@akasecurity/ai-tc-claude-code 0.9.10 → 0.9.12

package/scripts/scan-worker.js

@@ -20630,6 +20630,15 @@ var FindingCategory = external_exports.enum([
 ]).meta({ id: "FindingCategory" });
 var FindingOrigin = external_exports.enum(["in-flight", "at-rest"]).meta({ id: "FindingOrigin" });
 var FindingStatus = external_exports.enum(["open", "handled", "resolved", "dismissed"]).meta({ id: "FindingStatus" });
+var SyncFailureReason = external_exports.enum(["deployment_refused", "payload_invalid", "detached_undelivered"]).meta({ id: "SyncFailureReason" });
+var FindingDeliveryState = external_exports.enum(["sent", "queued", "not_sent", "never_offered", "local_scan"]).meta({ id: "FindingDeliveryState" });
+var FindingDelivery = external_exports.object({
+  state: FindingDeliveryState,
+  // The delivery time for `sent`; the failure time for `not_sent` when recorded.
+  at: external_exports.iso.datetime().optional(),
+  // Only on `not_sent`, and only when a known reason was recorded.
+  reason: SyncFailureReason.optional()
+}).meta({ id: "FindingDelivery" });
 var ResolutionMethod = external_exports.enum([
   "enforced-in-flight",
   "fixed-at-source",
@@ -20686,7 +20695,10 @@ var FindingInstance = external_exports.object({
   // The session that event belongs to, when it has one — the seam a
   // per-instance "view session" link needs. Absent for events captured
   // outside a session.
-  sessionId: external_exports.string().optional()
+  sessionId: external_exports.string().optional(),
+  // The delivery state of the event above (see FindingDelivery). Optional so
+  // readers that do not project it stay valid.
+  delivery: FindingDelivery.optional()
 }).meta({ id: "FindingInstance" });
 var FindingGroup = external_exports.object({
   id: external_exports.string(),
@@ -20703,13 +20715,11 @@ var FindingGroup = external_exports.object({
   latestDetectedAt: external_exports.iso.datetime(),
   instances: external_exports.array(FindingInstance),
   // Derived from instances' statuses with open-dominates precedence (see
-  // buildFindingGroups). Undefined only when no instance carries a status.
+  // foldGroupStatus). Undefined only when no instance carries a status.
   status: FindingStatus.optional(),
-  // The distinct people across the WHOLE group, not just the `instances`
-  // preview — from the store's whole-group aggregate when it supplies one,
-  // else folded from the rows (see buildFindingGroups). Undefined when no
-  // instance carries a user, or when the store supplied whole-group folds
-  // without one.
+  // The distinct people across the WHOLE group, not just the instances
+  // carried here. Undefined when no instance carries a user, or when the
+  // store supplied whole-group folds without one.
   users: external_exports.array(FindingUser).optional()
 }).meta({ id: "FindingGroup" });
 var FindingStats = external_exports.object({
@@ -20738,20 +20748,33 @@ var FindingFacets = external_exports.object({
   // counted under no value.
   status: external_exports.array(FindingFacetItem),
   // Host tool (attributes.tool_name). Present only on the instance-level
-  // reads, which can filter by it; the grouped read omits the dimension
+  // reads, which can filter by it; the type-level read omits the dimension
   // because a group spans tools.
-  tool: external_exports.array(FindingFacetItem).optional()
+  tool: external_exports.array(FindingFacetItem).optional(),
+  // Delivery states (FindingDeliveryState). Present only on the
+  // instance-level reads, like `tool`.
+  deployment: external_exports.array(FindingFacetItem).optional()
 }).meta({ id: "FindingFacets" });
-var ListGroupedFindingsQuery = external_exports.object({
+var FindingTypeSummary = FindingGroup.omit({ instances: true, match: true }).meta({
+  id: "FindingTypeSummary"
+});
+var MAX_FINDING_TYPES_LIMIT = 100;
+var ListFindingTypesQuery = external_exports.object({
   // NOTE: severity filters by Severity (critical/high/medium/low), not by
-  // FindingAction.
+  // FindingAction. It narrows TYPES: a type's severity is the one its newest
+  // firing version carries, and this list pages types.
+  //
+  // That is NOT a claim the findings of a type share it. A rule can hold several
+  // definition versions at different severities, so a type kept by this filter
+  // can hold findings that individually do not match — see totals.findings on
+  // ListFindingTypesResponse, which counts them all.
   severity: external_exports.array(Severity).optional(),
   subtype: external_exports.array(external_exports.string()).optional(),
   provider: external_exports.array(FindingProvider).optional(),
   action: external_exports.array(FindingAction).optional(),
-  // Matches a group's DERIVED status (see FindingGroup.status), not its
-  // individual instances' — so a filtered group's Status column always reads
-  // one of the requested values.
+  // Matches a type's DERIVED status (see FindingGroup.status), not its
+  // individual findings' — so a filtered row's status always reads one of the
+  // requested values.
   status: external_exports.array(FindingStatus).optional(),
   q: external_exports.string().optional(),
   // Scope to findings whose event carries this session id (the Activity page's
@@ -20761,23 +20784,37 @@ var ListGroupedFindingsQuery = external_exports.object({
   // from a time-scoped page (Activity's range) can carry that scope. Absent
   // means all time — this list has no default window.
   from: external_exports.iso.datetime().optional(),
-  // A group or instance id that must appear in the page even when the cursor
-  // has already advanced past its sort position. This is what keeps the
-  // Findings page's one-shot ?finding= deep link resolving once the list
-  // paginates: the target group is appended out of sort order rather than
-  // scanning forward for it. Never affects totals, facets or the cursor.
+  // A RULE id that must appear in the page even when the cursor has already
+  // advanced past its sort position. This is what keeps the selected type
+  // visible in the list once it paginates: the target is appended out of sort
+  // order rather than scanned forward for. Never affects totals, facets or the
+  // cursor. Unlike the grouped read this replaces, it names a rule only — an
+  // instance id is resolved by `findingInstance`, which is a primary-key seek
+  // and so is not bounded by what any page happens to hold.
   includeId: external_exports.string().optional(),
-  groupBy: external_exports.literal("type").optional(),
-  limit: external_exports.coerce.number().int().min(1).max(100).optional(),
+  limit: external_exports.coerce.number().int().min(1).max(MAX_FINDING_TYPES_LIMIT).optional(),
   cursor: external_exports.string().optional()
 });
-var ListGroupedFindingsResponse = external_exports.object({
+var ListFindingTypesResponse = external_exports.object({
   totals: external_exports.object({
+    // Findings belonging to the matching TYPES — not findings that each match
+    // the filters. The filters here select types, so a type that survives
+    // contributes its whole instanceCount.
+    //
+    // `status` is the one exception, narrowed per finding via
+    // countInstancesByStatus. `severity`, `provider` and `action` are not, so
+    // this can exceed what the instance read reports for the same filters: a
+    // rule whose severity moved between versions is kept on its newest and
+    // still counts its older findings. Narrowing the other three needs
+    // per-dimension counts the aggregate does not carry today.
     findings: external_exports.number().int().nonnegative(),
-    groups: external_exports.number().int().nonnegative()
+    // Counts TYPES, which is the unit this read pages. The instance read's
+    // own totals count findings; the two deliberately answer different
+    // questions and are never summed.
+    types: external_exports.number().int().nonnegative()
   }),
   facets: FindingFacets,
-  items: external_exports.array(FindingGroup),
+  items: external_exports.array(FindingTypeSummary),
   nextCursor: external_exports.string().nullable(),
   // Present only on session-scoped queries (`sessionId` set): per ruleId, how
   // many times that rule fired in the session's persisted transcript. Findings
@@ -20785,7 +20822,7 @@ var ListGroupedFindingsResponse = external_exports.object({
   // every firing, so the two numbers legitimately differ — this map lets a
   // session-scoped view show both.
   sessionFirings: external_exports.record(external_exports.string(), external_exports.number().int().nonnegative()).optional()
-}).meta({ id: "ListGroupedFindingsResponse" });
+}).meta({ id: "ListFindingTypesResponse" });
 var ApplyFindingActionRequest = external_exports.object({
   // 'quarantined' is system-assigned (see FindingAction) — clients may not set
   // it, so it is excluded from the request contract. The mapping helper
@@ -20814,16 +20851,19 @@ var FindingInstanceDetail = FindingInstance.extend({
 var MAX_FLAT_FINDINGS_LIMIT = 200;
 var ListFindingInstancesQuery = external_exports.object({
   severity: external_exports.array(Severity).optional(),
-  // Rule ids, the same vocabulary the grouped list's `subtype` carries.
+  // Rule ids, the same vocabulary the types list's `subtype` carries. Pinning
+  // ONE of them is how the master/detail view scopes its right-hand panel.
   subtype: external_exports.array(external_exports.string()).optional(),
   provider: external_exports.array(FindingProvider).optional(),
   action: external_exports.array(FindingAction).optional(),
   // Matches each instance's OWN derived status (deriveFindingStatus), unlike
-  // the grouped query's group-level fold.
+  // the types query's type-level fold.
   status: external_exports.array(FindingStatus).optional(),
   // Exact host-tool names (attributes.tool_name, e.g. 'Bash'). A real filter,
   // where the free-text `q` can only match the rendered "via Bash" label.
   tool: external_exports.array(external_exports.string()).optional(),
+  // The delivery state of each finding's event (see FindingDelivery).
+  deployment: external_exports.array(FindingDeliveryState).optional(),
   // Exact repository / file-path matches, for the drill-down out of the
   // locations view. A row whose event carries no repo/file matches neither.
   repo: external_exports.string().optional(),
@@ -20836,37 +20876,50 @@ var ListFindingInstancesQuery = external_exports.object({
 });
 var ListFindingInstancesResponse = external_exports.object({
   // Instances matching the filters across the whole scope, not just this
-  // page — cursor-independent, like the grouped list's totals.
+  // page — cursor-independent, like the types list's totals.
   totals: external_exports.object({ findings: external_exports.number().int().nonnegative() }),
-  // Counts in INSTANCES here, where the grouped response counts groups. Each
+  // Counts in INSTANCES here, where the types response counts types. Each
   // dimension still excludes its own filter.
   facets: FindingFacets,
   items: external_exports.array(FindingInstanceDetail),
   nextCursor: external_exports.string().nullable()
 }).meta({ id: "ListFindingInstancesResponse" });
-var FindingLocationFile = external_exports.object({
-  // Empty when the instances carried no file path (a prompt or a tool call
-  // with no file attribution).
-  file: external_exports.string(),
-  instanceCount: external_exports.number().int().nonnegative(),
-  maxSeverity: Severity,
-  latestDetectedAt: external_exports.iso.datetime(),
-  // Folded from the instances' derived statuses with the same
-  // open-dominates precedence a group uses.
-  status: FindingStatus.optional(),
-  // Distinct rules seen at this location, capped — the row shows them as
-  // chips, and the count is what conveys scale.
-  ruleIds: external_exports.array(external_exports.string())
-}).meta({ id: "FindingLocationFile" });
-var FindingLocationRepo = external_exports.object({
+var ListFindingInstancesPage = external_exports.object({
+  items: external_exports.array(FindingInstanceDetail),
+  nextCursor: external_exports.string().nullable()
+}).meta({ id: "ListFindingInstancesPage" });
+var FindingLocationSummary = external_exports.object({
+  // Opaque, stable, minted from the pair by encodeLocationId. It exists
+  // because a location's identity is two values and a URL param carries one:
+  // `?loc=` names a location the way `?rule=` names a type. Only ever compared
+  // for EQUALITY — the page's selection check, this read's `includeId`, the
+  // client's page dedupe — never decoded, and never a sort key.
+  id: external_exports.string(),
   /** Empty when the instances carried no repo attribute. */
   repo: external_exports.string(),
+  // Empty when the instances carried no file path (a prompt, or a tool call
+  // with no file attribution). Both halves empty is a real location — usually
+  // the largest one in a store — and is selectable like any other.
+  file: external_exports.string(),
   instanceCount: external_exports.number().int().nonnegative(),
+  // The WORST severity present, not the first row's. It is this list's primary
+  // sort key, so it is also what explains why a row is where it is, and it is
+  // how a reader decides what to open without opening everything.
   maxSeverity: Severity,
   latestDetectedAt: external_exports.iso.datetime(),
+  // Folded from the instances' derived statuses with the same open-dominates
+  // precedence a group uses, so it answers "is anything left to do here" and
+  // not much more: a location holding 1 open among 40 resolved reads like one
+  // holding 40 open. That loss is accepted — the panel beside this list
+  // carries each finding's own status, and instanceCount sits next to the
+  // badge.
   status: FindingStatus.optional(),
-  files: external_exports.array(FindingLocationFile)
-}).meta({ id: "FindingLocationRepo" });
+  // Every distinct rule seen at this location, UNCAPPED — so the length is a
+  // tally rather than a sample and a row can say how many there are. Bounded
+  // by the ruleset, not by the store. The view bounds what it DISPLAYS.
+  ruleIds: external_exports.array(external_exports.string())
+}).meta({ id: "FindingLocationSummary" });
+var MAX_FINDING_LOCATIONS_LIMIT = 100;
 var ListFindingLocationsQuery = external_exports.object({
   severity: external_exports.array(Severity).optional(),
   subtype: external_exports.array(external_exports.string()).optional(),
@@ -20876,21 +20929,47 @@ var ListFindingLocationsQuery = external_exports.object({
   // instances that match, and folds its status from those.
   status: external_exports.array(FindingStatus).optional(),
   tool: external_exports.array(external_exports.string()).optional(),
+  // The delivery state of each finding's event (see FindingDelivery).
+  deployment: external_exports.array(FindingDeliveryState).optional(),
   q: external_exports.string().optional(),
   sessionId: external_exports.string().optional(),
   from: external_exports.iso.datetime().optional(),
-  limit: external_exports.coerce.number().int().min(1).max(500).optional()
+  // A LOCATION id (see FindingLocationSummary.id) that must appear in the page
+  // even when the cursor has already advanced past its sort position — the
+  // counterpart of ListFindingTypesQuery.includeId, and needed far more often
+  // here. Selecting a row pushes the URL, which re-renders the server and resets
+  // the client's page cache to page 0; with distinct (repo, file) pairs running
+  // into the thousands, a selection sitting off page 0 is the ordinary case
+  // rather than a deep-link corner. Never affects totals, facets or the cursor.
+  includeId: external_exports.string().optional(),
+  limit: external_exports.coerce.number().int().min(1).max(MAX_FINDING_LOCATIONS_LIMIT).optional(),
+  cursor: external_exports.string().optional()
 });
 var ListFindingLocationsResponse = external_exports.object({
   totals: external_exports.object({
+    // Findings matching the filters across the whole scope. Unlike the types
+    // read's same-named field this needs no caveat: the filters here narrow
+    // per finding, so this is the sum of every row's instanceCount.
     findings: external_exports.number().int().nonnegative(),
-    repos: external_exports.number().int().nonnegative(),
-    files: external_exports.number().int().nonnegative()
+    // Counts LOCATIONS, the unit this read pages — the number the paginator
+    // states. The facets beside it count FINDINGS (see below); a surface
+    // showing both says which is which.
+    locations: external_exports.number().int().nonnegative()
   }),
-  /** Sorted by max severity, then most recent. */
-  items: external_exports.array(FindingLocationRepo),
-  /** Whether `limit` truncated the repo list. */
-  hasMore: external_exports.boolean()
+  // Counts in FINDINGS, where the types response counts types, each dimension
+  // still excluding its own filter. Deliberately not locations: counting those
+  // needs a set of location keys per dimension per value — memory tracking the
+  // store times the vocabulary, in a read whose scan promises flat memory —
+  // and the cheap per-location version is not an approximation but WRONG. A
+  // location holding {claudecode, block} and {codex, warn} would survive
+  // provider=claudecode AND action=warn, under which no single finding
+  // matches, so the facet would contradict the instanceCount this whole view
+  // rests on. Findings also keep the toolbar in the same unit as the page
+  // tally and the panel it sits above.
+  facets: FindingFacets,
+  /** Sorted by max severity, then most recent, then (repo, file). */
+  items: external_exports.array(FindingLocationSummary),
+  nextCursor: external_exports.string().nullable()
 }).meta({ id: "ListFindingLocationsResponse" });
 
 // ../../packages/schema/src/zod/meta.ts
@@ -21054,6 +21133,10 @@ var CaptureAttributes = external_exports.object({
   // to 'allow' — the enforcement audit trail's link back to the grant that
   // authorized the bypass.
   exception_ids: external_exports.array(external_exports.guid()).optional(),
+  // The persisted spellings of EventMetadata's messageId/conversationId — the
+  // join back to the `llm_call` leaf for the same assistant turn.
+  message_id: external_exports.string().optional(),
+  conversation_id: external_exports.string().optional(),
   // Whole milliseconds this capture's inspection blocked its caller — the
   // plugin's own added latency (see EventMetadata.inspectionMs, whose value
   // this is). Promoted to the `inspection_ms` generated column so the facet is
@@ -21062,7 +21145,19 @@ var CaptureAttributes = external_exports.object({
   // inline json_extract and is not itself an optimization.
   // ABSENT on replayed captures (backfill / worktree scan) and on rows written
   // before the measurement shipped — never present as a placeholder 0.
-  inspection_ms: external_exports.number().int().nonnegative().optional()
+  inspection_ms: external_exports.number().int().nonnegative().optional(),
+  // What a `redact` this capture could not carry out became instead (see
+  // EventMetadata.redactDegradedTo, whose value this is). Present only when a
+  // degrade actually happened, so absence is the ordinary case rather than a
+  // reader having to distinguish it from a zero.
+  //
+  // PER CAPTURE, while `inspection_findings.action_taken` is per finding —
+  // so on a multi-finding row this does not say which finding degraded, and
+  // its presence does not mean the fallback decided the capture's action. A
+  // capture denied by another finding's own Block policy carries `block`
+  // here too. The full statement is on EventMetadata.redactDegradedTo; it is
+  // repeated rather than referenced because a store reader opens this file.
+  redact_degraded_to: ActionTaken.optional()
 }).catchall(external_exports.unknown());
 var ToolCallInspection = external_exports.object({
   ruleId: external_exports.string().min(1),
@@ -21258,7 +21353,17 @@ var AuditEvent = external_exports.object({
   /** `share` to a first-party/internal destination. */
   internal: external_exports.boolean(),
   /** Event needs review (e.g. unverified egress). */
-  flagged: external_exports.boolean()
+  flagged: external_exports.boolean(),
+  /**
+   * The body this event's `title` is drawn from was cleared by local body
+   * expiry, so an EMPTY title here means "gone", not "never had one".
+   *
+   * A separate flag rather than a sentinel written into `title`: the title is
+   * rendered text, and a store-layer module that invented display copy for it
+   * would be choosing words the view is supposed to choose. Additive and
+   * defaulted, so an older producer still validates.
+   */
+  bodyExpired: external_exports.boolean().default(false)
 }).meta({ id: "ActivityAuditEvent" });
 var ActivitySessionSummary = external_exports.object({
   id: external_exports.string(),
@@ -22055,6 +22160,14 @@ var ControlPlaneErrorBody = external_exports.object({
     message: external_exports.string().optional()
   }).optional()
 });
+var RemoteFailureKind = external_exports.enum([
+  "unauthorized",
+  "forbidden",
+  "route-absent",
+  "invalid-request",
+  "rejected",
+  "unreachable"
+]);
 var AttachDeviceRequest = external_exports.object({
   // This machine's own continuity id, so re-attaching ROTATES the credential
   // on one machine record instead of producing a second one. Client-minted
@@ -22473,6 +22586,12 @@ var EventMetadata = external_exports.object({
   // to 'allow' — the enforcement audit trail's link back to the grant that
   // authorized the bypass. Absent on captures where no exception applied.
   exceptionIds: external_exports.array(external_exports.guid()).optional(),
+  // The assistant message this capture belongs to, and the conversation it sits
+  // in — set by the browser extension's network capture so a stored `response`
+  // row can be joined to the `llm_call` leaf describing the same turn. Absent
+  // on every other capture path, which has no such id.
+  messageId: external_exports.string().optional(),
+  conversationId: external_exports.string().optional(),
   // How long THIS capture's inspection blocked its caller, in whole
   // milliseconds — the plugin's own added latency, NOT the LLM call it sat in
   // front of. Measured inside `capture()` (@akasecurity/plugin-sdk) across
@@ -22485,7 +22604,37 @@ var EventMetadata = external_exports.object({
   // Absent is also what every pre-measurement client writes, and what a
   // clock failure degrades to — a reader must treat absence as "not measured"
   // and never as a zero, which would read as "inspection is free".
-  inspectionMs: external_exports.number().int().nonnegative().optional()
+  inspectionMs: external_exports.number().int().nonnegative().optional(),
+  // What a `redact` this capture COULD NOT CARRY OUT became instead — the
+  // workspace's `redactFallback`, applied because the field could not be
+  // masked in place (a shell command, a URL, or any argument on a host whose
+  // hook contract offers no rewrite channel).
+  //
+  // It exists because the action alone cannot say why. A finding recorded as
+  // `warn` reads identically whether its detection was ASSIGNED Warn or was
+  // assigned Redact on a field that could not take one — and those are
+  // different facts about the same row: the first is a policy the user chose,
+  // the second is a masking the host could not perform. Absent means no
+  // degrade happened, which is every ordinary capture.
+  //
+  // TWO LIMITS a reader of a stored row has to know, because the grain here
+  // is the CAPTURE while `actionTaken` is per FINDING:
+  //
+  //   - It does not say WHICH finding degraded. A capture carrying a degraded
+  //     `redact` alongside a finding ASSIGNED the same action stores both
+  //     identically and one reason for the pair; attributing it to both
+  //     describes the assigned one wrongly, and to neither loses the degrade.
+  //   - PRESENCE IS NOT CAUSATION. The value is the action the lost redact
+  //     became, not the reason the capture ended as it did — a capture denied
+  //     by some other finding's own Block policy still carries `block` here,
+  //     and clearing the workspace's fallback would not have let it through.
+  //     Gate on the value against what a fallback can produce; never read the
+  //     field's presence as "this was the fallback's doing".
+  //
+  // Both are pinned as behaviour in @akasecurity/plugin-sdk's runtime suite.
+  // Closing either means moving the reason onto the finding row, which
+  // already carries its own action.
+  redactDegradedTo: ActionTaken.optional()
 }).meta({ id: "EventMetadata" });
 var Event = external_exports.object({
   id: external_exports.guid(),
@@ -22595,6 +22744,15 @@ var RotateKeyInput = external_exports.object({
   confirmation: external_exports.string()
 });
 
+// ../../packages/schema/src/zod/finding-delivery.ts
+var KNOWN_REASONS = SyncFailureReason.options;
+
+// ../../packages/schema/src/zod/findings-group-build.ts
+function rankByOrder(members2) {
+  return Object.fromEntries(members2.map((member, index) => [member, index]));
+}
+var SEVERITY_RANK = rankByOrder(Severity.options);
+
 // ../../packages/schema/src/zod/installed-pack.ts
 var InstalledPack = external_exports.object({
   id: external_exports.guid(),
@@ -22661,6 +22819,11 @@ var Policy = external_exports.object({
   // test `prohibitedModels` passes and `reversibleRuleIds` fails.
   provenance: PolicyProvenance.optional()
 }).meta({ id: "Policy" });
+var KNOWN_BUILTIN_IDS = ["monitor", "warn", "redact", "vault", "block"];
+var BuiltinPolicyId = external_exports.enum(KNOWN_BUILTIN_IDS).meta({ id: "BuiltinPolicyId" });
+var RedactFallback = BuiltinPolicyId.extract(["monitor", "warn", "block"]).meta({
+  id: "RedactFallback"
+});
 var PolicyBundle = external_exports.object({
   version: external_exports.string(),
   policies: external_exports.array(Policy),
@@ -22708,6 +22871,16 @@ var PolicyBundle = external_exports.object({
   // control plane), so no name resolution stands between the decision and the
   // comparison.
   prohibitedModels: external_exports.array(external_exports.string()).optional(),
+  // What a resolved `redact` becomes on a field the host cannot rewrite, as
+  // the ORGANIZATION would have it. Merged raise-only against the device's own
+  // `WorkspaceSettings.redactFallback` (see strongerRedactFallback below), so
+  // a control plane can tighten a machine and never loosen one — the same
+  // direction `mergeRaiseOnly` enforces for policies.
+  //
+  // Optional so an older backend, and an older on-disk cache, still parses;
+  // absent leaves the device's own setting in force, which is the behaviour
+  // that predates the field and the safe direction to default.
+  redactFallback: RedactFallback.optional(),
   customKeywords: external_exports.array(external_exports.string()),
   fetchedAt: external_exports.iso.datetime()
 }).meta({ id: "PolicyBundle" });
@@ -22737,11 +22910,6 @@ function severityFloorPolicy(category) {
   const peak = CATEGORY_PEAK_SEVERITY[category];
   return peak === "critical" || peak === "high" ? "warn" : "monitor";
 }
-var KNOWN_BUILTIN_IDS = ["monitor", "warn", "redact", "vault", "block"];
-var BuiltinPolicyId = external_exports.enum(KNOWN_BUILTIN_IDS).meta({ id: "BuiltinPolicyId" });
-var RedactFallback = BuiltinPolicyId.extract(["monitor", "warn", "block"]).meta({
-  id: "RedactFallback"
-});
 var BUILTIN_POLICY_SPECS = {
   monitor: {
     name: "Monitor",
@@ -23003,7 +23171,7 @@ var VaultConsent = external_exports.object({
 });
 
 // ../../packages/schema/src/zod/local.ts
-var WORKSPACE_SETTINGS_SPEC_VERSION = 7;
+var WORKSPACE_SETTINGS_SPEC_VERSION = 8;
 var RunMode = external_exports.enum(["standalone", "attached"]);
 var ControlPlaneConnection = external_exports.object({
   endpoint: external_exports.string().min(1),
@@ -23022,6 +23190,15 @@ var HistorySyncConsent = external_exports.object({
   payloadVersion: external_exports.number().int().positive(),
   endpoint: external_exports.string()
 });
+var BODY_RETENTION_DEFAULT_DAYS = 30;
+var BodyRetention = external_exports.object({
+  enabled: external_exports.boolean().default(false),
+  // Never 0, and the ceiling is a fat-finger guard rather than a policy
+  // limit — `enabled` is the real gate. A low value cannot reach a row the
+  // sync ledger still owes: the sweep's age filter only ever NARROWS a
+  // candidate set that is already bounded by "delivered, or never owed".
+  retainDays: external_exports.number().int().min(1).max(3650).default(BODY_RETENTION_DEFAULT_DAYS)
+}).meta({ id: "BodyRetention" });
 var WorkspaceSettings = external_exports.object({
   specVersion: external_exports.number().int().positive().default(WORKSPACE_SETTINGS_SPEC_VERSION),
   runMode: RunMode.default("standalone"),
@@ -23065,12 +23242,18 @@ var WorkspaceSettings = external_exports.object({
   // covers the current payload and must be re-granted.
   modelJudgeConsent: ModelJudgeConsent.optional(),
   // Records that the user consented to the DEFERRED send — the outbox — along
-  // with the payload shape and the endpoint they agreed to. Since payload v2
-  // that covers both the pre-attach backlog and undelivered captures (which
-  // carry prompt/reply text in `content`); the key name predates the widening.
-  // Absent until granted, and a grant for a different endpoint or an older
-  // payload no longer counts.
-  historySyncConsent: HistorySyncConsent.optional()
+  // with the payload shape and the endpoint they agreed to. Since payload v3
+  // that covers the pre-attach backlog AND undelivered captures alike, and both
+  // carry prompt/reply/tool-output text in `content`; the key name predates
+  // both widenings. Absent until granted, and a grant for a different endpoint
+  // or an older payload no longer counts.
+  historySyncConsent: HistorySyncConsent.optional(),
+  // Local body expiry (see BodyRetention). Off until switched on; expiring a
+  // body never removes the row or its findings.
+  bodyRetention: BodyRetention.default({
+    enabled: false,
+    retainDays: BODY_RETENTION_DEFAULT_DAYS
+  })
 });
 
 // ../../packages/schema/src/zod/managed.ts
@@ -23083,10 +23266,22 @@ var ManagedSettingKey = external_exports.enum([
   "vaultInlineReveal",
   "modelJudgeConsent",
   "dataSharesInPlace",
-  "redactFallback"
+  "redactFallback",
+  // Pins the toggle and the day count together — see BodyRetention on why the
+  // two are one unit. An administrator mandating a window wants the count
+  // enforced with it, not one a user can widen while the toggle stays on.
+  "bodyRetention"
 ]).meta({ id: "ManagedSettingKey" });
+function isManagedSettingKey(value) {
+  return ManagedSettingKey.safeParse(value).success;
+}
 var ManagedSettingsValues = external_exports.object({
   runMode: external_exports.enum(["standalone", "attached"]).optional(),
+  // `controlPlane` and `bodyRetention` are the two nested values, and both are
+  // plain, non-strict objects: a key under either that this build does not know
+  // is stripped and nothing reports it. The unknown-value split in
+  // ManagedSettings below classifies top-level names only, so it stops at
+  // these boundaries.
   controlPlane: external_exports.object({
     endpoint: external_exports.string().min(1),
     label: external_exports.string().min(1).optional()
@@ -23097,7 +23292,8 @@ var ManagedSettingsValues = external_exports.object({
   vaultInlineReveal: external_exports.enum(["masked", "full", "off"]).optional(),
   modelJudgeConsent: external_exports.boolean().optional(),
   dataSharesInPlace: external_exports.boolean().optional(),
-  redactFallback: RedactFallback.optional()
+  redactFallback: RedactFallback.optional(),
+  bodyRetention: BodyRetention.optional()
 }).meta({ id: "ManagedSettingsValues" });
 var ManagedSettings = external_exports.object({
   specVersion: external_exports.number().int().positive().default(MANAGED_SETTINGS_SPEC_VERSION),
@@ -23105,11 +23301,59 @@ var ManagedSettings = external_exports.object({
   // decision from a bug. Absent renders as a generic "your organization".
   organization: external_exports.string().min(1).optional(),
   // What the administrator pinned.
-  values: ManagedSettingsValues.default({}),
+  //
+  // Parsed as a RECORD rather than as the nested schema, and split below for
+  // the same reason `lockedFields` is parsed as names: a plain `z.object`
+  // drops an unrecognised key and succeeds, so a pin this build does not know
+  // vanished and nothing anywhere said so. A pin with no lock is a supported
+  // shape — it is a DEFAULT the user may still change — so that silence hit
+  // exactly the file an administrator is most likely to write while a fleet
+  // is mid-upgrade.
+  //
+  // Splitting here rather than calling `.strict()`: strict would REFUSE the
+  // file, which is the outcome the lock half already rejected — an older
+  // build then runs entirely unmanaged, every pin and lock gone. A bad KNOWN
+  // value still fails, because the nested schema is re-run over the known
+  // subset and its issues are re-raised on this parse.
+  values: external_exports.record(external_exports.string(), external_exports.unknown()).default({}),
   // Which of those the user may not change. A key here with no matching value
   // freezes whatever the user last chose; a value with no lock is a DEFAULT
   // the user may still override. The two are separable on purpose.
-  lockedFields: external_exports.array(ManagedSettingKey).default([])
+  //
+  // Parsed as NAMES rather than as the enum, and split below: a name this
+  // build does not know is dropped from the locked set and reported, never a
+  // reason to refuse the file. The same shape reaches an older build whenever
+  // an administrator locks a key a newer build added, and refusing it there
+  // ran that build entirely unmanaged — every pin and lock gone — on exactly
+  // the fleets most likely to carry a version skew. A name outside the enum
+  // is still never HONOURED: the lockable set stays explicit above.
+  lockedFields: external_exports.array(external_exports.string()).default([])
+}).transform(({ lockedFields, values, ...rest }, ctx) => {
+  const known = [];
+  const unknown2 = [];
+  for (const name of lockedFields) {
+    if (isManagedSettingKey(name)) known.push(name);
+    else unknown2.push(name);
+  }
+  const knownValues = /* @__PURE__ */ Object.create(null);
+  const unknownValues = [];
+  for (const [name, value] of Object.entries(values)) {
+    if (Object.hasOwn(ManagedSettingsValues.shape, name)) knownValues[name] = value;
+    else unknownValues.push(name);
+  }
+  const pinned = ManagedSettingsValues.safeParse(knownValues);
+  if (!pinned.success) {
+    for (const issue2 of pinned.error.issues)
+      ctx.addIssue({ ...issue2, path: ["values", ...issue2.path] });
+    return external_exports.NEVER;
+  }
+  return {
+    ...rest,
+    values: pinned.data,
+    lockedFields: known,
+    ...unknown2.length > 0 ? { unknownLockedFields: unknown2 } : {},
+    ...unknownValues.length > 0 ? { unknownValueFields: unknownValues } : {}
+  };
 }).meta({ id: "ManagedSettings" });
 
 // ../../packages/schema/src/zod/project-files.ts
@@ -23227,7 +23471,11 @@ var FindingsTimeseriesPoint = external_exports.object({
   timestamp: external_exports.iso.date(),
   critical: external_exports.number().int().nonnegative(),
   high: external_exports.number().int().nonnegative(),
-  medium: external_exports.number().int().nonnegative()
+  medium: external_exports.number().int().nonnegative(),
+  // Optional and additive, so a producer written against the earlier
+  // three-series contract keeps validating. A consumer plotting it resolves the
+  // absent case itself — the chart point requires a number.
+  low: external_exports.number().int().nonnegative().optional()
 }).meta({ id: "FindingsTimeseriesPoint" });
 var FindingsTimeseriesResponse = external_exports.object({
   range: TimeRange,
@@ -23253,6 +23501,10 @@ var ResolvedFeedItem = external_exports.object({
   findingKey: external_exports.string(),
   ruleId: external_exports.string(),
   severity: Severity,
+  // Repository slug, and the file path RELATIVE to it. The pair is what
+  // identifies the file: a bare path matches the same name in every repo.
+  // Optional and additive; empty when the event carried no repo.
+  repo: external_exports.string().optional(),
   path: external_exports.string(),
   // ISO-8601 datetime (matches FindingInstance.detectedAt / the rest of the
   // findings domain). The reader `.toISOString()`s the DB epoch-ms values.
@@ -23358,7 +23610,23 @@ var SaveSettingsInput = external_exports.object({
   modelJudgeConsent: ModelJudgeConsentChoice,
   historySyncConsent: HistorySyncConsentChoice,
   vaultConsent: external_exports.string(),
-  vaultInlineReveal: external_exports.string()
+  vaultInlineReveal: external_exports.string(),
+  // Widened to `string` like its neighbours rather than typed as
+  // `RedactFallback`, on this module's own layering rule: shape here, VALUE at
+  // the call site, so the domain check receives the type it was written for.
+  //
+  // NOT because a narrower schema would reject differently. `parseActionInput`
+  // is a `safeParse` wrapper and throws for no field schema, so either spelling
+  // reaches a recoverable `{ ok: false }` and there is no rejected promise to
+  // trade against. The real cost runs the other way and is the part worth
+  // knowing: a value this schema admits and the domain enum then rejects lands
+  // on the action's shared refusal, which names NO field, where a shape
+  // rejection reaches `malformedInput` and names the schema key.
+  redactFallback: external_exports.string(),
+  // Shape only, the way the enum fields above are strings only: the RANGE is
+  // `BodyRetention`'s and the action checks it there, so there is one place
+  // that decides what a legal horizon is rather than two that can drift.
+  bodyRetention: external_exports.object({ enabled: external_exports.boolean(), retainDays: external_exports.number() })
 });
 var AttachInput = external_exports.object({
   endpoint: external_exports.string(),
@@ -23484,6 +23752,52 @@ var SetupHandoffOffer = external_exports.object({
   path: ["liveKeys"]
 });
 
+// ../../packages/schema/src/zod/web-capture.ts
+var WebUsageSource = external_exports.enum(["site", "estimated", "none"]);
+var WebUsage = external_exports.object({
+  inputTokens: external_exports.number().int().nonnegative().optional(),
+  outputTokens: external_exports.number().int().nonnegative().optional(),
+  cacheReadInputTokens: external_exports.number().int().nonnegative().optional(),
+  cacheCreationInputTokens: external_exports.number().int().nonnegative().optional()
+});
+var WebToolCall = external_exports.object({
+  toolUseId: external_exports.string().min(1),
+  toolName: external_exports.string().min(1),
+  target: external_exports.string().optional(),
+  isError: external_exports.boolean().optional(),
+  inputSize: external_exports.number().int().nonnegative().optional(),
+  outputSize: external_exports.number().int().nonnegative().optional()
+});
+var WebExchange = external_exports.object({
+  messageId: external_exports.string().min(1),
+  startedAt: external_exports.iso.datetime(),
+  model: external_exports.string().optional(),
+  usage: WebUsage.optional(),
+  usageSource: WebUsageSource,
+  stopReason: external_exports.string().optional(),
+  conversationId: external_exports.string().optional(),
+  turnIndex: external_exports.number().int().nonnegative().optional(),
+  toolCalls: external_exports.array(WebToolCall).default([]),
+  // Absent when the adapter recovered no text. Capped by the caller at
+  // RESPONSE_TEXT_MAX_BYTES; `truncated` records that the cap was reached, so a
+  // short capture is never mistaken for a short reply.
+  responseText: external_exports.string().optional(),
+  truncated: external_exports.boolean().default(false)
+});
+var RESPONSE_TEXT_MAX_BYTES = 2 * 1024 * 1024;
+var WebCaptureStatus = external_exports.object({
+  patched: external_exports.boolean(),
+  live: external_exports.boolean(),
+  blind: external_exports.boolean(),
+  sendsSeenDom: external_exports.number().int().nonnegative(),
+  exchangesSeenNet: external_exports.number().int().nonnegative(),
+  parseFailures: external_exports.number().int().nonnegative(),
+  unparsedBodies: external_exports.number().int().nonnegative(),
+  // The adapter-declared JSON key paths that were absent from a real payload —
+  // the earliest signal that a site's contract moved.
+  shapeMisses: external_exports.array(external_exports.string()).default([])
+});
+
 // ../../packages/detections/src/posture/config-posture.ts
 var RULE_VERSION = "1";
 var KNOWN_TOOLS = /* @__PURE__ */ new Set([