@akasecurity/ai-tc-claude-code 0.9.6 → 0.9.8

package/scripts/stop.js

@@ -50,7 +50,7 @@ var require_ignore = __commonJS({
     var REGEX_SPLITALL_CRLF = /\r?\n/g;
     var REGEX_TEST_INVALID_PATH = /^\.{0,2}\/|^\.{1,2}$/;
     var REGEX_TEST_TRAILING_SLASH = /\/$/;
-    var SLASH = "/";
+    var SLASH2 = "/";
     var TMP_KEY_IGNORE = "node-ignore";
     if (typeof Symbol !== "undefined") {
       TMP_KEY_IGNORE = /* @__PURE__ */ Symbol.for("node-ignore");
@@ -422,11 +422,11 @@ var require_ignore = __commonJS({
         if (!REGEX_TEST_TRAILING_SLASH.test(path)) {
           return this.test(path);
         }
-        const slices = path.split(SLASH).filter(Boolean);
+        const slices = path.split(SLASH2).filter(Boolean);
         slices.pop();
         if (slices.length) {
           const parent = this._t(
-            slices.join(SLASH) + SLASH,
+            slices.join(SLASH2) + SLASH2,
             this._testCache,
             true,
             slices
@@ -442,14 +442,14 @@ var require_ignore = __commonJS({
           return cache[path];
         }
         if (!slices) {
-          slices = path.split(SLASH).filter(Boolean);
+          slices = path.split(SLASH2).filter(Boolean);
         }
         slices.pop();
         if (!slices.length) {
           return cache[path] = this._rules.test(path, checkUnignored, MODE_IGNORE);
         }
         const parent = this._t(
-          slices.join(SLASH) + SLASH,
+          slices.join(SLASH2) + SLASH2,
           cache,
           checkUnignored,
           slices
@@ -492,13 +492,12 @@ var require_ignore = __commonJS({
 });
 
 // ../../packages/plugin-sdk/src/config.ts
-import { existsSync as existsSync5 } from "fs";
-import { join as join8 } from "path";
+import { existsSync as existsSync6 } from "fs";
+import { join as join10 } from "path";
 
-// ../../packages/persistence/src/database.ts
-import { randomUUID as randomUUID10 } from "crypto";
-import { join as join2, sep } from "path";
-import { DatabaseSync } from "node:sqlite";
+// ../../packages/persistence/src/control-plane-credential.ts
+import { chmodSync as chmodSync2, lstatSync as lstatSync2, readFileSync, rmSync as rmSync2, statSync } from "fs";
+import { join } from "path";
 
 // ../../packages/schema/src/exception-scope.ts
 var MINUTE_MS = 6e4;
@@ -15070,6 +15069,47 @@ function date4(params) {
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
 config(en_default());
 
+// ../../packages/schema/src/zod/harness-map.ts
+var HARNESS = {
+  ClaudeCode: "claudecode",
+  Cursor: "cursor",
+  Copilot: "copilot",
+  Codex: "codex",
+  Antigravity: "antigravity",
+  Windsurf: "windsurf",
+  ClaudeDesktop: "claudedesktop",
+  ChatGpt: "chatgpt",
+  ClaudeAi: "claudeai",
+  Api: "api"
+};
+var Harness = external_exports.enum(HARNESS).meta({ id: "Harness" });
+var SOURCE_TOOL = {
+  ClaudeCode: "claude-code",
+  ClaudeDesktop: "claude-desktop",
+  Cursor: "cursor",
+  ChatGpt: "chatgpt",
+  ClaudeAi: "claude-ai",
+  Copilot: "github-copilot",
+  Codex: "codex",
+  Antigravity: "antigravity",
+  // No harness counterpart, deliberately: the CLI's own captures and a capture
+  // whose tool could not be identified both render through the read side's
+  // miss path rather than as a harness of their own.
+  Cli: "cli",
+  Unknown: "unknown"
+};
+var SourceTool = external_exports.enum(SOURCE_TOOL).meta({ id: "SourceTool" });
+var TOOL_TO_HARNESS = {
+  [SOURCE_TOOL.ClaudeCode]: HARNESS.ClaudeCode,
+  [SOURCE_TOOL.ClaudeDesktop]: HARNESS.ClaudeDesktop,
+  [SOURCE_TOOL.Copilot]: HARNESS.Copilot,
+  [SOURCE_TOOL.Cursor]: HARNESS.Cursor,
+  [SOURCE_TOOL.ChatGpt]: HARNESS.ChatGpt,
+  [SOURCE_TOOL.Codex]: HARNESS.Codex,
+  [SOURCE_TOOL.Antigravity]: HARNESS.Antigravity,
+  [SOURCE_TOOL.ClaudeAi]: HARNESS.ClaudeAi
+};
+
 // ../../packages/schema/src/zod/finding.ts
 var DetectionCategory = external_exports.enum(["pii", "financial", "secret", "phi", "code_context", "code_flaw", "custom", "config"]).meta({ id: "DetectionCategory" });
 var Severity = external_exports.enum(["critical", "high", "medium", "low"]).meta({ id: "Severity" });
@@ -15092,21 +15132,22 @@ var Finding = external_exports.object({
 }).meta({ id: "Finding" });
 var DetectedFinding = Finding.meta({ id: "DetectedFinding" });
 var FindingAction = external_exports.enum(["blocked", "redacted", "warned", "allowed", "quarantined", "monitored"]).meta({ id: "FindingAction" });
-var FindingProvider = external_exports.enum([
-  "claudecode",
-  "claudedesktop",
-  "cursor",
-  "copilot",
-  "chatgpt",
-  "claudeai",
-  "codex",
-  "antigravity",
-  "api"
+var FindingProvider = Harness.extract([
+  "ClaudeCode",
+  "ClaudeDesktop",
+  "Cursor",
+  "Copilot",
+  "ChatGpt",
+  "ClaudeAi",
+  "Codex",
+  "Antigravity",
+  "Api"
 ]).meta({ id: "FindingProvider" });
 var FindingCategory = external_exports.enum([
   "secret",
   "pii",
   "source_code",
+  "code_flaw",
   "external_share",
   "mcp_server",
   "customer_data",
@@ -15284,6 +15325,7 @@ var FindingInstanceDetail = FindingInstance.extend({
   detection: FindingDetectionRef,
   policy: FindingPolicyRef
 }).meta({ id: "FindingInstanceDetail" });
+var MAX_FLAT_FINDINGS_LIMIT = 200;
 var ListFindingInstancesQuery = external_exports.object({
   severity: external_exports.array(Severity).optional(),
   // Rule ids, the same vocabulary the grouped list's `subtype` carries.
@@ -15303,7 +15345,7 @@ var ListFindingInstancesQuery = external_exports.object({
   q: external_exports.string().optional(),
   sessionId: external_exports.string().optional(),
   from: external_exports.iso.datetime().optional(),
-  limit: external_exports.coerce.number().int().min(1).max(200).optional(),
+  limit: external_exports.coerce.number().int().min(1).max(MAX_FLAT_FINDINGS_LIMIT).optional(),
   cursor: external_exports.string().optional()
 });
 var ListFindingInstancesResponse = external_exports.object({
@@ -15365,20 +15407,6 @@ var ListFindingLocationsResponse = external_exports.object({
   hasMore: external_exports.boolean()
 }).meta({ id: "ListFindingLocationsResponse" });
 
-// ../../packages/schema/src/zod/harness-map.ts
-var Harness = external_exports.enum([
-  "claudecode",
-  "cursor",
-  "copilot",
-  "codex",
-  "antigravity",
-  "windsurf",
-  "claudedesktop",
-  "chatgpt",
-  "claudeai",
-  "api"
-]).meta({ id: "Harness" });
-
 // ../../packages/schema/src/zod/meta.ts
 var InventoryObjectType = external_exports.enum(["host", "harness", "user", "skill", "hook", "mcp_server", "config_file"]).meta({ id: "InventoryObjectType" });
 var AuditEventType = external_exports.enum([
@@ -15828,366 +15856,240 @@ var ActivityOverviewResponse = external_exports.object({
   sessions: ListActivitySessionsResponse
 }).meta({ id: "ActivityOverviewResponse" });
 
-// ../../packages/schema/src/zod/event.ts
-var EventKind = external_exports.enum(["prompt", "response", "code_change", "tool_use"]).meta({ id: "EventKind" });
-var CAPTURE_EVENT_TYPES_SQL = EventKind.options.map((k) => `'${k}'`).join(",");
-var SourceTool = external_exports.enum([
-  "claude-code",
-  "claude-desktop",
-  "cursor",
-  "chatgpt",
-  "claude-ai",
-  "github-copilot",
-  "codex",
-  "antigravity",
-  "cli",
-  "unknown"
-]).meta({ id: "SourceTool" });
-var EventMetadata = external_exports.object({
-  sessionId: external_exports.string().optional(),
-  repo: external_exports.string().optional(),
-  filePath: external_exports.string().optional(),
-  // The host tool whose input/output was scanned (e.g. 'Bash', 'WebFetch'),
-  // set by the tool-scanning hooks. The tool NAME only — never the tool's
-  // arguments or output, which can carry the very value a finding masked
-  // (metadata is stored unredacted). Gives findings on non-file captures a
-  // display location ("via Bash") when no filePath exists.
-  toolName: external_exports.string().optional(),
-  // Set (true) by the worktree scanner when the file is excluded by the
-  // repo's .gitignore. Gitignored files ARE still scanned — local scratch and
-  // generated code can leak real secrets — but the provenance is recorded so
-  // policy/dashboards can treat those findings as informational rather than
-  // blocking. Omitted (not false) for tracked files and non-scan events.
-  gitignored: external_exports.boolean().optional(),
-  // Set (true) ONLY when the event's `content` is the COMPLETE file at
-  // capture time (a worktree scan reading from disk). Hook-captured edits
-  // (e.g. an Edit tool's new_string) are partial fragments and MUST NOT set
-  // this. The resolver-on-ingest keys its fixed-at-source dropout
-  // diff on this marker: only a whole-file snapshot can prove a previously
-  // open finding is gone; a fragment's absence proves nothing (the secret
-  // may live outside the hunk). Omitted (not false) for fragments and
-  // non-scan events, so pre-marker clients safely default to the
-  // non-authoritative path.
-  wholeFile: external_exports.boolean().optional(),
-  model: external_exports.string().optional(),
-  turnIndex: external_exports.number().int().nonnegative().optional(),
-  // Distributed-tracing correlation. `correlationId` ties a recorded event back
-  // to the request that captured/ingested it (a UUID, generated independently of
-  // the trace id); `traceId` is the W3C trace id (32 lowercase hex chars) of the
-  // originating span when telemetry is enabled. Both optional + backward
-  // compatible — populated by the plugin (see @akasecurity/plugin-sdk).
-  correlationId: external_exports.uuid().optional(),
-  traceId: external_exports.string().regex(/^[0-9a-f]{32}$/).optional(),
-  // Ids of the detection exceptions that downgraded findings in this capture
-  // to 'allow' — the enforcement audit trail's link back to the grant that
-  // authorized the bypass. Absent on captures where no exception applied.
-  exceptionIds: external_exports.array(external_exports.guid()).optional()
-}).meta({ id: "EventMetadata" });
-var Event = external_exports.object({
-  id: external_exports.guid(),
-  sourceTool: SourceTool,
-  kind: EventKind,
-  occurredAt: external_exports.iso.datetime(),
-  contentHash: external_exports.string(),
-  content: external_exports.string(),
-  metadata: EventMetadata.optional()
-}).meta({ id: "Event" });
-var IngestEvent = Event.meta({ id: "IngestEvent" });
-var IngestBatch = external_exports.object({
-  events: external_exports.array(IngestEvent).min(1).max(100),
-  // Dedup policy for this batch. Id-dedup ALWAYS applies. 'content-hash'
-  // additionally rejects any event whose contentHash the store has already
-  // recorded — for re-runnable bulk ingest (worktree scan, transcript
-  // backfill), where a re-run mints fresh event ids for identical content and
-  // would otherwise accumulate duplicates. Live hook traffic must NOT set it:
-  // two genuinely separate prompts can be byte-identical and both belong on
-  // the timeline.
-  dedupe: external_exports.literal("content-hash").optional()
-}).meta({ id: "IngestBatch" });
-
-// ../../packages/schema/src/zod/inventory.ts
-var AssetType = external_exports.enum(["project", "skill", "mcp", "hook", "config"]).meta({ id: "AssetType" });
-var AccessLevel = external_exports.enum(["open", "approved", "blocked"]).meta({ id: "AccessLevel" });
-var Origin = external_exports.enum(["source", "public-dep", "vendored", "config", "data", "docs", "generated"]).meta({ id: "Origin" });
-var TrustLevel = external_exports.enum(["known-good", "risky", "unapproved"]).meta({ id: "TrustLevel" });
-var Flag = external_exports.enum(["update", "stale", "conflict", "unknown", "change", "untracked", "risk", "findings"]).meta({ id: "Flag" });
-var Visibility = external_exports.enum(["public", "private"]).meta({ id: "Visibility" });
-var HarnessEventKind = external_exports.enum(["block", "redact", "warn"]).meta({ id: "HarnessEventKind" });
-var HarnessId = external_exports.enum(["claudecode", "cursor", "codex", "antigravity"]).meta({ id: "HarnessId" });
-var AccessCounts = external_exports.object({
-  open: external_exports.number().int().nonnegative(),
-  approved: external_exports.number().int().nonnegative(),
-  blocked: external_exports.number().int().nonnegative(),
-  total: external_exports.number().int().nonnegative()
-}).meta({ id: "AccessCounts" });
-var AssetSummary = external_exports.object({
-  id: external_exports.string(),
-  type: AssetType,
-  name: external_exports.string(),
-  sub: external_exports.string(),
-  flags: external_exports.array(Flag),
-  /** MCP servers only — omitted for all other types. */
-  trust: TrustLevel.optional()
-}).meta({ id: "AssetSummary" });
-var ProjectSummary = external_exports.object({
-  id: external_exports.string(),
-  name: external_exports.string(),
-  repo: external_exports.string(),
-  visibility: Visibility,
-  language: external_exports.string(),
-  policyDefault: AccessLevel,
-  updatedAt: external_exports.iso.datetime(),
-  accessCounts: AccessCounts,
-  findingsCount: external_exports.number().int().nonnegative()
-}).meta({ id: "ProjectSummary" });
-var HarnessCategory = external_exports.object({
-  /** One of config/skill/mcp/hook — never project (enforced at service layer). */
-  type: AssetType,
-  assets: external_exports.array(AssetSummary)
+// ../../packages/schema/src/zod/config-inventory.ts
+var ConfigScope = external_exports.enum(["user", "project", "local", "plugin"]);
+var SkillScanEntry = external_exports.object({
+  name: external_exports.string().min(1),
+  // The identity source: a marketplace repo for plugin skills (e.g.
+  // 'anthropics/skills'), 'local' for personal ~/.claude/skills, or
+  // 'project:<repo-identity>' for checked-in project skills. The surrogate keeps
+  // a personal skill named 'pdf' from colliding with the marketplace 'pdf'.
+  source: external_exports.string().min(1),
+  scope: ConfigScope,
+  pluginName: external_exports.string().optional(),
+  // Volatile — rides the attribute bag, never the identity hash.
+  version: external_exports.string().optional(),
+  description: external_exports.string().optional(),
+  // Skill directory mtime (ISO) — the "updated Nd ago" freshness signal.
+  updatedAt: external_exports.iso.datetime().optional(),
+  // Filesystem path — the promoted inventory `location` column.
+  location: external_exports.string().optional()
 });
-var HarnessSummary = external_exports.object({
-  id: HarnessId,
-  label: external_exports.string(),
-  kind: external_exports.string(),
-  version: external_exports.string(),
-  sessions: external_exports.number().int().nonnegative(),
-  assetCount: external_exports.number().int().nonnegative(),
-  flagCount: external_exports.number().int().nonnegative(),
-  projects: external_exports.array(ProjectSummary),
-  categories: external_exports.array(HarnessCategory)
-}).meta({ id: "HarnessSummary" });
-var ListHarnessesResponse = external_exports.object({ items: external_exports.array(HarnessSummary) }).meta({ id: "ListHarnessesResponse" });
-var AssetGroup = external_exports.object({
-  /** Group key — never project (enforced at service layer). */
-  type: AssetType,
-  total: external_exports.number().int().nonnegative(),
-  /**
-   * MCP group only — omitted for all other types.
-   * Partial: only TrustLevel keys with non-zero counts are included.
-   * Strict: unknown keys are rejected — only TrustLevel values are valid keys.
-   */
-  trustRollup: external_exports.object({
-    "known-good": external_exports.number().int().nonnegative(),
-    risky: external_exports.number().int().nonnegative(),
-    unapproved: external_exports.number().int().nonnegative()
-  }).partial().strict().optional(),
+var HookScanEntry = external_exports.object({
+  // Hook event name (PreToolUse, PostToolUse, …). Open string, not an enum: the
+  // set is harness-defined and grows without a schema change.
+  event: external_exports.string().min(1),
+  // The tool matcher ('Bash', 'Edit|Write', …). Absent = matches all tools.
+  matcher: external_exports.string().optional(),
+  command: external_exports.string().min(1),
+  timeout: external_exports.number().optional(),
+  scope: ConfigScope,
+  pluginName: external_exports.string().optional(),
+  // The settings file / hooks.json the entry came from.
+  location: external_exports.string().optional()
+});
+var McpServerScanEntry = external_exports.object({
+  // The server's config key ("github", "filesystem", …) — identity, with the
+  // qualified scope (see mcpServerIdentityKey).
+  name: external_exports.string().min(1),
+  scope: ConfigScope,
+  pluginName: external_exports.string().optional(),
+  // The owning plugin's marketplace — part of PLUGIN-scope identity: two
+  // marketplaces can each ship a plugin named `guard`, and without this their
+  // same-named servers would collapse to one row (the second silently dropped,
+  // inheriting the first's trust).
+  marketplace: external_exports.string().optional(),
+  // The repo identity (remote url, or the cwd for un-remoted repos) — part of
+  // PROJECT/LOCAL-scope identity: a server named `github` in repo A and one in
+  // repo B are different servers with different commands, and MUST NOT share a
+  // row — a shared row would let a cloned repo's .mcp.json inherit the trust
+  // the user granted elsewhere.
+  project: external_exports.string().optional(),
+  // 'stdio' when the entry carries a command; otherwise the config's `type`
+  // ('http' / 'sse' / …). Open string — the transport set is harness-defined.
+  transport: external_exports.string().min(1),
+  // Volatile on purpose (unlike hook `command`): a changed command/url is drift
+  // on a stable row — visible across config_scan snapshots and preserving the
+  // user's trust decision — never a quiet new row. One of the two is present.
+  // Secret-masked at collection time (the scanner runs the bundled detection
+  // packs over both — tokens routinely ride command args and URLs).
+  command: external_exports.string().optional(),
+  url: external_exports.string().optional(),
+  // Env var NAMES only, never values (the no-secrets rule).
+  envKeys: external_exports.array(external_exports.string()).optional(),
+  // The config file the entry came from.
+  location: external_exports.string().optional()
+});
+var ConfigFileScanEntry = external_exports.object({
+  // Basename (settings.json, CLAUDE.md) or dir name (commands/, agents/).
+  name: external_exports.string().min(1),
+  // The absolute path — identity (with scope) and the promoted `location`.
+  path: external_exports.string().min(1),
+  scope: ConfigScope,
+  // Human label: "User settings", "Project memory", "Slash commands", …
+  kind: external_exports.string().min(1),
+  // Derived SHAPE summary — top-level key names, entry counts, line counts.
+  // Never file content or values (memory files can carry sensitive detail).
+  detail: external_exports.string().optional(),
+  // Dir configs (commands/, agents/) and .mcp.json: how many entries.
+  entryCount: external_exports.number().optional(),
+  // File mtime (ISO) — the freshness signal.
+  updatedAt: external_exports.iso.datetime().optional()
+});
+var ConfigScanResult = external_exports.object({
+  scannedAt: external_exports.iso.datetime(),
+  skills: external_exports.array(SkillScanEntry),
+  hooks: external_exports.array(HookScanEntry),
+  mcpServers: external_exports.array(McpServerScanEntry),
+  configFiles: external_exports.array(ConfigFileScanEntry),
+  errors: external_exports.array(external_exports.object({ source: external_exports.string(), reason: external_exports.string() }))
+});
+var ConfigPostureFindingInput = external_exports.object({
+  ruleId: external_exports.string().min(1),
+  version: external_exports.string().min(1),
+  span: Span,
+  // For posture rules this is the offending COMMAND (config the user already
+  // holds locally, not captured secret content) — it is also the correlation
+  // key the read surface matches back to a hook row.
+  maskedMatch: external_exports.string(),
+  actionTaken: ActionTaken,
+  confidence: external_exports.number().min(0).max(1)
+});
+var ConfigScanRecord = external_exports.object({
+  items: external_exports.array(InventoryInput),
+  scanEvent: AuditEventInput,
+  definitions: external_exports.array(InspectionDefinitionInput).optional(),
+  findings: external_exports.array(ConfigPostureFindingInput).optional()
+});
+
+// ../../packages/schema/src/zod/control-plane.ts
+var ATTACHED_CREDENTIAL_SPEC_VERSION = 1;
+var AttachedCredential = external_exports.object({
+  specVersion: external_exports.literal(ATTACHED_CREDENTIAL_SPEC_VERSION),
+  // The control-plane endpoint this credential was minted against.
+  endpoint: external_exports.string().min(1),
+  // The bearer credential itself. Never logged, never rendered — status
+  // surfaces show `keyPrefix` and nothing else.
+  apiKey: external_exports.string().min(1),
+  // First few characters of the key, safe to display so a user can match the
+  // credential against their organization's key list.
+  keyPrefix: external_exports.string().min(1).max(16).optional(),
+  mintedAt: external_exports.iso.datetime().optional()
+});
+var MAX_DATE_MS = 253402300799999;
+var MAX_INT4 = 2147483647;
+var StorePosturePack = external_exports.object({
+  packId: external_exports.string().min(1),
+  // 'namespace/packId'
+  version: external_exports.string().min(1),
+  enabled: external_exports.boolean(),
+  // Stringified pass-through of the local store's `installed_packs.updated_at`
+  // — the column format is store-version-dependent (epoch millis vs ISO), so
+  // the wire shape assumes neither.
+  updatedAt: external_exports.string().nullable()
+}).meta({ id: "StorePosturePack" });
+var StorePosturePolicyCounts = external_exports.object({
+  total: external_exports.number().int().min(0),
+  disabled: external_exports.number().int().min(0),
+  // Exhaustive per-action map; the builder pre-fills every action with 0.
+  //
+  // Spelled out member-by-member rather than `z.record(ActionTaken, …)`. Zod
+  // enforces exhaustiveness either way, but z.record emits `propertyNames` +
+  // `additionalProperties` into a generated schema document, and a type
+  // generator renders THAT with every key optional — a sender built against
+  // the generated type would typecheck and still be rejected at runtime. An
+  // explicit object emits `properties` + `required`, so generated types
+  // demand all five.
+  //
+  // `satisfies Record<ActionTaken, …>` keeps the link to the enum: adding an
+  // ActionTaken member is a COMPILE error here instead of silent drift.
+  // `.strict()` is load-bearing — it rejects an unknown action key, which a
+  // bare object would silently STRIP, accepting a miscounted map as valid.
+  byAction: external_exports.object({
+    warn: external_exports.number().int().min(0),
+    redact: external_exports.number().int().min(0),
+    block: external_exports.number().int().min(0),
+    allow: external_exports.number().int().min(0),
+    log: external_exports.number().int().min(0)
+  }).strict()
+}).meta({ id: "StorePosturePolicyCounts" });
+var StorePosturePlugin = external_exports.object({
+  /** Package name of the reporting plugin. */
+  package: external_exports.string().min(1).max(200),
+  version: external_exports.string().min(1).max(64),
+  /** Version of the bundled core, when the build records one separately. */
+  ossVersion: external_exports.string().max(64).nullable(),
   /**
-   * Partial: only Flag keys with non-zero counts are included.
-   * Strict: unknown keys are rejected — only Flag values are valid keys.
+   * `version` of the policy bundle this machine last fetched. Bounded at 200
+   * rather than the 64 a bare sha256 hex digest needs today, so a later
+   * format with an algorithm prefix does not start rejecting the channel.
    */
-  flagRollup: external_exports.object({
-    update: external_exports.number().int().nonnegative(),
-    stale: external_exports.number().int().nonnegative(),
-    conflict: external_exports.number().int().nonnegative(),
-    unknown: external_exports.number().int().nonnegative(),
-    change: external_exports.number().int().nonnegative(),
-    untracked: external_exports.number().int().nonnegative(),
-    risk: external_exports.number().int().nonnegative(),
-    findings: external_exports.number().int().nonnegative()
-  }).partial().strict(),
-  items: external_exports.array(AssetSummary)
-}).meta({ id: "AssetGroup" });
-var ListAssetsResponse = external_exports.object({ groups: external_exports.array(AssetGroup) }).meta({ id: "ListAssetsResponse" });
-var McpTool = external_exports.object({
-  name: external_exports.string(),
-  signature: external_exports.string(),
-  description: external_exports.string(),
-  write: external_exports.boolean(),
-  /** Non-null string when tool is dangerous / blocked; null otherwise. */
-  risk: external_exports.string().nullable()
-}).meta({ id: "McpTool" });
-var AssetFindingRef = external_exports.object({
-  id: external_exports.string(),
-  title: external_exports.string(),
-  note: external_exports.string()
-});
-var AssetDetail = AssetSummary.extend({
-  /** string | null — null when no description is available. */
-  description: external_exports.string().nullable(),
-  /** trustLevel | null — null for non-MCP assets. */
-  trust: TrustLevel.nullable(),
-  /** Type-specific raw key/values — FE renders the grid. */
-  meta: external_exports.record(external_exports.string(), external_exports.unknown()),
-  /** always present — object when there is an active finding, null when absent. */
-  finding: AssetFindingRef.nullable(),
-  /** MCP exposed-tools list — omitted for non-mcp. */
-  tools: external_exports.array(McpTool).optional()
-}).meta({ id: "AssetDetail" });
-var ListProjectsResponse = external_exports.object({ items: external_exports.array(ProjectSummary) }).meta({ id: "ListProjectsResponse" });
-var InventoryStats = external_exports.object({
-  /** Total assets/projects with ≥1 flag or finding (drives the attention header chip). */
-  attention: external_exports.number().int().nonnegative(),
-  byType: external_exports.object({
-    project: external_exports.number().int().nonnegative(),
-    skill: external_exports.number().int().nonnegative(),
-    mcp: external_exports.number().int().nonnegative(),
-    hook: external_exports.number().int().nonnegative(),
-    config: external_exports.number().int().nonnegative()
-  }),
-  harnesses: external_exports.number().int().nonnegative(),
-  mcpTrust: external_exports.object({
-    "known-good": external_exports.number().int().nonnegative(),
-    risky: external_exports.number().int().nonnegative(),
-    unapproved: external_exports.number().int().nonnegative()
-  })
-}).meta({ id: "InventoryStats" });
-var FileSummary = external_exports.object({
-  path: external_exports.string(),
-  name: external_exports.string(),
-  origin: Origin,
-  /** Effective access (override applied). */
-  access: AccessLevel,
-  /** True when a file_access_override differs from the computed default. */
-  isCustom: external_exports.boolean(),
-  findings: external_exports.number().int().nonnegative(),
-  /** When the file was auto-blocked by a detection; null when not blocked. */
-  blockedAt: external_exports.iso.datetime().nullable().optional(),
-  /** Why the file was blocked; null when absent. */
-  note: external_exports.string().nullable().optional()
-}).meta({ id: "FileSummary" });
-var FolderSummary = external_exports.object({
-  name: external_exports.string(),
-  path: external_exports.string(),
-  /** Rollup of effective access across all descendants. */
-  accessCounts: AccessCounts
-}).meta({ id: "FolderSummary" });
-var ProjectTreeResponse = external_exports.object({
-  project: external_exports.object({
-    id: external_exports.string(),
-    repo: external_exports.string(),
-    visibility: Visibility
-  }),
-  path: external_exports.string(),
-  /** Browse mode: one-level folders at the current path. Omitted in search mode. */
-  folders: external_exports.array(FolderSummary).optional(),
-  files: external_exports.array(FileSummary)
-}).meta({ id: "ProjectTreeResponse" });
-var FileDetail = FileSummary.extend({
-  project: external_exports.object({
-    repo: external_exports.string(),
-    visibility: Visibility,
-    language: external_exports.string(),
-    policyDefault: AccessLevel,
-    updatedAt: external_exports.iso.datetime()
-  }),
-  findingsRefs: external_exports.array(external_exports.object({ id: external_exports.string(), title: external_exports.string() }))
-}).meta({ id: "FileDetail" });
-var SetFileAccessBody = external_exports.object({
-  path: external_exports.string(),
-  access: AccessLevel
-}).meta({ id: "SetFileAccessBody" });
-var SetFileAccessResponse = external_exports.object({
-  file: FileSummary,
-  accessCounts: AccessCounts
-}).meta({ id: "SetFileAccessResponse" });
-var SetMcpTrustBody = external_exports.object({ trust: TrustLevel }).meta({ id: "SetMcpTrustBody" });
-var HarnessEventItem = external_exports.object({
-  kind: HarnessEventKind,
-  title: external_exports.string(),
-  detail: external_exports.string(),
-  occurredAt: external_exports.iso.datetime(),
-  findingId: external_exports.string().nullable().optional()
-}).meta({ id: "HarnessEventItem" });
-var HarnessEventsResponse = external_exports.object({
-  counts: external_exports.object({
-    block: external_exports.number().int().nonnegative(),
-    redact: external_exports.number().int().nonnegative(),
-    warn: external_exports.number().int().nonnegative()
-  }),
-  items: external_exports.array(HarnessEventItem)
-}).meta({ id: "HarnessEventsResponse" });
-var RescanResponse = external_exports.object({
-  jobId: external_exports.string(),
-  startedAt: external_exports.iso.datetime()
-}).meta({ id: "RescanResponse" });
-var ConnectProjectBody = external_exports.object({ repo: external_exports.string() }).meta({ id: "ConnectProjectBody" });
-var ListAssetsQuery = external_exports.object({
-  /** Filter by one or more AssetType values; absent means all types. */
-  type: external_exports.array(AssetType).optional(),
-  /** Free-text search term. */
-  q: external_exports.string().optional()
-});
-var GetProjectTreeQuery = external_exports.object({
-  /** Subtree root path; defaults to repository root when absent. */
-  path: external_exports.string().optional(),
-  /** Free-text filter applied to file paths. */
-  q: external_exports.string().optional(),
-  /**
-   * Special listing mode. `blocked` returns every effectively-blocked, auto-blocked
-   * file across the whole repo (folders omitted, most-recent first), ignoring
-   * `path`/`q` — powers the project-wide "recently blocked" strip.
-   */
-  filter: external_exports.enum(["blocked"]).optional()
+  policyBundleVersion: external_exports.string().max(200).nullable(),
+  /** Epoch millis, on the CLIENT clock, of that fetch. */
+  policyFetchedAt: external_exports.number().int().min(0).max(MAX_DATE_MS).nullable()
+}).meta({ id: "StorePosturePlugin" });
+var StorePostureSnapshot = external_exports.object({
+  deviceId: external_exports.guid(),
+  hostname: external_exports.string().min(1).max(253),
+  // Epoch millis on the CLIENT clock. Bounded by what a receiving store
+  // accepts (see MAX_DATE_MS), not by what a JavaScript Date can hold.
+  capturedAt: external_exports.number().int().min(0).max(MAX_DATE_MS),
+  // False is a measurement, not an error state: "no local store exists on
+  // this machine".
+  storePresent: external_exports.boolean(),
+  schemaVersion: external_exports.number().int().min(0).max(MAX_INT4).nullable(),
+  // PRAGMA user_version
+  findingsTotal: external_exports.number().int().min(0).max(MAX_INT4),
+  // Epoch millis, bounded like `capturedAt` — see MAX_DATE_MS on what that
+  // bound does and does not do. Worth stating for these two specifically:
+  // they are read from the local store's own ROWS rather than from this
+  // machine's clock, so a damaged or hand-edited store is enough to produce
+  // an out-of-range value with no clock skew involved.
+  findingsFirstAt: external_exports.number().int().min(0).max(MAX_DATE_MS).nullable(),
+  findingsLastAt: external_exports.number().int().min(0).max(MAX_DATE_MS).nullable(),
+  packs: external_exports.array(StorePosturePack).max(500),
+  policyCounts: StorePosturePolicyCounts,
+  // OPTIONAL, not nullable: a reporter that predates this member keeps
+  // getting its 200 without a payload change.
+  plugin: StorePosturePlugin.optional()
+}).meta({ id: "StorePostureSnapshot" });
+var CAPTURE_VERSION_PREFIX = "capture/";
+var RecordAuditEventRequest = AuditEventInput.extend({
+  inspections: external_exports.array(ToolCallInspection).default([])
+}).refine((v) => v.inspections.every((i) => !i.ruleVersion.startsWith(CAPTURE_VERSION_PREFIX)), {
+  message: `inspections[].ruleVersion must not start with \`${CAPTURE_VERSION_PREFIX}\` \u2014 that namespace is reserved for capture definitions the control plane mints itself`,
+  path: ["inspections"]
+}).meta({ id: "RecordAuditEventRequest" });
+var IngestAck = external_exports.object({
+  accepted: external_exports.number().int().nonnegative(),
+  duplicates: external_exports.number().int().nonnegative()
 });
-var GetProjectFileQuery = external_exports.object({
-  /** Repository-relative file path; absent or empty → 400. */
-  path: external_exports.string()
+var PRINTABLE = /^[^\p{Cc}\p{Cf}]*$/u;
+var printable = (max) => external_exports.string().max(max).regex(PRINTABLE, "must not contain control characters");
+var PluginWhoami = external_exports.object({
+  tenantName: printable(200),
+  userEmail: printable(320),
+  role: printable(64),
+  keyKind: printable(64),
+  serverTime: printable(64)
 });
-var GetHarnessEventsQuery = external_exports.object({
-  /** Maximum number of events to return.  Range: 1–50; default: 7. */
-  limit: external_exports.coerce.number().int().min(1).max(50).default(7)
+var ControlPlaneErrorBody = external_exports.object({
+  error: external_exports.object({
+    code: external_exports.string().optional(),
+    message: external_exports.string().optional()
+  }).optional()
 });
 
-// ../../packages/schema/src/zod/exception.ts
-var ExceptionScope = external_exports.enum(["once", "temporary", "permanent"]);
-var ExceptionConditions = external_exports.object({
-  repo: external_exports.string().optional(),
-  sourceTool: external_exports.string().optional(),
-  provider: external_exports.string().optional()
-}).strict();
-var ExceptionCapability = external_exports.enum(["suppress", "reveal_to_model"]);
-var DetectionException = external_exports.object({
-  id: external_exports.guid(),
-  ruleId: external_exports.string(),
-  // Denormalized from the rule, for reporting — never matched on.
-  category: DetectionCategory,
-  // HMAC-SHA256 hex of the raw match under a machine-local key: a KEYED
-  // fingerprint, never the raw value, and never reversible. Matching recomputes
-  // the fingerprint from a fresh capture; the value itself is never stored.
-  // Shape-constrained so a malformed — or accidentally raw — value is rejected
-  // at the boundary rather than persisted.
-  valueFingerprint: external_exports.string().regex(/^[0-9a-f]{64}$/),
-  // Version of the fingerprint key the grant was written under; a rotated key
-  // invalidates old grants rather than silently mismatching them.
-  keyVersion: external_exports.number().int().positive(),
-  // maskMatch() preview of the approved value — never the raw value.
-  maskedValue: external_exports.string(),
-  capability: ExceptionCapability.default("suppress"),
-  scope: ExceptionScope,
-  expiresAt: external_exports.iso.datetime().nullable(),
-  maxUses: external_exports.number().int().positive().nullable(),
-  useCount: external_exports.number().int().nonnegative(),
-  lastUsedAt: external_exports.iso.datetime().nullable(),
-  // Mandatory: every grant carries the human reason it exists.
-  justification: external_exports.string().min(1),
-  conditions: ExceptionConditions.nullable(),
-  createdBy: external_exports.string(),
-  createdVia: external_exports.enum(["cli-approve", "cli-add", "web-approve", "web-add", "api", "setup-triage"]),
-  createdAt: external_exports.iso.datetime(),
-  updatedAt: external_exports.iso.datetime(),
-  // Revocation is terminal and retained — consumed/expired/revoked rows are
-  // audit evidence; nothing in the exception lifecycle hard-deletes.
-  revokedAt: external_exports.iso.datetime().nullable(),
-  revokedBy: external_exports.string().nullable(),
-  revokeReason: external_exports.string().nullable()
-});
-var ExceptionBundleEntry = DetectionException.pick({
-  id: true,
-  ruleId: true,
-  valueFingerprint: true,
-  keyVersion: true,
-  capability: true,
-  expiresAt: true,
-  maxUses: true,
-  useCount: true,
-  conditions: true
-});
-var ExceptionDescriptor = DetectionException.omit({ valueFingerprint: true });
+// ../../packages/schema/src/zod/registry.ts
+var Namespace = external_exports.string().regex(/^[a-z][a-z0-9-]*$/);
+var PackId = external_exports.string().regex(/^[a-z][a-z0-9-]*$/);
+var SemVer = external_exports.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-.]+)?$/);
+var PublisherKind = external_exports.enum(["labs", "user", "org"]);
 
 // ../../packages/schema/src/zod/rule.ts
-var MatcherType = external_exports.enum(["keyword", "regex", "validator"]).meta({ id: "MatcherType" });
+var MatcherType = external_exports.enum(["keyword", "regex"]).meta({ id: "MatcherType" });
 var RuleProbeVerdict = external_exports.enum(["safe", "quarantined"]).meta({ id: "RuleProbeVerdict" });
-var KeywordMatcher = external_exports.object({
+var KeywordMatcher = external_exports.strictObject({
   type: external_exports.literal("keyword"),
   // An empty keyword matches at every position, yielding one zero-length span
   // per character. Rejected here because a keyword that matches everything is
@@ -16203,16 +16105,31 @@ function isValidRegex(pattern, flags) {
     return false;
   }
 }
+function probeFlags(flags) {
+  return flags.replace(/[gy]/g, "");
+}
 function matchesEmptyString(pattern, flags) {
   try {
-    const re = new RegExp(pattern, flags.replace(/[gy]/g, ""));
+    const re = new RegExp(pattern, probeFlags(flags));
     return re.exec("")?.[0].length === 0;
   } catch {
     return false;
   }
 }
+function spansWholeMatch(captureGroup) {
+  return captureGroup === void 0 || captureGroup === 0;
+}
+function captureGroupCount(pattern, flags) {
+  try {
+    const probe = new RegExp(`${pattern}|`, probeFlags(flags));
+    const result = probe.exec("");
+    return result ? result.length - 1 : void 0;
+  } catch {
+    return void 0;
+  }
+}
 var MAX_PATTERN_LENGTH = 2e3;
-var RegexMatcher = external_exports.object({
+var RegexMatcher = external_exports.strictObject({
   type: external_exports.literal("regex"),
   pattern: external_exports.string().min(1).max(MAX_PATTERN_LENGTH),
   flags: external_exports.string().default("gi"),
@@ -16220,28 +16137,47 @@ var RegexMatcher = external_exports.object({
 }).refine((v) => isValidRegex(v.pattern, v.flags), {
   message: "pattern/flags do not form a valid JavaScript regular expression",
   path: ["pattern"]
-}).refine((v) => v.captureGroup !== void 0 || !matchesEmptyString(v.pattern, v.flags), {
+}).refine((v) => !spansWholeMatch(v.captureGroup) || !matchesEmptyString(v.pattern, v.flags), {
   message: 'a whole-match regex that can match the empty string (e.g. "\\d*", "a?", "(?:)") can hang the matcher \u2014 scope the quantifier to a captureGroup, or require at least one character',
   path: ["pattern"]
+}).superRefine((v, ctx) => {
+  if (v.captureGroup === void 0) return;
+  const groups = captureGroupCount(v.pattern, v.flags);
+  if (groups === void 0 || v.captureGroup <= groups) return;
+  ctx.addIssue({
+    code: "custom",
+    path: ["captureGroup"],
+    message: `captureGroup ${String(v.captureGroup)} is out of range \u2014 the pattern declares ${String(groups)} capture group(s), so valid values are 0-${String(groups)}. An out-of-range group never matches, which would make the rule silently never fire.`
+  });
 });
-var ValidatorMatcher = external_exports.object({
-  type: external_exports.literal("validator"),
-  name: external_exports.enum(["luhn", "entropy", "ssn-checksum"]),
-  config: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
-});
-var Matcher = external_exports.discriminatedUnion("type", [KeywordMatcher, RegexMatcher, ValidatorMatcher]).meta({ id: "Matcher" });
-var AppliesTo = external_exports.object({
+var Matcher = external_exports.discriminatedUnion("type", [KeywordMatcher, RegexMatcher]).meta({ id: "Matcher" });
+var MATCHER_TYPES = MatcherType.options;
+var AppliesTo = external_exports.strictObject({
   // Dot-prefixed, e.g. ".py" — matches the scanner's SOURCE_EXTENSIONS shape.
   extensions: external_exports.array(external_exports.string().regex(/^\.[A-Za-z0-9]+$/)).min(1)
 }).meta({ id: "AppliesTo" });
-var PostValidatorRef = external_exports.union([
-  external_exports.string(),
-  external_exports.object({
-    name: external_exports.string(),
-    config: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
-  })
-]).meta({ id: "PostValidatorRef" });
-var RequiresNearby = external_exports.object({
+var PostValidatorName = external_exports.enum(["entropy", "luhn"]).meta({ id: "PostValidatorName" });
+var PostValidatorRef = external_exports.union(
+  [
+    PostValidatorName,
+    external_exports.strictObject({
+      name: PostValidatorName,
+      config: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
+    })
+  ],
+  {
+    // A union reports one collapsed issue for every way its arms can fail, so
+    // this has to describe the whole shape rather than just the name — it is
+    // what an author sees for a misspelled name AND for a stray key in the
+    // object form. The names come from the enum so the message cannot go
+    // stale. Without it Zod says only "Invalid input", which is precisely the
+    // no-feedback outcome this schema exists to remove.
+    error: () => `not a valid post-validator: use a bare name (${PostValidatorName.options.map((name) => JSON.stringify(name)).join(
+      " or "
+    )}) or { "name": ..., "config": { ... } }. An unrecognized name would be a false-positive guard that never runs.`
+  }
+).meta({ id: "PostValidatorRef" });
+var RequiresNearby = external_exports.strictObject({
   // Each array, when present, must be non-empty and contain non-empty strings —
   // an empty/blank criterion would either never fire or (for labels) match
   // everything.
@@ -16256,16 +16192,23 @@ var RequiresNearby = external_exports.object({
   (v) => (v.categories?.length ?? 0) + (v.ruleIds?.length ?? 0) + (v.labels?.length ?? 0) > 0,
   { message: "requiresNearby needs at least one of categories, ruleIds, or labels" }
 ).meta({ id: "RequiresNearby" });
-var RuleFixture = external_exports.object({
+var RuleFixture = external_exports.strictObject({
   label: external_exports.string(),
   text: external_exports.string().max(5e4),
   shouldMatch: external_exports.boolean(),
   // Simulated file context for the scan, so fixtures can assert `appliesTo`
   // gating (e.g. a Python-only pattern must NOT fire in a .ts file).
   filePath: external_exports.string().optional(),
-  expectedSpans: external_exports.array(external_exports.object({ start: external_exports.number(), end: external_exports.number() })).optional()
+  expectedSpans: external_exports.array(external_exports.strictObject({ start: external_exports.number(), end: external_exports.number() })).optional()
 }).meta({ id: "RuleFixture" });
-var Rule = external_exports.object({
+var Rule = external_exports.strictObject({
+  // A pinned literal over a STRICT object, and the two together decide how this
+  // format may grow. A rule carrying a key not listed below is refused with
+  // `unrecognized_keys`; a rule declaring `specVersion: 2` is refused with
+  // `invalid_value`. So the only additive path is adding an OPTIONAL field here
+  // — that keeps every rule authored before it valid — and a rule author has no
+  // way to introduce a field of their own or to opt into a later version.
+  // Widening the format means changing this literal and every consumer of it.
   specVersion: external_exports.literal(1),
   // `packId/ruleName` (e.g. `secrets/aws-access-key`). NOTE the first segment is
   // the PACK id, NOT a namespace — this is a DIFFERENT slug space from a
@@ -16301,406 +16244,350 @@ var PackManifest = external_exports.object({
   sourceUrl: external_exports.url().optional()
 }).meta({ id: "PackManifest" });
 
-// ../../packages/schema/src/zod/policy.ts
-var PolicyScope = external_exports.enum(["global", "repo", "user"]).meta({ id: "PolicyScope" });
-var PolicyTarget = external_exports.union([external_exports.object({ ruleId: external_exports.string() }), external_exports.object({ category: DetectionCategory })]).meta({ id: "PolicyTarget" });
-var Policy = external_exports.object({
-  id: external_exports.guid(),
-  scope: PolicyScope,
-  target: PolicyTarget,
-  action: ActionTaken,
-  enabled: external_exports.boolean().default(true),
-  customKeywords: external_exports.array(external_exports.string()).optional(),
-  // Display name — optional so older policy rows without name still parse.
-  // Added for the findings API (policy.name column migration).
-  name: external_exports.string().optional()
-}).meta({ id: "Policy" });
-var PolicyBundle = external_exports.object({
-  version: external_exports.string(),
-  policies: external_exports.array(Policy),
-  // Rules from the installed marketplace packs (snapshotted by the
-  // control plane). The plugin registers these in addition to its bundled
-  // packs. Optional so older backends — and older on-disk caches — that omit
-  // the field still parse; consumers read `bundle.rules ?? []`.
-  rules: external_exports.array(Rule).optional(),
-  // When true, `rules` IS the complete effective ruleset and the runtime must
-  // NOT merge its compiled-in bundled packs — the standalone gateway sets this
-  // after reading the user's installed snapshot (installed_packs, enabled
-  // packs only), which is how detection updates stay manual: new bundled
-  // rules run only after the user applies the pack update. Absent/false keeps
-  // the historical composition (bundled packs + rules) — older caches.
-  rulesComplete: external_exports.boolean().optional(),
-  // Active detection exceptions, evaluation subset only (see
-  // ExceptionBundleEntry). Optional so older bundle producers — and older
-  // on-disk caches — that omit the field still parse; consumers read
-  // `bundle.exceptions ?? []`.
-  exceptions: external_exports.array(ExceptionBundleEntry).optional(),
-  // Installed pack version, keyed by ruleId, for rules in `rules` that came
-  // from a versioned installed pack. Optional so older backends — and older
-  // on-disk caches — that omit the field still parse; consumers fall back to
-  // the rule's own spec version. NOT the bundle version above — see
-  // installedRuleset's ruleVersions for the source of truth.
-  ruleVersions: external_exports.record(external_exports.string(), external_exports.string()).optional(),
-  customKeywords: external_exports.array(external_exports.string()),
-  fetchedAt: external_exports.iso.datetime()
-}).meta({ id: "PolicyBundle" });
-var OBSERVE_ONLY_CATEGORIES = ["config"];
-var ENFORCEABLE_CATEGORIES = DetectionCategory.options.filter((c) => !OBSERVE_ONLY_CATEGORIES.includes(c));
-var CATEGORY_PEAK_SEVERITY = {
-  secret: "critical",
-  financial: "critical",
-  // core-financial/credit-card
-  code_flaw: "critical",
-  pii: "high",
-  phi: "high",
-  custom: "high",
-  // user-defined; conservative
-  code_context: "low",
-  config: "low"
-  // observe-only; floors to monitor regardless
-};
-function severityFloorPolicy(category) {
-  if (OBSERVE_ONLY_CATEGORIES.includes(category)) return "monitor";
-  const peak = CATEGORY_PEAK_SEVERITY[category];
-  return peak === "critical" || peak === "high" ? "warn" : "monitor";
-}
-var PolicyKind = external_exports.enum(["builtin", "custom"]).meta({ id: "PolicyKind" });
-var KNOWN_BUILTIN_IDS = ["monitor", "warn", "redact", "block"];
-var BuiltinPolicyId = external_exports.enum(KNOWN_BUILTIN_IDS).meta({ id: "BuiltinPolicyId" });
-var BUILTIN_POLICY_SPECS = {
-  monitor: {
-    name: "Monitor",
-    action: "log",
-    description: "Log every match for audit. The request is allowed through untouched."
-  },
-  warn: {
-    name: "Warn",
-    action: "warn",
-    description: "Allow the request, but warn the user inline before it is sent."
-  },
-  redact: {
-    name: "Redact",
-    action: "redact",
-    description: "Automatically strip the matched value from the request, then continue."
-  },
-  block: {
-    name: "Block",
-    action: "block",
-    description: "Refuse the request entirely whenever any rule in this detection matches."
-  }
-};
-function builtinPolicyToAction(id) {
-  return BUILTIN_POLICY_SPECS[id].action;
-}
-var DEFAULT_ACTIONS = Object.fromEntries(
-  DetectionCategory.options.map((c) => [c, builtinPolicyToAction(severityFloorPolicy(c))])
-);
-var BUILTIN_POLICIES = Object.fromEntries(
-  KNOWN_BUILTIN_IDS.map((id) => [id, { id, ...BUILTIN_POLICY_SPECS[id] }])
-);
-var UsedByItem = external_exports.object({
+// ../../packages/schema/src/zod/detection.ts
+var OriginEnum = external_exports.enum(["library"]).meta({ id: "OriginEnum" });
+var DetectionFilterEnum = external_exports.enum(["all", "library", "custom", "customized", "updates"]);
+var LibraryStateEnum = external_exports.enum(["new", "imported", "update"]).meta({ id: "LibraryStateEnum" });
+var DetectionCounts = external_exports.object({
+  all: external_exports.number().int().nonnegative(),
+  library: external_exports.number().int().nonnegative(),
+  custom: external_exports.number().int().nonnegative(),
+  customized: external_exports.number().int().nonnegative(),
+  updates: external_exports.number().int().nonnegative()
+}).meta({ id: "DetectionCounts" });
+var DetectionListItem = external_exports.object({
   id: external_exports.string(),
   name: external_exports.string(),
+  version: SemVer,
+  enabled: external_exports.boolean(),
+  origin: OriginEnum,
+  publisher: Namespace.optional(),
+  publisherKind: PublisherKind.optional(),
   ruleCount: external_exports.number().int().nonnegative(),
-  enabled: external_exports.boolean()
-}).meta({ id: "UsedByItem" });
-var PolicyListItem = external_exports.object({
+  namespace: Namespace,
+  packId: PackId,
+  // Per-pack enforcement-policy assignment. Holds a BuiltinPolicyId ARCHETYPE
+  // (monitor|warn|redact|block) — NOT a policies-table Policy.id guid; a
+  // detection is a PACK, and its policy is the archetype applied to all its
+  // rules. Absent == unassigned, which resolves to Monitor everywhere
+  // (DEFAULT_PACK_POLICY_ID). Every enforcement surface expands it into
+  // per-rule policies (see policyIdToAction). Typed z.string() (not
+  // the enum) to keep the OpenAPI response tolerant of a future custom id.
+  policyId: external_exports.string().optional(),
+  // Set ONLY when a newer snapshot is available for this pack (OSS: the
+  // bundled inventory recorded in available_packs differs from the installed
+  // row). Absent == up to date or unknown. Powers the list's per-row update
+  // badge and the `updates` filter/count without a per-item detail read.
+  latestVersion: SemVer.optional()
+}).meta({ id: "DetectionListItem" });
+var ListDetectionsResponse = external_exports.object({
+  counts: DetectionCounts,
+  items: external_exports.array(DetectionListItem)
+}).meta({ id: "ListDetectionsResponse" });
+var ListDetectionsQuery = external_exports.object({
+  filter: DetectionFilterEnum.optional().default("all"),
+  q: external_exports.string().optional()
+});
+var DetectionStats = external_exports.object({
+  detections: external_exports.number().int().nonnegative(),
+  rules: external_exports.number().int().nonnegative(),
+  active: external_exports.number().int().nonnegative(),
+  findingsLast30d: external_exports.number().int().nonnegative()
+}).meta({ id: "DetectionStats" });
+var DetectionRule = external_exports.object({
   id: external_exports.string(),
-  kind: PolicyKind,
   name: external_exports.string(),
-  enabled: external_exports.boolean(),
-  usedByCount: external_exports.number().int().nonnegative()
-}).meta({ id: "PolicyListItem" });
-var PolicyDetail = external_exports.object({
-  specVersion: external_exports.literal(1),
+  category: DetectionCategory,
+  severity: Severity,
+  matcher: Matcher
+}).meta({ id: "DetectionRule" });
+var DetectionUpdate = external_exports.object({
+  available: external_exports.boolean(),
+  latestVersion: SemVer,
+  // Rule count of the latest snapshot. Lets the update UI show a meaningful
+  // delta ("2 rules → 14 rules") when the version did NOT change but the rule
+  // content did — the OSS store compares content, not just version. Optional:
+  // registry-backed updates omit it.
+  latestRuleCount: external_exports.number().int().nonnegative().optional()
+}).nullable().meta({ id: "DetectionUpdate" });
+var DetectionDetail = external_exports.object({
   id: external_exports.string(),
-  kind: PolicyKind,
   name: external_exports.string(),
+  version: SemVer,
   enabled: external_exports.boolean(),
-  description: external_exports.string(),
-  usedBy: external_exports.array(UsedByItem)
-}).meta({ id: "PolicyDetail" });
-var PolicyStatsResponse = external_exports.object({
-  policies: external_exports.number().int().nonnegative(),
-  builtin: external_exports.number().int().nonnegative(),
-  custom: external_exports.number().int().nonnegative(),
-  detectionsGoverned: external_exports.number().int().nonnegative()
-}).meta({ id: "PolicyStatsResponse" });
-
-// ../../packages/schema/src/zod/api.ts
-var LIST_QUERY_MAX_LIMIT = 200;
-var ListEventsQuery = external_exports.object({
-  cursor: external_exports.string().optional(),
-  limit: external_exports.coerce.number().int().min(1).max(LIST_QUERY_MAX_LIMIT).default(50),
-  sourceTool: external_exports.string().optional(),
-  kind: external_exports.string().optional(),
-  from: external_exports.iso.datetime().optional(),
-  to: external_exports.iso.datetime().optional()
-});
-var ListEventsResponse = external_exports.object({
-  items: external_exports.array(Event),
-  nextCursor: external_exports.string().nullable()
-}).meta({ id: "ListEventsResponse" });
-var IngestResponse = external_exports.object({
-  accepted: external_exports.number().int().nonnegative(),
-  duplicates: external_exports.number().int().nonnegative()
-}).meta({ id: "IngestResponse" });
-var ListFindingsQuery = external_exports.object({
-  cursor: external_exports.string().optional(),
-  limit: external_exports.coerce.number().int().min(1).max(LIST_QUERY_MAX_LIMIT).default(50),
-  severity: external_exports.string().optional(),
-  category: external_exports.string().optional(),
-  eventId: external_exports.guid().optional()
-});
-var ListFindingsResponse = external_exports.object({
-  items: external_exports.array(Finding),
-  nextCursor: external_exports.string().nullable()
-}).meta({ id: "ListFindingsResponse" });
-var ListPoliciesResponse = external_exports.object({ items: external_exports.array(PolicyListItem) }).meta({ id: "ListPoliciesResponse" });
-var CreatePolicyRequest = Policy.omit({ id: true }).meta({
-  id: "CreatePolicyRequest"
-});
-var UpdatePolicyRequest = Policy.partial().required({ id: true }).meta({ id: "UpdatePolicyRequest" });
-var RecordAuditEventResponse = external_exports.object({ accepted: external_exports.boolean() }).meta({ id: "RecordAuditEventResponse" });
-var ErrorResponse = external_exports.object({
-  error: external_exports.object({
-    code: external_exports.string(),
-    message: external_exports.string(),
-    details: external_exports.unknown().optional()
+  origin: OriginEnum,
+  publisher: Namespace.optional(),
+  publisherKind: PublisherKind.optional(),
+  ruleCount: external_exports.number().int().nonnegative(),
+  namespace: Namespace,
+  packId: PackId,
+  description: external_exports.string().optional(),
+  editedAt: external_exports.iso.datetime(),
+  findingsLast30d: external_exports.number().int().nonnegative(),
+  latestVersion: SemVer.nullable().optional(),
+  update: DetectionUpdate,
+  rules: external_exports.array(DetectionRule),
+  modified: external_exports.boolean(),
+  // Per-pack enforcement-policy assignment. Holds a BuiltinPolicyId ARCHETYPE
+  // (monitor|warn|redact|block) — NOT a policies-table Policy.id guid; a
+  // detection is a PACK, and its policy is the archetype applied to all its
+  // rules. Absent == unassigned, which resolves to Monitor everywhere
+  // (DEFAULT_PACK_POLICY_ID). Every enforcement surface expands it into
+  // per-rule policies (see policyIdToAction). Typed z.string() (not
+  // the enum) to keep the OpenAPI response tolerant of a future custom id.
+  policyId: external_exports.string().optional()
+}).meta({ id: "DetectionDetail" });
+var LibraryItem = external_exports.object({
+  id: external_exports.string(),
+  name: external_exports.string(),
+  publisher: Namespace,
+  publisherKind: PublisherKind.optional(),
+  // LOSSY single-category view of a pack. A pack MAY span several categories;
+  // this carries only the canonical-first one for display. Do NOT filter/facet
+  // on it — the library filter matches a pack's full category set (see
+  // ListLibraryResponse.categories).
+  category: DetectionCategory.optional(),
+  version: SemVer,
+  ruleCount: external_exports.number().int().nonnegative(),
+  description: external_exports.string().optional(),
+  updatedAt: external_exports.iso.datetime(),
+  state: LibraryStateEnum,
+  importedAs: external_exports.string().nullable()
+}).meta({ id: "LibraryItem" });
+var ListLibraryResponse = external_exports.object({
+  categories: external_exports.array(DetectionCategory),
+  items: external_exports.array(LibraryItem)
+}).meta({ id: "ListLibraryResponse" });
+var ImportDetectionRequest = external_exports.object({
+  libraryId: external_exports.string().refine((v) => /^[^/]+\/[^/]+$/.test(v), {
+    message: "libraryId must be in namespace/packId format"
   })
-}).meta({ id: "ErrorResponse" });
+}).meta({ id: "ImportDetectionRequest" });
 
-// ../../packages/schema/src/zod/config-inventory.ts
-var ConfigScope = external_exports.enum(["user", "project", "local", "plugin"]);
-var SkillScanEntry = external_exports.object({
-  name: external_exports.string().min(1),
-  // The identity source: a marketplace repo for plugin skills (e.g.
-  // 'anthropics/skills'), 'local' for personal ~/.claude/skills, or
-  // 'project:<repo-identity>' for checked-in project skills. The surrogate keeps
-  // a personal skill named 'pdf' from colliding with the marketplace 'pdf'.
-  source: external_exports.string().min(1),
-  scope: ConfigScope,
-  pluginName: external_exports.string().optional(),
-  // Volatile — rides the attribute bag, never the identity hash.
-  version: external_exports.string().optional(),
-  description: external_exports.string().optional(),
-  // Skill directory mtime (ISO) — the "updated Nd ago" freshness signal.
-  updatedAt: external_exports.iso.datetime().optional(),
-  // Filesystem path — the promoted inventory `location` column.
-  location: external_exports.string().optional()
-});
-var HookScanEntry = external_exports.object({
-  // Hook event name (PreToolUse, PostToolUse, …). Open string, not an enum: the
-  // set is harness-defined and grows without a schema change.
-  event: external_exports.string().min(1),
-  // The tool matcher ('Bash', 'Edit|Write', …). Absent = matches all tools.
-  matcher: external_exports.string().optional(),
-  command: external_exports.string().min(1),
-  timeout: external_exports.number().optional(),
-  scope: ConfigScope,
-  pluginName: external_exports.string().optional(),
-  // The settings file / hooks.json the entry came from.
-  location: external_exports.string().optional()
+// ../../packages/schema/src/zod/inventory.ts
+var AssetType = external_exports.enum(["project", "skill", "mcp", "hook", "config"]).meta({ id: "AssetType" });
+var AccessLevel = external_exports.enum(["open", "approved", "blocked"]).meta({ id: "AccessLevel" });
+var Origin = external_exports.enum(["source", "public-dep", "vendored", "config", "data", "docs", "generated"]).meta({ id: "Origin" });
+var TrustLevel = external_exports.enum(["known-good", "risky", "unapproved"]).meta({ id: "TrustLevel" });
+var Flag = external_exports.enum(["update", "stale", "conflict", "unknown", "change", "untracked", "risk", "findings"]).meta({ id: "Flag" });
+var Visibility = external_exports.enum(["public", "private"]).meta({ id: "Visibility" });
+var HarnessEventKind = external_exports.enum(["block", "redact", "warn"]).meta({ id: "HarnessEventKind" });
+var HarnessId = Harness.extract(["ClaudeCode", "Cursor", "Codex", "Antigravity"]).meta({
+  id: "HarnessId"
 });
-var McpServerScanEntry = external_exports.object({
-  // The server's config key ("github", "filesystem", …) — identity, with the
-  // qualified scope (see mcpServerIdentityKey).
-  name: external_exports.string().min(1),
-  scope: ConfigScope,
-  pluginName: external_exports.string().optional(),
-  // The owning plugin's marketplace — part of PLUGIN-scope identity: two
-  // marketplaces can each ship a plugin named `guard`, and without this their
-  // same-named servers would collapse to one row (the second silently dropped,
-  // inheriting the first's trust).
-  marketplace: external_exports.string().optional(),
-  // The repo identity (remote url, or the cwd for un-remoted repos) — part of
-  // PROJECT/LOCAL-scope identity: a server named `github` in repo A and one in
-  // repo B are different servers with different commands, and MUST NOT share a
-  // row — a shared row would let a cloned repo's .mcp.json inherit the trust
-  // the user granted elsewhere.
-  project: external_exports.string().optional(),
-  // 'stdio' when the entry carries a command; otherwise the config's `type`
-  // ('http' / 'sse' / …). Open string — the transport set is harness-defined.
-  transport: external_exports.string().min(1),
-  // Volatile on purpose (unlike hook `command`): a changed command/url is drift
-  // on a stable row — visible across config_scan snapshots and preserving the
-  // user's trust decision — never a quiet new row. One of the two is present.
-  // Secret-masked at collection time (the scanner runs the bundled detection
-  // packs over both — tokens routinely ride command args and URLs).
-  command: external_exports.string().optional(),
-  url: external_exports.string().optional(),
-  // Env var NAMES only, never values (the no-secrets rule).
-  envKeys: external_exports.array(external_exports.string()).optional(),
-  // The config file the entry came from.
-  location: external_exports.string().optional()
+var AccessCounts = external_exports.object({
+  open: external_exports.number().int().nonnegative(),
+  approved: external_exports.number().int().nonnegative(),
+  blocked: external_exports.number().int().nonnegative(),
+  total: external_exports.number().int().nonnegative()
+}).meta({ id: "AccessCounts" });
+var AssetSummary = external_exports.object({
+  id: external_exports.string(),
+  type: AssetType,
+  name: external_exports.string(),
+  sub: external_exports.string(),
+  flags: external_exports.array(Flag),
+  /** MCP servers only — omitted for all other types. */
+  trust: TrustLevel.optional()
+}).meta({ id: "AssetSummary" });
+var ProjectSummary = external_exports.object({
+  id: external_exports.string(),
+  name: external_exports.string(),
+  repo: external_exports.string(),
+  visibility: Visibility,
+  language: external_exports.string(),
+  policyDefault: AccessLevel,
+  updatedAt: external_exports.iso.datetime(),
+  accessCounts: AccessCounts,
+  findingsCount: external_exports.number().int().nonnegative()
+}).meta({ id: "ProjectSummary" });
+var HarnessCategory = external_exports.object({
+  /** One of config/skill/mcp/hook — never project (enforced at service layer). */
+  type: AssetType,
+  assets: external_exports.array(AssetSummary)
 });
-var ConfigFileScanEntry = external_exports.object({
-  // Basename (settings.json, CLAUDE.md) or dir name (commands/, agents/).
-  name: external_exports.string().min(1),
-  // The absolute path — identity (with scope) and the promoted `location`.
-  path: external_exports.string().min(1),
-  scope: ConfigScope,
-  // Human label: "User settings", "Project memory", "Slash commands", …
-  kind: external_exports.string().min(1),
-  // Derived SHAPE summary — top-level key names, entry counts, line counts.
-  // Never file content or values (memory files can carry sensitive detail).
-  detail: external_exports.string().optional(),
-  // Dir configs (commands/, agents/) and .mcp.json: how many entries.
-  entryCount: external_exports.number().optional(),
-  // File mtime (ISO) — the freshness signal.
-  updatedAt: external_exports.iso.datetime().optional()
+var HarnessSummary = external_exports.object({
+  id: HarnessId,
+  label: external_exports.string(),
+  kind: external_exports.string(),
+  version: external_exports.string(),
+  sessions: external_exports.number().int().nonnegative(),
+  assetCount: external_exports.number().int().nonnegative(),
+  flagCount: external_exports.number().int().nonnegative(),
+  projects: external_exports.array(ProjectSummary),
+  categories: external_exports.array(HarnessCategory)
+}).meta({ id: "HarnessSummary" });
+var ListHarnessesResponse = external_exports.object({ items: external_exports.array(HarnessSummary) }).meta({ id: "ListHarnessesResponse" });
+var AssetGroup = external_exports.object({
+  /** Group key — never project (enforced at service layer). */
+  type: AssetType,
+  total: external_exports.number().int().nonnegative(),
+  /**
+   * MCP group only — omitted for all other types.
+   * Partial: only TrustLevel keys with non-zero counts are included.
+   * Strict: unknown keys are rejected — only TrustLevel values are valid keys.
+   */
+  trustRollup: external_exports.object({
+    "known-good": external_exports.number().int().nonnegative(),
+    risky: external_exports.number().int().nonnegative(),
+    unapproved: external_exports.number().int().nonnegative()
+  }).partial().strict().optional(),
+  /**
+   * Partial: only Flag keys with non-zero counts are included.
+   * Strict: unknown keys are rejected — only Flag values are valid keys.
+   */
+  flagRollup: external_exports.object({
+    update: external_exports.number().int().nonnegative(),
+    stale: external_exports.number().int().nonnegative(),
+    conflict: external_exports.number().int().nonnegative(),
+    unknown: external_exports.number().int().nonnegative(),
+    change: external_exports.number().int().nonnegative(),
+    untracked: external_exports.number().int().nonnegative(),
+    risk: external_exports.number().int().nonnegative(),
+    findings: external_exports.number().int().nonnegative()
+  }).partial().strict(),
+  items: external_exports.array(AssetSummary)
+}).meta({ id: "AssetGroup" });
+var ListAssetsResponse = external_exports.object({ groups: external_exports.array(AssetGroup) }).meta({ id: "ListAssetsResponse" });
+var McpTool = external_exports.object({
+  name: external_exports.string(),
+  signature: external_exports.string(),
+  description: external_exports.string(),
+  write: external_exports.boolean(),
+  /** Non-null string when tool is dangerous / blocked; null otherwise. */
+  risk: external_exports.string().nullable()
+}).meta({ id: "McpTool" });
+var AssetFindingRef = external_exports.object({
+  id: external_exports.string(),
+  title: external_exports.string(),
+  note: external_exports.string()
 });
-var ConfigScanResult = external_exports.object({
-  scannedAt: external_exports.iso.datetime(),
-  skills: external_exports.array(SkillScanEntry),
-  hooks: external_exports.array(HookScanEntry),
-  mcpServers: external_exports.array(McpServerScanEntry),
-  configFiles: external_exports.array(ConfigFileScanEntry),
-  errors: external_exports.array(external_exports.object({ source: external_exports.string(), reason: external_exports.string() }))
+var AssetDetail = AssetSummary.extend({
+  /** string | null — null when no description is available. */
+  description: external_exports.string().nullable(),
+  /** trustLevel | null — null for non-MCP assets. */
+  trust: TrustLevel.nullable(),
+  /** Type-specific raw key/values — FE renders the grid. */
+  meta: external_exports.record(external_exports.string(), external_exports.unknown()),
+  /** always present — object when there is an active finding, null when absent. */
+  finding: AssetFindingRef.nullable(),
+  /** MCP exposed-tools list — omitted for non-mcp. */
+  tools: external_exports.array(McpTool).optional()
+}).meta({ id: "AssetDetail" });
+var ListProjectsResponse = external_exports.object({ items: external_exports.array(ProjectSummary) }).meta({ id: "ListProjectsResponse" });
+var InventoryStats = external_exports.object({
+  /** Total assets/projects with ≥1 flag or finding (drives the attention header chip). */
+  attention: external_exports.number().int().nonnegative(),
+  byType: external_exports.object({
+    project: external_exports.number().int().nonnegative(),
+    skill: external_exports.number().int().nonnegative(),
+    mcp: external_exports.number().int().nonnegative(),
+    hook: external_exports.number().int().nonnegative(),
+    config: external_exports.number().int().nonnegative()
+  }),
+  harnesses: external_exports.number().int().nonnegative(),
+  mcpTrust: external_exports.object({
+    "known-good": external_exports.number().int().nonnegative(),
+    risky: external_exports.number().int().nonnegative(),
+    unapproved: external_exports.number().int().nonnegative()
+  })
+}).meta({ id: "InventoryStats" });
+var FileSummary = external_exports.object({
+  path: external_exports.string(),
+  name: external_exports.string(),
+  origin: Origin,
+  /** Effective access (override applied). */
+  access: AccessLevel,
+  /** True when a file_access_override differs from the computed default. */
+  isCustom: external_exports.boolean(),
+  findings: external_exports.number().int().nonnegative(),
+  /** When the file was auto-blocked by a detection; null when not blocked. */
+  blockedAt: external_exports.iso.datetime().nullable().optional(),
+  /** Why the file was blocked; null when absent. */
+  note: external_exports.string().nullable().optional()
+}).meta({ id: "FileSummary" });
+var FolderSummary = external_exports.object({
+  name: external_exports.string(),
+  path: external_exports.string(),
+  /** Rollup of effective access across all descendants. */
+  accessCounts: AccessCounts
+}).meta({ id: "FolderSummary" });
+var ProjectTreeResponse = external_exports.object({
+  project: external_exports.object({
+    id: external_exports.string(),
+    repo: external_exports.string(),
+    visibility: Visibility
+  }),
+  path: external_exports.string(),
+  /** Browse mode: one-level folders at the current path. Omitted in search mode. */
+  folders: external_exports.array(FolderSummary).optional(),
+  files: external_exports.array(FileSummary)
+}).meta({ id: "ProjectTreeResponse" });
+var FileDetail = FileSummary.extend({
+  project: external_exports.object({
+    repo: external_exports.string(),
+    visibility: Visibility,
+    language: external_exports.string(),
+    policyDefault: AccessLevel,
+    updatedAt: external_exports.iso.datetime()
+  }),
+  findingsRefs: external_exports.array(external_exports.object({ id: external_exports.string(), title: external_exports.string() }))
+}).meta({ id: "FileDetail" });
+var SetFileAccessBody = external_exports.object({
+  path: external_exports.string(),
+  access: AccessLevel
+}).meta({ id: "SetFileAccessBody" });
+var SetFileAccessResponse = external_exports.object({
+  file: FileSummary,
+  accessCounts: AccessCounts
+}).meta({ id: "SetFileAccessResponse" });
+var SetMcpTrustBody = external_exports.object({ trust: TrustLevel }).meta({ id: "SetMcpTrustBody" });
+var HarnessEventItem = external_exports.object({
+  kind: HarnessEventKind,
+  title: external_exports.string(),
+  detail: external_exports.string(),
+  occurredAt: external_exports.iso.datetime(),
+  findingId: external_exports.string().nullable().optional()
+}).meta({ id: "HarnessEventItem" });
+var HarnessEventsResponse = external_exports.object({
+  counts: external_exports.object({
+    block: external_exports.number().int().nonnegative(),
+    redact: external_exports.number().int().nonnegative(),
+    warn: external_exports.number().int().nonnegative()
+  }),
+  items: external_exports.array(HarnessEventItem)
+}).meta({ id: "HarnessEventsResponse" });
+var RescanResponse = external_exports.object({
+  jobId: external_exports.string(),
+  startedAt: external_exports.iso.datetime()
+}).meta({ id: "RescanResponse" });
+var ConnectProjectBody = external_exports.object({ repo: external_exports.string() }).meta({ id: "ConnectProjectBody" });
+var ListAssetsQuery = external_exports.object({
+  /** Filter by one or more AssetType values; absent means all types. */
+  type: external_exports.array(AssetType).optional(),
+  /** Free-text search term. */
+  q: external_exports.string().optional()
 });
-var ConfigPostureFindingInput = external_exports.object({
-  ruleId: external_exports.string().min(1),
-  version: external_exports.string().min(1),
-  span: Span,
-  // For posture rules this is the offending COMMAND (config the user already
-  // holds locally, not captured secret content) — it is also the correlation
-  // key the read surface matches back to a hook row.
-  maskedMatch: external_exports.string(),
-  actionTaken: ActionTaken,
-  confidence: external_exports.number().min(0).max(1)
+var GetProjectTreeQuery = external_exports.object({
+  /** Subtree root path; defaults to repository root when absent. */
+  path: external_exports.string().optional(),
+  /** Free-text filter applied to file paths. */
+  q: external_exports.string().optional(),
+  /**
+   * Special listing mode. `blocked` returns every effectively-blocked, auto-blocked
+   * file across the whole repo (folders omitted, most-recent first), ignoring
+   * `path`/`q` — powers the project-wide "recently blocked" strip.
+   */
+  filter: external_exports.enum(["blocked"]).optional()
 });
-var ConfigScanRecord = external_exports.object({
-  items: external_exports.array(InventoryInput),
-  scanEvent: AuditEventInput,
-  definitions: external_exports.array(InspectionDefinitionInput).optional(),
-  findings: external_exports.array(ConfigPostureFindingInput).optional()
+var GetProjectFileQuery = external_exports.object({
+  /** Repository-relative file path; absent or empty → 400. */
+  path: external_exports.string()
 });
-
-// ../../packages/schema/src/zod/registry.ts
-var Namespace = external_exports.string().regex(/^[a-z][a-z0-9-]*$/);
-var PackId = external_exports.string().regex(/^[a-z][a-z0-9-]*$/);
-var SemVer = external_exports.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-.]+)?$/);
-var PublisherKind = external_exports.enum(["labs", "user", "org"]);
-
-// ../../packages/schema/src/zod/detection.ts
-var OriginEnum = external_exports.enum(["library"]).meta({ id: "OriginEnum" });
-var DetectionFilterEnum = external_exports.enum(["all", "library", "custom", "customized", "updates"]);
-var LibraryStateEnum = external_exports.enum(["new", "imported", "update"]).meta({ id: "LibraryStateEnum" });
-var DetectionCounts = external_exports.object({
-  all: external_exports.number().int().nonnegative(),
-  library: external_exports.number().int().nonnegative(),
-  custom: external_exports.number().int().nonnegative(),
-  customized: external_exports.number().int().nonnegative(),
-  updates: external_exports.number().int().nonnegative()
-}).meta({ id: "DetectionCounts" });
-var DetectionListItem = external_exports.object({
-  id: external_exports.string(),
-  name: external_exports.string(),
-  version: SemVer,
-  enabled: external_exports.boolean(),
-  origin: OriginEnum,
-  publisher: Namespace.optional(),
-  publisherKind: PublisherKind.optional(),
-  ruleCount: external_exports.number().int().nonnegative(),
-  namespace: Namespace,
-  packId: PackId,
-  // Per-pack enforcement-policy assignment. Holds a BuiltinPolicyId ARCHETYPE
-  // (monitor|warn|redact|block) — NOT a policies-table Policy.id guid; a
-  // detection is a PACK, and its policy is the archetype applied to all its
-  // rules. Absent == unassigned, which resolves to Monitor everywhere
-  // (DEFAULT_PACK_POLICY_ID). Every enforcement surface expands it into
-  // per-rule policies (see policyIdToAction). Typed z.string() (not
-  // the enum) to keep the OpenAPI response tolerant of a future custom id.
-  policyId: external_exports.string().optional(),
-  // Set ONLY when a newer snapshot is available for this pack (OSS: the
-  // bundled inventory recorded in available_packs differs from the installed
-  // row). Absent == up to date or unknown. Powers the list's per-row update
-  // badge and the `updates` filter/count without a per-item detail read.
-  latestVersion: SemVer.optional()
-}).meta({ id: "DetectionListItem" });
-var ListDetectionsResponse = external_exports.object({
-  counts: DetectionCounts,
-  items: external_exports.array(DetectionListItem)
-}).meta({ id: "ListDetectionsResponse" });
-var ListDetectionsQuery = external_exports.object({
-  filter: DetectionFilterEnum.optional().default("all"),
-  q: external_exports.string().optional()
+var GetHarnessEventsQuery = external_exports.object({
+  /** Maximum number of events to return.  Range: 1–50; default: 7. */
+  limit: external_exports.coerce.number().int().min(1).max(50).default(7)
 });
-var DetectionStats = external_exports.object({
-  detections: external_exports.number().int().nonnegative(),
-  rules: external_exports.number().int().nonnegative(),
-  active: external_exports.number().int().nonnegative(),
-  findingsLast30d: external_exports.number().int().nonnegative()
-}).meta({ id: "DetectionStats" });
-var DetectionRule = external_exports.object({
-  id: external_exports.string(),
-  name: external_exports.string(),
-  category: DetectionCategory,
-  severity: Severity,
-  matcher: Matcher
-}).meta({ id: "DetectionRule" });
-var DetectionUpdate = external_exports.object({
-  available: external_exports.boolean(),
-  latestVersion: SemVer,
-  // Rule count of the latest snapshot. Lets the update UI show a meaningful
-  // delta ("2 rules → 14 rules") when the version did NOT change but the rule
-  // content did — the OSS store compares content, not just version. Optional:
-  // registry-backed updates omit it.
-  latestRuleCount: external_exports.number().int().nonnegative().optional()
-}).nullable().meta({ id: "DetectionUpdate" });
-var DetectionDetail = external_exports.object({
-  id: external_exports.string(),
-  name: external_exports.string(),
-  version: SemVer,
-  enabled: external_exports.boolean(),
-  origin: OriginEnum,
-  publisher: Namespace.optional(),
-  publisherKind: PublisherKind.optional(),
-  ruleCount: external_exports.number().int().nonnegative(),
-  namespace: Namespace,
-  packId: PackId,
-  description: external_exports.string().optional(),
-  editedAt: external_exports.iso.datetime(),
-  findingsLast30d: external_exports.number().int().nonnegative(),
-  latestVersion: SemVer.nullable().optional(),
-  update: DetectionUpdate,
-  rules: external_exports.array(DetectionRule),
-  modified: external_exports.boolean(),
-  // Per-pack enforcement-policy assignment. Holds a BuiltinPolicyId ARCHETYPE
-  // (monitor|warn|redact|block) — NOT a policies-table Policy.id guid; a
-  // detection is a PACK, and its policy is the archetype applied to all its
-  // rules. Absent == unassigned, which resolves to Monitor everywhere
-  // (DEFAULT_PACK_POLICY_ID). Every enforcement surface expands it into
-  // per-rule policies (see policyIdToAction). Typed z.string() (not
-  // the enum) to keep the OpenAPI response tolerant of a future custom id.
-  policyId: external_exports.string().optional()
-}).meta({ id: "DetectionDetail" });
-var LibraryItem = external_exports.object({
-  id: external_exports.string(),
-  name: external_exports.string(),
-  publisher: Namespace,
-  publisherKind: PublisherKind.optional(),
-  // LOSSY single-category view of a pack. A pack MAY span several categories;
-  // this carries only the canonical-first one for display. Do NOT filter/facet
-  // on it — the library filter matches a pack's full category set (see
-  // ListLibraryResponse.categories).
-  category: DetectionCategory.optional(),
-  version: SemVer,
-  ruleCount: external_exports.number().int().nonnegative(),
-  description: external_exports.string().optional(),
-  updatedAt: external_exports.iso.datetime(),
-  state: LibraryStateEnum,
-  importedAs: external_exports.string().nullable()
-}).meta({ id: "LibraryItem" });
-var ListLibraryResponse = external_exports.object({
-  categories: external_exports.array(DetectionCategory),
-  items: external_exports.array(LibraryItem)
-}).meta({ id: "ListLibraryResponse" });
-var ImportDetectionRequest = external_exports.object({
-  libraryId: external_exports.string().refine((v) => /^[^/]+\/[^/]+$/.test(v), {
-    message: "libraryId must be in namespace/packId format"
-  })
-}).meta({ id: "ImportDetectionRequest" });
 
 // ../../packages/schema/src/zod/shares.ts
 var DestinationKind = external_exports.enum(["provider", "internal", "external", "ip"]).meta({ id: "DestinationKind" });
@@ -16908,6 +16795,127 @@ var EgressWriteSummary = external_exports.object({
   droppedFiles: external_exports.array(external_exports.string()).default([])
 }).meta({ id: "EgressWriteSummary" });
 
+// ../../packages/schema/src/zod/event.ts
+var EventKind = external_exports.enum(["prompt", "response", "code_change", "tool_use"]).meta({ id: "EventKind" });
+var CAPTURE_EVENT_TYPES_SQL = EventKind.options.map((k) => `'${k}'`).join(",");
+var EventMetadata = external_exports.object({
+  sessionId: external_exports.string().optional(),
+  repo: external_exports.string().optional(),
+  filePath: external_exports.string().optional(),
+  // The host tool whose input/output was scanned (e.g. 'Bash', 'WebFetch'),
+  // set by the tool-scanning hooks. The tool NAME only — never the tool's
+  // arguments or output, which can carry the very value a finding masked
+  // (metadata is stored unredacted). Gives findings on non-file captures a
+  // display location ("via Bash") when no filePath exists.
+  toolName: external_exports.string().optional(),
+  // Set (true) by the worktree scanner when the file is excluded by the
+  // repo's .gitignore. Gitignored files ARE still scanned — local scratch and
+  // generated code can leak real secrets — but the provenance is recorded so
+  // policy/dashboards can treat those findings as informational rather than
+  // blocking. Omitted (not false) for tracked files and non-scan events.
+  gitignored: external_exports.boolean().optional(),
+  // Set (true) ONLY when the event's `content` is the COMPLETE file at
+  // capture time (a worktree scan reading from disk). Hook-captured edits
+  // (e.g. an Edit tool's new_string) are partial fragments and MUST NOT set
+  // this. The resolver-on-ingest keys its fixed-at-source dropout
+  // diff on this marker: only a whole-file snapshot can prove a previously
+  // open finding is gone; a fragment's absence proves nothing (the secret
+  // may live outside the hunk). Omitted (not false) for fragments and
+  // non-scan events, so pre-marker clients safely default to the
+  // non-authoritative path.
+  wholeFile: external_exports.boolean().optional(),
+  model: external_exports.string().optional(),
+  turnIndex: external_exports.number().int().nonnegative().optional(),
+  // Distributed-tracing correlation. `correlationId` ties a recorded event back
+  // to the request that captured/ingested it (a UUID, generated independently of
+  // the trace id); `traceId` is the W3C trace id (32 lowercase hex chars) of the
+  // originating span when telemetry is enabled. Both optional + backward
+  // compatible — populated by the plugin (see @akasecurity/plugin-sdk).
+  correlationId: external_exports.uuid().optional(),
+  traceId: external_exports.string().regex(/^[0-9a-f]{32}$/).optional(),
+  // Ids of the detection exceptions that downgraded findings in this capture
+  // to 'allow' — the enforcement audit trail's link back to the grant that
+  // authorized the bypass. Absent on captures where no exception applied.
+  exceptionIds: external_exports.array(external_exports.guid()).optional()
+}).meta({ id: "EventMetadata" });
+var Event = external_exports.object({
+  id: external_exports.guid(),
+  sourceTool: SourceTool,
+  kind: EventKind,
+  occurredAt: external_exports.iso.datetime(),
+  contentHash: external_exports.string(),
+  content: external_exports.string(),
+  metadata: EventMetadata.optional()
+}).meta({ id: "Event" });
+var IngestEvent = Event.meta({ id: "IngestEvent" });
+var IngestBatch = external_exports.object({
+  events: external_exports.array(IngestEvent).min(1).max(100),
+  // Dedup policy for this batch. Id-dedup ALWAYS applies. 'content-hash'
+  // additionally rejects any event whose contentHash the store has already
+  // recorded — for re-runnable bulk ingest (worktree scan, transcript
+  // backfill), where a re-run mints fresh event ids for identical content and
+  // would otherwise accumulate duplicates. Live hook traffic must NOT set it:
+  // two genuinely separate prompts can be byte-identical and both belong on
+  // the timeline.
+  dedupe: external_exports.literal("content-hash").optional()
+}).meta({ id: "IngestBatch" });
+
+// ../../packages/schema/src/zod/exception.ts
+var ExceptionScope = external_exports.enum(["once", "temporary", "permanent"]);
+var ExceptionConditions = external_exports.object({
+  repo: external_exports.string().optional(),
+  sourceTool: external_exports.string().optional(),
+  provider: external_exports.string().optional()
+}).strict();
+var ExceptionCapability = external_exports.enum(["suppress", "reveal_to_model"]);
+var DetectionException = external_exports.object({
+  id: external_exports.guid(),
+  ruleId: external_exports.string(),
+  // Denormalized from the rule, for reporting — never matched on.
+  category: DetectionCategory,
+  // HMAC-SHA256 hex of the raw match under a machine-local key: a KEYED
+  // fingerprint, never the raw value, and never reversible. Matching recomputes
+  // the fingerprint from a fresh capture; the value itself is never stored.
+  // Shape-constrained so a malformed — or accidentally raw — value is rejected
+  // at the boundary rather than persisted.
+  valueFingerprint: external_exports.string().regex(/^[0-9a-f]{64}$/),
+  // Version of the fingerprint key the grant was written under; a rotated key
+  // invalidates old grants rather than silently mismatching them.
+  keyVersion: external_exports.number().int().positive(),
+  // maskMatch() preview of the approved value — never the raw value.
+  maskedValue: external_exports.string(),
+  capability: ExceptionCapability.default("suppress"),
+  scope: ExceptionScope,
+  expiresAt: external_exports.iso.datetime().nullable(),
+  maxUses: external_exports.number().int().positive().nullable(),
+  useCount: external_exports.number().int().nonnegative(),
+  lastUsedAt: external_exports.iso.datetime().nullable(),
+  // Mandatory: every grant carries the human reason it exists.
+  justification: external_exports.string().min(1),
+  conditions: ExceptionConditions.nullable(),
+  createdBy: external_exports.string(),
+  createdVia: external_exports.enum(["cli-approve", "cli-add", "web-approve", "web-add", "api", "setup-triage"]),
+  createdAt: external_exports.iso.datetime(),
+  updatedAt: external_exports.iso.datetime(),
+  // Revocation is terminal and retained — consumed/expired/revoked rows are
+  // audit evidence; nothing in the exception lifecycle hard-deletes.
+  revokedAt: external_exports.iso.datetime().nullable(),
+  revokedBy: external_exports.string().nullable(),
+  revokeReason: external_exports.string().nullable()
+});
+var ExceptionBundleEntry = DetectionException.pick({
+  id: true,
+  ruleId: true,
+  valueFingerprint: true,
+  keyVersion: true,
+  capability: true,
+  expiresAt: true,
+  maxUses: true,
+  useCount: true,
+  conditions: true
+});
+var ExceptionDescriptor = DetectionException.omit({ valueFingerprint: true });
+
 // ../../packages/schema/src/zod/exception-action.ts
 var confirmation = external_exports.string().optional();
 var ApproveBlockedInput = external_exports.object({
@@ -17112,6 +17120,7 @@ var ListVaultDerefsResponse = external_exports.object({
 });
 var VaultKeyCustody = external_exports.string();
 var VaultInlineReveal = external_exports.enum(["masked", "full", "off"]);
+var VAULT_CONSENT_VERSION = 1;
 var VaultConsent = external_exports.object({
   acknowledgedAt: external_exports.iso.datetime(),
   version: external_exports.number().int().positive()
@@ -17119,7 +17128,14 @@ var VaultConsent = external_exports.object({
 
 // ../../packages/schema/src/zod/local.ts
 var WORKSPACE_SETTINGS_SPEC_VERSION = 5;
-var RunMode = external_exports.enum(["standalone"]);
+var MODEL_JUDGE_PAYLOAD_VERSION = 1;
+var RunMode = external_exports.enum(["standalone", "attached"]);
+var ControlPlaneConnection = external_exports.object({
+  endpoint: external_exports.string().min(1),
+  // Display name for the deployment, shown instead of the raw endpoint.
+  label: external_exports.string().min(1).optional(),
+  attachedAt: external_exports.iso.datetime()
+}).meta({ id: "ControlPlaneConnection" });
 var SimpleDetectionPolicy = external_exports.enum(["redact", "warn"]);
 var HistoricalAccess = external_exports.enum(["full", "session-only"]);
 var ModelJudgeConsent = external_exports.object({
@@ -17128,12 +17144,10 @@ var ModelJudgeConsent = external_exports.object({
 });
 var WorkspaceSettings = external_exports.object({
   specVersion: external_exports.number().int().positive().default(WORKSPACE_SETTINGS_SPEC_VERSION),
-  // Settings files written by earlier releases may carry the retired 'attached'
-  // value; it parses as 'standalone' so those files keep loading.
-  runMode: external_exports.preprocess(
-    (v) => v === "attached" ? "standalone" : v,
-    RunMode.default("standalone")
-  ),
+  runMode: RunMode.default("standalone"),
+  // Present only while attached; a detach clears it. Its presence is what makes
+  // `runMode: 'attached'` mean anything — see isAttached.
+  controlPlane: ControlPlaneConnection.optional(),
   policy: SimpleDetectionPolicy.default("redact"),
   // Consent for scanning pre-install surfaces; opt-in (see HistoricalAccess).
   historicalAccess: HistoricalAccess.default("session-only"),
@@ -17162,6 +17176,196 @@ function defaultWorkspaceSettings() {
   return WorkspaceSettings.parse({});
 }
 
+// ../../packages/schema/src/zod/managed.ts
+var MANAGED_SETTINGS_FILENAME = "managed-settings.json";
+var MANAGED_SETTINGS_SPEC_VERSION = 1;
+var ManagedSettingKey = external_exports.enum([
+  "runMode",
+  "historicalAccess",
+  "vaultConsent",
+  "vaultKeyCustody",
+  "vaultInlineReveal",
+  "modelJudgeConsent",
+  "dataSharesInPlace"
+]).meta({ id: "ManagedSettingKey" });
+var ManagedSettingsValues = external_exports.object({
+  runMode: external_exports.enum(["standalone", "attached"]).optional(),
+  controlPlane: external_exports.object({
+    endpoint: external_exports.string().min(1),
+    label: external_exports.string().min(1).optional()
+  }).optional(),
+  historicalAccess: external_exports.enum(["full", "session-only"]).optional(),
+  vaultConsent: external_exports.boolean().optional(),
+  vaultKeyCustody: external_exports.enum(["file", "keychain"]).optional(),
+  vaultInlineReveal: external_exports.enum(["masked", "full", "off"]).optional(),
+  modelJudgeConsent: external_exports.boolean().optional(),
+  dataSharesInPlace: external_exports.boolean().optional()
+}).meta({ id: "ManagedSettingsValues" });
+var ManagedSettings = external_exports.object({
+  specVersion: external_exports.number().int().positive().default(MANAGED_SETTINGS_SPEC_VERSION),
+  // Shown on every locked control, so the user can tell an administrative
+  // decision from a bug. Absent renders as a generic "your organization".
+  organization: external_exports.string().min(1).optional(),
+  // What the administrator pinned.
+  values: ManagedSettingsValues.default({}),
+  // Which of those the user may not change. A key here with no matching value
+  // freezes whatever the user last chose; a value with no lock is a DEFAULT
+  // the user may still override. The two are separable on purpose.
+  lockedFields: external_exports.array(ManagedSettingKey).default([])
+}).meta({ id: "ManagedSettings" });
+
+// ../../packages/schema/src/zod/policy.ts
+var PolicyScope = external_exports.enum(["global", "repo", "user"]).meta({ id: "PolicyScope" });
+var PolicyTarget = external_exports.union([external_exports.object({ ruleId: external_exports.string() }), external_exports.object({ category: DetectionCategory })]).meta({ id: "PolicyTarget" });
+var Policy = external_exports.object({
+  id: external_exports.guid(),
+  scope: PolicyScope,
+  target: PolicyTarget,
+  action: ActionTaken,
+  enabled: external_exports.boolean().default(true),
+  customKeywords: external_exports.array(external_exports.string()).optional(),
+  // Display name — optional so older policy rows without name still parse.
+  // Added for the findings API (policy.name column migration).
+  name: external_exports.string().optional()
+}).meta({ id: "Policy" });
+var PolicyBundle = external_exports.object({
+  version: external_exports.string(),
+  policies: external_exports.array(Policy),
+  // Rules from the installed marketplace packs (snapshotted by the
+  // control plane). The plugin registers these in addition to its bundled
+  // packs. Optional so older backends — and older on-disk caches — that omit
+  // the field still parse; consumers read `bundle.rules ?? []`.
+  rules: external_exports.array(Rule).optional(),
+  // When true, `rules` IS the complete effective ruleset and the runtime must
+  // NOT merge its compiled-in bundled packs — the standalone gateway sets this
+  // after reading the user's installed snapshot (installed_packs, enabled
+  // packs only), which is how detection updates stay manual: new bundled
+  // rules run only after the user applies the pack update. Absent/false keeps
+  // the historical composition (bundled packs + rules) — older caches.
+  rulesComplete: external_exports.boolean().optional(),
+  // Active detection exceptions, evaluation subset only (see
+  // ExceptionBundleEntry). Optional so older bundle producers — and older
+  // on-disk caches — that omit the field still parse; consumers read
+  // `bundle.exceptions ?? []`.
+  exceptions: external_exports.array(ExceptionBundleEntry).optional(),
+  // Rule ids whose pack is assigned a REVERSIBLE archetype (Redact & Vault).
+  // A second axis over the same `redact` action, carried beside the policies
+  // rather than on them: nothing writes ruleId-targeted policies to disk, so
+  // widening Policy itself would change a persisted shape to express something
+  // only the in-memory bundle needs. Optional so an older producer — or an
+  // older on-disk cache — still parses; consumers read `?? []` and get the
+  // pre-existing one-way behaviour, which is the safe direction to default.
+  reversibleRuleIds: external_exports.array(external_exports.string()).optional(),
+  // Installed pack version, keyed by ruleId, for rules in `rules` that came
+  // from a versioned installed pack. Optional so older backends — and older
+  // on-disk caches — that omit the field still parse; consumers fall back to
+  // the rule's own spec version. NOT the bundle version above — see
+  // installedRuleset's ruleVersions for the source of truth.
+  ruleVersions: external_exports.record(external_exports.string(), external_exports.string()).optional(),
+  customKeywords: external_exports.array(external_exports.string()),
+  fetchedAt: external_exports.iso.datetime()
+}).meta({ id: "PolicyBundle" });
+var OBSERVE_ONLY_CATEGORIES = ["config"];
+var ENFORCEABLE_CATEGORIES = DetectionCategory.options.filter((c) => !OBSERVE_ONLY_CATEGORIES.includes(c));
+var CATEGORY_PEAK_SEVERITY = {
+  secret: "critical",
+  financial: "critical",
+  // core-financial/credit-card
+  code_flaw: "critical",
+  pii: "high",
+  phi: "high",
+  custom: "high",
+  // user-defined; conservative
+  code_context: "low",
+  config: "low"
+  // observe-only; floors to monitor regardless
+};
+function severityFloorPolicy(category) {
+  if (OBSERVE_ONLY_CATEGORIES.includes(category)) return "monitor";
+  const peak = CATEGORY_PEAK_SEVERITY[category];
+  return peak === "critical" || peak === "high" ? "warn" : "monitor";
+}
+var PolicyKind = external_exports.enum(["builtin", "custom"]).meta({ id: "PolicyKind" });
+var KNOWN_BUILTIN_IDS = ["monitor", "warn", "redact", "vault", "block"];
+var BuiltinPolicyId = external_exports.enum(KNOWN_BUILTIN_IDS).meta({ id: "BuiltinPolicyId" });
+var BUILTIN_POLICY_SPECS = {
+  monitor: {
+    name: "Monitor",
+    action: "log",
+    reversible: false,
+    description: "Log every match for audit. The request is allowed through untouched."
+  },
+  warn: {
+    name: "Warn",
+    action: "warn",
+    reversible: false,
+    description: "Allow the request, but warn the user inline before it is sent."
+  },
+  redact: {
+    name: "Redact",
+    action: "redact",
+    reversible: false,
+    description: "Strip the matched value from the request and destroy it, then continue. What was removed cannot be recovered."
+  },
+  vault: {
+    name: "Redact & Vault",
+    action: "redact",
+    reversible: true,
+    description: "Strip the matched value from the request and keep an encrypted, recoverable copy in the local vault, leaving a pointer in its place. Needs the vault consent granted under Settings; without it this behaves as Redact."
+  },
+  block: {
+    name: "Block",
+    action: "block",
+    reversible: false,
+    description: "Refuse the request entirely whenever any rule in this detection matches."
+  }
+};
+function builtinPolicyToAction(id) {
+  return BUILTIN_POLICY_SPECS[id].action;
+}
+var CATEGORY_EXPRESSIBLE_IDS = KNOWN_BUILTIN_IDS.filter(
+  (id) => !BUILTIN_POLICY_SPECS[id].reversible
+);
+var CATEGORY_INEXPRESSIBLE_IDS = KNOWN_BUILTIN_IDS.filter(
+  (id) => BUILTIN_POLICY_SPECS[id].reversible
+);
+var CategoryPolicyId = external_exports.enum(CATEGORY_EXPRESSIBLE_IDS).meta({ id: "CategoryPolicyId" });
+var DEFAULT_ACTIONS = Object.fromEntries(
+  DetectionCategory.options.map((c) => [c, builtinPolicyToAction(severityFloorPolicy(c))])
+);
+var BUILTIN_POLICIES = Object.fromEntries(
+  KNOWN_BUILTIN_IDS.map((id) => [id, { id, ...BUILTIN_POLICY_SPECS[id] }])
+);
+var UsedByItem = external_exports.object({
+  id: external_exports.string(),
+  name: external_exports.string(),
+  ruleCount: external_exports.number().int().nonnegative(),
+  enabled: external_exports.boolean()
+}).meta({ id: "UsedByItem" });
+var PolicyListItem = external_exports.object({
+  id: external_exports.string(),
+  kind: PolicyKind,
+  name: external_exports.string(),
+  enabled: external_exports.boolean(),
+  usedByCount: external_exports.number().int().nonnegative()
+}).meta({ id: "PolicyListItem" });
+var ListPoliciesResponse = external_exports.object({ items: external_exports.array(PolicyListItem) }).meta({ id: "ListPoliciesResponse" });
+var PolicyDetail = external_exports.object({
+  specVersion: external_exports.literal(1),
+  id: external_exports.string(),
+  kind: PolicyKind,
+  name: external_exports.string(),
+  enabled: external_exports.boolean(),
+  description: external_exports.string(),
+  usedBy: external_exports.array(UsedByItem)
+}).meta({ id: "PolicyDetail" });
+var PolicyStatsResponse = external_exports.object({
+  policies: external_exports.number().int().nonnegative(),
+  builtin: external_exports.number().int().nonnegative(),
+  custom: external_exports.number().int().nonnegative(),
+  detectionsGoverned: external_exports.number().int().nonnegative()
+}).meta({ id: "PolicyStatsResponse" });
+
 // ../../packages/schema/src/zod/project-files.ts
 var ProjectFileInput = external_exports.object({
   path: external_exports.string().min(1),
@@ -17234,44 +17438,6 @@ var BatchedRemediation = external_exports.discriminatedUnion("kind", [
   NoRemediationDecision
 ]);
 
-// ../../packages/schema/src/zod/rule-test.ts
-var TestRulesRequest = external_exports.object({
-  rules: external_exports.array(Rule).min(1).max(100),
-  text: external_exports.string().max(5e4).optional(),
-  fixtures: external_exports.array(RuleFixture).max(200).optional()
-}).refine((v) => v.text !== void 0 || (v.fixtures?.length ?? 0) > 0, {
-  message: "Provide `text`, `fixtures`, or both \u2014 there must be something to test"
-}).meta({ id: "TestRulesRequest" });
-var RuleTestMatch = external_exports.object({
-  ruleId: external_exports.string(),
-  category: DetectionCategory,
-  severity: Severity,
-  span: Span,
-  confidence: external_exports.number().min(0).max(1),
-  match: external_exports.string()
-}).meta({ id: "RuleTestMatch" });
-var FixtureResult = external_exports.object({
-  label: external_exports.string(),
-  shouldMatch: external_exports.boolean(),
-  didMatch: external_exports.boolean(),
-  passed: external_exports.boolean(),
-  matches: external_exports.array(RuleTestMatch)
-}).meta({ id: "FixtureResult" });
-var TestRulesResponse = external_exports.object({
-  // Present only when the request supplied `text`.
-  adhoc: external_exports.object({ matches: external_exports.array(RuleTestMatch) }).optional(),
-  fixtures: external_exports.array(FixtureResult),
-  summary: external_exports.object({
-    total: external_exports.number().int().nonnegative(),
-    passed: external_exports.number().int().nonnegative(),
-    failed: external_exports.number().int().nonnegative()
-  }),
-  // Ids of rules whose matcher type the engine cannot evaluate today (e.g.
-  // `validator`), so they silently never match. Surfaced so an author is not
-  // misled by a green run that actually skipped a rule.
-  unsupportedRuleIds: external_exports.array(external_exports.string())
-}).meta({ id: "TestRulesResponse" });
-
 // ../../packages/schema/src/zod/security.ts
 var SeveritySummaryItem = external_exports.object({
   severity: Severity,
@@ -17369,10 +17535,22 @@ var TopSourcesQuery = external_exports.object({
   // Omit for both kinds.
   kind: external_exports.enum(SOURCE_KINDS).optional()
 });
-var Provider = external_exports.enum(["claudecode", "cursor", "codex", "antigravity", "claudeai", "chatgpt", "copilot", "api"]).meta({ id: "Provider" });
+var Provider = Harness.extract([
+  "ClaudeCode",
+  "Cursor",
+  "Codex",
+  "Antigravity",
+  "ClaudeAi",
+  "ChatGpt",
+  "Copilot",
+  "Api"
+]).meta({ id: "Provider" });
 var ScanCoverageProvider = external_exports.object({
   provider: Provider,
-  // Percent of that provider's traffic scanned in the window. 0 when unsupported.
+  // Percent of that provider's traffic the shipped capture surface reaches.
+  // A curated business fact, constant across every `range` — not a measured
+  // per-window metric. 0 exactly when `supported` is false. See the comment
+  // above the block for where these numbers are decided.
   coverage: external_exports.number().int().min(0).max(100),
   supported: external_exports.boolean()
 }).meta({ id: "ScanCoverageProvider" });
@@ -17426,6 +17604,18 @@ var ApplyRecommendedActionResponse = external_exports.object({
 var DismissRecommendedActionResponse = external_exports.object({ id: external_exports.string(), status: external_exports.literal("dismissed") }).meta({ id: "DismissRecommendedActionResponse" });
 var RecommendedActionIdParam = external_exports.object({ id: external_exports.string() });
 
+// ../../packages/schema/src/zod/settings-action.ts
+var SaveSettingsInput = external_exports.object({
+  historicalAccess: external_exports.string(),
+  modelJudgeConsent: external_exports.boolean(),
+  vaultConsent: external_exports.string(),
+  vaultInlineReveal: external_exports.string()
+});
+var AttachInput = external_exports.object({
+  endpoint: external_exports.string(),
+  label: external_exports.string().optional()
+});
+
 // ../../packages/schema/src/zod/triage.ts
 var TriageHit = external_exports.object({
   ruleId: external_exports.string(),
@@ -17440,7 +17630,7 @@ var TriageHit = external_exports.object({
   valueFingerprint: external_exports.string().optional(),
   keyVersion: external_exports.number().int().nonnegative().optional()
 });
-var TriagePolicy = BuiltinPolicyId;
+var TriagePolicy = CategoryPolicyId;
 var TriageCategoryRec = external_exports.object({
   category: DetectionCategory,
   action: TriagePolicy,
@@ -17534,14 +17724,6 @@ var SetupHandoffOffer = external_exports.object({
   path: ["liveKeys"]
 });
 
-// ../../packages/persistence/src/ids.ts
-import { createHash } from "crypto";
-
-// ../../packages/persistence/src/internal/snapshot.ts
-import { randomUUID } from "crypto";
-import { existsSync, readdirSync, renameSync as renameSync2, rmSync as rmSync2, statSync } from "fs";
-import { basename, dirname, join } from "path";
-
 // ../../packages/persistence/src/paths.ts
 import {
   chmodSync,
@@ -17572,16 +17754,32 @@ function chmodBestEffort(path, mode) {
 function tightenDir(dir) {
   chmodBestEffort(dir, DATA_DIR_MODE);
 }
+function mkdirOwnerOnlySync(dir, recursive = false) {
+  mkdirSync(dir, { recursive, mode: DATA_DIR_MODE });
+}
 function ensureDataDirSync(dir) {
-  mkdirSync(dir, { recursive: true, mode: DATA_DIR_MODE });
+  mkdirOwnerOnlySync(dir, true);
   tightenDir(dir);
 }
 function tightenFile(file2) {
   chmodBestEffort(file2, DATA_FILE_MODE);
 }
 
+// ../../packages/persistence/src/database.ts
+import { randomUUID as randomUUID10 } from "crypto";
+import { join as join3, sep } from "path";
+import { DatabaseSync } from "node:sqlite";
+
+// ../../packages/persistence/src/ids.ts
+import { createHash } from "crypto";
+
 // ../../packages/persistence/src/internal/snapshot.ts
+import { randomUUID } from "crypto";
+import { existsSync, readdirSync, renameSync as renameSync2, rmSync as rmSync3, statSync as statSync2 } from "fs";
+import { basename, dirname, join as join2 } from "path";
 var STALE_PARTIAL_MS = 5 * 6e4;
+var SNAPSHOT_STAGING_SUFFIX = ".partial";
+var STAGED_NAME_SUFFIX = `.bak${SNAPSHOT_STAGING_SUFFIX}`;
 
 // ../../packages/persistence/src/internal/json.ts
 function parseJsonObject(s) {
@@ -17596,6 +17794,7 @@ function parseJsonObject(s) {
 
 // ../../packages/persistence/src/repositories/activity.ts
 var LIVE_ACTIVITY_WINDOW_MS = 30 * 6e4;
+var DEFAULT_HARNESS = HARNESS.ClaudeCode;
 
 // ../../packages/persistence/src/repositories/exceptions.ts
 import { randomUUID as randomUUID2 } from "crypto";
@@ -17614,7 +17813,20 @@ import { createHash as createHash2, randomUUID as randomUUID3 } from "crypto";
 // ../../packages/persistence/src/repositories/inventory-assets.ts
 import { randomUUID as randomUUID4 } from "crypto";
 var VALID_HARNESS_IDS = new Set(HarnessId.options);
+var HARNESS_LABELS = {
+  [HARNESS.ClaudeCode]: "Claude Code",
+  [HARNESS.Cursor]: "Cursor",
+  [HARNESS.Codex]: "Codex",
+  [HARNESS.Antigravity]: "Antigravity"
+};
 var HARNESS_LIVENESS_WINDOW_MS = 30 * 24 * 60 * 60 * 1e3;
+var stripSeparators = (value) => value.toLowerCase().replace(/[\s-]/g, "");
+var TITLE_NEEDLES = {
+  ClaudeCode: stripSeparators(SOURCE_TOOL.ClaudeCode),
+  Cursor: stripSeparators(SOURCE_TOOL.Cursor),
+  Codex: stripSeparators(SOURCE_TOOL.Codex),
+  Antigravity: stripSeparators(SOURCE_TOOL.Antigravity)
+};
 
 // ../../packages/persistence/src/repositories/policies.ts
 import { randomUUID as randomUUID5 } from "crypto";
@@ -17628,6 +17840,18 @@ import { randomUUID as randomUUID7 } from "crypto";
 // ../../packages/persistence/src/repositories/secret-vault.ts
 import { randomUUID as randomUUID8 } from "crypto";
 
+// ../../packages/persistence/src/repositories/security.ts
+var SCAN_COVERAGE = {
+  [HARNESS.Antigravity]: { coverage: 60, supported: true },
+  [HARNESS.Api]: { coverage: 0, supported: false },
+  [HARNESS.ChatGpt]: { coverage: 40, supported: true },
+  [HARNESS.ClaudeAi]: { coverage: 40, supported: true },
+  [HARNESS.ClaudeCode]: { coverage: 100, supported: true },
+  [HARNESS.Codex]: { coverage: 80, supported: true },
+  [HARNESS.Copilot]: { coverage: 0, supported: false },
+  [HARNESS.Cursor]: { coverage: 0, supported: false }
+};
+
 // ../../packages/persistence/src/repositories/shares.ts
 import { randomUUID as randomUUID9 } from "crypto";
 
@@ -17637,9 +17861,9 @@ import {
   closeSync,
   existsSync as existsSync2,
   openSync,
-  readFileSync,
-  rmSync as rmSync3,
-  statSync as statSync2,
+  readFileSync as readFileSync2,
+  rmSync as rmSync4,
+  statSync as statSync3,
   writeFileSync as writeFileSync2
 } from "fs";
 import { hostname as hostname3 } from "os";
@@ -17650,26 +17874,29 @@ import { createHash as createHash3 } from "crypto";
 
 // ../../packages/persistence/src/fingerprint.ts
 import { createHmac, randomBytes } from "crypto";
-import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
-import { join as join3 } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
+import { join as join4 } from "path";
 import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
 
 // ../../packages/persistence/src/local-layout.ts
 import { renameSync as renameSync3 } from "fs";
 import { mkdir } from "fs/promises";
 import { homedir } from "os";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 function defaultDataDir() {
-  return join4(homedir(), ".aka");
+  return join5(homedir(), ".aka");
 }
 function settingsDir(base = defaultDataDir()) {
-  return join4(base, "settings");
+  return join5(base, "settings");
 }
 function dataDir(base = defaultDataDir()) {
-  return join4(base, "data");
+  return join5(base, "data");
 }
 function dbPath(base = defaultDataDir()) {
-  return join4(dataDir(base), "aka.db");
+  return join5(dataDir(base), "aka.db");
+}
+function keysDir(base = defaultDataDir()) {
+  return join5(base, "keys");
 }
 function ensureLayoutDirSync(dir = defaultDataDir()) {
   ensureDataDirSync(dir);
@@ -17682,20 +17909,88 @@ function migrateLegacyLayout(base = defaultDataDir()) {
   for (const { name, dest } of moves) {
     try {
       ensureDataDirSync(dest);
-      const moved = join4(dest, name);
-      renameSync3(join4(base, name), moved);
+      const moved = join5(dest, name);
+      renameSync3(join5(base, name), moved);
       tightenFile(moved);
     } catch {
     }
   }
 }
 
+// ../../packages/persistence/src/managed-settings.ts
+import { readFileSync as readFileSync4 } from "fs";
+import { posix, win32 } from "path";
+function managedSettingsPaths(platform2 = process.platform) {
+  if (platform2 === "darwin") {
+    return [
+      posix.join("/Library", "Application Support", "AKASecurity", MANAGED_SETTINGS_FILENAME),
+      posix.join("/Library", "Managed Preferences", MANAGED_SETTINGS_FILENAME)
+    ];
+  }
+  if (platform2 === "win32") {
+    return [win32.join("C:\\", "ProgramData", "AKASecurity", MANAGED_SETTINGS_FILENAME)];
+  }
+  return [posix.join("/etc", "aka", MANAGED_SETTINGS_FILENAME)];
+}
+function readManagedSettings(paths = managedSettingsPaths()) {
+  for (const path of paths) {
+    let text;
+    try {
+      text = readFileSync4(path, "utf8");
+    } catch {
+      continue;
+    }
+    const record2 = parseJsonObject(text);
+    if (!record2) continue;
+    const parsed = ManagedSettings.safeParse(record2);
+    if (parsed.success) return parsed.data;
+  }
+  return null;
+}
+function overlayManagedSettings(settings, managed, now = () => /* @__PURE__ */ new Date()) {
+  if (!managed) return settings;
+  const { values } = managed;
+  const merged = { ...settings };
+  if (values.runMode !== void 0) merged.runMode = values.runMode;
+  if (values.controlPlane !== void 0) {
+    merged.controlPlane = {
+      ...values.controlPlane,
+      // The administrator pinned WHICH deployment, not WHEN this machine
+      // joined it. Keep the user's own attach time when the endpoint is
+      // unchanged, so a managed machine does not appear to re-attach on every
+      // read; stamp a fresh one when the administrator moved it.
+      attachedAt: settings.controlPlane?.endpoint === values.controlPlane.endpoint ? settings.controlPlane.attachedAt : now().toISOString()
+    };
+  }
+  if (values.historicalAccess !== void 0) merged.historicalAccess = values.historicalAccess;
+  if (values.vaultKeyCustody !== void 0) merged.vaultKeyCustody = values.vaultKeyCustody;
+  if (values.vaultInlineReveal !== void 0) merged.vaultInlineReveal = values.vaultInlineReveal;
+  if (values.dataSharesInPlace !== void 0) merged.dataSharesInPlace = values.dataSharesInPlace;
+  if (values.vaultConsent !== void 0) {
+    merged.vaultConsent = values.vaultConsent ? (
+      // Keep an existing valid grant so its acknowledgedAt survives; mint one
+      // at the current version otherwise.
+      settings.vaultConsent?.version === VAULT_CONSENT_VERSION ? settings.vaultConsent : { acknowledgedAt: now().toISOString(), version: VAULT_CONSENT_VERSION }
+    ) : void 0;
+  }
+  if (values.modelJudgeConsent !== void 0) {
+    merged.modelJudgeConsent = values.modelJudgeConsent ? settings.modelJudgeConsent?.payloadVersion === MODEL_JUDGE_PAYLOAD_VERSION ? settings.modelJudgeConsent : {
+      acknowledgedAt: now().toISOString(),
+      payloadVersion: MODEL_JUDGE_PAYLOAD_VERSION
+    } : void 0;
+  }
+  return merged;
+}
+
 // ../../packages/persistence/src/settings.ts
-import { readFileSync as readFileSync3 } from "fs";
-import { join as join5 } from "path";
+import { readFileSync as readFileSync5 } from "fs";
+import { join as join6 } from "path";
 var SETTINGS_FILENAME = "settings.json";
 function readWorkspaceSettings(base = defaultDataDir()) {
-  const record2 = readJson(join5(settingsDir(base), SETTINGS_FILENAME));
+  return overlayManagedSettings(readUserSettings(base), readManagedSettings());
+}
+function readUserSettings(base) {
+  const record2 = readJson(join6(settingsDir(base), SETTINGS_FILENAME));
   if (!record2) return defaultWorkspaceSettings();
   try {
     return WorkspaceSettings.parse(record2);
@@ -17706,13 +18001,64 @@ function readWorkspaceSettings(base = defaultDataDir()) {
 function readJson(file2) {
   let text;
   try {
-    text = readFileSync3(file2, "utf8");
+    text = readFileSync5(file2, "utf8");
   } catch {
     return null;
   }
   return parseJsonObject(text) ?? null;
 }
 
+// ../../packages/persistence/src/store-symlinks.ts
+import { existsSync as existsSync4, lstatSync as lstatSync3, readlinkSync, realpathSync, statSync as statSync4 } from "fs";
+import { dirname as dirname2, join as join7, resolve } from "path";
+var STORE_DB = "the store database (including the prompt corpus)";
+var STORE_SETTINGS = "your settings file";
+function storeContents(home) {
+  return /* @__PURE__ */ new Map([
+    [home, "the store (including the prompt corpus in aka.db)"],
+    [settingsDir(home), STORE_SETTINGS],
+    [dataDir(home), STORE_DB],
+    [keysDir(home), "the vault key"],
+    [join7(settingsDir(home), "settings.json"), STORE_SETTINGS],
+    [dbPath(home), STORE_DB]
+  ]);
+}
+function symlinkedStorePaths(home, platform2 = process.platform) {
+  return [...storeContents(home)].flatMap(([path, holds]) => {
+    try {
+      if (!lstatSync3(path).isSymbolicLink()) return [];
+      return [
+        {
+          path,
+          target: linkTarget(path),
+          holds,
+          // existsSync follows the link, so a target that is gone reads as
+          // absent here while lstat above still sees the link itself.
+          missing: !existsSync4(path),
+          mode: targetMode(path, platform2)
+        }
+      ];
+    } catch {
+      return [];
+    }
+  });
+}
+function linkTarget(path) {
+  try {
+    return realpathSync(path);
+  } catch {
+    return resolve(dirname2(path), readlinkSync(path));
+  }
+}
+function targetMode(path, platform2) {
+  if (platform2 === "win32") return void 0;
+  try {
+    return statSync4(path).mode & 511;
+  } catch {
+    return void 0;
+  }
+}
+
 // ../../packages/persistence/src/vault/crypto.ts
 import {
   createCipheriv,
@@ -17725,23 +18071,15 @@ import {
 // ../../packages/persistence/src/vault/key-provider.ts
 import { execFileSync } from "child_process";
 import { randomBytes as randomBytes2 } from "crypto";
-import {
-  chmodSync as chmodSync2,
-  mkdirSync as mkdirSync2,
-  readFileSync as readFileSync4,
-  renameSync as renameSync4,
-  rmSync as rmSync4,
-  statSync as statSync3,
-  writeFileSync as writeFileSync3
-} from "fs";
-import { join as join6 } from "path";
+import { chmodSync as chmodSync3, readFileSync as readFileSync6, renameSync as renameSync4, rmSync as rmSync5, statSync as statSync5, writeFileSync as writeFileSync3 } from "fs";
+import { join as join8 } from "path";
 
 // ../../packages/persistence/src/vault/vault.ts
 import { randomBytes as randomBytes3, randomUUID as randomUUID12 } from "crypto";
 
 // ../../packages/persistence/src/warn-era-cap.ts
-import { existsSync as existsSync4, writeFileSync as writeFileSync4 } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync5, writeFileSync as writeFileSync4 } from "fs";
+import { join as join9 } from "path";
 
 // ../../packages/plugin-sdk/src/provider-env.ts
 var DEFAULT_ANTHROPIC_HOST = "api.anthropic.com";
@@ -17795,8 +18133,8 @@ function resolveProvider() {
 function loadConfig(base = defaultDataDir(), resolveProviderFn = resolveProvider) {
   try {
     ensureLayoutDirSync(base);
-    const settingsFile = join8(settingsDir(base), "settings.json");
-    if (existsSync5(settingsFile)) tightenFile(settingsFile);
+    const settingsFile = join10(settingsDir(base), "settings.json");
+    if (existsSync6(settingsFile)) tightenFile(settingsFile);
   } catch {
   }
   migrateLegacyLayout(base);
@@ -17819,9 +18157,9 @@ function resolveProviderSafe(resolveProviderFn) {
 }
 
 // ../../packages/plugin-sdk/src/config-inventory.ts
-import { readdirSync as readdirSync2, readFileSync as readFileSync6, realpathSync, statSync as statSync5 } from "fs";
+import { readdirSync as readdirSync2, readFileSync as readFileSync8, realpathSync as realpathSync2, statSync as statSync7 } from "fs";
 import { homedir as homedir2 } from "os";
-import { basename as basename3, join as join10 } from "path";
+import { basename as basename3, join as join12 } from "path";
 
 // ../../packages/detections/src/egress/registry.ts
 var EXTRACTOR_VERSION = "1";
@@ -18551,6 +18889,7 @@ var CONFIG_POSTURE_RULES = [
 ];
 
 // ../../packages/detections/src/security/redos-probe.ts
+var BUDGET_MS = 100;
 var EXPONENTIAL_UNITS = [
   "a",
   "0",
@@ -18574,34 +18913,40 @@ var EXPONENTIAL_PROBES = EXPONENTIAL_UNITS.flatMap(
 var POLYNOMIAL_PROBES = ["abc-", "a.", "a ", "a=", "x", "0", "a@", "a/", "ab"].map(
   (unit) => unit.repeat(1e4).slice(0, 4e4) + "!"
 );
+var CPU_CORROBORATION_SHARE = 0.2;
+var CORROBORATION_FLOOR_MS = BUDGET_MS * CPU_CORROBORATION_SHARE;
 
 // ../../packages/plugin-sdk/src/repo.ts
-import { existsSync as existsSync6, readFileSync as readFileSync5, statSync as statSync4 } from "fs";
-import { basename as basename2, dirname as dirname2, isAbsolute, join as join9, sep as sep2 } from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync7, statSync as statSync6 } from "fs";
+import { basename as basename2, dirname as dirname3, isAbsolute, join as join11, sep as sep2 } from "path";
 
 // ../../packages/plugin-sdk/src/events.ts
 import { createHash as createHash4, randomUUID as randomUUID13 } from "crypto";
 
 // ../../packages/plugin-sdk/src/isolated-scan.ts
-import { existsSync as existsSync7 } from "fs";
+import { existsSync as existsSync8 } from "fs";
 import { fileURLToPath } from "url";
 import { Worker } from "worker_threads";
 
+// ../../packages/plugin-sdk/src/ignore-layers.ts
+var import_ignore = __toESM(require_ignore(), 1);
+import { readFileSync as readFileSync9 } from "fs";
+import { join as join13 } from "path";
+
 // ../../packages/plugin-sdk/src/inventory-resolver.ts
 import { arch, hostname as hostname4, platform, release } from "os";
 
 // ../../packages/plugin-sdk/src/nudge.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync5 } from "fs";
-import { join as join11 } from "path";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync10, writeFileSync as writeFileSync5 } from "fs";
+import { join as join14 } from "path";
 
 // ../../packages/plugin-sdk/src/paths.ts
-import { readdirSync as readdirSync3, realpathSync as realpathSync2 } from "fs";
-import { basename as basename4, dirname as dirname3, sep as sep3 } from "path";
+import { readdirSync as readdirSync3, realpathSync as realpathSync3 } from "fs";
+import { basename as basename4, dirname as dirname4, sep as sep3 } from "path";
 
 // ../../packages/plugin-sdk/src/project-files.ts
-var import_ignore = __toESM(require_ignore(), 1);
-import { existsSync as existsSync8, readdirSync as readdirSync4, readFileSync as readFileSync8 } from "fs";
-import { basename as basename5, join as join12 } from "path";
+import { existsSync as existsSync9, readdirSync as readdirSync4 } from "fs";
+import { basename as basename5, join as join15 } from "path";
 
 // ../../packages/plugin-sdk/src/provider-env-antigravity.ts
 var optionalBaseUrl2 = external_exports.preprocess((v) => {
@@ -18636,16 +18981,16 @@ import { randomUUID as randomUUID14 } from "crypto";
 var THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1e3;
 
 // ../../packages/plugin-sdk/src/throttle.ts
-import { mkdirSync as mkdirSync4, statSync as statSync6, writeFileSync as writeFileSync6 } from "fs";
-import { join as join13 } from "path";
+import { mkdirSync as mkdirSync3, statSync as statSync8, writeFileSync as writeFileSync6 } from "fs";
+import { join as join16 } from "path";
 function throttled(dataDir2, markerName, windowMs) {
-  const marker = join13(dataDir2, markerName);
+  const marker = join16(dataDir2, markerName);
   try {
-    if (Date.now() - statSync6(marker).mtimeMs < windowMs) return true;
+    if (Date.now() - statSync8(marker).mtimeMs < windowMs) return true;
   } catch {
   }
   try {
-    mkdirSync4(dataDir2, { recursive: true, mode: DATA_DIR_MODE });
+    mkdirSync3(dataDir2, { recursive: true, mode: DATA_DIR_MODE });
     writeFileSync6(marker, String(Date.now()), { mode: DATA_FILE_MODE });
   } catch {
   }
@@ -18654,7 +18999,7 @@ function throttled(dataDir2, markerName, windowMs) {
 
 // src/history/reconcile-trigger.ts
 import { spawn } from "child_process";
-import { dirname as dirname4, join as join15 } from "path";
+import { dirname as dirname5, join as join18 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/history/tail.ts
@@ -18662,13 +19007,13 @@ import { createHash as createHash5 } from "crypto";
 import {
   closeSync as closeSync2,
   fstatSync,
-  mkdirSync as mkdirSync5,
+  mkdirSync as mkdirSync4,
   openSync as openSync2,
-  readFileSync as readFileSync9,
+  readFileSync as readFileSync11,
   readSync,
   writeFileSync as writeFileSync7
 } from "fs";
-import { join as join14 } from "path";
+import { join as join17 } from "path";
 var SAFE_SESSION_ID = /^[A-Za-z0-9._-]+$/;
 function safeSessionId(sessionId) {
   if (SAFE_SESSION_ID.test(sessionId) && sessionId !== "." && sessionId !== "..") {
@@ -18684,8 +19029,8 @@ function triggerReconcile(dataDir2, sessionId, transcriptPath) {
   try {
     const marker = `${RECONCILE_MARKER_PREFIX}-${safeSessionId(sessionId)}`;
     if (throttled(dataDir2, marker, RECONCILE_THROTTLE_MS)) return;
-    const here = dirname4(fileURLToPath2(import.meta.url));
-    const child = spawn(process.execPath, [join15(here, "reconcile.js"), sessionId, transcriptPath], {
+    const here = dirname5(fileURLToPath2(import.meta.url));
+    const child = spawn(process.execPath, [join18(here, "reconcile.js"), sessionId, transcriptPath], {
       detached: true,
       stdio: "ignore"
     });
@@ -18696,7 +19041,7 @@ function triggerReconcile(dataDir2, sessionId, transcriptPath) {
 
 // src/hooks/shared.ts
 async function readStdin() {
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     let data = "";
     let settled = false;
     const finish = () => {
@@ -18705,7 +19050,7 @@ async function readStdin() {
       clearTimeout(timer);
       process.stdin.removeListener("data", onData);
       process.stdin.removeListener("end", finish);
-      resolve(data);
+      resolve2(data);
     };
     const onData = (chunk) => {
       data += chunk;
@@ -18739,11 +19084,144 @@ function parseStopPayload(input) {
   return { sessionId, transcriptPath };
 }
 
+// src/hooks/store-health.ts
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync15, writeFileSync as writeFileSync8 } from "fs";
+import { dirname as dirname6, join as join24 } from "path";
+
+// ../../packages/plugin-runtime/src/attached/forward-drops.ts
+import { readFileSync as readFileSync12 } from "fs";
+import { join as join19 } from "path";
+
+// ../../packages/plugin-runtime/src/attached/forward-policy.ts
+import { randomUUID as randomUUID15 } from "crypto";
+import { readFileSync as readFileSync13 } from "fs";
+import { readFile, rename, writeFile } from "fs/promises";
+import { join as join20 } from "path";
+
+// ../../packages/plugin-runtime/src/attached/policy-store.ts
+import { randomUUID as randomUUID16 } from "crypto";
+import { readFile as readFile2, rm, writeFile as writeFile2 } from "fs/promises";
+import { join as join21 } from "path";
+
+// ../../packages/plugin-runtime/src/attached/atomic-publish.ts
+import { rename as rename2 } from "fs/promises";
+
+// ../../packages/remote/src/http.ts
+import { request as httpRequest } from "http";
+import { request as httpsRequest } from "https";
+var MAX_RESPONSE_BYTES = 8 * 1024 * 1024;
+
+// ../../packages/remote/src/client.ts
+var SLASH = "/".charCodeAt(0);
+
+// ../../packages/plugin-runtime/src/attached/posture-reporter.ts
+var POSTURE_REPORT_INTERVAL_MS = 60 * 60 * 1e3;
+
+// ../../packages/plugin-runtime/src/attached/posture-snapshot.ts
+import { statSync as statSync9 } from "fs";
+import { DatabaseSync as DatabaseSync3 } from "node:sqlite";
+
+// ../../packages/plugin-runtime/src/attached/posture-store.ts
+import { randomUUID as randomUUID17 } from "crypto";
+import { readFile as readFile3, rm as rm2, writeFile as writeFile3 } from "fs/promises";
+import { join as join22 } from "path";
+
+// ../../packages/plugin-runtime/src/attached/sync-state.ts
+import { readFileSync as readFileSync14 } from "fs";
+import { join as join23 } from "path";
+
+// ../../packages/plugin-runtime/src/attached/status.ts
+var REFUSAL_LINES = {
+  unauthorized: "KEY REJECTED \u2014 re-attach with a valid plugin key",
+  forbidden: "ACCESS REFUSED \u2014 key is valid but not permitted; ask your org admin"
+};
+var OUTCOME_LINES = {
+  ok: "policy synced",
+  "not-modified": "policy up to date",
+  unauthorized: REFUSAL_LINES.unauthorized,
+  forbidden: REFUSAL_LINES.forbidden,
+  unreachable: "control plane unreachable at last attempt",
+  "invalid-bundle": "control plane sent a policy bundle this build cannot read"
+};
+
+// ../../packages/plugin-runtime/src/attached/sync-trigger.ts
+import { spawn as spawn2 } from "child_process";
+import { fileURLToPath as fileURLToPath3 } from "url";
+var SYNC_THROTTLE_MS = 15 * 60 * 1e3;
+
+// ../../packages/plugin-runtime/src/attached/factory.ts
+import { hostname as hostname5 } from "os";
+
+// ../../packages/plugin-runtime/src/standalone-gateway.ts
+import { randomUUID as randomUUID18 } from "crypto";
+
+// ../../packages/plugin-runtime/src/handle-session-start.ts
+import { randomUUID as randomUUID19 } from "crypto";
+var EXCEPTION_RETENTION_MS = 90 * 24 * 60 * 60 * 1e3;
+
+// src/hooks/store-health.ts
+var STORE_REDIRECT_MARKER = "store-redirect-last-session";
+function markerDirs(dataDir2) {
+  return [dataDir2, dirname6(dataDir2)];
+}
+function alreadyClaimed(dirs, marker, sessionId) {
+  return dirs.some((dir) => {
+    try {
+      return readFileSync15(join24(dir, marker), "utf8") === sessionId;
+    } catch {
+      return false;
+    }
+  });
+}
+function recordClaim(dirs, marker, sessionId) {
+  for (const dir of dirs) {
+    try {
+      mkdirSync5(dir, { recursive: true, mode: DATA_DIR_MODE });
+      writeFileSync8(join24(dir, marker), sessionId, { mode: DATA_FILE_MODE });
+      return;
+    } catch {
+    }
+  }
+}
+function storeRedirectedMessage(paths, platform2 = process.platform) {
+  const where = paths.map(({ path, target, holds, missing, mode }) => {
+    if (missing) return `${path} -> ${target} (which does not exist; ${holds} cannot land there)`;
+    const loose = mode !== void 0 && (mode & 63) !== 0 ? ", NOT owner-only" : "";
+    const inherited = mode === void 0 ? "" : ` (${formatMode(mode)}${loose})`;
+    return `${path} -> ${target}${inherited}, holding ${holds}`;
+  }).join("; ");
+  const subject = paths.length === 1 ? "a store path is a symlink" : `${String(paths.length)} store paths are symlinks`;
+  const anyResolves = paths.some(({ missing }) => !missing);
+  const lead = anyResolves ? `${subject}, so AKA is writing into the target instead: ${where}. ` : `${subject} resolving nowhere, so AKA cannot write there: ${where}. `;
+  const kept = anyResolves && platform2 !== "win32" ? "Permissions are never changed through a symlink, so the store keeps whatever the target already had. " : "";
+  return `[aka] ${lead}${kept}If you did not create that link, treat it as untrusted and run \`aka init\` for the full report.
+`;
+}
+function formatMode(mode) {
+  return `0${mode.toString(8).padStart(3, "0")}`;
+}
+function warnIfStoreRedirected(config2, sessionId, write = (message) => void process.stderr.write(message)) {
+  try {
+    const paths = symlinkedStorePaths(dirname6(config2.dataDir));
+    if (paths.length === 0) return;
+    if (!sessionId) {
+      write(storeRedirectedMessage(paths));
+      return;
+    }
+    const dirs = markerDirs(config2.dataDir);
+    if (alreadyClaimed(dirs, STORE_REDIRECT_MARKER, sessionId)) return;
+    write(storeRedirectedMessage(paths));
+    recordClaim(dirs, STORE_REDIRECT_MARKER, sessionId);
+  } catch {
+  }
+}
+
 // src/hooks/stop.ts
 async function main() {
   const trigger = parseStopPayload(parseJson(await readStdin()));
   if (trigger === void 0) return;
   const config2 = loadConfig();
+  warnIfStoreRedirected(config2, trigger.sessionId);
   triggerReconcile(config2.dataDir, trigger.sessionId, trigger.transcriptPath);
 }
 try {