@prooflane/inspector-beta 0.1.0-beta.6 → 0.1.0-beta.7

package/dist/server.mjs

@@ -4225,7 +4225,7 @@ function validateGovernedGateManifest(value) {
   if (!record2(value))
     return { ok: !1, error: "Gate manifest must be an object." };
   let forbidden = findForbiddenGateManifestMaterial(value);
-  return forbidden ? { ok: !1, error: `Gate manifest rejected: ${forbidden}.` } : exactKeys(value, ["schemaVersion", "suiteRef", "policyRef", "targetScope", "environment", "requiredPillars", "settings", "approvalRules"]) ? value.schemaVersion !== GATE_MANIFEST_VERSION ? { ok: !1, error: `Gate manifest must use ${GATE_MANIFEST_VERSION}.` } : validateSuiteReference(value.suiteRef) ? validatePolicyReference(value.policyRef) ? !record2(value.targetScope) || !exactKeys(value.targetScope, ["projectId"]) || !text2(value.targetScope.projectId, 2, 128, projectPattern) ? { ok: !1, error: "Gate targetScope must contain one stable projectId." } : text2(value.environment, 2, 64, slugPattern) ? !Array.isArray(value.requiredPillars) || value.requiredPillars.length < 1 || value.requiredPillars.length > POLICY_PILLARS.length ? { ok: !1, error: "Gate requiredPillars must contain at least one supported Policy pillar." } : value.requiredPillars.every((pillar) => POLICY_PILLARS.includes(pillar)) ? new Set(value.requiredPillars).size !== value.requiredPillars.length ? { ok: !1, error: "Gate requiredPillars must be unique." } : !record2(value.settings) || !exactKeys(value.settings, ["executionMode", "evidenceSync"]) || value.settings.executionMode !== "ALL_CONTROLS" || value.settings.evidenceSync !== "COMPACT_ONLY" ? { ok: !1, error: "Gate settings must execute all signed Suite controls and synchronize compact evidence only." } : !record2(value.approvalRules) || !exactKeys(value.approvalRules, ["minimumApprovals", "requireDistinctReviewer"]) || value.approvalRules.minimumApprovals !== 1 || value.approvalRules.requireDistinctReviewer !== !0 ? { ok: !1, error: "Gate approvalRules must require one approval from a distinct reviewer." } : { ok: !0, manifest: value } : { ok: !1, error: "Gate requiredPillars contains an unsupported pillar." } : { ok: !1, error: "Gate environment must be a bounded lowercase slug." } : { ok: !1, error: "Gate policyRef must pin an exact Policy identity, version ID, version, and SHA-256 hash." } : { ok: !1, error: "Gate suiteRef must pin an exact Suite identity, slug, version ID, version, and SHA-256 hash." } : { ok: !1, error: "Gate manifest must contain only the frozen v1 fields." };
+  return forbidden ? { ok: !1, error: `Gate manifest rejected: ${forbidden}.` } : exactKeys(value, ["schemaVersion", "suiteRef", "policyRef", "targetScope", "environment", "requiredPillars", "settings", "approvalRules"]) ? value.schemaVersion !== GATE_MANIFEST_VERSION ? { ok: !1, error: `Gate manifest must use ${GATE_MANIFEST_VERSION}.` } : validateSuiteReference(value.suiteRef) ? validatePolicyReference(value.policyRef) ? !record2(value.targetScope) || !exactKeys(value.targetScope, ["projectId"]) || !text2(value.targetScope.projectId, 2, 128, projectPattern) ? { ok: !1, error: "Gate targetScope must contain one stable projectId." } : text2(value.environment, 2, 64, slugPattern) ? !Array.isArray(value.requiredPillars) || value.requiredPillars.length < 1 || value.requiredPillars.length > POLICY_PILLARS.length ? { ok: !1, error: "Gate requiredPillars must contain at least one supported Policy pillar." } : value.requiredPillars.every((pillar) => POLICY_PILLARS.includes(pillar)) ? new Set(value.requiredPillars).size !== value.requiredPillars.length ? { ok: !1, error: "Gate requiredPillars must be unique." } : !record2(value.settings) || !exactKeys(value.settings, ["executionMode", "evidenceSync"]) || value.settings.executionMode !== "ALL_CONTROLS" || value.settings.evidenceSync !== "COMPACT_ONLY" ? { ok: !1, error: "Gate settings must execute all signed Suite controls and synchronize compact evidence only." } : !record2(value.approvalRules) || !exactKeys(value.approvalRules, ["minimumApprovals", "requireDistinctReviewer"]) || value.approvalRules.minimumApprovals !== 1 || typeof value.approvalRules.requireDistinctReviewer != "boolean" ? { ok: !1, error: "Gate approvalRules must require one recorded approval and a boolean reviewer policy." } : { ok: !0, manifest: value } : { ok: !1, error: "Gate requiredPillars contains an unsupported pillar." } : { ok: !1, error: "Gate environment must be a bounded lowercase slug." } : { ok: !1, error: "Gate policyRef must pin an exact Policy identity, version ID, version, and SHA-256 hash." } : { ok: !1, error: "Gate suiteRef must pin an exact Suite identity, slug, version ID, version, and SHA-256 hash." } : { ok: !1, error: "Gate manifest must contain only the frozen v1 fields." };
 }
 function hashGovernedGateManifest(value) {
   let validated = validateGovernedGateManifest(value);
@@ -11624,8 +11624,8 @@ function publicServerError(path) {
 }
 var HOSTED_SAMMY_AUTHORIZATION = Symbol("prooflane.hosted-sammy-authorization");
 function buildApp() {
-  let app2 = Fastify({ logger: !1 });
-  app2.addHook("onSend", async (request, reply, payload) => !request.url.startsWith("/api") || reply.statusCode < 500 ? payload : (reply.header("cache-control", "no-store"), reply.type("application/json; charset=utf-8"), JSON.stringify({ error: publicServerError(request.url), reference: request.id })));
+  let app = Fastify({ logger: !1 });
+  app.addHook("onSend", async (request, reply, payload) => !request.url.startsWith("/api") || reply.statusCode < 500 ? payload : (reply.header("cache-control", "no-store"), reply.type("application/json; charset=utf-8"), JSON.stringify({ error: publicServerError(request.url), reference: request.id })));
   let store = new Store(dbPath()), svc = new InspectorService(store), mcpManager = new McpConnectionManager(() => new InspectorService(store), store), env = (process.env.KAWACH_ENV ?? process.env.NODE_ENV ?? "production").toLowerCase(), isDev = env === "dev" || env === "development", intelligenceMode = PUBLIC_RUNNER_BUILD || process.env.KAWACH_INTELLIGENCE_MODE === "hosted" ? "hosted" : "legacy", AUTH0_DOMAIN = process.env.AUTH0_DOMAIN, AUTH0_CLIENT_ID = process.env.AUTH0_CLIENT_ID, AUTH0_AUDIENCE = process.env.AUTH0_AUDIENCE, CONTROL_PLANE_URL = process.env.KAWACH_CONTROL_PLANE_URL?.replace(/\/$/, ""), PROOFLANE_PROJECT = (process.env.PROOFLANE_PROJECT ?? "default").trim(), configuredNumber = (name, fallback, minimum, maximum) => {
     let value = Number(process.env[name]);
     return Number.isFinite(value) ? Math.max(minimum, Math.min(maximum, value)) : fallback;
@@ -11725,10 +11725,19 @@ function buildApp() {
         method,
         headers: body === void 0 ? { authorization } : { authorization, "content-type": "application/json" },
         body: body === void 0 ? void 0 : JSON.stringify(body)
-      }), text6 = await response.text(), payload = text6 ? JSON.parse(text6) : null;
-      return response.ok && await onSuccess?.(payload), reply.code(response.status).send(payload);
-    } catch {
-      return reply.code(502).send({ error: "Prooflane Cloud Workspace could not be reached. Check KAWACH_CONTROL_PLANE_URL and your connection." });
+      }), text6 = await response.text(), payload = null;
+      if (text6)
+        try {
+          payload = JSON.parse(text6);
+        } catch {
+          if (response.ok)
+            return reply.code(502).send({ error: "Prooflane Cloud Workspace returned an invalid response." });
+          payload = response.status === 404 ? { error: "The deployed Prooflane control plane does not support this Inspector route yet. Deploy the matching control-plane build, then retry.", upgrade: !0 } : { error: `Prooflane Cloud request failed (${response.status}).` };
+        }
+      let upstreamError = payload && typeof payload == "object" && typeof payload.error == "string" ? String(payload.error).trim() : "";
+      return !response.ok && response.status === 404 && (!upstreamError || /^not found$/i.test(upstreamError) || /route.*not found/i.test(upstreamError)) && (payload = { error: "The deployed Prooflane control plane does not support this Inspector route yet. Deploy the matching control-plane build, then retry.", upgrade: !0 }), response.ok && await onSuccess?.(payload), reply.code(response.status).send(payload);
+    } catch (error) {
+      return error instanceof SyntaxError ? reply.code(502).send({ error: "Prooflane Cloud Workspace returned an invalid response." }) : reply.code(502).send({ error: "Prooflane Cloud Workspace could not be reached. Check KAWACH_CONTROL_PLANE_URL and your connection." });
     }
   }
   async function requestControlPlaneJson(req, path, method = "GET", body, idempotencyKey) {
@@ -11745,9 +11754,19 @@ function buildApp() {
     } catch {
       throw new ControlPlaneRequestError(502, "Prooflane Cloud Workspace could not be reached.");
     }
-    let text6 = await response.text(), payload = text6 ? JSON.parse(text6) : {};
-    if (!response.ok)
-      throw new ControlPlaneRequestError(response.status, typeof payload.error == "string" ? String(payload.error).slice(0, 300) : "Prooflane Cloud request failed.");
+    let text6 = await response.text(), payload;
+    try {
+      payload = text6 ? JSON.parse(text6) : {};
+    } catch {
+      if (response.ok)
+        throw new ControlPlaneRequestError(502, "Prooflane Cloud Workspace returned an invalid response.");
+      let message2 = response.status === 404 ? "The deployed Prooflane control plane does not support this Inspector route yet. Deploy the matching control-plane build, then retry." : `Prooflane Cloud request failed (${response.status}).`;
+      throw new ControlPlaneRequestError(response.status, message2);
+    }
+    if (!response.ok) {
+      let upstreamError = typeof payload.error == "string" ? String(payload.error).trim().slice(0, 300) : "", message2 = response.status === 404 && (!upstreamError || /^not found$/i.test(upstreamError) || /route.*not found/i.test(upstreamError)) ? "The deployed Prooflane control plane does not support this Inspector route yet. Deploy the matching control-plane build, then retry." : upstreamError || "Prooflane Cloud request failed.";
+      throw new ControlPlaneRequestError(response.status, message2);
+    }
     return payload;
   }
   async function cloudPlan(req) {
@@ -11792,7 +11811,7 @@ function buildApp() {
   async function resolvePlan(req) {
     return (await resolvePlanState(req)).plan;
   }
-  app2.addHook("preHandler", async (req, reply) => {
+  app.addHook("preHandler", async (req, reply) => {
     if (req.method === "GET" || req.method === "HEAD" || req.method === "OPTIONS")
       return;
     let path = req.url.split("?", 1)[0] ?? req.url;
@@ -11838,17 +11857,54 @@ function buildApp() {
     let p = await resolvePlan(req);
     return { core: p.core, security: p.security, rag: p.rag, deployment: p.deployment, ci: p.ci };
   }
-  app2.addHook("onRequest", async (req, reply) => {
-    if (intelligenceMode === "hosted" && (/^\/api\/intelligence\/(?:analyze-options|surface|generations|datasets|native-artifacts|effectiveness|learning-candidates|usage)(?:\/|\?|$)/.test(req.url) || /^\/api\/(?:annotations|assurance|boundary)(?:\/|\?|$)/.test(req.url)) && req.raw.method !== "OPTIONS")
-      return reply.code(410).send({
+  if (app.addHook("onRequest", async (req, reply) => {
+    if (intelligenceMode === "hosted" && (/^\/api\/intelligence\/(?:effectiveness|learning-candidates)(?:\/|\?|$)/.test(req.url) || /^\/api\/(?:assurance|boundary)(?:\/|\?|$)/.test(req.url)) && req.raw.method !== "OPTIONS")
+      return /^\/api\/assurance\/gates(?:\/|\?|$)/.test(req.url) && reply.header("cache-control", "no-store"), reply.code(410).send({
         ok: !1,
         error: "This feature uses Hosted Intelligence and is unavailable through the retired local route."
       });
     let plan = await resolvePlan(req);
     mcpManager.reconcileEntitlement(PROOFLANE_PROJECT, mcpEntitlementForPlan(plan)), svc.setToolLimit(plan.tools), mcpManager.setToolLimit(PROOFLANE_PROJECT, plan.tools), activeMcpConnectionId && mcpManager.getConnection(PROOFLANE_PROJECT, activeMcpConnectionId)?.status === "ENTITLEMENT_LOCKED" && svc.setToolLimit(0);
-  }), app2.addHook("onSend", async (_req, reply) => {
+  }), intelligenceMode === "hosted") {
+    let hostedSurfaceRefreshInFlight = null, relayHostedIntelligenceSurface = async (req, reply, refresh) => {
+      try {
+        refresh && svc.isConnected() && (hostedSurfaceRefreshInFlight ??= svc.refreshCapabilities().finally(() => {
+          hostedSurfaceRefreshInFlight = null;
+        }), await hostedSurfaceRefreshInFlight);
+        let capabilities = svc.getCapabilities();
+        return capabilities ? proxyControlPlane(req, reply, "/v1/intelligence/surface", { capabilities }) : { connected: !1 };
+      } catch (error) {
+        return reply.code(503).send({ error: `MCP discovery refresh failed: ${error instanceof Error ? error.message : String(error)}` });
+      }
+    };
+    app.get("/api/intelligence/surface", async (req, reply) => (reply.header("cache-control", "no-store"), relayHostedIntelligenceSurface(req, reply, !1))), app.post("/api/intelligence/surface/refresh", async (req, reply) => relayHostedIntelligenceSurface(req, reply, !0));
+    let hostedSammyPath = `/v1/projects/${encodeURIComponent(PROOFLANE_PROJECT)}/intelligence`, hostedCapabilities = (reply) => {
+      let capabilities = svc.getCapabilities();
+      return capabilities || (reply.code(409).send({ error: "Connect an MCP target before using Sammy Intelligence." }), null);
+    }, selectedBody = (value, keys) => {
+      if (!value || typeof value != "object" || Array.isArray(value))
+        return {};
+      let source = value;
+      return Object.fromEntries(keys.filter((key) => source[key] !== void 0).map((key) => [key, source[key]]));
+    };
+    app.post("/api/intelligence/analyze-options", async (req, reply) => {
+      let capabilities = hostedCapabilities(reply);
+      if (capabilities)
+        return proxyControlPlane(req, reply, `${hostedSammyPath}/analyze-options`, { ...selectedBody(req.body, ["graphVersion"]), capabilities });
+    }), app.post("/api/intelligence/generations", async (req, reply) => {
+      let capabilities = hostedCapabilities(reply);
+      if (capabilities)
+        return proxyControlPlane(req, reply, `${hostedSammyPath}/generations`, { ...selectedBody(req.body, ["idempotencyKey", "strategy", "sammyEnabled", "selectedRecommendationIds", "datasetVersionRefs", "promptBundleVersion"]), capabilities });
+    }), app.get("/api/intelligence/generations/:id", async (req, reply) => proxyControlPlane(req, reply, `${hostedSammyPath}/generations/${encodeURIComponent(req.params.id)}`, void 0, "GET")), app.post("/api/intelligence/generations/:id/review", async (req, reply) => proxyControlPlane(req, reply, `${hostedSammyPath}/generations/${encodeURIComponent(req.params.id)}/review`, {})), app.post("/api/intelligence/generations/:id/approve", async (req, reply) => {
+      let capabilities = hostedCapabilities(reply);
+      if (capabilities)
+        return proxyControlPlane(req, reply, `${hostedSammyPath}/generations/${encodeURIComponent(req.params.id)}/approve`, { ...selectedBody(req.body, ["gateId", "name", "policyVersion"]), capabilities });
+    }), app.post("/api/intelligence/generations/:id/compile-suite", async (req, reply) => proxyControlPlane(req, reply, `${hostedSammyPath}/generations/${encodeURIComponent(req.params.id)}/compile-suite`, {})), app.get("/api/intelligence/usage", async (req, reply) => proxyControlPlane(req, reply, `${hostedSammyPath}/usage`, void 0, "GET")), app.get("/api/intelligence/datasets", async (req, reply) => proxyControlPlane(req, reply, `${hostedSammyPath}/datasets`, void 0, "GET")), app.post("/api/intelligence/datasets", async (req, reply) => proxyControlPlane(req, reply, `${hostedSammyPath}/datasets`, selectedBody(req.body, ["name", "format", "content"]))), app.get("/api/intelligence/native-artifacts", async (req, reply) => proxyControlPlane(req, reply, `${hostedSammyPath}/native-artifacts${req.query.pillar ? `?pillar=${encodeURIComponent(req.query.pillar)}` : ""}`, void 0, "GET")), app.post("/api/intelligence/native-artifacts/:generationId/:testId/review", async (req, reply) => proxyControlPlane(req, reply, `${hostedSammyPath}/native-artifacts/${encodeURIComponent(req.params.generationId)}/${encodeURIComponent(req.params.testId)}/review`, selectedBody(req.body, ["action", "replacement", "trustedGolden"]))), app.post("/api/annotations", async (req, reply) => proxyControlPlane(req, reply, `${hostedSammyPath}/annotations`, selectedBody(req.body, ["targetType", "targetId", "labels", "text", "resolution"]))), app.get("/api/annotations/context", async (req, reply) => proxyControlPlane(req, reply, `${hostedSammyPath}/annotations${req.query.targetId ? `?targetId=${encodeURIComponent(req.query.targetId)}` : ""}`, void 0, "GET"));
+  }
+  app.addHook("onSend", async (_req, reply) => {
     reply.header("x-content-type-options", "nosniff"), reply.header("x-frame-options", "SAMEORIGIN"), reply.header("referrer-policy", "no-referrer"), reply.header("x-permitted-cross-domain-policies", "none");
-  }), app2.get("/api/config", async (req) => {
+  }), app.get("/api/config", async (req, reply) => {
+    reply.header("cache-control", "no-store");
     let resolution = await resolvePlanState(req), plan = resolution.plan;
     return {
       env: isDev ? "dev" : "production",
@@ -11898,9 +11954,9 @@ function buildApp() {
       project: { id: PROOFLANE_PROJECT },
       intelligenceMode
     };
-  }), app2.post("/api/workspace/consent", async (req, reply) => proxyControlPlane(req, reply, "/v1/workspace/consent", req.body ?? {})), app2.post("/api/ci/token", async (req, reply) => proxyControlPlane(req, reply, "/v1/ci/token", { projectId: PROOFLANE_PROJECT }));
+  }), app.post("/api/workspace/consent", async (req, reply) => proxyControlPlane(req, reply, "/v1/workspace/consent", req.body ?? {})), app.post("/api/ci/token", async (req, reply) => proxyControlPlane(req, reply, "/v1/ci/token", { projectId: PROOFLANE_PROJECT }));
   let githubOidcTrustPath = `/v1/projects/${encodeURIComponent(PROOFLANE_PROJECT)}/github-oidc-trust`;
-  app2.get("/api/governance/github-oidc-trust", async (req, reply) => proxyControlPlane(req, reply, githubOidcTrustPath, void 0, "GET")), app2.put("/api/governance/github-oidc-trust", async (req, reply) => proxyControlPlane(req, reply, githubOidcTrustPath, req.body ?? {}, "PUT")), app2.delete("/api/governance/github-oidc-trust", async (req, reply) => proxyControlPlane(req, reply, githubOidcTrustPath, void 0, "DELETE")), app2.post("/api/trial/start", async (req, reply) => proxyControlPlane(req, reply, "/v1/trial/start", {})), app2.get("/api/workspace/status", async (req, reply) => proxyControlPlane(req, reply, "/v1/workspace", void 0, "GET")), app2.get("/api/gate-runs", async (req, reply) => proxyControlPlane(req, reply, `/v1/gate-runs?limit=${encodeURIComponent(req.query.limit ?? "200")}`, void 0, "GET")), app2.post("/api/gate-runs", async (req, reply) => proxyControlPlane(req, reply, "/v1/gate-runs", req.body ?? {})), app2.get("/api/governed-runs", async (req, reply) => proxyControlPlane(req, reply, `/v1/projects/${encodeURIComponent(PROOFLANE_PROJECT)}/runs?limit=${encodeURIComponent(req.query.limit ?? "50")}`, void 0, "GET")), app2.post("/api/intelligence/infer", async (req, reply) => {
+  app.get("/api/governance/github-oidc-trust", async (req, reply) => proxyControlPlane(req, reply, githubOidcTrustPath, void 0, "GET")), app.put("/api/governance/github-oidc-trust", async (req, reply) => proxyControlPlane(req, reply, githubOidcTrustPath, req.body ?? {}, "PUT")), app.delete("/api/governance/github-oidc-trust", async (req, reply) => proxyControlPlane(req, reply, githubOidcTrustPath, void 0, "DELETE")), app.post("/api/trial/start", async (req, reply) => proxyControlPlane(req, reply, "/v1/trial/start", {})), app.get("/api/workspace/status", async (req, reply) => proxyControlPlane(req, reply, "/v1/workspace", void 0, "GET")), app.get("/api/gate-runs", async (req, reply) => proxyControlPlane(req, reply, `/v1/gate-runs?limit=${encodeURIComponent(req.query.limit ?? "200")}`, void 0, "GET")), app.post("/api/gate-runs", async (req, reply) => proxyControlPlane(req, reply, "/v1/gate-runs", req.body ?? {})), app.get("/api/governed-runs", async (req, reply) => proxyControlPlane(req, reply, `/v1/projects/${encodeURIComponent(PROOFLANE_PROJECT)}/runs?limit=${encodeURIComponent(req.query.limit ?? "50")}`, void 0, "GET")), app.post("/api/intelligence/infer", async (req, reply) => {
     let result = await relaySammyInferenceBoundary({
       request: req.body,
       controlPlaneUrl: CONTROL_PLANE_URL,
@@ -11910,7 +11966,7 @@ function buildApp() {
     return reply.code(result.status).send(result.payload);
   });
   let suiteRegistryPath = `/v1/projects/${encodeURIComponent(PROOFLANE_PROJECT)}/suites`;
-  app2.get("/api/suites", async (req, reply) => proxyControlPlane(req, reply, suiteRegistryPath, void 0, "GET")), app2.post("/api/suites", async (req, reply) => proxyControlPlane(req, reply, suiteRegistryPath, req.body ?? {})), app2.post("/api/governance/suites/:slug/drift", async (req, reply) => {
+  app.get("/api/suites", async (req, reply) => proxyControlPlane(req, reply, suiteRegistryPath, void 0, "GET")), app.post("/api/suites", async (req, reply) => proxyControlPlane(req, reply, suiteRegistryPath, req.body ?? {})), app.post("/api/governance/suites/:slug/drift", async (req, reply) => {
     try {
       let capabilities = svc.getCapabilities();
       if (!capabilities)
@@ -11939,7 +11995,7 @@ function buildApp() {
     } catch (error) {
       return error instanceof ControlPlaneRequestError ? reply.code(error.status).send({ error: error.message }) : reply.code(500).send({ error: "Governed surface drift assessment could not complete." });
     }
-  }), app2.get("/api/suites/:slug", async (req, reply) => proxyControlPlane(req, reply, `${suiteRegistryPath}/${encodeURIComponent(req.params.slug)}`, void 0, "GET")), app2.patch("/api/suites/:slug", async (req, reply) => proxyControlPlane(req, reply, `${suiteRegistryPath}/${encodeURIComponent(req.params.slug)}`, req.body ?? {}, "PATCH")), app2.delete("/api/suites/:slug", async (req, reply) => proxyControlPlane(req, reply, `${suiteRegistryPath}/${encodeURIComponent(req.params.slug)}`, void 0, "DELETE")), app2.post("/api/suites/:slug/versions", async (req, reply) => proxyControlPlane(req, reply, `${suiteRegistryPath}/${encodeURIComponent(req.params.slug)}/versions`, req.body ?? {})), app2.get("/api/suites/:slug/versions/:version", async (req, reply) => proxyControlPlane(req, reply, `${suiteRegistryPath}/${encodeURIComponent(req.params.slug)}/versions/${encodeURIComponent(req.params.version)}`, void 0, "GET")), app2.put("/api/suites/:slug/versions/:version", async (req, reply) => proxyControlPlane(req, reply, `${suiteRegistryPath}/${encodeURIComponent(req.params.slug)}/versions/${encodeURIComponent(req.params.version)}`, req.body ?? {}, "PUT")), app2.post("/api/suites/:slug/versions/:version/review", async (req, reply) => proxyControlPlane(req, reply, `${suiteRegistryPath}/${encodeURIComponent(req.params.slug)}/versions/${encodeURIComponent(req.params.version)}/review`, {})), app2.post("/api/suites/:slug/versions/:version/approve", async (req, reply) => proxyControlPlane(req, reply, `${suiteRegistryPath}/${encodeURIComponent(req.params.slug)}/versions/${encodeURIComponent(req.params.version)}/approve`, {})), app2.post("/api/suites/:slug/versions/:version/deprecate", async (req, reply) => proxyControlPlane(req, reply, `${suiteRegistryPath}/${encodeURIComponent(req.params.slug)}/versions/${encodeURIComponent(req.params.version)}/deprecate`, {})), app2.get("/api/suites/:slug/aliases", async (req, reply) => proxyControlPlane(req, reply, `${suiteRegistryPath}/${encodeURIComponent(req.params.slug)}/aliases`, void 0, "GET")), app2.get("/api/suite-signing-keys/:keyId", async (req, reply) => proxyControlPlane(req, reply, `/v1/projects/${encodeURIComponent(PROOFLANE_PROJECT)}/suite-signing-keys/${encodeURIComponent(req.params.keyId)}`, void 0, "GET"));
+  }), app.get("/api/suites/:slug", async (req, reply) => proxyControlPlane(req, reply, `${suiteRegistryPath}/${encodeURIComponent(req.params.slug)}`, void 0, "GET")), app.patch("/api/suites/:slug", async (req, reply) => proxyControlPlane(req, reply, `${suiteRegistryPath}/${encodeURIComponent(req.params.slug)}`, req.body ?? {}, "PATCH")), app.delete("/api/suites/:slug", async (req, reply) => proxyControlPlane(req, reply, `${suiteRegistryPath}/${encodeURIComponent(req.params.slug)}`, void 0, "DELETE")), app.post("/api/suites/:slug/versions", async (req, reply) => proxyControlPlane(req, reply, `${suiteRegistryPath}/${encodeURIComponent(req.params.slug)}/versions`, req.body ?? {})), app.get("/api/suites/:slug/versions/:version", async (req, reply) => proxyControlPlane(req, reply, `${suiteRegistryPath}/${encodeURIComponent(req.params.slug)}/versions/${encodeURIComponent(req.params.version)}`, void 0, "GET")), app.put("/api/suites/:slug/versions/:version", async (req, reply) => proxyControlPlane(req, reply, `${suiteRegistryPath}/${encodeURIComponent(req.params.slug)}/versions/${encodeURIComponent(req.params.version)}`, req.body ?? {}, "PUT")), app.post("/api/suites/:slug/versions/:version/review", async (req, reply) => proxyControlPlane(req, reply, `${suiteRegistryPath}/${encodeURIComponent(req.params.slug)}/versions/${encodeURIComponent(req.params.version)}/review`, {})), app.post("/api/suites/:slug/versions/:version/approve", async (req, reply) => proxyControlPlane(req, reply, `${suiteRegistryPath}/${encodeURIComponent(req.params.slug)}/versions/${encodeURIComponent(req.params.version)}/approve`, {})), app.post("/api/suites/:slug/versions/:version/deprecate", async (req, reply) => proxyControlPlane(req, reply, `${suiteRegistryPath}/${encodeURIComponent(req.params.slug)}/versions/${encodeURIComponent(req.params.version)}/deprecate`, {})), app.get("/api/suites/:slug/aliases", async (req, reply) => proxyControlPlane(req, reply, `${suiteRegistryPath}/${encodeURIComponent(req.params.slug)}/aliases`, void 0, "GET")), app.get("/api/suite-signing-keys/:keyId", async (req, reply) => proxyControlPlane(req, reply, `/v1/projects/${encodeURIComponent(PROOFLANE_PROJECT)}/suite-signing-keys/${encodeURIComponent(req.params.keyId)}`, void 0, "GET"));
   let localMigrationInspection = async (req) => {
     let cloudResponse = await requestControlPlaneJson(req, suiteRegistryPath);
     if (cloudResponse.projectId !== PROOFLANE_PROJECT || !Array.isArray(cloudResponse.suites))
@@ -11955,14 +12011,14 @@ function buildApp() {
     let scan = discoverLegacyLocalSuites({ cwd: process.cwd() }), plan = planLegacyLocalSuiteMigration(scan.suites, cloud), suites = plan.map(safeLocalSuiteMigrationSummary);
     return { plan, response: { version: "prooflane-local-suite-migration-status-v1", projectId: PROOFLANE_PROJECT, suites, issues: scan.issues, pending: suites.filter((suite) => suite.action === "CREATE_SUITE_DRAFT" || suite.action === "CREATE_VERSION_DRAFT").length, conflicts: scan.issues.length + suites.filter((suite) => suite.action === "CONFLICT").length } };
   };
-  app2.get("/api/suite-migration/status", async (req, reply) => {
+  app.get("/api/suite-migration/status", async (req, reply) => {
     try {
       return (await localMigrationInspection(req)).response;
     } catch (error) {
       let status = error instanceof ControlPlaneRequestError ? error.status : 400;
       return reply.code(status).send({ error: (error instanceof Error ? error.message : "Local Suite migration status failed.").slice(0, 300) });
     }
-  }), app2.post("/api/suite-migration/sync", async (req, reply) => {
+  }), app.post("/api/suite-migration/sync", async (req, reply) => {
     try {
       if (!req.body || typeof req.body != "object" || Array.isArray(req.body))
         return reply.code(400).send({ error: "Migration sync request must be an object." });
@@ -12011,15 +12067,15 @@ ${item.artifact.localFingerprint}`));
     }
   });
   let gateRegistryPath = `/v1/projects/${encodeURIComponent(PROOFLANE_PROJECT)}/gates`;
-  app2.get("/api/governance/gates", async (req, reply) => proxyControlPlane(req, reply, gateRegistryPath, void 0, "GET")), app2.post("/api/governance/gates", async (req, reply) => proxyControlPlane(req, reply, gateRegistryPath, req.body ?? {})), app2.get("/api/governance/gates/:slug", async (req, reply) => proxyControlPlane(req, reply, `${gateRegistryPath}/${encodeURIComponent(req.params.slug)}`, void 0, "GET")), app2.post("/api/governance/gates/:slug/versions", async (req, reply) => proxyControlPlane(req, reply, `${gateRegistryPath}/${encodeURIComponent(req.params.slug)}/versions`, req.body ?? {})), app2.get("/api/governance/gates/:slug/versions/:version", async (req, reply) => proxyControlPlane(req, reply, `${gateRegistryPath}/${encodeURIComponent(req.params.slug)}/versions/${encodeURIComponent(req.params.version)}`, void 0, "GET")), app2.put("/api/governance/gates/:slug/versions/:version", async (req, reply) => proxyControlPlane(req, reply, `${gateRegistryPath}/${encodeURIComponent(req.params.slug)}/versions/${encodeURIComponent(req.params.version)}`, req.body ?? {}, "PUT"));
+  app.get("/api/governance/gates", async (req, reply) => proxyControlPlane(req, reply, gateRegistryPath, void 0, "GET")), app.post("/api/governance/gates", async (req, reply) => proxyControlPlane(req, reply, gateRegistryPath, req.body ?? {})), app.get("/api/governance/gates/:slug", async (req, reply) => proxyControlPlane(req, reply, `${gateRegistryPath}/${encodeURIComponent(req.params.slug)}`, void 0, "GET")), app.post("/api/governance/gates/:slug/versions", async (req, reply) => proxyControlPlane(req, reply, `${gateRegistryPath}/${encodeURIComponent(req.params.slug)}/versions`, req.body ?? {})), app.get("/api/governance/gates/:slug/versions/:version", async (req, reply) => proxyControlPlane(req, reply, `${gateRegistryPath}/${encodeURIComponent(req.params.slug)}/versions/${encodeURIComponent(req.params.version)}`, void 0, "GET")), app.put("/api/governance/gates/:slug/versions/:version", async (req, reply) => proxyControlPlane(req, reply, `${gateRegistryPath}/${encodeURIComponent(req.params.slug)}/versions/${encodeURIComponent(req.params.version)}`, req.body ?? {}, "PUT"));
   for (let transition of ["review", "approve", "deprecate"])
-    app2.post(`/api/governance/gates/:slug/versions/:version/${transition}`, async (req, reply) => proxyControlPlane(req, reply, `${gateRegistryPath}/${encodeURIComponent(req.params.slug)}/versions/${encodeURIComponent(req.params.version)}/${transition}`, {}));
-  app2.get("/api/governance/gates/:slug/aliases", async (req, reply) => proxyControlPlane(req, reply, `${gateRegistryPath}/${encodeURIComponent(req.params.slug)}/aliases`, void 0, "GET")), app2.get("/api/governance/gates/:slug/audit", async (req, reply) => proxyControlPlane(req, reply, `${gateRegistryPath}/${encodeURIComponent(req.params.slug)}/audit?limit=${encodeURIComponent(req.query.limit ?? "50")}`, void 0, "GET")), app2.get("/api/governance/gates/:slug/resolve", async (req, reply) => proxyControlPlane(req, reply, `${gateRegistryPath}/${encodeURIComponent(req.params.slug)}/resolve`, void 0, "GET")), app2.get("/api/governance/gate-signing-keys/:keyId", async (req, reply) => proxyControlPlane(req, reply, `/v1/projects/${encodeURIComponent(PROOFLANE_PROJECT)}/gate-signing-keys/${encodeURIComponent(req.params.keyId)}`, void 0, "GET"));
+    app.post(`/api/governance/gates/:slug/versions/:version/${transition}`, async (req, reply) => proxyControlPlane(req, reply, `${gateRegistryPath}/${encodeURIComponent(req.params.slug)}/versions/${encodeURIComponent(req.params.version)}/${transition}`, {}));
+  app.get("/api/governance/gates/:slug/aliases", async (req, reply) => proxyControlPlane(req, reply, `${gateRegistryPath}/${encodeURIComponent(req.params.slug)}/aliases`, void 0, "GET")), app.get("/api/governance/gates/:slug/audit", async (req, reply) => proxyControlPlane(req, reply, `${gateRegistryPath}/${encodeURIComponent(req.params.slug)}/audit?limit=${encodeURIComponent(req.query.limit ?? "50")}`, void 0, "GET")), app.get("/api/governance/gates/:slug/resolve", async (req, reply) => proxyControlPlane(req, reply, `${gateRegistryPath}/${encodeURIComponent(req.params.slug)}/resolve`, void 0, "GET")), app.get("/api/governance/gate-signing-keys/:keyId", async (req, reply) => proxyControlPlane(req, reply, `/v1/projects/${encodeURIComponent(PROOFLANE_PROJECT)}/gate-signing-keys/${encodeURIComponent(req.params.keyId)}`, void 0, "GET"));
   let learningRegistryPath = `/v1/projects/${encodeURIComponent(PROOFLANE_PROJECT)}/learning`, learningMutationAuthorized = (req, reply) => typeof req.headers.authorization == "string" && req.headers.authorization.startsWith("Bearer ") ? !0 : (reply.code(401).send({ error: "Sign in to your Prooflane account first." }), !1);
-  app2.get("/api/governance/learning/runs/:runId/findings", async (req, reply) => proxyControlPlane(req, reply, `/v1/projects/${encodeURIComponent(PROOFLANE_PROJECT)}/runs/${encodeURIComponent(req.params.runId)}/learning-findings`, void 0, "GET")), app2.get("/api/governance/learning/runs/:runId/disposition", async (req, reply) => proxyControlPlane(req, reply, `/v1/projects/${encodeURIComponent(PROOFLANE_PROJECT)}/runs/${encodeURIComponent(req.params.runId)}/learning-disposition`, void 0, "GET")), app2.put("/api/governance/learning/runs/:runId/disposition", async (req, reply) => {
+  app.get("/api/governance/learning/runs/:runId/findings", async (req, reply) => proxyControlPlane(req, reply, `/v1/projects/${encodeURIComponent(PROOFLANE_PROJECT)}/runs/${encodeURIComponent(req.params.runId)}/learning-findings`, void 0, "GET")), app.get("/api/governance/learning/runs/:runId/disposition", async (req, reply) => proxyControlPlane(req, reply, `/v1/projects/${encodeURIComponent(PROOFLANE_PROJECT)}/runs/${encodeURIComponent(req.params.runId)}/learning-disposition`, void 0, "GET")), app.put("/api/governance/learning/runs/:runId/disposition", async (req, reply) => {
     if (learningMutationAuthorized(req, reply))
       return !isApproveLearningDispositionRequest(req.body) || findSensitiveMaterial(req.body) ? reply.code(400).send({ error: "Expected a compact prooflane-learning-disposition-request-v1 envelope." }) : proxyControlPlane(req, reply, `/v1/projects/${encodeURIComponent(PROOFLANE_PROJECT)}/runs/${encodeURIComponent(req.params.runId)}/learning-disposition`, req.body, "PUT");
-  }), app2.get("/api/governance/learning/generations", async (req, reply) => proxyControlPlane(req, reply, `${learningRegistryPath}/generations?limit=${encodeURIComponent(req.query.limit ?? "50")}`, void 0, "GET")), app2.post("/api/governance/learning/generations", async (req, reply) => {
+  }), app.get("/api/governance/learning/generations", async (req, reply) => proxyControlPlane(req, reply, `${learningRegistryPath}/generations?limit=${encodeURIComponent(req.query.limit ?? "50")}`, void 0, "GET")), app.post("/api/governance/learning/generations", async (req, reply) => {
     if (!learningMutationAuthorized(req, reply))
       return;
     if (!isCreateLearningGenerationRequest(req.body))
@@ -12033,15 +12089,15 @@ ${item.artifact.localFingerprint}`));
       let status = error instanceof ControlPlaneRequestError ? error.status : 502;
       return reply.code(status).send({ error: error instanceof Error ? error.message : "Governed learning generation failed." });
     }
-  }), app2.get("/api/governance/learning/tests", async (req, reply) => proxyControlPlane(req, reply, `${learningRegistryPath}/tests?limit=${encodeURIComponent(req.query.limit ?? "100")}`, void 0, "GET"));
+  }), app.get("/api/governance/learning/tests", async (req, reply) => proxyControlPlane(req, reply, `${learningRegistryPath}/tests?limit=${encodeURIComponent(req.query.limit ?? "100")}`, void 0, "GET"));
   for (let transition of ["review", "approve"])
-    app2.post(`/api/governance/learning/tests/:testId/${transition}`, async (req, reply) => {
+    app.post(`/api/governance/learning/tests/:testId/${transition}`, async (req, reply) => {
       if (learningMutationAuthorized(req, reply))
         return !req.body || typeof req.body != "object" || Array.isArray(req.body) || Object.keys(req.body).length !== 0 ? reply.code(400).send({ error: "Learning lifecycle transitions accept an empty body only." }) : proxyControlPlane(req, reply, `${learningRegistryPath}/tests/${encodeURIComponent(req.params.testId)}/${transition}`, {});
     });
-  app2.get("/api/governance/learning/audit", async (req, reply) => proxyControlPlane(req, reply, `${learningRegistryPath}/audit?limit=${encodeURIComponent(req.query.limit ?? "100")}`, void 0, "GET"));
+  app.get("/api/governance/learning/audit", async (req, reply) => proxyControlPlane(req, reply, `${learningRegistryPath}/audit?limit=${encodeURIComponent(req.query.limit ?? "100")}`, void 0, "GET"));
   let runnerRegistryPath = `/v1/projects/${encodeURIComponent(PROOFLANE_PROJECT)}/runners`;
-  app2.get("/api/governance/runners", async (req, reply) => proxyControlPlane(req, reply, runnerRegistryPath, void 0, "GET")), app2.post("/api/governance/runners/:runnerId/revoke", async (req, reply) => proxyControlPlane(req, reply, `${runnerRegistryPath}/${encodeURIComponent(req.params.runnerId)}/revoke`, {})), app2.post("/api/governance/gates/:slug/remote-runs", async (req, reply) => proxyControlPlane(req, reply, `${gateRegistryPath}/${encodeURIComponent(req.params.slug)}/remote-runs`, req.body ?? {})), app2.get("/api/governance/runner-jobs/:jobId", async (req, reply) => proxyControlPlane(req, reply, `/v1/projects/${encodeURIComponent(PROOFLANE_PROJECT)}/runner-jobs/${encodeURIComponent(req.params.jobId)}`, void 0, "GET")), app2.post("/api/governance/runner-jobs/:jobId/cancel", async (req, reply) => proxyControlPlane(req, reply, `/v1/projects/${encodeURIComponent(PROOFLANE_PROJECT)}/runner-jobs/${encodeURIComponent(req.params.jobId)}/cancel`, {})), app2.post("/api/governance/gates/:slug/runs", async (req, reply) => {
+  app.get("/api/governance/runners", async (req, reply) => proxyControlPlane(req, reply, runnerRegistryPath, void 0, "GET")), app.post("/api/governance/runners/:runnerId/revoke", async (req, reply) => proxyControlPlane(req, reply, `${runnerRegistryPath}/${encodeURIComponent(req.params.runnerId)}/revoke`, {})), app.post("/api/governance/gates/:slug/remote-runs", async (req, reply) => proxyControlPlane(req, reply, `${gateRegistryPath}/${encodeURIComponent(req.params.slug)}/remote-runs`, req.body ?? {})), app.get("/api/governance/runner-jobs/:jobId", async (req, reply) => proxyControlPlane(req, reply, `/v1/projects/${encodeURIComponent(PROOFLANE_PROJECT)}/runner-jobs/${encodeURIComponent(req.params.jobId)}`, void 0, "GET")), app.post("/api/governance/runner-jobs/:jobId/cancel", async (req, reply) => proxyControlPlane(req, reply, `/v1/projects/${encodeURIComponent(PROOFLANE_PROJECT)}/runner-jobs/${encodeURIComponent(req.params.jobId)}/cancel`, {})), app.post("/api/governance/gates/:slug/runs", async (req, reply) => {
     let projectPath = `/v1/projects/${encodeURIComponent(PROOFLANE_PROJECT)}`, run, startedAt = (/* @__PURE__ */ new Date()).toISOString(), startedMs = Date.now();
     try {
       let resolutionPayload = await requestControlPlaneJson(req, `${gateRegistryPath}/${encodeURIComponent(req.params.slug)}/resolve`), object = (value) => !!value && typeof value == "object" && !Array.isArray(value);
@@ -12151,7 +12207,7 @@ ${PROOFLANE_PROJECT}`, "utf8").digest("hex").slice(0, 24)}`, idempotencyKey = `l
     }
   });
   let policyRegistryPath = `/v1/projects/${encodeURIComponent(PROOFLANE_PROJECT)}/policies`;
-  app2.get("/api/policies", async (req, reply) => proxyControlPlane(req, reply, policyRegistryPath, void 0, "GET")), app2.post("/api/policies", async (req, reply) => proxyControlPlane(req, reply, policyRegistryPath, req.body ?? {})), app2.get("/api/policies/:policyId", async (req, reply) => proxyControlPlane(req, reply, `${policyRegistryPath}/${encodeURIComponent(req.params.policyId)}`, void 0, "GET")), app2.post("/api/policies/:policyId/versions", async (req, reply) => proxyControlPlane(req, reply, `${policyRegistryPath}/${encodeURIComponent(req.params.policyId)}/versions`, req.body ?? {})), app2.put("/api/policies/:policyId/versions/:version", async (req, reply) => proxyControlPlane(req, reply, `${policyRegistryPath}/${encodeURIComponent(req.params.policyId)}/versions/${encodeURIComponent(req.params.version)}`, req.body ?? {}, "PUT")), app2.post("/api/policies/:policyId/versions/:version/review", async (req, reply) => proxyControlPlane(req, reply, `${policyRegistryPath}/${encodeURIComponent(req.params.policyId)}/versions/${encodeURIComponent(req.params.version)}/review`, {})), app2.post("/api/policies/:policyId/versions/:version/approve", async (req, reply) => proxyControlPlane(req, reply, `${policyRegistryPath}/${encodeURIComponent(req.params.policyId)}/versions/${encodeURIComponent(req.params.version)}/approve`, {})), app2.post("/api/policies/:policyId/versions/:version/deprecate", async (req, reply) => proxyControlPlane(req, reply, `${policyRegistryPath}/${encodeURIComponent(req.params.policyId)}/versions/${encodeURIComponent(req.params.version)}/deprecate`, {})), app2.post("/api/assure/target-snapshot", async (req, reply) => proxyControlPlane(req, reply, "/v1/assure/target-snapshot", req.body ?? {})), app2.get("/api/assure/target-snapshot", async (req, reply) => proxyControlPlane(req, reply, "/v1/assure/target-snapshot", void 0, "GET")), app2.post("/api/workspace/backup-preference", async (req, reply) => proxyControlPlane(req, reply, "/v1/workspace/backup-preference", req.body ?? {})), app2.post("/api/workspace/backup", async (req, reply) => {
+  app.get("/api/policies", async (req, reply) => proxyControlPlane(req, reply, policyRegistryPath, void 0, "GET")), app.post("/api/policies", async (req, reply) => proxyControlPlane(req, reply, policyRegistryPath, req.body ?? {})), app.get("/api/policies/:policyId", async (req, reply) => proxyControlPlane(req, reply, `${policyRegistryPath}/${encodeURIComponent(req.params.policyId)}`, void 0, "GET")), app.post("/api/policies/:policyId/versions", async (req, reply) => proxyControlPlane(req, reply, `${policyRegistryPath}/${encodeURIComponent(req.params.policyId)}/versions`, req.body ?? {})), app.put("/api/policies/:policyId/versions/:version", async (req, reply) => proxyControlPlane(req, reply, `${policyRegistryPath}/${encodeURIComponent(req.params.policyId)}/versions/${encodeURIComponent(req.params.version)}`, req.body ?? {}, "PUT")), app.post("/api/policies/:policyId/versions/:version/review", async (req, reply) => proxyControlPlane(req, reply, `${policyRegistryPath}/${encodeURIComponent(req.params.policyId)}/versions/${encodeURIComponent(req.params.version)}/review`, {})), app.post("/api/policies/:policyId/versions/:version/approve", async (req, reply) => proxyControlPlane(req, reply, `${policyRegistryPath}/${encodeURIComponent(req.params.policyId)}/versions/${encodeURIComponent(req.params.version)}/approve`, {})), app.post("/api/policies/:policyId/versions/:version/deprecate", async (req, reply) => proxyControlPlane(req, reply, `${policyRegistryPath}/${encodeURIComponent(req.params.policyId)}/versions/${encodeURIComponent(req.params.version)}/deprecate`, {})), app.post("/api/assure/target-snapshot", async (req, reply) => proxyControlPlane(req, reply, "/v1/assure/target-snapshot", req.body ?? {})), app.get("/api/assure/target-snapshot", async (req, reply) => proxyControlPlane(req, reply, "/v1/assure/target-snapshot", void 0, "GET")), app.post("/api/workspace/backup-preference", async (req, reply) => proxyControlPlane(req, reply, "/v1/workspace/backup-preference", req.body ?? {})), app.post("/api/workspace/backup", async (req, reply) => {
     let snapshots = svc.listSnapshots().map(({ id, createdAt, kind, origin, snapshot }) => ({ id, createdAt, kind, origin, snapshot })), backup = {
       version: "workspace-backup-v1",
       capturedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -12167,7 +12223,7 @@ ${PROOFLANE_PROJECT}`, "utf8").digest("hex").slice(0, 24)}`, idempotencyKey = `l
       let capturedAt = payload && typeof payload == "object" && typeof payload.capturedAt == "string" ? payload.capturedAt : backup.capturedAt;
       svc.markCloudWorkspaceBackedUp(capturedAt);
     });
-  }), app2.get("/api/workspace/backup/latest", async (req, reply) => proxyControlPlane(req, reply, `/v1/workspace/backup/latest${req.query?.restorable ? "?restorable=1" : ""}`, void 0, "GET")), app2.get("/api/workspace/backup/versions", async (req, reply) => proxyControlPlane(req, reply, `/v1/workspace/backup/versions${req.query?.limit ? `?limit=${encodeURIComponent(req.query.limit)}` : ""}`, void 0, "GET")), app2.post("/api/workspace/restore", async (req, reply) => {
+  }), app.get("/api/workspace/backup/latest", async (req, reply) => proxyControlPlane(req, reply, `/v1/workspace/backup/latest${req.query?.restorable ? "?restorable=1" : ""}`, void 0, "GET")), app.get("/api/workspace/backup/versions", async (req, reply) => proxyControlPlane(req, reply, `/v1/workspace/backup/versions${req.query?.limit ? `?limit=${encodeURIComponent(req.query.limit)}` : ""}`, void 0, "GET")), app.post("/api/workspace/restore", async (req, reply) => {
     if (!CONTROL_PLANE_URL)
       return reply.code(503).send({ error: "Prooflane Cloud Workspace is not configured for this Inspector." });
     let authorization = req.headers.authorization;
@@ -12186,20 +12242,20 @@ ${PROOFLANE_PROJECT}`, "utf8").digest("hex").slice(0, 24)}`, idempotencyKey = `l
       return reply.code(404).send({ ok: !1, error: "No cloud backup was found to restore." });
     let restored = svc.restoreFromBackup(backup.value), capturedAt = backup.value.capturedAt ?? backup.createdAt;
     return svc.markCloudWorkspaceBackedUp(capturedAt), reply.send({ ok: !0, restored, capturedAt, backupId: backup.id });
-  }), app2.post("/api/workspace/local/lifecycle", async (req, reply) => {
+  }), app.post("/api/workspace/local/lifecycle", async (req, reply) => {
     if (req.headers["x-kawach-local-lifecycle"] !== localLifecycleKey)
       return reply.code(403).send({ error: "Invalid local workspace lifecycle request." });
     let subject = typeof req.body?.subject == "string" ? req.body.subject.slice(0, 320) : void 0;
     await mcpManager.clearWorkspace(PROOFLANE_PROJECT);
     let result = await svc.applyLocalWorkspaceLifecycle(subject);
     return svc = new InspectorService(store), activeMcpConnectionId = null, activeMcpAuthMode = "unknown", oauthFlows.clear(), { ok: !0, result, reason: req.body?.reason ?? "login" };
-  }), app2.post("/api/intelligence/leases", async (req, reply) => proxyControlPlane(req, reply, "/v1/intelligence/leases", req.body ?? {})), app2.post("/api/intelligence/evidence", async (req, reply) => proxyControlPlane(req, reply, "/v1/intelligence/evidence", req.body ?? {})), app2.post("/api/intelligence/evaluations", async (req, reply) => proxyControlPlane(req, reply, "/v1/intelligence/evaluations", req.body ?? {})), app2.get("/api/security/catalog", async (req, reply) => proxyControlPlane(req, reply, "/v1/security/catalog", void 0, "GET"));
+  }), app.post("/api/intelligence/leases", async (req, reply) => proxyControlPlane(req, reply, "/v1/intelligence/leases", req.body ?? {})), app.post("/api/intelligence/evidence", async (req, reply) => proxyControlPlane(req, reply, "/v1/intelligence/evidence", req.body ?? {})), app.post("/api/intelligence/evaluations", async (req, reply) => proxyControlPlane(req, reply, "/v1/intelligence/evaluations", req.body ?? {})), app.get("/api/security/catalog", async (req, reply) => proxyControlPlane(req, reply, "/v1/security/catalog", void 0, "GET"));
   for (let pillar of ["security", "rag"])
-    app2.post(`/api/${pillar}/scans`, async (req, reply) => proxyControlPlane(req, reply, "/v1/scans", { pillar, ...req.body ?? {} })), app2.get(`/api/${pillar}/scans/:id`, async (req, reply) => proxyControlPlane(req, reply, `/v1/scans/${encodeURIComponent(req.params.id)}`, void 0, "GET")), app2.get(`/api/${pillar}/scans/:id/events`, async (req, reply) => {
+    app.post(`/api/${pillar}/scans`, async (req, reply) => proxyControlPlane(req, reply, "/v1/scans", { pillar, ...req.body ?? {} })), app.get(`/api/${pillar}/scans/:id`, async (req, reply) => proxyControlPlane(req, reply, `/v1/scans/${encodeURIComponent(req.params.id)}`, void 0, "GET")), app.get(`/api/${pillar}/scans/:id/events`, async (req, reply) => {
       let after = Math.max(0, Math.trunc(Number(req.query.after)) || 0);
       return proxyControlPlane(req, reply, `/v1/scans/${encodeURIComponent(req.params.id)}/events?after=${after}`, void 0, "GET");
-    }), app2.post(`/api/${pillar}/scans/:id/next-task`, async (req, reply) => proxyControlPlane(req, reply, `/v1/scans/${encodeURIComponent(req.params.id)}/next-task`, {})), app2.post(`/api/${pillar}/scans/:id/evidence`, async (req, reply) => proxyControlPlane(req, reply, `/v1/scans/${encodeURIComponent(req.params.id)}/evidence`, req.body ?? {})), app2.post(`/api/${pillar}/scans/:id/stop`, async (req, reply) => proxyControlPlane(req, reply, `/v1/scans/${encodeURIComponent(req.params.id)}/cancel`, {})), app2.post(`/api/${pillar}/scans/:id/retry`, async (req, reply) => proxyControlPlane(req, reply, `/v1/scans/${encodeURIComponent(req.params.id)}/retry`, {}));
-  app2.post("/api/benchmark/evidence/generate", async (req, reply) => {
+    }), app.post(`/api/${pillar}/scans/:id/next-task`, async (req, reply) => proxyControlPlane(req, reply, `/v1/scans/${encodeURIComponent(req.params.id)}/next-task`, {})), app.post(`/api/${pillar}/scans/:id/evidence`, async (req, reply) => proxyControlPlane(req, reply, `/v1/scans/${encodeURIComponent(req.params.id)}/evidence`, req.body ?? {})), app.post(`/api/${pillar}/scans/:id/stop`, async (req, reply) => proxyControlPlane(req, reply, `/v1/scans/${encodeURIComponent(req.params.id)}/cancel`, {})), app.post(`/api/${pillar}/scans/:id/retry`, async (req, reply) => proxyControlPlane(req, reply, `/v1/scans/${encodeURIComponent(req.params.id)}/retry`, {}));
+  app.post("/api/benchmark/evidence/generate", async (req, reply) => {
     let generator = req.body?.generator, count = Math.min(20, Math.max(1, Math.trunc(req.body?.count ?? 4))), brief = req.body?.brief?.trim();
     if (!generator?.model?.trim() || !generator.apiKey?.trim())
       return reply.code(400).send({ error: "Configure the evidence-generator model and API key." });
@@ -12285,7 +12341,7 @@ ${existing.length ? existing.join(`
       (run?.status === "CANCELLED" || run?.status === "FAILED") && store.releaseBenchmarkEntitlement(workspaceId, entitlement.id, entitlement.reservationKey);
     }
   };
-  app2.get("/api/benchmark/entitlements", async () => {
+  app.get("/api/benchmark/entitlements", async () => {
     let workspaceId = benchmarkWorkspaceId();
     ensureFreeFastBenchmarkEntitlement(), reconcileTerminalBenchmarkReservations(workspaceId);
     let entitlements = store.listBenchmarkEntitlements(workspaceId);
@@ -12297,7 +12353,7 @@ ${existing.length ? existing.join(`
       pricingPolicy: benchmarkPricingPolicy,
       purchase: { verification: "SERVER_REQUIRED", clientPaidFlagsAccepted: !1 }
     };
-  }), app2.post("/api/benchmark/purchases/verify", async (req, reply) => {
+  }), app.post("/api/benchmark/purchases/verify", async (req, reply) => {
     let receipt = req.body?.receipt?.trim(), idempotencyKey = req.body?.idempotencyKey?.trim();
     return !receipt || receipt.length > 65536 || !idempotencyKey || idempotencyKey.length > 120 ? reply.code(400).send({ error: "A bounded purchase receipt and idempotency key are required." }) : proxyControlPlane(req, reply, "/v1/benchmark/purchases/verify", { ...req.body, receipt, idempotencyKey, projectId: PROOFLANE_PROJECT }, "POST", (payload) => {
       let response = payload, entitlement = response?.entitlement;
@@ -12305,7 +12361,7 @@ ${existing.length ? existing.join(`
         throw new Error("Prooflane returned an invalid Benchmark purchase entitlement.");
       store.saveBenchmarkEntitlement(entitlement);
     });
-  }), app2.post("/api/benchmark/plans", async (req, reply) => {
+  }), app.post("/api/benchmark/plans", async (req, reply) => {
     if (intelligenceMode === "hosted")
       return proxyControlPlane(req, reply, "/v1/benchmark/plans", req.body ?? {});
     let body = req.body ?? {}, objective = body.objective?.trim(), targetType = body.targetType, mode = body.mode, targets = body.targets;
@@ -12402,7 +12458,7 @@ ${existing.length ? existing.join(`
       let message2 = error instanceof Error ? error.message : String(error), status = error instanceof ControlPlaneRequestError ? error.status : /allowance|locked|not enabled/i.test(message2) ? 403 : 502;
       return reply.code(status).send({ error: status < 500 ? message2 : publicIntelligenceGenerationError(message2) });
     }
-  }), app2.post("/api/benchmark/run", async (req, reply) => {
+  }), app.post("/api/benchmark/run", async (req, reply) => {
     let suppliedCandidates = req.body?.candidates, workflowPlan = req.body?.plan, suppliedCases = req.body?.cases;
     if (!Array.isArray(suppliedCandidates) || suppliedCandidates.length < 2 || suppliedCandidates.length > 8)
       return reply.code(400).send({ error: "Choose between 2 and 8 benchmark candidates." });
@@ -12614,16 +12670,16 @@ ${existing.length ? existing.join(`
     } finally {
       keys.clear(), prices.clear();
     }
-  }), app2.get("/api/benchmark/history", async (req) => {
+  }), app.get("/api/benchmark/history", async (req) => {
     let limit = Math.max(1, Math.min(100, Number(req.query.limit) || 25));
     return { runs: store.listBenchmarkRuns(benchmarkWorkspaceId(), limit).map((record6) => ({ runId: record6.runId, status: record6.status, planId: record6.plan.planId, planVersion: record6.plan.version, objective: record6.plan.objective, mode: record6.plan.mode, targetType: record6.plan.targetType, summary: record6.summary, createdAt: record6.createdAt, updatedAt: record6.updatedAt })) };
-  }), app2.get("/api/benchmark/runs/:id", async (req, reply) => {
+  }), app.get("/api/benchmark/runs/:id", async (req, reply) => {
     let record6 = store.getBenchmarkRun(req.params.id);
     return !record6 || record6.workspaceId !== benchmarkWorkspaceId() ? reply.code(404).send({ error: "Benchmark Run not found." }) : { run: record6 };
-  }), app2.get("/api/benchmark/runs/:id/report.html", async (req, reply) => {
+  }), app.get("/api/benchmark/runs/:id/report.html", async (req, reply) => {
     let record6 = store.getBenchmarkRun(req.params.id);
     return !record6 || record6.workspaceId !== benchmarkWorkspaceId() || !record6.reportHtml ? reply.code(404).send({ error: "Benchmark HTML report not found." }) : (reply.header("Content-Disposition", `attachment; filename="benchmark-report-${record6.runId}.html"`), reply.type("text/html; charset=utf-8"), record6.reportHtml);
-  }), app2.post("/api/intelligence/execute", async (req, reply) => {
+  }), app.post("/api/intelligence/execute", async (req, reply) => {
     if (!req.body?.lease)
       return reply.code(400).send({ ok: !1, error: "A hosted Intelligence lease is required." });
     let claims;
@@ -12894,7 +12950,7 @@ ${answer}`
   let tagsFile = () => join4(process.cwd(), DEFAULT_TAGS_FILE), readTagsConfig = (file) => parseTagsConfig(existsSync2(file) ? readFileSync3(file, "utf8") : ""), writeTagsConfig = (file, config) => {
     mkdirSync2(dirname4(file), { recursive: !0 }), writeFileSync(file, serializeTagsConfig(config));
   };
-  app2.get("/api/tags", async () => ({ ok: !0, path: DEFAULT_TAGS_FILE, config: readTagsConfig(tagsFile()) })), app2.post("/api/tags", async (req, reply) => {
+  app.get("/api/tags", async () => ({ ok: !0, path: DEFAULT_TAGS_FILE, config: readTagsConfig(tagsFile()) })), app.post("/api/tags", async (req, reply) => {
     let plan = await resolvePlan(req);
     if (!plan.gates)
       return reply.code(402).send({ ok: !1, upgrade: !0, feature: "gates", tier: plan.tier, error: "CI gates are part of the Scale plan. Upgrade to capture tagged tests for CI." });
@@ -12903,7 +12959,7 @@ ${answer}`
       return reply.code(400).send({ ok: !1, error: "A valid tagged test (id, pillar, tags[]) is required." });
     let file = tagsFile(), next = upsertTest(readTagsConfig(file), { ...test, createdAt: test.createdAt || (/* @__PURE__ */ new Date()).toISOString() });
     return writeTagsConfig(file, next), { ok: !0, path: DEFAULT_TAGS_FILE, config: next };
-  }), app2.delete("/api/tags/:id", async (req, reply) => {
+  }), app.delete("/api/tags/:id", async (req, reply) => {
     let plan = await resolvePlan(req);
     if (!plan.gates)
       return reply.code(402).send({ ok: !1, upgrade: !0, feature: "gates", tier: plan.tier, error: "CI gates are part of the Scale plan." });
@@ -12927,7 +12983,7 @@ ${answer}`
     mkdirSync2(dirname4(file), { recursive: !0 }), writeFileSync(file, JSON.stringify({ version: "prooflane-gates-v1", gates }, null, 2) + `
 `, "utf8");
   };
-  app2.get("/api/gates", async () => ({ ok: !0, path: ".prooflane/gates.json", gates: readLegacyRegressionGroups() })), app2.put("/api/gates/:id", async (req, reply) => {
+  app.get("/api/gates", async () => ({ ok: !0, path: ".prooflane/gates.json", gates: readLegacyRegressionGroups() })), app.put("/api/gates/:id", async (req, reply) => {
     let plan = await resolvePlan(req);
     if (!plan.gates)
       return reply.code(402).send({ ok: !1, upgrade: !0, feature: "gates", tier: plan.tier, error: "Legacy local regression groups are part of the Scale plan." });
@@ -12935,7 +12991,7 @@ ${answer}`
       return reply.code(400).send({ ok: !1, error: "A valid legacy local regression group with at least one tag is required." });
     let current = readLegacyRegressionGroups(), existing = current.find((gate2) => gate2.id === req.params.id), gate = { ...req.body.gate, createdAt: existing?.createdAt ?? req.body.gate.createdAt }, next = [...current.filter((item) => item.id !== gate.id), gate].sort((a, b) => a.name.localeCompare(b.name));
     return writeLegacyRegressionGroups(next), { ok: !0, path: ".prooflane/gates.json", gate, gates: next };
-  }), app2.delete("/api/gates/:id", async (req, reply) => {
+  }), app.delete("/api/gates/:id", async (req, reply) => {
     let plan = await resolvePlan(req);
     if (!plan.gates)
       return reply.code(402).send({ ok: !1, upgrade: !0, feature: "gates", tier: plan.tier, error: "Legacy local regression groups are part of the Scale plan." });
@@ -12967,7 +13023,7 @@ ${answer}`
       throw new Error("Connected MCP runtime was not registered.");
     return runtime.setToolLimit?.(plan.tools), svc = runtime, activeMcpConnectionId = result.connection.id, activeMcpAuthMode = authModeFor(connection), result;
   }
-  app2.post("/api/connect", async (req, reply) => {
+  app.post("/api/connect", async (req, reply) => {
     try {
       let disconnected = mcpManager.listConnections(PROOFLANE_PROJECT).filter((connection) => connection.status === "DISCONNECTED");
       if (!activeMcpConnectionId && disconnected.length === 1) {
@@ -12979,21 +13035,21 @@ ${answer}`
     } catch (error) {
       return sendMcpError(reply, error);
     }
-  }), app2.get("/api/mcp/connections", async (req) => {
+  }), app.get("/api/mcp/connections", async (req) => {
     let entitlement = mcpEntitlementForPlan(await resolvePlan(req)), connections = mcpManager.reconcileEntitlement(PROOFLANE_PROJECT, entitlement);
     return {
       connections,
       entitlement,
       usage: { current: connections.length, allowed: entitlement.maxConnections }
     };
-  }), app2.post("/api/mcp/connections", async (req, reply) => {
+  }), app.post("/api/mcp/connections", async (req, reply) => {
     try {
       let result = await connectMcp(req, req.body.connection, req.body.displayName ?? req.body.name);
       return reply.code(201).send({ ok: !0, ...result });
     } catch (error) {
       return sendMcpError(reply, error);
     }
-  }), app2.post("/api/mcp/connections/:id/reconnect", async (req, reply) => {
+  }), app.post("/api/mcp/connections/:id/reconnect", async (req, reply) => {
     try {
       let plan = await resolvePlan(req);
       mcpManager.reconcileEntitlement(PROOFLANE_PROJECT, mcpEntitlementForPlan(plan));
@@ -13005,7 +13061,7 @@ ${answer}`
     } catch (error) {
       return sendMcpError(reply, error);
     }
-  }), app2.post("/api/mcp/connections/:id/activate", async (req, reply) => {
+  }), app.post("/api/mcp/connections/:id/activate", async (req, reply) => {
     try {
       let plan = await resolvePlan(req);
       mcpManager.reconcileEntitlement(PROOFLANE_PROJECT, mcpEntitlementForPlan(plan));
@@ -13021,32 +13077,32 @@ ${answer}`
     } catch (error) {
       return sendMcpError(reply, error);
     }
-  }), app2.post("/api/mcp/connections/:id/refresh", async (req, reply) => {
+  }), app.post("/api/mcp/connections/:id/refresh", async (req, reply) => {
     try {
       let plan = await resolvePlan(req);
       return mcpManager.reconcileEntitlement(PROOFLANE_PROJECT, mcpEntitlementForPlan(plan)), { ok: !0, tools: await mcpManager.refreshTools(PROOFLANE_PROJECT, req.params.id, await requestActor(req)), connection: mcpManager.getConnection(PROOFLANE_PROJECT, req.params.id) };
     } catch (error) {
       return sendMcpError(reply, error);
     }
-  }), app2.post("/api/mcp/connections/:id/disconnect", async (req, reply) => {
+  }), app.post("/api/mcp/connections/:id/disconnect", async (req, reply) => {
     try {
       return await mcpManager.disconnectConnection(PROOFLANE_PROJECT, req.params.id, await requestActor(req)), activeMcpConnectionId === req.params.id && (activeMcpConnectionId = null, activeMcpAuthMode = "unknown", svc = new InspectorService(store)), { ok: !0 };
     } catch (error) {
       return sendMcpError(reply, error);
     }
-  }), app2.delete("/api/mcp/connections/:id", async (req, reply) => {
+  }), app.delete("/api/mcp/connections/:id", async (req, reply) => {
     try {
       return await mcpManager.removeConnection(PROOFLANE_PROJECT, req.params.id, await requestActor(req)), activeMcpConnectionId === req.params.id && (activeMcpConnectionId = null, activeMcpAuthMode = "unknown", svc = new InspectorService(store)), { ok: !0 };
     } catch (error) {
       return sendMcpError(reply, error);
     }
-  }), app2.get("/api/mcp/tools", async (req) => {
+  }), app.get("/api/mcp/tools", async (req) => {
     let entitlement = mcpEntitlementForPlan(await resolvePlan(req));
     return mcpManager.reconcileEntitlement(PROOFLANE_PROJECT, entitlement), { tools: mcpManager.listTools(PROOFLANE_PROJECT, req.query.connectionId) };
-  }), app2.get("/api/features/:featureType/:resourceId/mcp-binding", async (req, reply) => {
+  }), app.get("/api/features/:featureType/:resourceId/mcp-binding", async (req, reply) => {
     let featureType = parseFeatureType(req.params.featureType);
     return !featureType || !validResourceId(req.params.resourceId) ? reply.code(400).send({ error: "A valid MCP feature type and resource ID are required." }) : { binding: mcpManager.getBinding(PROOFLANE_PROJECT, featureType, req.params.resourceId) };
-  }), app2.put("/api/features/:featureType/:resourceId/mcp-binding", async (req, reply) => {
+  }), app.put("/api/features/:featureType/:resourceId/mcp-binding", async (req, reply) => {
     let featureType = parseFeatureType(req.params.featureType);
     if (!featureType || !validResourceId(req.params.resourceId))
       return reply.code(400).send({ error: "A valid MCP feature type and resource ID are required." });
@@ -13072,10 +13128,10 @@ ${answer}`
     } catch (error) {
       return sendMcpError(reply, error);
     }
-  }), app2.delete("/api/features/:featureType/:resourceId/mcp-binding", async (req, reply) => {
+  }), app.delete("/api/features/:featureType/:resourceId/mcp-binding", async (req, reply) => {
     let featureType = parseFeatureType(req.params.featureType);
     return !featureType || !validResourceId(req.params.resourceId) ? reply.code(400).send({ error: "A valid MCP feature type and resource ID are required." }) : { ok: mcpManager.deleteBinding(PROOFLANE_PROJECT, featureType, req.params.resourceId, await requestActor(req)) };
-  }), app2.post("/api/features/:featureType/:resourceId/mcp-runs", async (req, reply) => {
+  }), app.post("/api/features/:featureType/:resourceId/mcp-runs", async (req, reply) => {
     let featureType = parseFeatureType(req.params.featureType);
     if (!featureType || !validResourceId(req.params.resourceId))
       return reply.code(400).send({ error: "A valid MCP feature type and resource ID are required." });
@@ -13087,10 +13143,10 @@ ${answer}`
     } catch (error) {
       return sendMcpError(reply, error);
     }
-  }), app2.get("/api/mcp/runs/:runId", async (req, reply) => {
+  }), app.get("/api/mcp/runs/:runId", async (req, reply) => {
     let snapshot = mcpManager.getRunSnapshot(PROOFLANE_PROJECT, req.params.runId);
     return snapshot ? { snapshot } : reply.code(404).send({ error: "MCP run snapshot was not found." });
-  }), app2.post("/api/mcp/runs/:runId/invoke", async (req, reply) => {
+  }), app.post("/api/mcp/runs/:runId/invoke", async (req, reply) => {
     let controller = new AbortController(), cancel = () => controller.abort();
     req.raw.once("aborted", cancel);
     try {
@@ -13105,12 +13161,12 @@ ${answer}`
     } finally {
       req.raw.off("aborted", cancel);
     }
-  }), app2.get("/api/mcp/audit", async (req) => ({
+  }), app.get("/api/mcp/audit", async (req) => ({
     events: mcpManager.listAuditEvents(PROOFLANE_PROJECT, Number(req.query.limit ?? 100))
-  })), app2.get("/api/capabilities", async () => {
+  })), app.get("/api/capabilities", async () => {
     let capabilities = svc.getCapabilities(), searchable = capabilities ? JSON.stringify(capabilities).toLowerCase() : "", tools = capabilities?.tools ?? [], resources = capabilities?.resources ?? [], rag = tools.some((tool) => /rag|retriev|search|knowledge|vector|semantic/.test(`${tool.name} ${tool.description ?? ""}`.toLowerCase())) || resources.some((resource) => /knowledge|document|vector|search|rag/.test(`${resource.uri} ${resource.name ?? ""} ${resource.description ?? ""}`.toLowerCase())), notableTools = tools.filter((tool) => /create|update|write|delete|remove|execute|admin|push|merge|dispatch|upload/.test(`${tool.name} ${tool.description ?? ""}`.toLowerCase())).map((tool) => tool.name), sensitivitySignals = [...new Set((searchable.match(/email|phone|address|ssn|personal|secret|token|password|api[_ -]?key|user[_ -]?id|account[_ -]?id/g) ?? []).slice(0, 8))];
     return { connected: svc.isConnected(), connectionId: activeMcpConnectionId, capabilities, discovery: { toolCount: tools.length, auth: { mode: activeMcpAuthMode, status: activeMcpAuthMode === "unknown" ? "UNKNOWN" : "OBSERVED" }, rag: { present: rag, status: rag ? "OBSERVED" : "NOT_OBSERVED" }, notable: { tools: notableTools, status: notableTools.length ? "CLASSIFIED" : "NONE_CLASSIFIED" }, sensitivity: { signals: sensitivitySignals, status: sensitivitySignals.length ? "INFERRED" : "NOT_INFERRED" } } };
-  }), app2.post("/api/connect/oauth/start", async (req, reply) => {
+  }), app.post("/api/connect/oauth/start", async (req, reply) => {
     let { url, name } = req.body, plan = await resolvePlan(req), entitlement = mcpEntitlementForPlan(plan), actor = await requestActor(req);
     try {
       mcpManager.assertCanAddMcpConnection(PROOFLANE_PROJECT, entitlement);
@@ -13137,10 +13193,10 @@ ${answer}`
       authUrl: flow.authUrl,
       redirectUri: flow.redirectUri
     };
-  }), app2.get("/api/connect/oauth/status", async (req) => {
+  }), app.get("/api/connect/oauth/status", async (req) => {
     let rec = oauthFlows.get(req.query.flowId);
     return rec || { status: "error", error: "Unknown flow." };
-  }), app2.post("/api/disconnect", async () => (activeMcpConnectionId ? await mcpManager.disconnectConnection(PROOFLANE_PROJECT, activeMcpConnectionId, "local-user") : await svc.disconnect(), activeMcpConnectionId = null, activeMcpAuthMode = "unknown", svc = new InspectorService(store), { ok: !0 })), app2.post("/api/tools/:name/call", async (req) => svc.callTool(req.params.name, req.body?.input ?? {})), app2.post("/api/tools/:name/snapshot", async (req) => svc.snapshotTool(req.params.name, req.body?.input ?? {})), app2.post("/api/security/verify-capability", async (req, reply) => {
+  }), app.post("/api/disconnect", async () => (activeMcpConnectionId ? await mcpManager.disconnectConnection(PROOFLANE_PROJECT, activeMcpConnectionId, "local-user") : await svc.disconnect(), activeMcpConnectionId = null, activeMcpAuthMode = "unknown", svc = new InspectorService(store), { ok: !0 })), app.post("/api/tools/:name/call", async (req) => svc.callTool(req.params.name, req.body?.input ?? {})), app.post("/api/tools/:name/snapshot", async (req) => svc.snapshotTool(req.params.name, req.body?.input ?? {})), app.post("/api/security/verify-capability", async (req, reply) => {
     let toolName = typeof req.body?.toolName == "string" ? req.body.toolName : "";
     if (!toolName)
       return reply.code(400).send({ error: "toolName is required." });
@@ -13193,19 +13249,19 @@ ${answer}`
     } catch (error) {
       return error instanceof ExecutionGateError ? reply.code(400).send({ error: error.message }) : reply.code(500).send({ error: error instanceof Error ? error.message : "Capability verification failed." });
     }
-  }), app2.post("/api/diff/snapshot", async (req) => svc.diffAgainst(req.body.snapshot)), app2.post("/api/diff/values", async (req) => diffTool(req.body.tool, req.body.expected, req.body.actual)), app2.post("/api/resources/read", async (req) => svc.readResource(req.body.uri)), app2.post("/api/prompts/:name/get", async (req) => svc.getPrompt(req.params.name, req.body?.args)), app2.post("/api/drift", async (req) => {
+  }), app.post("/api/diff/snapshot", async (req) => svc.diffAgainst(req.body.snapshot)), app.post("/api/diff/values", async (req) => diffTool(req.body.tool, req.body.expected, req.body.actual)), app.post("/api/resources/read", async (req) => svc.readResource(req.body.uri)), app.post("/api/prompts/:name/get", async (req) => svc.getPrompt(req.params.name, req.body?.args)), app.post("/api/drift", async (req) => {
     let current = svc.getCapabilities();
     if (!current)
       throw new Error("Not connected.");
     return detectCapabilityDrift(req.body.baseline, current);
-  }), app2.post("/api/record/start", async (req) => (svc.startRecording(req.body?.label), { ok: !0, recording: !0 })), app2.get("/api/record/status", async () => ({ recording: svc.isRecording() })), app2.post("/api/record/stop", async () => svc.stopRecording()), app2.get("/api/sessions", async () => svc.listSessions()), app2.get("/api/sessions/:id", async (req) => {
+  }), app.post("/api/record/start", async (req) => (svc.startRecording(req.body?.label), { ok: !0, recording: !0 })), app.get("/api/record/status", async () => ({ recording: svc.isRecording() })), app.post("/api/record/stop", async () => svc.stopRecording()), app.get("/api/sessions", async () => svc.listSessions()), app.get("/api/sessions/:id", async (req) => {
     let session = svc.getSession(req.params.id);
     if (!session)
       throw new Error(`Session not found: ${req.params.id}`);
     return session;
-  }), app2.post("/api/sessions/:id/golden", async (req) => (svc.markGolden(req.params.id, req.body?.golden ?? !0), { ok: !0 })), app2.post("/api/sessions/:id/automate", async (req) => svc.automate(req.params.id, req.body.format)), app2.post("/api/sessions/:id/fault", async (req) => svc.injectFault(req.params.id, req.body.step, req.body.type));
+  }), app.post("/api/sessions/:id/golden", async (req) => (svc.markGolden(req.params.id, req.body?.golden ?? !0), { ok: !0 })), app.post("/api/sessions/:id/automate", async (req) => svc.automate(req.params.id, req.body.format)), app.post("/api/sessions/:id/fault", async (req) => svc.injectFault(req.params.id, req.body.step, req.body.type));
   let HTTP_TIMEOUT_MS = 3e4, HTTP_BODY_CAP = 2e6;
-  app2.post("/api/http/request", async (req) => {
+  app.post("/api/http/request", async (req) => {
     let { method, url, headers, body } = req.body, start = Date.now(), controller = new AbortController(), timer = setTimeout(() => controller.abort(), HTTP_TIMEOUT_MS), hasBody = !["GET", "HEAD"].includes(method.toUpperCase());
     try {
       let res = await fetch(url, {
@@ -13236,9 +13292,9 @@ ${answer}`
     } finally {
       clearTimeout(timer);
     }
-  }), app2.post("/api/http/snapshot", async (req) => svc.saveHttpSnapshot(req.body.request, req.body.response, req.body.origin ?? "captured")), app2.get("/api/snapshots", async () => svc.listSnapshots()), app2.patch("/api/snapshots/:id", async (req, reply) => svc.updateSnapshot(req.params.id, req.body) ? { ok: !0 } : reply.code(404).send({ ok: !1, error: "Contract not found." })), app2.delete("/api/snapshots/:id", async (req) => (svc.deleteSnapshot(req.params.id), { ok: !0 })), app2.post("/api/automate/contracts", async (req) => svc.automateSnapshots(req.body.snapshotIds, req.body.format)), app2.post("/api/prompts/generate", async (req) => ({
+  }), app.post("/api/http/snapshot", async (req) => svc.saveHttpSnapshot(req.body.request, req.body.response, req.body.origin ?? "captured")), app.get("/api/snapshots", async () => svc.listSnapshots()), app.patch("/api/snapshots/:id", async (req, reply) => svc.updateSnapshot(req.params.id, req.body) ? { ok: !0 } : reply.code(404).send({ ok: !1, error: "Contract not found." })), app.delete("/api/snapshots/:id", async (req) => (svc.deleteSnapshot(req.params.id), { ok: !0 })), app.post("/api/automate/contracts", async (req) => svc.automateSnapshots(req.body.snapshotIds, req.body.format)), app.post("/api/prompts/generate", async (req) => ({
     prompts: svc.generatePromptsForTool(req.body.tool)
-  })), app2.get("/api/prompts/custom", async () => svc.listCustomPrompts()), app2.post("/api/llm/run", async (req) => callLlm(req.body)), app2.post("/api/prompts/run-agent", async (req, reply) => {
+  })), app.get("/api/prompts/custom", async () => svc.listCustomPrompts()), app.post("/api/llm/run", async (req) => callLlm(req.body)), app.post("/api/prompts/run-agent", async (req, reply) => {
     let { tool, prompt, llm } = req.body, t = svc.getCapabilities()?.tools.find((x) => x.name === tool);
     return t ? runAgent({
       ...llm,
@@ -13249,7 +13305,7 @@ ${answer}`
         return { output: r.output, isError: r.isError };
       }
     }) : reply.code(400).send({ ok: !1, toolCalls: [], error: `Tool "${tool}" isn't on the current connection \u2014 connect first.`, latencyMs: 0 });
-  }), app2.post("/api/rag/hosted-run", async (req, reply) => {
+  }), app.post("/api/rag/hosted-run", async (req, reply) => {
     let cases = Array.isArray(req.body?.cases) ? req.body.cases.filter((candidate) => candidate && typeof candidate.id == "string" && hostedRagCaseQuery(candidate).trim()) : [], capabilities = svc.getCapabilities();
     if (!capabilities)
       return reply.code(400).send({ ok: !1, error: "Connect to an MCP server first \u2014 RAG Assurance runs against its retrieval tools." });
@@ -13432,7 +13488,7 @@ ${answer}`
       evidence: JSON.stringify(mcpSnapshot ? { ...snapshot, mcp: mcpSnapshot.mcp, hostedScanId: hostedScan.id } : { ...snapshot, hostedScanId: hostedScan.id })
     }), diff = previous ? hostedRagScoreDiff(previous, snapshot) : void 0;
     return finish({ ok: !0, report, diff, run, hostedScan });
-  }), app2.get("/api/rag/hosted-diff/:id", async (req, reply) => {
+  }), app.get("/api/rag/hosted-diff/:id", async (req, reply) => {
     let runs = svc.listRuns(1e3).filter((record6) => record6.pillar === "rag"), index = runs.findIndex((record6) => record6.id === req.params.id);
     if (index === -1)
       return reply.code(404).send({ ok: !1, error: "Run not found." });
@@ -13472,7 +13528,7 @@ ${answer}`
       durationMs
     });
   }
-  app2.post("/api/perf/run", async (req, reply) => {
+  app.post("/api/perf/run", async (req, reply) => {
     let { target, vus, durationS, targetMs } = req.body;
     if (vus > 5) {
       let plan = await resolvePlan(req);
@@ -13513,7 +13569,7 @@ ${answer}`
       };
     let metrics = await runLoadTest({ fire, vus: cappedVus, durationMs, targetMs });
     return mcpSnapshot ? { ok: !0, ...metrics, mcpSnapshot, mcpFact: recordBoundMcpFact(mcpSnapshot, metrics.errors === 0) } : { ok: !0, ...metrics };
-  }), app2.post("/api/prompts/generate-ai", async (req, reply) => {
+  }), app.post("/api/prompts/generate-ai", async (req, reply) => {
     let plan = await resolvePlan(req);
     if (!plan.hosted)
       return reply.code(402).send({
@@ -13542,17 +13598,17 @@ Cover a mix of: positive (valid, useful requests), negative (misuse \u2014 missi
       skipped: parsed.length - saved.length,
       tokens: (res.usage?.inputTokens ?? 0) + (res.usage?.outputTokens ?? 0)
     };
-  }), app2.post("/api/prompts/custom/:id/golden", async (req) => (svc.setPromptGolden(req.params.id, req.body.expected, req.body.assert ?? "similar"), { ok: !0 })), app2.post("/api/prompts/custom/:id/checks", async (req) => (svc.setPromptChecks(req.params.id, {
+  }), app.post("/api/prompts/custom/:id/golden", async (req) => (svc.setPromptGolden(req.params.id, req.body.expected, req.body.assert ?? "similar"), { ok: !0 })), app.post("/api/prompts/custom/:id/checks", async (req) => (svc.setPromptChecks(req.params.id, {
     input: req.body.input,
     assertions: req.body.assertions,
     checkSchema: req.body.checkSchema
-  }), { ok: !0 })), app2.post("/api/prompts/assert", async (req, reply) => {
+  }), { ok: !0 })), app.post("/api/prompts/assert", async (req, reply) => {
     try {
       return { ok: !0, ...await svc.assertTool(req.body.tool, req.body.input ?? {}, req.body.assertions ?? [], req.body.checkSchema ?? !1) };
     } catch (e) {
       return reply.code(400).send({ ok: !1, error: e instanceof Error ? e.message : String(e) });
     }
-  }), app2.post("/api/prompts/custom", async (req, reply) => {
+  }), app.post("/api/prompts/custom", async (req, reply) => {
     let plan = await resolvePlan(req);
     return !isUnlimited(plan.prompts) && svc.listCustomPrompts().length >= plan.prompts ? reply.code(402).send({
       ok: !1,
@@ -13562,7 +13618,7 @@ Cover a mix of: positive (valid, useful requests), negative (misuse \u2014 missi
       limit: plan.prompts,
       error: `Your ${plan.label} plan stores up to ${plan.prompts} test prompts. Delete one or upgrade to add more.`
     }) : svc.addCustomPrompt(req.body.name, req.body.content, req.body.tool);
-  }), app2.patch("/api/prompts/custom/:id", async (req) => (svc.updateCustomPrompt(req.params.id, req.body), { ok: !0 })), app2.delete("/api/prompts/custom/:id", async (req) => (svc.deleteCustomPrompt(req.params.id), { ok: !0 })), app2.post("/api/prompts/generate-cases", async (req, reply) => {
+  }), app.patch("/api/prompts/custom/:id", async (req) => (svc.updateCustomPrompt(req.params.id, req.body), { ok: !0 })), app.delete("/api/prompts/custom/:id", async (req) => (svc.deleteCustomPrompt(req.params.id), { ok: !0 })), app.post("/api/prompts/generate-cases", async (req, reply) => {
     let plan = await resolvePlan(req);
     if (!plan.hosted)
       return reply.code(402).send({
@@ -13614,7 +13670,7 @@ Assertions must be objectively checkable against the tool's JSON response. Never
       errorKind: "hosted-generation",
       error: "The model did not return usable test cases. Retry, or choose a model that reliably follows structured-output instructions."
     });
-  }), app2.post("/api/prompts/custom/bulk", async (req, reply) => {
+  }), app.post("/api/prompts/custom/bulk", async (req, reply) => {
     let cases = (req.body?.cases ?? []).filter((c) => c && typeof c.content == "string" && c.content.trim());
     if (!cases.length)
       return reply.code(400).send({ ok: !1, error: "Select at least one reviewed case to save." });
@@ -13666,7 +13722,7 @@ Assertions must be objectively checkable against the tool's JSON response. Never
     let all = svc.getCapabilities()?.tools ?? [], enabled = session.config.enabledTools;
     return enabled && enabled.length ? all.filter((t) => enabled.includes(t.name)) : all;
   };
-  app2.post("/api/prompt-studio/sessions", async (req) => {
+  app.post("/api/prompt-studio/sessions", async (req) => {
     let body = req.body ?? {}, now = (/* @__PURE__ */ new Date()).toISOString(), session = {
       id: `ps-${randomUUID7().slice(0, 8)}`,
       name: (body.name ?? "").trim().slice(0, 120) || `Session ${(/* @__PURE__ */ new Date()).toLocaleString()}`,
@@ -13697,13 +13753,13 @@ Assertions must be objectively checkable against the tool's JSON response. Never
       oldest && studioSessions.delete(oldest.id);
     }
     return { ok: !0, session: studioSummary(session), events: [] };
-  }), app2.get("/api/prompt-studio/sessions", async () => ({
+  }), app.get("/api/prompt-studio/sessions", async () => ({
     ok: !0,
     sessions: [...studioSessions.values()].sort((a, b) => b.updatedAt.localeCompare(a.updatedAt)).map(studioSummary)
-  })), app2.get("/api/prompt-studio/sessions/:id", async (req, reply) => {
+  })), app.get("/api/prompt-studio/sessions/:id", async (req, reply) => {
     let session = studioSessions.get(req.params.id);
     return session ? { ok: !0, session: studioSummary(session), events: session.events } : reply.code(404).send({ ok: !1, error: "That Prompt Studio session is no longer available." });
-  }), app2.get("/api/prompt-studio/sessions/:id/suggestions", async (req, reply) => {
+  }), app.get("/api/prompt-studio/sessions/:id/suggestions", async (req, reply) => {
     let session = studioSessions.get(req.params.id);
     if (!session)
       return reply.code(404).send({ ok: !1, error: "That Prompt Studio session is no longer available." });
@@ -13713,10 +13769,10 @@ Assertions must be objectively checkable against the tool's JSON response. Never
       observation: { prompt: observation.prompt, answer: observation.answer, toolCalls: observation.toolCalls },
       suggestions: suggestPromptTestChecks(observation)
     };
-  }), app2.delete("/api/prompt-studio/sessions/:id", async (req) => (studioSessions.delete(req.params.id), { ok: !0 })), app2.post("/api/prompt-studio/sessions/:id/stop", async (req, reply) => {
+  }), app.delete("/api/prompt-studio/sessions/:id", async (req) => (studioSessions.delete(req.params.id), { ok: !0 })), app.post("/api/prompt-studio/sessions/:id/stop", async (req, reply) => {
     let session = studioSessions.get(req.params.id);
     return session ? (session.stopRequested = !0, { ok: !0, stopping: session.running }) : reply.code(404).send({ ok: !1, error: "That Prompt Studio session is no longer available." });
-  }), app2.post("/api/prompt-studio/sessions/:id/messages", async (req, reply) => {
+  }), app.post("/api/prompt-studio/sessions/:id/messages", async (req, reply) => {
     let session = studioSessions.get(req.params.id);
     if (!session)
       return reply.code(404).send({ ok: !1, error: "That Prompt Studio session is no longer available. Start a new session." });
@@ -13795,7 +13851,7 @@ Assertions must be objectively checkable against the tool's JSON response. Never
     } finally {
       session.running = !1, session.stopRequested = !1;
     }
-  }), app2.post("/api/prompt-studio/sessions/:id/tools/:tool", async (req, reply) => {
+  }), app.post("/api/prompt-studio/sessions/:id/tools/:tool", async (req, reply) => {
     let session = studioSessions.get(req.params.id);
     if (!session)
       return reply.code(404).send({ ok: !1, error: "That Prompt Studio session is no longer available." });
@@ -13840,7 +13896,7 @@ Assertions must be objectively checkable against the tool's JSON response. Never
       let attributed = attributeError(error instanceof Error ? error.message : String(error), "tool");
       return pushStudioEvent(session, turnId, "run-failed", { tool: tool.name, error: attributed.detail, errorKind: attributed.kind }), reply.code(502).send({ ok: !1, error: attributed.detail, errorKind: attributed.kind, errorTitle: attributed.title });
     }
-  }), app2.post("/api/model-scans/run", async (req, reply) => {
+  }), app.post("/api/model-scans/run", async (req, reply) => {
     let target = req.body?.path?.trim();
     if (!target || target.length > 4096)
       return reply.code(400).send({ ok: !1, error: "A valid local model file or directory path is required." });
@@ -13852,7 +13908,7 @@ Assertions must be objectively checkable against the tool's JSON response. Never
       maxArchiveExpandedBytes: Math.round(maxArchiveMb * 1024 * 1024)
     });
     return store.saveModelScan(report), reply.header("Cache-Control", "no-store"), { ok: !0, report };
-  }), app2.get("/api/model-scans", async (req, reply) => {
+  }), app.get("/api/model-scans", async (req, reply) => {
     let limit = Math.max(1, Math.min(200, Math.trunc(Number(req.query.limit) || 25)));
     return reply.header("Cache-Control", "no-store"), store.listModelScans(limit).map((report) => ({
       scanId: report.scanId,
@@ -13863,16 +13919,16 @@ Assertions must be objectively checkable against the tool's JSON response. Never
       summary: report.summary,
       artifactIdentity: report.artifactIdentity
     }));
-  }), app2.get("/api/model-scans/:id", async (req, reply) => {
+  }), app.get("/api/model-scans/:id", async (req, reply) => {
     let report = store.getModelScan(req.params.id);
     return report ? (reply.header("Cache-Control", "no-store"), { ok: !0, report }) : reply.code(404).send({ ok: !1, error: "Model scan not found." });
-  }), app2.get("/api/model-scans/:id/export", async (req, reply) => {
+  }), app.get("/api/model-scans/:id/export", async (req, reply) => {
     let report = store.getModelScan(req.params.id);
     if (!report)
       return reply.code(404).send({ ok: !1, error: "Model scan not found." });
     let safeName = report.target.displayName.replace(/[^A-Za-z0-9._-]+/g, "-").slice(0, 100) || "model", format = String(req.query.format ?? "json").toLowerCase();
     return reply.header("Cache-Control", "no-store"), format === "html" ? (reply.type("text/html; charset=utf-8").header("Content-Disposition", `attachment; filename="${safeName}-prooflane-model-scan.html"`), reply.send(modelScanToHtml(report))) : format === "sarif" ? (reply.type("application/sarif+json").header("Content-Disposition", `attachment; filename="${safeName}-prooflane-model-scan.sarif.json"`), reply.send(JSON.stringify(modelScanToSarif(report), null, 2))) : (reply.type("application/json").header("Content-Disposition", `attachment; filename="${safeName}-prooflane-model-scan.json"`), reply.send(JSON.stringify(report, null, 2)));
-  }), app2.delete("/api/model-scans/:id", async (req, reply) => store.deleteModelScan(req.params.id) ? { ok: !0 } : reply.code(404).send({ ok: !1, error: "Model scan not found." })), app2.get("/api/model-security/packs", async (_req, reply) => (reply.header("Cache-Control", "no-store"), {
+  }), app.delete("/api/model-scans/:id", async (req, reply) => store.deleteModelScan(req.params.id) ? { ok: !0 } : reply.code(404).send({ ok: !1, error: "Model scan not found." })), app.get("/api/model-security/packs", async (_req, reply) => (reply.header("Cache-Control", "no-store"), {
     packs: MODEL_SECURITY_PACKS,
     checks: MODEL_SECURITY_RULES.map((rule) => ({
       id: rule.id,
@@ -13886,7 +13942,7 @@ Assertions must be objectively checkable against the tool's JSON response. Never
     stages: MODEL_SCAN_STAGES.map((stage) => ({ id: stage, label: MODEL_SCAN_STAGE_LABEL[stage] })),
     sourceTypes: SUPPORTED_MODEL_SOURCE_TYPES,
     evidenceClasses: MODEL_EVIDENCE_CLASSES.map((id) => ({ id, label: MODEL_EVIDENCE_LABEL[id] }))
-  })), app2.post("/api/model-security/run", async (req, reply) => {
+  })), app.post("/api/model-security/run", async (req, reply) => {
     let target = req.body?.target;
     if (!target?.sourceType || !target.source?.trim())
       return reply.code(400).send({ ok: !1, error: "A model security scan needs a target source type and source." });
@@ -13929,19 +13985,19 @@ Assertions must be objectively checkable against the tool's JSON response. Never
       let message2 = error instanceof Error ? error.message : String(error);
       return wantStream && streamOpen ? (streamWrite({ t: "done", ok: !1, error: message2 }), reply.raw.end(), reply) : reply.code(400).send({ ok: !1, error: message2 });
     }
-  }), app2.get("/api/model-security", async (req, reply) => {
+  }), app.get("/api/model-security", async (req, reply) => {
     let limit = Math.max(1, Math.min(200, Math.trunc(Number(req.query.limit) || 25)));
     return reply.header("Cache-Control", "no-store"), store.listModelSecurityScans(limit).map(modelSecuritySummary);
-  }), app2.get("/api/model-security/:id", async (req, reply) => {
+  }), app.get("/api/model-security/:id", async (req, reply) => {
     let report = store.getModelSecurityScan(req.params.id);
     return report ? (reply.header("Cache-Control", "no-store"), { ok: !0, report }) : reply.code(404).send({ ok: !1, error: "Model security scan not found." });
-  }), app2.get("/api/model-security/:id/export", async (req, reply) => {
+  }), app.get("/api/model-security/:id/export", async (req, reply) => {
     let report = store.getModelSecurityScan(req.params.id);
     if (!report)
       return reply.code(404).send({ ok: !1, error: "Model security scan not found." });
     let safeName = report.target.displayName.replace(/[^A-Za-z0-9._-]+/g, "-").slice(0, 100) || "model", format = String(req.query.format ?? "json").toLowerCase();
     return reply.header("Cache-Control", "no-store"), format === "html" ? (reply.type("text/html; charset=utf-8").header("Content-Disposition", `attachment; filename="${safeName}-model-supply-chain.html"`), reply.send(modelSecurityToHtml(report))) : format === "sarif" ? (reply.type("application/sarif+json").header("Content-Disposition", `attachment; filename="${safeName}-model-supply-chain.sarif.json"`), reply.send(JSON.stringify(modelSecurityToSarif(report), null, 2))) : (reply.type("application/json").header("Content-Disposition", `attachment; filename="${safeName}-model-supply-chain.json"`), reply.send(JSON.stringify(report, null, 2)));
-  }), app2.delete("/api/model-security/:id", async (req, reply) => store.deleteModelSecurityScan(req.params.id) ? { ok: !0 } : reply.code(404).send({ ok: !1, error: "Model security scan not found." })), app2.post("/api/runs", async (req) => svc.recordRun(req.body)), app2.get("/api/runs", async (req, reply) => {
+  }), app.delete("/api/model-security/:id", async (req, reply) => store.deleteModelSecurityScan(req.params.id) ? { ok: !0 } : reply.code(404).send({ ok: !1, error: "Model security scan not found." })), app.post("/api/runs", async (req) => svc.recordRun(req.body)), app.get("/api/runs", async (req, reply) => {
     let plan = await resolvePlan(req), requestedLimit = Number(req.query.limit), limit = Number.isFinite(requestedLimit) && requestedLimit > 0 ? Math.min(1e3, Math.trunc(requestedLimit)) : void 0;
     reply.header("Cache-Control", "no-store");
     let runs = svc.listRuns(limit);
@@ -13951,26 +14007,32 @@ Assertions must be objectively checkable against the tool's JSON response. Never
     return runs.filter((run) => Date.parse(run.createdAt) >= oldest);
   });
   let uiDist = process.env.KAWACH_UI_DIST ?? join4(__dirname, "../../ui/dist");
-  return existsSync2(uiDist) && (app2.register(fastifyStatic, { root: uiDist }), app2.setNotFoundHandler((req, reply) => {
+  return existsSync2(uiDist) && (app.register(fastifyStatic, { root: uiDist }), app.setNotFoundHandler((req, reply) => {
     if (req.url.startsWith("/api")) {
       reply.code(404).send({ error: "Not found" });
       return;
     }
     reply.sendFile("index.html");
-  })), app2.setErrorHandler((err, req, reply) => {
+  })), app.setErrorHandler((err, req, reply) => {
     let upstream = err instanceof KawachError ? err.statusCode : void 0;
     req.log.error({ err, upstream }, "Inspector request failed"), reply.code(upstream ? 502 : 500).send({ error: publicServerError(req.url), reference: req.id });
-  }), app2.addHook("onClose", async () => store.close()), app2;
+  }), app.addHook("onClose", async () => store.close()), app;
+}
+
+// ../server/dist/start.js
+var PORT = Number(process.env.KAWACH_UI_PORT ?? 7357), HOST = "127.0.0.1";
+async function startServer(options = {}) {
+  let app = buildApp();
+  options.configureApp?.(app), await app.listen({ port: PORT, host: HOST }), console.log(`Kawach Inspector UI \u2192 http://localhost:${PORT}`);
+  for (let sig of ["SIGINT", "SIGTERM"])
+    process.once(sig, () => {
+      app.close().finally(() => process.exit(0));
+    });
+  return app;
+}
+function failServerStart(error) {
+  console.error("Failed to start Kawach Inspector server:", error), process.exit(1);
 }
 
 // ../server/dist/index.js
-var PORT = Number(process.env.KAWACH_UI_PORT ?? 7357), HOST = "127.0.0.1", app = buildApp();
-app.listen({ port: PORT, host: HOST }).then(() => {
-  console.log(`Kawach Inspector UI \u2192 http://localhost:${PORT}`);
-}).catch((err) => {
-  console.error("Failed to start Kawach Inspector server:", err), process.exit(1);
-});
-for (let sig of ["SIGINT", "SIGTERM"])
-  process.on(sig, () => {
-    app.close().finally(() => process.exit(0));
-  });
+startServer().catch(failServerStart);