@bbradar/mcp 0.2.3 → 0.2.6

package/dist/server.js

@@ -5,8 +5,8 @@ import { BBRadarApiError } from "./bbradarClient.js";
 import { NumericCursorStore } from "./cursorStore.js";
 import { stableStringify, stripUndefined } from "./json.js";
 import { FixedWindowRateLimiter } from "./rateLimit.js";
-import { readArray, readBoolean, readNumber, readObject, readString, sanitizeJson, sanitizeChange, sanitizeProgram, sanitizeRepositoryChange, sanitizeTarget, sanitizeTargetsForExport } from "./sanitize.js";
-const SERVER_VERSION = "0.2.3";
+import { readArray, readBoolean, readNumber, readObject, readString, sanitizeJson, sanitizeProPayload, sanitizeChange, sanitizeProgram, sanitizeRepositoryChange, sanitizeTarget, sanitizeTargetsForExport } from "./sanitize.js";
+const SERVER_VERSION = "0.2.6";
 const MAX_PROGRAMS_PER_SEARCH = 100;
 const MAX_TARGET_EXPORT = 500;
 const MAX_RECENT_CHANGES = 100;
@@ -27,6 +27,7 @@ const MAX_HUNT_TARGETS_PER_RESULT = 10;
 const MAX_BULK_PROGRAM_RESOURCE_LINKS = 5;
 const DEFAULT_RESOLVE_UPSTREAM_REQUEST_BUDGET = 12;
 const MAX_ACCEPTED_NUMERIC_LIMIT = 1_000;
+const MAX_UPSTREAM_PAGE = 500;
 const PROGRAM_COLLECTION_CONCURRENCY = 4;
 const TARGET_SAMPLE_CONCURRENCY = 3;
 const DEFAULT_FILTER_DISCOVERY_PAGES = 2;
@@ -63,9 +64,17 @@ const CORE_TOOL_NAMES = new Set([
     "list_filters",
     "get_bbradar_guide",
     "get_mcp_status",
-    "export_targets"
+    "export_targets",
+    "get_history_changes",
+    "get_history_change_detail",
+    "get_program_history",
+    "get_program_activity",
+    "get_analytics_platform_series",
+    "get_analytics_program_activity",
+    "get_analytics_program_detail"
 ]);
 const TOOL_ENDPOINT_REQUIREMENTS = {
+    search_targets: "target_search",
     get_repository_changes: "repository_changes",
     find_repository_hunt_targets: "repository_changes",
     export_targets: "target_export",
@@ -95,7 +104,6 @@ const PROGRAM_ID_PLATFORM_GUESSES = [
 ];
 const PRIMARY_PROGRAM_ID_PLATFORM_GUESSES = PROGRAM_ID_PLATFORM_GUESSES.slice(0, 8);
 const WEB3_TAGS = ["web3", "crypto", "blockchain", "smart-contract", "smart contract", "defi", "nft", "ethereum", "solana", "solidity"];
-const WEB3_CONTEST_SIGNALS = ["contest", "audit", "competitive", "code4rena", "sherlock", "cantina", "codehawks", "hats", "spearbit", "warden"];
 const VDP_SIGNALS = ["vdp", "disclosure", "responsible disclosure", "vulnerability disclosure", "no bounty", "non-bounty", "no reward"];
 const PROGRAM_RESOLUTION_STOP_WORDS = new Set([
     "program",
@@ -183,6 +191,8 @@ const vdpModeSchema = z.enum(["include", "exclude", "only_likely", "only_known_n
 const targetMatchModeSchema = z
     .enum(["smart", "contains", "exact", "suffix", "wildcard"])
     .describe("How to match target_query. smart is forgiving for URLs, wildcards, target names, and partial words.");
+const apiTargetMatchModeSchema = z.enum(["contains", "exact", "suffix", "wildcard"]);
+const targetChangeTypeSchema = z.enum(["added", "readded", "updated", "removed"]);
 const programNameActionSchema = z.enum(["new_targets", "targets", "scope_delta", "brief", "target_breakdown"]);
 const guideTopicSchema = z.enum(["start", "program", "discovery", "freshness", "targets", "compare", "export", "filters"]).default("start");
 const readOnlyAnnotations = {
@@ -241,6 +251,18 @@ const targetQuerySchema = z
 })
     .describe("Target identifier, domain, URL, wildcard, app/package/repo name, or partial target text. URLs and wildcards are normalized automatically.");
 const isoDateTimeSchema = z.string().datetime({ offset: true });
+const stableSnapshotSchema = z
+    .string()
+    .trim()
+    .min(1)
+    .max(1_024)
+    .refine((value) => !/[\u0000-\u001F\u007F]/.test(value), {
+    message: "Snapshot tokens cannot contain control characters."
+})
+    .describe("Optional stable-page token. Send 'start' on page 1, then reuse meta.snapshot with identical filters. Snapshot creation is consistency-first and can be slower; omit it for the fastest live result.");
+const opaqueCursorSchema = z.string().min(1).max(4096).describe("Opaque five-minute cursor. Reuse with identical filters and page size; restart the query on expiry.");
+const analyticsDateSchema = () => z.string().regex(/^\d{4}-\d{2}-\d{2}$/, "Use an inclusive UTC YYYY-MM-DD date.");
+const proLimitSchema = z.number().int().min(1).max(100);
 const pageSchema = z.number().int().min(1).default(1);
 const programsPageSizeSchema = z.number().int().min(1).max(MAX_PROGRAMS_PER_SEARCH).default(20);
 const recentChangesPageSizeSchema = z.number().int().min(1).max(MAX_RECENT_CHANGES).default(50);
@@ -265,7 +287,7 @@ const programIdSchema = z
     .string()
     .trim()
     .min(3)
-    .max(256)
+    .max(620)
     .regex(/^[^:/?#\u0000-\u001F\u007F]+:[^?#\u0000-\u001F\u007F]+$/, "Use platform:handle, for example HackerOne:example-handle.")
     .refine((value) => !/[\u0000-\u001F\u007F]/.test(value), {
     message: "program_id cannot contain control characters."
@@ -300,6 +322,7 @@ function cacheOutputSchema() {
         hit: z.boolean(),
         stale_while_revalidate: z.boolean().optional(),
         coalesced_live_request: z.boolean().optional(),
+        no_store: z.boolean().optional(),
         expires_at: z.string().optional()
     });
 }
@@ -325,6 +348,7 @@ function apiEnvelopeOutputShape() {
         mcp_timing: toolTimingOutputSchema().optional(),
         warnings: z.array(z.string()).optional(),
         program_id_resolution: jsonRecordSchema().optional(),
+        recovery: jsonRecordSchema().optional(),
         error: errorOutputSchema().optional()
     };
 }
@@ -387,7 +411,11 @@ const programCandidatePresetInputSchema = {
 };
 function createProfiledToolRegistrar(server, profile, client) {
     return (name, toolConfig, callback) => {
-        const registeredTool = server.registerTool(name, toolConfig, callback);
+        const scopedCallback = ((...args) => {
+            const extra = args[args.length - 1];
+            return client.withRequestContext(extra.signal, () => callback(...args), readObject(args[0])?.snapshot === "start");
+        });
+        const registeredTool = server.registerTool(name, toolConfig, scopedCallback);
         const requiredEndpoint = TOOL_ENDPOINT_REQUIREMENTS[name];
         if ((profile === "core" && !CORE_TOOL_NAMES.has(name)) ||
             (requiredEndpoint !== undefined && !client.supportsEndpoint(requiredEndpoint))) {
@@ -404,6 +432,7 @@ export function createBbradarServer(client, config) {
             "Use resolve_program or run_program_name_action for a named program.",
             "Use find_hunt_targets once for requests combining good rewards, broad scope, target quality, and recent target additions. Use find_repository_hunt_targets instead when Git or repository activity is explicitly required.",
             "Use find_programs for lower-level program-only discovery and find_programs_by_target for reverse target lookup.",
+            "For semantic changes use get_history_changes or get_program_history, then get_history_change_detail only when before/after items are needed. For exact activity use get_program_activity; for ranked activity use get_analytics_program_activity. Use daily analytics tools directly for date series.",
             "Default to bounty-eligible in-scope data unless the user explicitly requests broader results.",
             "Prefer compact/identifier outputs and disclose sampled ranking scope when present."
         ]
@@ -419,6 +448,7 @@ export function createBbradarServer(client, config) {
             "Self-Hosted programs use Self-Hosted:slug ids and are available through program search, exact detail, and target tools. Respect data_capabilities; do not infer missing opportunity, report-count, target-change, submission-cost, or repository signals.",
             "Freshness: find_recently_updated_programs, get_latest_added_targets, check_program_new_targets, check_watchlist_new_targets, find_recent_by_type, get_program_scope_delta.",
             "Repository activity: get_repository_changes defaults to compact program-only events. Seed with after_id, then resume the in-memory per-filter cursor.",
+            "Semantic History: get_history_changes globally or get_program_history for one exact ID, especially Self-Hosted. Fetch detail lazily with get_history_change_detail. Exact recorded signals: get_program_activity. Server-side rankings: get_analytics_program_activity. Daily series: get_analytics_platform_series or get_analytics_program_detail. Reuse opaque cursors only with unchanged filters and page size.",
             "Discovery: find_hunt_targets is the one-call default; find_program_candidates, find_wildcard_programs, find_recently_added_wildcards, find_low_competition_high_reward, find_stack_matches, find_language_programs, find_target_type_programs, find_reward_programs, find_paid_programs, find_vdp_programs, find_web3_contests, and find_low_noise_programs are lower-level alternatives.",
             "Details: get_program_brief, get_program_scope_summary, get_program_target_breakdown, find_programs_by_target, compare_programs_compact.",
             "Prefer compact/identifier outputs and disclose sampled ranking scope when present."
@@ -436,6 +466,7 @@ export function createBbradarServer(client, config) {
     const feedCursorStore = new NumericCursorStore(config.cursorStatePath, MAX_IN_MEMORY_FEED_CURSORS);
     const maxProgramsPageSize = client.endpointNumber("programs", "max_page_size", MAX_PROGRAMS_PER_SEARCH);
     const maxProgramTargetsPageSize = client.endpointNumber("program_targets", "max_page_size", MAX_TARGETS_PER_PROGRAM);
+    const maxTargetSearchPageSize = client.endpointNumber("target_search", "max_page_size", MAX_TARGETS_PER_PROGRAM);
     const maxTargetChangesPageSize = client.endpointNumber("target_changes", "max_page_size", MAX_RECENT_CHANGES);
     const maxRepositoryChangesPageSize = client.endpointNumber("repository_changes", "max_page_size", MAX_RECENT_CHANGES);
     const maxTargetExport = client.endpointNumber("target_export", "max_targets", MAX_TARGET_EXPORT);
@@ -444,14 +475,93 @@ export function createBbradarServer(client, config) {
     const recentChangesPageSizeSchema = z.number().int().min(1).max(maxTargetChangesPageSize).default(Math.min(50, maxTargetChangesPageSize));
     const repositoryChangesPageSizeSchema = z.number().int().min(1).max(maxRepositoryChangesPageSize).default(Math.min(50, maxRepositoryChangesPageSize));
     const acceptedTargetLimitSchema = z.number().int().min(1).max(maxProgramTargetsPageSize);
+    const targetSearchPageSizeSchema = z.number().int().min(1).max(maxTargetSearchPageSize).default(Math.min(50, maxTargetSearchPageSize));
+    const historyOutput = { ...apiEnvelopeOutputShape(), changes: z.array(jsonRecordSchema()).optional(), coverage: jsonRecordSchema().optional(), meta: jsonRecordSchema().optional() };
+    const analyticsOutput = { ...apiEnvelopeOutputShape(), platform: z.string().optional(), program: jsonRecordSchema().optional(), programs: z.array(jsonRecordSchema()).optional(), series: z.array(jsonRecordSchema()).optional(), observations: jsonRecordSchema().optional(), category: z.string().optional(), population: z.string().optional(), ranking_definition: z.string().optional(), inventory_definition: z.string().optional(), meta: jsonRecordSchema().optional() };
+    registerTool("get_history_changes", {
+        title: "Get Program History Changes",
+        description: "One page of semantic program History. Use get_program_history for an exact program, especially Self-Hosted. History may be partial or unavailable; inspect coverage.",
+        inputSchema: {
+            cursor: opaqueCursorSchema.optional(), days: z.number().int().min(0).max(3650).default(90),
+            platform: z.string().min(1).max(100).optional(), program_id: programIdSchema.optional(),
+            category: z.enum(["scope", "rewards", "rules", "program", "repositories"]).optional(),
+            search: z.string().min(1).max(120).optional(), limit: proLimitSchema.default(50)
+        }, outputSchema: historyOutput, annotations: readOnlyAnnotations
+    }, (args) => runTool("get_history_changes", config, rateLimiter, async () => {
+        assertProFeature(client, "history_changes", "history_capture_enabled");
+        if (args.days === 0 && !args.program_id)
+            throw new Error("days=0 requires program_id; use get_program_history for Self-Hosted catalog IDs.");
+        const api = await client.getHistoryChanges(toQuery(args));
+        return proPage(api, "changes");
+    }));
+    registerTool("get_history_change_detail", {
+        title: "Get History Change Detail",
+        description: "Fetch one semantic History change's paginated before/after items only when needed.",
+        inputSchema: { change_id: z.string().min(1).max(128), cursor: opaqueCursorSchema.optional(), limit: proLimitSchema.default(50) },
+        outputSchema: { ...apiEnvelopeOutputShape(), change: jsonRecordSchema().optional(), items: z.array(jsonRecordSchema()).optional(), meta: jsonRecordSchema().optional() }, annotations: readOnlyAnnotations
+    }, (args) => runTool("get_history_change_detail", config, rateLimiter, async () => {
+        assertProFeature(client, "history_change_detail");
+        assertHistoryCapture(client);
+        return proPage(await client.getHistoryChangeDetail(args.change_id, toQuery({ cursor: args.cursor, limit: args.limit })), "items");
+    }));
+    registerTool("get_program_history", {
+        title: "Get Program History",
+        description: "One page of exact semantic History for a platform:handle or Self-Hosted:slug catalog ID. Preserve archive id and catalog_id separately.",
+        inputSchema: { program_id: programIdSchema, cursor: opaqueCursorSchema.optional(), days: z.number().int().min(0).max(3650).default(90), limit: proLimitSchema.default(50) },
+        outputSchema: historyOutput, annotations: readOnlyAnnotations
+    }, (args) => runTool("get_program_history", config, rateLimiter, async () => {
+        assertProFeature(client, "program_history");
+        assertHistoryCapture(client);
+        return proPage(await client.getProgramHistory(args.program_id, toQuery({ cursor: args.cursor, days: args.days, limit: args.limit })), "changes");
+    }));
+    registerTool("get_program_activity", {
+        title: "Get Exact Program Activity",
+        description: "Read the authoritative activity_summary for one exact program ID.",
+        inputSchema: { program_id: programIdSchema },
+        outputSchema: { ...apiEnvelopeOutputShape(), program_id: z.string().optional(), activity_summary: jsonRecordSchema().optional() }, annotations: readOnlyAnnotations
+    }, (args) => runTool("get_program_activity", config, rateLimiter, async () => {
+        assertProFeature(client, "program_activity");
+        return proPage(await client.getProgramActivity(args.program_id), "activity_summary");
+    }));
+    registerTool("get_analytics_platform_series", {
+        title: "Get Platform Daily Analytics",
+        description: "One page of inclusive UTC daily platform analytics; inspect generation, projection_pending, and tracking_since.",
+        inputSchema: { platform: z.string().min(1).max(100), start: analyticsDateSchema().optional(), end: analyticsDateSchema().optional(), cursor: opaqueCursorSchema.optional(), limit: proLimitSchema.default(100) },
+        outputSchema: analyticsOutput, annotations: readOnlyAnnotations
+    }, (args) => runTool("get_analytics_platform_series", config, rateLimiter, async () => {
+        assertProFeature(client, "analytics_platform_series", "enabled");
+        const { platform, ...query } = args;
+        return proPage(await client.getAnalyticsPlatformSeries(platform, toQuery(query)), "series");
+    }));
+    registerTool("get_analytics_program_activity", {
+        title: "Rank Programs by Recorded Activity",
+        description: "Server-side daily activity ranking. One page; semantic activity excludes baselines and corrections.",
+        inputSchema: { start: analyticsDateSchema().optional(), end: analyticsDateSchema().optional(), platform: z.string().min(1).max(100).optional(), category: z.enum(["all", "scope", "rewards", "rules", "schedule", "costs", "lifecycle"]).default("all"), cursor: opaqueCursorSchema.optional(), limit: proLimitSchema.default(50) },
+        outputSchema: analyticsOutput, annotations: readOnlyAnnotations
+    }, (args) => runTool("get_analytics_program_activity", config, rateLimiter, async () => {
+        assertProFeature(client, "analytics_program_activity", "enabled");
+        return proPage(await client.getAnalyticsProgramActivity(toQuery(args)), "programs");
+    }));
+    registerTool("get_analytics_program_detail", {
+        title: "Get Program Daily Analytics",
+        description: "One page of program daily metrics, carried inventory state, report observations, and source coverage.",
+        inputSchema: { program_id: programIdSchema, start: analyticsDateSchema().optional(), end: analyticsDateSchema().optional(), cursor: opaqueCursorSchema.optional(), limit: proLimitSchema.default(100) },
+        outputSchema: analyticsOutput, annotations: readOnlyAnnotations
+    }, (args) => runTool("get_analytics_program_detail", config, rateLimiter, async () => {
+        assertProFeature(client, "analytics_program_detail", "enabled");
+        const { program_id, ...query } = args;
+        return proPage(await client.getAnalyticsProgramDetail(program_id, toQuery(query)), "series");
+    }));
     registerTool("search_programs", {
         title: "Search BBRadar Programs",
-        description: `Search or list active platform and Self-Hosted programs. page_size max ${MAX_PROGRAMS_PER_SEARCH}.`,
+        description: `Search or list active and confirmed paused platform programs plus active Self-Hosted programs. page_size max ${maxProgramsPageSize}. Stable snapshots are opt-in because creating one can be slower than live indexed pagination.`,
         inputSchema: {
             search: searchTextSchema.optional().describe("Server-side program name, handle, platform, policy-host, or target search."),
+            program_kind: z.enum(["bounty", "contest", "challenge"]).optional(),
             platforms: platformListSchema(),
             tags: tagListSchema(),
             updated_since: isoDateTimeSchema.optional().describe("ISO datetime."),
+            snapshot: stableSnapshotSchema.optional(),
             vdp_mode: vdpModeSchema.default("exclude").describe("VDP/no-bounty filter mode."),
             page: pageSchema,
             page_size: programsPageSizeSchema
@@ -460,6 +570,7 @@ export function createBbradarServer(client, config) {
         annotations: readOnlyAnnotations
     }, (args) => runTool("search_programs", config, rateLimiter, async () => {
         const { vdp_mode, ...filters } = args;
+        assertStableSnapshotSupported(client, "programs", filters.snapshot);
         const api = await client.listPrograms(toQuery(filters));
         const data = readObject(api.data);
         const programs = readArray(data?.programs)
@@ -471,6 +582,47 @@ export function createBbradarServer(client, config) {
             meta: sanitizeJson(data?.meta)
         });
     }));
+    registerTool("search_targets", {
+        title: "Search BBRadar Targets",
+        description: `Low-level reverse target search and current target-inventory paging. q may be omitted for inventory traversal. page_size max ${maxTargetSearchPageSize}. Stable snapshots are opt-in and intentionally not used by find_hunt_targets.`,
+        inputSchema: {
+            q: targetQuerySchema.optional(),
+            match_mode: apiTargetMatchModeSchema.default("contains"),
+            snapshot: stableSnapshotSchema.optional(),
+            platforms: platformListSchema(),
+            tags: tagListSchema(),
+            include_out_of_scope: z.boolean().default(false),
+            include_ineligible: z.boolean().default(false),
+            page: pageSchema,
+            page_size: targetSearchPageSizeSchema,
+            output_mode: targetListModeSchema.default("compact")
+        },
+        outputSchema: {
+            ...apiEnvelopeOutputShape(),
+            results: z.array(jsonRecordSchema()).optional(),
+            meta: jsonRecordSchema().optional(),
+            continuation: jsonRecordSchema().optional()
+        },
+        annotations: readOnlyAnnotations
+    }, (args) => runTool("search_targets", config, rateLimiter, async () => {
+        const { output_mode, ...filters } = args;
+        assertStableSnapshotSupported(client, "target_search", filters.snapshot);
+        const api = await client.searchTargets(toQuery(filters));
+        const data = readObject(api.data);
+        const results = readArray(data?.results).map((value) => {
+            const row = readObject(value) ?? {};
+            const program = sanitizeProgram(row.program, config.webBaseUrl);
+            const target = sanitizeTarget(row.target);
+            return stripUndefined({
+                program: formatProgram(program, output_mode === "full" ? "full" : "compact"),
+                target: output_mode === "full" ? target : compactTarget(target)
+            });
+        });
+        return applyCollectionContinuation(withApiMetadata(api, {
+            results,
+            meta: sanitizeJson(data?.meta)
+        }), "results", "target search results", continuationStore, config);
+    }));
     registerTool("get_program", {
         title: "Get BBRadar Program",
         description: "Get one program by platform:handle program_id, handle, or human program name. Names are resolved automatically when unambiguous.",
@@ -629,7 +781,8 @@ export function createBbradarServer(client, config) {
         title: "Get Recent Target Changes",
         description: `List recent target changes. page_size max ${MAX_RECENT_CHANGES}.`,
         inputSchema: {
-            change_type: z.enum(["added", "updated", "removed"]).optional(),
+            change_type: targetChangeTypeSchema.optional(),
+            snapshot: stableSnapshotSchema.optional(),
             after_id: z.number().int().min(0).optional().describe("Incremental cursor; returns changes after this id in ascending order."),
             resume_cursor: z.boolean().default(false).describe("Resume the in-memory cursor for this exact normalized filter set. Seed it once with after_id."),
             max_cursor_pages: z.number().int().min(1).max(10).default(2),
@@ -658,16 +811,24 @@ export function createBbradarServer(client, config) {
         annotations: readOnlyAnnotations
     }, (args) => runTool("get_recent_changes", config, rateLimiter, async () => {
         const { output_mode, resume_cursor, max_cursor_pages, cursor_time_budget_ms, ...filters } = args;
-        const cursor = resolveFeedCursor(feedCursorStore, "target_changes", filters, resume_cursor);
-        const { min_target_score, target_opportunity_label, competition_risk, ...upstreamFilters } = filters;
-        const collected = await collectCursorFeedPages(feedCursorStore, cursor, max_cursor_pages, cursor_time_budget_ms, (afterId) => client.getRecentChanges(toQuery({
+        assertStableSnapshotSupported(client, "target_changes", filters.snapshot);
+        const cursor = resolveFeedCursor(feedCursorStore, "target_changes", filters, resume_cursor, config);
+        const { min_target_score, target_opportunity_label, competition_risk, snapshot, ...upstreamFilters } = filters;
+        const collected = await collectCursorFeedPages(feedCursorStore, cursor, max_cursor_pages, cursor_time_budget_ms, snapshot, filters.page, (afterId, recoveryProbe, activeSnapshot, pageNumber) => client.getRecentChanges(toQuery({
             ...upstreamFilters,
             minTargetScore: min_target_score,
             targetOpportunityLabel: target_opportunity_label,
             competitionRisk: competition_risk,
+            snapshot: activeSnapshot,
             after_id: afterId,
-            page: afterId === undefined ? filters.page : 1
-        })));
+            page: activeSnapshot ? pageNumber : afterId === undefined ? filters.page : 1
+        }), recoveryProbe ? { cache: false, coalesce: false } : {}), (startPage, recoveryProbe) => refreshInventoryBaseline((page, pageProbe) => client.searchTargets(toQuery({
+            q: upstreamFilters.search,
+            platforms: upstreamFilters.platforms,
+            tags: upstreamFilters.tags,
+            page,
+            page_size: client.endpointNumber("target_search", "max_page_size", 100)
+        }), pageProbe ? { cache: false, coalesce: false } : {}), "results", max_cursor_pages, cursor_time_budget_ms, startPage, recoveryProbe));
         const api = collected.lastApi;
         const data = collected.lastData;
         const sanitizedMeta = readObject(sanitizeJson(data?.meta));
@@ -682,7 +843,9 @@ export function createBbradarServer(client, config) {
                 pages_fetched: collected.pagesFetched,
                 returned_across_pages: changes.length,
                 cursor_page_budget_exhausted: collected.pageBudgetExhausted,
-                cursor_time_budget_exhausted: collected.timeBudgetExhausted
+                cursor_time_budget_exhausted: collected.timeBudgetExhausted,
+                history_gap: collected.gapRecovery !== undefined,
+                inventory_baseline: collected.gapRecovery
             }),
             facets: sanitizeJson(data?.facets),
             cursor: collected.cursor,
@@ -694,6 +857,7 @@ export function createBbradarServer(client, config) {
         description: "Read-only repository push/change feed for direct inspection or polling. Defaults to lightweight program summaries; use after_id for efficient incremental polling. Use find_repository_hunt_targets instead when reward or target-quality ranking is also required.",
         inputSchema: {
             after_id: z.number().int().min(0).optional().describe("Incremental cursor; returns events after this id in ascending order."),
+            snapshot: stableSnapshotSchema.optional(),
             resume_cursor: z.boolean().default(false).describe("Resume the in-memory cursor for this exact normalized filter set. Seed it once with after_id."),
             max_cursor_pages: z.number().int().min(1).max(10).default(2),
             cursor_time_budget_ms: z.number().int().min(100).max(10_000).default(3_000),
@@ -724,12 +888,20 @@ export function createBbradarServer(client, config) {
             throw new Error("The negotiated BBRadar API contract does not expose repository changes.");
         }
         const { output_mode, resume_cursor, max_cursor_pages, cursor_time_budget_ms, ...filters } = args;
-        const cursor = resolveFeedCursor(feedCursorStore, "repository_changes", filters, resume_cursor);
-        const collected = await collectCursorFeedPages(feedCursorStore, cursor, max_cursor_pages, cursor_time_budget_ms, (afterId) => client.getRepositoryChanges(toQuery({
-            ...filters,
+        assertStableSnapshotSupported(client, "repository_changes", filters.snapshot);
+        const cursor = resolveFeedCursor(feedCursorStore, "repository_changes", filters, resume_cursor, config);
+        const { snapshot, ...upstreamFilters } = filters;
+        const collected = await collectCursorFeedPages(feedCursorStore, cursor, max_cursor_pages, cursor_time_budget_ms, snapshot, filters.page, (afterId, recoveryProbe, activeSnapshot, pageNumber) => client.getRepositoryChanges(toQuery({
+            ...upstreamFilters,
+            snapshot: activeSnapshot,
             after_id: afterId,
-            page: afterId === undefined ? filters.page : 1
-        })));
+            page: activeSnapshot ? pageNumber : afterId === undefined ? filters.page : 1
+        }), recoveryProbe ? { cache: false, coalesce: false } : {}), (startPage, recoveryProbe) => refreshInventoryBaseline((page, pageProbe) => client.getRepositoryChanges(toQuery({
+            ...upstreamFilters,
+            after_id: undefined,
+            page,
+            page_size: client.endpointNumber("repository_changes", "max_page_size", 100)
+        }), pageProbe ? { cache: false, coalesce: false } : {}), "results", max_cursor_pages, cursor_time_budget_ms, startPage, recoveryProbe));
         const api = collected.lastApi;
         const data = collected.lastData;
         return applyCollectionContinuation(withApiMetadata(api, {
@@ -740,7 +912,9 @@ export function createBbradarServer(client, config) {
                 pages_fetched: collected.pagesFetched,
                 returned_across_pages: collected.results.length,
                 cursor_page_budget_exhausted: collected.pageBudgetExhausted,
-                cursor_time_budget_exhausted: collected.timeBudgetExhausted
+                cursor_time_budget_exhausted: collected.timeBudgetExhausted,
+                history_gap: collected.gapRecovery !== undefined,
+                inventory_baseline: collected.gapRecovery
             }),
             facets: sanitizeJson(data?.facets),
             available_facets: sanitizeJson(data?.available_facets),
@@ -750,7 +924,7 @@ export function createBbradarServer(client, config) {
     }));
     registerTool("find_hunt_targets", {
         title: "Find Best Hunt Targets",
-        description: "Preferred one-call path for requests combining good rewards, broad Web2/Web3 scope, target quality, competition, and recently added targets. Returns a final ranked shortlist with exact bounded target samples and recent additions; do not fan out into repeated find_programs/get_program_targets calls. Use find_repository_hunt_targets instead only when Git or repository activity is explicitly requested.",
+        description: "Preferred one-call path for requests combining good rewards, broad Web2/Web3 scope, target quality, competition, and recently added targets. Returns a final ranked shortlist with exact bounded target samples and recent additions; do not fan out into repeated find_programs/get_program_targets calls. Self-Hosted is supported through current inventory and automatically skips its unavailable change feed. Use find_repository_hunt_targets instead only when Git or repository activity is explicitly requested.",
         inputSchema: {
             platforms: platformListSchema(),
             exclude_platforms: stringListSchema("Platforms to exclude from the final shortlist."),
@@ -795,7 +969,7 @@ export function createBbradarServer(client, config) {
     }, (args) => runTool("find_hunt_targets", config, rateLimiter, async () => findHuntTargets(client, config, args)));
     registerTool("find_repository_hunt_targets", {
         title: "Find Repository-Aware Hunt Targets",
-        description: "Fast one-call path for requests that combine recent repository activity with program rewards and target quality. Fetches program rankings and repository changes in parallel, joins them locally, and works with arbitrary platforms, Web2/Web3 modes, reward thresholds, target types, languages, and freshness criteria.",
+        description: "Fast one-call path for requests that combine recent repository activity with program rewards and target quality. Fetches program rankings and repository changes in parallel, joins them locally, and works with arbitrary supported platform catalogs, Web2/Web3 modes, reward thresholds, target types, languages, and freshness criteria. Self-Hosted has no repository stream and is rejected without upstream work.",
         inputSchema: {
             platforms: platformListSchema(),
             exclude_platforms: stringListSchema("Platforms to exclude from final matches."),
@@ -916,7 +1090,7 @@ export function createBbradarServer(client, config) {
         inputSchema: {
             program_id: programIdentifierSchema,
             since: isoDateTimeSchema.optional(),
-            change_type: z.enum(["added", "updated", "removed"]).optional(),
+            change_type: targetChangeTypeSchema.optional(),
             target_type: filterValueSchema().optional(),
             language_tags: languageTagListSchema(),
             include_removed: z.boolean().default(true),
@@ -940,7 +1114,7 @@ export function createBbradarServer(client, config) {
         title: "Get Recent Target Activity",
         description: "Recent target changes grouped by program.",
         inputSchema: {
-            change_type: z.enum(["added", "updated", "removed"]).optional(),
+            change_type: targetChangeTypeSchema.optional(),
             target_type: filterValueSchema().optional(),
             include_removed: z.boolean().default(true),
             include_out_of_scope: z.boolean().default(false),
@@ -1050,6 +1224,7 @@ export function createBbradarServer(client, config) {
             target_types: targetTypeListSchema(),
             language_tags: languageTagListSchema(),
             web3: z.boolean().default(false).describe("Require Web3 signals."),
+            program_kind: z.enum(["bounty", "contest", "challenge"]).optional().describe("Source-classified program kind; sent to the Pro program list."),
             exclude_web3: z.boolean().default(false).describe("Exclude programs with Web3, blockchain, smart-contract, crypto, DeFi, NFT, Solidity, Ethereum, or Solana signals. Use this for Web2-only discovery."),
             opportunity_levels: z.array(opportunityLevelSchema).max(4).default([]),
             updated_since: isoDateTimeSchema.optional(),
@@ -1064,7 +1239,7 @@ export function createBbradarServer(client, config) {
             exclude_mobile_only: z.boolean().default(false),
             exclude_non_web: z.boolean().default(false),
             has_api_scope: z.boolean().default(false),
-            contest_like: z.boolean().default(false).describe("Require contest/audit signals."),
+            contest_like: z.boolean().default(false).describe("Require source-classified contests."),
             vdp_mode: vdpModeSchema.default("exclude").describe("VDP/no-bounty filter mode."),
             fresh_launch_days: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).optional(),
             min_wildcards: z.number().int().min(0).max(1000).default(0),
@@ -1426,7 +1601,7 @@ export function createBbradarServer(client, config) {
         description: "Recent changes by target type grouped by program.",
         inputSchema: {
             target_type: filterValueSchema(),
-            change_type: z.enum(["added", "updated", "removed"]).default("added"),
+            change_type: targetChangeTypeSchema.default("added"),
             include_removed: z.boolean().default(false),
             include_out_of_scope: z.boolean().default(false),
             include_ineligible: z.boolean().default(false),
@@ -1692,7 +1867,8 @@ export function createBbradarServer(client, config) {
             ...apiEnvelopeOutputShape(),
             program: programOutputSchema().optional(),
             activity: jsonRecordSchema().optional(),
-            changes: z.array(jsonRecordSchema()).optional()
+            changes: z.array(jsonRecordSchema()).optional(),
+            meta: jsonRecordSchema().optional()
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("summarize_program_activity", config, rateLimiter, async () => runProgramIdTool(client, config, args.program_id, (programId) => summarizeProgramActivity(client, config, programId, args.recent_changes_limit))));
@@ -1896,13 +2072,15 @@ export function createBbradarServer(client, config) {
             const exportId = randomUUID();
             const sanitizedExport = sanitizeTargetsForExport(api.data, args.limit);
             const resourceUri = exportResourceUri(exportId);
-            rememberExport(exportStore, exportId, sanitizedExport);
+            if (!api.noStore)
+                rememberExport(exportStore, exportId, sanitizedExport);
             return withApiMetadata(api, {
                 source_requests: resolvedProgramIds.sourceRequests.length > 0 ? resolvedProgramIds.sourceRequests : undefined,
                 warnings: resolvedProgramIds.warnings.length > 0 ? resolvedProgramIds.warnings : undefined,
                 export: {
-                    export_id: exportId,
-                    resource_uri: resourceUri,
+                    export_id: api.noStore ? undefined : exportId,
+                    resource_uri: api.noStore ? undefined : resourceUri,
+                    data: api.noStore ? sanitizedExport : undefined,
                     preview: previewExportPayload(sanitizedExport),
                     returned_preview_count: previewExportCount(sanitizedExport),
                     limit: args.limit
@@ -1999,6 +2177,9 @@ function bbradarGuide(topic, profile, client) {
             arguments: { include_targets: false, max_cursor_pages: 2 },
             then: "For incremental polling, seed once with after_id and later set resume_cursor=true with the same filters."
         },
+        { user_goal: "semantic program change history", first_tool: "get_program_history", arguments: { program_id: "Platform:handle" }, then: "Fetch get_history_change_detail only for a selected change." },
+        { user_goal: "most active programs in a date range", first_tool: "get_analytics_program_activity", arguments: {}, then: "Use this server-side ranking rather than sampling the program catalog." },
+        { user_goal: "exact recorded activity for one program", first_tool: "get_program_activity", arguments: { program_id: "Platform:handle" } },
         {
             user_goal: "hunt targets combining repository activity with rewards, target quality, platforms, or Web2/Web3 constraints",
             first_tool: "find_repository_hunt_targets",
@@ -2141,6 +2322,9 @@ function coreBbradarGuide(topic, client) {
             first_tool: "get_repository_changes",
             arguments: { include_targets: false, max_cursor_pages: 2 }
         },
+        { user_goal: "semantic program change history", first_tool: "get_program_history", arguments: { program_id: "Platform:handle" }, then: "Fetch change detail only when needed." },
+        { user_goal: "most active programs", first_tool: "get_analytics_program_activity", arguments: {} },
+        { user_goal: "exact recorded activity", first_tool: "get_program_activity", arguments: { program_id: "Platform:handle" } },
         {
             user_goal: "hunt targets combining repository activity with rewards, target quality, platforms, or Web2/Web3 constraints",
             first_tool: "find_repository_hunt_targets",
@@ -2518,7 +2702,7 @@ function getCachedProgramFallback(config, requestedProgramId) {
     return cloneProgramFallbackForRequest(cached.fallback, requestedProgramId, true);
 }
 function rememberProgramFallback(config, fallback) {
-    if (config.cacheTtlMs <= 0 || config.cacheMaxEntries <= 0) {
+    if (config.cacheTtlMs <= 0 || config.cacheMaxEntries <= 0 || hasNoStoreSource(fallback.sourceRequests)) {
         return;
     }
     pruneProgramFallbackCache();
@@ -2543,7 +2727,13 @@ function pruneProgramFallbackCache() {
     }
 }
 function programFallbackCacheKey(config, requestedProgramId) {
-    return `${config.apiBaseUrl}\n${normalizeTag(requestedProgramId)}`;
+    return `${config.apiBaseUrl}\n${credentialCacheScope(config)}\n${isStrictProgramId(requestedProgramId) ? requestedProgramId : normalizeTag(requestedProgramId)}`;
+}
+function credentialCacheScope(config) {
+    return createHash("sha256").update(config.apiKey).digest("hex");
+}
+function hasNoStoreSource(sourceRequests) {
+    return sourceRequests.some((request) => readBoolean(request.no_store) === true);
 }
 function cloneProgramFallbackForRequest(fallback, requestedProgramId, fromCache) {
     const warnings = fromCache
@@ -2997,7 +3187,8 @@ function getCachedResolveProgram(config, input) {
     });
 }
 function rememberResolveProgram(config, input, payload) {
-    if (config.cacheTtlMs <= 0 || config.cacheMaxEntries <= 0) {
+    const sourceRequests = readArray(payload.source_requests).filter((request) => readObject(request) !== undefined);
+    if (config.cacheTtlMs <= 0 || config.cacheMaxEntries <= 0 || hasNoStoreSource(sourceRequests)) {
         return;
     }
     pruneResolveProgramCache();
@@ -3023,7 +3214,8 @@ function pruneResolveProgramCache() {
 function resolveProgramCacheKey(config, input) {
     return stableStringify({
         apiBaseUrl: config.apiBaseUrl,
-        query: normalizeTag(input.query),
+        credentialScope: credentialCacheScope(config),
+        query: isStrictProgramId(input.query) ? input.query : normalizeTag(input.query),
         platforms: input.platforms.map(normalizeTag).sort(),
         tags: input.tags.map(normalizeTag).sort(),
         opportunity_levels: [...input.opportunity_levels].sort(),
@@ -4231,8 +4423,9 @@ async function comparePrograms(client, config, input) {
     });
 }
 async function summarizeProgramActivity(client, config, programId, recentChangesLimit) {
-    const [programApi, changes] = await Promise.all([
+    const [programApi, activityApi, changes] = await Promise.all([
         client.getProgram(programId),
+        client.supportsEndpoint("program_activity") ? client.getProgramActivity(programId) : Promise.resolve(undefined),
         recentChangesLimit > 0
             ? fetchProgramChanges(client, config, programId, recentChangesLimit, true, true, true)
             : Promise.resolve(undefined)
@@ -4249,15 +4442,18 @@ async function summarizeProgramActivity(client, config, programId, recentChanges
                 upstream_request_id: programApi.upstreamRequestId,
                 ...apiSourceMetadata(programApi)
             },
+            ...(activityApi ? [{ source: "program_activity", request_id: activityApi.requestId, upstream_request_id: activityApi.upstreamRequestId, ...apiSourceMetadata(activityApi) }] : []),
             ...(changes?.sourceRequests ?? [])
         ],
         program,
         activity: stripUndefined({
+            activity_summary: activityApi ? sanitizeProPayload(readObject(activityApi.data)?.activity_summary) : undefined,
             target_counts: readObject(scopeSummary?.target_counts),
             target_activity: targetActivity,
             recent_change_count: changes?.changes.length
         }),
-        changes: changes?.changes ?? []
+        changes: changes?.changes ?? [],
+        meta: { target_change_samples_are_semantic_history: false, activity_source: activityApi ? "pro_activity_endpoint" : "legacy_program_projection" }
     };
 }
 async function getLatestAddedTargets(client, config, input) {
@@ -4407,21 +4603,50 @@ function latestAddedProgramMatches(change, input, platformFilters) {
     return true;
 }
 async function getProgramTargetsPayload(client, input, programId) {
-    const api = await client.getProgramTargets(programId, {
-        search: input.search,
-        target_type: input.target_type,
-        eligibility: input.include_ineligible ? "all" : "eligible",
-        minTargetScore: input.min_target_score,
-        targetOpportunityLabel: input.target_opportunity_label,
-        competitionRisk: input.competition_risk,
-        page: 1,
-        page_size: client.endpointNumber("program_targets", "max_page_size", MAX_TARGETS_PER_PROGRAM)
-    });
-    const data = readObject(api.data);
-    const upstreamMeta = readObject(data?.meta);
-    const rawTargets = readArray(data?.targets);
-    const sanitizedTargets = rawTargets.map(sanitizeTarget).filter((target) => targetHasAllowedScope(target, input));
-    const targets = sanitizedTargets.slice(input.offset, input.offset + input.limit);
+    const pageSize = client.endpointNumber("program_targets", "max_page_size", MAX_TARGETS_PER_PROGRAM);
+    // `eligibility=eligible` is an API-level in-scope bounty-eligibility filter,
+    // so the common eligible-only path needs no second local scope pass.
+    const directOffsetPaging = !input.include_ineligible || (!input.strict_scope_filter && input.include_out_of_scope);
+    const collected = [];
+    let matchedSeen = directOffsetPaging ? Math.floor(input.offset / pageSize) * pageSize : 0;
+    let page = directOffsetPaging ? Math.floor(input.offset / pageSize) + 1 : 1;
+    const firstPage = page;
+    let api;
+    let upstreamMeta;
+    let upstreamHasMore = false;
+    do {
+        api = await client.getProgramTargets(programId, {
+            search: input.search,
+            target_type: input.target_type,
+            eligibility: input.include_ineligible ? "all" : "eligible",
+            minTargetScore: input.min_target_score,
+            targetOpportunityLabel: input.target_opportunity_label,
+            competitionRisk: input.competition_risk,
+            page,
+            page_size: pageSize
+        });
+        const data = readObject(api.data);
+        upstreamMeta = readObject(data?.meta);
+        for (const target of readArray(data?.targets).map(sanitizeTarget)) {
+            if (!targetHasAllowedScope(target, input))
+                continue;
+            if (matchedSeen >= input.offset && collected.length < input.limit)
+                collected.push(target);
+            matchedSeen += 1;
+        }
+        upstreamHasMore = readBoolean(upstreamMeta?.has_more) === true;
+        const totalPages = readNumber(upstreamMeta?.total_pages);
+        page += 1;
+        if (totalPages !== undefined && page > totalPages) {
+            upstreamHasMore = false;
+        }
+    } while (upstreamHasMore &&
+        page <= MAX_UPSTREAM_PAGE &&
+        collected.length < input.limit);
+    if (!api) {
+        throw new Error("No program target response was collected.");
+    }
+    const targets = collected;
     return withApiMetadata(api, {
         program_id: programId,
         targets: formatTargetList(targets, input.output_mode),
@@ -4429,12 +4654,16 @@ async function getProgramTargetsPayload(client, input, programId) {
             offset: input.offset,
             limit: input.limit,
             output_mode: input.output_mode,
-            total_active_targets: readNumber(upstreamMeta?.total) ?? rawTargets.length,
-            total_after_filters: sanitizedTargets.length,
+            total_active_targets: readNumber(upstreamMeta?.total) ?? matchedSeen,
+            total_after_filters: upstreamHasMore ? undefined : matchedSeen,
             returned: targets.length,
-            has_more: input.offset + input.limit < sanitizedTargets.length || readBoolean(upstreamMeta?.has_more) === true,
-            upstream_has_more: readBoolean(upstreamMeta?.has_more),
-            possibly_incomplete: readBoolean(upstreamMeta?.has_more) === true,
+            has_more: upstreamHasMore || matchedSeen > input.offset + targets.length,
+            upstream_has_more: upstreamHasMore,
+            possibly_incomplete: upstreamHasMore,
+            upstream_pages_fetched: page - firstPage,
+            upstream_start_page: firstPage,
+            direct_offset_paging: directOffsetPaging,
+            upstream_page_limit_reached: upstreamHasMore && page > MAX_UPSTREAM_PAGE,
             data_capabilities: readObject(upstreamMeta?.data_capabilities),
             target_source: "program_targets"
         }
@@ -4480,10 +4709,12 @@ async function fetchProgramTargetsWithEndpointFallback(client, programId) {
             requestId: api.requestId,
             upstreamRequestId: api.upstreamRequestId,
             fetchedAt: api.fetchedAt,
+            noStore: api.noStore,
             cache: readObject(stripUndefined({
                 hit: api.cached,
                 coalesced_live_request: api.coalesced,
-                expires_at: api.cacheExpiresAt
+                expires_at: api.cacheExpiresAt,
+                no_store: api.noStore
             })),
             source: "program_targets",
             rawTargets,
@@ -4541,7 +4772,7 @@ function getCachedProgramTargetsFallback(client, programId) {
 }
 function rememberProgramTargetsFallback(client, programId, lookup) {
     const diagnostics = client.diagnostics();
-    if (!diagnostics.response_cache.enabled || lookup.unavailable) {
+    if (!diagnostics.response_cache.enabled || lookup.unavailable || lookup.noStore) {
         return;
     }
     const cache = programTargetsFallbackCacheForClient(client);
@@ -4579,7 +4810,7 @@ function pruneProgramTargetsFallbackCache(cache) {
     }
 }
 function programTargetsFallbackCacheKey(programId) {
-    return normalizeTag(programId);
+    return programId;
 }
 function cacheTtlMsFromDiagnostics(cache) {
     return cache.enabled ? cache.ttl_ms : 0;
@@ -4598,10 +4829,12 @@ async function fetchProgramTargetsFromExportFallback(client, programId) {
             requestId: api.requestId,
             upstreamRequestId: api.upstreamRequestId,
             fetchedAt: api.fetchedAt,
+            noStore: api.noStore,
             cache: readObject(stripUndefined({
                 hit: api.cached,
                 coalesced_live_request: api.coalesced,
-                expires_at: api.cacheExpiresAt
+                expires_at: api.cacheExpiresAt,
+                no_store: api.noStore
             })),
             source: "target_export",
             rawTargets,
@@ -4648,7 +4881,8 @@ async function getProgramFromTargetsOnlyFallback(client, programId, programError
         cache: readObject(stripUndefined({
             hit: targetsApi.cached,
             coalesced_live_request: targetsApi.coalesced,
-            expires_at: targetsApi.cacheExpiresAt
+            expires_at: targetsApi.cacheExpiresAt,
+            no_store: targetsApi.noStore
         })),
         source_requests: [
             stripUndefined({
@@ -4793,8 +5027,6 @@ async function exportTargetsFromProgramTargetsFallback(client, config, exportSto
         generated_at: new Date().toISOString()
     });
     const exportId = randomUUID();
-    const resourceUri = exportResourceUri(exportId);
-    rememberExport(exportStore, exportId, exportPayload);
     return stripUndefined({
         request_id: randomUUID(),
         source_requests: sourceRequests,
@@ -4802,7 +5034,7 @@ async function exportTargetsFromProgramTargetsFallback(client, config, exportSto
         errors: errors.length > 0 ? errors : undefined,
         export: {
             export_id: exportId,
-            resource_uri: resourceUri,
+            data: exportPayload,
             preview: previewExportPayload(exportPayload),
             returned_preview_count: previewExportCount(exportPayload),
             limit: input.limit
@@ -5529,6 +5761,10 @@ function applyCollectionContinuation(payload, field, label, store, config) {
     if (!items || items.length <= inlineLimit) {
         return payload;
     }
+    // A no-store page stays only in this tool result, never in a reusable resource.
+    if (readBoolean(readObject(payload.cache)?.no_store) === true) {
+        return payload;
+    }
     const continuationId = randomUUID();
     const expiresAt = Date.now() + (config.continuationTtlMs ?? LOCAL_EXPORT_TTL_MS);
     const stored = rememberContinuation(store, continuationId, label, items, expiresAt);
@@ -5785,28 +6021,41 @@ function formatProgram(program, mode) {
 function compactProgram(program) {
     return stripUndefined({
         id: stringField(program, "id"),
+        catalog_id: stringField(program, "catalog_id"),
         handle: stringField(program, "handle"),
         name: stringField(program, "name"),
         platform: stringField(program, "platform"),
         catalog: stringField(program, "catalog"),
+        program_kind: stringField(program, "program_kind"),
+        program_status: stringField(program, "program_status"),
+        is_active: readBoolean(program.is_active),
         program_type: stringField(program, "program_type"),
         platform_url: stringField(program, "platform_url"),
         bbradar_url: stringField(program, "bbradar_url"),
         policy_url: stringField(program, "policy_url"),
         reporting_url: stringField(program, "reporting_url"),
         reward_status: stringField(program, "reward_status"),
-        data_capabilities: readObject(program.data_capabilities),
-        opportunity_tag: readObject(program.opportunity_tag),
+        data_capabilities: program.data_capabilities,
+        opportunity_tag: program.opportunity_tag,
         competition_risk: stringField(program, "competition_risk"),
         competition_risk_reason: stringField(program, "competition_risk_reason"),
-        submission_cost: readObject(program.submission_cost),
-        reward_range: readObject(program.reward_range),
-        public_report_count: readNumber(program.public_report_count),
+        submission_cost: program.submission_cost,
+        reward_range: program.reward_range,
+        reward_range_label: stringField(program, "reward_range_label"),
+        public_report_count: program.public_report_count,
         public_report_count_label: stringField(program, "public_report_count_label"),
         first_seen_date: stringField(program, "first_seen_date"),
+        launch_at: program.launch_at,
+        launch_at_precision: stringField(program, "launch_at_precision"),
+        ends_at: program.ends_at,
+        ends_on: program.ends_on,
+        verification: program.verification,
         last_updated: stringField(program, "last_updated"),
         targets_updated_at: stringField(program, "targets_updated_at"),
         scope_summary: readObject(program.scope_summary),
+        match_qualities: Array.isArray(program.match_qualities)
+            ? readStringArrayField(program, "match_qualities")
+            : undefined,
         resource_links: readObject(program.resource_links)
     });
 }
@@ -5867,6 +6116,7 @@ function formatRepositoryChange(change, mode) {
             })
             : undefined,
         changes_url: stringField(change, "changes_url"),
+        comparison: sanitizeJson(change.comparison),
         programs: readArray(change.programs).map((program) => formatProgram(readObject(program) ?? {}, "compact")),
         targets: Array.isArray(change.targets)
             ? change.targets.map((target) => compactTarget(readObject(target) ?? {}))
@@ -6121,7 +6371,7 @@ function candidateLooksLikeCtf(candidate) {
     return candidate.looksLikeCtf;
 }
 function candidateLooksContestLike(candidate) {
-    return tagIncludesAnyNormalized(candidate.normalizedSearchSignals, WEB3_CONTEST_SIGNALS);
+    return stringField(candidate.program, "program_kind") === "contest";
 }
 function candidateHasKnownNoBounty(candidate) {
     const programType = normalizeTag(stringField(candidate.program, "program_type") ?? "");
@@ -6351,7 +6601,11 @@ function clampLimit(name, value, max, warnings) {
 async function findHuntTargets(client, config, input) {
     const warnings = [];
     const errors = [];
-    const recentChangesEnabled = input.include_recent_changes && client.supportsEndpoint("target_changes");
+    const selfHostedOnly = isSelfHostedOnlyPlatformSelection(input.platforms);
+    const targetChangesEndpointSupported = client.supportsEndpoint("target_changes");
+    const recentChangesEnabled = input.include_recent_changes &&
+        !selfHostedOnly &&
+        targetChangesEndpointSupported;
     const desiredRecentChangeQueries = recentChangesEnabled ? huntRecentChangeQueries(input) : [];
     const recentChangeQueries = desiredRecentChangeQueries.slice(0, Math.max(0, input.upstream_request_budget - 2));
     const recentRequestReserve = recentChangeQueries.length;
@@ -6399,7 +6653,10 @@ async function findHuntTargets(client, config, input) {
         output_mode: "compact",
         upstream_request_budget: programRequestBudget
     };
-    if (input.include_recent_changes && !recentChangesEnabled) {
+    if (input.include_recent_changes && selfHostedOnly) {
+        warnings.push("Self-Hosted does not expose target-change history; recent target evidence was derived only from current target-inventory timestamps.");
+    }
+    else if (input.include_recent_changes && !recentChangesEnabled) {
         warnings.push("The negotiated API contract does not expose target changes; ranked current programs without recent-change enrichment.");
     }
     else if (recentChangeQueries.length < desiredRecentChangeQueries.length) {
@@ -6502,6 +6759,7 @@ async function findHuntTargets(client, config, input) {
             exact_target_programs_sampled: targetResult.targetsByProgram.size,
             recent_changes_scanned: recentResult.changes.length,
             recent_programs_matched: recentByProgram.size,
+            recent_change_catalog_supported: !selfHostedOnly && targetChangesEndpointSupported,
             model_round_trips_expected: 1,
             parallel_recent_change_fetch: recentChangeQueries.length > 0,
             bulk_resource_links_suppressed: true,
@@ -6747,7 +7005,9 @@ function buildHuntTargetMatch(entry, targetsByProgram, recentByProgram, input) {
         (readNumber(rankFactors.target_surface_score) ?? 0) * 0.25);
     const freshnessScore = huntFreshnessScore(latestRecentAt, recentTargets.length, readNumber(rankFactors.added_7d));
     const publicReports = readNumber(rankFactors.public_report_count);
-    const competitionScore = publicReports === undefined ? 50 : Math.max(0, 100 - Math.min(100, publicReports / 10));
+    // Missing report evidence is unknown, not low competition. Keep the
+    // internal ranking conservative and do not expose a made-up numeric signal.
+    const competitionScore = publicReports === undefined ? 20 : Math.max(0, 100 - Math.min(100, publicReports / 10));
     const bestTargetScore = Math.max(0, ...targetSamples.map((target) => readNumber(target.target_opportunity_score) ?? 0));
     const baseHuntScore = readNumber(rankFactors.hunt_value_score) ?? 0;
     const compositeScore = huntCompositeScore(input.ranking_mode, baseHuntScore, rewardScore, scopeScore, freshnessScore, competitionScore, bestTargetScore);
@@ -6775,7 +7035,8 @@ function buildHuntTargetMatch(entry, targetsByProgram, recentByProgram, input) {
                 reward_score: roundScore(rewardScore),
                 scope_score: roundScore(scopeScore),
                 freshness_score: roundScore(freshnessScore),
-                competition_score: roundScore(competitionScore),
+                competition_score: publicReports === undefined ? undefined : roundScore(competitionScore),
+                competition_signal: publicReports === undefined ? "unknown" : "public_report_count",
                 best_sample_target_score: bestTargetScore > 0 ? bestTargetScore : undefined,
                 recent_added_targets_in_window: recentTargets.length,
                 latest_added_target_at: latestRecentAt,
@@ -6880,11 +7141,52 @@ function compareHuntTargetMatches(left, right, mode) {
 }
 async function findRepositoryHuntTargets(client, config, input) {
     const warnings = [];
+    const repositoryPlatforms = input.platforms.filter((platform) => !isSelfHostedPlatform(platform));
+    const selfHostedRequested = repositoryPlatforms.length !== input.platforms.length;
+    if (input.platforms.length > 0 && repositoryPlatforms.length === 0) {
+        return {
+            request_id: randomUUID(),
+            fetched_at: new Date().toISOString(),
+            source_requests: [],
+            warnings: [
+                "Self-Hosted does not expose repository-change events or target intelligence, so repository-aware hunting is unavailable for this catalog. Use find_hunt_targets for current Self-Hosted program and target inventory."
+            ],
+            filters: {
+                platforms: input.platforms,
+                surface_mode: input.surface_mode,
+                ranking_mode: input.ranking_mode,
+                output_mode: input.output_mode
+            },
+            upstream_budget: {
+                initial: input.upstream_request_budget,
+                used: 0,
+                remaining: input.upstream_request_budget
+            },
+            ranking_scope: {
+                mode: "unsupported_catalog",
+                possibly_incomplete: false
+            },
+            programs: [],
+            matches: [],
+            meta: {
+                returned: 0,
+                matched_programs: 0,
+                program_candidates: 0,
+                repository_events_scanned: 0,
+                qualifying_targets_before_result_limit: 0,
+                repository_request_attempts: 0,
+                parallel_source_fetch: false
+            }
+        };
+    }
+    if (selfHostedRequested) {
+        warnings.push("Self-Hosted was excluded from repository-aware matching because that catalog has no repository-change stream; other requested platforms were processed normally.");
+    }
     const repositoryRequestReserve = input.upstream_request_budget >= 3 ? 2 : 1;
     const programRequestBudget = Math.max(1, input.upstream_request_budget - repositoryRequestReserve);
     const programInput = {
-        platforms: input.platforms,
-        exclude_platforms: input.exclude_platforms,
+        platforms: repositoryPlatforms,
+        exclude_platforms: uniqueStrings([...input.exclude_platforms, "Self-Hosted"]),
         tags: input.tags,
         scope_tags: input.scope_tags,
         target_types: input.target_types,
@@ -6926,7 +7228,7 @@ async function findRepositoryHuntTargets(client, config, input) {
     };
     const [programPayload, repository] = await Promise.all([
         findPrograms(client, config, programInput),
-        fetchRepositoryHuntPage(client, input, warnings, repositoryRequestReserve)
+        fetchRepositoryHuntPage(client, { ...input, platforms: repositoryPlatforms }, warnings, repositoryRequestReserve)
     ]);
     const candidatePrograms = readArray(programPayload.programs)
         .map(readObject)
@@ -7175,6 +7477,7 @@ async function findPrograms(client, config, input) {
     const collected = await collectPrograms(client, {
         platforms: input.platforms,
         tags: upstreamTags,
+        program_kind: input.program_kind ?? (input.contest_like ? "contest" : undefined),
         updated_since: input.updated_since,
         opportunity_levels: input.opportunity_levels,
         max_pages: input.max_pages,
@@ -7223,6 +7526,7 @@ async function findPrograms(client, config, input) {
             exclude_non_web: input.exclude_non_web,
             has_api_scope: input.has_api_scope,
             contest_like: input.contest_like ? true : undefined,
+            program_kind: input.program_kind,
             vdp_mode: input.vdp_mode && input.vdp_mode !== "include" ? input.vdp_mode : undefined,
             fresh_launch_days: input.fresh_launch_days,
             min_wildcards: input.min_wildcards,
@@ -7652,6 +7956,7 @@ async function fetchProgramPage(client, source, sourceIndex, page, options) {
             platforms: options.platforms,
             tags: options.tags,
             updated_since: options.updated_since,
+            program_kind: source.kind === "programs" ? options.program_kind : undefined,
             page,
             page_size: MAX_PROGRAMS_PER_SEARCH
         });
@@ -7737,6 +8042,13 @@ function toProgramCandidate(rawProgram, webBaseUrl) {
     return candidate;
 }
 function programCandidateMatches(candidate, filters) {
+    if (filters.program_kind && stringField(candidate.program, "program_kind") !== filters.program_kind) {
+        return false;
+    }
+    const programStatus = normalizeTag(stringField(candidate.program, "program_status") ?? "");
+    if (readBoolean(candidate.program.is_active) === false || programStatus === "paused") {
+        return false;
+    }
     if (filters.platforms.length > 0 && !filters.platforms.map(normalizeTag).includes(normalizeTag(stringField(candidate.program, "platform") ?? ""))) {
         return false;
     }
@@ -8062,6 +8374,12 @@ function uniqueStrings(values) {
 function normalizeTag(value) {
     return value.trim().toLowerCase();
 }
+function isSelfHostedPlatform(value) {
+    return normalizeTag(value).replace(/[\s_]+/g, "-") === "self-hosted";
+}
+function isSelfHostedOnlyPlatformSelection(platforms) {
+    return platforms.length > 0 && platforms.every(isSelfHostedPlatform);
+}
 function tokenSet(value) {
     return new Set(value.split(/[^a-z0-9]+/).filter((token) => token.length >= 2));
 }
@@ -8089,7 +8407,7 @@ function registerPrompts(server, profile) {
             tags: z.string().optional().describe("Optional comma-separated scope/language/target-type tags."),
             max_programs: z.string().optional().describe("Optional maximum shortlist size.")
         }
-    }, (args) => promptResult(`Use the BBRadar MCP tools only. Do not invoke local bug bounty skills, methodology files, worklogs, or non-BBRadar tools unless the user explicitly asks for methodology. Do not perform active scanning or contact third-party targets. Treat results as fresh API reads; do not describe them as cached.
+    }, (args) => promptResult(`Use the BBRadar MCP tools only. Do not invoke local bug bounty skills, methodology files, worklogs, or non-BBRadar tools unless the user explicitly asks for methodology. Do not perform active scanning or contact third-party targets. Check each result's cache metadata before describing its freshness.
 
 Find the best BBRadar program candidates.
 ${discoveryToolInstructions}
@@ -8140,8 +8458,12 @@ The plan must:
 - Prioritize targets by bounty eligibility, freshness, wildcard status, target type, and severity labels.
 - Include a short checklist of BBRadar follow-up tool calls and decision points.`));
 }
-function resolveFeedCursor(store, endpoint, filters, resume) {
-    const normalizedFilters = stableStringify(normalizeFeedCursorFilters(filters));
+function resolveFeedCursor(store, endpoint, filters, resume, config) {
+    const normalizedFilters = stableStringify({
+        api_base_url: config.apiBaseUrl,
+        credential_scope: credentialCacheScope(config),
+        filters: normalizeFeedCursorFilters(filters)
+    });
     const key = `${endpoint}:${createHash("sha256").update(normalizedFilters).digest("hex")}`;
     const explicitAfterId = readNumber(filters.after_id);
     if (explicitAfterId !== undefined) {
@@ -8172,7 +8494,7 @@ function advanceFeedCursor(store, cursor, rawMeta) {
         stored_in_memory: true
     };
 }
-async function collectCursorFeedPages(store, initialCursor, maxPages, timeBudgetMs, fetchPage) {
+async function collectCursorFeedPages(store, initialCursor, maxPages, timeBudgetMs, initialSnapshot, initialPage, fetchPage, refreshInventory) {
     const startedAt = Date.now();
     const results = [];
     const sourceRequests = [];
@@ -8184,9 +8506,114 @@ async function collectCursorFeedPages(store, initialCursor, maxPages, timeBudget
     let hasMore = false;
     let pageBudgetExhausted = false;
     let timeBudgetExhausted = false;
+    let gapRecovery;
+    let activeSnapshot = initialSnapshot;
     do {
-        const api = await fetchPage(currentCursor.afterId);
+        let api;
+        try {
+            api = await fetchPage(currentCursor.afterId, undefined, activeSnapshot, activeSnapshot ? initialPage + pagesFetched : 1);
+            feedRecoveryProgress.get(store)?.delete(currentCursor.key);
+        }
+        catch (error) {
+            if (!(error instanceof BBRadarApiError) ||
+                error.status !== 410 ||
+                currentCursor.afterId === undefined ||
+                activeSnapshot !== undefined ||
+                !refreshInventory) {
+                throw error;
+            }
+            const recoveryNonce = `${Date.now()}-${currentCursor.afterId}`;
+            const markerApi = await fetchPage(undefined, `${recoveryNonce}-marker`);
+            const markerData = readObject(markerApi.data);
+            const markerAfterId = feedBaselineAfterId(markerData);
+            let progress = feedRecoveryProgress.get(store)?.get(currentCursor.key);
+            let restartedForDrift = false;
+            if (progress && (progress.previousAfterId !== currentCursor.afterId ||
+                progress.baselineAfterId !== markerAfterId)) {
+                feedRecoveryProgress.get(store)?.delete(currentCursor.key);
+                progress = undefined;
+                restartedForDrift = true;
+            }
+            const beforeAfterId = progress?.baselineAfterId ?? markerAfterId;
+            const startPage = progress?.nextPage ?? 1;
+            const inventoryPart = await refreshInventory(startPage, `${recoveryNonce}-inventory`);
+            const inventory = {
+                ...inventoryPart,
+                rows_observed: (progress?.rowsObserved ?? 0) + (readNumber(inventoryPart.rows_observed) ?? 0),
+                pages_fetched: (progress?.pagesFetched ?? 0) + (readNumber(inventoryPart.pages_fetched) ?? 0),
+                resumed_from_page: startPage,
+                restarted_for_feed_drift: restartedForDrift
+            };
+            const inventoryComplete = readBoolean(inventory.complete) === true;
+            const endpointPageLimitReached = readBoolean(inventory.endpoint_page_limit_reached) === true;
+            const afterApi = inventoryComplete ? await fetchPage(undefined, `${recoveryNonce}-after`) : markerApi;
+            const afterData = readObject(afterApi.data);
+            const afterAfterId = feedBaselineAfterId(afterData);
+            const baselineStable = inventoryComplete && beforeAfterId !== undefined && beforeAfterId === afterAfterId;
+            const nextAfterId = baselineStable ? beforeAfterId : currentCursor.afterId;
+            if (baselineStable) {
+                store.set(currentCursor.key, nextAfterId);
+                feedRecoveryProgress.get(store)?.delete(currentCursor.key);
+            }
+            else if (!inventoryComplete && !endpointPageLimitReached && beforeAfterId !== undefined) {
+                // Persist only the unchanged expired bookmark so resume_cursor can
+                // continue recovery without treating partial inventory as a baseline.
+                store.set(currentCursor.key, currentCursor.afterId);
+                setRecoveryCheckpoint(store, currentCursor.key, {
+                    previousAfterId: currentCursor.afterId,
+                    baselineAfterId: beforeAfterId,
+                    nextPage: readNumber(inventoryPart.next_page) ?? startPage,
+                    rowsObserved: readNumber(inventory.rows_observed) ?? 0,
+                    pagesFetched: readNumber(inventory.pages_fetched) ?? 0
+                });
+            }
+            else {
+                // A failed first explicit recovery must remain resumable even when no
+                // safe inventory checkpoint can be retained.
+                store.set(currentCursor.key, currentCursor.afterId);
+                feedRecoveryProgress.get(store)?.delete(currentCursor.key);
+            }
+            gapRecovery = {
+                historical_gap: true,
+                current_inventory_refreshed: inventoryComplete,
+                recovery_complete: baselineStable,
+                retained_previous_cursor: !baselineStable,
+                incomplete_reason: !inventoryComplete
+                    ? endpointPageLimitReached ? "inventory_endpoint_page_limit_reached" : "inventory_page_or_time_budget_exhausted"
+                    : beforeAfterId === undefined
+                        ? "feed_baseline_unavailable"
+                        : beforeAfterId !== afterAfterId
+                            ? "feed_changed_during_inventory_refresh"
+                            : undefined,
+                inventory,
+                next_inventory_page: baselineStable ? undefined : readNumber(inventoryPart.next_page),
+                previous_after_id: currentCursor.afterId,
+                baseline_after_id: baselineStable ? nextAfterId : undefined,
+                baseline_events_emitted: 0,
+                limitation: "Changes retired before recovery cannot be reconstructed."
+            };
+            lastApi = afterApi;
+            lastData = afterData;
+            cursorPayload = {
+                endpoint: currentCursor.endpoint,
+                mode: baselineStable ? "recovered_baseline" : "recovery_incomplete",
+                used_after_id: currentCursor.afterId,
+                next_after_id: nextAfterId,
+                has_more: false,
+                stored_in_memory: true
+            };
+            pagesFetched += 1;
+            break;
+        }
         const data = readObject(api.data);
+        const returnedSnapshot = readString(readObject(data?.meta)?.snapshot);
+        if (activeSnapshot && !returnedSnapshot)
+            throw new Error("Stable snapshot response omitted its token; discard this page and start a new snapshot.");
+        if (activeSnapshot && activeSnapshot !== "start" && returnedSnapshot !== activeSnapshot)
+            throw new Error("Stable snapshot changed between pages; discard these pages and start a new snapshot.");
+        if (activeSnapshot === "start" && returnedSnapshot) {
+            activeSnapshot = returnedSnapshot;
+        }
         const pageResults = readArray(data?.results);
         lastApi = api;
         lastData = data;
@@ -8229,12 +8656,61 @@ async function collectCursorFeedPages(store, initialCursor, maxPages, timeBudget
         pagesFetched,
         pageBudgetExhausted,
         timeBudgetExhausted,
-        sourceRequests
+        sourceRequests,
+        gapRecovery
+    };
+}
+const feedRecoveryProgress = new WeakMap();
+function recoveryProgressFor(store) {
+    let progress = feedRecoveryProgress.get(store);
+    if (!progress) {
+        progress = new Map();
+        feedRecoveryProgress.set(store, progress);
+    }
+    return progress;
+}
+function setRecoveryCheckpoint(store, key, checkpoint) {
+    const progress = recoveryProgressFor(store);
+    if (!progress.has(key) && progress.size >= 500) {
+        const oldest = progress.keys().next().value;
+        if (oldest !== undefined)
+            progress.delete(oldest);
+    }
+    progress.delete(key);
+    progress.set(key, checkpoint);
+}
+function feedBaselineAfterId(data) {
+    const metaAfterId = readNumber(readObject(data?.meta)?.next_after_id);
+    const ids = readArray(data?.results)
+        .map((entry) => readNumber(readObject(entry)?.id))
+        .filter((value) => value !== undefined);
+    return ids.length > 0 ? Math.max(metaAfterId ?? 0, ...ids) : metaAfterId;
+}
+async function refreshInventoryBaseline(fetchPage, collection, maxPages, timeBudgetMs, startPage = 1, recoveryProbe = "inventory") {
+    const startedAt = Date.now();
+    let page = startPage;
+    let rows = 0;
+    let hasMore = false;
+    do {
+        const api = await fetchPage(page, `${recoveryProbe}-${page}`);
+        const data = readObject(api.data);
+        rows += readArray(data?.[collection]).length;
+        hasMore = readBoolean(readObject(data?.meta)?.has_more) === true;
+        page += 1;
+    } while (hasMore && page < startPage + maxPages && Date.now() - startedAt < timeBudgetMs);
+    return {
+        collection,
+        rows_observed: rows,
+        pages_fetched: page - startPage,
+        next_page: hasMore && page <= MAX_UPSTREAM_PAGE ? page : undefined,
+        endpoint_page_limit_reached: hasMore && page > MAX_UPSTREAM_PAGE,
+        complete: !hasMore,
+        bounded: true
     };
 }
 function normalizeFeedCursorFilters(filters) {
     return Object.fromEntries(Object.entries(filters)
-        .filter(([key, value]) => key !== "after_id" && key !== "page" && value !== undefined)
+        .filter(([key, value]) => key !== "after_id" && key !== "page" && key !== "snapshot" && value !== undefined)
         .map(([key, value]) => [key, normalizeFeedCursorFilterValue(value)]));
 }
 function normalizeFeedCursorFilterValue(value) {
@@ -8337,21 +8813,49 @@ function withApiMetadata(api, payload) {
             hit: api.cached,
             stale_while_revalidate: api.stale,
             coalesced_live_request: api.coalesced,
-            expires_at: api.cacheExpiresAt
+            expires_at: api.cacheExpiresAt,
+            no_store: api.noStore
         }),
         fetched_at: api.fetchedAt,
         ...payload
     });
 }
+function proPage(api, field) {
+    const raw = readObject(api.data);
+    if (!raw || !(field === "activity_summary" ? readObject(raw[field]) : Array.isArray(raw[field]))) {
+        throw new Error(`BBRadar Pro API returned a malformed page: expected ${field}.`);
+    }
+    const data = sanitizeProPayload(api.data);
+    return { ...data, ...withApiMetadata(api, {}) };
+}
+function assertProFeature(client, endpoint, flag) {
+    const state = client.capabilitySnapshot();
+    if (state.status !== "negotiated")
+        return;
+    const capability = client.endpointCapability(endpoint);
+    if (!capability)
+        throw new Error(`The negotiated BBRadar API does not advertise ${endpoint}. Upgrade the API deployment to use this tool.`);
+    if (flag && capability[flag] === false) {
+        throw new Error(`${endpoint} is advertised but ${flag}=false on this API deployment.`);
+    }
+}
+function assertHistoryCapture(client) {
+    if (client.capabilitySnapshot().status === "negotiated" &&
+        client.endpointCapability("history_changes")?.history_capture_enabled === false) {
+        throw new Error("History endpoints are advertised but history_capture_enabled=false on this API deployment.");
+    }
+}
 function apiSourceMetadata(api) {
     return stripUndefined({
         cache_hit: api.cached,
         cache_expires_at: api.cacheExpiresAt,
-        coalesced_live_request: api.coalesced
+        coalesced_live_request: api.coalesced,
+        no_store: api.noStore
     });
 }
 function errorPayload(error, decision, toolName, durationMs) {
     if (error instanceof BBRadarApiError) {
+        const recovery = error.status === 410 ? recoveryForGone(error, toolName) : undefined;
         return stripUndefined({
             request_id: error.requestId,
             upstream_request_id: error.upstreamRequestId,
@@ -8361,6 +8865,7 @@ function errorPayload(error, decision, toolName, durationMs) {
                 detail: sanitizeJson(error.detail),
                 errors: sanitizeJson(error.errors)
             }),
+            recovery,
             mcp_rate_limit: toRateLimitPayload(decision),
             mcp_timing: toolTimingPayload(toolName, durationMs)
         });
@@ -8374,6 +8879,19 @@ function errorPayload(error, decision, toolName, durationMs) {
         mcp_timing: toolTimingPayload(toolName, durationMs)
     };
 }
+function recoveryForGone(error, toolName) {
+    const detail = typeof error.detail === "string" ? error.detail.toLowerCase() : error.message.toLowerCase();
+    if (detail.includes("retained analytics") || detail.includes("precede")) {
+        return { action: "choose_supported_interval", message: "Choose dates inside the retained analytics window." };
+    }
+    if (detail.includes("snapshot")) {
+        return { action: "start_new_snapshot", message: "Restart on page 1 with snapshot=start; do not combine pages from the old snapshot." };
+    }
+    if (toolName.startsWith("get_history") || toolName === "get_program_history" || toolName.startsWith("get_analytics")) {
+        return { action: "restart_query", message: "Restart this History or analytics query without its expired opaque cursor, keeping the intended filters." };
+    }
+    return { action: "reconcile_inventory", message: "The retained numeric feed has a gap; reconcile current inventory before seeding a new after_id." };
+}
 function recordToolMetric(toolName, durationMs, status) {
     const existing = TOOL_METRICS.get(toolName) ??
         {
@@ -8441,6 +8959,11 @@ function splitFilterList(value) {
 function toQuery(values) {
     return compactRecord(values);
 }
+function assertStableSnapshotSupported(client, endpoint, snapshot) {
+    if (snapshot !== undefined && !client.supportsStableSnapshot(endpoint)) {
+        throw new Error(`The negotiated BBRadar API contract does not advertise stable snapshots for ${endpoint}. Omit snapshot to use live pagination.`);
+    }
+}
 function compactRecord(values) {
     return Object.fromEntries(Object.entries(values).filter(([, value]) => {
         if (value === undefined || value === null) {
@@ -8487,11 +9010,19 @@ function compactTarget(target) {
         identifier: targetIdentifier(target),
         target_type: stringField(target, "target_type"),
         in_scope: readBoolean(target.in_scope),
-        eligible_for_bounty: readBoolean(target.eligible_for_bounty),
+        eligible_for_bounty: target.eligible_for_bounty,
         wildcard: readBoolean(target.wildcard),
-        target_opportunity_score: readNumber(target.target_opportunity_score),
+        path_kind: stringField(target, "path_kind"),
+        path_prefix: stringField(target, "path_prefix"),
+        match_quality: stringField(target, "match_quality"),
+        match_reason: stringField(target, "match_reason"),
+        target_opportunity_score: target.target_opportunity_score,
         target_opportunity_label: stringField(target, "target_opportunity_label"),
+        score_version: target.score_version,
+        evidence_coverage: target.evidence_coverage,
+        target_score_breakdown: target.target_score_breakdown,
         competition_risk: stringField(target, "competition_risk"),
+        competition_risk_reason: stringField(target, "competition_risk_reason"),
         why_this_target: stringField(target, "why_this_target")
     });
 }