{
  "schemaVersion": 1,
  "scope": "Application source and locked package inventory. Not provider infrastructure.",
  "sourceFingerprint": "0425ab135c00b20bf115c49eee58271b51e8e7e18d11bcde025c7199cef79b54",
  "phpPackaged": false,
  "sshPackaged": false,
  "phpPackages": [],
  "sshPackages": [],
  "forbiddenFiles": [],
  "workerThirdPartyRuntimeDependencies": [],
  "workerEntry": "src/worker.mjs",
  "workerServiceModel": "HTTP request handler with R2 binding; no application OS image or SSH listener.",
  "checksPerformed": [
    "Enumerated application source paths for PHP executable extensions.",
    "Matched locked package names against the published PHP and SSH package patterns.",
    "Bundled Worker dependencies restricted to application source and Web APIs."
  ],
  "limits": [
    "Package-name and file-extension checks alone are not a security audit.",
    "The hosting deployment correspondence is not independently attested.",
    "External providers, RPCs, wallets and onchain programs are outside this inventory."
  ]
}