@kodycodes/cli 1.27.1 → 1.27.2

package/dist/{dev-command-TZ2EB4J3.js → dev-command-PCQDX5EH.js}

@@ -69,8 +69,8 @@ import {
 import "./chunk-UW6AWLXX.js";
 
 // src/dev-command.ts
-import { access, mkdir as mkdir3, readFile as readFile4, rm as rm4, writeFile as writeFile4 } from "node:fs/promises";
-import { dirname as dirname3, join as join8, resolve as resolve7 } from "node:path";
+import { access, mkdir as mkdir3, readFile as readFile5, rm as rm4, writeFile as writeFile4 } from "node:fs/promises";
+import { dirname as dirname4, join as join9, resolve as resolve8 } from "node:path";
 
 // src/credentialed-fetch-scan.ts
 var esModuleLexerReady = init();
@@ -142,6 +142,621 @@ function mocksSuggestionDetail(input) {
   return `suggested \u2014 package uses credentialed fetch (${kinds}); add .kody/mocks.ts so --target mock can MSW-match outbound requests (unmocked credentialed hops fail closed)`;
 }
 
+// src/fetch-body-secret-resolution.ts
+var fetchBodySecretResolutionWarningLead = 'WARNING: a fetch sends a body without x-kody-secret-resolution. The gateway fills {{secret:name}} anywhere in that body, so text this package did not write can fail with Secret "name" was not found, or a saved secret can be sent to a host the credential allows. Set x-kody-secret-resolution: headers-only on that fetch (headers still resolve). This does not block publish.';
+var secretResolutionHeaderName = "x-kody-secret-resolution";
+var maxWarningSites = 8;
+function findFetchBodiesMissingSecretResolution(source) {
+  const hits = [];
+  for (const call of findFetchLikeCalls(source)) {
+    if (callSendsUnresolvedDynamicBody(call.args)) {
+      hits.push({ line: lineAt(source, call.index) });
+    }
+  }
+  return hits;
+}
+function formatFetchBodySecretResolutionWarning(hits) {
+  if (hits.length === 0) return null;
+  const ordered = [...hits].sort((left, right) => {
+    const byPath = left.path.localeCompare(right.path);
+    return byPath === 0 ? left.line - right.line : byPath;
+  });
+  const shown = ordered.slice(0, maxWarningSites);
+  const extra = ordered.length - shown.length;
+  return [
+    fetchBodySecretResolutionWarningLead,
+    ...shown.map((hit) => `- ${hit.path}:${hit.line}`),
+    ...extra > 0 ? [`- ${extra} more`] : []
+  ].join("\n");
+}
+function findFetchLikeCalls(source) {
+  const calls = [];
+  scanCode(source, 0, "eof", calls);
+  return calls;
+}
+function scanCode(source, start, stop, calls) {
+  let index = start;
+  let lastWord = "";
+  let braceDepth = 0;
+  while (index < source.length) {
+    const char = source[index];
+    if (isWhitespace(char)) {
+      index += 1;
+      continue;
+    }
+    if (char === "/" && source[index + 1] === "/") {
+      index = skipLineComment(source, index);
+      continue;
+    }
+    if (char === "/" && source[index + 1] === "*") {
+      index = skipBlockComment(source, index);
+      continue;
+    }
+    if (char === "'" || char === '"') {
+      index = skipQuotedString(source, index);
+      lastWord = "";
+      continue;
+    }
+    if (char === "`") {
+      index = skipTemplate(source, index, calls);
+      lastWord = "";
+      continue;
+    }
+    if (isIdentStart(char)) {
+      const wordStart = index;
+      index += 1;
+      while (index < source.length && isIdentPart(source[index])) index += 1;
+      const word = source.slice(wordStart, index);
+      const openParen = skipWhitespaceAndComments(source, index);
+      const isFetch = word === "fetch" && lastWord !== "function" && lastWord !== "async";
+      const isRequest = word === "Request" && lastWord === "new";
+      if ((isFetch || isRequest) && source[openParen] === "(") {
+        const call = readCallArguments(source, openParen);
+        if (call) calls.push({ index: wordStart, args: call.args });
+      }
+      lastWord = word;
+      continue;
+    }
+    if (char === "{") {
+      braceDepth += 1;
+      lastWord = "";
+      index += 1;
+      continue;
+    }
+    if (char === "}") {
+      if (stop === "brace" && braceDepth === 0) return index + 1;
+      braceDepth -= 1;
+      lastWord = "";
+      index += 1;
+      continue;
+    }
+    lastWord = "";
+    index += 1;
+  }
+  return index;
+}
+function callSendsUnresolvedDynamicBody(args) {
+  const init2 = args[1]?.trim();
+  if (init2 == null || !init2.startsWith("{")) return false;
+  const properties = readObjectProperties(init2);
+  if (properties == null) return false;
+  const body = lastProperty(properties, "body");
+  if (body == null || body.spread || body.method) return false;
+  if (isStaticExpression(body.value)) return false;
+  const headers = lastProperty(properties, "headers");
+  if (headers == null) return true;
+  if (headers.spread || headers.method) return false;
+  return headersLeaveBodyResolutionOn(headers.value);
+}
+function headersLeaveBodyResolutionOn(headersValue) {
+  const text = headersValue.trim();
+  if (!text.startsWith("{")) return false;
+  const properties = readObjectProperties(text);
+  if (properties == null) return false;
+  if (properties.some((property) => property.spread)) return false;
+  const resolution = lastProperty(properties, secretResolutionHeaderName, {
+    caseInsensitive: true
+  });
+  if (resolution == null || resolution.method) return true;
+  const mode = staticStringValue(resolution.value);
+  if (mode == null) return false;
+  return mode === "on";
+}
+function lastProperty(properties, key, options) {
+  const needle = options?.caseInsensitive ? key.toLowerCase() : key;
+  for (let index = properties.length - 1; index >= 0; index -= 1) {
+    const property = properties[index];
+    const name = property.key;
+    if (name == null) continue;
+    const match = options?.caseInsensitive ? name.toLowerCase() : name;
+    if (match === needle) return property;
+  }
+  return void 0;
+}
+function readObjectProperties(source) {
+  const text = source.trim();
+  if (!text.startsWith("{")) return null;
+  const properties = [];
+  let index = 1;
+  while (index < text.length) {
+    index = skipWhitespaceAndComments(text, index);
+    if (index >= text.length) return null;
+    if (text[index] === "}") return properties;
+    if (text[index] === ",") {
+      index += 1;
+      continue;
+    }
+    if (text.startsWith("...", index)) {
+      const spread = readExpression(text, index + 3);
+      if (spread == null) return null;
+      properties.push({
+        key: null,
+        value: spread.text,
+        spread: true,
+        method: false
+      });
+      index = spread.end;
+      continue;
+    }
+    const key = readPropertyKey(text, index);
+    if (key == null) return null;
+    index = skipWhitespaceAndComments(text, key.end);
+    if (text[index] === "(" || text.startsWith("async ", key.start)) {
+      const method = skipMethod(text, index);
+      if (method == null) return null;
+      properties.push({
+        key: key.name,
+        value: "",
+        spread: false,
+        method: true
+      });
+      index = method;
+      continue;
+    }
+    if (text[index] !== ":") {
+      properties.push({
+        key: key.name,
+        value: key.raw,
+        spread: false,
+        method: false
+      });
+      continue;
+    }
+    const value = readExpression(text, index + 1);
+    if (value == null) return null;
+    properties.push({
+      key: key.name,
+      value: value.text,
+      spread: false,
+      method: false
+    });
+    index = value.end;
+  }
+  return null;
+}
+function readPropertyKey(source, start) {
+  const index = skipWhitespaceAndComments(source, start);
+  const char = source[index];
+  if (char === "'" || char === '"') {
+    const end = skipQuotedString(source, index);
+    const raw = source.slice(index, end);
+    return { name: staticStringValue(raw), raw, start: index, end };
+  }
+  if (char === "[") {
+    const computed = readBalanced(source, index, "[", "]");
+    if (computed == null) return null;
+    return { name: null, raw: computed.text, start: index, end: computed.end };
+  }
+  if (char != null && isIdentStart(char)) {
+    let end = index + 1;
+    while (end < source.length && isIdentPart(source[end])) end += 1;
+    const raw = source.slice(index, end);
+    return { name: raw, raw, start: index, end };
+  }
+  return null;
+}
+function readExpression(source, start) {
+  const index = skipWhitespaceAndComments(source, start);
+  const balanced = readUntilSeparator(source, index);
+  if (balanced == null) return null;
+  return { text: source.slice(index, balanced), end: balanced };
+}
+function readUntilSeparator(source, start) {
+  let index = start;
+  let paren = 0;
+  let brace = 0;
+  let bracket = 0;
+  while (index < source.length) {
+    const char = source[index];
+    if (char === "/" && source[index + 1] === "/") {
+      index = skipLineComment(source, index);
+      continue;
+    }
+    if (char === "/" && source[index + 1] === "*") {
+      index = skipBlockComment(source, index);
+      continue;
+    }
+    if (char === "'" || char === '"') {
+      index = skipQuotedString(source, index);
+      continue;
+    }
+    if (char === "`") {
+      index = skipTemplate(source, index, []);
+      continue;
+    }
+    if (char === "(") paren += 1;
+    else if (char === ")") {
+      if (paren === 0) return index;
+      paren -= 1;
+    } else if (char === "{") brace += 1;
+    else if (char === "}") {
+      if (brace === 0 && paren === 0 && bracket === 0) return index;
+      brace -= 1;
+    } else if (char === "[") bracket += 1;
+    else if (char === "]") {
+      if (bracket === 0) return index;
+      bracket -= 1;
+    } else if (char === "," && paren === 0 && brace === 0 && bracket === 0) {
+      return index;
+    }
+    index += 1;
+  }
+  return null;
+}
+function skipMethod(source, openParen) {
+  const params = readBalanced(source, openParen, "(", ")");
+  if (params == null) return null;
+  const bodyAt = skipWhitespaceAndComments(source, params.end);
+  if (source[bodyAt] !== "{") return null;
+  const body = readBalanced(source, bodyAt, "{", "}");
+  return body?.end ?? null;
+}
+function readCallArguments(source, openParen) {
+  const args = [];
+  let index = openParen + 1;
+  let argStart = index;
+  let paren = 1;
+  let brace = 0;
+  let bracket = 0;
+  while (index < source.length) {
+    const char = source[index];
+    if (char === "/" && source[index + 1] === "/") {
+      index = skipLineComment(source, index);
+      continue;
+    }
+    if (char === "/" && source[index + 1] === "*") {
+      index = skipBlockComment(source, index);
+      continue;
+    }
+    if (char === "'" || char === '"') {
+      index = skipQuotedString(source, index);
+      continue;
+    }
+    if (char === "`") {
+      index = skipTemplate(source, index, []);
+      continue;
+    }
+    if (char === "(") paren += 1;
+    else if (char === ")") {
+      paren -= 1;
+      if (paren === 0) {
+        args.push(source.slice(argStart, index));
+        return { args };
+      }
+    } else if (char === "{") brace += 1;
+    else if (char === "}") brace -= 1;
+    else if (char === "[") bracket += 1;
+    else if (char === "]") bracket -= 1;
+    else if (char === "," && paren === 1 && brace === 0 && bracket === 0) {
+      args.push(source.slice(argStart, index));
+      argStart = index + 1;
+    }
+    index += 1;
+  }
+  return null;
+}
+function readBalanced(source, openIndex, open2, close) {
+  let depth = 0;
+  let index = openIndex;
+  while (index < source.length) {
+    const char = source[index];
+    if (char === "/" && source[index + 1] === "/") {
+      index = skipLineComment(source, index);
+      continue;
+    }
+    if (char === "/" && source[index + 1] === "*") {
+      index = skipBlockComment(source, index);
+      continue;
+    }
+    if (char === "'" || char === '"') {
+      index = skipQuotedString(source, index);
+      continue;
+    }
+    if (char === "`") {
+      index = skipTemplate(source, index, []);
+      continue;
+    }
+    if (char === open2) depth += 1;
+    else if (char === close) {
+      depth -= 1;
+      if (depth === 0) {
+        return { text: source.slice(openIndex, index + 1), end: index + 1 };
+      }
+    }
+    index += 1;
+  }
+  return null;
+}
+function isStaticExpression(expression) {
+  const text = expression.trim();
+  if (isLiteral(text)) return true;
+  const stringify = matchCallee(text, "JSON.stringify");
+  if (stringify != null) {
+    const data = stringify.args[0];
+    return data != null && stringify.args.slice(1).every((arg) => isLiteral(arg.trim())) && isStaticData(data);
+  }
+  const params = matchNewCallee(text, "URLSearchParams");
+  if (params != null) {
+    if (params.args.length === 0) return true;
+    const data = params.args[0];
+    return data != null && params.args.length === 1 && isStaticData(data);
+  }
+  return false;
+}
+function isStaticData(expression) {
+  const text = expression.trim();
+  if (isLiteral(text)) return true;
+  if (text.startsWith("{")) {
+    const closed = readBalanced(text, 0, "{", "}");
+    if (closed == null || closed.end !== text.length) return false;
+    const properties = readObjectProperties(text);
+    if (properties == null) return false;
+    return properties.every(
+      (property) => !property.spread && !property.method && property.key != null && isStaticData(property.value)
+    );
+  }
+  if (text.startsWith("[")) {
+    const closed = readBalanced(text, 0, "[", "]");
+    if (closed == null || closed.end !== text.length) return false;
+    const elements = readArrayElements(text);
+    if (elements == null) return false;
+    return elements.every((element) => isStaticData(element));
+  }
+  return false;
+}
+function readArrayElements(source) {
+  const text = source.trim();
+  if (!text.startsWith("[")) return null;
+  const elements = [];
+  let index = 1;
+  while (index < text.length) {
+    index = skipWhitespaceAndComments(text, index);
+    if (text[index] === "]") return elements;
+    if (text[index] === ",") {
+      index += 1;
+      continue;
+    }
+    if (text.startsWith("...", index)) return null;
+    const value = readExpression(text, index);
+    if (value == null) return null;
+    elements.push(value.text);
+    index = value.end;
+  }
+  return null;
+}
+function isLiteral(expression) {
+  const text = expression.trim();
+  if (/^(?:null|undefined|true|false|-?\d+(?:\.\d+)?)$/.test(text)) return true;
+  if (isPlainTemplate(text)) return true;
+  return staticStringValue(text) != null && (text.startsWith("'") || text.startsWith('"'));
+}
+function staticStringValue(expression) {
+  const text = expression.trim();
+  if (isPlainTemplate(text)) return text.slice(1, -1);
+  if (text.startsWith("'") && text.endsWith("'") || text.startsWith('"') && text.endsWith('"')) {
+    if (text.length < 2) return null;
+    const body = text.slice(1, -1);
+    if (body.includes(text[0]) || body.includes("\n")) return null;
+    return body.replace(/\\(.)/g, "$1");
+  }
+  return null;
+}
+function isPlainTemplate(expression) {
+  const text = expression.trim();
+  return text.startsWith("`") && text.endsWith("`") && !text.slice(1, -1).includes("${");
+}
+function matchCallee(expression, callee) {
+  const text = expression.trim();
+  if (!text.startsWith(callee)) return null;
+  const open2 = skipWhitespaceAndComments(text, callee.length);
+  if (text[open2] !== "(") return null;
+  const call = readCallArguments(text, open2);
+  if (call == null) return null;
+  const end = skipWhitespaceAndComments(text, endOfCall(text, open2));
+  if (end !== text.length) return null;
+  return call;
+}
+function matchNewCallee(expression, name) {
+  const text = expression.trim();
+  if (!text.startsWith("new")) return null;
+  const nameAt = skipWhitespaceAndComments(text, "new".length);
+  if (!text.startsWith(name, nameAt)) return null;
+  return matchCallee(text.slice(nameAt), name);
+}
+function endOfCall(source, openParen) {
+  const args = readCallArguments(source, openParen);
+  if (args == null) return openParen;
+  let index = openParen;
+  let paren = 0;
+  while (index < source.length) {
+    const char = source[index];
+    if (char === "'" || char === '"') {
+      index = skipQuotedString(source, index);
+      continue;
+    }
+    if (char === "`") {
+      index = skipTemplate(source, index, []);
+      continue;
+    }
+    if (char === "(") paren += 1;
+    else if (char === ")") {
+      paren -= 1;
+      if (paren === 0) return index + 1;
+    }
+    index += 1;
+  }
+  return source.length;
+}
+function skipTemplate(source, start, calls) {
+  let index = start + 1;
+  while (index < source.length) {
+    const char = source[index];
+    if (char === "\\") {
+      index += 2;
+      continue;
+    }
+    if (char === "`") return index + 1;
+    if (char === "$" && source[index + 1] === "{") {
+      index = scanCode(source, index + 2, "brace", calls);
+      continue;
+    }
+    index += 1;
+  }
+  return index;
+}
+function skipQuotedString(source, start) {
+  const quote = source[start];
+  let index = start + 1;
+  while (index < source.length) {
+    const char = source[index];
+    if (char === "\\") {
+      index += 2;
+      continue;
+    }
+    if (char === quote) return index + 1;
+    if (char === "\n") return index;
+    index += 1;
+  }
+  return index;
+}
+function skipLineComment(source, start) {
+  const newline = source.indexOf("\n", start);
+  return newline === -1 ? source.length : newline + 1;
+}
+function skipBlockComment(source, start) {
+  const end = source.indexOf("*/", start + 2);
+  return end === -1 ? source.length : end + 2;
+}
+function skipWhitespaceAndComments(source, start) {
+  let index = start;
+  while (index < source.length) {
+    const char = source[index];
+    if (isWhitespace(char)) {
+      index += 1;
+      continue;
+    }
+    if (char === "/" && source[index + 1] === "/") {
+      index = skipLineComment(source, index);
+      continue;
+    }
+    if (char === "/" && source[index + 1] === "*") {
+      index = skipBlockComment(source, index);
+      continue;
+    }
+    break;
+  }
+  return index;
+}
+function lineAt(source, index) {
+  let line = 1;
+  for (let cursor = 0; cursor < index && cursor < source.length; cursor += 1) {
+    if (source[cursor] === "\n") line += 1;
+  }
+  return line;
+}
+function isWhitespace(char) {
+  return char === " " || char === "	" || char === "\n" || char === "\r";
+}
+function isIdentStart(char) {
+  return /[A-Za-z_$]/.test(char);
+}
+function isIdentPart(char) {
+  return /[A-Za-z0-9_$]/.test(char);
+}
+
+// src/fetch-body-package-scan.ts
+import { readFile, stat } from "node:fs/promises";
+import { dirname, extname, join, relative, resolve } from "node:path";
+var esModuleLexerReady2 = init();
+var sourceExtensions = [
+  ".ts",
+  ".tsx",
+  ".mts",
+  ".cts",
+  ".js",
+  ".mjs",
+  ".cjs",
+  ".jsx"
+];
+var maxModules = 200;
+async function findPackageFetchBodyWarnings(input) {
+  await esModuleLexerReady2;
+  const hits = [];
+  const seen = /* @__PURE__ */ new Set();
+  const queue = [input.entryPath];
+  while (queue.length > 0 && seen.size < maxModules) {
+    const resolved = await resolveSourceFile(queue.pop());
+    if (resolved == null || seen.has(resolved)) continue;
+    const rel = relative(input.packageRoot, resolved).split("\\").join("/");
+    if (rel.startsWith("..") || rel.split("/").includes("node_modules") || isTestModule(rel)) {
+      continue;
+    }
+    seen.add(resolved);
+    let source;
+    try {
+      source = await readFile(resolved, "utf8");
+    } catch {
+      continue;
+    }
+    for (const hit of findFetchBodiesMissingSecretResolution(source)) {
+      hits.push({ path: rel, line: hit.line });
+    }
+    let imports;
+    try {
+      imports = parse(source)[0];
+    } catch {
+      continue;
+    }
+    for (const im of imports) {
+      if (im.type === "dynamic" || im.typeOnly === true) continue;
+      const specifier = im.specifier;
+      if (typeof specifier !== "string" || !specifier.startsWith(".")) continue;
+      queue.push(resolve(dirname(resolved), specifier));
+    }
+  }
+  return hits;
+}
+function isTestModule(path) {
+  return /\.(?:test|spec)\.[cm]?[jt]sx?$/.test(path);
+}
+async function resolveSourceFile(absPath) {
+  const candidates = [absPath];
+  if (extname(absPath) === "") {
+    for (const ext of sourceExtensions) {
+      candidates.push(`${absPath}${ext}`);
+      candidates.push(join(absPath, `index${ext}`));
+    }
+  }
+  for (const candidate of candidates) {
+    try {
+      const info = await stat(candidate);
+      if (info.isFile()) return candidate;
+    } catch {
+    }
+  }
+  return null;
+}
+
 // src/package-app-dev.ts
 import { randomBytes } from "node:crypto";
 import { rmSync } from "node:fs";
@@ -151,19 +766,19 @@ import {
   request as httpRequest
 } from "node:http";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join7, relative as relative4, resolve as resolve6, sep as sep3 } from "node:path";
+import { join as join8, relative as relative5, resolve as resolve7, sep as sep3 } from "node:path";
 
 // src/dev/dev-assets.ts
 import * as esbuild2 from "esbuild";
 import { createHash } from "node:crypto";
-import { readFile, stat } from "node:fs/promises";
-import { join as join2, resolve as resolve2, sep } from "node:path";
+import { readFile as readFile2, stat as stat2 } from "node:fs/promises";
+import { join as join3, resolve as resolve3, sep } from "node:path";
 
 // src/dev/dev-bundler.ts
 import * as esbuild from "esbuild";
-import { join, resolve } from "node:path";
+import { join as join2, resolve as resolve2 } from "node:path";
 function createDevBundler(input) {
-  const entry = resolve(input.entryPath);
+  const entry = resolve2(input.entryPath);
   const base = localBundleOptions(entry);
   const options = {
     ...base,
@@ -171,7 +786,7 @@ function createDevBundler(input) {
     sourcesContent: false,
     metafile: true,
     // Never written (write: false); only anchors source map paths at the root.
-    outfile: join(input.root, "__kody_dev_bundle.js")
+    outfile: join2(input.root, "__kody_dev_bundle.js")
   };
   const paths = { workingDir: base.absWorkingDir, displayRoot: input.root };
   let disposed = false;
@@ -197,7 +812,7 @@ function createDevBundler(input) {
   };
 }
 function bundleInputs(metafile, workingDir) {
-  return Object.keys(metafile?.inputs ?? {}).filter((path) => !path.includes("node_modules") && !path.includes(":")).map((path) => resolve(workingDir, path));
+  return Object.keys(metafile?.inputs ?? {}).filter((path) => !path.includes("node_modules") && !path.includes(":")).map((path) => resolve2(workingDir, path));
 }
 function readBundle(result, workingDir, entryPath) {
   const outputs = result.outputFiles ?? [];
@@ -227,7 +842,7 @@ function createDevClientBundler(input) {
   let context3 = null;
   const createContext = () => esbuild2.context({
     absWorkingDir: workingDir,
-    entryPoints: [resolve2(input.entryPath)],
+    entryPoints: [resolve3(input.entryPath)],
     bundle: true,
     write: false,
     metafile: true,
@@ -236,7 +851,7 @@ function createDevClientBundler(input) {
     target: "es2022",
     sourcemap: "inline",
     logLevel: "silent",
-    outfile: join2(input.root, "_assets", "client.js"),
+    outfile: join3(input.root, "_assets", "client.js"),
     plugins: externals.length > 0 ? [clientExternalsPlugin(externals)] : []
   });
   return {
@@ -292,8 +907,8 @@ function parseDevAssetPath(pathname) {
 }
 function resolveDevAssetFile(assetsDir, relativePath) {
   if (relativePath.includes("\0") || relativePath.startsWith("/")) return null;
-  const root = resolve2(assetsDir);
-  const file = resolve2(root, relativePath);
+  const root = resolve3(assetsDir);
+  const file = resolve3(root, relativePath);
   return file.startsWith(`${root}${sep}`) ? file : null;
 }
 async function serveDevAsset(input) {
@@ -341,8 +956,8 @@ async function serveDevAsset(input) {
 }
 async function readAssetFile(file) {
   try {
-    if (!(await stat(file)).isFile()) return null;
-    return await readFile(file);
+    if (!(await stat2(file)).isFile()) return null;
+    return await readFile2(file);
   } catch {
     return null;
   }
@@ -540,14 +1155,14 @@ function wrapPort(port) {
   return port > 65535 ? devPortRange.min + (port - 65536) : port;
 }
 function listenOnce(server, host, port) {
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     const onError = (error) => {
       server.off("listening", onListening);
       reject(error);
     };
     const onListening = () => {
       server.off("error", onError);
-      resolve8();
+      resolve9();
     };
     server.once("error", onError);
     server.once("listening", onListening);
@@ -560,14 +1175,14 @@ function isAddressInUse(error) {
 
 // src/dev/dev-registry.ts
 import { createHash as createHash3 } from "node:crypto";
-import { mkdir, readFile as readFile3, rm as rm2, writeFile as writeFile2 } from "node:fs/promises";
-import { join as join4 } from "node:path";
+import { mkdir, readFile as readFile4, rm as rm2, writeFile as writeFile2 } from "node:fs/promises";
+import { join as join5 } from "node:path";
 
 // src/dev/process-reaper.ts
 import { spawn } from "node:child_process";
-import { readdir, readFile as readFile2, rm, stat as stat2, writeFile } from "node:fs/promises";
+import { readdir, readFile as readFile3, rm, stat as stat3, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join as join3 } from "node:path";
+import { join as join4 } from "node:path";
 import psList from "ps-list";
 var devWorkDirPrefix = "kody-dev-";
 var ownerFileName = "owner.json";
@@ -590,7 +1205,7 @@ rm -rf "$1"
 `;
 async function startProcessReaper(input) {
   await writeFile(
-    join3(input.workDir, ownerFileName),
+    join4(input.workDir, ownerFileName),
     JSON.stringify({ pid: process.pid, startedAt: (/* @__PURE__ */ new Date()).toISOString() })
   );
   let reaper;
@@ -652,7 +1267,7 @@ async function sweepStaleDevDirs(input = {}) {
   }
   const byPid = new Map(processes.map((item) => [item.pid, item]));
   for (const name of entries) {
-    const dir = join3(tmp, name);
+    const dir = join4(tmp, name);
     try {
       const owner = await readOwnerPid(dir);
       if (owner !== null && isAlive(owner)) continue;
@@ -660,7 +1275,7 @@ async function sweepStaleDevDirs(input = {}) {
         (item) => /workerd/.test(item.name) && (item.cmd ?? "").includes(`${dir}/`)
       );
       if (owner === null) {
-        const info = await stat2(dir);
+        const info = await stat3(dir);
         if (now - info.mtimeMs < legacyDirMinAgeMs) continue;
         if (workerds.some((item) => !isOrphaned(item, byPid, isAlive))) continue;
       }
@@ -687,7 +1302,7 @@ function isOrphaned(item, byPid, isAlive) {
 async function readOwnerPid(dir) {
   try {
     const parsed = JSON.parse(
-      await readFile2(join3(dir, ownerFileName), "utf8")
+      await readFile3(join4(dir, ownerFileName), "utf8")
     );
     return typeof parsed.pid === "number" ? parsed.pid : null;
   } catch {
@@ -707,11 +1322,11 @@ function isProcessAlive(pid) {
 var devStatusPath = "/__kody/dev/status";
 function devRegistryPath(root, target, cacheDir = userCacheDir()) {
   const key = createHash3("sha256").update(`${root}\0${target}`).digest("hex").slice(0, 16);
-  return join4(cacheDir, "dev-servers", `${key}.json`);
+  return join5(cacheDir, "dev-servers", `${key}.json`);
 }
 async function writeDevRegistration(registration, cacheDir) {
   const path = devRegistryPath(registration.root, registration.target, cacheDir);
-  await mkdir(join4(path, ".."), { recursive: true });
+  await mkdir(join5(path, ".."), { recursive: true });
   await writeFile2(path, `${JSON.stringify(registration, null, 2)}
 `);
   return path;
@@ -754,7 +1369,7 @@ async function findRunningDevServer(input) {
 async function readRegistration(path) {
   try {
     const parsed = JSON.parse(
-      await readFile3(path, "utf8")
+      await readFile4(path, "utf8")
     );
     if (typeof parsed.pid !== "number" || typeof parsed.origin !== "string" || typeof parsed.root !== "string" || parsed.target !== "mock" && parsed.target !== "prod") {
       return null;
@@ -774,12 +1389,12 @@ async function readRegistration(path) {
 
 // node_modules/chokidar/esm/index.js
 import { stat as statcb } from "fs";
-import { stat as stat5, readdir as readdir3 } from "fs/promises";
+import { stat as stat6, readdir as readdir3 } from "fs/promises";
 import { EventEmitter } from "events";
 import * as sysPath2 from "path";
 
 // node_modules/readdirp/esm/index.js
-import { stat as stat3, lstat, readdir as readdir2, realpath } from "node:fs/promises";
+import { stat as stat4, lstat, readdir as readdir2, realpath } from "node:fs/promises";
 import { Readable } from "node:stream";
 import { resolve as presolve, relative as prelative, join as pjoin, sep as psep } from "node:path";
 var EntryTypes = {
@@ -846,7 +1461,7 @@ var ReaddirpStream = class extends Readable {
     const { root, type } = opts;
     this._fileFilter = normalizeFilter(opts.fileFilter);
     this._directoryFilter = normalizeFilter(opts.directoryFilter);
-    const statMethod = opts.lstat ? lstat : stat3;
+    const statMethod = opts.lstat ? lstat : stat4;
     if (wantBigintFsStats) {
       this._stat = (path) => statMethod(path, { bigint: true });
     } else {
@@ -999,7 +1614,7 @@ function readdirp(root, options = {}) {
 
 // node_modules/chokidar/esm/handler.js
 import { watchFile, unwatchFile, watch as fs_watch } from "fs";
-import { open, stat as stat4, lstat as lstat2, realpath as fsrealpath } from "fs/promises";
+import { open, stat as stat5, lstat as lstat2, realpath as fsrealpath } from "fs/promises";
 import * as sysPath from "path";
 import { type as osType } from "os";
 var STR_DATA = "data";
@@ -1026,7 +1641,7 @@ var EVENTS = {
 };
 var EV = EVENTS;
 var THROTTLE_MODE_WATCH = "watch";
-var statMethods = { lstat: lstat2, stat: stat4 };
+var statMethods = { lstat: lstat2, stat: stat5 };
 var KEY_LISTENERS = "listeners";
 var KEY_ERR = "errHandlers";
 var KEY_RAW = "rawEmitters";
@@ -1501,9 +2116,9 @@ var NodeFsHandler = class {
     if (this.fsw.closed) {
       return;
     }
-    const dirname4 = sysPath.dirname(file);
+    const dirname5 = sysPath.dirname(file);
     const basename3 = sysPath.basename(file);
-    const parent = this.fsw._getWatchedDir(dirname4);
+    const parent = this.fsw._getWatchedDir(dirname5);
     let prevStats = stats;
     if (parent.has(basename3))
       return;
@@ -1512,7 +2127,7 @@ var NodeFsHandler = class {
         return;
       if (!newStats || newStats.mtimeMs === 0) {
         try {
-          const newStats2 = await stat4(file);
+          const newStats2 = await stat5(file);
           if (this.fsw.closed)
             return;
           const at = newStats2.atimeMs;
@@ -1530,7 +2145,7 @@ var NodeFsHandler = class {
             prevStats = newStats2;
           }
         } catch (error) {
-          this.fsw._remove(dirname4, basename3);
+          this.fsw._remove(dirname5, basename3);
         }
       } else if (parent.has(basename3)) {
         const at = newStats.atimeMs;
@@ -1626,7 +2241,7 @@ var NodeFsHandler = class {
         this._addToNodeFs(path, initialAdd, wh, depth + 1);
       }
     }).on(EV.ERROR, this._boundHandleError);
-    return new Promise((resolve8, reject) => {
+    return new Promise((resolve9, reject) => {
       if (!stream)
         return reject();
       stream.once(STR_END, () => {
@@ -1635,7 +2250,7 @@ var NodeFsHandler = class {
           return;
         }
         const wasThrottled = throttler ? throttler.clear() : false;
-        resolve8(void 0);
+        resolve9(void 0);
         previous.getChildren().filter((item) => {
           return item !== directory && !current.has(item);
         }).forEach((item) => {
@@ -1779,11 +2394,11 @@ function createPattern(matcher) {
       if (matcher.path === string)
         return true;
       if (matcher.recursive) {
-        const relative5 = sysPath2.relative(matcher.path, string);
-        if (!relative5) {
+        const relative6 = sysPath2.relative(matcher.path, string);
+        if (!relative6) {
           return false;
         }
-        return !relative5.startsWith("..") && !sysPath2.isAbsolute(relative5);
+        return !relative6.startsWith("..") && !sysPath2.isAbsolute(relative6);
       }
       return false;
     };
@@ -2211,7 +2826,7 @@ var FSWatcher = class extends EventEmitter {
       const fullPath = opts.cwd ? sysPath2.join(opts.cwd, path) : path;
       let stats2;
       try {
-        stats2 = await stat5(fullPath);
+        stats2 = await stat6(fullPath);
       } catch (err) {
       }
       if (!stats2 || this.closed)
@@ -2338,8 +2953,8 @@ var FSWatcher = class extends EventEmitter {
     }
     return this._userIgnored(path, stats);
   }
-  _isntIgnored(path, stat7) {
-    return !this._isIgnored(path, stat7);
+  _isntIgnored(path, stat8) {
+    return !this._isIgnored(path, stat8);
   }
   /**
    * Provides a set of common helpers and properties relating to symlink handling.
@@ -2463,12 +3078,12 @@ function watch(paths, options = {}) {
 }
 
 // src/dev/dev-watcher.ts
-import { stat as stat6 } from "node:fs/promises";
-import { relative as relative3, sep as sep2 } from "node:path";
+import { stat as stat7 } from "node:fs/promises";
+import { relative as relative4, sep as sep2 } from "node:path";
 var defaultPollIntervalMs = 1e3;
 function createDevWatcher(input) {
   const ignorePrefixes = (input.ignore ?? []).map(normalizePrefix).filter(Boolean);
-  const ignored = (path) => shouldIgnoreWatchPath(relative3(input.root, path), ignorePrefixes);
+  const ignored = (path) => shouldIgnoreWatchPath(relative4(input.root, path), ignorePrefixes);
   const watcher = watch(input.root, {
     ignoreInitial: true,
     ignored,
@@ -2478,10 +3093,10 @@ function createDevWatcher(input) {
     if (!ignored(path)) input.onChange(path);
   });
   let readySettled = false;
-  const ready = new Promise((resolve8, reject) => {
+  const ready = new Promise((resolve9, reject) => {
     watcher.once("ready", () => {
       readySettled = true;
-      resolve8();
+      resolve9();
     });
     watcher.on("error", (error) => {
       if (readySettled) return;
@@ -2568,7 +3183,7 @@ function createDevWatcher(input) {
 }
 async function fingerprint(path) {
   try {
-    const info = await stat6(path);
+    const info = await stat7(path);
     return `${info.ino}:${info.size}:${info.mtimeMs}`;
   } catch {
     return "missing";
@@ -2843,9 +3458,9 @@ async function runPrebuild(input) {
     else input.signal.addEventListener("abort", killChild, { once: true });
   }
   try {
-    const result = await new Promise((resolve8, reject) => {
+    const result = await new Promise((resolve9, reject) => {
       child.once("error", reject);
-      child.once("close", (code, signal) => resolve8({ code, signal }));
+      child.once("close", (code, signal) => resolve9({ code, signal }));
     });
     if (input.signal?.aborted) {
       throw new PrebuildError("kody.dev.prebuild aborted");
@@ -2891,7 +3506,7 @@ for (let i = 0; i < chars.length; i++) {
   intToChar[i] = c;
   charToInt[c] = i;
 }
-function decodeInteger(reader, relative5) {
+function decodeInteger(reader, relative6) {
   let value = 0;
   let shift = 0;
   let integer = 0;
@@ -2906,7 +3521,7 @@ function decodeInteger(reader, relative5) {
   if (shouldNegate) {
     value = -2147483648 | -value;
   }
-  return relative5 + value;
+  return relative6 + value;
 }
 function hasMoreVlq(reader, max) {
   if (reader.pos >= max) return false;
@@ -3094,7 +3709,7 @@ function normalizePath2(url, type) {
   }
   url.path = path;
 }
-function resolve5(input, base) {
+function resolve6(input, base) {
   if (!input && !base)
     return "";
   const url = parseUrl(input);
@@ -3157,7 +3772,7 @@ function stripFilename(path) {
 function resolver(mapUrl, sourceRoot) {
   const from = stripFilename(mapUrl);
   const prefix = sourceRoot ? sourceRoot + "/" : "";
-  return (source) => resolve5(prefix + (source || ""), from);
+  return (source) => resolve6(prefix + (source || ""), from);
 }
 var COLUMN = 0;
 var SOURCES_INDEX = 1;
@@ -3270,8 +3885,8 @@ var TraceMap = class {
     this.sources = sources;
     this.sourcesContent = sourcesContent;
     this.ignoreList = parsed.ignoreList || parsed.x_google_ignoreList || void 0;
-    const resolve8 = resolver(mapUrl, sourceRoot);
-    this.resolvedSources = sources.map(resolve8);
+    const resolve9 = resolver(mapUrl, sourceRoot);
+    this.resolvedSources = sources.map(resolve9);
     const { mappings } = parsed;
     if (typeof mappings === "string") {
       this._encoded = mappings;
@@ -3408,12 +4023,12 @@ async function startWorkerd(input) {
 `;
     input.onStderrLine(line);
   });
-  const exited = new Promise((resolve8) => {
+  const exited = new Promise((resolve9) => {
     child.once(
       "exit",
-      (code, signal) => resolve8(`workerd exit ${signal ?? code}`)
+      (code, signal) => resolve9(`workerd exit ${signal ?? code}`)
     );
-    child.once("error", (error) => resolve8(`workerd error: ${error.message}`));
+    child.once("error", (error) => resolve9(`workerd error: ${error.message}`));
   });
   const port = await waitForListen(child, exited, () => {
     const trimmed = redact(startupStderr.trim());
@@ -3430,7 +4045,7 @@ ${trimmed}` : "";
       child.kill("SIGKILL");
       await Promise.race([
         exited,
-        new Promise((resolve8) => setTimeout(resolve8, 1e3))
+        new Promise((resolve9) => setTimeout(resolve9, 1e3))
       ]);
     }
   };
@@ -3443,7 +4058,7 @@ function forEachLine2(stream, onLine) {
   });
 }
 function waitForListen(child, exited, stderr) {
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     const control = child.stdio[3];
     let buffered = "";
     let settled = false;
@@ -3469,7 +4084,7 @@ function waitForListen(child, exited, stderr) {
       buffered = lines.pop() ?? "";
       for (const line of lines) {
         const port = parseListenPort(line);
-        if (port !== null) settle(() => resolve8(port));
+        if (port !== null) settle(() => resolve9(port));
       }
     });
     void exited.then((detail) => {
@@ -3519,7 +4134,7 @@ async function startPackageAppDev(options) {
   const errorPageTail = liveReload ? `<script>globalThis.__kodyDevErrorPage = true</script>${liveReloadScriptTag}` : "";
   void sweepStaleDevDirs().catch(() => {
   });
-  const workDir = await mkdtemp(join7(tmpdir2(), devWorkDirPrefix));
+  const workDir = await mkdtemp(join8(tmpdir2(), devWorkDirPrefix));
   const reaper = await startProcessReaper({ workDir });
   const workerdPath = options.workerdPath ?? await ensureWorkerdBinary({
     onDownload: (url) => options.onStatus?.(`Downloading workerd from ${url}\u2026`)
@@ -3555,8 +4170,8 @@ async function startPackageAppDev(options) {
   let buildFailureAt = startedAt;
   let markStarted = () => {
   };
-  const started = new Promise((resolve8) => {
-    markStarted = resolve8;
+  const started = new Promise((resolve9) => {
+    markStarted = resolve9;
   });
   const killAllSync = () => {
     for (const generation of generations) {
@@ -3598,8 +4213,8 @@ async function startPackageAppDev(options) {
     process.off("exit", killAllSync);
     reaper.close();
     proxy.closeAllConnections();
-    await new Promise((resolve8) => {
-      proxy.close(() => resolve8());
+    await new Promise((resolve9) => {
+      proxy.close(() => resolve9());
     });
     await rm3(workDir, { recursive: true, force: true });
     throw error;
@@ -3653,7 +4268,7 @@ async function startPackageAppDev(options) {
     root,
     externals: app.clientExternals
   }) : null;
-  const assetsDir = app.assets ? resolve6(root, app.assets) : null;
+  const assetsDir = app.assets ? resolve7(root, app.assets) : null;
   const prebuild = options.manifest.dev?.prebuild;
   let prebuildRunning = false;
   let prebuildSettledAt = 0;
@@ -3687,7 +4302,7 @@ async function startPackageAppDev(options) {
     const started2 = performance.now();
     emit({
       type: "rebuild_start",
-      files: files.map((file) => relative4(root, file) || file)
+      files: files.map((file) => relative5(root, file) || file)
     });
     const assetsChanged = assetsDir !== null && files.some(
       (file) => file === assetsDir || file.startsWith(`${assetsDir}${sep3}`)
@@ -3806,7 +4421,7 @@ async function startPackageAppDev(options) {
   }
   async function startGeneration(bundle, client2) {
     const id = ++generationCounter;
-    const dir = join7(workDir, `g${id}`);
+    const dir = join8(workDir, `g${id}`);
     await writeWorkerFiles({
       workDir: dir,
       code: bundle.code,
@@ -3828,7 +4443,7 @@ async function startPackageAppDev(options) {
     try {
       workerd = await startWorkerd({
         workerdPath,
-        configPath: join7(dir, "config.capnp"),
+        configPath: join8(dir, "config.capnp"),
         cwd: dir,
         env: workerdEnv,
         onSpawn: (pid) => {
@@ -3907,7 +4522,7 @@ async function startPackageAppDev(options) {
       pending.catch(() => {
       }),
       new Promise(
-        (resolve8) => setTimeout(resolve8, rebuildGateMs).unref()
+        (resolve9) => setTimeout(resolve9, rebuildGateMs).unref()
       )
     ]);
   }
@@ -4041,7 +4656,7 @@ async function startPackageAppDev(options) {
       [runSecretHeader]: runSecret,
       [devRequestIdHeader]: tag.id
     };
-    return new Promise((resolve8, reject) => {
+    return new Promise((resolve9, reject) => {
       const upstream = httpRequest(
         forwardUrl,
         { method: req.method, headers },
@@ -4049,7 +4664,7 @@ async function startPackageAppDev(options) {
           if (upstreamRes.headers[devErrorHeader]) {
             void readStream(upstreamRes).then((raw) => {
               respondWithRuntimeError(generation, req, res, tag, raw);
-              resolve8();
+              resolve9();
             }).catch(reject);
             return;
           }
@@ -4076,20 +4691,20 @@ async function startPackageAppDev(options) {
               headers2["content-length"] = String(body.length);
               res.writeHead(status2, headers2);
               res.end(body);
-              resolve8();
+              resolve9();
             }).catch(reject);
             return;
           }
           res.writeHead(status2, upstreamRes.headers);
           upstreamRes.pipe(res);
-          upstreamRes.on("end", () => resolve8());
+          upstreamRes.on("end", () => resolve9());
           upstreamRes.on("error", reject);
         }
       );
       upstream.on("error", reject);
       res.on("close", () => {
         if (!res.writableFinished) upstream.destroy();
-        resolve8();
+        resolve9();
       });
       req.pipe(upstream);
     });
@@ -4138,10 +4753,10 @@ fix: ${fix}` : mapped,
       pending.clear();
       clearTimeout(debounceTimer);
       debouncePending = false;
-      const resolve8 = resolveDebounceFlush;
+      const resolve9 = resolveDebounceFlush;
       resolveDebounceFlush = null;
       debounceFlush = null;
-      resolve8?.();
+      resolve9?.();
     };
     return createDevWatcher({
       root,
@@ -4163,8 +4778,8 @@ fix: ${fix}` : mapped,
         pending.add(path);
         debouncePending = true;
         if (!debounceFlush) {
-          debounceFlush = new Promise((resolve8) => {
-            resolveDebounceFlush = resolve8;
+          debounceFlush = new Promise((resolve9) => {
+            resolveDebounceFlush = resolve9;
           });
         }
         clearTimeout(debounceTimer);
@@ -4173,10 +4788,10 @@ fix: ${fix}` : mapped,
           pending.clear();
           debouncePending = false;
           const build = requestBuild(paths);
-          const resolve8 = resolveDebounceFlush;
+          const resolve9 = resolveDebounceFlush;
           resolveDebounceFlush = null;
           debounceFlush = null;
-          resolve8?.();
+          resolve9?.();
           void build;
         }, options.debounceMs ?? defaultDebounceMs);
       }
@@ -4188,10 +4803,10 @@ fix: ${fix}` : mapped,
     process.off("exit", killAllSync);
     clearTimeout(debounceTimer);
     debouncePending = false;
-    const resolve8 = resolveDebounceFlush;
+    const resolve9 = resolveDebounceFlush;
     resolveDebounceFlush = null;
     debounceFlush = null;
-    resolve8?.();
+    resolve9?.();
     prebuildAbort?.abort();
     await watcher?.close();
     await buildLoop?.catch(() => {
@@ -4205,8 +4820,8 @@ fix: ${fix}` : mapped,
     await bridge.close();
     liveReloadHub.close();
     proxy.closeAllConnections();
-    await new Promise((resolve9) => {
-      proxy.close(() => resolve9());
+    await new Promise((resolve10) => {
+      proxy.close(() => resolve10());
     });
     await rm3(workDir, { recursive: true, force: true });
   };
@@ -4296,7 +4911,7 @@ async function writeWorkerFiles(input) {
     input.workDir,
     packageGraph,
     writeFile3,
-    join7
+    join8
   );
   let gatewayFetchShimModules = packageGraph.modules.map((module) => module.name).filter((name) => name === localExecuteGatewayFetchShimModuleName);
   if (input.mockFetchGateway) {
@@ -4308,23 +4923,23 @@ async function writeWorkerFiles(input) {
     gatewayFetchShimModules = installed.sideEffectModules;
   }
   await writeFile3(
-    join7(input.workDir, files.entry),
+    join8(input.workDir, files.entry),
     createPackageAppEntrySource({ sideEffectModules: gatewayFetchShimModules })
   );
-  await writeFile3(join7(input.workDir, files.user), input.code);
+  await writeFile3(join8(input.workDir, files.user), input.code);
   await writeFile3(
-    join7(input.workDir, files.runtime),
+    join8(input.workDir, files.runtime),
     createPackageLocalRuntimeModuleSource({
       packageContext: input.packageContext,
       mockStorage: input.mockStorage
     })
   );
   await writeFile3(
-    join7(input.workDir, localWorkerModuleNames.runtimeFlatAlias),
+    join8(input.workDir, localWorkerModuleNames.runtimeFlatAlias),
     createRuntimeFlatAliasSource()
   );
   await writeFile3(
-    join7(input.workDir, "config.capnp"),
+    join8(input.workDir, "config.capnp"),
     createWorkerdConfig({
       bridgePort: input.bridgePort,
       files,
@@ -4474,7 +5089,7 @@ async function runDevServe(input) {
       statusUrl
     };
     if (input.readyFile) {
-      await mkdir3(dirname3(input.readyFile), { recursive: true });
+      await mkdir3(dirname4(input.readyFile), { recursive: true });
       await writeFile4(input.readyFile, `${JSON.stringify(ready, null, 2)}
 `);
     }
@@ -4676,8 +5291,8 @@ async function runDevWebhook(input) {
       target: input.target
     });
   }
-  const rawBody = await readFile4(
-    resolve7(input.cwd ?? process.cwd(), input.bodyPath),
+  const rawBody = await readFile5(
+    resolve8(input.cwd ?? process.cwd(), input.bodyPath),
     "utf8"
   );
   let jsonBody = null;
@@ -4747,8 +5362,8 @@ async function runDevEmit(input) {
       target: input.target
     });
   }
-  const rawBody = await readFile4(
-    resolve7(input.cwd ?? process.cwd(), input.bodyPath),
+  const rawBody = await readFile5(
+    resolve8(input.cwd ?? process.cwd(), input.bodyPath),
     "utf8"
   );
   let envelope;
@@ -4805,8 +5420,14 @@ async function runDevCheck(input) {
   const manifest = await loadPackageManifest(input.cwd);
   const checks = [];
   const credentialSignals = [];
-  const push = (name, ok, detail) => {
-    checks.push({ name, ok, detail });
+  const fetchBodyHits = [];
+  const push = (name, ok, detail, level) => {
+    checks.push({
+      name,
+      ok,
+      ...detail !== void 0 ? { detail } : {},
+      ...level !== void 0 ? { level } : {}
+    });
   };
   const bundleAndScan = async (label, modulePath) => {
     try {
@@ -4815,6 +5436,12 @@ async function runDevCheck(input) {
       credentialSignals.push(
         ...await detectCredentialedFetchInSource(bundled, label)
       );
+      fetchBodyHits.push(
+        ...await findPackageFetchBodyWarnings({
+          entryPath: modulePath,
+          packageRoot: manifest.root
+        })
+      );
     } catch (error) {
       push(label, false, error instanceof Error ? error.message : String(error));
     }
@@ -4822,13 +5449,13 @@ async function runDevCheck(input) {
   push("package.json", true, manifest.name);
   push("kody.id", Boolean(manifest.kodyId), manifest.kodyId);
   try {
-    await readFile4(resolve7(manifest.root, "README.md"));
+    await readFile5(resolve8(manifest.root, "README.md"));
     push("README.md", true);
   } catch {
     push("README.md", false, "Publish requires README.md");
   }
   try {
-    await readFile4(resolve7(manifest.root, "AGENTS.md"));
+    await readFile5(resolve8(manifest.root, "AGENTS.md"));
     push("AGENTS.md", true);
   } catch {
     push("AGENTS.md", false, "Publish requires AGENTS.md");
@@ -4861,7 +5488,7 @@ async function runDevCheck(input) {
   }
   let hasMocksFile = false;
   try {
-    await access(join8(manifest.root, packageMocksRelativePath));
+    await access(join9(manifest.root, packageMocksRelativePath));
     hasMocksFile = true;
   } catch {
     hasMocksFile = false;
@@ -4873,6 +5500,12 @@ async function runDevCheck(input) {
   if (mocksDetail) {
     push(packageMocksRelativePath, true, mocksDetail);
   }
+  const fetchBodyWarning = formatFetchBodySecretResolutionWarning(
+    dedupeFetchBodyHits(fetchBodyHits)
+  );
+  if (fetchBodyWarning) {
+    push("secret-resolution", true, fetchBodyWarning, "warning");
+  }
   const failed = checks.filter((check) => !check.ok);
   if (input.json) {
     input.io.stdout(
@@ -4896,7 +5529,7 @@ async function runDevCheck(input) {
     );
   } else {
     for (const check of checks) {
-      const mark = check.ok ? "ok" : "FAIL";
+      const mark = !check.ok ? "FAIL" : check.level === "warning" ? "WARN" : "ok";
       input.io.stdout(
         `${mark.padEnd(4)} ${check.name}${check.detail ? ` \u2014 ${check.detail}` : ""}
 `
@@ -4910,6 +5543,17 @@ async function runDevCheck(input) {
   }
   return failed.length === 0 ? 0 : 1;
 }
+function dedupeFetchBodyHits(hits) {
+  const seen = /* @__PURE__ */ new Set();
+  const unique = [];
+  for (const hit of hits) {
+    const key = `${hit.path}:${hit.line}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    unique.push(hit);
+  }
+  return unique;
+}
 async function runPackageModuleOnce(input) {
   const packageContext = buildLocalPackageContext({
     kodyId: input.manifest.kodyId,
@@ -4998,7 +5642,7 @@ function parseDevSubcommand(positionals) {
 }
 async function removeOwnedReadyFile(path, ownerPid) {
   try {
-    const parsed = JSON.parse(await readFile4(path, "utf8"));
+    const parsed = JSON.parse(await readFile5(path, "utf8"));
     if (parsed.pid !== ownerPid) return;
     await rm4(path, { force: true });
   } catch {
@@ -5022,4 +5666,4 @@ export {
 chokidar/esm/index.js:
   (*! chokidar - MIT License (c) 2012 Paul Miller (paulmillr.com) *)
 */
-//# sourceMappingURL=dev-command-TZ2EB4J3.js.map
+//# sourceMappingURL=dev-command-PCQDX5EH.js.map