@akasecurity/ai-tc-claude-code 0.9.5 → 0.9.7

package/scripts/stop.js

@@ -15070,6 +15070,47 @@ function date4(params) {
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
 config(en_default());
 
+// ../../packages/schema/src/zod/harness-map.ts
+var HARNESS = {
+  ClaudeCode: "claudecode",
+  Cursor: "cursor",
+  Copilot: "copilot",
+  Codex: "codex",
+  Antigravity: "antigravity",
+  Windsurf: "windsurf",
+  ClaudeDesktop: "claudedesktop",
+  ChatGpt: "chatgpt",
+  ClaudeAi: "claudeai",
+  Api: "api"
+};
+var Harness = external_exports.enum(HARNESS).meta({ id: "Harness" });
+var SOURCE_TOOL = {
+  ClaudeCode: "claude-code",
+  ClaudeDesktop: "claude-desktop",
+  Cursor: "cursor",
+  ChatGpt: "chatgpt",
+  ClaudeAi: "claude-ai",
+  Copilot: "github-copilot",
+  Codex: "codex",
+  Antigravity: "antigravity",
+  // No harness counterpart, deliberately: the CLI's own captures and a capture
+  // whose tool could not be identified both render through the read side's
+  // miss path rather than as a harness of their own.
+  Cli: "cli",
+  Unknown: "unknown"
+};
+var SourceTool = external_exports.enum(SOURCE_TOOL).meta({ id: "SourceTool" });
+var TOOL_TO_HARNESS = {
+  [SOURCE_TOOL.ClaudeCode]: HARNESS.ClaudeCode,
+  [SOURCE_TOOL.ClaudeDesktop]: HARNESS.ClaudeDesktop,
+  [SOURCE_TOOL.Copilot]: HARNESS.Copilot,
+  [SOURCE_TOOL.Cursor]: HARNESS.Cursor,
+  [SOURCE_TOOL.ChatGpt]: HARNESS.ChatGpt,
+  [SOURCE_TOOL.Codex]: HARNESS.Codex,
+  [SOURCE_TOOL.Antigravity]: HARNESS.Antigravity,
+  [SOURCE_TOOL.ClaudeAi]: HARNESS.ClaudeAi
+};
+
 // ../../packages/schema/src/zod/finding.ts
 var DetectionCategory = external_exports.enum(["pii", "financial", "secret", "phi", "code_context", "code_flaw", "custom", "config"]).meta({ id: "DetectionCategory" });
 var Severity = external_exports.enum(["critical", "high", "medium", "low"]).meta({ id: "Severity" });
@@ -15092,21 +15133,22 @@ var Finding = external_exports.object({
 }).meta({ id: "Finding" });
 var DetectedFinding = Finding.meta({ id: "DetectedFinding" });
 var FindingAction = external_exports.enum(["blocked", "redacted", "warned", "allowed", "quarantined", "monitored"]).meta({ id: "FindingAction" });
-var FindingProvider = external_exports.enum([
-  "claudecode",
-  "claudedesktop",
-  "cursor",
-  "copilot",
-  "chatgpt",
-  "claudeai",
-  "codex",
-  "antigravity",
-  "api"
+var FindingProvider = Harness.extract([
+  "ClaudeCode",
+  "ClaudeDesktop",
+  "Cursor",
+  "Copilot",
+  "ChatGpt",
+  "ClaudeAi",
+  "Codex",
+  "Antigravity",
+  "Api"
 ]).meta({ id: "FindingProvider" });
 var FindingCategory = external_exports.enum([
   "secret",
   "pii",
   "source_code",
+  "code_flaw",
   "external_share",
   "mcp_server",
   "customer_data",
@@ -15284,6 +15326,7 @@ var FindingInstanceDetail = FindingInstance.extend({
   detection: FindingDetectionRef,
   policy: FindingPolicyRef
 }).meta({ id: "FindingInstanceDetail" });
+var MAX_FLAT_FINDINGS_LIMIT = 200;
 var ListFindingInstancesQuery = external_exports.object({
   severity: external_exports.array(Severity).optional(),
   // Rule ids, the same vocabulary the grouped list's `subtype` carries.
@@ -15303,7 +15346,7 @@ var ListFindingInstancesQuery = external_exports.object({
   q: external_exports.string().optional(),
   sessionId: external_exports.string().optional(),
   from: external_exports.iso.datetime().optional(),
-  limit: external_exports.coerce.number().int().min(1).max(200).optional(),
+  limit: external_exports.coerce.number().int().min(1).max(MAX_FLAT_FINDINGS_LIMIT).optional(),
   cursor: external_exports.string().optional()
 });
 var ListFindingInstancesResponse = external_exports.object({
@@ -15365,20 +15408,6 @@ var ListFindingLocationsResponse = external_exports.object({
   hasMore: external_exports.boolean()
 }).meta({ id: "ListFindingLocationsResponse" });
 
-// ../../packages/schema/src/zod/harness-map.ts
-var Harness = external_exports.enum([
-  "claudecode",
-  "cursor",
-  "copilot",
-  "codex",
-  "antigravity",
-  "windsurf",
-  "claudedesktop",
-  "chatgpt",
-  "claudeai",
-  "api"
-]).meta({ id: "Harness" });
-
 // ../../packages/schema/src/zod/meta.ts
 var InventoryObjectType = external_exports.enum(["host", "harness", "user", "skill", "hook", "mcp_server", "config_file"]).meta({ id: "InventoryObjectType" });
 var AuditEventType = external_exports.enum([
@@ -15828,366 +15857,122 @@ var ActivityOverviewResponse = external_exports.object({
   sessions: ListActivitySessionsResponse
 }).meta({ id: "ActivityOverviewResponse" });
 
-// ../../packages/schema/src/zod/event.ts
-var EventKind = external_exports.enum(["prompt", "response", "code_change", "tool_use"]).meta({ id: "EventKind" });
-var CAPTURE_EVENT_TYPES_SQL = EventKind.options.map((k) => `'${k}'`).join(",");
-var SourceTool = external_exports.enum([
-  "claude-code",
-  "claude-desktop",
-  "cursor",
-  "chatgpt",
-  "claude-ai",
-  "github-copilot",
-  "codex",
-  "antigravity",
-  "cli",
-  "unknown"
-]).meta({ id: "SourceTool" });
-var EventMetadata = external_exports.object({
-  sessionId: external_exports.string().optional(),
-  repo: external_exports.string().optional(),
-  filePath: external_exports.string().optional(),
-  // The host tool whose input/output was scanned (e.g. 'Bash', 'WebFetch'),
-  // set by the tool-scanning hooks. The tool NAME only — never the tool's
-  // arguments or output, which can carry the very value a finding masked
-  // (metadata is stored unredacted). Gives findings on non-file captures a
-  // display location ("via Bash") when no filePath exists.
-  toolName: external_exports.string().optional(),
-  // Set (true) by the worktree scanner when the file is excluded by the
-  // repo's .gitignore. Gitignored files ARE still scanned — local scratch and
-  // generated code can leak real secrets — but the provenance is recorded so
-  // policy/dashboards can treat those findings as informational rather than
-  // blocking. Omitted (not false) for tracked files and non-scan events.
-  gitignored: external_exports.boolean().optional(),
-  // Set (true) ONLY when the event's `content` is the COMPLETE file at
-  // capture time (a worktree scan reading from disk). Hook-captured edits
-  // (e.g. an Edit tool's new_string) are partial fragments and MUST NOT set
-  // this. The resolver-on-ingest keys its fixed-at-source dropout
-  // diff on this marker: only a whole-file snapshot can prove a previously
-  // open finding is gone; a fragment's absence proves nothing (the secret
-  // may live outside the hunk). Omitted (not false) for fragments and
-  // non-scan events, so pre-marker clients safely default to the
-  // non-authoritative path.
-  wholeFile: external_exports.boolean().optional(),
-  model: external_exports.string().optional(),
-  turnIndex: external_exports.number().int().nonnegative().optional(),
-  // Distributed-tracing correlation. `correlationId` ties a recorded event back
-  // to the request that captured/ingested it (a UUID, generated independently of
-  // the trace id); `traceId` is the W3C trace id (32 lowercase hex chars) of the
-  // originating span when telemetry is enabled. Both optional + backward
-  // compatible — populated by the plugin (see @akasecurity/plugin-sdk).
-  correlationId: external_exports.uuid().optional(),
-  traceId: external_exports.string().regex(/^[0-9a-f]{32}$/).optional(),
-  // Ids of the detection exceptions that downgraded findings in this capture
-  // to 'allow' — the enforcement audit trail's link back to the grant that
-  // authorized the bypass. Absent on captures where no exception applied.
-  exceptionIds: external_exports.array(external_exports.guid()).optional()
-}).meta({ id: "EventMetadata" });
-var Event = external_exports.object({
-  id: external_exports.guid(),
-  sourceTool: SourceTool,
-  kind: EventKind,
-  occurredAt: external_exports.iso.datetime(),
-  contentHash: external_exports.string(),
-  content: external_exports.string(),
-  metadata: EventMetadata.optional()
-}).meta({ id: "Event" });
-var IngestEvent = Event.meta({ id: "IngestEvent" });
-var IngestBatch = external_exports.object({
-  events: external_exports.array(IngestEvent).min(1).max(100),
-  // Dedup policy for this batch. Id-dedup ALWAYS applies. 'content-hash'
-  // additionally rejects any event whose contentHash the store has already
-  // recorded — for re-runnable bulk ingest (worktree scan, transcript
-  // backfill), where a re-run mints fresh event ids for identical content and
-  // would otherwise accumulate duplicates. Live hook traffic must NOT set it:
-  // two genuinely separate prompts can be byte-identical and both belong on
-  // the timeline.
-  dedupe: external_exports.literal("content-hash").optional()
-}).meta({ id: "IngestBatch" });
-
-// ../../packages/schema/src/zod/inventory.ts
-var AssetType = external_exports.enum(["project", "skill", "mcp", "hook", "config"]).meta({ id: "AssetType" });
-var AccessLevel = external_exports.enum(["open", "approved", "blocked"]).meta({ id: "AccessLevel" });
-var Origin = external_exports.enum(["source", "public-dep", "vendored", "config", "data", "docs", "generated"]).meta({ id: "Origin" });
-var TrustLevel = external_exports.enum(["known-good", "risky", "unapproved"]).meta({ id: "TrustLevel" });
-var Flag = external_exports.enum(["update", "stale", "conflict", "unknown", "change", "untracked", "risk", "findings"]).meta({ id: "Flag" });
-var Visibility = external_exports.enum(["public", "private"]).meta({ id: "Visibility" });
-var HarnessEventKind = external_exports.enum(["block", "redact", "warn"]).meta({ id: "HarnessEventKind" });
-var HarnessId = external_exports.enum(["claudecode", "cursor", "codex", "antigravity"]).meta({ id: "HarnessId" });
-var AccessCounts = external_exports.object({
-  open: external_exports.number().int().nonnegative(),
-  approved: external_exports.number().int().nonnegative(),
-  blocked: external_exports.number().int().nonnegative(),
-  total: external_exports.number().int().nonnegative()
-}).meta({ id: "AccessCounts" });
-var AssetSummary = external_exports.object({
-  id: external_exports.string(),
-  type: AssetType,
-  name: external_exports.string(),
-  sub: external_exports.string(),
-  flags: external_exports.array(Flag),
-  /** MCP servers only — omitted for all other types. */
-  trust: TrustLevel.optional()
-}).meta({ id: "AssetSummary" });
-var ProjectSummary = external_exports.object({
-  id: external_exports.string(),
-  name: external_exports.string(),
-  repo: external_exports.string(),
-  visibility: Visibility,
-  language: external_exports.string(),
-  policyDefault: AccessLevel,
-  updatedAt: external_exports.iso.datetime(),
-  accessCounts: AccessCounts,
-  findingsCount: external_exports.number().int().nonnegative()
-}).meta({ id: "ProjectSummary" });
-var HarnessCategory = external_exports.object({
-  /** One of config/skill/mcp/hook — never project (enforced at service layer). */
-  type: AssetType,
-  assets: external_exports.array(AssetSummary)
+// ../../packages/schema/src/zod/config-inventory.ts
+var ConfigScope = external_exports.enum(["user", "project", "local", "plugin"]);
+var SkillScanEntry = external_exports.object({
+  name: external_exports.string().min(1),
+  // The identity source: a marketplace repo for plugin skills (e.g.
+  // 'anthropics/skills'), 'local' for personal ~/.claude/skills, or
+  // 'project:<repo-identity>' for checked-in project skills. The surrogate keeps
+  // a personal skill named 'pdf' from colliding with the marketplace 'pdf'.
+  source: external_exports.string().min(1),
+  scope: ConfigScope,
+  pluginName: external_exports.string().optional(),
+  // Volatile — rides the attribute bag, never the identity hash.
+  version: external_exports.string().optional(),
+  description: external_exports.string().optional(),
+  // Skill directory mtime (ISO) — the "updated Nd ago" freshness signal.
+  updatedAt: external_exports.iso.datetime().optional(),
+  // Filesystem path — the promoted inventory `location` column.
+  location: external_exports.string().optional()
 });
-var HarnessSummary = external_exports.object({
-  id: HarnessId,
-  label: external_exports.string(),
-  kind: external_exports.string(),
-  version: external_exports.string(),
-  sessions: external_exports.number().int().nonnegative(),
-  assetCount: external_exports.number().int().nonnegative(),
-  flagCount: external_exports.number().int().nonnegative(),
-  projects: external_exports.array(ProjectSummary),
-  categories: external_exports.array(HarnessCategory)
-}).meta({ id: "HarnessSummary" });
-var ListHarnessesResponse = external_exports.object({ items: external_exports.array(HarnessSummary) }).meta({ id: "ListHarnessesResponse" });
-var AssetGroup = external_exports.object({
-  /** Group key — never project (enforced at service layer). */
-  type: AssetType,
-  total: external_exports.number().int().nonnegative(),
-  /**
-   * MCP group only — omitted for all other types.
-   * Partial: only TrustLevel keys with non-zero counts are included.
-   * Strict: unknown keys are rejected — only TrustLevel values are valid keys.
-   */
-  trustRollup: external_exports.object({
-    "known-good": external_exports.number().int().nonnegative(),
-    risky: external_exports.number().int().nonnegative(),
-    unapproved: external_exports.number().int().nonnegative()
-  }).partial().strict().optional(),
-  /**
-   * Partial: only Flag keys with non-zero counts are included.
-   * Strict: unknown keys are rejected — only Flag values are valid keys.
-   */
-  flagRollup: external_exports.object({
-    update: external_exports.number().int().nonnegative(),
-    stale: external_exports.number().int().nonnegative(),
-    conflict: external_exports.number().int().nonnegative(),
-    unknown: external_exports.number().int().nonnegative(),
-    change: external_exports.number().int().nonnegative(),
-    untracked: external_exports.number().int().nonnegative(),
-    risk: external_exports.number().int().nonnegative(),
-    findings: external_exports.number().int().nonnegative()
-  }).partial().strict(),
-  items: external_exports.array(AssetSummary)
-}).meta({ id: "AssetGroup" });
-var ListAssetsResponse = external_exports.object({ groups: external_exports.array(AssetGroup) }).meta({ id: "ListAssetsResponse" });
-var McpTool = external_exports.object({
-  name: external_exports.string(),
-  signature: external_exports.string(),
-  description: external_exports.string(),
-  write: external_exports.boolean(),
-  /** Non-null string when tool is dangerous / blocked; null otherwise. */
-  risk: external_exports.string().nullable()
-}).meta({ id: "McpTool" });
-var AssetFindingRef = external_exports.object({
-  id: external_exports.string(),
-  title: external_exports.string(),
-  note: external_exports.string()
+var HookScanEntry = external_exports.object({
+  // Hook event name (PreToolUse, PostToolUse, …). Open string, not an enum: the
+  // set is harness-defined and grows without a schema change.
+  event: external_exports.string().min(1),
+  // The tool matcher ('Bash', 'Edit|Write', …). Absent = matches all tools.
+  matcher: external_exports.string().optional(),
+  command: external_exports.string().min(1),
+  timeout: external_exports.number().optional(),
+  scope: ConfigScope,
+  pluginName: external_exports.string().optional(),
+  // The settings file / hooks.json the entry came from.
+  location: external_exports.string().optional()
 });
-var AssetDetail = AssetSummary.extend({
-  /** string | null — null when no description is available. */
-  description: external_exports.string().nullable(),
-  /** trustLevel | null — null for non-MCP assets. */
-  trust: TrustLevel.nullable(),
-  /** Type-specific raw key/values — FE renders the grid. */
-  meta: external_exports.record(external_exports.string(), external_exports.unknown()),
-  /** always present — object when there is an active finding, null when absent. */
-  finding: AssetFindingRef.nullable(),
-  /** MCP exposed-tools list — omitted for non-mcp. */
-  tools: external_exports.array(McpTool).optional()
-}).meta({ id: "AssetDetail" });
-var ListProjectsResponse = external_exports.object({ items: external_exports.array(ProjectSummary) }).meta({ id: "ListProjectsResponse" });
-var InventoryStats = external_exports.object({
-  /** Total assets/projects with ≥1 flag or finding (drives the attention header chip). */
-  attention: external_exports.number().int().nonnegative(),
-  byType: external_exports.object({
-    project: external_exports.number().int().nonnegative(),
-    skill: external_exports.number().int().nonnegative(),
-    mcp: external_exports.number().int().nonnegative(),
-    hook: external_exports.number().int().nonnegative(),
-    config: external_exports.number().int().nonnegative()
-  }),
-  harnesses: external_exports.number().int().nonnegative(),
-  mcpTrust: external_exports.object({
-    "known-good": external_exports.number().int().nonnegative(),
-    risky: external_exports.number().int().nonnegative(),
-    unapproved: external_exports.number().int().nonnegative()
-  })
-}).meta({ id: "InventoryStats" });
-var FileSummary = external_exports.object({
-  path: external_exports.string(),
-  name: external_exports.string(),
-  origin: Origin,
-  /** Effective access (override applied). */
-  access: AccessLevel,
-  /** True when a file_access_override differs from the computed default. */
-  isCustom: external_exports.boolean(),
-  findings: external_exports.number().int().nonnegative(),
-  /** When the file was auto-blocked by a detection; null when not blocked. */
-  blockedAt: external_exports.iso.datetime().nullable().optional(),
-  /** Why the file was blocked; null when absent. */
-  note: external_exports.string().nullable().optional()
-}).meta({ id: "FileSummary" });
-var FolderSummary = external_exports.object({
-  name: external_exports.string(),
-  path: external_exports.string(),
-  /** Rollup of effective access across all descendants. */
-  accessCounts: AccessCounts
-}).meta({ id: "FolderSummary" });
-var ProjectTreeResponse = external_exports.object({
-  project: external_exports.object({
-    id: external_exports.string(),
-    repo: external_exports.string(),
-    visibility: Visibility
-  }),
-  path: external_exports.string(),
-  /** Browse mode: one-level folders at the current path. Omitted in search mode. */
-  folders: external_exports.array(FolderSummary).optional(),
-  files: external_exports.array(FileSummary)
-}).meta({ id: "ProjectTreeResponse" });
-var FileDetail = FileSummary.extend({
-  project: external_exports.object({
-    repo: external_exports.string(),
-    visibility: Visibility,
-    language: external_exports.string(),
-    policyDefault: AccessLevel,
-    updatedAt: external_exports.iso.datetime()
-  }),
-  findingsRefs: external_exports.array(external_exports.object({ id: external_exports.string(), title: external_exports.string() }))
-}).meta({ id: "FileDetail" });
-var SetFileAccessBody = external_exports.object({
-  path: external_exports.string(),
-  access: AccessLevel
-}).meta({ id: "SetFileAccessBody" });
-var SetFileAccessResponse = external_exports.object({
-  file: FileSummary,
-  accessCounts: AccessCounts
-}).meta({ id: "SetFileAccessResponse" });
-var SetMcpTrustBody = external_exports.object({ trust: TrustLevel }).meta({ id: "SetMcpTrustBody" });
-var HarnessEventItem = external_exports.object({
-  kind: HarnessEventKind,
-  title: external_exports.string(),
-  detail: external_exports.string(),
-  occurredAt: external_exports.iso.datetime(),
-  findingId: external_exports.string().nullable().optional()
-}).meta({ id: "HarnessEventItem" });
-var HarnessEventsResponse = external_exports.object({
-  counts: external_exports.object({
-    block: external_exports.number().int().nonnegative(),
-    redact: external_exports.number().int().nonnegative(),
-    warn: external_exports.number().int().nonnegative()
-  }),
-  items: external_exports.array(HarnessEventItem)
-}).meta({ id: "HarnessEventsResponse" });
-var RescanResponse = external_exports.object({
-  jobId: external_exports.string(),
-  startedAt: external_exports.iso.datetime()
-}).meta({ id: "RescanResponse" });
-var ConnectProjectBody = external_exports.object({ repo: external_exports.string() }).meta({ id: "ConnectProjectBody" });
-var ListAssetsQuery = external_exports.object({
-  /** Filter by one or more AssetType values; absent means all types. */
-  type: external_exports.array(AssetType).optional(),
-  /** Free-text search term. */
-  q: external_exports.string().optional()
-});
-var GetProjectTreeQuery = external_exports.object({
-  /** Subtree root path; defaults to repository root when absent. */
-  path: external_exports.string().optional(),
-  /** Free-text filter applied to file paths. */
-  q: external_exports.string().optional(),
-  /**
-   * Special listing mode. `blocked` returns every effectively-blocked, auto-blocked
-   * file across the whole repo (folders omitted, most-recent first), ignoring
-   * `path`/`q` — powers the project-wide "recently blocked" strip.
-   */
-  filter: external_exports.enum(["blocked"]).optional()
+var McpServerScanEntry = external_exports.object({
+  // The server's config key ("github", "filesystem", …) — identity, with the
+  // qualified scope (see mcpServerIdentityKey).
+  name: external_exports.string().min(1),
+  scope: ConfigScope,
+  pluginName: external_exports.string().optional(),
+  // The owning plugin's marketplace — part of PLUGIN-scope identity: two
+  // marketplaces can each ship a plugin named `guard`, and without this their
+  // same-named servers would collapse to one row (the second silently dropped,
+  // inheriting the first's trust).
+  marketplace: external_exports.string().optional(),
+  // The repo identity (remote url, or the cwd for un-remoted repos) — part of
+  // PROJECT/LOCAL-scope identity: a server named `github` in repo A and one in
+  // repo B are different servers with different commands, and MUST NOT share a
+  // row — a shared row would let a cloned repo's .mcp.json inherit the trust
+  // the user granted elsewhere.
+  project: external_exports.string().optional(),
+  // 'stdio' when the entry carries a command; otherwise the config's `type`
+  // ('http' / 'sse' / …). Open string — the transport set is harness-defined.
+  transport: external_exports.string().min(1),
+  // Volatile on purpose (unlike hook `command`): a changed command/url is drift
+  // on a stable row — visible across config_scan snapshots and preserving the
+  // user's trust decision — never a quiet new row. One of the two is present.
+  // Secret-masked at collection time (the scanner runs the bundled detection
+  // packs over both — tokens routinely ride command args and URLs).
+  command: external_exports.string().optional(),
+  url: external_exports.string().optional(),
+  // Env var NAMES only, never values (the no-secrets rule).
+  envKeys: external_exports.array(external_exports.string()).optional(),
+  // The config file the entry came from.
+  location: external_exports.string().optional()
 });
-var GetProjectFileQuery = external_exports.object({
-  /** Repository-relative file path; absent or empty → 400. */
-  path: external_exports.string()
+var ConfigFileScanEntry = external_exports.object({
+  // Basename (settings.json, CLAUDE.md) or dir name (commands/, agents/).
+  name: external_exports.string().min(1),
+  // The absolute path — identity (with scope) and the promoted `location`.
+  path: external_exports.string().min(1),
+  scope: ConfigScope,
+  // Human label: "User settings", "Project memory", "Slash commands", …
+  kind: external_exports.string().min(1),
+  // Derived SHAPE summary — top-level key names, entry counts, line counts.
+  // Never file content or values (memory files can carry sensitive detail).
+  detail: external_exports.string().optional(),
+  // Dir configs (commands/, agents/) and .mcp.json: how many entries.
+  entryCount: external_exports.number().optional(),
+  // File mtime (ISO) — the freshness signal.
+  updatedAt: external_exports.iso.datetime().optional()
 });
-var GetHarnessEventsQuery = external_exports.object({
-  /** Maximum number of events to return.  Range: 1–50; default: 7. */
-  limit: external_exports.coerce.number().int().min(1).max(50).default(7)
+var ConfigScanResult = external_exports.object({
+  scannedAt: external_exports.iso.datetime(),
+  skills: external_exports.array(SkillScanEntry),
+  hooks: external_exports.array(HookScanEntry),
+  mcpServers: external_exports.array(McpServerScanEntry),
+  configFiles: external_exports.array(ConfigFileScanEntry),
+  errors: external_exports.array(external_exports.object({ source: external_exports.string(), reason: external_exports.string() }))
 });
-
-// ../../packages/schema/src/zod/exception.ts
-var ExceptionScope = external_exports.enum(["once", "temporary", "permanent"]);
-var ExceptionConditions = external_exports.object({
-  repo: external_exports.string().optional(),
-  sourceTool: external_exports.string().optional(),
-  provider: external_exports.string().optional()
-}).strict();
-var ExceptionCapability = external_exports.enum(["suppress", "reveal_to_model"]);
-var DetectionException = external_exports.object({
-  id: external_exports.guid(),
-  ruleId: external_exports.string(),
-  // Denormalized from the rule, for reporting — never matched on.
-  category: DetectionCategory,
-  // HMAC-SHA256 hex of the raw match under a machine-local key: a KEYED
-  // fingerprint, never the raw value, and never reversible. Matching recomputes
-  // the fingerprint from a fresh capture; the value itself is never stored.
-  // Shape-constrained so a malformed — or accidentally raw — value is rejected
-  // at the boundary rather than persisted.
-  valueFingerprint: external_exports.string().regex(/^[0-9a-f]{64}$/),
-  // Version of the fingerprint key the grant was written under; a rotated key
-  // invalidates old grants rather than silently mismatching them.
-  keyVersion: external_exports.number().int().positive(),
-  // maskMatch() preview of the approved value — never the raw value.
-  maskedValue: external_exports.string(),
-  capability: ExceptionCapability.default("suppress"),
-  scope: ExceptionScope,
-  expiresAt: external_exports.iso.datetime().nullable(),
-  maxUses: external_exports.number().int().positive().nullable(),
-  useCount: external_exports.number().int().nonnegative(),
-  lastUsedAt: external_exports.iso.datetime().nullable(),
-  // Mandatory: every grant carries the human reason it exists.
-  justification: external_exports.string().min(1),
-  conditions: ExceptionConditions.nullable(),
-  createdBy: external_exports.string(),
-  createdVia: external_exports.enum(["cli-approve", "cli-add", "web-approve", "web-add", "api", "setup-triage"]),
-  createdAt: external_exports.iso.datetime(),
-  updatedAt: external_exports.iso.datetime(),
-  // Revocation is terminal and retained — consumed/expired/revoked rows are
-  // audit evidence; nothing in the exception lifecycle hard-deletes.
-  revokedAt: external_exports.iso.datetime().nullable(),
-  revokedBy: external_exports.string().nullable(),
-  revokeReason: external_exports.string().nullable()
+var ConfigPostureFindingInput = external_exports.object({
+  ruleId: external_exports.string().min(1),
+  version: external_exports.string().min(1),
+  span: Span,
+  // For posture rules this is the offending COMMAND (config the user already
+  // holds locally, not captured secret content) — it is also the correlation
+  // key the read surface matches back to a hook row.
+  maskedMatch: external_exports.string(),
+  actionTaken: ActionTaken,
+  confidence: external_exports.number().min(0).max(1)
 });
-var ExceptionBundleEntry = DetectionException.pick({
-  id: true,
-  ruleId: true,
-  valueFingerprint: true,
-  keyVersion: true,
-  capability: true,
-  expiresAt: true,
-  maxUses: true,
-  useCount: true,
-  conditions: true
+var ConfigScanRecord = external_exports.object({
+  items: external_exports.array(InventoryInput),
+  scanEvent: AuditEventInput,
+  definitions: external_exports.array(InspectionDefinitionInput).optional(),
+  findings: external_exports.array(ConfigPostureFindingInput).optional()
 });
-var ExceptionDescriptor = DetectionException.omit({ valueFingerprint: true });
+
+// ../../packages/schema/src/zod/registry.ts
+var Namespace = external_exports.string().regex(/^[a-z][a-z0-9-]*$/);
+var PackId = external_exports.string().regex(/^[a-z][a-z0-9-]*$/);
+var SemVer = external_exports.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-.]+)?$/);
+var PublisherKind = external_exports.enum(["labs", "user", "org"]);
 
 // ../../packages/schema/src/zod/rule.ts
-var MatcherType = external_exports.enum(["keyword", "regex", "validator"]).meta({ id: "MatcherType" });
+var MatcherType = external_exports.enum(["keyword", "regex"]).meta({ id: "MatcherType" });
 var RuleProbeVerdict = external_exports.enum(["safe", "quarantined"]).meta({ id: "RuleProbeVerdict" });
-var KeywordMatcher = external_exports.object({
+var KeywordMatcher = external_exports.strictObject({
   type: external_exports.literal("keyword"),
   // An empty keyword matches at every position, yielding one zero-length span
   // per character. Rejected here because a keyword that matches everything is
@@ -16203,16 +15988,31 @@ function isValidRegex(pattern, flags) {
     return false;
   }
 }
+function probeFlags(flags) {
+  return flags.replace(/[gy]/g, "");
+}
 function matchesEmptyString(pattern, flags) {
   try {
-    const re = new RegExp(pattern, flags.replace(/[gy]/g, ""));
+    const re = new RegExp(pattern, probeFlags(flags));
     return re.exec("")?.[0].length === 0;
   } catch {
     return false;
   }
 }
+function spansWholeMatch(captureGroup) {
+  return captureGroup === void 0 || captureGroup === 0;
+}
+function captureGroupCount(pattern, flags) {
+  try {
+    const probe = new RegExp(`${pattern}|`, probeFlags(flags));
+    const result = probe.exec("");
+    return result ? result.length - 1 : void 0;
+  } catch {
+    return void 0;
+  }
+}
 var MAX_PATTERN_LENGTH = 2e3;
-var RegexMatcher = external_exports.object({
+var RegexMatcher = external_exports.strictObject({
   type: external_exports.literal("regex"),
   pattern: external_exports.string().min(1).max(MAX_PATTERN_LENGTH),
   flags: external_exports.string().default("gi"),
@@ -16220,28 +16020,47 @@ var RegexMatcher = external_exports.object({
 }).refine((v) => isValidRegex(v.pattern, v.flags), {
   message: "pattern/flags do not form a valid JavaScript regular expression",
   path: ["pattern"]
-}).refine((v) => v.captureGroup !== void 0 || !matchesEmptyString(v.pattern, v.flags), {
+}).refine((v) => !spansWholeMatch(v.captureGroup) || !matchesEmptyString(v.pattern, v.flags), {
   message: 'a whole-match regex that can match the empty string (e.g. "\\d*", "a?", "(?:)") can hang the matcher \u2014 scope the quantifier to a captureGroup, or require at least one character',
   path: ["pattern"]
+}).superRefine((v, ctx) => {
+  if (v.captureGroup === void 0) return;
+  const groups = captureGroupCount(v.pattern, v.flags);
+  if (groups === void 0 || v.captureGroup <= groups) return;
+  ctx.addIssue({
+    code: "custom",
+    path: ["captureGroup"],
+    message: `captureGroup ${String(v.captureGroup)} is out of range \u2014 the pattern declares ${String(groups)} capture group(s), so valid values are 0-${String(groups)}. An out-of-range group never matches, which would make the rule silently never fire.`
+  });
 });
-var ValidatorMatcher = external_exports.object({
-  type: external_exports.literal("validator"),
-  name: external_exports.enum(["luhn", "entropy", "ssn-checksum"]),
-  config: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
-});
-var Matcher = external_exports.discriminatedUnion("type", [KeywordMatcher, RegexMatcher, ValidatorMatcher]).meta({ id: "Matcher" });
-var AppliesTo = external_exports.object({
+var Matcher = external_exports.discriminatedUnion("type", [KeywordMatcher, RegexMatcher]).meta({ id: "Matcher" });
+var MATCHER_TYPES = MatcherType.options;
+var AppliesTo = external_exports.strictObject({
   // Dot-prefixed, e.g. ".py" — matches the scanner's SOURCE_EXTENSIONS shape.
   extensions: external_exports.array(external_exports.string().regex(/^\.[A-Za-z0-9]+$/)).min(1)
 }).meta({ id: "AppliesTo" });
-var PostValidatorRef = external_exports.union([
-  external_exports.string(),
-  external_exports.object({
-    name: external_exports.string(),
-    config: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
-  })
-]).meta({ id: "PostValidatorRef" });
-var RequiresNearby = external_exports.object({
+var PostValidatorName = external_exports.enum(["entropy", "luhn"]).meta({ id: "PostValidatorName" });
+var PostValidatorRef = external_exports.union(
+  [
+    PostValidatorName,
+    external_exports.strictObject({
+      name: PostValidatorName,
+      config: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
+    })
+  ],
+  {
+    // A union reports one collapsed issue for every way its arms can fail, so
+    // this has to describe the whole shape rather than just the name — it is
+    // what an author sees for a misspelled name AND for a stray key in the
+    // object form. The names come from the enum so the message cannot go
+    // stale. Without it Zod says only "Invalid input", which is precisely the
+    // no-feedback outcome this schema exists to remove.
+    error: () => `not a valid post-validator: use a bare name (${PostValidatorName.options.map((name) => JSON.stringify(name)).join(
+      " or "
+    )}) or { "name": ..., "config": { ... } }. An unrecognized name would be a false-positive guard that never runs.`
+  }
+).meta({ id: "PostValidatorRef" });
+var RequiresNearby = external_exports.strictObject({
   // Each array, when present, must be non-empty and contain non-empty strings —
   // an empty/blank criterion would either never fire or (for labels) match
   // everything.
@@ -16256,16 +16075,23 @@ var RequiresNearby = external_exports.object({
   (v) => (v.categories?.length ?? 0) + (v.ruleIds?.length ?? 0) + (v.labels?.length ?? 0) > 0,
   { message: "requiresNearby needs at least one of categories, ruleIds, or labels" }
 ).meta({ id: "RequiresNearby" });
-var RuleFixture = external_exports.object({
+var RuleFixture = external_exports.strictObject({
   label: external_exports.string(),
   text: external_exports.string().max(5e4),
   shouldMatch: external_exports.boolean(),
   // Simulated file context for the scan, so fixtures can assert `appliesTo`
   // gating (e.g. a Python-only pattern must NOT fire in a .ts file).
   filePath: external_exports.string().optional(),
-  expectedSpans: external_exports.array(external_exports.object({ start: external_exports.number(), end: external_exports.number() })).optional()
+  expectedSpans: external_exports.array(external_exports.strictObject({ start: external_exports.number(), end: external_exports.number() })).optional()
 }).meta({ id: "RuleFixture" });
-var Rule = external_exports.object({
+var Rule = external_exports.strictObject({
+  // A pinned literal over a STRICT object, and the two together decide how this
+  // format may grow. A rule carrying a key not listed below is refused with
+  // `unrecognized_keys`; a rule declaring `specVersion: 2` is refused with
+  // `invalid_value`. So the only additive path is adding an OPTIONAL field here
+  // — that keeps every rule authored before it valid — and a rule author has no
+  // way to introduce a field of their own or to opt into a later version.
+  // Widening the format means changing this literal and every consumer of it.
   specVersion: external_exports.literal(1),
   // `packId/ruleName` (e.g. `secrets/aws-access-key`). NOTE the first segment is
   // the PACK id, NOT a namespace — this is a DIFFERENT slug space from a
@@ -16301,287 +16127,6 @@ var PackManifest = external_exports.object({
   sourceUrl: external_exports.url().optional()
 }).meta({ id: "PackManifest" });
 
-// ../../packages/schema/src/zod/policy.ts
-var PolicyScope = external_exports.enum(["global", "repo", "user"]).meta({ id: "PolicyScope" });
-var PolicyTarget = external_exports.union([external_exports.object({ ruleId: external_exports.string() }), external_exports.object({ category: DetectionCategory })]).meta({ id: "PolicyTarget" });
-var Policy = external_exports.object({
-  id: external_exports.guid(),
-  scope: PolicyScope,
-  target: PolicyTarget,
-  action: ActionTaken,
-  enabled: external_exports.boolean().default(true),
-  customKeywords: external_exports.array(external_exports.string()).optional(),
-  // Display name — optional so older policy rows without name still parse.
-  // Added for the findings API (policy.name column migration).
-  name: external_exports.string().optional()
-}).meta({ id: "Policy" });
-var PolicyBundle = external_exports.object({
-  version: external_exports.string(),
-  policies: external_exports.array(Policy),
-  // Rules from the installed marketplace packs (snapshotted by the
-  // control plane). The plugin registers these in addition to its bundled
-  // packs. Optional so older backends — and older on-disk caches — that omit
-  // the field still parse; consumers read `bundle.rules ?? []`.
-  rules: external_exports.array(Rule).optional(),
-  // When true, `rules` IS the complete effective ruleset and the runtime must
-  // NOT merge its compiled-in bundled packs — the standalone gateway sets this
-  // after reading the user's installed snapshot (installed_packs, enabled
-  // packs only), which is how detection updates stay manual: new bundled
-  // rules run only after the user applies the pack update. Absent/false keeps
-  // the historical composition (bundled packs + rules) — older caches.
-  rulesComplete: external_exports.boolean().optional(),
-  // Active detection exceptions, evaluation subset only (see
-  // ExceptionBundleEntry). Optional so older bundle producers — and older
-  // on-disk caches — that omit the field still parse; consumers read
-  // `bundle.exceptions ?? []`.
-  exceptions: external_exports.array(ExceptionBundleEntry).optional(),
-  // Installed pack version, keyed by ruleId, for rules in `rules` that came
-  // from a versioned installed pack. Optional so older backends — and older
-  // on-disk caches — that omit the field still parse; consumers fall back to
-  // the rule's own spec version. NOT the bundle version above — see
-  // installedRuleset's ruleVersions for the source of truth.
-  ruleVersions: external_exports.record(external_exports.string(), external_exports.string()).optional(),
-  customKeywords: external_exports.array(external_exports.string()),
-  fetchedAt: external_exports.iso.datetime()
-}).meta({ id: "PolicyBundle" });
-var OBSERVE_ONLY_CATEGORIES = ["config"];
-var ENFORCEABLE_CATEGORIES = DetectionCategory.options.filter((c) => !OBSERVE_ONLY_CATEGORIES.includes(c));
-var CATEGORY_PEAK_SEVERITY = {
-  secret: "critical",
-  financial: "critical",
-  // core-financial/credit-card
-  code_flaw: "critical",
-  pii: "high",
-  phi: "high",
-  custom: "high",
-  // user-defined; conservative
-  code_context: "low",
-  config: "low"
-  // observe-only; floors to monitor regardless
-};
-function severityFloorPolicy(category) {
-  if (OBSERVE_ONLY_CATEGORIES.includes(category)) return "monitor";
-  const peak = CATEGORY_PEAK_SEVERITY[category];
-  return peak === "critical" || peak === "high" ? "warn" : "monitor";
-}
-var PolicyKind = external_exports.enum(["builtin", "custom"]).meta({ id: "PolicyKind" });
-var KNOWN_BUILTIN_IDS = ["monitor", "warn", "redact", "block"];
-var BuiltinPolicyId = external_exports.enum(KNOWN_BUILTIN_IDS).meta({ id: "BuiltinPolicyId" });
-var BUILTIN_POLICY_SPECS = {
-  monitor: {
-    name: "Monitor",
-    action: "log",
-    description: "Log every match for audit. The request is allowed through untouched."
-  },
-  warn: {
-    name: "Warn",
-    action: "warn",
-    description: "Allow the request, but warn the user inline before it is sent."
-  },
-  redact: {
-    name: "Redact",
-    action: "redact",
-    description: "Automatically strip the matched value from the request, then continue."
-  },
-  block: {
-    name: "Block",
-    action: "block",
-    description: "Refuse the request entirely whenever any rule in this detection matches."
-  }
-};
-function builtinPolicyToAction(id) {
-  return BUILTIN_POLICY_SPECS[id].action;
-}
-var DEFAULT_ACTIONS = Object.fromEntries(
-  DetectionCategory.options.map((c) => [c, builtinPolicyToAction(severityFloorPolicy(c))])
-);
-var BUILTIN_POLICIES = Object.fromEntries(
-  KNOWN_BUILTIN_IDS.map((id) => [id, { id, ...BUILTIN_POLICY_SPECS[id] }])
-);
-var UsedByItem = external_exports.object({
-  id: external_exports.string(),
-  name: external_exports.string(),
-  ruleCount: external_exports.number().int().nonnegative(),
-  enabled: external_exports.boolean()
-}).meta({ id: "UsedByItem" });
-var PolicyListItem = external_exports.object({
-  id: external_exports.string(),
-  kind: PolicyKind,
-  name: external_exports.string(),
-  enabled: external_exports.boolean(),
-  usedByCount: external_exports.number().int().nonnegative()
-}).meta({ id: "PolicyListItem" });
-var PolicyDetail = external_exports.object({
-  specVersion: external_exports.literal(1),
-  id: external_exports.string(),
-  kind: PolicyKind,
-  name: external_exports.string(),
-  enabled: external_exports.boolean(),
-  description: external_exports.string(),
-  usedBy: external_exports.array(UsedByItem)
-}).meta({ id: "PolicyDetail" });
-var PolicyStatsResponse = external_exports.object({
-  policies: external_exports.number().int().nonnegative(),
-  builtin: external_exports.number().int().nonnegative(),
-  custom: external_exports.number().int().nonnegative(),
-  detectionsGoverned: external_exports.number().int().nonnegative()
-}).meta({ id: "PolicyStatsResponse" });
-
-// ../../packages/schema/src/zod/api.ts
-var LIST_QUERY_MAX_LIMIT = 200;
-var ListEventsQuery = external_exports.object({
-  cursor: external_exports.string().optional(),
-  limit: external_exports.coerce.number().int().min(1).max(LIST_QUERY_MAX_LIMIT).default(50),
-  sourceTool: external_exports.string().optional(),
-  kind: external_exports.string().optional(),
-  from: external_exports.iso.datetime().optional(),
-  to: external_exports.iso.datetime().optional()
-});
-var ListEventsResponse = external_exports.object({
-  items: external_exports.array(Event),
-  nextCursor: external_exports.string().nullable()
-}).meta({ id: "ListEventsResponse" });
-var IngestResponse = external_exports.object({
-  accepted: external_exports.number().int().nonnegative(),
-  duplicates: external_exports.number().int().nonnegative()
-}).meta({ id: "IngestResponse" });
-var ListFindingsQuery = external_exports.object({
-  cursor: external_exports.string().optional(),
-  limit: external_exports.coerce.number().int().min(1).max(LIST_QUERY_MAX_LIMIT).default(50),
-  severity: external_exports.string().optional(),
-  category: external_exports.string().optional(),
-  eventId: external_exports.guid().optional()
-});
-var ListFindingsResponse = external_exports.object({
-  items: external_exports.array(Finding),
-  nextCursor: external_exports.string().nullable()
-}).meta({ id: "ListFindingsResponse" });
-var ListPoliciesResponse = external_exports.object({ items: external_exports.array(PolicyListItem) }).meta({ id: "ListPoliciesResponse" });
-var CreatePolicyRequest = Policy.omit({ id: true }).meta({
-  id: "CreatePolicyRequest"
-});
-var UpdatePolicyRequest = Policy.partial().required({ id: true }).meta({ id: "UpdatePolicyRequest" });
-var RecordAuditEventResponse = external_exports.object({ accepted: external_exports.boolean() }).meta({ id: "RecordAuditEventResponse" });
-var ErrorResponse = external_exports.object({
-  error: external_exports.object({
-    code: external_exports.string(),
-    message: external_exports.string(),
-    details: external_exports.unknown().optional()
-  })
-}).meta({ id: "ErrorResponse" });
-
-// ../../packages/schema/src/zod/config-inventory.ts
-var ConfigScope = external_exports.enum(["user", "project", "local", "plugin"]);
-var SkillScanEntry = external_exports.object({
-  name: external_exports.string().min(1),
-  // The identity source: a marketplace repo for plugin skills (e.g.
-  // 'anthropics/skills'), 'local' for personal ~/.claude/skills, or
-  // 'project:<repo-identity>' for checked-in project skills. The surrogate keeps
-  // a personal skill named 'pdf' from colliding with the marketplace 'pdf'.
-  source: external_exports.string().min(1),
-  scope: ConfigScope,
-  pluginName: external_exports.string().optional(),
-  // Volatile — rides the attribute bag, never the identity hash.
-  version: external_exports.string().optional(),
-  description: external_exports.string().optional(),
-  // Skill directory mtime (ISO) — the "updated Nd ago" freshness signal.
-  updatedAt: external_exports.iso.datetime().optional(),
-  // Filesystem path — the promoted inventory `location` column.
-  location: external_exports.string().optional()
-});
-var HookScanEntry = external_exports.object({
-  // Hook event name (PreToolUse, PostToolUse, …). Open string, not an enum: the
-  // set is harness-defined and grows without a schema change.
-  event: external_exports.string().min(1),
-  // The tool matcher ('Bash', 'Edit|Write', …). Absent = matches all tools.
-  matcher: external_exports.string().optional(),
-  command: external_exports.string().min(1),
-  timeout: external_exports.number().optional(),
-  scope: ConfigScope,
-  pluginName: external_exports.string().optional(),
-  // The settings file / hooks.json the entry came from.
-  location: external_exports.string().optional()
-});
-var McpServerScanEntry = external_exports.object({
-  // The server's config key ("github", "filesystem", …) — identity, with the
-  // qualified scope (see mcpServerIdentityKey).
-  name: external_exports.string().min(1),
-  scope: ConfigScope,
-  pluginName: external_exports.string().optional(),
-  // The owning plugin's marketplace — part of PLUGIN-scope identity: two
-  // marketplaces can each ship a plugin named `guard`, and without this their
-  // same-named servers would collapse to one row (the second silently dropped,
-  // inheriting the first's trust).
-  marketplace: external_exports.string().optional(),
-  // The repo identity (remote url, or the cwd for un-remoted repos) — part of
-  // PROJECT/LOCAL-scope identity: a server named `github` in repo A and one in
-  // repo B are different servers with different commands, and MUST NOT share a
-  // row — a shared row would let a cloned repo's .mcp.json inherit the trust
-  // the user granted elsewhere.
-  project: external_exports.string().optional(),
-  // 'stdio' when the entry carries a command; otherwise the config's `type`
-  // ('http' / 'sse' / …). Open string — the transport set is harness-defined.
-  transport: external_exports.string().min(1),
-  // Volatile on purpose (unlike hook `command`): a changed command/url is drift
-  // on a stable row — visible across config_scan snapshots and preserving the
-  // user's trust decision — never a quiet new row. One of the two is present.
-  // Secret-masked at collection time (the scanner runs the bundled detection
-  // packs over both — tokens routinely ride command args and URLs).
-  command: external_exports.string().optional(),
-  url: external_exports.string().optional(),
-  // Env var NAMES only, never values (the no-secrets rule).
-  envKeys: external_exports.array(external_exports.string()).optional(),
-  // The config file the entry came from.
-  location: external_exports.string().optional()
-});
-var ConfigFileScanEntry = external_exports.object({
-  // Basename (settings.json, CLAUDE.md) or dir name (commands/, agents/).
-  name: external_exports.string().min(1),
-  // The absolute path — identity (with scope) and the promoted `location`.
-  path: external_exports.string().min(1),
-  scope: ConfigScope,
-  // Human label: "User settings", "Project memory", "Slash commands", …
-  kind: external_exports.string().min(1),
-  // Derived SHAPE summary — top-level key names, entry counts, line counts.
-  // Never file content or values (memory files can carry sensitive detail).
-  detail: external_exports.string().optional(),
-  // Dir configs (commands/, agents/) and .mcp.json: how many entries.
-  entryCount: external_exports.number().optional(),
-  // File mtime (ISO) — the freshness signal.
-  updatedAt: external_exports.iso.datetime().optional()
-});
-var ConfigScanResult = external_exports.object({
-  scannedAt: external_exports.iso.datetime(),
-  skills: external_exports.array(SkillScanEntry),
-  hooks: external_exports.array(HookScanEntry),
-  mcpServers: external_exports.array(McpServerScanEntry),
-  configFiles: external_exports.array(ConfigFileScanEntry),
-  errors: external_exports.array(external_exports.object({ source: external_exports.string(), reason: external_exports.string() }))
-});
-var ConfigPostureFindingInput = external_exports.object({
-  ruleId: external_exports.string().min(1),
-  version: external_exports.string().min(1),
-  span: Span,
-  // For posture rules this is the offending COMMAND (config the user already
-  // holds locally, not captured secret content) — it is also the correlation
-  // key the read surface matches back to a hook row.
-  maskedMatch: external_exports.string(),
-  actionTaken: ActionTaken,
-  confidence: external_exports.number().min(0).max(1)
-});
-var ConfigScanRecord = external_exports.object({
-  items: external_exports.array(InventoryInput),
-  scanEvent: AuditEventInput,
-  definitions: external_exports.array(InspectionDefinitionInput).optional(),
-  findings: external_exports.array(ConfigPostureFindingInput).optional()
-});
-
-// ../../packages/schema/src/zod/registry.ts
-var Namespace = external_exports.string().regex(/^[a-z][a-z0-9-]*$/);
-var PackId = external_exports.string().regex(/^[a-z][a-z0-9-]*$/);
-var SemVer = external_exports.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-.]+)?$/);
-var PublisherKind = external_exports.enum(["labs", "user", "org"]);
-
 // ../../packages/schema/src/zod/detection.ts
 var OriginEnum = external_exports.enum(["library"]).meta({ id: "OriginEnum" });
 var DetectionFilterEnum = external_exports.enum(["all", "library", "custom", "customized", "updates"]);
@@ -16626,81 +16171,306 @@ var ListDetectionsQuery = external_exports.object({
   filter: DetectionFilterEnum.optional().default("all"),
   q: external_exports.string().optional()
 });
-var DetectionStats = external_exports.object({
-  detections: external_exports.number().int().nonnegative(),
-  rules: external_exports.number().int().nonnegative(),
-  active: external_exports.number().int().nonnegative(),
-  findingsLast30d: external_exports.number().int().nonnegative()
-}).meta({ id: "DetectionStats" });
-var DetectionRule = external_exports.object({
-  id: external_exports.string(),
-  name: external_exports.string(),
-  category: DetectionCategory,
-  severity: Severity,
-  matcher: Matcher
-}).meta({ id: "DetectionRule" });
-var DetectionUpdate = external_exports.object({
-  available: external_exports.boolean(),
-  latestVersion: SemVer,
-  // Rule count of the latest snapshot. Lets the update UI show a meaningful
-  // delta ("2 rules → 14 rules") when the version did NOT change but the rule
-  // content did — the OSS store compares content, not just version. Optional:
-  // registry-backed updates omit it.
-  latestRuleCount: external_exports.number().int().nonnegative().optional()
-}).nullable().meta({ id: "DetectionUpdate" });
-var DetectionDetail = external_exports.object({
-  id: external_exports.string(),
-  name: external_exports.string(),
-  version: SemVer,
-  enabled: external_exports.boolean(),
-  origin: OriginEnum,
-  publisher: Namespace.optional(),
-  publisherKind: PublisherKind.optional(),
-  ruleCount: external_exports.number().int().nonnegative(),
-  namespace: Namespace,
-  packId: PackId,
-  description: external_exports.string().optional(),
-  editedAt: external_exports.iso.datetime(),
-  findingsLast30d: external_exports.number().int().nonnegative(),
-  latestVersion: SemVer.nullable().optional(),
-  update: DetectionUpdate,
-  rules: external_exports.array(DetectionRule),
-  modified: external_exports.boolean(),
-  // Per-pack enforcement-policy assignment. Holds a BuiltinPolicyId ARCHETYPE
-  // (monitor|warn|redact|block) — NOT a policies-table Policy.id guid; a
-  // detection is a PACK, and its policy is the archetype applied to all its
-  // rules. Absent == unassigned, which resolves to Monitor everywhere
-  // (DEFAULT_PACK_POLICY_ID). Every enforcement surface expands it into
-  // per-rule policies (see policyIdToAction). Typed z.string() (not
-  // the enum) to keep the OpenAPI response tolerant of a future custom id.
-  policyId: external_exports.string().optional()
-}).meta({ id: "DetectionDetail" });
-var LibraryItem = external_exports.object({
-  id: external_exports.string(),
-  name: external_exports.string(),
-  publisher: Namespace,
-  publisherKind: PublisherKind.optional(),
-  // LOSSY single-category view of a pack. A pack MAY span several categories;
-  // this carries only the canonical-first one for display. Do NOT filter/facet
-  // on it — the library filter matches a pack's full category set (see
-  // ListLibraryResponse.categories).
-  category: DetectionCategory.optional(),
-  version: SemVer,
-  ruleCount: external_exports.number().int().nonnegative(),
-  description: external_exports.string().optional(),
-  updatedAt: external_exports.iso.datetime(),
-  state: LibraryStateEnum,
-  importedAs: external_exports.string().nullable()
-}).meta({ id: "LibraryItem" });
-var ListLibraryResponse = external_exports.object({
-  categories: external_exports.array(DetectionCategory),
-  items: external_exports.array(LibraryItem)
-}).meta({ id: "ListLibraryResponse" });
-var ImportDetectionRequest = external_exports.object({
-  libraryId: external_exports.string().refine((v) => /^[^/]+\/[^/]+$/.test(v), {
-    message: "libraryId must be in namespace/packId format"
-  })
-}).meta({ id: "ImportDetectionRequest" });
+var DetectionStats = external_exports.object({
+  detections: external_exports.number().int().nonnegative(),
+  rules: external_exports.number().int().nonnegative(),
+  active: external_exports.number().int().nonnegative(),
+  findingsLast30d: external_exports.number().int().nonnegative()
+}).meta({ id: "DetectionStats" });
+var DetectionRule = external_exports.object({
+  id: external_exports.string(),
+  name: external_exports.string(),
+  category: DetectionCategory,
+  severity: Severity,
+  matcher: Matcher
+}).meta({ id: "DetectionRule" });
+var DetectionUpdate = external_exports.object({
+  available: external_exports.boolean(),
+  latestVersion: SemVer,
+  // Rule count of the latest snapshot. Lets the update UI show a meaningful
+  // delta ("2 rules → 14 rules") when the version did NOT change but the rule
+  // content did — the OSS store compares content, not just version. Optional:
+  // registry-backed updates omit it.
+  latestRuleCount: external_exports.number().int().nonnegative().optional()
+}).nullable().meta({ id: "DetectionUpdate" });
+var DetectionDetail = external_exports.object({
+  id: external_exports.string(),
+  name: external_exports.string(),
+  version: SemVer,
+  enabled: external_exports.boolean(),
+  origin: OriginEnum,
+  publisher: Namespace.optional(),
+  publisherKind: PublisherKind.optional(),
+  ruleCount: external_exports.number().int().nonnegative(),
+  namespace: Namespace,
+  packId: PackId,
+  description: external_exports.string().optional(),
+  editedAt: external_exports.iso.datetime(),
+  findingsLast30d: external_exports.number().int().nonnegative(),
+  latestVersion: SemVer.nullable().optional(),
+  update: DetectionUpdate,
+  rules: external_exports.array(DetectionRule),
+  modified: external_exports.boolean(),
+  // Per-pack enforcement-policy assignment. Holds a BuiltinPolicyId ARCHETYPE
+  // (monitor|warn|redact|block) — NOT a policies-table Policy.id guid; a
+  // detection is a PACK, and its policy is the archetype applied to all its
+  // rules. Absent == unassigned, which resolves to Monitor everywhere
+  // (DEFAULT_PACK_POLICY_ID). Every enforcement surface expands it into
+  // per-rule policies (see policyIdToAction). Typed z.string() (not
+  // the enum) to keep the OpenAPI response tolerant of a future custom id.
+  policyId: external_exports.string().optional()
+}).meta({ id: "DetectionDetail" });
+var LibraryItem = external_exports.object({
+  id: external_exports.string(),
+  name: external_exports.string(),
+  publisher: Namespace,
+  publisherKind: PublisherKind.optional(),
+  // LOSSY single-category view of a pack. A pack MAY span several categories;
+  // this carries only the canonical-first one for display. Do NOT filter/facet
+  // on it — the library filter matches a pack's full category set (see
+  // ListLibraryResponse.categories).
+  category: DetectionCategory.optional(),
+  version: SemVer,
+  ruleCount: external_exports.number().int().nonnegative(),
+  description: external_exports.string().optional(),
+  updatedAt: external_exports.iso.datetime(),
+  state: LibraryStateEnum,
+  importedAs: external_exports.string().nullable()
+}).meta({ id: "LibraryItem" });
+var ListLibraryResponse = external_exports.object({
+  categories: external_exports.array(DetectionCategory),
+  items: external_exports.array(LibraryItem)
+}).meta({ id: "ListLibraryResponse" });
+var ImportDetectionRequest = external_exports.object({
+  libraryId: external_exports.string().refine((v) => /^[^/]+\/[^/]+$/.test(v), {
+    message: "libraryId must be in namespace/packId format"
+  })
+}).meta({ id: "ImportDetectionRequest" });
+
+// ../../packages/schema/src/zod/inventory.ts
+var AssetType = external_exports.enum(["project", "skill", "mcp", "hook", "config"]).meta({ id: "AssetType" });
+var AccessLevel = external_exports.enum(["open", "approved", "blocked"]).meta({ id: "AccessLevel" });
+var Origin = external_exports.enum(["source", "public-dep", "vendored", "config", "data", "docs", "generated"]).meta({ id: "Origin" });
+var TrustLevel = external_exports.enum(["known-good", "risky", "unapproved"]).meta({ id: "TrustLevel" });
+var Flag = external_exports.enum(["update", "stale", "conflict", "unknown", "change", "untracked", "risk", "findings"]).meta({ id: "Flag" });
+var Visibility = external_exports.enum(["public", "private"]).meta({ id: "Visibility" });
+var HarnessEventKind = external_exports.enum(["block", "redact", "warn"]).meta({ id: "HarnessEventKind" });
+var HarnessId = Harness.extract(["ClaudeCode", "Cursor", "Codex", "Antigravity"]).meta({
+  id: "HarnessId"
+});
+var AccessCounts = external_exports.object({
+  open: external_exports.number().int().nonnegative(),
+  approved: external_exports.number().int().nonnegative(),
+  blocked: external_exports.number().int().nonnegative(),
+  total: external_exports.number().int().nonnegative()
+}).meta({ id: "AccessCounts" });
+var AssetSummary = external_exports.object({
+  id: external_exports.string(),
+  type: AssetType,
+  name: external_exports.string(),
+  sub: external_exports.string(),
+  flags: external_exports.array(Flag),
+  /** MCP servers only — omitted for all other types. */
+  trust: TrustLevel.optional()
+}).meta({ id: "AssetSummary" });
+var ProjectSummary = external_exports.object({
+  id: external_exports.string(),
+  name: external_exports.string(),
+  repo: external_exports.string(),
+  visibility: Visibility,
+  language: external_exports.string(),
+  policyDefault: AccessLevel,
+  updatedAt: external_exports.iso.datetime(),
+  accessCounts: AccessCounts,
+  findingsCount: external_exports.number().int().nonnegative()
+}).meta({ id: "ProjectSummary" });
+var HarnessCategory = external_exports.object({
+  /** One of config/skill/mcp/hook — never project (enforced at service layer). */
+  type: AssetType,
+  assets: external_exports.array(AssetSummary)
+});
+var HarnessSummary = external_exports.object({
+  id: HarnessId,
+  label: external_exports.string(),
+  kind: external_exports.string(),
+  version: external_exports.string(),
+  sessions: external_exports.number().int().nonnegative(),
+  assetCount: external_exports.number().int().nonnegative(),
+  flagCount: external_exports.number().int().nonnegative(),
+  projects: external_exports.array(ProjectSummary),
+  categories: external_exports.array(HarnessCategory)
+}).meta({ id: "HarnessSummary" });
+var ListHarnessesResponse = external_exports.object({ items: external_exports.array(HarnessSummary) }).meta({ id: "ListHarnessesResponse" });
+var AssetGroup = external_exports.object({
+  /** Group key — never project (enforced at service layer). */
+  type: AssetType,
+  total: external_exports.number().int().nonnegative(),
+  /**
+   * MCP group only — omitted for all other types.
+   * Partial: only TrustLevel keys with non-zero counts are included.
+   * Strict: unknown keys are rejected — only TrustLevel values are valid keys.
+   */
+  trustRollup: external_exports.object({
+    "known-good": external_exports.number().int().nonnegative(),
+    risky: external_exports.number().int().nonnegative(),
+    unapproved: external_exports.number().int().nonnegative()
+  }).partial().strict().optional(),
+  /**
+   * Partial: only Flag keys with non-zero counts are included.
+   * Strict: unknown keys are rejected — only Flag values are valid keys.
+   */
+  flagRollup: external_exports.object({
+    update: external_exports.number().int().nonnegative(),
+    stale: external_exports.number().int().nonnegative(),
+    conflict: external_exports.number().int().nonnegative(),
+    unknown: external_exports.number().int().nonnegative(),
+    change: external_exports.number().int().nonnegative(),
+    untracked: external_exports.number().int().nonnegative(),
+    risk: external_exports.number().int().nonnegative(),
+    findings: external_exports.number().int().nonnegative()
+  }).partial().strict(),
+  items: external_exports.array(AssetSummary)
+}).meta({ id: "AssetGroup" });
+var ListAssetsResponse = external_exports.object({ groups: external_exports.array(AssetGroup) }).meta({ id: "ListAssetsResponse" });
+var McpTool = external_exports.object({
+  name: external_exports.string(),
+  signature: external_exports.string(),
+  description: external_exports.string(),
+  write: external_exports.boolean(),
+  /** Non-null string when tool is dangerous / blocked; null otherwise. */
+  risk: external_exports.string().nullable()
+}).meta({ id: "McpTool" });
+var AssetFindingRef = external_exports.object({
+  id: external_exports.string(),
+  title: external_exports.string(),
+  note: external_exports.string()
+});
+var AssetDetail = AssetSummary.extend({
+  /** string | null — null when no description is available. */
+  description: external_exports.string().nullable(),
+  /** trustLevel | null — null for non-MCP assets. */
+  trust: TrustLevel.nullable(),
+  /** Type-specific raw key/values — FE renders the grid. */
+  meta: external_exports.record(external_exports.string(), external_exports.unknown()),
+  /** always present — object when there is an active finding, null when absent. */
+  finding: AssetFindingRef.nullable(),
+  /** MCP exposed-tools list — omitted for non-mcp. */
+  tools: external_exports.array(McpTool).optional()
+}).meta({ id: "AssetDetail" });
+var ListProjectsResponse = external_exports.object({ items: external_exports.array(ProjectSummary) }).meta({ id: "ListProjectsResponse" });
+var InventoryStats = external_exports.object({
+  /** Total assets/projects with ≥1 flag or finding (drives the attention header chip). */
+  attention: external_exports.number().int().nonnegative(),
+  byType: external_exports.object({
+    project: external_exports.number().int().nonnegative(),
+    skill: external_exports.number().int().nonnegative(),
+    mcp: external_exports.number().int().nonnegative(),
+    hook: external_exports.number().int().nonnegative(),
+    config: external_exports.number().int().nonnegative()
+  }),
+  harnesses: external_exports.number().int().nonnegative(),
+  mcpTrust: external_exports.object({
+    "known-good": external_exports.number().int().nonnegative(),
+    risky: external_exports.number().int().nonnegative(),
+    unapproved: external_exports.number().int().nonnegative()
+  })
+}).meta({ id: "InventoryStats" });
+var FileSummary = external_exports.object({
+  path: external_exports.string(),
+  name: external_exports.string(),
+  origin: Origin,
+  /** Effective access (override applied). */
+  access: AccessLevel,
+  /** True when a file_access_override differs from the computed default. */
+  isCustom: external_exports.boolean(),
+  findings: external_exports.number().int().nonnegative(),
+  /** When the file was auto-blocked by a detection; null when not blocked. */
+  blockedAt: external_exports.iso.datetime().nullable().optional(),
+  /** Why the file was blocked; null when absent. */
+  note: external_exports.string().nullable().optional()
+}).meta({ id: "FileSummary" });
+var FolderSummary = external_exports.object({
+  name: external_exports.string(),
+  path: external_exports.string(),
+  /** Rollup of effective access across all descendants. */
+  accessCounts: AccessCounts
+}).meta({ id: "FolderSummary" });
+var ProjectTreeResponse = external_exports.object({
+  project: external_exports.object({
+    id: external_exports.string(),
+    repo: external_exports.string(),
+    visibility: Visibility
+  }),
+  path: external_exports.string(),
+  /** Browse mode: one-level folders at the current path. Omitted in search mode. */
+  folders: external_exports.array(FolderSummary).optional(),
+  files: external_exports.array(FileSummary)
+}).meta({ id: "ProjectTreeResponse" });
+var FileDetail = FileSummary.extend({
+  project: external_exports.object({
+    repo: external_exports.string(),
+    visibility: Visibility,
+    language: external_exports.string(),
+    policyDefault: AccessLevel,
+    updatedAt: external_exports.iso.datetime()
+  }),
+  findingsRefs: external_exports.array(external_exports.object({ id: external_exports.string(), title: external_exports.string() }))
+}).meta({ id: "FileDetail" });
+var SetFileAccessBody = external_exports.object({
+  path: external_exports.string(),
+  access: AccessLevel
+}).meta({ id: "SetFileAccessBody" });
+var SetFileAccessResponse = external_exports.object({
+  file: FileSummary,
+  accessCounts: AccessCounts
+}).meta({ id: "SetFileAccessResponse" });
+var SetMcpTrustBody = external_exports.object({ trust: TrustLevel }).meta({ id: "SetMcpTrustBody" });
+var HarnessEventItem = external_exports.object({
+  kind: HarnessEventKind,
+  title: external_exports.string(),
+  detail: external_exports.string(),
+  occurredAt: external_exports.iso.datetime(),
+  findingId: external_exports.string().nullable().optional()
+}).meta({ id: "HarnessEventItem" });
+var HarnessEventsResponse = external_exports.object({
+  counts: external_exports.object({
+    block: external_exports.number().int().nonnegative(),
+    redact: external_exports.number().int().nonnegative(),
+    warn: external_exports.number().int().nonnegative()
+  }),
+  items: external_exports.array(HarnessEventItem)
+}).meta({ id: "HarnessEventsResponse" });
+var RescanResponse = external_exports.object({
+  jobId: external_exports.string(),
+  startedAt: external_exports.iso.datetime()
+}).meta({ id: "RescanResponse" });
+var ConnectProjectBody = external_exports.object({ repo: external_exports.string() }).meta({ id: "ConnectProjectBody" });
+var ListAssetsQuery = external_exports.object({
+  /** Filter by one or more AssetType values; absent means all types. */
+  type: external_exports.array(AssetType).optional(),
+  /** Free-text search term. */
+  q: external_exports.string().optional()
+});
+var GetProjectTreeQuery = external_exports.object({
+  /** Subtree root path; defaults to repository root when absent. */
+  path: external_exports.string().optional(),
+  /** Free-text filter applied to file paths. */
+  q: external_exports.string().optional(),
+  /**
+   * Special listing mode. `blocked` returns every effectively-blocked, auto-blocked
+   * file across the whole repo (folders omitted, most-recent first), ignoring
+   * `path`/`q` — powers the project-wide "recently blocked" strip.
+   */
+  filter: external_exports.enum(["blocked"]).optional()
+});
+var GetProjectFileQuery = external_exports.object({
+  /** Repository-relative file path; absent or empty → 400. */
+  path: external_exports.string()
+});
+var GetHarnessEventsQuery = external_exports.object({
+  /** Maximum number of events to return.  Range: 1–50; default: 7. */
+  limit: external_exports.coerce.number().int().min(1).max(50).default(7)
+});
 
 // ../../packages/schema/src/zod/shares.ts
 var DestinationKind = external_exports.enum(["provider", "internal", "external", "ip"]).meta({ id: "DestinationKind" });
@@ -16841,72 +16611,193 @@ var ExportSharesQuery = external_exports.object({
   q: external_exports.string().optional(),
   kind: external_exports.array(DestinationKind).optional()
 });
-
-// ../../packages/schema/src/zod/egress-extraction.ts
-var EgressEcosystem = external_exports.enum(["npm", "pypi", "go", "maven", "rubygems", "cargo", "composer", "nuget"]).meta({ id: "EgressEcosystem" });
-var ProviderRegistryEntry = external_exports.object({
-  id: external_exports.string(),
-  name: external_exports.string(),
-  category: external_exports.string(),
-  /** Suffix-matched: 'stripe.com' matches api.stripe.com, never evilstripe.com. */
-  hostSuffixes: external_exports.array(external_exports.string()).min(1),
-  /** Canonical API base URL recorded for manifest-derived (method 'SDK') endpoints. */
-  apiBase: external_exports.string(),
-  /** Most-sensitive first; index 0 becomes the endpoint dataClass. */
-  defaultDataClasses: external_exports.array(DataClass).min(1),
-  /** SDK identifiers per ecosystem ('go' prefix-matched by path, 'maven' by group-id prefix). */
-  sdks: external_exports.partialRecord(EgressEcosystem, external_exports.array(external_exports.string()))
-}).meta({ id: "ProviderRegistryEntry" });
-var EgressCallSiteHit = external_exports.object({
-  file: external_exports.string(),
-  line: external_exports.number().int().positive(),
-  snippet: external_exports.string(),
-  dynamic: external_exports.boolean(),
-  vendored: external_exports.boolean()
-}).meta({ id: "EgressCallSiteHit" });
-var ResolvedEgressHit = external_exports.object({
-  host: external_exports.string(),
-  kind: DestinationKind,
-  name: external_exports.string(),
-  category: external_exports.string(),
-  trust: ShareTrustLevel,
-  network: DestinationNetwork.nullable(),
-  method: HttpMethod,
-  transport: Transport,
-  url: external_exports.string(),
-  template: external_exports.boolean(),
-  dataClass: DataClass,
-  site: EgressCallSiteHit
-}).meta({ id: "ResolvedEgressHit" });
-var EgressReconcile = external_exports.discriminatedUnion("mode", [
-  external_exports.object({ mode: external_exports.literal("walk"), walkedPrefix: external_exports.string() }),
-  external_exports.object({
-    mode: external_exports.literal("ledger"),
-    scannedFiles: external_exports.array(external_exports.string()),
-    deletedFiles: external_exports.array(external_exports.string())
-  })
-]).meta({ id: "EgressReconcile" });
-var RecordProjectEgressInput = external_exports.object({
-  /** Stable reconcile key: 'git:<repo identity>' or 'path:<abs root>' (non-git). */
-  projectKey: external_exports.string().min(1),
-  /** Display name only — never keys reconciliation. */
-  project: external_exports.string(),
-  projectId: external_exports.string().nullable(),
-  reconcile: EgressReconcile,
-  hits: external_exports.array(ResolvedEgressHit)
-}).meta({ id: "RecordProjectEgressInput" });
-var EgressWriteSummary = external_exports.object({
-  destinations: external_exports.number().int().nonnegative(),
-  endpoints: external_exports.number().int().nonnegative(),
-  callSites: external_exports.number().int().nonnegative(),
-  truncated: external_exports.boolean(),
-  /**
-   * Files the cap dropped whole. Their stored rows were left untouched, so a
-   * ledger-keeping caller must withhold their ledger entries and read them
-   * again next scan.
-   */
-  droppedFiles: external_exports.array(external_exports.string()).default([])
-}).meta({ id: "EgressWriteSummary" });
+
+// ../../packages/schema/src/zod/egress-extraction.ts
+var EgressEcosystem = external_exports.enum(["npm", "pypi", "go", "maven", "rubygems", "cargo", "composer", "nuget"]).meta({ id: "EgressEcosystem" });
+var ProviderRegistryEntry = external_exports.object({
+  id: external_exports.string(),
+  name: external_exports.string(),
+  category: external_exports.string(),
+  /** Suffix-matched: 'stripe.com' matches api.stripe.com, never evilstripe.com. */
+  hostSuffixes: external_exports.array(external_exports.string()).min(1),
+  /** Canonical API base URL recorded for manifest-derived (method 'SDK') endpoints. */
+  apiBase: external_exports.string(),
+  /** Most-sensitive first; index 0 becomes the endpoint dataClass. */
+  defaultDataClasses: external_exports.array(DataClass).min(1),
+  /** SDK identifiers per ecosystem ('go' prefix-matched by path, 'maven' by group-id prefix). */
+  sdks: external_exports.partialRecord(EgressEcosystem, external_exports.array(external_exports.string()))
+}).meta({ id: "ProviderRegistryEntry" });
+var EgressCallSiteHit = external_exports.object({
+  file: external_exports.string(),
+  line: external_exports.number().int().positive(),
+  snippet: external_exports.string(),
+  dynamic: external_exports.boolean(),
+  vendored: external_exports.boolean()
+}).meta({ id: "EgressCallSiteHit" });
+var ResolvedEgressHit = external_exports.object({
+  host: external_exports.string(),
+  kind: DestinationKind,
+  name: external_exports.string(),
+  category: external_exports.string(),
+  trust: ShareTrustLevel,
+  network: DestinationNetwork.nullable(),
+  method: HttpMethod,
+  transport: Transport,
+  url: external_exports.string(),
+  template: external_exports.boolean(),
+  dataClass: DataClass,
+  site: EgressCallSiteHit
+}).meta({ id: "ResolvedEgressHit" });
+var EgressReconcile = external_exports.discriminatedUnion("mode", [
+  external_exports.object({ mode: external_exports.literal("walk"), walkedPrefix: external_exports.string() }),
+  external_exports.object({
+    mode: external_exports.literal("ledger"),
+    scannedFiles: external_exports.array(external_exports.string()),
+    deletedFiles: external_exports.array(external_exports.string())
+  })
+]).meta({ id: "EgressReconcile" });
+var RecordProjectEgressInput = external_exports.object({
+  /** Stable reconcile key: 'git:<repo identity>' or 'path:<abs root>' (non-git). */
+  projectKey: external_exports.string().min(1),
+  /** Display name only — never keys reconciliation. */
+  project: external_exports.string(),
+  projectId: external_exports.string().nullable(),
+  reconcile: EgressReconcile,
+  hits: external_exports.array(ResolvedEgressHit)
+}).meta({ id: "RecordProjectEgressInput" });
+var EgressWriteSummary = external_exports.object({
+  destinations: external_exports.number().int().nonnegative(),
+  endpoints: external_exports.number().int().nonnegative(),
+  callSites: external_exports.number().int().nonnegative(),
+  truncated: external_exports.boolean(),
+  /**
+   * Files the cap dropped whole. Their stored rows were left untouched, so a
+   * ledger-keeping caller must withhold their ledger entries and read them
+   * again next scan.
+   */
+  droppedFiles: external_exports.array(external_exports.string()).default([])
+}).meta({ id: "EgressWriteSummary" });
+
+// ../../packages/schema/src/zod/event.ts
+var EventKind = external_exports.enum(["prompt", "response", "code_change", "tool_use"]).meta({ id: "EventKind" });
+var CAPTURE_EVENT_TYPES_SQL = EventKind.options.map((k) => `'${k}'`).join(",");
+var EventMetadata = external_exports.object({
+  sessionId: external_exports.string().optional(),
+  repo: external_exports.string().optional(),
+  filePath: external_exports.string().optional(),
+  // The host tool whose input/output was scanned (e.g. 'Bash', 'WebFetch'),
+  // set by the tool-scanning hooks. The tool NAME only — never the tool's
+  // arguments or output, which can carry the very value a finding masked
+  // (metadata is stored unredacted). Gives findings on non-file captures a
+  // display location ("via Bash") when no filePath exists.
+  toolName: external_exports.string().optional(),
+  // Set (true) by the worktree scanner when the file is excluded by the
+  // repo's .gitignore. Gitignored files ARE still scanned — local scratch and
+  // generated code can leak real secrets — but the provenance is recorded so
+  // policy/dashboards can treat those findings as informational rather than
+  // blocking. Omitted (not false) for tracked files and non-scan events.
+  gitignored: external_exports.boolean().optional(),
+  // Set (true) ONLY when the event's `content` is the COMPLETE file at
+  // capture time (a worktree scan reading from disk). Hook-captured edits
+  // (e.g. an Edit tool's new_string) are partial fragments and MUST NOT set
+  // this. The resolver-on-ingest keys its fixed-at-source dropout
+  // diff on this marker: only a whole-file snapshot can prove a previously
+  // open finding is gone; a fragment's absence proves nothing (the secret
+  // may live outside the hunk). Omitted (not false) for fragments and
+  // non-scan events, so pre-marker clients safely default to the
+  // non-authoritative path.
+  wholeFile: external_exports.boolean().optional(),
+  model: external_exports.string().optional(),
+  turnIndex: external_exports.number().int().nonnegative().optional(),
+  // Distributed-tracing correlation. `correlationId` ties a recorded event back
+  // to the request that captured/ingested it (a UUID, generated independently of
+  // the trace id); `traceId` is the W3C trace id (32 lowercase hex chars) of the
+  // originating span when telemetry is enabled. Both optional + backward
+  // compatible — populated by the plugin (see @akasecurity/plugin-sdk).
+  correlationId: external_exports.uuid().optional(),
+  traceId: external_exports.string().regex(/^[0-9a-f]{32}$/).optional(),
+  // Ids of the detection exceptions that downgraded findings in this capture
+  // to 'allow' — the enforcement audit trail's link back to the grant that
+  // authorized the bypass. Absent on captures where no exception applied.
+  exceptionIds: external_exports.array(external_exports.guid()).optional()
+}).meta({ id: "EventMetadata" });
+var Event = external_exports.object({
+  id: external_exports.guid(),
+  sourceTool: SourceTool,
+  kind: EventKind,
+  occurredAt: external_exports.iso.datetime(),
+  contentHash: external_exports.string(),
+  content: external_exports.string(),
+  metadata: EventMetadata.optional()
+}).meta({ id: "Event" });
+var IngestEvent = Event.meta({ id: "IngestEvent" });
+var IngestBatch = external_exports.object({
+  events: external_exports.array(IngestEvent).min(1).max(100),
+  // Dedup policy for this batch. Id-dedup ALWAYS applies. 'content-hash'
+  // additionally rejects any event whose contentHash the store has already
+  // recorded — for re-runnable bulk ingest (worktree scan, transcript
+  // backfill), where a re-run mints fresh event ids for identical content and
+  // would otherwise accumulate duplicates. Live hook traffic must NOT set it:
+  // two genuinely separate prompts can be byte-identical and both belong on
+  // the timeline.
+  dedupe: external_exports.literal("content-hash").optional()
+}).meta({ id: "IngestBatch" });
+
+// ../../packages/schema/src/zod/exception.ts
+var ExceptionScope = external_exports.enum(["once", "temporary", "permanent"]);
+var ExceptionConditions = external_exports.object({
+  repo: external_exports.string().optional(),
+  sourceTool: external_exports.string().optional(),
+  provider: external_exports.string().optional()
+}).strict();
+var ExceptionCapability = external_exports.enum(["suppress", "reveal_to_model"]);
+var DetectionException = external_exports.object({
+  id: external_exports.guid(),
+  ruleId: external_exports.string(),
+  // Denormalized from the rule, for reporting — never matched on.
+  category: DetectionCategory,
+  // HMAC-SHA256 hex of the raw match under a machine-local key: a KEYED
+  // fingerprint, never the raw value, and never reversible. Matching recomputes
+  // the fingerprint from a fresh capture; the value itself is never stored.
+  // Shape-constrained so a malformed — or accidentally raw — value is rejected
+  // at the boundary rather than persisted.
+  valueFingerprint: external_exports.string().regex(/^[0-9a-f]{64}$/),
+  // Version of the fingerprint key the grant was written under; a rotated key
+  // invalidates old grants rather than silently mismatching them.
+  keyVersion: external_exports.number().int().positive(),
+  // maskMatch() preview of the approved value — never the raw value.
+  maskedValue: external_exports.string(),
+  capability: ExceptionCapability.default("suppress"),
+  scope: ExceptionScope,
+  expiresAt: external_exports.iso.datetime().nullable(),
+  maxUses: external_exports.number().int().positive().nullable(),
+  useCount: external_exports.number().int().nonnegative(),
+  lastUsedAt: external_exports.iso.datetime().nullable(),
+  // Mandatory: every grant carries the human reason it exists.
+  justification: external_exports.string().min(1),
+  conditions: ExceptionConditions.nullable(),
+  createdBy: external_exports.string(),
+  createdVia: external_exports.enum(["cli-approve", "cli-add", "web-approve", "web-add", "api", "setup-triage"]),
+  createdAt: external_exports.iso.datetime(),
+  updatedAt: external_exports.iso.datetime(),
+  // Revocation is terminal and retained — consumed/expired/revoked rows are
+  // audit evidence; nothing in the exception lifecycle hard-deletes.
+  revokedAt: external_exports.iso.datetime().nullable(),
+  revokedBy: external_exports.string().nullable(),
+  revokeReason: external_exports.string().nullable()
+});
+var ExceptionBundleEntry = DetectionException.pick({
+  id: true,
+  ruleId: true,
+  valueFingerprint: true,
+  keyVersion: true,
+  capability: true,
+  expiresAt: true,
+  maxUses: true,
+  useCount: true,
+  conditions: true
+});
+var ExceptionDescriptor = DetectionException.omit({ valueFingerprint: true });
 
 // ../../packages/schema/src/zod/exception-action.ts
 var confirmation = external_exports.string().optional();
@@ -17112,6 +17003,7 @@ var ListVaultDerefsResponse = external_exports.object({
 });
 var VaultKeyCustody = external_exports.string();
 var VaultInlineReveal = external_exports.enum(["masked", "full", "off"]);
+var VAULT_CONSENT_VERSION = 1;
 var VaultConsent = external_exports.object({
   acknowledgedAt: external_exports.iso.datetime(),
   version: external_exports.number().int().positive()
@@ -17119,7 +17011,14 @@ var VaultConsent = external_exports.object({
 
 // ../../packages/schema/src/zod/local.ts
 var WORKSPACE_SETTINGS_SPEC_VERSION = 5;
-var RunMode = external_exports.enum(["standalone"]);
+var MODEL_JUDGE_PAYLOAD_VERSION = 1;
+var RunMode = external_exports.enum(["standalone", "attached"]);
+var ControlPlaneConnection = external_exports.object({
+  endpoint: external_exports.string().min(1),
+  // Display name for the deployment, shown instead of the raw endpoint.
+  label: external_exports.string().min(1).optional(),
+  attachedAt: external_exports.iso.datetime()
+}).meta({ id: "ControlPlaneConnection" });
 var SimpleDetectionPolicy = external_exports.enum(["redact", "warn"]);
 var HistoricalAccess = external_exports.enum(["full", "session-only"]);
 var ModelJudgeConsent = external_exports.object({
@@ -17128,12 +17027,10 @@ var ModelJudgeConsent = external_exports.object({
 });
 var WorkspaceSettings = external_exports.object({
   specVersion: external_exports.number().int().positive().default(WORKSPACE_SETTINGS_SPEC_VERSION),
-  // Settings files written by earlier releases may carry the retired 'attached'
-  // value; it parses as 'standalone' so those files keep loading.
-  runMode: external_exports.preprocess(
-    (v) => v === "attached" ? "standalone" : v,
-    RunMode.default("standalone")
-  ),
+  runMode: RunMode.default("standalone"),
+  // Present only while attached; a detach clears it. Its presence is what makes
+  // `runMode: 'attached'` mean anything — see isAttached.
+  controlPlane: ControlPlaneConnection.optional(),
   policy: SimpleDetectionPolicy.default("redact"),
   // Consent for scanning pre-install surfaces; opt-in (see HistoricalAccess).
   historicalAccess: HistoricalAccess.default("session-only"),
@@ -17162,6 +17059,196 @@ function defaultWorkspaceSettings() {
   return WorkspaceSettings.parse({});
 }
 
+// ../../packages/schema/src/zod/managed.ts
+var MANAGED_SETTINGS_FILENAME = "managed-settings.json";
+var MANAGED_SETTINGS_SPEC_VERSION = 1;
+var ManagedSettingKey = external_exports.enum([
+  "runMode",
+  "historicalAccess",
+  "vaultConsent",
+  "vaultKeyCustody",
+  "vaultInlineReveal",
+  "modelJudgeConsent",
+  "dataSharesInPlace"
+]).meta({ id: "ManagedSettingKey" });
+var ManagedSettingsValues = external_exports.object({
+  runMode: external_exports.enum(["standalone", "attached"]).optional(),
+  controlPlane: external_exports.object({
+    endpoint: external_exports.string().min(1),
+    label: external_exports.string().min(1).optional()
+  }).optional(),
+  historicalAccess: external_exports.enum(["full", "session-only"]).optional(),
+  vaultConsent: external_exports.boolean().optional(),
+  vaultKeyCustody: external_exports.enum(["file", "keychain"]).optional(),
+  vaultInlineReveal: external_exports.enum(["masked", "full", "off"]).optional(),
+  modelJudgeConsent: external_exports.boolean().optional(),
+  dataSharesInPlace: external_exports.boolean().optional()
+}).meta({ id: "ManagedSettingsValues" });
+var ManagedSettings = external_exports.object({
+  specVersion: external_exports.number().int().positive().default(MANAGED_SETTINGS_SPEC_VERSION),
+  // Shown on every locked control, so the user can tell an administrative
+  // decision from a bug. Absent renders as a generic "your organization".
+  organization: external_exports.string().min(1).optional(),
+  // What the administrator pinned.
+  values: ManagedSettingsValues.default({}),
+  // Which of those the user may not change. A key here with no matching value
+  // freezes whatever the user last chose; a value with no lock is a DEFAULT
+  // the user may still override. The two are separable on purpose.
+  lockedFields: external_exports.array(ManagedSettingKey).default([])
+}).meta({ id: "ManagedSettings" });
+
+// ../../packages/schema/src/zod/policy.ts
+var PolicyScope = external_exports.enum(["global", "repo", "user"]).meta({ id: "PolicyScope" });
+var PolicyTarget = external_exports.union([external_exports.object({ ruleId: external_exports.string() }), external_exports.object({ category: DetectionCategory })]).meta({ id: "PolicyTarget" });
+var Policy = external_exports.object({
+  id: external_exports.guid(),
+  scope: PolicyScope,
+  target: PolicyTarget,
+  action: ActionTaken,
+  enabled: external_exports.boolean().default(true),
+  customKeywords: external_exports.array(external_exports.string()).optional(),
+  // Display name — optional so older policy rows without name still parse.
+  // Added for the findings API (policy.name column migration).
+  name: external_exports.string().optional()
+}).meta({ id: "Policy" });
+var PolicyBundle = external_exports.object({
+  version: external_exports.string(),
+  policies: external_exports.array(Policy),
+  // Rules from the installed marketplace packs (snapshotted by the
+  // control plane). The plugin registers these in addition to its bundled
+  // packs. Optional so older backends — and older on-disk caches — that omit
+  // the field still parse; consumers read `bundle.rules ?? []`.
+  rules: external_exports.array(Rule).optional(),
+  // When true, `rules` IS the complete effective ruleset and the runtime must
+  // NOT merge its compiled-in bundled packs — the standalone gateway sets this
+  // after reading the user's installed snapshot (installed_packs, enabled
+  // packs only), which is how detection updates stay manual: new bundled
+  // rules run only after the user applies the pack update. Absent/false keeps
+  // the historical composition (bundled packs + rules) — older caches.
+  rulesComplete: external_exports.boolean().optional(),
+  // Active detection exceptions, evaluation subset only (see
+  // ExceptionBundleEntry). Optional so older bundle producers — and older
+  // on-disk caches — that omit the field still parse; consumers read
+  // `bundle.exceptions ?? []`.
+  exceptions: external_exports.array(ExceptionBundleEntry).optional(),
+  // Rule ids whose pack is assigned a REVERSIBLE archetype (Redact & Vault).
+  // A second axis over the same `redact` action, carried beside the policies
+  // rather than on them: nothing writes ruleId-targeted policies to disk, so
+  // widening Policy itself would change a persisted shape to express something
+  // only the in-memory bundle needs. Optional so an older producer — or an
+  // older on-disk cache — still parses; consumers read `?? []` and get the
+  // pre-existing one-way behaviour, which is the safe direction to default.
+  reversibleRuleIds: external_exports.array(external_exports.string()).optional(),
+  // Installed pack version, keyed by ruleId, for rules in `rules` that came
+  // from a versioned installed pack. Optional so older backends — and older
+  // on-disk caches — that omit the field still parse; consumers fall back to
+  // the rule's own spec version. NOT the bundle version above — see
+  // installedRuleset's ruleVersions for the source of truth.
+  ruleVersions: external_exports.record(external_exports.string(), external_exports.string()).optional(),
+  customKeywords: external_exports.array(external_exports.string()),
+  fetchedAt: external_exports.iso.datetime()
+}).meta({ id: "PolicyBundle" });
+var OBSERVE_ONLY_CATEGORIES = ["config"];
+var ENFORCEABLE_CATEGORIES = DetectionCategory.options.filter((c) => !OBSERVE_ONLY_CATEGORIES.includes(c));
+var CATEGORY_PEAK_SEVERITY = {
+  secret: "critical",
+  financial: "critical",
+  // core-financial/credit-card
+  code_flaw: "critical",
+  pii: "high",
+  phi: "high",
+  custom: "high",
+  // user-defined; conservative
+  code_context: "low",
+  config: "low"
+  // observe-only; floors to monitor regardless
+};
+function severityFloorPolicy(category) {
+  if (OBSERVE_ONLY_CATEGORIES.includes(category)) return "monitor";
+  const peak = CATEGORY_PEAK_SEVERITY[category];
+  return peak === "critical" || peak === "high" ? "warn" : "monitor";
+}
+var PolicyKind = external_exports.enum(["builtin", "custom"]).meta({ id: "PolicyKind" });
+var KNOWN_BUILTIN_IDS = ["monitor", "warn", "redact", "vault", "block"];
+var BuiltinPolicyId = external_exports.enum(KNOWN_BUILTIN_IDS).meta({ id: "BuiltinPolicyId" });
+var BUILTIN_POLICY_SPECS = {
+  monitor: {
+    name: "Monitor",
+    action: "log",
+    reversible: false,
+    description: "Log every match for audit. The request is allowed through untouched."
+  },
+  warn: {
+    name: "Warn",
+    action: "warn",
+    reversible: false,
+    description: "Allow the request, but warn the user inline before it is sent."
+  },
+  redact: {
+    name: "Redact",
+    action: "redact",
+    reversible: false,
+    description: "Strip the matched value from the request and destroy it, then continue. What was removed cannot be recovered."
+  },
+  vault: {
+    name: "Redact & Vault",
+    action: "redact",
+    reversible: true,
+    description: "Strip the matched value from the request and keep an encrypted, recoverable copy in the local vault, leaving a pointer in its place. Needs the vault consent granted under Settings; without it this behaves as Redact."
+  },
+  block: {
+    name: "Block",
+    action: "block",
+    reversible: false,
+    description: "Refuse the request entirely whenever any rule in this detection matches."
+  }
+};
+function builtinPolicyToAction(id) {
+  return BUILTIN_POLICY_SPECS[id].action;
+}
+var CATEGORY_EXPRESSIBLE_IDS = KNOWN_BUILTIN_IDS.filter(
+  (id) => !BUILTIN_POLICY_SPECS[id].reversible
+);
+var CATEGORY_INEXPRESSIBLE_IDS = KNOWN_BUILTIN_IDS.filter(
+  (id) => BUILTIN_POLICY_SPECS[id].reversible
+);
+var CategoryPolicyId = external_exports.enum(CATEGORY_EXPRESSIBLE_IDS).meta({ id: "CategoryPolicyId" });
+var DEFAULT_ACTIONS = Object.fromEntries(
+  DetectionCategory.options.map((c) => [c, builtinPolicyToAction(severityFloorPolicy(c))])
+);
+var BUILTIN_POLICIES = Object.fromEntries(
+  KNOWN_BUILTIN_IDS.map((id) => [id, { id, ...BUILTIN_POLICY_SPECS[id] }])
+);
+var UsedByItem = external_exports.object({
+  id: external_exports.string(),
+  name: external_exports.string(),
+  ruleCount: external_exports.number().int().nonnegative(),
+  enabled: external_exports.boolean()
+}).meta({ id: "UsedByItem" });
+var PolicyListItem = external_exports.object({
+  id: external_exports.string(),
+  kind: PolicyKind,
+  name: external_exports.string(),
+  enabled: external_exports.boolean(),
+  usedByCount: external_exports.number().int().nonnegative()
+}).meta({ id: "PolicyListItem" });
+var ListPoliciesResponse = external_exports.object({ items: external_exports.array(PolicyListItem) }).meta({ id: "ListPoliciesResponse" });
+var PolicyDetail = external_exports.object({
+  specVersion: external_exports.literal(1),
+  id: external_exports.string(),
+  kind: PolicyKind,
+  name: external_exports.string(),
+  enabled: external_exports.boolean(),
+  description: external_exports.string(),
+  usedBy: external_exports.array(UsedByItem)
+}).meta({ id: "PolicyDetail" });
+var PolicyStatsResponse = external_exports.object({
+  policies: external_exports.number().int().nonnegative(),
+  builtin: external_exports.number().int().nonnegative(),
+  custom: external_exports.number().int().nonnegative(),
+  detectionsGoverned: external_exports.number().int().nonnegative()
+}).meta({ id: "PolicyStatsResponse" });
+
 // ../../packages/schema/src/zod/project-files.ts
 var ProjectFileInput = external_exports.object({
   path: external_exports.string().min(1),
@@ -17234,44 +17321,6 @@ var BatchedRemediation = external_exports.discriminatedUnion("kind", [
   NoRemediationDecision
 ]);
 
-// ../../packages/schema/src/zod/rule-test.ts
-var TestRulesRequest = external_exports.object({
-  rules: external_exports.array(Rule).min(1).max(100),
-  text: external_exports.string().max(5e4).optional(),
-  fixtures: external_exports.array(RuleFixture).max(200).optional()
-}).refine((v) => v.text !== void 0 || (v.fixtures?.length ?? 0) > 0, {
-  message: "Provide `text`, `fixtures`, or both \u2014 there must be something to test"
-}).meta({ id: "TestRulesRequest" });
-var RuleTestMatch = external_exports.object({
-  ruleId: external_exports.string(),
-  category: DetectionCategory,
-  severity: Severity,
-  span: Span,
-  confidence: external_exports.number().min(0).max(1),
-  match: external_exports.string()
-}).meta({ id: "RuleTestMatch" });
-var FixtureResult = external_exports.object({
-  label: external_exports.string(),
-  shouldMatch: external_exports.boolean(),
-  didMatch: external_exports.boolean(),
-  passed: external_exports.boolean(),
-  matches: external_exports.array(RuleTestMatch)
-}).meta({ id: "FixtureResult" });
-var TestRulesResponse = external_exports.object({
-  // Present only when the request supplied `text`.
-  adhoc: external_exports.object({ matches: external_exports.array(RuleTestMatch) }).optional(),
-  fixtures: external_exports.array(FixtureResult),
-  summary: external_exports.object({
-    total: external_exports.number().int().nonnegative(),
-    passed: external_exports.number().int().nonnegative(),
-    failed: external_exports.number().int().nonnegative()
-  }),
-  // Ids of rules whose matcher type the engine cannot evaluate today (e.g.
-  // `validator`), so they silently never match. Surfaced so an author is not
-  // misled by a green run that actually skipped a rule.
-  unsupportedRuleIds: external_exports.array(external_exports.string())
-}).meta({ id: "TestRulesResponse" });
-
 // ../../packages/schema/src/zod/security.ts
 var SeveritySummaryItem = external_exports.object({
   severity: Severity,
@@ -17369,10 +17418,22 @@ var TopSourcesQuery = external_exports.object({
   // Omit for both kinds.
   kind: external_exports.enum(SOURCE_KINDS).optional()
 });
-var Provider = external_exports.enum(["claudecode", "cursor", "codex", "antigravity", "claudeai", "chatgpt", "copilot", "api"]).meta({ id: "Provider" });
+var Provider = Harness.extract([
+  "ClaudeCode",
+  "Cursor",
+  "Codex",
+  "Antigravity",
+  "ClaudeAi",
+  "ChatGpt",
+  "Copilot",
+  "Api"
+]).meta({ id: "Provider" });
 var ScanCoverageProvider = external_exports.object({
   provider: Provider,
-  // Percent of that provider's traffic scanned in the window. 0 when unsupported.
+  // Percent of that provider's traffic the shipped capture surface reaches.
+  // A curated business fact, constant across every `range` — not a measured
+  // per-window metric. 0 exactly when `supported` is false. See the comment
+  // above the block for where these numbers are decided.
   coverage: external_exports.number().int().min(0).max(100),
   supported: external_exports.boolean()
 }).meta({ id: "ScanCoverageProvider" });
@@ -17426,6 +17487,18 @@ var ApplyRecommendedActionResponse = external_exports.object({
 var DismissRecommendedActionResponse = external_exports.object({ id: external_exports.string(), status: external_exports.literal("dismissed") }).meta({ id: "DismissRecommendedActionResponse" });
 var RecommendedActionIdParam = external_exports.object({ id: external_exports.string() });
 
+// ../../packages/schema/src/zod/settings-action.ts
+var SaveSettingsInput = external_exports.object({
+  historicalAccess: external_exports.string(),
+  modelJudgeConsent: external_exports.boolean(),
+  vaultConsent: external_exports.string(),
+  vaultInlineReveal: external_exports.string()
+});
+var AttachInput = external_exports.object({
+  endpoint: external_exports.string(),
+  label: external_exports.string().optional()
+});
+
 // ../../packages/schema/src/zod/triage.ts
 var TriageHit = external_exports.object({
   ruleId: external_exports.string(),
@@ -17440,7 +17513,7 @@ var TriageHit = external_exports.object({
   valueFingerprint: external_exports.string().optional(),
   keyVersion: external_exports.number().int().nonnegative().optional()
 });
-var TriagePolicy = BuiltinPolicyId;
+var TriagePolicy = CategoryPolicyId;
 var TriageCategoryRec = external_exports.object({
   category: DetectionCategory,
   action: TriagePolicy,
@@ -17572,8 +17645,11 @@ function chmodBestEffort(path, mode) {
 function tightenDir(dir) {
   chmodBestEffort(dir, DATA_DIR_MODE);
 }
+function mkdirOwnerOnlySync(dir, recursive = false) {
+  mkdirSync(dir, { recursive, mode: DATA_DIR_MODE });
+}
 function ensureDataDirSync(dir) {
-  mkdirSync(dir, { recursive: true, mode: DATA_DIR_MODE });
+  mkdirOwnerOnlySync(dir, true);
   tightenDir(dir);
 }
 function tightenFile(file2) {
@@ -17582,6 +17658,8 @@ function tightenFile(file2) {
 
 // ../../packages/persistence/src/internal/snapshot.ts
 var STALE_PARTIAL_MS = 5 * 6e4;
+var SNAPSHOT_STAGING_SUFFIX = ".partial";
+var STAGED_NAME_SUFFIX = `.bak${SNAPSHOT_STAGING_SUFFIX}`;
 
 // ../../packages/persistence/src/internal/json.ts
 function parseJsonObject(s) {
@@ -17596,6 +17674,7 @@ function parseJsonObject(s) {
 
 // ../../packages/persistence/src/repositories/activity.ts
 var LIVE_ACTIVITY_WINDOW_MS = 30 * 6e4;
+var DEFAULT_HARNESS = HARNESS.ClaudeCode;
 
 // ../../packages/persistence/src/repositories/exceptions.ts
 import { randomUUID as randomUUID2 } from "crypto";
@@ -17614,7 +17693,20 @@ import { createHash as createHash2, randomUUID as randomUUID3 } from "crypto";
 // ../../packages/persistence/src/repositories/inventory-assets.ts
 import { randomUUID as randomUUID4 } from "crypto";
 var VALID_HARNESS_IDS = new Set(HarnessId.options);
+var HARNESS_LABELS = {
+  [HARNESS.ClaudeCode]: "Claude Code",
+  [HARNESS.Cursor]: "Cursor",
+  [HARNESS.Codex]: "Codex",
+  [HARNESS.Antigravity]: "Antigravity"
+};
 var HARNESS_LIVENESS_WINDOW_MS = 30 * 24 * 60 * 60 * 1e3;
+var stripSeparators = (value) => value.toLowerCase().replace(/[\s-]/g, "");
+var TITLE_NEEDLES = {
+  ClaudeCode: stripSeparators(SOURCE_TOOL.ClaudeCode),
+  Cursor: stripSeparators(SOURCE_TOOL.Cursor),
+  Codex: stripSeparators(SOURCE_TOOL.Codex),
+  Antigravity: stripSeparators(SOURCE_TOOL.Antigravity)
+};
 
 // ../../packages/persistence/src/repositories/policies.ts
 import { randomUUID as randomUUID5 } from "crypto";
@@ -17628,6 +17720,18 @@ import { randomUUID as randomUUID7 } from "crypto";
 // ../../packages/persistence/src/repositories/secret-vault.ts
 import { randomUUID as randomUUID8 } from "crypto";
 
+// ../../packages/persistence/src/repositories/security.ts
+var SCAN_COVERAGE = {
+  [HARNESS.Antigravity]: { coverage: 60, supported: true },
+  [HARNESS.Api]: { coverage: 0, supported: false },
+  [HARNESS.ChatGpt]: { coverage: 40, supported: true },
+  [HARNESS.ClaudeAi]: { coverage: 40, supported: true },
+  [HARNESS.ClaudeCode]: { coverage: 100, supported: true },
+  [HARNESS.Codex]: { coverage: 80, supported: true },
+  [HARNESS.Copilot]: { coverage: 0, supported: false },
+  [HARNESS.Cursor]: { coverage: 0, supported: false }
+};
+
 // ../../packages/persistence/src/repositories/shares.ts
 import { randomUUID as randomUUID9 } from "crypto";
 
@@ -17690,11 +17794,79 @@ function migrateLegacyLayout(base = defaultDataDir()) {
   }
 }
 
-// ../../packages/persistence/src/settings.ts
+// ../../packages/persistence/src/managed-settings.ts
 import { readFileSync as readFileSync3 } from "fs";
+import { posix, win32 } from "path";
+function managedSettingsPaths(platform2 = process.platform) {
+  if (platform2 === "darwin") {
+    return [
+      posix.join("/Library", "Application Support", "AKASecurity", MANAGED_SETTINGS_FILENAME),
+      posix.join("/Library", "Managed Preferences", MANAGED_SETTINGS_FILENAME)
+    ];
+  }
+  if (platform2 === "win32") {
+    return [win32.join("C:\\", "ProgramData", "AKASecurity", MANAGED_SETTINGS_FILENAME)];
+  }
+  return [posix.join("/etc", "aka", MANAGED_SETTINGS_FILENAME)];
+}
+function readManagedSettings(paths = managedSettingsPaths()) {
+  for (const path of paths) {
+    let text;
+    try {
+      text = readFileSync3(path, "utf8");
+    } catch {
+      continue;
+    }
+    const record2 = parseJsonObject(text);
+    if (!record2) continue;
+    const parsed = ManagedSettings.safeParse(record2);
+    if (parsed.success) return parsed.data;
+  }
+  return null;
+}
+function overlayManagedSettings(settings, managed, now = () => /* @__PURE__ */ new Date()) {
+  if (!managed) return settings;
+  const { values } = managed;
+  const merged = { ...settings };
+  if (values.runMode !== void 0) merged.runMode = values.runMode;
+  if (values.controlPlane !== void 0) {
+    merged.controlPlane = {
+      ...values.controlPlane,
+      // The administrator pinned WHICH deployment, not WHEN this machine
+      // joined it. Keep the user's own attach time when the endpoint is
+      // unchanged, so a managed machine does not appear to re-attach on every
+      // read; stamp a fresh one when the administrator moved it.
+      attachedAt: settings.controlPlane?.endpoint === values.controlPlane.endpoint ? settings.controlPlane.attachedAt : now().toISOString()
+    };
+  }
+  if (values.historicalAccess !== void 0) merged.historicalAccess = values.historicalAccess;
+  if (values.vaultKeyCustody !== void 0) merged.vaultKeyCustody = values.vaultKeyCustody;
+  if (values.vaultInlineReveal !== void 0) merged.vaultInlineReveal = values.vaultInlineReveal;
+  if (values.dataSharesInPlace !== void 0) merged.dataSharesInPlace = values.dataSharesInPlace;
+  if (values.vaultConsent !== void 0) {
+    merged.vaultConsent = values.vaultConsent ? (
+      // Keep an existing valid grant so its acknowledgedAt survives; mint one
+      // at the current version otherwise.
+      settings.vaultConsent?.version === VAULT_CONSENT_VERSION ? settings.vaultConsent : { acknowledgedAt: now().toISOString(), version: VAULT_CONSENT_VERSION }
+    ) : void 0;
+  }
+  if (values.modelJudgeConsent !== void 0) {
+    merged.modelJudgeConsent = values.modelJudgeConsent ? settings.modelJudgeConsent?.payloadVersion === MODEL_JUDGE_PAYLOAD_VERSION ? settings.modelJudgeConsent : {
+      acknowledgedAt: now().toISOString(),
+      payloadVersion: MODEL_JUDGE_PAYLOAD_VERSION
+    } : void 0;
+  }
+  return merged;
+}
+
+// ../../packages/persistence/src/settings.ts
+import { readFileSync as readFileSync4 } from "fs";
 import { join as join5 } from "path";
 var SETTINGS_FILENAME = "settings.json";
 function readWorkspaceSettings(base = defaultDataDir()) {
+  return overlayManagedSettings(readUserSettings(base), readManagedSettings());
+}
+function readUserSettings(base) {
   const record2 = readJson(join5(settingsDir(base), SETTINGS_FILENAME));
   if (!record2) return defaultWorkspaceSettings();
   try {
@@ -17706,7 +17878,7 @@ function readWorkspaceSettings(base = defaultDataDir()) {
 function readJson(file2) {
   let text;
   try {
-    text = readFileSync3(file2, "utf8");
+    text = readFileSync4(file2, "utf8");
   } catch {
     return null;
   }
@@ -17725,15 +17897,7 @@ import {
 // ../../packages/persistence/src/vault/key-provider.ts
 import { execFileSync } from "child_process";
 import { randomBytes as randomBytes2 } from "crypto";
-import {
-  chmodSync as chmodSync2,
-  mkdirSync as mkdirSync2,
-  readFileSync as readFileSync4,
-  renameSync as renameSync4,
-  rmSync as rmSync4,
-  statSync as statSync3,
-  writeFileSync as writeFileSync3
-} from "fs";
+import { chmodSync as chmodSync2, readFileSync as readFileSync5, renameSync as renameSync4, rmSync as rmSync4, statSync as statSync3, writeFileSync as writeFileSync3 } from "fs";
 import { join as join6 } from "path";
 
 // ../../packages/persistence/src/vault/vault.ts
@@ -17819,7 +17983,7 @@ function resolveProviderSafe(resolveProviderFn) {
 }
 
 // ../../packages/plugin-sdk/src/config-inventory.ts
-import { readdirSync as readdirSync2, readFileSync as readFileSync6, realpathSync, statSync as statSync5 } from "fs";
+import { readdirSync as readdirSync2, readFileSync as readFileSync7, realpathSync, statSync as statSync5 } from "fs";
 import { homedir as homedir2 } from "os";
 import { basename as basename3, join as join10 } from "path";
 
@@ -18395,6 +18559,40 @@ function escapeRegExp2(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
+// ../../packages/detections/src/regex-cache.ts
+var singles = /* @__PURE__ */ new WeakMap();
+var keywordLists = /* @__PURE__ */ new WeakMap();
+var labelLists = /* @__PURE__ */ new WeakMap();
+function listCache(kind) {
+  return kind === "keyword" ? keywordLists : labelLists;
+}
+function memoizedRegExp(owner, build) {
+  const cached2 = singles.get(owner);
+  if (cached2 !== void 0) {
+    cached2.lastIndex = 0;
+    return cached2;
+  }
+  const compiled = build();
+  singles.set(owner, compiled);
+  return compiled;
+}
+function memoizedRegExpList(kind, owner, build) {
+  const cache = listCache(kind);
+  const cached2 = cache.get(owner);
+  if (cached2 !== void 0) {
+    if (cached2.stateful) {
+      for (const re of cached2.entries) if (re !== void 0) re.lastIndex = 0;
+    }
+    return cached2.entries;
+  }
+  const entries = build();
+  cache.set(owner, {
+    entries,
+    stateful: entries.some((re) => re !== void 0 && (re.global || re.sticky))
+  });
+  return entries;
+}
+
 // ../../packages/detections/src/matchers/limits.ts
 var MAX_MATCHES_PER_RULE = 1e4;
 var MAX_REGEX_INPUT_LENGTH = 2e5;
@@ -18405,10 +18603,17 @@ var KeywordMatcher2 = class {
     if (rule.matcher.type !== "keyword") return [];
     const { keywords, caseSensitive } = rule.matcher;
     const spans = [];
-    for (const kw of keywords) {
-      if (kw.length === 0) continue;
+    const compiled = memoizedRegExpList(
+      "keyword",
+      rule.matcher,
+      () => keywords.map((kw) => {
+        if (kw.length === 0) return void 0;
+        return new RegExp(escapeRegExp2(kw), caseSensitive ? "gu" : "giu");
+      })
+    );
+    for (const re of compiled) {
+      if (re === void 0) continue;
       if (spans.length >= MAX_MATCHES_PER_RULE) break;
-      const re = new RegExp(escapeRegExp2(kw), caseSensitive ? "gu" : "giu");
       let m;
       while ((m = re.exec(text)) !== null) {
         spans.push({ start: m.index, end: m.index + m[0].length });
@@ -18424,7 +18629,10 @@ var RegexMatcher2 = class {
   match(text, rule) {
     if (rule.matcher.type !== "regex") return [];
     const { pattern, flags, captureGroup } = rule.matcher;
-    const re = new RegExp(pattern, flags.includes("d") ? flags : `${flags}d`);
+    const re = memoizedRegExp(
+      rule.matcher,
+      () => new RegExp(pattern, flags.includes("d") ? flags : `${flags}d`)
+    );
     const scanText2 = text.length > MAX_REGEX_INPUT_LENGTH ? text.slice(0, MAX_REGEX_INPUT_LENGTH) : text;
     const spans = [];
     let m;
@@ -18507,6 +18715,7 @@ var CONFIG_POSTURE_RULES = [
 ];
 
 // ../../packages/detections/src/security/redos-probe.ts
+var BUDGET_MS = 100;
 var EXPONENTIAL_UNITS = [
   "a",
   "0",
@@ -18530,9 +18739,11 @@ var EXPONENTIAL_PROBES = EXPONENTIAL_UNITS.flatMap(
 var POLYNOMIAL_PROBES = ["abc-", "a.", "a ", "a=", "x", "0", "a@", "a/", "ab"].map(
   (unit) => unit.repeat(1e4).slice(0, 4e4) + "!"
 );
+var CPU_CORROBORATION_SHARE = 0.2;
+var CORROBORATION_FLOOR_MS = BUDGET_MS * CPU_CORROBORATION_SHARE;
 
 // ../../packages/plugin-sdk/src/repo.ts
-import { existsSync as existsSync6, readFileSync as readFileSync5, statSync as statSync4 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync6, statSync as statSync4 } from "fs";
 import { basename as basename2, dirname as dirname2, isAbsolute, join as join9, sep as sep2 } from "path";
 
 // ../../packages/plugin-sdk/src/events.ts
@@ -18543,21 +18754,25 @@ import { existsSync as existsSync7 } from "fs";
 import { fileURLToPath } from "url";
 import { Worker } from "worker_threads";
 
+// ../../packages/plugin-sdk/src/ignore-layers.ts
+var import_ignore = __toESM(require_ignore(), 1);
+import { readFileSync as readFileSync8 } from "fs";
+import { join as join11 } from "path";
+
 // ../../packages/plugin-sdk/src/inventory-resolver.ts
 import { arch, hostname as hostname4, platform, release } from "os";
 
 // ../../packages/plugin-sdk/src/nudge.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync5 } from "fs";
-import { join as join11 } from "path";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync9, writeFileSync as writeFileSync5 } from "fs";
+import { join as join12 } from "path";
 
 // ../../packages/plugin-sdk/src/paths.ts
 import { readdirSync as readdirSync3, realpathSync as realpathSync2 } from "fs";
 import { basename as basename4, dirname as dirname3, sep as sep3 } from "path";
 
 // ../../packages/plugin-sdk/src/project-files.ts
-var import_ignore = __toESM(require_ignore(), 1);
-import { existsSync as existsSync8, readdirSync as readdirSync4, readFileSync as readFileSync8 } from "fs";
-import { basename as basename5, join as join12, relative, sep as sep4 } from "path";
+import { existsSync as existsSync8, readdirSync as readdirSync4 } from "fs";
+import { basename as basename5, join as join13 } from "path";
 
 // ../../packages/plugin-sdk/src/provider-env-antigravity.ts
 var optionalBaseUrl2 = external_exports.preprocess((v) => {
@@ -18592,16 +18807,16 @@ import { randomUUID as randomUUID14 } from "crypto";
 var THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1e3;
 
 // ../../packages/plugin-sdk/src/throttle.ts
-import { mkdirSync as mkdirSync4, statSync as statSync6, writeFileSync as writeFileSync6 } from "fs";
-import { join as join13 } from "path";
+import { mkdirSync as mkdirSync3, statSync as statSync6, writeFileSync as writeFileSync6 } from "fs";
+import { join as join14 } from "path";
 function throttled(dataDir2, markerName, windowMs) {
-  const marker = join13(dataDir2, markerName);
+  const marker = join14(dataDir2, markerName);
   try {
     if (Date.now() - statSync6(marker).mtimeMs < windowMs) return true;
   } catch {
   }
   try {
-    mkdirSync4(dataDir2, { recursive: true, mode: DATA_DIR_MODE });
+    mkdirSync3(dataDir2, { recursive: true, mode: DATA_DIR_MODE });
     writeFileSync6(marker, String(Date.now()), { mode: DATA_FILE_MODE });
   } catch {
   }
@@ -18610,7 +18825,7 @@ function throttled(dataDir2, markerName, windowMs) {
 
 // src/history/reconcile-trigger.ts
 import { spawn } from "child_process";
-import { dirname as dirname4, join as join15 } from "path";
+import { dirname as dirname4, join as join16 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/history/tail.ts
@@ -18618,13 +18833,13 @@ import { createHash as createHash5 } from "crypto";
 import {
   closeSync as closeSync2,
   fstatSync,
-  mkdirSync as mkdirSync5,
+  mkdirSync as mkdirSync4,
   openSync as openSync2,
-  readFileSync as readFileSync9,
+  readFileSync as readFileSync10,
   readSync,
   writeFileSync as writeFileSync7
 } from "fs";
-import { join as join14 } from "path";
+import { join as join15 } from "path";
 var SAFE_SESSION_ID = /^[A-Za-z0-9._-]+$/;
 function safeSessionId(sessionId) {
   if (SAFE_SESSION_ID.test(sessionId) && sessionId !== "." && sessionId !== "..") {
@@ -18641,7 +18856,7 @@ function triggerReconcile(dataDir2, sessionId, transcriptPath) {
     const marker = `${RECONCILE_MARKER_PREFIX}-${safeSessionId(sessionId)}`;
     if (throttled(dataDir2, marker, RECONCILE_THROTTLE_MS)) return;
     const here = dirname4(fileURLToPath2(import.meta.url));
-    const child = spawn(process.execPath, [join15(here, "reconcile.js"), sessionId, transcriptPath], {
+    const child = spawn(process.execPath, [join16(here, "reconcile.js"), sessionId, transcriptPath], {
       detached: true,
       stdio: "ignore"
     });