@prooflane/inspector-beta 0.1.0-beta.7 → 0.1.0-beta.8

package/dist/server.mjs

@@ -1099,10 +1099,10 @@ function decodeJwt(jwt) {
 }
 
 // ../server/dist/app.js
-import { createHash as createHash15, randomUUID as randomUUID7 } from "node:crypto";
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync } from "node:fs";
+import { createHash as createHash16, randomUUID as randomUUID8 } from "node:crypto";
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "node:fs";
 import { fileURLToPath } from "node:url";
-import { dirname as dirname4, join as join4, resolve as resolve5 } from "node:path";
+import { dirname as dirname4, join as join5, resolve as resolve6 } from "node:path";
 
 // ../core/dist/transport/mcpTransport.js
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
@@ -1386,9 +1386,9 @@ async function startCallbackServer(path = "/callback", port = callbackPort()) {
     res.end(PAGE("Authorized \u2713", "You can close this tab and return to Kawach Inspector.")), resolveCode(code);
   });
   try {
-    await new Promise((resolve6, reject) => {
+    await new Promise((resolve7, reject) => {
       server.once("error", reject), server.listen(port, "127.0.0.1", () => {
-        server.off("error", reject), resolve6();
+        server.off("error", reject), resolve7();
       });
     });
   } catch (err) {
@@ -1902,7 +1902,7 @@ var Store = class {
     return this.db.prepare(`UPDATE benchmark_entitlements SET state = 'AVAILABLE', reservation_key = NULL, reserved_at = NULL
        WHERE id = ? AND workspace_id = ? AND state = 'RESERVED' AND reservation_key = ?`).run(entitlementId, workspaceId, reservationKey), this.getBenchmarkEntitlement(entitlementId);
   }
-  saveBenchmarkRun(record6) {
+  saveBenchmarkRun(record7) {
     this.db.prepare(`INSERT INTO benchmark_runs
          (run_id, workspace_id, status, plan_json, summary_json, report_json, report_html, created_at, updated_at)
        VALUES (@run_id, @workspace_id, @status, @plan_json, @summary_json, @report_json, @report_html, @created_at, @updated_at)
@@ -1912,15 +1912,15 @@ var Store = class {
          report_json = excluded.report_json,
          report_html = excluded.report_html,
          updated_at = excluded.updated_at`).run({
-      run_id: record6.runId,
-      workspace_id: record6.workspaceId,
-      status: record6.status,
-      plan_json: JSON.stringify(record6.plan),
-      summary_json: record6.summary ? JSON.stringify(record6.summary) : null,
-      report_json: record6.report ? JSON.stringify(record6.report) : null,
-      report_html: record6.reportHtml ?? null,
-      created_at: record6.createdAt,
-      updated_at: record6.updatedAt
+      run_id: record7.runId,
+      workspace_id: record7.workspaceId,
+      status: record7.status,
+      plan_json: JSON.stringify(record7.plan),
+      summary_json: record7.summary ? JSON.stringify(record7.summary) : null,
+      report_json: record7.report ? JSON.stringify(record7.report) : null,
+      report_html: record7.reportHtml ?? null,
+      created_at: record7.createdAt,
+      updated_at: record7.updatedAt
     });
   }
   getBenchmarkRun(runId) {
@@ -3152,12 +3152,12 @@ ${http2.content}`
   addPromptCases(cases, source = "ai") {
     let saved = [], skipped = 0;
     for (let item of cases) {
-      let [record6] = this.addPrompts([{ category: item.category, name: item.name, content: item.content, tool: item.tool }], source);
-      if (!record6) {
+      let [record7] = this.addPrompts([{ category: item.category, name: item.name, content: item.content, tool: item.tool }], source);
+      if (!record7) {
         skipped += 1;
         continue;
       }
-      item.assertions && item.assertions.length || item.checkSchema ? (this.store.setPromptChecks(record6.id, { assertions: item.assertions, checkSchema: item.checkSchema }), saved.push({ ...record6, assertions: item.assertions, checkSchema: item.checkSchema })) : saved.push(record6);
+      item.assertions && item.assertions.length || item.checkSchema ? (this.store.setPromptChecks(record7.id, { assertions: item.assertions, checkSchema: item.checkSchema }), saved.push({ ...record7, assertions: item.assertions, checkSchema: item.checkSchema })) : saved.push(record7);
     }
     return { saved, skipped };
   }
@@ -4688,13 +4688,13 @@ function fingerprintLocalSuite(suite) {
 function executorForPillar(pillar) {
   return pillar === "prompt" ? "PROMPT" : pillar === "rag" ? "RAG" : pillar === "contract" ? "CONTRACT" : pillar === "performance" ? "PERFORMANCE" : pillar === "model" ? "MODEL" : "MCP";
 }
-function compileLegacyLocalSuiteManifest(suite, localFingerprint = fingerprintLocalSuite(suite)) {
-  if (!/^sha256:[a-f0-9]{64}$/.test(localFingerprint))
+function compileLegacyLocalSuiteManifest(suite, localFingerprint2 = fingerprintLocalSuite(suite)) {
+  if (!/^sha256:[a-f0-9]{64}$/.test(localFingerprint2))
     throw new Error("Local Suite migration fingerprint is invalid.");
   let pillarCounts = {};
   for (let test of suite.tests)
     pillarCounts[test.pillar] = (pillarCounts[test.pillar] ?? 0) + 1;
-  let assetName = `local-suite-${localFingerprint.slice(7)}`, manifest = {
+  let assetName = `local-suite-${localFingerprint2.slice(7)}`, manifest = {
     schemaVersion: "prooflane-suite-manifest-v1",
     executionClass: "LOCAL_ONLY",
     controls: PILLARS2.filter((pillar) => !!pillarCounts[pillar]).map((pillar) => ({
@@ -4707,7 +4707,7 @@ function compileLegacyLocalSuiteManifest(suite, localFingerprint = fingerprintLo
       localRef: { kind: "PROJECT_ASSET", name: assetName },
       parameters: {
         schemaVersion: LOCAL_SUITE_MIGRATION_VERSION,
-        localFingerprint,
+        localFingerprint: localFingerprint2,
         localVersion: suite.version,
         testCount: pillarCounts[pillar]
       }
@@ -4738,7 +4738,7 @@ function readLegacyLocalSuiteArtifact(file, cwd = process.cwd()) {
   } catch (error) {
     throw new Error(`Could not read local Suite ${basename(sourcePath)}: ${error instanceof Error ? error.message : String(error)}`);
   }
-  let suite = validateLegacyLocalSuite(parsed), localFingerprint = fingerprintLocalSuite(suite), manifest = compileLegacyLocalSuiteManifest(suite, localFingerprint), pillarCounts = {};
+  let suite = validateLegacyLocalSuite(parsed), localFingerprint2 = fingerprintLocalSuite(suite), manifest = compileLegacyLocalSuiteManifest(suite, localFingerprint2), pillarCounts = {};
   for (let test of suite.tests)
     pillarCounts[test.pillar] = (pillarCounts[test.pillar] ?? 0) + 1;
   let supported = suite.tests.filter(localSuiteTestIsGeneric).length, projectRelative = relative(cwd, sourcePath);
@@ -4748,7 +4748,7 @@ function readLegacyLocalSuiteArtifact(file, cwd = process.cwd()) {
     projectRelativePath: projectRelative.startsWith("..") || projectRelative.startsWith("/") ? null : projectRelative,
     slug: localSuiteSlug(suite.id),
     displayName: localDisplayName(suite.id),
-    localFingerprint,
+    localFingerprint: localFingerprint2,
     manifest,
     migrationManifestHash: hashGovernedSuiteManifest(manifest),
     suite,
@@ -4789,7 +4789,7 @@ function discoverLegacyLocalSuites(input = {}) {
   return { suites, issues };
 }
 function migrationManifestHash(manifest) {
-  let { policyRef: _policyRef, ...content } = manifest;
+  let { policyRef: _policyRef, targetFingerprint: _targetFingerprint, requiredCapabilities: _requiredCapabilities, ...content } = manifest;
   return hashGovernedSuiteManifest(content);
 }
 function planLegacyLocalSuiteMigration(local, cloud) {
@@ -4989,10 +4989,10 @@ function resultCount(output) {
     return output.length;
   if (!output || typeof output != "object")
     return null;
-  let record6 = output;
+  let record7 = output;
   for (let key of ["results", "documents", "items", "data", "matches"])
-    if (Array.isArray(record6[key]))
-      return record6[key].length;
+    if (Array.isArray(record7[key]))
+      return record7[key].length;
   return null;
 }
 function compactError(cause) {
@@ -5628,11 +5628,11 @@ async function gradeExecution(candidate, benchmarkCase, result, scorers, passThr
   return { assertions, dimensions, score, verdict, securityBreach, criticalFailure, functionalSuccess, secureTaskSuccess };
 }
 async function withTimeout(promise, timeoutMs, signal) {
-  return timeoutMs <= 0 && !signal ? promise : await new Promise((resolve6, reject) => {
+  return timeoutMs <= 0 && !signal ? promise : await new Promise((resolve7, reject) => {
     let settled = !1, finish = (fn) => {
       settled || (settled = !0, clearTimeout(timer), signal && signal.removeEventListener("abort", onAbort), fn());
     }, timer = timeoutMs > 0 ? setTimeout(() => finish(() => reject(new Error(`benchmark timeout after ${timeoutMs}ms`))), timeoutMs) : void 0, onAbort = () => finish(() => reject(new Error("benchmark cancelled")));
-    signal && signal.addEventListener("abort", onAbort, { once: !0 }), promise.then((v) => finish(() => resolve6(v)), (e) => finish(() => reject(e)));
+    signal && signal.addEventListener("abort", onAbort, { once: !0 }), promise.then((v) => finish(() => resolve7(v)), (e) => finish(() => reject(e)));
   });
 }
 async function pool(items, limit, work) {
@@ -8663,9 +8663,9 @@ function readHuggingFaceCache(ir) {
     recordedFiles
   };
 }
-function compareRecordedDigests(ir, record6) {
+function compareRecordedDigests(ir, record7) {
   let onDisk = new Map(ir.files.map((f) => [f.path, f.sha256])), out = { matched: [], mismatched: [], unverifiable: [] };
-  for (let entry of record6.digests) {
+  for (let entry of record7.digests) {
     if (entry.algorithm !== "sha256") {
       out.unverifiable.push(entry.path);
       continue;
@@ -8683,25 +8683,25 @@ function compareRecordedDigests(ir, record6) {
 // ../core/dist/modelSecurity/packs/provenance.js
 var PACK2 = "model-provenance", IMMUTABLE_REVISION = /^[a-f0-9]{7,64}$/i, FLOATING_NAMES = /^(?:main|master|develop|dev|trunk|latest|head|refs\/heads\/.+|refs\/tags\/.+|v?\d+(?:\.\d+)*(?:-[a-z0-9.]+)?)$/i;
 function readProvenance(ir) {
-  let record6 = { architectures: [], externalDependencies: [] };
-  ir.target.sourceType === "huggingface" && (record6.sourceRepository = ir.target.source), ir.target.sourceType === "url" && (record6.artifactUrl = ir.target.source), (ir.target.sourceType === "url" || ir.target.sourceType === "huggingface") && (record6.downloadedFrom = ir.target.source), record6.revision = ir.target.resolvedRevision ?? ir.target.revision, record6.publisher = ir.target.publisher;
+  let record7 = { architectures: [], externalDependencies: [] };
+  ir.target.sourceType === "huggingface" && (record7.sourceRepository = ir.target.source), ir.target.sourceType === "url" && (record7.artifactUrl = ir.target.source), (ir.target.sourceType === "url" || ir.target.sourceType === "huggingface") && (record7.downloadedFrom = ir.target.source), record7.revision = ir.target.resolvedRevision ?? ir.target.revision, record7.publisher = ir.target.publisher;
   for (let file of ir.files) {
-    (/^readme|model[_-]?card/i.test(file.path) || file.role === "documentation") && (record6.modelCardPath ??= file.path, file.text && (record6.license ??= file.text.match(/^(?:license|model-license)\s*:\s*["']?([^\n"']+)/im)?.[1]?.trim(), record6.sourceRepository ??= file.text.match(/^(?:base_model|base-model|source_model|repository)\s*:\s*["']?([^\n"']+)/im)?.[1]?.trim(), record6.commit ??= file.text.match(/^(?:revision|commit|sha)\s*:\s*["']?([a-f0-9]{7,64})/im)?.[1], record6.publisher ??= file.text.match(/^(?:author|publisher|organization)\s*:\s*["']?([^\n"']+)/im)?.[1]?.trim())), /^license(?:\.|$)|^copying(?:\.|$)/i.test(file.path) && file.text?.trim() && (record6.license ??= "License file present (identifier not parsed)");
+    (/^readme|model[_-]?card/i.test(file.path) || file.role === "documentation") && (record7.modelCardPath ??= file.path, file.text && (record7.license ??= file.text.match(/^(?:license|model-license)\s*:\s*["']?([^\n"']+)/im)?.[1]?.trim(), record7.sourceRepository ??= file.text.match(/^(?:base_model|base-model|source_model|repository)\s*:\s*["']?([^\n"']+)/im)?.[1]?.trim(), record7.commit ??= file.text.match(/^(?:revision|commit|sha)\s*:\s*["']?([a-f0-9]{7,64})/im)?.[1], record7.publisher ??= file.text.match(/^(?:author|publisher|organization)\s*:\s*["']?([^\n"']+)/im)?.[1]?.trim())), /^license(?:\.|$)|^copying(?:\.|$)/i.test(file.path) && file.text?.trim() && (record7.license ??= "License file present (identifier not parsed)");
     for (let [key, value] of flatten(file.json))
-      typeof value == "string" && (/(?:^|\.)model_type$/.test(key) && (record6.modelType ??= value), /(?:^|\.)transformers_version$/.test(key) && (record6.libraryVersion ??= value), /(?:^|\.)license$/.test(key) && (record6.license ??= value), /(?:^|\.)_name_or_path$/.test(key) && (record6.sourceRepository ??= value), /(?:^|\.)(?:base_model_name_or_path|base_model)$/.test(key) && (record6.sourceRepository ??= value), /(?:^|\.)(?:_?commit_hash|revision|sha)$/.test(key) && (record6.commit ??= value), /(?:^|\.)(?:author|publisher|organization)$/.test(key) && (record6.publisher ??= value));
+      typeof value == "string" && (/(?:^|\.)model_type$/.test(key) && (record7.modelType ??= value), /(?:^|\.)transformers_version$/.test(key) && (record7.libraryVersion ??= value), /(?:^|\.)license$/.test(key) && (record7.license ??= value), /(?:^|\.)_name_or_path$/.test(key) && (record7.sourceRepository ??= value), /(?:^|\.)(?:base_model_name_or_path|base_model)$/.test(key) && (record7.sourceRepository ??= value), /(?:^|\.)(?:_?commit_hash|revision|sha)$/.test(key) && (record7.commit ??= value), /(?:^|\.)(?:author|publisher|organization)$/.test(key) && (record7.publisher ??= value));
     let architectures = flatten(file.json).filter(([key]) => /(?:^|\.)architectures\[\d+\]$/.test(key)).map(([, value]) => value);
     for (let architecture of architectures)
-      typeof architecture == "string" && record6.architectures.push(architecture);
+      typeof architecture == "string" && record7.architectures.push(architecture);
     if (/requirements\.txt$|pyproject\.toml$|setup\.py$|environment\.ya?ml$/i.test(file.path) && file.text)
       for (let line of file.text.split(/\r?\n/)) {
         let dependency = line.trim();
         if (!dependency || dependency.startsWith("#"))
           continue;
         let name = dependency.match(/^([A-Za-z0-9._-]+)/)?.[1];
-        name && record6.externalDependencies.push(dependency.length > 80 ? name : dependency);
+        name && record7.externalDependencies.push(dependency.length > 80 ? name : dependency);
       }
   }
-  return record6.architectures = [...new Set(record6.architectures)], record6.externalDependencies = [...new Set(record6.externalDependencies)], record6.commit ??= record6.revision && IMMUTABLE_REVISION.test(record6.revision) ? record6.revision : void 0, record6;
+  return record7.architectures = [...new Set(record7.architectures)], record7.externalDependencies = [...new Set(record7.externalDependencies)], record7.commit ??= record7.revision && IMMUTABLE_REVISION.test(record7.revision) ? record7.revision : void 0, record7;
 }
 function recordCheck(id, title, intent, read, missing) {
   return {
@@ -8731,13 +8731,13 @@ function recordCheck(id, title, intent, read, missing) {
   };
 }
 var PROVENANCE_RULES = [
-  recordCheck("provenance.source-repository", "Source repository", "The artifact records the repository it was published from.", (record6) => record6.sourceRepository, {
+  recordCheck("provenance.source-repository", "Source repository", "The artifact records the repository it was published from.", (record7) => record7.sourceRepository, {
     severity: "medium",
     description: "Nothing in the artifact identifies the repository it came from.",
     impact: "The artifact cannot be traced back to reviewed source, and a substitution would go unnoticed.",
     remediation: "Record the publishing repository in the model card and configuration, and scan by Hugging Face repository or URL so the source is captured automatically."
   }),
-  recordCheck("provenance.artifact-url", "Artifact URL", "The location the artifact was retrieved from is recorded.", (record6) => record6.artifactUrl ?? record6.downloadedFrom, {
+  recordCheck("provenance.artifact-url", "Artifact URL", "The location the artifact was retrieved from is recorded.", (record7) => record7.artifactUrl ?? record7.downloadedFrom, {
     severity: "low",
     description: "No retrieval URL was recorded for this artifact.",
     impact: "Re-fetching the exact bytes later depends on undocumented tribal knowledge.",
@@ -8776,7 +8776,7 @@ var PROVENANCE_RULES = [
     derivedFrom: "Git object naming and model-hub revision semantics",
     verification: "source-metadata",
     run(ctx) {
-      let record6 = readProvenance(ctx.ir), revision = record6.commit ?? record6.revision;
+      let record7 = readProvenance(ctx.ir), revision = record7.commit ?? record7.revision;
       if (revision && IMMUTABLE_REVISION.test(revision)) {
         ctx.clean(`Pinned to immutable revision ${revision.slice(0, 12)}\u2026`);
         return;
@@ -8801,7 +8801,7 @@ var PROVENANCE_RULES = [
     derivedFrom: "Git ref semantics; mutable tags and branches are not content-addressed",
     verification: "source-metadata",
     run(ctx) {
-      let floating = [], record6 = readProvenance(ctx.ir), targetRevision = ctx.ir.target.revision;
+      let floating = [], record7 = readProvenance(ctx.ir), targetRevision = ctx.ir.target.revision;
       ctx.ir.target.revisionIsFloating === !0 && targetRevision ? floating.push({ where: "scan target", value: targetRevision }) : targetRevision && !IMMUTABLE_REVISION.test(targetRevision) && floating.push({ where: "scan target", value: targetRevision });
       for (let file of ctx.ir.files)
         for (let [key, value] of flatten(file.json))
@@ -8820,26 +8820,26 @@ var PROVENANCE_RULES = [
         });
       if (floating.length)
         return;
-      if (!(!!targetRevision || !!record6.commit || !!record6.revision || ctx.ir.files.some((file) => [...flatten(file.json)].some(([key, value]) => typeof value == "string" && /(?:^|\.)(?:revision|base_model_revision|adapter_revision|ref|branch|tag)$/i.test(key))))) {
+      if (!(!!targetRevision || !!record7.commit || !!record7.revision || ctx.ir.files.some((file) => [...flatten(file.json)].some(([key, value]) => typeof value == "string" && /(?:^|\.)(?:revision|base_model_revision|adapter_revision|ref|branch|tag)$/i.test(key))))) {
         ctx.notApplicable("NOT MEASURED \u2014 the artifact declares no repository revision, branch or tag, and none was supplied to the scan. There is nothing to judge as floating or immutable; this is absent provenance, not a verified property.");
         return;
       }
       ctx.clean("Every revision reference in the artifact was an immutable identifier.");
     }
   },
-  recordCheck("provenance.commit-captured", "Repository commit", "The upstream repository commit is captured with the artifact.", (record6) => record6.commit, {
+  recordCheck("provenance.commit-captured", "Repository commit", "The upstream repository commit is captured with the artifact.", (record7) => record7.commit, {
     severity: "medium",
     description: "No repository commit was recorded alongside the artifact.",
     impact: "The artifact cannot be reproducibly rebuilt from, or diffed against, reviewed source.",
     remediation: "Emit the build commit into the model card and configuration as part of the publishing pipeline."
   }),
-  recordCheck("provenance.license-declared", "Model license", "A model license is declared.", (record6) => record6.license, {
+  recordCheck("provenance.license-declared", "Model license", "A model license is declared.", (record7) => record7.license, {
     severity: "medium",
     description: "No model license was discovered in configuration, model card or a license file.",
     impact: "Use, redistribution, fine-tuning and commercial deployment rights are undetermined.",
     remediation: "Attach an SPDX-identifiable model license and have counsel review its obligations before deployment."
   }),
-  recordCheck("provenance.publisher-metadata", "Publisher metadata", "An author or publishing organization is recorded.", (record6) => record6.publisher, {
+  recordCheck("provenance.publisher-metadata", "Publisher metadata", "An author or publishing organization is recorded.", (record7) => record7.publisher, {
     severity: "low",
     description: "No author or publishing organization was recorded for the artifact.",
     impact: "There is no accountable owner recorded for security questions or advisories.",
@@ -8884,7 +8884,7 @@ var PROVENANCE_RULES = [
     derivedFrom: "Python packaging manifest formats",
     verification: "static-text-inspection",
     run(ctx) {
-      let record6 = readProvenance(ctx.ir), manifests = ctx.ir.files.filter((file) => /requirements\.txt$|pyproject\.toml$|setup\.py$|environment\.ya?ml$/i.test(file.path));
+      let record7 = readProvenance(ctx.ir), manifests = ctx.ir.files.filter((file) => /requirements\.txt$|pyproject\.toml$|setup\.py$|environment\.ya?ml$/i.test(file.path));
       if (!manifests.length) {
         ctx.report({
           title: "No dependency manifest accompanies the model",
@@ -8897,7 +8897,7 @@ var PROVENANCE_RULES = [
         });
         return;
       }
-      ctx.clean(`${record6.externalDependencies.length} declared dependenc${record6.externalDependencies.length === 1 ? "y" : "ies"} across ${manifests.length} manifest(s).`);
+      ctx.clean(`${record7.externalDependencies.length} declared dependenc${record7.externalDependencies.length === 1 ? "y" : "ies"} across ${manifests.length} manifest(s).`);
     }
   },
   {
@@ -8972,7 +8972,7 @@ var PROVENANCE_RULES = [
       });
     }
   },
-  recordCheck("provenance.model-card-source", "Model card", "A model card documents origin, intended use and limitations.", (record6) => record6.modelCardPath, {
+  recordCheck("provenance.model-card-source", "Model card", "A model card documents origin, intended use and limitations.", (record7) => record7.modelCardPath, {
     severity: "medium",
     description: "The artifact has no discoverable README or model card.",
     impact: "Reviewers cannot establish intended use, training data, limitations or safety evaluation from the artifact itself.",
@@ -10909,11 +10909,11 @@ function sanitizeAssertions(raw) {
   for (let item of raw) {
     if (!item || typeof item != "object")
       continue;
-    let record6 = item, op = record6.op;
+    let record7 = item, op = record7.op;
     if (typeof op != "string" || !ASSERT_OPS.has(op))
       continue;
-    let path = typeof record6.path == "string" ? record6.path : "", needsValue = op !== "exists" && op !== "not-exists";
-    if (!(needsValue && record6.value === void 0) && (out.push({ path, op, ...needsValue ? { value: record6.value } : {} }), out.length >= 10))
+    let path = typeof record7.path == "string" ? record7.path : "", needsValue = op !== "exists" && op !== "not-exists";
+    if (!(needsValue && record7.value === void 0) && (out.push({ path, op, ...needsValue ? { value: record7.value } : {} }), out.length >= 10))
       break;
   }
   return out;
@@ -10940,22 +10940,22 @@ function parseGeneratedPromptCases(text6, ctx = {}) {
   for (let raw of parsed) {
     if (!raw || typeof raw != "object")
       continue;
-    let record6 = raw, prompt = typeof record6.prompt == "string" ? record6.prompt.trim() : "";
+    let record7 = raw, prompt = typeof record7.prompt == "string" ? record7.prompt.trim() : "";
     if (!prompt || !isPromptLike(prompt))
       continue;
-    let type = typeof record6.type == "string" && CASE_TYPES.has(record6.type) ? record6.type : "positive", expectedTool = typeof record6.expectedTool == "string" ? record6.expectedTool.trim() : "", forbiddenTools = textList(record6.forbiddenTools).filter((t) => known ? known.has(t) : !0);
+    let type = typeof record7.type == "string" && CASE_TYPES.has(record7.type) ? record7.type : "positive", expectedTool = typeof record7.expectedTool == "string" ? record7.expectedTool.trim() : "", forbiddenTools = textList(record7.forbiddenTools).filter((t) => known ? known.has(t) : !0);
     if (cases.push({
       id: `${prefix}-${cases.length + 1}`,
-      name: (typeof record6.name == "string" && record6.name.trim() ? record6.name.trim() : `${type} case`).slice(0, 120),
+      name: (typeof record7.name == "string" && record7.name.trim() ? record7.name.trim() : `${type} case`).slice(0, 120),
       source: { kind: "ai-generated", serverId: ctx.serverId, toolName: ctx.toolName },
       type,
       prompt: prompt.slice(0, 8e3),
-      expectedBehavior: typeof record6.expectedBehavior == "string" && record6.expectedBehavior.trim() ? record6.expectedBehavior.trim().slice(0, 500) : void 0,
+      expectedBehavior: typeof record7.expectedBehavior == "string" && record7.expectedBehavior.trim() ? record7.expectedBehavior.trim().slice(0, 500) : void 0,
       // Never let the generator invent a tool the connected server doesn't advertise.
       expectedTool: expectedTool && (!known || known.has(expectedTool)) ? expectedTool : void 0,
       forbiddenTools: forbiddenTools.length ? forbiddenTools : void 0,
-      assertions: sanitizeAssertions(record6.assertions),
-      tags: textList(record6.tags, 6)
+      assertions: sanitizeAssertions(record7.assertions),
+      tags: textList(record7.tags, 6)
     }), cases.length >= max)
       break;
   }
@@ -11167,6 +11167,122 @@ async function relaySammyInferenceBoundary(options) {
   }
 }
 
+// ../server/dist/hostedSammySuiteHandoff.js
+import { createHash as createHash15, randomUUID as randomUUID7 } from "node:crypto";
+import { existsSync as existsSync2, linkSync, mkdirSync as mkdirSync2, readFileSync as readFileSync3, unlinkSync, writeFileSync } from "node:fs";
+import { join as join4, resolve as resolve5 } from "node:path";
+var GENERATION_ID = /^sammy-[a-f0-9]{12}$/, STATIC_FINGERPRINT = /^static-suite-fp-[a-f0-9]{12}$/, PROFILE_TARGET_FINGERPRINT = /^target-fp-[a-f0-9]{12}$/, GOVERNED_TARGET_FINGERPRINT = /^target-fp-[a-f0-9]{32}$/, CAPABILITY_FINGERPRINT = /^cap-fp-[a-f0-9]{32}$/, LINEAGE_KEYS = /* @__PURE__ */ new Set([
+  "generationId",
+  "generationStrategy",
+  "registryVersion",
+  "generatorModelAlias",
+  "reviewerModelAlias",
+  "graphVersion",
+  "promptBundleVersion",
+  "datasetVersionRefs",
+  "generatorModelRef",
+  "reviewerModelRef"
+]);
+function record6(value) {
+  return !!value && typeof value == "object" && !Array.isArray(value);
+}
+function validateArtifact(value, generationId) {
+  if (!record6(value) || !Object.keys(value).every((key) => ["format", "suite", "lineage", "fingerprint"].includes(key)))
+    throw new Error("Hosted Sammy returned an invalid static Suite artifact envelope.");
+  if (value.format !== "prooflane-static-assurance-suite-v1" || typeof value.fingerprint != "string" || !STATIC_FINGERPRINT.test(value.fingerprint))
+    throw new Error("Hosted Sammy returned an unsupported static Suite artifact.");
+  if (!record6(value.lineage) || !Object.keys(value.lineage).every((key) => LINEAGE_KEYS.has(key)) || value.lineage.generationId !== generationId)
+    throw new Error("Hosted Sammy artifact lineage does not match the approved generation.");
+  let suite = validateLegacyLocalSuite(value.suite);
+  if (suite.status !== "APPROVED" || !suite.approvedAt)
+    throw new Error("Only an approved Sammy Suite can enter governed authoring.");
+  let expectedFingerprint = `static-suite-fp-${createHash15("sha256").update(canonicalizeSuiteJson({ suiteFingerprint: suite.suiteFingerprint, lineage: value.lineage }), "utf8").digest("hex").slice(0, 12)}`;
+  if (value.fingerprint !== expectedFingerprint)
+    throw new Error("Hosted Sammy static Suite artifact fingerprint verification failed.");
+  return { format: value.format, suite, lineage: value.lineage, fingerprint: value.fingerprint };
+}
+function validateCapabilities(value) {
+  if (value.length > 1e3)
+    throw new Error("The governed capability surface is too large.");
+  let ids = /* @__PURE__ */ new Set();
+  return value.map((entry) => {
+    if (!entry || typeof entry.id != "string" || entry.id.length < 1 || entry.id.length > 128 || !/^[A-Za-z0-9][A-Za-z0-9_.:/-]{0,127}$/.test(entry.id) || typeof entry.fingerprint != "string" || !CAPABILITY_FINGERPRINT.test(entry.fingerprint) || ids.has(entry.id))
+      throw new Error("The governed capability surface is invalid.");
+    return ids.add(entry.id), { id: entry.id, fingerprint: entry.fingerprint };
+  }).sort((left, right) => left.id.localeCompare(right.id));
+}
+function approvedTestContentFingerprint(tests) {
+  let content = tests.map((test) => {
+    let { createdAt: _createdAt, ...rest } = test, intelligence = test.intelligence ? (({ generationId: _generationId, suiteId: _suiteId, suiteVersion: _suiteVersion, reviewStatus: _reviewStatus, reviewedAt: _reviewedAt, reviewedBy: _reviewedBy, ...authored }) => authored)(test.intelligence) : void 0, rag = test.rag ? {
+      ...test.rag,
+      intelligence: test.rag.intelligence ? (({ generationId: _generationId, suiteId: _suiteId, suiteVersion: _suiteVersion, nativeTestRef: _nativeTestRef, ...trusted }) => trusted)(test.rag.intelligence) : null
+    } : null;
+    return { ...rest, tags: [...test.tags].sort(), intelligence: intelligence ?? null, rag };
+  }).sort((left, right) => left.id.localeCompare(right.id));
+  return `suite-fp-${createHash15("sha256").update(canonicalizeSuiteJson({ format: "prooflane-assurance-suite-v1", content }), "utf8").digest("hex").slice(0, 12)}`;
+}
+function runtimeSuiteId(sourceId, generationId) {
+  let sourceSlug = localSuiteSlug(sourceId), suffix = generationId.slice(6);
+  return `${sourceSlug.slice(0, 48)}-${suffix}`;
+}
+function localFingerprint(suite) {
+  return `sha256:${createHash15("sha256").update(canonicalizeSuiteJson(suite), "utf8").digest("hex")}`;
+}
+function materializeHostedSammySuite(input) {
+  if (!GENERATION_ID.test(input.generationId))
+    throw new Error("Hosted Sammy generation id is invalid.");
+  if (!input.expectedTarget.trim() || input.expectedTarget.length > 256 || !PROFILE_TARGET_FINGERPRINT.test(input.expectedProfileTargetFingerprint) || !GOVERNED_TARGET_FINGERPRINT.test(input.governedTargetFingerprint))
+    throw new Error("The current hosted capability surface is invalid.");
+  let artifact = validateArtifact(input.artifact, input.generationId);
+  if (artifact.suite.suiteFingerprint !== approvedTestContentFingerprint(artifact.suite.tests))
+    throw new Error("Hosted Sammy approved Suite content fingerprint verification failed.");
+  if (artifact.suite.target !== input.expectedTarget || artifact.suite.targetFingerprint !== input.expectedProfileTargetFingerprint)
+    throw new Error("The connected MCP target changed after Sammy approval. Generate and approve a fresh plan.");
+  let requiredCapabilities = validateCapabilities(input.requiredCapabilities), id = runtimeSuiteId(artifact.suite.id, input.generationId), suite = validateLegacyLocalSuite({
+    ...artifact.suite,
+    id,
+    targetFingerprint: input.governedTargetFingerprint
+  }), expectedLocalFingerprint = localFingerprint(suite), slug = localSuiteSlug(suite.id), directory = resolve5(input.cwd ?? process.cwd(), ".prooflane", "suites"), fileName = `${slug}-v${suite.version}.json`, file = join4(directory, fileName), bytes = `${JSON.stringify(suite, null, 2)}
+`, created = !1;
+  if (mkdirSync2(directory, { recursive: !0, mode: 448 }), existsSync2(file)) {
+    if (readLegacyLocalSuiteArtifact(file, input.cwd ?? process.cwd()).localFingerprint !== expectedLocalFingerprint)
+      throw new Error(`A different local Suite already occupies ${fileName}; Prooflane will not overwrite it.`);
+  } else {
+    let temporary = join4(directory, `.${fileName}.${process.pid}.${randomUUID7()}.tmp`);
+    try {
+      writeFileSync(temporary, bytes, { encoding: "utf8", flag: "wx", mode: 384 });
+      try {
+        linkSync(temporary, file), created = !0;
+      } catch (error) {
+        if (!existsSync2(file))
+          throw error;
+        if (readLegacyLocalSuiteArtifact(file, input.cwd ?? process.cwd()).localFingerprint !== expectedLocalFingerprint)
+          throw new Error(`A different local Suite already occupies ${fileName}; Prooflane will not overwrite it.`);
+      }
+    } finally {
+      existsSync2(temporary) && unlinkSync(temporary);
+    }
+  }
+  let stored = readLegacyLocalSuiteArtifact(file, input.cwd ?? process.cwd());
+  if (stored.localFingerprint !== expectedLocalFingerprint || stored.slug !== slug || stored.suite.status !== "APPROVED")
+    throw new Error("The materialized Sammy Suite failed local integrity verification.");
+  if (readFileSync3(file).byteLength > 8 * 1024 * 1024)
+    throw new Error("The materialized Sammy Suite exceeds the local artifact limit.");
+  return {
+    version: "prooflane-hosted-sammy-materialization-v1",
+    generationId: input.generationId,
+    sourceArtifactFingerprint: artifact.fingerprint,
+    sourceTargetFingerprint: artifact.suite.targetFingerprint,
+    governedTargetFingerprint: input.governedTargetFingerprint,
+    requiredCapabilities,
+    slug,
+    localFingerprint: stored.localFingerprint,
+    localVersion: stored.suite.version,
+    fileName,
+    created
+  };
+}
+
 // ../server/dist/plans.js
 var UNLIMITED = 1e6, PLANS = {
   free: { tier: "free", label: "Free \xB7 Inspector", servers: 1, tools: 5, attacks: 0, retrievers: 0, prompts: 10, maxVus: 10, deployment: !1, historyDays: 7, ci: !1, ruleFeed: "static", core: !0, hosted: !1, security: !1, rag: !1, gates: !1 },
@@ -11218,7 +11334,7 @@ function describeToolError(output) {
   })();
   return text6.length > 500 ? `${text6.slice(0, 500)}\u2026` : text6 || "the tool reported an error";
 }
-var sha256 = (value) => createHash15("sha256").update(typeof value == "string" ? value : JSON.stringify(value)).digest("hex"), hostedRagCaseQuery = (testCase) => (testCase.userQuery ?? "").trim() || testCase.query, hostedRagCaseName = (testCase) => (testCase.name ?? "").trim() || hostedRagCaseQuery(testCase) || testCase.id, hostedRagCaseInput = (testCase) => testCase.input ?? { query: hostedRagCaseQuery(testCase) }, clampRagScore = (value) => Math.max(0, Math.min(100, Math.round(Number.isFinite(value) ? value : 0))), averageRagScore = (values) => values.length ? Math.round(values.reduce((sum, value) => sum + value, 0) / values.length) : 100;
+var sha256 = (value) => createHash16("sha256").update(typeof value == "string" ? value : JSON.stringify(value)).digest("hex"), hostedRagCaseQuery = (testCase) => (testCase.userQuery ?? "").trim() || testCase.query, hostedRagCaseName = (testCase) => (testCase.name ?? "").trim() || hostedRagCaseQuery(testCase) || testCase.id, hostedRagCaseInput = (testCase) => testCase.input ?? { query: hostedRagCaseQuery(testCase) }, clampRagScore = (value) => Math.max(0, Math.min(100, Math.round(Number.isFinite(value) ? value : 0))), averageRagScore = (values) => values.length ? Math.round(values.reduce((sum, value) => sum + value, 0) / values.length) : 100;
 function extractHostedRagPayload(output) {
   let value = output;
   if (Array.isArray(value) && value.length && value.every((block) => block && typeof block == "object" && "type" in block)) {
@@ -11492,10 +11608,10 @@ function resultCount3(value) {
   if (Array.isArray(value))
     return value.length;
   if (value && typeof value == "object") {
-    let record6 = value;
+    let record7 = value;
     for (let key of ["results", "items", "documents", "matches", "content"])
-      if (Array.isArray(record6[key]))
-        return record6[key].length;
+      if (Array.isArray(record7[key]))
+        return record7[key].length;
     return 1;
   }
   return value == null || value === "" ? 0 : 1;
@@ -11651,10 +11767,10 @@ function buildApp() {
         targetTokenCeiling: Math.trunc(configuredNumber("PROOFLANE_BENCHMARK_PAID_TARGET_TOKENS", DEFAULT_BENCHMARK_PRICING_POLICY.products.PAID_SINGLE_RUN.targetTokenCeiling, 1e3, 2e7))
       }
     }
-  }, localLifecycleKey = randomUUID7(), activeMcpAuthMode = "unknown", activeMcpConnectionId = null, oauthFlows = /* @__PURE__ */ new Map(), assuranceGateManifest = process.env.PROOFLANE_ASSURANCE_GATES_FILE ?? resolve5(".prooflane/assurance-gates.json"), assurancePolicyRegistry = process.env.PROOFLANE_ASSURANCE_POLICIES_FILE ?? join4(dirname4(assuranceGateManifest), "assurance-policies.json"), readAssurancePolicies = async () => {
+  }, localLifecycleKey = randomUUID8(), activeMcpAuthMode = "unknown", activeMcpConnectionId = null, oauthFlows = /* @__PURE__ */ new Map(), assuranceGateManifest = process.env.PROOFLANE_ASSURANCE_GATES_FILE ?? resolve6(".prooflane/assurance-gates.json"), assurancePolicyRegistry = process.env.PROOFLANE_ASSURANCE_POLICIES_FILE ?? join5(dirname4(assuranceGateManifest), "assurance-policies.json"), readAssurancePolicies = async () => {
     let intel = await loadLegacyIntelligence(), stored = [];
-    if (existsSync2(assurancePolicyRegistry)) {
-      let document = JSON.parse(readFileSync3(assurancePolicyRegistry, "utf8"));
+    if (existsSync3(assurancePolicyRegistry)) {
+      let document = JSON.parse(readFileSync4(assurancePolicyRegistry, "utf8"));
       if (document.version !== "prooflane-assurance-policy-registry-v1" || !Array.isArray(document.policies))
         throw new Error("Assurance Policy registry must use prooflane-assurance-policy-registry-v1.");
       stored = document.policies;
@@ -11662,7 +11778,7 @@ function buildApp() {
     let policies = stored.map((policy) => intel.validateAssurancePolicyVersion(policy));
     return policies.some((policy) => policy.id === intel.DEFAULT_ASSURANCE_POLICY.id) || policies.unshift(structuredClone(intel.DEFAULT_ASSURANCE_POLICY)), policies.sort((a, b) => b.createdAt.localeCompare(a.createdAt) || b.version - a.version || a.id.localeCompare(b.id));
   }, writeAssurancePolicies = (policies) => {
-    mkdirSync2(dirname4(assurancePolicyRegistry), { recursive: !0 }), writeFileSync(assurancePolicyRegistry, JSON.stringify({ version: "prooflane-assurance-policy-registry-v1", policies }, null, 2) + `
+    mkdirSync3(dirname4(assurancePolicyRegistry), { recursive: !0 }), writeFileSync2(assurancePolicyRegistry, JSON.stringify({ version: "prooflane-assurance-policy-registry-v1", policies }, null, 2) + `
 `, "utf8");
   }, hostedSammyInference = async (request, task, context) => {
     let authorization = request[HOSTED_SAMMY_AUTHORIZATION], relayRequest = buildHostedSammyRelayRequest({
@@ -12065,6 +12181,36 @@ ${item.artifact.localFingerprint}`));
       let status = error instanceof ControlPlaneRequestError ? error.status : 400;
       return reply.code(status).send({ error: (error instanceof Error ? error.message : "Local Suite migration failed.").slice(0, 300) });
     }
+  }), app.post("/api/intelligence/generations/:id/materialize-suite", async (req, reply) => {
+    if (intelligenceMode !== "hosted")
+      return reply.code(409).send({ error: "Hosted Sammy Suite materialization is available only in hosted Intelligence mode." });
+    if (!req.body || typeof req.body != "object" || Array.isArray(req.body) || Object.keys(req.body).length !== 0)
+      return reply.code(400).send({ error: "Hosted Sammy Suite materialization accepts an empty body only." });
+    if (!/^sammy-[a-f0-9]{12}$/.test(req.params.id))
+      return reply.code(400).send({ error: "Hosted Sammy generation id is invalid." });
+    let capabilities = svc.getCapabilities();
+    if (!capabilities)
+      return reply.code(409).send({ error: "Connect the same MCP target before preparing the governed Suite." });
+    try {
+      let surface = await requestControlPlaneJson(req, "/v1/intelligence/surface", "POST", { capabilities }), governedTargetFingerprint = fingerprintServerCapabilities(capabilities), governedCapabilities = fingerprintServerCapabilitySurface(capabilities);
+      if (surface.connected !== !0 || typeof surface.target != "string" || typeof surface.fingerprint != "string" || surface.governedTargetFingerprint !== governedTargetFingerprint || JSON.stringify(surface.governedCapabilities) !== JSON.stringify(governedCapabilities))
+        throw new Error("Hosted capability analysis did not preserve the current governed target identity.");
+      let compiled = await requestControlPlaneJson(req, `/v1/projects/${encodeURIComponent(PROOFLANE_PROJECT)}/intelligence/generations/${encodeURIComponent(req.params.id)}/compile-suite`, "POST", {});
+      if (!compiled.artifact)
+        throw new Error("Hosted Sammy did not return an approved static Suite artifact.");
+      return { materialized: materializeHostedSammySuite({
+        artifact: compiled.artifact,
+        generationId: req.params.id,
+        expectedTarget: surface.target,
+        expectedProfileTargetFingerprint: surface.fingerprint,
+        governedTargetFingerprint,
+        requiredCapabilities: governedCapabilities,
+        cwd: process.cwd()
+      }) };
+    } catch (error) {
+      let status = error instanceof ControlPlaneRequestError ? error.status : 409;
+      return reply.code(status).send({ error: (error instanceof Error ? error.message : "The hosted Sammy Suite could not be prepared.").slice(0, 300) });
+    }
   });
   let gateRegistryPath = `/v1/projects/${encodeURIComponent(PROOFLANE_PROJECT)}/gates`;
   app.get("/api/governance/gates", async (req, reply) => proxyControlPlane(req, reply, gateRegistryPath, void 0, "GET")), app.post("/api/governance/gates", async (req, reply) => proxyControlPlane(req, reply, gateRegistryPath, req.body ?? {})), app.get("/api/governance/gates/:slug", async (req, reply) => proxyControlPlane(req, reply, `${gateRegistryPath}/${encodeURIComponent(req.params.slug)}`, void 0, "GET")), app.post("/api/governance/gates/:slug/versions", async (req, reply) => proxyControlPlane(req, reply, `${gateRegistryPath}/${encodeURIComponent(req.params.slug)}/versions`, req.body ?? {})), app.get("/api/governance/gates/:slug/versions/:version", async (req, reply) => proxyControlPlane(req, reply, `${gateRegistryPath}/${encodeURIComponent(req.params.slug)}/versions/${encodeURIComponent(req.params.version)}`, void 0, "GET")), app.put("/api/governance/gates/:slug/versions/:version", async (req, reply) => proxyControlPlane(req, reply, `${gateRegistryPath}/${encodeURIComponent(req.params.slug)}/versions/${encodeURIComponent(req.params.version)}`, req.body ?? {}, "PUT"));
@@ -12129,8 +12275,8 @@ ${item.artifact.localFingerprint}`));
         throw new Error("Gate required pillars are not represented by the signed Suite.");
       if (!svc.isConnected())
         throw new Error("Connect the local MCP target before running this Gate.");
-      let runnerId = `local_ui_${createHash15("sha256").update(`${kawachHome()}
-${PROOFLANE_PROJECT}`, "utf8").digest("hex").slice(0, 24)}`, idempotencyKey = `localui:${randomUUID7().replaceAll("-", "")}`, gatePin = { gateId: gate.id, slug: gate.slug, gateVersionId: gateVersion.id, version: gateVersion.version, manifestHash: gateVersion.manifestHash }, suitePin = { suiteId: suite.id, slug: suite.slug, suiteVersionId: suiteVersion.id, version: suiteVersion.version, manifestHash: suiteVersion.manifestHash }, policyPin = { policyId: policy.id, policyVersionId: policyVersion.id, version: policyVersion.version, manifestHash: policyVersion.manifestHash }, runner = { runnerId, type: "LOCAL_UI", runnerVersion: "0.1.0", cliVersion: "ui-0.1.0" }, governedRunMatches = (candidate, targetFingerprint) => {
+      let runnerId = `local_ui_${createHash16("sha256").update(`${kawachHome()}
+${PROOFLANE_PROJECT}`, "utf8").digest("hex").slice(0, 24)}`, idempotencyKey = `localui:${randomUUID8().replaceAll("-", "")}`, gatePin = { gateId: gate.id, slug: gate.slug, gateVersionId: gateVersion.id, version: gateVersion.version, manifestHash: gateVersion.manifestHash }, suitePin = { suiteId: suite.id, slug: suite.slug, suiteVersionId: suiteVersion.id, version: suiteVersion.version, manifestHash: suiteVersion.manifestHash }, policyPin = { policyId: policy.id, policyVersionId: policyVersion.id, version: policyVersion.version, manifestHash: policyVersion.manifestHash }, runner = { runnerId, type: "LOCAL_UI", runnerVersion: "0.1.0", cliVersion: "ui-0.1.0" }, governedRunMatches = (candidate, targetFingerprint) => {
         if (!object(candidate) || !object(candidate.gate) || !object(candidate.suite) || !object(candidate.policy) || !object(candidate.runner))
           return !1;
         let value = candidate;
@@ -12672,13 +12818,13 @@ ${existing.length ? existing.join(`
     }
   }), app.get("/api/benchmark/history", async (req) => {
     let limit = Math.max(1, Math.min(100, Number(req.query.limit) || 25));
-    return { runs: store.listBenchmarkRuns(benchmarkWorkspaceId(), limit).map((record6) => ({ runId: record6.runId, status: record6.status, planId: record6.plan.planId, planVersion: record6.plan.version, objective: record6.plan.objective, mode: record6.plan.mode, targetType: record6.plan.targetType, summary: record6.summary, createdAt: record6.createdAt, updatedAt: record6.updatedAt })) };
+    return { runs: store.listBenchmarkRuns(benchmarkWorkspaceId(), limit).map((record7) => ({ runId: record7.runId, status: record7.status, planId: record7.plan.planId, planVersion: record7.plan.version, objective: record7.plan.objective, mode: record7.plan.mode, targetType: record7.plan.targetType, summary: record7.summary, createdAt: record7.createdAt, updatedAt: record7.updatedAt })) };
   }), app.get("/api/benchmark/runs/:id", async (req, reply) => {
-    let record6 = store.getBenchmarkRun(req.params.id);
-    return !record6 || record6.workspaceId !== benchmarkWorkspaceId() ? reply.code(404).send({ error: "Benchmark Run not found." }) : { run: record6 };
+    let record7 = store.getBenchmarkRun(req.params.id);
+    return !record7 || record7.workspaceId !== benchmarkWorkspaceId() ? reply.code(404).send({ error: "Benchmark Run not found." }) : { run: record7 };
   }), app.get("/api/benchmark/runs/:id/report.html", async (req, reply) => {
-    let record6 = store.getBenchmarkRun(req.params.id);
-    return !record6 || record6.workspaceId !== benchmarkWorkspaceId() || !record6.reportHtml ? reply.code(404).send({ error: "Benchmark HTML report not found." }) : (reply.header("Content-Disposition", `attachment; filename="benchmark-report-${record6.runId}.html"`), reply.type("text/html; charset=utf-8"), record6.reportHtml);
+    let record7 = store.getBenchmarkRun(req.params.id);
+    return !record7 || record7.workspaceId !== benchmarkWorkspaceId() || !record7.reportHtml ? reply.code(404).send({ error: "Benchmark HTML report not found." }) : (reply.header("Content-Disposition", `attachment; filename="benchmark-report-${record7.runId}.html"`), reply.type("text/html; charset=utf-8"), record7.reportHtml);
   }), app.post("/api/intelligence/execute", async (req, reply) => {
     if (!req.body?.lease)
       return reply.code(400).send({ ok: !1, error: "A hosted Intelligence lease is required." });
@@ -12947,8 +13093,8 @@ ${answer}`
       severity: scanSeverity ?? (evidence.outcome === "fail" ? "high" : void 0)
     } : void 0) ?? evidence, privacy: { rawDataSent: !1, next: "Submit this envelope with the original lease to the hosted Control Plane." } };
   });
-  let tagsFile = () => join4(process.cwd(), DEFAULT_TAGS_FILE), readTagsConfig = (file) => parseTagsConfig(existsSync2(file) ? readFileSync3(file, "utf8") : ""), writeTagsConfig = (file, config) => {
-    mkdirSync2(dirname4(file), { recursive: !0 }), writeFileSync(file, serializeTagsConfig(config));
+  let tagsFile = () => join5(process.cwd(), DEFAULT_TAGS_FILE), readTagsConfig = (file) => parseTagsConfig(existsSync3(file) ? readFileSync4(file, "utf8") : ""), writeTagsConfig = (file, config) => {
+    mkdirSync3(dirname4(file), { recursive: !0 }), writeFileSync2(file, serializeTagsConfig(config));
   };
   app.get("/api/tags", async () => ({ ok: !0, path: DEFAULT_TAGS_FILE, config: readTagsConfig(tagsFile()) })), app.post("/api/tags", async (req, reply) => {
     let plan = await resolvePlan(req);
@@ -12966,21 +13112,21 @@ ${answer}`
     let file = tagsFile(), next = removeTest(readTagsConfig(file), req.params.id);
     return writeTagsConfig(file, next), { ok: !0, path: DEFAULT_TAGS_FILE, config: next };
   });
-  let gatesPath = () => join4(process.cwd(), ".prooflane/gates.json"), validLegacyRegressionGroup = (value) => {
+  let gatesPath = () => join5(process.cwd(), ".prooflane/gates.json"), validLegacyRegressionGroup = (value) => {
     if (!value || typeof value != "object" || Array.isArray(value))
       return !1;
     let gate = value;
     return typeof gate.id == "string" && /^[a-z0-9][a-z0-9_-]{1,63}$/.test(gate.id) && typeof gate.name == "string" && gate.name.trim().length >= 2 && gate.name.length <= 80 && Array.isArray(gate.tags) && gate.tags.length > 0 && gate.tags.length <= 50 && gate.tags.every((tag2) => typeof tag2 == "string" && /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,63}$/.test(tag2)) && typeof gate.minScore == "number" && Number.isFinite(gate.minScore) && gate.minScore >= 0 && gate.minScore <= 100 && typeof gate.repeat == "number" && Number.isInteger(gate.repeat) && gate.repeat >= 1 && gate.repeat <= 10 && typeof gate.deterministicOnly == "boolean" && typeof gate.createdAt == "string" && Number.isFinite(Date.parse(gate.createdAt)) && typeof gate.updatedAt == "string" && Number.isFinite(Date.parse(gate.updatedAt));
   }, readLegacyRegressionGroups = () => {
     try {
-      let parsed = JSON.parse(readFileSync3(gatesPath(), "utf8"));
+      let parsed = JSON.parse(readFileSync4(gatesPath(), "utf8"));
       return parsed.version === "prooflane-gates-v1" && Array.isArray(parsed.gates) ? parsed.gates.filter(validLegacyRegressionGroup) : [];
     } catch {
       return [];
     }
   }, writeLegacyRegressionGroups = (gates) => {
     let file = gatesPath();
-    mkdirSync2(dirname4(file), { recursive: !0 }), writeFileSync(file, JSON.stringify({ version: "prooflane-gates-v1", gates }, null, 2) + `
+    mkdirSync3(dirname4(file), { recursive: !0 }), writeFileSync2(file, JSON.stringify({ version: "prooflane-gates-v1", gates }, null, 2) + `
 `, "utf8");
   };
   app.get("/api/gates", async () => ({ ok: !0, path: ".prooflane/gates.json", gates: readLegacyRegressionGroups() })), app.put("/api/gates/:id", async (req, reply) => {
@@ -13180,7 +13326,7 @@ ${answer}`
       let capabilities = await candidate.adoptConnection(flow.transport, name, origin), registered = mcpManager.registerConnectedRuntime({ workspaceId: PROOFLANE_PROJECT, displayName: name ?? "MCP Server", config: origin, createdBy: actor, entitlement, authMode: "oauth" }, candidate, capabilities);
       return svc = candidate, activeMcpConnectionId = registered.connection.id, activeMcpAuthMode = "oauth", { status: "connected", capabilities, connection: registered.connection };
     }
-    let flowId = randomUUID7();
+    let flowId = randomUUID8();
     return oauthFlows.set(flowId, { status: "pending" }), flow.finish().then((transport) => candidate.adoptConnection(transport, name, origin)).then((capabilities) => {
       let registered = mcpManager.registerConnectedRuntime({ workspaceId: PROOFLANE_PROJECT, displayName: name ?? "MCP Server", config: origin, createdBy: actor, entitlement, authMode: "oauth" }, candidate, capabilities);
       svc = candidate, activeMcpConnectionId = registered.connection.id, activeMcpAuthMode = "oauth", oauthFlows.set(flowId, { status: "connected", capabilities });
@@ -13462,7 +13608,7 @@ ${answer}`
     if (req.body.recordHistory === !1)
       return finish({ ok: !0, report, hostedScan });
     let previous = (() => {
-      let last = svc.listRuns(500).find((record6) => record6.pillar === "rag" && record6.evidence);
+      let last = svc.listRuns(500).find((record7) => record7.pillar === "rag" && record7.evidence);
       if (!last?.evidence)
         return null;
       try {
@@ -13489,10 +13635,10 @@ ${answer}`
     }), diff = previous ? hostedRagScoreDiff(previous, snapshot) : void 0;
     return finish({ ok: !0, report, diff, run, hostedScan });
   }), app.get("/api/rag/hosted-diff/:id", async (req, reply) => {
-    let runs = svc.listRuns(1e3).filter((record6) => record6.pillar === "rag"), index = runs.findIndex((record6) => record6.id === req.params.id);
+    let runs = svc.listRuns(1e3).filter((record7) => record7.pillar === "rag"), index = runs.findIndex((record7) => record7.id === req.params.id);
     if (index === -1)
       return reply.code(404).send({ ok: !1, error: "Run not found." });
-    let current = runs[index], previous = runs.slice(index + 1).find((record6) => record6.evidence);
+    let current = runs[index], previous = runs.slice(index + 1).find((record7) => record7.evidence);
     if (!current.evidence || !previous?.evidence)
       return { ok: !0, diff: null };
     try {
@@ -13701,7 +13847,7 @@ Assertions must be objectively checkable against the tool's JSON response. Never
   });
   function pushStudioEvent(session, turnId, type, payload) {
     let event = {
-      id: `ev-${randomUUID7().slice(0, 8)}`,
+      id: `ev-${randomUUID8().slice(0, 8)}`,
       sessionId: session.id,
       turnId,
       sequence: ++session.sequence,
@@ -13724,7 +13870,7 @@ Assertions must be objectively checkable against the tool's JSON response. Never
   };
   app.post("/api/prompt-studio/sessions", async (req) => {
     let body = req.body ?? {}, now = (/* @__PURE__ */ new Date()).toISOString(), session = {
-      id: `ps-${randomUUID7().slice(0, 8)}`,
+      id: `ps-${randomUUID8().slice(0, 8)}`,
       name: (body.name ?? "").trim().slice(0, 120) || `Session ${(/* @__PURE__ */ new Date()).toLocaleString()}`,
       createdAt: now,
       updatedAt: now,
@@ -14006,8 +14152,8 @@ Assertions must be objectively checkable against the tool's JSON response. Never
     let oldest = Date.now() - plan.historyDays * 24 * 60 * 60 * 1e3;
     return runs.filter((run) => Date.parse(run.createdAt) >= oldest);
   });
-  let uiDist = process.env.KAWACH_UI_DIST ?? join4(__dirname, "../../ui/dist");
-  return existsSync2(uiDist) && (app.register(fastifyStatic, { root: uiDist }), app.setNotFoundHandler((req, reply) => {
+  let uiDist = process.env.KAWACH_UI_DIST ?? join5(__dirname, "../../ui/dist");
+  return existsSync3(uiDist) && (app.register(fastifyStatic, { root: uiDist }), app.setNotFoundHandler((req, reply) => {
     if (req.url.startsWith("/api")) {
       reply.code(404).send({ error: "Not found" });
       return;