@moda-ai/cli 1.55.13 → 1.55.15

package/dist/{cli-m0fa54ny.js → cli-7fc44hhq.js}

@@ -4,16 +4,16 @@ import {
 import {
   createCommandContext,
   stringOption
-} from "./cli-4x9w6ey7.js";
+} from "./cli-kf3d6y8c.js";
 import {
   assertFlags,
   assertPositionals,
   requireTenant
-} from "./cli-k7vwt56h.js";
+} from "./cli-53mvsfgn.js";
 import {
   ApiError,
   callControlAPI
-} from "./cli-ryd7nzke.js";
+} from "./cli-2ars875d.js";
 import {
   CliInputError,
   CliInputRequiredError,
@@ -39,7 +39,7 @@ import {
   resolveModaBaseUrl,
   resolveTenantId,
   shouldInventoryFile
-} from "./cli-kwz900s4.js";
+} from "./cli-b3cxcxgn.js";
 import {
   __commonJS,
   __require,
@@ -10304,7 +10304,7 @@ var require_typescript = __commonJS((exports, module) => {
       identity: () => identity2,
       identitySourceMapConsumer: () => identitySourceMapConsumer,
       ignoreSourceNewlines: () => ignoreSourceNewlines,
-      ignoredPaths: () => ignoredPaths,
+      ignoredPaths: () => ignoredPaths2,
       importFromModuleSpecifier: () => importFromModuleSpecifier,
       importSyntaxAffectsModuleResolution: () => importSyntaxAffectsModuleResolution,
       indexOfAnyCharCode: () => indexOfAnyCharCode,
@@ -16689,7 +16689,7 @@ ${lanes.join(`
     function getFileWatcherEventKind(oldTime, newTime) {
       return oldTime === 0 ? 0 : newTime === 0 ? 2 : 1;
     }
-    var ignoredPaths = ["/node_modules/.", "/.git", "/.#"];
+    var ignoredPaths2 = ["/node_modules/.", "/.git", "/.#"];
     var curSysLog = noop;
     function sysLog(s) {
       return curSysLog(s);
@@ -16907,7 +16907,7 @@ ${lanes.join(`
         }
       }
       function isIgnoredPath(path, options) {
-        return some(ignoredPaths, (searchPath) => isInPath(path, searchPath)) || isIgnoredByWatchOptions(path, options, useCaseSensitiveFileNames2, getCurrentDirectory);
+        return some(ignoredPaths2, (searchPath) => isInPath(path, searchPath)) || isIgnoredByWatchOptions(path, options, useCaseSensitiveFileNames2, getCurrentDirectory);
       }
       function isInPath(path, searchPath) {
         if (path.includes(searchPath))
@@ -31305,7 +31305,7 @@ ${lanes.join(`
       }
     }
     function containsIgnoredPath(path) {
-      return some(ignoredPaths, (p2) => path.includes(p2));
+      return some(ignoredPaths2, (p2) => path.includes(p2));
     }
     function getContainingNodeArray(node) {
       if (!node.parent)
@@ -75258,11 +75258,11 @@ ${lanes.join(`
         const resolved = resolveStructuredTypeMembers(type);
         return !!(resolved.callSignatures.length || resolved.constructSignatures.length || resolved.members.get("bind") && isTypeSubtypeOf(type, globalFunctionType));
       }
-      function getTypeFacts(type, mask2) {
-        return getTypeFactsWorker(type, mask2) & mask2;
+      function getTypeFacts(type, mask22) {
+        return getTypeFactsWorker(type, mask22) & mask22;
       }
-      function hasTypeFacts(type, mask2) {
-        return getTypeFacts(type, mask2) !== 0;
+      function hasTypeFacts(type, mask22) {
+        return getTypeFacts(type, mask22) !== 0;
       }
       function getTypeFactsWorker(type, callerOnlyNeeds) {
         if (type.flags & (2097152 | 465829888)) {
@@ -110604,14 +110604,14 @@ ${lanes.join(`
         return factory2.createModifiersFromModifierFlags(newFlags);
       }
       function ensureModifierFlags(node) {
-        let mask2 = 131071 ^ (1 | 1024 | 16);
+        let mask22 = 131071 ^ (1 | 1024 | 16);
         let additions = needsDeclare && !isAlwaysType(node) ? 128 : 0;
         const parentIsFile = node.parent.kind === 308;
         if (!parentIsFile || isBundledEmit && parentIsFile && isExternalModule(node.parent)) {
-          mask2 ^= 128;
+          mask22 ^= 128;
           additions = 0;
         }
-        return maskModifierFlags(node, mask2, additions);
+        return maskModifierFlags(node, mask22, additions);
       }
       function transformHeritageClauses(nodes) {
         return factory2.createNodeArray(filter(map(nodes, (clause) => factory2.updateHeritageClause(clause, visitNodes2(factory2.createNodeArray(filter(clause.types, (t) => {
@@ -121243,7 +121243,7 @@ ${lanes.join(`
       if (endsWith(path, "/node_modules/.staging")) {
         return removeSuffix(path, "/.staging");
       }
-      return some(ignoredPaths, (searchPath) => path.includes(searchPath)) ? undefined : path;
+      return some(ignoredPaths2, (searchPath) => path.includes(searchPath)) ? undefined : path;
     }
     function perceivedOsRootLengthForWatching(pathComponents2, length2) {
       if (length2 <= 1)
@@ -163646,20 +163646,20 @@ ${options.prefix}` : `
       return rulesMapCache;
     }
     function getRuleActionExclusion(ruleAction) {
-      let mask2 = 0;
+      let mask22 = 0;
       if (ruleAction & 1) {
-        mask2 |= 28;
+        mask22 |= 28;
       }
       if (ruleAction & 2) {
-        mask2 |= 96;
+        mask22 |= 96;
       }
       if (ruleAction & 28) {
-        mask2 |= 28;
+        mask22 |= 28;
       }
       if (ruleAction & 96) {
-        mask2 |= 96;
+        mask22 |= 96;
       }
-      return mask2;
+      return mask22;
     }
     function createRulesMap(rules) {
       const map2 = buildMap(rules);
@@ -163704,7 +163704,7 @@ ${options.prefix}` : `
       return row * mapRowLength + column;
     }
     var maskBitSize = 5;
-    var mask = 31;
+    var mask2 = 31;
     var mapRowLength = 166 + 1;
     var RulesPosition = ((RulesPosition2) => {
       RulesPosition2[RulesPosition2["StopRulesSpecific"] = 0] = "StopRulesSpecific";
@@ -163724,15 +163724,15 @@ ${options.prefix}` : `
     function getInsertionIndex(indexBitmap, maskPosition) {
       let index = 0;
       for (let pos = 0;pos <= maskPosition; pos += maskBitSize) {
-        index += indexBitmap & mask;
+        index += indexBitmap & mask2;
         indexBitmap >>= maskBitSize;
       }
       return index;
     }
     function increaseInsertionIndex(indexBitmap, maskPosition) {
-      const value = (indexBitmap >> maskPosition & mask) + 1;
-      Debug.assert((value & mask) === value, "Adding more rules into the sub-bucket than allowed. Maximum allowed is 32 rules.");
-      return indexBitmap & ~(mask << maskPosition) | value << maskPosition;
+      const value = (indexBitmap >> maskPosition & mask2) + 1;
+      Debug.assert((value & mask2) === value, "Adding more rules into the sub-bucket than allowed. Maximum allowed is 32 rules.");
+      return indexBitmap & ~(mask2 << maskPosition) | value << maskPosition;
     }
     function createTextRangeWithKind(pos, end, kind) {
       const textRangeWithKind = { pos, end, kind };
@@ -166304,7 +166304,7 @@ ${options.prefix}` : `
       identity: () => identity2,
       identitySourceMapConsumer: () => identitySourceMapConsumer,
       ignoreSourceNewlines: () => ignoreSourceNewlines,
-      ignoredPaths: () => ignoredPaths,
+      ignoredPaths: () => ignoredPaths2,
       importFromModuleSpecifier: () => importFromModuleSpecifier,
       importSyntaxAffectsModuleResolution: () => importSyntaxAffectsModuleResolution,
       indexOfAnyCharCode: () => indexOfAnyCharCode,
@@ -177901,7 +177901,7 @@ import {
   lstatSync as lstatSync10,
   mkdtempSync as mkdtempSync2,
   mkdirSync as mkdirSync6,
-  readFileSync as readFileSync17,
+  readFileSync as readFileSync16,
   readdirSync as readdirSync4,
   writeFileSync as writeFileSync6,
   rmSync as rmSync4
@@ -180097,7 +180097,7 @@ async function remoteAnalyzeFetch(url, apiKey, init, timeoutMs) {
 
 // src/harness-register/register.ts
 import * as fs from "node:fs";
-import { mkdtempSync, readFileSync as readFileSync7, rmSync as rmSync3 } from "node:fs";
+import { mkdtempSync, readFileSync as readFileSync6, rmSync as rmSync3 } from "node:fs";
 import { Readable as Readable2 } from "node:stream";
 import { tmpdir } from "node:os";
 import { basename as basename4, join as join8, resolve as resolve4 } from "node:path";
@@ -180105,7 +180105,7 @@ import { basename as basename4, join as join8, resolve as resolve4 } from "node:
 // src/harness-register/collect-adapter.ts
 import { createHash as createHash4 } from "node:crypto";
 import { execFileSync } from "node:child_process";
-import { copyFileSync, createReadStream, existsSync as existsSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync6, realpathSync as realpathSync4, rmSync as rmSync2, statSync as statSync2, writeFileSync as writeFileSync4 } from "node:fs";
+import { copyFileSync, createReadStream, existsSync as existsSync6, mkdirSync as mkdirSync4, realpathSync as realpathSync4, rmSync as rmSync2, statSync as statSync2, writeFileSync as writeFileSync4 } from "node:fs";
 import { dirname as dirname5, join as join7 } from "node:path";
 
 // ../../packages/harness-bundle/src/contract.ts
@@ -180406,6 +180406,22 @@ function isCommentLine(line) {
   const t = line.trimStart();
   return t.startsWith("//") || t.startsWith("#") || t.startsWith("*") || t.startsWith("/*") || t.startsWith("--") || t.startsWith("<!--");
 }
+function globRegex(glob) {
+  let out = "";
+  for (let i = 0;i < glob.length; i++) {
+    const ch = glob[i];
+    if (ch === "*" && glob[i + 1] === "*" && glob[i + 2] === "/") {
+      out += "(?:.*/)?";
+      i += 2;
+    } else if (ch === "*")
+      out += "[^/]*";
+    else if (ch === "?")
+      out += "[^/]";
+    else
+      out += ch.replace(/[.+^${}()|[\]\\]/, "\\$&");
+  }
+  return new RegExp(`^${out}$`);
+}
 
 // ../../packages/harness-bundle/src/detect/files.ts
 var DEFAULT_MAX_FILE_BYTES = 1024 * 1024;
@@ -180727,6 +180743,7 @@ function pyStringStateAfter(line, open) {
   }
   return open;
 }
+var PY_HEADER = /^(?:if|elif|else|try|except|finally|with|for|while|async\s+with|async\s+for)\b[^:]*:\s*/;
 function pyImports(text) {
   const out = [];
   const lines = text.split(/\r?\n/);
@@ -180737,24 +180754,34 @@ function pyImports(text) {
     inString = pyStringStateAfter(line, inString);
     if (wasInString !== undefined)
       continue;
-    let m = /^\s*from\s+([A-Za-z_][\w.]*)\s+import\s+(.+)/.exec(line);
-    if (m) {
-      out.push({ spec: m[1], line: i + 1 });
-      let list = m[2].replace(/#.*$/, "");
-      for (let j = i + 1;j < lines.length && (list.includes("(") && !list.includes(")") || /\\\s*$/.test(list)); j++)
-        list += ` ${lines[j].replace(/#.*$/, "")}`;
-      const names = list.replace(/[()\\]/g, "").split(",");
-      for (const raw of names) {
-        const name = raw.trim().split(/\s+as\s+/)[0];
-        if (/^[A-Za-z_]\w*$/.test(name))
-          out.push({ spec: `${m[1]}.${name}`, line: i + 1 });
+    const literals = [];
+    const code = line.replace(/(?:\b[rRbBuUfF]{1,2})?(['"])((?:\\.|(?!\1).)*)\1/g, (_m, _q, body) => `\x00${literals.push(body) - 1}\x00`).replace(/#.*$/, "");
+    for (const m of code.matchAll(/\b(?:importlib\.import_module|__import__)\(\s*\u0000(\d+)\u0000/g)) {
+      const spec = literals[Number(m[1])];
+      if (/^[A-Za-z_][\w.]*$/.test(spec))
+        out.push({ spec, line: i + 1 });
+    }
+    for (let stmt of code.split(";")) {
+      stmt = stmt.trim();
+      for (let h = PY_HEADER.exec(stmt);h; h = PY_HEADER.exec(stmt))
+        stmt = stmt.slice(h[0].length);
+      let m = /^from\s+([A-Za-z_][\w.]*)\s+import\s+(.+)/.exec(stmt);
+      if (m) {
+        out.push({ spec: m[1], line: i + 1 });
+        let list = m[2];
+        for (let j = i + 1;j < lines.length && (list.includes("(") && !list.includes(")") || /\\\s*$/.test(list)); j++)
+          list += ` ${lines[j].replace(/#.*$/, "")}`;
+        for (const raw of list.replace(/[()\\]/g, "").split(",")) {
+          const name = raw.trim().split(/\s+as\s+/)[0];
+          if (/^[A-Za-z_]\w*$/.test(name))
+            out.push({ spec: `${m[1]}.${name}`, line: i + 1 });
+        }
+        continue;
       }
-      continue;
-    }
-    m = /^\s*import\s+([A-Za-z_][\w.]*(?:\s+as\s+\w+)?(?:\s*,\s*[A-Za-z_][\w.]*(?:\s+as\s+\w+)?)*)/.exec(line);
-    if (m) {
-      for (const raw of m[1].split(","))
-        out.push({ spec: raw.trim().split(/\s+as\s+/)[0], line: i + 1 });
+      m = /^import\s+([A-Za-z_][\w.]*(?:\s+as\s+\w+)?(?:\s*,\s*[A-Za-z_][\w.]*(?:\s+as\s+\w+)?)*)/.exec(stmt);
+      if (m)
+        for (const raw of m[1].split(","))
+          out.push({ spec: raw.trim().split(/\s+as\s+/)[0], line: i + 1 });
     }
   }
   return out;
@@ -180873,7 +180900,7 @@ var PROVIDERS = [
   p("libsql", "database", "engine", { npm: ["@libsql/client", "drizzle-orm/libsql", "@prisma/adapter-libsql"], py: ["libsql_client", "libsql_experimental", "libsql"], pypi: ["libsql-client", "libsql-experimental"], hosts: [".turso.io"], env: ["TURSO_*", "LIBSQL_*"], schemes: ["libsql"], images: ["ghcr.io/tursodatabase/libsql-server"] }),
   p("mssql", "database", "engine", { npm: ["mssql", "tedious"], py: ["pyodbc", "pymssql"], go: ["github.com/microsoft/go-mssqldb", "github.com/denisenkom/go-mssqldb"], hosts: [".database.windows.net"], env: ["MSSQL_*"], schemes: ["mssql", "sqlserver"], images: ["mcr.microsoft.com/mssql/server", "mcr.microsoft.com/azure-sql-edge"] }),
   p("cloudflare.d1", "database", "emulated", { npm: ["drizzle-orm/d1", "@prisma/adapter-d1"] }),
-  p("redis", "kv", "engine", { npm: ["redis", "ioredis", "@redis/client", "@upstash/redis", "@vercel/kv"], py: ["redis", "aioredis", "upstash_redis", "valkey"], pypi: ["redis", "aioredis", "upstash-redis", "valkey"], go: ["github.com/redis/go-redis", "github.com/go-redis/redis", "github.com/gomodule/redigo"], gems: ["redis"], hosts: [".upstash.io", ".redis.cache.windows.net", ".redislabs.com", ".redis-cloud.com", ".cache.amazonaws.com"], env: ["REDIS_*", "UPSTASH_REDIS_*", "KV_REST_API_*", "KV_URL", "VALKEY_*", "*_REDIS_URL"], schemes: ["redis", "rediss", "valkey"], images: ["redis", "valkey/valkey", "redislabs/redismod", "redis/redis-stack", "redis/redis-stack-server", "bitnami/redis", "eqalpha/keydb", "docker.dragonflydb.io/dragonflydb/dragonfly"] }),
+  p("redis", "kv", "engine", { npm: ["redis", "ioredis", "@redis/client", "@upstash/redis", "@vercel/kv", "bullmq", "bull", "bee-queue", "@nestjs/bull", "@nestjs/bullmq"], py: ["redis", "aioredis", "upstash_redis", "valkey"], pypi: ["redis", "aioredis", "upstash-redis", "valkey"], go: ["github.com/redis/go-redis", "github.com/go-redis/redis", "github.com/gomodule/redigo"], gems: ["redis"], hosts: [".upstash.io", ".redis.cache.windows.net", ".redislabs.com", ".redis-cloud.com", ".cache.amazonaws.com"], env: ["REDIS_*", "UPSTASH_REDIS_*", "KV_REST_API_*", "KV_URL", "VALKEY_*", "*_REDIS_URL"], schemes: ["redis", "rediss", "valkey"], images: ["redis", "valkey/valkey", "redislabs/redismod", "redis/redis-stack", "redis/redis-stack-server", "bitnami/redis", "eqalpha/keydb", "docker.dragonflydb.io/dragonflydb/dragonfly"] }),
   p("memcached", "kv", "engine", { npm: ["memjs", "memcached"], py: ["pymemcache", "pylibmc"], env: ["MEMCACHE_*", "MEMCACHED_*"], schemes: ["memcached"], images: ["memcached"] }),
   p("mongodb", "document", "engine", { npm: ["mongodb", "mongoose"], py: ["pymongo", "motor", "mongoengine", "beanie"], go: ["go.mongodb.org/mongo-driver"], gems: ["mongoid", "mongo"], hosts: [".mongodb.net"], env: ["MONGODB_*", "MONGO_*"], schemes: ["mongodb", "mongodb+srv"], images: ["mongo", "mongodb/mongodb-community-server", "bitnami/mongodb"] }),
   p("clickhouse", "database", "engine", { npm: ["@clickhouse/client", "@clickhouse/client-web"], py: ["clickhouse_connect", "clickhouse_driver"], pypi: ["clickhouse-connect", "clickhouse-driver"], go: ["github.com/ClickHouse/clickhouse-go"], hosts: [".clickhouse.cloud"], env: ["CLICKHOUSE_*"], schemes: ["clickhouse"], images: ["clickhouse/clickhouse-server", "yandex/clickhouse-server"] }),
@@ -180887,7 +180914,7 @@ var PROVIDERS = [
   p("snowflake", "database", "none", { npm: ["snowflake-sdk"], py: ["snowflake.connector", "snowflake.snowpark"], pypi: ["snowflake-connector-python"], hosts: [".snowflakecomputing.com"], env: ["SNOWFLAKE_*"] }),
   p("aws.s3", "object_store", "emulated", { npm: ["@aws-sdk/client-s3", "@aws-sdk/lib-storage", "@aws-sdk/s3-request-presigner", "@aws-sdk/s3-presigned-post", "minio"], py: ["minio", "s3fs"], go: [...goAws("s3"), "github.com/minio/minio-go"], hosts: [/(^|\.)s3([.-][a-z0-9-]+)?\.amazonaws\.com$/], env: ["S3_*", "AWS_S3_*", "*_S3_BUCKET*", "MINIO_*"], schemes: ["s3"], images: ["minio/minio", "quay.io/minio/minio", "bitnami/minio"], code: [botoTracked("s3"), awsV2("S3")] }),
   p("cloudflare.r2", "object_store", "emulated", { hosts: [".r2.cloudflarestorage.com", ".r2.dev"], env: ["R2_*", "*_R2_*"] }),
-  p("gcp.gcs", "object_store", "emulated", { npm: ["@google-cloud/storage", "firebase-admin/storage"], py: ["google.cloud.storage", "firebase_admin.storage"], pypi: ["google-cloud-storage"], go: ["cloud.google.com/go/storage"], hosts: ["storage.googleapis.com"], env: ["GCS_*", "*_GCS_*"], schemes: ["gs"], images: ["fsouza/fake-gcs-server"] }),
+  p("gcp.storage", "object_store", "emulated", { npm: ["@google-cloud/storage", "firebase-admin/storage"], py: ["google.cloud.storage", "firebase_admin.storage"], pypi: ["google-cloud-storage"], go: ["cloud.google.com/go/storage"], hosts: ["storage.googleapis.com"], env: ["GCS_*", "*_GCS_*"], schemes: ["gs"], images: ["fsouza/fake-gcs-server"] }),
   p("azure.blob", "object_store", "emulated", { npm: ["@azure/storage-blob"], py: ["azure.storage.blob"], pypi: ["azure-storage-blob"], go: ["github.com/Azure/azure-sdk-for-go/sdk/storage/azblob"], hosts: [/\.blob\.core\.windows\.net$/], env: ["AZURE_STORAGE_*", "AzureWebJobsStorage"], images: ["mcr.microsoft.com/azure-storage/azurite"] }),
   p("vercel.blob", "object_store", "saas", { npm: ["@vercel/blob"], hosts: [".blob.vercel-storage.com"], env: ["BLOB_READ_WRITE_TOKEN"] }),
   p("uploadthing", "object_store", "saas", { npm: ["uploadthing", "@uploadthing/react"], env: ["UPLOADTHING_*"], hosts: ["api.uploadthing.com"] }),
@@ -180905,7 +180932,6 @@ var PROVIDERS = [
   p("kafka", "queue", "engine", { npm: ["kafkajs", "node-rdkafka", "@confluentinc/kafka-javascript"], py: ["kafka", "confluent_kafka", "aiokafka"], pypi: ["kafka-python", "confluent-kafka", "aiokafka"], go: ["github.com/segmentio/kafka-go", "github.com/confluentinc/confluent-kafka-go", "github.com/IBM/sarama", "github.com/Shopify/sarama"], hosts: [".confluent.cloud"], env: ["KAFKA_*"], schemes: ["kafka"], images: ["confluentinc/cp-kafka", "bitnami/kafka", "apache/kafka", "wurstmeister/kafka", "redpandadata/redpanda", "docker.redpanda.com/redpandadata/redpanda", "vectorized/redpanda"] }),
   p("rabbitmq", "queue", "engine", { npm: ["amqplib", "amqp-connection-manager"], py: ["pika", "aio_pika", "kombu"], pypi: ["pika", "aio-pika", "kombu"], go: ["github.com/rabbitmq/amqp091-go", "github.com/streadway/amqp"], hosts: [".cloudamqp.com"], env: ["RABBITMQ_*", "AMQP_*"], schemes: ["amqp", "amqps"], images: ["rabbitmq", "bitnami/rabbitmq"] }),
   p("nats", "queue", "engine", { npm: ["nats"], py: ["nats"], pypi: ["nats-py"], go: ["github.com/nats-io/nats.go"], env: ["NATS_*"], schemes: ["nats"], images: ["nats"] }),
-  p("bullmq", "queue", "engine", { npm: ["bullmq", "bull", "bee-queue"] }),
   p("celery", "queue", "engine", { py: ["celery"], env: ["CELERY_*"] }),
   p("inngest", "queue", "emulated", { npm: ["inngest"], py: ["inngest"], env: ["INNGEST_*"], hosts: ["api.inngest.com", "inn.gs"] }),
   p("trigger.dev", "queue", "saas", { npm: ["@trigger.dev/sdk"], env: ["TRIGGER_*"], hosts: ["api.trigger.dev"] }),
@@ -180921,7 +180947,11 @@ var PROVIDERS = [
   p("aws.bedrock_agentcore", "function.invoke", "none", { npm: ["bedrock-agentcore", "@aws-sdk/client-bedrock-agentcore", "@aws-sdk/client-bedrock-agentcore-control"], py: ["bedrock_agentcore"], pypi: ["bedrock-agentcore"], env: ["BEDROCK_AGENTCORE_*"], code: [botoTracked("bedrock-agentcore", "bedrock-agentcore-control")] }),
   p("cloud.metadata", "other", "emulated", { hosts: ["metadata.google.internal", "169.254.169.254", "metadata"] }),
   p("gcp.secretmanager", "other", "saas", { npm: ["@google-cloud/secret-manager"], py: ["google.cloud.secretmanager"], pypi: ["google-cloud-secret-manager"], hosts: ["secretmanager.googleapis.com"] }),
-  p("gcp.ml_apis", "http.request", "saas", { npm: ["@google-cloud/vision", "@google-cloud/language", "@google-cloud/translate", "@google-cloud/speech", "@google-cloud/text-to-speech", "@google-cloud/video-intelligence", "@google-cloud/documentai", "@google-cloud/dialogflow", "@google-cloud/dlp"], py: ["google.cloud.vision", "google.cloud.language", "google.cloud.translate", "google.cloud.translate_v2", "google.cloud.translate_v3", "google.cloud.speech", "google.cloud.texttospeech", "google.cloud.videointelligence", "google.cloud.documentai", "google.cloud.dialogflow"], hosts: ["vision.googleapis.com", "translation.googleapis.com", "language.googleapis.com", "speech.googleapis.com", "texttospeech.googleapis.com", "documentai.googleapis.com"] }),
+  p("gcp.vision", "http.request", "saas", { npm: ["@google-cloud/vision"], py: ["google.cloud.vision"], pypi: ["google-cloud-vision"], hosts: ["vision.googleapis.com"] }),
+  p("gcp.translate", "http.request", "saas", { npm: ["@google-cloud/translate"], py: ["google.cloud.translate", "google.cloud.translate_v2", "google.cloud.translate_v3"], pypi: ["google-cloud-translate"], hosts: ["translation.googleapis.com"] }),
+  p("gcp.speech", "http.request", "saas", { npm: ["@google-cloud/speech", "@google-cloud/text-to-speech"], py: ["google.cloud.speech", "google.cloud.texttospeech"], hosts: ["speech.googleapis.com", "texttospeech.googleapis.com"] }),
+  p("gcp.language", "http.request", "saas", { npm: ["@google-cloud/language"], py: ["google.cloud.language"], hosts: ["language.googleapis.com"] }),
+  p("gcp.documentai", "http.request", "saas", { npm: ["@google-cloud/documentai", "@google-cloud/video-intelligence", "@google-cloud/dialogflow", "@google-cloud/dlp"], py: ["google.cloud.documentai", "google.cloud.videointelligence", "google.cloud.dialogflow"], hosts: ["documentai.googleapis.com"] }),
   p("cloudflare.api", "http.request", "saas", { npm: ["cloudflare"], py: ["cloudflare"], hosts: ["api.cloudflare.com"], env: ["CLOUDFLARE_API_TOKEN", "CF_API_TOKEN"] }),
   p("pinecone", "vector_store", "emulated", { npm: ["@pinecone-database/pinecone", "@langchain/pinecone"], py: ["pinecone", "langchain_pinecone"], pypi: ["pinecone", "pinecone-client"], hosts: [".pinecone.io"], env: ["PINECONE_*"], images: ["ghcr.io/pinecone-io/pinecone-local"] }),
   p("weaviate", "vector_store", "engine", { npm: ["weaviate-client", "weaviate-ts-client", "@langchain/weaviate"], py: ["weaviate"], pypi: ["weaviate-client"], hosts: [".weaviate.network", ".weaviate.cloud"], env: ["WEAVIATE_*"], images: ["semitechnologies/weaviate", "cr.weaviate.io/semitechnologies/weaviate"] }),
@@ -180943,7 +180973,7 @@ var PROVIDERS = [
   p("anthropic", "model.inference", "model", { npm: ["@anthropic-ai/sdk", "@ai-sdk/anthropic", "@langchain/anthropic", "@anthropic-ai/claude-agent-sdk", "@anthropic-ai/claude-code", "@anthropic-ai/bedrock-sdk", "@anthropic-ai/vertex-sdk"], py: ["anthropic", "langchain_anthropic", "claude_agent_sdk", "claude_code_sdk", "llama_index.llms.anthropic"], pypi: ["langchain-anthropic", "claude-agent-sdk", "claude-code-sdk"], go: ["github.com/anthropics/anthropic-sdk-go"], hosts: ["api.anthropic.com"], env: ["ANTHROPIC_*"] }),
   p("openrouter", "model.inference", "model", { npm: ["@openrouter/ai-sdk-provider", "@openrouter/sdk"], hosts: ["openrouter.ai"], env: ["OPENROUTER_*"] }),
   p("google.genai", "model.inference", "model", { npm: ["@google/genai", "@google/generative-ai", "@ai-sdk/google", "@langchain/google-genai", "@genkit-ai/googleai", "@genkit-ai/google-genai"], py: ["google.genai", "google.generativeai", "langchain_google_genai"], pypi: ["google-genai", "google-generativeai", "langchain-google-genai"], go: ["google.golang.org/genai", "github.com/google/generative-ai-go"], hosts: ["generativelanguage.googleapis.com"], env: ["GEMINI_*", "GOOGLE_API_KEY", "GOOGLE_GENERATIVE_AI_*", "GOOGLE_GENAI_*"] }),
-  p("google.vertex", "model.inference", "model", { npm: ["@google-cloud/vertexai", "@ai-sdk/google-vertex", "@langchain/google-vertexai", "@genkit-ai/vertexai"], py: ["vertexai", "google.cloud.aiplatform", "langchain_google_vertexai"], pypi: ["google-cloud-aiplatform", "langchain-google-vertexai"], hosts: [/aiplatform\.googleapis\.com$/], env: ["VERTEX_*", "GOOGLE_VERTEX_*"] }),
+  p("google.vertex", "model.inference", "model", { npm: ["@google-cloud/vertexai", "@ai-sdk/google-vertex", "@langchain/google-vertexai", "@genkit-ai/vertexai"], py: ["vertexai", "google.cloud.aiplatform", "langchain_google_vertexai", "pydantic_ai.models.vertexai"], pypi: ["google-cloud-aiplatform", "langchain-google-vertexai"], hosts: [/aiplatform\.googleapis\.com$/], env: ["VERTEX_*", "GOOGLE_VERTEX_*", "GOOGLE_GENAI_USE_VERTEXAI"], code: [/\bvertexai\.init\s*\(/, /\bClient\s*\([^)]*\bvertexai\s*=\s*True/, /\bnew\s+GoogleGenAI\s*\(\s*\{[^}]*\bvertexai\s*:\s*true/, /GOOGLE_GENAI_USE_VERTEXAI['"]?\s*\]?\s*=\s*['"]?(?:True|true|TRUE|1)\b/] }),
   p("aws.bedrock", "model.inference", "model", { npm: ["@aws-sdk/client-bedrock-runtime", "@aws-sdk/client-bedrock-agent-runtime", "@ai-sdk/amazon-bedrock", "@langchain/aws"], py: ["langchain_aws"], pypi: ["langchain-aws"], go: goAws("bedrockruntime"), hosts: [/^bedrock(-runtime|-agent-runtime)?\.[a-z0-9-]+\.amazonaws\.com$/], env: ["BEDROCK_*", "AWS_BEDROCK_*"], code: [botoTracked("bedrock-runtime", "bedrock-agent-runtime", "bedrock")] }),
   p("azure.openai", "model.inference", "model", { npm: ["@azure/openai", "@ai-sdk/azure"], py: ["azure.ai.inference", "azure.ai.openai"], hosts: [/\.openai\.azure\.com$/, /\.services\.ai\.azure\.com$/], env: ["AZURE_OPENAI_*", "AZURE_AI_*"], code: [/\bAzureOpenAI\s*\(/, /\bAzureChatOpenAI\s*\(/, /\bnew\s+AzureOpenAI\s*\(/] }),
   p("groq", "model.inference", "model", { npm: ["groq-sdk", "@ai-sdk/groq", "@langchain/groq"], py: ["groq", "langchain_groq"], hosts: ["api.groq.com"], env: ["GROQ_*"] }),
@@ -180999,7 +181029,7 @@ var PROVIDERS = [
   p("shopify", "http.request", "saas", { npm: ["@shopify/shopify-api", "@shopify/admin-api-client", "shopify-api-node"], py: ["shopify"], pypi: ["ShopifyAPI"], hosts: [".myshopify.com"], env: ["SHOPIFY_*"] }),
   p("jira", "http.request", "saas", { npm: ["jira-client", "jira.js"], py: ["jira", "atlassian"], pypi: ["atlassian-python-api"], hosts: [".atlassian.net"], env: ["JIRA_*", "ATLASSIAN_*", "CONFLUENCE_*"] }),
   p("airtable", "http.request", "saas", { npm: ["airtable"], py: ["pyairtable"], hosts: ["api.airtable.com"], env: ["AIRTABLE_*"] }),
-  p("google.apis", "http.request", "saas", { npm: ["googleapis", "@googleapis/sheets", "@googleapis/gmail", "@googleapis/drive", "@googleapis/calendar"], py: ["googleapiclient", "google_auth_oauthlib", "google.oauth2", "google.auth"], pypi: ["google-api-python-client", "google-auth-oauthlib"], go: ["google.golang.org/api"], hosts: ["www.googleapis.com", "sheets.googleapis.com", "gmail.googleapis.com", "oauth2.googleapis.com", "accounts.google.com", ".googleapis.com"], env: ["GOOGLE_CLIENT_*", "GOOGLE_SERVICE_ACCOUNT*"] }),
+  p("google.apis", "http.request", "saas", { npm: ["googleapis", "@googleapis/sheets", "@googleapis/gmail", "@googleapis/drive", "@googleapis/calendar"], py: ["googleapiclient", "google_auth_oauthlib"], pypi: ["google-api-python-client", "google-auth-oauthlib"], go: ["google.golang.org/api"], hosts: ["www.googleapis.com", "sheets.googleapis.com", "gmail.googleapis.com", "oauth2.googleapis.com", "accounts.google.com", ".googleapis.com"], env: ["GOOGLE_CLIENT_*", "GOOGLE_SERVICE_ACCOUNT*"] }),
   p("google.maps", "http.request", "saas", { npm: ["@googlemaps/google-maps-services-js"], py: ["googlemaps"], hosts: ["maps.googleapis.com", "places.googleapis.com"], env: ["GOOGLE_MAPS_*"] }),
   p("serpapi", "http.request", "saas", { npm: ["serpapi"], py: ["serpapi"], pypi: ["google-search-results"], hosts: ["serpapi.com"], env: ["SERPAPI_*", "SERP_API_*"] }),
   p("serper", "http.request", "saas", { hosts: ["google.serper.dev"], env: ["SERPER_*"], code: [/\bSerperDevTool\s*\(/] }),
@@ -181025,22 +181055,52 @@ var PROVIDERS = [
   p("arxiv", "http.request", "saas", { py: ["arxiv"], hosts: ["export.arxiv.org"], code: [/\bArxiv(?:Retriever|APIWrapper|QueryRun|Loader)\s*\(/] }),
   p("linkup", "http.request", "saas", { npm: ["linkup-sdk"], py: ["linkup"], pypi: ["linkup-sdk"], hosts: ["api.linkup.so"], env: ["LINKUP_*"] }),
   p("ncbi", "http.request", "saas", { hosts: ["eutils.ncbi.nlm.nih.gov", "pubmed.ncbi.nlm.nih.gov"], code: [/\bPubMed(?:APIWrapper|QueryRun|Retriever)\s*\(/], env: ["NCBI_*", "PUBMED_*"] }),
+  p("mcp", "function.invoke", "saas", { npm: ["@modelcontextprotocol/sdk/client", "@ai-sdk/mcp", "@langchain/mcp-adapters"], py: ["mcp.client", "langchain_mcp_adapters", "fastmcp.client"], code: [/\baddMcpServer\s*\(/, /\bcreateSdkMcpServer\s*\(/, /\bexperimental_createMCPClient\s*\(|\bcreateMCPClient\s*\(/, /\bmcpServers\b/, /\bMultiServerMCPClient\s*\(/, /\bClientSession\s*\(\s*read/] }),
   p("pusher", "http.request", "saas", { npm: ["pusher"], py: ["pusher"], hosts: [".pusher.com"], env: ["PUSHER_*"] }),
   p("ably", "http.request", "saas", { npm: ["ably"], py: ["ably"], hosts: ["rest.ably.io", "realtime.ably.io"], env: ["ABLY_*"] }),
   p("mapbox", "http.request", "saas", { hosts: ["api.mapbox.com"], env: ["MAPBOX_*", "*_MAPBOX_*"] }),
   p("openweathermap", "http.request", "saas", { hosts: ["api.openweathermap.org"], env: ["OPENWEATHER*"] }),
   p("open-meteo", "http.request", "saas", { hosts: ["api.open-meteo.com", "geocoding-api.open-meteo.com", "archive-api.open-meteo.com"] }),
-  p("telemetry.sentry", "other", "saas", { npm: ["@sentry/node", "@sentry/nextjs", "@sentry/cloudflare", "@sentry/serverless", "@sentry/aws-serverless", "@sentry/bun", "@sentry/react"], py: ["sentry_sdk"], pypi: ["sentry-sdk"], hosts: [".ingest.sentry.io", ".ingest.us.sentry.io"], env: ["SENTRY_*", "*_SENTRY_*"] }),
-  p("telemetry.langsmith", "other", "saas", { npm: ["langsmith"], py: ["langsmith"], hosts: ["api.smith.langchain.com"], env: ["LANGSMITH_*", "LANGCHAIN_API_KEY", "LANGCHAIN_TRACING*", "LANGCHAIN_ENDPOINT", "LANGCHAIN_PROJECT"] }),
-  p("telemetry.langfuse", "other", "saas", { npm: ["langfuse", "@langfuse/tracing", "@langfuse/otel", "langfuse-vercel"], py: ["langfuse"], hosts: ["cloud.langfuse.com", "us.cloud.langfuse.com"], env: ["LANGFUSE_*"] }),
-  p("telemetry.posthog", "other", "saas", { npm: ["posthog-node", "posthog-js"], py: ["posthog"], hosts: [".posthog.com"], env: ["POSTHOG_*", "*_POSTHOG_*"] }),
-  p("telemetry.datadog", "other", "saas", { npm: ["dd-trace"], py: ["ddtrace", "datadog"], hosts: [".datadoghq.com", ".datadoghq.eu"], env: ["DD_API_KEY", "DD_SITE", "DATADOG_*"] }),
-  p("telemetry.braintrust", "other", "saas", { npm: ["braintrust"], py: ["braintrust"], hosts: ["api.braintrust.dev"], env: ["BRAINTRUST_*"] }),
+  p("sentry", "other", "saas", { npm: ["@sentry/node", "@sentry/nextjs", "@sentry/cloudflare", "@sentry/serverless", "@sentry/aws-serverless", "@sentry/bun", "@sentry/react"], py: ["sentry_sdk"], pypi: ["sentry-sdk"], hosts: [".ingest.sentry.io", ".ingest.us.sentry.io"], env: ["SENTRY_*", "*_SENTRY_*"] }),
+  p("langsmith", "other", "saas", { npm: ["langsmith"], py: ["langsmith"], hosts: ["api.smith.langchain.com"], env: ["LANGSMITH_*", "LANGCHAIN_API_KEY", "LANGCHAIN_TRACING*", "LANGCHAIN_ENDPOINT", "LANGCHAIN_PROJECT"] }),
+  p("langfuse", "other", "saas", { npm: ["langfuse", "@langfuse/tracing", "@langfuse/otel", "langfuse-vercel"], py: ["langfuse"], hosts: ["cloud.langfuse.com", "us.cloud.langfuse.com"], env: ["LANGFUSE_*"] }),
+  p("posthog", "other", "saas", { npm: ["posthog-node", "posthog-js"], py: ["posthog"], hosts: [".posthog.com"], env: ["POSTHOG_*", "*_POSTHOG_*"] }),
+  p("datadog", "other", "saas", { npm: ["dd-trace"], py: ["ddtrace", "datadog"], hosts: [".datadoghq.com", ".datadoghq.eu"], env: ["DD_API_KEY", "DD_SITE", "DATADOG_*"] }),
+  p("braintrust", "other", "saas", { npm: ["braintrust"], py: ["braintrust"], hosts: ["api.braintrust.dev"], env: ["BRAINTRUST_*"] }),
   p("telemetry.gcp", "other", "saas", { npm: ["@google-cloud/logging", "@google-cloud/logging-winston", "@google-cloud/monitoring", "@google-cloud/opentelemetry-cloud-trace-exporter", "@google-cloud/trace-agent"], py: ["google.cloud.logging"], pypi: ["google-cloud-logging"] }),
   p("telemetry.azure_monitor", "other", "saas", { npm: ["@azure/monitor-opentelemetry", "applicationinsights"], py: ["azure.monitor.opentelemetry", "opencensus.ext.azure"], pypi: ["azure-monitor-opentelemetry"], hosts: [".applicationinsights.azure.com", "dc.services.visualstudio.com"], env: ["APPLICATIONINSIGHTS_*"] }),
-  p("telemetry.otlp", "other", "saas", { npm: ["@opentelemetry/exporter-trace-otlp-http", "@opentelemetry/exporter-trace-otlp-proto", "@opentelemetry/exporter-trace-otlp-grpc", "@vercel/otel"], py: ["opentelemetry.exporter.otlp"], pypi: ["opentelemetry-exporter-otlp"], env: ["OTEL_EXPORTER_OTLP_*"] }),
   p("local_fs", "file", "engine", { code: [/\b(?:fs\.)?(?:writeFile|writeFileSync|appendFile|appendFileSync)\s*\(/, /\bBun\.write\s*\(/, /\bopen\([^)\n]*,\s*['"](?:w|a|wb|ab|w\+|a\+)['"]/, /\.write_(?:text|bytes)\s*\(/] })
 ];
+var SDK_DEFAULT_ENV = {
+  "npm:openai": ["OPENAI_API_KEY", "OPENAI_BASE_URL", "OPENAI_ORG_ID", "OPENAI_PROJECT_ID"],
+  "pypi:openai": ["OPENAI_API_KEY", "OPENAI_BASE_URL", "OPENAI_ORG_ID", "OPENAI_PROJECT_ID"],
+  "npm:@openai/agents": ["OPENAI_API_KEY", "OPENAI_BASE_URL", "OPENAI_DEFAULT_MODEL", "OPENAI_AGENTS_DISABLE_TRACING", "OPENAI_AGENTS_DONT_LOG_MODEL_DATA", "OPENAI_AGENTS_DONT_LOG_TOOL_DATA"],
+  "pypi:openai-agents": ["OPENAI_API_KEY", "OPENAI_BASE_URL", "OPENAI_DEFAULT_MODEL", "OPENAI_AGENTS_DISABLE_SENSITIVE_DATA", "OPENAI_AGENTS_DONT_LOG_MODEL_DATA", "OPENAI_AGENTS_DONT_LOG_TOOL_DATA"],
+  "npm:@anthropic-ai/sdk": ["ANTHROPIC_API_KEY", "ANTHROPIC_BASE_URL"],
+  "pypi:anthropic": ["ANTHROPIC_API_KEY", "ANTHROPIC_BASE_URL"],
+  "npm:@anthropic-ai/claude-agent-sdk": ["ANTHROPIC_API_KEY"],
+  "pypi:claude-agent-sdk": ["ANTHROPIC_API_KEY"],
+  "npm:@google/genai": ["GEMINI_API_KEY", "GOOGLE_API_KEY"],
+  "pypi:google-genai": ["GEMINI_API_KEY", "GOOGLE_API_KEY"],
+  "npm:groq-sdk": ["GROQ_API_KEY"],
+  "pypi:groq": ["GROQ_API_KEY"],
+  "npm:@mistralai/mistralai": ["MISTRAL_API_KEY"],
+  "pypi:mistralai": ["MISTRAL_API_KEY"],
+  "npm:cohere-ai": ["CO_API_KEY"],
+  "pypi:cohere": ["CO_API_KEY"],
+  "npm:together-ai": ["TOGETHER_API_KEY"],
+  "pypi:together": ["TOGETHER_API_KEY"],
+  "npm:replicate": ["REPLICATE_API_TOKEN"],
+  "pypi:replicate": ["REPLICATE_API_TOKEN"],
+  "npm:@pinecone-database/pinecone": ["PINECONE_API_KEY"],
+  "pypi:pinecone": ["PINECONE_API_KEY"],
+  "pypi:logfire": ["LOGFIRE_TOKEN"],
+  "npm:@pydantic/logfire-node": ["LOGFIRE_TOKEN"],
+  "npm:langsmith": ["LANGSMITH_API_KEY"],
+  "pypi:langsmith": ["LANGSMITH_API_KEY"],
+  "npm:@livekit/agents": ["LIVEKIT_URL", "LIVEKIT_API_KEY", "LIVEKIT_API_SECRET"],
+  "pypi:livekit-agents": ["LIVEKIT_URL", "LIVEKIT_API_KEY", "LIVEKIT_API_SECRET"]
+};
 var WORKERS_BINDINGS = {
   d1_databases: { capability: "database", provider: "cloudflare.d1", cls: "emulated", type: "D1" },
   kv_namespaces: { capability: "kv", provider: "cloudflare.kv", cls: "emulated", type: "KV" },
@@ -181075,8 +181135,42 @@ var CFN_RESOURCES = {
   "AWS::ElastiCache::CacheCluster": { capability: "kv", provider: "redis", cls: "engine" },
   "AWS::ElastiCache::ReplicationGroup": { capability: "kv", provider: "redis", cls: "engine" },
   "AWS::ElastiCache::ServerlessCache": { capability: "kv", provider: "redis", cls: "engine" },
-  "AWS::OpenSearchService::Domain": { capability: "search", provider: "opensearch", cls: "engine" }
+  "AWS::OpenSearchService::Domain": { capability: "search", provider: "opensearch", cls: "engine" },
+  "AWS::Cognito::UserPoolClient": { capability: "auth", provider: "aws.cognito", cls: "emulated" },
+  "AWS::Cognito::IdentityPool": { capability: "auth", provider: "aws.cognito", cls: "emulated" },
+  "AWS::Bedrock::Agent": { capability: "model.inference", provider: "aws.bedrock", cls: "model" },
+  "AWS::Bedrock::KnowledgeBase": { capability: "vector_store", provider: "aws.bedrock", cls: "none" },
+  "AWS::BedrockAgentCore::Runtime": { capability: "function.invoke", provider: "aws.bedrock_agentcore", cls: "none" },
+  "AWS::BedrockAgentCore::Gateway": { capability: "function.invoke", provider: "aws.bedrock_agentcore", cls: "none" },
+  "AWS::BedrockAgentCore::Memory": { capability: "document", provider: "aws.bedrock_agentcore", cls: "none" }
+};
+var CFN_SHORT = {
+  dynamodb: "dynamodb",
+  s3: "s3",
+  sqs: "sqs",
+  sns: "sns",
+  events: "eventbridge",
+  kinesis: "kinesis",
+  stepfunctions: "stepfunctions",
+  cognito: "cognito",
+  secretsmanager: "secretsmanager",
+  ssm: "ssm",
+  elasticache: "elasticache",
+  opensearchservice: "opensearch",
+  rds: "rds"
 };
+function cfnBindingType(type) {
+  const [, service = "", resource = ""] = type.split("::");
+  if (type === "AWS::Serverless::SimpleTable")
+    return "dynamodb";
+  if (type === "AWS::Serverless::StateMachine")
+    return "stepfunctions";
+  const svc = service.toLowerCase();
+  if (svc === "bedrock" || svc === "bedrockagentcore") {
+    return `${svc === "bedrock" ? "bedrock" : "agentcore"}_${resource.replace(/([a-z])([A-Z])/g, "$1_$2").toLowerCase()}`;
+  }
+  return CFN_SHORT[svc] ?? svc;
+}
 function rdsEngineProvider(engine) {
   const e = (engine ?? "").toLowerCase();
   if (e.includes("postgres"))
@@ -181573,6 +181667,9 @@ function scanSources(ctx, declaredPypi, workspaceNames) {
       evidence: evidence.slice(0, 3)
     };
     ctx.gaps.push(gap);
+    if (evidence.some((e) => !isTestPath(e.path))) {
+      ctx.signals.push({ kind: "code", capability: "http.request", provider: "http", host: undefined, evidence: evidence[0] });
+    }
   }
   return { frameworks };
 }
@@ -181597,6 +181694,7 @@ var CODE_ENV_RES = [
   /\bos\.environ\[\s*['"]([A-Za-z_][A-Za-z0-9_]*)['"]\s*\]/g,
   /\bos\.environ\.get\(\s*['"]([A-Za-z_][A-Za-z0-9_]*)['"]/g,
   /\bos\.getenv\(\s*['"]([A-Za-z_][A-Za-z0-9_]*)['"]/g,
+  /['"]([A-Z_][A-Z0-9_]*)['"]\s+(?:not\s+)?in\s+os\.environ\b/g,
   /\bos\.Getenv\(\s*"([A-Za-z_][A-Za-z0-9_]*)"/g,
   /\bos\.LookupEnv\(\s*"([A-Za-z_][A-Za-z0-9_]*)"/g,
   /\bENV\[\s*['"]([A-Za-z_][A-Za-z0-9_]*)['"]\s*\]/g,
@@ -181604,11 +181702,15 @@ var CODE_ENV_RES = [
   /\benv\.(?:str|int|bool|url|db|list|float|json)\(\s*['"]([A-Z_][A-Z0-9_]*)['"]/g,
   /\bconfig\(\s*['"]([A-Z_][A-Z0-9_]*)['"]/g
 ];
-var ENV_EXAMPLE_FILE = /^(?:\.env\.(?:example|sample|template|dist|defaults|local\.example|development\.example)|\.env-(?:example|sample)|example\.env|sample\.env|env\.example|\.dev\.vars\.example|\.dev\.vars\.sample)$/;
+var ENV_EXAMPLE_FILE = /^(?:\.env\.(?:example|sample|template|dist|defaults?|local\.example|development\.example)|\.env-(?:example|sample)|example\.env|sample\.env|env\.example|\.dev\.vars\.example|\.dev\.vars\.sample)$/;
 var ENV_SECRET_FILE = /^(?:\.env(?:\.[\w.-]+)?|\.dev\.vars)$/;
 function isEnvExampleFile(path) {
   return ENV_EXAMPLE_FILE.test(basename2(path));
 }
+function isEnvFile(path) {
+  const name = basename2(path);
+  return (ENV_EXAMPLE_FILE.test(name) || ENV_SECRET_FILE.test(name)) && !/\.test\b/.test(name);
+}
 function scanEnv(ctx) {
   for (const file of ctx.files) {
     const name = basename2(file.path);
@@ -181634,6 +181736,8 @@ function scanEnv(ctx) {
       continue;
     const at = lineIndex(file.text);
     const lines = splitLines(file.text);
+    if (file.path.endsWith(".py") && /\bBaseSettings\b/.test(file.text))
+      settingsFields(ctx, file.path, lines);
     const seen = new Set;
     for (const re of CODE_ENV_RES) {
       re.lastIndex = 0;
@@ -181655,6 +181759,63 @@ function scanEnv(ctx) {
     }
   }
 }
+function sdkDefaultEnv(ctx, declared) {
+  const seen = new Set;
+  for (const d of declared) {
+    const file = ctx.byPath.get(d.path);
+    if (d.dev || file?.isTest)
+      continue;
+    const key = `${d.eco}:${d.eco === "pypi" ? d.name.toLowerCase().replace(/[_.]/g, "-") : d.name}`;
+    for (const name of SDK_DEFAULT_ENV[key] ?? []) {
+      if (seen.has(`${name}:${d.path}`))
+        continue;
+      seen.add(`${name}:${d.path}`);
+      const line = d.line ?? 1;
+      ctx.env.push({
+        name,
+        source: `${d.path}:${line}`,
+        evidence: { path: d.path, line, excerpt: excerpt(file ? splitLines(file.text)[line - 1] : undefined), detector: `${DETECTOR2}.sdk_default` }
+      });
+    }
+  }
+}
+function settingsFields(ctx, path, lines) {
+  const settings = new Map([["BaseSettings", ""]]);
+  for (let i = 0;i < lines.length; i++) {
+    const cls = /^class\s+(\w+)\s*\(([^)]*)\)/.exec(lines[i]);
+    const base = cls?.[2].split(",").map((b) => b.trim().split(".").pop() ?? "").find((b) => settings.has(b));
+    if (!cls || base === undefined)
+      continue;
+    const body = [];
+    let prefix = settings.get(base) ?? "";
+    let docstring = false;
+    for (let j = i + 1;j < lines.length; j++) {
+      const line = lines[j];
+      if (line.trim() !== "" && !/^\s/.test(line))
+        break;
+      const quotes = (line.match(/"""|'''/g) ?? []).length;
+      if (docstring || quotes > 0) {
+        if (quotes % 2 === 1)
+          docstring = !docstring;
+        continue;
+      }
+      const p2 = /\benv_prefix\s*=\s*['"]([^'"]*)['"]/.exec(line);
+      if (p2)
+        prefix = p2[1];
+      const m = /^ {4}([A-Za-z][A-Za-z0-9_]*)\s*:/.exec(line);
+      if (m && m[1] !== "model_config" && !isCommentLine(line))
+        body.push({ name: m[1], line: j + 1 });
+    }
+    settings.set(cls[1], prefix);
+    for (const f of body) {
+      ctx.env.push({
+        name: `${prefix}${f.name}`.toUpperCase(),
+        source: `${path}:${f.line}`,
+        evidence: { path, line: f.line, excerpt: excerpt(lines[f.line - 1]), detector: `${DETECTOR2}.settings` }
+      });
+    }
+  }
+}
 var GENERIC_DB_URL = /^(?:[A-Z0-9]+_)*(?:DATABASE|DB)_(?:URL|URI|DSN|CONNECTION(?:_STRING)?)(?:_[A-Z0-9]+)*$|^SQLALCHEMY_DATABASE_UR[IL]$|^(?:DATABASE|DB)$/;
 function isGenericDatabaseUrl(name) {
   return GENERIC_DB_URL.test(name);
@@ -181689,6 +181850,8 @@ function envSignals(ctx) {
     }
     if (resolved)
       continue;
+    if (/(?:^|_)(?:USE|ENABLE|ENABLED)(?:_|$)/.test(obs.name) && obs.value !== undefined && /^(?:false|0|no|off)$/i.test(obs.value.trim()))
+      continue;
     const sig = matchEnvName(obs.name);
     if (sig) {
       ctx.signals.push({ kind: "env", capability: sig.capability, provider: sig.provider, envVar: obs.name, evidence: ev, weak: isTestPath(ev.path) });
@@ -181698,14 +181861,18 @@ function envSignals(ctx) {
 var SECRET_NAME = /(?:^|_)(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD|PWD|PASS|CREDENTIALS?|PRIVATE|AUTH|SIGNING|SALT|CERT|DSN)(?:_|$)|APIKEY|_PAT$/;
 var ENDPOINT_NAME = /(?:^|_)(?:URL|URI|ENDPOINT|HOST|HOSTNAME|BASE|BASE_URL|ADDR|ADDRESS|PORT|DSN|CONNECTION(?:_STRING)?|SERVER|REGION|BUCKET|TABLE|QUEUE|TOPIC|DATABASE|DB|INDEX|NAMESPACE|PROJECT_ID|ACCOUNT_ID)(?:_|$)/;
 var SELF_CONFIG = /^(?:NODE_ENV|ENV|ENVIRONMENT|APP_ENV|DEBUG|LOG_LEVEL|LOGLEVEL|PORT|HOST|HOSTNAME|TZ|PYTHONPATH|PYTHONUNBUFFERED|PATH|HOME|CI|VERCEL_ENV|VERCEL_URL|NEXT_PUBLIC_APP_URL|APP_URL|SITE_URL|PUBLIC_URL|BASE_URL|NEXTAUTH_URL|AUTH_URL|DJANGO_SETTINGS_MODULE|FLASK_APP|FLASK_ENV|WORKERS|WEB_CONCURRENCY|ALLOWED_HOSTS|DJANGO_ALLOWED_HOSTS|CORS_ORIGINS?)$/;
+var PUBLIC_NAME = /^(?:NEXT_PUBLIC_|VITE_|PUBLIC_|EXPO_PUBLIC_|REACT_APP_|NUXT_PUBLIC_|GATSBY_)|(?:^|_)(?:PUBLISHABLE|ANON)_KEY$/;
+var CREDENTIAL_SETTING = /^(?:ENABLE|ENABLED|ALLOW|DISABLE|USE|MIN|MAX)_|_(?:LENGTH|EXPIRY|EXPIRES_IN|INTERVAL|INTERVAL_\w+|SECONDS|SECS|HOURS|MINUTES|MS|TTL|MAX|WINDOW|PREFIX|PREFIX_VAR|KIND|PATH|FORMAT|PROVIDER|DURATION|VIOLATIONS|COUNT|LIMIT)$/;
 function classifyName(name) {
-  if (SELF_CONFIG.test(name))
+  if (SELF_CONFIG.test(name) || PUBLIC_NAME.test(name))
     return "config";
   if (SECRET_NAME.test(name))
     return "secret";
   return "unknown";
 }
 function classifyLinked(name, deps) {
+  if (PUBLIC_NAME.test(name))
+    return "config";
   const isModel = deps.some((d) => d.capability === "model.inference");
   const secret = SECRET_NAME.test(name) && !/(?:^|_)(?:URL|URI|HOST|ENDPOINT)$/.test(name);
   if (isModel) {
@@ -181721,6 +181888,21 @@ function classifyLinked(name, deps) {
     return "dependency_endpoint";
   return "config";
 }
+var AMBIENT_ENV = /^(?:PATH|HOME|USER|LOGNAME|SHELL|PWD|OLDPWD|TERM|LANG|LANGUAGE|LC_\w+|TMPDIR|TEMP|TMP|EDITOR|PAGER|LD_PRELOAD|LD_LIBRARY_PATH|PYTHONDONTWRITEBYTECODE|PYTHONASYNCIODEBUG|PYTHONHASHSEED|PYTHONFAULTHANDLER|NX_\w+|APPDATA|LOCALAPPDATA|PROGRAMDATA|USERPROFILE|COMSPEC|SYSTEMROOT|WINDIR|COLORTERM|COLORFGBG|NO_COLOR|FORCE_COLOR|TERM_PROGRAM|DEBIAN_FRONTEND|BUILDPLATFORM|TARGETPLATFORM|TARGETOS|TARGETARCH|TARGETVARIANT|BUILDOS|BUILDARCH|BUILDKIT_\w+|DOCKER_BUILDKIT|DOCKER_METADATA_\w+|GITHUB_(?:ACTIONS|WORKSPACE|SHA|REF|REF_NAME|REF_TYPE|HEAD_REF|BASE_REF|RUN_ID|RUN_NUMBER|RUN_ATTEMPT|REPOSITORY|REPOSITORY_OWNER|EVENT_NAME|EVENT_PATH|ENV|OUTPUT|STEP_SUMMARY|PATH|JOB|ACTOR|SERVER_URL|API_URL|GRAPHQL_URL|WORKFLOW|ACTION|ACTION_PATH|RETENTION_DAYS)|RUNNER_\w+|ACTIONS_\w+|CARGO_\w+|RUSTFLAGS|BASH_\w+|BASH|ZSH_\w+|CONDA_\w+|VIRTUAL_ENV|PYENV_\w+|NVM_\w+|npm_\w+|CODECOV_TOKEN|DOCKERHUB_\w+|UV_\w+|PIP_\w+|POETRY_\w+|CMAKE_\w+|CC|CXX|CFLAGS|CXXFLAGS|LDFLAGS|MAKEFLAGS|ANDROID_\w+|XDG_\w+|SSH_\w+|DISPLAY|SHLVL|_)$/;
+var TOOLING_SOURCE = /(^|\/)(\.github|\.gitlab|\.circleci|\.buildkite|ci|\.devcontainer)\/|(^|\/)(Makefile|GNUmakefile|CMakeLists\.txt|Justfile|Jenkinsfile)$|(^|\/)(?:jest|vitest|playwright|karma|cypress)\.config\.[cm]?[jt]s$|\.(cmake|mk|bat|ps1)$/;
+function isRuntimeEnvSource(source) {
+  if (/ ARG$/.test(source))
+    return false;
+  const path = source.split(/[: ]/)[0];
+  if (TOOLING_SOURCE.test(path))
+    return false;
+  if (!/[/.]/.test(path))
+    return true;
+  return !isTestPath(path);
+}
+function isAmbientEnv(name) {
+  return AMBIENT_ENV.test(name);
+}
 function buildEnvReferences(ctx, deps) {
   const byName = new Map;
   for (const ref of ctx.manifest?.env ?? []) {
@@ -181747,12 +181929,16 @@ function buildEnvReferences(ctx, deps) {
     const entry = byName.get(name);
     const linked = depsByEnv.get(name) ?? [];
     let classification;
-    if (linked.length > 0)
+    if (PUBLIC_NAME.test(name))
+      classification = "config";
+    else if (linked.length > 0)
       classification = classifyLinked(name, linked);
     else if (entry.manifest && entry.manifest.classification !== "unknown")
       classification = entry.manifest.classification;
     else
       classification = classifyName(name);
+    if (classification === "secret" && CREDENTIAL_SETTING.test(name))
+      classification = "config";
     const ref = {
       name,
       sources: uniqSorted(entry.sources).slice(0, 20),
@@ -182107,6 +182293,9 @@ function detectMigrations(ctx) {
           if (env)
             ctx.envLinks.push({ envVar: env, capability: providerName === "mongodb" ? "document" : "database", provider: providerName, evidence });
       }
+      if (/\bextensions\s*=\s*\[[^\]]*\b(?:pgvector|vector)\b/.test(file.text)) {
+        ctx.signals.push({ kind: "config", capability: "vector_store", provider: "pgvector", evidence: evidenceAt(file.path, file.text, findLine(file.text, /\bextensions\s*=/), `${DETECTOR3}.prisma`) });
+      }
       continue;
     }
     if (/^drizzle\.config\.(ts|js|mjs|cjs|json)$/.test(name)) {
@@ -182119,10 +182308,21 @@ function detectMigrations(ctx) {
       b.schemaFiles.add(file.path);
       for (const s of schemas) {
         const p2 = joinPath(dir, s);
-        if (ctx.byPath.has(p2) || ctx.files.some((f) => isUnder(f.path, p2)))
+        if (/[*?]/.test(s)) {
+          const re = globRegex(p2);
+          for (const f of ctx.files)
+            if (re.test(f.path))
+              b.schemaFiles.add(f.path);
+        } else if (ctx.byPath.has(p2) || ctx.files.some((f) => isUnder(f.path, p2)))
           b.schemaFiles.add(p2);
       }
-      const outDir = joinPath(dir, out2);
+      let outDir = joinPath(dir, out2);
+      if (!ctx.files.some((f) => isUnder(f.path, outDir))) {
+        const nestedRoots = ctx.files.filter((f) => /^(?:package\.json|pyproject\.toml|go\.mod)$/.test(basename2(f.path)) && dirname2(f.path) !== dir && isUnder(f.path, dir)).map((f) => dirname2(f.path));
+        const sql = ctx.files.find((f) => isUnder(f.path, dir) && /(^|\/)migrations?\/[^/]+\.(?:sql|[cm]?[jt]s)$/.test(f.path) && !isTestPath(f.path) && !nestedRoots.some((r) => isUnder(f.path, r)));
+        if (sql)
+          outDir = dirname2(sql.path);
+      }
       if (ctx.files.some((f) => isUnder(f.path, outDir))) {
         b.paths.add(outDir);
         claimDir(outDir);
@@ -182276,13 +182476,50 @@ function detectMigrations(ctx) {
         b.paths.add(dir);
     }
   }
+  for (const f of ctx.files) {
+    if (!/^wrangler\.(?:toml|jsonc?)$/.test(basename2(f.path)) || !/new_sqlite_classes/.test(f.text) || isTestPath(f.path))
+      continue;
+    ctx.gaps.push({
+      kind: "durable_object_migrations",
+      message: `${f.path} declares SQLite-backed Durable Object migrations; the workerd runtime adapter applies them`,
+      evidence: [{ path: f.path, line: findLine(f.text, /new_sqlite_classes/), detector: DETECTOR3 }]
+    });
+  }
+  const all = [...sets.values()];
+  for (const b of all) {
+    if (b.tool !== "raw_sql" || b.paths.size > 0)
+      continue;
+    const parent = [...b.schemaFiles].map(dirname2)[0];
+    const sibling = all.find((o) => o !== b && o.tool === "raw_sql" && [...o.paths].some((p2) => isUnder(p2, parent ?? "\x00")));
+    if (sibling) {
+      for (const f of b.schemaFiles)
+        sibling.schemaFiles.add(f);
+      sibling.first = [...sibling.first ?? [], ...uniqSorted(b.schemaFiles)];
+      if (sibling.engine === "unknown")
+        sibling.engine = b.engine;
+      b.schemaFiles.clear();
+    }
+  }
   const out = [];
+  const testOnly = (p2) => isTestPath(p2) || /(^|\/)(?:conformance|e2e|[\w-]+-tests?|tests?-[\w-]+|e2e-[\w-]+)\//.test(p2);
   for (const b of [...sets.values()].sort((x, y) => cmp(`${x.tool}:${x.key}`, `${y.tool}:${y.key}`))) {
+    if (b.tool === "django" && b.paths.size === 0)
+      continue;
     if (b.paths.size === 0 && b.schemaFiles.size === 0)
       continue;
-    if (b.tool === "django" && b.paths.size === 0)
+    if ([...b.paths, ...b.schemaFiles].every(testOnly))
       continue;
-    out.push({ engine: b.engine, tool: b.tool, paths: uniqSorted(b.paths), schemaFiles: uniqSorted(b.schemaFiles) });
+    if (b.paths.size === 0) {
+      for (const f of b.schemaFiles)
+        b.paths.add(f);
+      ctx.gaps.push({
+        kind: "migration_schema_only",
+        message: `${b.tool} has no migration files at ${[...b.schemaFiles][0]}; the schema is applied directly`,
+        evidence: [...b.schemaFiles].slice(0, 1).map((path) => ({ path, detector: DETECTOR3 }))
+      });
+    }
+    const first = b.first ?? [];
+    out.push({ engine: b.engine, tool: b.tool, paths: [...first, ...uniqSorted(b.paths).filter((x) => !first.includes(x))], schemaFiles: uniqSorted(b.schemaFiles) });
   }
   return out;
 }
@@ -183290,6 +183527,19 @@ function fromPyproject(f, out) {
   for (const req of asArray(uv["dev-dependencies"]))
     if (typeof req === "string")
       add(req, true);
+  const hatch = isRecord2(tool.hatch) && isRecord2(tool.hatch.metadata) && isRecord2(tool.hatch.metadata.hooks) ? tool.hatch.metadata.hooks : {};
+  for (const hook of Object.values(hatch)) {
+    if (!isRecord2(hook))
+      continue;
+    for (const req of asArray(hook.dependencies))
+      if (typeof req === "string")
+        add(req, false);
+    const extra = isRecord2(hook["optional-dependencies"]) ? hook["optional-dependencies"] : {};
+    for (const [group, reqs] of Object.entries(extra))
+      for (const req of asArray(reqs))
+        if (typeof req === "string")
+          add(req, /dev|test|lint|doc/i.test(group));
+  }
 }
 function fromPipfile(f, out) {
   let doc;
@@ -183553,7 +183803,7 @@ function cfnResources(ctx, resources, file, runtime) {
     if (!spec)
       continue;
     const resource = asString(props.TableName) ?? asString(props.BucketName) ?? asString(props.QueueName) ?? asString(props.TopicName) ?? asString(props.Name) ?? asString(props.StateMachineName) ?? logicalId;
-    runtime.bindings.push({ name: logicalId, type, resource });
+    runtime.bindings.push({ name: logicalId, type: cfnBindingType(type), resource });
     bindingSignal(ctx, { ...spec, binding: logicalId, resource, evidence: ev(file, logicalId) });
   }
 }
@@ -183603,6 +183853,30 @@ function detectSam(ctx, file, doc) {
     envFromVariables(ctx, isRecord2(props.Environment) ? props.Environment.Variables : undefined, file, logicalId);
   }
   cfnResources(ctx, resources, file, runtime);
+  const ids = Object.keys(resources);
+  const direct = (text, self) => ids.filter((id) => id !== self && new RegExp(`\\b${escapeRe(id)}\\b`).test(text));
+  const globalsText = JSON.stringify(isRecord2(doc.Globals) && isRecord2(doc.Globals.Function) ? doc.Globals.Function : {});
+  const refs = new Map;
+  for (const [fnId, res] of Object.entries(resources)) {
+    if (!isRecord2(res) || !/^AWS::(?:Serverless|Lambda)::Function$/.test(asString(res.Type) ?? ""))
+      continue;
+    const seen = new Set(direct(`${JSON.stringify(res.Properties ?? {})} ${globalsText}`, fnId));
+    const queue = [...seen];
+    while (queue.length > 0) {
+      const id = queue.shift();
+      const other = resources[id];
+      if (!isRecord2(other) || /^AWS::(?:Serverless|Lambda)::Function$/.test(asString(other.Type) ?? ""))
+        continue;
+      for (const next of direct(JSON.stringify(other.Properties ?? {}), id)) {
+        if (next !== fnId && !seen.has(next)) {
+          seen.add(next);
+          queue.push(next);
+        }
+      }
+    }
+    refs.set(fnId, seen);
+  }
+  ctx.functionRefs.set(file.path, refs);
   if (runtime.entrypoints.length === 0)
     return;
   return runtime;
@@ -183666,6 +183940,17 @@ var CDK_RESOURCE_TYPES = {
   StateMachine: "AWS::StepFunctions::StateMachine",
   UserPool: "AWS::Cognito::UserPool"
 };
+function cdkTrigger(text, variable) {
+  const v = `(?:this\\.|self\\.)?${escapeRe(variable)}\\b`;
+  const re = (pattern) => new RegExp(pattern);
+  if (re(`LambdaIntegration\\(\\s*(?:['"][^'"]*['"]\\s*,\\s*)?${v}`).test(text) || re(`LambdaRestApi\\([^)]*?handler\\s*[:=]\\s*${v}`).test(text) || re(`${v}\\s*\\.\\s*(?:addFunctionUrl|add_function_url)\\(`).test(text) || re(`FunctionUrl\\([^)]*?function\\s*[:=]\\s*${v}`).test(text))
+    return "http";
+  if (re(`${v}\\s*\\.\\s*(?:addEventSource|add_event_source)\\(\\s*(?:new\\s+)?(?:\\w+\\.)?SqsEventSource`).test(text))
+    return "queue";
+  if (re(`Schedule\\.[\\s\\S]{0,400}LambdaFunction\\(\\s*${v}`).test(text))
+    return "cron";
+  return "event";
+}
 function detectCdk(ctx, cdkJson) {
   const root = dirname2(cdkJson.path);
   const runtime = newRuntime("aws_lambda", root, [cdkJson.path], [{ path: cdkJson.path, detector: `${DETECTOR4}.cdk` }], 0.8);
@@ -183691,7 +183976,8 @@ function detectCdk(ctx, cdkJson) {
         runtime.runtimeVersion = lang.version;
       }
       const handlerRef = entry ? joinPath(root, entry) + (handler ? `#${handler}` : "") : asset ? `${joinPath(root, asset)}/${handler ?? ""}` : handler;
-      runtime.entrypoints.push({ name: id, handler: handlerRef, trigger: "event" });
+      const variable = /(?:\b|\.)(\w+)\s*=\s*$/.exec(file.text.slice(Math.max(0, m.index - 120), m.index))?.[1];
+      runtime.entrypoints.push({ name: id, handler: handlerRef, trigger: variable ? cdkTrigger(file.text, variable) : "event" });
       runtime.evidence.push({ path: file.path, line: at(m.index), excerpt: excerpt(splitLines(file.text)[at(m.index) - 1]), detector: `${DETECTOR4}.cdk:${construct}` });
     }
     CDK_RESOURCE.lastIndex = 0;
@@ -183703,12 +183989,12 @@ function detectCdk(ctx, cdkJson) {
       const type = CDK_RESOURCE_TYPES[kind];
       if (type) {
         const spec = CFN_RESOURCES[type];
-        runtime.bindings.push({ name: id, type });
+        runtime.bindings.push({ name: id, type: cfnBindingType(type) });
         bindingSignal(ctx, { ...spec, binding: id, evidence });
       } else if (kind === "DatabaseInstance" || kind === "DatabaseCluster") {
         const engine = /DatabaseInstanceEngine\.(\w+)|DatabaseClusterEngine\.(\w+)/.exec(file.text.slice(m.index, m.index + 800));
         const provider = rdsEngineProvider(engine?.[1] ?? engine?.[2]);
-        runtime.bindings.push({ name: id, type: `AWS::RDS::${kind.replace("Database", "DB")}` });
+        runtime.bindings.push({ name: id, type: "rds" });
         bindingSignal(ctx, { capability: "database", provider, cls: "engine", binding: id, evidence });
       }
     }
@@ -183842,7 +184128,10 @@ function detectCloudflare(input) {
       if (seen.has(key))
         return false;
       seen.add(key);
-      runtime.bindings.push(resource ? { name, type, resource } : { name, type });
+      if (type === "QueueConsumer")
+        return true;
+      const normalized = type.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase();
+      runtime.bindings.push(resource ? { name, type: normalized, resource } : { name, type: normalized });
       return true;
     };
     const produced = new Set(sections(config).flatMap((section) => asArray(isRecord2(section.queues) ? section.queues.producers : undefined).map((p2) => isRecord2(p2) ? asString(p2.queue) : undefined)));
@@ -183915,7 +184204,9 @@ function detectCloudflare(input) {
         const script = asString(item.script_name);
         if (!addBinding(name, "DurableObject", className))
           continue;
-        if (script && !workerNames.has(script)) {
+        if (!script || workerNames.has(script)) {
+          bindingSignal(ctx, { capability: "document", provider: "cloudflare.durable_objects", cls: "emulated", binding: name, resource: className, evidence: ev2(file, name) });
+        } else {
           bindingSignal(ctx, { capability: "function.invoke", provider: "cloudflare.durable_object", cls: "saas", binding: name, resource: className, evidence: ev2(file, name) });
           ctx.gaps.push({ kind: "external_service_binding", message: `Durable Object ${name} lives in worker \`${script}\`, which is not in the bundle`, evidence: [ev2(file, name)] });
         }
@@ -183961,6 +184252,21 @@ var DETECTOR6 = "runtime.container";
 var DOCKERFILE = /^(?:Dockerfile|Containerfile)(?:\.[\w.-]+)?$|\.(?:Dockerfile|dockerfile)$/;
 var COMPOSE = /^(?:docker-)?compose(?:\.[\w-]+)*\.ya?ml$/;
 var INFRA_IMAGES = /^(?:nginx|traefik|caddy|haproxy|envoyproxy\/envoy|busybox|alpine|ubuntu|debian|node|python|golang|grafana\/.*|prom\/.*|otel\/.*|jaegertracing\/.*|adminer|dpage\/pgadmin4|portainer\/.*|.*\/?(?:loki|promtail|tempo))$/;
+var PROJECT_MANIFEST = /^(?:package\.json|pyproject\.toml|requirements\.txt|setup\.py|go\.mod|Gemfile|Cargo\.toml|pom\.xml|build\.gradle(?:\.kts)?)$/;
+function buildContext(ctx, dir, copies) {
+  if (copies.length === 0 || ctx.files.some((f) => dirname2(f.path) === dir && PROJECT_MANIFEST.test(basename2(f.path))))
+    return dir;
+  const has = (base, src) => {
+    const p2 = joinPath(base, src);
+    return ctx.byPath.has(p2) || ctx.files.some((f) => f.path.startsWith(`${p2}/`));
+  };
+  for (let base = dir;; base = dirname2(base)) {
+    if (copies.every((src) => has(base, src)))
+      return base;
+    if (base === ".")
+      return dir;
+  }
+}
 function parseInstructionArgs(rest) {
   const t = rest.trim();
   if (t.startsWith("[")) {
@@ -183973,7 +184279,7 @@ function parseInstructionArgs(rest) {
   return ["sh", "-c", t];
 }
 function parseDockerfile(file) {
-  const out = { path: file.path, from: [], expose: [], env: [], args: [], stages: {} };
+  const out = { path: file.path, from: [], expose: [], env: [], args: [], copies: [], stages: {} };
   const raw = splitLines(file.text);
   const stages = new Map;
   let stage = { base: "", expose: [], env: [] };
@@ -184018,6 +184324,11 @@ function parseDockerfile(file) {
       for (const [name, value] of pairs)
         if (name)
           stage.env.push({ name, value, line: startLine });
+    } else if ((instr === "COPY" || instr === "ADD") && !/--from=/.test(rest)) {
+      const parts = rest.trim().startsWith("[") ? parseInstructionArgs(rest) : rest.split(/\s+/).filter((w) => !w.startsWith("--"));
+      for (const src of parts.slice(0, -1))
+        if (src && !/^https?:/.test(src) && !/[*?$]/.test(src) && src !== "." && src !== "./")
+          out.copies.push(src.replace(/^\.\//, "").replace(/\/$/, ""));
     } else if (instr === "ARG") {
       const name = rest.split("=")[0].trim();
       if (name)
@@ -184051,7 +184362,7 @@ function detectContainers(input) {
       continue;
     const df = parseDockerfile(file);
     dockerfiles.push(df);
-    const root = dirname2(file.path);
+    const root = buildContext(ctx, dirname2(file.path), df.copies);
     const base = df.from[df.from.length - 1] ?? "";
     const lambda = /^(?:public\.ecr\.aws\/lambda\/|amazon\/aws-lambda-)/.test(base);
     const kind = lambda ? "aws_lambda" : "container";
@@ -184136,12 +184447,16 @@ function composeServices(ctx, file, byRoot, contributions, relocated) {
     const ports = asArray(svc.ports);
     const svcEntrypoint = composeArgs(svc.entrypoint);
     const svcCommand = composeArgs(svc.command);
-    const serviceRoot = build !== undefined ? joinPath(base, typeof build === "string" ? build : isRecord2(build) ? asString(build.context) ?? "." : ".") : undefined;
+    let serviceRoot = build !== undefined ? joinPath(base, typeof build === "string" ? build : isRecord2(build) ? asString(build.context) ?? "." : ".") : undefined;
     if (build !== undefined) {
       const context = typeof build === "string" ? build : isRecord2(build) ? asString(build.context) ?? "." : ".";
-      const root = joinPath(base, context);
+      const contextRoot = joinPath(base, context);
+      const dockerfile = joinPath(contextRoot, (isRecord2(build) ? asString(build.dockerfile) : undefined) ?? "Dockerfile");
+      const dfDir = dirname2(dockerfile);
+      const projectDir = dfDir !== contextRoot && isUnder(dfDir, contextRoot) && ctx.files.some((f) => dirname2(f.path) === dfDir && PROJECT_MANIFEST.test(basename2(f.path)));
+      const root = projectDir ? dfDir : contextRoot;
+      serviceRoot = root;
       const key = `container:${root}`;
-      const dockerfile = joinPath(root, (isRecord2(build) ? asString(build.dockerfile) : undefined) ?? "Dockerfile");
       const contribution = contributions.get(dockerfile);
       const runtime = byRoot.get(key) ?? newRuntime("container", root, [], [], 0.85);
       runtime.configFiles.push(file.path);
@@ -184178,28 +184493,11 @@ function composeServices(ctx, file, byRoot, contributions, relocated) {
       if (sig) {
         ctx.signals.push({ kind: "image", capability: sig.capability, provider: sig.provider, resource: name, evidence });
       } else if (!INFRA_IMAGES.test(image.split(":")[0])) {
-        if (svcEntrypoint || svcCommand || ports.length > 0) {
-          const key = `container:${base}`;
-          const runtime = byRoot.get(key) ?? newRuntime("container", base, [], [], 0.75);
-          runtime.configFiles.push(file.path);
-          runtime.evidence.push(evidence);
-          if (!runtime.entrypoints.some((e) => e.name === name)) {
-            const entry = { name, handler: image, trigger: ports.length > 0 ? "http" : "unknown" };
-            if (svcEntrypoint)
-              entry.command = [...svcEntrypoint, ...svcCommand ?? []];
-            else if (svcCommand) {
-              ctx.gaps.push({
-                kind: "unresolved_command",
-                message: `Compose service \`${name}\` overrides the CMD of image \`${image}\`, whose ENTRYPOINT is not in the bundle; the full launch command is unknown`,
-                evidence: [evidence]
-              });
-            }
-            runtime.entrypoints.push(entry);
-          }
-          byRoot.set(key, runtime);
-        } else {
-          ctx.gaps.push({ kind: "unrecognized_service", message: `Compose service \`${name}\` uses image \`${image}\`, which maps to no known provider`, evidence: [evidence] });
-        }
+        ctx.gaps.push({
+          kind: "unrecognized_service",
+          message: `Compose service \`${name}\` runs prebuilt image \`${image}\`, which maps to no known provider; treated as a sidecar, not a harness entrypoint`,
+          evidence: [evidence]
+        });
       }
     }
     const env = svc.environment;
@@ -184223,7 +184521,8 @@ function composeServices(ctx, file, byRoot, contributions, relocated) {
         source: `${file.path} services.${name}.environment`,
         value: literal,
         evidence: { path: file.path, line: l, excerpt: l ? excerpt(lines[l - 1]) : undefined, detector: `${DETECTOR6}.compose` },
-        scopeRoot: serviceRoot
+        scopeRoot: serviceRoot,
+        service: name
       });
     }
   }
@@ -184246,14 +184545,21 @@ var ROOT_MARKERS = new Set([
   "host.json",
   "deno.json",
   "deno.jsonc",
-  "Cargo.toml"
+  "Cargo.toml",
+  "project.json"
 ]);
 function projectRoots(files) {
-  const out = new Set;
-  for (const f of files)
-    if (ROOT_MARKERS.has(basename2(f.path)))
-      out.add(dirname2(f.path));
-  return [...out].sort();
+  const markers = new Map;
+  for (const f of files) {
+    if (!ROOT_MARKERS.has(basename2(f.path)))
+      continue;
+    const dir = dirname2(f.path);
+    if (!markers.has(dir))
+      markers.set(dir, new Set);
+    markers.get(dir).add(basename2(f.path));
+  }
+  const pyProjects = [...markers.entries()].filter(([, m]) => m.has("pyproject.toml") || m.has("setup.py")).map(([d]) => d);
+  return [...markers.entries()].filter(([dir, m]) => !(m.size === 1 && m.has("requirements.txt") && pyProjects.some((p2) => p2 !== dir && isUnder(dir, p2)))).map(([dir]) => dir).sort();
 }
 function nearestRoot(path, roots) {
   let best;
@@ -184291,6 +184597,15 @@ function cloudRunMarkers(ctx) {
       out.push({ root: dirname2(file.path), path: file.path, line: findLine(file.text, /serving\.knative\.dev/) });
       continue;
     }
+    if (name.endsWith(".tf")) {
+      const services = (file.text.match(/resource\s+"google_cloud_run(?:_v2)?_service"/g) ?? []).length;
+      if (services > 0) {
+        const dir = dirname2(file.path);
+        const root = /^(?:terraform|infra|infrastructure|deploy|deployment)$/.test(basename2(dir)) ? dirname2(dir) : dir;
+        out.push({ root, path: file.path, line: findLine(file.text, /google_cloud_run/), services });
+      }
+      continue;
+    }
     const re = /gcloud\s+(?:beta\s+)?run\s+(?:deploy|services\s+replace)\b([^\n]*)/g;
     let m;
     while ((m = re.exec(file.text)) !== null) {
@@ -184495,76 +184810,72 @@ function decoratedDefs(text, decorator) {
 // ../../packages/harness-bundle/src/detect/runtimes/azure.ts
 var DETECTOR8 = "runtime.azure";
 var BINDINGS = {
-  httpTrigger: { trigger: "http" },
-  timerTrigger: { trigger: "cron" },
-  queueTrigger: { trigger: "queue", dep: { capability: "queue", provider: "azure.queue", cls: "emulated" } },
-  queue: { dep: { capability: "queue", provider: "azure.queue", cls: "emulated" } },
-  blobTrigger: { trigger: "event", dep: { capability: "object_store", provider: "azure.blob", cls: "emulated" } },
-  blob: { dep: { capability: "object_store", provider: "azure.blob", cls: "emulated" } },
+  http: { trigger: "http" },
+  timer: { trigger: "cron" },
+  queue: { trigger: "queue", dep: { capability: "queue", provider: "azure.queue", cls: "emulated" } },
+  blob: { trigger: "event", dep: { capability: "object_store", provider: "azure.blob", cls: "emulated" } },
   table: { dep: { capability: "document", provider: "azure.table", cls: "emulated" } },
-  cosmosDBTrigger: { trigger: "event", dep: { capability: "document", provider: "azure.cosmos", cls: "emulated" } },
-  cosmosDB: { dep: { capability: "document", provider: "azure.cosmos", cls: "emulated" } },
-  serviceBusTrigger: { trigger: "queue", dep: { capability: "queue", provider: "azure.servicebus", cls: "emulated" } },
-  serviceBus: { dep: { capability: "queue", provider: "azure.servicebus", cls: "emulated" } },
-  eventHubTrigger: { trigger: "queue", dep: { capability: "queue", provider: "azure.eventhubs", cls: "emulated" } },
-  eventHub: { dep: { capability: "queue", provider: "azure.eventhubs", cls: "emulated" } },
-  eventGridTrigger: { trigger: "event" },
-  eventGrid: { dep: { capability: "queue", provider: "azure.eventgrid", cls: "saas" } },
-  sql: { dep: { capability: "database", provider: "mssql", cls: "engine" } },
-  sqlTrigger: { trigger: "event", dep: { capability: "database", provider: "mssql", cls: "engine" } }
-};
-var PY_DECORATORS = {
-  route: "httpTrigger",
-  timer_trigger: "timerTrigger",
-  schedule: "timerTrigger",
-  queue_trigger: "queueTrigger",
-  queue_output: "queue",
-  blob_trigger: "blobTrigger",
-  blob_input: "blob",
-  blob_output: "blob",
-  cosmos_db_trigger: "cosmosDBTrigger",
-  cosmos_db_input: "cosmosDB",
-  cosmos_db_output: "cosmosDB",
-  service_bus_queue_trigger: "serviceBusTrigger",
-  service_bus_topic_trigger: "serviceBusTrigger",
-  service_bus_queue_output: "serviceBus",
-  service_bus_topic_output: "serviceBus",
-  event_hub_message_trigger: "eventHubTrigger",
-  event_hub_output: "eventHub",
-  event_grid_trigger: "eventGridTrigger",
-  event_grid_output: "eventGrid",
-  table_input: "table",
-  table_output: "table",
-  sql_input: "sql",
-  sql_output: "sql",
-  sql_trigger: "sqlTrigger"
+  cosmosdb: { trigger: "event", dep: { capability: "document", provider: "azure.cosmos", cls: "emulated" } },
+  servicebus: { trigger: "queue", dep: { capability: "queue", provider: "azure.servicebus", cls: "emulated" } },
+  eventhub: { trigger: "queue", dep: { capability: "queue", provider: "azure.eventhubs", cls: "emulated" } },
+  eventgrid: { trigger: "event", dep: { capability: "queue", provider: "azure.eventgrid", cls: "saas" } },
+  sql: { trigger: "event", dep: { capability: "database", provider: "mssql", cls: "engine" } },
+  durable_client: {},
+  durable_orchestration: { trigger: "event" },
+  durable_activity: { trigger: "event" },
+  durable_entity: { trigger: "event" },
+  embeddings_store: { dep: { capability: "vector_store", provider: "azure.search", cls: "saas" } },
+  semantic_search: { dep: { capability: "vector_store", provider: "azure.search", cls: "saas" } }
 };
-var NODE_REGISTRATIONS = {
-  http: "httpTrigger",
-  get: "httpTrigger",
-  post: "httpTrigger",
-  put: "httpTrigger",
-  patch: "httpTrigger",
-  deleteRequest: "httpTrigger",
-  timer: "timerTrigger",
-  storageQueue: "queueTrigger",
-  storageBlob: "blobTrigger",
-  cosmosDB: "cosmosDBTrigger",
-  serviceBusQueue: "serviceBusTrigger",
-  serviceBusTopic: "serviceBusTrigger",
-  eventHub: "eventHubTrigger",
-  eventGrid: "eventGridTrigger",
-  sql: "sqlTrigger"
+var TYPE_ALIASES = {
+  httptrigger: "http",
+  route: "http",
+  get: "http",
+  post: "http",
+  put: "http",
+  patch: "http",
+  deleterequest: "http",
+  timertrigger: "timer",
+  schedule: "timer",
+  queuetrigger: "queue",
+  storagequeue: "queue",
+  blobtrigger: "blob",
+  storageblob: "blob",
+  cosmosdbtrigger: "cosmosdb",
+  cosmos_db: "cosmosdb",
+  servicebustrigger: "servicebus",
+  service_bus_queue: "servicebus",
+  service_bus_topic: "servicebus",
+  servicebusqueue: "servicebus",
+  servicebustopic: "servicebus",
+  eventhubtrigger: "eventhub",
+  event_hub_message: "eventhub",
+  event_hub: "eventhub",
+  eventgridtrigger: "eventgrid",
+  event_grid: "eventgrid",
+  sqltrigger: "sql",
+  durableclient: "durable_client",
+  orchestrationtrigger: "durable_orchestration",
+  orchestration: "durable_orchestration",
+  activitytrigger: "durable_activity",
+  activity: "durable_activity",
+  entitytrigger: "durable_entity",
+  entity: "durable_entity"
 };
+function azureBindingType(raw) {
+  const key = raw.toLowerCase();
+  const t = TYPE_ALIASES[key] ?? key;
+  return t in BINDINGS ? t : undefined;
+}
 var NODE_IO = {
   storageBlob: "blob",
   storageQueue: "queue",
   table: "table",
-  cosmosDB: "cosmosDB",
-  serviceBusQueue: "serviceBus",
-  serviceBusTopic: "serviceBus",
-  eventHub: "eventHub",
-  eventGrid: "eventGrid",
+  cosmosDB: "cosmosdb",
+  serviceBusQueue: "servicebus",
+  serviceBusTopic: "servicebus",
+  eventHub: "eventhub",
+  eventGrid: "eventgrid",
   sql: "sql"
 };
 function detectAzure(input) {
@@ -184583,12 +184894,12 @@ function detectAzure(input) {
     const seenDeps = new Set;
     const addDep = (type, name, rawConnection, evidence) => {
       const connection = rawConnection && /^[A-Za-z_][A-Za-z0-9_]*$/.test(rawConnection) ? rawConnection : undefined;
+      if (!runtime.bindings.some((b) => b.name === name && b.type === type))
+        runtime.bindings.push(connection ? { name, type, resource: connection } : { name, type });
       const spec = BINDINGS[type]?.dep;
       if (!spec)
         return;
       const key = `${spec.provider}:${connection ?? ""}`;
-      if (!runtime.bindings.some((b) => b.name === name && b.type === type))
-        runtime.bindings.push({ name, type, resource: connection });
       if (seenDeps.has(key))
         return;
       seenDeps.add(key);
@@ -184611,7 +184922,7 @@ function detectAzure(input) {
         continue;
       if (basename2(file.path) === "function.json") {
         handleFunctionJson(file, runtime, addDep);
-      } else if (file.path.endsWith(".py") && /azure\.functions|func\.FunctionApp|func\.Blueprint/.test(file.text)) {
+      } else if (file.path.endsWith(".py") && /azure\.functions|azure\.durable_functions|func\.FunctionApp|func\.Blueprint|\bDFApp\(/.test(file.text)) {
         handlePython(file, runtime, addDep);
       } else if (/\.[cm]?[jt]s$/.test(file.path) && /@azure\/functions/.test(file.text)) {
         handleNode(file, runtime, addDep);
@@ -184632,17 +184943,22 @@ function handleFunctionJson(file, runtime, addDep) {
   for (const b of asArray(json.bindings)) {
     if (!isRecord2(b))
       continue;
-    const type = asString(b.type) ?? "";
-    const spec = BINDINGS[type];
-    if (spec?.trigger)
-      trigger = spec.trigger;
+    const raw = asString(b.type) ?? "";
+    const type = azureBindingType(raw);
+    if (!type)
+      continue;
+    if (/trigger$/i.test(raw) && BINDINGS[type].trigger)
+      trigger = BINDINGS[type].trigger;
     const name = asString(b.name) ?? type;
-    addDep(type, name, asString(b.connection) ?? (type.startsWith("blob") || type.startsWith("queue") ? "AzureWebJobsStorage" : undefined), evidenceAt(file.path, file.text, findLine(file.text, new RegExp(`"${escapeRe(type)}"`)), DETECTOR8));
+    addDep(type, name, asString(b.connection) ?? defaultConnection(type), evidenceAt(file.path, file.text, findLine(file.text, new RegExp(`"${escapeRe(raw)}"`)), DETECTOR8));
   }
   const script = asString(json.scriptFile);
   runtime.entrypoints.push({ name: fnName, handler: script ? joinPath(dirname2(file.path), script) : dirname2(file.path), trigger });
   runtime.language ??= script ? languageFromPath(script) : undefined;
 }
+function defaultConnection(type) {
+  return type === "blob" || type === "queue" || type === "table" ? "AzureWebJobsStorage" : undefined;
+}
 function parenDepth(text) {
   let depth = 0;
   for (const ch of text.replace(/'(?:[^'\\\n]|\\.)*'|"(?:[^"\\\n]|\\.)*"|#[^\n]*/g, "")) {
@@ -184665,24 +184981,34 @@ function handlePython(file, runtime, addDep) {
       while (parenDepth(lines.slice(start, i + 1).join(`
 `)) > 0 && i + 1 < lines.length)
         i++;
-      deco[2] = [deco[2], ...lines.slice(start + 1, i + 1)].join(`
+      const args = [deco[2], ...lines.slice(start + 1, i + 1)].join(`
 `);
       const kind = deco[1];
       if (kind === "function_name")
-        pending.name = /name\s*=\s*['"]([^'"]+)['"]/.exec(deco[2])?.[1];
-      const type = PY_DECORATORS[kind];
+        pending.name = /name\s*=\s*['"]([^'"]+)['"]/.exec(args)?.[1];
+      const stem = kind === "route" || kind === "schedule" ? kind : /^(\w+?)_(?:trigger|input|output)$/.exec(kind)?.[1];
+      const type = stem ? azureBindingType(stem) : undefined;
       if (type) {
-        if (BINDINGS[type]?.trigger)
+        const isTrigger = kind === "route" || kind === "schedule" || kind.endsWith("_trigger");
+        if (isTrigger && BINDINGS[type].trigger)
           pending.trigger = BINDINGS[type].trigger;
         if (kind === "route")
-          pending.name ??= /route\s*=\s*['"]([^'"]+)['"]/.exec(deco[2])?.[1];
-        const connection = /connection\s*=\s*['"]([^'"]+)['"]/.exec(deco[2])?.[1];
-        addDep(type, kind, connection ?? (type.startsWith("blob") || type.startsWith("queue") ? "AzureWebJobsStorage" : undefined), { path: file.path, line: start + 1, excerpt: excerpt(line), detector: DETECTOR8 });
+          pending.name ??= /route\s*=\s*['"]([^'"]+)['"]/.exec(args)?.[1];
+        const connection = /connection\s*=\s*['"]([^'"]+)['"]/.exec(args)?.[1] ?? defaultConnection(type);
+        const argName = /\b(?:arg_name|client_name|context_name|input_name|name)\s*=\s*['"]([^'"]+)['"]/.exec(args)?.[1];
+        const evidence = { path: file.path, line: start + 1, excerpt: excerpt(line), detector: DETECTOR8 };
+        if (type === "http" && !argName)
+          pending.httpBinding = { line: start + 1, connection };
+        else
+          addDep(type, argName ?? kind, connection, evidence);
       }
       continue;
     }
-    const def = /^\s*(?:async\s+)?def\s+(\w+)/.exec(line);
+    const def = /^\s*(?:async\s+)?def\s+(\w+)\s*\(\s*(\w+)?/.exec(line);
     if (def && pending) {
+      if (pending.httpBinding) {
+        addDep("http", def[2] ?? "req", undefined, { path: file.path, line: pending.httpBinding.line, excerpt: excerpt(lines[pending.httpBinding.line - 1]), detector: DETECTOR8 });
+      }
       if (pending.trigger) {
         runtime.entrypoints.push({ name: pending.name ?? def[1], handler: `${file.path}#${def[1]}`, trigger: pending.trigger });
         runtime.language ??= "python";
@@ -184696,10 +185022,10 @@ function handlePython(file, runtime, addDep) {
 function handleNode(file, runtime, addDep) {
   const at = lineIndex(file.text);
   const lines = splitLines(file.text);
-  const reg = /\bapp\.(\w+)\(\s*['"]([^'"]+)['"]/g;
+  const reg = /\b(?:app|df\.app)\.(\w+)\(\s*['"]([^'"]+)['"]/g;
   let m;
   while ((m = reg.exec(file.text)) !== null) {
-    const type = NODE_REGISTRATIONS[m[1]];
+    const type = azureBindingType(m[1]);
     if (!type)
       continue;
     const line = at(m.index);
@@ -184707,7 +185033,7 @@ function handleNode(file, runtime, addDep) {
     runtime.language ??= languageFromPath(file.path);
     const window2 = callArgs(file.text, m.index);
     const connection = /connection\s*:\s*['"]([^'"]+)['"]/.exec(window2)?.[1];
-    addDep(type, m[2], connection ?? (type.startsWith("blob") || type.startsWith("queue") ? "AzureWebJobsStorage" : undefined), { path: file.path, line, excerpt: excerpt(lines[line - 1]), detector: DETECTOR8 });
+    addDep(type, m[2], connection ?? defaultConnection(type), { path: file.path, line, excerpt: excerpt(lines[line - 1]), detector: DETECTOR8 });
   }
   const io = /\b(?:input|output)\.(\w+)\(\s*\{/g;
   while ((m = io.exec(file.text)) !== null) {
@@ -184717,7 +185043,8 @@ function handleNode(file, runtime, addDep) {
     const line = at(m.index);
     const window2 = callArgs(file.text, m.index);
     const connection = /connection\s*:\s*['"]([^'"]+)['"]/.exec(window2)?.[1];
-    addDep(type, m[1], connection ?? (type === "blob" || type === "queue" || type === "table" ? "AzureWebJobsStorage" : undefined), { path: file.path, line, excerpt: excerpt(lines[line - 1]), detector: DETECTOR8 });
+    const name = /(?:const|let|var)\s+(\w+)\s*=\s*$/.exec(file.text.slice(Math.max(0, m.index - 80), m.index))?.[1] ?? m[1];
+    addDep(type, name, connection ?? defaultConnection(type), { path: file.path, line, excerpt: excerpt(lines[line - 1]), detector: DETECTOR8 });
   }
 }
 
@@ -184771,7 +185098,10 @@ function detectProcesses(input, roots) {
       continue;
     if (json.workspaces && !start && !bin)
       continue;
-    const rt = upsert(map, "node_process", pkg.root, pkg.path);
+    const runsOnBun = /^\s*bun\s+(?:run\s+|--\S+\s+)*[\w./-]+\.[cm]?[jt]sx?\b/.test(start ?? asString(scripts.dev) ?? "");
+    const rt = upsert(map, runsOnBun ? "other_process" : "node_process", pkg.root, pkg.path);
+    if (runsOnBun)
+      rt.language = "typescript";
     const pkgFile = ctx.byPath.get(pkg.path);
     rt.evidence.push(evidenceAt(pkg.path, pkgFile?.text ?? "", findLine(pkgFile?.text ?? "", /"(start|bin|main)"/), DETECTOR9));
     const trigger = server2 ? "http" : bin ? "cli" : "unknown";
@@ -184956,6 +185286,10 @@ function pythonFile(file, map, roots) {
       hits.push({ entry: { name: `mcp ${mod}:${m[1]}`, handler: `${file.path}:${m[1]}`, command: ["python", fromRoot(file.path, root)], trigger: /sse|streamable_http/.test(text) ? "http" : "cli" }, offset: m.index, detector: `${DETECTOR9}.mcp` });
     }
   }
+  const agentcore = /\bBedrockAgentCoreApp\s*\(/.exec(text);
+  if (agentcore && /bedrock_agentcore/.test(text)) {
+    hits.push({ entry: { name: `agentcore ${file.path}`, handler: file.path, command: ["python", rel], trigger: "http" }, offset: agentcore.index, detector: `${DETECTOR9}.agentcore` });
+  }
   const main = /^if\s+__name__\s*==\s*['"]__main__['"]\s*:/m.exec(text);
   if (main && hits.length === 0) {
     const serves = /uvicorn\.run|\.run\(\s*(?:host|port|debug)|app\.run\(|web\.run_app|serve_forever/.test(text);
@@ -184972,10 +185306,24 @@ function pythonFile(file, map, roots) {
     }
   }
 }
+var SUPABASE_EDGE = /^(.*?supabase\/functions)\/([^_./][^/]*)\/index\.[cm]?[jt]s$/;
 function nodeFile(file, map, roots) {
   const text = file.text;
+  const edge = SUPABASE_EDGE.exec(file.path);
+  if (edge) {
+    const rt2 = upsert(map, "other_process", edge[1]);
+    rt2.language = "typescript";
+    rt2.frameworks = [...new Set([...rt2.frameworks ?? [], "supabase-edge-functions"])].sort();
+    addEntry(rt2, { name: `edge ${edge[2]}`, handler: file.path, command: ["supabase", "functions", "serve", edge[2]], trigger: "http" });
+    if (rt2.evidence.length < 5)
+      rt2.evidence.push(evidenceAt(file.path, text, 1, `${DETECTOR9}.supabase_edge`));
+    return;
+  }
   const hits = [];
   let m;
+  if (/bedrock-agentcore/.test(text) && (m = /\bBedrockAgentCoreApp\b|\.entrypoint\s*\(/.exec(text))) {
+    hits.push({ entry: { name: `agentcore ${file.path}`, handler: file.path, trigger: "http" }, offset: m.index, detector: `${DETECTOR9}.agentcore` });
+  }
   if (/@modelcontextprotocol\/sdk/.test(text) && (m = /new\s+(McpServer|Server)\s*\(/.exec(text))) {
     const http = /StreamableHTTPServerTransport|SSEServerTransport/.test(text);
     hits.push({ entry: { name: `mcp ${file.path}`, handler: file.path, trigger: http ? "http" : "cli" }, offset: m.index, detector: `${DETECTOR9}.mcp` });
@@ -184985,10 +185333,15 @@ function nodeFile(file, map, roots) {
   }
   if (m = /\b(?:app|server|fastify)\.listen\s*\(|\bserve\(\s*\{\s*fetch|\bBun\.serve\s*\(|\bDeno\.serve\s*\(|\bcreateServer\s*\([^)]*\)\s*\.listen/.exec(text)) {
     hits.push({ entry: { name: `listen ${file.path}`, handler: file.path, trigger: "http" }, offset: m.index, detector: `${DETECTOR9}.listen` });
+    const bun = /\bBun\.serve\s*\(/.exec(text);
+    if (bun && /\bwebsocket\s*[:,}]/.test(callArgs(text, bun.index + bun[0].length - 1, 50000))) {
+      hits.push({ entry: { name: `websocket ${file.path}`, handler: file.path, trigger: "websocket" }, offset: bun.index, detector: `${DETECTOR9}.listen` });
+    }
   }
   if (hits.length === 0)
     return;
-  const rt = upsert(map, "node_process", nearestRoot(file.path, roots));
+  const kind = /\bBun\.serve\s*\(/.test(text) ? "other_process" : "node_process";
+  const rt = upsert(map, kind, nearestRoot(file.path, roots));
   rt.language = languageFromPath(file.path) ?? rt.language;
   const at = lineIndex(text);
   const lines = splitLines(text);
@@ -185068,7 +185421,9 @@ function detectVercel(input) {
       if (info.next && /^(?:src\/)?app\/(?:.*\/)?route\.[cm]?[jt]sx?$/.test(r)) {
         const methods = exportedMethods(f.text);
         const path = routePath(r.replace(/^src\//, "").replace(/^app\//, ""), "app");
-        entries.push({ name: `${methods.join(",") || "ANY"} ${path}`, handler: f.path, trigger: "http" });
+        entries.push({ name: `${methods.length > 0 ? methods.join(",") : "ANY"} ${path}`, handler: f.path, trigger: "http" });
+      } else if (info.next && /^(?:src\/)?middleware\.[cm]?[jt]s$/.test(r)) {
+        entries.push({ name: "middleware", handler: `${f.path}#middleware`, trigger: "http" });
       } else if (info.next && /^(?:src\/)?pages\/api\/.+\.[cm]?[jt]sx?$/.test(r)) {
         entries.push({ name: `ANY ${routePath(r.replace(/^src\//, "").replace(/^pages\//, ""), "pages")}`, handler: f.path, trigger: "http" });
       } else if (!info.next && /^api\/.+\.([cm]?[jt]s|py|go)$/.test(r) && !/\/_/.test(r)) {
@@ -185097,11 +185452,277 @@ function detectVercel(input) {
 function rel(path, root) {
   return root === "." ? path : path.slice(root.length + 1);
 }
+
+// ../../packages/harness-bundle/src/detect/scope.ts
+var DEPLOY_CONFIG = /^(?:wrangler\.(?:toml|json|jsonc)|template\.ya?ml|serverless\.ya?ml|vercel\.json|firebase\.json|cloudbuild\.ya?ml|service\.ya?ml|cdk\.json|langgraph\.json|Procfile|render\.ya?ml|fly\.toml|railway\.(?:json|toml)|netlify\.toml|(?:docker-)?compose(?:\.[\w-]+)*\.ya?ml)$/;
+var PROJECT_MANIFEST2 = /^(?:package\.json|pyproject\.toml|requirements\.txt|go\.mod|Cargo\.toml|Gemfile)$/;
+var ANCESTOR_ORM = [
+  { uses: /@prisma\/client|\bPrismaClient\b/, files: /^(?:prisma\/.+|[\w.-]+\.prisma|(?:\.config\/)?prisma(?:\.config)?\.[cm]?[jt]s)$/ },
+  { uses: /\bdrizzle-orm\b/, files: /^drizzle\.config\.[cm]?[jt]s$/ },
+  { uses: /\b(?:sqlalchemy|sqlmodel|alembic)\b/, files: /^(?:alembic\.ini|alembic\/.+)$/ }
+];
+var CODE_FILE = /\.(?:[cm]?[jt]sx?|py)$/;
+function pyDependencyNames(doc) {
+  const out = [];
+  const project = isRecord2(doc.project) ? doc.project : {};
+  for (const req of asArray(project.dependencies)) {
+    const m = typeof req === "string" ? /^\s*([A-Za-z0-9][\w.-]*)/.exec(req) : null;
+    if (m)
+      out.push(m[1]);
+  }
+  const poetry = isRecord2(doc.tool) && isRecord2(doc.tool.poetry) ? doc.tool.poetry : {};
+  if (isRecord2(poetry.dependencies))
+    out.push(...Object.keys(poetry.dependencies));
+  return out.map(pyName);
+}
+function pyName(name) {
+  return name.toLowerCase().replace(/[_.]/g, "-");
+}
+function npmDeps(json) {
+  const out = [];
+  for (const field of ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"]) {
+    const deps = json[field];
+    if (isRecord2(deps))
+      out.push(...Object.keys(deps));
+  }
+  return out;
+}
+function tomlDoc(file) {
+  if (!file)
+    return;
+  try {
+    return parse(file.text);
+  } catch {
+    return;
+  }
+}
+function directDeps(dir, byPath, npmNames, pyNames, goModules, workspaces) {
+  const out = [];
+  const pkg = byPath.get(joinPath(dir, "package.json"));
+  if (pkg) {
+    const json = parseJsonLoose(pkg.text);
+    if (isRecord2(json)) {
+      for (const name of npmDeps(json)) {
+        const target = npmNames.get(name);
+        if (target !== undefined)
+          out.push(target);
+      }
+    }
+  }
+  const pyproject = tomlDoc(byPath.get(joinPath(dir, "pyproject.toml")));
+  if (pyproject) {
+    const tool = isRecord2(pyproject.tool) ? pyproject.tool : {};
+    const uv = isRecord2(tool.uv) ? tool.uv : {};
+    const sources = isRecord2(uv.sources) ? uv.sources : {};
+    for (const [name, src] of Object.entries(sources)) {
+      if (!isRecord2(src))
+        continue;
+      if (src.workspace === true) {
+        const target = pyNames.get(pyName(name));
+        if (target !== undefined)
+          out.push(target);
+      }
+      const path = asString(src.path);
+      if (path)
+        out.push(joinPath(dir, path));
+    }
+    for (const ws of workspaces) {
+      if (!isUnder(dir, ws.root))
+        continue;
+      for (const name of pyDependencyNames(pyproject)) {
+        const target = ws.sources.get(name);
+        if (target !== undefined)
+          out.push(target);
+      }
+    }
+    const poetry = isRecord2(tool.poetry) ? tool.poetry : {};
+    const groups = [poetry.dependencies, ...isRecord2(poetry.group) ? Object.values(poetry.group).map((g) => isRecord2(g) ? g.dependencies : undefined) : []];
+    for (const deps of groups) {
+      if (!isRecord2(deps))
+        continue;
+      for (const spec of Object.values(deps)) {
+        const path = isRecord2(spec) ? asString(spec.path) : undefined;
+        if (path)
+          out.push(joinPath(dir, path));
+      }
+    }
+  }
+  for (const name of ["requirements.txt", "requirements.in"]) {
+    const req = byPath.get(joinPath(dir, name));
+    if (!req)
+      continue;
+    for (const line of splitLines(req.text)) {
+      const m = /^\s*(?:-e\s+)?(\.{1,2}\/[^\s#;]+)/.exec(line);
+      if (m)
+        out.push(joinPath(dir, m[1]));
+    }
+  }
+  const gomod = byPath.get(joinPath(dir, "go.mod"));
+  if (gomod) {
+    for (const m of gomod.text.matchAll(/=>\s*(\.{1,2}\/\S+)/g))
+      out.push(joinPath(dir, m[1]));
+    for (const m of gomod.text.matchAll(/^\s*(?:require\s+)?([\w.-]+\.[\w./-]+)\s+v[\w.+-]+/gm)) {
+      const target = goModules.get(m[1]);
+      if (target !== undefined)
+        out.push(target);
+    }
+    const own = /^module\s+(\S+)/m.exec(gomod.text)?.[1];
+    const others = [...goModules].filter(([mod]) => mod !== own);
+    if (others.length > 0) {
+      for (const f of byPath.values()) {
+        if (!f.path.endsWith(".go") || !isUnder(f.path, dir))
+          continue;
+        for (const [mod, target] of others)
+          if (f.text.includes(`"${mod}"`) || f.text.includes(`"${mod}/`))
+            out.push(target);
+      }
+    }
+  }
+  return out;
+}
+function composeBuildsUnder(svc, base, root) {
+  if (!isRecord2(svc) || svc.build === undefined)
+    return false;
+  const build = svc.build;
+  const context = joinPath(base, typeof build === "string" ? build : isRecord2(build) ? asString(build.context) ?? "." : ".");
+  if (isUnder(context, root))
+    return true;
+  const dockerfile = isRecord2(build) ? asString(build.dockerfile) : undefined;
+  return dockerfile !== undefined && isUnder(joinPath(context, dockerfile), root);
+}
+function computeScope(files, root) {
+  const byPath = new Map(files.map((f) => [f.path, f]));
+  if (root === ".")
+    return { root, closure: [], configs: [] };
+  const npmNames = new Map;
+  const pyNames = new Map;
+  const goModules = new Map;
+  for (const f of files) {
+    const name = basename2(f.path);
+    if (name === "package.json") {
+      const json = parseJsonLoose(f.text);
+      if (isRecord2(json) && typeof json.name === "string")
+        npmNames.set(json.name, dirname2(f.path));
+    } else if (name === "pyproject.toml") {
+      const doc = tomlDoc(f);
+      const project = doc && isRecord2(doc.project) ? doc.project : undefined;
+      const poetry = doc && isRecord2(doc.tool) && isRecord2(doc.tool.poetry) ? doc.tool.poetry : undefined;
+      const projectName = asString(project?.name) ?? asString(poetry?.name);
+      if (projectName)
+        pyNames.set(pyName(projectName), dirname2(f.path));
+    } else if (name === "go.mod") {
+      const mod = /^module\s+(\S+)/m.exec(f.text)?.[1];
+      if (mod)
+        goModules.set(mod, dirname2(f.path));
+    }
+  }
+  const workspaces = [];
+  for (const f of files) {
+    if (basename2(f.path) !== "pyproject.toml")
+      continue;
+    const doc = tomlDoc(f);
+    const uv = doc && isRecord2(doc.tool) && isRecord2(doc.tool.uv) ? doc.tool.uv : undefined;
+    if (!uv || !isRecord2(uv.workspace))
+      continue;
+    const base = dirname2(f.path);
+    const members = asArray(uv.workspace.members).filter((m) => typeof m === "string").map((m) => globRegex(joinPath(base, m)));
+    if (!members.some((re) => re.test(root) || [...pyNames.values()].some((d) => isUnder(root, d) && re.test(d))))
+      continue;
+    const sources = new Map;
+    for (const [name, src] of Object.entries(isRecord2(uv.sources) ? uv.sources : {})) {
+      if (!isRecord2(src))
+        continue;
+      const target = src.workspace === true ? pyNames.get(pyName(name)) : asString(src.path) ? joinPath(base, asString(src.path)) : undefined;
+      if (target !== undefined)
+        sources.set(pyName(name), target);
+    }
+    workspaces.push({ root: base, sources });
+  }
+  const MANIFEST = /^(?:package\.json|pyproject\.toml|requirements\.(?:txt|in)|go\.mod)$/;
+  const nested = files.filter((f) => MANIFEST.test(basename2(f.path)) && isUnder(f.path, root) && !/(^|\/)node_modules\//.test(f.path)).map((f) => dirname2(f.path));
+  const closure = new Set;
+  const queue = [...new Set([root, ...nested])];
+  while (queue.length > 0) {
+    const dir = queue.shift();
+    for (const dep of directDeps(dir, byPath, npmNames, pyNames, goModules, workspaces)) {
+      if (dep === root || isUnder(dep, root) || closure.has(dep) || dep === ".")
+        continue;
+      closure.add(dep);
+      queue.push(dep);
+    }
+  }
+  const owned = (p2) => isUnder(p2, root) || [...closure].some((c) => isUnder(p2, c));
+  const ancestors = [];
+  for (let d = dirname2(root);; d = dirname2(d)) {
+    ancestors.push(d);
+    if (d === ".")
+      break;
+  }
+  const harnessFiles = files.filter((f) => owned(f.path));
+  const configs = new Set;
+  if (!harnessFiles.some((f) => dirname2(f.path) === root && PROJECT_MANIFEST2.test(basename2(f.path)))) {
+    const dir = ancestors.find((a) => files.some((f) => dirname2(f.path) === a && PROJECT_MANIFEST2.test(basename2(f.path))));
+    for (const f of files)
+      if (dir !== undefined && dirname2(f.path) === dir && PROJECT_MANIFEST2.test(basename2(f.path)))
+        configs.add(f.path);
+  }
+  const users = [...harnessFiles, ...[...configs].map((p2) => byPath.get(p2))];
+  const relToRoot = (p2) => p2.slice(root.length + 1);
+  const orms = ANCESTOR_ORM.filter((o) => users.some((f) => (CODE_FILE.test(f.path) || PROJECT_MANIFEST2.test(basename2(f.path))) && o.uses.test(f.text)) && !files.some((f) => isUnder(f.path, root) && o.files.test(relToRoot(f.path))));
+  const ormDirs = [];
+  for (const f of files) {
+    if (owned(f.path))
+      continue;
+    const name = basename2(f.path);
+    const base = dirname2(f.path);
+    if (ancestors.includes(base) && isEnvFile(f.path))
+      configs.add(f.path);
+    for (const a of ancestors) {
+      if (!isUnder(f.path, a))
+        continue;
+      const rel3 = a === "." ? f.path : f.path.slice(a.length + 1);
+      if (!orms.some((o) => o.files.test(rel3)))
+        continue;
+      configs.add(f.path);
+      if (!/^(?:drizzle\.config\.|alembic\.ini$)/.test(name))
+        continue;
+      if (name.startsWith("drizzle.config.") && !/\bout\s*:/.test(f.text))
+        ormDirs.push(joinPath(a, "drizzle"));
+      for (const m of f.text.matchAll(/\b(?:out|schema|script_location)\s*[:=]\s*['"]?([\w./-]+)/g))
+        ormDirs.push(joinPath(a, m[1].replace(/\/?\*.*$/, "")));
+    }
+    if (!DEPLOY_CONFIG.test(name) || !ancestors.includes(base))
+      continue;
+    const rel2 = base === "." ? root : root.slice(base.length + 1);
+    if (/compose/.test(name)) {
+      const doc = loadYaml(f.text);
+      const services = isRecord2(doc) && isRecord2(doc.services) ? doc.services : {};
+      if (Object.values(services).some((svc) => composeBuildsUnder(svc, base, root)))
+        configs.add(f.path);
+    } else if (new RegExp(`(?:^|[\\s"'=:/])\\.?/?${rel2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:[/"'\\s]|$)`, "m").test(f.text)) {
+      configs.add(f.path);
+    }
+  }
+  for (const f of files)
+    if (!owned(f.path) && ormDirs.some((d) => d !== "." && (f.path === d || isUnder(f.path, d))))
+      configs.add(f.path);
+  return { root, closure: [...closure].sort(), configs: [...configs].sort() };
+}
+var configSets = new WeakMap;
+function inScope(path, scope) {
+  if (scope.root === ".")
+    return true;
+  let configs = configSets.get(scope);
+  if (!configs)
+    configSets.set(scope, configs = new Set(scope.configs));
+  return isUnder(path, scope.root) || scope.closure.some((c) => isUnder(path, c)) || configs.has(path);
+}
 // ../../packages/harness-bundle/src/detect/index.ts
 var DETECTOR_NAME = "@moda/harness-bundle/detect";
 var DETECTOR_VERSION = "0.1.0";
 var SERVER_FRAMEWORKS = new Set(FRAMEWORKS.filter((f) => f.kind === "server").map((f) => f.name));
 var MIGRATION_ENGINE_PROVIDERS = new Set(["postgres", "mysql", "sqlite", "libsql", "mssql", "clickhouse", "cloudflare.d1", "supabase", "mongodb"]);
+var CLOSURE_CAPABILITIES = new Set(["database", "document", "kv", "vector_store", "object_store", "queue"]);
 var PLATFORM_KINDS = new Set(["cloudflare_workers", "aws_lambda", "gcp_cloud_functions", "gcp_cloud_run", "azure_functions", "vercel_functions"]);
 var PROCESS_KINDS = new Set(["node_process", "python_process", "other_process"]);
 function packageSignals(ctx, declared) {
@@ -185122,6 +185743,237 @@ function packageSignals(ctx, declared) {
     });
   }
 }
+function normalizeRoot(raw) {
+  if (!raw)
+    return ".";
+  const root = joinPath(raw);
+  return root === "" ? "." : root;
+}
+var RUNTIME_CONFIG = /^(?:wrangler\.(?:toml|jsonc?)|template\.ya?ml|serverless\.ya?ml|host\.json|vercel\.json|next\.config\.\w+|Dockerfile[\w.-]*|(?:docker-)?compose[\w.-]*\.ya?ml|langgraph\.json|firebase\.json|cdk\.json)$/;
+function outsideContext(files, scope) {
+  const configs = files.filter((f) => RUNTIME_CONFIG.test(basename2(f.path))).map((f) => f.path);
+  const providers = new Set;
+  for (const d of collectDeclaredPackages(files)) {
+    const m = matchModule(d.eco === "pypi" ? "pypi" : d.eco, d.name);
+    if (m && !d.dev)
+      providers.add(m.signature.provider);
+  }
+  const list = [...providers].sort();
+  return {
+    kind: "outside_harness_root",
+    message: `${files.length} file(s) outside harness root ${scope.root}${scope.closure.length > 0 ? ` and its workspace dependencies (${scope.closure.join(", ")})` : ""} were not analyzed` + (configs.length > 0 ? `; runtime configs there: ${configs.slice(0, 5).join(", ")}${configs.length > 5 ? `, +${configs.length - 5} more` : ""}` : "") + (list.length > 0 ? `; providers declared there: ${list.slice(0, 10).join(", ")}${list.length > 10 ? `, +${list.length - 10} more` : ""}` : ""),
+    evidence: configs.slice(0, 3).map((path) => ({ path, detector: "scope" }))
+  };
+}
+function scopeRuntimes(ctx, runtimes, scope) {
+  if (scope.root === ".")
+    return runtimes;
+  const out = [];
+  for (const rt of runtimes) {
+    if (isUnder(rt.root, scope.root)) {
+      out.push(rt);
+      continue;
+    }
+    if (!isUnder(scope.root, rt.root))
+      continue;
+    const pointsIn = (ep) => [ep.handler ?? "", ...ep.command ?? []].some((p2) => isUnder(joinPath(rt.root, p2.split(/[#:]/)[0]), scope.root) || isUnder(p2.split(/[#:]/)[0], scope.root));
+    const entrypoints = rt.entrypoints.filter(pointsIn);
+    if (entrypoints.length === 0)
+      continue;
+    const kept = new Set(entrypoints.map((e) => e.name));
+    let bindings = rt.bindings;
+    for (const [template, refs] of ctx.functionRefs) {
+      if (!rt.configFiles.includes(template))
+        continue;
+      const dropped = [...refs.keys()].filter((fn) => !kept.has(fn));
+      const allowed = new Set([...refs.entries()].filter(([fn]) => kept.has(fn)).flatMap(([, ids]) => [...ids]));
+      ctx.env = ctx.env.filter((e) => !dropped.some((fn) => e.source === `${template} ${fn}`));
+      ctx.signals = ctx.signals.filter((s) => s.kind !== "binding" || s.evidence.path !== template || allowed.has(s.binding ?? ""));
+      bindings = bindings.filter((b) => allowed.has(b.name));
+    }
+    out.push({ ...rt, entrypoints, bindings });
+  }
+  return out;
+}
+function scopeComposeImages(ctx, scope) {
+  const optional = new Set;
+  for (const f of ctx.files) {
+    if (!/^(?:docker-)?compose(?:\.[\w-]+)*\.ya?ml$/.test(basename2(f.path)))
+      continue;
+    const base = f.path.includes("/") ? f.path.slice(0, f.path.lastIndexOf("/")) : ".";
+    if (base === scope.root)
+      continue;
+    const doc = loadYaml(f.text);
+    const services = isRecord2(doc) && isRecord2(doc.services) ? Object.values(doc.services) : [];
+    const builds = services.some((svc) => isRecord2(svc) && svc.build !== undefined);
+    if (!builds)
+      optional.add(f.path);
+  }
+  for (const s of ctx.signals)
+    if (s.kind === "image" && optional.has(s.evidence.path))
+      s.weak = true;
+  if (scope.root === ".")
+    return ctx.signals;
+  const allowed = new Map;
+  for (const path of scope.configs) {
+    if (!/compose/.test(basename2(path)))
+      continue;
+    const doc = loadYaml(ctx.byPath.get(path)?.text ?? "");
+    const services = isRecord2(doc) && isRecord2(doc.services) ? doc.services : {};
+    const base = path.includes("/") ? path.slice(0, path.lastIndexOf("/")) : ".";
+    const deps = new Set;
+    let declared = false;
+    for (const svc of Object.values(services)) {
+      if (!isRecord2(svc) || !composeBuildsUnder(svc, base, scope.root))
+        continue;
+      const names = [...Array.isArray(svc.depends_on) ? svc.depends_on : isRecord2(svc.depends_on) ? Object.keys(svc.depends_on) : [], ...Array.isArray(svc.links) ? svc.links : []];
+      for (const n of names)
+        if (typeof n === "string") {
+          declared = true;
+          deps.add(n.split(":")[0]);
+        }
+    }
+    if (declared)
+      allowed.set(path, deps);
+  }
+  ctx.env = ctx.env.filter((e) => e.service === undefined || e.scopeRoot !== undefined || !e.evidence || !allowed.has(e.evidence.path) || allowed.get(e.evidence.path).has(e.service));
+  return ctx.signals.filter((s) => s.kind !== "image" || !allowed.has(s.evidence.path) || allowed.get(s.evidence.path).has(s.resource ?? ""));
+}
+var SERVERLESS_KINDS = new Set(["cloudflare_workers", "aws_lambda", "gcp_cloud_functions", "azure_functions", "vercel_functions"]);
+function isAuxiliary(path, harnessRoot) {
+  if (!isUnder(path, harnessRoot))
+    return false;
+  const rel2 = harnessRoot === "." ? path : path === harnessRoot ? "." : path.slice(harnessRoot.length + 1);
+  return AUXILIARY_DIR.test(rel2);
+}
+var AUXILIARY_DIR = /(^|\/)(vendor|third_party|examples?|samples?|demos?|docs?|tests?|e2e|benchmarks?|fixtures|\.devops|\.github|cloud-deployments|hack|playground)(\/|$)/;
+function foldNestedRuntimes(ctx, runtimes, harnessRoot) {
+  const rel2 = (root) => harnessRoot === "." ? root : root === harnessRoot ? "." : root.slice(harnessRoot.length + 1);
+  const auxiliary = runtimes.filter((r) => isUnder(r.root, harnessRoot) && AUXILIARY_DIR.test(rel2(r.root)));
+  if (auxiliary.length > 0) {
+    ctx.gaps.push({
+      kind: "auxiliary_runtime",
+      message: `${auxiliary.length} runtime(s) under example, vendored, test, or deployment-variant directories were not treated as the harness: ${auxiliary.slice(0, 5).map((r) => `${r.kind}@${r.root}`).join(", ")}${auxiliary.length > 5 ? ", ..." : ""}`,
+      evidence: auxiliary.slice(0, 3).map((r) => r.evidence[0]).filter((e) => e !== undefined)
+    });
+  }
+  let out = runtimes.filter((r) => !auxiliary.includes(r));
+  const merge = (into, from) => {
+    into.configFiles = uniqSorted([...into.configFiles, ...from.configFiles]);
+    into.frameworks = uniqSorted([...into.frameworks ?? [], ...from.frameworks ?? []]);
+    for (const ep of from.entrypoints) {
+      const moved = ep.command && from.root !== into.root ? { ...ep, command: rebaseCommand(ep.command, from.root, into.root, ctx) } : ep;
+      if (into.entrypoints.some((e) => e.name === moved.name && e.handler === moved.handler && (e.command ?? []).join(" ") === (moved.command ?? []).join(" ")))
+        continue;
+      into.entrypoints.push(moved);
+    }
+    into.language ??= from.language;
+  };
+  for (const v of out.filter((r) => r.kind === "vercel_functions")) {
+    const container = out.find((r) => (r.kind === "container" || r.kind === "gcp_cloud_run") && r.root === v.root);
+    if (container && !v.configFiles.some((f) => basename2(f) === "vercel.json")) {
+      merge(container, v);
+      out = out.filter((r) => r !== v);
+    }
+  }
+  for (const p2 of out.filter((r) => PROCESS_KINDS.has(r.kind))) {
+    const owners = out.filter((o) => o !== p2 && !PROCESS_KINDS.has(o.kind) && isUnder(p2.root, o.root) && o.root !== p2.root).sort((a, b) => b.root.length - a.root.length);
+    const owner = owners.find((o) => o.kind === "container" || o.kind === "gcp_cloud_run" || SERVERLESS_KINDS.has(o.kind) && !p2.entrypoints.some((e) => e.trigger === "http"));
+    if (owner) {
+      merge(owner, p2);
+      out = out.filter((r) => r !== p2);
+    }
+  }
+  return out;
+}
+function resolveCommandHandlers(rt, ctx) {
+  const exists = (p2) => ctx.byPath.has(p2);
+  const under = (p2) => joinPath(rt.root, p2.replace(/^\/(?:app|usr\/src\/app|code|workspace|srv)\//, ""));
+  for (const ep of rt.entrypoints) {
+    if (ep.handler || !ep.command)
+      continue;
+    const words = ep.command.flatMap((w) => w.split(/\s+/)).filter(Boolean);
+    for (let i = 0;i < words.length && !ep.handler; i++) {
+      const w = words[i];
+      const mod = /^([A-Za-z_][\w.]*):([A-Za-z_]\w*)(?:\(\))?$/.exec(w) ?? (words[i - 1] === "-m" && /^[A-Za-z_][\w.]*$/.test(w) ? [w, w, ""] : null);
+      if (mod) {
+        const base = mod[1].replace(/\./g, "/");
+        const file = [`${base}.py`, `${base}/__init__.py`, `${base}/__main__.py`, `src/${base}.py`].map(under).find(exists);
+        if (file)
+          ep.handler = mod[2] ? `${file}:${mod[2]}` : file;
+        continue;
+      }
+      if (/\.(?:py|[cm]?[jt]sx?|sh)$/.test(w)) {
+        const file = [under(w), joinPath(w)].find(exists);
+        if (file)
+          ep.handler = file;
+      }
+    }
+  }
+}
+var INFERRED_ENTRY = /^(?:fastapi|starlette|litestar|quart|sanic|flask) /;
+function dedupeEntrypoints(rt) {
+  const handlerFile = (h) => h.split(/[#:]/)[0];
+  const kept = rt.entrypoints.filter((e) => !e.handler || !isAuxiliary(handlerFile(e.handler), rt.root));
+  const pool = kept.length > 0 ? kept : rt.entrypoints;
+  const commanded = new Set(pool.filter((e) => e.command && e.handler).map((e) => `${e.trigger}:${e.handler}`));
+  const explicit = new Set(pool.filter((e) => e.command && e.handler && !INFERRED_ENTRY.test(e.name)).map((e) => `${e.trigger}:${e.handler}`));
+  const seen = new Set;
+  const out = [];
+  for (const ep of pool) {
+    if (!ep.command && ep.handler && commanded.has(`${ep.trigger}:${ep.handler}`))
+      continue;
+    if (ep.handler && INFERRED_ENTRY.test(ep.name) && explicit.has(`${ep.trigger}:${ep.handler}`))
+      continue;
+    const key = ep.command ? `${ep.trigger}:${ep.handler ?? ""}:${ep.command.join(" ")}` : `${ep.trigger}:${ep.handler ?? ""}:${ep.name}`;
+    if (seen.has(key))
+      continue;
+    seen.add(key);
+    out.push(ep);
+  }
+  return out;
+}
+function scriptLocalFilter(ctx, runtimes) {
+  const scripts = ctx.files.filter((f) => /\.(?:sh|bash)$/.test(f.path));
+  if (scripts.length === 0)
+    return () => false;
+  const launched = new Set(runtimes.flatMap((r) => r.entrypoints.flatMap((e) => [...(e.command ?? []).flatMap((w) => w.split(/[\s/;&|]+/)), basename2(e.handler ?? "")])));
+  const runners = ctx.files.filter((f) => /^(?:Dockerfile[\w.-]*|Procfile|package\.json|azure\.ya?ml)$/.test(basename2(f.path)) || !f.isDoc && !f.isTest && languageOf(f.path) !== undefined).map((f) => f.text);
+  for (const s of scripts)
+    if (runners.some((t) => t.includes(basename2(s.path))))
+      launched.add(basename2(s.path));
+  for (let changed = true;changed; ) {
+    changed = false;
+    for (const s of scripts) {
+      if (!launched.has(basename2(s.path)))
+        continue;
+      for (const m of s.text.matchAll(/(?:^|[\s;&|])(?:source|\.)\s+["']?([^\s"';&|]+\.(?:sh|bash))/gm)) {
+        const name = basename2(m[1]);
+        if (!launched.has(name)) {
+          launched.add(name);
+          changed = true;
+        }
+      }
+    }
+  }
+  return (path) => /\.(?:sh|bash)$/.test(path) && !launched.has(basename2(path));
+}
+function rebaseCommand(command, fromRoot2, toRoot, ctx) {
+  const sub = toRoot === "." ? fromRoot2 : fromRoot2.slice(toRoot.length + 1);
+  let rebased = false;
+  const out = command.map((arg) => {
+    const path = joinPath(fromRoot2, arg);
+    if (/[./]/.test(arg) && !arg.startsWith("-") && !arg.startsWith("/") && (ctx.byPath.has(path) || ctx.files.some((f) => f.path.startsWith(`${path}/`)))) {
+      rebased = true;
+      return joinPath(sub, arg);
+    }
+    return arg;
+  });
+  if (rebased)
+    return out;
+  const quote = (a) => /^[\w@%+=:,./-]+$/.test(a) ? a : `'${a.replace(/'/g, `'\\''`)}'`;
+  return ["sh", "-c", `cd ${quote(sub)} && ${command.map(quote).join(" ")}`];
+}
 function consolidateRuntimes(runtimes) {
   const out = [];
   const owners = runtimes.filter((r) => !PROCESS_KINDS.has(r.kind));
@@ -185151,8 +186003,17 @@ function applyCloudRun(ctx, runtimes) {
   for (const marker of markers) {
     const candidates = runtimes.filter((r) => (r.kind === "container" || PROCESS_KINDS.has(r.kind) || r.kind === "gcp_cloud_run") && isUnder(r.root, marker.root));
     const exact = candidates.filter((r) => r.root === marker.root);
-    const pool = exact.length > 0 ? exact : candidates;
+    const pool = exact.length > 0 && (marker.services ?? 1) <= 1 ? exact : candidates;
     const roots = uniqSorted(pool.map((r) => r.root));
+    if (roots.length > 1 && (marker.services ?? 1) >= roots.length) {
+      for (const rt of pool.filter((r) => r.kind === "container" || PROCESS_KINDS.has(r.kind))) {
+        rt.kind = "gcp_cloud_run";
+        if (!rt.configFiles.includes(marker.path))
+          rt.configFiles = uniqSorted([...rt.configFiles, marker.path]);
+        rt.evidence.push({ path: marker.path, line: marker.line, detector: "runtime.gcp.cloud_run" });
+      }
+      continue;
+    }
     if (roots.length > 1) {
       ctx.gaps.push({
         kind: "ambiguous_deploy_target",
@@ -185190,6 +186051,9 @@ function applyCloudRun(ctx, runtimes) {
 function dedupeGaps(gaps) {
   const seen = new Map;
   for (const g of gaps) {
+    g.message = redact(g.message);
+    if (g.evidence)
+      g.evidence = g.evidence.map((e) => ({ ...e, path: redact(e.path) }));
     const key = `${g.kind}:${g.message}`;
     if (!seen.has(key))
       seen.set(key, g);
@@ -185199,9 +186063,13 @@ function dedupeGaps(gaps) {
 function detectDependencies(input) {
   const opts = typeof input === "string" ? { dir: input } : input;
   const loaded = loadFiles(opts.dir, { maxFileBytes: opts.maxFileBytes, maxFiles: opts.maxFiles });
+  const harnessRoot = normalizeRoot(opts.harnessRoot ?? loaded.manifest?.harness?.root);
+  const scope = computeScope(loaded.files, harnessRoot);
+  const scoped = loaded.files.filter((f) => inScope(f.path, scope));
+  const outside = loaded.files.filter((f) => !inScope(f.path, scope));
   const ctx = {
-    files: loaded.files,
-    byPath: new Map(loaded.files.map((f) => [f.path, f])),
+    files: scoped,
+    byPath: new Map(scoped.map((f) => [f.path, f])),
     manifest: loaded.manifest,
     signals: [],
     runtimes: [],
@@ -185209,12 +186077,28 @@ function detectDependencies(input) {
     gaps: [],
     env: [],
     envLinks: [],
-    migrationHints: []
+    migrationHints: [],
+    functionRefs: new Map
   };
-  for (const ref of ctx.manifest?.env ?? []) {
-    for (const source of ref.sources.length > 0 ? ref.sources : ["manifest.json"])
-      ctx.env.push({ name: ref.name, source });
+  if (ctx.manifest) {
+    const scopedEnv = [];
+    for (const ref of ctx.manifest.env ?? []) {
+      if (isAmbientEnv(ref.name))
+        continue;
+      const sources = ref.sources.filter((src) => {
+        const path = src.split(/[: ]/)[0];
+        return (!/[/.]/.test(path) || inScope(path, scope)) && isRuntimeEnvSource(src) && !isAuxiliary(path, harnessRoot);
+      });
+      if (ref.sources.length > 0 && sources.length === 0)
+        continue;
+      scopedEnv.push({ ...ref, sources });
+      for (const source of sources.length > 0 ? sources : ["manifest.json"])
+        ctx.env.push({ name: ref.name, source });
+    }
+    ctx.manifest = { ...ctx.manifest, env: scopedEnv };
   }
+  if (outside.length > 0)
+    ctx.gaps.push(outsideContext(outside, scope));
   if (loaded.skipped.length > 0) {
     const byReason = new Map;
     for (const sk of loaded.skipped) {
@@ -185233,13 +186117,25 @@ function detectDependencies(input) {
   }
   if (loaded.truncated)
     ctx.gaps.push({ kind: "truncated", message: `Only the first ${ctx.files.length} files were analyzed` });
-  const declared = collectDeclaredPackages(ctx.files);
+  const harnessFiles = ctx.files.filter((f) => isUnder(f.path, scope.root) && !f.isDoc && !f.isTest);
+  const harnessCode = harnessFiles.map((f) => f.text);
+  const pyImported = new Set(harnessFiles.filter((f) => languageOf(f.path) === "python").flatMap((f) => extractImports("python", f.text).map((r) => r.spec)));
+  const usesPackage = (d) => {
+    if (d.eco !== "pypi") {
+      const re = new RegExp(`['"\`]${escapeRe(d.name)}(?:/[^'"\`]*)?['"\`]`);
+      return harnessCode.some((t) => re.test(t));
+    }
+    const modules = [d.name.toLowerCase().replace(/-/g, "_"), ...matchModule("pypi", d.name)?.signature.py ?? []];
+    return [...pyImported].some((spec) => modules.some((m) => spec === m || spec.startsWith(`${m}.`)));
+  };
+  const declared = collectDeclaredPackages(ctx.files).filter((d) => isUnder(d.path, scope.root) || !scope.configs.includes(d.path) || usesPackage(d));
   const packageJsons = parsePackageJsons(ctx.files);
   packageSignals(ctx, declared);
   const declaredPypi = new Set(declared.filter((d) => d.eco === "pypi").map((d) => d.name));
   const workspaceNames = new Set(packageJsons.map((p2) => typeof p2.json.name === "string" ? p2.json.name : "").filter(Boolean));
   const scan = scanSources(ctx, declaredPypi, workspaceNames);
   scanEnv(ctx);
+  sdkDefaultEnv(ctx, declared);
   const roots = projectRoots(ctx.files);
   const runtimeInput = { ctx, packageJsons, declared, frameworks: scan.frameworks };
   let runtimes = [
@@ -185253,6 +186149,12 @@ function detectDependencies(input) {
   ];
   runtimes = applyCloudRun(ctx, runtimes);
   runtimes = consolidateRuntimes(runtimes);
+  runtimes = foldNestedRuntimes(ctx, runtimes, harnessRoot);
+  runtimes = scopeRuntimes(ctx, runtimes, scope);
+  const runtimeConfigs = new Set(runtimes.flatMap((r) => r.configFiles));
+  ctx.signals = ctx.signals.filter((s) => s.kind !== "binding" || isUnder(s.evidence.path, scope.root) || runtimeConfigs.has(s.evidence.path));
+  ctx.signals = scopeComposeImages(ctx, scope);
+  ctx.env = ctx.env.filter((e) => e.scopeRoot === undefined || inScope(e.scopeRoot, scope) || isUnder(scope.root, e.scopeRoot));
   runtimes.sort((a, b) => cmp(a.root, b.root) || cmp(a.kind, b.kind));
   for (const rt of runtimes) {
     if (PLATFORM_KINDS.has(rt.kind) || rt.kind === "container" || PROCESS_KINDS.has(rt.kind)) {
@@ -185261,11 +186163,15 @@ function detectDependencies(input) {
       if (all.length > 0)
         rt.frameworks = all;
     }
+    resolveCommandHandlers(rt, ctx);
+    if (rt.entrypoints.some((e) => !e.name.startsWith("__main__ ")))
+      rt.entrypoints = rt.entrypoints.filter((e) => !e.name.startsWith("__main__ ") || e.trigger !== "cli");
     const serves = (rt.frameworks ?? []).some((f) => SERVER_FRAMEWORKS.has(f));
     for (const ep of rt.entrypoints) {
       if (ep.trigger === "unknown" && (serves || /gunicorn|uvicorn|hypercorn|daphne|waitress|next start|runserver|flask run|serve/.test((ep.command ?? []).join(" "))))
         ep.trigger = "http";
     }
+    rt.entrypoints = dedupeEntrypoints(rt);
     for (const ep of rt.entrypoints)
       if (ep.command)
         ep.command = ep.command.map((arg, i) => i === 2 && ep.command[0] === "sh" && ep.command[1] === "-c" ? redactScript(arg) : redactArg(arg));
@@ -185281,7 +186187,28 @@ function detectDependencies(input) {
     }
   }
   const migrations = detectMigrations(ctx);
+  const scriptLocal = scriptLocalFilter(ctx, runtimes);
+  ctx.env = ctx.env.filter((e) => !scriptLocal(e.source.split(/[: ]/)[0]));
+  if (ctx.manifest?.env) {
+    const env2 = ctx.manifest.env.flatMap((ref) => {
+      const sources = ref.sources.filter((src) => !scriptLocal(src.split(/[: ]/)[0]));
+      return ref.sources.length > 0 && sources.length === 0 ? [] : [{ ...ref, sources }];
+    });
+    ctx.manifest = { ...ctx.manifest, env: env2 };
+  }
   envSignals(ctx);
+  const touched = new Set(ctx.signals.filter((s) => isUnder(s.evidence.path, scope.root)).map((s) => s.provider));
+  for (const sig of ctx.signals) {
+    if (!scope.closure.some((c) => isUnder(sig.evidence.path, c)) || sig.capability === "model.inference")
+      continue;
+    if (sig.kind === "host" && sig.provider === "http" && !scope.closure.some((c) => isAuxiliary(sig.evidence.path, c)))
+      continue;
+    if (["host", "env", "env_value", "code"].includes(sig.kind) || !CLOSURE_CAPABILITIES.has(sig.capability) && !touched.has(sig.provider))
+      sig.weak = true;
+  }
+  for (const sig of ctx.signals)
+    if (isAuxiliary(sig.evidence.path, harnessRoot))
+      sig.weak = true;
   const dependencies = mergeSignals(ctx, runtimes);
   linkEnv(ctx, dependencies, runtimes);
   for (const m of migrations) {
@@ -185290,6 +186217,15 @@ function detectDependencies(input) {
     const candidates = dependencies.filter((d) => MIGRATION_ENGINE_PROVIDERS.has(d.provider) && (root === undefined || (d.runtimeRoots ?? []).includes(root)));
     resolveMigrationEngines([m], candidates.map((d) => d.provider), ctx);
   }
+  const keepSource = (source) => isRuntimeEnvSource(source) && !isAuxiliary(source.split(/[: ]/)[0], harnessRoot);
+  ctx.env = ctx.env.filter((e) => !isAmbientEnv(e.name) && keepSource(e.source));
+  if (ctx.manifest?.env) {
+    const env2 = ctx.manifest.env.flatMap((ref) => {
+      const sources = ref.sources.filter(keepSource);
+      return ref.sources.length > 0 && sources.length === 0 ? [] : [{ ...ref, sources }];
+    });
+    ctx.manifest = { ...ctx.manifest, env: env2 };
+  }
   const env = buildEnvReferences(ctx, dependencies);
   return {
     schema: DEPENDENCY_MAP_SCHEMA,
@@ -185388,15 +186324,16 @@ var CACHE_FILE_PATTERNS = [
   [/^\.yarn-integrity$/, "yarn_integrity"],
   [/^install-state\.gz$/, "yarn_install_state"]
 ];
-var ENV_EXAMPLE_SUFFIXES = new Set(["example", "sample", "template", "dist", "defaults.example", "tpl"]);
+var ENV_TEMPLATE_WORDS = new Set(["example", "examples", "sample", "template", "dist", "tpl", "default", "defaults"]);
 function isEnvExampleName(name) {
   const lower = name.toLowerCase();
-  for (const prefix of [".env.", ".dev.vars.", "env."]) {
-    if (lower.startsWith(prefix) && ENV_EXAMPLE_SUFFIXES.has(lower.slice(prefix.length)))
-      return true;
-  }
-  return /^(example|sample|template)\.env$/.test(lower) || /\.env\.(example|sample|template)$/.test(lower);
+  const base = /^(\.env|\.dev\.vars|env)\./.exec(lower);
+  if (base)
+    return lower.slice(base[0].length).split(".").some((part) => ENV_TEMPLATE_WORDS.has(part));
+  const named = /^(.+)\.env$/.exec(lower);
+  return named !== null && named[1].split(".").some((part) => ENV_TEMPLATE_WORDS.has(part));
 }
+var ENV_VALUE_FILE_RULES = new Set(["dotenv", "direnv", "wrangler_dev_vars"]);
 function secretPathRule(path) {
   const name = basenameOf(path);
   const lower = name.toLowerCase();
@@ -185417,7 +186354,7 @@ function secretPathRule(path) {
     return "key_material_file";
   if (/^id_(rsa|dsa|ecdsa|ed25519)/.test(lower))
     return "ssh_key";
-  if (lower === "credentials.json" || lower === "credentials" || lower === "credentials.yml" || lower === "credentials.yaml") {
+  if (/^credentials(\.(json|ya?ml|toml|conf|cfg|ini|txt|env|properties|xml|csv))?$/.test(lower) || /\.credentials$/.test(lower)) {
     return "credentials_file";
   }
   if (/(^|\/)\.aws\/(credentials|config)$/.test(lowerPath))
@@ -185453,34 +186390,58 @@ function secretPathRule(path) {
     return "secrets_file";
   return null;
 }
-function registryAuthRule(path, text) {
+var PROVIDER_MARKER = /^(?:sk-ant-(?:api|admin|oat)\d{2}-|sk-or-v1-|sk-(?:proj|svcacct|admin)-|sk-|(?:sk|rk)_(?:live|test)_|gh[pousr]_|github_pat_|glpat-|xox[abposr]-|whsec_|gsk_|hf_|xai-|npm_|pypi-|do[opr]_v1_|shp(?:at|ca|pa|ss)_|moda_(?:sk|ct)_)/;
+function registryAuthFindings(path, text) {
   const name = basenameOf(path).toLowerCase();
   const literal = (value) => value.trim() !== "" && !/^["']?\$\{?[A-Za-z_]/.test(value.trim());
-  if (name === ".npmrc") {
-    for (const match of text.matchAll(/(?:_authToken|_auth|_password)\s*=\s*(.*)/g)) {
-      if (literal(match[1] ?? ""))
-        return "npmrc_auth_token";
-    }
-  }
-  if (name === ".yarnrc.yml" || name === ".yarnrc") {
-    for (const match of text.matchAll(/npmAuth(?:Token|Ident)\s*:\s*(.*)/g)) {
-      if (literal(match[1] ?? ""))
-        return "yarnrc_auth_token";
-    }
-  }
-  if (name === ".pypirc") {
-    for (const match of text.matchAll(/^\s*password\s*[=:]\s*(.*)$/gm)) {
-      if (literal(match[1] ?? ""))
-        return "pypirc_password";
+  const out = [];
+  const scan = (pattern, rule2, check, yaml = false) => {
+    for (const match of text.matchAll(pattern)) {
+      if (!check(match[1] ?? ""))
+        continue;
+      const [from] = match.indices[1];
+      let raw = match[1];
+      if (yaml) {
+        const quoted = /^\s*(?:"(?:[^"\\\n]|\\.)*"|'(?:[^'\n]|'')*')/.exec(raw);
+        raw = quoted ? quoted[0] : raw.replace(/\s+#.*$/, "");
+      }
+      const lead = raw.length - raw.replace(/^[\s"']+/, "").length;
+      const value = raw.replace(/[\s"']+$/, "");
+      if (value.length <= lead)
+        continue;
+      out.push({ rule: rule2, line: 0, start: from + lead, end: from + value.length });
     }
-  }
+  };
+  if (name === ".npmrc")
+    scan(/(?:_authToken|_auth|_password)\s*=\s*(.*)/dg, "npmrc_auth_token", literal);
+  if (name === ".yarnrc.yml" || name === ".yarnrc")
+    scan(/npmAuth(?:Token|Ident)\s*:\s*(.*)/dg, "yarnrc_auth_token", literal, name === ".yarnrc.yml");
+  if (name === ".pypirc")
+    scan(/^\s*password\s*[=:]\s*(.*)$/dgm, "pypirc_password", literal);
   if (name === "pip.conf" || name === "pip.ini" || name === "poetry.toml" || name === "bunfig.toml" || name === ".condarc") {
-    if (/https?:\/\/[^\s/:@]+:[^\s/@$]+@/.test(text))
-      return "registry_url_credentials";
+    scan(/https?:\/\/[^\s/:@]+:([^\s/?#]+)@[^\s/?#@]+/dg, "registry_url_credentials", (value) => !value.startsWith("$"));
+  }
+  if (name === "settings.xml")
+    scan(/<password>(?!\s*\$\{)([^<]+)<\/password>/dg, "maven_settings_password", () => true);
+  out.sort((a, b) => a.start - b.start);
+  let line = 1;
+  let cursor = 0;
+  for (const finding of out) {
+    for (;cursor < finding.start; cursor += 1)
+      if (text.charCodeAt(cursor) === 10)
+        line += 1;
+    finding.line = line;
   }
-  if (name === "settings.xml" && /<password>(?!\s*\$\{)[^<]+<\/password>/.test(text))
-    return "maven_settings_password";
-  return null;
+  return out;
+}
+function registryAuthRule(path, text) {
+  return registryAuthFindings(path, text)[0]?.rule ?? null;
+}
+var LOG_DIRS = new Set(["logs", ".logs"]);
+function runtimeLogRule(path, status) {
+  if (status === "tracked")
+    return null;
+  return /\.log(\.\d+)?$/i.test(basenameOf(path)) ? { reason: "regenerable_output", rule: "runtime_log" } : null;
 }
 function dirRule(dirPath, status) {
   const name = basenameOf(dirPath);
@@ -185491,6 +186452,8 @@ function dirRule(dirPath, status) {
   }
   if (status === "tracked")
     return null;
+  if (LOG_DIRS.has(name))
+    return { reason: "regenerable_output", rule: "runtime_log" };
   if (DEPENDENCY_DIRS.has(name) || DEPENDENCY_DIR_SUFFIXES.some((s) => hasSuffix(dirPath, s))) {
     return { reason: "dependency_install", rule: name };
   }
@@ -186222,12 +187185,21 @@ class EnvCollector {
     }
   }
   scanDotenv(path, lines) {
+    let open = null;
     lines.forEach((line, index) => {
+      if (open) {
+        if (closesQuote(line, open, 0))
+          open = null;
+        return;
+      }
       const m = line.match(new RegExp(`^\\s*(?:export\\s+)?(${NAME})\\s*=\\s*(.*)$`));
       if (!m)
         return;
-      const value = stripInlineValue(m[2] ?? "");
-      this.add(m[1], `${path}:${index + 1}`, value !== "");
+      this.add(m[1], `${path}:${index + 1}`, false);
+      const value = m[2] ?? "";
+      const quote = value[0];
+      if ((quote === '"' || quote === "'" || quote === "`") && !closesQuote(value, quote, 1))
+        open = quote;
     });
   }
   scanDestructuring(path, line, lineNo) {
@@ -186468,6 +187440,15 @@ function shellExpandable(line) {
   }
   return out;
 }
+function closesQuote(text, quote, from) {
+  for (let i = from;i < text.length; i += 1) {
+    if (text[i] === "\\" && quote !== "'")
+      i += 1;
+    else if (text[i] === quote)
+      return true;
+  }
+  return false;
+}
 function stripInlineValue(raw) {
   let value = raw.trim();
   if (/^["']/.test(value)) {
@@ -186587,6 +187568,24 @@ function lsFiles(root, args) {
     throw new Error(`git ls-files ${args.join(" ")} failed in ${root}`);
   return result.stdout.split("\x00").filter((entry) => entry !== "");
 }
+function ignoredPaths(root) {
+  const result = git(root, ["status", "--porcelain=v1", "-z", "--ignored=matching", "--untracked-files=all"]);
+  if (!result.ok)
+    throw new Error(`git status --ignored failed in ${root}`);
+  const out = [];
+  const fields = result.stdout.split("\x00");
+  for (let i = 0;i < fields.length; i += 1) {
+    const field = fields[i];
+    if (field.length < 4)
+      continue;
+    const code = field.slice(0, 2);
+    if (code === "!!")
+      out.push(field.slice(3));
+    else if (code[0] === "R" || code[0] === "C")
+      i += 1;
+  }
+  return out;
+}
 function gitMetadata(root) {
   const commit = git(root, ["rev-parse", "--verify", "-q", "HEAD"]);
   const branch = git(root, ["symbolic-ref", "--short", "-q", "HEAD"]);
@@ -186877,7 +187876,6 @@ function shannonEntropy(value) {
   return entropy;
 }
 var notPlaceholder = (value) => !looksLikePlaceholder(value);
-var LOCAL_HOSTS = /^(localhost|127\.0\.0\.1|0\.0\.0\.0|\[::1\]|::1|host\.docker\.internal|[a-z0-9_-]+)(:\d+)?$/i;
 var WEAK_PASSWORDS = new Set([
   "password",
   "pass",
@@ -186903,9 +187901,20 @@ var WEAK_PASSWORDS = new Set([
 var SECRET_RULES = [
   {
     name: "private_key_block",
-    pattern: /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----(?:(?:\r?\n|(?:\\r)?\\n)[A-Za-z][A-Za-z0-9-]*:[^\r\n\\]*)*(?:\\n|\\r|\s)+([A-Za-z0-9+/=]{32,})/g,
+    pattern: /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----(?:(?:\r?\n|(?:\\r)?\\n)[A-Za-z][A-Za-z0-9-]*:[^\r\n\\]*)*(?:\\n|\\r|\s)+([A-Za-z0-9+/=]{32,8192})/g,
     group: 1,
-    accept: notPlaceholder
+    accept: notPlaceholder,
+    withholdFile: true
+  },
+  {
+    name: "private_key_block",
+    pattern: /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----([^-]{1,8192}?)-----END (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----/g,
+    group: 1,
+    accept: (body) => {
+      const compact = body.replace(/\\[rn]|\s/g, "");
+      return compact.length >= 16 && /^[A-Za-z0-9+/=:,-]+$/.test(compact) && !/x{4,}|X{4,}|\.\.\./.test(compact);
+    },
+    withholdFile: true
   },
   {
     name: "aws_access_key_id",
@@ -186919,57 +187928,60 @@ var SECRET_RULES = [
     group: 1,
     accept: (value) => !/EXAMPLE/.test(value) && notPlaceholder(value)
   },
-  { name: "anthropic_api_key", pattern: /\bsk-ant-(?:api|admin|oat)\d{2}-([A-Za-z0-9_-]{32,})/g, group: 1, accept: (v) => randomLooking(v, 32) },
-  { name: "openrouter_api_key", pattern: /\bsk-or-v1-[a-f0-9]{48,}\b/g, accept: notPlaceholder },
+  { name: "anthropic_api_key", pattern: /\bsk-ant-(?:api|admin|oat)\d{2}-([A-Za-z0-9_-]{32,512})(?![A-Za-z0-9_-])/g, group: 1, accept: (v) => randomLooking(v, 32) },
+  { name: "openrouter_api_key", pattern: /\bsk-or-v1-[a-f0-9]{48,512}\b/g, accept: notPlaceholder },
   {
     name: "openai_api_key",
-    pattern: /\bsk-(?!ant-|or-)(?:proj-|svcacct-|admin-|None-)?([A-Za-z0-9_-]{32,})/g,
+    pattern: /\bsk-(?!ant-|or-)(?:proj-|svcacct-|admin-|None-)?([A-Za-z0-9_-]{32,512})(?![A-Za-z0-9_-])/g,
     group: 1,
     accept: (value) => randomLooking(value, 32)
   },
-  { name: "groq_api_key", pattern: /\bgsk_[A-Za-z0-9]{40,}\b/g, accept: notPlaceholder },
+  { name: "groq_api_key", pattern: /\bgsk_[A-Za-z0-9]{40,512}\b/g, accept: notPlaceholder },
   { name: "google_api_key", pattern: /\bAIza[0-9A-Za-z_-]{35}\b/g, accept: notPlaceholder },
-  { name: "huggingface_token", pattern: /\bhf_[A-Za-z0-9]{30,}\b/g, accept: notPlaceholder },
-  { name: "xai_api_key", pattern: /\bxai-[A-Za-z0-9]{40,}\b/g, accept: notPlaceholder },
-  { name: "github_token", pattern: /\b(?:gh[pousr]_([A-Za-z0-9]{36,})|github_pat_([A-Za-z0-9_]{60,}))\b/g, accept: (_v, m) => randomLooking(m[1] ?? m[2] ?? "", 36) },
-  { name: "gitlab_token", pattern: /\bglpat-[A-Za-z0-9_-]{20,}\b/g, accept: notPlaceholder },
-  { name: "slack_token", pattern: /\bxox[abposr]-[A-Za-z0-9-]{10,}/g, accept: notPlaceholder },
+  { name: "huggingface_token", pattern: /\bhf_[A-Za-z0-9]{30,512}\b/g, accept: notPlaceholder },
+  { name: "xai_api_key", pattern: /\bxai-[A-Za-z0-9]{40,512}\b/g, accept: notPlaceholder },
+  { name: "github_token", pattern: /\b(?:gh[pousr]_([A-Za-z0-9]{36,512})|github_pat_([A-Za-z0-9_]{60,512}))\b/g, accept: (_v, m) => randomLooking(m[1] ?? m[2] ?? "", 36) },
+  { name: "gitlab_token", pattern: /\bglpat-[A-Za-z0-9_-]{20,512}\b/g, accept: notPlaceholder },
+  { name: "slack_token", pattern: /\bxox[abposr]-[A-Za-z0-9-]{10,512}(?![A-Za-z0-9-])/g, accept: notPlaceholder },
   {
     name: "slack_webhook",
-    pattern: /https:\/\/hooks\.slack\.com\/services\/T[A-Z0-9]+\/B[A-Z0-9]+\/[A-Za-z0-9]{16,}/g,
+    pattern: /https:\/\/hooks\.slack\.com\/services\/T[A-Z0-9]+\/B[A-Z0-9]+\/[A-Za-z0-9]{16,512}/g,
     accept: notPlaceholder
   },
-  { name: "stripe_secret_key", pattern: /\b(?:sk|rk)_(?:live|test)_([A-Za-z0-9]{20,})\b/g, group: 1, accept: (v) => randomLooking(v, 20) },
-  { name: "stripe_webhook_secret", pattern: /\bwhsec_[A-Za-z0-9]{24,}\b/g, accept: notPlaceholder },
+  { name: "stripe_secret_key", pattern: /\b(?:sk|rk)_(?:live|test)_([A-Za-z0-9]{20,512})\b/g, group: 1, accept: (v) => randomLooking(v, 20) },
+  { name: "stripe_webhook_secret", pattern: /\bwhsec_[A-Za-z0-9]{24,512}\b/g, accept: notPlaceholder },
   { name: "sendgrid_api_key", pattern: /\bSG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}\b/g, accept: notPlaceholder },
   { name: "npm_token", pattern: /\bnpm_[A-Za-z0-9]{36}\b/g, accept: notPlaceholder },
-  { name: "pypi_token", pattern: /\bpypi-AgEIcHlwaS5vcmc[A-Za-z0-9_-]{50,}/g, accept: notPlaceholder },
+  { name: "pypi_token", pattern: /\bpypi-AgEIcHlwaS5vcmc[A-Za-z0-9_-]{50,512}(?![A-Za-z0-9_-])/g, accept: notPlaceholder },
   { name: "digitalocean_token", pattern: /\bdo[opr]_v1_[a-f0-9]{64}\b/g, accept: notPlaceholder },
   { name: "shopify_token", pattern: /\bshp(?:at|ca|pa|ss)_[a-fA-F0-9]{32}\b/g, accept: notPlaceholder },
   { name: "databricks_token", pattern: /\bdapi[a-f0-9]{32}\b/g, accept: notPlaceholder },
-  { name: "moda_api_key", pattern: /\bmoda_(?:sk|ct)_([A-Za-z0-9_-]{32,})/g, group: 1, accept: (v) => randomLooking(v, 32) },
+  { name: "moda_api_key", pattern: /\bmoda_(?:sk|ct)_([A-Za-z0-9_-]{32,512})(?![A-Za-z0-9_-])/g, group: 1, accept: (v) => randomLooking(v, 32) },
   {
     name: "jwt",
-    pattern: /\b(eyJ[A-Za-z0-9_-]{10,})\.eyJ[A-Za-z0-9_-]{10,}\.([A-Za-z0-9_-]{16,})/g,
+    pattern: /\b(eyJ[A-Za-z0-9_-]{10,1024})\.eyJ[A-Za-z0-9_-]{10,65536}\.([A-Za-z0-9_-]{16,1024})(?![A-Za-z0-9_-])/g,
     accept: (_v, m) => isJwtHeader(m[1] ?? "") && !KNOWN_SAMPLE_JWT_SIGNATURES.has(m[2] ?? "") && notPlaceholder(m[2] ?? "")
   },
+  {
+    name: "bearer_token",
+    pattern: /\bBearer[ \t]+([A-Za-z0-9._~+/=-]{20,65536})(?![A-Za-z0-9._~+/=-])/g,
+    group: 1,
+    accept: (value) => !looksLikePlaceholder(value) && /[0-9]/.test(value) && /[A-Za-z]/.test(value)
+  },
   {
     name: "url_embedded_credentials",
-    pattern: /\b(?:postgres(?:ql)?|mysql|mariadb|mongodb(?:\+srv)?|rediss?|amqps?|mssql|sqlserver|clickhouse|https?):\/\/([^:\s/@'"]+):([^@\s/'"]{3,})@([^/\s'"?#]+)/g,
+    pattern: /\b(?:postgres(?:ql)?|mysql|mariadb|mongodb(?:\+srv)?|rediss?|amqps?|mssql|sqlserver|clickhouse|https?):\/\/([^:\s/@'"]{1,256}):([^\s/?#'"]{3,65536})@([^/\s'"?#@]+)/g,
     group: 2,
-    accept: (password, match) => {
-      const host = match[3] ?? "";
+    accept: (password) => {
       if (WEAK_PASSWORDS.has(password.toLowerCase()))
         return false;
-      if (looksLikePlaceholder(password) || /^[$%:]/.test(password))
-        return false;
-      return !LOCAL_HOSTS.test(host);
+      return !looksLikePlaceholder(password) && !/^[$%:{]/.test(password);
     }
   },
   {
     name: "generic_secret_assignment",
     heuristic: true,
-    pattern: /\b([A-Za-z][A-Za-z0-9_-]*)["']?\s*[:=]\s*(["'`])([A-Za-z0-9+/=_\-.~]{16,})\2/g,
+    pattern: /\b([A-Za-z][A-Za-z0-9_-]{0,127})["']?[ \t]*[:=][ \t]*(["'`])([A-Za-z0-9+/=_\-.~]{16,})\2/g,
     group: 3,
     accept: (value, match) => isSecretName(match[1] ?? "") && isSecretLikeValue(value)
   },
@@ -186977,7 +187989,7 @@ var SECRET_RULES = [
     name: "generic_secret_assignment",
     heuristic: true,
     configOnly: true,
-    pattern: /^\s*(?:export\s+)?([A-Za-z][A-Za-z0-9_-]*)\s*[:=]\s*([A-Za-z0-9+/=_\-.~]{16,})\s*(?:#.*)?$/gm,
+    pattern: /^[ \t]*(?:export[ \t]+)?([A-Za-z][A-Za-z0-9_-]{0,127})[ \t]*[:=][ \t]*([A-Za-z0-9+/=_\-.~]{16,512})[ \t]*(?:#.*)?$/gm,
     group: 2,
     accept: (value, match) => isSecretName(match[1] ?? "") && isSecretLikeValue(value)
   }
@@ -187035,6 +188047,842 @@ function scanForSecrets(text, opts) {
   }
   return null;
 }
+var INDEXED = new Map;
+function withIndices(pattern) {
+  let indexed = INDEXED.get(pattern);
+  if (!indexed) {
+    indexed = new RegExp(pattern.source, `${pattern.flags.replace("d", "")}d`);
+    INDEXED.set(pattern, indexed);
+  }
+  return indexed;
+}
+function findSecretSpans(text, opts) {
+  const spans = [];
+  for (const rule2 of SECRET_RULES) {
+    if (rule2.heuristic && !opts.heuristics)
+      continue;
+    if (rule2.configOnly && !opts.config)
+      continue;
+    const pattern = withIndices(rule2.pattern);
+    pattern.lastIndex = 0;
+    for (const match of text.matchAll(pattern)) {
+      const group = rule2.group ?? 0;
+      const value = match[group] ?? "";
+      if (rule2.accept && !rule2.accept(value, match))
+        continue;
+      const range = match.indices?.[group] ?? [match.index ?? 0, (match.index ?? 0) + match[0].length];
+      spans.push({ rule: rule2.name, start: range[0], end: range[1], withholdFile: rule2.withholdFile === true });
+    }
+  }
+  return spans;
+}
+
+// ../../packages/harness-bundle/src/collect/redact.ts
+var CONFIG_EXT = /\.(ya?ml|toml|json|jsonc|json5|properties|ini|cfg|conf|env|tfvars|hcl|cnf|nix)$/i;
+var CONFIG_NAMES = /^(\.npmrc|\.yarnrc|\.yarnrc\.yml|\.pypirc|pip\.conf|pip\.ini|\.condarc|\.netrc|\.envrc|\.dev\.vars.*|\.env.*|[^/]*\.env|dockerfile.*|containerfile.*|.*\.dockerfile|procfile|settings\.xml)$/i;
+function isConfigLike(path) {
+  const name = basenameOf(path);
+  return CONFIG_EXT.test(name) || CONFIG_NAMES.test(name);
+}
+var CREDENTIAL_WORDS = new Set([
+  "token",
+  "secret",
+  "password",
+  "passwd",
+  "pwd",
+  "passphrase",
+  "credential",
+  "credentials",
+  "dsn",
+  "apikey"
+]);
+var NOT_CREDENTIAL_WORDS = new Set([
+  "public",
+  "publishable",
+  "anon",
+  "primary",
+  "foreign",
+  "sort",
+  "partition",
+  "cache",
+  "idempotency",
+  "dedup",
+  "lookup",
+  "index",
+  "hash",
+  "column",
+  "cursor",
+  "row",
+  "composite",
+  "unique",
+  "map",
+  "dict"
+]);
+var KEY_QUALIFIERS = new Set([
+  "api",
+  "access",
+  "secret",
+  "private",
+  "signing",
+  "encryption",
+  "enc",
+  "master",
+  "service",
+  "auth",
+  "client",
+  "license",
+  "app",
+  "webhook",
+  "session",
+  "jwt",
+  "hmac",
+  "admin",
+  "bearer",
+  "account",
+  "subscription",
+  "crypto",
+  "cipher",
+  "root",
+  "role",
+  "write",
+  "read",
+  "deploy",
+  "gateway",
+  "aes",
+  "creds",
+  "credential",
+  "credentials",
+  "pat",
+  "sas",
+  "shared"
+]);
+var IDENTIFIER_KEY_WORDS = new Set([
+  "s3",
+  "r2",
+  "gcs",
+  "blob",
+  "object",
+  "output",
+  "path",
+  "plugin",
+  "file",
+  "prompt",
+  "config",
+  "json",
+  "user",
+  "storage",
+  "routing",
+  "shard",
+  "message",
+  "event",
+  "bucket",
+  "record",
+  "i18n",
+  "translation",
+  "metric",
+  "label",
+  "group",
+  "state",
+  "query",
+  "field",
+  "attribute",
+  "property",
+  "tag",
+  "header",
+  "item",
+  "table",
+  "range",
+  "prefix",
+  "ssh",
+  "gpg",
+  "pgp",
+  "idem",
+  "sort",
+  "partition",
+  "cache",
+  "lookup",
+  "index",
+  "hash",
+  "column",
+  "row",
+  "map",
+  "dict",
+  "composite",
+  "unique"
+]);
+function isCredentialName(rawName) {
+  const name = rawName.split(/[./:\\]/).filter(Boolean).pop() ?? rawName;
+  const words = name.replace(/([a-z0-9])([A-Z])/g, "$1_$2").split(/[_\-\s]+/).filter(Boolean).map((w) => w.toLowerCase());
+  const last = words[words.length - 1];
+  const previous = words[words.length - 2];
+  if (!last || words.slice(0, -1).some((w) => NOT_CREDENTIAL_WORDS.has(w)))
+    return false;
+  if (CREDENTIAL_WORDS.has(last))
+    return true;
+  if (/^_auth$/i.test(name) || last === "ident" && previous === "auth")
+    return true;
+  if (last !== "key" || !previous)
+    return false;
+  if (KEY_QUALIFIERS.has(previous))
+    return true;
+  return /^[A-Z][A-Z0-9]*(_[A-Z0-9]+)+$/.test(name) && !IDENTIFIER_KEY_WORDS.has(previous);
+}
+function isCredentialValue(raw) {
+  const value = raw.trim();
+  if (value.length < 4 || /[\s\p{C}]/u.test(value))
+    return false;
+  if (/^(true|false|null|none|nil|undefined|yes|no|on|off|~)$/i.test(value))
+    return false;
+  if (/^\$\{?[A-Za-z_]/.test(value) || /\$\{\{|\{\{|%\(|^\$\(/.test(value))
+    return false;
+  if (/^(?:os\.environ(?:\.get)?|os\.getenv|process\.env|import\.meta\.env|Deno\.env\.get|System\.getenv|getenv|ENV)(?:\(.*\)|\[.*\]|\.[A-Za-z_]\w*)$/.test(value))
+    return false;
+  if (/^(env|secret|vault|op|arn|ssm|awssecretsmanager|azurekeyvault|sm|gcpsm|projects)[:(/]/i.test(value) || /^@Microsoft\.KeyVault/i.test(value))
+    return false;
+  if (/^<.*>$/.test(value) || /^#\//.test(value))
+    return false;
+  if (/^(\/|\.\.?\/|~\/|[A-Za-z]:\\)/.test(value))
+    return false;
+  if (/^[a-z][a-z0-9+.-]*:\/\//i.test(value) && !/^[a-z][a-z0-9+.-]*:\/\/[^/@\s]+@/i.test(value))
+    return false;
+  if (/^[-+]?\d*\.?\d+(e[-+]?\d+)?$/i.test(value))
+    return false;
+  if (/^[\^~<>=v]*\d+(\.(\d+|x|\*)){0,3}([-+.][\w.-]+)?$/i.test(value))
+    return false;
+  if (/^(workspace|npm|file|link|portal|patch|catalog|git\+\w+|github|gitlab):/i.test(value) || /^(latest|next|canary|beta|\*)$/i.test(value))
+    return false;
+  if (WEAK_PASSWORDS.has(value.toLowerCase()))
+    return false;
+  if (/^(.)\1+$/.test(value) || sequentialRuns(value) >= 2)
+    return false;
+  if (/x{4,}|X{4,}|\*{3,}|\.\.\.|(^|[-_.])your[-_.]|changeme|change[-_]me|placeholder|example|replace[-_]?me|redacted|dummy|(^|[-_.])(fake|mock|sample|test|demo)([-_.]|$)/i.test(value))
+    return false;
+  const classes = [/[a-z]/, /[A-Z]/, /[0-9]/, /[^A-Za-z0-9]/].filter((re) => re.test(value)).length;
+  return /[0-9]/.test(value) || value.length >= 20 && classes >= 3;
+}
+var PREFIX = String.raw`[ \t]*(?:-[ \t]+)?(?:export[ \t]+|ENV[ \t]+|ARG[ \t]+)?`;
+var EQUALS_LINE = new RegExp(String.raw`^(${PREFIX})(["']?)([A-Za-z_@/][\w.\-/:@]*)\2[ \t]*=[ \t]*(.*)$`, "gm");
+var COLON_LINE = new RegExp(String.raw`^(${PREFIX})(["']?)([A-Za-z_@][\w.\-/@]*)\2[ \t]*:(?:[ \t]+|(?=["']))(.*)$`, "gm");
+function closingQuote(text, open, lineEnd) {
+  const quote = text[open];
+  for (let i = open + 1;i < lineEnd; i += 1) {
+    if (text[i] === "\\" && quote === '"') {
+      i += 1;
+      continue;
+    }
+    if (quote === "'" && text[i] === quote && text[i + 1] === quote) {
+      i += 1;
+      continue;
+    }
+    if (text[i] === quote)
+      return i;
+  }
+  return -1;
+}
+function isDockerfile(path) {
+  const name = basenameOf(path);
+  return /^(dockerfile|containerfile)/i.test(name) || /\.dockerfile$/i.test(name);
+}
+function valueEnds(path, envFile) {
+  const chars = isDockerfile(path) ? "\\s" : envFile ? "\\s;" : "\\s,;)\\]}";
+  return { terminator: new RegExp(`[${chars}]`), segmentEnd: new RegExp(`[${chars}"'\`]`) };
+}
+function dockerfileEnvSpans(source, detected) {
+  const directives = /^(?:[ \t]*#[ \t]*[A-Za-z]+[ \t]*=[^\n]*\n)*/.exec(source)[0];
+  const backtick = /^[ \t]*#[ \t]*escape[ \t]*=[ \t]*`[ \t]*\r?$/im.test(directives);
+  const text = backtick ? source.replace(/[`\\]/g, (ch) => ch === "`" ? "\\" : "`") : source;
+  const spans = [];
+  const known = [...detected].sort((a, b) => a.start - b.start);
+  let nextKnown = 0;
+  let knownEnd = -1;
+  let covered = -1;
+  const skipIgnored = (from) => {
+    let q = from;
+    while (q < text.length) {
+      const lineEnd = text.indexOf(`
+`, q) === -1 ? text.length : text.indexOf(`
+`, q);
+      if (!/^[ \t]*(?:#.*)?\r?$/.test(text.slice(q, lineEnd)) || lineEnd === text.length)
+        break;
+      q = lineEnd + 1;
+    }
+    return q;
+  };
+  for (const m of text.matchAll(/^[ \t]*(ENV|ARG)[ \t]+/gim)) {
+    if (m.index < covered)
+      continue;
+    let p2 = m.index + m[0].length;
+    let instructionEnd = text.indexOf(`
+`, p2);
+    while (instructionEnd !== -1) {
+      let slash = instructionEnd - (text[instructionEnd - 1] === "\r" ? 1 : 0);
+      const end = slash;
+      while (slash > p2 && text[slash - 1] === "\\")
+        slash -= 1;
+      if ((end - slash) % 2 === 0)
+        break;
+      instructionEnd = text.indexOf(`
+`, skipIgnored(instructionEnd + 1));
+    }
+    if (instructionEnd === -1)
+      instructionEnd = text.length;
+    covered = instructionEnd;
+    let first = true;
+    for (;; ) {
+      for (;; ) {
+        if (text[p2] === " " || text[p2] === "\t" || text[p2] === "\r")
+          p2 += 1;
+        else if (text.startsWith("\\\n", p2))
+          p2 = skipIgnored(p2 + 2);
+        else if (text.startsWith(`\\\r
+`, p2))
+          p2 = skipIgnored(p2 + 3);
+        else
+          break;
+      }
+      const rest = text.slice(p2, Math.min(p2 + 256, instructionEnd));
+      let name = /^(["']?)([A-Za-z_][\w.-]*)\1=/.exec(rest);
+      const legacy = !name && first && m[1].toUpperCase() === "ENV";
+      if (legacy)
+        name = /^(["']?)([A-Za-z_][\w.-]*)\1[ \t]+/.exec(rest);
+      if (!name)
+        break;
+      first = false;
+      p2 += name[0].length;
+      const valueStart = p2;
+      const parts = [];
+      const addPart = (start, end) => {
+        let from = start;
+        for (const continuation of text.slice(start, end).matchAll(/\\\r?\n/g)) {
+          const stop = start + continuation.index;
+          if (stop > from)
+            parts.push({ start: from, end: stop, rule: "credential_assignment" });
+          from = stop + continuation[0].length;
+        }
+        if (end > from)
+          parts.push({ start: from, end, rule: "credential_assignment" });
+      };
+      let literal = "";
+      while (p2 < instructionEnd && (legacy || !/\s/.test(text[p2]))) {
+        const q = text[p2];
+        if (q === '"' || q === "'") {
+          const close = closingQuote(text, p2, instructionEnd);
+          const end = close === -1 ? instructionEnd : close;
+          addPart(p2 + 1, end);
+          literal += text.slice(p2 + 1, end);
+          p2 = close === -1 ? instructionEnd : close + 1;
+        } else {
+          let e = p2;
+          while (e < instructionEnd && !(legacy ? /["']/ : /[\s"']/).test(text[e])) {
+            if (text[e] === "\\" && e + 1 < instructionEnd)
+              e += text.startsWith(`\\\r
+`, e) ? 3 : 2;
+            else
+              e += 1;
+          }
+          addPart(p2, e);
+          literal += text.slice(p2, e);
+          p2 = e;
+        }
+      }
+      while (nextKnown < known.length && known[nextKnown].start < valueStart) {
+        knownEnd = Math.max(knownEnd, known[nextKnown++].end);
+      }
+      const hasSecret = knownEnd > valueStart || nextKnown < known.length && known[nextKnown].start < p2;
+      const value = literal.replace(/\\\r?\n/g, "").replace(/\\(.)/g, "$1").trim();
+      if (isCredentialName(name[2]) && (hasSecret || value.split(/[ \t]+/).some(isCredentialValue)))
+        for (const part of parts)
+          spans.push(part);
+      if (legacy)
+        break;
+    }
+  }
+  return spans;
+}
+function assignmentSpans(text, everyValue, path, ends) {
+  const toml = /\.toml$/i.test(path);
+  const spans = [];
+  const seenLines = new Set;
+  for (const pattern of [EQUALS_LINE, COLON_LINE]) {
+    pattern.lastIndex = 0;
+    for (const m of text.matchAll(pattern)) {
+      const lineStart = m.index ?? 0;
+      if (seenLines.has(lineStart))
+        continue;
+      seenLines.add(lineStart);
+      const name = m[3];
+      const rest = m[4];
+      const restStart = lineStart + m[0].length - rest.length;
+      let value = valueBounds(rest, everyValue, toml) ?? multilineQuoted(text, restStart, toml);
+      if (!value && everyValue && rest.trim() !== "")
+        value = { start: 0, end: rest.replace(/[ \t]+$/, "").length };
+      if (!value)
+        continue;
+      const extra = [];
+      if (value.start > 0) {
+        const lineEnd = text.indexOf(`
+`, restStart + value.end) === -1 ? text.length : text.indexOf(`
+`, restStart + value.end);
+        let p2 = restStart + value.end + value.start;
+        while (p2 < lineEnd && !ends.terminator.test(text[p2])) {
+          const q = text[p2];
+          if (q === '"' || q === "'" || q === "`") {
+            const close = closingQuote(text, p2, lineEnd);
+            const contentEnd = close === -1 ? lineEnd : close;
+            if (contentEnd > p2 + 1)
+              extra.push({ start: p2 + 1, end: contentEnd, rule: "" });
+            p2 = close === -1 ? lineEnd : close + 1;
+          } else {
+            let e = p2;
+            while (e < lineEnd && !ends.segmentEnd.test(text[e]))
+              e += 1;
+            extra.push({ start: p2, end: e, rule: "" });
+            p2 = e;
+          }
+        }
+        if (everyValue && p2 < lineEnd) {
+          const line = text.slice(p2, lineEnd);
+          const comment = line.search(/[ \t]+#/);
+          const body = (comment === -1 ? line : line.slice(0, comment)).replace(/[ \t\r]+$/, "");
+          const lead = body.length - body.replace(/^[\s,;)\]}]+/, "").length;
+          if (body.length > lead)
+            extra.push({ start: p2 + lead, end: p2 + body.length, rule: "" });
+        }
+      }
+      const joined = extra.length > 0;
+      const rule2 = everyValue ? "env_value" : "credential_assignment";
+      const literal = rest.slice(value.start, Math.min(value.end, rest.length)) + (value.end > rest.length ? text.slice(restStart + rest.length, restStart + value.end) : "");
+      if (!everyValue && /\.(hcl|tfvars)$/i.test(path) && value.start === 0 && /^[A-Za-z_]\w*(?:\.|\[|\()/.test(literal))
+        continue;
+      if (everyValue ? literal.trim() === "" : !(isCredentialName(name) && (joined || isCredentialValue(literal))))
+        continue;
+      spans.push({ start: restStart + value.start, end: restStart + value.end, rule: rule2 });
+      for (const span of extra)
+        spans.push({ ...span, rule: rule2 });
+    }
+  }
+  return spans;
+}
+function unparsedEnvLines(text, covered) {
+  const out = [];
+  const assignment = new RegExp(String.raw`^${PREFIX}(["']?)[A-Za-z_@/][\w.\-/:@]*\1[ \t]*[=:]`);
+  const spans = [...covered].sort((a, b) => a.start - b.start);
+  let next = 0;
+  let reach = -1;
+  let offset = 0;
+  for (const line of text.split(`
+`)) {
+    const start = offset;
+    const end = start + Math.max(line.length, 1);
+    offset += line.length + 1;
+    while (next < spans.length && spans[next].start < end)
+      reach = Math.max(reach, spans[next++].end);
+    if (reach > start)
+      continue;
+    const trimmed = line.trim();
+    if (trimmed === "" || trimmed.startsWith("#") || assignment.test(line))
+      continue;
+    const lead = line.length - line.trimStart().length;
+    out.push({ start: start + lead, end: start + line.replace(/[ \t\r]+$/, "").length, rule: "env_value" });
+  }
+  return out;
+}
+function tripleQuoted(text, from) {
+  const delim = text.slice(from, from + 3);
+  if (delim !== '"""' && delim !== "'''")
+    return null;
+  for (let i = from + 3;i < text.length; i += 1) {
+    if (text[i] === "\\" && delim === '"""') {
+      i += 1;
+      continue;
+    }
+    if (text.startsWith(delim, i)) {
+      let close = i;
+      while (close - i < 2 && text[close + 3] === delim[0])
+        close += 1;
+      return close > from + 3 ? { start: 3, end: close - from } : null;
+    }
+  }
+  return null;
+}
+function multilineQuoted(text, restStart, toml) {
+  const quote = text[restStart];
+  if (quote !== '"' && quote !== "'" && quote !== "`")
+    return null;
+  if (toml && quote !== "`" && text.startsWith(quote.repeat(3), restStart))
+    return tripleQuoted(text, restStart);
+  for (let i = restStart + 1;i < text.length; i += 1) {
+    if (text[i] === "\\" && quote !== "'") {
+      i += 1;
+      continue;
+    }
+    if (quote === "'" && text[i] === quote && text[i + 1] === quote) {
+      i += 1;
+      continue;
+    }
+    if (text[i] === quote)
+      return i > restStart + 1 ? { start: 1, end: i - restStart } : null;
+  }
+  return null;
+}
+function valueBounds(rest, envFile, toml) {
+  if (rest === "" || /^[{[|>]/.test(rest))
+    return null;
+  const quote = rest[0];
+  if (quote === '"' || quote === "'" || quote === "`") {
+    if (toml && quote !== "`" && rest.startsWith(quote.repeat(3)))
+      return tripleQuoted(rest, 0);
+    for (let i = 1;i < rest.length; i += 1) {
+      if (rest[i] === "\\" && quote === '"') {
+        i += 1;
+        continue;
+      }
+      if (quote === "'" && rest[i] === quote && rest[i + 1] === quote) {
+        i += 1;
+        continue;
+      }
+      if (rest[i] === quote)
+        return i > 1 ? { start: 1, end: i } : null;
+    }
+    return null;
+  }
+  let end = rest.length;
+  const comment = rest.search(envFile ? /[ \t]+#/ : /[ \t]+[#;]/);
+  if (comment !== -1)
+    end = comment;
+  const trimmed = rest.slice(0, end).replace(envFile ? /[ \t]+$/ : /[ \t,]+$/, "");
+  return trimmed === "" ? null : { start: 0, end: trimmed.length };
+}
+function xmlSpans(text) {
+  const spans = [];
+  for (const m of text.matchAll(/<(password|passphrase|privateKey|secret|token|apiKey|accessKey|secretKey)>([^<]+)<\/\1>/dgi)) {
+    const value = m[2].trim();
+    if (value === "" || /^\$\{/.test(value))
+      continue;
+    const [start, end] = m.indices[2];
+    spans.push({ start, end, rule: "credential_assignment" });
+  }
+  return spans;
+}
+function inlinePairSpans(text, path) {
+  const cComments = /\.json5$/i.test(path);
+  const toml = /\.toml$/i.test(path);
+  const yaml = /\.ya?ml$/i.test(path);
+  const spans = [];
+  const tomlKey = /[ \t]*(["']?)([A-Za-z_@][\w.\-/@]{0,127})\1[ \t]*=[ \t]*("""|''')/y;
+  const pair = /[ \t]*(["']?)([A-Za-z_@][\w.\-/@]{0,127})\1[ \t]*[:=][ \t]*(?:"((?:[^"\\\n]|\\.)*)"|'((?:[^'\n]|'')*)'|([^,{}[\]\s"'][^,{}\n]*))/dy;
+  let depth = 0;
+  let quote = "";
+  let previous = `
+`;
+  let expectKey = false;
+  for (let i = 0;i < text.length; i += 1) {
+    const ch = text[i];
+    if (quote) {
+      if (ch === "\\" && quote === '"')
+        i += 1;
+      else if (quote === "'" && ch === "'" && text[i + 1] === "'")
+        i += 1;
+      else if (ch === quote || ch === `
+` && !yaml)
+        quote = "";
+      continue;
+    }
+    if (ch === " " || ch === "\t" || ch === "\r")
+      continue;
+    if (ch === `
+`) {
+      previous = ch;
+      continue;
+    }
+    if (cComments && ch === "/" && (text[i + 1] === "/" || text[i + 1] === "*") && /[\s{,[]/.test(text[i - 1] ?? `
+`)) {
+      const close = text[i + 1] === "*" ? text.indexOf("*/", i + 2) : text.indexOf(`
+`, i);
+      i = close === -1 ? text.length : text[i + 1] === "*" ? close + 1 : close - 1;
+      continue;
+    }
+    if (ch === "#" && /\s/.test(text[i - 1] ?? `
+`)) {
+      const lineEnd = text.indexOf(`
+`, i);
+      i = (lineEnd === -1 ? text.length : lineEnd) - 1;
+      continue;
+    }
+    if (expectKey) {
+      expectKey = false;
+      if (toml) {
+        tomlKey.lastIndex = i;
+        const k = tomlKey.exec(text);
+        if (k) {
+          const open = k.index + k[0].length - 3;
+          const bounds = tripleQuoted(text, open);
+          if (!bounds) {
+            const close = text.indexOf(k[3], open + 3);
+            i = close === -1 ? text.length - 1 : close + 2;
+          } else {
+            const from = open + bounds.start;
+            const to = open + bounds.end;
+            if (isCredentialName(k[2]) && text.slice(from, to).trim().split(/\s+/).some(isCredentialValue)) {
+              spans.push({ start: from, end: to, rule: "credential_assignment" });
+            }
+            i = to + 2;
+            while (text[i + 1] === k[3][0])
+              i += 1;
+          }
+          previous = text[i];
+          continue;
+        }
+      }
+      pair.lastIndex = i;
+      const m = pair.exec(text);
+      if (m) {
+        const group = m[3] !== undefined ? 3 : m[4] !== undefined ? 4 : 5;
+        const value = m[group];
+        if (isCredentialName(m[2]) && isCredentialValue(value)) {
+          const [from] = m.indices[group];
+          spans.push({ start: from, end: from + value.replace(/[ \t]+$/, "").length, rule: "credential_assignment" });
+        }
+        i = m.index + m[0].length - 1;
+        previous = text[i];
+        continue;
+      }
+    }
+    if ((ch === '"' || ch === "'") && /[\n:=,{[(]/.test(previous)) {
+      if (toml && text.startsWith(ch.repeat(3), i)) {
+        const close = tripleQuoted(text, i);
+        const end = close === null ? text.indexOf(ch.repeat(3), i + 3) : i + close.end;
+        i = end === -1 ? text.length : end + 2;
+        while (text[i + 1] === ch)
+          i += 1;
+        previous = ch;
+        continue;
+      }
+      quote = ch;
+      previous = ch;
+      continue;
+    }
+    previous = ch;
+    if (ch === "{")
+      depth += 1;
+    else if (ch === "}" && depth > 0)
+      depth -= 1;
+    if ((ch === "{" || ch === ",") && depth > 0)
+      expectKey = true;
+  }
+  return spans;
+}
+function jsonSpans(text) {
+  const spans = [];
+  for (const m of text.matchAll(/"([^"\\\n]{1,128})"\s*:\s*"((?:[^"\\\n]|\\.)*)"/dg)) {
+    if (!isCredentialName(m[1]) || !isCredentialValue(m[2]))
+      continue;
+    const [start, end] = m.indices[2];
+    spans.push({ start, end, rule: "credential_assignment" });
+  }
+  return spans;
+}
+var GENERIC_RULES = new Set(["generic_secret_assignment", "credential_assignment", "env_value", "url_embedded_credentials", "bearer_token"]);
+var SEPARATOR2 = /[-_./:@+=,;]/;
+function mask(value) {
+  const marker = PROVIDER_MARKER.exec(value)?.[0] ?? "";
+  const keep = marker.length <= value.length - 8 ? marker : "";
+  const body = value.slice(keep.length);
+  const hasContent = /[\p{L}\p{N}]/u.test(body);
+  let out = "";
+  for (let i = 0;i < body.length; i += 1) {
+    const ch = body[i];
+    if (ch === "\\" && i + 1 < body.length && body[i + 1] !== `
+` && body[i + 1] !== "\r") {
+      out += "xx";
+      i += 1;
+      continue;
+    }
+    if (ch === `
+` || ch === "\r")
+      out += ch;
+    else if (hasContent && SEPARATOR2.test(ch))
+      out += ch;
+    else
+      out += "x";
+  }
+  return keep + out;
+}
+function propertiesContinuations(text, spans) {
+  const out = [];
+  const visited = new Set;
+  const lineEndAt = (i) => text.indexOf(`
+`, i) === -1 ? text.length : text.indexOf(`
+`, i);
+  const continuation = (from, end) => {
+    let contentEnd = end;
+    if (text[contentEnd - 1] === "\r")
+      contentEnd -= 1;
+    let run = contentEnd;
+    while (run > from && text[run - 1] === "\\")
+      run -= 1;
+    return (contentEnd - run) % 2 === 1 ? contentEnd - 1 : -1;
+  };
+  const comments = new Set;
+  let continued = false;
+  for (let from = 0;from < text.length; ) {
+    const end = lineEndAt(from);
+    const comment = !continued && /^[ \t\f]*[#!]/.test(text.slice(from, end));
+    if (comment)
+      comments.add(end);
+    continued = !comment && continuation(from, end) !== -1;
+    from = end + 1;
+  }
+  for (const span of spans) {
+    let end = lineEndAt(span.start);
+    if (comments.has(end))
+      continue;
+    let slash = continuation(span.start, end);
+    if (slash === -1)
+      continue;
+    if (span.end > slash)
+      span.end = slash;
+    while (slash !== -1 && end < text.length && !visited.has(end)) {
+      visited.add(end);
+      const from = end + 1;
+      end = lineEndAt(from);
+      let start = from;
+      while (start < end && (text[start] === " " || text[start] === "\t"))
+        start += 1;
+      slash = continuation(start, end);
+      const stop = slash === -1 ? text[end - 1] === "\r" ? end - 1 : end : slash;
+      if (stop > start)
+        out.push({ start, end: stop, rule: span.rule });
+    }
+  }
+  return out;
+}
+function yamlValueSpans(text, spans, everyValue) {
+  if (spans.length === 0) {
+    let candidate = false;
+    COLON_LINE.lastIndex = 0;
+    for (const match of text.matchAll(COLON_LINE)) {
+      if (!isCredentialName(match[3]))
+        continue;
+      const rest = match[4].replace(/\r$/, "");
+      const lineEnd = match.index + match[0].length;
+      const nextLine = /^\n([ \t]*)\S/.exec(text.slice(lineEnd, lineEnd + 512));
+      const indent = /^[ \t]*/.exec(match[0])[0].length;
+      if (/^[&!]/.test(rest) || /(?:^|[ \t])[|>][-+1-9]*[ \t]*(?:#.*)?$/.test(rest) || /^"(?:[^"\\]|\\.)*$/.test(rest) || /^'(?:[^']|'')*$/.test(rest) || rest.trim() !== "" && !/^["'{[]/.test(rest) && nextLine !== null && nextLine[1].length > indent) {
+        candidate = true;
+        break;
+      }
+    }
+    if (!candidate)
+      return [];
+  } else if (!/[|>&!]/.test(text) && !/[\r\n][^\r\n]/.test(text))
+    return [];
+  const out = [];
+  const sorted = [...spans].sort((a, b) => a.start - b.start);
+  let next = 0;
+  let reach = -1;
+  let reachRule = "";
+  for (const doc of $parseAllDocuments(text, { keepSourceTokens: true, prettyErrors: false })) {
+    if (doc.errors.length > 0)
+      throw new Error("YAML value bounds are unavailable");
+    $visit(doc, (_key, node, path) => {
+      if (!$isScalar(node) || !node.srcToken || !("source" in node.srcToken) || !node.range)
+        return;
+      const block = node.srcToken.type === "block-scalar";
+      const quoted = node.type === "QUOTE_SINGLE" || node.type === "QUOTE_DOUBLE";
+      const raw = node.srcToken.source;
+      if (!block && !node.anchor && !node.tag && !/[\r\n]/.test(raw))
+        return;
+      const source = quoted ? raw.slice(1, -1) : raw;
+      const to = node.range[1] - (quoted ? 1 : 0);
+      const from = to - source.length;
+      const parent = path[path.length - 1];
+      const name = $isPair(parent) && $isScalar(parent.key) ? String(parent.key.value) : "";
+      while (next < sorted.length && sorted[next].start < from) {
+        if (sorted[next].end > reach)
+          [reach, reachRule] = [sorted[next].end, sorted[next].rule];
+        next += 1;
+      }
+      const inside = reach > from ? reachRule : next < sorted.length && sorted[next].start < to ? sorted[next].rule : "";
+      const credential = isCredentialName(name) && String(node.value).trim().split(/[ \t\r\n]+/).some(isCredentialValue);
+      if (!inside && !everyValue && !credential)
+        return;
+      const rule2 = inside || (everyValue ? "env_value" : "credential_assignment");
+      for (const line of source.matchAll(/[^\r\n]+/g)) {
+        const lead = /^[ \t]*/.exec(line[0])[0].length;
+        if (lead < line[0].length)
+          out.push({ start: from + line.index + lead, end: from + line.index + line[0].length, rule: rule2 });
+      }
+    });
+  }
+  return out;
+}
+function redactText(path, text, categories, opts) {
+  const heuristics = !categories.includes("lockfile") && !/\.min\.(js|css)$|\.map$/.test(path);
+  const config = isConfigLike(path);
+  const found = findSecretSpans(text, { heuristics, config: !categories.includes("source") });
+  const withhold = found.find((s) => s.withholdFile);
+  if (withhold)
+    return { text, redactions: [], ranges: [], withholdRule: withhold.rule };
+  const spans = found.map(({ start, end, rule: rule2 }) => ({ start, end, rule: rule2 }));
+  const lockfile = categories.includes("lockfile");
+  if (opts.envFile) {
+    spans.push(...assignmentSpans(text, true, path, valueEnds(path, true)));
+    spans.push(...unparsedEnvLines(text, spans));
+  } else if (config && !lockfile && !isDockerfile(path))
+    spans.push(...assignmentSpans(text, false, path, valueEnds(path, false)));
+  if (isDockerfile(path))
+    for (const span of dockerfileEnvSpans(text, spans))
+      spans.push(span);
+  if (config && !lockfile && /\.json[c5]?$/i.test(path))
+    spans.push(...jsonSpans(text));
+  if (config && !lockfile && !opts.envFile && !/\.jsonc?$/i.test(path))
+    spans.push(...inlinePairSpans(text, path));
+  if (!lockfile && /\.xml$/i.test(path))
+    spans.push(...xmlSpans(text));
+  if (/\.properties$/i.test(path))
+    spans.push(...propertiesContinuations(text, spans));
+  if (/\.ya?ml$/i.test(path)) {
+    try {
+      spans.push(...yamlValueSpans(text, spans, opts.envFile));
+    } catch {
+      return { text, redactions: [], ranges: [], withholdRule: "credential_assignment" };
+    }
+  }
+  if (spans.length === 0)
+    return { text, redactions: [], ranges: [] };
+  spans.sort((a, b) => a.start - b.start || b.end - a.end);
+  const merged = [];
+  for (const span of spans) {
+    if (span.end <= span.start)
+      continue;
+    const last = merged[merged.length - 1];
+    if (last && span.start < last.end) {
+      last.end = Math.max(last.end, span.end);
+      if (GENERIC_RULES.has(last.rule) && !GENERIC_RULES.has(span.rule))
+        last.rule = span.rule;
+    } else {
+      merged.push({ ...span });
+    }
+  }
+  let out = "";
+  let cursor = 0;
+  let lineNo = 1;
+  let lineCursor = 0;
+  const redactions = [];
+  for (const span of merged) {
+    for (let i = lineCursor;i < span.start; i += 1)
+      if (text.charCodeAt(i) === 10)
+        lineNo += 1;
+    lineCursor = span.start;
+    const value = text.slice(span.start, span.end);
+    out += text.slice(cursor, span.start) + mask(value);
+    cursor = span.end;
+    redactions.push({ line: lineNo, rule: span.rule, length: value.length });
+  }
+  out += text.slice(cursor);
+  return { text: out, redactions, ranges: merged.map((span) => [span.start, span.end]) };
+}
 
 // ../../packages/harness-bundle/src/collect/toolchain.ts
 function isToolchainFile(path) {
@@ -187735,6 +189583,7 @@ class Collector {
   texts = new Map;
   env = new EnvCollector;
   parentCache = new Map;
+  redactions = [];
   listedArtifacts = new Map;
   constructor(repoRoot, opts) {
     this.opts = opts;
@@ -187793,7 +189642,7 @@ class Collector {
     const withPrefix = (p2) => prefix === "" ? p2 : `${prefix}/${p2}`;
     const tracked = [...new Set(lsFiles(dir, ["--cached"]))].sort().map(withPrefix);
     const untracked = lsFiles(dir, ["--others", "--exclude-standard"]).sort().map(withPrefix);
-    const ignored = lsFiles(dir, ["--others", "--ignored", "--exclude-standard", "--directory", "--no-empty-directory"]).sort().map(withPrefix);
+    const ignored = ignoredPaths(dir).sort().map(withPrefix);
     const ignoredDirs = ignored.filter((p2) => p2.endsWith("/"));
     const ignoredRuleFiles = lsFiles(dir, ["--others", "--ignored", "--exclude-standard", "--", ":(glob)**/.modaignore"]).map(withPrefix).filter((p2) => !ignoredDirs.some((d) => p2.startsWith(d))).filter((p2) => {
       const excluded = this.ancestorMatch(p2, "ignored");
@@ -187962,13 +189811,14 @@ class Collector {
       this.addToAggregate(ancestor.dir, ancestor.rule, path, isDir);
       return;
     }
+    const collectAll = this.opts.collectIgnored !== false;
     if (isDir) {
       const rule3 = this.dirMatch(path, "ignored");
       if (rule3) {
         this.recordDirOrFile(path, rule3);
         return;
       }
-      if (this.includeIgnoredRules.size > 0 && this.includeIgnoredRules.matchesWithAncestors(path, true)) {
+      if (collectAll || this.includeIgnoredRules.size > 0 && this.includeIgnoredRules.matchesWithAncestors(path, true)) {
         this.walk(path, "ignored", null);
         return;
       }
@@ -187988,7 +189838,7 @@ class Collector {
       this.excludeFile(path, "user_exclude", "modaignore", this.sizeOf(path));
       return;
     }
-    if (this.includeIgnoredRules.size > 0 && this.includeIgnoredRules.matchesWithAncestors(path, false)) {
+    if (collectAll || this.includeIgnoredRules.size > 0 && this.includeIgnoredRules.matchesWithAncestors(path, false)) {
       this.consider(path, "ignored");
       return;
     }
@@ -188074,8 +189924,9 @@ class Collector {
       }
       return;
     }
-    const pathRule = fileRule(path);
-    if (pathRule) {
+    const pathRule = fileRule(path) ?? runtimeLogRule(path, status);
+    const envValueFile = pathRule?.reason === "secret_path" && ENV_VALUE_FILE_RULES.has(pathRule.rule) && status === "tracked";
+    if (pathRule && !envValueFile) {
       this.excludeFile(path, pathRule.reason, pathRule.rule, st.size);
       return;
     }
@@ -188106,20 +189957,48 @@ class Collector {
     const text = encoding === "text" ? buf.toString("utf8") : undefined;
     const categoryText = text !== undefined && /^(package\.json|pyproject\.toml|Cargo\.toml)$/.test(basenameOf(path)) ? text : undefined;
     const categories = categorize({ path, encoding, head: text?.slice(0, 1024), text: categoryText });
-    const finding = contentSecretFinding(path, buf, text, categories);
-    if (finding) {
-      this.excludeFile(path, finding.reason, finding.rule, buf.length);
-      return;
+    if (envValueFile && !categories.includes("env_example"))
+      categories.push("env_example");
+    const envFile = envValueFile || categories.includes("env_example");
+    let shipped = buf;
+    if (text !== undefined) {
+      const redacted = redactText(path, text, categories, { envFile });
+      if (redacted.withholdRule) {
+        this.excludeFile(path, "secret_content", redacted.withholdRule, buf.length);
+        return;
+      }
+      const credential = redacted.redactions.find((r) => r.rule !== "env_value");
+      if (credential && status !== "tracked" && !categories.includes("env_example")) {
+        this.excludeFile(path, "secret_content", credential.rule, buf.length);
+        return;
+      }
+      const unmasked = registryAuthFindings(path, text).find((finding) => !rangeCovered(redacted.ranges, finding.start, finding.end));
+      if (unmasked) {
+        this.excludeFile(path, "secret_path", unmasked.rule, buf.length);
+        return;
+      }
+      if (redacted.redactions.length > 0) {
+        shipped = Buffer.from(redacted.text, "utf8");
+        for (const r of redacted.redactions)
+          this.redactions.push({ path, ...r });
+      }
+    } else {
+      const finding = contentSecretFinding(path, buf, text, categories);
+      if (finding) {
+        this.excludeFile(path, finding.reason, finding.rule, buf.length);
+        return;
+      }
     }
     this.included.set(path, {
       path,
-      bytes: buf.length,
-      sha256: sha256(buf),
+      bytes: shipped.length,
+      sha256: sha256(shipped),
       executable: (st.mode & 73) !== 0,
       encoding,
-      categories,
+      categories: [...categories].sort(),
       git: status,
-      absolutePath: abs
+      absolutePath: abs,
+      ...shipped !== buf ? { redaction: { envFile }, sourceSha256: sha256(buf) } : {}
     });
     if (text !== undefined) {
       if (isToolchainFile(path))
@@ -188304,7 +190183,15 @@ class Collector {
     ].sort((a, b) => compare(a.path, b.path) || compare(a.reason, b.reason));
     const textOf = (path) => this.texts.get(path);
     const toolchain = detectToolchain(files.map((f) => f.path), textOf, harnessRel);
-    const manifestFiles = files.map(({ absolutePath: _absolutePath, linkTargetOnDisk: _linkTargetOnDisk, ...file }) => file);
+    const manifestFiles = files.map(({
+      absolutePath: _absolutePath,
+      linkTargetOnDisk: _linkTargetOnDisk,
+      redaction: _redaction,
+      sourceSha256: _sourceSha256,
+      ...file
+    }) => file);
+    const shippedPaths = new Set(manifestFiles.map((f) => f.path));
+    const redactions = this.redactions.filter((r) => shippedPaths.has(r.path)).sort((a, b) => compare(a.path, b.path) || a.line - b.line);
     const bytes = manifestFiles.reduce((sum, f) => sum + f.bytes, 0);
     const manifest = {
       schema: HARNESS_BUNDLE_SCHEMA,
@@ -188326,6 +190213,7 @@ class Collector {
       totals: { files: manifestFiles.length, bytes, excluded: excluded.length },
       files: manifestFiles,
       excluded,
+      ...redactions.length > 0 ? { redactions } : {},
       ignoredPresent: this.collapseIgnored(),
       toolchain,
       env: this.env.finalize(new Set(manifestFiles.map((f) => f.path))),
@@ -188471,6 +190359,19 @@ function isOutside(rel2) {
 function stripUndefined(value) {
   return Object.fromEntries(Object.entries(value).filter(([, v]) => v !== undefined));
 }
+function rangeCovered(ranges, start, end) {
+  let at = start;
+  for (const [s, e] of ranges) {
+    if (e <= at)
+      continue;
+    if (s > at)
+      return false;
+    at = e;
+    if (at >= end)
+      return true;
+  }
+  return at >= end;
+}
 // ../../packages/harness-bundle/src/collect/write.ts
 import { createHash as createHash3, randomUUID } from "node:crypto";
 import { createWriteStream, existsSync as existsSync5, lstatSync as lstatSync4, mkdirSync as mkdirSync3, readdirSync as readdirSync3, readFileSync as readFileSync5, readlinkSync as readlinkSync2, realpathSync as realpathSync3, renameSync, rmSync, statSync, writeFileSync as writeFileSync3 } from "node:fs";
@@ -188634,6 +190535,14 @@ function replaceTogether(moves, token) {
   for (const [backup] of backups)
     rmSync(backup, { force: true });
 }
+function shippedBody(file, disk = readFileSync5(file.absolutePath)) {
+  if (!file.redaction)
+    return disk;
+  const body = Buffer.from(redactText(file.path, disk.toString("utf8"), file.categories, file.redaction).text, "utf8");
+  if (sha256(body) !== file.sha256)
+    throw new Error(`${file.path} changed after collection; re-run the collector`);
+  return body;
+}
 function* tarChunks(files) {
   const sorted = [...files].sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
   for (const file of sorted) {
@@ -188652,10 +190561,10 @@ function* tarChunks(files) {
     } else {
       const body = readFileSync5(file.absolutePath);
       const executableNow = (statSync(file.absolutePath).mode & 73) !== 0;
-      if (sha256(body) !== file.sha256 || executableNow !== file.executable) {
+      if (sha256(body) !== (file.sourceSha256 ?? file.sha256) || executableNow !== file.executable) {
         throw new Error(`${file.path} changed after collection; re-run the collector`);
       }
-      entry = { path: file.path, type: "file", mode: file.executable ? 493 : 420, body };
+      entry = { path: file.path, type: "file", mode: file.executable ? 493 : 420, body: shippedBody(file, body) };
     }
     yield* encodeEntry(entry);
   }
@@ -188689,7 +190598,6 @@ async function collectRegistration(request) {
     throw new Error(`Git could not list this checkout, so the bundle would ignore .gitignore; nothing was collected. ${gitFailure ?? "Check that git works here (safe.directory, a readable index)."}`);
   }
   const deployArtifacts = request.imageRef ? [{ producedBy: "customer", kind: "oci_image", digest: request.imageRef.slice(request.imageRef.lastIndexOf("@") + 1), imageRef: request.imageRef }] : [];
-  redactEnvExamples(result, join7(request.outDir, "redacted"));
   const written = await writeBundle(result, request.outDir, { deployArtifacts: async () => deployArtifacts });
   const stage = join7(request.outDir, "stage");
   let dependencyMap;
@@ -188701,6 +190609,7 @@ async function collectRegistration(request) {
   } finally {
     rmSync2(stage, { recursive: true, force: true });
   }
+  keepRedactedExamplesFalse(dependencyMap, written.manifest);
   const mapPath = join7(request.outDir, "dependency-map.json");
   writeFileSync4(mapPath, `${JSON.stringify(dependencyMap, null, 2)}
 `);
@@ -188713,64 +190622,20 @@ async function collectRegistration(request) {
     dependencyMapFile: await digestFile(mapPath)
   };
 }
-var MAX_ENV_RESCAN_BYTES = 2 * 1024 * 1024;
-function redactEnvExamples(result, dir) {
-  const byPath = new Map(result.manifest.files.map((file) => [file.path, file]));
-  let redacted = false;
-  for (const file of result.files) {
-    if (!file.categories.includes("env_example") || file.symlinkTarget !== undefined)
-      continue;
-    redacted = true;
-    const body = Buffer.from(envNamesOnly(readFileSync6(file.absolutePath, "utf8")));
-    const target = join7(dir, file.path);
-    mkdirSync4(dirname5(target), { recursive: true });
-    writeFileSync4(target, body, { mode: file.executable ? 493 : 420 });
-    const sha2562 = createHash4("sha256").update(body).digest("hex");
-    Object.assign(file, { absolutePath: target, sha256: sha2562, bytes: body.byteLength });
-    const listed = byPath.get(file.path);
-    if (listed)
-      Object.assign(listed, { sha256: sha2562, bytes: body.byteLength });
-  }
-  result.manifest.totals.bytes = result.manifest.files.reduce((sum, file) => sum + file.bytes, 0);
-  if (redacted) {
-    const env = new EnvCollector;
-    for (const file of result.files) {
-      if (file.encoding !== "text" || file.symlinkTarget !== undefined || file.bytes > MAX_ENV_RESCAN_BYTES)
-        continue;
-      env.scanFile(file.path, readFileSync6(file.absolutePath, "utf8"), file.categories);
-    }
-    result.manifest.env = env.finalize(new Set(result.files.map((file) => file.path)));
-  }
-}
-function envNamesOnly(text) {
-  const names = [];
-  let open = null;
-  for (const line of text.split(`
-`)) {
-    if (open) {
-      if (closes(line, open, 0))
-        open = null;
-      continue;
-    }
-    const match = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/.exec(line);
-    if (!match)
+function keepRedactedExamplesFalse(map, manifest) {
+  const redactedPaths = new Set((manifest.redactions ?? []).map((r) => r.path));
+  const redactedEnvFiles = new Set(manifest.files.filter((file) => file.categories.includes("env_example") && redactedPaths.has(file.path)).map((file) => file.path));
+  if (redactedEnvFiles.size === 0)
+    return;
+  const collected = new Map(manifest.env.map((ref) => [ref.name, ref]));
+  const sourcePath = (source) => source.replace(/:\d+$/, "");
+  for (const ref of map.env) {
+    const seen = collected.get(ref.name);
+    if (!seen || seen.hasExampleValue || !ref.hasExampleValue)
       continue;
-    names.push(match[1]);
-    const quote = match[2][0];
-    if ((quote === '"' || quote === "'" || quote === "`") && !closes(match[2], quote, 1))
-      open = quote;
-  }
-  return names.map((name) => `${name}=
-`).join("");
-}
-function closes(text, quote, from) {
-  for (let i = from;i < text.length; i++) {
-    if (text[i] === "\\" && quote !== "'")
-      i++;
-    else if (text[i] === quote)
-      return true;
+    if (seen.sources.some((source) => redactedEnvFiles.has(sourcePath(source))))
+      ref.hasExampleValue = false;
   }
-  return false;
 }
 function insideCheckout(dir) {
   for (let current = realpathSync4(dir);; current = dirname5(current)) {
@@ -188983,7 +190848,7 @@ function parseRegisterOptions(context, argv) {
 }
 function defaultHarnessName(root) {
   try {
-    const name = JSON.parse(readFileSync7(join8(root, "package.json"), "utf8")).name;
+    const name = JSON.parse(readFileSync6(join8(root, "package.json"), "utf8")).name;
     if (typeof name === "string" && name)
       return sanitizeName(name.replace(/^@[^/]+\//, ""));
   } catch {}
@@ -189019,6 +190884,7 @@ function buildRegisterReport(collected) {
       byCategory: [...byCategory].map(([category, entry]) => ({ category, ...entry })).sort((a, b) => b.bytes - a.bytes)
     },
     excluded: manifest.excluded,
+    redactions: manifest.redactions ?? [],
     ignoredPresent: manifest.ignoredPresent,
     env,
     toolchain: manifest.toolchain,
@@ -189133,6 +190999,15 @@ function renderRegisterReport(report, registration) {
     const rule2 = item.rule ? `, rule ${item.rule}` : "";
     lines.push(`  ${pad(item.path, 40)} ${item.reason}: ${EXCLUSION_REASONS[item.reason] ?? item.reason}${rule2}${size}`);
   }
+  if (report.redactions.length > 0) {
+    lines.push("");
+    lines.push(`Redacted: ${report.redactions.length} value(s) masked in place. The files ship; the values never leave this machine.`);
+    for (const item of report.redactions.slice(0, 40)) {
+      lines.push(`  ${pad(`${item.path}:${item.line}`, 40)} ${item.rule} (${item.length} chars)`);
+    }
+    if (report.redactions.length > 40)
+      lines.push(`  ... ${report.redactions.length - 40} more (see the manifest)`);
+  }
   if (report.ignoredPresent.length > 0) {
     lines.push("");
     lines.push(`Git-ignored but present, not uploaded (names only): ${report.ignoredPresent.length}`);
@@ -189239,7 +191114,7 @@ function formatBytes(bytes) {
 }
 
 // src/harness-artifact-bodies.ts
-import { existsSync as existsSync7, lstatSync as lstatSync5, readFileSync as readFileSync8, realpathSync as realpathSync5 } from "node:fs";
+import { existsSync as existsSync7, lstatSync as lstatSync5, readFileSync as readFileSync7, realpathSync as realpathSync5 } from "node:fs";
 import { basename as basename5, dirname as dirname6, isAbsolute as isAbsolute3, relative as relative4, resolve as resolve5 } from "node:path";
 var MAX_SCANNED_FILE_BYTES2 = 512 * 1024;
 var SNAPSHOT_BUDGET_SKIP_REASONS = new Set([
@@ -189303,7 +191178,7 @@ function readBoundedRepoText(absPath, rootDir) {
     return;
   }
   try {
-    return readFileSync8(absPath, "utf8");
+    return readFileSync7(absPath, "utf8");
   } catch {
     return;
   }
@@ -189854,9 +191729,9 @@ function detectPromptLiterals(file, out) {
     });
   };
   if (ext === ".py") {
-    const tripleQuoted = /("""|''')([\s\S]*?)\1/g;
+    const tripleQuoted2 = /("""|''')([\s\S]*?)\1/g;
     let match;
-    while ((match = tripleQuoted.exec(file.text)) !== null) {
+    while ((match = tripleQuoted2.exec(file.text)) !== null) {
       record(match.index, match.index + match[0].length - 1, match[2], "python.triple_quoted_string");
     }
     return;
@@ -190036,7 +191911,7 @@ import { extname as extname8 } from "node:path";
 // src/prompt-sources.ts
 var import_typescript2 = __toESM(require_typescript(), 1);
 import { createHash as createHash5 } from "node:crypto";
-import { lstatSync as lstatSync7, readFileSync as readFileSync11, realpathSync as realpathSync8 } from "node:fs";
+import { lstatSync as lstatSync7, readFileSync as readFileSync10, realpathSync as realpathSync8 } from "node:fs";
 import { extname as extname3, isAbsolute as isAbsolute4, relative as relative5, resolve as resolve9 } from "node:path";
 
 // src/prompt-frameworks.ts
@@ -190058,7 +191933,7 @@ var TYPESCRIPT_AGENT_MODULES = [
 
 // src/prompt-source-code.ts
 var import_typescript = __toESM(require_typescript(), 1);
-import { existsSync as existsSync8, lstatSync as lstatSync6, readFileSync as readFileSync9, realpathSync as realpathSync6 } from "node:fs";
+import { existsSync as existsSync8, lstatSync as lstatSync6, readFileSync as readFileSync8, realpathSync as realpathSync6 } from "node:fs";
 import { dirname as dirname8, extname as extname2, join as join9, resolve as resolve7 } from "node:path";
 var EXTENSIONS = [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"];
 var MAX_BYTES = 2 * 1024 * 1024;
@@ -190099,7 +191974,7 @@ function parseFile(filePath, state) {
   const cached = state.parsed.get(path);
   if (cached)
     return cached;
-  const text = readFileSync9(path, "utf8");
+  const text = readFileSync8(path, "utf8");
   state.bytesRead += Buffer.byteLength(text);
   state.files.push(path);
   const scriptKind = extname2(path) === ".json" ? import_typescript.default.ScriptKind.JSON : /\.tsx?$/.test(extname2(path)) ? import_typescript.default.ScriptKind.TSX : import_typescript.default.ScriptKind.JSX;
@@ -190537,7 +192412,7 @@ function referenceNames(node) {
 
 // src/prompt-source-python.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { readFileSync as readFileSync10, realpathSync as realpathSync7 } from "node:fs";
+import { readFileSync as readFileSync9, realpathSync as realpathSync7 } from "node:fs";
 import { resolve as resolve8 } from "node:path";
 var PYTHON_AGENT_MODULES_LITERAL = JSON.stringify(PYTHON_AGENT_MODULES);
 var SELECTOR_HELPER = String.raw`import ast,json,os,sys
@@ -191004,7 +192879,7 @@ except Exception as e:
 function extractPythonSource(rootDir, sourcePath, symbol, _forceDependencyGraph = false) {
   let raw = "";
   try {
-    raw = readFileSync10(sourcePath, "utf8");
+    raw = readFileSync9(sourcePath, "utf8");
   } catch {}
   const result = spawnSync2("python3", ["-I", "-c", HELPER], {
     input: JSON.stringify({ root: rootDir, path: sourcePath, symbol, force: _forceDependencyGraph }),
@@ -191098,7 +192973,7 @@ function resolvePromptSource(rootDir, source) {
   } else if (source.selector?.symbol) {
     throw new Error(`${sourcePath}: symbol selectors require a JavaScript, TypeScript, or Python source file`);
   } else if (ext === ".json" || ext === ".yaml" || ext === ".yml" || hasPointer || source.kind === "messages") {
-    const parsed = parseStructured(readFileSync11(sourceAbs, "utf8"), sourcePath, ext);
+    const parsed = parseStructured(readFileSync10(sourceAbs, "utf8"), sourcePath, ext);
     const selected = hasPointer ? jsonPointer(parsed, source.selector.pointer, sourcePath) : parsed;
     const selectedField = source.selector?.pointer?.split("/").at(-1)?.replaceAll("~1", "/").replaceAll("~0", "~");
     const inferredKind = !source.kind && selectedField && /^(?:template|system_template|instance_template)$/.test(selectedField) ? "template" : source.kind;
@@ -191108,7 +192983,7 @@ function resolvePromptSource(rootDir, source) {
     messages = structured.messages;
     kind = structured.kind;
   } else {
-    const raw = readFileSync11(sourceAbs, "utf8");
+    const raw = readFileSync10(sourceAbs, "utf8");
     if (ext === ".md" && /\.prompt\.md$/i.test(sourcePath)) {
       const legacy = parseLegacyMarkdown(raw);
       content = legacy.content;
@@ -191131,7 +193006,7 @@ function resolvePromptSource(rootDir, source) {
       const depAbs = safePath(root, dependency.path);
       files.add(depAbs);
       if (typeof dependency.selector?.pointer === "string") {
-        const parsed = parseStructured(readFileSync11(depAbs, "utf8"), dependency.path, extname3(depAbs).toLowerCase());
+        const parsed = parseStructured(readFileSync10(depAbs, "utf8"), dependency.path, extname3(depAbs).toLowerCase());
         jsonPointer(parsed, dependency.selector.pointer, dependency.path);
       } else if (dependency.selector?.symbol && CODE_EXTENSIONS2.has(extname3(depAbs).toLowerCase())) {
         const dep = extname3(depAbs).toLowerCase() === ".py" ? extractPythonSource(root, depAbs, dependency.selector.symbol) : extractCodeSource(root, depAbs, dependency.selector.symbol);
@@ -191154,7 +193029,7 @@ function resolvePromptSource(rootDir, source) {
     assertSafeMaterializedContent(content, sourcePath);
   else
     assertSafeMaterializedContent(materialized, sourcePath);
-  const dependencies = [...files].sort().map((path) => ({ path: relative5(root, path).replaceAll("\\", "/"), contentHash: sha2562(readFileSync11(path)) }));
+  const dependencies = [...files].sort().map((path) => ({ path: relative5(root, path).replaceAll("\\", "/"), contentHash: sha2562(readFileSync10(path)) }));
   const sourceHash = sha2562(JSON.stringify({ kind, content, systemPrompt: systemPrompt ?? null, messages: messages ?? null }));
   const sourceDefinition = {
     schemaVersion: 1,
@@ -191224,7 +193099,7 @@ function discoverStructuredPromptSources(rootDir, sourcePath) {
   const ext = extname3(file).toLowerCase();
   if (![".json", ".yaml", ".yml"].includes(ext))
     return [];
-  const value = parseStructured(readFileSync11(file, "utf8"), sourcePath, ext);
+  const value = parseStructured(readFileSync10(file, "utf8"), sourcePath, ext);
   const sources = [];
   const base = sourcePath.replace(/\.[^.]+$/, "").replace(/[^A-Za-z0-9_.-]+/g, ".");
   const dedicatedPath = /(^|\/)prompts?(?:\/|\.[^/]+$)|\.prompt\.[^.]+$/i.test(sourcePath);
@@ -191300,14 +193175,14 @@ function discoverCodePromptCandidates(rootDir, sourcePath) {
       addName(candidate.symbol, candidate.knownBuilder === true);
       modelInputs.add(candidate.symbol);
     }
-    for (const match of readFileSync11(file, "utf8").matchAll(/^(?:(?:async\s+)?def\s+([A-Za-z_]\w*)|([A-Za-z_]\w*)\s*=\s*([^\n#]+))/gm)) {
+    for (const match of readFileSync10(file, "utf8").matchAll(/^(?:(?:async\s+)?def\s+([A-Za-z_]\w*)|([A-Za-z_]\w*)\s*=\s*([^\n#]+))/gm)) {
       const name = match[1] ?? match[2];
       const rhs = match[3] ?? "";
       if (name && isPromptName2(name) && (match[1] || /['"`\[({+]/.test(rhs) || /^[A-Za-z_]\w*\s*$/.test(rhs)))
         addName(name, Boolean(match[1]));
     }
   } else {
-    const sf = import_typescript2.default.createSourceFile(file, readFileSync11(file, "utf8"), import_typescript2.default.ScriptTarget.Latest, true, import_typescript2.default.ScriptKind.TSX);
+    const sf = import_typescript2.default.createSourceFile(file, readFileSync10(file, "utf8"), import_typescript2.default.ScriptTarget.Latest, true, import_typescript2.default.ScriptKind.TSX);
     const agentConstructors = new Set;
     for (const statement of sf.statements) {
       if (!import_typescript2.default.isImportDeclaration(statement) || !import_typescript2.default.isStringLiteral(statement.moduleSpecifier) || !TYPESCRIPT_AGENT_MODULES.includes(statement.moduleSpecifier.text))
@@ -191541,7 +193416,7 @@ function sha2562(input) {
 }
 
 // src/prompt-source-verification/index.ts
-import { readFileSync as readFileSync15 } from "node:fs";
+import { readFileSync as readFileSync14 } from "node:fs";
 import { z } from "zod";
 
 // src/prompt-source-validation.ts
@@ -191630,7 +193505,7 @@ function isPromptDefinitionPath(path) {
 }
 
 // src/prompt-source-verification/evidence.ts
-import { readFileSync as readFileSync14 } from "node:fs";
+import { readFileSync as readFileSync13 } from "node:fs";
 import { extname as extname7 } from "node:path";
 
 // src/prompt-source-verification/paths.ts
@@ -191660,14 +193535,14 @@ function safePromptEvidencePath(rootDir, path) {
 var import_typescript3 = __toESM(require_typescript(), 1);
 import { execFileSync as execFileSync2 } from "node:child_process";
 import { extname as extname5 } from "node:path";
-import { readFileSync as readFileSync12 } from "node:fs";
+import { readFileSync as readFileSync11 } from "node:fs";
 function proveSink(root, sink) {
   const file = safePromptEvidencePath(root, sink.path);
   const cache = new Map;
   if (!cache.has(file)) {
     if (extname5(file) === ".py") {
       try {
-        const rows = JSON.parse(execFileSync2("python3", ["-I", "-c", PYTHON_PROOF], { input: readFileSync12(file, "utf8"), encoding: "utf8", timeout: 1e4, maxBuffer: 2 * 1024 * 1024 }));
+        const rows = JSON.parse(execFileSync2("python3", ["-I", "-c", PYTHON_PROOF], { input: readFileSync11(file, "utf8"), encoding: "utf8", timeout: 1e4, maxBuffer: 2 * 1024 * 1024 }));
         cache.set(file, new Map(Object.entries(rows).map(([line, proof]) => [Number(line), proof])));
       } catch {
         cache.set(file, new Map);
@@ -191834,7 +193709,7 @@ print(json.dumps(rows))
 `;
 
 // src/prompt-source-location.ts
-import { readFileSync as readFileSync13 } from "node:fs";
+import { readFileSync as readFileSync12 } from "node:fs";
 import { extname as extname6 } from "node:path";
 function structuredExcerpt(text, source) {
   if (source.selector?.pointer === undefined)
@@ -191888,7 +193763,7 @@ function promptDefinitionExcerpt(rootDir, source) {
       return;
     return { ...extraction.range, text: extraction.sourceText, ...extraction.declarationKind ? { declarationKind: extraction.declarationKind } : {} };
   }
-  const text = readFileSync13(file, "utf8");
+  const text = readFileSync12(file, "utf8");
   return structuredExcerpt(text, source);
 }
 function promptDefinitionRange(rootDir, source) {
@@ -191915,7 +193790,7 @@ function reviewEvidence(rootDir, source, evidence) {
     for (const item of evidence) {
       let text;
       try {
-        text = readFileSync14(safePromptEvidencePath(rootDir, item.path), "utf8");
+        text = readFileSync13(safePromptEvidencePath(rootDir, item.path), "utf8");
       } catch (error) {
         if (item.kind === "model_endpoint")
           return { valid: false, endpointVerified: false, reason: error instanceof Error ? error.message : String(error) };
@@ -192030,7 +193905,7 @@ async function independentlyVerifyPromptSource(rootDir, source, verifier) {
   let priorJudgment;
   try {
     const before = JSON.stringify(checked.resolved.sourceDefinition);
-    const sourceBytes = readFileSync15(safePromptEvidencePath(rootDir, source.path), "utf8");
+    const sourceBytes = readFileSync14(safePromptEvidencePath(rootDir, source.path), "utf8");
     const instruction = promptVerificationInstruction(checked.source, checked.sourceHash, promptDefinitionExcerpt(rootDir, checked.source));
     for (let attempt = 0;attempt < 2; attempt++) {
       const repair = attempt ? `
@@ -192061,7 +193936,7 @@ ${output}` : "";
     }
     if (reviewed.truncated || reviewed.sourceHash !== checked.sourceHash)
       return pending("Verifier output is truncated or cites a different source hash", reviewed.evidence, reviewed.role, normalizeUsage(undefined, false));
-    if (before !== snapshot() || readFileSync15(safePromptEvidencePath(rootDir, source.path), "utf8") !== sourceBytes)
+    if (before !== snapshot() || readFileSync14(safePromptEvidencePath(rootDir, source.path), "utf8") !== sourceBytes)
       return pending("Source changed during verification", reviewed.evidence, reviewed.role, normalizeUsage(undefined, false));
     if (reviewed.role === "non_prompt")
       return { status: "rejected", reason: reviewed.reason, evidence: reviewed.evidence, sourceHash: checked.sourceHash, role: reviewed.role, usage: normalizeUsage(undefined, false) };
@@ -192421,7 +194296,7 @@ function applyPromptDiscovery(graph, discovery) {
 }
 
 // src/harness-candidate-promotion.ts
-import { readFileSync as readFileSync16 } from "node:fs";
+import { readFileSync as readFileSync15 } from "node:fs";
 import { resolve as resolve12 } from "node:path";
 var PROMOTED_CONFIDENCE = {
   high: 0.85,
@@ -192452,7 +194327,7 @@ function readFileLines(rootDir, path, cache) {
     return cached;
   let lines;
   try {
-    lines = readFileSync16(resolve12(rootDir, path), "utf8").split(/\r?\n/);
+    lines = readFileSync15(resolve12(rootDir, path), "utf8").split(/\r?\n/);
   } catch {
     lines = null;
   }
@@ -192606,19 +194481,19 @@ function assertHarnessGraphSyncSize(graph) {
 // ../../packages/messaging/messaging.json
 var messaging_default = {
   $schema: "./messaging.schema.json",
-  version: "1.0.3",
-  locked_on: "2026-10-14",
+  version: "1.0.4",
+  locked_on: "2026-10-15",
   approved_by: "mo",
-  source: "Branding project docs/positioning.md v1.0.3",
+  source: "Branding project docs/positioning.md v1.0.4",
   canonical_strings: {
-    version: "1.0.3",
-    locked_on: "2026-10-14",
+    version: "1.0.4",
+    locked_on: "2026-10-15",
     approved_by: "mo",
     strings: [
       {
         id: "one_liner",
         source: "approved",
-        text: "Moda gives engineers the infrastructure to monitor AI agents in production, find the mistakes they keep repeating, and test every change against real traces before it ships.",
+        text: "Infrastructure for catching AI agent mistakes in production and turning them into evals.",
         match: "exact",
         surfaces: [
           "apps/moda-frontend/components/landing/hero.tsx (subhead under the H1)",
@@ -192678,7 +194553,7 @@ var messaging_default = {
       {
         id: "meta_description",
         source: "derived",
-        text: "Production monitoring and evals for AI agents. Find the mistakes your agents keep repeating and test every change against real traces before it ships.",
+        text: "Production monitoring and evals for AI agents. Infrastructure for catching AI agent mistakes in production and turning them into evals.",
         match: "exact",
         max_chars: 160,
         surfaces: [
@@ -192703,7 +194578,7 @@ var messaging_default = {
       {
         id: "long_description",
         source: "derived",
-        text: "Moda gives engineers the infrastructure to monitor AI agents in production, find the mistakes they keep repeating, and test every change against real traces before it ships. Agents fail in ways that never throw an error: frustrated users, failing tools, lazy or hallucinated answers. Moda reads every production trace end to end, detects these failures, and groups them into problems ranked by how many users they affect, with the traces behind each one. When your team changes a prompt, tool, or model, Moda replays the change against those traces and shows whether it worked, then keeps monitoring after release. Works with any model provider through SDKs, OpenTelemetry, or HTTP. Backed by Y Combinator.",
+        text: "Infrastructure for catching AI agent mistakes in production and turning them into evals. Agents fail in ways that never throw an error: frustrated users, failing tools, lazy or hallucinated answers. Moda reads every production trace end to end, detects these failures, and groups them into problems ranked by how many users they affect, with the traces behind each one. When your team changes a prompt, tool, or model, Moda replays the change against those traces and shows whether it worked, then keeps monitoring after release. Works with any model provider through SDKs, OpenTelemetry, or HTTP. Backed by Y Combinator.",
         match: "exact",
         surfaces: [
           "LinkedIn About",
@@ -192817,7 +194692,7 @@ var messaging_default = {
     ]
   },
   banned_phrases: {
-    version: "1.0.3",
+    version: "1.0.4",
     phrases: [
       {
         id: "fixes_your_agent",
@@ -192994,7 +194869,7 @@ var messaging_default = {
     ]
   },
   terminology: {
-    version: "1.0.3",
+    version: "1.0.4",
     terms: [
       {
         use: "trace",
@@ -193996,7 +195871,7 @@ async function runHarnessCommand(context) {
         throw new CliInputError("Focused remote prompt analysis is not supported yet.", "Use local --analyst=claude|codex|cursor|local-scan, or drop --concern for a full remote report.");
       }
       if (context.flags["github-actions"] === "true") {
-        const { runGithubActionsAnalyze } = await import("./harness-github-actions-nph5t2s7.js");
+        const { runGithubActionsAnalyze } = await import("./harness-github-actions-301nak95.js");
         const result = await runGithubActionsAnalyze(rootDir, {
           writeReport: (report2) => {
             const normalized = normalizeHarnessReport(report2);
@@ -194330,7 +196205,7 @@ async function runPromptConcernAnalysis(context, rootDir, scanPlan, tenant) {
   const manifest = join10(rootDir, ".moda/prompts.yml");
   let existing = [];
   if (existsSync10(manifest)) {
-    const document = $parseDocument(readFileSync17(manifest, "utf8"));
+    const document = $parseDocument(readFileSync16(manifest, "utf8"));
     if (document.errors.length)
       throw new CliInputError("Invalid prompt manifest.", document.errors[0].message);
     existing = document.toJS({ maxAliasCount: 20 })?.sources ?? [];
@@ -194801,7 +196676,7 @@ function repairCitationLines(report, rootDir) {
       continue;
     let text;
     try {
-      text = readFileSync17(candidatePath, "utf8");
+      text = readFileSync16(candidatePath, "utf8");
     } catch {
       continue;
     }
@@ -196018,7 +197893,7 @@ function collectSnapshotInputs(rootDir, maxFiles, maxTextBytes) {
     let text = "";
     if (isTextFile(path)) {
       try {
-        text = readFileSync17(current, "utf8");
+        text = readFileSync16(current, "utf8");
         inventoryTextBytes += Buffer.byteLength(text, "utf8");
       } catch {
         return;
@@ -196258,7 +198133,7 @@ function readHarnessSyncState(rootDir) {
   if (!existsSync10(path))
     return;
   try {
-    const parsed = JSON.parse(readFileSync17(path, "utf8"));
+    const parsed = JSON.parse(readFileSync16(path, "utf8"));
     if (!isRecord4(parsed) || parsed.schemaVersion !== "sync_state.v0.1") {
       return;
     }
@@ -196392,7 +198267,7 @@ function warnFresherSubdirHarnessReports(context, rootDir, explicitReport) {
   writeHarnessNotice(context, `A fresher harness report exists at ${newest.path} (this directory has ${rootState}). If you meant that report, re-run with --path=${subdir}.`);
 }
 function readHarnessGraph(manifestPath) {
-  return JSON.parse(readFileSync17(manifestPath, "utf8"));
+  return JSON.parse(readFileSync16(manifestPath, "utf8"));
 }
 function writeHarnessArtifacts(graph, rootDir, options = {}) {
   const modaDir = join10(rootDir, MODA_DIR);
@@ -196631,7 +198506,7 @@ function inventoryFiles(rootDir, skipped, options = {}) {
         recordSkipped(skipped, { path: rel2, reason: "scan text budget exceeded" });
       } else {
         try {
-          item.text = readFileSync17(current, "utf8");
+          item.text = readFileSync16(current, "utf8");
           textBytes += Buffer.byteLength(item.text, "utf8");
         } catch {
           recordSkipped(skipped, { path: rel2, reason: "text read failed" });
@@ -196938,7 +198813,7 @@ function maybeAddPromptArtifact(graph, file) {
   if (!isPrompt)
     return;
   const id = stableId2("prompt", file.path);
-  const text = file.text ?? readFileSync17(file.absPath, "utf8");
+  const text = file.text ?? readFileSync16(file.absPath, "utf8");
   upsertArtifact(graph, {
     id,
     type: "prompt",
@@ -197519,7 +199394,7 @@ function detectProviderPackagesInManifests(rootDir) {
   const packageJsonPath = join10(rootDir, "package.json");
   if (existsSync10(packageJsonPath)) {
     try {
-      const deps = packageDependencyNames(readFileSync17(packageJsonPath, "utf8"));
+      const deps = packageDependencyNames(readFileSync16(packageJsonPath, "utf8"));
       for (const provider of PROVIDER_CATALOG) {
         for (const name of provider.packageNames) {
           if (deps.has(name))
@@ -197531,7 +199406,7 @@ function detectProviderPackagesInManifests(rootDir) {
   const pyprojectPath = join10(rootDir, "pyproject.toml");
   if (existsSync10(pyprojectPath)) {
     try {
-      const deps = pyprojectDependencyNames(readFileSync17(pyprojectPath, "utf8"));
+      const deps = pyprojectDependencyNames(readFileSync16(pyprojectPath, "utf8"));
       for (const provider of PROVIDER_CATALOG) {
         for (const name of provider.packageNames) {
           if (deps.has(name.toLowerCase()))
@@ -197948,7 +199823,7 @@ function readSmallTextFileForHash(absPath, rootDir) {
   if (!isTextFile(rel2))
     return;
   try {
-    return readFileSync17(absPath, "utf8");
+    return readFileSync16(absPath, "utf8");
   } catch {
     return;
   }