@haystackeditor/cli 0.25.1 → 0.27.0

package/dist/commands/cloud-verifier-identity-census.js

@@ -1,4060 +0,0 @@
-import { createHash } from 'node:crypto';
-import { execFileSync } from 'node:child_process';
-import { existsSync, readFileSync, statSync } from 'node:fs';
-import { basename, extname, join, posix, resolve } from 'node:path';
-import fg from 'fast-glob';
-import { findGitRoot } from '../utils/hooks.js';
-import { scanPascalSelectorIdentities } from './cloud-verifier-pascal-selector-census.js';
-import { scanPythonManifestSelectorIdentities } from './cloud-verifier-python-manifest-selector-census.js';
-import { scanSpecializedOperationalIdentities } from './cloud-verifier-specialized-operational-census.js';
-import { detectDataStores, } from './cloud-verifier-data-store-census.js';
-export const IDENTITY_CENSUS_SCHEMA_VERSION = 'cloud-verifier-identity-census-v1';
-export const IDENTITY_CENSUS_CONTRACT_REVISION = 39;
-const MAX_SOURCE_BYTES = 4 * 1024 * 1024;
-const MAX_LOCKFILE_BYTES = 24 * 1024 * 1024;
-const MAX_EVIDENCE_TEXT_CHARS = 1_024;
-const MAX_SUPPORTING_TOKENS = 64;
-const LOCKFILE_NAMES = new Set([
-    'uv.lock',
-    'poetry.lock',
-    'pdm.lock',
-    'package-lock.json',
-    'npm-shrinkwrap.json',
-    'pnpm-lock.yaml',
-    'pnpm-lock.yml',
-    'yarn.lock',
-    'bun.lock',
-    'bun.lockb',
-    'cargo.lock',
-    'go.sum',
-    'gemfile.lock',
-    'composer.lock',
-]);
-const MANIFEST_NAMES = new Set([
-    'pyproject.toml',
-    'package.json',
-    'cargo.toml',
-    'go.mod',
-    'gemfile',
-    'composer.json',
-    'pom.xml',
-    'build.gradle',
-    'build.gradle.kts',
-]);
-const ALWAYS_SCAN_NAMES = new Set([
-    ...LOCKFILE_NAMES,
-    ...MANIFEST_NAMES,
-    'dockerfile',
-    'compose.yml',
-    'compose.yaml',
-    'docker-compose.yml',
-    'docker-compose.yaml',
-    'makefile',
-    'requirements.txt',
-    'requirements-prod.txt',
-    'requirements-production.txt',
-    'install.inf',
-]);
-const SOURCE_EXTENSIONS = new Set([
-    '.py', '.pyi', '.js', '.jsx', '.mjs', '.cjs', '.ts', '.tsx', '.mts', '.cts',
-    '.go', '.rs', '.rb', '.java', '.kt', '.kts', '.cs', '.php', '.swift', '.scala',
-    '.sh', '.bash', '.zsh', '.fish', '.ps1', '.sql', '.graphql', '.gql', '.proto',
-    '.toml', '.yaml', '.yml', '.json', '.xml', '.ini', '.cfg', '.conf', '.properties',
-    '.vue', '.pas', '.pp', '.inc', '.lpr', '.lpi', '.lpk', '.lfm', '.inf', '.plist',
-    '.desktop', '.control',
-]);
-const EXCLUDED_COMPONENTS = new Set([
-    '.git', '.hg', '.svn', '.haystack', '.agents', '.codex', '.claude',
-    '.venv', 'venv', 'node_modules', 'vendor', 'target',
-    'coverage', 'playwright-report', 'test-results', '__pycache__',
-    'test', 'tests', 'testapp', 'testapps', '__tests__', 'spec', 'specs', 'fixtures', '__fixtures__',
-    'examples', 'example', 'samples', 'sample', 'benchmarks', 'benchmark', 'docs', 'doc',
-]);
-// Repository modules often qualify a non-product purpose with the project name
-// (for example, "project-docs" or "project-samples"). Match those purposes as
-// exact structured component tokens, never as fuzzy substrings.
-const EXCLUDED_DIRECTORY_PURPOSE_TOKENS = new Set([
-    'benchmark', 'benchmarks', 'doc', 'docs', 'documentation', 'example', 'examples',
-    'fixture', 'fixtures', 'sample', 'samples', 'spec', 'specs', 'test', 'tests',
-]);
-// Files the data-store detector reads: dependency manifests, service manifests,
-// and config that name a database/cache/queue/store. A targeted, additive pass
-// that does not alter the identity census's own scan surface.
-const DATA_STORE_CONFIG_EXTENSIONS = new Set([
-    '.yml', '.yaml', '.toml', '.json', '.ini', '.conf', '.cfg', '.properties',
-    '.csproj', '.fsproj', '.vbproj', '.props',
-]);
-// Whether a file (by lowercased basename) is one the data-store detector reads.
-// Exported so the drift check can gate on it: a change that touches no such file
-// cannot alter the detected stores, so the drift check can skip it entirely.
-export function isDataStoreInputName(lowerName) {
-    // A lockfile is the full transitive tree, not a store declaration, and can be
-    // large — reading it (as a .json/.yaml) only wastes work and inflates
-    // omissions. The detector reads the direct manifest (package.json) instead.
-    if (LOCKFILE_NAMES.has(lowerName))
-        return false;
-    return MANIFEST_NAMES.has(lowerName)
-        || lowerName === 'mix.exs'
-        || lowerName === 'packages.config'
-        // Django names its database/cache backends in settings.py, and Elixir names
-        // its stores in conventional config scripts (config/runtime.exs, etc.). These
-        // are specific, conventional basenames the config-declaration patterns target
-        // — fed by name so the whole `.py`/`.exs` source surface stays out.
-        || lowerName === 'settings.py'
-        || lowerName === 'config.exs' || lowerName === 'runtime.exs'
-        || lowerName === 'prod.exs' || lowerName === 'dev.exs' || lowerName === 'releases.exs'
-        || lowerName.startsWith('requirements')
-        || lowerName === 'dockerfile' || lowerName.startsWith('dockerfile.') || lowerName.endsWith('.dockerfile')
-        || lowerName === '.env' || lowerName.startsWith('.env.')
-        || DATA_STORE_CONFIG_EXTENSIONS.has(extname(lowerName));
-}
-export function collectDataStores(root, tracked, omissions = []) {
-    const inputs = [];
-    for (const path of tracked) {
-        // Apply the census's own production-file boundary so this pass matches the
-        // identity records. This excludes the verifier's checked-in map
-        // (`.haystack/cloud-verifier/*.yml`, whose `image: postgres` evidence would
-        // otherwise mint stores from the map itself), plus test/example/vendor trees
-        // — a compose under `examples/` or `tests/` is not the app's own store. The
-        // drift check reuses this collector, so it inherits the same boundary.
-        if (isTestLike(path))
-            continue;
-        const lowerName = basename(path).toLowerCase();
-        if (!isDataStoreInputName(lowerName))
-            continue;
-        const absolute = join(root, path);
-        try {
-            if (!existsSync(absolute) || !statSync(absolute).isFile())
-                continue;
-            if (statSync(absolute).size > MAX_SOURCE_BYTES) {
-                omissions.push({ path, reason: 'data-store-input-over-size-limit' });
-                continue;
-            }
-            const bytes = readFileSync(absolute);
-            if (bytes.includes(0))
-                continue; // skip binary files
-            inputs.push({ path, lowerName, text: bytes.toString('utf8') });
-        }
-        catch {
-            // This pass reads files the main scan may not (.env, Dockerfiles,
-            // .csproj/.props, .ini), so its read failures are not covered by the
-            // main omission list — record them here so the gap stays visible.
-            omissions.push({ path, reason: 'data-store-input-unreadable' });
-        }
-    }
-    return detectDataStores(inputs);
-}
-function sha256(value) {
-    return createHash('sha256').update(value).digest('hex');
-}
-function stableId(kind, identityKey) {
-    const slug = kind.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '');
-    return `census-${slug}-${sha256(`${kind}\0${identityKey}`).slice(0, 20)}`;
-}
-function recordStableId(kind, path, owner, identity) {
-    return stableId(kind, `${path}#${owner}:${identity}`);
-}
-function normalizePath(path) {
-    return path.split(posix.sep).join('/').replace(/^\.\//, '');
-}
-function isTestLike(path) {
-    const sourceComponents = normalizePath(path).split('/');
-    const normalized = sourceComponents.join('/').toLowerCase();
-    const name = basename(normalized);
-    const components = normalized.split('/');
-    const productionSourceIndex = components.findIndex((component, index) => component === 'src' && components[index + 1] === 'main');
-    const insideProductionNamespace = (index) => productionSourceIndex >= 0 && index > productionSourceIndex + 1;
-    if (components.some((component, index) => !insideProductionNamespace(index) && EXCLUDED_COMPONENTS.has(component)))
-        return true;
-    const directoryHasExcludedPurpose = sourceComponents.slice(0, -1).some((component, index) => {
-        if (insideProductionNamespace(index))
-            return false;
-        const tokens = component
-            .replace(/([a-z0-9])([A-Z])/g, '$1-$2')
-            .toLowerCase()
-            .split(/[^a-z0-9]+/)
-            .filter(Boolean);
-        return tokens.some((token) => EXCLUDED_DIRECTORY_PURPOSE_TOKENS.has(token));
-    });
-    if (directoryHasExcludedPurpose)
-        return true;
-    if (ALWAYS_SCAN_NAMES.has(name))
-        return false;
-    return /(?:^|[._-])(test|tests|spec|fixture|mock)(?:[._-]|$)/.test(name)
-        || /^(?:test_|conftest\.)/.test(name)
-        || /(?:^|\.)stories\.[^.]+$/.test(name);
-}
-function shouldScan(path) {
-    const normalized = normalizePath(path);
-    const lowerName = basename(normalized).toLowerCase();
-    if (isTestLike(normalized))
-        return false;
-    if (ALWAYS_SCAN_NAMES.has(lowerName))
-        return true;
-    if (normalized.startsWith('.github/workflows/'))
-        return true;
-    if (normalized.startsWith('deploy/') || normalized.startsWith('deployment/') || normalized.startsWith('infra/'))
-        return true;
-    return SOURCE_EXTENSIONS.has(extname(lowerName));
-}
-function trackedFiles(root) {
-    try {
-        return execFileSync('git', ['-C', root, 'ls-files', '-z'], {
-            encoding: 'utf8',
-            maxBuffer: 64 * 1024 * 1024,
-            stdio: ['ignore', 'pipe', 'ignore'],
-        }).split('\0').filter(Boolean).map(normalizePath)
-            .filter((path) => !path.startsWith('.haystack/'))
-            .sort();
-    }
-    catch {
-        // Same entries as glob's { dot: true, nodir: true }: every non-directory,
-        // with symlinks listed as themselves and never followed.
-        return fg.sync('**/*', { cwd: root, dot: true, onlyFiles: false, followSymbolicLinks: false, markDirectories: true })
-            .filter((path) => !path.endsWith('/'))
-            .map(normalizePath)
-            .filter((path) => !path.startsWith('.git/') &&
-            !path.startsWith('.haystack/') &&
-            !path.includes('/node_modules/'))
-            .sort();
-    }
-}
-function gitObjectId(root, revision) {
-    try {
-        const value = execFileSync('git', ['-C', root, 'rev-parse', '--verify', revision], {
-            encoding: 'utf8',
-            maxBuffer: 1024 * 1024,
-            stdio: ['ignore', 'pipe', 'ignore'],
-        }).trim();
-        return /^[0-9a-f]{40}$/.test(value) ? value : null;
-    }
-    catch {
-        return null;
-    }
-}
-function textLines(root, path) {
-    const absolute = join(root, path);
-    const lowerName = basename(path).toLowerCase();
-    const maxBytes = LOCKFILE_NAMES.has(lowerName) ? MAX_LOCKFILE_BYTES : MAX_SOURCE_BYTES;
-    const stat = statSync(absolute);
-    if (!stat.isFile() || stat.size > maxBytes)
-        return null;
-    const bytes = readFileSync(absolute);
-    if (bytes.includes(0))
-        return null;
-    return bytes.toString('utf8').split(/\r?\n/);
-}
-// Compatibility for typed records introduced before proof_status became part
-// of the census contract. New scanners must set proofStatus explicitly; this
-// set only preserves the already-structured rev35/rev36 emitters.
-const LEGACY_PROOF_COMPLETE_KINDS = new Set([
-    'locked-production-package-artifact-state',
-    'locked-production-package-artifact-install-operation',
-    'python-installation-profile-state',
-    'python-requirements-installation-profile-state',
-    'python-requirement-variant-state',
-    'python-requirements-profile-install-operation',
-    'exact-operation-matrix-member',
-    'maven-product-distribution-state',
-    'maven-installation-profile-state',
-    'maven-dependency-requirement-state',
-    'maven-plugin-dependency-requirement-state',
-    'maven-build-plugin-requirement-state',
-    'maven-plugin-execution-entrypoint-state',
-    'browser-keyed-storage-state',
-    'workflow-publication-stage-state',
-    'workflow-product-publication-runtime-unit',
-    'workflow-publication-secret-read-operation',
-    'workflow-publication-command-operation',
-    'workflow-publication-trigger-operation',
-    'workflow-publication-action-operation',
-    'workflow-publication-host-allocation-operation',
-    'browser-mounted-application-role',
-    'browser-supervised-subscription-role',
-    'spring-managed-lifecycle-role',
-    'java-annotated-lifecycle-role',
-    'java-supervised-worker-role',
-    'spring-static-resource-inbound-operation',
-    'spring-controller-inbound-operation',
-    'vue-local-component-family',
-    'vue-local-directive-family',
-    'vue-global-component-family',
-    'vue-global-directive-family',
-    'vue-selector-entry',
-    'vue-selector-edge',
-    'java-annotated-command-family',
-    'java-annotated-command-entry',
-    'java-json-subtype-family',
-    'java-json-subtype-entry',
-    'java-deserializer-family',
-    'java-deserializer-entry',
-    'java-spring-bean-alternative-family',
-    'java-spring-bean-alternative-entry',
-    'java-selector-edge',
-]);
-function addRecord(records, input) {
-    const identityKey = `${input.path}#${input.owner}:${input.identity}`;
-    const id = stableId(input.kind, identityKey);
-    if (records.has(id))
-        return;
-    const proofStatus = input.proofStatus ?? (LEGACY_PROOF_COMPLETE_KINDS.has(input.kind)
-        ? 'proof-complete'
-        : input.presumptiveInventory ? 'discovery-lead' : 'non-inventory');
-    // Proof-complete records are mandatory finals. Operational discovery leads
-    // are also presumptive inventory: every exact source observation must be
-    // resolved to a mapped identity or an evidenced exclusion instead of
-    // disappearing behind an inventory-complete receipt. Registry-only leads
-    // remain in the selector-surface census until structured proof upgrades them.
-    const presumptiveInventory = proofStatus === 'proof-complete' || (proofStatus === 'discovery-lead' &&
-        input.projections.some((projection) => projection === 'runtime_roles' ||
-            projection === 'stateful_resources' ||
-            projection === 'external_dependencies'));
-    const rawIdentityComponents = {
-        ...(input.identityComponents ?? {}),
-    };
-    if (proofStatus === 'proof-complete') {
-        rawIdentityComponents.identity_kind ??= input.kind;
-        rawIdentityComponents.production_provenance ??= `repository-source:${input.path}`;
-        rawIdentityComponents.owner_identity ??= `${input.path}#${input.owner}`;
-        if (input.projections.includes('registry_families')) {
-            rawIdentityComponents.selector_domain ??= input.identity;
-        }
-        if (input.projections.includes('registry_entries')) {
-            if (input.selectorKey !== undefined)
-                rawIdentityComponents.selector_key ??= input.selectorKey;
-            if (input.implementationKey !== undefined) {
-                rawIdentityComponents.implementation_identity ??= input.implementationKey;
-            }
-        }
-        if (input.projections.includes('registry_edges')) {
-            if (input.parentSelectorEntryRecordId !== undefined) {
-                rawIdentityComponents.parent_entry_identity ??= input.parentSelectorEntryRecordId;
-            }
-            if (input.childSelectorFamilyRecordId !== undefined) {
-                rawIdentityComponents.child_family_identity ??= input.childSelectorFamilyRecordId;
-            }
-            if (input.relationKind !== undefined)
-                rawIdentityComponents.relation_kind ??= input.relationKind;
-        }
-        if (input.projections.includes('runtime_roles')) {
-            rawIdentityComponents.controller_kind ??= input.kind.startsWith('workflow-')
-                ? 'workflow'
-                : input.kind.startsWith('browser-') ? 'browser-host'
-                    : input.kind.startsWith('spring-') ? 'spring-container'
-                        : input.kind.startsWith('java-') ? 'jvm-application'
-                            : 'source-declared';
-            rawIdentityComponents.entrypoint_identity ??= input.identity;
-            rawIdentityComponents.lifecycle_kind ??= input.operationToken ?? input.kind;
-            if (input.kind === 'workflow-product-publication-runtime-unit') {
-                rawIdentityComponents.production_operational_unit ??= 'true';
-                rawIdentityComponents.production_effect_kind ??= 'deploy';
-            }
-        }
-        if (input.projections.includes('stateful_resources')) {
-            rawIdentityComponents.address_grammar ??=
-                input.addressToken ?? input.materializationRootIdentityKey ??
-                    input.packageArtifactUrl ?? input.packageArtifactFilename ?? input.identity;
-            rawIdentityComponents.reproduction_operation ??=
-                input.reproductionOperationToken ?? input.operationToken ?? `manifest-derived:${input.kind}`;
-        }
-        if (input.projections.includes('external_dependencies')) {
-            rawIdentityComponents.boundary_kind ??= input.kind;
-            rawIdentityComponents.direction ??= input.kind.includes('inbound') ? 'inbound' : 'outbound';
-            rawIdentityComponents.operation_identity ??=
-                input.operationIdentityKey ?? input.operationToken ?? input.identity;
-            rawIdentityComponents.target_identity ??=
-                input.addressToken ?? input.packageArtifactUrl ?? input.identity;
-            rawIdentityComponents.object_identity ??=
-                input.packageArtifactFilename ?? input.identity;
-            rawIdentityComponents.flow_stage ??= input.operationToken ?? input.kind;
-        }
-    }
-    const identityComponents = Object.keys(rawIdentityComponents).length === 0
-        ? undefined
-        : Object.fromEntries(Object.entries(rawIdentityComponents)
-            .sort(([left], [right]) => left.localeCompare(right))
-            .map(([key, value]) => [key, Array.isArray(value) ? [...value] : value]));
-    const missingProofComponents = input.missingProofComponents ?? (proofStatus === 'proof-complete' ? [] : undefined);
-    records.set(id, {
-        id,
-        kind: input.kind,
-        projections: [...new Set(input.projections)].sort(),
-        presumptive_inventory: presumptiveInventory,
-        proof_status: proofStatus,
-        ...(proofStatus !== 'proof-complete' ? {} : {
-            semantic_identity_id: stableId('semantic-identity-v1', input.semanticIdentityKey ?? identityKey),
-        }),
-        ...(input.executionIdentityKey === undefined ? {} : {
-            execution_identity_id: stableId('execution-identity-v1', input.executionIdentityKey),
-        }),
-        ...(identityComponents === undefined ? {} : { identity_components: identityComponents }),
-        ...(missingProofComponents === undefined ? {} : {
-            missing_proof_components: [...new Set(missingProofComponents)].sort(),
-        }),
-        owner_identity_key: `${input.path}#${input.owner}`,
-        identity_key: identityKey,
-        ...(input.selectorKey === undefined ? {} : { selector_key: input.selectorKey }),
-        ...(input.implementationKey === undefined ? {} : { implementation_key: input.implementationKey }),
-        ...(input.operationToken === undefined ? {} : { operation_token: input.operationToken }),
-        ...(input.addressToken === undefined ? {} : { address_token: input.addressToken }),
-        ...(input.packageName === undefined ? {} : { package_name: input.packageName }),
-        ...(input.packageVersion === undefined ? {} : { package_version: input.packageVersion }),
-        ...(input.packageArtifactKind === undefined ? {} : { package_artifact_kind: input.packageArtifactKind }),
-        ...(input.packageArtifactFilename === undefined ? {} : { package_artifact_filename: input.packageArtifactFilename }),
-        ...(input.packageArtifactUrl === undefined ? {} : { package_artifact_url: input.packageArtifactUrl }),
-        ...(input.packageArtifactHash === undefined ? {} : { package_artifact_hash: input.packageArtifactHash }),
-        ...(input.operationIdentityKey === undefined ? {} : { operation_identity_key: input.operationIdentityKey }),
-        ...(input.materializationRootIdentityKey === undefined ? {} : {
-            materialization_root_identity_key: input.materializationRootIdentityKey,
-        }),
-        ...(input.reproductionOperationToken === undefined ? {} : {
-            reproduction_operation_token: input.reproductionOperationToken,
-        }),
-        ...(input.matrixAxes === undefined ? {} : {
-            matrix_axes: input.matrixAxes.map((axis) => ({
-                ...axis,
-                source: {
-                    ...axis.source,
-                    anchor: boundedEvidenceText(axis.source.anchor),
-                },
-            })),
-        }),
-        ...(input.selectorFamilyRecordId === undefined ? {} : {
-            selector_family_record_id: input.selectorFamilyRecordId,
-        }),
-        ...(input.parentSelectorEntryRecordId === undefined ? {} : {
-            parent_selector_entry_record_id: input.parentSelectorEntryRecordId,
-        }),
-        ...(input.childSelectorFamilyRecordId === undefined ? {} : {
-            child_selector_family_record_id: input.childSelectorFamilyRecordId,
-        }),
-        ...(input.relationKind === undefined ? {} : { relation_kind: input.relationKind }),
-        source: {
-            path: input.path,
-            start_line: input.line,
-            end_line: input.endLine ?? input.line,
-            anchor: boundedEvidenceText(input.anchor),
-        },
-        supporting_tokens: [...new Set(input.tokens.filter(Boolean))]
-            .slice(0, MAX_SUPPORTING_TOKENS)
-            .map(boundedEvidenceText),
-    });
-}
-function boundedEvidenceText(value) {
-    if (value.length <= MAX_EVIDENCE_TEXT_CHARS)
-        return value;
-    const digest = createHash('sha256').update(value).digest('hex');
-    const retained = Math.floor((MAX_EVIDENCE_TEXT_CHARS - digest.length - 32) / 2);
-    return `${value.slice(0, retained)} … [sha256:${digest}] … ${value.slice(-retained)}`;
-}
-function indentation(line) {
-    const prefix = line.match(/^\s*/)?.[0] ?? '';
-    return [...prefix].reduce((total, char) => total + (char === '\t' ? 8 : 1), 0);
-}
-function pythonOwners(path, lines) {
-    const owners = [];
-    const stack = [];
-    lines.forEach((line, index) => {
-        const trimmed = line.trim();
-        const indent = indentation(line);
-        const continuingSignature = stack.at(-1)?.signatureDepth ?? 0;
-        if (continuingSignature === 0 &&
-            trimmed &&
-            !trimmed.startsWith('#') &&
-            !trimmed.startsWith('@')) {
-            while (stack.length > 0 && indent <= stack[stack.length - 1].indent)
-                stack.pop();
-        }
-        const match = line.match(/^\s*(?:async\s+def|def|class)\s+([A-Za-z_][A-Za-z0-9_]*)/);
-        if (match)
-            stack.push({
-                indent,
-                name: match[1],
-                signatureDepth: Math.max(0, parenthesisDelta(line.slice(match.index ?? 0))),
-            });
-        else if (stack.length > 0 && stack[stack.length - 1].signatureDepth > 0) {
-            stack[stack.length - 1].signatureDepth = Math.max(0, stack[stack.length - 1].signatureDepth + parenthesisDelta(line));
-        }
-        owners[index] = stack.length > 0 ? stack.map((entry) => entry.name).join('.') : basename(path);
-    });
-    return owners;
-}
-function collectionBracketDelta(value) {
-    let delta = 0;
-    let quote = null;
-    let escaped = false;
-    for (const char of value) {
-        if (escaped) {
-            escaped = false;
-            continue;
-        }
-        if (char === '\\') {
-            escaped = true;
-            continue;
-        }
-        if (quote) {
-            if (char === quote)
-                quote = null;
-            continue;
-        }
-        if (char === "'" || char === '"') {
-            quote = char;
-            continue;
-        }
-        if (char === '[' || char === '(' || char === '{')
-            delta += 1;
-        if (char === ']' || char === ')' || char === '}')
-            delta -= 1;
-    }
-    return delta;
-}
-function pythonModuleName(path) {
-    const withoutExtension = normalizePath(path).replace(/\.pyi?$/, '');
-    const withoutSourceRoot = withoutExtension.startsWith('src/')
-        ? withoutExtension.slice(4)
-        : withoutExtension;
-    return withoutSourceRoot.replace(/\/__init__$/, '').replaceAll('/', '.');
-}
-function stripPythonComment(value) {
-    let quote = null;
-    let escaped = false;
-    for (let index = 0; index < value.length; index += 1) {
-        const char = value[index];
-        if (escaped) {
-            escaped = false;
-            continue;
-        }
-        if (char === '\\') {
-            escaped = true;
-            continue;
-        }
-        if (quote) {
-            if (char === quote)
-                quote = null;
-            continue;
-        }
-        if (char === "'" || char === '"') {
-            quote = char;
-            continue;
-        }
-        if (char === '#')
-            return value.slice(0, index);
-    }
-    return value;
-}
-function parsePythonLiteralCollections(path, lines) {
-    const collections = new Map();
-    for (let index = 0; index < lines.length; index += 1) {
-        const assignment = lines[index].match(/^([A-Z][A-Z0-9_]*)\s*(?::[^=]+)?=\s*(\[|\()/);
-        if (!assignment)
-            continue;
-        const start = index;
-        let end = index;
-        let depth = collectionBracketDelta(lines[index].slice(lines[index].indexOf(assignment[2])));
-        while (depth > 0 && end + 1 < lines.length && end - start < 10_000) {
-            end += 1;
-            depth += collectionBracketDelta(lines[end]);
-        }
-        if (depth !== 0)
-            continue;
-        const symbol = assignment[1];
-        const symbolIdentityKey = `${path}#${symbol}`;
-        const items = [];
-        for (let itemLine = start; itemLine <= end; itemLine += 1) {
-            const text = stripPythonComment(itemLine === start
-                ? lines[itemLine].slice(lines[itemLine].indexOf(assignment[2]) + 1)
-                : lines[itemLine]);
-            for (const match of text.matchAll(/(['"])(.*?)\1|\b-?\d+(?:\.\d+)?\b/g)) {
-                const value = match[2] ?? match[0];
-                const ordinal = items.length;
-                items.push({
-                    value,
-                    identityKey: `${symbolIdentityKey}[${ordinal}]`,
-                    source: {
-                        path,
-                        start_line: itemLine + 1,
-                        end_line: itemLine + 1,
-                        anchor: lines[itemLine],
-                    },
-                });
-            }
-        }
-        if (items.length === 0)
-            continue;
-        collections.set(symbol, {
-            symbol,
-            symbolIdentityKey,
-            source: {
-                path,
-                start_line: start + 1,
-                end_line: end + 1,
-                anchor: lines[start],
-            },
-            items,
-        });
-        index = end;
-    }
-    return collections;
-}
-function bindPythonLiteralCollections(path, lines, ownCollections, collectionsByModule) {
-    const bindings = new Map(ownCollections);
-    for (const line of lines) {
-        const fromImport = line.match(/^\s*from\s+([A-Za-z_][A-Za-z0-9_.]*)\s+import\s+(.+)$/);
-        if (fromImport) {
-            const imported = collectionsByModule.get(fromImport[1]);
-            if (!imported)
-                continue;
-            for (const rawSymbol of fromImport[2].replace(/[()]/g, '').split(',')) {
-                const symbol = rawSymbol.trim().match(/^([A-Za-z_][A-Za-z0-9_]*)(?:\s+as\s+([A-Za-z_][A-Za-z0-9_]*))?/);
-                if (!symbol)
-                    continue;
-                const collection = imported.get(symbol[1]);
-                if (collection)
-                    bindings.set(symbol[2] ?? symbol[1], collection);
-            }
-            continue;
-        }
-        const moduleImport = line.match(/^\s*import\s+([A-Za-z_][A-Za-z0-9_.]*)(?:\s+as\s+([A-Za-z_][A-Za-z0-9_]*))?/);
-        if (!moduleImport)
-            continue;
-        const imported = collectionsByModule.get(moduleImport[1]);
-        if (!imported)
-            continue;
-        const prefix = moduleImport[2] ?? moduleImport[1].split('.').at(-1);
-        for (const [symbol, collection] of imported) {
-            bindings.set(`${prefix}.${symbol}`, collection);
-        }
-    }
-    return bindings;
-}
-function pythonFunctionDefinitions(lines) {
-    const functions = new Map();
-    for (let index = 0; index < lines.length; index += 1) {
-        const match = lines[index].match(/^(\s*)(?:async\s+def|def)\s+([A-Za-z_][A-Za-z0-9_]*)\s*\(/);
-        if (!match)
-            continue;
-        const indent = indentation(match[1]);
-        let signatureEnd = index;
-        let signatureDepth = parenthesisDelta(lines[index].slice(lines[index].indexOf('(')));
-        while (signatureDepth > 0 && signatureEnd + 1 < lines.length) {
-            signatureEnd += 1;
-            signatureDepth += parenthesisDelta(lines[signatureEnd]);
-        }
-        let end = lines.length;
-        for (let cursor = signatureEnd + 1; cursor < lines.length; cursor += 1) {
-            const trimmed = lines[cursor].trim();
-            if (trimmed && !trimmed.startsWith('#') && indentation(lines[cursor]) <= indent) {
-                end = cursor;
-                break;
-            }
-        }
-        functions.set(match[2], {
-            name: match[2],
-            startLine: index + 1,
-            endLine: end,
-            indent,
-        });
-    }
-    return functions;
-}
-function mergePythonAxes(...groups) {
-    const byIdentity = new Map();
-    for (const group of groups) {
-        for (const collection of group)
-            byIdentity.set(collection.symbolIdentityKey, collection);
-    }
-    return [...byIdentity.values()].sort((left, right) => left.symbolIdentityKey.localeCompare(right.symbolIdentityKey));
-}
-function pythonAxisSetKey(axes) {
-    return axes.map((axis) => axis.symbolIdentityKey).sort().join('\0');
-}
-function analyzePythonOperationMatrices(path, lines, collectionBindings) {
-    const functions = pythonFunctionDefinitions(lines);
-    const loopsByFunction = new Map();
-    const callEdges = [];
-    const incoming = new Map([...functions.keys()].map((name) => [name, 0]));
-    for (const definition of functions.values()) {
-        const loops = [];
-        for (let lineIndex = definition.startLine; lineIndex < definition.endLine; lineIndex += 1) {
-            const line = lines[lineIndex];
-            const loop = line.match(/^\s*(?:async\s+)?for\s+.+?\s+in\s+(?:enumerate\(\s*)?([A-Za-z_][A-Za-z0-9_.]*)(?:\s*\))?\s*:/);
-            if (loop) {
-                const collection = collectionBindings.get(loop[1]);
-                if (collection) {
-                    const loopIndent = indentation(line);
-                    let loopEnd = definition.endLine;
-                    for (let cursor = lineIndex + 1; cursor < definition.endLine; cursor += 1) {
-                        const current = lines[cursor].trim();
-                        if (current && !current.startsWith('#') && indentation(lines[cursor]) <= loopIndent) {
-                            loopEnd = cursor;
-                            break;
-                        }
-                    }
-                    loops.push({ startLine: lineIndex + 1, endLine: loopEnd, collection });
-                }
-            }
-            for (const callee of functions.keys()) {
-                if (lineIndex + 1 === functions.get(callee)?.startLine)
-                    continue;
-                const escaped = callee.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-                if (!new RegExp(`\\b${escaped}\\s*\\(`).test(line))
-                    continue;
-                const loopAxes = loops
-                    .filter((candidate) => candidate.startLine <= lineIndex + 1 && lineIndex + 1 <= candidate.endLine)
-                    .map((candidate) => candidate.collection);
-                const argumentAxes = [...collectionBindings.entries()]
-                    .filter(([binding]) => {
-                    const escapedBinding = binding.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-                    return new RegExp(`\\b${escapedBinding}\\b`).test(line);
-                })
-                    .map(([, collection]) => collection);
-                callEdges.push({
-                    caller: definition.name,
-                    callee,
-                    line: lineIndex + 1,
-                    axes: mergePythonAxes(loopAxes, argumentAxes),
-                });
-                incoming.set(callee, (incoming.get(callee) ?? 0) + 1);
-            }
-        }
-        loopsByFunction.set(definition.name, loops);
-    }
-    const contextsByFunction = new Map();
-    for (const name of functions.keys()) {
-        contextsByFunction.set(name, incoming.get(name) === 0 ? [[]] : []);
-    }
-    let changed = true;
-    for (let pass = 0; changed && pass < functions.size * 4 + 4; pass += 1) {
-        changed = false;
-        for (const edge of callEdges) {
-            const callerContexts = contextsByFunction.get(edge.caller) ?? [];
-            const calleeContexts = contextsByFunction.get(edge.callee) ?? [];
-            const existing = new Set(calleeContexts.map(pythonAxisSetKey));
-            for (const callerContext of callerContexts) {
-                const context = mergePythonAxes(callerContext, edge.axes);
-                const key = pythonAxisSetKey(context);
-                if (existing.has(key))
-                    continue;
-                calleeContexts.push(context);
-                existing.add(key);
-                changed = true;
-            }
-            contextsByFunction.set(edge.callee, calleeContexts);
-        }
-    }
-    return { path, lines, functions, loopsByFunction, contextsByFunction };
-}
-function scanPythonExecutableEntrypoint(path, lines, records) {
-    const functions = pythonFunctionDefinitions(lines);
-    for (let index = 0; index < lines.length; index += 1) {
-        const guard = lines[index].match(/^\s*if\s+(?:__name__\s*==\s*(['"])__main__\1|(['"])__main__\2\s*==\s*__name__)\s*:/);
-        if (!guard)
-            continue;
-        const guardIndent = indentation(lines[index]);
-        let end = lines.length;
-        for (let cursor = index + 1; cursor < lines.length; cursor += 1) {
-            const trimmed = lines[cursor].trim();
-            if (trimmed && !trimmed.startsWith('#') && indentation(lines[cursor]) <= guardIndent) {
-                end = cursor;
-                break;
-            }
-        }
-        const implementations = [...functions.keys()].filter((name) => {
-            const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-            return lines.slice(index + 1, end).some((line) => new RegExp(`\\b${escaped}\\s*\\(`).test(line));
-        });
-        addRecord(records, {
-            kind: 'python-executable-entrypoint-role',
-            projections: ['runtime_roles'],
-            presumptiveInventory: true,
-            path,
-            line: index + 1,
-            anchor: lines[index],
-            owner: '__main__',
-            identity: `python-script:${path}:__main__`,
-            tokens: [path, '__main__', ...implementations],
-            implementationKey: implementations.join('|') || 'module-body',
-            operationToken: 'execute-python-script',
-            addressToken: path,
-            operationIdentityKey: `${path}#__main__`,
-        });
-    }
-}
-function scanPythonEmbeddedConfiguration(path, lines, collections, importedCollectionIdentityKeys, records) {
-    for (const collection of collections.values()) {
-        const used = importedCollectionIdentityKeys.has(collection.symbolIdentityKey) || lines.some((line, index) => index + 1 !== collection.source.start_line &&
-            new RegExp(`\\b${collection.symbol}\\b`).test(line));
-        if (!used)
-            continue;
-        addRecord(records, {
-            kind: 'python-embedded-configuration-state',
-            projections: ['stateful_resources'],
-            presumptiveInventory: true,
-            path,
-            line: collection.source.start_line,
-            anchor: collection.source.anchor,
-            owner: 'module-configuration',
-            identity: `embedded-configuration:${collection.symbolIdentityKey}`,
-            tokens: [collection.symbol, ...collection.items.map((item) => item.value)],
-            addressToken: collection.symbol,
-            materializationRootIdentityKey: collection.symbolIdentityKey,
-        });
-    }
-    lines.forEach((line, index) => {
-        const template = line.match(/^([A-Z][A-Z0-9_]*)\s*(?::[^=]+)?=\s*(?:[rubfRUBF]*)?(?:'''|""")/);
-        if (!template)
-            return;
-        const symbol = template[1];
-        const used = lines.some((candidate, candidateIndex) => candidateIndex !== index && new RegExp(`\\b${symbol}\\b`).test(candidate));
-        if (!used)
-            return;
-        addRecord(records, {
-            kind: 'python-embedded-template-state',
-            projections: ['stateful_resources'],
-            presumptiveInventory: true,
-            path,
-            line: index + 1,
-            anchor: line,
-            owner: 'module-configuration',
-            identity: `embedded-template:${path}#${symbol}`,
-            tokens: [symbol],
-            addressToken: symbol,
-            materializationRootIdentityKey: `${path}#${symbol}`,
-        });
-    });
-}
-const EXACT_MATRIX_OPERATION_KINDS = new Set([
-    'client-boundary-operation',
-    'http-operation',
-    'http-wrapper-operation',
-    'imported-sdk-instance-operation',
-    'socket-operation',
-]);
-function cartesianMatrixAxes(axes, limit = 25_000) {
-    const cardinality = axes.reduce((total, axis) => total * axis.items.length, 1);
-    if (!Number.isSafeInteger(cardinality) || cardinality > limit)
-        return null;
-    let rows = [[]];
-    for (const axis of axes) {
-        const next = [];
-        for (const row of rows) {
-            for (const item of axis.items) {
-                next.push([...row, {
-                        symbol_identity_key: axis.symbolIdentityKey,
-                        item_identity_key: item.identityKey,
-                        item_value: item.value,
-                        source: item.source,
-                    }]);
-            }
-        }
-        rows = next;
-    }
-    return rows;
-}
-function emitPythonExactOperationMatrices(analysis, records) {
-    const groups = new Map();
-    for (const record of records.values()) {
-        if (record.source.path !== analysis.path ||
-            !EXACT_MATRIX_OPERATION_KINDS.has(record.kind) ||
-            !record.projections.includes('external_dependencies') ||
-            !record.operation_token)
-            continue;
-        const owner = record.owner_identity_key.slice(record.owner_identity_key.indexOf('#') + 1);
-        if (!analysis.functions.has(owner))
-            continue;
-        const key = `${owner}\0${record.source.start_line}\0${record.operation_token}`;
-        const group = groups.get(key) ?? [];
-        group.push(record);
-        groups.set(key, group);
-    }
-    for (const group of groups.values()) {
-        const representative = [...group].sort((left, right) => Number(right.presumptive_inventory) - Number(left.presumptive_inventory) ||
-            left.kind.localeCompare(right.kind))[0];
-        const owner = representative.owner_identity_key.slice(representative.owner_identity_key.indexOf('#') + 1);
-        const contexts = analysis.contextsByFunction.get(owner) ?? [];
-        const localAxes = (analysis.loopsByFunction.get(owner) ?? [])
-            .filter((loop) => loop.startLine <= representative.source.start_line &&
-            representative.source.start_line <= loop.endLine)
-            .map((loop) => loop.collection);
-        const axisSets = new Map();
-        let hasUnexpandedInvocation = false;
-        for (const context of contexts) {
-            const axes = mergePythonAxes(context, localAxes);
-            if (axes.length === 0) {
-                hasUnexpandedInvocation = true;
-                continue;
-            }
-            axisSets.set(pythonAxisSetKey(axes), axes);
-        }
-        if (axisSets.size === 0)
-            continue;
-        const operationToken = representative.operation_token;
-        const callsiteIdentity = `${analysis.path}#${owner}:${operationToken}` +
-            `@${representative.source.start_line}`;
-        for (const axes of axisSets.values()) {
-            const matrixRows = cartesianMatrixAxes(axes);
-            if (!matrixRows) {
-                hasUnexpandedInvocation = true;
-                continue;
-            }
-            for (const matrixAxes of matrixRows) {
-                const itemIdentity = matrixAxes.map((axis) => axis.item_identity_key).join('|');
-                const operationIdentityKey = `${callsiteIdentity}:${itemIdentity}`;
-                addRecord(records, {
-                    kind: 'exact-operation-matrix-member',
-                    projections: ['external_dependencies'],
-                    presumptiveInventory: true,
-                    path: analysis.path,
-                    line: representative.source.start_line,
-                    anchor: representative.source.anchor,
-                    owner,
-                    identity: operationIdentityKey,
-                    tokens: [
-                        operationToken,
-                        ...matrixAxes.map((axis) => axis.item_value),
-                    ],
-                    operationToken,
-                    addressToken: matrixAxes.map((axis) => axis.item_value).join('|'),
-                    operationIdentityKey,
-                    matrixAxes,
-                });
-            }
-        }
-        if (!hasUnexpandedInvocation) {
-            for (const record of group)
-                record.presumptive_inventory = false;
-        }
-    }
-}
-function executableLineMask(path, lines) {
-    const extension = extname(path.toLowerCase());
-    if (extension === '.pyi' || path.endsWith('.d.ts'))
-        return lines.map(() => false);
-    if (extension === '.vue') {
-        let inScript = false;
-        return lines.map((line) => {
-            if (/<script(?:\s[^>]*)?>/i.test(line)) {
-                inScript = true;
-                return false;
-            }
-            if (/<\/script>/i.test(line)) {
-                inScript = false;
-                return false;
-            }
-            const trimmed = line.trim();
-            return inScript && Boolean(trimmed) &&
-                !trimmed.startsWith('//') && !trimmed.startsWith('/*') && !trimmed.startsWith('*');
-        });
-    }
-    if (extension !== '.py') {
-        return lines.map((line) => {
-            const trimmed = line.trim();
-            return Boolean(trimmed) && !trimmed.startsWith('//') && !trimmed.startsWith('/*') && !trimmed.startsWith('*');
-        });
-    }
-    let delimiter = null;
-    return lines.map((line) => {
-        const trimmed = line.trim();
-        if (delimiter) {
-            const end = line.indexOf(delimiter);
-            if (end >= 0)
-                delimiter = null;
-            return false;
-        }
-        if (!trimmed || trimmed.startsWith('#'))
-            return false;
-        const single = line.indexOf("'''");
-        const double = line.indexOf('"""');
-        const start = single < 0 ? double : (double < 0 ? single : Math.min(single, double));
-        if (start < 0)
-            return true;
-        const selected = start === single ? "'''" : '"""';
-        if (line.indexOf(selected, start + 3) < 0)
-            delimiter = selected;
-        return start > 0 && Boolean(line.slice(0, start).trim());
-    });
-}
-function literalTokens(value) {
-    const tokens = [];
-    for (const match of value.matchAll(/(['"])(.*?)\1|\b(?:true|false|null|none)\b|\b-?\d+(?:\.\d+)?\b/gi)) {
-        const token = match[2] ?? match[0];
-        if (!tokens.includes(token))
-            tokens.push(token);
-    }
-    return tokens;
-}
-function selectorProjections(base, selectorSurface) {
-    const projections = [base];
-    if (/(?:^|[^a-z])(?:api|backend|callback|client|command|endpoint|event|export|format|grant|handler|hook|http|integration|listener|message|method|operation|provider|protocol|request|response|route|sdk|signal|stream|transport|url)(?:[^a-z]|$)/i
-        .test(selectorSurface)) {
-        projections.push('external_dependencies');
-    }
-    if (/(?:^|[^a-z])(?:cache|caches|callback|callbacks|config|configs|configuration|credential|credentials|hook|hooks|installed|patch|patches|plugin|plugins|queue|queues|registry|registries|session|sessions|state|states|store|stores|token|tokens|variable|variables|wrapper|wrappers)(?:[^a-z]|$)/i
-        .test(selectorSurface)) {
-        projections.push('stateful_resources');
-    }
-    return projections;
-}
-function scanPythonSelectors(path, lines, owners, executable, records) {
-    const activeChains = new Map();
-    lines.forEach((line, index) => {
-        if (!executable[index])
-            return;
-        const lineNumber = index + 1;
-        const indent = indentation(line);
-        const branch = line.match(/^\s*(if|elif)\s+(.+):\s*(?:#.*)?$/);
-        if (branch) {
-            const owner = owners[index];
-            const prior = activeChains.get(indent);
-            const chain = branch[1] === 'elif' && prior?.owner === owner
-                ? prior
-                : { owner, line: lineNumber, condition: branch[2].trim() };
-            activeChains.set(indent, chain);
-            const selectors = literalTokens(branch[2]);
-            const recognizedDispatch = selectors.length > 0
-                || /\b(?:isinstance|issubclass|len|type)\s*\(|\.(?:startswith|endswith)\s*\(/.test(branch[2]);
-            if (!recognizedDispatch)
-                return;
-            const familyIdentity = `${chain.owner}:if-chain:${chain.line}`;
-            const familyProjections = selectorProjections('registry_families', `${chain.owner} ${chain.condition}`);
-            addRecord(records, {
-                kind: 'conditional-dispatch-family', projections: familyProjections, presumptiveInventory: true,
-                path, line: chain.line, anchor: lines[chain.line - 1], owner: chain.owner,
-                identity: familyIdentity, tokens: [chain.condition], selectorKey: branch[2].trim(),
-            });
-            (selectors.length > 0 ? selectors : [branch[2].trim()]).forEach((selector) => {
-                addRecord(records, {
-                    kind: 'conditional-dispatch-entry',
-                    projections: selectorProjections('registry_entries', `${chain.owner} ${branch[2]}`),
-                    presumptiveInventory: true,
-                    path, line: lineNumber, anchor: line, owner: chain.owner,
-                    identity: `${familyIdentity}:${selector}:${lineNumber}`, tokens: [branch[2].trim(), selector],
-                    selectorKey: selector, implementationKey: `branch@${path}:${lineNumber}`,
-                });
-            });
-        }
-        else if (line.trim() && !line.trim().startsWith('#')) {
-            for (const chainIndent of [...activeChains.keys()]) {
-                if (indent < chainIndent)
-                    activeChains.delete(chainIndent);
-            }
-        }
-        const ternary = line.match(/(.+?)\s+if\s+(.+?)\s+else\s+(.+)/);
-        if (ternary && !/^\s*(?:if|elif)\s/.test(line)) {
-            const owner = owners[index];
-            const familyIdentity = `${owner}:conditional-expression:${lineNumber}`;
-            addRecord(records, {
-                kind: 'conditional-expression-family',
-                projections: selectorProjections('registry_families', `${owner} ${ternary[2]}`),
-                presumptiveInventory: true,
-                path, line: lineNumber, anchor: line, owner, identity: familyIdentity, tokens: [ternary[2].trim()],
-            });
-            [
-                ['true', ternary[1].trim()],
-                ['false', ternary[3].trim()],
-            ].forEach(([selector, implementation]) => addRecord(records, {
-                kind: 'conditional-expression-entry',
-                projections: selectorProjections('registry_entries', `${owner} ${ternary[2]}`),
-                presumptiveInventory: true,
-                path, line: lineNumber, anchor: line, owner,
-                identity: `${familyIdentity}:${selector}`, tokens: [ternary[2].trim(), implementation],
-                selectorKey: selector, implementationKey: implementation,
-            }));
-        }
-    });
-    for (let index = 0; index < lines.length; index += 1) {
-        if (!executable[index])
-            continue;
-        const assignment = lines[index].match(/^\s*([A-Za-z_][A-Za-z0-9_.]*)\s*(?::[^=]+)?=\s*\{\s*$/);
-        if (!assignment)
-            continue;
-        const owner = owners[index];
-        const baseIndent = indentation(lines[index]);
-        const entries = [];
-        let end = index + 1;
-        for (; end < lines.length; end += 1) {
-            const current = lines[end];
-            if (current.trim() === '}' && indentation(current) <= baseIndent)
-                break;
-            const entry = current.match(/^\s*(['"]?)([^'"\s][^:'"]*|[^'"]+)\1\s*:\s*(.+?)(?:,\s*)?(?:#.*)?$/);
-            if (entry)
-                entries.push({ line: end + 1, key: entry[2].trim(), value: entry[3].trim() });
-        }
-        if (entries.length < 2)
-            continue;
-        const familyIdentity = `${owner}:mapping:${assignment[1]}:${index + 1}`;
-        addRecord(records, {
-            kind: 'mapping-dispatch-family',
-            projections: selectorProjections('registry_families', `${owner} ${assignment[1]}`),
-            presumptiveInventory: true,
-            path, line: index + 1, anchor: lines[index], owner, identity: familyIdentity, tokens: [assignment[1]],
-        });
-        entries.forEach((entry) => addRecord(records, {
-            kind: 'mapping-dispatch-entry',
-            projections: selectorProjections('registry_entries', `${owner} ${assignment[1]} ${entry.key}`),
-            presumptiveInventory: true,
-            path, line: entry.line, anchor: lines[entry.line - 1], owner,
-            identity: `${familyIdentity}:${entry.key}`, tokens: [entry.key, entry.value],
-            selectorKey: entry.key, implementationKey: entry.value,
-        }));
-        index = Math.max(index, end - 1);
-    }
-}
-function scanGenericSelectors(path, lines, executable, records) {
-    let switchOwner = null;
-    lines.forEach((line, index) => {
-        if (!executable[index])
-            return;
-        const lineNumber = index + 1;
-        const switchMatch = line.match(/\bswitch\s*\((.+)\)/);
-        if (switchMatch) {
-            switchOwner = { line: lineNumber, expression: switchMatch[1].trim() };
-            addRecord(records, {
-                kind: 'switch-dispatch-family',
-                projections: selectorProjections('registry_families', switchMatch[1]),
-                presumptiveInventory: true,
-                path, line: lineNumber, anchor: line, owner: `switch@${lineNumber}`,
-                identity: `switch:${lineNumber}:${switchMatch[1].trim()}`, tokens: [switchMatch[1].trim()],
-            });
-        }
-        const caseMatch = line.match(/\bcase\s+([^:]+):/);
-        if (caseMatch && switchOwner) {
-            const selector = caseMatch[1].trim().replace(/^['"]|['"]$/g, '');
-            addRecord(records, {
-                kind: 'switch-dispatch-entry',
-                projections: selectorProjections('registry_entries', `${switchOwner.expression} ${caseMatch[1]}`),
-                presumptiveInventory: true,
-                path, line: lineNumber, anchor: line, owner: `switch@${switchOwner.line}`,
-                identity: `switch:${switchOwner.line}:${selector}`, tokens: [caseMatch[1].trim()],
-                selectorKey: selector, implementationKey: `branch@${path}:${lineNumber}`,
-            });
-        }
-        const conditional = line.match(/\b(?:if|else\s+if)\s*\((.+)\)/);
-        if (conditional) {
-            const selectors = literalTokens(conditional[1]);
-            if (selectors.length === 0 && !/\b(?:instanceof|typeof)\b|\.length\b|\.(?:startsWith|endsWith)\s*\(/.test(conditional[1]))
-                return;
-            const owner = `conditional@${lineNumber}`;
-            addRecord(records, {
-                kind: 'conditional-dispatch-family',
-                projections: selectorProjections('registry_families', conditional[1]),
-                presumptiveInventory: true,
-                path, line: lineNumber, anchor: line, owner, identity: `${owner}:${conditional[1].trim()}`,
-                tokens: [conditional[1].trim()],
-            });
-            (selectors.length > 0 ? selectors : [conditional[1].trim()]).forEach((selector) => addRecord(records, {
-                kind: 'conditional-dispatch-entry',
-                projections: selectorProjections('registry_entries', `${conditional[1]} ${selector}`),
-                presumptiveInventory: true,
-                path, line: lineNumber, anchor: line, owner, identity: `${owner}:${selector}`,
-                tokens: [conditional[1].trim(), selector], selectorKey: selector,
-                implementationKey: `branch@${path}:${lineNumber}`,
-            }));
-        }
-        const ternaryIndex = line.indexOf('?');
-        const colonIndex = ternaryIndex < 0 ? -1 : line.indexOf(':', ternaryIndex + 1);
-        if (ternaryIndex > 0 && colonIndex > ternaryIndex) {
-            const condition = line.slice(0, ternaryIndex).trim();
-            const owner = `conditional-expression@${lineNumber}`;
-            addRecord(records, {
-                kind: 'conditional-expression-family',
-                projections: selectorProjections('registry_families', condition),
-                presumptiveInventory: true,
-                path, line: lineNumber, anchor: line, owner, identity: `${owner}:${condition}`, tokens: [condition],
-            });
-            [['true', line.slice(ternaryIndex + 1, colonIndex).trim()], ['false', line.slice(colonIndex + 1).trim()]]
-                .forEach(([selector, implementation]) => addRecord(records, {
-                kind: 'conditional-expression-entry',
-                projections: selectorProjections('registry_entries', `${condition} ${selector}`),
-                presumptiveInventory: true,
-                path, line: lineNumber, anchor: line, owner, identity: `${owner}:${selector}`,
-                tokens: [condition, implementation], selectorKey: selector, implementationKey: implementation,
-            }));
-        }
-    });
-}
-function resolvedSourceImport(importerPath, specifier, extension, aliases, knownPaths) {
-    let joined = null;
-    if (specifier.startsWith('.')) {
-        joined = normalizePath(posix.normalize(posix.join(posix.dirname(importerPath), specifier)));
-    }
-    else {
-        for (const [prefix, target] of aliases) {
-            if (!specifier.startsWith(prefix))
-                continue;
-            joined = normalizePath(posix.normalize(posix.join(target, specifier.slice(prefix.length))));
-            break;
-        }
-    }
-    if (!joined)
-        return null;
-    const candidates = extname(joined)
-        ? [joined]
-        : [`${joined}${extension}`, `${joined}/index${extension}`];
-    return candidates.find((candidate) => knownPaths.has(candidate)) ?? candidates[0];
-}
-function scanVueSelectorCensus(root, paths, records) {
-    const families = [];
-    const knownPaths = new Set(paths.map(normalizePath));
-    const aliases = new Map();
-    for (const configPath of paths.filter((candidate) => /(?:^|\/)tsconfig(?:\.[^/]+)?\.json$/.test(candidate))) {
-        let configLines = null;
-        try {
-            configLines = textLines(root, configPath);
-        }
-        catch {
-            configLines = null;
-        }
-        if (!configLines)
-            continue;
-        const source = configLines.join('\n');
-        for (const alias of source.matchAll(/"([^"]*\/)?\*"\s*:\s*\[\s*"([^"]*\/)?\*"/g)) {
-            const prefix = alias[1] ?? '';
-            const target = normalizePath(posix.join(posix.dirname(configPath), alias[2] ?? ''));
-            if (prefix)
-                aliases.set(prefix, target);
-        }
-    }
-    for (const path of paths.filter((candidate) => candidate.endsWith('.vue') && shouldScan(candidate))) {
-        let lines = null;
-        try {
-            lines = textLines(root, path);
-        }
-        catch {
-            lines = null;
-        }
-        if (!lines)
-            continue;
-        const imports = new Map();
-        lines.forEach((line) => {
-            const imported = line.match(/^\s*import\s+([A-Za-z_$][\w$]*)\s+from\s+['"]([^'"]+)['"]/);
-            if (!imported)
-                return;
-            const resolved = resolvedSourceImport(path, imported[2], '.vue', aliases, knownPaths);
-            if (resolved)
-                imports.set(imported[1], resolved);
-        });
-        for (let index = 0; index < lines.length; index += 1) {
-            const opening = lines[index].match(/^\s*(components|directives)\s*:\s*\{\s*(.*?)\s*\}\s*,?\s*$/)
-                ?? lines[index].match(/^\s*(components|directives)\s*:\s*\{\s*$/);
-            if (!opening)
-                continue;
-            const domain = opening[1];
-            const entries = [];
-            const sameLineBody = opening[2];
-            if (sameLineBody) {
-                sameLineBody.split(',').map((value) => value.trim()).filter(Boolean).forEach((value) => {
-                    const pair = value.match(/^(?:['"]([^'"]+)['"]|([A-Za-z_$][\w$-]*))\s*:\s*([A-Za-z_$][\w$]*)$/);
-                    const shorthand = value.match(/^([A-Za-z_$][\w$]*)$/);
-                    if (pair)
-                        entries.push({
-                            selector: pair[1] ?? pair[2], implementation: pair[3], line: index + 1, anchor: lines[index],
-                        });
-                    else if (shorthand)
-                        entries.push({
-                            selector: shorthand[1], implementation: shorthand[1], line: index + 1, anchor: lines[index],
-                        });
-                });
-            }
-            else {
-                const baseIndent = indentation(lines[index]);
-                let cursor = index + 1;
-                for (; cursor < lines.length; cursor += 1) {
-                    const current = lines[cursor];
-                    if (/^\s*}\s*,?\s*$/.test(current) && indentation(current) <= baseIndent)
-                        break;
-                    const pair = current.match(/^\s*(?:['"]([^'"]+)['"]|([A-Za-z_$][\w$-]*))\s*:\s*([A-Za-z_$][\w$]*)\s*,?\s*$/);
-                    const shorthand = current.match(/^\s*([A-Za-z_$][\w$]*)\s*,?\s*$/);
-                    if (pair)
-                        entries.push({
-                            selector: pair[1] ?? pair[2], implementation: pair[3], line: cursor + 1, anchor: current,
-                        });
-                    else if (shorthand)
-                        entries.push({
-                            selector: shorthand[1], implementation: shorthand[1], line: cursor + 1, anchor: current,
-                        });
-                }
-                index = cursor;
-            }
-            if (entries.length === 0)
-                continue;
-            families.push({
-                path,
-                owner: 'vue-component-options',
-                identity: `vue-options:${domain}`,
-                kind: domain === 'components' ? 'vue-local-component-family' : 'vue-local-directive-family',
-                line: index + 1,
-                anchor: lines[index] ?? `<${domain}>`,
-                entries,
-                imports,
-            });
-        }
-        const globalEntries = new Map();
-        lines.forEach((line, index) => {
-            for (const match of line.matchAll(/\b([A-Za-z_$][\w$]*)\.(component|directive)\(\s*['"]([^'"]+)['"]\s*,\s*([A-Za-z_$][\w$]*)/g)) {
-                const key = `${match[1]}.${match[2]}`;
-                const entries = globalEntries.get(key) ?? [];
-                entries.push({ selector: match[3], implementation: match[4], line: index + 1, anchor: line });
-                globalEntries.set(key, entries);
-            }
-        });
-        globalEntries.forEach((entries, key) => families.push({
-            path,
-            owner: `vue-registration:${key}`,
-            identity: `vue-registration:${key}`,
-            kind: key.endsWith('.component') ? 'vue-global-component-family' : 'vue-global-directive-family',
-            line: entries[0].line,
-            anchor: entries[0].anchor,
-            entries,
-            imports,
-        }));
-    }
-    const familyIdByPath = new Map();
-    const emittedEntries = [];
-    families.forEach((family) => {
-        const familyId = recordStableId(family.kind, family.path, family.owner, family.identity);
-        const pathFamilies = familyIdByPath.get(family.path) ?? [];
-        pathFamilies.push(familyId);
-        familyIdByPath.set(family.path, pathFamilies);
-        addRecord(records, {
-            kind: family.kind,
-            projections: ['registry_families'],
-            presumptiveInventory: true,
-            path: family.path,
-            line: family.line,
-            anchor: family.anchor,
-            owner: family.owner,
-            identity: family.identity,
-            tokens: [family.identity],
-        });
-        family.entries.forEach((entry) => {
-            const implementationPath = family.imports.get(entry.implementation);
-            const implementationKey = implementationPath
-                ? `${implementationPath}#default-export`
-                : `${family.path}#${entry.implementation}`;
-            const entryIdentity = `${family.identity}:${entry.selector}:${implementationKey}`;
-            const entryId = recordStableId('vue-selector-entry', family.path, family.owner, entryIdentity);
-            addRecord(records, {
-                kind: 'vue-selector-entry',
-                projections: ['registry_entries'],
-                presumptiveInventory: true,
-                path: family.path,
-                line: entry.line,
-                anchor: entry.anchor,
-                owner: family.owner,
-                identity: entryIdentity,
-                tokens: [entry.selector, entry.implementation, implementationKey],
-                selectorKey: entry.selector,
-                implementationKey,
-                selectorFamilyRecordId: familyId,
-            });
-            emittedEntries.push({ entryId, family, implementation: entry.implementation });
-        });
-    });
-    emittedEntries.forEach(({ entryId, family, implementation }) => {
-        const implementationPath = family.imports.get(implementation);
-        if (!implementationPath)
-            return;
-        const childFamilyIds = familyIdByPath.get(implementationPath) ?? [];
-        childFamilyIds.forEach((childFamilyId) => addRecord(records, {
-            kind: 'vue-selector-edge',
-            projections: ['registry_edges'],
-            presumptiveInventory: true,
-            path: family.path,
-            line: family.line,
-            anchor: family.anchor,
-            owner: family.owner,
-            identity: `edge:${entryId}:${childFamilyId}`,
-            tokens: [entryId, childFamilyId],
-            parentSelectorEntryRecordId: entryId,
-            childSelectorFamilyRecordId: childFamilyId,
-            relationKind: 'implementation-owns-selector',
-        }));
-    });
-}
-function javaImportedTypes(lines) {
-    const imports = new Map();
-    lines.forEach((line) => {
-        const imported = line.match(/^\s*import\s+(?:static\s+)?([A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)+)\s*;/)?.[1];
-        if (imported && !imported.endsWith('.*'))
-            imports.set(imported.split('.').at(-1), imported);
-    });
-    return imports;
-}
-function scanJavaSelectorCensus(root, paths, records) {
-    const beanAlternatives = [];
-    const commandFamilyIdsByClass = new Map();
-    for (const path of paths.filter((candidate) => candidate.endsWith('.java') && shouldScan(candidate))) {
-        let lines = null;
-        try {
-            lines = textLines(root, path);
-        }
-        catch {
-            lines = null;
-        }
-        if (!lines)
-            continue;
-        const source = lines.join('\n');
-        const imports = javaImportedTypes(lines);
-        const className = [...source.matchAll(/\b(?:class|interface|record)\s+([A-Za-z_$][\w$]*)/g)].at(-1)?.[1]
-            ?? basename(path, '.java');
-        const commandEntries = [];
-        for (let index = 0; index < lines.length; index += 1) {
-            if (!/@McpTool\s*\(/.test(lines[index]))
-                continue;
-            const annotation = [];
-            let cursor = index;
-            let depth = 0;
-            do {
-                annotation.push(lines[cursor]);
-                depth += parenthesisDelta(lines[cursor]);
-                cursor += 1;
-            } while (cursor < lines.length && depth > 0 && cursor - index < 20);
-            const annotationText = annotation.join('\n');
-            const selector = annotationText.match(/\bname\s*=\s*"([^"]+)"/)?.[1];
-            while (cursor < lines.length && (!lines[cursor].trim() || lines[cursor].trim().startsWith('@')))
-                cursor += 1;
-            const method = lines.slice(cursor, cursor + 6).join(' ').match(/\b(?:public|protected|private)?\s*(?:static\s+)?[A-Za-z_$][\w$]*(?:<[^;{}()]+>)?(?:\[\])?\s+([A-Za-z_$][\w$]*)\s*\(/)?.[1];
-            if (selector && method)
-                commandEntries.push({
-                    selector,
-                    implementation: `${path}#${className}.${method}`,
-                    line: index + 1,
-                    anchor: lines[index],
-                });
-        }
-        if (commandEntries.length > 0) {
-            const owner = `java-class:${className}`;
-            const identity = `annotation-dispatch:McpTool.name:${className}`;
-            const familyId = recordStableId('java-annotated-command-family', path, owner, identity);
-            commandFamilyIdsByClass.set(className, familyId);
-            addRecord(records, {
-                kind: 'java-annotated-command-family',
-                projections: ['registry_families'],
-                presumptiveInventory: true,
-                path,
-                line: commandEntries[0].line,
-                anchor: commandEntries[0].anchor,
-                owner,
-                identity,
-                tokens: ['McpTool.name', className],
-            });
-            commandEntries.forEach((entry) => addRecord(records, {
-                kind: 'java-annotated-command-entry',
-                projections: ['registry_entries'],
-                presumptiveInventory: true,
-                path,
-                line: entry.line,
-                anchor: entry.anchor,
-                owner,
-                identity: `${identity}:${entry.selector}:${entry.implementation}`,
-                tokens: [entry.selector, entry.implementation],
-                selectorKey: entry.selector,
-                implementationKey: entry.implementation,
-                selectorFamilyRecordId: familyId,
-            }));
-        }
-        for (const subtype of source.matchAll(/@JsonSubTypes\s*\(\s*\{([\s\S]*?)\}\s*\)\s*(?:public\s+)?(?:abstract\s+)?(?:class|interface)\s+([A-Za-z_$][\w$]*)/g)) {
-            const ownerType = subtype[2];
-            const entries = [...subtype[1].matchAll(/(?:JsonSubTypes\.)?Type\s*\(\s*value\s*=\s*([A-Za-z_$][\w$]*)\.class\s*,\s*name\s*=\s*([A-Za-z0-9_$."]+)/g)];
-            if (entries.length === 0)
-                continue;
-            const line = source.slice(0, subtype.index ?? 0).split('\n').length;
-            const owner = `java-type:${ownerType}`;
-            const identity = `json-subtypes:${ownerType}`;
-            const familyId = recordStableId('java-json-subtype-family', path, owner, identity);
-            addRecord(records, {
-                kind: 'java-json-subtype-family', projections: ['registry_families'], presumptiveInventory: true,
-                path, line, anchor: lines[line - 1] ?? '@JsonSubTypes', owner, identity, tokens: [ownerType],
-            });
-            entries.forEach((entry) => {
-                const implementation = imports.get(entry[1]) ?? entry[1];
-                const selector = entry[2].replace(/^"|"$/g, '');
-                addRecord(records, {
-                    kind: 'java-json-subtype-entry', projections: ['registry_entries'], presumptiveInventory: true,
-                    path, line, anchor: lines[line - 1] ?? '@JsonSubTypes', owner,
-                    identity: `${identity}:${selector}:${implementation}`,
-                    tokens: [selector, implementation], selectorKey: selector, implementationKey: implementation,
-                    selectorFamilyRecordId: familyId,
-                });
-            });
-        }
-        const deserializers = [...source.matchAll(/\baddDeserializer\s*\(\s*([A-Za-z_$][\w$]*)\.class\s*,\s*new\s+([A-Za-z_$][\w$]*)\s*\(/g)];
-        if (deserializers.length > 0) {
-            const owner = `java-class:${className}`;
-            const identity = `jackson-deserializers:${className}`;
-            const familyId = recordStableId('java-deserializer-family', path, owner, identity);
-            const line = source.slice(0, deserializers[0].index ?? 0).split('\n').length;
-            addRecord(records, {
-                kind: 'java-deserializer-family', projections: ['registry_families'], presumptiveInventory: true,
-                path, line, anchor: lines[line - 1] ?? 'addDeserializer', owner, identity, tokens: [className],
-            });
-            deserializers.forEach((entry) => {
-                const entryLine = source.slice(0, entry.index ?? 0).split('\n').length;
-                addRecord(records, {
-                    kind: 'java-deserializer-entry', projections: ['registry_entries'], presumptiveInventory: true,
-                    path, line: entryLine, anchor: lines[entryLine - 1] ?? entry[0], owner,
-                    identity: `${identity}:${entry[1]}:${entry[2]}`, tokens: [entry[1], entry[2]],
-                    selectorKey: imports.get(entry[1]) ?? entry[1], implementationKey: imports.get(entry[2]) ?? entry[2],
-                    selectorFamilyRecordId: familyId,
-                });
-            });
-        }
-        let pendingAnnotations = [];
-        let annotationBuffer = null;
-        lines.forEach((line, index) => {
-            const trimmed = line.trim();
-            if (annotationBuffer) {
-                annotationBuffer.text += ` ${trimmed}`;
-                annotationBuffer.depth += parenthesisDelta(line);
-                if (annotationBuffer.depth <= 0) {
-                    pendingAnnotations.push({ line: annotationBuffer.line, text: annotationBuffer.text });
-                    annotationBuffer = null;
-                }
-                return;
-            }
-            if (trimmed.startsWith('@')) {
-                const depth = parenthesisDelta(line);
-                if (depth > 0)
-                    annotationBuffer = { line: index + 1, text: trimmed, depth };
-                else
-                    pendingAnnotations.push({ line: index + 1, text: trimmed });
-                return;
-            }
-            if (!trimmed || trimmed.startsWith('//'))
-                return;
-            if (!pendingAnnotations.some((annotation) => /^@Bean\b/.test(annotation.text))) {
-                pendingAnnotations = [];
-                return;
-            }
-            const method = line.match(/^\s*(?:public|protected|private)?\s*(?:static\s+)?([A-Za-z_$][\w$]*(?:<[^;{}()]+>)?(?:\[\])?)\s+([A-Za-z_$][\w$]*)\s*\(/);
-            if (!method)
-                return;
-            const simpleContract = method[1].replace(/<.*$/, '');
-            const contract = imports.get(simpleContract) ?? simpleContract;
-            const conditions = pendingAnnotations
-                .filter((annotation) => !/^@Bean\b/.test(annotation.text))
-                .map((annotation) => annotation.text)
-                .sort();
-            beanAlternatives.push({
-                path,
-                line: index + 1,
-                anchor: line,
-                ownerClass: className,
-                method: method[2],
-                contract,
-                selector: conditions.length > 0
-                    ? conditions.join('&')
-                    : `unconditional:${path}#${className}.${method[2]}`,
-                implementation: `${path}#${className}.${method[2]}`,
-            });
-            pendingAnnotations = [];
-        });
-    }
-    const alternativesByContract = new Map();
-    beanAlternatives.forEach((alternative) => {
-        const group = alternativesByContract.get(alternative.contract) ?? [];
-        group.push(alternative);
-        alternativesByContract.set(alternative.contract, group);
-    });
-    alternativesByContract.forEach((alternatives, contract) => {
-        const exactAlternatives = [...new Map(alternatives.map((entry) => [entry.implementation, entry])).values()]
-            .sort((left, right) => left.implementation.localeCompare(right.implementation));
-        if (exactAlternatives.length < 2 || exactAlternatives.every((entry) => entry.selector.startsWith('unconditional:')))
-            return;
-        const anchor = exactAlternatives[0];
-        const owner = `spring-bean-contract:${contract}`;
-        const identity = `spring-bean-alternatives:${contract}`;
-        const familyId = recordStableId('java-spring-bean-alternative-family', anchor.path, owner, identity);
-        addRecord(records, {
-            kind: 'java-spring-bean-alternative-family', projections: ['registry_families'], presumptiveInventory: true,
-            path: anchor.path, line: anchor.line, anchor: anchor.anchor, owner, identity, tokens: [contract],
-        });
-        exactAlternatives.forEach((entry) => {
-            const entryIdentity = `${identity}:${entry.selector}:${entry.implementation}`;
-            const entryId = recordStableId('java-spring-bean-alternative-entry', entry.path, owner, entryIdentity);
-            addRecord(records, {
-                kind: 'java-spring-bean-alternative-entry', projections: ['registry_entries'], presumptiveInventory: true,
-                path: entry.path, line: entry.line, anchor: entry.anchor, owner, identity: entryIdentity,
-                tokens: [contract, entry.selector, entry.implementation], selectorKey: entry.selector,
-                implementationKey: entry.implementation, selectorFamilyRecordId: familyId,
-            });
-            const childFamilyId = commandFamilyIdsByClass.get(entry.contract.split('.').at(-1) ?? entry.contract);
-            if (!childFamilyId)
-                return;
-            addRecord(records, {
-                kind: 'java-selector-edge', projections: ['registry_edges'], presumptiveInventory: true,
-                path: entry.path, line: entry.line, anchor: entry.anchor, owner,
-                identity: `edge:${entryId}:${childFamilyId}`, tokens: [entryId, childFamilyId],
-                parentSelectorEntryRecordId: entryId, childSelectorFamilyRecordId: childFamilyId,
-                relationKind: 'implementation-owns-selector',
-            });
-        });
-    });
-}
-function scanJavaExactOperationMatrices(root, paths, records) {
-    const units = [];
-    for (const path of paths.filter((candidate) => candidate.endsWith('.java') && shouldScan(candidate))) {
-        let lines = null;
-        try {
-            lines = textLines(root, path);
-        }
-        catch {
-            lines = null;
-        }
-        if (!lines)
-            continue;
-        const source = lines.join('\n');
-        const className = source.match(/\b(?:class|record)\s+([A-Za-z_$][\w$]*)/)?.[1];
-        if (className)
-            units.push({ path, lines, source, className });
-    }
-    const unitsByClass = new Map(units.map((unit) => [unit.className, unit]));
-    units.forEach((declarationUnit) => {
-        for (const array of declarationUnit.source.matchAll(/\bString\s*\[\s*]\s*([A-Za-z_$][\w$]*)\s*=\s*\{([\s\S]*?)\}\s*;/g)) {
-            const symbol = array[1];
-            const values = [...array[2].matchAll(/"([^"]+)"/g)];
-            if (values.length < 2)
-                continue;
-            const accessor = `get${symbol[0].toUpperCase()}${symbol.slice(1)}`;
-            units.forEach((consumerUnit) => {
-                const accessorUse = new RegExp(`\\.${accessor}\\s*\\(\\s*\\)`, 'g');
-                for (const use of consumerUnit.source.matchAll(accessorUse)) {
-                    const useOffset = use.index ?? 0;
-                    const prefixStart = Math.max(0, useOffset - 1000);
-                    const constructors = [...consumerUnit.source.slice(prefixStart, useOffset)
-                            .matchAll(/new\s+([A-Za-z_$][\w$]*)\s*\(/g)];
-                    const constructor = constructors.at(-1);
-                    if (!constructor)
-                        continue;
-                    const implementation = unitsByClass.get(constructor[1]);
-                    if (!implementation)
-                        continue;
-                    const httpMethods = [...new Set([...implementation.source.matchAll(/\.(get|post|put|patch|delete|options|head)\s*\(\s*\)/gi)]
-                            .map((match) => match[1].toUpperCase()))];
-                    if (httpMethods.length !== 1 || !/\.uri\s*\(/.test(implementation.source))
-                        continue;
-                    const method = httpMethods[0];
-                    const arrayOffset = array.index ?? 0;
-                    const declarationLine = declarationUnit.source.slice(0, arrayOffset).split('\n').length;
-                    values.forEach((value, valueIndex) => {
-                        const itemValue = value[1];
-                        const itemOffset = arrayOffset + array[0].indexOf(array[2]) + (value.index ?? 0);
-                        const itemLine = declarationUnit.source.slice(0, itemOffset).split('\n').length;
-                        const configuredParts = itemValue.split(':');
-                        const endpointId = configuredParts[0];
-                        const endpointPath = configuredParts.length > 1 ? configuredParts.slice(1).join(':') : endpointId;
-                        const itemIdentityKey = `${declarationUnit.path}#${declarationUnit.className}.${symbol}[${valueIndex}]`;
-                        const operationIdentityKey = `${implementation.path}#${implementation.className}:${method}:matrix:${itemIdentityKey}`;
-                        addRecord(records, {
-                            kind: 'exact-operation-matrix-member',
-                            projections: ['external_dependencies'],
-                            presumptiveInventory: true,
-                            path: declarationUnit.path,
-                            line: itemLine,
-                            anchor: declarationUnit.lines[itemLine - 1] ?? declarationUnit.lines[declarationLine - 1] ?? array[0],
-                            owner: `${declarationUnit.className}.${symbol}`,
-                            identity: operationIdentityKey,
-                            tokens: [symbol, itemValue, endpointId, endpointPath, implementation.className, method],
-                            operationToken: method,
-                            addressToken: endpointPath,
-                            operationIdentityKey,
-                            matrixAxes: [{
-                                    symbol_identity_key: `${declarationUnit.path}#${declarationUnit.className}.${symbol}`,
-                                    item_identity_key: itemIdentityKey,
-                                    item_value: itemValue,
-                                    source: {
-                                        path: declarationUnit.path,
-                                        start_line: itemLine,
-                                        end_line: itemLine,
-                                        anchor: declarationUnit.lines[itemLine - 1] ?? itemValue,
-                                    },
-                                }],
-                        });
-                    });
-                }
-            });
-        }
-    });
-}
-function enclosingTypeName(lines, index) {
-    for (let cursor = index; cursor >= 0; cursor -= 1) {
-        const type = lines[cursor].match(/\b(?:class|interface|record|enum)\s+([A-Za-z_$][\w$]*)/)?.[1];
-        if (type)
-            return type;
-    }
-    return basename('source');
-}
-function scanJavaAndBrowserOperationalIdentities(path, lines, records) {
-    const extension = extname(path.toLowerCase());
-    const javaLike = extension === '.java' || extension === '.kt' || extension === '.kts';
-    const browserLike = ['.js', '.jsx', '.mjs', '.cjs', '.ts', '.tsx', '.mts', '.cts', '.vue']
-        .includes(extension);
-    if (browserLike) {
-        lines.forEach((line, index) => {
-            for (const mount of line.matchAll(/\b([A-Za-z_$][\w$]*)\.mount\(\s*([^,)]+)/g)) {
-                const receiver = mount[1];
-                const address = mount[2].trim();
-                addRecord(records, {
-                    kind: 'browser-mounted-application-role',
-                    projections: ['runtime_roles'],
-                    presumptiveInventory: true,
-                    path,
-                    line: index + 1,
-                    anchor: line,
-                    owner: `browser-application:${receiver}`,
-                    identity: `mount:${receiver}:${address}`,
-                    tokens: [receiver, address],
-                    operationToken: 'mount',
-                    addressToken: address,
-                    operationIdentityKey: `${path}#${receiver}.mount:${address}`,
-                });
-            }
-            for (const storage of line.matchAll(/\b(?:window\.)?(localStorage|sessionStorage)\.(getItem|setItem|removeItem)\(\s*['"]([^'"]+)['"]/g))
-                addRecord(records, {
-                    kind: 'browser-keyed-storage-state',
-                    projections: ['stateful_resources'],
-                    presumptiveInventory: true,
-                    path,
-                    line: index + 1,
-                    anchor: line,
-                    owner: `browser-storage:${storage[1]}`,
-                    identity: `storage:${storage[1]}:${storage[3]}`,
-                    tokens: [storage[1], storage[2], storage[3]],
-                    addressToken: `${storage[1]}:${storage[3]}`,
-                    operationToken: storage[2],
-                    reproductionOperationToken: `${storage[1]}.${storage[2]}(${JSON.stringify(storage[3])})`,
-                });
-            for (const storage of line.matchAll(/\b(?:useStorage|useLocalStorage|useSessionStorage)\(\s*['"]([^'"]+)['"]/g))
-                addRecord(records, {
-                    kind: 'browser-keyed-storage-state',
-                    projections: ['stateful_resources'],
-                    presumptiveInventory: true,
-                    path,
-                    line: index + 1,
-                    anchor: line,
-                    owner: 'browser-storage-composable',
-                    identity: `storage-composable:${storage[1]}`,
-                    tokens: [storage[0].split('(')[0], storage[1]],
-                    addressToken: storage[1],
-                    operationToken: storage[0].split('(')[0],
-                    reproductionOperationToken: storage[0].split('(')[0],
-                });
-            const browserRequests = [...line.matchAll(/\b(axios\.(get|post|put|patch|delete|options|head))\(\s*([`'"])(.*?)\3/g)].map((request) => ({
-                callable: request[1],
-                operation: request[2].toUpperCase(),
-                address: request[4],
-                offset: request.index ?? 0,
-                anchor: line,
-                endLine: index + 1,
-            }));
-            for (const fetchStart of line.matchAll(/\bfetch\s*\(/g)) {
-                const offset = fetchStart.index ?? 0;
-                const callLines = [line.slice(offset)];
-                let depth = parenthesisDelta(callLines[0]);
-                let cursor = index;
-                while (depth > 0 && cursor + 1 < lines.length && cursor - index < 40) {
-                    cursor += 1;
-                    callLines.push(lines[cursor]);
-                    depth += parenthesisDelta(lines[cursor]);
-                }
-                const callAnchor = callLines.join('\n');
-                const address = callAnchor.match(/\bfetch\s*\(\s*([`'"])(.*?)\1/s)?.[2];
-                if (!address)
-                    continue;
-                const declaredMethod = directFetchMethod(callAnchor);
-                browserRequests.push({
-                    callable: 'fetch',
-                    operation: declaredMethod?.toUpperCase() ?? 'GET',
-                    address,
-                    offset,
-                    anchor: callAnchor,
-                    endLine: cursor + 1,
-                });
-            }
-            for (const request of browserRequests) {
-                addRecord(records, {
-                    kind: 'browser-http-request-operation',
-                    projections: ['external_dependencies'],
-                    presumptiveInventory: true,
-                    path,
-                    line: index + 1,
-                    endLine: request.endLine,
-                    anchor: request.anchor,
-                    owner: basename(path),
-                    identity: `browser-http:${request.operation}:${request.address}@${index + 1}:${request.offset}`,
-                    tokens: [request.callable, request.operation, request.address],
-                    operationToken: request.operation,
-                    addressToken: request.address,
-                    operationIdentityKey: `${path}#browser-http:${request.operation}:${request.address}@${index + 1}:${request.offset}`,
-                });
-            }
-        });
-        const source = lines.join('\n');
-        for (const handle of source.matchAll(/(?:const|let|private|protected|public|readonly)\s+([A-Za-z_$][\w$]*)[^=;\n]*=\s*[^;\n]*\.subscribe\s*\(/g)) {
-            const field = handle[1];
-            if (!new RegExp(`\\b${field}\\.(?:unsubscribe|dispose|cancel)\\s*\\(`).test(source))
-                continue;
-            const line = source.slice(0, handle.index ?? 0).split('\n').length;
-            addRecord(records, {
-                kind: 'browser-supervised-subscription-role',
-                projections: ['runtime_roles'],
-                presumptiveInventory: true,
-                path,
-                line,
-                anchor: lines[line - 1] ?? field,
-                owner: basename(path),
-                identity: `subscription:${field}`,
-                tokens: [field, 'subscribe', 'unsubscribe'],
-                operationToken: 'subscribe/unsubscribe',
-                addressToken: field,
-                operationIdentityKey: `${path}#subscription:${field}`,
-            });
-        }
-    }
-    if (!javaLike)
-        return;
-    const source = lines.join('\n');
-    for (const bean of source.matchAll(/@Bean\s*\(\s*initMethod\s*=\s*"([^"]+)"\s*,\s*destroyMethod\s*=\s*"([^"]+)"\s*\)[\s\S]{0,500}?\b([A-Za-z_$][\w$<>?, ]*)\s+([A-Za-z_$][\w$]*)\s*\(/g)) {
-        const line = source.slice(0, bean.index ?? 0).split('\n').length;
-        addRecord(records, {
-            kind: 'spring-managed-lifecycle-role',
-            projections: ['runtime_roles'],
-            presumptiveInventory: true,
-            path,
-            line,
-            anchor: lines[line - 1] ?? '@Bean',
-            owner: `spring-bean:${bean[4]}`,
-            identity: `bean-lifecycle:${bean[4]}:${bean[1]}:${bean[2]}`,
-            tokens: [bean[4], bean[1], bean[2], bean[3].trim()],
-            operationToken: `${bean[1]}/${bean[2]}`,
-            addressToken: bean[4],
-            operationIdentityKey: `${path}#spring-bean:${bean[4]}:${bean[1]}:${bean[2]}`,
-        });
-    }
-    lines.forEach((line, index) => {
-        const staticResource = line.match(/\.addResourceHandler\s*\(([\s\S]*?)\)/);
-        if (staticResource) {
-            const route = [...staticResource[1].matchAll(/['"](\/[^'"]*)['"]/g)].at(-1)?.[1]
-                ?? staticResource[1].trim();
-            for (const method of ['GET', 'HEAD'])
-                addRecord(records, {
-                    kind: 'spring-static-resource-inbound-operation',
-                    projections: ['external_dependencies'],
-                    presumptiveInventory: true,
-                    path,
-                    line: index + 1,
-                    anchor: line,
-                    owner: enclosingTypeName(lines, index),
-                    identity: `static-resource:${method}:${route}@${index + 1}`,
-                    tokens: [method, route],
-                    operationToken: method,
-                    addressToken: route,
-                    operationIdentityKey: `${path}#static-resource:${method}:${route}@${index + 1}`,
-                });
-        }
-        const mapping = line.match(/@(Get|Post|Put|Patch|Delete|Request)Mapping\s*\((.*)\)/);
-        if (!mapping)
-            return;
-        const routes = [...mapping[2].matchAll(/['"](\/[^'"]*)['"]/g)].map((match) => match[1]);
-        const methods = mapping[1] === 'Request'
-            ? [...mapping[2].matchAll(/RequestMethod\.(GET|POST|PUT|PATCH|DELETE|OPTIONS|HEAD)/g)].map((match) => match[1])
-            : [mapping[1].toUpperCase()];
-        (methods.length > 0 ? methods : ['ANY']).forEach((method) => (routes.length > 0 ? routes : ['class-mapping']).forEach((route) => addRecord(records, {
-            kind: 'spring-controller-inbound-operation',
-            projections: ['external_dependencies'],
-            presumptiveInventory: true,
-            path,
-            line: index + 1,
-            anchor: line,
-            owner: enclosingTypeName(lines, index),
-            identity: `controller:${method}:${route}@${index + 1}`,
-            tokens: [method, route],
-            operationToken: method,
-            addressToken: route,
-            operationIdentityKey: `${path}#controller:${method}:${route}@${index + 1}`,
-        })));
-    });
-    const classBlocks = [...source.matchAll(/\bclass\s+([A-Za-z_$][\w$]*)/g)];
-    classBlocks.forEach((classMatch, classIndex) => {
-        const start = classMatch.index ?? 0;
-        const end = classBlocks[classIndex + 1]?.index ?? source.length;
-        const body = source.slice(start, end);
-        if (!/@PostConstruct\b/.test(body) || !/@PreDestroy\b/.test(body))
-            return;
-        const line = source.slice(0, start).split('\n').length;
-        addRecord(records, {
-            kind: 'java-annotated-lifecycle-role',
-            projections: ['runtime_roles'],
-            presumptiveInventory: true,
-            path,
-            line,
-            anchor: lines[line - 1] ?? classMatch[0],
-            owner: classMatch[1],
-            identity: `annotated-lifecycle:${classMatch[1]}`,
-            tokens: [classMatch[1], 'PostConstruct', 'PreDestroy'],
-            operationToken: 'PostConstruct/PreDestroy',
-            addressToken: classMatch[1],
-            operationIdentityKey: `${path}#class:${classMatch[1]}:PostConstruct/PreDestroy`,
-        });
-    });
-    for (const field of source.matchAll(/\b(?:Disposable|Subscription|ScheduledFuture(?:<[^>]+>)?)\s+([A-Za-z_$][\w$]*)\s*[;=]/g)) {
-        const fieldOffset = field.index ?? 0;
-        let enclosingClassIndex = -1;
-        for (let index = 0; index < classBlocks.length; index += 1) {
-            if ((classBlocks[index].index ?? 0) >= fieldOffset)
-                break;
-            enclosingClassIndex = index;
-        }
-        if (enclosingClassIndex >= 0) {
-            const classStart = classBlocks[enclosingClassIndex].index ?? 0;
-            const classEnd = classBlocks[enclosingClassIndex + 1]?.index ?? source.length;
-            const classBody = source.slice(classStart, classEnd);
-            if (/@PostConstruct\b/.test(classBody) && /@PreDestroy\b/.test(classBody))
-                continue;
-        }
-        const name = field[1];
-        const startPattern = new RegExp(`\\b(?:this\\.)?${name}\\s*=\\s*[\\s\\S]{0,300}?(?:subscribe|schedule(?:AtFixedRate|WithFixedDelay)?)\\s*\\(`);
-        const stopPattern = new RegExp(`\\b(?:this\\.)?${name}\\.(?:dispose|cancel|unsubscribe)\\s*\\(`);
-        if (!startPattern.test(source) || !stopPattern.test(source))
-            continue;
-        const line = source.slice(0, field.index ?? 0).split('\n').length;
-        const owner = enclosingTypeName(lines, line - 1);
-        addRecord(records, {
-            kind: 'java-supervised-worker-role',
-            projections: ['runtime_roles'],
-            presumptiveInventory: true,
-            path,
-            line,
-            anchor: lines[line - 1] ?? field[0],
-            owner,
-            identity: `supervised-worker:${owner}:${name}`,
-            tokens: [owner, name, field[0].trim()],
-            operationToken: 'start/stop-handle',
-            addressToken: name,
-            operationIdentityKey: `${path}#${owner}:worker:${name}`,
-        });
-    }
-}
-const EFFECT_PATTERNS = [
-    { kind: 'filesystem-read-operation', projections: ['external_dependencies'], regex: /(?:\b(?:readFile(?:Sync)?|read_text|read_bytes|File\.read|fs\.readFile)|(?<!\.)\bopen)\s*\(/g },
-    { kind: 'filesystem-write-operation', projections: ['stateful_resources', 'external_dependencies'], regex: /\b(?:writeFile(?:Sync)?|appendFile(?:Sync)?|write_text|write_bytes|touch|mkdir|makedirs|unlink|rmdir|rmtree|File\.write|fs\.writeFile)\s*\(/g },
-    { kind: 'filesystem-metadata-operation', projections: ['external_dependencies'], regex: /\b(?:os\.(?:stat|lstat|listdir|scandir|walk|readlink|getcwd|chdir|chmod|rename|replace)|glob\.(?:glob|iglob)|shutil\.(?:copy|copy2|copyfile|copytree|move)|[A-Za-z0-9_.]+\.(?:exists|is_file|is_dir|stat|glob|rglob|iterdir|resolve|readlink|chmod|rename|replace|symlink_to|hardlink_to))\s*\(/g },
-    { kind: 'subprocess-operation', projections: ['external_dependencies'], regex: /\b(?:subprocess\.(?:run|Popen|call|check_call|check_output)|create_subprocess_(?:exec|shell)|child_process\.(?:spawn|exec|execFile|fork)|Command::new|ProcessBuilder|os\.(?:system|exec\w*))\s*\(/g },
-    { kind: 'command-wrapper-operation', projections: ['external_dependencies'], regex: /\b(?:run_command|run_cmd|execute_command|exec_command|invoke_command|shell_command)\s*\(\s*['"][^'"]+['"]/g },
-    { kind: 'host-execution-operation', projections: ['external_dependencies'], regex: /\b(?:runpy\.(?:run_module|run_path)|importlib\.(?:import_module|metadata\.(?:entry_points|distributions|version))|pkg_resources\.(?:iter_entry_points|get_distribution)|compile|exec)\s*\(/g },
-    { kind: 'host-installation-operation', projections: ['external_dependencies'], regex: /\b(?:entry_points|distributions|distribution|metadata|version)\s*\(|\.load\s*\(\s*\)/g },
-    { kind: 'host-interpreter-operation', projections: ['stateful_resources', 'external_dependencies'], regex: /\b(?:sys\.(?:meta_path|path_hooks|path_importer_cache|modules)|importlib\.(?:invalidate_caches|reload)|inspect\.(?:getsource|getattr_static|getmodule))\b/g },
-    { kind: 'socket-operation', projections: ['external_dependencies'], regex: /(?:\bsocket\.create_connection|\.(?:bind|listen|accept|connect|sendto|recvfrom))\s*\(/g },
-    { kind: 'host-signal-operation', projections: ['external_dependencies'], regex: /\b(?:signal\.signal|os\.kill|process\.(?:on|once)|[A-Za-z0-9_.]+\.add_signal_handler)\s*\(/g },
-    { kind: 'browser-host-operation', projections: ['external_dependencies'], regex: /\b(?:webbrowser\.open|window\.(?:open|addEventListener|removeEventListener)|document\.(?:createElement|createTextNode|getElementById|querySelector|querySelectorAll)|navigator\.[A-Za-z0-9_]+|Browser\.open|openExternal)\s*\(/g },
-    { kind: 'browser-model-operation', projections: ['external_dependencies'], regex: /\b(?:model|view)\.(?:addEventListener|addSignalListener|change|data|finalize|get|height|off|on|removeEventListener|removeSignalListener|resize|run|runAsync|save_changes|send|set|signal|toCanvas|toImageURL|toSVG|width)\s*\(/g },
-    { kind: 'browser-module-loader-operation', projections: ['external_dependencies'], regex: /\b(?:import|require|requirejs|define)(?:\.config)?\s*\(/g },
-    { kind: 'http-operation', projections: ['external_dependencies'], regex: /\b(?:fetch|requests\.(?:get|post|put|patch|delete|request)|axios\.(?:get|post|put|patch|delete|request)|httpx\.(?:get|post|put|patch|delete|request))\s*\(/g },
-    { kind: 'http-wrapper-operation', projections: ['external_dependencies'], regex: /\b(?:self\.)?_(?:get|post|put|patch|delete|request)(?:_raw)?\s*\(\s*(?:f|r|fr|rf)?['"]/g },
-    { kind: 'client-boundary-operation', projections: ['external_dependencies'], regex: /\b(?:[A-Za-z_][A-Za-z0-9_]*\.)*[A-Za-z0-9_]*(?:api|channel|client|connection|exporter|http|provider|session|transport)[A-Za-z0-9_]*\.(?:get|post|put|patch|delete|request|send|receive|respond|stream|query|execute|create|update|remove|list|load|export|publish|consume|ack|invoke|call)\s*\(/gi },
-    { kind: 'sdk-boundary-operation', projections: ['external_dependencies'], regex: /\b[A-Za-z_][A-Za-z0-9_.]*\.(?:add_event|add_link|attach|detach|emit|end|export|extract|force_flush|inject|invoke|observe|publish|record|receive_message|send_message|set_attribute|set_attributes|set_status|shutdown|start_span|write)\s*\(/g },
-    { kind: 'listener-operation', projections: ['external_dependencies'], regex: /\b(?:listen|serve|Server|Route|router\.(?:get|post|put|patch|delete)|app\.(?:get|post|put|patch|delete)|add_url_rule)\s*\(/g },
-    { kind: 'host-metadata-operation', projections: ['external_dependencies'], regex: /\b(?:socket\.gethostname|platform\.(?:machine|system|platform|node)|os\.(?:getpid|getppid|getuid|getgid|uname)|psutil\.(?:Process|cpu_percent|cpu_count|virtual_memory)|process\.(?:cpuUsage|memoryUsage))\s*\(/g },
-    { kind: 'installed-callback-state', projections: ['stateful_resources', 'external_dependencies'], regex: /\b(?:atexit\.register|os\.register_at_fork|signal\.signal|set_global_[A-Za-z0-9_]+|setattr|monkeypatch|patch)(?:\s*\(|\s*$)/g },
-    { kind: 'installed-registration-state', projections: ['stateful_resources'], regex: /\.(?:add_handler|add_hook|add_middleware|add_instrumentation|instrument)\s*\(/g },
-    { kind: 'in-memory-state', projections: ['stateful_resources'], regex: /\b(?:Queue|SimpleQueue|deque|WeakSet|WeakKeyDictionary|WeakValueDictionary|LRUCache|TTLCache)\s*\(/g },
-    { kind: 'runtime-task-candidate', projections: ['runtime_roles'], regex: /\b(?:asyncio\.create_task|create_task|ensure_future|Thread|Process|ThreadPoolExecutor|ProcessPoolExecutor)\s*\(/g, presumptive: false },
-];
-function scanEffects(path, lines, owners, executable, records) {
-    lines.forEach((line, index) => {
-        if (!executable[index])
-            return;
-        const owner = owners[index] ?? basename(path);
-        for (const pattern of EFFECT_PATTERNS) {
-            pattern.regex.lastIndex = 0;
-            let match;
-            while ((match = pattern.regex.exec(line)) !== null) {
-                const token = match[0].replace(/\s*\($/, '').trim();
-                addRecord(records, {
-                    kind: pattern.kind,
-                    projections: pattern.projections,
-                    presumptiveInventory: pattern.presumptive ?? true,
-                    path,
-                    line: index + 1,
-                    anchor: line,
-                    owner,
-                    identity: `${token}@${index + 1}:${match.index}`,
-                    tokens: [token],
-                    operationToken: token,
-                });
-                if (match[0].length === 0)
-                    pattern.regex.lastIndex += 1;
-            }
-        }
-        const envMatches = [
-            ...line.matchAll(/os\.getenv\(\s*['"]([^'"]+)['"]/g),
-            ...line.matchAll(/os\.environ\.(get|pop|setdefault)\(\s*['"]([^'"]+)['"]/g),
-            ...line.matchAll(/os\.environ\[\s*['"]([^'"]+)['"]\s*\]/g),
-            ...line.matchAll(/process\.env\.([A-Za-z_][A-Za-z0-9_]*)/g),
-            ...line.matchAll(/process\.env\[\s*['"]([^'"]+)['"]\s*\]/g),
-        ].sort((left, right) => (left.index ?? 0) - (right.index ?? 0));
-        for (const envMatch of envMatches) {
-            const method = envMatch[1] && ['get', 'pop', 'setdefault'].includes(envMatch[1]) ? envMatch[1] : null;
-            const key = method ? envMatch[2] : envMatch[1];
-            const suffix = line.slice((envMatch.index ?? 0) + envMatch[0].length);
-            const written = method === 'pop' || method === 'setdefault' || /^\s*=/.test(suffix);
-            addRecord(records, {
-                kind: written ? 'environment-write-operation' : 'environment-read-operation',
-                projections: written ? ['stateful_resources', 'external_dependencies'] : ['external_dependencies'],
-                presumptiveInventory: true,
-                path, line: index + 1, anchor: line, owner,
-                identity: `environment:${written ? 'write' : 'read'}:${key}@${index + 1}`,
-                tokens: [key], operationToken: written ? 'environment-write' : 'environment-read', addressToken: key,
-            });
-        }
-        const dynamicEnvMatches = [
-            ...line.matchAll(/os\.getenv\(\s*([^,)]+)(?:,|\))/g),
-            ...line.matchAll(/os\.environ\.(get|pop|setdefault)\(\s*([^,)]+)(?:,|\))/g),
-            ...line.matchAll(/os\.environ\[\s*([^\]]+)\s*\]/g),
-        ].sort((left, right) => (left.index ?? 0) - (right.index ?? 0));
-        for (const envMatch of dynamicEnvMatches) {
-            const method = envMatch[1] && ['get', 'pop', 'setdefault'].includes(envMatch[1])
-                ? envMatch[1]
-                : null;
-            const expression = (method ? envMatch[2] : envMatch[1])?.trim();
-            if (!expression || /^['"][^'"]+['"]$/.test(expression))
-                continue;
-            const suffix = line.slice((envMatch.index ?? 0) + envMatch[0].length);
-            const written = method === 'pop' || method === 'setdefault' || /^\s*=/.test(suffix);
-            addRecord(records, {
-                kind: written ? 'environment-write-operation' : 'environment-read-operation',
-                projections: written ? ['stateful_resources', 'external_dependencies'] : ['external_dependencies'],
-                presumptiveInventory: true,
-                path, line: index + 1, anchor: line, owner,
-                identity: `environment:${written ? 'write' : 'read'}:${expression}@${index + 1}`,
-                tokens: [expression], operationToken: written ? 'environment-write' : 'environment-read',
-                addressToken: expression,
-            });
-        }
-        const synchronizedTrait = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s*(?::[^=]+)?=.+\.tag\([^)]*\bsync\s*=\s*(?:True|true)\b/);
-        if (synchronizedTrait)
-            addRecord(records, {
-                kind: 'synchronized-trait-state',
-                projections: ['stateful_resources'],
-                presumptiveInventory: true,
-                path,
-                line: index + 1,
-                anchor: line,
-                owner,
-                identity: `synchronized-trait:${synchronizedTrait[1]}@${index + 1}`,
-                tokens: [synchronizedTrait[1], 'sync'],
-                addressToken: synchronizedTrait[1],
-                operationToken: 'sync-trait',
-            });
-        for (const resourceAssignment of line.matchAll(/\b([A-Za-z_][A-Za-z0-9_.]*)\.(src|href)\s*=\s*([^;]+)/g))
-            addRecord(records, {
-                kind: 'browser-resource-load-operation',
-                projections: ['external_dependencies'],
-                presumptiveInventory: true,
-                path,
-                line: index + 1,
-                anchor: line,
-                owner,
-                identity: `browser-resource:${resourceAssignment[1]}.${resourceAssignment[2]}:${resourceAssignment[3].trim()}@${index + 1}`,
-                tokens: [resourceAssignment[1], resourceAssignment[2], resourceAssignment[3].trim()],
-                operationToken: `${resourceAssignment[1]}.${resourceAssignment[2]}=`,
-                addressToken: resourceAssignment[3].trim(),
-            });
-        const openWrite = line.match(/\bopen\s*\([^,\n]+,\s*(?:mode\s*=\s*)?['"]([wax+][^'"]*)['"]/) ??
-            line.match(/\b[A-Za-z_][A-Za-z0-9_.]*\.open\s*\(\s*['"]([wax+][^'"]*)['"]/);
-        if (openWrite)
-            addRecord(records, {
-                kind: 'filesystem-write-operation', projections: ['stateful_resources', 'external_dependencies'], presumptiveInventory: true,
-                path, line: index + 1, anchor: line, owner,
-                identity: `open-write:${openWrite[1]}@${index + 1}`, tokens: [openWrite[1]], operationToken: 'open-write',
-            });
-        for (const mutation of line.matchAll(/\b((?:self\.)?[A-Za-z_][A-Za-z0-9_]*(?:\.[A-Za-z_][A-Za-z0-9_]*)*)\.(append|extend|add|set|update|pop|remove|discard|clear|put|put_nowait|setdefault)\s*\(/g)) {
-            const target = mutation[1];
-            if (!target.startsWith('self.') &&
-                !/^[A-Z][A-Z0-9_]*$/.test(target) &&
-                !/(?:cache|config|credential|hook|open_span|queue|registry|session|state|store|token|variable)/i.test(target))
-                continue;
-            addRecord(records, {
-                kind: 'in-memory-state-mutation', projections: ['stateful_resources'], presumptiveInventory: true,
-                path, line: index + 1, anchor: line, owner,
-                identity: `memory-mutation:${target}.${mutation[2]}@${index + 1}`,
-                tokens: [target, mutation[2]], operationToken: mutation[2], addressToken: target,
-            });
-        }
-        const indexedMutation = line.match(/^\s*((?:self\.)?[A-Za-z_][A-Za-z0-9_]*(?:\.[A-Za-z_][A-Za-z0-9_]*)*)\s*\[[^\]]+\]\s*=/);
-        if (indexedMutation &&
-            (indexedMutation[1].startsWith('self.') ||
-                /^[A-Z][A-Z0-9_]*$/.test(indexedMutation[1]) ||
-                /(?:cache|config|credential|queue|registry|session|state|store|token|variable)/i.test(indexedMutation[1])))
-            addRecord(records, {
-                kind: 'in-memory-state-mutation', projections: ['stateful_resources'], presumptiveInventory: true,
-                path, line: index + 1, anchor: line, owner,
-                identity: `memory-index-write:${indexedMutation[1]}@${index + 1}`,
-                tokens: [indexedMutation[1]], operationToken: 'indexed-write', addressToken: indexedMutation[1],
-            });
-        for (const remoteMutation of line.matchAll(/\b((?:[A-Za-z_][A-Za-z0-9_]*\.)+[A-Za-z_][A-Za-z0-9_]*)\.(post|put|patch|delete|create|update|remove|publish)\s*\(/gi)) {
-            addRecord(records, {
-                kind: 'remote-state-mutation-operation', projections: ['stateful_resources', 'external_dependencies'], presumptiveInventory: true,
-                path, line: index + 1, anchor: line, owner,
-                identity: `remote-mutation:${remoteMutation[1]}.${remoteMutation[2]}@${index + 1}`,
-                tokens: [remoteMutation[1], remoteMutation[2]], operationToken: remoteMutation[2].toLowerCase(),
-            });
-        }
-        const stateAddress = line.match(/^\s*((?:self\.)?[A-Za-z_][A-Za-z0-9_]*(?:PATH|FILE|DIR|HOME|CACHE|CONFIG|STORE|TOKEN|CREDENTIAL|DATABASE)[A-Za-z0-9_]*)\s*(?::[^=]+)?=\s*(.+)$/i);
-        if (stateAddress && /(?:\bPath\s*\(|\/\s*['"]|['"][^'"]*(?:\/|\.[A-Za-z0-9]{1,8})['"])/.test(stateAddress[2])) {
-            addRecord(records, {
-                kind: 'state-address-declaration', projections: ['stateful_resources'], presumptiveInventory: true,
-                path, line: index + 1, anchor: line, owner,
-                identity: `state-address:${stateAddress[1]}@${index + 1}`,
-                tokens: [stateAddress[1], stateAddress[2].trim()], addressToken: stateAddress[1],
-            });
-        }
-        const dataclassState = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s*:\s*[^=]+?=\s*field\(\s*default_factory\s*=\s*([A-Za-z_][A-Za-z0-9_.]*)/);
-        if (dataclassState)
-            addRecord(records, {
-                kind: 'in-memory-state', projections: ['stateful_resources'], presumptiveInventory: true,
-                path, line: index + 1, anchor: line, owner,
-                identity: `dataclass-state:${dataclassState[1]}:${dataclassState[2]}@${index + 1}`,
-                tokens: [dataclassState[1], dataclassState[2]], addressToken: dataclassState[1],
-            });
-        const mutableAssignment = line.match(/^\s*(?:self\.)?([A-Za-z_][A-Za-z0-9_]*)\s*(?::[^=]+)?=\s*(\{\}|\[\]|set\(\)|dict\(\)|list\(\))/);
-        if (mutableAssignment)
-            addRecord(records, {
-                kind: 'in-memory-state', projections: ['stateful_resources'], presumptiveInventory: false,
-                path, line: index + 1, anchor: line, owner,
-                identity: `mutable:${mutableAssignment[1]}@${index + 1}`, tokens: [mutableAssignment[1], mutableAssignment[2]],
-                addressToken: mutableAssignment[1],
-            });
-        const wrapperAssignment = line.match(/^\s*([A-Za-z_][A-Za-z0-9_.]*)\s*=\s*([A-Za-z_][A-Za-z0-9_.]*)\s*(?:#.*)?$/);
-        const wrapperRoot = wrapperAssignment?.[1].split('.')[0] ?? '';
-        const wrapperTarget = wrapperAssignment?.[2] ?? '';
-        const looksLikeInstalledWrapper = Boolean(wrapperAssignment
-            && wrapperAssignment[1].includes('.')
-            && (/^[A-Z]/.test(wrapperRoot)
-                || /^(?:builtins|os|sys|asyncio|concurrent|threading|socket|signal)\./.test(wrapperAssignment[1])
-                || /(?:wrap|patch|handler|hook|instrument|send|receive|respond)/i.test(wrapperTarget)));
-        if (wrapperAssignment && looksLikeInstalledWrapper)
-            addRecord(records, {
-                kind: 'installed-wrapper-state', projections: ['stateful_resources', 'external_dependencies'], presumptiveInventory: true,
-                path, line: index + 1, anchor: line, owner,
-                identity: `patch:${wrapperAssignment[1]}:${wrapperAssignment[2]}@${index + 1}`,
-                tokens: [wrapperAssignment[1], wrapperAssignment[2]], operationToken: wrapperAssignment[1], addressToken: wrapperAssignment[1],
-            });
-        const routeMethods = [...line.matchAll(/['"](GET|POST|PUT|PATCH|DELETE|OPTIONS|HEAD)['"]/g)].map((match) => match[1]);
-        if (/\b(?:Route|router\.|app\.|add_url_rule)/.test(line) && routeMethods.length > 0) {
-            const route = line.match(/(?:f|r|fr|rf)?['"](\/[^'"]*)['"]/)?.[1];
-            routeMethods.forEach((method) => addRecord(records, {
-                kind: 'required-inbound-operation', projections: ['external_dependencies'], presumptiveInventory: true,
-                path, line: index + 1, anchor: line, owner,
-                identity: `inbound:${method}:${route ?? 'route'}@${index + 1}`,
-                tokens: [method, route ?? 'route'], operationToken: method, addressToken: route,
-            }));
-        }
-    });
-}
-function parenthesisDelta(value) {
-    let delta = 0;
-    let quote = null;
-    let escaped = false;
-    for (const char of value) {
-        if (escaped) {
-            escaped = false;
-            continue;
-        }
-        if (char === '\\') {
-            escaped = true;
-            continue;
-        }
-        if (quote) {
-            if (char === quote)
-                quote = null;
-            continue;
-        }
-        if (char === "'" || char === '"') {
-            quote = char;
-            continue;
-        }
-        if (char === '(')
-            delta += 1;
-        if (char === ')')
-            delta -= 1;
-    }
-    return delta;
-}
-function splitTopLevelJavaScript(value) {
-    const segments = [];
-    let start = 0;
-    let parentheses = 0;
-    let brackets = 0;
-    let braces = 0;
-    let quote = null;
-    let escaped = false;
-    let lineComment = false;
-    let blockComment = false;
-    for (let index = 0; index < value.length; index += 1) {
-        const char = value[index];
-        const next = value[index + 1];
-        if (lineComment) {
-            if (char === '\n')
-                lineComment = false;
-            continue;
-        }
-        if (blockComment) {
-            if (char === '*' && next === '/') {
-                blockComment = false;
-                index += 1;
-            }
-            continue;
-        }
-        if (escaped) {
-            escaped = false;
-            continue;
-        }
-        if (quote) {
-            if (char === '\\')
-                escaped = true;
-            else if (char === quote)
-                quote = null;
-            continue;
-        }
-        if (char === '/' && next === '/') {
-            lineComment = true;
-            index += 1;
-            continue;
-        }
-        if (char === '/' && next === '*') {
-            blockComment = true;
-            index += 1;
-            continue;
-        }
-        if (char === "'" || char === '"' || char === '`') {
-            quote = char;
-            continue;
-        }
-        if (char === '(')
-            parentheses += 1;
-        else if (char === ')')
-            parentheses -= 1;
-        else if (char === '[')
-            brackets += 1;
-        else if (char === ']')
-            brackets -= 1;
-        else if (char === '{')
-            braces += 1;
-        else if (char === '}')
-            braces -= 1;
-        else if (char === ',' && parentheses === 0 && brackets === 0 && braces === 0) {
-            segments.push(value.slice(start, index));
-            start = index + 1;
-        }
-    }
-    segments.push(value.slice(start));
-    return segments;
-}
-function javascriptCallArguments(call) {
-    const open = call.indexOf('(');
-    if (open < 0)
-        return [];
-    let depth = 0;
-    let quote = null;
-    let escaped = false;
-    let lineComment = false;
-    let blockComment = false;
-    for (let index = open + 1; index < call.length; index += 1) {
-        const char = call[index];
-        const next = call[index + 1];
-        if (lineComment) {
-            if (char === '\n')
-                lineComment = false;
-            continue;
-        }
-        if (blockComment) {
-            if (char === '*' && next === '/') {
-                blockComment = false;
-                index += 1;
-            }
-            continue;
-        }
-        if (escaped) {
-            escaped = false;
-            continue;
-        }
-        if (quote) {
-            if (char === '\\')
-                escaped = true;
-            else if (char === quote)
-                quote = null;
-            continue;
-        }
-        if (char === '/' && next === '/') {
-            lineComment = true;
-            index += 1;
-            continue;
-        }
-        if (char === '/' && next === '*') {
-            blockComment = true;
-            index += 1;
-            continue;
-        }
-        if (char === "'" || char === '"' || char === '`') {
-            quote = char;
-            continue;
-        }
-        if (char === '(')
-            depth += 1;
-        else if (char === ')' && depth > 0)
-            depth -= 1;
-        else if (char === ')')
-            return splitTopLevelJavaScript(call.slice(open + 1, index));
-    }
-    return [];
-}
-function directFetchMethod(call) {
-    const init = javascriptCallArguments(call)[1]?.trim();
-    if (!init?.startsWith('{'))
-        return undefined;
-    let close = -1;
-    let depth = 0;
-    let quote = null;
-    let escaped = false;
-    for (let index = 0; index < init.length; index += 1) {
-        const char = init[index];
-        if (escaped) {
-            escaped = false;
-            continue;
-        }
-        if (quote) {
-            if (char === '\\')
-                escaped = true;
-            else if (char === quote)
-                quote = null;
-            continue;
-        }
-        if (char === "'" || char === '"' || char === '`') {
-            quote = char;
-            continue;
-        }
-        if (char === '{')
-            depth += 1;
-        else if (char === '}') {
-            depth -= 1;
-            if (depth === 0) {
-                close = index;
-                break;
-            }
-        }
-    }
-    if (close < 0)
-        return undefined;
-    let method;
-    for (const property of splitTopLevelJavaScript(init.slice(1, close))) {
-        const direct = property.match(/^\s*(?:method|['"]method['"])\s*:\s*([\s\S]*)$/i);
-        if (!direct)
-            continue;
-        method = direct[1].match(/^\s*(['"])(GET|POST|PUT|PATCH|DELETE|OPTIONS|HEAD)\1(?:\s|$)/i)?.[2];
-    }
-    return method;
-}
-function scanExternalCallBlocks(path, lines, owners, executable, records) {
-    for (let index = 0; index < lines.length; index += 1) {
-        if (!executable[index])
-            continue;
-        const start = lines[index];
-        const call = start.match(/\b([A-Za-z_][A-Za-z0-9_.]*)\s*\(/);
-        if (!call)
-            continue;
-        let depth = parenthesisDelta(start.slice(call.index ?? 0));
-        const block = [start];
-        let end = index;
-        while (depth > 0 && end + 1 < lines.length && end - index < 40) {
-            end += 1;
-            block.push(lines[end]);
-            depth += parenthesisDelta(lines[end]);
-        }
-        const blockText = block.join('\n');
-        const callable = call[1];
-        const shortCallable = callable.split('.').at(-1) ?? callable;
-        const owner = owners[index] ?? basename(path);
-        const callLiterals = literalTokens(blockText);
-        if (shortCallable === 'register' && callLiterals.length > 0) {
-            const selector = callLiterals[0];
-            const argumentText = blockText.slice(blockText.indexOf('(') + 1, blockText.lastIndexOf(')'));
-            const implementation = argumentText.split(',').slice(1).join(',').trim() || 'registered-callback';
-            addRecord(records, {
-                kind: 'installed-registration-state',
-                projections: ['stateful_resources'],
-                presumptiveInventory: true,
-                path,
-                line: index + 1,
-                anchor: start,
-                owner,
-                identity: `installed-registration:${callable}:${selector}:${implementation}@${index + 1}`,
-                tokens: [callable, selector, implementation],
-                selectorKey: selector,
-                implementationKey: implementation,
-                operationToken: callable,
-                addressToken: selector,
-            });
-        }
-        if (/^(?:addEventListener|addListener|observe|on|register_magic_function|subscribe|watch)$/.test(shortCallable)) {
-            const selector = callLiterals.join('|') || 'all-events';
-            addRecord(records, {
-                kind: 'callback-registration-operation',
-                projections: path.endsWith('.py')
-                    ? ['stateful_resources', 'external_dependencies']
-                    : ['external_dependencies'],
-                presumptiveInventory: true,
-                path,
-                line: index + 1,
-                anchor: start,
-                owner,
-                identity: `callback-registration:${callable}:${selector}@${index + 1}`,
-                tokens: [callable, ...callLiterals],
-                selectorKey: selector,
-                implementationKey: `callback@${path}:${index + 1}`,
-                operationToken: callable,
-                addressToken: selector,
-            });
-        }
-        const constructorBoundary = /(?:Api|Channel|Client|Connection|Consumer|Exporter|Producer|Provider|Publisher|Reader|Session|Stub|Transport|Writer)$/i.test(shortCallable) &&
-            /(?:endpoint|base_url|url|host|address|dsn|channel|connection|session|transport|headers|credentials)\s*=/i.test(blockText);
-        if (constructorBoundary) {
-            addRecord(records, {
-                kind: 'external-constructor-operation', projections: ['external_dependencies'], presumptiveInventory: true,
-                path, line: index + 1, anchor: start, owner,
-                identity: `external-constructor:${callable}@${index + 1}`,
-                tokens: [callable, ...literalTokens(blockText).slice(0, 8)],
-                operationToken: callable,
-            });
-        }
-        if (/(?:^|\.)(?:run|Popen|call|check_call|check_output|spawn|exec|execFile)$/.test(callable) &&
-            /['"](?:add|configure|create|delete|disable|enable|install|patch|register|remove|set|update)['"]/.test(blockText)) {
-            addRecord(records, {
-                kind: 'installed-command-state', projections: ['stateful_resources', 'external_dependencies'], presumptiveInventory: true,
-                path, line: index + 1, anchor: start, owner,
-                identity: `installed-command:${callable}:${literalTokens(blockText).join(':')}@${index + 1}`,
-                tokens: [callable, ...literalTokens(blockText).slice(0, 10)], operationToken: callable,
-            });
-        }
-        if (/^(?:self\.)?_(?:get|post|put|patch|delete|request)(?:_raw)?$/i.test(callable)) {
-            const address = blockText.match(/(?:f|r|fr|rf)?['"]([^'"]*(?:\/|https?:)[^'"]*)['"]/)?.[1];
-            if (address)
-                addRecord(records, {
-                    kind: 'http-wrapper-operation',
-                    projections: /_(?:post|put|patch|delete)(?:_raw)?$/i.test(callable)
-                        ? ['stateful_resources', 'external_dependencies']
-                        : ['external_dependencies'],
-                    presumptiveInventory: true,
-                    path, line: index + 1, anchor: start, owner,
-                    identity: `http-wrapper:${callable}:${address}@${index + 1}`,
-                    tokens: [callable, address], operationToken: callable, addressToken: address,
-                });
-        }
-        if (/(?:^|\.)(?:Route|route|add_url_rule)$/.test(callable)) {
-            const methods = [...blockText.matchAll(/['"](GET|POST|PUT|PATCH|DELETE|OPTIONS|HEAD)['"]/g)]
-                .map((match) => match[1]);
-            const route = blockText.match(/(?:f|r|fr|rf)?['"](\/[^'"]*)['"]/)?.[1];
-            [...new Set(methods)].forEach((method) => addRecord(records, {
-                kind: 'required-inbound-operation', projections: ['external_dependencies'], presumptiveInventory: true,
-                path, line: index + 1, anchor: start, owner,
-                identity: `inbound:${method}:${route ?? callable}@${index + 1}`,
-                tokens: [method, route ?? callable], operationToken: method, addressToken: route,
-            }));
-        }
-    }
-}
-function scanPythonProtocolCallbacks(path, lines, owners, executable, records) {
-    lines.forEach((line, index) => {
-        if (!executable[index])
-            return;
-        const method = line.match(/^\s*(?:async\s+def|def)\s+([A-Za-z_][A-Za-z0-9_]*)\s*\(/)?.[1];
-        if (!method || /^__.*__$/.test(method))
-            return;
-        const owner = owners[index] ?? basename(path);
-        const classOwner = owner.split('.').slice(0, -1).join('.');
-        if (!/(?:Api|Callback|Client|Consumer|Executor|Exporter|Finder|Handler|Hook|Instrumentor|Listener|Loader|Plugin|Processor|Provider|Publisher|Receiver|Session|Transport|Wrapper)(?:\.|$)/i.test(classOwner))
-            return;
-        const projections = ['external_dependencies'];
-        if (/(?:Callback|Finder|Handler|Hook|Instrumentor|Loader|Plugin|Wrapper)(?:\.|$)/i.test(classOwner)) {
-            projections.push('stateful_resources');
-        }
-        addRecord(records, {
-            kind: 'protocol-callback-operation', projections, presumptiveInventory: true,
-            path, line: index + 1, anchor: line, owner: classOwner,
-            identity: `protocol-callback:${classOwner}.${method}@${index + 1}`,
-            tokens: [classOwner, method], operationToken: method,
-        });
-    });
-}
-function scanPythonOptionalImports(path, lines, owners, executable, records) {
-    lines.forEach((line, index) => {
-        if (!executable[index])
-            return;
-        const imported = line.match(/^\s*(?:from\s+([A-Za-z_][A-Za-z0-9_.]*)\s+import|import\s+([A-Za-z_][A-Za-z0-9_.]*))/);
-        if (!imported)
-            return;
-        const owner = owners[index] ?? basename(path);
-        const nearby = lines.slice(Math.max(0, index - 3), Math.min(lines.length, index + 5)).join('\n');
-        if (!/except\s+(?:ImportError|ModuleNotFoundError)|\btry\s*:|optional\s+(?:dependency|package)|required\s+to\s+use/i.test(nearby))
-            return;
-        const name = normalizePackageName((imported[1] ?? imported[2]).split('.')[0]);
-        addRecord(records, {
-            kind: 'optional-import-package-state', projections: ['stateful_resources'], presumptiveInventory: false,
-            path, line: index + 1, anchor: line, owner,
-            identity: `optional-import:${name}@${index + 1}`,
-            tokens: [name], addressToken: name, packageName: name,
-        });
-        addRecord(records, {
-            kind: 'optional-import-operation', projections: ['external_dependencies'], presumptiveInventory: false,
-            path, line: index + 1, anchor: line, owner,
-            identity: `optional-import:${name}@${index + 1}`,
-            tokens: [name], operationToken: 'import-optional-package', packageName: name,
-        });
-    });
-}
-const PYTHON_STANDARD_LIBRARY_ROOTS = new Set([
-    '__future__', 'abc', 'argparse', 'array', 'ast', 'asyncio', 'atexit', 'base64',
-    'bisect', 'builtins', 'bz2', 'calendar', 'cmath', 'cmd', 'code', 'codecs',
-    'collections', 'concurrent', 'configparser', 'contextlib', 'contextvars', 'copy',
-    'csv', 'ctypes', 'dataclasses', 'datetime', 'decimal', 'difflib', 'dis', 'email',
-    'enum', 'errno', 'faulthandler', 'fcntl', 'filecmp', 'fileinput', 'fnmatch',
-    'fractions', 'ftplib', 'functools', 'gc', 'getopt', 'getpass', 'gettext', 'glob',
-    'graphlib', 'gzip', 'hashlib', 'heapq', 'hmac', 'html', 'http', 'imaplib',
-    'importlib', 'inspect', 'io', 'ipaddress', 'itertools', 'json', 'keyword',
-    'linecache', 'locale', 'logging', 'lzma', 'mailbox', 'math', 'mimetypes',
-    'multiprocessing', 'netrc', 'numbers', 'operator', 'os', 'pathlib', 'pickle',
-    'pkgutil', 'platform', 'plistlib', 'pprint', 'profile', 'pstats', 'pty', 'pwd',
-    'queue', 'random', 're', 'readline', 'resource', 'runpy', 'sched', 'secrets',
-    'select', 'selectors', 'shelve', 'shlex', 'shutil', 'signal', 'site', 'smtplib',
-    'socket', 'sqlite3', 'ssl', 'stat', 'statistics', 'string', 'stringprep',
-    'struct', 'subprocess', 'sys', 'sysconfig', 'tarfile', 'tempfile', 'textwrap',
-    'threading', 'time', 'timeit', 'tkinter', 'token', 'tokenize', 'tomllib',
-    'trace', 'traceback', 'tracemalloc', 'types', 'typing', 'unittest', 'urllib',
-    'uuid', 'venv', 'warnings', 'wave', 'weakref', 'webbrowser', 'xml', 'xmlrpc',
-    'zipfile', 'zipimport', 'zlib', 'zoneinfo',
-]);
-function scanPythonImportedSdkOperations(path, lines, owners, executable, localModuleRoots, records) {
-    const bindings = new Map();
-    for (const line of lines) {
-        const importedModule = line.match(/^\s*import\s+([A-Za-z_][A-Za-z0-9_.]*)(?:\s+as\s+([A-Za-z_][A-Za-z0-9_]*))?/);
-        if (importedModule) {
-            const root = importedModule[1].split('.')[0];
-            if (!PYTHON_STANDARD_LIBRARY_ROOTS.has(root) && !localModuleRoots.has(root)) {
-                bindings.set(importedModule[2] ?? root, importedModule[1]);
-            }
-        }
-        const importedSymbols = line.match(/^\s*from\s+([A-Za-z_][A-Za-z0-9_.]*)\s+import\s+(.+)$/);
-        if (!importedSymbols)
-            continue;
-        const root = importedSymbols[1].split('.')[0];
-        if (PYTHON_STANDARD_LIBRARY_ROOTS.has(root) || localModuleRoots.has(root))
-            continue;
-        for (const rawSymbol of importedSymbols[2].replace(/[()]/g, '').split(',')) {
-            const symbol = rawSymbol.trim().match(/^([A-Za-z_][A-Za-z0-9_]*)(?:\s+as\s+([A-Za-z_][A-Za-z0-9_]*))?/);
-            if (symbol)
-                bindings.set(symbol[2] ?? symbol[1], `${importedSymbols[1]}.${symbol[1]}`);
-        }
-    }
-    if (bindings.size === 0)
-        return;
-    const instanceBindings = new Map();
-    for (const line of lines) {
-        const assignment = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=\s*([A-Za-z_][A-Za-z0-9_.]*)\s*\(/);
-        if (!assignment)
-            continue;
-        const root = assignment[2].split('.')[0];
-        const importedIdentity = bindings.get(root);
-        const constructor = assignment[2].split('.').at(-1) ?? '';
-        if (importedIdentity &&
-            /(?:Api|Browser|Channel|Client|Connection|Consumer|Exporter|Producer|Provider|Publisher|Reader|Resolver|Session|Stub|Transport|Writer)$/i.test(constructor)) {
-            instanceBindings.set(assignment[1], `${importedIdentity}${assignment[2].slice(root.length)}`);
-        }
-    }
-    lines.forEach((line, index) => {
-        if (!executable[index] || /^\s*(?:from|import)\s/.test(line))
-            return;
-        const owner = owners[index] ?? basename(path);
-        for (const [binding, importedIdentity] of bindings) {
-            const escaped = binding.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-            const callPattern = new RegExp(`\\b(${escaped}(?:\\.[A-Za-z_][A-Za-z0-9_]*)*)\\s*\\(`, 'g');
-            for (const match of line.matchAll(callPattern)) {
-                const callable = match[1];
-                const boundaryLike = /(?:api|browser|client|convert|display|entry.?point|export|fusion|host|http|loader|model|network|plugin|resource|schema|sdk|session|socket|trait|transport|widget)/i
-                    .test(`${importedIdentity} ${callable}`);
-                addRecord(records, {
-                    kind: 'imported-sdk-operation',
-                    projections: ['external_dependencies'],
-                    presumptiveInventory: boundaryLike,
-                    path,
-                    line: index + 1,
-                    anchor: line,
-                    owner,
-                    identity: `imported-sdk:${importedIdentity}:${callable}@${index + 1}:${match.index ?? 0}`,
-                    tokens: [importedIdentity, callable],
-                    operationToken: callable,
-                    addressToken: importedIdentity,
-                });
-            }
-        }
-        for (const [binding, constructorIdentity] of instanceBindings) {
-            const escaped = binding.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-            const callPattern = new RegExp(`\\b(${escaped}\\.([A-Za-z_][A-Za-z0-9_]*))\\s*\\(`, 'g');
-            for (const match of line.matchAll(callPattern)) {
-                const callable = match[1];
-                const method = match[2];
-                const boundaryLike = /^(?:ack|call|connect|consume|create|delete|execute|export|get|invoke|list|load|post|publish|put|query|read|receive|remove|request|respond|send|stream|update|write)$/i
-                    .test(method);
-                addRecord(records, {
-                    kind: 'imported-sdk-instance-operation',
-                    projections: ['external_dependencies'],
-                    presumptiveInventory: boundaryLike,
-                    path,
-                    line: index + 1,
-                    anchor: line,
-                    owner,
-                    identity: `imported-sdk-instance:${constructorIdentity}:${callable}@${index + 1}:${match.index ?? 0}`,
-                    tokens: [constructorIdentity, callable],
-                    operationToken: callable,
-                    addressToken: constructorIdentity,
-                    operationIdentityKey: `${path}#${owner}:${callable}@${index + 1}`,
-                });
-            }
-        }
-    });
-}
-function productPublicationWorkflowJobs(path, lines) {
-    if (structuredPurposeTokens(basename(path)).some((token) => EXCLUDED_DIRECTORY_PURPOSE_TOKENS.has(token) || token === 'documentation'))
-        return new Set();
-    const jobs = new Map();
-    let jobsIndent = null;
-    let jobIndent = null;
-    let currentJob = null;
-    lines.forEach((line) => {
-        const trimmed = line.trim();
-        const indent = indentation(line);
-        if (/^jobs:\s*(?:#.*)?$/.test(trimmed)) {
-            jobsIndent = indent;
-            jobIndent = null;
-            currentJob = null;
-            return;
-        }
-        if (jobsIndent === null)
-            return;
-        if (trimmed && indent <= jobsIndent) {
-            jobsIndent = null;
-            currentJob = null;
-            return;
-        }
-        const job = line.match(/^\s*([A-Za-z0-9_.-]+):\s*(?:#.*)?$/)?.[1];
-        if (job && indent > jobsIndent && (jobIndent === null || indent === jobIndent)) {
-            jobIndent ??= indent;
-            currentJob = job;
-            jobs.set(job, []);
-            return;
-        }
-        if (currentJob)
-            jobs.get(currentJob)?.push(line);
-    });
-    const publicationOpcode = /(?:\bnpm\s+publish\b|\bmvn(?:w|\s)[^\n]*\bdeploy\b|\bgradlew?\b[^\n]*\bpublish\b|\btwine\s+upload\b|\bdocker\s+push\b|\bgh\s+release\s+create\b|\bcargo\s+publish\b|\bgem\s+push\b|\bgoReleaser\b|uses:\s*[^\s#]*(?:publish|release|deploy|upload-pages-artifact|deploy-pages)[^\s#]*)/i;
-    return new Set([...jobs].filter(([, body]) => publicationOpcode.test(body.join('\n'))).map(([job]) => job));
-}
-function isProductPublicationCommand(command) {
-    return /^(?:\.\/)?(?:mvnw?|gradlew?)\b.*\b(?:deploy|publish)\b|^npm\s+publish\b|^twine\s+upload\b|^docker\s+push\b|^gh\s+release\s+create\b|^cargo\s+publish\b|^gem\s+push\b|^git\s+(?:config|add|commit|tag|push)\b/i
-        .test(command.trim());
-}
-function scanWorkflowAndRecipeOperations(path, lines, records) {
-    const workflow = path.startsWith('.github/workflows/') || /(?:^|\/)(?:ci|pipeline)s?\.(?:ya?ml)$/i.test(path);
-    if (workflow) {
-        const publicationJobs = productPublicationWorkflowJobs(path, lines);
-        let jobsIndent = null;
-        let jobIndent = null;
-        let currentJob = 'workflow';
-        let triggerIndent = null;
-        let triggerChildIndent = null;
-        let currentTrigger = '';
-        let currentScheduleEmitted = false;
-        let blockRunIndent = null;
-        const emitSecretReads = (line, index) => {
-            for (const secret of line.matchAll(/\$\{\{\s*secrets\.([A-Za-z_][A-Za-z0-9_]*)\s*\}\}/g)) {
-                addRecord(records, {
-                    kind: publicationJobs.has(currentJob)
-                        ? 'workflow-publication-secret-read-operation'
-                        : 'workflow-secret-read-operation',
-                    projections: ['external_dependencies'],
-                    presumptiveInventory: true,
-                    path,
-                    line: index + 1,
-                    anchor: line,
-                    owner: `workflow-job:${currentJob}`,
-                    identity: `workflow-secret:${currentJob}:${secret[1]}@${index + 1}`,
-                    tokens: [currentJob, secret[1]],
-                    operationToken: 'read-workflow-secret',
-                    addressToken: secret[1],
-                    operationIdentityKey: `${path}#jobs.${currentJob}:secrets.${secret[1]}@${index + 1}`,
-                });
-            }
-        };
-        lines.forEach((line, index) => {
-            const trimmed = line.trim();
-            const indent = indentation(line);
-            emitSecretReads(line, index);
-            if (blockRunIndent !== null) {
-                if (trimmed && !trimmed.startsWith('#') && indent > blockRunIndent) {
-                    const command = trimmed.replace(/^[-@]+/, '');
-                    const installProfileCommand = /\bpip(?:3)?\s+install\b.*(?:-r|--requirement)\b/.test(command);
-                    const projections = ['external_dependencies'];
-                    if (/^git\s+(?:config|add|commit|checkout|reset|update-ref)\b/.test(command)) {
-                        projections.push('stateful_resources');
-                    }
-                    addRecord(records, {
-                        kind: publicationJobs.has(currentJob) && isProductPublicationCommand(command)
-                            ? 'workflow-publication-command-operation'
-                            : 'workflow-command-operation',
-                        projections,
-                        presumptiveInventory: !installProfileCommand,
-                        path,
-                        line: index + 1,
-                        anchor: line,
-                        owner: `workflow-job:${currentJob}`,
-                        identity: `workflow-command:${currentJob}:${command}@${index + 1}`,
-                        tokens: [currentJob, command],
-                        operationToken: command.split(/\s+/)[0],
-                        operationIdentityKey: `${path}#jobs.${currentJob}:run@${index + 1}`,
-                    });
-                    return;
-                }
-                if (trimmed && indent <= blockRunIndent)
-                    blockRunIndent = null;
-            }
-            if (/^\s*jobs:\s*(?:#.*)?$/.test(line)) {
-                jobsIndent = indent;
-                jobIndent = null;
-                triggerIndent = null;
-                triggerChildIndent = null;
-                currentTrigger = '';
-                return;
-            }
-            if (jobsIndent !== null && trimmed && indent <= jobsIndent && !/^jobs:/.test(trimmed)) {
-                jobsIndent = null;
-                jobIndent = null;
-                currentJob = 'workflow';
-            }
-            if (jobsIndent !== null) {
-                const job = line.match(/^\s*([A-Za-z0-9_.-]+):\s*(?:#.*)?$/)?.[1];
-                if (job && indent > jobsIndent && (jobIndent === null || indent === jobIndent)) {
-                    jobIndent ??= indent;
-                    currentJob = job;
-                    addRecord(records, {
-                        kind: publicationJobs.has(job)
-                            ? 'workflow-product-publication-runtime-unit'
-                            : 'workflow-controlled-runtime-unit',
-                        projections: ['runtime_roles'],
-                        presumptiveInventory: true,
-                        path,
-                        line: index + 1,
-                        anchor: line,
-                        owner: 'workflow-jobs',
-                        identity: `workflow-job:${path}#jobs.${job}`,
-                        tokens: [path, job],
-                        selectorKey: job,
-                        implementationKey: `${path}#jobs.${job}`,
-                        operationToken: 'execute-workflow-job',
-                        addressToken: `${path}#jobs.${job}`,
-                        operationIdentityKey: `${path}#jobs.${job}`,
-                    });
-                }
-            }
-            if (/^\s*on:\s*(?:#.*)?$/.test(line)) {
-                triggerIndent = indent;
-                triggerChildIndent = null;
-                currentTrigger = '';
-                currentScheduleEmitted = false;
-                return;
-            }
-            if (triggerIndent !== null && trimmed && indent <= triggerIndent && !/^on:/.test(trimmed)) {
-                triggerIndent = null;
-                triggerChildIndent = null;
-                currentTrigger = '';
-            }
-            if (triggerIndent !== null && indent > triggerIndent) {
-                const trigger = line.match(/^\s*([A-Za-z0-9_.-]+):(?:\s*.*)?$/)?.[1];
-                if (trigger && (triggerChildIndent === null || indent === triggerChildIndent)) {
-                    triggerChildIndent ??= indent;
-                    currentTrigger = trigger;
-                    currentScheduleEmitted = false;
-                    if (trigger !== 'schedule')
-                        addRecord(records, {
-                            kind: publicationJobs.size > 0
-                                ? 'workflow-publication-trigger-operation'
-                                : 'workflow-trigger-operation',
-                            projections: ['external_dependencies'],
-                            presumptiveInventory: true,
-                            path,
-                            line: index + 1,
-                            anchor: line,
-                            owner: 'workflow-trigger',
-                            identity: `workflow-trigger:${path}:${trigger}@${index + 1}`,
-                            tokens: [trigger],
-                            operationToken: trigger,
-                            addressToken: `${path}#on.${trigger}`,
-                            operationIdentityKey: `${path}#on.${trigger}@${index + 1}`,
-                        });
-                }
-                const cron = line.match(/^\s*-\s*cron:\s*(['"]?)(.+?)\1\s*(?:#.*)?$/)?.[2];
-                if (currentTrigger === 'schedule' && cron) {
-                    currentScheduleEmitted = true;
-                    addRecord(records, {
-                        kind: publicationJobs.size > 0
-                            ? 'workflow-publication-trigger-operation'
-                            : 'workflow-trigger-operation',
-                        projections: ['external_dependencies'],
-                        presumptiveInventory: true,
-                        path,
-                        line: index + 1,
-                        anchor: line,
-                        owner: 'workflow-trigger',
-                        identity: `workflow-trigger:${path}:schedule:${cron}@${index + 1}`,
-                        tokens: ['schedule', cron],
-                        operationToken: 'schedule',
-                        addressToken: cron,
-                        operationIdentityKey: `${path}#on.schedule@${index + 1}`,
-                    });
-                }
-                if (currentTrigger === 'schedule' &&
-                    !currentScheduleEmitted &&
-                    trigger &&
-                    trigger !== 'schedule')
-                    currentScheduleEmitted = true;
-            }
-            const uses = line.match(/^\s*-?\s*uses:\s*([^\s#]+)/)?.[1];
-            if (uses) {
-                addRecord(records, {
-                    kind: publicationJobs.has(currentJob)
-                        ? 'workflow-publication-action-operation'
-                        : 'workflow-action-operation',
-                    projections: ['external_dependencies'], presumptiveInventory: true,
-                    path, line: index + 1, anchor: line, owner: `workflow-job:${currentJob}`,
-                    identity: `workflow-action:${currentJob}:${uses}@${index + 1}`, tokens: [currentJob, uses],
-                    operationToken: 'uses', addressToken: uses,
-                    operationIdentityKey: `${path}#jobs.${currentJob}:uses@${index + 1}`,
-                });
-                if (publicationJobs.has(currentJob) && /(?:cache|artifact|publish|release|deploy)/i.test(uses)) {
-                    addRecord(records, {
-                        kind: 'workflow-publication-stage-state',
-                        projections: ['stateful_resources'],
-                        presumptiveInventory: true,
-                        path,
-                        line: index + 1,
-                        anchor: line,
-                        owner: `workflow-job:${currentJob}`,
-                        identity: `publication-stage:${currentJob}:${uses}@${index + 1}`,
-                        tokens: [currentJob, uses],
-                        addressToken: `${path}#jobs.${currentJob}:uses@${index + 1}`,
-                        materializationRootIdentityKey: `${path}#jobs.${currentJob}`,
-                        reproductionOperationToken: `uses:${uses}`,
-                    });
-                }
-            }
-            const run = line.match(/^\s*-?\s*run:\s*(.+)$/)?.[1];
-            if (run === '|' || run === '>') {
-                blockRunIndent = indent;
-                return;
-            }
-            if (run && run !== '|' && run !== '>')
-                addRecord(records, {
-                    kind: publicationJobs.has(currentJob) && isProductPublicationCommand(run)
-                        ? 'workflow-publication-command-operation'
-                        : 'workflow-command-operation',
-                    projections: ['external_dependencies'], presumptiveInventory: true,
-                    path, line: index + 1, anchor: line, owner: `workflow-job:${currentJob}`,
-                    identity: `workflow-command:${currentJob}:${run}@${index + 1}`, tokens: [currentJob, run],
-                    operationToken: run.split(/\s+/)[0],
-                    operationIdentityKey: `${path}#jobs.${currentJob}:run@${index + 1}`,
-                });
-            const runner = line.match(/^\s*runs-on:\s*([^#]+?)\s*$/)?.[1];
-            if (runner)
-                addRecord(records, {
-                    kind: publicationJobs.has(currentJob)
-                        ? 'workflow-publication-host-allocation-operation'
-                        : 'workflow-host-allocation-operation',
-                    projections: ['external_dependencies'],
-                    presumptiveInventory: true,
-                    path,
-                    line: index + 1,
-                    anchor: line,
-                    owner: `workflow-job:${currentJob}`,
-                    identity: `workflow-host:${currentJob}:${runner}@${index + 1}`,
-                    tokens: [currentJob, runner],
-                    operationToken: 'allocate-workflow-host',
-                    addressToken: runner,
-                    operationIdentityKey: `${path}#jobs.${currentJob}:runs-on@${index + 1}`,
-                });
-        });
-    }
-    if (basename(path).toLowerCase() === 'makefile') {
-        lines.forEach((line, index) => {
-            if (!/^\t\S/.test(line) || /^\t[@-]?(?:#|echo\b)/.test(line))
-                return;
-            const command = line.trim().replace(/^[@-]+/, '');
-            const projections = ['external_dependencies'];
-            if (/^(?:cp|install|mkdir|mv|rsync|sed|stubgen|tar|touch|uv\s+build)\b/.test(command)) {
-                projections.push('stateful_resources');
-            }
-            addRecord(records, {
-                kind: 'build-command-operation', projections, presumptiveInventory: true,
-                path, line: index + 1, anchor: line, owner: 'make-recipe',
-                identity: `make-command:${command}@${index + 1}`, tokens: [command], operationToken: command.split(/\s+/)[0],
-            });
-        });
-    }
-}
-const NON_PRODUCTION_OPTIONAL_GROUP_PARTS = new Set([
-    'bench',
-    'benchmark',
-    'benchmarks',
-    'benchmarking',
-    'ci',
-    'dev',
-    'development',
-    'doc',
-    'docs',
-    'documentation',
-    'lint',
-    'linting',
-    'qa',
-    'release',
-    'test',
-    'tests',
-    'testing',
-    'type',
-    'types',
-    'typing',
-]);
-function executedCommandSurfaces(path, lines) {
-    const lowerName = basename(path).toLowerCase();
-    const extension = extname(lowerName);
-    const workflow = path.startsWith('.github/workflows/') ||
-        /(?:^|\/)(?:ci|pipeline)s?\.(?:ya?ml)$/i.test(path);
-    const surfaces = [];
-    let blockRunIndent = null;
-    lines.forEach((line, index) => {
-        const trimmed = line.trim();
-        const indent = indentation(line);
-        if (workflow) {
-            if (blockRunIndent !== null) {
-                if (trimmed && !trimmed.startsWith('#') && indent > blockRunIndent) {
-                    surfaces.push({
-                        line: index + 1,
-                        anchor: line,
-                        command: trimmed,
-                        preserveWholeCommand: true,
-                    });
-                    return;
-                }
-                if (trimmed && indent <= blockRunIndent)
-                    blockRunIndent = null;
-            }
-            const run = line.match(/^\s*-?\s*run:\s*(.+)$/)?.[1];
-            if (run === '|' || run === '>') {
-                blockRunIndent = indent;
-                return;
-            }
-            if (run)
-                surfaces.push({
-                    line: index + 1,
-                    anchor: line,
-                    command: run,
-                    preserveWholeCommand: true,
-                });
-            return;
-        }
-        if (lowerName === 'makefile') {
-            if (/^\t[@-]?(?!#|echo\b)\S/.test(line)) {
-                surfaces.push({
-                    line: index + 1,
-                    anchor: line,
-                    command: trimmed.replace(/^[@-]+/, ''),
-                    preserveWholeCommand: true,
-                });
-            }
-            return;
-        }
-        if (lowerName === 'dockerfile') {
-            const run = line.match(/^\s*RUN\s+(.+)$/i)?.[1];
-            if (run)
-                surfaces.push({
-                    line: index + 1,
-                    anchor: line,
-                    command: run,
-                    preserveWholeCommand: true,
-                });
-            return;
-        }
-        if (['.sh', '.bash', '.zsh', '.fish', '.ps1'].includes(extension)) {
-            if (trimmed && !trimmed.startsWith('#')) {
-                surfaces.push({
-                    line: index + 1,
-                    anchor: line,
-                    command: trimmed,
-                    preserveWholeCommand: true,
-                });
-            }
-            return;
-        }
-        if (/\b(?:subprocess\.(?:run|Popen|call|check_call|check_output)|os\.system|child_process\.(?:spawn|exec|execFile)|run_command|exec_command)\s*\(/.test(line))
-            surfaces.push({
-                line: index + 1,
-                anchor: line,
-                command: line,
-                preserveWholeCommand: false,
-            });
-    });
-    return surfaces;
-}
-function discoverPythonRequirementProfiles(root, tracked) {
-    const trackedSet = new Set(tracked);
-    const profiles = new Map();
-    for (const path of tracked) {
-        if (/^requirements(?:[._-](?:prod|production|runtime))?\.txt$/i.test(basename(path))) {
-            profiles.set(path, { path, installReferences: [] });
-        }
-    }
-    for (const sourcePath of tracked) {
-        if (!shouldScan(sourcePath))
-            continue;
-        let lines = null;
-        try {
-            lines = textLines(root, sourcePath);
-        }
-        catch {
-            lines = null;
-        }
-        if (!lines)
-            continue;
-        for (const surface of executedCommandSurfaces(sourcePath, lines)) {
-            for (const match of surface.command.matchAll(/\b(?:python(?:3(?:\.\d+)?)?\s+-m\s+)?pip(?:3)?\s+install\b[^;|&\n]*?(?:-r|--requirement)(?:\s+|=)(?:['"])([^'"]+)['"]/g)) {
-                const rawPath = (match[1] ?? '').trim();
-                const normalized = normalizePath(rawPath).replace(/^\.\//, '');
-                if (!normalized || !trackedSet.has(normalized))
-                    continue;
-                const profile = profiles.get(normalized) ?? {
-                    path: normalized,
-                    installReferences: [],
-                };
-                const command = surface.preserveWholeCommand
-                    ? surface.command.trim()
-                    : match[0].trim();
-                if (!profile.installReferences.some((reference) => reference.path === sourcePath && reference.line === surface.line && reference.command === command))
-                    profile.installReferences.push({
-                        path: sourcePath,
-                        line: surface.line,
-                        anchor: surface.anchor,
-                        command,
-                    });
-                profiles.set(normalized, profile);
-            }
-            for (const match of surface.command.matchAll(/\b(?:python(?:3(?:\.\d+)?)?\s+-m\s+)?pip(?:3)?\s+install\b[^;|&\n]*?(?:-r|--requirement)(?:\s+|=)([^\s;'"|&]+)/g)) {
-                const normalized = normalizePath(match[1]).replace(/^\.\//, '');
-                if (!normalized || !trackedSet.has(normalized))
-                    continue;
-                const profile = profiles.get(normalized) ?? {
-                    path: normalized,
-                    installReferences: [],
-                };
-                const command = surface.preserveWholeCommand
-                    ? surface.command.trim()
-                    : match[0].trim();
-                if (!profile.installReferences.some((reference) => reference.path === sourcePath && reference.line === surface.line && reference.command === command))
-                    profile.installReferences.push({
-                        path: sourcePath,
-                        line: surface.line,
-                        anchor: surface.anchor,
-                        command,
-                    });
-                profiles.set(normalized, profile);
-            }
-        }
-    }
-    for (const profile of profiles.values()) {
-        profile.installReferences.sort((left, right) => left.path.localeCompare(right.path) || left.line - right.line || left.command.localeCompare(right.command));
-    }
-    return profiles;
-}
-function scanPythonRequirementProfile(profile, lines, records) {
-    const requirements = lines.flatMap((line, index) => {
-        const trimmed = line.trim();
-        if (!trimmed || trimmed.startsWith('#') || /^-/.test(trimmed))
-            return [];
-        const requirement = trimmed.match(/^([A-Za-z0-9_.-]+)(\[[^\]]+\])?([^;#\s]*)(?:\s*;[^#]*)?(?:\s*#.*)?$/);
-        if (!requirement)
-            return [];
-        return [{
-                line: index + 1,
-                anchor: line,
-                name: normalizePackageName(requirement[1]),
-                extras: requirement[2] ?? '',
-                version: requirement[3] || 'unversioned',
-                raw: `${requirement[1]}${requirement[2] ?? ''}${requirement[3] ?? ''}`,
-            }];
-    });
-    const reproductionOperationToken = profile.installReferences[0]?.command;
-    addRecord(records, {
-        kind: 'python-requirements-installation-profile-state',
-        projections: ['stateful_resources'],
-        presumptiveInventory: true,
-        path: profile.path,
-        line: 1,
-        anchor: lines[0] ?? profile.path,
-        owner: 'python-requirements-profile',
-        identity: `requirements-profile:${profile.path}`,
-        tokens: [profile.path, ...requirements.map((requirement) => requirement.raw)],
-        addressToken: profile.path,
-        materializationRootIdentityKey: profile.path,
-        reproductionOperationToken,
-    });
-    for (const requirement of requirements)
-        addRecord(records, {
-            kind: 'python-requirement-variant-state',
-            projections: ['stateful_resources'],
-            presumptiveInventory: true,
-            path: profile.path,
-            line: requirement.line,
-            anchor: requirement.anchor,
-            owner: `python-requirements-profile:${profile.path}`,
-            identity: `requirement:${profile.path}:${requirement.line}:${requirement.raw}`,
-            tokens: [profile.path, requirement.raw, requirement.name, requirement.extras, requirement.version],
-            addressToken: requirement.name,
-            packageName: requirement.name,
-            packageVersion: requirement.version,
-            materializationRootIdentityKey: profile.path,
-            reproductionOperationToken,
-        });
-    for (const reference of profile.installReferences)
-        addRecord(records, {
-            kind: 'python-requirements-profile-install-operation',
-            projections: ['external_dependencies'],
-            presumptiveInventory: true,
-            path: reference.path,
-            line: reference.line,
-            anchor: reference.anchor,
-            owner: 'executed-install-command',
-            identity: `install-profile:${profile.path}:${reference.path}:${reference.line}:${reference.command}`,
-            tokens: [profile.path, reference.command],
-            operationToken: reference.command,
-            addressToken: profile.path,
-            operationIdentityKey: `${reference.path}#install:${reference.line}:${reference.command}`,
-            materializationRootIdentityKey: profile.path,
-            reproductionOperationToken: reference.command,
-        });
-}
-function isNonProductionOptionalGroup(value) {
-    return value
-        .trim()
-        .toLowerCase()
-        .split(/[._-]+/)
-        .some((part) => NON_PRODUCTION_OPTIONAL_GROUP_PARTS.has(part));
-}
-function optionalGroupName(line) {
-    const match = line.trim().match(/^(?:"([^"]+)"|'([^']+)'|([A-Za-z0-9_.-]+))\s*=\s*\[/);
-    return match?.[1] ?? match?.[2] ?? match?.[3];
-}
-function artifactFilename(url) {
-    const path = url.split(/[?#]/, 1)[0];
-    const encoded = path.slice(path.lastIndexOf('/') + 1);
-    try {
-        return decodeURIComponent(encoded);
-    }
-    catch {
-        return encoded;
-    }
-}
-function parseUvPackages(lines) {
-    const starts = [];
-    lines.forEach((line, index) => { if (line.trim() === '[[package]]')
-        starts.push(index); });
-    return starts.flatMap((start, position) => {
-        const end = starts[position + 1] ?? lines.length;
-        const block = lines.slice(start, end);
-        const nameIndex = block.findIndex((line) => /^name\s*=\s*"/.test(line));
-        if (nameIndex < 0)
-            return [];
-        const name = block[nameIndex].match(/^name\s*=\s*"([^"]+)"/)?.[1];
-        if (!name)
-            return [];
-        const versionIndex = block.findIndex((line) => /^version\s*=\s*"/.test(line));
-        const version = versionIndex < 0 ? 'workspace' : block[versionIndex].match(/^version\s*=\s*"([^"]+)"/)?.[1] ?? 'workspace';
-        const sourceIndex = block.findIndex((line) => /^source\s*=/.test(line));
-        const sourceLine = sourceIndex < 0 ? block[nameIndex] : block[sourceIndex];
-        const dependencies = new Set();
-        const optionalDependencies = new Set();
-        const artifacts = [];
-        let section = '';
-        let optionalGroup = '';
-        for (let blockIndex = 0; blockIndex < block.length; blockIndex += 1) {
-            const line = block[blockIndex];
-            const trimmed = line.trim();
-            if (/^dependencies\s*=\s*\[/.test(trimmed)) {
-                section = 'dependencies';
-                optionalGroup = '';
-            }
-            else if (trimmed === '[package.optional-dependencies]') {
-                section = 'optional';
-                optionalGroup = '';
-            }
-            else if (trimmed.startsWith('[package.dev-dependencies]') || trimmed.startsWith('[package.metadata]')) {
-                section = 'excluded';
-                optionalGroup = '';
-            }
-            else if (section === 'optional') {
-                const group = optionalGroupName(trimmed);
-                if (group)
-                    optionalGroup = group;
-            }
-            for (const dependency of line.matchAll(/\{\s*name\s*=\s*"([^"]+)"/g)) {
-                if (section === 'dependencies')
-                    dependencies.add(dependency[1]);
-                if (section === 'optional' &&
-                    optionalGroup &&
-                    !isNonProductionOptionalGroup(optionalGroup))
-                    optionalDependencies.add(dependency[1]);
-            }
-            for (const artifact of line.matchAll(/\{[^{}]*\burl\s*=\s*"([^"]+)"[^{}]*\bhash\s*=\s*"(sha256:[0-9a-fA-F]+)"[^{}]*\}/g)) {
-                const url = artifact[1];
-                const filename = artifactFilename(url);
-                artifacts.push({
-                    kind: /^sdist\s*=/.test(trimmed) || !filename.endsWith('.whl') ? 'sdist' : 'wheel',
-                    filename,
-                    url,
-                    hash: artifact[2].toLowerCase(),
-                    line: start + blockIndex + 1,
-                    anchor: line,
-                });
-            }
-        }
-        return [{
-                name,
-                version,
-                line: start + nameIndex + 1,
-                sourceLine,
-                editable: /editable\s*=|virtual\s*=/.test(sourceLine),
-                dependencies,
-                optionalDependencies,
-                artifacts,
-            }];
-    });
-}
-function scanUvLock(path, lines, records) {
-    const packages = parseUvPackages(lines);
-    const byName = new Map();
-    for (const pkg of packages) {
-        const variants = byName.get(pkg.name) ?? [];
-        variants.push(pkg);
-        byName.set(pkg.name, variants);
-    }
-    const roots = packages.filter((pkg) => pkg.editable);
-    const rootNames = new Set(roots.map((pkg) => pkg.name));
-    const queue = roots.flatMap((pkg) => [...pkg.dependencies, ...pkg.optionalDependencies]);
-    const reachable = new Set();
-    while (queue.length > 0) {
-        const name = queue.shift();
-        if (rootNames.has(name))
-            continue;
-        if (reachable.has(name))
-            continue;
-        const variants = byName.get(name);
-        if (!variants)
-            continue;
-        reachable.add(name);
-        for (const pkg of variants)
-            queue.push(...pkg.dependencies);
-    }
-    for (const name of [...reachable].sort()) {
-        for (const pkg of byName.get(name)) {
-            if (pkg.artifacts.length > 0) {
-                for (const artifact of pkg.artifacts) {
-                    const tokens = [
-                        name,
-                        pkg.version,
-                        artifact.kind,
-                        artifact.filename,
-                        artifact.url,
-                        artifact.hash,
-                    ];
-                    const variantIdentity = `${name}@${pkg.version}:${artifact.kind}:${artifact.hash}:${artifact.url}`;
-                    addRecord(records, {
-                        kind: 'locked-production-package-artifact-state',
-                        projections: ['stateful_resources'],
-                        presumptiveInventory: true,
-                        path,
-                        line: artifact.line,
-                        anchor: artifact.anchor,
-                        owner: 'production-package-artifact-closure',
-                        identity: `package-artifact:${variantIdentity}`,
-                        tokens,
-                        addressToken: artifact.filename,
-                        packageName: name,
-                        packageVersion: pkg.version,
-                        packageArtifactKind: artifact.kind,
-                        packageArtifactFilename: artifact.filename,
-                        packageArtifactUrl: artifact.url,
-                        packageArtifactHash: artifact.hash,
-                    });
-                    addRecord(records, {
-                        kind: 'locked-production-package-artifact-install-operation',
-                        projections: ['external_dependencies'],
-                        presumptiveInventory: true,
-                        path,
-                        line: artifact.line,
-                        anchor: artifact.anchor,
-                        owner: 'production-package-artifact-closure',
-                        identity: `pull-package-artifact:${variantIdentity}`,
-                        tokens,
-                        operationToken: 'pull-locked-package-artifact',
-                        addressToken: artifact.url,
-                        packageName: name,
-                        packageVersion: pkg.version,
-                        packageArtifactKind: artifact.kind,
-                        packageArtifactFilename: artifact.filename,
-                        packageArtifactUrl: artifact.url,
-                        packageArtifactHash: artifact.hash,
-                    });
-                }
-                continue;
-            }
-            const anchor = lines[pkg.line - 1];
-            addRecord(records, {
-                kind: 'locked-production-package-state',
-                projections: ['stateful_resources'],
-                presumptiveInventory: true,
-                path, line: pkg.line, anchor, owner: 'production-package-closure',
-                identity: `package:${name}@${pkg.version}`, tokens: [name, pkg.version],
-                addressToken: name, packageName: name, packageVersion: pkg.version,
-            });
-            addRecord(records, {
-                kind: 'locked-production-package-install-operation',
-                projections: ['external_dependencies'],
-                presumptiveInventory: true,
-                path, line: pkg.line, anchor, owner: 'production-package-closure',
-                identity: `install:${name}@${pkg.version}`, tokens: [name, pkg.version],
-                operationToken: 'install-locked-package', packageName: name, packageVersion: pkg.version,
-            });
-        }
-    }
-}
-function scanPackageLock(path, text, records) {
-    let parsed;
-    try {
-        parsed = JSON.parse(text);
-    }
-    catch {
-        return;
-    }
-    if (!parsed || typeof parsed !== 'object')
-        return;
-    const lock = parsed;
-    const lines = text.split(/\r?\n/);
-    const emittedLocations = new Set();
-    const emitPackage = (location, packageName, pkg) => {
-        if (!location || pkg.dev === true || emittedLocations.has(location))
-            return;
-        emittedLocations.add(location);
-        const name = pkg.name ?? packageName;
-        const version = pkg.version ?? 'locked';
-        const quotedLocation = JSON.stringify(location);
-        const exactLocatorTokens = [
-            `${quotedLocation}:`,
-            pkg.resolved ? JSON.stringify(pkg.resolved) : '',
-            pkg.integrity ? JSON.stringify(pkg.integrity) : '',
-            JSON.stringify(packageName),
-        ].filter(Boolean);
-        const lineIndex = exactLocatorTokens
-            .map((token) => lines.findIndex((line) => line.includes(token)))
-            .find((index) => index >= 0) ?? -1;
-        const line = lineIndex >= 0 ? lineIndex + 1 : 1;
-        const anchor = lines[line - 1] ?? '{';
-        const exactArtifact = Boolean(pkg.resolved && pkg.integrity);
-        const filename = pkg.resolved ? artifactFilename(pkg.resolved) : undefined;
-        for (const [kind, projection, operationToken] of [
-            [exactArtifact ? 'locked-production-package-artifact-state' : 'locked-production-package-state', 'stateful_resources', undefined],
-            [exactArtifact ? 'locked-production-package-artifact-install-operation' : 'locked-production-package-install-operation', 'external_dependencies', exactArtifact ? 'pull-locked-package-artifact' : 'install-locked-package'],
-        ])
-            addRecord(records, {
-                kind, projections: [projection], presumptiveInventory: true,
-                path, line, anchor, owner: 'production-package-closure',
-                identity: `${operationToken ? 'install' : 'package'}:${name}@${version}:${location}:${pkg.resolved ?? ''}:${pkg.integrity ?? ''}`,
-                tokens: [name, version, location, pkg.resolved ?? '', pkg.integrity ?? ''],
-                packageName: name,
-                packageVersion: version,
-                ...(exactArtifact ? {
-                    packageArtifactKind: 'tarball',
-                    packageArtifactFilename: filename,
-                    packageArtifactUrl: pkg.resolved,
-                    packageArtifactHash: pkg.integrity,
-                } : {}),
-                ...(operationToken ? { operationToken, addressToken: pkg.resolved } : { addressToken: filename ?? name }),
-            });
-    };
-    if (lock.packages) {
-        Object.entries(lock.packages).forEach(([location, pkg]) => {
-            if (!location)
-                return;
-            const name = pkg.name ?? location.split('/node_modules/').at(-1)
-                .replace(/^node_modules\//, '');
-            emitPackage(location, name, pkg);
-        });
-        return;
-    }
-    const walkLegacy = (dependencies, parentLocation = '') => {
-        Object.entries(dependencies).forEach(([name, pkg]) => {
-            if (pkg.dev === true)
-                return;
-            const location = parentLocation
-                ? `${parentLocation}/node_modules/${name}`
-                : `node_modules/${name}`;
-            emitPackage(location, name, pkg);
-            if (pkg.dependencies)
-                walkLegacy(pkg.dependencies, location);
-        });
-    };
-    if (lock.dependencies)
-        walkLegacy(lock.dependencies);
-}
-function scanPythonBuildRequirements(path, lines, records) {
-    let inBuild = false;
-    let inRequires = false;
-    lines.forEach((line, index) => {
-        const trimmed = line.trim();
-        if (/^\[.+\]$/.test(trimmed)) {
-            inBuild = trimmed === '[build-system]';
-            inRequires = false;
-            return;
-        }
-        if (!inBuild)
-            return;
-        if (/^requires\s*=\s*\[/.test(trimmed))
-            inRequires = true;
-        if (!inRequires)
-            return;
-        for (const match of line.matchAll(/['"]([A-Za-z0-9_.-]+)(?:\[[^\]]+\])?(?:\s*[^'"]*)?['"]/g)) {
-            const name = match[1].toLowerCase().replace(/_/g, '-');
-            addRecord(records, {
-                kind: 'build-system-package-state', projections: ['stateful_resources'], presumptiveInventory: true,
-                path, line: index + 1, anchor: line, owner: 'build-system', identity: `package:${name}`,
-                tokens: [name], addressToken: name, packageName: name,
-            });
-            addRecord(records, {
-                kind: 'build-system-package-install-operation', projections: ['external_dependencies'], presumptiveInventory: true,
-                path, line: index + 1, anchor: line, owner: 'build-system', identity: `install:${name}`,
-                tokens: [name], operationToken: 'install-build-system-package', packageName: name,
-            });
-        }
-        if (trimmed.includes(']'))
-            inRequires = false;
-    });
-}
-function normalizePackageName(value) {
-    return value.trim().toLowerCase().replace(/_/g, '-');
-}
-function xmlBlocks(source, tag) {
-    const escaped = tag.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-    const pattern = new RegExp(`<${escaped}(?:\\s[^>]*)?>([\\s\\S]*?)<\\/${escaped}>`, 'g');
-    const blocks = [];
-    for (const match of source.matchAll(pattern)) {
-        const start = match.index ?? 0;
-        blocks.push({
-            start,
-            end: start + match[0].length,
-            line: source.slice(0, start).split('\n').length,
-            text: match[1],
-        });
-    }
-    return blocks;
-}
-function xmlValue(source, tag) {
-    const escaped = tag.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-    return source.match(new RegExp(`<${escaped}(?:\\s[^>]*)?>\\s*([^<]+?)\\s*<\\/${escaped}>`))?.[1].trim();
-}
-function structuredPurposeTokens(value) {
-    return value
-        .replace(/([a-z0-9])([A-Z])/g, '$1-$2')
-        .toLowerCase()
-        .split(/[^a-z0-9]+/)
-        .filter(Boolean);
-}
-const NON_PRODUCTION_MAVEN_SCOPE_TOKENS = new Set([
-    'benchmark', 'benchmarks', 'checkstyle', 'coverage', 'dev', 'docs', 'integration',
-    'documenter', 'failsafe', 'format', 'jacoco', 'javaformat', 'jmh', 'lint', 'qa', 'site', 'spec',
-    'surefire', 'test', 'tests', 'verification', 'versions',
-]);
-function isNonProductionMavenUnit(...values) {
-    return values.some((value) => value !== undefined && structuredPurposeTokens(value)
-        .some((token) => NON_PRODUCTION_MAVEN_SCOPE_TOKENS.has(token)));
-}
-function scanMavenManifest(path, lines, records) {
-    if (basename(path).toLowerCase() !== 'pom.xml')
-        return;
-    const source = lines.join('\n');
-    const profiles = xmlBlocks(source, 'profile').map((block) => ({
-        ...block,
-        id: xmlValue(block.text, 'id') ?? `profile@${block.line}`,
-    }));
-    const profileAt = (offset) => profiles.find((profile) => offset >= profile.start && offset < profile.end)?.id;
-    const lineAnchor = (line) => lines[line - 1] ?? '<project>';
-    const beforeBuildSections = source
-        .replace(/<parent(?:\s[^>]*)?>[\s\S]*?<\/parent>/, '')
-        .split(/<(?:dependencies|dependencyManagement|build|profiles|modules)(?:\s|>)/, 1)[0];
-    const groupId = xmlValue(beforeBuildSections, 'groupId') ?? 'inherited-group';
-    const artifactId = xmlValue(beforeBuildSections, 'artifactId')
-        ?? (normalizePath(path).replace(/\/pom\.xml$/, '') || 'root-project');
-    const version = xmlValue(beforeBuildSections, 'version') ?? 'inherited-version';
-    const packaging = xmlValue(beforeBuildSections, 'packaging') ?? 'jar';
-    const moduleIdentity = `${path}#maven-project:${groupId}:${artifactId}:${version}`;
-    if (packaging !== 'pom')
-        addRecord(records, {
-            kind: 'maven-product-distribution-state',
-            projections: ['stateful_resources'],
-            presumptiveInventory: true,
-            path,
-            line: 1,
-            anchor: lines.find((line) => line.includes('<artifactId>')) ?? lines[0] ?? '<project>',
-            owner: 'maven-project',
-            identity: `distribution:${groupId}:${artifactId}:${version}:${packaging}`,
-            tokens: [groupId, artifactId, version, packaging],
-            addressToken: `${groupId}:${artifactId}`,
-            packageName: `${groupId}:${artifactId}`,
-            packageVersion: version,
-            packageArtifactKind: packaging,
-            materializationRootIdentityKey: moduleIdentity,
-            reproductionOperationToken: 'mvn package',
-        });
-    profiles.filter((profile) => !isNonProductionMavenUnit(profile.id)).forEach((profile) => addRecord(records, {
-        kind: 'maven-installation-profile-state',
-        projections: ['stateful_resources'],
-        presumptiveInventory: true,
-        path,
-        line: profile.line,
-        anchor: lineAnchor(profile.line),
-        owner: 'maven-profiles',
-        identity: `profile:${moduleIdentity}:${profile.id}`,
-        tokens: [moduleIdentity, profile.id],
-        selectorKey: profile.id,
-        addressToken: `${groupId}:${artifactId}:${profile.id}`,
-        materializationRootIdentityKey: `${moduleIdentity}:profile:${profile.id}`,
-        reproductionOperationToken: `mvn -P${profile.id} package`,
-    }));
-    const pluginBlocks = xmlBlocks(source, 'plugin');
-    const enclosingPlugin = (block) => pluginBlocks.find((plugin) => block.start > plugin.start && block.end < plugin.end);
-    xmlBlocks(source, 'dependency').forEach((dependency) => {
-        const dependencyGroup = xmlValue(dependency.text, 'groupId') ?? 'inherited-group';
-        const dependencyArtifact = xmlValue(dependency.text, 'artifactId');
-        if (!dependencyArtifact)
-            return;
-        const dependencyVersion = xmlValue(dependency.text, 'version') ?? 'managed-version';
-        const scope = xmlValue(dependency.text, 'scope') ?? 'compile';
-        if (scope === 'test' || isNonProductionMavenUnit(scope))
-            return;
-        const profile = profileAt(dependency.start) ?? 'base';
-        const plugin = enclosingPlugin(dependency);
-        const type = xmlValue(dependency.text, 'type') ?? 'jar';
-        const classifier = xmlValue(dependency.text, 'classifier') ?? 'default';
-        const optional = xmlValue(dependency.text, 'optional') ?? 'false';
-        const coordinate = `${dependencyGroup}:${dependencyArtifact}:${type}:${classifier}:${dependencyVersion}`;
-        addRecord(records, {
-            kind: plugin ? 'maven-plugin-dependency-requirement-state' : 'maven-dependency-requirement-state',
-            projections: ['stateful_resources'],
-            presumptiveInventory: true,
-            path,
-            line: dependency.line,
-            anchor: lineAnchor(dependency.line),
-            owner: `maven-profile:${profile}`,
-            identity: `requirement:${moduleIdentity}:${profile}:${scope}:${coordinate}:optional=${optional}`,
-            tokens: [moduleIdentity, profile, scope, coordinate, optional],
-            addressToken: coordinate,
-            packageName: `${dependencyGroup}:${dependencyArtifact}`,
-            packageVersion: dependencyVersion,
-            packageArtifactKind: type,
-            materializationRootIdentityKey: `${moduleIdentity}:profile:${profile}`,
-            reproductionOperationToken: profile === 'base' ? 'mvn package' : `mvn -P${profile} package`,
-        });
-    });
-    pluginBlocks.forEach((plugin) => {
-        const pluginGroup = xmlValue(plugin.text, 'groupId') ?? 'org.apache.maven.plugins';
-        const pluginArtifact = xmlValue(plugin.text, 'artifactId');
-        if (!pluginArtifact)
-            return;
-        const pluginVersion = xmlValue(plugin.text, 'version') ?? 'managed-version';
-        const profile = profileAt(plugin.start) ?? 'base';
-        const pluginCoordinate = `${pluginGroup}:${pluginArtifact}:${pluginVersion}`;
-        if (!isNonProductionMavenUnit(pluginArtifact))
-            addRecord(records, {
-                kind: 'maven-build-plugin-requirement-state',
-                projections: ['stateful_resources'],
-                presumptiveInventory: true,
-                path,
-                line: plugin.line,
-                anchor: lineAnchor(plugin.line),
-                owner: `maven-profile:${profile}`,
-                identity: `plugin:${moduleIdentity}:${profile}:${pluginCoordinate}`,
-                tokens: [moduleIdentity, profile, pluginCoordinate],
-                addressToken: pluginCoordinate,
-                packageName: `${pluginGroup}:${pluginArtifact}`,
-                packageVersion: pluginVersion,
-                packageArtifactKind: 'maven-plugin',
-                materializationRootIdentityKey: `${moduleIdentity}:profile:${profile}`,
-                reproductionOperationToken: profile === 'base' ? 'mvn package' : `mvn -P${profile} package`,
-            });
-        const executions = xmlBlocks(plugin.text, 'execution');
-        const admittedExecutions = executions.map((execution) => ({
-            ...execution,
-            absoluteLine: plugin.line + execution.line - 1,
-            id: xmlValue(execution.text, 'id') ?? `execution@${plugin.line + execution.line - 1}`,
-            phase: xmlValue(execution.text, 'phase'),
-            goals: xmlBlocks(execution.text, 'goal').map((goal) => goal.text.trim()).filter(Boolean),
-        })).filter((execution) => !isNonProductionMavenUnit(pluginArtifact, execution.id, execution.phase, ...execution.goals));
-        if (admittedExecutions.length === 0)
-            return;
-        const familyIdentity = `plugin-executions:${moduleIdentity}:${profile}:${pluginCoordinate}`;
-        addRecord(records, {
-            kind: 'maven-plugin-execution-family',
-            projections: ['registry_families'],
-            presumptiveInventory: true,
-            path,
-            line: plugin.line,
-            anchor: lineAnchor(plugin.line),
-            owner: `maven-plugin:${pluginCoordinate}`,
-            identity: familyIdentity,
-            tokens: [pluginCoordinate, profile],
-            implementationKey: pluginCoordinate,
-        });
-        admittedExecutions.forEach((execution) => addRecord(records, {
-            kind: 'maven-plugin-execution-entrypoint-state',
-            projections: ['stateful_resources', 'registry_entries'],
-            presumptiveInventory: true,
-            path,
-            line: execution.absoluteLine,
-            anchor: lineAnchor(execution.absoluteLine),
-            owner: `maven-plugin:${pluginCoordinate}`,
-            identity: `${familyIdentity}:${execution.id}`,
-            tokens: [pluginCoordinate, execution.id, execution.phase ?? '', ...execution.goals],
-            selectorKey: execution.id,
-            implementationKey: `${pluginCoordinate}:${execution.goals.join('+') || 'default-goal'}`,
-            addressToken: execution.id,
-            materializationRootIdentityKey: `${moduleIdentity}:profile:${profile}`,
-            reproductionOperationToken: profile === 'base'
-                ? `mvn ${pluginGroup}:${pluginArtifact}:${execution.goals[0] ?? execution.id}`
-                : `mvn -P${profile} ${pluginGroup}:${pluginArtifact}:${execution.goals[0] ?? execution.id}`,
-        }));
-    });
-}
-function addDeclaredProductionPackage(path, line, anchor, rawName, version, profileIdentityKey, records) {
-    const name = normalizePackageName(rawName);
-    if (!name || name === 'python')
-        return;
-    const alreadyDeclared = [...records.values()].some((record) => record.kind === 'declared-production-package-state' &&
-        record.package_name === name &&
-        record.package_version === version &&
-        record.materialization_root_identity_key === profileIdentityKey);
-    if (alreadyDeclared)
-        return;
-    addRecord(records, {
-        kind: 'declared-production-package-state', projections: ['stateful_resources'], presumptiveInventory: true,
-        path, line, anchor, owner: `production-package-profile:${profileIdentityKey}`,
-        identity: `package:${profileIdentityKey}:${name}@${version}`, tokens: [profileIdentityKey, name, version],
-        addressToken: name, packageName: name, packageVersion: version,
-        materializationRootIdentityKey: profileIdentityKey,
-    });
-    addRecord(records, {
-        kind: 'declared-production-package-install-operation', projections: ['external_dependencies'], presumptiveInventory: true,
-        path, line, anchor, owner: `production-package-profile:${profileIdentityKey}`,
-        identity: `install:${profileIdentityKey}:${name}@${version}`, tokens: [profileIdentityKey, name, version],
-        operationToken: 'install-production-package', packageName: name, packageVersion: version,
-        materializationRootIdentityKey: profileIdentityKey,
-        operationIdentityKey: `${profileIdentityKey}:install:${name}@${version}`,
-    });
-}
-function scanProductionManifestPackages(path, lines, records) {
-    const lowerName = basename(path).toLowerCase();
-    if (lowerName === 'pyproject.toml') {
-        let projectSection = false;
-        let projectName = 'python-project';
-        for (const line of lines) {
-            const header = line.trim().match(/^\[([^\]]+)\]$/)?.[1];
-            if (header) {
-                projectSection = header === 'project';
-                continue;
-            }
-            if (!projectSection)
-                continue;
-            const declaredName = line.trim().match(/^name\s*=\s*['"]([^'"]+)['"]/)?.[1];
-            if (declaredName) {
-                projectName = normalizePackageName(declaredName);
-                break;
-            }
-        }
-        let section = '';
-        let inProjectArray = false;
-        let optionalGroup = '';
-        let inOptionalArray = false;
-        lines.forEach((line, index) => {
-            const trimmed = line.trim();
-            const header = trimmed.match(/^\[([^\]]+)\]$/)?.[1];
-            if (header) {
-                section = header;
-                inProjectArray = false;
-                inOptionalArray = false;
-                optionalGroup = '';
-                if (header === 'project')
-                    addRecord(records, {
-                        kind: 'python-installation-profile-state',
-                        projections: ['stateful_resources'],
-                        presumptiveInventory: true,
-                        path,
-                        line: index + 1,
-                        anchor: line,
-                        owner: 'python-installation-profile',
-                        identity: `install-profile:${projectName}`,
-                        tokens: [projectName],
-                        addressToken: projectName,
-                        packageName: projectName,
-                        packageVersion: 'base-profile',
-                    });
-                return;
-            }
-            const projectArray = section === 'project' && /^dependencies\s*=\s*\[/.test(trimmed);
-            if (projectArray) {
-                inProjectArray = true;
-            }
-            if (section === 'project.optional-dependencies') {
-                const group = optionalGroupName(trimmed);
-                if (group) {
-                    optionalGroup = group;
-                    inOptionalArray = true;
-                    if (!isNonProductionOptionalGroup(group))
-                        addRecord(records, {
-                            kind: 'python-installation-profile-state',
-                            projections: ['stateful_resources'],
-                            presumptiveInventory: true,
-                            path,
-                            line: index + 1,
-                            anchor: line,
-                            owner: 'python-installation-profile',
-                            identity: `install-profile:${projectName}[${group}]`,
-                            tokens: [projectName, group],
-                            addressToken: `${projectName}[${group}]`,
-                            packageName: projectName,
-                            packageVersion: `extra:${group}`,
-                        });
-                }
-            }
-            const includeProjectLine = projectArray || (section === 'project' && inProjectArray);
-            const includeOptionalLine = section === 'project.optional-dependencies' &&
-                inOptionalArray &&
-                optionalGroup.length > 0 &&
-                !isNonProductionOptionalGroup(optionalGroup);
-            const includePoetryLine = section === 'tool.poetry.dependencies';
-            if (includeProjectLine || includeOptionalLine) {
-                const profileIdentityKey = includeOptionalLine
-                    ? `${path}#project.optional-dependencies.${optionalGroup}`
-                    : `${path}#project`;
-                for (const match of line.matchAll(/['"]([A-Za-z0-9_.-]+)(?:\[[^\]]+\])?([^'"]*)['"]/g)) {
-                    if (normalizePackageName(match[1]) === projectName)
-                        continue;
-                    addDeclaredProductionPackage(path, index + 1, line, match[1], match[2].trim() || 'declared', profileIdentityKey, records);
-                }
-            }
-            else if (includePoetryLine) {
-                const dependency = line.match(/^\s*([A-Za-z0-9_.-]+)\s*=\s*(.+)$/);
-                if (dependency)
-                    addDeclaredProductionPackage(path, index + 1, line, dependency[1], dependency[2].trim(), `${path}#tool.poetry.dependencies`, records);
-            }
-            if (includeProjectLine && trimmed.includes(']'))
-                inProjectArray = false;
-            if (includeOptionalLine && trimmed.includes(']'))
-                inOptionalArray = false;
-        });
-    }
-    else if (lowerName === 'package.json') {
-        let parsed;
-        try {
-            parsed = JSON.parse(lines.join('\n'));
-        }
-        catch {
-            return;
-        }
-        const dependencies = { ...(parsed.dependencies ?? {}), ...(parsed.optionalDependencies ?? {}) };
-        Object.entries(dependencies).forEach(([name, version]) => {
-            const lineIndex = lines.findIndex((line) => line.includes(JSON.stringify(name)));
-            const line = lineIndex >= 0 ? lineIndex + 1 : 1;
-            addDeclaredProductionPackage(path, line, lines[line - 1] ?? '{', name, version, `${path}#dependencies`, records);
-        });
-    }
-    else if (lowerName === 'cargo.toml') {
-        let productionSection = false;
-        let productionSectionIdentity = '';
-        lines.forEach((line, index) => {
-            const header = line.trim().match(/^\[([^\]]+)\]$/)?.[1];
-            if (header) {
-                productionSection = /(?:^|\.)(?:dependencies|build-dependencies)$/.test(header) && !/(?:^|\.)dev-dependencies$/.test(header);
-                productionSectionIdentity = productionSection ? `${path}#${header}` : '';
-                return;
-            }
-            if (!productionSection)
-                return;
-            const dependency = line.match(/^\s*([A-Za-z0-9_.-]+)\s*=\s*(.+)$/);
-            if (dependency)
-                addDeclaredProductionPackage(path, index + 1, line, dependency[1], dependency[2].trim(), productionSectionIdentity, records);
-        });
-    }
-    else if (lowerName === 'go.mod') {
-        let requireBlock = false;
-        lines.forEach((line, index) => {
-            const trimmed = line.trim();
-            if (trimmed === 'require (') {
-                requireBlock = true;
-                return;
-            }
-            if (requireBlock && trimmed === ')') {
-                requireBlock = false;
-                return;
-            }
-            const match = (requireBlock ? trimmed : trimmed.replace(/^require\s+/, '')).match(/^([^\s]+)\s+([^\s]+)/);
-            if ((requireBlock || trimmed.startsWith('require ')) && match) {
-                addDeclaredProductionPackage(path, index + 1, line, match[1], match[2], `${path}#require`, records);
-            }
-        });
-    }
-}
-function scanManifestEntrypoints(path, lines, records) {
-    const lowerName = basename(path).toLowerCase();
-    if (lowerName === 'pom.xml')
-        scanMavenManifest(path, lines, records);
-    if (lowerName === 'pyproject.toml') {
-        let section = '';
-        lines.forEach((line, index) => {
-            const header = line.trim().match(/^\[(project\.scripts|project\.entry-points\.[^\]]+)\]$/);
-            if (header) {
-                section = header[1];
-                return;
-            }
-            if (/^\[.+\]$/.test(line.trim()))
-                section = '';
-            if (!section)
-                return;
-            const entry = line.match(/^\s*([A-Za-z0-9_.-]+)\s*=\s*['"]([^'"]+)['"]/);
-            if (!entry)
-                return;
-            addRecord(records, {
-                kind: 'installed-entrypoint-state', projections: ['stateful_resources', 'registry_families', 'registry_entries'], presumptiveInventory: true,
-                path, line: index + 1, anchor: line, owner: section, identity: `${entry[1]}:${entry[2]}`,
-                tokens: [entry[1], entry[2]], selectorKey: entry[1], implementationKey: entry[2], addressToken: entry[1],
-            });
-        });
-        scanPythonBuildRequirements(path, lines, records);
-    }
-    if (lowerName === 'package.json') {
-        let parsed;
-        try {
-            parsed = JSON.parse(lines.join('\n'));
-        }
-        catch {
-            return;
-        }
-        const bins = typeof parsed.bin === 'string' ? { [basename(resolve(path), '.json')]: parsed.bin } : parsed.bin ?? {};
-        Object.entries(bins).forEach(([name, implementation]) => {
-            const lineIndex = lines.findIndex((line) => line.includes(JSON.stringify(name)) && line.includes(JSON.stringify(implementation)));
-            const line = lineIndex >= 0 ? lineIndex + 1 : 1;
-            addRecord(records, {
-                kind: 'installed-entrypoint-state', projections: ['stateful_resources', 'registry_families', 'registry_entries'], presumptiveInventory: true,
-                path, line, anchor: lines[line - 1] ?? '{', owner: 'package.bin',
-                identity: `${name}:${implementation}`, tokens: [name, implementation], selectorKey: name,
-                implementationKey: implementation, addressToken: name,
-            });
-        });
-    }
-    scanProductionManifestPackages(path, lines, records);
-}
-export function scanUniverseIdentities(repositoryRoot) {
-    const root = resolve(repositoryRoot);
-    const tracked = trackedFiles(root);
-    const requirementProfiles = discoverPythonRequirementProfiles(root, tracked);
-    const pythonLinesByPath = new Map();
-    const pythonCollectionsByPath = new Map();
-    const pythonCollectionsByModule = new Map();
-    for (const path of tracked.filter((candidate) => candidate.endsWith('.py') && shouldScan(candidate))) {
-        let lines = null;
-        try {
-            lines = textLines(root, path);
-        }
-        catch {
-            lines = null;
-        }
-        if (!lines)
-            continue;
-        pythonLinesByPath.set(path, lines);
-        const collections = parsePythonLiteralCollections(path, lines);
-        pythonCollectionsByPath.set(path, collections);
-        pythonCollectionsByModule.set(pythonModuleName(path), collections);
-    }
-    const pythonMatrixAnalyses = new Map();
-    const importedPythonCollectionIdentityKeys = new Set();
-    for (const [path, lines] of pythonLinesByPath) {
-        const bindings = bindPythonLiteralCollections(path, lines, pythonCollectionsByPath.get(path) ?? new Map(), pythonCollectionsByModule);
-        const ownIdentityKeys = new Set([...(pythonCollectionsByPath.get(path) ?? new Map()).values()]
-            .map((collection) => collection.symbolIdentityKey));
-        for (const collection of bindings.values()) {
-            if (!ownIdentityKeys.has(collection.symbolIdentityKey)) {
-                importedPythonCollectionIdentityKeys.add(collection.symbolIdentityKey);
-            }
-        }
-        pythonMatrixAnalyses.set(path, analyzePythonOperationMatrices(path, lines, bindings));
-    }
-    const localPythonModuleRoots = new Set();
-    for (const path of tracked.filter((candidate) => candidate.endsWith('.py'))) {
-        const parts = normalizePath(path).split('/');
-        if (parts[0] === 'src' && parts.length > 2)
-            localPythonModuleRoots.add(parts[1]);
-        else if (parts.length > 1)
-            localPythonModuleRoots.add(parts[0]);
-        else
-            localPythonModuleRoots.add(basename(parts[0], '.py'));
-    }
-    const records = new Map();
-    const omissions = [];
-    const manifestParts = [];
-    let scanned = 0;
-    for (const path of tracked) {
-        const absolute = join(root, path);
-        if (!existsSync(absolute) || !statSync(absolute).isFile())
-            continue;
-        if (!shouldScan(path) && !requirementProfiles.has(path))
-            continue;
-        const bytes = readFileSync(absolute);
-        manifestParts.push(`${path}\0${sha256(bytes)}\n`);
-        let lines;
-        try {
-            lines = pythonLinesByPath.get(path) ?? textLines(root, path);
-        }
-        catch {
-            lines = null;
-        }
-        if (!lines) {
-            omissions.push({ path, reason: 'binary-or-over-size-limit' });
-            continue;
-        }
-        scanned += 1;
-        const lowerName = basename(path).toLowerCase();
-        const extension = extname(lowerName);
-        const owners = extension === '.py' || extension === '.pyi'
-            ? pythonOwners(path, lines)
-            : lines.map(() => basename(path));
-        const executable = executableLineMask(path, lines);
-        scanEffects(path, lines, owners, executable, records);
-        scanExternalCallBlocks(path, lines, owners, executable, records);
-        scanJavaAndBrowserOperationalIdentities(path, lines, records);
-        scanWorkflowAndRecipeOperations(path, lines, records);
-        if (extension === '.py') {
-            scanPythonExecutableEntrypoint(path, lines, records);
-            scanPythonEmbeddedConfiguration(path, lines, pythonCollectionsByPath.get(path) ?? new Map(), importedPythonCollectionIdentityKeys, records);
-            scanPythonSelectors(path, lines, owners, executable, records);
-            scanPythonProtocolCallbacks(path, lines, owners, executable, records);
-            scanPythonOptionalImports(path, lines, owners, executable, records);
-            scanPythonImportedSdkOperations(path, lines, owners, executable, localPythonModuleRoots, records);
-        }
-        if (['.js', '.jsx', '.mjs', '.cjs', '.ts', '.tsx', '.mts', '.cts', '.java', '.kt', '.kts', '.cs', '.go', '.rs'].includes(extension)) {
-            scanGenericSelectors(path, lines, executable, records);
-        }
-        scanManifestEntrypoints(path, lines, records);
-        const requirementProfile = requirementProfiles.get(path);
-        if (requirementProfile)
-            scanPythonRequirementProfile(requirementProfile, lines, records);
-        if (lowerName === 'uv.lock')
-            scanUvLock(path, lines, records);
-        if (lowerName === 'package-lock.json' || lowerName === 'npm-shrinkwrap.json') {
-            scanPackageLock(path, lines.join('\n'), records);
-        }
-    }
-    for (const analysis of pythonMatrixAnalyses.values()) {
-        emitPythonExactOperationMatrices(analysis, records);
-    }
-    scanVueSelectorCensus(root, tracked, records);
-    scanJavaSelectorCensus(root, tracked, records);
-    scanJavaExactOperationMatrices(root, tracked, records);
-    scanPascalSelectorIdentities(root, tracked).forEach((record) => addRecord(records, record));
-    scanPythonManifestSelectorIdentities(root, tracked).forEach((record) => addRecord(records, record));
-    scanSpecializedOperationalIdentities(root, tracked).forEach((record) => addRecord(records, record));
-    const sortedRecords = [...records.values()].sort((left, right) => left.id.localeCompare(right.id));
-    const byKind = {};
-    const byProjection = {};
-    const byProofStatus = {
-        'proof-complete': 0,
-        'discovery-lead': 0,
-        'non-inventory': 0,
-    };
-    sortedRecords.forEach((record) => {
-        byKind[record.kind] = (byKind[record.kind] ?? 0) + 1;
-        byProofStatus[record.proof_status] += 1;
-        record.projections.forEach((projection) => {
-            byProjection[projection] = (byProjection[projection] ?? 0) + 1;
-        });
-    });
-    // Hash incrementally so a large (but bounded per-record) census does not need
-    // a second repository-sized string allocation just to compute its receipt.
-    // Preserve the prior canonical encoding exactly: records are separated by a
-    // single newline, with no trailing newline.
-    const recordDigest = createHash('sha256');
-    sortedRecords.forEach((record, index) => {
-        if (index > 0)
-            recordDigest.update('\n');
-        recordDigest.update(JSON.stringify(record));
-    });
-    const projectionRecordIds = Object.fromEntries(['runtime_roles', 'stateful_resources', 'external_dependencies', 'registry_families', 'registry_entries', 'registry_edges']
-        .map((projection) => [
-        projection,
-        sortedRecords
-            .filter((record) => record.presumptive_inventory && record.projections.includes(projection))
-            .map((record) => record.id),
-    ]));
-    // Run the data-store pass before building the result so any inputs it cannot
-    // read are appended to `omissions` before `files_omitted` counts them.
-    const dataStores = collectDataStores(root, tracked, omissions);
-    return {
-        schema_version: IDENTITY_CENSUS_SCHEMA_VERSION,
-        contract_revision: IDENTITY_CENSUS_CONTRACT_REVISION,
-        repository_root: root,
-        source_commit: gitObjectId(root, 'HEAD^{commit}'),
-        source_tree: gitObjectId(root, 'HEAD^{tree}'),
-        source_manifest: {
-            digest: `sha256:${sha256(manifestParts.sort().join(''))}`,
-            tracked_files_total: tracked.length,
-            production_files_scanned: scanned,
-            files_omitted: omissions.length,
-        },
-        record_digest: `sha256:${recordDigest.digest('hex')}`,
-        counts: {
-            records: sortedRecords.length,
-            by_kind: Object.fromEntries(Object.entries(byKind).sort(([left], [right]) => left.localeCompare(right))),
-            by_projection: Object.fromEntries(Object.entries(byProjection).sort(([left], [right]) => left.localeCompare(right))),
-            by_proof_status: byProofStatus,
-            presumptive_inventory: sortedRecords.filter((record) => record.presumptive_inventory).length,
-        },
-        projection_record_ids: projectionRecordIds,
-        records: sortedRecords,
-        omissions,
-        data_stores: dataStores,
-    };
-}
-export function cloudVerifierIdentityCensusCommand(options) {
-    const root = options.root ? resolve(options.root) : (findGitRoot() ?? process.cwd());
-    const result = scanUniverseIdentities(root);
-    if (options.json) {
-        process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
-        return;
-    }
-    process.stdout.write(`Cloud Verifier identity census: ${result.counts.records} records from `
-        + `${result.source_manifest.production_files_scanned}/${result.source_manifest.tracked_files_total} files\n`);
-    process.stdout.write(`Record digest: ${result.record_digest}\n`);
-    Object.entries(result.counts.by_projection).forEach(([projection, count]) => {
-        process.stdout.write(`  ${projection}: ${count}\n`);
-    });
-}