@moda-ai/cli 1.55.89 → 1.55.90

package/dist/{cli-9p2cdy58.js → cli-aqk56bkg.js}

@@ -40,15 +40,15 @@ import {
   assertFlags,
   assertPositionals,
   requireTenant
-} from "./cli-22yvg5kh.js";
+} from "./cli-6ga6kmdp.js";
 import {
   ApiError,
   callControlAPI
-} from "./cli-87xy1evx.js";
+} from "./cli-dxajrq9h.js";
 import {
   createCommandContext,
   stringOption
-} from "./cli-5ms8rw8x.js";
+} from "./cli-13zdcv4w.js";
 import {
   EXIT_DEGRADED,
   embeddedTenantIdFromApiKey,
@@ -59,7 +59,7 @@ import {
   resolveModaBaseUrl,
   resolveTenantId,
   shellArg
-} from "./cli-z1t3sf7b.js";
+} from "./cli-1nd4339b.js";
 import {
   CliInputError,
   CliInputRequiredError
@@ -74,7 +74,7 @@ import {
   extractPythonSource,
   resolvePromptSource,
   validatePromptSource
-} from "./cli-p1rrq2sq.js";
+} from "./cli-t29r8b6f.js";
 import {
   $isMap,
   $isNode,
@@ -91,17 +91,21 @@ import {
   DEFAULT_MAX_INVENTORY_TEXT_BYTES,
   MAX_RECORDED_SKIPS,
   MAX_SCANNED_FILE_BYTES,
+  MAX_STORED_ARTIFACT_BODY_BYTES,
   SKIPPED_DIRS,
+  captureFullArtifactBodies,
+  fitGraphForSync,
   isEvalLikePath,
   isSecretishPath,
   isSkippedDir,
   isSkippedPathPrefix,
   isTextFile,
   packSnapshot,
+  redactArtifactBody,
   redactDeep,
-  redactSnapshotText,
-  shouldInventoryFile
-} from "./cli-p5grm12t.js";
+  shouldInventoryFile,
+  storeShortenedArtifactBodies
+} from "./cli-0semcakc.js";
 import {
   CALL_SINKS,
   CallIndex,
@@ -487,12 +491,12 @@ function buildPrograms(rootDir, options = {}) {
 
 // src/harness-extract/emit-models.ts
 var import_typescript7 = __toESM(require_typescript(), 1);
-import { createHash as createHash9 } from "node:crypto";
+import { createHash as createHash10 } from "node:crypto";
 import { readFileSync as readFileSync16, readdirSync as readdirSync8, statSync as statSync5 } from "node:fs";
 import { join as join13, resolve as resolve13 } from "node:path";
 
 // src/harness-candidate-promotion.ts
-import { createHash as createHash8 } from "node:crypto";
+import { createHash as createHash9 } from "node:crypto";
 import { readdirSync as readdirSync7, readFileSync as readFileSync15, statSync as statSync4 } from "node:fs";
 import { extname as extname8, posix as posix2, resolve as resolve12 } from "node:path";
 
@@ -704,22 +708,6 @@ function readSourcePathRelativeToEvidence(artifact, rootDir) {
   }
   return;
 }
-var PRIVATE_KEY_BLOCK = /-----BEGIN ([A-Z ]*)PRIVATE KEY-----(?:[\s\S]*?-----END \1PRIVATE KEY-----|(?:(?:\r\n|\r|\n)[ \t]*[A-Za-z0-9+/=]+[ \t]*(?=[\r\n]|$))*)/g;
-function maskPrivateKeyBlock(block) {
-  return block.split(/(\r\n|\r|\n)/).map((part, index) => index === 0 ? "[REDACTED PRIVATE KEY]" : index % 2 === 1 ? part : "").join("");
-}
-var CREDENTIAL_FIELD = /(\b(?:[A-Za-z0-9]+[_-])*(?:api[_-]?key|apikey|secret(?:[_-]?key)?|password|passwd|access[_-]?token|auth[_-]?token|refresh[_-]?token|client[_-]?secret|private[_-]?key)\b["']?\s*[:=]\s*["']?)(?![<${]|process\.env|os\.environ)([^\s"'`,;]{8,})/gi;
-var CALL_OR_INDEX = /^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*[([]/;
-var DOTTED_REFERENCE = /^[A-Za-z_$][\w$]{0,39}(?:\.[A-Za-z_$][\w$]{0,39})+$/;
-function isCredentialReference(field, value) {
-  if (/["']$/.test(field))
-    return false;
-  return CALL_OR_INDEX.test(value) || DOTTED_REFERENCE.test(value);
-}
-function redactArtifactBody(body) {
-  const masked = body.replace(PRIVATE_KEY_BLOCK, maskPrivateKeyBlock).replace(CREDENTIAL_FIELD, (match, field, value) => isCredentialReference(field, value) ? match : `${field}[REDACTED]`);
-  return redactSnapshotText(masked).text;
-}
 function hydratePromptAndToolBodies(graph, rootDir) {
   for (const artifact of graph.artifacts) {
     if (requiresArtifactBody(artifact.type) && !artifactHasBody(artifact)) {
@@ -1275,7 +1263,7 @@ function withTemplateOwners(templates, refs, agentsForCallSite, scopes = []) {
 }
 
 // src/harness.ts
-import { createHash as createHash7 } from "node:crypto";
+import { createHash as createHash8 } from "node:crypto";
 import { execFileSync as execFileSync3, spawn } from "node:child_process";
 import { homedir, tmpdir as tmpdir2 } from "node:os";
 import { fileURLToPath } from "node:url";
@@ -1407,6 +1395,112 @@ function harnessAgentIdentities(value) {
   });
 }
 
+// src/harness-body-store.ts
+import { createHash as createHash2 } from "node:crypto";
+
+// src/harness-sync-limits.ts
+var MAX_HARNESS_SYNC_GRAPH_BYTES = 2000000;
+var MAX_HARNESS_SYNC_REQUEST_BYTES = 2000000;
+function assertHarnessSyncRequestSize(body) {
+  const requestBytes = Buffer.byteLength(JSON.stringify(body), "utf8");
+  if (requestBytes > MAX_HARNESS_SYNC_REQUEST_BYTES) {
+    throw new CliInputError(`Harness sync request is too large (${requestBytes.toLocaleString()} bytes; limit ${MAX_HARNESS_SYNC_REQUEST_BYTES.toLocaleString()}).`, "Run `moda harness analyze --path=<agent-dir>` to narrow the harness root.");
+  }
+}
+function assertHarnessGraphSyncSize(graph) {
+  if (!graph || typeof graph !== "object" || Array.isArray(graph)) {
+    throw new CliInputError("Harness graph must be an object before sync.");
+  }
+  const graphBytes = Buffer.byteLength(JSON.stringify(graph), "utf8");
+  if (graphBytes > MAX_HARNESS_SYNC_GRAPH_BYTES) {
+    throw new CliInputError(`Harness graph is too large to sync (${graphBytes.toLocaleString()} bytes; limit ${MAX_HARNESS_SYNC_GRAPH_BYTES.toLocaleString()}).`, [
+      "Run `moda harness analyze --path=<agent-dir>` to narrow the harness root.",
+      "Reduce captured prompt/tool bodies if the graph grew too large.",
+      "Split multiple agent roots into separate harness syncs per tenant."
+    ].join(`
+`));
+  }
+}
+
+// src/harness-body-store.ts
+function sha256Hex(text) {
+  return Promise.resolve(createHash2("sha256").update(text, "utf8").digest("hex"));
+}
+function graphBytes(graph) {
+  return Buffer.byteLength(JSON.stringify(graph), "utf8");
+}
+async function prepareHarnessGraphForSync(graph, store, maxBytes = MAX_HARNESS_SYNC_GRAPH_BYTES, options = {}) {
+  if (!graph || typeof graph !== "object" || graphBytes(graph) <= maxBytes) {
+    return { graph, shortened: 0, uploaded: 0, storeFailed: false, storeFailedBodies: 0, unstorableBodies: 0 };
+  }
+  const copy = structuredClone(graph);
+  const fullBodies = await captureFullArtifactBodies(copy, sha256Hex);
+  const artifacts = Array.isArray(copy.artifacts) ? copy.artifacts.filter((artifact) => Boolean(artifact) && typeof artifact === "object") : [];
+  const capturedBodies = new Map(artifacts.map((artifact) => [artifact, artifact.body]));
+  const shortened = fitGraphForSync(copy, maxBytes, fullBodies);
+  const unstorableBodies = artifacts.filter((artifact) => artifact.body !== capturedBodies.get(artifact) && typeof artifact.bodyHash !== "string").length;
+  if (shortened === 0 || !store || options.requireStorable && unstorableBodies > 0) {
+    return { graph: copy, shortened, uploaded: 0, storeFailed: false, storeFailedBodies: 0, unstorableBodies };
+  }
+  const stored = await storeShortenedArtifactBodies(copy, fullBodies, store, { keepHashesOnError: true });
+  const storeFailed = stored.error !== undefined;
+  return {
+    graph: copy,
+    shortened,
+    uploaded: stored.uploaded,
+    storeFailed,
+    storeFailedBodies: storeFailed ? stored.referenced : 0,
+    unstorableBodies
+  };
+}
+function requestBytes(request) {
+  return graphBytes({ ...request, dryRun: false });
+}
+function isRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function reportFieldsWithoutGraph(body) {
+  const report = body.report;
+  if (!isRecord(report) || !("graph" in report))
+    return {};
+  const { graph: _graph, ...reportWithoutGraph } = report;
+  const fields = { report: reportWithoutGraph };
+  if (body.reportHash === undefined)
+    return fields;
+  const reportHash = hashStableJson(reportWithoutGraph);
+  fields.reportHash = reportHash;
+  const approval = body.reportApproval;
+  if (isRecord(approval) && approval.reportHash === body.reportHash) {
+    fields.reportApproval = { ...approval, reportHash, approvedReportHash: body.reportHash };
+  }
+  return fields;
+}
+async function prepareHarnessSyncRequest(body, store, maxRequestBytes = MAX_HARNESS_SYNC_REQUEST_BYTES, maxGraphBytes = MAX_HARNESS_SYNC_GRAPH_BYTES, options = {}) {
+  const { dryRun: _dryRun, ...rest } = body;
+  if (requestBytes(rest) <= maxRequestBytes && graphBytes(rest.graph) <= maxGraphBytes) {
+    return { request: rest, shortened: 0, uploaded: 0, storeFailed: false, storeFailedBodies: 0, unstorableBodies: 0 };
+  }
+  const request = { ...rest, ...reportFieldsWithoutGraph(rest) };
+  const envelopeBytes = requestBytes({ ...request, graph: null });
+  const budget = Math.min(maxGraphBytes, maxRequestBytes - envelopeBytes);
+  const { graph, ...prepared } = await prepareHarnessGraphForSync(rest.graph, store, Math.max(0, budget), options);
+  return { request: { ...request, graph }, ...prepared };
+}
+function controlApiArtifactBodyStore(call) {
+  return {
+    async missing(hashes) {
+      const result = await call("/harnesses/bodies/missing", {
+        method: "POST",
+        body: JSON.stringify({ hashes })
+      });
+      return Array.isArray(result?.missing) ? result.missing.filter((hash) => typeof hash === "string") : [];
+    },
+    upload(bodies) {
+      return call("/harnesses/bodies", { method: "POST", body: JSON.stringify({ bodies }) });
+    }
+  };
+}
+
 // src/analyst-tui.ts
 class AnalystTui {
   state;
@@ -2102,13 +2196,13 @@ function entrypointOf(command, modelRouting) {
   return { entrypoint: { kind: "command", ...command ? { command } : {}, ...hasRouting ? { modelRouting } : {} } };
 }
 // ../../packages/harness-bundle/src/register/collect.ts
-import { createHash as createHash5 } from "node:crypto";
+import { createHash as createHash6 } from "node:crypto";
 import { execFileSync } from "node:child_process";
 import { copyFileSync, createReadStream, existsSync as existsSync6, mkdirSync as mkdirSync3, realpathSync as realpathSync6, rmSync as rmSync2, statSync as statSync3, writeFileSync as writeFileSync3 } from "node:fs";
 import { dirname as dirname7, join as join8 } from "node:path";
 
 // ../../packages/harness-bundle/src/collect/collect.ts
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 import { closeSync, existsSync as existsSync3, lstatSync as lstatSync2, openSync, readdirSync as readdirSync2, readFileSync as readFileSync4, readlinkSync, readSync, realpathSync as realpathSync3 } from "node:fs";
 import { basename as basename2, dirname as dirname4, isAbsolute as isAbsolute4, join as join4, relative as relative3, resolve as resolve5, sep } from "node:path";
 
@@ -6247,7 +6341,7 @@ function detectEncoding(buf) {
   }
 }
 function sha256(buf) {
-  return createHash2("sha256").update(buf).digest("hex");
+  return createHash3("sha256").update(buf).digest("hex");
 }
 var DROP_FIRST = ["data", "binary", "asset", "generated"];
 var KEEP = [
@@ -6316,7 +6410,7 @@ function rangeCovered(ranges, start, end) {
 }
 
 // ../../packages/harness-bundle/src/collect/write.ts
-import { createHash as createHash3, randomUUID } from "node:crypto";
+import { createHash as createHash4, randomUUID } from "node:crypto";
 import { createWriteStream, existsSync as existsSync4, lstatSync as lstatSync3, mkdirSync as mkdirSync2, readdirSync as readdirSync3, readFileSync as readFileSync5, readlinkSync as readlinkSync2, realpathSync as realpathSync4, renameSync, rmSync, statSync as statSync2, writeFileSync as writeFileSync2 } from "node:fs";
 import { dirname as dirname5, isAbsolute as isAbsolute5, join as join5, relative as relative4, resolve as resolve6, sep as sep2 } from "node:path";
 import { Readable, Transform } from "node:stream";
@@ -6515,7 +6609,7 @@ function* tarChunks(files) {
 }
 async function writeTarGz(files, path) {
   mkdirSync2(dirname5(path), { recursive: true });
-  const tarHash = createHash3("sha256");
+  const tarHash = createHash4("sha256");
   await pipeline(Readable.from(tarChunks(files)), new Transform({
     transform(chunk, _encoding, callback) {
       tarHash.update(chunk);
@@ -6743,7 +6837,7 @@ function parseJsonLoose(text) {
     return;
   }
 }
-function isRecord(value) {
+function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function asString(value) {
@@ -7941,7 +8035,7 @@ function readManifest(dir) {
     return;
   try {
     const parsed = JSON.parse(readFileSync6(path, "utf8"));
-    if (isRecord(parsed) && parsed.schema === HARNESS_BUNDLE_SCHEMA && Array.isArray(parsed.files)) {
+    if (isRecord2(parsed) && parsed.schema === HARNESS_BUNDLE_SCHEMA && Array.isArray(parsed.files)) {
       return parsed;
     }
   } catch {
@@ -7977,7 +8071,7 @@ function makeFile(path, text, categories) {
   };
 }
 function isValidEntry(value) {
-  return isRecord(value) && typeof value.path === "string" && typeof value.bytes === "number" && Array.isArray(value.categories) && value.categories.every((c) => typeof c === "string") && (value.encoding === "text" || value.encoding === "binary");
+  return isRecord2(value) && typeof value.path === "string" && typeof value.bytes === "number" && Array.isArray(value.categories) && value.categories.every((c) => typeof c === "string") && (value.encoding === "text" || value.encoding === "binary");
 }
 function staysInside(root, abs) {
   try {
@@ -8013,7 +8107,7 @@ function loadFiles(dir, opts = {}) {
       if (isValidEntry(raw))
         entries.push(raw);
       else
-        skipped.push({ path: isRecord(raw) && typeof raw.path === "string" ? raw.path : "(unnamed)", reason: "invalid_entry" });
+        skipped.push({ path: isRecord2(raw) && typeof raw.path === "string" ? raw.path : "(unnamed)", reason: "invalid_entry" });
     }
     const contentRoot = contentRootFor(dir, entries);
     entries.sort((a, b) => cmp(a.path, b.path));
@@ -8099,7 +8193,7 @@ function loadFiles(dir, opts = {}) {
   return { files, truncated, skipped };
 }
 function isValidEnv(value) {
-  return isRecord(value) && typeof value.name === "string" && Array.isArray(value.sources) && typeof value.classification === "string" && typeof value.hasExampleValue === "boolean";
+  return isRecord2(value) && typeof value.name === "string" && Array.isArray(value.sources) && typeof value.classification === "string" && typeof value.hasExampleValue === "boolean";
 }
 
 // ../../packages/harness-bundle/src/detect/frameworks.ts
@@ -10254,7 +10348,7 @@ function parsePackageJsons(files) {
       continue;
     try {
       const json = JSON.parse(f.text);
-      if (isRecord(json))
+      if (isRecord2(json))
         out.push({ path: f.path, root: dirname6(f.path), json });
     } catch {}
   }
@@ -10267,7 +10361,7 @@ function fromPackageJson(f, out) {
   } catch {
     return;
   }
-  if (!isRecord(json))
+  if (!isRecord2(json))
     return;
   for (const [field, dev] of [
     ["dependencies", false],
@@ -10276,7 +10370,7 @@ function fromPackageJson(f, out) {
     ["devDependencies", true]
   ]) {
     const deps = json[field];
-    if (!isRecord(deps))
+    if (!isRecord2(deps))
       continue;
     for (const name of Object.keys(deps).sort()) {
       out.push({ eco: "npm", name, path: f.path, line: lineOfToken(f.text, `"${name}"`), dev });
@@ -10307,49 +10401,49 @@ function fromPyproject(f, out) {
     if (name && name !== "python")
       out.push({ eco: "pypi", name, path: f.path, line: lineOfToken(f.text, name), dev });
   };
-  const project = isRecord(doc.project) ? doc.project : {};
+  const project = isRecord2(doc.project) ? doc.project : {};
   for (const req of asArray(project.dependencies))
     if (typeof req === "string")
       add(req, false);
-  const optional = isRecord(project["optional-dependencies"]) ? project["optional-dependencies"] : {};
+  const optional = isRecord2(project["optional-dependencies"]) ? project["optional-dependencies"] : {};
   for (const [group, reqs] of Object.entries(optional)) {
     for (const req of asArray(reqs))
       if (typeof req === "string")
         add(req, /dev|test|lint|doc/i.test(group));
   }
-  const groups = isRecord(doc["dependency-groups"]) ? doc["dependency-groups"] : {};
+  const groups = isRecord2(doc["dependency-groups"]) ? doc["dependency-groups"] : {};
   for (const reqs of Object.values(groups))
     for (const req of asArray(reqs))
       if (typeof req === "string")
         add(req, true);
-  const tool = isRecord(doc.tool) ? doc.tool : {};
-  const poetry = isRecord(tool.poetry) ? tool.poetry : {};
-  if (isRecord(poetry.dependencies))
+  const tool = isRecord2(doc.tool) ? doc.tool : {};
+  const poetry = isRecord2(tool.poetry) ? tool.poetry : {};
+  if (isRecord2(poetry.dependencies))
     for (const name of Object.keys(poetry.dependencies))
       add(name, false);
-  if (isRecord(poetry["dev-dependencies"]))
+  if (isRecord2(poetry["dev-dependencies"]))
     for (const name of Object.keys(poetry["dev-dependencies"]))
       add(name, true);
-  if (isRecord(poetry.group)) {
+  if (isRecord2(poetry.group)) {
     for (const [group, body] of Object.entries(poetry.group)) {
-      if (isRecord(body) && isRecord(body.dependencies)) {
+      if (isRecord2(body) && isRecord2(body.dependencies)) {
         for (const name of Object.keys(body.dependencies))
           add(name, /dev|test|lint|doc/i.test(group));
       }
     }
   }
-  const uv = isRecord(tool.uv) ? tool.uv : {};
+  const uv = isRecord2(tool.uv) ? tool.uv : {};
   for (const req of asArray(uv["dev-dependencies"]))
     if (typeof req === "string")
       add(req, true);
-  const hatch = isRecord(tool.hatch) && isRecord(tool.hatch.metadata) && isRecord(tool.hatch.metadata.hooks) ? tool.hatch.metadata.hooks : {};
+  const hatch = isRecord2(tool.hatch) && isRecord2(tool.hatch.metadata) && isRecord2(tool.hatch.metadata.hooks) ? tool.hatch.metadata.hooks : {};
   for (const hook of Object.values(hatch)) {
-    if (!isRecord(hook))
+    if (!isRecord2(hook))
       continue;
     for (const req of asArray(hook.dependencies))
       if (typeof req === "string")
         add(req, false);
-    const extra = isRecord(hook["optional-dependencies"]) ? hook["optional-dependencies"] : {};
+    const extra = isRecord2(hook["optional-dependencies"]) ? hook["optional-dependencies"] : {};
     for (const [group, reqs] of Object.entries(extra))
       for (const req of asArray(reqs))
         if (typeof req === "string")
@@ -10368,7 +10462,7 @@ function fromPipfile(f, out) {
     ["dev-packages", true]
   ]) {
     const pkgs = doc[section];
-    if (isRecord(pkgs)) {
+    if (isRecord2(pkgs)) {
       for (const name of Object.keys(pkgs)) {
         out.push({ eco: "pypi", name: name.toLowerCase(), path: f.path, line: lineOfToken(f.text, name), dev });
       }
@@ -10550,7 +10644,7 @@ var SLS_EVENT_TRIGGERS = {
   alexaSkill: "event"
 };
 function envFromVariables(ctx, vars, file, sourceLabel) {
-  if (!isRecord(vars))
+  if (!isRecord2(vars))
     return;
   for (const name of Object.keys(vars).sort()) {
     const value = vars[name];
@@ -10561,10 +10655,10 @@ function envFromVariables(ctx, vars, file, sourceLabel) {
 function cfnResources(ctx, resources, file, runtime) {
   for (const logicalId of Object.keys(resources).sort()) {
     const res = resources[logicalId];
-    if (!isRecord(res))
+    if (!isRecord2(res))
       continue;
     const type = asString(res.Type) ?? "";
-    const props = isRecord(res.Properties) ? res.Properties : {};
+    const props = isRecord2(res.Properties) ? res.Properties : {};
     let spec = CFN_RESOURCES[type];
     if (!spec && (type === "AWS::RDS::DBInstance" || type === "AWS::RDS::DBCluster")) {
       spec = { capability: "database", provider: rdsEngineProvider(asString(props.Engine)), cls: "engine" };
@@ -10580,61 +10674,61 @@ function handlerPath(codeUri, handler, root) {
   return codeUri ? `${joinPath(root, codeUri)}/${handler}` : joinPath(root, handler);
 }
 function detectSam(ctx, file, doc) {
-  const resources = isRecord(doc.Resources) ? doc.Resources : undefined;
+  const resources = isRecord2(doc.Resources) ? doc.Resources : undefined;
   if (!resources)
     return;
   const root = dirname6(file.path);
-  const globals = isRecord(doc.Globals) && isRecord(doc.Globals.Function) ? doc.Globals.Function : {};
+  const globals = isRecord2(doc.Globals) && isRecord2(doc.Globals.Function) ? doc.Globals.Function : {};
   const runtime = newRuntime("aws_lambda", root, [file.path], [ev(file, /AWS::Serverless|AWSTemplateFormatVersion/)], 0.95);
   const g = languageFromRuntime(asString(globals.Runtime));
-  envFromVariables(ctx, isRecord(globals.Environment) ? globals.Environment.Variables : undefined, file, "Globals");
+  envFromVariables(ctx, isRecord2(globals.Environment) ? globals.Environment.Variables : undefined, file, "Globals");
   for (const logicalId of Object.keys(resources).sort()) {
     const res = resources[logicalId];
-    if (!isRecord(res))
+    if (!isRecord2(res))
       continue;
     const type = asString(res.Type);
     if (type !== "AWS::Serverless::Function" && type !== "AWS::Lambda::Function")
       continue;
-    const props = isRecord(res.Properties) ? res.Properties : {};
+    const props = isRecord2(res.Properties) ? res.Properties : {};
     const lang = languageFromRuntime(asString(props.Runtime) ?? asString(globals.Runtime));
     runtime.language ??= lang.language ?? g.language;
     runtime.runtimeVersion ??= lang.version ?? g.version;
     const handler = asString(props.Handler) ?? asString(globals.Handler);
-    const codeUri = asString(props.CodeUri) ?? asString(globals.CodeUri) ?? (isRecord(props.Code) ? undefined : asString(props.Code));
-    const events = isRecord(props.Events) ? props.Events : {};
+    const codeUri = asString(props.CodeUri) ?? asString(globals.CodeUri) ?? (isRecord2(props.Code) ? undefined : asString(props.Code));
+    const events = isRecord2(props.Events) ? props.Events : {};
     const triggers = new Set;
     for (const evt of Object.values(events)) {
-      if (isRecord(evt))
+      if (isRecord2(evt))
         triggers.add(SAM_EVENT_TRIGGERS[asString(evt.Type) ?? ""] ?? "event");
     }
-    if (isRecord(props.FunctionUrlConfig))
+    if (isRecord2(props.FunctionUrlConfig))
       triggers.add("http");
     const trigger = triggers.has("http") ? "http" : [...triggers][0] ?? "event";
     const entry = { name: logicalId, trigger };
     if (handler)
       entry.handler = handlerPath(codeUri, handler, root);
     else if (asString(props.PackageType) === "Image") {
-      const meta = isRecord(res.Metadata) ? res.Metadata : {};
+      const meta = isRecord2(res.Metadata) ? res.Metadata : {};
       const ctxDir = asString(meta.DockerContext);
       entry.handler = ctxDir ? `${joinPath(root, ctxDir)}/${asString(meta.Dockerfile) ?? "Dockerfile"}` : undefined;
     }
     runtime.entrypoints.push(entry);
-    envFromVariables(ctx, isRecord(props.Environment) ? props.Environment.Variables : undefined, file, logicalId);
+    envFromVariables(ctx, isRecord2(props.Environment) ? props.Environment.Variables : undefined, file, logicalId);
   }
   cfnResources(ctx, resources, file, runtime);
   const ids = Object.keys(resources);
   const direct = (text, self) => ids.filter((id) => id !== self && new RegExp(`\\b${escapeRe(id)}\\b`).test(text));
-  const globalsText = JSON.stringify(isRecord(doc.Globals) && isRecord(doc.Globals.Function) ? doc.Globals.Function : {});
+  const globalsText = JSON.stringify(isRecord2(doc.Globals) && isRecord2(doc.Globals.Function) ? doc.Globals.Function : {});
   const refs = new Map;
   for (const [fnId, res] of Object.entries(resources)) {
-    if (!isRecord(res) || !/^AWS::(?:Serverless|Lambda)::Function$/.test(asString(res.Type) ?? ""))
+    if (!isRecord2(res) || !/^AWS::(?:Serverless|Lambda)::Function$/.test(asString(res.Type) ?? ""))
       continue;
     const seen = new Set(direct(`${JSON.stringify(res.Properties ?? {})} ${globalsText}`, fnId));
     const queue = [...seen];
     while (queue.length > 0) {
       const id = queue.shift();
       const other = resources[id];
-      if (!isRecord(other) || /^AWS::(?:Serverless|Lambda)::Function$/.test(asString(other.Type) ?? ""))
+      if (!isRecord2(other) || /^AWS::(?:Serverless|Lambda)::Function$/.test(asString(other.Type) ?? ""))
         continue;
       for (const next of direct(JSON.stringify(other.Properties ?? {}), id)) {
         if (next !== fnId && !seen.has(next)) {
@@ -10651,7 +10745,7 @@ function detectSam(ctx, file, doc) {
   return runtime;
 }
 function detectServerless(ctx, file, doc) {
-  const provider = isRecord(doc.provider) ? doc.provider : {};
+  const provider = isRecord2(doc.provider) ? doc.provider : {};
   const providerName = asString(provider.name) ?? "aws";
   const root = dirname6(file.path);
   const kind = providerName === "google" ? "gcp_cloud_functions" : providerName === "azure" ? "azure_functions" : "aws_lambda";
@@ -10660,14 +10754,14 @@ function detectServerless(ctx, file, doc) {
   runtime.language = lang.language;
   runtime.runtimeVersion = lang.version;
   envFromVariables(ctx, provider.environment, file, "provider.environment");
-  const functions = isRecord(doc.functions) ? doc.functions : {};
+  const functions = isRecord2(doc.functions) ? doc.functions : {};
   for (const name of Object.keys(functions).sort()) {
     const fn = functions[name];
-    if (!isRecord(fn))
+    if (!isRecord2(fn))
       continue;
     const triggers = new Set;
     for (const evt of asArray(fn.events)) {
-      if (isRecord(evt))
+      if (isRecord2(evt))
         for (const key of Object.keys(evt))
           triggers.add(SLS_EVENT_TRIGGERS[key] ?? "event");
     }
@@ -10692,7 +10786,7 @@ function detectServerless(ctx, file, doc) {
     const line = at(m.index);
     ctx.env.push({ name: m[1], source: `${file.path}:${line}`, evidence: { path: file.path, line, excerpt: excerpt(splitLines(file.text)[line - 1]), detector: DETECTOR5 } });
   }
-  const resources = isRecord(doc.resources) && isRecord(doc.resources.Resources) ? doc.resources.Resources : undefined;
+  const resources = isRecord2(doc.resources) && isRecord2(doc.resources.Resources) ? doc.resources.Resources : undefined;
   if (resources)
     cfnResources(ctx, resources, file, runtime);
   return runtime;
@@ -10786,7 +10880,7 @@ function detectAws(input) {
     const name = basename3(file.path);
     if (/^serverless\.ya?ml$/.test(name)) {
       const doc = loadYaml(file.text);
-      if (!isRecord(doc)) {
+      if (!isRecord2(doc)) {
         ctx.gaps.push({ kind: "unparseable_config", message: `Could not parse ${file.path}`, evidence: [{ path: file.path, detector: DETECTOR5 }] });
         continue;
       }
@@ -10795,7 +10889,7 @@ function detectAws(input) {
         out.push(rt);
     } else if (isCfnTemplate(file)) {
       const doc = file.path.endsWith(".json") ? safeJson(file.text) : loadYaml(file.text);
-      if (!isRecord(doc)) {
+      if (!isRecord2(doc)) {
         ctx.gaps.push({ kind: "unparseable_config", message: `Could not parse ${file.path}`, evidence: [{ path: file.path, detector: DETECTOR5 }] });
         continue;
       }
@@ -10830,7 +10924,7 @@ function parseWrangler(file) {
     }
   }
   const parsed = parseJsonLoose(file.text);
-  return isRecord(parsed) ? parsed : undefined;
+  return isRecord2(parsed) ? parsed : undefined;
 }
 function ev2(file, token) {
   const re = typeof token === "string" ? new RegExp(escapeRe(token)) : token;
@@ -10838,10 +10932,10 @@ function ev2(file, token) {
 }
 function sections(config) {
   const out = [config];
-  if (isRecord(config.env))
+  if (isRecord2(config.env))
     for (const key of Object.keys(config.env).sort()) {
       const env = config.env[key];
-      if (isRecord(env))
+      if (isRecord2(env))
         out.push(env);
     }
   return out;
@@ -10877,7 +10971,7 @@ function detectCloudflare(input) {
       const hasFetch = !mainFile || /\bfetch\s*[(:]|\bexport\s+default\s+(?:app|router|server)\b|routeAgentRequest|new\s+Hono\b|\bon_fetch\b|WorkerEntrypoint/.test(text);
       if (hasFetch)
         runtime.entrypoints.push({ name: "fetch", handler: `${mainPath}#default.fetch`, trigger: "http" });
-      if (mainFile && /(?:^|[\s{,])(?:async\s+)?scheduled\s*\(\s*\w|\bscheduled\s*:\s*(?:async\s*)?(?:\(|function)|\bon_scheduled\b/m.test(text) && asArray(isRecord(config.triggers) ? config.triggers.crons : undefined).length === 0) {
+      if (mainFile && /(?:^|[\s{,])(?:async\s+)?scheduled\s*\(\s*\w|\bscheduled\s*:\s*(?:async\s*)?(?:\(|function)|\bon_scheduled\b/m.test(text) && asArray(isRecord2(config.triggers) ? config.triggers.crons : undefined).length === 0) {
         runtime.entrypoints.push({ name: "scheduled", handler: `${mainPath}#default.scheduled`, trigger: "cron" });
       }
       if (!mainFile) {
@@ -10886,7 +10980,7 @@ function detectCloudflare(input) {
     } else if (pagesOut) {
       runtime.entrypoints.push({ name: "pages", handler: joinPath(root, "functions"), trigger: "http" });
     }
-    const triggers = isRecord(config.triggers) ? config.triggers : {};
+    const triggers = isRecord2(config.triggers) ? config.triggers : {};
     for (const cron of asArray(triggers.crons)) {
       if (typeof cron === "string")
         runtime.entrypoints.push({ name: `cron ${cron}`, handler: main ? `${joinPath(root, main)}#default.scheduled` : undefined, trigger: "cron" });
@@ -10903,16 +10997,16 @@ function detectCloudflare(input) {
       runtime.bindings.push(resource ? { name, type: normalized, resource } : { name, type: normalized });
       return true;
     };
-    const produced = new Set(sections(config).flatMap((section) => asArray(isRecord(section.queues) ? section.queues.producers : undefined).map((p2) => isRecord(p2) ? asString(p2.queue) : undefined)));
+    const produced = new Set(sections(config).flatMap((section) => asArray(isRecord2(section.queues) ? section.queues.producers : undefined).map((p2) => isRecord2(p2) ? asString(p2.queue) : undefined)));
     for (const section of sections(config)) {
       for (const [field, spec] of Object.entries(WORKERS_BINDINGS)) {
         const raw = section[field];
         if (raw === undefined)
           continue;
         if (field === "queues") {
-          const queues = isRecord(raw) ? raw : {};
+          const queues = isRecord2(raw) ? raw : {};
           for (const producer of asArray(queues.producers)) {
-            if (!isRecord(producer))
+            if (!isRecord2(producer))
               continue;
             const name = asString(producer.binding) ?? "QUEUE";
             const resource = asString(producer.queue);
@@ -10921,7 +11015,7 @@ function detectCloudflare(input) {
             }
           }
           for (const consumer of asArray(queues.consumers)) {
-            if (!isRecord(consumer))
+            if (!isRecord2(consumer))
               continue;
             const queue = asString(consumer.queue) ?? "queue";
             if (addBinding(queue, "QueueConsumer", queue)) {
@@ -10934,7 +11028,7 @@ function detectCloudflare(input) {
         }
         const items = Array.isArray(raw) ? raw : [raw];
         for (const item of items) {
-          if (!isRecord(item))
+          if (!isRecord2(item))
             continue;
           const name = asString(item.binding) ?? asString(item.name) ?? spec.type.toUpperCase();
           const resource = asString(item.database_name) ?? asString(item.bucket_name) ?? asString(item.index_name) ?? asString(item.service) ?? asString(item.dataset) ?? asString(item.namespace) ?? asString(item.id);
@@ -10964,9 +11058,9 @@ function detectCloudflare(input) {
           }
         }
       }
-      const durable = isRecord(section.durable_objects) ? section.durable_objects : {};
+      const durable = isRecord2(section.durable_objects) ? section.durable_objects : {};
       for (const item of asArray(durable.bindings)) {
-        if (!isRecord(item))
+        if (!isRecord2(item))
           continue;
         const name = asString(item.name) ?? "DO";
         const className2 = asString(item.class_name);
@@ -10981,19 +11075,19 @@ function detectCloudflare(input) {
         }
       }
       for (const item of asArray(section.workflows)) {
-        if (isRecord(item))
+        if (isRecord2(item))
           addBinding(asString(item.binding) ?? "WORKFLOW", "Workflow", asString(item.class_name));
       }
       for (const item of asArray(section.containers)) {
-        if (isRecord(item))
+        if (isRecord2(item))
           addBinding(asString(item.class_name) ?? "CONTAINER", "Container", asString(item.image));
       }
-      if (isRecord(section.assets)) {
+      if (isRecord2(section.assets)) {
         const binding = asString(section.assets.binding);
         if (binding)
           addBinding(binding, "Assets", asString(section.assets.directory));
       }
-      if (isRecord(section.vars)) {
+      if (isRecord2(section.vars)) {
         for (const key of Object.keys(section.vars).sort()) {
           const value = section.vars[key];
           ctx.env.push({
@@ -11005,7 +11099,7 @@ function detectCloudflare(input) {
         }
       }
       const secrets = section.secrets;
-      const required = isRecord(secrets) ? asArray(secrets.required) : asArray(secrets);
+      const required = isRecord2(secrets) ? asArray(secrets.required) : asArray(secrets);
       for (const s of required)
         if (typeof s === "string")
           ctx.env.push({ name: s, source: `${file.path} secrets` });
@@ -11196,7 +11290,7 @@ function detachDockerfile(byRoot, contributions, c) {
 }
 function composeServices(ctx, file, byRoot, contributions, relocated) {
   const doc = loadYaml(file.text);
-  if (!isRecord(doc) || !isRecord(doc.services))
+  if (!isRecord2(doc) || !isRecord2(doc.services))
     return;
   const base = dirname6(file.path);
   const at = lineIndex(file.text);
@@ -11207,7 +11301,7 @@ function composeServices(ctx, file, byRoot, contributions, relocated) {
   };
   for (const name of Object.keys(doc.services).sort()) {
     const svc = doc.services[name];
-    if (!isRecord(svc))
+    if (!isRecord2(svc))
       continue;
     const line = lineOfService(name);
     const evidence = { path: file.path, line, excerpt: line ? excerpt(lines[line - 1]) : undefined, detector: `${DETECTOR7}.compose` };
@@ -11216,11 +11310,11 @@ function composeServices(ctx, file, byRoot, contributions, relocated) {
     const ports = asArray(svc.ports);
     const svcEntrypoint = composeArgs(svc.entrypoint);
     const svcCommand = composeArgs(svc.command);
-    let serviceRoot = build !== undefined ? joinPath(base, typeof build === "string" ? build : isRecord(build) ? asString(build.context) ?? "." : ".") : undefined;
+    let serviceRoot = build !== undefined ? joinPath(base, typeof build === "string" ? build : isRecord2(build) ? asString(build.context) ?? "." : ".") : undefined;
     if (build !== undefined) {
-      const context = typeof build === "string" ? build : isRecord(build) ? asString(build.context) ?? "." : ".";
+      const context = typeof build === "string" ? build : isRecord2(build) ? asString(build.context) ?? "." : ".";
       const contextRoot = joinPath(base, context);
-      const dockerfile = joinPath(contextRoot, (isRecord(build) ? asString(build.dockerfile) : undefined) ?? "Dockerfile");
+      const dockerfile = joinPath(contextRoot, (isRecord2(build) ? asString(build.dockerfile) : undefined) ?? "Dockerfile");
       const dfDir = dirname6(dockerfile);
       const projectDir = dfDir !== contextRoot && isUnder2(dfDir, contextRoot) && ctx.files.some((f) => dirname6(f.path) === dfDir && PROJECT_MANIFEST.test(basename3(f.path)));
       const root = projectDir ? dfDir : contextRoot;
@@ -11240,7 +11334,7 @@ function composeServices(ctx, file, byRoot, contributions, relocated) {
         else if (contribution.entry)
           runtime.entrypoints = runtime.entrypoints.filter((e) => e !== contribution.entry);
       }
-      const target = isRecord(build) ? asString(build.target)?.toLowerCase() : undefined;
+      const target = isRecord2(build) ? asString(build.target)?.toLowerCase() : undefined;
       const targetStage = target ? contribution?.df.stages[target] : undefined;
       if (targetStage) {
         const lang = languageFromImage(targetStage.base);
@@ -11277,7 +11371,7 @@ function composeServices(ctx, file, byRoot, contributions, relocated) {
           const [k, ...v] = item.split("=");
           pairs.push([k, v.length > 0 ? v.join("=") : undefined]);
         }
-    } else if (isRecord(env)) {
+    } else if (isRecord2(env)) {
       for (const [k, v] of Object.entries(env))
         pairs.push([k, v === null || v === undefined ? undefined : String(v)]);
     }
@@ -11396,16 +11490,16 @@ function knativeServices(ctx, file, runtime) {
   }
   for (const doc of Array.isArray(docs) ? docs : [docs]) {
     const json = doc.toJS?.();
-    if (!isRecord(json) || json.kind !== "Service")
+    if (!isRecord2(json) || json.kind !== "Service")
       continue;
-    const spec = isRecord(json.spec) && isRecord(json.spec.template) && isRecord(json.spec.template.spec) ? json.spec.template.spec : {};
+    const spec = isRecord2(json.spec) && isRecord2(json.spec.template) && isRecord2(json.spec.template.spec) ? json.spec.template.spec : {};
     for (const container of asArray(spec.containers)) {
-      if (!isRecord(container))
+      if (!isRecord2(container))
         continue;
       const strings = (v) => asArray(v).filter((c) => typeof c === "string");
       const cmd = strings(container.command);
       const args = strings(container.args);
-      const name = isRecord(json.metadata) ? asString(json.metadata.name) ?? "service" : "service";
+      const name = isRecord2(json.metadata) ? asString(json.metadata.name) ?? "service" : "service";
       const entry = { name, trigger: "http" };
       const image = asString(container.image);
       if (image)
@@ -11421,7 +11515,7 @@ function knativeServices(ctx, file, runtime) {
       }
       runtime.entrypoints.push(entry);
       for (const env of asArray(container.env)) {
-        if (isRecord(env) && typeof env.name === "string") {
+        if (isRecord2(env) && typeof env.name === "string") {
           ctx.env.push({ name: env.name, source: `${file.path} env`, value: asString(env.value), evidence: { path: file.path, line: findLine(file.text, new RegExp(`name:\\s*${escapeRe(env.name)}\\b`)), detector: DETECTOR8 } });
         }
       }
@@ -11498,18 +11592,18 @@ function detectGcp(input, roots) {
     if (basename3(file.path) !== "firebase.json")
       continue;
     const json = parseJsonLoose(file.text);
-    if (!isRecord(json) || json.functions === undefined)
+    if (!isRecord2(json) || json.functions === undefined)
       continue;
     const entries = Array.isArray(json.functions) ? json.functions : [json.functions];
     for (const fn of entries) {
-      const source = isRecord(fn) ? asString(fn.source) ?? "functions" : "functions";
+      const source = isRecord2(fn) ? asString(fn.source) ?? "functions" : "functions";
       const root = joinPath(dirname6(file.path), source);
       const rt = get(root, file.path, "gcp_cloud_functions");
       rt.evidence.unshift(evidenceAt(file.path, file.text, findLine(file.text, /"functions"/), `${DETECTOR8}.firebase`));
     }
   }
   for (const pkg of input.packageJsons) {
-    const scripts = isRecord(pkg.json.scripts) ? pkg.json.scripts : {};
+    const scripts = isRecord2(pkg.json.scripts) ? pkg.json.scripts : {};
     for (const [script, cmd] of Object.entries(scripts)) {
       if (typeof cmd !== "string" || !/functions-framework/.test(cmd))
         continue;
@@ -11656,7 +11750,7 @@ function detectAzure(input) {
     if (basename3(hostFile.path) !== "host.json")
       continue;
     const host = parseJsonLoose(hostFile.text);
-    if (!isRecord(host) || host.version !== undefined && !String(host.version).startsWith("2"))
+    if (!isRecord2(host) || host.version !== undefined && !String(host.version).startsWith("2"))
       continue;
     const root = dirname6(hostFile.path);
     const runtime = newRuntime("azure_functions", root, [hostFile.path], [evidenceAt(hostFile.path, hostFile.text, findLine(hostFile.text, /version/), DETECTOR9)], 0.9);
@@ -11678,7 +11772,7 @@ function detectAzure(input) {
     if (settings) {
       runtime.configFiles.push(settings.path);
       const json = parseJsonLoose(settings.text);
-      const values = isRecord(json) && isRecord(json.Values) ? json.Values : {};
+      const values = isRecord2(json) && isRecord2(json.Values) ? json.Values : {};
       for (const name of Object.keys(values).sort()) {
         ctx.env.push({ name, source: `${settings.path} Values`, value: asString(values[name]), evidence: evidenceAt(settings.path, settings.text, findLine(settings.text, new RegExp(`"${escapeRe(name)}"`)), DETECTOR9) });
       }
@@ -11705,12 +11799,12 @@ function detectAzure(input) {
 }
 function handleFunctionJson(file, runtime, addDep) {
   const json = parseJsonLoose(file.text);
-  if (!isRecord(json))
+  if (!isRecord2(json))
     return;
   const fnName = basename3(dirname6(file.path));
   let trigger = "unknown";
   for (const b of asArray(json.bindings)) {
-    if (!isRecord(b))
+    if (!isRecord2(b))
       continue;
     const raw = asString(b.type) ?? "";
     const type = azureBindingType(raw);
@@ -11857,8 +11951,8 @@ function detectProcesses(input, roots) {
   const map = new Map;
   for (const pkg of packageJsons) {
     const json = pkg.json;
-    const deps = { ...isRecord(json.dependencies) ? json.dependencies : {} };
-    const scripts = isRecord(json.scripts) ? json.scripts : {};
+    const deps = { ...isRecord2(json.dependencies) ? json.dependencies : {} };
+    const scripts = isRecord2(json.scripts) ? json.scripts : {};
     const bin = json.bin;
     const server = Object.keys(deps).some((d) => SERVER_NPM.has(d));
     const agent = Object.keys(deps).some((d) => AGENT_NPM.has(d));
@@ -11878,7 +11972,7 @@ function detectProcesses(input, roots) {
       addEntry(rt, { name: "start", command: shellCommand(start), trigger });
     if (typeof bin === "string")
       addEntry(rt, { name: asString(json.name) ?? "bin", handler: joinPath(pkg.root, bin), command: ["node", joinPath(bin)], trigger: "cli" });
-    else if (isRecord(bin))
+    else if (isRecord2(bin))
       for (const [name, target] of Object.entries(bin)) {
         if (typeof target === "string")
           addEntry(rt, { name, handler: joinPath(pkg.root, target), command: ["node", joinPath(target)], trigger: "cli" });
@@ -11976,10 +12070,10 @@ function pyprojectScripts(file, map) {
   } catch {
     return;
   }
-  const project = isRecord(doc.project) ? doc.project : {};
-  const tool = isRecord(doc.tool) ? doc.tool : {};
-  const poetry = isRecord(tool.poetry) ? tool.poetry : {};
-  const scripts = { ...isRecord(poetry.scripts) ? poetry.scripts : {}, ...isRecord(project.scripts) ? project.scripts : {} };
+  const project = isRecord2(doc.project) ? doc.project : {};
+  const tool = isRecord2(doc.tool) ? doc.tool : {};
+  const poetry = isRecord2(tool.poetry) ? tool.poetry : {};
+  const scripts = { ...isRecord2(poetry.scripts) ? poetry.scripts : {}, ...isRecord2(project.scripts) ? project.scripts : {} };
   const names = Object.keys(scripts).sort();
   if (names.length === 0)
     return;
@@ -11994,16 +12088,16 @@ function pyprojectScripts(file, map) {
 }
 function langgraph(file, map) {
   const json = parseJsonLoose(file.text);
-  if (!isRecord(json))
+  if (!isRecord2(json))
     return;
   const root = dirname6(file.path);
-  const graphs = isRecord(json.graphs) ? json.graphs : {};
+  const graphs = isRecord2(json.graphs) ? json.graphs : {};
   const isJs = Object.values(graphs).some((g) => typeof g === "string" && /\.[cm]?[jt]s:/.test(g));
   const rt = upsert(map, isJs ? "node_process" : "python_process", root, file.path);
   rt.frameworks = [...new Set([...rt.frameworks ?? [], "langgraph"])].sort();
   for (const name of Object.keys(graphs).sort()) {
     const ref = graphs[name];
-    const spec = typeof ref === "string" ? ref : isRecord(ref) ? asString(ref.path) : undefined;
+    const spec = typeof ref === "string" ? ref : isRecord2(ref) ? asString(ref.path) : undefined;
     if (!spec)
       continue;
     const [p2, attr] = spec.split(":");
@@ -12149,10 +12243,10 @@ function detectVercel(input) {
   const { ctx, packageJsons } = input;
   const roots = new Map;
   for (const pkg of packageJsons) {
-    const deps = { ...isRecord(pkg.json.dependencies) ? pkg.json.dependencies : {}, ...isRecord(pkg.json.devDependencies) ? pkg.json.devDependencies : {} };
+    const deps = { ...isRecord2(pkg.json.dependencies) ? pkg.json.dependencies : {}, ...isRecord2(pkg.json.devDependencies) ? pkg.json.devDependencies : {} };
     if (!("next" in deps))
       continue;
-    const scripts = isRecord(pkg.json.scripts) ? pkg.json.scripts : {};
+    const scripts = isRecord2(pkg.json.scripts) ? pkg.json.scripts : {};
     const start = asString(scripts.start) ?? asString(scripts.dev);
     roots.set(pkg.root, { configFiles: [pkg.path], next: true, start: start ? splitCommand(start) : undefined });
   }
@@ -12207,8 +12301,8 @@ function detectVercel(input) {
     }
     if (info.vercelJson) {
       const json = parseJsonLoose(info.vercelJson.text);
-      for (const cron of isRecord(json) ? asArray(json.crons) : []) {
-        if (isRecord(cron) && typeof cron.path === "string")
+      for (const cron of isRecord2(json) ? asArray(json.crons) : []) {
+        if (isRecord2(cron) && typeof cron.path === "string")
           runtime.entrypoints.push({ name: `cron ${asString(cron.schedule) ?? ""} ${cron.path}`.trim(), handler: cron.path, trigger: "cron" });
       }
     }
@@ -12248,7 +12342,7 @@ function readOptions(cfg, paths2, read, depth = 0) {
   if (depth > 8 || !paths2.has(cfg))
     return null;
   const json = parseJsonLoose(read(cfg) ?? "");
-  if (!isRecord(json))
+  if (!isRecord2(json))
     return null;
   const dir = dirname6(cfg);
   const merged = {};
@@ -12261,10 +12355,10 @@ function readOptions(cfg, paths2, read, depth = 0) {
     if (parent?.paths !== undefined)
       merged.paths = parent.paths;
   }
-  const opts = isRecord(json.compilerOptions) ? json.compilerOptions : {};
+  const opts = isRecord2(json.compilerOptions) ? json.compilerOptions : {};
   if (typeof opts.baseUrl === "string")
     merged.baseUrl = joinPath(dir, opts.baseUrl);
-  if (isRecord(opts.paths)) {
+  if (isRecord2(opts.paths)) {
     merged.paths = {
       base: typeof opts.baseUrl === "string" ? joinPath(dir, opts.baseUrl) : merged.baseUrl ?? dir,
       list: Object.entries(opts.paths).map(([key, value]) => {
@@ -12318,17 +12412,17 @@ function exportTargets(value) {
     return [value];
   if (Array.isArray(value))
     return value.flatMap(exportTargets);
-  if (isRecord(value))
+  if (isRecord2(value))
     return Object.values(value).flatMap(exportTargets);
   return [];
 }
 function packageEntry(dir, sub, paths2, read) {
   const json = parseJsonLoose(read(joinPath(dir, "package.json")) ?? "");
   const fields = [];
-  if (isRecord(json)) {
+  if (isRecord2(json)) {
     const exp = json.exports;
     const key = sub ? `./${sub}` : ".";
-    if (isRecord(exp) && Object.keys(exp).some((k) => k.startsWith("."))) {
+    if (isRecord2(exp) && Object.keys(exp).some((k) => k.startsWith("."))) {
       if (exp[key] !== undefined)
         fields.push(...exportTargets(exp[key]));
       else {
@@ -12367,7 +12461,7 @@ function packageImportTargets(spec, from, paths2, read) {
     const manifest = joinPath(d, "package.json");
     if (paths2.has(manifest)) {
       const json = parseJsonLoose(read(manifest) ?? "");
-      const imports = isRecord(json) && isRecord(json.imports) ? json.imports : undefined;
+      const imports = isRecord2(json) && isRecord2(json.imports) ? json.imports : undefined;
       if (imports) {
         const targets = [];
         if (imports[spec] !== undefined)
@@ -12643,14 +12737,14 @@ var ANCESTOR_ORM = [
 var CODE_FILE2 = /\.(?:[cm]?[jt]sx?|py)$/;
 function pyDependencyNames(doc) {
   const out = [];
-  const project = isRecord(doc.project) ? doc.project : {};
+  const project = isRecord2(doc.project) ? doc.project : {};
   for (const req of asArray(project.dependencies)) {
     const m = typeof req === "string" ? /^\s*([A-Za-z0-9][\w.-]*)/.exec(req) : null;
     if (m)
       out.push(m[1]);
   }
-  const poetry = isRecord(doc.tool) && isRecord(doc.tool.poetry) ? doc.tool.poetry : {};
-  if (isRecord(poetry.dependencies))
+  const poetry = isRecord2(doc.tool) && isRecord2(doc.tool.poetry) ? doc.tool.poetry : {};
+  if (isRecord2(poetry.dependencies))
     out.push(...Object.keys(poetry.dependencies));
   return out.map(pyName);
 }
@@ -12661,7 +12755,7 @@ function npmDeps(json) {
   const out = [];
   for (const field of ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"]) {
     const deps = json[field];
-    if (isRecord(deps))
+    if (isRecord2(deps))
       out.push(...Object.keys(deps));
   }
   return out;
@@ -12680,7 +12774,7 @@ function directDeps(dir, byPath, npmNames, pyNames, goModules, workspaces) {
   const pkg = byPath.get(joinPath(dir, "package.json"));
   if (pkg) {
     const json = parseJsonLoose(pkg.text);
-    if (isRecord(json)) {
+    if (isRecord2(json)) {
       for (const name of npmDeps(json)) {
         const target = npmNames.get(name);
         if (target !== undefined)
@@ -12690,11 +12784,11 @@ function directDeps(dir, byPath, npmNames, pyNames, goModules, workspaces) {
   }
   const pyproject = tomlDoc(byPath.get(joinPath(dir, "pyproject.toml")));
   if (pyproject) {
-    const tool = isRecord(pyproject.tool) ? pyproject.tool : {};
-    const uv = isRecord(tool.uv) ? tool.uv : {};
-    const sources = isRecord(uv.sources) ? uv.sources : {};
+    const tool = isRecord2(pyproject.tool) ? pyproject.tool : {};
+    const uv = isRecord2(tool.uv) ? tool.uv : {};
+    const sources = isRecord2(uv.sources) ? uv.sources : {};
     for (const [name, src] of Object.entries(sources)) {
-      if (!isRecord(src))
+      if (!isRecord2(src))
         continue;
       if (src.workspace === true) {
         const target = pyNames.get(pyName(name));
@@ -12714,13 +12808,13 @@ function directDeps(dir, byPath, npmNames, pyNames, goModules, workspaces) {
           out.push(target);
       }
     }
-    const poetry = isRecord(tool.poetry) ? tool.poetry : {};
-    const groups = [poetry.dependencies, ...isRecord(poetry.group) ? Object.values(poetry.group).map((g) => isRecord(g) ? g.dependencies : undefined) : []];
+    const poetry = isRecord2(tool.poetry) ? tool.poetry : {};
+    const groups = [poetry.dependencies, ...isRecord2(poetry.group) ? Object.values(poetry.group).map((g) => isRecord2(g) ? g.dependencies : undefined) : []];
     for (const deps of groups) {
-      if (!isRecord(deps))
+      if (!isRecord2(deps))
         continue;
       for (const spec of Object.values(deps)) {
-        const path = isRecord(spec) ? asString(spec.path) : undefined;
+        const path = isRecord2(spec) ? asString(spec.path) : undefined;
         if (path)
           out.push(joinPath(dir, path));
       }
@@ -12760,13 +12854,13 @@ function directDeps(dir, byPath, npmNames, pyNames, goModules, workspaces) {
   return out;
 }
 function composeBuildsUnder(svc, base, root) {
-  if (!isRecord(svc) || svc.build === undefined)
+  if (!isRecord2(svc) || svc.build === undefined)
     return false;
   const build = svc.build;
-  const context = joinPath(base, typeof build === "string" ? build : isRecord(build) ? asString(build.context) ?? "." : ".");
+  const context = joinPath(base, typeof build === "string" ? build : isRecord2(build) ? asString(build.context) ?? "." : ".");
   if (isUnder2(context, root))
     return true;
-  const dockerfile = isRecord(build) ? asString(build.dockerfile) : undefined;
+  const dockerfile = isRecord2(build) ? asString(build.dockerfile) : undefined;
   return dockerfile !== undefined && isUnder2(joinPath(context, dockerfile), root);
 }
 function computeScope(files, root) {
@@ -12780,12 +12874,12 @@ function computeScope(files, root) {
     const name = basename3(f.path);
     if (name === "package.json") {
       const json = parseJsonLoose(f.text);
-      if (isRecord(json) && typeof json.name === "string")
+      if (isRecord2(json) && typeof json.name === "string")
         npmNames.set(json.name, dirname6(f.path));
     } else if (name === "pyproject.toml") {
       const doc = tomlDoc(f);
-      const project = doc && isRecord(doc.project) ? doc.project : undefined;
-      const poetry = doc && isRecord(doc.tool) && isRecord(doc.tool.poetry) ? doc.tool.poetry : undefined;
+      const project = doc && isRecord2(doc.project) ? doc.project : undefined;
+      const poetry = doc && isRecord2(doc.tool) && isRecord2(doc.tool.poetry) ? doc.tool.poetry : undefined;
       const projectName = asString(project?.name) ?? asString(poetry?.name);
       if (projectName)
         pyNames.set(pyName(projectName), dirname6(f.path));
@@ -12800,16 +12894,16 @@ function computeScope(files, root) {
     if (basename3(f.path) !== "pyproject.toml")
       continue;
     const doc = tomlDoc(f);
-    const uv = doc && isRecord(doc.tool) && isRecord(doc.tool.uv) ? doc.tool.uv : undefined;
-    if (!uv || !isRecord(uv.workspace))
+    const uv = doc && isRecord2(doc.tool) && isRecord2(doc.tool.uv) ? doc.tool.uv : undefined;
+    if (!uv || !isRecord2(uv.workspace))
       continue;
     const base = dirname6(f.path);
     const members = asArray(uv.workspace.members).filter((m) => typeof m === "string").map((m) => globRegex(joinPath(base, m)));
     if (!members.some((re) => re.test(root) || [...pyNames.values()].some((d) => isUnder2(root, d) && re.test(d))))
       continue;
     const sources = new Map;
-    for (const [name, src] of Object.entries(isRecord(uv.sources) ? uv.sources : {})) {
-      if (!isRecord(src))
+    for (const [name, src] of Object.entries(isRecord2(uv.sources) ? uv.sources : {})) {
+      if (!isRecord2(src))
         continue;
       const target = src.workspace === true ? pyNames.get(pyName(name)) : asString(src.path) ? joinPath(base, asString(src.path)) : undefined;
       if (target !== undefined)
@@ -12875,7 +12969,7 @@ function computeScope(files, root) {
     const rel2 = base === "." ? root : root.slice(base.length + 1);
     if (/compose/.test(name)) {
       const doc = loadYaml(f.text);
-      const services = isRecord(doc) && isRecord(doc.services) ? doc.services : {};
+      const services = isRecord2(doc) && isRecord2(doc.services) ? doc.services : {};
       if (Object.values(services).some((svc) => composeBuildsUnder(svc, base, root)))
         configs.add(f.path);
     } else if (new RegExp(`(?:^|[\\s"'=:/])\\.?/?${rel2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:[/"'\\s]|$)`, "m").test(f.text)) {
@@ -12984,8 +13078,8 @@ function scopeComposeImages(ctx, scope) {
     if (base === scope.root)
       continue;
     const doc = loadYaml(f.text);
-    const services = isRecord(doc) && isRecord(doc.services) ? Object.values(doc.services) : [];
-    const builds = services.some((svc) => isRecord(svc) && svc.build !== undefined);
+    const services = isRecord2(doc) && isRecord2(doc.services) ? Object.values(doc.services) : [];
+    const builds = services.some((svc) => isRecord2(svc) && svc.build !== undefined);
     if (!builds)
       optional.add(f.path);
   }
@@ -12999,14 +13093,14 @@ function scopeComposeImages(ctx, scope) {
     if (!/compose/.test(basename3(path)))
       continue;
     const doc = loadYaml(ctx.byPath.get(path)?.text ?? "");
-    const services = isRecord(doc) && isRecord(doc.services) ? doc.services : {};
+    const services = isRecord2(doc) && isRecord2(doc.services) ? doc.services : {};
     const base = path.includes("/") ? path.slice(0, path.lastIndexOf("/")) : ".";
     const deps = new Set;
     let declared = false;
     for (const svc of Object.values(services)) {
-      if (!isRecord(svc) || !composeBuildsUnder(svc, base, scope.root))
+      if (!isRecord2(svc) || !composeBuildsUnder(svc, base, scope.root))
         continue;
-      const names = [...Array.isArray(svc.depends_on) ? svc.depends_on : isRecord(svc.depends_on) ? Object.keys(svc.depends_on) : [], ...Array.isArray(svc.links) ? svc.links : []];
+      const names = [...Array.isArray(svc.depends_on) ? svc.depends_on : isRecord2(svc.depends_on) ? Object.keys(svc.depends_on) : [], ...Array.isArray(svc.links) ? svc.links : []];
       for (const n of names)
         if (typeof n === "string") {
           declared = true;
@@ -13140,7 +13234,7 @@ function scriptLocalFilter(ctx, runtimes) {
 }
 function lifecycleScripts(text) {
   const json = parseJsonLoose(text);
-  const scripts = new Map(Object.entries(isRecord(json) && isRecord(json.scripts) ? json.scripts : {}).filter((e) => typeof e[1] === "string"));
+  const scripts = new Map(Object.entries(isRecord2(json) && isRecord2(json.scripts) ? json.scripts : {}).filter((e) => typeof e[1] === "string"));
   const selected = new Set([...scripts.keys()].filter((name) => /^(?:pre|post)?(?:start|serve|build|install|prepare)(?::[\w:-]+)?$/.test(name)));
   const queue = [...selected];
   while (queue.length > 0) {
@@ -13474,7 +13568,7 @@ function detectDependencies(input) {
 }
 
 // ../../packages/harness-bundle/src/register/harness-digest.ts
-import { createHash as createHash4 } from "node:crypto";
+import { createHash as createHash5 } from "node:crypto";
 import { readFileSync as readFileSync7 } from "node:fs";
 import { join as join7 } from "node:path";
 
@@ -13550,7 +13644,7 @@ function harnessFiles(manifest, map, read) {
         if (basename3(p2) !== "package.json")
           continue;
         const json = parseJsonLoose(read(p2) ?? "");
-        if (isRecord(json) && typeof json.name === "string")
+        if (isRecord2(json) && typeof json.name === "string")
           workspacePackages.set(json.name, dirname6(p2));
       }
       for (const f of importClosure({ entries, paths: paths2, read, workspacePackages }).files)
@@ -13578,7 +13672,7 @@ function harnessDigest(manifest, map, filesDir) {
   };
   const byPath = new Map(manifest.files.map((f) => [f.path, f]));
   const links = new Map(manifest.files.flatMap((f) => f.symlinkTarget !== undefined ? [[f.path, f.symlinkTarget]] : []));
-  const hash = createHash4("sha256");
+  const hash = createHash5("sha256");
   hash.update(JSON.stringify({
     v: 1,
     detector: DETECTOR_VERSION,
@@ -13628,10 +13722,10 @@ function wranglerAssetDirs(configPath, text) {
       raw.push(m[1]);
   } else {
     const json = parseJsonLoose(text);
-    if (isRecord(json)) {
-      if (isRecord(json.assets) && typeof json.assets.directory === "string")
+    if (isRecord2(json)) {
+      if (isRecord2(json.assets) && typeof json.assets.directory === "string")
         raw.push(json.assets.directory);
-      if (isRecord(json.site) && typeof json.site.bucket === "string")
+      if (isRecord2(json.site) && typeof json.site.bucket === "string")
         raw.push(json.site.bucket);
     }
   }
@@ -13711,7 +13805,7 @@ function insideCheckout(dir) {
   }
 }
 async function digestFile(path) {
-  const hash = createHash5("sha256");
+  const hash = createHash6("sha256");
   await new Promise((resolve7, reject) => {
     createReadStream(path).on("data", (chunk) => hash.update(chunk)).on("error", reject).on("end", () => resolve7());
   });
@@ -14207,7 +14301,7 @@ function formatBytes(bytes) {
 }
 
 // src/harness-prompt-sources.ts
-import { createHash as createHash6 } from "node:crypto";
+import { createHash as createHash7 } from "node:crypto";
 import { extname as extname5 } from "node:path";
 
 // src/prompt-source-verification/index.ts
@@ -14777,7 +14871,7 @@ function normalizeUsage(reviewed, endpointVerified, reviewedConsumerCited = fals
 
 // src/harness-prompt-sources.ts
 var CODE2 = new Set([".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".py"]);
-var shortHash = (text) => createHash6("sha256").update(text).digest("hex").slice(0, 20);
+var shortHash = (text) => createHash7("sha256").update(text).digest("hex").slice(0, 20);
 var TEST_PATH3 = /(^|\/)(?:test|tests|__tests__|fixtures?|test-fixtures)(?:[_-]|\/|$)|\.(?:test|spec)\.[^.]+$/i;
 var MAX_CODE_PROMPT_PATHS = 64;
 var identity = (source) => JSON.stringify([source.path, source.selector ?? null]);
@@ -15825,23 +15919,6 @@ function unresolvedReports(resolution, sites) {
 function promptArtifactsFromCallSites(callSites, context, promoted, options = {}) {
   return assemblePromptArtifacts(resolvePromptArguments(callSites, context, options), callSites, promoted, options);
 }
-
-// src/harness-sync-limits.ts
-var MAX_HARNESS_SYNC_GRAPH_BYTES = 2000000;
-function assertHarnessGraphSyncSize(graph) {
-  if (!graph || typeof graph !== "object" || Array.isArray(graph)) {
-    throw new CliInputError("Harness graph must be an object before sync.");
-  }
-  const graphBytes = Buffer.byteLength(JSON.stringify(graph), "utf8");
-  if (graphBytes > MAX_HARNESS_SYNC_GRAPH_BYTES) {
-    throw new CliInputError(`Harness graph is too large to sync (${graphBytes.toLocaleString()} bytes; limit ${MAX_HARNESS_SYNC_GRAPH_BYTES.toLocaleString()}).`, [
-      "Run `moda harness analyze --path=<agent-dir>` to narrow the harness root.",
-      "Reduce captured prompt/tool bodies if the graph grew too large.",
-      "Split multiple agent roots into separate harness syncs per tenant."
-    ].join(`
-`));
-  }
-}
 // src/harness.ts
 var MODA_DIR = ".moda";
 var HARNESS_PATH = join12(MODA_DIR, "harness.json");
@@ -15875,6 +15952,7 @@ var HARNESS_FAMILY_FLAGS = [
   "remote",
   "repair",
   "report",
+  "require-full-bodies",
   "run",
   "run-id",
   "shards",
@@ -16159,7 +16237,7 @@ async function runHarnessCommand(context) {
         throw new CliInputError("Focused remote prompt analysis is not supported yet.", "Use local --analyst=claude|codex|cursor|local-scan, or drop --concern for a full remote report.");
       }
       if (context.flags["github-actions"] === "true") {
-        const { runGithubActionsAnalyze } = await import("./harness-github-actions-18v41647.js");
+        const { runGithubActionsAnalyze } = await import("./harness-github-actions-9a48sd2r.js");
         const result = await runGithubActionsAnalyze(rootDir, {
           writeReport: (report2) => {
             const normalized = normalizeHarnessReport(report2);
@@ -16310,8 +16388,8 @@ async function runHarnessCommand(context) {
         }
         const { artifacts, unknowns, canonicalAgentIdentities } = deterministicGraphItems(rootDir, promote === "all" ? undefined : promote);
         tagComponentStatus({ runtimeAgents: [], artifacts }, rootDir);
-        const { extractHarnessWithContext: extractHarnessWithContext2 } = await import("./index-rdzd700n.js");
-        const { enumerateHarnessComponents, mergeEnumeratedComponents } = await import("./index-g3zsqcjg.js");
+        const { extractHarnessWithContext: extractHarnessWithContext2 } = await import("./index-t4fncjwa.js");
+        const { enumerateHarnessComponents, mergeEnumeratedComponents } = await import("./index-5q79y09b.js");
         let components = { runtimeAgents: [], artifacts: [], warnings: [] };
         if (promote === "all" || promote === "topology" || promote === "tools") {
           const { result, ctx } = extractHarnessWithContext2(rootDir);
@@ -16377,8 +16455,8 @@ async function runHarnessCommand(context) {
     }
     case "extract": {
       writeHumanProgress(context, "Harness extract: tracing model call sites (no LLM, no network)...");
-      const { extractHarnessWithContext: extractHarnessWithContext2, serializeExtractResult } = await import("./index-rdzd700n.js");
-      const { enumerateHarnessComponents, mergeEnumeratedComponents } = await import("./index-g3zsqcjg.js");
+      const { extractHarnessWithContext: extractHarnessWithContext2, serializeExtractResult } = await import("./index-t4fncjwa.js");
+      const { enumerateHarnessComponents, mergeEnumeratedComponents } = await import("./index-5q79y09b.js");
       const { result, ctx } = extractHarnessWithContext2(rootDir, { fresh: true });
       const items = deterministicGraphItems(rootDir);
       const artifacts = items.artifacts;
@@ -16873,7 +16951,7 @@ function reportJsonCandidates(output) {
 function parseHarnessReportCandidate(candidate) {
   try {
     const parsed = JSON.parse(candidate.trim());
-    if (isRecord2(parsed) && parsed.schemaVersion === "harness_report.v0.1") {
+    if (isRecord3(parsed) && parsed.schemaVersion === "harness_report.v0.1") {
       return parsed;
     }
   } catch {
@@ -17180,7 +17258,7 @@ function repairExternalAnalystReport(report, rootDir, options = {}) {
       ];
       if (owners.some((owner) => knownAgents.has(owner)))
         continue;
-      const id = `unresolved_tool_owner_${createHash7("sha256").update(artifact2.id).digest("hex").slice(0, 16)}`;
+      const id = `unresolved_tool_owner_${createHash8("sha256").update(artifact2.id).digest("hex").slice(0, 16)}`;
       if (!normalized.graph.unknowns.some((unknown) => unknown.id === id))
         normalized.graph.unknowns.push({
           id,
@@ -17285,8 +17363,8 @@ var CONCERN_PROMOTED_ARTIFACT_TYPES = {
   evals: new Set(["model_config", "eval"])
 };
 async function deterministicFloorGraph(rootDir, options = {}) {
-  const { extractHarnessWithContext: extractHarnessWithContext2 } = await import("./index-rdzd700n.js");
-  const { enumerateHarnessComponents, mergeEnumeratedComponents } = await import("./index-g3zsqcjg.js");
+  const { extractHarnessWithContext: extractHarnessWithContext2 } = await import("./index-t4fncjwa.js");
+  const { enumerateHarnessComponents, mergeEnumeratedComponents } = await import("./index-5q79y09b.js");
   const { result, ctx } = extractHarnessWithContext2(rootDir);
   const items = deterministicGraphItems(rootDir);
   const components = mergeEnumeratedComponents(items.artifacts, enumerateHarnessComponents(result, ctx));
@@ -17440,7 +17518,7 @@ function mergeDeterministicArtifacts(graph, rootDir, options = {}) {
   }
   const extracted = !allowedTypes || allowedTypes.has("model_config") ? extractedModelItems(rootDir) : { artifacts: [], unknowns: [], rewritten: new Set, enabled: false };
   promoted = withExtractedModels(promoted, extracted, rootDir);
-  if (extracted.enabled && isRecord2(graph.scan)) {
+  if (extracted.enabled && isRecord3(graph.scan)) {
     try {
       const { literals, truncated } = collectModelLiterals(rootDir);
       const scan = graph.scan;
@@ -17564,7 +17642,7 @@ function remapCanonicalArtifactAgents(graph, artifacts = graph.artifacts, dropUn
   }
   for (const [agentId, artifactIds] of unresolved) {
     const identity2 = canonical.get(agentId);
-    const id = `unresolved_agent_links_${createHash7("sha256").update(agentId).digest("hex").slice(0, 16)}`;
+    const id = `unresolved_agent_links_${createHash8("sha256").update(agentId).digest("hex").slice(0, 16)}`;
     if (graph.unknowns.some((unknown) => unknown.id === id))
       continue;
     graph.unknowns.push({
@@ -17853,18 +17931,18 @@ function extractAgentTextFromOutput(output) {
 `);
 }
 function extractTextFromAgentEvent(event) {
-  if (!isRecord2(event))
+  if (!isRecord3(event))
     return;
   const directText = stringValue(event.text) ?? stringValue(event.message) ?? stringValue(event.delta) ?? stringValue(event.result);
   if (directText)
     return directText;
-  const message = isRecord2(event.message) ? event.message : undefined;
+  const message = isRecord3(event.message) ? event.message : undefined;
   const messageText = message ? stringValue(message.text) ?? stringValue(message.content) : undefined;
   if (messageText)
     return messageText;
   const content = Array.isArray(message?.content) ? message.content : Array.isArray(event.content) ? event.content : [];
   const textParts = content.map((part) => {
-    if (!isRecord2(part))
+    if (!isRecord3(part))
       return;
     return stringValue(part.text) ?? stringValue(part.content);
   }).filter((part) => Boolean(part));
@@ -18102,9 +18180,9 @@ function formatExternalAgentDisplayEvent(event, adapter) {
 `;
 }
 function extractAgentEventTelemetry(event) {
-  const message = isRecord2(event.message) ? event.message : undefined;
-  const usage = isRecord2(event.usage) ? event.usage : isRecord2(message?.usage) ? message.usage : undefined;
-  const modelUsage = isRecord2(event.modelUsage) ? event.modelUsage : undefined;
+  const message = isRecord3(event.message) ? event.message : undefined;
+  const usage = isRecord3(event.usage) ? event.usage : isRecord3(message?.usage) ? message.usage : undefined;
+  const modelUsage = isRecord3(event.modelUsage) ? event.modelUsage : undefined;
   const model = stringValue(event.model) ?? stringValue(message?.model) ?? (modelUsage ? Object.keys(modelUsage)[0] : undefined);
   const durationValue = (value) => typeof value === "number" && Number.isFinite(value) ? value : undefined;
   const durationMs = durationValue(event.duration_ms) ?? durationValue(event.durationMs) ?? durationValue(event.duration_api_ms);
@@ -18118,7 +18196,7 @@ function extractAgentEventTelemetry(event) {
 }
 function parseExternalAgentEvent(event) {
   const body = parseExternalAgentEventBody(event);
-  if (!isRecord2(event))
+  if (!isRecord3(event))
     return body;
   const telemetry = extractAgentEventTelemetry(event);
   if (!telemetry)
@@ -18130,10 +18208,10 @@ function parseExternalAgentEvent(event) {
   return { kind: "system", message: "usage update", telemetryOnly: true, ...telemetry };
 }
 function parseExternalAgentEventBody(event) {
-  if (!isRecord2(event))
+  if (!isRecord3(event))
     return { kind: "agent_text", message: truncateText(String(event), 500) };
-  const msg = isRecord2(event.msg) ? event.msg : undefined;
-  const call = isRecord2(event.call) ? event.call : undefined;
+  const msg = isRecord3(event.msg) ? event.msg : undefined;
+  const call = isRecord3(event.call) ? event.call : undefined;
   const type = stringValue(event.type) ?? stringValue(event.event) ?? stringValue(msg?.type);
   const subtype = stringValue(event.subtype);
   if (type === "rate_limit_event")
@@ -18147,7 +18225,7 @@ function parseExternalAgentEventBody(event) {
   if (directText && !isLowSignalEventType(type)) {
     return { kind: "agent_text", message: truncateText(firstMeaningfulLine(directText), 500) };
   }
-  const message = isRecord2(event.message) ? event.message : undefined;
+  const message = isRecord3(event.message) ? event.message : undefined;
   const messageText = message ? stringValue(message.text) ?? stringValue(message.content) : undefined;
   if (messageText && !isLowSignalEventType(type)) {
     return { kind: "agent_text", message: truncateText(firstMeaningfulLine(messageText), 500) };
@@ -18168,7 +18246,7 @@ function parseExternalAgentEventBody(event) {
   return;
 }
 function parseAgentContentPart(part) {
-  if (!isRecord2(part))
+  if (!isRecord3(part))
     return;
   const partType = stringValue(part.type);
   if (partType === "tool_use" || partType === "tool_call") {
@@ -18190,7 +18268,7 @@ function parseAgentContentPart(part) {
   return;
 }
 function toolInputDetail(input) {
-  if (!isRecord2(input))
+  if (!isRecord3(input))
     return;
   const value = stringValue(input.file_path) ?? stringValue(input.filePath) ?? stringValue(input.path) ?? stringValue(input.notebook_path) ?? stringValue(input.command) ?? stringValue(input.cmd) ?? stringValue(input.pattern) ?? stringValue(input.query);
   return value ? truncateText(firstMeaningfulLine(value), 300) : undefined;
@@ -18208,7 +18286,7 @@ function analystDisplayName(adapter) {
     return "Cursor";
   return "Codex";
 }
-function isRecord2(value) {
+function isRecord3(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function stringValue(value) {
@@ -19284,15 +19362,36 @@ function plannedDryRunRemote(plan) {
   };
 }
 async function syncHarnessWithRemote(context, body) {
-  assertHarnessGraphSyncSize(body.graph);
   const profileOptions = { profile: context.profile, env: context.env };
   const hasApiKey = Boolean(resolveApiKey(profileOptions));
+  const requireFullBodies = context.flags["require-full-bodies"] === "true";
+  const prepared = await prepareHarnessSyncRequest(body, !context.dryRun && hasApiKey ? controlApiArtifactBodyStore((endpoint, init) => callControlAPI(endpoint, init, profileOptions)) : undefined, undefined, undefined, { requireStorable: requireFullBodies });
+  assertHarnessGraphSyncSize(prepared.request.graph);
+  assertHarnessSyncRequestSize({ ...prepared.request, dryRun: context.dryRun });
+  if (prepared.shortened > 0 && context.dryRun) {
+    writeHarnessNotice(context, "The graph is over the sync limit, so its largest bodies are shortened. A dry run uploads none of their full text; the real sync uploads it.");
+  }
+  const bodiesLabel = (count) => `${count} shortened ${count === 1 ? "body" : "bodies"}`;
+  if (prepared.unstorableBodies > 0) {
+    const count = bodiesLabel(prepared.unstorableBodies);
+    if (requireFullBodies) {
+      throw new CliInputError(`${count} ${prepared.unstorableBodies === 1 ? "is" : "are"} over the ${MAX_STORED_ARTIFACT_BODY_BYTES.toLocaleString()}-byte full-body limit and cannot be stored, so nothing was synced (--require-full-bodies).`, "Split the largest artifacts into smaller files, or drop --require-full-bodies to sync with shortened bodies.");
+    }
+    writeHarnessNotice(context, `${count} ${prepared.unstorableBodies === 1 ? "is" : "are"} over the ${MAX_STORED_ARTIFACT_BODY_BYTES.toLocaleString()}-byte full-body limit; the harness syncs with them shortened and their full text is not stored.`);
+  }
+  if (prepared.storeFailed) {
+    const count = bodiesLabel(prepared.storeFailedBodies);
+    if (requireFullBodies) {
+      throw new CliInputError(`Uploading the full text of ${count} failed, so nothing was synced (--require-full-bodies).`, "Rerun `moda harness sync`, or drop --require-full-bodies to sync with shortened bodies.");
+    }
+    writeHarnessNotice(context, `Uploading the full text of ${count} failed; the harness syncs with shortened bodies and their full text is not retrievable yet. Rerun \`moda harness sync\` to upload it (the version does not change).`);
+  }
   if (context.dryRun && !hasApiKey)
     return;
   return await callControlAPI("/harnesses/sync", {
     method: "POST",
     body: JSON.stringify({
-      ...body,
+      ...prepared.request,
       dryRun: context.dryRun
     })
   }, profileOptions);
@@ -21068,7 +21167,7 @@ function normalizePath3(path) {
   return path.split(sep5).join("/");
 }
 function hashText(text) {
-  return createHash7("sha256").update(text).digest("hex");
+  return createHash8("sha256").update(text).digest("hex");
 }
 
 // src/harness-candidates.ts
@@ -22984,7 +23083,7 @@ function capPromotedEvidence(artifact2) {
     artifact2.evidence = artifact2.evidence.slice(0, max);
 }
 function distinctStableId(prefix, raw) {
-  return `${stableId(prefix, raw.replace(/\./g, "-"))}_${createHash8("sha256").update(raw).digest("hex").slice(0, 8)}`;
+  return `${stableId(prefix, raw.replace(/\./g, "-"))}_${createHash9("sha256").update(raw).digest("hex").slice(0, 8)}`;
 }
 function promoteModelIds(occurrences, context) {
   const out = [];
@@ -23841,7 +23940,7 @@ function modelArtifacts(result) {
   return (result.models ?? []).map((model) => {
     const agentIds = [...new Set(model.calledFrom.flatMap((site) => owners.get(site.callSite) ?? []))].sort();
     return {
-      id: `model_config_${slug(model.id)}_${createHash9("sha256").update(model.id).digest("hex").slice(0, 8)}`,
+      id: `model_config_${slug(model.id)}_${createHash10("sha256").update(model.id).digest("hex").slice(0, 8)}`,
       type: "model_config",
       name: model.id,
       scope: agentIds.length === 1 ? "agent" : "shared",