@akasecurity/ai-tc-claude-code 0.9.5 → 0.9.7

package/scripts/reconcile.js

@@ -585,6 +585,10 @@ var SQLITE_MIGRATIONS = [
   {
     tag: "0020_secret_vault_pagination_indexes",
     sql: "CREATE INDEX `idx_secret_vault_last_seen` ON `secret_vault` (`last_seen`,`pointer_id`);--> statement-breakpoint\nCREATE INDEX `idx_secret_vault_reuse` ON `secret_vault` (`occurrence_count`,`pointer_id`);--> statement-breakpoint\nCREATE INDEX `idx_secret_vault_deref_at` ON `secret_vault_deref` (`at`,`id`);--> statement-breakpoint\nCREATE INDEX `idx_secret_vault_deref_signal` ON `secret_vault_deref` (`at`,`id`) WHERE `reason` NOT IN ('display', 'view-render');"
+  },
+  {
+    tag: "0021_finding_resolution_resolved_at_index",
+    sql: "CREATE INDEX `idx_finding_resolution_resolved_at` ON `finding_resolution` (`resolved_at`);\n"
   }
 ];
 
@@ -15300,6 +15304,50 @@ function date4(params) {
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
 config(en_default());
 
+// ../../packages/schema/src/zod/harness-map.ts
+var HARNESS = {
+  ClaudeCode: "claudecode",
+  Cursor: "cursor",
+  Copilot: "copilot",
+  Codex: "codex",
+  Antigravity: "antigravity",
+  Windsurf: "windsurf",
+  ClaudeDesktop: "claudedesktop",
+  ChatGpt: "chatgpt",
+  ClaudeAi: "claudeai",
+  Api: "api"
+};
+var Harness = external_exports.enum(HARNESS).meta({ id: "Harness" });
+var SOURCE_TOOL = {
+  ClaudeCode: "claude-code",
+  ClaudeDesktop: "claude-desktop",
+  Cursor: "cursor",
+  ChatGpt: "chatgpt",
+  ClaudeAi: "claude-ai",
+  Copilot: "github-copilot",
+  Codex: "codex",
+  Antigravity: "antigravity",
+  // No harness counterpart, deliberately: the CLI's own captures and a capture
+  // whose tool could not be identified both render through the read side's
+  // miss path rather than as a harness of their own.
+  Cli: "cli",
+  Unknown: "unknown"
+};
+var SourceTool = external_exports.enum(SOURCE_TOOL).meta({ id: "SourceTool" });
+var TOOL_TO_HARNESS = {
+  [SOURCE_TOOL.ClaudeCode]: HARNESS.ClaudeCode,
+  [SOURCE_TOOL.ClaudeDesktop]: HARNESS.ClaudeDesktop,
+  [SOURCE_TOOL.Copilot]: HARNESS.Copilot,
+  [SOURCE_TOOL.Cursor]: HARNESS.Cursor,
+  [SOURCE_TOOL.ChatGpt]: HARNESS.ChatGpt,
+  [SOURCE_TOOL.Codex]: HARNESS.Codex,
+  [SOURCE_TOOL.Antigravity]: HARNESS.Antigravity,
+  [SOURCE_TOOL.ClaudeAi]: HARNESS.ClaudeAi
+};
+function harnessFromTool(tool) {
+  return TOOL_TO_HARNESS[tool] ?? tool;
+}
+
 // ../../packages/schema/src/zod/finding.ts
 var DetectionCategory = external_exports.enum(["pii", "financial", "secret", "phi", "code_context", "code_flaw", "custom", "config"]).meta({ id: "DetectionCategory" });
 var Severity = external_exports.enum(["critical", "high", "medium", "low"]).meta({ id: "Severity" });
@@ -15322,21 +15370,22 @@ var Finding = external_exports.object({
 }).meta({ id: "Finding" });
 var DetectedFinding = Finding.meta({ id: "DetectedFinding" });
 var FindingAction = external_exports.enum(["blocked", "redacted", "warned", "allowed", "quarantined", "monitored"]).meta({ id: "FindingAction" });
-var FindingProvider = external_exports.enum([
-  "claudecode",
-  "claudedesktop",
-  "cursor",
-  "copilot",
-  "chatgpt",
-  "claudeai",
-  "codex",
-  "antigravity",
-  "api"
+var FindingProvider = Harness.extract([
+  "ClaudeCode",
+  "ClaudeDesktop",
+  "Cursor",
+  "Copilot",
+  "ChatGpt",
+  "ClaudeAi",
+  "Codex",
+  "Antigravity",
+  "Api"
 ]).meta({ id: "FindingProvider" });
 var FindingCategory = external_exports.enum([
   "secret",
   "pii",
   "source_code",
+  "code_flaw",
   "external_share",
   "mcp_server",
   "customer_data",
@@ -15516,6 +15565,7 @@ var FindingInstanceDetail = FindingInstance.extend({
   policy: FindingPolicyRef
 }).meta({ id: "FindingInstanceDetail" });
 var DEFAULT_FLAT_FINDINGS_LIMIT = 50;
+var MAX_FLAT_FINDINGS_LIMIT = 200;
 var ListFindingInstancesQuery = external_exports.object({
   severity: external_exports.array(Severity).optional(),
   // Rule ids, the same vocabulary the grouped list's `subtype` carries.
@@ -15535,7 +15585,7 @@ var ListFindingInstancesQuery = external_exports.object({
   q: external_exports.string().optional(),
   sessionId: external_exports.string().optional(),
   from: external_exports.iso.datetime().optional(),
-  limit: external_exports.coerce.number().int().min(1).max(200).optional(),
+  limit: external_exports.coerce.number().int().min(1).max(MAX_FLAT_FINDINGS_LIMIT).optional(),
   cursor: external_exports.string().optional()
 });
 var ListFindingInstancesResponse = external_exports.object({
@@ -15597,33 +15647,6 @@ var ListFindingLocationsResponse = external_exports.object({
   hasMore: external_exports.boolean()
 }).meta({ id: "ListFindingLocationsResponse" });
 
-// ../../packages/schema/src/zod/harness-map.ts
-var Harness = external_exports.enum([
-  "claudecode",
-  "cursor",
-  "copilot",
-  "codex",
-  "antigravity",
-  "windsurf",
-  "claudedesktop",
-  "chatgpt",
-  "claudeai",
-  "api"
-]).meta({ id: "Harness" });
-var TOOL_TO_HARNESS = {
-  "claude-code": "claudecode",
-  "claude-desktop": "claudedesktop",
-  "github-copilot": "copilot",
-  cursor: "cursor",
-  chatgpt: "chatgpt",
-  codex: "codex",
-  antigravity: "antigravity",
-  "claude-ai": "claudeai"
-};
-function harnessFromTool(tool) {
-  return TOOL_TO_HARNESS[tool] ?? tool;
-}
-
 // ../../packages/schema/src/zod/meta.ts
 var InventoryObjectType = external_exports.enum(["host", "harness", "user", "skill", "hook", "mcp_server", "config_file"]).meta({ id: "InventoryObjectType" });
 var AuditEventType = external_exports.enum([
@@ -16076,686 +16099,37 @@ var ActivityOverviewResponse = external_exports.object({
   sessions: ListActivitySessionsResponse
 }).meta({ id: "ActivityOverviewResponse" });
 
-// ../../packages/schema/src/zod/event.ts
-var EventKind = external_exports.enum(["prompt", "response", "code_change", "tool_use"]).meta({ id: "EventKind" });
-var CAPTURE_EVENT_TYPES_SQL = EventKind.options.map((k) => `'${k}'`).join(",");
-var SourceTool = external_exports.enum([
-  "claude-code",
-  "claude-desktop",
-  "cursor",
-  "chatgpt",
-  "claude-ai",
-  "github-copilot",
-  "codex",
-  "antigravity",
-  "cli",
-  "unknown"
-]).meta({ id: "SourceTool" });
-var EventMetadata = external_exports.object({
-  sessionId: external_exports.string().optional(),
-  repo: external_exports.string().optional(),
-  filePath: external_exports.string().optional(),
-  // The host tool whose input/output was scanned (e.g. 'Bash', 'WebFetch'),
-  // set by the tool-scanning hooks. The tool NAME only — never the tool's
-  // arguments or output, which can carry the very value a finding masked
-  // (metadata is stored unredacted). Gives findings on non-file captures a
-  // display location ("via Bash") when no filePath exists.
-  toolName: external_exports.string().optional(),
-  // Set (true) by the worktree scanner when the file is excluded by the
-  // repo's .gitignore. Gitignored files ARE still scanned — local scratch and
-  // generated code can leak real secrets — but the provenance is recorded so
-  // policy/dashboards can treat those findings as informational rather than
-  // blocking. Omitted (not false) for tracked files and non-scan events.
-  gitignored: external_exports.boolean().optional(),
-  // Set (true) ONLY when the event's `content` is the COMPLETE file at
-  // capture time (a worktree scan reading from disk). Hook-captured edits
-  // (e.g. an Edit tool's new_string) are partial fragments and MUST NOT set
-  // this. The resolver-on-ingest keys its fixed-at-source dropout
-  // diff on this marker: only a whole-file snapshot can prove a previously
-  // open finding is gone; a fragment's absence proves nothing (the secret
-  // may live outside the hunk). Omitted (not false) for fragments and
-  // non-scan events, so pre-marker clients safely default to the
-  // non-authoritative path.
-  wholeFile: external_exports.boolean().optional(),
-  model: external_exports.string().optional(),
-  turnIndex: external_exports.number().int().nonnegative().optional(),
-  // Distributed-tracing correlation. `correlationId` ties a recorded event back
-  // to the request that captured/ingested it (a UUID, generated independently of
-  // the trace id); `traceId` is the W3C trace id (32 lowercase hex chars) of the
-  // originating span when telemetry is enabled. Both optional + backward
-  // compatible — populated by the plugin (see @akasecurity/plugin-sdk).
-  correlationId: external_exports.uuid().optional(),
-  traceId: external_exports.string().regex(/^[0-9a-f]{32}$/).optional(),
-  // Ids of the detection exceptions that downgraded findings in this capture
-  // to 'allow' — the enforcement audit trail's link back to the grant that
-  // authorized the bypass. Absent on captures where no exception applied.
-  exceptionIds: external_exports.array(external_exports.guid()).optional()
-}).meta({ id: "EventMetadata" });
-var Event = external_exports.object({
-  id: external_exports.guid(),
-  sourceTool: SourceTool,
-  kind: EventKind,
-  occurredAt: external_exports.iso.datetime(),
-  contentHash: external_exports.string(),
-  content: external_exports.string(),
-  metadata: EventMetadata.optional()
-}).meta({ id: "Event" });
-var IngestEvent = Event.meta({ id: "IngestEvent" });
-var IngestBatch = external_exports.object({
-  events: external_exports.array(IngestEvent).min(1).max(100),
-  // Dedup policy for this batch. Id-dedup ALWAYS applies. 'content-hash'
-  // additionally rejects any event whose contentHash the store has already
-  // recorded — for re-runnable bulk ingest (worktree scan, transcript
-  // backfill), where a re-run mints fresh event ids for identical content and
-  // would otherwise accumulate duplicates. Live hook traffic must NOT set it:
-  // two genuinely separate prompts can be byte-identical and both belong on
-  // the timeline.
-  dedupe: external_exports.literal("content-hash").optional()
-}).meta({ id: "IngestBatch" });
-
-// ../../packages/schema/src/zod/inventory.ts
-var AssetType = external_exports.enum(["project", "skill", "mcp", "hook", "config"]).meta({ id: "AssetType" });
-var AccessLevel = external_exports.enum(["open", "approved", "blocked"]).meta({ id: "AccessLevel" });
-var Origin = external_exports.enum(["source", "public-dep", "vendored", "config", "data", "docs", "generated"]).meta({ id: "Origin" });
-var TrustLevel = external_exports.enum(["known-good", "risky", "unapproved"]).meta({ id: "TrustLevel" });
-var Flag = external_exports.enum(["update", "stale", "conflict", "unknown", "change", "untracked", "risk", "findings"]).meta({ id: "Flag" });
-var Visibility = external_exports.enum(["public", "private"]).meta({ id: "Visibility" });
-var HarnessEventKind = external_exports.enum(["block", "redact", "warn"]).meta({ id: "HarnessEventKind" });
-var HarnessId = external_exports.enum(["claudecode", "cursor", "codex", "antigravity"]).meta({ id: "HarnessId" });
-var AccessCounts = external_exports.object({
-  open: external_exports.number().int().nonnegative(),
-  approved: external_exports.number().int().nonnegative(),
-  blocked: external_exports.number().int().nonnegative(),
-  total: external_exports.number().int().nonnegative()
-}).meta({ id: "AccessCounts" });
-var AssetSummary = external_exports.object({
-  id: external_exports.string(),
-  type: AssetType,
-  name: external_exports.string(),
-  sub: external_exports.string(),
-  flags: external_exports.array(Flag),
-  /** MCP servers only — omitted for all other types. */
-  trust: TrustLevel.optional()
-}).meta({ id: "AssetSummary" });
-var ProjectSummary = external_exports.object({
-  id: external_exports.string(),
-  name: external_exports.string(),
-  repo: external_exports.string(),
-  visibility: Visibility,
-  language: external_exports.string(),
-  policyDefault: AccessLevel,
-  updatedAt: external_exports.iso.datetime(),
-  accessCounts: AccessCounts,
-  findingsCount: external_exports.number().int().nonnegative()
-}).meta({ id: "ProjectSummary" });
-var HarnessCategory = external_exports.object({
-  /** One of config/skill/mcp/hook — never project (enforced at service layer). */
-  type: AssetType,
-  assets: external_exports.array(AssetSummary)
+// ../../packages/schema/src/zod/config-inventory.ts
+var ConfigScope = external_exports.enum(["user", "project", "local", "plugin"]);
+var SkillScanEntry = external_exports.object({
+  name: external_exports.string().min(1),
+  // The identity source: a marketplace repo for plugin skills (e.g.
+  // 'anthropics/skills'), 'local' for personal ~/.claude/skills, or
+  // 'project:<repo-identity>' for checked-in project skills. The surrogate keeps
+  // a personal skill named 'pdf' from colliding with the marketplace 'pdf'.
+  source: external_exports.string().min(1),
+  scope: ConfigScope,
+  pluginName: external_exports.string().optional(),
+  // Volatile — rides the attribute bag, never the identity hash.
+  version: external_exports.string().optional(),
+  description: external_exports.string().optional(),
+  // Skill directory mtime (ISO) — the "updated Nd ago" freshness signal.
+  updatedAt: external_exports.iso.datetime().optional(),
+  // Filesystem path — the promoted inventory `location` column.
+  location: external_exports.string().optional()
 });
-var HarnessSummary = external_exports.object({
-  id: HarnessId,
-  label: external_exports.string(),
-  kind: external_exports.string(),
-  version: external_exports.string(),
-  sessions: external_exports.number().int().nonnegative(),
-  assetCount: external_exports.number().int().nonnegative(),
-  flagCount: external_exports.number().int().nonnegative(),
-  projects: external_exports.array(ProjectSummary),
-  categories: external_exports.array(HarnessCategory)
-}).meta({ id: "HarnessSummary" });
-var ListHarnessesResponse = external_exports.object({ items: external_exports.array(HarnessSummary) }).meta({ id: "ListHarnessesResponse" });
-var AssetGroup = external_exports.object({
-  /** Group key — never project (enforced at service layer). */
-  type: AssetType,
-  total: external_exports.number().int().nonnegative(),
-  /**
-   * MCP group only — omitted for all other types.
-   * Partial: only TrustLevel keys with non-zero counts are included.
-   * Strict: unknown keys are rejected — only TrustLevel values are valid keys.
-   */
-  trustRollup: external_exports.object({
-    "known-good": external_exports.number().int().nonnegative(),
-    risky: external_exports.number().int().nonnegative(),
-    unapproved: external_exports.number().int().nonnegative()
-  }).partial().strict().optional(),
-  /**
-   * Partial: only Flag keys with non-zero counts are included.
-   * Strict: unknown keys are rejected — only Flag values are valid keys.
-   */
-  flagRollup: external_exports.object({
-    update: external_exports.number().int().nonnegative(),
-    stale: external_exports.number().int().nonnegative(),
-    conflict: external_exports.number().int().nonnegative(),
-    unknown: external_exports.number().int().nonnegative(),
-    change: external_exports.number().int().nonnegative(),
-    untracked: external_exports.number().int().nonnegative(),
-    risk: external_exports.number().int().nonnegative(),
-    findings: external_exports.number().int().nonnegative()
-  }).partial().strict(),
-  items: external_exports.array(AssetSummary)
-}).meta({ id: "AssetGroup" });
-var ListAssetsResponse = external_exports.object({ groups: external_exports.array(AssetGroup) }).meta({ id: "ListAssetsResponse" });
-var McpTool = external_exports.object({
-  name: external_exports.string(),
-  signature: external_exports.string(),
-  description: external_exports.string(),
-  write: external_exports.boolean(),
-  /** Non-null string when tool is dangerous / blocked; null otherwise. */
-  risk: external_exports.string().nullable()
-}).meta({ id: "McpTool" });
-var AssetFindingRef = external_exports.object({
-  id: external_exports.string(),
-  title: external_exports.string(),
-  note: external_exports.string()
-});
-var AssetDetail = AssetSummary.extend({
-  /** string | null — null when no description is available. */
-  description: external_exports.string().nullable(),
-  /** trustLevel | null — null for non-MCP assets. */
-  trust: TrustLevel.nullable(),
-  /** Type-specific raw key/values — FE renders the grid. */
-  meta: external_exports.record(external_exports.string(), external_exports.unknown()),
-  /** always present — object when there is an active finding, null when absent. */
-  finding: AssetFindingRef.nullable(),
-  /** MCP exposed-tools list — omitted for non-mcp. */
-  tools: external_exports.array(McpTool).optional()
-}).meta({ id: "AssetDetail" });
-var ListProjectsResponse = external_exports.object({ items: external_exports.array(ProjectSummary) }).meta({ id: "ListProjectsResponse" });
-var InventoryStats = external_exports.object({
-  /** Total assets/projects with ≥1 flag or finding (drives the attention header chip). */
-  attention: external_exports.number().int().nonnegative(),
-  byType: external_exports.object({
-    project: external_exports.number().int().nonnegative(),
-    skill: external_exports.number().int().nonnegative(),
-    mcp: external_exports.number().int().nonnegative(),
-    hook: external_exports.number().int().nonnegative(),
-    config: external_exports.number().int().nonnegative()
-  }),
-  harnesses: external_exports.number().int().nonnegative(),
-  mcpTrust: external_exports.object({
-    "known-good": external_exports.number().int().nonnegative(),
-    risky: external_exports.number().int().nonnegative(),
-    unapproved: external_exports.number().int().nonnegative()
-  })
-}).meta({ id: "InventoryStats" });
-var FileSummary = external_exports.object({
-  path: external_exports.string(),
-  name: external_exports.string(),
-  origin: Origin,
-  /** Effective access (override applied). */
-  access: AccessLevel,
-  /** True when a file_access_override differs from the computed default. */
-  isCustom: external_exports.boolean(),
-  findings: external_exports.number().int().nonnegative(),
-  /** When the file was auto-blocked by a detection; null when not blocked. */
-  blockedAt: external_exports.iso.datetime().nullable().optional(),
-  /** Why the file was blocked; null when absent. */
-  note: external_exports.string().nullable().optional()
-}).meta({ id: "FileSummary" });
-var FolderSummary = external_exports.object({
-  name: external_exports.string(),
-  path: external_exports.string(),
-  /** Rollup of effective access across all descendants. */
-  accessCounts: AccessCounts
-}).meta({ id: "FolderSummary" });
-var ProjectTreeResponse = external_exports.object({
-  project: external_exports.object({
-    id: external_exports.string(),
-    repo: external_exports.string(),
-    visibility: Visibility
-  }),
-  path: external_exports.string(),
-  /** Browse mode: one-level folders at the current path. Omitted in search mode. */
-  folders: external_exports.array(FolderSummary).optional(),
-  files: external_exports.array(FileSummary)
-}).meta({ id: "ProjectTreeResponse" });
-var FileDetail = FileSummary.extend({
-  project: external_exports.object({
-    repo: external_exports.string(),
-    visibility: Visibility,
-    language: external_exports.string(),
-    policyDefault: AccessLevel,
-    updatedAt: external_exports.iso.datetime()
-  }),
-  findingsRefs: external_exports.array(external_exports.object({ id: external_exports.string(), title: external_exports.string() }))
-}).meta({ id: "FileDetail" });
-var SetFileAccessBody = external_exports.object({
-  path: external_exports.string(),
-  access: AccessLevel
-}).meta({ id: "SetFileAccessBody" });
-var SetFileAccessResponse = external_exports.object({
-  file: FileSummary,
-  accessCounts: AccessCounts
-}).meta({ id: "SetFileAccessResponse" });
-var SetMcpTrustBody = external_exports.object({ trust: TrustLevel }).meta({ id: "SetMcpTrustBody" });
-var HarnessEventItem = external_exports.object({
-  kind: HarnessEventKind,
-  title: external_exports.string(),
-  detail: external_exports.string(),
-  occurredAt: external_exports.iso.datetime(),
-  findingId: external_exports.string().nullable().optional()
-}).meta({ id: "HarnessEventItem" });
-var HarnessEventsResponse = external_exports.object({
-  counts: external_exports.object({
-    block: external_exports.number().int().nonnegative(),
-    redact: external_exports.number().int().nonnegative(),
-    warn: external_exports.number().int().nonnegative()
-  }),
-  items: external_exports.array(HarnessEventItem)
-}).meta({ id: "HarnessEventsResponse" });
-var RescanResponse = external_exports.object({
-  jobId: external_exports.string(),
-  startedAt: external_exports.iso.datetime()
-}).meta({ id: "RescanResponse" });
-var ConnectProjectBody = external_exports.object({ repo: external_exports.string() }).meta({ id: "ConnectProjectBody" });
-var ListAssetsQuery = external_exports.object({
-  /** Filter by one or more AssetType values; absent means all types. */
-  type: external_exports.array(AssetType).optional(),
-  /** Free-text search term. */
-  q: external_exports.string().optional()
-});
-var GetProjectTreeQuery = external_exports.object({
-  /** Subtree root path; defaults to repository root when absent. */
-  path: external_exports.string().optional(),
-  /** Free-text filter applied to file paths. */
-  q: external_exports.string().optional(),
-  /**
-   * Special listing mode. `blocked` returns every effectively-blocked, auto-blocked
-   * file across the whole repo (folders omitted, most-recent first), ignoring
-   * `path`/`q` — powers the project-wide "recently blocked" strip.
-   */
-  filter: external_exports.enum(["blocked"]).optional()
-});
-var GetProjectFileQuery = external_exports.object({
-  /** Repository-relative file path; absent or empty → 400. */
-  path: external_exports.string()
-});
-var GetHarnessEventsQuery = external_exports.object({
-  /** Maximum number of events to return.  Range: 1–50; default: 7. */
-  limit: external_exports.coerce.number().int().min(1).max(50).default(7)
-});
-
-// ../../packages/schema/src/zod/exception.ts
-var ExceptionScope = external_exports.enum(["once", "temporary", "permanent"]);
-var ExceptionConditions = external_exports.object({
-  repo: external_exports.string().optional(),
-  sourceTool: external_exports.string().optional(),
-  provider: external_exports.string().optional()
-}).strict();
-var ExceptionCapability = external_exports.enum(["suppress", "reveal_to_model"]);
-var DetectionException = external_exports.object({
-  id: external_exports.guid(),
-  ruleId: external_exports.string(),
-  // Denormalized from the rule, for reporting — never matched on.
-  category: DetectionCategory,
-  // HMAC-SHA256 hex of the raw match under a machine-local key: a KEYED
-  // fingerprint, never the raw value, and never reversible. Matching recomputes
-  // the fingerprint from a fresh capture; the value itself is never stored.
-  // Shape-constrained so a malformed — or accidentally raw — value is rejected
-  // at the boundary rather than persisted.
-  valueFingerprint: external_exports.string().regex(/^[0-9a-f]{64}$/),
-  // Version of the fingerprint key the grant was written under; a rotated key
-  // invalidates old grants rather than silently mismatching them.
-  keyVersion: external_exports.number().int().positive(),
-  // maskMatch() preview of the approved value — never the raw value.
-  maskedValue: external_exports.string(),
-  capability: ExceptionCapability.default("suppress"),
-  scope: ExceptionScope,
-  expiresAt: external_exports.iso.datetime().nullable(),
-  maxUses: external_exports.number().int().positive().nullable(),
-  useCount: external_exports.number().int().nonnegative(),
-  lastUsedAt: external_exports.iso.datetime().nullable(),
-  // Mandatory: every grant carries the human reason it exists.
-  justification: external_exports.string().min(1),
-  conditions: ExceptionConditions.nullable(),
-  createdBy: external_exports.string(),
-  createdVia: external_exports.enum(["cli-approve", "cli-add", "web-approve", "web-add", "api", "setup-triage"]),
-  createdAt: external_exports.iso.datetime(),
-  updatedAt: external_exports.iso.datetime(),
-  // Revocation is terminal and retained — consumed/expired/revoked rows are
-  // audit evidence; nothing in the exception lifecycle hard-deletes.
-  revokedAt: external_exports.iso.datetime().nullable(),
-  revokedBy: external_exports.string().nullable(),
-  revokeReason: external_exports.string().nullable()
-});
-var ExceptionBundleEntry = DetectionException.pick({
-  id: true,
-  ruleId: true,
-  valueFingerprint: true,
-  keyVersion: true,
-  capability: true,
-  expiresAt: true,
-  maxUses: true,
-  useCount: true,
-  conditions: true
-});
-var ExceptionDescriptor = DetectionException.omit({ valueFingerprint: true });
-
-// ../../packages/schema/src/zod/rule.ts
-var MatcherType = external_exports.enum(["keyword", "regex", "validator"]).meta({ id: "MatcherType" });
-var RuleProbeVerdict = external_exports.enum(["safe", "quarantined"]).meta({ id: "RuleProbeVerdict" });
-var KeywordMatcher = external_exports.object({
-  type: external_exports.literal("keyword"),
-  // An empty keyword matches at every position, yielding one zero-length span
-  // per character. Rejected here because a keyword that matches everything is
-  // never intentional.
-  keywords: external_exports.array(external_exports.string().min(1)).min(1),
-  caseSensitive: external_exports.boolean().default(false)
-});
-function isValidRegex(pattern, flags) {
-  try {
-    new RegExp(pattern, flags);
-    return true;
-  } catch {
-    return false;
-  }
-}
-function matchesEmptyString(pattern, flags) {
-  try {
-    const re = new RegExp(pattern, flags.replace(/[gy]/g, ""));
-    return re.exec("")?.[0].length === 0;
-  } catch {
-    return false;
-  }
-}
-var MAX_PATTERN_LENGTH = 2e3;
-var RegexMatcher = external_exports.object({
-  type: external_exports.literal("regex"),
-  pattern: external_exports.string().min(1).max(MAX_PATTERN_LENGTH),
-  flags: external_exports.string().default("gi"),
-  captureGroup: external_exports.number().int().nonnegative().optional()
-}).refine((v) => isValidRegex(v.pattern, v.flags), {
-  message: "pattern/flags do not form a valid JavaScript regular expression",
-  path: ["pattern"]
-}).refine((v) => v.captureGroup !== void 0 || !matchesEmptyString(v.pattern, v.flags), {
-  message: 'a whole-match regex that can match the empty string (e.g. "\\d*", "a?", "(?:)") can hang the matcher \u2014 scope the quantifier to a captureGroup, or require at least one character',
-  path: ["pattern"]
-});
-var ValidatorMatcher = external_exports.object({
-  type: external_exports.literal("validator"),
-  name: external_exports.enum(["luhn", "entropy", "ssn-checksum"]),
-  config: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
-});
-var Matcher = external_exports.discriminatedUnion("type", [KeywordMatcher, RegexMatcher, ValidatorMatcher]).meta({ id: "Matcher" });
-var AppliesTo = external_exports.object({
-  // Dot-prefixed, e.g. ".py" — matches the scanner's SOURCE_EXTENSIONS shape.
-  extensions: external_exports.array(external_exports.string().regex(/^\.[A-Za-z0-9]+$/)).min(1)
-}).meta({ id: "AppliesTo" });
-var PostValidatorRef = external_exports.union([
-  external_exports.string(),
-  external_exports.object({
-    name: external_exports.string(),
-    config: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
-  })
-]).meta({ id: "PostValidatorRef" });
-var RequiresNearby = external_exports.object({
-  // Each array, when present, must be non-empty and contain non-empty strings —
-  // an empty/blank criterion would either never fire or (for labels) match
-  // everything.
-  categories: external_exports.array(DetectionCategory).min(1).optional(),
-  ruleIds: external_exports.array(external_exports.string().min(1)).min(1).optional(),
-  labels: external_exports.array(external_exports.string().min(1)).min(1).optional(),
-  windowChars: external_exports.number().int().positive().default(160),
-  // Optional confidence bump applied when a gated match is corroborated. Capped
-  // small: it nudges confidence, it does not assert certainty.
-  confidenceBoost: external_exports.number().min(0).max(0.3).optional()
-}).refine(
-  (v) => (v.categories?.length ?? 0) + (v.ruleIds?.length ?? 0) + (v.labels?.length ?? 0) > 0,
-  { message: "requiresNearby needs at least one of categories, ruleIds, or labels" }
-).meta({ id: "RequiresNearby" });
-var RuleFixture = external_exports.object({
-  label: external_exports.string(),
-  text: external_exports.string().max(5e4),
-  shouldMatch: external_exports.boolean(),
-  // Simulated file context for the scan, so fixtures can assert `appliesTo`
-  // gating (e.g. a Python-only pattern must NOT fire in a .ts file).
-  filePath: external_exports.string().optional(),
-  expectedSpans: external_exports.array(external_exports.object({ start: external_exports.number(), end: external_exports.number() })).optional()
-}).meta({ id: "RuleFixture" });
-var Rule = external_exports.object({
-  specVersion: external_exports.literal(1),
-  // `packId/ruleName` (e.g. `secrets/aws-access-key`). NOTE the first segment is
-  // the PACK id, NOT a namespace — this is a DIFFERENT slug space from a
-  // detection id (`namespace/packId`, decoded by splitDetectionId). A Rule.id
-  // therefore carries no namespace and is not globally unique across publishers;
-  // never feed one to splitDetectionId. `category` below (per-rule) is the
-  // taxonomy axis; the pack's enforcement policy is installed_packs.policy_id.
-  id: external_exports.string().regex(/^[a-z][a-z0-9-]*\/[a-z][a-z0-9-]*$/),
-  name: external_exports.string(),
-  category: DetectionCategory,
-  severity: Severity,
-  matcher: Matcher,
-  appliesTo: AppliesTo.optional(),
-  postValidators: external_exports.array(PostValidatorRef).optional(),
-  requiresNearby: RequiresNearby.optional(),
-  examples: external_exports.array(external_exports.string()).optional()
-}).meta({ id: "Rule" });
-var Author = external_exports.object({
-  name: external_exports.string(),
-  email: external_exports.email().optional(),
-  url: external_exports.url().optional()
-}).meta({ id: "Author" });
-var PackManifest = external_exports.object({
-  specVersion: external_exports.literal(1),
-  id: external_exports.string(),
-  name: external_exports.string(),
-  version: external_exports.string(),
-  rules: external_exports.array(external_exports.string()),
-  // Optional attribution/provenance — consumed by the rule marketplace.
-  description: external_exports.string().optional(),
-  author: Author.optional(),
-  license: external_exports.string().optional(),
-  sourceUrl: external_exports.url().optional()
-}).meta({ id: "PackManifest" });
-
-// ../../packages/schema/src/zod/policy.ts
-var PolicyScope = external_exports.enum(["global", "repo", "user"]).meta({ id: "PolicyScope" });
-var PolicyTarget = external_exports.union([external_exports.object({ ruleId: external_exports.string() }), external_exports.object({ category: DetectionCategory })]).meta({ id: "PolicyTarget" });
-var Policy = external_exports.object({
-  id: external_exports.guid(),
-  scope: PolicyScope,
-  target: PolicyTarget,
-  action: ActionTaken,
-  enabled: external_exports.boolean().default(true),
-  customKeywords: external_exports.array(external_exports.string()).optional(),
-  // Display name — optional so older policy rows without name still parse.
-  // Added for the findings API (policy.name column migration).
-  name: external_exports.string().optional()
-}).meta({ id: "Policy" });
-var PolicyBundle = external_exports.object({
-  version: external_exports.string(),
-  policies: external_exports.array(Policy),
-  // Rules from the installed marketplace packs (snapshotted by the
-  // control plane). The plugin registers these in addition to its bundled
-  // packs. Optional so older backends — and older on-disk caches — that omit
-  // the field still parse; consumers read `bundle.rules ?? []`.
-  rules: external_exports.array(Rule).optional(),
-  // When true, `rules` IS the complete effective ruleset and the runtime must
-  // NOT merge its compiled-in bundled packs — the standalone gateway sets this
-  // after reading the user's installed snapshot (installed_packs, enabled
-  // packs only), which is how detection updates stay manual: new bundled
-  // rules run only after the user applies the pack update. Absent/false keeps
-  // the historical composition (bundled packs + rules) — older caches.
-  rulesComplete: external_exports.boolean().optional(),
-  // Active detection exceptions, evaluation subset only (see
-  // ExceptionBundleEntry). Optional so older bundle producers — and older
-  // on-disk caches — that omit the field still parse; consumers read
-  // `bundle.exceptions ?? []`.
-  exceptions: external_exports.array(ExceptionBundleEntry).optional(),
-  // Installed pack version, keyed by ruleId, for rules in `rules` that came
-  // from a versioned installed pack. Optional so older backends — and older
-  // on-disk caches — that omit the field still parse; consumers fall back to
-  // the rule's own spec version. NOT the bundle version above — see
-  // installedRuleset's ruleVersions for the source of truth.
-  ruleVersions: external_exports.record(external_exports.string(), external_exports.string()).optional(),
-  customKeywords: external_exports.array(external_exports.string()),
-  fetchedAt: external_exports.iso.datetime()
-}).meta({ id: "PolicyBundle" });
-var OBSERVE_ONLY_CATEGORIES = ["config"];
-var ENFORCEABLE_CATEGORIES = DetectionCategory.options.filter((c) => !OBSERVE_ONLY_CATEGORIES.includes(c));
-var CATEGORY_PEAK_SEVERITY = {
-  secret: "critical",
-  financial: "critical",
-  // core-financial/credit-card
-  code_flaw: "critical",
-  pii: "high",
-  phi: "high",
-  custom: "high",
-  // user-defined; conservative
-  code_context: "low",
-  config: "low"
-  // observe-only; floors to monitor regardless
-};
-function severityFloorPolicy(category) {
-  if (OBSERVE_ONLY_CATEGORIES.includes(category)) return "monitor";
-  const peak = CATEGORY_PEAK_SEVERITY[category];
-  return peak === "critical" || peak === "high" ? "warn" : "monitor";
-}
-var PolicyKind = external_exports.enum(["builtin", "custom"]).meta({ id: "PolicyKind" });
-var KNOWN_BUILTIN_IDS = ["monitor", "warn", "redact", "block"];
-var BuiltinPolicyId = external_exports.enum(KNOWN_BUILTIN_IDS).meta({ id: "BuiltinPolicyId" });
-var BUILTIN_ORDER = KNOWN_BUILTIN_IDS;
-var BUILTIN_POLICY_SPECS = {
-  monitor: {
-    name: "Monitor",
-    action: "log",
-    description: "Log every match for audit. The request is allowed through untouched."
-  },
-  warn: {
-    name: "Warn",
-    action: "warn",
-    description: "Allow the request, but warn the user inline before it is sent."
-  },
-  redact: {
-    name: "Redact",
-    action: "redact",
-    description: "Automatically strip the matched value from the request, then continue."
-  },
-  block: {
-    name: "Block",
-    action: "block",
-    description: "Refuse the request entirely whenever any rule in this detection matches."
-  }
-};
-function builtinPolicyToAction(id) {
-  return BUILTIN_POLICY_SPECS[id].action;
-}
-var DEFAULT_ACTIONS = Object.fromEntries(
-  DetectionCategory.options.map((c) => [c, builtinPolicyToAction(severityFloorPolicy(c))])
-);
-var BUILTIN_POLICIES = Object.fromEntries(
-  KNOWN_BUILTIN_IDS.map((id) => [id, { id, ...BUILTIN_POLICY_SPECS[id] }])
-);
-var DEFAULT_PACK_POLICY_ID = "monitor";
-function policyIdToAction(policyId) {
-  const parsed = BuiltinPolicyId.safeParse(policyId ?? DEFAULT_PACK_POLICY_ID);
-  const id = parsed.success ? parsed.data : DEFAULT_PACK_POLICY_ID;
-  return BUILTIN_POLICIES[id].action;
-}
-var UsedByItem = external_exports.object({
-  id: external_exports.string(),
-  name: external_exports.string(),
-  ruleCount: external_exports.number().int().nonnegative(),
-  enabled: external_exports.boolean()
-}).meta({ id: "UsedByItem" });
-var PolicyListItem = external_exports.object({
-  id: external_exports.string(),
-  kind: PolicyKind,
-  name: external_exports.string(),
-  enabled: external_exports.boolean(),
-  usedByCount: external_exports.number().int().nonnegative()
-}).meta({ id: "PolicyListItem" });
-var PolicyDetail = external_exports.object({
-  specVersion: external_exports.literal(1),
-  id: external_exports.string(),
-  kind: PolicyKind,
-  name: external_exports.string(),
-  enabled: external_exports.boolean(),
-  description: external_exports.string(),
-  usedBy: external_exports.array(UsedByItem)
-}).meta({ id: "PolicyDetail" });
-var PolicyStatsResponse = external_exports.object({
-  policies: external_exports.number().int().nonnegative(),
-  builtin: external_exports.number().int().nonnegative(),
-  custom: external_exports.number().int().nonnegative(),
-  detectionsGoverned: external_exports.number().int().nonnegative()
-}).meta({ id: "PolicyStatsResponse" });
-
-// ../../packages/schema/src/zod/api.ts
-var LIST_QUERY_MAX_LIMIT = 200;
-var ListEventsQuery = external_exports.object({
-  cursor: external_exports.string().optional(),
-  limit: external_exports.coerce.number().int().min(1).max(LIST_QUERY_MAX_LIMIT).default(50),
-  sourceTool: external_exports.string().optional(),
-  kind: external_exports.string().optional(),
-  from: external_exports.iso.datetime().optional(),
-  to: external_exports.iso.datetime().optional()
-});
-var ListEventsResponse = external_exports.object({
-  items: external_exports.array(Event),
-  nextCursor: external_exports.string().nullable()
-}).meta({ id: "ListEventsResponse" });
-var IngestResponse = external_exports.object({
-  accepted: external_exports.number().int().nonnegative(),
-  duplicates: external_exports.number().int().nonnegative()
-}).meta({ id: "IngestResponse" });
-var ListFindingsQuery = external_exports.object({
-  cursor: external_exports.string().optional(),
-  limit: external_exports.coerce.number().int().min(1).max(LIST_QUERY_MAX_LIMIT).default(50),
-  severity: external_exports.string().optional(),
-  category: external_exports.string().optional(),
-  eventId: external_exports.guid().optional()
-});
-var ListFindingsResponse = external_exports.object({
-  items: external_exports.array(Finding),
-  nextCursor: external_exports.string().nullable()
-}).meta({ id: "ListFindingsResponse" });
-var ListPoliciesResponse = external_exports.object({ items: external_exports.array(PolicyListItem) }).meta({ id: "ListPoliciesResponse" });
-var CreatePolicyRequest = Policy.omit({ id: true }).meta({
-  id: "CreatePolicyRequest"
-});
-var UpdatePolicyRequest = Policy.partial().required({ id: true }).meta({ id: "UpdatePolicyRequest" });
-var RecordAuditEventResponse = external_exports.object({ accepted: external_exports.boolean() }).meta({ id: "RecordAuditEventResponse" });
-var ErrorResponse = external_exports.object({
-  error: external_exports.object({
-    code: external_exports.string(),
-    message: external_exports.string(),
-    details: external_exports.unknown().optional()
-  })
-}).meta({ id: "ErrorResponse" });
-
-// ../../packages/schema/src/zod/config-inventory.ts
-var ConfigScope = external_exports.enum(["user", "project", "local", "plugin"]);
-var SkillScanEntry = external_exports.object({
-  name: external_exports.string().min(1),
-  // The identity source: a marketplace repo for plugin skills (e.g.
-  // 'anthropics/skills'), 'local' for personal ~/.claude/skills, or
-  // 'project:<repo-identity>' for checked-in project skills. The surrogate keeps
-  // a personal skill named 'pdf' from colliding with the marketplace 'pdf'.
-  source: external_exports.string().min(1),
-  scope: ConfigScope,
-  pluginName: external_exports.string().optional(),
-  // Volatile — rides the attribute bag, never the identity hash.
-  version: external_exports.string().optional(),
-  description: external_exports.string().optional(),
-  // Skill directory mtime (ISO) — the "updated Nd ago" freshness signal.
-  updatedAt: external_exports.iso.datetime().optional(),
-  // Filesystem path — the promoted inventory `location` column.
-  location: external_exports.string().optional()
-});
-var HookScanEntry = external_exports.object({
-  // Hook event name (PreToolUse, PostToolUse, …). Open string, not an enum: the
-  // set is harness-defined and grows without a schema change.
-  event: external_exports.string().min(1),
-  // The tool matcher ('Bash', 'Edit|Write', …). Absent = matches all tools.
-  matcher: external_exports.string().optional(),
-  command: external_exports.string().min(1),
-  timeout: external_exports.number().optional(),
-  scope: ConfigScope,
-  pluginName: external_exports.string().optional(),
-  // The settings file / hooks.json the entry came from.
-  location: external_exports.string().optional()
+var HookScanEntry = external_exports.object({
+  // Hook event name (PreToolUse, PostToolUse, …). Open string, not an enum: the
+  // set is harness-defined and grows without a schema change.
+  event: external_exports.string().min(1),
+  // The tool matcher ('Bash', 'Edit|Write', …). Absent = matches all tools.
+  matcher: external_exports.string().optional(),
+  command: external_exports.string().min(1),
+  timeout: external_exports.number().optional(),
+  scope: ConfigScope,
+  pluginName: external_exports.string().optional(),
+  // The settings file / hooks.json the entry came from.
+  location: external_exports.string().optional()
 });
 var McpServerScanEntry = external_exports.object({
   // The server's config key ("github", "filesystem", …) — identity, with the
@@ -16830,12 +16204,170 @@ var ConfigScanRecord = external_exports.object({
   definitions: external_exports.array(InspectionDefinitionInput).optional(),
   findings: external_exports.array(ConfigPostureFindingInput).optional()
 });
-
-// ../../packages/schema/src/zod/registry.ts
-var Namespace = external_exports.string().regex(/^[a-z][a-z0-9-]*$/);
-var PackId = external_exports.string().regex(/^[a-z][a-z0-9-]*$/);
-var SemVer = external_exports.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-.]+)?$/);
-var PublisherKind = external_exports.enum(["labs", "user", "org"]);
+
+// ../../packages/schema/src/zod/registry.ts
+var Namespace = external_exports.string().regex(/^[a-z][a-z0-9-]*$/);
+var PackId = external_exports.string().regex(/^[a-z][a-z0-9-]*$/);
+var SemVer = external_exports.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-.]+)?$/);
+var PublisherKind = external_exports.enum(["labs", "user", "org"]);
+
+// ../../packages/schema/src/zod/rule.ts
+var MatcherType = external_exports.enum(["keyword", "regex"]).meta({ id: "MatcherType" });
+var RuleProbeVerdict = external_exports.enum(["safe", "quarantined"]).meta({ id: "RuleProbeVerdict" });
+var KeywordMatcher = external_exports.strictObject({
+  type: external_exports.literal("keyword"),
+  // An empty keyword matches at every position, yielding one zero-length span
+  // per character. Rejected here because a keyword that matches everything is
+  // never intentional.
+  keywords: external_exports.array(external_exports.string().min(1)).min(1),
+  caseSensitive: external_exports.boolean().default(false)
+});
+function isValidRegex(pattern, flags) {
+  try {
+    new RegExp(pattern, flags);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function probeFlags(flags) {
+  return flags.replace(/[gy]/g, "");
+}
+function matchesEmptyString(pattern, flags) {
+  try {
+    const re = new RegExp(pattern, probeFlags(flags));
+    return re.exec("")?.[0].length === 0;
+  } catch {
+    return false;
+  }
+}
+function spansWholeMatch(captureGroup) {
+  return captureGroup === void 0 || captureGroup === 0;
+}
+function captureGroupCount(pattern, flags) {
+  try {
+    const probe = new RegExp(`${pattern}|`, probeFlags(flags));
+    const result = probe.exec("");
+    return result ? result.length - 1 : void 0;
+  } catch {
+    return void 0;
+  }
+}
+var MAX_PATTERN_LENGTH = 2e3;
+var RegexMatcher = external_exports.strictObject({
+  type: external_exports.literal("regex"),
+  pattern: external_exports.string().min(1).max(MAX_PATTERN_LENGTH),
+  flags: external_exports.string().default("gi"),
+  captureGroup: external_exports.number().int().nonnegative().optional()
+}).refine((v) => isValidRegex(v.pattern, v.flags), {
+  message: "pattern/flags do not form a valid JavaScript regular expression",
+  path: ["pattern"]
+}).refine((v) => !spansWholeMatch(v.captureGroup) || !matchesEmptyString(v.pattern, v.flags), {
+  message: 'a whole-match regex that can match the empty string (e.g. "\\d*", "a?", "(?:)") can hang the matcher \u2014 scope the quantifier to a captureGroup, or require at least one character',
+  path: ["pattern"]
+}).superRefine((v, ctx) => {
+  if (v.captureGroup === void 0) return;
+  const groups = captureGroupCount(v.pattern, v.flags);
+  if (groups === void 0 || v.captureGroup <= groups) return;
+  ctx.addIssue({
+    code: "custom",
+    path: ["captureGroup"],
+    message: `captureGroup ${String(v.captureGroup)} is out of range \u2014 the pattern declares ${String(groups)} capture group(s), so valid values are 0-${String(groups)}. An out-of-range group never matches, which would make the rule silently never fire.`
+  });
+});
+var Matcher = external_exports.discriminatedUnion("type", [KeywordMatcher, RegexMatcher]).meta({ id: "Matcher" });
+var MATCHER_TYPES = MatcherType.options;
+var AppliesTo = external_exports.strictObject({
+  // Dot-prefixed, e.g. ".py" — matches the scanner's SOURCE_EXTENSIONS shape.
+  extensions: external_exports.array(external_exports.string().regex(/^\.[A-Za-z0-9]+$/)).min(1)
+}).meta({ id: "AppliesTo" });
+var PostValidatorName = external_exports.enum(["entropy", "luhn"]).meta({ id: "PostValidatorName" });
+var PostValidatorRef = external_exports.union(
+  [
+    PostValidatorName,
+    external_exports.strictObject({
+      name: PostValidatorName,
+      config: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
+    })
+  ],
+  {
+    // A union reports one collapsed issue for every way its arms can fail, so
+    // this has to describe the whole shape rather than just the name — it is
+    // what an author sees for a misspelled name AND for a stray key in the
+    // object form. The names come from the enum so the message cannot go
+    // stale. Without it Zod says only "Invalid input", which is precisely the
+    // no-feedback outcome this schema exists to remove.
+    error: () => `not a valid post-validator: use a bare name (${PostValidatorName.options.map((name) => JSON.stringify(name)).join(
+      " or "
+    )}) or { "name": ..., "config": { ... } }. An unrecognized name would be a false-positive guard that never runs.`
+  }
+).meta({ id: "PostValidatorRef" });
+var RequiresNearby = external_exports.strictObject({
+  // Each array, when present, must be non-empty and contain non-empty strings —
+  // an empty/blank criterion would either never fire or (for labels) match
+  // everything.
+  categories: external_exports.array(DetectionCategory).min(1).optional(),
+  ruleIds: external_exports.array(external_exports.string().min(1)).min(1).optional(),
+  labels: external_exports.array(external_exports.string().min(1)).min(1).optional(),
+  windowChars: external_exports.number().int().positive().default(160),
+  // Optional confidence bump applied when a gated match is corroborated. Capped
+  // small: it nudges confidence, it does not assert certainty.
+  confidenceBoost: external_exports.number().min(0).max(0.3).optional()
+}).refine(
+  (v) => (v.categories?.length ?? 0) + (v.ruleIds?.length ?? 0) + (v.labels?.length ?? 0) > 0,
+  { message: "requiresNearby needs at least one of categories, ruleIds, or labels" }
+).meta({ id: "RequiresNearby" });
+var RuleFixture = external_exports.strictObject({
+  label: external_exports.string(),
+  text: external_exports.string().max(5e4),
+  shouldMatch: external_exports.boolean(),
+  // Simulated file context for the scan, so fixtures can assert `appliesTo`
+  // gating (e.g. a Python-only pattern must NOT fire in a .ts file).
+  filePath: external_exports.string().optional(),
+  expectedSpans: external_exports.array(external_exports.strictObject({ start: external_exports.number(), end: external_exports.number() })).optional()
+}).meta({ id: "RuleFixture" });
+var Rule = external_exports.strictObject({
+  // A pinned literal over a STRICT object, and the two together decide how this
+  // format may grow. A rule carrying a key not listed below is refused with
+  // `unrecognized_keys`; a rule declaring `specVersion: 2` is refused with
+  // `invalid_value`. So the only additive path is adding an OPTIONAL field here
+  // — that keeps every rule authored before it valid — and a rule author has no
+  // way to introduce a field of their own or to opt into a later version.
+  // Widening the format means changing this literal and every consumer of it.
+  specVersion: external_exports.literal(1),
+  // `packId/ruleName` (e.g. `secrets/aws-access-key`). NOTE the first segment is
+  // the PACK id, NOT a namespace — this is a DIFFERENT slug space from a
+  // detection id (`namespace/packId`, decoded by splitDetectionId). A Rule.id
+  // therefore carries no namespace and is not globally unique across publishers;
+  // never feed one to splitDetectionId. `category` below (per-rule) is the
+  // taxonomy axis; the pack's enforcement policy is installed_packs.policy_id.
+  id: external_exports.string().regex(/^[a-z][a-z0-9-]*\/[a-z][a-z0-9-]*$/),
+  name: external_exports.string(),
+  category: DetectionCategory,
+  severity: Severity,
+  matcher: Matcher,
+  appliesTo: AppliesTo.optional(),
+  postValidators: external_exports.array(PostValidatorRef).optional(),
+  requiresNearby: RequiresNearby.optional(),
+  examples: external_exports.array(external_exports.string()).optional()
+}).meta({ id: "Rule" });
+var Author = external_exports.object({
+  name: external_exports.string(),
+  email: external_exports.email().optional(),
+  url: external_exports.url().optional()
+}).meta({ id: "Author" });
+var PackManifest = external_exports.object({
+  specVersion: external_exports.literal(1),
+  id: external_exports.string(),
+  name: external_exports.string(),
+  version: external_exports.string(),
+  rules: external_exports.array(external_exports.string()),
+  // Optional attribution/provenance — consumed by the rule marketplace.
+  description: external_exports.string().optional(),
+  author: Author.optional(),
+  license: external_exports.string().optional(),
+  sourceUrl: external_exports.url().optional()
+}).meta({ id: "PackManifest" });
 
 // ../../packages/schema/src/zod/detection.ts
 var OriginEnum = external_exports.enum(["library"]).meta({ id: "OriginEnum" });
@@ -17035,6 +16567,231 @@ function buildDetectionsList(summaries, query) {
   return { counts, items: filtered.map(summaryToDetectionListItem) };
 }
 
+// ../../packages/schema/src/zod/inventory.ts
+var AssetType = external_exports.enum(["project", "skill", "mcp", "hook", "config"]).meta({ id: "AssetType" });
+var AccessLevel = external_exports.enum(["open", "approved", "blocked"]).meta({ id: "AccessLevel" });
+var Origin = external_exports.enum(["source", "public-dep", "vendored", "config", "data", "docs", "generated"]).meta({ id: "Origin" });
+var TrustLevel = external_exports.enum(["known-good", "risky", "unapproved"]).meta({ id: "TrustLevel" });
+var Flag = external_exports.enum(["update", "stale", "conflict", "unknown", "change", "untracked", "risk", "findings"]).meta({ id: "Flag" });
+var Visibility = external_exports.enum(["public", "private"]).meta({ id: "Visibility" });
+var HarnessEventKind = external_exports.enum(["block", "redact", "warn"]).meta({ id: "HarnessEventKind" });
+var HarnessId = Harness.extract(["ClaudeCode", "Cursor", "Codex", "Antigravity"]).meta({
+  id: "HarnessId"
+});
+var AccessCounts = external_exports.object({
+  open: external_exports.number().int().nonnegative(),
+  approved: external_exports.number().int().nonnegative(),
+  blocked: external_exports.number().int().nonnegative(),
+  total: external_exports.number().int().nonnegative()
+}).meta({ id: "AccessCounts" });
+var AssetSummary = external_exports.object({
+  id: external_exports.string(),
+  type: AssetType,
+  name: external_exports.string(),
+  sub: external_exports.string(),
+  flags: external_exports.array(Flag),
+  /** MCP servers only — omitted for all other types. */
+  trust: TrustLevel.optional()
+}).meta({ id: "AssetSummary" });
+var ProjectSummary = external_exports.object({
+  id: external_exports.string(),
+  name: external_exports.string(),
+  repo: external_exports.string(),
+  visibility: Visibility,
+  language: external_exports.string(),
+  policyDefault: AccessLevel,
+  updatedAt: external_exports.iso.datetime(),
+  accessCounts: AccessCounts,
+  findingsCount: external_exports.number().int().nonnegative()
+}).meta({ id: "ProjectSummary" });
+var HarnessCategory = external_exports.object({
+  /** One of config/skill/mcp/hook — never project (enforced at service layer). */
+  type: AssetType,
+  assets: external_exports.array(AssetSummary)
+});
+var HarnessSummary = external_exports.object({
+  id: HarnessId,
+  label: external_exports.string(),
+  kind: external_exports.string(),
+  version: external_exports.string(),
+  sessions: external_exports.number().int().nonnegative(),
+  assetCount: external_exports.number().int().nonnegative(),
+  flagCount: external_exports.number().int().nonnegative(),
+  projects: external_exports.array(ProjectSummary),
+  categories: external_exports.array(HarnessCategory)
+}).meta({ id: "HarnessSummary" });
+var ListHarnessesResponse = external_exports.object({ items: external_exports.array(HarnessSummary) }).meta({ id: "ListHarnessesResponse" });
+var AssetGroup = external_exports.object({
+  /** Group key — never project (enforced at service layer). */
+  type: AssetType,
+  total: external_exports.number().int().nonnegative(),
+  /**
+   * MCP group only — omitted for all other types.
+   * Partial: only TrustLevel keys with non-zero counts are included.
+   * Strict: unknown keys are rejected — only TrustLevel values are valid keys.
+   */
+  trustRollup: external_exports.object({
+    "known-good": external_exports.number().int().nonnegative(),
+    risky: external_exports.number().int().nonnegative(),
+    unapproved: external_exports.number().int().nonnegative()
+  }).partial().strict().optional(),
+  /**
+   * Partial: only Flag keys with non-zero counts are included.
+   * Strict: unknown keys are rejected — only Flag values are valid keys.
+   */
+  flagRollup: external_exports.object({
+    update: external_exports.number().int().nonnegative(),
+    stale: external_exports.number().int().nonnegative(),
+    conflict: external_exports.number().int().nonnegative(),
+    unknown: external_exports.number().int().nonnegative(),
+    change: external_exports.number().int().nonnegative(),
+    untracked: external_exports.number().int().nonnegative(),
+    risk: external_exports.number().int().nonnegative(),
+    findings: external_exports.number().int().nonnegative()
+  }).partial().strict(),
+  items: external_exports.array(AssetSummary)
+}).meta({ id: "AssetGroup" });
+var ListAssetsResponse = external_exports.object({ groups: external_exports.array(AssetGroup) }).meta({ id: "ListAssetsResponse" });
+var McpTool = external_exports.object({
+  name: external_exports.string(),
+  signature: external_exports.string(),
+  description: external_exports.string(),
+  write: external_exports.boolean(),
+  /** Non-null string when tool is dangerous / blocked; null otherwise. */
+  risk: external_exports.string().nullable()
+}).meta({ id: "McpTool" });
+var AssetFindingRef = external_exports.object({
+  id: external_exports.string(),
+  title: external_exports.string(),
+  note: external_exports.string()
+});
+var AssetDetail = AssetSummary.extend({
+  /** string | null — null when no description is available. */
+  description: external_exports.string().nullable(),
+  /** trustLevel | null — null for non-MCP assets. */
+  trust: TrustLevel.nullable(),
+  /** Type-specific raw key/values — FE renders the grid. */
+  meta: external_exports.record(external_exports.string(), external_exports.unknown()),
+  /** always present — object when there is an active finding, null when absent. */
+  finding: AssetFindingRef.nullable(),
+  /** MCP exposed-tools list — omitted for non-mcp. */
+  tools: external_exports.array(McpTool).optional()
+}).meta({ id: "AssetDetail" });
+var ListProjectsResponse = external_exports.object({ items: external_exports.array(ProjectSummary) }).meta({ id: "ListProjectsResponse" });
+var InventoryStats = external_exports.object({
+  /** Total assets/projects with ≥1 flag or finding (drives the attention header chip). */
+  attention: external_exports.number().int().nonnegative(),
+  byType: external_exports.object({
+    project: external_exports.number().int().nonnegative(),
+    skill: external_exports.number().int().nonnegative(),
+    mcp: external_exports.number().int().nonnegative(),
+    hook: external_exports.number().int().nonnegative(),
+    config: external_exports.number().int().nonnegative()
+  }),
+  harnesses: external_exports.number().int().nonnegative(),
+  mcpTrust: external_exports.object({
+    "known-good": external_exports.number().int().nonnegative(),
+    risky: external_exports.number().int().nonnegative(),
+    unapproved: external_exports.number().int().nonnegative()
+  })
+}).meta({ id: "InventoryStats" });
+var FileSummary = external_exports.object({
+  path: external_exports.string(),
+  name: external_exports.string(),
+  origin: Origin,
+  /** Effective access (override applied). */
+  access: AccessLevel,
+  /** True when a file_access_override differs from the computed default. */
+  isCustom: external_exports.boolean(),
+  findings: external_exports.number().int().nonnegative(),
+  /** When the file was auto-blocked by a detection; null when not blocked. */
+  blockedAt: external_exports.iso.datetime().nullable().optional(),
+  /** Why the file was blocked; null when absent. */
+  note: external_exports.string().nullable().optional()
+}).meta({ id: "FileSummary" });
+var FolderSummary = external_exports.object({
+  name: external_exports.string(),
+  path: external_exports.string(),
+  /** Rollup of effective access across all descendants. */
+  accessCounts: AccessCounts
+}).meta({ id: "FolderSummary" });
+var ProjectTreeResponse = external_exports.object({
+  project: external_exports.object({
+    id: external_exports.string(),
+    repo: external_exports.string(),
+    visibility: Visibility
+  }),
+  path: external_exports.string(),
+  /** Browse mode: one-level folders at the current path. Omitted in search mode. */
+  folders: external_exports.array(FolderSummary).optional(),
+  files: external_exports.array(FileSummary)
+}).meta({ id: "ProjectTreeResponse" });
+var FileDetail = FileSummary.extend({
+  project: external_exports.object({
+    repo: external_exports.string(),
+    visibility: Visibility,
+    language: external_exports.string(),
+    policyDefault: AccessLevel,
+    updatedAt: external_exports.iso.datetime()
+  }),
+  findingsRefs: external_exports.array(external_exports.object({ id: external_exports.string(), title: external_exports.string() }))
+}).meta({ id: "FileDetail" });
+var SetFileAccessBody = external_exports.object({
+  path: external_exports.string(),
+  access: AccessLevel
+}).meta({ id: "SetFileAccessBody" });
+var SetFileAccessResponse = external_exports.object({
+  file: FileSummary,
+  accessCounts: AccessCounts
+}).meta({ id: "SetFileAccessResponse" });
+var SetMcpTrustBody = external_exports.object({ trust: TrustLevel }).meta({ id: "SetMcpTrustBody" });
+var HarnessEventItem = external_exports.object({
+  kind: HarnessEventKind,
+  title: external_exports.string(),
+  detail: external_exports.string(),
+  occurredAt: external_exports.iso.datetime(),
+  findingId: external_exports.string().nullable().optional()
+}).meta({ id: "HarnessEventItem" });
+var HarnessEventsResponse = external_exports.object({
+  counts: external_exports.object({
+    block: external_exports.number().int().nonnegative(),
+    redact: external_exports.number().int().nonnegative(),
+    warn: external_exports.number().int().nonnegative()
+  }),
+  items: external_exports.array(HarnessEventItem)
+}).meta({ id: "HarnessEventsResponse" });
+var RescanResponse = external_exports.object({
+  jobId: external_exports.string(),
+  startedAt: external_exports.iso.datetime()
+}).meta({ id: "RescanResponse" });
+var ConnectProjectBody = external_exports.object({ repo: external_exports.string() }).meta({ id: "ConnectProjectBody" });
+var ListAssetsQuery = external_exports.object({
+  /** Filter by one or more AssetType values; absent means all types. */
+  type: external_exports.array(AssetType).optional(),
+  /** Free-text search term. */
+  q: external_exports.string().optional()
+});
+var GetProjectTreeQuery = external_exports.object({
+  /** Subtree root path; defaults to repository root when absent. */
+  path: external_exports.string().optional(),
+  /** Free-text filter applied to file paths. */
+  q: external_exports.string().optional(),
+  /**
+   * Special listing mode. `blocked` returns every effectively-blocked, auto-blocked
+   * file across the whole repo (folders omitted, most-recent first), ignoring
+   * `path`/`q` — powers the project-wide "recently blocked" strip.
+   */
+  filter: external_exports.enum(["blocked"]).optional()
+});
+var GetProjectFileQuery = external_exports.object({
+  /** Repository-relative file path; absent or empty → 400. */
+  path: external_exports.string()
+});
+var GetHarnessEventsQuery = external_exports.object({
+  /** Maximum number of events to return.  Range: 1–50; default: 7. */
+  limit: external_exports.coerce.number().int().min(1).max(50).default(7)
+});
+
 // ../../packages/schema/src/zod/shares.ts
 var DestinationKind = external_exports.enum(["provider", "internal", "external", "ip"]).meta({ id: "DestinationKind" });
 var Transport = external_exports.enum(["https", "http", "sftp", "grpc", "smtp", "ws", "wss"]).meta({ id: "Transport" });
@@ -17241,6 +16998,127 @@ var EgressWriteSummary = external_exports.object({
   droppedFiles: external_exports.array(external_exports.string()).default([])
 }).meta({ id: "EgressWriteSummary" });
 
+// ../../packages/schema/src/zod/event.ts
+var EventKind = external_exports.enum(["prompt", "response", "code_change", "tool_use"]).meta({ id: "EventKind" });
+var CAPTURE_EVENT_TYPES_SQL = EventKind.options.map((k) => `'${k}'`).join(",");
+var EventMetadata = external_exports.object({
+  sessionId: external_exports.string().optional(),
+  repo: external_exports.string().optional(),
+  filePath: external_exports.string().optional(),
+  // The host tool whose input/output was scanned (e.g. 'Bash', 'WebFetch'),
+  // set by the tool-scanning hooks. The tool NAME only — never the tool's
+  // arguments or output, which can carry the very value a finding masked
+  // (metadata is stored unredacted). Gives findings on non-file captures a
+  // display location ("via Bash") when no filePath exists.
+  toolName: external_exports.string().optional(),
+  // Set (true) by the worktree scanner when the file is excluded by the
+  // repo's .gitignore. Gitignored files ARE still scanned — local scratch and
+  // generated code can leak real secrets — but the provenance is recorded so
+  // policy/dashboards can treat those findings as informational rather than
+  // blocking. Omitted (not false) for tracked files and non-scan events.
+  gitignored: external_exports.boolean().optional(),
+  // Set (true) ONLY when the event's `content` is the COMPLETE file at
+  // capture time (a worktree scan reading from disk). Hook-captured edits
+  // (e.g. an Edit tool's new_string) are partial fragments and MUST NOT set
+  // this. The resolver-on-ingest keys its fixed-at-source dropout
+  // diff on this marker: only a whole-file snapshot can prove a previously
+  // open finding is gone; a fragment's absence proves nothing (the secret
+  // may live outside the hunk). Omitted (not false) for fragments and
+  // non-scan events, so pre-marker clients safely default to the
+  // non-authoritative path.
+  wholeFile: external_exports.boolean().optional(),
+  model: external_exports.string().optional(),
+  turnIndex: external_exports.number().int().nonnegative().optional(),
+  // Distributed-tracing correlation. `correlationId` ties a recorded event back
+  // to the request that captured/ingested it (a UUID, generated independently of
+  // the trace id); `traceId` is the W3C trace id (32 lowercase hex chars) of the
+  // originating span when telemetry is enabled. Both optional + backward
+  // compatible — populated by the plugin (see @akasecurity/plugin-sdk).
+  correlationId: external_exports.uuid().optional(),
+  traceId: external_exports.string().regex(/^[0-9a-f]{32}$/).optional(),
+  // Ids of the detection exceptions that downgraded findings in this capture
+  // to 'allow' — the enforcement audit trail's link back to the grant that
+  // authorized the bypass. Absent on captures where no exception applied.
+  exceptionIds: external_exports.array(external_exports.guid()).optional()
+}).meta({ id: "EventMetadata" });
+var Event = external_exports.object({
+  id: external_exports.guid(),
+  sourceTool: SourceTool,
+  kind: EventKind,
+  occurredAt: external_exports.iso.datetime(),
+  contentHash: external_exports.string(),
+  content: external_exports.string(),
+  metadata: EventMetadata.optional()
+}).meta({ id: "Event" });
+var IngestEvent = Event.meta({ id: "IngestEvent" });
+var IngestBatch = external_exports.object({
+  events: external_exports.array(IngestEvent).min(1).max(100),
+  // Dedup policy for this batch. Id-dedup ALWAYS applies. 'content-hash'
+  // additionally rejects any event whose contentHash the store has already
+  // recorded — for re-runnable bulk ingest (worktree scan, transcript
+  // backfill), where a re-run mints fresh event ids for identical content and
+  // would otherwise accumulate duplicates. Live hook traffic must NOT set it:
+  // two genuinely separate prompts can be byte-identical and both belong on
+  // the timeline.
+  dedupe: external_exports.literal("content-hash").optional()
+}).meta({ id: "IngestBatch" });
+
+// ../../packages/schema/src/zod/exception.ts
+var ExceptionScope = external_exports.enum(["once", "temporary", "permanent"]);
+var ExceptionConditions = external_exports.object({
+  repo: external_exports.string().optional(),
+  sourceTool: external_exports.string().optional(),
+  provider: external_exports.string().optional()
+}).strict();
+var ExceptionCapability = external_exports.enum(["suppress", "reveal_to_model"]);
+var DetectionException = external_exports.object({
+  id: external_exports.guid(),
+  ruleId: external_exports.string(),
+  // Denormalized from the rule, for reporting — never matched on.
+  category: DetectionCategory,
+  // HMAC-SHA256 hex of the raw match under a machine-local key: a KEYED
+  // fingerprint, never the raw value, and never reversible. Matching recomputes
+  // the fingerprint from a fresh capture; the value itself is never stored.
+  // Shape-constrained so a malformed — or accidentally raw — value is rejected
+  // at the boundary rather than persisted.
+  valueFingerprint: external_exports.string().regex(/^[0-9a-f]{64}$/),
+  // Version of the fingerprint key the grant was written under; a rotated key
+  // invalidates old grants rather than silently mismatching them.
+  keyVersion: external_exports.number().int().positive(),
+  // maskMatch() preview of the approved value — never the raw value.
+  maskedValue: external_exports.string(),
+  capability: ExceptionCapability.default("suppress"),
+  scope: ExceptionScope,
+  expiresAt: external_exports.iso.datetime().nullable(),
+  maxUses: external_exports.number().int().positive().nullable(),
+  useCount: external_exports.number().int().nonnegative(),
+  lastUsedAt: external_exports.iso.datetime().nullable(),
+  // Mandatory: every grant carries the human reason it exists.
+  justification: external_exports.string().min(1),
+  conditions: ExceptionConditions.nullable(),
+  createdBy: external_exports.string(),
+  createdVia: external_exports.enum(["cli-approve", "cli-add", "web-approve", "web-add", "api", "setup-triage"]),
+  createdAt: external_exports.iso.datetime(),
+  updatedAt: external_exports.iso.datetime(),
+  // Revocation is terminal and retained — consumed/expired/revoked rows are
+  // audit evidence; nothing in the exception lifecycle hard-deletes.
+  revokedAt: external_exports.iso.datetime().nullable(),
+  revokedBy: external_exports.string().nullable(),
+  revokeReason: external_exports.string().nullable()
+});
+var ExceptionBundleEntry = DetectionException.pick({
+  id: true,
+  ruleId: true,
+  valueFingerprint: true,
+  keyVersion: true,
+  capability: true,
+  expiresAt: true,
+  maxUses: true,
+  useCount: true,
+  conditions: true
+});
+var ExceptionDescriptor = DetectionException.omit({ valueFingerprint: true });
+
 // ../../packages/schema/src/zod/exception-action.ts
 var confirmation = external_exports.string().optional();
 var ApproveBlockedInput = external_exports.object({
@@ -17283,10 +17161,11 @@ function toApiAction(dbVal) {
 }
 function toApiCategory(dbVal) {
   if (dbVal === "code_context") return "source_code";
-  return dbVal;
+  const parsed = FindingCategory.safeParse(dbVal);
+  return parsed.success ? parsed.data : "custom";
 }
 function toApiProvider(sourceTool) {
-  return TOOL_TO_HARNESS[sourceTool] ?? "api";
+  return TOOL_TO_HARNESS[sourceTool] ?? HARNESS.Api;
 }
 var STATUS_PRECEDENCE = ["open", "handled", "dismissed", "resolved"];
 function foldGroupStatus(instanceStatuses) {
@@ -17873,7 +17752,14 @@ function isVaultConsentValid(consent) {
 
 // ../../packages/schema/src/zod/local.ts
 var WORKSPACE_SETTINGS_SPEC_VERSION = 5;
-var RunMode = external_exports.enum(["standalone"]);
+var MODEL_JUDGE_PAYLOAD_VERSION = 1;
+var RunMode = external_exports.enum(["standalone", "attached"]);
+var ControlPlaneConnection = external_exports.object({
+  endpoint: external_exports.string().min(1),
+  // Display name for the deployment, shown instead of the raw endpoint.
+  label: external_exports.string().min(1).optional(),
+  attachedAt: external_exports.iso.datetime()
+}).meta({ id: "ControlPlaneConnection" });
 var SimpleDetectionPolicy = external_exports.enum(["redact", "warn"]);
 var HistoricalAccess = external_exports.enum(["full", "session-only"]);
 var ModelJudgeConsent = external_exports.object({
@@ -17882,12 +17768,10 @@ var ModelJudgeConsent = external_exports.object({
 });
 var WorkspaceSettings = external_exports.object({
   specVersion: external_exports.number().int().positive().default(WORKSPACE_SETTINGS_SPEC_VERSION),
-  // Settings files written by earlier releases may carry the retired 'attached'
-  // value; it parses as 'standalone' so those files keep loading.
-  runMode: external_exports.preprocess(
-    (v) => v === "attached" ? "standalone" : v,
-    RunMode.default("standalone")
-  ),
+  runMode: RunMode.default("standalone"),
+  // Present only while attached; a detach clears it. Its presence is what makes
+  // `runMode: 'attached'` mean anything — see isAttached.
+  controlPlane: ControlPlaneConnection.optional(),
   policy: SimpleDetectionPolicy.default("redact"),
   // Consent for scanning pre-install surfaces; opt-in (see HistoricalAccess).
   historicalAccess: HistoricalAccess.default("session-only"),
@@ -17989,39 +17873,244 @@ function toInspectionFindingRow(input) {
     firstDetectedAt: input.firstDetectedAt ? isoToEpochMillis(input.firstDetectedAt) : null
   };
 }
-function toCaptureAttributes(event) {
-  const metadata = event.metadata;
-  return {
-    source_tool: event.sourceTool,
-    ...metadata?.repo !== void 0 ? { repo: metadata.repo } : {},
-    ...metadata?.filePath !== void 0 ? { file_path: metadata.filePath } : {},
-    ...metadata?.toolName !== void 0 ? { tool_name: metadata.toolName } : {},
-    ...metadata?.gitignored !== void 0 ? { gitignored: metadata.gitignored } : {},
-    ...metadata?.wholeFile !== void 0 ? { whole_file: metadata.wholeFile } : {},
-    ...metadata?.correlationId !== void 0 ? { correlation_id: metadata.correlationId } : {},
-    ...metadata?.traceId !== void 0 ? { trace_id: metadata.traceId } : {},
-    ...metadata?.exceptionIds !== void 0 ? { exception_ids: metadata.exceptionIds } : {},
-    // `model`/`turnIndex` have no dedicated CaptureAttributes field (no writer
-    // has ever populated either), but every legacy metadata key still rides
-    // the bag rather than being silently dropped — CaptureAttributes'
-    // `.catchall(z.unknown())` carries the long tail.
-    ...metadata?.model !== void 0 ? { model: metadata.model } : {},
-    ...metadata?.turnIndex !== void 0 ? { turn_index: metadata.turnIndex } : {}
-  };
+function toCaptureAttributes(event) {
+  const metadata = event.metadata;
+  return {
+    source_tool: event.sourceTool,
+    ...metadata?.repo !== void 0 ? { repo: metadata.repo } : {},
+    ...metadata?.filePath !== void 0 ? { file_path: metadata.filePath } : {},
+    ...metadata?.toolName !== void 0 ? { tool_name: metadata.toolName } : {},
+    ...metadata?.gitignored !== void 0 ? { gitignored: metadata.gitignored } : {},
+    ...metadata?.wholeFile !== void 0 ? { whole_file: metadata.wholeFile } : {},
+    ...metadata?.correlationId !== void 0 ? { correlation_id: metadata.correlationId } : {},
+    ...metadata?.traceId !== void 0 ? { trace_id: metadata.traceId } : {},
+    ...metadata?.exceptionIds !== void 0 ? { exception_ids: metadata.exceptionIds } : {},
+    // `model`/`turnIndex` have no dedicated CaptureAttributes field (no writer
+    // has ever populated either), but every legacy metadata key still rides
+    // the bag rather than being silently dropped — CaptureAttributes'
+    // `.catchall(z.unknown())` carries the long tail.
+    ...metadata?.model !== void 0 ? { model: metadata.model } : {},
+    ...metadata?.turnIndex !== void 0 ? { turn_index: metadata.turnIndex } : {}
+  };
+}
+function captureDefinitionVersion(finding) {
+  return `capture/${finding.category}/${finding.severity}`;
+}
+function toCaptureDefinitionInput(finding) {
+  return {
+    ruleId: finding.ruleId,
+    version: captureDefinitionVersion(finding),
+    name: finding.ruleId,
+    category: finding.category,
+    severity: finding.severity,
+    definition: JSON.stringify({ ruleId: finding.ruleId })
+  };
+}
+
+// ../../packages/schema/src/zod/managed.ts
+var MANAGED_SETTINGS_FILENAME = "managed-settings.json";
+var MANAGED_SETTINGS_SPEC_VERSION = 1;
+var ManagedSettingKey = external_exports.enum([
+  "runMode",
+  "historicalAccess",
+  "vaultConsent",
+  "vaultKeyCustody",
+  "vaultInlineReveal",
+  "modelJudgeConsent",
+  "dataSharesInPlace"
+]).meta({ id: "ManagedSettingKey" });
+var ManagedSettingsValues = external_exports.object({
+  runMode: external_exports.enum(["standalone", "attached"]).optional(),
+  controlPlane: external_exports.object({
+    endpoint: external_exports.string().min(1),
+    label: external_exports.string().min(1).optional()
+  }).optional(),
+  historicalAccess: external_exports.enum(["full", "session-only"]).optional(),
+  vaultConsent: external_exports.boolean().optional(),
+  vaultKeyCustody: external_exports.enum(["file", "keychain"]).optional(),
+  vaultInlineReveal: external_exports.enum(["masked", "full", "off"]).optional(),
+  modelJudgeConsent: external_exports.boolean().optional(),
+  dataSharesInPlace: external_exports.boolean().optional()
+}).meta({ id: "ManagedSettingsValues" });
+var ManagedSettings = external_exports.object({
+  specVersion: external_exports.number().int().positive().default(MANAGED_SETTINGS_SPEC_VERSION),
+  // Shown on every locked control, so the user can tell an administrative
+  // decision from a bug. Absent renders as a generic "your organization".
+  organization: external_exports.string().min(1).optional(),
+  // What the administrator pinned.
+  values: ManagedSettingsValues.default({}),
+  // Which of those the user may not change. A key here with no matching value
+  // freezes whatever the user last chose; a value with no lock is a DEFAULT
+  // the user may still override. The two are separable on purpose.
+  lockedFields: external_exports.array(ManagedSettingKey).default([])
+}).meta({ id: "ManagedSettings" });
+
+// ../../packages/schema/src/zod/policy.ts
+var PolicyScope = external_exports.enum(["global", "repo", "user"]).meta({ id: "PolicyScope" });
+var PolicyTarget = external_exports.union([external_exports.object({ ruleId: external_exports.string() }), external_exports.object({ category: DetectionCategory })]).meta({ id: "PolicyTarget" });
+var Policy = external_exports.object({
+  id: external_exports.guid(),
+  scope: PolicyScope,
+  target: PolicyTarget,
+  action: ActionTaken,
+  enabled: external_exports.boolean().default(true),
+  customKeywords: external_exports.array(external_exports.string()).optional(),
+  // Display name — optional so older policy rows without name still parse.
+  // Added for the findings API (policy.name column migration).
+  name: external_exports.string().optional()
+}).meta({ id: "Policy" });
+var PolicyBundle = external_exports.object({
+  version: external_exports.string(),
+  policies: external_exports.array(Policy),
+  // Rules from the installed marketplace packs (snapshotted by the
+  // control plane). The plugin registers these in addition to its bundled
+  // packs. Optional so older backends — and older on-disk caches — that omit
+  // the field still parse; consumers read `bundle.rules ?? []`.
+  rules: external_exports.array(Rule).optional(),
+  // When true, `rules` IS the complete effective ruleset and the runtime must
+  // NOT merge its compiled-in bundled packs — the standalone gateway sets this
+  // after reading the user's installed snapshot (installed_packs, enabled
+  // packs only), which is how detection updates stay manual: new bundled
+  // rules run only after the user applies the pack update. Absent/false keeps
+  // the historical composition (bundled packs + rules) — older caches.
+  rulesComplete: external_exports.boolean().optional(),
+  // Active detection exceptions, evaluation subset only (see
+  // ExceptionBundleEntry). Optional so older bundle producers — and older
+  // on-disk caches — that omit the field still parse; consumers read
+  // `bundle.exceptions ?? []`.
+  exceptions: external_exports.array(ExceptionBundleEntry).optional(),
+  // Rule ids whose pack is assigned a REVERSIBLE archetype (Redact & Vault).
+  // A second axis over the same `redact` action, carried beside the policies
+  // rather than on them: nothing writes ruleId-targeted policies to disk, so
+  // widening Policy itself would change a persisted shape to express something
+  // only the in-memory bundle needs. Optional so an older producer — or an
+  // older on-disk cache — still parses; consumers read `?? []` and get the
+  // pre-existing one-way behaviour, which is the safe direction to default.
+  reversibleRuleIds: external_exports.array(external_exports.string()).optional(),
+  // Installed pack version, keyed by ruleId, for rules in `rules` that came
+  // from a versioned installed pack. Optional so older backends — and older
+  // on-disk caches — that omit the field still parse; consumers fall back to
+  // the rule's own spec version. NOT the bundle version above — see
+  // installedRuleset's ruleVersions for the source of truth.
+  ruleVersions: external_exports.record(external_exports.string(), external_exports.string()).optional(),
+  customKeywords: external_exports.array(external_exports.string()),
+  fetchedAt: external_exports.iso.datetime()
+}).meta({ id: "PolicyBundle" });
+var OBSERVE_ONLY_CATEGORIES = ["config"];
+var ENFORCEABLE_CATEGORIES = DetectionCategory.options.filter((c) => !OBSERVE_ONLY_CATEGORIES.includes(c));
+var CATEGORY_PEAK_SEVERITY = {
+  secret: "critical",
+  financial: "critical",
+  // core-financial/credit-card
+  code_flaw: "critical",
+  pii: "high",
+  phi: "high",
+  custom: "high",
+  // user-defined; conservative
+  code_context: "low",
+  config: "low"
+  // observe-only; floors to monitor regardless
+};
+function severityFloorPolicy(category) {
+  if (OBSERVE_ONLY_CATEGORIES.includes(category)) return "monitor";
+  const peak = CATEGORY_PEAK_SEVERITY[category];
+  return peak === "critical" || peak === "high" ? "warn" : "monitor";
+}
+var PolicyKind = external_exports.enum(["builtin", "custom"]).meta({ id: "PolicyKind" });
+var KNOWN_BUILTIN_IDS = ["monitor", "warn", "redact", "vault", "block"];
+var BuiltinPolicyId = external_exports.enum(KNOWN_BUILTIN_IDS).meta({ id: "BuiltinPolicyId" });
+var BUILTIN_ORDER = KNOWN_BUILTIN_IDS;
+var BUILTIN_POLICY_SPECS = {
+  monitor: {
+    name: "Monitor",
+    action: "log",
+    reversible: false,
+    description: "Log every match for audit. The request is allowed through untouched."
+  },
+  warn: {
+    name: "Warn",
+    action: "warn",
+    reversible: false,
+    description: "Allow the request, but warn the user inline before it is sent."
+  },
+  redact: {
+    name: "Redact",
+    action: "redact",
+    reversible: false,
+    description: "Strip the matched value from the request and destroy it, then continue. What was removed cannot be recovered."
+  },
+  vault: {
+    name: "Redact & Vault",
+    action: "redact",
+    reversible: true,
+    description: "Strip the matched value from the request and keep an encrypted, recoverable copy in the local vault, leaving a pointer in its place. Needs the vault consent granted under Settings; without it this behaves as Redact."
+  },
+  block: {
+    name: "Block",
+    action: "block",
+    reversible: false,
+    description: "Refuse the request entirely whenever any rule in this detection matches."
+  }
+};
+function builtinPolicyToAction(id) {
+  return BUILTIN_POLICY_SPECS[id].action;
+}
+var CATEGORY_EXPRESSIBLE_IDS = KNOWN_BUILTIN_IDS.filter(
+  (id) => !BUILTIN_POLICY_SPECS[id].reversible
+);
+var CATEGORY_INEXPRESSIBLE_IDS = KNOWN_BUILTIN_IDS.filter(
+  (id) => BUILTIN_POLICY_SPECS[id].reversible
+);
+var CategoryPolicyId = external_exports.enum(CATEGORY_EXPRESSIBLE_IDS).meta({ id: "CategoryPolicyId" });
+function builtinPolicyIsReversible(id) {
+  return BUILTIN_POLICY_SPECS[id].reversible;
 }
-function captureDefinitionVersion(finding) {
-  return `capture/${finding.category}/${finding.severity}`;
+function policyIdIsReversible(policyId) {
+  const parsed = BuiltinPolicyId.safeParse(policyId ?? DEFAULT_PACK_POLICY_ID);
+  const id = parsed.success ? parsed.data : DEFAULT_PACK_POLICY_ID;
+  return builtinPolicyIsReversible(id);
 }
-function toCaptureDefinitionInput(finding) {
-  return {
-    ruleId: finding.ruleId,
-    version: captureDefinitionVersion(finding),
-    name: finding.ruleId,
-    category: finding.category,
-    severity: finding.severity,
-    definition: JSON.stringify({ ruleId: finding.ruleId })
-  };
+var DEFAULT_ACTIONS = Object.fromEntries(
+  DetectionCategory.options.map((c) => [c, builtinPolicyToAction(severityFloorPolicy(c))])
+);
+var BUILTIN_POLICIES = Object.fromEntries(
+  KNOWN_BUILTIN_IDS.map((id) => [id, { id, ...BUILTIN_POLICY_SPECS[id] }])
+);
+var DEFAULT_PACK_POLICY_ID = "monitor";
+function policyIdToAction(policyId) {
+  const parsed = BuiltinPolicyId.safeParse(policyId ?? DEFAULT_PACK_POLICY_ID);
+  const id = parsed.success ? parsed.data : DEFAULT_PACK_POLICY_ID;
+  return BUILTIN_POLICIES[id].action;
 }
+var UsedByItem = external_exports.object({
+  id: external_exports.string(),
+  name: external_exports.string(),
+  ruleCount: external_exports.number().int().nonnegative(),
+  enabled: external_exports.boolean()
+}).meta({ id: "UsedByItem" });
+var PolicyListItem = external_exports.object({
+  id: external_exports.string(),
+  kind: PolicyKind,
+  name: external_exports.string(),
+  enabled: external_exports.boolean(),
+  usedByCount: external_exports.number().int().nonnegative()
+}).meta({ id: "PolicyListItem" });
+var ListPoliciesResponse = external_exports.object({ items: external_exports.array(PolicyListItem) }).meta({ id: "ListPoliciesResponse" });
+var PolicyDetail = external_exports.object({
+  specVersion: external_exports.literal(1),
+  id: external_exports.string(),
+  kind: PolicyKind,
+  name: external_exports.string(),
+  enabled: external_exports.boolean(),
+  description: external_exports.string(),
+  usedBy: external_exports.array(UsedByItem)
+}).meta({ id: "PolicyDetail" });
+var PolicyStatsResponse = external_exports.object({
+  policies: external_exports.number().int().nonnegative(),
+  builtin: external_exports.number().int().nonnegative(),
+  custom: external_exports.number().int().nonnegative(),
+  detectionsGoverned: external_exports.number().int().nonnegative()
+}).meta({ id: "PolicyStatsResponse" });
 
 // ../../packages/schema/src/zod/project-files.ts
 var ProjectFileInput = external_exports.object({
@@ -18101,44 +18190,6 @@ var BatchedRemediation = external_exports.discriminatedUnion("kind", [
   NoRemediationDecision
 ]);
 
-// ../../packages/schema/src/zod/rule-test.ts
-var TestRulesRequest = external_exports.object({
-  rules: external_exports.array(Rule).min(1).max(100),
-  text: external_exports.string().max(5e4).optional(),
-  fixtures: external_exports.array(RuleFixture).max(200).optional()
-}).refine((v) => v.text !== void 0 || (v.fixtures?.length ?? 0) > 0, {
-  message: "Provide `text`, `fixtures`, or both \u2014 there must be something to test"
-}).meta({ id: "TestRulesRequest" });
-var RuleTestMatch = external_exports.object({
-  ruleId: external_exports.string(),
-  category: DetectionCategory,
-  severity: Severity,
-  span: Span,
-  confidence: external_exports.number().min(0).max(1),
-  match: external_exports.string()
-}).meta({ id: "RuleTestMatch" });
-var FixtureResult = external_exports.object({
-  label: external_exports.string(),
-  shouldMatch: external_exports.boolean(),
-  didMatch: external_exports.boolean(),
-  passed: external_exports.boolean(),
-  matches: external_exports.array(RuleTestMatch)
-}).meta({ id: "FixtureResult" });
-var TestRulesResponse = external_exports.object({
-  // Present only when the request supplied `text`.
-  adhoc: external_exports.object({ matches: external_exports.array(RuleTestMatch) }).optional(),
-  fixtures: external_exports.array(FixtureResult),
-  summary: external_exports.object({
-    total: external_exports.number().int().nonnegative(),
-    passed: external_exports.number().int().nonnegative(),
-    failed: external_exports.number().int().nonnegative()
-  }),
-  // Ids of rules whose matcher type the engine cannot evaluate today (e.g.
-  // `validator`), so they silently never match. Surfaced so an author is not
-  // misled by a green run that actually skipped a rule.
-  unsupportedRuleIds: external_exports.array(external_exports.string())
-}).meta({ id: "TestRulesResponse" });
-
 // ../../packages/schema/src/zod/security.ts
 var SeveritySummaryItem = external_exports.object({
   severity: Severity,
@@ -18236,10 +18287,22 @@ var TopSourcesQuery = external_exports.object({
   // Omit for both kinds.
   kind: external_exports.enum(SOURCE_KINDS).optional()
 });
-var Provider = external_exports.enum(["claudecode", "cursor", "codex", "antigravity", "claudeai", "chatgpt", "copilot", "api"]).meta({ id: "Provider" });
+var Provider = Harness.extract([
+  "ClaudeCode",
+  "Cursor",
+  "Codex",
+  "Antigravity",
+  "ClaudeAi",
+  "ChatGpt",
+  "Copilot",
+  "Api"
+]).meta({ id: "Provider" });
 var ScanCoverageProvider = external_exports.object({
   provider: Provider,
-  // Percent of that provider's traffic scanned in the window. 0 when unsupported.
+  // Percent of that provider's traffic the shipped capture surface reaches.
+  // A curated business fact, constant across every `range` — not a measured
+  // per-window metric. 0 exactly when `supported` is false. See the comment
+  // above the block for where these numbers are decided.
   coverage: external_exports.number().int().min(0).max(100),
   supported: external_exports.boolean()
 }).meta({ id: "ScanCoverageProvider" });
@@ -18293,6 +18356,18 @@ var ApplyRecommendedActionResponse = external_exports.object({
 var DismissRecommendedActionResponse = external_exports.object({ id: external_exports.string(), status: external_exports.literal("dismissed") }).meta({ id: "DismissRecommendedActionResponse" });
 var RecommendedActionIdParam = external_exports.object({ id: external_exports.string() });
 
+// ../../packages/schema/src/zod/settings-action.ts
+var SaveSettingsInput = external_exports.object({
+  historicalAccess: external_exports.string(),
+  modelJudgeConsent: external_exports.boolean(),
+  vaultConsent: external_exports.string(),
+  vaultInlineReveal: external_exports.string()
+});
+var AttachInput = external_exports.object({
+  endpoint: external_exports.string(),
+  label: external_exports.string().optional()
+});
+
 // ../../packages/schema/src/zod/triage.ts
 var TriageHit = external_exports.object({
   ruleId: external_exports.string(),
@@ -18307,7 +18382,7 @@ var TriageHit = external_exports.object({
   valueFingerprint: external_exports.string().optional(),
   keyVersion: external_exports.number().int().nonnegative().optional()
 });
-var TriagePolicy = BuiltinPolicyId;
+var TriagePolicy = CategoryPolicyId;
 var TriageCategoryRec = external_exports.object({
   category: DetectionCategory,
   action: TriagePolicy,
@@ -18525,8 +18600,11 @@ function chmodBestEffort(path, mode) {
 function tightenDir(dir) {
   chmodBestEffort(dir, DATA_DIR_MODE);
 }
+function mkdirOwnerOnlySync(dir, recursive = false) {
+  mkdirSync(dir, { recursive, mode: DATA_DIR_MODE });
+}
 function ensureDataDirSync(dir) {
-  mkdirSync(dir, { recursive: true, mode: DATA_DIR_MODE });
+  mkdirOwnerOnlySync(dir, true);
   tightenDir(dir);
 }
 function dbSidecars(file2) {
@@ -18538,6 +18616,26 @@ function tightenFile(file2) {
 function tightenPerms(file2) {
   for (const path of [file2, ...dbSidecars(file2)]) chmodBestEffort(path, DATA_FILE_MODE);
 }
+function writeExclusiveOwnerOnlySync(file2, data) {
+  writeFileSync(file2, data, { mode: DATA_FILE_MODE, flag: "wx" });
+}
+function writeOwnerOnlyFileSync(file2, data) {
+  const tmp = `${file2}.${String(process.pid)}.tmp`;
+  try {
+    rmSync(tmp, { force: true });
+  } catch {
+  }
+  try {
+    writeExclusiveOwnerOnlySync(tmp, data);
+    renameSync(tmp, file2);
+  } finally {
+    try {
+      rmSync(tmp, { force: true });
+    } catch {
+    }
+  }
+  tightenFile(file2);
+}
 function classifyOccupant(file2) {
   try {
     if (lstatSync(file2).isSymbolicLink()) return { kind: "symlink" };
@@ -18566,7 +18664,7 @@ function createOwnerOnlyFileSync(file2, data) {
   }
   let created;
   try {
-    writeFileSync(tmp, data, { mode: DATA_FILE_MODE, flag: "wx" });
+    writeExclusiveOwnerOnlySync(tmp, data);
     created = publishByLink(tmp, file2, data);
   } finally {
     try {
@@ -18588,7 +18686,7 @@ function publishByLink(tmp, file2, data) {
     if (!LINK_UNSUPPORTED.has(code ?? "")) throw err;
   }
   try {
-    writeFileSync(file2, data, { mode: DATA_FILE_MODE, flag: "wx" });
+    writeExclusiveOwnerOnlySync(file2, data);
     return true;
   } catch (err) {
     if (err.code === "EEXIST") return false;
@@ -18601,6 +18699,25 @@ function backupPath(file2, tag) {
   return `${file2}.${tag}.${String(Date.now())}.${randomUUID().slice(0, 8)}.bak`;
 }
 var STALE_PARTIAL_MS = 5 * 6e4;
+var SNAPSHOT_STAGING_SUFFIX = ".partial";
+var STAGED_NAME_SUFFIX = `.bak${SNAPSHOT_STAGING_SUFFIX}`;
+var SNAPSHOT_STAGING_COPY = "copy";
+function createSnapshotStaging(backup) {
+  const stage = `${backup}${SNAPSHOT_STAGING_SUFFIX}`;
+  rmSync2(stage, { recursive: true, force: true });
+  mkdirOwnerOnlySync(stage);
+  tightenDir(stage);
+  return { stage, copy: join(stage, SNAPSHOT_STAGING_COPY) };
+}
+function idleMs(entry) {
+  for (const candidate of [join(entry, SNAPSHOT_STAGING_COPY), entry]) {
+    try {
+      return Date.now() - statSync(candidate).mtimeMs;
+    } catch {
+    }
+  }
+  return null;
+}
 function reapStalePartials(file2) {
   const dir = dirname(file2);
   const prefix = `${basename(file2)}.`;
@@ -18611,30 +18728,34 @@ function reapStalePartials(file2) {
     return;
   }
   for (const name of entries) {
-    if (!name.startsWith(prefix) || !name.endsWith(".bak.partial")) continue;
-    const partial2 = join(dir, name);
+    if (!name.startsWith(prefix) || !name.endsWith(STAGED_NAME_SUFFIX)) continue;
+    const staging = join(dir, name);
     try {
-      if (Date.now() - statSync(partial2).mtimeMs > STALE_PARTIAL_MS) {
-        rmSync2(partial2, { force: true });
+      const idle = idleMs(staging);
+      if (idle !== null && idle > STALE_PARTIAL_MS) {
+        rmSync2(staging, { recursive: true, force: true });
       }
     } catch {
     }
   }
 }
 function snapshotStore(db, backup) {
-  const partial2 = `${backup}.partial`;
+  const { stage, copy } = createSnapshotStaging(backup);
   try {
-    rmSync2(partial2, { force: true });
-    db.prepare("VACUUM INTO ?").run(partial2);
-    tightenFile(partial2);
-    renameSync2(partial2, backup);
+    db.prepare("VACUUM INTO ?").run(copy);
+    tightenFile(copy);
+    renameSync2(copy, backup);
   } catch (error51) {
     try {
-      rmSync2(partial2, { force: true });
+      rmSync2(stage, { recursive: true, force: true });
     } catch {
     }
     throw error51;
   }
+  try {
+    rmSync2(stage, { recursive: true, force: true });
+  } catch {
+  }
 }
 function moveStoreAside(file2, backup) {
   const undo = [];
@@ -19362,9 +19483,10 @@ function safeParseStringArray(raw) {
   const parsed = safeJson(raw, null);
   return Array.isArray(parsed) ? parsed : [];
 }
+var DEFAULT_HARNESS = HARNESS.ClaudeCode;
 function toHarness(raw) {
   const parsed = Harness.safeParse(raw);
-  return parsed.success ? parsed.data : "claudecode";
+  return parsed.success ? parsed.data : DEFAULT_HARNESS;
 }
 function resolveLifecycle(row, lastActivityMs, nowMs) {
   if (row.status) {
@@ -19495,7 +19617,7 @@ var SqliteActivityRepository = class {
     const params = [];
     if (query.harness && query.harness.length > 0) {
       conditions.push(
-        `coalesce(json_extract(attributes, '$.harness'), 'claudecode') IN (${placeholders(query.harness.length)})`
+        `coalesce(json_extract(attributes, '$.harness'), '${DEFAULT_HARNESS}') IN (${placeholders(query.harness.length)})`
       );
       params.push(...query.harness);
     }
@@ -19702,13 +19824,13 @@ var SqliteActivityRepository = class {
    * The DISTINCT harnesses that actually have sessions (optionally within a
    * `started_at >= fromMs` window), so the filter can offer only the harnesses
    * present rather than the full enum. Each stored value is normalized through
-   * the SAME `toHarness` default the list uses (missing → 'claudecode'), so a
-   * store of bare (harness-less) roots surfaces exactly `['claudecode']`.
+   * the SAME `toHarness` default the list uses (missing → DEFAULT_HARNESS), so
+   * a store of bare (harness-less) roots surfaces exactly that one harness.
    */
   harnessFacets(fromMs) {
     const where = fromMs === void 0 ? "" : " AND started_at >= ?";
     const stmt = this.db.prepare(
-      `SELECT DISTINCT coalesce(json_extract(attributes, '$.harness'), 'claudecode') AS harness
+      `SELECT DISTINCT coalesce(json_extract(attributes, '$.harness'), '${DEFAULT_HARNESS}') AS harness
          FROM audit_events WHERE ${SESSION_ROOT}${where}`
     );
     const rows = allRows(
@@ -19922,8 +20044,8 @@ var SqliteAuditEventsRepository = class {
   }
   // Insert one transcript-derived `llm_call` leaf. Unlike `insertAuditEvent`
   // (which takes a caller-supplied random id), the id here is MINTED internally
-  // from the natural key — `llmCallId(sessionId, messageId)` — tenant-free like the
-  // sibling local-store ids (the local store is single-tenant). The deterministic
+  // from the natural key — `llmCallId(sessionId, messageId)` — derived from the
+  // session and message alone, like the sibling local-store ids. The deterministic
   // id + the UPSERT-take-MAX(output_tokens) statement make every re-read idempotent
   // AND converge a streaming partial/final split across two incremental passes:
   // a whole-file re-read no-ops (equal output), a lagging final replaces a
@@ -20888,6 +21010,42 @@ var SqliteFindingsRepository = class {
     this.db = db;
   }
   db;
+  /**
+   * The newest `limit` findings, newest first.
+   *
+   * THE PLAN IS THE POINT HERE, and two things in the SQL below exist only to
+   * pin it. The natural spelling — drive from `inspection_findings`, order by the
+   * JOINED `e.started_at` — cannot push the LIMIT down, because the sort key is
+   * not on the driving table: SQLite sorts every finding in the store through a
+   * temp B-tree to return 500 rows. Measured at 35.0 ms on a 40,000-event corpus
+   * against 0.9 ms for the form below, and the gap is a ratio of the store size
+   * rather than a constant.
+   *
+   * What it takes to make `started_at` order come out of an index instead:
+   *
+   *  - **`+e.event_type`** — the unary plus makes that term non-indexable, so the
+   *    planner stops choosing `idx_audit_type_t` (`event_type, started_at`). That
+   *    index cannot serve the ORDER BY: the predicate spans four event types, so
+   *    satisfying a global `started_at` order across them needs a range merge
+   *    SQLite will not do, and it sorts instead. Freed of it, the planner scans
+   *    `idx_audit_started_at` — a bare `started_at` index — in DESC order and
+   *    filters the type per row, which lets the LIMIT stop the scan early.
+   *  - **`CROSS JOIN`** — semantically identical to JOIN in SQLite, and there
+   *    purely to stop the tables being reordered. With plain JOINs the planner
+   *    drives from `f` and sorts everything again: measured at 23.6 ms, i.e. the
+   *    unary plus ALONE recovers almost none of the win. Both are needed.
+   *
+   * Neither is a micro-optimisation that a later reader should tidy away, and
+   * `packages/persistence/test/performance/hot-read-query-plans.test.ts` fails if
+   * the temp B-tree comes back.
+   *
+   * Degrading gracefully was the reason for `+` over `INDEXED BY`, which measured
+   * identically (0.9 ms): `INDEXED BY` is a hard requirement, so dropping or
+   * renaming the index turns this read into an ERROR, where `+` turns it into a
+   * scan-and-sort — slower, still correct. The worst case for the chosen form is
+   * a store whose recent captures carry no findings at all, where the scan walks
+   * the whole index; that is still no worse than the full sort it replaced.
+   */
   recentFindings(opts) {
     const limit = opts?.limit ?? 50;
     const rows = allRows(
@@ -20896,10 +21054,10 @@ var SqliteFindingsRepository = class {
                 f.masked_match, f.action_taken, f.confidence, e.started_at AS occurred_at,
                 json_extract(e.attributes, '$.source_tool') AS source_tool,
                 e.event_type AS kind
-         FROM inspection_findings f
-         JOIN audit_events e ON e.id = f.audit_event_id
-         JOIN inspection_definitions d ON d.id = f.inspection_definition_id
-         WHERE e.event_type IN (${CAPTURE_EVENT_TYPES_SQL})
+         FROM audit_events e
+         CROSS JOIN inspection_findings f ON f.audit_event_id = e.id
+         CROSS JOIN inspection_definitions d ON d.id = f.inspection_definition_id
+         WHERE +e.event_type IN (${CAPTURE_EVENT_TYPES_SQL})
          ORDER BY e.started_at DESC, f.rowid DESC
          LIMIT :limit`
       ),
@@ -21543,7 +21701,8 @@ var SqliteInspectionDefinitionsRepository = class {
   }
   db;
   insertStmt;
-  // Idempotent upsert; returns the content-addressed definition id.
+  // Insert-if-absent; returns the content-addressed definition id. An id already
+  // present keeps the stored row untouched — see the class doc.
   upsert(input) {
     const id = inspectionDefinitionId(input.ruleId, input.version);
     const row = toInspectionDefinitionRow(input, id);
@@ -21687,11 +21846,23 @@ function isParseableBinaryVersion(version2) {
 
 // ../../packages/persistence/src/repositories/installed-packs.ts
 var DEFAULT_POLICY_ID = DEFAULT_PACK_POLICY_ID;
+function printableRuleId(entry) {
+  if (typeof entry !== "object" || entry === null) return null;
+  const candidate = entry.id;
+  return Rule.shape.id.safeParse(candidate).success ? candidate : null;
+}
+function firstIssueReason(error51) {
+  const issue2 = error51.issues[0];
+  if (!issue2) return "unknown";
+  const path = issue2.path.map((segment) => String(segment)).join(".");
+  return path ? `${path}: ${issue2.code}` : issue2.code;
+}
+var REJECTED_RULE_DETAIL_CAP = 10;
 function inventorySignature(packs2) {
   return packs2.map((p) => `${p.namespace}/${p.packId}@${p.version}#${hashRules(p.rulesJson)}`).sort().join(",");
 }
 function hashRules(rulesJson) {
-  return createHash2("sha1").update(rulesJson).digest("hex");
+  return createHash2("sha256").update(rulesJson).digest("hex");
 }
 function parseVersion(v) {
   const m = /^(\d+)\.(\d+)\.(\d+)/.exec(v);
@@ -21903,10 +22074,21 @@ var SqliteInstalledPacksRepository = class {
    * (all detection off) instead of falling back to the bundled packs. Every
    * JSON-level failure therefore counts as invalid.
    */
+  /**
+   * ORDERED, because a rule id is unique only WITHIN a pack — the sole unique
+   * index is (namespace, pack_id) — so two enabled packs may contribute the same
+   * id, and the per-rule maps below are last-write-wins. Without an ORDER BY the
+   * winner is whatever order SQLite happens to return, which makes a collision
+   * resolve differently on two machines holding identical stores. Ordering by
+   * (namespace, pack_id) makes the loser deterministic and therefore testable.
+   */
   installedRuleset() {
     const rows = allRows(
       this.db.prepare(
-        `SELECT enabled, policy_id AS policyId, rules_json AS rulesJson, version FROM installed_packs`
+        `SELECT enabled, policy_id AS policyId, rules_json AS rulesJson, version,
+                namespace, pack_id AS packId
+           FROM installed_packs
+          ORDER BY namespace, pack_id`
       )
     );
     const out = {
@@ -21914,22 +22096,32 @@ var SqliteInstalledPacksRepository = class {
       enabledPacks: 0,
       rules: [],
       invalidRules: 0,
+      rejectedRules: [],
       ruleActions: /* @__PURE__ */ new Map(),
-      ruleVersions: /* @__PURE__ */ new Map()
+      ruleVersions: /* @__PURE__ */ new Map(),
+      reversibleRules: /* @__PURE__ */ new Set()
+    };
+    const reject = (pack, ruleId, reason) => {
+      if (out.rejectedRules.length >= REJECTED_RULE_DETAIL_CAP) return;
+      out.rejectedRules.push({ pack, ruleId, reason });
     };
     for (const row of rows) {
       if (!intToBool(row.enabled)) continue;
       out.enabledPacks += 1;
       const action = policyIdToAction(row.policyId);
+      const reversible = policyIdIsReversible(row.policyId);
+      const pack = `${row.namespace}/${row.packId}`;
       let raw;
       try {
         raw = JSON.parse(row.rulesJson);
       } catch {
         out.invalidRules += 1;
+        reject(pack, null, "rules_json: malformed JSON");
         continue;
       }
       if (!Array.isArray(raw)) {
         out.invalidRules += 1;
+        reject(pack, null, "rules_json: not an array");
         continue;
       }
       for (const entry of raw) {
@@ -21938,7 +22130,12 @@ var SqliteInstalledPacksRepository = class {
           out.rules.push(parsed.data);
           out.ruleActions.set(parsed.data.id, action);
           out.ruleVersions.set(parsed.data.id, row.version);
-        } else out.invalidRules += 1;
+          if (reversible) out.reversibleRules.add(parsed.data.id);
+          else out.reversibleRules.delete(parsed.data.id);
+        } else {
+          out.invalidRules += 1;
+          reject(pack, printableRuleId(entry), firstIssueReason(parsed.error));
+        }
       }
     }
     return out;
@@ -22132,31 +22329,38 @@ var CATEGORY_ORDER = ["config", "skill", "mcp", "hook"];
 var VALID_HARNESS_IDS = new Set(HarnessId.options);
 var WORKTREE_CHECKOUT_FILTER = "(url IS NULL OR (url NOT LIKE '%/.claude/worktrees/%' AND url NOT LIKE '%\\.claude\\worktrees\\%'))";
 var HARNESS_LABELS = {
-  claudecode: "Claude Code",
-  cursor: "Cursor",
-  codex: "Codex",
-  antigravity: "Antigravity"
+  [HARNESS.ClaudeCode]: "Claude Code",
+  [HARNESS.Cursor]: "Cursor",
+  [HARNESS.Codex]: "Codex",
+  [HARNESS.Antigravity]: "Antigravity"
 };
 var HARNESS_LIVENESS_WINDOW_MS = 30 * 24 * 60 * 60 * 1e3;
 var EMPTY_PROJECT_AGG = {
   accessCounts: { open: 0, approved: 0, blocked: 0, total: 0 },
   findingsCount: 0
 };
+var stripSeparators = (value) => value.toLowerCase().replace(/[\s-]/g, "");
+var TITLE_NEEDLES = {
+  ClaudeCode: stripSeparators(SOURCE_TOOL.ClaudeCode),
+  Cursor: stripSeparators(SOURCE_TOOL.Cursor),
+  Codex: stripSeparators(SOURCE_TOOL.Codex),
+  Antigravity: stripSeparators(SOURCE_TOOL.Antigravity)
+};
 function resolveHarnessId(attrs, row) {
   if (attrs.provider && VALID_HARNESS_IDS.has(attrs.provider)) {
     return attrs.provider;
   }
-  const t = (row.title ?? "").toLowerCase().replace(/[\s-]/g, "");
-  if (t.includes("claudecode") || t === "claude") return "claudecode";
-  if (t.includes("cursor")) return "cursor";
-  if (t.includes("codex")) return "codex";
-  if (t.includes("antigravity")) return "antigravity";
+  const t = stripSeparators(row.title ?? "");
+  if (t.includes(TITLE_NEEDLES.ClaudeCode) || t === "claude") return HARNESS.ClaudeCode;
+  if (t.includes(TITLE_NEEDLES.Cursor)) return HARNESS.Cursor;
+  if (t.includes(TITLE_NEEDLES.Codex)) return HARNESS.Codex;
+  if (t.includes(TITLE_NEEDLES.Antigravity)) return HARNESS.Antigravity;
   return null;
 }
 function isLiveRealClaudeCode(rows) {
   return rows.some((r) => {
     const attrs = safeJson(r.attributes, {});
-    return attrs.provenance !== "sample" && resolveHarnessId(attrs, r) === "claudecode";
+    return attrs.provenance !== "sample" && resolveHarnessId(attrs, r) === HARNESS.ClaudeCode;
   });
 }
 function toAssetSummary(row) {
@@ -22424,7 +22628,7 @@ var SqliteInventoryAssetsRepository = class {
       const isRealHarness = rows.some(
         (r) => safeJson(r.attributes, {}).provenance !== "sample"
       );
-      const attachConfig = isRealHarness && harnessId === "claudecode" && configAssets.length > 0;
+      const attachConfig = isRealHarness && harnessId === HARNESS.ClaudeCode && configAssets.length > 0;
       const assets = attachConfig ? [...harnessAssets, ...configAssets].sort((a, b) => a.name.localeCompare(b.name)) : harnessAssets;
       if (q && assets.length === 0) continue;
       const firstRow = rows[0];
@@ -23098,9 +23302,10 @@ var SqliteProjectFilesRepository = class {
 // ../../packages/persistence/src/repositories/resolutions.ts
 import { randomUUID as randomUUID7 } from "crypto";
 var SqliteResolutionsRepository = class {
-  constructor(db, now = () => Date.now()) {
+  constructor(db, now = () => Date.now(), newId = () => randomUUID7()) {
     this.db = db;
     this.now = now;
+    this.newId = newId;
     this.insertStmt = db.prepare(
       `INSERT INTO finding_resolution (id, finding_key, status, method, resolved_at, evidence, created_at)
        VALUES (:id, :findingKey, :status, :method, :resolvedAt, :evidence, :createdAt)`
@@ -23133,12 +23338,14 @@ var SqliteResolutionsRepository = class {
   }
   db;
   now;
+  newId;
   insertStmt;
   latestStmt;
   openAtRestStmt;
   resolvedAtRestStmt;
   /**
-   * Insert one disposition row. The repo mints the id and stamps created_at.
+   * Insert one disposition row. The repo mints the id and stamps created_at,
+   * both through the constructor's injectable seams.
    * `status`/`method` are typed AND re-parsed here against @akasecurity/schema's
    * FindingStatus/ResolutionMethod, so the persisted vocabulary can never drift
    * from the schema enums. NOTE for future manual-resolution writers: this is
@@ -23150,7 +23357,7 @@ var SqliteResolutionsRepository = class {
    */
   insertResolution(r) {
     this.insertStmt.run({
-      id: randomUUID7(),
+      id: this.newId(),
       findingKey: r.findingKey,
       status: FindingStatus.parse(r.status),
       method: ResolutionMethod.parse(r.method),
@@ -23729,16 +23936,16 @@ var ACTION_TO_KIND = {
   warn: "warned"
 };
 var ENFORCEMENT_KINDS = ["blocked", "redacted", "warned"];
-var SCAN_COVERAGE = [
-  { provider: "claudecode", coverage: 100, supported: true },
-  { provider: "cursor", coverage: 0, supported: false },
-  { provider: "codex", coverage: 80, supported: true },
-  { provider: "antigravity", coverage: 60, supported: true },
-  { provider: "claudeai", coverage: 0, supported: false },
-  { provider: "chatgpt", coverage: 0, supported: false },
-  { provider: "copilot", coverage: 0, supported: false },
-  { provider: "api", coverage: 0, supported: false }
-];
+var SCAN_COVERAGE = {
+  [HARNESS.Antigravity]: { coverage: 60, supported: true },
+  [HARNESS.Api]: { coverage: 0, supported: false },
+  [HARNESS.ChatGpt]: { coverage: 40, supported: true },
+  [HARNESS.ClaudeAi]: { coverage: 40, supported: true },
+  [HARNESS.ClaudeCode]: { coverage: 100, supported: true },
+  [HARNESS.Codex]: { coverage: 80, supported: true },
+  [HARNESS.Copilot]: { coverage: 0, supported: false },
+  [HARNESS.Cursor]: { coverage: 0, supported: false }
+};
 var GRANULARITY = {
   "7d": "day",
   "30d": "day",
@@ -23837,9 +24044,22 @@ var SqliteSecurityRepository = class {
     return Promise.resolve({ total, needsRemediation, bySeverity });
   }
   // Range is echoed but does not change the result today — coverage is a constant
-  // business fact (see SCAN_COVERAGE), not a measured per-window metric.
+  // business fact (see SCAN_COVERAGE), not a measured per-window metric. Order
+  // comes from Provider.options (the enum's declaration order), not from
+  // SCAN_COVERAGE's own key order — deliberately, not because object literals
+  // leave key order unspecified (ES2015 guarantees insertion order for these
+  // non-integer string keys, so iterating SCAN_COVERAGE directly would be
+  // reliable too). The reason is the schema comment's promise: the returned
+  // order must mirror the generated OpenAPI enum list, which is Provider's
+  // contract, not this table's.
   scanCoverage(range) {
-    return Promise.resolve({ range, providers: SCAN_COVERAGE.map((p) => ({ ...p })) });
+    return Promise.resolve({
+      range,
+      providers: Provider.options.map((provider) => ({
+        provider,
+        ...SCAN_COVERAGE[provider]
+      }))
+    });
   }
   enforcementActions(range) {
     const lenMs = RANGE_DAYS[range] * DAY_MS4;
@@ -23897,10 +24117,10 @@ var SqliteSecurityRepository = class {
   // count; a superseding open/redetected row means the finding is not
   // remediated and is excluded, same invariant as severitySummary. Legacy
   // at-rest findings with finding_key IS NULL can never have a resolution row
-  // (the lifecycle is keyed by finding_key), so the SQL guard excludes them
-  // outright. One raw-row query (fetch every trackable finding + its latest
-  // resolution's status/method/resolved_at) + pure-JS filter/bucket/mean,
-  // mirroring this file's other methods.
+  // (the lifecycle is keyed by finding_key), so they cannot reach the driving
+  // set below. One raw-row query (fetch the findings with resolution activity in
+  // the window + each one's latest resolution status/method/resolved_at) +
+  // pure-JS filter/bucket/mean, mirroring this file's other methods.
   mttrTrend(range) {
     const granularity = granularityFor(range);
     const bucketMs = (granularity === "day" ? 1 : 7) * DAY_MS4;
@@ -23916,29 +24136,80 @@ var SqliteSecurityRepository = class {
         // started_at the upsert overwrites onto inspection_findings.audit_event_id.
         // COALESCE onto the parent event's started_at defends against any
         // legacy/edge row the backfill left null.
-        `SELECT COALESCE(f.first_detected_at, e.started_at) AS first_detected_at, d.severity AS severity,
+        `SELECT DISTINCT f.finding_key AS finding_key,
+                COALESCE(f.first_detected_at, e.started_at) AS first_detected_at, d.severity AS severity,
                 latest.status AS latest_status,
                 latest.method AS latest_method,
                 latest.resolved_at AS latest_resolved_at
-         FROM inspection_findings f
-         JOIN audit_events e ON e.id = f.audit_event_id
-         JOIN inspection_definitions d ON d.id = f.inspection_definition_id
+         FROM finding_resolution fr
+         CROSS JOIN inspection_findings f ON f.finding_key = fr.finding_key
+         CROSS JOIN audit_events e ON e.id = f.audit_event_id
+         CROSS JOIN inspection_definitions d ON d.id = f.inspection_definition_id
          LEFT JOIN ${LATEST_RESOLUTION_BY_KEY_SQL} latest
            ON latest.finding_key = f.finding_key
-         WHERE f.finding_key IS NOT NULL
-           AND e.event_type IN (${CAPTURE_EVENT_TYPES_SQL})
-           AND EXISTS (
-             SELECT 1 FROM finding_resolution fr
-              WHERE fr.finding_key = f.finding_key
-                AND fr.resolved_at >= :windowStart
-           )`
-        // The EXISTS is a SUPERSET prefilter that bounds the scan to keys with
-        // any resolution activity at/after the window start — a row this method
+         WHERE fr.resolved_at >= :windowStart
+           AND e.event_type IN (${CAPTURE_EVENT_TYPES_SQL})`
+        // `fr` is a SUPERSET prefilter, not the answer: a finding this method
         // ultimately counts has its LATEST resolution inside the window, which
-        // implies such a row exists, so nothing wanted is dropped. The exact
-        // latest-wins + status/method + window gate stays in JS below,
-        // dialect-agnostic. Without this, a
-        // 7d request evaluated the store's entire trackable-findings history.
+        // implies a resolution row at/after the window start exists, so nothing
+        // wanted is dropped. The exact latest-wins + status/method + window gate
+        // stays in JS below, dialect-agnostic. `f.finding_key IS NOT NULL` is
+        // implied rather than dropped — the join key comes from
+        // finding_resolution, whose finding_key is NOT NULL.
+        //
+        // IT IS THE DRIVING TABLE THAT MAKES THAT PREFILTER A BOUND, which is
+        // the correction this replaced. Spelled as an `EXISTS` in the WHERE it
+        // READ as a bound and was not one: SQLite drove from `audit_events` on
+        // event_type, joined every capture event to its findings, and evaluated
+        // the EXISTS last — bounding the RESULT and not the scan, so a 7d request
+        // still cost the store's whole trackable history. Measured at 44.6 ms on
+        // 50,000 events and 171.3 ms on 150,000 — linear in the STORE, and in
+        // both cases returning rows for a window holding a fraction of it.
+        //
+        // Two things carry it, and they answer DIFFERENT halves — which is worth
+        // stating precisely, because the obvious reading (both are needed for the
+        // speed) is wrong and was measured to be wrong:
+        //
+        //  - **`CROSS JOIN`** is the whole of the store-size fix. In SQLite the
+        //    keyword is semantically identical to JOIN and exists only to stop the
+        //    tables being reordered; with plain JOINs the planner puts `e` back on
+        //    the outside, because with no ANALYZE statistics it prices
+        //    `event_type IN (...)` as a selective probe. Reverting it alone takes
+        //    the 2k->20k flatness ratio from 1.32 to 16.87.
+        //  - **`idx_finding_resolution_resolved_at`** (migration 0021) makes
+        //    `resolved_at >= :windowStart` a range SEARCH instead of a bare
+        //    `SCAN fr` — finding_key was this table's only index before it, so the
+        //    range had none. It buys NO flatness in store size: remove it and the
+        //    ratio above does not move, because the latest-resolution derived
+        //    table already passes over the whole of finding_resolution, so this
+        //    read is O(resolutions) either way and resolutions are not the store.
+        //    What it buys is the criterion `hot-read-query-plans.test.ts` enforces
+        //    — no hot read may pass over a table with no index — and that is the
+        //    guard that goes red when it is dropped. Neither test catches the
+        //    other's defect.
+        //
+        // SELECT DISTINCT is a CORRECTNESS requirement of driving from `fr`, not a
+        // tidy-up. finding_resolution is append-only, so a key that was fixed,
+        // redetected and fixed again carries several rows inside one window and
+        // matches once per row — and the value below is a MEAN, so a key matched
+        // three times is a key weighted three times.
+        //
+        // The skew is easy to argue away and the argument is wrong, so it is worth
+        // recording. Duplicate rows for ONE key are identical (every projected
+        // column is per-key: `latest.*` is latest-wins, `first_detected_at` is
+        // preserved), so sums and counts scale together and that key's own mean
+        // does not move. What moves is a bucket holding TWO findings that duplicate
+        // UNEQUALLY: three rows for a 5.9-day fix and one for a 1.9-day fix average
+        // 4.9 days weighted against 3.9 unweighted. Measured, and pinned by
+        // `security.test.ts`'s "weights a finding ONCE however many resolution rows
+        // it has inside the window" — which needed a fixture built for it, since no
+        // single-key case can show it.
+        //
+        // `finding_key` is selected to make the DISTINCT dedup by KEY rather than
+        // by value tuple. On the other columns alone, two genuinely different
+        // findings sharing a severity, a first-detection event and a resolution
+        // instant — one commit fixing two secrets in one file — are one tuple, and
+        // collapsing them would under-count in the other direction.
       ),
       { windowStart }
     );
@@ -23996,16 +24267,47 @@ var SqliteSecurityRepository = class {
   }
   // Recently-resolved activity feed: findings whose finding_key's LATEST
   // finding_resolution row is status:'resolved'/method:'fixed-at-source' —
-  // same latest-resolution-wins correlated subquery as severitySummary /
-  // mttrTrend (NOT a plain JOIN, which would surface every historical
-  // resolution row for a key rather than just its current disposition). A key
-  // whose latest row is a superseding 'open'/'redetected' row (the same
-  // secret came back) is excluded — it is not currently resolved. Legacy
-  // at-rest findings with finding_key IS NULL are excluded outright (the
-  // resolution lifecycle can never attach to them). Path comes from the
-  // finding's parent event (event_type 'code_change', attributes.file_path) —
-  // mirrors resolutions.ts's openAtRestStmt accessor. Ordered by resolved_at
-  // DESC, capped at `limit`.
+  // same latest-resolution-wins derived table as severitySummary / mttrTrend
+  // (NOT a plain JOIN, which would surface every historical resolution row for
+  // a key rather than just its current disposition). A key whose latest row is
+  // a superseding 'open'/'redetected' row (the same secret came back) is
+  // excluded — it is not currently resolved. Legacy at-rest findings with
+  // finding_key IS NULL are excluded outright (the resolution lifecycle can
+  // never attach to them). Path comes from the finding's parent event
+  // (event_type 'code_change', attributes.file_path) — mirrors resolutions.ts's
+  // openAtRestStmt accessor. Ordered by resolved_at DESC, capped at `limit`.
+  //
+  // THE RESOLUTION SET DRIVES THIS QUERY, and that is a correctness property of
+  // the plan rather than a preference. Written the other way round — driving
+  // from inspection_findings/audit_events with `latest` LEFT JOINed on — SQLite
+  // cannot use the join key: `f` is reached FROM `latest` by finding_key, so
+  // `latest` gets probed on (rn, status, method) instead and the plan enumerates
+  // every (code_change event x resolved key) pair before `f` can reject it. That
+  // is a cross product, and it is quadratic in the store: measured at 10,966 ms
+  // on a corpus of 50,000 events carrying 2,051 resolutions, against 20 rows
+  // returned. It was invisible for as long as it was, and reported at 8 ms,
+  // because an empty finding_resolution table makes the inner side empty and the
+  // cross product collapses to nothing — so the shape is only observable on a
+  // corpus that seeds resolutions.
+  //
+  // Driving from `latest` instead makes every step below it a unique-index or
+  // primary-key lookup (uq_inspection_findings_key, then audit_events' own PK),
+  // so the cost is the derived table's own — linear in resolutions, which is
+  // what this feed is legitimately about.
+  //
+  // CROSS JOIN is what actually pins that, and it is load-bearing rather than
+  // decorative: in SQLite the keyword is semantically identical to JOIN and
+  // exists only to stop the optimizer reordering the tables. Written as plain
+  // JOINs in this order the planner puts `e` back on the outside — it has no
+  // ANALYZE statistics to price the alternatives with, so it takes
+  // `event_type = 'code_change'` for a selective index probe and rebuilds the
+  // cross product. The FROM order alone was measured to change the plan not at
+  // all.
+  //
+  // The LEFT JOIN it replaced was already an inner join in effect: three
+  // `latest.*` predicates sit in the WHERE, and each of them is false for a
+  // null-extended row. Spelling it JOIN changes no row and stops the plan
+  // reading as though the findings side could drive.
   recentlyResolved(limit = 20) {
     const rows = allRows(
       this.db.prepare(
@@ -24015,17 +24317,15 @@ var SqliteSecurityRepository = class {
                 json_extract(e.attributes, '$.file_path') AS path,
                 COALESCE(f.first_detected_at, e.started_at) AS first_detected_at,
                 latest.resolved_at AS latest_resolved_at
-         FROM inspection_findings f
-         JOIN audit_events e ON e.id = f.audit_event_id
-         JOIN inspection_definitions d ON d.id = f.inspection_definition_id
-         LEFT JOIN ${LATEST_RESOLUTION_BY_KEY_SQL} latest
-           ON latest.finding_key = f.finding_key
-         WHERE e.event_type = 'code_change'
-           AND f.finding_key IS NOT NULL
-           AND latest.status = 'resolved'
+         FROM ${LATEST_RESOLUTION_BY_KEY_SQL} latest
+         CROSS JOIN inspection_findings f ON f.finding_key = latest.finding_key
+         CROSS JOIN audit_events e ON e.id = f.audit_event_id
+         CROSS JOIN inspection_definitions d ON d.id = f.inspection_definition_id
+         WHERE latest.status = 'resolved'
            AND latest.method = 'fixed-at-source'
            AND latest.resolved_at IS NOT NULL
-         ORDER BY latest_resolved_at DESC
+           AND e.event_type = 'code_change'
+         ORDER BY latest.resolved_at DESC
          LIMIT :limit`
       ),
       { limit }
@@ -24962,6 +25262,7 @@ function openAndInitialize(file2) {
 function openLocalDatabase(dir) {
   ensureDataDirSync(dir);
   const file2 = join2(dir, DB_FILENAME);
+  reapStalePartials(file2);
   const {
     db,
     events,
@@ -25389,11 +25690,79 @@ function migrateLegacyLayout(base = defaultDataDir()) {
   }
 }
 
-// ../../packages/persistence/src/settings.ts
+// ../../packages/persistence/src/managed-settings.ts
 import { readFileSync as readFileSync3 } from "fs";
+import { posix, win32 } from "path";
+function managedSettingsPaths(platform2 = process.platform) {
+  if (platform2 === "darwin") {
+    return [
+      posix.join("/Library", "Application Support", "AKASecurity", MANAGED_SETTINGS_FILENAME),
+      posix.join("/Library", "Managed Preferences", MANAGED_SETTINGS_FILENAME)
+    ];
+  }
+  if (platform2 === "win32") {
+    return [win32.join("C:\\", "ProgramData", "AKASecurity", MANAGED_SETTINGS_FILENAME)];
+  }
+  return [posix.join("/etc", "aka", MANAGED_SETTINGS_FILENAME)];
+}
+function readManagedSettings(paths = managedSettingsPaths()) {
+  for (const path of paths) {
+    let text;
+    try {
+      text = readFileSync3(path, "utf8");
+    } catch {
+      continue;
+    }
+    const record2 = parseJsonObject(text);
+    if (!record2) continue;
+    const parsed = ManagedSettings.safeParse(record2);
+    if (parsed.success) return parsed.data;
+  }
+  return null;
+}
+function overlayManagedSettings(settings, managed, now = () => /* @__PURE__ */ new Date()) {
+  if (!managed) return settings;
+  const { values } = managed;
+  const merged = { ...settings };
+  if (values.runMode !== void 0) merged.runMode = values.runMode;
+  if (values.controlPlane !== void 0) {
+    merged.controlPlane = {
+      ...values.controlPlane,
+      // The administrator pinned WHICH deployment, not WHEN this machine
+      // joined it. Keep the user's own attach time when the endpoint is
+      // unchanged, so a managed machine does not appear to re-attach on every
+      // read; stamp a fresh one when the administrator moved it.
+      attachedAt: settings.controlPlane?.endpoint === values.controlPlane.endpoint ? settings.controlPlane.attachedAt : now().toISOString()
+    };
+  }
+  if (values.historicalAccess !== void 0) merged.historicalAccess = values.historicalAccess;
+  if (values.vaultKeyCustody !== void 0) merged.vaultKeyCustody = values.vaultKeyCustody;
+  if (values.vaultInlineReveal !== void 0) merged.vaultInlineReveal = values.vaultInlineReveal;
+  if (values.dataSharesInPlace !== void 0) merged.dataSharesInPlace = values.dataSharesInPlace;
+  if (values.vaultConsent !== void 0) {
+    merged.vaultConsent = values.vaultConsent ? (
+      // Keep an existing valid grant so its acknowledgedAt survives; mint one
+      // at the current version otherwise.
+      settings.vaultConsent?.version === VAULT_CONSENT_VERSION ? settings.vaultConsent : { acknowledgedAt: now().toISOString(), version: VAULT_CONSENT_VERSION }
+    ) : void 0;
+  }
+  if (values.modelJudgeConsent !== void 0) {
+    merged.modelJudgeConsent = values.modelJudgeConsent ? settings.modelJudgeConsent?.payloadVersion === MODEL_JUDGE_PAYLOAD_VERSION ? settings.modelJudgeConsent : {
+      acknowledgedAt: now().toISOString(),
+      payloadVersion: MODEL_JUDGE_PAYLOAD_VERSION
+    } : void 0;
+  }
+  return merged;
+}
+
+// ../../packages/persistence/src/settings.ts
+import { readFileSync as readFileSync4 } from "fs";
 import { join as join5 } from "path";
 var SETTINGS_FILENAME = "settings.json";
 function readWorkspaceSettings(base = defaultDataDir()) {
+  return overlayManagedSettings(readUserSettings(base), readManagedSettings());
+}
+function readUserSettings(base) {
   const record2 = readJson(join5(settingsDir(base), SETTINGS_FILENAME));
   if (!record2) return defaultWorkspaceSettings();
   try {
@@ -25405,7 +25774,7 @@ function readWorkspaceSettings(base = defaultDataDir()) {
 function readJson(file2) {
   let text;
   try {
-    text = readFileSync3(file2, "utf8");
+    text = readFileSync4(file2, "utf8");
   } catch {
     return null;
   }
@@ -25523,15 +25892,7 @@ function formatPointer(category, keyVersion, pointerId, tag) {
 // ../../packages/persistence/src/vault/key-provider.ts
 import { execFileSync } from "child_process";
 import { randomBytes as randomBytes2 } from "crypto";
-import {
-  chmodSync as chmodSync2,
-  mkdirSync as mkdirSync2,
-  readFileSync as readFileSync4,
-  renameSync as renameSync4,
-  rmSync as rmSync4,
-  statSync as statSync3,
-  writeFileSync as writeFileSync3
-} from "fs";
+import { chmodSync as chmodSync2, readFileSync as readFileSync5, renameSync as renameSync4, rmSync as rmSync4, statSync as statSync3, writeFileSync as writeFileSync3 } from "fs";
 import { join as join6 } from "path";
 var VAULT_OCCUPANT_REASON = {
   symlink: "the path is a symlink; remove it so a keyring can be created",
@@ -25624,7 +25985,8 @@ var LOCK_OWNER_FILE = "owner";
 var ROTATION_IN_PROGRESS = "vault: a key rotation is already in progress";
 function claimRotationLock(lock, owner) {
   try {
-    mkdirSync2(lock);
+    mkdirOwnerOnlySync(lock);
+    tightenDir(lock);
   } catch (err) {
     if (err.code === "EEXIST") return false;
     throw asError(err);
@@ -25666,7 +26028,7 @@ function acquireRotationLock(keysDir2) {
 }
 function releaseRotationLock(lease) {
   try {
-    if (readFileSync4(join6(lease.lock, LOCK_OWNER_FILE), "utf8").trim() !== lease.owner) return;
+    if (readFileSync5(join6(lease.lock, LOCK_OWNER_FILE), "utf8").trim() !== lease.owner) return;
   } catch {
     return;
   }
@@ -25717,7 +26079,7 @@ var FileKeyProvider = class {
   #read() {
     let raw;
     try {
-      raw = readFileSync4(this.filePath, "utf8");
+      raw = readFileSync5(this.filePath, "utf8");
     } catch (err) {
       if (err.code === "ENOENT") return null;
       throw err instanceof Error ? err : new Error(String(err));
@@ -25756,15 +26118,19 @@ var FileKeyProvider = class {
    * Atomic tmp + rename so a crash mid-write cannot truncate the keyring.
    * Used only for rotation, under the rotation lock — first creation goes
    * through the creation-exclusive path instead.
+   *
+   * Delegated to the shared owner-only write rather than spelled here, so the
+   * create mode this file is published at is the one paths.ts owns and tests
+   * directly. A local copy of the pair was a second place the mode could be
+   * dropped with the trailing tighten still repairing the end state, which is
+   * the shape no assertion on a published file can see. It also picks up that
+   * primitive's per-process tmp name, its stale-tmp sweep, and an exclusive
+   * create that refuses to follow a symlink planted at the tmp path.
    */
   #write(keyring) {
     ensureDataDirSync(this.#keysDir);
-    const file2 = this.filePath;
-    const tmp = `${file2}.tmp`;
-    writeFileSync3(tmp, `${serializeKeyring(keyring)}
-`, { mode: DATA_FILE_MODE });
-    renameSync4(tmp, file2);
-    tightenFileMode(file2);
+    writeOwnerOnlyFileSync(this.filePath, `${serializeKeyring(keyring)}
+`);
     return keyring;
   }
 };
@@ -25774,15 +26140,73 @@ function tightenFileMode(file2) {
   } catch {
   }
 }
-var runSecurity = (args) => execFileSync("/usr/bin/security", args, {
+var SECURITY_TIMEOUT_MS = 5e3;
+var runSecurity = (args, stdin) => execFileSync("/usr/bin/security", args, {
   encoding: "utf8",
-  stdio: ["ignore", "pipe", "ignore"]
+  input: stdin,
+  timeout: SECURITY_TIMEOUT_MS,
+  // stderr is discarded rather than captured, and that is deliberate: a
+  // captured stream rides out on an execFileSync error's `.stderr`, and the
+  // write paths here carry the keyring. Exit status is the only thing any
+  // branch below reads.
+  stdio: [stdin === void 0 ? "ignore" : "pipe", "pipe", "ignore"]
 });
 var SECURITY_ITEM_NOT_FOUND = 44;
+function corruptReason(err) {
+  if (err instanceof SyntaxError) return "malformed JSON";
+  return err instanceof Error ? err.message : "unknown";
+}
+function securityFailureMeta(err) {
+  const e = err;
+  const parts = [];
+  if (typeof e.status === "number") parts.push(`exit ${String(e.status)}`);
+  if (typeof e.signal === "string" && e.signal) parts.push(`signal ${e.signal}`);
+  if (typeof e.code === "string" && e.code) parts.push(e.code);
+  return parts.length > 0 ? parts.join(", ") : "unknown error";
+}
+function writeCommand(keyring, update, keychain) {
+  const hex3 = Buffer.from(serializeKeyring(keyring), "utf8").toString("hex");
+  const parts = [
+    "add-generic-password",
+    ...update ? ["-U"] : [],
+    "-s",
+    KEYCHAIN_SERVICE,
+    "-a",
+    KEYCHAIN_ACCOUNT,
+    "-X",
+    hex3
+  ];
+  if (keychain !== void 0) {
+    if (/['\\\n\r\0]/.test(keychain)) {
+      throw new Error(
+        "vault: keychain path contains a quote, backslash, line break or NUL, which security -i cannot carry intact"
+      );
+    }
+    parts.push(`'${keychain}'`);
+  }
+  return `${parts.join(" ")}
+`;
+}
 var KeychainKeyProvider = class {
   #keysDir;
   #exec;
-  constructor(keysDir2, exec = runSecurity) {
+  #keychain;
+  /**
+   * The trailing keychain argument, or nothing. Every subcommand used here
+   * takes it last (`add-generic-password [keychain]`,
+   * `find-generic-password [keychain...]`), and omitting it means the default
+   * search list. Fixed at construction, so it is built once rather than per
+   * call on the capture path.
+   */
+  #target;
+  /**
+   * `keychain` names the keychain to operate on, as `security`'s trailing
+   * argument. Production passes nothing and gets the user's default keychain,
+   * which is the whole point of the backend. A test driving the REAL binary
+   * passes a throwaway one, because the alternative is writing vault key
+   * material into the developer's own login keychain and leaving it there.
+   */
+  constructor(keysDir2, exec = runSecurity, keychain) {
     if (exec === runSecurity && process.platform !== "darwin") {
       throw new Error(
         `keychain custody is not available on this platform (${process.platform}); use file custody`
@@ -25790,6 +26214,8 @@ var KeychainKeyProvider = class {
     }
     this.#keysDir = keysDir2;
     this.#exec = exec;
+    this.#keychain = keychain;
+    this.#target = keychain === void 0 ? [] : [keychain];
   }
   /** Where a fallback file provider for the same vault would keep its keyring. */
   get keysDir() {
@@ -25828,18 +26254,22 @@ var KeychainKeyProvider = class {
         KEYCHAIN_SERVICE,
         "-a",
         KEYCHAIN_ACCOUNT,
-        "-w"
+        "-w",
+        ...this.#target
       ]);
     } catch (err) {
       if (err.status === SECURITY_ITEM_NOT_FOUND) return null;
       throw new Error(
-        `vault: keychain read failed (${err instanceof Error ? err.message : String(err)}); refusing to treat the failure as an absent keyring`,
-        { cause: err }
+        `vault: keychain read failed (${securityFailureMeta(err)}); refusing to treat the failure as an absent keyring`
       );
     }
     const body = raw.trim();
     if (body.length === 0) return null;
-    return parseKeyring(body);
+    try {
+      return parseKeyring(body);
+    } catch (err) {
+      throw new Error(`vault: keychain item is not a usable keyring (${corruptReason(err)})`);
+    }
   }
   /**
    * First mint: a plain `add-generic-password` (no `-U`) fails when an item
@@ -25847,37 +26277,25 @@ var KeychainKeyProvider = class {
    * keyring — the loser re-reads and adopts it instead.
    */
   #create(keyring) {
-    const args = [
-      "add-generic-password",
-      "-s",
-      KEYCHAIN_SERVICE,
-      "-a",
-      KEYCHAIN_ACCOUNT,
-      "-w",
-      serializeKeyring(keyring)
-    ];
+    const line = writeCommand(keyring, false, this.#keychain);
     try {
-      this.#exec(args);
+      this.#exec(["-i"], line);
     } catch (err) {
       const winner = this.#read();
       if (winner) return winner;
-      throw asError(err);
+      throw new Error(`vault: keychain write failed (${securityFailureMeta(err)})`);
     }
     return keyring;
   }
   // `-U` updates the item in place, deliberately replacing the stored map with
   // one that contains it — used only for rotation, under the rotation lock.
   #replace(keyring) {
-    this.#exec([
-      "add-generic-password",
-      "-U",
-      "-s",
-      KEYCHAIN_SERVICE,
-      "-a",
-      KEYCHAIN_ACCOUNT,
-      "-w",
-      serializeKeyring(keyring)
-    ]);
+    const line = writeCommand(keyring, true, this.#keychain);
+    try {
+      this.#exec(["-i"], line);
+    } catch (err) {
+      throw new Error(`vault: keychain write failed (${securityFailureMeta(err)})`);
+    }
     return keyring;
   }
 };
@@ -26387,7 +26805,7 @@ function resolveProviderSafe(resolveProviderFn) {
 }
 
 // ../../packages/plugin-sdk/src/config-inventory.ts
-import { readdirSync as readdirSync2, readFileSync as readFileSync6, realpathSync, statSync as statSync5 } from "fs";
+import { readdirSync as readdirSync2, readFileSync as readFileSync7, realpathSync, statSync as statSync5 } from "fs";
 import { homedir as homedir2 } from "os";
 import { basename as basename3, join as join10 } from "path";
 
@@ -26963,6 +27381,40 @@ function escapeRegExp2(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
+// ../../packages/detections/src/regex-cache.ts
+var singles = /* @__PURE__ */ new WeakMap();
+var keywordLists = /* @__PURE__ */ new WeakMap();
+var labelLists = /* @__PURE__ */ new WeakMap();
+function listCache(kind) {
+  return kind === "keyword" ? keywordLists : labelLists;
+}
+function memoizedRegExp(owner, build) {
+  const cached2 = singles.get(owner);
+  if (cached2 !== void 0) {
+    cached2.lastIndex = 0;
+    return cached2;
+  }
+  const compiled = build();
+  singles.set(owner, compiled);
+  return compiled;
+}
+function memoizedRegExpList(kind, owner, build) {
+  const cache = listCache(kind);
+  const cached2 = cache.get(owner);
+  if (cached2 !== void 0) {
+    if (cached2.stateful) {
+      for (const re of cached2.entries) if (re !== void 0) re.lastIndex = 0;
+    }
+    return cached2.entries;
+  }
+  const entries = build();
+  cache.set(owner, {
+    entries,
+    stateful: entries.some((re) => re !== void 0 && (re.global || re.sticky))
+  });
+  return entries;
+}
+
 // ../../packages/detections/src/matchers/limits.ts
 var MAX_MATCHES_PER_RULE = 1e4;
 var MAX_REGEX_INPUT_LENGTH = 2e5;
@@ -26973,10 +27425,17 @@ var KeywordMatcher2 = class {
     if (rule.matcher.type !== "keyword") return [];
     const { keywords, caseSensitive } = rule.matcher;
     const spans = [];
-    for (const kw of keywords) {
-      if (kw.length === 0) continue;
+    const compiled = memoizedRegExpList(
+      "keyword",
+      rule.matcher,
+      () => keywords.map((kw) => {
+        if (kw.length === 0) return void 0;
+        return new RegExp(escapeRegExp2(kw), caseSensitive ? "gu" : "giu");
+      })
+    );
+    for (const re of compiled) {
+      if (re === void 0) continue;
       if (spans.length >= MAX_MATCHES_PER_RULE) break;
-      const re = new RegExp(escapeRegExp2(kw), caseSensitive ? "gu" : "giu");
       let m;
       while ((m = re.exec(text)) !== null) {
         spans.push({ start: m.index, end: m.index + m[0].length });
@@ -26992,7 +27451,10 @@ var RegexMatcher2 = class {
   match(text, rule) {
     if (rule.matcher.type !== "regex") return [];
     const { pattern, flags, captureGroup } = rule.matcher;
-    const re = new RegExp(pattern, flags.includes("d") ? flags : `${flags}d`);
+    const re = memoizedRegExp(
+      rule.matcher,
+      () => new RegExp(pattern, flags.includes("d") ? flags : `${flags}d`)
+    );
     const scanText2 = text.length > MAX_REGEX_INPUT_LENGTH ? text.slice(0, MAX_REGEX_INPUT_LENGTH) : text;
     const spans = [];
     let m;
@@ -27051,6 +27513,10 @@ function luhnCheck(digits) {
 // ../../packages/detections/src/engine.ts
 var keywordMatcher = new KeywordMatcher2();
 var regexMatcher = new RegexMatcher2();
+var MATCHERS = {
+  keyword: (text, rule) => keywordMatcher.match(text, rule),
+  regex: (text, rule) => regexMatcher.match(text, rule)
+};
 var packs = /* @__PURE__ */ new Map();
 var POST_VALIDATORS = {
   entropy: (value, config2) => isHighEntropy(value, numberOption(config2, "threshold"), numberOption(config2, "minLength")),
@@ -27066,8 +27532,7 @@ function passesPostValidators(rule, value) {
   for (const ref of validators) {
     const name = typeof ref === "string" ? ref : ref.name;
     const config2 = typeof ref === "string" ? void 0 : ref.config;
-    const validate = POST_VALIDATORS[name];
-    if (validate && !validate(value, config2)) return false;
+    if (!POST_VALIDATORS[name](value, config2)) return false;
   }
   return true;
 }
@@ -27100,11 +27565,15 @@ function isCorroborated(candidate, candidates, text) {
   const labels = req.labels;
   if (labels && labels.length > 0) {
     const haystack = text.slice(Math.max(0, winStart), winEnd);
-    for (const label of labels) {
-      const trimmed = label.trim();
-      if (trimmed.length === 0) continue;
-      const re = new RegExp(`(?<![A-Za-z0-9])${escapeRegExp2(trimmed)}(?![A-Za-z0-9])`, "i");
-      if (re.test(haystack)) return true;
+    for (const re of memoizedRegExpList(
+      "label",
+      req,
+      () => labels.map((label) => {
+        const trimmed = label.trim();
+        return trimmed.length === 0 ? void 0 : new RegExp(`(?<![A-Za-z0-9])${escapeRegExp2(trimmed)}(?![A-Za-z0-9])`, "i");
+      })
+    )) {
+      if (re?.test(haystack)) return true;
     }
   }
   return false;
@@ -27124,14 +27593,7 @@ function scan(text, rules, context) {
   const candidates = [];
   for (const rule of ruleset) {
     if (!ruleApplies(rule, extension)) continue;
-    let spans;
-    if (rule.matcher.type === "keyword") {
-      spans = keywordMatcher.match(text, rule);
-    } else if (rule.matcher.type === "regex") {
-      spans = regexMatcher.match(text, rule);
-    } else {
-      continue;
-    }
+    const spans = MATCHERS[rule.matcher.type](text, rule);
     for (const span of spans) {
       const rawMatch = text.slice(span.start, span.end);
       if (!passesPostValidators(rule, rawMatch)) continue;
@@ -27287,6 +27749,7 @@ var CONFIG_POSTURE_RULES = [
 ];
 
 // ../../packages/detections/src/security/redos-probe.ts
+var BUDGET_MS = 100;
 var EXPONENTIAL_UNITS = [
   "a",
   "0",
@@ -27310,6 +27773,8 @@ var EXPONENTIAL_PROBES = EXPONENTIAL_UNITS.flatMap(
 var POLYNOMIAL_PROBES = ["abc-", "a.", "a ", "a=", "x", "0", "a@", "a/", "ab"].map(
   (unit) => unit.repeat(1e4).slice(0, 4e4) + "!"
 );
+var CPU_CORROBORATION_SHARE = 0.2;
+var CORROBORATION_FLOOR_MS = BUDGET_MS * CPU_CORROBORATION_SHARE;
 
 // ../../rules/code-flaws/auth-jwt-no-verify.json
 var auth_jwt_no_verify_default = {
@@ -29386,7 +29851,7 @@ function scanText(text, ruleVersions) {
 }
 
 // ../../packages/plugin-sdk/src/repo.ts
-import { existsSync as existsSync6, readFileSync as readFileSync5, statSync as statSync4 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync6, statSync as statSync4 } from "fs";
 import { basename as basename2, dirname as dirname2, isAbsolute, join as join9, sep as sep2 } from "path";
 function resolveRepoIdentity(cwd) {
   try {
@@ -29449,7 +29914,7 @@ function resolveGitContext(root) {
 }
 function safeRead(path) {
   try {
-    return readFileSync5(path, "utf8");
+    return readFileSync6(path, "utf8");
   } catch {
     return void 0;
   }
@@ -29507,6 +29972,11 @@ import { existsSync as existsSync7 } from "fs";
 import { fileURLToPath } from "url";
 import { Worker } from "worker_threads";
 
+// ../../packages/plugin-sdk/src/ignore-layers.ts
+var import_ignore = __toESM(require_ignore(), 1);
+import { readFileSync as readFileSync8 } from "fs";
+import { join as join11 } from "path";
+
 // ../../packages/plugin-sdk/src/inventory-resolver.ts
 import { arch, hostname as hostname4, platform, release } from "os";
 function resolveInventoryContext(input) {
@@ -29537,17 +30007,16 @@ function resolveInventoryContext(input) {
 }
 
 // ../../packages/plugin-sdk/src/nudge.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync5 } from "fs";
-import { join as join11 } from "path";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync9, writeFileSync as writeFileSync5 } from "fs";
+import { join as join12 } from "path";
 
 // ../../packages/plugin-sdk/src/paths.ts
 import { readdirSync as readdirSync3, realpathSync as realpathSync2 } from "fs";
 import { basename as basename4, dirname as dirname3, sep as sep3 } from "path";
 
 // ../../packages/plugin-sdk/src/project-files.ts
-var import_ignore = __toESM(require_ignore(), 1);
-import { existsSync as existsSync8, readdirSync as readdirSync4, readFileSync as readFileSync8 } from "fs";
-import { basename as basename5, join as join12, relative, sep as sep4 } from "path";
+import { existsSync as existsSync8, readdirSync as readdirSync4 } from "fs";
+import { basename as basename5, join as join13 } from "path";
 
 // ../../packages/plugin-sdk/src/provider-env-antigravity.ts
 var optionalBaseUrl2 = external_exports.preprocess((v) => {
@@ -29582,8 +30051,8 @@ import { randomUUID as randomUUID14 } from "crypto";
 var THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1e3;
 
 // ../../packages/plugin-sdk/src/throttle.ts
-import { mkdirSync as mkdirSync4, statSync as statSync6, writeFileSync as writeFileSync6 } from "fs";
-import { join as join13 } from "path";
+import { mkdirSync as mkdirSync3, statSync as statSync6, writeFileSync as writeFileSync6 } from "fs";
+import { join as join14 } from "path";
 
 // ../../packages/plugin-sdk/src/tokenize.ts
 function redactedPlaceholder(category) {
@@ -29646,6 +30115,8 @@ var SecretVaultGlue = class {
   async tokenizeText(text, opts) {
     try {
       const findings = opts?.findings ?? this.#selfScan(text);
+      const reversible = opts?.reversible;
+      const keeps = (finding) => reversible === void 0 || reversible.has(finding);
       if (findings === null) return { text: "[REDACTED]", pointers: [], degraded: [] };
       if (findings.length === 0) return { text, pointers: [], degraded: [] };
       const groups = groupSpans(text, findings);
@@ -29662,6 +30133,8 @@ var SecretVaultGlue = class {
         } else if (original !== finding.rawMatch) {
           replacement = redactedPlaceholder(group.category);
           degraded.unshift({ category: group.category });
+        } else if (!keeps(finding)) {
+          replacement = redactedPlaceholder(finding.category);
         } else {
           replacement = await this.tokenizeValue(finding.rawMatch, {
             ruleId: finding.ruleId,
@@ -29892,6 +30365,8 @@ var StandaloneDataGateway = class {
   db;
   // Kept for the fingerprint key lookup (exception.key lives beside the store).
   dataDir;
+  // One notice per gateway — see warnRulesetDiscarded.
+  warnedRulesetDiscarded = false;
   constructor(dataDir2, detections = [], meta3) {
     this.db = openLocalDatabase(dataDir2);
     this.dataDir = dataDir2;
@@ -30011,28 +30486,69 @@ var StandaloneDataGateway = class {
   //   - ANY invalid rule among enabled packs (all-invalid, partial corruption,
   //     or a single malformed entry) → undefined → bundled fallback. Serving a
   //     reduced "complete" set would silently drop exactly the corrupted rules
-  //     with no fallback; the bundled packs are a superset, so falling back
-  //     never loses coverage. Steady-state installed rules are all valid
-  //     (generated + Zod-checked), so this only fires on a genuinely
-  //     malformed/foreign store;
+  //     with no fallback. The bundled packs are a superset of AKA's OWN packs,
+  //     so falling back never loses coverage there — but they contain no
+  //     pulled or custom pack, so for those this trades a partial ruleset for
+  //     none of them plus the loss of every pack's per-detection enforcement
+  //     action. That is deliberate (a store this machine cannot fully validate
+  //     is not authoritative), and it is why the cost of REJECTING a rule
+  //     matters: `Rule` is strict, so one unrecognized key in one custom rule
+  //     reaches this branch, not just a genuinely malformed or foreign store.
+  //     `installed-packs.test.ts` pins that per-rule counting;
   //   - enabled packs that produce ZERO rules with no invalids (e.g. every
   //     enabled pack's rules_json is `[]`) → undefined → bundled fallback: an
   //     enabled pack contributing nothing is untrustworthy, not a real
   //     "detect nothing" (that is expressed by disabling packs, handled above);
   //   - otherwise → the enabled packs' validated rules, marked complete.
+  /**
+   * The discard above is the one ruleset decision this gateway reaches on its
+   * own, and it is the most expensive one here: ONE rejected entry costs the
+   * user every custom rule and every per-detection enforcement action, replaced
+   * by bundled packs that contain neither. Nothing else reports it — a hook is a
+   * short-lived process whose stderr is the only channel it has — so name what
+   * was rejected and where the rest of the list lives.
+   *
+   * Unlike a quarantine verdict this caches nothing: the rejection is re-derived
+   * from the store on every run, so the recovery is to fix or reinstall the pack,
+   * and no line here may offer a command that clears a stored verdict.
+   *
+   * Written at most once per gateway — a second getPolicyBundle() in the same
+   * process would re-report the same finding.
+   */
+  warnRulesetDiscarded(snapshot) {
+    if (this.warnedRulesetDiscarded) return;
+    this.warnedRulesetDiscarded = true;
+    const listed = snapshot.rejectedRules.map((r) => `${r.pack}${r.ruleId === null ? "" : ` "${r.ruleId}"`} (${r.reason})`).join(", ");
+    const undisclosed = snapshot.invalidRules - snapshot.rejectedRules.length;
+    const more = undisclosed > 0 ? `, and ${String(undisclosed)} more` : "";
+    process.stderr.write(
+      `[aka] installed ruleset not used: ${String(snapshot.invalidRules)} rule(s) under enabled packs failed validation, so scanning fell back to the bundled packs and no custom rule or per-detection action is enforced \u2014 rejected: ${listed}${more}; review them with \`aka detections\`
+`
+    );
+  }
   installedScanRules() {
     try {
       const snapshot = this.db.installedPacks.installedRuleset();
       if (snapshot.installedPacks === 0) return void 0;
       if (snapshot.enabledPacks === 0) {
-        return { rules: [], ruleActions: /* @__PURE__ */ new Map(), ruleVersions: /* @__PURE__ */ new Map(), complete: true };
+        return {
+          rules: [],
+          ruleActions: /* @__PURE__ */ new Map(),
+          ruleVersions: /* @__PURE__ */ new Map(),
+          reversibleRules: /* @__PURE__ */ new Set(),
+          complete: true
+        };
+      }
+      if (snapshot.invalidRules > 0) {
+        this.warnRulesetDiscarded(snapshot);
+        return void 0;
       }
-      if (snapshot.invalidRules > 0) return void 0;
       if (snapshot.rules.length === 0) return void 0;
       return {
         rules: snapshot.rules,
         ruleActions: snapshot.ruleActions,
         ruleVersions: snapshot.ruleVersions,
+        reversibleRules: snapshot.reversibleRules,
         complete: true
       };
     } catch {
@@ -30060,6 +30576,11 @@ var StandaloneDataGateway = class {
     return {
       version: "local",
       policies: [...policies, ...rulePolicies],
+      // The reversibility half of each pack's assignment. Emitted only under the
+      // authoritative installed snapshot, exactly like rulePolicies above: the
+      // bundled-packs fallback carries no per-pack assignment, so it carries no
+      // reversibility either and every redaction there stays one-way.
+      reversibleRuleIds: installed ? [...installed.reversibleRules] : [],
       rules: installed ? installed.rules : [],
       ...installed ? { rulesComplete: true } : {},
       ...installed ? { ruleVersions: Object.fromEntries(installed.ruleVersions) } : {},
@@ -30078,29 +30599,32 @@ var StandaloneDataGateway = class {
     return this.db.exceptions.recordBlocked(entry);
   }
   // Retention sweep over TERMINAL exception rows (revoked / expired / budget
-  // exhausted) — standalone-only store maintenance, invoked from SessionStart,
-  // not part of the DataGateway port. Active grants are never touched.
+  // exhausted) — local-store maintenance, invoked from SessionStart through the
+  // LocalStoreMaintenance capability rather than the DataGateway port. Active
+  // grants are never touched.
   sweepTerminalExceptions(retentionMs) {
     return this.db.exceptions.sweepTerminal(retentionMs);
   }
-  // The warn-era enforcement cap, standalone-only store maintenance invoked
-  // from SessionStart, not part of the DataGateway port. Returns the number
-  // of block/redact rows capped to warn (0 for a redact-policy store or an
-  // already-capped one).
+  // The warn-era enforcement cap — local-store maintenance, invoked from
+  // SessionStart through the LocalStoreMaintenance capability rather than
+  // the DataGateway port. Returns the number of block/redact rows capped to
+  // warn (0 for a redact-policy store or an already-capped one).
   capWarnEraEnforcement(policyMode) {
     const { capped } = capWarnEraEnforcementOnce(this.db, policyMode, this.dataDir);
     return { capped };
   }
   // One project-file scan → the local project_file tree (one transaction inside
-  // the LocalDatabase, fail-open there). Like the sweep above, this is
-  // NOT part of the DataGateway port: the file tree is a local-store read model.
+  // the LocalDatabase, fail-open there). Like the sweep above, this is reached
+  // through the LocalStoreMaintenance capability rather than the DataGateway
+  // port: the file tree is a local-store read model.
   recordProjectFiles(projectId, scan2) {
     this.db.recordProjectFiles(projectId, scan2);
     return Promise.resolve();
   }
   // Fold ghost source_project rows minted by the pre-worktree-fix resolver
-  // (checkout-path identities) into the repo's canonical row. Standalone-only
-  // store maintenance, invoked from SessionStart. Fail-open in the store.
+  // (checkout-path identities) into the repo's canonical row. Local-store
+  // maintenance, invoked from SessionStart through the LocalStoreMaintenance
+  // capability. Fail-open in the store.
   reconcileWorktreeProjects(canonicalId, headRoot, worktreeRoot) {
     this.db.reconcileWorktreeProjects(canonicalId, headRoot, worktreeRoot);
     return Promise.resolve();
@@ -30111,10 +30635,10 @@ var StandaloneDataGateway = class {
    * executing the plugin generation they started with (Claude Code caches
    * plugin versions), and the write gate makes their installed-pack writes
    * silent no-ops — this is the one-line nudge telling the user WHY, and that
-   * a restart picks the newer plugin up. Standalone-only, invoked from
-   * SessionStart, not part of the DataGateway port. Fail-open: any error →
-   * null (no notice), and unparseable versions compare equal so garbage can
-   * never fire it.
+   * a restart picks the newer plugin up. Local-store maintenance, invoked
+   * from SessionStart through the LocalStoreMaintenance capability rather
+   * than the DataGateway port. Fail-open: any error → null (no notice), and
+   * unparseable versions compare equal so garbage can never fire it.
    */
   staleBinaryNotice(currentVersion) {
     try {
@@ -30192,7 +30716,8 @@ var StandaloneDataGateway = class {
 
 // ../../packages/plugin-runtime/src/resolve.ts
 var standaloneGatewayFactory = (config2, meta3) => new StandaloneDataGateway(config2.dataDir, bundledDetections(), meta3);
-function resolveDataGateway(config2, meta3, gatewayFactory = standaloneGatewayFactory) {
+var defaultGatewayFactory = standaloneGatewayFactory;
+function resolveDataGateway(config2, meta3, gatewayFactory = defaultGatewayFactory) {
   return gatewayFactory(config2, meta3);
 }
 
@@ -30201,15 +30726,15 @@ import { randomUUID as randomUUID16 } from "crypto";
 var EXCEPTION_RETENTION_MS = 90 * 24 * 60 * 60 * 1e3;
 
 // src/remediation/redact.ts
-import { readFileSync as readFileSync10, realpathSync as realpathSync3, renameSync as renameSync5, rmSync as rmSync5, writeFileSync as writeFileSync7 } from "fs";
-import { isAbsolute as isAbsolute2, relative as relative2, resolve } from "path";
+import { readFileSync as readFileSync11, realpathSync as realpathSync3, renameSync as renameSync5, rmSync as rmSync5, writeFileSync as writeFileSync7 } from "fs";
+import { isAbsolute as isAbsolute2, relative, resolve } from "path";
 
 // src/history/transcripts.ts
-import { readdirSync as readdirSync5, readFileSync as readFileSync9 } from "fs";
+import { readdirSync as readdirSync5, readFileSync as readFileSync10 } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join14 } from "path";
+import { join as join15 } from "path";
 function transcriptsDir(home) {
-  return join14(home ?? homedir3(), ".claude", "projects");
+  return join15(home ?? homedir3(), ".claude", "projects");
 }
 function isRecord(value) {
   return typeof value === "object" && value !== null;
@@ -30426,7 +30951,7 @@ function realPathOrNull(path) {
 function isWithinRoot(realTarget, root) {
   const realRoot = realPathOrNull(root);
   if (realRoot === null) return false;
-  const rel = relative2(realRoot, realTarget);
+  const rel = relative(realRoot, realTarget);
   return rel !== "" && !rel.startsWith("..") && !isAbsolute2(rel);
 }
 function resolveRedactableArtifact(filePath, scope) {
@@ -30440,15 +30965,15 @@ import { createHash as createHash5 } from "crypto";
 import {
   closeSync as closeSync2,
   fstatSync,
-  mkdirSync as mkdirSync5,
+  mkdirSync as mkdirSync4,
   openSync as openSync2,
-  readFileSync as readFileSync11,
+  readFileSync as readFileSync12,
   readSync,
   writeFileSync as writeFileSync8
 } from "fs";
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 function offsetsDir(dataDir2) {
-  return join15(dataDir2, "usage-offsets");
+  return join16(dataDir2, "usage-offsets");
 }
 var SAFE_SESSION_ID = /^[A-Za-z0-9._-]+$/;
 function safeSessionId(sessionId) {
@@ -30458,11 +30983,11 @@ function safeSessionId(sessionId) {
   return createHash5("sha256").update(sessionId).digest("hex");
 }
 function offsetPath(dataDir2, sessionId) {
-  return join15(offsetsDir(dataDir2), safeSessionId(sessionId));
+  return join16(offsetsDir(dataDir2), safeSessionId(sessionId));
 }
 function readOffset(dataDir2, sessionId) {
   try {
-    const raw = readFileSync11(offsetPath(dataDir2, sessionId), "utf8");
+    const raw = readFileSync12(offsetPath(dataDir2, sessionId), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed === "object" && parsed !== null) {
       const rec = parsed;
@@ -30476,7 +31001,7 @@ function readOffset(dataDir2, sessionId) {
 }
 function writeOffset(dataDir2, sessionId, value) {
   try {
-    mkdirSync5(offsetsDir(dataDir2), { recursive: true, mode: DATA_DIR_MODE });
+    mkdirSync4(offsetsDir(dataDir2), { recursive: true, mode: DATA_DIR_MODE });
     const payload = value.lastPromptId !== void 0 ? { offset: value.offset, lastPromptId: value.lastPromptId } : { offset: value.offset };
     writeFileSync8(offsetPath(dataDir2, sessionId), JSON.stringify(payload), {
       mode: DATA_FILE_MODE
@@ -30520,7 +31045,7 @@ function readTail(transcriptPath, startOffset) {
 }
 
 // src/history/tail-scrub.ts
-import { readFileSync as readFileSync12, renameSync as renameSync6, rmSync as rmSync6, statSync as statSync7, writeFileSync as writeFileSync9 } from "fs";
+import { readFileSync as readFileSync13, renameSync as renameSync6, rmSync as rmSync6, statSync as statSync7, writeFileSync as writeFileSync9 } from "fs";
 var DEFAULT_MAX_SCRUB_BYTES = 32 * 1024 * 1024;
 async function scrubTranscriptTail(filePath, deps) {
   try {
@@ -30528,7 +31053,7 @@ async function scrubTranscriptTail(filePath, deps) {
     if (realPath === null) return null;
     const statBefore = statSync7(realPath);
     if (statBefore.size > (deps.maxBytes ?? DEFAULT_MAX_SCRUB_BYTES)) return null;
-    const content = readFileSync12(realPath, "utf8");
+    const content = readFileSync13(realPath, "utf8");
     const lines = content.split("\n");
     let rewritten = 0;
     for (const [i, line] of lines.entries()) {
@@ -30579,7 +31104,7 @@ async function reconcileSession(gateway, sessionId, records, opts = {}) {
   if (anchor === void 0) return { llmCalls: 0, skipped: 0, lastPromptId };
   const ctx = resolveInventoryContext({
     cwd: anchor.cwd ?? NO_PROJECT_CWD,
-    tool: "claude-code",
+    tool: SOURCE_TOOL.ClaudeCode,
     harnessVersion: anchor.version,
     harnessInterface: anchor.entrypoint
   });
@@ -30720,7 +31245,7 @@ function buildSessionRoot(sessionId, ctx, resolved, anchor, provider) {
   if (typeof osVersion === "string") attributes.os_version = osVersion;
   if (anchor.version !== void 0) attributes.harness_version = anchor.version;
   attributes.provider = provider;
-  attributes.harness = harnessFromTool("claude-code");
+  attributes.harness = harnessFromTool(SOURCE_TOOL.ClaudeCode);
   if (anchor.cwd !== void 0) attributes.cwd = anchor.cwd;
   if (anchor.version !== void 0) attributes.version = anchor.version;
   const hostName = ctx.host?.attributes.host_name;