@prooflane/inspector-beta 0.1.0-beta.6 → 0.1.0-beta.8

package/dist/server.mjs

@@ -1099,10 +1099,10 @@ function decodeJwt(jwt) {
 }
 
 // ../server/dist/app.js
-import { createHash as createHash15, randomUUID as randomUUID7 } from "node:crypto";
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync } from "node:fs";
+import { createHash as createHash16, randomUUID as randomUUID8 } from "node:crypto";
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "node:fs";
 import { fileURLToPath } from "node:url";
-import { dirname as dirname4, join as join4, resolve as resolve5 } from "node:path";
+import { dirname as dirname4, join as join5, resolve as resolve6 } from "node:path";
 
 // ../core/dist/transport/mcpTransport.js
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
@@ -1386,9 +1386,9 @@ async function startCallbackServer(path = "/callback", port = callbackPort()) {
     res.end(PAGE("Authorized \u2713", "You can close this tab and return to Kawach Inspector.")), resolveCode(code);
   });
   try {
-    await new Promise((resolve6, reject) => {
+    await new Promise((resolve7, reject) => {
       server.once("error", reject), server.listen(port, "127.0.0.1", () => {
-        server.off("error", reject), resolve6();
+        server.off("error", reject), resolve7();
       });
     });
   } catch (err) {
@@ -1902,7 +1902,7 @@ var Store = class {
     return this.db.prepare(`UPDATE benchmark_entitlements SET state = 'AVAILABLE', reservation_key = NULL, reserved_at = NULL
        WHERE id = ? AND workspace_id = ? AND state = 'RESERVED' AND reservation_key = ?`).run(entitlementId, workspaceId, reservationKey), this.getBenchmarkEntitlement(entitlementId);
   }
-  saveBenchmarkRun(record6) {
+  saveBenchmarkRun(record7) {
     this.db.prepare(`INSERT INTO benchmark_runs
          (run_id, workspace_id, status, plan_json, summary_json, report_json, report_html, created_at, updated_at)
        VALUES (@run_id, @workspace_id, @status, @plan_json, @summary_json, @report_json, @report_html, @created_at, @updated_at)
@@ -1912,15 +1912,15 @@ var Store = class {
          report_json = excluded.report_json,
          report_html = excluded.report_html,
          updated_at = excluded.updated_at`).run({
-      run_id: record6.runId,
-      workspace_id: record6.workspaceId,
-      status: record6.status,
-      plan_json: JSON.stringify(record6.plan),
-      summary_json: record6.summary ? JSON.stringify(record6.summary) : null,
-      report_json: record6.report ? JSON.stringify(record6.report) : null,
-      report_html: record6.reportHtml ?? null,
-      created_at: record6.createdAt,
-      updated_at: record6.updatedAt
+      run_id: record7.runId,
+      workspace_id: record7.workspaceId,
+      status: record7.status,
+      plan_json: JSON.stringify(record7.plan),
+      summary_json: record7.summary ? JSON.stringify(record7.summary) : null,
+      report_json: record7.report ? JSON.stringify(record7.report) : null,
+      report_html: record7.reportHtml ?? null,
+      created_at: record7.createdAt,
+      updated_at: record7.updatedAt
     });
   }
   getBenchmarkRun(runId) {
@@ -3152,12 +3152,12 @@ ${http2.content}`
   addPromptCases(cases, source = "ai") {
     let saved = [], skipped = 0;
     for (let item of cases) {
-      let [record6] = this.addPrompts([{ category: item.category, name: item.name, content: item.content, tool: item.tool }], source);
-      if (!record6) {
+      let [record7] = this.addPrompts([{ category: item.category, name: item.name, content: item.content, tool: item.tool }], source);
+      if (!record7) {
         skipped += 1;
         continue;
       }
-      item.assertions && item.assertions.length || item.checkSchema ? (this.store.setPromptChecks(record6.id, { assertions: item.assertions, checkSchema: item.checkSchema }), saved.push({ ...record6, assertions: item.assertions, checkSchema: item.checkSchema })) : saved.push(record6);
+      item.assertions && item.assertions.length || item.checkSchema ? (this.store.setPromptChecks(record7.id, { assertions: item.assertions, checkSchema: item.checkSchema }), saved.push({ ...record7, assertions: item.assertions, checkSchema: item.checkSchema })) : saved.push(record7);
     }
     return { saved, skipped };
   }
@@ -4225,7 +4225,7 @@ function validateGovernedGateManifest(value) {
   if (!record2(value))
     return { ok: !1, error: "Gate manifest must be an object." };
   let forbidden = findForbiddenGateManifestMaterial(value);
-  return forbidden ? { ok: !1, error: `Gate manifest rejected: ${forbidden}.` } : exactKeys(value, ["schemaVersion", "suiteRef", "policyRef", "targetScope", "environment", "requiredPillars", "settings", "approvalRules"]) ? value.schemaVersion !== GATE_MANIFEST_VERSION ? { ok: !1, error: `Gate manifest must use ${GATE_MANIFEST_VERSION}.` } : validateSuiteReference(value.suiteRef) ? validatePolicyReference(value.policyRef) ? !record2(value.targetScope) || !exactKeys(value.targetScope, ["projectId"]) || !text2(value.targetScope.projectId, 2, 128, projectPattern) ? { ok: !1, error: "Gate targetScope must contain one stable projectId." } : text2(value.environment, 2, 64, slugPattern) ? !Array.isArray(value.requiredPillars) || value.requiredPillars.length < 1 || value.requiredPillars.length > POLICY_PILLARS.length ? { ok: !1, error: "Gate requiredPillars must contain at least one supported Policy pillar." } : value.requiredPillars.every((pillar) => POLICY_PILLARS.includes(pillar)) ? new Set(value.requiredPillars).size !== value.requiredPillars.length ? { ok: !1, error: "Gate requiredPillars must be unique." } : !record2(value.settings) || !exactKeys(value.settings, ["executionMode", "evidenceSync"]) || value.settings.executionMode !== "ALL_CONTROLS" || value.settings.evidenceSync !== "COMPACT_ONLY" ? { ok: !1, error: "Gate settings must execute all signed Suite controls and synchronize compact evidence only." } : !record2(value.approvalRules) || !exactKeys(value.approvalRules, ["minimumApprovals", "requireDistinctReviewer"]) || value.approvalRules.minimumApprovals !== 1 || value.approvalRules.requireDistinctReviewer !== !0 ? { ok: !1, error: "Gate approvalRules must require one approval from a distinct reviewer." } : { ok: !0, manifest: value } : { ok: !1, error: "Gate requiredPillars contains an unsupported pillar." } : { ok: !1, error: "Gate environment must be a bounded lowercase slug." } : { ok: !1, error: "Gate policyRef must pin an exact Policy identity, version ID, version, and SHA-256 hash." } : { ok: !1, error: "Gate suiteRef must pin an exact Suite identity, slug, version ID, version, and SHA-256 hash." } : { ok: !1, error: "Gate manifest must contain only the frozen v1 fields." };
+  return forbidden ? { ok: !1, error: `Gate manifest rejected: ${forbidden}.` } : exactKeys(value, ["schemaVersion", "suiteRef", "policyRef", "targetScope", "environment", "requiredPillars", "settings", "approvalRules"]) ? value.schemaVersion !== GATE_MANIFEST_VERSION ? { ok: !1, error: `Gate manifest must use ${GATE_MANIFEST_VERSION}.` } : validateSuiteReference(value.suiteRef) ? validatePolicyReference(value.policyRef) ? !record2(value.targetScope) || !exactKeys(value.targetScope, ["projectId"]) || !text2(value.targetScope.projectId, 2, 128, projectPattern) ? { ok: !1, error: "Gate targetScope must contain one stable projectId." } : text2(value.environment, 2, 64, slugPattern) ? !Array.isArray(value.requiredPillars) || value.requiredPillars.length < 1 || value.requiredPillars.length > POLICY_PILLARS.length ? { ok: !1, error: "Gate requiredPillars must contain at least one supported Policy pillar." } : value.requiredPillars.every((pillar) => POLICY_PILLARS.includes(pillar)) ? new Set(value.requiredPillars).size !== value.requiredPillars.length ? { ok: !1, error: "Gate requiredPillars must be unique." } : !record2(value.settings) || !exactKeys(value.settings, ["executionMode", "evidenceSync"]) || value.settings.executionMode !== "ALL_CONTROLS" || value.settings.evidenceSync !== "COMPACT_ONLY" ? { ok: !1, error: "Gate settings must execute all signed Suite controls and synchronize compact evidence only." } : !record2(value.approvalRules) || !exactKeys(value.approvalRules, ["minimumApprovals", "requireDistinctReviewer"]) || value.approvalRules.minimumApprovals !== 1 || typeof value.approvalRules.requireDistinctReviewer != "boolean" ? { ok: !1, error: "Gate approvalRules must require one recorded approval and a boolean reviewer policy." } : { ok: !0, manifest: value } : { ok: !1, error: "Gate requiredPillars contains an unsupported pillar." } : { ok: !1, error: "Gate environment must be a bounded lowercase slug." } : { ok: !1, error: "Gate policyRef must pin an exact Policy identity, version ID, version, and SHA-256 hash." } : { ok: !1, error: "Gate suiteRef must pin an exact Suite identity, slug, version ID, version, and SHA-256 hash." } : { ok: !1, error: "Gate manifest must contain only the frozen v1 fields." };
 }
 function hashGovernedGateManifest(value) {
   let validated = validateGovernedGateManifest(value);
@@ -4688,13 +4688,13 @@ function fingerprintLocalSuite(suite) {
 function executorForPillar(pillar) {
   return pillar === "prompt" ? "PROMPT" : pillar === "rag" ? "RAG" : pillar === "contract" ? "CONTRACT" : pillar === "performance" ? "PERFORMANCE" : pillar === "model" ? "MODEL" : "MCP";
 }
-function compileLegacyLocalSuiteManifest(suite, localFingerprint = fingerprintLocalSuite(suite)) {
-  if (!/^sha256:[a-f0-9]{64}$/.test(localFingerprint))
+function compileLegacyLocalSuiteManifest(suite, localFingerprint2 = fingerprintLocalSuite(suite)) {
+  if (!/^sha256:[a-f0-9]{64}$/.test(localFingerprint2))
     throw new Error("Local Suite migration fingerprint is invalid.");
   let pillarCounts = {};
   for (let test of suite.tests)
     pillarCounts[test.pillar] = (pillarCounts[test.pillar] ?? 0) + 1;
-  let assetName = `local-suite-${localFingerprint.slice(7)}`, manifest = {
+  let assetName = `local-suite-${localFingerprint2.slice(7)}`, manifest = {
     schemaVersion: "prooflane-suite-manifest-v1",
     executionClass: "LOCAL_ONLY",
     controls: PILLARS2.filter((pillar) => !!pillarCounts[pillar]).map((pillar) => ({
@@ -4707,7 +4707,7 @@ function compileLegacyLocalSuiteManifest(suite, localFingerprint = fingerprintLo
       localRef: { kind: "PROJECT_ASSET", name: assetName },
       parameters: {
         schemaVersion: LOCAL_SUITE_MIGRATION_VERSION,
-        localFingerprint,
+        localFingerprint: localFingerprint2,
         localVersion: suite.version,
         testCount: pillarCounts[pillar]
       }
@@ -4738,7 +4738,7 @@ function readLegacyLocalSuiteArtifact(file, cwd = process.cwd()) {
   } catch (error) {
     throw new Error(`Could not read local Suite ${basename(sourcePath)}: ${error instanceof Error ? error.message : String(error)}`);
   }
-  let suite = validateLegacyLocalSuite(parsed), localFingerprint = fingerprintLocalSuite(suite), manifest = compileLegacyLocalSuiteManifest(suite, localFingerprint), pillarCounts = {};
+  let suite = validateLegacyLocalSuite(parsed), localFingerprint2 = fingerprintLocalSuite(suite), manifest = compileLegacyLocalSuiteManifest(suite, localFingerprint2), pillarCounts = {};
   for (let test of suite.tests)
     pillarCounts[test.pillar] = (pillarCounts[test.pillar] ?? 0) + 1;
   let supported = suite.tests.filter(localSuiteTestIsGeneric).length, projectRelative = relative(cwd, sourcePath);
@@ -4748,7 +4748,7 @@ function readLegacyLocalSuiteArtifact(file, cwd = process.cwd()) {
     projectRelativePath: projectRelative.startsWith("..") || projectRelative.startsWith("/") ? null : projectRelative,
     slug: localSuiteSlug(suite.id),
     displayName: localDisplayName(suite.id),
-    localFingerprint,
+    localFingerprint: localFingerprint2,
     manifest,
     migrationManifestHash: hashGovernedSuiteManifest(manifest),
     suite,
@@ -4789,7 +4789,7 @@ function discoverLegacyLocalSuites(input = {}) {
   return { suites, issues };
 }
 function migrationManifestHash(manifest) {
-  let { policyRef: _policyRef, ...content } = manifest;
+  let { policyRef: _policyRef, targetFingerprint: _targetFingerprint, requiredCapabilities: _requiredCapabilities, ...content } = manifest;
   return hashGovernedSuiteManifest(content);
 }
 function planLegacyLocalSuiteMigration(local, cloud) {
@@ -4989,10 +4989,10 @@ function resultCount(output) {
     return output.length;
   if (!output || typeof output != "object")
     return null;
-  let record6 = output;
+  let record7 = output;
   for (let key of ["results", "documents", "items", "data", "matches"])
-    if (Array.isArray(record6[key]))
-      return record6[key].length;
+    if (Array.isArray(record7[key]))
+      return record7[key].length;
   return null;
 }
 function compactError(cause) {
@@ -5628,11 +5628,11 @@ async function gradeExecution(candidate, benchmarkCase, result, scorers, passThr
   return { assertions, dimensions, score, verdict, securityBreach, criticalFailure, functionalSuccess, secureTaskSuccess };
 }
 async function withTimeout(promise, timeoutMs, signal) {
-  return timeoutMs <= 0 && !signal ? promise : await new Promise((resolve6, reject) => {
+  return timeoutMs <= 0 && !signal ? promise : await new Promise((resolve7, reject) => {
     let settled = !1, finish = (fn) => {
       settled || (settled = !0, clearTimeout(timer), signal && signal.removeEventListener("abort", onAbort), fn());
     }, timer = timeoutMs > 0 ? setTimeout(() => finish(() => reject(new Error(`benchmark timeout after ${timeoutMs}ms`))), timeoutMs) : void 0, onAbort = () => finish(() => reject(new Error("benchmark cancelled")));
-    signal && signal.addEventListener("abort", onAbort, { once: !0 }), promise.then((v) => finish(() => resolve6(v)), (e) => finish(() => reject(e)));
+    signal && signal.addEventListener("abort", onAbort, { once: !0 }), promise.then((v) => finish(() => resolve7(v)), (e) => finish(() => reject(e)));
   });
 }
 async function pool(items, limit, work) {
@@ -8663,9 +8663,9 @@ function readHuggingFaceCache(ir) {
     recordedFiles
   };
 }
-function compareRecordedDigests(ir, record6) {
+function compareRecordedDigests(ir, record7) {
   let onDisk = new Map(ir.files.map((f) => [f.path, f.sha256])), out = { matched: [], mismatched: [], unverifiable: [] };
-  for (let entry of record6.digests) {
+  for (let entry of record7.digests) {
     if (entry.algorithm !== "sha256") {
       out.unverifiable.push(entry.path);
       continue;
@@ -8683,25 +8683,25 @@ function compareRecordedDigests(ir, record6) {
 // ../core/dist/modelSecurity/packs/provenance.js
 var PACK2 = "model-provenance", IMMUTABLE_REVISION = /^[a-f0-9]{7,64}$/i, FLOATING_NAMES = /^(?:main|master|develop|dev|trunk|latest|head|refs\/heads\/.+|refs\/tags\/.+|v?\d+(?:\.\d+)*(?:-[a-z0-9.]+)?)$/i;
 function readProvenance(ir) {
-  let record6 = { architectures: [], externalDependencies: [] };
-  ir.target.sourceType === "huggingface" && (record6.sourceRepository = ir.target.source), ir.target.sourceType === "url" && (record6.artifactUrl = ir.target.source), (ir.target.sourceType === "url" || ir.target.sourceType === "huggingface") && (record6.downloadedFrom = ir.target.source), record6.revision = ir.target.resolvedRevision ?? ir.target.revision, record6.publisher = ir.target.publisher;
+  let record7 = { architectures: [], externalDependencies: [] };
+  ir.target.sourceType === "huggingface" && (record7.sourceRepository = ir.target.source), ir.target.sourceType === "url" && (record7.artifactUrl = ir.target.source), (ir.target.sourceType === "url" || ir.target.sourceType === "huggingface") && (record7.downloadedFrom = ir.target.source), record7.revision = ir.target.resolvedRevision ?? ir.target.revision, record7.publisher = ir.target.publisher;
   for (let file of ir.files) {
-    (/^readme|model[_-]?card/i.test(file.path) || file.role === "documentation") && (record6.modelCardPath ??= file.path, file.text && (record6.license ??= file.text.match(/^(?:license|model-license)\s*:\s*["']?([^\n"']+)/im)?.[1]?.trim(), record6.sourceRepository ??= file.text.match(/^(?:base_model|base-model|source_model|repository)\s*:\s*["']?([^\n"']+)/im)?.[1]?.trim(), record6.commit ??= file.text.match(/^(?:revision|commit|sha)\s*:\s*["']?([a-f0-9]{7,64})/im)?.[1], record6.publisher ??= file.text.match(/^(?:author|publisher|organization)\s*:\s*["']?([^\n"']+)/im)?.[1]?.trim())), /^license(?:\.|$)|^copying(?:\.|$)/i.test(file.path) && file.text?.trim() && (record6.license ??= "License file present (identifier not parsed)");
+    (/^readme|model[_-]?card/i.test(file.path) || file.role === "documentation") && (record7.modelCardPath ??= file.path, file.text && (record7.license ??= file.text.match(/^(?:license|model-license)\s*:\s*["']?([^\n"']+)/im)?.[1]?.trim(), record7.sourceRepository ??= file.text.match(/^(?:base_model|base-model|source_model|repository)\s*:\s*["']?([^\n"']+)/im)?.[1]?.trim(), record7.commit ??= file.text.match(/^(?:revision|commit|sha)\s*:\s*["']?([a-f0-9]{7,64})/im)?.[1], record7.publisher ??= file.text.match(/^(?:author|publisher|organization)\s*:\s*["']?([^\n"']+)/im)?.[1]?.trim())), /^license(?:\.|$)|^copying(?:\.|$)/i.test(file.path) && file.text?.trim() && (record7.license ??= "License file present (identifier not parsed)");
     for (let [key, value] of flatten(file.json))
-      typeof value == "string" && (/(?:^|\.)model_type$/.test(key) && (record6.modelType ??= value), /(?:^|\.)transformers_version$/.test(key) && (record6.libraryVersion ??= value), /(?:^|\.)license$/.test(key) && (record6.license ??= value), /(?:^|\.)_name_or_path$/.test(key) && (record6.sourceRepository ??= value), /(?:^|\.)(?:base_model_name_or_path|base_model)$/.test(key) && (record6.sourceRepository ??= value), /(?:^|\.)(?:_?commit_hash|revision|sha)$/.test(key) && (record6.commit ??= value), /(?:^|\.)(?:author|publisher|organization)$/.test(key) && (record6.publisher ??= value));
+      typeof value == "string" && (/(?:^|\.)model_type$/.test(key) && (record7.modelType ??= value), /(?:^|\.)transformers_version$/.test(key) && (record7.libraryVersion ??= value), /(?:^|\.)license$/.test(key) && (record7.license ??= value), /(?:^|\.)_name_or_path$/.test(key) && (record7.sourceRepository ??= value), /(?:^|\.)(?:base_model_name_or_path|base_model)$/.test(key) && (record7.sourceRepository ??= value), /(?:^|\.)(?:_?commit_hash|revision|sha)$/.test(key) && (record7.commit ??= value), /(?:^|\.)(?:author|publisher|organization)$/.test(key) && (record7.publisher ??= value));
     let architectures = flatten(file.json).filter(([key]) => /(?:^|\.)architectures\[\d+\]$/.test(key)).map(([, value]) => value);
     for (let architecture of architectures)
-      typeof architecture == "string" && record6.architectures.push(architecture);
+      typeof architecture == "string" && record7.architectures.push(architecture);
     if (/requirements\.txt$|pyproject\.toml$|setup\.py$|environment\.ya?ml$/i.test(file.path) && file.text)
       for (let line of file.text.split(/\r?\n/)) {
         let dependency = line.trim();
         if (!dependency || dependency.startsWith("#"))
           continue;
         let name = dependency.match(/^([A-Za-z0-9._-]+)/)?.[1];
-        name && record6.externalDependencies.push(dependency.length > 80 ? name : dependency);
+        name && record7.externalDependencies.push(dependency.length > 80 ? name : dependency);
       }
   }
-  return record6.architectures = [...new Set(record6.architectures)], record6.externalDependencies = [...new Set(record6.externalDependencies)], record6.commit ??= record6.revision && IMMUTABLE_REVISION.test(record6.revision) ? record6.revision : void 0, record6;
+  return record7.architectures = [...new Set(record7.architectures)], record7.externalDependencies = [...new Set(record7.externalDependencies)], record7.commit ??= record7.revision && IMMUTABLE_REVISION.test(record7.revision) ? record7.revision : void 0, record7;
 }
 function recordCheck(id, title, intent, read, missing) {
   return {
@@ -8731,13 +8731,13 @@ function recordCheck(id, title, intent, read, missing) {
   };
 }
 var PROVENANCE_RULES = [
-  recordCheck("provenance.source-repository", "Source repository", "The artifact records the repository it was published from.", (record6) => record6.sourceRepository, {
+  recordCheck("provenance.source-repository", "Source repository", "The artifact records the repository it was published from.", (record7) => record7.sourceRepository, {
     severity: "medium",
     description: "Nothing in the artifact identifies the repository it came from.",
     impact: "The artifact cannot be traced back to reviewed source, and a substitution would go unnoticed.",
     remediation: "Record the publishing repository in the model card and configuration, and scan by Hugging Face repository or URL so the source is captured automatically."
   }),
-  recordCheck("provenance.artifact-url", "Artifact URL", "The location the artifact was retrieved from is recorded.", (record6) => record6.artifactUrl ?? record6.downloadedFrom, {
+  recordCheck("provenance.artifact-url", "Artifact URL", "The location the artifact was retrieved from is recorded.", (record7) => record7.artifactUrl ?? record7.downloadedFrom, {
     severity: "low",
     description: "No retrieval URL was recorded for this artifact.",
     impact: "Re-fetching the exact bytes later depends on undocumented tribal knowledge.",
@@ -8776,7 +8776,7 @@ var PROVENANCE_RULES = [
     derivedFrom: "Git object naming and model-hub revision semantics",
     verification: "source-metadata",
     run(ctx) {
-      let record6 = readProvenance(ctx.ir), revision = record6.commit ?? record6.revision;
+      let record7 = readProvenance(ctx.ir), revision = record7.commit ?? record7.revision;
       if (revision && IMMUTABLE_REVISION.test(revision)) {
         ctx.clean(`Pinned to immutable revision ${revision.slice(0, 12)}\u2026`);
         return;
@@ -8801,7 +8801,7 @@ var PROVENANCE_RULES = [
     derivedFrom: "Git ref semantics; mutable tags and branches are not content-addressed",
     verification: "source-metadata",
     run(ctx) {
-      let floating = [], record6 = readProvenance(ctx.ir), targetRevision = ctx.ir.target.revision;
+      let floating = [], record7 = readProvenance(ctx.ir), targetRevision = ctx.ir.target.revision;
       ctx.ir.target.revisionIsFloating === !0 && targetRevision ? floating.push({ where: "scan target", value: targetRevision }) : targetRevision && !IMMUTABLE_REVISION.test(targetRevision) && floating.push({ where: "scan target", value: targetRevision });
       for (let file of ctx.ir.files)
         for (let [key, value] of flatten(file.json))
@@ -8820,26 +8820,26 @@ var PROVENANCE_RULES = [
         });
       if (floating.length)
         return;
-      if (!(!!targetRevision || !!record6.commit || !!record6.revision || ctx.ir.files.some((file) => [...flatten(file.json)].some(([key, value]) => typeof value == "string" && /(?:^|\.)(?:revision|base_model_revision|adapter_revision|ref|branch|tag)$/i.test(key))))) {
+      if (!(!!targetRevision || !!record7.commit || !!record7.revision || ctx.ir.files.some((file) => [...flatten(file.json)].some(([key, value]) => typeof value == "string" && /(?:^|\.)(?:revision|base_model_revision|adapter_revision|ref|branch|tag)$/i.test(key))))) {
         ctx.notApplicable("NOT MEASURED \u2014 the artifact declares no repository revision, branch or tag, and none was supplied to the scan. There is nothing to judge as floating or immutable; this is absent provenance, not a verified property.");
         return;
       }
       ctx.clean("Every revision reference in the artifact was an immutable identifier.");
     }
   },
-  recordCheck("provenance.commit-captured", "Repository commit", "The upstream repository commit is captured with the artifact.", (record6) => record6.commit, {
+  recordCheck("provenance.commit-captured", "Repository commit", "The upstream repository commit is captured with the artifact.", (record7) => record7.commit, {
     severity: "medium",
     description: "No repository commit was recorded alongside the artifact.",
     impact: "The artifact cannot be reproducibly rebuilt from, or diffed against, reviewed source.",
     remediation: "Emit the build commit into the model card and configuration as part of the publishing pipeline."
   }),
-  recordCheck("provenance.license-declared", "Model license", "A model license is declared.", (record6) => record6.license, {
+  recordCheck("provenance.license-declared", "Model license", "A model license is declared.", (record7) => record7.license, {
     severity: "medium",
     description: "No model license was discovered in configuration, model card or a license file.",
     impact: "Use, redistribution, fine-tuning and commercial deployment rights are undetermined.",
     remediation: "Attach an SPDX-identifiable model license and have counsel review its obligations before deployment."
   }),
-  recordCheck("provenance.publisher-metadata", "Publisher metadata", "An author or publishing organization is recorded.", (record6) => record6.publisher, {
+  recordCheck("provenance.publisher-metadata", "Publisher metadata", "An author or publishing organization is recorded.", (record7) => record7.publisher, {
     severity: "low",
     description: "No author or publishing organization was recorded for the artifact.",
     impact: "There is no accountable owner recorded for security questions or advisories.",
@@ -8884,7 +8884,7 @@ var PROVENANCE_RULES = [
     derivedFrom: "Python packaging manifest formats",
     verification: "static-text-inspection",
     run(ctx) {
-      let record6 = readProvenance(ctx.ir), manifests = ctx.ir.files.filter((file) => /requirements\.txt$|pyproject\.toml$|setup\.py$|environment\.ya?ml$/i.test(file.path));
+      let record7 = readProvenance(ctx.ir), manifests = ctx.ir.files.filter((file) => /requirements\.txt$|pyproject\.toml$|setup\.py$|environment\.ya?ml$/i.test(file.path));
       if (!manifests.length) {
         ctx.report({
           title: "No dependency manifest accompanies the model",
@@ -8897,7 +8897,7 @@ var PROVENANCE_RULES = [
         });
         return;
       }
-      ctx.clean(`${record6.externalDependencies.length} declared dependenc${record6.externalDependencies.length === 1 ? "y" : "ies"} across ${manifests.length} manifest(s).`);
+      ctx.clean(`${record7.externalDependencies.length} declared dependenc${record7.externalDependencies.length === 1 ? "y" : "ies"} across ${manifests.length} manifest(s).`);
     }
   },
   {
@@ -8972,7 +8972,7 @@ var PROVENANCE_RULES = [
       });
     }
   },
-  recordCheck("provenance.model-card-source", "Model card", "A model card documents origin, intended use and limitations.", (record6) => record6.modelCardPath, {
+  recordCheck("provenance.model-card-source", "Model card", "A model card documents origin, intended use and limitations.", (record7) => record7.modelCardPath, {
     severity: "medium",
     description: "The artifact has no discoverable README or model card.",
     impact: "Reviewers cannot establish intended use, training data, limitations or safety evaluation from the artifact itself.",
@@ -10909,11 +10909,11 @@ function sanitizeAssertions(raw) {
   for (let item of raw) {
     if (!item || typeof item != "object")
       continue;
-    let record6 = item, op = record6.op;
+    let record7 = item, op = record7.op;
     if (typeof op != "string" || !ASSERT_OPS.has(op))
       continue;
-    let path = typeof record6.path == "string" ? record6.path : "", needsValue = op !== "exists" && op !== "not-exists";
-    if (!(needsValue && record6.value === void 0) && (out.push({ path, op, ...needsValue ? { value: record6.value } : {} }), out.length >= 10))
+    let path = typeof record7.path == "string" ? record7.path : "", needsValue = op !== "exists" && op !== "not-exists";
+    if (!(needsValue && record7.value === void 0) && (out.push({ path, op, ...needsValue ? { value: record7.value } : {} }), out.length >= 10))
       break;
   }
   return out;
@@ -10940,22 +10940,22 @@ function parseGeneratedPromptCases(text6, ctx = {}) {
   for (let raw of parsed) {
     if (!raw || typeof raw != "object")
       continue;
-    let record6 = raw, prompt = typeof record6.prompt == "string" ? record6.prompt.trim() : "";
+    let record7 = raw, prompt = typeof record7.prompt == "string" ? record7.prompt.trim() : "";
     if (!prompt || !isPromptLike(prompt))
       continue;
-    let type = typeof record6.type == "string" && CASE_TYPES.has(record6.type) ? record6.type : "positive", expectedTool = typeof record6.expectedTool == "string" ? record6.expectedTool.trim() : "", forbiddenTools = textList(record6.forbiddenTools).filter((t) => known ? known.has(t) : !0);
+    let type = typeof record7.type == "string" && CASE_TYPES.has(record7.type) ? record7.type : "positive", expectedTool = typeof record7.expectedTool == "string" ? record7.expectedTool.trim() : "", forbiddenTools = textList(record7.forbiddenTools).filter((t) => known ? known.has(t) : !0);
     if (cases.push({
       id: `${prefix}-${cases.length + 1}`,
-      name: (typeof record6.name == "string" && record6.name.trim() ? record6.name.trim() : `${type} case`).slice(0, 120),
+      name: (typeof record7.name == "string" && record7.name.trim() ? record7.name.trim() : `${type} case`).slice(0, 120),
       source: { kind: "ai-generated", serverId: ctx.serverId, toolName: ctx.toolName },
       type,
       prompt: prompt.slice(0, 8e3),
-      expectedBehavior: typeof record6.expectedBehavior == "string" && record6.expectedBehavior.trim() ? record6.expectedBehavior.trim().slice(0, 500) : void 0,
+      expectedBehavior: typeof record7.expectedBehavior == "string" && record7.expectedBehavior.trim() ? record7.expectedBehavior.trim().slice(0, 500) : void 0,
       // Never let the generator invent a tool the connected server doesn't advertise.
       expectedTool: expectedTool && (!known || known.has(expectedTool)) ? expectedTool : void 0,
       forbiddenTools: forbiddenTools.length ? forbiddenTools : void 0,
-      assertions: sanitizeAssertions(record6.assertions),
-      tags: textList(record6.tags, 6)
+      assertions: sanitizeAssertions(record7.assertions),
+      tags: textList(record7.tags, 6)
     }), cases.length >= max)
       break;
   }
@@ -11167,6 +11167,122 @@ async function relaySammyInferenceBoundary(options) {
   }
 }
 
+// ../server/dist/hostedSammySuiteHandoff.js
+import { createHash as createHash15, randomUUID as randomUUID7 } from "node:crypto";
+import { existsSync as existsSync2, linkSync, mkdirSync as mkdirSync2, readFileSync as readFileSync3, unlinkSync, writeFileSync } from "node:fs";
+import { join as join4, resolve as resolve5 } from "node:path";
+var GENERATION_ID = /^sammy-[a-f0-9]{12}$/, STATIC_FINGERPRINT = /^static-suite-fp-[a-f0-9]{12}$/, PROFILE_TARGET_FINGERPRINT = /^target-fp-[a-f0-9]{12}$/, GOVERNED_TARGET_FINGERPRINT = /^target-fp-[a-f0-9]{32}$/, CAPABILITY_FINGERPRINT = /^cap-fp-[a-f0-9]{32}$/, LINEAGE_KEYS = /* @__PURE__ */ new Set([
+  "generationId",
+  "generationStrategy",
+  "registryVersion",
+  "generatorModelAlias",
+  "reviewerModelAlias",
+  "graphVersion",
+  "promptBundleVersion",
+  "datasetVersionRefs",
+  "generatorModelRef",
+  "reviewerModelRef"
+]);
+function record6(value) {
+  return !!value && typeof value == "object" && !Array.isArray(value);
+}
+function validateArtifact(value, generationId) {
+  if (!record6(value) || !Object.keys(value).every((key) => ["format", "suite", "lineage", "fingerprint"].includes(key)))
+    throw new Error("Hosted Sammy returned an invalid static Suite artifact envelope.");
+  if (value.format !== "prooflane-static-assurance-suite-v1" || typeof value.fingerprint != "string" || !STATIC_FINGERPRINT.test(value.fingerprint))
+    throw new Error("Hosted Sammy returned an unsupported static Suite artifact.");
+  if (!record6(value.lineage) || !Object.keys(value.lineage).every((key) => LINEAGE_KEYS.has(key)) || value.lineage.generationId !== generationId)
+    throw new Error("Hosted Sammy artifact lineage does not match the approved generation.");
+  let suite = validateLegacyLocalSuite(value.suite);
+  if (suite.status !== "APPROVED" || !suite.approvedAt)
+    throw new Error("Only an approved Sammy Suite can enter governed authoring.");
+  let expectedFingerprint = `static-suite-fp-${createHash15("sha256").update(canonicalizeSuiteJson({ suiteFingerprint: suite.suiteFingerprint, lineage: value.lineage }), "utf8").digest("hex").slice(0, 12)}`;
+  if (value.fingerprint !== expectedFingerprint)
+    throw new Error("Hosted Sammy static Suite artifact fingerprint verification failed.");
+  return { format: value.format, suite, lineage: value.lineage, fingerprint: value.fingerprint };
+}
+function validateCapabilities(value) {
+  if (value.length > 1e3)
+    throw new Error("The governed capability surface is too large.");
+  let ids = /* @__PURE__ */ new Set();
+  return value.map((entry) => {
+    if (!entry || typeof entry.id != "string" || entry.id.length < 1 || entry.id.length > 128 || !/^[A-Za-z0-9][A-Za-z0-9_.:/-]{0,127}$/.test(entry.id) || typeof entry.fingerprint != "string" || !CAPABILITY_FINGERPRINT.test(entry.fingerprint) || ids.has(entry.id))
+      throw new Error("The governed capability surface is invalid.");
+    return ids.add(entry.id), { id: entry.id, fingerprint: entry.fingerprint };
+  }).sort((left, right) => left.id.localeCompare(right.id));
+}
+function approvedTestContentFingerprint(tests) {
+  let content = tests.map((test) => {
+    let { createdAt: _createdAt, ...rest } = test, intelligence = test.intelligence ? (({ generationId: _generationId, suiteId: _suiteId, suiteVersion: _suiteVersion, reviewStatus: _reviewStatus, reviewedAt: _reviewedAt, reviewedBy: _reviewedBy, ...authored }) => authored)(test.intelligence) : void 0, rag = test.rag ? {
+      ...test.rag,
+      intelligence: test.rag.intelligence ? (({ generationId: _generationId, suiteId: _suiteId, suiteVersion: _suiteVersion, nativeTestRef: _nativeTestRef, ...trusted }) => trusted)(test.rag.intelligence) : null
+    } : null;
+    return { ...rest, tags: [...test.tags].sort(), intelligence: intelligence ?? null, rag };
+  }).sort((left, right) => left.id.localeCompare(right.id));
+  return `suite-fp-${createHash15("sha256").update(canonicalizeSuiteJson({ format: "prooflane-assurance-suite-v1", content }), "utf8").digest("hex").slice(0, 12)}`;
+}
+function runtimeSuiteId(sourceId, generationId) {
+  let sourceSlug = localSuiteSlug(sourceId), suffix = generationId.slice(6);
+  return `${sourceSlug.slice(0, 48)}-${suffix}`;
+}
+function localFingerprint(suite) {
+  return `sha256:${createHash15("sha256").update(canonicalizeSuiteJson(suite), "utf8").digest("hex")}`;
+}
+function materializeHostedSammySuite(input) {
+  if (!GENERATION_ID.test(input.generationId))
+    throw new Error("Hosted Sammy generation id is invalid.");
+  if (!input.expectedTarget.trim() || input.expectedTarget.length > 256 || !PROFILE_TARGET_FINGERPRINT.test(input.expectedProfileTargetFingerprint) || !GOVERNED_TARGET_FINGERPRINT.test(input.governedTargetFingerprint))
+    throw new Error("The current hosted capability surface is invalid.");
+  let artifact = validateArtifact(input.artifact, input.generationId);
+  if (artifact.suite.suiteFingerprint !== approvedTestContentFingerprint(artifact.suite.tests))
+    throw new Error("Hosted Sammy approved Suite content fingerprint verification failed.");
+  if (artifact.suite.target !== input.expectedTarget || artifact.suite.targetFingerprint !== input.expectedProfileTargetFingerprint)
+    throw new Error("The connected MCP target changed after Sammy approval. Generate and approve a fresh plan.");
+  let requiredCapabilities = validateCapabilities(input.requiredCapabilities), id = runtimeSuiteId(artifact.suite.id, input.generationId), suite = validateLegacyLocalSuite({
+    ...artifact.suite,
+    id,
+    targetFingerprint: input.governedTargetFingerprint
+  }), expectedLocalFingerprint = localFingerprint(suite), slug = localSuiteSlug(suite.id), directory = resolve5(input.cwd ?? process.cwd(), ".prooflane", "suites"), fileName = `${slug}-v${suite.version}.json`, file = join4(directory, fileName), bytes = `${JSON.stringify(suite, null, 2)}
+`, created = !1;
+  if (mkdirSync2(directory, { recursive: !0, mode: 448 }), existsSync2(file)) {
+    if (readLegacyLocalSuiteArtifact(file, input.cwd ?? process.cwd()).localFingerprint !== expectedLocalFingerprint)
+      throw new Error(`A different local Suite already occupies ${fileName}; Prooflane will not overwrite it.`);
+  } else {
+    let temporary = join4(directory, `.${fileName}.${process.pid}.${randomUUID7()}.tmp`);
+    try {
+      writeFileSync(temporary, bytes, { encoding: "utf8", flag: "wx", mode: 384 });
+      try {
+        linkSync(temporary, file), created = !0;
+      } catch (error) {
+        if (!existsSync2(file))
+          throw error;
+        if (readLegacyLocalSuiteArtifact(file, input.cwd ?? process.cwd()).localFingerprint !== expectedLocalFingerprint)
+          throw new Error(`A different local Suite already occupies ${fileName}; Prooflane will not overwrite it.`);
+      }
+    } finally {
+      existsSync2(temporary) && unlinkSync(temporary);
+    }
+  }
+  let stored = readLegacyLocalSuiteArtifact(file, input.cwd ?? process.cwd());
+  if (stored.localFingerprint !== expectedLocalFingerprint || stored.slug !== slug || stored.suite.status !== "APPROVED")
+    throw new Error("The materialized Sammy Suite failed local integrity verification.");
+  if (readFileSync3(file).byteLength > 8 * 1024 * 1024)
+    throw new Error("The materialized Sammy Suite exceeds the local artifact limit.");
+  return {
+    version: "prooflane-hosted-sammy-materialization-v1",
+    generationId: input.generationId,
+    sourceArtifactFingerprint: artifact.fingerprint,
+    sourceTargetFingerprint: artifact.suite.targetFingerprint,
+    governedTargetFingerprint: input.governedTargetFingerprint,
+    requiredCapabilities,
+    slug,
+    localFingerprint: stored.localFingerprint,
+    localVersion: stored.suite.version,
+    fileName,
+    created
+  };
+}
+
 // ../server/dist/plans.js
 var UNLIMITED = 1e6, PLANS = {
   free: { tier: "free", label: "Free \xB7 Inspector", servers: 1, tools: 5, attacks: 0, retrievers: 0, prompts: 10, maxVus: 10, deployment: !1, historyDays: 7, ci: !1, ruleFeed: "static", core: !0, hosted: !1, security: !1, rag: !1, gates: !1 },
@@ -11218,7 +11334,7 @@ function describeToolError(output) {
   })();
   return text6.length > 500 ? `${text6.slice(0, 500)}\u2026` : text6 || "the tool reported an error";
 }
-var sha256 = (value) => createHash15("sha256").update(typeof value == "string" ? value : JSON.stringify(value)).digest("hex"), hostedRagCaseQuery = (testCase) => (testCase.userQuery ?? "").trim() || testCase.query, hostedRagCaseName = (testCase) => (testCase.name ?? "").trim() || hostedRagCaseQuery(testCase) || testCase.id, hostedRagCaseInput = (testCase) => testCase.input ?? { query: hostedRagCaseQuery(testCase) }, clampRagScore = (value) => Math.max(0, Math.min(100, Math.round(Number.isFinite(value) ? value : 0))), averageRagScore = (values) => values.length ? Math.round(values.reduce((sum, value) => sum + value, 0) / values.length) : 100;
+var sha256 = (value) => createHash16("sha256").update(typeof value == "string" ? value : JSON.stringify(value)).digest("hex"), hostedRagCaseQuery = (testCase) => (testCase.userQuery ?? "").trim() || testCase.query, hostedRagCaseName = (testCase) => (testCase.name ?? "").trim() || hostedRagCaseQuery(testCase) || testCase.id, hostedRagCaseInput = (testCase) => testCase.input ?? { query: hostedRagCaseQuery(testCase) }, clampRagScore = (value) => Math.max(0, Math.min(100, Math.round(Number.isFinite(value) ? value : 0))), averageRagScore = (values) => values.length ? Math.round(values.reduce((sum, value) => sum + value, 0) / values.length) : 100;
 function extractHostedRagPayload(output) {
   let value = output;
   if (Array.isArray(value) && value.length && value.every((block) => block && typeof block == "object" && "type" in block)) {
@@ -11492,10 +11608,10 @@ function resultCount3(value) {
   if (Array.isArray(value))
     return value.length;
   if (value && typeof value == "object") {
-    let record6 = value;
+    let record7 = value;
     for (let key of ["results", "items", "documents", "matches", "content"])
-      if (Array.isArray(record6[key]))
-        return record6[key].length;
+      if (Array.isArray(record7[key]))
+        return record7[key].length;
     return 1;
   }
   return value == null || value === "" ? 0 : 1;
@@ -11624,8 +11740,8 @@ function publicServerError(path) {
 }
 var HOSTED_SAMMY_AUTHORIZATION = Symbol("prooflane.hosted-sammy-authorization");
 function buildApp() {
-  let app2 = Fastify({ logger: !1 });
-  app2.addHook("onSend", async (request, reply, payload) => !request.url.startsWith("/api") || reply.statusCode < 500 ? payload : (reply.header("cache-control", "no-store"), reply.type("application/json; charset=utf-8"), JSON.stringify({ error: publicServerError(request.url), reference: request.id })));
+  let app = Fastify({ logger: !1 });
+  app.addHook("onSend", async (request, reply, payload) => !request.url.startsWith("/api") || reply.statusCode < 500 ? payload : (reply.header("cache-control", "no-store"), reply.type("application/json; charset=utf-8"), JSON.stringify({ error: publicServerError(request.url), reference: request.id })));
   let store = new Store(dbPath()), svc = new InspectorService(store), mcpManager = new McpConnectionManager(() => new InspectorService(store), store), env = (process.env.KAWACH_ENV ?? process.env.NODE_ENV ?? "production").toLowerCase(), isDev = env === "dev" || env === "development", intelligenceMode = PUBLIC_RUNNER_BUILD || process.env.KAWACH_INTELLIGENCE_MODE === "hosted" ? "hosted" : "legacy", AUTH0_DOMAIN = process.env.AUTH0_DOMAIN, AUTH0_CLIENT_ID = process.env.AUTH0_CLIENT_ID, AUTH0_AUDIENCE = process.env.AUTH0_AUDIENCE, CONTROL_PLANE_URL = process.env.KAWACH_CONTROL_PLANE_URL?.replace(/\/$/, ""), PROOFLANE_PROJECT = (process.env.PROOFLANE_PROJECT ?? "default").trim(), configuredNumber = (name, fallback, minimum, maximum) => {
     let value = Number(process.env[name]);
     return Number.isFinite(value) ? Math.max(minimum, Math.min(maximum, value)) : fallback;
@@ -11651,10 +11767,10 @@ function buildApp() {
         targetTokenCeiling: Math.trunc(configuredNumber("PROOFLANE_BENCHMARK_PAID_TARGET_TOKENS", DEFAULT_BENCHMARK_PRICING_POLICY.products.PAID_SINGLE_RUN.targetTokenCeiling, 1e3, 2e7))
       }
     }
-  }, localLifecycleKey = randomUUID7(), activeMcpAuthMode = "unknown", activeMcpConnectionId = null, oauthFlows = /* @__PURE__ */ new Map(), assuranceGateManifest = process.env.PROOFLANE_ASSURANCE_GATES_FILE ?? resolve5(".prooflane/assurance-gates.json"), assurancePolicyRegistry = process.env.PROOFLANE_ASSURANCE_POLICIES_FILE ?? join4(dirname4(assuranceGateManifest), "assurance-policies.json"), readAssurancePolicies = async () => {
+  }, localLifecycleKey = randomUUID8(), activeMcpAuthMode = "unknown", activeMcpConnectionId = null, oauthFlows = /* @__PURE__ */ new Map(), assuranceGateManifest = process.env.PROOFLANE_ASSURANCE_GATES_FILE ?? resolve6(".prooflane/assurance-gates.json"), assurancePolicyRegistry = process.env.PROOFLANE_ASSURANCE_POLICIES_FILE ?? join5(dirname4(assuranceGateManifest), "assurance-policies.json"), readAssurancePolicies = async () => {
     let intel = await loadLegacyIntelligence(), stored = [];
-    if (existsSync2(assurancePolicyRegistry)) {
-      let document = JSON.parse(readFileSync3(assurancePolicyRegistry, "utf8"));
+    if (existsSync3(assurancePolicyRegistry)) {
+      let document = JSON.parse(readFileSync4(assurancePolicyRegistry, "utf8"));
       if (document.version !== "prooflane-assurance-policy-registry-v1" || !Array.isArray(document.policies))
         throw new Error("Assurance Policy registry must use prooflane-assurance-policy-registry-v1.");
       stored = document.policies;
@@ -11662,7 +11778,7 @@ function buildApp() {
     let policies = stored.map((policy) => intel.validateAssurancePolicyVersion(policy));
     return policies.some((policy) => policy.id === intel.DEFAULT_ASSURANCE_POLICY.id) || policies.unshift(structuredClone(intel.DEFAULT_ASSURANCE_POLICY)), policies.sort((a, b) => b.createdAt.localeCompare(a.createdAt) || b.version - a.version || a.id.localeCompare(b.id));
   }, writeAssurancePolicies = (policies) => {
-    mkdirSync2(dirname4(assurancePolicyRegistry), { recursive: !0 }), writeFileSync(assurancePolicyRegistry, JSON.stringify({ version: "prooflane-assurance-policy-registry-v1", policies }, null, 2) + `
+    mkdirSync3(dirname4(assurancePolicyRegistry), { recursive: !0 }), writeFileSync2(assurancePolicyRegistry, JSON.stringify({ version: "prooflane-assurance-policy-registry-v1", policies }, null, 2) + `
 `, "utf8");
   }, hostedSammyInference = async (request, task, context) => {
     let authorization = request[HOSTED_SAMMY_AUTHORIZATION], relayRequest = buildHostedSammyRelayRequest({
@@ -11725,10 +11841,19 @@ function buildApp() {
         method,
         headers: body === void 0 ? { authorization } : { authorization, "content-type": "application/json" },
         body: body === void 0 ? void 0 : JSON.stringify(body)
-      }), text6 = await response.text(), payload = text6 ? JSON.parse(text6) : null;
-      return response.ok && await onSuccess?.(payload), reply.code(response.status).send(payload);
-    } catch {
-      return reply.code(502).send({ error: "Prooflane Cloud Workspace could not be reached. Check KAWACH_CONTROL_PLANE_URL and your connection." });
+      }), text6 = await response.text(), payload = null;
+      if (text6)
+        try {
+          payload = JSON.parse(text6);
+        } catch {
+          if (response.ok)
+            return reply.code(502).send({ error: "Prooflane Cloud Workspace returned an invalid response." });
+          payload = response.status === 404 ? { error: "The deployed Prooflane control plane does not support this Inspector route yet. Deploy the matching control-plane build, then retry.", upgrade: !0 } : { error: `Prooflane Cloud request failed (${response.status}).` };
+        }
+      let upstreamError = payload && typeof payload == "object" && typeof payload.error == "string" ? String(payload.error).trim() : "";
+      return !response.ok && response.status === 404 && (!upstreamError || /^not found$/i.test(upstreamError) || /route.*not found/i.test(upstreamError)) && (payload = { error: "The deployed Prooflane control plane does not support this Inspector route yet. Deploy the matching control-plane build, then retry.", upgrade: !0 }), response.ok && await onSuccess?.(payload), reply.code(response.status).send(payload);
+    } catch (error) {
+      return error instanceof SyntaxError ? reply.code(502).send({ error: "Prooflane Cloud Workspace returned an invalid response." }) : reply.code(502).send({ error: "Prooflane Cloud Workspace could not be reached. Check KAWACH_CONTROL_PLANE_URL and your connection." });
     }
   }
   async function requestControlPlaneJson(req, path, method = "GET", body, idempotencyKey) {
@@ -11745,9 +11870,19 @@ function buildApp() {
     } catch {
       throw new ControlPlaneRequestError(502, "Prooflane Cloud Workspace could not be reached.");
     }
-    let text6 = await response.text(), payload = text6 ? JSON.parse(text6) : {};
-    if (!response.ok)
-      throw new ControlPlaneRequestError(response.status, typeof payload.error == "string" ? String(payload.error).slice(0, 300) : "Prooflane Cloud request failed.");
+    let text6 = await response.text(), payload;
+    try {
+      payload = text6 ? JSON.parse(text6) : {};
+    } catch {
+      if (response.ok)
+        throw new ControlPlaneRequestError(502, "Prooflane Cloud Workspace returned an invalid response.");
+      let message2 = response.status === 404 ? "The deployed Prooflane control plane does not support this Inspector route yet. Deploy the matching control-plane build, then retry." : `Prooflane Cloud request failed (${response.status}).`;
+      throw new ControlPlaneRequestError(response.status, message2);
+    }
+    if (!response.ok) {
+      let upstreamError = typeof payload.error == "string" ? String(payload.error).trim().slice(0, 300) : "", message2 = response.status === 404 && (!upstreamError || /^not found$/i.test(upstreamError) || /route.*not found/i.test(upstreamError)) ? "The deployed Prooflane control plane does not support this Inspector route yet. Deploy the matching control-plane build, then retry." : upstreamError || "Prooflane Cloud request failed.";
+      throw new ControlPlaneRequestError(response.status, message2);
+    }
     return payload;
   }
   async function cloudPlan(req) {
@@ -11792,7 +11927,7 @@ function buildApp() {
   async function resolvePlan(req) {
     return (await resolvePlanState(req)).plan;
   }
-  app2.addHook("preHandler", async (req, reply) => {
+  app.addHook("preHandler", async (req, reply) => {
     if (req.method === "GET" || req.method === "HEAD" || req.method === "OPTIONS")
       return;
     let path = req.url.split("?", 1)[0] ?? req.url;
@@ -11838,17 +11973,54 @@ function buildApp() {
     let p = await resolvePlan(req);
     return { core: p.core, security: p.security, rag: p.rag, deployment: p.deployment, ci: p.ci };
   }
-  app2.addHook("onRequest", async (req, reply) => {
-    if (intelligenceMode === "hosted" && (/^\/api\/intelligence\/(?:analyze-options|surface|generations|datasets|native-artifacts|effectiveness|learning-candidates|usage)(?:\/|\?|$)/.test(req.url) || /^\/api\/(?:annotations|assurance|boundary)(?:\/|\?|$)/.test(req.url)) && req.raw.method !== "OPTIONS")
-      return reply.code(410).send({
+  if (app.addHook("onRequest", async (req, reply) => {
+    if (intelligenceMode === "hosted" && (/^\/api\/intelligence\/(?:effectiveness|learning-candidates)(?:\/|\?|$)/.test(req.url) || /^\/api\/(?:assurance|boundary)(?:\/|\?|$)/.test(req.url)) && req.raw.method !== "OPTIONS")
+      return /^\/api\/assurance\/gates(?:\/|\?|$)/.test(req.url) && reply.header("cache-control", "no-store"), reply.code(410).send({
         ok: !1,
         error: "This feature uses Hosted Intelligence and is unavailable through the retired local route."
       });
     let plan = await resolvePlan(req);
     mcpManager.reconcileEntitlement(PROOFLANE_PROJECT, mcpEntitlementForPlan(plan)), svc.setToolLimit(plan.tools), mcpManager.setToolLimit(PROOFLANE_PROJECT, plan.tools), activeMcpConnectionId && mcpManager.getConnection(PROOFLANE_PROJECT, activeMcpConnectionId)?.status === "ENTITLEMENT_LOCKED" && svc.setToolLimit(0);
-  }), app2.addHook("onSend", async (_req, reply) => {
+  }), intelligenceMode === "hosted") {
+    let hostedSurfaceRefreshInFlight = null, relayHostedIntelligenceSurface = async (req, reply, refresh) => {
+      try {
+        refresh && svc.isConnected() && (hostedSurfaceRefreshInFlight ??= svc.refreshCapabilities().finally(() => {
+          hostedSurfaceRefreshInFlight = null;
+        }), await hostedSurfaceRefreshInFlight);
+        let capabilities = svc.getCapabilities();
+        return capabilities ? proxyControlPlane(req, reply, "/v1/intelligence/surface", { capabilities }) : { connected: !1 };
+      } catch (error) {
+        return reply.code(503).send({ error: `MCP discovery refresh failed: ${error instanceof Error ? error.message : String(error)}` });
+      }
+    };
+    app.get("/api/intelligence/surface", async (req, reply) => (reply.header("cache-control", "no-store"), relayHostedIntelligenceSurface(req, reply, !1))), app.post("/api/intelligence/surface/refresh", async (req, reply) => relayHostedIntelligenceSurface(req, reply, !0));
+    let hostedSammyPath = `/v1/projects/${encodeURIComponent(PROOFLANE_PROJECT)}/intelligence`, hostedCapabilities = (reply) => {
+      let capabilities = svc.getCapabilities();
+      return capabilities || (reply.code(409).send({ error: "Connect an MCP target before using Sammy Intelligence." }), null);
+    }, selectedBody = (value, keys) => {
+      if (!value || typeof value != "object" || Array.isArray(value))
+        return {};
+      let source = value;
+      return Object.fromEntries(keys.filter((key) => source[key] !== void 0).map((key) => [key, source[key]]));
+    };
+    app.post("/api/intelligence/analyze-options", async (req, reply) => {
+      let capabilities = hostedCapabilities(reply);
+      if (capabilities)
+        return proxyControlPlane(req, reply, `${hostedSammyPath}/analyze-options`, { ...selectedBody(req.body, ["graphVersion"]), capabilities });
+    }), app.post("/api/intelligence/generations", async (req, reply) => {
+      let capabilities = hostedCapabilities(reply);
+      if (capabilities)
+        return proxyControlPlane(req, reply, `${hostedSammyPath}/generations`, { ...selectedBody(req.body, ["idempotencyKey", "strategy", "sammyEnabled", "selectedRecommendationIds", "datasetVersionRefs", "promptBundleVersion"]), capabilities });
+    }), app.get("/api/intelligence/generations/:id", async (req, reply) => proxyControlPlane(req, reply, `${hostedSammyPath}/generations/${encodeURIComponent(req.params.id)}`, void 0, "GET")), app.post("/api/intelligence/generations/:id/review", async (req, reply) => proxyControlPlane(req, reply, `${hostedSammyPath}/generations/${encodeURIComponent(req.params.id)}/review`, {})), app.post("/api/intelligence/generations/:id/approve", async (req, reply) => {
+      let capabilities = hostedCapabilities(reply);
+      if (capabilities)
+        return proxyControlPlane(req, reply, `${hostedSammyPath}/generations/${encodeURIComponent(req.params.id)}/approve`, { ...selectedBody(req.body, ["gateId", "name", "policyVersion"]), capabilities });
+    }), app.post("/api/intelligence/generations/:id/compile-suite", async (req, reply) => proxyControlPlane(req, reply, `${hostedSammyPath}/generations/${encodeURIComponent(req.params.id)}/compile-suite`, {})), app.get("/api/intelligence/usage", async (req, reply) => proxyControlPlane(req, reply, `${hostedSammyPath}/usage`, void 0, "GET")), app.get("/api/intelligence/datasets", async (req, reply) => proxyControlPlane(req, reply, `${hostedSammyPath}/datasets`, void 0, "GET")), app.post("/api/intelligence/datasets", async (req, reply) => proxyControlPlane(req, reply, `${hostedSammyPath}/datasets`, selectedBody(req.body, ["name", "format", "content"]))), app.get("/api/intelligence/native-artifacts", async (req, reply) => proxyControlPlane(req, reply, `${hostedSammyPath}/native-artifacts${req.query.pillar ? `?pillar=${encodeURIComponent(req.query.pillar)}` : ""}`, void 0, "GET")), app.post("/api/intelligence/native-artifacts/:generationId/:testId/review", async (req, reply) => proxyControlPlane(req, reply, `${hostedSammyPath}/native-artifacts/${encodeURIComponent(req.params.generationId)}/${encodeURIComponent(req.params.testId)}/review`, selectedBody(req.body, ["action", "replacement", "trustedGolden"]))), app.post("/api/annotations", async (req, reply) => proxyControlPlane(req, reply, `${hostedSammyPath}/annotations`, selectedBody(req.body, ["targetType", "targetId", "labels", "text", "resolution"]))), app.get("/api/annotations/context", async (req, reply) => proxyControlPlane(req, reply, `${hostedSammyPath}/annotations${req.query.targetId ? `?targetId=${encodeURIComponent(req.query.targetId)}` : ""}`, void 0, "GET"));
+  }
+  app.addHook("onSend", async (_req, reply) => {
     reply.header("x-content-type-options", "nosniff"), reply.header("x-frame-options", "SAMEORIGIN"), reply.header("referrer-policy", "no-referrer"), reply.header("x-permitted-cross-domain-policies", "none");
-  }), app2.get("/api/config", async (req) => {
+  }), app.get("/api/config", async (req, reply) => {
+    reply.header("cache-control", "no-store");
     let resolution = await resolvePlanState(req), plan = resolution.plan;
     return {
       env: isDev ? "dev" : "production",
@@ -11898,9 +12070,9 @@ function buildApp() {
       project: { id: PROOFLANE_PROJECT },
       intelligenceMode
     };
-  }), app2.post("/api/workspace/consent", async (req, reply) => proxyControlPlane(req, reply, "/v1/workspace/consent", req.body ?? {})), app2.post("/api/ci/token", async (req, reply) => proxyControlPlane(req, reply, "/v1/ci/token", { projectId: PROOFLANE_PROJECT }));
+  }), app.post("/api/workspace/consent", async (req, reply) => proxyControlPlane(req, reply, "/v1/workspace/consent", req.body ?? {})), app.post("/api/ci/token", async (req, reply) => proxyControlPlane(req, reply, "/v1/ci/token", { projectId: PROOFLANE_PROJECT }));
   let githubOidcTrustPath = `/v1/projects/${encodeURIComponent(PROOFLANE_PROJECT)}/github-oidc-trust`;
-  app2.get("/api/governance/github-oidc-trust", async (req, reply) => proxyControlPlane(req, reply, githubOidcTrustPath, void 0, "GET")), app2.put("/api/governance/github-oidc-trust", async (req, reply) => proxyControlPlane(req, reply, githubOidcTrustPath, req.body ?? {}, "PUT")), app2.delete("/api/governance/github-oidc-trust", async (req, reply) => proxyControlPlane(req, reply, githubOidcTrustPath, void 0, "DELETE")), app2.post("/api/trial/start", async (req, reply) => proxyControlPlane(req, reply, "/v1/trial/start", {})), app2.get("/api/workspace/status", async (req, reply) => proxyControlPlane(req, reply, "/v1/workspace", void 0, "GET")), app2.get("/api/gate-runs", async (req, reply) => proxyControlPlane(req, reply, `/v1/gate-runs?limit=${encodeURIComponent(req.query.limit ?? "200")}`, void 0, "GET")), app2.post("/api/gate-runs", async (req, reply) => proxyControlPlane(req, reply, "/v1/gate-runs", req.body ?? {})), app2.get("/api/governed-runs", async (req, reply) => proxyControlPlane(req, reply, `/v1/projects/${encodeURIComponent(PROOFLANE_PROJECT)}/runs?limit=${encodeURIComponent(req.query.limit ?? "50")}`, void 0, "GET")), app2.post("/api/intelligence/infer", async (req, reply) => {
+  app.get("/api/governance/github-oidc-trust", async (req, reply) => proxyControlPlane(req, reply, githubOidcTrustPath, void 0, "GET")), app.put("/api/governance/github-oidc-trust", async (req, reply) => proxyControlPlane(req, reply, githubOidcTrustPath, req.body ?? {}, "PUT")), app.delete("/api/governance/github-oidc-trust", async (req, reply) => proxyControlPlane(req, reply, githubOidcTrustPath, void 0, "DELETE")), app.post("/api/trial/start", async (req, reply) => proxyControlPlane(req, reply, "/v1/trial/start", {})), app.get("/api/workspace/status", async (req, reply) => proxyControlPlane(req, reply, "/v1/workspace", void 0, "GET")), app.get("/api/gate-runs", async (req, reply) => proxyControlPlane(req, reply, `/v1/gate-runs?limit=${encodeURIComponent(req.query.limit ?? "200")}`, void 0, "GET")), app.post("/api/gate-runs", async (req, reply) => proxyControlPlane(req, reply, "/v1/gate-runs", req.body ?? {})), app.get("/api/governed-runs", async (req, reply) => proxyControlPlane(req, reply, `/v1/projects/${encodeURIComponent(PROOFLANE_PROJECT)}/runs?limit=${encodeURIComponent(req.query.limit ?? "50")}`, void 0, "GET")), app.post("/api/intelligence/infer", async (req, reply) => {
     let result = await relaySammyInferenceBoundary({
       request: req.body,
       controlPlaneUrl: CONTROL_PLANE_URL,
@@ -11910,7 +12082,7 @@ function buildApp() {
     return reply.code(result.status).send(result.payload);
   });
   let suiteRegistryPath = `/v1/projects/${encodeURIComponent(PROOFLANE_PROJECT)}/suites`;
-  app2.get("/api/suites", async (req, reply) => proxyControlPlane(req, reply, suiteRegistryPath, void 0, "GET")), app2.post("/api/suites", async (req, reply) => proxyControlPlane(req, reply, suiteRegistryPath, req.body ?? {})), app2.post("/api/governance/suites/:slug/drift", async (req, reply) => {
+  app.get("/api/suites", async (req, reply) => proxyControlPlane(req, reply, suiteRegistryPath, void 0, "GET")), app.post("/api/suites", async (req, reply) => proxyControlPlane(req, reply, suiteRegistryPath, req.body ?? {})), app.post("/api/governance/suites/:slug/drift", async (req, reply) => {
     try {
       let capabilities = svc.getCapabilities();
       if (!capabilities)
@@ -11939,7 +12111,7 @@ function buildApp() {
     } catch (error) {
       return error instanceof ControlPlaneRequestError ? reply.code(error.status).send({ error: error.message }) : reply.code(500).send({ error: "Governed surface drift assessment could not complete." });
     }
-  }), app2.get("/api/suites/:slug", async (req, reply) => proxyControlPlane(req, reply, `${suiteRegistryPath}/${encodeURIComponent(req.params.slug)}`, void 0, "GET")), app2.patch("/api/suites/:slug", async (req, reply) => proxyControlPlane(req, reply, `${suiteRegistryPath}/${encodeURIComponent(req.params.slug)}`, req.body ?? {}, "PATCH")), app2.delete("/api/suites/:slug", async (req, reply) => proxyControlPlane(req, reply, `${suiteRegistryPath}/${encodeURIComponent(req.params.slug)}`, void 0, "DELETE")), app2.post("/api/suites/:slug/versions", async (req, reply) => proxyControlPlane(req, reply, `${suiteRegistryPath}/${encodeURIComponent(req.params.slug)}/versions`, req.body ?? {})), app2.get("/api/suites/:slug/versions/:version", async (req, reply) => proxyControlPlane(req, reply, `${suiteRegistryPath}/${encodeURIComponent(req.params.slug)}/versions/${encodeURIComponent(req.params.version)}`, void 0, "GET")), app2.put("/api/suites/:slug/versions/:version", async (req, reply) => proxyControlPlane(req, reply, `${suiteRegistryPath}/${encodeURIComponent(req.params.slug)}/versions/${encodeURIComponent(req.params.version)}`, req.body ?? {}, "PUT")), app2.post("/api/suites/:slug/versions/:version/review", async (req, reply) => proxyControlPlane(req, reply, `${suiteRegistryPath}/${encodeURIComponent(req.params.slug)}/versions/${encodeURIComponent(req.params.version)}/review`, {})), app2.post("/api/suites/:slug/versions/:version/approve", async (req, reply) => proxyControlPlane(req, reply, `${suiteRegistryPath}/${encodeURIComponent(req.params.slug)}/versions/${encodeURIComponent(req.params.version)}/approve`, {})), app2.post("/api/suites/:slug/versions/:version/deprecate", async (req, reply) => proxyControlPlane(req, reply, `${suiteRegistryPath}/${encodeURIComponent(req.params.slug)}/versions/${encodeURIComponent(req.params.version)}/deprecate`, {})), app2.get("/api/suites/:slug/aliases", async (req, reply) => proxyControlPlane(req, reply, `${suiteRegistryPath}/${encodeURIComponent(req.params.slug)}/aliases`, void 0, "GET")), app2.get("/api/suite-signing-keys/:keyId", async (req, reply) => proxyControlPlane(req, reply, `/v1/projects/${encodeURIComponent(PROOFLANE_PROJECT)}/suite-signing-keys/${encodeURIComponent(req.params.keyId)}`, void 0, "GET"));
+  }), app.get("/api/suites/:slug", async (req, reply) => proxyControlPlane(req, reply, `${suiteRegistryPath}/${encodeURIComponent(req.params.slug)}`, void 0, "GET")), app.patch("/api/suites/:slug", async (req, reply) => proxyControlPlane(req, reply, `${suiteRegistryPath}/${encodeURIComponent(req.params.slug)}`, req.body ?? {}, "PATCH")), app.delete("/api/suites/:slug", async (req, reply) => proxyControlPlane(req, reply, `${suiteRegistryPath}/${encodeURIComponent(req.params.slug)}`, void 0, "DELETE")), app.post("/api/suites/:slug/versions", async (req, reply) => proxyControlPlane(req, reply, `${suiteRegistryPath}/${encodeURIComponent(req.params.slug)}/versions`, req.body ?? {})), app.get("/api/suites/:slug/versions/:version", async (req, reply) => proxyControlPlane(req, reply, `${suiteRegistryPath}/${encodeURIComponent(req.params.slug)}/versions/${encodeURIComponent(req.params.version)}`, void 0, "GET")), app.put("/api/suites/:slug/versions/:version", async (req, reply) => proxyControlPlane(req, reply, `${suiteRegistryPath}/${encodeURIComponent(req.params.slug)}/versions/${encodeURIComponent(req.params.version)}`, req.body ?? {}, "PUT")), app.post("/api/suites/:slug/versions/:version/review", async (req, reply) => proxyControlPlane(req, reply, `${suiteRegistryPath}/${encodeURIComponent(req.params.slug)}/versions/${encodeURIComponent(req.params.version)}/review`, {})), app.post("/api/suites/:slug/versions/:version/approve", async (req, reply) => proxyControlPlane(req, reply, `${suiteRegistryPath}/${encodeURIComponent(req.params.slug)}/versions/${encodeURIComponent(req.params.version)}/approve`, {})), app.post("/api/suites/:slug/versions/:version/deprecate", async (req, reply) => proxyControlPlane(req, reply, `${suiteRegistryPath}/${encodeURIComponent(req.params.slug)}/versions/${encodeURIComponent(req.params.version)}/deprecate`, {})), app.get("/api/suites/:slug/aliases", async (req, reply) => proxyControlPlane(req, reply, `${suiteRegistryPath}/${encodeURIComponent(req.params.slug)}/aliases`, void 0, "GET")), app.get("/api/suite-signing-keys/:keyId", async (req, reply) => proxyControlPlane(req, reply, `/v1/projects/${encodeURIComponent(PROOFLANE_PROJECT)}/suite-signing-keys/${encodeURIComponent(req.params.keyId)}`, void 0, "GET"));
   let localMigrationInspection = async (req) => {
     let cloudResponse = await requestControlPlaneJson(req, suiteRegistryPath);
     if (cloudResponse.projectId !== PROOFLANE_PROJECT || !Array.isArray(cloudResponse.suites))
@@ -11955,14 +12127,14 @@ function buildApp() {
     let scan = discoverLegacyLocalSuites({ cwd: process.cwd() }), plan = planLegacyLocalSuiteMigration(scan.suites, cloud), suites = plan.map(safeLocalSuiteMigrationSummary);
     return { plan, response: { version: "prooflane-local-suite-migration-status-v1", projectId: PROOFLANE_PROJECT, suites, issues: scan.issues, pending: suites.filter((suite) => suite.action === "CREATE_SUITE_DRAFT" || suite.action === "CREATE_VERSION_DRAFT").length, conflicts: scan.issues.length + suites.filter((suite) => suite.action === "CONFLICT").length } };
   };
-  app2.get("/api/suite-migration/status", async (req, reply) => {
+  app.get("/api/suite-migration/status", async (req, reply) => {
     try {
       return (await localMigrationInspection(req)).response;
     } catch (error) {
       let status = error instanceof ControlPlaneRequestError ? error.status : 400;
       return reply.code(status).send({ error: (error instanceof Error ? error.message : "Local Suite migration status failed.").slice(0, 300) });
     }
-  }), app2.post("/api/suite-migration/sync", async (req, reply) => {
+  }), app.post("/api/suite-migration/sync", async (req, reply) => {
     try {
       if (!req.body || typeof req.body != "object" || Array.isArray(req.body))
         return reply.code(400).send({ error: "Migration sync request must be an object." });
@@ -12009,17 +12181,47 @@ ${item.artifact.localFingerprint}`));
       let status = error instanceof ControlPlaneRequestError ? error.status : 400;
       return reply.code(status).send({ error: (error instanceof Error ? error.message : "Local Suite migration failed.").slice(0, 300) });
     }
+  }), app.post("/api/intelligence/generations/:id/materialize-suite", async (req, reply) => {
+    if (intelligenceMode !== "hosted")
+      return reply.code(409).send({ error: "Hosted Sammy Suite materialization is available only in hosted Intelligence mode." });
+    if (!req.body || typeof req.body != "object" || Array.isArray(req.body) || Object.keys(req.body).length !== 0)
+      return reply.code(400).send({ error: "Hosted Sammy Suite materialization accepts an empty body only." });
+    if (!/^sammy-[a-f0-9]{12}$/.test(req.params.id))
+      return reply.code(400).send({ error: "Hosted Sammy generation id is invalid." });
+    let capabilities = svc.getCapabilities();
+    if (!capabilities)
+      return reply.code(409).send({ error: "Connect the same MCP target before preparing the governed Suite." });
+    try {
+      let surface = await requestControlPlaneJson(req, "/v1/intelligence/surface", "POST", { capabilities }), governedTargetFingerprint = fingerprintServerCapabilities(capabilities), governedCapabilities = fingerprintServerCapabilitySurface(capabilities);
+      if (surface.connected !== !0 || typeof surface.target != "string" || typeof surface.fingerprint != "string" || surface.governedTargetFingerprint !== governedTargetFingerprint || JSON.stringify(surface.governedCapabilities) !== JSON.stringify(governedCapabilities))
+        throw new Error("Hosted capability analysis did not preserve the current governed target identity.");
+      let compiled = await requestControlPlaneJson(req, `/v1/projects/${encodeURIComponent(PROOFLANE_PROJECT)}/intelligence/generations/${encodeURIComponent(req.params.id)}/compile-suite`, "POST", {});
+      if (!compiled.artifact)
+        throw new Error("Hosted Sammy did not return an approved static Suite artifact.");
+      return { materialized: materializeHostedSammySuite({
+        artifact: compiled.artifact,
+        generationId: req.params.id,
+        expectedTarget: surface.target,
+        expectedProfileTargetFingerprint: surface.fingerprint,
+        governedTargetFingerprint,
+        requiredCapabilities: governedCapabilities,
+        cwd: process.cwd()
+      }) };
+    } catch (error) {
+      let status = error instanceof ControlPlaneRequestError ? error.status : 409;
+      return reply.code(status).send({ error: (error instanceof Error ? error.message : "The hosted Sammy Suite could not be prepared.").slice(0, 300) });
+    }
   });
   let gateRegistryPath = `/v1/projects/${encodeURIComponent(PROOFLANE_PROJECT)}/gates`;
-  app2.get("/api/governance/gates", async (req, reply) => proxyControlPlane(req, reply, gateRegistryPath, void 0, "GET")), app2.post("/api/governance/gates", async (req, reply) => proxyControlPlane(req, reply, gateRegistryPath, req.body ?? {})), app2.get("/api/governance/gates/:slug", async (req, reply) => proxyControlPlane(req, reply, `${gateRegistryPath}/${encodeURIComponent(req.params.slug)}`, void 0, "GET")), app2.post("/api/governance/gates/:slug/versions", async (req, reply) => proxyControlPlane(req, reply, `${gateRegistryPath}/${encodeURIComponent(req.params.slug)}/versions`, req.body ?? {})), app2.get("/api/governance/gates/:slug/versions/:version", async (req, reply) => proxyControlPlane(req, reply, `${gateRegistryPath}/${encodeURIComponent(req.params.slug)}/versions/${encodeURIComponent(req.params.version)}`, void 0, "GET")), app2.put("/api/governance/gates/:slug/versions/:version", async (req, reply) => proxyControlPlane(req, reply, `${gateRegistryPath}/${encodeURIComponent(req.params.slug)}/versions/${encodeURIComponent(req.params.version)}`, req.body ?? {}, "PUT"));
+  app.get("/api/governance/gates", async (req, reply) => proxyControlPlane(req, reply, gateRegistryPath, void 0, "GET")), app.post("/api/governance/gates", async (req, reply) => proxyControlPlane(req, reply, gateRegistryPath, req.body ?? {})), app.get("/api/governance/gates/:slug", async (req, reply) => proxyControlPlane(req, reply, `${gateRegistryPath}/${encodeURIComponent(req.params.slug)}`, void 0, "GET")), app.post("/api/governance/gates/:slug/versions", async (req, reply) => proxyControlPlane(req, reply, `${gateRegistryPath}/${encodeURIComponent(req.params.slug)}/versions`, req.body ?? {})), app.get("/api/governance/gates/:slug/versions/:version", async (req, reply) => proxyControlPlane(req, reply, `${gateRegistryPath}/${encodeURIComponent(req.params.slug)}/versions/${encodeURIComponent(req.params.version)}`, void 0, "GET")), app.put("/api/governance/gates/:slug/versions/:version", async (req, reply) => proxyControlPlane(req, reply, `${gateRegistryPath}/${encodeURIComponent(req.params.slug)}/versions/${encodeURIComponent(req.params.version)}`, req.body ?? {}, "PUT"));
   for (let transition of ["review", "approve", "deprecate"])
-    app2.post(`/api/governance/gates/:slug/versions/:version/${transition}`, async (req, reply) => proxyControlPlane(req, reply, `${gateRegistryPath}/${encodeURIComponent(req.params.slug)}/versions/${encodeURIComponent(req.params.version)}/${transition}`, {}));
-  app2.get("/api/governance/gates/:slug/aliases", async (req, reply) => proxyControlPlane(req, reply, `${gateRegistryPath}/${encodeURIComponent(req.params.slug)}/aliases`, void 0, "GET")), app2.get("/api/governance/gates/:slug/audit", async (req, reply) => proxyControlPlane(req, reply, `${gateRegistryPath}/${encodeURIComponent(req.params.slug)}/audit?limit=${encodeURIComponent(req.query.limit ?? "50")}`, void 0, "GET")), app2.get("/api/governance/gates/:slug/resolve", async (req, reply) => proxyControlPlane(req, reply, `${gateRegistryPath}/${encodeURIComponent(req.params.slug)}/resolve`, void 0, "GET")), app2.get("/api/governance/gate-signing-keys/:keyId", async (req, reply) => proxyControlPlane(req, reply, `/v1/projects/${encodeURIComponent(PROOFLANE_PROJECT)}/gate-signing-keys/${encodeURIComponent(req.params.keyId)}`, void 0, "GET"));
+    app.post(`/api/governance/gates/:slug/versions/:version/${transition}`, async (req, reply) => proxyControlPlane(req, reply, `${gateRegistryPath}/${encodeURIComponent(req.params.slug)}/versions/${encodeURIComponent(req.params.version)}/${transition}`, {}));
+  app.get("/api/governance/gates/:slug/aliases", async (req, reply) => proxyControlPlane(req, reply, `${gateRegistryPath}/${encodeURIComponent(req.params.slug)}/aliases`, void 0, "GET")), app.get("/api/governance/gates/:slug/audit", async (req, reply) => proxyControlPlane(req, reply, `${gateRegistryPath}/${encodeURIComponent(req.params.slug)}/audit?limit=${encodeURIComponent(req.query.limit ?? "50")}`, void 0, "GET")), app.get("/api/governance/gates/:slug/resolve", async (req, reply) => proxyControlPlane(req, reply, `${gateRegistryPath}/${encodeURIComponent(req.params.slug)}/resolve`, void 0, "GET")), app.get("/api/governance/gate-signing-keys/:keyId", async (req, reply) => proxyControlPlane(req, reply, `/v1/projects/${encodeURIComponent(PROOFLANE_PROJECT)}/gate-signing-keys/${encodeURIComponent(req.params.keyId)}`, void 0, "GET"));
   let learningRegistryPath = `/v1/projects/${encodeURIComponent(PROOFLANE_PROJECT)}/learning`, learningMutationAuthorized = (req, reply) => typeof req.headers.authorization == "string" && req.headers.authorization.startsWith("Bearer ") ? !0 : (reply.code(401).send({ error: "Sign in to your Prooflane account first." }), !1);
-  app2.get("/api/governance/learning/runs/:runId/findings", async (req, reply) => proxyControlPlane(req, reply, `/v1/projects/${encodeURIComponent(PROOFLANE_PROJECT)}/runs/${encodeURIComponent(req.params.runId)}/learning-findings`, void 0, "GET")), app2.get("/api/governance/learning/runs/:runId/disposition", async (req, reply) => proxyControlPlane(req, reply, `/v1/projects/${encodeURIComponent(PROOFLANE_PROJECT)}/runs/${encodeURIComponent(req.params.runId)}/learning-disposition`, void 0, "GET")), app2.put("/api/governance/learning/runs/:runId/disposition", async (req, reply) => {
+  app.get("/api/governance/learning/runs/:runId/findings", async (req, reply) => proxyControlPlane(req, reply, `/v1/projects/${encodeURIComponent(PROOFLANE_PROJECT)}/runs/${encodeURIComponent(req.params.runId)}/learning-findings`, void 0, "GET")), app.get("/api/governance/learning/runs/:runId/disposition", async (req, reply) => proxyControlPlane(req, reply, `/v1/projects/${encodeURIComponent(PROOFLANE_PROJECT)}/runs/${encodeURIComponent(req.params.runId)}/learning-disposition`, void 0, "GET")), app.put("/api/governance/learning/runs/:runId/disposition", async (req, reply) => {
     if (learningMutationAuthorized(req, reply))
       return !isApproveLearningDispositionRequest(req.body) || findSensitiveMaterial(req.body) ? reply.code(400).send({ error: "Expected a compact prooflane-learning-disposition-request-v1 envelope." }) : proxyControlPlane(req, reply, `/v1/projects/${encodeURIComponent(PROOFLANE_PROJECT)}/runs/${encodeURIComponent(req.params.runId)}/learning-disposition`, req.body, "PUT");
-  }), app2.get("/api/governance/learning/generations", async (req, reply) => proxyControlPlane(req, reply, `${learningRegistryPath}/generations?limit=${encodeURIComponent(req.query.limit ?? "50")}`, void 0, "GET")), app2.post("/api/governance/learning/generations", async (req, reply) => {
+  }), app.get("/api/governance/learning/generations", async (req, reply) => proxyControlPlane(req, reply, `${learningRegistryPath}/generations?limit=${encodeURIComponent(req.query.limit ?? "50")}`, void 0, "GET")), app.post("/api/governance/learning/generations", async (req, reply) => {
     if (!learningMutationAuthorized(req, reply))
       return;
     if (!isCreateLearningGenerationRequest(req.body))
@@ -12033,15 +12235,15 @@ ${item.artifact.localFingerprint}`));
       let status = error instanceof ControlPlaneRequestError ? error.status : 502;
       return reply.code(status).send({ error: error instanceof Error ? error.message : "Governed learning generation failed." });
     }
-  }), app2.get("/api/governance/learning/tests", async (req, reply) => proxyControlPlane(req, reply, `${learningRegistryPath}/tests?limit=${encodeURIComponent(req.query.limit ?? "100")}`, void 0, "GET"));
+  }), app.get("/api/governance/learning/tests", async (req, reply) => proxyControlPlane(req, reply, `${learningRegistryPath}/tests?limit=${encodeURIComponent(req.query.limit ?? "100")}`, void 0, "GET"));
   for (let transition of ["review", "approve"])
-    app2.post(`/api/governance/learning/tests/:testId/${transition}`, async (req, reply) => {
+    app.post(`/api/governance/learning/tests/:testId/${transition}`, async (req, reply) => {
       if (learningMutationAuthorized(req, reply))
         return !req.body || typeof req.body != "object" || Array.isArray(req.body) || Object.keys(req.body).length !== 0 ? reply.code(400).send({ error: "Learning lifecycle transitions accept an empty body only." }) : proxyControlPlane(req, reply, `${learningRegistryPath}/tests/${encodeURIComponent(req.params.testId)}/${transition}`, {});
     });
-  app2.get("/api/governance/learning/audit", async (req, reply) => proxyControlPlane(req, reply, `${learningRegistryPath}/audit?limit=${encodeURIComponent(req.query.limit ?? "100")}`, void 0, "GET"));
+  app.get("/api/governance/learning/audit", async (req, reply) => proxyControlPlane(req, reply, `${learningRegistryPath}/audit?limit=${encodeURIComponent(req.query.limit ?? "100")}`, void 0, "GET"));
   let runnerRegistryPath = `/v1/projects/${encodeURIComponent(PROOFLANE_PROJECT)}/runners`;
-  app2.get("/api/governance/runners", async (req, reply) => proxyControlPlane(req, reply, runnerRegistryPath, void 0, "GET")), app2.post("/api/governance/runners/:runnerId/revoke", async (req, reply) => proxyControlPlane(req, reply, `${runnerRegistryPath}/${encodeURIComponent(req.params.runnerId)}/revoke`, {})), app2.post("/api/governance/gates/:slug/remote-runs", async (req, reply) => proxyControlPlane(req, reply, `${gateRegistryPath}/${encodeURIComponent(req.params.slug)}/remote-runs`, req.body ?? {})), app2.get("/api/governance/runner-jobs/:jobId", async (req, reply) => proxyControlPlane(req, reply, `/v1/projects/${encodeURIComponent(PROOFLANE_PROJECT)}/runner-jobs/${encodeURIComponent(req.params.jobId)}`, void 0, "GET")), app2.post("/api/governance/runner-jobs/:jobId/cancel", async (req, reply) => proxyControlPlane(req, reply, `/v1/projects/${encodeURIComponent(PROOFLANE_PROJECT)}/runner-jobs/${encodeURIComponent(req.params.jobId)}/cancel`, {})), app2.post("/api/governance/gates/:slug/runs", async (req, reply) => {
+  app.get("/api/governance/runners", async (req, reply) => proxyControlPlane(req, reply, runnerRegistryPath, void 0, "GET")), app.post("/api/governance/runners/:runnerId/revoke", async (req, reply) => proxyControlPlane(req, reply, `${runnerRegistryPath}/${encodeURIComponent(req.params.runnerId)}/revoke`, {})), app.post("/api/governance/gates/:slug/remote-runs", async (req, reply) => proxyControlPlane(req, reply, `${gateRegistryPath}/${encodeURIComponent(req.params.slug)}/remote-runs`, req.body ?? {})), app.get("/api/governance/runner-jobs/:jobId", async (req, reply) => proxyControlPlane(req, reply, `/v1/projects/${encodeURIComponent(PROOFLANE_PROJECT)}/runner-jobs/${encodeURIComponent(req.params.jobId)}`, void 0, "GET")), app.post("/api/governance/runner-jobs/:jobId/cancel", async (req, reply) => proxyControlPlane(req, reply, `/v1/projects/${encodeURIComponent(PROOFLANE_PROJECT)}/runner-jobs/${encodeURIComponent(req.params.jobId)}/cancel`, {})), app.post("/api/governance/gates/:slug/runs", async (req, reply) => {
     let projectPath = `/v1/projects/${encodeURIComponent(PROOFLANE_PROJECT)}`, run, startedAt = (/* @__PURE__ */ new Date()).toISOString(), startedMs = Date.now();
     try {
       let resolutionPayload = await requestControlPlaneJson(req, `${gateRegistryPath}/${encodeURIComponent(req.params.slug)}/resolve`), object = (value) => !!value && typeof value == "object" && !Array.isArray(value);
@@ -12073,8 +12275,8 @@ ${item.artifact.localFingerprint}`));
         throw new Error("Gate required pillars are not represented by the signed Suite.");
       if (!svc.isConnected())
         throw new Error("Connect the local MCP target before running this Gate.");
-      let runnerId = `local_ui_${createHash15("sha256").update(`${kawachHome()}
-${PROOFLANE_PROJECT}`, "utf8").digest("hex").slice(0, 24)}`, idempotencyKey = `localui:${randomUUID7().replaceAll("-", "")}`, gatePin = { gateId: gate.id, slug: gate.slug, gateVersionId: gateVersion.id, version: gateVersion.version, manifestHash: gateVersion.manifestHash }, suitePin = { suiteId: suite.id, slug: suite.slug, suiteVersionId: suiteVersion.id, version: suiteVersion.version, manifestHash: suiteVersion.manifestHash }, policyPin = { policyId: policy.id, policyVersionId: policyVersion.id, version: policyVersion.version, manifestHash: policyVersion.manifestHash }, runner = { runnerId, type: "LOCAL_UI", runnerVersion: "0.1.0", cliVersion: "ui-0.1.0" }, governedRunMatches = (candidate, targetFingerprint) => {
+      let runnerId = `local_ui_${createHash16("sha256").update(`${kawachHome()}
+${PROOFLANE_PROJECT}`, "utf8").digest("hex").slice(0, 24)}`, idempotencyKey = `localui:${randomUUID8().replaceAll("-", "")}`, gatePin = { gateId: gate.id, slug: gate.slug, gateVersionId: gateVersion.id, version: gateVersion.version, manifestHash: gateVersion.manifestHash }, suitePin = { suiteId: suite.id, slug: suite.slug, suiteVersionId: suiteVersion.id, version: suiteVersion.version, manifestHash: suiteVersion.manifestHash }, policyPin = { policyId: policy.id, policyVersionId: policyVersion.id, version: policyVersion.version, manifestHash: policyVersion.manifestHash }, runner = { runnerId, type: "LOCAL_UI", runnerVersion: "0.1.0", cliVersion: "ui-0.1.0" }, governedRunMatches = (candidate, targetFingerprint) => {
         if (!object(candidate) || !object(candidate.gate) || !object(candidate.suite) || !object(candidate.policy) || !object(candidate.runner))
           return !1;
         let value = candidate;
@@ -12151,7 +12353,7 @@ ${PROOFLANE_PROJECT}`, "utf8").digest("hex").slice(0, 24)}`, idempotencyKey = `l
     }
   });
   let policyRegistryPath = `/v1/projects/${encodeURIComponent(PROOFLANE_PROJECT)}/policies`;
-  app2.get("/api/policies", async (req, reply) => proxyControlPlane(req, reply, policyRegistryPath, void 0, "GET")), app2.post("/api/policies", async (req, reply) => proxyControlPlane(req, reply, policyRegistryPath, req.body ?? {})), app2.get("/api/policies/:policyId", async (req, reply) => proxyControlPlane(req, reply, `${policyRegistryPath}/${encodeURIComponent(req.params.policyId)}`, void 0, "GET")), app2.post("/api/policies/:policyId/versions", async (req, reply) => proxyControlPlane(req, reply, `${policyRegistryPath}/${encodeURIComponent(req.params.policyId)}/versions`, req.body ?? {})), app2.put("/api/policies/:policyId/versions/:version", async (req, reply) => proxyControlPlane(req, reply, `${policyRegistryPath}/${encodeURIComponent(req.params.policyId)}/versions/${encodeURIComponent(req.params.version)}`, req.body ?? {}, "PUT")), app2.post("/api/policies/:policyId/versions/:version/review", async (req, reply) => proxyControlPlane(req, reply, `${policyRegistryPath}/${encodeURIComponent(req.params.policyId)}/versions/${encodeURIComponent(req.params.version)}/review`, {})), app2.post("/api/policies/:policyId/versions/:version/approve", async (req, reply) => proxyControlPlane(req, reply, `${policyRegistryPath}/${encodeURIComponent(req.params.policyId)}/versions/${encodeURIComponent(req.params.version)}/approve`, {})), app2.post("/api/policies/:policyId/versions/:version/deprecate", async (req, reply) => proxyControlPlane(req, reply, `${policyRegistryPath}/${encodeURIComponent(req.params.policyId)}/versions/${encodeURIComponent(req.params.version)}/deprecate`, {})), app2.post("/api/assure/target-snapshot", async (req, reply) => proxyControlPlane(req, reply, "/v1/assure/target-snapshot", req.body ?? {})), app2.get("/api/assure/target-snapshot", async (req, reply) => proxyControlPlane(req, reply, "/v1/assure/target-snapshot", void 0, "GET")), app2.post("/api/workspace/backup-preference", async (req, reply) => proxyControlPlane(req, reply, "/v1/workspace/backup-preference", req.body ?? {})), app2.post("/api/workspace/backup", async (req, reply) => {
+  app.get("/api/policies", async (req, reply) => proxyControlPlane(req, reply, policyRegistryPath, void 0, "GET")), app.post("/api/policies", async (req, reply) => proxyControlPlane(req, reply, policyRegistryPath, req.body ?? {})), app.get("/api/policies/:policyId", async (req, reply) => proxyControlPlane(req, reply, `${policyRegistryPath}/${encodeURIComponent(req.params.policyId)}`, void 0, "GET")), app.post("/api/policies/:policyId/versions", async (req, reply) => proxyControlPlane(req, reply, `${policyRegistryPath}/${encodeURIComponent(req.params.policyId)}/versions`, req.body ?? {})), app.put("/api/policies/:policyId/versions/:version", async (req, reply) => proxyControlPlane(req, reply, `${policyRegistryPath}/${encodeURIComponent(req.params.policyId)}/versions/${encodeURIComponent(req.params.version)}`, req.body ?? {}, "PUT")), app.post("/api/policies/:policyId/versions/:version/review", async (req, reply) => proxyControlPlane(req, reply, `${policyRegistryPath}/${encodeURIComponent(req.params.policyId)}/versions/${encodeURIComponent(req.params.version)}/review`, {})), app.post("/api/policies/:policyId/versions/:version/approve", async (req, reply) => proxyControlPlane(req, reply, `${policyRegistryPath}/${encodeURIComponent(req.params.policyId)}/versions/${encodeURIComponent(req.params.version)}/approve`, {})), app.post("/api/policies/:policyId/versions/:version/deprecate", async (req, reply) => proxyControlPlane(req, reply, `${policyRegistryPath}/${encodeURIComponent(req.params.policyId)}/versions/${encodeURIComponent(req.params.version)}/deprecate`, {})), app.post("/api/assure/target-snapshot", async (req, reply) => proxyControlPlane(req, reply, "/v1/assure/target-snapshot", req.body ?? {})), app.get("/api/assure/target-snapshot", async (req, reply) => proxyControlPlane(req, reply, "/v1/assure/target-snapshot", void 0, "GET")), app.post("/api/workspace/backup-preference", async (req, reply) => proxyControlPlane(req, reply, "/v1/workspace/backup-preference", req.body ?? {})), app.post("/api/workspace/backup", async (req, reply) => {
     let snapshots = svc.listSnapshots().map(({ id, createdAt, kind, origin, snapshot }) => ({ id, createdAt, kind, origin, snapshot })), backup = {
       version: "workspace-backup-v1",
       capturedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -12167,7 +12369,7 @@ ${PROOFLANE_PROJECT}`, "utf8").digest("hex").slice(0, 24)}`, idempotencyKey = `l
       let capturedAt = payload && typeof payload == "object" && typeof payload.capturedAt == "string" ? payload.capturedAt : backup.capturedAt;
       svc.markCloudWorkspaceBackedUp(capturedAt);
     });
-  }), app2.get("/api/workspace/backup/latest", async (req, reply) => proxyControlPlane(req, reply, `/v1/workspace/backup/latest${req.query?.restorable ? "?restorable=1" : ""}`, void 0, "GET")), app2.get("/api/workspace/backup/versions", async (req, reply) => proxyControlPlane(req, reply, `/v1/workspace/backup/versions${req.query?.limit ? `?limit=${encodeURIComponent(req.query.limit)}` : ""}`, void 0, "GET")), app2.post("/api/workspace/restore", async (req, reply) => {
+  }), app.get("/api/workspace/backup/latest", async (req, reply) => proxyControlPlane(req, reply, `/v1/workspace/backup/latest${req.query?.restorable ? "?restorable=1" : ""}`, void 0, "GET")), app.get("/api/workspace/backup/versions", async (req, reply) => proxyControlPlane(req, reply, `/v1/workspace/backup/versions${req.query?.limit ? `?limit=${encodeURIComponent(req.query.limit)}` : ""}`, void 0, "GET")), app.post("/api/workspace/restore", async (req, reply) => {
     if (!CONTROL_PLANE_URL)
       return reply.code(503).send({ error: "Prooflane Cloud Workspace is not configured for this Inspector." });
     let authorization = req.headers.authorization;
@@ -12186,20 +12388,20 @@ ${PROOFLANE_PROJECT}`, "utf8").digest("hex").slice(0, 24)}`, idempotencyKey = `l
       return reply.code(404).send({ ok: !1, error: "No cloud backup was found to restore." });
     let restored = svc.restoreFromBackup(backup.value), capturedAt = backup.value.capturedAt ?? backup.createdAt;
     return svc.markCloudWorkspaceBackedUp(capturedAt), reply.send({ ok: !0, restored, capturedAt, backupId: backup.id });
-  }), app2.post("/api/workspace/local/lifecycle", async (req, reply) => {
+  }), app.post("/api/workspace/local/lifecycle", async (req, reply) => {
     if (req.headers["x-kawach-local-lifecycle"] !== localLifecycleKey)
       return reply.code(403).send({ error: "Invalid local workspace lifecycle request." });
     let subject = typeof req.body?.subject == "string" ? req.body.subject.slice(0, 320) : void 0;
     await mcpManager.clearWorkspace(PROOFLANE_PROJECT);
     let result = await svc.applyLocalWorkspaceLifecycle(subject);
     return svc = new InspectorService(store), activeMcpConnectionId = null, activeMcpAuthMode = "unknown", oauthFlows.clear(), { ok: !0, result, reason: req.body?.reason ?? "login" };
-  }), app2.post("/api/intelligence/leases", async (req, reply) => proxyControlPlane(req, reply, "/v1/intelligence/leases", req.body ?? {})), app2.post("/api/intelligence/evidence", async (req, reply) => proxyControlPlane(req, reply, "/v1/intelligence/evidence", req.body ?? {})), app2.post("/api/intelligence/evaluations", async (req, reply) => proxyControlPlane(req, reply, "/v1/intelligence/evaluations", req.body ?? {})), app2.get("/api/security/catalog", async (req, reply) => proxyControlPlane(req, reply, "/v1/security/catalog", void 0, "GET"));
+  }), app.post("/api/intelligence/leases", async (req, reply) => proxyControlPlane(req, reply, "/v1/intelligence/leases", req.body ?? {})), app.post("/api/intelligence/evidence", async (req, reply) => proxyControlPlane(req, reply, "/v1/intelligence/evidence", req.body ?? {})), app.post("/api/intelligence/evaluations", async (req, reply) => proxyControlPlane(req, reply, "/v1/intelligence/evaluations", req.body ?? {})), app.get("/api/security/catalog", async (req, reply) => proxyControlPlane(req, reply, "/v1/security/catalog", void 0, "GET"));
   for (let pillar of ["security", "rag"])
-    app2.post(`/api/${pillar}/scans`, async (req, reply) => proxyControlPlane(req, reply, "/v1/scans", { pillar, ...req.body ?? {} })), app2.get(`/api/${pillar}/scans/:id`, async (req, reply) => proxyControlPlane(req, reply, `/v1/scans/${encodeURIComponent(req.params.id)}`, void 0, "GET")), app2.get(`/api/${pillar}/scans/:id/events`, async (req, reply) => {
+    app.post(`/api/${pillar}/scans`, async (req, reply) => proxyControlPlane(req, reply, "/v1/scans", { pillar, ...req.body ?? {} })), app.get(`/api/${pillar}/scans/:id`, async (req, reply) => proxyControlPlane(req, reply, `/v1/scans/${encodeURIComponent(req.params.id)}`, void 0, "GET")), app.get(`/api/${pillar}/scans/:id/events`, async (req, reply) => {
       let after = Math.max(0, Math.trunc(Number(req.query.after)) || 0);
       return proxyControlPlane(req, reply, `/v1/scans/${encodeURIComponent(req.params.id)}/events?after=${after}`, void 0, "GET");
-    }), app2.post(`/api/${pillar}/scans/:id/next-task`, async (req, reply) => proxyControlPlane(req, reply, `/v1/scans/${encodeURIComponent(req.params.id)}/next-task`, {})), app2.post(`/api/${pillar}/scans/:id/evidence`, async (req, reply) => proxyControlPlane(req, reply, `/v1/scans/${encodeURIComponent(req.params.id)}/evidence`, req.body ?? {})), app2.post(`/api/${pillar}/scans/:id/stop`, async (req, reply) => proxyControlPlane(req, reply, `/v1/scans/${encodeURIComponent(req.params.id)}/cancel`, {})), app2.post(`/api/${pillar}/scans/:id/retry`, async (req, reply) => proxyControlPlane(req, reply, `/v1/scans/${encodeURIComponent(req.params.id)}/retry`, {}));
-  app2.post("/api/benchmark/evidence/generate", async (req, reply) => {
+    }), app.post(`/api/${pillar}/scans/:id/next-task`, async (req, reply) => proxyControlPlane(req, reply, `/v1/scans/${encodeURIComponent(req.params.id)}/next-task`, {})), app.post(`/api/${pillar}/scans/:id/evidence`, async (req, reply) => proxyControlPlane(req, reply, `/v1/scans/${encodeURIComponent(req.params.id)}/evidence`, req.body ?? {})), app.post(`/api/${pillar}/scans/:id/stop`, async (req, reply) => proxyControlPlane(req, reply, `/v1/scans/${encodeURIComponent(req.params.id)}/cancel`, {})), app.post(`/api/${pillar}/scans/:id/retry`, async (req, reply) => proxyControlPlane(req, reply, `/v1/scans/${encodeURIComponent(req.params.id)}/retry`, {}));
+  app.post("/api/benchmark/evidence/generate", async (req, reply) => {
     let generator = req.body?.generator, count = Math.min(20, Math.max(1, Math.trunc(req.body?.count ?? 4))), brief = req.body?.brief?.trim();
     if (!generator?.model?.trim() || !generator.apiKey?.trim())
       return reply.code(400).send({ error: "Configure the evidence-generator model and API key." });
@@ -12285,7 +12487,7 @@ ${existing.length ? existing.join(`
       (run?.status === "CANCELLED" || run?.status === "FAILED") && store.releaseBenchmarkEntitlement(workspaceId, entitlement.id, entitlement.reservationKey);
     }
   };
-  app2.get("/api/benchmark/entitlements", async () => {
+  app.get("/api/benchmark/entitlements", async () => {
     let workspaceId = benchmarkWorkspaceId();
     ensureFreeFastBenchmarkEntitlement(), reconcileTerminalBenchmarkReservations(workspaceId);
     let entitlements = store.listBenchmarkEntitlements(workspaceId);
@@ -12297,7 +12499,7 @@ ${existing.length ? existing.join(`
       pricingPolicy: benchmarkPricingPolicy,
       purchase: { verification: "SERVER_REQUIRED", clientPaidFlagsAccepted: !1 }
     };
-  }), app2.post("/api/benchmark/purchases/verify", async (req, reply) => {
+  }), app.post("/api/benchmark/purchases/verify", async (req, reply) => {
     let receipt = req.body?.receipt?.trim(), idempotencyKey = req.body?.idempotencyKey?.trim();
     return !receipt || receipt.length > 65536 || !idempotencyKey || idempotencyKey.length > 120 ? reply.code(400).send({ error: "A bounded purchase receipt and idempotency key are required." }) : proxyControlPlane(req, reply, "/v1/benchmark/purchases/verify", { ...req.body, receipt, idempotencyKey, projectId: PROOFLANE_PROJECT }, "POST", (payload) => {
       let response = payload, entitlement = response?.entitlement;
@@ -12305,7 +12507,7 @@ ${existing.length ? existing.join(`
         throw new Error("Prooflane returned an invalid Benchmark purchase entitlement.");
       store.saveBenchmarkEntitlement(entitlement);
     });
-  }), app2.post("/api/benchmark/plans", async (req, reply) => {
+  }), app.post("/api/benchmark/plans", async (req, reply) => {
     if (intelligenceMode === "hosted")
       return proxyControlPlane(req, reply, "/v1/benchmark/plans", req.body ?? {});
     let body = req.body ?? {}, objective = body.objective?.trim(), targetType = body.targetType, mode = body.mode, targets = body.targets;
@@ -12402,7 +12604,7 @@ ${existing.length ? existing.join(`
       let message2 = error instanceof Error ? error.message : String(error), status = error instanceof ControlPlaneRequestError ? error.status : /allowance|locked|not enabled/i.test(message2) ? 403 : 502;
       return reply.code(status).send({ error: status < 500 ? message2 : publicIntelligenceGenerationError(message2) });
     }
-  }), app2.post("/api/benchmark/run", async (req, reply) => {
+  }), app.post("/api/benchmark/run", async (req, reply) => {
     let suppliedCandidates = req.body?.candidates, workflowPlan = req.body?.plan, suppliedCases = req.body?.cases;
     if (!Array.isArray(suppliedCandidates) || suppliedCandidates.length < 2 || suppliedCandidates.length > 8)
       return reply.code(400).send({ error: "Choose between 2 and 8 benchmark candidates." });
@@ -12614,16 +12816,16 @@ ${existing.length ? existing.join(`
     } finally {
       keys.clear(), prices.clear();
     }
-  }), app2.get("/api/benchmark/history", async (req) => {
+  }), app.get("/api/benchmark/history", async (req) => {
     let limit = Math.max(1, Math.min(100, Number(req.query.limit) || 25));
-    return { runs: store.listBenchmarkRuns(benchmarkWorkspaceId(), limit).map((record6) => ({ runId: record6.runId, status: record6.status, planId: record6.plan.planId, planVersion: record6.plan.version, objective: record6.plan.objective, mode: record6.plan.mode, targetType: record6.plan.targetType, summary: record6.summary, createdAt: record6.createdAt, updatedAt: record6.updatedAt })) };
-  }), app2.get("/api/benchmark/runs/:id", async (req, reply) => {
-    let record6 = store.getBenchmarkRun(req.params.id);
-    return !record6 || record6.workspaceId !== benchmarkWorkspaceId() ? reply.code(404).send({ error: "Benchmark Run not found." }) : { run: record6 };
-  }), app2.get("/api/benchmark/runs/:id/report.html", async (req, reply) => {
-    let record6 = store.getBenchmarkRun(req.params.id);
-    return !record6 || record6.workspaceId !== benchmarkWorkspaceId() || !record6.reportHtml ? reply.code(404).send({ error: "Benchmark HTML report not found." }) : (reply.header("Content-Disposition", `attachment; filename="benchmark-report-${record6.runId}.html"`), reply.type("text/html; charset=utf-8"), record6.reportHtml);
-  }), app2.post("/api/intelligence/execute", async (req, reply) => {
+    return { runs: store.listBenchmarkRuns(benchmarkWorkspaceId(), limit).map((record7) => ({ runId: record7.runId, status: record7.status, planId: record7.plan.planId, planVersion: record7.plan.version, objective: record7.plan.objective, mode: record7.plan.mode, targetType: record7.plan.targetType, summary: record7.summary, createdAt: record7.createdAt, updatedAt: record7.updatedAt })) };
+  }), app.get("/api/benchmark/runs/:id", async (req, reply) => {
+    let record7 = store.getBenchmarkRun(req.params.id);
+    return !record7 || record7.workspaceId !== benchmarkWorkspaceId() ? reply.code(404).send({ error: "Benchmark Run not found." }) : { run: record7 };
+  }), app.get("/api/benchmark/runs/:id/report.html", async (req, reply) => {
+    let record7 = store.getBenchmarkRun(req.params.id);
+    return !record7 || record7.workspaceId !== benchmarkWorkspaceId() || !record7.reportHtml ? reply.code(404).send({ error: "Benchmark HTML report not found." }) : (reply.header("Content-Disposition", `attachment; filename="benchmark-report-${record7.runId}.html"`), reply.type("text/html; charset=utf-8"), record7.reportHtml);
+  }), app.post("/api/intelligence/execute", async (req, reply) => {
     if (!req.body?.lease)
       return reply.code(400).send({ ok: !1, error: "A hosted Intelligence lease is required." });
     let claims;
@@ -12891,10 +13093,10 @@ ${answer}`
       severity: scanSeverity ?? (evidence.outcome === "fail" ? "high" : void 0)
     } : void 0) ?? evidence, privacy: { rawDataSent: !1, next: "Submit this envelope with the original lease to the hosted Control Plane." } };
   });
-  let tagsFile = () => join4(process.cwd(), DEFAULT_TAGS_FILE), readTagsConfig = (file) => parseTagsConfig(existsSync2(file) ? readFileSync3(file, "utf8") : ""), writeTagsConfig = (file, config) => {
-    mkdirSync2(dirname4(file), { recursive: !0 }), writeFileSync(file, serializeTagsConfig(config));
+  let tagsFile = () => join5(process.cwd(), DEFAULT_TAGS_FILE), readTagsConfig = (file) => parseTagsConfig(existsSync3(file) ? readFileSync4(file, "utf8") : ""), writeTagsConfig = (file, config) => {
+    mkdirSync3(dirname4(file), { recursive: !0 }), writeFileSync2(file, serializeTagsConfig(config));
   };
-  app2.get("/api/tags", async () => ({ ok: !0, path: DEFAULT_TAGS_FILE, config: readTagsConfig(tagsFile()) })), app2.post("/api/tags", async (req, reply) => {
+  app.get("/api/tags", async () => ({ ok: !0, path: DEFAULT_TAGS_FILE, config: readTagsConfig(tagsFile()) })), app.post("/api/tags", async (req, reply) => {
     let plan = await resolvePlan(req);
     if (!plan.gates)
       return reply.code(402).send({ ok: !1, upgrade: !0, feature: "gates", tier: plan.tier, error: "CI gates are part of the Scale plan. Upgrade to capture tagged tests for CI." });
@@ -12903,31 +13105,31 @@ ${answer}`
       return reply.code(400).send({ ok: !1, error: "A valid tagged test (id, pillar, tags[]) is required." });
     let file = tagsFile(), next = upsertTest(readTagsConfig(file), { ...test, createdAt: test.createdAt || (/* @__PURE__ */ new Date()).toISOString() });
     return writeTagsConfig(file, next), { ok: !0, path: DEFAULT_TAGS_FILE, config: next };
-  }), app2.delete("/api/tags/:id", async (req, reply) => {
+  }), app.delete("/api/tags/:id", async (req, reply) => {
     let plan = await resolvePlan(req);
     if (!plan.gates)
       return reply.code(402).send({ ok: !1, upgrade: !0, feature: "gates", tier: plan.tier, error: "CI gates are part of the Scale plan." });
     let file = tagsFile(), next = removeTest(readTagsConfig(file), req.params.id);
     return writeTagsConfig(file, next), { ok: !0, path: DEFAULT_TAGS_FILE, config: next };
   });
-  let gatesPath = () => join4(process.cwd(), ".prooflane/gates.json"), validLegacyRegressionGroup = (value) => {
+  let gatesPath = () => join5(process.cwd(), ".prooflane/gates.json"), validLegacyRegressionGroup = (value) => {
     if (!value || typeof value != "object" || Array.isArray(value))
       return !1;
     let gate = value;
     return typeof gate.id == "string" && /^[a-z0-9][a-z0-9_-]{1,63}$/.test(gate.id) && typeof gate.name == "string" && gate.name.trim().length >= 2 && gate.name.length <= 80 && Array.isArray(gate.tags) && gate.tags.length > 0 && gate.tags.length <= 50 && gate.tags.every((tag2) => typeof tag2 == "string" && /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,63}$/.test(tag2)) && typeof gate.minScore == "number" && Number.isFinite(gate.minScore) && gate.minScore >= 0 && gate.minScore <= 100 && typeof gate.repeat == "number" && Number.isInteger(gate.repeat) && gate.repeat >= 1 && gate.repeat <= 10 && typeof gate.deterministicOnly == "boolean" && typeof gate.createdAt == "string" && Number.isFinite(Date.parse(gate.createdAt)) && typeof gate.updatedAt == "string" && Number.isFinite(Date.parse(gate.updatedAt));
   }, readLegacyRegressionGroups = () => {
     try {
-      let parsed = JSON.parse(readFileSync3(gatesPath(), "utf8"));
+      let parsed = JSON.parse(readFileSync4(gatesPath(), "utf8"));
       return parsed.version === "prooflane-gates-v1" && Array.isArray(parsed.gates) ? parsed.gates.filter(validLegacyRegressionGroup) : [];
     } catch {
       return [];
     }
   }, writeLegacyRegressionGroups = (gates) => {
     let file = gatesPath();
-    mkdirSync2(dirname4(file), { recursive: !0 }), writeFileSync(file, JSON.stringify({ version: "prooflane-gates-v1", gates }, null, 2) + `
+    mkdirSync3(dirname4(file), { recursive: !0 }), writeFileSync2(file, JSON.stringify({ version: "prooflane-gates-v1", gates }, null, 2) + `
 `, "utf8");
   };
-  app2.get("/api/gates", async () => ({ ok: !0, path: ".prooflane/gates.json", gates: readLegacyRegressionGroups() })), app2.put("/api/gates/:id", async (req, reply) => {
+  app.get("/api/gates", async () => ({ ok: !0, path: ".prooflane/gates.json", gates: readLegacyRegressionGroups() })), app.put("/api/gates/:id", async (req, reply) => {
     let plan = await resolvePlan(req);
     if (!plan.gates)
       return reply.code(402).send({ ok: !1, upgrade: !0, feature: "gates", tier: plan.tier, error: "Legacy local regression groups are part of the Scale plan." });
@@ -12935,7 +13137,7 @@ ${answer}`
       return reply.code(400).send({ ok: !1, error: "A valid legacy local regression group with at least one tag is required." });
     let current = readLegacyRegressionGroups(), existing = current.find((gate2) => gate2.id === req.params.id), gate = { ...req.body.gate, createdAt: existing?.createdAt ?? req.body.gate.createdAt }, next = [...current.filter((item) => item.id !== gate.id), gate].sort((a, b) => a.name.localeCompare(b.name));
     return writeLegacyRegressionGroups(next), { ok: !0, path: ".prooflane/gates.json", gate, gates: next };
-  }), app2.delete("/api/gates/:id", async (req, reply) => {
+  }), app.delete("/api/gates/:id", async (req, reply) => {
     let plan = await resolvePlan(req);
     if (!plan.gates)
       return reply.code(402).send({ ok: !1, upgrade: !0, feature: "gates", tier: plan.tier, error: "Legacy local regression groups are part of the Scale plan." });
@@ -12967,7 +13169,7 @@ ${answer}`
       throw new Error("Connected MCP runtime was not registered.");
     return runtime.setToolLimit?.(plan.tools), svc = runtime, activeMcpConnectionId = result.connection.id, activeMcpAuthMode = authModeFor(connection), result;
   }
-  app2.post("/api/connect", async (req, reply) => {
+  app.post("/api/connect", async (req, reply) => {
     try {
       let disconnected = mcpManager.listConnections(PROOFLANE_PROJECT).filter((connection) => connection.status === "DISCONNECTED");
       if (!activeMcpConnectionId && disconnected.length === 1) {
@@ -12979,21 +13181,21 @@ ${answer}`
     } catch (error) {
       return sendMcpError(reply, error);
     }
-  }), app2.get("/api/mcp/connections", async (req) => {
+  }), app.get("/api/mcp/connections", async (req) => {
     let entitlement = mcpEntitlementForPlan(await resolvePlan(req)), connections = mcpManager.reconcileEntitlement(PROOFLANE_PROJECT, entitlement);
     return {
       connections,
       entitlement,
       usage: { current: connections.length, allowed: entitlement.maxConnections }
     };
-  }), app2.post("/api/mcp/connections", async (req, reply) => {
+  }), app.post("/api/mcp/connections", async (req, reply) => {
     try {
       let result = await connectMcp(req, req.body.connection, req.body.displayName ?? req.body.name);
       return reply.code(201).send({ ok: !0, ...result });
     } catch (error) {
       return sendMcpError(reply, error);
     }
-  }), app2.post("/api/mcp/connections/:id/reconnect", async (req, reply) => {
+  }), app.post("/api/mcp/connections/:id/reconnect", async (req, reply) => {
     try {
       let plan = await resolvePlan(req);
       mcpManager.reconcileEntitlement(PROOFLANE_PROJECT, mcpEntitlementForPlan(plan));
@@ -13005,7 +13207,7 @@ ${answer}`
     } catch (error) {
       return sendMcpError(reply, error);
     }
-  }), app2.post("/api/mcp/connections/:id/activate", async (req, reply) => {
+  }), app.post("/api/mcp/connections/:id/activate", async (req, reply) => {
     try {
       let plan = await resolvePlan(req);
       mcpManager.reconcileEntitlement(PROOFLANE_PROJECT, mcpEntitlementForPlan(plan));
@@ -13021,32 +13223,32 @@ ${answer}`
     } catch (error) {
       return sendMcpError(reply, error);
     }
-  }), app2.post("/api/mcp/connections/:id/refresh", async (req, reply) => {
+  }), app.post("/api/mcp/connections/:id/refresh", async (req, reply) => {
     try {
       let plan = await resolvePlan(req);
       return mcpManager.reconcileEntitlement(PROOFLANE_PROJECT, mcpEntitlementForPlan(plan)), { ok: !0, tools: await mcpManager.refreshTools(PROOFLANE_PROJECT, req.params.id, await requestActor(req)), connection: mcpManager.getConnection(PROOFLANE_PROJECT, req.params.id) };
     } catch (error) {
       return sendMcpError(reply, error);
     }
-  }), app2.post("/api/mcp/connections/:id/disconnect", async (req, reply) => {
+  }), app.post("/api/mcp/connections/:id/disconnect", async (req, reply) => {
     try {
       return await mcpManager.disconnectConnection(PROOFLANE_PROJECT, req.params.id, await requestActor(req)), activeMcpConnectionId === req.params.id && (activeMcpConnectionId = null, activeMcpAuthMode = "unknown", svc = new InspectorService(store)), { ok: !0 };
     } catch (error) {
       return sendMcpError(reply, error);
     }
-  }), app2.delete("/api/mcp/connections/:id", async (req, reply) => {
+  }), app.delete("/api/mcp/connections/:id", async (req, reply) => {
     try {
       return await mcpManager.removeConnection(PROOFLANE_PROJECT, req.params.id, await requestActor(req)), activeMcpConnectionId === req.params.id && (activeMcpConnectionId = null, activeMcpAuthMode = "unknown", svc = new InspectorService(store)), { ok: !0 };
     } catch (error) {
       return sendMcpError(reply, error);
     }
-  }), app2.get("/api/mcp/tools", async (req) => {
+  }), app.get("/api/mcp/tools", async (req) => {
     let entitlement = mcpEntitlementForPlan(await resolvePlan(req));
     return mcpManager.reconcileEntitlement(PROOFLANE_PROJECT, entitlement), { tools: mcpManager.listTools(PROOFLANE_PROJECT, req.query.connectionId) };
-  }), app2.get("/api/features/:featureType/:resourceId/mcp-binding", async (req, reply) => {
+  }), app.get("/api/features/:featureType/:resourceId/mcp-binding", async (req, reply) => {
     let featureType = parseFeatureType(req.params.featureType);
     return !featureType || !validResourceId(req.params.resourceId) ? reply.code(400).send({ error: "A valid MCP feature type and resource ID are required." }) : { binding: mcpManager.getBinding(PROOFLANE_PROJECT, featureType, req.params.resourceId) };
-  }), app2.put("/api/features/:featureType/:resourceId/mcp-binding", async (req, reply) => {
+  }), app.put("/api/features/:featureType/:resourceId/mcp-binding", async (req, reply) => {
     let featureType = parseFeatureType(req.params.featureType);
     if (!featureType || !validResourceId(req.params.resourceId))
       return reply.code(400).send({ error: "A valid MCP feature type and resource ID are required." });
@@ -13072,10 +13274,10 @@ ${answer}`
     } catch (error) {
       return sendMcpError(reply, error);
     }
-  }), app2.delete("/api/features/:featureType/:resourceId/mcp-binding", async (req, reply) => {
+  }), app.delete("/api/features/:featureType/:resourceId/mcp-binding", async (req, reply) => {
     let featureType = parseFeatureType(req.params.featureType);
     return !featureType || !validResourceId(req.params.resourceId) ? reply.code(400).send({ error: "A valid MCP feature type and resource ID are required." }) : { ok: mcpManager.deleteBinding(PROOFLANE_PROJECT, featureType, req.params.resourceId, await requestActor(req)) };
-  }), app2.post("/api/features/:featureType/:resourceId/mcp-runs", async (req, reply) => {
+  }), app.post("/api/features/:featureType/:resourceId/mcp-runs", async (req, reply) => {
     let featureType = parseFeatureType(req.params.featureType);
     if (!featureType || !validResourceId(req.params.resourceId))
       return reply.code(400).send({ error: "A valid MCP feature type and resource ID are required." });
@@ -13087,10 +13289,10 @@ ${answer}`
     } catch (error) {
       return sendMcpError(reply, error);
     }
-  }), app2.get("/api/mcp/runs/:runId", async (req, reply) => {
+  }), app.get("/api/mcp/runs/:runId", async (req, reply) => {
     let snapshot = mcpManager.getRunSnapshot(PROOFLANE_PROJECT, req.params.runId);
     return snapshot ? { snapshot } : reply.code(404).send({ error: "MCP run snapshot was not found." });
-  }), app2.post("/api/mcp/runs/:runId/invoke", async (req, reply) => {
+  }), app.post("/api/mcp/runs/:runId/invoke", async (req, reply) => {
     let controller = new AbortController(), cancel = () => controller.abort();
     req.raw.once("aborted", cancel);
     try {
@@ -13105,12 +13307,12 @@ ${answer}`
     } finally {
       req.raw.off("aborted", cancel);
     }
-  }), app2.get("/api/mcp/audit", async (req) => ({
+  }), app.get("/api/mcp/audit", async (req) => ({
     events: mcpManager.listAuditEvents(PROOFLANE_PROJECT, Number(req.query.limit ?? 100))
-  })), app2.get("/api/capabilities", async () => {
+  })), app.get("/api/capabilities", async () => {
     let capabilities = svc.getCapabilities(), searchable = capabilities ? JSON.stringify(capabilities).toLowerCase() : "", tools = capabilities?.tools ?? [], resources = capabilities?.resources ?? [], rag = tools.some((tool) => /rag|retriev|search|knowledge|vector|semantic/.test(`${tool.name} ${tool.description ?? ""}`.toLowerCase())) || resources.some((resource) => /knowledge|document|vector|search|rag/.test(`${resource.uri} ${resource.name ?? ""} ${resource.description ?? ""}`.toLowerCase())), notableTools = tools.filter((tool) => /create|update|write|delete|remove|execute|admin|push|merge|dispatch|upload/.test(`${tool.name} ${tool.description ?? ""}`.toLowerCase())).map((tool) => tool.name), sensitivitySignals = [...new Set((searchable.match(/email|phone|address|ssn|personal|secret|token|password|api[_ -]?key|user[_ -]?id|account[_ -]?id/g) ?? []).slice(0, 8))];
     return { connected: svc.isConnected(), connectionId: activeMcpConnectionId, capabilities, discovery: { toolCount: tools.length, auth: { mode: activeMcpAuthMode, status: activeMcpAuthMode === "unknown" ? "UNKNOWN" : "OBSERVED" }, rag: { present: rag, status: rag ? "OBSERVED" : "NOT_OBSERVED" }, notable: { tools: notableTools, status: notableTools.length ? "CLASSIFIED" : "NONE_CLASSIFIED" }, sensitivity: { signals: sensitivitySignals, status: sensitivitySignals.length ? "INFERRED" : "NOT_INFERRED" } } };
-  }), app2.post("/api/connect/oauth/start", async (req, reply) => {
+  }), app.post("/api/connect/oauth/start", async (req, reply) => {
     let { url, name } = req.body, plan = await resolvePlan(req), entitlement = mcpEntitlementForPlan(plan), actor = await requestActor(req);
     try {
       mcpManager.assertCanAddMcpConnection(PROOFLANE_PROJECT, entitlement);
@@ -13124,7 +13326,7 @@ ${answer}`
       let capabilities = await candidate.adoptConnection(flow.transport, name, origin), registered = mcpManager.registerConnectedRuntime({ workspaceId: PROOFLANE_PROJECT, displayName: name ?? "MCP Server", config: origin, createdBy: actor, entitlement, authMode: "oauth" }, candidate, capabilities);
       return svc = candidate, activeMcpConnectionId = registered.connection.id, activeMcpAuthMode = "oauth", { status: "connected", capabilities, connection: registered.connection };
     }
-    let flowId = randomUUID7();
+    let flowId = randomUUID8();
     return oauthFlows.set(flowId, { status: "pending" }), flow.finish().then((transport) => candidate.adoptConnection(transport, name, origin)).then((capabilities) => {
       let registered = mcpManager.registerConnectedRuntime({ workspaceId: PROOFLANE_PROJECT, displayName: name ?? "MCP Server", config: origin, createdBy: actor, entitlement, authMode: "oauth" }, candidate, capabilities);
       svc = candidate, activeMcpConnectionId = registered.connection.id, activeMcpAuthMode = "oauth", oauthFlows.set(flowId, { status: "connected", capabilities });
@@ -13137,10 +13339,10 @@ ${answer}`
       authUrl: flow.authUrl,
       redirectUri: flow.redirectUri
     };
-  }), app2.get("/api/connect/oauth/status", async (req) => {
+  }), app.get("/api/connect/oauth/status", async (req) => {
     let rec = oauthFlows.get(req.query.flowId);
     return rec || { status: "error", error: "Unknown flow." };
-  }), app2.post("/api/disconnect", async () => (activeMcpConnectionId ? await mcpManager.disconnectConnection(PROOFLANE_PROJECT, activeMcpConnectionId, "local-user") : await svc.disconnect(), activeMcpConnectionId = null, activeMcpAuthMode = "unknown", svc = new InspectorService(store), { ok: !0 })), app2.post("/api/tools/:name/call", async (req) => svc.callTool(req.params.name, req.body?.input ?? {})), app2.post("/api/tools/:name/snapshot", async (req) => svc.snapshotTool(req.params.name, req.body?.input ?? {})), app2.post("/api/security/verify-capability", async (req, reply) => {
+  }), app.post("/api/disconnect", async () => (activeMcpConnectionId ? await mcpManager.disconnectConnection(PROOFLANE_PROJECT, activeMcpConnectionId, "local-user") : await svc.disconnect(), activeMcpConnectionId = null, activeMcpAuthMode = "unknown", svc = new InspectorService(store), { ok: !0 })), app.post("/api/tools/:name/call", async (req) => svc.callTool(req.params.name, req.body?.input ?? {})), app.post("/api/tools/:name/snapshot", async (req) => svc.snapshotTool(req.params.name, req.body?.input ?? {})), app.post("/api/security/verify-capability", async (req, reply) => {
     let toolName = typeof req.body?.toolName == "string" ? req.body.toolName : "";
     if (!toolName)
       return reply.code(400).send({ error: "toolName is required." });
@@ -13193,19 +13395,19 @@ ${answer}`
     } catch (error) {
       return error instanceof ExecutionGateError ? reply.code(400).send({ error: error.message }) : reply.code(500).send({ error: error instanceof Error ? error.message : "Capability verification failed." });
     }
-  }), app2.post("/api/diff/snapshot", async (req) => svc.diffAgainst(req.body.snapshot)), app2.post("/api/diff/values", async (req) => diffTool(req.body.tool, req.body.expected, req.body.actual)), app2.post("/api/resources/read", async (req) => svc.readResource(req.body.uri)), app2.post("/api/prompts/:name/get", async (req) => svc.getPrompt(req.params.name, req.body?.args)), app2.post("/api/drift", async (req) => {
+  }), app.post("/api/diff/snapshot", async (req) => svc.diffAgainst(req.body.snapshot)), app.post("/api/diff/values", async (req) => diffTool(req.body.tool, req.body.expected, req.body.actual)), app.post("/api/resources/read", async (req) => svc.readResource(req.body.uri)), app.post("/api/prompts/:name/get", async (req) => svc.getPrompt(req.params.name, req.body?.args)), app.post("/api/drift", async (req) => {
     let current = svc.getCapabilities();
     if (!current)
       throw new Error("Not connected.");
     return detectCapabilityDrift(req.body.baseline, current);
-  }), app2.post("/api/record/start", async (req) => (svc.startRecording(req.body?.label), { ok: !0, recording: !0 })), app2.get("/api/record/status", async () => ({ recording: svc.isRecording() })), app2.post("/api/record/stop", async () => svc.stopRecording()), app2.get("/api/sessions", async () => svc.listSessions()), app2.get("/api/sessions/:id", async (req) => {
+  }), app.post("/api/record/start", async (req) => (svc.startRecording(req.body?.label), { ok: !0, recording: !0 })), app.get("/api/record/status", async () => ({ recording: svc.isRecording() })), app.post("/api/record/stop", async () => svc.stopRecording()), app.get("/api/sessions", async () => svc.listSessions()), app.get("/api/sessions/:id", async (req) => {
     let session = svc.getSession(req.params.id);
     if (!session)
       throw new Error(`Session not found: ${req.params.id}`);
     return session;
-  }), app2.post("/api/sessions/:id/golden", async (req) => (svc.markGolden(req.params.id, req.body?.golden ?? !0), { ok: !0 })), app2.post("/api/sessions/:id/automate", async (req) => svc.automate(req.params.id, req.body.format)), app2.post("/api/sessions/:id/fault", async (req) => svc.injectFault(req.params.id, req.body.step, req.body.type));
+  }), app.post("/api/sessions/:id/golden", async (req) => (svc.markGolden(req.params.id, req.body?.golden ?? !0), { ok: !0 })), app.post("/api/sessions/:id/automate", async (req) => svc.automate(req.params.id, req.body.format)), app.post("/api/sessions/:id/fault", async (req) => svc.injectFault(req.params.id, req.body.step, req.body.type));
   let HTTP_TIMEOUT_MS = 3e4, HTTP_BODY_CAP = 2e6;
-  app2.post("/api/http/request", async (req) => {
+  app.post("/api/http/request", async (req) => {
     let { method, url, headers, body } = req.body, start = Date.now(), controller = new AbortController(), timer = setTimeout(() => controller.abort(), HTTP_TIMEOUT_MS), hasBody = !["GET", "HEAD"].includes(method.toUpperCase());
     try {
       let res = await fetch(url, {
@@ -13236,9 +13438,9 @@ ${answer}`
     } finally {
       clearTimeout(timer);
     }
-  }), app2.post("/api/http/snapshot", async (req) => svc.saveHttpSnapshot(req.body.request, req.body.response, req.body.origin ?? "captured")), app2.get("/api/snapshots", async () => svc.listSnapshots()), app2.patch("/api/snapshots/:id", async (req, reply) => svc.updateSnapshot(req.params.id, req.body) ? { ok: !0 } : reply.code(404).send({ ok: !1, error: "Contract not found." })), app2.delete("/api/snapshots/:id", async (req) => (svc.deleteSnapshot(req.params.id), { ok: !0 })), app2.post("/api/automate/contracts", async (req) => svc.automateSnapshots(req.body.snapshotIds, req.body.format)), app2.post("/api/prompts/generate", async (req) => ({
+  }), app.post("/api/http/snapshot", async (req) => svc.saveHttpSnapshot(req.body.request, req.body.response, req.body.origin ?? "captured")), app.get("/api/snapshots", async () => svc.listSnapshots()), app.patch("/api/snapshots/:id", async (req, reply) => svc.updateSnapshot(req.params.id, req.body) ? { ok: !0 } : reply.code(404).send({ ok: !1, error: "Contract not found." })), app.delete("/api/snapshots/:id", async (req) => (svc.deleteSnapshot(req.params.id), { ok: !0 })), app.post("/api/automate/contracts", async (req) => svc.automateSnapshots(req.body.snapshotIds, req.body.format)), app.post("/api/prompts/generate", async (req) => ({
     prompts: svc.generatePromptsForTool(req.body.tool)
-  })), app2.get("/api/prompts/custom", async () => svc.listCustomPrompts()), app2.post("/api/llm/run", async (req) => callLlm(req.body)), app2.post("/api/prompts/run-agent", async (req, reply) => {
+  })), app.get("/api/prompts/custom", async () => svc.listCustomPrompts()), app.post("/api/llm/run", async (req) => callLlm(req.body)), app.post("/api/prompts/run-agent", async (req, reply) => {
     let { tool, prompt, llm } = req.body, t = svc.getCapabilities()?.tools.find((x) => x.name === tool);
     return t ? runAgent({
       ...llm,
@@ -13249,7 +13451,7 @@ ${answer}`
         return { output: r.output, isError: r.isError };
       }
     }) : reply.code(400).send({ ok: !1, toolCalls: [], error: `Tool "${tool}" isn't on the current connection \u2014 connect first.`, latencyMs: 0 });
-  }), app2.post("/api/rag/hosted-run", async (req, reply) => {
+  }), app.post("/api/rag/hosted-run", async (req, reply) => {
     let cases = Array.isArray(req.body?.cases) ? req.body.cases.filter((candidate) => candidate && typeof candidate.id == "string" && hostedRagCaseQuery(candidate).trim()) : [], capabilities = svc.getCapabilities();
     if (!capabilities)
       return reply.code(400).send({ ok: !1, error: "Connect to an MCP server first \u2014 RAG Assurance runs against its retrieval tools." });
@@ -13406,7 +13608,7 @@ ${answer}`
     if (req.body.recordHistory === !1)
       return finish({ ok: !0, report, hostedScan });
     let previous = (() => {
-      let last = svc.listRuns(500).find((record6) => record6.pillar === "rag" && record6.evidence);
+      let last = svc.listRuns(500).find((record7) => record7.pillar === "rag" && record7.evidence);
       if (!last?.evidence)
         return null;
       try {
@@ -13432,11 +13634,11 @@ ${answer}`
       evidence: JSON.stringify(mcpSnapshot ? { ...snapshot, mcp: mcpSnapshot.mcp, hostedScanId: hostedScan.id } : { ...snapshot, hostedScanId: hostedScan.id })
     }), diff = previous ? hostedRagScoreDiff(previous, snapshot) : void 0;
     return finish({ ok: !0, report, diff, run, hostedScan });
-  }), app2.get("/api/rag/hosted-diff/:id", async (req, reply) => {
-    let runs = svc.listRuns(1e3).filter((record6) => record6.pillar === "rag"), index = runs.findIndex((record6) => record6.id === req.params.id);
+  }), app.get("/api/rag/hosted-diff/:id", async (req, reply) => {
+    let runs = svc.listRuns(1e3).filter((record7) => record7.pillar === "rag"), index = runs.findIndex((record7) => record7.id === req.params.id);
     if (index === -1)
       return reply.code(404).send({ ok: !1, error: "Run not found." });
-    let current = runs[index], previous = runs.slice(index + 1).find((record6) => record6.evidence);
+    let current = runs[index], previous = runs.slice(index + 1).find((record7) => record7.evidence);
     if (!current.evidence || !previous?.evidence)
       return { ok: !0, diff: null };
     try {
@@ -13472,7 +13674,7 @@ ${answer}`
       durationMs
     });
   }
-  app2.post("/api/perf/run", async (req, reply) => {
+  app.post("/api/perf/run", async (req, reply) => {
     let { target, vus, durationS, targetMs } = req.body;
     if (vus > 5) {
       let plan = await resolvePlan(req);
@@ -13513,7 +13715,7 @@ ${answer}`
       };
     let metrics = await runLoadTest({ fire, vus: cappedVus, durationMs, targetMs });
     return mcpSnapshot ? { ok: !0, ...metrics, mcpSnapshot, mcpFact: recordBoundMcpFact(mcpSnapshot, metrics.errors === 0) } : { ok: !0, ...metrics };
-  }), app2.post("/api/prompts/generate-ai", async (req, reply) => {
+  }), app.post("/api/prompts/generate-ai", async (req, reply) => {
     let plan = await resolvePlan(req);
     if (!plan.hosted)
       return reply.code(402).send({
@@ -13542,17 +13744,17 @@ Cover a mix of: positive (valid, useful requests), negative (misuse \u2014 missi
       skipped: parsed.length - saved.length,
       tokens: (res.usage?.inputTokens ?? 0) + (res.usage?.outputTokens ?? 0)
     };
-  }), app2.post("/api/prompts/custom/:id/golden", async (req) => (svc.setPromptGolden(req.params.id, req.body.expected, req.body.assert ?? "similar"), { ok: !0 })), app2.post("/api/prompts/custom/:id/checks", async (req) => (svc.setPromptChecks(req.params.id, {
+  }), app.post("/api/prompts/custom/:id/golden", async (req) => (svc.setPromptGolden(req.params.id, req.body.expected, req.body.assert ?? "similar"), { ok: !0 })), app.post("/api/prompts/custom/:id/checks", async (req) => (svc.setPromptChecks(req.params.id, {
     input: req.body.input,
     assertions: req.body.assertions,
     checkSchema: req.body.checkSchema
-  }), { ok: !0 })), app2.post("/api/prompts/assert", async (req, reply) => {
+  }), { ok: !0 })), app.post("/api/prompts/assert", async (req, reply) => {
     try {
       return { ok: !0, ...await svc.assertTool(req.body.tool, req.body.input ?? {}, req.body.assertions ?? [], req.body.checkSchema ?? !1) };
     } catch (e) {
       return reply.code(400).send({ ok: !1, error: e instanceof Error ? e.message : String(e) });
     }
-  }), app2.post("/api/prompts/custom", async (req, reply) => {
+  }), app.post("/api/prompts/custom", async (req, reply) => {
     let plan = await resolvePlan(req);
     return !isUnlimited(plan.prompts) && svc.listCustomPrompts().length >= plan.prompts ? reply.code(402).send({
       ok: !1,
@@ -13562,7 +13764,7 @@ Cover a mix of: positive (valid, useful requests), negative (misuse \u2014 missi
       limit: plan.prompts,
       error: `Your ${plan.label} plan stores up to ${plan.prompts} test prompts. Delete one or upgrade to add more.`
     }) : svc.addCustomPrompt(req.body.name, req.body.content, req.body.tool);
-  }), app2.patch("/api/prompts/custom/:id", async (req) => (svc.updateCustomPrompt(req.params.id, req.body), { ok: !0 })), app2.delete("/api/prompts/custom/:id", async (req) => (svc.deleteCustomPrompt(req.params.id), { ok: !0 })), app2.post("/api/prompts/generate-cases", async (req, reply) => {
+  }), app.patch("/api/prompts/custom/:id", async (req) => (svc.updateCustomPrompt(req.params.id, req.body), { ok: !0 })), app.delete("/api/prompts/custom/:id", async (req) => (svc.deleteCustomPrompt(req.params.id), { ok: !0 })), app.post("/api/prompts/generate-cases", async (req, reply) => {
     let plan = await resolvePlan(req);
     if (!plan.hosted)
       return reply.code(402).send({
@@ -13614,7 +13816,7 @@ Assertions must be objectively checkable against the tool's JSON response. Never
       errorKind: "hosted-generation",
       error: "The model did not return usable test cases. Retry, or choose a model that reliably follows structured-output instructions."
     });
-  }), app2.post("/api/prompts/custom/bulk", async (req, reply) => {
+  }), app.post("/api/prompts/custom/bulk", async (req, reply) => {
     let cases = (req.body?.cases ?? []).filter((c) => c && typeof c.content == "string" && c.content.trim());
     if (!cases.length)
       return reply.code(400).send({ ok: !1, error: "Select at least one reviewed case to save." });
@@ -13645,7 +13847,7 @@ Assertions must be objectively checkable against the tool's JSON response. Never
   });
   function pushStudioEvent(session, turnId, type, payload) {
     let event = {
-      id: `ev-${randomUUID7().slice(0, 8)}`,
+      id: `ev-${randomUUID8().slice(0, 8)}`,
       sessionId: session.id,
       turnId,
       sequence: ++session.sequence,
@@ -13666,9 +13868,9 @@ Assertions must be objectively checkable against the tool's JSON response. Never
     let all = svc.getCapabilities()?.tools ?? [], enabled = session.config.enabledTools;
     return enabled && enabled.length ? all.filter((t) => enabled.includes(t.name)) : all;
   };
-  app2.post("/api/prompt-studio/sessions", async (req) => {
+  app.post("/api/prompt-studio/sessions", async (req) => {
     let body = req.body ?? {}, now = (/* @__PURE__ */ new Date()).toISOString(), session = {
-      id: `ps-${randomUUID7().slice(0, 8)}`,
+      id: `ps-${randomUUID8().slice(0, 8)}`,
       name: (body.name ?? "").trim().slice(0, 120) || `Session ${(/* @__PURE__ */ new Date()).toLocaleString()}`,
       createdAt: now,
       updatedAt: now,
@@ -13697,13 +13899,13 @@ Assertions must be objectively checkable against the tool's JSON response. Never
       oldest && studioSessions.delete(oldest.id);
     }
     return { ok: !0, session: studioSummary(session), events: [] };
-  }), app2.get("/api/prompt-studio/sessions", async () => ({
+  }), app.get("/api/prompt-studio/sessions", async () => ({
     ok: !0,
     sessions: [...studioSessions.values()].sort((a, b) => b.updatedAt.localeCompare(a.updatedAt)).map(studioSummary)
-  })), app2.get("/api/prompt-studio/sessions/:id", async (req, reply) => {
+  })), app.get("/api/prompt-studio/sessions/:id", async (req, reply) => {
     let session = studioSessions.get(req.params.id);
     return session ? { ok: !0, session: studioSummary(session), events: session.events } : reply.code(404).send({ ok: !1, error: "That Prompt Studio session is no longer available." });
-  }), app2.get("/api/prompt-studio/sessions/:id/suggestions", async (req, reply) => {
+  }), app.get("/api/prompt-studio/sessions/:id/suggestions", async (req, reply) => {
     let session = studioSessions.get(req.params.id);
     if (!session)
       return reply.code(404).send({ ok: !1, error: "That Prompt Studio session is no longer available." });
@@ -13713,10 +13915,10 @@ Assertions must be objectively checkable against the tool's JSON response. Never
       observation: { prompt: observation.prompt, answer: observation.answer, toolCalls: observation.toolCalls },
       suggestions: suggestPromptTestChecks(observation)
     };
-  }), app2.delete("/api/prompt-studio/sessions/:id", async (req) => (studioSessions.delete(req.params.id), { ok: !0 })), app2.post("/api/prompt-studio/sessions/:id/stop", async (req, reply) => {
+  }), app.delete("/api/prompt-studio/sessions/:id", async (req) => (studioSessions.delete(req.params.id), { ok: !0 })), app.post("/api/prompt-studio/sessions/:id/stop", async (req, reply) => {
     let session = studioSessions.get(req.params.id);
     return session ? (session.stopRequested = !0, { ok: !0, stopping: session.running }) : reply.code(404).send({ ok: !1, error: "That Prompt Studio session is no longer available." });
-  }), app2.post("/api/prompt-studio/sessions/:id/messages", async (req, reply) => {
+  }), app.post("/api/prompt-studio/sessions/:id/messages", async (req, reply) => {
     let session = studioSessions.get(req.params.id);
     if (!session)
       return reply.code(404).send({ ok: !1, error: "That Prompt Studio session is no longer available. Start a new session." });
@@ -13795,7 +13997,7 @@ Assertions must be objectively checkable against the tool's JSON response. Never
     } finally {
       session.running = !1, session.stopRequested = !1;
     }
-  }), app2.post("/api/prompt-studio/sessions/:id/tools/:tool", async (req, reply) => {
+  }), app.post("/api/prompt-studio/sessions/:id/tools/:tool", async (req, reply) => {
     let session = studioSessions.get(req.params.id);
     if (!session)
       return reply.code(404).send({ ok: !1, error: "That Prompt Studio session is no longer available." });
@@ -13840,7 +14042,7 @@ Assertions must be objectively checkable against the tool's JSON response. Never
       let attributed = attributeError(error instanceof Error ? error.message : String(error), "tool");
       return pushStudioEvent(session, turnId, "run-failed", { tool: tool.name, error: attributed.detail, errorKind: attributed.kind }), reply.code(502).send({ ok: !1, error: attributed.detail, errorKind: attributed.kind, errorTitle: attributed.title });
     }
-  }), app2.post("/api/model-scans/run", async (req, reply) => {
+  }), app.post("/api/model-scans/run", async (req, reply) => {
     let target = req.body?.path?.trim();
     if (!target || target.length > 4096)
       return reply.code(400).send({ ok: !1, error: "A valid local model file or directory path is required." });
@@ -13852,7 +14054,7 @@ Assertions must be objectively checkable against the tool's JSON response. Never
       maxArchiveExpandedBytes: Math.round(maxArchiveMb * 1024 * 1024)
     });
     return store.saveModelScan(report), reply.header("Cache-Control", "no-store"), { ok: !0, report };
-  }), app2.get("/api/model-scans", async (req, reply) => {
+  }), app.get("/api/model-scans", async (req, reply) => {
     let limit = Math.max(1, Math.min(200, Math.trunc(Number(req.query.limit) || 25)));
     return reply.header("Cache-Control", "no-store"), store.listModelScans(limit).map((report) => ({
       scanId: report.scanId,
@@ -13863,16 +14065,16 @@ Assertions must be objectively checkable against the tool's JSON response. Never
       summary: report.summary,
       artifactIdentity: report.artifactIdentity
     }));
-  }), app2.get("/api/model-scans/:id", async (req, reply) => {
+  }), app.get("/api/model-scans/:id", async (req, reply) => {
     let report = store.getModelScan(req.params.id);
     return report ? (reply.header("Cache-Control", "no-store"), { ok: !0, report }) : reply.code(404).send({ ok: !1, error: "Model scan not found." });
-  }), app2.get("/api/model-scans/:id/export", async (req, reply) => {
+  }), app.get("/api/model-scans/:id/export", async (req, reply) => {
     let report = store.getModelScan(req.params.id);
     if (!report)
       return reply.code(404).send({ ok: !1, error: "Model scan not found." });
     let safeName = report.target.displayName.replace(/[^A-Za-z0-9._-]+/g, "-").slice(0, 100) || "model", format = String(req.query.format ?? "json").toLowerCase();
     return reply.header("Cache-Control", "no-store"), format === "html" ? (reply.type("text/html; charset=utf-8").header("Content-Disposition", `attachment; filename="${safeName}-prooflane-model-scan.html"`), reply.send(modelScanToHtml(report))) : format === "sarif" ? (reply.type("application/sarif+json").header("Content-Disposition", `attachment; filename="${safeName}-prooflane-model-scan.sarif.json"`), reply.send(JSON.stringify(modelScanToSarif(report), null, 2))) : (reply.type("application/json").header("Content-Disposition", `attachment; filename="${safeName}-prooflane-model-scan.json"`), reply.send(JSON.stringify(report, null, 2)));
-  }), app2.delete("/api/model-scans/:id", async (req, reply) => store.deleteModelScan(req.params.id) ? { ok: !0 } : reply.code(404).send({ ok: !1, error: "Model scan not found." })), app2.get("/api/model-security/packs", async (_req, reply) => (reply.header("Cache-Control", "no-store"), {
+  }), app.delete("/api/model-scans/:id", async (req, reply) => store.deleteModelScan(req.params.id) ? { ok: !0 } : reply.code(404).send({ ok: !1, error: "Model scan not found." })), app.get("/api/model-security/packs", async (_req, reply) => (reply.header("Cache-Control", "no-store"), {
     packs: MODEL_SECURITY_PACKS,
     checks: MODEL_SECURITY_RULES.map((rule) => ({
       id: rule.id,
@@ -13886,7 +14088,7 @@ Assertions must be objectively checkable against the tool's JSON response. Never
     stages: MODEL_SCAN_STAGES.map((stage) => ({ id: stage, label: MODEL_SCAN_STAGE_LABEL[stage] })),
     sourceTypes: SUPPORTED_MODEL_SOURCE_TYPES,
     evidenceClasses: MODEL_EVIDENCE_CLASSES.map((id) => ({ id, label: MODEL_EVIDENCE_LABEL[id] }))
-  })), app2.post("/api/model-security/run", async (req, reply) => {
+  })), app.post("/api/model-security/run", async (req, reply) => {
     let target = req.body?.target;
     if (!target?.sourceType || !target.source?.trim())
       return reply.code(400).send({ ok: !1, error: "A model security scan needs a target source type and source." });
@@ -13929,19 +14131,19 @@ Assertions must be objectively checkable against the tool's JSON response. Never
       let message2 = error instanceof Error ? error.message : String(error);
       return wantStream && streamOpen ? (streamWrite({ t: "done", ok: !1, error: message2 }), reply.raw.end(), reply) : reply.code(400).send({ ok: !1, error: message2 });
     }
-  }), app2.get("/api/model-security", async (req, reply) => {
+  }), app.get("/api/model-security", async (req, reply) => {
     let limit = Math.max(1, Math.min(200, Math.trunc(Number(req.query.limit) || 25)));
     return reply.header("Cache-Control", "no-store"), store.listModelSecurityScans(limit).map(modelSecuritySummary);
-  }), app2.get("/api/model-security/:id", async (req, reply) => {
+  }), app.get("/api/model-security/:id", async (req, reply) => {
     let report = store.getModelSecurityScan(req.params.id);
     return report ? (reply.header("Cache-Control", "no-store"), { ok: !0, report }) : reply.code(404).send({ ok: !1, error: "Model security scan not found." });
-  }), app2.get("/api/model-security/:id/export", async (req, reply) => {
+  }), app.get("/api/model-security/:id/export", async (req, reply) => {
     let report = store.getModelSecurityScan(req.params.id);
     if (!report)
       return reply.code(404).send({ ok: !1, error: "Model security scan not found." });
     let safeName = report.target.displayName.replace(/[^A-Za-z0-9._-]+/g, "-").slice(0, 100) || "model", format = String(req.query.format ?? "json").toLowerCase();
     return reply.header("Cache-Control", "no-store"), format === "html" ? (reply.type("text/html; charset=utf-8").header("Content-Disposition", `attachment; filename="${safeName}-model-supply-chain.html"`), reply.send(modelSecurityToHtml(report))) : format === "sarif" ? (reply.type("application/sarif+json").header("Content-Disposition", `attachment; filename="${safeName}-model-supply-chain.sarif.json"`), reply.send(JSON.stringify(modelSecurityToSarif(report), null, 2))) : (reply.type("application/json").header("Content-Disposition", `attachment; filename="${safeName}-model-supply-chain.json"`), reply.send(JSON.stringify(report, null, 2)));
-  }), app2.delete("/api/model-security/:id", async (req, reply) => store.deleteModelSecurityScan(req.params.id) ? { ok: !0 } : reply.code(404).send({ ok: !1, error: "Model security scan not found." })), app2.post("/api/runs", async (req) => svc.recordRun(req.body)), app2.get("/api/runs", async (req, reply) => {
+  }), app.delete("/api/model-security/:id", async (req, reply) => store.deleteModelSecurityScan(req.params.id) ? { ok: !0 } : reply.code(404).send({ ok: !1, error: "Model security scan not found." })), app.post("/api/runs", async (req) => svc.recordRun(req.body)), app.get("/api/runs", async (req, reply) => {
     let plan = await resolvePlan(req), requestedLimit = Number(req.query.limit), limit = Number.isFinite(requestedLimit) && requestedLimit > 0 ? Math.min(1e3, Math.trunc(requestedLimit)) : void 0;
     reply.header("Cache-Control", "no-store");
     let runs = svc.listRuns(limit);
@@ -13950,27 +14152,33 @@ Assertions must be objectively checkable against the tool's JSON response. Never
     let oldest = Date.now() - plan.historyDays * 24 * 60 * 60 * 1e3;
     return runs.filter((run) => Date.parse(run.createdAt) >= oldest);
   });
-  let uiDist = process.env.KAWACH_UI_DIST ?? join4(__dirname, "../../ui/dist");
-  return existsSync2(uiDist) && (app2.register(fastifyStatic, { root: uiDist }), app2.setNotFoundHandler((req, reply) => {
+  let uiDist = process.env.KAWACH_UI_DIST ?? join5(__dirname, "../../ui/dist");
+  return existsSync3(uiDist) && (app.register(fastifyStatic, { root: uiDist }), app.setNotFoundHandler((req, reply) => {
     if (req.url.startsWith("/api")) {
       reply.code(404).send({ error: "Not found" });
       return;
     }
     reply.sendFile("index.html");
-  })), app2.setErrorHandler((err, req, reply) => {
+  })), app.setErrorHandler((err, req, reply) => {
     let upstream = err instanceof KawachError ? err.statusCode : void 0;
     req.log.error({ err, upstream }, "Inspector request failed"), reply.code(upstream ? 502 : 500).send({ error: publicServerError(req.url), reference: req.id });
-  }), app2.addHook("onClose", async () => store.close()), app2;
+  }), app.addHook("onClose", async () => store.close()), app;
+}
+
+// ../server/dist/start.js
+var PORT = Number(process.env.KAWACH_UI_PORT ?? 7357), HOST = "127.0.0.1";
+async function startServer(options = {}) {
+  let app = buildApp();
+  options.configureApp?.(app), await app.listen({ port: PORT, host: HOST }), console.log(`Kawach Inspector UI \u2192 http://localhost:${PORT}`);
+  for (let sig of ["SIGINT", "SIGTERM"])
+    process.once(sig, () => {
+      app.close().finally(() => process.exit(0));
+    });
+  return app;
+}
+function failServerStart(error) {
+  console.error("Failed to start Kawach Inspector server:", error), process.exit(1);
 }
 
 // ../server/dist/index.js
-var PORT = Number(process.env.KAWACH_UI_PORT ?? 7357), HOST = "127.0.0.1", app = buildApp();
-app.listen({ port: PORT, host: HOST }).then(() => {
-  console.log(`Kawach Inspector UI \u2192 http://localhost:${PORT}`);
-}).catch((err) => {
-  console.error("Failed to start Kawach Inspector server:", err), process.exit(1);
-});
-for (let sig of ["SIGINT", "SIGTERM"])
-  process.on(sig, () => {
-    app.close().finally(() => process.exit(0));
-  });
+startServer().catch(failServerStart);