0sec-cli 0.23.0 → 0.24.1

package/chunks/{chunk-TO35Y326.js → chunk-GTED3FSZ.js}

@@ -9,7 +9,10 @@ import {
 import {
   extractFileRefs,
   redactSensitiveHeaders
-} from "./chunk-UELXHK2Y.js";
+} from "./chunk-CGBDEST2.js";
+import {
+  getFindingPriority
+} from "./chunk-GXXX7AGH.js";
 import {
   __toESM
 } from "./chunk-VCSFCHAJ.js";
@@ -906,7 +909,7 @@ function impactForSeverity(severity) {
 function impactLine(finding) {
   const base = impactForSeverity(finding.severity);
   const a = finding.impactAssessment;
-  if (!a)
+  if (!a || !getFindingPriority(finding).assessed)
     return base;
   const gain = {
     rce: "remote code execution",

package/chunks/{chunk-LT7BFGXA.js → chunk-GV5WXDHY.js}

@@ -5,20 +5,20 @@ import {
   captureObservation,
   createEvolvedFinder,
   loadAppsecFinderLenses
-} from "./chunk-4HGGNBKK.js";
+} from "./chunk-ZM6ANQZJ.js";
+import {
+  ScanCostLedger
+} from "./chunk-BD7WULFS.js";
 import {
   loadEvolutionConfigFile
-} from "./chunk-AAA4PRWK.js";
+} from "./chunk-YKWARO3T.js";
 import {
   resolveOsecRunStorage,
   writeOsecRunReport
-} from "./chunk-T7ZEVY5G.js";
-import {
-  ScanCostLedger
-} from "./chunk-CP6HANBE.js";
+} from "./chunk-BMDG6T7D.js";
 import {
   eventBus
-} from "./chunk-A5QO7N3S.js";
+} from "./chunk-5PFRE522.js";
 
 // packages/cli/src/commands/deep-review.ts
 import { readFileSync, realpathSync, statSync } from "node:fs";
@@ -283,7 +283,7 @@ async function runDeepReview(opts) {
     cairoVerifyLenses,
     moveFinderLenses,
     moveVerifyLenses
-  } = await import("./dist-4LGRIBOC.js");
+  } = await import("./dist-TQMHMSBZ.js");
   opts.signal?.throwIfAborted();
   const costLedger = opts.costLedger ?? new ScanCostLedger();
   const scanStartedAt = Date.now();
@@ -330,7 +330,7 @@ async function runDeepReview(opts) {
     let lanes = null;
     let allocateAcrossLanes;
     if (opts.useThreatModel) {
-      const threatModule = await import("./dist-4LGRIBOC.js");
+      const threatModule = await import("./dist-TQMHMSBZ.js");
       allocateAcrossLanes = threatModule.allocateCandidatesAcrossLanes;
       const rtType = runtime !== "auto" ? runtime : "api";
       const plannerRuntime = opts.nativeRuntime ? {
@@ -654,7 +654,7 @@ async function deepReviewAction(target, opts) {
     costCeilingUsd = parsed;
   }
   const { writeFileSync } = await import("node:fs");
-  const { executeManagedOperation } = await import("./managed-operation-YNQQEA5V.js");
+  const { executeManagedOperation } = await import("./managed-operation-6R2QPPW5.js");
   const timeoutMs = parsePositive("--timeout", opts.timeout, 6e5);
   const outcome = await executeManagedOperation({
     type: "deep-review",

package/chunks/{chunk-LTEE2JWK.js → chunk-GXXX7AGH.js}

@@ -67,7 +67,7 @@ import { fileURLToPath } from "node:url";
 import { dirname, join } from "node:path";
 function loadVersion() {
   if (true) {
-    return "0.23.0";
+    return "0.24.1";
   }
   try {
     const here = dirname(fileURLToPath(import.meta.url));
@@ -189,6 +189,22 @@ var MANUAL_PRICING = {
   "qwen3.7-plus": { input: 0.5, output: 3, cachedInput: 0.05 },
   "qwen3.6-plus": { input: 0.5, output: 3, cachedInput: 0.05 },
   "qwen3.6-flash": { input: 0.1875, output: 1.125 },
+  // ClinePass reference quota rates, not incremental subscription charges.
+  // https://github.com/cline/cline/blob/main/docs/getting-started/clinepass.mdx
+  // checked 2026-10-05; DeepSeek uses peak rates; Qwen Plus <=256K only.
+  "cline-pass/glm-5.3": { input: 1.4, output: 4.4, cachedInput: 0.26 },
+  "cline-pass/glm-5.2": { input: 1.4, output: 4.4, cachedInput: 0.26 },
+  "cline-pass/kimi-k3": { input: 3, output: 15, cachedInput: 0.3 },
+  "cline-pass/kimi-k2.7-code": { input: 0.95, output: 4, cachedInput: 0.19 },
+  "cline-pass/kimi-k2.6": { input: 0.95, output: 4, cachedInput: 0.16 },
+  "cline-pass/deepseek-v4-pro": { input: 1.32, output: 3.96, cachedInput: 0.044 },
+  "cline-pass/deepseek-v4-flash": { input: 0.44, output: 1.32, cachedInput: 0.014 },
+  "cline-pass/mimo-v2.5": { input: 0.14, output: 0.28, cachedInput: 28e-4 },
+  "cline-pass/mimo-v2.5-pro": { input: 1.74, output: 3.48, cachedInput: 0.0145 },
+  "cline-pass/minimax-m3": { input: 0.3, output: 1.2, cachedInput: 0.06 },
+  "cline-pass/qwen3.8-max": { input: 2, output: 6, cachedInput: 0.25, cacheWrite: 2.5 },
+  "cline-pass/qwen3.7-max": { input: 2.5, output: 7.5, cachedInput: 0.5, cacheWrite: 3.125 },
+  "cline-pass/qwen3.7-plus": { input: 0.4, output: 1.6, cachedInput: 0.04, cacheWrite: 0.5 },
   // OpenCode Zen free tier (https://opencode.ai/docs/zen/) — zero-rate gateway
   // models; actual spend is $0 while the free period lasts.
   "muse-spark-1.3-contributor-free": { input: 0, output: 0 },
@@ -293,7 +309,9 @@ var MODEL_VENDOR_PREFIXES = [
   "openrouter/",
   "opencode/",
   "xai/",
-  "x-ai/"
+  "x-ai/",
+  "cline/",
+  "cline-pass/"
 ];
 function normalizeModel(model) {
   let key = model;
@@ -313,7 +331,7 @@ function normalizeModel(model) {
 function getRates(model) {
   const key = model ? normalizeModel(model) : "";
   const aliasKey = azureDeploymentPriceKey(key);
-  const rates = (model && Object.hasOwn(MODEL_PRICING, model) ? MODEL_PRICING[model] : void 0) ?? (model ? DISCOVERED_PRICING.get(model) : void 0) ?? (Object.hasOwn(MODEL_PRICING, key) ? MODEL_PRICING[key] : void 0) ?? (aliasKey ? MODEL_PRICING[aliasKey] : void 0) ?? DISCOVERED_PRICING.get(key);
+  const rates = (model && Object.hasOwn(MODEL_PRICING, model) ? MODEL_PRICING[model] : void 0) ?? (model ? DISCOVERED_PRICING.get(model) : void 0) ?? (model?.startsWith("cline/") && Object.hasOwn(MODEL_PRICING, model.slice(6)) ? MODEL_PRICING[model.slice(6)] : void 0) ?? (Object.hasOwn(MODEL_PRICING, key) ? MODEL_PRICING[key] : void 0) ?? (aliasKey ? MODEL_PRICING[aliasKey] : void 0) ?? DISCOVERED_PRICING.get(key);
   if (!rates) {
     if (model)
       console.warn(`[0] Unknown model for cost estimation: ${model}`);
@@ -336,6 +354,8 @@ function modelProvider(model) {
   if (!model)
     return "unknown";
   const lowered = model.toLowerCase();
+  if (lowered.startsWith("cline/") || lowered.startsWith("cline-pass/"))
+    return "cline";
   if (lowered.startsWith("openai/"))
     return "openai";
   if (lowered.startsWith("azure/"))
@@ -1820,7 +1840,8 @@ var BACKEND_CAPABILITIES = [
   "artifacts",
   "model-connections",
   "process-controls",
-  "operator-services"
+  "operator-services",
+  "learning"
 ];
 var BackendCapabilitySchema = external_exports.enum(BACKEND_CAPABILITIES);
 var BackendIdSchema = external_exports.string().min(1).max(128).regex(/^[A-Za-z0-9][A-Za-z0-9_.-]*$/).refine((value) => !["__proto__", "constructor", "prototype"].includes(value), "Reserved backend identifier.");
@@ -1918,9 +1939,14 @@ function backendCapabilitiesForApiPath(pathname) {
     return ["workflow-engine"];
   if (parts[0] === "control" && parts.length === 2 && ["recover-stale-workers", "prune-stopped-workers", "reset-database", "start-daemon", "stop-daemon", "launch-run"].includes(parts[1]))
     return ["process-controls"];
-  if (pathname === "/api/dashboard" || parts[0] === "scans" || parts[0] === "finding-family")
+  if (pathname === "/api/dashboard" || parts[0] === "scans" || parts[0] === "finding-family" || pathname === "/api/findings/export")
     add("artifacts");
-  else if (parts[0] === "events" || pathname === "/api/v1/presentation/events")
+  if (parts[0] === "findings" && parts.length === 3 && parts[2] === "impact-assessment")
+    add("artifacts");
+  if (parts[0] === "scans" && parts[2] === "resume") {
+    add("workflows");
+    add("sessions");
+  } else if (parts[0] === "events" || pathname === "/api/v1/presentation/events")
     add("events");
   else if (parts[0] === "console") {
     const family = parts[1];
@@ -1935,7 +1961,9 @@ function backendCapabilitiesForApiPath(pathname) {
         add("model-connections");
       if (["files", "directories", "paths", "workspace", "project"].includes(operation ?? ""))
         add("workspaces");
-    } else if (["workflow-triggers", "workflow-schedules"].includes(family ?? ""))
+    } else if (family === "learning")
+      add("learning");
+    else if (["workflow-triggers", "workflow-schedules"].includes(family ?? ""))
       add("schedules");
     else if (["workflows", "workflow-definitions", "workflow-executions", "workflow-tool-catalog", "fixes"].includes(family ?? "")) {
       add("workflows");
@@ -1958,6 +1986,205 @@ function backendCapabilitiesForApiPath(pathname) {
   return [...capabilities];
 }
 
+// packages/shared/dist/scan-resume.js
+var ScanResumeRequestSchema = external_exports.object({
+  sessionId: external_exports.string().trim().min(1).max(160),
+  approval: external_exports.literal("launch-authorized-run"),
+  branchFromEntry: external_exports.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER).optional(),
+  timeCapMs: external_exports.number().int().positive().max(864e5).optional(),
+  costCapUsd: external_exports.number().finite().positive().max(1e3).optional()
+}).strict();
+function resolvePersistedScanResume(scan) {
+  if (!scan.id || scan.id.startsWith("console-"))
+    throw new Error("Choose a persisted assessment scan, not a console conversation.");
+  const depth = external_exports.enum(["quick", "default", "deep"]).parse(scan.depth);
+  const storedMode = scan.mode ? external_exports.enum(["probe", "deep", "mcp", "web", "http_audit", "llm-ipi"]).parse(scan.mode) : void 0;
+  const raw = external_exports.string().trim().min(1).max(4096).parse(scan.target);
+  let parsed;
+  let impliedMode;
+  if (/^https?:\/\//.test(raw))
+    parsed = { target: raw, targetType: "url", sourceDescription: "url" };
+  else if (raw.startsWith("web:")) {
+    parsed = { target: raw.slice(4), targetType: "web-app", sourceDescription: "web-app" };
+    impliedMode = "web";
+  } else if (raw.startsWith("mcp://")) {
+    parsed = { target: raw, targetType: "url", sourceDescription: "mcp target" };
+    impliedMode = "mcp";
+  } else if (raw.startsWith("scan:"))
+    parsed = { target: raw.slice(5), targetType: "url", sourceDescription: "url" };
+  else if (raw.startsWith("repo:"))
+    parsed = { target: raw.slice(5), targetType: "source-code", sourceDescription: "repository" };
+  else {
+    const match = /^(npm|pypi|cargo|oci):(.+)$/.exec(raw);
+    if (!match)
+      throw new Error(`Resume does not know how to route this persisted target yet: ${raw}`);
+    const ecosystem = match[1];
+    const spec = match[2];
+    const at = spec.lastIndexOf("@");
+    const target = at > 0 ? spec.slice(0, at) : spec;
+    const packageVersion = at > 0 ? spec.slice(at + 1) : void 0;
+    if (!target.trim() || packageVersion === "")
+      throw new Error("Persisted package identity is incomplete.");
+    const types = { npm: "npm-package", pypi: "pypi-package", cargo: "cargo-package", oci: "oci-image" };
+    parsed = { target, targetType: types[ecosystem], ...packageVersion ? { packageVersion } : {}, sourceDescription: `${ecosystem} package` };
+  }
+  if (!parsed.target.trim())
+    throw new Error("Persisted scan target is empty.");
+  const targetType = storedMode === "web" ? "web-app" : parsed.targetType;
+  return { ...parsed, targetType, depth, mode: impliedMode ?? storedMode ?? (targetType === "web-app" ? "web" : "deep") };
+}
+
+// packages/shared/dist/engine-operations.js
+var ENGINE_OPERATION_DEFINITIONS = [
+  { id: "get_capabilities", capability: "operator-services", effect: "read" },
+  { id: "start_assessment", capability: "workflows", effect: "execute" },
+  { id: "attach_session", capability: "sessions", effect: "read" },
+  { id: "get_session_events", capability: "events", effect: "read" },
+  { id: "list_templates", capability: "workflows", effect: "read" },
+  { id: "get_template", capability: "workflows", effect: "read" },
+  { id: "list_workflows", capability: "workflows", effect: "read" },
+  { id: "get_workflow", capability: "workflows", effect: "read" },
+  { id: "save_workflow", capability: "workflows", effect: "write" },
+  { id: "start_run", capability: "workflows", effect: "execute" },
+  { id: "list_runs", capability: "workflows", effect: "read" },
+  { id: "get_run", capability: "workflows", effect: "read" },
+  { id: "get_run_results", capability: "workflows", effect: "read" },
+  { id: "cancel_run", capability: "workflows", effect: "cancel" },
+  { id: "list_sessions", capability: "sessions", effect: "read" },
+  { id: "create_session", capability: "sessions", effect: "write" },
+  { id: "get_session", capability: "sessions", effect: "read" },
+  { id: "send_message", capability: "sessions", effect: "execute" },
+  { id: "continue_session", capability: "sessions", effect: "execute" },
+  { id: "cancel_session", capability: "sessions", effect: "cancel" },
+  { id: "resolve_decision", capability: "approvals", effect: "approve" },
+  { id: "list_saved_sessions", capability: "sessions", effect: "read" },
+  { id: "resume_session", capability: "sessions", effect: "execute" },
+  { id: "resume_scan", capability: "scan-resume", effect: "execute" }
+];
+var ENGINE_REPORT_FORMATS = ["json", "md", "html", "sarif", "pdf"];
+var operationIds = ENGINE_OPERATION_DEFINITIONS.map((operation) => operation.id);
+var OperationIdSchema = external_exports.enum(operationIds);
+var unique = (values) => new Set(values).size === values.length;
+var EngineCapabilityManifestSchema = external_exports.object({
+  schemaVersion: external_exports.literal(1),
+  operations: external_exports.array(OperationIdSchema).refine(unique, "Engine operations must be unique"),
+  reportExport: external_exports.object({ formats: external_exports.array(external_exports.enum(ENGINE_REPORT_FORMATS)).refine(unique, "Report formats must be unique") }).strict(),
+  resume: external_exports.object({ session: external_exports.boolean(), scan: external_exports.boolean(), workflow: external_exports.literal(false) }).strict()
+}).strict().superRefine((manifest, context) => {
+  if (manifest.resume.session !== manifest.operations.includes("resume_session") || manifest.resume.scan !== manifest.operations.includes("resume_scan")) {
+    context.addIssue({ code: external_exports.ZodIssueCode.custom, message: "Resume support must match registered operations" });
+  }
+});
+function createEngineCapabilityManifest(options) {
+  return EngineCapabilityManifestSchema.parse({
+    schemaVersion: 1,
+    operations: [...options.operations],
+    reportExport: { formats: [...options.reportFormats ?? []] },
+    resume: { session: options.operations.includes("resume_session"), scan: options.operations.includes("resume_scan"), workflow: false }
+  });
+}
+function requireEngineOperation(manifest, operation) {
+  const valid = EngineCapabilityManifestSchema.parse(manifest);
+  if (!valid.operations.includes(operation))
+    throw new Error(`Engine does not support operation ${operation}.`);
+}
+var ENGINE_COMMAND_COVERAGE = [
+  { id: "assessment", classification: "workflow", cliCommands: ["scan", "review", "audit", "secure"], workflowSteps: ["audit"], templateIds: ["repository-review", "dependency-review", "api-security", "web-configuration", "scoped-penetration-test", "package-behavior", "contract-review", "native-code-review"], chatTools: [], limits: "Target-specific assessment options and admission still apply.", source: "packages/core/src/assessment.ts" },
+  { id: "fix", classification: "workflow", cliCommands: ["fix"], workflowSteps: ["fix"], templateIds: ["fix-candidate"], chatTools: ["generate_fix"], limits: "Chat generation is distinct from workflow candidate validation; applying requires exact live candidate proof and host/request approval.", source: "packages/cli/src/finding-workflow-executors.ts" },
+  { id: "verification", classification: "workflow", cliCommands: ["verify", "replay"], workflowSteps: ["verify"], templateIds: ["finding-verification"], chatTools: ["verify_finding"], limits: "Managed verification uses supported replay runners; CLI kernel verification is not a portable workflow operation.", source: "packages/cli/src/finding-workflow-executors.ts" },
+  { id: "research", classification: "workflow", cliCommands: ["research pipeline", "research mobile", "research linux-matrix"], workflowSteps: ["research"], templateIds: ["security-research"], chatTools: [], limits: "Managed modes pipeline/mobile/linux-matrix require authorized local workspace; pipeline is source-only. linux-matrix imports external evidence and does not execute boots.", source: "packages/cli/src/workflow-research-executors.ts" },
+  { id: "deep-review", classification: "workflow", cliCommands: ["deep-review"], workflowSteps: ["deep-review"], templateIds: ["deep-source-review"], chatTools: [], limits: "Authorized local source workspace and provider prerequisites apply.", source: "packages/cli/src/workflow-research-executors.ts" },
+  { id: "offensive-tools", classification: "chat-tool", cliCommands: ["hunt", "assumption-hunt", "protocol-check", "specdrift", "memsafety", "npm-discovery", "kernel", "cve"], workflowSteps: [], templateIds: [], chatTools: ["variant_hunt", "assumption_hunt", "protocol_conformance", "spec_drift", "safety_eval", "memsafety_fuzz", "npm_dynamic_discovery", "weaponize_kernel", "cve_adapt"], limits: "Tool availability is scope/feature/prerequisite gated. CLI engines and tools have different contracts; no portable specialist workflow executor is registered by this manifest.", source: "packages/core/src/agent/tools/offensive-engines.ts" },
+  { id: "kernel-research", classification: "cli-specialist", cliCommands: ["research linux"], workflowSteps: [], templateIds: [], chatTools: [], limits: "Managed kernel research rejects execution until the VM/build runner supports workflow cancellation and deadlines.", source: "packages/cli/src/workflow-research-executors.ts" },
+  { id: "specialist-cli", classification: "cli-specialist", cliCommands: ["binary", "exploit", "recency-hunt", "lens-synth", "xnu-fuzz", "disclose", "eval", "bench", "ingest"], workflowSteps: [], templateIds: [], chatTools: [], limits: "These CLI contracts are not exposed as portable workflow steps here; model-driven source review is not equivalent to their native proof engines.", source: "packages/cli/src/index.ts" },
+  { id: "maintenance", classification: "cli-maintenance", cliCommands: ["doctor", "db", "upgrade", "config", "plugin", "theme", "login", "logout"], workflowSteps: [], templateIds: [], chatTools: [], limits: "Host maintenance and credential changes are not workflow execution or model-tool grants.", source: "packages/cli/src/index.ts" }
+];
+
+// packages/shared/dist/finding-priority.js
+var ImpactAssessmentSchema = external_exports.object({
+  reachability_tier: external_exports.enum(["remote-unauth", "remote-auth", "proximity-rf", "local-unpriv", "local-priv", "needs-hardware", "needs-host-migration", "unknown"]),
+  blast_radius: external_exports.string().trim().min(1).max(4096),
+  weaponizability: external_exports.enum(["dos-crash", "info-leak", "integrity-tampering", "lpe-to-root", "rce", "unknown"]),
+  business_impact: external_exports.enum(["headline", "notable", "modest", "noise", "unassessed"]),
+  rationale: external_exports.string().trim().min(1).max(8192),
+  assessment_source: external_exports.enum(["model", "provided", "heuristic"]).optional()
+}).strip();
+var UNKNOWN_PRIORITY = {
+  rank: 1.5,
+  label: "Not assessed",
+  assessed: false,
+  rationale: "Business impact has not been assessed. Establish the affected services, customers, data, and operational consequences."
+};
+var PRIORITIES = {
+  headline: { rank: 3, label: "Urgent" },
+  notable: { rank: 2, label: "High" },
+  modest: { rank: 1, label: "Moderate" },
+  noise: { rank: 0, label: "Low" }
+};
+function isHeuristicImpactAssessment(assessment) {
+  return assessment.assessment_source === "heuristic" || /^deterministic fallback derived from severity\s*\+\s*category/i.test(assessment.rationale) || /^heuristic baseline for a /i.test(assessment.blast_radius);
+}
+function getFindingPriority(finding) {
+  const parsed = ImpactAssessmentSchema.safeParse(finding.impactAssessment);
+  if (!parsed.success || parsed.data.business_impact === "unassessed" || isHeuristicImpactAssessment(parsed.data)) {
+    return { ...UNKNOWN_PRIORITY };
+  }
+  const priority = PRIORITIES[parsed.data.business_impact];
+  return { ...priority, assessed: true, rationale: parsed.data.rationale };
+}
+var TECHNICAL_SEVERITY = { critical: 4, high: 3, medium: 2, low: 1, info: 0 };
+function technicalCvss(value) {
+  return typeof value === "number" && Number.isFinite(value) && value >= 0 && value <= 10 ? value : -1;
+}
+function compareFindingsByBusinessPriority(a, b) {
+  return getFindingPriority(b).rank - getFindingPriority(a).rank || (TECHNICAL_SEVERITY[b.severity?.toLowerCase() ?? ""] ?? -1) - (TECHNICAL_SEVERITY[a.severity?.toLowerCase() ?? ""] ?? -1) || technicalCvss(b.cvssScore) - technicalCvss(a.cvssScore);
+}
+
+// packages/shared/dist/access-milestone.js
+var record = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+var successfulObservation = (value) => {
+  const item = record(value);
+  return item && typeof item.status === "number" && Number.isInteger(item.status) && item.status >= 200 && item.status < 300 && item.truncated === false && item.field_present === true && (typeof item.json_pointer_value === "string" || item.json_pointer_value === null) ? item : void 0;
+};
+function accessMilestoneFromArtifact(eventType, value, scopeId, evidenceEventId) {
+  const item = record(value);
+  if (eventType !== "tool_artifact" || !item || item.tool !== "access_control_workflow" || item.workflow !== "access_control_workflow" || item.verdict !== "confirmed" || typeof item.owner_identity !== "string" || !item.owner_identity || typeof item.actor_identity !== "string" || !item.actor_identity || item.owner_identity === item.actor_identity || typeof item.expected_state !== "string" || item.expected_state.length > 500 || typeof item.observation_url !== "string" || item.observation_url.length > 8192 || !scopeId || scopeId.length > 512)
+    return null;
+  const before = successfulObservation(item.observation_before);
+  const after = successfulObservation(item.observation_after);
+  if (!before || !after || before.json_pointer_value === item.expected_state || after.json_pointer_value !== item.expected_state || !Array.isArray(item.steps) || item.steps.length === 0 || item.steps.length > 10)
+    return null;
+  if (item.steps.some((value2, index) => {
+    const step = record(value2);
+    return !step || step.step_index !== index || typeof step.url !== "string" || !["GET", "POST", "PUT", "DELETE", "PATCH"].includes(String(step.method)) || typeof step.status !== "number" || !Number.isInteger(step.status) || step.status < 100 || step.status > 599 || step.error !== void 0;
+  }))
+    return null;
+  let asset;
+  try {
+    const url = new URL(item.observation_url);
+    if (!["https:", "http:"].includes(url.protocol) || url.username || url.password)
+      return null;
+    asset = url.origin;
+  } catch {
+    return null;
+  }
+  return {
+    key: JSON.stringify([scopeId, "cross-identity-write", item.observation_url]),
+    asset,
+    status: "conditional",
+    accessClass: "cross-identity-write",
+    headline: "State change confirmed across request contexts",
+    summary: "The observing context saw the declared marker after requests using different configured authentication headers. Authorization impact requires validation. Cleanup was not verified.",
+    cleanup: "unknown",
+    ...evidenceEventId && evidenceEventId.length <= 512 ? { evidenceEventId } : {}
+  };
+}
+function appendAccessMilestone(current, next, limit = 80) {
+  if (current.some((item) => item.milestone.key === next.milestone.key))
+    return [...current];
+  return [...current, next].slice(-Math.max(1, Math.min(80, limit)));
+}
+
 export {
   validateScanPlan,
   defaultRoleFor,
@@ -1992,6 +2219,8 @@ export {
   VerificationAssertionSchema,
   EvidenceArtifactSchema,
   VerificationResultSchema,
+  pocStepActionSchema,
+  pocStepExpectSchema,
   pocStepSchema,
   pocStepArraySchema,
   findingSchema,
@@ -2076,5 +2305,19 @@ export {
   BackendEventCursorSchema,
   BackendApprovalRefSchema,
   assertBackendReference,
-  backendCapabilitiesForApiPath
+  backendCapabilitiesForApiPath,
+  ScanResumeRequestSchema,
+  resolvePersistedScanResume,
+  ENGINE_OPERATION_DEFINITIONS,
+  ENGINE_REPORT_FORMATS,
+  EngineCapabilityManifestSchema,
+  createEngineCapabilityManifest,
+  requireEngineOperation,
+  ENGINE_COMMAND_COVERAGE,
+  ImpactAssessmentSchema,
+  isHeuristicImpactAssessment,
+  getFindingPriority,
+  compareFindingsByBusinessPriority,
+  accessMilestoneFromArtifact,
+  appendAccessMilestone
 };