@akasecurity/ai-tc-claude-code 0.9.11 → 0.9.12

package/scripts/post-model-switch.js

@@ -50,7 +50,7 @@ var require_ignore = __commonJS({
     var REGEX_SPLITALL_CRLF = /\r?\n/g;
     var REGEX_TEST_INVALID_PATH = /^\.{0,2}\/|^\.{1,2}$/;
     var REGEX_TEST_TRAILING_SLASH = /\/$/;
-    var SLASH2 = "/";
+    var SLASH3 = "/";
     var TMP_KEY_IGNORE = "node-ignore";
     if (typeof Symbol !== "undefined") {
       TMP_KEY_IGNORE = /* @__PURE__ */ Symbol.for("node-ignore");
@@ -422,11 +422,11 @@ var require_ignore = __commonJS({
         if (!REGEX_TEST_TRAILING_SLASH.test(path)) {
           return this.test(path);
         }
-        const slices = path.split(SLASH2).filter(Boolean);
+        const slices = path.split(SLASH3).filter(Boolean);
         slices.pop();
         if (slices.length) {
           const parent = this._t(
-            slices.join(SLASH2) + SLASH2,
+            slices.join(SLASH3) + SLASH3,
             this._testCache,
             true,
             slices
@@ -442,14 +442,14 @@ var require_ignore = __commonJS({
           return cache[path];
         }
         if (!slices) {
-          slices = path.split(SLASH2).filter(Boolean);
+          slices = path.split(SLASH3).filter(Boolean);
         }
         slices.pop();
         if (!slices.length) {
           return cache[path] = this._rules.test(path, checkUnignored, MODE_IGNORE);
         }
         const parent = this._t(
-          slices.join(SLASH2) + SLASH2,
+          slices.join(SLASH3) + SLASH3,
           cache,
           checkUnignored,
           slices
@@ -493,7 +493,7 @@ var require_ignore = __commonJS({
 
 // ../../packages/plugin-sdk/src/config.ts
 import { existsSync as existsSync8 } from "fs";
-import { join as join14 } from "path";
+import { join as join16 } from "path";
 
 // ../../packages/persistence/src/attached-derived.ts
 import { rmSync } from "fs";
@@ -503,6 +503,14 @@ import { join } from "path";
 import { chmodSync as chmodSync2, lstatSync as lstatSync2, readFileSync, rmSync as rmSync3, statSync } from "fs";
 import { join as join2 } from "path";
 
+// ../../packages/schema/src/drizzle/deferred-migrations.ts
+var DEFERRED_MIGRATION_TAGS = [
+  "0031_audit_capture_by_time_index",
+  "0032_audit_capture_by_id_index",
+  "0033_audit_capture_location_index",
+  "0034_findings_read_indexes"
+];
+
 // ../../packages/schema/src/exception-scope.ts
 var MINUTE_MS = 6e4;
 var HOUR_MS = 60 * MINUTE_MS;
@@ -20312,6 +20320,15 @@ var FindingCategory = external_exports.enum([
 ]).meta({ id: "FindingCategory" });
 var FindingOrigin = external_exports.enum(["in-flight", "at-rest"]).meta({ id: "FindingOrigin" });
 var FindingStatus = external_exports.enum(["open", "handled", "resolved", "dismissed"]).meta({ id: "FindingStatus" });
+var SyncFailureReason = external_exports.enum(["deployment_refused", "payload_invalid", "detached_undelivered"]).meta({ id: "SyncFailureReason" });
+var FindingDeliveryState = external_exports.enum(["sent", "queued", "not_sent", "never_offered", "local_scan"]).meta({ id: "FindingDeliveryState" });
+var FindingDelivery = external_exports.object({
+  state: FindingDeliveryState,
+  // The delivery time for `sent`; the failure time for `not_sent` when recorded.
+  at: external_exports.iso.datetime().optional(),
+  // Only on `not_sent`, and only when a known reason was recorded.
+  reason: SyncFailureReason.optional()
+}).meta({ id: "FindingDelivery" });
 var ResolutionMethod = external_exports.enum([
   "enforced-in-flight",
   "fixed-at-source",
@@ -20368,7 +20385,10 @@ var FindingInstance = external_exports.object({
   // The session that event belongs to, when it has one — the seam a
   // per-instance "view session" link needs. Absent for events captured
   // outside a session.
-  sessionId: external_exports.string().optional()
+  sessionId: external_exports.string().optional(),
+  // The delivery state of the event above (see FindingDelivery). Optional so
+  // readers that do not project it stay valid.
+  delivery: FindingDelivery.optional()
 }).meta({ id: "FindingInstance" });
 var FindingGroup = external_exports.object({
   id: external_exports.string(),
@@ -20420,7 +20440,10 @@ var FindingFacets = external_exports.object({
   // Host tool (attributes.tool_name). Present only on the instance-level
   // reads, which can filter by it; the type-level read omits the dimension
   // because a group spans tools.
-  tool: external_exports.array(FindingFacetItem).optional()
+  tool: external_exports.array(FindingFacetItem).optional(),
+  // Delivery states (FindingDeliveryState). Present only on the
+  // instance-level reads, like `tool`.
+  deployment: external_exports.array(FindingFacetItem).optional()
 }).meta({ id: "FindingFacets" });
 var FindingTypeSummary = FindingGroup.omit({ instances: true, match: true }).meta({
   id: "FindingTypeSummary"
@@ -20529,6 +20552,8 @@ var ListFindingInstancesQuery = external_exports.object({
   // Exact host-tool names (attributes.tool_name, e.g. 'Bash'). A real filter,
   // where the free-text `q` can only match the rendered "via Bash" label.
   tool: external_exports.array(external_exports.string()).optional(),
+  // The delivery state of each finding's event (see FindingDelivery).
+  deployment: external_exports.array(FindingDeliveryState).optional(),
   // Exact repository / file-path matches, for the drill-down out of the
   // locations view. A row whose event carries no repo/file matches neither.
   repo: external_exports.string().optional(),
@@ -20549,6 +20574,10 @@ var ListFindingInstancesResponse = external_exports.object({
   items: external_exports.array(FindingInstanceDetail),
   nextCursor: external_exports.string().nullable()
 }).meta({ id: "ListFindingInstancesResponse" });
+var ListFindingInstancesPage = external_exports.object({
+  items: external_exports.array(FindingInstanceDetail),
+  nextCursor: external_exports.string().nullable()
+}).meta({ id: "ListFindingInstancesPage" });
 var FindingLocationSummary = external_exports.object({
   // Opaque, stable, minted from the pair by encodeLocationId. It exists
   // because a location's identity is two values and a URL param carries one:
@@ -20590,6 +20619,8 @@ var ListFindingLocationsQuery = external_exports.object({
   // instances that match, and folds its status from those.
   status: external_exports.array(FindingStatus).optional(),
   tool: external_exports.array(external_exports.string()).optional(),
+  // The delivery state of each finding's event (see FindingDelivery).
+  deployment: external_exports.array(FindingDeliveryState).optional(),
   q: external_exports.string().optional(),
   sessionId: external_exports.string().optional(),
   from: external_exports.iso.datetime().optional(),
@@ -20792,6 +20823,10 @@ var CaptureAttributes = external_exports.object({
   // to 'allow' — the enforcement audit trail's link back to the grant that
   // authorized the bypass.
   exception_ids: external_exports.array(external_exports.guid()).optional(),
+  // The persisted spellings of EventMetadata's messageId/conversationId — the
+  // join back to the `llm_call` leaf for the same assistant turn.
+  message_id: external_exports.string().optional(),
+  conversation_id: external_exports.string().optional(),
   // Whole milliseconds this capture's inspection blocked its caller — the
   // plugin's own added latency (see EventMetadata.inspectionMs, whose value
   // this is). Promoted to the `inspection_ms` generated column so the facet is
@@ -20800,7 +20835,19 @@ var CaptureAttributes = external_exports.object({
   // inline json_extract and is not itself an optimization.
   // ABSENT on replayed captures (backfill / worktree scan) and on rows written
   // before the measurement shipped — never present as a placeholder 0.
-  inspection_ms: external_exports.number().int().nonnegative().optional()
+  inspection_ms: external_exports.number().int().nonnegative().optional(),
+  // What a `redact` this capture could not carry out became instead (see
+  // EventMetadata.redactDegradedTo, whose value this is). Present only when a
+  // degrade actually happened, so absence is the ordinary case rather than a
+  // reader having to distinguish it from a zero.
+  //
+  // PER CAPTURE, while `inspection_findings.action_taken` is per finding —
+  // so on a multi-finding row this does not say which finding degraded, and
+  // its presence does not mean the fallback decided the capture's action. A
+  // capture denied by another finding's own Block policy carries `block`
+  // here too. The full statement is on EventMetadata.redactDegradedTo; it is
+  // repeated rather than referenced because a store reader opens this file.
+  redact_degraded_to: ActionTaken.optional()
 }).catchall(external_exports.unknown());
 var ToolCallInspection = external_exports.object({
   ruleId: external_exports.string().min(1),
@@ -20996,7 +21043,17 @@ var AuditEvent = external_exports.object({
   /** `share` to a first-party/internal destination. */
   internal: external_exports.boolean(),
   /** Event needs review (e.g. unverified egress). */
-  flagged: external_exports.boolean()
+  flagged: external_exports.boolean(),
+  /**
+   * The body this event's `title` is drawn from was cleared by local body
+   * expiry, so an EMPTY title here means "gone", not "never had one".
+   *
+   * A separate flag rather than a sentinel written into `title`: the title is
+   * rendered text, and a store-layer module that invented display copy for it
+   * would be choosing words the view is supposed to choose. Additive and
+   * defaulted, so an older producer still validates.
+   */
+  bodyExpired: external_exports.boolean().default(false)
 }).meta({ id: "ActivityAuditEvent" });
 var ActivitySessionSummary = external_exports.object({
   id: external_exports.string(),
@@ -22219,6 +22276,12 @@ var EventMetadata = external_exports.object({
   // to 'allow' — the enforcement audit trail's link back to the grant that
   // authorized the bypass. Absent on captures where no exception applied.
   exceptionIds: external_exports.array(external_exports.guid()).optional(),
+  // The assistant message this capture belongs to, and the conversation it sits
+  // in — set by the browser extension's network capture so a stored `response`
+  // row can be joined to the `llm_call` leaf describing the same turn. Absent
+  // on every other capture path, which has no such id.
+  messageId: external_exports.string().optional(),
+  conversationId: external_exports.string().optional(),
   // How long THIS capture's inspection blocked its caller, in whole
   // milliseconds — the plugin's own added latency, NOT the LLM call it sat in
   // front of. Measured inside `capture()` (@akasecurity/plugin-sdk) across
@@ -22231,7 +22294,37 @@ var EventMetadata = external_exports.object({
   // Absent is also what every pre-measurement client writes, and what a
   // clock failure degrades to — a reader must treat absence as "not measured"
   // and never as a zero, which would read as "inspection is free".
-  inspectionMs: external_exports.number().int().nonnegative().optional()
+  inspectionMs: external_exports.number().int().nonnegative().optional(),
+  // What a `redact` this capture COULD NOT CARRY OUT became instead — the
+  // workspace's `redactFallback`, applied because the field could not be
+  // masked in place (a shell command, a URL, or any argument on a host whose
+  // hook contract offers no rewrite channel).
+  //
+  // It exists because the action alone cannot say why. A finding recorded as
+  // `warn` reads identically whether its detection was ASSIGNED Warn or was
+  // assigned Redact on a field that could not take one — and those are
+  // different facts about the same row: the first is a policy the user chose,
+  // the second is a masking the host could not perform. Absent means no
+  // degrade happened, which is every ordinary capture.
+  //
+  // TWO LIMITS a reader of a stored row has to know, because the grain here
+  // is the CAPTURE while `actionTaken` is per FINDING:
+  //
+  //   - It does not say WHICH finding degraded. A capture carrying a degraded
+  //     `redact` alongside a finding ASSIGNED the same action stores both
+  //     identically and one reason for the pair; attributing it to both
+  //     describes the assigned one wrongly, and to neither loses the degrade.
+  //   - PRESENCE IS NOT CAUSATION. The value is the action the lost redact
+  //     became, not the reason the capture ended as it did — a capture denied
+  //     by some other finding's own Block policy still carries `block` here,
+  //     and clearing the workspace's fallback would not have let it through.
+  //     Gate on the value against what a fallback can produce; never read the
+  //     field's presence as "this was the fallback's doing".
+  //
+  // Both are pinned as behaviour in @akasecurity/plugin-sdk's runtime suite.
+  // Closing either means moving the reason onto the finding row, which
+  // already carries its own action.
+  redactDegradedTo: ActionTaken.optional()
 }).meta({ id: "EventMetadata" });
 var Event = external_exports.object({
   id: external_exports.guid(),
@@ -22341,6 +22434,15 @@ var RotateKeyInput = external_exports.object({
   confirmation: external_exports.string()
 });
 
+// ../../packages/schema/src/zod/finding-delivery.ts
+var KNOWN_REASONS = SyncFailureReason.options;
+
+// ../../packages/schema/src/zod/findings-group-build.ts
+function rankByOrder(members2) {
+  return Object.fromEntries(members2.map((member, index) => [member, index]));
+}
+var SEVERITY_RANK = rankByOrder(Severity.options);
+
 // ../../packages/schema/src/zod/installed-pack.ts
 var InstalledPack = external_exports.object({
   id: external_exports.guid(),
@@ -22407,6 +22509,11 @@ var Policy = external_exports.object({
   // test `prohibitedModels` passes and `reversibleRuleIds` fails.
   provenance: PolicyProvenance.optional()
 }).meta({ id: "Policy" });
+var KNOWN_BUILTIN_IDS = ["monitor", "warn", "redact", "vault", "block"];
+var BuiltinPolicyId = external_exports.enum(KNOWN_BUILTIN_IDS).meta({ id: "BuiltinPolicyId" });
+var RedactFallback = BuiltinPolicyId.extract(["monitor", "warn", "block"]).meta({
+  id: "RedactFallback"
+});
 var PolicyBundle = external_exports.object({
   version: external_exports.string(),
   policies: external_exports.array(Policy),
@@ -22454,6 +22561,16 @@ var PolicyBundle = external_exports.object({
   // control plane), so no name resolution stands between the decision and the
   // comparison.
   prohibitedModels: external_exports.array(external_exports.string()).optional(),
+  // What a resolved `redact` becomes on a field the host cannot rewrite, as
+  // the ORGANIZATION would have it. Merged raise-only against the device's own
+  // `WorkspaceSettings.redactFallback` (see strongerRedactFallback below), so
+  // a control plane can tighten a machine and never loosen one — the same
+  // direction `mergeRaiseOnly` enforces for policies.
+  //
+  // Optional so an older backend, and an older on-disk cache, still parses;
+  // absent leaves the device's own setting in force, which is the behaviour
+  // that predates the field and the safe direction to default.
+  redactFallback: RedactFallback.optional(),
   customKeywords: external_exports.array(external_exports.string()),
   fetchedAt: external_exports.iso.datetime()
 }).meta({ id: "PolicyBundle" });
@@ -22483,11 +22600,6 @@ function severityFloorPolicy(category) {
   const peak = CATEGORY_PEAK_SEVERITY[category];
   return peak === "critical" || peak === "high" ? "warn" : "monitor";
 }
-var KNOWN_BUILTIN_IDS = ["monitor", "warn", "redact", "vault", "block"];
-var BuiltinPolicyId = external_exports.enum(KNOWN_BUILTIN_IDS).meta({ id: "BuiltinPolicyId" });
-var RedactFallback = BuiltinPolicyId.extract(["monitor", "warn", "block"]).meta({
-  id: "RedactFallback"
-});
 var BUILTIN_POLICY_SPECS = {
   monitor: {
     name: "Monitor",
@@ -22750,7 +22862,7 @@ var VaultConsent = external_exports.object({
 });
 
 // ../../packages/schema/src/zod/local.ts
-var WORKSPACE_SETTINGS_SPEC_VERSION = 7;
+var WORKSPACE_SETTINGS_SPEC_VERSION = 8;
 var MODEL_JUDGE_PAYLOAD_VERSION = 1;
 var RunMode = external_exports.enum(["standalone", "attached"]);
 var ControlPlaneConnection = external_exports.object({
@@ -22770,6 +22882,15 @@ var HistorySyncConsent = external_exports.object({
   payloadVersion: external_exports.number().int().positive(),
   endpoint: external_exports.string()
 });
+var BODY_RETENTION_DEFAULT_DAYS = 30;
+var BodyRetention = external_exports.object({
+  enabled: external_exports.boolean().default(false),
+  // Never 0, and the ceiling is a fat-finger guard rather than a policy
+  // limit — `enabled` is the real gate. A low value cannot reach a row the
+  // sync ledger still owes: the sweep's age filter only ever NARROWS a
+  // candidate set that is already bounded by "delivered, or never owed".
+  retainDays: external_exports.number().int().min(1).max(3650).default(BODY_RETENTION_DEFAULT_DAYS)
+}).meta({ id: "BodyRetention" });
 var WorkspaceSettings = external_exports.object({
   specVersion: external_exports.number().int().positive().default(WORKSPACE_SETTINGS_SPEC_VERSION),
   runMode: RunMode.default("standalone"),
@@ -22818,7 +22939,13 @@ var WorkspaceSettings = external_exports.object({
   // carry prompt/reply/tool-output text in `content`; the key name predates
   // both widenings. Absent until granted, and a grant for a different endpoint
   // or an older payload no longer counts.
-  historySyncConsent: HistorySyncConsent.optional()
+  historySyncConsent: HistorySyncConsent.optional(),
+  // Local body expiry (see BodyRetention). Off until switched on; expiring a
+  // body never removes the row or its findings.
+  bodyRetention: BodyRetention.default({
+    enabled: false,
+    retainDays: BODY_RETENTION_DEFAULT_DAYS
+  })
 });
 function defaultWorkspaceSettings() {
   return WorkspaceSettings.parse({});
@@ -22835,13 +22962,22 @@ var ManagedSettingKey = external_exports.enum([
   "vaultInlineReveal",
   "modelJudgeConsent",
   "dataSharesInPlace",
-  "redactFallback"
+  "redactFallback",
+  // Pins the toggle and the day count together — see BodyRetention on why the
+  // two are one unit. An administrator mandating a window wants the count
+  // enforced with it, not one a user can widen while the toggle stays on.
+  "bodyRetention"
 ]).meta({ id: "ManagedSettingKey" });
 function isManagedSettingKey(value) {
   return ManagedSettingKey.safeParse(value).success;
 }
 var ManagedSettingsValues = external_exports.object({
   runMode: external_exports.enum(["standalone", "attached"]).optional(),
+  // `controlPlane` and `bodyRetention` are the two nested values, and both are
+  // plain, non-strict objects: a key under either that this build does not know
+  // is stripped and nothing reports it. The unknown-value split in
+  // ManagedSettings below classifies top-level names only, so it stops at
+  // these boundaries.
   controlPlane: external_exports.object({
     endpoint: external_exports.string().min(1),
     label: external_exports.string().min(1).optional()
@@ -22852,7 +22988,8 @@ var ManagedSettingsValues = external_exports.object({
   vaultInlineReveal: external_exports.enum(["masked", "full", "off"]).optional(),
   modelJudgeConsent: external_exports.boolean().optional(),
   dataSharesInPlace: external_exports.boolean().optional(),
-  redactFallback: RedactFallback.optional()
+  redactFallback: RedactFallback.optional(),
+  bodyRetention: BodyRetention.optional()
 }).meta({ id: "ManagedSettingsValues" });
 var ManagedSettings = external_exports.object({
   specVersion: external_exports.number().int().positive().default(MANAGED_SETTINGS_SPEC_VERSION),
@@ -22860,7 +22997,21 @@ var ManagedSettings = external_exports.object({
   // decision from a bug. Absent renders as a generic "your organization".
   organization: external_exports.string().min(1).optional(),
   // What the administrator pinned.
-  values: ManagedSettingsValues.default({}),
+  //
+  // Parsed as a RECORD rather than as the nested schema, and split below for
+  // the same reason `lockedFields` is parsed as names: a plain `z.object`
+  // drops an unrecognised key and succeeds, so a pin this build does not know
+  // vanished and nothing anywhere said so. A pin with no lock is a supported
+  // shape — it is a DEFAULT the user may still change — so that silence hit
+  // exactly the file an administrator is most likely to write while a fleet
+  // is mid-upgrade.
+  //
+  // Splitting here rather than calling `.strict()`: strict would REFUSE the
+  // file, which is the outcome the lock half already rejected — an older
+  // build then runs entirely unmanaged, every pin and lock gone. A bad KNOWN
+  // value still fails, because the nested schema is re-run over the known
+  // subset and its issues are re-raised on this parse.
+  values: external_exports.record(external_exports.string(), external_exports.unknown()).default({}),
   // Which of those the user may not change. A key here with no matching value
   // freezes whatever the user last chose; a value with no lock is a DEFAULT
   // the user may still override. The two are separable on purpose.
@@ -22873,17 +23024,31 @@ var ManagedSettings = external_exports.object({
   // the fleets most likely to carry a version skew. A name outside the enum
   // is still never HONOURED: the lockable set stays explicit above.
   lockedFields: external_exports.array(external_exports.string()).default([])
-}).transform(({ lockedFields, ...rest }) => {
+}).transform(({ lockedFields, values, ...rest }, ctx) => {
   const known = [];
   const unknown2 = [];
   for (const name of lockedFields) {
     if (isManagedSettingKey(name)) known.push(name);
     else unknown2.push(name);
   }
+  const knownValues = /* @__PURE__ */ Object.create(null);
+  const unknownValues = [];
+  for (const [name, value] of Object.entries(values)) {
+    if (Object.hasOwn(ManagedSettingsValues.shape, name)) knownValues[name] = value;
+    else unknownValues.push(name);
+  }
+  const pinned = ManagedSettingsValues.safeParse(knownValues);
+  if (!pinned.success) {
+    for (const issue2 of pinned.error.issues)
+      ctx.addIssue({ ...issue2, path: ["values", ...issue2.path] });
+    return external_exports.NEVER;
+  }
   return {
     ...rest,
+    values: pinned.data,
     lockedFields: known,
-    ...unknown2.length > 0 ? { unknownLockedFields: unknown2 } : {}
+    ...unknown2.length > 0 ? { unknownLockedFields: unknown2 } : {},
+    ...unknownValues.length > 0 ? { unknownValueFields: unknownValues } : {}
   };
 }).meta({ id: "ManagedSettings" });
 
@@ -23141,7 +23306,23 @@ var SaveSettingsInput = external_exports.object({
   modelJudgeConsent: ModelJudgeConsentChoice,
   historySyncConsent: HistorySyncConsentChoice,
   vaultConsent: external_exports.string(),
-  vaultInlineReveal: external_exports.string()
+  vaultInlineReveal: external_exports.string(),
+  // Widened to `string` like its neighbours rather than typed as
+  // `RedactFallback`, on this module's own layering rule: shape here, VALUE at
+  // the call site, so the domain check receives the type it was written for.
+  //
+  // NOT because a narrower schema would reject differently. `parseActionInput`
+  // is a `safeParse` wrapper and throws for no field schema, so either spelling
+  // reaches a recoverable `{ ok: false }` and there is no rejected promise to
+  // trade against. The real cost runs the other way and is the part worth
+  // knowing: a value this schema admits and the domain enum then rejects lands
+  // on the action's shared refusal, which names NO field, where a shape
+  // rejection reaches `malformedInput` and names the schema key.
+  redactFallback: external_exports.string(),
+  // Shape only, the way the enum fields above are strings only: the RANGE is
+  // `BodyRetention`'s and the action checks it there, so there is one place
+  // that decides what a legal horizon is rather than two that can drift.
+  bodyRetention: external_exports.object({ enabled: external_exports.boolean(), retainDays: external_exports.number() })
 });
 var AttachInput = external_exports.object({
   endpoint: external_exports.string(),
@@ -23267,6 +23448,52 @@ var SetupHandoffOffer = external_exports.object({
   path: ["liveKeys"]
 });
 
+// ../../packages/schema/src/zod/web-capture.ts
+var WebUsageSource = external_exports.enum(["site", "estimated", "none"]);
+var WebUsage = external_exports.object({
+  inputTokens: external_exports.number().int().nonnegative().optional(),
+  outputTokens: external_exports.number().int().nonnegative().optional(),
+  cacheReadInputTokens: external_exports.number().int().nonnegative().optional(),
+  cacheCreationInputTokens: external_exports.number().int().nonnegative().optional()
+});
+var WebToolCall = external_exports.object({
+  toolUseId: external_exports.string().min(1),
+  toolName: external_exports.string().min(1),
+  target: external_exports.string().optional(),
+  isError: external_exports.boolean().optional(),
+  inputSize: external_exports.number().int().nonnegative().optional(),
+  outputSize: external_exports.number().int().nonnegative().optional()
+});
+var WebExchange = external_exports.object({
+  messageId: external_exports.string().min(1),
+  startedAt: external_exports.iso.datetime(),
+  model: external_exports.string().optional(),
+  usage: WebUsage.optional(),
+  usageSource: WebUsageSource,
+  stopReason: external_exports.string().optional(),
+  conversationId: external_exports.string().optional(),
+  turnIndex: external_exports.number().int().nonnegative().optional(),
+  toolCalls: external_exports.array(WebToolCall).default([]),
+  // Absent when the adapter recovered no text. Capped by the caller at
+  // RESPONSE_TEXT_MAX_BYTES; `truncated` records that the cap was reached, so a
+  // short capture is never mistaken for a short reply.
+  responseText: external_exports.string().optional(),
+  truncated: external_exports.boolean().default(false)
+});
+var RESPONSE_TEXT_MAX_BYTES = 2 * 1024 * 1024;
+var WebCaptureStatus = external_exports.object({
+  patched: external_exports.boolean(),
+  live: external_exports.boolean(),
+  blind: external_exports.boolean(),
+  sendsSeenDom: external_exports.number().int().nonnegative(),
+  exchangesSeenNet: external_exports.number().int().nonnegative(),
+  parseFailures: external_exports.number().int().nonnegative(),
+  unparsedBodies: external_exports.number().int().nonnegative(),
+  // The adapter-declared JSON key paths that were absent from a real payload —
+  // the earliest signal that a site's contract moved.
+  shapeMisses: external_exports.array(external_exports.string()).default([])
+});
+
 // ../../packages/persistence/src/paths.ts
 import {
   chmodSync,
@@ -23324,6 +23551,32 @@ var STALE_PARTIAL_MS = 5 * 6e4;
 var SNAPSHOT_STAGING_SUFFIX = ".partial";
 var STAGED_NAME_SUFFIX = `.bak${SNAPSHOT_STAGING_SUFFIX}`;
 
+// ../../packages/persistence/src/internal/sql-functions.ts
+var utf8 = new TextDecoder();
+
+// ../../packages/persistence/src/internal/outbox-lane.ts
+var OUTBOX_CAPTURE_EVENT_TYPES = ["prompt", "response", "tool_use"];
+var OUTBOX_CAPTURE_TYPE_LIST = OUTBOX_CAPTURE_EVENT_TYPES.map((t) => `'${t}'`).join(", ");
+
+// ../../packages/persistence/src/sync-failure.ts
+var SYNC_FAILURE_REASONS = SyncFailureReason.options;
+
+// ../../packages/persistence/src/repositories/history-sync.ts
+var STRUCTURAL_EVENT_TYPES = ["session", "llm_call", "tool_call"];
+var TYPE_LIST = STRUCTURAL_EVENT_TYPES.map((t) => `'${t}'`).join(", ");
+var COUNTED_EVENT_TYPES = [
+  ...STRUCTURAL_EVENT_TYPES,
+  ...OUTBOX_CAPTURE_EVENT_TYPES
+];
+var COUNTED_TYPE_LIST = COUNTED_EVENT_TYPES.map((t) => `'${t}'`).join(", ");
+var COUNTED_SCOPE = `
+       WHERE event_type IN (${COUNTED_TYPE_LIST})
+         AND (
+           event_type IN (${TYPE_LIST})
+           OR synced_at IS NOT NULL
+           OR outbox_owed = 1
+         )`;
+
 // ../../packages/persistence/src/internal/json.ts
 function parseJsonObject(s) {
   if (s == null) return void 0;
@@ -23388,13 +23641,10 @@ var FINDING_ROW_COLUMNS_SQL = `f.id AS id, d.rule_id AS rule_id, d.category AS c
               e.tool_name AS tool_name,
               f.audit_event_id AS event_id, e.root_session_id AS session_id,
               e.event_type AS kind, f.finding_key AS finding_key,
-              ${latestResolutionStatusSql("f")} AS latest_status`;
-
-// ../../packages/persistence/src/repositories/history-sync.ts
-var STRUCTURAL_EVENT_TYPES = ["session", "llm_call", "tool_call"];
-var TYPE_LIST = STRUCTURAL_EVENT_TYPES.map((t) => `'${t}'`).join(", ");
-var OUTBOX_CAPTURE_EVENT_TYPES = ["prompt", "response", "tool_use"];
-var CAPTURE_TYPE_LIST = OUTBOX_CAPTURE_EVENT_TYPES.map((t) => `'${t}'`).join(", ");
+              ${latestResolutionStatusSql("f")} AS latest_status,
+              e.synced_at AS synced_at, e.sync_claimed_at AS sync_claimed_at,
+              e.sync_failed_at AS sync_failed_at, e.sync_failure AS sync_failure,
+              e.outbox_owed AS outbox_owed`;
 
 // ../../packages/persistence/src/repositories/installed-packs.ts
 import { createHash as createHash2, randomUUID as randomUUID4 } from "crypto";
@@ -23511,6 +23761,7 @@ function overlayManagedSettings(settings, managed, now = () => /* @__PURE__ */ n
   if (values.vaultInlineReveal !== void 0) merged.vaultInlineReveal = values.vaultInlineReveal;
   if (values.dataSharesInPlace !== void 0) merged.dataSharesInPlace = values.dataSharesInPlace;
   if (values.redactFallback !== void 0) merged.redactFallback = values.redactFallback;
+  if (values.bodyRetention !== void 0) merged.bodyRetention = values.bodyRetention;
   if (values.vaultConsent !== void 0) {
     merged.vaultConsent = values.vaultConsent ? (
       // Keep an existing valid grant so its acknowledgedAt survives; mint one
@@ -23598,9 +23849,11 @@ import { randomUUID as randomUUID10 } from "crypto";
 
 // ../../packages/persistence/src/database.ts
 var CAPTURE_GRAIN = new Set(EventKind.options);
+var DEFERRED_TAGS = new Set(DEFERRED_MIGRATION_TAGS);
 
 // ../../packages/persistence/src/egress-wire.ts
 import { createHash as createHash3 } from "crypto";
+var SLASH = "/".charCodeAt(0);
 
 // ../../packages/persistence/src/finding-key.ts
 import { createHash as createHash4 } from "crypto";
@@ -23611,18 +23864,26 @@ import { existsSync as existsSync3, readFileSync as readFileSync6 } from "fs";
 import { join as join8 } from "path";
 import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
 
+// ../../packages/persistence/src/forward-health.ts
+import { readFileSync as readFileSync7 } from "fs";
+import { join as join9 } from "path";
+
 // ../../packages/persistence/src/history-backfill.ts
 import { existsSync as existsSync4 } from "fs";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 
 // ../../packages/persistence/src/history-preview.ts
 import { existsSync as existsSync5 } from "fs";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 import { DatabaseSync as DatabaseSync3 } from "node:sqlite";
 
+// ../../packages/persistence/src/history-sync-state.ts
+import { readFileSync as readFileSync8 } from "fs";
+import { join as join12 } from "path";
+
 // ../../packages/persistence/src/store-symlinks.ts
 import { existsSync as existsSync6, lstatSync as lstatSync3, readlinkSync, realpathSync, statSync as statSync4 } from "fs";
-import { dirname as dirname3, join as join11, resolve } from "path";
+import { dirname as dirname3, join as join13, resolve } from "path";
 var STORE_DB = "the store database (including the prompt corpus)";
 var STORE_SETTINGS = "your settings file";
 function storeContents(home) {
@@ -23631,7 +23892,7 @@ function storeContents(home) {
     [settingsDir(home), STORE_SETTINGS],
     [dataDir(home), STORE_DB],
     [keysDir(home), "the vault key"],
-    [join11(settingsDir(home), "settings.json"), STORE_SETTINGS],
+    [join13(settingsDir(home), "settings.json"), STORE_SETTINGS],
     [dbPath(home), STORE_DB]
   ]);
 }
@@ -23683,15 +23944,15 @@ import {
 // ../../packages/persistence/src/vault/key-provider.ts
 import { execFileSync } from "child_process";
 import { randomBytes as randomBytes2 } from "crypto";
-import { chmodSync as chmodSync3, readFileSync as readFileSync7, renameSync as renameSync4, rmSync as rmSync6, statSync as statSync5, writeFileSync as writeFileSync3 } from "fs";
-import { join as join12 } from "path";
+import { chmodSync as chmodSync3, readFileSync as readFileSync9, renameSync as renameSync4, rmSync as rmSync6, statSync as statSync5, writeFileSync as writeFileSync3 } from "fs";
+import { join as join14 } from "path";
 
 // ../../packages/persistence/src/vault/vault.ts
 import { randomBytes as randomBytes3, randomUUID as randomUUID12 } from "crypto";
 
 // ../../packages/persistence/src/warn-era-cap.ts
 import { existsSync as existsSync7, writeFileSync as writeFileSync4 } from "fs";
-import { join as join13 } from "path";
+import { join as join15 } from "path";
 
 // ../../packages/plugin-sdk/src/provider-env.ts
 var DEFAULT_ANTHROPIC_HOST = "api.anthropic.com";
@@ -23745,7 +24006,7 @@ function resolveProvider() {
 function loadConfig(base = defaultDataDir(), resolveProviderFn = resolveProvider) {
   try {
     ensureLayoutDirSync(base);
-    const settingsFile = join14(settingsDir(base), "settings.json");
+    const settingsFile = join16(settingsDir(base), "settings.json");
     if (existsSync8(settingsFile)) tightenFile(settingsFile);
   } catch {
   }
@@ -23769,9 +24030,9 @@ function resolveProviderSafe(resolveProviderFn) {
 }
 
 // ../../packages/plugin-sdk/src/config-inventory.ts
-import { readdirSync as readdirSync2, readFileSync as readFileSync9, realpathSync as realpathSync2, statSync as statSync7 } from "fs";
+import { readdirSync as readdirSync2, readFileSync as readFileSync11, realpathSync as realpathSync2, statSync as statSync7 } from "fs";
 import { homedir as homedir2 } from "os";
-import { basename as basename3, join as join16 } from "path";
+import { basename as basename3, join as join18 } from "path";
 
 // ../../packages/detections/src/egress/registry.ts
 var EXTRACTOR_VERSION = "1";
@@ -24529,8 +24790,8 @@ var CPU_CORROBORATION_SHARE = 0.2;
 var CORROBORATION_FLOOR_MS = BUDGET_MS * CPU_CORROBORATION_SHARE;
 
 // ../../packages/plugin-sdk/src/repo.ts
-import { existsSync as existsSync9, readFileSync as readFileSync8, statSync as statSync6 } from "fs";
-import { basename as basename2, dirname as dirname4, isAbsolute, join as join15, sep as sep2 } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync10, statSync as statSync6 } from "fs";
+import { basename as basename2, dirname as dirname4, isAbsolute, join as join17, sep as sep2 } from "path";
 
 // ../../packages/plugin-sdk/src/events.ts
 import { createHash as createHash5, randomUUID as randomUUID13 } from "crypto";
@@ -24541,8 +24802,8 @@ import { fileURLToPath } from "url";
 import { Worker } from "worker_threads";
 
 // ../../packages/plugin-sdk/src/host-floor.ts
-import { readFileSync as readFileSync11 } from "fs";
-import { join as join18 } from "path";
+import { readFileSync as readFileSync13 } from "fs";
+import { join as join20 } from "path";
 
 // ../../packages/plugin-sdk/src/model-governance.ts
 import {
@@ -24550,18 +24811,18 @@ import {
   fstatSync,
   mkdirSync as mkdirSync2,
   openSync as openSync2,
-  readFileSync as readFileSync10,
+  readFileSync as readFileSync12,
   readSync,
   writeFileSync as writeFileSync5
 } from "fs";
-import { join as join17 } from "path";
+import { join as join19 } from "path";
 var SESSION_MODEL_MARKER = "session-model";
 function recordSessionModel(dataDir2, sessionId, model) {
   if (sessionId === void 0 || sessionId === "") return;
   if (model === void 0 || model === "") return;
   try {
     mkdirSync2(dataDir2, { recursive: true, mode: DATA_DIR_MODE });
-    writeFileSync5(join17(dataDir2, SESSION_MODEL_MARKER), JSON.stringify({ sessionId, model }), {
+    writeFileSync5(join19(dataDir2, SESSION_MODEL_MARKER), JSON.stringify({ sessionId, model }), {
       encoding: "utf8",
       mode: DATA_FILE_MODE
     });
@@ -24590,15 +24851,15 @@ var HOST_FLOORS = {
 
 // ../../packages/plugin-sdk/src/ignore-layers.ts
 var import_ignore = __toESM(require_ignore(), 1);
-import { readFileSync as readFileSync12 } from "fs";
-import { join as join19 } from "path";
+import { readFileSync as readFileSync14 } from "fs";
+import { join as join21 } from "path";
 
 // ../../packages/plugin-sdk/src/inventory-resolver.ts
 import { arch, hostname as hostname4, platform, release } from "os";
 
 // ../../packages/plugin-sdk/src/nudge.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync13, writeFileSync as writeFileSync6 } from "fs";
-import { join as join20 } from "path";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync15, writeFileSync as writeFileSync6 } from "fs";
+import { join as join22 } from "path";
 
 // ../../packages/plugin-sdk/src/paths.ts
 import { readdirSync as readdirSync3, realpathSync as realpathSync3 } from "fs";
@@ -24606,7 +24867,7 @@ import { basename as basename4, dirname as dirname5, sep as sep3 } from "path";
 
 // ../../packages/plugin-sdk/src/project-files.ts
 import { existsSync as existsSync11, readdirSync as readdirSync4 } from "fs";
-import { basename as basename5, join as join21 } from "path";
+import { basename as basename5, join as join23 } from "path";
 
 // ../../packages/plugin-sdk/src/provider-env-antigravity.ts
 var optionalBaseUrl2 = external_exports.preprocess((v) => {
@@ -24642,16 +24903,16 @@ var THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1e3;
 
 // ../../packages/plugin-sdk/src/throttle.ts
 import { mkdirSync as mkdirSync4, statSync as statSync8, writeFileSync as writeFileSync7 } from "fs";
-import { join as join22 } from "path";
+import { join as join24 } from "path";
 
 // src/hooks/model-switch-run.ts
 import { randomUUID as randomUUID16 } from "crypto";
 
 // src/hooks/model-guard.ts
 import { randomUUID as randomUUID15 } from "crypto";
-import { readFileSync as readFileSync14, statSync as statSync9 } from "fs";
+import { readFileSync as readFileSync16, statSync as statSync9 } from "fs";
 import { homedir as homedir3 } from "os";
-import { dirname as dirname6, join as join23 } from "path";
+import { dirname as dirname6, join as join25 } from "path";
 
 // src/hooks/model-switch-run.ts
 function runPostModelSwitch(sessionId, toModel, deps) {
@@ -24697,7 +24958,7 @@ function getString(record2, key) {
 
 // src/hooks/store-health.ts
 import { mkdirSync as mkdirSync5, readFileSync as readFileSync20, writeFileSync as writeFileSync8 } from "fs";
-import { dirname as dirname7, join as join30 } from "path";
+import { dirname as dirname7, join as join31 } from "path";
 
 // ../../packages/remote/src/http.ts
 import { request as httpRequest } from "http";
@@ -24705,21 +24966,16 @@ import { request as httpsRequest } from "https";
 var MAX_RESPONSE_BYTES = 8 * 1024 * 1024;
 
 // ../../packages/remote/src/client.ts
-var SLASH = "/".charCodeAt(0);
+var SLASH2 = "/".charCodeAt(0);
 
 // ../../packages/plugin-runtime/src/attached/forward-drops.ts
-import { readFileSync as readFileSync15 } from "fs";
-import { join as join24 } from "path";
+import { readFileSync as readFileSync17 } from "fs";
+import { join as join26 } from "path";
 
 // ../../packages/plugin-runtime/src/attached/forward-policy.ts
 import { randomUUID as randomUUID17 } from "crypto";
-import { readFileSync as readFileSync16 } from "fs";
 import { readFile, rename, writeFile } from "fs/promises";
-import { join as join25 } from "path";
-
-// ../../packages/plugin-runtime/src/attached/history-state.ts
-import { readFileSync as readFileSync17 } from "fs";
-import { join as join26 } from "path";
+import { join as join27 } from "path";
 
 // ../../packages/plugin-runtime/src/attached/history-sync.ts
 import { createHash as createHash6 } from "crypto";
@@ -24729,6 +24985,10 @@ import { hostname as hostname5 } from "os";
 var CORRELATION_ID = EventMetadata.shape.correlationId;
 var TRACE_ID = EventMetadata.shape.traceId;
 var EXCEPTION_ID = EventMetadata.shape.exceptionIds.unwrap().element;
+var REDACT_DEGRADED_TO = EventMetadata.shape.redactDegradedTo.unwrap();
+
+// ../../packages/plugin-runtime/src/attached/history-sync.ts
+var CAPTURE_BATCH_BYTES = 1024 * 1024;
 
 // ../../packages/plugin-runtime/src/attached/history-sync-trigger.ts
 import { spawn } from "child_process";
@@ -24741,7 +25001,7 @@ import { readFileSync as readFileSync18 } from "fs";
 // ../../packages/plugin-runtime/src/attached/policy-store.ts
 import { randomUUID as randomUUID18 } from "crypto";
 import { readFile as readFile2, rm, writeFile as writeFile2 } from "fs/promises";
-import { join as join27 } from "path";
+import { join as join28 } from "path";
 
 // ../../packages/plugin-runtime/src/attached/atomic-publish.ts
 import { rename as rename2 } from "fs/promises";
@@ -24756,11 +25016,11 @@ import { DatabaseSync as DatabaseSync4 } from "node:sqlite";
 // ../../packages/plugin-runtime/src/attached/posture-store.ts
 import { randomUUID as randomUUID19 } from "crypto";
 import { readFile as readFile3, rm as rm2, writeFile as writeFile3 } from "fs/promises";
-import { join as join28 } from "path";
+import { join as join29 } from "path";
 
 // ../../packages/plugin-runtime/src/attached/sync-state.ts
 import { readFileSync as readFileSync19 } from "fs";
-import { join as join29 } from "path";
+import { join as join30 } from "path";
 
 // ../../packages/plugin-runtime/src/attached/status.ts
 var REFUSAL_LINES = {
@@ -24781,6 +25041,14 @@ import { spawn as spawn2 } from "child_process";
 import { fileURLToPath as fileURLToPath3 } from "url";
 var SYNC_THROTTLE_MS = 15 * 60 * 1e3;
 
+// ../../packages/plugin-runtime/src/content-retention-pass.ts
+var MAX_ROWS_PER_SWEEP = 50 * 1e3;
+
+// ../../packages/plugin-runtime/src/content-retention-trigger.ts
+import { spawn as spawn3 } from "child_process";
+import { fileURLToPath as fileURLToPath4 } from "url";
+var CONTENT_RETENTION_THROTTLE_MS = 60 * 60 * 1e3;
+
 // ../../packages/plugin-runtime/src/attached/factory.ts
 import { hostname as hostname6 } from "os";
 
@@ -24799,7 +25067,7 @@ function markerDirs(dataDir2) {
 function alreadyClaimed(dirs, marker, sessionId) {
   return dirs.some((dir) => {
     try {
-      return readFileSync20(join30(dir, marker), "utf8") === sessionId;
+      return readFileSync20(join31(dir, marker), "utf8") === sessionId;
     } catch {
       return false;
     }
@@ -24809,7 +25077,7 @@ function recordClaim(dirs, marker, sessionId) {
   for (const dir of dirs) {
     try {
       mkdirSync5(dir, { recursive: true, mode: DATA_DIR_MODE });
-      writeFileSync8(join30(dir, marker), sessionId, { mode: DATA_FILE_MODE });
+      writeFileSync8(join31(dir, marker), sessionId, { mode: DATA_FILE_MODE });
       return;
     } catch {
     }