@moda-ai/cli 1.55.14 → 1.55.15

package/dist/{cli-k9nae6t9.js → cli-7fc44hhq.js}

@@ -4,16 +4,16 @@ import {
 import {
   createCommandContext,
   stringOption
-} from "./cli-4x9w6ey7.js";
+} from "./cli-kf3d6y8c.js";
 import {
   assertFlags,
   assertPositionals,
   requireTenant
-} from "./cli-k7vwt56h.js";
+} from "./cli-53mvsfgn.js";
 import {
   ApiError,
   callControlAPI
-} from "./cli-ryd7nzke.js";
+} from "./cli-2ars875d.js";
 import {
   CliInputError,
   CliInputRequiredError,
@@ -39,7 +39,7 @@ import {
   resolveModaBaseUrl,
   resolveTenantId,
   shouldInventoryFile
-} from "./cli-kwz900s4.js";
+} from "./cli-b3cxcxgn.js";
 import {
   __commonJS,
   __require,
@@ -180406,6 +180406,22 @@ function isCommentLine(line) {
   const t = line.trimStart();
   return t.startsWith("//") || t.startsWith("#") || t.startsWith("*") || t.startsWith("/*") || t.startsWith("--") || t.startsWith("<!--");
 }
+function globRegex(glob) {
+  let out = "";
+  for (let i = 0;i < glob.length; i++) {
+    const ch = glob[i];
+    if (ch === "*" && glob[i + 1] === "*" && glob[i + 2] === "/") {
+      out += "(?:.*/)?";
+      i += 2;
+    } else if (ch === "*")
+      out += "[^/]*";
+    else if (ch === "?")
+      out += "[^/]";
+    else
+      out += ch.replace(/[.+^${}()|[\]\\]/, "\\$&");
+  }
+  return new RegExp(`^${out}$`);
+}
 
 // ../../packages/harness-bundle/src/detect/files.ts
 var DEFAULT_MAX_FILE_BYTES = 1024 * 1024;
@@ -180727,6 +180743,7 @@ function pyStringStateAfter(line, open) {
   }
   return open;
 }
+var PY_HEADER = /^(?:if|elif|else|try|except|finally|with|for|while|async\s+with|async\s+for)\b[^:]*:\s*/;
 function pyImports(text) {
   const out = [];
   const lines = text.split(/\r?\n/);
@@ -180737,24 +180754,34 @@ function pyImports(text) {
     inString = pyStringStateAfter(line, inString);
     if (wasInString !== undefined)
       continue;
-    let m = /^\s*from\s+([A-Za-z_][\w.]*)\s+import\s+(.+)/.exec(line);
-    if (m) {
-      out.push({ spec: m[1], line: i + 1 });
-      let list = m[2].replace(/#.*$/, "");
-      for (let j = i + 1;j < lines.length && (list.includes("(") && !list.includes(")") || /\\\s*$/.test(list)); j++)
-        list += ` ${lines[j].replace(/#.*$/, "")}`;
-      const names = list.replace(/[()\\]/g, "").split(",");
-      for (const raw of names) {
-        const name = raw.trim().split(/\s+as\s+/)[0];
-        if (/^[A-Za-z_]\w*$/.test(name))
-          out.push({ spec: `${m[1]}.${name}`, line: i + 1 });
+    const literals = [];
+    const code = line.replace(/(?:\b[rRbBuUfF]{1,2})?(['"])((?:\\.|(?!\1).)*)\1/g, (_m, _q, body) => `\x00${literals.push(body) - 1}\x00`).replace(/#.*$/, "");
+    for (const m of code.matchAll(/\b(?:importlib\.import_module|__import__)\(\s*\u0000(\d+)\u0000/g)) {
+      const spec = literals[Number(m[1])];
+      if (/^[A-Za-z_][\w.]*$/.test(spec))
+        out.push({ spec, line: i + 1 });
+    }
+    for (let stmt of code.split(";")) {
+      stmt = stmt.trim();
+      for (let h = PY_HEADER.exec(stmt);h; h = PY_HEADER.exec(stmt))
+        stmt = stmt.slice(h[0].length);
+      let m = /^from\s+([A-Za-z_][\w.]*)\s+import\s+(.+)/.exec(stmt);
+      if (m) {
+        out.push({ spec: m[1], line: i + 1 });
+        let list = m[2];
+        for (let j = i + 1;j < lines.length && (list.includes("(") && !list.includes(")") || /\\\s*$/.test(list)); j++)
+          list += ` ${lines[j].replace(/#.*$/, "")}`;
+        for (const raw of list.replace(/[()\\]/g, "").split(",")) {
+          const name = raw.trim().split(/\s+as\s+/)[0];
+          if (/^[A-Za-z_]\w*$/.test(name))
+            out.push({ spec: `${m[1]}.${name}`, line: i + 1 });
+        }
+        continue;
       }
-      continue;
-    }
-    m = /^\s*import\s+([A-Za-z_][\w.]*(?:\s+as\s+\w+)?(?:\s*,\s*[A-Za-z_][\w.]*(?:\s+as\s+\w+)?)*)/.exec(line);
-    if (m) {
-      for (const raw of m[1].split(","))
-        out.push({ spec: raw.trim().split(/\s+as\s+/)[0], line: i + 1 });
+      m = /^import\s+([A-Za-z_][\w.]*(?:\s+as\s+\w+)?(?:\s*,\s*[A-Za-z_][\w.]*(?:\s+as\s+\w+)?)*)/.exec(stmt);
+      if (m)
+        for (const raw of m[1].split(","))
+          out.push({ spec: raw.trim().split(/\s+as\s+/)[0], line: i + 1 });
     }
   }
   return out;
@@ -180873,7 +180900,7 @@ var PROVIDERS = [
   p("libsql", "database", "engine", { npm: ["@libsql/client", "drizzle-orm/libsql", "@prisma/adapter-libsql"], py: ["libsql_client", "libsql_experimental", "libsql"], pypi: ["libsql-client", "libsql-experimental"], hosts: [".turso.io"], env: ["TURSO_*", "LIBSQL_*"], schemes: ["libsql"], images: ["ghcr.io/tursodatabase/libsql-server"] }),
   p("mssql", "database", "engine", { npm: ["mssql", "tedious"], py: ["pyodbc", "pymssql"], go: ["github.com/microsoft/go-mssqldb", "github.com/denisenkom/go-mssqldb"], hosts: [".database.windows.net"], env: ["MSSQL_*"], schemes: ["mssql", "sqlserver"], images: ["mcr.microsoft.com/mssql/server", "mcr.microsoft.com/azure-sql-edge"] }),
   p("cloudflare.d1", "database", "emulated", { npm: ["drizzle-orm/d1", "@prisma/adapter-d1"] }),
-  p("redis", "kv", "engine", { npm: ["redis", "ioredis", "@redis/client", "@upstash/redis", "@vercel/kv"], py: ["redis", "aioredis", "upstash_redis", "valkey"], pypi: ["redis", "aioredis", "upstash-redis", "valkey"], go: ["github.com/redis/go-redis", "github.com/go-redis/redis", "github.com/gomodule/redigo"], gems: ["redis"], hosts: [".upstash.io", ".redis.cache.windows.net", ".redislabs.com", ".redis-cloud.com", ".cache.amazonaws.com"], env: ["REDIS_*", "UPSTASH_REDIS_*", "KV_REST_API_*", "KV_URL", "VALKEY_*", "*_REDIS_URL"], schemes: ["redis", "rediss", "valkey"], images: ["redis", "valkey/valkey", "redislabs/redismod", "redis/redis-stack", "redis/redis-stack-server", "bitnami/redis", "eqalpha/keydb", "docker.dragonflydb.io/dragonflydb/dragonfly"] }),
+  p("redis", "kv", "engine", { npm: ["redis", "ioredis", "@redis/client", "@upstash/redis", "@vercel/kv", "bullmq", "bull", "bee-queue", "@nestjs/bull", "@nestjs/bullmq"], py: ["redis", "aioredis", "upstash_redis", "valkey"], pypi: ["redis", "aioredis", "upstash-redis", "valkey"], go: ["github.com/redis/go-redis", "github.com/go-redis/redis", "github.com/gomodule/redigo"], gems: ["redis"], hosts: [".upstash.io", ".redis.cache.windows.net", ".redislabs.com", ".redis-cloud.com", ".cache.amazonaws.com"], env: ["REDIS_*", "UPSTASH_REDIS_*", "KV_REST_API_*", "KV_URL", "VALKEY_*", "*_REDIS_URL"], schemes: ["redis", "rediss", "valkey"], images: ["redis", "valkey/valkey", "redislabs/redismod", "redis/redis-stack", "redis/redis-stack-server", "bitnami/redis", "eqalpha/keydb", "docker.dragonflydb.io/dragonflydb/dragonfly"] }),
   p("memcached", "kv", "engine", { npm: ["memjs", "memcached"], py: ["pymemcache", "pylibmc"], env: ["MEMCACHE_*", "MEMCACHED_*"], schemes: ["memcached"], images: ["memcached"] }),
   p("mongodb", "document", "engine", { npm: ["mongodb", "mongoose"], py: ["pymongo", "motor", "mongoengine", "beanie"], go: ["go.mongodb.org/mongo-driver"], gems: ["mongoid", "mongo"], hosts: [".mongodb.net"], env: ["MONGODB_*", "MONGO_*"], schemes: ["mongodb", "mongodb+srv"], images: ["mongo", "mongodb/mongodb-community-server", "bitnami/mongodb"] }),
   p("clickhouse", "database", "engine", { npm: ["@clickhouse/client", "@clickhouse/client-web"], py: ["clickhouse_connect", "clickhouse_driver"], pypi: ["clickhouse-connect", "clickhouse-driver"], go: ["github.com/ClickHouse/clickhouse-go"], hosts: [".clickhouse.cloud"], env: ["CLICKHOUSE_*"], schemes: ["clickhouse"], images: ["clickhouse/clickhouse-server", "yandex/clickhouse-server"] }),
@@ -180887,7 +180914,7 @@ var PROVIDERS = [
   p("snowflake", "database", "none", { npm: ["snowflake-sdk"], py: ["snowflake.connector", "snowflake.snowpark"], pypi: ["snowflake-connector-python"], hosts: [".snowflakecomputing.com"], env: ["SNOWFLAKE_*"] }),
   p("aws.s3", "object_store", "emulated", { npm: ["@aws-sdk/client-s3", "@aws-sdk/lib-storage", "@aws-sdk/s3-request-presigner", "@aws-sdk/s3-presigned-post", "minio"], py: ["minio", "s3fs"], go: [...goAws("s3"), "github.com/minio/minio-go"], hosts: [/(^|\.)s3([.-][a-z0-9-]+)?\.amazonaws\.com$/], env: ["S3_*", "AWS_S3_*", "*_S3_BUCKET*", "MINIO_*"], schemes: ["s3"], images: ["minio/minio", "quay.io/minio/minio", "bitnami/minio"], code: [botoTracked("s3"), awsV2("S3")] }),
   p("cloudflare.r2", "object_store", "emulated", { hosts: [".r2.cloudflarestorage.com", ".r2.dev"], env: ["R2_*", "*_R2_*"] }),
-  p("gcp.gcs", "object_store", "emulated", { npm: ["@google-cloud/storage", "firebase-admin/storage"], py: ["google.cloud.storage", "firebase_admin.storage"], pypi: ["google-cloud-storage"], go: ["cloud.google.com/go/storage"], hosts: ["storage.googleapis.com"], env: ["GCS_*", "*_GCS_*"], schemes: ["gs"], images: ["fsouza/fake-gcs-server"] }),
+  p("gcp.storage", "object_store", "emulated", { npm: ["@google-cloud/storage", "firebase-admin/storage"], py: ["google.cloud.storage", "firebase_admin.storage"], pypi: ["google-cloud-storage"], go: ["cloud.google.com/go/storage"], hosts: ["storage.googleapis.com"], env: ["GCS_*", "*_GCS_*"], schemes: ["gs"], images: ["fsouza/fake-gcs-server"] }),
   p("azure.blob", "object_store", "emulated", { npm: ["@azure/storage-blob"], py: ["azure.storage.blob"], pypi: ["azure-storage-blob"], go: ["github.com/Azure/azure-sdk-for-go/sdk/storage/azblob"], hosts: [/\.blob\.core\.windows\.net$/], env: ["AZURE_STORAGE_*", "AzureWebJobsStorage"], images: ["mcr.microsoft.com/azure-storage/azurite"] }),
   p("vercel.blob", "object_store", "saas", { npm: ["@vercel/blob"], hosts: [".blob.vercel-storage.com"], env: ["BLOB_READ_WRITE_TOKEN"] }),
   p("uploadthing", "object_store", "saas", { npm: ["uploadthing", "@uploadthing/react"], env: ["UPLOADTHING_*"], hosts: ["api.uploadthing.com"] }),
@@ -180905,7 +180932,6 @@ var PROVIDERS = [
   p("kafka", "queue", "engine", { npm: ["kafkajs", "node-rdkafka", "@confluentinc/kafka-javascript"], py: ["kafka", "confluent_kafka", "aiokafka"], pypi: ["kafka-python", "confluent-kafka", "aiokafka"], go: ["github.com/segmentio/kafka-go", "github.com/confluentinc/confluent-kafka-go", "github.com/IBM/sarama", "github.com/Shopify/sarama"], hosts: [".confluent.cloud"], env: ["KAFKA_*"], schemes: ["kafka"], images: ["confluentinc/cp-kafka", "bitnami/kafka", "apache/kafka", "wurstmeister/kafka", "redpandadata/redpanda", "docker.redpanda.com/redpandadata/redpanda", "vectorized/redpanda"] }),
   p("rabbitmq", "queue", "engine", { npm: ["amqplib", "amqp-connection-manager"], py: ["pika", "aio_pika", "kombu"], pypi: ["pika", "aio-pika", "kombu"], go: ["github.com/rabbitmq/amqp091-go", "github.com/streadway/amqp"], hosts: [".cloudamqp.com"], env: ["RABBITMQ_*", "AMQP_*"], schemes: ["amqp", "amqps"], images: ["rabbitmq", "bitnami/rabbitmq"] }),
   p("nats", "queue", "engine", { npm: ["nats"], py: ["nats"], pypi: ["nats-py"], go: ["github.com/nats-io/nats.go"], env: ["NATS_*"], schemes: ["nats"], images: ["nats"] }),
-  p("bullmq", "queue", "engine", { npm: ["bullmq", "bull", "bee-queue"] }),
   p("celery", "queue", "engine", { py: ["celery"], env: ["CELERY_*"] }),
   p("inngest", "queue", "emulated", { npm: ["inngest"], py: ["inngest"], env: ["INNGEST_*"], hosts: ["api.inngest.com", "inn.gs"] }),
   p("trigger.dev", "queue", "saas", { npm: ["@trigger.dev/sdk"], env: ["TRIGGER_*"], hosts: ["api.trigger.dev"] }),
@@ -180921,7 +180947,11 @@ var PROVIDERS = [
   p("aws.bedrock_agentcore", "function.invoke", "none", { npm: ["bedrock-agentcore", "@aws-sdk/client-bedrock-agentcore", "@aws-sdk/client-bedrock-agentcore-control"], py: ["bedrock_agentcore"], pypi: ["bedrock-agentcore"], env: ["BEDROCK_AGENTCORE_*"], code: [botoTracked("bedrock-agentcore", "bedrock-agentcore-control")] }),
   p("cloud.metadata", "other", "emulated", { hosts: ["metadata.google.internal", "169.254.169.254", "metadata"] }),
   p("gcp.secretmanager", "other", "saas", { npm: ["@google-cloud/secret-manager"], py: ["google.cloud.secretmanager"], pypi: ["google-cloud-secret-manager"], hosts: ["secretmanager.googleapis.com"] }),
-  p("gcp.ml_apis", "http.request", "saas", { npm: ["@google-cloud/vision", "@google-cloud/language", "@google-cloud/translate", "@google-cloud/speech", "@google-cloud/text-to-speech", "@google-cloud/video-intelligence", "@google-cloud/documentai", "@google-cloud/dialogflow", "@google-cloud/dlp"], py: ["google.cloud.vision", "google.cloud.language", "google.cloud.translate", "google.cloud.translate_v2", "google.cloud.translate_v3", "google.cloud.speech", "google.cloud.texttospeech", "google.cloud.videointelligence", "google.cloud.documentai", "google.cloud.dialogflow"], hosts: ["vision.googleapis.com", "translation.googleapis.com", "language.googleapis.com", "speech.googleapis.com", "texttospeech.googleapis.com", "documentai.googleapis.com"] }),
+  p("gcp.vision", "http.request", "saas", { npm: ["@google-cloud/vision"], py: ["google.cloud.vision"], pypi: ["google-cloud-vision"], hosts: ["vision.googleapis.com"] }),
+  p("gcp.translate", "http.request", "saas", { npm: ["@google-cloud/translate"], py: ["google.cloud.translate", "google.cloud.translate_v2", "google.cloud.translate_v3"], pypi: ["google-cloud-translate"], hosts: ["translation.googleapis.com"] }),
+  p("gcp.speech", "http.request", "saas", { npm: ["@google-cloud/speech", "@google-cloud/text-to-speech"], py: ["google.cloud.speech", "google.cloud.texttospeech"], hosts: ["speech.googleapis.com", "texttospeech.googleapis.com"] }),
+  p("gcp.language", "http.request", "saas", { npm: ["@google-cloud/language"], py: ["google.cloud.language"], hosts: ["language.googleapis.com"] }),
+  p("gcp.documentai", "http.request", "saas", { npm: ["@google-cloud/documentai", "@google-cloud/video-intelligence", "@google-cloud/dialogflow", "@google-cloud/dlp"], py: ["google.cloud.documentai", "google.cloud.videointelligence", "google.cloud.dialogflow"], hosts: ["documentai.googleapis.com"] }),
   p("cloudflare.api", "http.request", "saas", { npm: ["cloudflare"], py: ["cloudflare"], hosts: ["api.cloudflare.com"], env: ["CLOUDFLARE_API_TOKEN", "CF_API_TOKEN"] }),
   p("pinecone", "vector_store", "emulated", { npm: ["@pinecone-database/pinecone", "@langchain/pinecone"], py: ["pinecone", "langchain_pinecone"], pypi: ["pinecone", "pinecone-client"], hosts: [".pinecone.io"], env: ["PINECONE_*"], images: ["ghcr.io/pinecone-io/pinecone-local"] }),
   p("weaviate", "vector_store", "engine", { npm: ["weaviate-client", "weaviate-ts-client", "@langchain/weaviate"], py: ["weaviate"], pypi: ["weaviate-client"], hosts: [".weaviate.network", ".weaviate.cloud"], env: ["WEAVIATE_*"], images: ["semitechnologies/weaviate", "cr.weaviate.io/semitechnologies/weaviate"] }),
@@ -180943,7 +180973,7 @@ var PROVIDERS = [
   p("anthropic", "model.inference", "model", { npm: ["@anthropic-ai/sdk", "@ai-sdk/anthropic", "@langchain/anthropic", "@anthropic-ai/claude-agent-sdk", "@anthropic-ai/claude-code", "@anthropic-ai/bedrock-sdk", "@anthropic-ai/vertex-sdk"], py: ["anthropic", "langchain_anthropic", "claude_agent_sdk", "claude_code_sdk", "llama_index.llms.anthropic"], pypi: ["langchain-anthropic", "claude-agent-sdk", "claude-code-sdk"], go: ["github.com/anthropics/anthropic-sdk-go"], hosts: ["api.anthropic.com"], env: ["ANTHROPIC_*"] }),
   p("openrouter", "model.inference", "model", { npm: ["@openrouter/ai-sdk-provider", "@openrouter/sdk"], hosts: ["openrouter.ai"], env: ["OPENROUTER_*"] }),
   p("google.genai", "model.inference", "model", { npm: ["@google/genai", "@google/generative-ai", "@ai-sdk/google", "@langchain/google-genai", "@genkit-ai/googleai", "@genkit-ai/google-genai"], py: ["google.genai", "google.generativeai", "langchain_google_genai"], pypi: ["google-genai", "google-generativeai", "langchain-google-genai"], go: ["google.golang.org/genai", "github.com/google/generative-ai-go"], hosts: ["generativelanguage.googleapis.com"], env: ["GEMINI_*", "GOOGLE_API_KEY", "GOOGLE_GENERATIVE_AI_*", "GOOGLE_GENAI_*"] }),
-  p("google.vertex", "model.inference", "model", { npm: ["@google-cloud/vertexai", "@ai-sdk/google-vertex", "@langchain/google-vertexai", "@genkit-ai/vertexai"], py: ["vertexai", "google.cloud.aiplatform", "langchain_google_vertexai"], pypi: ["google-cloud-aiplatform", "langchain-google-vertexai"], hosts: [/aiplatform\.googleapis\.com$/], env: ["VERTEX_*", "GOOGLE_VERTEX_*"] }),
+  p("google.vertex", "model.inference", "model", { npm: ["@google-cloud/vertexai", "@ai-sdk/google-vertex", "@langchain/google-vertexai", "@genkit-ai/vertexai"], py: ["vertexai", "google.cloud.aiplatform", "langchain_google_vertexai", "pydantic_ai.models.vertexai"], pypi: ["google-cloud-aiplatform", "langchain-google-vertexai"], hosts: [/aiplatform\.googleapis\.com$/], env: ["VERTEX_*", "GOOGLE_VERTEX_*", "GOOGLE_GENAI_USE_VERTEXAI"], code: [/\bvertexai\.init\s*\(/, /\bClient\s*\([^)]*\bvertexai\s*=\s*True/, /\bnew\s+GoogleGenAI\s*\(\s*\{[^}]*\bvertexai\s*:\s*true/, /GOOGLE_GENAI_USE_VERTEXAI['"]?\s*\]?\s*=\s*['"]?(?:True|true|TRUE|1)\b/] }),
   p("aws.bedrock", "model.inference", "model", { npm: ["@aws-sdk/client-bedrock-runtime", "@aws-sdk/client-bedrock-agent-runtime", "@ai-sdk/amazon-bedrock", "@langchain/aws"], py: ["langchain_aws"], pypi: ["langchain-aws"], go: goAws("bedrockruntime"), hosts: [/^bedrock(-runtime|-agent-runtime)?\.[a-z0-9-]+\.amazonaws\.com$/], env: ["BEDROCK_*", "AWS_BEDROCK_*"], code: [botoTracked("bedrock-runtime", "bedrock-agent-runtime", "bedrock")] }),
   p("azure.openai", "model.inference", "model", { npm: ["@azure/openai", "@ai-sdk/azure"], py: ["azure.ai.inference", "azure.ai.openai"], hosts: [/\.openai\.azure\.com$/, /\.services\.ai\.azure\.com$/], env: ["AZURE_OPENAI_*", "AZURE_AI_*"], code: [/\bAzureOpenAI\s*\(/, /\bAzureChatOpenAI\s*\(/, /\bnew\s+AzureOpenAI\s*\(/] }),
   p("groq", "model.inference", "model", { npm: ["groq-sdk", "@ai-sdk/groq", "@langchain/groq"], py: ["groq", "langchain_groq"], hosts: ["api.groq.com"], env: ["GROQ_*"] }),
@@ -180999,7 +181029,7 @@ var PROVIDERS = [
   p("shopify", "http.request", "saas", { npm: ["@shopify/shopify-api", "@shopify/admin-api-client", "shopify-api-node"], py: ["shopify"], pypi: ["ShopifyAPI"], hosts: [".myshopify.com"], env: ["SHOPIFY_*"] }),
   p("jira", "http.request", "saas", { npm: ["jira-client", "jira.js"], py: ["jira", "atlassian"], pypi: ["atlassian-python-api"], hosts: [".atlassian.net"], env: ["JIRA_*", "ATLASSIAN_*", "CONFLUENCE_*"] }),
   p("airtable", "http.request", "saas", { npm: ["airtable"], py: ["pyairtable"], hosts: ["api.airtable.com"], env: ["AIRTABLE_*"] }),
-  p("google.apis", "http.request", "saas", { npm: ["googleapis", "@googleapis/sheets", "@googleapis/gmail", "@googleapis/drive", "@googleapis/calendar"], py: ["googleapiclient", "google_auth_oauthlib", "google.oauth2", "google.auth"], pypi: ["google-api-python-client", "google-auth-oauthlib"], go: ["google.golang.org/api"], hosts: ["www.googleapis.com", "sheets.googleapis.com", "gmail.googleapis.com", "oauth2.googleapis.com", "accounts.google.com", ".googleapis.com"], env: ["GOOGLE_CLIENT_*", "GOOGLE_SERVICE_ACCOUNT*"] }),
+  p("google.apis", "http.request", "saas", { npm: ["googleapis", "@googleapis/sheets", "@googleapis/gmail", "@googleapis/drive", "@googleapis/calendar"], py: ["googleapiclient", "google_auth_oauthlib"], pypi: ["google-api-python-client", "google-auth-oauthlib"], go: ["google.golang.org/api"], hosts: ["www.googleapis.com", "sheets.googleapis.com", "gmail.googleapis.com", "oauth2.googleapis.com", "accounts.google.com", ".googleapis.com"], env: ["GOOGLE_CLIENT_*", "GOOGLE_SERVICE_ACCOUNT*"] }),
   p("google.maps", "http.request", "saas", { npm: ["@googlemaps/google-maps-services-js"], py: ["googlemaps"], hosts: ["maps.googleapis.com", "places.googleapis.com"], env: ["GOOGLE_MAPS_*"] }),
   p("serpapi", "http.request", "saas", { npm: ["serpapi"], py: ["serpapi"], pypi: ["google-search-results"], hosts: ["serpapi.com"], env: ["SERPAPI_*", "SERP_API_*"] }),
   p("serper", "http.request", "saas", { hosts: ["google.serper.dev"], env: ["SERPER_*"], code: [/\bSerperDevTool\s*\(/] }),
@@ -181025,22 +181055,52 @@ var PROVIDERS = [
   p("arxiv", "http.request", "saas", { py: ["arxiv"], hosts: ["export.arxiv.org"], code: [/\bArxiv(?:Retriever|APIWrapper|QueryRun|Loader)\s*\(/] }),
   p("linkup", "http.request", "saas", { npm: ["linkup-sdk"], py: ["linkup"], pypi: ["linkup-sdk"], hosts: ["api.linkup.so"], env: ["LINKUP_*"] }),
   p("ncbi", "http.request", "saas", { hosts: ["eutils.ncbi.nlm.nih.gov", "pubmed.ncbi.nlm.nih.gov"], code: [/\bPubMed(?:APIWrapper|QueryRun|Retriever)\s*\(/], env: ["NCBI_*", "PUBMED_*"] }),
+  p("mcp", "function.invoke", "saas", { npm: ["@modelcontextprotocol/sdk/client", "@ai-sdk/mcp", "@langchain/mcp-adapters"], py: ["mcp.client", "langchain_mcp_adapters", "fastmcp.client"], code: [/\baddMcpServer\s*\(/, /\bcreateSdkMcpServer\s*\(/, /\bexperimental_createMCPClient\s*\(|\bcreateMCPClient\s*\(/, /\bmcpServers\b/, /\bMultiServerMCPClient\s*\(/, /\bClientSession\s*\(\s*read/] }),
   p("pusher", "http.request", "saas", { npm: ["pusher"], py: ["pusher"], hosts: [".pusher.com"], env: ["PUSHER_*"] }),
   p("ably", "http.request", "saas", { npm: ["ably"], py: ["ably"], hosts: ["rest.ably.io", "realtime.ably.io"], env: ["ABLY_*"] }),
   p("mapbox", "http.request", "saas", { hosts: ["api.mapbox.com"], env: ["MAPBOX_*", "*_MAPBOX_*"] }),
   p("openweathermap", "http.request", "saas", { hosts: ["api.openweathermap.org"], env: ["OPENWEATHER*"] }),
   p("open-meteo", "http.request", "saas", { hosts: ["api.open-meteo.com", "geocoding-api.open-meteo.com", "archive-api.open-meteo.com"] }),
-  p("telemetry.sentry", "other", "saas", { npm: ["@sentry/node", "@sentry/nextjs", "@sentry/cloudflare", "@sentry/serverless", "@sentry/aws-serverless", "@sentry/bun", "@sentry/react"], py: ["sentry_sdk"], pypi: ["sentry-sdk"], hosts: [".ingest.sentry.io", ".ingest.us.sentry.io"], env: ["SENTRY_*", "*_SENTRY_*"] }),
-  p("telemetry.langsmith", "other", "saas", { npm: ["langsmith"], py: ["langsmith"], hosts: ["api.smith.langchain.com"], env: ["LANGSMITH_*", "LANGCHAIN_API_KEY", "LANGCHAIN_TRACING*", "LANGCHAIN_ENDPOINT", "LANGCHAIN_PROJECT"] }),
-  p("telemetry.langfuse", "other", "saas", { npm: ["langfuse", "@langfuse/tracing", "@langfuse/otel", "langfuse-vercel"], py: ["langfuse"], hosts: ["cloud.langfuse.com", "us.cloud.langfuse.com"], env: ["LANGFUSE_*"] }),
-  p("telemetry.posthog", "other", "saas", { npm: ["posthog-node", "posthog-js"], py: ["posthog"], hosts: [".posthog.com"], env: ["POSTHOG_*", "*_POSTHOG_*"] }),
-  p("telemetry.datadog", "other", "saas", { npm: ["dd-trace"], py: ["ddtrace", "datadog"], hosts: [".datadoghq.com", ".datadoghq.eu"], env: ["DD_API_KEY", "DD_SITE", "DATADOG_*"] }),
-  p("telemetry.braintrust", "other", "saas", { npm: ["braintrust"], py: ["braintrust"], hosts: ["api.braintrust.dev"], env: ["BRAINTRUST_*"] }),
+  p("sentry", "other", "saas", { npm: ["@sentry/node", "@sentry/nextjs", "@sentry/cloudflare", "@sentry/serverless", "@sentry/aws-serverless", "@sentry/bun", "@sentry/react"], py: ["sentry_sdk"], pypi: ["sentry-sdk"], hosts: [".ingest.sentry.io", ".ingest.us.sentry.io"], env: ["SENTRY_*", "*_SENTRY_*"] }),
+  p("langsmith", "other", "saas", { npm: ["langsmith"], py: ["langsmith"], hosts: ["api.smith.langchain.com"], env: ["LANGSMITH_*", "LANGCHAIN_API_KEY", "LANGCHAIN_TRACING*", "LANGCHAIN_ENDPOINT", "LANGCHAIN_PROJECT"] }),
+  p("langfuse", "other", "saas", { npm: ["langfuse", "@langfuse/tracing", "@langfuse/otel", "langfuse-vercel"], py: ["langfuse"], hosts: ["cloud.langfuse.com", "us.cloud.langfuse.com"], env: ["LANGFUSE_*"] }),
+  p("posthog", "other", "saas", { npm: ["posthog-node", "posthog-js"], py: ["posthog"], hosts: [".posthog.com"], env: ["POSTHOG_*", "*_POSTHOG_*"] }),
+  p("datadog", "other", "saas", { npm: ["dd-trace"], py: ["ddtrace", "datadog"], hosts: [".datadoghq.com", ".datadoghq.eu"], env: ["DD_API_KEY", "DD_SITE", "DATADOG_*"] }),
+  p("braintrust", "other", "saas", { npm: ["braintrust"], py: ["braintrust"], hosts: ["api.braintrust.dev"], env: ["BRAINTRUST_*"] }),
   p("telemetry.gcp", "other", "saas", { npm: ["@google-cloud/logging", "@google-cloud/logging-winston", "@google-cloud/monitoring", "@google-cloud/opentelemetry-cloud-trace-exporter", "@google-cloud/trace-agent"], py: ["google.cloud.logging"], pypi: ["google-cloud-logging"] }),
   p("telemetry.azure_monitor", "other", "saas", { npm: ["@azure/monitor-opentelemetry", "applicationinsights"], py: ["azure.monitor.opentelemetry", "opencensus.ext.azure"], pypi: ["azure-monitor-opentelemetry"], hosts: [".applicationinsights.azure.com", "dc.services.visualstudio.com"], env: ["APPLICATIONINSIGHTS_*"] }),
-  p("telemetry.otlp", "other", "saas", { npm: ["@opentelemetry/exporter-trace-otlp-http", "@opentelemetry/exporter-trace-otlp-proto", "@opentelemetry/exporter-trace-otlp-grpc", "@vercel/otel"], py: ["opentelemetry.exporter.otlp"], pypi: ["opentelemetry-exporter-otlp"], env: ["OTEL_EXPORTER_OTLP_*"] }),
   p("local_fs", "file", "engine", { code: [/\b(?:fs\.)?(?:writeFile|writeFileSync|appendFile|appendFileSync)\s*\(/, /\bBun\.write\s*\(/, /\bopen\([^)\n]*,\s*['"](?:w|a|wb|ab|w\+|a\+)['"]/, /\.write_(?:text|bytes)\s*\(/] })
 ];
+var SDK_DEFAULT_ENV = {
+  "npm:openai": ["OPENAI_API_KEY", "OPENAI_BASE_URL", "OPENAI_ORG_ID", "OPENAI_PROJECT_ID"],
+  "pypi:openai": ["OPENAI_API_KEY", "OPENAI_BASE_URL", "OPENAI_ORG_ID", "OPENAI_PROJECT_ID"],
+  "npm:@openai/agents": ["OPENAI_API_KEY", "OPENAI_BASE_URL", "OPENAI_DEFAULT_MODEL", "OPENAI_AGENTS_DISABLE_TRACING", "OPENAI_AGENTS_DONT_LOG_MODEL_DATA", "OPENAI_AGENTS_DONT_LOG_TOOL_DATA"],
+  "pypi:openai-agents": ["OPENAI_API_KEY", "OPENAI_BASE_URL", "OPENAI_DEFAULT_MODEL", "OPENAI_AGENTS_DISABLE_SENSITIVE_DATA", "OPENAI_AGENTS_DONT_LOG_MODEL_DATA", "OPENAI_AGENTS_DONT_LOG_TOOL_DATA"],
+  "npm:@anthropic-ai/sdk": ["ANTHROPIC_API_KEY", "ANTHROPIC_BASE_URL"],
+  "pypi:anthropic": ["ANTHROPIC_API_KEY", "ANTHROPIC_BASE_URL"],
+  "npm:@anthropic-ai/claude-agent-sdk": ["ANTHROPIC_API_KEY"],
+  "pypi:claude-agent-sdk": ["ANTHROPIC_API_KEY"],
+  "npm:@google/genai": ["GEMINI_API_KEY", "GOOGLE_API_KEY"],
+  "pypi:google-genai": ["GEMINI_API_KEY", "GOOGLE_API_KEY"],
+  "npm:groq-sdk": ["GROQ_API_KEY"],
+  "pypi:groq": ["GROQ_API_KEY"],
+  "npm:@mistralai/mistralai": ["MISTRAL_API_KEY"],
+  "pypi:mistralai": ["MISTRAL_API_KEY"],
+  "npm:cohere-ai": ["CO_API_KEY"],
+  "pypi:cohere": ["CO_API_KEY"],
+  "npm:together-ai": ["TOGETHER_API_KEY"],
+  "pypi:together": ["TOGETHER_API_KEY"],
+  "npm:replicate": ["REPLICATE_API_TOKEN"],
+  "pypi:replicate": ["REPLICATE_API_TOKEN"],
+  "npm:@pinecone-database/pinecone": ["PINECONE_API_KEY"],
+  "pypi:pinecone": ["PINECONE_API_KEY"],
+  "pypi:logfire": ["LOGFIRE_TOKEN"],
+  "npm:@pydantic/logfire-node": ["LOGFIRE_TOKEN"],
+  "npm:langsmith": ["LANGSMITH_API_KEY"],
+  "pypi:langsmith": ["LANGSMITH_API_KEY"],
+  "npm:@livekit/agents": ["LIVEKIT_URL", "LIVEKIT_API_KEY", "LIVEKIT_API_SECRET"],
+  "pypi:livekit-agents": ["LIVEKIT_URL", "LIVEKIT_API_KEY", "LIVEKIT_API_SECRET"]
+};
 var WORKERS_BINDINGS = {
   d1_databases: { capability: "database", provider: "cloudflare.d1", cls: "emulated", type: "D1" },
   kv_namespaces: { capability: "kv", provider: "cloudflare.kv", cls: "emulated", type: "KV" },
@@ -181075,8 +181135,42 @@ var CFN_RESOURCES = {
   "AWS::ElastiCache::CacheCluster": { capability: "kv", provider: "redis", cls: "engine" },
   "AWS::ElastiCache::ReplicationGroup": { capability: "kv", provider: "redis", cls: "engine" },
   "AWS::ElastiCache::ServerlessCache": { capability: "kv", provider: "redis", cls: "engine" },
-  "AWS::OpenSearchService::Domain": { capability: "search", provider: "opensearch", cls: "engine" }
+  "AWS::OpenSearchService::Domain": { capability: "search", provider: "opensearch", cls: "engine" },
+  "AWS::Cognito::UserPoolClient": { capability: "auth", provider: "aws.cognito", cls: "emulated" },
+  "AWS::Cognito::IdentityPool": { capability: "auth", provider: "aws.cognito", cls: "emulated" },
+  "AWS::Bedrock::Agent": { capability: "model.inference", provider: "aws.bedrock", cls: "model" },
+  "AWS::Bedrock::KnowledgeBase": { capability: "vector_store", provider: "aws.bedrock", cls: "none" },
+  "AWS::BedrockAgentCore::Runtime": { capability: "function.invoke", provider: "aws.bedrock_agentcore", cls: "none" },
+  "AWS::BedrockAgentCore::Gateway": { capability: "function.invoke", provider: "aws.bedrock_agentcore", cls: "none" },
+  "AWS::BedrockAgentCore::Memory": { capability: "document", provider: "aws.bedrock_agentcore", cls: "none" }
+};
+var CFN_SHORT = {
+  dynamodb: "dynamodb",
+  s3: "s3",
+  sqs: "sqs",
+  sns: "sns",
+  events: "eventbridge",
+  kinesis: "kinesis",
+  stepfunctions: "stepfunctions",
+  cognito: "cognito",
+  secretsmanager: "secretsmanager",
+  ssm: "ssm",
+  elasticache: "elasticache",
+  opensearchservice: "opensearch",
+  rds: "rds"
 };
+function cfnBindingType(type) {
+  const [, service = "", resource = ""] = type.split("::");
+  if (type === "AWS::Serverless::SimpleTable")
+    return "dynamodb";
+  if (type === "AWS::Serverless::StateMachine")
+    return "stepfunctions";
+  const svc = service.toLowerCase();
+  if (svc === "bedrock" || svc === "bedrockagentcore") {
+    return `${svc === "bedrock" ? "bedrock" : "agentcore"}_${resource.replace(/([a-z])([A-Z])/g, "$1_$2").toLowerCase()}`;
+  }
+  return CFN_SHORT[svc] ?? svc;
+}
 function rdsEngineProvider(engine) {
   const e = (engine ?? "").toLowerCase();
   if (e.includes("postgres"))
@@ -181573,6 +181667,9 @@ function scanSources(ctx, declaredPypi, workspaceNames) {
       evidence: evidence.slice(0, 3)
     };
     ctx.gaps.push(gap);
+    if (evidence.some((e) => !isTestPath(e.path))) {
+      ctx.signals.push({ kind: "code", capability: "http.request", provider: "http", host: undefined, evidence: evidence[0] });
+    }
   }
   return { frameworks };
 }
@@ -181597,6 +181694,7 @@ var CODE_ENV_RES = [
   /\bos\.environ\[\s*['"]([A-Za-z_][A-Za-z0-9_]*)['"]\s*\]/g,
   /\bos\.environ\.get\(\s*['"]([A-Za-z_][A-Za-z0-9_]*)['"]/g,
   /\bos\.getenv\(\s*['"]([A-Za-z_][A-Za-z0-9_]*)['"]/g,
+  /['"]([A-Z_][A-Z0-9_]*)['"]\s+(?:not\s+)?in\s+os\.environ\b/g,
   /\bos\.Getenv\(\s*"([A-Za-z_][A-Za-z0-9_]*)"/g,
   /\bos\.LookupEnv\(\s*"([A-Za-z_][A-Za-z0-9_]*)"/g,
   /\bENV\[\s*['"]([A-Za-z_][A-Za-z0-9_]*)['"]\s*\]/g,
@@ -181604,11 +181702,15 @@ var CODE_ENV_RES = [
   /\benv\.(?:str|int|bool|url|db|list|float|json)\(\s*['"]([A-Z_][A-Z0-9_]*)['"]/g,
   /\bconfig\(\s*['"]([A-Z_][A-Z0-9_]*)['"]/g
 ];
-var ENV_EXAMPLE_FILE = /^(?:\.env\.(?:example|sample|template|dist|defaults|local\.example|development\.example)|\.env-(?:example|sample)|example\.env|sample\.env|env\.example|\.dev\.vars\.example|\.dev\.vars\.sample)$/;
+var ENV_EXAMPLE_FILE = /^(?:\.env\.(?:example|sample|template|dist|defaults?|local\.example|development\.example)|\.env-(?:example|sample)|example\.env|sample\.env|env\.example|\.dev\.vars\.example|\.dev\.vars\.sample)$/;
 var ENV_SECRET_FILE = /^(?:\.env(?:\.[\w.-]+)?|\.dev\.vars)$/;
 function isEnvExampleFile(path) {
   return ENV_EXAMPLE_FILE.test(basename2(path));
 }
+function isEnvFile(path) {
+  const name = basename2(path);
+  return (ENV_EXAMPLE_FILE.test(name) || ENV_SECRET_FILE.test(name)) && !/\.test\b/.test(name);
+}
 function scanEnv(ctx) {
   for (const file of ctx.files) {
     const name = basename2(file.path);
@@ -181634,6 +181736,8 @@ function scanEnv(ctx) {
       continue;
     const at = lineIndex(file.text);
     const lines = splitLines(file.text);
+    if (file.path.endsWith(".py") && /\bBaseSettings\b/.test(file.text))
+      settingsFields(ctx, file.path, lines);
     const seen = new Set;
     for (const re of CODE_ENV_RES) {
       re.lastIndex = 0;
@@ -181655,6 +181759,63 @@ function scanEnv(ctx) {
     }
   }
 }
+function sdkDefaultEnv(ctx, declared) {
+  const seen = new Set;
+  for (const d of declared) {
+    const file = ctx.byPath.get(d.path);
+    if (d.dev || file?.isTest)
+      continue;
+    const key = `${d.eco}:${d.eco === "pypi" ? d.name.toLowerCase().replace(/[_.]/g, "-") : d.name}`;
+    for (const name of SDK_DEFAULT_ENV[key] ?? []) {
+      if (seen.has(`${name}:${d.path}`))
+        continue;
+      seen.add(`${name}:${d.path}`);
+      const line = d.line ?? 1;
+      ctx.env.push({
+        name,
+        source: `${d.path}:${line}`,
+        evidence: { path: d.path, line, excerpt: excerpt(file ? splitLines(file.text)[line - 1] : undefined), detector: `${DETECTOR2}.sdk_default` }
+      });
+    }
+  }
+}
+function settingsFields(ctx, path, lines) {
+  const settings = new Map([["BaseSettings", ""]]);
+  for (let i = 0;i < lines.length; i++) {
+    const cls = /^class\s+(\w+)\s*\(([^)]*)\)/.exec(lines[i]);
+    const base = cls?.[2].split(",").map((b) => b.trim().split(".").pop() ?? "").find((b) => settings.has(b));
+    if (!cls || base === undefined)
+      continue;
+    const body = [];
+    let prefix = settings.get(base) ?? "";
+    let docstring = false;
+    for (let j = i + 1;j < lines.length; j++) {
+      const line = lines[j];
+      if (line.trim() !== "" && !/^\s/.test(line))
+        break;
+      const quotes = (line.match(/"""|'''/g) ?? []).length;
+      if (docstring || quotes > 0) {
+        if (quotes % 2 === 1)
+          docstring = !docstring;
+        continue;
+      }
+      const p2 = /\benv_prefix\s*=\s*['"]([^'"]*)['"]/.exec(line);
+      if (p2)
+        prefix = p2[1];
+      const m = /^ {4}([A-Za-z][A-Za-z0-9_]*)\s*:/.exec(line);
+      if (m && m[1] !== "model_config" && !isCommentLine(line))
+        body.push({ name: m[1], line: j + 1 });
+    }
+    settings.set(cls[1], prefix);
+    for (const f of body) {
+      ctx.env.push({
+        name: `${prefix}${f.name}`.toUpperCase(),
+        source: `${path}:${f.line}`,
+        evidence: { path, line: f.line, excerpt: excerpt(lines[f.line - 1]), detector: `${DETECTOR2}.settings` }
+      });
+    }
+  }
+}
 var GENERIC_DB_URL = /^(?:[A-Z0-9]+_)*(?:DATABASE|DB)_(?:URL|URI|DSN|CONNECTION(?:_STRING)?)(?:_[A-Z0-9]+)*$|^SQLALCHEMY_DATABASE_UR[IL]$|^(?:DATABASE|DB)$/;
 function isGenericDatabaseUrl(name) {
   return GENERIC_DB_URL.test(name);
@@ -181689,6 +181850,8 @@ function envSignals(ctx) {
     }
     if (resolved)
       continue;
+    if (/(?:^|_)(?:USE|ENABLE|ENABLED)(?:_|$)/.test(obs.name) && obs.value !== undefined && /^(?:false|0|no|off)$/i.test(obs.value.trim()))
+      continue;
     const sig = matchEnvName(obs.name);
     if (sig) {
       ctx.signals.push({ kind: "env", capability: sig.capability, provider: sig.provider, envVar: obs.name, evidence: ev, weak: isTestPath(ev.path) });
@@ -181698,14 +181861,18 @@ function envSignals(ctx) {
 var SECRET_NAME = /(?:^|_)(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD|PWD|PASS|CREDENTIALS?|PRIVATE|AUTH|SIGNING|SALT|CERT|DSN)(?:_|$)|APIKEY|_PAT$/;
 var ENDPOINT_NAME = /(?:^|_)(?:URL|URI|ENDPOINT|HOST|HOSTNAME|BASE|BASE_URL|ADDR|ADDRESS|PORT|DSN|CONNECTION(?:_STRING)?|SERVER|REGION|BUCKET|TABLE|QUEUE|TOPIC|DATABASE|DB|INDEX|NAMESPACE|PROJECT_ID|ACCOUNT_ID)(?:_|$)/;
 var SELF_CONFIG = /^(?:NODE_ENV|ENV|ENVIRONMENT|APP_ENV|DEBUG|LOG_LEVEL|LOGLEVEL|PORT|HOST|HOSTNAME|TZ|PYTHONPATH|PYTHONUNBUFFERED|PATH|HOME|CI|VERCEL_ENV|VERCEL_URL|NEXT_PUBLIC_APP_URL|APP_URL|SITE_URL|PUBLIC_URL|BASE_URL|NEXTAUTH_URL|AUTH_URL|DJANGO_SETTINGS_MODULE|FLASK_APP|FLASK_ENV|WORKERS|WEB_CONCURRENCY|ALLOWED_HOSTS|DJANGO_ALLOWED_HOSTS|CORS_ORIGINS?)$/;
+var PUBLIC_NAME = /^(?:NEXT_PUBLIC_|VITE_|PUBLIC_|EXPO_PUBLIC_|REACT_APP_|NUXT_PUBLIC_|GATSBY_)|(?:^|_)(?:PUBLISHABLE|ANON)_KEY$/;
+var CREDENTIAL_SETTING = /^(?:ENABLE|ENABLED|ALLOW|DISABLE|USE|MIN|MAX)_|_(?:LENGTH|EXPIRY|EXPIRES_IN|INTERVAL|INTERVAL_\w+|SECONDS|SECS|HOURS|MINUTES|MS|TTL|MAX|WINDOW|PREFIX|PREFIX_VAR|KIND|PATH|FORMAT|PROVIDER|DURATION|VIOLATIONS|COUNT|LIMIT)$/;
 function classifyName(name) {
-  if (SELF_CONFIG.test(name))
+  if (SELF_CONFIG.test(name) || PUBLIC_NAME.test(name))
     return "config";
   if (SECRET_NAME.test(name))
     return "secret";
   return "unknown";
 }
 function classifyLinked(name, deps) {
+  if (PUBLIC_NAME.test(name))
+    return "config";
   const isModel = deps.some((d) => d.capability === "model.inference");
   const secret = SECRET_NAME.test(name) && !/(?:^|_)(?:URL|URI|HOST|ENDPOINT)$/.test(name);
   if (isModel) {
@@ -181721,6 +181888,21 @@ function classifyLinked(name, deps) {
     return "dependency_endpoint";
   return "config";
 }
+var AMBIENT_ENV = /^(?:PATH|HOME|USER|LOGNAME|SHELL|PWD|OLDPWD|TERM|LANG|LANGUAGE|LC_\w+|TMPDIR|TEMP|TMP|EDITOR|PAGER|LD_PRELOAD|LD_LIBRARY_PATH|PYTHONDONTWRITEBYTECODE|PYTHONASYNCIODEBUG|PYTHONHASHSEED|PYTHONFAULTHANDLER|NX_\w+|APPDATA|LOCALAPPDATA|PROGRAMDATA|USERPROFILE|COMSPEC|SYSTEMROOT|WINDIR|COLORTERM|COLORFGBG|NO_COLOR|FORCE_COLOR|TERM_PROGRAM|DEBIAN_FRONTEND|BUILDPLATFORM|TARGETPLATFORM|TARGETOS|TARGETARCH|TARGETVARIANT|BUILDOS|BUILDARCH|BUILDKIT_\w+|DOCKER_BUILDKIT|DOCKER_METADATA_\w+|GITHUB_(?:ACTIONS|WORKSPACE|SHA|REF|REF_NAME|REF_TYPE|HEAD_REF|BASE_REF|RUN_ID|RUN_NUMBER|RUN_ATTEMPT|REPOSITORY|REPOSITORY_OWNER|EVENT_NAME|EVENT_PATH|ENV|OUTPUT|STEP_SUMMARY|PATH|JOB|ACTOR|SERVER_URL|API_URL|GRAPHQL_URL|WORKFLOW|ACTION|ACTION_PATH|RETENTION_DAYS)|RUNNER_\w+|ACTIONS_\w+|CARGO_\w+|RUSTFLAGS|BASH_\w+|BASH|ZSH_\w+|CONDA_\w+|VIRTUAL_ENV|PYENV_\w+|NVM_\w+|npm_\w+|CODECOV_TOKEN|DOCKERHUB_\w+|UV_\w+|PIP_\w+|POETRY_\w+|CMAKE_\w+|CC|CXX|CFLAGS|CXXFLAGS|LDFLAGS|MAKEFLAGS|ANDROID_\w+|XDG_\w+|SSH_\w+|DISPLAY|SHLVL|_)$/;
+var TOOLING_SOURCE = /(^|\/)(\.github|\.gitlab|\.circleci|\.buildkite|ci|\.devcontainer)\/|(^|\/)(Makefile|GNUmakefile|CMakeLists\.txt|Justfile|Jenkinsfile)$|(^|\/)(?:jest|vitest|playwright|karma|cypress)\.config\.[cm]?[jt]s$|\.(cmake|mk|bat|ps1)$/;
+function isRuntimeEnvSource(source) {
+  if (/ ARG$/.test(source))
+    return false;
+  const path = source.split(/[: ]/)[0];
+  if (TOOLING_SOURCE.test(path))
+    return false;
+  if (!/[/.]/.test(path))
+    return true;
+  return !isTestPath(path);
+}
+function isAmbientEnv(name) {
+  return AMBIENT_ENV.test(name);
+}
 function buildEnvReferences(ctx, deps) {
   const byName = new Map;
   for (const ref of ctx.manifest?.env ?? []) {
@@ -181747,12 +181929,16 @@ function buildEnvReferences(ctx, deps) {
     const entry = byName.get(name);
     const linked = depsByEnv.get(name) ?? [];
     let classification;
-    if (linked.length > 0)
+    if (PUBLIC_NAME.test(name))
+      classification = "config";
+    else if (linked.length > 0)
       classification = classifyLinked(name, linked);
     else if (entry.manifest && entry.manifest.classification !== "unknown")
       classification = entry.manifest.classification;
     else
       classification = classifyName(name);
+    if (classification === "secret" && CREDENTIAL_SETTING.test(name))
+      classification = "config";
     const ref = {
       name,
       sources: uniqSorted(entry.sources).slice(0, 20),
@@ -182107,6 +182293,9 @@ function detectMigrations(ctx) {
           if (env)
             ctx.envLinks.push({ envVar: env, capability: providerName === "mongodb" ? "document" : "database", provider: providerName, evidence });
       }
+      if (/\bextensions\s*=\s*\[[^\]]*\b(?:pgvector|vector)\b/.test(file.text)) {
+        ctx.signals.push({ kind: "config", capability: "vector_store", provider: "pgvector", evidence: evidenceAt(file.path, file.text, findLine(file.text, /\bextensions\s*=/), `${DETECTOR3}.prisma`) });
+      }
       continue;
     }
     if (/^drizzle\.config\.(ts|js|mjs|cjs|json)$/.test(name)) {
@@ -182119,10 +182308,21 @@ function detectMigrations(ctx) {
       b.schemaFiles.add(file.path);
       for (const s of schemas) {
         const p2 = joinPath(dir, s);
-        if (ctx.byPath.has(p2) || ctx.files.some((f) => isUnder(f.path, p2)))
+        if (/[*?]/.test(s)) {
+          const re = globRegex(p2);
+          for (const f of ctx.files)
+            if (re.test(f.path))
+              b.schemaFiles.add(f.path);
+        } else if (ctx.byPath.has(p2) || ctx.files.some((f) => isUnder(f.path, p2)))
           b.schemaFiles.add(p2);
       }
-      const outDir = joinPath(dir, out2);
+      let outDir = joinPath(dir, out2);
+      if (!ctx.files.some((f) => isUnder(f.path, outDir))) {
+        const nestedRoots = ctx.files.filter((f) => /^(?:package\.json|pyproject\.toml|go\.mod)$/.test(basename2(f.path)) && dirname2(f.path) !== dir && isUnder(f.path, dir)).map((f) => dirname2(f.path));
+        const sql = ctx.files.find((f) => isUnder(f.path, dir) && /(^|\/)migrations?\/[^/]+\.(?:sql|[cm]?[jt]s)$/.test(f.path) && !isTestPath(f.path) && !nestedRoots.some((r) => isUnder(f.path, r)));
+        if (sql)
+          outDir = dirname2(sql.path);
+      }
       if (ctx.files.some((f) => isUnder(f.path, outDir))) {
         b.paths.add(outDir);
         claimDir(outDir);
@@ -182276,13 +182476,50 @@ function detectMigrations(ctx) {
         b.paths.add(dir);
     }
   }
+  for (const f of ctx.files) {
+    if (!/^wrangler\.(?:toml|jsonc?)$/.test(basename2(f.path)) || !/new_sqlite_classes/.test(f.text) || isTestPath(f.path))
+      continue;
+    ctx.gaps.push({
+      kind: "durable_object_migrations",
+      message: `${f.path} declares SQLite-backed Durable Object migrations; the workerd runtime adapter applies them`,
+      evidence: [{ path: f.path, line: findLine(f.text, /new_sqlite_classes/), detector: DETECTOR3 }]
+    });
+  }
+  const all = [...sets.values()];
+  for (const b of all) {
+    if (b.tool !== "raw_sql" || b.paths.size > 0)
+      continue;
+    const parent = [...b.schemaFiles].map(dirname2)[0];
+    const sibling = all.find((o) => o !== b && o.tool === "raw_sql" && [...o.paths].some((p2) => isUnder(p2, parent ?? "\x00")));
+    if (sibling) {
+      for (const f of b.schemaFiles)
+        sibling.schemaFiles.add(f);
+      sibling.first = [...sibling.first ?? [], ...uniqSorted(b.schemaFiles)];
+      if (sibling.engine === "unknown")
+        sibling.engine = b.engine;
+      b.schemaFiles.clear();
+    }
+  }
   const out = [];
+  const testOnly = (p2) => isTestPath(p2) || /(^|\/)(?:conformance|e2e|[\w-]+-tests?|tests?-[\w-]+|e2e-[\w-]+)\//.test(p2);
   for (const b of [...sets.values()].sort((x, y) => cmp(`${x.tool}:${x.key}`, `${y.tool}:${y.key}`))) {
+    if (b.tool === "django" && b.paths.size === 0)
+      continue;
     if (b.paths.size === 0 && b.schemaFiles.size === 0)
       continue;
-    if (b.tool === "django" && b.paths.size === 0)
+    if ([...b.paths, ...b.schemaFiles].every(testOnly))
       continue;
-    out.push({ engine: b.engine, tool: b.tool, paths: uniqSorted(b.paths), schemaFiles: uniqSorted(b.schemaFiles) });
+    if (b.paths.size === 0) {
+      for (const f of b.schemaFiles)
+        b.paths.add(f);
+      ctx.gaps.push({
+        kind: "migration_schema_only",
+        message: `${b.tool} has no migration files at ${[...b.schemaFiles][0]}; the schema is applied directly`,
+        evidence: [...b.schemaFiles].slice(0, 1).map((path) => ({ path, detector: DETECTOR3 }))
+      });
+    }
+    const first = b.first ?? [];
+    out.push({ engine: b.engine, tool: b.tool, paths: [...first, ...uniqSorted(b.paths).filter((x) => !first.includes(x))], schemaFiles: uniqSorted(b.schemaFiles) });
   }
   return out;
 }
@@ -183290,6 +183527,19 @@ function fromPyproject(f, out) {
   for (const req of asArray(uv["dev-dependencies"]))
     if (typeof req === "string")
       add(req, true);
+  const hatch = isRecord2(tool.hatch) && isRecord2(tool.hatch.metadata) && isRecord2(tool.hatch.metadata.hooks) ? tool.hatch.metadata.hooks : {};
+  for (const hook of Object.values(hatch)) {
+    if (!isRecord2(hook))
+      continue;
+    for (const req of asArray(hook.dependencies))
+      if (typeof req === "string")
+        add(req, false);
+    const extra = isRecord2(hook["optional-dependencies"]) ? hook["optional-dependencies"] : {};
+    for (const [group, reqs] of Object.entries(extra))
+      for (const req of asArray(reqs))
+        if (typeof req === "string")
+          add(req, /dev|test|lint|doc/i.test(group));
+  }
 }
 function fromPipfile(f, out) {
   let doc;
@@ -183553,7 +183803,7 @@ function cfnResources(ctx, resources, file, runtime) {
     if (!spec)
       continue;
     const resource = asString(props.TableName) ?? asString(props.BucketName) ?? asString(props.QueueName) ?? asString(props.TopicName) ?? asString(props.Name) ?? asString(props.StateMachineName) ?? logicalId;
-    runtime.bindings.push({ name: logicalId, type, resource });
+    runtime.bindings.push({ name: logicalId, type: cfnBindingType(type), resource });
     bindingSignal(ctx, { ...spec, binding: logicalId, resource, evidence: ev(file, logicalId) });
   }
 }
@@ -183603,6 +183853,30 @@ function detectSam(ctx, file, doc) {
     envFromVariables(ctx, isRecord2(props.Environment) ? props.Environment.Variables : undefined, file, logicalId);
   }
   cfnResources(ctx, resources, file, runtime);
+  const ids = Object.keys(resources);
+  const direct = (text, self) => ids.filter((id) => id !== self && new RegExp(`\\b${escapeRe(id)}\\b`).test(text));
+  const globalsText = JSON.stringify(isRecord2(doc.Globals) && isRecord2(doc.Globals.Function) ? doc.Globals.Function : {});
+  const refs = new Map;
+  for (const [fnId, res] of Object.entries(resources)) {
+    if (!isRecord2(res) || !/^AWS::(?:Serverless|Lambda)::Function$/.test(asString(res.Type) ?? ""))
+      continue;
+    const seen = new Set(direct(`${JSON.stringify(res.Properties ?? {})} ${globalsText}`, fnId));
+    const queue = [...seen];
+    while (queue.length > 0) {
+      const id = queue.shift();
+      const other = resources[id];
+      if (!isRecord2(other) || /^AWS::(?:Serverless|Lambda)::Function$/.test(asString(other.Type) ?? ""))
+        continue;
+      for (const next of direct(JSON.stringify(other.Properties ?? {}), id)) {
+        if (next !== fnId && !seen.has(next)) {
+          seen.add(next);
+          queue.push(next);
+        }
+      }
+    }
+    refs.set(fnId, seen);
+  }
+  ctx.functionRefs.set(file.path, refs);
   if (runtime.entrypoints.length === 0)
     return;
   return runtime;
@@ -183666,6 +183940,17 @@ var CDK_RESOURCE_TYPES = {
   StateMachine: "AWS::StepFunctions::StateMachine",
   UserPool: "AWS::Cognito::UserPool"
 };
+function cdkTrigger(text, variable) {
+  const v = `(?:this\\.|self\\.)?${escapeRe(variable)}\\b`;
+  const re = (pattern) => new RegExp(pattern);
+  if (re(`LambdaIntegration\\(\\s*(?:['"][^'"]*['"]\\s*,\\s*)?${v}`).test(text) || re(`LambdaRestApi\\([^)]*?handler\\s*[:=]\\s*${v}`).test(text) || re(`${v}\\s*\\.\\s*(?:addFunctionUrl|add_function_url)\\(`).test(text) || re(`FunctionUrl\\([^)]*?function\\s*[:=]\\s*${v}`).test(text))
+    return "http";
+  if (re(`${v}\\s*\\.\\s*(?:addEventSource|add_event_source)\\(\\s*(?:new\\s+)?(?:\\w+\\.)?SqsEventSource`).test(text))
+    return "queue";
+  if (re(`Schedule\\.[\\s\\S]{0,400}LambdaFunction\\(\\s*${v}`).test(text))
+    return "cron";
+  return "event";
+}
 function detectCdk(ctx, cdkJson) {
   const root = dirname2(cdkJson.path);
   const runtime = newRuntime("aws_lambda", root, [cdkJson.path], [{ path: cdkJson.path, detector: `${DETECTOR4}.cdk` }], 0.8);
@@ -183691,7 +183976,8 @@ function detectCdk(ctx, cdkJson) {
         runtime.runtimeVersion = lang.version;
       }
       const handlerRef = entry ? joinPath(root, entry) + (handler ? `#${handler}` : "") : asset ? `${joinPath(root, asset)}/${handler ?? ""}` : handler;
-      runtime.entrypoints.push({ name: id, handler: handlerRef, trigger: "event" });
+      const variable = /(?:\b|\.)(\w+)\s*=\s*$/.exec(file.text.slice(Math.max(0, m.index - 120), m.index))?.[1];
+      runtime.entrypoints.push({ name: id, handler: handlerRef, trigger: variable ? cdkTrigger(file.text, variable) : "event" });
       runtime.evidence.push({ path: file.path, line: at(m.index), excerpt: excerpt(splitLines(file.text)[at(m.index) - 1]), detector: `${DETECTOR4}.cdk:${construct}` });
     }
     CDK_RESOURCE.lastIndex = 0;
@@ -183703,12 +183989,12 @@ function detectCdk(ctx, cdkJson) {
       const type = CDK_RESOURCE_TYPES[kind];
       if (type) {
         const spec = CFN_RESOURCES[type];
-        runtime.bindings.push({ name: id, type });
+        runtime.bindings.push({ name: id, type: cfnBindingType(type) });
         bindingSignal(ctx, { ...spec, binding: id, evidence });
       } else if (kind === "DatabaseInstance" || kind === "DatabaseCluster") {
         const engine = /DatabaseInstanceEngine\.(\w+)|DatabaseClusterEngine\.(\w+)/.exec(file.text.slice(m.index, m.index + 800));
         const provider = rdsEngineProvider(engine?.[1] ?? engine?.[2]);
-        runtime.bindings.push({ name: id, type: `AWS::RDS::${kind.replace("Database", "DB")}` });
+        runtime.bindings.push({ name: id, type: "rds" });
         bindingSignal(ctx, { capability: "database", provider, cls: "engine", binding: id, evidence });
       }
     }
@@ -183842,7 +184128,10 @@ function detectCloudflare(input) {
       if (seen.has(key))
         return false;
       seen.add(key);
-      runtime.bindings.push(resource ? { name, type, resource } : { name, type });
+      if (type === "QueueConsumer")
+        return true;
+      const normalized = type.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase();
+      runtime.bindings.push(resource ? { name, type: normalized, resource } : { name, type: normalized });
       return true;
     };
     const produced = new Set(sections(config).flatMap((section) => asArray(isRecord2(section.queues) ? section.queues.producers : undefined).map((p2) => isRecord2(p2) ? asString(p2.queue) : undefined)));
@@ -183915,7 +184204,9 @@ function detectCloudflare(input) {
         const script = asString(item.script_name);
         if (!addBinding(name, "DurableObject", className))
           continue;
-        if (script && !workerNames.has(script)) {
+        if (!script || workerNames.has(script)) {
+          bindingSignal(ctx, { capability: "document", provider: "cloudflare.durable_objects", cls: "emulated", binding: name, resource: className, evidence: ev2(file, name) });
+        } else {
           bindingSignal(ctx, { capability: "function.invoke", provider: "cloudflare.durable_object", cls: "saas", binding: name, resource: className, evidence: ev2(file, name) });
           ctx.gaps.push({ kind: "external_service_binding", message: `Durable Object ${name} lives in worker \`${script}\`, which is not in the bundle`, evidence: [ev2(file, name)] });
         }
@@ -183961,6 +184252,21 @@ var DETECTOR6 = "runtime.container";
 var DOCKERFILE = /^(?:Dockerfile|Containerfile)(?:\.[\w.-]+)?$|\.(?:Dockerfile|dockerfile)$/;
 var COMPOSE = /^(?:docker-)?compose(?:\.[\w-]+)*\.ya?ml$/;
 var INFRA_IMAGES = /^(?:nginx|traefik|caddy|haproxy|envoyproxy\/envoy|busybox|alpine|ubuntu|debian|node|python|golang|grafana\/.*|prom\/.*|otel\/.*|jaegertracing\/.*|adminer|dpage\/pgadmin4|portainer\/.*|.*\/?(?:loki|promtail|tempo))$/;
+var PROJECT_MANIFEST = /^(?:package\.json|pyproject\.toml|requirements\.txt|setup\.py|go\.mod|Gemfile|Cargo\.toml|pom\.xml|build\.gradle(?:\.kts)?)$/;
+function buildContext(ctx, dir, copies) {
+  if (copies.length === 0 || ctx.files.some((f) => dirname2(f.path) === dir && PROJECT_MANIFEST.test(basename2(f.path))))
+    return dir;
+  const has = (base, src) => {
+    const p2 = joinPath(base, src);
+    return ctx.byPath.has(p2) || ctx.files.some((f) => f.path.startsWith(`${p2}/`));
+  };
+  for (let base = dir;; base = dirname2(base)) {
+    if (copies.every((src) => has(base, src)))
+      return base;
+    if (base === ".")
+      return dir;
+  }
+}
 function parseInstructionArgs(rest) {
   const t = rest.trim();
   if (t.startsWith("[")) {
@@ -183973,7 +184279,7 @@ function parseInstructionArgs(rest) {
   return ["sh", "-c", t];
 }
 function parseDockerfile(file) {
-  const out = { path: file.path, from: [], expose: [], env: [], args: [], stages: {} };
+  const out = { path: file.path, from: [], expose: [], env: [], args: [], copies: [], stages: {} };
   const raw = splitLines(file.text);
   const stages = new Map;
   let stage = { base: "", expose: [], env: [] };
@@ -184018,6 +184324,11 @@ function parseDockerfile(file) {
       for (const [name, value] of pairs)
         if (name)
           stage.env.push({ name, value, line: startLine });
+    } else if ((instr === "COPY" || instr === "ADD") && !/--from=/.test(rest)) {
+      const parts = rest.trim().startsWith("[") ? parseInstructionArgs(rest) : rest.split(/\s+/).filter((w) => !w.startsWith("--"));
+      for (const src of parts.slice(0, -1))
+        if (src && !/^https?:/.test(src) && !/[*?$]/.test(src) && src !== "." && src !== "./")
+          out.copies.push(src.replace(/^\.\//, "").replace(/\/$/, ""));
     } else if (instr === "ARG") {
       const name = rest.split("=")[0].trim();
       if (name)
@@ -184051,7 +184362,7 @@ function detectContainers(input) {
       continue;
     const df = parseDockerfile(file);
     dockerfiles.push(df);
-    const root = dirname2(file.path);
+    const root = buildContext(ctx, dirname2(file.path), df.copies);
     const base = df.from[df.from.length - 1] ?? "";
     const lambda = /^(?:public\.ecr\.aws\/lambda\/|amazon\/aws-lambda-)/.test(base);
     const kind = lambda ? "aws_lambda" : "container";
@@ -184136,12 +184447,16 @@ function composeServices(ctx, file, byRoot, contributions, relocated) {
     const ports = asArray(svc.ports);
     const svcEntrypoint = composeArgs(svc.entrypoint);
     const svcCommand = composeArgs(svc.command);
-    const serviceRoot = build !== undefined ? joinPath(base, typeof build === "string" ? build : isRecord2(build) ? asString(build.context) ?? "." : ".") : undefined;
+    let serviceRoot = build !== undefined ? joinPath(base, typeof build === "string" ? build : isRecord2(build) ? asString(build.context) ?? "." : ".") : undefined;
     if (build !== undefined) {
       const context = typeof build === "string" ? build : isRecord2(build) ? asString(build.context) ?? "." : ".";
-      const root = joinPath(base, context);
+      const contextRoot = joinPath(base, context);
+      const dockerfile = joinPath(contextRoot, (isRecord2(build) ? asString(build.dockerfile) : undefined) ?? "Dockerfile");
+      const dfDir = dirname2(dockerfile);
+      const projectDir = dfDir !== contextRoot && isUnder(dfDir, contextRoot) && ctx.files.some((f) => dirname2(f.path) === dfDir && PROJECT_MANIFEST.test(basename2(f.path)));
+      const root = projectDir ? dfDir : contextRoot;
+      serviceRoot = root;
       const key = `container:${root}`;
-      const dockerfile = joinPath(root, (isRecord2(build) ? asString(build.dockerfile) : undefined) ?? "Dockerfile");
       const contribution = contributions.get(dockerfile);
       const runtime = byRoot.get(key) ?? newRuntime("container", root, [], [], 0.85);
       runtime.configFiles.push(file.path);
@@ -184178,28 +184493,11 @@ function composeServices(ctx, file, byRoot, contributions, relocated) {
       if (sig) {
         ctx.signals.push({ kind: "image", capability: sig.capability, provider: sig.provider, resource: name, evidence });
       } else if (!INFRA_IMAGES.test(image.split(":")[0])) {
-        if (svcEntrypoint || svcCommand || ports.length > 0) {
-          const key = `container:${base}`;
-          const runtime = byRoot.get(key) ?? newRuntime("container", base, [], [], 0.75);
-          runtime.configFiles.push(file.path);
-          runtime.evidence.push(evidence);
-          if (!runtime.entrypoints.some((e) => e.name === name)) {
-            const entry = { name, handler: image, trigger: ports.length > 0 ? "http" : "unknown" };
-            if (svcEntrypoint)
-              entry.command = [...svcEntrypoint, ...svcCommand ?? []];
-            else if (svcCommand) {
-              ctx.gaps.push({
-                kind: "unresolved_command",
-                message: `Compose service \`${name}\` overrides the CMD of image \`${image}\`, whose ENTRYPOINT is not in the bundle; the full launch command is unknown`,
-                evidence: [evidence]
-              });
-            }
-            runtime.entrypoints.push(entry);
-          }
-          byRoot.set(key, runtime);
-        } else {
-          ctx.gaps.push({ kind: "unrecognized_service", message: `Compose service \`${name}\` uses image \`${image}\`, which maps to no known provider`, evidence: [evidence] });
-        }
+        ctx.gaps.push({
+          kind: "unrecognized_service",
+          message: `Compose service \`${name}\` runs prebuilt image \`${image}\`, which maps to no known provider; treated as a sidecar, not a harness entrypoint`,
+          evidence: [evidence]
+        });
       }
     }
     const env = svc.environment;
@@ -184223,7 +184521,8 @@ function composeServices(ctx, file, byRoot, contributions, relocated) {
         source: `${file.path} services.${name}.environment`,
         value: literal,
         evidence: { path: file.path, line: l, excerpt: l ? excerpt(lines[l - 1]) : undefined, detector: `${DETECTOR6}.compose` },
-        scopeRoot: serviceRoot
+        scopeRoot: serviceRoot,
+        service: name
       });
     }
   }
@@ -184246,14 +184545,21 @@ var ROOT_MARKERS = new Set([
   "host.json",
   "deno.json",
   "deno.jsonc",
-  "Cargo.toml"
+  "Cargo.toml",
+  "project.json"
 ]);
 function projectRoots(files) {
-  const out = new Set;
-  for (const f of files)
-    if (ROOT_MARKERS.has(basename2(f.path)))
-      out.add(dirname2(f.path));
-  return [...out].sort();
+  const markers = new Map;
+  for (const f of files) {
+    if (!ROOT_MARKERS.has(basename2(f.path)))
+      continue;
+    const dir = dirname2(f.path);
+    if (!markers.has(dir))
+      markers.set(dir, new Set);
+    markers.get(dir).add(basename2(f.path));
+  }
+  const pyProjects = [...markers.entries()].filter(([, m]) => m.has("pyproject.toml") || m.has("setup.py")).map(([d]) => d);
+  return [...markers.entries()].filter(([dir, m]) => !(m.size === 1 && m.has("requirements.txt") && pyProjects.some((p2) => p2 !== dir && isUnder(dir, p2)))).map(([dir]) => dir).sort();
 }
 function nearestRoot(path, roots) {
   let best;
@@ -184291,6 +184597,15 @@ function cloudRunMarkers(ctx) {
       out.push({ root: dirname2(file.path), path: file.path, line: findLine(file.text, /serving\.knative\.dev/) });
       continue;
     }
+    if (name.endsWith(".tf")) {
+      const services = (file.text.match(/resource\s+"google_cloud_run(?:_v2)?_service"/g) ?? []).length;
+      if (services > 0) {
+        const dir = dirname2(file.path);
+        const root = /^(?:terraform|infra|infrastructure|deploy|deployment)$/.test(basename2(dir)) ? dirname2(dir) : dir;
+        out.push({ root, path: file.path, line: findLine(file.text, /google_cloud_run/), services });
+      }
+      continue;
+    }
     const re = /gcloud\s+(?:beta\s+)?run\s+(?:deploy|services\s+replace)\b([^\n]*)/g;
     let m;
     while ((m = re.exec(file.text)) !== null) {
@@ -184495,76 +184810,72 @@ function decoratedDefs(text, decorator) {
 // ../../packages/harness-bundle/src/detect/runtimes/azure.ts
 var DETECTOR8 = "runtime.azure";
 var BINDINGS = {
-  httpTrigger: { trigger: "http" },
-  timerTrigger: { trigger: "cron" },
-  queueTrigger: { trigger: "queue", dep: { capability: "queue", provider: "azure.queue", cls: "emulated" } },
-  queue: { dep: { capability: "queue", provider: "azure.queue", cls: "emulated" } },
-  blobTrigger: { trigger: "event", dep: { capability: "object_store", provider: "azure.blob", cls: "emulated" } },
-  blob: { dep: { capability: "object_store", provider: "azure.blob", cls: "emulated" } },
+  http: { trigger: "http" },
+  timer: { trigger: "cron" },
+  queue: { trigger: "queue", dep: { capability: "queue", provider: "azure.queue", cls: "emulated" } },
+  blob: { trigger: "event", dep: { capability: "object_store", provider: "azure.blob", cls: "emulated" } },
   table: { dep: { capability: "document", provider: "azure.table", cls: "emulated" } },
-  cosmosDBTrigger: { trigger: "event", dep: { capability: "document", provider: "azure.cosmos", cls: "emulated" } },
-  cosmosDB: { dep: { capability: "document", provider: "azure.cosmos", cls: "emulated" } },
-  serviceBusTrigger: { trigger: "queue", dep: { capability: "queue", provider: "azure.servicebus", cls: "emulated" } },
-  serviceBus: { dep: { capability: "queue", provider: "azure.servicebus", cls: "emulated" } },
-  eventHubTrigger: { trigger: "queue", dep: { capability: "queue", provider: "azure.eventhubs", cls: "emulated" } },
-  eventHub: { dep: { capability: "queue", provider: "azure.eventhubs", cls: "emulated" } },
-  eventGridTrigger: { trigger: "event" },
-  eventGrid: { dep: { capability: "queue", provider: "azure.eventgrid", cls: "saas" } },
-  sql: { dep: { capability: "database", provider: "mssql", cls: "engine" } },
-  sqlTrigger: { trigger: "event", dep: { capability: "database", provider: "mssql", cls: "engine" } }
+  cosmosdb: { trigger: "event", dep: { capability: "document", provider: "azure.cosmos", cls: "emulated" } },
+  servicebus: { trigger: "queue", dep: { capability: "queue", provider: "azure.servicebus", cls: "emulated" } },
+  eventhub: { trigger: "queue", dep: { capability: "queue", provider: "azure.eventhubs", cls: "emulated" } },
+  eventgrid: { trigger: "event", dep: { capability: "queue", provider: "azure.eventgrid", cls: "saas" } },
+  sql: { trigger: "event", dep: { capability: "database", provider: "mssql", cls: "engine" } },
+  durable_client: {},
+  durable_orchestration: { trigger: "event" },
+  durable_activity: { trigger: "event" },
+  durable_entity: { trigger: "event" },
+  embeddings_store: { dep: { capability: "vector_store", provider: "azure.search", cls: "saas" } },
+  semantic_search: { dep: { capability: "vector_store", provider: "azure.search", cls: "saas" } }
 };
-var PY_DECORATORS = {
-  route: "httpTrigger",
-  timer_trigger: "timerTrigger",
-  schedule: "timerTrigger",
-  queue_trigger: "queueTrigger",
-  queue_output: "queue",
-  blob_trigger: "blobTrigger",
-  blob_input: "blob",
-  blob_output: "blob",
-  cosmos_db_trigger: "cosmosDBTrigger",
-  cosmos_db_input: "cosmosDB",
-  cosmos_db_output: "cosmosDB",
-  service_bus_queue_trigger: "serviceBusTrigger",
-  service_bus_topic_trigger: "serviceBusTrigger",
-  service_bus_queue_output: "serviceBus",
-  service_bus_topic_output: "serviceBus",
-  event_hub_message_trigger: "eventHubTrigger",
-  event_hub_output: "eventHub",
-  event_grid_trigger: "eventGridTrigger",
-  event_grid_output: "eventGrid",
-  table_input: "table",
-  table_output: "table",
-  sql_input: "sql",
-  sql_output: "sql",
-  sql_trigger: "sqlTrigger"
-};
-var NODE_REGISTRATIONS = {
-  http: "httpTrigger",
-  get: "httpTrigger",
-  post: "httpTrigger",
-  put: "httpTrigger",
-  patch: "httpTrigger",
-  deleteRequest: "httpTrigger",
-  timer: "timerTrigger",
-  storageQueue: "queueTrigger",
-  storageBlob: "blobTrigger",
-  cosmosDB: "cosmosDBTrigger",
-  serviceBusQueue: "serviceBusTrigger",
-  serviceBusTopic: "serviceBusTrigger",
-  eventHub: "eventHubTrigger",
-  eventGrid: "eventGridTrigger",
-  sql: "sqlTrigger"
+var TYPE_ALIASES = {
+  httptrigger: "http",
+  route: "http",
+  get: "http",
+  post: "http",
+  put: "http",
+  patch: "http",
+  deleterequest: "http",
+  timertrigger: "timer",
+  schedule: "timer",
+  queuetrigger: "queue",
+  storagequeue: "queue",
+  blobtrigger: "blob",
+  storageblob: "blob",
+  cosmosdbtrigger: "cosmosdb",
+  cosmos_db: "cosmosdb",
+  servicebustrigger: "servicebus",
+  service_bus_queue: "servicebus",
+  service_bus_topic: "servicebus",
+  servicebusqueue: "servicebus",
+  servicebustopic: "servicebus",
+  eventhubtrigger: "eventhub",
+  event_hub_message: "eventhub",
+  event_hub: "eventhub",
+  eventgridtrigger: "eventgrid",
+  event_grid: "eventgrid",
+  sqltrigger: "sql",
+  durableclient: "durable_client",
+  orchestrationtrigger: "durable_orchestration",
+  orchestration: "durable_orchestration",
+  activitytrigger: "durable_activity",
+  activity: "durable_activity",
+  entitytrigger: "durable_entity",
+  entity: "durable_entity"
 };
+function azureBindingType(raw) {
+  const key = raw.toLowerCase();
+  const t = TYPE_ALIASES[key] ?? key;
+  return t in BINDINGS ? t : undefined;
+}
 var NODE_IO = {
   storageBlob: "blob",
   storageQueue: "queue",
   table: "table",
-  cosmosDB: "cosmosDB",
-  serviceBusQueue: "serviceBus",
-  serviceBusTopic: "serviceBus",
-  eventHub: "eventHub",
-  eventGrid: "eventGrid",
+  cosmosDB: "cosmosdb",
+  serviceBusQueue: "servicebus",
+  serviceBusTopic: "servicebus",
+  eventHub: "eventhub",
+  eventGrid: "eventgrid",
   sql: "sql"
 };
 function detectAzure(input) {
@@ -184583,12 +184894,12 @@ function detectAzure(input) {
     const seenDeps = new Set;
     const addDep = (type, name, rawConnection, evidence) => {
       const connection = rawConnection && /^[A-Za-z_][A-Za-z0-9_]*$/.test(rawConnection) ? rawConnection : undefined;
+      if (!runtime.bindings.some((b) => b.name === name && b.type === type))
+        runtime.bindings.push(connection ? { name, type, resource: connection } : { name, type });
       const spec = BINDINGS[type]?.dep;
       if (!spec)
         return;
       const key = `${spec.provider}:${connection ?? ""}`;
-      if (!runtime.bindings.some((b) => b.name === name && b.type === type))
-        runtime.bindings.push({ name, type, resource: connection });
       if (seenDeps.has(key))
         return;
       seenDeps.add(key);
@@ -184611,7 +184922,7 @@ function detectAzure(input) {
         continue;
       if (basename2(file.path) === "function.json") {
         handleFunctionJson(file, runtime, addDep);
-      } else if (file.path.endsWith(".py") && /azure\.functions|func\.FunctionApp|func\.Blueprint/.test(file.text)) {
+      } else if (file.path.endsWith(".py") && /azure\.functions|azure\.durable_functions|func\.FunctionApp|func\.Blueprint|\bDFApp\(/.test(file.text)) {
         handlePython(file, runtime, addDep);
       } else if (/\.[cm]?[jt]s$/.test(file.path) && /@azure\/functions/.test(file.text)) {
         handleNode(file, runtime, addDep);
@@ -184632,17 +184943,22 @@ function handleFunctionJson(file, runtime, addDep) {
   for (const b of asArray(json.bindings)) {
     if (!isRecord2(b))
       continue;
-    const type = asString(b.type) ?? "";
-    const spec = BINDINGS[type];
-    if (spec?.trigger)
-      trigger = spec.trigger;
+    const raw = asString(b.type) ?? "";
+    const type = azureBindingType(raw);
+    if (!type)
+      continue;
+    if (/trigger$/i.test(raw) && BINDINGS[type].trigger)
+      trigger = BINDINGS[type].trigger;
     const name = asString(b.name) ?? type;
-    addDep(type, name, asString(b.connection) ?? (type.startsWith("blob") || type.startsWith("queue") ? "AzureWebJobsStorage" : undefined), evidenceAt(file.path, file.text, findLine(file.text, new RegExp(`"${escapeRe(type)}"`)), DETECTOR8));
+    addDep(type, name, asString(b.connection) ?? defaultConnection(type), evidenceAt(file.path, file.text, findLine(file.text, new RegExp(`"${escapeRe(raw)}"`)), DETECTOR8));
   }
   const script = asString(json.scriptFile);
   runtime.entrypoints.push({ name: fnName, handler: script ? joinPath(dirname2(file.path), script) : dirname2(file.path), trigger });
   runtime.language ??= script ? languageFromPath(script) : undefined;
 }
+function defaultConnection(type) {
+  return type === "blob" || type === "queue" || type === "table" ? "AzureWebJobsStorage" : undefined;
+}
 function parenDepth(text) {
   let depth = 0;
   for (const ch of text.replace(/'(?:[^'\\\n]|\\.)*'|"(?:[^"\\\n]|\\.)*"|#[^\n]*/g, "")) {
@@ -184665,24 +184981,34 @@ function handlePython(file, runtime, addDep) {
       while (parenDepth(lines.slice(start, i + 1).join(`
 `)) > 0 && i + 1 < lines.length)
         i++;
-      deco[2] = [deco[2], ...lines.slice(start + 1, i + 1)].join(`
+      const args = [deco[2], ...lines.slice(start + 1, i + 1)].join(`
 `);
       const kind = deco[1];
       if (kind === "function_name")
-        pending.name = /name\s*=\s*['"]([^'"]+)['"]/.exec(deco[2])?.[1];
-      const type = PY_DECORATORS[kind];
+        pending.name = /name\s*=\s*['"]([^'"]+)['"]/.exec(args)?.[1];
+      const stem = kind === "route" || kind === "schedule" ? kind : /^(\w+?)_(?:trigger|input|output)$/.exec(kind)?.[1];
+      const type = stem ? azureBindingType(stem) : undefined;
       if (type) {
-        if (BINDINGS[type]?.trigger)
+        const isTrigger = kind === "route" || kind === "schedule" || kind.endsWith("_trigger");
+        if (isTrigger && BINDINGS[type].trigger)
           pending.trigger = BINDINGS[type].trigger;
         if (kind === "route")
-          pending.name ??= /route\s*=\s*['"]([^'"]+)['"]/.exec(deco[2])?.[1];
-        const connection = /connection\s*=\s*['"]([^'"]+)['"]/.exec(deco[2])?.[1];
-        addDep(type, kind, connection ?? (type.startsWith("blob") || type.startsWith("queue") ? "AzureWebJobsStorage" : undefined), { path: file.path, line: start + 1, excerpt: excerpt(line), detector: DETECTOR8 });
+          pending.name ??= /route\s*=\s*['"]([^'"]+)['"]/.exec(args)?.[1];
+        const connection = /connection\s*=\s*['"]([^'"]+)['"]/.exec(args)?.[1] ?? defaultConnection(type);
+        const argName = /\b(?:arg_name|client_name|context_name|input_name|name)\s*=\s*['"]([^'"]+)['"]/.exec(args)?.[1];
+        const evidence = { path: file.path, line: start + 1, excerpt: excerpt(line), detector: DETECTOR8 };
+        if (type === "http" && !argName)
+          pending.httpBinding = { line: start + 1, connection };
+        else
+          addDep(type, argName ?? kind, connection, evidence);
       }
       continue;
     }
-    const def = /^\s*(?:async\s+)?def\s+(\w+)/.exec(line);
+    const def = /^\s*(?:async\s+)?def\s+(\w+)\s*\(\s*(\w+)?/.exec(line);
     if (def && pending) {
+      if (pending.httpBinding) {
+        addDep("http", def[2] ?? "req", undefined, { path: file.path, line: pending.httpBinding.line, excerpt: excerpt(lines[pending.httpBinding.line - 1]), detector: DETECTOR8 });
+      }
       if (pending.trigger) {
         runtime.entrypoints.push({ name: pending.name ?? def[1], handler: `${file.path}#${def[1]}`, trigger: pending.trigger });
         runtime.language ??= "python";
@@ -184696,10 +185022,10 @@ function handlePython(file, runtime, addDep) {
 function handleNode(file, runtime, addDep) {
   const at = lineIndex(file.text);
   const lines = splitLines(file.text);
-  const reg = /\bapp\.(\w+)\(\s*['"]([^'"]+)['"]/g;
+  const reg = /\b(?:app|df\.app)\.(\w+)\(\s*['"]([^'"]+)['"]/g;
   let m;
   while ((m = reg.exec(file.text)) !== null) {
-    const type = NODE_REGISTRATIONS[m[1]];
+    const type = azureBindingType(m[1]);
     if (!type)
       continue;
     const line = at(m.index);
@@ -184707,7 +185033,7 @@ function handleNode(file, runtime, addDep) {
     runtime.language ??= languageFromPath(file.path);
     const window2 = callArgs(file.text, m.index);
     const connection = /connection\s*:\s*['"]([^'"]+)['"]/.exec(window2)?.[1];
-    addDep(type, m[2], connection ?? (type.startsWith("blob") || type.startsWith("queue") ? "AzureWebJobsStorage" : undefined), { path: file.path, line, excerpt: excerpt(lines[line - 1]), detector: DETECTOR8 });
+    addDep(type, m[2], connection ?? defaultConnection(type), { path: file.path, line, excerpt: excerpt(lines[line - 1]), detector: DETECTOR8 });
   }
   const io = /\b(?:input|output)\.(\w+)\(\s*\{/g;
   while ((m = io.exec(file.text)) !== null) {
@@ -184717,7 +185043,8 @@ function handleNode(file, runtime, addDep) {
     const line = at(m.index);
     const window2 = callArgs(file.text, m.index);
     const connection = /connection\s*:\s*['"]([^'"]+)['"]/.exec(window2)?.[1];
-    addDep(type, m[1], connection ?? (type === "blob" || type === "queue" || type === "table" ? "AzureWebJobsStorage" : undefined), { path: file.path, line, excerpt: excerpt(lines[line - 1]), detector: DETECTOR8 });
+    const name = /(?:const|let|var)\s+(\w+)\s*=\s*$/.exec(file.text.slice(Math.max(0, m.index - 80), m.index))?.[1] ?? m[1];
+    addDep(type, name, connection ?? defaultConnection(type), { path: file.path, line, excerpt: excerpt(lines[line - 1]), detector: DETECTOR8 });
   }
 }
 
@@ -184771,7 +185098,10 @@ function detectProcesses(input, roots) {
       continue;
     if (json.workspaces && !start && !bin)
       continue;
-    const rt = upsert(map, "node_process", pkg.root, pkg.path);
+    const runsOnBun = /^\s*bun\s+(?:run\s+|--\S+\s+)*[\w./-]+\.[cm]?[jt]sx?\b/.test(start ?? asString(scripts.dev) ?? "");
+    const rt = upsert(map, runsOnBun ? "other_process" : "node_process", pkg.root, pkg.path);
+    if (runsOnBun)
+      rt.language = "typescript";
     const pkgFile = ctx.byPath.get(pkg.path);
     rt.evidence.push(evidenceAt(pkg.path, pkgFile?.text ?? "", findLine(pkgFile?.text ?? "", /"(start|bin|main)"/), DETECTOR9));
     const trigger = server2 ? "http" : bin ? "cli" : "unknown";
@@ -184956,6 +185286,10 @@ function pythonFile(file, map, roots) {
       hits.push({ entry: { name: `mcp ${mod}:${m[1]}`, handler: `${file.path}:${m[1]}`, command: ["python", fromRoot(file.path, root)], trigger: /sse|streamable_http/.test(text) ? "http" : "cli" }, offset: m.index, detector: `${DETECTOR9}.mcp` });
     }
   }
+  const agentcore = /\bBedrockAgentCoreApp\s*\(/.exec(text);
+  if (agentcore && /bedrock_agentcore/.test(text)) {
+    hits.push({ entry: { name: `agentcore ${file.path}`, handler: file.path, command: ["python", rel], trigger: "http" }, offset: agentcore.index, detector: `${DETECTOR9}.agentcore` });
+  }
   const main = /^if\s+__name__\s*==\s*['"]__main__['"]\s*:/m.exec(text);
   if (main && hits.length === 0) {
     const serves = /uvicorn\.run|\.run\(\s*(?:host|port|debug)|app\.run\(|web\.run_app|serve_forever/.test(text);
@@ -184972,10 +185306,24 @@ function pythonFile(file, map, roots) {
     }
   }
 }
+var SUPABASE_EDGE = /^(.*?supabase\/functions)\/([^_./][^/]*)\/index\.[cm]?[jt]s$/;
 function nodeFile(file, map, roots) {
   const text = file.text;
+  const edge = SUPABASE_EDGE.exec(file.path);
+  if (edge) {
+    const rt2 = upsert(map, "other_process", edge[1]);
+    rt2.language = "typescript";
+    rt2.frameworks = [...new Set([...rt2.frameworks ?? [], "supabase-edge-functions"])].sort();
+    addEntry(rt2, { name: `edge ${edge[2]}`, handler: file.path, command: ["supabase", "functions", "serve", edge[2]], trigger: "http" });
+    if (rt2.evidence.length < 5)
+      rt2.evidence.push(evidenceAt(file.path, text, 1, `${DETECTOR9}.supabase_edge`));
+    return;
+  }
   const hits = [];
   let m;
+  if (/bedrock-agentcore/.test(text) && (m = /\bBedrockAgentCoreApp\b|\.entrypoint\s*\(/.exec(text))) {
+    hits.push({ entry: { name: `agentcore ${file.path}`, handler: file.path, trigger: "http" }, offset: m.index, detector: `${DETECTOR9}.agentcore` });
+  }
   if (/@modelcontextprotocol\/sdk/.test(text) && (m = /new\s+(McpServer|Server)\s*\(/.exec(text))) {
     const http = /StreamableHTTPServerTransport|SSEServerTransport/.test(text);
     hits.push({ entry: { name: `mcp ${file.path}`, handler: file.path, trigger: http ? "http" : "cli" }, offset: m.index, detector: `${DETECTOR9}.mcp` });
@@ -184985,10 +185333,15 @@ function nodeFile(file, map, roots) {
   }
   if (m = /\b(?:app|server|fastify)\.listen\s*\(|\bserve\(\s*\{\s*fetch|\bBun\.serve\s*\(|\bDeno\.serve\s*\(|\bcreateServer\s*\([^)]*\)\s*\.listen/.exec(text)) {
     hits.push({ entry: { name: `listen ${file.path}`, handler: file.path, trigger: "http" }, offset: m.index, detector: `${DETECTOR9}.listen` });
+    const bun = /\bBun\.serve\s*\(/.exec(text);
+    if (bun && /\bwebsocket\s*[:,}]/.test(callArgs(text, bun.index + bun[0].length - 1, 50000))) {
+      hits.push({ entry: { name: `websocket ${file.path}`, handler: file.path, trigger: "websocket" }, offset: bun.index, detector: `${DETECTOR9}.listen` });
+    }
   }
   if (hits.length === 0)
     return;
-  const rt = upsert(map, "node_process", nearestRoot(file.path, roots));
+  const kind = /\bBun\.serve\s*\(/.test(text) ? "other_process" : "node_process";
+  const rt = upsert(map, kind, nearestRoot(file.path, roots));
   rt.language = languageFromPath(file.path) ?? rt.language;
   const at = lineIndex(text);
   const lines = splitLines(text);
@@ -185068,7 +185421,9 @@ function detectVercel(input) {
       if (info.next && /^(?:src\/)?app\/(?:.*\/)?route\.[cm]?[jt]sx?$/.test(r)) {
         const methods = exportedMethods(f.text);
         const path = routePath(r.replace(/^src\//, "").replace(/^app\//, ""), "app");
-        entries.push({ name: `${methods.join(",") || "ANY"} ${path}`, handler: f.path, trigger: "http" });
+        entries.push({ name: `${methods.length > 0 ? methods.join(",") : "ANY"} ${path}`, handler: f.path, trigger: "http" });
+      } else if (info.next && /^(?:src\/)?middleware\.[cm]?[jt]s$/.test(r)) {
+        entries.push({ name: "middleware", handler: `${f.path}#middleware`, trigger: "http" });
       } else if (info.next && /^(?:src\/)?pages\/api\/.+\.[cm]?[jt]sx?$/.test(r)) {
         entries.push({ name: `ANY ${routePath(r.replace(/^src\//, "").replace(/^pages\//, ""), "pages")}`, handler: f.path, trigger: "http" });
       } else if (!info.next && /^api\/.+\.([cm]?[jt]s|py|go)$/.test(r) && !/\/_/.test(r)) {
@@ -185097,11 +185452,277 @@ function detectVercel(input) {
 function rel(path, root) {
   return root === "." ? path : path.slice(root.length + 1);
 }
+
+// ../../packages/harness-bundle/src/detect/scope.ts
+var DEPLOY_CONFIG = /^(?:wrangler\.(?:toml|json|jsonc)|template\.ya?ml|serverless\.ya?ml|vercel\.json|firebase\.json|cloudbuild\.ya?ml|service\.ya?ml|cdk\.json|langgraph\.json|Procfile|render\.ya?ml|fly\.toml|railway\.(?:json|toml)|netlify\.toml|(?:docker-)?compose(?:\.[\w-]+)*\.ya?ml)$/;
+var PROJECT_MANIFEST2 = /^(?:package\.json|pyproject\.toml|requirements\.txt|go\.mod|Cargo\.toml|Gemfile)$/;
+var ANCESTOR_ORM = [
+  { uses: /@prisma\/client|\bPrismaClient\b/, files: /^(?:prisma\/.+|[\w.-]+\.prisma|(?:\.config\/)?prisma(?:\.config)?\.[cm]?[jt]s)$/ },
+  { uses: /\bdrizzle-orm\b/, files: /^drizzle\.config\.[cm]?[jt]s$/ },
+  { uses: /\b(?:sqlalchemy|sqlmodel|alembic)\b/, files: /^(?:alembic\.ini|alembic\/.+)$/ }
+];
+var CODE_FILE = /\.(?:[cm]?[jt]sx?|py)$/;
+function pyDependencyNames(doc) {
+  const out = [];
+  const project = isRecord2(doc.project) ? doc.project : {};
+  for (const req of asArray(project.dependencies)) {
+    const m = typeof req === "string" ? /^\s*([A-Za-z0-9][\w.-]*)/.exec(req) : null;
+    if (m)
+      out.push(m[1]);
+  }
+  const poetry = isRecord2(doc.tool) && isRecord2(doc.tool.poetry) ? doc.tool.poetry : {};
+  if (isRecord2(poetry.dependencies))
+    out.push(...Object.keys(poetry.dependencies));
+  return out.map(pyName);
+}
+function pyName(name) {
+  return name.toLowerCase().replace(/[_.]/g, "-");
+}
+function npmDeps(json) {
+  const out = [];
+  for (const field of ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"]) {
+    const deps = json[field];
+    if (isRecord2(deps))
+      out.push(...Object.keys(deps));
+  }
+  return out;
+}
+function tomlDoc(file) {
+  if (!file)
+    return;
+  try {
+    return parse(file.text);
+  } catch {
+    return;
+  }
+}
+function directDeps(dir, byPath, npmNames, pyNames, goModules, workspaces) {
+  const out = [];
+  const pkg = byPath.get(joinPath(dir, "package.json"));
+  if (pkg) {
+    const json = parseJsonLoose(pkg.text);
+    if (isRecord2(json)) {
+      for (const name of npmDeps(json)) {
+        const target = npmNames.get(name);
+        if (target !== undefined)
+          out.push(target);
+      }
+    }
+  }
+  const pyproject = tomlDoc(byPath.get(joinPath(dir, "pyproject.toml")));
+  if (pyproject) {
+    const tool = isRecord2(pyproject.tool) ? pyproject.tool : {};
+    const uv = isRecord2(tool.uv) ? tool.uv : {};
+    const sources = isRecord2(uv.sources) ? uv.sources : {};
+    for (const [name, src] of Object.entries(sources)) {
+      if (!isRecord2(src))
+        continue;
+      if (src.workspace === true) {
+        const target = pyNames.get(pyName(name));
+        if (target !== undefined)
+          out.push(target);
+      }
+      const path = asString(src.path);
+      if (path)
+        out.push(joinPath(dir, path));
+    }
+    for (const ws of workspaces) {
+      if (!isUnder(dir, ws.root))
+        continue;
+      for (const name of pyDependencyNames(pyproject)) {
+        const target = ws.sources.get(name);
+        if (target !== undefined)
+          out.push(target);
+      }
+    }
+    const poetry = isRecord2(tool.poetry) ? tool.poetry : {};
+    const groups = [poetry.dependencies, ...isRecord2(poetry.group) ? Object.values(poetry.group).map((g) => isRecord2(g) ? g.dependencies : undefined) : []];
+    for (const deps of groups) {
+      if (!isRecord2(deps))
+        continue;
+      for (const spec of Object.values(deps)) {
+        const path = isRecord2(spec) ? asString(spec.path) : undefined;
+        if (path)
+          out.push(joinPath(dir, path));
+      }
+    }
+  }
+  for (const name of ["requirements.txt", "requirements.in"]) {
+    const req = byPath.get(joinPath(dir, name));
+    if (!req)
+      continue;
+    for (const line of splitLines(req.text)) {
+      const m = /^\s*(?:-e\s+)?(\.{1,2}\/[^\s#;]+)/.exec(line);
+      if (m)
+        out.push(joinPath(dir, m[1]));
+    }
+  }
+  const gomod = byPath.get(joinPath(dir, "go.mod"));
+  if (gomod) {
+    for (const m of gomod.text.matchAll(/=>\s*(\.{1,2}\/\S+)/g))
+      out.push(joinPath(dir, m[1]));
+    for (const m of gomod.text.matchAll(/^\s*(?:require\s+)?([\w.-]+\.[\w./-]+)\s+v[\w.+-]+/gm)) {
+      const target = goModules.get(m[1]);
+      if (target !== undefined)
+        out.push(target);
+    }
+    const own = /^module\s+(\S+)/m.exec(gomod.text)?.[1];
+    const others = [...goModules].filter(([mod]) => mod !== own);
+    if (others.length > 0) {
+      for (const f of byPath.values()) {
+        if (!f.path.endsWith(".go") || !isUnder(f.path, dir))
+          continue;
+        for (const [mod, target] of others)
+          if (f.text.includes(`"${mod}"`) || f.text.includes(`"${mod}/`))
+            out.push(target);
+      }
+    }
+  }
+  return out;
+}
+function composeBuildsUnder(svc, base, root) {
+  if (!isRecord2(svc) || svc.build === undefined)
+    return false;
+  const build = svc.build;
+  const context = joinPath(base, typeof build === "string" ? build : isRecord2(build) ? asString(build.context) ?? "." : ".");
+  if (isUnder(context, root))
+    return true;
+  const dockerfile = isRecord2(build) ? asString(build.dockerfile) : undefined;
+  return dockerfile !== undefined && isUnder(joinPath(context, dockerfile), root);
+}
+function computeScope(files, root) {
+  const byPath = new Map(files.map((f) => [f.path, f]));
+  if (root === ".")
+    return { root, closure: [], configs: [] };
+  const npmNames = new Map;
+  const pyNames = new Map;
+  const goModules = new Map;
+  for (const f of files) {
+    const name = basename2(f.path);
+    if (name === "package.json") {
+      const json = parseJsonLoose(f.text);
+      if (isRecord2(json) && typeof json.name === "string")
+        npmNames.set(json.name, dirname2(f.path));
+    } else if (name === "pyproject.toml") {
+      const doc = tomlDoc(f);
+      const project = doc && isRecord2(doc.project) ? doc.project : undefined;
+      const poetry = doc && isRecord2(doc.tool) && isRecord2(doc.tool.poetry) ? doc.tool.poetry : undefined;
+      const projectName = asString(project?.name) ?? asString(poetry?.name);
+      if (projectName)
+        pyNames.set(pyName(projectName), dirname2(f.path));
+    } else if (name === "go.mod") {
+      const mod = /^module\s+(\S+)/m.exec(f.text)?.[1];
+      if (mod)
+        goModules.set(mod, dirname2(f.path));
+    }
+  }
+  const workspaces = [];
+  for (const f of files) {
+    if (basename2(f.path) !== "pyproject.toml")
+      continue;
+    const doc = tomlDoc(f);
+    const uv = doc && isRecord2(doc.tool) && isRecord2(doc.tool.uv) ? doc.tool.uv : undefined;
+    if (!uv || !isRecord2(uv.workspace))
+      continue;
+    const base = dirname2(f.path);
+    const members = asArray(uv.workspace.members).filter((m) => typeof m === "string").map((m) => globRegex(joinPath(base, m)));
+    if (!members.some((re) => re.test(root) || [...pyNames.values()].some((d) => isUnder(root, d) && re.test(d))))
+      continue;
+    const sources = new Map;
+    for (const [name, src] of Object.entries(isRecord2(uv.sources) ? uv.sources : {})) {
+      if (!isRecord2(src))
+        continue;
+      const target = src.workspace === true ? pyNames.get(pyName(name)) : asString(src.path) ? joinPath(base, asString(src.path)) : undefined;
+      if (target !== undefined)
+        sources.set(pyName(name), target);
+    }
+    workspaces.push({ root: base, sources });
+  }
+  const MANIFEST = /^(?:package\.json|pyproject\.toml|requirements\.(?:txt|in)|go\.mod)$/;
+  const nested = files.filter((f) => MANIFEST.test(basename2(f.path)) && isUnder(f.path, root) && !/(^|\/)node_modules\//.test(f.path)).map((f) => dirname2(f.path));
+  const closure = new Set;
+  const queue = [...new Set([root, ...nested])];
+  while (queue.length > 0) {
+    const dir = queue.shift();
+    for (const dep of directDeps(dir, byPath, npmNames, pyNames, goModules, workspaces)) {
+      if (dep === root || isUnder(dep, root) || closure.has(dep) || dep === ".")
+        continue;
+      closure.add(dep);
+      queue.push(dep);
+    }
+  }
+  const owned = (p2) => isUnder(p2, root) || [...closure].some((c) => isUnder(p2, c));
+  const ancestors = [];
+  for (let d = dirname2(root);; d = dirname2(d)) {
+    ancestors.push(d);
+    if (d === ".")
+      break;
+  }
+  const harnessFiles = files.filter((f) => owned(f.path));
+  const configs = new Set;
+  if (!harnessFiles.some((f) => dirname2(f.path) === root && PROJECT_MANIFEST2.test(basename2(f.path)))) {
+    const dir = ancestors.find((a) => files.some((f) => dirname2(f.path) === a && PROJECT_MANIFEST2.test(basename2(f.path))));
+    for (const f of files)
+      if (dir !== undefined && dirname2(f.path) === dir && PROJECT_MANIFEST2.test(basename2(f.path)))
+        configs.add(f.path);
+  }
+  const users = [...harnessFiles, ...[...configs].map((p2) => byPath.get(p2))];
+  const relToRoot = (p2) => p2.slice(root.length + 1);
+  const orms = ANCESTOR_ORM.filter((o) => users.some((f) => (CODE_FILE.test(f.path) || PROJECT_MANIFEST2.test(basename2(f.path))) && o.uses.test(f.text)) && !files.some((f) => isUnder(f.path, root) && o.files.test(relToRoot(f.path))));
+  const ormDirs = [];
+  for (const f of files) {
+    if (owned(f.path))
+      continue;
+    const name = basename2(f.path);
+    const base = dirname2(f.path);
+    if (ancestors.includes(base) && isEnvFile(f.path))
+      configs.add(f.path);
+    for (const a of ancestors) {
+      if (!isUnder(f.path, a))
+        continue;
+      const rel3 = a === "." ? f.path : f.path.slice(a.length + 1);
+      if (!orms.some((o) => o.files.test(rel3)))
+        continue;
+      configs.add(f.path);
+      if (!/^(?:drizzle\.config\.|alembic\.ini$)/.test(name))
+        continue;
+      if (name.startsWith("drizzle.config.") && !/\bout\s*:/.test(f.text))
+        ormDirs.push(joinPath(a, "drizzle"));
+      for (const m of f.text.matchAll(/\b(?:out|schema|script_location)\s*[:=]\s*['"]?([\w./-]+)/g))
+        ormDirs.push(joinPath(a, m[1].replace(/\/?\*.*$/, "")));
+    }
+    if (!DEPLOY_CONFIG.test(name) || !ancestors.includes(base))
+      continue;
+    const rel2 = base === "." ? root : root.slice(base.length + 1);
+    if (/compose/.test(name)) {
+      const doc = loadYaml(f.text);
+      const services = isRecord2(doc) && isRecord2(doc.services) ? doc.services : {};
+      if (Object.values(services).some((svc) => composeBuildsUnder(svc, base, root)))
+        configs.add(f.path);
+    } else if (new RegExp(`(?:^|[\\s"'=:/])\\.?/?${rel2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:[/"'\\s]|$)`, "m").test(f.text)) {
+      configs.add(f.path);
+    }
+  }
+  for (const f of files)
+    if (!owned(f.path) && ormDirs.some((d) => d !== "." && (f.path === d || isUnder(f.path, d))))
+      configs.add(f.path);
+  return { root, closure: [...closure].sort(), configs: [...configs].sort() };
+}
+var configSets = new WeakMap;
+function inScope(path, scope) {
+  if (scope.root === ".")
+    return true;
+  let configs = configSets.get(scope);
+  if (!configs)
+    configSets.set(scope, configs = new Set(scope.configs));
+  return isUnder(path, scope.root) || scope.closure.some((c) => isUnder(path, c)) || configs.has(path);
+}
 // ../../packages/harness-bundle/src/detect/index.ts
 var DETECTOR_NAME = "@moda/harness-bundle/detect";
 var DETECTOR_VERSION = "0.1.0";
 var SERVER_FRAMEWORKS = new Set(FRAMEWORKS.filter((f) => f.kind === "server").map((f) => f.name));
 var MIGRATION_ENGINE_PROVIDERS = new Set(["postgres", "mysql", "sqlite", "libsql", "mssql", "clickhouse", "cloudflare.d1", "supabase", "mongodb"]);
+var CLOSURE_CAPABILITIES = new Set(["database", "document", "kv", "vector_store", "object_store", "queue"]);
 var PLATFORM_KINDS = new Set(["cloudflare_workers", "aws_lambda", "gcp_cloud_functions", "gcp_cloud_run", "azure_functions", "vercel_functions"]);
 var PROCESS_KINDS = new Set(["node_process", "python_process", "other_process"]);
 function packageSignals(ctx, declared) {
@@ -185122,6 +185743,237 @@ function packageSignals(ctx, declared) {
     });
   }
 }
+function normalizeRoot(raw) {
+  if (!raw)
+    return ".";
+  const root = joinPath(raw);
+  return root === "" ? "." : root;
+}
+var RUNTIME_CONFIG = /^(?:wrangler\.(?:toml|jsonc?)|template\.ya?ml|serverless\.ya?ml|host\.json|vercel\.json|next\.config\.\w+|Dockerfile[\w.-]*|(?:docker-)?compose[\w.-]*\.ya?ml|langgraph\.json|firebase\.json|cdk\.json)$/;
+function outsideContext(files, scope) {
+  const configs = files.filter((f) => RUNTIME_CONFIG.test(basename2(f.path))).map((f) => f.path);
+  const providers = new Set;
+  for (const d of collectDeclaredPackages(files)) {
+    const m = matchModule(d.eco === "pypi" ? "pypi" : d.eco, d.name);
+    if (m && !d.dev)
+      providers.add(m.signature.provider);
+  }
+  const list = [...providers].sort();
+  return {
+    kind: "outside_harness_root",
+    message: `${files.length} file(s) outside harness root ${scope.root}${scope.closure.length > 0 ? ` and its workspace dependencies (${scope.closure.join(", ")})` : ""} were not analyzed` + (configs.length > 0 ? `; runtime configs there: ${configs.slice(0, 5).join(", ")}${configs.length > 5 ? `, +${configs.length - 5} more` : ""}` : "") + (list.length > 0 ? `; providers declared there: ${list.slice(0, 10).join(", ")}${list.length > 10 ? `, +${list.length - 10} more` : ""}` : ""),
+    evidence: configs.slice(0, 3).map((path) => ({ path, detector: "scope" }))
+  };
+}
+function scopeRuntimes(ctx, runtimes, scope) {
+  if (scope.root === ".")
+    return runtimes;
+  const out = [];
+  for (const rt of runtimes) {
+    if (isUnder(rt.root, scope.root)) {
+      out.push(rt);
+      continue;
+    }
+    if (!isUnder(scope.root, rt.root))
+      continue;
+    const pointsIn = (ep) => [ep.handler ?? "", ...ep.command ?? []].some((p2) => isUnder(joinPath(rt.root, p2.split(/[#:]/)[0]), scope.root) || isUnder(p2.split(/[#:]/)[0], scope.root));
+    const entrypoints = rt.entrypoints.filter(pointsIn);
+    if (entrypoints.length === 0)
+      continue;
+    const kept = new Set(entrypoints.map((e) => e.name));
+    let bindings = rt.bindings;
+    for (const [template, refs] of ctx.functionRefs) {
+      if (!rt.configFiles.includes(template))
+        continue;
+      const dropped = [...refs.keys()].filter((fn) => !kept.has(fn));
+      const allowed = new Set([...refs.entries()].filter(([fn]) => kept.has(fn)).flatMap(([, ids]) => [...ids]));
+      ctx.env = ctx.env.filter((e) => !dropped.some((fn) => e.source === `${template} ${fn}`));
+      ctx.signals = ctx.signals.filter((s) => s.kind !== "binding" || s.evidence.path !== template || allowed.has(s.binding ?? ""));
+      bindings = bindings.filter((b) => allowed.has(b.name));
+    }
+    out.push({ ...rt, entrypoints, bindings });
+  }
+  return out;
+}
+function scopeComposeImages(ctx, scope) {
+  const optional = new Set;
+  for (const f of ctx.files) {
+    if (!/^(?:docker-)?compose(?:\.[\w-]+)*\.ya?ml$/.test(basename2(f.path)))
+      continue;
+    const base = f.path.includes("/") ? f.path.slice(0, f.path.lastIndexOf("/")) : ".";
+    if (base === scope.root)
+      continue;
+    const doc = loadYaml(f.text);
+    const services = isRecord2(doc) && isRecord2(doc.services) ? Object.values(doc.services) : [];
+    const builds = services.some((svc) => isRecord2(svc) && svc.build !== undefined);
+    if (!builds)
+      optional.add(f.path);
+  }
+  for (const s of ctx.signals)
+    if (s.kind === "image" && optional.has(s.evidence.path))
+      s.weak = true;
+  if (scope.root === ".")
+    return ctx.signals;
+  const allowed = new Map;
+  for (const path of scope.configs) {
+    if (!/compose/.test(basename2(path)))
+      continue;
+    const doc = loadYaml(ctx.byPath.get(path)?.text ?? "");
+    const services = isRecord2(doc) && isRecord2(doc.services) ? doc.services : {};
+    const base = path.includes("/") ? path.slice(0, path.lastIndexOf("/")) : ".";
+    const deps = new Set;
+    let declared = false;
+    for (const svc of Object.values(services)) {
+      if (!isRecord2(svc) || !composeBuildsUnder(svc, base, scope.root))
+        continue;
+      const names = [...Array.isArray(svc.depends_on) ? svc.depends_on : isRecord2(svc.depends_on) ? Object.keys(svc.depends_on) : [], ...Array.isArray(svc.links) ? svc.links : []];
+      for (const n of names)
+        if (typeof n === "string") {
+          declared = true;
+          deps.add(n.split(":")[0]);
+        }
+    }
+    if (declared)
+      allowed.set(path, deps);
+  }
+  ctx.env = ctx.env.filter((e) => e.service === undefined || e.scopeRoot !== undefined || !e.evidence || !allowed.has(e.evidence.path) || allowed.get(e.evidence.path).has(e.service));
+  return ctx.signals.filter((s) => s.kind !== "image" || !allowed.has(s.evidence.path) || allowed.get(s.evidence.path).has(s.resource ?? ""));
+}
+var SERVERLESS_KINDS = new Set(["cloudflare_workers", "aws_lambda", "gcp_cloud_functions", "azure_functions", "vercel_functions"]);
+function isAuxiliary(path, harnessRoot) {
+  if (!isUnder(path, harnessRoot))
+    return false;
+  const rel2 = harnessRoot === "." ? path : path === harnessRoot ? "." : path.slice(harnessRoot.length + 1);
+  return AUXILIARY_DIR.test(rel2);
+}
+var AUXILIARY_DIR = /(^|\/)(vendor|third_party|examples?|samples?|demos?|docs?|tests?|e2e|benchmarks?|fixtures|\.devops|\.github|cloud-deployments|hack|playground)(\/|$)/;
+function foldNestedRuntimes(ctx, runtimes, harnessRoot) {
+  const rel2 = (root) => harnessRoot === "." ? root : root === harnessRoot ? "." : root.slice(harnessRoot.length + 1);
+  const auxiliary = runtimes.filter((r) => isUnder(r.root, harnessRoot) && AUXILIARY_DIR.test(rel2(r.root)));
+  if (auxiliary.length > 0) {
+    ctx.gaps.push({
+      kind: "auxiliary_runtime",
+      message: `${auxiliary.length} runtime(s) under example, vendored, test, or deployment-variant directories were not treated as the harness: ${auxiliary.slice(0, 5).map((r) => `${r.kind}@${r.root}`).join(", ")}${auxiliary.length > 5 ? ", ..." : ""}`,
+      evidence: auxiliary.slice(0, 3).map((r) => r.evidence[0]).filter((e) => e !== undefined)
+    });
+  }
+  let out = runtimes.filter((r) => !auxiliary.includes(r));
+  const merge = (into, from) => {
+    into.configFiles = uniqSorted([...into.configFiles, ...from.configFiles]);
+    into.frameworks = uniqSorted([...into.frameworks ?? [], ...from.frameworks ?? []]);
+    for (const ep of from.entrypoints) {
+      const moved = ep.command && from.root !== into.root ? { ...ep, command: rebaseCommand(ep.command, from.root, into.root, ctx) } : ep;
+      if (into.entrypoints.some((e) => e.name === moved.name && e.handler === moved.handler && (e.command ?? []).join(" ") === (moved.command ?? []).join(" ")))
+        continue;
+      into.entrypoints.push(moved);
+    }
+    into.language ??= from.language;
+  };
+  for (const v of out.filter((r) => r.kind === "vercel_functions")) {
+    const container = out.find((r) => (r.kind === "container" || r.kind === "gcp_cloud_run") && r.root === v.root);
+    if (container && !v.configFiles.some((f) => basename2(f) === "vercel.json")) {
+      merge(container, v);
+      out = out.filter((r) => r !== v);
+    }
+  }
+  for (const p2 of out.filter((r) => PROCESS_KINDS.has(r.kind))) {
+    const owners = out.filter((o) => o !== p2 && !PROCESS_KINDS.has(o.kind) && isUnder(p2.root, o.root) && o.root !== p2.root).sort((a, b) => b.root.length - a.root.length);
+    const owner = owners.find((o) => o.kind === "container" || o.kind === "gcp_cloud_run" || SERVERLESS_KINDS.has(o.kind) && !p2.entrypoints.some((e) => e.trigger === "http"));
+    if (owner) {
+      merge(owner, p2);
+      out = out.filter((r) => r !== p2);
+    }
+  }
+  return out;
+}
+function resolveCommandHandlers(rt, ctx) {
+  const exists = (p2) => ctx.byPath.has(p2);
+  const under = (p2) => joinPath(rt.root, p2.replace(/^\/(?:app|usr\/src\/app|code|workspace|srv)\//, ""));
+  for (const ep of rt.entrypoints) {
+    if (ep.handler || !ep.command)
+      continue;
+    const words = ep.command.flatMap((w) => w.split(/\s+/)).filter(Boolean);
+    for (let i = 0;i < words.length && !ep.handler; i++) {
+      const w = words[i];
+      const mod = /^([A-Za-z_][\w.]*):([A-Za-z_]\w*)(?:\(\))?$/.exec(w) ?? (words[i - 1] === "-m" && /^[A-Za-z_][\w.]*$/.test(w) ? [w, w, ""] : null);
+      if (mod) {
+        const base = mod[1].replace(/\./g, "/");
+        const file = [`${base}.py`, `${base}/__init__.py`, `${base}/__main__.py`, `src/${base}.py`].map(under).find(exists);
+        if (file)
+          ep.handler = mod[2] ? `${file}:${mod[2]}` : file;
+        continue;
+      }
+      if (/\.(?:py|[cm]?[jt]sx?|sh)$/.test(w)) {
+        const file = [under(w), joinPath(w)].find(exists);
+        if (file)
+          ep.handler = file;
+      }
+    }
+  }
+}
+var INFERRED_ENTRY = /^(?:fastapi|starlette|litestar|quart|sanic|flask) /;
+function dedupeEntrypoints(rt) {
+  const handlerFile = (h) => h.split(/[#:]/)[0];
+  const kept = rt.entrypoints.filter((e) => !e.handler || !isAuxiliary(handlerFile(e.handler), rt.root));
+  const pool = kept.length > 0 ? kept : rt.entrypoints;
+  const commanded = new Set(pool.filter((e) => e.command && e.handler).map((e) => `${e.trigger}:${e.handler}`));
+  const explicit = new Set(pool.filter((e) => e.command && e.handler && !INFERRED_ENTRY.test(e.name)).map((e) => `${e.trigger}:${e.handler}`));
+  const seen = new Set;
+  const out = [];
+  for (const ep of pool) {
+    if (!ep.command && ep.handler && commanded.has(`${ep.trigger}:${ep.handler}`))
+      continue;
+    if (ep.handler && INFERRED_ENTRY.test(ep.name) && explicit.has(`${ep.trigger}:${ep.handler}`))
+      continue;
+    const key = ep.command ? `${ep.trigger}:${ep.handler ?? ""}:${ep.command.join(" ")}` : `${ep.trigger}:${ep.handler ?? ""}:${ep.name}`;
+    if (seen.has(key))
+      continue;
+    seen.add(key);
+    out.push(ep);
+  }
+  return out;
+}
+function scriptLocalFilter(ctx, runtimes) {
+  const scripts = ctx.files.filter((f) => /\.(?:sh|bash)$/.test(f.path));
+  if (scripts.length === 0)
+    return () => false;
+  const launched = new Set(runtimes.flatMap((r) => r.entrypoints.flatMap((e) => [...(e.command ?? []).flatMap((w) => w.split(/[\s/;&|]+/)), basename2(e.handler ?? "")])));
+  const runners = ctx.files.filter((f) => /^(?:Dockerfile[\w.-]*|Procfile|package\.json|azure\.ya?ml)$/.test(basename2(f.path)) || !f.isDoc && !f.isTest && languageOf(f.path) !== undefined).map((f) => f.text);
+  for (const s of scripts)
+    if (runners.some((t) => t.includes(basename2(s.path))))
+      launched.add(basename2(s.path));
+  for (let changed = true;changed; ) {
+    changed = false;
+    for (const s of scripts) {
+      if (!launched.has(basename2(s.path)))
+        continue;
+      for (const m of s.text.matchAll(/(?:^|[\s;&|])(?:source|\.)\s+["']?([^\s"';&|]+\.(?:sh|bash))/gm)) {
+        const name = basename2(m[1]);
+        if (!launched.has(name)) {
+          launched.add(name);
+          changed = true;
+        }
+      }
+    }
+  }
+  return (path) => /\.(?:sh|bash)$/.test(path) && !launched.has(basename2(path));
+}
+function rebaseCommand(command, fromRoot2, toRoot, ctx) {
+  const sub = toRoot === "." ? fromRoot2 : fromRoot2.slice(toRoot.length + 1);
+  let rebased = false;
+  const out = command.map((arg) => {
+    const path = joinPath(fromRoot2, arg);
+    if (/[./]/.test(arg) && !arg.startsWith("-") && !arg.startsWith("/") && (ctx.byPath.has(path) || ctx.files.some((f) => f.path.startsWith(`${path}/`)))) {
+      rebased = true;
+      return joinPath(sub, arg);
+    }
+    return arg;
+  });
+  if (rebased)
+    return out;
+  const quote = (a) => /^[\w@%+=:,./-]+$/.test(a) ? a : `'${a.replace(/'/g, `'\\''`)}'`;
+  return ["sh", "-c", `cd ${quote(sub)} && ${command.map(quote).join(" ")}`];
+}
 function consolidateRuntimes(runtimes) {
   const out = [];
   const owners = runtimes.filter((r) => !PROCESS_KINDS.has(r.kind));
@@ -185151,8 +186003,17 @@ function applyCloudRun(ctx, runtimes) {
   for (const marker of markers) {
     const candidates = runtimes.filter((r) => (r.kind === "container" || PROCESS_KINDS.has(r.kind) || r.kind === "gcp_cloud_run") && isUnder(r.root, marker.root));
     const exact = candidates.filter((r) => r.root === marker.root);
-    const pool = exact.length > 0 ? exact : candidates;
+    const pool = exact.length > 0 && (marker.services ?? 1) <= 1 ? exact : candidates;
     const roots = uniqSorted(pool.map((r) => r.root));
+    if (roots.length > 1 && (marker.services ?? 1) >= roots.length) {
+      for (const rt of pool.filter((r) => r.kind === "container" || PROCESS_KINDS.has(r.kind))) {
+        rt.kind = "gcp_cloud_run";
+        if (!rt.configFiles.includes(marker.path))
+          rt.configFiles = uniqSorted([...rt.configFiles, marker.path]);
+        rt.evidence.push({ path: marker.path, line: marker.line, detector: "runtime.gcp.cloud_run" });
+      }
+      continue;
+    }
     if (roots.length > 1) {
       ctx.gaps.push({
         kind: "ambiguous_deploy_target",
@@ -185190,6 +186051,9 @@ function applyCloudRun(ctx, runtimes) {
 function dedupeGaps(gaps) {
   const seen = new Map;
   for (const g of gaps) {
+    g.message = redact(g.message);
+    if (g.evidence)
+      g.evidence = g.evidence.map((e) => ({ ...e, path: redact(e.path) }));
     const key = `${g.kind}:${g.message}`;
     if (!seen.has(key))
       seen.set(key, g);
@@ -185199,9 +186063,13 @@ function dedupeGaps(gaps) {
 function detectDependencies(input) {
   const opts = typeof input === "string" ? { dir: input } : input;
   const loaded = loadFiles(opts.dir, { maxFileBytes: opts.maxFileBytes, maxFiles: opts.maxFiles });
+  const harnessRoot = normalizeRoot(opts.harnessRoot ?? loaded.manifest?.harness?.root);
+  const scope = computeScope(loaded.files, harnessRoot);
+  const scoped = loaded.files.filter((f) => inScope(f.path, scope));
+  const outside = loaded.files.filter((f) => !inScope(f.path, scope));
   const ctx = {
-    files: loaded.files,
-    byPath: new Map(loaded.files.map((f) => [f.path, f])),
+    files: scoped,
+    byPath: new Map(scoped.map((f) => [f.path, f])),
     manifest: loaded.manifest,
     signals: [],
     runtimes: [],
@@ -185209,12 +186077,28 @@ function detectDependencies(input) {
     gaps: [],
     env: [],
     envLinks: [],
-    migrationHints: []
+    migrationHints: [],
+    functionRefs: new Map
   };
-  for (const ref of ctx.manifest?.env ?? []) {
-    for (const source of ref.sources.length > 0 ? ref.sources : ["manifest.json"])
-      ctx.env.push({ name: ref.name, source });
+  if (ctx.manifest) {
+    const scopedEnv = [];
+    for (const ref of ctx.manifest.env ?? []) {
+      if (isAmbientEnv(ref.name))
+        continue;
+      const sources = ref.sources.filter((src) => {
+        const path = src.split(/[: ]/)[0];
+        return (!/[/.]/.test(path) || inScope(path, scope)) && isRuntimeEnvSource(src) && !isAuxiliary(path, harnessRoot);
+      });
+      if (ref.sources.length > 0 && sources.length === 0)
+        continue;
+      scopedEnv.push({ ...ref, sources });
+      for (const source of sources.length > 0 ? sources : ["manifest.json"])
+        ctx.env.push({ name: ref.name, source });
+    }
+    ctx.manifest = { ...ctx.manifest, env: scopedEnv };
   }
+  if (outside.length > 0)
+    ctx.gaps.push(outsideContext(outside, scope));
   if (loaded.skipped.length > 0) {
     const byReason = new Map;
     for (const sk of loaded.skipped) {
@@ -185233,13 +186117,25 @@ function detectDependencies(input) {
   }
   if (loaded.truncated)
     ctx.gaps.push({ kind: "truncated", message: `Only the first ${ctx.files.length} files were analyzed` });
-  const declared = collectDeclaredPackages(ctx.files);
+  const harnessFiles = ctx.files.filter((f) => isUnder(f.path, scope.root) && !f.isDoc && !f.isTest);
+  const harnessCode = harnessFiles.map((f) => f.text);
+  const pyImported = new Set(harnessFiles.filter((f) => languageOf(f.path) === "python").flatMap((f) => extractImports("python", f.text).map((r) => r.spec)));
+  const usesPackage = (d) => {
+    if (d.eco !== "pypi") {
+      const re = new RegExp(`['"\`]${escapeRe(d.name)}(?:/[^'"\`]*)?['"\`]`);
+      return harnessCode.some((t) => re.test(t));
+    }
+    const modules = [d.name.toLowerCase().replace(/-/g, "_"), ...matchModule("pypi", d.name)?.signature.py ?? []];
+    return [...pyImported].some((spec) => modules.some((m) => spec === m || spec.startsWith(`${m}.`)));
+  };
+  const declared = collectDeclaredPackages(ctx.files).filter((d) => isUnder(d.path, scope.root) || !scope.configs.includes(d.path) || usesPackage(d));
   const packageJsons = parsePackageJsons(ctx.files);
   packageSignals(ctx, declared);
   const declaredPypi = new Set(declared.filter((d) => d.eco === "pypi").map((d) => d.name));
   const workspaceNames = new Set(packageJsons.map((p2) => typeof p2.json.name === "string" ? p2.json.name : "").filter(Boolean));
   const scan = scanSources(ctx, declaredPypi, workspaceNames);
   scanEnv(ctx);
+  sdkDefaultEnv(ctx, declared);
   const roots = projectRoots(ctx.files);
   const runtimeInput = { ctx, packageJsons, declared, frameworks: scan.frameworks };
   let runtimes = [
@@ -185253,6 +186149,12 @@ function detectDependencies(input) {
   ];
   runtimes = applyCloudRun(ctx, runtimes);
   runtimes = consolidateRuntimes(runtimes);
+  runtimes = foldNestedRuntimes(ctx, runtimes, harnessRoot);
+  runtimes = scopeRuntimes(ctx, runtimes, scope);
+  const runtimeConfigs = new Set(runtimes.flatMap((r) => r.configFiles));
+  ctx.signals = ctx.signals.filter((s) => s.kind !== "binding" || isUnder(s.evidence.path, scope.root) || runtimeConfigs.has(s.evidence.path));
+  ctx.signals = scopeComposeImages(ctx, scope);
+  ctx.env = ctx.env.filter((e) => e.scopeRoot === undefined || inScope(e.scopeRoot, scope) || isUnder(scope.root, e.scopeRoot));
   runtimes.sort((a, b) => cmp(a.root, b.root) || cmp(a.kind, b.kind));
   for (const rt of runtimes) {
     if (PLATFORM_KINDS.has(rt.kind) || rt.kind === "container" || PROCESS_KINDS.has(rt.kind)) {
@@ -185261,11 +186163,15 @@ function detectDependencies(input) {
       if (all.length > 0)
         rt.frameworks = all;
     }
+    resolveCommandHandlers(rt, ctx);
+    if (rt.entrypoints.some((e) => !e.name.startsWith("__main__ ")))
+      rt.entrypoints = rt.entrypoints.filter((e) => !e.name.startsWith("__main__ ") || e.trigger !== "cli");
     const serves = (rt.frameworks ?? []).some((f) => SERVER_FRAMEWORKS.has(f));
     for (const ep of rt.entrypoints) {
       if (ep.trigger === "unknown" && (serves || /gunicorn|uvicorn|hypercorn|daphne|waitress|next start|runserver|flask run|serve/.test((ep.command ?? []).join(" "))))
         ep.trigger = "http";
     }
+    rt.entrypoints = dedupeEntrypoints(rt);
     for (const ep of rt.entrypoints)
       if (ep.command)
         ep.command = ep.command.map((arg, i) => i === 2 && ep.command[0] === "sh" && ep.command[1] === "-c" ? redactScript(arg) : redactArg(arg));
@@ -185281,7 +186187,28 @@ function detectDependencies(input) {
     }
   }
   const migrations = detectMigrations(ctx);
+  const scriptLocal = scriptLocalFilter(ctx, runtimes);
+  ctx.env = ctx.env.filter((e) => !scriptLocal(e.source.split(/[: ]/)[0]));
+  if (ctx.manifest?.env) {
+    const env2 = ctx.manifest.env.flatMap((ref) => {
+      const sources = ref.sources.filter((src) => !scriptLocal(src.split(/[: ]/)[0]));
+      return ref.sources.length > 0 && sources.length === 0 ? [] : [{ ...ref, sources }];
+    });
+    ctx.manifest = { ...ctx.manifest, env: env2 };
+  }
   envSignals(ctx);
+  const touched = new Set(ctx.signals.filter((s) => isUnder(s.evidence.path, scope.root)).map((s) => s.provider));
+  for (const sig of ctx.signals) {
+    if (!scope.closure.some((c) => isUnder(sig.evidence.path, c)) || sig.capability === "model.inference")
+      continue;
+    if (sig.kind === "host" && sig.provider === "http" && !scope.closure.some((c) => isAuxiliary(sig.evidence.path, c)))
+      continue;
+    if (["host", "env", "env_value", "code"].includes(sig.kind) || !CLOSURE_CAPABILITIES.has(sig.capability) && !touched.has(sig.provider))
+      sig.weak = true;
+  }
+  for (const sig of ctx.signals)
+    if (isAuxiliary(sig.evidence.path, harnessRoot))
+      sig.weak = true;
   const dependencies = mergeSignals(ctx, runtimes);
   linkEnv(ctx, dependencies, runtimes);
   for (const m of migrations) {
@@ -185290,6 +186217,15 @@ function detectDependencies(input) {
     const candidates = dependencies.filter((d) => MIGRATION_ENGINE_PROVIDERS.has(d.provider) && (root === undefined || (d.runtimeRoots ?? []).includes(root)));
     resolveMigrationEngines([m], candidates.map((d) => d.provider), ctx);
   }
+  const keepSource = (source) => isRuntimeEnvSource(source) && !isAuxiliary(source.split(/[: ]/)[0], harnessRoot);
+  ctx.env = ctx.env.filter((e) => !isAmbientEnv(e.name) && keepSource(e.source));
+  if (ctx.manifest?.env) {
+    const env2 = ctx.manifest.env.flatMap((ref) => {
+      const sources = ref.sources.filter(keepSource);
+      return ref.sources.length > 0 && sources.length === 0 ? [] : [{ ...ref, sources }];
+    });
+    ctx.manifest = { ...ctx.manifest, env: env2 };
+  }
   const env = buildEnvReferences(ctx, dependencies);
   return {
     schema: DEPENDENCY_MAP_SCHEMA,
@@ -193545,19 +194481,19 @@ function assertHarnessGraphSyncSize(graph) {
 // ../../packages/messaging/messaging.json
 var messaging_default = {
   $schema: "./messaging.schema.json",
-  version: "1.0.3",
-  locked_on: "2026-10-14",
+  version: "1.0.4",
+  locked_on: "2026-10-15",
   approved_by: "mo",
-  source: "Branding project docs/positioning.md v1.0.3",
+  source: "Branding project docs/positioning.md v1.0.4",
   canonical_strings: {
-    version: "1.0.3",
-    locked_on: "2026-10-14",
+    version: "1.0.4",
+    locked_on: "2026-10-15",
     approved_by: "mo",
     strings: [
       {
         id: "one_liner",
         source: "approved",
-        text: "Moda gives engineers the infrastructure to monitor AI agents in production, find the mistakes they keep repeating, and test every change against real traces before it ships.",
+        text: "Infrastructure for catching AI agent mistakes in production and turning them into evals.",
         match: "exact",
         surfaces: [
           "apps/moda-frontend/components/landing/hero.tsx (subhead under the H1)",
@@ -193617,7 +194553,7 @@ var messaging_default = {
       {
         id: "meta_description",
         source: "derived",
-        text: "Production monitoring and evals for AI agents. Find the mistakes your agents keep repeating and test every change against real traces before it ships.",
+        text: "Production monitoring and evals for AI agents. Infrastructure for catching AI agent mistakes in production and turning them into evals.",
         match: "exact",
         max_chars: 160,
         surfaces: [
@@ -193642,7 +194578,7 @@ var messaging_default = {
       {
         id: "long_description",
         source: "derived",
-        text: "Moda gives engineers the infrastructure to monitor AI agents in production, find the mistakes they keep repeating, and test every change against real traces before it ships. Agents fail in ways that never throw an error: frustrated users, failing tools, lazy or hallucinated answers. Moda reads every production trace end to end, detects these failures, and groups them into problems ranked by how many users they affect, with the traces behind each one. When your team changes a prompt, tool, or model, Moda replays the change against those traces and shows whether it worked, then keeps monitoring after release. Works with any model provider through SDKs, OpenTelemetry, or HTTP. Backed by Y Combinator.",
+        text: "Infrastructure for catching AI agent mistakes in production and turning them into evals. Agents fail in ways that never throw an error: frustrated users, failing tools, lazy or hallucinated answers. Moda reads every production trace end to end, detects these failures, and groups them into problems ranked by how many users they affect, with the traces behind each one. When your team changes a prompt, tool, or model, Moda replays the change against those traces and shows whether it worked, then keeps monitoring after release. Works with any model provider through SDKs, OpenTelemetry, or HTTP. Backed by Y Combinator.",
         match: "exact",
         surfaces: [
           "LinkedIn About",
@@ -193756,7 +194692,7 @@ var messaging_default = {
     ]
   },
   banned_phrases: {
-    version: "1.0.3",
+    version: "1.0.4",
     phrases: [
       {
         id: "fixes_your_agent",
@@ -193933,7 +194869,7 @@ var messaging_default = {
     ]
   },
   terminology: {
-    version: "1.0.3",
+    version: "1.0.4",
     terms: [
       {
         use: "trace",
@@ -194935,7 +195871,7 @@ async function runHarnessCommand(context) {
         throw new CliInputError("Focused remote prompt analysis is not supported yet.", "Use local --analyst=claude|codex|cursor|local-scan, or drop --concern for a full remote report.");
       }
       if (context.flags["github-actions"] === "true") {
-        const { runGithubActionsAnalyze } = await import("./harness-github-actions-tmy3gqwa.js");
+        const { runGithubActionsAnalyze } = await import("./harness-github-actions-301nak95.js");
         const result = await runGithubActionsAnalyze(rootDir, {
           writeReport: (report2) => {
             const normalized = normalizeHarnessReport(report2);