0sec-cli 0.25.0 → 0.26.0

package/chunks/{commands-MPPAADGY.js → commands-C2WRSCNB.js}

@@ -3,19 +3,19 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   registerDeepReviewCommand
-} from "./chunk-ZZV56ACK.js";
+} from "./chunk-3VQ5EZKG.js";
 import {
   registerOrchestrateCommand
-} from "./chunk-YYFODVZG.js";
+} from "./chunk-NNMOTHKC.js";
 import {
   registerDbCommand
-} from "./chunk-B5TIXHCO.js";
+} from "./chunk-WNWDQ2TO.js";
 import {
   discoverSshHosts,
   hashTeamPassword,
   registerDashboardCommand,
   registerWorkbenchCommand
-} from "./chunk-3HMO42M2.js";
+} from "./chunk-MOGWEHSC.js";
 import {
   buildFindingChatPrompt,
   buildFindingConsoleCommand,
@@ -25,46 +25,50 @@ import {
   registerVerifyCommand,
   resolveFindingChatIntent,
   runUnified
-} from "./chunk-BWUW6ZQR.js";
-import "./chunk-DMDWIW3E.js";
-import "./chunk-GOUGG7IQ.js";
+} from "./chunk-UQS7XCBV.js";
+import "./chunk-Z2VLJEQJ.js";
+import "./chunk-K3PTYN43.js";
 import {
   TIMELINE_FORMATS,
   formatTimeline,
   isTimelineFormat,
   renderReplay
-} from "./chunk-C6ZMPXN2.js";
+} from "./chunk-FBZBJYZS.js";
 import {
   registerRoutingCommand
-} from "./chunk-3DF55BWV.js";
+} from "./chunk-JGDA6EIJ.js";
 import {
   executeManagedOperation
-} from "./chunk-JCRQV4FE.js";
-import "./chunk-ZWAWZU6C.js";
-import "./chunk-EQBC2ZWL.js";
+} from "./chunk-MOEVVXML.js";
+import "./chunk-YJGPPPUB.js";
+import "./chunk-ZPVSDB63.js";
 import {
   getRuntimeAvailability
-} from "./chunk-ITHDAIRY.js";
-import "./chunk-7TIWL6E5.js";
+} from "./chunk-MNK373HF.js";
+import "./chunk-KCABBZHN.js";
 import {
+  BackendConnectionError,
+  BackendConnectionRegistry,
+  backendBearerFromEnv,
   deployWorker,
+  loadBackendConnectionConfig,
   repairWorker,
   stopWorker,
   validateWorkerOptions
-} from "./chunk-SEWZ76MN.js";
+} from "./chunk-UGCTPKJG.js";
 import {
   consolePresentationOutput,
   performAutoUpdate,
   processPresentationOutput,
   writePresentationLine
-} from "./chunk-NBLKIQCW.js";
+} from "./chunk-D4M5WURF.js";
 import {
   Command,
   InvalidArgumentError,
   Option
 } from "./chunk-S4DFH2FJ.js";
-import "./chunk-NO543ZBU.js";
-import "./chunk-RBTJYREN.js";
+import "./chunk-A7G6S5RA.js";
+import "./chunk-OILVEROI.js";
 import {
   source_default
 } from "./chunk-HLFS6WV2.js";
@@ -80,7 +84,7 @@ import {
   saveProjectOverrides,
   saveSettings,
   settingsFilePath
-} from "./chunk-6TA3CWND.js";
+} from "./chunk-V2KJQVYE.js";
 import {
   CraftMemoryStore,
   DEFAULT_MAX_TOOL_ITERATIONS,
@@ -124,17 +128,17 @@ import {
   techniquesForEvent,
   toScopeFile,
   updateProjectReviewChecks
-} from "./chunk-EEP6GBUO.js";
+} from "./chunk-3MWQNNJU.js";
 import {
   formatSarif
-} from "./chunk-AL32F74R.js";
+} from "./chunk-YP2DHYNI.js";
 import {
   adaptAndVerify
-} from "./chunk-FI5YL4R2.js";
+} from "./chunk-XJ2TBEV7.js";
 import {
   enumerateJsChunkUrls
-} from "./chunk-WK6VUCKK.js";
-import "./chunk-D4IBEO2K.js";
+} from "./chunk-STPHTPSD.js";
+import "./chunk-VWE36MUN.js";
 import {
   createLiveHttpSender
 } from "./chunk-GVD6SJGH.js";
@@ -146,7 +150,7 @@ import {
 import {
   getEvalCategories,
   runEval
-} from "./chunk-PMAKX6KP.js";
+} from "./chunk-NABVDAAO.js";
 import {
   runNpmDynamicDiscovery
 } from "./chunk-2WNCI664.js";
@@ -158,12 +162,12 @@ import {
   DETECTOR_REGISTRY,
   resolveDetectors
 } from "./chunk-DQTNI3KY.js";
-import "./chunk-FI2H6HV2.js";
+import "./chunk-NA3FKCI2.js";
 import {
   prepare
-} from "./chunk-HJKJ4NQP.js";
-import "./chunk-TFKY6D7O.js";
-import "./chunk-76CLUI54.js";
+} from "./chunk-HUZ2EC2R.js";
+import "./chunk-N7YCONYR.js";
+import "./chunk-BM6EYP2D.js";
 import {
   ObjectiveOracle,
   ToolExecutor,
@@ -238,8 +242,8 @@ import {
   withVariantFeatureFlags,
   workflowPolicyRuntime,
   writeAgentActionEvidenceBundle
-} from "./chunk-HFUOUT2B.js";
-import "./chunk-ACYZMJHC.js";
+} from "./chunk-SIR7XW2S.js";
+import "./chunk-LRD5N2TQ.js";
 import "./chunk-K2PWUPUI.js";
 import {
   RateLimiter,
@@ -249,31 +253,31 @@ import {
   searchAdvisories,
   searchSimilar,
   searchTargetHistory
-} from "./chunk-OFPF26WL.js";
+} from "./chunk-6SNOKNCS.js";
 import "./chunk-PAE7ZAV6.js";
 import "./chunk-UEX7PFSE.js";
-import "./chunk-I4VIAQHM.js";
-import "./chunk-2J3STRJT.js";
+import "./chunk-6GV5G6U3.js";
+import "./chunk-R7VWEY45.js";
 import {
   budgetNativeRuntime
-} from "./chunk-HDJSHLRM.js";
+} from "./chunk-SSPP64FF.js";
 import "./chunk-AZ7L3HFD.js";
-import "./chunk-FOLTHXRH.js";
+import "./chunk-B7XL6RON.js";
 import {
   runSourceFix
-} from "./chunk-ITEMDJAB.js";
+} from "./chunk-AFJ2UMPR.js";
 import {
   appendImprovementLedgerEntry,
   evaluateImprovementPromotion,
   loadEvolutionConfigFile,
   verifyImprovementLedger
-} from "./chunk-DJGJECBV.js";
+} from "./chunk-YGYJ2FTH.js";
 import {
   runHttpConformanceCheck
 } from "./chunk-LWMEJYCP.js";
 import {
   createRuntime
-} from "./chunk-DHNYJ2ML.js";
+} from "./chunk-EHNVP6QB.js";
 import "./chunk-O6KPVYOI.js";
 import {
   buildAdGraph,
@@ -293,7 +297,7 @@ import {
   resolveOsecDbPath,
   resolveOsecRunStorage,
   writeOsecRunReport
-} from "./chunk-YXTV2FRE.js";
+} from "./chunk-72PU46MS.js";
 import {
   DISCLOSURE_STATUSES,
   IncompleteEvidenceError,
@@ -312,46 +316,48 @@ import {
   renderReproducibilityManifest,
   renderVendorNotificationMarkdown,
   transition
-} from "./chunk-S2WCYEK2.js";
+} from "./chunk-WPJMA5AK.js";
 import {
   executePocSteps
 } from "./chunk-XPDJE537.js";
 import {
   findCveArtifacts,
   normaliseCveId
-} from "./chunk-5H2PXZ7Q.js";
+} from "./chunk-IUUNIJPM.js";
 import "./chunk-ABKUI3QB.js";
-import "./chunk-GXSECFUE.js";
+import "./chunk-PAMJEXE2.js";
 import {
   LlmApiRuntime,
   features
-} from "./chunk-EIONVEFN.js";
+} from "./chunk-HS2NQ7K6.js";
 import {
   isAdmittedSmolvmWorkbench
-} from "./chunk-3T5R7P4T.js";
+} from "./chunk-XOVYV7TT.js";
 import {
   eventBus
-} from "./chunk-MY44EZKD.js";
+} from "./chunk-ULRLUXSS.js";
 import "./chunk-RS4MAN3Q.js";
 import {
   EmptyPocError,
   detectVersionRange,
   renderAdvisoryMarkdown,
   verifyAgainstRef
-} from "./chunk-RFK5F45W.js";
+} from "./chunk-VJBEB2K6.js";
 import {
   ScopePolicy,
   getScopeEnforcementState,
   isScopeEnforcementEnabled,
   loadScope
-} from "./chunk-27SXCYWH.js";
+} from "./chunk-RZZ6VPRY.js";
 import "./chunk-5IBCBQEH.js";
 import {
   AgentActionScenarioSchema,
+  BACKEND_PROTOCOL_VERSION,
   DEFAULT_AUTONOMY_MODE,
   DEFAULT_SEVERITY_FLOOR,
   SecurityWorkflowBindingsSchema,
   VERSION,
+  backendCapabilitiesForApiPath,
   compareFindingsByBusinessPriority,
   createJevEvaluator,
   findingSchema,
@@ -363,7 +369,7 @@ import {
   pocStepArraySchema,
   reportSummarySchema,
   validateScanPlan
-} from "./chunk-S3B6HFSM.js";
+} from "./chunk-GYEYTNHK.js";
 import {
   external_exports
 } from "./chunk-5XOYTAOK.js";
@@ -647,7 +653,7 @@ function registerScanCommand(program) {
   ).option("--base <branch>", "Base branch for `--emit pr` (default: main)").option("--dry-run", "With `--emit pr`: print git/gh commands instead of running them", false).option("--emit-out-dir <path>", "Directory for `--emit pr` rollup files (default: system temp)").option("--resume <run-id>", "Resume a previous run from its on-disk journal").addOption(new Option("--branch-from <entry-index>", "Branch the journal at an entry index before resuming (with --resume)").hideHelp()).option("--verbose", "Show detailed output", false).addOption(new Option("--replay", "Replay the last scan's results").default(false).hideHelp()).action(async (opts, command) => {
     if (opts.replay) {
       try {
-        const { osecDB: osecDB2 } = await import("./dist-OLGNKDB2.js");
+        const { osecDB: osecDB2 } = await import("./dist-QLMPTFT7.js");
         const db = new osecDB2(opts.dbPath);
         const scans = db.listScans(1);
         if (scans.length === 0) {
@@ -799,7 +805,7 @@ function registerScanCommand(program) {
         process.exit(2);
       }
       try {
-        const { loadScope: loadScope2 } = await import("./dist-6RNAVFAY.js");
+        const { loadScope: loadScope2 } = await import("./dist-ONIRKDH6.js");
         const policy = loadScope2(scopeFile);
         const verdict = scopeEnforcement.enabled ? policy.match(String(opts.target)) : void 0;
         if (verdict && !verdict.allowed) {
@@ -826,7 +832,7 @@ function registerScanCommand(program) {
         loadScope: loadScope2,
         resolveAttribution: resolveAttribution2,
         extractAttributionFromScopeJson: extractAttributionFromScopeJson2
-      } = await import("./dist-6RNAVFAY.js");
+      } = await import("./dist-ONIRKDH6.js");
       const policy = scopeFile ? loadScope2(scopeFile) : void 0;
       resolveAttribution2({
         scopeFileBlock: policy ? extractAttributionFromScopeJson2(policy.raw) : void 0,
@@ -844,7 +850,7 @@ function registerScanCommand(program) {
         loadScope: loadScope2,
         resolveEngagementProfile: resolveEngagementProfile2,
         extractEngagementFromScopeJson: extractEngagementFromScopeJson2
-      } = await import("./dist-6RNAVFAY.js");
+      } = await import("./dist-ONIRKDH6.js");
       const policy = scopeFile ? loadScope2(scopeFile) : void 0;
       resolveEngagementProfile2({
         scopeFileBlock: policy ? extractEngagementFromScopeJson2(policy.raw) : void 0,
@@ -873,7 +879,7 @@ function registerScanCommand(program) {
     const rateLimit = opts.rateLimit;
     if (rateLimit !== void 0 && rateLimit !== "") {
       try {
-        const { parseRateLimitFlag: parseRateLimitFlag2 } = await import("./dist-6RNAVFAY.js");
+        const { parseRateLimitFlag: parseRateLimitFlag2 } = await import("./dist-ONIRKDH6.js");
         parseRateLimitFlag2(rateLimit);
       } catch (err) {
         console.error(source_default.red(err instanceof Error ? err.message : String(err)));
@@ -886,8 +892,8 @@ function registerScanCommand(program) {
     if (opts.routingReport && !opts.singleModel) {
       if (opts.runtime !== "api") throw new Error("Reviewed routing requires --runtime api; no unsupported runtime or provider substitution.");
       if (!opts.routingReviewRef || !opts.routingModel?.length) throw new Error("--routing-report requires --routing-model approvals and --routing-review-ref confirming the workflow/provider review.");
-      const { readRoutingJson } = await import("./routing-ITJZBJIU.js");
-      const { recommendQualifiedRouting, LlmApiRuntime: LlmApiRuntime2 } = await import("./dist-6RNAVFAY.js");
+      const { readRoutingJson } = await import("./routing-WCQLO5SP.js");
+      const { recommendQualifiedRouting, LlmApiRuntime: LlmApiRuntime2 } = await import("./dist-ONIRKDH6.js");
       const raw = readRoutingJson(String(opts.routingReport));
       const current = new LlmApiRuntime2({ type: "api", timeout: parseInt(opts.timeout, 10), model: opts.model });
       recommendRouting = (selectedPlan) => {
@@ -902,7 +908,7 @@ function registerScanCommand(program) {
     if (!interactivePlanning && recommendRouting) {
       if (!opts.goal || !opts.planTimeCap || costCeilingUsd === void 0) throw new Error("Noninteractive reviewed routing requires --goal, --plan-time-cap and --cost-ceiling.");
       plan = { goal: opts.goal, depth: opts.depth, runCount: 1, executionMode: "sequential", timeCapMs: Number(opts.planTimeCap), costCapUsd: costCeilingUsd };
-      const { validateScanPlan: validateScanPlan2 } = await import("./dist-DWN7U5OV.js");
+      const { validateScanPlan: validateScanPlan2 } = await import("./dist-QXJKD743.js");
       validateScanPlan2(plan);
       const routing = recommendRouting(plan);
       for (const [role, model] of Object.entries(routing.assignments)) console.error(`${role}: ${model} \u2014 ${routing.reasons[role]}`);
@@ -1074,7 +1080,7 @@ function registerResumeCommand(program) {
 
 // packages/cli/src/commands/replay.ts
 async function replayScan(opts) {
-  const { osecDB: osecDB2 } = await import("./dist-OLGNKDB2.js");
+  const { osecDB: osecDB2 } = await import("./dist-QLMPTFT7.js");
   const db = new osecDB2(opts.dbPath);
   const requestedScan = opts.scan;
   let scanRecord;
@@ -1154,8 +1160,14 @@ function registerReplayCommand(program) {
 // packages/cli/src/commands/history.ts
 import { existsSync as existsSync2 } from "node:fs";
 function registerHistoryCommand(program) {
-  program.command("history").description("Show past scan history from run-local SQLite databases").option("--db-path <path>", "Path to one SQLite database").option("--limit <n>", "Number of scans to show", "10").action(async (opts) => {
-    const limit2 = Number.parseInt(opts.limit ?? "10", 10);
+  program.command("history").description("Show past scan history from run-local SQLite databases").option("--db-path <path>", "Path to one SQLite database").option("--limit <n>", "Number of scans to show", (value) => {
+    const limit2 = Number(value);
+    if (!/^\d+$/.test(value) || !Number.isSafeInteger(limit2) || limit2 < 1) {
+      throw new InvalidArgumentError("must be a positive integer");
+    }
+    return limit2;
+  }, 10).action(async (opts) => {
+    const limit2 = opts.limit ?? 10;
     const dbPaths = opts.dbPath ? [opts.dbPath] : listOsecRunDatabasePaths();
     const legacyDbPath = resolveOsecDbPath();
     if (!opts.dbPath && existsSync2(legacyDbPath) && !dbPaths.includes(legacyDbPath)) {
@@ -1409,7 +1421,7 @@ function registerFindingsCommand(program) {
         console.log(`  ${source_default.dim(finding.evidenceAnalysis)}`);
       }
       {
-        const { summarizeTriageProvenance, formatTriageProvenance } = await import("./dist-6RNAVFAY.js");
+        const { summarizeTriageProvenance, formatTriageProvenance } = await import("./dist-ONIRKDH6.js");
         const provenance = summarizeTriageProvenance({
           ...finding,
           layerVerdicts: parseLayerVerdicts(finding.layerVerdicts)
@@ -1530,7 +1542,7 @@ import { existsSync as existsSync3 } from "node:fs";
 var VALID_BUILD_SYSTEMS = /* @__PURE__ */ new Set(["autotools", "cmake", "meson", "auto"]);
 var VALID_SANITIZERS = /* @__PURE__ */ new Set(["asan", "ubsan", "msan"]);
 async function runHarnessTier2(args2) {
-  const { buildTier2Harness, extractCorpus } = await import("./dist-6RNAVFAY.js");
+  const { buildTier2Harness, extractCorpus } = await import("./dist-ONIRKDH6.js");
   const repoAbs = resolve2(args2.repo);
   if (!existsSync3(repoAbs)) {
     throw new Error(`Tier-2: repo path '${repoAbs}' does not exist.`);
@@ -1626,7 +1638,7 @@ async function runHarnessTier3(args2) {
     buildTier2Harness,
     extractCorpus,
     runTier3Validation
-  } = await import("./dist-6RNAVFAY.js");
+  } = await import("./dist-ONIRKDH6.js");
   const repoAbs = resolve3(args2.repo);
   if (!existsSync4(repoAbs)) {
     throw new Error(`Tier-3: repo path '${repoAbs}' does not exist.`);
@@ -1846,7 +1858,7 @@ function registerReviewCommand(program) {
     let seedFindings;
     const seedPath = opts.seedFindings;
     if (seedPath) {
-      const { readSeedFindings } = await import("./dist-6RNAVFAY.js");
+      const { readSeedFindings } = await import("./dist-ONIRKDH6.js");
       seedFindings = readSeedFindings(seedPath);
       console.log(
         source_default.cyan(
@@ -1862,7 +1874,7 @@ function registerReviewCommand(program) {
       );
     }
     if (fixCommit) {
-      const { huntAppFixVariants, appFixVariantsToSeedFindings } = await import("./dist-6RNAVFAY.js");
+      const { huntAppFixVariants, appFixVariantsToSeedFindings } = await import("./dist-ONIRKDH6.js");
       const result = huntAppFixVariants({
         repoPath: repo,
         fixCommit
@@ -2173,7 +2185,7 @@ function registerAuditCommand(program) {
 // packages/cli/src/commands/doctor.ts
 function registerDoctorCommand(program) {
   program.command("doctor").description("Check local runtime prerequisites and suggest the next command").action(async () => {
-    const { getRuntimeMetadata } = await import("./runtime-W6JNDQRO.js");
+    const { getRuntimeMetadata } = await import("./runtime-6ZIXFTW5.js");
     const { hasApiKey, availableRuntimes, apiRuntime } = await getRuntimeAvailability();
     const runtime = getRuntimeMetadata();
     const nodeMajor = Number.parseInt(process.versions.node.split(".")[0] ?? "0", 10);
@@ -2468,7 +2480,7 @@ function clampRateLimitToPosture(cfg, posture) {
 }
 var workflowInputsSchema = SecurityWorkflowBindingsSchema;
 async function registerWorkflowTools(server, selected, opts) {
-  const runtime = opts.backend || opts.engineUrl ? await (await import("./remote-workflow-runtime-6CEVRZXS.js")).createRemoteWorkflowRuntime({ backendId: opts.backend, configPath: opts.backendsConfig, sessionId: opts.session, engineUrl: opts.engineUrl, engineTokenEnv: opts.engineTokenEnv }) : await (await import("./workflow-runtime-PLB32XC3.js")).createCliWorkflowRuntime({
+  const runtime = opts.backend || opts.engineUrl ? await (await import("./remote-workflow-runtime-GOI4TYP5.js")).createRemoteWorkflowRuntime({ backendId: opts.backend, configPath: opts.backendsConfig, sessionId: opts.session, engineUrl: opts.engineUrl, engineTokenEnv: opts.engineTokenEnv }) : await (await import("./workflow-runtime-CQTDASFA.js")).createCliWorkflowRuntime({
     ownerId: `mcp:${randomUUID()}`,
     workspace: opts.workspace,
     target: opts.target,
@@ -2766,11 +2778,11 @@ function rowToFinding(row) {
   };
 }
 async function openStore(dbPath) {
-  const { MemoryStore } = await import("./dist-6RNAVFAY.js");
+  const { MemoryStore } = await import("./dist-ONIRKDH6.js");
   return new MemoryStore(dbPath);
 }
 async function loadFinding2(dbPath, findingId) {
-  const { osecDB: osecDB2 } = await import("./dist-OLGNKDB2.js");
+  const { osecDB: osecDB2 } = await import("./dist-QLMPTFT7.js");
   const db = new osecDB2(dbPath);
   try {
     const rows = db.listFindings({ limit: 5e3 });
@@ -2845,7 +2857,7 @@ async function runMemoryRemove(id, dbPath) {
 async function runMarkFp(findingId, opts) {
   const row = await loadFinding2(opts.dbPath, findingId);
   const finding = rowToFinding(row);
-  const { osecDB: osecDB2 } = await import("./dist-OLGNKDB2.js");
+  const { osecDB: osecDB2 } = await import("./dist-QLMPTFT7.js");
   const db = new osecDB2(opts.dbPath);
   try {
     db.updateFindingTriage(row.id, "suppressed", opts.reason);
@@ -6560,7 +6572,7 @@ function registerIngestCommand(program) {
         reviewKernelCrashSubsystems,
         verifyStandaloneKernelReproducer,
         verifyKernelCrash
-      } = await import("./dist-6RNAVFAY.js");
+      } = await import("./dist-ONIRKDH6.js");
       let kernelBuild;
       if (opts.kernelTree) {
         kernelBuild = prepareKernelVmArtifacts({
@@ -6983,7 +6995,7 @@ function registerKernelCommand(program) {
         checkAlreadyFixed,
         rankKernelHypothesesWithJev,
         verifyStaticKernelFinding
-      } = await import("./dist-6RNAVFAY.js");
+      } = await import("./dist-ONIRKDH6.js");
       const noveltyExcluded = opts.upstreamTree ? findings.flatMap((finding) => {
         const path = finding.reviewAnnotation?.path ?? finding.evidence.request.match(/([^\s:]+\.[ch]):\d+/)?.[1];
         if (!path) return [];
@@ -7030,7 +7042,7 @@ function registerKernelCommand(program) {
     try {
       const config = jevConfigFromEnvironment("kernel", process.env);
       if (!config) throw new Error("Jev commit prepass requires ZERO_JEV_FEATURES=kernel and a configured provider");
-      const { rankKernelCommitsWithJev } = await import("./dist-6RNAVFAY.js");
+      const { rankKernelCommitsWithJev } = await import("./dist-ONIRKDH6.js");
       const result = await rankKernelCommitsWithJev({
         tree: opts.tree,
         evaluator: createJevEvaluator(config),
@@ -7054,7 +7066,7 @@ function registerKernelCommand(program) {
     try {
       const config = jevConfigFromEnvironment("kernel", process.env);
       if (!config) throw new Error("Jev source prepass requires ZERO_JEV_FEATURES=kernel and a configured provider");
-      const { runKernelSourceJevPrepass } = await import("./dist-6RNAVFAY.js");
+      const { runKernelSourceJevPrepass } = await import("./dist-ONIRKDH6.js");
       const result = await runKernelSourceJevPrepass({
         tree: opts.tree,
         subtree: opts.subtree,
@@ -7088,7 +7100,7 @@ function registerKernelCommand(program) {
       if (crashes.length === 0) throw new Error("Crash input must be a CrashRecord[] or an object with a crashes array");
       const records = crashes.filter((c) => !!c && typeof c === "object" && "id" in c && "summary" in c && typeof c.id === "string" && typeof c.summary === "string");
       if (records.length !== crashes.length) throw new Error("Every crash record requires string id and summary fields");
-      const { rankCrashesWithJev, crashSummaryFromTriage } = await import("./dist-6RNAVFAY.js");
+      const { rankCrashesWithJev, crashSummaryFromTriage } = await import("./dist-ONIRKDH6.js");
       const result = await rankCrashesWithJev(
         records,
         createJevEvaluator(config)
@@ -7116,7 +7128,7 @@ function registerKernelCommand(program) {
       const details = parsePositiveInt(opts.details, "--details", 100);
       const detailDelayMs = parsePositiveInt(opts.detailDelay, "--detail-delay", 5e3);
       const subsystems = opts.subsystems.split(",").map((value) => value.trim()).filter(Boolean);
-      const { defaultSyzbotFetcher, mineSyzbotQueue, toHuntCandidates } = await import("./dist-6RNAVFAY.js");
+      const { defaultSyzbotFetcher, mineSyzbotQueue, toHuntCandidates } = await import("./dist-ONIRKDH6.js");
       const result = await mineSyzbotQueue({
         fetch: defaultSyzbotFetcher,
         fetchDetail: defaultSyzbotFetcher,
@@ -7174,7 +7186,7 @@ function registerKernelCommand(program) {
           `Invalid output format '${opts.output}'. Valid: ${VALID_OUTPUT_FORMATS2.join(", ")}`
         );
       }
-      const { runKernelVariantHunt } = await import("./dist-6RNAVFAY.js");
+      const { runKernelVariantHunt } = await import("./dist-ONIRKDH6.js");
       const report = await runKernelVariantHunt({
         tree: opts.tree,
         advisory: opts.advisory,
@@ -7277,7 +7289,7 @@ function resolveOutputDir(opts, scanId) {
   return join9(homedir2(), "0", "disclosures", `scan-${scanId.slice(0, 8)}`);
 }
 async function disclose(findingId, opts) {
-  const { osecDB: osecDB2 } = await import("./dist-OLGNKDB2.js");
+  const { osecDB: osecDB2 } = await import("./dist-QLMPTFT7.js");
   const db = new osecDB2(opts.dbPath);
   try {
     let routeDroppedFinding2 = function(args2) {
@@ -7729,7 +7741,7 @@ async function runExploit(opts) {
     classifyPrimitiveFromDmesg,
     describeKernelPrimitive,
     runWeaponization
-  } = await import("./dist-6RNAVFAY.js");
+  } = await import("./dist-ONIRKDH6.js");
   const rawFinding = readJson(opts.findingPath, "finding");
   let finding;
   try {
@@ -7792,7 +7804,7 @@ async function runExploit(opts) {
 }
 async function exploitAction(opts) {
   if (opts.agent) {
-    const { agentFromExploitOpts } = await import("./exploit-agent-M3KUMZJH.js");
+    const { agentFromExploitOpts } = await import("./exploit-agent-4E4HXKUA.js");
     process.exitCode = await agentFromExploitOpts({
       ...opts.task ? { task: opts.task } : {},
       ...opts.flagPath ? { flagPath: opts.flagPath } : {},
@@ -7807,7 +7819,7 @@ async function exploitAction(opts) {
     return;
   }
   if (opts.autoclimb) {
-    const { autoclimbFromExploitOpts } = await import("./exploit-autoclimb-QTTWC5WM.js");
+    const { autoclimbFromExploitOpts } = await import("./exploit-autoclimb-5GRXI6VQ.js");
     process.exitCode = await autoclimbFromExploitOpts({
       ...opts.bugSpec ? { bugSpec: opts.bugSpec } : {},
       ...opts.bootScript ? { bootScript: opts.bootScript } : {},
@@ -7821,7 +7833,7 @@ async function exploitAction(opts) {
     throw new Error("missing required flag: --finding <path>");
   }
   if (opts.climb) {
-    const { runClimb } = await import("./exploit-climb-E4KDELTN.js");
+    const { runClimb } = await import("./exploit-climb-AHQEJ2I2.js");
     let loopBoots = 8;
     if (opts.loopBoots !== void 0) {
       loopBoots = parseInt(opts.loopBoots, 10);
@@ -7994,7 +8006,7 @@ async function runHunt(opts) {
     makeLloreJudge,
     makeHuntProveStage,
     prepare: prepare2
-  } = await import("./dist-6RNAVFAY.js");
+  } = await import("./dist-ONIRKDH6.js");
   const log = opts.log ?? (() => {
   });
   const runtime = opts.runtime ?? "api";
@@ -8342,7 +8354,7 @@ function parseWitnessMode(raw) {
 }
 async function recencyAction(opts) {
   if (!opts.tree) throw new Error("missing required flag: --tree <kernel source tree>");
-  const { runRecencyHunt, renderRecencyReportMarkdown } = await import("./dist-6RNAVFAY.js");
+  const { runRecencyHunt, renderRecencyReportMarkdown } = await import("./dist-ONIRKDH6.js");
   const tree = resolve14(opts.tree);
   const runtime = opts.runtime ?? "api";
   const modelDir = opts.modelDir ? resolve14(opts.modelDir) : join10(tree, ".recency-models");
@@ -8720,7 +8732,7 @@ function resolveArtifactDir(value, sourceRoot) {
   return canonicalArtifactDir;
 }
 async function runMemSafety(opts) {
-  const { prepare: prepare2, runMemSafetyScan } = await import("./dist-6RNAVFAY.js");
+  const { prepare: prepare2, runMemSafetyScan } = await import("./dist-ONIRKDH6.js");
   const log = opts.log ?? (() => {
   });
   const prepared = await prepare2(
@@ -8927,7 +8939,7 @@ function parseWitnessMode2(raw) {
   return m;
 }
 async function runAssumptionHuntCli(sourceRoot, opts) {
-  const { runAssumptionHunt, makeSkepticVerifier } = await import("./dist-6RNAVFAY.js");
+  const { runAssumptionHunt, makeSkepticVerifier } = await import("./dist-ONIRKDH6.js");
   const log = (m) => process.stderr.write(m + "\n");
   const runtime = opts.runtime ?? "api";
   const root = resolve17(sourceRoot);
@@ -10302,7 +10314,7 @@ function resolveConsoleAutonomyMode(opts) {
 function registerConsoleCommand(program) {
   program.command("console").alias("chat").description(
     "Run a headless chat prompt; interactive conversations use 0 web"
-  ).option("--target <url>", "Engagement target the tools operate against (optional; can be named in-chat)").option("--scope <file>", "Initial policy for the optional scope plugin; activate with `0 plugin enable scope`").option("--finding <id>", "Focus the chat on one persisted finding").option("--finding-intent <intent>", "Finding workflow: investigate, verify, or draft_fix").option("--db-path <path>", "Persistent findings database (defaults to ZERO_DB_PATH or the local store)").option("-m, --model <id>", "Override the LLM model id (else provider default)").option("--role <role>", "Tool set to expose: audit|review|discovery|attack|verify (default audit = every tool)").option("--mode <mode>", "Approval mode: standard|recon|copilot|yolo (default yolo)").option("--yolo", "Shortcut for --mode yolo (no per-action prompts; independent credential, private-network and sandbox protections remain).").option("--autonomy <mode>", "Alias of --mode (standard|copilot|yolo|recon); --mode/--yolo take precedence.").option("--max-tool-calls <n>", "Safety cap on tool-call rounds per message", String(DEFAULT_MAX_TOOL_ITERATIONS)).option("--allow-scanners", "Expose generic-scanner tool wrappers (sqlmap/nikto/\u2026); default off").option("--resume [id]", "With a headless prompt, reopen a saved session by id or unique prefix; use browser history for a picker.").option("--continue", "With a headless prompt, continue the most recent saved console session.").option("-p, --print [prompt]", "Non-interactive: run ONE prompt through the engine, print the result, and exit. Reads the prompt from the argument or piped stdin. Combine with --continue/--resume to query a saved session. Also reachable as `0 -p <prompt>`.").option("--prompt <text>", "Run one headless prompt (alias for --print)").action(async (opts) => {
+  ).option("--target <url>", "Engagement target the tools operate against (optional; can be named in-chat)").option("--scope <file>", "Initial policy for the optional scope plugin; activate with `0 plugin enable scope`").option("--finding <id>", "Focus the chat on one persisted finding").option("--finding-intent <intent>", "Finding workflow: investigate, verify, or draft_fix").option("--db-path <path>", "Persistent findings database (defaults to ZERO_DB_PATH or the local store)").option("-m, --model <id>", "Override the LLM model id (else provider default)").option("--role <role>", "Tool set to expose: audit|review|discovery|attack|verify (default audit = every tool)").option("--mode <mode>", "Approval mode: standard|recon|copilot|yolo (default yolo)").option("--yolo", "Shortcut for --mode yolo (no per-action prompts; independent credential, private-network and sandbox protections remain).").option("--autonomy <mode>", "Alias of --mode (standard|copilot|yolo|recon); --mode/--yolo take precedence.").option("--max-tool-calls <n>", "Optional tool-call round limit per message (unlimited by default)").option("--allow-scanners", "Expose generic-scanner tool wrappers (sqlmap/nikto/\u2026); default off").option("--resume [id]", "With a headless prompt, reopen a saved session by id or unique prefix; use browser history for a picker.").option("--continue", "With a headless prompt, continue the most recent saved console session.").option("-p, --print [prompt]", "Non-interactive: run ONE prompt through the engine, print the result, and exit. Reads the prompt from the argument or piped stdin. Combine with --continue/--resume to query a saved session. Also reachable as `0 -p <prompt>`.").option("--prompt <text>", "Run one headless prompt (alias for --print)").action(async (opts) => {
     if (opts.prompt !== void 0) opts.print = opts.prompt;
     if (opts.print === void 0) {
       console.log('Interactive conversations are in the browser. Run 0 web (no account required). For automation use 0 chat --prompt "your request" or 0 -p "your request".');
@@ -10380,7 +10392,7 @@ function registerConsoleCommand(program) {
     let resumedModel;
     let resumedTarget;
     if (opts.continue || opts.resume !== void 0) {
-      const { listSessions, loadSession } = await import("./session-store-DBBI544Y.js");
+      const { listSessions, loadSession } = await import("./session-store-6QR3CVUA.js");
       const idArg = typeof opts.resume === "string" ? opts.resume.trim() : "";
       if (idArg || opts.continue) {
         let stored = idArg ? loadSession(idArg) : null;
@@ -11497,7 +11509,7 @@ function registerXnuFuzzCommand(program) {
 import { readFileSync as readFileSync18 } from "node:fs";
 import { resolve as resolve21 } from "node:path";
 async function managedResearch(adapter, target, options, engine) {
-  const { executeManagedOperation: executeManagedOperation2 } = await import("./managed-operation-642WPTLC.js");
+  const { executeManagedOperation: executeManagedOperation2 } = await import("./managed-operation-ZMLLRCCQ.js");
   const started = Date.now();
   return executeManagedOperation2({
     type: "research",
@@ -11549,7 +11561,7 @@ function print(value) {
 function registerResearchCommand(program) {
   const research = program.command("research").description("Run target-specific research engines");
   research.command("pipeline").description("Run the existing web/AI/source/package pipeline through the shared evidence plane").requiredOption("--target <target>", "URL, local path, repository, package, or image").option("--target-type <type>", "url, web-app, source-code, npm-package, pypi-package, cargo-package, or oci-image").option("--profile <profile>", "Source review profile").option("--depth <depth>", "quick, default, or deep", "default").option("--runtime <runtime>", "auto, api, claude, codex, gemini, or ollama", "auto").option("--artifact-root <path>", "Research artifact root", ".0-research").action(async (opts) => {
-    const { UnifiedPipelineResearchAdapter, runResearch } = await import("./dist-6RNAVFAY.js");
+    const { UnifiedPipelineResearchAdapter, runResearch } = await import("./dist-ONIRKDH6.js");
     const allowedTypes = /* @__PURE__ */ new Set(["url", "web-app", "source-code", "npm-package", "pypi-package", "cargo-package", "oci-image"]);
     if (opts.targetType && !allowedTypes.has(opts.targetType)) throw new Error(`unsupported --target-type ${opts.targetType}`);
     print(await managedResearch(
@@ -11573,7 +11585,7 @@ function registerResearchCommand(program) {
     ));
   });
   research.command("counterexample").description("Search a C/C++ source target for sanitizer-confirmed counterexample inputs; optional mitigation replay").requiredOption("--source <dir>", "C/C++ source tree root").requiredOption("--fn <name>", "Suspect function name").requiredOption("--header <path>", "Header declaring the suspect function").requiredOption("--declaration <decl>", "C declaration of the suspect function").option("--input-shape <shape>", "bytesAndLen, bytesPtr, or bytesAndLenOut", "bytesAndLen").option("--build-system <system>", "auto, autotools, cmake, or meson", "auto").option("--timeout <sec>", "Fuzz wall-clock budget in seconds").option("--mitigation-source <files...>", "Reference-mitigation source file(s) for replay").option("--mitigation-include <dirs...>", "Extra include directories for the mitigation build").option("--witness <files...>", "Finding-proposed witness input file(s) to replay through the sanitizer build").option("--artifact-root <path>", "Research artifact root", ".0-research").action(async (opts) => {
-    const { UserspaceCounterexampleResearchAdapter, runResearch } = await import("./dist-6RNAVFAY.js");
+    const { UserspaceCounterexampleResearchAdapter, runResearch } = await import("./dist-ONIRKDH6.js");
     const SHAPES = { bytesAndLen: true, bytesPtr: true, bytesAndLenOut: true };
     if (!SHAPES[opts.inputShape]) throw new Error(`unsupported --input-shape ${opts.inputShape}`);
     const SYSTEMS = { auto: true, autotools: true, cmake: true, meson: true };
@@ -11603,7 +11615,7 @@ function registerResearchCommand(program) {
     ));
   });
   research.command("mobile").description("Run passive mobile intake; indicators remain hypotheses and only scoped adapters may hand off targets").requiredOption("--target <path>", "Extracted APK/IPA directory or metadata file").option("--artifact-root <path>", "Research artifact root", ".0-research").action(async (opts) => {
-    const { MobileStaticResearchAdapter, runResearch } = await import("./dist-6RNAVFAY.js");
+    const { MobileStaticResearchAdapter, runResearch } = await import("./dist-ONIRKDH6.js");
     const targetPath = resolve21(opts.target);
     print(await managedResearch(
       new MobileStaticResearchAdapter(),
@@ -11613,7 +11625,7 @@ function registerResearchCommand(program) {
     ));
   });
   research.command("linux-matrix").description("Import externally executed vulnerable-vs-patched boot logs; 0 validates and hashes them but does not execute boots").requiredOption("--matrix <path>", "Versioned external boot-matrix manifest JSON").requiredOption("--finding <path>", "Existing Finding JSON to bind the proof to").option("--artifact-root <path>", "Research artifact root", ".0-research").action(async (opts) => {
-    const { LinuxBootMatrixImportAdapter, runResearch } = await import("./dist-6RNAVFAY.js");
+    const { LinuxBootMatrixImportAdapter, runResearch } = await import("./dist-ONIRKDH6.js");
     const matrix = resolve21(opts.matrix);
     const finding = JSON.parse(readFileSync18(resolve21(opts.finding), "utf8"));
     const result = await managedResearch(
@@ -11626,7 +11638,7 @@ function registerResearchCommand(program) {
     print(result);
   });
   research.command("linux").description("Run a supplied Linux kernel reproducer through the shared N-boot evidence gate").requiredOption("--kernel-tree <path>", "Linux source tree").requiredOption("--reproducer <path>", "C reproducer or syzkaller .syz program").requiredOption("--finding <path>", "Existing Finding JSON to bind the proof to").requiredOption("--expected-signature <literal>", "Literal crash signature that every counted boot must contain").option("--boots <n>", "Fresh boots", "3").option("--min-hits <n>", "Required reproducing boots", "2").option("--artifact-root <path>", "Research artifact root", ".0-research").action(async (opts) => {
-    const { LinuxKernelResearchAdapter, runResearch } = await import("./dist-6RNAVFAY.js");
+    const { LinuxKernelResearchAdapter, runResearch } = await import("./dist-ONIRKDH6.js");
     const kernelTree = resolve21(opts.kernelTree);
     const reproducer = resolve21(opts.reproducer);
     const finding = JSON.parse(readFileSync18(resolve21(opts.finding), "utf8"));
@@ -11791,7 +11803,7 @@ function registerTimelineCommand(program) {
       process.exitCode = 2;
       return;
     }
-    const { osecDB: osecDB2 } = await import("./dist-OLGNKDB2.js");
+    const { osecDB: osecDB2 } = await import("./dist-QLMPTFT7.js");
     const db = new osecDB2(opts.dbPath);
     let scan2;
     let rows;
@@ -12371,7 +12383,7 @@ var MAX_SOURCE_BYTES = 4 * 1024 * 1024;
 var cachedCore;
 async function defaultCorePort() {
   if (cachedCore) return cachedCore;
-  const mod = await import("./dist-6RNAVFAY.js");
+  const mod = await import("./dist-ONIRKDH6.js");
   cachedCore = {
     validatePluginManifest: mod.validatePluginManifest,
     reservedToolNames: Object.values(mod.TOOL_DEFINITIONS).map((tool) => tool.name),
@@ -12710,7 +12722,7 @@ function registerHackstoreCommand(program) {
 var cachedCore2;
 async function defaultCorePort2() {
   if (cachedCore2) return cachedCore2;
-  const mod = await import("./dist-6RNAVFAY.js");
+  const mod = await import("./dist-ONIRKDH6.js");
   cachedCore2 = mod;
   return mod;
 }
@@ -13609,8 +13621,8 @@ import { realpathSync as realpathSync3 } from "node:fs";
 import { isAbsolute as isAbsolute3, resolve as resolve27 } from "node:path";
 import { homedir as homedir3 } from "node:os";
 async function defaultService() {
-  const { LearningService, HuntMemoryStore } = await import("./dist-6RNAVFAY.js");
-  const { SecurityWorkflowStore: SecurityWorkflowStore2, learningProjectId } = await import("./dist-OLGNKDB2.js");
+  const { LearningService, HuntMemoryStore } = await import("./dist-ONIRKDH6.js");
+  const { SecurityWorkflowStore: SecurityWorkflowStore2, learningProjectId } = await import("./dist-QLMPTFT7.js");
   const workflows = new SecurityWorkflowStore2();
   const store = workflows.learningStore();
   const service = new LearningService(store, { workflows });
@@ -13920,9 +13932,9 @@ function registerReviewChecksCommand(program) {
 import { open } from "node:fs/promises";
 import { constants as constants4 } from "node:fs";
 var defaults = {
-  createRemoteRuntime: async (options) => (await import("./remote-workflow-runtime-6CEVRZXS.js")).createRemoteWorkflowRuntime(options),
+  createRemoteRuntime: async (options) => (await import("./remote-workflow-runtime-GOI4TYP5.js")).createRemoteWorkflowRuntime(options),
   createRuntime: async (options) => {
-    const { createCliWorkflowRuntime } = await import("./workflow-runtime-PLB32XC3.js");
+    const { createCliWorkflowRuntime } = await import("./workflow-runtime-CQTDASFA.js");
     return await createCliWorkflowRuntime(options);
   },
   out: (text2) => process.stdout.write(`${text2}
@@ -14274,9 +14286,106 @@ function registerTeamCommand(program, dependencies = {}) {
     out(JSON.stringify({ workspace: config.workspace, users: config.users.map(({ id, name, role }) => ({ id, name, role })) }, null, 2));
   }));
 }
+
+// packages/cli/src/commands/api.ts
+import { constants as constants6 } from "node:fs";
+import { open as open2 } from "node:fs/promises";
+var MAX_BODY = 1e6;
+var METHODS = ["GET", "POST", "PATCH", "PUT", "DELETE", "HEAD"];
+async function parseBody(input) {
+  if (input === void 0) return void 0;
+  let text2 = input;
+  if (input.startsWith("@")) {
+    if (input.length === 1) throw new Error("--data @file requires a file path.");
+    const file = await open2(input.slice(1), constants6.O_RDONLY | constants6.O_NONBLOCK);
+    try {
+      const stat3 = await file.stat();
+      if (!stat3.isFile() || stat3.size > MAX_BODY) throw new Error("API data must be a regular JSON file of at most 1 MB.");
+      const buffer = Buffer.alloc(MAX_BODY + 1);
+      let length = 0;
+      while (length < buffer.length) {
+        const { bytesRead } = await file.read(buffer, length, buffer.length - length, length);
+        if (!bytesRead) break;
+        length += bytesRead;
+      }
+      if (length > MAX_BODY) throw new Error("API data exceeds 1 MB.");
+      text2 = buffer.subarray(0, length).toString("utf8");
+    } finally {
+      await file.close();
+    }
+  }
+  if (Buffer.byteLength(text2) > MAX_BODY) throw new Error("API data exceeds 1 MB.");
+  let body;
+  try {
+    body = JSON.parse(text2);
+  } catch {
+    throw new Error("--data must contain valid JSON, or @file containing JSON.");
+  }
+  if (Buffer.byteLength(JSON.stringify(body)) > MAX_BODY) throw new Error("API data exceeds 1 MB.");
+  return body;
+}
+async function runApiCommand(path, options, deps = {}) {
+  const out = deps.out ?? ((text2) => {
+    process.stdout.write(`${text2}
+`);
+  });
+  const err = deps.err ?? ((text2) => {
+    process.stderr.write(`${text2}
+`);
+  });
+  const fail2 = deps.setExitCode ?? ((code) => {
+    process.exitCode = code;
+  });
+  let registry;
+  try {
+    const method = (options.method ?? "GET").toUpperCase();
+    if (!METHODS.includes(method)) throw new Error(`--method must be one of ${METHODS.join(", ")}.`);
+    if (options.data !== void 0 && (method === "GET" || method === "HEAD")) throw new Error("GET and HEAD cannot include --data.");
+    if (options.engineUrl && (options.backend || options.backendsConfig)) throw new Error("--engine-url cannot be combined with --backend or --backends-config.");
+    if (Boolean(options.engineUrl) !== Boolean(options.engineTokenEnv)) throw new Error("Direct attachment requires both --engine-url and --engine-token-env.");
+    if (!options.engineUrl && !options.backend) throw new Error("Select --backend or --engine-url with --engine-token-env explicitly.");
+    if (options.backend === "local") throw new Error("Use an explicit HTTP engine URL or registered HTTP backend; local is not an API transport.");
+    const requestPath = path ?? "/api/backend/handshake";
+    if (requestPath.includes("#")) throw new Error("API paths cannot contain fragments.");
+    if (!requestPath.startsWith("/api/") || requestPath.split("?")[0] !== "/api/backend/handshake" && !backendCapabilitiesForApiPath(requestPath.split("?")[0]).length) throw new Error("Supply an admitted /api/ path.");
+    const body = await parseBody(options.data);
+    const env = deps.env ?? process.env;
+    const backendId = options.backend ?? "attached-engine";
+    const connections = options.engineUrl ? [{ id: backendId, name: "Attached engine", url: options.engineUrl, bearerTokenEnv: options.engineTokenEnv }] : loadBackendConnectionConfig(options.backendsConfig);
+    const connection = connections.find((row) => row.id === backendId);
+    if (!connection) throw new Error("Backend is not registered.");
+    if (options.engineUrl) backendBearerFromEnv(connection.bearerTokenEnv, env);
+    const localHandshake = { protocolVersion: BACKEND_PROTOCOL_VERSION, engineId: "api-client", capabilities: [], platform: { os: process.platform, pathStyle: process.platform === "win32" ? "windows" : "posix" } };
+    registry = new BackendConnectionRegistry({ ...options.engineUrl ? { connections } : { configPath: options.backendsConfig }, env, ...deps.fetch ? { fetch: deps.fetch } : {}, localHandshake });
+    const response = await registry.request(backendId, requestPath, { method, ...body !== void 0 ? { body } : {} });
+    const text2 = method === "HEAD" || response.status === 204 ? "" : await response.text();
+    let data = text2 || null;
+    if (text2 && /(?:application\/json|\+json)(?:;|$)/i.test(response.headers.get("content-type") ?? "")) {
+      try {
+        data = JSON.parse(text2);
+      } catch {
+        throw new Error(`Engine returned malformed JSON (HTTP ${response.status}).`);
+      }
+    }
+    out(JSON.stringify({ ok: response.ok, status: response.status, data }));
+    if (!response.ok) {
+      err(JSON.stringify({ ok: false, status: response.status, error: `Engine request failed (HTTP ${response.status}).` }));
+      fail2(2);
+    }
+  } catch (error) {
+    err(JSON.stringify({ ok: false, status: error instanceof BackendConnectionError ? error.statusCode : null, error: error instanceof Error ? error.message : "API request failed." }));
+    fail2(2);
+  } finally {
+    registry?.dispose();
+  }
+}
+function registerApiCommand(program, deps = {}) {
+  program.command("api [path]").description("Call a trusted engine API with deterministic JSON output (defaults to its handshake)").option("--method <method>", "GET, POST, PATCH, PUT, DELETE or HEAD", "GET").option("--data <json-or-@file>", "JSON body, or @regular-file containing JSON (at most 1 MB)").option("--backend <id>", "Registered HTTP engine ID").option("--backends-config <path>", "Operator backend registry JSON file").option("--engine-url <url>", "Attach directly to a trusted HTTP engine").option("--engine-token-env <name>", "Environment variable containing its engine token").action((path, options) => runApiCommand(path, options, deps));
+}
 export {
   registerAdGraphCommand,
   registerAgentAssureCommand,
+  registerApiCommand,
   registerAssumptionHuntCommand,
   registerAuditCommand,
   registerBenchCommand,