@akasecurity/ai-tc-claude-code 0.9.0 → 0.9.2

package/scripts/post-tool-use.js

@@ -491,9 +491,13 @@ var require_ignore = __commonJS({
   }
 });
 
+// ../../packages/plugin-sdk/src/config.ts
+import { existsSync as existsSync3 } from "fs";
+import { join as join6 } from "path";
+
 // ../../packages/persistence/src/database.ts
 import { randomUUID as randomUUID8 } from "crypto";
-import { existsSync, renameSync, rmSync } from "fs";
+import { existsSync, renameSync as renameSync2, rmSync as rmSync2 } from "fs";
 import { join, sep } from "path";
 import { DatabaseSync } from "node:sqlite";
 
@@ -542,6 +546,22 @@ var SQLITE_MIGRATIONS = [
   {
     tag: "0010_events_session_expression_index",
     sql: "-- Custom migration: partial expression index for session-scoped finding reads.\n--\n-- sessionFindingsCount, the session-scoped listGroupedFindings paths, and the\n-- insert-time session dedup all filter live-capture events by\n--   json_extract(e.metadata, '$.sessionId') = :sessionId\n-- \u2014 previously a full findings-join scan with a JSON parse per row. The\n-- IS NOT NULL predicate keeps the index to session-stamped events only (an\n-- equality probe implies non-null, so SQLite still uses it).\nCREATE INDEX `idx_events_session_id` ON `events` (json_extract(`metadata`, '$.sessionId')) WHERE json_extract(`metadata`, '$.sessionId') IS NOT NULL;\n"
+  },
+  {
+    tag: "0011_egress_writer",
+    sql: '-- Stable per-project reconcile key for egress call sites, plus a host-keyed\n-- egress decision override that survives destination pruning.\n--\n-- DROP INDEX IF EXISTS, not a bare DROP: the applier replays a pending\n-- migration\'s non-index statements verbatim, so a store that lost\n-- uq_share_call_site out of band would throw here \u2014 and on the plugin hook path\n-- that throw is swallowed fail-open, silently stopping capture.\n--\n-- Existing rows carry the old key\'s discriminator into project_key\n-- (\'legacy:\' || project), so the new unique index is a re-encoding of the old\n-- one and cannot collide on rows the old one allowed. Leaving them on the\n-- column default would collapse two projects\' identical file/line hits onto\n-- one key and abort the whole migration. Writer keys are \'git:\'/\'path:\'-\n-- prefixed, so a backfilled row never collides with a captured one either.\n--\n-- egress_decision_override.destination_id becomes nullable with ON DELETE SET\n-- NULL, which SQLite can only do by rebuilding the table. `host` is ADDed\n-- before the rebuild so the copy has a column to read and so the migration\n-- still presents two probeable columns to the applier\'s evidence check.\nALTER TABLE `share_call_site` ADD `project_key` text DEFAULT \'\' NOT NULL;--> statement-breakpoint\nUPDATE `share_call_site` SET `project_key` = \'legacy:\' || `project`;--> statement-breakpoint\nDROP INDEX IF EXISTS `uq_share_call_site`;--> statement-breakpoint\nCREATE UNIQUE INDEX `uq_share_call_site` ON `share_call_site` (`endpoint_id`,`project_key`,`file`,`line`);--> statement-breakpoint\nCREATE INDEX `idx_share_call_site_project` ON `share_call_site` (`project_key`,`endpoint_id`);--> statement-breakpoint\nALTER TABLE `egress_decision_override` ADD `host` text;--> statement-breakpoint\nPRAGMA foreign_keys=OFF;--> statement-breakpoint\nCREATE TABLE `__new_egress_decision_override` (\n	`id` text PRIMARY KEY NOT NULL,\n	`destination_id` text,\n	`host` text,\n	`decision` text NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL,\n	FOREIGN KEY (`destination_id`) REFERENCES `share_destination`(`id`) ON UPDATE no action ON DELETE set null\n);\n--> statement-breakpoint\nINSERT INTO `__new_egress_decision_override`("id", "destination_id", "host", "decision", "created_at", "updated_at") SELECT "id", "destination_id", "host", "decision", "created_at", "updated_at" FROM `egress_decision_override`;--> statement-breakpoint\nDROP TABLE `egress_decision_override`;--> statement-breakpoint\nALTER TABLE `__new_egress_decision_override` RENAME TO `egress_decision_override`;--> statement-breakpoint\nPRAGMA foreign_keys=ON;--> statement-breakpoint\nCREATE UNIQUE INDEX `uq_egress_decision_override` ON `egress_decision_override` (`destination_id`);--> statement-breakpoint\nCREATE UNIQUE INDEX `uq_egress_decision_override_host` ON `egress_decision_override` (`host`) WHERE `host` IS NOT NULL;\n'
+  },
+  {
+    tag: "0012_handy_the_captain",
+    sql: "ALTER TABLE `inspection_findings` ADD `finding_key` text;--> statement-breakpoint\nALTER TABLE `inspection_findings` ADD `first_detected_at` integer;--> statement-breakpoint\nCREATE UNIQUE INDEX `uq_inspection_findings_key` ON `inspection_findings` (`finding_key`);"
+  },
+  {
+    tag: "0013_legacy_history_backfill_support",
+    sql: "-- Legacy-to-generalized backfill support: the schema the resumable\n-- events/findings -> audit_events/inspection_findings copy needs (the row\n-- copy itself runs as a batched post-migration installer, not here \u2014 see\n-- @akasecurity/persistence's migrations.ts), plus the audit_events read-path\n-- indexes replacing the ones the legacy events table carried (0009/0010).\n\n-- Tracks how far the batched, resumable copy has advanced through each legacy\n-- table, by rowid, so a copy interrupted mid-run resumes instead of\n-- restarting, and a completed copy is a cheap no-op on every later open.\nCREATE TABLE `legacy_copy_watermark` (\n	`source` text PRIMARY KEY NOT NULL,\n	`last_rowid` integer DEFAULT 0 NOT NULL\n);\n--> statement-breakpoint\n-- Serves the time-range read family that scans a single event_type across a\n-- start/end window (e.g. the Activity timeline) without a full-table scan.\nCREATE INDEX `idx_audit_type_t` ON `audit_events` (`event_type`,`started_at`);\n--> statement-breakpoint\n-- Partial expression index mirroring `idx_events_code_change_path` (0009) for\n-- the generalized audit_events/attributes pair: file-path reads filter\n-- `event_type = 'code_change' AND json_extract(attributes, '$.file_path') = :path`.\nCREATE INDEX `idx_audit_code_change_path` ON `audit_events` (json_extract(`attributes`, '$.file_path')) WHERE `event_type` = 'code_change';\n--> statement-breakpoint\n-- Synthesizes a stub session root (event_type = 'session', no attributes) for\n-- every legacy `events.metadata.sessionId` that has no audit_events row yet.\n-- audit_events.root_session_id is a self-FK, enforced with foreign-key\n-- checking on, and INSERT OR IGNORE does not suppress a foreign-key violation\n-- (only UNIQUE/PK/NOT NULL/CHECK) \u2014 so this must run before the events copy\n-- resolves root_session_id, or every session-scoped row's insert fails.\n-- started_at takes the earliest legacy occurred_at recorded under that\n-- session, so the stub root's own timeline position is never later than\n-- anything it will end up parenting.\nINSERT INTO audit_events (id, event_type, root_session_id, started_at)\nSELECT\n	json_extract(metadata, '$.sessionId'),\n	'session',\n	NULL,\n	min(occurred_at)\nFROM events\nWHERE json_valid(metadata)\n	AND json_extract(metadata, '$.sessionId') IS NOT NULL\n	AND json_extract(metadata, '$.sessionId') NOT IN (SELECT id FROM audit_events)\nGROUP BY json_extract(metadata, '$.sessionId');\n"
+  },
+  {
+    tag: "0014_drop_legacy_events_findings",
+    sql: "-- Custom migration: drops the frozen legacy `events`/`findings` tables\n-- (superseded by audit_events/inspection_definitions/inspection_findings) and\n-- replaces them with read-only views of the same name.\n--\n-- persistence's migrations.ts applies this migration ONLY once the batched\n-- history backfill (see runLegacyHistoryBackfill) has fully drained both\n-- tables, and only after copying the live file aside \u2014 see\n-- backupBeforeLegacyDrop in packages/persistence/src/migrations.ts. A store\n-- still mid-copy keeps its real tables and this migration stays pending.\n--\n-- The views exist for skew: the `aka` CLI and the Claude Code plugin update\n-- independently against one shared store, so an older, already-installed\n-- binary can open a store a newer binary already dropped these tables on.\n-- Every already-shipped repository constructor prepares its SQL eagerly at\n-- open time, so a bare \"table not found\" would fail the WHOLE open, not just\n-- a findings-specific read \u2014 these views keep `prepare()` succeeding so an\n-- old binary's unrelated features keep working; its own reads stay truthful,\n-- and its rare (already fail-open) writes fail at run time instead.\n--\n-- The 0009/0010 expression indexes existed only over the legacy `events`\n-- table; DROP TABLE below would remove them implicitly, but they are\n-- dropped explicitly first so the intent reads clearly. IF EXISTS so a store\n-- that reached here with an index missing out of band (an adopted-tag store\n-- whose physical index was never built) does not throw a deterministic \"no\n-- such index\" out of the fail-open drop path.\nDROP INDEX IF EXISTS `idx_events_code_change_path`;\n--> statement-breakpoint\nDROP INDEX IF EXISTS `idx_events_session_id`;\n--> statement-breakpoint\n-- `findings.event_id` references `events.id` \u2014 drop the child first.\nDROP TABLE `findings`;\n--> statement-breakpoint\nDROP TABLE `events`;\n--> statement-breakpoint\n-- Legacy `events` shape, projected from audit_events: `kind`/`occurred_at`/\n-- `source_tool` become real columns again (source_tool round-trips through\n-- the attributes bag, the only place a capture-typed audit row keeps it);\n-- `metadata` is reconstructed as the old camelCase JSON object from the new\n-- snake_case attributes bag, with `root_session_id` folded back in as\n-- `sessionId` (the one legacy metadata key that became a column, never an\n-- attribute, on the new table). Constrained to the four capture kinds so\n-- structural rows (session/run/tool_call/llm_call/source_lookup/config_scan)\n-- never leak into a legacy reader's result set \u2014 the old `events` table\n-- never held them either.\nCREATE VIEW `events` AS\nSELECT\n  id,\n  json_extract(attributes, '$.source_tool') AS source_tool,\n  event_type AS kind,\n  started_at AS occurred_at,\n  content_hash,\n  content,\n  -- Plugin-local bookkeeping column that `ensureSyncedAtColumn` adds to the\n  -- real `events` table at open time. A pre-cutover binary runs that probe on\n  -- EVERY open; without this projection its `columnNames('events')` check\n  -- misses `synced_at` and issues `ALTER TABLE events ADD COLUMN` against this\n  -- view, which SQLite rejects (\"Cannot add a column to a view\") \u2014 a hard,\n  -- non-fail-open crash of the whole open, the exact skew failure these views\n  -- exist to prevent. Projecting it (always NULL; no reader consumes it)\n  -- short-circuits that ALTER.\n  NULL AS synced_at,\n  json_object(\n    'sessionId', root_session_id,\n    'repo', json_extract(attributes, '$.repo'),\n    'filePath', json_extract(attributes, '$.file_path'),\n    'toolName', json_extract(attributes, '$.tool_name'),\n    'gitignored', json_extract(attributes, '$.gitignored'),\n    'wholeFile', json_extract(attributes, '$.whole_file'),\n    'model', json_extract(attributes, '$.model'),\n    'turnIndex', json_extract(attributes, '$.turn_index'),\n    'correlationId', json_extract(attributes, '$.correlation_id'),\n    'traceId', json_extract(attributes, '$.trace_id'),\n    'exceptionIds', json_extract(attributes, '$.exception_ids')\n  ) AS metadata\nFROM audit_events\nWHERE event_type IN ('prompt', 'response', 'code_change', 'tool_use');\n--> statement-breakpoint\n-- A plain single-row INSERT (the old writer's shape \u2014 no ON CONFLICT) is\n-- accepted by prepare() against a view once an INSTEAD OF INSERT trigger\n-- exists, so it fails at run time instead of at open \u2014 landing in the same\n-- fail-open path the caller already wraps its write in.\nCREATE TRIGGER `trg_events_ro`\nINSTEAD OF INSERT ON `events`\nBEGIN SELECT RAISE(ABORT, 'events is read-only; write to audit_events instead'); END;\n--> statement-breakpoint\n-- Legacy `findings` shape: rule_id/category/severity come from the joined\n-- inspection_definitions row (the legacy table inlined them per-row; the\n-- generalized schema normalizes them out into the shared definition). A view\n-- has no rowid of its own, so the underlying table's rowid is re-exposed\n-- explicitly under that name \u2014 a legacy reader ordering by `f.rowid` would\n-- otherwise fail to resolve the column at all. Joined to audit_events for the\n-- same four-capture-kind constraint as the events view above (a finding\n-- attached to a tool_call/config_scan row never existed in the legacy table\n-- either \u2014 see the persistence findings repository's identical predicate).\nCREATE VIEW `findings` AS\nSELECT\n  f.id AS id,\n  f.rowid AS rowid,\n  f.audit_event_id AS event_id,\n  d.rule_id AS rule_id,\n  d.category AS category,\n  d.severity AS severity,\n  f.span_start AS span_start,\n  f.span_end AS span_end,\n  f.masked_match AS masked_match,\n  f.action_taken AS action_taken,\n  f.confidence AS confidence,\n  f.finding_key AS finding_key,\n  f.first_detected_at AS first_detected_at\nFROM inspection_findings f\nJOIN audit_events e ON e.id = f.audit_event_id\nJOIN inspection_definitions d ON d.id = f.inspection_definition_id\nWHERE e.event_type IN ('prompt', 'response', 'code_change', 'tool_use');\n--> statement-breakpoint\n-- Defense in depth only: SQLite refuses to plan ANY upsert against a view\n-- (\"cannot UPSERT a view\") no matter what trigger exists, so this can never\n-- rescue the real legacy writer, which always used\n-- `ON CONFLICT (finding_key) DO UPDATE` \u2014 that statement still fails at\n-- prepare() on an old binary, same as it would with no trigger at all. This\n-- only covers a plain-INSERT shape, should one ever exist.\nCREATE TRIGGER `trg_findings_ro`\nINSTEAD OF INSERT ON `findings`\nBEGIN SELECT RAISE(ABORT, 'findings is read-only; write to inspection_findings instead'); END;\n"
   }
 ];
 
@@ -15372,7 +15392,12 @@ var FindingFacets = external_exports.object({
   severity: external_exports.array(FindingFacetItem),
   subtype: external_exports.array(FindingFacetItem),
   provider: external_exports.array(FindingFacetItem),
-  action: external_exports.array(FindingFacetItem)
+  action: external_exports.array(FindingFacetItem),
+  // Counts by the group's derived status. The SQLite store derives a status
+  // for every instance, so every group lands in a bucket; a status-less
+  // group (possible only for callers whose rows carry no statuses) is
+  // counted under no value.
+  status: external_exports.array(FindingFacetItem)
 }).meta({ id: "FindingFacets" });
 var DEFAULT_GROUPED_FINDINGS_LIMIT = 50;
 var ListGroupedFindingsQuery = external_exports.object({
@@ -15382,6 +15407,10 @@ var ListGroupedFindingsQuery = external_exports.object({
   subtype: external_exports.array(external_exports.string()).optional(),
   provider: external_exports.array(FindingProvider).optional(),
   action: external_exports.array(FindingAction).optional(),
+  // Matches a group's DERIVED status (see FindingGroup.status), not its
+  // individual instances' — so a filtered group's Status column always reads
+  // one of the requested values.
+  status: external_exports.array(FindingStatus).optional(),
   q: external_exports.string().optional(),
   // Scope to findings whose event carries this session id (the Activity page's
   // session → findings drilldown). Findings without a session never match.
@@ -15569,6 +15598,33 @@ var ToolCallAttributes = external_exports.object({
   parent_uuid: external_exports.string().optional(),
   run_key: external_exports.string().optional()
 }).catchall(external_exports.unknown());
+var CaptureAttributes = external_exports.object({
+  // The harness/tool that produced the capture (`claude-code`, `cli`, …). A
+  // column on the legacy `events` table; here it rides the bag because a
+  // capture-typed audit row has no equivalent column of its own.
+  source_tool: external_exports.string().optional(),
+  file_path: external_exports.string().optional(),
+  repo: external_exports.string().optional(),
+  // The host tool whose input/output was scanned (e.g. 'Bash', 'WebFetch') —
+  // gives a non-file capture a display location ("via Bash") when file_path
+  // is absent. The tool NAME only, never its arguments/output.
+  tool_name: external_exports.string().optional(),
+  // Presence-only provenance flag: set when the file is excluded by the
+  // repo's .gitignore. Omitted (not false) for tracked files.
+  gitignored: external_exports.boolean().optional(),
+  // Set ONLY when the capture is a COMPLETE file snapshot (a worktree scan
+  // reading from disk), never a partial fragment (a hook-captured edit).
+  whole_file: external_exports.boolean().optional(),
+  // Distributed-tracing correlation: `correlation_id` ties the capture back to
+  // the request that produced it; `trace_id` is the originating span's W3C
+  // trace id when telemetry is enabled.
+  correlation_id: external_exports.uuid().optional(),
+  trace_id: external_exports.string().regex(/^[0-9a-f]{32}$/).optional(),
+  // Ids of the detection exceptions that downgraded findings in this capture
+  // to 'allow' — the enforcement audit trail's link back to the grant that
+  // authorized the bypass.
+  exception_ids: external_exports.array(external_exports.guid()).optional()
+}).catchall(external_exports.unknown());
 var ToolCallInspection = external_exports.object({
   ruleId: external_exports.string().min(1),
   ruleName: external_exports.string(),
@@ -15655,7 +15711,18 @@ var InspectionFindingInput = external_exports.object({
   span: Span,
   maskedMatch: external_exports.string(),
   actionTaken: ActionTaken,
-  confidence: external_exports.number().min(0).max(1)
+  confidence: external_exports.number().min(0).max(1),
+  // Stable, content-addressed key correlating this finding across re-detections
+  // — mirrors the legacy `findings.finding_key` (uq_inspection_findings_key is
+  // its unique index). Optional: only an at-rest/re-scannable finding carries
+  // one; an in-flight capture (prompt/response) has nothing to re-detect
+  // against and leaves it unset, so every insert is a fresh row.
+  findingKey: external_exports.string().optional(),
+  // The ORIGINAL detection time, preserved across a later re-detection of the
+  // same findingKey — mirrors the legacy `findings.first_detected_at`.
+  // Optional: when omitted, the writer derives it from the referenced audit
+  // event's startedAt on first insert (see SqliteInspectionFindingsRepository).
+  firstDetectedAt: external_exports.iso.datetime().optional()
 });
 var InventoryContext = external_exports.object({
   host: InventoryInput.optional(),
@@ -15857,6 +15924,7 @@ var ActivityOverviewResponse = external_exports.object({
 
 // ../../packages/schema/src/zod/event.ts
 var EventKind = external_exports.enum(["prompt", "response", "code_change", "tool_use"]).meta({ id: "EventKind" });
+var CAPTURE_EVENT_TYPES_SQL = EventKind.options.map((k) => `'${k}'`).join(",");
 var SourceTool = external_exports.enum(["claude-code", "claude-desktop", "cursor", "chatgpt", "github-copilot", "cli", "unknown"]).meta({ id: "SourceTool" });
 var EventMetadata = external_exports.object({
   sessionId: external_exports.string().optional(),
@@ -16197,6 +16265,7 @@ var ExceptionBundleEntry = DetectionException.pick({
 
 // ../../packages/schema/src/zod/rule.ts
 var MatcherType = external_exports.enum(["keyword", "regex", "validator"]).meta({ id: "MatcherType" });
+var RuleProbeVerdict = external_exports.enum(["safe", "quarantined"]).meta({ id: "RuleProbeVerdict" });
 var KeywordMatcher = external_exports.object({
   type: external_exports.literal("keyword"),
   // An empty keyword matches at every position, yielding one zero-length span
@@ -16221,9 +16290,10 @@ function matchesEmptyString(pattern, flags) {
     return false;
   }
 }
+var MAX_PATTERN_LENGTH = 2e3;
 var RegexMatcher = external_exports.object({
   type: external_exports.literal("regex"),
-  pattern: external_exports.string(),
+  pattern: external_exports.string().min(1).max(MAX_PATTERN_LENGTH),
   flags: external_exports.string().default("gi"),
   captureGroup: external_exports.number().int().nonnegative().optional()
 }).refine((v) => isValidRegex(v.pattern, v.flags), {
@@ -16344,6 +16414,12 @@ var PolicyBundle = external_exports.object({
   // on-disk caches — that omit the field still parse; consumers read
   // `bundle.exceptions ?? []`.
   exceptions: external_exports.array(ExceptionBundleEntry).optional(),
+  // Installed pack version, keyed by ruleId, for rules in `rules` that came
+  // from a versioned installed pack. Optional so older backends — and older
+  // on-disk caches — that omit the field still parse; consumers fall back to
+  // the rule's own spec version. NOT the bundle version above — see
+  // installedRuleset's ruleVersions for the source of truth.
+  ruleVersions: external_exports.record(external_exports.string(), external_exports.string()).optional(),
   customKeywords: external_exports.array(external_exports.string()),
   fetchedAt: external_exports.iso.datetime()
 }).meta({ id: "PolicyBundle" });
@@ -16790,6 +16866,212 @@ function buildDetectionsList(summaries, query) {
   return { counts, items: filtered.map(summaryToDetectionListItem) };
 }
 
+// ../../packages/schema/src/zod/shares.ts
+var DestinationKind = external_exports.enum(["provider", "internal", "external", "ip"]).meta({ id: "DestinationKind" });
+var Transport = external_exports.enum(["https", "http", "sftp", "grpc", "smtp", "ws", "wss"]).meta({ id: "Transport" });
+var DataClass = external_exports.enum(["secrets", "pii", "customer", "source", "telemetry", "logs", "metrics", "none"]).meta({ id: "DataClass" });
+var DATA_CLASS_ORDER = DataClass.options;
+var ShareTrustLevel = external_exports.enum(["recognized", "internal", "unverified", "ip"]).meta({ id: "ShareTrustLevel" });
+var EgressDecision = external_exports.enum(["allow", "block"]).meta({ id: "EgressDecision" });
+var EgressStatus = external_exports.enum(["allowed", "blocked", "review"]).meta({ id: "EgressStatus" });
+var ReviewReason = external_exports.enum(["raw_ip", "unverified_domain", "plaintext_transport"]).meta({ id: "ReviewReason" });
+var HttpMethod = external_exports.enum(["GET", "POST", "PUT", "DELETE", "SDK", "REF"]).meta({ id: "HttpMethod" });
+var ReviewInfo = external_exports.object({
+  needsReview: external_exports.boolean(),
+  reasons: external_exports.array(ReviewReason)
+}).meta({ id: "ReviewInfo" });
+var DestinationNetwork = external_exports.object({
+  port: external_exports.number().int().nullable(),
+  geo: external_exports.string().nullable(),
+  ptr: external_exports.string().nullable()
+}).meta({ id: "DestinationNetwork" });
+var EndpointSummary = external_exports.object({
+  id: external_exports.string(),
+  method: HttpMethod,
+  transport: Transport,
+  url: external_exports.string(),
+  template: external_exports.boolean(),
+  dataClass: DataClass,
+  lastSeen: external_exports.iso.datetime(),
+  callSiteCount: external_exports.number().int().nonnegative()
+}).meta({ id: "EndpointSummary" });
+var CallSite = external_exports.object({
+  id: external_exports.string(),
+  project: external_exports.string(),
+  file: external_exports.string(),
+  line: external_exports.number().int().nonnegative(),
+  snippet: external_exports.string(),
+  dynamic: external_exports.boolean(),
+  vendored: external_exports.boolean(),
+  /** Deep-link to the Inventory project, when the repo is governed there. */
+  projectId: external_exports.string().nullable()
+}).meta({ id: "CallSite" });
+var EndpointWithSites = EndpointSummary.extend({
+  sites: external_exports.array(CallSite)
+}).meta({ id: "EndpointWithSites" });
+var ShareDestinationSummary = external_exports.object({
+  id: external_exports.string(),
+  kind: DestinationKind,
+  name: external_exports.string(),
+  host: external_exports.string(),
+  category: external_exports.string(),
+  trust: ShareTrustLevel,
+  /** Effective state (decision applied over the trust default). */
+  status: EgressStatus,
+  /** True when an egress decision override differs from the trust default. */
+  isCustom: external_exports.boolean(),
+  lastSeen: external_exports.iso.datetime(),
+  endpointCount: external_exports.number().int().nonnegative(),
+  callSiteCount: external_exports.number().int().nonnegative(),
+  transports: external_exports.array(Transport),
+  /** Most-sensitive first. */
+  dataClasses: external_exports.array(DataClass),
+  review: ReviewInfo,
+  /** Non-provider hosts only; null for providers. */
+  network: DestinationNetwork.nullable(),
+  /** Embedded for inline expansion — no call sites here. */
+  endpoints: external_exports.array(EndpointSummary)
+}).meta({ id: "ShareDestinationSummary" });
+var ShareDestinationDetail = ShareDestinationSummary.omit({
+  endpointCount: true,
+  callSiteCount: true,
+  endpoints: true
+}).extend({
+  /** Ownership/geo rationale; null for providers. */
+  note: external_exports.string().nullable(),
+  endpoints: external_exports.array(EndpointWithSites)
+}).meta({ id: "ShareDestinationDetail" });
+var ReviewDestination = external_exports.object({
+  id: external_exports.string(),
+  kind: DestinationKind,
+  name: external_exports.string(),
+  /** Registrable host — lets the strip derive the provider lettermark, as the register does. */
+  host: external_exports.string(),
+  trust: ShareTrustLevel,
+  status: EgressStatus,
+  review: ReviewInfo,
+  topDataClass: DataClass,
+  callSiteCount: external_exports.number().int().nonnegative(),
+  lastSeen: external_exports.iso.datetime()
+}).meta({ id: "ReviewDestination" });
+var ShareDestinationGroup = external_exports.object({
+  kind: DestinationKind,
+  total: external_exports.number().int().nonnegative(),
+  items: external_exports.array(ShareDestinationSummary)
+}).meta({ id: "ShareDestinationGroup" });
+var ListShareDestinationsResponse = external_exports.object({ groups: external_exports.array(ShareDestinationGroup) }).meta({ id: "ListShareDestinationsResponse" });
+var NeedsReviewResponse = external_exports.object({ items: external_exports.array(ReviewDestination) }).meta({ id: "NeedsReviewResponse" });
+var SharesStats = external_exports.object({
+  destinations: external_exports.number().int().nonnegative(),
+  endpoints: external_exports.number().int().nonnegative(),
+  callSites: external_exports.number().int().nonnegative(),
+  needsReview: external_exports.number().int().nonnegative(),
+  insecure: external_exports.number().int().nonnegative(),
+  byKind: external_exports.object({
+    provider: external_exports.number().int().nonnegative(),
+    internal: external_exports.number().int().nonnegative(),
+    external: external_exports.number().int().nonnegative(),
+    ip: external_exports.number().int().nonnegative()
+  }),
+  byTrust: external_exports.object({
+    recognized: external_exports.number().int().nonnegative(),
+    internal: external_exports.number().int().nonnegative(),
+    unverified: external_exports.number().int().nonnegative(),
+    ip: external_exports.number().int().nonnegative()
+  })
+}).meta({ id: "SharesStats" });
+var SetEgressDecisionBody = external_exports.object({
+  /** `null` clears the override — reverts to the trust default, isCustom false. */
+  decision: EgressDecision.nullable()
+}).meta({ id: "SetEgressDecisionBody" });
+var SetEgressDecisionResponse = external_exports.object({ destination: ShareDestinationSummary }).meta({ id: "SetEgressDecisionResponse" });
+var ListShareDestinationsQuery = external_exports.object({
+  /** Case-insensitive match over destination name/category, endpoint url, call-site project/file. */
+  q: external_exports.string().optional(),
+  /** Repeatable. Restrict to these DestinationKind values; absent means all kinds. */
+  kind: external_exports.array(DestinationKind).optional(),
+  /** Reserved for future grouping modes; only 'destination' is supported today. */
+  groupBy: external_exports.enum(["destination"]).default("destination"),
+  /**
+   * When true, return a flat severity-ordered `items[]` instead of `groups`.
+   * Uses `z.stringbool()` (NOT `z.coerce.boolean()` — `Boolean(str)` is true for
+   * any non-empty string, so `?review=false`/`?review=0` would wrongly coerce
+   * to `true`). `z.stringbool()` parses true/1/yes vs false/0/no correctly.
+   */
+  review: external_exports.stringbool().default(false)
+});
+var ExportSharesQuery = external_exports.object({
+  format: external_exports.enum(["csv", "json"]).default("csv"),
+  q: external_exports.string().optional(),
+  kind: external_exports.array(DestinationKind).optional()
+});
+
+// ../../packages/schema/src/zod/egress-extraction.ts
+var EgressEcosystem = external_exports.enum(["npm", "pypi", "go", "maven", "rubygems", "cargo", "composer", "nuget"]).meta({ id: "EgressEcosystem" });
+var ProviderRegistryEntry = external_exports.object({
+  id: external_exports.string(),
+  name: external_exports.string(),
+  category: external_exports.string(),
+  /** Suffix-matched: 'stripe.com' matches api.stripe.com, never evilstripe.com. */
+  hostSuffixes: external_exports.array(external_exports.string()).min(1),
+  /** Canonical API base URL recorded for manifest-derived (method 'SDK') endpoints. */
+  apiBase: external_exports.string(),
+  /** Most-sensitive first; index 0 becomes the endpoint dataClass. */
+  defaultDataClasses: external_exports.array(DataClass).min(1),
+  /** SDK identifiers per ecosystem ('go' prefix-matched by path, 'maven' by group-id prefix). */
+  sdks: external_exports.partialRecord(EgressEcosystem, external_exports.array(external_exports.string()))
+}).meta({ id: "ProviderRegistryEntry" });
+var EgressCallSiteHit = external_exports.object({
+  file: external_exports.string(),
+  line: external_exports.number().int().positive(),
+  snippet: external_exports.string(),
+  dynamic: external_exports.boolean(),
+  vendored: external_exports.boolean()
+}).meta({ id: "EgressCallSiteHit" });
+var ResolvedEgressHit = external_exports.object({
+  host: external_exports.string(),
+  kind: DestinationKind,
+  name: external_exports.string(),
+  category: external_exports.string(),
+  trust: ShareTrustLevel,
+  network: DestinationNetwork.nullable(),
+  method: HttpMethod,
+  transport: Transport,
+  url: external_exports.string(),
+  template: external_exports.boolean(),
+  dataClass: DataClass,
+  site: EgressCallSiteHit
+}).meta({ id: "ResolvedEgressHit" });
+var EgressReconcile = external_exports.discriminatedUnion("mode", [
+  external_exports.object({ mode: external_exports.literal("walk"), walkedPrefix: external_exports.string() }),
+  external_exports.object({
+    mode: external_exports.literal("ledger"),
+    scannedFiles: external_exports.array(external_exports.string()),
+    deletedFiles: external_exports.array(external_exports.string())
+  })
+]).meta({ id: "EgressReconcile" });
+var RecordProjectEgressInput = external_exports.object({
+  /** Stable reconcile key: 'git:<repo identity>' or 'path:<abs root>' (non-git). */
+  projectKey: external_exports.string().min(1),
+  /** Display name only — never keys reconciliation. */
+  project: external_exports.string(),
+  projectId: external_exports.string().nullable(),
+  reconcile: EgressReconcile,
+  hits: external_exports.array(ResolvedEgressHit)
+}).meta({ id: "RecordProjectEgressInput" });
+var EgressWriteSummary = external_exports.object({
+  destinations: external_exports.number().int().nonnegative(),
+  endpoints: external_exports.number().int().nonnegative(),
+  callSites: external_exports.number().int().nonnegative(),
+  truncated: external_exports.boolean(),
+  /**
+   * Files the cap dropped whole. Their stored rows were left untouched, so a
+   * ledger-keeping caller must withhold their ledger entries and read them
+   * again next scan.
+   */
+  droppedFiles: external_exports.array(external_exports.string()).default([])
+}).meta({ id: "EgressWriteSummary" });
+
 // ../../packages/schema/src/zod/findings-group-build.ts
 function toApiAction(dbVal) {
   const map2 = {
@@ -16937,6 +17219,15 @@ function groupActions(g) {
   actionsCache.set(g, actions);
   return actions;
 }
+function countInstancesByStatus(statusInputs, statuses) {
+  const statusSet = new Set(statuses);
+  let sum = 0;
+  for (const input of statusInputs) {
+    if (input.count === void 0) return null;
+    if (statusSet.has(deriveFindingStatus(input))) sum += input.count;
+  }
+  return sum;
+}
 function applyFindingFilters(groups, opts) {
   let filtered = groups;
   if (opts.severity && opts.severity.length > 0) {
@@ -16955,6 +17246,10 @@ function applyFindingFilters(groups, opts) {
     const subtypeSet = new Set(opts.subtype);
     filtered = filtered.filter((g) => subtypeSet.has(g.subtype));
   }
+  if (opts.statuses && opts.statuses.length > 0) {
+    const statusSet = new Set(opts.statuses);
+    filtered = filtered.filter((g) => g.status !== void 0 && statusSet.has(g.status));
+  }
   if (opts.q) {
     const q = opts.q.toLowerCase();
     filtered = filtered.filter((g) => groupHaystack(g).includes(q));
@@ -16976,6 +17271,7 @@ function computeFindingFacets(allGroups, opts) {
   const forSeverity = applyFindingFilters(allGroups, {
     providers: opts.providers,
     actions: opts.actions,
+    statuses: opts.statuses,
     q: opts.q,
     subtype: opts.subtype
   });
@@ -16985,6 +17281,7 @@ function computeFindingFacets(allGroups, opts) {
   }
   const forProvider = applyFindingFilters(allGroups, {
     actions: opts.actions,
+    statuses: opts.statuses,
     q: opts.q,
     subtype: opts.subtype,
     severity: opts.severity
@@ -16995,6 +17292,7 @@ function computeFindingFacets(allGroups, opts) {
   }
   const forAction = applyFindingFilters(allGroups, {
     providers: opts.providers,
+    statuses: opts.statuses,
     q: opts.q,
     subtype: opts.subtype,
     severity: opts.severity
@@ -17006,17 +17304,30 @@ function computeFindingFacets(allGroups, opts) {
   const forSubtype = applyFindingFilters(allGroups, {
     providers: opts.providers,
     actions: opts.actions,
+    statuses: opts.statuses,
     q: opts.q,
     severity: opts.severity
   });
   const subtypeMap = /* @__PURE__ */ new Map();
   for (const g of forSubtype) subtypeMap.set(g.subtype, (subtypeMap.get(g.subtype) ?? 0) + 1);
+  const forStatus = applyFindingFilters(allGroups, {
+    providers: opts.providers,
+    actions: opts.actions,
+    q: opts.q,
+    subtype: opts.subtype,
+    severity: opts.severity
+  });
+  const statusMap = /* @__PURE__ */ new Map();
+  for (const g of forStatus) {
+    if (g.status !== void 0) statusMap.set(g.status, (statusMap.get(g.status) ?? 0) + 1);
+  }
   const toItems = (m) => [...m.entries()].map(([value, count]) => ({ value, count }));
   return {
     severity: toItems(severityMap),
     provider: toItems(providerMap),
     action: toItems(actionMap),
-    subtype: toItems(subtypeMap)
+    subtype: toItems(subtypeMap),
+    status: toItems(statusMap)
   };
 }
 
@@ -17051,10 +17362,14 @@ var PatchInstalledPackRequest = external_exports.object({
 }).meta({ id: "PatchInstalledPackRequest" });
 
 // ../../packages/schema/src/zod/local.ts
-var WORKSPACE_SETTINGS_SPEC_VERSION = 2;
+var WORKSPACE_SETTINGS_SPEC_VERSION = 4;
 var RunMode = external_exports.enum(["standalone"]);
 var SimpleDetectionPolicy = external_exports.enum(["redact", "warn"]);
 var HistoricalAccess = external_exports.enum(["full", "session-only"]);
+var ModelJudgeConsent = external_exports.object({
+  acknowledgedAt: external_exports.iso.datetime(),
+  payloadVersion: external_exports.number().int().positive()
+});
 var WorkspaceSettings = external_exports.object({
   specVersion: external_exports.number().int().positive().default(WORKSPACE_SETTINGS_SPEC_VERSION),
   // Settings files written by earlier releases may carry the retired 'attached'
@@ -17066,38 +17381,20 @@ var WorkspaceSettings = external_exports.object({
   policy: SimpleDetectionPolicy.default("redact"),
   // Consent for scanning pre-install surfaces; opt-in (see HistoricalAccess).
   historicalAccess: HistoricalAccess.default("session-only"),
+  // In-place egress extraction on the scan paths; disable to stop all Data
+  // Shares writes.
+  dataSharesInPlace: external_exports.boolean().default(true),
   // Absent until /aka:setup completes; its presence is what "onboarded" means.
-  onboardedAt: external_exports.iso.datetime().optional()
+  onboardedAt: external_exports.iso.datetime().optional(),
+  // Records that the user consented to sending findings to the model API for
+  // the /aka:setup judge, along with the payload-shape version they agreed to.
+  // Absent until granted; a stale payloadVersion means the consent no longer
+  // covers the current payload and must be re-granted.
+  modelJudgeConsent: ModelJudgeConsent.optional()
 });
 function defaultWorkspaceSettings() {
   return WorkspaceSettings.parse({});
 }
-function toEventRow(event) {
-  return {
-    id: event.id,
-    sourceTool: event.sourceTool,
-    kind: event.kind,
-    occurredAt: isoToEpochMillis(event.occurredAt),
-    contentHash: event.contentHash,
-    content: event.content,
-    metadata: event.metadata ? JSON.stringify(event.metadata) : null
-  };
-}
-function toFindingRow(finding) {
-  return {
-    id: finding.id,
-    eventId: finding.eventId,
-    ruleId: finding.ruleId,
-    category: finding.category,
-    severity: finding.severity,
-    spanStart: finding.span.start,
-    spanEnd: finding.span.end,
-    maskedMatch: finding.maskedMatch,
-    actionTaken: finding.actionTaken,
-    confidence: finding.confidence,
-    findingKey: finding.findingKey ?? null
-  };
-}
 function toInventoryRow(input, id, now) {
   return {
     id,
@@ -17167,7 +17464,42 @@ function toInspectionFindingRow(input) {
     spanEnd: input.span.end,
     maskedMatch: input.maskedMatch,
     actionTaken: input.actionTaken,
-    confidence: input.confidence
+    confidence: input.confidence,
+    findingKey: input.findingKey ?? null,
+    firstDetectedAt: input.firstDetectedAt ? isoToEpochMillis(input.firstDetectedAt) : null
+  };
+}
+function toCaptureAttributes(event) {
+  const metadata = event.metadata;
+  return {
+    source_tool: event.sourceTool,
+    ...metadata?.repo !== void 0 ? { repo: metadata.repo } : {},
+    ...metadata?.filePath !== void 0 ? { file_path: metadata.filePath } : {},
+    ...metadata?.toolName !== void 0 ? { tool_name: metadata.toolName } : {},
+    ...metadata?.gitignored !== void 0 ? { gitignored: metadata.gitignored } : {},
+    ...metadata?.wholeFile !== void 0 ? { whole_file: metadata.wholeFile } : {},
+    ...metadata?.correlationId !== void 0 ? { correlation_id: metadata.correlationId } : {},
+    ...metadata?.traceId !== void 0 ? { trace_id: metadata.traceId } : {},
+    ...metadata?.exceptionIds !== void 0 ? { exception_ids: metadata.exceptionIds } : {},
+    // `model`/`turnIndex` have no dedicated CaptureAttributes field (no writer
+    // has ever populated either), but every legacy metadata key still rides
+    // the bag rather than being silently dropped — CaptureAttributes'
+    // `.catchall(z.unknown())` carries the long tail.
+    ...metadata?.model !== void 0 ? { model: metadata.model } : {},
+    ...metadata?.turnIndex !== void 0 ? { turn_index: metadata.turnIndex } : {}
+  };
+}
+function captureDefinitionVersion(finding) {
+  return `capture/${finding.category}/${finding.severity}`;
+}
+function toCaptureDefinitionInput(finding) {
+  return {
+    ruleId: finding.ruleId,
+    version: captureDefinitionVersion(finding),
+    name: finding.ruleId,
+    category: finding.category,
+    severity: finding.severity,
+    definition: JSON.stringify({ ruleId: finding.ruleId })
   };
 }
 
@@ -17549,145 +17881,6 @@ var SetupHandoffOffer = external_exports.object({
   path: ["liveKeys"]
 });
 
-// ../../packages/schema/src/zod/shares.ts
-var DestinationKind = external_exports.enum(["provider", "internal", "ip"]).meta({ id: "DestinationKind" });
-var Transport = external_exports.enum(["https", "http", "sftp", "grpc", "smtp"]).meta({ id: "Transport" });
-var DataClass = external_exports.enum(["secrets", "pii", "customer", "source", "telemetry", "logs", "metrics", "none"]).meta({ id: "DataClass" });
-var DATA_CLASS_ORDER = DataClass.options;
-var ShareTrustLevel = external_exports.enum(["recognized", "internal", "unverified", "ip"]).meta({ id: "ShareTrustLevel" });
-var EgressDecision = external_exports.enum(["allow", "block"]).meta({ id: "EgressDecision" });
-var EgressStatus = external_exports.enum(["allowed", "blocked", "review"]).meta({ id: "EgressStatus" });
-var ReviewReason = external_exports.enum(["raw_ip", "unverified_domain", "plaintext_transport"]).meta({ id: "ReviewReason" });
-var HttpMethod = external_exports.enum(["GET", "POST", "PUT", "DELETE"]).meta({ id: "HttpMethod" });
-var ReviewInfo = external_exports.object({
-  needsReview: external_exports.boolean(),
-  reasons: external_exports.array(ReviewReason)
-}).meta({ id: "ReviewInfo" });
-var DestinationNetwork = external_exports.object({
-  port: external_exports.number().int().nullable(),
-  geo: external_exports.string().nullable(),
-  ptr: external_exports.string().nullable()
-}).meta({ id: "DestinationNetwork" });
-var EndpointSummary = external_exports.object({
-  id: external_exports.string(),
-  method: HttpMethod,
-  transport: Transport,
-  url: external_exports.string(),
-  template: external_exports.boolean(),
-  dataClass: DataClass,
-  lastSeen: external_exports.iso.datetime(),
-  callSiteCount: external_exports.number().int().nonnegative()
-}).meta({ id: "EndpointSummary" });
-var CallSite = external_exports.object({
-  id: external_exports.string(),
-  project: external_exports.string(),
-  file: external_exports.string(),
-  line: external_exports.number().int().nonnegative(),
-  snippet: external_exports.string(),
-  dynamic: external_exports.boolean(),
-  vendored: external_exports.boolean(),
-  /** Deep-link to the Inventory project, when the repo is governed there. */
-  projectId: external_exports.string().nullable()
-}).meta({ id: "CallSite" });
-var EndpointWithSites = EndpointSummary.extend({
-  sites: external_exports.array(CallSite)
-}).meta({ id: "EndpointWithSites" });
-var ShareDestinationSummary = external_exports.object({
-  id: external_exports.string(),
-  kind: DestinationKind,
-  name: external_exports.string(),
-  host: external_exports.string(),
-  category: external_exports.string(),
-  trust: ShareTrustLevel,
-  /** Effective state (decision applied over the trust default). */
-  status: EgressStatus,
-  /** True when an egress decision override differs from the trust default. */
-  isCustom: external_exports.boolean(),
-  lastSeen: external_exports.iso.datetime(),
-  endpointCount: external_exports.number().int().nonnegative(),
-  callSiteCount: external_exports.number().int().nonnegative(),
-  transports: external_exports.array(Transport),
-  /** Most-sensitive first. */
-  dataClasses: external_exports.array(DataClass),
-  review: ReviewInfo,
-  /** Non-provider hosts only; null for providers. */
-  network: DestinationNetwork.nullable(),
-  /** Embedded for inline expansion — no call sites here. */
-  endpoints: external_exports.array(EndpointSummary)
-}).meta({ id: "ShareDestinationSummary" });
-var ShareDestinationDetail = ShareDestinationSummary.omit({
-  endpointCount: true,
-  callSiteCount: true,
-  endpoints: true
-}).extend({
-  /** Ownership/geo rationale; null for providers. */
-  note: external_exports.string().nullable(),
-  endpoints: external_exports.array(EndpointWithSites)
-}).meta({ id: "ShareDestinationDetail" });
-var ReviewDestination = external_exports.object({
-  id: external_exports.string(),
-  kind: DestinationKind,
-  name: external_exports.string(),
-  /** Registrable host — lets the strip derive the provider lettermark, as the register does. */
-  host: external_exports.string(),
-  trust: ShareTrustLevel,
-  status: EgressStatus,
-  review: ReviewInfo,
-  topDataClass: DataClass,
-  callSiteCount: external_exports.number().int().nonnegative(),
-  lastSeen: external_exports.iso.datetime()
-}).meta({ id: "ReviewDestination" });
-var ShareDestinationGroup = external_exports.object({
-  kind: DestinationKind,
-  total: external_exports.number().int().nonnegative(),
-  items: external_exports.array(ShareDestinationSummary)
-}).meta({ id: "ShareDestinationGroup" });
-var ListShareDestinationsResponse = external_exports.object({ groups: external_exports.array(ShareDestinationGroup) }).meta({ id: "ListShareDestinationsResponse" });
-var NeedsReviewResponse = external_exports.object({ items: external_exports.array(ReviewDestination) }).meta({ id: "NeedsReviewResponse" });
-var SharesStats = external_exports.object({
-  destinations: external_exports.number().int().nonnegative(),
-  endpoints: external_exports.number().int().nonnegative(),
-  callSites: external_exports.number().int().nonnegative(),
-  needsReview: external_exports.number().int().nonnegative(),
-  insecure: external_exports.number().int().nonnegative(),
-  byKind: external_exports.object({
-    provider: external_exports.number().int().nonnegative(),
-    internal: external_exports.number().int().nonnegative(),
-    ip: external_exports.number().int().nonnegative()
-  }),
-  byTrust: external_exports.object({
-    recognized: external_exports.number().int().nonnegative(),
-    internal: external_exports.number().int().nonnegative(),
-    unverified: external_exports.number().int().nonnegative(),
-    ip: external_exports.number().int().nonnegative()
-  })
-}).meta({ id: "SharesStats" });
-var SetEgressDecisionBody = external_exports.object({
-  /** `null` clears the override — reverts to the trust default, isCustom false. */
-  decision: EgressDecision.nullable()
-}).meta({ id: "SetEgressDecisionBody" });
-var SetEgressDecisionResponse = external_exports.object({ destination: ShareDestinationSummary }).meta({ id: "SetEgressDecisionResponse" });
-var ListShareDestinationsQuery = external_exports.object({
-  /** Case-insensitive match over destination name/category, endpoint url, call-site project/file. */
-  q: external_exports.string().optional(),
-  /** Repeatable. Restrict to these DestinationKind values; absent means all kinds. */
-  kind: external_exports.array(DestinationKind).optional(),
-  /** Reserved for future grouping modes; only 'destination' is supported today. */
-  groupBy: external_exports.enum(["destination"]).default("destination"),
-  /**
-   * When true, return a flat severity-ordered `items[]` instead of `groups`.
-   * Uses `z.stringbool()` (NOT `z.coerce.boolean()` — `Boolean(str)` is true for
-   * any non-empty string, so `?review=false`/`?review=0` would wrongly coerce
-   * to `true`). `z.stringbool()` parses true/1/yes vs false/0/no correctly.
-   */
-  review: external_exports.stringbool().default(false)
-});
-var ExportSharesQuery = external_exports.object({
-  format: external_exports.enum(["csv", "json"]).default("csv"),
-  q: external_exports.string().optional(),
-  kind: external_exports.array(DestinationKind).optional()
-});
-
 // ../../packages/schema/src/zod/shares-access.ts
 var ALLOWED_BY_DEFAULT_TRUST = /* @__PURE__ */ new Set(["recognized", "internal"]);
 function trustDefaultStatus(trust) {
@@ -17707,7 +17900,7 @@ function deriveReviewReasons(trust, transports) {
   const reasons = [];
   if (trust === "ip") reasons.push("raw_ip");
   if (trust === "unverified") reasons.push("unverified_domain");
-  if (transports.includes("http")) reasons.push("plaintext_transport");
+  if (transports.includes("http") || transports.includes("ws")) reasons.push("plaintext_transport");
   return reasons;
 }
 function buildReviewInfo(trust, transports) {
@@ -17734,6 +17927,48 @@ function reviewSeverityRank(reasons) {
   return Math.min(...reasons.map((r) => REVIEW_SEVERITY_RANK[r]));
 }
 
+// ../../packages/persistence/src/ids.ts
+import { createHash } from "crypto";
+function sha256Hex(input) {
+  return createHash("sha256").update(input).digest("hex");
+}
+function inventoryId(objectType, identityKey) {
+  return sha256Hex(canonicalIdentity(["inventory", objectType, identityKey]));
+}
+function sourceProjectId(url2) {
+  return sha256Hex(canonicalIdentity(["source_project", url2]));
+}
+function classifiedDataId(cls) {
+  return sha256Hex(canonicalIdentity(["classified_data", cls]));
+}
+function inspectionDefinitionId(ruleId, version2) {
+  return sha256Hex(canonicalIdentity(["inspection_definition", ruleId, version2]));
+}
+function llmCallId(sessionId, messageId) {
+  return sha256Hex(canonicalIdentity(["audit_event_llm_call", sessionId, messageId]));
+}
+function toolCallId(sessionId, toolUseId) {
+  return sha256Hex(canonicalIdentity(["audit_event_tool_call", sessionId, toolUseId]));
+}
+function inspectionFindingId(auditEventId, ruleId, spanStart, spanEnd) {
+  return sha256Hex(
+    canonicalIdentity([
+      "inspection_finding",
+      auditEventId,
+      ruleId,
+      String(spanStart),
+      String(spanEnd)
+    ])
+  );
+}
+var NO_SESSION = "no_session";
+var NO_PATH = "no_path";
+function captureId(sessionId, contentHash, filePath = null) {
+  return sha256Hex(
+    canonicalIdentity(["capture", sessionId ?? NO_SESSION, contentHash, filePath ?? NO_PATH])
+  );
+}
+
 // ../../packages/persistence/src/internal/sql-text.ts
 function escapeLikePattern(s) {
   return s.replace(/\\/g, "\\\\").replace(/%/g, "\\%").replace(/_/g, "\\_");
@@ -17830,39 +18065,98 @@ function evidenceExists(db, object2) {
   return schemaObjectExists(db, "table", object2.name);
 }
 
-// ../../packages/persistence/src/ids.ts
-import { createHash } from "crypto";
-function sha256Hex(input) {
-  return createHash("sha256").update(input).digest("hex");
+// ../../packages/persistence/src/internal/rows.ts
+function allRows(stmt, params) {
+  if (params === void 0) return stmt.all();
+  if (Array.isArray(params)) return stmt.all(...params);
+  return stmt.all(params);
 }
-function inventoryId(objectType, identityKey) {
-  return sha256Hex(canonicalIdentity(["inventory", objectType, identityKey]));
+function getRow(stmt, params) {
+  if (params === void 0) return stmt.get();
+  if (Array.isArray(params)) return stmt.get(...params);
+  return stmt.get(params);
 }
-function sourceProjectId(url2) {
-  return sha256Hex(canonicalIdentity(["source_project", url2]));
+function intToBool(raw) {
+  return raw === 1 || raw === true;
 }
-function classifiedDataId(cls) {
-  return sha256Hex(canonicalIdentity(["classified_data", cls]));
+function boolToInt(b) {
+  return b ? 1 : 0;
 }
-function inspectionDefinitionId(ruleId, version2) {
-  return sha256Hex(canonicalIdentity(["inspection_definition", ruleId, version2]));
+function bindParams(row) {
+  const out = {};
+  for (const [key, value] of Object.entries(row)) {
+    out[key] = value === void 0 ? null : value;
+  }
+  return out;
 }
-function llmCallId(sessionId, messageId) {
-  return sha256Hex(canonicalIdentity(["audit_event_llm_call", sessionId, messageId]));
+function countScalar(db, sql, params) {
+  return getRow(db.prepare(sql), params)?.n ?? 0;
 }
-function toolCallId(sessionId, toolUseId) {
-  return sha256Hex(canonicalIdentity(["audit_event_tool_call", sessionId, toolUseId]));
+function countBy(db, sql, params) {
+  const map2 = /* @__PURE__ */ new Map();
+  for (const row of allRows(db.prepare(sql), params)) {
+    map2.set(row.k, row.n);
+  }
+  return map2;
 }
-function inspectionFindingId(auditEventId, definitionId, spanStart, spanEnd) {
-  return sha256Hex(
-    canonicalIdentity([
-      "inspection_finding",
-      auditEventId,
-      definitionId,
-      String(spanStart),
-      String(spanEnd)
-    ])
-  );
+function mapRowsTolerant(rows, map2) {
+  const out = [];
+  for (const row of rows) {
+    try {
+      out.push(map2(row));
+    } catch {
+    }
+  }
+  return out;
+}
+
+// ../../packages/persistence/src/paths.ts
+import { chmodSync, lstatSync, mkdirSync, renameSync, rmSync, writeFileSync } from "fs";
+var DATA_DIR_MODE = 448;
+var DATA_FILE_MODE = 384;
+var DB_FILENAME = "aka.db";
+function chmodBestEffort(path, mode) {
+  try {
+    chmodSync(path, mode);
+  } catch {
+  }
+}
+function tightenDir(dir) {
+  chmodBestEffort(dir, DATA_DIR_MODE);
+}
+function ensureDataDirSync(dir) {
+  mkdirSync(dir, { recursive: true, mode: DATA_DIR_MODE });
+  tightenDir(dir);
+}
+function dbSidecars(file2) {
+  return [`${file2}-wal`, `${file2}-shm`, `${file2}-journal`];
+}
+function tightenFile(file2) {
+  try {
+    if (lstatSync(file2).isSymbolicLink()) return;
+  } catch {
+  }
+  chmodBestEffort(file2, DATA_FILE_MODE);
+}
+function tightenPerms(file2) {
+  for (const path of [file2, ...dbSidecars(file2)]) chmodBestEffort(path, DATA_FILE_MODE);
+}
+function writeOwnerOnlyFileSync(file2, data) {
+  const tmp = `${file2}.${String(process.pid)}.tmp`;
+  try {
+    rmSync(tmp, { force: true });
+  } catch {
+  }
+  try {
+    writeFileSync(tmp, data, { mode: DATA_FILE_MODE, flag: "wx" });
+    renameSync(tmp, file2);
+  } finally {
+    try {
+      rmSync(tmp, { force: true });
+    } catch {
+    }
+  }
+  tightenFile(file2);
 }
 
 // ../../packages/persistence/src/migrations.ts
@@ -17876,7 +18170,8 @@ function createdIndexName(statement) {
   const body = statement.replace(/^(?:\s*--[^\n]*\n?)+/, "").trimStart();
   return /^CREATE (?:UNIQUE )?INDEX (?:IF NOT EXISTS )?`([^`]+)`/.exec(body)?.[1];
 }
-function applyMigrations(db) {
+var LEGACY_DROP_MIGRATION_TAG = "0014_drop_legacy_events_findings";
+function applyMigrations(db, file2) {
   const legacyCount = db.prepare("PRAGMA user_version").get().user_version;
   db.exec(
     "CREATE TABLE IF NOT EXISTS migration_ledger (tag TEXT PRIMARY KEY, applied_at INTEGER NOT NULL)"
@@ -17890,6 +18185,7 @@ function applyMigrations(db) {
   );
   for (const [index, migration] of SQLITE_MIGRATIONS.entries()) {
     if (applied.has(migration.tag)) continue;
+    if (migration.tag === LEGACY_DROP_MIGRATION_TAG) continue;
     const evidence = evidenceObjects(migration.sql);
     const present = evidence.filter((o) => evidenceExists(db, o));
     if (present.length > 0 && present.length < evidence.length) {
@@ -17934,13 +18230,54 @@ function applyMigrations(db) {
   if (legacyCount < SQLITE_MIGRATIONS.length) {
     db.exec(`PRAGMA user_version = ${String(SQLITE_MIGRATIONS.length)}`);
   }
-  ensureSyncedAtColumn(db, "events");
   ensureSyncedAtColumn(db, "audit_events");
   ensureScanLedgerTable(db);
   ensureBlockedDetectionsTable(db);
+  ensureRuleProbeCacheTable(db);
   ensureWriteGateTrigger(db);
   ensureTokenUsageColumns(db);
   reconcileSourceProjectIds(db);
+  if (!applied.has(LEGACY_DROP_MIGRATION_TAG)) {
+    const drained = runLegacyHistoryBackfill(db);
+    if (drained) applyLegacyDropMigration(db, file2);
+  }
+}
+function applyLegacyDropMigration(db, file2) {
+  const migration = SQLITE_MIGRATIONS.find((m) => m.tag === LEGACY_DROP_MIGRATION_TAG);
+  if (!migration) return;
+  if (file2) {
+    try {
+      backupBeforeLegacyDrop(db, file2);
+    } catch (error51) {
+      akaWarn(`legacy events/findings backup failed; deferring the drop: ${String(error51)}`);
+      return;
+    }
+  }
+  try {
+    withTransaction(
+      db,
+      () => {
+        const alreadyDropped = db.prepare("SELECT 1 FROM migration_ledger WHERE tag = ?").get(migration.tag);
+        if (alreadyDropped) return;
+        for (const statement of splitStatements(migration.sql)) {
+          db.exec(statement);
+        }
+        db.prepare("INSERT OR IGNORE INTO migration_ledger (tag, applied_at) VALUES (?, ?)").run(
+          migration.tag,
+          Date.now()
+        );
+      },
+      "IMMEDIATE"
+    );
+  } catch (error51) {
+    akaWarn(`legacy events/findings drop failed; deferring: ${String(error51)}`);
+  }
+}
+function backupBeforeLegacyDrop(db, file2) {
+  const backup = `${file2}.pre-drop.${String(Date.now())}.bak`;
+  db.prepare("VACUUM INTO ?").run(backup);
+  tightenFile(backup);
+  return backup;
 }
 var TOKEN_USAGE_COLUMNS = [
   {
@@ -17969,6 +18306,7 @@ var TOKEN_USAGE_COLUMNS = [
   }
 ];
 function ensureTokenUsageColumns(db) {
+  if (!schemaObjectExists(db, "table", "audit_events")) return;
   const existing = new Set(columnNames(db, "audit_events", { includeGenerated: true }));
   for (const column of TOKEN_USAGE_COLUMNS) {
     if (!existing.has(column.name)) {
@@ -18027,11 +18365,186 @@ function reconcileSourceProjectIds(db) {
           repointCallSite.run(canonicalId, row.id);
           deleteLegacy.run(row.id);
         }
-      },
-      "IMMEDIATE"
-    );
+      },
+      "IMMEDIATE"
+    );
+  } catch (error51) {
+    akaWarn(`source_project id reconcile failed: ${String(error51)}`);
+  }
+}
+var LEGACY_BACKFILL_BATCH_SIZE = 200;
+var LEGACY_BACKFILL_MAX_ROWS_PER_CALL = 1e3;
+function getLegacyCopyWatermark(db, source) {
+  const row = db.prepare("SELECT last_rowid AS lastRowid FROM legacy_copy_watermark WHERE source = ?").get(source);
+  return row?.lastRowid ?? 0;
+}
+function setLegacyCopyWatermark(db, source, lastRowid) {
+  db.prepare(
+    `INSERT INTO legacy_copy_watermark (source, last_rowid) VALUES (?, ?)
+     ON CONFLICT(source) DO UPDATE SET last_rowid = excluded.last_rowid`
+  ).run(source, lastRowid);
+}
+function drainLegacyTable(db, source, selectStmt, handleRows) {
+  let watermark = getLegacyCopyWatermark(db, source);
+  let processed = 0;
+  while (processed < LEGACY_BACKFILL_MAX_ROWS_PER_CALL) {
+    const rows = selectStmt.all(watermark, LEGACY_BACKFILL_BATCH_SIZE);
+    if (rows.length === 0) return true;
+    withTransaction(
+      db,
+      () => {
+        handleRows(rows);
+        watermark = rows[rows.length - 1]?.rowid ?? watermark;
+        setLegacyCopyWatermark(db, source, watermark);
+      },
+      "IMMEDIATE"
+    );
+    processed += rows.length;
+    if (rows.length < LEGACY_BACKFILL_BATCH_SIZE) return true;
+  }
+  return false;
+}
+function parseLegacyEventMetadata(raw) {
+  if (raw === null) return void 0;
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return void 0;
+  }
+}
+function toLegacyAuditAttributesJson(row) {
+  return JSON.stringify(
+    toCaptureAttributes({
+      id: row.id,
+      sourceTool: row.sourceTool,
+      kind: row.kind,
+      occurredAt: new Date(row.occurredAt).toISOString(),
+      contentHash: row.contentHash,
+      content: row.content,
+      metadata: row.metadata
+    })
+  );
+}
+function copyLegacyEvents(db) {
+  const selectStmt = db.prepare(
+    `SELECT rowid AS rowid, id, source_tool AS sourceTool, kind, occurred_at AS occurredAt,
+            content_hash AS contentHash, content, metadata
+     FROM events WHERE rowid > ? ORDER BY rowid LIMIT ?`
+  );
+  const insertStmt = db.prepare(
+    `INSERT OR IGNORE INTO audit_events
+       (id, parent_id, root_session_id, event_type, started_at, content, content_hash, attributes)
+     VALUES (:id, :parentId, :rootSessionId, :eventType, :startedAt, :content, :contentHash, :attributes)`
+  );
+  const stubRootStmt = db.prepare(
+    `INSERT OR IGNORE INTO audit_events (id, event_type, started_at) VALUES (?, 'session', ?)`
+  );
+  return drainLegacyTable(
+    db,
+    "events",
+    selectStmt,
+    (rows) => {
+      for (const row of rows) {
+        const metadata = parseLegacyEventMetadata(row.metadata);
+        const sessionId = metadata?.sessionId ?? null;
+        if (sessionId !== null) stubRootStmt.run(sessionId, row.occurredAt);
+        insertStmt.run(
+          bindParams({
+            id: row.id,
+            parentId: sessionId,
+            rootSessionId: sessionId,
+            eventType: row.kind,
+            startedAt: row.occurredAt,
+            content: row.content,
+            contentHash: row.contentHash,
+            attributes: toLegacyAuditAttributesJson({ ...row, metadata })
+          })
+        );
+      }
+    }
+  );
+}
+function copyLegacyFindings(db) {
+  const selectStmt = db.prepare(
+    `SELECT rowid AS rowid, id, event_id AS eventId, rule_id AS ruleId, category, severity,
+            span_start AS spanStart, span_end AS spanEnd, masked_match AS maskedMatch,
+            action_taken AS actionTaken, confidence, finding_key AS findingKey,
+            first_detected_at AS firstDetectedAt
+     FROM findings WHERE rowid > ? ORDER BY rowid LIMIT ?`
+  );
+  const definitionStmt = db.prepare(
+    `INSERT OR IGNORE INTO inspection_definitions
+       (id, rule_id, name, category, severity, definition, version)
+     VALUES (:id, :ruleId, :name, :category, :severity, :definition, :version)`
+  );
+  const findingStmt = db.prepare(
+    `INSERT INTO inspection_findings
+       (id, audit_event_id, inspection_definition_id, classified_data_id,
+        span_start, span_end, masked_match, action_taken, confidence,
+        finding_key, first_detected_at)
+     VALUES
+       (:id, :auditEventId, :inspectionDefinitionId, NULL,
+        :spanStart, :spanEnd, :maskedMatch, :actionTaken, :confidence,
+        :findingKey, :firstDetectedAt)
+     ON CONFLICT(id) DO NOTHING
+     ON CONFLICT (finding_key) DO UPDATE SET
+       first_detected_at = CASE
+         WHEN first_detected_at IS NULL THEN excluded.first_detected_at
+         WHEN excluded.first_detected_at IS NULL THEN first_detected_at
+         ELSE min(first_detected_at, excluded.first_detected_at)
+       END`
+  );
+  return drainLegacyTable(
+    db,
+    "findings",
+    selectStmt,
+    (rows) => {
+      const definitionIds = /* @__PURE__ */ new Map();
+      for (const row of rows) {
+        const tupleKey = JSON.stringify([row.ruleId, row.category, row.severity]);
+        let definitionId = definitionIds.get(tupleKey);
+        if (definitionId === void 0) {
+          const version2 = `unmigrated/${row.category}/${row.severity}`;
+          definitionId = inspectionDefinitionId(row.ruleId, version2);
+          definitionStmt.run(
+            bindParams({
+              id: definitionId,
+              ruleId: row.ruleId,
+              name: row.ruleId,
+              category: row.category,
+              severity: row.severity,
+              definition: "",
+              version: version2
+            })
+          );
+          definitionIds.set(tupleKey, definitionId);
+        }
+        findingStmt.run(
+          bindParams({
+            id: row.id,
+            auditEventId: row.eventId,
+            inspectionDefinitionId: definitionId,
+            spanStart: row.spanStart,
+            spanEnd: row.spanEnd,
+            maskedMatch: row.maskedMatch,
+            actionTaken: row.actionTaken,
+            confidence: row.confidence,
+            findingKey: row.findingKey,
+            firstDetectedAt: row.firstDetectedAt
+          })
+        );
+      }
+    }
+  );
+}
+function runLegacyHistoryBackfill(db) {
+  try {
+    const eventsCaughtUp = copyLegacyEvents(db);
+    if (!eventsCaughtUp) return false;
+    return copyLegacyFindings(db);
   } catch (error51) {
-    akaWarn(`source_project id reconcile failed: ${String(error51)}`);
+    akaWarn(`legacy history backfill failed: ${String(error51)}`);
+    return false;
   }
 }
 function isForeignSqliteLineage(db) {
@@ -18039,6 +18552,7 @@ function isForeignSqliteLineage(db) {
   return columnNames(db, "events").includes("tenant_id");
 }
 function ensureSyncedAtColumn(db, table) {
+  if (!schemaObjectExists(db, "table", table)) return;
   if (!columnNames(db, table).includes("synced_at")) {
     db.exec(`ALTER TABLE ${table} ADD COLUMN synced_at integer`);
   }
@@ -18059,6 +18573,7 @@ function ensureWriteGateTrigger(db) {
 	CONSTRAINT "ck_pack_write_gate_single_row" CHECK("_pack_write_gate"."id" = 1)
 )`);
   db.exec("INSERT OR IGNORE INTO _pack_write_gate (id, open) VALUES (1, 0)");
+  if (!schemaObjectExists(db, "table", "installed_packs")) return;
   db.exec(`CREATE TRIGGER IF NOT EXISTS trg_installed_packs_write_gate
 BEFORE UPDATE OF version, name, rules_json ON installed_packs
 WHEN (SELECT open FROM _pack_write_gate WHERE id = 1) IS NOT 1
@@ -18077,29 +18592,13 @@ function ensureBlockedDetectionsTable(db) {
     blocked_at INTEGER NOT NULL
   )`);
 }
-
-// ../../packages/persistence/src/paths.ts
-import { chmodSync, mkdirSync } from "fs";
-var DATA_DIR_MODE = 448;
-var DATA_FILE_MODE = 384;
-var DB_FILENAME = "aka.db";
-function ensureDataDirSync(dir) {
-  mkdirSync(dir, { recursive: true, mode: DATA_DIR_MODE });
-  try {
-    chmodSync(dir, DATA_DIR_MODE);
-  } catch {
-  }
-}
-function walSidecars(file2) {
-  return [`${file2}-wal`, `${file2}-shm`];
-}
-function tightenPerms(file2) {
-  for (const path of [file2, ...walSidecars(file2)]) {
-    try {
-      chmodSync(path, DATA_FILE_MODE);
-    } catch {
-    }
-  }
+function ensureRuleProbeCacheTable(db) {
+  db.exec(`CREATE TABLE IF NOT EXISTS rule_probe_cache (
+    rule_key TEXT PRIMARY KEY,
+    verdict TEXT NOT NULL,
+    worst_probe_ms REAL NOT NULL,
+    checked_at INTEGER NOT NULL
+  )`);
 }
 
 // ../../packages/persistence/src/internal/json.ts
@@ -18121,51 +18620,6 @@ function parseJsonObject(s) {
   return void 0;
 }
 
-// ../../packages/persistence/src/internal/rows.ts
-function allRows(stmt, params) {
-  if (params === void 0) return stmt.all();
-  if (Array.isArray(params)) return stmt.all(...params);
-  return stmt.all(params);
-}
-function getRow(stmt, params) {
-  if (params === void 0) return stmt.get();
-  if (Array.isArray(params)) return stmt.get(...params);
-  return stmt.get(params);
-}
-function intToBool(raw) {
-  return raw === 1 || raw === true;
-}
-function boolToInt(b) {
-  return b ? 1 : 0;
-}
-function bindParams(row) {
-  const out = {};
-  for (const [key, value] of Object.entries(row)) {
-    out[key] = value === void 0 ? null : value;
-  }
-  return out;
-}
-function countScalar(db, sql, params) {
-  return getRow(db.prepare(sql), params)?.n ?? 0;
-}
-function countBy(db, sql, params) {
-  const map2 = /* @__PURE__ */ new Map();
-  for (const row of allRows(db.prepare(sql), params)) {
-    map2.set(row.k, row.n);
-  }
-  return map2;
-}
-function mapRowsTolerant(rows, map2) {
-  const out = [];
-  for (const row of rows) {
-    try {
-      out.push(map2(row));
-    } catch {
-    }
-  }
-  return out;
-}
-
 // ../../packages/persistence/src/repositories/activity.ts
 var DAY_MS = 864e5;
 var LIVE_ACTIVITY_WINDOW_MS = 30 * 6e4;
@@ -18782,6 +19236,21 @@ var SqliteAuditEventsRepository = class {
       })
     );
   }
+  // Idempotent stub of a session's structural root. Session-scoped leaves
+  // (captures, llm_call, tool_call) FK parent_id/root_session_id onto this row;
+  // INSERT OR IGNORE does NOT suppress a foreign-key violation (only
+  // UNIQUE/PK/NOT NULL/CHECK), so a session-scoped insert with no root row
+  // raises SQLITE_CONSTRAINT and rolls its whole transaction back — silently
+  // dropping the write under failOpenTransaction. SessionStart's own root write
+  // is itself fail-open and marks "attempted", not "succeeded", so a session
+  // with no root row yet is a real, permanent condition, not a transient race.
+  // The stub carries no dimensions/attributes; an authoritative root
+  // (SessionStart / the reconciler's buildSessionRoot) wins by first-write-wins
+  // on the id PK, so the stub never shadows real data. This is the single named
+  // home for that FK invariant — call it before writing any session-scoped row.
+  ensureSessionRoot(sessionId, startedAt) {
+    this.insertAuditEvent({ id: sessionId, eventType: "session", startedAt });
+  }
   // Insert one transcript-derived `llm_call` leaf. Unlike `insertAuditEvent`
   // (which takes a caller-supplied random id), the id here is MINTED internally
   // from the natural key — `llmCallId(sessionId, messageId)` — tenant-free like the
@@ -19243,8 +19712,14 @@ var SqliteDetectionsRepository = class {
       )
     );
   }
-  // Findings whose parent event occurred in the last 30 days and whose rule_id is
-  // in the given set. Mirrors the security repo's findings⋈events window join.
+  // Findings whose parent audit event occurred in the last 30 days, is one of
+  // the four capture kinds, and whose definition's rule_id is in the given set.
+  // Mirrors the security repo's inspection_findings⋈audit_events window join.
+  // rule_id lives on inspection_definitions, not the finding row, so the join
+  // chains through it. audit_events also holds structural rows (session, run,
+  // tool_call, llm_call, source_lookup, config_scan) that never had a legacy
+  // events counterpart, so the event_type predicate keeps this count identical
+  // to the old findings⋈events one.
   countFindingsLast30d(ruleIds) {
     if (ruleIds.length === 0) return 0;
     const since = this.now() - 30 * DAY_MS2;
@@ -19252,8 +19727,12 @@ var SqliteDetectionsRepository = class {
     return countScalar(
       this.db,
       `SELECT count(*) AS n
-         FROM findings f JOIN events e ON e.id = f.event_id
-         WHERE e.occurred_at >= ? AND f.rule_id IN (${inClause})`,
+         FROM inspection_findings f
+         JOIN audit_events e ON e.id = f.audit_event_id
+         JOIN inspection_definitions d ON d.id = f.inspection_definition_id
+         WHERE e.started_at >= ?
+           AND e.event_type IN (${CAPTURE_EVENT_TYPES_SQL})
+           AND d.rule_id IN (${inClause})`,
       [since, ...ruleIds]
     );
   }
@@ -19263,35 +19742,24 @@ var SqliteDetectionsRepository = class {
 var SqliteEventsRepository = class {
   constructor(db) {
     this.db = db;
-    this.insertStmt = db.prepare(
-      `INSERT INTO events (id, source_tool, kind, occurred_at, content_hash, content, metadata)
-       VALUES (:id, :sourceTool, :kind, :occurredAt, :contentHash, :content, :metadata)`
-    );
   }
   db;
-  insertStmt;
-  insertEvent(event) {
-    const row = toEventRow(event);
-    this.insertStmt.run(
-      bindParams({
-        id: row.id,
-        sourceTool: row.sourceTool,
-        kind: row.kind,
-        occurredAt: row.occurredAt,
-        contentHash: row.contentHash,
-        content: row.content,
-        metadata: row.metadata
-      })
-    );
-  }
-  // Every recorded event's content hash — the historical backfill loads this once
-  // to skip transcript messages it has already stored, so re-running the scan
-  // never duplicates findings.
+  // Every recorded capture's content hash — the historical backfill loads this
+  // once to skip transcript messages it has already stored, so re-running the
+  // scan never duplicates findings.
   // Async (Promise.resolve over synchronous node:sqlite) so it satisfies the
   // async EventsReadPort contract.
+  //
+  // audit_events also holds structural rows (session, run, tool_call, llm_call,
+  // source_lookup, config_scan) with a NULL content_hash, so the capture-kind
+  // predicate isn't load-bearing here — it documents intent and keeps the scan
+  // index-friendly rather than walking rows that can never match.
   contentHashes() {
     const rows = allRows(
-      this.db.prepare("SELECT content_hash FROM events")
+      this.db.prepare(
+        `SELECT content_hash FROM audit_events
+         WHERE event_type IN (${CAPTURE_EVENT_TYPES_SQL})`
+      )
     );
     return Promise.resolve(new Set(rows.map((r) => r.content_hash)));
   }
@@ -19627,17 +20095,20 @@ function parseExceptionRow(row) {
 }
 
 // ../../packages/persistence/src/repositories/resolution-sql.ts
-function latestResolutionStatusSql(findingsAlias) {
+function latestResolutionColumnSql(column, findingsAlias) {
   return `(
-    SELECT fr.status FROM finding_resolution fr
+    SELECT fr.${column} FROM finding_resolution fr
      WHERE fr.finding_key = ${findingsAlias}.finding_key
      ORDER BY fr.created_at DESC, fr.rowid DESC
      LIMIT 1
   )`;
 }
+function latestResolutionStatusSql(findingsAlias) {
+  return latestResolutionColumnSql("status", findingsAlias);
+}
 var LATEST_RESOLUTION_BY_KEY_SQL = `(
-  SELECT finding_key, status FROM (
-    SELECT fr.finding_key, fr.status,
+  SELECT finding_key, status, method, resolved_at FROM (
+    SELECT fr.finding_key, fr.status, fr.method, fr.resolved_at,
            ROW_NUMBER() OVER (
              PARTITION BY fr.finding_key
              ORDER BY fr.created_at DESC, fr.rowid DESC
@@ -19664,68 +20135,21 @@ var DAY_MS3 = 864e5;
 var SqliteFindingsRepository = class {
   constructor(db) {
     this.db = db;
-    this.insertStmt = db.prepare(
-      `INSERT INTO findings (id, event_id, rule_id, category, severity, span_start, span_end, masked_match, action_taken, confidence, finding_key, first_detected_at)
-       VALUES (:id, :eventId, :ruleId, :category, :severity, :spanStart, :spanEnd, :maskedMatch, :actionTaken, :confidence, :findingKey,
-               (SELECT occurred_at FROM events WHERE id = :eventId))
-       ON CONFLICT (finding_key) DO UPDATE SET
-         event_id = excluded.event_id,
-         category = excluded.category,
-         severity = excluded.severity,
-         span_start = excluded.span_start,
-         span_end = excluded.span_end,
-         masked_match = excluded.masked_match,
-         action_taken = excluded.action_taken,
-         confidence = excluded.confidence`
-    );
-    this.sessionDupStmt = db.prepare(
-      `SELECT 1 FROM findings f JOIN events e ON e.id = f.event_id
-       WHERE f.rule_id = :ruleId AND f.masked_match = :maskedMatch
-         AND json_extract(e.metadata, '$.sessionId') = :sessionId
-       LIMIT 1`
-    );
   }
   db;
-  insertStmt;
-  sessionDupStmt;
-  insertFindings(findings, scope = {}) {
-    for (const finding of findings) {
-      if (scope.sessionId && this.isSessionDuplicate(finding, scope.sessionId)) continue;
-      const row = toFindingRow(finding);
-      this.insertStmt.run({
-        id: row.id,
-        eventId: row.eventId,
-        ruleId: row.ruleId,
-        category: row.category,
-        severity: row.severity,
-        spanStart: row.spanStart,
-        spanEnd: row.spanEnd,
-        maskedMatch: row.maskedMatch,
-        actionTaken: row.actionTaken,
-        confidence: row.confidence,
-        findingKey: row.findingKey ?? null
-      });
-    }
-  }
-  // True when an earlier event in the same session already recorded a finding
-  // with the same rule and masked value. The current event is inserted before
-  // its findings, but carries no findings yet, so this never self-matches.
-  isSessionDuplicate(finding, sessionId) {
-    const hit = this.sessionDupStmt.get({
-      ruleId: finding.ruleId,
-      maskedMatch: finding.maskedMatch,
-      sessionId
-    });
-    return hit !== void 0;
-  }
   recentFindings(opts) {
     const limit = opts?.limit ?? 50;
     const rows = allRows(
       this.db.prepare(
-        `SELECT f.id, f.event_id, f.rule_id, f.category, f.severity, f.masked_match,
-                f.action_taken, f.confidence, e.occurred_at, e.source_tool, e.kind
-         FROM findings f JOIN events e ON e.id = f.event_id
-         ORDER BY e.occurred_at DESC, f.rowid DESC
+        `SELECT f.id, f.audit_event_id AS event_id, d.rule_id, d.category, d.severity,
+                f.masked_match, f.action_taken, f.confidence, e.started_at AS occurred_at,
+                json_extract(e.attributes, '$.source_tool') AS source_tool,
+                e.event_type AS kind
+         FROM inspection_findings f
+         JOIN audit_events e ON e.id = f.audit_event_id
+         JOIN inspection_definitions d ON d.id = f.inspection_definition_id
+         WHERE e.event_type IN (${CAPTURE_EVENT_TYPES_SQL})
+         ORDER BY e.started_at DESC, f.rowid DESC
          LIMIT :limit`
       ),
       { limit }
@@ -19747,25 +20171,34 @@ var SqliteFindingsRepository = class {
     );
   }
   /** Live-enforced findings recorded for one session — a bare COUNT over the
-   * session-stamped events (served by idx_events_session_id), so the Activity
+   * session-stamped audit_events (served by idx_audit_session), so the Activity
    * page can label its findings link without the grouped pipeline. */
   sessionFindingsCount(sessionId) {
     if (!sessionId) return Promise.resolve(0);
     return Promise.resolve(
       countScalar(
         this.db,
-        `SELECT count(*) AS n FROM findings f
-           JOIN events e ON e.id = f.event_id
-          WHERE json_extract(e.metadata, '$.sessionId') = :sessionId`,
+        `SELECT count(*) AS n FROM inspection_findings f
+           JOIN audit_events e ON e.id = f.audit_event_id
+          WHERE e.root_session_id = :sessionId
+            AND e.event_type IN (${CAPTURE_EVENT_TYPES_SQL})`,
         { sessionId }
       )
     );
   }
-  /** Per-rule transcript firing tally for one session — reads the OTHER finding
-   * store (inspection_findings, keyed to audit_events): every detection the
-   * transcript pass recorded, counted per firing rather than per unique value.
-   * Rides on session-scoped grouped responses so the findings view can
-   * reconcile the Activity page's tally with the deduped groups it lists. */
+  /** Per-rule transcript firing tally for one session — every detection the
+   * transcript-reconciler pass recorded against the session's `tool_call` rows,
+   * counted per firing rather than per unique value. Rides on session-scoped
+   * grouped responses so the findings view can reconcile the Activity page's
+   * tally with the deduped groups it lists.
+   *
+   * `inspection_findings`/`audit_events` are now the SAME physical tables the
+   * rest of this class reads for the live-capture list above (they used to be
+   * a separate store), so this excludes the four capture kinds those rows
+   * already carry — without that exclusion, every live-capture finding in the
+   * session would be tallied here too, double-counting against the grouped
+   * list this response rides alongside. The reconciler attaches its findings
+   * only to `tool_call` rows, which the exclusion leaves untouched. */
   sessionFirings(sessionId) {
     return Object.fromEntries(
       countBy(
@@ -19775,18 +20208,25 @@ var SqliteFindingsRepository = class {
            JOIN audit_events e ON e.id = f.audit_event_id
            JOIN inspection_definitions d ON d.id = f.inspection_definition_id
           WHERE e.root_session_id = :sessionId
+            AND e.event_type NOT IN (${CAPTURE_EVENT_TYPES_SQL})
           GROUP BY d.rule_id`,
         { sessionId }
       )
     );
   }
   /**
-   * Grouped findings for the dashboard — joins findings⋈events (repo/file/
-   * toolName from event metadata), groups by ruleId, computes per-filter-excluded facets,
-   * applies the requested filters, and sorts by severity then recency. Filtering
+   * Grouped findings for the dashboard — joins inspection_findings⋈audit_events
+   * ⋈inspection_definitions (repo/file/toolName from the audit event's
+   * attributes bag, rule_id/category/severity from the definition), scoped to
+   * the four capture kinds (audit_events also holds structural/reconciler/scan
+   * rows this list must never surface), groups by ruleId, computes
+   * per-filter-excluded facets, applies the requested filters, and sorts by
+   * severity then recency. Filtering
    * and faceting run in JS via the shared @akasecurity/schema helpers. `totals`
    * reflect the full filtered set; `items` is the requested
-   * page (default 50); no cursor (nextCursor is always null).
+   * page (default 50); no cursor (nextCursor is always null). Under a `status`
+   * filter, `totals.findings` counts only instances whose derived status was
+   * requested, and each item's instance preview is narrowed the same way.
    *
    * Two reads, neither of which materializes a row per finding:
    *   1. one aggregate row per rule_id, folding EVERY instance into the numbers
@@ -19799,10 +20239,11 @@ var SqliteFindingsRepository = class {
    * rule is ever restated in SQL.
    */
   listGroupedFindings(query) {
-    const sessionPredicate = query.sessionId ? `WHERE json_extract(e.metadata, '$.sessionId') = :sessionId` : "";
+    const sessionPredicate = query.sessionId ? ` AND e.root_session_id = :sessionId` : "";
+    const predicate = `WHERE e.event_type IN (${CAPTURE_EVENT_TYPES_SQL})${sessionPredicate}`;
     const sessionParams = query.sessionId ? { sessionId: query.sessionId } : {};
     const aggregates = this.groupAggregates(query.q !== void 0 && query.q !== "", {
-      predicate: sessionPredicate,
+      predicate,
       params: sessionParams
     });
     const rows = allRows(
@@ -19810,24 +20251,26 @@ var SqliteFindingsRepository = class {
         `SELECT id, rule_id, category, severity, masked_match, action_taken, confidence,
                 occurred_at, source_tool, repo, file, tool_name, kind, finding_key, latest_status
          FROM (
-           SELECT f.id AS id, f.rule_id AS rule_id, f.category AS category,
-                  f.severity AS severity, f.masked_match AS masked_match,
+           SELECT f.id AS id, d.rule_id AS rule_id, d.category AS category,
+                  d.severity AS severity, f.masked_match AS masked_match,
                   f.action_taken AS action_taken, f.confidence AS confidence,
-                  e.occurred_at AS occurred_at, e.source_tool AS source_tool,
-                  json_extract(e.metadata, '$.repo') AS repo,
-                  json_extract(e.metadata, '$.filePath') AS file,
-                  json_extract(e.metadata, '$.toolName') AS tool_name,
-                  e.kind AS kind, f.finding_key AS finding_key,
+                  e.started_at AS occurred_at,
+                  json_extract(e.attributes, '$.source_tool') AS source_tool,
+                  json_extract(e.attributes, '$.repo') AS repo,
+                  json_extract(e.attributes, '$.file_path') AS file,
+                  json_extract(e.attributes, '$.tool_name') AS tool_name,
+                  e.event_type AS kind, f.finding_key AS finding_key,
                   latest.status AS latest_status,
                   ROW_NUMBER() OVER (
-                    PARTITION BY f.rule_id
-                    ORDER BY e.occurred_at DESC, f.id DESC
+                    PARTITION BY d.rule_id
+                    ORDER BY e.started_at DESC, f.id DESC
                   ) AS rn
-             FROM findings f
-             JOIN events e ON e.id = f.event_id
+             FROM inspection_findings f
+             JOIN audit_events e ON e.id = f.audit_event_id
+             JOIN inspection_definitions d ON d.id = f.inspection_definition_id
              LEFT JOIN ${LATEST_RESOLUTION_BY_KEY_SQL} latest
                ON latest.finding_key = f.finding_key
-             ${sessionPredicate}
+             ${predicate}
          )
          WHERE rn <= :cap
          ORDER BY occurred_at DESC, id DESC`
@@ -19854,17 +20297,29 @@ var SqliteFindingsRepository = class {
       severity: query.severity,
       providers: query.provider,
       actions: query.action,
+      statuses: query.status,
       subtype: query.subtype,
       q: query.q
     };
     const facets = computeFindingFacets(allGroups, filterOpts);
     const sorted = sortFindingGroups(applyFindingFilters(allGroups, filterOpts));
+    const statusFilter = query.status ?? [];
     const totals = {
-      findings: sorted.reduce((acc, g) => acc + g.instanceCount, 0),
+      findings: sorted.reduce((acc, g) => {
+        if (statusFilter.length === 0) return acc + g.instanceCount;
+        const agg = aggregates.get(g.id);
+        return acc + (agg ? countInstancesByStatus(agg.statusInputs, statusFilter) ?? g.instanceCount : g.instanceCount);
+      }, 0),
       groups: sorted.length
     };
     const limit = query.limit ?? DEFAULT_GROUPED_FINDINGS_LIMIT;
-    const items = sorted.slice(0, limit);
+    const statusSet = statusFilter.length > 0 ? new Set(statusFilter) : null;
+    const items = sorted.slice(0, limit).map(
+      (g) => statusSet ? {
+        ...g,
+        instances: g.instances.filter((i) => i.status !== void 0 && statusSet.has(i.status))
+      } : g
+    );
     return Promise.resolve({
       totals,
       facets,
@@ -19878,45 +20333,62 @@ var SqliteFindingsRepository = class {
    * buildFindingGroups cannot recover from a preview. Bounded by the number of
    * distinct rule_ids (the installed packs' rules), not by the store's size.
    *
-   * The per-instance sets ride back as group_concat lists of RAW DB values —
-   * source_tool, action_taken, and the (kind, has-key, latest-status) triples
-   * deriveFindingStatus consumes. Aggregating the status INPUTS rather than a
-   * status keeps the classifier itself in @akasecurity/schema, where
-   * severitySummary's SQL and this query can't drift apart on what 'resolved'
-   * means (see resolution-sql.ts). Each of those sets is bounded by an enum, so
+   * A single scan, folded in two levels: the inner SELECT groups by
+   * (rule_id, status tuple) so each (kind, has-key, latest-status) combination
+   * carries its instance count — countInstancesByStatus needs those counts for
+   * status-scoped totals — and the outer SELECT folds the tuples back to one
+   * row per rule. The per-instance sets ride back as group_concat lists of RAW
+   * DB values — source_tool, action_taken, and the tuples deriveFindingStatus
+   * consumes. Aggregating the status INPUTS rather than a status keeps the
+   * classifier itself in @akasecurity/schema, where severitySummary's SQL and
+   * this query can't drift apart on what 'resolved' means (see
+   * resolution-sql.ts). The concat-of-concats can repeat a value across
+   * tuples; the schema mappers dedupe, and each set is bounded by an enum, so
    * a group's row stays small however many findings it holds.
    *
    * `withSearchText` is the exception, and the one column here that does NOT
-   * stay small: the group's distinct repos/filePaths, whose size tracks how many
-   * distinct paths a rule fired across — for a rule hitting mostly-unique paths
-   * that is a string proportional to the store (~8MB over 200k distinct paths,
-   * and buildHaystack lowercases a second copy). It buys `q` the ability to
-   * match an instance outside the preview, which searching the preview alone
-   * would silently lose, so it is fetched only when the request actually
-   * carries a `q`.
+   * stay small: the group's per-tuple-distinct repos/filePaths, whose size
+   * tracks how many distinct paths a rule fired across — for a rule hitting
+   * mostly-unique paths that is a string proportional to the store (~8MB over
+   * 200k distinct paths, and buildHaystack lowercases a second copy). It buys
+   * `q` the ability to match an instance outside the preview, which searching
+   * the preview alone would silently lose, so it is fetched only when the
+   * request actually carries a `q`. (Substring matching is unaffected by a
+   * path repeating across tuples.)
    */
   groupAggregates(withSearchText, scope) {
-    const searchTextColumns = withSearchText ? `, group_concat(DISTINCT json_extract(e.metadata, '$.repo')) AS repos,
-           group_concat(DISTINCT json_extract(e.metadata, '$.filePath')) AS files,
-           group_concat(DISTINCT 'via ' || json_extract(e.metadata, '$.toolName')) AS tool_names` : `, NULL AS repos, NULL AS files, NULL AS tool_names`;
+    const innerSearchColumns = withSearchText ? `, group_concat(DISTINCT json_extract(e.attributes, '$.repo')) AS repos,
+           group_concat(DISTINCT json_extract(e.attributes, '$.file_path')) AS files,
+           group_concat(DISTINCT 'via ' || json_extract(e.attributes, '$.tool_name')) AS tool_names` : `, NULL AS repos, NULL AS files, NULL AS tool_names`;
     const rows = this.db.prepare(
-      `SELECT f.rule_id AS rule_id,
-                count(*) AS instance_count,
-                max(e.occurred_at) AS latest_at,
-                group_concat(DISTINCT e.source_tool) AS source_tools,
-                group_concat(DISTINCT f.action_taken) AS actions_taken,
-                group_concat(DISTINCT (
-                  e.kind || '${TUPLE_SEP}' ||
-                  (CASE WHEN f.finding_key IS NULL THEN '' ELSE 'k' END) || '${TUPLE_SEP}' ||
-                  coalesce(latest.status, '')
-                )) AS status_inputs
-                ${searchTextColumns}
-           FROM findings f
-           JOIN events e ON e.id = f.event_id
-           LEFT JOIN ${LATEST_RESOLUTION_BY_KEY_SQL} latest
-             ON latest.finding_key = f.finding_key
-          ${scope.predicate}
-          GROUP BY f.rule_id`
+      `SELECT rule_id,
+                sum(tuple_count) AS instance_count,
+                max(latest_at) AS latest_at,
+                group_concat(source_tools) AS source_tools,
+                group_concat(actions_taken) AS actions_taken,
+                group_concat(status_tuple || '${TUPLE_SEP}' || tuple_count) AS status_inputs,
+                group_concat(repos) AS repos,
+                group_concat(files) AS files,
+                group_concat(tool_names) AS tool_names
+           FROM (
+             SELECT d.rule_id AS rule_id,
+                    e.event_type || '${TUPLE_SEP}' ||
+                      (CASE WHEN f.finding_key IS NULL THEN '' ELSE 'k' END) || '${TUPLE_SEP}' ||
+                      coalesce(latest.status, '') AS status_tuple,
+                    count(*) AS tuple_count,
+                    max(e.started_at) AS latest_at,
+                    group_concat(DISTINCT json_extract(e.attributes, '$.source_tool')) AS source_tools,
+                    group_concat(DISTINCT f.action_taken) AS actions_taken
+                    ${innerSearchColumns}
+               FROM inspection_findings f
+               JOIN audit_events e ON e.id = f.audit_event_id
+               JOIN inspection_definitions d ON d.id = f.inspection_definition_id
+               LEFT JOIN ${LATEST_RESOLUTION_BY_KEY_SQL} latest
+                 ON latest.finding_key = f.finding_key
+              ${scope.predicate}
+              GROUP BY d.rule_id, status_tuple
+           )
+          GROUP BY rule_id`
     ).all(scope.params);
     return new Map(
       rows.map((r) => [
@@ -19926,13 +20398,14 @@ var SqliteFindingsRepository = class {
           sourceTools: splitConcat(r.source_tools),
           actionsTaken: splitConcat(r.actions_taken),
           statusInputs: splitConcat(r.status_inputs).map((tuple2) => {
-            const [kind = "", keyMarker = "", latestStatus = ""] = tuple2.split(TUPLE_SEP);
+            const [kind = "", keyMarker = "", latestStatus = "", count = ""] = tuple2.split(TUPLE_SEP);
             return {
               // deriveFindingStatus only distinguishes null from non-null here,
               // so the marker stands in for the key itself (never rendered).
               kind,
               findingKey: keyMarker === "" ? null : keyMarker,
-              latestResolutionStatus: latestStatus === "" ? null : latestStatus
+              latestResolutionStatus: latestStatus === "" ? null : latestStatus,
+              count: Number(count)
             };
           }),
           latestDetectedAt: epochMillisToIso(r.latest_at),
@@ -19949,10 +20422,21 @@ var SqliteFindingsRepository = class {
     );
   }
   healthSummary() {
-    const total = countScalar(this.db, "SELECT count(*) AS n FROM findings");
+    const total = countScalar(
+      this.db,
+      `SELECT count(*) AS n FROM inspection_findings f
+         JOIN audit_events e ON e.id = f.audit_event_id
+        WHERE e.event_type IN (${CAPTURE_EVENT_TYPES_SQL})`
+    );
     const byAction = Object.fromEntries(ACTION_TAKEN_KEYS.map((a) => [a, 0]));
     const grouped = allRows(
-      this.db.prepare("SELECT action_taken, count(*) AS c FROM findings GROUP BY action_taken")
+      this.db.prepare(
+        `SELECT f.action_taken AS action_taken, count(*) AS c
+           FROM inspection_findings f
+           JOIN audit_events e ON e.id = f.audit_event_id
+          WHERE e.event_type IN (${CAPTURE_EVENT_TYPES_SQL})
+          GROUP BY f.action_taken`
+      )
     );
     for (const row of grouped) {
       if (row.action_taken in byAction) byAction[row.action_taken] = row.c;
@@ -19960,12 +20444,15 @@ var SqliteFindingsRepository = class {
     const bySeverity = { critical: 0, high: 0, medium: 0, low: 0 };
     const sevRows = allRows(
       this.db.prepare(
-        `SELECT f.severity AS severity, count(*) AS c
-         FROM findings f
+        `SELECT d.severity AS severity, count(*) AS c
+         FROM inspection_findings f
+         JOIN audit_events e ON e.id = f.audit_event_id
+         JOIN inspection_definitions d ON d.id = f.inspection_definition_id
          LEFT JOIN ${LATEST_RESOLUTION_BY_KEY_SQL} latest
            ON latest.finding_key = f.finding_key
-         WHERE latest.status IS NULL OR latest.status != 'resolved'
-         GROUP BY f.severity`
+         WHERE e.event_type IN (${CAPTURE_EVENT_TYPES_SQL})
+           AND (latest.status IS NULL OR latest.status != 'resolved')
+         GROUP BY d.severity`
       )
     );
     for (const row of sevRows) {
@@ -19986,9 +20473,11 @@ var SqliteFindingsRepository = class {
     const since = startOfUtcDay(Date.now()) - (days - 1) * DAY_MS3;
     const rows = allRows(
       this.db.prepare(
-        `SELECT date(e.occurred_at / 1000, 'unixepoch') AS day, f.action_taken AS action, count(*) AS c
-         FROM findings f JOIN events e ON e.id = f.event_id
-         WHERE e.occurred_at >= :since
+        `SELECT date(e.started_at / 1000, 'unixepoch') AS day, f.action_taken AS action, count(*) AS c
+         FROM inspection_findings f
+         JOIN audit_events e ON e.id = f.audit_event_id
+         WHERE e.started_at >= :since
+           AND e.event_type IN (${CAPTURE_EVENT_TYPES_SQL})
          GROUP BY day, f.action_taken`
       ),
       { since }
@@ -20053,15 +20542,59 @@ var SqliteInspectionFindingsRepository = class {
     this.insertStmt = db.prepare(
       `INSERT INTO inspection_findings
          (id, audit_event_id, inspection_definition_id, classified_data_id,
-          span_start, span_end, masked_match, action_taken, confidence)
+          span_start, span_end, masked_match, action_taken, confidence,
+          finding_key, first_detected_at)
        VALUES
          (:id, :auditEventId, :inspectionDefinitionId, :classifiedDataId,
-          :spanStart, :spanEnd, :maskedMatch, :actionTaken, :confidence)
-       ON CONFLICT(id) DO NOTHING`
+          :spanStart, :spanEnd, :maskedMatch, :actionTaken, :confidence,
+          :findingKey,
+          COALESCE(:firstDetectedAt, (SELECT started_at FROM audit_events WHERE id = :auditEventId)))
+       ON CONFLICT(id) DO UPDATE SET
+         inspection_definition_id = excluded.inspection_definition_id
+       ON CONFLICT (finding_key) DO UPDATE SET
+         audit_event_id = excluded.audit_event_id,
+         inspection_definition_id = excluded.inspection_definition_id,
+         classified_data_id = excluded.classified_data_id,
+         span_start = excluded.span_start,
+         span_end = excluded.span_end,
+         masked_match = excluded.masked_match,
+         action_taken = excluded.action_taken,
+         confidence = excluded.confidence`
+    );
+    this.sessionDupStmt = db.prepare(
+      `SELECT 1 FROM inspection_findings f
+         JOIN audit_events e ON e.id = f.audit_event_id
+         JOIN inspection_definitions d ON d.id = f.inspection_definition_id
+        WHERE d.rule_id = :ruleId AND f.masked_match = :maskedMatch
+          AND e.root_session_id = :sessionId
+          AND e.event_type IN (${CAPTURE_EVENT_TYPES_SQL})
+        LIMIT 1`
+    );
+    this.eventDupStmt = db.prepare(
+      `SELECT 1 FROM inspection_findings f
+         JOIN inspection_definitions d ON d.id = f.inspection_definition_id
+        WHERE f.audit_event_id = :auditEventId AND d.rule_id = :ruleId
+          AND f.masked_match = :maskedMatch
+          AND f.span_start = :spanStart AND f.span_end = :spanEnd
+        LIMIT 1`
     );
   }
   db;
   insertStmt;
+  sessionDupStmt;
+  eventDupStmt;
+  // True when an earlier event in the same session already recorded a finding
+  // with the same rule and masked value. The current event's own findings are
+  // inserted one at a time in caller order, so an earlier finding in the SAME
+  // recordCapture call is visible to a later duplicate check within it too.
+  isSessionDuplicate(ruleId, maskedMatch, sessionId) {
+    return this.sessionDupStmt.get({ ruleId, maskedMatch, sessionId }) !== void 0;
+  }
+  // True when this exact detection (rule + masked value + span) is already
+  // recorded against the given audit event.
+  isEventDuplicate(auditEventId, ruleId, maskedMatch, spanStart, spanEnd) {
+    return this.eventDupStmt.get({ auditEventId, ruleId, maskedMatch, spanStart, spanEnd }) !== void 0;
+  }
   insertFinding(input) {
     const row = toInspectionFindingRow(input);
     this.insertStmt.run(
@@ -20074,7 +20607,9 @@ var SqliteInspectionFindingsRepository = class {
         spanEnd: row.spanEnd,
         maskedMatch: row.maskedMatch,
         actionTaken: row.actionTaken,
-        confidence: row.confidence
+        confidence: row.confidence,
+        findingKey: row.findingKey,
+        firstDetectedAt: row.firstDetectedAt
       })
     );
   }
@@ -20346,7 +20881,7 @@ var SqliteInstalledPacksRepository = class {
   installedRuleset() {
     const rows = allRows(
       this.db.prepare(
-        `SELECT enabled, policy_id AS policyId, rules_json AS rulesJson FROM installed_packs`
+        `SELECT enabled, policy_id AS policyId, rules_json AS rulesJson, version FROM installed_packs`
       )
     );
     const out = {
@@ -20354,7 +20889,8 @@ var SqliteInstalledPacksRepository = class {
       enabledPacks: 0,
       rules: [],
       invalidRules: 0,
-      ruleActions: /* @__PURE__ */ new Map()
+      ruleActions: /* @__PURE__ */ new Map(),
+      ruleVersions: /* @__PURE__ */ new Map()
     };
     for (const row of rows) {
       if (!intToBool(row.enabled)) continue;
@@ -20376,6 +20912,7 @@ var SqliteInstalledPacksRepository = class {
         if (parsed.success) {
           out.rules.push(parsed.data);
           out.ruleActions.set(parsed.data.id, action);
+          out.ruleVersions.set(parsed.data.id, row.version);
         } else out.invalidRules += 1;
       }
     }
@@ -21550,19 +22087,19 @@ var SqliteResolutionsRepository = class {
     );
     this.openAtRestStmt = db.prepare(
       `SELECT DISTINCT f.finding_key AS finding_key
-         FROM findings f
-         JOIN events e ON e.id = f.event_id
-        WHERE e.kind = 'code_change'
-          AND json_extract(e.metadata, '$.filePath') = :path
+         FROM inspection_findings f
+         JOIN audit_events e ON e.id = f.audit_event_id
+        WHERE e.event_type = 'code_change'
+          AND json_extract(e.attributes, '$.file_path') = :path
           AND f.finding_key IS NOT NULL
           AND ${latestResolutionStatusSql("f")} IS NOT 'resolved'`
     );
     this.resolvedAtRestStmt = db.prepare(
       `SELECT DISTINCT f.finding_key AS finding_key
-         FROM findings f
-         JOIN events e ON e.id = f.event_id
-        WHERE e.kind = 'code_change'
-          AND json_extract(e.metadata, '$.filePath') = :path
+         FROM inspection_findings f
+         JOIN audit_events e ON e.id = f.audit_event_id
+        WHERE e.event_type = 'code_change'
+          AND json_extract(e.attributes, '$.file_path') = :path
           AND f.finding_key IS NOT NULL
           AND ${latestResolutionStatusSql("f")} = 'resolved'`
     );
@@ -21630,6 +22167,35 @@ var SqliteResolutionsRepository = class {
   }
 };
 
+// ../../packages/persistence/src/repositories/rule-probe-cache.ts
+var SqliteRuleProbeCacheRepository = class {
+  constructor(db) {
+    this.db = db;
+    this.upsertStmt = db.prepare(
+      `INSERT INTO rule_probe_cache (rule_key, verdict, worst_probe_ms, checked_at)
+       VALUES (:ruleKey, :verdict, :worstProbeMs, :checkedAt)
+       ON CONFLICT (rule_key) DO UPDATE SET
+         verdict = excluded.verdict,
+         worst_probe_ms = excluded.worst_probe_ms,
+         checked_at = excluded.checked_at`
+    );
+    this.readStmt = db.prepare(
+      `SELECT verdict, worst_probe_ms AS worstProbeMs FROM rule_probe_cache WHERE rule_key = :ruleKey`
+    );
+  }
+  db;
+  upsertStmt;
+  readStmt;
+  getVerdict(ruleKey) {
+    return getRow(this.readStmt, { ruleKey });
+  }
+  setVerdict(ruleKey, verdict, worstProbeMs2) {
+    failOpenTransaction(this.db, () => {
+      this.upsertStmt.run({ ruleKey, verdict, worstProbeMs: worstProbeMs2, checkedAt: Date.now() });
+    });
+  }
+};
+
 // ../../packages/persistence/src/repositories/scan-ledger.ts
 var SqliteScanLedgerRepository = class {
   constructor(db) {
@@ -21756,25 +22322,27 @@ var SqliteSecurityRepository = class {
   severitySummary() {
     const rows = allRows(
       this.db.prepare(
-        `SELECT f.severity AS severity,
+        `SELECT d.severity AS severity,
                 COUNT(*) AS count,
                 SUM(CASE
-                      WHEN e.kind != 'code_change' THEN 1
+                      WHEN e.event_type != 'code_change' THEN 1
                       WHEN f.finding_key IS NULL THEN 0
                       WHEN latest.status = 'resolved' THEN 1
                       ELSE 0
                     END) AS caught,
                 SUM(CASE
-                      WHEN e.kind = 'code_change'
+                      WHEN e.event_type = 'code_change'
                        AND f.finding_key IS NOT NULL
                        AND (latest.status IS NULL OR latest.status != 'resolved') THEN 1
                       ELSE 0
                     END) AS open_at_rest
-         FROM findings f
-         JOIN events e ON e.id = f.event_id
+         FROM inspection_findings f
+         JOIN audit_events e ON e.id = f.audit_event_id
+         JOIN inspection_definitions d ON d.id = f.inspection_definition_id
          LEFT JOIN ${LATEST_RESOLUTION_BY_KEY_SQL} latest
            ON latest.finding_key = f.finding_key
-         GROUP BY f.severity`
+         WHERE e.event_type IN (${CAPTURE_EVENT_TYPES_SQL})
+         GROUP BY d.severity`
       )
     );
     const byRow = new Map(rows.map((r) => [r.severity, r]));
@@ -21840,7 +22408,7 @@ var SqliteSecurityRepository = class {
   // Mean time-to-remediate per bucket, split by severity — a sibling of
   // findingsTimeseries that reuses the same window/bucket/UTC math, but buckets
   // on a different timestamp: findingsTimeseries buckets by first-detection
-  // (events.occurred_at), this buckets by resolution time (the latest
+  // (audit_events.started_at), this buckets by resolution time (the latest
   // finding_resolution row's resolved_at) — it's a "resolved in this bucket"
   // trend, not a "detected in this bucket" one. Only findings whose LATEST
   // resolution row (latest-resolution-wins, same correlated subquery as
@@ -21865,30 +22433,20 @@ var SqliteSecurityRepository = class {
         // first_detected_at is the PRESERVED first-detection time (set once on a
         // finding's INSERT, never overwritten on the re-detection upsert), so MTTR
         // measures from first sighting — not the latest re-scan's event, whose
-        // occurred_at the upsert overwrites onto findings.event_id. COALESCE onto
-        // the parent event's occurred_at defends against any legacy/edge row the
-        // backfill left null.
-        `SELECT COALESCE(f.first_detected_at, e.occurred_at) AS first_detected_at, f.severity AS severity,
-                (
-                  SELECT fr.status FROM finding_resolution fr
-                   WHERE fr.finding_key = f.finding_key
-                   ORDER BY fr.created_at DESC, fr.rowid DESC
-                   LIMIT 1
-                ) AS latest_status,
-                (
-                  SELECT fr.method FROM finding_resolution fr
-                   WHERE fr.finding_key = f.finding_key
-                   ORDER BY fr.created_at DESC, fr.rowid DESC
-                   LIMIT 1
-                ) AS latest_method,
-                (
-                  SELECT fr.resolved_at FROM finding_resolution fr
-                   WHERE fr.finding_key = f.finding_key
-                   ORDER BY fr.created_at DESC, fr.rowid DESC
-                   LIMIT 1
-                ) AS latest_resolved_at
-         FROM findings f JOIN events e ON e.id = f.event_id
+        // started_at the upsert overwrites onto inspection_findings.audit_event_id.
+        // COALESCE onto the parent event's started_at defends against any
+        // legacy/edge row the backfill left null.
+        `SELECT COALESCE(f.first_detected_at, e.started_at) AS first_detected_at, d.severity AS severity,
+                latest.status AS latest_status,
+                latest.method AS latest_method,
+                latest.resolved_at AS latest_resolved_at
+         FROM inspection_findings f
+         JOIN audit_events e ON e.id = f.audit_event_id
+         JOIN inspection_definitions d ON d.id = f.inspection_definition_id
+         LEFT JOIN ${LATEST_RESOLUTION_BY_KEY_SQL} latest
+           ON latest.finding_key = f.finding_key
          WHERE f.finding_key IS NOT NULL
+           AND e.event_type IN (${CAPTURE_EVENT_TYPES_SQL})
            AND EXISTS (
              SELECT 1 FROM finding_resolution fr
               WHERE fr.finding_key = f.finding_key
@@ -21935,11 +22493,13 @@ var SqliteSecurityRepository = class {
     const from = now - RANGE_DAYS[range] * DAY_MS4;
     const rows = allRows(
       this.db.prepare(
-        `SELECT json_extract(e.metadata, '$.repo') AS repo, count(*) AS c
-         FROM findings f JOIN events e ON e.id = f.event_id
-         WHERE e.occurred_at >= :from AND e.occurred_at < :to
-           AND json_extract(e.metadata, '$.repo') IS NOT NULL
-           AND json_extract(e.metadata, '$.repo') != ''
+        `SELECT json_extract(e.attributes, '$.repo') AS repo, count(*) AS c
+         FROM inspection_findings f
+         JOIN audit_events e ON e.id = f.audit_event_id
+         WHERE e.started_at >= :from AND e.started_at < :to
+           AND e.event_type IN (${CAPTURE_EVENT_TYPES_SQL})
+           AND json_extract(e.attributes, '$.repo') IS NOT NULL
+           AND json_extract(e.attributes, '$.repo') != ''
          GROUP BY repo
          ORDER BY c DESC, repo
          LIMIT :limit`
@@ -21963,44 +22523,28 @@ var SqliteSecurityRepository = class {
   // secret came back) is excluded — it is not currently resolved. Legacy
   // at-rest findings with finding_key IS NULL are excluded outright (the
   // resolution lifecycle can never attach to them). Path comes from the
-  // finding's parent event (kind 'code_change', metadata.filePath) — mirrors
-  // resolutions.ts's openAtRestStmt accessor. Ordered by resolved_at DESC,
-  // capped at `limit`.
+  // finding's parent event (event_type 'code_change', attributes.file_path) —
+  // mirrors resolutions.ts's openAtRestStmt accessor. Ordered by resolved_at
+  // DESC, capped at `limit`.
   recentlyResolved(limit = 20) {
     const rows = allRows(
       this.db.prepare(
         `SELECT f.finding_key AS finding_key,
-                f.rule_id AS rule_id,
-                f.severity AS severity,
-                json_extract(e.metadata, '$.filePath') AS path,
-                COALESCE(f.first_detected_at, e.occurred_at) AS first_detected_at,
-                (
-                  SELECT fr.resolved_at FROM finding_resolution fr
-                   WHERE fr.finding_key = f.finding_key
-                   ORDER BY fr.created_at DESC, fr.rowid DESC
-                   LIMIT 1
-                ) AS latest_resolved_at
-         FROM findings f JOIN events e ON e.id = f.event_id
-         WHERE e.kind = 'code_change'
+                d.rule_id AS rule_id,
+                d.severity AS severity,
+                json_extract(e.attributes, '$.file_path') AS path,
+                COALESCE(f.first_detected_at, e.started_at) AS first_detected_at,
+                latest.resolved_at AS latest_resolved_at
+         FROM inspection_findings f
+         JOIN audit_events e ON e.id = f.audit_event_id
+         JOIN inspection_definitions d ON d.id = f.inspection_definition_id
+         LEFT JOIN ${LATEST_RESOLUTION_BY_KEY_SQL} latest
+           ON latest.finding_key = f.finding_key
+         WHERE e.event_type = 'code_change'
            AND f.finding_key IS NOT NULL
-           AND (
-             SELECT fr.status FROM finding_resolution fr
-              WHERE fr.finding_key = f.finding_key
-              ORDER BY fr.created_at DESC, fr.rowid DESC
-              LIMIT 1
-           ) = 'resolved'
-           AND (
-             SELECT fr.method FROM finding_resolution fr
-              WHERE fr.finding_key = f.finding_key
-              ORDER BY fr.created_at DESC, fr.rowid DESC
-              LIMIT 1
-           ) = 'fixed-at-source'
-           AND (
-             SELECT fr.resolved_at FROM finding_resolution fr
-              WHERE fr.finding_key = f.finding_key
-              ORDER BY fr.created_at DESC, fr.rowid DESC
-              LIMIT 1
-           ) IS NOT NULL
+           AND latest.status = 'resolved'
+           AND latest.method = 'fixed-at-source'
+           AND latest.resolved_at IS NOT NULL
          ORDER BY latest_resolved_at DESC
          LIMIT :limit`
       ),
@@ -22019,15 +22563,18 @@ var SqliteSecurityRepository = class {
     return Promise.resolve({ items });
   }
   // Findings whose parent event occurred in [fromMs, toMs), with the parent's
-  // epoch-millis timestamp. occurred_at is an INTEGER column, so the bounds stay
+  // epoch-millis timestamp. started_at is an INTEGER column, so the bounds stay
   // numeric and the JS aggregations bucket/split on ms directly.
   findingsInRange(fromMs, toMs) {
     const rows = allRows(
       this.db.prepare(
-        `SELECT e.occurred_at AS occurred_at, f.severity AS severity, f.action_taken AS action_taken
-         FROM findings f JOIN events e ON e.id = f.event_id
-         WHERE e.occurred_at >= :from AND e.occurred_at < :to
-         ORDER BY e.occurred_at`
+        `SELECT e.started_at AS occurred_at, d.severity AS severity, f.action_taken AS action_taken
+         FROM inspection_findings f
+         JOIN audit_events e ON e.id = f.audit_event_id
+         JOIN inspection_definitions d ON d.id = f.inspection_definition_id
+         WHERE e.started_at >= :from AND e.started_at < :to
+           AND e.event_type IN (${CAPTURE_EVENT_TYPES_SQL})
+         ORDER BY e.started_at`
       ),
       { from: fromMs, to: toMs }
     );
@@ -22041,11 +22588,50 @@ var SqliteSecurityRepository = class {
 
 // ../../packages/persistence/src/repositories/shares.ts
 import { randomUUID as randomUUID7 } from "crypto";
-var KIND_ORDER = ["provider", "internal", "ip"];
+var MAX_EGRESS_CALL_SITES_PER_PROJECT = 5e3;
+var IN_CHUNK = 500;
+var KIND_ORDER = ["provider", "internal", "external", "ip"];
+var PLAINTEXT_TRANSPORT_SQL = "('http', 'ws')";
+var OVERRIDE_JOIN = `LEFT JOIN egress_decision_override oh ON oh.host = d.host
+             LEFT JOIN egress_decision_override ol ON ol.destination_id = d.id AND ol.host IS NULL`;
 var CALL_SITE_EMBED_CAP = 200;
 function parseNetwork(networkJson) {
   return safeJson(networkJson, null);
 }
+function capHits(all, mode) {
+  if (all.length <= MAX_EGRESS_CALL_SITES_PER_PROJECT) {
+    return { hits: [...all], droppedFiles: [], truncated: false };
+  }
+  if (mode === "walk") {
+    return {
+      hits: all.slice(0, MAX_EGRESS_CALL_SITES_PER_PROJECT),
+      droppedFiles: [],
+      truncated: true
+    };
+  }
+  const byFile = /* @__PURE__ */ new Map();
+  for (const hit of all) {
+    const bucket = byFile.get(hit.site.file);
+    if (bucket === void 0) byFile.set(hit.site.file, [hit]);
+    else bucket.push(hit);
+  }
+  const hits = [];
+  const droppedFiles = [];
+  for (const [file2, bucket] of byFile) {
+    if (hits.length + bucket.length > MAX_EGRESS_CALL_SITES_PER_PROJECT) droppedFiles.push(file2);
+    else hits.push(...bucket);
+  }
+  return { hits, droppedFiles, truncated: true };
+}
+function withoutDroppedFiles(reconcile, droppedFiles) {
+  if (reconcile.mode === "walk" || droppedFiles.length === 0) return reconcile;
+  const dropped = new Set(droppedFiles);
+  return {
+    mode: "ledger",
+    scannedFiles: reconcile.scannedFiles.filter((file2) => !dropped.has(file2)),
+    deletedFiles: reconcile.deletedFiles.filter((file2) => !dropped.has(file2))
+  };
+}
 function toEndpointSummary(row) {
   return {
     id: row.id,
@@ -22136,13 +22722,15 @@ var SqliteSharesRepository = class {
     const callSites = countScalar(this.db, "SELECT count(*) AS n FROM share_call_site");
     const insecure = countScalar(
       this.db,
-      "SELECT count(DISTINCT destination_id) AS n FROM share_endpoint WHERE transport = 'http'"
+      `SELECT count(DISTINCT destination_id) AS n FROM share_endpoint
+       WHERE transport IN ${PLAINTEXT_TRANSPORT_SQL}`
     );
     const needsReview = countScalar(
       this.db,
       `SELECT count(DISTINCT d.id) AS n
        FROM share_destination d
-       LEFT JOIN share_endpoint e ON e.destination_id = d.id AND e.transport = 'http'
+       LEFT JOIN share_endpoint e ON e.destination_id = d.id
+         AND e.transport IN ${PLAINTEXT_TRANSPORT_SQL}
        WHERE d.trust IN ('unverified', 'ip') OR e.id IS NOT NULL`
     );
     const kindCounts = countBy(
@@ -22152,6 +22740,7 @@ var SqliteSharesRepository = class {
     const byKind = {
       provider: kindCounts.get("provider") ?? 0,
       internal: kindCounts.get("internal") ?? 0,
+      external: kindCounts.get("external") ?? 0,
       ip: kindCounts.get("ip") ?? 0
     };
     const trustCounts = countBy(
@@ -22221,29 +22810,322 @@ var SqliteSharesRepository = class {
     const callSites = this.fetchCallSites(endpoints.map((e) => e.id));
     return Promise.resolve(buildDetail(dest, endpoints, callSites));
   }
-  // ─── Writes ────────────────────────────────────────────────────────────────
-  // Driven by a web-ui Server Action, not the hook path — errors surface to the
-  // caller. Returns whether the destination existed, so the caller can tell a
-  // real edit from a no-such-destination.
+  // ─── Writes ────────────────────────────────────────────────────────────────
+  // Driven by a web-ui Server Action, not the hook path — errors surface to the
+  // caller. Returns whether the destination existed, so the caller can tell a
+  // real edit from a no-such-destination.
+  /**
+   * Set (decision) or clear (null) the egress decision override for a destination.
+   * `null` deletes the override rows → reverts to the trust default.
+   *
+   * The written row carries both the destination id and its host, so the
+   * decision re-attaches by host after the destination is pruned and
+   * re-detected under a fresh id. Rows written before the host column existed
+   * (host NULL, matched by destination id) are replaced rather than left to
+   * shadow the new one. Runs IMMEDIATE: the host lookup is read-then-write and
+   * would otherwise race a concurrent prune.
+   */
+  setEgressDecision(destinationId, decision) {
+    let existed = false;
+    withTransaction(
+      this.db,
+      () => {
+        const dest = this.db.prepare("SELECT host FROM share_destination WHERE id = ?").get(destinationId);
+        if (dest === void 0) return;
+        existed = true;
+        this.db.prepare(
+          `DELETE FROM egress_decision_override
+             WHERE host = :host OR (destination_id = :destinationId AND host IS NULL)`
+        ).run({ host: dest.host, destinationId });
+        if (decision === null) return;
+        this.db.prepare(
+          `INSERT INTO egress_decision_override
+               (id, destination_id, host, decision, created_at, updated_at)
+             VALUES (:id, :destinationId, :host, :decision, :now, :now)`
+        ).run({
+          id: randomUUID7(),
+          destinationId,
+          host: dest.host,
+          decision,
+          now: Date.now()
+        });
+      },
+      "IMMEDIATE"
+    );
+    return existed;
+  }
+  /**
+   * Record one project's statically-extracted egress: reconcile the previously
+   * stored call sites against this scan, upsert destination → endpoint → call
+   * site for every hit, confirm `last_seen` on everything the project still
+   * references, and drop what no longer has evidence.
+   *
+   * Reconciliation keys on `projectKey` alone; `project` and `projectId` are
+   * display payload and never scope a delete. The whole write is one
+   * transaction: a failure leaves the project's previous inventory exactly as
+   * it was, and THROWS rather than reporting a partial write — callers decide
+   * their own fail-open behavior, and the scanner additionally withholds its
+   * ledger commit so the next scan retries.
+   *
+   * Over-cap input is truncated at a FILE boundary, and the files that lost
+   * their hits are both excluded from the reconcile delete and named in
+   * `droppedFiles`. That pairing is what keeps truncation non-destructive on
+   * the ledger path: a dropped file keeps whatever rows it already had, and its
+   * caller withholds the ledger entry so the next scan reads it again.
+   */
+  recordProjectEgress(input) {
+    const { hits, droppedFiles, truncated } = capHits(input.hits, input.reconcile.mode);
+    const reconcile = withoutDroppedFiles(input.reconcile, droppedFiles);
+    const now = Date.now();
+    let summary = {
+      destinations: 0,
+      endpoints: 0,
+      callSites: 0,
+      truncated,
+      droppedFiles
+    };
+    withTransaction(
+      this.db,
+      () => {
+        const projectId = input.projectId ?? this.knownProjectId(input.projectKey);
+        this.reconcileCallSites(input.projectKey, reconcile);
+        this.upsertHits(input, hits, projectId, now);
+        this.confirmLastSeen(input.projectKey, now);
+        this.pruneOrphans();
+        summary = { ...this.projectTotals(input.projectKey), truncated, droppedFiles };
+      },
+      "IMMEDIATE"
+    );
+    return summary;
+  }
+  // ─── Egress write internals ──────────────────────────────────────────────────
+  /**
+   * Clear the stored call sites this scan is responsible for re-creating.
+   *
+   * Each pipeline may only delete rows its own walker could have produced. The
+   * fs walk behind 'walk' mode never descends into dot-directories, so its
+   * delete excludes dot-path files — those rows are the plugin scanner's to
+   * reconcile, and deleting them here would make the two pipelines erase each
+   * other's rows on every alternating scan. 'ledger' mode names its files
+   * outright and never mass-deletes, so rows the fs walk contributed for files
+   * the scanner skips (vendored, oversize) survive it.
+   */
+  reconcileCallSites(projectKey, reconcile) {
+    if (reconcile.mode === "walk") {
+      const prefix = reconcile.walkedPrefix.replace(/\/+$/, "");
+      this.db.prepare(
+        `DELETE FROM share_call_site
+           WHERE project_key = :key
+             AND (:prefix = '' OR file = :prefix OR file LIKE :subtree ESCAPE '\\')
+             AND file NOT LIKE '.%'
+             AND file NOT LIKE '%/.%'`
+      ).run({ key: projectKey, prefix, subtree: `${escapeLikePattern(prefix)}/%` });
+      return;
+    }
+    const files = [.../* @__PURE__ */ new Set([...reconcile.scannedFiles, ...reconcile.deletedFiles])];
+    for (let i = 0; i < files.length; i += IN_CHUNK) {
+      const chunk = files.slice(i, i + IN_CHUNK);
+      this.db.prepare(
+        `DELETE FROM share_call_site
+           WHERE project_key = ? AND file IN (${placeholders(chunk.length)})`
+      ).run(projectKey, ...chunk);
+    }
+  }
+  /**
+   * Upsert every hit as destination → endpoint → call site. Destinations key on
+   * `host` and endpoints on `(destination_id, method, url)`, both shared across
+   * projects; only the call site carries `project_key`. A destination's `note`
+   * is user-owned and never overwritten. The id caches keep one upsert per
+   * distinct host and endpoint, so the first hit for a host supplies its
+   * classification for this batch.
+   */
+  upsertHits(input, hits, projectId, now) {
+    if (hits.length === 0) return;
+    const destStmt = this.db.prepare(
+      `INSERT INTO share_destination
+         (id, kind, name, host, category, trust, network_json, last_seen, provenance,
+          created_at, updated_at)
+       VALUES (:id, :kind, :name, :host, :category, :trust, :networkJson, :now, 'scan', :now, :now)
+       ON CONFLICT (host) DO UPDATE SET
+         kind = excluded.kind,
+         name = excluded.name,
+         category = excluded.category,
+         trust = excluded.trust,
+         network_json = excluded.network_json,
+         last_seen = excluded.last_seen,
+         updated_at = excluded.updated_at`
+    );
+    const destIdStmt = this.db.prepare("SELECT id FROM share_destination WHERE host = ?");
+    const endpointStmt = this.db.prepare(
+      `INSERT INTO share_endpoint
+         (id, destination_id, method, transport, url, template, data_class, last_seen,
+          created_at, updated_at)
+       VALUES (:id, :destinationId, :method, :transport, :url, :template, :dataClass, :now,
+               :now, :now)
+       ON CONFLICT (destination_id, method, url) DO UPDATE SET
+         transport = excluded.transport,
+         template = excluded.template,
+         data_class = excluded.data_class,
+         last_seen = excluded.last_seen,
+         updated_at = excluded.updated_at`
+    );
+    const endpointIdStmt = this.db.prepare(
+      "SELECT id FROM share_endpoint WHERE destination_id = ? AND method = ? AND url = ?"
+    );
+    const siteStmt = this.db.prepare(
+      `INSERT INTO share_call_site
+         (id, endpoint_id, project, project_key, file, line, snippet, dynamic, vendored,
+          project_id, created_at, updated_at)
+       VALUES (:id, :endpointId, :project, :projectKey, :file, :line, :snippet, :dynamic,
+               :vendored, :projectId, :now, :now)
+       ON CONFLICT (endpoint_id, project_key, file, line) DO UPDATE SET
+         snippet = excluded.snippet,
+         dynamic = excluded.dynamic,
+         vendored = excluded.vendored,
+         project = excluded.project,
+         project_id = COALESCE(excluded.project_id, share_call_site.project_id),
+         updated_at = excluded.updated_at`
+    );
+    const destIds = /* @__PURE__ */ new Map();
+    const endpointIds = /* @__PURE__ */ new Map();
+    for (const hit of hits) {
+      let destinationId = destIds.get(hit.host);
+      if (destinationId === void 0) {
+        destStmt.run({
+          id: randomUUID7(),
+          kind: hit.kind,
+          name: hit.name,
+          host: hit.host,
+          category: hit.category,
+          trust: hit.trust,
+          networkJson: hit.network === null ? null : JSON.stringify(hit.network),
+          now
+        });
+        destinationId = getRow(destIdStmt, [hit.host])?.id ?? "";
+        destIds.set(hit.host, destinationId);
+      }
+      const endpointKey = `${destinationId}\0${hit.method}\0${hit.url}`;
+      let endpointId = endpointIds.get(endpointKey);
+      if (endpointId === void 0) {
+        endpointStmt.run({
+          id: randomUUID7(),
+          destinationId,
+          method: hit.method,
+          transport: hit.transport,
+          url: hit.url,
+          template: boolToInt(hit.template),
+          dataClass: hit.dataClass,
+          now
+        });
+        endpointId = getRow(endpointIdStmt, [destinationId, hit.method, hit.url])?.id ?? "";
+        endpointIds.set(endpointKey, endpointId);
+      }
+      siteStmt.run({
+        id: randomUUID7(),
+        endpointId,
+        project: input.project,
+        projectKey: input.projectKey,
+        file: hit.site.file,
+        line: hit.site.line,
+        snippet: hit.site.snippet,
+        dynamic: boolToInt(hit.site.dynamic),
+        vendored: boolToInt(hit.site.vendored),
+        projectId,
+        now
+      });
+    }
+  }
   /**
-   * Set (decision) or clear (null) the egress decision override for a destination.
-   * `null` deletes the override row → reverts to the trust default.
+   * The source-project id this project's stored call sites already carry, if
+   * any. Only the pipeline that resolves a source project supplies one; the
+   * other passes null and inherits this, so the link stops flapping between a
+   * real id and NULL depending on which pipeline ran last. The value is a
+   * per-project attribute stored redundantly on each row, so any row's is
+   * representative.
    */
-  setEgressDecision(destinationId, decision) {
-    const exists = this.db.prepare("SELECT 1 FROM share_destination WHERE id = ?").get(destinationId);
-    if (exists === void 0) return false;
-    if (decision === null) {
-      this.db.prepare("DELETE FROM egress_decision_override WHERE destination_id = ?").run(destinationId);
-      return true;
-    }
+  knownProjectId(projectKey) {
+    return getRow(
+      this.db.prepare(
+        `SELECT project_id AS projectId FROM share_call_site
+           WHERE project_key = ? AND project_id IS NOT NULL LIMIT 1`
+      ),
+      [projectKey]
+    )?.projectId ?? null;
+  }
+  /**
+   * Stamp `last_seen` on every endpoint and destination this project still
+   * references — including rows the scan preserved rather than re-wrote, so a
+   * ledger-skipped file's references don't decay into "stale" on the page.
+   */
+  confirmLastSeen(projectKey, now) {
     this.db.prepare(
-      `INSERT INTO egress_decision_override (id, destination_id, decision, created_at, updated_at)
-         VALUES (:id, :destinationId, :decision, :now, :now)
-         ON CONFLICT (destination_id) DO UPDATE SET
-           decision = excluded.decision,
-           updated_at = excluded.updated_at`
-    ).run({ id: randomUUID7(), destinationId, decision, now: Date.now() });
-    return true;
+      `UPDATE share_endpoint SET last_seen = :now, updated_at = :now
+         WHERE id IN (SELECT DISTINCT endpoint_id FROM share_call_site WHERE project_key = :key)`
+    ).run({ now, key: projectKey });
+    this.db.prepare(
+      `UPDATE share_destination SET last_seen = :now, updated_at = :now
+         WHERE id IN (SELECT DISTINCT e.destination_id
+                      FROM share_endpoint e
+                      JOIN share_call_site c ON c.endpoint_id = e.id
+                      WHERE c.project_key = :key)`
+    ).run({ now, key: projectKey });
+  }
+  /**
+   * Drop rows left without evidence: endpoints with no call site, then
+   * destinations with no endpoint. Call sites are the only evidence either one
+   * has, so a row that lost its last one belongs to no project any more.
+   *
+   * Overrides are deleted between the two steps, and only the ones written
+   * before the host column existed. Those match a destination by id alone;
+   * because the id link is released on delete rather than cascading, leaving
+   * them would accumulate rows that match neither join arm and that nothing can
+   * reach again. Host-bearing rows deliberately survive — the host is what
+   * re-attaches a user's decision when the destination comes back.
+   */
+  pruneOrphans() {
+    this.db.exec(
+      `DELETE FROM share_endpoint
+       WHERE NOT EXISTS (SELECT 1 FROM share_call_site c WHERE c.endpoint_id = share_endpoint.id)`
+    );
+    this.db.exec(
+      `DELETE FROM egress_decision_override
+       WHERE host IS NULL
+         AND destination_id IN (
+           SELECT d.id FROM share_destination d
+           WHERE NOT EXISTS (SELECT 1 FROM share_endpoint e WHERE e.destination_id = d.id))`
+    );
+    this.db.exec(
+      `DELETE FROM share_destination
+       WHERE NOT EXISTS (
+         SELECT 1 FROM share_endpoint e WHERE e.destination_id = share_destination.id)`
+    );
+  }
+  /**
+   * Live totals for one project. Destinations and endpoints are shared across
+   * projects and carry no project column, so both are counted through the call
+   * sites that reference them.
+   */
+  projectTotals(projectKey) {
+    return {
+      destinations: countScalar(
+        this.db,
+        `SELECT count(DISTINCT e.destination_id) AS n
+         FROM share_endpoint e
+         JOIN share_call_site c ON c.endpoint_id = e.id
+         WHERE c.project_key = ?`,
+        [projectKey]
+      ),
+      endpoints: countScalar(
+        this.db,
+        "SELECT count(DISTINCT endpoint_id) AS n FROM share_call_site WHERE project_key = ?",
+        [projectKey]
+      ),
+      callSites: countScalar(
+        this.db,
+        "SELECT count(*) AS n FROM share_call_site WHERE project_key = ?",
+        [projectKey]
+      )
+    };
   }
   // ─── Raw fetchers ────────────────────────────────────────────────────────────
   mapDestRow(r) {
@@ -22263,7 +23145,8 @@ var SqliteSharesRepository = class {
   fetchDestinations(q, kinds, reviewOnly = false) {
     const cols = `d.id, d.kind, d.name, d.host, d.category, d.trust, d.note,
                   d.network_json AS networkJson, d.last_seen AS lastSeenMs,
-                  d.created_at AS createdAt, o.decision AS overrideDecision`;
+                  d.created_at AS createdAt,
+                  COALESCE(oh.decision, ol.decision) AS overrideDecision`;
     const conditions = [];
     const params = [];
     if (kinds && kinds.length > 0) {
@@ -22274,7 +23157,8 @@ var SqliteSharesRepository = class {
       conditions.push(
         `(d.trust IN ('unverified', 'ip')
           OR EXISTS (SELECT 1 FROM share_endpoint re
-                     WHERE re.destination_id = d.id AND re.transport = 'http'))`
+                     WHERE re.destination_id = d.id
+                       AND re.transport IN ${PLAINTEXT_TRANSPORT_SQL}))`
       );
     }
     let sql;
@@ -22287,7 +23171,7 @@ var SqliteSharesRepository = class {
       params.push(pattern, pattern, pattern, pattern, pattern);
       sql = `SELECT DISTINCT ${cols}
              FROM share_destination d
-             LEFT JOIN egress_decision_override o ON o.destination_id = d.id
+             ${OVERRIDE_JOIN}
              LEFT JOIN share_endpoint e ON e.destination_id = d.id
              LEFT JOIN share_call_site c ON c.endpoint_id = e.id
              ${conditions.length ? `WHERE ${conditions.join(" AND ")}` : ""}
@@ -22295,7 +23179,7 @@ var SqliteSharesRepository = class {
     } else {
       sql = `SELECT ${cols}
              FROM share_destination d
-             LEFT JOIN egress_decision_override o ON o.destination_id = d.id
+             ${OVERRIDE_JOIN}
              ${conditions.length ? `WHERE ${conditions.join(" AND ")}` : ""}
              ORDER BY d.created_at ASC, d.id ASC`;
     }
@@ -22310,9 +23194,9 @@ var SqliteSharesRepository = class {
       this.db.prepare(
         `SELECT d.id, d.kind, d.name, d.host, d.category, d.trust, d.note,
                 d.network_json AS networkJson, d.last_seen AS lastSeenMs,
-                o.decision AS overrideDecision
+                COALESCE(oh.decision, ol.decision) AS overrideDecision
          FROM share_destination d
-         LEFT JOIN egress_decision_override o ON o.destination_id = d.id
+         ${OVERRIDE_JOIN}
          WHERE d.id = ?`
       ),
       [destinationId]
@@ -22514,9 +23398,10 @@ function openWithPragmas(file2) {
 }
 function backupLegacyStore(file2) {
   const backup = `${file2}.legacy.${String(Date.now())}.bak`;
-  renameSync(file2, backup);
-  for (const sidecar of walSidecars(file2)) {
-    if (existsSync(sidecar)) rmSync(sidecar);
+  renameSync2(file2, backup);
+  tightenFile(backup);
+  for (const sidecar of dbSidecars(file2)) {
+    if (existsSync(sidecar)) rmSync2(sidecar);
   }
   return backup;
 }
@@ -22532,7 +23417,7 @@ function openLocalDatabase(dir) {
       `Detected an older, incompatible (tenant-bearing) ${DB_FILENAME}; backed it up to ${backup} and created a fresh store.`
     );
   }
-  applyMigrations(db);
+  applyMigrations(db, file2);
   tightenPerms(file2);
   const events = new SqliteEventsRepository(db);
   const findings = new SqliteFindingsRepository(db);
@@ -22541,6 +23426,7 @@ function openLocalDatabase(dir) {
   const scanLedger = new SqliteScanLedgerRepository(db);
   const exceptions = new SqliteExceptionsRepository(db);
   const resolutions = new SqliteResolutionsRepository(db);
+  const ruleProbeCache = new SqliteRuleProbeCacheRepository(db);
   const security = new SqliteSecurityRepository(db);
   const detections = new SqliteDetectionsRepository(db);
   const shares = new SqliteSharesRepository(db);
@@ -22558,9 +23444,56 @@ function openLocalDatabase(dir) {
   policies.seedDefaults();
   function recordCapture(event, detected) {
     failOpenTransaction(db, () => {
-      events.insertEvent(event);
       const sessionId = event.metadata?.sessionId;
-      findings.insertFindings(detected, sessionId ? { sessionId } : {});
+      if (sessionId) {
+        auditEvents.ensureSessionRoot(sessionId, event.occurredAt);
+      }
+      const auditEventId = captureId(
+        sessionId ?? null,
+        event.contentHash,
+        event.metadata?.filePath ?? null
+      );
+      auditEvents.insertAuditEvent({
+        id: auditEventId,
+        eventType: event.kind,
+        startedAt: event.occurredAt,
+        parentId: sessionId,
+        rootSessionId: sessionId,
+        content: event.content,
+        contentHash: event.contentHash,
+        attributes: toCaptureAttributes(event)
+      });
+      const definitionIds = /* @__PURE__ */ new Map();
+      for (const finding of detected) {
+        if (sessionId && inspectionFindings.isSessionDuplicate(finding.ruleId, finding.maskedMatch, sessionId)) {
+          continue;
+        }
+        if (inspectionFindings.isEventDuplicate(
+          auditEventId,
+          finding.ruleId,
+          finding.maskedMatch,
+          finding.span.start,
+          finding.span.end
+        )) {
+          continue;
+        }
+        const key = `${finding.ruleId}@${captureDefinitionVersion(finding)}`;
+        let definitionId = definitionIds.get(key);
+        if (!definitionId) {
+          definitionId = inspectionDefinitions.upsert(toCaptureDefinitionInput(finding));
+          definitionIds.set(key, definitionId);
+        }
+        inspectionFindings.insertFinding({
+          id: finding.id,
+          auditEventId,
+          inspectionDefinitionId: definitionId,
+          span: finding.span,
+          maskedMatch: finding.maskedMatch,
+          actionTaken: finding.actionTaken,
+          confidence: finding.confidence,
+          findingKey: finding.findingKey ?? void 0
+        });
+      }
     });
   }
   function ensureInventory(ctx) {
@@ -22678,6 +23611,7 @@ function openLocalDatabase(dir) {
     scanLedger,
     exceptions,
     resolutions,
+    ruleProbeCache,
     security,
     detections,
     shares,
@@ -22707,9 +23641,19 @@ function openLocalDatabase(dir) {
   };
 }
 
+// ../../packages/persistence/src/finding-key.ts
+import { createHash as createHash3 } from "crypto";
+function normalizeFilePath(filePath) {
+  return filePath.replaceAll("\\", "/");
+}
+function computeFindingKey(input) {
+  const normalizedPath = normalizeFilePath(input.filePath);
+  return createHash3("sha256").update(`${input.ruleId}\0${normalizedPath}\0${input.valueFingerprint}`).digest("hex");
+}
+
 // ../../packages/persistence/src/fingerprint.ts
 import { createHmac, randomBytes } from "crypto";
-import { chmodSync as chmodSync2, readFileSync, renameSync as renameSync2, writeFileSync } from "fs";
+import { readFileSync } from "fs";
 import { join as join2 } from "path";
 var KEY_FILENAME = "exception.key";
 var KEY_MATERIAL_BYTES = 32;
@@ -22737,15 +23681,9 @@ function parseKeyFile(raw) {
 function writeKeyFile(dataDir2, key) {
   ensureDataDirSync(dataDir2);
   const file2 = keyFilePath(dataDir2);
-  const tmp = `${file2}.tmp`;
   const body = JSON.stringify({ version: key.version, material: key.material.toString("base64") });
-  writeFileSync(tmp, `${body}
-`, { mode: DATA_FILE_MODE });
-  renameSync2(tmp, file2);
-  try {
-    chmodSync2(file2, DATA_FILE_MODE);
-  } catch {
-  }
+  writeOwnerOnlyFileSync(file2, `${body}
+`);
   return key;
 }
 function readFingerprintKey(dataDir2) {
@@ -22761,10 +23699,7 @@ function readFingerprintKey(dataDir2) {
 function loadOrCreateFingerprintKey(dataDir2) {
   const existing = readFingerprintKey(dataDir2);
   if (existing) {
-    try {
-      chmodSync2(keyFilePath(dataDir2), DATA_FILE_MODE);
-    } catch {
-    }
+    tightenFile(keyFilePath(dataDir2));
     return existing;
   }
   return writeKeyFile(dataDir2, { version: 1, material: randomBytes(KEY_MATERIAL_BYTES) });
@@ -22774,8 +23709,8 @@ function fingerprintValue(key, raw) {
 }
 
 // ../../packages/persistence/src/local-layout.ts
-import { chmodSync as chmodSync3, mkdirSync as mkdirSync2, renameSync as renameSync3 } from "fs";
-import { chmod, mkdir } from "fs/promises";
+import { renameSync as renameSync3 } from "fs";
+import { mkdir } from "fs/promises";
 import { homedir } from "os";
 import { join as join3 } from "path";
 function defaultDataDir() {
@@ -22790,6 +23725,9 @@ function dataDir(base = defaultDataDir()) {
 function dbPath(base = defaultDataDir()) {
   return join3(dataDir(base), "aka.db");
 }
+function ensureLayoutDirSync(dir = defaultDataDir()) {
+  ensureDataDirSync(dir);
+}
 function migrateLegacyLayout(base = defaultDataDir()) {
   const moves = [
     { name: "config.json", dest: settingsDir(base) },
@@ -22797,19 +23735,17 @@ function migrateLegacyLayout(base = defaultDataDir()) {
   ];
   for (const { name, dest } of moves) {
     try {
-      mkdirSync2(dest, { recursive: true, mode: DATA_DIR_MODE });
-      try {
-        chmodSync3(dest, DATA_DIR_MODE);
-      } catch {
-      }
-      renameSync3(join3(base, name), join3(dest, name));
+      ensureDataDirSync(dest);
+      const moved = join3(dest, name);
+      renameSync3(join3(base, name), moved);
+      tightenFile(moved);
     } catch {
     }
   }
 }
 
 // ../../packages/persistence/src/settings.ts
-import { readFileSync as readFileSync2, renameSync as renameSync4, writeFileSync as writeFileSync2 } from "fs";
+import { readFileSync as readFileSync2 } from "fs";
 import { join as join4 } from "path";
 function readWorkspaceSettings(base = defaultDataDir()) {
   const record2 = readJson(join4(settingsDir(base), "settings.json"));
@@ -22831,7 +23767,7 @@ function readJson(file2) {
 }
 
 // ../../packages/persistence/src/warn-era-cap.ts
-import { existsSync as existsSync2, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync2, writeFileSync as writeFileSync2 } from "fs";
 import { join as join5 } from "path";
 var MARKER = "warn-era-capped";
 function capWarnEraEnforcementOnce(db, policyMode, dataDir2) {
@@ -22839,7 +23775,7 @@ function capWarnEraEnforcementOnce(db, policyMode, dataDir2) {
   const marker = join5(dataDir2, MARKER);
   if (existsSync2(marker)) return { capped: 0, skipped: "already-run" };
   const capped = db.policies.capCategoryActions();
-  writeFileSync3(marker, `${new Date(Date.now()).toISOString()}
+  writeFileSync2(marker, `${new Date(Date.now()).toISOString()}
 `, { mode: DATA_FILE_MODE });
   return { capped };
 }
@@ -22894,6 +23830,12 @@ function resolveProvider() {
 
 // ../../packages/plugin-sdk/src/config.ts
 function loadConfig(base = defaultDataDir()) {
+  try {
+    ensureLayoutDirSync(base);
+    const settingsFile = join6(settingsDir(base), "settings.json");
+    if (existsSync3(settingsFile)) tightenFile(settingsFile);
+  } catch {
+  }
   migrateLegacyLayout(base);
   const settings = readWorkspaceSettings(base);
   return {
@@ -22916,15 +23858,583 @@ function resolveProviderSafe() {
 // ../../packages/plugin-sdk/src/config-inventory.ts
 import { readdirSync, readFileSync as readFileSync4, realpathSync, statSync as statSync2 } from "fs";
 import { homedir as homedir2 } from "os";
-import { basename as basename2, join as join7 } from "path";
+import { basename as basename2, join as join8 } from "path";
+
+// ../../packages/detections/src/egress/registry.ts
+var EXTRACTOR_VERSION = "1";
+var PROVIDER_REGISTRY = [
+  {
+    id: "stripe",
+    name: "Stripe",
+    category: "Payments",
+    hostSuffixes: ["stripe.com"],
+    apiBase: "https://api.stripe.com",
+    defaultDataClasses: ["pii", "customer"],
+    sdks: {
+      npm: ["stripe"],
+      pypi: ["stripe"],
+      go: ["github.com/stripe/stripe-go"],
+      maven: ["com.stripe"],
+      rubygems: ["stripe"],
+      composer: ["stripe/stripe-php"],
+      nuget: ["Stripe.net"]
+    }
+  },
+  {
+    id: "datadog",
+    name: "Datadog",
+    category: "Observability",
+    hostSuffixes: ["datadoghq.com", "datadoghq.eu"],
+    apiBase: "https://api.datadoghq.com",
+    defaultDataClasses: ["telemetry", "logs", "metrics"],
+    sdks: {
+      npm: ["dd-trace", "@datadog/browser-logs"],
+      pypi: ["datadog", "ddtrace"],
+      go: ["github.com/DataDog/dd-trace-go"],
+      maven: ["com.datadoghq"],
+      rubygems: ["ddtrace", "dogapi"],
+      nuget: ["Datadog.Trace"]
+    }
+  },
+  {
+    id: "newrelic",
+    name: "New Relic",
+    category: "Observability",
+    hostSuffixes: ["newrelic.com", "nr-data.net"],
+    apiBase: "https://api.newrelic.com",
+    defaultDataClasses: ["telemetry", "logs", "metrics"],
+    sdks: {
+      npm: ["newrelic"],
+      pypi: ["newrelic"],
+      go: ["github.com/newrelic/go-agent"],
+      maven: ["com.newrelic.agent.java"],
+      rubygems: ["newrelic_rpm"],
+      nuget: ["NewRelic.Agent"]
+    }
+  },
+  {
+    id: "sentry",
+    name: "Sentry",
+    category: "Error tracking",
+    hostSuffixes: ["sentry.io"],
+    apiBase: "https://sentry.io",
+    defaultDataClasses: ["source", "telemetry"],
+    sdks: {
+      npm: ["@sentry/node", "@sentry/react", "@sentry/nextjs"],
+      pypi: ["sentry-sdk"],
+      go: ["github.com/getsentry/sentry-go"],
+      maven: ["io.sentry"],
+      rubygems: ["sentry-ruby"],
+      cargo: ["sentry"],
+      composer: ["sentry/sentry"],
+      nuget: ["Sentry"]
+    }
+  },
+  {
+    id: "openai",
+    name: "OpenAI",
+    category: "LLM provider",
+    hostSuffixes: ["openai.com"],
+    apiBase: "https://api.openai.com",
+    defaultDataClasses: ["pii", "source"],
+    sdks: {
+      npm: ["openai"],
+      pypi: ["openai"],
+      go: ["github.com/sashabaranov/go-openai"],
+      maven: ["com.openai"],
+      rubygems: ["ruby-openai"],
+      cargo: ["async-openai"],
+      composer: ["openai-php/client"],
+      nuget: ["OpenAI"]
+    }
+  },
+  {
+    id: "anthropic",
+    name: "Anthropic",
+    category: "LLM provider",
+    hostSuffixes: ["anthropic.com"],
+    apiBase: "https://api.anthropic.com",
+    defaultDataClasses: ["pii", "source"],
+    sdks: {
+      npm: ["@anthropic-ai/sdk"],
+      pypi: ["anthropic"],
+      go: ["github.com/anthropics/anthropic-sdk-go"],
+      nuget: ["Anthropic.SDK"]
+    }
+  },
+  {
+    id: "aws",
+    name: "Amazon Web Services",
+    category: "Cloud platform",
+    hostSuffixes: ["amazonaws.com"],
+    apiBase: "https://s3.amazonaws.com",
+    defaultDataClasses: ["secrets", "customer"],
+    sdks: {
+      npm: ["@aws-sdk/client-s3", "aws-sdk"],
+      pypi: ["boto3"],
+      go: ["github.com/aws/aws-sdk-go", "github.com/aws/aws-sdk-go-v2"],
+      maven: ["com.amazonaws", "software.amazon.awssdk"],
+      rubygems: ["aws-sdk-s3"],
+      cargo: ["aws-sdk-s3"],
+      nuget: ["AWSSDK.S3"]
+    }
+  },
+  {
+    id: "gcp",
+    name: "Google Cloud",
+    category: "Cloud platform",
+    hostSuffixes: ["googleapis.com"],
+    apiBase: "https://storage.googleapis.com",
+    defaultDataClasses: ["customer", "logs"],
+    sdks: {
+      npm: ["@google-cloud/storage"],
+      pypi: ["google-cloud-storage"],
+      go: ["cloud.google.com/go"],
+      maven: ["com.google.cloud"],
+      rubygems: ["google-cloud-storage"],
+      nuget: ["Google.Cloud.Storage.V1"]
+    }
+  },
+  {
+    id: "azure",
+    name: "Microsoft Azure",
+    category: "Cloud platform",
+    hostSuffixes: ["azure.com", "windows.net"],
+    apiBase: "https://management.azure.com",
+    defaultDataClasses: ["customer", "logs"],
+    sdks: {
+      npm: ["@azure/storage-blob"],
+      pypi: ["azure-storage-blob"],
+      go: ["github.com/Azure/azure-sdk-for-go"],
+      maven: ["com.azure"],
+      rubygems: ["azure-storage-blob"],
+      nuget: ["Azure.Storage.Blobs"]
+    }
+  },
+  {
+    id: "slack",
+    name: "Slack",
+    category: "Notifications",
+    hostSuffixes: ["slack.com"],
+    apiBase: "https://slack.com/api",
+    defaultDataClasses: ["logs"],
+    sdks: {
+      npm: ["@slack/web-api"],
+      pypi: ["slack-sdk"],
+      go: ["github.com/slack-go/slack"],
+      maven: ["com.slack.api"],
+      rubygems: ["slack-ruby-client"],
+      composer: ["slack-php/slack-api"],
+      nuget: ["SlackNet"]
+    }
+  },
+  {
+    id: "segment",
+    name: "Segment",
+    category: "Analytics",
+    hostSuffixes: ["segment.io", "segment.com"],
+    apiBase: "https://api.segment.io",
+    defaultDataClasses: ["customer"],
+    sdks: {
+      npm: ["@segment/analytics-node", "analytics-node"],
+      pypi: ["segment-analytics-python"],
+      go: ["github.com/segmentio/analytics-go"],
+      maven: ["com.segment.analytics.java"],
+      rubygems: ["analytics-ruby"],
+      nuget: ["Analytics"]
+    }
+  },
+  {
+    id: "twilio",
+    name: "Twilio",
+    category: "Communications",
+    hostSuffixes: ["twilio.com"],
+    apiBase: "https://api.twilio.com",
+    defaultDataClasses: ["pii", "customer"],
+    sdks: {
+      npm: ["twilio"],
+      pypi: ["twilio"],
+      go: ["github.com/twilio/twilio-go"],
+      maven: ["com.twilio.sdk"],
+      rubygems: ["twilio-ruby"],
+      composer: ["twilio/sdk"],
+      nuget: ["Twilio"]
+    }
+  },
+  {
+    id: "sendgrid",
+    name: "SendGrid",
+    category: "Email",
+    hostSuffixes: ["sendgrid.com"],
+    apiBase: "https://api.sendgrid.com",
+    defaultDataClasses: ["pii"],
+    sdks: {
+      npm: ["@sendgrid/mail"],
+      pypi: ["sendgrid"],
+      go: ["github.com/sendgrid/sendgrid-go"],
+      maven: ["com.sendgrid"],
+      rubygems: ["sendgrid-ruby"],
+      composer: ["sendgrid/sendgrid"],
+      nuget: ["SendGrid"]
+    }
+  },
+  {
+    id: "mailgun",
+    name: "Mailgun",
+    category: "Email",
+    hostSuffixes: ["mailgun.net"],
+    apiBase: "https://api.mailgun.net",
+    defaultDataClasses: ["pii"],
+    sdks: {
+      npm: ["mailgun.js"],
+      pypi: ["mailgun"],
+      rubygems: ["mailgun-ruby"],
+      composer: ["mailgun/mailgun-php"],
+      nuget: ["Mailgun"]
+    }
+  },
+  {
+    id: "mixpanel",
+    name: "Mixpanel",
+    category: "Analytics",
+    hostSuffixes: ["mixpanel.com"],
+    apiBase: "https://api.mixpanel.com",
+    defaultDataClasses: ["customer", "telemetry"],
+    sdks: {
+      npm: ["mixpanel"],
+      pypi: ["mixpanel"],
+      rubygems: ["mixpanel-ruby"],
+      nuget: ["Mixpanel"]
+    }
+  },
+  {
+    id: "amplitude",
+    name: "Amplitude",
+    category: "Analytics",
+    hostSuffixes: ["amplitude.com"],
+    apiBase: "https://api2.amplitude.com",
+    defaultDataClasses: ["customer", "telemetry"],
+    sdks: {
+      npm: ["@amplitude/analytics-node"],
+      pypi: ["amplitude-analytics"],
+      nuget: ["Amplitude"]
+    }
+  },
+  {
+    id: "posthog",
+    name: "PostHog",
+    category: "Analytics",
+    hostSuffixes: ["posthog.com"],
+    apiBase: "https://us.i.posthog.com",
+    defaultDataClasses: ["customer", "telemetry"],
+    sdks: {
+      npm: ["posthog-node", "posthog-js"],
+      pypi: ["posthog"],
+      go: ["github.com/posthog/posthog-go"],
+      rubygems: ["posthog-ruby"],
+      composer: ["posthog/posthog-php"],
+      nuget: ["PostHog"]
+    }
+  },
+  {
+    id: "honeycomb",
+    name: "Honeycomb",
+    category: "Observability",
+    hostSuffixes: ["honeycomb.io"],
+    apiBase: "https://api.honeycomb.io",
+    defaultDataClasses: ["telemetry", "metrics"],
+    sdks: {
+      npm: ["libhoney"],
+      pypi: ["libhoney"],
+      go: ["github.com/honeycombio/libhoney-go"],
+      rubygems: ["libhoney"]
+    }
+  },
+  {
+    id: "grafana",
+    name: "Grafana Cloud",
+    category: "Observability",
+    hostSuffixes: ["grafana.net"],
+    apiBase: "https://grafana.net",
+    defaultDataClasses: ["logs", "metrics"],
+    sdks: {
+      npm: ["@grafana/faro-web-sdk"]
+    }
+  },
+  {
+    id: "splunk",
+    name: "Splunk",
+    category: "Observability",
+    hostSuffixes: ["splunkcloud.com", "splunk.com"],
+    apiBase: "https://http-inputs.splunkcloud.com",
+    defaultDataClasses: ["logs"],
+    sdks: {
+      npm: ["splunk-logging"],
+      pypi: ["splunk-sdk"],
+      maven: ["com.splunk"],
+      nuget: ["Splunk.Logging.Common"]
+    }
+  },
+  {
+    id: "pagerduty",
+    name: "PagerDuty",
+    category: "Incident response",
+    hostSuffixes: ["pagerduty.com"],
+    apiBase: "https://api.pagerduty.com",
+    defaultDataClasses: ["logs"],
+    sdks: {
+      npm: ["@pagerduty/pdjs"],
+      pypi: ["pdpyras"],
+      go: ["github.com/PagerDuty/go-pagerduty"],
+      rubygems: ["pagerduty"]
+    }
+  },
+  {
+    id: "github",
+    name: "GitHub",
+    category: "Developer platform",
+    hostSuffixes: ["github.com", "githubusercontent.com"],
+    apiBase: "https://api.github.com",
+    defaultDataClasses: ["source"],
+    sdks: {
+      npm: ["@octokit/rest", "octokit"],
+      pypi: ["pygithub"],
+      go: ["github.com/google/go-github"],
+      maven: ["org.kohsuke.github-api"],
+      rubygems: ["octokit"],
+      cargo: ["octocrab"],
+      composer: ["knplabs/github-api"],
+      nuget: ["Octokit"]
+    }
+  },
+  {
+    id: "gitlab",
+    name: "GitLab",
+    category: "Developer platform",
+    hostSuffixes: ["gitlab.com"],
+    apiBase: "https://gitlab.com/api",
+    defaultDataClasses: ["source"],
+    sdks: {
+      npm: ["@gitbeaker/rest"],
+      pypi: ["python-gitlab"],
+      go: ["gitlab.com/gitlab-org/api/client-go"],
+      rubygems: ["gitlab"],
+      nuget: ["GitLabApiClient"]
+    }
+  },
+  {
+    id: "auth0",
+    name: "Auth0",
+    category: "Identity",
+    hostSuffixes: ["auth0.com"],
+    apiBase: "https://login.auth0.com",
+    defaultDataClasses: ["pii"],
+    sdks: {
+      npm: ["auth0"],
+      pypi: ["auth0-python"],
+      go: ["github.com/auth0/go-auth0"],
+      maven: ["com.auth0"],
+      rubygems: ["auth0"],
+      composer: ["auth0/auth0-php"],
+      nuget: ["Auth0.ManagementApi"]
+    }
+  },
+  {
+    id: "okta",
+    name: "Okta",
+    category: "Identity",
+    hostSuffixes: ["okta.com", "oktapreview.com"],
+    apiBase: "https://login.okta.com",
+    defaultDataClasses: ["pii"],
+    sdks: {
+      npm: ["@okta/okta-sdk-nodejs"],
+      pypi: ["okta"],
+      go: ["github.com/okta/okta-sdk-golang"],
+      maven: ["com.okta.sdk"],
+      nuget: ["Okta.Sdk"]
+    }
+  },
+  {
+    id: "clerk",
+    name: "Clerk",
+    category: "Identity",
+    hostSuffixes: ["clerk.com", "clerk.dev"],
+    apiBase: "https://api.clerk.com",
+    defaultDataClasses: ["pii"],
+    sdks: {
+      npm: ["@clerk/backend", "@clerk/nextjs"],
+      pypi: ["clerk-backend-api"],
+      go: ["github.com/clerk/clerk-sdk-go"]
+    }
+  },
+  {
+    id: "supabase",
+    name: "Supabase",
+    category: "Backend platform",
+    hostSuffixes: ["supabase.co", "supabase.com"],
+    apiBase: "https://api.supabase.com",
+    defaultDataClasses: ["pii", "customer"],
+    sdks: {
+      npm: ["@supabase/supabase-js"],
+      pypi: ["supabase"],
+      cargo: ["postgrest"]
+    }
+  },
+  {
+    id: "firebase",
+    name: "Firebase",
+    category: "Backend platform",
+    hostSuffixes: ["firebaseio.com", "firebase.google.com"],
+    apiBase: "https://firebaseio.com",
+    defaultDataClasses: ["customer"],
+    sdks: {
+      npm: ["firebase", "firebase-admin"],
+      pypi: ["firebase-admin"],
+      go: ["firebase.google.com/go"],
+      maven: ["com.google.firebase"]
+    }
+  },
+  {
+    id: "mongodb-atlas",
+    name: "MongoDB Atlas",
+    category: "Database SaaS",
+    hostSuffixes: ["mongodb.net", "mongodb.com"],
+    apiBase: "https://cloud.mongodb.com",
+    defaultDataClasses: ["customer"],
+    sdks: {
+      npm: ["mongodb"],
+      pypi: ["pymongo"],
+      go: ["go.mongodb.org/mongo-driver"],
+      maven: ["org.mongodb"],
+      rubygems: ["mongo"],
+      cargo: ["mongodb"],
+      nuget: ["MongoDB.Driver"]
+    }
+  },
+  {
+    id: "planetscale",
+    name: "PlanetScale",
+    category: "Database SaaS",
+    hostSuffixes: ["psdb.cloud", "planetscale.com"],
+    apiBase: "https://api.planetscale.com",
+    defaultDataClasses: ["customer"],
+    sdks: {
+      npm: ["@planetscale/database"],
+      go: ["github.com/planetscale/planetscale-go"]
+    }
+  },
+  {
+    id: "algolia",
+    name: "Algolia",
+    category: "Search SaaS",
+    hostSuffixes: ["algolia.net", "algolianet.com"],
+    apiBase: "https://algolia.net",
+    defaultDataClasses: ["customer"],
+    sdks: {
+      npm: ["algoliasearch"],
+      pypi: ["algoliasearch"],
+      go: ["github.com/algolia/algoliasearch-client-go"],
+      maven: ["com.algolia"],
+      rubygems: ["algolia"],
+      composer: ["algolia/algoliasearch-client-php"],
+      nuget: ["Algolia.Search"]
+    }
+  },
+  {
+    id: "cloudflare",
+    name: "Cloudflare",
+    category: "CDN / edge",
+    hostSuffixes: ["cloudflare.com", "workers.dev"],
+    apiBase: "https://api.cloudflare.com",
+    defaultDataClasses: ["logs"],
+    sdks: {
+      npm: ["cloudflare"],
+      pypi: ["cloudflare"],
+      go: ["github.com/cloudflare/cloudflare-go"],
+      nuget: ["CloudFlare.Client"]
+    }
+  },
+  {
+    id: "huggingface",
+    name: "Hugging Face",
+    category: "LLM provider",
+    hostSuffixes: ["huggingface.co"],
+    apiBase: "https://api-inference.huggingface.co",
+    defaultDataClasses: ["source"],
+    sdks: {
+      npm: ["@huggingface/inference"],
+      pypi: ["huggingface-hub", "transformers"],
+      rubygems: ["hugging-face"]
+    }
+  },
+  {
+    id: "cohere",
+    name: "Cohere",
+    category: "LLM provider",
+    hostSuffixes: ["cohere.com", "cohere.ai"],
+    apiBase: "https://api.cohere.com",
+    defaultDataClasses: ["pii", "source"],
+    sdks: {
+      npm: ["cohere-ai"],
+      pypi: ["cohere"],
+      go: ["github.com/cohere-ai/cohere-go"]
+    }
+  },
+  {
+    id: "mistral",
+    name: "Mistral AI",
+    category: "LLM provider",
+    hostSuffixes: ["mistral.ai"],
+    apiBase: "https://api.mistral.ai",
+    defaultDataClasses: ["pii", "source"],
+    sdks: {
+      npm: ["@mistralai/mistralai"],
+      pypi: ["mistralai"],
+      go: ["github.com/gage-technologies/mistral-go"]
+    }
+  }
+];
+var EGRESS_VERSION_MATERIAL = `${EXTRACTOR_VERSION}
+${JSON.stringify(PROVIDER_REGISTRY)}`;
+
+// ../../packages/detections/src/egress/extract.ts
+var SECRET_KEY_NAMES = "api[_-]?key|apikey|private[_-]?key|access[_-]?key|access[_-]?token|token|secret|credentials?|password|passwd|pwd|authorization|sig|signature|sas|assertion";
+var AUTH_SCHEMES = "Bearer|Basic|Token|Digest|ApiKey|SSWS|AWS4-HMAC-SHA256";
+var SECRET_VALUE = new RegExp(
+  `((?:${SECRET_KEY_NAMES})['"\`]?\\s*[:=]\\s*['"\`]?)(?!(?:${AUTH_SCHEMES})[\\s'"\`])[^\\s'"\`&]+`,
+  "gi"
+);
+var AUTH_SCHEME_VALUE = new RegExp(
+  `((?:${SECRET_KEY_NAMES})['"\`]?\\s*[:=]\\s*['"\`]?)(${AUTH_SCHEMES})\\s+[^\\s'"\`]+`,
+  "gi"
+);
+var WEBHOOK_SECRET_PATHS = [
+  { hosts: ["hooks.slack.com"], prefix: "/services/" },
+  {
+    hosts: ["discord.com", "discordapp.com", "ptb.discord.com", "canary.discord.com"],
+    prefix: "/api/webhooks/"
+  },
+  { hosts: ["hooks.zapier.com"], prefix: "/hooks/" },
+  { hosts: ["outlook.office.com", "outlook.office365.com"], prefix: "/webhook/" }
+];
+function escapeRegExp(literal2) {
+  return literal2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+var WEBHOOK_URL = new RegExp(
+  `(https?://(?:${WEBHOOK_SECRET_PATHS.flatMap(
+    (entry) => entry.hosts.map((host) => `${escapeRegExp(host)}${escapeRegExp(entry.prefix)}`)
+  ).join("|")}))[^\\s'"\`<>()[\\]{},;]+`,
+  "gi"
+);
 
 // ../../packages/detections/src/escape-regexp.ts
-function escapeRegExp(value) {
+function escapeRegExp2(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
 // ../../packages/detections/src/matchers/limits.ts
 var MAX_MATCHES_PER_RULE = 1e4;
+var MAX_REGEX_INPUT_LENGTH = 2e5;
 
 // ../../packages/detections/src/matchers/keyword.ts
 var KeywordMatcher2 = class {
@@ -22935,7 +24445,7 @@ var KeywordMatcher2 = class {
     for (const kw of keywords) {
       if (kw.length === 0) continue;
       if (spans.length >= MAX_MATCHES_PER_RULE) break;
-      const re = new RegExp(escapeRegExp(kw), caseSensitive ? "gu" : "giu");
+      const re = new RegExp(escapeRegExp2(kw), caseSensitive ? "gu" : "giu");
       let m;
       while ((m = re.exec(text)) !== null) {
         spans.push({ start: m.index, end: m.index + m[0].length });
@@ -22952,9 +24462,13 @@ var RegexMatcher2 = class {
     if (rule.matcher.type !== "regex") return [];
     const { pattern, flags, captureGroup } = rule.matcher;
     const re = new RegExp(pattern, flags.includes("d") ? flags : `${flags}d`);
+    const scanText2 = text.length > MAX_REGEX_INPUT_LENGTH ? text.slice(0, MAX_REGEX_INPUT_LENGTH) : text;
     const spans = [];
     let m;
-    while ((m = re.exec(text)) !== null) {
+    const maxIterations = scanText2.length + 1;
+    let iterations = 0;
+    while ((m = re.exec(scanText2)) !== null) {
+      if (++iterations > maxIterations) break;
       const group = captureGroup != null ? m[captureGroup] : m[0];
       if (m[0].length === 0) re.lastIndex++;
       if (group && spans.length < MAX_MATCHES_PER_RULE) {
@@ -23058,7 +24572,7 @@ function isCorroborated(candidate, candidates, text) {
     for (const label of labels) {
       const trimmed = label.trim();
       if (trimmed.length === 0) continue;
-      const re = new RegExp(`(?<![A-Za-z0-9])${escapeRegExp(trimmed)}(?![A-Za-z0-9])`, "i");
+      const re = new RegExp(`(?<![A-Za-z0-9])${escapeRegExp2(trimmed)}(?![A-Za-z0-9])`, "i");
       if (re.test(haystack)) return true;
     }
   }
@@ -23223,6 +24737,112 @@ var CONFIG_POSTURE_RULES = [
   }
 ];
 
+// ../../packages/detections/src/security/redos-probe.ts
+var BUDGET_MS = 100;
+var EXPONENTIAL_UNITS = [
+  "a",
+  "0",
+  " ",
+  "x",
+  "ab",
+  "a.",
+  "a-",
+  "a_",
+  "a@",
+  "a/",
+  "a:",
+  "a=",
+  "a;",
+  "aA0",
+  "	"
+];
+var EXPONENTIAL_PROBES = EXPONENTIAL_UNITS.flatMap(
+  (unit) => [23, 25].map((len) => unit.repeat(Math.ceil(len / unit.length)).slice(0, len) + "!")
+);
+var POLYNOMIAL_PROBES = ["abc-", "a.", "a ", "a=", "x", "0", "a@", "a/", "ab"].map(
+  (unit) => unit.repeat(1e4).slice(0, 4e4) + "!"
+);
+function literalPrefix(pattern) {
+  let prefix = "";
+  let i = 0;
+  if (pattern[i] === "^") i++;
+  while (i < pattern.length) {
+    const c = pattern[i];
+    if (c === void 0) break;
+    if (c === "\\") {
+      const next = pattern[i + 1];
+      if (next === "b" || next === "B") {
+        i += 2;
+        continue;
+      }
+      if (next === void 0 || /[dDwWsSnrtfv.]/.test(next)) break;
+      prefix += next;
+      i += 2;
+      continue;
+    }
+    if ("([{.*+?|)]}^$".includes(c)) break;
+    prefix += c;
+    i++;
+  }
+  return prefix;
+}
+function fuelChars(pattern) {
+  const fuel = /* @__PURE__ */ new Set();
+  for (const m of pattern.matchAll(/\[\^?([^\]]+)\]/g)) {
+    const body = m[1];
+    if (body === void 0) continue;
+    const range = /([A-Za-z0-9])-[A-Za-z0-9]/.exec(body);
+    const rangeStart = range?.[1];
+    if (rangeStart !== void 0) fuel.add(rangeStart);
+    else {
+      const literal2 = body.replace(/\\/g, "")[0];
+      if (literal2 !== void 0 && literal2 !== "^") fuel.add(literal2);
+    }
+  }
+  if (pattern.includes("\\w")) fuel.add("a");
+  if (pattern.includes("\\d")) fuel.add("0");
+  if (pattern.includes("\\s")) fuel.add(" ");
+  if (/(?<!\\)\./.test(pattern)) fuel.add("a");
+  if (fuel.size === 0) fuel.add("a");
+  return [...fuel];
+}
+function derivedProbes(pattern) {
+  const prefix = literalPrefix(pattern);
+  const fuel = fuelChars(pattern);
+  const terminators = ["!", "#", "~", "\n"];
+  const probes = [];
+  for (const f of fuel) {
+    for (const term of terminators) {
+      if (term === f) continue;
+      for (const len of [23, 25]) probes.push(prefix + f.repeat(len) + term);
+    }
+  }
+  return probes;
+}
+function probesFor(rule) {
+  const derived = rule.matcher.type === "regex" ? derivedProbes(rule.matcher.pattern) : [];
+  return [...derived, ...EXPONENTIAL_PROBES, ...POLYNOMIAL_PROBES];
+}
+function worstProbeMs(rule) {
+  let ms = 0;
+  let probe = "";
+  for (const text of probesFor(rule)) {
+    const start = performance.now();
+    scan(text, [rule]);
+    const elapsed = performance.now() - start;
+    if (elapsed > ms) {
+      ms = elapsed;
+      probe = text;
+    }
+    if (ms >= BUDGET_MS) break;
+  }
+  return { ms, probe };
+}
+function checkRuleTiming(rule) {
+  const { ms, probe } = worstProbeMs(rule);
+  return { safe: ms < BUDGET_MS, worstMs: ms, probe };
+}
+
 // ../../rules/code-flaws/auth-jwt-no-verify.json
 var auth_jwt_no_verify_default = {
   specVersion: 1,
@@ -25259,8 +26879,8 @@ function uniqueRuleIds(findings) {
 }
 
 // ../../packages/plugin-sdk/src/repo.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3, statSync } from "fs";
-import { basename, dirname, isAbsolute, join as join6, sep as sep2 } from "path";
+import { existsSync as existsSync4, readFileSync as readFileSync3, statSync } from "fs";
+import { basename, dirname, isAbsolute, join as join7, sep as sep2 } from "path";
 function resolveRepo(cwd) {
   try {
     const root = findGitRoot(cwd);
@@ -25275,32 +26895,32 @@ function resolveRepo(cwd) {
 function findGitRoot(start) {
   let dir = start;
   for (; ; ) {
-    if (existsSync3(join6(dir, ".git"))) return dir;
+    if (existsSync4(join7(dir, ".git"))) return dir;
     const parent = dirname(dir);
     if (parent === dir) return void 0;
     dir = parent;
   }
 }
 function resolveGitContext(root) {
-  const dotGit = join6(root, ".git");
+  const dotGit = join7(root, ".git");
   try {
     if (statSync(dotGit).isDirectory()) {
-      return { configPath: join6(dotGit, "config"), headRoot: root };
+      return { configPath: join7(dotGit, "config"), headRoot: root };
     }
   } catch {
     return void 0;
   }
   const target = /^gitdir:\s*(.+?)\s*$/m.exec(safeRead(dotGit) ?? "")?.[1];
   if (!target) return void 0;
-  const gitdir = isAbsolute(target) ? target : join6(root, target);
-  if (existsSync3(join6(gitdir, "config"))) {
-    return { configPath: join6(gitdir, "config"), headRoot: root };
+  const gitdir = isAbsolute(target) ? target : join7(root, target);
+  if (existsSync4(join7(gitdir, "config"))) {
+    return { configPath: join7(gitdir, "config"), headRoot: root };
   }
-  const commonRaw = safeRead(join6(gitdir, "commondir"))?.trim();
+  const commonRaw = safeRead(join7(gitdir, "commondir"))?.trim();
   if (!commonRaw) return void 0;
-  const commonGitDir = isAbsolute(commonRaw) ? commonRaw : join6(gitdir, commonRaw);
+  const commonGitDir = isAbsolute(commonRaw) ? commonRaw : join7(gitdir, commonRaw);
   const headRoot = basename(commonGitDir) === ".git" ? dirname(commonGitDir) : root;
-  return { configPath: join6(commonGitDir, "config"), headRoot };
+  return { configPath: join7(commonGitDir, "config"), headRoot };
 }
 function safeRead(path) {
   try {
@@ -25342,9 +26962,9 @@ function slugFromUrl(url2) {
 }
 
 // ../../packages/plugin-sdk/src/events.ts
-import { createHash as createHash3, randomUUID as randomUUID9 } from "crypto";
+import { createHash as createHash4, randomUUID as randomUUID9 } from "crypto";
 function contentHashOf(text) {
-  return createHash3("sha256").update(text).digest("hex");
+  return createHash4("sha256").update(text).digest("hex");
 }
 function buildIngestEvent(input) {
   return {
@@ -25364,27 +26984,74 @@ function buildIngestEvent(input) {
   };
 }
 
-// ../../packages/plugin-sdk/src/finding-key.ts
-import { createHash as createHash4 } from "crypto";
-function normalizeFilePath(filePath) {
-  return filePath.replaceAll("\\", "/");
-}
-function computeFindingKey(input) {
-  const normalizedPath = normalizeFilePath(input.filePath);
-  return createHash4("sha256").update(`${input.ruleId}\0${normalizedPath}\0${input.valueFingerprint}`).digest("hex");
-}
-
 // ../../packages/plugin-sdk/src/inventory-resolver.ts
 import { arch, hostname as hostname3, platform, release } from "os";
 
 // ../../packages/plugin-sdk/src/nudge.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
-import { join as join8 } from "path";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
+import { join as join9 } from "path";
+
+// ../../packages/plugin-sdk/src/paths.ts
+import { readdirSync as readdirSync2, realpathSync as realpathSync2 } from "fs";
+import { basename as basename3, dirname as dirname2, sep as sep3 } from "path";
 
 // ../../packages/plugin-sdk/src/project-files.ts
 var import_ignore = __toESM(require_ignore(), 1);
-import { existsSync as existsSync4, readdirSync as readdirSync2, readFileSync as readFileSync6 } from "fs";
-import { basename as basename3, join as join9, relative, sep as sep3 } from "path";
+import { existsSync as existsSync5, readdirSync as readdirSync3, readFileSync as readFileSync6 } from "fs";
+import { basename as basename4, join as join10, relative, sep as sep4 } from "path";
+
+// ../../packages/plugin-sdk/src/rule-quarantine.ts
+var PASS_BUDGET_MS = 2e3;
+function ruleProbeKey(rule) {
+  if (rule.matcher.type !== "regex") return void 0;
+  return contentHashOf(`${rule.matcher.pattern} ${rule.matcher.flags}`);
+}
+function warnQuarantined(rule, worstMs) {
+  const timing = worstMs === void 0 ? "not verified in time" : `${worstMs.toFixed(1)}ms`;
+  process.stderr.write(
+    `[aka] quarantined rule "${rule.id}": regex matcher exceeded the ReDoS timing budget (${timing}); excluded from this scan.
+`
+  );
+}
+async function filterUnsafeRules(rules, gateway, opts) {
+  const passBudgetMs = opts?.passBudgetMs ?? PASS_BUDGET_MS;
+  const passStart = performance.now();
+  const safe = [];
+  for (const rule of rules) {
+    const key = ruleProbeKey(rule);
+    if (key === void 0) {
+      safe.push(rule);
+      continue;
+    }
+    let cached2;
+    try {
+      cached2 = await gateway.getRuleProbeVerdict(key);
+    } catch {
+      cached2 = void 0;
+    }
+    if (cached2) {
+      if (cached2.verdict === "safe") safe.push(rule);
+      else warnQuarantined(rule, cached2.worstProbeMs);
+      continue;
+    }
+    if (performance.now() - passStart >= passBudgetMs) {
+      warnQuarantined(rule, void 0);
+      continue;
+    }
+    let isSafe;
+    let worstMs;
+    try {
+      ({ safe: isSafe, worstMs } = checkRuleTiming(rule));
+    } catch {
+      isSafe = false;
+      worstMs = Number.POSITIVE_INFINITY;
+    }
+    await gateway.setRuleProbeVerdict(key, isSafe ? "safe" : "quarantined", worstMs);
+    if (isSafe) safe.push(rule);
+    else warnQuarantined(rule, worstMs);
+  }
+  return safe;
+}
 
 // ../../packages/plugin-sdk/src/runtime.ts
 import { randomUUID as randomUUID10 } from "crypto";
@@ -25428,7 +27095,17 @@ function createPluginRuntime(gateway, settings, opts) {
         categoryActionIndex.set(p.target.category, p.action);
       }
     }
-    rules = bundle.rulesComplete ? bundle.rules ?? [] : [...getLoadedRules(), ...bundle.rules ?? []];
+    const bundledProbeKeys = new Set(
+      getLoadedRules().map(ruleProbeKey).filter((key) => key !== void 0)
+    );
+    const incoming = bundle.rules ?? [];
+    const ciVerified = incoming.filter((rule) => {
+      const key = ruleProbeKey(rule);
+      return key !== void 0 && bundledProbeKeys.has(key);
+    });
+    const needsGate = incoming.filter((rule) => !ciVerified.includes(rule));
+    const safeBundleRules = [...ciVerified, ...await filterUnsafeRules(needsGate, gateway)];
+    rules = bundle.rulesComplete ? safeBundleRules : [...getLoadedRules(), ...safeBundleRules];
     bundleExceptions = bundle.exceptions ?? [];
     initialized = true;
   }
@@ -25671,8 +27348,8 @@ function createPluginRuntime(gateway, settings, opts) {
 var THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1e3;
 
 // ../../packages/plugin-sdk/src/throttle.ts
-import { mkdirSync as mkdirSync4, statSync as statSync3, writeFileSync as writeFileSync5 } from "fs";
-import { join as join10 } from "path";
+import { mkdirSync as mkdirSync3, statSync as statSync3, writeFileSync as writeFileSync4 } from "fs";
+import { join as join11 } from "path";
 
 // ../../packages/plugin-runtime/src/standalone-gateway.ts
 import { randomUUID as randomUUID11 } from "crypto";
@@ -25703,7 +27380,8 @@ var StandaloneDataGateway = class {
   }
   // The id is minted inside the repository from the natural key — the plugin can't
   // import @akasecurity/persistence to compute it, so the gateway is the boundary that
-  // hands the natural key across. INSERT OR IGNORE → idempotent re-reads.
+  // hands the natural key across. UPSERT-take-MAX → idempotent re-reads that also
+  // converge a streaming partial/final split (see insertLlmCall).
   recordLlmCall(input) {
     this.db.auditEvents.insertLlmCall(input);
     return Promise.resolve();
@@ -25745,7 +27423,9 @@ var StandaloneDataGateway = class {
   // caller's transaction (Layer 2b). The audit-event id the findings FK into is the
   // SAME content-addressed `toolCallId` the leaf insert mints, so both re-read
   // idempotently. Definitions/classified-data are idempotent upserts; findings are
-  // content-addressed INSERT OR IGNORE.
+  // content-addressed upserts (ON CONFLICT(id) DO UPDATE SET inspection_definition_id),
+  // so a re-detection under a bumped rule version repoints the definition FK rather
+  // than no-opping.
   writeToolCall(input) {
     this.db.auditEvents.insertToolCall(input);
     if (input.inspections.length === 0) return;
@@ -25765,7 +27445,7 @@ var StandaloneDataGateway = class {
       });
       const classifiedDataId2 = this.db.classifiedData.upsert({ class: insp.category });
       this.db.inspectionFindings.insertFinding({
-        id: inspectionFindingId(auditEventId, definitionId, insp.span.start, insp.span.end),
+        id: inspectionFindingId(auditEventId, insp.ruleId, insp.span.start, insp.span.end),
         auditEventId,
         inspectionDefinitionId: definitionId,
         classifiedDataId: classifiedDataId2,
@@ -25814,10 +27494,17 @@ var StandaloneDataGateway = class {
     try {
       const snapshot = this.db.installedPacks.installedRuleset();
       if (snapshot.installedPacks === 0) return void 0;
-      if (snapshot.enabledPacks === 0) return { rules: [], ruleActions: /* @__PURE__ */ new Map(), complete: true };
+      if (snapshot.enabledPacks === 0) {
+        return { rules: [], ruleActions: /* @__PURE__ */ new Map(), ruleVersions: /* @__PURE__ */ new Map(), complete: true };
+      }
       if (snapshot.invalidRules > 0) return void 0;
       if (snapshot.rules.length === 0) return void 0;
-      return { rules: snapshot.rules, ruleActions: snapshot.ruleActions, complete: true };
+      return {
+        rules: snapshot.rules,
+        ruleActions: snapshot.ruleActions,
+        ruleVersions: snapshot.ruleVersions,
+        complete: true
+      };
     } catch {
       return void 0;
     }
@@ -25845,6 +27532,7 @@ var StandaloneDataGateway = class {
       policies: [...policies, ...rulePolicies],
       rules: installed ? installed.rules : [],
       ...installed ? { rulesComplete: true } : {},
+      ...installed ? { ruleVersions: Object.fromEntries(installed.ruleVersions) } : {},
       ...exceptions !== void 0 ? { exceptions } : {},
       customKeywords,
       fetchedAt: (/* @__PURE__ */ new Date()).toISOString()
@@ -25943,6 +27631,13 @@ var StandaloneDataGateway = class {
     this.db.scanLedger.upsertEntries(entries);
     return Promise.resolve();
   }
+  getRuleProbeVerdict(ruleKey) {
+    return Promise.resolve(this.db.ruleProbeCache.getVerdict(ruleKey));
+  }
+  setRuleProbeVerdict(ruleKey, verdict, worstProbeMs2) {
+    this.db.ruleProbeCache.setVerdict(ruleKey, verdict, worstProbeMs2);
+    return Promise.resolve();
+  }
   openAtRestKeysForPath(path) {
     return Promise.resolve(this.db.resolutions.openAtRestKeysForPath(path));
   }
@@ -25953,6 +27648,12 @@ var StandaloneDataGateway = class {
     this.db.resolutions.insertResolution(input);
     return Promise.resolve();
   }
+  // Bare forward — no toggle read here. The plugin-path kill-switch is
+  // enforced by the caller, which already holds the parsed workspace
+  // settings; this class only ever sees `dataDir`, not the settings base.
+  recordProjectEgress(input) {
+    return Promise.resolve(this.db.shares.recordProjectEgress(input));
+  }
   close() {
     this.db.close();
     return Promise.resolve();
@@ -26141,13 +27842,23 @@ function responseEmitPayload(toolName, outcome) {
 async function readStdin() {
   return new Promise((resolve) => {
     let data = "";
-    process.stdin.setEncoding("utf8");
-    process.stdin.on("data", (chunk) => {
-      data += chunk;
-    });
-    process.stdin.on("end", () => {
+    let settled = false;
+    const finish = () => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      process.stdin.removeListener("data", onData);
+      process.stdin.removeListener("end", finish);
       resolve(data);
-    });
+    };
+    const onData = (chunk) => {
+      data += chunk;
+    };
+    const timer = setTimeout(finish, 5e3);
+    process.stdin.setEncoding("utf8");
+    process.stdin.on("data", onData);
+    process.stdin.on("end", finish);
+    process.stdin.on("error", finish);
   });
 }
 function parseJson(raw) {
@@ -26164,9 +27875,14 @@ function getString(record2, key) {
 }
 function emit(output) {
   return new Promise((resolve) => {
-    process.stdout.write(JSON.stringify(output), () => {
+    let settled = false;
+    const finish = () => {
+      if (settled) return;
+      settled = true;
       resolve();
-    });
+    };
+    process.stdout.on("error", finish);
+    process.stdout.write(JSON.stringify(output), finish);
   });
 }
 function baseMetadata(input) {