@akasecurity/ai-tc-claude-code 0.9.5 → 0.9.7

package/scripts/pre-tool-use.js

@@ -585,6 +585,10 @@ var SQLITE_MIGRATIONS = [
   {
     tag: "0020_secret_vault_pagination_indexes",
     sql: "CREATE INDEX `idx_secret_vault_last_seen` ON `secret_vault` (`last_seen`,`pointer_id`);--> statement-breakpoint\nCREATE INDEX `idx_secret_vault_reuse` ON `secret_vault` (`occurrence_count`,`pointer_id`);--> statement-breakpoint\nCREATE INDEX `idx_secret_vault_deref_at` ON `secret_vault_deref` (`at`,`id`);--> statement-breakpoint\nCREATE INDEX `idx_secret_vault_deref_signal` ON `secret_vault_deref` (`at`,`id`) WHERE `reason` NOT IN ('display', 'view-render');"
+  },
+  {
+    tag: "0021_finding_resolution_resolved_at_index",
+    sql: "CREATE INDEX `idx_finding_resolution_resolved_at` ON `finding_resolution` (`resolved_at`);\n"
   }
 ];
 
@@ -15300,6 +15304,47 @@ function date4(params) {
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
 config(en_default());
 
+// ../../packages/schema/src/zod/harness-map.ts
+var HARNESS = {
+  ClaudeCode: "claudecode",
+  Cursor: "cursor",
+  Copilot: "copilot",
+  Codex: "codex",
+  Antigravity: "antigravity",
+  Windsurf: "windsurf",
+  ClaudeDesktop: "claudedesktop",
+  ChatGpt: "chatgpt",
+  ClaudeAi: "claudeai",
+  Api: "api"
+};
+var Harness = external_exports.enum(HARNESS).meta({ id: "Harness" });
+var SOURCE_TOOL = {
+  ClaudeCode: "claude-code",
+  ClaudeDesktop: "claude-desktop",
+  Cursor: "cursor",
+  ChatGpt: "chatgpt",
+  ClaudeAi: "claude-ai",
+  Copilot: "github-copilot",
+  Codex: "codex",
+  Antigravity: "antigravity",
+  // No harness counterpart, deliberately: the CLI's own captures and a capture
+  // whose tool could not be identified both render through the read side's
+  // miss path rather than as a harness of their own.
+  Cli: "cli",
+  Unknown: "unknown"
+};
+var SourceTool = external_exports.enum(SOURCE_TOOL).meta({ id: "SourceTool" });
+var TOOL_TO_HARNESS = {
+  [SOURCE_TOOL.ClaudeCode]: HARNESS.ClaudeCode,
+  [SOURCE_TOOL.ClaudeDesktop]: HARNESS.ClaudeDesktop,
+  [SOURCE_TOOL.Copilot]: HARNESS.Copilot,
+  [SOURCE_TOOL.Cursor]: HARNESS.Cursor,
+  [SOURCE_TOOL.ChatGpt]: HARNESS.ChatGpt,
+  [SOURCE_TOOL.Codex]: HARNESS.Codex,
+  [SOURCE_TOOL.Antigravity]: HARNESS.Antigravity,
+  [SOURCE_TOOL.ClaudeAi]: HARNESS.ClaudeAi
+};
+
 // ../../packages/schema/src/zod/finding.ts
 var DetectionCategory = external_exports.enum(["pii", "financial", "secret", "phi", "code_context", "code_flaw", "custom", "config"]).meta({ id: "DetectionCategory" });
 var Severity = external_exports.enum(["critical", "high", "medium", "low"]).meta({ id: "Severity" });
@@ -15322,21 +15367,22 @@ var Finding = external_exports.object({
 }).meta({ id: "Finding" });
 var DetectedFinding = Finding.meta({ id: "DetectedFinding" });
 var FindingAction = external_exports.enum(["blocked", "redacted", "warned", "allowed", "quarantined", "monitored"]).meta({ id: "FindingAction" });
-var FindingProvider = external_exports.enum([
-  "claudecode",
-  "claudedesktop",
-  "cursor",
-  "copilot",
-  "chatgpt",
-  "claudeai",
-  "codex",
-  "antigravity",
-  "api"
+var FindingProvider = Harness.extract([
+  "ClaudeCode",
+  "ClaudeDesktop",
+  "Cursor",
+  "Copilot",
+  "ChatGpt",
+  "ClaudeAi",
+  "Codex",
+  "Antigravity",
+  "Api"
 ]).meta({ id: "FindingProvider" });
 var FindingCategory = external_exports.enum([
   "secret",
   "pii",
   "source_code",
+  "code_flaw",
   "external_share",
   "mcp_server",
   "customer_data",
@@ -15516,6 +15562,7 @@ var FindingInstanceDetail = FindingInstance.extend({
   policy: FindingPolicyRef
 }).meta({ id: "FindingInstanceDetail" });
 var DEFAULT_FLAT_FINDINGS_LIMIT = 50;
+var MAX_FLAT_FINDINGS_LIMIT = 200;
 var ListFindingInstancesQuery = external_exports.object({
   severity: external_exports.array(Severity).optional(),
   // Rule ids, the same vocabulary the grouped list's `subtype` carries.
@@ -15535,7 +15582,7 @@ var ListFindingInstancesQuery = external_exports.object({
   q: external_exports.string().optional(),
   sessionId: external_exports.string().optional(),
   from: external_exports.iso.datetime().optional(),
-  limit: external_exports.coerce.number().int().min(1).max(200).optional(),
+  limit: external_exports.coerce.number().int().min(1).max(MAX_FLAT_FINDINGS_LIMIT).optional(),
   cursor: external_exports.string().optional()
 });
 var ListFindingInstancesResponse = external_exports.object({
@@ -15597,30 +15644,6 @@ var ListFindingLocationsResponse = external_exports.object({
   hasMore: external_exports.boolean()
 }).meta({ id: "ListFindingLocationsResponse" });
 
-// ../../packages/schema/src/zod/harness-map.ts
-var Harness = external_exports.enum([
-  "claudecode",
-  "cursor",
-  "copilot",
-  "codex",
-  "antigravity",
-  "windsurf",
-  "claudedesktop",
-  "chatgpt",
-  "claudeai",
-  "api"
-]).meta({ id: "Harness" });
-var TOOL_TO_HARNESS = {
-  "claude-code": "claudecode",
-  "claude-desktop": "claudedesktop",
-  "github-copilot": "copilot",
-  cursor: "cursor",
-  chatgpt: "chatgpt",
-  codex: "codex",
-  antigravity: "antigravity",
-  "claude-ai": "claudeai"
-};
-
 // ../../packages/schema/src/zod/meta.ts
 var InventoryObjectType = external_exports.enum(["host", "harness", "user", "skill", "hook", "mcp_server", "config_file"]).meta({ id: "InventoryObjectType" });
 var AuditEventType = external_exports.enum([
@@ -16073,686 +16096,37 @@ var ActivityOverviewResponse = external_exports.object({
   sessions: ListActivitySessionsResponse
 }).meta({ id: "ActivityOverviewResponse" });
 
-// ../../packages/schema/src/zod/event.ts
-var EventKind = external_exports.enum(["prompt", "response", "code_change", "tool_use"]).meta({ id: "EventKind" });
-var CAPTURE_EVENT_TYPES_SQL = EventKind.options.map((k) => `'${k}'`).join(",");
-var SourceTool = external_exports.enum([
-  "claude-code",
-  "claude-desktop",
-  "cursor",
-  "chatgpt",
-  "claude-ai",
-  "github-copilot",
-  "codex",
-  "antigravity",
-  "cli",
-  "unknown"
-]).meta({ id: "SourceTool" });
-var EventMetadata = external_exports.object({
-  sessionId: external_exports.string().optional(),
-  repo: external_exports.string().optional(),
-  filePath: external_exports.string().optional(),
-  // The host tool whose input/output was scanned (e.g. 'Bash', 'WebFetch'),
-  // set by the tool-scanning hooks. The tool NAME only — never the tool's
-  // arguments or output, which can carry the very value a finding masked
-  // (metadata is stored unredacted). Gives findings on non-file captures a
-  // display location ("via Bash") when no filePath exists.
-  toolName: external_exports.string().optional(),
-  // Set (true) by the worktree scanner when the file is excluded by the
-  // repo's .gitignore. Gitignored files ARE still scanned — local scratch and
-  // generated code can leak real secrets — but the provenance is recorded so
-  // policy/dashboards can treat those findings as informational rather than
-  // blocking. Omitted (not false) for tracked files and non-scan events.
-  gitignored: external_exports.boolean().optional(),
-  // Set (true) ONLY when the event's `content` is the COMPLETE file at
-  // capture time (a worktree scan reading from disk). Hook-captured edits
-  // (e.g. an Edit tool's new_string) are partial fragments and MUST NOT set
-  // this. The resolver-on-ingest keys its fixed-at-source dropout
-  // diff on this marker: only a whole-file snapshot can prove a previously
-  // open finding is gone; a fragment's absence proves nothing (the secret
-  // may live outside the hunk). Omitted (not false) for fragments and
-  // non-scan events, so pre-marker clients safely default to the
-  // non-authoritative path.
-  wholeFile: external_exports.boolean().optional(),
-  model: external_exports.string().optional(),
-  turnIndex: external_exports.number().int().nonnegative().optional(),
-  // Distributed-tracing correlation. `correlationId` ties a recorded event back
-  // to the request that captured/ingested it (a UUID, generated independently of
-  // the trace id); `traceId` is the W3C trace id (32 lowercase hex chars) of the
-  // originating span when telemetry is enabled. Both optional + backward
-  // compatible — populated by the plugin (see @akasecurity/plugin-sdk).
-  correlationId: external_exports.uuid().optional(),
-  traceId: external_exports.string().regex(/^[0-9a-f]{32}$/).optional(),
-  // Ids of the detection exceptions that downgraded findings in this capture
-  // to 'allow' — the enforcement audit trail's link back to the grant that
-  // authorized the bypass. Absent on captures where no exception applied.
-  exceptionIds: external_exports.array(external_exports.guid()).optional()
-}).meta({ id: "EventMetadata" });
-var Event = external_exports.object({
-  id: external_exports.guid(),
-  sourceTool: SourceTool,
-  kind: EventKind,
-  occurredAt: external_exports.iso.datetime(),
-  contentHash: external_exports.string(),
-  content: external_exports.string(),
-  metadata: EventMetadata.optional()
-}).meta({ id: "Event" });
-var IngestEvent = Event.meta({ id: "IngestEvent" });
-var IngestBatch = external_exports.object({
-  events: external_exports.array(IngestEvent).min(1).max(100),
-  // Dedup policy for this batch. Id-dedup ALWAYS applies. 'content-hash'
-  // additionally rejects any event whose contentHash the store has already
-  // recorded — for re-runnable bulk ingest (worktree scan, transcript
-  // backfill), where a re-run mints fresh event ids for identical content and
-  // would otherwise accumulate duplicates. Live hook traffic must NOT set it:
-  // two genuinely separate prompts can be byte-identical and both belong on
-  // the timeline.
-  dedupe: external_exports.literal("content-hash").optional()
-}).meta({ id: "IngestBatch" });
-
-// ../../packages/schema/src/zod/inventory.ts
-var AssetType = external_exports.enum(["project", "skill", "mcp", "hook", "config"]).meta({ id: "AssetType" });
-var AccessLevel = external_exports.enum(["open", "approved", "blocked"]).meta({ id: "AccessLevel" });
-var Origin = external_exports.enum(["source", "public-dep", "vendored", "config", "data", "docs", "generated"]).meta({ id: "Origin" });
-var TrustLevel = external_exports.enum(["known-good", "risky", "unapproved"]).meta({ id: "TrustLevel" });
-var Flag = external_exports.enum(["update", "stale", "conflict", "unknown", "change", "untracked", "risk", "findings"]).meta({ id: "Flag" });
-var Visibility = external_exports.enum(["public", "private"]).meta({ id: "Visibility" });
-var HarnessEventKind = external_exports.enum(["block", "redact", "warn"]).meta({ id: "HarnessEventKind" });
-var HarnessId = external_exports.enum(["claudecode", "cursor", "codex", "antigravity"]).meta({ id: "HarnessId" });
-var AccessCounts = external_exports.object({
-  open: external_exports.number().int().nonnegative(),
-  approved: external_exports.number().int().nonnegative(),
-  blocked: external_exports.number().int().nonnegative(),
-  total: external_exports.number().int().nonnegative()
-}).meta({ id: "AccessCounts" });
-var AssetSummary = external_exports.object({
-  id: external_exports.string(),
-  type: AssetType,
-  name: external_exports.string(),
-  sub: external_exports.string(),
-  flags: external_exports.array(Flag),
-  /** MCP servers only — omitted for all other types. */
-  trust: TrustLevel.optional()
-}).meta({ id: "AssetSummary" });
-var ProjectSummary = external_exports.object({
-  id: external_exports.string(),
-  name: external_exports.string(),
-  repo: external_exports.string(),
-  visibility: Visibility,
-  language: external_exports.string(),
-  policyDefault: AccessLevel,
-  updatedAt: external_exports.iso.datetime(),
-  accessCounts: AccessCounts,
-  findingsCount: external_exports.number().int().nonnegative()
-}).meta({ id: "ProjectSummary" });
-var HarnessCategory = external_exports.object({
-  /** One of config/skill/mcp/hook — never project (enforced at service layer). */
-  type: AssetType,
-  assets: external_exports.array(AssetSummary)
+// ../../packages/schema/src/zod/config-inventory.ts
+var ConfigScope = external_exports.enum(["user", "project", "local", "plugin"]);
+var SkillScanEntry = external_exports.object({
+  name: external_exports.string().min(1),
+  // The identity source: a marketplace repo for plugin skills (e.g.
+  // 'anthropics/skills'), 'local' for personal ~/.claude/skills, or
+  // 'project:<repo-identity>' for checked-in project skills. The surrogate keeps
+  // a personal skill named 'pdf' from colliding with the marketplace 'pdf'.
+  source: external_exports.string().min(1),
+  scope: ConfigScope,
+  pluginName: external_exports.string().optional(),
+  // Volatile — rides the attribute bag, never the identity hash.
+  version: external_exports.string().optional(),
+  description: external_exports.string().optional(),
+  // Skill directory mtime (ISO) — the "updated Nd ago" freshness signal.
+  updatedAt: external_exports.iso.datetime().optional(),
+  // Filesystem path — the promoted inventory `location` column.
+  location: external_exports.string().optional()
 });
-var HarnessSummary = external_exports.object({
-  id: HarnessId,
-  label: external_exports.string(),
-  kind: external_exports.string(),
-  version: external_exports.string(),
-  sessions: external_exports.number().int().nonnegative(),
-  assetCount: external_exports.number().int().nonnegative(),
-  flagCount: external_exports.number().int().nonnegative(),
-  projects: external_exports.array(ProjectSummary),
-  categories: external_exports.array(HarnessCategory)
-}).meta({ id: "HarnessSummary" });
-var ListHarnessesResponse = external_exports.object({ items: external_exports.array(HarnessSummary) }).meta({ id: "ListHarnessesResponse" });
-var AssetGroup = external_exports.object({
-  /** Group key — never project (enforced at service layer). */
-  type: AssetType,
-  total: external_exports.number().int().nonnegative(),
-  /**
-   * MCP group only — omitted for all other types.
-   * Partial: only TrustLevel keys with non-zero counts are included.
-   * Strict: unknown keys are rejected — only TrustLevel values are valid keys.
-   */
-  trustRollup: external_exports.object({
-    "known-good": external_exports.number().int().nonnegative(),
-    risky: external_exports.number().int().nonnegative(),
-    unapproved: external_exports.number().int().nonnegative()
-  }).partial().strict().optional(),
-  /**
-   * Partial: only Flag keys with non-zero counts are included.
-   * Strict: unknown keys are rejected — only Flag values are valid keys.
-   */
-  flagRollup: external_exports.object({
-    update: external_exports.number().int().nonnegative(),
-    stale: external_exports.number().int().nonnegative(),
-    conflict: external_exports.number().int().nonnegative(),
-    unknown: external_exports.number().int().nonnegative(),
-    change: external_exports.number().int().nonnegative(),
-    untracked: external_exports.number().int().nonnegative(),
-    risk: external_exports.number().int().nonnegative(),
-    findings: external_exports.number().int().nonnegative()
-  }).partial().strict(),
-  items: external_exports.array(AssetSummary)
-}).meta({ id: "AssetGroup" });
-var ListAssetsResponse = external_exports.object({ groups: external_exports.array(AssetGroup) }).meta({ id: "ListAssetsResponse" });
-var McpTool = external_exports.object({
-  name: external_exports.string(),
-  signature: external_exports.string(),
-  description: external_exports.string(),
-  write: external_exports.boolean(),
-  /** Non-null string when tool is dangerous / blocked; null otherwise. */
-  risk: external_exports.string().nullable()
-}).meta({ id: "McpTool" });
-var AssetFindingRef = external_exports.object({
-  id: external_exports.string(),
-  title: external_exports.string(),
-  note: external_exports.string()
-});
-var AssetDetail = AssetSummary.extend({
-  /** string | null — null when no description is available. */
-  description: external_exports.string().nullable(),
-  /** trustLevel | null — null for non-MCP assets. */
-  trust: TrustLevel.nullable(),
-  /** Type-specific raw key/values — FE renders the grid. */
-  meta: external_exports.record(external_exports.string(), external_exports.unknown()),
-  /** always present — object when there is an active finding, null when absent. */
-  finding: AssetFindingRef.nullable(),
-  /** MCP exposed-tools list — omitted for non-mcp. */
-  tools: external_exports.array(McpTool).optional()
-}).meta({ id: "AssetDetail" });
-var ListProjectsResponse = external_exports.object({ items: external_exports.array(ProjectSummary) }).meta({ id: "ListProjectsResponse" });
-var InventoryStats = external_exports.object({
-  /** Total assets/projects with ≥1 flag or finding (drives the attention header chip). */
-  attention: external_exports.number().int().nonnegative(),
-  byType: external_exports.object({
-    project: external_exports.number().int().nonnegative(),
-    skill: external_exports.number().int().nonnegative(),
-    mcp: external_exports.number().int().nonnegative(),
-    hook: external_exports.number().int().nonnegative(),
-    config: external_exports.number().int().nonnegative()
-  }),
-  harnesses: external_exports.number().int().nonnegative(),
-  mcpTrust: external_exports.object({
-    "known-good": external_exports.number().int().nonnegative(),
-    risky: external_exports.number().int().nonnegative(),
-    unapproved: external_exports.number().int().nonnegative()
-  })
-}).meta({ id: "InventoryStats" });
-var FileSummary = external_exports.object({
-  path: external_exports.string(),
-  name: external_exports.string(),
-  origin: Origin,
-  /** Effective access (override applied). */
-  access: AccessLevel,
-  /** True when a file_access_override differs from the computed default. */
-  isCustom: external_exports.boolean(),
-  findings: external_exports.number().int().nonnegative(),
-  /** When the file was auto-blocked by a detection; null when not blocked. */
-  blockedAt: external_exports.iso.datetime().nullable().optional(),
-  /** Why the file was blocked; null when absent. */
-  note: external_exports.string().nullable().optional()
-}).meta({ id: "FileSummary" });
-var FolderSummary = external_exports.object({
-  name: external_exports.string(),
-  path: external_exports.string(),
-  /** Rollup of effective access across all descendants. */
-  accessCounts: AccessCounts
-}).meta({ id: "FolderSummary" });
-var ProjectTreeResponse = external_exports.object({
-  project: external_exports.object({
-    id: external_exports.string(),
-    repo: external_exports.string(),
-    visibility: Visibility
-  }),
-  path: external_exports.string(),
-  /** Browse mode: one-level folders at the current path. Omitted in search mode. */
-  folders: external_exports.array(FolderSummary).optional(),
-  files: external_exports.array(FileSummary)
-}).meta({ id: "ProjectTreeResponse" });
-var FileDetail = FileSummary.extend({
-  project: external_exports.object({
-    repo: external_exports.string(),
-    visibility: Visibility,
-    language: external_exports.string(),
-    policyDefault: AccessLevel,
-    updatedAt: external_exports.iso.datetime()
-  }),
-  findingsRefs: external_exports.array(external_exports.object({ id: external_exports.string(), title: external_exports.string() }))
-}).meta({ id: "FileDetail" });
-var SetFileAccessBody = external_exports.object({
-  path: external_exports.string(),
-  access: AccessLevel
-}).meta({ id: "SetFileAccessBody" });
-var SetFileAccessResponse = external_exports.object({
-  file: FileSummary,
-  accessCounts: AccessCounts
-}).meta({ id: "SetFileAccessResponse" });
-var SetMcpTrustBody = external_exports.object({ trust: TrustLevel }).meta({ id: "SetMcpTrustBody" });
-var HarnessEventItem = external_exports.object({
-  kind: HarnessEventKind,
-  title: external_exports.string(),
-  detail: external_exports.string(),
-  occurredAt: external_exports.iso.datetime(),
-  findingId: external_exports.string().nullable().optional()
-}).meta({ id: "HarnessEventItem" });
-var HarnessEventsResponse = external_exports.object({
-  counts: external_exports.object({
-    block: external_exports.number().int().nonnegative(),
-    redact: external_exports.number().int().nonnegative(),
-    warn: external_exports.number().int().nonnegative()
-  }),
-  items: external_exports.array(HarnessEventItem)
-}).meta({ id: "HarnessEventsResponse" });
-var RescanResponse = external_exports.object({
-  jobId: external_exports.string(),
-  startedAt: external_exports.iso.datetime()
-}).meta({ id: "RescanResponse" });
-var ConnectProjectBody = external_exports.object({ repo: external_exports.string() }).meta({ id: "ConnectProjectBody" });
-var ListAssetsQuery = external_exports.object({
-  /** Filter by one or more AssetType values; absent means all types. */
-  type: external_exports.array(AssetType).optional(),
-  /** Free-text search term. */
-  q: external_exports.string().optional()
-});
-var GetProjectTreeQuery = external_exports.object({
-  /** Subtree root path; defaults to repository root when absent. */
-  path: external_exports.string().optional(),
-  /** Free-text filter applied to file paths. */
-  q: external_exports.string().optional(),
-  /**
-   * Special listing mode. `blocked` returns every effectively-blocked, auto-blocked
-   * file across the whole repo (folders omitted, most-recent first), ignoring
-   * `path`/`q` — powers the project-wide "recently blocked" strip.
-   */
-  filter: external_exports.enum(["blocked"]).optional()
-});
-var GetProjectFileQuery = external_exports.object({
-  /** Repository-relative file path; absent or empty → 400. */
-  path: external_exports.string()
-});
-var GetHarnessEventsQuery = external_exports.object({
-  /** Maximum number of events to return.  Range: 1–50; default: 7. */
-  limit: external_exports.coerce.number().int().min(1).max(50).default(7)
-});
-
-// ../../packages/schema/src/zod/exception.ts
-var ExceptionScope = external_exports.enum(["once", "temporary", "permanent"]);
-var ExceptionConditions = external_exports.object({
-  repo: external_exports.string().optional(),
-  sourceTool: external_exports.string().optional(),
-  provider: external_exports.string().optional()
-}).strict();
-var ExceptionCapability = external_exports.enum(["suppress", "reveal_to_model"]);
-var DetectionException = external_exports.object({
-  id: external_exports.guid(),
-  ruleId: external_exports.string(),
-  // Denormalized from the rule, for reporting — never matched on.
-  category: DetectionCategory,
-  // HMAC-SHA256 hex of the raw match under a machine-local key: a KEYED
-  // fingerprint, never the raw value, and never reversible. Matching recomputes
-  // the fingerprint from a fresh capture; the value itself is never stored.
-  // Shape-constrained so a malformed — or accidentally raw — value is rejected
-  // at the boundary rather than persisted.
-  valueFingerprint: external_exports.string().regex(/^[0-9a-f]{64}$/),
-  // Version of the fingerprint key the grant was written under; a rotated key
-  // invalidates old grants rather than silently mismatching them.
-  keyVersion: external_exports.number().int().positive(),
-  // maskMatch() preview of the approved value — never the raw value.
-  maskedValue: external_exports.string(),
-  capability: ExceptionCapability.default("suppress"),
-  scope: ExceptionScope,
-  expiresAt: external_exports.iso.datetime().nullable(),
-  maxUses: external_exports.number().int().positive().nullable(),
-  useCount: external_exports.number().int().nonnegative(),
-  lastUsedAt: external_exports.iso.datetime().nullable(),
-  // Mandatory: every grant carries the human reason it exists.
-  justification: external_exports.string().min(1),
-  conditions: ExceptionConditions.nullable(),
-  createdBy: external_exports.string(),
-  createdVia: external_exports.enum(["cli-approve", "cli-add", "web-approve", "web-add", "api", "setup-triage"]),
-  createdAt: external_exports.iso.datetime(),
-  updatedAt: external_exports.iso.datetime(),
-  // Revocation is terminal and retained — consumed/expired/revoked rows are
-  // audit evidence; nothing in the exception lifecycle hard-deletes.
-  revokedAt: external_exports.iso.datetime().nullable(),
-  revokedBy: external_exports.string().nullable(),
-  revokeReason: external_exports.string().nullable()
-});
-var ExceptionBundleEntry = DetectionException.pick({
-  id: true,
-  ruleId: true,
-  valueFingerprint: true,
-  keyVersion: true,
-  capability: true,
-  expiresAt: true,
-  maxUses: true,
-  useCount: true,
-  conditions: true
-});
-var ExceptionDescriptor = DetectionException.omit({ valueFingerprint: true });
-
-// ../../packages/schema/src/zod/rule.ts
-var MatcherType = external_exports.enum(["keyword", "regex", "validator"]).meta({ id: "MatcherType" });
-var RuleProbeVerdict = external_exports.enum(["safe", "quarantined"]).meta({ id: "RuleProbeVerdict" });
-var KeywordMatcher = external_exports.object({
-  type: external_exports.literal("keyword"),
-  // An empty keyword matches at every position, yielding one zero-length span
-  // per character. Rejected here because a keyword that matches everything is
-  // never intentional.
-  keywords: external_exports.array(external_exports.string().min(1)).min(1),
-  caseSensitive: external_exports.boolean().default(false)
-});
-function isValidRegex(pattern, flags) {
-  try {
-    new RegExp(pattern, flags);
-    return true;
-  } catch {
-    return false;
-  }
-}
-function matchesEmptyString(pattern, flags) {
-  try {
-    const re = new RegExp(pattern, flags.replace(/[gy]/g, ""));
-    return re.exec("")?.[0].length === 0;
-  } catch {
-    return false;
-  }
-}
-var MAX_PATTERN_LENGTH = 2e3;
-var RegexMatcher = external_exports.object({
-  type: external_exports.literal("regex"),
-  pattern: external_exports.string().min(1).max(MAX_PATTERN_LENGTH),
-  flags: external_exports.string().default("gi"),
-  captureGroup: external_exports.number().int().nonnegative().optional()
-}).refine((v) => isValidRegex(v.pattern, v.flags), {
-  message: "pattern/flags do not form a valid JavaScript regular expression",
-  path: ["pattern"]
-}).refine((v) => v.captureGroup !== void 0 || !matchesEmptyString(v.pattern, v.flags), {
-  message: 'a whole-match regex that can match the empty string (e.g. "\\d*", "a?", "(?:)") can hang the matcher \u2014 scope the quantifier to a captureGroup, or require at least one character',
-  path: ["pattern"]
-});
-var ValidatorMatcher = external_exports.object({
-  type: external_exports.literal("validator"),
-  name: external_exports.enum(["luhn", "entropy", "ssn-checksum"]),
-  config: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
-});
-var Matcher = external_exports.discriminatedUnion("type", [KeywordMatcher, RegexMatcher, ValidatorMatcher]).meta({ id: "Matcher" });
-var AppliesTo = external_exports.object({
-  // Dot-prefixed, e.g. ".py" — matches the scanner's SOURCE_EXTENSIONS shape.
-  extensions: external_exports.array(external_exports.string().regex(/^\.[A-Za-z0-9]+$/)).min(1)
-}).meta({ id: "AppliesTo" });
-var PostValidatorRef = external_exports.union([
-  external_exports.string(),
-  external_exports.object({
-    name: external_exports.string(),
-    config: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
-  })
-]).meta({ id: "PostValidatorRef" });
-var RequiresNearby = external_exports.object({
-  // Each array, when present, must be non-empty and contain non-empty strings —
-  // an empty/blank criterion would either never fire or (for labels) match
-  // everything.
-  categories: external_exports.array(DetectionCategory).min(1).optional(),
-  ruleIds: external_exports.array(external_exports.string().min(1)).min(1).optional(),
-  labels: external_exports.array(external_exports.string().min(1)).min(1).optional(),
-  windowChars: external_exports.number().int().positive().default(160),
-  // Optional confidence bump applied when a gated match is corroborated. Capped
-  // small: it nudges confidence, it does not assert certainty.
-  confidenceBoost: external_exports.number().min(0).max(0.3).optional()
-}).refine(
-  (v) => (v.categories?.length ?? 0) + (v.ruleIds?.length ?? 0) + (v.labels?.length ?? 0) > 0,
-  { message: "requiresNearby needs at least one of categories, ruleIds, or labels" }
-).meta({ id: "RequiresNearby" });
-var RuleFixture = external_exports.object({
-  label: external_exports.string(),
-  text: external_exports.string().max(5e4),
-  shouldMatch: external_exports.boolean(),
-  // Simulated file context for the scan, so fixtures can assert `appliesTo`
-  // gating (e.g. a Python-only pattern must NOT fire in a .ts file).
-  filePath: external_exports.string().optional(),
-  expectedSpans: external_exports.array(external_exports.object({ start: external_exports.number(), end: external_exports.number() })).optional()
-}).meta({ id: "RuleFixture" });
-var Rule = external_exports.object({
-  specVersion: external_exports.literal(1),
-  // `packId/ruleName` (e.g. `secrets/aws-access-key`). NOTE the first segment is
-  // the PACK id, NOT a namespace — this is a DIFFERENT slug space from a
-  // detection id (`namespace/packId`, decoded by splitDetectionId). A Rule.id
-  // therefore carries no namespace and is not globally unique across publishers;
-  // never feed one to splitDetectionId. `category` below (per-rule) is the
-  // taxonomy axis; the pack's enforcement policy is installed_packs.policy_id.
-  id: external_exports.string().regex(/^[a-z][a-z0-9-]*\/[a-z][a-z0-9-]*$/),
-  name: external_exports.string(),
-  category: DetectionCategory,
-  severity: Severity,
-  matcher: Matcher,
-  appliesTo: AppliesTo.optional(),
-  postValidators: external_exports.array(PostValidatorRef).optional(),
-  requiresNearby: RequiresNearby.optional(),
-  examples: external_exports.array(external_exports.string()).optional()
-}).meta({ id: "Rule" });
-var Author = external_exports.object({
-  name: external_exports.string(),
-  email: external_exports.email().optional(),
-  url: external_exports.url().optional()
-}).meta({ id: "Author" });
-var PackManifest = external_exports.object({
-  specVersion: external_exports.literal(1),
-  id: external_exports.string(),
-  name: external_exports.string(),
-  version: external_exports.string(),
-  rules: external_exports.array(external_exports.string()),
-  // Optional attribution/provenance — consumed by the rule marketplace.
-  description: external_exports.string().optional(),
-  author: Author.optional(),
-  license: external_exports.string().optional(),
-  sourceUrl: external_exports.url().optional()
-}).meta({ id: "PackManifest" });
-
-// ../../packages/schema/src/zod/policy.ts
-var PolicyScope = external_exports.enum(["global", "repo", "user"]).meta({ id: "PolicyScope" });
-var PolicyTarget = external_exports.union([external_exports.object({ ruleId: external_exports.string() }), external_exports.object({ category: DetectionCategory })]).meta({ id: "PolicyTarget" });
-var Policy = external_exports.object({
-  id: external_exports.guid(),
-  scope: PolicyScope,
-  target: PolicyTarget,
-  action: ActionTaken,
-  enabled: external_exports.boolean().default(true),
-  customKeywords: external_exports.array(external_exports.string()).optional(),
-  // Display name — optional so older policy rows without name still parse.
-  // Added for the findings API (policy.name column migration).
-  name: external_exports.string().optional()
-}).meta({ id: "Policy" });
-var PolicyBundle = external_exports.object({
-  version: external_exports.string(),
-  policies: external_exports.array(Policy),
-  // Rules from the installed marketplace packs (snapshotted by the
-  // control plane). The plugin registers these in addition to its bundled
-  // packs. Optional so older backends — and older on-disk caches — that omit
-  // the field still parse; consumers read `bundle.rules ?? []`.
-  rules: external_exports.array(Rule).optional(),
-  // When true, `rules` IS the complete effective ruleset and the runtime must
-  // NOT merge its compiled-in bundled packs — the standalone gateway sets this
-  // after reading the user's installed snapshot (installed_packs, enabled
-  // packs only), which is how detection updates stay manual: new bundled
-  // rules run only after the user applies the pack update. Absent/false keeps
-  // the historical composition (bundled packs + rules) — older caches.
-  rulesComplete: external_exports.boolean().optional(),
-  // Active detection exceptions, evaluation subset only (see
-  // ExceptionBundleEntry). Optional so older bundle producers — and older
-  // on-disk caches — that omit the field still parse; consumers read
-  // `bundle.exceptions ?? []`.
-  exceptions: external_exports.array(ExceptionBundleEntry).optional(),
-  // Installed pack version, keyed by ruleId, for rules in `rules` that came
-  // from a versioned installed pack. Optional so older backends — and older
-  // on-disk caches — that omit the field still parse; consumers fall back to
-  // the rule's own spec version. NOT the bundle version above — see
-  // installedRuleset's ruleVersions for the source of truth.
-  ruleVersions: external_exports.record(external_exports.string(), external_exports.string()).optional(),
-  customKeywords: external_exports.array(external_exports.string()),
-  fetchedAt: external_exports.iso.datetime()
-}).meta({ id: "PolicyBundle" });
-var OBSERVE_ONLY_CATEGORIES = ["config"];
-var ENFORCEABLE_CATEGORIES = DetectionCategory.options.filter((c) => !OBSERVE_ONLY_CATEGORIES.includes(c));
-var CATEGORY_PEAK_SEVERITY = {
-  secret: "critical",
-  financial: "critical",
-  // core-financial/credit-card
-  code_flaw: "critical",
-  pii: "high",
-  phi: "high",
-  custom: "high",
-  // user-defined; conservative
-  code_context: "low",
-  config: "low"
-  // observe-only; floors to monitor regardless
-};
-function severityFloorPolicy(category) {
-  if (OBSERVE_ONLY_CATEGORIES.includes(category)) return "monitor";
-  const peak = CATEGORY_PEAK_SEVERITY[category];
-  return peak === "critical" || peak === "high" ? "warn" : "monitor";
-}
-var PolicyKind = external_exports.enum(["builtin", "custom"]).meta({ id: "PolicyKind" });
-var KNOWN_BUILTIN_IDS = ["monitor", "warn", "redact", "block"];
-var BuiltinPolicyId = external_exports.enum(KNOWN_BUILTIN_IDS).meta({ id: "BuiltinPolicyId" });
-var BUILTIN_ORDER = KNOWN_BUILTIN_IDS;
-var BUILTIN_POLICY_SPECS = {
-  monitor: {
-    name: "Monitor",
-    action: "log",
-    description: "Log every match for audit. The request is allowed through untouched."
-  },
-  warn: {
-    name: "Warn",
-    action: "warn",
-    description: "Allow the request, but warn the user inline before it is sent."
-  },
-  redact: {
-    name: "Redact",
-    action: "redact",
-    description: "Automatically strip the matched value from the request, then continue."
-  },
-  block: {
-    name: "Block",
-    action: "block",
-    description: "Refuse the request entirely whenever any rule in this detection matches."
-  }
-};
-function builtinPolicyToAction(id) {
-  return BUILTIN_POLICY_SPECS[id].action;
-}
-var DEFAULT_ACTIONS = Object.fromEntries(
-  DetectionCategory.options.map((c) => [c, builtinPolicyToAction(severityFloorPolicy(c))])
-);
-var BUILTIN_POLICIES = Object.fromEntries(
-  KNOWN_BUILTIN_IDS.map((id) => [id, { id, ...BUILTIN_POLICY_SPECS[id] }])
-);
-var DEFAULT_PACK_POLICY_ID = "monitor";
-function policyIdToAction(policyId) {
-  const parsed = BuiltinPolicyId.safeParse(policyId ?? DEFAULT_PACK_POLICY_ID);
-  const id = parsed.success ? parsed.data : DEFAULT_PACK_POLICY_ID;
-  return BUILTIN_POLICIES[id].action;
-}
-var UsedByItem = external_exports.object({
-  id: external_exports.string(),
-  name: external_exports.string(),
-  ruleCount: external_exports.number().int().nonnegative(),
-  enabled: external_exports.boolean()
-}).meta({ id: "UsedByItem" });
-var PolicyListItem = external_exports.object({
-  id: external_exports.string(),
-  kind: PolicyKind,
-  name: external_exports.string(),
-  enabled: external_exports.boolean(),
-  usedByCount: external_exports.number().int().nonnegative()
-}).meta({ id: "PolicyListItem" });
-var PolicyDetail = external_exports.object({
-  specVersion: external_exports.literal(1),
-  id: external_exports.string(),
-  kind: PolicyKind,
-  name: external_exports.string(),
-  enabled: external_exports.boolean(),
-  description: external_exports.string(),
-  usedBy: external_exports.array(UsedByItem)
-}).meta({ id: "PolicyDetail" });
-var PolicyStatsResponse = external_exports.object({
-  policies: external_exports.number().int().nonnegative(),
-  builtin: external_exports.number().int().nonnegative(),
-  custom: external_exports.number().int().nonnegative(),
-  detectionsGoverned: external_exports.number().int().nonnegative()
-}).meta({ id: "PolicyStatsResponse" });
-
-// ../../packages/schema/src/zod/api.ts
-var LIST_QUERY_MAX_LIMIT = 200;
-var ListEventsQuery = external_exports.object({
-  cursor: external_exports.string().optional(),
-  limit: external_exports.coerce.number().int().min(1).max(LIST_QUERY_MAX_LIMIT).default(50),
-  sourceTool: external_exports.string().optional(),
-  kind: external_exports.string().optional(),
-  from: external_exports.iso.datetime().optional(),
-  to: external_exports.iso.datetime().optional()
-});
-var ListEventsResponse = external_exports.object({
-  items: external_exports.array(Event),
-  nextCursor: external_exports.string().nullable()
-}).meta({ id: "ListEventsResponse" });
-var IngestResponse = external_exports.object({
-  accepted: external_exports.number().int().nonnegative(),
-  duplicates: external_exports.number().int().nonnegative()
-}).meta({ id: "IngestResponse" });
-var ListFindingsQuery = external_exports.object({
-  cursor: external_exports.string().optional(),
-  limit: external_exports.coerce.number().int().min(1).max(LIST_QUERY_MAX_LIMIT).default(50),
-  severity: external_exports.string().optional(),
-  category: external_exports.string().optional(),
-  eventId: external_exports.guid().optional()
-});
-var ListFindingsResponse = external_exports.object({
-  items: external_exports.array(Finding),
-  nextCursor: external_exports.string().nullable()
-}).meta({ id: "ListFindingsResponse" });
-var ListPoliciesResponse = external_exports.object({ items: external_exports.array(PolicyListItem) }).meta({ id: "ListPoliciesResponse" });
-var CreatePolicyRequest = Policy.omit({ id: true }).meta({
-  id: "CreatePolicyRequest"
-});
-var UpdatePolicyRequest = Policy.partial().required({ id: true }).meta({ id: "UpdatePolicyRequest" });
-var RecordAuditEventResponse = external_exports.object({ accepted: external_exports.boolean() }).meta({ id: "RecordAuditEventResponse" });
-var ErrorResponse = external_exports.object({
-  error: external_exports.object({
-    code: external_exports.string(),
-    message: external_exports.string(),
-    details: external_exports.unknown().optional()
-  })
-}).meta({ id: "ErrorResponse" });
-
-// ../../packages/schema/src/zod/config-inventory.ts
-var ConfigScope = external_exports.enum(["user", "project", "local", "plugin"]);
-var SkillScanEntry = external_exports.object({
-  name: external_exports.string().min(1),
-  // The identity source: a marketplace repo for plugin skills (e.g.
-  // 'anthropics/skills'), 'local' for personal ~/.claude/skills, or
-  // 'project:<repo-identity>' for checked-in project skills. The surrogate keeps
-  // a personal skill named 'pdf' from colliding with the marketplace 'pdf'.
-  source: external_exports.string().min(1),
-  scope: ConfigScope,
-  pluginName: external_exports.string().optional(),
-  // Volatile — rides the attribute bag, never the identity hash.
-  version: external_exports.string().optional(),
-  description: external_exports.string().optional(),
-  // Skill directory mtime (ISO) — the "updated Nd ago" freshness signal.
-  updatedAt: external_exports.iso.datetime().optional(),
-  // Filesystem path — the promoted inventory `location` column.
-  location: external_exports.string().optional()
-});
-var HookScanEntry = external_exports.object({
-  // Hook event name (PreToolUse, PostToolUse, …). Open string, not an enum: the
-  // set is harness-defined and grows without a schema change.
-  event: external_exports.string().min(1),
-  // The tool matcher ('Bash', 'Edit|Write', …). Absent = matches all tools.
-  matcher: external_exports.string().optional(),
-  command: external_exports.string().min(1),
-  timeout: external_exports.number().optional(),
-  scope: ConfigScope,
-  pluginName: external_exports.string().optional(),
-  // The settings file / hooks.json the entry came from.
-  location: external_exports.string().optional()
+var HookScanEntry = external_exports.object({
+  // Hook event name (PreToolUse, PostToolUse, …). Open string, not an enum: the
+  // set is harness-defined and grows without a schema change.
+  event: external_exports.string().min(1),
+  // The tool matcher ('Bash', 'Edit|Write', …). Absent = matches all tools.
+  matcher: external_exports.string().optional(),
+  command: external_exports.string().min(1),
+  timeout: external_exports.number().optional(),
+  scope: ConfigScope,
+  pluginName: external_exports.string().optional(),
+  // The settings file / hooks.json the entry came from.
+  location: external_exports.string().optional()
 });
 var McpServerScanEntry = external_exports.object({
   // The server's config key ("github", "filesystem", …) — identity, with the
@@ -16834,6 +16208,164 @@ var PackId = external_exports.string().regex(/^[a-z][a-z0-9-]*$/);
 var SemVer = external_exports.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-.]+)?$/);
 var PublisherKind = external_exports.enum(["labs", "user", "org"]);
 
+// ../../packages/schema/src/zod/rule.ts
+var MatcherType = external_exports.enum(["keyword", "regex"]).meta({ id: "MatcherType" });
+var RuleProbeVerdict = external_exports.enum(["safe", "quarantined"]).meta({ id: "RuleProbeVerdict" });
+var KeywordMatcher = external_exports.strictObject({
+  type: external_exports.literal("keyword"),
+  // An empty keyword matches at every position, yielding one zero-length span
+  // per character. Rejected here because a keyword that matches everything is
+  // never intentional.
+  keywords: external_exports.array(external_exports.string().min(1)).min(1),
+  caseSensitive: external_exports.boolean().default(false)
+});
+function isValidRegex(pattern, flags) {
+  try {
+    new RegExp(pattern, flags);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function probeFlags(flags) {
+  return flags.replace(/[gy]/g, "");
+}
+function matchesEmptyString(pattern, flags) {
+  try {
+    const re = new RegExp(pattern, probeFlags(flags));
+    return re.exec("")?.[0].length === 0;
+  } catch {
+    return false;
+  }
+}
+function spansWholeMatch(captureGroup) {
+  return captureGroup === void 0 || captureGroup === 0;
+}
+function captureGroupCount(pattern, flags) {
+  try {
+    const probe = new RegExp(`${pattern}|`, probeFlags(flags));
+    const result = probe.exec("");
+    return result ? result.length - 1 : void 0;
+  } catch {
+    return void 0;
+  }
+}
+var MAX_PATTERN_LENGTH = 2e3;
+var RegexMatcher = external_exports.strictObject({
+  type: external_exports.literal("regex"),
+  pattern: external_exports.string().min(1).max(MAX_PATTERN_LENGTH),
+  flags: external_exports.string().default("gi"),
+  captureGroup: external_exports.number().int().nonnegative().optional()
+}).refine((v) => isValidRegex(v.pattern, v.flags), {
+  message: "pattern/flags do not form a valid JavaScript regular expression",
+  path: ["pattern"]
+}).refine((v) => !spansWholeMatch(v.captureGroup) || !matchesEmptyString(v.pattern, v.flags), {
+  message: 'a whole-match regex that can match the empty string (e.g. "\\d*", "a?", "(?:)") can hang the matcher \u2014 scope the quantifier to a captureGroup, or require at least one character',
+  path: ["pattern"]
+}).superRefine((v, ctx) => {
+  if (v.captureGroup === void 0) return;
+  const groups = captureGroupCount(v.pattern, v.flags);
+  if (groups === void 0 || v.captureGroup <= groups) return;
+  ctx.addIssue({
+    code: "custom",
+    path: ["captureGroup"],
+    message: `captureGroup ${String(v.captureGroup)} is out of range \u2014 the pattern declares ${String(groups)} capture group(s), so valid values are 0-${String(groups)}. An out-of-range group never matches, which would make the rule silently never fire.`
+  });
+});
+var Matcher = external_exports.discriminatedUnion("type", [KeywordMatcher, RegexMatcher]).meta({ id: "Matcher" });
+var MATCHER_TYPES = MatcherType.options;
+var AppliesTo = external_exports.strictObject({
+  // Dot-prefixed, e.g. ".py" — matches the scanner's SOURCE_EXTENSIONS shape.
+  extensions: external_exports.array(external_exports.string().regex(/^\.[A-Za-z0-9]+$/)).min(1)
+}).meta({ id: "AppliesTo" });
+var PostValidatorName = external_exports.enum(["entropy", "luhn"]).meta({ id: "PostValidatorName" });
+var PostValidatorRef = external_exports.union(
+  [
+    PostValidatorName,
+    external_exports.strictObject({
+      name: PostValidatorName,
+      config: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
+    })
+  ],
+  {
+    // A union reports one collapsed issue for every way its arms can fail, so
+    // this has to describe the whole shape rather than just the name — it is
+    // what an author sees for a misspelled name AND for a stray key in the
+    // object form. The names come from the enum so the message cannot go
+    // stale. Without it Zod says only "Invalid input", which is precisely the
+    // no-feedback outcome this schema exists to remove.
+    error: () => `not a valid post-validator: use a bare name (${PostValidatorName.options.map((name) => JSON.stringify(name)).join(
+      " or "
+    )}) or { "name": ..., "config": { ... } }. An unrecognized name would be a false-positive guard that never runs.`
+  }
+).meta({ id: "PostValidatorRef" });
+var RequiresNearby = external_exports.strictObject({
+  // Each array, when present, must be non-empty and contain non-empty strings —
+  // an empty/blank criterion would either never fire or (for labels) match
+  // everything.
+  categories: external_exports.array(DetectionCategory).min(1).optional(),
+  ruleIds: external_exports.array(external_exports.string().min(1)).min(1).optional(),
+  labels: external_exports.array(external_exports.string().min(1)).min(1).optional(),
+  windowChars: external_exports.number().int().positive().default(160),
+  // Optional confidence bump applied when a gated match is corroborated. Capped
+  // small: it nudges confidence, it does not assert certainty.
+  confidenceBoost: external_exports.number().min(0).max(0.3).optional()
+}).refine(
+  (v) => (v.categories?.length ?? 0) + (v.ruleIds?.length ?? 0) + (v.labels?.length ?? 0) > 0,
+  { message: "requiresNearby needs at least one of categories, ruleIds, or labels" }
+).meta({ id: "RequiresNearby" });
+var RuleFixture = external_exports.strictObject({
+  label: external_exports.string(),
+  text: external_exports.string().max(5e4),
+  shouldMatch: external_exports.boolean(),
+  // Simulated file context for the scan, so fixtures can assert `appliesTo`
+  // gating (e.g. a Python-only pattern must NOT fire in a .ts file).
+  filePath: external_exports.string().optional(),
+  expectedSpans: external_exports.array(external_exports.strictObject({ start: external_exports.number(), end: external_exports.number() })).optional()
+}).meta({ id: "RuleFixture" });
+var Rule = external_exports.strictObject({
+  // A pinned literal over a STRICT object, and the two together decide how this
+  // format may grow. A rule carrying a key not listed below is refused with
+  // `unrecognized_keys`; a rule declaring `specVersion: 2` is refused with
+  // `invalid_value`. So the only additive path is adding an OPTIONAL field here
+  // — that keeps every rule authored before it valid — and a rule author has no
+  // way to introduce a field of their own or to opt into a later version.
+  // Widening the format means changing this literal and every consumer of it.
+  specVersion: external_exports.literal(1),
+  // `packId/ruleName` (e.g. `secrets/aws-access-key`). NOTE the first segment is
+  // the PACK id, NOT a namespace — this is a DIFFERENT slug space from a
+  // detection id (`namespace/packId`, decoded by splitDetectionId). A Rule.id
+  // therefore carries no namespace and is not globally unique across publishers;
+  // never feed one to splitDetectionId. `category` below (per-rule) is the
+  // taxonomy axis; the pack's enforcement policy is installed_packs.policy_id.
+  id: external_exports.string().regex(/^[a-z][a-z0-9-]*\/[a-z][a-z0-9-]*$/),
+  name: external_exports.string(),
+  category: DetectionCategory,
+  severity: Severity,
+  matcher: Matcher,
+  appliesTo: AppliesTo.optional(),
+  postValidators: external_exports.array(PostValidatorRef).optional(),
+  requiresNearby: RequiresNearby.optional(),
+  examples: external_exports.array(external_exports.string()).optional()
+}).meta({ id: "Rule" });
+var Author = external_exports.object({
+  name: external_exports.string(),
+  email: external_exports.email().optional(),
+  url: external_exports.url().optional()
+}).meta({ id: "Author" });
+var PackManifest = external_exports.object({
+  specVersion: external_exports.literal(1),
+  id: external_exports.string(),
+  name: external_exports.string(),
+  version: external_exports.string(),
+  rules: external_exports.array(external_exports.string()),
+  // Optional attribution/provenance — consumed by the rule marketplace.
+  description: external_exports.string().optional(),
+  author: Author.optional(),
+  license: external_exports.string().optional(),
+  sourceUrl: external_exports.url().optional()
+}).meta({ id: "PackManifest" });
+
 // ../../packages/schema/src/zod/detection.ts
 var OriginEnum = external_exports.enum(["library"]).meta({ id: "OriginEnum" });
 var DetectionFilterEnum = external_exports.enum(["all", "library", "custom", "customized", "updates"]);
@@ -17032,6 +16564,231 @@ function buildDetectionsList(summaries, query) {
   return { counts, items: filtered.map(summaryToDetectionListItem) };
 }
 
+// ../../packages/schema/src/zod/inventory.ts
+var AssetType = external_exports.enum(["project", "skill", "mcp", "hook", "config"]).meta({ id: "AssetType" });
+var AccessLevel = external_exports.enum(["open", "approved", "blocked"]).meta({ id: "AccessLevel" });
+var Origin = external_exports.enum(["source", "public-dep", "vendored", "config", "data", "docs", "generated"]).meta({ id: "Origin" });
+var TrustLevel = external_exports.enum(["known-good", "risky", "unapproved"]).meta({ id: "TrustLevel" });
+var Flag = external_exports.enum(["update", "stale", "conflict", "unknown", "change", "untracked", "risk", "findings"]).meta({ id: "Flag" });
+var Visibility = external_exports.enum(["public", "private"]).meta({ id: "Visibility" });
+var HarnessEventKind = external_exports.enum(["block", "redact", "warn"]).meta({ id: "HarnessEventKind" });
+var HarnessId = Harness.extract(["ClaudeCode", "Cursor", "Codex", "Antigravity"]).meta({
+  id: "HarnessId"
+});
+var AccessCounts = external_exports.object({
+  open: external_exports.number().int().nonnegative(),
+  approved: external_exports.number().int().nonnegative(),
+  blocked: external_exports.number().int().nonnegative(),
+  total: external_exports.number().int().nonnegative()
+}).meta({ id: "AccessCounts" });
+var AssetSummary = external_exports.object({
+  id: external_exports.string(),
+  type: AssetType,
+  name: external_exports.string(),
+  sub: external_exports.string(),
+  flags: external_exports.array(Flag),
+  /** MCP servers only — omitted for all other types. */
+  trust: TrustLevel.optional()
+}).meta({ id: "AssetSummary" });
+var ProjectSummary = external_exports.object({
+  id: external_exports.string(),
+  name: external_exports.string(),
+  repo: external_exports.string(),
+  visibility: Visibility,
+  language: external_exports.string(),
+  policyDefault: AccessLevel,
+  updatedAt: external_exports.iso.datetime(),
+  accessCounts: AccessCounts,
+  findingsCount: external_exports.number().int().nonnegative()
+}).meta({ id: "ProjectSummary" });
+var HarnessCategory = external_exports.object({
+  /** One of config/skill/mcp/hook — never project (enforced at service layer). */
+  type: AssetType,
+  assets: external_exports.array(AssetSummary)
+});
+var HarnessSummary = external_exports.object({
+  id: HarnessId,
+  label: external_exports.string(),
+  kind: external_exports.string(),
+  version: external_exports.string(),
+  sessions: external_exports.number().int().nonnegative(),
+  assetCount: external_exports.number().int().nonnegative(),
+  flagCount: external_exports.number().int().nonnegative(),
+  projects: external_exports.array(ProjectSummary),
+  categories: external_exports.array(HarnessCategory)
+}).meta({ id: "HarnessSummary" });
+var ListHarnessesResponse = external_exports.object({ items: external_exports.array(HarnessSummary) }).meta({ id: "ListHarnessesResponse" });
+var AssetGroup = external_exports.object({
+  /** Group key — never project (enforced at service layer). */
+  type: AssetType,
+  total: external_exports.number().int().nonnegative(),
+  /**
+   * MCP group only — omitted for all other types.
+   * Partial: only TrustLevel keys with non-zero counts are included.
+   * Strict: unknown keys are rejected — only TrustLevel values are valid keys.
+   */
+  trustRollup: external_exports.object({
+    "known-good": external_exports.number().int().nonnegative(),
+    risky: external_exports.number().int().nonnegative(),
+    unapproved: external_exports.number().int().nonnegative()
+  }).partial().strict().optional(),
+  /**
+   * Partial: only Flag keys with non-zero counts are included.
+   * Strict: unknown keys are rejected — only Flag values are valid keys.
+   */
+  flagRollup: external_exports.object({
+    update: external_exports.number().int().nonnegative(),
+    stale: external_exports.number().int().nonnegative(),
+    conflict: external_exports.number().int().nonnegative(),
+    unknown: external_exports.number().int().nonnegative(),
+    change: external_exports.number().int().nonnegative(),
+    untracked: external_exports.number().int().nonnegative(),
+    risk: external_exports.number().int().nonnegative(),
+    findings: external_exports.number().int().nonnegative()
+  }).partial().strict(),
+  items: external_exports.array(AssetSummary)
+}).meta({ id: "AssetGroup" });
+var ListAssetsResponse = external_exports.object({ groups: external_exports.array(AssetGroup) }).meta({ id: "ListAssetsResponse" });
+var McpTool = external_exports.object({
+  name: external_exports.string(),
+  signature: external_exports.string(),
+  description: external_exports.string(),
+  write: external_exports.boolean(),
+  /** Non-null string when tool is dangerous / blocked; null otherwise. */
+  risk: external_exports.string().nullable()
+}).meta({ id: "McpTool" });
+var AssetFindingRef = external_exports.object({
+  id: external_exports.string(),
+  title: external_exports.string(),
+  note: external_exports.string()
+});
+var AssetDetail = AssetSummary.extend({
+  /** string | null — null when no description is available. */
+  description: external_exports.string().nullable(),
+  /** trustLevel | null — null for non-MCP assets. */
+  trust: TrustLevel.nullable(),
+  /** Type-specific raw key/values — FE renders the grid. */
+  meta: external_exports.record(external_exports.string(), external_exports.unknown()),
+  /** always present — object when there is an active finding, null when absent. */
+  finding: AssetFindingRef.nullable(),
+  /** MCP exposed-tools list — omitted for non-mcp. */
+  tools: external_exports.array(McpTool).optional()
+}).meta({ id: "AssetDetail" });
+var ListProjectsResponse = external_exports.object({ items: external_exports.array(ProjectSummary) }).meta({ id: "ListProjectsResponse" });
+var InventoryStats = external_exports.object({
+  /** Total assets/projects with ≥1 flag or finding (drives the attention header chip). */
+  attention: external_exports.number().int().nonnegative(),
+  byType: external_exports.object({
+    project: external_exports.number().int().nonnegative(),
+    skill: external_exports.number().int().nonnegative(),
+    mcp: external_exports.number().int().nonnegative(),
+    hook: external_exports.number().int().nonnegative(),
+    config: external_exports.number().int().nonnegative()
+  }),
+  harnesses: external_exports.number().int().nonnegative(),
+  mcpTrust: external_exports.object({
+    "known-good": external_exports.number().int().nonnegative(),
+    risky: external_exports.number().int().nonnegative(),
+    unapproved: external_exports.number().int().nonnegative()
+  })
+}).meta({ id: "InventoryStats" });
+var FileSummary = external_exports.object({
+  path: external_exports.string(),
+  name: external_exports.string(),
+  origin: Origin,
+  /** Effective access (override applied). */
+  access: AccessLevel,
+  /** True when a file_access_override differs from the computed default. */
+  isCustom: external_exports.boolean(),
+  findings: external_exports.number().int().nonnegative(),
+  /** When the file was auto-blocked by a detection; null when not blocked. */
+  blockedAt: external_exports.iso.datetime().nullable().optional(),
+  /** Why the file was blocked; null when absent. */
+  note: external_exports.string().nullable().optional()
+}).meta({ id: "FileSummary" });
+var FolderSummary = external_exports.object({
+  name: external_exports.string(),
+  path: external_exports.string(),
+  /** Rollup of effective access across all descendants. */
+  accessCounts: AccessCounts
+}).meta({ id: "FolderSummary" });
+var ProjectTreeResponse = external_exports.object({
+  project: external_exports.object({
+    id: external_exports.string(),
+    repo: external_exports.string(),
+    visibility: Visibility
+  }),
+  path: external_exports.string(),
+  /** Browse mode: one-level folders at the current path. Omitted in search mode. */
+  folders: external_exports.array(FolderSummary).optional(),
+  files: external_exports.array(FileSummary)
+}).meta({ id: "ProjectTreeResponse" });
+var FileDetail = FileSummary.extend({
+  project: external_exports.object({
+    repo: external_exports.string(),
+    visibility: Visibility,
+    language: external_exports.string(),
+    policyDefault: AccessLevel,
+    updatedAt: external_exports.iso.datetime()
+  }),
+  findingsRefs: external_exports.array(external_exports.object({ id: external_exports.string(), title: external_exports.string() }))
+}).meta({ id: "FileDetail" });
+var SetFileAccessBody = external_exports.object({
+  path: external_exports.string(),
+  access: AccessLevel
+}).meta({ id: "SetFileAccessBody" });
+var SetFileAccessResponse = external_exports.object({
+  file: FileSummary,
+  accessCounts: AccessCounts
+}).meta({ id: "SetFileAccessResponse" });
+var SetMcpTrustBody = external_exports.object({ trust: TrustLevel }).meta({ id: "SetMcpTrustBody" });
+var HarnessEventItem = external_exports.object({
+  kind: HarnessEventKind,
+  title: external_exports.string(),
+  detail: external_exports.string(),
+  occurredAt: external_exports.iso.datetime(),
+  findingId: external_exports.string().nullable().optional()
+}).meta({ id: "HarnessEventItem" });
+var HarnessEventsResponse = external_exports.object({
+  counts: external_exports.object({
+    block: external_exports.number().int().nonnegative(),
+    redact: external_exports.number().int().nonnegative(),
+    warn: external_exports.number().int().nonnegative()
+  }),
+  items: external_exports.array(HarnessEventItem)
+}).meta({ id: "HarnessEventsResponse" });
+var RescanResponse = external_exports.object({
+  jobId: external_exports.string(),
+  startedAt: external_exports.iso.datetime()
+}).meta({ id: "RescanResponse" });
+var ConnectProjectBody = external_exports.object({ repo: external_exports.string() }).meta({ id: "ConnectProjectBody" });
+var ListAssetsQuery = external_exports.object({
+  /** Filter by one or more AssetType values; absent means all types. */
+  type: external_exports.array(AssetType).optional(),
+  /** Free-text search term. */
+  q: external_exports.string().optional()
+});
+var GetProjectTreeQuery = external_exports.object({
+  /** Subtree root path; defaults to repository root when absent. */
+  path: external_exports.string().optional(),
+  /** Free-text filter applied to file paths. */
+  q: external_exports.string().optional(),
+  /**
+   * Special listing mode. `blocked` returns every effectively-blocked, auto-blocked
+   * file across the whole repo (folders omitted, most-recent first), ignoring
+   * `path`/`q` — powers the project-wide "recently blocked" strip.
+   */
+  filter: external_exports.enum(["blocked"]).optional()
+});
+var GetProjectFileQuery = external_exports.object({
+  /** Repository-relative file path; absent or empty → 400. */
+  path: external_exports.string()
+});
+var GetHarnessEventsQuery = external_exports.object({
+  /** Maximum number of events to return.  Range: 1–50; default: 7. */
+  limit: external_exports.coerce.number().int().min(1).max(50).default(7)
+});
+
 // ../../packages/schema/src/zod/shares.ts
 var DestinationKind = external_exports.enum(["provider", "internal", "external", "ip"]).meta({ id: "DestinationKind" });
 var Transport = external_exports.enum(["https", "http", "sftp", "grpc", "smtp", "ws", "wss"]).meta({ id: "Transport" });
@@ -17238,6 +16995,127 @@ var EgressWriteSummary = external_exports.object({
   droppedFiles: external_exports.array(external_exports.string()).default([])
 }).meta({ id: "EgressWriteSummary" });
 
+// ../../packages/schema/src/zod/event.ts
+var EventKind = external_exports.enum(["prompt", "response", "code_change", "tool_use"]).meta({ id: "EventKind" });
+var CAPTURE_EVENT_TYPES_SQL = EventKind.options.map((k) => `'${k}'`).join(",");
+var EventMetadata = external_exports.object({
+  sessionId: external_exports.string().optional(),
+  repo: external_exports.string().optional(),
+  filePath: external_exports.string().optional(),
+  // The host tool whose input/output was scanned (e.g. 'Bash', 'WebFetch'),
+  // set by the tool-scanning hooks. The tool NAME only — never the tool's
+  // arguments or output, which can carry the very value a finding masked
+  // (metadata is stored unredacted). Gives findings on non-file captures a
+  // display location ("via Bash") when no filePath exists.
+  toolName: external_exports.string().optional(),
+  // Set (true) by the worktree scanner when the file is excluded by the
+  // repo's .gitignore. Gitignored files ARE still scanned — local scratch and
+  // generated code can leak real secrets — but the provenance is recorded so
+  // policy/dashboards can treat those findings as informational rather than
+  // blocking. Omitted (not false) for tracked files and non-scan events.
+  gitignored: external_exports.boolean().optional(),
+  // Set (true) ONLY when the event's `content` is the COMPLETE file at
+  // capture time (a worktree scan reading from disk). Hook-captured edits
+  // (e.g. an Edit tool's new_string) are partial fragments and MUST NOT set
+  // this. The resolver-on-ingest keys its fixed-at-source dropout
+  // diff on this marker: only a whole-file snapshot can prove a previously
+  // open finding is gone; a fragment's absence proves nothing (the secret
+  // may live outside the hunk). Omitted (not false) for fragments and
+  // non-scan events, so pre-marker clients safely default to the
+  // non-authoritative path.
+  wholeFile: external_exports.boolean().optional(),
+  model: external_exports.string().optional(),
+  turnIndex: external_exports.number().int().nonnegative().optional(),
+  // Distributed-tracing correlation. `correlationId` ties a recorded event back
+  // to the request that captured/ingested it (a UUID, generated independently of
+  // the trace id); `traceId` is the W3C trace id (32 lowercase hex chars) of the
+  // originating span when telemetry is enabled. Both optional + backward
+  // compatible — populated by the plugin (see @akasecurity/plugin-sdk).
+  correlationId: external_exports.uuid().optional(),
+  traceId: external_exports.string().regex(/^[0-9a-f]{32}$/).optional(),
+  // Ids of the detection exceptions that downgraded findings in this capture
+  // to 'allow' — the enforcement audit trail's link back to the grant that
+  // authorized the bypass. Absent on captures where no exception applied.
+  exceptionIds: external_exports.array(external_exports.guid()).optional()
+}).meta({ id: "EventMetadata" });
+var Event = external_exports.object({
+  id: external_exports.guid(),
+  sourceTool: SourceTool,
+  kind: EventKind,
+  occurredAt: external_exports.iso.datetime(),
+  contentHash: external_exports.string(),
+  content: external_exports.string(),
+  metadata: EventMetadata.optional()
+}).meta({ id: "Event" });
+var IngestEvent = Event.meta({ id: "IngestEvent" });
+var IngestBatch = external_exports.object({
+  events: external_exports.array(IngestEvent).min(1).max(100),
+  // Dedup policy for this batch. Id-dedup ALWAYS applies. 'content-hash'
+  // additionally rejects any event whose contentHash the store has already
+  // recorded — for re-runnable bulk ingest (worktree scan, transcript
+  // backfill), where a re-run mints fresh event ids for identical content and
+  // would otherwise accumulate duplicates. Live hook traffic must NOT set it:
+  // two genuinely separate prompts can be byte-identical and both belong on
+  // the timeline.
+  dedupe: external_exports.literal("content-hash").optional()
+}).meta({ id: "IngestBatch" });
+
+// ../../packages/schema/src/zod/exception.ts
+var ExceptionScope = external_exports.enum(["once", "temporary", "permanent"]);
+var ExceptionConditions = external_exports.object({
+  repo: external_exports.string().optional(),
+  sourceTool: external_exports.string().optional(),
+  provider: external_exports.string().optional()
+}).strict();
+var ExceptionCapability = external_exports.enum(["suppress", "reveal_to_model"]);
+var DetectionException = external_exports.object({
+  id: external_exports.guid(),
+  ruleId: external_exports.string(),
+  // Denormalized from the rule, for reporting — never matched on.
+  category: DetectionCategory,
+  // HMAC-SHA256 hex of the raw match under a machine-local key: a KEYED
+  // fingerprint, never the raw value, and never reversible. Matching recomputes
+  // the fingerprint from a fresh capture; the value itself is never stored.
+  // Shape-constrained so a malformed — or accidentally raw — value is rejected
+  // at the boundary rather than persisted.
+  valueFingerprint: external_exports.string().regex(/^[0-9a-f]{64}$/),
+  // Version of the fingerprint key the grant was written under; a rotated key
+  // invalidates old grants rather than silently mismatching them.
+  keyVersion: external_exports.number().int().positive(),
+  // maskMatch() preview of the approved value — never the raw value.
+  maskedValue: external_exports.string(),
+  capability: ExceptionCapability.default("suppress"),
+  scope: ExceptionScope,
+  expiresAt: external_exports.iso.datetime().nullable(),
+  maxUses: external_exports.number().int().positive().nullable(),
+  useCount: external_exports.number().int().nonnegative(),
+  lastUsedAt: external_exports.iso.datetime().nullable(),
+  // Mandatory: every grant carries the human reason it exists.
+  justification: external_exports.string().min(1),
+  conditions: ExceptionConditions.nullable(),
+  createdBy: external_exports.string(),
+  createdVia: external_exports.enum(["cli-approve", "cli-add", "web-approve", "web-add", "api", "setup-triage"]),
+  createdAt: external_exports.iso.datetime(),
+  updatedAt: external_exports.iso.datetime(),
+  // Revocation is terminal and retained — consumed/expired/revoked rows are
+  // audit evidence; nothing in the exception lifecycle hard-deletes.
+  revokedAt: external_exports.iso.datetime().nullable(),
+  revokedBy: external_exports.string().nullable(),
+  revokeReason: external_exports.string().nullable()
+});
+var ExceptionBundleEntry = DetectionException.pick({
+  id: true,
+  ruleId: true,
+  valueFingerprint: true,
+  keyVersion: true,
+  capability: true,
+  expiresAt: true,
+  maxUses: true,
+  useCount: true,
+  conditions: true
+});
+var ExceptionDescriptor = DetectionException.omit({ valueFingerprint: true });
+
 // ../../packages/schema/src/zod/exception-action.ts
 var confirmation = external_exports.string().optional();
 var ApproveBlockedInput = external_exports.object({
@@ -17280,10 +17158,11 @@ function toApiAction(dbVal) {
 }
 function toApiCategory(dbVal) {
   if (dbVal === "code_context") return "source_code";
-  return dbVal;
+  const parsed = FindingCategory.safeParse(dbVal);
+  return parsed.success ? parsed.data : "custom";
 }
 function toApiProvider(sourceTool) {
-  return TOOL_TO_HARNESS[sourceTool] ?? "api";
+  return TOOL_TO_HARNESS[sourceTool] ?? HARNESS.Api;
 }
 var STATUS_PRECEDENCE = ["open", "handled", "dismissed", "resolved"];
 function foldGroupStatus(instanceStatuses) {
@@ -17871,7 +17750,14 @@ function isVaultConsentValid(consent) {
 
 // ../../packages/schema/src/zod/local.ts
 var WORKSPACE_SETTINGS_SPEC_VERSION = 5;
-var RunMode = external_exports.enum(["standalone"]);
+var MODEL_JUDGE_PAYLOAD_VERSION = 1;
+var RunMode = external_exports.enum(["standalone", "attached"]);
+var ControlPlaneConnection = external_exports.object({
+  endpoint: external_exports.string().min(1),
+  // Display name for the deployment, shown instead of the raw endpoint.
+  label: external_exports.string().min(1).optional(),
+  attachedAt: external_exports.iso.datetime()
+}).meta({ id: "ControlPlaneConnection" });
 var SimpleDetectionPolicy = external_exports.enum(["redact", "warn"]);
 var HistoricalAccess = external_exports.enum(["full", "session-only"]);
 var ModelJudgeConsent = external_exports.object({
@@ -17880,12 +17766,10 @@ var ModelJudgeConsent = external_exports.object({
 });
 var WorkspaceSettings = external_exports.object({
   specVersion: external_exports.number().int().positive().default(WORKSPACE_SETTINGS_SPEC_VERSION),
-  // Settings files written by earlier releases may carry the retired 'attached'
-  // value; it parses as 'standalone' so those files keep loading.
-  runMode: external_exports.preprocess(
-    (v) => v === "attached" ? "standalone" : v,
-    RunMode.default("standalone")
-  ),
+  runMode: RunMode.default("standalone"),
+  // Present only while attached; a detach clears it. Its presence is what makes
+  // `runMode: 'attached'` mean anything — see isAttached.
+  controlPlane: ControlPlaneConnection.optional(),
   policy: SimpleDetectionPolicy.default("redact"),
   // Consent for scanning pre-install surfaces; opt-in (see HistoricalAccess).
   historicalAccess: HistoricalAccess.default("session-only"),
@@ -17987,39 +17871,244 @@ function toInspectionFindingRow(input) {
     firstDetectedAt: input.firstDetectedAt ? isoToEpochMillis(input.firstDetectedAt) : null
   };
 }
-function toCaptureAttributes(event) {
-  const metadata = event.metadata;
-  return {
-    source_tool: event.sourceTool,
-    ...metadata?.repo !== void 0 ? { repo: metadata.repo } : {},
-    ...metadata?.filePath !== void 0 ? { file_path: metadata.filePath } : {},
-    ...metadata?.toolName !== void 0 ? { tool_name: metadata.toolName } : {},
-    ...metadata?.gitignored !== void 0 ? { gitignored: metadata.gitignored } : {},
-    ...metadata?.wholeFile !== void 0 ? { whole_file: metadata.wholeFile } : {},
-    ...metadata?.correlationId !== void 0 ? { correlation_id: metadata.correlationId } : {},
-    ...metadata?.traceId !== void 0 ? { trace_id: metadata.traceId } : {},
-    ...metadata?.exceptionIds !== void 0 ? { exception_ids: metadata.exceptionIds } : {},
-    // `model`/`turnIndex` have no dedicated CaptureAttributes field (no writer
-    // has ever populated either), but every legacy metadata key still rides
-    // the bag rather than being silently dropped — CaptureAttributes'
-    // `.catchall(z.unknown())` carries the long tail.
-    ...metadata?.model !== void 0 ? { model: metadata.model } : {},
-    ...metadata?.turnIndex !== void 0 ? { turn_index: metadata.turnIndex } : {}
-  };
+function toCaptureAttributes(event) {
+  const metadata = event.metadata;
+  return {
+    source_tool: event.sourceTool,
+    ...metadata?.repo !== void 0 ? { repo: metadata.repo } : {},
+    ...metadata?.filePath !== void 0 ? { file_path: metadata.filePath } : {},
+    ...metadata?.toolName !== void 0 ? { tool_name: metadata.toolName } : {},
+    ...metadata?.gitignored !== void 0 ? { gitignored: metadata.gitignored } : {},
+    ...metadata?.wholeFile !== void 0 ? { whole_file: metadata.wholeFile } : {},
+    ...metadata?.correlationId !== void 0 ? { correlation_id: metadata.correlationId } : {},
+    ...metadata?.traceId !== void 0 ? { trace_id: metadata.traceId } : {},
+    ...metadata?.exceptionIds !== void 0 ? { exception_ids: metadata.exceptionIds } : {},
+    // `model`/`turnIndex` have no dedicated CaptureAttributes field (no writer
+    // has ever populated either), but every legacy metadata key still rides
+    // the bag rather than being silently dropped — CaptureAttributes'
+    // `.catchall(z.unknown())` carries the long tail.
+    ...metadata?.model !== void 0 ? { model: metadata.model } : {},
+    ...metadata?.turnIndex !== void 0 ? { turn_index: metadata.turnIndex } : {}
+  };
+}
+function captureDefinitionVersion(finding) {
+  return `capture/${finding.category}/${finding.severity}`;
+}
+function toCaptureDefinitionInput(finding) {
+  return {
+    ruleId: finding.ruleId,
+    version: captureDefinitionVersion(finding),
+    name: finding.ruleId,
+    category: finding.category,
+    severity: finding.severity,
+    definition: JSON.stringify({ ruleId: finding.ruleId })
+  };
+}
+
+// ../../packages/schema/src/zod/managed.ts
+var MANAGED_SETTINGS_FILENAME = "managed-settings.json";
+var MANAGED_SETTINGS_SPEC_VERSION = 1;
+var ManagedSettingKey = external_exports.enum([
+  "runMode",
+  "historicalAccess",
+  "vaultConsent",
+  "vaultKeyCustody",
+  "vaultInlineReveal",
+  "modelJudgeConsent",
+  "dataSharesInPlace"
+]).meta({ id: "ManagedSettingKey" });
+var ManagedSettingsValues = external_exports.object({
+  runMode: external_exports.enum(["standalone", "attached"]).optional(),
+  controlPlane: external_exports.object({
+    endpoint: external_exports.string().min(1),
+    label: external_exports.string().min(1).optional()
+  }).optional(),
+  historicalAccess: external_exports.enum(["full", "session-only"]).optional(),
+  vaultConsent: external_exports.boolean().optional(),
+  vaultKeyCustody: external_exports.enum(["file", "keychain"]).optional(),
+  vaultInlineReveal: external_exports.enum(["masked", "full", "off"]).optional(),
+  modelJudgeConsent: external_exports.boolean().optional(),
+  dataSharesInPlace: external_exports.boolean().optional()
+}).meta({ id: "ManagedSettingsValues" });
+var ManagedSettings = external_exports.object({
+  specVersion: external_exports.number().int().positive().default(MANAGED_SETTINGS_SPEC_VERSION),
+  // Shown on every locked control, so the user can tell an administrative
+  // decision from a bug. Absent renders as a generic "your organization".
+  organization: external_exports.string().min(1).optional(),
+  // What the administrator pinned.
+  values: ManagedSettingsValues.default({}),
+  // Which of those the user may not change. A key here with no matching value
+  // freezes whatever the user last chose; a value with no lock is a DEFAULT
+  // the user may still override. The two are separable on purpose.
+  lockedFields: external_exports.array(ManagedSettingKey).default([])
+}).meta({ id: "ManagedSettings" });
+
+// ../../packages/schema/src/zod/policy.ts
+var PolicyScope = external_exports.enum(["global", "repo", "user"]).meta({ id: "PolicyScope" });
+var PolicyTarget = external_exports.union([external_exports.object({ ruleId: external_exports.string() }), external_exports.object({ category: DetectionCategory })]).meta({ id: "PolicyTarget" });
+var Policy = external_exports.object({
+  id: external_exports.guid(),
+  scope: PolicyScope,
+  target: PolicyTarget,
+  action: ActionTaken,
+  enabled: external_exports.boolean().default(true),
+  customKeywords: external_exports.array(external_exports.string()).optional(),
+  // Display name — optional so older policy rows without name still parse.
+  // Added for the findings API (policy.name column migration).
+  name: external_exports.string().optional()
+}).meta({ id: "Policy" });
+var PolicyBundle = external_exports.object({
+  version: external_exports.string(),
+  policies: external_exports.array(Policy),
+  // Rules from the installed marketplace packs (snapshotted by the
+  // control plane). The plugin registers these in addition to its bundled
+  // packs. Optional so older backends — and older on-disk caches — that omit
+  // the field still parse; consumers read `bundle.rules ?? []`.
+  rules: external_exports.array(Rule).optional(),
+  // When true, `rules` IS the complete effective ruleset and the runtime must
+  // NOT merge its compiled-in bundled packs — the standalone gateway sets this
+  // after reading the user's installed snapshot (installed_packs, enabled
+  // packs only), which is how detection updates stay manual: new bundled
+  // rules run only after the user applies the pack update. Absent/false keeps
+  // the historical composition (bundled packs + rules) — older caches.
+  rulesComplete: external_exports.boolean().optional(),
+  // Active detection exceptions, evaluation subset only (see
+  // ExceptionBundleEntry). Optional so older bundle producers — and older
+  // on-disk caches — that omit the field still parse; consumers read
+  // `bundle.exceptions ?? []`.
+  exceptions: external_exports.array(ExceptionBundleEntry).optional(),
+  // Rule ids whose pack is assigned a REVERSIBLE archetype (Redact & Vault).
+  // A second axis over the same `redact` action, carried beside the policies
+  // rather than on them: nothing writes ruleId-targeted policies to disk, so
+  // widening Policy itself would change a persisted shape to express something
+  // only the in-memory bundle needs. Optional so an older producer — or an
+  // older on-disk cache — still parses; consumers read `?? []` and get the
+  // pre-existing one-way behaviour, which is the safe direction to default.
+  reversibleRuleIds: external_exports.array(external_exports.string()).optional(),
+  // Installed pack version, keyed by ruleId, for rules in `rules` that came
+  // from a versioned installed pack. Optional so older backends — and older
+  // on-disk caches — that omit the field still parse; consumers fall back to
+  // the rule's own spec version. NOT the bundle version above — see
+  // installedRuleset's ruleVersions for the source of truth.
+  ruleVersions: external_exports.record(external_exports.string(), external_exports.string()).optional(),
+  customKeywords: external_exports.array(external_exports.string()),
+  fetchedAt: external_exports.iso.datetime()
+}).meta({ id: "PolicyBundle" });
+var OBSERVE_ONLY_CATEGORIES = ["config"];
+var ENFORCEABLE_CATEGORIES = DetectionCategory.options.filter((c) => !OBSERVE_ONLY_CATEGORIES.includes(c));
+var CATEGORY_PEAK_SEVERITY = {
+  secret: "critical",
+  financial: "critical",
+  // core-financial/credit-card
+  code_flaw: "critical",
+  pii: "high",
+  phi: "high",
+  custom: "high",
+  // user-defined; conservative
+  code_context: "low",
+  config: "low"
+  // observe-only; floors to monitor regardless
+};
+function severityFloorPolicy(category) {
+  if (OBSERVE_ONLY_CATEGORIES.includes(category)) return "monitor";
+  const peak = CATEGORY_PEAK_SEVERITY[category];
+  return peak === "critical" || peak === "high" ? "warn" : "monitor";
+}
+var PolicyKind = external_exports.enum(["builtin", "custom"]).meta({ id: "PolicyKind" });
+var KNOWN_BUILTIN_IDS = ["monitor", "warn", "redact", "vault", "block"];
+var BuiltinPolicyId = external_exports.enum(KNOWN_BUILTIN_IDS).meta({ id: "BuiltinPolicyId" });
+var BUILTIN_ORDER = KNOWN_BUILTIN_IDS;
+var BUILTIN_POLICY_SPECS = {
+  monitor: {
+    name: "Monitor",
+    action: "log",
+    reversible: false,
+    description: "Log every match for audit. The request is allowed through untouched."
+  },
+  warn: {
+    name: "Warn",
+    action: "warn",
+    reversible: false,
+    description: "Allow the request, but warn the user inline before it is sent."
+  },
+  redact: {
+    name: "Redact",
+    action: "redact",
+    reversible: false,
+    description: "Strip the matched value from the request and destroy it, then continue. What was removed cannot be recovered."
+  },
+  vault: {
+    name: "Redact & Vault",
+    action: "redact",
+    reversible: true,
+    description: "Strip the matched value from the request and keep an encrypted, recoverable copy in the local vault, leaving a pointer in its place. Needs the vault consent granted under Settings; without it this behaves as Redact."
+  },
+  block: {
+    name: "Block",
+    action: "block",
+    reversible: false,
+    description: "Refuse the request entirely whenever any rule in this detection matches."
+  }
+};
+function builtinPolicyToAction(id) {
+  return BUILTIN_POLICY_SPECS[id].action;
+}
+var CATEGORY_EXPRESSIBLE_IDS = KNOWN_BUILTIN_IDS.filter(
+  (id) => !BUILTIN_POLICY_SPECS[id].reversible
+);
+var CATEGORY_INEXPRESSIBLE_IDS = KNOWN_BUILTIN_IDS.filter(
+  (id) => BUILTIN_POLICY_SPECS[id].reversible
+);
+var CategoryPolicyId = external_exports.enum(CATEGORY_EXPRESSIBLE_IDS).meta({ id: "CategoryPolicyId" });
+function builtinPolicyIsReversible(id) {
+  return BUILTIN_POLICY_SPECS[id].reversible;
 }
-function captureDefinitionVersion(finding) {
-  return `capture/${finding.category}/${finding.severity}`;
+function policyIdIsReversible(policyId) {
+  const parsed = BuiltinPolicyId.safeParse(policyId ?? DEFAULT_PACK_POLICY_ID);
+  const id = parsed.success ? parsed.data : DEFAULT_PACK_POLICY_ID;
+  return builtinPolicyIsReversible(id);
 }
-function toCaptureDefinitionInput(finding) {
-  return {
-    ruleId: finding.ruleId,
-    version: captureDefinitionVersion(finding),
-    name: finding.ruleId,
-    category: finding.category,
-    severity: finding.severity,
-    definition: JSON.stringify({ ruleId: finding.ruleId })
-  };
+var DEFAULT_ACTIONS = Object.fromEntries(
+  DetectionCategory.options.map((c) => [c, builtinPolicyToAction(severityFloorPolicy(c))])
+);
+var BUILTIN_POLICIES = Object.fromEntries(
+  KNOWN_BUILTIN_IDS.map((id) => [id, { id, ...BUILTIN_POLICY_SPECS[id] }])
+);
+var DEFAULT_PACK_POLICY_ID = "monitor";
+function policyIdToAction(policyId) {
+  const parsed = BuiltinPolicyId.safeParse(policyId ?? DEFAULT_PACK_POLICY_ID);
+  const id = parsed.success ? parsed.data : DEFAULT_PACK_POLICY_ID;
+  return BUILTIN_POLICIES[id].action;
 }
+var UsedByItem = external_exports.object({
+  id: external_exports.string(),
+  name: external_exports.string(),
+  ruleCount: external_exports.number().int().nonnegative(),
+  enabled: external_exports.boolean()
+}).meta({ id: "UsedByItem" });
+var PolicyListItem = external_exports.object({
+  id: external_exports.string(),
+  kind: PolicyKind,
+  name: external_exports.string(),
+  enabled: external_exports.boolean(),
+  usedByCount: external_exports.number().int().nonnegative()
+}).meta({ id: "PolicyListItem" });
+var ListPoliciesResponse = external_exports.object({ items: external_exports.array(PolicyListItem) }).meta({ id: "ListPoliciesResponse" });
+var PolicyDetail = external_exports.object({
+  specVersion: external_exports.literal(1),
+  id: external_exports.string(),
+  kind: PolicyKind,
+  name: external_exports.string(),
+  enabled: external_exports.boolean(),
+  description: external_exports.string(),
+  usedBy: external_exports.array(UsedByItem)
+}).meta({ id: "PolicyDetail" });
+var PolicyStatsResponse = external_exports.object({
+  policies: external_exports.number().int().nonnegative(),
+  builtin: external_exports.number().int().nonnegative(),
+  custom: external_exports.number().int().nonnegative(),
+  detectionsGoverned: external_exports.number().int().nonnegative()
+}).meta({ id: "PolicyStatsResponse" });
 
 // ../../packages/schema/src/zod/project-files.ts
 var ProjectFileInput = external_exports.object({
@@ -18099,44 +18188,6 @@ var BatchedRemediation = external_exports.discriminatedUnion("kind", [
   NoRemediationDecision
 ]);
 
-// ../../packages/schema/src/zod/rule-test.ts
-var TestRulesRequest = external_exports.object({
-  rules: external_exports.array(Rule).min(1).max(100),
-  text: external_exports.string().max(5e4).optional(),
-  fixtures: external_exports.array(RuleFixture).max(200).optional()
-}).refine((v) => v.text !== void 0 || (v.fixtures?.length ?? 0) > 0, {
-  message: "Provide `text`, `fixtures`, or both \u2014 there must be something to test"
-}).meta({ id: "TestRulesRequest" });
-var RuleTestMatch = external_exports.object({
-  ruleId: external_exports.string(),
-  category: DetectionCategory,
-  severity: Severity,
-  span: Span,
-  confidence: external_exports.number().min(0).max(1),
-  match: external_exports.string()
-}).meta({ id: "RuleTestMatch" });
-var FixtureResult = external_exports.object({
-  label: external_exports.string(),
-  shouldMatch: external_exports.boolean(),
-  didMatch: external_exports.boolean(),
-  passed: external_exports.boolean(),
-  matches: external_exports.array(RuleTestMatch)
-}).meta({ id: "FixtureResult" });
-var TestRulesResponse = external_exports.object({
-  // Present only when the request supplied `text`.
-  adhoc: external_exports.object({ matches: external_exports.array(RuleTestMatch) }).optional(),
-  fixtures: external_exports.array(FixtureResult),
-  summary: external_exports.object({
-    total: external_exports.number().int().nonnegative(),
-    passed: external_exports.number().int().nonnegative(),
-    failed: external_exports.number().int().nonnegative()
-  }),
-  // Ids of rules whose matcher type the engine cannot evaluate today (e.g.
-  // `validator`), so they silently never match. Surfaced so an author is not
-  // misled by a green run that actually skipped a rule.
-  unsupportedRuleIds: external_exports.array(external_exports.string())
-}).meta({ id: "TestRulesResponse" });
-
 // ../../packages/schema/src/zod/security.ts
 var SeveritySummaryItem = external_exports.object({
   severity: Severity,
@@ -18234,10 +18285,22 @@ var TopSourcesQuery = external_exports.object({
   // Omit for both kinds.
   kind: external_exports.enum(SOURCE_KINDS).optional()
 });
-var Provider = external_exports.enum(["claudecode", "cursor", "codex", "antigravity", "claudeai", "chatgpt", "copilot", "api"]).meta({ id: "Provider" });
+var Provider = Harness.extract([
+  "ClaudeCode",
+  "Cursor",
+  "Codex",
+  "Antigravity",
+  "ClaudeAi",
+  "ChatGpt",
+  "Copilot",
+  "Api"
+]).meta({ id: "Provider" });
 var ScanCoverageProvider = external_exports.object({
   provider: Provider,
-  // Percent of that provider's traffic scanned in the window. 0 when unsupported.
+  // Percent of that provider's traffic the shipped capture surface reaches.
+  // A curated business fact, constant across every `range` — not a measured
+  // per-window metric. 0 exactly when `supported` is false. See the comment
+  // above the block for where these numbers are decided.
   coverage: external_exports.number().int().min(0).max(100),
   supported: external_exports.boolean()
 }).meta({ id: "ScanCoverageProvider" });
@@ -18291,6 +18354,18 @@ var ApplyRecommendedActionResponse = external_exports.object({
 var DismissRecommendedActionResponse = external_exports.object({ id: external_exports.string(), status: external_exports.literal("dismissed") }).meta({ id: "DismissRecommendedActionResponse" });
 var RecommendedActionIdParam = external_exports.object({ id: external_exports.string() });
 
+// ../../packages/schema/src/zod/settings-action.ts
+var SaveSettingsInput = external_exports.object({
+  historicalAccess: external_exports.string(),
+  modelJudgeConsent: external_exports.boolean(),
+  vaultConsent: external_exports.string(),
+  vaultInlineReveal: external_exports.string()
+});
+var AttachInput = external_exports.object({
+  endpoint: external_exports.string(),
+  label: external_exports.string().optional()
+});
+
 // ../../packages/schema/src/zod/triage.ts
 var TriageHit = external_exports.object({
   ruleId: external_exports.string(),
@@ -18305,7 +18380,7 @@ var TriageHit = external_exports.object({
   valueFingerprint: external_exports.string().optional(),
   keyVersion: external_exports.number().int().nonnegative().optional()
 });
-var TriagePolicy = BuiltinPolicyId;
+var TriagePolicy = CategoryPolicyId;
 var TriageCategoryRec = external_exports.object({
   category: DetectionCategory,
   action: TriagePolicy,
@@ -18523,8 +18598,11 @@ function chmodBestEffort(path, mode) {
 function tightenDir(dir) {
   chmodBestEffort(dir, DATA_DIR_MODE);
 }
+function mkdirOwnerOnlySync(dir, recursive = false) {
+  mkdirSync(dir, { recursive, mode: DATA_DIR_MODE });
+}
 function ensureDataDirSync(dir) {
-  mkdirSync(dir, { recursive: true, mode: DATA_DIR_MODE });
+  mkdirOwnerOnlySync(dir, true);
   tightenDir(dir);
 }
 function dbSidecars(file2) {
@@ -18536,6 +18614,26 @@ function tightenFile(file2) {
 function tightenPerms(file2) {
   for (const path of [file2, ...dbSidecars(file2)]) chmodBestEffort(path, DATA_FILE_MODE);
 }
+function writeExclusiveOwnerOnlySync(file2, data) {
+  writeFileSync(file2, data, { mode: DATA_FILE_MODE, flag: "wx" });
+}
+function writeOwnerOnlyFileSync(file2, data) {
+  const tmp = `${file2}.${String(process.pid)}.tmp`;
+  try {
+    rmSync(tmp, { force: true });
+  } catch {
+  }
+  try {
+    writeExclusiveOwnerOnlySync(tmp, data);
+    renameSync(tmp, file2);
+  } finally {
+    try {
+      rmSync(tmp, { force: true });
+    } catch {
+    }
+  }
+  tightenFile(file2);
+}
 function classifyOccupant(file2) {
   try {
     if (lstatSync(file2).isSymbolicLink()) return { kind: "symlink" };
@@ -18564,7 +18662,7 @@ function createOwnerOnlyFileSync(file2, data) {
   }
   let created;
   try {
-    writeFileSync(tmp, data, { mode: DATA_FILE_MODE, flag: "wx" });
+    writeExclusiveOwnerOnlySync(tmp, data);
     created = publishByLink(tmp, file2, data);
   } finally {
     try {
@@ -18586,7 +18684,7 @@ function publishByLink(tmp, file2, data) {
     if (!LINK_UNSUPPORTED.has(code ?? "")) throw err;
   }
   try {
-    writeFileSync(file2, data, { mode: DATA_FILE_MODE, flag: "wx" });
+    writeExclusiveOwnerOnlySync(file2, data);
     return true;
   } catch (err) {
     if (err.code === "EEXIST") return false;
@@ -18599,6 +18697,25 @@ function backupPath(file2, tag) {
   return `${file2}.${tag}.${String(Date.now())}.${randomUUID().slice(0, 8)}.bak`;
 }
 var STALE_PARTIAL_MS = 5 * 6e4;
+var SNAPSHOT_STAGING_SUFFIX = ".partial";
+var STAGED_NAME_SUFFIX = `.bak${SNAPSHOT_STAGING_SUFFIX}`;
+var SNAPSHOT_STAGING_COPY = "copy";
+function createSnapshotStaging(backup) {
+  const stage = `${backup}${SNAPSHOT_STAGING_SUFFIX}`;
+  rmSync2(stage, { recursive: true, force: true });
+  mkdirOwnerOnlySync(stage);
+  tightenDir(stage);
+  return { stage, copy: join(stage, SNAPSHOT_STAGING_COPY) };
+}
+function idleMs(entry) {
+  for (const candidate of [join(entry, SNAPSHOT_STAGING_COPY), entry]) {
+    try {
+      return Date.now() - statSync(candidate).mtimeMs;
+    } catch {
+    }
+  }
+  return null;
+}
 function reapStalePartials(file2) {
   const dir = dirname(file2);
   const prefix = `${basename(file2)}.`;
@@ -18609,30 +18726,34 @@ function reapStalePartials(file2) {
     return;
   }
   for (const name of entries) {
-    if (!name.startsWith(prefix) || !name.endsWith(".bak.partial")) continue;
-    const partial2 = join(dir, name);
+    if (!name.startsWith(prefix) || !name.endsWith(STAGED_NAME_SUFFIX)) continue;
+    const staging = join(dir, name);
     try {
-      if (Date.now() - statSync(partial2).mtimeMs > STALE_PARTIAL_MS) {
-        rmSync2(partial2, { force: true });
+      const idle = idleMs(staging);
+      if (idle !== null && idle > STALE_PARTIAL_MS) {
+        rmSync2(staging, { recursive: true, force: true });
       }
     } catch {
     }
   }
 }
 function snapshotStore(db, backup) {
-  const partial2 = `${backup}.partial`;
+  const { stage, copy } = createSnapshotStaging(backup);
   try {
-    rmSync2(partial2, { force: true });
-    db.prepare("VACUUM INTO ?").run(partial2);
-    tightenFile(partial2);
-    renameSync2(partial2, backup);
+    db.prepare("VACUUM INTO ?").run(copy);
+    tightenFile(copy);
+    renameSync2(copy, backup);
   } catch (error51) {
     try {
-      rmSync2(partial2, { force: true });
+      rmSync2(stage, { recursive: true, force: true });
     } catch {
     }
     throw error51;
   }
+  try {
+    rmSync2(stage, { recursive: true, force: true });
+  } catch {
+  }
 }
 function moveStoreAside(file2, backup) {
   const undo = [];
@@ -19360,9 +19481,10 @@ function safeParseStringArray(raw) {
   const parsed = safeJson(raw, null);
   return Array.isArray(parsed) ? parsed : [];
 }
+var DEFAULT_HARNESS = HARNESS.ClaudeCode;
 function toHarness(raw) {
   const parsed = Harness.safeParse(raw);
-  return parsed.success ? parsed.data : "claudecode";
+  return parsed.success ? parsed.data : DEFAULT_HARNESS;
 }
 function resolveLifecycle(row, lastActivityMs, nowMs) {
   if (row.status) {
@@ -19493,7 +19615,7 @@ var SqliteActivityRepository = class {
     const params = [];
     if (query.harness && query.harness.length > 0) {
       conditions.push(
-        `coalesce(json_extract(attributes, '$.harness'), 'claudecode') IN (${placeholders(query.harness.length)})`
+        `coalesce(json_extract(attributes, '$.harness'), '${DEFAULT_HARNESS}') IN (${placeholders(query.harness.length)})`
       );
       params.push(...query.harness);
     }
@@ -19700,13 +19822,13 @@ var SqliteActivityRepository = class {
    * The DISTINCT harnesses that actually have sessions (optionally within a
    * `started_at >= fromMs` window), so the filter can offer only the harnesses
    * present rather than the full enum. Each stored value is normalized through
-   * the SAME `toHarness` default the list uses (missing → 'claudecode'), so a
-   * store of bare (harness-less) roots surfaces exactly `['claudecode']`.
+   * the SAME `toHarness` default the list uses (missing → DEFAULT_HARNESS), so
+   * a store of bare (harness-less) roots surfaces exactly that one harness.
    */
   harnessFacets(fromMs) {
     const where = fromMs === void 0 ? "" : " AND started_at >= ?";
     const stmt = this.db.prepare(
-      `SELECT DISTINCT coalesce(json_extract(attributes, '$.harness'), 'claudecode') AS harness
+      `SELECT DISTINCT coalesce(json_extract(attributes, '$.harness'), '${DEFAULT_HARNESS}') AS harness
          FROM audit_events WHERE ${SESSION_ROOT}${where}`
     );
     const rows = allRows(
@@ -19920,8 +20042,8 @@ var SqliteAuditEventsRepository = class {
   }
   // Insert one transcript-derived `llm_call` leaf. Unlike `insertAuditEvent`
   // (which takes a caller-supplied random id), the id here is MINTED internally
-  // from the natural key — `llmCallId(sessionId, messageId)` — tenant-free like the
-  // sibling local-store ids (the local store is single-tenant). The deterministic
+  // from the natural key — `llmCallId(sessionId, messageId)` — derived from the
+  // session and message alone, like the sibling local-store ids. The deterministic
   // id + the UPSERT-take-MAX(output_tokens) statement make every re-read idempotent
   // AND converge a streaming partial/final split across two incremental passes:
   // a whole-file re-read no-ops (equal output), a lagging final replaces a
@@ -20886,6 +21008,42 @@ var SqliteFindingsRepository = class {
     this.db = db;
   }
   db;
+  /**
+   * The newest `limit` findings, newest first.
+   *
+   * THE PLAN IS THE POINT HERE, and two things in the SQL below exist only to
+   * pin it. The natural spelling — drive from `inspection_findings`, order by the
+   * JOINED `e.started_at` — cannot push the LIMIT down, because the sort key is
+   * not on the driving table: SQLite sorts every finding in the store through a
+   * temp B-tree to return 500 rows. Measured at 35.0 ms on a 40,000-event corpus
+   * against 0.9 ms for the form below, and the gap is a ratio of the store size
+   * rather than a constant.
+   *
+   * What it takes to make `started_at` order come out of an index instead:
+   *
+   *  - **`+e.event_type`** — the unary plus makes that term non-indexable, so the
+   *    planner stops choosing `idx_audit_type_t` (`event_type, started_at`). That
+   *    index cannot serve the ORDER BY: the predicate spans four event types, so
+   *    satisfying a global `started_at` order across them needs a range merge
+   *    SQLite will not do, and it sorts instead. Freed of it, the planner scans
+   *    `idx_audit_started_at` — a bare `started_at` index — in DESC order and
+   *    filters the type per row, which lets the LIMIT stop the scan early.
+   *  - **`CROSS JOIN`** — semantically identical to JOIN in SQLite, and there
+   *    purely to stop the tables being reordered. With plain JOINs the planner
+   *    drives from `f` and sorts everything again: measured at 23.6 ms, i.e. the
+   *    unary plus ALONE recovers almost none of the win. Both are needed.
+   *
+   * Neither is a micro-optimisation that a later reader should tidy away, and
+   * `packages/persistence/test/performance/hot-read-query-plans.test.ts` fails if
+   * the temp B-tree comes back.
+   *
+   * Degrading gracefully was the reason for `+` over `INDEXED BY`, which measured
+   * identically (0.9 ms): `INDEXED BY` is a hard requirement, so dropping or
+   * renaming the index turns this read into an ERROR, where `+` turns it into a
+   * scan-and-sort — slower, still correct. The worst case for the chosen form is
+   * a store whose recent captures carry no findings at all, where the scan walks
+   * the whole index; that is still no worse than the full sort it replaced.
+   */
   recentFindings(opts) {
     const limit = opts?.limit ?? 50;
     const rows = allRows(
@@ -20894,10 +21052,10 @@ var SqliteFindingsRepository = class {
                 f.masked_match, f.action_taken, f.confidence, e.started_at AS occurred_at,
                 json_extract(e.attributes, '$.source_tool') AS source_tool,
                 e.event_type AS kind
-         FROM inspection_findings f
-         JOIN audit_events e ON e.id = f.audit_event_id
-         JOIN inspection_definitions d ON d.id = f.inspection_definition_id
-         WHERE e.event_type IN (${CAPTURE_EVENT_TYPES_SQL})
+         FROM audit_events e
+         CROSS JOIN inspection_findings f ON f.audit_event_id = e.id
+         CROSS JOIN inspection_definitions d ON d.id = f.inspection_definition_id
+         WHERE +e.event_type IN (${CAPTURE_EVENT_TYPES_SQL})
          ORDER BY e.started_at DESC, f.rowid DESC
          LIMIT :limit`
       ),
@@ -21541,7 +21699,8 @@ var SqliteInspectionDefinitionsRepository = class {
   }
   db;
   insertStmt;
-  // Idempotent upsert; returns the content-addressed definition id.
+  // Insert-if-absent; returns the content-addressed definition id. An id already
+  // present keeps the stored row untouched — see the class doc.
   upsert(input) {
     const id = inspectionDefinitionId(input.ruleId, input.version);
     const row = toInspectionDefinitionRow(input, id);
@@ -21685,11 +21844,23 @@ function isParseableBinaryVersion(version2) {
 
 // ../../packages/persistence/src/repositories/installed-packs.ts
 var DEFAULT_POLICY_ID = DEFAULT_PACK_POLICY_ID;
+function printableRuleId(entry) {
+  if (typeof entry !== "object" || entry === null) return null;
+  const candidate = entry.id;
+  return Rule.shape.id.safeParse(candidate).success ? candidate : null;
+}
+function firstIssueReason(error51) {
+  const issue2 = error51.issues[0];
+  if (!issue2) return "unknown";
+  const path = issue2.path.map((segment) => String(segment)).join(".");
+  return path ? `${path}: ${issue2.code}` : issue2.code;
+}
+var REJECTED_RULE_DETAIL_CAP = 10;
 function inventorySignature(packs2) {
   return packs2.map((p) => `${p.namespace}/${p.packId}@${p.version}#${hashRules(p.rulesJson)}`).sort().join(",");
 }
 function hashRules(rulesJson) {
-  return createHash2("sha1").update(rulesJson).digest("hex");
+  return createHash2("sha256").update(rulesJson).digest("hex");
 }
 function parseVersion(v) {
   const m = /^(\d+)\.(\d+)\.(\d+)/.exec(v);
@@ -21901,10 +22072,21 @@ var SqliteInstalledPacksRepository = class {
    * (all detection off) instead of falling back to the bundled packs. Every
    * JSON-level failure therefore counts as invalid.
    */
+  /**
+   * ORDERED, because a rule id is unique only WITHIN a pack — the sole unique
+   * index is (namespace, pack_id) — so two enabled packs may contribute the same
+   * id, and the per-rule maps below are last-write-wins. Without an ORDER BY the
+   * winner is whatever order SQLite happens to return, which makes a collision
+   * resolve differently on two machines holding identical stores. Ordering by
+   * (namespace, pack_id) makes the loser deterministic and therefore testable.
+   */
   installedRuleset() {
     const rows = allRows(
       this.db.prepare(
-        `SELECT enabled, policy_id AS policyId, rules_json AS rulesJson, version FROM installed_packs`
+        `SELECT enabled, policy_id AS policyId, rules_json AS rulesJson, version,
+                namespace, pack_id AS packId
+           FROM installed_packs
+          ORDER BY namespace, pack_id`
       )
     );
     const out = {
@@ -21912,22 +22094,32 @@ var SqliteInstalledPacksRepository = class {
       enabledPacks: 0,
       rules: [],
       invalidRules: 0,
+      rejectedRules: [],
       ruleActions: /* @__PURE__ */ new Map(),
-      ruleVersions: /* @__PURE__ */ new Map()
+      ruleVersions: /* @__PURE__ */ new Map(),
+      reversibleRules: /* @__PURE__ */ new Set()
+    };
+    const reject = (pack, ruleId, reason) => {
+      if (out.rejectedRules.length >= REJECTED_RULE_DETAIL_CAP) return;
+      out.rejectedRules.push({ pack, ruleId, reason });
     };
     for (const row of rows) {
       if (!intToBool(row.enabled)) continue;
       out.enabledPacks += 1;
       const action = policyIdToAction(row.policyId);
+      const reversible = policyIdIsReversible(row.policyId);
+      const pack = `${row.namespace}/${row.packId}`;
       let raw;
       try {
         raw = JSON.parse(row.rulesJson);
       } catch {
         out.invalidRules += 1;
+        reject(pack, null, "rules_json: malformed JSON");
         continue;
       }
       if (!Array.isArray(raw)) {
         out.invalidRules += 1;
+        reject(pack, null, "rules_json: not an array");
         continue;
       }
       for (const entry of raw) {
@@ -21936,7 +22128,12 @@ var SqliteInstalledPacksRepository = class {
           out.rules.push(parsed.data);
           out.ruleActions.set(parsed.data.id, action);
           out.ruleVersions.set(parsed.data.id, row.version);
-        } else out.invalidRules += 1;
+          if (reversible) out.reversibleRules.add(parsed.data.id);
+          else out.reversibleRules.delete(parsed.data.id);
+        } else {
+          out.invalidRules += 1;
+          reject(pack, printableRuleId(entry), firstIssueReason(parsed.error));
+        }
       }
     }
     return out;
@@ -22130,31 +22327,38 @@ var CATEGORY_ORDER = ["config", "skill", "mcp", "hook"];
 var VALID_HARNESS_IDS = new Set(HarnessId.options);
 var WORKTREE_CHECKOUT_FILTER = "(url IS NULL OR (url NOT LIKE '%/.claude/worktrees/%' AND url NOT LIKE '%\\.claude\\worktrees\\%'))";
 var HARNESS_LABELS = {
-  claudecode: "Claude Code",
-  cursor: "Cursor",
-  codex: "Codex",
-  antigravity: "Antigravity"
+  [HARNESS.ClaudeCode]: "Claude Code",
+  [HARNESS.Cursor]: "Cursor",
+  [HARNESS.Codex]: "Codex",
+  [HARNESS.Antigravity]: "Antigravity"
 };
 var HARNESS_LIVENESS_WINDOW_MS = 30 * 24 * 60 * 60 * 1e3;
 var EMPTY_PROJECT_AGG = {
   accessCounts: { open: 0, approved: 0, blocked: 0, total: 0 },
   findingsCount: 0
 };
+var stripSeparators = (value) => value.toLowerCase().replace(/[\s-]/g, "");
+var TITLE_NEEDLES = {
+  ClaudeCode: stripSeparators(SOURCE_TOOL.ClaudeCode),
+  Cursor: stripSeparators(SOURCE_TOOL.Cursor),
+  Codex: stripSeparators(SOURCE_TOOL.Codex),
+  Antigravity: stripSeparators(SOURCE_TOOL.Antigravity)
+};
 function resolveHarnessId(attrs, row) {
   if (attrs.provider && VALID_HARNESS_IDS.has(attrs.provider)) {
     return attrs.provider;
   }
-  const t = (row.title ?? "").toLowerCase().replace(/[\s-]/g, "");
-  if (t.includes("claudecode") || t === "claude") return "claudecode";
-  if (t.includes("cursor")) return "cursor";
-  if (t.includes("codex")) return "codex";
-  if (t.includes("antigravity")) return "antigravity";
+  const t = stripSeparators(row.title ?? "");
+  if (t.includes(TITLE_NEEDLES.ClaudeCode) || t === "claude") return HARNESS.ClaudeCode;
+  if (t.includes(TITLE_NEEDLES.Cursor)) return HARNESS.Cursor;
+  if (t.includes(TITLE_NEEDLES.Codex)) return HARNESS.Codex;
+  if (t.includes(TITLE_NEEDLES.Antigravity)) return HARNESS.Antigravity;
   return null;
 }
 function isLiveRealClaudeCode(rows) {
   return rows.some((r) => {
     const attrs = safeJson(r.attributes, {});
-    return attrs.provenance !== "sample" && resolveHarnessId(attrs, r) === "claudecode";
+    return attrs.provenance !== "sample" && resolveHarnessId(attrs, r) === HARNESS.ClaudeCode;
   });
 }
 function toAssetSummary(row) {
@@ -22422,7 +22626,7 @@ var SqliteInventoryAssetsRepository = class {
       const isRealHarness = rows.some(
         (r) => safeJson(r.attributes, {}).provenance !== "sample"
       );
-      const attachConfig = isRealHarness && harnessId === "claudecode" && configAssets.length > 0;
+      const attachConfig = isRealHarness && harnessId === HARNESS.ClaudeCode && configAssets.length > 0;
       const assets = attachConfig ? [...harnessAssets, ...configAssets].sort((a, b) => a.name.localeCompare(b.name)) : harnessAssets;
       if (q && assets.length === 0) continue;
       const firstRow = rows[0];
@@ -23096,9 +23300,10 @@ var SqliteProjectFilesRepository = class {
 // ../../packages/persistence/src/repositories/resolutions.ts
 import { randomUUID as randomUUID7 } from "crypto";
 var SqliteResolutionsRepository = class {
-  constructor(db, now = () => Date.now()) {
+  constructor(db, now = () => Date.now(), newId = () => randomUUID7()) {
     this.db = db;
     this.now = now;
+    this.newId = newId;
     this.insertStmt = db.prepare(
       `INSERT INTO finding_resolution (id, finding_key, status, method, resolved_at, evidence, created_at)
        VALUES (:id, :findingKey, :status, :method, :resolvedAt, :evidence, :createdAt)`
@@ -23131,12 +23336,14 @@ var SqliteResolutionsRepository = class {
   }
   db;
   now;
+  newId;
   insertStmt;
   latestStmt;
   openAtRestStmt;
   resolvedAtRestStmt;
   /**
-   * Insert one disposition row. The repo mints the id and stamps created_at.
+   * Insert one disposition row. The repo mints the id and stamps created_at,
+   * both through the constructor's injectable seams.
    * `status`/`method` are typed AND re-parsed here against @akasecurity/schema's
    * FindingStatus/ResolutionMethod, so the persisted vocabulary can never drift
    * from the schema enums. NOTE for future manual-resolution writers: this is
@@ -23148,7 +23355,7 @@ var SqliteResolutionsRepository = class {
    */
   insertResolution(r) {
     this.insertStmt.run({
-      id: randomUUID7(),
+      id: this.newId(),
       findingKey: r.findingKey,
       status: FindingStatus.parse(r.status),
       method: ResolutionMethod.parse(r.method),
@@ -23727,16 +23934,16 @@ var ACTION_TO_KIND = {
   warn: "warned"
 };
 var ENFORCEMENT_KINDS = ["blocked", "redacted", "warned"];
-var SCAN_COVERAGE = [
-  { provider: "claudecode", coverage: 100, supported: true },
-  { provider: "cursor", coverage: 0, supported: false },
-  { provider: "codex", coverage: 80, supported: true },
-  { provider: "antigravity", coverage: 60, supported: true },
-  { provider: "claudeai", coverage: 0, supported: false },
-  { provider: "chatgpt", coverage: 0, supported: false },
-  { provider: "copilot", coverage: 0, supported: false },
-  { provider: "api", coverage: 0, supported: false }
-];
+var SCAN_COVERAGE = {
+  [HARNESS.Antigravity]: { coverage: 60, supported: true },
+  [HARNESS.Api]: { coverage: 0, supported: false },
+  [HARNESS.ChatGpt]: { coverage: 40, supported: true },
+  [HARNESS.ClaudeAi]: { coverage: 40, supported: true },
+  [HARNESS.ClaudeCode]: { coverage: 100, supported: true },
+  [HARNESS.Codex]: { coverage: 80, supported: true },
+  [HARNESS.Copilot]: { coverage: 0, supported: false },
+  [HARNESS.Cursor]: { coverage: 0, supported: false }
+};
 var GRANULARITY = {
   "7d": "day",
   "30d": "day",
@@ -23835,9 +24042,22 @@ var SqliteSecurityRepository = class {
     return Promise.resolve({ total, needsRemediation, bySeverity });
   }
   // Range is echoed but does not change the result today — coverage is a constant
-  // business fact (see SCAN_COVERAGE), not a measured per-window metric.
+  // business fact (see SCAN_COVERAGE), not a measured per-window metric. Order
+  // comes from Provider.options (the enum's declaration order), not from
+  // SCAN_COVERAGE's own key order — deliberately, not because object literals
+  // leave key order unspecified (ES2015 guarantees insertion order for these
+  // non-integer string keys, so iterating SCAN_COVERAGE directly would be
+  // reliable too). The reason is the schema comment's promise: the returned
+  // order must mirror the generated OpenAPI enum list, which is Provider's
+  // contract, not this table's.
   scanCoverage(range) {
-    return Promise.resolve({ range, providers: SCAN_COVERAGE.map((p) => ({ ...p })) });
+    return Promise.resolve({
+      range,
+      providers: Provider.options.map((provider) => ({
+        provider,
+        ...SCAN_COVERAGE[provider]
+      }))
+    });
   }
   enforcementActions(range) {
     const lenMs = RANGE_DAYS[range] * DAY_MS4;
@@ -23895,10 +24115,10 @@ var SqliteSecurityRepository = class {
   // count; a superseding open/redetected row means the finding is not
   // remediated and is excluded, same invariant as severitySummary. Legacy
   // at-rest findings with finding_key IS NULL can never have a resolution row
-  // (the lifecycle is keyed by finding_key), so the SQL guard excludes them
-  // outright. One raw-row query (fetch every trackable finding + its latest
-  // resolution's status/method/resolved_at) + pure-JS filter/bucket/mean,
-  // mirroring this file's other methods.
+  // (the lifecycle is keyed by finding_key), so they cannot reach the driving
+  // set below. One raw-row query (fetch the findings with resolution activity in
+  // the window + each one's latest resolution status/method/resolved_at) +
+  // pure-JS filter/bucket/mean, mirroring this file's other methods.
   mttrTrend(range) {
     const granularity = granularityFor(range);
     const bucketMs = (granularity === "day" ? 1 : 7) * DAY_MS4;
@@ -23914,29 +24134,80 @@ var SqliteSecurityRepository = class {
         // started_at the upsert overwrites onto inspection_findings.audit_event_id.
         // COALESCE onto the parent event's started_at defends against any
         // legacy/edge row the backfill left null.
-        `SELECT COALESCE(f.first_detected_at, e.started_at) AS first_detected_at, d.severity AS severity,
+        `SELECT DISTINCT f.finding_key AS finding_key,
+                COALESCE(f.first_detected_at, e.started_at) AS first_detected_at, d.severity AS severity,
                 latest.status AS latest_status,
                 latest.method AS latest_method,
                 latest.resolved_at AS latest_resolved_at
-         FROM inspection_findings f
-         JOIN audit_events e ON e.id = f.audit_event_id
-         JOIN inspection_definitions d ON d.id = f.inspection_definition_id
+         FROM finding_resolution fr
+         CROSS JOIN inspection_findings f ON f.finding_key = fr.finding_key
+         CROSS JOIN audit_events e ON e.id = f.audit_event_id
+         CROSS JOIN inspection_definitions d ON d.id = f.inspection_definition_id
          LEFT JOIN ${LATEST_RESOLUTION_BY_KEY_SQL} latest
            ON latest.finding_key = f.finding_key
-         WHERE f.finding_key IS NOT NULL
-           AND e.event_type IN (${CAPTURE_EVENT_TYPES_SQL})
-           AND EXISTS (
-             SELECT 1 FROM finding_resolution fr
-              WHERE fr.finding_key = f.finding_key
-                AND fr.resolved_at >= :windowStart
-           )`
-        // The EXISTS is a SUPERSET prefilter that bounds the scan to keys with
-        // any resolution activity at/after the window start — a row this method
+         WHERE fr.resolved_at >= :windowStart
+           AND e.event_type IN (${CAPTURE_EVENT_TYPES_SQL})`
+        // `fr` is a SUPERSET prefilter, not the answer: a finding this method
         // ultimately counts has its LATEST resolution inside the window, which
-        // implies such a row exists, so nothing wanted is dropped. The exact
-        // latest-wins + status/method + window gate stays in JS below,
-        // dialect-agnostic. Without this, a
-        // 7d request evaluated the store's entire trackable-findings history.
+        // implies a resolution row at/after the window start exists, so nothing
+        // wanted is dropped. The exact latest-wins + status/method + window gate
+        // stays in JS below, dialect-agnostic. `f.finding_key IS NOT NULL` is
+        // implied rather than dropped — the join key comes from
+        // finding_resolution, whose finding_key is NOT NULL.
+        //
+        // IT IS THE DRIVING TABLE THAT MAKES THAT PREFILTER A BOUND, which is
+        // the correction this replaced. Spelled as an `EXISTS` in the WHERE it
+        // READ as a bound and was not one: SQLite drove from `audit_events` on
+        // event_type, joined every capture event to its findings, and evaluated
+        // the EXISTS last — bounding the RESULT and not the scan, so a 7d request
+        // still cost the store's whole trackable history. Measured at 44.6 ms on
+        // 50,000 events and 171.3 ms on 150,000 — linear in the STORE, and in
+        // both cases returning rows for a window holding a fraction of it.
+        //
+        // Two things carry it, and they answer DIFFERENT halves — which is worth
+        // stating precisely, because the obvious reading (both are needed for the
+        // speed) is wrong and was measured to be wrong:
+        //
+        //  - **`CROSS JOIN`** is the whole of the store-size fix. In SQLite the
+        //    keyword is semantically identical to JOIN and exists only to stop the
+        //    tables being reordered; with plain JOINs the planner puts `e` back on
+        //    the outside, because with no ANALYZE statistics it prices
+        //    `event_type IN (...)` as a selective probe. Reverting it alone takes
+        //    the 2k->20k flatness ratio from 1.32 to 16.87.
+        //  - **`idx_finding_resolution_resolved_at`** (migration 0021) makes
+        //    `resolved_at >= :windowStart` a range SEARCH instead of a bare
+        //    `SCAN fr` — finding_key was this table's only index before it, so the
+        //    range had none. It buys NO flatness in store size: remove it and the
+        //    ratio above does not move, because the latest-resolution derived
+        //    table already passes over the whole of finding_resolution, so this
+        //    read is O(resolutions) either way and resolutions are not the store.
+        //    What it buys is the criterion `hot-read-query-plans.test.ts` enforces
+        //    — no hot read may pass over a table with no index — and that is the
+        //    guard that goes red when it is dropped. Neither test catches the
+        //    other's defect.
+        //
+        // SELECT DISTINCT is a CORRECTNESS requirement of driving from `fr`, not a
+        // tidy-up. finding_resolution is append-only, so a key that was fixed,
+        // redetected and fixed again carries several rows inside one window and
+        // matches once per row — and the value below is a MEAN, so a key matched
+        // three times is a key weighted three times.
+        //
+        // The skew is easy to argue away and the argument is wrong, so it is worth
+        // recording. Duplicate rows for ONE key are identical (every projected
+        // column is per-key: `latest.*` is latest-wins, `first_detected_at` is
+        // preserved), so sums and counts scale together and that key's own mean
+        // does not move. What moves is a bucket holding TWO findings that duplicate
+        // UNEQUALLY: three rows for a 5.9-day fix and one for a 1.9-day fix average
+        // 4.9 days weighted against 3.9 unweighted. Measured, and pinned by
+        // `security.test.ts`'s "weights a finding ONCE however many resolution rows
+        // it has inside the window" — which needed a fixture built for it, since no
+        // single-key case can show it.
+        //
+        // `finding_key` is selected to make the DISTINCT dedup by KEY rather than
+        // by value tuple. On the other columns alone, two genuinely different
+        // findings sharing a severity, a first-detection event and a resolution
+        // instant — one commit fixing two secrets in one file — are one tuple, and
+        // collapsing them would under-count in the other direction.
       ),
       { windowStart }
     );
@@ -23994,16 +24265,47 @@ var SqliteSecurityRepository = class {
   }
   // Recently-resolved activity feed: findings whose finding_key's LATEST
   // finding_resolution row is status:'resolved'/method:'fixed-at-source' —
-  // same latest-resolution-wins correlated subquery as severitySummary /
-  // mttrTrend (NOT a plain JOIN, which would surface every historical
-  // resolution row for a key rather than just its current disposition). A key
-  // whose latest row is a superseding 'open'/'redetected' row (the same
-  // secret came back) is excluded — it is not currently resolved. Legacy
-  // at-rest findings with finding_key IS NULL are excluded outright (the
-  // resolution lifecycle can never attach to them). Path comes from the
-  // finding's parent event (event_type 'code_change', attributes.file_path) —
-  // mirrors resolutions.ts's openAtRestStmt accessor. Ordered by resolved_at
-  // DESC, capped at `limit`.
+  // same latest-resolution-wins derived table as severitySummary / mttrTrend
+  // (NOT a plain JOIN, which would surface every historical resolution row for
+  // a key rather than just its current disposition). A key whose latest row is
+  // a superseding 'open'/'redetected' row (the same secret came back) is
+  // excluded — it is not currently resolved. Legacy at-rest findings with
+  // finding_key IS NULL are excluded outright (the resolution lifecycle can
+  // never attach to them). Path comes from the finding's parent event
+  // (event_type 'code_change', attributes.file_path) — mirrors resolutions.ts's
+  // openAtRestStmt accessor. Ordered by resolved_at DESC, capped at `limit`.
+  //
+  // THE RESOLUTION SET DRIVES THIS QUERY, and that is a correctness property of
+  // the plan rather than a preference. Written the other way round — driving
+  // from inspection_findings/audit_events with `latest` LEFT JOINed on — SQLite
+  // cannot use the join key: `f` is reached FROM `latest` by finding_key, so
+  // `latest` gets probed on (rn, status, method) instead and the plan enumerates
+  // every (code_change event x resolved key) pair before `f` can reject it. That
+  // is a cross product, and it is quadratic in the store: measured at 10,966 ms
+  // on a corpus of 50,000 events carrying 2,051 resolutions, against 20 rows
+  // returned. It was invisible for as long as it was, and reported at 8 ms,
+  // because an empty finding_resolution table makes the inner side empty and the
+  // cross product collapses to nothing — so the shape is only observable on a
+  // corpus that seeds resolutions.
+  //
+  // Driving from `latest` instead makes every step below it a unique-index or
+  // primary-key lookup (uq_inspection_findings_key, then audit_events' own PK),
+  // so the cost is the derived table's own — linear in resolutions, which is
+  // what this feed is legitimately about.
+  //
+  // CROSS JOIN is what actually pins that, and it is load-bearing rather than
+  // decorative: in SQLite the keyword is semantically identical to JOIN and
+  // exists only to stop the optimizer reordering the tables. Written as plain
+  // JOINs in this order the planner puts `e` back on the outside — it has no
+  // ANALYZE statistics to price the alternatives with, so it takes
+  // `event_type = 'code_change'` for a selective index probe and rebuilds the
+  // cross product. The FROM order alone was measured to change the plan not at
+  // all.
+  //
+  // The LEFT JOIN it replaced was already an inner join in effect: three
+  // `latest.*` predicates sit in the WHERE, and each of them is false for a
+  // null-extended row. Spelling it JOIN changes no row and stops the plan
+  // reading as though the findings side could drive.
   recentlyResolved(limit = 20) {
     const rows = allRows(
       this.db.prepare(
@@ -24013,17 +24315,15 @@ var SqliteSecurityRepository = class {
                 json_extract(e.attributes, '$.file_path') AS path,
                 COALESCE(f.first_detected_at, e.started_at) AS first_detected_at,
                 latest.resolved_at AS latest_resolved_at
-         FROM inspection_findings f
-         JOIN audit_events e ON e.id = f.audit_event_id
-         JOIN inspection_definitions d ON d.id = f.inspection_definition_id
-         LEFT JOIN ${LATEST_RESOLUTION_BY_KEY_SQL} latest
-           ON latest.finding_key = f.finding_key
-         WHERE e.event_type = 'code_change'
-           AND f.finding_key IS NOT NULL
-           AND latest.status = 'resolved'
+         FROM ${LATEST_RESOLUTION_BY_KEY_SQL} latest
+         CROSS JOIN inspection_findings f ON f.finding_key = latest.finding_key
+         CROSS JOIN audit_events e ON e.id = f.audit_event_id
+         CROSS JOIN inspection_definitions d ON d.id = f.inspection_definition_id
+         WHERE latest.status = 'resolved'
            AND latest.method = 'fixed-at-source'
            AND latest.resolved_at IS NOT NULL
-         ORDER BY latest_resolved_at DESC
+           AND e.event_type = 'code_change'
+         ORDER BY latest.resolved_at DESC
          LIMIT :limit`
       ),
       { limit }
@@ -24960,6 +25260,7 @@ function openAndInitialize(file2) {
 function openLocalDatabase(dir) {
   ensureDataDirSync(dir);
   const file2 = join2(dir, DB_FILENAME);
+  reapStalePartials(file2);
   const {
     db,
     events,
@@ -25394,11 +25695,79 @@ function migrateLegacyLayout(base = defaultDataDir()) {
   }
 }
 
-// ../../packages/persistence/src/settings.ts
+// ../../packages/persistence/src/managed-settings.ts
 import { readFileSync as readFileSync3 } from "fs";
+import { posix, win32 } from "path";
+function managedSettingsPaths(platform2 = process.platform) {
+  if (platform2 === "darwin") {
+    return [
+      posix.join("/Library", "Application Support", "AKASecurity", MANAGED_SETTINGS_FILENAME),
+      posix.join("/Library", "Managed Preferences", MANAGED_SETTINGS_FILENAME)
+    ];
+  }
+  if (platform2 === "win32") {
+    return [win32.join("C:\\", "ProgramData", "AKASecurity", MANAGED_SETTINGS_FILENAME)];
+  }
+  return [posix.join("/etc", "aka", MANAGED_SETTINGS_FILENAME)];
+}
+function readManagedSettings(paths = managedSettingsPaths()) {
+  for (const path of paths) {
+    let text;
+    try {
+      text = readFileSync3(path, "utf8");
+    } catch {
+      continue;
+    }
+    const record2 = parseJsonObject(text);
+    if (!record2) continue;
+    const parsed = ManagedSettings.safeParse(record2);
+    if (parsed.success) return parsed.data;
+  }
+  return null;
+}
+function overlayManagedSettings(settings, managed, now = () => /* @__PURE__ */ new Date()) {
+  if (!managed) return settings;
+  const { values } = managed;
+  const merged = { ...settings };
+  if (values.runMode !== void 0) merged.runMode = values.runMode;
+  if (values.controlPlane !== void 0) {
+    merged.controlPlane = {
+      ...values.controlPlane,
+      // The administrator pinned WHICH deployment, not WHEN this machine
+      // joined it. Keep the user's own attach time when the endpoint is
+      // unchanged, so a managed machine does not appear to re-attach on every
+      // read; stamp a fresh one when the administrator moved it.
+      attachedAt: settings.controlPlane?.endpoint === values.controlPlane.endpoint ? settings.controlPlane.attachedAt : now().toISOString()
+    };
+  }
+  if (values.historicalAccess !== void 0) merged.historicalAccess = values.historicalAccess;
+  if (values.vaultKeyCustody !== void 0) merged.vaultKeyCustody = values.vaultKeyCustody;
+  if (values.vaultInlineReveal !== void 0) merged.vaultInlineReveal = values.vaultInlineReveal;
+  if (values.dataSharesInPlace !== void 0) merged.dataSharesInPlace = values.dataSharesInPlace;
+  if (values.vaultConsent !== void 0) {
+    merged.vaultConsent = values.vaultConsent ? (
+      // Keep an existing valid grant so its acknowledgedAt survives; mint one
+      // at the current version otherwise.
+      settings.vaultConsent?.version === VAULT_CONSENT_VERSION ? settings.vaultConsent : { acknowledgedAt: now().toISOString(), version: VAULT_CONSENT_VERSION }
+    ) : void 0;
+  }
+  if (values.modelJudgeConsent !== void 0) {
+    merged.modelJudgeConsent = values.modelJudgeConsent ? settings.modelJudgeConsent?.payloadVersion === MODEL_JUDGE_PAYLOAD_VERSION ? settings.modelJudgeConsent : {
+      acknowledgedAt: now().toISOString(),
+      payloadVersion: MODEL_JUDGE_PAYLOAD_VERSION
+    } : void 0;
+  }
+  return merged;
+}
+
+// ../../packages/persistence/src/settings.ts
+import { readFileSync as readFileSync4 } from "fs";
 import { join as join5 } from "path";
 var SETTINGS_FILENAME = "settings.json";
 function readWorkspaceSettings(base = defaultDataDir()) {
+  return overlayManagedSettings(readUserSettings(base), readManagedSettings());
+}
+function readUserSettings(base) {
   const record2 = readJson(join5(settingsDir(base), SETTINGS_FILENAME));
   if (!record2) return defaultWorkspaceSettings();
   try {
@@ -25410,7 +25779,7 @@ function readWorkspaceSettings(base = defaultDataDir()) {
 function readJson(file2) {
   let text;
   try {
-    text = readFileSync3(file2, "utf8");
+    text = readFileSync4(file2, "utf8");
   } catch {
     return null;
   }
@@ -25528,15 +25897,7 @@ function formatPointer(category, keyVersion, pointerId, tag) {
 // ../../packages/persistence/src/vault/key-provider.ts
 import { execFileSync } from "child_process";
 import { randomBytes as randomBytes2 } from "crypto";
-import {
-  chmodSync as chmodSync2,
-  mkdirSync as mkdirSync2,
-  readFileSync as readFileSync4,
-  renameSync as renameSync4,
-  rmSync as rmSync4,
-  statSync as statSync3,
-  writeFileSync as writeFileSync3
-} from "fs";
+import { chmodSync as chmodSync2, readFileSync as readFileSync5, renameSync as renameSync4, rmSync as rmSync4, statSync as statSync3, writeFileSync as writeFileSync3 } from "fs";
 import { join as join6 } from "path";
 var VAULT_OCCUPANT_REASON = {
   symlink: "the path is a symlink; remove it so a keyring can be created",
@@ -25629,7 +25990,8 @@ var LOCK_OWNER_FILE = "owner";
 var ROTATION_IN_PROGRESS = "vault: a key rotation is already in progress";
 function claimRotationLock(lock, owner) {
   try {
-    mkdirSync2(lock);
+    mkdirOwnerOnlySync(lock);
+    tightenDir(lock);
   } catch (err) {
     if (err.code === "EEXIST") return false;
     throw asError(err);
@@ -25671,7 +26033,7 @@ function acquireRotationLock(keysDir2) {
 }
 function releaseRotationLock(lease) {
   try {
-    if (readFileSync4(join6(lease.lock, LOCK_OWNER_FILE), "utf8").trim() !== lease.owner) return;
+    if (readFileSync5(join6(lease.lock, LOCK_OWNER_FILE), "utf8").trim() !== lease.owner) return;
   } catch {
     return;
   }
@@ -25722,7 +26084,7 @@ var FileKeyProvider = class {
   #read() {
     let raw;
     try {
-      raw = readFileSync4(this.filePath, "utf8");
+      raw = readFileSync5(this.filePath, "utf8");
     } catch (err) {
       if (err.code === "ENOENT") return null;
       throw err instanceof Error ? err : new Error(String(err));
@@ -25761,15 +26123,19 @@ var FileKeyProvider = class {
    * Atomic tmp + rename so a crash mid-write cannot truncate the keyring.
    * Used only for rotation, under the rotation lock — first creation goes
    * through the creation-exclusive path instead.
+   *
+   * Delegated to the shared owner-only write rather than spelled here, so the
+   * create mode this file is published at is the one paths.ts owns and tests
+   * directly. A local copy of the pair was a second place the mode could be
+   * dropped with the trailing tighten still repairing the end state, which is
+   * the shape no assertion on a published file can see. It also picks up that
+   * primitive's per-process tmp name, its stale-tmp sweep, and an exclusive
+   * create that refuses to follow a symlink planted at the tmp path.
    */
   #write(keyring) {
     ensureDataDirSync(this.#keysDir);
-    const file2 = this.filePath;
-    const tmp = `${file2}.tmp`;
-    writeFileSync3(tmp, `${serializeKeyring(keyring)}
-`, { mode: DATA_FILE_MODE });
-    renameSync4(tmp, file2);
-    tightenFileMode(file2);
+    writeOwnerOnlyFileSync(this.filePath, `${serializeKeyring(keyring)}
+`);
     return keyring;
   }
 };
@@ -25779,15 +26145,73 @@ function tightenFileMode(file2) {
   } catch {
   }
 }
-var runSecurity = (args) => execFileSync("/usr/bin/security", args, {
+var SECURITY_TIMEOUT_MS = 5e3;
+var runSecurity = (args, stdin) => execFileSync("/usr/bin/security", args, {
   encoding: "utf8",
-  stdio: ["ignore", "pipe", "ignore"]
+  input: stdin,
+  timeout: SECURITY_TIMEOUT_MS,
+  // stderr is discarded rather than captured, and that is deliberate: a
+  // captured stream rides out on an execFileSync error's `.stderr`, and the
+  // write paths here carry the keyring. Exit status is the only thing any
+  // branch below reads.
+  stdio: [stdin === void 0 ? "ignore" : "pipe", "pipe", "ignore"]
 });
 var SECURITY_ITEM_NOT_FOUND = 44;
+function corruptReason(err) {
+  if (err instanceof SyntaxError) return "malformed JSON";
+  return err instanceof Error ? err.message : "unknown";
+}
+function securityFailureMeta(err) {
+  const e = err;
+  const parts = [];
+  if (typeof e.status === "number") parts.push(`exit ${String(e.status)}`);
+  if (typeof e.signal === "string" && e.signal) parts.push(`signal ${e.signal}`);
+  if (typeof e.code === "string" && e.code) parts.push(e.code);
+  return parts.length > 0 ? parts.join(", ") : "unknown error";
+}
+function writeCommand(keyring, update, keychain) {
+  const hex3 = Buffer.from(serializeKeyring(keyring), "utf8").toString("hex");
+  const parts = [
+    "add-generic-password",
+    ...update ? ["-U"] : [],
+    "-s",
+    KEYCHAIN_SERVICE,
+    "-a",
+    KEYCHAIN_ACCOUNT,
+    "-X",
+    hex3
+  ];
+  if (keychain !== void 0) {
+    if (/['\\\n\r\0]/.test(keychain)) {
+      throw new Error(
+        "vault: keychain path contains a quote, backslash, line break or NUL, which security -i cannot carry intact"
+      );
+    }
+    parts.push(`'${keychain}'`);
+  }
+  return `${parts.join(" ")}
+`;
+}
 var KeychainKeyProvider = class {
   #keysDir;
   #exec;
-  constructor(keysDir2, exec = runSecurity) {
+  #keychain;
+  /**
+   * The trailing keychain argument, or nothing. Every subcommand used here
+   * takes it last (`add-generic-password [keychain]`,
+   * `find-generic-password [keychain...]`), and omitting it means the default
+   * search list. Fixed at construction, so it is built once rather than per
+   * call on the capture path.
+   */
+  #target;
+  /**
+   * `keychain` names the keychain to operate on, as `security`'s trailing
+   * argument. Production passes nothing and gets the user's default keychain,
+   * which is the whole point of the backend. A test driving the REAL binary
+   * passes a throwaway one, because the alternative is writing vault key
+   * material into the developer's own login keychain and leaving it there.
+   */
+  constructor(keysDir2, exec = runSecurity, keychain) {
     if (exec === runSecurity && process.platform !== "darwin") {
       throw new Error(
         `keychain custody is not available on this platform (${process.platform}); use file custody`
@@ -25795,6 +26219,8 @@ var KeychainKeyProvider = class {
     }
     this.#keysDir = keysDir2;
     this.#exec = exec;
+    this.#keychain = keychain;
+    this.#target = keychain === void 0 ? [] : [keychain];
   }
   /** Where a fallback file provider for the same vault would keep its keyring. */
   get keysDir() {
@@ -25833,18 +26259,22 @@ var KeychainKeyProvider = class {
         KEYCHAIN_SERVICE,
         "-a",
         KEYCHAIN_ACCOUNT,
-        "-w"
+        "-w",
+        ...this.#target
       ]);
     } catch (err) {
       if (err.status === SECURITY_ITEM_NOT_FOUND) return null;
       throw new Error(
-        `vault: keychain read failed (${err instanceof Error ? err.message : String(err)}); refusing to treat the failure as an absent keyring`,
-        { cause: err }
+        `vault: keychain read failed (${securityFailureMeta(err)}); refusing to treat the failure as an absent keyring`
       );
     }
     const body = raw.trim();
     if (body.length === 0) return null;
-    return parseKeyring(body);
+    try {
+      return parseKeyring(body);
+    } catch (err) {
+      throw new Error(`vault: keychain item is not a usable keyring (${corruptReason(err)})`);
+    }
   }
   /**
    * First mint: a plain `add-generic-password` (no `-U`) fails when an item
@@ -25852,37 +26282,25 @@ var KeychainKeyProvider = class {
    * keyring — the loser re-reads and adopts it instead.
    */
   #create(keyring) {
-    const args = [
-      "add-generic-password",
-      "-s",
-      KEYCHAIN_SERVICE,
-      "-a",
-      KEYCHAIN_ACCOUNT,
-      "-w",
-      serializeKeyring(keyring)
-    ];
+    const line = writeCommand(keyring, false, this.#keychain);
     try {
-      this.#exec(args);
+      this.#exec(["-i"], line);
     } catch (err) {
       const winner = this.#read();
       if (winner) return winner;
-      throw asError(err);
+      throw new Error(`vault: keychain write failed (${securityFailureMeta(err)})`);
     }
     return keyring;
   }
   // `-U` updates the item in place, deliberately replacing the stored map with
   // one that contains it — used only for rotation, under the rotation lock.
   #replace(keyring) {
-    this.#exec([
-      "add-generic-password",
-      "-U",
-      "-s",
-      KEYCHAIN_SERVICE,
-      "-a",
-      KEYCHAIN_ACCOUNT,
-      "-w",
-      serializeKeyring(keyring)
-    ]);
+    const line = writeCommand(keyring, true, this.#keychain);
+    try {
+      this.#exec(["-i"], line);
+    } catch (err) {
+      throw new Error(`vault: keychain write failed (${securityFailureMeta(err)})`);
+    }
     return keyring;
   }
 };
@@ -26382,7 +26800,7 @@ function resolveProviderSafe(resolveProviderFn) {
 }
 
 // ../../packages/plugin-sdk/src/config-inventory.ts
-import { readdirSync as readdirSync2, readFileSync as readFileSync6, realpathSync, statSync as statSync5 } from "fs";
+import { readdirSync as readdirSync2, readFileSync as readFileSync7, realpathSync, statSync as statSync5 } from "fs";
 import { homedir as homedir2 } from "os";
 import { basename as basename3, join as join10 } from "path";
 
@@ -26958,6 +27376,40 @@ function escapeRegExp2(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
+// ../../packages/detections/src/regex-cache.ts
+var singles = /* @__PURE__ */ new WeakMap();
+var keywordLists = /* @__PURE__ */ new WeakMap();
+var labelLists = /* @__PURE__ */ new WeakMap();
+function listCache(kind) {
+  return kind === "keyword" ? keywordLists : labelLists;
+}
+function memoizedRegExp(owner, build) {
+  const cached2 = singles.get(owner);
+  if (cached2 !== void 0) {
+    cached2.lastIndex = 0;
+    return cached2;
+  }
+  const compiled = build();
+  singles.set(owner, compiled);
+  return compiled;
+}
+function memoizedRegExpList(kind, owner, build) {
+  const cache = listCache(kind);
+  const cached2 = cache.get(owner);
+  if (cached2 !== void 0) {
+    if (cached2.stateful) {
+      for (const re of cached2.entries) if (re !== void 0) re.lastIndex = 0;
+    }
+    return cached2.entries;
+  }
+  const entries = build();
+  cache.set(owner, {
+    entries,
+    stateful: entries.some((re) => re !== void 0 && (re.global || re.sticky))
+  });
+  return entries;
+}
+
 // ../../packages/detections/src/matchers/limits.ts
 var MAX_MATCHES_PER_RULE = 1e4;
 var MAX_REGEX_INPUT_LENGTH = 2e5;
@@ -26968,10 +27420,17 @@ var KeywordMatcher2 = class {
     if (rule.matcher.type !== "keyword") return [];
     const { keywords, caseSensitive } = rule.matcher;
     const spans = [];
-    for (const kw of keywords) {
-      if (kw.length === 0) continue;
+    const compiled = memoizedRegExpList(
+      "keyword",
+      rule.matcher,
+      () => keywords.map((kw) => {
+        if (kw.length === 0) return void 0;
+        return new RegExp(escapeRegExp2(kw), caseSensitive ? "gu" : "giu");
+      })
+    );
+    for (const re of compiled) {
+      if (re === void 0) continue;
       if (spans.length >= MAX_MATCHES_PER_RULE) break;
-      const re = new RegExp(escapeRegExp2(kw), caseSensitive ? "gu" : "giu");
       let m;
       while ((m = re.exec(text)) !== null) {
         spans.push({ start: m.index, end: m.index + m[0].length });
@@ -26987,7 +27446,10 @@ var RegexMatcher2 = class {
   match(text, rule) {
     if (rule.matcher.type !== "regex") return [];
     const { pattern, flags, captureGroup } = rule.matcher;
-    const re = new RegExp(pattern, flags.includes("d") ? flags : `${flags}d`);
+    const re = memoizedRegExp(
+      rule.matcher,
+      () => new RegExp(pattern, flags.includes("d") ? flags : `${flags}d`)
+    );
     const scanText2 = text.length > MAX_REGEX_INPUT_LENGTH ? text.slice(0, MAX_REGEX_INPUT_LENGTH) : text;
     const spans = [];
     let m;
@@ -27046,6 +27508,10 @@ function luhnCheck(digits) {
 // ../../packages/detections/src/engine.ts
 var keywordMatcher = new KeywordMatcher2();
 var regexMatcher = new RegexMatcher2();
+var MATCHERS = {
+  keyword: (text, rule) => keywordMatcher.match(text, rule),
+  regex: (text, rule) => regexMatcher.match(text, rule)
+};
 var packs = /* @__PURE__ */ new Map();
 var POST_VALIDATORS = {
   entropy: (value, config2) => isHighEntropy(value, numberOption(config2, "threshold"), numberOption(config2, "minLength")),
@@ -27061,8 +27527,7 @@ function passesPostValidators(rule, value) {
   for (const ref of validators) {
     const name = typeof ref === "string" ? ref : ref.name;
     const config2 = typeof ref === "string" ? void 0 : ref.config;
-    const validate = POST_VALIDATORS[name];
-    if (validate && !validate(value, config2)) return false;
+    if (!POST_VALIDATORS[name](value, config2)) return false;
   }
   return true;
 }
@@ -27095,11 +27560,15 @@ function isCorroborated(candidate, candidates, text) {
   const labels = req.labels;
   if (labels && labels.length > 0) {
     const haystack = text.slice(Math.max(0, winStart), winEnd);
-    for (const label of labels) {
-      const trimmed = label.trim();
-      if (trimmed.length === 0) continue;
-      const re = new RegExp(`(?<![A-Za-z0-9])${escapeRegExp2(trimmed)}(?![A-Za-z0-9])`, "i");
-      if (re.test(haystack)) return true;
+    for (const re of memoizedRegExpList(
+      "label",
+      req,
+      () => labels.map((label) => {
+        const trimmed = label.trim();
+        return trimmed.length === 0 ? void 0 : new RegExp(`(?<![A-Za-z0-9])${escapeRegExp2(trimmed)}(?![A-Za-z0-9])`, "i");
+      })
+    )) {
+      if (re?.test(haystack)) return true;
     }
   }
   return false;
@@ -27119,14 +27588,7 @@ function scan(text, rules, context) {
   const candidates = [];
   for (const rule of ruleset) {
     if (!ruleApplies(rule, extension)) continue;
-    let spans;
-    if (rule.matcher.type === "keyword") {
-      spans = keywordMatcher.match(text, rule);
-    } else if (rule.matcher.type === "regex") {
-      spans = regexMatcher.match(text, rule);
-    } else {
-      continue;
-    }
+    const spans = MATCHERS[rule.matcher.type](text, rule);
     for (const span of spans) {
       const rawMatch = text.slice(span.start, span.end);
       if (!passesPostValidators(rule, rawMatch)) continue;
@@ -27367,24 +27829,33 @@ function probesFor(rule) {
   const derived = rule.matcher.type === "regex" ? derivedProbes(rule.matcher.pattern) : [];
   return [...derived, ...EXPONENTIAL_PROBES, ...POLYNOMIAL_PROBES];
 }
-function worstProbeMs(rule) {
+var wallClock = () => performance.now();
+function worstProbeMs(rule, now = wallClock, corroborate) {
   let ms = 0;
   let probe = "";
+  let corroboratedMs;
   for (const text of probesFor(rule)) {
-    const start = performance.now();
+    const start = now();
+    const corroborateStart = corroborate?.();
     scan(text, [rule]);
-    const elapsed = performance.now() - start;
+    const elapsed = now() - start;
+    const corroborateEnd = corroborate?.();
     if (elapsed > ms) {
       ms = elapsed;
       probe = text;
+      corroboratedMs = corroborateStart === void 0 || corroborateEnd === void 0 ? void 0 : corroborateEnd - corroborateStart;
     }
     if (ms >= BUDGET_MS) break;
   }
-  return { ms, probe };
+  return { ms, probe, corroboratedMs };
 }
-function checkRuleTiming(rule) {
-  const { ms, probe } = worstProbeMs(rule);
-  return { safe: ms < BUDGET_MS, worstMs: ms, probe };
+var CPU_CORROBORATION_SHARE = 0.2;
+var CORROBORATION_FLOOR_MS = BUDGET_MS * CPU_CORROBORATION_SHARE;
+function checkRuleTiming(rule, corroborate) {
+  const { ms, probe, corroboratedMs } = worstProbeMs(rule, wallClock, corroborate);
+  const work = corroboratedMs ?? 0;
+  const verdict = ms < BUDGET_MS ? "safe" : work >= CORROBORATION_FLOOR_MS ? "over-budget" : "uncorroborated";
+  return { verdict, worstMs: ms, corroboratedMs: work, probe };
 }
 
 // ../../rules/code-flaws/auth-jwt-no-verify.json
@@ -29420,7 +29891,7 @@ function bundledDetections() {
 }
 
 // ../../packages/plugin-sdk/src/repo.ts
-import { existsSync as existsSync6, readFileSync as readFileSync5, statSync as statSync4 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync6, statSync as statSync4 } from "fs";
 import { basename as basename2, dirname as dirname2, isAbsolute, join as join9, sep as sep2 } from "path";
 function resolveRepo(cwd) {
   try {
@@ -29465,7 +29936,7 @@ function resolveGitContext(root) {
 }
 function safeRead(path) {
   try {
-    return readFileSync5(path, "utf8");
+    return readFileSync6(path, "utf8");
   } catch {
     return void 0;
   }
@@ -29766,7 +30237,12 @@ function createIsolatedScanner(data, opts = {}) {
             build: (id) => ({ kind: "probe", id, rule }),
             reply: (message) => {
               if (message.kind !== "probed") return false;
-              resolve({ status: "ok", safe: message.safe, worstMs: message.worstMs });
+              resolve({
+                status: "ok",
+                verdict: message.verdict,
+                worstMs: message.worstMs,
+                corroboratedMs: message.corroboratedMs
+              });
               return true;
             }
           },
@@ -29786,6 +30262,12 @@ function createIsolatedScanner(data, opts = {}) {
   };
 }
 
+// ../../packages/plugin-sdk/src/work-clock.ts
+function workClockMs() {
+  const usage = typeof process.threadCpuUsage === "function" ? process.threadCpuUsage() : process.cpuUsage();
+  return (usage.user + usage.system) / 1e3;
+}
+
 // ../../packages/plugin-sdk/src/rule-quarantine.ts
 var PASS_BUDGET_MS = 2e3;
 var UNQUARANTINE_HINT = "clear it with `aka detections unquarantine`";
@@ -29814,6 +30296,14 @@ function warnUnmeasured(rule) {
     false
   );
 }
+function warnUncorroborated(rule, worstMs, corroboratedMs) {
+  warn(
+    rule,
+    "deferred",
+    `its regex matcher ran past the ReDoS timing budget (${worstMs.toFixed(1)}ms) but spent only ${corroboratedMs.toFixed(1)}ms of CPU doing it, which is a busy machine rather than a slow pattern; excluded from this run and measured again next time, with nothing recorded against it.`,
+    false
+  );
+}
 function warnUnmeasurable(reason, count) {
   process.stderr.write(
     `[aka] ${String(count)} pulled/custom-pack rule(s) could not be time-checked: ${reason}. That is a problem with this install, not with the rules \u2014 until it is fixed they are excluded from every scan on this machine. Nothing was quarantined, so reinstalling AKA brings them straight back.
@@ -29860,24 +30350,31 @@ async function filterUnsafeRules(rules, gateway, opts) {
         warnUnmeasured(rule);
         continue;
       }
-      let isSafe;
+      let verdict;
       let worstMs;
+      let corroboratedMs = 0;
       if (prober) {
         const outcome = await prober.probe(rule);
         if (outcome.status === "unavailable") {
           unmeasurable.set(outcome.reason, (unmeasurable.get(outcome.reason) ?? 0) + 1);
           continue;
         }
-        isSafe = outcome.status === "ok" ? outcome.safe : false;
+        verdict = outcome.status === "ok" ? outcome.verdict : "over-budget";
         worstMs = outcome.status === "ok" ? outcome.worstMs : outcome.elapsedMs;
+        if (outcome.status === "ok") corroboratedMs = outcome.corroboratedMs;
       } else {
         try {
-          ({ safe: isSafe, worstMs } = checkRuleTiming(rule));
+          ({ verdict, worstMs, corroboratedMs } = checkRuleTiming(rule, workClockMs));
         } catch {
-          isSafe = false;
+          verdict = "over-budget";
           worstMs = Number.POSITIVE_INFINITY;
         }
       }
+      if (verdict === "uncorroborated") {
+        warnUncorroborated(rule, worstMs, corroboratedMs);
+        continue;
+      }
+      const isSafe = verdict === "safe";
       let persisted = false;
       try {
         await gateway.setRuleProbeVerdict(key, isSafe ? "safe" : "quarantined", worstMs);
@@ -29977,21 +30474,25 @@ function createGuardedScanner(partition, gateway, opts) {
   };
 }
 
+// ../../packages/plugin-sdk/src/ignore-layers.ts
+var import_ignore = __toESM(require_ignore(), 1);
+import { readFileSync as readFileSync8 } from "fs";
+import { join as join11 } from "path";
+
 // ../../packages/plugin-sdk/src/inventory-resolver.ts
 import { arch, hostname as hostname4, platform, release } from "os";
 
 // ../../packages/plugin-sdk/src/nudge.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync5 } from "fs";
-import { join as join11 } from "path";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync9, writeFileSync as writeFileSync5 } from "fs";
+import { join as join12 } from "path";
 
 // ../../packages/plugin-sdk/src/paths.ts
 import { readdirSync as readdirSync3, realpathSync as realpathSync2 } from "fs";
 import { basename as basename4, dirname as dirname3, sep as sep3 } from "path";
 
 // ../../packages/plugin-sdk/src/project-files.ts
-var import_ignore = __toESM(require_ignore(), 1);
-import { existsSync as existsSync8, readdirSync as readdirSync4, readFileSync as readFileSync8 } from "fs";
-import { basename as basename5, join as join12, relative, sep as sep4 } from "path";
+import { existsSync as existsSync8, readdirSync as readdirSync4 } from "fs";
+import { basename as basename5, join as join13 } from "path";
 
 // ../../packages/plugin-sdk/src/provider-env-antigravity.ts
 var optionalBaseUrl2 = external_exports.preprocess((v) => {
@@ -30050,6 +30551,7 @@ function createPluginRuntime(gateway, settings, opts) {
   let initialized = false;
   const ruleActionIndex = /* @__PURE__ */ new Map();
   const categoryActionIndex = /* @__PURE__ */ new Map();
+  let reversibleRuleIndex = /* @__PURE__ */ new Set();
   async function ensureInitialized() {
     if (initialized) return;
     const bundle = await gateway.getPolicyBundle();
@@ -30062,6 +30564,7 @@ function createPluginRuntime(gateway, settings, opts) {
         categoryActionIndex.set(p.target.category, p.action);
       }
     }
+    reversibleRuleIndex = new Set(bundle.reversibleRuleIds ?? []);
     const bundledProbeKeys = new Set(
       getLoadedRules().map(ruleProbeKey).filter((key) => key !== void 0)
     );
@@ -30140,11 +30643,13 @@ function createPluginRuntime(gateway, settings, opts) {
     if (worst === "block") return { action: "block", text: null, findings };
     if (worst === "redact") {
       const redactFindings = findings.filter((f) => actionFor(f) === "redact");
+      const reversibleFindings = redactFindings.filter((f) => reversibleRuleIndex.has(f.ruleId));
       return {
         action: "redact",
         text: redact(text, redactFindings),
         findings,
-        enforcedFindings: redactFindings
+        enforcedFindings: redactFindings,
+        reversibleFindings
       };
     }
     return { action: worst, text, findings };
@@ -30358,8 +30863,8 @@ function createPluginRuntime(gateway, settings, opts) {
 var THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1e3;
 
 // ../../packages/plugin-sdk/src/throttle.ts
-import { mkdirSync as mkdirSync4, statSync as statSync6, writeFileSync as writeFileSync6 } from "fs";
-import { join as join13 } from "path";
+import { mkdirSync as mkdirSync3, statSync as statSync6, writeFileSync as writeFileSync6 } from "fs";
+import { join as join14 } from "path";
 
 // ../../packages/plugin-sdk/src/tokenize.ts
 function redactedPlaceholder(category) {
@@ -30422,6 +30927,8 @@ var SecretVaultGlue = class {
   async tokenizeText(text, opts) {
     try {
       const findings = opts?.findings ?? this.#selfScan(text);
+      const reversible = opts?.reversible;
+      const keeps = (finding) => reversible === void 0 || reversible.has(finding);
       if (findings === null) return { text: "[REDACTED]", pointers: [], degraded: [] };
       if (findings.length === 0) return { text, pointers: [], degraded: [] };
       const groups = groupSpans(text, findings);
@@ -30438,6 +30945,8 @@ var SecretVaultGlue = class {
         } else if (original !== finding.rawMatch) {
           replacement = redactedPlaceholder(group.category);
           degraded.unshift({ category: group.category });
+        } else if (!keeps(finding)) {
+          replacement = redactedPlaceholder(finding.category);
         } else {
           replacement = await this.tokenizeValue(finding.rawMatch, {
             ruleId: finding.ruleId,
@@ -30662,17 +31171,17 @@ var UNOPENABLE_VAULT = {
 
 // src/protocol/marker.ts
 import { randomBytes as randomBytes4 } from "crypto";
-import { mkdirSync as mkdirSync5, readFileSync as readFileSync9, renameSync as renameSync5, writeFileSync as writeFileSync7 } from "fs";
-import { join as join14 } from "path";
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync10, renameSync as renameSync5, writeFileSync as writeFileSync7 } from "fs";
+import { join as join15 } from "path";
 var MARKER_FILE = "protocol-marker";
 function mintMarker() {
   return randomBytes4(8).toString("hex");
 }
 function sessionProtocolMarker(dataDir2, sessionId) {
   if (!sessionId) return mintMarker();
-  const path = join14(dataDir2, MARKER_FILE);
+  const path = join15(dataDir2, MARKER_FILE);
   try {
-    const stored = JSON.parse(readFileSync9(path, "utf8"));
+    const stored = JSON.parse(readFileSync10(path, "utf8"));
     if (stored.sessionId === sessionId && typeof stored.marker === "string" && /^[0-9a-f]{16}$/.test(stored.marker)) {
       return stored.marker;
     }
@@ -30680,8 +31189,8 @@ function sessionProtocolMarker(dataDir2, sessionId) {
   }
   const marker = mintMarker();
   try {
-    mkdirSync5(dataDir2, { recursive: true, mode: DATA_DIR_MODE });
-    const tmp = join14(dataDir2, `${MARKER_FILE}.tmp`);
+    mkdirSync4(dataDir2, { recursive: true, mode: DATA_DIR_MODE });
+    const tmp = join15(dataDir2, `${MARKER_FILE}.tmp`);
     writeFileSync7(tmp, JSON.stringify({ sessionId, marker }), { mode: DATA_FILE_MODE });
     renameSync5(tmp, path);
   } catch {
@@ -30876,9 +31385,10 @@ async function decidePreToolUse(toolName, toolInput, scanned, tokenizeField) {
     } else if (action === "redact") {
       let rewritten = result.text;
       const enforced = result.enforcedFindings ?? [];
+      const reversible = new Set(result.reversibleFindings ?? []);
       if (tokenizeField && enforced.length > 0) {
         try {
-          const tokenized = await tokenizeField(text, enforced);
+          const tokenized = await tokenizeField(text, enforced, reversible);
           rewritten = tokenized.text;
           for (const token of tokenized.pointers) {
             realized.pointers.push({ token, category: pointerCategory(token) });
@@ -31076,8 +31586,8 @@ function baseMetadata(input) {
 }
 
 // src/hooks/store-health.ts
-import { mkdirSync as mkdirSync6, readFileSync as readFileSync10, writeFileSync as writeFileSync8 } from "fs";
-import { join as join15 } from "path";
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync11, writeFileSync as writeFileSync8 } from "fs";
+import { join as join16 } from "path";
 
 // ../../packages/plugin-runtime/src/standalone-gateway.ts
 import { randomUUID as randomUUID15 } from "crypto";
@@ -31090,6 +31600,8 @@ var StandaloneDataGateway = class {
   db;
   // Kept for the fingerprint key lookup (exception.key lives beside the store).
   dataDir;
+  // One notice per gateway — see warnRulesetDiscarded.
+  warnedRulesetDiscarded = false;
   constructor(dataDir2, detections = [], meta3) {
     this.db = openLocalDatabase(dataDir2);
     this.dataDir = dataDir2;
@@ -31209,28 +31721,69 @@ var StandaloneDataGateway = class {
   //   - ANY invalid rule among enabled packs (all-invalid, partial corruption,
   //     or a single malformed entry) → undefined → bundled fallback. Serving a
   //     reduced "complete" set would silently drop exactly the corrupted rules
-  //     with no fallback; the bundled packs are a superset, so falling back
-  //     never loses coverage. Steady-state installed rules are all valid
-  //     (generated + Zod-checked), so this only fires on a genuinely
-  //     malformed/foreign store;
+  //     with no fallback. The bundled packs are a superset of AKA's OWN packs,
+  //     so falling back never loses coverage there — but they contain no
+  //     pulled or custom pack, so for those this trades a partial ruleset for
+  //     none of them plus the loss of every pack's per-detection enforcement
+  //     action. That is deliberate (a store this machine cannot fully validate
+  //     is not authoritative), and it is why the cost of REJECTING a rule
+  //     matters: `Rule` is strict, so one unrecognized key in one custom rule
+  //     reaches this branch, not just a genuinely malformed or foreign store.
+  //     `installed-packs.test.ts` pins that per-rule counting;
   //   - enabled packs that produce ZERO rules with no invalids (e.g. every
   //     enabled pack's rules_json is `[]`) → undefined → bundled fallback: an
   //     enabled pack contributing nothing is untrustworthy, not a real
   //     "detect nothing" (that is expressed by disabling packs, handled above);
   //   - otherwise → the enabled packs' validated rules, marked complete.
+  /**
+   * The discard above is the one ruleset decision this gateway reaches on its
+   * own, and it is the most expensive one here: ONE rejected entry costs the
+   * user every custom rule and every per-detection enforcement action, replaced
+   * by bundled packs that contain neither. Nothing else reports it — a hook is a
+   * short-lived process whose stderr is the only channel it has — so name what
+   * was rejected and where the rest of the list lives.
+   *
+   * Unlike a quarantine verdict this caches nothing: the rejection is re-derived
+   * from the store on every run, so the recovery is to fix or reinstall the pack,
+   * and no line here may offer a command that clears a stored verdict.
+   *
+   * Written at most once per gateway — a second getPolicyBundle() in the same
+   * process would re-report the same finding.
+   */
+  warnRulesetDiscarded(snapshot) {
+    if (this.warnedRulesetDiscarded) return;
+    this.warnedRulesetDiscarded = true;
+    const listed = snapshot.rejectedRules.map((r) => `${r.pack}${r.ruleId === null ? "" : ` "${r.ruleId}"`} (${r.reason})`).join(", ");
+    const undisclosed = snapshot.invalidRules - snapshot.rejectedRules.length;
+    const more = undisclosed > 0 ? `, and ${String(undisclosed)} more` : "";
+    process.stderr.write(
+      `[aka] installed ruleset not used: ${String(snapshot.invalidRules)} rule(s) under enabled packs failed validation, so scanning fell back to the bundled packs and no custom rule or per-detection action is enforced \u2014 rejected: ${listed}${more}; review them with \`aka detections\`
+`
+    );
+  }
   installedScanRules() {
     try {
       const snapshot = this.db.installedPacks.installedRuleset();
       if (snapshot.installedPacks === 0) return void 0;
       if (snapshot.enabledPacks === 0) {
-        return { rules: [], ruleActions: /* @__PURE__ */ new Map(), ruleVersions: /* @__PURE__ */ new Map(), complete: true };
+        return {
+          rules: [],
+          ruleActions: /* @__PURE__ */ new Map(),
+          ruleVersions: /* @__PURE__ */ new Map(),
+          reversibleRules: /* @__PURE__ */ new Set(),
+          complete: true
+        };
+      }
+      if (snapshot.invalidRules > 0) {
+        this.warnRulesetDiscarded(snapshot);
+        return void 0;
       }
-      if (snapshot.invalidRules > 0) return void 0;
       if (snapshot.rules.length === 0) return void 0;
       return {
         rules: snapshot.rules,
         ruleActions: snapshot.ruleActions,
         ruleVersions: snapshot.ruleVersions,
+        reversibleRules: snapshot.reversibleRules,
         complete: true
       };
     } catch {
@@ -31258,6 +31811,11 @@ var StandaloneDataGateway = class {
     return {
       version: "local",
       policies: [...policies, ...rulePolicies],
+      // The reversibility half of each pack's assignment. Emitted only under the
+      // authoritative installed snapshot, exactly like rulePolicies above: the
+      // bundled-packs fallback carries no per-pack assignment, so it carries no
+      // reversibility either and every redaction there stays one-way.
+      reversibleRuleIds: installed ? [...installed.reversibleRules] : [],
       rules: installed ? installed.rules : [],
       ...installed ? { rulesComplete: true } : {},
       ...installed ? { ruleVersions: Object.fromEntries(installed.ruleVersions) } : {},
@@ -31276,29 +31834,32 @@ var StandaloneDataGateway = class {
     return this.db.exceptions.recordBlocked(entry);
   }
   // Retention sweep over TERMINAL exception rows (revoked / expired / budget
-  // exhausted) — standalone-only store maintenance, invoked from SessionStart,
-  // not part of the DataGateway port. Active grants are never touched.
+  // exhausted) — local-store maintenance, invoked from SessionStart through the
+  // LocalStoreMaintenance capability rather than the DataGateway port. Active
+  // grants are never touched.
   sweepTerminalExceptions(retentionMs) {
     return this.db.exceptions.sweepTerminal(retentionMs);
   }
-  // The warn-era enforcement cap, standalone-only store maintenance invoked
-  // from SessionStart, not part of the DataGateway port. Returns the number
-  // of block/redact rows capped to warn (0 for a redact-policy store or an
-  // already-capped one).
+  // The warn-era enforcement cap — local-store maintenance, invoked from
+  // SessionStart through the LocalStoreMaintenance capability rather than
+  // the DataGateway port. Returns the number of block/redact rows capped to
+  // warn (0 for a redact-policy store or an already-capped one).
   capWarnEraEnforcement(policyMode) {
     const { capped } = capWarnEraEnforcementOnce(this.db, policyMode, this.dataDir);
     return { capped };
   }
   // One project-file scan → the local project_file tree (one transaction inside
-  // the LocalDatabase, fail-open there). Like the sweep above, this is
-  // NOT part of the DataGateway port: the file tree is a local-store read model.
+  // the LocalDatabase, fail-open there). Like the sweep above, this is reached
+  // through the LocalStoreMaintenance capability rather than the DataGateway
+  // port: the file tree is a local-store read model.
   recordProjectFiles(projectId, scan2) {
     this.db.recordProjectFiles(projectId, scan2);
     return Promise.resolve();
   }
   // Fold ghost source_project rows minted by the pre-worktree-fix resolver
-  // (checkout-path identities) into the repo's canonical row. Standalone-only
-  // store maintenance, invoked from SessionStart. Fail-open in the store.
+  // (checkout-path identities) into the repo's canonical row. Local-store
+  // maintenance, invoked from SessionStart through the LocalStoreMaintenance
+  // capability. Fail-open in the store.
   reconcileWorktreeProjects(canonicalId, headRoot, worktreeRoot) {
     this.db.reconcileWorktreeProjects(canonicalId, headRoot, worktreeRoot);
     return Promise.resolve();
@@ -31309,10 +31870,10 @@ var StandaloneDataGateway = class {
    * executing the plugin generation they started with (Claude Code caches
    * plugin versions), and the write gate makes their installed-pack writes
    * silent no-ops — this is the one-line nudge telling the user WHY, and that
-   * a restart picks the newer plugin up. Standalone-only, invoked from
-   * SessionStart, not part of the DataGateway port. Fail-open: any error →
-   * null (no notice), and unparseable versions compare equal so garbage can
-   * never fire it.
+   * a restart picks the newer plugin up. Local-store maintenance, invoked
+   * from SessionStart through the LocalStoreMaintenance capability rather
+   * than the DataGateway port. Fail-open: any error → null (no notice), and
+   * unparseable versions compare equal so garbage can never fire it.
    */
   staleBinaryNotice(currentVersion) {
     try {
@@ -31390,7 +31951,8 @@ var StandaloneDataGateway = class {
 
 // ../../packages/plugin-runtime/src/resolve.ts
 var standaloneGatewayFactory = (config2, meta3) => new StandaloneDataGateway(config2.dataDir, bundledDetections(), meta3);
-function resolveDataGateway(config2, meta3, gatewayFactory = standaloneGatewayFactory) {
+var defaultGatewayFactory = standaloneGatewayFactory;
+function resolveDataGateway(config2, meta3, gatewayFactory = defaultGatewayFactory) {
   return gatewayFactory(config2, meta3);
 }
 
@@ -31412,13 +31974,13 @@ function storeUnavailableMessage(dbPath2) {
 }
 function claimStoreUnavailableWarning(dataDir2, sessionId) {
   if (!sessionId) return true;
-  const path = join15(dataDir2, STORE_WARNING_MARKER);
+  const path = join16(dataDir2, STORE_WARNING_MARKER);
   try {
-    if (readFileSync10(path, "utf8") === sessionId) return false;
+    if (readFileSync11(path, "utf8") === sessionId) return false;
   } catch {
   }
   try {
-    mkdirSync6(dataDir2, { recursive: true, mode: DATA_DIR_MODE });
+    mkdirSync5(dataDir2, { recursive: true, mode: DATA_DIR_MODE });
     writeFileSync8(path, sessionId, { mode: DATA_FILE_MODE });
   } catch {
   }
@@ -31510,7 +32072,7 @@ async function main() {
       const text = stringAtPath(effectiveInput, spec.path);
       if (text === void 0 || text === "") continue;
       const result = await runtime.capture(
-        { kind, sourceTool: "claude-code", text, metadata },
+        { kind, sourceTool: SOURCE_TOOL.ClaudeCode, text, metadata },
         // code_change keeps the default 'always': those events are the at-rest
         // trail the re-scan resolver reconciles against, so a benign one still
         // has to exist. tool_use records only what was flagged — this hook sees
@@ -31533,8 +32095,12 @@ async function main() {
     toolName,
     effectiveInput,
     scanned,
-    vaultGlue ? (text, findings) => vaultGlue.tokenizeText(text, {
+    vaultGlue ? (text, findings, reversible) => vaultGlue.tokenizeText(text, {
       findings,
+      // Which of those the assigned archetype said to KEEP. The glue
+      // rewrites every span either way; this decides only which survive
+      // as recoverable pointers and which are destroyed.
+      reversible,
       sighting: filePath ? { location: filePath, kind: "file" } : { location: `${toolName} input`, kind: "tool-input" }
     }) : void 0
   );