@prodgator/report 3.19.0 → 3.25.0

package/dist/cli.js

@@ -239,10 +239,10 @@ var require_utils = __commonJS({
       REGEX_SPECIAL_CHARS_GLOBAL
     } = require_constants();
     exports2.isObject = (val) => val !== null && typeof val === "object" && !Array.isArray(val);
-    exports2.hasRegexChars = (str) => REGEX_SPECIAL_CHARS.test(str);
-    exports2.isRegexChar = (str) => str.length === 1 && exports2.hasRegexChars(str);
-    exports2.escapeRegex = (str) => str.replace(REGEX_SPECIAL_CHARS_GLOBAL, "\\$1");
-    exports2.toPosixSlashes = (str) => str.replace(REGEX_BACKSLASH, "/");
+    exports2.hasRegexChars = (str2) => REGEX_SPECIAL_CHARS.test(str2);
+    exports2.isRegexChar = (str2) => str2.length === 1 && exports2.hasRegexChars(str2);
+    exports2.escapeRegex = (str2) => str2.replace(REGEX_SPECIAL_CHARS_GLOBAL, "\\$1");
+    exports2.toPosixSlashes = (str2) => str2.replace(REGEX_BACKSLASH, "/");
     exports2.isWindows = () => {
       if (typeof navigator !== "undefined" && navigator.platform) {
         const platform = navigator.platform.toLowerCase();
@@ -253,8 +253,8 @@ var require_utils = __commonJS({
       }
       return false;
     };
-    exports2.removeBackslashes = (str) => {
-      return str.replace(REGEX_REMOVE_BACKSLASH, (match) => {
+    exports2.removeBackslashes = (str2) => {
+      return str2.replace(REGEX_REMOVE_BACKSLASH, (match) => {
         return match === "\\" ? "" : match;
       });
     };
@@ -344,7 +344,7 @@ var require_scan = __commonJS({
       const slashes = [];
       const tokens = [];
       const parts = [];
-      let str = input;
+      let str2 = input;
       let index = -1;
       let start = 0;
       let lastIndex = 0;
@@ -363,10 +363,10 @@ var require_scan = __commonJS({
       let code;
       let token = { value: "", depth: 0, isGlob: false };
       const eos = () => index >= length;
-      const peek = () => str.charCodeAt(index + 1);
+      const peek = () => str2.charCodeAt(index + 1);
       const advance = () => {
         prev = code;
-        return str.charCodeAt(++index);
+        return str2.charCodeAt(++index);
       };
       while (index < length) {
         code = advance();
@@ -543,24 +543,24 @@ var require_scan = __commonJS({
         isExtglob = false;
         isGlob = false;
       }
-      let base = str;
+      let base = str2;
       let prefix = "";
       let glob2 = "";
       if (start > 0) {
-        prefix = str.slice(0, start);
-        str = str.slice(start);
+        prefix = str2.slice(0, start);
+        str2 = str2.slice(start);
         lastIndex -= start;
       }
       if (base && isGlob === true && lastIndex > 0) {
-        base = str.slice(0, lastIndex);
-        glob2 = str.slice(lastIndex);
+        base = str2.slice(0, lastIndex);
+        glob2 = str2.slice(lastIndex);
       } else if (isGlob === true) {
         base = "";
-        glob2 = str;
+        glob2 = str2;
       } else {
-        base = str;
+        base = str2;
       }
-      if (base && base !== "" && base !== "/" && base !== str) {
+      if (base && base !== "" && base !== "/" && base !== str2) {
         if (isPathSeparator(base.charCodeAt(base.length - 1))) {
           base = base.slice(0, -1);
         }
@@ -634,7 +634,7 @@ var require_scan = __commonJS({
 var require_parse = __commonJS({
   "node_modules/picomatch/lib/parse.js"(exports2, module2) {
     "use strict";
-    var constants = require_constants();
+    var constants2 = require_constants();
     var utils = require_utils();
     var {
       MAX_LENGTH,
@@ -642,7 +642,7 @@ var require_parse = __commonJS({
       REGEX_NON_SPECIAL_CHARS,
       REGEX_SPECIAL_CHARS_BACKREF,
       REPLACEMENTS
-    } = constants;
+    } = constants2;
     var expandRange = (args, options) => {
       if (typeof options.expandRange === "function") {
         return options.expandRange(...args, options);
@@ -851,7 +851,7 @@ var require_parse = __commonJS({
       if (options.maxExtglobRecursion === false) {
         return { risky: false };
       }
-      const max = typeof options.maxExtglobRecursion === "number" ? options.maxExtglobRecursion : constants.DEFAULT_MAX_EXTGLOB_RECURSION;
+      const max = typeof options.maxExtglobRecursion === "number" ? options.maxExtglobRecursion : constants2.DEFAULT_MAX_EXTGLOB_RECURSION;
       const branches = splitTopLevel(body).map((branch) => branch.trim());
       if (branches.length > 1) {
         if (branches.some((branch) => branch === "") || branches.some((branch) => /^[*?]+$/.test(branch)) || hasRepeatedCharPrefixOverlap(branches)) {
@@ -897,8 +897,8 @@ var require_parse = __commonJS({
       const bos = { type: "bos", value: "", output: opts.prepend || "" };
       const tokens = [bos];
       const capture = opts.capture ? "" : "?:";
-      const PLATFORM_CHARS = constants.globChars(opts.windows);
-      const EXTGLOB_CHARS = constants.extglobChars(PLATFORM_CHARS);
+      const PLATFORM_CHARS = constants2.globChars(opts.windows);
+      const EXTGLOB_CHARS = constants2.extglobChars(PLATFORM_CHARS);
       const {
         DOT_LITERAL,
         PLUS_LITERAL,
@@ -1275,15 +1275,15 @@ var require_parse = __commonJS({
           }
           let output = ")";
           if (brace.dots === true) {
-            const arr = tokens.slice();
+            const arr2 = tokens.slice();
             const range = [];
-            for (let i = arr.length - 1; i >= 0; i--) {
+            for (let i = arr2.length - 1; i >= 0; i--) {
               tokens.pop();
-              if (arr[i].type === "brace") {
+              if (arr2[i].type === "brace") {
                 break;
               }
-              if (arr[i].type !== "dots") {
-                range.unshift(arr[i].value);
+              if (arr2[i].type !== "dots") {
+                range.unshift(arr2[i].value);
               }
             }
             output = expandRange(range, opts);
@@ -1594,7 +1594,7 @@ var require_parse = __commonJS({
         NO_DOTS_SLASH,
         STAR,
         START_ANCHOR
-      } = constants.globChars(opts.windows);
+      } = constants2.globChars(opts.windows);
       const nodot = opts.dot ? NO_DOTS : NO_DOT;
       const slashDot = opts.dot ? NO_DOTS_SLASH : NO_DOT;
       const capture = opts.capture ? "" : "?:";
@@ -1607,8 +1607,8 @@ var require_parse = __commonJS({
         if (opts2.noglobstar === true) return star;
         return `(${capture}(?:(?!${START_ANCHOR}${opts2.dot ? DOTS_SLASH : DOT_LITERAL}).)*?)`;
       };
-      const create = (str) => {
-        switch (str) {
+      const create = (str2) => {
+        switch (str2) {
           case "*":
             return `${nodot}${ONE_CHAR}${star}`;
           case ".*":
@@ -1626,7 +1626,7 @@ var require_parse = __commonJS({
           case "**/.*":
             return `(?:${nodot}${globstar(opts)}${SLASH_LITERAL})?${DOT_LITERAL}${ONE_CHAR}${star}`;
           default: {
-            const match = /^(.*?)\.(\w+)$/.exec(str);
+            const match = /^(.*?)\.(\w+)$/.exec(str2);
             if (!match) return;
             const source2 = create(match[1]);
             if (!source2) return;
@@ -1652,14 +1652,14 @@ var require_picomatch = __commonJS({
     var scan = require_scan();
     var parse = require_parse();
     var utils = require_utils();
-    var constants = require_constants();
+    var constants2 = require_constants();
     var isObject = (val) => val && typeof val === "object" && !Array.isArray(val);
     var picomatch = (glob2, options, returnState = false) => {
       if (Array.isArray(glob2)) {
         const fns = glob2.map((input) => picomatch(input, options, returnState));
-        const arrayMatcher = (str) => {
+        const arrayMatcher = (str2) => {
           for (const isMatch of fns) {
-            const state2 = isMatch(str);
+            const state2 = isMatch(str2);
             if (state2) return state2;
           }
           return false;
@@ -1735,7 +1735,7 @@ var require_picomatch = __commonJS({
       const regex = glob2 instanceof RegExp ? glob2 : picomatch.makeRe(glob2, options);
       return regex.test(utils.basename(input, { windows: posix }));
     };
-    picomatch.isMatch = (str, patterns, options) => picomatch(patterns, options)(str);
+    picomatch.isMatch = (str2, patterns, options) => picomatch(patterns, options)(str2);
     picomatch.parse = (pattern, options) => {
       if (Array.isArray(pattern)) return pattern.map((p) => picomatch.parse(p, options));
       return parse(pattern, { ...options, fastpaths: false });
@@ -1780,7 +1780,7 @@ var require_picomatch = __commonJS({
         return /$^/;
       }
     };
-    picomatch.constants = constants;
+    picomatch.constants = constants2;
     module2.exports = picomatch;
   }
 });
@@ -1826,7 +1826,7 @@ var require_dist = __commonJS({
       enumerable: true
     }) : target, mod));
     var path = __toESM2(require("path"));
-    var fs5 = __toESM2(require("fs"));
+    var fs3 = __toESM2(require("fs"));
     function cleanPath(path$1) {
       let normalized = (0, path.normalize)(path$1);
       if (normalized.length > 1 && normalized[normalized.length - 1] === path.sep) normalized = normalized.substring(0, normalized.length - 1);
@@ -2123,7 +2123,7 @@ var require_dist = __commonJS({
           symlinks: /* @__PURE__ */ new Map(),
           visited: [""].slice(0, 0),
           controller: new Aborter(),
-          fs: options.fs || fs5
+          fs: options.fs || fs3
         };
         this.joinPath = build$7(this.root, options);
         this.pushDirectory = build$6(this.root, options);
@@ -2358,7 +2358,7 @@ var require_dist2 = __commonJS({
       value: mod,
       enumerable: true
     }) : target, mod));
-    var fs5 = require("fs");
+    var fs3 = require("fs");
     var path = require("path");
     var url = require("url");
     var fdir = require_dist();
@@ -2607,12 +2607,12 @@ var require_dist2 = __commonJS({
       opts.cwd = (opts.cwd instanceof URL ? (0, url.fileURLToPath)(opts.cwd) : (0, path.resolve)(opts.cwd || process.cwd())).replace(BACKSLASHES, "/");
       opts.ignore = ensureStringArray(opts.ignore);
       opts.fs && (opts.fs = {
-        readdir: opts.fs.readdir || fs5.readdir,
-        readdirSync: opts.fs.readdirSync || fs5.readdirSync,
-        realpath: opts.fs.realpath || fs5.realpath,
-        realpathSync: opts.fs.realpathSync || fs5.realpathSync,
-        stat: opts.fs.stat || fs5.stat,
-        statSync: opts.fs.statSync || fs5.statSync
+        readdir: opts.fs.readdir || fs3.readdir,
+        readdirSync: opts.fs.readdirSync || fs3.readdirSync,
+        realpath: opts.fs.realpath || fs3.realpath,
+        realpathSync: opts.fs.realpathSync || fs3.realpathSync,
+        stat: opts.fs.stat || fs3.stat,
+        statSync: opts.fs.statSync || fs3.statSync
       });
       if (opts.debug) log("globbing with options:", opts);
       return opts;
@@ -2641,10 +2641,6 @@ var require_dist2 = __commonJS({
   }
 });
 
-// src/cli/main.ts
-var import_fs5 = require("fs");
-var import_path4 = require("path");
-
 // src/core/text.ts
 var MAX_SUMMARY_BYTES = 1024 * 1024;
 var MARKER = "\n\n\u2026(truncated by prodgator-report)";
@@ -2656,9 +2652,6 @@ function truncateUtf8(text, maxBytes) {
   return { text: bytes.subarray(0, end).toString("utf8") + MARKER, truncated: true };
 }
 
-// src/core/junit.ts
-var import_fs = require("fs");
-
 // node_modules/fast-xml-parser/src/util.js
 var nameStartChar = ":A-Za-z_\\u00C0-\\u00D6\\u00D8-\\u00F6\\u00F8-\\u02FF\\u0370-\\u037D\\u037F-\\u1FFF\\u200C-\\u200D\\u2070-\\u218F\\u2C00-\\u2FEF\\u3001-\\uD7FF\\uF900-\\uFDCF\\uFDF0-\\uFFFD";
 var nameChar = nameStartChar + "\\-.\\d\\u00B7\\u0300-\\u036F\\u203F-\\u2040";
@@ -3348,29 +3341,29 @@ var EntityDecoder = class {
    * @param {string} str
    * @returns {string}
    */
-  decode(str) {
-    if (typeof str !== "string" || str.length === 0) return str;
-    if (str.indexOf("&") === -1) return str;
-    const original = str;
+  decode(str2) {
+    if (typeof str2 !== "string" || str2.length === 0) return str2;
+    if (str2.indexOf("&") === -1) return str2;
+    const original = str2;
     const chunks = [];
-    const len = str.length;
+    const len = str2.length;
     let last = 0;
     let i = 0;
     const limitExpansions = this._maxTotalExpansions > 0;
     const limitLength = this._maxExpandedLength > 0;
     const checkLimits = limitExpansions || limitLength;
     while (i < len) {
-      if (str.charCodeAt(i) !== 38) {
+      if (str2.charCodeAt(i) !== 38) {
         i++;
         continue;
       }
       let j = i + 1;
-      while (j < len && str.charCodeAt(j) !== 59 && j - i <= 32) j++;
-      if (j >= len || str.charCodeAt(j) !== 59) {
+      while (j < len && str2.charCodeAt(j) !== 59 && j - i <= 32) j++;
+      if (j >= len || str2.charCodeAt(j) !== 59) {
         i++;
         continue;
       }
-      const token = str.slice(i + 1, j);
+      const token = str2.slice(i + 1, j);
       if (token.length === 0) {
         i++;
         continue;
@@ -3402,7 +3395,7 @@ var EntityDecoder = class {
         i++;
         continue;
       }
-      if (i > last) chunks.push(str.slice(last, i));
+      if (i > last) chunks.push(str2.slice(last, i));
       chunks.push(replacement);
       last = j + 1;
       i = last;
@@ -3428,8 +3421,8 @@ var EntityDecoder = class {
         }
       }
     }
-    if (last < len) chunks.push(str.slice(last));
-    const result = chunks.length === 0 ? str : chunks.join("");
+    if (last < len) chunks.push(str2.slice(last));
+    const result = chunks.length === 0 ? str2 : chunks.join("");
     return this._postCheck(result, original);
   }
   // -------------------------------------------------------------------------
@@ -3748,7 +3741,7 @@ var getRegexes = (xmlVersion = "1.0", asciiOnly = false) => {
   if (asciiOnly) return regexesAscii;
   return xmlVersion === "1.1" ? regexes11 : regexes10;
 };
-var qName = (str, { xmlVersion = "1.0", asciiOnly = false } = {}) => getRegexes(xmlVersion, asciiOnly).qName.test(str);
+var qName = (str2, { xmlVersion = "1.0", asciiOnly = false } = {}) => getRegexes(xmlVersion, asciiOnly).qName.test(str2);
 
 // node_modules/fast-xml-parser/src/xmlparser/DocTypeReader.js
 var DocTypeReader = class {
@@ -4196,13 +4189,13 @@ var CHAR_0 = 48;
 var CHAR_9 = 57;
 var CHAR_MINUS = 45;
 var MINUS_SET = /* @__PURE__ */ new Set([8722, 65293, 65123]);
-function anynum(str) {
-  if (typeof str !== "string") return str;
-  const len = str.length;
-  if (len === 0) return str;
+function anynum(str2) {
+  if (typeof str2 !== "string") return str2;
+  const len = str2.length;
+  if (len === 0) return str2;
   let firstHit = -1;
   for (let i = 0; i < len; i++) {
-    const cc = str.charCodeAt(i);
+    const cc = str2.charCodeAt(i);
     if (cc >= CHAR_0 && cc <= CHAR_9 || cc === CHAR_MINUS) continue;
     if (cc < TABLE_OFFSET) {
       if (MINUS_SET.has(cc)) {
@@ -4213,7 +4206,7 @@ function anynum(str) {
     }
     if (cc >= 55296 && cc <= 56319) {
       if (i + 1 < len) {
-        const low = str.charCodeAt(i + 1);
+        const low = str2.charCodeAt(i + 1);
         if (low >= 56320 && low <= 57343) {
           const cp = 65536 + (cc - 55296 << 10) + (low - 56320);
           if (HIGH_MAP.has(cp)) {
@@ -4229,22 +4222,22 @@ function anynum(str) {
       break;
     }
   }
-  if (firstHit === -1) return str;
+  if (firstHit === -1) return str2;
   const chars = [];
-  if (firstHit > 0) chars.push(str.slice(0, firstHit));
+  if (firstHit > 0) chars.push(str2.slice(0, firstHit));
   for (let i = firstHit; i < len; i++) {
-    const cc = str.charCodeAt(i);
+    const cc = str2.charCodeAt(i);
     if (cc >= CHAR_0 && cc <= CHAR_9 || cc === CHAR_MINUS) {
-      chars.push(str[i]);
+      chars.push(str2[i]);
       continue;
     }
     if (cc < TABLE_OFFSET) {
-      chars.push(MINUS_SET.has(cc) ? "-" : str[i]);
+      chars.push(MINUS_SET.has(cc) ? "-" : str2[i]);
       continue;
     }
     if (cc >= 55296 && cc <= 56319) {
       if (i + 1 < len) {
-        const low = str.charCodeAt(i + 1);
+        const low = str2.charCodeAt(i + 1);
         if (low >= 56320 && low <= 57343) {
           const cp = 65536 + (cc - 55296 << 10) + (low - 56320);
           const d2 = HIGH_MAP.get(cp);
@@ -4255,7 +4248,7 @@ function anynum(str) {
           }
         }
       }
-      chars.push(str[i]);
+      chars.push(str2[i]);
       continue;
     }
     if (MINUS_SET.has(cc)) {
@@ -4263,7 +4256,7 @@ function anynum(str) {
       continue;
     }
     const d = TABLE[cc - TABLE_OFFSET];
-    chars.push(d !== NOT_DIGIT ? String.fromCharCode(d + 48) : str[i]);
+    chars.push(d !== NOT_DIGIT ? String.fromCharCode(d + 48) : str2[i]);
   }
   return chars.join("");
 }
@@ -4286,12 +4279,12 @@ var consider = {
   // "null", "infinity" (Infinity type), "string" ("Infinity" (the string literal))
   unicode: false
 };
-function toNumber(str, options = {}) {
+function toNumber(str2, options = {}) {
   options = Object.assign({}, consider, options);
-  if (!str || typeof str !== "string") return str;
-  let trimmedStr = str.trim();
-  if (trimmedStr.length === 0) return str;
-  else if (options.skipLike !== void 0 && options.skipLike.test(trimmedStr)) return str;
+  if (!str2 || typeof str2 !== "string") return str2;
+  let trimmedStr = str2.trim();
+  if (trimmedStr.length === 0) return str2;
+  else if (options.skipLike !== void 0 && options.skipLike.test(trimmedStr)) return str2;
   else if (trimmedStr === "0") return 0;
   if (options.unicode) {
     trimmedStr = anynum_default(trimmedStr);
@@ -4304,9 +4297,9 @@ function toNumber(str, options = {}) {
   } else if (options.octal && octRegex.test(trimmedStr)) {
     return parse_int(trimmedStr, 8);
   } else if (!isFinite(trimmedStr)) {
-    return handleInfinity(str, Number(trimmedStr), options);
+    return handleInfinity(str2, Number(trimmedStr), options);
   } else if (trimmedStr.includes("e") || trimmedStr.includes("E")) {
-    return resolveEnotation(str, trimmedStr, options);
+    return resolveEnotation(str2, trimmedStr, options);
   } else {
     const match = numRegex.exec(trimmedStr);
     if (match) {
@@ -4315,38 +4308,38 @@ function toNumber(str, options = {}) {
       let numTrimmedByZeros = trimZeros(match[3]);
       const decimalAdjacentToLeadingZeros = sign ? (
         // 0., -00., 000.
-        str[leadingZeros.length + 1] === "."
-      ) : str[leadingZeros.length] === ".";
+        str2[leadingZeros.length + 1] === "."
+      ) : str2[leadingZeros.length] === ".";
       if (!options.leadingZeros && (leadingZeros.length > 1 || leadingZeros.length === 1 && !decimalAdjacentToLeadingZeros)) {
-        return str;
+        return str2;
       } else {
         const num = Number(trimmedStr);
         const parsedStr = String(num);
         if (num === 0) return num;
         if (parsedStr.search(/[eE]/) !== -1) {
           if (options.eNotation) return num;
-          else return str;
+          else return str2;
         } else if (trimmedStr.indexOf(".") !== -1) {
           if (parsedStr === "0") return num;
           else if (parsedStr === numTrimmedByZeros) return num;
           else if (parsedStr === `${sign}${numTrimmedByZeros}`) return num;
-          else return str;
+          else return str2;
         }
         let n = leadingZeros ? numTrimmedByZeros : trimmedStr;
         if (leadingZeros) {
-          return n === parsedStr || sign + n === parsedStr ? num : str;
+          return n === parsedStr || sign + n === parsedStr ? num : str2;
         } else {
-          return n === parsedStr || n === sign + parsedStr ? num : str;
+          return n === parsedStr || n === sign + parsedStr ? num : str2;
         }
       }
     } else {
-      return str;
+      return str2;
     }
   }
 }
 var eNotationRegx = /^([-+])?(0*)(\d*(\.\d*)?[eE][-\+]?\d+)$/;
-function resolveEnotation(str, trimmedStr, options) {
-  if (!options.eNotation) return str;
+function resolveEnotation(str2, trimmedStr, options) {
+  if (!options.eNotation) return str2;
   const notation = trimmedStr.match(eNotationRegx);
   if (notation) {
     let sign = notation[1] || "";
@@ -4354,21 +4347,21 @@ function resolveEnotation(str, trimmedStr, options) {
     const leadingZeros = notation[2];
     const eAdjacentToLeadingZeros = sign ? (
       // 0E.
-      str[leadingZeros.length + 1] === eChar
-    ) : str[leadingZeros.length] === eChar;
-    if (leadingZeros.length > 1 && eAdjacentToLeadingZeros) return str;
+      str2[leadingZeros.length + 1] === eChar
+    ) : str2[leadingZeros.length] === eChar;
+    if (leadingZeros.length > 1 && eAdjacentToLeadingZeros) return str2;
     else if (leadingZeros.length === 1 && (notation[3].startsWith(`.${eChar}`) || notation[3][0] === eChar)) {
       return Number(trimmedStr);
     } else if (leadingZeros.length > 0) {
       if (options.leadingZeros && !eAdjacentToLeadingZeros) {
         trimmedStr = (notation[1] || "") + notation[3];
         return Number(trimmedStr);
-      } else return str;
+      } else return str2;
     } else {
       return Number(trimmedStr);
     }
   } else {
-    return str;
+    return str2;
   }
 }
 function trimZeros(numStr) {
@@ -4384,14 +4377,14 @@ function trimZeros(numStr) {
   return numStr;
 }
 function parse_int(numStr, base) {
-  const str = numStr.trim();
-  if (base === 2 || base === 8) numStr = str.substring(2);
+  const str2 = numStr.trim();
+  if (base === 2 || base === 8) numStr = str2.substring(2);
   if (parseInt) return parseInt(numStr, base);
   else if (Number.parseInt) return Number.parseInt(numStr, base);
   else if (window && window.parseInt) return window.parseInt(numStr, base);
   else throw new Error("parseInt, Number.parseInt, window.parseInt are not supported");
 }
-function handleInfinity(str, num, options) {
+function handleInfinity(str2, num, options) {
   const isPositive = num === Infinity;
   switch (options.infinity.toLowerCase()) {
     case "null":
@@ -4403,7 +4396,7 @@ function handleInfinity(str, num, options) {
       return isPositive ? "Infinity" : "-Infinity";
     case "original":
     default:
-      return str;
+      return str2;
   }
 }
 
@@ -6485,12 +6478,12 @@ function tagExpWithClosingIndex(xmlData, i, closingChar = ">") {
     }
   }
 }
-function findClosingIndex(xmlData, str, i, errMsg) {
-  const closingIndex = xmlData.indexOf(str, i);
+function findClosingIndex(xmlData, str2, i, errMsg) {
+  const closingIndex = xmlData.indexOf(str2, i);
   if (closingIndex === -1) {
     throw new Error(errMsg);
   } else {
-    return closingIndex + str.length - 1;
+    return closingIndex + str2.length - 1;
   }
 }
 function findClosingChar(xmlData, char, i, errMsg) {
@@ -6621,11 +6614,11 @@ function stripAttributePrefix(attrs, prefix) {
 function prettify(node, options, matcher, readonlyMatcher) {
   return compress(node, options, matcher, readonlyMatcher);
 }
-function compress(arr, options, matcher, readonlyMatcher) {
+function compress(arr2, options, matcher, readonlyMatcher) {
   let text;
   const compressedObj = {};
-  for (let i = 0; i < arr.length; i++) {
-    const tagObj = arr[i];
+  for (let i = 0; i < arr2.length; i++) {
+    const tagObj = arr2[i];
     const property = propName(tagObj);
     if (property !== void 0 && property !== options.textNodeName) {
       const rawAttrs = stripAttributePrefix(
@@ -6778,6 +6771,103 @@ var XMLParser = class {
   }
 };
 
+// src/core/safe-path.ts
+var import_crypto = require("crypto");
+var import_fs = require("fs");
+var import_path = require("path");
+var O_NOFOLLOW = import_fs.constants.O_NOFOLLOW ?? 0;
+var outside = (rel) => !rel || rel === ".." || rel.startsWith(`..${import_path.sep}`) || rel.startsWith("../") || (0, import_path.isAbsolute)(rel) || /^[A-Za-z]:/.test(rel);
+var underGit = (rel) => rel.split(/[\\/]/).includes(".git");
+var refuse = (reason, message) => ({ ok: false, reason, message });
+function displayName(root, file) {
+  const rel = (0, import_path.relative)((0, import_path.resolve)(root), (0, import_path.resolve)(root, file));
+  return outside(rel) ? file : rel.split(import_path.sep).join("/");
+}
+async function checkWorkspacePath(root, name, opts = {}) {
+  const display = opts.display ?? name;
+  const absolute = (0, import_path.resolve)(root, name);
+  const rel = (0, import_path.relative)((0, import_path.resolve)(root), absolute);
+  if (outside(rel)) return refuse("outside", `${display} is outside the workspace`);
+  const path = rel.split(import_path.sep).join("/");
+  if (underGit(path)) return refuse("git", `${display} is inside a .git directory`);
+  let real;
+  let realRoot;
+  try {
+    [real, realRoot] = await Promise.all([import_fs.promises.realpath(absolute), import_fs.promises.realpath(root)]);
+  } catch {
+    return refuse("missing", `${display} was not found`);
+  }
+  const realRel = (0, import_path.relative)(realRoot, real);
+  if (outside(realRel)) return refuse("symlink", `${display} resolves outside the workspace (symlink)`);
+  if (underGit(realRel)) return refuse("git", `${display} resolves into a .git directory (symlink)`);
+  if (opts.followLinks === false && realRel !== rel) return refuse("symlink", `${display} is a symlink`);
+  return { ok: true, file: { absolute, path, real } };
+}
+async function openWorkspaceFile(root, name, opts = {}) {
+  const display = opts.display ?? name;
+  const checked = await checkWorkspacePath(root, name, opts);
+  if (!checked.ok) return checked;
+  const { file } = checked;
+  let handle;
+  try {
+    handle = await import_fs.promises.open(file.real, import_fs.constants.O_RDONLY | O_NOFOLLOW);
+  } catch (e) {
+    const code = e.code;
+    return code === "ENOENT" ? refuse("missing", `${display} was not found`) : refuse("changed", `${display} could not be opened safely`);
+  }
+  try {
+    const st = await handle.stat();
+    if (!st.isFile()) {
+      await handle.close();
+      return refuse("not-file", `${display} is not a file`);
+    }
+    if (!await sameFile(handle, st, file.real, await import_fs.promises.realpath(root))) {
+      await handle.close();
+      return refuse("changed", `${display} changed before it could be read (symlink)`);
+    }
+    return { ok: true, file, size: st.size, handle };
+  } catch {
+    await handle.close().catch(() => {
+    });
+    return refuse("changed", `${display} changed before it could be read (symlink)`);
+  }
+}
+async function sameFile(handle, st, real, realRoot) {
+  const viaProc = await import_fs.promises.realpath(`/proc/self/fd/${handle.fd}`).catch(() => null);
+  if (viaProc !== null) {
+    const rel = (0, import_path.relative)(realRoot, viaProc);
+    return viaProc === real && !outside(rel) && !underGit(rel);
+  }
+  const again = await import_fs.promises.realpath(real).catch(() => null);
+  if (again !== real) return false;
+  const now = await import_fs.promises.stat(real).catch(() => null);
+  return !!now && now.dev === st.dev && now.ino === st.ino;
+}
+async function readWorkspaceText(root, name, opts = {}) {
+  const opened = await openWorkspaceFile(root, name, opts);
+  if (!opened.ok) return opened;
+  try {
+    if (opts.maxBytes !== void 0 && opened.size > opts.maxBytes) return { ok: true, file: opened.file, size: opened.size, text: null };
+    return { ok: true, file: opened.file, size: opened.size, text: await opened.handle.readFile("utf8") };
+  } finally {
+    await opened.handle.close();
+  }
+}
+async function sha256Handle(handle) {
+  const hash = (0, import_crypto.createHash)("sha256");
+  for await (const chunk of handle.createReadStream({ autoClose: false, start: 0 })) hash.update(chunk);
+  return hash.digest("hex");
+}
+async function hashWorkspaceFile(root, name, opts = {}) {
+  const opened = await openWorkspaceFile(root, name, opts);
+  if (!opened.ok) return opened;
+  try {
+    return { ok: true, file: opened.file, size: opened.size, sha256: await sha256Handle(opened.handle) };
+  } finally {
+    await opened.handle.close();
+  }
+}
+
 // src/core/junit.ts
 var MAX_FILE_BYTES = 50 * 1024 * 1024;
 var MAX_FILES = 500;
@@ -6822,12 +6912,17 @@ async function junitAttestation(patterns, opts) {
   if (!patterns.length) return null;
   const find = opts.glob;
   const files = (await find(patterns)).slice(0, MAX_FILES);
-  if (!files.length) return null;
   const total = empty();
+  let read = 0;
   for (const f of files) {
-    const stat = await import_fs.promises.stat(f);
-    if (stat.size > MAX_FILE_BYTES) continue;
-    const t = parseJUnitXml(await import_fs.promises.readFile(f, "utf8"));
+    const r = await readWorkspaceText(opts.workspace, f, { maxBytes: MAX_FILE_BYTES, display: displayName(opts.workspace, f) });
+    if (!r.ok) {
+      if (r.reason !== "missing") opts.warn(`${r.message} and was not read`);
+      continue;
+    }
+    read++;
+    if (r.text === null) continue;
+    const t = parseJUnitXml(r.text);
     total.passed += t.passed;
     total.failed += t.failed;
     total.skipped += t.skipped;
@@ -6835,87 +6930,582 @@ async function junitAttestation(patterns, opts) {
     total.durationSeconds = (total.durationSeconds ?? 0) + (t.durationSeconds ?? 0);
     total.failures.push(...t.failures.slice(0, 50 - total.failures.length));
   }
+  if (!read) return null;
   return { kind: "test-results", name: opts.name ?? "junit", data: { ...total } };
 }
 
 // src/core/attestations.ts
+var import_crypto3 = require("crypto");
 var import_fs3 = require("fs");
-var import_path2 = require("path");
+var import_os = require("os");
+var import_path3 = require("path");
 
-// src/core/artifacts.ts
-var import_crypto = require("crypto");
+// src/core/blame.ts
+var import_child_process = require("child_process");
+var import_crypto2 = require("crypto");
 var import_fs2 = require("fs");
-var import_path = require("path");
-var MAX_ARTIFACT_FILES = 50;
-var TYPES = {
-  ".zip": "application/zip",
-  ".gz": "application/gzip",
-  ".tgz": "application/gzip",
-  ".tar": "application/x-tar",
-  ".json": "application/json",
-  ".xml": "application/xml",
-  ".pdf": "application/pdf",
-  ".txt": "text/plain",
-  ".log": "text/plain",
-  ".info": "text/plain",
-  ".md": "text/markdown",
-  ".csv": "text/csv",
-  ".html": "text/html",
-  ".htm": "text/html",
-  ".png": "image/png",
-  ".jpg": "image/jpeg",
-  ".jpeg": "image/jpeg",
-  ".svg": "image/svg+xml"
+var import_path2 = require("path");
+var import_url = require("url");
+function createBlameBudget(limits = {}, now = Date.now()) {
+  return {
+    deadline: now + (limits.maxMs ?? 6e4),
+    resultsLeft: limits.maxResults ?? 500,
+    deepensLeft: limits.maxDeepen ?? 3,
+    gitMissing: false,
+    snippetDeadline: null,
+    snippetMs: limits.maxSnippetMs ?? 3e4,
+    snippetsLeft: limits.maxSnippets ?? 5e3
+  };
+}
+var BLAME_SIDECAR_SUFFIX = ".prodgator-blame.json";
+var MAX_RANGE_LINES = 50;
+var DEEPEN_BY = 200;
+var MAX_CALL_MS = 3e4;
+var MAX_RUNS = 20;
+var SKIP_KINDS = /* @__PURE__ */ new Set(["pass", "notApplicable", "informational"]);
+var GitError = class extends Error {
+  constructor(message, stderr, code) {
+    super(message);
+    this.stderr = stderr;
+    this.code = code;
+  }
 };
-var contentTypeFor = (path) => TYPES[(0, import_path.extname)(path).toLowerCase()] ?? "application/octet-stream";
-function sha256File(path) {
-  return new Promise((resolveHash, reject) => {
-    const hash = (0, import_crypto.createHash)("sha256");
-    (0, import_fs2.createReadStream)(path).on("error", reject).on("data", (c) => hash.update(c)).on("end", () => resolveHash(hash.digest("hex")));
+var defaultIsExecutable = (platform) => (file) => {
+  try {
+    if (!(0, import_fs2.statSync)(file).isFile()) return false;
+    if (platform !== "win32") (0, import_fs2.accessSync)(file, import_fs2.constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+};
+var defaultRealpath = (p) => {
+  try {
+    return import_fs2.realpathSync.native(p);
+  } catch {
+    return p;
+  }
+};
+function searchGit(workspace, o) {
+  const platform = o.platform ?? process.platform;
+  const win = platform === "win32";
+  const p = win ? import_path2.win32 : import_path2.posix;
+  const env = o.env ?? process.env;
+  const isExecutable = o.isExecutable ?? defaultIsExecutable(platform);
+  const realpath = o.realpath ?? defaultRealpath;
+  const pathKey = (win ? Object.keys(env).find((k) => k.toUpperCase() === "PATH") : void 0) ?? "PATH";
+  const pathValue = env[pathKey];
+  const pathExt = win ? Object.entries(env).find(([k]) => k.toUpperCase() === "PATHEXT")?.[1] : void 0;
+  const exts = win ? [...new Set((pathExt ?? ".COM;.EXE").split(";").map((e) => e.trim().toLowerCase()).filter((e) => e === ".exe" || e === ".com"))] : [""];
+  if (win && !exts.length) exts.push(".exe");
+  const roots = [.../* @__PURE__ */ new Set([p.resolve(workspace), p.resolve(realpath(workspace))])];
+  const inside = (dir) => roots.some((root) => {
+    const rel = p.relative(root, dir);
+    return !(rel === ".." || rel.startsWith(`..${p.sep}`) || p.isAbsolute(rel));
   });
+  const absolute = (dir) => win ? /^([A-Za-z]:[\\/]|\\\\[^\\])/.test(dir) : dir.startsWith("/");
+  const kept = [];
+  let git = null;
+  for (const raw of (pathValue ?? "").split(win ? ";" : ":")) {
+    const dir = win ? raw.trim().replace(/^"(.*)"$/, "$1") : raw;
+    if (!dir || dir === "." || !absolute(dir)) continue;
+    const resolved = p.resolve(dir);
+    if (inside(resolved) || inside(p.resolve(realpath(resolved)))) continue;
+    kept.push(raw);
+    for (const ext of git ? [] : exts) {
+      const candidate = p.join(resolved, `git${ext}`);
+      if (isExecutable(candidate)) {
+        git = candidate;
+        break;
+      }
+    }
+  }
+  return { git, path: kept.join(win ? ";" : ":"), pathKey };
 }
-var outside = (rel) => !rel || rel.startsWith("..") || (0, import_path.isAbsolute)(rel) || /^[A-Za-z]:/.test(rel);
-async function refusalFor(absolute, path, workspace) {
-  if (path.split("/").includes(".git")) return `${path} is inside a .git directory and was not uploaded`;
-  const [real, root] = await Promise.all([import_fs2.promises.realpath(absolute), import_fs2.promises.realpath(workspace)]);
-  if (outside((0, import_path.relative)(root, real))) return `${path} resolves outside the workspace (symlink) and was not uploaded`;
-  return null;
+function findGit(workspace, o = {}) {
+  return searchGit(workspace, o).git;
 }
-async function collectArtifacts(patterns, workspace, deps) {
-  const warnings = [];
-  if (!patterns.length) return { files: [], warnings };
-  const find = deps.glob;
-  const inside = [];
-  for (const absolute of [...new Set(await find(patterns))]) {
-    const rel = (0, import_path.relative)(workspace, absolute);
-    if (outside(rel)) {
-      warnings.push(`${absolute} is outside the workspace and was not uploaded`);
+function gitEnv(workspace, o = {}) {
+  const search = searchGit(workspace, o);
+  const env = { ...o.env ?? process.env };
+  for (const k of Object.keys(env)) if (k.toUpperCase() === "PATH") delete env[k];
+  env[search.pathKey] = search.path;
+  return env;
+}
+function gitRunnerFor(lookup = {}, spawn = import_child_process.execFile) {
+  const found = /* @__PURE__ */ new Map();
+  return {
+    run: (args, { cwd, timeoutMs }) => new Promise((resolveRun, reject) => {
+      if (!found.has(cwd)) found.set(cwd, { git: findGit(cwd, lookup), env: gitEnv(cwd, lookup) });
+      const { git, env: baseEnv } = found.get(cwd);
+      if (!git) {
+        reject(new GitError("git not found", "", "ENOENT"));
+        return;
+      }
+      spawn(git, args, {
+        cwd,
+        timeout: Math.max(1, timeoutMs),
+        maxBuffer: 16 * 1024 * 1024,
+        windowsHide: true,
+        encoding: "utf8",
+        // English messages (for missing-path detection) and never a credential prompt.
+        env: { ...baseEnv, LC_ALL: "C", GIT_TERMINAL_PROMPT: "0", GIT_OPTIONAL_LOCKS: "0" }
+      }, (err, stdout, stderr) => {
+        if (err) reject(new GitError("git failed", String(stderr ?? ""), err.code));
+        else resolveRun(String(stdout));
+      });
+    })
+  };
+}
+var execGit = gitRunnerFor();
+function normalizeSnippet(lines) {
+  return lines.map((l) => l.trim().replace(/\s+/g, " ")).filter(Boolean).join("\n");
+}
+function snippetHashOf(lines) {
+  const snippet = normalizeSnippet(lines);
+  return snippet ? (0, import_crypto2.createHash)("sha256").update(snippet).digest("hex").slice(0, 32) : void 0;
+}
+var isObj = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var arr = (v) => Array.isArray(v) ? v : [];
+var str = (v) => typeof v === "string" && v.trim() ? v.trim() : null;
+var SCA_TOOLS = [
+  /\bgrype\b|anchore\/grype/i,
+  /osv-scanner|google\/osv-scanner/i,
+  /dependency-check|dependencycheck/i,
+  /snyk open source|snyk-open-source/i,
+  /\bnpm[- ]audit\b/i,
+  /\byarn[- ]audit\b/i,
+  /\bpnpm[- ]audit\b/i,
+  /\bpip[- ]audit\b/i,
+  /\bcargo[- ]audit\b/i,
+  /\bbundler[- ]audit\b/i,
+  /\bgovulncheck\b/i
+];
+var SECRET_TOOLS = [/gitleaks/i, /trufflehog/i, /detect-secrets/i, /ggshield|gitguardian/i, /secret[- ]scanning/i, /secretlint/i, /noseyparker|nosey parker/i];
+var MANIFESTS = [
+  /(^|\/)(package-lock\.json|npm-shrinkwrap\.json|yarn\.lock|pnpm-lock\.yaml|bun\.lockb?|package\.json)$/i,
+  /(^|\/)(go\.sum|go\.mod)$/i,
+  /(^|\/)(Gemfile\.lock|Gemfile|gems\.locked)$/i,
+  /(^|\/)(requirements[^/]*\.txt|poetry\.lock|Pipfile\.lock|Pipfile|pdm\.lock|uv\.lock|pyproject\.toml|setup\.py)$/i,
+  /(^|\/)(pom\.xml|build\.gradle(\.kts)?|gradle\.lockfile|[^/]+\.jar)$/i,
+  /(^|\/)(Cargo\.lock|Cargo\.toml)$/i,
+  /(^|\/)(packages\.lock\.json|packages\.config|[^/]+\.csproj|[^/]+\.fsproj|[^/]+\.vbproj|[^/]+\.deps\.json)$/i,
+  /(^|\/)(composer\.lock|composer\.json)$/i,
+  /(^|\/)pubspec\.lock$/i,
+  /(^|\/)Package\.resolved$/i,
+  /(^|\/)mix\.lock$/i,
+  // OS package databases inside an image.
+  /(^|\/)lib\/apk\/db\/installed$/i,
+  /(^|\/)var\/lib\/dpkg\/status(\.d\/[^/]+)?$/i,
+  /(^|\/)var\/lib\/rpm\/(Packages|rpmdb\.sqlite|Packages\.db)$/i
+];
+var isManifest = (path) => !!path && MANIFESTS.some((re) => re.test(path));
+var CVE = /^CVE-\d{4}-\d{4,}$/;
+var GHSA = /^GHSA(-[23456789CFGHJMPQRVWX]{4}){3}$/;
+var ADVISORY_PREFIX = /^(RUSTSEC|GO|PYSEC|OSV|GSD|MAL|SNYK|RUBYSEC|DLA|DSA|USN|ALSA|RHSA|ELSA|ALAS\d*|BIT|CGA|MGASA|OESA|OPENSUSE|SUSE)-/;
+var LEADING_VULN_ID = /^(CVE-\d{4}-\d{4,}|GHSA(?:-[23456789cfghjmpqrvwx]{4}){3})-([^-].*)$/i;
+var CHECKOV_SCA_ID = /^([A-Z]+-[A-Z0-9-]+?)_(.+)@([^@]+)$/i;
+function normalizeVulnId(v) {
+  if (typeof v !== "string") return null;
+  const id = v.trim().toUpperCase();
+  if (!id || id.length > 64 || !/^[A-Z0-9._:-]+$/.test(id)) return null;
+  if (id.startsWith("CVE-") && !CVE.test(id)) return null;
+  if (id.startsWith("GHSA-") && !GHSA.test(id)) return null;
+  return id;
+}
+var isAdvisoryId = (id) => !!id && (CVE.test(id) || GHSA.test(id) || ADVISORY_PREFIX.test(id));
+function vulnFromRuleId(ruleId) {
+  if (!ruleId) return { id: null, rest: null, pkgVersion: null };
+  const whole = normalizeVulnId(ruleId);
+  if (isAdvisoryId(whole)) return { id: whole, rest: null, pkgVersion: null };
+  const lead = LEADING_VULN_ID.exec(ruleId);
+  if (lead) return { id: normalizeVulnId(lead[1]), rest: lead[2], pkgVersion: null };
+  const ck = CHECKOV_SCA_ID.exec(ruleId);
+  const ckId = ck ? normalizeVulnId(ck[1]) : null;
+  if (ck && isAdvisoryId(ckId)) return { id: ckId, rest: ck[2], pkgVersion: ck[3] };
+  return { id: null, rest: null, pkgVersion: null };
+}
+var canon = (k) => k.toLowerCase().replace(/[-_ ]/g, "");
+var prop = (bag, names) => {
+  if (!isObj(bag)) return void 0;
+  for (const key of Object.keys(bag)) if (names.includes(canon(key))) return bag[key];
+  return void 0;
+};
+var firstStr = (v) => Array.isArray(v) ? v.map(str).find(Boolean) ?? null : str(v);
+var nameValue = (v) => {
+  if (isObj(v)) return str(v.name);
+  const s = firstStr(v);
+  return s && s.length <= 300 && !/\s/.test(s) ? s : null;
+};
+var concreteVersion = (v) => v && v.length <= 100 && /^[A-Za-z0-9][A-Za-z0-9._+:~-]*$/.test(v) ? v : null;
+function parsePurl(purl) {
+  if (typeof purl !== "string" || purl.length > 2048 || !purl.startsWith("pkg:")) return null;
+  const withoutSub = purl.slice(4).split("#")[0].split("?")[0];
+  const at = withoutSub.lastIndexOf("@");
+  const parts = (at > 0 ? withoutSub.slice(0, at) : withoutSub).split("/").filter(Boolean);
+  if (parts.length < 2 || !/^[a-z][a-z0-9.+-]*$/.test(parts[0].toLowerCase()) || !parts[parts.length - 1]) return null;
+  let version = null;
+  if (at > 0) {
+    const raw = withoutSub.slice(at + 1);
+    try {
+      version = decodeURIComponent(raw) || null;
+    } catch {
+      version = raw || null;
+    }
+  }
+  return { version };
+}
+var PROP = {
+  purl: ["purl", "purls", "packageurl", "packageurls"],
+  name: ["packagename", "pkgname", "package", "componentname", "dependency", "dependencyname", "artifactname", "libraryname"],
+  version: ["packageversion", "pkgversion", "installedversion", "componentversion", "dependencyversion", "currentversion", "version"],
+  fixed: ["fixedversion", "fixedversions", "fixversion", "fixversions", "patchedversion", "patchedversions", "fixedin"]
+};
+function fromProperties(bag) {
+  if (!isObj(bag)) return null;
+  const purlText = firstStr(prop(bag, PROP.purl));
+  const parsed = parsePurl(purlText);
+  const pkgObj = isObj(prop(bag, ["package"])) ? prop(bag, ["package"]) : null;
+  const name = nameValue(prop(bag, PROP.name)) ?? (parsed ? "purl" : null);
+  const versionRaw = firstStr(prop(bag, PROP.version.filter((n) => n !== "version"))) ?? (name ? firstStr(prop(bag, ["version"])) : null) ?? str(pkgObj?.version);
+  const fixed = firstStr(prop(bag, PROP.fixed));
+  if (!parsed && !name && !versionRaw && !fixed) return null;
+  return { purl: parsed ? purlText : null, name, version: concreteVersion(versionRaw) ?? parsed?.version ?? null, fixedVersion: fixed };
+}
+function mergeParts(parts) {
+  const out = { purl: null, name: null, version: null, fixedVersion: null };
+  for (const p of parts) {
+    if (!p) continue;
+    for (const k of Object.keys(out)) if (!out[k] && p[k]) out[k] = p[k];
+  }
+  return out;
+}
+var PACKAGE_MESSAGES = [/^Package: *(\S+)\s*$/m, /^Package '([^']+)@([^'@]+)' is vulnerable to '/, /vulnerability in ([\w.-]+) package: ([^,\s]+), version ([^\s,]+) was found/];
+var SNYK_DESCRIPTION = /^\(([^)]*)\)\s+(\S+)@(\S+)$/;
+function isDependencyResult(result, rule, run2, path, line) {
+  if (isManifest(path) && line === 1) return true;
+  const driver = isObj(run2.tool?.driver) ? run2.tool.driver : {};
+  const props = isObj(result.properties) ? result.properties : {};
+  const toolName = str(props.scanner_name) ?? str(props.scanner_details?.tool_name) ?? str(driver.name);
+  const nested = toolName !== str(driver.name);
+  const toolNames = [toolName, nested ? null : str(driver.fullName), nested ? null : str(driver.informationUri)].filter((n) => !!n);
+  const tags = [...arr(rule.properties?.tags), ...arr(result.properties?.tags)].filter((t) => typeof t === "string").map((t) => t.toLowerCase());
+  const toolType = tags.map((t) => /^tool_type::(\w+)$/.exec(t)?.[1]).find(Boolean) ?? null;
+  if (toolNames.some((n) => SECRET_TOOLS.some((re) => re.test(n))) || toolType === "secrets" || tags.includes("secret") || tags.includes("secrets")) return false;
+  if (toolType === "sast" || toolType === "iac" || tags.includes("misconfiguration")) return false;
+  if (toolNames.some((n) => SCA_TOOLS.some((re) => re.test(n))) || toolType === "sca" || toolType === "container") return true;
+  const parts = mergeParts([fromProperties(result.properties), fromProperties(rule.properties)]);
+  const explicitName = [result.properties, rule.properties].some((b) => !!nameValue(prop(b, ["packagename", "pkgname"])));
+  if (parts.purl || explicitName || parts.name && (parts.version || parts.fixedVersion)) return true;
+  const message = typeof result.message?.text === "string" ? result.message.text : "";
+  if (PACKAGE_MESSAGES.some((re) => re.test(message))) return true;
+  const ruleVuln = vulnFromRuleId(str(result.ruleId) ?? str(rule.id));
+  const snyk = SNYK_DESCRIPTION.exec(str(rule.fullDescription?.text) ?? "");
+  const vulnIds = [
+    ruleVuln.id,
+    ...[...arr(rule.deprecatedIds), ...arr(rule.properties?.aliases)].map(normalizeVulnId).filter(isAdvisoryId),
+    ...snyk ? snyk[1].split(/[,\s]+/).map(normalizeVulnId).filter(isAdvisoryId) : []
+  ].filter(Boolean);
+  if (!vulnIds.length) return false;
+  if (ruleVuln.rest && ruleVuln.pkgVersion) return true;
+  if (isManifest(path) || str(run2.properties?.imageName)) return true;
+  return tags.some((t) => ["vulnerability", "dependency", "dependencies", "sca", "supply-chain", "security"].includes(t));
+}
+function hasFingerprints(result) {
+  return [result.partialFingerprints, result.fingerprints].some((source) => isObj(source) && Object.entries(source).some(([key, value]) => typeof value === "string" && (/(hash|fingerprint)/i.test(key) || /\/v\d+$/.test(key))));
+}
+var rulesById = /* @__PURE__ */ new WeakMap();
+var hasRuleId = (result, run2) => !!(str(result.ruleId) ?? str(ruleFor(result, run2).id));
+function ruleFor(result, run2) {
+  const driverRules = arr(run2.tool?.driver?.rules);
+  const ref = isObj(result.rule) ? result.rule : {};
+  const idx = Number.isInteger(result.ruleIndex) ? result.ruleIndex : Number.isInteger(ref.index) ? ref.index : null;
+  if (idx !== null && !isObj(ref.toolComponent) && isObj(driverRules[idx])) return driverRules[idx];
+  const id = str(result.ruleId) ?? str(ref.id);
+  let byId = rulesById.get(run2);
+  if (!byId) {
+    byId = /* @__PURE__ */ new Map();
+    for (const r of [...driverRules, ...arr(run2.tool?.extensions).flatMap((e) => arr(e?.rules))]) {
+      if (isObj(r) && !byId.has(r.id)) byId.set(r.id, r);
+    }
+    rulesById.set(run2, byId);
+  }
+  return byId.get(id) ?? {};
+}
+function uriToPath(uri) {
+  if (/^file:/i.test(uri)) {
+    try {
+      return (0, import_url.fileURLToPath)(uri);
+    } catch {
+      return null;
+    }
+  }
+  if (/^[a-z][a-z0-9+.-]*:\/\//i.test(uri)) return null;
+  try {
+    return decodeURIComponent(uri);
+  } catch {
+    return uri;
+  }
+}
+function categoryPath(uri) {
+  let p = uri.trim();
+  try {
+    p = decodeURIComponent(p);
+  } catch {
+  }
+  p = p.replace(/\\/g, "/").replace(/^file:\/\//i, "");
+  p = p.replace(/^\/github\/workspace\//, "").replace(/^\/home\/runner\/work\/[^/]+\/[^/]+\//, "");
+  p = p.replace(/^\.\//, "").replace(/^\/+/, "").replace(/\/{2,}/g, "/");
+  return !p || p.split("/").some((s) => s === "..") ? null : p;
+}
+var outsideRel = (rel) => !rel || rel === ".." || rel.startsWith(`..${import_path2.sep}`) || (0, import_path2.isAbsolute)(rel) || /^[A-Za-z]:/.test(rel);
+function locate(result, run2, workspace) {
+  const physical = arr(result.locations).map((l) => l?.physicalLocation).find(isObj);
+  const al = isObj(physical?.artifactLocation) ? physical.artifactLocation : {};
+  const fromIndex = Number.isInteger(al.index) ? arr(run2.artifacts)[al.index]?.location : null;
+  const loc = typeof al.uri === "string" ? al : isObj(fromIndex) ? fromIndex : null;
+  const uri = loc && typeof loc.uri === "string" && loc.uri.trim() ? loc.uri.trim() : null;
+  const rawStart = physical?.region?.startLine;
+  const start = Number.isInteger(rawStart) && rawStart >= 1 ? rawStart : null;
+  const rawEnd = physical?.region?.endLine;
+  const end = start === null ? 0 : Math.min(Number.isInteger(rawEnd) && rawEnd >= start ? rawEnd : start, start + MAX_RANGE_LINES - 1);
+  const located = (kind, path2 = null) => ({ kind, path: path2, categoryPath: uri ? categoryPath(uri) : null, start, end });
+  if (!uri || start === null) return located("none");
+  let p = uriToPath(uri);
+  if (p === null) return located("outside");
+  const base = typeof loc?.uriBaseId === "string" ? run2.originalUriBaseIds?.[loc.uriBaseId]?.uri : null;
+  const basePath = typeof base === "string" ? uriToPath(base) : null;
+  if (!(0, import_path2.isAbsolute)(p) && !p.startsWith("/") && basePath) p = (0, import_path2.resolve)(workspace, basePath, p);
+  p = p.replace(/^\/github\/workspace\//, "");
+  const rel = (0, import_path2.relative)(workspace, (0, import_path2.resolve)(workspace, p));
+  if (outsideRel(rel)) return located("outside");
+  const path = rel.split(import_path2.sep).join("/");
+  if (path.split("/").includes(".git")) return located("outside");
+  return located("ok", path);
+}
+function parsePorcelain(out) {
+  const commits = /* @__PURE__ */ new Map();
+  const lines = [];
+  const order = [];
+  let current = null;
+  for (const raw of out.split("\n")) {
+    const header = /^([0-9a-f]{40,64}) \d+ \d+(?: \d+)?$/.exec(raw);
+    if (header) {
+      current = header[1];
+      if (!commits.has(current)) commits.set(current, { time: 0, boundary: false });
       continue;
     }
-    const path = rel.split(import_path.sep).join("/");
-    const refused = await refusalFor(absolute, path, workspace);
-    if (refused) {
-      warnings.push(refused);
+    if (!current) continue;
+    if (raw.startsWith("	")) {
+      lines.push(raw.slice(1));
+      order.push(current);
       continue;
     }
-    inside.push({ absolute, path });
+    const info = commits.get(current);
+    if (raw.startsWith("committer-time ")) info.time = Number(raw.slice(15)) || 0;
+    else if (raw === "boundary") info.boundary = true;
   }
-  inside.sort((a, b) => a.path.localeCompare(b.path));
-  if (inside.length > MAX_ARTIFACT_FILES) warnings.push(`${inside.length} files matched; only the first ${MAX_ARTIFACT_FILES} are uploaded`);
-  const files = [];
-  for (const f of inside.slice(0, MAX_ARTIFACT_FILES)) {
-    const stat = await import_fs2.promises.stat(f.absolute);
-    if (!stat.isFile() || stat.size === 0) continue;
-    files.push({ path: f.path, absolute: f.absolute, size: stat.size, sha256: await sha256File(f.absolute), contentType: contentTypeFor(f.path) });
+  if (!lines.length) return { ok: false, reason: "error" };
+  if (lines.some((l) => l.includes("\0"))) return { ok: false, reason: "binary" };
+  let best = order[0];
+  for (const c of order) if (commits.get(c).time > commits.get(best).time) best = c;
+  return { ok: true, commit: best, boundary: commits.get(best).boundary, lines };
+}
+function failureReason(text) {
+  if (/no such path|has only \d+ lines?|does not exist|outside repository|no such file/i.test(text)) return "missing";
+  if (/binary/i.test(text)) return "binary";
+  return "error";
+}
+async function buildBlameSidecar(sarif, opts) {
+  const started = Date.now();
+  const budget = opts.budget ?? createBlameBudget(opts, started);
+  if (budget.gitMissing) return null;
+  const git = opts.git ?? execGit;
+  const cwd = opts.cwd;
+  const safeDirectory = cwd.replace(/\\/g, "/");
+  const gitRun = (args, timeoutMs) => git.run(["-c", `safe.directory=${safeDirectory}`, "-c", "safe.bareRepository=explicit", ...args], { cwd, timeoutMs });
+  const callMs = () => Math.min(MAX_CALL_MS, budget.deadline - Date.now());
+  let doc;
+  let sarifSha256;
+  try {
+    sarifSha256 = (0, import_crypto2.createHash)("sha256").update(sarif).digest("hex");
+    doc = JSON.parse(Buffer.from(sarif.buffer, sarif.byteOffset, sarif.byteLength).toString("utf8"));
+    if (!isObj(doc)) return null;
+  } catch {
+    return null;
   }
-  return { files, warnings };
+  let head;
+  let shallow;
+  try {
+    head = (await gitRun(["rev-parse", "HEAD"], MAX_CALL_MS)).trim();
+    if (!/^[0-9a-f]{40,64}$/.test(head)) return null;
+    shallow = (await gitRun(["rev-parse", "--is-shallow-repository"], MAX_CALL_MS).catch(() => "false")).trim() === "true";
+  } catch (e) {
+    if (e?.code === "ENOENT") budget.gitMissing = true;
+    return null;
+  }
+  const cache = /* @__PURE__ */ new Map();
+  const missingFiles = /* @__PURE__ */ new Set();
+  const shallowBoundary = /* @__PURE__ */ new Map();
+  let canDeepen = shallow;
+  const blameRange = (path, start, end) => {
+    const key = `${start},${end}\0${path}`;
+    let hit = cache.get(key);
+    if (!hit) {
+      hit = (async () => {
+        if (missingFiles.has(path)) return { ok: false, reason: "missing" };
+        const timeoutMs = callMs();
+        if (timeoutMs <= 0) return { ok: false, reason: "limit" };
+        try {
+          return parsePorcelain(await gitRun(["blame", "--no-textconv", "-w", "-M", "-C", "--porcelain", "-L", `${start},${end}`, head, "--", path], timeoutMs));
+        } catch (e) {
+          if (Date.now() >= budget.deadline) return { ok: false, reason: "limit" };
+          const stderr = e instanceof GitError ? e.stderr : "";
+          if (/no such path/i.test(stderr)) missingFiles.add(path);
+          const lineCount = Number(/has only (\d+) lines?/i.exec(stderr)?.[1]) || void 0;
+          return { ok: false, reason: failureReason(stderr), lineCount };
+        }
+      })();
+      cache.set(key, hit);
+    }
+    return hit;
+  };
+  const blame = async (path, start, end) => {
+    const first = await blameRange(path, start, end);
+    const lineCount = first.ok ? null : first.lineCount;
+    return lineCount && start <= lineCount && end > lineCount ? blameRange(path, start, lineCount) : first;
+  };
+  const isShallowEdge = (commit, timeoutMs) => {
+    let hit = shallowBoundary.get(commit);
+    if (!hit) {
+      hit = gitRun(["cat-file", "commit", commit], timeoutMs).then((raw) => /^parent [0-9a-f]+$/m.test(raw), () => true);
+      shallowBoundary.set(commit, hit);
+    }
+    return hit;
+  };
+  const deepen = async () => {
+    if (!canDeepen || budget.deepensLeft <= 0) return false;
+    budget.deepensLeft--;
+    try {
+      await gitRun(["-c", "http.lowSpeedLimit=1000", "-c", "http.lowSpeedTime=10", "fetch", `--deepen=${DEEPEN_BY}`, "--no-tags", "--quiet"], Math.max(1, budget.deadline - Date.now()));
+    } catch {
+      canDeepen = false;
+      return false;
+    }
+    cache.clear();
+    shallowBoundary.clear();
+    return true;
+  };
+  const linesAtHead = (path, timeoutMs) => gitRun(["show", "--no-textconv", `${head}:./${path}`], timeoutMs).then(
+    (text) => text.includes("\0") ? null : text.split("\n").map((l) => l.replace(/\r$/, "")),
+    () => null
+  );
+  const toHash = [];
+  const hashSnippets = async () => {
+    const byPath = /* @__PURE__ */ new Map();
+    for (const t of toHash) {
+      const group = byPath.get(t.path);
+      if (group) group.push(t);
+      else byPath.set(t.path, [t]);
+    }
+    if (!byPath.size) return;
+    const deadline = budget.snippetDeadline ??= Date.now() + budget.snippetMs;
+    for (const [path, group] of byPath) {
+      const timeoutMs = Math.min(MAX_CALL_MS, deadline - Date.now());
+      if (budget.snippetsLeft <= 0 || timeoutMs <= 0) return;
+      const counted = group.slice(0, budget.snippetsLeft);
+      budget.snippetsLeft -= counted.length;
+      const lines = await linesAtHead(path, timeoutMs);
+      if (!lines) continue;
+      const count = lines.at(-1) === "" ? lines.length - 1 : lines.length;
+      for (const { entry, start, end } of counted) {
+        const hash = start > count ? void 0 : snippetHashOf(lines.slice(start - 1, Math.min(end, count)));
+        if (hash) entry.snippetHash = hash;
+      }
+    }
+  };
+  const results = [];
+  const runs = arr(doc.runs).slice(0, MAX_RUNS);
+  for (let r = 0; r < runs.length; r++) {
+    const run2 = isObj(runs[r]) ? runs[r] : {};
+    const list2 = arr(run2.results);
+    for (let i = 0; i < list2.length; i++) {
+      const result = list2[i];
+      if (!isObj(result) || SKIP_KINDS.has(result.kind)) continue;
+      const entry = { run: r, result: i, status: "skipped" };
+      results.push(entry);
+      try {
+        const located = locate(result, run2, cwd);
+        if (isDependencyResult(result, ruleFor(result, run2), run2, located.categoryPath, located.start)) {
+          Object.assign(entry, { status: "not_applicable", reason: "dependency" });
+          continue;
+        }
+        if (located.kind === "none") {
+          entry.reason = "no_location";
+          continue;
+        }
+        if (located.kind === "outside" || !located.path || located.start === null) {
+          entry.reason = "missing";
+          continue;
+        }
+        const { path, start, end } = { path: located.path, start: located.start, end: located.end };
+        if (!hasFingerprints(result) && hasRuleId(result, run2) && toHash.length < budget.snippetsLeft && (budget.snippetDeadline === null || Date.now() < budget.snippetDeadline)) {
+          toHash.push({ entry, path, start, end });
+        }
+        if (budget.resultsLeft <= 0 || Date.now() >= budget.deadline) {
+          entry.reason = "limit";
+          continue;
+        }
+        budget.resultsLeft--;
+        let blamed = await blame(path, start, end);
+        while (blamed.ok && shallow && blamed.boundary) {
+          const timeoutMs = callMs();
+          if (timeoutMs <= 0) {
+            entry.reason = "limit";
+            break;
+          }
+          if (!await isShallowEdge(blamed.commit, timeoutMs)) break;
+          if (!await deepen()) {
+            entry.reason = Date.now() >= budget.deadline ? "limit" : "shallow";
+            break;
+          }
+          blamed = await blame(path, start, end);
+        }
+        if (entry.reason) continue;
+        if (!blamed.ok) {
+          entry.reason = blamed.reason;
+          continue;
+        }
+        Object.assign(entry, { status: "found", commit: blamed.commit });
+      } catch {
+        entry.reason = "error";
+      }
+    }
+  }
+  try {
+    await hashSnippets();
+  } catch {
+  }
+  return {
+    format: "prodgator-blame",
+    version: 1,
+    sarifSha256,
+    head,
+    results,
+    stats: { blamed: results.filter((e) => e.status === "found").length, skipped: results.filter((e) => e.status === "skipped").length, ms: Date.now() - started }
+  };
 }
 
 // src/core/attestations.ts
 var KINDS = ["test-results", "coverage", "sbom", "scan", "custom", "provenance"];
-function parseAttestationsInput(value, workspace) {
+async function parseAttestationsInput(value, workspace) {
   if (!value) return [];
-  const text = /^\s*[[{]/.test(value) ? value : (0, import_fs3.readFileSync)((0, import_path2.resolve)(workspace, value.trim()), "utf8");
+  let text = value;
+  if (!/^\s*[[{]/.test(value)) {
+    const read = await readWorkspaceText(workspace, value.trim());
+    if (!read.ok) throw new Error(`attestations file ${read.message}; it was not read`);
+    text = read.text ?? "";
+  }
   let parsed;
   try {
     parsed = JSON.parse(text);
@@ -6937,7 +7527,7 @@ function contentTypeForScanFile(format, path) {
   if (format === "sarif") return "application/sarif+json";
   if (format === "cyclonedx") return "application/vnd.cyclonedx+json";
   if (format === "spdx") return "application/spdx+json";
-  return (0, import_path2.extname)(path).toLowerCase() === ".json" ? "application/json" : "application/octet-stream";
+  return (0, import_path3.extname)(path).toLowerCase() === ".json" ? "application/json" : "application/octet-stream";
 }
 function sarifCounts(json) {
   const counts = { critical: 0, high: 0, medium: 0, low: 0 };
@@ -6968,13 +7558,77 @@ function sarifCounts(json) {
   }
   return counts;
 }
+var BLAME_INPUT_WARNING = "data.blame is set by the report client itself; the value given was ignored";
+var isReservedSidecarPath = (path) => path.toLowerCase().endsWith(BLAME_SIDECAR_SUFFIX);
+var BLAME_NO_GIT_NOTE = "git is not installed, so code findings were sent without blame data.";
+var blameTooLargeWarning = (file) => `${file} is too large to add blame data to (over ${MAX_SARIF_BYTES} bytes), so its code findings were sent without it`;
+var BlameSidecars = class {
+  constructor(limits, build) {
+    this.build = build;
+    this.budget = createBlameBudget(limits);
+  }
+  dir = null;
+  count = 0;
+  budget;
+  /** The sidecar as an artifact, or why there is none (null when git is not installed: the note covers it). */
+  async add(sarif, path, workspace) {
+    let sidecar;
+    try {
+      sidecar = await this.build(sarif, { cwd: workspace, budget: this.budget });
+    } catch {
+      return "blame data was not added (blame stopped with an error)";
+    }
+    if (this.budget.gitMissing) return null;
+    if (!sidecar) return "blame data was not added (the workspace is not a git checkout, or the SARIF file could not be read)";
+    try {
+      this.dir ??= await import_fs3.promises.mkdtemp((0, import_path3.join)((0, import_os.tmpdir)(), "prodgator-blame-"));
+      const name = `${++this.count}${BLAME_SIDECAR_SUFFIX}`;
+      const target = (0, import_path3.join)(this.dir, name);
+      const text = JSON.stringify(sidecar);
+      await import_fs3.promises.writeFile(target, text, { flag: "wx" });
+      return {
+        // Uploaded from the directory this client made (its own root for the upload check), never from the checkout.
+        path: path + BLAME_SIDECAR_SUFFIX,
+        absolute: target,
+        workspace: this.dir,
+        source: name,
+        size: Buffer.byteLength(text),
+        sha256: (0, import_crypto3.createHash)("sha256").update(text).digest("hex"),
+        contentType: "application/json"
+      };
+    } catch {
+      return "blame data was not added (the blame file could not be written)";
+    }
+  }
+  /** Removes the temporary directory (best effort). Call after the uploads. */
+  async cleanup() {
+    const dir = this.dir;
+    this.dir = null;
+    if (dir) await import_fs3.promises.rm(dir, { recursive: true, force: true }).catch(() => {
+    });
+  }
+};
 async function resolveAttestationFiles(attestations, workspace, deps = {}) {
-  const hash = deps.sha256File ?? sha256File;
+  const blame = deps.blame ? new BlameSidecars(deps.blame === true ? {} : deps.blame, deps.buildBlameSidecar ?? buildBlameSidecar) : null;
+  try {
+    return await resolveFiles(attestations, workspace, blame);
+  } catch (e) {
+    await blame?.cleanup();
+    throw e;
+  }
+}
+async function resolveFiles(attestations, workspace, blame) {
   const files = [];
   const warnings = [];
   const out = [];
+  let warnedTooLargeForBlame = false;
   for (const input of attestations) {
     let a = input;
+    if ("blame" in a.data) {
+      const { blame: _given, ...rest } = a.data;
+      a = { ...a, data: rest };
+      warnings.push(BLAME_INPUT_WARNING);
+    }
     if (a.kind === "scan" && "mode" in a.data && a.data.mode !== "full" && a.data.mode !== "diff") {
       const { mode: _ignored, ...rest } = a.data;
       a = { ...a, data: rest };
@@ -6987,39 +7641,123 @@ async function resolveAttestationFiles(attestations, workspace, deps = {}) {
     }
     const format = a.format;
     const scanFormat = typeof format === "string" && SCAN_FILE_FORMATS.includes(format) ? format : void 0;
-    const absolute = (0, import_path2.resolve)(workspace, file);
-    const rel = (0, import_path2.relative)(workspace, absolute);
-    if (!rel || rel.startsWith("..") || /^[A-Za-z]:/.test(rel)) {
-      warnings.push(`${file} is outside the workspace and was not attached to "${a.name}"`);
+    const wantCounts = a.kind === "scan" && scanFormat === "sarif" && a.data.critical === void 0 && a.data.high === void 0 && a.data.medium === void 0 && a.data.low === void 0;
+    const notAttached = `and was not attached to "${a.name}"`;
+    const wantBlame = !!blame && a.kind === "scan" && scanFormat === "sarif";
+    const opened = await openWorkspaceFile(workspace, file);
+    if (!opened.ok) {
+      const missing = opened.reason === "missing" || opened.reason === "not-file";
+      warnings.push(missing ? `${file} was not found (or is empty) ${notAttached}` : `${opened.message} ${notAttached}`);
       out.push(a);
       continue;
     }
-    const path = rel.split(import_path2.sep).join("/");
-    const stat = await import_fs3.promises.stat(absolute).catch(() => null);
-    if (!stat?.isFile() || stat.size === 0) {
-      warnings.push(`${file} was not found (or is empty) and was not attached to "${a.name}"`);
+    if (isReservedSidecarPath(opened.file.path)) {
+      await opened.handle.close();
+      warnings.push(`${opened.file.path} ends in ${BLAME_SIDECAR_SUFFIX}, a name reserved for blame data, ${notAttached}`);
       out.push(a);
       continue;
     }
-    const refused = await refusalFor(absolute, path, workspace);
-    if (refused) {
-      warnings.push(refused);
-      out.push(a);
-      continue;
+    let sha256;
+    let counts = null;
+    let sarifBytes = null;
+    try {
+      if (opened.size === 0) {
+        warnings.push(`${file} was not found (or is empty) ${notAttached}`);
+        out.push(a);
+        continue;
+      }
+      if ((wantCounts || wantBlame) && opened.size <= MAX_SARIF_BYTES) {
+        const bytes = await opened.handle.readFile();
+        sha256 = (0, import_crypto3.createHash)("sha256").update(bytes).digest("hex");
+        if (wantCounts) counts = sarifCounts(bytes.toString("utf8"));
+        if (wantBlame) sarifBytes = bytes;
+      } else {
+        sha256 = await sha256Handle(opened.handle);
+      }
+    } finally {
+      await opened.handle.close();
     }
-    files.push({ path, absolute, size: stat.size, sha256: await hash(absolute), contentType: contentTypeForScanFile(scanFormat, path) });
+    const { path, absolute } = opened.file;
+    files.push({ path, absolute, workspace, size: opened.size, sha256, contentType: contentTypeForScanFile(scanFormat, path) });
     const data = { ...a.data, artifact: path };
     if (a.kind === "scan" && scanFormat) data.format = scanFormat;
-    if (a.kind === "scan" && scanFormat === "sarif" && data.critical === void 0 && data.high === void 0 && data.medium === void 0 && data.low === void 0) {
-      if (stat.size <= MAX_SARIF_BYTES) {
-        Object.assign(data, sarifCounts((0, import_fs3.readFileSync)(absolute, "utf8")));
-      } else {
-        warnings.push(`${file} is too large to compute SARIF counts from (over ${MAX_SARIF_BYTES} bytes); skipping`);
+    if (counts) Object.assign(data, counts);
+    else if (wantCounts) warnings.push(`${file} is too large to compute SARIF counts from (over ${MAX_SARIF_BYTES} bytes); skipping`);
+    if (wantBlame && opened.size > MAX_SARIF_BYTES && !warnedTooLargeForBlame) {
+      warnedTooLargeForBlame = true;
+      warnings.push(blameTooLargeWarning(file));
+    }
+    if (blame && sarifBytes) {
+      const sidecar = await blame.add(sarifBytes, path, workspace);
+      if (typeof sidecar === "string") warnings.push(`${file}: ${sidecar}`);
+      else if (sidecar && files.some((f) => f.path === sidecar.path)) warnings.push(`${file}: blame data was not added (${sidecar.path} is already in this report)`);
+      else if (sidecar) {
+        files.push(sidecar);
+        data.blame = sidecar.path;
       }
     }
     out.push({ kind: a.kind, name: a.name, status: a.status, data });
   }
-  return { attestations: out, files, warnings };
+  const notes = blame?.budget.gitMissing ? [BLAME_NO_GIT_NOTE] : [];
+  return { attestations: out, files, warnings, notes, cleanup: async () => {
+    await blame?.cleanup();
+  } };
+}
+
+// src/core/artifacts.ts
+var import_path4 = require("path");
+var MAX_ARTIFACT_FILES = 50;
+var TYPES = {
+  ".zip": "application/zip",
+  ".gz": "application/gzip",
+  ".tgz": "application/gzip",
+  ".tar": "application/x-tar",
+  ".json": "application/json",
+  ".xml": "application/xml",
+  ".pdf": "application/pdf",
+  ".txt": "text/plain",
+  ".log": "text/plain",
+  ".info": "text/plain",
+  ".md": "text/markdown",
+  ".csv": "text/csv",
+  ".html": "text/html",
+  ".htm": "text/html",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".svg": "image/svg+xml"
+};
+var contentTypeFor = (path) => TYPES[(0, import_path4.extname)(path).toLowerCase()] ?? "application/octet-stream";
+async function collectArtifacts(patterns, workspace, deps) {
+  const warnings = [];
+  if (!patterns.length) return { files: [], warnings };
+  const find = deps.glob;
+  const inside = [];
+  for (const absolute of [...new Set(await find(patterns))]) {
+    const checked = await checkWorkspacePath(workspace, absolute, { display: displayName(workspace, absolute) });
+    if (!checked.ok) {
+      if (checked.reason !== "missing") warnings.push(`${checked.message} and was not uploaded`);
+      continue;
+    }
+    if (checked.file.path.toLowerCase().endsWith(BLAME_SIDECAR_SUFFIX)) {
+      warnings.push(`${checked.file.path} ends in ${BLAME_SIDECAR_SUFFIX}, a name reserved for blame data, and was not uploaded`);
+      continue;
+    }
+    inside.push({ absolute: checked.file.absolute, path: checked.file.path });
+  }
+  inside.sort((a, b) => a.path.localeCompare(b.path));
+  if (inside.length > MAX_ARTIFACT_FILES) warnings.push(`${inside.length} files matched; only the first ${MAX_ARTIFACT_FILES} are uploaded`);
+  const files = [];
+  for (const f of inside.slice(0, MAX_ARTIFACT_FILES)) {
+    const hashed = await hashWorkspaceFile(workspace, f.path);
+    if (!hashed.ok) {
+      if (hashed.reason !== "missing" && hashed.reason !== "not-file") warnings.push(`${hashed.message} and was not uploaded`);
+      continue;
+    }
+    if (hashed.size === 0) continue;
+    files.push({ path: f.path, absolute: f.absolute, workspace, size: hashed.size, sha256: hashed.sha256, contentType: contentTypeFor(f.path) });
+  }
+  return { files, warnings };
 }
 
 // src/core/request.ts
@@ -7092,23 +7830,34 @@ var sendReport = (baseUrl, provider, req, audience, deps, azure) => postJson(`${
 var completeReport = (baseUrl, provider, reportId, artifactIds, audience, deps, azure) => postJson(`${baseUrl}/api/ingest/${provider}/reports/${encodeURIComponent(reportId)}/complete`, azure ? { artifactIds, azure } : { artifactIds }, audience, deps);
 
 // src/core/upload.ts
-var import_fs4 = require("fs");
 var http = __toESM(require("http"));
 var https = __toESM(require("https"));
-function putOnce(slot, file) {
-  return new Promise((resolve3, reject) => {
+var refused = (message) => Object.assign(new Error(message), { retryable: false });
+async function openForUpload(file) {
+  const opened = await openWorkspaceFile(file.workspace, file.source ?? file.path, { display: file.path });
+  if (!opened.ok) throw refused(`${opened.message} and was not uploaded`);
+  if (opened.size !== file.size) {
+    await opened.handle.close();
+    throw refused(`${file.path} changed since it was hashed and was not uploaded`);
+  }
+  return opened.handle;
+}
+async function putOnce(slot, file) {
+  const handle = await openForUpload(file);
+  const body = handle.createReadStream({ start: 0 });
+  return new Promise((resolve4, reject) => {
     const url = new URL(slot.url);
     const mod = url.protocol === "http:" ? http : https;
     const headers = Object.fromEntries(Object.entries(slot.headers).filter(([k]) => !/^(proxy-)?authorization$|^cookie$/i.test(k)));
     const req = mod.request(url, { method: "PUT", headers, timeout: 10 * 6e4 }, (res) => {
-      let body = "";
+      let body2 = "";
       res.setEncoding("utf8");
       res.on("data", (c) => {
-        if (body.length < 4e3) body += c;
+        if (body2.length < 4e3) body2 += c;
       });
       res.on("end", () => {
-        if (res.statusCode && res.statusCode < 300) return resolve3();
-        const code = /<Code>([^<]+)<\/Code>/.exec(body)?.[1] ?? `HTTP ${res.statusCode}`;
+        if (res.statusCode && res.statusCode < 300) return resolve4();
+        const code = /<Code>([^<]+)<\/Code>/.exec(body2)?.[1] ?? `HTTP ${res.statusCode}`;
         const err = new Error(`${file.path}: upload refused (${code})`);
         err.retryable = (res.statusCode ?? 0) >= 500;
         reject(err);
@@ -7123,8 +7872,8 @@ function putOnce(slot, file) {
       if (e.retryable === void 0) e.retryable = true;
       reject(e);
     });
-    (0, import_fs4.createReadStream)(file.absolute).on("error", reject).pipe(req);
-  });
+    body.on("error", reject).pipe(req);
+  }).finally(() => body.destroy());
 }
 async function uploadFile(slot, file, attempts = 2) {
   for (let i = 1; ; i++) {
@@ -7243,7 +7992,9 @@ var OPTION_NAMES = {
   failOnError: { flag: "--fail-on-error", env: "PRODGATOR_FAIL_ON_ERROR", pipe: "FAIL_ON_ERROR" },
   tokenVariable: { flag: "--token-variable", env: "PRODGATOR_TOKEN_VARIABLE", pipe: null },
   gate: { flag: "--gate", env: "PRODGATOR_GATE", pipe: "GATE" },
-  gateTimeoutMinutes: { flag: "--gate-timeout", env: "PRODGATOR_GATE_TIMEOUT", pipe: "GATE_TIMEOUT" }
+  gateTimeoutMinutes: { flag: "--gate-timeout", env: "PRODGATOR_GATE_TIMEOUT", pipe: "GATE_TIMEOUT" },
+  // No pipe name: a Bitbucket pipe step sets PRODGATOR_BLAME: 'false' among its variables.
+  blame: { flag: "--blame", env: "PRODGATOR_BLAME", pipe: null }
 };
 var DEFAULT_GATE_TIMEOUT_MINUTES = 60;
 var MAX_GATE_TIMEOUT_MINUTES = 720;
@@ -7275,7 +8026,11 @@ function parseOptions(argv, env) {
       pipe = true;
       continue;
     }
-    if ((a === "--gate" || a === "--allow-custom-url") && (argv[i + 1] === void 0 || argv[i + 1].startsWith("--"))) {
+    if (a === "--no-blame") {
+      flags.set("--blame", "false");
+      continue;
+    }
+    if ((a === "--gate" || a === "--allow-custom-url" || a === "--blame") && (argv[i + 1] === void 0 || argv[i + 1].startsWith("--"))) {
       flags.set(a, "true");
       continue;
     }
@@ -7323,7 +8078,8 @@ function parseOptions(argv, env) {
     tokenVariable: get("tokenVariable")?.trim() ?? null,
     pipe,
     gate: (get("gate") ?? "false").trim().toLowerCase() === "true",
-    gateTimeoutMinutes: gateTimeout(get("gateTimeoutMinutes"))
+    gateTimeoutMinutes: gateTimeout(get("gateTimeoutMinutes")),
+    blame: (get("blame") ?? "true").trim().toLowerCase() !== "false"
   };
 }
 
@@ -7420,7 +8176,7 @@ function redactDeep(value, values) {
 }
 
 // src/cli/glob.ts
-var import_path3 = require("path");
+var import_path5 = require("path");
 var { glob } = require_dist2();
 function workspaceGlob(workspace, warn) {
   return async (patterns) => {
@@ -7429,9 +8185,9 @@ function workspaceGlob(workspace, warn) {
     for (const raw of patterns) {
       const neg = raw.startsWith("!");
       let p = neg ? raw.slice(1) : raw;
-      if ((0, import_path3.isAbsolute)(p)) {
-        const rel = (0, import_path3.relative)(workspace, p);
-        if (!rel || rel.startsWith("..") || (0, import_path3.isAbsolute)(rel)) {
+      if ((0, import_path5.isAbsolute)(p)) {
+        const rel = (0, import_path5.relative)(workspace, p);
+        if (!rel || rel.startsWith("..") || (0, import_path5.isAbsolute)(rel)) {
           warn(`${raw} is outside the workspace and was skipped`);
           continue;
         }
@@ -7441,7 +8197,7 @@ function workspaceGlob(workspace, warn) {
     }
     if (!include.length) return [];
     const found = await glob(include, { cwd: workspace, ignore, absolute: true, onlyFiles: true, dot: true, followSymbolicLinks: true });
-    return found.map((f) => (0, import_path3.resolve)(f)).sort();
+    return found.map((f) => (0, import_path5.resolve)(f)).sort();
   };
 }
 
@@ -7504,16 +8260,17 @@ var SKIPPED = {
   monthly_quota: "your organization's monthly upload allowance is used up"
 };
 var DEFAULT_SUMMARY_FILE = "prodgator-summary.md";
-async function readSummary(workspace, summary, file, info) {
+async function readSummary(workspace, summary, file, log) {
   if (summary) return summary;
   const path = file ?? DEFAULT_SUMMARY_FILE;
-  const absolute = (0, import_path4.isAbsolute)(path) ? path : (0, import_path4.join)(workspace, path);
-  try {
-    return await import_fs5.promises.readFile(absolute, "utf8");
-  } catch {
-    if (file) info(`No summary file at ${path}; sending the report without a summary.`);
-    return null;
+  const read = await readWorkspaceText(workspace, path);
+  if (read.ok) return read.text;
+  if (read.reason === "missing") {
+    if (file) log.info(`No summary file at ${path}; sending the report without a summary.`);
+  } else {
+    log.warn(`${read.message}; sending the report without a summary.`);
   }
+  return null;
 }
 function mergeFiles(first, rest, warn) {
   const byPath = /* @__PURE__ */ new Map();
@@ -7527,10 +8284,11 @@ async function run(deps = {}) {
   const argv = deps.argv ?? process.argv.slice(2);
   const log = deps.log ?? { info: (m) => console.log(m), warn: (m) => console.log(`Warning: ${m}`), error: (m) => console.error(m) };
   if (argv.includes("--version")) {
-    log.info("3.19.0");
+    log.info("3.25.0");
     return 0;
   }
   let failOnError = false;
+  let cleanup = null;
   const truthy = (v) => v?.trim().toLowerCase() === "true";
   let gate = argv.some((a) => a === "--gate" || a === "--gate=true") || truthy(env.PRODGATOR_GATE) || argv.includes("--pipe") && truthy(env.GATE);
   try {
@@ -7545,7 +8303,7 @@ async function run(deps = {}) {
     const problem = tokenProblem(token, opts.audience, ci.provider, variable, (deps.nowMs ?? Date.now)());
     if (problem) throw new CliError(problem);
     if (opts.gate) {
-      const client2 = { getToken: async () => token, fetch: deps.fetch, sleep: deps.sleep, fixedToken: true, userAgent: `prodgator-report/${"3.19.0"} (${ci.provider}; gate)` };
+      const client2 = { getToken: async () => token, fetch: deps.fetch, sleep: deps.sleep, fixedToken: true, userAgent: `prodgator-report/${"3.25.0"} (${ci.provider}; gate)` };
       return await runGate(ci, { prodgatorUrl: opts.prodgatorUrl, audience: opts.audience, timeoutMinutes: opts.gateTimeoutMinutes }, client2, {
         sleep: deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms))),
         nowMs: deps.nowMs ?? Date.now,
@@ -7554,11 +8312,13 @@ async function run(deps = {}) {
     }
     const secrets = secretValues(env, [variable, ...opts.redactVariables]);
     const glob2 = workspaceGlob(ci.workspace, (w) => log.warn(w));
-    const rawSummary = await readSummary(ci.workspace, opts.summary, opts.summaryFile, (m) => log.info(m));
+    const rawSummary = await readSummary(ci.workspace, opts.summary, opts.summaryFile, log);
     const summary = rawSummary ? truncateUtf8(redactText(rawSummary, secrets), MAX_SUMMARY_BYTES).text : null;
-    const scanned = await resolveAttestationFiles(parseAttestationsInput(opts.attestations, ci.workspace), ci.workspace);
+    const scanned = await resolveAttestationFiles(await parseAttestationsInput(opts.attestations, ci.workspace), ci.workspace, { blame: opts.blame });
+    cleanup = scanned.cleanup;
+    scanned.notes.forEach((n) => log.info(n));
     const attestations = redactDeep(scanned.attestations, secrets);
-    const junit = await junitAttestation(opts.junit, { glob: glob2 });
+    const junit = await junitAttestation(opts.junit, { glob: glob2, workspace: ci.workspace, warn: (w) => log.warn(w) });
     if (junit) attestations.push(junit);
     const globbed = await collectArtifacts(opts.artifacts, ci.workspace, { glob: glob2 });
     [...scanned.warnings, ...globbed.warnings].forEach((w) => log.warn(w));
@@ -7568,7 +8328,7 @@ async function run(deps = {}) {
       fetch: deps.fetch,
       sleep: deps.sleep,
       fixedToken: true,
-      userAgent: `prodgator-report/${"3.19.0"} (${ci.provider})`
+      userAgent: `prodgator-report/${"3.25.0"} (${ci.provider})`
     };
     const request = buildIngestRequest({ job: { name: opts.jobName ?? ci.jobName, matrix: opts.matrix, runner: ci.runner }, name: opts.name, summary, attestations, files });
     const res = await sendReport(opts.prodgatorUrl, ci.provider, request, opts.audience, client, ci.azure);
@@ -7606,6 +8366,8 @@ async function run(deps = {}) {
     log.warn(`Prodgator report was not sent: ${msg2}`);
     deps.onOutcome?.("not_sent");
     return 0;
+  } finally {
+    await cleanup?.();
   }
 }