@vantageos/mcp-doctor 0.3.2 → 0.4.0

package/dist/doctor.js

@@ -2,12 +2,997 @@
 
 // src/doctor.ts
 import { readFileSync as readFileSync12, realpathSync } from "fs";
-import { dirname as dirname11, join as join21, resolve as resolve2 } from "path";
+import { dirname as dirname11, join as join19, resolve as resolve2 } from "path";
 import { fileURLToPath } from "url";
 
+// src/scan.ts
+import { existsSync, readFileSync, readdirSync, statSync } from "fs";
+import { basename, dirname, join, relative, sep } from "path";
+var SKIP_DIR_INFO = {
+  node_modules: { reason: "vendored dependencies", authored: false },
+  dist: { reason: "build output", authored: false },
+  build: { reason: "build output", authored: false },
+  ".git": { reason: "version-control metadata", authored: false },
+  coverage: { reason: "generated coverage output", authored: false },
+  // `authored: true` marks content the target's own authors wrote, as opposed
+  // to vendored or generated content. A walk that looks for a site (C-26) may
+  // probe an authored directory it skips: a deployable there would otherwise
+  // be reported as if it did not exist.
+  tests: { reason: "test material", authored: true },
+  __tests__: { reason: "test material", authored: true },
+  // Test material, not a target's served surface: deliberately-malformed
+  // servers and foreign copies live here. Scanning them makes the instrument
+  // trip its own fail-closed detectors when pointed at its own tree, and lints
+  // inputs that are meant to be broken. A real target's fixtures are equally
+  // test inputs, not its product surface.
+  fixtures: { reason: "test material (fixtures)", authored: true }
+};
+var SKIP_DIRS = new Set(Object.keys(SKIP_DIR_INFO));
+function recordSkip(tree, dir, root, reason) {
+  const path = relative(root, dir).split(sep).join("/");
+  const existing = tree.skippedDirs.find((d) => d.path === path);
+  if (existing) return existing;
+  const entry = {
+    path,
+    reason: reason ?? SKIP_DIR_INFO[basename(dir)]?.reason ?? "skipped"
+  };
+  tree.skippedDirs.push(entry);
+  return entry;
+}
+function isCommentLine(raw) {
+  const t = raw.trim();
+  if (t === "") return false;
+  return t.startsWith("*") || t.startsWith("//") || t.startsWith("/*") || t.startsWith("*/");
+}
+function walk(dir, out, onSkip) {
+  let entries;
+  try {
+    entries = readdirSync(dir);
+  } catch {
+    return;
+  }
+  for (const name of entries) {
+    const full = join(dir, name);
+    let st;
+    try {
+      st = statSync(full);
+    } catch {
+      continue;
+    }
+    if (st.isDirectory()) {
+      if (SKIP_DIRS.has(name)) {
+        onSkip(full);
+        continue;
+      }
+      walk(full, out, onSkip);
+    } else if (name.endsWith(".ts") || name.endsWith(".tsx")) {
+      if (name.endsWith(".d.ts") || name.endsWith(".test.ts")) continue;
+      out.push(full);
+    }
+  }
+}
+function loadFile(path, root) {
+  const raw = readFileSync(path, "utf8");
+  const lines = raw.split("\n").map((r, i) => ({ n: i + 1, raw: r, comment: isCommentLine(r) }));
+  const file = { path, rel: relative(root, path) || path, lines };
+  const mask = maskOf(file);
+  for (const line of lines) {
+    if (line.comment) continue;
+    const row = mask[line.n - 1];
+    let any = false;
+    let allComment = true;
+    for (let c = 0; c < line.raw.length; c++) {
+      if (line.raw[c] === " " || line.raw[c] === "	" || line.raw[c] === "\r") continue;
+      any = true;
+      if (row[c] !== COM) {
+        allComment = false;
+        break;
+      }
+    }
+    if (any && allComment) line.comment = true;
+  }
+  return file;
+}
+function findPackageJson(startDir) {
+  let dir = startDir;
+  for (let depth = 0; depth < 8; depth++) {
+    const candidate = join(dir, "package.json");
+    if (existsSync(candidate)) {
+      try {
+        const parsed = JSON.parse(readFileSync(candidate, "utf8"));
+        if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+          return { path: candidate, json: {}, unreadable: "not a JSON object" };
+        }
+        return { path: candidate, json: parsed };
+      } catch (err) {
+        return { path: candidate, json: {}, unreadable: err.message };
+      }
+    }
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return null;
+}
+function loadTree(root) {
+  const st = statSync(root);
+  const baseDir = st.isDirectory() ? root : dirname(root);
+  const filePaths = [];
+  const tree = { root, files: [], packageJson: null, skippedDirs: [] };
+  if (st.isDirectory()) walk(root, filePaths, (d) => recordSkip(tree, d, root));
+  else if (root.endsWith(".ts") || root.endsWith(".tsx")) filePaths.push(root);
+  tree.files = filePaths.map((p) => loadFile(p, baseDir));
+  tree.packageJson = findPackageJson(baseDir);
+  return tree;
+}
+var COM = 1;
+var CODE = 2;
+var maskCache = /* @__PURE__ */ new WeakMap();
+function buildCodeMask(file) {
+  const mask = [];
+  let mode = "code";
+  const tplStack = [];
+  let braceDepth = 0;
+  let prevSig = "";
+  let prevWord = "";
+  const regexAfterKeyword = /* @__PURE__ */ new Set([
+    "case",
+    "default",
+    "delete",
+    "do",
+    "else",
+    "extends",
+    "in",
+    "instanceof",
+    "new",
+    "of",
+    "return",
+    "throw",
+    "typeof",
+    "void",
+    "yield",
+    "await"
+  ]);
+  const regexAfter = /* @__PURE__ */ new Set([
+    "",
+    "(",
+    ",",
+    "=",
+    ":",
+    "[",
+    "!",
+    "&",
+    "|",
+    "?",
+    "{",
+    "}",
+    ";",
+    "+",
+    "-",
+    "*",
+    "%",
+    "<",
+    ">",
+    "~",
+    "^"
+  ]);
+  for (const line of file.lines) {
+    const s = line.raw;
+    const row = new Uint8Array(s.length);
+    let i = 0;
+    while (i < s.length) {
+      const c = s[i];
+      const n = s[i + 1];
+      if (mode === "block") {
+        row[i] = COM;
+        if (c === "*" && n === "/") {
+          row[i + 1] = COM;
+          i += 2;
+          mode = "code";
+        } else i++;
+        continue;
+      }
+      if (mode === "sq" || mode === "dq") {
+        if (c === "\\") i += 2;
+        else if (mode === "sq" && c === "'" || mode === "dq" && c === '"') {
+          row[i] = CODE;
+          i++;
+          mode = "code";
+          prevSig = c;
+        } else i++;
+        continue;
+      }
+      if (mode === "tpl") {
+        if (c === "\\") i += 2;
+        else if (c === "`") {
+          row[i] = CODE;
+          i++;
+          mode = "code";
+          prevSig = c;
+        } else if (c === "$" && n === "{") {
+          row[i] = CODE;
+          row[i + 1] = CODE;
+          tplStack.push(braceDepth);
+          braceDepth++;
+          i += 2;
+          mode = "code";
+          prevSig = "{";
+        } else i++;
+        continue;
+      }
+      if (mode === "re" || mode === "recls") {
+        if (c === "\\") i += 2;
+        else if (mode === "re" && c === "[") {
+          mode = "recls";
+          i++;
+        } else if (mode === "recls" && c === "]") {
+          mode = "re";
+          i++;
+        } else if (mode === "re" && c === "/") {
+          row[i] = CODE;
+          i++;
+          mode = "code";
+          prevSig = "/";
+        } else i++;
+        continue;
+      }
+      if (c === "/" && n === "/") {
+        row.fill(COM, i);
+        break;
+      }
+      if (c === "/" && n === "*") {
+        mode = "block";
+        row[i] = COM;
+        row[i + 1] = COM;
+        i += 2;
+        continue;
+      }
+      row[i] = CODE;
+      const wordBefore = prevWord;
+      if (c !== " " && c !== "	") prevWord = "";
+      if (/[A-Za-z_$]/.test(c)) {
+        let j = i + 1;
+        while (j < s.length && /[\w$]/.test(s[j])) j++;
+        for (let k = i; k < j; k++) row[k] = CODE;
+        prevWord = prevSig === "." ? "" : s.slice(i, j);
+        prevSig = s[j - 1];
+        i = j;
+        continue;
+      }
+      if (c === '"' || c === "'" || c === "`") {
+        mode = c === '"' ? "dq" : c === "'" ? "sq" : "tpl";
+        i++;
+        continue;
+      }
+      if (c === "/" && (regexAfter.has(prevSig) || regexAfterKeyword.has(wordBefore))) {
+        mode = "re";
+        i++;
+        continue;
+      }
+      if (c === "{") braceDepth++;
+      else if (c === "}") {
+        braceDepth--;
+        if (tplStack.length > 0 && tplStack[tplStack.length - 1] === braceDepth) {
+          tplStack.pop();
+          mode = "tpl";
+          i++;
+          continue;
+        }
+      }
+      if (c !== " " && c !== "	") prevSig = c;
+      i++;
+    }
+    if (mode === "sq" || mode === "dq" || mode === "re" || mode === "recls") mode = "code";
+    mask.push(row);
+  }
+  return mask;
+}
+function maskOf(file) {
+  let mask = maskCache.get(file);
+  if (!mask) {
+    mask = buildCodeMask(file);
+    maskCache.set(file, mask);
+  }
+  return mask;
+}
+function isCodeAt(file, n, col) {
+  const mask = maskOf(file);
+  return mask[n - 1]?.[col] === CODE;
+}
+function matchInCode(file, line, re) {
+  const g = new RegExp(re.source, re.flags.includes("g") ? re.flags : `${re.flags}g`);
+  for (const m of line.raw.matchAll(g)) {
+    if (isCodeAt(file, line.n, m.index ?? 0)) return m;
+  }
+  return null;
+}
+function testInCode(file, line, re) {
+  return matchInCode(file, line, re) !== null;
+}
+function countInCode(file, line, ch) {
+  let n = 0;
+  for (let c = 0; c < line.raw.length; c++) {
+    if (line.raw[c] === ch && isCodeAt(file, line.n, c)) n++;
+  }
+  return n;
+}
+
+// src/detectors/couldNotJudge.ts
+import { readFileSync as readFileSync2 } from "fs";
+function couldNotJudge(id, anchor, reason) {
+  return {
+    id,
+    anchor,
+    state: "could-not-judge",
+    reason,
+    verdict: `could not judge: ${reason}`
+  };
+}
+function settle(id, decided, unreadable) {
+  if (unreadable.length === 0) return decided;
+  const named = unreadable.map((u) => `${u.anchor}: ${u.reason}`).join("; ");
+  if (decided.state === "non-conforming") {
+    return { ...decided, verdict: `${decided.verdict} [also could not read: ${named}]` };
+  }
+  const judgedRest = decided.state === "could-not-judge" ? ` ${decided.reason ?? decided.verdict}` : ` The readable remainder judged ${decided.state}: ${decided.verdict}`;
+  return couldNotJudge(
+    id,
+    unreadable[0].anchor,
+    `${unreadable.length} input(s) present but unreadable \u2014 ${named}.${judgedRest}`
+  );
+}
+function readJsonObject(path) {
+  let value;
+  try {
+    value = JSON.parse(readFileSync2(path, "utf8"));
+  } catch {
+    return null;
+  }
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+  return value;
+}
+function guardUnreadablePackageJson(inner, opts) {
+  return {
+    ...inner,
+    run(tree) {
+      const decided = inner.run(tree);
+      const pkg = tree.packageJson;
+      if (!pkg?.unreadable) return decided;
+      const u = {
+        anchor: pkg.path,
+        reason: `package.json is present but could not be parsed (${pkg.unreadable})`
+      };
+      if (opts.authoritative && decided.state !== "could-not-judge") {
+        return couldNotJudge(inner.id, u.anchor, `${u.anchor}: ${u.reason}`);
+      }
+      return settle(inner.id, decided, [u]);
+    }
+  };
+}
+
+// src/detectors/dLocalIdentity.ts
+var CLOUD_IDENTITY_PACKAGE = "@vantageos/cloud-identity";
+var EXEMPT_MARKER = "allow-local-identity:";
+var MIN_JUSTIFICATION = 8;
+var TENANT_NAMES = "orgId|org_id|orgSlug|org_slug|tenantId|tenant_id";
+var TENANT_PROP = new RegExp(`\\.(${TENANT_NAMES})$`, "i");
+var unbracket = (x) => x.replace(/\??\.?\[\s*["'`]([\w$]+)["'`]\s*\]/g, ".$1").replace(/\?/g, "");
+var FOLD_NAMES = "toLowerCase|toUpperCase|toLocaleLowerCase|toLocaleUpperCase|trim|normalize";
+var FOLD_CALL = String.raw`(?:\s*\.\s*(?:${FOLD_NAMES})\s*\([^()]*\))*`;
+var PATH = String.raw`[\w$.?]+(?![\w$])(?<!\.(?:${FOLD_NAMES}))`;
+var OPERAND = String.raw`${PATH}(?:\[\s*["\`][\w$]+["\`]\s*\]\??[\w$.?]*)*${FOLD_CALL}`;
+var NON_OPERAND = /* @__PURE__ */ new Set(["undefined", "null", "true", "false", "NaN"]);
+var isLiteral = (x) => NON_OPERAND.has(x) || /^-?\d/.test(x);
+var unfold = (x) => unbracket(x.replace(new RegExp(`${FOLD_CALL}$`), ""));
+var lastSegment = (x) => x.split(".").pop() ?? "";
+var ACTING_FIELD = /^(createdBy|assignedTo|assignee|from|fromOrchestrator|toOrchestrator|recipient|sender|callerOrchestrator|orchestrator|orchestratorName|actor|actorName|actingAs|claimedBy|callerName|agentName|fromName)$/;
+var ACTING_BARE = /^(createdBy|assignedTo|assignee|fromOrchestrator|toOrchestrator|callerOrchestrator|actingAs|claimedBy)$/;
+var CALLERISH = /^(caller\w*|actor\w*|acting\w*|claimed\w*|\w*Orchestrator|\w*AgentName)$/i;
+var NAME_FIELD = /^(name|agentName|orchestratorName|displayName)$/;
+var isActing = (x) => ACTING_FIELD.test(lastSegment(x)) && (x.includes(".") || ACTING_BARE.test(x)) || x.includes(".") && CALLERISH.test(lastSegment(x));
+var isNameField = (x) => x.includes(".") && NAME_FIELD.test(lastSegment(x));
+var isBareCallerish = (x) => !x.includes(".") && CALLERISH.test(x);
+var comparesTenants = (a, b) => TENANT_PROP.test(a) || TENANT_PROP.test(b);
+var comparesNames = (a, b) => isActing(a) && (isActing(b) || CALLERISH.test(lastSegment(b)) || isNameField(b)) || isActing(b) && (CALLERISH.test(lastSegment(a)) || isNameField(a)) || isBareCallerish(a) && isNameField(b) || isBareCallerish(b) && isNameField(a);
+var comparesIdentity = (a, b) => comparesTenants(a, b) || comparesNames(a, b);
+function operands(x, y) {
+  const [a, b] = [unfold(x), unfold(y)];
+  return isLiteral(a) || isLiteral(b) ? null : [a, b];
+}
+var CMP = String.raw`(${OPERAND})\s*[!=]==?\s*(${OPERAND})`;
+var OBJECT_IS = String.raw`\bObject\s*\.\s*is\s*\(\s*(${OPERAND})\s*,\s*(${OPERAND})\s*\)`;
+var acceptWith = (pred) => (m) => {
+  const ops = operands(m[1], m[2]);
+  return ops !== null && pred(ops[0], ops[1]);
+};
+var STRING_LITERAL = String.raw`(?:"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|\`[^\`$\\]*\`)`;
+var LITERAL_CONCAT = new RegExp(String.raw`^${STRING_LITERAL}(?:\s*\+\s*${STRING_LITERAL})*$`);
+function staticConstants(file) {
+  const out = /* @__PURE__ */ new Set();
+  const decl = /^(?:export\s+)?const\s+([\w$]+)\s*(?::[^=]+)?=\s*(.*)$/;
+  for (let i = 0; i < file.lines.length; i++) {
+    const m = file.lines[i].raw.match(decl);
+    if (!m) continue;
+    let init = m[2];
+    for (let j = i + 1; !/;\s*$/.test(init) && j < Math.min(file.lines.length, i + 40); j++) {
+      init += `
+${file.lines[j].raw}`;
+    }
+    const body = init.replace(/;\s*$/, "").trim();
+    if (LITERAL_CONCAT.test(body)) out.add(m[1]);
+  }
+  return out;
+}
+function callArgs(text, from) {
+  const args = [];
+  let depth = 0;
+  let start = from;
+  for (let i = from; i < text.length; i++) {
+    const c = text[i];
+    if (c === '"' || c === "'" || c === "`") {
+      for (i++; i < text.length && text[i] !== c; i++) if (text[i] === "\\") i++;
+      continue;
+    }
+    if (c === "(" || c === "[" || c === "{") depth++;
+    else if (c === ")" || c === "]" || c === "}") {
+      if (depth === 0) {
+        args.push(text.slice(start, i).trim());
+        return { args, end: i + 1 };
+      }
+      depth--;
+    } else if (c === "," && depth === 0) {
+      args.push(text.slice(start, i).trim());
+      start = i + 1;
+    }
+  }
+  return null;
+}
+function isStaticInput(expr, statics) {
+  const e = expr.trim();
+  if (LITERAL_CONCAT.test(e) || statics.has(e)) return true;
+  const wrapped = e.match(/^(?:new\s+TextEncoder\s*\(\s*\)\s*\.\s*encode|Buffer\s*\.\s*from)\s*\(/);
+  if (!wrapped) return false;
+  const inner = callArgs(e, wrapped[0].length);
+  return inner !== null && inner.end === e.length && isStaticInput(inner.args[0], statics);
+}
+function textFrom(ctx, extra = 12) {
+  const { file, line, idx } = ctx;
+  const tail = file.lines.slice(line.n, line.n + extra).map((l) => l.raw);
+  return [line.raw.slice(idx), ...tail].join("\n");
+}
+function blockFrom(text, from) {
+  const open = text.indexOf("{", from);
+  if (open < 0) return null;
+  let depth = 0;
+  for (let i = open; i < text.length; i++) {
+    const c = text[i];
+    if (c === '"' || c === "'" || c === "`") {
+      for (i++; i < text.length && text[i] !== c; i++) if (text[i] === "\\") i++;
+      continue;
+    }
+    if (c === "{") depth++;
+    else if (c === "}" && --depth === 0) return text.slice(open, i + 1);
+  }
+  return null;
+}
+function switchComparesIdentity(m, ctx) {
+  if (!ctx) return false;
+  const subject = unfold(m[1]);
+  const body = blockFrom(textFrom(ctx, 60), m[0].length);
+  if (body === null) return false;
+  const label = new RegExp(String.raw`\bcase\s+(${OPERAND})\s*:`, "g");
+  for (const c of body.matchAll(label)) {
+    const ops = operands(subject, c[1]);
+    if (ops !== null && comparesIdentity(ops[0], ops[1])) return true;
+  }
+  return false;
+}
+function literalHoldsIdentity(m) {
+  const arg = unfold(m[2]);
+  return m[1].split(",").map((e) => unfold(e.trim())).some((e) => e !== "" && !isLiteral(e) && !isLiteral(arg) && comparesIdentity(e, arg));
+}
+function digestsStaticInput(m, ctx) {
+  if (!ctx) return false;
+  const text = textFrom(ctx);
+  const open = text.indexOf("(");
+  if (open < 0) return false;
+  const call = callArgs(text, open + 1);
+  if (!call) return false;
+  if (/^subtle/.test(m[0])) {
+    return m[1] === "digest" && call.args.length >= 2 && isStaticInput(call.args[1], ctx.statics);
+  }
+  if (!/^createHash/.test(m[0])) return false;
+  const update = text.slice(call.end).match(/^\s*\.\s*update\s*\(/);
+  if (!update) return false;
+  const data = callArgs(text, call.end + update[0].length);
+  return data !== null && isStaticInput(data.args[0], ctx.statics);
+}
+var RENAMEABLE = [
+  "createHash",
+  "createHmac",
+  "timingSafeEqual",
+  "jwtVerify",
+  "jwtDecrypt",
+  "createRemoteJWKSet",
+  "createLocalJWKSet",
+  "decodeJwt",
+  "compactVerify",
+  "verifyToken"
+];
+function renamedPrimitives(file) {
+  const text = file.lines.map((l) => l.raw).join("\n");
+  const out = [];
+  const named = /import\s+(type\s+)?\{([^}]*)\}\s*from\s*["']([^"']+)["']/g;
+  for (const m of text.matchAll(named)) {
+    if (m[1] || m[3].startsWith(CLOUD_IDENTITY_PACKAGE)) continue;
+    for (const part of m[2].split(",")) {
+      const as = part.trim().match(/^([\w$]+)\s+as\s+([\w$]+)$/);
+      if (as && RENAMEABLE.includes(as[1])) out.push([as[1], as[2]]);
+    }
+  }
+  const destructured = /(?:const|let|var)\s*\{([^}]*)\}\s*=\s*(?:await\s+)?(?:require|import)\s*\(\s*["']([^"']+)["']/g;
+  for (const m of text.matchAll(destructured)) {
+    if (m[2].startsWith(CLOUD_IDENTITY_PACKAGE)) continue;
+    for (const part of m[1].split(",")) {
+      const as = part.trim().match(/^([\w$]+)\s*:\s*([\w$]+)$/);
+      if (as && RENAMEABLE.includes(as[1])) out.push([as[1], as[2]]);
+    }
+  }
+  return out;
+}
+var escapeRe = (x) => x.replace(/[$]/g, "\\$&");
+function aliasMatchers(file) {
+  const out = [];
+  for (const [orig, alias] of renamedPrimitives(file)) {
+    for (const mt of MATCHERS) {
+      if (!mt.re.source.includes(orig)) continue;
+      const re = new RegExp(mt.re.source.split(orig).join(escapeRe(alias)), mt.re.flags);
+      const { accept } = mt;
+      out.push({
+        ...mt,
+        re,
+        // The predicate reads the matched text; give it the original callee name.
+        accept: accept ? (m, ctx) => {
+          const fake = Object.assign(
+            [...m].map((x) => x?.replace(alias, orig)),
+            {
+              index: m.index,
+              input: m.input
+            }
+          );
+          return accept(fake, ctx);
+        } : void 0
+      });
+    }
+  }
+  return out;
+}
+var MATCHERS = [
+  {
+    id: "local-jwt-verify",
+    category: "resolves-caller",
+    re: /\b(jwtVerify|jwtDecrypt|createRemoteJWKSet|createLocalJWKSet|decodeJwt|compactVerify|verifyToken)\s*\(/,
+    callee: 1,
+    sample: "const { payload } = await jwtVerify(token, jwks);"
+  },
+  {
+    id: "local-jwt-verify",
+    category: "resolves-caller",
+    re: /\b(jwt|jsonwebtoken)\.(verify|decode)\s*\(/,
+    sample: "const claims = jwt.verify(token, key);"
+  },
+  {
+    id: "raw-claim-read",
+    category: "resolves-caller",
+    re: /\b(payload|claims|decoded)\??\.(org_id|org_slug|org_role|orgId|orgSlug|orgRole)\b/,
+    sample: "const orgId = payload.org_id as string;"
+  },
+  {
+    // A populated grant attached locally: a non-empty literal, or a value read
+    // off another object (a mapping row). A pass-through copy of the same
+    // field (`fromAllowList: ctx.fromAllowList`) grants nothing new.
+    id: "local-grant",
+    category: "resolves-caller",
+    re: /\bfromAllowList\s*:\s*(\[\s*[^\]\s][^\]]*\]|[\w$]+(?:\??\.[\w$]+)+)/,
+    accept: (m) => !/\.fromAllowList$/.test(m[1]),
+    sample: 'fromAllowList: ["*"],'
+  },
+  {
+    // A role compared to a value. A presence test (`orgRole !== undefined`,
+    // forwarding the claim on) asserts nothing and is not a site.
+    id: "org-role-assert",
+    category: "asserts-membership",
+    re: /\b(orgRole|org_role)\s*[!=]==\s*([^\s);&|?:]+)/,
+    accept: (m) => !NON_OPERAND.has(m[2]),
+    sample: 'if (orgRole === "org:admin") return true;'
+  },
+  {
+    id: "org-role-assert",
+    category: "asserts-membership",
+    re: /[!=]==\s*["'`]org:|\.has\(\s*\{\s*(role|permission)\s*:/,
+    sample: 'if (auth.has({ role: "org:admin" })) return true;'
+  },
+  {
+    // Identifying an agent by NAME: a typed name compared to a roster or an
+    // allow-list, by method or by iteration.
+    id: "name-allowlist",
+    category: "filters-by-scope",
+    re: /\b[\w$]*(roster|allow_?list|allowed_?orchestrators)\s*\??\.\s*(includes|indexOf|some|find|findIndex|every|has)\s*\(/i,
+    sample: "if (ctx.fromAllowList.includes(from)) return null;"
+  },
+  {
+    id: "name-allowlist",
+    category: "filters-by-scope",
+    re: /\b(isIn\w*Allow_?list)\s*\(/i,
+    callee: 1,
+    sample: "if (!isInAllowList(list, name)) return false;"
+  },
+  {
+    id: "name-allowlist",
+    category: "filters-by-scope",
+    re: /\bof\s+[\w$.?]*(roster|allow_?list|allowed_?orchestrators)\s*\)/i,
+    sample: "for (const entry of ctx.fromAllowList) {"
+  },
+  {
+    // A row kept or dropped by comparing its tenant to the caller's: ===, !==, == or !=.
+    id: "tenant-row-filter",
+    category: "filters-by-scope",
+    re: new RegExp(CMP),
+    accept: acceptWith(comparesTenants),
+    sample: "return row.orgId == ctx.actor.orgSlug;"
+  },
+  {
+    id: "tenant-row-filter",
+    category: "filters-by-scope",
+    re: new RegExp(OBJECT_IS),
+    accept: acceptWith(comparesTenants),
+    sample: "return Object.is(row.orgId, ctx.actor.orgSlug);"
+  },
+  {
+    // A tenant passed to a membership test: `callerOrgs.includes(row.orgId)`.
+    id: "tenant-row-filter",
+    category: "filters-by-scope",
+    re: new RegExp(
+      String.raw`\.(includes|has|indexOf|some|find|findIndex)\s*\(\s*(${OPERAND})\s*[,)]`
+    ),
+    accept: (m) => TENANT_PROP.test(unfold(m[2])),
+    sample: "return callerOrgs.includes(row.orgId);"
+  },
+  {
+    // Identifying an agent by NAME through a normaliser: either side of a strict
+    // comparison is a call to `normalize...Id/Name/Orchestrator/Agent/...`.
+    id: "name-compare",
+    category: "filters-by-scope",
+    re: /\bnormali[sz]e\w*(id|name|orchestrator|agent|label|slug|handle)\w*\s*\([^()]*(?:\([^()]*\)[^()]*)*\)\s*[!=]==|[!=]==\s*normali[sz]e\w*(id|name|orchestrator|agent|label|slug|handle)\w*\s*\(/i,
+    sample: "return normalizeOrchestratorId(claimedName) === only;"
+  },
+  {
+    // A typed or argument name compared straight to an allow-list / roster entry.
+    id: "name-compare",
+    category: "filters-by-scope",
+    re: /(?:\b[\w$.?]*(?:roster|allow_?list|allowed_?orchestrators)\s*\??\.?\[[^\]]*\]\s*[!=]==|[!=]==\s*[\w$.?]*(?:roster|allow_?list|allowed_?orchestrators)\s*\??\.?\[)/i,
+    sample: "return claimedName === ctx.fromAllowList[0];"
+  },
+  {
+    // Identifying an agent by NAME through its acting-name fields: who made a row
+    // against who is asking. ===, !==, == and !=, case-folded or not.
+    id: "name-compare",
+    category: "filters-by-scope",
+    re: new RegExp(CMP),
+    accept: acceptWith(comparesNames),
+    sample: "return row.assignedTo.toLowerCase() !== a.callerOrchestrator.toLowerCase();"
+  },
+  {
+    id: "name-compare",
+    category: "filters-by-scope",
+    re: new RegExp(OBJECT_IS),
+    accept: acceptWith(comparesNames),
+    sample: "return Object.is(row.createdBy, m.from);"
+  },
+  {
+    // `switch (row.createdBy) { case caller: }` is the same compare, spelled as a jump table.
+    id: "name-compare",
+    category: "filters-by-scope",
+    re: new RegExp(String.raw`\bswitch\s*\(\s*(${OPERAND})\s*\)`),
+    accept: (m, ctx) => switchComparesIdentity(m, ctx),
+    sample: "switch (row.createdBy) { case caller: return true; }"
+  },
+  {
+    // `[caller].includes(row.createdBy)`: a membership test against a literal that holds the caller.
+    id: "name-compare",
+    category: "filters-by-scope",
+    re: new RegExp(
+      String.raw`(?<![\w$\])])\[([^\[\]]*)\]\s*\.\s*(?:includes|indexOf)\s*\(\s*(${OPERAND})\s*[,)]`
+    ),
+    accept: (m) => literalHoldsIdentity(m),
+    sample: "return [caller].includes(row.createdBy);"
+  },
+  {
+    id: "name-compare",
+    category: "filters-by-scope",
+    re: new RegExp(
+      String.raw`\bnew\s+Set\s*\(\s*\[([^\[\]]*)\]\s*\)\s*\.\s*has\s*\(\s*(${OPERAND})\s*[,)]`
+    ),
+    accept: (m) => literalHoldsIdentity(m),
+    sample: "return new Set([caller]).has(row.assignedTo);"
+  },
+  {
+    // `a.localeCompare(b) === 0` is an equality test, whichever way round it is written.
+    id: "name-compare",
+    category: "filters-by-scope",
+    re: new RegExp(
+      String.raw`(${OPERAND})\s*\.\s*localeCompare\s*\(\s*(${OPERAND})\s*(?:,[^()]*(?:\([^()]*\)[^()]*)*)?\)\s*[!=]==?\s*0(?![\w$.])`
+    ),
+    accept: acceptWith(comparesIdentity),
+    sample: "return row.assignedTo.localeCompare(a.callerOrchestrator) === 0;"
+  },
+  {
+    id: "name-compare",
+    category: "filters-by-scope",
+    re: new RegExp(
+      String.raw`(?<![\w$.])0\s*[!=]==?\s*(${OPERAND})\s*\.\s*localeCompare\s*\(\s*(${OPERAND})\s*[,)]`
+    ),
+    accept: acceptWith(comparesIdentity),
+    sample: "return 0 === row.assignedTo.localeCompare(a.callerOrchestrator);"
+  },
+  {
+    id: "local-secret-compare",
+    category: "validates-credential",
+    re: /\b(timingSafeEqual)\s*\(/,
+    callee: 1,
+    sample: "return timingSafeEqual(a, b);"
+  },
+  {
+    // Any digest of a presented credential, whatever the algorithm.
+    id: "local-digest",
+    category: "validates-credential",
+    // A digest over static content (a literal, or a constant made of literals) is
+    // not a digest of a credential. HMAC and sign/verify always take a key: a site.
+    re: /\bcreateHash\s*\(|\bcreateHmac\s*\(|\bsubtle\s*\.\s*(digest|sign|verify)\s*\(/,
+    accept: (m, ctx) => !digestsStaticInput(m, ctx),
+    sample: 'const h = await crypto.subtle.digest("SHA-256", data);'
+  }
+];
+function biteSample(mt, text) {
+  const m = text.match(mt.re);
+  if (m === null) return false;
+  if (!mt.accept) return true;
+  const line = { n: 1, raw: text, comment: false };
+  const file = { path: "sample", rel: "sample", lines: [line] };
+  return mt.accept(m, { file, line, idx: m.index ?? 0, statics: /* @__PURE__ */ new Set() });
+}
+function localIdentityPositiveControls() {
+  const out = {};
+  MATCHERS.forEach((mt, i) => {
+    out[`${mt.id}#${i}`] = biteSample(mt, mt.sample);
+  });
+  const bites = (line) => MATCHERS.some((mt) => biteSample(mt, line));
+  out["negative:pass-through-grant"] = !bites("fromAllowList: ctx.fromAllowList,");
+  out["negative:delegated-bearer"] = !MATCHERS.some(
+    (mt) => mt.re.test("const r = await validateMasterBearer(authHeader, secret);")
+  );
+  out["negative:role-presence-test"] = !bites(
+    "...(ctx.orgRole !== undefined ? { role: ctx.orgRole } : {}),"
+  );
+  out["negative:undefined-compare"] = !bites("if (row.orgId === undefined) return;");
+  out["negative:acting-field-vs-nullish"] = !bites("if (row.assignedTo !== undefined) return;");
+  out["negative:acting-field-vs-literal"] = !bites('return t.createdBy === "system";');
+  out["negative:unrelated-field-compare"] = !bites("return page.from === page.to;");
+  out["negative:switch-on-unrelated-field"] = !bites('switch (row.kind) { case "a": return 1; }');
+  out["negative:literal-array-unrelated"] = !bites("return [kind].includes(row.status);");
+  out["negative:localecompare-unrelated"] = !bites("return a.name.localeCompare(b.name) === 0;");
+  out["negative:object-is-nullish"] = !bites("return Object.is(row.orgId, undefined);");
+  return out;
+}
+function cloudIdentityBindings(file) {
+  const text = file.lines.map((l) => l.raw).join("\n");
+  const names = /* @__PURE__ */ new Set();
+  const namespaces = /* @__PURE__ */ new Set();
+  const pkg = `@vantageos\\/cloud-identity(?:\\/[^"']*)?`;
+  const named = new RegExp(`import\\s+(type\\s+)?\\{([^}]*)\\}\\s*from\\s*["']${pkg}["']`, "g");
+  for (const m of text.matchAll(named)) {
+    if (m[1]) continue;
+    for (const part of m[2].split(",")) {
+      const p = part.trim();
+      if (!p || p.startsWith("type ")) continue;
+      const as = p.match(/^[\w$]+\s+as\s+([\w$]+)$/);
+      names.add(as ? as[1] : p);
+    }
+  }
+  const ns = new RegExp(`import\\s+\\*\\s+as\\s+([\\w$]+)\\s+from\\s*["']${pkg}["']`, "g");
+  for (const m of text.matchAll(ns)) namespaces.add(m[1]);
+  return { names, namespaces };
+}
+function isDelegated(raw, start, callee, b) {
+  const before = raw.slice(0, start);
+  const qualified = before.match(/([\w$]+)\s*\.\s*$/);
+  if (qualified) return b.namespaces.has(qualified[1]);
+  return b.names.has(callee);
+}
+function countDelegatedCalls(file, b) {
+  if (b.names.size === 0 && b.namespaces.size === 0) return 0;
+  let n = 0;
+  for (const line of file.lines) {
+    if (line.comment) continue;
+    for (const m of line.raw.matchAll(/([\w$]+)\s*\(/g)) {
+      const idx = m.index ?? 0;
+      if (isCodeAt(file, line.n, idx) && isDelegated(line.raw, idx, m[1], b)) n++;
+    }
+  }
+  return n;
+}
+var DECL = /^(?:export\s+)?(?:default\s+)?(?:async\s+)?(?:function\s*\*?\s*([\w$]+)|(?:const|let|var|class)\s+([\w$]+))/;
+function enclosingDecl(file, n) {
+  for (let i = n - 1; i >= 0; i--) {
+    const l = file.lines[i];
+    if (l.comment) continue;
+    const m = l.raw.match(DECL);
+    if (m) return { name: m[1] ?? m[2], line: l.n };
+  }
+  return null;
+}
+function justificationIn(line, file) {
+  const at = line.raw.indexOf(EXEMPT_MARKER);
+  if (at < 0) return null;
+  if (!line.comment && isCodeAt(file, line.n, at)) return null;
+  if (!line.comment && !/\/\/|\/\*/.test(line.raw.slice(0, at))) return null;
+  return line.raw.slice(at + EXEMPT_MARKER.length).replace(/\*\/\s*$/, "").trim();
+}
+function commentBlockAbove(file, n) {
+  const out = [];
+  for (let i = n - 2; i >= 0; i--) {
+    const l = file.lines[i];
+    if (!l.comment) break;
+    out.push(l);
+  }
+  return out;
+}
+function findJustification(file, line, decl) {
+  const candidates = [line, ...commentBlockAbove(file, line.n)];
+  if (decl) candidates.push(...commentBlockAbove(file, decl.line));
+  for (const c of candidates) {
+    const j = justificationIn(c, file);
+    if (j !== null) return { text: j, valid: j.length >= MIN_JUSTIFICATION };
+  }
+  return null;
+}
+function unreadableReason(file) {
+  if (file.lines.some((l) => l.raw.includes("\0") || l.raw.includes("\uFFFD"))) {
+    return "file is not valid UTF-8 text";
+  }
+  const pairs = [
+    ["{", "}"],
+    ["(", ")"],
+    ["[", "]"]
+  ];
+  const off = [];
+  for (const [open, close] of pairs) {
+    let net = 0;
+    for (const l of file.lines) net += countInCode(file, l, open) - countInCode(file, l, close);
+    if (net !== 0) off.push(`${open}${close} ${net > 0 ? "+" : ""}${net}`);
+  }
+  return off.length > 0 ? `brackets never balance (${off.join(", ")}) \u2014 the file cannot be read as code` : null;
+}
+function findLocalIdentitySites(tree) {
+  const pkg = tree.packageJson;
+  const selfExempt = !pkg?.unreadable && pkg?.json.name === CLOUD_IDENTITY_PACKAGE;
+  const scan = {
+    selfExempt,
+    violations: [],
+    exempt: [],
+    delegatedCalls: 0,
+    unreadable: []
+  };
+  for (const file of tree.files) {
+    const bad = unreadableReason(file);
+    if (bad) scan.unreadable.push({ anchor: file.rel, reason: bad });
+    const bindings = cloudIdentityBindings(file);
+    const statics = staticConstants(file);
+    const catalog = [...MATCHERS, ...aliasMatchers(file)];
+    scan.delegatedCalls += countDelegatedCalls(file, bindings);
+    for (const line of file.lines) {
+      if (line.comment) continue;
+      let hit = null;
+      for (const mt of catalog) {
+        const g = new RegExp(mt.re.source, `${mt.re.flags.replace("g", "")}g`);
+        for (const m of line.raw.matchAll(g)) {
+          const idx = m.index ?? 0;
+          if (!isCodeAt(file, line.n, idx)) continue;
+          if (mt.accept && !mt.accept(m, { file, line, idx, statics })) continue;
+          const callee = mt.callee !== void 0 ? m[mt.callee] : void 0;
+          if (callee && isDelegated(line.raw, idx, callee, bindings)) continue;
+          hit = mt;
+          break;
+        }
+        if (hit) break;
+      }
+      if (!hit) continue;
+      const decl = enclosingDecl(file, line.n);
+      const site = {
+        file: file.rel,
+        line: line.n,
+        primitive: hit.id,
+        category: hit.category,
+        enclosing: decl
+      };
+      const j = findJustification(file, line, decl);
+      if (j?.valid) scan.exempt.push({ ...site, justification: j.text });
+      else scan.violations.push(site);
+    }
+  }
+  return scan;
+}
+function describeSite(s) {
+  const where = s.enclosing ? ` in ${s.enclosing.name} (declared :${s.enclosing.line})` : "";
+  return `${s.file}:${s.line} [${s.category}/${s.primitive}]${where}`;
+}
+function exemptSuffix(exempt) {
+  if (exempt.length === 0) return "";
+  const rows = exempt.map((e) => `${describeSite(e)} \u2014 "${e.justification}"`);
+  return `; EXEMPT (${exempt.length}): ${rows.join("; ")}`;
+}
+function makeLocalIdentity(opts = {}) {
+  const ceiling = opts.ceiling ?? 0;
+  if (!Number.isInteger(ceiling) || ceiling < 0) {
+    throw new Error(`local-identity ceiling must be a non-negative integer, got ${ceiling}`);
+  }
+  return {
+    id: "DLocalIdentity no-local-identity",
+    run(tree) {
+      const controls = localIdentityPositiveControls();
+      const failed = Object.entries(controls).filter(([, ok]) => !ok);
+      if (failed.length > 0) {
+        throw new Error(
+          `DLocalIdentity positive control FAILED: ${failed.map(([k]) => k).join(", ")} \u2014 matcher broken, verdict untrustworthy`
+        );
+      }
+      const id = this.id;
+      const s = findLocalIdentitySites(tree);
+      if (s.selfExempt) {
+        const n = s.violations.length + s.exempt.length;
+        return {
+          id,
+          anchor: tree.packageJson?.path ?? "-",
+          state: "present",
+          verdict: `EXEMPT: the target is ${CLOUD_IDENTITY_PACKAGE} itself, the one place identity primitives live (${n} primitive site(s) not counted)`
+        };
+      }
+      const listed = s.violations.map(describeSite).join("; ");
+      const delegated = `${s.delegatedCalls} call(s) to ${CLOUD_IDENTITY_PACKAGE}`;
+      let decided;
+      if (s.violations.length > ceiling) {
+        const v = s.violations[0];
+        decided = {
+          id,
+          anchor: `${v.file}:${v.line}`,
+          state: "non-conforming",
+          verdict: `${s.violations.length} local identity primitive(s), ceiling ${ceiling} (positive-control OK): ${listed}${exemptSuffix(s.exempt)} -> delegate to ${CLOUD_IDENTITY_PACKAGE} (validateMasterBearer, verifyClerkSessionToken, isMasterScope, ...) or justify the site with "// ${EXEMPT_MARKER} <reason>"`
+        };
+      } else if (s.violations.length > 0) {
+        const v = s.violations[0];
+        decided = {
+          id,
+          anchor: `${v.file}:${v.line}`,
+          state: "present",
+          verdict: `${s.violations.length} local identity primitive(s) at or under the ceiling ${ceiling} \u2014 a ratchet, not a clean bill: ${listed}${exemptSuffix(s.exempt)}`
+        };
+      } else {
+        decided = {
+          id,
+          anchor: s.exempt[0] ? `${s.exempt[0].file}:${s.exempt[0].line}` : "-",
+          state: "present",
+          verdict: `0 local identity primitives; ${delegated} (positive-control OK)${exemptSuffix(s.exempt)}`
+        };
+      }
+      return settle(id, decided, s.unreadable);
+    }
+  };
+}
+var localIdentity = makeLocalIdentity();
+
 // src/detectors/c7-artifact-verifiable.ts
-import { existsSync, readFileSync } from "fs";
-import { join } from "path";
+import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";
+import { join as join2 } from "path";
 var PIN = "a74a042b53c71a095ab88b3073bd47728eeda814";
 var DOC_FILES = ["README.md", "README.fr.md"];
 var INSTALL_RE = /\b(?:npm\s+(?:install|i)|npx|pnpm\s+add|yarn\s+add)\s+(@?[\w./-]+)/i;
@@ -46,10 +1031,10 @@ function c7PositiveControls() {
 }
 function readDocText(root) {
   for (const name of DOC_FILES) {
-    const path = join(root, name);
-    if (!existsSync(path)) continue;
+    const path = join2(root, name);
+    if (!existsSync2(path)) continue;
     try {
-      return { text: readFileSync(path, "utf8"), file: name };
+      return { text: readFileSync3(path, "utf8"), file: name };
     } catch {
     }
   }
@@ -1177,59 +2162,6 @@ var c13ContextCeiling = {
   }
 };
 
-// src/detectors/couldNotJudge.ts
-import { readFileSync as readFileSync2 } from "fs";
-function couldNotJudge(id, anchor, reason) {
-  return {
-    id,
-    anchor,
-    state: "could-not-judge",
-    reason,
-    verdict: `could not judge: ${reason}`
-  };
-}
-function settle(id, decided, unreadable) {
-  if (unreadable.length === 0) return decided;
-  const named = unreadable.map((u) => `${u.anchor}: ${u.reason}`).join("; ");
-  if (decided.state === "non-conforming") {
-    return { ...decided, verdict: `${decided.verdict} [also could not read: ${named}]` };
-  }
-  const judgedRest = decided.state === "could-not-judge" ? ` ${decided.reason ?? decided.verdict}` : ` The readable remainder judged ${decided.state}: ${decided.verdict}`;
-  return couldNotJudge(
-    id,
-    unreadable[0].anchor,
-    `${unreadable.length} input(s) present but unreadable \u2014 ${named}.${judgedRest}`
-  );
-}
-function readJsonObject(path) {
-  let value;
-  try {
-    value = JSON.parse(readFileSync2(path, "utf8"));
-  } catch {
-    return null;
-  }
-  if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-  return value;
-}
-function guardUnreadablePackageJson(inner, opts) {
-  return {
-    ...inner,
-    run(tree) {
-      const decided = inner.run(tree);
-      const pkg = tree.packageJson;
-      if (!pkg?.unreadable) return decided;
-      const u = {
-        anchor: pkg.path,
-        reason: `package.json is present but could not be parsed (${pkg.unreadable})`
-      };
-      if (opts.authoritative && decided.state !== "could-not-judge") {
-        return couldNotJudge(inner.id, u.anchor, `${u.anchor}: ${u.reason}`);
-      }
-      return settle(inner.id, decided, [u]);
-    }
-  };
-}
-
 // src/detectors/c14-catalog-registration.ts
 var PIN3 = "a74a042b53c71a095ab88b3073bd47728eeda814";
 var REQUIRED_FIELDS = [
@@ -1514,11 +2446,11 @@ var c16UntrustedOutput = {
 };
 
 // src/detectors/c17-supply-chain.ts
-import { existsSync as existsSync2, readFileSync as readFileSync3, readdirSync } from "fs";
-import { join as join2 } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync4, readdirSync as readdirSync2 } from "fs";
+import { join as join3 } from "path";
 var PIN4 = "a74a042b53c71a095ab88b3073bd47728eeda814";
 var LOCKFILES = ["package-lock.json", "pnpm-lock.yaml", "yarn.lock", "bun.lock", "bun.lockb"];
-var WORKFLOW_DIR = join2(".github", "workflows");
+var WORKFLOW_DIR = join3(".github", "workflows");
 var PROVENANCE_RE2 = /--provenance\b|\bprovenance\s*:\s*true\b|id-token:\s*write/i;
 function c17PositiveControls() {
   const sample = "npm publish --provenance --access public";
@@ -1534,7 +2466,7 @@ function c17PositiveControls() {
 }
 function findLockfile(root) {
   for (const name of LOCKFILES) {
-    if (existsSync2(join2(root, name))) return name;
+    if (existsSync3(join3(root, name))) return name;
   }
   return null;
 }
@@ -1546,20 +2478,20 @@ function findProvenanceClaim(tree, root) {
       return { site: `${pkg.path}:publishConfig.provenance`, text: "provenance: true" };
     }
   }
-  const workflowsDir = join2(root, WORKFLOW_DIR);
-  if (!existsSync2(workflowsDir)) return null;
+  const workflowsDir = join3(root, WORKFLOW_DIR);
+  if (!existsSync3(workflowsDir)) return null;
   let entries = [];
   try {
-    entries = readdirSync(workflowsDir);
+    entries = readdirSync2(workflowsDir);
   } catch {
     return null;
   }
   for (const name of entries) {
     if (!/\.ya?ml$/.test(name)) continue;
-    const path = join2(workflowsDir, name);
+    const path = join3(workflowsDir, name);
     let text;
     try {
-      text = readFileSync3(path, "utf8");
+      text = readFileSync4(path, "utf8");
     } catch {
       continue;
     }
@@ -1612,17 +2544,17 @@ var c17SupplyChain = guardUnreadablePackageJson(c17SupplyChainInner, {
 });
 
 // src/detectors/c18-structure-manifest.ts
-import { existsSync as existsSync3, readFileSync as readFileSync4 } from "fs";
-import { join as join3 } from "path";
+import { existsSync as existsSync4, readFileSync as readFileSync5 } from "fs";
+import { join as join4 } from "path";
 var PIN5 = "a74a042b53c71a095ab88b3073bd47728eeda814";
 function manifestPath(root) {
-  const extPath = join3(root, "extension.json");
-  if (existsSync3(extPath)) return { kind: "extension", path: extPath };
-  return { kind: "server", path: join3(root, "mcp.json") };
+  const extPath = join4(root, "extension.json");
+  if (existsSync4(extPath)) return { kind: "extension", path: extPath };
+  return { kind: "server", path: join4(root, "mcp.json") };
 }
 function readJson(path) {
   try {
-    return JSON.parse(readFileSync4(path, "utf8"));
+    return JSON.parse(readFileSync5(path, "utf8"));
   } catch {
     return null;
   }
@@ -1670,7 +2602,7 @@ var c18StructureManifestInner = {
     }
     const { kind, path } = manifestPath(tree.root);
     const manifestName = kind === "extension" ? "extension.json" : "mcp.json";
-    if (!existsSync3(path)) {
+    if (!existsSync4(path)) {
       return {
         id: this.id,
         anchor: tree.root,
@@ -1753,89 +2685,6 @@ var c18StructureManifest = guardUnreadablePackageJson(
   { authoritative: false }
 );
 
-// src/scan.ts
-import { existsSync as existsSync4, readFileSync as readFileSync5, readdirSync as readdirSync2, statSync } from "fs";
-import { dirname, join as join4, relative } from "path";
-var SKIP_DIRS = /* @__PURE__ */ new Set([
-  "node_modules",
-  "dist",
-  "build",
-  ".git",
-  "tests",
-  "__tests__",
-  "coverage",
-  // Test material, not a target's served surface: deliberately-malformed
-  // servers and foreign copies live here. Scanning them makes the instrument
-  // trip its own fail-closed detectors when pointed at its own tree, and lints
-  // inputs that are meant to be broken. A real target's fixtures are equally
-  // test inputs, not its product surface.
-  "fixtures"
-]);
-function isCommentLine(raw) {
-  const t = raw.trim();
-  if (t === "") return false;
-  return t.startsWith("*") || t.startsWith("//") || t.startsWith("/*") || t.startsWith("*/");
-}
-function walk(dir, out) {
-  let entries;
-  try {
-    entries = readdirSync2(dir);
-  } catch {
-    return;
-  }
-  for (const name of entries) {
-    const full = join4(dir, name);
-    let st;
-    try {
-      st = statSync(full);
-    } catch {
-      continue;
-    }
-    if (st.isDirectory()) {
-      if (SKIP_DIRS.has(name)) continue;
-      walk(full, out);
-    } else if (name.endsWith(".ts") || name.endsWith(".tsx")) {
-      if (name.endsWith(".d.ts") || name.endsWith(".test.ts")) continue;
-      out.push(full);
-    }
-  }
-}
-function loadFile(path, root) {
-  const raw = readFileSync5(path, "utf8");
-  const lines = raw.split("\n").map((r, i) => ({ n: i + 1, raw: r, comment: isCommentLine(r) }));
-  return { path, rel: relative(root, path) || path, lines };
-}
-function findPackageJson(startDir) {
-  let dir = startDir;
-  for (let depth = 0; depth < 8; depth++) {
-    const candidate = join4(dir, "package.json");
-    if (existsSync4(candidate)) {
-      try {
-        const parsed = JSON.parse(readFileSync5(candidate, "utf8"));
-        if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
-          return { path: candidate, json: {}, unreadable: "not a JSON object" };
-        }
-        return { path: candidate, json: parsed };
-      } catch (err) {
-        return { path: candidate, json: {}, unreadable: err.message };
-      }
-    }
-    const parent = dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  return null;
-}
-function loadTree(root) {
-  const st = statSync(root);
-  const baseDir = st.isDirectory() ? root : dirname(root);
-  const filePaths = [];
-  if (st.isDirectory()) walk(root, filePaths);
-  else if (root.endsWith(".ts") || root.endsWith(".tsx")) filePaths.push(root);
-  const files = filePaths.map((p) => loadFile(p, baseDir));
-  return { root, files, packageJson: findPackageJson(baseDir) };
-}
-
 // src/detectors/c19-served-descriptions.ts
 var PIN6 = "a74a042b53c71a095ab88b3073bd47728eeda814";
 var TOOL_DESC_INLINE_RE = /\b(?:s\.tool|\.tool|registerTool)\s*\(\s*(?:["'`][^"'`]+["'`]|[A-Za-z_$][\w$]*)\s*,\s*["'`]([^"'`]+)["'`]/;
@@ -2509,7 +3358,7 @@ import {
   writeFileSync
 } from "fs";
 import { tmpdir } from "os";
-import { join as join6, relative as relative2 } from "path";
+import { basename as basename2, join as join6, relative as relative2, sep as sep2 } from "path";
 var PIN9 = "20136b50";
 var DEPLOY_CONFIG_FILES = [
   "railway.json",
@@ -2526,15 +3375,44 @@ var LOCKFILES2 = [
   { name: "pnpm-lock.yaml", command: "pnpm", args: ["install", "--frozen-lockfile"] },
   { name: "yarn.lock", command: "yarn", args: ["install", "--frozen-lockfile"] }
 ];
-var SKIP_WALK_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "build", "coverage"]);
-function walkForConfigs(dir, depth, seen) {
+function walkForConfigs(dir, depth, seen, onSkip) {
   if (depth > 8) return;
   let entries;
   try {
-    entries = readdirSync3(dir);
+    entries = readdirSync3(dir);
+  } catch {
+    return;
+  }
+  for (const name of entries) {
+    const full = join6(dir, name);
+    let st;
+    try {
+      st = statSync2(full);
+    } catch {
+      continue;
+    }
+    if (st.isDirectory()) {
+      if (SKIP_DIRS.has(name)) {
+        onSkip(full, depth + 1);
+        continue;
+      }
+      walkForConfigs(full, depth + 1, seen, onSkip);
+    } else if (DEPLOY_CONFIG_FILES.includes(name)) {
+      if (!seen.has(dir)) {
+        seen.set(dir, { dir, configFile: name, configPath: full });
+      }
+    }
+  }
+}
+function probeForCandidate(dir, depth) {
+  if (depth > 8) return null;
+  let entries;
+  try {
+    entries = readdirSync3(dir).sort();
   } catch {
-    return;
+    return null;
   }
+  const subdirs = [];
   for (const name of entries) {
     const full = join6(dir, name);
     let st;
@@ -2544,14 +3422,18 @@ function walkForConfigs(dir, depth, seen) {
       continue;
     }
     if (st.isDirectory()) {
-      if (SKIP_WALK_DIRS.has(name)) continue;
-      walkForConfigs(full, depth + 1, seen);
+      const info = SKIP_DIR_INFO[name];
+      if (info && !info.authored) continue;
+      subdirs.push(full);
     } else if (DEPLOY_CONFIG_FILES.includes(name)) {
-      if (!seen.has(dir)) {
-        seen.set(dir, { dir, configFile: name, configPath: full });
-      }
+      return full;
     }
   }
+  for (const sub of subdirs) {
+    const hit = probeForCandidate(sub, depth + 1);
+    if (hit) return hit;
+  }
+  return null;
 }
 function resolveRailwayRootDirectory(configPath) {
   let text;
@@ -2574,15 +3456,31 @@ function resolveRailwayRootDirectory(configPath) {
   const rootDirectory = typeof parsed.rootDirectory === "string" && parsed.rootDirectory || build && typeof build.rootDirectory === "string" && build.rootDirectory || null;
   return rootDirectory;
 }
-function c26DeriveScope(root) {
+function c26DeriveScope(root, tree) {
   const seen = /* @__PURE__ */ new Map();
-  walkForConfigs(root, 0, seen);
+  const skipped = [];
+  const onSkip = (skippedDir, depth) => {
+    const entry = tree ? recordSkip(tree, skippedDir, root) : {
+      path: relative2(root, skippedDir).split(sep2).join("/"),
+      reason: SKIP_DIR_INFO[basename2(skippedDir)]?.reason ?? "skipped"
+    };
+    if (SKIP_DIR_INFO[basename2(skippedDir)]?.authored) {
+      const hit = probeForCandidate(skippedDir, depth);
+      if (hit) entry.candidate = relative2(root, hit).split(sep2).join("/");
+    }
+    if (!skipped.some((d) => d.path === entry.path)) skipped.push(entry);
+  };
+  walkForConfigs(root, 0, seen, onSkip);
   const sites = [];
   for (const site of seen.values()) {
     if (site.configFile === "railway.json") {
       const resolved = resolveRailwayRootDirectory(site.configPath);
       if (resolved && typeof resolved === "object" && "error" in resolved) {
-        return { sites: [], unparsable: { path: site.configPath, reason: resolved.error } };
+        return {
+          sites: [],
+          skipped,
+          unparsable: { path: site.configPath, reason: resolved.error }
+        };
       }
       if (typeof resolved === "string" && resolved.trim()) {
         sites.push({ ...site, dir: join6(site.dir, resolved) });
@@ -2595,6 +3493,7 @@ function c26DeriveScope(root) {
       } catch (err) {
         return {
           sites: [],
+          skipped,
           unparsable: {
             path: site.configPath,
             reason: `could not parse ${site.configPath} as JSON: ${err instanceof Error ? err.message : String(err)}`
@@ -2604,7 +3503,7 @@ function c26DeriveScope(root) {
     }
     sites.push(site);
   }
-  return { sites };
+  return { sites, skipped };
 }
 function findLockfile2(dir) {
   for (const l of LOCKFILES2) {
@@ -2761,7 +3660,18 @@ var c26SubpackageLockfile = {
   rule: "C-26",
   pin: PIN9,
   run(tree) {
-    const scope = c26DeriveScope(tree.root);
+    const scope = c26DeriveScope(tree.root, tree);
+    const hidden = scope.skipped.filter((d) => d.candidate !== void 0);
+    const unjudgedHidden = (prefix) => {
+      const reason = `${prefix}deployment configuration found only under skipped director${hidden.length === 1 ? "y" : "ies"}: ${hidden.map((d) => `${d.path} (${d.reason}) -> ${d.candidate}`).join("; ")} \u2014 C-26 does not descend into skipped directories, so these site(s) were not judged`;
+      return {
+        id: this.id,
+        anchor: join6(tree.root, hidden[0].candidate),
+        state: "could-not-judge",
+        reason,
+        verdict: `could not judge: ${reason}`
+      };
+    };
     if (scope.unparsable) {
       const reason = `deployment configuration ${scope.unparsable.path} could not be parsed: ${scope.unparsable.reason} \u2014 scope unestablished, C-26 cannot derive its targets`;
       return {
@@ -2773,6 +3683,7 @@ var c26SubpackageLockfile = {
       };
     }
     if (scope.sites.length === 0) {
+      if (hidden.length > 0) return unjudgedHidden("");
       return {
         id: this.id,
         anchor: tree.root,
@@ -2784,6 +3695,7 @@ var c26SubpackageLockfile = {
     const inventory = renderCoverage(scope.sites, verdicts);
     const analysed = verdicts.filter((v) => v.status === "analysed");
     if (analysed.length === 0) {
+      if (hidden.length > 0) return unjudgedHidden("no analysable site; ");
       return {
         id: this.id,
         anchor: tree.root,
@@ -2800,6 +3712,11 @@ var c26SubpackageLockfile = {
         verdict: reds.some((r) => r.detail?.includes("no lockfile")) ? `${reds[0].detail} (C-26). Coverage: ${inventory}` : `${reds.map((r) => r.detail).join(" ; ")} (C-26). Coverage: ${inventory}`
       };
     }
+    if (hidden.length > 0) {
+      return unjudgedHidden(
+        `${analysed.length} analysed site(s) are consistent, but coverage is partial; `
+      );
+    }
     return {
       id: this.id,
       anchor: analysed[0].site.dir,
@@ -4369,24 +5286,12 @@ var dDebugOptIn = {
   }
 };
 
-// src/detectors/dExt1.ts
+// src/detectors/extManifests.ts
 import { readdirSync as readdirSync4, statSync as statSync5 } from "fs";
 import { join as join12 } from "path";
-var IDENTIFIER_RE2 = /^[a-z0-9]+(\.[a-z0-9-]+)+\/[a-z0-9-]+$/;
-var IDENTIFIER_POSITIVE = "com.elpi/middleware-redact-pii";
-var IDENTIFIER_NEGATIVE = "Com.Elpi/Bad_Id";
-function dExt1PositiveControls() {
-  return {
-    identifier: {
-      pattern: IDENTIFIER_RE2.source,
-      positive: IDENTIFIER_RE2.test(IDENTIFIER_POSITIVE),
-      negative: IDENTIFIER_RE2.test(IDENTIFIER_NEGATIVE)
-    }
-  };
-}
-var SKIP_DIRS2 = /* @__PURE__ */ new Set(["node_modules", "dist", "build", ".git", "coverage"]);
-function findExtensionManifests(root) {
+function findExtensionManifests(tree) {
   const out = [];
+  const root = tree.root;
   let base;
   try {
     base = statSync5(root).isDirectory() ? root : join12(root, "..");
@@ -4409,7 +5314,10 @@ function findExtensionManifests(root) {
         continue;
       }
       if (st.isDirectory()) {
-        if (SKIP_DIRS2.has(name)) continue;
+        if (SKIP_DIRS.has(name)) {
+          recordSkip(tree, full, base);
+          continue;
+        }
         walk2(full);
       } else if (name === "extension.json") {
         out.push(full);
@@ -4419,20 +5327,34 @@ function findExtensionManifests(root) {
   walk2(base);
   return out;
 }
+
+// src/detectors/dExt1.ts
+var IDENTIFIER_RE2 = /^[a-z0-9]+(\.[a-z0-9-]+)+\/[a-z0-9-]+$/;
+var IDENTIFIER_POSITIVE = "com.elpi/middleware-redact-pii";
+var IDENTIFIER_NEGATIVE = "Com.Elpi/Bad_Id";
+function dExt1PositiveControls() {
+  return {
+    identifier: {
+      pattern: IDENTIFIER_RE2.source,
+      positive: IDENTIFIER_RE2.test(IDENTIFIER_POSITIVE),
+      negative: IDENTIFIER_RE2.test(IDENTIFIER_NEGATIVE)
+    }
+  };
+}
 var TS_IDENT_LITERAL_RE = /\bidentifier:\s*["'`]([^"'`]*)["'`]/;
-var TS_IDENT_KEY_RE = /\bidentifier:\s*[^\s"'`]/;
+var TS_IDENT_KEY_RE = /\bidentifier:\s*[^\s"'`{]/;
 function findTsIdentifiers(tree) {
   const sites = [];
   const unresolved = [];
   for (const file of tree.files) {
     for (const line of file.lines) {
       if (line.comment) continue;
-      const lit = line.raw.match(TS_IDENT_LITERAL_RE);
+      const lit = matchInCode(file, line, TS_IDENT_LITERAL_RE);
       if (lit) {
         sites.push({ value: lit[1], anchor: `${file.rel}:${line.n}` });
         continue;
       }
-      if (TS_IDENT_KEY_RE.test(line.raw)) {
+      if (testInCode(file, line, TS_IDENT_KEY_RE)) {
         unresolved.push(`${file.rel}:${line.n}`);
       }
     }
@@ -4450,7 +5372,7 @@ var dExt1 = {
     }
     const unreadable = [];
     const decided = (() => {
-      const manifests = findExtensionManifests(tree.root);
+      const manifests = findExtensionManifests(tree);
       for (const manifestPath2 of manifests) {
         const shortPath = manifestPath2.split("/").slice(-2).join("/");
         const parsed = readJsonObject(manifestPath2);
@@ -4517,8 +5439,6 @@ var dExt1 = {
 };
 
 // src/detectors/dExt2.ts
-import { readdirSync as readdirSync5, statSync as statSync6 } from "fs";
-import { join as join13 } from "path";
 var TS_GD_TRUE_RE = /\bgracefulDegradation:\s*true\b/;
 var TS_GD_FALSE_RE = /\bgracefulDegradation:\s*false\b/;
 var TS_GD_KEY_RE = /\bgracefulDegradation:\s*([^\s,}]+)/;
@@ -4533,41 +5453,6 @@ function dExt2PositiveControls() {
     }
   };
 }
-var SKIP_DIRS3 = /* @__PURE__ */ new Set(["node_modules", "dist", "build", ".git", "coverage"]);
-function findExtensionManifests2(root) {
-  const out = [];
-  let base;
-  try {
-    base = statSync6(root).isDirectory() ? root : join13(root, "..");
-  } catch {
-    return out;
-  }
-  const walk2 = (dir) => {
-    let entries;
-    try {
-      entries = readdirSync5(dir);
-    } catch {
-      return;
-    }
-    for (const name of entries) {
-      const full = join13(dir, name);
-      let st;
-      try {
-        st = statSync6(full);
-      } catch {
-        continue;
-      }
-      if (st.isDirectory()) {
-        if (SKIP_DIRS3.has(name)) continue;
-        walk2(full);
-      } else if (name === "extension.json") {
-        out.push(full);
-      }
-    }
-  };
-  walk2(base);
-  return out;
-}
 function findTsFactorySites(tree) {
   const sites = [];
   for (const file of tree.files) {
@@ -4575,7 +5460,7 @@ function findTsFactorySites(tree) {
     for (let i = 0; i < lines.length; i++) {
       const line = lines[i];
       if (line.comment) continue;
-      if (!DEFINE_EXTENSION_OPEN_RE.test(line.raw)) continue;
+      if (!testInCode(file, line, DEFINE_EXTENSION_OPEN_RE)) continue;
       const anchor = `${file.rel}:${line.n}`;
       let depth = 0;
       let started = false;
@@ -4585,20 +5470,20 @@ function findTsFactorySites(tree) {
         const bl = lines[j];
         if (!bl.comment) {
           if (state === "absent") {
-            if (TS_GD_TRUE_RE.test(bl.raw)) {
+            if (testInCode(file, bl, TS_GD_TRUE_RE)) {
               state = "true";
-            } else if (TS_GD_FALSE_RE.test(bl.raw)) {
+            } else if (testInCode(file, bl, TS_GD_FALSE_RE)) {
               state = "false";
             } else {
-              const key = bl.raw.match(TS_GD_KEY_RE);
+              const key = matchInCode(file, bl, TS_GD_KEY_RE);
               if (key) {
                 state = "unresolved";
                 value = key[1];
               }
             }
           }
-          depth += (bl.raw.match(/\{/g) ?? []).length;
-          depth -= (bl.raw.match(/\}/g) ?? []).length;
+          depth += countInCode(file, bl, "{");
+          depth -= countInCode(file, bl, "}");
           if (depth > 0) started = true;
         }
         if (started && depth <= 0) break;
@@ -4619,7 +5504,7 @@ var dExt2 = {
     }
     const unreadable = [];
     const decided = (() => {
-      const manifests = findExtensionManifests2(tree.root);
+      const manifests = findExtensionManifests(tree);
       for (const manifestPath2 of manifests) {
         const shortPath = manifestPath2.split("/").slice(-2).join("/");
         const parsed = readJsonObject(manifestPath2);
@@ -4695,8 +5580,6 @@ var dExt2 = {
 };
 
 // src/detectors/dExt3.ts
-import { readdirSync as readdirSync6, statSync as statSync7 } from "fs";
-import { join as join14 } from "path";
 var TYPE_MATCHERS = [
   { type: "middleware", re: /\bmiddleware\b/ },
   { type: "tool-extension", re: /\btool-ext(?:ension)?\b/ },
@@ -4719,41 +5602,6 @@ function dExt3PositiveControls() {
     }
   };
 }
-var SKIP_DIRS4 = /* @__PURE__ */ new Set(["node_modules", "dist", "build", ".git", "coverage"]);
-function findExtensionManifests3(root) {
-  const out = [];
-  let base;
-  try {
-    base = statSync7(root).isDirectory() ? root : join14(root, "..");
-  } catch {
-    return out;
-  }
-  const walk2 = (dir) => {
-    let entries;
-    try {
-      entries = readdirSync6(dir);
-    } catch {
-      return;
-    }
-    for (const name of entries) {
-      const full = join14(dir, name);
-      let st;
-      try {
-        st = statSync7(full);
-      } catch {
-        continue;
-      }
-      if (st.isDirectory()) {
-        if (SKIP_DIRS4.has(name)) continue;
-        walk2(full);
-      } else if (name === "extension.json") {
-        out.push(full);
-      }
-    }
-  };
-  walk2(base);
-  return out;
-}
 var DEFINE_EXTENSION_OPEN_RE2 = /\bdefineExtension\s*\(\s*\{/;
 var TS_TYPE_LITERAL_RE = /\btype:\s*["'`]([^"'`]*)["'`]/;
 var TS_TYPE_KEY_RE = /\btype:\s*[^\s"'`]/;
@@ -4764,7 +5612,7 @@ function findTsTypeSites(tree) {
     for (let i = 0; i < lines.length; i++) {
       const line = lines[i];
       if (line.comment) continue;
-      if (!DEFINE_EXTENSION_OPEN_RE2.test(line.raw)) continue;
+      if (!testInCode(file, line, DEFINE_EXTENSION_OPEN_RE2)) continue;
       const anchor = `${file.rel}:${line.n}`;
       let depth = 0;
       let started = false;
@@ -4775,17 +5623,17 @@ function findTsTypeSites(tree) {
         const bl = lines[j];
         if (!bl.comment) {
           if (!found) {
-            const lit = bl.raw.match(TS_TYPE_LITERAL_RE);
+            const lit = matchInCode(file, bl, TS_TYPE_LITERAL_RE);
             if (lit) {
               value = lit[1];
               found = true;
-            } else if (TS_TYPE_KEY_RE.test(bl.raw)) {
+            } else if (testInCode(file, bl, TS_TYPE_KEY_RE)) {
               unresolved = true;
               found = true;
             }
           }
-          depth += (bl.raw.match(/\{/g) ?? []).length;
-          depth -= (bl.raw.match(/\}/g) ?? []).length;
+          depth += countInCode(file, bl, "{");
+          depth -= countInCode(file, bl, "}");
           if (depth > 0) started = true;
         }
         if (started && depth <= 0) break;
@@ -4813,7 +5661,7 @@ var dExt3 = {
     const decided = (() => {
       const declared = /* @__PURE__ */ new Set();
       let firstAnchor2 = null;
-      const manifests = findExtensionManifests3(tree.root);
+      const manifests = findExtensionManifests(tree);
       for (const manifestPath2 of manifests) {
         const shortPath = manifestPath2.split("/").slice(-2).join("/");
         const parsed = readJsonObject(manifestPath2);
@@ -4920,8 +5768,8 @@ var dExt3 = {
 };
 
 // src/detectors/dExt4.ts
-import { readdirSync as readdirSync7, statSync as statSync8 } from "fs";
-import { join as join15 } from "path";
+import { readdirSync as readdirSync5, statSync as statSync6 } from "fs";
+import { join as join13 } from "path";
 function canonical(name) {
   return name.replace(/[-_]/g, "").toLowerCase();
 }
@@ -4940,71 +5788,40 @@ function dExt4PositiveControls() {
     }
   };
 }
-var SKIP_DIRS5 = /* @__PURE__ */ new Set(["node_modules", "dist", "build", ".git", "coverage"]);
-function findExtensionManifests4(root) {
+function findHooksDirs(tree) {
+  const root = tree.root;
   const out = [];
   let base;
   try {
-    base = statSync8(root).isDirectory() ? root : join15(root, "..");
+    base = statSync6(root).isDirectory() ? root : join13(root, "..");
   } catch {
     return out;
   }
   const walk2 = (dir) => {
     let entries;
     try {
-      entries = readdirSync7(dir);
+      entries = readdirSync5(dir);
     } catch {
       return;
     }
     for (const name of entries) {
-      const full = join15(dir, name);
+      const full = join13(dir, name);
       let st;
       try {
-        st = statSync8(full);
+        st = statSync6(full);
       } catch {
         continue;
       }
-      if (st.isDirectory()) {
-        if (SKIP_DIRS5.has(name)) continue;
-        walk2(full);
-      } else if (name === "extension.json") {
-        out.push(full);
-      }
-    }
-  };
-  walk2(base);
-  return out;
-}
-function findHooksDirs(root) {
-  const out = [];
-  let base;
-  try {
-    base = statSync8(root).isDirectory() ? root : join15(root, "..");
-  } catch {
-    return out;
-  }
-  const walk2 = (dir) => {
-    let entries;
-    try {
-      entries = readdirSync7(dir);
-    } catch {
-      return;
-    }
-    for (const name of entries) {
-      const full = join15(dir, name);
-      let st;
-      try {
-        st = statSync8(full);
-      } catch {
+      if (!st.isDirectory()) continue;
+      if (SKIP_DIRS.has(name)) {
+        recordSkip(tree, full, base);
         continue;
       }
-      if (!st.isDirectory()) continue;
-      if (SKIP_DIRS5.has(name)) continue;
       if (name === "hooks") {
         const tokens = /* @__PURE__ */ new Set();
         let files;
         try {
-          files = readdirSync7(full);
+          files = readdirSync5(full);
         } catch {
           files = [];
         }
@@ -5033,7 +5850,7 @@ function findFactorySites(tree) {
     for (let i = 0; i < lines.length; i++) {
       const line = lines[i];
       if (line.comment) continue;
-      if (LIFECYCLE_OBJ_RE.test(line.raw)) {
+      if (testInCode(file, line, LIFECYCLE_OBJ_RE)) {
         const anchor = `${file.rel}:${line.n}`;
         const tokens = /* @__PURE__ */ new Set();
         let depth = 0;
@@ -5041,20 +5858,19 @@ function findFactorySites(tree) {
         for (let j = i; j < lines.length; j++) {
           const bl = lines[j];
           if (bl.comment) continue;
-          const raw = bl.raw;
           if (started && depth === 1) {
-            const k = raw.match(OBJECT_KEY_RE);
+            const k = matchInCode(file, bl, OBJECT_KEY_RE);
             if (k) tokens.add(canonical(k[1]));
           }
-          depth += (raw.match(/\{/g) ?? []).length;
-          depth -= (raw.match(/\}/g) ?? []).length;
+          depth += countInCode(file, bl, "{");
+          depth -= countInCode(file, bl, "}");
           if (depth > 0) started = true;
           if (started && depth <= 0) break;
         }
         sites.push({ anchor, tokens });
         continue;
       }
-      if (LIFECYCLE_KEY_RE.test(line.raw)) {
+      if (testInCode(file, line, LIFECYCLE_KEY_RE)) {
         unresolved.push(`${file.rel}:${line.n}`);
       }
     }
@@ -5082,7 +5898,7 @@ var dExt4 = {
     }
     const unreadable = [];
     const decided = (() => {
-      const hooksDirs = findHooksDirs(tree.root);
+      const hooksDirs = findHooksDirs(tree);
       const { sites, unresolved } = findFactorySites(tree);
       for (const anchor of unresolved) {
         unreadable.push({
@@ -5094,7 +5910,7 @@ var dExt4 = {
       for (const d of hooksDirs) for (const t of d.tokens) implemented.add(t);
       for (const s of sites) for (const t of s.tokens) implemented.add(t);
       const implSurfacePresent = hooksDirs.length > 0 || sites.length > 0;
-      const manifests = findExtensionManifests4(tree.root);
+      const manifests = findExtensionManifests(tree);
       let declaredAnyLifecycle = false;
       for (const manifestPath2 of manifests) {
         const shortPath = manifestPath2.split("/").slice(-2).join("/");
@@ -5163,8 +5979,8 @@ var dExt4 = {
 };
 
 // src/detectors/dExt5.ts
-import { existsSync as existsSync12, readdirSync as readdirSync8, statSync as statSync9 } from "fs";
-import { dirname as dirname7, join as join16 } from "path";
+import { existsSync as existsSync12 } from "fs";
+import { dirname as dirname7, join as join14 } from "path";
 function nonEmptyString(v) {
   return typeof v === "string" && v.trim().length > 0;
 }
@@ -5178,41 +5994,6 @@ function dExt5PositiveControls() {
     }
   };
 }
-var SKIP_DIRS6 = /* @__PURE__ */ new Set(["node_modules", "dist", "build", ".git", "coverage"]);
-function findExtensionManifests5(root) {
-  const out = [];
-  let base;
-  try {
-    base = statSync9(root).isDirectory() ? root : join16(root, "..");
-  } catch {
-    return out;
-  }
-  const walk2 = (dir) => {
-    let entries;
-    try {
-      entries = readdirSync8(dir);
-    } catch {
-      return;
-    }
-    for (const name of entries) {
-      const full = join16(dir, name);
-      let st;
-      try {
-        st = statSync9(full);
-      } catch {
-        continue;
-      }
-      if (st.isDirectory()) {
-        if (SKIP_DIRS6.has(name)) continue;
-        walk2(full);
-      } else if (name === "extension.json") {
-        out.push(full);
-      }
-    }
-  };
-  walk2(base);
-  return out;
-}
 function isToolExtension(type) {
   return typeof type === "string" && type.includes("tool-extension");
 }
@@ -5225,7 +6006,7 @@ var dExt5 = {
         `DExt5 bilingual control FAILED: accept(\`${FR_POSITIVE}\`)=${controls.descriptionFr.positive} reject(empty)=${!controls.descriptionFr.negative} \u2014 FR-string matcher broken, absence verdict untrustworthy`
       );
     }
-    const manifests = findExtensionManifests5(tree.root);
+    const manifests = findExtensionManifests(tree);
     if (manifests.length === 0) {
       return {
         id: this.id,
@@ -5259,7 +6040,7 @@ var dExt5 = {
       if (!nonEmptyString(parsed.description_fr)) {
         missing.push("description_fr (extension.json)");
       }
-      if (!existsSync12(join16(root, "README.fr.md"))) {
+      if (!existsSync12(join14(root, "README.fr.md"))) {
         missing.push("README.fr.md");
       }
       if (isToolExtension(parsed.type) && "tools" in parsed) {
@@ -5302,8 +6083,8 @@ var dExt5 = {
 };
 
 // src/detectors/dExt7.ts
-import { existsSync as existsSync13, readdirSync as readdirSync9, statSync as statSync10 } from "fs";
-import { dirname as dirname8, join as join17 } from "path";
+import { existsSync as existsSync13 } from "fs";
+import { dirname as dirname8, join as join15 } from "path";
 var ABSENCE_FLAG_FIELDS = [
   "extensionAbsent",
   "extension_absent",
@@ -5346,41 +6127,6 @@ function dExt7PositiveControls() {
     negative: isAbsenceCase(ABSENCE_NEGATIVE)
   };
 }
-var SKIP_DIRS7 = /* @__PURE__ */ new Set(["node_modules", "dist", "build", ".git", "coverage"]);
-function findExtensionManifests6(root) {
-  const out = [];
-  let base;
-  try {
-    base = statSync10(root).isDirectory() ? root : join17(root, "..");
-  } catch {
-    return out;
-  }
-  const walk2 = (dir) => {
-    let entries;
-    try {
-      entries = readdirSync9(dir);
-    } catch {
-      return;
-    }
-    for (const name of entries) {
-      const full = join17(dir, name);
-      let st;
-      try {
-        st = statSync10(full);
-      } catch {
-        continue;
-      }
-      if (st.isDirectory()) {
-        if (SKIP_DIRS7.has(name)) continue;
-        walk2(full);
-      } else if (name === "extension.json") {
-        out.push(full);
-      }
-    }
-  };
-  walk2(base);
-  return out;
-}
 var dExt7 = {
   id: "DExt7 eval-coverage",
   run(tree) {
@@ -5390,7 +6136,7 @@ var dExt7 = {
         `DExt7 absence-matcher control FAILED: flag=${controls.flag} token=${controls.token} label=${controls.label} reject(normal)=${!controls.negative} \u2014 absence matcher broken, eval-coverage verdict untrustworthy`
       );
     }
-    const manifests = findExtensionManifests6(tree.root);
+    const manifests = findExtensionManifests(tree);
     if (manifests.length === 0) {
       return {
         id: this.id,
@@ -5404,7 +6150,7 @@ var dExt7 = {
       for (const manifestPath2 of manifests) {
         const extDir = dirname8(manifestPath2);
         const extLabel = extDir.split("/").pop() ?? extDir;
-        const evalsPath = join17(extDir, "evals", "evals.json");
+        const evalsPath = join15(extDir, "evals", "evals.json");
         const shortPath = `${extLabel}/evals/evals.json`;
         if (!existsSync13(evalsPath)) {
           return {
@@ -5470,8 +6216,8 @@ var dExt7 = {
 };
 
 // src/detectors/dExt8.ts
-import { existsSync as existsSync14, readdirSync as readdirSync10, statSync as statSync11 } from "fs";
-import { dirname as dirname9, join as join18 } from "path";
+import { existsSync as existsSync14 } from "fs";
+import { dirname as dirname9, join as join16 } from "path";
 var SEMVER_RE2 = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$/;
 var POSITIVE_CONTROL5 = "1.2.3-beta.1+build.7";
 function dExt8PositiveControl() {
@@ -5481,41 +6227,6 @@ function dExt8PositiveControl() {
     matched: SEMVER_RE2.test(POSITIVE_CONTROL5)
   };
 }
-var SKIP_DIRS8 = /* @__PURE__ */ new Set(["node_modules", "dist", "build", ".git", "coverage"]);
-function findExtensionManifests7(root) {
-  const out = [];
-  let base;
-  try {
-    base = statSync11(root).isDirectory() ? root : join18(root, "..");
-  } catch {
-    return out;
-  }
-  const walk2 = (dir) => {
-    let entries;
-    try {
-      entries = readdirSync10(dir);
-    } catch {
-      return;
-    }
-    for (const name of entries) {
-      const full = join18(dir, name);
-      let st;
-      try {
-        st = statSync11(full);
-      } catch {
-        continue;
-      }
-      if (st.isDirectory()) {
-        if (SKIP_DIRS8.has(name)) continue;
-        walk2(full);
-      } else if (name === "extension.json") {
-        out.push(full);
-      }
-    }
-  };
-  walk2(base);
-  return out;
-}
 var dExt8 = {
   id: "DExt8 semver+changelog",
   run(tree) {
@@ -5525,7 +6236,7 @@ var dExt8 = {
         `DExt8 positive control FAILED: pattern /${control.pattern}/ did not match sample \`${control.sample}\` \u2014 matcher broken, verdict untrustworthy`
       );
     }
-    const manifests = findExtensionManifests7(tree.root);
+    const manifests = findExtensionManifests(tree);
     if (manifests.length === 0) {
       return {
         id: this.id,
@@ -5540,7 +6251,7 @@ var dExt8 = {
     for (const manifestPath2 of manifests) {
       const extDir = dirname9(manifestPath2);
       const extLabel = extDir.split("/").pop() ?? extDir;
-      const pkgPath = join18(extDir, "package.json");
+      const pkgPath = join16(extDir, "package.json");
       const shortPkgPath = `${extLabel}/package.json`;
       if (!existsSync14(pkgPath)) {
         unreadable.push({
@@ -5577,7 +6288,7 @@ var dExt8 = {
         continue;
       }
       const validSemver = SEMVER_RE2.test(version);
-      const changelogPath = join18(extDir, "CHANGELOG.md");
+      const changelogPath = join16(extDir, "CHANGELOG.md");
       const hasChangelog = existsSync14(changelogPath);
       if (!validSemver) {
         finding ??= {
@@ -5612,38 +6323,41 @@ var dExt8 = {
 };
 
 // src/detectors/dExt9.ts
-import { readFileSync as readFileSync10, readdirSync as readdirSync11, statSync as statSync12 } from "fs";
-import { join as join19 } from "path";
-var SKIP_DIRS9 = /* @__PURE__ */ new Set(["node_modules", "dist", "build", ".git", "coverage"]);
-function collectHooksDirSources(root, unreadable) {
+import { readFileSync as readFileSync10, readdirSync as readdirSync6, statSync as statSync7 } from "fs";
+import { join as join17 } from "path";
+function collectHooksDirSources(tree, unreadable) {
+  const root = tree.root;
   const out = [];
   let base;
   try {
-    base = statSync12(root).isDirectory() ? root : join19(root, "..");
+    base = statSync7(root).isDirectory() ? root : join17(root, "..");
   } catch {
     return out;
   }
   const walk2 = (dir) => {
     let entries;
     try {
-      entries = readdirSync11(dir);
+      entries = readdirSync6(dir);
     } catch {
       return;
     }
     for (const name of entries) {
-      const full = join19(dir, name);
+      const full = join17(dir, name);
       let st;
       try {
-        st = statSync12(full);
+        st = statSync7(full);
       } catch {
         continue;
       }
       if (!st.isDirectory()) continue;
-      if (SKIP_DIRS9.has(name)) continue;
+      if (SKIP_DIRS.has(name)) {
+        recordSkip(tree, full, base);
+        continue;
+      }
       if (name === "hooks") {
         let files;
         try {
-          files = readdirSync11(full);
+          files = readdirSync6(full);
         } catch {
           files = [];
         }
@@ -5651,7 +6365,7 @@ function collectHooksDirSources(root, unreadable) {
           if (!f.endsWith(".ts") || f.endsWith(".d.ts")) continue;
           const stem = f.replace(/\.ts$/, "");
           if (stem === "index") continue;
-          const filePath = join19(full, f);
+          const filePath = join17(full, f);
           let body;
           try {
             body = readFileSync10(filePath, "utf8");
@@ -5685,7 +6399,7 @@ function collectFactorySources(tree) {
     for (let i = 0; i < lines.length; i++) {
       const line = lines[i];
       if (line.comment) continue;
-      if (!LIFECYCLE_OBJ_RE2.test(line.raw)) continue;
+      if (!testInCode(file, line, LIFECYCLE_OBJ_RE2)) continue;
       let depth = 0;
       let started = false;
       let curKey = null;
@@ -5695,7 +6409,7 @@ function collectFactorySources(tree) {
         if (bl.comment) continue;
         const raw = bl.raw;
         if (started && depth === 1) {
-          const k = raw.match(OBJECT_KEY_RE2);
+          const k = matchInCode(file, bl, OBJECT_KEY_RE2);
           if (k) {
             curKey = canonical(k[1]);
             keyBodies.set(curKey, []);
@@ -5704,8 +6418,8 @@ function collectFactorySources(tree) {
         if (curKey && depth >= 1) {
           keyBodies.get(curKey)?.push(raw);
         }
-        depth += (raw.match(/\{/g) ?? []).length;
-        depth -= (raw.match(/\}/g) ?? []).length;
+        depth += countInCode(file, bl, "{");
+        depth -= countInCode(file, bl, "}");
         if (depth > 0) started = true;
         if (started && depth <= 0) break;
       }
@@ -5756,7 +6470,7 @@ var dExt9 = {
     const unreadable = [];
     const decided = (() => {
       const hookSources = [
-        ...collectHooksDirSources(tree.root, unreadable),
+        ...collectHooksDirSources(tree, unreadable),
         ...collectFactorySources(tree)
       ];
       const implByToken = /* @__PURE__ */ new Map();
@@ -5765,7 +6479,7 @@ var dExt9 = {
         list.push(s);
         implByToken.set(s.token, list);
       }
-      const manifests = findExtensionManifests4(tree.root);
+      const manifests = findExtensionManifests(tree);
       let declaredAnyLifecycle = false;
       for (const manifestPath2 of manifests) {
         const shortPath = manifestPath2.split("/").slice(-2).join("/");
@@ -6547,22 +7261,23 @@ var detectors = [
   dExt5,
   dExt7,
   dExt8,
-  dExt9
+  dExt9,
+  localIdentity
 ];
 
 // src/runtime/launch.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import { existsSync as existsSync15, readFileSync as readFileSync11, statSync as statSync13 } from "fs";
-import { dirname as dirname10, isAbsolute, join as join20, resolve } from "path";
+import { existsSync as existsSync15, readFileSync as readFileSync11, statSync as statSync8 } from "fs";
+import { dirname as dirname10, isAbsolute, join as join18, resolve } from "path";
 function findPackageDir(target) {
   let dir;
   try {
-    dir = statSync13(target).isDirectory() ? target : dirname10(target);
+    dir = statSync8(target).isDirectory() ? target : dirname10(target);
   } catch {
     return null;
   }
   for (let depth = 0; depth < 8; depth++) {
-    if (existsSync15(join20(dir, "package.json"))) return dir;
+    if (existsSync15(join18(dir, "package.json"))) return dir;
     const parent = dirname10(dir);
     if (parent === dir) break;
     dir = parent;
@@ -6587,10 +7302,10 @@ function deriveLaunchPlan(target) {
   }
   let pkg;
   try {
-    pkg = JSON.parse(readFileSync11(join20(pkgDir, "package.json"), "utf8"));
+    pkg = JSON.parse(readFileSync11(join18(pkgDir, "package.json"), "utf8"));
   } catch (err) {
     return {
-      error: `could not parse ${join20(pkgDir, "package.json")}: ${err instanceof Error ? err.message : String(err)}`
+      error: `could not parse ${join18(pkgDir, "package.json")}: ${err instanceof Error ? err.message : String(err)}`
     };
   }
   const bin = firstBinEntry(pkg.bin);
@@ -6668,7 +7383,7 @@ function readEvalCounts(target) {
   if (!pkgDir) return counts;
   let dir = pkgDir;
   for (let depth = 0; depth < 8; depth++) {
-    const candidate = join20(dir, "evals", "evals.json");
+    const candidate = join18(dir, "evals", "evals.json");
     if (existsSync15(candidate)) {
       try {
         const parsed = JSON.parse(readFileSync11(candidate, "utf8"));
@@ -6687,7 +7402,7 @@ function readEvalCounts(target) {
 }
 function statSyncSafe(p) {
   try {
-    return statSync13(p).isDirectory();
+    return statSync8(p).isDirectory();
   } catch {
     return false;
   }
@@ -6806,6 +7521,9 @@ function reconcile(id, staticR, dynamicR) {
   };
 }
 function runDoctor(target, detectorList = detectors, opts = {}) {
+  return runDoctorReport(target, detectorList, opts).results;
+}
+function runDoctorReport(target, detectorList = detectors, opts = {}) {
   const mode = opts.mode ?? "static";
   const tree = loadTree(target);
   const needsRuntime = mode !== "static" && detectorList.some((d) => typeof d.runDynamic === "function");
@@ -6840,7 +7558,7 @@ function runDoctor(target, detectorList = detectors, opts = {}) {
       results.push(reconcile(d.id, staticR, dynamicR));
     }
   }
-  return results;
+  return { results, skipped: tree.skippedDirs };
 }
 async function invokeLiveChecked(d, session) {
   if (!session) {
@@ -6895,14 +7613,32 @@ async function runDoctorAsync(target, opts = {}) {
   }
   return results;
 }
-function renderTable(surface, results) {
+function renderSkipped(skipped) {
+  if (skipped.length === 0) {
+    return "skipped directories (0) \u2014 none: no directory was skipped on this run.";
+  }
+  const sorted = [...skipped].sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+  const head = `skipped directories (${sorted.length}) \u2014 NOT read on this run; a verdict above says nothing about what lies inside:`;
+  const rows = sorted.map(
+    (d) => `${d.path} | ${d.reason}${d.candidate ? ` | holds a deployment configuration: ${d.candidate}` : ""}`
+  );
+  return [head, "-".repeat(head.length), ...rows].join("\n");
+}
+function renderTable(surface, results, skipped) {
+  const body = renderResults(surface, results);
+  const section = skipped === void 0 ? "skipped directories: NOT REPORTED \u2014 the caller did not pass this run's skipped list (use runDoctorReport), so the scope above may be narrower than it reads." : renderSkipped(skipped);
+  return `${body}
+
+${section}`;
+}
+function renderResults(surface, results) {
   const cols = { item: 24, anchor: 26, state: 15 };
   const header = `${pad("item", cols.item)} | ${pad("file:line", cols.anchor)} | ${pad("state", cols.state)} | verdict`;
-  const sep = "-".repeat(header.length);
+  const sep3 = "-".repeat(header.length);
   const rows = results.map(
     (r) => `${pad(r.id, cols.item)} | ${pad(r.anchor, cols.anchor)} | ${pad(r.state, cols.state)} | ${r.verdict}`
   );
-  const table = [`surface: ${surface}`, header, sep, ...rows].join("\n");
+  const table = [`surface: ${surface}`, header, sep3, ...rows].join("\n");
   const unjudged = results.filter((r) => r.state === "could-not-judge");
   if (unjudged.length === 0) return table;
   const cnjHeader = `could-not-judge (${unjudged.length}) \u2014 the doctor could NOT read these; this is NOT a clean bill:`;
@@ -6923,6 +7659,9 @@ var USAGE = [
   "  --mode=static   read the tree only (default)",
   "  --mode=dynamic  launch the server and judge what it serves",
   "  --mode=both     both, dynamic findings taking precedence",
+  "  --local-identity-ceiling=N",
+  "                  local identity primitives tolerated before DLocalIdentity",
+  "                  fails (default 0)",
   "  --version       print the version and exit",
   "  --help          print this and exit",
   "",
@@ -6931,7 +7670,7 @@ var USAGE = [
 function readVersion() {
   try {
     const here = dirname11(fileURLToPath(import.meta.url));
-    const manifest = JSON.parse(readFileSync12(join21(here, "..", "package.json"), "utf8"));
+    const manifest = JSON.parse(readFileSync12(join19(here, "..", "package.json"), "utf8"));
     return manifest.version ?? null;
   } catch {
     return null;
@@ -6963,8 +7702,20 @@ function main() {
     console.error(`unknown --mode "${mode}" \u2014 expected static|dynamic|both`);
     process.exit(1);
   }
-  const results = runDoctor(target, void 0, { mode });
-  console.log(renderTable(target, results));
+  const ceilingArg = args.find((a) => a.startsWith("--local-identity-ceiling="));
+  let detectorList = detectors;
+  if (ceilingArg) {
+    const raw = ceilingArg.slice("--local-identity-ceiling=".length);
+    const ceiling = /^\d+$/.test(raw) ? Number(raw) : Number.NaN;
+    if (!Number.isInteger(ceiling)) {
+      console.error(`invalid --local-identity-ceiling "${raw}" \u2014 expected a non-negative integer`);
+      process.exit(1);
+    }
+    const ratchet = makeLocalIdentity({ ceiling });
+    detectorList = detectors.map((d) => d === localIdentity ? ratchet : d);
+  }
+  const { results, skipped } = runDoctorReport(target, detectorList, { mode });
+  console.log(renderTable(target, results, skipped));
   process.exitCode = computeExitCode(results);
 }
 function isDirectInvocation() {
@@ -6986,7 +7737,9 @@ if (isDirectInvocation()) main();
 export {
   computeExitCode,
   isLiveDetector,
+  renderSkipped,
   renderTable,
   runDoctor,
-  runDoctorAsync
+  runDoctorAsync,
+  runDoctorReport
 };