@vantageos/mcp-doctor 0.3.2 → 0.5.0

package/dist/doctor.js

@@ -1,13 +1,999 @@
 #!/usr/bin/env node
 
 // src/doctor.ts
-import { readFileSync as readFileSync12, realpathSync } from "fs";
-import { dirname as dirname11, join as join21, resolve as resolve2 } from "path";
+import { readFileSync as readFileSync13, realpathSync } from "fs";
+import { dirname as dirname12, join as join20, resolve as resolve2 } from "path";
 import { fileURLToPath } from "url";
 
+// src/scan.ts
+import { existsSync, readFileSync, readdirSync, statSync } from "fs";
+import { basename, dirname, join, relative, sep } from "path";
+var SKIP_DIR_INFO = {
+  node_modules: { reason: "vendored dependencies", authored: false },
+  dist: { reason: "build output", authored: false },
+  build: { reason: "build output", authored: false },
+  ".git": { reason: "version-control metadata", authored: false },
+  coverage: { reason: "generated coverage output", authored: false },
+  // `authored: true` marks content the target's own authors wrote, as opposed
+  // to vendored or generated content. A walk that looks for a site (C-26) may
+  // probe an authored directory it skips: a deployable there would otherwise
+  // be reported as if it did not exist.
+  tests: { reason: "test material", authored: true },
+  __tests__: { reason: "test material", authored: true },
+  // Test material, not a target's served surface: deliberately-malformed
+  // servers and foreign copies live here. Scanning them makes the instrument
+  // trip its own fail-closed detectors when pointed at its own tree, and lints
+  // inputs that are meant to be broken. A real target's fixtures are equally
+  // test inputs, not its product surface.
+  fixtures: { reason: "test material (fixtures)", authored: true }
+};
+var SKIP_DIRS = new Set(Object.keys(SKIP_DIR_INFO));
+function recordSkip(tree, dir, root, reason) {
+  const path = relative(root, dir).split(sep).join("/");
+  const existing = tree.skippedDirs.find((d) => d.path === path);
+  if (existing) return existing;
+  const entry = {
+    path,
+    reason: reason ?? SKIP_DIR_INFO[basename(dir)]?.reason ?? "skipped"
+  };
+  tree.skippedDirs.push(entry);
+  return entry;
+}
+function isCommentLine(raw) {
+  const t = raw.trim();
+  if (t === "") return false;
+  return t.startsWith("*") || t.startsWith("//") || t.startsWith("/*") || t.startsWith("*/");
+}
+function walk(dir, out, onSkip) {
+  let entries;
+  try {
+    entries = readdirSync(dir);
+  } catch {
+    return;
+  }
+  for (const name of entries) {
+    const full = join(dir, name);
+    let st;
+    try {
+      st = statSync(full);
+    } catch {
+      continue;
+    }
+    if (st.isDirectory()) {
+      if (SKIP_DIRS.has(name)) {
+        onSkip(full);
+        continue;
+      }
+      walk(full, out, onSkip);
+    } else if (name.endsWith(".ts") || name.endsWith(".tsx")) {
+      if (name.endsWith(".d.ts") || name.endsWith(".test.ts")) continue;
+      out.push(full);
+    }
+  }
+}
+function loadFile(path, root) {
+  const raw = readFileSync(path, "utf8");
+  const lines = raw.split("\n").map((r, i) => ({ n: i + 1, raw: r, comment: isCommentLine(r) }));
+  const file = { path, rel: relative(root, path) || path, lines };
+  const mask = maskOf(file);
+  for (const line of lines) {
+    if (line.comment) continue;
+    const row = mask[line.n - 1];
+    let any = false;
+    let allComment = true;
+    for (let c = 0; c < line.raw.length; c++) {
+      if (line.raw[c] === " " || line.raw[c] === "	" || line.raw[c] === "\r") continue;
+      any = true;
+      if (row[c] !== COM) {
+        allComment = false;
+        break;
+      }
+    }
+    if (any && allComment) line.comment = true;
+  }
+  return file;
+}
+function findPackageJson(startDir) {
+  let dir = startDir;
+  for (let depth = 0; depth < 8; depth++) {
+    const candidate = join(dir, "package.json");
+    if (existsSync(candidate)) {
+      try {
+        const parsed = JSON.parse(readFileSync(candidate, "utf8"));
+        if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+          return { path: candidate, json: {}, unreadable: "not a JSON object" };
+        }
+        return { path: candidate, json: parsed };
+      } catch (err) {
+        return { path: candidate, json: {}, unreadable: err.message };
+      }
+    }
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return null;
+}
+function loadTree(root, backendRoot) {
+  const st = statSync(root);
+  const baseDir = st.isDirectory() ? root : dirname(root);
+  const filePaths = [];
+  const tree = { root, files: [], packageJson: null, skippedDirs: [] };
+  if (backendRoot !== void 0) tree.backendRoot = backendRoot;
+  if (st.isDirectory()) walk(root, filePaths, (d) => recordSkip(tree, d, root));
+  else if (root.endsWith(".ts") || root.endsWith(".tsx")) filePaths.push(root);
+  tree.files = filePaths.map((p) => loadFile(p, baseDir));
+  tree.packageJson = findPackageJson(baseDir);
+  return tree;
+}
+var COM = 1;
+var CODE = 2;
+var maskCache = /* @__PURE__ */ new WeakMap();
+function buildCodeMask(file) {
+  const mask = [];
+  let mode = "code";
+  const tplStack = [];
+  let braceDepth = 0;
+  let prevSig = "";
+  let prevWord = "";
+  const regexAfterKeyword = /* @__PURE__ */ new Set([
+    "case",
+    "default",
+    "delete",
+    "do",
+    "else",
+    "extends",
+    "in",
+    "instanceof",
+    "new",
+    "of",
+    "return",
+    "throw",
+    "typeof",
+    "void",
+    "yield",
+    "await"
+  ]);
+  const regexAfter = /* @__PURE__ */ new Set([
+    "",
+    "(",
+    ",",
+    "=",
+    ":",
+    "[",
+    "!",
+    "&",
+    "|",
+    "?",
+    "{",
+    "}",
+    ";",
+    "+",
+    "-",
+    "*",
+    "%",
+    "<",
+    ">",
+    "~",
+    "^"
+  ]);
+  for (const line of file.lines) {
+    const s = line.raw;
+    const row = new Uint8Array(s.length);
+    let i = 0;
+    while (i < s.length) {
+      const c = s[i];
+      const n = s[i + 1];
+      if (mode === "block") {
+        row[i] = COM;
+        if (c === "*" && n === "/") {
+          row[i + 1] = COM;
+          i += 2;
+          mode = "code";
+        } else i++;
+        continue;
+      }
+      if (mode === "sq" || mode === "dq") {
+        if (c === "\\") i += 2;
+        else if (mode === "sq" && c === "'" || mode === "dq" && c === '"') {
+          row[i] = CODE;
+          i++;
+          mode = "code";
+          prevSig = c;
+        } else i++;
+        continue;
+      }
+      if (mode === "tpl") {
+        if (c === "\\") i += 2;
+        else if (c === "`") {
+          row[i] = CODE;
+          i++;
+          mode = "code";
+          prevSig = c;
+        } else if (c === "$" && n === "{") {
+          row[i] = CODE;
+          row[i + 1] = CODE;
+          tplStack.push(braceDepth);
+          braceDepth++;
+          i += 2;
+          mode = "code";
+          prevSig = "{";
+        } else i++;
+        continue;
+      }
+      if (mode === "re" || mode === "recls") {
+        if (c === "\\") i += 2;
+        else if (mode === "re" && c === "[") {
+          mode = "recls";
+          i++;
+        } else if (mode === "recls" && c === "]") {
+          mode = "re";
+          i++;
+        } else if (mode === "re" && c === "/") {
+          row[i] = CODE;
+          i++;
+          mode = "code";
+          prevSig = "/";
+        } else i++;
+        continue;
+      }
+      if (c === "/" && n === "/") {
+        row.fill(COM, i);
+        break;
+      }
+      if (c === "/" && n === "*") {
+        mode = "block";
+        row[i] = COM;
+        row[i + 1] = COM;
+        i += 2;
+        continue;
+      }
+      row[i] = CODE;
+      const wordBefore = prevWord;
+      if (c !== " " && c !== "	") prevWord = "";
+      if (/[A-Za-z_$]/.test(c)) {
+        let j = i + 1;
+        while (j < s.length && /[\w$]/.test(s[j])) j++;
+        for (let k = i; k < j; k++) row[k] = CODE;
+        prevWord = prevSig === "." ? "" : s.slice(i, j);
+        prevSig = s[j - 1];
+        i = j;
+        continue;
+      }
+      if (c === '"' || c === "'" || c === "`") {
+        mode = c === '"' ? "dq" : c === "'" ? "sq" : "tpl";
+        i++;
+        continue;
+      }
+      if (c === "/" && (regexAfter.has(prevSig) || regexAfterKeyword.has(wordBefore))) {
+        mode = "re";
+        i++;
+        continue;
+      }
+      if (c === "{") braceDepth++;
+      else if (c === "}") {
+        braceDepth--;
+        if (tplStack.length > 0 && tplStack[tplStack.length - 1] === braceDepth) {
+          tplStack.pop();
+          mode = "tpl";
+          i++;
+          continue;
+        }
+      }
+      if (c !== " " && c !== "	") prevSig = c;
+      i++;
+    }
+    if (mode === "sq" || mode === "dq" || mode === "re" || mode === "recls") mode = "code";
+    mask.push(row);
+  }
+  return mask;
+}
+function maskOf(file) {
+  let mask = maskCache.get(file);
+  if (!mask) {
+    mask = buildCodeMask(file);
+    maskCache.set(file, mask);
+  }
+  return mask;
+}
+function isCodeAt(file, n, col) {
+  const mask = maskOf(file);
+  return mask[n - 1]?.[col] === CODE;
+}
+function matchInCode(file, line, re) {
+  const g = new RegExp(re.source, re.flags.includes("g") ? re.flags : `${re.flags}g`);
+  for (const m of line.raw.matchAll(g)) {
+    if (isCodeAt(file, line.n, m.index ?? 0)) return m;
+  }
+  return null;
+}
+function testInCode(file, line, re) {
+  return matchInCode(file, line, re) !== null;
+}
+function countInCode(file, line, ch) {
+  let n = 0;
+  for (let c = 0; c < line.raw.length; c++) {
+    if (line.raw[c] === ch && isCodeAt(file, line.n, c)) n++;
+  }
+  return n;
+}
+
+// src/detectors/couldNotJudge.ts
+import { readFileSync as readFileSync2 } from "fs";
+function couldNotJudge(id, anchor, reason) {
+  return {
+    id,
+    anchor,
+    state: "could-not-judge",
+    reason,
+    verdict: `could not judge: ${reason}`
+  };
+}
+function settle(id, decided, unreadable) {
+  if (unreadable.length === 0) return decided;
+  const named = unreadable.map((u) => `${u.anchor}: ${u.reason}`).join("; ");
+  if (decided.state === "non-conforming") {
+    return { ...decided, verdict: `${decided.verdict} [also could not read: ${named}]` };
+  }
+  const judgedRest = decided.state === "could-not-judge" ? ` ${decided.reason ?? decided.verdict}` : ` The readable remainder judged ${decided.state}: ${decided.verdict}`;
+  return couldNotJudge(
+    id,
+    unreadable[0].anchor,
+    `${unreadable.length} input(s) present but unreadable \u2014 ${named}.${judgedRest}`
+  );
+}
+function readJsonObject(path) {
+  let value;
+  try {
+    value = JSON.parse(readFileSync2(path, "utf8"));
+  } catch {
+    return null;
+  }
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+  return value;
+}
+function guardUnreadablePackageJson(inner, opts) {
+  return {
+    ...inner,
+    run(tree) {
+      const decided = inner.run(tree);
+      const pkg = tree.packageJson;
+      if (!pkg?.unreadable) return decided;
+      const u = {
+        anchor: pkg.path,
+        reason: `package.json is present but could not be parsed (${pkg.unreadable})`
+      };
+      if (opts.authoritative && decided.state !== "could-not-judge") {
+        return couldNotJudge(inner.id, u.anchor, `${u.anchor}: ${u.reason}`);
+      }
+      return settle(inner.id, decided, [u]);
+    }
+  };
+}
+
+// src/detectors/dLocalIdentity.ts
+var CLOUD_IDENTITY_PACKAGE = "@vantageos/cloud-identity";
+var EXEMPT_MARKER = "allow-local-identity:";
+var MIN_JUSTIFICATION = 8;
+var TENANT_NAMES = "orgId|org_id|orgSlug|org_slug|tenantId|tenant_id";
+var TENANT_PROP = new RegExp(`\\.(${TENANT_NAMES})$`, "i");
+var unbracket = (x) => x.replace(/\??\.?\[\s*["'`]([\w$]+)["'`]\s*\]/g, ".$1").replace(/\?/g, "");
+var FOLD_NAMES = "toLowerCase|toUpperCase|toLocaleLowerCase|toLocaleUpperCase|trim|normalize";
+var FOLD_CALL = String.raw`(?:\s*\.\s*(?:${FOLD_NAMES})\s*\([^()]*\))*`;
+var PATH = String.raw`[\w$.?]+(?![\w$])(?<!\.(?:${FOLD_NAMES}))`;
+var OPERAND = String.raw`${PATH}(?:\[\s*["\`][\w$]+["\`]\s*\]\??[\w$.?]*)*${FOLD_CALL}`;
+var NON_OPERAND = /* @__PURE__ */ new Set(["undefined", "null", "true", "false", "NaN"]);
+var isLiteral = (x) => NON_OPERAND.has(x) || /^-?\d/.test(x);
+var unfold = (x) => unbracket(x.replace(new RegExp(`${FOLD_CALL}$`), ""));
+var lastSegment = (x) => x.split(".").pop() ?? "";
+var ACTING_FIELD = /^(createdBy|assignedTo|assignee|from|fromOrchestrator|toOrchestrator|recipient|sender|callerOrchestrator|orchestrator|orchestratorName|actor|actorName|actingAs|claimedBy|callerName|agentName|fromName)$/;
+var ACTING_BARE = /^(createdBy|assignedTo|assignee|fromOrchestrator|toOrchestrator|callerOrchestrator|actingAs|claimedBy)$/;
+var CALLERISH = /^(caller\w*|actor\w*|acting\w*|claimed\w*|\w*Orchestrator|\w*AgentName)$/i;
+var NAME_FIELD = /^(name|agentName|orchestratorName|displayName)$/;
+var isActing = (x) => ACTING_FIELD.test(lastSegment(x)) && (x.includes(".") || ACTING_BARE.test(x)) || x.includes(".") && CALLERISH.test(lastSegment(x));
+var isNameField = (x) => x.includes(".") && NAME_FIELD.test(lastSegment(x));
+var isBareCallerish = (x) => !x.includes(".") && CALLERISH.test(x);
+var comparesTenants = (a, b) => TENANT_PROP.test(a) || TENANT_PROP.test(b);
+var comparesNames = (a, b) => isActing(a) && (isActing(b) || CALLERISH.test(lastSegment(b)) || isNameField(b)) || isActing(b) && (CALLERISH.test(lastSegment(a)) || isNameField(a)) || isBareCallerish(a) && isNameField(b) || isBareCallerish(b) && isNameField(a);
+var comparesIdentity = (a, b) => comparesTenants(a, b) || comparesNames(a, b);
+function operands(x, y) {
+  const [a, b] = [unfold(x), unfold(y)];
+  return isLiteral(a) || isLiteral(b) ? null : [a, b];
+}
+var CMP = String.raw`(${OPERAND})\s*[!=]==?\s*(${OPERAND})`;
+var OBJECT_IS = String.raw`\bObject\s*\.\s*is\s*\(\s*(${OPERAND})\s*,\s*(${OPERAND})\s*\)`;
+var acceptWith = (pred) => (m) => {
+  const ops = operands(m[1], m[2]);
+  return ops !== null && pred(ops[0], ops[1]);
+};
+var STRING_LITERAL = String.raw`(?:"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|\`[^\`$\\]*\`)`;
+var LITERAL_CONCAT = new RegExp(String.raw`^${STRING_LITERAL}(?:\s*\+\s*${STRING_LITERAL})*$`);
+function staticConstants(file) {
+  const out = /* @__PURE__ */ new Set();
+  const decl = /^(?:export\s+)?const\s+([\w$]+)\s*(?::[^=]+)?=\s*(.*)$/;
+  for (let i = 0; i < file.lines.length; i++) {
+    const m = file.lines[i].raw.match(decl);
+    if (!m) continue;
+    let init = m[2];
+    for (let j = i + 1; !/;\s*$/.test(init) && j < Math.min(file.lines.length, i + 40); j++) {
+      init += `
+${file.lines[j].raw}`;
+    }
+    const body = init.replace(/;\s*$/, "").trim();
+    if (LITERAL_CONCAT.test(body)) out.add(m[1]);
+  }
+  return out;
+}
+function callArgs(text, from) {
+  const args = [];
+  let depth = 0;
+  let start = from;
+  for (let i = from; i < text.length; i++) {
+    const c = text[i];
+    if (c === '"' || c === "'" || c === "`") {
+      for (i++; i < text.length && text[i] !== c; i++) if (text[i] === "\\") i++;
+      continue;
+    }
+    if (c === "(" || c === "[" || c === "{") depth++;
+    else if (c === ")" || c === "]" || c === "}") {
+      if (depth === 0) {
+        args.push(text.slice(start, i).trim());
+        return { args, end: i + 1 };
+      }
+      depth--;
+    } else if (c === "," && depth === 0) {
+      args.push(text.slice(start, i).trim());
+      start = i + 1;
+    }
+  }
+  return null;
+}
+function isStaticInput(expr, statics) {
+  const e = expr.trim();
+  if (LITERAL_CONCAT.test(e) || statics.has(e)) return true;
+  const wrapped = e.match(/^(?:new\s+TextEncoder\s*\(\s*\)\s*\.\s*encode|Buffer\s*\.\s*from)\s*\(/);
+  if (!wrapped) return false;
+  const inner = callArgs(e, wrapped[0].length);
+  return inner !== null && inner.end === e.length && isStaticInput(inner.args[0], statics);
+}
+function textFrom(ctx, extra = 12) {
+  const { file, line, idx } = ctx;
+  const tail = file.lines.slice(line.n, line.n + extra).map((l) => l.raw);
+  return [line.raw.slice(idx), ...tail].join("\n");
+}
+function blockFrom(text, from) {
+  const open = text.indexOf("{", from);
+  if (open < 0) return null;
+  let depth = 0;
+  for (let i = open; i < text.length; i++) {
+    const c = text[i];
+    if (c === '"' || c === "'" || c === "`") {
+      for (i++; i < text.length && text[i] !== c; i++) if (text[i] === "\\") i++;
+      continue;
+    }
+    if (c === "{") depth++;
+    else if (c === "}" && --depth === 0) return text.slice(open, i + 1);
+  }
+  return null;
+}
+function switchComparesIdentity(m, ctx) {
+  if (!ctx) return false;
+  const subject = unfold(m[1]);
+  const body = blockFrom(textFrom(ctx, 60), m[0].length);
+  if (body === null) return false;
+  const label = new RegExp(String.raw`\bcase\s+(${OPERAND})\s*:`, "g");
+  for (const c of body.matchAll(label)) {
+    const ops = operands(subject, c[1]);
+    if (ops !== null && comparesIdentity(ops[0], ops[1])) return true;
+  }
+  return false;
+}
+function literalHoldsIdentity(m) {
+  const arg = unfold(m[2]);
+  return m[1].split(",").map((e) => unfold(e.trim())).some((e) => e !== "" && !isLiteral(e) && !isLiteral(arg) && comparesIdentity(e, arg));
+}
+function digestsStaticInput(m, ctx) {
+  if (!ctx) return false;
+  const text = textFrom(ctx);
+  const open = text.indexOf("(");
+  if (open < 0) return false;
+  const call = callArgs(text, open + 1);
+  if (!call) return false;
+  if (/^subtle/.test(m[0])) {
+    return m[1] === "digest" && call.args.length >= 2 && isStaticInput(call.args[1], ctx.statics);
+  }
+  if (!/^createHash/.test(m[0])) return false;
+  const update = text.slice(call.end).match(/^\s*\.\s*update\s*\(/);
+  if (!update) return false;
+  const data = callArgs(text, call.end + update[0].length);
+  return data !== null && isStaticInput(data.args[0], ctx.statics);
+}
+var RENAMEABLE = [
+  "createHash",
+  "createHmac",
+  "timingSafeEqual",
+  "jwtVerify",
+  "jwtDecrypt",
+  "createRemoteJWKSet",
+  "createLocalJWKSet",
+  "decodeJwt",
+  "compactVerify",
+  "verifyToken"
+];
+function renamedPrimitives(file) {
+  const text = file.lines.map((l) => l.raw).join("\n");
+  const out = [];
+  const named = /import\s+(type\s+)?\{([^}]*)\}\s*from\s*["']([^"']+)["']/g;
+  for (const m of text.matchAll(named)) {
+    if (m[1] || m[3].startsWith(CLOUD_IDENTITY_PACKAGE)) continue;
+    for (const part of m[2].split(",")) {
+      const as = part.trim().match(/^([\w$]+)\s+as\s+([\w$]+)$/);
+      if (as && RENAMEABLE.includes(as[1])) out.push([as[1], as[2]]);
+    }
+  }
+  const destructured = /(?:const|let|var)\s*\{([^}]*)\}\s*=\s*(?:await\s+)?(?:require|import)\s*\(\s*["']([^"']+)["']/g;
+  for (const m of text.matchAll(destructured)) {
+    if (m[2].startsWith(CLOUD_IDENTITY_PACKAGE)) continue;
+    for (const part of m[1].split(",")) {
+      const as = part.trim().match(/^([\w$]+)\s*:\s*([\w$]+)$/);
+      if (as && RENAMEABLE.includes(as[1])) out.push([as[1], as[2]]);
+    }
+  }
+  return out;
+}
+var escapeRe = (x) => x.replace(/[$]/g, "\\$&");
+function aliasMatchers(file) {
+  const out = [];
+  for (const [orig, alias] of renamedPrimitives(file)) {
+    for (const mt of MATCHERS) {
+      if (!mt.re.source.includes(orig)) continue;
+      const re = new RegExp(mt.re.source.split(orig).join(escapeRe(alias)), mt.re.flags);
+      const { accept } = mt;
+      out.push({
+        ...mt,
+        re,
+        // The predicate reads the matched text; give it the original callee name.
+        accept: accept ? (m, ctx) => {
+          const fake = Object.assign(
+            [...m].map((x) => x?.replace(alias, orig)),
+            {
+              index: m.index,
+              input: m.input
+            }
+          );
+          return accept(fake, ctx);
+        } : void 0
+      });
+    }
+  }
+  return out;
+}
+var MATCHERS = [
+  {
+    id: "local-jwt-verify",
+    category: "resolves-caller",
+    re: /\b(jwtVerify|jwtDecrypt|createRemoteJWKSet|createLocalJWKSet|decodeJwt|compactVerify|verifyToken)\s*\(/,
+    callee: 1,
+    sample: "const { payload } = await jwtVerify(token, jwks);"
+  },
+  {
+    id: "local-jwt-verify",
+    category: "resolves-caller",
+    re: /\b(jwt|jsonwebtoken)\.(verify|decode)\s*\(/,
+    sample: "const claims = jwt.verify(token, key);"
+  },
+  {
+    id: "raw-claim-read",
+    category: "resolves-caller",
+    re: /\b(payload|claims|decoded)\??\.(org_id|org_slug|org_role|orgId|orgSlug|orgRole)\b/,
+    sample: "const orgId = payload.org_id as string;"
+  },
+  {
+    // A populated grant attached locally: a non-empty literal, or a value read
+    // off another object (a mapping row). A pass-through copy of the same
+    // field (`fromAllowList: ctx.fromAllowList`) grants nothing new.
+    id: "local-grant",
+    category: "resolves-caller",
+    re: /\bfromAllowList\s*:\s*(\[\s*[^\]\s][^\]]*\]|[\w$]+(?:\??\.[\w$]+)+)/,
+    accept: (m) => !/\.fromAllowList$/.test(m[1]),
+    sample: 'fromAllowList: ["*"],'
+  },
+  {
+    // A role compared to a value. A presence test (`orgRole !== undefined`,
+    // forwarding the claim on) asserts nothing and is not a site.
+    id: "org-role-assert",
+    category: "asserts-membership",
+    re: /\b(orgRole|org_role)\s*[!=]==\s*([^\s);&|?:]+)/,
+    accept: (m) => !NON_OPERAND.has(m[2]),
+    sample: 'if (orgRole === "org:admin") return true;'
+  },
+  {
+    id: "org-role-assert",
+    category: "asserts-membership",
+    re: /[!=]==\s*["'`]org:|\.has\(\s*\{\s*(role|permission)\s*:/,
+    sample: 'if (auth.has({ role: "org:admin" })) return true;'
+  },
+  {
+    // Identifying an agent by NAME: a typed name compared to a roster or an
+    // allow-list, by method or by iteration.
+    id: "name-allowlist",
+    category: "filters-by-scope",
+    re: /\b[\w$]*(roster|allow_?list|allowed_?orchestrators)\s*\??\.\s*(includes|indexOf|some|find|findIndex|every|has)\s*\(/i,
+    sample: "if (ctx.fromAllowList.includes(from)) return null;"
+  },
+  {
+    id: "name-allowlist",
+    category: "filters-by-scope",
+    re: /\b(isIn\w*Allow_?list)\s*\(/i,
+    callee: 1,
+    sample: "if (!isInAllowList(list, name)) return false;"
+  },
+  {
+    id: "name-allowlist",
+    category: "filters-by-scope",
+    re: /\bof\s+[\w$.?]*(roster|allow_?list|allowed_?orchestrators)\s*\)/i,
+    sample: "for (const entry of ctx.fromAllowList) {"
+  },
+  {
+    // A row kept or dropped by comparing its tenant to the caller's: ===, !==, == or !=.
+    id: "tenant-row-filter",
+    category: "filters-by-scope",
+    re: new RegExp(CMP),
+    accept: acceptWith(comparesTenants),
+    sample: "return row.orgId == ctx.actor.orgSlug;"
+  },
+  {
+    id: "tenant-row-filter",
+    category: "filters-by-scope",
+    re: new RegExp(OBJECT_IS),
+    accept: acceptWith(comparesTenants),
+    sample: "return Object.is(row.orgId, ctx.actor.orgSlug);"
+  },
+  {
+    // A tenant passed to a membership test: `callerOrgs.includes(row.orgId)`.
+    id: "tenant-row-filter",
+    category: "filters-by-scope",
+    re: new RegExp(
+      String.raw`\.(includes|has|indexOf|some|find|findIndex)\s*\(\s*(${OPERAND})\s*[,)]`
+    ),
+    accept: (m) => TENANT_PROP.test(unfold(m[2])),
+    sample: "return callerOrgs.includes(row.orgId);"
+  },
+  {
+    // Identifying an agent by NAME through a normaliser: either side of a strict
+    // comparison is a call to `normalize...Id/Name/Orchestrator/Agent/...`.
+    id: "name-compare",
+    category: "filters-by-scope",
+    re: /\bnormali[sz]e\w*(id|name|orchestrator|agent|label|slug|handle)\w*\s*\([^()]*(?:\([^()]*\)[^()]*)*\)\s*[!=]==|[!=]==\s*normali[sz]e\w*(id|name|orchestrator|agent|label|slug|handle)\w*\s*\(/i,
+    sample: "return normalizeOrchestratorId(claimedName) === only;"
+  },
+  {
+    // A typed or argument name compared straight to an allow-list / roster entry.
+    id: "name-compare",
+    category: "filters-by-scope",
+    re: /(?:\b[\w$.?]*(?:roster|allow_?list|allowed_?orchestrators)\s*\??\.?\[[^\]]*\]\s*[!=]==|[!=]==\s*[\w$.?]*(?:roster|allow_?list|allowed_?orchestrators)\s*\??\.?\[)/i,
+    sample: "return claimedName === ctx.fromAllowList[0];"
+  },
+  {
+    // Identifying an agent by NAME through its acting-name fields: who made a row
+    // against who is asking. ===, !==, == and !=, case-folded or not.
+    id: "name-compare",
+    category: "filters-by-scope",
+    re: new RegExp(CMP),
+    accept: acceptWith(comparesNames),
+    sample: "return row.assignedTo.toLowerCase() !== a.callerOrchestrator.toLowerCase();"
+  },
+  {
+    id: "name-compare",
+    category: "filters-by-scope",
+    re: new RegExp(OBJECT_IS),
+    accept: acceptWith(comparesNames),
+    sample: "return Object.is(row.createdBy, m.from);"
+  },
+  {
+    // `switch (row.createdBy) { case caller: }` is the same compare, spelled as a jump table.
+    id: "name-compare",
+    category: "filters-by-scope",
+    re: new RegExp(String.raw`\bswitch\s*\(\s*(${OPERAND})\s*\)`),
+    accept: (m, ctx) => switchComparesIdentity(m, ctx),
+    sample: "switch (row.createdBy) { case caller: return true; }"
+  },
+  {
+    // `[caller].includes(row.createdBy)`: a membership test against a literal that holds the caller.
+    id: "name-compare",
+    category: "filters-by-scope",
+    re: new RegExp(
+      String.raw`(?<![\w$\])])\[([^\[\]]*)\]\s*\.\s*(?:includes|indexOf)\s*\(\s*(${OPERAND})\s*[,)]`
+    ),
+    accept: (m) => literalHoldsIdentity(m),
+    sample: "return [caller].includes(row.createdBy);"
+  },
+  {
+    id: "name-compare",
+    category: "filters-by-scope",
+    re: new RegExp(
+      String.raw`\bnew\s+Set\s*\(\s*\[([^\[\]]*)\]\s*\)\s*\.\s*has\s*\(\s*(${OPERAND})\s*[,)]`
+    ),
+    accept: (m) => literalHoldsIdentity(m),
+    sample: "return new Set([caller]).has(row.assignedTo);"
+  },
+  {
+    // `a.localeCompare(b) === 0` is an equality test, whichever way round it is written.
+    id: "name-compare",
+    category: "filters-by-scope",
+    re: new RegExp(
+      String.raw`(${OPERAND})\s*\.\s*localeCompare\s*\(\s*(${OPERAND})\s*(?:,[^()]*(?:\([^()]*\)[^()]*)*)?\)\s*[!=]==?\s*0(?![\w$.])`
+    ),
+    accept: acceptWith(comparesIdentity),
+    sample: "return row.assignedTo.localeCompare(a.callerOrchestrator) === 0;"
+  },
+  {
+    id: "name-compare",
+    category: "filters-by-scope",
+    re: new RegExp(
+      String.raw`(?<![\w$.])0\s*[!=]==?\s*(${OPERAND})\s*\.\s*localeCompare\s*\(\s*(${OPERAND})\s*[,)]`
+    ),
+    accept: acceptWith(comparesIdentity),
+    sample: "return 0 === row.assignedTo.localeCompare(a.callerOrchestrator);"
+  },
+  {
+    id: "local-secret-compare",
+    category: "validates-credential",
+    re: /\b(timingSafeEqual)\s*\(/,
+    callee: 1,
+    sample: "return timingSafeEqual(a, b);"
+  },
+  {
+    // Any digest of a presented credential, whatever the algorithm.
+    id: "local-digest",
+    category: "validates-credential",
+    // A digest over static content (a literal, or a constant made of literals) is
+    // not a digest of a credential. HMAC and sign/verify always take a key: a site.
+    re: /\bcreateHash\s*\(|\bcreateHmac\s*\(|\bsubtle\s*\.\s*(digest|sign|verify)\s*\(/,
+    accept: (m, ctx) => !digestsStaticInput(m, ctx),
+    sample: 'const h = await crypto.subtle.digest("SHA-256", data);'
+  }
+];
+function biteSample(mt, text) {
+  const m = text.match(mt.re);
+  if (m === null) return false;
+  if (!mt.accept) return true;
+  const line = { n: 1, raw: text, comment: false };
+  const file = { path: "sample", rel: "sample", lines: [line] };
+  return mt.accept(m, { file, line, idx: m.index ?? 0, statics: /* @__PURE__ */ new Set() });
+}
+function localIdentityPositiveControls() {
+  const out = {};
+  MATCHERS.forEach((mt, i) => {
+    out[`${mt.id}#${i}`] = biteSample(mt, mt.sample);
+  });
+  const bites = (line) => MATCHERS.some((mt) => biteSample(mt, line));
+  out["negative:pass-through-grant"] = !bites("fromAllowList: ctx.fromAllowList,");
+  out["negative:delegated-bearer"] = !MATCHERS.some(
+    (mt) => mt.re.test("const r = await validateMasterBearer(authHeader, secret);")
+  );
+  out["negative:role-presence-test"] = !bites(
+    "...(ctx.orgRole !== undefined ? { role: ctx.orgRole } : {}),"
+  );
+  out["negative:undefined-compare"] = !bites("if (row.orgId === undefined) return;");
+  out["negative:acting-field-vs-nullish"] = !bites("if (row.assignedTo !== undefined) return;");
+  out["negative:acting-field-vs-literal"] = !bites('return t.createdBy === "system";');
+  out["negative:unrelated-field-compare"] = !bites("return page.from === page.to;");
+  out["negative:switch-on-unrelated-field"] = !bites('switch (row.kind) { case "a": return 1; }');
+  out["negative:literal-array-unrelated"] = !bites("return [kind].includes(row.status);");
+  out["negative:localecompare-unrelated"] = !bites("return a.name.localeCompare(b.name) === 0;");
+  out["negative:object-is-nullish"] = !bites("return Object.is(row.orgId, undefined);");
+  return out;
+}
+function cloudIdentityBindings(file) {
+  const text = file.lines.map((l) => l.raw).join("\n");
+  const names = /* @__PURE__ */ new Set();
+  const namespaces = /* @__PURE__ */ new Set();
+  const pkg = `@vantageos\\/cloud-identity(?:\\/[^"']*)?`;
+  const named = new RegExp(`import\\s+(type\\s+)?\\{([^}]*)\\}\\s*from\\s*["']${pkg}["']`, "g");
+  for (const m of text.matchAll(named)) {
+    if (m[1]) continue;
+    for (const part of m[2].split(",")) {
+      const p = part.trim();
+      if (!p || p.startsWith("type ")) continue;
+      const as = p.match(/^[\w$]+\s+as\s+([\w$]+)$/);
+      names.add(as ? as[1] : p);
+    }
+  }
+  const ns = new RegExp(`import\\s+\\*\\s+as\\s+([\\w$]+)\\s+from\\s*["']${pkg}["']`, "g");
+  for (const m of text.matchAll(ns)) namespaces.add(m[1]);
+  return { names, namespaces };
+}
+function isDelegated(raw, start, callee, b) {
+  const before = raw.slice(0, start);
+  const qualified = before.match(/([\w$]+)\s*\.\s*$/);
+  if (qualified) return b.namespaces.has(qualified[1]);
+  return b.names.has(callee);
+}
+function countDelegatedCalls(file, b) {
+  if (b.names.size === 0 && b.namespaces.size === 0) return 0;
+  let n = 0;
+  for (const line of file.lines) {
+    if (line.comment) continue;
+    for (const m of line.raw.matchAll(/([\w$]+)\s*\(/g)) {
+      const idx = m.index ?? 0;
+      if (isCodeAt(file, line.n, idx) && isDelegated(line.raw, idx, m[1], b)) n++;
+    }
+  }
+  return n;
+}
+var DECL = /^(?:export\s+)?(?:default\s+)?(?:async\s+)?(?:function\s*\*?\s*([\w$]+)|(?:const|let|var|class)\s+([\w$]+))/;
+function enclosingDecl(file, n) {
+  for (let i = n - 1; i >= 0; i--) {
+    const l = file.lines[i];
+    if (l.comment) continue;
+    const m = l.raw.match(DECL);
+    if (m) return { name: m[1] ?? m[2], line: l.n };
+  }
+  return null;
+}
+function justificationIn(line, file) {
+  const at = line.raw.indexOf(EXEMPT_MARKER);
+  if (at < 0) return null;
+  if (!line.comment && isCodeAt(file, line.n, at)) return null;
+  if (!line.comment && !/\/\/|\/\*/.test(line.raw.slice(0, at))) return null;
+  return line.raw.slice(at + EXEMPT_MARKER.length).replace(/\*\/\s*$/, "").trim();
+}
+function commentBlockAbove(file, n) {
+  const out = [];
+  for (let i = n - 2; i >= 0; i--) {
+    const l = file.lines[i];
+    if (!l.comment) break;
+    out.push(l);
+  }
+  return out;
+}
+function findJustification(file, line, decl) {
+  const candidates = [line, ...commentBlockAbove(file, line.n)];
+  if (decl) candidates.push(...commentBlockAbove(file, decl.line));
+  for (const c of candidates) {
+    const j = justificationIn(c, file);
+    if (j !== null) return { text: j, valid: j.length >= MIN_JUSTIFICATION };
+  }
+  return null;
+}
+function unreadableReason(file) {
+  if (file.lines.some((l) => l.raw.includes("\0") || l.raw.includes("\uFFFD"))) {
+    return "file is not valid UTF-8 text";
+  }
+  const pairs = [
+    ["{", "}"],
+    ["(", ")"],
+    ["[", "]"]
+  ];
+  const off = [];
+  for (const [open, close] of pairs) {
+    let net = 0;
+    for (const l of file.lines) net += countInCode(file, l, open) - countInCode(file, l, close);
+    if (net !== 0) off.push(`${open}${close} ${net > 0 ? "+" : ""}${net}`);
+  }
+  return off.length > 0 ? `brackets never balance (${off.join(", ")}) \u2014 the file cannot be read as code` : null;
+}
+function findLocalIdentitySites(tree) {
+  const pkg = tree.packageJson;
+  const selfExempt = !pkg?.unreadable && pkg?.json.name === CLOUD_IDENTITY_PACKAGE;
+  const scan = {
+    selfExempt,
+    violations: [],
+    exempt: [],
+    delegatedCalls: 0,
+    unreadable: []
+  };
+  for (const file of tree.files) {
+    const bad = unreadableReason(file);
+    if (bad) scan.unreadable.push({ anchor: file.rel, reason: bad });
+    const bindings = cloudIdentityBindings(file);
+    const statics = staticConstants(file);
+    const catalog = [...MATCHERS, ...aliasMatchers(file)];
+    scan.delegatedCalls += countDelegatedCalls(file, bindings);
+    for (const line of file.lines) {
+      if (line.comment) continue;
+      let hit = null;
+      for (const mt of catalog) {
+        const g = new RegExp(mt.re.source, `${mt.re.flags.replace("g", "")}g`);
+        for (const m of line.raw.matchAll(g)) {
+          const idx = m.index ?? 0;
+          if (!isCodeAt(file, line.n, idx)) continue;
+          if (mt.accept && !mt.accept(m, { file, line, idx, statics })) continue;
+          const callee = mt.callee !== void 0 ? m[mt.callee] : void 0;
+          if (callee && isDelegated(line.raw, idx, callee, bindings)) continue;
+          hit = mt;
+          break;
+        }
+        if (hit) break;
+      }
+      if (!hit) continue;
+      const decl = enclosingDecl(file, line.n);
+      const site = {
+        file: file.rel,
+        line: line.n,
+        primitive: hit.id,
+        category: hit.category,
+        enclosing: decl
+      };
+      const j = findJustification(file, line, decl);
+      if (j?.valid) scan.exempt.push({ ...site, justification: j.text });
+      else scan.violations.push(site);
+    }
+  }
+  return scan;
+}
+function describeSite(s) {
+  const where = s.enclosing ? ` in ${s.enclosing.name} (declared :${s.enclosing.line})` : "";
+  return `${s.file}:${s.line} [${s.category}/${s.primitive}]${where}`;
+}
+function exemptSuffix(exempt) {
+  if (exempt.length === 0) return "";
+  const rows = exempt.map((e) => `${describeSite(e)} \u2014 "${e.justification}"`);
+  return `; EXEMPT (${exempt.length}): ${rows.join("; ")}`;
+}
+function makeLocalIdentity(opts = {}) {
+  const ceiling = opts.ceiling ?? 0;
+  if (!Number.isInteger(ceiling) || ceiling < 0) {
+    throw new Error(`local-identity ceiling must be a non-negative integer, got ${ceiling}`);
+  }
+  return {
+    id: "DLocalIdentity no-local-identity",
+    run(tree) {
+      const controls = localIdentityPositiveControls();
+      const failed = Object.entries(controls).filter(([, ok]) => !ok);
+      if (failed.length > 0) {
+        throw new Error(
+          `DLocalIdentity positive control FAILED: ${failed.map(([k]) => k).join(", ")} \u2014 matcher broken, verdict untrustworthy`
+        );
+      }
+      const id = this.id;
+      const s = findLocalIdentitySites(tree);
+      if (s.selfExempt) {
+        const n = s.violations.length + s.exempt.length;
+        return {
+          id,
+          anchor: tree.packageJson?.path ?? "-",
+          state: "present",
+          verdict: `EXEMPT: the target is ${CLOUD_IDENTITY_PACKAGE} itself, the one place identity primitives live (${n} primitive site(s) not counted)`
+        };
+      }
+      const listed = s.violations.map(describeSite).join("; ");
+      const delegated = `${s.delegatedCalls} call(s) to ${CLOUD_IDENTITY_PACKAGE}`;
+      let decided;
+      if (s.violations.length > ceiling) {
+        const v = s.violations[0];
+        decided = {
+          id,
+          anchor: `${v.file}:${v.line}`,
+          state: "non-conforming",
+          verdict: `${s.violations.length} local identity primitive(s), ceiling ${ceiling} (positive-control OK): ${listed}${exemptSuffix(s.exempt)} -> delegate to ${CLOUD_IDENTITY_PACKAGE} (validateMasterBearer, verifyClerkSessionToken, isMasterScope, ...) or justify the site with "// ${EXEMPT_MARKER} <reason>"`
+        };
+      } else if (s.violations.length > 0) {
+        const v = s.violations[0];
+        decided = {
+          id,
+          anchor: `${v.file}:${v.line}`,
+          state: "present",
+          verdict: `${s.violations.length} local identity primitive(s) at or under the ceiling ${ceiling} \u2014 a ratchet, not a clean bill: ${listed}${exemptSuffix(s.exempt)}`
+        };
+      } else {
+        decided = {
+          id,
+          anchor: s.exempt[0] ? `${s.exempt[0].file}:${s.exempt[0].line}` : "-",
+          state: "present",
+          verdict: `0 local identity primitives; ${delegated} (positive-control OK)${exemptSuffix(s.exempt)}`
+        };
+      }
+      return settle(id, decided, s.unreadable);
+    }
+  };
+}
+var localIdentity = makeLocalIdentity();
+
 // src/detectors/c7-artifact-verifiable.ts
-import { existsSync, readFileSync } from "fs";
-import { join } from "path";
+import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";
+import { join as join2 } from "path";
 var PIN = "a74a042b53c71a095ab88b3073bd47728eeda814";
 var DOC_FILES = ["README.md", "README.fr.md"];
 var INSTALL_RE = /\b(?:npm\s+(?:install|i)|npx|pnpm\s+add|yarn\s+add)\s+(@?[\w./-]+)/i;
@@ -46,10 +1032,10 @@ function c7PositiveControls() {
 }
 function readDocText(root) {
   for (const name of DOC_FILES) {
-    const path = join(root, name);
-    if (!existsSync(path)) continue;
+    const path = join2(root, name);
+    if (!existsSync2(path)) continue;
     try {
-      return { text: readFileSync(path, "utf8"), file: name };
+      return { text: readFileSync3(path, "utf8"), file: name };
     } catch {
     }
   }
@@ -1177,59 +2163,6 @@ var c13ContextCeiling = {
   }
 };
 
-// src/detectors/couldNotJudge.ts
-import { readFileSync as readFileSync2 } from "fs";
-function couldNotJudge(id, anchor, reason) {
-  return {
-    id,
-    anchor,
-    state: "could-not-judge",
-    reason,
-    verdict: `could not judge: ${reason}`
-  };
-}
-function settle(id, decided, unreadable) {
-  if (unreadable.length === 0) return decided;
-  const named = unreadable.map((u) => `${u.anchor}: ${u.reason}`).join("; ");
-  if (decided.state === "non-conforming") {
-    return { ...decided, verdict: `${decided.verdict} [also could not read: ${named}]` };
-  }
-  const judgedRest = decided.state === "could-not-judge" ? ` ${decided.reason ?? decided.verdict}` : ` The readable remainder judged ${decided.state}: ${decided.verdict}`;
-  return couldNotJudge(
-    id,
-    unreadable[0].anchor,
-    `${unreadable.length} input(s) present but unreadable \u2014 ${named}.${judgedRest}`
-  );
-}
-function readJsonObject(path) {
-  let value;
-  try {
-    value = JSON.parse(readFileSync2(path, "utf8"));
-  } catch {
-    return null;
-  }
-  if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-  return value;
-}
-function guardUnreadablePackageJson(inner, opts) {
-  return {
-    ...inner,
-    run(tree) {
-      const decided = inner.run(tree);
-      const pkg = tree.packageJson;
-      if (!pkg?.unreadable) return decided;
-      const u = {
-        anchor: pkg.path,
-        reason: `package.json is present but could not be parsed (${pkg.unreadable})`
-      };
-      if (opts.authoritative && decided.state !== "could-not-judge") {
-        return couldNotJudge(inner.id, u.anchor, `${u.anchor}: ${u.reason}`);
-      }
-      return settle(inner.id, decided, [u]);
-    }
-  };
-}
-
 // src/detectors/c14-catalog-registration.ts
 var PIN3 = "a74a042b53c71a095ab88b3073bd47728eeda814";
 var REQUIRED_FIELDS = [
@@ -1514,11 +2447,11 @@ var c16UntrustedOutput = {
 };
 
 // src/detectors/c17-supply-chain.ts
-import { existsSync as existsSync2, readFileSync as readFileSync3, readdirSync } from "fs";
-import { join as join2 } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync4, readdirSync as readdirSync2 } from "fs";
+import { join as join3 } from "path";
 var PIN4 = "a74a042b53c71a095ab88b3073bd47728eeda814";
 var LOCKFILES = ["package-lock.json", "pnpm-lock.yaml", "yarn.lock", "bun.lock", "bun.lockb"];
-var WORKFLOW_DIR = join2(".github", "workflows");
+var WORKFLOW_DIR = join3(".github", "workflows");
 var PROVENANCE_RE2 = /--provenance\b|\bprovenance\s*:\s*true\b|id-token:\s*write/i;
 function c17PositiveControls() {
   const sample = "npm publish --provenance --access public";
@@ -1534,7 +2467,7 @@ function c17PositiveControls() {
 }
 function findLockfile(root) {
   for (const name of LOCKFILES) {
-    if (existsSync2(join2(root, name))) return name;
+    if (existsSync3(join3(root, name))) return name;
   }
   return null;
 }
@@ -1546,20 +2479,20 @@ function findProvenanceClaim(tree, root) {
       return { site: `${pkg.path}:publishConfig.provenance`, text: "provenance: true" };
     }
   }
-  const workflowsDir = join2(root, WORKFLOW_DIR);
-  if (!existsSync2(workflowsDir)) return null;
+  const workflowsDir = join3(root, WORKFLOW_DIR);
+  if (!existsSync3(workflowsDir)) return null;
   let entries = [];
   try {
-    entries = readdirSync(workflowsDir);
+    entries = readdirSync2(workflowsDir);
   } catch {
     return null;
   }
   for (const name of entries) {
     if (!/\.ya?ml$/.test(name)) continue;
-    const path = join2(workflowsDir, name);
+    const path = join3(workflowsDir, name);
     let text;
     try {
-      text = readFileSync3(path, "utf8");
+      text = readFileSync4(path, "utf8");
     } catch {
       continue;
     }
@@ -1612,17 +2545,17 @@ var c17SupplyChain = guardUnreadablePackageJson(c17SupplyChainInner, {
 });
 
 // src/detectors/c18-structure-manifest.ts
-import { existsSync as existsSync3, readFileSync as readFileSync4 } from "fs";
-import { join as join3 } from "path";
+import { existsSync as existsSync4, readFileSync as readFileSync5 } from "fs";
+import { join as join4 } from "path";
 var PIN5 = "a74a042b53c71a095ab88b3073bd47728eeda814";
 function manifestPath(root) {
-  const extPath = join3(root, "extension.json");
-  if (existsSync3(extPath)) return { kind: "extension", path: extPath };
-  return { kind: "server", path: join3(root, "mcp.json") };
+  const extPath = join4(root, "extension.json");
+  if (existsSync4(extPath)) return { kind: "extension", path: extPath };
+  return { kind: "server", path: join4(root, "mcp.json") };
 }
 function readJson(path) {
   try {
-    return JSON.parse(readFileSync4(path, "utf8"));
+    return JSON.parse(readFileSync5(path, "utf8"));
   } catch {
     return null;
   }
@@ -1670,7 +2603,7 @@ var c18StructureManifestInner = {
     }
     const { kind, path } = manifestPath(tree.root);
     const manifestName = kind === "extension" ? "extension.json" : "mcp.json";
-    if (!existsSync3(path)) {
+    if (!existsSync4(path)) {
       return {
         id: this.id,
         anchor: tree.root,
@@ -1753,89 +2686,6 @@ var c18StructureManifest = guardUnreadablePackageJson(
   { authoritative: false }
 );
 
-// src/scan.ts
-import { existsSync as existsSync4, readFileSync as readFileSync5, readdirSync as readdirSync2, statSync } from "fs";
-import { dirname, join as join4, relative } from "path";
-var SKIP_DIRS = /* @__PURE__ */ new Set([
-  "node_modules",
-  "dist",
-  "build",
-  ".git",
-  "tests",
-  "__tests__",
-  "coverage",
-  // Test material, not a target's served surface: deliberately-malformed
-  // servers and foreign copies live here. Scanning them makes the instrument
-  // trip its own fail-closed detectors when pointed at its own tree, and lints
-  // inputs that are meant to be broken. A real target's fixtures are equally
-  // test inputs, not its product surface.
-  "fixtures"
-]);
-function isCommentLine(raw) {
-  const t = raw.trim();
-  if (t === "") return false;
-  return t.startsWith("*") || t.startsWith("//") || t.startsWith("/*") || t.startsWith("*/");
-}
-function walk(dir, out) {
-  let entries;
-  try {
-    entries = readdirSync2(dir);
-  } catch {
-    return;
-  }
-  for (const name of entries) {
-    const full = join4(dir, name);
-    let st;
-    try {
-      st = statSync(full);
-    } catch {
-      continue;
-    }
-    if (st.isDirectory()) {
-      if (SKIP_DIRS.has(name)) continue;
-      walk(full, out);
-    } else if (name.endsWith(".ts") || name.endsWith(".tsx")) {
-      if (name.endsWith(".d.ts") || name.endsWith(".test.ts")) continue;
-      out.push(full);
-    }
-  }
-}
-function loadFile(path, root) {
-  const raw = readFileSync5(path, "utf8");
-  const lines = raw.split("\n").map((r, i) => ({ n: i + 1, raw: r, comment: isCommentLine(r) }));
-  return { path, rel: relative(root, path) || path, lines };
-}
-function findPackageJson(startDir) {
-  let dir = startDir;
-  for (let depth = 0; depth < 8; depth++) {
-    const candidate = join4(dir, "package.json");
-    if (existsSync4(candidate)) {
-      try {
-        const parsed = JSON.parse(readFileSync5(candidate, "utf8"));
-        if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
-          return { path: candidate, json: {}, unreadable: "not a JSON object" };
-        }
-        return { path: candidate, json: parsed };
-      } catch (err) {
-        return { path: candidate, json: {}, unreadable: err.message };
-      }
-    }
-    const parent = dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  return null;
-}
-function loadTree(root) {
-  const st = statSync(root);
-  const baseDir = st.isDirectory() ? root : dirname(root);
-  const filePaths = [];
-  if (st.isDirectory()) walk(root, filePaths);
-  else if (root.endsWith(".ts") || root.endsWith(".tsx")) filePaths.push(root);
-  const files = filePaths.map((p) => loadFile(p, baseDir));
-  return { root, files, packageJson: findPackageJson(baseDir) };
-}
-
 // src/detectors/c19-served-descriptions.ts
 var PIN6 = "a74a042b53c71a095ab88b3073bd47728eeda814";
 var TOOL_DESC_INLINE_RE = /\b(?:s\.tool|\.tool|registerTool)\s*\(\s*(?:["'`][^"'`]+["'`]|[A-Za-z_$][\w$]*)\s*,\s*["'`]([^"'`]+)["'`]/;
@@ -2509,7 +3359,7 @@ import {
   writeFileSync
 } from "fs";
 import { tmpdir } from "os";
-import { join as join6, relative as relative2 } from "path";
+import { basename as basename2, join as join6, relative as relative2, sep as sep2 } from "path";
 var PIN9 = "20136b50";
 var DEPLOY_CONFIG_FILES = [
   "railway.json",
@@ -2526,8 +3376,7 @@ var LOCKFILES2 = [
   { name: "pnpm-lock.yaml", command: "pnpm", args: ["install", "--frozen-lockfile"] },
   { name: "yarn.lock", command: "yarn", args: ["install", "--frozen-lockfile"] }
 ];
-var SKIP_WALK_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "build", "coverage"]);
-function walkForConfigs(dir, depth, seen) {
+function walkForConfigs(dir, depth, seen, onSkip) {
   if (depth > 8) return;
   let entries;
   try {
@@ -2544,8 +3393,11 @@ function walkForConfigs(dir, depth, seen) {
       continue;
     }
     if (st.isDirectory()) {
-      if (SKIP_WALK_DIRS.has(name)) continue;
-      walkForConfigs(full, depth + 1, seen);
+      if (SKIP_DIRS.has(name)) {
+        onSkip(full, depth + 1);
+        continue;
+      }
+      walkForConfigs(full, depth + 1, seen, onSkip);
     } else if (DEPLOY_CONFIG_FILES.includes(name)) {
       if (!seen.has(dir)) {
         seen.set(dir, { dir, configFile: name, configPath: full });
@@ -2553,6 +3405,37 @@ function walkForConfigs(dir, depth, seen) {
     }
   }
 }
+function probeForCandidate(dir, depth) {
+  if (depth > 8) return null;
+  let entries;
+  try {
+    entries = readdirSync3(dir).sort();
+  } catch {
+    return null;
+  }
+  const subdirs = [];
+  for (const name of entries) {
+    const full = join6(dir, name);
+    let st;
+    try {
+      st = statSync2(full);
+    } catch {
+      continue;
+    }
+    if (st.isDirectory()) {
+      const info = SKIP_DIR_INFO[name];
+      if (info && !info.authored) continue;
+      subdirs.push(full);
+    } else if (DEPLOY_CONFIG_FILES.includes(name)) {
+      return full;
+    }
+  }
+  for (const sub of subdirs) {
+    const hit = probeForCandidate(sub, depth + 1);
+    if (hit) return hit;
+  }
+  return null;
+}
 function resolveRailwayRootDirectory(configPath) {
   let text;
   try {
@@ -2574,15 +3457,31 @@ function resolveRailwayRootDirectory(configPath) {
   const rootDirectory = typeof parsed.rootDirectory === "string" && parsed.rootDirectory || build && typeof build.rootDirectory === "string" && build.rootDirectory || null;
   return rootDirectory;
 }
-function c26DeriveScope(root) {
+function c26DeriveScope(root, tree) {
   const seen = /* @__PURE__ */ new Map();
-  walkForConfigs(root, 0, seen);
+  const skipped = [];
+  const onSkip = (skippedDir, depth) => {
+    const entry = tree ? recordSkip(tree, skippedDir, root) : {
+      path: relative2(root, skippedDir).split(sep2).join("/"),
+      reason: SKIP_DIR_INFO[basename2(skippedDir)]?.reason ?? "skipped"
+    };
+    if (SKIP_DIR_INFO[basename2(skippedDir)]?.authored) {
+      const hit = probeForCandidate(skippedDir, depth);
+      if (hit) entry.candidate = relative2(root, hit).split(sep2).join("/");
+    }
+    if (!skipped.some((d) => d.path === entry.path)) skipped.push(entry);
+  };
+  walkForConfigs(root, 0, seen, onSkip);
   const sites = [];
   for (const site of seen.values()) {
     if (site.configFile === "railway.json") {
       const resolved = resolveRailwayRootDirectory(site.configPath);
       if (resolved && typeof resolved === "object" && "error" in resolved) {
-        return { sites: [], unparsable: { path: site.configPath, reason: resolved.error } };
+        return {
+          sites: [],
+          skipped,
+          unparsable: { path: site.configPath, reason: resolved.error }
+        };
       }
       if (typeof resolved === "string" && resolved.trim()) {
         sites.push({ ...site, dir: join6(site.dir, resolved) });
@@ -2595,6 +3494,7 @@ function c26DeriveScope(root) {
       } catch (err) {
         return {
           sites: [],
+          skipped,
           unparsable: {
             path: site.configPath,
             reason: `could not parse ${site.configPath} as JSON: ${err instanceof Error ? err.message : String(err)}`
@@ -2604,7 +3504,7 @@ function c26DeriveScope(root) {
     }
     sites.push(site);
   }
-  return { sites };
+  return { sites, skipped };
 }
 function findLockfile2(dir) {
   for (const l of LOCKFILES2) {
@@ -2761,7 +3661,18 @@ var c26SubpackageLockfile = {
   rule: "C-26",
   pin: PIN9,
   run(tree) {
-    const scope = c26DeriveScope(tree.root);
+    const scope = c26DeriveScope(tree.root, tree);
+    const hidden = scope.skipped.filter((d) => d.candidate !== void 0);
+    const unjudgedHidden = (prefix) => {
+      const reason = `${prefix}deployment configuration found only under skipped director${hidden.length === 1 ? "y" : "ies"}: ${hidden.map((d) => `${d.path} (${d.reason}) -> ${d.candidate}`).join("; ")} \u2014 C-26 does not descend into skipped directories, so these site(s) were not judged`;
+      return {
+        id: this.id,
+        anchor: join6(tree.root, hidden[0].candidate),
+        state: "could-not-judge",
+        reason,
+        verdict: `could not judge: ${reason}`
+      };
+    };
     if (scope.unparsable) {
       const reason = `deployment configuration ${scope.unparsable.path} could not be parsed: ${scope.unparsable.reason} \u2014 scope unestablished, C-26 cannot derive its targets`;
       return {
@@ -2773,6 +3684,7 @@ var c26SubpackageLockfile = {
       };
     }
     if (scope.sites.length === 0) {
+      if (hidden.length > 0) return unjudgedHidden("");
       return {
         id: this.id,
         anchor: tree.root,
@@ -2784,6 +3696,7 @@ var c26SubpackageLockfile = {
     const inventory = renderCoverage(scope.sites, verdicts);
     const analysed = verdicts.filter((v) => v.status === "analysed");
     if (analysed.length === 0) {
+      if (hidden.length > 0) return unjudgedHidden("no analysable site; ");
       return {
         id: this.id,
         anchor: tree.root,
@@ -2800,6 +3713,11 @@ var c26SubpackageLockfile = {
         verdict: reds.some((r) => r.detail?.includes("no lockfile")) ? `${reds[0].detail} (C-26). Coverage: ${inventory}` : `${reds.map((r) => r.detail).join(" ; ")} (C-26). Coverage: ${inventory}`
       };
     }
+    if (hidden.length > 0) {
+      return unjudgedHidden(
+        `${analysed.length} analysed site(s) are consistent, but coverage is partial; `
+      );
+    }
     return {
       id: this.id,
       anchor: analysed[0].site.dir,
@@ -4369,24 +5287,12 @@ var dDebugOptIn = {
   }
 };
 
-// src/detectors/dExt1.ts
+// src/detectors/extManifests.ts
 import { readdirSync as readdirSync4, statSync as statSync5 } from "fs";
 import { join as join12 } from "path";
-var IDENTIFIER_RE2 = /^[a-z0-9]+(\.[a-z0-9-]+)+\/[a-z0-9-]+$/;
-var IDENTIFIER_POSITIVE = "com.elpi/middleware-redact-pii";
-var IDENTIFIER_NEGATIVE = "Com.Elpi/Bad_Id";
-function dExt1PositiveControls() {
-  return {
-    identifier: {
-      pattern: IDENTIFIER_RE2.source,
-      positive: IDENTIFIER_RE2.test(IDENTIFIER_POSITIVE),
-      negative: IDENTIFIER_RE2.test(IDENTIFIER_NEGATIVE)
-    }
-  };
-}
-var SKIP_DIRS2 = /* @__PURE__ */ new Set(["node_modules", "dist", "build", ".git", "coverage"]);
-function findExtensionManifests(root) {
+function findExtensionManifests(tree) {
   const out = [];
+  const root = tree.root;
   let base;
   try {
     base = statSync5(root).isDirectory() ? root : join12(root, "..");
@@ -4409,7 +5315,10 @@ function findExtensionManifests(root) {
         continue;
       }
       if (st.isDirectory()) {
-        if (SKIP_DIRS2.has(name)) continue;
+        if (SKIP_DIRS.has(name)) {
+          recordSkip(tree, full, base);
+          continue;
+        }
         walk2(full);
       } else if (name === "extension.json") {
         out.push(full);
@@ -4419,20 +5328,34 @@ function findExtensionManifests(root) {
   walk2(base);
   return out;
 }
+
+// src/detectors/dExt1.ts
+var IDENTIFIER_RE2 = /^[a-z0-9]+(\.[a-z0-9-]+)+\/[a-z0-9-]+$/;
+var IDENTIFIER_POSITIVE = "com.elpi/middleware-redact-pii";
+var IDENTIFIER_NEGATIVE = "Com.Elpi/Bad_Id";
+function dExt1PositiveControls() {
+  return {
+    identifier: {
+      pattern: IDENTIFIER_RE2.source,
+      positive: IDENTIFIER_RE2.test(IDENTIFIER_POSITIVE),
+      negative: IDENTIFIER_RE2.test(IDENTIFIER_NEGATIVE)
+    }
+  };
+}
 var TS_IDENT_LITERAL_RE = /\bidentifier:\s*["'`]([^"'`]*)["'`]/;
-var TS_IDENT_KEY_RE = /\bidentifier:\s*[^\s"'`]/;
+var TS_IDENT_KEY_RE = /\bidentifier:\s*[^\s"'`{]/;
 function findTsIdentifiers(tree) {
   const sites = [];
   const unresolved = [];
   for (const file of tree.files) {
     for (const line of file.lines) {
       if (line.comment) continue;
-      const lit = line.raw.match(TS_IDENT_LITERAL_RE);
+      const lit = matchInCode(file, line, TS_IDENT_LITERAL_RE);
       if (lit) {
         sites.push({ value: lit[1], anchor: `${file.rel}:${line.n}` });
         continue;
       }
-      if (TS_IDENT_KEY_RE.test(line.raw)) {
+      if (testInCode(file, line, TS_IDENT_KEY_RE)) {
         unresolved.push(`${file.rel}:${line.n}`);
       }
     }
@@ -4450,7 +5373,7 @@ var dExt1 = {
     }
     const unreadable = [];
     const decided = (() => {
-      const manifests = findExtensionManifests(tree.root);
+      const manifests = findExtensionManifests(tree);
       for (const manifestPath2 of manifests) {
         const shortPath = manifestPath2.split("/").slice(-2).join("/");
         const parsed = readJsonObject(manifestPath2);
@@ -4517,8 +5440,6 @@ var dExt1 = {
 };
 
 // src/detectors/dExt2.ts
-import { readdirSync as readdirSync5, statSync as statSync6 } from "fs";
-import { join as join13 } from "path";
 var TS_GD_TRUE_RE = /\bgracefulDegradation:\s*true\b/;
 var TS_GD_FALSE_RE = /\bgracefulDegradation:\s*false\b/;
 var TS_GD_KEY_RE = /\bgracefulDegradation:\s*([^\s,}]+)/;
@@ -4533,41 +5454,6 @@ function dExt2PositiveControls() {
     }
   };
 }
-var SKIP_DIRS3 = /* @__PURE__ */ new Set(["node_modules", "dist", "build", ".git", "coverage"]);
-function findExtensionManifests2(root) {
-  const out = [];
-  let base;
-  try {
-    base = statSync6(root).isDirectory() ? root : join13(root, "..");
-  } catch {
-    return out;
-  }
-  const walk2 = (dir) => {
-    let entries;
-    try {
-      entries = readdirSync5(dir);
-    } catch {
-      return;
-    }
-    for (const name of entries) {
-      const full = join13(dir, name);
-      let st;
-      try {
-        st = statSync6(full);
-      } catch {
-        continue;
-      }
-      if (st.isDirectory()) {
-        if (SKIP_DIRS3.has(name)) continue;
-        walk2(full);
-      } else if (name === "extension.json") {
-        out.push(full);
-      }
-    }
-  };
-  walk2(base);
-  return out;
-}
 function findTsFactorySites(tree) {
   const sites = [];
   for (const file of tree.files) {
@@ -4575,7 +5461,7 @@ function findTsFactorySites(tree) {
     for (let i = 0; i < lines.length; i++) {
       const line = lines[i];
       if (line.comment) continue;
-      if (!DEFINE_EXTENSION_OPEN_RE.test(line.raw)) continue;
+      if (!testInCode(file, line, DEFINE_EXTENSION_OPEN_RE)) continue;
       const anchor = `${file.rel}:${line.n}`;
       let depth = 0;
       let started = false;
@@ -4585,20 +5471,20 @@ function findTsFactorySites(tree) {
         const bl = lines[j];
         if (!bl.comment) {
           if (state === "absent") {
-            if (TS_GD_TRUE_RE.test(bl.raw)) {
+            if (testInCode(file, bl, TS_GD_TRUE_RE)) {
               state = "true";
-            } else if (TS_GD_FALSE_RE.test(bl.raw)) {
+            } else if (testInCode(file, bl, TS_GD_FALSE_RE)) {
               state = "false";
             } else {
-              const key = bl.raw.match(TS_GD_KEY_RE);
+              const key = matchInCode(file, bl, TS_GD_KEY_RE);
               if (key) {
                 state = "unresolved";
                 value = key[1];
               }
             }
           }
-          depth += (bl.raw.match(/\{/g) ?? []).length;
-          depth -= (bl.raw.match(/\}/g) ?? []).length;
+          depth += countInCode(file, bl, "{");
+          depth -= countInCode(file, bl, "}");
           if (depth > 0) started = true;
         }
         if (started && depth <= 0) break;
@@ -4619,7 +5505,7 @@ var dExt2 = {
     }
     const unreadable = [];
     const decided = (() => {
-      const manifests = findExtensionManifests2(tree.root);
+      const manifests = findExtensionManifests(tree);
       for (const manifestPath2 of manifests) {
         const shortPath = manifestPath2.split("/").slice(-2).join("/");
         const parsed = readJsonObject(manifestPath2);
@@ -4695,8 +5581,6 @@ var dExt2 = {
 };
 
 // src/detectors/dExt3.ts
-import { readdirSync as readdirSync6, statSync as statSync7 } from "fs";
-import { join as join14 } from "path";
 var TYPE_MATCHERS = [
   { type: "middleware", re: /\bmiddleware\b/ },
   { type: "tool-extension", re: /\btool-ext(?:ension)?\b/ },
@@ -4719,41 +5603,6 @@ function dExt3PositiveControls() {
     }
   };
 }
-var SKIP_DIRS4 = /* @__PURE__ */ new Set(["node_modules", "dist", "build", ".git", "coverage"]);
-function findExtensionManifests3(root) {
-  const out = [];
-  let base;
-  try {
-    base = statSync7(root).isDirectory() ? root : join14(root, "..");
-  } catch {
-    return out;
-  }
-  const walk2 = (dir) => {
-    let entries;
-    try {
-      entries = readdirSync6(dir);
-    } catch {
-      return;
-    }
-    for (const name of entries) {
-      const full = join14(dir, name);
-      let st;
-      try {
-        st = statSync7(full);
-      } catch {
-        continue;
-      }
-      if (st.isDirectory()) {
-        if (SKIP_DIRS4.has(name)) continue;
-        walk2(full);
-      } else if (name === "extension.json") {
-        out.push(full);
-      }
-    }
-  };
-  walk2(base);
-  return out;
-}
 var DEFINE_EXTENSION_OPEN_RE2 = /\bdefineExtension\s*\(\s*\{/;
 var TS_TYPE_LITERAL_RE = /\btype:\s*["'`]([^"'`]*)["'`]/;
 var TS_TYPE_KEY_RE = /\btype:\s*[^\s"'`]/;
@@ -4764,7 +5613,7 @@ function findTsTypeSites(tree) {
     for (let i = 0; i < lines.length; i++) {
       const line = lines[i];
       if (line.comment) continue;
-      if (!DEFINE_EXTENSION_OPEN_RE2.test(line.raw)) continue;
+      if (!testInCode(file, line, DEFINE_EXTENSION_OPEN_RE2)) continue;
       const anchor = `${file.rel}:${line.n}`;
       let depth = 0;
       let started = false;
@@ -4775,17 +5624,17 @@ function findTsTypeSites(tree) {
         const bl = lines[j];
         if (!bl.comment) {
           if (!found) {
-            const lit = bl.raw.match(TS_TYPE_LITERAL_RE);
+            const lit = matchInCode(file, bl, TS_TYPE_LITERAL_RE);
             if (lit) {
               value = lit[1];
               found = true;
-            } else if (TS_TYPE_KEY_RE.test(bl.raw)) {
+            } else if (testInCode(file, bl, TS_TYPE_KEY_RE)) {
               unresolved = true;
               found = true;
             }
           }
-          depth += (bl.raw.match(/\{/g) ?? []).length;
-          depth -= (bl.raw.match(/\}/g) ?? []).length;
+          depth += countInCode(file, bl, "{");
+          depth -= countInCode(file, bl, "}");
           if (depth > 0) started = true;
         }
         if (started && depth <= 0) break;
@@ -4813,7 +5662,7 @@ var dExt3 = {
     const decided = (() => {
       const declared = /* @__PURE__ */ new Set();
       let firstAnchor2 = null;
-      const manifests = findExtensionManifests3(tree.root);
+      const manifests = findExtensionManifests(tree);
       for (const manifestPath2 of manifests) {
         const shortPath = manifestPath2.split("/").slice(-2).join("/");
         const parsed = readJsonObject(manifestPath2);
@@ -4920,8 +5769,8 @@ var dExt3 = {
 };
 
 // src/detectors/dExt4.ts
-import { readdirSync as readdirSync7, statSync as statSync8 } from "fs";
-import { join as join15 } from "path";
+import { readdirSync as readdirSync5, statSync as statSync6 } from "fs";
+import { join as join13 } from "path";
 function canonical(name) {
   return name.replace(/[-_]/g, "").toLowerCase();
 }
@@ -4940,71 +5789,40 @@ function dExt4PositiveControls() {
     }
   };
 }
-var SKIP_DIRS5 = /* @__PURE__ */ new Set(["node_modules", "dist", "build", ".git", "coverage"]);
-function findExtensionManifests4(root) {
+function findHooksDirs(tree) {
+  const root = tree.root;
   const out = [];
   let base;
   try {
-    base = statSync8(root).isDirectory() ? root : join15(root, "..");
+    base = statSync6(root).isDirectory() ? root : join13(root, "..");
   } catch {
     return out;
   }
   const walk2 = (dir) => {
     let entries;
     try {
-      entries = readdirSync7(dir);
+      entries = readdirSync5(dir);
     } catch {
       return;
     }
     for (const name of entries) {
-      const full = join15(dir, name);
+      const full = join13(dir, name);
       let st;
       try {
-        st = statSync8(full);
+        st = statSync6(full);
       } catch {
         continue;
       }
-      if (st.isDirectory()) {
-        if (SKIP_DIRS5.has(name)) continue;
-        walk2(full);
-      } else if (name === "extension.json") {
-        out.push(full);
-      }
-    }
-  };
-  walk2(base);
-  return out;
-}
-function findHooksDirs(root) {
-  const out = [];
-  let base;
-  try {
-    base = statSync8(root).isDirectory() ? root : join15(root, "..");
-  } catch {
-    return out;
-  }
-  const walk2 = (dir) => {
-    let entries;
-    try {
-      entries = readdirSync7(dir);
-    } catch {
-      return;
-    }
-    for (const name of entries) {
-      const full = join15(dir, name);
-      let st;
-      try {
-        st = statSync8(full);
-      } catch {
+      if (!st.isDirectory()) continue;
+      if (SKIP_DIRS.has(name)) {
+        recordSkip(tree, full, base);
         continue;
       }
-      if (!st.isDirectory()) continue;
-      if (SKIP_DIRS5.has(name)) continue;
       if (name === "hooks") {
         const tokens = /* @__PURE__ */ new Set();
         let files;
         try {
-          files = readdirSync7(full);
+          files = readdirSync5(full);
         } catch {
           files = [];
         }
@@ -5033,7 +5851,7 @@ function findFactorySites(tree) {
     for (let i = 0; i < lines.length; i++) {
       const line = lines[i];
       if (line.comment) continue;
-      if (LIFECYCLE_OBJ_RE.test(line.raw)) {
+      if (testInCode(file, line, LIFECYCLE_OBJ_RE)) {
         const anchor = `${file.rel}:${line.n}`;
         const tokens = /* @__PURE__ */ new Set();
         let depth = 0;
@@ -5041,20 +5859,19 @@ function findFactorySites(tree) {
         for (let j = i; j < lines.length; j++) {
           const bl = lines[j];
           if (bl.comment) continue;
-          const raw = bl.raw;
           if (started && depth === 1) {
-            const k = raw.match(OBJECT_KEY_RE);
+            const k = matchInCode(file, bl, OBJECT_KEY_RE);
             if (k) tokens.add(canonical(k[1]));
           }
-          depth += (raw.match(/\{/g) ?? []).length;
-          depth -= (raw.match(/\}/g) ?? []).length;
+          depth += countInCode(file, bl, "{");
+          depth -= countInCode(file, bl, "}");
           if (depth > 0) started = true;
           if (started && depth <= 0) break;
         }
         sites.push({ anchor, tokens });
         continue;
       }
-      if (LIFECYCLE_KEY_RE.test(line.raw)) {
+      if (testInCode(file, line, LIFECYCLE_KEY_RE)) {
         unresolved.push(`${file.rel}:${line.n}`);
       }
     }
@@ -5082,7 +5899,7 @@ var dExt4 = {
     }
     const unreadable = [];
     const decided = (() => {
-      const hooksDirs = findHooksDirs(tree.root);
+      const hooksDirs = findHooksDirs(tree);
       const { sites, unresolved } = findFactorySites(tree);
       for (const anchor of unresolved) {
         unreadable.push({
@@ -5094,7 +5911,7 @@ var dExt4 = {
       for (const d of hooksDirs) for (const t of d.tokens) implemented.add(t);
       for (const s of sites) for (const t of s.tokens) implemented.add(t);
       const implSurfacePresent = hooksDirs.length > 0 || sites.length > 0;
-      const manifests = findExtensionManifests4(tree.root);
+      const manifests = findExtensionManifests(tree);
       let declaredAnyLifecycle = false;
       for (const manifestPath2 of manifests) {
         const shortPath = manifestPath2.split("/").slice(-2).join("/");
@@ -5163,8 +5980,8 @@ var dExt4 = {
 };
 
 // src/detectors/dExt5.ts
-import { existsSync as existsSync12, readdirSync as readdirSync8, statSync as statSync9 } from "fs";
-import { dirname as dirname7, join as join16 } from "path";
+import { existsSync as existsSync12 } from "fs";
+import { dirname as dirname7, join as join14 } from "path";
 function nonEmptyString(v) {
   return typeof v === "string" && v.trim().length > 0;
 }
@@ -5178,41 +5995,6 @@ function dExt5PositiveControls() {
     }
   };
 }
-var SKIP_DIRS6 = /* @__PURE__ */ new Set(["node_modules", "dist", "build", ".git", "coverage"]);
-function findExtensionManifests5(root) {
-  const out = [];
-  let base;
-  try {
-    base = statSync9(root).isDirectory() ? root : join16(root, "..");
-  } catch {
-    return out;
-  }
-  const walk2 = (dir) => {
-    let entries;
-    try {
-      entries = readdirSync8(dir);
-    } catch {
-      return;
-    }
-    for (const name of entries) {
-      const full = join16(dir, name);
-      let st;
-      try {
-        st = statSync9(full);
-      } catch {
-        continue;
-      }
-      if (st.isDirectory()) {
-        if (SKIP_DIRS6.has(name)) continue;
-        walk2(full);
-      } else if (name === "extension.json") {
-        out.push(full);
-      }
-    }
-  };
-  walk2(base);
-  return out;
-}
 function isToolExtension(type) {
   return typeof type === "string" && type.includes("tool-extension");
 }
@@ -5225,7 +6007,7 @@ var dExt5 = {
         `DExt5 bilingual control FAILED: accept(\`${FR_POSITIVE}\`)=${controls.descriptionFr.positive} reject(empty)=${!controls.descriptionFr.negative} \u2014 FR-string matcher broken, absence verdict untrustworthy`
       );
     }
-    const manifests = findExtensionManifests5(tree.root);
+    const manifests = findExtensionManifests(tree);
     if (manifests.length === 0) {
       return {
         id: this.id,
@@ -5259,7 +6041,7 @@ var dExt5 = {
       if (!nonEmptyString(parsed.description_fr)) {
         missing.push("description_fr (extension.json)");
       }
-      if (!existsSync12(join16(root, "README.fr.md"))) {
+      if (!existsSync12(join14(root, "README.fr.md"))) {
         missing.push("README.fr.md");
       }
       if (isToolExtension(parsed.type) && "tools" in parsed) {
@@ -5302,8 +6084,8 @@ var dExt5 = {
 };
 
 // src/detectors/dExt7.ts
-import { existsSync as existsSync13, readdirSync as readdirSync9, statSync as statSync10 } from "fs";
-import { dirname as dirname8, join as join17 } from "path";
+import { existsSync as existsSync13 } from "fs";
+import { dirname as dirname8, join as join15 } from "path";
 var ABSENCE_FLAG_FIELDS = [
   "extensionAbsent",
   "extension_absent",
@@ -5346,41 +6128,6 @@ function dExt7PositiveControls() {
     negative: isAbsenceCase(ABSENCE_NEGATIVE)
   };
 }
-var SKIP_DIRS7 = /* @__PURE__ */ new Set(["node_modules", "dist", "build", ".git", "coverage"]);
-function findExtensionManifests6(root) {
-  const out = [];
-  let base;
-  try {
-    base = statSync10(root).isDirectory() ? root : join17(root, "..");
-  } catch {
-    return out;
-  }
-  const walk2 = (dir) => {
-    let entries;
-    try {
-      entries = readdirSync9(dir);
-    } catch {
-      return;
-    }
-    for (const name of entries) {
-      const full = join17(dir, name);
-      let st;
-      try {
-        st = statSync10(full);
-      } catch {
-        continue;
-      }
-      if (st.isDirectory()) {
-        if (SKIP_DIRS7.has(name)) continue;
-        walk2(full);
-      } else if (name === "extension.json") {
-        out.push(full);
-      }
-    }
-  };
-  walk2(base);
-  return out;
-}
 var dExt7 = {
   id: "DExt7 eval-coverage",
   run(tree) {
@@ -5390,7 +6137,7 @@ var dExt7 = {
         `DExt7 absence-matcher control FAILED: flag=${controls.flag} token=${controls.token} label=${controls.label} reject(normal)=${!controls.negative} \u2014 absence matcher broken, eval-coverage verdict untrustworthy`
       );
     }
-    const manifests = findExtensionManifests6(tree.root);
+    const manifests = findExtensionManifests(tree);
     if (manifests.length === 0) {
       return {
         id: this.id,
@@ -5404,7 +6151,7 @@ var dExt7 = {
       for (const manifestPath2 of manifests) {
         const extDir = dirname8(manifestPath2);
         const extLabel = extDir.split("/").pop() ?? extDir;
-        const evalsPath = join17(extDir, "evals", "evals.json");
+        const evalsPath = join15(extDir, "evals", "evals.json");
         const shortPath = `${extLabel}/evals/evals.json`;
         if (!existsSync13(evalsPath)) {
           return {
@@ -5470,8 +6217,8 @@ var dExt7 = {
 };
 
 // src/detectors/dExt8.ts
-import { existsSync as existsSync14, readdirSync as readdirSync10, statSync as statSync11 } from "fs";
-import { dirname as dirname9, join as join18 } from "path";
+import { existsSync as existsSync14 } from "fs";
+import { dirname as dirname9, join as join16 } from "path";
 var SEMVER_RE2 = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$/;
 var POSITIVE_CONTROL5 = "1.2.3-beta.1+build.7";
 function dExt8PositiveControl() {
@@ -5481,41 +6228,6 @@ function dExt8PositiveControl() {
     matched: SEMVER_RE2.test(POSITIVE_CONTROL5)
   };
 }
-var SKIP_DIRS8 = /* @__PURE__ */ new Set(["node_modules", "dist", "build", ".git", "coverage"]);
-function findExtensionManifests7(root) {
-  const out = [];
-  let base;
-  try {
-    base = statSync11(root).isDirectory() ? root : join18(root, "..");
-  } catch {
-    return out;
-  }
-  const walk2 = (dir) => {
-    let entries;
-    try {
-      entries = readdirSync10(dir);
-    } catch {
-      return;
-    }
-    for (const name of entries) {
-      const full = join18(dir, name);
-      let st;
-      try {
-        st = statSync11(full);
-      } catch {
-        continue;
-      }
-      if (st.isDirectory()) {
-        if (SKIP_DIRS8.has(name)) continue;
-        walk2(full);
-      } else if (name === "extension.json") {
-        out.push(full);
-      }
-    }
-  };
-  walk2(base);
-  return out;
-}
 var dExt8 = {
   id: "DExt8 semver+changelog",
   run(tree) {
@@ -5525,7 +6237,7 @@ var dExt8 = {
         `DExt8 positive control FAILED: pattern /${control.pattern}/ did not match sample \`${control.sample}\` \u2014 matcher broken, verdict untrustworthy`
       );
     }
-    const manifests = findExtensionManifests7(tree.root);
+    const manifests = findExtensionManifests(tree);
     if (manifests.length === 0) {
       return {
         id: this.id,
@@ -5540,7 +6252,7 @@ var dExt8 = {
     for (const manifestPath2 of manifests) {
       const extDir = dirname9(manifestPath2);
       const extLabel = extDir.split("/").pop() ?? extDir;
-      const pkgPath = join18(extDir, "package.json");
+      const pkgPath = join16(extDir, "package.json");
       const shortPkgPath = `${extLabel}/package.json`;
       if (!existsSync14(pkgPath)) {
         unreadable.push({
@@ -5577,7 +6289,7 @@ var dExt8 = {
         continue;
       }
       const validSemver = SEMVER_RE2.test(version);
-      const changelogPath = join18(extDir, "CHANGELOG.md");
+      const changelogPath = join16(extDir, "CHANGELOG.md");
       const hasChangelog = existsSync14(changelogPath);
       if (!validSemver) {
         finding ??= {
@@ -5612,38 +6324,41 @@ var dExt8 = {
 };
 
 // src/detectors/dExt9.ts
-import { readFileSync as readFileSync10, readdirSync as readdirSync11, statSync as statSync12 } from "fs";
-import { join as join19 } from "path";
-var SKIP_DIRS9 = /* @__PURE__ */ new Set(["node_modules", "dist", "build", ".git", "coverage"]);
-function collectHooksDirSources(root, unreadable) {
+import { readFileSync as readFileSync10, readdirSync as readdirSync6, statSync as statSync7 } from "fs";
+import { join as join17 } from "path";
+function collectHooksDirSources(tree, unreadable) {
+  const root = tree.root;
   const out = [];
   let base;
   try {
-    base = statSync12(root).isDirectory() ? root : join19(root, "..");
+    base = statSync7(root).isDirectory() ? root : join17(root, "..");
   } catch {
     return out;
   }
   const walk2 = (dir) => {
     let entries;
     try {
-      entries = readdirSync11(dir);
+      entries = readdirSync6(dir);
     } catch {
       return;
     }
     for (const name of entries) {
-      const full = join19(dir, name);
+      const full = join17(dir, name);
       let st;
       try {
-        st = statSync12(full);
+        st = statSync7(full);
       } catch {
         continue;
       }
       if (!st.isDirectory()) continue;
-      if (SKIP_DIRS9.has(name)) continue;
+      if (SKIP_DIRS.has(name)) {
+        recordSkip(tree, full, base);
+        continue;
+      }
       if (name === "hooks") {
         let files;
         try {
-          files = readdirSync11(full);
+          files = readdirSync6(full);
         } catch {
           files = [];
         }
@@ -5651,7 +6366,7 @@ function collectHooksDirSources(root, unreadable) {
           if (!f.endsWith(".ts") || f.endsWith(".d.ts")) continue;
           const stem = f.replace(/\.ts$/, "");
           if (stem === "index") continue;
-          const filePath = join19(full, f);
+          const filePath = join17(full, f);
           let body;
           try {
             body = readFileSync10(filePath, "utf8");
@@ -5685,7 +6400,7 @@ function collectFactorySources(tree) {
     for (let i = 0; i < lines.length; i++) {
       const line = lines[i];
       if (line.comment) continue;
-      if (!LIFECYCLE_OBJ_RE2.test(line.raw)) continue;
+      if (!testInCode(file, line, LIFECYCLE_OBJ_RE2)) continue;
       let depth = 0;
       let started = false;
       let curKey = null;
@@ -5695,7 +6410,7 @@ function collectFactorySources(tree) {
         if (bl.comment) continue;
         const raw = bl.raw;
         if (started && depth === 1) {
-          const k = raw.match(OBJECT_KEY_RE2);
+          const k = matchInCode(file, bl, OBJECT_KEY_RE2);
           if (k) {
             curKey = canonical(k[1]);
             keyBodies.set(curKey, []);
@@ -5704,8 +6419,8 @@ function collectFactorySources(tree) {
         if (curKey && depth >= 1) {
           keyBodies.get(curKey)?.push(raw);
         }
-        depth += (raw.match(/\{/g) ?? []).length;
-        depth -= (raw.match(/\}/g) ?? []).length;
+        depth += countInCode(file, bl, "{");
+        depth -= countInCode(file, bl, "}");
         if (depth > 0) started = true;
         if (started && depth <= 0) break;
       }
@@ -5756,7 +6471,7 @@ var dExt9 = {
     const unreadable = [];
     const decided = (() => {
       const hookSources = [
-        ...collectHooksDirSources(tree.root, unreadable),
+        ...collectHooksDirSources(tree, unreadable),
         ...collectFactorySources(tree)
       ];
       const implByToken = /* @__PURE__ */ new Map();
@@ -5765,7 +6480,7 @@ var dExt9 = {
         list.push(s);
         implByToken.set(s.token, list);
       }
-      const manifests = findExtensionManifests4(tree.root);
+      const manifests = findExtensionManifests(tree);
       let declaredAnyLifecycle = false;
       for (const manifestPath2 of manifests) {
         const shortPath = manifestPath2.split("/").slice(-2).join("/");
@@ -6501,6 +7216,436 @@ var dServer14 = {
   }
 };
 
+// src/detectors/s28-claim-forwarded.ts
+import { existsSync as existsSync15, readFileSync as readFileSync11, readdirSync as readdirSync7, statSync as statSync8 } from "fs";
+import { dirname as dirname10, join as join18, relative as relative4 } from "path";
+var PIN11 = "bacc54a53d5f6f9f20e5254908e2b46807902faa";
+var CLAIM_TOKEN = /\bverified(?:Org|Person)\b/;
+var ANY_CLAIM = /\bverified(?:Actor|Org|Person)\b/g;
+var CALL_RE = /\b([A-Za-z_$][\w$]*)\s*\.\s*(query|mutation|action)\s*\(/g;
+var GUARD_RE = /\b(?:unresolved\w*Denial|requireVerified\w+|requireClaim\w*)\s*\(|verified-org-unresolved/;
+var FLEET_WIDE = /fleet-wide:\s*\S[^\n]{7,}/;
+var SCOPE_MARKERS = /\bwithOrgScope\b|\brequireAuthenticatedCaller\b|\bresolveInboxReader\b|\bresolveVerified\w*\b|\brequireScope\b|\bgetUserIdentity\b|\bisMaster\b|\bscope\b/;
+var ACTOR_SET_RE = /\bconst\s+(VERIFIED_\w*DOORS)\b[^=]*=\s*new\s+Set\s*(?:<[^>]*>)?\s*\(\s*\[([\s\S]*?)\]\s*\)/;
+function masked(file) {
+  const out = [];
+  for (const line of file.lines) {
+    let row = "";
+    for (let c = 0; c < line.raw.length; c++) {
+      const ch = line.raw[c];
+      row += ch === " " || ch === "	" || ch === "\r" || isCodeAt(file, line.n, c) ? ch : " ";
+    }
+    out.push(row);
+  }
+  return out.join("\n");
+}
+function rawText(file) {
+  return file.lines.map((l) => l.raw).join("\n");
+}
+function lineAt(text, offset) {
+  let n = 1;
+  for (let i = 0; i < offset && i < text.length; i++) if (text.charCodeAt(i) === 10) n++;
+  return n;
+}
+var OPEN = { "(": ")", "[": "]", "{": "}" };
+function matchClose(m, open) {
+  const stack = [];
+  for (let i = open; i < m.length; i++) {
+    const ch = m[i];
+    if (OPEN[ch] !== void 0) stack.push(OPEN[ch]);
+    else if (ch === ")" || ch === "]" || ch === "}") {
+      if (stack.pop() !== ch) return -1;
+      if (stack.length === 0) return i;
+    }
+  }
+  return -1;
+}
+function splitTop(m, from, to) {
+  const parts = [];
+  let depth = 0;
+  let start = from;
+  for (let i = from; i < to; i++) {
+    const ch = m[i];
+    if (OPEN[ch] !== void 0) depth++;
+    else if (ch === ")" || ch === "]" || ch === "}") depth--;
+    else if (ch === "," && depth === 0) {
+      parts.push([start, i]);
+      start = i + 1;
+    }
+  }
+  if (start < to && m.slice(start, to).trim() !== "") parts.push([start, to]);
+  return parts;
+}
+function listTs(dir, out = []) {
+  let names;
+  try {
+    names = readdirSync7(dir);
+  } catch {
+    return out;
+  }
+  for (const n of names) {
+    if (n === "node_modules" || n === "_generated" || n === "__tests__") continue;
+    const p = join18(dir, n);
+    let st;
+    try {
+      st = statSync8(p);
+    } catch {
+      continue;
+    }
+    if (st.isDirectory()) listTs(p, out);
+    else if (n.endsWith(".ts") && !n.endsWith(".test.ts") && !n.endsWith(".d.ts")) out.push(p);
+  }
+  return out;
+}
+function discoverBackend(root) {
+  let dir = root;
+  try {
+    if (!statSync8(root).isDirectory()) dir = dirname10(root);
+  } catch {
+    return void 0;
+  }
+  for (let up = 0; up < 5; up++) {
+    const cand = join18(dir, "convex");
+    if (existsSync15(join18(cand, "schema.ts"))) return cand;
+    const parent = dirname10(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return void 0;
+}
+function readDoors(backendRoot) {
+  const doors = /* @__PURE__ */ new Map();
+  for (const path of listTs(backendRoot)) {
+    let text;
+    try {
+      text = readFileSync11(path, "utf8");
+    } catch {
+      continue;
+    }
+    const file = {
+      path,
+      rel: relative4(backendRoot, path),
+      lines: text.split("\n").map((raw, i) => ({ n: i + 1, raw, comment: false }))
+    };
+    const m = masked(file);
+    const module = relative4(backendRoot, path).replace(/\.ts$/, "").split("\\").join("/");
+    const re = /\bexport\s+const\s+([A-Za-z_$][\w$]*)\s*=\s*(?:query|mutation|action)\s*\(/g;
+    for (let hit = re.exec(m); hit; hit = re.exec(m)) {
+      const open = hit.index + hit[0].length - 1;
+      const close = matchClose(m, open);
+      if (close < 0) continue;
+      let start = hit.index;
+      const lines = text.slice(0, start).split("\n");
+      let k = lines.length - 2;
+      while (k >= 0 && (lines[k].trim() === "" || /^\s*(\/\/|\/\*|\*)/.test(lines[k])) && lines.length - 2 - k < 60)
+        k--;
+      start = lines.slice(0, k + 1).join("\n").length;
+      const region = text.slice(start, close + 1);
+      const mRegion = m.slice(hit.index, close + 1);
+      const claims = [];
+      const am = /\bargs\s*:\s*/.exec(mRegion);
+      if (am) {
+        const at = hit.index + am.index + am[0].length;
+        let argsText = "";
+        if (m[at] === "{") argsText = text.slice(at, matchClose(m, at) + 1);
+        else {
+          const id = /^[A-Za-z_$][\w$]*/.exec(m.slice(at));
+          if (id) {
+            const dm = new RegExp(`\\bconst\\s+${id[0]}\\b[^=]*=\\s*`).exec(m);
+            if (dm) {
+              let p = dm.index + dm[0].length;
+              if (m.slice(p).startsWith("v.object(")) p += "v.object(".length;
+              if (m[p] === "{") argsText = text.slice(p, matchClose(m, p) + 1);
+            }
+          }
+        }
+        for (const c of argsText.match(ANY_CLAIM) ?? []) if (!claims.includes(c)) claims.push(c);
+      }
+      let exit;
+      if (/\brequireServiceAccount\b/.test(mRegion))
+        exit = "service-account-only (requireServiceAccount)";
+      else if (/\brequireResolvedCaller\s*\([^)]*masterOnly[^)]*mcpBoundOnly|\brequireResolvedCaller\s*\([^)]*mcpBoundOnly[^)]*masterOnly/s.test(
+        mRegion
+      ))
+        exit = "service-account-only (requireResolvedCaller masterOnly+mcpBoundOnly)";
+      else {
+        const fw = FLEET_WIDE.exec(region);
+        if (fw) exit = `fleet-wide declaration (${fw[0].slice(11).trim().slice(0, 80)})`;
+      }
+      doors.set(`${module}:${hit[1]}`, {
+        claims,
+        exit,
+        resolvesCaller: SCOPE_MARKERS.test(mRegion)
+      });
+    }
+  }
+  return doors;
+}
+function definitionOf(name, files) {
+  const esc = name.replace(/\$/g, "\\$");
+  const re = new RegExp(`(?:\\b(?:const|let|var)\\s+${esc}\\b|\\bfunction\\s+${esc}\\b)`);
+  for (const f of files) {
+    const hit = re.exec(f.m);
+    if (!hit) continue;
+    let depth = 0;
+    for (let i = hit.index + hit[0].length; i < f.m.length; i++) {
+      const ch = f.m[i];
+      if (OPEN[ch] !== void 0) {
+        depth++;
+      } else if (ch === ")" || ch === "]" || ch === "}") {
+        depth--;
+        if (depth === 0 && ch === "}" && /\bfunction\b/.test(hit[0]))
+          return { mask: f.m.slice(hit.index, i + 1) };
+      } else if (ch === ";" && depth === 0 && !/\bfunction\b/.test(hit[0])) {
+        return { mask: f.m.slice(hit.index, i + 1) };
+      }
+      if (depth < 0) break;
+    }
+    return { mask: f.m.slice(hit.index, Math.min(f.m.length, hit.index + 1500)) };
+  }
+  return void 0;
+}
+function readHelper(name, files, seen = /* @__PURE__ */ new Set(), depth = 0) {
+  if (seen.has(name) || depth > 3) return { forwards: false, optional: false };
+  seen.add(name);
+  const def = definitionOf(name, files);
+  if (!def) return { forwards: false, optional: false };
+  let forwards = CLAIM_TOKEN.test(def.mask);
+  const optional = /:\s*\{\s*\}|return\s*\{\s*\}|\?\?\s*\{\s*\}/.test(def.mask);
+  if (!forwards) {
+    for (const c of def.mask.matchAll(/\b([A-Za-z_$][\w$]*)\s*\(/g)) {
+      const sub = readHelper(c[1], files, seen, depth + 1);
+      if (sub.forwards) {
+        forwards = true;
+        break;
+      }
+    }
+  }
+  return { forwards, optional };
+}
+function toolNameBefore(text, offset) {
+  const head = text.slice(0, offset);
+  const open = Math.max(head.lastIndexOf("defineTool("), head.lastIndexOf("registerTool("));
+  if (open >= 0) {
+    const m = /^\s*"([a-z][a-z0-9_]*)",?\s*$/m.exec(head.slice(open));
+    if (m) return { name: m[1], start: open };
+    const r = /registerTool\(\s*"([a-z][a-z0-9_]*)"/.exec(head.slice(open));
+    if (r) return { name: r[1], start: open };
+    return { name: void 0, start: open };
+  }
+  const lines = head.split("\n");
+  const back = Math.max(0, lines.length - 120);
+  return { name: void 0, start: lines.slice(0, back).join("\n").length };
+}
+function scanS28(tree) {
+  const scan = { violate: [], conform: [], cnj: [], calls: 0, backend: void 0 };
+  const backendRoot = tree.backendRoot ?? discoverBackend(tree.root);
+  scan.backend = backendRoot;
+  const doors = backendRoot ? readDoors(backendRoot) : void 0;
+  const files = tree.files.map((f) => ({ f, text: rawText(f), m: masked(f) }));
+  const actorDoors = /* @__PURE__ */ new Set();
+  for (const { text } of files) {
+    const hit = ACTOR_SET_RE.exec(text);
+    if (hit) for (const s of hit[2].matchAll(/["'`]([\w/]+:[\w]+)["'`]/g)) actorDoors.add(s[1]);
+  }
+  for (const { f, text, m } of files) {
+    for (let hit = CALL_RE.exec(m); hit; hit = CALL_RE.exec(m)) {
+      const recv = hit[1];
+      if (!/convex|client/i.test(recv)) continue;
+      const open = hit.index + hit[0].length - 1;
+      const close = matchClose(m, open);
+      if (close < 0) continue;
+      scan.calls++;
+      const line = lineAt(text, hit.index);
+      const tool = toolNameBefore(text, hit.index);
+      const parts = splitTop(m, open + 1, close);
+      let door;
+      if (parts[0]) {
+        const rawFirst = text.slice(parts[0][0], parts[0][1]);
+        const lit = /^\s*(?:\/\/[^\n]*\n\s*)*["'`]([\w/]+:[\w]+)["'`]/.exec(rawFirst);
+        const ref = /^\s*(?:api|internal)\.([\w]+)\.([\w]+)/.exec(rawFirst);
+        if (lit) door = lit[1];
+        else if (ref) door = `${ref[1]}:${ref[2]}`;
+      }
+      const site = (note) => ({
+        file: f.rel,
+        line,
+        door: door ?? "?",
+        tool: tool.name,
+        note
+      });
+      if (door === void 0) {
+        scan.cnj.push(
+          site(
+            "the door is named by an expression the scan cannot resolve (not statically resolvable)"
+          )
+        );
+        continue;
+      }
+      const argText = parts[1] ? m.slice(parts[1][0], parts[1][1]) : "";
+      const region = m.slice(tool.start, hit.index);
+      const regionRaw = text.slice(tool.start, hit.index);
+      const guard = GUARD_RE.test(region) || GUARD_RE.test(regionRaw);
+      let direct = CLAIM_TOKEN.test(argText);
+      let viaHelper;
+      let virtual = argText;
+      const bare = /^\s*([A-Za-z_$][\w$]*)\s*$/.exec(argText);
+      if (bare && !direct) {
+        const v = bare[1].replace(/\$/g, "\\$");
+        const pieces = [];
+        for (const a of region.matchAll(new RegExp(`Object\\.assign\\s*\\(\\s*${v}\\s*,`, "g"))) {
+          const o = a.index + a[0].length - 1;
+          const c = matchClose(region, region.lastIndexOf("(", o));
+          pieces.push(region.slice(o, c < 0 ? o + 400 : c));
+        }
+        for (const a of region.matchAll(
+          new RegExp(`\\b${v}\\.verified(?:Org|Person|Actor)\\b`, "g")
+        ))
+          pieces.push(a[0]);
+        const decl = new RegExp(`\\b(?:const|let)\\s+${v}\\b[^=]*=\\s*\\{`).exec(region);
+        if (decl) {
+          const o = decl.index + decl[0].length - 1;
+          const c = matchClose(region, o);
+          pieces.push(region.slice(o, c < 0 ? o + 600 : c + 1));
+        }
+        virtual = pieces.join("\n");
+        direct = CLAIM_TOKEN.test(virtual);
+      }
+      if (!direct) {
+        for (const sp of virtual.matchAll(/\.\.\.\s*([A-Za-z_$][\w$]*)/g)) {
+          const h = readHelper(sp[1], files);
+          if (h.forwards) {
+            viaHelper = h;
+            break;
+          }
+        }
+        if (!viaHelper) {
+          for (const sp of virtual.matchAll(/\b([A-Za-z_$][\w$]*)\s*\(\s*\)/g)) {
+            const h = readHelper(sp[1], files);
+            if (h.forwards) {
+              viaHelper = h;
+              break;
+            }
+          }
+        }
+      }
+      if (direct) {
+        scan.conform.push(site("forwards the verified claim in the call"));
+        continue;
+      }
+      if (viaHelper) {
+        if (viaHelper.optional && !guard) {
+          scan.violate.push(
+            site(
+              "forwards its claim through an optional helper (it returns {} when the bearer holds none) and no refusal precedes the call in the handler: a bearer with no resolvable organisation is sent claimless"
+            )
+          );
+        } else {
+          scan.conform.push(
+            site(
+              viaHelper.optional ? "forwards the verified claim through a helper and refuses before the call when it holds none" : "forwards the verified claim through a helper"
+            )
+          );
+        }
+        continue;
+      }
+      if (!doors) {
+        scan.cnj.push(
+          site(
+            "forwards no verified claim and no backend source was found above the scanned tree (no convex/ with a schema.ts, and no backend root given): whether the door is an exit cannot be read"
+          )
+        );
+        continue;
+      }
+      const info = doors.get(door);
+      if (!info) {
+        scan.cnj.push(
+          site(
+            `forwards no verified claim and the door ${door} is not defined in the supplied backend (${backendRoot})`
+          )
+        );
+        continue;
+      }
+      if (info.exit) {
+        scan.conform.push(site(`needs no claim: the door is ${info.exit}`));
+        continue;
+      }
+      if (!info.resolvesCaller) {
+        scan.cnj.push(
+          site(
+            `forwards no verified claim and the door ${door} shows no caller resolution in its own source (its scope comes from a helper or a run call that this scan does not follow)`
+          )
+        );
+        continue;
+      }
+      const accepts = info.claims.length > 0 ? `the door accepts ${info.claims.join(", ")} and the tool omits it` : "the door accepts no claim argument, so R-54 must add one before the tool can forward it";
+      const actorNote = actorDoors.has(door) ? "; verifiedActor is added by the wrapped client only for a bearer that resolved an agent, and a bearer that resolved no agent (a seat or person token, an org-level token) is sent claimless" : "";
+      scan.violate.push(site(`forwards no verified claim \u2014 ${accepts}${actorNote}`));
+    }
+  }
+  return scan;
+}
+function fmt(s) {
+  return `${s.file}:${s.line} ${s.door} ${s.tool ? `[${s.tool}] ` : ""}(${s.note})`;
+}
+var S28_ID = "S-28 claim-forwarded";
+var s28ClaimForwarded = {
+  id: S28_ID,
+  rule: "S-28",
+  pin: PIN11,
+  run(tree) {
+    const s = scanS28(tree);
+    const breakdown = `[conform=${s.conform.length} non-conforming=${s.violate.length} could-not-judge=${s.cnj.length}]`;
+    const list = (xs) => xs.slice(0, 5).map(fmt).join("; ");
+    if (s.violate.length > 0) {
+      const first = s.violate[0];
+      return {
+        id: S28_ID,
+        anchor: `${first.file}:${first.line}`,
+        state: "non-conforming",
+        verdict: `S-28: ${s.violate.length} backend call(s) VIOLATE (a tool forwards the verified claim of its caller to every backend door it calls, and refuses when it has none). ${breakdown} Violations: ${list(s.violate)}${s.violate.length > 5 ? `; +${s.violate.length - 5} more` : ""}.${s.cnj.length ? ` could-not-judge calls (a verdict is owed): ${list(s.cnj)}.` : ""}`
+      };
+    }
+    if (s.cnj.length > 0) {
+      const reason2 = `S-28: ${s.cnj.length} backend call(s) could not be judged \u2014 ${list(s.cnj)}. This is NOT a clean bill. ${breakdown}`;
+      return {
+        id: S28_ID,
+        anchor: `${s.cnj[0].file}:${s.cnj[0].line}`,
+        state: "could-not-judge",
+        verdict: reason2,
+        reason: reason2
+      };
+    }
+    if (s.conform.length > 0) {
+      return {
+        id: S28_ID,
+        anchor: `${s.conform[0].file}:${s.conform[0].line}`,
+        state: "present",
+        verdict: `S-28: ${s.conform.length} backend call(s) forward the verified claim or call a door that needs none; 0 violations. ${breakdown} Conform: ${list(s.conform)}.`
+      };
+    }
+    const usesBackend = tree.files.some(
+      (f) => f.lines.some((l) => !l.comment && /\bConvexHttpClient\b|from\s+["']convex\//.test(l.raw))
+    );
+    if (!usesBackend) {
+      return {
+        id: S28_ID,
+        anchor: "source:no-backend-client",
+        state: "absent",
+        verdict: `S-28: no Convex client is imported anywhere in the ${tree.files.length} file(s) read; no backend door is called, so there is no claim to forward (rule out of subject).`
+      };
+    }
+    const reason = `S-28: no applicable site \u2014 a Convex client is imported but none of the ${s.calls} <client>.query|mutation|action call(s) read names a door statically. NOT a clean bill.`;
+    return {
+      id: S28_ID,
+      anchor: "source:no-applicable-site",
+      state: "could-not-judge",
+      verdict: reason,
+      reason
+    };
+  }
+};
+
 // src/detectors/index.ts
 var detectors = [
   d2,
@@ -6534,6 +7679,7 @@ var detectors = [
   c22TestRatioGate,
   c25BuildIdentity,
   c26SubpackageLockfile,
+  s28ClaimForwarded,
   dServer2,
   dServer6,
   dDebugOptIn,
@@ -6547,23 +7693,24 @@ var detectors = [
   dExt5,
   dExt7,
   dExt8,
-  dExt9
+  dExt9,
+  localIdentity
 ];
 
 // src/runtime/launch.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import { existsSync as existsSync15, readFileSync as readFileSync11, statSync as statSync13 } from "fs";
-import { dirname as dirname10, isAbsolute, join as join20, resolve } from "path";
+import { existsSync as existsSync16, readFileSync as readFileSync12, statSync as statSync9 } from "fs";
+import { dirname as dirname11, isAbsolute, join as join19, resolve } from "path";
 function findPackageDir(target) {
   let dir;
   try {
-    dir = statSync13(target).isDirectory() ? target : dirname10(target);
+    dir = statSync9(target).isDirectory() ? target : dirname11(target);
   } catch {
     return null;
   }
   for (let depth = 0; depth < 8; depth++) {
-    if (existsSync15(join20(dir, "package.json"))) return dir;
-    const parent = dirname10(dir);
+    if (existsSync16(join19(dir, "package.json"))) return dir;
+    const parent = dirname11(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -6587,10 +7734,10 @@ function deriveLaunchPlan(target) {
   }
   let pkg;
   try {
-    pkg = JSON.parse(readFileSync11(join20(pkgDir, "package.json"), "utf8"));
+    pkg = JSON.parse(readFileSync12(join19(pkgDir, "package.json"), "utf8"));
   } catch (err) {
     return {
-      error: `could not parse ${join20(pkgDir, "package.json")}: ${err instanceof Error ? err.message : String(err)}`
+      error: `could not parse ${join19(pkgDir, "package.json")}: ${err instanceof Error ? err.message : String(err)}`
     };
   }
   const bin = firstBinEntry(pkg.bin);
@@ -6668,10 +7815,10 @@ function readEvalCounts(target) {
   if (!pkgDir) return counts;
   let dir = pkgDir;
   for (let depth = 0; depth < 8; depth++) {
-    const candidate = join20(dir, "evals", "evals.json");
-    if (existsSync15(candidate)) {
+    const candidate = join19(dir, "evals", "evals.json");
+    if (existsSync16(candidate)) {
       try {
-        const parsed = JSON.parse(readFileSync11(candidate, "utf8"));
+        const parsed = JSON.parse(readFileSync12(candidate, "utf8"));
         for (const c of parsed.cases ?? []) {
           if (c && typeof c.tool === "string") counts.set(c.tool, (counts.get(c.tool) ?? 0) + 1);
         }
@@ -6679,7 +7826,7 @@ function readEvalCounts(target) {
       }
       return counts;
     }
-    const parent = dirname10(dir);
+    const parent = dirname11(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -6687,7 +7834,7 @@ function readEvalCounts(target) {
 }
 function statSyncSafe(p) {
   try {
-    return statSync13(p).isDirectory();
+    return statSync9(p).isDirectory();
   } catch {
     return false;
   }
@@ -6806,8 +7953,11 @@ function reconcile(id, staticR, dynamicR) {
   };
 }
 function runDoctor(target, detectorList = detectors, opts = {}) {
+  return runDoctorReport(target, detectorList, opts).results;
+}
+function runDoctorReport(target, detectorList = detectors, opts = {}) {
   const mode = opts.mode ?? "static";
-  const tree = loadTree(target);
+  const tree = loadTree(target, opts.backend);
   const needsRuntime = mode !== "static" && detectorList.some((d) => typeof d.runDynamic === "function");
   const runtime = needsRuntime ? launchAndIntrospect(target) : null;
   const results = [];
@@ -6840,7 +7990,7 @@ function runDoctor(target, detectorList = detectors, opts = {}) {
       results.push(reconcile(d.id, staticR, dynamicR));
     }
   }
-  return results;
+  return { results, skipped: tree.skippedDirs };
 }
 async function invokeLiveChecked(d, session) {
   if (!session) {
@@ -6895,14 +8045,32 @@ async function runDoctorAsync(target, opts = {}) {
   }
   return results;
 }
-function renderTable(surface, results) {
+function renderSkipped(skipped) {
+  if (skipped.length === 0) {
+    return "skipped directories (0) \u2014 none: no directory was skipped on this run.";
+  }
+  const sorted = [...skipped].sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+  const head = `skipped directories (${sorted.length}) \u2014 NOT read on this run; a verdict above says nothing about what lies inside:`;
+  const rows = sorted.map(
+    (d) => `${d.path} | ${d.reason}${d.candidate ? ` | holds a deployment configuration: ${d.candidate}` : ""}`
+  );
+  return [head, "-".repeat(head.length), ...rows].join("\n");
+}
+function renderTable(surface, results, skipped) {
+  const body = renderResults(surface, results);
+  const section = skipped === void 0 ? "skipped directories: NOT REPORTED \u2014 the caller did not pass this run's skipped list (use runDoctorReport), so the scope above may be narrower than it reads." : renderSkipped(skipped);
+  return `${body}
+
+${section}`;
+}
+function renderResults(surface, results) {
   const cols = { item: 24, anchor: 26, state: 15 };
   const header = `${pad("item", cols.item)} | ${pad("file:line", cols.anchor)} | ${pad("state", cols.state)} | verdict`;
-  const sep = "-".repeat(header.length);
+  const sep3 = "-".repeat(header.length);
   const rows = results.map(
     (r) => `${pad(r.id, cols.item)} | ${pad(r.anchor, cols.anchor)} | ${pad(r.state, cols.state)} | ${r.verdict}`
   );
-  const table = [`surface: ${surface}`, header, sep, ...rows].join("\n");
+  const table = [`surface: ${surface}`, header, sep3, ...rows].join("\n");
   const unjudged = results.filter((r) => r.state === "could-not-judge");
   if (unjudged.length === 0) return table;
   const cnjHeader = `could-not-judge (${unjudged.length}) \u2014 the doctor could NOT read these; this is NOT a clean bill:`;
@@ -6918,11 +8086,16 @@ function computeExitCode(results) {
   return 0;
 }
 var USAGE = [
-  "usage: mcp-doctor <source-tree-path> [--mode=static|dynamic|both]",
+  "usage: mcp-doctor <source-tree-path> [--mode=static|dynamic|both] [--backend=<convex-dir>]",
   "",
   "  --mode=static   read the tree only (default)",
   "  --mode=dynamic  launch the server and judge what it serves",
   "  --mode=both     both, dynamic findings taking precedence",
+  "  --local-identity-ceiling=N",
+  "                  local identity primitives tolerated before DLocalIdentity",
+  "                  fails (default 0)",
+  "  --backend=DIR   the backend source (a convex/ dir) whose door list S-28 reads;",
+  "                  default: the nearest convex/ above the tree",
   "  --version       print the version and exit",
   "  --help          print this and exit",
   "",
@@ -6930,8 +8103,8 @@ var USAGE = [
 ].join("\n");
 function readVersion() {
   try {
-    const here = dirname11(fileURLToPath(import.meta.url));
-    const manifest = JSON.parse(readFileSync12(join21(here, "..", "package.json"), "utf8"));
+    const here = dirname12(fileURLToPath(import.meta.url));
+    const manifest = JSON.parse(readFileSync13(join20(here, "..", "package.json"), "utf8"));
     return manifest.version ?? null;
   } catch {
     return null;
@@ -6953,6 +8126,7 @@ function main() {
     return;
   }
   const modeArg = args.find((a) => a.startsWith("--mode="));
+  const backendArg = args.find((a) => a.startsWith("--backend="));
   const target = args.find((a) => !a.startsWith("--"));
   if (!target) {
     console.error(USAGE);
@@ -6963,8 +8137,24 @@ function main() {
     console.error(`unknown --mode "${mode}" \u2014 expected static|dynamic|both`);
     process.exit(1);
   }
-  const results = runDoctor(target, void 0, { mode });
-  console.log(renderTable(target, results));
+  const ceilingArg = args.find((a) => a.startsWith("--local-identity-ceiling="));
+  let detectorList = detectors;
+  if (ceilingArg) {
+    const raw = ceilingArg.slice("--local-identity-ceiling=".length);
+    const ceiling = /^\d+$/.test(raw) ? Number(raw) : Number.NaN;
+    if (!Number.isInteger(ceiling)) {
+      console.error(`invalid --local-identity-ceiling "${raw}" \u2014 expected a non-negative integer`);
+      process.exit(1);
+    }
+    const ratchet = makeLocalIdentity({ ceiling });
+    detectorList = detectors.map((d) => d === localIdentity ? ratchet : d);
+  }
+  const backend = backendArg ? backendArg.slice("--backend=".length) : void 0;
+  const { results, skipped } = runDoctorReport(target, detectorList, {
+    mode,
+    ...backend !== void 0 ? { backend } : {}
+  });
+  console.log(renderTable(target, results, skipped));
   process.exitCode = computeExitCode(results);
 }
 function isDirectInvocation() {
@@ -6986,7 +8176,9 @@ if (isDirectInvocation()) main();
 export {
   computeExitCode,
   isLiveDetector,
+  renderSkipped,
   renderTable,
   runDoctor,
-  runDoctorAsync
+  runDoctorAsync,
+  runDoctorReport
 };