@akasecurity/ai-tc-claude-code 0.9.5 → 0.9.7

package/scripts/scan-worker.js

@@ -579,6 +579,40 @@ function escapeRegExp2(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
+// ../../packages/detections/src/regex-cache.ts
+var singles = /* @__PURE__ */ new WeakMap();
+var keywordLists = /* @__PURE__ */ new WeakMap();
+var labelLists = /* @__PURE__ */ new WeakMap();
+function listCache(kind) {
+  return kind === "keyword" ? keywordLists : labelLists;
+}
+function memoizedRegExp(owner, build) {
+  const cached2 = singles.get(owner);
+  if (cached2 !== void 0) {
+    cached2.lastIndex = 0;
+    return cached2;
+  }
+  const compiled = build();
+  singles.set(owner, compiled);
+  return compiled;
+}
+function memoizedRegExpList(kind, owner, build) {
+  const cache = listCache(kind);
+  const cached2 = cache.get(owner);
+  if (cached2 !== void 0) {
+    if (cached2.stateful) {
+      for (const re of cached2.entries) if (re !== void 0) re.lastIndex = 0;
+    }
+    return cached2.entries;
+  }
+  const entries = build();
+  cache.set(owner, {
+    entries,
+    stateful: entries.some((re) => re !== void 0 && (re.global || re.sticky))
+  });
+  return entries;
+}
+
 // ../../packages/detections/src/matchers/limits.ts
 var MAX_MATCHES_PER_RULE = 1e4;
 var MAX_REGEX_INPUT_LENGTH = 2e5;
@@ -589,10 +623,17 @@ var KeywordMatcher = class {
     if (rule.matcher.type !== "keyword") return [];
     const { keywords, caseSensitive } = rule.matcher;
     const spans = [];
-    for (const kw of keywords) {
-      if (kw.length === 0) continue;
+    const compiled = memoizedRegExpList(
+      "keyword",
+      rule.matcher,
+      () => keywords.map((kw) => {
+        if (kw.length === 0) return void 0;
+        return new RegExp(escapeRegExp2(kw), caseSensitive ? "gu" : "giu");
+      })
+    );
+    for (const re of compiled) {
+      if (re === void 0) continue;
       if (spans.length >= MAX_MATCHES_PER_RULE) break;
-      const re = new RegExp(escapeRegExp2(kw), caseSensitive ? "gu" : "giu");
       let m;
       while ((m = re.exec(text)) !== null) {
         spans.push({ start: m.index, end: m.index + m[0].length });
@@ -608,7 +649,10 @@ var RegexMatcher = class {
   match(text, rule) {
     if (rule.matcher.type !== "regex") return [];
     const { pattern, flags, captureGroup } = rule.matcher;
-    const re = new RegExp(pattern, flags.includes("d") ? flags : `${flags}d`);
+    const re = memoizedRegExp(
+      rule.matcher,
+      () => new RegExp(pattern, flags.includes("d") ? flags : `${flags}d`)
+    );
     const scanText = text.length > MAX_REGEX_INPUT_LENGTH ? text.slice(0, MAX_REGEX_INPUT_LENGTH) : text;
     const spans = [];
     let m;
@@ -667,6 +711,10 @@ function luhnCheck(digits) {
 // ../../packages/detections/src/engine.ts
 var keywordMatcher = new KeywordMatcher();
 var regexMatcher = new RegexMatcher();
+var MATCHERS = {
+  keyword: (text, rule) => keywordMatcher.match(text, rule),
+  regex: (text, rule) => regexMatcher.match(text, rule)
+};
 var packs = /* @__PURE__ */ new Map();
 var POST_VALIDATORS = {
   entropy: (value, config2) => isHighEntropy(value, numberOption(config2, "threshold"), numberOption(config2, "minLength")),
@@ -682,8 +730,7 @@ function passesPostValidators(rule, value) {
   for (const ref of validators) {
     const name = typeof ref === "string" ? ref : ref.name;
     const config2 = typeof ref === "string" ? void 0 : ref.config;
-    const validate = POST_VALIDATORS[name];
-    if (validate && !validate(value, config2)) return false;
+    if (!POST_VALIDATORS[name](value, config2)) return false;
   }
   return true;
 }
@@ -713,11 +760,15 @@ function isCorroborated(candidate, candidates, text) {
   const labels = req.labels;
   if (labels && labels.length > 0) {
     const haystack = text.slice(Math.max(0, winStart), winEnd);
-    for (const label of labels) {
-      const trimmed = label.trim();
-      if (trimmed.length === 0) continue;
-      const re = new RegExp(`(?<![A-Za-z0-9])${escapeRegExp2(trimmed)}(?![A-Za-z0-9])`, "i");
-      if (re.test(haystack)) return true;
+    for (const re of memoizedRegExpList(
+      "label",
+      req,
+      () => labels.map((label) => {
+        const trimmed = label.trim();
+        return trimmed.length === 0 ? void 0 : new RegExp(`(?<![A-Za-z0-9])${escapeRegExp2(trimmed)}(?![A-Za-z0-9])`, "i");
+      })
+    )) {
+      if (re?.test(haystack)) return true;
     }
   }
   return false;
@@ -737,14 +788,7 @@ function scan(text, rules, context) {
   const candidates = [];
   for (const rule of ruleset2) {
     if (!ruleApplies(rule, extension)) continue;
-    let spans;
-    if (rule.matcher.type === "keyword") {
-      spans = keywordMatcher.match(text, rule);
-    } else if (rule.matcher.type === "regex") {
-      spans = regexMatcher.match(text, rule);
-    } else {
-      continue;
-    }
+    const spans = MATCHERS[rule.matcher.type](text, rule);
     for (const span of spans) {
       const rawMatch = text.slice(span.start, span.end);
       if (!passesPostValidators(rule, rawMatch)) continue;
@@ -1339,7 +1383,7 @@ __export(core_exports2, {
   parse: () => parse,
   parseAsync: () => parseAsync,
   prettifyError: () => prettifyError,
-  process: () => process,
+  process: () => process2,
   regexes: () => regexes_exports,
   registry: () => registry,
   safeDecode: () => safeDecode,
@@ -12264,7 +12308,7 @@ function initializeContext(params) {
     external: params?.external ?? void 0
   };
 }
-function process(schema, ctx, _params = { path: [], schemaPath: [] }) {
+function process2(schema, ctx, _params = { path: [], schemaPath: [] }) {
   var _a3;
   const def = schema._zod.def;
   const seen = ctx.seen.get(schema);
@@ -12301,7 +12345,7 @@ function process(schema, ctx, _params = { path: [], schemaPath: [] }) {
     if (parent) {
       if (!result.ref)
         result.ref = parent;
-      process(parent, ctx, params);
+      process2(parent, ctx, params);
       ctx.seen.get(parent).isParent = true;
     }
   }
@@ -12589,14 +12633,14 @@ function isTransforming(_schema, _ctx) {
 }
 var createToJSONSchemaMethod = (schema, processors = {}) => (params) => {
   const ctx = initializeContext({ ...params, processors });
-  process(schema, ctx);
+  process2(schema, ctx);
   extractDefs(ctx, schema);
   return finalize(ctx, schema);
 };
 var createStandardJSONSchemaMethod = (schema, io, processors = {}) => (params) => {
   const { libraryOptions, target } = params ?? {};
   const ctx = initializeContext({ ...libraryOptions ?? {}, target, io, processors });
-  process(schema, ctx);
+  process2(schema, ctx);
   extractDefs(ctx, schema);
   return finalize(ctx, schema);
 };
@@ -12842,7 +12886,7 @@ var arrayProcessor = (schema, ctx, _json, params) => {
   if (typeof maximum === "number")
     json2.maxItems = maximum;
   json2.type = "array";
-  json2.items = process(def.element, ctx, {
+  json2.items = process2(def.element, ctx, {
     ...params,
     path: [...params.path, "items"]
   });
@@ -12854,7 +12898,7 @@ var objectProcessor = (schema, ctx, _json, params) => {
   json2.properties = {};
   const shape = def.shape;
   for (const key in shape) {
-    json2.properties[key] = process(shape[key], ctx, {
+    json2.properties[key] = process2(shape[key], ctx, {
       ...params,
       path: [...params.path, "properties", key]
     });
@@ -12877,7 +12921,7 @@ var objectProcessor = (schema, ctx, _json, params) => {
     if (ctx.io === "output")
       json2.additionalProperties = false;
   } else if (def.catchall) {
-    json2.additionalProperties = process(def.catchall, ctx, {
+    json2.additionalProperties = process2(def.catchall, ctx, {
       ...params,
       path: [...params.path, "additionalProperties"]
     });
@@ -12886,7 +12930,7 @@ var objectProcessor = (schema, ctx, _json, params) => {
 var unionProcessor = (schema, ctx, json2, params) => {
   const def = schema._zod.def;
   const isExclusive = def.inclusive === false;
-  const options = def.options.map((x, i) => process(x, ctx, {
+  const options = def.options.map((x, i) => process2(x, ctx, {
     ...params,
     path: [...params.path, isExclusive ? "oneOf" : "anyOf", i]
   }));
@@ -12898,11 +12942,11 @@ var unionProcessor = (schema, ctx, json2, params) => {
 };
 var intersectionProcessor = (schema, ctx, json2, params) => {
   const def = schema._zod.def;
-  const a = process(def.left, ctx, {
+  const a = process2(def.left, ctx, {
     ...params,
     path: [...params.path, "allOf", 0]
   });
-  const b = process(def.right, ctx, {
+  const b = process2(def.right, ctx, {
     ...params,
     path: [...params.path, "allOf", 1]
   });
@@ -12919,11 +12963,11 @@ var tupleProcessor = (schema, ctx, _json, params) => {
   json2.type = "array";
   const prefixPath = ctx.target === "draft-2020-12" ? "prefixItems" : "items";
   const restPath = ctx.target === "draft-2020-12" ? "items" : ctx.target === "openapi-3.0" ? "items" : "additionalItems";
-  const prefixItems = def.items.map((x, i) => process(x, ctx, {
+  const prefixItems = def.items.map((x, i) => process2(x, ctx, {
     ...params,
     path: [...params.path, prefixPath, i]
   }));
-  const rest = def.rest ? process(def.rest, ctx, {
+  const rest = def.rest ? process2(def.rest, ctx, {
     ...params,
     path: [...params.path, restPath, ...ctx.target === "openapi-3.0" ? [def.items.length] : []]
   }) : null;
@@ -12963,7 +13007,7 @@ var recordProcessor = (schema, ctx, _json, params) => {
   const keyBag = keyType._zod.bag;
   const patterns = keyBag?.patterns;
   if (def.mode === "loose" && patterns && patterns.size > 0) {
-    const valueSchema = process(def.valueType, ctx, {
+    const valueSchema = process2(def.valueType, ctx, {
       ...params,
       path: [...params.path, "patternProperties", "*"]
     });
@@ -12973,12 +13017,12 @@ var recordProcessor = (schema, ctx, _json, params) => {
     }
   } else {
     if (ctx.target === "draft-07" || ctx.target === "draft-2020-12") {
-      json2.propertyNames = process(def.keyType, ctx, {
+      json2.propertyNames = process2(def.keyType, ctx, {
         ...params,
         path: [...params.path, "propertyNames"]
       });
     }
-    json2.additionalProperties = process(def.valueType, ctx, {
+    json2.additionalProperties = process2(def.valueType, ctx, {
       ...params,
       path: [...params.path, "additionalProperties"]
     });
@@ -12993,7 +13037,7 @@ var recordProcessor = (schema, ctx, _json, params) => {
 };
 var nullableProcessor = (schema, ctx, json2, params) => {
   const def = schema._zod.def;
-  const inner = process(def.innerType, ctx, params);
+  const inner = process2(def.innerType, ctx, params);
   const seen = ctx.seen.get(schema);
   if (ctx.target === "openapi-3.0") {
     seen.ref = def.innerType;
@@ -13004,20 +13048,20 @@ var nullableProcessor = (schema, ctx, json2, params) => {
 };
 var nonoptionalProcessor = (schema, ctx, _json, params) => {
   const def = schema._zod.def;
-  process(def.innerType, ctx, params);
+  process2(def.innerType, ctx, params);
   const seen = ctx.seen.get(schema);
   seen.ref = def.innerType;
 };
 var defaultProcessor = (schema, ctx, json2, params) => {
   const def = schema._zod.def;
-  process(def.innerType, ctx, params);
+  process2(def.innerType, ctx, params);
   const seen = ctx.seen.get(schema);
   seen.ref = def.innerType;
   json2.default = JSON.parse(JSON.stringify(def.defaultValue));
 };
 var prefaultProcessor = (schema, ctx, json2, params) => {
   const def = schema._zod.def;
-  process(def.innerType, ctx, params);
+  process2(def.innerType, ctx, params);
   const seen = ctx.seen.get(schema);
   seen.ref = def.innerType;
   if (ctx.io === "input")
@@ -13025,7 +13069,7 @@ var prefaultProcessor = (schema, ctx, json2, params) => {
 };
 var catchProcessor = (schema, ctx, json2, params) => {
   const def = schema._zod.def;
-  process(def.innerType, ctx, params);
+  process2(def.innerType, ctx, params);
   const seen = ctx.seen.get(schema);
   seen.ref = def.innerType;
   let catchValue;
@@ -13040,32 +13084,32 @@ var pipeProcessor = (schema, ctx, _json, params) => {
   const def = schema._zod.def;
   const inIsTransform = def.in._zod.traits.has("$ZodTransform");
   const innerType = ctx.io === "input" ? inIsTransform ? def.out : def.in : def.out;
-  process(innerType, ctx, params);
+  process2(innerType, ctx, params);
   const seen = ctx.seen.get(schema);
   seen.ref = innerType;
 };
 var readonlyProcessor = (schema, ctx, json2, params) => {
   const def = schema._zod.def;
-  process(def.innerType, ctx, params);
+  process2(def.innerType, ctx, params);
   const seen = ctx.seen.get(schema);
   seen.ref = def.innerType;
   json2.readOnly = true;
 };
 var promiseProcessor = (schema, ctx, _json, params) => {
   const def = schema._zod.def;
-  process(def.innerType, ctx, params);
+  process2(def.innerType, ctx, params);
   const seen = ctx.seen.get(schema);
   seen.ref = def.innerType;
 };
 var optionalProcessor = (schema, ctx, _json, params) => {
   const def = schema._zod.def;
-  process(def.innerType, ctx, params);
+  process2(def.innerType, ctx, params);
   const seen = ctx.seen.get(schema);
   seen.ref = def.innerType;
 };
 var lazyProcessor = (schema, ctx, _json, params) => {
   const innerType = schema._zod.innerType;
-  process(innerType, ctx, params);
+  process2(innerType, ctx, params);
   const seen = ctx.seen.get(schema);
   seen.ref = innerType;
 };
@@ -13117,7 +13161,7 @@ function toJSONSchema(input, params) {
     const defs = {};
     for (const entry of registry2._idmap.entries()) {
       const [_, schema] = entry;
-      process(schema, ctx2);
+      process2(schema, ctx2);
     }
     const schemas = {};
     const external = {
@@ -13140,7 +13184,7 @@ function toJSONSchema(input, params) {
     return { schemas };
   }
   const ctx = initializeContext({ ...params, processors: allProcessors });
-  process(input, ctx);
+  process2(input, ctx);
   extractDefs(ctx, input);
   return finalize(ctx, input);
 }
@@ -13198,7 +13242,7 @@ var JSONSchemaGenerator = class {
    * This must be called before emit().
    */
   process(schema, _params = { path: [], schemaPath: [] }) {
-    return process(schema, this.ctx, _params);
+    return process2(schema, this.ctx, _params);
   }
   /**
    * Emit the final JSON Schema after processing.
@@ -15347,6 +15391,47 @@ function date4(params) {
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
 config(en_default());
 
+// ../../packages/schema/src/zod/harness-map.ts
+var HARNESS = {
+  ClaudeCode: "claudecode",
+  Cursor: "cursor",
+  Copilot: "copilot",
+  Codex: "codex",
+  Antigravity: "antigravity",
+  Windsurf: "windsurf",
+  ClaudeDesktop: "claudedesktop",
+  ChatGpt: "chatgpt",
+  ClaudeAi: "claudeai",
+  Api: "api"
+};
+var Harness = external_exports.enum(HARNESS).meta({ id: "Harness" });
+var SOURCE_TOOL = {
+  ClaudeCode: "claude-code",
+  ClaudeDesktop: "claude-desktop",
+  Cursor: "cursor",
+  ChatGpt: "chatgpt",
+  ClaudeAi: "claude-ai",
+  Copilot: "github-copilot",
+  Codex: "codex",
+  Antigravity: "antigravity",
+  // No harness counterpart, deliberately: the CLI's own captures and a capture
+  // whose tool could not be identified both render through the read side's
+  // miss path rather than as a harness of their own.
+  Cli: "cli",
+  Unknown: "unknown"
+};
+var SourceTool = external_exports.enum(SOURCE_TOOL).meta({ id: "SourceTool" });
+var TOOL_TO_HARNESS = {
+  [SOURCE_TOOL.ClaudeCode]: HARNESS.ClaudeCode,
+  [SOURCE_TOOL.ClaudeDesktop]: HARNESS.ClaudeDesktop,
+  [SOURCE_TOOL.Copilot]: HARNESS.Copilot,
+  [SOURCE_TOOL.Cursor]: HARNESS.Cursor,
+  [SOURCE_TOOL.ChatGpt]: HARNESS.ChatGpt,
+  [SOURCE_TOOL.Codex]: HARNESS.Codex,
+  [SOURCE_TOOL.Antigravity]: HARNESS.Antigravity,
+  [SOURCE_TOOL.ClaudeAi]: HARNESS.ClaudeAi
+};
+
 // ../../packages/schema/src/zod/finding.ts
 var DetectionCategory = external_exports.enum(["pii", "financial", "secret", "phi", "code_context", "code_flaw", "custom", "config"]).meta({ id: "DetectionCategory" });
 var Severity = external_exports.enum(["critical", "high", "medium", "low"]).meta({ id: "Severity" });
@@ -15369,21 +15454,22 @@ var Finding = external_exports.object({
 }).meta({ id: "Finding" });
 var DetectedFinding = Finding.meta({ id: "DetectedFinding" });
 var FindingAction = external_exports.enum(["blocked", "redacted", "warned", "allowed", "quarantined", "monitored"]).meta({ id: "FindingAction" });
-var FindingProvider = external_exports.enum([
-  "claudecode",
-  "claudedesktop",
-  "cursor",
-  "copilot",
-  "chatgpt",
-  "claudeai",
-  "codex",
-  "antigravity",
-  "api"
+var FindingProvider = Harness.extract([
+  "ClaudeCode",
+  "ClaudeDesktop",
+  "Cursor",
+  "Copilot",
+  "ChatGpt",
+  "ClaudeAi",
+  "Codex",
+  "Antigravity",
+  "Api"
 ]).meta({ id: "FindingProvider" });
 var FindingCategory = external_exports.enum([
   "secret",
   "pii",
   "source_code",
+  "code_flaw",
   "external_share",
   "mcp_server",
   "customer_data",
@@ -15561,6 +15647,7 @@ var FindingInstanceDetail = FindingInstance.extend({
   detection: FindingDetectionRef,
   policy: FindingPolicyRef
 }).meta({ id: "FindingInstanceDetail" });
+var MAX_FLAT_FINDINGS_LIMIT = 200;
 var ListFindingInstancesQuery = external_exports.object({
   severity: external_exports.array(Severity).optional(),
   // Rule ids, the same vocabulary the grouped list's `subtype` carries.
@@ -15580,7 +15667,7 @@ var ListFindingInstancesQuery = external_exports.object({
   q: external_exports.string().optional(),
   sessionId: external_exports.string().optional(),
   from: external_exports.iso.datetime().optional(),
-  limit: external_exports.coerce.number().int().min(1).max(200).optional(),
+  limit: external_exports.coerce.number().int().min(1).max(MAX_FLAT_FINDINGS_LIMIT).optional(),
   cursor: external_exports.string().optional()
 });
 var ListFindingInstancesResponse = external_exports.object({
@@ -15642,20 +15729,6 @@ var ListFindingLocationsResponse = external_exports.object({
   hasMore: external_exports.boolean()
 }).meta({ id: "ListFindingLocationsResponse" });
 
-// ../../packages/schema/src/zod/harness-map.ts
-var Harness = external_exports.enum([
-  "claudecode",
-  "cursor",
-  "copilot",
-  "codex",
-  "antigravity",
-  "windsurf",
-  "claudedesktop",
-  "chatgpt",
-  "claudeai",
-  "api"
-]).meta({ id: "Harness" });
-
 // ../../packages/schema/src/zod/meta.ts
 var InventoryObjectType = external_exports.enum(["host", "harness", "user", "skill", "hook", "mcp_server", "config_file"]).meta({ id: "InventoryObjectType" });
 var AuditEventType = external_exports.enum([
@@ -16105,366 +16178,122 @@ var ActivityOverviewResponse = external_exports.object({
   sessions: ListActivitySessionsResponse
 }).meta({ id: "ActivityOverviewResponse" });
 
-// ../../packages/schema/src/zod/event.ts
-var EventKind = external_exports.enum(["prompt", "response", "code_change", "tool_use"]).meta({ id: "EventKind" });
-var CAPTURE_EVENT_TYPES_SQL = EventKind.options.map((k) => `'${k}'`).join(",");
-var SourceTool = external_exports.enum([
-  "claude-code",
-  "claude-desktop",
-  "cursor",
-  "chatgpt",
-  "claude-ai",
-  "github-copilot",
-  "codex",
-  "antigravity",
-  "cli",
-  "unknown"
-]).meta({ id: "SourceTool" });
-var EventMetadata = external_exports.object({
-  sessionId: external_exports.string().optional(),
-  repo: external_exports.string().optional(),
-  filePath: external_exports.string().optional(),
-  // The host tool whose input/output was scanned (e.g. 'Bash', 'WebFetch'),
-  // set by the tool-scanning hooks. The tool NAME only — never the tool's
-  // arguments or output, which can carry the very value a finding masked
-  // (metadata is stored unredacted). Gives findings on non-file captures a
-  // display location ("via Bash") when no filePath exists.
-  toolName: external_exports.string().optional(),
-  // Set (true) by the worktree scanner when the file is excluded by the
-  // repo's .gitignore. Gitignored files ARE still scanned — local scratch and
-  // generated code can leak real secrets — but the provenance is recorded so
-  // policy/dashboards can treat those findings as informational rather than
-  // blocking. Omitted (not false) for tracked files and non-scan events.
-  gitignored: external_exports.boolean().optional(),
-  // Set (true) ONLY when the event's `content` is the COMPLETE file at
-  // capture time (a worktree scan reading from disk). Hook-captured edits
-  // (e.g. an Edit tool's new_string) are partial fragments and MUST NOT set
-  // this. The resolver-on-ingest keys its fixed-at-source dropout
-  // diff on this marker: only a whole-file snapshot can prove a previously
-  // open finding is gone; a fragment's absence proves nothing (the secret
-  // may live outside the hunk). Omitted (not false) for fragments and
-  // non-scan events, so pre-marker clients safely default to the
-  // non-authoritative path.
-  wholeFile: external_exports.boolean().optional(),
-  model: external_exports.string().optional(),
-  turnIndex: external_exports.number().int().nonnegative().optional(),
-  // Distributed-tracing correlation. `correlationId` ties a recorded event back
-  // to the request that captured/ingested it (a UUID, generated independently of
-  // the trace id); `traceId` is the W3C trace id (32 lowercase hex chars) of the
-  // originating span when telemetry is enabled. Both optional + backward
-  // compatible — populated by the plugin (see @akasecurity/plugin-sdk).
-  correlationId: external_exports.uuid().optional(),
-  traceId: external_exports.string().regex(/^[0-9a-f]{32}$/).optional(),
-  // Ids of the detection exceptions that downgraded findings in this capture
-  // to 'allow' — the enforcement audit trail's link back to the grant that
-  // authorized the bypass. Absent on captures where no exception applied.
-  exceptionIds: external_exports.array(external_exports.guid()).optional()
-}).meta({ id: "EventMetadata" });
-var Event = external_exports.object({
-  id: external_exports.guid(),
-  sourceTool: SourceTool,
-  kind: EventKind,
-  occurredAt: external_exports.iso.datetime(),
-  contentHash: external_exports.string(),
-  content: external_exports.string(),
-  metadata: EventMetadata.optional()
-}).meta({ id: "Event" });
-var IngestEvent = Event.meta({ id: "IngestEvent" });
-var IngestBatch = external_exports.object({
-  events: external_exports.array(IngestEvent).min(1).max(100),
-  // Dedup policy for this batch. Id-dedup ALWAYS applies. 'content-hash'
-  // additionally rejects any event whose contentHash the store has already
-  // recorded — for re-runnable bulk ingest (worktree scan, transcript
-  // backfill), where a re-run mints fresh event ids for identical content and
-  // would otherwise accumulate duplicates. Live hook traffic must NOT set it:
-  // two genuinely separate prompts can be byte-identical and both belong on
-  // the timeline.
-  dedupe: external_exports.literal("content-hash").optional()
-}).meta({ id: "IngestBatch" });
-
-// ../../packages/schema/src/zod/inventory.ts
-var AssetType = external_exports.enum(["project", "skill", "mcp", "hook", "config"]).meta({ id: "AssetType" });
-var AccessLevel = external_exports.enum(["open", "approved", "blocked"]).meta({ id: "AccessLevel" });
-var Origin = external_exports.enum(["source", "public-dep", "vendored", "config", "data", "docs", "generated"]).meta({ id: "Origin" });
-var TrustLevel = external_exports.enum(["known-good", "risky", "unapproved"]).meta({ id: "TrustLevel" });
-var Flag = external_exports.enum(["update", "stale", "conflict", "unknown", "change", "untracked", "risk", "findings"]).meta({ id: "Flag" });
-var Visibility = external_exports.enum(["public", "private"]).meta({ id: "Visibility" });
-var HarnessEventKind = external_exports.enum(["block", "redact", "warn"]).meta({ id: "HarnessEventKind" });
-var HarnessId = external_exports.enum(["claudecode", "cursor", "codex", "antigravity"]).meta({ id: "HarnessId" });
-var AccessCounts = external_exports.object({
-  open: external_exports.number().int().nonnegative(),
-  approved: external_exports.number().int().nonnegative(),
-  blocked: external_exports.number().int().nonnegative(),
-  total: external_exports.number().int().nonnegative()
-}).meta({ id: "AccessCounts" });
-var AssetSummary = external_exports.object({
-  id: external_exports.string(),
-  type: AssetType,
-  name: external_exports.string(),
-  sub: external_exports.string(),
-  flags: external_exports.array(Flag),
-  /** MCP servers only — omitted for all other types. */
-  trust: TrustLevel.optional()
-}).meta({ id: "AssetSummary" });
-var ProjectSummary = external_exports.object({
-  id: external_exports.string(),
-  name: external_exports.string(),
-  repo: external_exports.string(),
-  visibility: Visibility,
-  language: external_exports.string(),
-  policyDefault: AccessLevel,
-  updatedAt: external_exports.iso.datetime(),
-  accessCounts: AccessCounts,
-  findingsCount: external_exports.number().int().nonnegative()
-}).meta({ id: "ProjectSummary" });
-var HarnessCategory = external_exports.object({
-  /** One of config/skill/mcp/hook — never project (enforced at service layer). */
-  type: AssetType,
-  assets: external_exports.array(AssetSummary)
+// ../../packages/schema/src/zod/config-inventory.ts
+var ConfigScope = external_exports.enum(["user", "project", "local", "plugin"]);
+var SkillScanEntry = external_exports.object({
+  name: external_exports.string().min(1),
+  // The identity source: a marketplace repo for plugin skills (e.g.
+  // 'anthropics/skills'), 'local' for personal ~/.claude/skills, or
+  // 'project:<repo-identity>' for checked-in project skills. The surrogate keeps
+  // a personal skill named 'pdf' from colliding with the marketplace 'pdf'.
+  source: external_exports.string().min(1),
+  scope: ConfigScope,
+  pluginName: external_exports.string().optional(),
+  // Volatile — rides the attribute bag, never the identity hash.
+  version: external_exports.string().optional(),
+  description: external_exports.string().optional(),
+  // Skill directory mtime (ISO) — the "updated Nd ago" freshness signal.
+  updatedAt: external_exports.iso.datetime().optional(),
+  // Filesystem path — the promoted inventory `location` column.
+  location: external_exports.string().optional()
 });
-var HarnessSummary = external_exports.object({
-  id: HarnessId,
-  label: external_exports.string(),
-  kind: external_exports.string(),
-  version: external_exports.string(),
-  sessions: external_exports.number().int().nonnegative(),
-  assetCount: external_exports.number().int().nonnegative(),
-  flagCount: external_exports.number().int().nonnegative(),
-  projects: external_exports.array(ProjectSummary),
-  categories: external_exports.array(HarnessCategory)
-}).meta({ id: "HarnessSummary" });
-var ListHarnessesResponse = external_exports.object({ items: external_exports.array(HarnessSummary) }).meta({ id: "ListHarnessesResponse" });
-var AssetGroup = external_exports.object({
-  /** Group key — never project (enforced at service layer). */
-  type: AssetType,
-  total: external_exports.number().int().nonnegative(),
-  /**
-   * MCP group only — omitted for all other types.
-   * Partial: only TrustLevel keys with non-zero counts are included.
-   * Strict: unknown keys are rejected — only TrustLevel values are valid keys.
-   */
-  trustRollup: external_exports.object({
-    "known-good": external_exports.number().int().nonnegative(),
-    risky: external_exports.number().int().nonnegative(),
-    unapproved: external_exports.number().int().nonnegative()
-  }).partial().strict().optional(),
-  /**
-   * Partial: only Flag keys with non-zero counts are included.
-   * Strict: unknown keys are rejected — only Flag values are valid keys.
-   */
-  flagRollup: external_exports.object({
-    update: external_exports.number().int().nonnegative(),
-    stale: external_exports.number().int().nonnegative(),
-    conflict: external_exports.number().int().nonnegative(),
-    unknown: external_exports.number().int().nonnegative(),
-    change: external_exports.number().int().nonnegative(),
-    untracked: external_exports.number().int().nonnegative(),
-    risk: external_exports.number().int().nonnegative(),
-    findings: external_exports.number().int().nonnegative()
-  }).partial().strict(),
-  items: external_exports.array(AssetSummary)
-}).meta({ id: "AssetGroup" });
-var ListAssetsResponse = external_exports.object({ groups: external_exports.array(AssetGroup) }).meta({ id: "ListAssetsResponse" });
-var McpTool = external_exports.object({
-  name: external_exports.string(),
-  signature: external_exports.string(),
-  description: external_exports.string(),
-  write: external_exports.boolean(),
-  /** Non-null string when tool is dangerous / blocked; null otherwise. */
-  risk: external_exports.string().nullable()
-}).meta({ id: "McpTool" });
-var AssetFindingRef = external_exports.object({
-  id: external_exports.string(),
-  title: external_exports.string(),
-  note: external_exports.string()
+var HookScanEntry = external_exports.object({
+  // Hook event name (PreToolUse, PostToolUse, …). Open string, not an enum: the
+  // set is harness-defined and grows without a schema change.
+  event: external_exports.string().min(1),
+  // The tool matcher ('Bash', 'Edit|Write', …). Absent = matches all tools.
+  matcher: external_exports.string().optional(),
+  command: external_exports.string().min(1),
+  timeout: external_exports.number().optional(),
+  scope: ConfigScope,
+  pluginName: external_exports.string().optional(),
+  // The settings file / hooks.json the entry came from.
+  location: external_exports.string().optional()
 });
-var AssetDetail = AssetSummary.extend({
-  /** string | null — null when no description is available. */
-  description: external_exports.string().nullable(),
-  /** trustLevel | null — null for non-MCP assets. */
-  trust: TrustLevel.nullable(),
-  /** Type-specific raw key/values — FE renders the grid. */
-  meta: external_exports.record(external_exports.string(), external_exports.unknown()),
-  /** always present — object when there is an active finding, null when absent. */
-  finding: AssetFindingRef.nullable(),
-  /** MCP exposed-tools list — omitted for non-mcp. */
-  tools: external_exports.array(McpTool).optional()
-}).meta({ id: "AssetDetail" });
-var ListProjectsResponse = external_exports.object({ items: external_exports.array(ProjectSummary) }).meta({ id: "ListProjectsResponse" });
-var InventoryStats = external_exports.object({
-  /** Total assets/projects with ≥1 flag or finding (drives the attention header chip). */
-  attention: external_exports.number().int().nonnegative(),
-  byType: external_exports.object({
-    project: external_exports.number().int().nonnegative(),
-    skill: external_exports.number().int().nonnegative(),
-    mcp: external_exports.number().int().nonnegative(),
-    hook: external_exports.number().int().nonnegative(),
-    config: external_exports.number().int().nonnegative()
-  }),
-  harnesses: external_exports.number().int().nonnegative(),
-  mcpTrust: external_exports.object({
-    "known-good": external_exports.number().int().nonnegative(),
-    risky: external_exports.number().int().nonnegative(),
-    unapproved: external_exports.number().int().nonnegative()
-  })
-}).meta({ id: "InventoryStats" });
-var FileSummary = external_exports.object({
-  path: external_exports.string(),
-  name: external_exports.string(),
-  origin: Origin,
-  /** Effective access (override applied). */
-  access: AccessLevel,
-  /** True when a file_access_override differs from the computed default. */
-  isCustom: external_exports.boolean(),
-  findings: external_exports.number().int().nonnegative(),
-  /** When the file was auto-blocked by a detection; null when not blocked. */
-  blockedAt: external_exports.iso.datetime().nullable().optional(),
-  /** Why the file was blocked; null when absent. */
-  note: external_exports.string().nullable().optional()
-}).meta({ id: "FileSummary" });
-var FolderSummary = external_exports.object({
-  name: external_exports.string(),
-  path: external_exports.string(),
-  /** Rollup of effective access across all descendants. */
-  accessCounts: AccessCounts
-}).meta({ id: "FolderSummary" });
-var ProjectTreeResponse = external_exports.object({
-  project: external_exports.object({
-    id: external_exports.string(),
-    repo: external_exports.string(),
-    visibility: Visibility
-  }),
-  path: external_exports.string(),
-  /** Browse mode: one-level folders at the current path. Omitted in search mode. */
-  folders: external_exports.array(FolderSummary).optional(),
-  files: external_exports.array(FileSummary)
-}).meta({ id: "ProjectTreeResponse" });
-var FileDetail = FileSummary.extend({
-  project: external_exports.object({
-    repo: external_exports.string(),
-    visibility: Visibility,
-    language: external_exports.string(),
-    policyDefault: AccessLevel,
-    updatedAt: external_exports.iso.datetime()
-  }),
-  findingsRefs: external_exports.array(external_exports.object({ id: external_exports.string(), title: external_exports.string() }))
-}).meta({ id: "FileDetail" });
-var SetFileAccessBody = external_exports.object({
-  path: external_exports.string(),
-  access: AccessLevel
-}).meta({ id: "SetFileAccessBody" });
-var SetFileAccessResponse = external_exports.object({
-  file: FileSummary,
-  accessCounts: AccessCounts
-}).meta({ id: "SetFileAccessResponse" });
-var SetMcpTrustBody = external_exports.object({ trust: TrustLevel }).meta({ id: "SetMcpTrustBody" });
-var HarnessEventItem = external_exports.object({
-  kind: HarnessEventKind,
-  title: external_exports.string(),
-  detail: external_exports.string(),
-  occurredAt: external_exports.iso.datetime(),
-  findingId: external_exports.string().nullable().optional()
-}).meta({ id: "HarnessEventItem" });
-var HarnessEventsResponse = external_exports.object({
-  counts: external_exports.object({
-    block: external_exports.number().int().nonnegative(),
-    redact: external_exports.number().int().nonnegative(),
-    warn: external_exports.number().int().nonnegative()
-  }),
-  items: external_exports.array(HarnessEventItem)
-}).meta({ id: "HarnessEventsResponse" });
-var RescanResponse = external_exports.object({
-  jobId: external_exports.string(),
-  startedAt: external_exports.iso.datetime()
-}).meta({ id: "RescanResponse" });
-var ConnectProjectBody = external_exports.object({ repo: external_exports.string() }).meta({ id: "ConnectProjectBody" });
-var ListAssetsQuery = external_exports.object({
-  /** Filter by one or more AssetType values; absent means all types. */
-  type: external_exports.array(AssetType).optional(),
-  /** Free-text search term. */
-  q: external_exports.string().optional()
-});
-var GetProjectTreeQuery = external_exports.object({
-  /** Subtree root path; defaults to repository root when absent. */
-  path: external_exports.string().optional(),
-  /** Free-text filter applied to file paths. */
-  q: external_exports.string().optional(),
-  /**
-   * Special listing mode. `blocked` returns every effectively-blocked, auto-blocked
-   * file across the whole repo (folders omitted, most-recent first), ignoring
-   * `path`/`q` — powers the project-wide "recently blocked" strip.
-   */
-  filter: external_exports.enum(["blocked"]).optional()
+var McpServerScanEntry = external_exports.object({
+  // The server's config key ("github", "filesystem", …) — identity, with the
+  // qualified scope (see mcpServerIdentityKey).
+  name: external_exports.string().min(1),
+  scope: ConfigScope,
+  pluginName: external_exports.string().optional(),
+  // The owning plugin's marketplace — part of PLUGIN-scope identity: two
+  // marketplaces can each ship a plugin named `guard`, and without this their
+  // same-named servers would collapse to one row (the second silently dropped,
+  // inheriting the first's trust).
+  marketplace: external_exports.string().optional(),
+  // The repo identity (remote url, or the cwd for un-remoted repos) — part of
+  // PROJECT/LOCAL-scope identity: a server named `github` in repo A and one in
+  // repo B are different servers with different commands, and MUST NOT share a
+  // row — a shared row would let a cloned repo's .mcp.json inherit the trust
+  // the user granted elsewhere.
+  project: external_exports.string().optional(),
+  // 'stdio' when the entry carries a command; otherwise the config's `type`
+  // ('http' / 'sse' / …). Open string — the transport set is harness-defined.
+  transport: external_exports.string().min(1),
+  // Volatile on purpose (unlike hook `command`): a changed command/url is drift
+  // on a stable row — visible across config_scan snapshots and preserving the
+  // user's trust decision — never a quiet new row. One of the two is present.
+  // Secret-masked at collection time (the scanner runs the bundled detection
+  // packs over both — tokens routinely ride command args and URLs).
+  command: external_exports.string().optional(),
+  url: external_exports.string().optional(),
+  // Env var NAMES only, never values (the no-secrets rule).
+  envKeys: external_exports.array(external_exports.string()).optional(),
+  // The config file the entry came from.
+  location: external_exports.string().optional()
 });
-var GetProjectFileQuery = external_exports.object({
-  /** Repository-relative file path; absent or empty → 400. */
-  path: external_exports.string()
+var ConfigFileScanEntry = external_exports.object({
+  // Basename (settings.json, CLAUDE.md) or dir name (commands/, agents/).
+  name: external_exports.string().min(1),
+  // The absolute path — identity (with scope) and the promoted `location`.
+  path: external_exports.string().min(1),
+  scope: ConfigScope,
+  // Human label: "User settings", "Project memory", "Slash commands", …
+  kind: external_exports.string().min(1),
+  // Derived SHAPE summary — top-level key names, entry counts, line counts.
+  // Never file content or values (memory files can carry sensitive detail).
+  detail: external_exports.string().optional(),
+  // Dir configs (commands/, agents/) and .mcp.json: how many entries.
+  entryCount: external_exports.number().optional(),
+  // File mtime (ISO) — the freshness signal.
+  updatedAt: external_exports.iso.datetime().optional()
 });
-var GetHarnessEventsQuery = external_exports.object({
-  /** Maximum number of events to return.  Range: 1–50; default: 7. */
-  limit: external_exports.coerce.number().int().min(1).max(50).default(7)
+var ConfigScanResult = external_exports.object({
+  scannedAt: external_exports.iso.datetime(),
+  skills: external_exports.array(SkillScanEntry),
+  hooks: external_exports.array(HookScanEntry),
+  mcpServers: external_exports.array(McpServerScanEntry),
+  configFiles: external_exports.array(ConfigFileScanEntry),
+  errors: external_exports.array(external_exports.object({ source: external_exports.string(), reason: external_exports.string() }))
 });
-
-// ../../packages/schema/src/zod/exception.ts
-var ExceptionScope = external_exports.enum(["once", "temporary", "permanent"]);
-var ExceptionConditions = external_exports.object({
-  repo: external_exports.string().optional(),
-  sourceTool: external_exports.string().optional(),
-  provider: external_exports.string().optional()
-}).strict();
-var ExceptionCapability = external_exports.enum(["suppress", "reveal_to_model"]);
-var DetectionException = external_exports.object({
-  id: external_exports.guid(),
-  ruleId: external_exports.string(),
-  // Denormalized from the rule, for reporting — never matched on.
-  category: DetectionCategory,
-  // HMAC-SHA256 hex of the raw match under a machine-local key: a KEYED
-  // fingerprint, never the raw value, and never reversible. Matching recomputes
-  // the fingerprint from a fresh capture; the value itself is never stored.
-  // Shape-constrained so a malformed — or accidentally raw — value is rejected
-  // at the boundary rather than persisted.
-  valueFingerprint: external_exports.string().regex(/^[0-9a-f]{64}$/),
-  // Version of the fingerprint key the grant was written under; a rotated key
-  // invalidates old grants rather than silently mismatching them.
-  keyVersion: external_exports.number().int().positive(),
-  // maskMatch() preview of the approved value — never the raw value.
-  maskedValue: external_exports.string(),
-  capability: ExceptionCapability.default("suppress"),
-  scope: ExceptionScope,
-  expiresAt: external_exports.iso.datetime().nullable(),
-  maxUses: external_exports.number().int().positive().nullable(),
-  useCount: external_exports.number().int().nonnegative(),
-  lastUsedAt: external_exports.iso.datetime().nullable(),
-  // Mandatory: every grant carries the human reason it exists.
-  justification: external_exports.string().min(1),
-  conditions: ExceptionConditions.nullable(),
-  createdBy: external_exports.string(),
-  createdVia: external_exports.enum(["cli-approve", "cli-add", "web-approve", "web-add", "api", "setup-triage"]),
-  createdAt: external_exports.iso.datetime(),
-  updatedAt: external_exports.iso.datetime(),
-  // Revocation is terminal and retained — consumed/expired/revoked rows are
-  // audit evidence; nothing in the exception lifecycle hard-deletes.
-  revokedAt: external_exports.iso.datetime().nullable(),
-  revokedBy: external_exports.string().nullable(),
-  revokeReason: external_exports.string().nullable()
+var ConfigPostureFindingInput = external_exports.object({
+  ruleId: external_exports.string().min(1),
+  version: external_exports.string().min(1),
+  span: Span,
+  // For posture rules this is the offending COMMAND (config the user already
+  // holds locally, not captured secret content) — it is also the correlation
+  // key the read surface matches back to a hook row.
+  maskedMatch: external_exports.string(),
+  actionTaken: ActionTaken,
+  confidence: external_exports.number().min(0).max(1)
 });
-var ExceptionBundleEntry = DetectionException.pick({
-  id: true,
-  ruleId: true,
-  valueFingerprint: true,
-  keyVersion: true,
-  capability: true,
-  expiresAt: true,
-  maxUses: true,
-  useCount: true,
-  conditions: true
+var ConfigScanRecord = external_exports.object({
+  items: external_exports.array(InventoryInput),
+  scanEvent: AuditEventInput,
+  definitions: external_exports.array(InspectionDefinitionInput).optional(),
+  findings: external_exports.array(ConfigPostureFindingInput).optional()
 });
-var ExceptionDescriptor = DetectionException.omit({ valueFingerprint: true });
+
+// ../../packages/schema/src/zod/registry.ts
+var Namespace = external_exports.string().regex(/^[a-z][a-z0-9-]*$/);
+var PackId = external_exports.string().regex(/^[a-z][a-z0-9-]*$/);
+var SemVer = external_exports.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-.]+)?$/);
+var PublisherKind = external_exports.enum(["labs", "user", "org"]);
 
 // ../../packages/schema/src/zod/rule.ts
-var MatcherType = external_exports.enum(["keyword", "regex", "validator"]).meta({ id: "MatcherType" });
+var MatcherType = external_exports.enum(["keyword", "regex"]).meta({ id: "MatcherType" });
 var RuleProbeVerdict = external_exports.enum(["safe", "quarantined"]).meta({ id: "RuleProbeVerdict" });
-var KeywordMatcher2 = external_exports.object({
+var KeywordMatcher2 = external_exports.strictObject({
   type: external_exports.literal("keyword"),
   // An empty keyword matches at every position, yielding one zero-length span
   // per character. Rejected here because a keyword that matches everything is
@@ -16480,16 +16309,31 @@ function isValidRegex(pattern, flags) {
     return false;
   }
 }
+function probeFlags(flags) {
+  return flags.replace(/[gy]/g, "");
+}
 function matchesEmptyString(pattern, flags) {
   try {
-    const re = new RegExp(pattern, flags.replace(/[gy]/g, ""));
+    const re = new RegExp(pattern, probeFlags(flags));
     return re.exec("")?.[0].length === 0;
   } catch {
     return false;
   }
 }
+function spansWholeMatch(captureGroup) {
+  return captureGroup === void 0 || captureGroup === 0;
+}
+function captureGroupCount(pattern, flags) {
+  try {
+    const probe = new RegExp(`${pattern}|`, probeFlags(flags));
+    const result = probe.exec("");
+    return result ? result.length - 1 : void 0;
+  } catch {
+    return void 0;
+  }
+}
 var MAX_PATTERN_LENGTH = 2e3;
-var RegexMatcher2 = external_exports.object({
+var RegexMatcher2 = external_exports.strictObject({
   type: external_exports.literal("regex"),
   pattern: external_exports.string().min(1).max(MAX_PATTERN_LENGTH),
   flags: external_exports.string().default("gi"),
@@ -16497,28 +16341,47 @@ var RegexMatcher2 = external_exports.object({
 }).refine((v) => isValidRegex(v.pattern, v.flags), {
   message: "pattern/flags do not form a valid JavaScript regular expression",
   path: ["pattern"]
-}).refine((v) => v.captureGroup !== void 0 || !matchesEmptyString(v.pattern, v.flags), {
+}).refine((v) => !spansWholeMatch(v.captureGroup) || !matchesEmptyString(v.pattern, v.flags), {
   message: 'a whole-match regex that can match the empty string (e.g. "\\d*", "a?", "(?:)") can hang the matcher \u2014 scope the quantifier to a captureGroup, or require at least one character',
   path: ["pattern"]
+}).superRefine((v, ctx) => {
+  if (v.captureGroup === void 0) return;
+  const groups = captureGroupCount(v.pattern, v.flags);
+  if (groups === void 0 || v.captureGroup <= groups) return;
+  ctx.addIssue({
+    code: "custom",
+    path: ["captureGroup"],
+    message: `captureGroup ${String(v.captureGroup)} is out of range \u2014 the pattern declares ${String(groups)} capture group(s), so valid values are 0-${String(groups)}. An out-of-range group never matches, which would make the rule silently never fire.`
+  });
 });
-var ValidatorMatcher = external_exports.object({
-  type: external_exports.literal("validator"),
-  name: external_exports.enum(["luhn", "entropy", "ssn-checksum"]),
-  config: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
-});
-var Matcher = external_exports.discriminatedUnion("type", [KeywordMatcher2, RegexMatcher2, ValidatorMatcher]).meta({ id: "Matcher" });
-var AppliesTo = external_exports.object({
+var Matcher = external_exports.discriminatedUnion("type", [KeywordMatcher2, RegexMatcher2]).meta({ id: "Matcher" });
+var MATCHER_TYPES = MatcherType.options;
+var AppliesTo = external_exports.strictObject({
   // Dot-prefixed, e.g. ".py" — matches the scanner's SOURCE_EXTENSIONS shape.
   extensions: external_exports.array(external_exports.string().regex(/^\.[A-Za-z0-9]+$/)).min(1)
 }).meta({ id: "AppliesTo" });
-var PostValidatorRef = external_exports.union([
-  external_exports.string(),
-  external_exports.object({
-    name: external_exports.string(),
-    config: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
-  })
-]).meta({ id: "PostValidatorRef" });
-var RequiresNearby = external_exports.object({
+var PostValidatorName = external_exports.enum(["entropy", "luhn"]).meta({ id: "PostValidatorName" });
+var PostValidatorRef = external_exports.union(
+  [
+    PostValidatorName,
+    external_exports.strictObject({
+      name: PostValidatorName,
+      config: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
+    })
+  ],
+  {
+    // A union reports one collapsed issue for every way its arms can fail, so
+    // this has to describe the whole shape rather than just the name — it is
+    // what an author sees for a misspelled name AND for a stray key in the
+    // object form. The names come from the enum so the message cannot go
+    // stale. Without it Zod says only "Invalid input", which is precisely the
+    // no-feedback outcome this schema exists to remove.
+    error: () => `not a valid post-validator: use a bare name (${PostValidatorName.options.map((name) => JSON.stringify(name)).join(
+      " or "
+    )}) or { "name": ..., "config": { ... } }. An unrecognized name would be a false-positive guard that never runs.`
+  }
+).meta({ id: "PostValidatorRef" });
+var RequiresNearby = external_exports.strictObject({
   // Each array, when present, must be non-empty and contain non-empty strings —
   // an empty/blank criterion would either never fire or (for labels) match
   // everything.
@@ -16533,16 +16396,23 @@ var RequiresNearby = external_exports.object({
   (v) => (v.categories?.length ?? 0) + (v.ruleIds?.length ?? 0) + (v.labels?.length ?? 0) > 0,
   { message: "requiresNearby needs at least one of categories, ruleIds, or labels" }
 ).meta({ id: "RequiresNearby" });
-var RuleFixture = external_exports.object({
+var RuleFixture = external_exports.strictObject({
   label: external_exports.string(),
   text: external_exports.string().max(5e4),
   shouldMatch: external_exports.boolean(),
   // Simulated file context for the scan, so fixtures can assert `appliesTo`
   // gating (e.g. a Python-only pattern must NOT fire in a .ts file).
   filePath: external_exports.string().optional(),
-  expectedSpans: external_exports.array(external_exports.object({ start: external_exports.number(), end: external_exports.number() })).optional()
+  expectedSpans: external_exports.array(external_exports.strictObject({ start: external_exports.number(), end: external_exports.number() })).optional()
 }).meta({ id: "RuleFixture" });
-var Rule = external_exports.object({
+var Rule = external_exports.strictObject({
+  // A pinned literal over a STRICT object, and the two together decide how this
+  // format may grow. A rule carrying a key not listed below is refused with
+  // `unrecognized_keys`; a rule declaring `specVersion: 2` is refused with
+  // `invalid_value`. So the only additive path is adding an OPTIONAL field here
+  // — that keeps every rule authored before it valid — and a rule author has no
+  // way to introduce a field of their own or to opt into a later version.
+  // Widening the format means changing this literal and every consumer of it.
   specVersion: external_exports.literal(1),
   // `packId/ruleName` (e.g. `secrets/aws-access-key`). NOTE the first segment is
   // the PACK id, NOT a namespace — this is a DIFFERENT slug space from a
@@ -16578,287 +16448,6 @@ var PackManifest = external_exports.object({
   sourceUrl: external_exports.url().optional()
 }).meta({ id: "PackManifest" });
 
-// ../../packages/schema/src/zod/policy.ts
-var PolicyScope = external_exports.enum(["global", "repo", "user"]).meta({ id: "PolicyScope" });
-var PolicyTarget = external_exports.union([external_exports.object({ ruleId: external_exports.string() }), external_exports.object({ category: DetectionCategory })]).meta({ id: "PolicyTarget" });
-var Policy = external_exports.object({
-  id: external_exports.guid(),
-  scope: PolicyScope,
-  target: PolicyTarget,
-  action: ActionTaken,
-  enabled: external_exports.boolean().default(true),
-  customKeywords: external_exports.array(external_exports.string()).optional(),
-  // Display name — optional so older policy rows without name still parse.
-  // Added for the findings API (policy.name column migration).
-  name: external_exports.string().optional()
-}).meta({ id: "Policy" });
-var PolicyBundle = external_exports.object({
-  version: external_exports.string(),
-  policies: external_exports.array(Policy),
-  // Rules from the installed marketplace packs (snapshotted by the
-  // control plane). The plugin registers these in addition to its bundled
-  // packs. Optional so older backends — and older on-disk caches — that omit
-  // the field still parse; consumers read `bundle.rules ?? []`.
-  rules: external_exports.array(Rule).optional(),
-  // When true, `rules` IS the complete effective ruleset and the runtime must
-  // NOT merge its compiled-in bundled packs — the standalone gateway sets this
-  // after reading the user's installed snapshot (installed_packs, enabled
-  // packs only), which is how detection updates stay manual: new bundled
-  // rules run only after the user applies the pack update. Absent/false keeps
-  // the historical composition (bundled packs + rules) — older caches.
-  rulesComplete: external_exports.boolean().optional(),
-  // Active detection exceptions, evaluation subset only (see
-  // ExceptionBundleEntry). Optional so older bundle producers — and older
-  // on-disk caches — that omit the field still parse; consumers read
-  // `bundle.exceptions ?? []`.
-  exceptions: external_exports.array(ExceptionBundleEntry).optional(),
-  // Installed pack version, keyed by ruleId, for rules in `rules` that came
-  // from a versioned installed pack. Optional so older backends — and older
-  // on-disk caches — that omit the field still parse; consumers fall back to
-  // the rule's own spec version. NOT the bundle version above — see
-  // installedRuleset's ruleVersions for the source of truth.
-  ruleVersions: external_exports.record(external_exports.string(), external_exports.string()).optional(),
-  customKeywords: external_exports.array(external_exports.string()),
-  fetchedAt: external_exports.iso.datetime()
-}).meta({ id: "PolicyBundle" });
-var OBSERVE_ONLY_CATEGORIES = ["config"];
-var ENFORCEABLE_CATEGORIES = DetectionCategory.options.filter((c) => !OBSERVE_ONLY_CATEGORIES.includes(c));
-var CATEGORY_PEAK_SEVERITY = {
-  secret: "critical",
-  financial: "critical",
-  // core-financial/credit-card
-  code_flaw: "critical",
-  pii: "high",
-  phi: "high",
-  custom: "high",
-  // user-defined; conservative
-  code_context: "low",
-  config: "low"
-  // observe-only; floors to monitor regardless
-};
-function severityFloorPolicy(category) {
-  if (OBSERVE_ONLY_CATEGORIES.includes(category)) return "monitor";
-  const peak = CATEGORY_PEAK_SEVERITY[category];
-  return peak === "critical" || peak === "high" ? "warn" : "monitor";
-}
-var PolicyKind = external_exports.enum(["builtin", "custom"]).meta({ id: "PolicyKind" });
-var KNOWN_BUILTIN_IDS = ["monitor", "warn", "redact", "block"];
-var BuiltinPolicyId = external_exports.enum(KNOWN_BUILTIN_IDS).meta({ id: "BuiltinPolicyId" });
-var BUILTIN_POLICY_SPECS = {
-  monitor: {
-    name: "Monitor",
-    action: "log",
-    description: "Log every match for audit. The request is allowed through untouched."
-  },
-  warn: {
-    name: "Warn",
-    action: "warn",
-    description: "Allow the request, but warn the user inline before it is sent."
-  },
-  redact: {
-    name: "Redact",
-    action: "redact",
-    description: "Automatically strip the matched value from the request, then continue."
-  },
-  block: {
-    name: "Block",
-    action: "block",
-    description: "Refuse the request entirely whenever any rule in this detection matches."
-  }
-};
-function builtinPolicyToAction(id) {
-  return BUILTIN_POLICY_SPECS[id].action;
-}
-var DEFAULT_ACTIONS = Object.fromEntries(
-  DetectionCategory.options.map((c) => [c, builtinPolicyToAction(severityFloorPolicy(c))])
-);
-var BUILTIN_POLICIES = Object.fromEntries(
-  KNOWN_BUILTIN_IDS.map((id) => [id, { id, ...BUILTIN_POLICY_SPECS[id] }])
-);
-var UsedByItem = external_exports.object({
-  id: external_exports.string(),
-  name: external_exports.string(),
-  ruleCount: external_exports.number().int().nonnegative(),
-  enabled: external_exports.boolean()
-}).meta({ id: "UsedByItem" });
-var PolicyListItem = external_exports.object({
-  id: external_exports.string(),
-  kind: PolicyKind,
-  name: external_exports.string(),
-  enabled: external_exports.boolean(),
-  usedByCount: external_exports.number().int().nonnegative()
-}).meta({ id: "PolicyListItem" });
-var PolicyDetail = external_exports.object({
-  specVersion: external_exports.literal(1),
-  id: external_exports.string(),
-  kind: PolicyKind,
-  name: external_exports.string(),
-  enabled: external_exports.boolean(),
-  description: external_exports.string(),
-  usedBy: external_exports.array(UsedByItem)
-}).meta({ id: "PolicyDetail" });
-var PolicyStatsResponse = external_exports.object({
-  policies: external_exports.number().int().nonnegative(),
-  builtin: external_exports.number().int().nonnegative(),
-  custom: external_exports.number().int().nonnegative(),
-  detectionsGoverned: external_exports.number().int().nonnegative()
-}).meta({ id: "PolicyStatsResponse" });
-
-// ../../packages/schema/src/zod/api.ts
-var LIST_QUERY_MAX_LIMIT = 200;
-var ListEventsQuery = external_exports.object({
-  cursor: external_exports.string().optional(),
-  limit: external_exports.coerce.number().int().min(1).max(LIST_QUERY_MAX_LIMIT).default(50),
-  sourceTool: external_exports.string().optional(),
-  kind: external_exports.string().optional(),
-  from: external_exports.iso.datetime().optional(),
-  to: external_exports.iso.datetime().optional()
-});
-var ListEventsResponse = external_exports.object({
-  items: external_exports.array(Event),
-  nextCursor: external_exports.string().nullable()
-}).meta({ id: "ListEventsResponse" });
-var IngestResponse = external_exports.object({
-  accepted: external_exports.number().int().nonnegative(),
-  duplicates: external_exports.number().int().nonnegative()
-}).meta({ id: "IngestResponse" });
-var ListFindingsQuery = external_exports.object({
-  cursor: external_exports.string().optional(),
-  limit: external_exports.coerce.number().int().min(1).max(LIST_QUERY_MAX_LIMIT).default(50),
-  severity: external_exports.string().optional(),
-  category: external_exports.string().optional(),
-  eventId: external_exports.guid().optional()
-});
-var ListFindingsResponse = external_exports.object({
-  items: external_exports.array(Finding),
-  nextCursor: external_exports.string().nullable()
-}).meta({ id: "ListFindingsResponse" });
-var ListPoliciesResponse = external_exports.object({ items: external_exports.array(PolicyListItem) }).meta({ id: "ListPoliciesResponse" });
-var CreatePolicyRequest = Policy.omit({ id: true }).meta({
-  id: "CreatePolicyRequest"
-});
-var UpdatePolicyRequest = Policy.partial().required({ id: true }).meta({ id: "UpdatePolicyRequest" });
-var RecordAuditEventResponse = external_exports.object({ accepted: external_exports.boolean() }).meta({ id: "RecordAuditEventResponse" });
-var ErrorResponse = external_exports.object({
-  error: external_exports.object({
-    code: external_exports.string(),
-    message: external_exports.string(),
-    details: external_exports.unknown().optional()
-  })
-}).meta({ id: "ErrorResponse" });
-
-// ../../packages/schema/src/zod/config-inventory.ts
-var ConfigScope = external_exports.enum(["user", "project", "local", "plugin"]);
-var SkillScanEntry = external_exports.object({
-  name: external_exports.string().min(1),
-  // The identity source: a marketplace repo for plugin skills (e.g.
-  // 'anthropics/skills'), 'local' for personal ~/.claude/skills, or
-  // 'project:<repo-identity>' for checked-in project skills. The surrogate keeps
-  // a personal skill named 'pdf' from colliding with the marketplace 'pdf'.
-  source: external_exports.string().min(1),
-  scope: ConfigScope,
-  pluginName: external_exports.string().optional(),
-  // Volatile — rides the attribute bag, never the identity hash.
-  version: external_exports.string().optional(),
-  description: external_exports.string().optional(),
-  // Skill directory mtime (ISO) — the "updated Nd ago" freshness signal.
-  updatedAt: external_exports.iso.datetime().optional(),
-  // Filesystem path — the promoted inventory `location` column.
-  location: external_exports.string().optional()
-});
-var HookScanEntry = external_exports.object({
-  // Hook event name (PreToolUse, PostToolUse, …). Open string, not an enum: the
-  // set is harness-defined and grows without a schema change.
-  event: external_exports.string().min(1),
-  // The tool matcher ('Bash', 'Edit|Write', …). Absent = matches all tools.
-  matcher: external_exports.string().optional(),
-  command: external_exports.string().min(1),
-  timeout: external_exports.number().optional(),
-  scope: ConfigScope,
-  pluginName: external_exports.string().optional(),
-  // The settings file / hooks.json the entry came from.
-  location: external_exports.string().optional()
-});
-var McpServerScanEntry = external_exports.object({
-  // The server's config key ("github", "filesystem", …) — identity, with the
-  // qualified scope (see mcpServerIdentityKey).
-  name: external_exports.string().min(1),
-  scope: ConfigScope,
-  pluginName: external_exports.string().optional(),
-  // The owning plugin's marketplace — part of PLUGIN-scope identity: two
-  // marketplaces can each ship a plugin named `guard`, and without this their
-  // same-named servers would collapse to one row (the second silently dropped,
-  // inheriting the first's trust).
-  marketplace: external_exports.string().optional(),
-  // The repo identity (remote url, or the cwd for un-remoted repos) — part of
-  // PROJECT/LOCAL-scope identity: a server named `github` in repo A and one in
-  // repo B are different servers with different commands, and MUST NOT share a
-  // row — a shared row would let a cloned repo's .mcp.json inherit the trust
-  // the user granted elsewhere.
-  project: external_exports.string().optional(),
-  // 'stdio' when the entry carries a command; otherwise the config's `type`
-  // ('http' / 'sse' / …). Open string — the transport set is harness-defined.
-  transport: external_exports.string().min(1),
-  // Volatile on purpose (unlike hook `command`): a changed command/url is drift
-  // on a stable row — visible across config_scan snapshots and preserving the
-  // user's trust decision — never a quiet new row. One of the two is present.
-  // Secret-masked at collection time (the scanner runs the bundled detection
-  // packs over both — tokens routinely ride command args and URLs).
-  command: external_exports.string().optional(),
-  url: external_exports.string().optional(),
-  // Env var NAMES only, never values (the no-secrets rule).
-  envKeys: external_exports.array(external_exports.string()).optional(),
-  // The config file the entry came from.
-  location: external_exports.string().optional()
-});
-var ConfigFileScanEntry = external_exports.object({
-  // Basename (settings.json, CLAUDE.md) or dir name (commands/, agents/).
-  name: external_exports.string().min(1),
-  // The absolute path — identity (with scope) and the promoted `location`.
-  path: external_exports.string().min(1),
-  scope: ConfigScope,
-  // Human label: "User settings", "Project memory", "Slash commands", …
-  kind: external_exports.string().min(1),
-  // Derived SHAPE summary — top-level key names, entry counts, line counts.
-  // Never file content or values (memory files can carry sensitive detail).
-  detail: external_exports.string().optional(),
-  // Dir configs (commands/, agents/) and .mcp.json: how many entries.
-  entryCount: external_exports.number().optional(),
-  // File mtime (ISO) — the freshness signal.
-  updatedAt: external_exports.iso.datetime().optional()
-});
-var ConfigScanResult = external_exports.object({
-  scannedAt: external_exports.iso.datetime(),
-  skills: external_exports.array(SkillScanEntry),
-  hooks: external_exports.array(HookScanEntry),
-  mcpServers: external_exports.array(McpServerScanEntry),
-  configFiles: external_exports.array(ConfigFileScanEntry),
-  errors: external_exports.array(external_exports.object({ source: external_exports.string(), reason: external_exports.string() }))
-});
-var ConfigPostureFindingInput = external_exports.object({
-  ruleId: external_exports.string().min(1),
-  version: external_exports.string().min(1),
-  span: Span,
-  // For posture rules this is the offending COMMAND (config the user already
-  // holds locally, not captured secret content) — it is also the correlation
-  // key the read surface matches back to a hook row.
-  maskedMatch: external_exports.string(),
-  actionTaken: ActionTaken,
-  confidence: external_exports.number().min(0).max(1)
-});
-var ConfigScanRecord = external_exports.object({
-  items: external_exports.array(InventoryInput),
-  scanEvent: AuditEventInput,
-  definitions: external_exports.array(InspectionDefinitionInput).optional(),
-  findings: external_exports.array(ConfigPostureFindingInput).optional()
-});
-
-// ../../packages/schema/src/zod/registry.ts
-var Namespace = external_exports.string().regex(/^[a-z][a-z0-9-]*$/);
-var PackId = external_exports.string().regex(/^[a-z][a-z0-9-]*$/);
-var SemVer = external_exports.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-.]+)?$/);
-var PublisherKind = external_exports.enum(["labs", "user", "org"]);
-
 // ../../packages/schema/src/zod/detection.ts
 var OriginEnum = external_exports.enum(["library"]).meta({ id: "OriginEnum" });
 var DetectionFilterEnum = external_exports.enum(["all", "library", "custom", "customized", "updates"]);
@@ -16903,81 +16492,306 @@ var ListDetectionsQuery = external_exports.object({
   filter: DetectionFilterEnum.optional().default("all"),
   q: external_exports.string().optional()
 });
-var DetectionStats = external_exports.object({
-  detections: external_exports.number().int().nonnegative(),
-  rules: external_exports.number().int().nonnegative(),
-  active: external_exports.number().int().nonnegative(),
-  findingsLast30d: external_exports.number().int().nonnegative()
-}).meta({ id: "DetectionStats" });
-var DetectionRule = external_exports.object({
-  id: external_exports.string(),
-  name: external_exports.string(),
-  category: DetectionCategory,
-  severity: Severity,
-  matcher: Matcher
-}).meta({ id: "DetectionRule" });
-var DetectionUpdate = external_exports.object({
-  available: external_exports.boolean(),
-  latestVersion: SemVer,
-  // Rule count of the latest snapshot. Lets the update UI show a meaningful
-  // delta ("2 rules → 14 rules") when the version did NOT change but the rule
-  // content did — the OSS store compares content, not just version. Optional:
-  // registry-backed updates omit it.
-  latestRuleCount: external_exports.number().int().nonnegative().optional()
-}).nullable().meta({ id: "DetectionUpdate" });
-var DetectionDetail = external_exports.object({
-  id: external_exports.string(),
-  name: external_exports.string(),
-  version: SemVer,
-  enabled: external_exports.boolean(),
-  origin: OriginEnum,
-  publisher: Namespace.optional(),
-  publisherKind: PublisherKind.optional(),
-  ruleCount: external_exports.number().int().nonnegative(),
-  namespace: Namespace,
-  packId: PackId,
-  description: external_exports.string().optional(),
-  editedAt: external_exports.iso.datetime(),
-  findingsLast30d: external_exports.number().int().nonnegative(),
-  latestVersion: SemVer.nullable().optional(),
-  update: DetectionUpdate,
-  rules: external_exports.array(DetectionRule),
-  modified: external_exports.boolean(),
-  // Per-pack enforcement-policy assignment. Holds a BuiltinPolicyId ARCHETYPE
-  // (monitor|warn|redact|block) — NOT a policies-table Policy.id guid; a
-  // detection is a PACK, and its policy is the archetype applied to all its
-  // rules. Absent == unassigned, which resolves to Monitor everywhere
-  // (DEFAULT_PACK_POLICY_ID). Every enforcement surface expands it into
-  // per-rule policies (see policyIdToAction). Typed z.string() (not
-  // the enum) to keep the OpenAPI response tolerant of a future custom id.
-  policyId: external_exports.string().optional()
-}).meta({ id: "DetectionDetail" });
-var LibraryItem = external_exports.object({
-  id: external_exports.string(),
-  name: external_exports.string(),
-  publisher: Namespace,
-  publisherKind: PublisherKind.optional(),
-  // LOSSY single-category view of a pack. A pack MAY span several categories;
-  // this carries only the canonical-first one for display. Do NOT filter/facet
-  // on it — the library filter matches a pack's full category set (see
-  // ListLibraryResponse.categories).
-  category: DetectionCategory.optional(),
-  version: SemVer,
-  ruleCount: external_exports.number().int().nonnegative(),
-  description: external_exports.string().optional(),
-  updatedAt: external_exports.iso.datetime(),
-  state: LibraryStateEnum,
-  importedAs: external_exports.string().nullable()
-}).meta({ id: "LibraryItem" });
-var ListLibraryResponse = external_exports.object({
-  categories: external_exports.array(DetectionCategory),
-  items: external_exports.array(LibraryItem)
-}).meta({ id: "ListLibraryResponse" });
-var ImportDetectionRequest = external_exports.object({
-  libraryId: external_exports.string().refine((v) => /^[^/]+\/[^/]+$/.test(v), {
-    message: "libraryId must be in namespace/packId format"
-  })
-}).meta({ id: "ImportDetectionRequest" });
+var DetectionStats = external_exports.object({
+  detections: external_exports.number().int().nonnegative(),
+  rules: external_exports.number().int().nonnegative(),
+  active: external_exports.number().int().nonnegative(),
+  findingsLast30d: external_exports.number().int().nonnegative()
+}).meta({ id: "DetectionStats" });
+var DetectionRule = external_exports.object({
+  id: external_exports.string(),
+  name: external_exports.string(),
+  category: DetectionCategory,
+  severity: Severity,
+  matcher: Matcher
+}).meta({ id: "DetectionRule" });
+var DetectionUpdate = external_exports.object({
+  available: external_exports.boolean(),
+  latestVersion: SemVer,
+  // Rule count of the latest snapshot. Lets the update UI show a meaningful
+  // delta ("2 rules → 14 rules") when the version did NOT change but the rule
+  // content did — the OSS store compares content, not just version. Optional:
+  // registry-backed updates omit it.
+  latestRuleCount: external_exports.number().int().nonnegative().optional()
+}).nullable().meta({ id: "DetectionUpdate" });
+var DetectionDetail = external_exports.object({
+  id: external_exports.string(),
+  name: external_exports.string(),
+  version: SemVer,
+  enabled: external_exports.boolean(),
+  origin: OriginEnum,
+  publisher: Namespace.optional(),
+  publisherKind: PublisherKind.optional(),
+  ruleCount: external_exports.number().int().nonnegative(),
+  namespace: Namespace,
+  packId: PackId,
+  description: external_exports.string().optional(),
+  editedAt: external_exports.iso.datetime(),
+  findingsLast30d: external_exports.number().int().nonnegative(),
+  latestVersion: SemVer.nullable().optional(),
+  update: DetectionUpdate,
+  rules: external_exports.array(DetectionRule),
+  modified: external_exports.boolean(),
+  // Per-pack enforcement-policy assignment. Holds a BuiltinPolicyId ARCHETYPE
+  // (monitor|warn|redact|block) — NOT a policies-table Policy.id guid; a
+  // detection is a PACK, and its policy is the archetype applied to all its
+  // rules. Absent == unassigned, which resolves to Monitor everywhere
+  // (DEFAULT_PACK_POLICY_ID). Every enforcement surface expands it into
+  // per-rule policies (see policyIdToAction). Typed z.string() (not
+  // the enum) to keep the OpenAPI response tolerant of a future custom id.
+  policyId: external_exports.string().optional()
+}).meta({ id: "DetectionDetail" });
+var LibraryItem = external_exports.object({
+  id: external_exports.string(),
+  name: external_exports.string(),
+  publisher: Namespace,
+  publisherKind: PublisherKind.optional(),
+  // LOSSY single-category view of a pack. A pack MAY span several categories;
+  // this carries only the canonical-first one for display. Do NOT filter/facet
+  // on it — the library filter matches a pack's full category set (see
+  // ListLibraryResponse.categories).
+  category: DetectionCategory.optional(),
+  version: SemVer,
+  ruleCount: external_exports.number().int().nonnegative(),
+  description: external_exports.string().optional(),
+  updatedAt: external_exports.iso.datetime(),
+  state: LibraryStateEnum,
+  importedAs: external_exports.string().nullable()
+}).meta({ id: "LibraryItem" });
+var ListLibraryResponse = external_exports.object({
+  categories: external_exports.array(DetectionCategory),
+  items: external_exports.array(LibraryItem)
+}).meta({ id: "ListLibraryResponse" });
+var ImportDetectionRequest = external_exports.object({
+  libraryId: external_exports.string().refine((v) => /^[^/]+\/[^/]+$/.test(v), {
+    message: "libraryId must be in namespace/packId format"
+  })
+}).meta({ id: "ImportDetectionRequest" });
+
+// ../../packages/schema/src/zod/inventory.ts
+var AssetType = external_exports.enum(["project", "skill", "mcp", "hook", "config"]).meta({ id: "AssetType" });
+var AccessLevel = external_exports.enum(["open", "approved", "blocked"]).meta({ id: "AccessLevel" });
+var Origin = external_exports.enum(["source", "public-dep", "vendored", "config", "data", "docs", "generated"]).meta({ id: "Origin" });
+var TrustLevel = external_exports.enum(["known-good", "risky", "unapproved"]).meta({ id: "TrustLevel" });
+var Flag = external_exports.enum(["update", "stale", "conflict", "unknown", "change", "untracked", "risk", "findings"]).meta({ id: "Flag" });
+var Visibility = external_exports.enum(["public", "private"]).meta({ id: "Visibility" });
+var HarnessEventKind = external_exports.enum(["block", "redact", "warn"]).meta({ id: "HarnessEventKind" });
+var HarnessId = Harness.extract(["ClaudeCode", "Cursor", "Codex", "Antigravity"]).meta({
+  id: "HarnessId"
+});
+var AccessCounts = external_exports.object({
+  open: external_exports.number().int().nonnegative(),
+  approved: external_exports.number().int().nonnegative(),
+  blocked: external_exports.number().int().nonnegative(),
+  total: external_exports.number().int().nonnegative()
+}).meta({ id: "AccessCounts" });
+var AssetSummary = external_exports.object({
+  id: external_exports.string(),
+  type: AssetType,
+  name: external_exports.string(),
+  sub: external_exports.string(),
+  flags: external_exports.array(Flag),
+  /** MCP servers only — omitted for all other types. */
+  trust: TrustLevel.optional()
+}).meta({ id: "AssetSummary" });
+var ProjectSummary = external_exports.object({
+  id: external_exports.string(),
+  name: external_exports.string(),
+  repo: external_exports.string(),
+  visibility: Visibility,
+  language: external_exports.string(),
+  policyDefault: AccessLevel,
+  updatedAt: external_exports.iso.datetime(),
+  accessCounts: AccessCounts,
+  findingsCount: external_exports.number().int().nonnegative()
+}).meta({ id: "ProjectSummary" });
+var HarnessCategory = external_exports.object({
+  /** One of config/skill/mcp/hook — never project (enforced at service layer). */
+  type: AssetType,
+  assets: external_exports.array(AssetSummary)
+});
+var HarnessSummary = external_exports.object({
+  id: HarnessId,
+  label: external_exports.string(),
+  kind: external_exports.string(),
+  version: external_exports.string(),
+  sessions: external_exports.number().int().nonnegative(),
+  assetCount: external_exports.number().int().nonnegative(),
+  flagCount: external_exports.number().int().nonnegative(),
+  projects: external_exports.array(ProjectSummary),
+  categories: external_exports.array(HarnessCategory)
+}).meta({ id: "HarnessSummary" });
+var ListHarnessesResponse = external_exports.object({ items: external_exports.array(HarnessSummary) }).meta({ id: "ListHarnessesResponse" });
+var AssetGroup = external_exports.object({
+  /** Group key — never project (enforced at service layer). */
+  type: AssetType,
+  total: external_exports.number().int().nonnegative(),
+  /**
+   * MCP group only — omitted for all other types.
+   * Partial: only TrustLevel keys with non-zero counts are included.
+   * Strict: unknown keys are rejected — only TrustLevel values are valid keys.
+   */
+  trustRollup: external_exports.object({
+    "known-good": external_exports.number().int().nonnegative(),
+    risky: external_exports.number().int().nonnegative(),
+    unapproved: external_exports.number().int().nonnegative()
+  }).partial().strict().optional(),
+  /**
+   * Partial: only Flag keys with non-zero counts are included.
+   * Strict: unknown keys are rejected — only Flag values are valid keys.
+   */
+  flagRollup: external_exports.object({
+    update: external_exports.number().int().nonnegative(),
+    stale: external_exports.number().int().nonnegative(),
+    conflict: external_exports.number().int().nonnegative(),
+    unknown: external_exports.number().int().nonnegative(),
+    change: external_exports.number().int().nonnegative(),
+    untracked: external_exports.number().int().nonnegative(),
+    risk: external_exports.number().int().nonnegative(),
+    findings: external_exports.number().int().nonnegative()
+  }).partial().strict(),
+  items: external_exports.array(AssetSummary)
+}).meta({ id: "AssetGroup" });
+var ListAssetsResponse = external_exports.object({ groups: external_exports.array(AssetGroup) }).meta({ id: "ListAssetsResponse" });
+var McpTool = external_exports.object({
+  name: external_exports.string(),
+  signature: external_exports.string(),
+  description: external_exports.string(),
+  write: external_exports.boolean(),
+  /** Non-null string when tool is dangerous / blocked; null otherwise. */
+  risk: external_exports.string().nullable()
+}).meta({ id: "McpTool" });
+var AssetFindingRef = external_exports.object({
+  id: external_exports.string(),
+  title: external_exports.string(),
+  note: external_exports.string()
+});
+var AssetDetail = AssetSummary.extend({
+  /** string | null — null when no description is available. */
+  description: external_exports.string().nullable(),
+  /** trustLevel | null — null for non-MCP assets. */
+  trust: TrustLevel.nullable(),
+  /** Type-specific raw key/values — FE renders the grid. */
+  meta: external_exports.record(external_exports.string(), external_exports.unknown()),
+  /** always present — object when there is an active finding, null when absent. */
+  finding: AssetFindingRef.nullable(),
+  /** MCP exposed-tools list — omitted for non-mcp. */
+  tools: external_exports.array(McpTool).optional()
+}).meta({ id: "AssetDetail" });
+var ListProjectsResponse = external_exports.object({ items: external_exports.array(ProjectSummary) }).meta({ id: "ListProjectsResponse" });
+var InventoryStats = external_exports.object({
+  /** Total assets/projects with ≥1 flag or finding (drives the attention header chip). */
+  attention: external_exports.number().int().nonnegative(),
+  byType: external_exports.object({
+    project: external_exports.number().int().nonnegative(),
+    skill: external_exports.number().int().nonnegative(),
+    mcp: external_exports.number().int().nonnegative(),
+    hook: external_exports.number().int().nonnegative(),
+    config: external_exports.number().int().nonnegative()
+  }),
+  harnesses: external_exports.number().int().nonnegative(),
+  mcpTrust: external_exports.object({
+    "known-good": external_exports.number().int().nonnegative(),
+    risky: external_exports.number().int().nonnegative(),
+    unapproved: external_exports.number().int().nonnegative()
+  })
+}).meta({ id: "InventoryStats" });
+var FileSummary = external_exports.object({
+  path: external_exports.string(),
+  name: external_exports.string(),
+  origin: Origin,
+  /** Effective access (override applied). */
+  access: AccessLevel,
+  /** True when a file_access_override differs from the computed default. */
+  isCustom: external_exports.boolean(),
+  findings: external_exports.number().int().nonnegative(),
+  /** When the file was auto-blocked by a detection; null when not blocked. */
+  blockedAt: external_exports.iso.datetime().nullable().optional(),
+  /** Why the file was blocked; null when absent. */
+  note: external_exports.string().nullable().optional()
+}).meta({ id: "FileSummary" });
+var FolderSummary = external_exports.object({
+  name: external_exports.string(),
+  path: external_exports.string(),
+  /** Rollup of effective access across all descendants. */
+  accessCounts: AccessCounts
+}).meta({ id: "FolderSummary" });
+var ProjectTreeResponse = external_exports.object({
+  project: external_exports.object({
+    id: external_exports.string(),
+    repo: external_exports.string(),
+    visibility: Visibility
+  }),
+  path: external_exports.string(),
+  /** Browse mode: one-level folders at the current path. Omitted in search mode. */
+  folders: external_exports.array(FolderSummary).optional(),
+  files: external_exports.array(FileSummary)
+}).meta({ id: "ProjectTreeResponse" });
+var FileDetail = FileSummary.extend({
+  project: external_exports.object({
+    repo: external_exports.string(),
+    visibility: Visibility,
+    language: external_exports.string(),
+    policyDefault: AccessLevel,
+    updatedAt: external_exports.iso.datetime()
+  }),
+  findingsRefs: external_exports.array(external_exports.object({ id: external_exports.string(), title: external_exports.string() }))
+}).meta({ id: "FileDetail" });
+var SetFileAccessBody = external_exports.object({
+  path: external_exports.string(),
+  access: AccessLevel
+}).meta({ id: "SetFileAccessBody" });
+var SetFileAccessResponse = external_exports.object({
+  file: FileSummary,
+  accessCounts: AccessCounts
+}).meta({ id: "SetFileAccessResponse" });
+var SetMcpTrustBody = external_exports.object({ trust: TrustLevel }).meta({ id: "SetMcpTrustBody" });
+var HarnessEventItem = external_exports.object({
+  kind: HarnessEventKind,
+  title: external_exports.string(),
+  detail: external_exports.string(),
+  occurredAt: external_exports.iso.datetime(),
+  findingId: external_exports.string().nullable().optional()
+}).meta({ id: "HarnessEventItem" });
+var HarnessEventsResponse = external_exports.object({
+  counts: external_exports.object({
+    block: external_exports.number().int().nonnegative(),
+    redact: external_exports.number().int().nonnegative(),
+    warn: external_exports.number().int().nonnegative()
+  }),
+  items: external_exports.array(HarnessEventItem)
+}).meta({ id: "HarnessEventsResponse" });
+var RescanResponse = external_exports.object({
+  jobId: external_exports.string(),
+  startedAt: external_exports.iso.datetime()
+}).meta({ id: "RescanResponse" });
+var ConnectProjectBody = external_exports.object({ repo: external_exports.string() }).meta({ id: "ConnectProjectBody" });
+var ListAssetsQuery = external_exports.object({
+  /** Filter by one or more AssetType values; absent means all types. */
+  type: external_exports.array(AssetType).optional(),
+  /** Free-text search term. */
+  q: external_exports.string().optional()
+});
+var GetProjectTreeQuery = external_exports.object({
+  /** Subtree root path; defaults to repository root when absent. */
+  path: external_exports.string().optional(),
+  /** Free-text filter applied to file paths. */
+  q: external_exports.string().optional(),
+  /**
+   * Special listing mode. `blocked` returns every effectively-blocked, auto-blocked
+   * file across the whole repo (folders omitted, most-recent first), ignoring
+   * `path`/`q` — powers the project-wide "recently blocked" strip.
+   */
+  filter: external_exports.enum(["blocked"]).optional()
+});
+var GetProjectFileQuery = external_exports.object({
+  /** Repository-relative file path; absent or empty → 400. */
+  path: external_exports.string()
+});
+var GetHarnessEventsQuery = external_exports.object({
+  /** Maximum number of events to return.  Range: 1–50; default: 7. */
+  limit: external_exports.coerce.number().int().min(1).max(50).default(7)
+});
 
 // ../../packages/schema/src/zod/shares.ts
 var DestinationKind = external_exports.enum(["provider", "internal", "external", "ip"]).meta({ id: "DestinationKind" });
@@ -17113,77 +16927,198 @@ var ListShareDestinationsQuery = external_exports.object({
    */
   review: external_exports.stringbool().default(false)
 });
-var ExportSharesQuery = external_exports.object({
-  format: external_exports.enum(["csv", "json"]).default("csv"),
-  q: external_exports.string().optional(),
-  kind: external_exports.array(DestinationKind).optional()
+var ExportSharesQuery = external_exports.object({
+  format: external_exports.enum(["csv", "json"]).default("csv"),
+  q: external_exports.string().optional(),
+  kind: external_exports.array(DestinationKind).optional()
+});
+
+// ../../packages/schema/src/zod/egress-extraction.ts
+var EgressEcosystem = external_exports.enum(["npm", "pypi", "go", "maven", "rubygems", "cargo", "composer", "nuget"]).meta({ id: "EgressEcosystem" });
+var ProviderRegistryEntry = external_exports.object({
+  id: external_exports.string(),
+  name: external_exports.string(),
+  category: external_exports.string(),
+  /** Suffix-matched: 'stripe.com' matches api.stripe.com, never evilstripe.com. */
+  hostSuffixes: external_exports.array(external_exports.string()).min(1),
+  /** Canonical API base URL recorded for manifest-derived (method 'SDK') endpoints. */
+  apiBase: external_exports.string(),
+  /** Most-sensitive first; index 0 becomes the endpoint dataClass. */
+  defaultDataClasses: external_exports.array(DataClass).min(1),
+  /** SDK identifiers per ecosystem ('go' prefix-matched by path, 'maven' by group-id prefix). */
+  sdks: external_exports.partialRecord(EgressEcosystem, external_exports.array(external_exports.string()))
+}).meta({ id: "ProviderRegistryEntry" });
+var EgressCallSiteHit = external_exports.object({
+  file: external_exports.string(),
+  line: external_exports.number().int().positive(),
+  snippet: external_exports.string(),
+  dynamic: external_exports.boolean(),
+  vendored: external_exports.boolean()
+}).meta({ id: "EgressCallSiteHit" });
+var ResolvedEgressHit = external_exports.object({
+  host: external_exports.string(),
+  kind: DestinationKind,
+  name: external_exports.string(),
+  category: external_exports.string(),
+  trust: ShareTrustLevel,
+  network: DestinationNetwork.nullable(),
+  method: HttpMethod,
+  transport: Transport,
+  url: external_exports.string(),
+  template: external_exports.boolean(),
+  dataClass: DataClass,
+  site: EgressCallSiteHit
+}).meta({ id: "ResolvedEgressHit" });
+var EgressReconcile = external_exports.discriminatedUnion("mode", [
+  external_exports.object({ mode: external_exports.literal("walk"), walkedPrefix: external_exports.string() }),
+  external_exports.object({
+    mode: external_exports.literal("ledger"),
+    scannedFiles: external_exports.array(external_exports.string()),
+    deletedFiles: external_exports.array(external_exports.string())
+  })
+]).meta({ id: "EgressReconcile" });
+var RecordProjectEgressInput = external_exports.object({
+  /** Stable reconcile key: 'git:<repo identity>' or 'path:<abs root>' (non-git). */
+  projectKey: external_exports.string().min(1),
+  /** Display name only — never keys reconciliation. */
+  project: external_exports.string(),
+  projectId: external_exports.string().nullable(),
+  reconcile: EgressReconcile,
+  hits: external_exports.array(ResolvedEgressHit)
+}).meta({ id: "RecordProjectEgressInput" });
+var EgressWriteSummary = external_exports.object({
+  destinations: external_exports.number().int().nonnegative(),
+  endpoints: external_exports.number().int().nonnegative(),
+  callSites: external_exports.number().int().nonnegative(),
+  truncated: external_exports.boolean(),
+  /**
+   * Files the cap dropped whole. Their stored rows were left untouched, so a
+   * ledger-keeping caller must withhold their ledger entries and read them
+   * again next scan.
+   */
+  droppedFiles: external_exports.array(external_exports.string()).default([])
+}).meta({ id: "EgressWriteSummary" });
+
+// ../../packages/schema/src/zod/event.ts
+var EventKind = external_exports.enum(["prompt", "response", "code_change", "tool_use"]).meta({ id: "EventKind" });
+var CAPTURE_EVENT_TYPES_SQL = EventKind.options.map((k) => `'${k}'`).join(",");
+var EventMetadata = external_exports.object({
+  sessionId: external_exports.string().optional(),
+  repo: external_exports.string().optional(),
+  filePath: external_exports.string().optional(),
+  // The host tool whose input/output was scanned (e.g. 'Bash', 'WebFetch'),
+  // set by the tool-scanning hooks. The tool NAME only — never the tool's
+  // arguments or output, which can carry the very value a finding masked
+  // (metadata is stored unredacted). Gives findings on non-file captures a
+  // display location ("via Bash") when no filePath exists.
+  toolName: external_exports.string().optional(),
+  // Set (true) by the worktree scanner when the file is excluded by the
+  // repo's .gitignore. Gitignored files ARE still scanned — local scratch and
+  // generated code can leak real secrets — but the provenance is recorded so
+  // policy/dashboards can treat those findings as informational rather than
+  // blocking. Omitted (not false) for tracked files and non-scan events.
+  gitignored: external_exports.boolean().optional(),
+  // Set (true) ONLY when the event's `content` is the COMPLETE file at
+  // capture time (a worktree scan reading from disk). Hook-captured edits
+  // (e.g. an Edit tool's new_string) are partial fragments and MUST NOT set
+  // this. The resolver-on-ingest keys its fixed-at-source dropout
+  // diff on this marker: only a whole-file snapshot can prove a previously
+  // open finding is gone; a fragment's absence proves nothing (the secret
+  // may live outside the hunk). Omitted (not false) for fragments and
+  // non-scan events, so pre-marker clients safely default to the
+  // non-authoritative path.
+  wholeFile: external_exports.boolean().optional(),
+  model: external_exports.string().optional(),
+  turnIndex: external_exports.number().int().nonnegative().optional(),
+  // Distributed-tracing correlation. `correlationId` ties a recorded event back
+  // to the request that captured/ingested it (a UUID, generated independently of
+  // the trace id); `traceId` is the W3C trace id (32 lowercase hex chars) of the
+  // originating span when telemetry is enabled. Both optional + backward
+  // compatible — populated by the plugin (see @akasecurity/plugin-sdk).
+  correlationId: external_exports.uuid().optional(),
+  traceId: external_exports.string().regex(/^[0-9a-f]{32}$/).optional(),
+  // Ids of the detection exceptions that downgraded findings in this capture
+  // to 'allow' — the enforcement audit trail's link back to the grant that
+  // authorized the bypass. Absent on captures where no exception applied.
+  exceptionIds: external_exports.array(external_exports.guid()).optional()
+}).meta({ id: "EventMetadata" });
+var Event = external_exports.object({
+  id: external_exports.guid(),
+  sourceTool: SourceTool,
+  kind: EventKind,
+  occurredAt: external_exports.iso.datetime(),
+  contentHash: external_exports.string(),
+  content: external_exports.string(),
+  metadata: EventMetadata.optional()
+}).meta({ id: "Event" });
+var IngestEvent = Event.meta({ id: "IngestEvent" });
+var IngestBatch = external_exports.object({
+  events: external_exports.array(IngestEvent).min(1).max(100),
+  // Dedup policy for this batch. Id-dedup ALWAYS applies. 'content-hash'
+  // additionally rejects any event whose contentHash the store has already
+  // recorded — for re-runnable bulk ingest (worktree scan, transcript
+  // backfill), where a re-run mints fresh event ids for identical content and
+  // would otherwise accumulate duplicates. Live hook traffic must NOT set it:
+  // two genuinely separate prompts can be byte-identical and both belong on
+  // the timeline.
+  dedupe: external_exports.literal("content-hash").optional()
+}).meta({ id: "IngestBatch" });
+
+// ../../packages/schema/src/zod/exception.ts
+var ExceptionScope = external_exports.enum(["once", "temporary", "permanent"]);
+var ExceptionConditions = external_exports.object({
+  repo: external_exports.string().optional(),
+  sourceTool: external_exports.string().optional(),
+  provider: external_exports.string().optional()
+}).strict();
+var ExceptionCapability = external_exports.enum(["suppress", "reveal_to_model"]);
+var DetectionException = external_exports.object({
+  id: external_exports.guid(),
+  ruleId: external_exports.string(),
+  // Denormalized from the rule, for reporting — never matched on.
+  category: DetectionCategory,
+  // HMAC-SHA256 hex of the raw match under a machine-local key: a KEYED
+  // fingerprint, never the raw value, and never reversible. Matching recomputes
+  // the fingerprint from a fresh capture; the value itself is never stored.
+  // Shape-constrained so a malformed — or accidentally raw — value is rejected
+  // at the boundary rather than persisted.
+  valueFingerprint: external_exports.string().regex(/^[0-9a-f]{64}$/),
+  // Version of the fingerprint key the grant was written under; a rotated key
+  // invalidates old grants rather than silently mismatching them.
+  keyVersion: external_exports.number().int().positive(),
+  // maskMatch() preview of the approved value — never the raw value.
+  maskedValue: external_exports.string(),
+  capability: ExceptionCapability.default("suppress"),
+  scope: ExceptionScope,
+  expiresAt: external_exports.iso.datetime().nullable(),
+  maxUses: external_exports.number().int().positive().nullable(),
+  useCount: external_exports.number().int().nonnegative(),
+  lastUsedAt: external_exports.iso.datetime().nullable(),
+  // Mandatory: every grant carries the human reason it exists.
+  justification: external_exports.string().min(1),
+  conditions: ExceptionConditions.nullable(),
+  createdBy: external_exports.string(),
+  createdVia: external_exports.enum(["cli-approve", "cli-add", "web-approve", "web-add", "api", "setup-triage"]),
+  createdAt: external_exports.iso.datetime(),
+  updatedAt: external_exports.iso.datetime(),
+  // Revocation is terminal and retained — consumed/expired/revoked rows are
+  // audit evidence; nothing in the exception lifecycle hard-deletes.
+  revokedAt: external_exports.iso.datetime().nullable(),
+  revokedBy: external_exports.string().nullable(),
+  revokeReason: external_exports.string().nullable()
+});
+var ExceptionBundleEntry = DetectionException.pick({
+  id: true,
+  ruleId: true,
+  valueFingerprint: true,
+  keyVersion: true,
+  capability: true,
+  expiresAt: true,
+  maxUses: true,
+  useCount: true,
+  conditions: true
 });
-
-// ../../packages/schema/src/zod/egress-extraction.ts
-var EgressEcosystem = external_exports.enum(["npm", "pypi", "go", "maven", "rubygems", "cargo", "composer", "nuget"]).meta({ id: "EgressEcosystem" });
-var ProviderRegistryEntry = external_exports.object({
-  id: external_exports.string(),
-  name: external_exports.string(),
-  category: external_exports.string(),
-  /** Suffix-matched: 'stripe.com' matches api.stripe.com, never evilstripe.com. */
-  hostSuffixes: external_exports.array(external_exports.string()).min(1),
-  /** Canonical API base URL recorded for manifest-derived (method 'SDK') endpoints. */
-  apiBase: external_exports.string(),
-  /** Most-sensitive first; index 0 becomes the endpoint dataClass. */
-  defaultDataClasses: external_exports.array(DataClass).min(1),
-  /** SDK identifiers per ecosystem ('go' prefix-matched by path, 'maven' by group-id prefix). */
-  sdks: external_exports.partialRecord(EgressEcosystem, external_exports.array(external_exports.string()))
-}).meta({ id: "ProviderRegistryEntry" });
-var EgressCallSiteHit = external_exports.object({
-  file: external_exports.string(),
-  line: external_exports.number().int().positive(),
-  snippet: external_exports.string(),
-  dynamic: external_exports.boolean(),
-  vendored: external_exports.boolean()
-}).meta({ id: "EgressCallSiteHit" });
-var ResolvedEgressHit = external_exports.object({
-  host: external_exports.string(),
-  kind: DestinationKind,
-  name: external_exports.string(),
-  category: external_exports.string(),
-  trust: ShareTrustLevel,
-  network: DestinationNetwork.nullable(),
-  method: HttpMethod,
-  transport: Transport,
-  url: external_exports.string(),
-  template: external_exports.boolean(),
-  dataClass: DataClass,
-  site: EgressCallSiteHit
-}).meta({ id: "ResolvedEgressHit" });
-var EgressReconcile = external_exports.discriminatedUnion("mode", [
-  external_exports.object({ mode: external_exports.literal("walk"), walkedPrefix: external_exports.string() }),
-  external_exports.object({
-    mode: external_exports.literal("ledger"),
-    scannedFiles: external_exports.array(external_exports.string()),
-    deletedFiles: external_exports.array(external_exports.string())
-  })
-]).meta({ id: "EgressReconcile" });
-var RecordProjectEgressInput = external_exports.object({
-  /** Stable reconcile key: 'git:<repo identity>' or 'path:<abs root>' (non-git). */
-  projectKey: external_exports.string().min(1),
-  /** Display name only — never keys reconciliation. */
-  project: external_exports.string(),
-  projectId: external_exports.string().nullable(),
-  reconcile: EgressReconcile,
-  hits: external_exports.array(ResolvedEgressHit)
-}).meta({ id: "RecordProjectEgressInput" });
-var EgressWriteSummary = external_exports.object({
-  destinations: external_exports.number().int().nonnegative(),
-  endpoints: external_exports.number().int().nonnegative(),
-  callSites: external_exports.number().int().nonnegative(),
-  truncated: external_exports.boolean(),
-  /**
-   * Files the cap dropped whole. Their stored rows were left untouched, so a
-   * ledger-keeping caller must withhold their ledger entries and read them
-   * again next scan.
-   */
-  droppedFiles: external_exports.array(external_exports.string()).default([])
-}).meta({ id: "EgressWriteSummary" });
+var ExceptionDescriptor = DetectionException.omit({ valueFingerprint: true });
 
 // ../../packages/schema/src/zod/exception-action.ts
 var confirmation = external_exports.string().optional();
@@ -17396,7 +17331,13 @@ var VaultConsent = external_exports.object({
 
 // ../../packages/schema/src/zod/local.ts
 var WORKSPACE_SETTINGS_SPEC_VERSION = 5;
-var RunMode = external_exports.enum(["standalone"]);
+var RunMode = external_exports.enum(["standalone", "attached"]);
+var ControlPlaneConnection = external_exports.object({
+  endpoint: external_exports.string().min(1),
+  // Display name for the deployment, shown instead of the raw endpoint.
+  label: external_exports.string().min(1).optional(),
+  attachedAt: external_exports.iso.datetime()
+}).meta({ id: "ControlPlaneConnection" });
 var SimpleDetectionPolicy = external_exports.enum(["redact", "warn"]);
 var HistoricalAccess = external_exports.enum(["full", "session-only"]);
 var ModelJudgeConsent = external_exports.object({
@@ -17405,12 +17346,10 @@ var ModelJudgeConsent = external_exports.object({
 });
 var WorkspaceSettings = external_exports.object({
   specVersion: external_exports.number().int().positive().default(WORKSPACE_SETTINGS_SPEC_VERSION),
-  // Settings files written by earlier releases may carry the retired 'attached'
-  // value; it parses as 'standalone' so those files keep loading.
-  runMode: external_exports.preprocess(
-    (v) => v === "attached" ? "standalone" : v,
-    RunMode.default("standalone")
-  ),
+  runMode: RunMode.default("standalone"),
+  // Present only while attached; a detach clears it. Its presence is what makes
+  // `runMode: 'attached'` mean anything — see isAttached.
+  controlPlane: ControlPlaneConnection.optional(),
   policy: SimpleDetectionPolicy.default("redact"),
   // Consent for scanning pre-install surfaces; opt-in (see HistoricalAccess).
   historicalAccess: HistoricalAccess.default("session-only"),
@@ -17436,6 +17375,195 @@ var WorkspaceSettings = external_exports.object({
   modelJudgeConsent: ModelJudgeConsent.optional()
 });
 
+// ../../packages/schema/src/zod/managed.ts
+var MANAGED_SETTINGS_SPEC_VERSION = 1;
+var ManagedSettingKey = external_exports.enum([
+  "runMode",
+  "historicalAccess",
+  "vaultConsent",
+  "vaultKeyCustody",
+  "vaultInlineReveal",
+  "modelJudgeConsent",
+  "dataSharesInPlace"
+]).meta({ id: "ManagedSettingKey" });
+var ManagedSettingsValues = external_exports.object({
+  runMode: external_exports.enum(["standalone", "attached"]).optional(),
+  controlPlane: external_exports.object({
+    endpoint: external_exports.string().min(1),
+    label: external_exports.string().min(1).optional()
+  }).optional(),
+  historicalAccess: external_exports.enum(["full", "session-only"]).optional(),
+  vaultConsent: external_exports.boolean().optional(),
+  vaultKeyCustody: external_exports.enum(["file", "keychain"]).optional(),
+  vaultInlineReveal: external_exports.enum(["masked", "full", "off"]).optional(),
+  modelJudgeConsent: external_exports.boolean().optional(),
+  dataSharesInPlace: external_exports.boolean().optional()
+}).meta({ id: "ManagedSettingsValues" });
+var ManagedSettings = external_exports.object({
+  specVersion: external_exports.number().int().positive().default(MANAGED_SETTINGS_SPEC_VERSION),
+  // Shown on every locked control, so the user can tell an administrative
+  // decision from a bug. Absent renders as a generic "your organization".
+  organization: external_exports.string().min(1).optional(),
+  // What the administrator pinned.
+  values: ManagedSettingsValues.default({}),
+  // Which of those the user may not change. A key here with no matching value
+  // freezes whatever the user last chose; a value with no lock is a DEFAULT
+  // the user may still override. The two are separable on purpose.
+  lockedFields: external_exports.array(ManagedSettingKey).default([])
+}).meta({ id: "ManagedSettings" });
+
+// ../../packages/schema/src/zod/policy.ts
+var PolicyScope = external_exports.enum(["global", "repo", "user"]).meta({ id: "PolicyScope" });
+var PolicyTarget = external_exports.union([external_exports.object({ ruleId: external_exports.string() }), external_exports.object({ category: DetectionCategory })]).meta({ id: "PolicyTarget" });
+var Policy = external_exports.object({
+  id: external_exports.guid(),
+  scope: PolicyScope,
+  target: PolicyTarget,
+  action: ActionTaken,
+  enabled: external_exports.boolean().default(true),
+  customKeywords: external_exports.array(external_exports.string()).optional(),
+  // Display name — optional so older policy rows without name still parse.
+  // Added for the findings API (policy.name column migration).
+  name: external_exports.string().optional()
+}).meta({ id: "Policy" });
+var PolicyBundle = external_exports.object({
+  version: external_exports.string(),
+  policies: external_exports.array(Policy),
+  // Rules from the installed marketplace packs (snapshotted by the
+  // control plane). The plugin registers these in addition to its bundled
+  // packs. Optional so older backends — and older on-disk caches — that omit
+  // the field still parse; consumers read `bundle.rules ?? []`.
+  rules: external_exports.array(Rule).optional(),
+  // When true, `rules` IS the complete effective ruleset and the runtime must
+  // NOT merge its compiled-in bundled packs — the standalone gateway sets this
+  // after reading the user's installed snapshot (installed_packs, enabled
+  // packs only), which is how detection updates stay manual: new bundled
+  // rules run only after the user applies the pack update. Absent/false keeps
+  // the historical composition (bundled packs + rules) — older caches.
+  rulesComplete: external_exports.boolean().optional(),
+  // Active detection exceptions, evaluation subset only (see
+  // ExceptionBundleEntry). Optional so older bundle producers — and older
+  // on-disk caches — that omit the field still parse; consumers read
+  // `bundle.exceptions ?? []`.
+  exceptions: external_exports.array(ExceptionBundleEntry).optional(),
+  // Rule ids whose pack is assigned a REVERSIBLE archetype (Redact & Vault).
+  // A second axis over the same `redact` action, carried beside the policies
+  // rather than on them: nothing writes ruleId-targeted policies to disk, so
+  // widening Policy itself would change a persisted shape to express something
+  // only the in-memory bundle needs. Optional so an older producer — or an
+  // older on-disk cache — still parses; consumers read `?? []` and get the
+  // pre-existing one-way behaviour, which is the safe direction to default.
+  reversibleRuleIds: external_exports.array(external_exports.string()).optional(),
+  // Installed pack version, keyed by ruleId, for rules in `rules` that came
+  // from a versioned installed pack. Optional so older backends — and older
+  // on-disk caches — that omit the field still parse; consumers fall back to
+  // the rule's own spec version. NOT the bundle version above — see
+  // installedRuleset's ruleVersions for the source of truth.
+  ruleVersions: external_exports.record(external_exports.string(), external_exports.string()).optional(),
+  customKeywords: external_exports.array(external_exports.string()),
+  fetchedAt: external_exports.iso.datetime()
+}).meta({ id: "PolicyBundle" });
+var OBSERVE_ONLY_CATEGORIES = ["config"];
+var ENFORCEABLE_CATEGORIES = DetectionCategory.options.filter((c) => !OBSERVE_ONLY_CATEGORIES.includes(c));
+var CATEGORY_PEAK_SEVERITY = {
+  secret: "critical",
+  financial: "critical",
+  // core-financial/credit-card
+  code_flaw: "critical",
+  pii: "high",
+  phi: "high",
+  custom: "high",
+  // user-defined; conservative
+  code_context: "low",
+  config: "low"
+  // observe-only; floors to monitor regardless
+};
+function severityFloorPolicy(category) {
+  if (OBSERVE_ONLY_CATEGORIES.includes(category)) return "monitor";
+  const peak = CATEGORY_PEAK_SEVERITY[category];
+  return peak === "critical" || peak === "high" ? "warn" : "monitor";
+}
+var PolicyKind = external_exports.enum(["builtin", "custom"]).meta({ id: "PolicyKind" });
+var KNOWN_BUILTIN_IDS = ["monitor", "warn", "redact", "vault", "block"];
+var BuiltinPolicyId = external_exports.enum(KNOWN_BUILTIN_IDS).meta({ id: "BuiltinPolicyId" });
+var BUILTIN_POLICY_SPECS = {
+  monitor: {
+    name: "Monitor",
+    action: "log",
+    reversible: false,
+    description: "Log every match for audit. The request is allowed through untouched."
+  },
+  warn: {
+    name: "Warn",
+    action: "warn",
+    reversible: false,
+    description: "Allow the request, but warn the user inline before it is sent."
+  },
+  redact: {
+    name: "Redact",
+    action: "redact",
+    reversible: false,
+    description: "Strip the matched value from the request and destroy it, then continue. What was removed cannot be recovered."
+  },
+  vault: {
+    name: "Redact & Vault",
+    action: "redact",
+    reversible: true,
+    description: "Strip the matched value from the request and keep an encrypted, recoverable copy in the local vault, leaving a pointer in its place. Needs the vault consent granted under Settings; without it this behaves as Redact."
+  },
+  block: {
+    name: "Block",
+    action: "block",
+    reversible: false,
+    description: "Refuse the request entirely whenever any rule in this detection matches."
+  }
+};
+function builtinPolicyToAction(id) {
+  return BUILTIN_POLICY_SPECS[id].action;
+}
+var CATEGORY_EXPRESSIBLE_IDS = KNOWN_BUILTIN_IDS.filter(
+  (id) => !BUILTIN_POLICY_SPECS[id].reversible
+);
+var CATEGORY_INEXPRESSIBLE_IDS = KNOWN_BUILTIN_IDS.filter(
+  (id) => BUILTIN_POLICY_SPECS[id].reversible
+);
+var CategoryPolicyId = external_exports.enum(CATEGORY_EXPRESSIBLE_IDS).meta({ id: "CategoryPolicyId" });
+var DEFAULT_ACTIONS = Object.fromEntries(
+  DetectionCategory.options.map((c) => [c, builtinPolicyToAction(severityFloorPolicy(c))])
+);
+var BUILTIN_POLICIES = Object.fromEntries(
+  KNOWN_BUILTIN_IDS.map((id) => [id, { id, ...BUILTIN_POLICY_SPECS[id] }])
+);
+var UsedByItem = external_exports.object({
+  id: external_exports.string(),
+  name: external_exports.string(),
+  ruleCount: external_exports.number().int().nonnegative(),
+  enabled: external_exports.boolean()
+}).meta({ id: "UsedByItem" });
+var PolicyListItem = external_exports.object({
+  id: external_exports.string(),
+  kind: PolicyKind,
+  name: external_exports.string(),
+  enabled: external_exports.boolean(),
+  usedByCount: external_exports.number().int().nonnegative()
+}).meta({ id: "PolicyListItem" });
+var ListPoliciesResponse = external_exports.object({ items: external_exports.array(PolicyListItem) }).meta({ id: "ListPoliciesResponse" });
+var PolicyDetail = external_exports.object({
+  specVersion: external_exports.literal(1),
+  id: external_exports.string(),
+  kind: PolicyKind,
+  name: external_exports.string(),
+  enabled: external_exports.boolean(),
+  description: external_exports.string(),
+  usedBy: external_exports.array(UsedByItem)
+}).meta({ id: "PolicyDetail" });
+var PolicyStatsResponse = external_exports.object({
+  policies: external_exports.number().int().nonnegative(),
+  builtin: external_exports.number().int().nonnegative(),
+  custom: external_exports.number().int().nonnegative(),
+  detectionsGoverned: external_exports.number().int().nonnegative()
+}).meta({ id: "PolicyStatsResponse" });
+
 // ../../packages/schema/src/zod/project-files.ts
 var ProjectFileInput = external_exports.object({
   path: external_exports.string().min(1),
@@ -17508,44 +17636,6 @@ var BatchedRemediation = external_exports.discriminatedUnion("kind", [
   NoRemediationDecision
 ]);
 
-// ../../packages/schema/src/zod/rule-test.ts
-var TestRulesRequest = external_exports.object({
-  rules: external_exports.array(Rule).min(1).max(100),
-  text: external_exports.string().max(5e4).optional(),
-  fixtures: external_exports.array(RuleFixture).max(200).optional()
-}).refine((v) => v.text !== void 0 || (v.fixtures?.length ?? 0) > 0, {
-  message: "Provide `text`, `fixtures`, or both \u2014 there must be something to test"
-}).meta({ id: "TestRulesRequest" });
-var RuleTestMatch = external_exports.object({
-  ruleId: external_exports.string(),
-  category: DetectionCategory,
-  severity: Severity,
-  span: Span,
-  confidence: external_exports.number().min(0).max(1),
-  match: external_exports.string()
-}).meta({ id: "RuleTestMatch" });
-var FixtureResult = external_exports.object({
-  label: external_exports.string(),
-  shouldMatch: external_exports.boolean(),
-  didMatch: external_exports.boolean(),
-  passed: external_exports.boolean(),
-  matches: external_exports.array(RuleTestMatch)
-}).meta({ id: "FixtureResult" });
-var TestRulesResponse = external_exports.object({
-  // Present only when the request supplied `text`.
-  adhoc: external_exports.object({ matches: external_exports.array(RuleTestMatch) }).optional(),
-  fixtures: external_exports.array(FixtureResult),
-  summary: external_exports.object({
-    total: external_exports.number().int().nonnegative(),
-    passed: external_exports.number().int().nonnegative(),
-    failed: external_exports.number().int().nonnegative()
-  }),
-  // Ids of rules whose matcher type the engine cannot evaluate today (e.g.
-  // `validator`), so they silently never match. Surfaced so an author is not
-  // misled by a green run that actually skipped a rule.
-  unsupportedRuleIds: external_exports.array(external_exports.string())
-}).meta({ id: "TestRulesResponse" });
-
 // ../../packages/schema/src/zod/security.ts
 var SeveritySummaryItem = external_exports.object({
   severity: Severity,
@@ -17643,10 +17733,22 @@ var TopSourcesQuery = external_exports.object({
   // Omit for both kinds.
   kind: external_exports.enum(SOURCE_KINDS).optional()
 });
-var Provider = external_exports.enum(["claudecode", "cursor", "codex", "antigravity", "claudeai", "chatgpt", "copilot", "api"]).meta({ id: "Provider" });
+var Provider = Harness.extract([
+  "ClaudeCode",
+  "Cursor",
+  "Codex",
+  "Antigravity",
+  "ClaudeAi",
+  "ChatGpt",
+  "Copilot",
+  "Api"
+]).meta({ id: "Provider" });
 var ScanCoverageProvider = external_exports.object({
   provider: Provider,
-  // Percent of that provider's traffic scanned in the window. 0 when unsupported.
+  // Percent of that provider's traffic the shipped capture surface reaches.
+  // A curated business fact, constant across every `range` — not a measured
+  // per-window metric. 0 exactly when `supported` is false. See the comment
+  // above the block for where these numbers are decided.
   coverage: external_exports.number().int().min(0).max(100),
   supported: external_exports.boolean()
 }).meta({ id: "ScanCoverageProvider" });
@@ -17700,6 +17802,18 @@ var ApplyRecommendedActionResponse = external_exports.object({
 var DismissRecommendedActionResponse = external_exports.object({ id: external_exports.string(), status: external_exports.literal("dismissed") }).meta({ id: "DismissRecommendedActionResponse" });
 var RecommendedActionIdParam = external_exports.object({ id: external_exports.string() });
 
+// ../../packages/schema/src/zod/settings-action.ts
+var SaveSettingsInput = external_exports.object({
+  historicalAccess: external_exports.string(),
+  modelJudgeConsent: external_exports.boolean(),
+  vaultConsent: external_exports.string(),
+  vaultInlineReveal: external_exports.string()
+});
+var AttachInput = external_exports.object({
+  endpoint: external_exports.string(),
+  label: external_exports.string().optional()
+});
+
 // ../../packages/schema/src/zod/triage.ts
 var TriageHit = external_exports.object({
   ruleId: external_exports.string(),
@@ -17714,7 +17828,7 @@ var TriageHit = external_exports.object({
   valueFingerprint: external_exports.string().optional(),
   keyVersion: external_exports.number().int().nonnegative().optional()
 });
-var TriagePolicy = BuiltinPolicyId;
+var TriagePolicy = CategoryPolicyId;
 var TriageCategoryRec = external_exports.object({
   category: DetectionCategory,
   action: TriagePolicy,
@@ -17951,24 +18065,39 @@ function probesFor(rule) {
   const derived = rule.matcher.type === "regex" ? derivedProbes(rule.matcher.pattern) : [];
   return [...derived, ...EXPONENTIAL_PROBES, ...POLYNOMIAL_PROBES];
 }
-function worstProbeMs(rule) {
+var wallClock = () => performance.now();
+function worstProbeMs(rule, now = wallClock, corroborate) {
   let ms = 0;
   let probe = "";
+  let corroboratedMs;
   for (const text of probesFor(rule)) {
-    const start = performance.now();
+    const start = now();
+    const corroborateStart = corroborate?.();
     scan(text, [rule]);
-    const elapsed = performance.now() - start;
+    const elapsed = now() - start;
+    const corroborateEnd = corroborate?.();
     if (elapsed > ms) {
       ms = elapsed;
       probe = text;
+      corroboratedMs = corroborateStart === void 0 || corroborateEnd === void 0 ? void 0 : corroborateEnd - corroborateStart;
     }
     if (ms >= BUDGET_MS) break;
   }
-  return { ms, probe };
+  return { ms, probe, corroboratedMs };
 }
-function checkRuleTiming(rule) {
-  const { ms, probe } = worstProbeMs(rule);
-  return { safe: ms < BUDGET_MS, worstMs: ms, probe };
+var CPU_CORROBORATION_SHARE = 0.2;
+var CORROBORATION_FLOOR_MS = BUDGET_MS * CPU_CORROBORATION_SHARE;
+function checkRuleTiming(rule, corroborate) {
+  const { ms, probe, corroboratedMs } = worstProbeMs(rule, wallClock, corroborate);
+  const work = corroboratedMs ?? 0;
+  const verdict = ms < BUDGET_MS ? "safe" : work >= CORROBORATION_FLOOR_MS ? "over-budget" : "uncorroborated";
+  return { verdict, worstMs: ms, corroboratedMs: work, probe };
+}
+
+// ../../packages/plugin-sdk/src/work-clock.ts
+function workClockMs() {
+  const usage = typeof process.threadCpuUsage === "function" ? process.threadCpuUsage() : process.cpuUsage();
+  return (usage.user + usage.system) / 1e3;
 }
 
 // ../../packages/plugin-sdk/src/scan-worker.ts
@@ -17982,8 +18111,8 @@ function post(message) {
 port.on("message", (job) => {
   try {
     if (job.kind === "probe") {
-      const { safe, worstMs } = checkRuleTiming(job.rule);
-      post({ kind: "probed", id: job.id, safe, worstMs });
+      const { verdict, worstMs, corroboratedMs } = checkRuleTiming(job.rule, workClockMs);
+      post({ kind: "probed", id: job.id, verdict, worstMs, corroboratedMs });
       return;
     }
     const context = job.filePath === void 0 ? void 0 : { filePath: job.filePath };