@bbradar/mcp 0.2.5 → 0.2.6

package/dist/server.js

@@ -5,8 +5,8 @@ import { BBRadarApiError } from "./bbradarClient.js";
 import { NumericCursorStore } from "./cursorStore.js";
 import { stableStringify, stripUndefined } from "./json.js";
 import { FixedWindowRateLimiter } from "./rateLimit.js";
-import { readArray, readBoolean, readNumber, readObject, readString, sanitizeJson, sanitizeChange, sanitizeProgram, sanitizeRepositoryChange, sanitizeTarget, sanitizeTargetsForExport } from "./sanitize.js";
-const SERVER_VERSION = "0.2.5";
+import { readArray, readBoolean, readNumber, readObject, readString, sanitizeJson, sanitizeProPayload, sanitizeChange, sanitizeProgram, sanitizeRepositoryChange, sanitizeTarget, sanitizeTargetsForExport } from "./sanitize.js";
+const SERVER_VERSION = "0.2.6";
 const MAX_PROGRAMS_PER_SEARCH = 100;
 const MAX_TARGET_EXPORT = 500;
 const MAX_RECENT_CHANGES = 100;
@@ -64,7 +64,14 @@ const CORE_TOOL_NAMES = new Set([
     "list_filters",
     "get_bbradar_guide",
     "get_mcp_status",
-    "export_targets"
+    "export_targets",
+    "get_history_changes",
+    "get_history_change_detail",
+    "get_program_history",
+    "get_program_activity",
+    "get_analytics_platform_series",
+    "get_analytics_program_activity",
+    "get_analytics_program_detail"
 ]);
 const TOOL_ENDPOINT_REQUIREMENTS = {
     search_targets: "target_search",
@@ -97,7 +104,6 @@ const PROGRAM_ID_PLATFORM_GUESSES = [
 ];
 const PRIMARY_PROGRAM_ID_PLATFORM_GUESSES = PROGRAM_ID_PLATFORM_GUESSES.slice(0, 8);
 const WEB3_TAGS = ["web3", "crypto", "blockchain", "smart-contract", "smart contract", "defi", "nft", "ethereum", "solana", "solidity"];
-const WEB3_CONTEST_SIGNALS = ["contest", "audit", "competitive", "code4rena", "sherlock", "cantina", "codehawks", "hats", "spearbit", "warden"];
 const VDP_SIGNALS = ["vdp", "disclosure", "responsible disclosure", "vulnerability disclosure", "no bounty", "non-bounty", "no reward"];
 const PROGRAM_RESOLUTION_STOP_WORDS = new Set([
     "program",
@@ -254,6 +260,9 @@ const stableSnapshotSchema = z
     message: "Snapshot tokens cannot contain control characters."
 })
     .describe("Optional stable-page token. Send 'start' on page 1, then reuse meta.snapshot with identical filters. Snapshot creation is consistency-first and can be slower; omit it for the fastest live result.");
+const opaqueCursorSchema = z.string().min(1).max(4096).describe("Opaque five-minute cursor. Reuse with identical filters and page size; restart the query on expiry.");
+const analyticsDateSchema = () => z.string().regex(/^\d{4}-\d{2}-\d{2}$/, "Use an inclusive UTC YYYY-MM-DD date.");
+const proLimitSchema = z.number().int().min(1).max(100);
 const pageSchema = z.number().int().min(1).default(1);
 const programsPageSizeSchema = z.number().int().min(1).max(MAX_PROGRAMS_PER_SEARCH).default(20);
 const recentChangesPageSizeSchema = z.number().int().min(1).max(MAX_RECENT_CHANGES).default(50);
@@ -278,7 +287,7 @@ const programIdSchema = z
     .string()
     .trim()
     .min(3)
-    .max(256)
+    .max(620)
     .regex(/^[^:/?#\u0000-\u001F\u007F]+:[^?#\u0000-\u001F\u007F]+$/, "Use platform:handle, for example HackerOne:example-handle.")
     .refine((value) => !/[\u0000-\u001F\u007F]/.test(value), {
     message: "program_id cannot contain control characters."
@@ -313,6 +322,7 @@ function cacheOutputSchema() {
         hit: z.boolean(),
         stale_while_revalidate: z.boolean().optional(),
         coalesced_live_request: z.boolean().optional(),
+        no_store: z.boolean().optional(),
         expires_at: z.string().optional()
     });
 }
@@ -338,6 +348,7 @@ function apiEnvelopeOutputShape() {
         mcp_timing: toolTimingOutputSchema().optional(),
         warnings: z.array(z.string()).optional(),
         program_id_resolution: jsonRecordSchema().optional(),
+        recovery: jsonRecordSchema().optional(),
         error: errorOutputSchema().optional()
     };
 }
@@ -400,7 +411,11 @@ const programCandidatePresetInputSchema = {
 };
 function createProfiledToolRegistrar(server, profile, client) {
     return (name, toolConfig, callback) => {
-        const registeredTool = server.registerTool(name, toolConfig, callback);
+        const scopedCallback = ((...args) => {
+            const extra = args[args.length - 1];
+            return client.withRequestContext(extra.signal, () => callback(...args), readObject(args[0])?.snapshot === "start");
+        });
+        const registeredTool = server.registerTool(name, toolConfig, scopedCallback);
         const requiredEndpoint = TOOL_ENDPOINT_REQUIREMENTS[name];
         if ((profile === "core" && !CORE_TOOL_NAMES.has(name)) ||
             (requiredEndpoint !== undefined && !client.supportsEndpoint(requiredEndpoint))) {
@@ -417,6 +432,7 @@ export function createBbradarServer(client, config) {
             "Use resolve_program or run_program_name_action for a named program.",
             "Use find_hunt_targets once for requests combining good rewards, broad scope, target quality, and recent target additions. Use find_repository_hunt_targets instead when Git or repository activity is explicitly required.",
             "Use find_programs for lower-level program-only discovery and find_programs_by_target for reverse target lookup.",
+            "For semantic changes use get_history_changes or get_program_history, then get_history_change_detail only when before/after items are needed. For exact activity use get_program_activity; for ranked activity use get_analytics_program_activity. Use daily analytics tools directly for date series.",
             "Default to bounty-eligible in-scope data unless the user explicitly requests broader results.",
             "Prefer compact/identifier outputs and disclose sampled ranking scope when present."
         ]
@@ -432,6 +448,7 @@ export function createBbradarServer(client, config) {
             "Self-Hosted programs use Self-Hosted:slug ids and are available through program search, exact detail, and target tools. Respect data_capabilities; do not infer missing opportunity, report-count, target-change, submission-cost, or repository signals.",
             "Freshness: find_recently_updated_programs, get_latest_added_targets, check_program_new_targets, check_watchlist_new_targets, find_recent_by_type, get_program_scope_delta.",
             "Repository activity: get_repository_changes defaults to compact program-only events. Seed with after_id, then resume the in-memory per-filter cursor.",
+            "Semantic History: get_history_changes globally or get_program_history for one exact ID, especially Self-Hosted. Fetch detail lazily with get_history_change_detail. Exact recorded signals: get_program_activity. Server-side rankings: get_analytics_program_activity. Daily series: get_analytics_platform_series or get_analytics_program_detail. Reuse opaque cursors only with unchanged filters and page size.",
             "Discovery: find_hunt_targets is the one-call default; find_program_candidates, find_wildcard_programs, find_recently_added_wildcards, find_low_competition_high_reward, find_stack_matches, find_language_programs, find_target_type_programs, find_reward_programs, find_paid_programs, find_vdp_programs, find_web3_contests, and find_low_noise_programs are lower-level alternatives.",
             "Details: get_program_brief, get_program_scope_summary, get_program_target_breakdown, find_programs_by_target, compare_programs_compact.",
             "Prefer compact/identifier outputs and disclose sampled ranking scope when present."
@@ -459,11 +476,88 @@ export function createBbradarServer(client, config) {
     const repositoryChangesPageSizeSchema = z.number().int().min(1).max(maxRepositoryChangesPageSize).default(Math.min(50, maxRepositoryChangesPageSize));
     const acceptedTargetLimitSchema = z.number().int().min(1).max(maxProgramTargetsPageSize);
     const targetSearchPageSizeSchema = z.number().int().min(1).max(maxTargetSearchPageSize).default(Math.min(50, maxTargetSearchPageSize));
+    const historyOutput = { ...apiEnvelopeOutputShape(), changes: z.array(jsonRecordSchema()).optional(), coverage: jsonRecordSchema().optional(), meta: jsonRecordSchema().optional() };
+    const analyticsOutput = { ...apiEnvelopeOutputShape(), platform: z.string().optional(), program: jsonRecordSchema().optional(), programs: z.array(jsonRecordSchema()).optional(), series: z.array(jsonRecordSchema()).optional(), observations: jsonRecordSchema().optional(), category: z.string().optional(), population: z.string().optional(), ranking_definition: z.string().optional(), inventory_definition: z.string().optional(), meta: jsonRecordSchema().optional() };
+    registerTool("get_history_changes", {
+        title: "Get Program History Changes",
+        description: "One page of semantic program History. Use get_program_history for an exact program, especially Self-Hosted. History may be partial or unavailable; inspect coverage.",
+        inputSchema: {
+            cursor: opaqueCursorSchema.optional(), days: z.number().int().min(0).max(3650).default(90),
+            platform: z.string().min(1).max(100).optional(), program_id: programIdSchema.optional(),
+            category: z.enum(["scope", "rewards", "rules", "program", "repositories"]).optional(),
+            search: z.string().min(1).max(120).optional(), limit: proLimitSchema.default(50)
+        }, outputSchema: historyOutput, annotations: readOnlyAnnotations
+    }, (args) => runTool("get_history_changes", config, rateLimiter, async () => {
+        assertProFeature(client, "history_changes", "history_capture_enabled");
+        if (args.days === 0 && !args.program_id)
+            throw new Error("days=0 requires program_id; use get_program_history for Self-Hosted catalog IDs.");
+        const api = await client.getHistoryChanges(toQuery(args));
+        return proPage(api, "changes");
+    }));
+    registerTool("get_history_change_detail", {
+        title: "Get History Change Detail",
+        description: "Fetch one semantic History change's paginated before/after items only when needed.",
+        inputSchema: { change_id: z.string().min(1).max(128), cursor: opaqueCursorSchema.optional(), limit: proLimitSchema.default(50) },
+        outputSchema: { ...apiEnvelopeOutputShape(), change: jsonRecordSchema().optional(), items: z.array(jsonRecordSchema()).optional(), meta: jsonRecordSchema().optional() }, annotations: readOnlyAnnotations
+    }, (args) => runTool("get_history_change_detail", config, rateLimiter, async () => {
+        assertProFeature(client, "history_change_detail");
+        assertHistoryCapture(client);
+        return proPage(await client.getHistoryChangeDetail(args.change_id, toQuery({ cursor: args.cursor, limit: args.limit })), "items");
+    }));
+    registerTool("get_program_history", {
+        title: "Get Program History",
+        description: "One page of exact semantic History for a platform:handle or Self-Hosted:slug catalog ID. Preserve archive id and catalog_id separately.",
+        inputSchema: { program_id: programIdSchema, cursor: opaqueCursorSchema.optional(), days: z.number().int().min(0).max(3650).default(90), limit: proLimitSchema.default(50) },
+        outputSchema: historyOutput, annotations: readOnlyAnnotations
+    }, (args) => runTool("get_program_history", config, rateLimiter, async () => {
+        assertProFeature(client, "program_history");
+        assertHistoryCapture(client);
+        return proPage(await client.getProgramHistory(args.program_id, toQuery({ cursor: args.cursor, days: args.days, limit: args.limit })), "changes");
+    }));
+    registerTool("get_program_activity", {
+        title: "Get Exact Program Activity",
+        description: "Read the authoritative activity_summary for one exact program ID.",
+        inputSchema: { program_id: programIdSchema },
+        outputSchema: { ...apiEnvelopeOutputShape(), program_id: z.string().optional(), activity_summary: jsonRecordSchema().optional() }, annotations: readOnlyAnnotations
+    }, (args) => runTool("get_program_activity", config, rateLimiter, async () => {
+        assertProFeature(client, "program_activity");
+        return proPage(await client.getProgramActivity(args.program_id), "activity_summary");
+    }));
+    registerTool("get_analytics_platform_series", {
+        title: "Get Platform Daily Analytics",
+        description: "One page of inclusive UTC daily platform analytics; inspect generation, projection_pending, and tracking_since.",
+        inputSchema: { platform: z.string().min(1).max(100), start: analyticsDateSchema().optional(), end: analyticsDateSchema().optional(), cursor: opaqueCursorSchema.optional(), limit: proLimitSchema.default(100) },
+        outputSchema: analyticsOutput, annotations: readOnlyAnnotations
+    }, (args) => runTool("get_analytics_platform_series", config, rateLimiter, async () => {
+        assertProFeature(client, "analytics_platform_series", "enabled");
+        const { platform, ...query } = args;
+        return proPage(await client.getAnalyticsPlatformSeries(platform, toQuery(query)), "series");
+    }));
+    registerTool("get_analytics_program_activity", {
+        title: "Rank Programs by Recorded Activity",
+        description: "Server-side daily activity ranking. One page; semantic activity excludes baselines and corrections.",
+        inputSchema: { start: analyticsDateSchema().optional(), end: analyticsDateSchema().optional(), platform: z.string().min(1).max(100).optional(), category: z.enum(["all", "scope", "rewards", "rules", "schedule", "costs", "lifecycle"]).default("all"), cursor: opaqueCursorSchema.optional(), limit: proLimitSchema.default(50) },
+        outputSchema: analyticsOutput, annotations: readOnlyAnnotations
+    }, (args) => runTool("get_analytics_program_activity", config, rateLimiter, async () => {
+        assertProFeature(client, "analytics_program_activity", "enabled");
+        return proPage(await client.getAnalyticsProgramActivity(toQuery(args)), "programs");
+    }));
+    registerTool("get_analytics_program_detail", {
+        title: "Get Program Daily Analytics",
+        description: "One page of program daily metrics, carried inventory state, report observations, and source coverage.",
+        inputSchema: { program_id: programIdSchema, start: analyticsDateSchema().optional(), end: analyticsDateSchema().optional(), cursor: opaqueCursorSchema.optional(), limit: proLimitSchema.default(100) },
+        outputSchema: analyticsOutput, annotations: readOnlyAnnotations
+    }, (args) => runTool("get_analytics_program_detail", config, rateLimiter, async () => {
+        assertProFeature(client, "analytics_program_detail", "enabled");
+        const { program_id, ...query } = args;
+        return proPage(await client.getAnalyticsProgramDetail(program_id, toQuery(query)), "series");
+    }));
     registerTool("search_programs", {
         title: "Search BBRadar Programs",
         description: `Search or list active and confirmed paused platform programs plus active Self-Hosted programs. page_size max ${maxProgramsPageSize}. Stable snapshots are opt-in because creating one can be slower than live indexed pagination.`,
         inputSchema: {
             search: searchTextSchema.optional().describe("Server-side program name, handle, platform, policy-host, or target search."),
+            program_kind: z.enum(["bounty", "contest", "challenge"]).optional(),
             platforms: platformListSchema(),
             tags: tagListSchema(),
             updated_since: isoDateTimeSchema.optional().describe("ISO datetime."),
@@ -718,16 +812,16 @@ export function createBbradarServer(client, config) {
     }, (args) => runTool("get_recent_changes", config, rateLimiter, async () => {
         const { output_mode, resume_cursor, max_cursor_pages, cursor_time_budget_ms, ...filters } = args;
         assertStableSnapshotSupported(client, "target_changes", filters.snapshot);
-        const cursor = resolveFeedCursor(feedCursorStore, "target_changes", filters, resume_cursor);
+        const cursor = resolveFeedCursor(feedCursorStore, "target_changes", filters, resume_cursor, config);
         const { min_target_score, target_opportunity_label, competition_risk, snapshot, ...upstreamFilters } = filters;
-        const collected = await collectCursorFeedPages(feedCursorStore, cursor, max_cursor_pages, cursor_time_budget_ms, snapshot, (afterId, recoveryProbe, activeSnapshot) => client.getRecentChanges(toQuery({
+        const collected = await collectCursorFeedPages(feedCursorStore, cursor, max_cursor_pages, cursor_time_budget_ms, snapshot, filters.page, (afterId, recoveryProbe, activeSnapshot, pageNumber) => client.getRecentChanges(toQuery({
             ...upstreamFilters,
             minTargetScore: min_target_score,
             targetOpportunityLabel: target_opportunity_label,
             competitionRisk: competition_risk,
             snapshot: activeSnapshot,
             after_id: afterId,
-            page: afterId === undefined ? filters.page : 1
+            page: activeSnapshot ? pageNumber : afterId === undefined ? filters.page : 1
         }), recoveryProbe ? { cache: false, coalesce: false } : {}), (startPage, recoveryProbe) => refreshInventoryBaseline((page, pageProbe) => client.searchTargets(toQuery({
             q: upstreamFilters.search,
             platforms: upstreamFilters.platforms,
@@ -795,13 +889,13 @@ export function createBbradarServer(client, config) {
         }
         const { output_mode, resume_cursor, max_cursor_pages, cursor_time_budget_ms, ...filters } = args;
         assertStableSnapshotSupported(client, "repository_changes", filters.snapshot);
-        const cursor = resolveFeedCursor(feedCursorStore, "repository_changes", filters, resume_cursor);
+        const cursor = resolveFeedCursor(feedCursorStore, "repository_changes", filters, resume_cursor, config);
         const { snapshot, ...upstreamFilters } = filters;
-        const collected = await collectCursorFeedPages(feedCursorStore, cursor, max_cursor_pages, cursor_time_budget_ms, snapshot, (afterId, recoveryProbe, activeSnapshot) => client.getRepositoryChanges(toQuery({
+        const collected = await collectCursorFeedPages(feedCursorStore, cursor, max_cursor_pages, cursor_time_budget_ms, snapshot, filters.page, (afterId, recoveryProbe, activeSnapshot, pageNumber) => client.getRepositoryChanges(toQuery({
             ...upstreamFilters,
             snapshot: activeSnapshot,
             after_id: afterId,
-            page: afterId === undefined ? filters.page : 1
+            page: activeSnapshot ? pageNumber : afterId === undefined ? filters.page : 1
         }), recoveryProbe ? { cache: false, coalesce: false } : {}), (startPage, recoveryProbe) => refreshInventoryBaseline((page, pageProbe) => client.getRepositoryChanges(toQuery({
             ...upstreamFilters,
             after_id: undefined,
@@ -1130,6 +1224,7 @@ export function createBbradarServer(client, config) {
             target_types: targetTypeListSchema(),
             language_tags: languageTagListSchema(),
             web3: z.boolean().default(false).describe("Require Web3 signals."),
+            program_kind: z.enum(["bounty", "contest", "challenge"]).optional().describe("Source-classified program kind; sent to the Pro program list."),
             exclude_web3: z.boolean().default(false).describe("Exclude programs with Web3, blockchain, smart-contract, crypto, DeFi, NFT, Solidity, Ethereum, or Solana signals. Use this for Web2-only discovery."),
             opportunity_levels: z.array(opportunityLevelSchema).max(4).default([]),
             updated_since: isoDateTimeSchema.optional(),
@@ -1144,7 +1239,7 @@ export function createBbradarServer(client, config) {
             exclude_mobile_only: z.boolean().default(false),
             exclude_non_web: z.boolean().default(false),
             has_api_scope: z.boolean().default(false),
-            contest_like: z.boolean().default(false).describe("Require contest/audit signals."),
+            contest_like: z.boolean().default(false).describe("Require source-classified contests."),
             vdp_mode: vdpModeSchema.default("exclude").describe("VDP/no-bounty filter mode."),
             fresh_launch_days: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).optional(),
             min_wildcards: z.number().int().min(0).max(1000).default(0),
@@ -1772,7 +1867,8 @@ export function createBbradarServer(client, config) {
             ...apiEnvelopeOutputShape(),
             program: programOutputSchema().optional(),
             activity: jsonRecordSchema().optional(),
-            changes: z.array(jsonRecordSchema()).optional()
+            changes: z.array(jsonRecordSchema()).optional(),
+            meta: jsonRecordSchema().optional()
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("summarize_program_activity", config, rateLimiter, async () => runProgramIdTool(client, config, args.program_id, (programId) => summarizeProgramActivity(client, config, programId, args.recent_changes_limit))));
@@ -1976,13 +2072,15 @@ export function createBbradarServer(client, config) {
             const exportId = randomUUID();
             const sanitizedExport = sanitizeTargetsForExport(api.data, args.limit);
             const resourceUri = exportResourceUri(exportId);
-            rememberExport(exportStore, exportId, sanitizedExport);
+            if (!api.noStore)
+                rememberExport(exportStore, exportId, sanitizedExport);
             return withApiMetadata(api, {
                 source_requests: resolvedProgramIds.sourceRequests.length > 0 ? resolvedProgramIds.sourceRequests : undefined,
                 warnings: resolvedProgramIds.warnings.length > 0 ? resolvedProgramIds.warnings : undefined,
                 export: {
-                    export_id: exportId,
-                    resource_uri: resourceUri,
+                    export_id: api.noStore ? undefined : exportId,
+                    resource_uri: api.noStore ? undefined : resourceUri,
+                    data: api.noStore ? sanitizedExport : undefined,
                     preview: previewExportPayload(sanitizedExport),
                     returned_preview_count: previewExportCount(sanitizedExport),
                     limit: args.limit
@@ -2079,6 +2177,9 @@ function bbradarGuide(topic, profile, client) {
             arguments: { include_targets: false, max_cursor_pages: 2 },
             then: "For incremental polling, seed once with after_id and later set resume_cursor=true with the same filters."
         },
+        { user_goal: "semantic program change history", first_tool: "get_program_history", arguments: { program_id: "Platform:handle" }, then: "Fetch get_history_change_detail only for a selected change." },
+        { user_goal: "most active programs in a date range", first_tool: "get_analytics_program_activity", arguments: {}, then: "Use this server-side ranking rather than sampling the program catalog." },
+        { user_goal: "exact recorded activity for one program", first_tool: "get_program_activity", arguments: { program_id: "Platform:handle" } },
         {
             user_goal: "hunt targets combining repository activity with rewards, target quality, platforms, or Web2/Web3 constraints",
             first_tool: "find_repository_hunt_targets",
@@ -2221,6 +2322,9 @@ function coreBbradarGuide(topic, client) {
             first_tool: "get_repository_changes",
             arguments: { include_targets: false, max_cursor_pages: 2 }
         },
+        { user_goal: "semantic program change history", first_tool: "get_program_history", arguments: { program_id: "Platform:handle" }, then: "Fetch change detail only when needed." },
+        { user_goal: "most active programs", first_tool: "get_analytics_program_activity", arguments: {} },
+        { user_goal: "exact recorded activity", first_tool: "get_program_activity", arguments: { program_id: "Platform:handle" } },
         {
             user_goal: "hunt targets combining repository activity with rewards, target quality, platforms, or Web2/Web3 constraints",
             first_tool: "find_repository_hunt_targets",
@@ -2598,7 +2702,7 @@ function getCachedProgramFallback(config, requestedProgramId) {
     return cloneProgramFallbackForRequest(cached.fallback, requestedProgramId, true);
 }
 function rememberProgramFallback(config, fallback) {
-    if (config.cacheTtlMs <= 0 || config.cacheMaxEntries <= 0) {
+    if (config.cacheTtlMs <= 0 || config.cacheMaxEntries <= 0 || hasNoStoreSource(fallback.sourceRequests)) {
         return;
     }
     pruneProgramFallbackCache();
@@ -2623,7 +2727,13 @@ function pruneProgramFallbackCache() {
     }
 }
 function programFallbackCacheKey(config, requestedProgramId) {
-    return `${config.apiBaseUrl}\n${normalizeTag(requestedProgramId)}`;
+    return `${config.apiBaseUrl}\n${credentialCacheScope(config)}\n${isStrictProgramId(requestedProgramId) ? requestedProgramId : normalizeTag(requestedProgramId)}`;
+}
+function credentialCacheScope(config) {
+    return createHash("sha256").update(config.apiKey).digest("hex");
+}
+function hasNoStoreSource(sourceRequests) {
+    return sourceRequests.some((request) => readBoolean(request.no_store) === true);
 }
 function cloneProgramFallbackForRequest(fallback, requestedProgramId, fromCache) {
     const warnings = fromCache
@@ -3077,7 +3187,8 @@ function getCachedResolveProgram(config, input) {
     });
 }
 function rememberResolveProgram(config, input, payload) {
-    if (config.cacheTtlMs <= 0 || config.cacheMaxEntries <= 0) {
+    const sourceRequests = readArray(payload.source_requests).filter((request) => readObject(request) !== undefined);
+    if (config.cacheTtlMs <= 0 || config.cacheMaxEntries <= 0 || hasNoStoreSource(sourceRequests)) {
         return;
     }
     pruneResolveProgramCache();
@@ -3103,7 +3214,8 @@ function pruneResolveProgramCache() {
 function resolveProgramCacheKey(config, input) {
     return stableStringify({
         apiBaseUrl: config.apiBaseUrl,
-        query: normalizeTag(input.query),
+        credentialScope: credentialCacheScope(config),
+        query: isStrictProgramId(input.query) ? input.query : normalizeTag(input.query),
         platforms: input.platforms.map(normalizeTag).sort(),
         tags: input.tags.map(normalizeTag).sort(),
         opportunity_levels: [...input.opportunity_levels].sort(),
@@ -4311,8 +4423,9 @@ async function comparePrograms(client, config, input) {
     });
 }
 async function summarizeProgramActivity(client, config, programId, recentChangesLimit) {
-    const [programApi, changes] = await Promise.all([
+    const [programApi, activityApi, changes] = await Promise.all([
         client.getProgram(programId),
+        client.supportsEndpoint("program_activity") ? client.getProgramActivity(programId) : Promise.resolve(undefined),
         recentChangesLimit > 0
             ? fetchProgramChanges(client, config, programId, recentChangesLimit, true, true, true)
             : Promise.resolve(undefined)
@@ -4329,15 +4442,18 @@ async function summarizeProgramActivity(client, config, programId, recentChanges
                 upstream_request_id: programApi.upstreamRequestId,
                 ...apiSourceMetadata(programApi)
             },
+            ...(activityApi ? [{ source: "program_activity", request_id: activityApi.requestId, upstream_request_id: activityApi.upstreamRequestId, ...apiSourceMetadata(activityApi) }] : []),
             ...(changes?.sourceRequests ?? [])
         ],
         program,
         activity: stripUndefined({
+            activity_summary: activityApi ? sanitizeProPayload(readObject(activityApi.data)?.activity_summary) : undefined,
             target_counts: readObject(scopeSummary?.target_counts),
             target_activity: targetActivity,
             recent_change_count: changes?.changes.length
         }),
-        changes: changes?.changes ?? []
+        changes: changes?.changes ?? [],
+        meta: { target_change_samples_are_semantic_history: false, activity_source: activityApi ? "pro_activity_endpoint" : "legacy_program_projection" }
     };
 }
 async function getLatestAddedTargets(client, config, input) {
@@ -4593,10 +4709,12 @@ async function fetchProgramTargetsWithEndpointFallback(client, programId) {
             requestId: api.requestId,
             upstreamRequestId: api.upstreamRequestId,
             fetchedAt: api.fetchedAt,
+            noStore: api.noStore,
             cache: readObject(stripUndefined({
                 hit: api.cached,
                 coalesced_live_request: api.coalesced,
-                expires_at: api.cacheExpiresAt
+                expires_at: api.cacheExpiresAt,
+                no_store: api.noStore
             })),
             source: "program_targets",
             rawTargets,
@@ -4654,7 +4772,7 @@ function getCachedProgramTargetsFallback(client, programId) {
 }
 function rememberProgramTargetsFallback(client, programId, lookup) {
     const diagnostics = client.diagnostics();
-    if (!diagnostics.response_cache.enabled || lookup.unavailable) {
+    if (!diagnostics.response_cache.enabled || lookup.unavailable || lookup.noStore) {
         return;
     }
     const cache = programTargetsFallbackCacheForClient(client);
@@ -4692,7 +4810,7 @@ function pruneProgramTargetsFallbackCache(cache) {
     }
 }
 function programTargetsFallbackCacheKey(programId) {
-    return normalizeTag(programId);
+    return programId;
 }
 function cacheTtlMsFromDiagnostics(cache) {
     return cache.enabled ? cache.ttl_ms : 0;
@@ -4711,10 +4829,12 @@ async function fetchProgramTargetsFromExportFallback(client, programId) {
             requestId: api.requestId,
             upstreamRequestId: api.upstreamRequestId,
             fetchedAt: api.fetchedAt,
+            noStore: api.noStore,
             cache: readObject(stripUndefined({
                 hit: api.cached,
                 coalesced_live_request: api.coalesced,
-                expires_at: api.cacheExpiresAt
+                expires_at: api.cacheExpiresAt,
+                no_store: api.noStore
             })),
             source: "target_export",
             rawTargets,
@@ -4761,7 +4881,8 @@ async function getProgramFromTargetsOnlyFallback(client, programId, programError
         cache: readObject(stripUndefined({
             hit: targetsApi.cached,
             coalesced_live_request: targetsApi.coalesced,
-            expires_at: targetsApi.cacheExpiresAt
+            expires_at: targetsApi.cacheExpiresAt,
+            no_store: targetsApi.noStore
         })),
         source_requests: [
             stripUndefined({
@@ -4906,8 +5027,6 @@ async function exportTargetsFromProgramTargetsFallback(client, config, exportSto
         generated_at: new Date().toISOString()
     });
     const exportId = randomUUID();
-    const resourceUri = exportResourceUri(exportId);
-    rememberExport(exportStore, exportId, exportPayload);
     return stripUndefined({
         request_id: randomUUID(),
         source_requests: sourceRequests,
@@ -4915,7 +5034,7 @@ async function exportTargetsFromProgramTargetsFallback(client, config, exportSto
         errors: errors.length > 0 ? errors : undefined,
         export: {
             export_id: exportId,
-            resource_uri: resourceUri,
+            data: exportPayload,
             preview: previewExportPayload(exportPayload),
             returned_preview_count: previewExportCount(exportPayload),
             limit: input.limit
@@ -5642,6 +5761,10 @@ function applyCollectionContinuation(payload, field, label, store, config) {
     if (!items || items.length <= inlineLimit) {
         return payload;
     }
+    // A no-store page stays only in this tool result, never in a reusable resource.
+    if (readBoolean(readObject(payload.cache)?.no_store) === true) {
+        return payload;
+    }
     const continuationId = randomUUID();
     const expiresAt = Date.now() + (config.continuationTtlMs ?? LOCAL_EXPORT_TTL_MS);
     const stored = rememberContinuation(store, continuationId, label, items, expiresAt);
@@ -5898,10 +6021,12 @@ function formatProgram(program, mode) {
 function compactProgram(program) {
     return stripUndefined({
         id: stringField(program, "id"),
+        catalog_id: stringField(program, "catalog_id"),
         handle: stringField(program, "handle"),
         name: stringField(program, "name"),
         platform: stringField(program, "platform"),
         catalog: stringField(program, "catalog"),
+        program_kind: stringField(program, "program_kind"),
         program_status: stringField(program, "program_status"),
         is_active: readBoolean(program.is_active),
         program_type: stringField(program, "program_type"),
@@ -5910,15 +6035,21 @@ function compactProgram(program) {
         policy_url: stringField(program, "policy_url"),
         reporting_url: stringField(program, "reporting_url"),
         reward_status: stringField(program, "reward_status"),
-        data_capabilities: readObject(program.data_capabilities),
-        opportunity_tag: readObject(program.opportunity_tag),
+        data_capabilities: program.data_capabilities,
+        opportunity_tag: program.opportunity_tag,
         competition_risk: stringField(program, "competition_risk"),
         competition_risk_reason: stringField(program, "competition_risk_reason"),
-        submission_cost: readObject(program.submission_cost),
-        reward_range: readObject(program.reward_range),
-        public_report_count: readNumber(program.public_report_count),
+        submission_cost: program.submission_cost,
+        reward_range: program.reward_range,
+        reward_range_label: stringField(program, "reward_range_label"),
+        public_report_count: program.public_report_count,
         public_report_count_label: stringField(program, "public_report_count_label"),
         first_seen_date: stringField(program, "first_seen_date"),
+        launch_at: program.launch_at,
+        launch_at_precision: stringField(program, "launch_at_precision"),
+        ends_at: program.ends_at,
+        ends_on: program.ends_on,
+        verification: program.verification,
         last_updated: stringField(program, "last_updated"),
         targets_updated_at: stringField(program, "targets_updated_at"),
         scope_summary: readObject(program.scope_summary),
@@ -6240,7 +6371,7 @@ function candidateLooksLikeCtf(candidate) {
     return candidate.looksLikeCtf;
 }
 function candidateLooksContestLike(candidate) {
-    return tagIncludesAnyNormalized(candidate.normalizedSearchSignals, WEB3_CONTEST_SIGNALS);
+    return stringField(candidate.program, "program_kind") === "contest";
 }
 function candidateHasKnownNoBounty(candidate) {
     const programType = normalizeTag(stringField(candidate.program, "program_type") ?? "");
@@ -7346,6 +7477,7 @@ async function findPrograms(client, config, input) {
     const collected = await collectPrograms(client, {
         platforms: input.platforms,
         tags: upstreamTags,
+        program_kind: input.program_kind ?? (input.contest_like ? "contest" : undefined),
         updated_since: input.updated_since,
         opportunity_levels: input.opportunity_levels,
         max_pages: input.max_pages,
@@ -7394,6 +7526,7 @@ async function findPrograms(client, config, input) {
             exclude_non_web: input.exclude_non_web,
             has_api_scope: input.has_api_scope,
             contest_like: input.contest_like ? true : undefined,
+            program_kind: input.program_kind,
             vdp_mode: input.vdp_mode && input.vdp_mode !== "include" ? input.vdp_mode : undefined,
             fresh_launch_days: input.fresh_launch_days,
             min_wildcards: input.min_wildcards,
@@ -7823,6 +7956,7 @@ async function fetchProgramPage(client, source, sourceIndex, page, options) {
             platforms: options.platforms,
             tags: options.tags,
             updated_since: options.updated_since,
+            program_kind: source.kind === "programs" ? options.program_kind : undefined,
             page,
             page_size: MAX_PROGRAMS_PER_SEARCH
         });
@@ -7908,6 +8042,9 @@ function toProgramCandidate(rawProgram, webBaseUrl) {
     return candidate;
 }
 function programCandidateMatches(candidate, filters) {
+    if (filters.program_kind && stringField(candidate.program, "program_kind") !== filters.program_kind) {
+        return false;
+    }
     const programStatus = normalizeTag(stringField(candidate.program, "program_status") ?? "");
     if (readBoolean(candidate.program.is_active) === false || programStatus === "paused") {
         return false;
@@ -8270,7 +8407,7 @@ function registerPrompts(server, profile) {
             tags: z.string().optional().describe("Optional comma-separated scope/language/target-type tags."),
             max_programs: z.string().optional().describe("Optional maximum shortlist size.")
         }
-    }, (args) => promptResult(`Use the BBRadar MCP tools only. Do not invoke local bug bounty skills, methodology files, worklogs, or non-BBRadar tools unless the user explicitly asks for methodology. Do not perform active scanning or contact third-party targets. Treat results as fresh API reads; do not describe them as cached.
+    }, (args) => promptResult(`Use the BBRadar MCP tools only. Do not invoke local bug bounty skills, methodology files, worklogs, or non-BBRadar tools unless the user explicitly asks for methodology. Do not perform active scanning or contact third-party targets. Check each result's cache metadata before describing its freshness.
 
 Find the best BBRadar program candidates.
 ${discoveryToolInstructions}
@@ -8321,8 +8458,12 @@ The plan must:
 - Prioritize targets by bounty eligibility, freshness, wildcard status, target type, and severity labels.
 - Include a short checklist of BBRadar follow-up tool calls and decision points.`));
 }
-function resolveFeedCursor(store, endpoint, filters, resume) {
-    const normalizedFilters = stableStringify(normalizeFeedCursorFilters(filters));
+function resolveFeedCursor(store, endpoint, filters, resume, config) {
+    const normalizedFilters = stableStringify({
+        api_base_url: config.apiBaseUrl,
+        credential_scope: credentialCacheScope(config),
+        filters: normalizeFeedCursorFilters(filters)
+    });
     const key = `${endpoint}:${createHash("sha256").update(normalizedFilters).digest("hex")}`;
     const explicitAfterId = readNumber(filters.after_id);
     if (explicitAfterId !== undefined) {
@@ -8353,7 +8494,7 @@ function advanceFeedCursor(store, cursor, rawMeta) {
         stored_in_memory: true
     };
 }
-async function collectCursorFeedPages(store, initialCursor, maxPages, timeBudgetMs, initialSnapshot, fetchPage, refreshInventory) {
+async function collectCursorFeedPages(store, initialCursor, maxPages, timeBudgetMs, initialSnapshot, initialPage, fetchPage, refreshInventory) {
     const startedAt = Date.now();
     const results = [];
     const sourceRequests = [];
@@ -8370,7 +8511,7 @@ async function collectCursorFeedPages(store, initialCursor, maxPages, timeBudget
     do {
         let api;
         try {
-            api = await fetchPage(currentCursor.afterId, undefined, activeSnapshot);
+            api = await fetchPage(currentCursor.afterId, undefined, activeSnapshot, activeSnapshot ? initialPage + pagesFetched : 1);
             feedRecoveryProgress.get(store)?.delete(currentCursor.key);
         }
         catch (error) {
@@ -8466,6 +8607,10 @@ async function collectCursorFeedPages(store, initialCursor, maxPages, timeBudget
         }
         const data = readObject(api.data);
         const returnedSnapshot = readString(readObject(data?.meta)?.snapshot);
+        if (activeSnapshot && !returnedSnapshot)
+            throw new Error("Stable snapshot response omitted its token; discard this page and start a new snapshot.");
+        if (activeSnapshot && activeSnapshot !== "start" && returnedSnapshot !== activeSnapshot)
+            throw new Error("Stable snapshot changed between pages; discard these pages and start a new snapshot.");
         if (activeSnapshot === "start" && returnedSnapshot) {
             activeSnapshot = returnedSnapshot;
         }
@@ -8668,21 +8813,49 @@ function withApiMetadata(api, payload) {
             hit: api.cached,
             stale_while_revalidate: api.stale,
             coalesced_live_request: api.coalesced,
-            expires_at: api.cacheExpiresAt
+            expires_at: api.cacheExpiresAt,
+            no_store: api.noStore
         }),
         fetched_at: api.fetchedAt,
         ...payload
     });
 }
+function proPage(api, field) {
+    const raw = readObject(api.data);
+    if (!raw || !(field === "activity_summary" ? readObject(raw[field]) : Array.isArray(raw[field]))) {
+        throw new Error(`BBRadar Pro API returned a malformed page: expected ${field}.`);
+    }
+    const data = sanitizeProPayload(api.data);
+    return { ...data, ...withApiMetadata(api, {}) };
+}
+function assertProFeature(client, endpoint, flag) {
+    const state = client.capabilitySnapshot();
+    if (state.status !== "negotiated")
+        return;
+    const capability = client.endpointCapability(endpoint);
+    if (!capability)
+        throw new Error(`The negotiated BBRadar API does not advertise ${endpoint}. Upgrade the API deployment to use this tool.`);
+    if (flag && capability[flag] === false) {
+        throw new Error(`${endpoint} is advertised but ${flag}=false on this API deployment.`);
+    }
+}
+function assertHistoryCapture(client) {
+    if (client.capabilitySnapshot().status === "negotiated" &&
+        client.endpointCapability("history_changes")?.history_capture_enabled === false) {
+        throw new Error("History endpoints are advertised but history_capture_enabled=false on this API deployment.");
+    }
+}
 function apiSourceMetadata(api) {
     return stripUndefined({
         cache_hit: api.cached,
         cache_expires_at: api.cacheExpiresAt,
-        coalesced_live_request: api.coalesced
+        coalesced_live_request: api.coalesced,
+        no_store: api.noStore
     });
 }
 function errorPayload(error, decision, toolName, durationMs) {
     if (error instanceof BBRadarApiError) {
+        const recovery = error.status === 410 ? recoveryForGone(error, toolName) : undefined;
         return stripUndefined({
             request_id: error.requestId,
             upstream_request_id: error.upstreamRequestId,
@@ -8692,6 +8865,7 @@ function errorPayload(error, decision, toolName, durationMs) {
                 detail: sanitizeJson(error.detail),
                 errors: sanitizeJson(error.errors)
             }),
+            recovery,
             mcp_rate_limit: toRateLimitPayload(decision),
             mcp_timing: toolTimingPayload(toolName, durationMs)
         });
@@ -8705,6 +8879,19 @@ function errorPayload(error, decision, toolName, durationMs) {
         mcp_timing: toolTimingPayload(toolName, durationMs)
     };
 }
+function recoveryForGone(error, toolName) {
+    const detail = typeof error.detail === "string" ? error.detail.toLowerCase() : error.message.toLowerCase();
+    if (detail.includes("retained analytics") || detail.includes("precede")) {
+        return { action: "choose_supported_interval", message: "Choose dates inside the retained analytics window." };
+    }
+    if (detail.includes("snapshot")) {
+        return { action: "start_new_snapshot", message: "Restart on page 1 with snapshot=start; do not combine pages from the old snapshot." };
+    }
+    if (toolName.startsWith("get_history") || toolName === "get_program_history" || toolName.startsWith("get_analytics")) {
+        return { action: "restart_query", message: "Restart this History or analytics query without its expired opaque cursor, keeping the intended filters." };
+    }
+    return { action: "reconcile_inventory", message: "The retained numeric feed has a gap; reconcile current inventory before seeding a new after_id." };
+}
 function recordToolMetric(toolName, durationMs, status) {
     const existing = TOOL_METRICS.get(toolName) ??
         {
@@ -8823,15 +9010,19 @@ function compactTarget(target) {
         identifier: targetIdentifier(target),
         target_type: stringField(target, "target_type"),
         in_scope: readBoolean(target.in_scope),
-        eligible_for_bounty: readBoolean(target.eligible_for_bounty),
+        eligible_for_bounty: target.eligible_for_bounty,
         wildcard: readBoolean(target.wildcard),
         path_kind: stringField(target, "path_kind"),
         path_prefix: stringField(target, "path_prefix"),
         match_quality: stringField(target, "match_quality"),
         match_reason: stringField(target, "match_reason"),
-        target_opportunity_score: readNumber(target.target_opportunity_score),
+        target_opportunity_score: target.target_opportunity_score,
         target_opportunity_label: stringField(target, "target_opportunity_label"),
+        score_version: target.score_version,
+        evidence_coverage: target.evidence_coverage,
+        target_score_breakdown: target.target_score_breakdown,
         competition_risk: stringField(target, "competition_risk"),
+        competition_risk_reason: stringField(target, "competition_risk_reason"),
         why_this_target: stringField(target, "why_this_target")
     });
 }