@akasecurity/ai-tc-claude-code 0.9.0 → 0.9.1

package/scripts/backfill.js

@@ -545,6 +545,10 @@ var SQLITE_MIGRATIONS = [
   {
     tag: "0010_events_session_expression_index",
     sql: "-- Custom migration: partial expression index for session-scoped finding reads.\n--\n-- sessionFindingsCount, the session-scoped listGroupedFindings paths, and the\n-- insert-time session dedup all filter live-capture events by\n--   json_extract(e.metadata, '$.sessionId') = :sessionId\n-- \u2014 previously a full findings-join scan with a JSON parse per row. The\n-- IS NOT NULL predicate keeps the index to session-stamped events only (an\n-- equality probe implies non-null, so SQLite still uses it).\nCREATE INDEX `idx_events_session_id` ON `events` (json_extract(`metadata`, '$.sessionId')) WHERE json_extract(`metadata`, '$.sessionId') IS NOT NULL;\n"
+  },
+  {
+    tag: "0011_egress_writer",
+    sql: '-- Stable per-project reconcile key for egress call sites, plus a host-keyed\n-- egress decision override that survives destination pruning.\n--\n-- DROP INDEX IF EXISTS, not a bare DROP: the applier replays a pending\n-- migration\'s non-index statements verbatim, so a store that lost\n-- uq_share_call_site out of band would throw here \u2014 and on the plugin hook path\n-- that throw is swallowed fail-open, silently stopping capture.\n--\n-- Existing rows carry the old key\'s discriminator into project_key\n-- (\'legacy:\' || project), so the new unique index is a re-encoding of the old\n-- one and cannot collide on rows the old one allowed. Leaving them on the\n-- column default would collapse two projects\' identical file/line hits onto\n-- one key and abort the whole migration. Writer keys are \'git:\'/\'path:\'-\n-- prefixed, so a backfilled row never collides with a captured one either.\n--\n-- egress_decision_override.destination_id becomes nullable with ON DELETE SET\n-- NULL, which SQLite can only do by rebuilding the table. `host` is ADDed\n-- before the rebuild so the copy has a column to read and so the migration\n-- still presents two probeable columns to the applier\'s evidence check.\nALTER TABLE `share_call_site` ADD `project_key` text DEFAULT \'\' NOT NULL;--> statement-breakpoint\nUPDATE `share_call_site` SET `project_key` = \'legacy:\' || `project`;--> statement-breakpoint\nDROP INDEX IF EXISTS `uq_share_call_site`;--> statement-breakpoint\nCREATE UNIQUE INDEX `uq_share_call_site` ON `share_call_site` (`endpoint_id`,`project_key`,`file`,`line`);--> statement-breakpoint\nCREATE INDEX `idx_share_call_site_project` ON `share_call_site` (`project_key`,`endpoint_id`);--> statement-breakpoint\nALTER TABLE `egress_decision_override` ADD `host` text;--> statement-breakpoint\nPRAGMA foreign_keys=OFF;--> statement-breakpoint\nCREATE TABLE `__new_egress_decision_override` (\n	`id` text PRIMARY KEY NOT NULL,\n	`destination_id` text,\n	`host` text,\n	`decision` text NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL,\n	FOREIGN KEY (`destination_id`) REFERENCES `share_destination`(`id`) ON UPDATE no action ON DELETE set null\n);\n--> statement-breakpoint\nINSERT INTO `__new_egress_decision_override`("id", "destination_id", "host", "decision", "created_at", "updated_at") SELECT "id", "destination_id", "host", "decision", "created_at", "updated_at" FROM `egress_decision_override`;--> statement-breakpoint\nDROP TABLE `egress_decision_override`;--> statement-breakpoint\nALTER TABLE `__new_egress_decision_override` RENAME TO `egress_decision_override`;--> statement-breakpoint\nPRAGMA foreign_keys=ON;--> statement-breakpoint\nCREATE UNIQUE INDEX `uq_egress_decision_override` ON `egress_decision_override` (`destination_id`);--> statement-breakpoint\nCREATE UNIQUE INDEX `uq_egress_decision_override_host` ON `egress_decision_override` (`host`) WHERE `host` IS NOT NULL;\n'
   }
 ];
 
@@ -16203,6 +16207,7 @@ var ExceptionBundleEntry = DetectionException.pick({
 
 // ../../packages/schema/src/zod/rule.ts
 var MatcherType = external_exports.enum(["keyword", "regex", "validator"]).meta({ id: "MatcherType" });
+var RuleProbeVerdict = external_exports.enum(["safe", "quarantined"]).meta({ id: "RuleProbeVerdict" });
 var KeywordMatcher = external_exports.object({
   type: external_exports.literal("keyword"),
   // An empty keyword matches at every position, yielding one zero-length span
@@ -16227,9 +16232,10 @@ function matchesEmptyString(pattern, flags) {
     return false;
   }
 }
+var MAX_PATTERN_LENGTH = 2e3;
 var RegexMatcher = external_exports.object({
   type: external_exports.literal("regex"),
-  pattern: external_exports.string(),
+  pattern: external_exports.string().min(1).max(MAX_PATTERN_LENGTH),
   flags: external_exports.string().default("gi"),
   captureGroup: external_exports.number().int().nonnegative().optional()
 }).refine((v) => isValidRegex(v.pattern, v.flags), {
@@ -16796,6 +16802,212 @@ function buildDetectionsList(summaries, query) {
   return { counts, items: filtered.map(summaryToDetectionListItem) };
 }
 
+// ../../packages/schema/src/zod/shares.ts
+var DestinationKind = external_exports.enum(["provider", "internal", "external", "ip"]).meta({ id: "DestinationKind" });
+var Transport = external_exports.enum(["https", "http", "sftp", "grpc", "smtp", "ws", "wss"]).meta({ id: "Transport" });
+var DataClass = external_exports.enum(["secrets", "pii", "customer", "source", "telemetry", "logs", "metrics", "none"]).meta({ id: "DataClass" });
+var DATA_CLASS_ORDER = DataClass.options;
+var ShareTrustLevel = external_exports.enum(["recognized", "internal", "unverified", "ip"]).meta({ id: "ShareTrustLevel" });
+var EgressDecision = external_exports.enum(["allow", "block"]).meta({ id: "EgressDecision" });
+var EgressStatus = external_exports.enum(["allowed", "blocked", "review"]).meta({ id: "EgressStatus" });
+var ReviewReason = external_exports.enum(["raw_ip", "unverified_domain", "plaintext_transport"]).meta({ id: "ReviewReason" });
+var HttpMethod = external_exports.enum(["GET", "POST", "PUT", "DELETE", "SDK", "REF"]).meta({ id: "HttpMethod" });
+var ReviewInfo = external_exports.object({
+  needsReview: external_exports.boolean(),
+  reasons: external_exports.array(ReviewReason)
+}).meta({ id: "ReviewInfo" });
+var DestinationNetwork = external_exports.object({
+  port: external_exports.number().int().nullable(),
+  geo: external_exports.string().nullable(),
+  ptr: external_exports.string().nullable()
+}).meta({ id: "DestinationNetwork" });
+var EndpointSummary = external_exports.object({
+  id: external_exports.string(),
+  method: HttpMethod,
+  transport: Transport,
+  url: external_exports.string(),
+  template: external_exports.boolean(),
+  dataClass: DataClass,
+  lastSeen: external_exports.iso.datetime(),
+  callSiteCount: external_exports.number().int().nonnegative()
+}).meta({ id: "EndpointSummary" });
+var CallSite = external_exports.object({
+  id: external_exports.string(),
+  project: external_exports.string(),
+  file: external_exports.string(),
+  line: external_exports.number().int().nonnegative(),
+  snippet: external_exports.string(),
+  dynamic: external_exports.boolean(),
+  vendored: external_exports.boolean(),
+  /** Deep-link to the Inventory project, when the repo is governed there. */
+  projectId: external_exports.string().nullable()
+}).meta({ id: "CallSite" });
+var EndpointWithSites = EndpointSummary.extend({
+  sites: external_exports.array(CallSite)
+}).meta({ id: "EndpointWithSites" });
+var ShareDestinationSummary = external_exports.object({
+  id: external_exports.string(),
+  kind: DestinationKind,
+  name: external_exports.string(),
+  host: external_exports.string(),
+  category: external_exports.string(),
+  trust: ShareTrustLevel,
+  /** Effective state (decision applied over the trust default). */
+  status: EgressStatus,
+  /** True when an egress decision override differs from the trust default. */
+  isCustom: external_exports.boolean(),
+  lastSeen: external_exports.iso.datetime(),
+  endpointCount: external_exports.number().int().nonnegative(),
+  callSiteCount: external_exports.number().int().nonnegative(),
+  transports: external_exports.array(Transport),
+  /** Most-sensitive first. */
+  dataClasses: external_exports.array(DataClass),
+  review: ReviewInfo,
+  /** Non-provider hosts only; null for providers. */
+  network: DestinationNetwork.nullable(),
+  /** Embedded for inline expansion — no call sites here. */
+  endpoints: external_exports.array(EndpointSummary)
+}).meta({ id: "ShareDestinationSummary" });
+var ShareDestinationDetail = ShareDestinationSummary.omit({
+  endpointCount: true,
+  callSiteCount: true,
+  endpoints: true
+}).extend({
+  /** Ownership/geo rationale; null for providers. */
+  note: external_exports.string().nullable(),
+  endpoints: external_exports.array(EndpointWithSites)
+}).meta({ id: "ShareDestinationDetail" });
+var ReviewDestination = external_exports.object({
+  id: external_exports.string(),
+  kind: DestinationKind,
+  name: external_exports.string(),
+  /** Registrable host — lets the strip derive the provider lettermark, as the register does. */
+  host: external_exports.string(),
+  trust: ShareTrustLevel,
+  status: EgressStatus,
+  review: ReviewInfo,
+  topDataClass: DataClass,
+  callSiteCount: external_exports.number().int().nonnegative(),
+  lastSeen: external_exports.iso.datetime()
+}).meta({ id: "ReviewDestination" });
+var ShareDestinationGroup = external_exports.object({
+  kind: DestinationKind,
+  total: external_exports.number().int().nonnegative(),
+  items: external_exports.array(ShareDestinationSummary)
+}).meta({ id: "ShareDestinationGroup" });
+var ListShareDestinationsResponse = external_exports.object({ groups: external_exports.array(ShareDestinationGroup) }).meta({ id: "ListShareDestinationsResponse" });
+var NeedsReviewResponse = external_exports.object({ items: external_exports.array(ReviewDestination) }).meta({ id: "NeedsReviewResponse" });
+var SharesStats = external_exports.object({
+  destinations: external_exports.number().int().nonnegative(),
+  endpoints: external_exports.number().int().nonnegative(),
+  callSites: external_exports.number().int().nonnegative(),
+  needsReview: external_exports.number().int().nonnegative(),
+  insecure: external_exports.number().int().nonnegative(),
+  byKind: external_exports.object({
+    provider: external_exports.number().int().nonnegative(),
+    internal: external_exports.number().int().nonnegative(),
+    external: external_exports.number().int().nonnegative(),
+    ip: external_exports.number().int().nonnegative()
+  }),
+  byTrust: external_exports.object({
+    recognized: external_exports.number().int().nonnegative(),
+    internal: external_exports.number().int().nonnegative(),
+    unverified: external_exports.number().int().nonnegative(),
+    ip: external_exports.number().int().nonnegative()
+  })
+}).meta({ id: "SharesStats" });
+var SetEgressDecisionBody = external_exports.object({
+  /** `null` clears the override — reverts to the trust default, isCustom false. */
+  decision: EgressDecision.nullable()
+}).meta({ id: "SetEgressDecisionBody" });
+var SetEgressDecisionResponse = external_exports.object({ destination: ShareDestinationSummary }).meta({ id: "SetEgressDecisionResponse" });
+var ListShareDestinationsQuery = external_exports.object({
+  /** Case-insensitive match over destination name/category, endpoint url, call-site project/file. */
+  q: external_exports.string().optional(),
+  /** Repeatable. Restrict to these DestinationKind values; absent means all kinds. */
+  kind: external_exports.array(DestinationKind).optional(),
+  /** Reserved for future grouping modes; only 'destination' is supported today. */
+  groupBy: external_exports.enum(["destination"]).default("destination"),
+  /**
+   * When true, return a flat severity-ordered `items[]` instead of `groups`.
+   * Uses `z.stringbool()` (NOT `z.coerce.boolean()` — `Boolean(str)` is true for
+   * any non-empty string, so `?review=false`/`?review=0` would wrongly coerce
+   * to `true`). `z.stringbool()` parses true/1/yes vs false/0/no correctly.
+   */
+  review: external_exports.stringbool().default(false)
+});
+var ExportSharesQuery = external_exports.object({
+  format: external_exports.enum(["csv", "json"]).default("csv"),
+  q: external_exports.string().optional(),
+  kind: external_exports.array(DestinationKind).optional()
+});
+
+// ../../packages/schema/src/zod/egress-extraction.ts
+var EgressEcosystem = external_exports.enum(["npm", "pypi", "go", "maven", "rubygems", "cargo", "composer", "nuget"]).meta({ id: "EgressEcosystem" });
+var ProviderRegistryEntry = external_exports.object({
+  id: external_exports.string(),
+  name: external_exports.string(),
+  category: external_exports.string(),
+  /** Suffix-matched: 'stripe.com' matches api.stripe.com, never evilstripe.com. */
+  hostSuffixes: external_exports.array(external_exports.string()).min(1),
+  /** Canonical API base URL recorded for manifest-derived (method 'SDK') endpoints. */
+  apiBase: external_exports.string(),
+  /** Most-sensitive first; index 0 becomes the endpoint dataClass. */
+  defaultDataClasses: external_exports.array(DataClass).min(1),
+  /** SDK identifiers per ecosystem ('go' prefix-matched by path, 'maven' by group-id prefix). */
+  sdks: external_exports.partialRecord(EgressEcosystem, external_exports.array(external_exports.string()))
+}).meta({ id: "ProviderRegistryEntry" });
+var EgressCallSiteHit = external_exports.object({
+  file: external_exports.string(),
+  line: external_exports.number().int().positive(),
+  snippet: external_exports.string(),
+  dynamic: external_exports.boolean(),
+  vendored: external_exports.boolean()
+}).meta({ id: "EgressCallSiteHit" });
+var ResolvedEgressHit = external_exports.object({
+  host: external_exports.string(),
+  kind: DestinationKind,
+  name: external_exports.string(),
+  category: external_exports.string(),
+  trust: ShareTrustLevel,
+  network: DestinationNetwork.nullable(),
+  method: HttpMethod,
+  transport: Transport,
+  url: external_exports.string(),
+  template: external_exports.boolean(),
+  dataClass: DataClass,
+  site: EgressCallSiteHit
+}).meta({ id: "ResolvedEgressHit" });
+var EgressReconcile = external_exports.discriminatedUnion("mode", [
+  external_exports.object({ mode: external_exports.literal("walk"), walkedPrefix: external_exports.string() }),
+  external_exports.object({
+    mode: external_exports.literal("ledger"),
+    scannedFiles: external_exports.array(external_exports.string()),
+    deletedFiles: external_exports.array(external_exports.string())
+  })
+]).meta({ id: "EgressReconcile" });
+var RecordProjectEgressInput = external_exports.object({
+  /** Stable reconcile key: 'git:<repo identity>' or 'path:<abs root>' (non-git). */
+  projectKey: external_exports.string().min(1),
+  /** Display name only — never keys reconciliation. */
+  project: external_exports.string(),
+  projectId: external_exports.string().nullable(),
+  reconcile: EgressReconcile,
+  hits: external_exports.array(ResolvedEgressHit)
+}).meta({ id: "RecordProjectEgressInput" });
+var EgressWriteSummary = external_exports.object({
+  destinations: external_exports.number().int().nonnegative(),
+  endpoints: external_exports.number().int().nonnegative(),
+  callSites: external_exports.number().int().nonnegative(),
+  truncated: external_exports.boolean(),
+  /**
+   * Files the cap dropped whole. Their stored rows were left untouched, so a
+   * ledger-keeping caller must withhold their ledger entries and read them
+   * again next scan.
+   */
+  droppedFiles: external_exports.array(external_exports.string()).default([])
+}).meta({ id: "EgressWriteSummary" });
+
 // ../../packages/schema/src/zod/findings-group-build.ts
 function toApiAction(dbVal) {
   const map2 = {
@@ -17057,7 +17269,7 @@ var PatchInstalledPackRequest = external_exports.object({
 }).meta({ id: "PatchInstalledPackRequest" });
 
 // ../../packages/schema/src/zod/local.ts
-var WORKSPACE_SETTINGS_SPEC_VERSION = 2;
+var WORKSPACE_SETTINGS_SPEC_VERSION = 3;
 var RunMode = external_exports.enum(["standalone"]);
 var SimpleDetectionPolicy = external_exports.enum(["redact", "warn"]);
 var HistoricalAccess = external_exports.enum(["full", "session-only"]);
@@ -17072,6 +17284,9 @@ var WorkspaceSettings = external_exports.object({
   policy: SimpleDetectionPolicy.default("redact"),
   // Consent for scanning pre-install surfaces; opt-in (see HistoricalAccess).
   historicalAccess: HistoricalAccess.default("session-only"),
+  // In-place egress extraction on the scan paths; disable to stop all Data
+  // Shares writes.
+  dataSharesInPlace: external_exports.boolean().default(true),
   // Absent until /aka:setup completes; its presence is what "onboarded" means.
   onboardedAt: external_exports.iso.datetime().optional()
 });
@@ -17555,145 +17770,6 @@ var SetupHandoffOffer = external_exports.object({
   path: ["liveKeys"]
 });
 
-// ../../packages/schema/src/zod/shares.ts
-var DestinationKind = external_exports.enum(["provider", "internal", "ip"]).meta({ id: "DestinationKind" });
-var Transport = external_exports.enum(["https", "http", "sftp", "grpc", "smtp"]).meta({ id: "Transport" });
-var DataClass = external_exports.enum(["secrets", "pii", "customer", "source", "telemetry", "logs", "metrics", "none"]).meta({ id: "DataClass" });
-var DATA_CLASS_ORDER = DataClass.options;
-var ShareTrustLevel = external_exports.enum(["recognized", "internal", "unverified", "ip"]).meta({ id: "ShareTrustLevel" });
-var EgressDecision = external_exports.enum(["allow", "block"]).meta({ id: "EgressDecision" });
-var EgressStatus = external_exports.enum(["allowed", "blocked", "review"]).meta({ id: "EgressStatus" });
-var ReviewReason = external_exports.enum(["raw_ip", "unverified_domain", "plaintext_transport"]).meta({ id: "ReviewReason" });
-var HttpMethod = external_exports.enum(["GET", "POST", "PUT", "DELETE"]).meta({ id: "HttpMethod" });
-var ReviewInfo = external_exports.object({
-  needsReview: external_exports.boolean(),
-  reasons: external_exports.array(ReviewReason)
-}).meta({ id: "ReviewInfo" });
-var DestinationNetwork = external_exports.object({
-  port: external_exports.number().int().nullable(),
-  geo: external_exports.string().nullable(),
-  ptr: external_exports.string().nullable()
-}).meta({ id: "DestinationNetwork" });
-var EndpointSummary = external_exports.object({
-  id: external_exports.string(),
-  method: HttpMethod,
-  transport: Transport,
-  url: external_exports.string(),
-  template: external_exports.boolean(),
-  dataClass: DataClass,
-  lastSeen: external_exports.iso.datetime(),
-  callSiteCount: external_exports.number().int().nonnegative()
-}).meta({ id: "EndpointSummary" });
-var CallSite = external_exports.object({
-  id: external_exports.string(),
-  project: external_exports.string(),
-  file: external_exports.string(),
-  line: external_exports.number().int().nonnegative(),
-  snippet: external_exports.string(),
-  dynamic: external_exports.boolean(),
-  vendored: external_exports.boolean(),
-  /** Deep-link to the Inventory project, when the repo is governed there. */
-  projectId: external_exports.string().nullable()
-}).meta({ id: "CallSite" });
-var EndpointWithSites = EndpointSummary.extend({
-  sites: external_exports.array(CallSite)
-}).meta({ id: "EndpointWithSites" });
-var ShareDestinationSummary = external_exports.object({
-  id: external_exports.string(),
-  kind: DestinationKind,
-  name: external_exports.string(),
-  host: external_exports.string(),
-  category: external_exports.string(),
-  trust: ShareTrustLevel,
-  /** Effective state (decision applied over the trust default). */
-  status: EgressStatus,
-  /** True when an egress decision override differs from the trust default. */
-  isCustom: external_exports.boolean(),
-  lastSeen: external_exports.iso.datetime(),
-  endpointCount: external_exports.number().int().nonnegative(),
-  callSiteCount: external_exports.number().int().nonnegative(),
-  transports: external_exports.array(Transport),
-  /** Most-sensitive first. */
-  dataClasses: external_exports.array(DataClass),
-  review: ReviewInfo,
-  /** Non-provider hosts only; null for providers. */
-  network: DestinationNetwork.nullable(),
-  /** Embedded for inline expansion — no call sites here. */
-  endpoints: external_exports.array(EndpointSummary)
-}).meta({ id: "ShareDestinationSummary" });
-var ShareDestinationDetail = ShareDestinationSummary.omit({
-  endpointCount: true,
-  callSiteCount: true,
-  endpoints: true
-}).extend({
-  /** Ownership/geo rationale; null for providers. */
-  note: external_exports.string().nullable(),
-  endpoints: external_exports.array(EndpointWithSites)
-}).meta({ id: "ShareDestinationDetail" });
-var ReviewDestination = external_exports.object({
-  id: external_exports.string(),
-  kind: DestinationKind,
-  name: external_exports.string(),
-  /** Registrable host — lets the strip derive the provider lettermark, as the register does. */
-  host: external_exports.string(),
-  trust: ShareTrustLevel,
-  status: EgressStatus,
-  review: ReviewInfo,
-  topDataClass: DataClass,
-  callSiteCount: external_exports.number().int().nonnegative(),
-  lastSeen: external_exports.iso.datetime()
-}).meta({ id: "ReviewDestination" });
-var ShareDestinationGroup = external_exports.object({
-  kind: DestinationKind,
-  total: external_exports.number().int().nonnegative(),
-  items: external_exports.array(ShareDestinationSummary)
-}).meta({ id: "ShareDestinationGroup" });
-var ListShareDestinationsResponse = external_exports.object({ groups: external_exports.array(ShareDestinationGroup) }).meta({ id: "ListShareDestinationsResponse" });
-var NeedsReviewResponse = external_exports.object({ items: external_exports.array(ReviewDestination) }).meta({ id: "NeedsReviewResponse" });
-var SharesStats = external_exports.object({
-  destinations: external_exports.number().int().nonnegative(),
-  endpoints: external_exports.number().int().nonnegative(),
-  callSites: external_exports.number().int().nonnegative(),
-  needsReview: external_exports.number().int().nonnegative(),
-  insecure: external_exports.number().int().nonnegative(),
-  byKind: external_exports.object({
-    provider: external_exports.number().int().nonnegative(),
-    internal: external_exports.number().int().nonnegative(),
-    ip: external_exports.number().int().nonnegative()
-  }),
-  byTrust: external_exports.object({
-    recognized: external_exports.number().int().nonnegative(),
-    internal: external_exports.number().int().nonnegative(),
-    unverified: external_exports.number().int().nonnegative(),
-    ip: external_exports.number().int().nonnegative()
-  })
-}).meta({ id: "SharesStats" });
-var SetEgressDecisionBody = external_exports.object({
-  /** `null` clears the override — reverts to the trust default, isCustom false. */
-  decision: EgressDecision.nullable()
-}).meta({ id: "SetEgressDecisionBody" });
-var SetEgressDecisionResponse = external_exports.object({ destination: ShareDestinationSummary }).meta({ id: "SetEgressDecisionResponse" });
-var ListShareDestinationsQuery = external_exports.object({
-  /** Case-insensitive match over destination name/category, endpoint url, call-site project/file. */
-  q: external_exports.string().optional(),
-  /** Repeatable. Restrict to these DestinationKind values; absent means all kinds. */
-  kind: external_exports.array(DestinationKind).optional(),
-  /** Reserved for future grouping modes; only 'destination' is supported today. */
-  groupBy: external_exports.enum(["destination"]).default("destination"),
-  /**
-   * When true, return a flat severity-ordered `items[]` instead of `groups`.
-   * Uses `z.stringbool()` (NOT `z.coerce.boolean()` — `Boolean(str)` is true for
-   * any non-empty string, so `?review=false`/`?review=0` would wrongly coerce
-   * to `true`). `z.stringbool()` parses true/1/yes vs false/0/no correctly.
-   */
-  review: external_exports.stringbool().default(false)
-});
-var ExportSharesQuery = external_exports.object({
-  format: external_exports.enum(["csv", "json"]).default("csv"),
-  q: external_exports.string().optional(),
-  kind: external_exports.array(DestinationKind).optional()
-});
-
 // ../../packages/schema/src/zod/shares-access.ts
 var ALLOWED_BY_DEFAULT_TRUST = /* @__PURE__ */ new Set(["recognized", "internal"]);
 function trustDefaultStatus(trust) {
@@ -17713,7 +17789,7 @@ function deriveReviewReasons(trust, transports) {
   const reasons = [];
   if (trust === "ip") reasons.push("raw_ip");
   if (trust === "unverified") reasons.push("unverified_domain");
-  if (transports.includes("http")) reasons.push("plaintext_transport");
+  if (transports.includes("http") || transports.includes("ws")) reasons.push("plaintext_transport");
   return reasons;
 }
 function buildReviewInfo(trust, transports) {
@@ -17944,6 +18020,7 @@ function applyMigrations(db) {
   ensureSyncedAtColumn(db, "audit_events");
   ensureScanLedgerTable(db);
   ensureBlockedDetectionsTable(db);
+  ensureRuleProbeCacheTable(db);
   ensureWriteGateTrigger(db);
   ensureTokenUsageColumns(db);
   reconcileSourceProjectIds(db);
@@ -18083,6 +18160,14 @@ function ensureBlockedDetectionsTable(db) {
     blocked_at INTEGER NOT NULL
   )`);
 }
+function ensureRuleProbeCacheTable(db) {
+  db.exec(`CREATE TABLE IF NOT EXISTS rule_probe_cache (
+    rule_key TEXT PRIMARY KEY,
+    verdict TEXT NOT NULL,
+    worst_probe_ms REAL NOT NULL,
+    checked_at INTEGER NOT NULL
+  )`);
+}
 
 // ../../packages/persistence/src/paths.ts
 import { chmodSync, mkdirSync } from "fs";
@@ -21636,6 +21721,35 @@ var SqliteResolutionsRepository = class {
   }
 };
 
+// ../../packages/persistence/src/repositories/rule-probe-cache.ts
+var SqliteRuleProbeCacheRepository = class {
+  constructor(db) {
+    this.db = db;
+    this.upsertStmt = db.prepare(
+      `INSERT INTO rule_probe_cache (rule_key, verdict, worst_probe_ms, checked_at)
+       VALUES (:ruleKey, :verdict, :worstProbeMs, :checkedAt)
+       ON CONFLICT (rule_key) DO UPDATE SET
+         verdict = excluded.verdict,
+         worst_probe_ms = excluded.worst_probe_ms,
+         checked_at = excluded.checked_at`
+    );
+    this.readStmt = db.prepare(
+      `SELECT verdict, worst_probe_ms AS worstProbeMs FROM rule_probe_cache WHERE rule_key = :ruleKey`
+    );
+  }
+  db;
+  upsertStmt;
+  readStmt;
+  getVerdict(ruleKey) {
+    return getRow(this.readStmt, { ruleKey });
+  }
+  setVerdict(ruleKey, verdict, worstProbeMs2) {
+    failOpenTransaction(this.db, () => {
+      this.upsertStmt.run({ ruleKey, verdict, worstProbeMs: worstProbeMs2, checkedAt: Date.now() });
+    });
+  }
+};
+
 // ../../packages/persistence/src/repositories/scan-ledger.ts
 var SqliteScanLedgerRepository = class {
   constructor(db) {
@@ -22047,11 +22161,50 @@ var SqliteSecurityRepository = class {
 
 // ../../packages/persistence/src/repositories/shares.ts
 import { randomUUID as randomUUID7 } from "crypto";
-var KIND_ORDER = ["provider", "internal", "ip"];
+var MAX_EGRESS_CALL_SITES_PER_PROJECT = 5e3;
+var IN_CHUNK = 500;
+var KIND_ORDER = ["provider", "internal", "external", "ip"];
+var PLAINTEXT_TRANSPORT_SQL = "('http', 'ws')";
+var OVERRIDE_JOIN = `LEFT JOIN egress_decision_override oh ON oh.host = d.host
+             LEFT JOIN egress_decision_override ol ON ol.destination_id = d.id AND ol.host IS NULL`;
 var CALL_SITE_EMBED_CAP = 200;
 function parseNetwork(networkJson) {
   return safeJson(networkJson, null);
 }
+function capHits(all, mode) {
+  if (all.length <= MAX_EGRESS_CALL_SITES_PER_PROJECT) {
+    return { hits: [...all], droppedFiles: [], truncated: false };
+  }
+  if (mode === "walk") {
+    return {
+      hits: all.slice(0, MAX_EGRESS_CALL_SITES_PER_PROJECT),
+      droppedFiles: [],
+      truncated: true
+    };
+  }
+  const byFile = /* @__PURE__ */ new Map();
+  for (const hit of all) {
+    const bucket = byFile.get(hit.site.file);
+    if (bucket === void 0) byFile.set(hit.site.file, [hit]);
+    else bucket.push(hit);
+  }
+  const hits = [];
+  const droppedFiles = [];
+  for (const [file2, bucket] of byFile) {
+    if (hits.length + bucket.length > MAX_EGRESS_CALL_SITES_PER_PROJECT) droppedFiles.push(file2);
+    else hits.push(...bucket);
+  }
+  return { hits, droppedFiles, truncated: true };
+}
+function withoutDroppedFiles(reconcile, droppedFiles) {
+  if (reconcile.mode === "walk" || droppedFiles.length === 0) return reconcile;
+  const dropped = new Set(droppedFiles);
+  return {
+    mode: "ledger",
+    scannedFiles: reconcile.scannedFiles.filter((file2) => !dropped.has(file2)),
+    deletedFiles: reconcile.deletedFiles.filter((file2) => !dropped.has(file2))
+  };
+}
 function toEndpointSummary(row) {
   return {
     id: row.id,
@@ -22142,13 +22295,15 @@ var SqliteSharesRepository = class {
     const callSites = countScalar(this.db, "SELECT count(*) AS n FROM share_call_site");
     const insecure = countScalar(
       this.db,
-      "SELECT count(DISTINCT destination_id) AS n FROM share_endpoint WHERE transport = 'http'"
+      `SELECT count(DISTINCT destination_id) AS n FROM share_endpoint
+       WHERE transport IN ${PLAINTEXT_TRANSPORT_SQL}`
     );
     const needsReview = countScalar(
       this.db,
       `SELECT count(DISTINCT d.id) AS n
        FROM share_destination d
-       LEFT JOIN share_endpoint e ON e.destination_id = d.id AND e.transport = 'http'
+       LEFT JOIN share_endpoint e ON e.destination_id = d.id
+         AND e.transport IN ${PLAINTEXT_TRANSPORT_SQL}
        WHERE d.trust IN ('unverified', 'ip') OR e.id IS NOT NULL`
     );
     const kindCounts = countBy(
@@ -22158,6 +22313,7 @@ var SqliteSharesRepository = class {
     const byKind = {
       provider: kindCounts.get("provider") ?? 0,
       internal: kindCounts.get("internal") ?? 0,
+      external: kindCounts.get("external") ?? 0,
       ip: kindCounts.get("ip") ?? 0
     };
     const trustCounts = countBy(
@@ -22233,23 +22389,316 @@ var SqliteSharesRepository = class {
   // real edit from a no-such-destination.
   /**
    * Set (decision) or clear (null) the egress decision override for a destination.
-   * `null` deletes the override row → reverts to the trust default.
+   * `null` deletes the override rows → reverts to the trust default.
+   *
+   * The written row carries both the destination id and its host, so the
+   * decision re-attaches by host after the destination is pruned and
+   * re-detected under a fresh id. Rows written before the host column existed
+   * (host NULL, matched by destination id) are replaced rather than left to
+   * shadow the new one. Runs IMMEDIATE: the host lookup is read-then-write and
+   * would otherwise race a concurrent prune.
    */
   setEgressDecision(destinationId, decision) {
-    const exists = this.db.prepare("SELECT 1 FROM share_destination WHERE id = ?").get(destinationId);
-    if (exists === void 0) return false;
-    if (decision === null) {
-      this.db.prepare("DELETE FROM egress_decision_override WHERE destination_id = ?").run(destinationId);
-      return true;
+    let existed = false;
+    withTransaction(
+      this.db,
+      () => {
+        const dest = this.db.prepare("SELECT host FROM share_destination WHERE id = ?").get(destinationId);
+        if (dest === void 0) return;
+        existed = true;
+        this.db.prepare(
+          `DELETE FROM egress_decision_override
+             WHERE host = :host OR (destination_id = :destinationId AND host IS NULL)`
+        ).run({ host: dest.host, destinationId });
+        if (decision === null) return;
+        this.db.prepare(
+          `INSERT INTO egress_decision_override
+               (id, destination_id, host, decision, created_at, updated_at)
+             VALUES (:id, :destinationId, :host, :decision, :now, :now)`
+        ).run({
+          id: randomUUID7(),
+          destinationId,
+          host: dest.host,
+          decision,
+          now: Date.now()
+        });
+      },
+      "IMMEDIATE"
+    );
+    return existed;
+  }
+  /**
+   * Record one project's statically-extracted egress: reconcile the previously
+   * stored call sites against this scan, upsert destination → endpoint → call
+   * site for every hit, confirm `last_seen` on everything the project still
+   * references, and drop what no longer has evidence.
+   *
+   * Reconciliation keys on `projectKey` alone; `project` and `projectId` are
+   * display payload and never scope a delete. The whole write is one
+   * transaction: a failure leaves the project's previous inventory exactly as
+   * it was, and THROWS rather than reporting a partial write — callers decide
+   * their own fail-open behavior, and the scanner additionally withholds its
+   * ledger commit so the next scan retries.
+   *
+   * Over-cap input is truncated at a FILE boundary, and the files that lost
+   * their hits are both excluded from the reconcile delete and named in
+   * `droppedFiles`. That pairing is what keeps truncation non-destructive on
+   * the ledger path: a dropped file keeps whatever rows it already had, and its
+   * caller withholds the ledger entry so the next scan reads it again.
+   */
+  recordProjectEgress(input) {
+    const { hits, droppedFiles, truncated } = capHits(input.hits, input.reconcile.mode);
+    const reconcile = withoutDroppedFiles(input.reconcile, droppedFiles);
+    const now = Date.now();
+    let summary = {
+      destinations: 0,
+      endpoints: 0,
+      callSites: 0,
+      truncated,
+      droppedFiles
+    };
+    withTransaction(
+      this.db,
+      () => {
+        const projectId = input.projectId ?? this.knownProjectId(input.projectKey);
+        this.reconcileCallSites(input.projectKey, reconcile);
+        this.upsertHits(input, hits, projectId, now);
+        this.confirmLastSeen(input.projectKey, now);
+        this.pruneOrphans();
+        summary = { ...this.projectTotals(input.projectKey), truncated, droppedFiles };
+      },
+      "IMMEDIATE"
+    );
+    return summary;
+  }
+  // ─── Egress write internals ──────────────────────────────────────────────────
+  /**
+   * Clear the stored call sites this scan is responsible for re-creating.
+   *
+   * Each pipeline may only delete rows its own walker could have produced. The
+   * fs walk behind 'walk' mode never descends into dot-directories, so its
+   * delete excludes dot-path files — those rows are the plugin scanner's to
+   * reconcile, and deleting them here would make the two pipelines erase each
+   * other's rows on every alternating scan. 'ledger' mode names its files
+   * outright and never mass-deletes, so rows the fs walk contributed for files
+   * the scanner skips (vendored, oversize) survive it.
+   */
+  reconcileCallSites(projectKey, reconcile) {
+    if (reconcile.mode === "walk") {
+      const prefix = reconcile.walkedPrefix.replace(/\/+$/, "");
+      this.db.prepare(
+        `DELETE FROM share_call_site
+           WHERE project_key = :key
+             AND (:prefix = '' OR file = :prefix OR file LIKE :subtree ESCAPE '\\')
+             AND file NOT LIKE '.%'
+             AND file NOT LIKE '%/.%'`
+      ).run({ key: projectKey, prefix, subtree: `${escapeLikePattern(prefix)}/%` });
+      return;
+    }
+    const files = [.../* @__PURE__ */ new Set([...reconcile.scannedFiles, ...reconcile.deletedFiles])];
+    for (let i = 0; i < files.length; i += IN_CHUNK) {
+      const chunk = files.slice(i, i + IN_CHUNK);
+      this.db.prepare(
+        `DELETE FROM share_call_site
+           WHERE project_key = ? AND file IN (${placeholders(chunk.length)})`
+      ).run(projectKey, ...chunk);
     }
+  }
+  /**
+   * Upsert every hit as destination → endpoint → call site. Destinations key on
+   * `host` and endpoints on `(destination_id, method, url)`, both shared across
+   * projects; only the call site carries `project_key`. A destination's `note`
+   * is user-owned and never overwritten. The id caches keep one upsert per
+   * distinct host and endpoint, so the first hit for a host supplies its
+   * classification for this batch.
+   */
+  upsertHits(input, hits, projectId, now) {
+    if (hits.length === 0) return;
+    const destStmt = this.db.prepare(
+      `INSERT INTO share_destination
+         (id, kind, name, host, category, trust, network_json, last_seen, provenance,
+          created_at, updated_at)
+       VALUES (:id, :kind, :name, :host, :category, :trust, :networkJson, :now, 'scan', :now, :now)
+       ON CONFLICT (host) DO UPDATE SET
+         kind = excluded.kind,
+         name = excluded.name,
+         category = excluded.category,
+         trust = excluded.trust,
+         network_json = excluded.network_json,
+         last_seen = excluded.last_seen,
+         updated_at = excluded.updated_at`
+    );
+    const destIdStmt = this.db.prepare("SELECT id FROM share_destination WHERE host = ?");
+    const endpointStmt = this.db.prepare(
+      `INSERT INTO share_endpoint
+         (id, destination_id, method, transport, url, template, data_class, last_seen,
+          created_at, updated_at)
+       VALUES (:id, :destinationId, :method, :transport, :url, :template, :dataClass, :now,
+               :now, :now)
+       ON CONFLICT (destination_id, method, url) DO UPDATE SET
+         transport = excluded.transport,
+         template = excluded.template,
+         data_class = excluded.data_class,
+         last_seen = excluded.last_seen,
+         updated_at = excluded.updated_at`
+    );
+    const endpointIdStmt = this.db.prepare(
+      "SELECT id FROM share_endpoint WHERE destination_id = ? AND method = ? AND url = ?"
+    );
+    const siteStmt = this.db.prepare(
+      `INSERT INTO share_call_site
+         (id, endpoint_id, project, project_key, file, line, snippet, dynamic, vendored,
+          project_id, created_at, updated_at)
+       VALUES (:id, :endpointId, :project, :projectKey, :file, :line, :snippet, :dynamic,
+               :vendored, :projectId, :now, :now)
+       ON CONFLICT (endpoint_id, project_key, file, line) DO UPDATE SET
+         snippet = excluded.snippet,
+         dynamic = excluded.dynamic,
+         vendored = excluded.vendored,
+         project = excluded.project,
+         project_id = COALESCE(excluded.project_id, share_call_site.project_id),
+         updated_at = excluded.updated_at`
+    );
+    const destIds = /* @__PURE__ */ new Map();
+    const endpointIds = /* @__PURE__ */ new Map();
+    for (const hit of hits) {
+      let destinationId = destIds.get(hit.host);
+      if (destinationId === void 0) {
+        destStmt.run({
+          id: randomUUID7(),
+          kind: hit.kind,
+          name: hit.name,
+          host: hit.host,
+          category: hit.category,
+          trust: hit.trust,
+          networkJson: hit.network === null ? null : JSON.stringify(hit.network),
+          now
+        });
+        destinationId = getRow(destIdStmt, [hit.host])?.id ?? "";
+        destIds.set(hit.host, destinationId);
+      }
+      const endpointKey = `${destinationId}\0${hit.method}\0${hit.url}`;
+      let endpointId = endpointIds.get(endpointKey);
+      if (endpointId === void 0) {
+        endpointStmt.run({
+          id: randomUUID7(),
+          destinationId,
+          method: hit.method,
+          transport: hit.transport,
+          url: hit.url,
+          template: boolToInt(hit.template),
+          dataClass: hit.dataClass,
+          now
+        });
+        endpointId = getRow(endpointIdStmt, [destinationId, hit.method, hit.url])?.id ?? "";
+        endpointIds.set(endpointKey, endpointId);
+      }
+      siteStmt.run({
+        id: randomUUID7(),
+        endpointId,
+        project: input.project,
+        projectKey: input.projectKey,
+        file: hit.site.file,
+        line: hit.site.line,
+        snippet: hit.site.snippet,
+        dynamic: boolToInt(hit.site.dynamic),
+        vendored: boolToInt(hit.site.vendored),
+        projectId,
+        now
+      });
+    }
+  }
+  /**
+   * The source-project id this project's stored call sites already carry, if
+   * any. Only the pipeline that resolves a source project supplies one; the
+   * other passes null and inherits this, so the link stops flapping between a
+   * real id and NULL depending on which pipeline ran last. The value is a
+   * per-project attribute stored redundantly on each row, so any row's is
+   * representative.
+   */
+  knownProjectId(projectKey) {
+    return getRow(
+      this.db.prepare(
+        `SELECT project_id AS projectId FROM share_call_site
+           WHERE project_key = ? AND project_id IS NOT NULL LIMIT 1`
+      ),
+      [projectKey]
+    )?.projectId ?? null;
+  }
+  /**
+   * Stamp `last_seen` on every endpoint and destination this project still
+   * references — including rows the scan preserved rather than re-wrote, so a
+   * ledger-skipped file's references don't decay into "stale" on the page.
+   */
+  confirmLastSeen(projectKey, now) {
     this.db.prepare(
-      `INSERT INTO egress_decision_override (id, destination_id, decision, created_at, updated_at)
-         VALUES (:id, :destinationId, :decision, :now, :now)
-         ON CONFLICT (destination_id) DO UPDATE SET
-           decision = excluded.decision,
-           updated_at = excluded.updated_at`
-    ).run({ id: randomUUID7(), destinationId, decision, now: Date.now() });
-    return true;
+      `UPDATE share_endpoint SET last_seen = :now, updated_at = :now
+         WHERE id IN (SELECT DISTINCT endpoint_id FROM share_call_site WHERE project_key = :key)`
+    ).run({ now, key: projectKey });
+    this.db.prepare(
+      `UPDATE share_destination SET last_seen = :now, updated_at = :now
+         WHERE id IN (SELECT DISTINCT e.destination_id
+                      FROM share_endpoint e
+                      JOIN share_call_site c ON c.endpoint_id = e.id
+                      WHERE c.project_key = :key)`
+    ).run({ now, key: projectKey });
+  }
+  /**
+   * Drop rows left without evidence: endpoints with no call site, then
+   * destinations with no endpoint. Call sites are the only evidence either one
+   * has, so a row that lost its last one belongs to no project any more.
+   *
+   * Overrides are deleted between the two steps, and only the ones written
+   * before the host column existed. Those match a destination by id alone;
+   * because the id link is released on delete rather than cascading, leaving
+   * them would accumulate rows that match neither join arm and that nothing can
+   * reach again. Host-bearing rows deliberately survive — the host is what
+   * re-attaches a user's decision when the destination comes back.
+   */
+  pruneOrphans() {
+    this.db.exec(
+      `DELETE FROM share_endpoint
+       WHERE NOT EXISTS (SELECT 1 FROM share_call_site c WHERE c.endpoint_id = share_endpoint.id)`
+    );
+    this.db.exec(
+      `DELETE FROM egress_decision_override
+       WHERE host IS NULL
+         AND destination_id IN (
+           SELECT d.id FROM share_destination d
+           WHERE NOT EXISTS (SELECT 1 FROM share_endpoint e WHERE e.destination_id = d.id))`
+    );
+    this.db.exec(
+      `DELETE FROM share_destination
+       WHERE NOT EXISTS (
+         SELECT 1 FROM share_endpoint e WHERE e.destination_id = share_destination.id)`
+    );
+  }
+  /**
+   * Live totals for one project. Destinations and endpoints are shared across
+   * projects and carry no project column, so both are counted through the call
+   * sites that reference them.
+   */
+  projectTotals(projectKey) {
+    return {
+      destinations: countScalar(
+        this.db,
+        `SELECT count(DISTINCT e.destination_id) AS n
+         FROM share_endpoint e
+         JOIN share_call_site c ON c.endpoint_id = e.id
+         WHERE c.project_key = ?`,
+        [projectKey]
+      ),
+      endpoints: countScalar(
+        this.db,
+        "SELECT count(DISTINCT endpoint_id) AS n FROM share_call_site WHERE project_key = ?",
+        [projectKey]
+      ),
+      callSites: countScalar(
+        this.db,
+        "SELECT count(*) AS n FROM share_call_site WHERE project_key = ?",
+        [projectKey]
+      )
+    };
   }
   // ─── Raw fetchers ────────────────────────────────────────────────────────────
   mapDestRow(r) {
@@ -22269,7 +22718,8 @@ var SqliteSharesRepository = class {
   fetchDestinations(q, kinds, reviewOnly = false) {
     const cols = `d.id, d.kind, d.name, d.host, d.category, d.trust, d.note,
                   d.network_json AS networkJson, d.last_seen AS lastSeenMs,
-                  d.created_at AS createdAt, o.decision AS overrideDecision`;
+                  d.created_at AS createdAt,
+                  COALESCE(oh.decision, ol.decision) AS overrideDecision`;
     const conditions = [];
     const params = [];
     if (kinds && kinds.length > 0) {
@@ -22280,7 +22730,8 @@ var SqliteSharesRepository = class {
       conditions.push(
         `(d.trust IN ('unverified', 'ip')
           OR EXISTS (SELECT 1 FROM share_endpoint re
-                     WHERE re.destination_id = d.id AND re.transport = 'http'))`
+                     WHERE re.destination_id = d.id
+                       AND re.transport IN ${PLAINTEXT_TRANSPORT_SQL}))`
       );
     }
     let sql;
@@ -22293,7 +22744,7 @@ var SqliteSharesRepository = class {
       params.push(pattern, pattern, pattern, pattern, pattern);
       sql = `SELECT DISTINCT ${cols}
              FROM share_destination d
-             LEFT JOIN egress_decision_override o ON o.destination_id = d.id
+             ${OVERRIDE_JOIN}
              LEFT JOIN share_endpoint e ON e.destination_id = d.id
              LEFT JOIN share_call_site c ON c.endpoint_id = e.id
              ${conditions.length ? `WHERE ${conditions.join(" AND ")}` : ""}
@@ -22301,7 +22752,7 @@ var SqliteSharesRepository = class {
     } else {
       sql = `SELECT ${cols}
              FROM share_destination d
-             LEFT JOIN egress_decision_override o ON o.destination_id = d.id
+             ${OVERRIDE_JOIN}
              ${conditions.length ? `WHERE ${conditions.join(" AND ")}` : ""}
              ORDER BY d.created_at ASC, d.id ASC`;
     }
@@ -22316,9 +22767,9 @@ var SqliteSharesRepository = class {
       this.db.prepare(
         `SELECT d.id, d.kind, d.name, d.host, d.category, d.trust, d.note,
                 d.network_json AS networkJson, d.last_seen AS lastSeenMs,
-                o.decision AS overrideDecision
+                COALESCE(oh.decision, ol.decision) AS overrideDecision
          FROM share_destination d
-         LEFT JOIN egress_decision_override o ON o.destination_id = d.id
+         ${OVERRIDE_JOIN}
          WHERE d.id = ?`
       ),
       [destinationId]
@@ -22547,6 +22998,7 @@ function openLocalDatabase(dir) {
   const scanLedger = new SqliteScanLedgerRepository(db);
   const exceptions = new SqliteExceptionsRepository(db);
   const resolutions = new SqliteResolutionsRepository(db);
+  const ruleProbeCache = new SqliteRuleProbeCacheRepository(db);
   const security = new SqliteSecurityRepository(db);
   const detections = new SqliteDetectionsRepository(db);
   const shares = new SqliteSharesRepository(db);
@@ -22684,6 +23136,7 @@ function openLocalDatabase(dir) {
     scanLedger,
     exceptions,
     resolutions,
+    ruleProbeCache,
     security,
     detections,
     shares,
@@ -22934,13 +23387,581 @@ import { readdirSync, readFileSync as readFileSync4, realpathSync, statSync as s
 import { homedir as homedir2 } from "os";
 import { basename as basename2, join as join7 } from "path";
 
+// ../../packages/detections/src/egress/registry.ts
+var EXTRACTOR_VERSION = "1";
+var PROVIDER_REGISTRY = [
+  {
+    id: "stripe",
+    name: "Stripe",
+    category: "Payments",
+    hostSuffixes: ["stripe.com"],
+    apiBase: "https://api.stripe.com",
+    defaultDataClasses: ["pii", "customer"],
+    sdks: {
+      npm: ["stripe"],
+      pypi: ["stripe"],
+      go: ["github.com/stripe/stripe-go"],
+      maven: ["com.stripe"],
+      rubygems: ["stripe"],
+      composer: ["stripe/stripe-php"],
+      nuget: ["Stripe.net"]
+    }
+  },
+  {
+    id: "datadog",
+    name: "Datadog",
+    category: "Observability",
+    hostSuffixes: ["datadoghq.com", "datadoghq.eu"],
+    apiBase: "https://api.datadoghq.com",
+    defaultDataClasses: ["telemetry", "logs", "metrics"],
+    sdks: {
+      npm: ["dd-trace", "@datadog/browser-logs"],
+      pypi: ["datadog", "ddtrace"],
+      go: ["github.com/DataDog/dd-trace-go"],
+      maven: ["com.datadoghq"],
+      rubygems: ["ddtrace", "dogapi"],
+      nuget: ["Datadog.Trace"]
+    }
+  },
+  {
+    id: "newrelic",
+    name: "New Relic",
+    category: "Observability",
+    hostSuffixes: ["newrelic.com", "nr-data.net"],
+    apiBase: "https://api.newrelic.com",
+    defaultDataClasses: ["telemetry", "logs", "metrics"],
+    sdks: {
+      npm: ["newrelic"],
+      pypi: ["newrelic"],
+      go: ["github.com/newrelic/go-agent"],
+      maven: ["com.newrelic.agent.java"],
+      rubygems: ["newrelic_rpm"],
+      nuget: ["NewRelic.Agent"]
+    }
+  },
+  {
+    id: "sentry",
+    name: "Sentry",
+    category: "Error tracking",
+    hostSuffixes: ["sentry.io"],
+    apiBase: "https://sentry.io",
+    defaultDataClasses: ["source", "telemetry"],
+    sdks: {
+      npm: ["@sentry/node", "@sentry/react", "@sentry/nextjs"],
+      pypi: ["sentry-sdk"],
+      go: ["github.com/getsentry/sentry-go"],
+      maven: ["io.sentry"],
+      rubygems: ["sentry-ruby"],
+      cargo: ["sentry"],
+      composer: ["sentry/sentry"],
+      nuget: ["Sentry"]
+    }
+  },
+  {
+    id: "openai",
+    name: "OpenAI",
+    category: "LLM provider",
+    hostSuffixes: ["openai.com"],
+    apiBase: "https://api.openai.com",
+    defaultDataClasses: ["pii", "source"],
+    sdks: {
+      npm: ["openai"],
+      pypi: ["openai"],
+      go: ["github.com/sashabaranov/go-openai"],
+      maven: ["com.openai"],
+      rubygems: ["ruby-openai"],
+      cargo: ["async-openai"],
+      composer: ["openai-php/client"],
+      nuget: ["OpenAI"]
+    }
+  },
+  {
+    id: "anthropic",
+    name: "Anthropic",
+    category: "LLM provider",
+    hostSuffixes: ["anthropic.com"],
+    apiBase: "https://api.anthropic.com",
+    defaultDataClasses: ["pii", "source"],
+    sdks: {
+      npm: ["@anthropic-ai/sdk"],
+      pypi: ["anthropic"],
+      go: ["github.com/anthropics/anthropic-sdk-go"],
+      nuget: ["Anthropic.SDK"]
+    }
+  },
+  {
+    id: "aws",
+    name: "Amazon Web Services",
+    category: "Cloud platform",
+    hostSuffixes: ["amazonaws.com"],
+    apiBase: "https://s3.amazonaws.com",
+    defaultDataClasses: ["secrets", "customer"],
+    sdks: {
+      npm: ["@aws-sdk/client-s3", "aws-sdk"],
+      pypi: ["boto3"],
+      go: ["github.com/aws/aws-sdk-go", "github.com/aws/aws-sdk-go-v2"],
+      maven: ["com.amazonaws", "software.amazon.awssdk"],
+      rubygems: ["aws-sdk-s3"],
+      cargo: ["aws-sdk-s3"],
+      nuget: ["AWSSDK.S3"]
+    }
+  },
+  {
+    id: "gcp",
+    name: "Google Cloud",
+    category: "Cloud platform",
+    hostSuffixes: ["googleapis.com"],
+    apiBase: "https://storage.googleapis.com",
+    defaultDataClasses: ["customer", "logs"],
+    sdks: {
+      npm: ["@google-cloud/storage"],
+      pypi: ["google-cloud-storage"],
+      go: ["cloud.google.com/go"],
+      maven: ["com.google.cloud"],
+      rubygems: ["google-cloud-storage"],
+      nuget: ["Google.Cloud.Storage.V1"]
+    }
+  },
+  {
+    id: "azure",
+    name: "Microsoft Azure",
+    category: "Cloud platform",
+    hostSuffixes: ["azure.com", "windows.net"],
+    apiBase: "https://management.azure.com",
+    defaultDataClasses: ["customer", "logs"],
+    sdks: {
+      npm: ["@azure/storage-blob"],
+      pypi: ["azure-storage-blob"],
+      go: ["github.com/Azure/azure-sdk-for-go"],
+      maven: ["com.azure"],
+      rubygems: ["azure-storage-blob"],
+      nuget: ["Azure.Storage.Blobs"]
+    }
+  },
+  {
+    id: "slack",
+    name: "Slack",
+    category: "Notifications",
+    hostSuffixes: ["slack.com"],
+    apiBase: "https://slack.com/api",
+    defaultDataClasses: ["logs"],
+    sdks: {
+      npm: ["@slack/web-api"],
+      pypi: ["slack-sdk"],
+      go: ["github.com/slack-go/slack"],
+      maven: ["com.slack.api"],
+      rubygems: ["slack-ruby-client"],
+      composer: ["slack-php/slack-api"],
+      nuget: ["SlackNet"]
+    }
+  },
+  {
+    id: "segment",
+    name: "Segment",
+    category: "Analytics",
+    hostSuffixes: ["segment.io", "segment.com"],
+    apiBase: "https://api.segment.io",
+    defaultDataClasses: ["customer"],
+    sdks: {
+      npm: ["@segment/analytics-node", "analytics-node"],
+      pypi: ["segment-analytics-python"],
+      go: ["github.com/segmentio/analytics-go"],
+      maven: ["com.segment.analytics.java"],
+      rubygems: ["analytics-ruby"],
+      nuget: ["Analytics"]
+    }
+  },
+  {
+    id: "twilio",
+    name: "Twilio",
+    category: "Communications",
+    hostSuffixes: ["twilio.com"],
+    apiBase: "https://api.twilio.com",
+    defaultDataClasses: ["pii", "customer"],
+    sdks: {
+      npm: ["twilio"],
+      pypi: ["twilio"],
+      go: ["github.com/twilio/twilio-go"],
+      maven: ["com.twilio.sdk"],
+      rubygems: ["twilio-ruby"],
+      composer: ["twilio/sdk"],
+      nuget: ["Twilio"]
+    }
+  },
+  {
+    id: "sendgrid",
+    name: "SendGrid",
+    category: "Email",
+    hostSuffixes: ["sendgrid.com"],
+    apiBase: "https://api.sendgrid.com",
+    defaultDataClasses: ["pii"],
+    sdks: {
+      npm: ["@sendgrid/mail"],
+      pypi: ["sendgrid"],
+      go: ["github.com/sendgrid/sendgrid-go"],
+      maven: ["com.sendgrid"],
+      rubygems: ["sendgrid-ruby"],
+      composer: ["sendgrid/sendgrid"],
+      nuget: ["SendGrid"]
+    }
+  },
+  {
+    id: "mailgun",
+    name: "Mailgun",
+    category: "Email",
+    hostSuffixes: ["mailgun.net"],
+    apiBase: "https://api.mailgun.net",
+    defaultDataClasses: ["pii"],
+    sdks: {
+      npm: ["mailgun.js"],
+      pypi: ["mailgun"],
+      rubygems: ["mailgun-ruby"],
+      composer: ["mailgun/mailgun-php"],
+      nuget: ["Mailgun"]
+    }
+  },
+  {
+    id: "mixpanel",
+    name: "Mixpanel",
+    category: "Analytics",
+    hostSuffixes: ["mixpanel.com"],
+    apiBase: "https://api.mixpanel.com",
+    defaultDataClasses: ["customer", "telemetry"],
+    sdks: {
+      npm: ["mixpanel"],
+      pypi: ["mixpanel"],
+      rubygems: ["mixpanel-ruby"],
+      nuget: ["Mixpanel"]
+    }
+  },
+  {
+    id: "amplitude",
+    name: "Amplitude",
+    category: "Analytics",
+    hostSuffixes: ["amplitude.com"],
+    apiBase: "https://api2.amplitude.com",
+    defaultDataClasses: ["customer", "telemetry"],
+    sdks: {
+      npm: ["@amplitude/analytics-node"],
+      pypi: ["amplitude-analytics"],
+      nuget: ["Amplitude"]
+    }
+  },
+  {
+    id: "posthog",
+    name: "PostHog",
+    category: "Analytics",
+    hostSuffixes: ["posthog.com"],
+    apiBase: "https://us.i.posthog.com",
+    defaultDataClasses: ["customer", "telemetry"],
+    sdks: {
+      npm: ["posthog-node", "posthog-js"],
+      pypi: ["posthog"],
+      go: ["github.com/posthog/posthog-go"],
+      rubygems: ["posthog-ruby"],
+      composer: ["posthog/posthog-php"],
+      nuget: ["PostHog"]
+    }
+  },
+  {
+    id: "honeycomb",
+    name: "Honeycomb",
+    category: "Observability",
+    hostSuffixes: ["honeycomb.io"],
+    apiBase: "https://api.honeycomb.io",
+    defaultDataClasses: ["telemetry", "metrics"],
+    sdks: {
+      npm: ["libhoney"],
+      pypi: ["libhoney"],
+      go: ["github.com/honeycombio/libhoney-go"],
+      rubygems: ["libhoney"]
+    }
+  },
+  {
+    id: "grafana",
+    name: "Grafana Cloud",
+    category: "Observability",
+    hostSuffixes: ["grafana.net"],
+    apiBase: "https://grafana.net",
+    defaultDataClasses: ["logs", "metrics"],
+    sdks: {
+      npm: ["@grafana/faro-web-sdk"]
+    }
+  },
+  {
+    id: "splunk",
+    name: "Splunk",
+    category: "Observability",
+    hostSuffixes: ["splunkcloud.com", "splunk.com"],
+    apiBase: "https://http-inputs.splunkcloud.com",
+    defaultDataClasses: ["logs"],
+    sdks: {
+      npm: ["splunk-logging"],
+      pypi: ["splunk-sdk"],
+      maven: ["com.splunk"],
+      nuget: ["Splunk.Logging.Common"]
+    }
+  },
+  {
+    id: "pagerduty",
+    name: "PagerDuty",
+    category: "Incident response",
+    hostSuffixes: ["pagerduty.com"],
+    apiBase: "https://api.pagerduty.com",
+    defaultDataClasses: ["logs"],
+    sdks: {
+      npm: ["@pagerduty/pdjs"],
+      pypi: ["pdpyras"],
+      go: ["github.com/PagerDuty/go-pagerduty"],
+      rubygems: ["pagerduty"]
+    }
+  },
+  {
+    id: "github",
+    name: "GitHub",
+    category: "Developer platform",
+    hostSuffixes: ["github.com", "githubusercontent.com"],
+    apiBase: "https://api.github.com",
+    defaultDataClasses: ["source"],
+    sdks: {
+      npm: ["@octokit/rest", "octokit"],
+      pypi: ["pygithub"],
+      go: ["github.com/google/go-github"],
+      maven: ["org.kohsuke.github-api"],
+      rubygems: ["octokit"],
+      cargo: ["octocrab"],
+      composer: ["knplabs/github-api"],
+      nuget: ["Octokit"]
+    }
+  },
+  {
+    id: "gitlab",
+    name: "GitLab",
+    category: "Developer platform",
+    hostSuffixes: ["gitlab.com"],
+    apiBase: "https://gitlab.com/api",
+    defaultDataClasses: ["source"],
+    sdks: {
+      npm: ["@gitbeaker/rest"],
+      pypi: ["python-gitlab"],
+      go: ["gitlab.com/gitlab-org/api/client-go"],
+      rubygems: ["gitlab"],
+      nuget: ["GitLabApiClient"]
+    }
+  },
+  {
+    id: "auth0",
+    name: "Auth0",
+    category: "Identity",
+    hostSuffixes: ["auth0.com"],
+    apiBase: "https://login.auth0.com",
+    defaultDataClasses: ["pii"],
+    sdks: {
+      npm: ["auth0"],
+      pypi: ["auth0-python"],
+      go: ["github.com/auth0/go-auth0"],
+      maven: ["com.auth0"],
+      rubygems: ["auth0"],
+      composer: ["auth0/auth0-php"],
+      nuget: ["Auth0.ManagementApi"]
+    }
+  },
+  {
+    id: "okta",
+    name: "Okta",
+    category: "Identity",
+    hostSuffixes: ["okta.com", "oktapreview.com"],
+    apiBase: "https://login.okta.com",
+    defaultDataClasses: ["pii"],
+    sdks: {
+      npm: ["@okta/okta-sdk-nodejs"],
+      pypi: ["okta"],
+      go: ["github.com/okta/okta-sdk-golang"],
+      maven: ["com.okta.sdk"],
+      nuget: ["Okta.Sdk"]
+    }
+  },
+  {
+    id: "clerk",
+    name: "Clerk",
+    category: "Identity",
+    hostSuffixes: ["clerk.com", "clerk.dev"],
+    apiBase: "https://api.clerk.com",
+    defaultDataClasses: ["pii"],
+    sdks: {
+      npm: ["@clerk/backend", "@clerk/nextjs"],
+      pypi: ["clerk-backend-api"],
+      go: ["github.com/clerk/clerk-sdk-go"]
+    }
+  },
+  {
+    id: "supabase",
+    name: "Supabase",
+    category: "Backend platform",
+    hostSuffixes: ["supabase.co", "supabase.com"],
+    apiBase: "https://api.supabase.com",
+    defaultDataClasses: ["pii", "customer"],
+    sdks: {
+      npm: ["@supabase/supabase-js"],
+      pypi: ["supabase"],
+      cargo: ["postgrest"]
+    }
+  },
+  {
+    id: "firebase",
+    name: "Firebase",
+    category: "Backend platform",
+    hostSuffixes: ["firebaseio.com", "firebase.google.com"],
+    apiBase: "https://firebaseio.com",
+    defaultDataClasses: ["customer"],
+    sdks: {
+      npm: ["firebase", "firebase-admin"],
+      pypi: ["firebase-admin"],
+      go: ["firebase.google.com/go"],
+      maven: ["com.google.firebase"]
+    }
+  },
+  {
+    id: "mongodb-atlas",
+    name: "MongoDB Atlas",
+    category: "Database SaaS",
+    hostSuffixes: ["mongodb.net", "mongodb.com"],
+    apiBase: "https://cloud.mongodb.com",
+    defaultDataClasses: ["customer"],
+    sdks: {
+      npm: ["mongodb"],
+      pypi: ["pymongo"],
+      go: ["go.mongodb.org/mongo-driver"],
+      maven: ["org.mongodb"],
+      rubygems: ["mongo"],
+      cargo: ["mongodb"],
+      nuget: ["MongoDB.Driver"]
+    }
+  },
+  {
+    id: "planetscale",
+    name: "PlanetScale",
+    category: "Database SaaS",
+    hostSuffixes: ["psdb.cloud", "planetscale.com"],
+    apiBase: "https://api.planetscale.com",
+    defaultDataClasses: ["customer"],
+    sdks: {
+      npm: ["@planetscale/database"],
+      go: ["github.com/planetscale/planetscale-go"]
+    }
+  },
+  {
+    id: "algolia",
+    name: "Algolia",
+    category: "Search SaaS",
+    hostSuffixes: ["algolia.net", "algolianet.com"],
+    apiBase: "https://algolia.net",
+    defaultDataClasses: ["customer"],
+    sdks: {
+      npm: ["algoliasearch"],
+      pypi: ["algoliasearch"],
+      go: ["github.com/algolia/algoliasearch-client-go"],
+      maven: ["com.algolia"],
+      rubygems: ["algolia"],
+      composer: ["algolia/algoliasearch-client-php"],
+      nuget: ["Algolia.Search"]
+    }
+  },
+  {
+    id: "cloudflare",
+    name: "Cloudflare",
+    category: "CDN / edge",
+    hostSuffixes: ["cloudflare.com", "workers.dev"],
+    apiBase: "https://api.cloudflare.com",
+    defaultDataClasses: ["logs"],
+    sdks: {
+      npm: ["cloudflare"],
+      pypi: ["cloudflare"],
+      go: ["github.com/cloudflare/cloudflare-go"],
+      nuget: ["CloudFlare.Client"]
+    }
+  },
+  {
+    id: "huggingface",
+    name: "Hugging Face",
+    category: "LLM provider",
+    hostSuffixes: ["huggingface.co"],
+    apiBase: "https://api-inference.huggingface.co",
+    defaultDataClasses: ["source"],
+    sdks: {
+      npm: ["@huggingface/inference"],
+      pypi: ["huggingface-hub", "transformers"],
+      rubygems: ["hugging-face"]
+    }
+  },
+  {
+    id: "cohere",
+    name: "Cohere",
+    category: "LLM provider",
+    hostSuffixes: ["cohere.com", "cohere.ai"],
+    apiBase: "https://api.cohere.com",
+    defaultDataClasses: ["pii", "source"],
+    sdks: {
+      npm: ["cohere-ai"],
+      pypi: ["cohere"],
+      go: ["github.com/cohere-ai/cohere-go"]
+    }
+  },
+  {
+    id: "mistral",
+    name: "Mistral AI",
+    category: "LLM provider",
+    hostSuffixes: ["mistral.ai"],
+    apiBase: "https://api.mistral.ai",
+    defaultDataClasses: ["pii", "source"],
+    sdks: {
+      npm: ["@mistralai/mistralai"],
+      pypi: ["mistralai"],
+      go: ["github.com/gage-technologies/mistral-go"]
+    }
+  }
+];
+var EGRESS_VERSION_MATERIAL = `${EXTRACTOR_VERSION}
+${JSON.stringify(PROVIDER_REGISTRY)}`;
+
+// ../../packages/detections/src/egress/extract.ts
+var SECRET_KEY_NAMES = "api[_-]?key|apikey|private[_-]?key|access[_-]?key|access[_-]?token|token|secret|credentials?|password|passwd|pwd|authorization|sig|signature|sas|assertion";
+var AUTH_SCHEMES = "Bearer|Basic|Token|Digest|ApiKey|SSWS|AWS4-HMAC-SHA256";
+var SECRET_VALUE = new RegExp(
+  `((?:${SECRET_KEY_NAMES})['"\`]?\\s*[:=]\\s*['"\`]?)(?!(?:${AUTH_SCHEMES})[\\s'"\`])[^\\s'"\`&]+`,
+  "gi"
+);
+var AUTH_SCHEME_VALUE = new RegExp(
+  `((?:${SECRET_KEY_NAMES})['"\`]?\\s*[:=]\\s*['"\`]?)(${AUTH_SCHEMES})\\s+[^\\s'"\`]+`,
+  "gi"
+);
+var WEBHOOK_SECRET_PATHS = [
+  { hosts: ["hooks.slack.com"], prefix: "/services/" },
+  {
+    hosts: ["discord.com", "discordapp.com", "ptb.discord.com", "canary.discord.com"],
+    prefix: "/api/webhooks/"
+  },
+  { hosts: ["hooks.zapier.com"], prefix: "/hooks/" },
+  { hosts: ["outlook.office.com", "outlook.office365.com"], prefix: "/webhook/" }
+];
+function escapeRegExp(literal2) {
+  return literal2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+var WEBHOOK_URL = new RegExp(
+  `(https?://(?:${WEBHOOK_SECRET_PATHS.flatMap(
+    (entry) => entry.hosts.map((host) => `${escapeRegExp(host)}${escapeRegExp(entry.prefix)}`)
+  ).join("|")}))[^\\s'"\`<>()[\\]{},;]+`,
+  "gi"
+);
+
 // ../../packages/detections/src/escape-regexp.ts
-function escapeRegExp(value) {
+function escapeRegExp2(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
 // ../../packages/detections/src/matchers/limits.ts
 var MAX_MATCHES_PER_RULE = 1e4;
+var MAX_REGEX_INPUT_LENGTH = 2e5;
 
 // ../../packages/detections/src/matchers/keyword.ts
 var KeywordMatcher2 = class {
@@ -22951,7 +23972,7 @@ var KeywordMatcher2 = class {
     for (const kw of keywords) {
       if (kw.length === 0) continue;
       if (spans.length >= MAX_MATCHES_PER_RULE) break;
-      const re = new RegExp(escapeRegExp(kw), caseSensitive ? "gu" : "giu");
+      const re = new RegExp(escapeRegExp2(kw), caseSensitive ? "gu" : "giu");
       let m;
       while ((m = re.exec(text)) !== null) {
         spans.push({ start: m.index, end: m.index + m[0].length });
@@ -22968,9 +23989,13 @@ var RegexMatcher2 = class {
     if (rule.matcher.type !== "regex") return [];
     const { pattern, flags, captureGroup } = rule.matcher;
     const re = new RegExp(pattern, flags.includes("d") ? flags : `${flags}d`);
+    const scanText2 = text.length > MAX_REGEX_INPUT_LENGTH ? text.slice(0, MAX_REGEX_INPUT_LENGTH) : text;
     const spans = [];
     let m;
-    while ((m = re.exec(text)) !== null) {
+    const maxIterations = scanText2.length + 1;
+    let iterations = 0;
+    while ((m = re.exec(scanText2)) !== null) {
+      if (++iterations > maxIterations) break;
       const group = captureGroup != null ? m[captureGroup] : m[0];
       if (m[0].length === 0) re.lastIndex++;
       if (group && spans.length < MAX_MATCHES_PER_RULE) {
@@ -23074,7 +24099,7 @@ function isCorroborated(candidate, candidates, text) {
     for (const label of labels) {
       const trimmed = label.trim();
       if (trimmed.length === 0) continue;
-      const re = new RegExp(`(?<![A-Za-z0-9])${escapeRegExp(trimmed)}(?![A-Za-z0-9])`, "i");
+      const re = new RegExp(`(?<![A-Za-z0-9])${escapeRegExp2(trimmed)}(?![A-Za-z0-9])`, "i");
       if (re.test(haystack)) return true;
     }
   }
@@ -23239,6 +24264,112 @@ var CONFIG_POSTURE_RULES = [
   }
 ];
 
+// ../../packages/detections/src/security/redos-probe.ts
+var BUDGET_MS = 100;
+var EXPONENTIAL_UNITS = [
+  "a",
+  "0",
+  " ",
+  "x",
+  "ab",
+  "a.",
+  "a-",
+  "a_",
+  "a@",
+  "a/",
+  "a:",
+  "a=",
+  "a;",
+  "aA0",
+  "	"
+];
+var EXPONENTIAL_PROBES = EXPONENTIAL_UNITS.flatMap(
+  (unit) => [23, 25].map((len) => unit.repeat(Math.ceil(len / unit.length)).slice(0, len) + "!")
+);
+var POLYNOMIAL_PROBES = ["abc-", "a.", "a ", "a=", "x", "0", "a@", "a/", "ab"].map(
+  (unit) => unit.repeat(1e4).slice(0, 4e4) + "!"
+);
+function literalPrefix(pattern) {
+  let prefix = "";
+  let i = 0;
+  if (pattern[i] === "^") i++;
+  while (i < pattern.length) {
+    const c = pattern[i];
+    if (c === void 0) break;
+    if (c === "\\") {
+      const next = pattern[i + 1];
+      if (next === "b" || next === "B") {
+        i += 2;
+        continue;
+      }
+      if (next === void 0 || /[dDwWsSnrtfv.]/.test(next)) break;
+      prefix += next;
+      i += 2;
+      continue;
+    }
+    if ("([{.*+?|)]}^$".includes(c)) break;
+    prefix += c;
+    i++;
+  }
+  return prefix;
+}
+function fuelChars(pattern) {
+  const fuel = /* @__PURE__ */ new Set();
+  for (const m of pattern.matchAll(/\[\^?([^\]]+)\]/g)) {
+    const body = m[1];
+    if (body === void 0) continue;
+    const range = /([A-Za-z0-9])-[A-Za-z0-9]/.exec(body);
+    const rangeStart = range?.[1];
+    if (rangeStart !== void 0) fuel.add(rangeStart);
+    else {
+      const literal2 = body.replace(/\\/g, "")[0];
+      if (literal2 !== void 0 && literal2 !== "^") fuel.add(literal2);
+    }
+  }
+  if (pattern.includes("\\w")) fuel.add("a");
+  if (pattern.includes("\\d")) fuel.add("0");
+  if (pattern.includes("\\s")) fuel.add(" ");
+  if (/(?<!\\)\./.test(pattern)) fuel.add("a");
+  if (fuel.size === 0) fuel.add("a");
+  return [...fuel];
+}
+function derivedProbes(pattern) {
+  const prefix = literalPrefix(pattern);
+  const fuel = fuelChars(pattern);
+  const terminators = ["!", "#", "~", "\n"];
+  const probes = [];
+  for (const f of fuel) {
+    for (const term of terminators) {
+      if (term === f) continue;
+      for (const len of [23, 25]) probes.push(prefix + f.repeat(len) + term);
+    }
+  }
+  return probes;
+}
+function probesFor(rule) {
+  const derived = rule.matcher.type === "regex" ? derivedProbes(rule.matcher.pattern) : [];
+  return [...derived, ...EXPONENTIAL_PROBES, ...POLYNOMIAL_PROBES];
+}
+function worstProbeMs(rule) {
+  let ms = 0;
+  let probe = "";
+  for (const text of probesFor(rule)) {
+    const start = performance.now();
+    scan(text, [rule]);
+    const elapsed = performance.now() - start;
+    if (elapsed > ms) {
+      ms = elapsed;
+      probe = text;
+    }
+    if (ms >= BUDGET_MS) break;
+  }
+  return { ms, probe };
+}
+function checkRuleTiming(rule) {
+  const { ms, probe } = worstProbeMs(rule);
+  return { safe: ms < BUDGET_MS, worstMs: ms, probe };
+}
+
 // ../../rules/code-flaws/auth-jwt-no-verify.json
 var auth_jwt_no_verify_default = {
   specVersion: 1,
@@ -25492,10 +26623,14 @@ function resolveInventoryContext(input) {
 import { mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
 import { join as join8 } from "path";
 
+// ../../packages/plugin-sdk/src/paths.ts
+import { readdirSync as readdirSync2, realpathSync as realpathSync2 } from "fs";
+import { basename as basename3, dirname as dirname2, sep as sep3 } from "path";
+
 // ../../packages/plugin-sdk/src/project-files.ts
 var import_ignore = __toESM(require_ignore(), 1);
-import { existsSync as existsSync4, readdirSync as readdirSync2, readFileSync as readFileSync6 } from "fs";
-import { basename as basename3, join as join9, relative, sep as sep3 } from "path";
+import { existsSync as existsSync4, readdirSync as readdirSync3, readFileSync as readFileSync6 } from "fs";
+import { basename as basename4, join as join9, relative, sep as sep4 } from "path";
 
 // ../../packages/plugin-sdk/src/raw-egress.ts
 var RawEgressError = class extends Error {
@@ -25537,6 +26672,59 @@ function safeMaskedMatch(rawMatch) {
   return masked;
 }
 
+// ../../packages/plugin-sdk/src/rule-quarantine.ts
+var PASS_BUDGET_MS = 2e3;
+function ruleProbeKey(rule) {
+  if (rule.matcher.type !== "regex") return void 0;
+  return contentHashOf(`${rule.matcher.pattern} ${rule.matcher.flags}`);
+}
+function warnQuarantined(rule, worstMs) {
+  const timing = worstMs === void 0 ? "not verified in time" : `${worstMs.toFixed(1)}ms`;
+  process.stderr.write(
+    `[aka] quarantined rule "${rule.id}": regex matcher exceeded the ReDoS timing budget (${timing}); excluded from this scan.
+`
+  );
+}
+async function filterUnsafeRules(rules, gateway, opts) {
+  const passBudgetMs = opts?.passBudgetMs ?? PASS_BUDGET_MS;
+  const passStart = performance.now();
+  const safe = [];
+  for (const rule of rules) {
+    const key = ruleProbeKey(rule);
+    if (key === void 0) {
+      safe.push(rule);
+      continue;
+    }
+    let cached2;
+    try {
+      cached2 = await gateway.getRuleProbeVerdict(key);
+    } catch {
+      cached2 = void 0;
+    }
+    if (cached2) {
+      if (cached2.verdict === "safe") safe.push(rule);
+      else warnQuarantined(rule, cached2.worstProbeMs);
+      continue;
+    }
+    if (performance.now() - passStart >= passBudgetMs) {
+      warnQuarantined(rule, void 0);
+      continue;
+    }
+    let isSafe;
+    let worstMs;
+    try {
+      ({ safe: isSafe, worstMs } = checkRuleTiming(rule));
+    } catch {
+      isSafe = false;
+      worstMs = Number.POSITIVE_INFINITY;
+    }
+    await gateway.setRuleProbeVerdict(key, isSafe ? "safe" : "quarantined", worstMs);
+    if (isSafe) safe.push(rule);
+    else warnQuarantined(rule, worstMs);
+  }
+  return safe;
+}
+
 // ../../packages/plugin-sdk/src/runtime.ts
 import { randomUUID as randomUUID10 } from "crypto";
 var ENFORCEMENT_CEILING_ENABLED = false;
@@ -25579,7 +26767,17 @@ function createPluginRuntime(gateway, settings, opts) {
         categoryActionIndex.set(p.target.category, p.action);
       }
     }
-    rules = bundle.rulesComplete ? bundle.rules ?? [] : [...getLoadedRules(), ...bundle.rules ?? []];
+    const bundledProbeKeys = new Set(
+      getLoadedRules().map(ruleProbeKey).filter((key) => key !== void 0)
+    );
+    const incoming = bundle.rules ?? [];
+    const ciVerified = incoming.filter((rule) => {
+      const key = ruleProbeKey(rule);
+      return key !== void 0 && bundledProbeKeys.has(key);
+    });
+    const needsGate = incoming.filter((rule) => !ciVerified.includes(rule));
+    const safeBundleRules = [...ciVerified, ...await filterUnsafeRules(needsGate, gateway)];
+    rules = bundle.rulesComplete ? safeBundleRules : [...getLoadedRules(), ...safeBundleRules];
     bundleExceptions = bundle.exceptions ?? [];
     initialized = true;
   }
@@ -26094,6 +27292,13 @@ var StandaloneDataGateway = class {
     this.db.scanLedger.upsertEntries(entries);
     return Promise.resolve();
   }
+  getRuleProbeVerdict(ruleKey) {
+    return Promise.resolve(this.db.ruleProbeCache.getVerdict(ruleKey));
+  }
+  setRuleProbeVerdict(ruleKey, verdict, worstProbeMs2) {
+    this.db.ruleProbeCache.setVerdict(ruleKey, verdict, worstProbeMs2);
+    return Promise.resolve();
+  }
   openAtRestKeysForPath(path) {
     return Promise.resolve(this.db.resolutions.openAtRestKeysForPath(path));
   }
@@ -26104,6 +27309,12 @@ var StandaloneDataGateway = class {
     this.db.resolutions.insertResolution(input);
     return Promise.resolve();
   }
+  // Bare forward — no toggle read here. The plugin-path kill-switch is
+  // enforced by the caller, which already holds the parsed workspace
+  // settings; this class only ever sees `dataDir`, not the settings base.
+  recordProjectEgress(input) {
+    return Promise.resolve(this.db.shares.recordProjectEgress(input));
+  }
   close() {
     this.db.close();
     return Promise.resolve();
@@ -26121,7 +27332,7 @@ import { randomUUID as randomUUID12 } from "crypto";
 var EXCEPTION_RETENTION_MS = 90 * 24 * 60 * 60 * 1e3;
 
 // src/history/transcripts.ts
-import { readdirSync as readdirSync3, readFileSync as readFileSync7 } from "fs";
+import { readdirSync as readdirSync4, readFileSync as readFileSync7 } from "fs";
 import { homedir as homedir3 } from "os";
 import { join as join11 } from "path";
 function transcriptsDir(home) {
@@ -26368,7 +27579,7 @@ var DAY_MS5 = 24 * 60 * 60 * 1e3;
 function* iterateFileContents(dir, excludeSessionId) {
   let projects;
   try {
-    projects = readdirSync3(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
+    projects = readdirSync4(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
   } catch {
     return;
   }
@@ -26376,7 +27587,7 @@ function* iterateFileContents(dir, excludeSessionId) {
     const projectDir = join11(dir, project);
     let files;
     try {
-      files = readdirSync3(projectDir).filter((name) => name.endsWith(".jsonl"));
+      files = readdirSync4(projectDir).filter((name) => name.endsWith(".jsonl"));
     } catch {
       continue;
     }