{
  "schemaVersion": 1,
  "scope": "Application source and locked package inventory. Not provider infrastructure.",
  "sourceFingerprint": "26d310fa9a7f5d60d6eccce9028557ce2e625e4fd79cc68c7e44257a466e38d6",
  "phpPackaged": false,
  "sshPackaged": false,
  "phpPackages": [],
  "sshPackages": [],
  "forbiddenFiles": [],
  "workerThirdPartyRuntimeDependencies": [],
  "workerEntry": "src/worker.mjs",
  "workerServiceModel": "HTTP request handler with R2 binding; no application OS image or SSH listener.",
  "checksPerformed": [
    "Enumerated application source paths for PHP executable extensions.",
    "Matched locked package names against the published PHP and SSH package patterns.",
    "Bundled Worker dependencies restricted to application source and Web APIs."
  ],
  "limits": [
    "Package-name and file-extension checks alone are not a security audit.",
    "The hosting deployment correspondence is not independently attested.",
    "External providers, RPCs, wallets and onchain programs are outside this inventory."
  ]
}