@akasecurity/cli 0.8.1 → 0.8.2

package/web-ui/web-ui/.next/server/chunks/116.js

@@ -1,536 +0,0 @@
-"use strict";exports.id=116,exports.ids=[116],exports.modules={37906:(a,b,c)=>{c.d(b,{S8C:()=>y,hxQ:()=>ao,Itg:()=>ad,RRF:()=>a1,ZpU:()=>a3,HUb:()=>a0,unw:()=>aX,goN:()=>N,Jr:()=>a4,V8B:()=>aI,IgC:()=>aZ,aIg:()=>cg,iRC:()=>aJ,GCf:()=>E,TUN:()=>O,SHn:()=>au,rov:()=>bF,V0H:()=>a_,PEm:()=>aW,cqq:()=>F,jON:()=>aS,lFU:()=>d,PhW:()=>ab,uQz:()=>bE,BIx:()=>aq,hd_:()=>bG,tXp:()=>by,plk:()=>bt,mAj:()=>bw,Fnc:()=>cx,ryv:()=>r,tTV:()=>aa,rG:()=>bB,q_t:()=>p,i1j:()=>bH,xog:()=>bv,hzO:()=>cz,by7:()=>cy,Gw9:()=>cv,q11:()=>h,U7X:()=>w,y_0:()=>cw,I8t:()=>g,DhA:()=>a5,WSs:()=>cC,a45:()=>br,N6N:()=>f,A6E:()=>bA,pnU:()=>bs,V9M:()=>bM,$BP:()=>bN,yaP:()=>bI,zw:()=>bJ,JAl:()=>bO,$3l:()=>bP,gzP:()=>bK,QCA:()=>bL,C05:()=>cA});let d=[{tag:"0000_acoustic_felicia_hardy",sql:"CREATE TABLE `audit_events` (\n	`id` text PRIMARY KEY NOT NULL,\n	`parent_id` text,\n	`root_session_id` text,\n	`event_type` text NOT NULL,\n	`host_id` text,\n	`harness_id` text,\n	`source_project_id` text,\n	`started_at` integer NOT NULL,\n	`ended_at` integer,\n	`severity` text,\n	`priority` text,\n	`content` text,\n	`content_hash` text,\n	`attributes` text,\n	FOREIGN KEY (`parent_id`) REFERENCES `audit_events`(`id`) ON UPDATE no action ON DELETE no action,\n	FOREIGN KEY (`root_session_id`) REFERENCES `audit_events`(`id`) ON UPDATE no action ON DELETE no action,\n	FOREIGN KEY (`host_id`) REFERENCES `inventory`(`id`) ON UPDATE no action ON DELETE no action,\n	FOREIGN KEY (`harness_id`) REFERENCES `inventory`(`id`) ON UPDATE no action ON DELETE no action,\n	FOREIGN KEY (`source_project_id`) REFERENCES `source_project`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_audit_parent` ON `audit_events` (`parent_id`);--\x3e statement-breakpoint\nCREATE INDEX `idx_audit_session` ON `audit_events` (`root_session_id`,`started_at`);--\x3e statement-breakpoint\nCREATE INDEX `idx_audit_harness_t` ON `audit_events` (`harness_id`,`started_at`);--\x3e statement-breakpoint\nCREATE INDEX `idx_audit_project_t` ON `audit_events` (`source_project_id`,`started_at`);--\x3e statement-breakpoint\nCREATE TABLE `classified_data` (\n	`id` text PRIMARY KEY NOT NULL,\n	`class` text NOT NULL,\n	`label` text,\n	`attributes` text\n);\n--\x3e statement-breakpoint\nCREATE TABLE `events` (\n	`id` text PRIMARY KEY NOT NULL,\n	`source_tool` text NOT NULL,\n	`kind` text NOT NULL,\n	`occurred_at` integer NOT NULL,\n	`content_hash` text NOT NULL,\n	`content` text NOT NULL,\n	`metadata` text\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_events_occurred` ON `events` (`occurred_at`);--\x3e statement-breakpoint\nCREATE TABLE `findings` (\n	`id` text PRIMARY KEY NOT NULL,\n	`event_id` text NOT NULL,\n	`rule_id` text NOT NULL,\n	`category` text NOT NULL,\n	`severity` text NOT NULL,\n	`span_start` integer NOT NULL,\n	`span_end` integer NOT NULL,\n	`masked_match` text NOT NULL,\n	`action_taken` text NOT NULL,\n	`confidence` real NOT NULL,\n	FOREIGN KEY (`event_id`) REFERENCES `events`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_findings_event` ON `findings` (`event_id`);--\x3e statement-breakpoint\nCREATE TABLE `inspection_definitions` (\n	`id` text PRIMARY KEY NOT NULL,\n	`rule_id` text NOT NULL,\n	`name` text NOT NULL,\n	`category` text NOT NULL,\n	`severity` text NOT NULL,\n	`definition` text NOT NULL,\n	`version` text NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE TABLE `inspection_findings` (\n	`id` text PRIMARY KEY NOT NULL,\n	`audit_event_id` text NOT NULL,\n	`inspection_definition_id` text NOT NULL,\n	`classified_data_id` text,\n	`span_start` integer NOT NULL,\n	`span_end` integer NOT NULL,\n	`masked_match` text NOT NULL,\n	`action_taken` text NOT NULL,\n	`confidence` real NOT NULL,\n	FOREIGN KEY (`audit_event_id`) REFERENCES `audit_events`(`id`) ON UPDATE no action ON DELETE no action,\n	FOREIGN KEY (`inspection_definition_id`) REFERENCES `inspection_definitions`(`id`) ON UPDATE no action ON DELETE no action,\n	FOREIGN KEY (`classified_data_id`) REFERENCES `classified_data`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_inspection_findings_event` ON `inspection_findings` (`audit_event_id`);--\x3e statement-breakpoint\nCREATE TABLE `installed_packs` (\n	`id` text PRIMARY KEY NOT NULL,\n	`namespace` text NOT NULL,\n	`pack_id` text NOT NULL,\n	`version` text NOT NULL,\n	`name` text NOT NULL,\n	`rules_json` text NOT NULL,\n	`enabled` integer DEFAULT true NOT NULL,\n	`policy_id` text,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_installed_packs_pack` ON `installed_packs` (`namespace`,`pack_id`);--\x3e statement-breakpoint\nCREATE TABLE `inventory` (\n	`id` text PRIMARY KEY NOT NULL,\n	`object_type` text NOT NULL,\n	`location` text,\n	`title` text,\n	`host_id` text,\n	`attributes` text NOT NULL,\n	`os_version` text GENERATED ALWAYS AS (json_extract(attributes, '$.os_version')) VIRTUAL,\n	`harness_version` text GENERATED ALWAYS AS (json_extract(attributes, '$.harness_version')) VIRTUAL,\n	`first_seen` integer NOT NULL,\n	`last_seen` integer NOT NULL,\n	FOREIGN KEY (`host_id`) REFERENCES `inventory`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_inventory_type` ON `inventory` (`object_type`);--\x3e statement-breakpoint\nCREATE INDEX `idx_inventory_type_osver` ON `inventory` (`object_type`,`os_version`);--\x3e statement-breakpoint\nCREATE INDEX `idx_inventory_type_harnessver` ON `inventory` (`object_type`,`harness_version`);--\x3e statement-breakpoint\nCREATE TABLE `policies` (\n	`id` text PRIMARY KEY NOT NULL,\n	`scope` text DEFAULT 'global' NOT NULL,\n	`target` text NOT NULL,\n	`action` text NOT NULL,\n	`enabled` integer DEFAULT true NOT NULL,\n	`custom_keywords` text,\n	`name` text,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_policies_scope_target` ON `policies` (`scope`,`target`);--\x3e statement-breakpoint\nCREATE TABLE `source_project` (\n	`id` text PRIMARY KEY NOT NULL,\n	`url` text,\n	`name` text,\n	`attributes` text NOT NULL,\n	`first_seen` integer NOT NULL,\n	`last_seen` integer NOT NULL\n);\n"},{tag:"0001_adorable_marten_broadcloak",sql:"ALTER TABLE `audit_events` ADD `input_tokens` integer GENERATED ALWAYS AS (json_extract(attributes, '$.input_tokens')) VIRTUAL;--\x3e statement-breakpoint\nALTER TABLE `audit_events` ADD `output_tokens` integer GENERATED ALWAYS AS (json_extract(attributes, '$.output_tokens')) VIRTUAL;--\x3e statement-breakpoint\nALTER TABLE `audit_events` ADD `cache_creation_input_tokens` integer GENERATED ALWAYS AS (json_extract(attributes, '$.cache_creation_input_tokens')) VIRTUAL;--\x3e statement-breakpoint\nALTER TABLE `audit_events` ADD `cache_read_input_tokens` integer GENERATED ALWAYS AS (json_extract(attributes, '$.cache_read_input_tokens')) VIRTUAL;--\x3e statement-breakpoint\nALTER TABLE `audit_events` ADD `model` text GENERATED ALWAYS AS (json_extract(attributes, '$.model')) VIRTUAL;--\x3e statement-breakpoint\nALTER TABLE `audit_events` ADD `provider` text GENERATED ALWAYS AS (json_extract(attributes, '$.provider')) VIRTUAL;--\x3e statement-breakpoint\nCREATE INDEX `idx_audit_session_type` ON `audit_events` (`root_session_id`,`started_at`) WHERE event_type = 'llm_call';"},{tag:"0002_groovy_big_bertha",sql:"CREATE TABLE `exceptions` (\n	`id` text PRIMARY KEY NOT NULL,\n	`rule_id` text NOT NULL,\n	`category` text NOT NULL,\n	`value_fingerprint` text NOT NULL,\n	`key_version` integer NOT NULL,\n	`masked_value` text NOT NULL,\n	`scope` text NOT NULL,\n	`expires_at` integer,\n	`max_uses` integer,\n	`use_count` integer DEFAULT 0 NOT NULL,\n	`last_used_at` integer,\n	`justification` text NOT NULL,\n	`conditions` text,\n	`created_by` text NOT NULL,\n	`created_via` text NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL,\n	`revoked_at` integer,\n	`revoked_by` text,\n	`revoke_reason` text\n);\n--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_exceptions_active` ON `exceptions` (`rule_id`,`value_fingerprint`,`key_version`) WHERE revoked_at IS NULL;"},{tag:"0003_rich_sage",sql:"CREATE TABLE `egress_decision_override` (\n	`id` text PRIMARY KEY NOT NULL,\n	`destination_id` text NOT NULL,\n	`decision` text NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL,\n	FOREIGN KEY (`destination_id`) REFERENCES `share_destination`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_egress_decision_override` ON `egress_decision_override` (`destination_id`);--\x3e statement-breakpoint\nCREATE TABLE `file_access_override` (\n	`id` text PRIMARY KEY NOT NULL,\n	`project_id` text NOT NULL,\n	`path` text NOT NULL,\n	`access` text NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL,\n	FOREIGN KEY (`project_id`) REFERENCES `source_project`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_file_access_override_project` ON `file_access_override` (`project_id`);--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_file_access_override` ON `file_access_override` (`project_id`,`path`);--\x3e statement-breakpoint\nCREATE TABLE `harness_asset` (\n	`id` text PRIMARY KEY NOT NULL,\n	`harness_id` text NOT NULL,\n	`asset_id` text NOT NULL,\n	`created_at` integer NOT NULL,\n	FOREIGN KEY (`harness_id`) REFERENCES `inventory`(`id`) ON UPDATE no action ON DELETE no action,\n	FOREIGN KEY (`asset_id`) REFERENCES `inventory_asset`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_harness_asset_harness` ON `harness_asset` (`harness_id`);--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_harness_asset` ON `harness_asset` (`harness_id`,`asset_id`);--\x3e statement-breakpoint\nCREATE TABLE `inventory_asset` (\n	`id` text PRIMARY KEY NOT NULL,\n	`asset_type` text NOT NULL,\n	`name` text NOT NULL,\n	`sub` text,\n	`description` text,\n	`flags_json` text DEFAULT '[]' NOT NULL,\n	`meta_json` text DEFAULT '{}' NOT NULL,\n	`trust` text,\n	`tools_json` text,\n	`provenance` text DEFAULT 'scan' NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_inventory_asset_type` ON `inventory_asset` (`asset_type`);--\x3e statement-breakpoint\nCREATE TABLE `mcp_trust_override` (\n	`id` text PRIMARY KEY NOT NULL,\n	`asset_id` text NOT NULL,\n	`trust` text NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL,\n	FOREIGN KEY (`asset_id`) REFERENCES `inventory_asset`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_mcp_trust_override` ON `mcp_trust_override` (`asset_id`);--\x3e statement-breakpoint\nCREATE TABLE `project_file` (\n	`id` text PRIMARY KEY NOT NULL,\n	`project_id` text NOT NULL,\n	`path` text NOT NULL,\n	`name` text NOT NULL,\n	`origin` text NOT NULL,\n	`default_access` text NOT NULL,\n	`findings_count` integer DEFAULT 0 NOT NULL,\n	`blocked_at` integer,\n	`note` text,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL,\n	FOREIGN KEY (`project_id`) REFERENCES `source_project`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_project_file_project` ON `project_file` (`project_id`);--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_project_file` ON `project_file` (`project_id`,`path`);--\x3e statement-breakpoint\nCREATE TABLE `share_call_site` (\n	`id` text PRIMARY KEY NOT NULL,\n	`endpoint_id` text NOT NULL,\n	`project` text NOT NULL,\n	`file` text NOT NULL,\n	`line` integer NOT NULL,\n	`snippet` text NOT NULL,\n	`dynamic` integer DEFAULT false NOT NULL,\n	`vendored` integer DEFAULT false NOT NULL,\n	`project_id` text,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL,\n	FOREIGN KEY (`endpoint_id`) REFERENCES `share_endpoint`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_share_call_site_endpoint` ON `share_call_site` (`endpoint_id`);--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_share_call_site` ON `share_call_site` (`endpoint_id`,`project`,`file`,`line`);--\x3e statement-breakpoint\nCREATE TABLE `share_destination` (\n	`id` text PRIMARY KEY NOT NULL,\n	`kind` text NOT NULL,\n	`name` text NOT NULL,\n	`host` text NOT NULL,\n	`category` text NOT NULL,\n	`trust` text NOT NULL,\n	`note` text,\n	`network_json` text,\n	`last_seen` integer NOT NULL,\n	`provenance` text DEFAULT 'scan' NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_share_destination_kind` ON `share_destination` (`kind`);--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_share_destination_host` ON `share_destination` (`host`);--\x3e statement-breakpoint\nCREATE TABLE `share_endpoint` (\n	`id` text PRIMARY KEY NOT NULL,\n	`destination_id` text NOT NULL,\n	`method` text NOT NULL,\n	`transport` text NOT NULL,\n	`url` text NOT NULL,\n	`template` integer DEFAULT false NOT NULL,\n	`data_class` text NOT NULL,\n	`last_seen` integer NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL,\n	FOREIGN KEY (`destination_id`) REFERENCES `share_destination`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_share_endpoint_dest` ON `share_endpoint` (`destination_id`);--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_share_endpoint` ON `share_endpoint` (`destination_id`,`method`,`url`);"},{tag:"0004_glorious_mindworm",sql:"CREATE TABLE `available_packs` (\n	`id` text PRIMARY KEY NOT NULL,\n	`namespace` text NOT NULL,\n	`pack_id` text NOT NULL,\n	`version` text NOT NULL,\n	`name` text NOT NULL,\n	`rules_json` text NOT NULL,\n	`updated_at` integer NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_available_packs_pack` ON `available_packs` (`namespace`,`pack_id`);"},{tag:"0005_fast_vindicator",sql:'PRAGMA foreign_keys=OFF;--\x3e statement-breakpoint\nCREATE TABLE `__new_mcp_trust_override` (\n	`id` text PRIMARY KEY NOT NULL,\n	`asset_id` text NOT NULL,\n	`trust` text NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL\n);\n--\x3e statement-breakpoint\nINSERT INTO `__new_mcp_trust_override`("id", "asset_id", "trust", "created_at", "updated_at") SELECT "id", "asset_id", "trust", "created_at", "updated_at" FROM `mcp_trust_override`;--\x3e statement-breakpoint\nDROP TABLE `mcp_trust_override`;--\x3e statement-breakpoint\nALTER TABLE `__new_mcp_trust_override` RENAME TO `mcp_trust_override`;--\x3e statement-breakpoint\nPRAGMA foreign_keys=ON;--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_mcp_trust_override` ON `mcp_trust_override` (`asset_id`);'},{tag:"0006_magenta_flatman",sql:'CREATE TABLE `_pack_write_gate` (\n	`id` integer PRIMARY KEY NOT NULL,\n	`open` integer DEFAULT 0 NOT NULL,\n	CONSTRAINT "ck_pack_write_gate_single_row" CHECK("_pack_write_gate"."id" = 1)\n);\n--\x3e statement-breakpoint\nALTER TABLE `available_packs` ADD `recorded_by` text;--\x3e statement-breakpoint\nINSERT OR IGNORE INTO _pack_write_gate (id, open) VALUES (1, 0);\n--\x3e statement-breakpoint\nCREATE TRIGGER trg_installed_packs_write_gate\nBEFORE UPDATE OF version, name, rules_json ON installed_packs\nWHEN (SELECT open FROM _pack_write_gate WHERE id = 1) IS NOT 1\nBEGIN SELECT RAISE(IGNORE); END;'},{tag:"0007_thick_stick",sql:"CREATE TABLE `finding_resolution` (\n	`id` text PRIMARY KEY NOT NULL,\n	`finding_key` text NOT NULL,\n	`status` text NOT NULL,\n	`method` text NOT NULL,\n	`resolved_at` integer NOT NULL,\n	`evidence` text,\n	`created_at` integer NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_finding_resolution_key` ON `finding_resolution` (`finding_key`);--\x3e statement-breakpoint\nALTER TABLE `findings` ADD `finding_key` text;--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_findings_key` ON `findings` (`finding_key`);"},{tag:"0008_freezing_selene",sql:"ALTER TABLE `findings` ADD `first_detected_at` integer;--\x3e statement-breakpoint\nUPDATE `findings` SET `first_detected_at` = (SELECT `occurred_at` FROM `events` WHERE `events`.`id` = `findings`.`event_id`) WHERE `first_detected_at` IS NULL;"},{tag:"0009_findings_path_expression_index",sql:"-- Custom migration: partial expression index for the resolver's per-path reads.\n--\n-- openAtRestKeysForPath / resolvedAtRestKeysForPath (and the scanner's tier-3\n-- open-key probe) filter at-rest events by\n--   e.kind = 'code_change' AND json_extract(e.metadata, '$.filePath') = :path\n-- once per changed/deleted file on every scan — previously a full events scan\n-- per file. json_extract is deterministic, so SQLite allows it in an index;\n-- the WHERE kind = 'code_change' keeps the index to exactly the rows those\n-- queries can match (in-flight events are never path-addressed).\nCREATE INDEX `idx_events_code_change_path` ON `events` (json_extract(`metadata`, '$.filePath')) WHERE `kind` = 'code_change';\n"}],e=/^(\d+)([mh])$/;function f(a,b=Date.now()){let c=a.trim().toLowerCase();return"once"===c?{scope:"once",expiresAt:new Date(b+18e5).toISOString(),maxUses:1}:"permanent"===c?{scope:"permanent",expiresAt:null,maxUses:null}:{scope:"temporary",expiresAt:new Date(b+function(a){let b=e.exec(a.trim()),c=b?Number(b[1]):0;if(!b||c<=0)throw Error(`invalid duration '${a}' — use <n>m or <n>h (e.g. 30m, 1h, 24h)`);let d=c*("h"===b[2]?36e5:6e4);if(d>864e5)throw Error(`duration '${a}' exceeds the 24h maximum for --for — use --permanent (revocable any time) for an open-ended grant`);return d}(c)).toISOString(),maxUses:null}}function g(a){return new Date(a).getTime()}function h(a){return new Date(a).toISOString()}function i(a,b){return{input:a,output:b,cacheWrite5m:1.25*a,cacheWrite1h:2*a,cacheRead:.1*a,webSearch:.01}}let j={input:0,output:0,cacheWrite5m:0,cacheWrite1h:0,cacheRead:0,webSearch:0},k={"claude-fable-5":i(10,50),"claude-opus-4-8":i(5,25),"claude-opus-4-7":i(5,25),"claude-opus-4-6":i(5,25),"claude-opus-4-5":i(5,25),"claude-sonnet-5":i(3,15),"claude-sonnet-4-6":i(3,15),"claude-sonnet-4-5":i(3,15),"claude-haiku-4-5":i(1,5)},l={...Object.fromEntries(Object.entries(k).map(([a,b])=>[`anthropic/${a}`,b])),"ollama/*":j,"local/*":j},m={standard:1,batch:.5,priority:1.5},n=Object.keys(k);function o(a){let b=a.replace(/^(us|eu|apac|global)\./,"").replace(/^anthropic[./]/,"").replace(/@[\w-]+$/,"").replace(/-v\d+:\d+$/,"").replace(/:\d+$/,"").replace(/-\d{8}$/,"");for(let a of n)if(b===a)return a;return b}let p={normalizeModelId(a,b){let c=a.trim().toLowerCase();if("ollama"===c||"local"===c)return{provider:c,model:"*"};if("anthropic"===c||"bedrock"===c||"vertex"===c)return{provider:c,model:o(b)};let d=/^anthropic\/(.+)$/.exec(b);return d?.[1]!==void 0?{provider:c,model:o(d[1])}:{provider:c,model:b}},costFor({provider:a,model:b,usage:c}){var d;let e=this.normalizeModelId(a,b),f=l[`${e.provider}/${e.model}`];return void 0===f?null:((c.inputTokens??0)*f.input+(c.outputTokens??0)*f.output+(c.cacheWrite1hTokens??0)*f.cacheWrite1h+(c.cacheWrite5mTokens??0)*f.cacheWrite5m+(c.cacheReadTokens??0)*f.cacheRead)/1e6*(void 0===(d=c.serviceTier)?1:m[d]??1)+(c.webSearchRequests??0)*f.webSearch}},q=a=>a??0;function r(a,b){let c=new Map;for(let{sessionId:d,attributes:e}of a){let a=e.provider??"unknown",f=e.model??"unknown",g=`${a} ${f}`,h=c.get(d);void 0===h&&(h=new Map,c.set(d,h));let i=h.get(g);void 0===i&&(i={provider:a,model:f,input:0,output:0,cacheCreation:0,cacheRead:0,costUsd:0,priced:!1},h.set(g,i)),i.input+=q(e.input_tokens),i.output+=q(e.output_tokens),i.cacheCreation+=q(e.cache_creation_input_tokens),i.cacheRead+=q(e.cache_read_input_tokens);let j=b.costFor({provider:a,model:f,usage:function(a){let b={inputTokens:q(a.input_tokens),outputTokens:q(a.output_tokens),cacheWrite1hTokens:q(a.ephemeral_1h_input_tokens),cacheWrite5mTokens:q(a.ephemeral_5m_input_tokens),cacheReadTokens:q(a.cache_read_input_tokens),webSearchRequests:q(a.web_search_requests)};return void 0!==a.service_tier&&(b.serviceTier=a.service_tier),b}(e)});null!==j&&(i.costUsd+=j,i.priced=!0)}let d=[];for(let[a,b]of c){let c=[],e=0,f=0,g=!1,h=!1;for(let d of b.values()){let b=d.input+d.output+d.cacheCreation+d.cacheRead;e+=b;let i=d.priced?d.costUsd:null;null===i?h=!0:(g=!0,f+=i),c.push({sessionId:a,model:d.model,provider:d.provider,inputTokens:d.input,outputTokens:d.output,cacheCreation:d.cacheCreation,cacheRead:d.cacheRead,totalTokens:b,estimatedCostUsd:i})}c.sort((a,b)=>b.totalTokens-a.totalTokens),d.push({sessionId:a,rollups:c,totalTokens:e,estimatedCostUsd:g?f:null,costIsPartial:h})}return d.sort((a,b)=>b.totalTokens-a.totalTokens),d}var s=c(96046),t=c(74516),u=c(24054);let v=s.k5(["pii","financial","secret","phi","code_context","code_flaw","custom","config"]).meta({id:"DetectionCategory"}),w=s.k5(["critical","high","medium","low"]).meta({id:"Severity"}),x=s.k5(["warn","redact","block","allow","log"]).meta({id:"ActionTaken"}),y=x.options,z=s.Ik({start:s.ai().int().nonnegative(),end:s.ai().int().nonnegative()}).meta({id:"Span"}),A=s.Ik({id:s.Os(),eventId:s.Os(),ruleId:s.Yj(),category:v,severity:w,span:z,maskedMatch:s.Yj(),actionTaken:x,confidence:s.ai().min(0).max(1)}).meta({id:"Finding"});A.meta({id:"DetectedFinding"});let B=s.k5(["blocked","redacted","warned","allowed","quarantined","monitored"]).meta({id:"FindingAction"}),C=s.k5(["claudecode","claudedesktop","cursor","copilot","chatgpt","api"]).meta({id:"FindingProvider"}),D=s.k5(["secret","pii","source_code","external_share","mcp_server","customer_data","financial","phi","custom"]).meta({id:"FindingCategory"});s.k5(["in-flight","at-rest"]).meta({id:"FindingOrigin"});let E=s.k5(["open","handled","resolved","dismissed"]).meta({id:"FindingStatus"}),F=s.k5(["enforced-in-flight","fixed-at-source","exception","acknowledged","false-positive","redetected"]).meta({id:"ResolutionMethod"}),G=s.Ik({maskedValue:s.Yj(),contextPrefix:s.Yj()}).meta({id:"FindingMatch"}),H=s.Ik({id:s.Yj(),name:s.Yj().nullable()}).meta({id:"FindingDetectionRef"}),I=s.Ik({id:s.Yj(),name:s.Yj()}).meta({id:"FindingPolicyRef"}),J=s.Ik({id:s.Yj(),provider:C,repo:s.Yj(),file:s.Yj(),action:B,detectedAt:t.w$(),confidence:s.ai().min(0).max(1),status:E.optional()}).meta({id:"FindingInstance"}),K=s.Ik({id:s.Yj(),category:D,subtype:s.Yj(),severity:w,match:G,detection:H,policy:I,instanceCount:s.ai().int().nonnegative(),providers:s.YO(C),aggregateAction:B.nullable(),latestDetectedAt:t.w$(),instances:s.YO(J),status:E.optional()}).meta({id:"FindingGroup"});s.Ik({findings:s.ai().int().nonnegative(),groups:s.ai().int().nonnegative(),bySeverity:s.Ik({critical:s.ai().int().nonnegative(),high:s.ai().int().nonnegative(),medium:s.ai().int().nonnegative(),low:s.ai().int().nonnegative()})}).meta({id:"FindingStats"});let L=s.Ik({value:s.Yj(),count:s.ai().int().nonnegative()}).meta({id:"FindingFacetItem"}),M=s.Ik({severity:s.YO(L),subtype:s.YO(L),provider:s.YO(L),action:s.YO(L)}).meta({id:"FindingFacets"}),N=50;s.Ik({severity:s.YO(w).optional(),subtype:s.YO(s.Yj()).optional(),provider:s.YO(C).optional(),action:s.YO(B).optional(),q:s.Yj().optional(),groupBy:s.eu("type").optional(),limit:u.ai().int().min(1).max(100).optional(),cursor:s.Yj().optional()}),s.Ik({totals:s.Ik({findings:s.ai().int().nonnegative(),groups:s.ai().int().nonnegative()}),facets:M,items:s.YO(K),nextCursor:s.Yj().nullable()}).meta({id:"ListGroupedFindingsResponse"}),s.Ik({action:B.exclude(["quarantined"]),instanceId:s.Yj().optional()}).meta({id:"ApplyFindingActionRequest"}),K.meta({id:"ApplyFindingActionResponse"}),s.Ik({severity:s.YO(w).optional(),subtype:s.YO(s.Yj()).optional(),provider:s.YO(C).optional(),action:s.YO(B).optional(),q:s.Yj().optional(),format:s.k5(["csv","json"]).optional()}),J.extend({groupId:s.Yj(),category:D,subtype:s.Yj(),severity:w,match:G,detection:H,policy:I}).meta({id:"FindingInstanceDetail"});let O=s.k5(["claudecode","cursor","copilot","codex","windsurf","claudedesktop","chatgpt","api"]).meta({id:"Harness"}),P={"claude-code":"claudecode","claude-desktop":"claudedesktop","github-copilot":"copilot",cursor:"cursor",chatgpt:"chatgpt"},Q=s.k5(["host","harness","user","skill","hook","mcp_server","config_file"]).meta({id:"InventoryObjectType"}),R=s.k5(["session","run","tool_call","llm_call","source_lookup","prompt","response","code_change","config_scan"]).meta({id:"AuditEventType"}),S=s.g1(s.Yj(),s.L5());s.Ik({host_name:s.Yj().optional(),os:s.Yj().optional(),os_version:s.Yj().optional(),arch:s.Yj().optional()}).catchall(s.L5()),s.Ik({harness_version:s.Yj().optional(),interface:s.Yj().optional()}).catchall(s.L5()),s.Ik({display_name:s.Yj().optional(),email:s.Yj().optional()}).catchall(s.L5()),s.Ik({source:s.Yj().optional(),version:s.Yj().optional(),description:s.Yj().optional(),updated_at:s.Yj().optional(),scope:s.Yj().optional(),plugin_name:s.Yj().optional()}).catchall(s.L5()),s.Ik({event:s.Yj().optional(),matcher:s.Yj().optional(),command:s.Yj().optional(),scope:s.Yj().optional(),plugin_name:s.Yj().optional(),timeout:s.ai().optional()}).catchall(s.L5()),s.Ik({scope:s.Yj().optional(),transport:s.Yj().optional(),command:s.Yj().optional(),url:s.Yj().optional(),env_keys:s.YO(s.Yj()).optional(),plugin_name:s.Yj().optional(),marketplace:s.Yj().optional(),project:s.Yj().optional()}).catchall(s.L5()),s.Ik({kind:s.Yj().optional(),detail:s.Yj().optional(),scope:s.Yj().optional(),updated_at:s.Yj().optional(),entry_count:s.ai().optional()}).catchall(s.L5());let T=s.Ik({model:s.Yj().optional(),provider:s.Yj().optional(),input_tokens:s.ai().int().nonnegative().optional(),output_tokens:s.ai().int().nonnegative().optional(),cache_creation_input_tokens:s.ai().int().nonnegative().optional(),cache_read_input_tokens:s.ai().int().nonnegative().optional(),ephemeral_1h_input_tokens:s.ai().int().nonnegative().optional(),ephemeral_5m_input_tokens:s.ai().int().nonnegative().optional(),web_search_requests:s.ai().int().nonnegative().optional(),web_fetch_requests:s.ai().int().nonnegative().optional(),service_tier:s.Yj().optional(),stop_reason:s.Yj().optional(),message_id:s.Yj().optional(),uuid:s.Yj().optional(),parent_uuid:s.Yj().optional(),run_key:s.Yj().optional()}).catchall(s.L5());s.Ik({sessionId:s.Yj().min(1),messageId:s.Yj().min(1),parentId:s.Yj().min(1),rootSessionId:s.Yj().min(1),startedAt:t.w$(),attributes:T});let U=s.Ik({tool_name:s.Yj().optional(),tool_use_id:s.Yj().optional(),target:s.Yj().optional(),is_error:s.zM().optional(),input_size:s.ai().int().nonnegative().optional(),output_size:s.ai().int().nonnegative().optional(),uuid:s.Yj().optional(),parent_uuid:s.Yj().optional(),run_key:s.Yj().optional()}).catchall(s.L5()),V=s.Ik({ruleId:s.Yj().min(1),ruleName:s.Yj(),ruleVersion:s.Yj().min(1),category:v,severity:w,span:z,maskedMatch:s.Yj(),actionTaken:x,confidence:s.ai().min(0).max(1)});s.Ik({sessionId:s.Yj().min(1),toolUseId:s.Yj().min(1),parentId:s.Yj().min(1),rootSessionId:s.Yj().min(1),startedAt:t.w$(),attributes:U,inspections:s.YO(V).default([])});let W=s.Ik({objectType:Q,identityKey:s.Yj().min(1),location:s.Yj().optional(),title:s.Yj().optional(),hostId:s.Yj().optional(),attributes:S.default({})}).meta({id:"InventoryInput"}),X=s.Ik({url:s.Yj().min(1),name:s.Yj().optional(),attributes:S.default({})}).meta({id:"SourceProjectInput"}),Y=s.Ik({id:s.Yj().min(1),eventType:R,startedAt:t.w$(),endedAt:t.w$().optional(),parentId:s.Yj().optional(),rootSessionId:s.Yj().optional(),hostId:s.Yj().optional(),harnessId:s.Yj().optional(),sourceProjectId:s.Yj().optional(),severity:w.optional(),priority:s.Yj().optional(),content:s.Yj().optional(),contentHash:s.Yj().optional(),attributes:S.optional()}).meta({id:"AuditEventInput"});s.Ik({class:s.Yj().min(1),label:s.Yj().optional(),attributes:S.optional()});let Z=s.Ik({ruleId:s.Yj().min(1),version:s.Yj().min(1),name:s.Yj(),category:v,severity:w,definition:s.Yj()});s.Ik({id:s.Yj().min(1),auditEventId:s.Yj().min(1),inspectionDefinitionId:s.Yj().min(1),classifiedDataId:s.Yj().optional(),span:z,maskedMatch:s.Yj(),actionTaken:x,confidence:s.ai().min(0).max(1)}),s.Ik({host:W.optional(),harness:W.optional(),project:X.optional()}).meta({id:"InventoryContext"}),s.Ik({hostId:s.Yj().optional(),harnessId:s.Yj().optional(),accountId:s.Yj().optional(),sourceProjectId:s.Yj().optional()}).meta({id:"ResolvedInventory"}),s.Ik({hosts:s.YO(s.Yj()),harnesses:s.YO(s.Yj()),osVersions:s.YO(s.Yj()),projects:s.YO(s.Yj())}).meta({id:"InventoryFacets"});let $=s.Ik({sessionId:s.Yj(),model:s.Yj(),provider:s.Yj(),inputTokens:s.ai().int().nonnegative(),outputTokens:s.ai().int().nonnegative(),cacheCreation:s.ai().int().nonnegative(),cacheRead:s.ai().int().nonnegative(),totalTokens:s.ai().int().nonnegative(),estimatedCostUsd:s.ai().nullable()}).meta({id:"TokenRollup"});s.Ik({sessionId:s.Yj(),rollups:s.YO($),totalTokens:s.ai().int().nonnegative(),estimatedCostUsd:s.ai().nullable(),costIsPartial:s.zM()});let _=s.Ik({provider:s.Yj(),model:s.Yj(),inputTokens:s.ai().int().nonnegative(),outputTokens:s.ai().int().nonnegative(),cacheTokens:s.ai().int().nonnegative(),totalTokens:s.ai().int().nonnegative(),estimatedCostUsd:s.ai().nullable()});function aa(a){return JSON.stringify(a)}s.Ik({models:s.YO(_),sessionCount:s.ai().int().nonnegative(),totalTokens:s.ai().int().nonnegative(),estimatedCostUsd:s.ai(),costIsPartial:s.zM()});let ab=s.k5(["active","completed","interrupted","error"]),ac=s.k5(["session","prompt","response","tool","hook","detection","share","permission","commit","error","active"]),ad=s.k5(["detections","shares","inventory"]),ae=s.Ik({id:s.Yj(),occurredAt:t.w$(),kind:ac,title:s.Yj(),detail:s.Yj(),tool:s.Yj().nullable(),severity:w.nullable(),link:ad.nullable(),targetId:s.Yj().nullable(),internal:s.zM(),flagged:s.zM()}).meta({id:"ActivityAuditEvent"}),af=s.Ik({id:s.Yj(),harness:O,title:s.Yj(),project:s.Yj(),repo:s.Yj(),branches:s.YO(s.Yj()),startedAt:t.w$(),endedAt:t.w$().nullable(),status:ab,turns:s.ai().int().nonnegative(),findings:s.ai().int().nonnegative(),shares:s.ai().int().nonnegative()}).meta({id:"ActivitySessionSummary"});af.extend({host:s.Yj(),cwd:s.Yj(),models:s.YO(s.Yj()),version:s.Yj(),tokens:$,tools:s.g1(s.Yj(),s.ai().int().nonnegative()),files:s.YO(s.Yj()),commits:s.ai().int().nonnegative(),events:s.YO(ae)}).meta({id:"ActivitySession"}),s.Ik({tz:s.Yj().optional()});let ag=s.Ik({sessionsToday:s.ai().int().nonnegative(),liveNow:s.ai().int().nonnegative(),toolCallsToday:s.ai().int().nonnegative(),findingsToday:s.ai().int().nonnegative(),egressToday:s.ai().int().nonnegative()}).meta({id:"GetActivityStatsResponse"});s.Ik({q:s.Yj().optional(),harness:s.YO(O).optional(),from:s.KC([t.p6(),t.w$()]).optional(),to:s.KC([t.p6(),t.w$()]).optional(),limit:u.ai().int().min(1).max(100).default(50),cursor:s.Yj().optional()});let ah=s.Ik({items:s.YO(af),nextCursor:s.Yj().nullable()}).meta({id:"ListActivitySessionsResponse"});s.Ik({limit:u.ai().int().min(1).max(500).default(100),cursor:s.Yj().optional(),order:s.k5(["asc","desc"]).default("asc")}),s.Ik({items:s.YO(ae),nextCursor:s.Yj().nullable()}).meta({id:"ListSessionEventsResponse"}),s.Ik({format:s.k5(["ndjson","json"]).default("ndjson")}),s.Ik({format:s.k5(["csv","json"]).default("csv"),q:s.Yj().optional(),harness:s.YO(O).optional(),from:s.KC([t.p6(),t.w$()]).optional(),to:s.KC([t.p6(),t.w$()]).optional()}),s.Ik({stats:ag,sessions:ah}).meta({id:"ActivityOverviewResponse"});let ai=s.k5(["prompt","response","code_change"]).meta({id:"EventKind"}),aj=s.k5(["claude-code","claude-desktop","cursor","chatgpt","github-copilot","cli","unknown"]).meta({id:"SourceTool"}),ak=s.Ik({sessionId:s.Yj().optional(),repo:s.Yj().optional(),filePath:s.Yj().optional(),gitignored:s.zM().optional(),wholeFile:s.zM().optional(),model:s.Yj().optional(),turnIndex:s.ai().int().nonnegative().optional(),correlationId:s.uR().optional(),traceId:s.Yj().regex(/^[0-9a-f]{32}$/).optional(),exceptionIds:s.YO(s.Os()).optional()}).meta({id:"EventMetadata"}),al=s.Ik({id:s.Os(),sourceTool:aj,kind:ai,occurredAt:t.w$(),contentHash:s.Yj(),content:s.Yj(),metadata:ak.optional()}).meta({id:"Event"}),am=al.meta({id:"IngestEvent"});s.Ik({events:s.YO(am).min(1).max(100),dedupe:s.eu("content-hash").optional()}).meta({id:"IngestBatch"});let an=s.k5(["project","skill","mcp","hook","config"]).meta({id:"AssetType"}),ao=s.k5(["open","approved","blocked"]).meta({id:"AccessLevel"}),ap=s.k5(["source","public-dep","vendored","config","data","docs","generated"]).meta({id:"Origin"}),aq=s.k5(["known-good","risky","unapproved"]).meta({id:"TrustLevel"}),ar=s.k5(["update","stale","conflict","unknown","change","untracked","risk","findings"]).meta({id:"Flag"}),as=s.k5(["public","private"]).meta({id:"Visibility"}),at=s.k5(["block","redact","warn"]).meta({id:"HarnessEventKind"}),au=s.k5(["claudecode","cursor","codex"]).meta({id:"HarnessId"}),av=s.Ik({open:s.ai().int().nonnegative(),approved:s.ai().int().nonnegative(),blocked:s.ai().int().nonnegative(),total:s.ai().int().nonnegative()}).meta({id:"AccessCounts"}),aw=s.Ik({id:s.Yj(),type:an,name:s.Yj(),sub:s.Yj(),flags:s.YO(ar),trust:aq.optional()}).meta({id:"AssetSummary"}),ax=s.Ik({id:s.Yj(),name:s.Yj(),repo:s.Yj(),visibility:as,language:s.Yj(),policyDefault:ao,updatedAt:t.w$(),accessCounts:av,findingsCount:s.ai().int().nonnegative()}).meta({id:"ProjectSummary"}),ay=s.Ik({type:an,assets:s.YO(aw)}),az=s.Ik({id:au,label:s.Yj(),kind:s.Yj(),version:s.Yj(),sessions:s.ai().int().nonnegative(),assetCount:s.ai().int().nonnegative(),flagCount:s.ai().int().nonnegative(),projects:s.YO(ax),categories:s.YO(ay)}).meta({id:"HarnessSummary"});s.Ik({items:s.YO(az)}).meta({id:"ListHarnessesResponse"});let aA=s.Ik({type:an,total:s.ai().int().nonnegative(),trustRollup:s.Ik({"known-good":s.ai().int().nonnegative(),risky:s.ai().int().nonnegative(),unapproved:s.ai().int().nonnegative()}).partial().strict().optional(),flagRollup:s.Ik({update:s.ai().int().nonnegative(),stale:s.ai().int().nonnegative(),conflict:s.ai().int().nonnegative(),unknown:s.ai().int().nonnegative(),change:s.ai().int().nonnegative(),untracked:s.ai().int().nonnegative(),risk:s.ai().int().nonnegative(),findings:s.ai().int().nonnegative()}).partial().strict(),items:s.YO(aw)}).meta({id:"AssetGroup"});s.Ik({groups:s.YO(aA)}).meta({id:"ListAssetsResponse"});let aB=s.Ik({name:s.Yj(),signature:s.Yj(),description:s.Yj(),write:s.zM(),risk:s.Yj().nullable()}).meta({id:"McpTool"}),aC=s.Ik({id:s.Yj(),title:s.Yj(),note:s.Yj()});aw.extend({description:s.Yj().nullable(),trust:aq.nullable(),meta:s.g1(s.Yj(),s.L5()),finding:aC.nullable(),tools:s.YO(aB).optional()}).meta({id:"AssetDetail"}),s.Ik({items:s.YO(ax)}).meta({id:"ListProjectsResponse"}),s.Ik({attention:s.ai().int().nonnegative(),byType:s.Ik({project:s.ai().int().nonnegative(),skill:s.ai().int().nonnegative(),mcp:s.ai().int().nonnegative(),hook:s.ai().int().nonnegative(),config:s.ai().int().nonnegative()}),harnesses:s.ai().int().nonnegative(),mcpTrust:s.Ik({"known-good":s.ai().int().nonnegative(),risky:s.ai().int().nonnegative(),unapproved:s.ai().int().nonnegative()})}).meta({id:"InventoryStats"});let aD=s.Ik({path:s.Yj(),name:s.Yj(),origin:ap,access:ao,isCustom:s.zM(),findings:s.ai().int().nonnegative(),blockedAt:t.w$().nullable().optional(),note:s.Yj().nullable().optional()}).meta({id:"FileSummary"}),aE=s.Ik({name:s.Yj(),path:s.Yj(),accessCounts:av}).meta({id:"FolderSummary"});s.Ik({project:s.Ik({id:s.Yj(),repo:s.Yj(),visibility:as}),path:s.Yj(),folders:s.YO(aE).optional(),files:s.YO(aD)}).meta({id:"ProjectTreeResponse"}),aD.extend({project:s.Ik({repo:s.Yj(),visibility:as,language:s.Yj(),policyDefault:ao,updatedAt:t.w$()}),findingsRefs:s.YO(s.Ik({id:s.Yj(),title:s.Yj()}))}).meta({id:"FileDetail"}),s.Ik({path:s.Yj(),access:ao}).meta({id:"SetFileAccessBody"}),s.Ik({file:aD,accessCounts:av}).meta({id:"SetFileAccessResponse"}),s.Ik({trust:aq}).meta({id:"SetMcpTrustBody"});let aF=s.Ik({kind:at,title:s.Yj(),detail:s.Yj(),occurredAt:t.w$(),findingId:s.Yj().nullable().optional()}).meta({id:"HarnessEventItem"});s.Ik({counts:s.Ik({block:s.ai().int().nonnegative(),redact:s.ai().int().nonnegative(),warn:s.ai().int().nonnegative()}),items:s.YO(aF)}).meta({id:"HarnessEventsResponse"}),s.Ik({jobId:s.Yj(),startedAt:t.w$()}).meta({id:"RescanResponse"}),s.Ik({repo:s.Yj()}).meta({id:"ConnectProjectBody"}),s.Ik({type:s.YO(an).optional(),q:s.Yj().optional()}),s.Ik({path:s.Yj().optional(),q:s.Yj().optional(),filter:s.k5(["blocked"]).optional()}),s.Ik({path:s.Yj()}),s.Ik({limit:u.ai().int().min(1).max(50).default(7)});let aG=s.k5(["once","temporary","permanent"]),aH=s.Ik({repo:s.Yj().optional(),sourceTool:s.Yj().optional(),provider:s.Yj().optional()}).strict(),aI=s.Ik({id:s.Os(),ruleId:s.Yj(),category:v,valueFingerprint:s.Yj().regex(/^[0-9a-f]{64}$/),keyVersion:s.ai().int().positive(),maskedValue:s.Yj(),scope:aG,expiresAt:t.w$().nullable(),maxUses:s.ai().int().positive().nullable(),useCount:s.ai().int().nonnegative(),lastUsedAt:t.w$().nullable(),justification:s.Yj().min(1),conditions:aH.nullable(),createdBy:s.Yj(),createdVia:s.k5(["cli-approve","cli-add","web-approve","web-add","api"]),createdAt:t.w$(),updatedAt:t.w$(),revokedAt:t.w$().nullable(),revokedBy:s.Yj().nullable(),revokeReason:s.Yj().nullable()}),aJ=aI.pick({id:!0,ruleId:!0,valueFingerprint:!0,keyVersion:!0,expiresAt:!0,maxUses:!0,useCount:!0,conditions:!0});s.k5(["keyword","regex","validator"]).meta({id:"MatcherType"});let aK=s.Ik({type:s.eu("keyword"),keywords:s.YO(s.Yj()).min(1),caseSensitive:s.zM().default(!1)}),aL=s.Ik({type:s.eu("regex"),pattern:s.Yj(),flags:s.Yj().default("gi"),captureGroup:s.ai().int().nonnegative().optional()}).refine(a=>(function(a,b){try{return new RegExp(a,b),!0}catch{return!1}})(a.pattern,a.flags),{message:"pattern/flags do not form a valid JavaScript regular expression",path:["pattern"]}).refine(a=>void 0!==a.captureGroup||!function(a,b){try{let c=new RegExp(a,b.replace(/[gy]/g,""));return c.exec("")?.[0].length===0}catch{return!1}}(a.pattern,a.flags),{message:'a whole-match regex that can match the empty string (e.g. "\\d*", "a?", "(?:)") can hang the matcher — scope the quantifier to a captureGroup, or require at least one character',path:["pattern"]}),aM=s.Ik({type:s.eu("validator"),name:s.k5(["luhn","entropy","ssn-checksum"]),config:s.g1(s.Yj(),s.L5()).optional()}),aN=s.gM("type",[aK,aL,aM]).meta({id:"Matcher"}),aO=s.Ik({extensions:s.YO(s.Yj().regex(/^\.[A-Za-z0-9]+$/)).min(1)}).meta({id:"AppliesTo"}),aP=s.KC([s.Yj(),s.Ik({name:s.Yj(),config:s.g1(s.Yj(),s.L5()).optional()})]).meta({id:"PostValidatorRef"}),aQ=s.Ik({categories:s.YO(v).min(1).optional(),ruleIds:s.YO(s.Yj().min(1)).min(1).optional(),labels:s.YO(s.Yj().min(1)).min(1).optional(),windowChars:s.ai().int().positive().default(160),confidenceBoost:s.ai().min(0).max(.3).optional()}).refine(a=>(a.categories?.length??0)+(a.ruleIds?.length??0)+(a.labels?.length??0)>0,{message:"requiresNearby needs at least one of categories, ruleIds, or labels"}).meta({id:"RequiresNearby"}),aR=s.Ik({label:s.Yj(),text:s.Yj().max(5e4),shouldMatch:s.zM(),filePath:s.Yj().optional(),expectedSpans:s.YO(s.Ik({start:s.ai(),end:s.ai()})).optional()}).meta({id:"RuleFixture"}),aS=s.Ik({specVersion:s.eu(1),id:s.Yj().regex(/^[a-z][a-z0-9-]*\/[a-z][a-z0-9-]*$/),name:s.Yj(),category:v,severity:w,matcher:aN,appliesTo:aO.optional(),postValidators:s.YO(aP).optional(),requiresNearby:aQ.optional(),examples:s.YO(s.Yj()).optional()}).meta({id:"Rule"}),aT=s.Ik({name:s.Yj(),email:s.Rp().optional(),url:s.OZ().optional()}).meta({id:"Author"});s.Ik({specVersion:s.eu(1),id:s.Yj(),name:s.Yj(),version:s.Yj(),rules:s.YO(s.Yj()),description:s.Yj().optional(),author:aT.optional(),license:s.Yj().optional(),sourceUrl:s.OZ().optional()}).meta({id:"PackManifest"});let aU=s.k5(["global","repo","user"]).meta({id:"PolicyScope"}),aV=s.KC([s.Ik({ruleId:s.Yj()}),s.Ik({category:v})]).meta({id:"PolicyTarget"}),aW=s.Ik({id:s.Os(),scope:aU,target:aV,action:x,enabled:s.zM().default(!0),customKeywords:s.YO(s.Yj()).optional(),name:s.Yj().optional()}).meta({id:"Policy"});s.Ik({version:s.Yj(),policies:s.YO(aW),rules:s.YO(aS).optional(),rulesComplete:s.zM().optional(),exceptions:s.YO(aJ).optional(),customKeywords:s.YO(s.Yj()),fetchedAt:t.w$()}).meta({id:"PolicyBundle"});let aX={secret:"block",pii:"redact",financial:"redact",phi:"redact",code_context:"warn",code_flaw:"warn",custom:"warn",config:"warn"},aY=["config"],aZ=v.options.filter(a=>!aY.includes(a)),a$=s.k5(["builtin","custom"]).meta({id:"PolicyKind"}),a_=["monitor","warn","redact","block"],a0=s.k5(a_).meta({id:"BuiltinPolicyId"}),a1=a_,a2={monitor:{name:"Monitor",action:"log",description:"Log every match for audit. The request is allowed through untouched."},warn:{name:"Warn",action:"warn",description:"Allow the request, but warn the user inline before it is sent."},redact:{name:"Redact",action:"redact",description:"Automatically strip the matched value from the request, then continue."},block:{name:"Block",action:"block",description:"Refuse the request entirely whenever any rule in this detection matches."}},a3=Object.fromEntries(a_.map(a=>[a,{id:a,...a2[a]}])),a4="monitor";function a5(a){let b=a0.safeParse(a??a4);return a3[b.success?b.data:a4].action}let a6=s.Ik({id:s.Yj(),name:s.Yj(),ruleCount:s.ai().int().nonnegative(),enabled:s.zM()}).meta({id:"UsedByItem"}),a7=s.Ik({id:s.Yj(),kind:a$,name:s.Yj(),enabled:s.zM(),usedByCount:s.ai().int().nonnegative()}).meta({id:"PolicyListItem"});s.Ik({specVersion:s.eu(1),id:s.Yj(),kind:a$,name:s.Yj(),enabled:s.zM(),description:s.Yj(),usedBy:s.YO(a6)}).meta({id:"PolicyDetail"}),s.Ik({policies:s.ai().int().nonnegative(),builtin:s.ai().int().nonnegative(),custom:s.ai().int().nonnegative(),detectionsGoverned:s.ai().int().nonnegative()}).meta({id:"PolicyStatsResponse"}),s.Ik({cursor:s.Yj().optional(),limit:u.ai().int().min(1).max(200).default(50),sourceTool:s.Yj().optional(),kind:s.Yj().optional(),from:t.w$().optional(),to:t.w$().optional()}),s.Ik({items:s.YO(al),nextCursor:s.Yj().nullable()}).meta({id:"ListEventsResponse"}),s.Ik({cursor:s.Yj().optional(),limit:u.ai().int().min(1).max(200).default(50),severity:s.Yj().optional(),category:s.Yj().optional(),eventId:s.Os().optional()}),s.Ik({items:s.YO(A),nextCursor:s.Yj().nullable()}).meta({id:"ListFindingsResponse"}),s.Ik({items:s.YO(a7)}).meta({id:"ListPoliciesResponse"}),aW.omit({id:!0}).meta({id:"CreatePolicyRequest"}),aW.partial().required({id:!0}).meta({id:"UpdatePolicyRequest"}),s.Ik({accepted:s.zM()}).meta({id:"RecordAuditEventResponse"}),s.Ik({error:s.Ik({code:s.Yj(),message:s.Yj(),details:s.L5().optional()})}).meta({id:"ErrorResponse"});let a8=s.k5(["user","project","local","plugin"]),a9=s.Ik({name:s.Yj().min(1),source:s.Yj().min(1),scope:a8,pluginName:s.Yj().optional(),version:s.Yj().optional(),description:s.Yj().optional(),updatedAt:t.w$().optional(),location:s.Yj().optional()}),ba=s.Ik({event:s.Yj().min(1),matcher:s.Yj().optional(),command:s.Yj().min(1),timeout:s.ai().optional(),scope:a8,pluginName:s.Yj().optional(),location:s.Yj().optional()}),bb=s.Ik({name:s.Yj().min(1),scope:a8,pluginName:s.Yj().optional(),marketplace:s.Yj().optional(),project:s.Yj().optional(),transport:s.Yj().min(1),command:s.Yj().optional(),url:s.Yj().optional(),envKeys:s.YO(s.Yj()).optional(),location:s.Yj().optional()}),bc=s.Ik({name:s.Yj().min(1),path:s.Yj().min(1),scope:a8,kind:s.Yj().min(1),detail:s.Yj().optional(),entryCount:s.ai().optional(),updatedAt:t.w$().optional()});s.Ik({scannedAt:t.w$(),skills:s.YO(a9),hooks:s.YO(ba),mcpServers:s.YO(bb),configFiles:s.YO(bc),errors:s.YO(s.Ik({source:s.Yj(),reason:s.Yj()}))});let bd=s.Ik({ruleId:s.Yj().min(1),version:s.Yj().min(1),span:z,maskedMatch:s.Yj(),actionTaken:x,confidence:s.ai().min(0).max(1)});s.Ik({items:s.YO(W),scanEvent:Y,definitions:s.YO(Z).optional(),findings:s.YO(bd).optional()});let be=s.Yj().regex(/^[a-z][a-z0-9-]*$/),bf=s.Yj().regex(/^[a-z][a-z0-9-]*$/),bg=s.Yj().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-.]+)?$/),bh=s.k5(["labs","user","org"]),bi=s.k5(["library"]).meta({id:"OriginEnum"}),bj=s.k5(["all","library","custom","customized","updates"]),bk=s.k5(["new","imported","update"]).meta({id:"LibraryStateEnum"}),bl=s.Ik({all:s.ai().int().nonnegative(),library:s.ai().int().nonnegative(),custom:s.ai().int().nonnegative(),customized:s.ai().int().nonnegative(),updates:s.ai().int().nonnegative()}).meta({id:"DetectionCounts"}),bm=s.Ik({id:s.Yj(),name:s.Yj(),version:bg,enabled:s.zM(),origin:bi,publisher:be.optional(),publisherKind:bh.optional(),ruleCount:s.ai().int().nonnegative(),namespace:be,packId:bf,policyId:s.Yj().optional(),latestVersion:bg.optional()}).meta({id:"DetectionListItem"});s.Ik({counts:bl,items:s.YO(bm)}).meta({id:"ListDetectionsResponse"}),s.Ik({filter:bj.optional().default("all"),q:s.Yj().optional()}),s.Ik({detections:s.ai().int().nonnegative(),rules:s.ai().int().nonnegative(),active:s.ai().int().nonnegative(),findingsLast30d:s.ai().int().nonnegative()}).meta({id:"DetectionStats"});let bn=s.Ik({id:s.Yj(),name:s.Yj(),category:v,severity:w,matcher:aN}).meta({id:"DetectionRule"}),bo=s.Ik({available:s.zM(),latestVersion:bg,latestRuleCount:s.ai().int().nonnegative().optional()}).nullable().meta({id:"DetectionUpdate"});s.Ik({id:s.Yj(),name:s.Yj(),version:bg,enabled:s.zM(),origin:bi,publisher:be.optional(),publisherKind:bh.optional(),ruleCount:s.ai().int().nonnegative(),namespace:be,packId:bf,description:s.Yj().optional(),editedAt:t.w$(),findingsLast30d:s.ai().int().nonnegative(),latestVersion:bg.nullable().optional(),update:bo,rules:s.YO(bn),modified:s.zM(),policyId:s.Yj().optional()}).meta({id:"DetectionDetail"});let bp=s.Ik({id:s.Yj(),name:s.Yj(),publisher:be,publisherKind:bh.optional(),category:v.optional(),version:bg,ruleCount:s.ai().int().nonnegative(),description:s.Yj().optional(),updatedAt:t.w$(),state:bk,importedAs:s.Yj().nullable()}).meta({id:"LibraryItem"});function bq(a){return{id:`${a.namespace}/${a.packId}`,name:a.name,version:a.version,enabled:a.enabled,origin:"library",namespace:a.namespace,packId:a.packId,ruleCount:a.ruleCount,...null!=a.policyId?{policyId:a.policyId}:{},...null!=a.latestVersion?{latestVersion:a.latestVersion}:{}}}function br(a,b,c){let d=a.rules.flatMap(a=>{let b=aN.safeParse(a.matcher);return b.success?[{id:a.id,name:a.name,category:a.category,severity:a.severity,matcher:b.data}]:[]});return{id:`${a.namespace}/${a.packId}`,name:a.name,version:a.version,enabled:a.enabled,origin:"library",namespace:a.namespace,packId:a.packId,ruleCount:a.rules.length,editedAt:a.updatedAt.toISOString(),findingsLast30d:b,latestVersion:c?c.latestVersion:null,update:c,rules:d,modified:!1,...null!=a.policyId?{policyId:a.policyId}:{}}}function bs(a){let b=a.indexOf("/");return b<1||b===a.length-1?null:{namespace:a.slice(0,b),packId:a.slice(b+1)}}function bt(a,b){let c=a.filter(a=>null!=a.latestVersion),d={all:a.length,library:a.length,custom:0,customized:0,updates:c.length},e=b.filter,f="custom"===e||"customized"===e?[]:"updates"===e?[...c]:[...a];if(b.q){let a=b.q.toLowerCase();f=f.filter(b=>b.name.toLowerCase().includes(a)||b.packId.toLowerCase().includes(a)||b.namespace.toLowerCase().includes(a))}return f.sort((a,b)=>a.enabled!==b.enabled?a.enabled?-1:1:a.name.localeCompare(b.name)),{counts:d,items:f.map(bq)}}s.Ik({categories:s.YO(v),items:s.YO(bp)}).meta({id:"ListLibraryResponse"}),s.Ik({libraryId:s.Yj().refine(a=>/^[^/]+\/[^/]+$/.test(a),{message:"libraryId must be in namespace/packId format"})}).meta({id:"ImportDetectionRequest"});let bu=["open","handled","dismissed","resolved"];function bv(a){return"code_change"!==a.kind?"handled":null===a.findingKey?"open":"resolved"===a.latestResolutionStatus?"resolved":"dismissed"===a.latestResolutionStatus?"dismissed":"open"}function bw(a,b={}){let c=b.overrides,d=b.packNames,e=new Map;for(let b of a){let a=e.get(b.ruleId);a?a.push(b):e.set(b.ruleId,[b])}let f=[];for(let[a,b]of e){var g;let e=b.map(a=>{let b=c?.get(a.id)??a.actionTaken;return{id:a.id,provider:P[a.sourceTool]??"api",repo:a.repo,file:a.file,action:({log:"monitored",block:"blocked",redact:"redacted",warn:"warned",allow:"allowed"})[b]??"allowed",detectedAt:a.occurredAt,confidence:a.confidence,status:a.status}}),h=b.reduce((a,b)=>b.occurredAt>a?b.occurredAt:a,b[0]?.occurredAt??new Date(0).toISOString()),i=new Set,j=e.map(a=>a.provider).filter(a=>!i.has(a)&&(i.add(a),!0)),k=new Set(e.map(a=>a.action)),l=1===k.size?[...k][0]??null:null,m=b[0]?.severity??"low",n={id:a,name:d?.get(a)??null},o="code_context"===(g=b[0]?.category??"custom")?"source_code":g,p={id:`category:${o}`,name:o},q={maskedValue:b[0]?.maskedMatch??"",contextPrefix:""},r=function(a){let b=new Set(a.map(a=>a.status).filter(a=>void 0!==a));if(0!==b.size){for(let a of bu)if(b.has(a))return a}}(e);f.push({id:a,category:o,subtype:a,severity:m,match:q,detection:n,policy:p,instanceCount:e.length,providers:j,aggregateAction:l,latestDetectedAt:h,instances:e,status:r})}return f}let bx=new WeakMap;function by(a,b){let c=a;if(b.severity&&b.severity.length>0){let a=new Set(b.severity);c=c.filter(b=>a.has(b.severity))}if(b.providers&&b.providers.length>0){let a=new Set(b.providers);c=c.filter(b=>b.providers.some(b=>a.has(b)))}if(b.actions&&b.actions.length>0){let a=new Set(b.actions);c=c.filter(b=>b.instances.some(b=>a.has(b.action)))}if(b.subtype&&b.subtype.length>0){let a=new Set(b.subtype);c=c.filter(b=>a.has(b.subtype))}if(b.q){let a=b.q.toLowerCase();c=c.filter(b=>(function(a){let b=bx.get(a);if(void 0!==b)return b;let c=[a.subtype,a.category,a.match.maskedValue,a.policy.name,a.id,...a.instances.map(a=>a.repo),...a.instances.map(a=>a.file),...a.instances.map(a=>a.id)].join(" ").toLowerCase();return bx.set(a,c),c})(b).includes(a))}return c}let bz={critical:0,high:1,medium:2,low:3};function bA(a){return[...a].sort((a,b)=>{let c=(bz[a.severity]??-1)-(bz[b.severity]??-1);return 0!==c?c:b.latestDetectedAt.localeCompare(a.latestDetectedAt)})}function bB(a,b){let c=by(a,{providers:b.providers,actions:b.actions,q:b.q,subtype:b.subtype}),d=new Map;for(let a of c)d.set(a.severity,(d.get(a.severity)??0)+1);let e=by(a,{actions:b.actions,q:b.q,subtype:b.subtype,severity:b.severity}),f=new Map;for(let a of e)for(let b of a.providers)f.set(b,(f.get(b)??0)+1);let g=by(a,{providers:b.providers,q:b.q,subtype:b.subtype,severity:b.severity}),h=new Map;for(let a of g)for(let b of new Set(a.instances.map(a=>a.action)))h.set(b,(h.get(b)??0)+1);let i=by(a,{providers:b.providers,actions:b.actions,q:b.q,severity:b.severity}),j=new Map;for(let a of i)j.set(a.subtype,(j.get(a.subtype)??0)+1);let k=a=>[...a.entries()].map(([a,b])=>({value:a,count:b}));return{severity:k(d),provider:k(f),action:k(h),subtype:k(j)}}let bC=s.Ik({id:s.Os(),namespace:be,packId:bf,version:bg,name:s.Yj(),enabled:s.zM().default(!0),policyId:s.Yj().optional()}).meta({id:"InstalledPack"});s.Ik({namespace:be,packId:bf,version:bg}).meta({id:"InstallPackRequest"}),s.Ik({items:s.YO(bC)}).meta({id:"ListInstalledPacksResponse"}),s.Ik({enabled:s.zM().optional(),policyId:s.Yj().nullable().optional()}).refine(a=>Object.keys(a).some(b=>void 0!==a[b]),{message:"At least one field must be provided"}).meta({id:"PatchInstalledPackRequest"});let bD=s.k5(["standalone"]),bE=s.k5(["redact","warn"]),bF=s.k5(["full","session-only"]),bG=s.Ik({specVersion:s.ai().int().positive().default(2),runMode:s.vk(a=>"attached"===a?"standalone":a,bD.default("standalone")),policy:bE.default("redact"),historicalAccess:bF.default("session-only"),onboardedAt:t.w$().optional()});function bH(){return bG.parse({})}function bI(a){return{id:a.id,sourceTool:a.sourceTool,kind:a.kind,occurredAt:g(a.occurredAt),contentHash:a.contentHash,content:a.content,metadata:a.metadata?JSON.stringify(a.metadata):null}}function bJ(a){return{id:a.id,eventId:a.eventId,ruleId:a.ruleId,category:a.category,severity:a.severity,spanStart:a.span.start,spanEnd:a.span.end,maskedMatch:a.maskedMatch,actionTaken:a.actionTaken,confidence:a.confidence,findingKey:a.findingKey??null}}function bK(a,b,c){return{id:b,objectType:a.objectType,location:a.location??null,title:a.title??null,hostId:a.hostId??null,attributes:JSON.stringify(a.attributes),firstSeen:c,lastSeen:c}}function bL(a,b,c){return{id:b,url:a.url,name:a.name??null,attributes:JSON.stringify(a.attributes),firstSeen:c,lastSeen:c}}function bM(a){return{id:a.id,parentId:a.parentId??null,rootSessionId:a.rootSessionId??null,eventType:a.eventType,hostId:a.hostId??null,harnessId:a.harnessId??null,sourceProjectId:a.sourceProjectId??null,startedAt:g(a.startedAt),endedAt:a.endedAt?g(a.endedAt):null,severity:a.severity??null,priority:a.priority??null,content:a.content??null,contentHash:a.contentHash??null,attributes:a.attributes?JSON.stringify(a.attributes):null}}function bN(a,b){return{id:b,class:a.class,label:a.label??null,attributes:a.attributes?JSON.stringify(a.attributes):null}}function bO(a,b){return{id:b,ruleId:a.ruleId,name:a.name,category:a.category,severity:a.severity,definition:a.definition,version:a.version}}function bP(a){return{id:a.id,auditEventId:a.auditEventId,inspectionDefinitionId:a.inspectionDefinitionId,classifiedDataId:a.classifiedDataId??null,spanStart:a.span.start,spanEnd:a.span.end,maskedMatch:a.maskedMatch,actionTaken:a.actionTaken,confidence:a.confidence}}let bQ=s.Ik({path:s.Yj().min(1),name:s.Yj().min(1),origin:ap,defaultAccess:ao});s.Ik({files:s.YO(bQ),truncated:s.zM(),scannedAt:s.Yj()}),s.Ik({rules:s.YO(aS).min(1).max(100),text:s.Yj().max(5e4).optional(),fixtures:s.YO(aR).max(200).optional()}).refine(a=>void 0!==a.text||(a.fixtures?.length??0)>0,{message:"Provide `text`, `fixtures`, or both — there must be something to test"}).meta({id:"TestRulesRequest"});let bR=s.Ik({ruleId:s.Yj(),category:v,severity:w,span:z,confidence:s.ai().min(0).max(1),match:s.Yj()}).meta({id:"RuleTestMatch"}),bS=s.Ik({label:s.Yj(),shouldMatch:s.zM(),didMatch:s.zM(),passed:s.zM(),matches:s.YO(bR)}).meta({id:"FixtureResult"});s.Ik({adhoc:s.Ik({matches:s.YO(bR)}).optional(),fixtures:s.YO(bS),summary:s.Ik({total:s.ai().int().nonnegative(),passed:s.ai().int().nonnegative(),failed:s.ai().int().nonnegative()}),unsupportedRuleIds:s.YO(s.Yj())}).meta({id:"TestRulesResponse"});let bT=s.Ik({severity:w,count:s.ai().int().nonnegative(),caught:s.ai().int().nonnegative().optional(),openAtRest:s.ai().int().nonnegative().optional()}).meta({id:"SeveritySummaryItem"});s.Ik({total:s.ai().int().nonnegative(),needsRemediation:s.ai().int().nonnegative().optional(),bySeverity:s.YO(bT)}).meta({id:"SeveritySummaryResponse"});let bU=["7d","30d","3m","6m"],bV=s.k5(bU).meta({id:"SecurityRange"});s.Ik({range:s.k5(bU).default("30d")});let bW=s.k5(["blocked","redacted","warned"]).meta({id:"EnforcementActionKind"}),bX=s.Ik({kind:bW,count:s.ai().int().nonnegative(),delta:s.ai().int()}).meta({id:"EnforcementAction"});s.Ik({range:bV,total:s.ai().int().nonnegative(),actions:s.YO(bX)}).meta({id:"EnforcementActionsResponse"});let bY=s.k5(["day","week"]).meta({id:"TimeseriesGranularity"}),bZ=s.Ik({timestamp:t.p6(),critical:s.ai().int().nonnegative(),high:s.ai().int().nonnegative(),medium:s.ai().int().nonnegative()}).meta({id:"FindingsTimeseriesPoint"});s.Ik({range:bV,granularity:bY,points:s.YO(bZ)}).meta({id:"FindingsTimeseriesResponse"});let b$=s.Ik({timestamp:t.p6(),bySeverity:s.Ik({critical:s.ai().nonnegative().nullable(),high:s.ai().nonnegative().nullable(),medium:s.ai().nonnegative().nullable(),low:s.ai().nonnegative().nullable()})}).meta({id:"MttrTrendPoint"});s.Ik({range:bV,granularity:bY,points:s.YO(b$)}).meta({id:"MttrTrendResponse"});let b_=s.Ik({findingKey:s.Yj(),ruleId:s.Yj(),severity:w,path:s.Yj(),resolvedAt:t.w$(),detectedAt:t.w$()}).meta({id:"ResolvedFeedItem"});s.Ik({items:s.YO(b_)}).meta({id:"RecentlyResolvedResponse"});let b0=["repo","user"],b1=s.k5(b0).meta({id:"SourceKind"}),b2=s.Ik({id:s.Yj(),name:s.Yj(),kind:b1,findingsCount:s.ai().int().nonnegative()}).meta({id:"TopSource"});s.Ik({range:bV,items:s.YO(b2)}).meta({id:"TopSourcesResponse"}),s.Ik({range:s.k5(bU).default("30d"),limit:u.ai().int().min(1).max(50).default(5),kind:s.k5(b0).optional()});let b3=s.k5(["claudecode","cursor","codex","chatgpt","copilot","api"]).meta({id:"Provider"}),b4=s.Ik({provider:b3,coverage:s.ai().int().min(0).max(100),supported:s.zM()}).meta({id:"ScanCoverageProvider"});s.Ik({range:bV,providers:s.YO(b4)}).meta({id:"ScanCoverageResponse"});let b5=s.k5(["repo","user","team","policy","share","rule"]).meta({id:"SubjectType"}),b6=s.Ik({type:b5,id:s.Yj(),label:s.Yj()}).meta({id:"RecommendationSubject"}),b7=s.k5(["apply","navigate"]).meta({id:"RecommendationActionMode"}),b8=s.Ik({mode:b7,type:s.Yj(),label:s.Yj(),href:s.Yj().optional(),policyId:s.Yj().optional(),teamId:s.Yj().optional()}).meta({id:"RecommendationAction"}),b9=s.Ik({id:s.Yj(),category:s.Yj(),severity:w,title:s.Yj(),description:s.Yj(),subjects:s.YO(b6),action:b8}).meta({id:"RecommendedAction"});s.Ik({items:s.YO(b9)}).meta({id:"RecommendedActionsResponse"}),s.Ik({limit:u.ai().int().min(1).max(20).default(3)});let ca=s.Ik({type:s.Yj(),policyId:s.Yj().optional(),teamId:s.Yj().optional()}).meta({id:"AppliedAction"});s.Ik({id:s.Yj(),status:s.eu("applied"),appliedAction:ca}).meta({id:"ApplyRecommendedActionResponse"}),s.Ik({id:s.Yj(),status:s.eu("dismissed")}).meta({id:"DismissRecommendedActionResponse"}),s.Ik({id:s.Yj()});let cb=s.k5(["provider","internal","ip"]).meta({id:"DestinationKind"}),cc=s.k5(["https","http","sftp","grpc","smtp"]).meta({id:"Transport"}),cd=s.k5(["secrets","pii","customer","source","telemetry","logs","metrics","none"]).meta({id:"DataClass"}),ce=cd.options,cf=s.k5(["recognized","internal","unverified","ip"]).meta({id:"ShareTrustLevel"}),cg=s.k5(["allow","block"]).meta({id:"EgressDecision"}),ch=s.k5(["allowed","blocked","review"]).meta({id:"EgressStatus"}),ci=s.k5(["raw_ip","unverified_domain","plaintext_transport"]).meta({id:"ReviewReason"}),cj=s.k5(["GET","POST","PUT","DELETE"]).meta({id:"HttpMethod"}),ck=s.Ik({needsReview:s.zM(),reasons:s.YO(ci)}).meta({id:"ReviewInfo"}),cl=s.Ik({port:s.ai().int().nullable(),geo:s.Yj().nullable(),ptr:s.Yj().nullable()}).meta({id:"DestinationNetwork"}),cm=s.Ik({id:s.Yj(),method:cj,transport:cc,url:s.Yj(),template:s.zM(),dataClass:cd,lastSeen:t.w$(),callSiteCount:s.ai().int().nonnegative()}).meta({id:"EndpointSummary"}),cn=s.Ik({id:s.Yj(),project:s.Yj(),file:s.Yj(),line:s.ai().int().nonnegative(),snippet:s.Yj(),dynamic:s.zM(),vendored:s.zM(),projectId:s.Yj().nullable()}).meta({id:"CallSite"}),co=cm.extend({sites:s.YO(cn)}).meta({id:"EndpointWithSites"}),cp=s.Ik({id:s.Yj(),kind:cb,name:s.Yj(),host:s.Yj(),category:s.Yj(),trust:cf,status:ch,isCustom:s.zM(),lastSeen:t.w$(),endpointCount:s.ai().int().nonnegative(),callSiteCount:s.ai().int().nonnegative(),transports:s.YO(cc),dataClasses:s.YO(cd),review:ck,network:cl.nullable(),endpoints:s.YO(cm)}).meta({id:"ShareDestinationSummary"});cp.omit({endpointCount:!0,callSiteCount:!0,endpoints:!0}).extend({note:s.Yj().nullable(),endpoints:s.YO(co)}).meta({id:"ShareDestinationDetail"});let cq=s.Ik({id:s.Yj(),kind:cb,name:s.Yj(),host:s.Yj(),trust:cf,status:ch,review:ck,topDataClass:cd,callSiteCount:s.ai().int().nonnegative(),lastSeen:t.w$()}).meta({id:"ReviewDestination"}),cr=s.Ik({kind:cb,total:s.ai().int().nonnegative(),items:s.YO(cp)}).meta({id:"ShareDestinationGroup"});s.Ik({groups:s.YO(cr)}).meta({id:"ListShareDestinationsResponse"}),s.Ik({items:s.YO(cq)}).meta({id:"NeedsReviewResponse"}),s.Ik({destinations:s.ai().int().nonnegative(),endpoints:s.ai().int().nonnegative(),callSites:s.ai().int().nonnegative(),needsReview:s.ai().int().nonnegative(),insecure:s.ai().int().nonnegative(),byKind:s.Ik({provider:s.ai().int().nonnegative(),internal:s.ai().int().nonnegative(),ip:s.ai().int().nonnegative()}),byTrust:s.Ik({recognized:s.ai().int().nonnegative(),internal:s.ai().int().nonnegative(),unverified:s.ai().int().nonnegative(),ip:s.ai().int().nonnegative()})}).meta({id:"SharesStats"}),s.Ik({decision:cg.nullable()}).meta({id:"SetEgressDecisionBody"}),s.Ik({destination:cp}).meta({id:"SetEgressDecisionResponse"}),s.Ik({q:s.Yj().optional(),kind:s.YO(cb).optional(),groupBy:s.k5(["destination"]).default("destination"),review:s.uE().default(!1)}),s.Ik({format:s.k5(["csv","json"]).default("csv"),q:s.Yj().optional(),kind:s.YO(cb).optional()});let cs=new Set(["recognized","internal"]);function ct(a){return cs.has(a)?"allowed":"review"}function cu(a){return"block"===a?"blocked":"allowed"}function cv(a,b){return null===b?ct(a):cu(b)}function cw(a,b){return null!==b&&cu(b)!==ct(a)}function cx(a,b){let c=function(a,b){let c=[];return"ip"===a&&c.push("raw_ip"),"unverified"===a&&c.push("unverified_domain"),b.includes("http")&&c.push("plaintext_transport"),c}(a,b);return{needsReview:c.length>0,reasons:c}}function cy(a){return Array.from(new Set(a))}function cz(a){let b=new Set(a);return ce.filter(a=>b.has(a))}function cA(a){return cz(a)[0]??"none"}let cB={raw_ip:0,unverified_domain:1,plaintext_transport:2};function cC(a){return 0===a.length?1/0:Math.min(...a.map(a=>cB[a]))}},93116:(a,b,c)=>{c.d(b,{WR:()=>K,qA:()=>L,o8:()=>aX,KS:()=>aW,tI:()=>aU,_2:()=>aS,Rd:()=>aQ,Ji:()=>aM,v5:()=>aR});var d=c(77598),e=c(73024),f=c(76760),g=c(79868),h=c(37906);function i(a){return(0,d.createHash)("sha256").update(a).digest("hex")}function j(a){return i((0,h.tTV)(["source_project",a]))}function k(a){return"column"===a.kind?`column ${a.table}.${a.name}`:`table ${a.name}`}let l=[{name:"input_tokens",ddl:"ALTER TABLE audit_events ADD COLUMN input_tokens integer GENERATED ALWAYS AS (json_extract(attributes, '$.input_tokens')) VIRTUAL"},{name:"output_tokens",ddl:"ALTER TABLE audit_events ADD COLUMN output_tokens integer GENERATED ALWAYS AS (json_extract(attributes, '$.output_tokens')) VIRTUAL"},{name:"cache_creation_input_tokens",ddl:"ALTER TABLE audit_events ADD COLUMN cache_creation_input_tokens integer GENERATED ALWAYS AS (json_extract(attributes, '$.cache_creation_input_tokens')) VIRTUAL"},{name:"cache_read_input_tokens",ddl:"ALTER TABLE audit_events ADD COLUMN cache_read_input_tokens integer GENERATED ALWAYS AS (json_extract(attributes, '$.cache_read_input_tokens')) VIRTUAL"},{name:"model",ddl:"ALTER TABLE audit_events ADD COLUMN model text GENERATED ALWAYS AS (json_extract(attributes, '$.model')) VIRTUAL"},{name:"provider",ddl:"ALTER TABLE audit_events ADD COLUMN provider text GENERATED ALWAYS AS (json_extract(attributes, '$.provider')) VIRTUAL"}];function m(a,b){a.prepare(`PRAGMA table_info(${b})`).all().some(a=>"synced_at"===a.name)||a.exec(`ALTER TABLE ${b} ADD COLUMN synced_at integer`)}let n="aka.db";function o(a){(0,e.mkdirSync)(a,{recursive:!0,mode:448});try{(0,e.chmodSync)(a,448)}catch{}}function p(a){return a.replace(/\\/g,"\\\\").replace(/%/g,"\\%").replace(/_/g,"\\_")}function q(a){return Array.from({length:a},()=>"?").join(", ")}let r="max(started_at, coalesce(ended_at, started_at))";function s(){try{return Intl.DateTimeFormat().resolvedOptions().timeZone}catch{return"UTC"}}let t={session:"session",prompt:"prompt",response:"response",tool_call:"tool",hook:"hook",detection:"detection",share:"share",permission:"permission",commit:"commit",error:"error",active:"active"};function u(a){if(!a)return[];try{let b=JSON.parse(a);return Array.isArray(b)?b:[]}catch{return[]}}function v(a){return 1===a||!0===a}function w(a){let b=h.TUN.safeParse(a);return b.success?b.data:"claudecode"}function x(a,b,c){let d=Math.max(a.started_at,b.lastActivityMs),{status:e,endedAtMs:f}=function(a,b,c){if(a.status){let b=h.PhW.safeParse(a.status);if(b.success)return{status:b.data,endedAtMs:a.ended_at}}return null!==a.ended_at?{status:"completed",endedAtMs:a.ended_at}:b>=c-18e5?{status:"active",endedAtMs:null}:{status:"completed",endedAtMs:b}}(a,d,c);return{id:a.id,harness:w(a.harness),title:a.title||a.project||a.repo||`Session ${a.id.slice(0,8)}`,project:a.project??"",repo:a.repo??"",branches:u(a.branches),startedAt:(0,h.q11)(a.started_at),endedAt:null===f?null:(0,h.q11)(f),status:e,turns:b.turns,findings:b.findings,shares:b.shares}}function y(a){let b=t[a.event_type];if(!b)return null;let c=a.severity?h.U7X.safeParse(a.severity):null,d=a.link?h.Itg.safeParse(a.link):null;return{id:a.id,occurredAt:(0,h.q11)(a.started_at),kind:b,title:a.title??"",detail:a.detail??"",tool:a.tool,severity:c?.success?c.data:null,link:d?.success?d.data:null,targetId:a.target_id,internal:v(a.internal),flagged:v(a.flagged)}}let z=`
-  id,
-  event_type,
-  started_at,
-  coalesce(content, json_extract(attributes, '$.tool_name')) AS title,
-  coalesce(json_extract(attributes, '$.detail'), json_extract(attributes, '$.target')) AS detail,
-  coalesce(json_extract(attributes, '$.tool_name'), json_extract(attributes, '$.tool')) AS tool,
-  json_extract(attributes, '$.severity') AS severity,
-  json_extract(attributes, '$.link') AS link,
-  json_extract(attributes, '$.targetId') AS target_id,
-  json_extract(attributes, '$.internal') AS internal,
-  json_extract(attributes, '$.flagged') AS flagged`,A="event_type = 'session'";class B{constructor(a,b=()=>Date.now()){this.db=a,this.now=b}stats(a){let{startMs:b,endMs:c}=function a(b,c){let d;try{d=new Intl.DateTimeFormat("en-US",{timeZone:b,year:"numeric",month:"2-digit",day:"2-digit",hour:"2-digit",minute:"2-digit",second:"2-digit",hourCycle:"h23"}).formatToParts(new Date(c))}catch{let d=s();return b===d?function(a){let b=864e5*Math.floor(a/864e5);return{startMs:b,endMs:b+864e5}}(c):a(d,c)}let e=Object.fromEntries(d.map(a=>[a.type,a.value])),f=Number(e.year),g=Number(e.month),h=Number(e.day),i=Number(e.hour),j=Date.UTC(f,g-1,h,i,Number(e.minute),Number(e.second))-c,k=Date.UTC(f,g-1,h,0,0,0)-j;return{startMs:k,endMs:k+864e5}}(a??s(),this.now()),d=this.db.prepare(`SELECT count(*) AS n FROM audit_events
-           WHERE ${A} AND started_at >= ? AND started_at < ?`).get(b,c).n,e=this.now()-18e5,f=this.db.prepare(`SELECT count(*) AS n FROM audit_events s
-           WHERE s.event_type = 'session' AND s.ended_at IS NULL
-             AND max(
-               s.started_at,
-               coalesce(
-                 (SELECT max(${r}) FROM audit_events e WHERE e.root_session_id = s.id),
-                 s.started_at
-               )
-             ) >= ?`).get(e).n,g=this.db.prepare(`SELECT count(*) AS n FROM audit_events
-           WHERE event_type = 'tool_call' AND started_at >= ? AND started_at < ?`).get(b,c).n;return Promise.resolve({sessionsToday:d,liveNow:f,toolCallsToday:g,findingsToday:this.db.prepare(`SELECT count(*) AS n FROM inspection_findings f
-           JOIN audit_events e ON e.id = f.audit_event_id
-           WHERE e.started_at >= ? AND e.started_at < ?`).get(b,c).n,egressToday:this.db.prepare(`SELECT count(DISTINCT json_extract(attributes, '$.destination')) AS n
-           FROM audit_events
-           WHERE event_type = 'share' AND started_at >= ? AND started_at < ?`).get(b,c).n})}listSessions(a){var b;let c=a.cursor?function(a){try{let b=JSON.parse(Buffer.from(a,"base64url").toString("utf8"));if(null!==b&&"object"==typeof b&&"startedAtMs"in b&&"id"in b&&"number"==typeof b.startedAtMs&&"string"==typeof b.id)return b;return null}catch{return null}}(a.cursor):null,d=a.to?(0,h.I8t)(a.to):this.now(),e=a.from?(0,h.I8t)(a.from):void 0,f=[A],g=[];if(a.harness&&a.harness.length>0&&(f.push(`coalesce(json_extract(attributes, '$.harness'), 'claudecode') IN (${q(a.harness.length)})`),g.push(...a.harness)),void 0!==e&&(f.push("started_at >= ?"),g.push(e)),f.push("started_at <= ?"),g.push(d),a.q){let b=`%${p(a.q)}%`;f.push(`(content LIKE ? ESCAPE '\\'
-          OR json_extract(attributes, '$.project') LIKE ? ESCAPE '\\'
-          OR json_extract(attributes, '$.repo') LIKE ? ESCAPE '\\'
-          OR json_extract(attributes, '$.branches') LIKE ? ESCAPE '\\'
-          OR EXISTS (
-            SELECT 1 FROM audit_events d
-            WHERE d.root_session_id = audit_events.id
-              AND (d.content LIKE ? ESCAPE '\\'
-                   OR json_extract(d.attributes, '$.detail') LIKE ? ESCAPE '\\')))`),g.push(b,b,b,b,b,b)}c&&(f.push("(started_at < ? OR (started_at = ? AND id < ?))"),g.push(c.startedAtMs,c.startedAtMs,c.id));let i=a.limit,j=this.db.prepare(`SELECT id,
-                json_extract(attributes, '$.harness') AS harness,
-                content AS title,
-                json_extract(attributes, '$.project') AS project,
-                json_extract(attributes, '$.repo') AS repo,
-                json_extract(attributes, '$.branches') AS branches,
-                json_extract(attributes, '$.status') AS status,
-                started_at,
-                ended_at
-         FROM audit_events
-         WHERE ${f.join(" AND ")}
-         ORDER BY started_at DESC, id DESC
-         LIMIT ?`).all(...g,i+1),k=j.length>i,l=k?j.slice(0,i):j,m=this.rollupsFor(l.map(a=>a.id)),n=this.now(),o=l.map(a=>x(a,m.get(a.id)??{turns:0,findings:0,shares:0,lastActivityMs:0},n)),r=l[l.length-1];return Promise.resolve({items:o,nextCursor:k&&r?(b={startedAtMs:r.started_at,id:r.id},Buffer.from(JSON.stringify(b)).toString("base64url")):null})}getSession(a){let b=this.db.prepare(`SELECT id,
-                json_extract(attributes, '$.harness') AS harness,
-                content AS title,
-                json_extract(attributes, '$.project') AS project,
-                json_extract(attributes, '$.repo') AS repo,
-                json_extract(attributes, '$.branches') AS branches,
-                json_extract(attributes, '$.status') AS status,
-                json_extract(attributes, '$.host') AS host,
-                json_extract(attributes, '$.cwd') AS cwd,
-                json_extract(attributes, '$.models') AS models,
-                json_extract(attributes, '$.version') AS version,
-                json_extract(attributes, '$.files') AS files,
-                started_at,
-                ended_at
-         FROM audit_events
-         WHERE id = ? AND event_type = 'session'
-         LIMIT 1`).get(a);if(!b)return Promise.resolve(null);let c=this.db.prepare(`SELECT ${z}
-         FROM audit_events
-         WHERE id = ? OR root_session_id = ?
-         ORDER BY started_at ASC, id ASC`).all(a,a).map(y).filter(a=>null!==a),d=this.db.prepare(`SELECT
-           coalesce(sum(input_tokens), 0) AS input,
-           coalesce(sum(output_tokens), 0) AS output,
-           coalesce(sum(cache_creation_input_tokens), 0) AS cache_creation,
-           coalesce(sum(cache_read_input_tokens), 0) AS cache_read
-         FROM audit_events
-         WHERE root_session_id = ? AND event_type = 'llm_call'`).get(a),e=this.db.prepare(`SELECT model, provider FROM audit_events
-         WHERE root_session_id = ? AND event_type = 'llm_call'
-         ORDER BY started_at ASC, id ASC
-         LIMIT 1`).get(a),f=this.db.prepare(`SELECT coalesce(json_extract(attributes, '$.tool_name'), json_extract(attributes, '$.tool')) AS tool,
-                count(*) AS n
-         FROM audit_events
-         WHERE root_session_id = ? AND event_type = 'tool_call'
-         GROUP BY coalesce(json_extract(attributes, '$.tool_name'), json_extract(attributes, '$.tool'))`).all(a),g=this.db.prepare(`SELECT DISTINCT model FROM audit_events
-         WHERE root_session_id = ? AND event_type = 'llm_call' AND model IS NOT NULL AND model <> ''
-         ORDER BY model`).all(a).map(a=>a.model),h=this.db.prepare(`SELECT count(*) AS n FROM audit_events
-           WHERE root_session_id = ? AND event_type = 'commit'`).get(a).n,i=this.rollupsFor([a]).get(a)??{turns:0,findings:0,shares:0,lastActivityMs:0},j={sessionId:a,model:e?.model??"",provider:e?.provider??"",inputTokens:d.input,outputTokens:d.output,cacheCreation:d.cache_creation,cacheRead:d.cache_read,totalTokens:d.input+d.output+d.cache_creation+d.cache_read,estimatedCostUsd:null};return Promise.resolve({...x(b,i,this.now()),host:b.host??"",cwd:b.cwd??"",models:g.length>0?g:u(b.models),version:b.version??"",tokens:j,tools:Object.fromEntries(f.flatMap(a=>a.tool?[[a.tool,a.n]]:[])),files:u(b.files),commits:h,events:c})}tokenReports(a){let b=this.readLlmCallLeaves(void 0===a?{}:{fromMs:a});return Promise.resolve((0,h.ryv)(b,h.q_t))}tokenReportForSession(a){return Promise.resolve((0,h.ryv)(this.readLlmCallLeaves({sessionId:a}),h.q_t)[0]??null)}harnessFacets(a){let b=void 0===a?"":" AND started_at >= ?",c=this.db.prepare(`SELECT DISTINCT coalesce(json_extract(attributes, '$.harness'), 'claudecode') AS harness
-         FROM audit_events WHERE ${A}${b}`),d=void 0===a?c.all():c.all(a),e=new Set;for(let a of d)e.add(w(a.harness));return Promise.resolve([...e])}readLlmCallLeaves(a={}){let b=["event_type = 'llm_call'","attributes IS NOT NULL"],c=[];void 0!==a.sessionId&&(b.push("root_session_id = ?"),c.push(a.sessionId)),void 0!==a.fromMs&&(b.push("started_at >= ?"),c.push(a.fromMs));let d=this.db.prepare(`SELECT root_session_id AS sessionId, attributes
-           FROM audit_events
-          WHERE ${b.join(" AND ")}`).all(...c),e=[];for(let a of d)if(null!==a.sessionId)try{e.push({sessionId:a.sessionId,attributes:JSON.parse(a.attributes)})}catch{}return e}rollupsFor(a){let b=new Map(a.map(a=>[a,{turns:0,findings:0,shares:0,lastActivityMs:0}]));if(0===a.length)return b;let c=q(a.length);for(let d of this.db.prepare(`SELECT root_session_id AS id, max(${r}) AS m FROM audit_events
-         WHERE root_session_id IN (${c})
-         GROUP BY root_session_id`).all(...a)){if(null===d.id)continue;let a=b.get(d.id);a&&null!==d.m&&(a.lastActivityMs=d.m)}for(let d of this.db.prepare(`SELECT root_session_id AS id, count(*) AS n FROM audit_events
-         WHERE root_session_id IN (${c}) AND event_type = 'prompt'
-         GROUP BY root_session_id`).all(...a)){if(null===d.id)continue;let a=b.get(d.id);a&&(a.turns=d.n)}for(let d of this.db.prepare(`SELECT root_session_id AS id,
-                count(DISTINCT json_extract(attributes, '$.run_key')) AS n
-         FROM audit_events
-         WHERE root_session_id IN (${c}) AND event_type = 'llm_call'
-           AND json_extract(attributes, '$.run_key') IS NOT NULL
-         GROUP BY root_session_id`).all(...a)){if(null===d.id)continue;let a=b.get(d.id);a&&(a.turns=Math.max(a.turns,d.n))}for(let d of this.db.prepare(`SELECT e.root_session_id AS id, count(*) AS n FROM inspection_findings f
-         JOIN audit_events e ON e.id = f.audit_event_id
-         WHERE e.root_session_id IN (${c})
-         GROUP BY e.root_session_id`).all(...a)){if(null===d.id)continue;let a=b.get(d.id);a&&(a.findings=d.n)}for(let d of this.db.prepare(`SELECT root_session_id AS id,
-                count(DISTINCT json_extract(attributes, '$.destination')) AS n
-         FROM audit_events
-         WHERE root_session_id IN (${c}) AND event_type = 'share'
-         GROUP BY root_session_id`).all(...a)){if(null===d.id)continue;let a=b.get(d.id);a&&(a.shares=d.n)}return b}}class C{constructor(a){this.db=a,this.insertStmt=a.prepare(`INSERT OR IGNORE INTO audit_events
-         (id, parent_id, root_session_id, event_type,
-          host_id, harness_id, source_project_id, started_at, ended_at,
-          severity, priority, content, content_hash, attributes)
-       VALUES
-         (:id, :parentId, :rootSessionId, :eventType,
-          :hostId, :harnessId, :sourceProjectId, :startedAt, :endedAt,
-          :severity, :priority, :content, :contentHash, :attributes)`),this.upsertLlmCallStmt=a.prepare(`INSERT INTO audit_events
-         (id, parent_id, root_session_id, event_type,
-          host_id, harness_id, source_project_id, started_at, ended_at,
-          severity, priority, content, content_hash, attributes)
-       VALUES
-         (:id, :parentId, :rootSessionId, :eventType,
-          :hostId, :harnessId, :sourceProjectId, :startedAt, :endedAt,
-          :severity, :priority, :content, :contentHash, :attributes)
-       ON CONFLICT(id) DO UPDATE SET
-         attributes = excluded.attributes,
-         ended_at   = excluded.ended_at
-       WHERE COALESCE(json_extract(excluded.attributes, '$.output_tokens'), 0)
-           > COALESCE(json_extract(audit_events.attributes, '$.output_tokens'), 0)`)}runInTransaction(a){this.db.exec("BEGIN");try{a(),this.db.exec("COMMIT")}catch(a){throw this.db.exec("ROLLBACK"),a}}insertAuditEvent(a){let b=(0,h.V9M)(a);this.insertStmt.run({id:b.id,parentId:b.parentId??null,rootSessionId:b.rootSessionId??null,eventType:b.eventType,hostId:b.hostId??null,harnessId:b.harnessId??null,sourceProjectId:b.sourceProjectId??null,startedAt:b.startedAt,endedAt:b.endedAt??null,severity:b.severity??null,priority:b.priority??null,content:b.content??null,contentHash:b.contentHash??null,attributes:b.attributes??null})}insertLlmCall(a){var b,c;let d=(0,h.I8t)(a.startedAt);if(!Number.isFinite(d))return;let e=(b=a.sessionId,c=a.messageId,i((0,h.tTV)(["audit_event_llm_call",b,c])));this.upsertLlmCallStmt.run({id:e,parentId:a.parentId,rootSessionId:a.rootSessionId,eventType:"llm_call",hostId:null,harnessId:null,sourceProjectId:null,startedAt:d,endedAt:null,severity:null,priority:null,content:null,contentHash:null,attributes:JSON.stringify(a.attributes)})}insertToolCall(a){var b,c;let d=(0,h.I8t)(a.startedAt);if(!Number.isFinite(d))return;let e=(b=a.sessionId,c=a.toolUseId,i((0,h.tTV)(["audit_event_tool_call",b,c])));this.insertStmt.run({id:e,parentId:a.parentId,rootSessionId:a.rootSessionId,eventType:"tool_call",hostId:null,harnessId:null,sourceProjectId:null,startedAt:d,endedAt:null,severity:null,priority:null,content:null,contentHash:null,attributes:JSON.stringify(a.attributes)})}findById(a){return this.db.prepare("SELECT * FROM audit_events WHERE id = :id").get({id:a})}sessionProvider(a){let b=this.findById(a);if(b?.attributes)try{let a=JSON.parse(b.attributes);if("object"==typeof a&&null!==a){let b=a.provider;if("string"==typeof b)return b}}catch{}}llmCallLeaves(){return this.db.prepare(`SELECT root_session_id AS sessionId, attributes
-           FROM audit_events
-          WHERE event_type = 'llm_call' AND attributes IS NOT NULL`).all()}}class D{constructor(a){this.db=a,this.insertStmt=a.prepare(`INSERT OR IGNORE INTO classified_data (id, class, label, attributes)
-       VALUES (:id, :class, :label, :attributes)`)}upsert(a){var b;let c=(b=a.class,i((0,h.tTV)(["classified_data",b]))),d=(0,h.$BP)(a,c);return this.insertStmt.run({id:d.id,class:d.class,label:d.label??null,attributes:d.attributes??null}),c}}class E{constructor(a){this.db=a}report(){let a=this.latestScan();if(!a)return{scannedAt:null,skills:[],hooks:[],mcpServers:[],configFiles:[],topics:[]};let b=this.db.prepare(`SELECT id, object_type AS objectType, title, location, attributes FROM inventory
-          WHERE object_type IN ('skill', 'hook', 'mcp_server', 'config_file') AND last_seen >= :startedAt
-          ORDER BY object_type, title`).all({startedAt:a.started_at}),c=this.db.prepare(`SELECT f.masked_match AS maskedMatch, d.rule_id AS ruleId, d.name AS name
-           FROM inspection_findings f
-           JOIN inspection_definitions d ON d.id = f.inspection_definition_id
-          WHERE f.audit_event_id = :scanId`).all({scanId:a.id}),d=[],e=[],f=[],g=[],h=this.trustOverrides();for(let a of b){let b=function(a){try{let b=JSON.parse(a);if("object"==typeof b&&null!==b)return b}catch{}}(a.attributes);b&&("skill"===a.objectType?d.push(function(a,b){let c={id:a.id,name:a.title??"(unnamed)",source:F(b.source)??"unknown",scope:F(b.scope)??"unknown",status:"unknown"},d=F(b.description);void 0!==d&&(c.description=d);let e=F(b.version);void 0!==e&&(c.installedVersion=e);let f=F(b.updated_at);return void 0!==f&&(c.updatedAt=f),c}(a,b)):"hook"===a.objectType?e.push(function(a,b,c){let d=F(b.command)??"",e=c.filter(a=>a.maskedMatch===d),f={id:a.id,event:F(b.event)??"unknown",command:d,scope:F(b.scope)??"unknown",status:e.some(a=>"hook-external-egress"===a.ruleId)?"egress":e.some(a=>"hook-conflict"===a.ruleId)?"conflict":e.some(a=>"hook-unknown"===a.ruleId)?"unknown":"active",warnings:e.map(a=>a.name)},g=F(b.matcher);void 0!==g&&(f.matcher=g);let h=F(b.plugin_name);return void 0!==h&&(f.pluginName=h),f}(a,b,c)):"mcp_server"===a.objectType?f.push(function(a,b,c){let d={id:a.id,name:a.title??"(unnamed)",scope:F(b.scope)??"unknown",transport:F(b.transport)??"unknown",trust:c.get(a.id)??"unapproved"},e=F(b.command);void 0!==e&&(d.command=e);let f=F(b.url);if(void 0!==f&&(d.url=f),Array.isArray(b.env_keys)){let a=b.env_keys.filter(a=>"string"==typeof a);a.length>0&&(d.envKeys=a)}let g=F(b.plugin_name);void 0!==g&&(d.pluginName=g);let h=F(b.marketplace);void 0!==h&&(d.marketplace=h);let i=F(b.project);return void 0!==i&&(d.project=i),d}(a,b,h)):g.push(function(a,b){let c=F(b.scope)??"unknown",d={id:a.id,name:a.title??"(unnamed)",path:a.location??"",scope:c,kind:F(b.kind)??"Configuration file",untracked:"local"===c},e=F(b.detail);void 0!==e&&(d.detail=e),"number"==typeof b.entry_count&&(d.entryCount=b.entry_count);let f=F(b.updated_at);return void 0!==f&&(d.updatedAt=f),d}(a,b)))}return{scannedAt:new Date(a.started_at).toISOString(),skills:d,hooks:e,mcpServers:f,configFiles:g,topics:function(a,b,c,d,e){let f=[],g=a.filter(a=>"update_available"===a.status).length,h={topic:"skills",count:a.length};g>0&&(h.attention=`${String(g)} updates`),f.push(h);let i=b.filter(a=>"egress"===a.status).length,j=b.filter(a=>"conflict"===a.status).length,k=b.filter(a=>"unknown"===a.status).length,l=[];i>0&&l.push(`${String(i)} egress`),k>0&&l.push(`${String(k)} unknown`),j>0&&l.push(`${String(j)} conflict${j>1?"s":""}`);let m={topic:"hooks",count:b.length};l.length>0&&(m.attention=l.join(" \xb7 ")),f.push(m);let n=c.filter(a=>"unapproved"===a.trust).length,o={topic:"mcp",count:c.length};n>0&&(o.attention=`${String(n)} unapproved`),f.push(o);let p=d.filter(a=>a.untracked).length,q={topic:"config_files",count:d.length};p>0&&(q.attention=`${String(p)} untracked`),f.push(q);let r=function(a){if(!a)return 0;try{let b=JSON.parse(a),c=b?.errors;return"number"==typeof c?c:0}catch{return 0}}(e),s={topic:"configuration",count:r};return r>0&&(s.attention=`${String(r)} sources failed to parse`),f.push(s),f}(d,e,f,g,a.attributes)}}trustOverrides(){let a=this.db.prepare("SELECT asset_id AS assetId, trust FROM mcp_trust_override").all(),b=new Map;for(let c of a)("known-good"===c.trust||"risky"===c.trust||"unapproved"===c.trust)&&b.set(c.assetId,c.trust);return b}latestScan(){return this.db.prepare(`SELECT id, started_at, attributes FROM audit_events
-          WHERE event_type = 'config_scan'
-          ORDER BY started_at DESC, id DESC LIMIT 1`).get()}}function F(a){return"string"==typeof a?a:void 0}function G(a){let b;try{b=JSON.parse(a)}catch{return[]}if(!Array.isArray(b))return[];let c=[];for(let a of b)a&&"object"==typeof a&&c.push(a);return c}function H(a,b){return a.version!==b.version||a.rulesJson!==b.rulesJson}class I{constructor(a,b=()=>Date.now()){this.db=a,this.now=b}listDetections(a){let b=this.db.prepare(`SELECT namespace, pack_id AS packId, version, name, enabled, policy_id AS policyId,
-                rules_json AS rulesJson
-         FROM installed_packs`).all(),c=this.availableByPack(),d=b.map(a=>{let b=c.get(`${a.namespace}/${a.packId}`);return{namespace:a.namespace,packId:a.packId,version:a.version,name:a.name,enabled:1===a.enabled,ruleCount:G(a.rulesJson).length,policyId:a.policyId,...b&&H(a,b)?{latestVersion:b.version}:{}}});return Promise.resolve((0,h.plk)(d,a))}availableByPack(){return new Map(this.db.prepare(`SELECT namespace, pack_id AS packId, version, rules_json AS rulesJson
-         FROM available_packs`).all().map(a=>[`${a.namespace}/${a.packId}`,a]))}getDetectionStats(){let a=this.db.prepare("SELECT enabled, rules_json AS rulesJson FROM installed_packs").all(),b=0,c=0,d=new Set;for(let e of a){1===e.enabled&&(c+=1);let a=G(e.rulesJson);for(let c of(b+=a.length,a))"string"==typeof c.id&&d.add(c.id)}return Promise.resolve({detections:a.length,rules:b,active:c,findingsLast30d:this.countFindingsLast30d([...d])})}getDetectionDetail(a){let b=(0,h.pnU)(a);if(!b)return Promise.resolve(null);let{namespace:c,packId:d}=b,e=this.db.prepare(`SELECT namespace, pack_id AS packId, version, name, enabled, policy_id AS policyId,
-                rules_json AS rulesJson, updated_at AS updatedAt
-         FROM installed_packs
-         WHERE namespace = ? AND pack_id = ?`).get(c,d);if(!e)return Promise.resolve(null);let f=G(e.rulesJson),g=f.map(a=>a.id).filter(a=>"string"==typeof a),i=this.countFindingsLast30d(g),j=this.availableByPack().get(`${e.namespace}/${e.packId}`),k=j?H(e,j)?{available:!0,latestVersion:j.version,latestRuleCount:G(j.rulesJson).length}:{available:!1,latestVersion:j.version}:null;return Promise.resolve((0,h.a45)({namespace:e.namespace,packId:e.packId,version:e.version,name:e.name,enabled:1===e.enabled,rules:f,updatedAt:new Date(e.updatedAt),policyId:e.policyId},i,k))}countFindingsLast30d(a){if(0===a.length)return 0;let b=this.now()-2592e6,c=a.map(()=>"?").join(", ");return this.db.prepare(`SELECT count(*) AS c
-         FROM findings f JOIN events e ON e.id = f.event_id
-         WHERE e.occurred_at >= ? AND f.rule_id IN (${c})`).get(b,...a).c}}class J{constructor(a){this.db=a,this.insertStmt=a.prepare(`INSERT INTO events (id, source_tool, kind, occurred_at, content_hash, content, metadata)
-       VALUES (:id, :sourceTool, :kind, :occurredAt, :contentHash, :content, :metadata)`)}insertEvent(a){let b=(0,h.yaP)(a);this.insertStmt.run({id:b.id,sourceTool:b.sourceTool,kind:b.kind,occurredAt:b.occurredAt,contentHash:b.contentHash,content:b.content,metadata:b.metadata??null})}contentHashes(){return Promise.resolve(new Set(this.db.prepare("SELECT content_hash FROM events").all().map(a=>a.content_hash)))}}let K=864e5;class L extends Error{constructor(a){super(`duplicate-active-exception: an active exception already exists for rule "${a}" and this value — revoke it before granting a new one`),this.code="duplicate-active-exception",this.name="DuplicateActiveExceptionError"}}class M extends Error{constructor(a){super(`ambiguous-exception-id: "${a}" matches more than one exception — add more characters`),this.code="ambiguous-exception-id",this.name="AmbiguousExceptionIdError"}}let N=`revoked_at IS NULL
-     AND (expires_at IS NULL OR expires_at > :now)
-     AND (max_uses IS NULL OR use_count < max_uses)`;class O{constructor(a){this.db=a,this.consumeStmt=a.prepare(`UPDATE exceptions
-          SET use_count = use_count + 1, last_used_at = :now, updated_at = :now
-        WHERE id = :id AND ${N}`),this.insertBlockedStmt=a.prepare(`INSERT OR REPLACE INTO blocked_detections (reference, rule_id, category, value_fingerprint, key_version, masked_value, session_id, repo, blocked_at)
-       VALUES (:reference, :ruleId, :category, :valueFingerprint, :keyVersion, :maskedValue, :sessionId, :repo, :blockedAt)`),this.sweepBlockedStmt=a.prepare("DELETE FROM blocked_detections WHERE blocked_at <= :cutoff")}create(a){try{return Promise.resolve(this.createSync(a))}catch(a){return Promise.reject(a instanceof Error?a:Error(String(a)))}}createSync(a){if(a.conditions?.provider!==void 0)throw Error("provider conditions are not supported yet — a grant with one would never apply");let b=(0,d.randomUUID)(),c=Date.now();try{this.insertExceptionRow(b,a,c)}catch(d){if(!(d instanceof Error&&(2067===d.errcode||d.message.includes("UNIQUE constraint failed"))))throw d;this.db.exec("BEGIN IMMEDIATE");try{let d=this.db.prepare(`UPDATE exceptions
-                SET revoked_at = :now, revoked_by = :revokedBy,
-                    revoke_reason = 'superseded by a new grant for the same value',
-                    updated_at = :now
-              WHERE rule_id = :ruleId AND value_fingerprint = :valueFingerprint
-                AND key_version = :keyVersion AND revoked_at IS NULL
-                AND ((expires_at IS NOT NULL AND expires_at <= :now)
-                  OR (max_uses IS NOT NULL AND use_count >= max_uses))`).run({now:c,revokedBy:a.createdBy,ruleId:a.ruleId,valueFingerprint:a.valueFingerprint,keyVersion:a.keyVersion});if(1!==Number(d.changes))throw new L(a.ruleId);this.insertExceptionRow(b,a,c),this.db.exec("COMMIT")}catch(a){throw this.db.exec("ROLLBACK"),a}}return P(this.db.prepare("SELECT * FROM exceptions WHERE id = :id").get({id:b}))}insertExceptionRow(a,b,c){this.db.prepare(`INSERT INTO exceptions (
-             id, rule_id, category, value_fingerprint, key_version, masked_value,
-             scope, expires_at, max_uses, use_count, last_used_at, justification,
-             conditions, created_by, created_via, created_at, updated_at
-           ) VALUES (
-             :id, :ruleId, :category, :valueFingerprint, :keyVersion, :maskedValue,
-             :scope, :expiresAt, :maxUses, 0, NULL, :justification,
-             :conditions, :createdBy, :createdVia, :now, :now
-           )`).run({id:a,ruleId:b.ruleId,category:b.category,valueFingerprint:b.valueFingerprint,keyVersion:b.keyVersion,maskedValue:b.maskedValue,scope:b.scope,expiresAt:null===b.expiresAt?null:(0,h.I8t)(b.expiresAt),maxUses:b.maxUses,justification:b.justification,conditions:null===b.conditions?null:JSON.stringify(b.conditions),createdBy:b.createdBy,createdVia:b.createdVia,now:c})}list(a){let b=a?.includeTerminal?"":`WHERE ${N}`,c=this.db.prepare(`SELECT * FROM exceptions ${b} ORDER BY created_at DESC, rowid DESC`).all(a?.includeTerminal?{}:{now:Date.now()}),d=[];for(let a of c)try{d.push(P(a))}catch{}return Promise.resolve(d)}getByIdPrefix(a){if(0===a.length)return Promise.resolve(void 0);let b=this.db.prepare(String.raw`SELECT * FROM exceptions WHERE id LIKE :pattern ESCAPE '\' LIMIT 2`).all({pattern:`${p(a)}%`});if(b.length>1)return Promise.reject(new M(a));let c=b[0];if(!c)return Promise.resolve(void 0);try{return Promise.resolve(P(c))}catch{return Promise.resolve(void 0)}}revoke(a,b,c){let d=Date.now();return Promise.resolve(1===Number(this.db.prepare(`UPDATE exceptions
-            SET revoked_at = :now, revoked_by = :revokedBy, revoke_reason = :reason, updated_at = :now
-          WHERE id = :id AND revoked_at IS NULL`).run({id:a,revokedBy:b,reason:c??null,now:d}).changes))}consume(a,b=Date.now()){return Promise.resolve(1===Number(this.consumeStmt.run({id:a,now:b}).changes))}activeBundleEntries(a,b=Date.now()){let c=this.db.prepare(`SELECT * FROM exceptions
-          WHERE key_version = :keyVersion AND ${N}
-          ORDER BY created_at DESC, rowid DESC`).all({keyVersion:a,now:b}),d=[];for(let a of c)try{let b=null===a.conditions?null:JSON.parse(a.conditions);d.push(h.iRC.parse({id:a.id,ruleId:a.rule_id,valueFingerprint:a.value_fingerprint,keyVersion:a.key_version,expiresAt:null===a.expires_at?null:(0,h.q11)(a.expires_at),maxUses:a.max_uses,useCount:a.use_count,conditions:b}))}catch{}return Promise.resolve(d)}recordBlocked(a){let b=Date.now();return this.sweepBlockedStmt.run({cutoff:b-K}),this.insertBlockedStmt.run({reference:a.reference,ruleId:a.ruleId,category:a.category,valueFingerprint:a.valueFingerprint,keyVersion:a.keyVersion,maskedValue:a.maskedValue,sessionId:a.sessionId,repo:a.repo,blockedAt:b}),Promise.resolve()}recentBlocked(a=18e5){return Promise.resolve(this.db.prepare(`SELECT * FROM blocked_detections
-          WHERE blocked_at > :cutoff
-          ORDER BY blocked_at DESC, rowid DESC`).all({cutoff:Date.now()-a}).map(a=>({reference:a.reference,ruleId:a.rule_id,category:a.category,valueFingerprint:a.value_fingerprint,keyVersion:a.key_version,maskedValue:a.masked_value,sessionId:a.session_id,repo:a.repo,blockedAt:(0,h.q11)(a.blocked_at)})))}sweepTerminal(a,b=Date.now()){return Promise.resolve(Number(this.db.prepare(`DELETE FROM exceptions
-          WHERE updated_at < :cutoff
-            AND (revoked_at IS NOT NULL
-                 OR (expires_at IS NOT NULL AND expires_at <= :now)
-                 OR (max_uses IS NOT NULL AND use_count >= max_uses))`).run({cutoff:b-a,now:b}).changes))}}function P(a){let b=null===a.conditions?null:JSON.parse(a.conditions);return h.V8B.parse({id:a.id,ruleId:a.rule_id,category:a.category,valueFingerprint:a.value_fingerprint,keyVersion:a.key_version,maskedValue:a.masked_value,scope:a.scope,expiresAt:null===a.expires_at?null:(0,h.q11)(a.expires_at),maxUses:a.max_uses,useCount:a.use_count,lastUsedAt:null===a.last_used_at?null:(0,h.q11)(a.last_used_at),justification:a.justification,conditions:b,createdBy:a.created_by,createdVia:a.created_via,createdAt:(0,h.q11)(a.created_at),updatedAt:(0,h.q11)(a.updated_at),revokedAt:null===a.revoked_at?null:(0,h.q11)(a.revoked_at),revokedBy:a.revoked_by,revokeReason:a.revoke_reason})}function Q(a){return`(
-    SELECT fr.status FROM finding_resolution fr
-     WHERE fr.finding_key = ${a}.finding_key
-     ORDER BY fr.created_at DESC, fr.rowid DESC
-     LIMIT 1
-  )`}let R=`(
-  SELECT finding_key, status FROM (
-    SELECT fr.finding_key, fr.status,
-           ROW_NUMBER() OVER (
-             PARTITION BY fr.finding_key
-             ORDER BY fr.created_at DESC, fr.rowid DESC
-           ) AS rn
-      FROM finding_resolution fr
-  ) WHERE rn = 1
-)`;class S{constructor(a){this.db=a,this.insertStmt=a.prepare(`INSERT INTO findings (id, event_id, rule_id, category, severity, span_start, span_end, masked_match, action_taken, confidence, finding_key, first_detected_at)
-       VALUES (:id, :eventId, :ruleId, :category, :severity, :spanStart, :spanEnd, :maskedMatch, :actionTaken, :confidence, :findingKey,
-               (SELECT occurred_at FROM events WHERE id = :eventId))
-       ON CONFLICT (finding_key) DO UPDATE SET
-         event_id = excluded.event_id,
-         category = excluded.category,
-         severity = excluded.severity,
-         span_start = excluded.span_start,
-         span_end = excluded.span_end,
-         masked_match = excluded.masked_match,
-         action_taken = excluded.action_taken,
-         confidence = excluded.confidence`),this.sessionDupStmt=a.prepare(`SELECT 1 FROM findings f JOIN events e ON e.id = f.event_id
-       WHERE f.rule_id = :ruleId AND f.masked_match = :maskedMatch
-         AND json_extract(e.metadata, '$.sessionId') = :sessionId
-       LIMIT 1`)}insertFindings(a,b={}){for(let c of a){if(b.sessionId&&this.isSessionDuplicate(c,b.sessionId))continue;let a=(0,h.zw)(c);this.insertStmt.run({id:a.id,eventId:a.eventId,ruleId:a.ruleId,category:a.category,severity:a.severity,spanStart:a.spanStart,spanEnd:a.spanEnd,maskedMatch:a.maskedMatch,actionTaken:a.actionTaken,confidence:a.confidence,findingKey:a.findingKey??null})}}isSessionDuplicate(a,b){return void 0!==this.sessionDupStmt.get({ruleId:a.ruleId,maskedMatch:a.maskedMatch,sessionId:b})}recentFindings(a){let b=a?.limit??50;return Promise.resolve(this.db.prepare(`SELECT f.id, f.event_id, f.rule_id, f.category, f.severity, f.masked_match,
-                f.action_taken, f.confidence, e.occurred_at, e.source_tool, e.kind
-         FROM findings f JOIN events e ON e.id = f.event_id
-         ORDER BY e.occurred_at DESC, f.rowid DESC
-         LIMIT :limit`).all({limit:b}).map(a=>({id:a.id,eventId:a.event_id,ruleId:a.rule_id,category:a.category,severity:a.severity,maskedMatch:a.masked_match,actionTaken:a.action_taken,confidence:a.confidence,occurredAt:(0,h.q11)(a.occurred_at),sourceTool:a.source_tool,kind:a.kind})))}listGroupedFindings(a){let b=this.db.prepare(`SELECT f.id, f.rule_id, f.category, f.severity, f.masked_match,
-                f.action_taken, f.confidence, e.occurred_at, e.source_tool,
-                json_extract(e.metadata, '$.repo') AS repo,
-                json_extract(e.metadata, '$.filePath') AS file,
-                e.kind AS kind, f.finding_key AS finding_key,
-                ${Q("f")} AS latest_status
-         FROM findings f JOIN events e ON e.id = f.event_id
-         ORDER BY e.occurred_at DESC, f.id DESC
-         LIMIT :cap`).all({cap:2e3}).map(a=>({id:a.id,ruleId:a.rule_id,category:a.category,severity:a.severity,maskedMatch:a.masked_match,actionTaken:a.action_taken,confidence:a.confidence,occurredAt:(0,h.q11)(a.occurred_at),sourceTool:a.source_tool,repo:a.repo??"",file:a.file??"",status:(0,h.xog)({kind:a.kind,findingKey:a.finding_key,latestResolutionStatus:a.latest_status})})),c=(0,h.mAj)(b),d={severity:a.severity,providers:a.provider,actions:a.action,subtype:a.subtype,q:a.q},e=(0,h.rG)(c,d),f=(0,h.A6E)((0,h.tXp)(c,d)),g={findings:f.reduce((a,b)=>a+b.instanceCount,0),groups:f.length},i=a.limit??h.goN;return Promise.resolve({totals:g,facets:e,items:f.slice(0,i),nextCursor:null})}healthSummary(){let a=this.db.prepare("SELECT count(*) AS c FROM findings").get().c,b=Object.fromEntries(h.S8C.map(a=>[a,0]));for(let a of this.db.prepare("SELECT action_taken, count(*) AS c FROM findings GROUP BY action_taken").all())a.action_taken in b&&(b[a.action_taken]=a.c);let c={critical:0,high:0,medium:0,low:0};for(let a of this.db.prepare(`SELECT f.severity AS severity, count(*) AS c
-         FROM findings f
-         LEFT JOIN ${R} latest
-           ON latest.finding_key = f.finding_key
-         WHERE latest.status IS NULL OR latest.status != 'resolved'
-         GROUP BY f.severity`).all())a.severity in c&&(c[a.severity]=a.c);let d=h.IgC,e=new Set(this.db.prepare(`SELECT DISTINCT json_extract(target, '$.category') AS category
-         FROM policies WHERE enabled = 1 AND json_extract(target, '$.category') IS NOT NULL`).all().map(a=>a.category));return Promise.resolve({findings:a,byAction:b,bySeverity:c,coverage:0===d.length?0:d.filter(a=>e.has(a)).length/d.length})}activityByDay(a=7){let b=864e5*Math.floor(Date.now()/864e5)-(a-1)*864e5,c=this.db.prepare(`SELECT date(e.occurred_at / 1000, 'unixepoch') AS day, f.action_taken AS action, count(*) AS c
-         FROM findings f JOIN events e ON e.id = f.event_id
-         WHERE e.occurred_at >= :since
-         GROUP BY day, f.action_taken`).all({since:b}),d=new Map;for(let c=0;c<a;c++){let a=new Date(b+864e5*c).toISOString().slice(0,10);d.set(a,{day:a,total:0,redacted:0,warned:0,blocked:0})}for(let a of c){let b=d.get(a.day);b&&(b.total+=a.c,"redact"===a.action?b.redacted+=a.c:"warn"===a.action?b.warned+=a.c:"block"===a.action&&(b.blocked+=a.c))}return Promise.resolve([...d.values()].sort((a,b)=>a.day.localeCompare(b.day)))}}class T{constructor(a){this.db=a,this.insertStmt=a.prepare(`INSERT OR IGNORE INTO inspection_definitions
-         (id, rule_id, name, category, severity, definition, version)
-       VALUES
-         (:id, :ruleId, :name, :category, :severity, :definition, :version)`)}upsert(a){var b,c;let d=(b=a.ruleId,c=a.version,i((0,h.tTV)(["inspection_definition",b,c]))),e=(0,h.JAl)(a,d);return this.insertStmt.run({id:e.id,ruleId:e.ruleId,name:e.name,category:e.category,severity:e.severity,definition:e.definition,version:e.version}),d}}class U{constructor(a){this.db=a,this.insertStmt=a.prepare(`INSERT INTO inspection_findings
-         (id, audit_event_id, inspection_definition_id, classified_data_id,
-          span_start, span_end, masked_match, action_taken, confidence)
-       VALUES
-         (:id, :auditEventId, :inspectionDefinitionId, :classifiedDataId,
-          :spanStart, :spanEnd, :maskedMatch, :actionTaken, :confidence)
-       ON CONFLICT(id) DO NOTHING`)}insertFinding(a){let b=(0,h.$3l)(a);this.insertStmt.run({id:b.id,auditEventId:b.auditEventId,inspectionDefinitionId:b.inspectionDefinitionId,classifiedDataId:b.classifiedDataId??null,spanStart:b.spanStart,spanEnd:b.spanEnd,maskedMatch:b.maskedMatch,actionTaken:b.actionTaken,confidence:b.confidence})}}function V(a){let b=/^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z-.]+))?$/.exec(a.trim());return b?{core:[Number(b[1]),Number(b[2]),Number(b[3])],pre:b[4]?b[4].split("."):[]}:null}let W=h.Jr;function X(a){return a.map(a=>{var b;return`${a.namespace}/${a.packId}@${a.version}#${b=a.rulesJson,(0,d.createHash)("sha1").update(b).digest("hex")}`}).sort().join(",")}function Y(a){let b=/^(\d+)\.(\d+)\.(\d+)/.exec(a);return b?[Number(b[1]),Number(b[2]),Number(b[3])]:null}class Z{constructor(a){this.db=a,this.insertMissingStmt=a.prepare(`INSERT INTO installed_packs (id, namespace, pack_id, version, name, rules_json, enabled, created_at, updated_at)
-       VALUES (:id, :namespace, :packId, :version, :name, :rulesJson, 1, :now, :now)
-       ON CONFLICT (namespace, pack_id) DO NOTHING`),this.upsertAvailableStmt=a.prepare(`INSERT INTO available_packs (id, namespace, pack_id, version, name, rules_json, recorded_by, updated_at)
-       VALUES (:id, :namespace, :packId, :version, :name, :rulesJson, :recordedBy, :now)
-       ON CONFLICT (namespace, pack_id) DO UPDATE SET
-         version = excluded.version,
-         name = excluded.name,
-         rules_json = excluded.rules_json,
-         recorded_by = excluded.recorded_by,
-         updated_at = excluded.updated_at
-       WHERE available_packs.version <> excluded.version
-          OR available_packs.name <> excluded.name
-          OR available_packs.rules_json <> excluded.rules_json`),this.signatureStmt=a.prepare("SELECT namespace, pack_id AS packId, version, rules_json AS rulesJson FROM available_packs")}recordInventory(a,b){if(0!==a.length)try{let c=a.map(a=>({namespace:a.namespace,packId:a.packId,version:a.version,name:a.name,rulesJson:JSON.stringify(a.rules),ruleIds:new Set(a.rules.map(a=>a.id))}));if(this.storedSignature()===X(c))return;let e=Date.now();this.db.exec("BEGIN IMMEDIATE");try{let a=this.mirrorState(),f=!1;for(let g of c){let c={id:(0,d.randomUUID)(),namespace:g.namespace,packId:g.packId,version:g.version,name:g.name,rulesJson:g.rulesJson,now:e},h=a.get(`${g.namespace}/${g.packId}`);void 0===h||!function(a,b){let c=Y(a.version);if(null===c)return!0;let d=Y(b.version);if(null===d)return!1;for(let a=0;a<3;a++){let b=c[a]??0,e=d[a]??0;if(b!==e)return b<e}for(let c of b.ruleIds)if(!a.ruleIds.has(c))return!0;return!1}(g,h)?this.upsertAvailableStmt.run({...c,id:(0,d.randomUUID)(),recordedBy:b?.recordedBy??null}):f=!0,this.insertMissingStmt.run(c)}f||this.pruneAvailable(c.map(a=>`${a.namespace}/${a.packId}`)),this.db.exec("COMMIT")}catch(a){throw this.db.exec("ROLLBACK"),a}}catch{}}mirrorState(){return new Map(this.db.prepare("SELECT namespace, pack_id AS packId, version, rules_json AS rulesJson FROM available_packs").all().map(a=>[`${a.namespace}/${a.packId}`,{version:a.version,ruleIds:function(a){let b,c=new Set;try{b=JSON.parse(a)}catch{return c}if(!Array.isArray(b))return c;for(let a of b)if(a&&"object"==typeof a){let b=a.id;"string"==typeof b&&c.add(b)}return c}(a.rulesJson)}]))}pruneAvailable(a){let b=this.db.prepare("SELECT namespace, pack_id AS packId FROM available_packs").all(),c=new Set(a),d=this.db.prepare("DELETE FROM available_packs WHERE namespace = ? AND pack_id = ?");for(let a of b)c.has(`${a.namespace}/${a.packId}`)||d.run(a.namespace,a.packId)}applyUpdate(a,b){if(this.db.isTransaction)throw Error("applyUpdate must not be called inside an open transaction");this.db.exec("BEGIN IMMEDIATE");try{this.db.exec("UPDATE _pack_write_gate SET open = 1 WHERE id = 1");let c=this.db.prepare(`UPDATE installed_packs SET
-             version = (SELECT a.version FROM available_packs a
-                        WHERE a.namespace = :namespace AND a.pack_id = :packId),
-             name = (SELECT a.name FROM available_packs a
-                     WHERE a.namespace = :namespace AND a.pack_id = :packId),
-             rules_json = (SELECT a.rules_json FROM available_packs a
-                           WHERE a.namespace = :namespace AND a.pack_id = :packId),
-             updated_at = :now
-           WHERE namespace = :namespace AND pack_id = :packId
-             AND EXISTS (SELECT 1 FROM available_packs a
-                         WHERE a.namespace = :namespace AND a.pack_id = :packId)`).run({namespace:a,packId:b,now:Date.now()});return this.db.exec("UPDATE _pack_write_gate SET open = 0 WHERE id = 1"),this.db.exec("COMMIT"),Number(c.changes)>0}catch(a){try{this.db.exec("ROLLBACK")}catch{}throw a}}installedRuleset(){let a=this.db.prepare("SELECT enabled, policy_id AS policyId, rules_json AS rulesJson FROM installed_packs").all(),b={installedPacks:a.length,enabledPacks:0,rules:[],invalidRules:0,ruleActions:new Map};for(let c of a){let a;if(1!==c.enabled)continue;b.enabledPacks+=1;let d=(0,h.DhA)(c.policyId);try{a=JSON.parse(c.rulesJson)}catch{b.invalidRules+=1;continue}if(!Array.isArray(a)){b.invalidRules+=1;continue}for(let c of a){let a=h.jON.safeParse(c);a.success?(b.rules.push(a.data),b.ruleActions.set(a.data.id,d)):b.invalidRules+=1}}return b}newestRecordedBinary(){let a=this.db.prepare("SELECT DISTINCT recorded_by AS recordedBy FROM available_packs WHERE recorded_by IS NOT NULL").all(),b=null;for(let c of a){let a=c.recordedBy.lastIndexOf("@");if(a<=0||a===c.recordedBy.length-1)continue;let d=c.recordedBy.slice(0,a),e=c.recordedBy.slice(a+1);null!==V(e)&&(null===b||function(a,b){let c=V(a),d=V(b);if(!c||!d)return 0;for(let a=0;a<3;a++){let b=c.core[a]??0,e=d.core[a]??0;if(b!==e)return b<e?-1:1}return function(a,b){if(0===a.length&&0===b.length)return 0;if(0===a.length)return 1;if(0===b.length)return -1;let c=Math.min(a.length,b.length);for(let d=0;d<c;d++){let c=a[d]??"",e=b[d]??"";if(c===e)continue;let f=/^\d+$/.test(c),g=/^\d+$/.test(e);if(f&&!g)return -1;if(!f&&g)return 1;if(f&&g)return Number(c)<Number(e)?-1:1;return c<e?-1:1}return a.length===b.length?0:a.length<b.length?-1:1}(c.pre,d.pre)}(e,b.version)>0)&&(b={binary:d,version:e})}return b}counts(){return Promise.resolve(this.db.prepare(`SELECT count(*) AS packs,
-                coalesce(sum(json_array_length(rules_json)), 0) AS rules,
-                coalesce(sum(enabled), 0) AS enabled
-         FROM installed_packs`).get())}countsByPolicyId(){return new Map(this.db.prepare(`SELECT coalesce(policy_id, '${W}') AS pid, count(*) AS n
-         FROM installed_packs
-         GROUP BY pid`).all().map(a=>[a.pid,a.n]))}listByPolicyId(a){return this.db.prepare(`SELECT namespace, pack_id AS packId, name, enabled, rules_json AS rulesJson
-         FROM installed_packs
-         WHERE coalesce(policy_id, '${W}') = ?
-         ORDER BY name ASC`).all(a).map(a=>({id:`${a.namespace}/${a.packId}`,name:a.name,ruleCount:G(a.rulesJson).length,enabled:1===a.enabled}))}setPolicy(a,b,c){if(null!==c&&!h.HUb.safeParse(c).success)throw Error(`Unknown policy '${c}'. Must be one of: ${h.V0H.join(", ")}.`);return Number(this.db.prepare(`UPDATE installed_packs SET policy_id = :policyId, updated_at = :now
-         WHERE namespace = :namespace AND pack_id = :packId`).run({policyId:c,now:Date.now(),namespace:a,packId:b}).changes)>0}setEnabled(a,b,c){return Number(this.db.prepare(`UPDATE installed_packs SET enabled = :enabled, updated_at = :now
-         WHERE namespace = :namespace AND pack_id = :packId`).run({enabled:+!!c,now:Date.now(),namespace:a,packId:b}).changes)>0}storedSignature(){return X(this.signatureStmt.all())}}class ${constructor(a){this.db=a,this.upsertStmt=a.prepare(`INSERT INTO inventory
-         (id, object_type, location, title, host_id, attributes, first_seen, last_seen)
-       VALUES
-         (:id, :objectType, :location, :title, :hostId, :attributes, :firstSeen, :lastSeen)
-       ON CONFLICT(id) DO UPDATE SET
-         location = excluded.location,
-         title = excluded.title,
-         host_id = excluded.host_id,
-         attributes = excluded.attributes,
-         last_seen = excluded.last_seen`)}upsert(a,b=Date.now()){var c,d;let e=(c=a.objectType,d=a.identityKey,i((0,h.tTV)(["inventory",c,d]))),f=(0,h.gzP)(a,e,b);return this.upsertStmt.run({id:f.id,objectType:f.objectType,location:f.location??null,title:f.title??null,hostId:f.hostId??null,attributes:f.attributes,firstSeen:f.firstSeen,lastSeen:f.lastSeen}),e}findById(a){return this.db.prepare("SELECT * FROM inventory WHERE id = :id").get({id:a})}distinctTitles(a){return this.db.prepare(`SELECT DISTINCT title FROM inventory
-         WHERE object_type = :objectType AND title IS NOT NULL
-         ORDER BY title`).all({objectType:a}).map(a=>a.title)}osVersions(){return this.db.prepare(`SELECT DISTINCT os_version AS value FROM inventory
-         WHERE object_type = 'host' AND os_version IS NOT NULL
-         ORDER BY value`).all().map(a=>a.value)}}let _=["config","skill","mcp","hook"],aa=new Set(h.SHn.options),ab="(url IS NULL OR (url NOT LIKE '%/.claude/worktrees/%' AND url NOT LIKE '%\\.claude\\worktrees\\%'))",ac={claudecode:"Claude Code",cursor:"Cursor",codex:"Codex"},ad={accessCounts:{open:0,approved:0,blocked:0,total:0},findingsCount:0};function ae(a,b){if(null==a)return b;try{return JSON.parse(a)}catch{return b}}function af(a,b){if(a.provider&&aa.has(a.provider))return a.provider;let c=(b.title??"").toLowerCase().replace(/[\s-]/g,"");return c.includes("claudecode")||"claude"===c?"claudecode":c.includes("cursor")?"cursor":c.includes("codex")?"codex":null}function ag(a){return a.some(a=>{let b=ae(a.attributes,{});return"sample"!==b.provenance&&"claudecode"===af(b,a)})}function ah(a){let b={id:a.id,type:a.assetType,name:a.name,sub:a.sub??"",flags:ae(a.flagsJson,[])};return"mcp"===a.assetType&&a.effectiveTrust&&(b.trust=a.effectiveTrust),b}function ai(a){let b="update_available"===a.status?["update"]:[],c={source:a.source,scope:a.scope};return void 0!==a.installedVersion&&(c.installedVersion=a.installedVersion),void 0!==a.latestVersion&&(c.latestVersion=a.latestVersion),void 0!==a.updatedAt&&(c.updatedAt=a.updatedAt),{id:a.id,assetType:"skill",name:a.name,sub:`Skill \xb7 ${a.source}`,description:a.description??null,flagsJson:JSON.stringify(b),metaJson:JSON.stringify(c),trust:null,toolsJson:null,effectiveTrust:null}}function aj(a){let b="egress"===a.status?["risk"]:"conflict"===a.status?["conflict"]:"unknown"===a.status?["unknown"]:[],c={event:a.event,command:a.command,scope:a.scope,status:a.status};return void 0!==a.matcher&&(c.matcher=a.matcher),void 0!==a.pluginName&&(c.pluginName=a.pluginName),a.warnings.length>0&&(c.warnings=a.warnings),{id:a.id,assetType:"hook",name:am(a.command.trim(),64),sub:a.matcher?`Hook \xb7 ${a.event} \xb7 ${a.matcher}`:`Hook \xb7 ${a.event}`,description:a.warnings.length>0?a.warnings.join(" \xb7 "):null,flagsJson:JSON.stringify(b),metaJson:JSON.stringify(c),trust:null,toolsJson:null,effectiveTrust:null}}function ak(a){let b={scope:a.scope,transport:a.transport};return void 0!==a.command&&(b.command=a.command),void 0!==a.url&&(b.url=a.url),void 0!==a.envKeys&&(b.envKeys=a.envKeys),void 0!==a.pluginName&&(b.pluginName=a.pluginName),void 0!==a.marketplace&&(b.marketplace=a.marketplace),void 0!==a.project&&(b.project=a.project),{id:a.id,assetType:"mcp",name:a.name,sub:`MCP server \xb7 ${a.transport} \xb7 ${am(function(a){if(void 0!==a.url)try{return new URL(a.url).host}catch{return a.url}return a.command??a.name}(a),48)}`,description:null,flagsJson:"[]",metaJson:JSON.stringify(b),trust:"unapproved",toolsJson:null,effectiveTrust:a.trust}}function al(a){let b=a.untracked?["untracked"]:[],c={kind:a.kind,scope:a.scope,path:a.path};return void 0!==a.detail&&(c.detail=a.detail),void 0!==a.entryCount&&(c.entryCount=a.entryCount),void 0!==a.updatedAt&&(c.updatedAt=a.updatedAt),{id:a.id,assetType:"config",name:a.name,sub:a.kind,description:a.detail??null,flagsJson:JSON.stringify(b),metaJson:JSON.stringify(c),trust:null,toolsJson:null,effectiveTrust:null}}function am(a,b){return a.length>b?`${a.slice(0,b-1)}…`:a}function an(a,b,c){let d=ae(a.attributes,{});return{id:a.id,name:a.name??"",repo:a.url??"",visibility:d.visibility??"private",language:d.language??"",policyDefault:d.policyDefault??"approved",updatedAt:new Date(a.lastSeen).toISOString(),accessCounts:b,findingsCount:c}}function ao(a){return{path:a.path,name:a.name,origin:a.origin,access:a.effectiveAccess,isCustom:null!==a.overrideAccess&&a.overrideAccess!==a.defaultAccess,findings:a.findingsCount,blockedAt:null!==a.blockedAtMs?new Date(a.blockedAtMs).toISOString():null,note:a.note}}class ap{constructor(a){this.db=a}getInventoryStats(){let a={project:0,skill:0,mcp:0,hook:0,config:0};for(let b of this.db.prepare("SELECT asset_type AS t, count(*) AS n FROM inventory_asset GROUP BY asset_type").all())b.t in a&&(a[b.t]=b.n);a.project=this.db.prepare(`SELECT count(*) AS n FROM source_project WHERE ${ab}`).get().n;let b={"known-good":0,risky:0,unapproved:0};for(let a of this.db.prepare(`SELECT coalesce(o.trust, a.trust) AS trust, count(*) AS n
-         FROM inventory_asset a
-         LEFT JOIN mcp_trust_override o ON o.asset_id = a.id
-         WHERE a.asset_type = 'mcp' AND coalesce(o.trust, a.trust) IS NOT NULL
-         GROUP BY coalesce(o.trust, a.trust)`).all())a.trust in b&&(b[a.trust]=a.n);let c=this.db.prepare(`SELECT count(*) AS n FROM inventory
-           WHERE object_type = 'harness'
-             AND (last_seen >= :liveSince OR json_extract(attributes, '$.provenance') = 'sample')`).get({liveSince:Date.now()-2592e6}).n,d=this.db.prepare("SELECT count(*) AS n FROM inventory_asset WHERE flags_json <> '[]'").get().n,e=this.db.prepare("SELECT count(DISTINCT project_id) AS n FROM project_file WHERE findings_count > 0").get().n,f=this.configAssetRows();for(let c of f)a[c.assetType]+=1,"mcp"===c.assetType&&c.effectiveTrust&&(b[c.effectiveTrust]+=1);return Promise.resolve({attention:d+e+f.filter(a=>"[]"!==a.flagsJson).length,byType:a,harnesses:c,mcpTrust:b})}listHarnesses(a){let b=this.fetchHarnessRows();if(0===b.length)return Promise.resolve({items:[]});let c=new Map;for(let a of b){let b=af(ae(a.attributes,{}),a);if(!b)continue;let d=c.get(b);d?d.push(a):c.set(b,[a])}let d=this.assetsByHarness(b.map(a=>a.id),a),e=[...new Set(b.flatMap(a=>ae(a.attributes,{}).projectIds??[]))],f=this.fetchProjectsByIds(e),g=this.projectAggregates(e),h=this.configAssetRows(a,ag(b)),i=[];for(let[b,e]of c){let c=e.flatMap(a=>d.get(a.id)??[]),j=e.some(a=>"sample"!==ae(a.attributes,{}).provenance)&&"claudecode"===b&&h.length>0?[...c,...h].sort((a,b)=>a.name.localeCompare(b.name)):c;if(a&&0===j.length)continue;let k=e[0];if(!k)continue;let l=ae(k.attributes,{}),m=[...new Set(e.flatMap(a=>ae(a.attributes,{}).projectIds??[]))].map(a=>f.get(a)).filter(a=>void 0!==a).map(a=>{let b=g.get(a.id)??ad;return an(a,b.accessCounts,b.findingsCount)}),n=e.reduce((a,b)=>a+(ae(b.attributes,{}).sessions??0),0),o=j.reduce((a,b)=>a+ae(b.flagsJson,[]).length,0),p=new Map;for(let a of j){let b=p.get(a.assetType);b?b.push(ah(a)):p.set(a.assetType,[ah(a)])}let q=_.filter(a=>p.has(a)).map(a=>({type:a,assets:p.get(a)??[]}));i.push({id:b,label:l.label??ac[b],kind:l.kind??l.provider??b,version:l.harness_version??k.harnessVersion??"",sessions:n,assetCount:j.length,flagCount:o,projects:m,categories:q})}return Promise.resolve({items:i})}listAssets(a){let b=this.fetchAssets(a.type,a.q);if(0===b.length)return Promise.resolve({groups:[]});let c=new Map;for(let a of b){let b=c.get(a.assetType);b?b.push(a):c.set(a.assetType,[a])}let d=[...c.entries()].map(([a,b])=>{let c=new Map;for(let a of b)for(let b of ae(a.flagsJson,[]))c.set(b,(c.get(b)??0)+1);let d={type:a,total:b.length,flagRollup:Object.fromEntries(c),items:b.map(ah)};if("mcp"===a){let a=new Map;for(let c of b)c.effectiveTrust&&a.set(c.effectiveTrust,(a.get(c.effectiveTrust)??0)+1);d.trustRollup=Object.fromEntries(a)}return d});return d.sort((a,b)=>_.indexOf(a.type)-_.indexOf(b.type)),Promise.resolve({groups:d})}getAsset(a){let b=this.fetchAssetById(a);return Promise.resolve(b?function(a){let b={id:a.id,type:a.assetType,name:a.name,sub:a.sub??"",flags:ae(a.flagsJson,[]),description:a.description??null,trust:"mcp"===a.assetType?a.effectiveTrust??null:null,meta:ae(a.metaJson,{}),finding:null};if("mcp"===a.assetType&&null!==a.toolsJson){let c=ae(a.toolsJson,[]);b.tools="unapproved"===a.effectiveTrust?c.map(a=>({...a,risk:a.risk??"Tool access blocked: MCP server trust is unapproved."})):c}return b}(b):null)}listProjects(a){let b=this.fetchProjects(a),c=this.projectAggregates(b.map(a=>a.id));return Promise.resolve({items:b.map(a=>{let b=c.get(a.id)??ad;return an(a,b.accessCounts,b.findingsCount)})})}getProjectTree(a,b){let c=this.fetchProjectById(a);if(!c)return Promise.resolve(null);let d=ae(c.attributes,{}),e={id:c.id,repo:c.url??"",visibility:d.visibility??"private"},f=b.path??"";if("blocked"===b.filter){let b=this.fetchProjectFilesBlocked(a);return b.sort((a,b)=>(b.blockedAtMs??0)-(a.blockedAtMs??0)),Promise.resolve({project:e,path:f,files:b.map(ao)})}if(void 0!==b.q&&""!==b.q)return Promise.resolve({project:e,path:f,files:this.fetchProjectFilesSearch(a,b.q).map(ao)});let g=this.fetchProjectFilesUnder(a,f),h=""===f?"":`${f}/`,i=[],j=new Map;for(let a of g){let b=h.length>0?a.path.slice(h.length):a.path,c=b.indexOf("/");if(-1===c)i.push(a);else{let d=b.slice(0,c),e=j.get(d)??[];e.push(a),j.set(d,e)}}let k=[...j.entries()].sort(([a],[b])=>a.localeCompare(b)).map(([a,b])=>({name:a,path:h.length>0?`${f}/${a}`:a,accessCounts:function(a){let b={open:0,approved:0,blocked:0,total:0};for(let c of a)b.total++,b[c.effectiveAccess]++;return b}(b)}));return Promise.resolve({project:e,path:f,folders:k,files:i.map(ao)})}getProjectFile(a,b){let c=this.fetchProjectById(a);if(!c)return Promise.resolve(null);let d=this.fetchProjectFile(a,b);if(!d)return Promise.resolve(null);let e=ae(c.attributes,{});return Promise.resolve({...ao(d),project:{repo:c.url??"",visibility:e.visibility??"private",language:e.language??"",policyDefault:e.policyDefault??"approved",updatedAt:new Date(c.lastSeen).toISOString()},findingsRefs:[]})}setFileAccess(a,b,c){let e=this.fetchProjectFile(a,b);return!!e&&(c===e.defaultAccess?this.db.prepare("DELETE FROM file_access_override WHERE project_id = ? AND path = ?").run(a,b):this.db.prepare(`INSERT INTO file_access_override (id, project_id, path, access, created_at, updated_at)
-           VALUES (:id, :projectId, :path, :access, :now, :now)
-           ON CONFLICT (project_id, path) DO UPDATE SET access = excluded.access, updated_at = excluded.updated_at`).run({id:(0,d.randomUUID)(),projectId:a,path:b,access:c,now:Date.now()}),!0)}setMcpTrust(a,b){let c=this.fetchAssetById(a);return c?"mcp"!==c.assetType?"not_mcp":(b===c.trust?this.db.prepare("DELETE FROM mcp_trust_override WHERE asset_id = ?").run(a):this.db.prepare(`INSERT INTO mcp_trust_override (id, asset_id, trust, created_at, updated_at)
-           VALUES (:id, :assetId, :trust, :now, :now)
-           ON CONFLICT (asset_id) DO UPDATE SET trust = excluded.trust, updated_at = excluded.updated_at`).run({id:(0,d.randomUUID)(),assetId:a,trust:b,now:Date.now()}),this.configRowsCache=void 0,"ok"):"not_found"}fetchHarnessRows(){return this.db.prepare(`SELECT id, title, attributes, harness_version AS harnessVersion
-         FROM inventory
-         WHERE object_type = 'harness'
-           AND (last_seen >= :liveSince OR json_extract(attributes, '$.provenance') = 'sample')`).all({liveSince:Date.now()-2592e6})}assetsByHarness(a,b){let c=new Map;if(0===a.length)return c;let d=[...a],e=`ha.harness_id IN (${q(a.length)})`;if(b){let a=`%${p(b)}%`;e+=" AND (a.name LIKE ? ESCAPE '\\' OR a.sub LIKE ? ESCAPE '\\')",d.push(a,a)}for(let a of this.db.prepare(`SELECT ha.harness_id AS harnessInvId, a.id, a.asset_type AS assetType, a.name, a.sub,
-                a.description, a.flags_json AS flagsJson, a.meta_json AS metaJson, a.trust,
-                a.tools_json AS toolsJson, coalesce(o.trust, a.trust) AS effectiveTrust
-         FROM harness_asset ha
-         JOIN inventory_asset a ON a.id = ha.asset_id
-         LEFT JOIN mcp_trust_override o ON o.asset_id = a.id
-         WHERE ${e}
-         ORDER BY a.name ASC`).all(...d)){let b=a.harnessInvId,[d]=this.mapAssetRows([a]);if(!d)continue;let e=c.get(b);e?e.push(d):c.set(b,[d])}return c}fetchAssets(a,b){let c=[],d=[];if(a&&a.length>0&&(c.push(`a.asset_type IN (${q(a.length)})`),d.push(...a)),b){let a=`%${p(b)}%`;c.push("(a.name LIKE ? ESCAPE '\\' OR a.sub LIKE ? ESCAPE '\\')"),d.push(a,a)}let e=c.length?`WHERE ${c.join(" AND ")}`:"",f=this.mapAssetRows(this.db.prepare(`SELECT a.id, a.asset_type AS assetType, a.name, a.sub, a.description,
-                  a.flags_json AS flagsJson, a.meta_json AS metaJson, a.trust,
-                  a.tools_json AS toolsJson, coalesce(o.trust, a.trust) AS effectiveTrust
-           FROM inventory_asset a
-           LEFT JOIN mcp_trust_override o ON o.asset_id = a.id
-           ${e}
-           ORDER BY a.name ASC`).all(...d)),g=this.configAssetRows(b).filter(b=>!a||0===a.length||a.includes(b.assetType));return g.length>0?[...f,...g].sort((a,b)=>a.name.localeCompare(b.name)):f}fetchAssetById(a){return this.mapAssetRows(this.db.prepare(`SELECT a.id, a.asset_type AS assetType, a.name, a.sub, a.description,
-                  a.flags_json AS flagsJson, a.meta_json AS metaJson, a.trust,
-                  a.tools_json AS toolsJson, coalesce(o.trust, a.trust) AS effectiveTrust
-           FROM inventory_asset a
-           LEFT JOIN mcp_trust_override o ON o.asset_id = a.id
-           WHERE a.id = ?`).all(a))[0]??this.configAssetRows().find(b=>b.id===a)??null}mapAssetRows(a){return a.map(a=>({id:a.id,assetType:a.assetType,name:a.name,sub:a.sub??null,description:a.description??null,flagsJson:a.flagsJson??"[]",metaJson:a.metaJson??"{}",trust:a.trust??null,toolsJson:a.toolsJson??null,effectiveTrust:a.effectiveTrust??null}))}configAssetRows(a,b){let c=this.liveConfigAssetRows(b);if(!a)return c;let d=a.toLowerCase();return c.filter(a=>a.name.toLowerCase().includes(d)||(a.sub??"").toLowerCase().includes(d))}liveConfigAssetRows(a){if(!(a??ag(this.fetchHarnessRows())))return[];let b=this.latestConfigScanId();if(null===b)return[];if(this.configRowsCache?.scanId===b)return this.configRowsCache.rows;let c=new E(this.db).report(),d=[...c.skills.map(ai),...c.hooks.map(aj),...c.mcpServers.map(ak),...c.configFiles.map(al)].sort((a,b)=>a.name.localeCompare(b.name));return this.configRowsCache={scanId:b,rows:d},d}latestConfigScanId(){let a=this.db.prepare(`SELECT id FROM audit_events WHERE event_type = 'config_scan'
-         ORDER BY started_at DESC, id DESC LIMIT 1`).get();return a?.id??null}fetchProjects(a){let b=`SELECT id, url, name, attributes, last_seen AS lastSeen FROM source_project
-               WHERE ${ab}`,c=[];if(a){let d=`%${p(a)}%`;b+=" AND (name LIKE ? ESCAPE '\\' OR url LIKE ? ESCAPE '\\')",c.push(d,d)}return b+=" ORDER BY name ASC",this.db.prepare(b).all(...c)}fetchProjectById(a){return this.db.prepare("SELECT id, url, name, attributes, last_seen AS lastSeen FROM source_project WHERE id = ?").get(a)??null}fetchProjectsByIds(a){let b=new Map;if(0===a.length)return b;for(let c of this.db.prepare(`SELECT id, url, name, attributes, last_seen AS lastSeen
-         FROM source_project WHERE id IN (${q(a.length)})`).all(...a))b.set(c.id,c);return b}projectAggregates(a){let b=new Map;if(0===a.length)return b;for(let c of this.db.prepare(`SELECT f.project_id AS projectId,
-                coalesce(o.access, f.default_access) AS eff,
-                count(*) AS n,
-                coalesce(sum(f.findings_count), 0) AS findings
-         FROM project_file f
-         LEFT JOIN file_access_override o ON o.project_id = f.project_id AND o.path = f.path
-         WHERE f.project_id IN (${q(a.length)})
-         GROUP BY f.project_id, eff`).all(...a)){let a=b.get(c.projectId);a||(a={accessCounts:{open:0,approved:0,blocked:0,total:0},findingsCount:0},b.set(c.projectId,a)),a.accessCounts.total+=c.n,a.accessCounts[c.eff]+=c.n,a.findingsCount+=c.findings}return b}fileSelect(a){return`SELECT f.path, f.name, f.origin, f.default_access AS defaultAccess,
-                   f.findings_count AS findingsCount, f.blocked_at AS blockedAtMs, f.note,
-                   coalesce(o.access, f.default_access) AS effectiveAccess,
-                   o.access AS overrideAccess
-            FROM project_file f
-            LEFT JOIN file_access_override o ON o.project_id = f.project_id AND o.path = f.path
-            WHERE ${a}`}mapFileRows(a){return a.map(a=>({path:a.path,name:a.name,origin:a.origin,defaultAccess:a.defaultAccess,findingsCount:a.findingsCount??0,blockedAtMs:a.blockedAtMs??null,note:a.note??null,effectiveAccess:a.effectiveAccess,overrideAccess:a.overrideAccess??null}))}fetchProjectFilesUnder(a,b){return""===b?this.mapFileRows(this.db.prepare(this.fileSelect("f.project_id = ? ORDER BY f.path ASC")).all(a)):this.mapFileRows(this.db.prepare(this.fileSelect("f.project_id = ? AND f.path LIKE ? ESCAPE '\\' ORDER BY f.path ASC")).all(a,`${p(b)}/%`))}fetchProjectFilesSearch(a,b){let c=`%${p(b)}%`;return this.mapFileRows(this.db.prepare(this.fileSelect("f.project_id = ? AND (f.path LIKE ? ESCAPE '\\' OR f.name LIKE ? ESCAPE '\\') ORDER BY f.path ASC")).all(a,c,c))}fetchProjectFilesBlocked(a){return this.mapFileRows(this.db.prepare(this.fileSelect("f.project_id = ? AND coalesce(o.access, f.default_access) = 'blocked' AND f.blocked_at IS NOT NULL")).all(a))}fetchProjectFile(a,b){return this.mapFileRows(this.db.prepare(this.fileSelect("f.project_id = ? AND f.path = ?")).all(a,b))[0]??null}}class aq{constructor(a){this.db=a}readPolicies(){let a=this.db.prepare("SELECT * FROM policies").all(),b=[];for(let c of a)try{let a=JSON.parse(c.target),d=c.custom_keywords?JSON.parse(c.custom_keywords):void 0;b.push(h.PEm.parse({id:c.id,scope:c.scope,target:a,action:c.action,enabled:1===c.enabled,customKeywords:d}))}catch{}return Promise.resolve(b)}seedDefaults(){if(this.db.prepare("SELECT count(*) AS c FROM policies").get().c>0)return;let a=this.db.prepare(`INSERT INTO policies (id, scope, target, action, enabled, created_at, updated_at)
-       VALUES (:id, 'global', :target, :action, 1, :now, :now)`);this.db.exec("BEGIN");try{for(let[b,c]of Object.entries(h.unw))a.run({id:(0,d.randomUUID)(),target:JSON.stringify({category:b}),action:c,now:Date.now()});this.db.exec("COMMIT")}catch{this.db.exec("ROLLBACK")}}}class ar{constructor(a){this.packs=a}getPolicyList(a){if("custom"===a)return Promise.resolve({items:[]});let b=this.packs.countsByPolicyId();return Promise.resolve({items:h.RRF.map(a=>({id:a,kind:"builtin",name:h.ZpU[a].name,enabled:!0,usedByCount:b.get(a)??0}))})}getPolicyStats(){let a=this.packs.countsByPolicyId(),b=h.V0H.reduce((b,c)=>b+(a.get(c)??0),0),c=h.V0H.length;return Promise.resolve({policies:c,builtin:c,custom:0,detectionsGoverned:b})}getPolicyDetail(a){let b=h.V0H.find(b=>b===a);if(void 0===b)return Promise.resolve(null);let c=h.ZpU[b];return Promise.resolve({specVersion:1,id:a,kind:"builtin",name:c.name,enabled:!0,description:c.description,usedBy:this.packs.listByPolicyId(a)})}}class as{constructor(a){this.db=a,this.maxStampStmt=a.prepare("SELECT coalesce(max(updated_at), 0) AS maxStamp FROM project_file WHERE project_id = :projectId"),this.upsertStmt=a.prepare(`INSERT INTO project_file
-         (id, project_id, path, name, origin, default_access, findings_count, blocked_at, note, created_at, updated_at)
-       VALUES
-         (:id, :projectId, :path, :name, :origin, :defaultAccess, 0, NULL, NULL, :now, :now)
-       ON CONFLICT (project_id, path) DO UPDATE SET
-         name = excluded.name,
-         origin = excluded.origin,
-         default_access = excluded.default_access,
-         updated_at = excluded.updated_at`),this.pruneStmt=a.prepare("DELETE FROM project_file WHERE project_id = :projectId AND updated_at < :now")}replaceForProject(a,b,c){let{maxStamp:e}=this.maxStampStmt.get({projectId:a}),f=Math.max(c,e+1);for(let c of b.files)this.upsertStmt.run({id:(0,d.randomUUID)(),projectId:a,path:c.path,name:c.name,origin:c.origin,defaultAccess:c.defaultAccess,now:f});b.truncated||this.pruneStmt.run({projectId:a,now:f})}}class at{constructor(a,b=()=>Date.now()){this.db=a,this.now=b,this.insertStmt=a.prepare(`INSERT INTO finding_resolution (id, finding_key, status, method, resolved_at, evidence, created_at)
-       VALUES (:id, :findingKey, :status, :method, :resolvedAt, :evidence, :createdAt)`),this.latestStmt=a.prepare(`SELECT status, method, resolved_at, evidence
-         FROM finding_resolution
-        WHERE finding_key = :findingKey
-        ORDER BY created_at DESC, rowid DESC
-        LIMIT 1`),this.openAtRestStmt=a.prepare(`SELECT DISTINCT f.finding_key AS finding_key
-         FROM findings f
-         JOIN events e ON e.id = f.event_id
-        WHERE e.kind = 'code_change'
-          AND json_extract(e.metadata, '$.filePath') = :path
-          AND f.finding_key IS NOT NULL
-          AND ${Q("f")} IS NOT 'resolved'`),this.resolvedAtRestStmt=a.prepare(`SELECT DISTINCT f.finding_key AS finding_key
-         FROM findings f
-         JOIN events e ON e.id = f.event_id
-        WHERE e.kind = 'code_change'
-          AND json_extract(e.metadata, '$.filePath') = :path
-          AND f.finding_key IS NOT NULL
-          AND ${Q("f")} = 'resolved'`)}insertResolution(a){this.insertStmt.run({id:(0,d.randomUUID)(),findingKey:a.findingKey,status:h.GCf.parse(a.status),method:h.cqq.parse(a.method),resolvedAt:a.resolvedAt,evidence:a.evidence,createdAt:this.now()})}latestByKey(a){let b=this.latestStmt.get({findingKey:a});if(b)return{status:b.status,method:b.method,resolvedAt:b.resolved_at,evidence:b.evidence??""}}openAtRestKeysForPath(a){return this.openAtRestStmt.all({path:a}).map(a=>a.finding_key)}resolvedAtRestKeysForPath(a){return this.resolvedAtRestStmt.all({path:a}).map(a=>a.finding_key)}}class au{constructor(a){this.db=a,this.upsertStmt=a.prepare(`INSERT INTO scan_ledger (path, mtime, content_hash, ruleset_hash, scanned_at)
-       VALUES (:path, :mtime, :contentHash, :rulesetHash, :scannedAt)
-       ON CONFLICT (path) DO UPDATE SET
-         mtime = excluded.mtime,
-         content_hash = excluded.content_hash,
-         ruleset_hash = excluded.ruleset_hash,
-         scanned_at = excluded.scanned_at`),this.readStmt=a.prepare(`SELECT path, mtime, content_hash AS contentHash
-       FROM scan_ledger WHERE ruleset_hash = :rulesetHash`)}entriesForRuleset(a){return new Map(this.readStmt.all({rulesetHash:a}).map(a=>[a.path,{mtime:a.mtime,contentHash:a.contentHash}]))}upsertEntries(a){if(0===a.length)return;let b=Date.now();try{this.db.exec("BEGIN");try{for(let c of a)this.upsertStmt.run({path:c.path,mtime:c.mtime,contentHash:c.contentHash,rulesetHash:c.rulesetHash,scannedAt:b});this.db.exec("COMMIT")}catch(a){throw this.db.exec("ROLLBACK"),a}}catch{}}}let av=["critical","high","medium","low"],aw={"7d":7,"30d":30,"3m":90,"6m":180},ax={block:"blocked",redact:"redacted",warn:"warned"},ay=["blocked","redacted","warned"],az=[{provider:"claudecode",coverage:100,supported:!0},{provider:"cursor",coverage:0,supported:!1},{provider:"codex",coverage:0,supported:!1},{provider:"chatgpt",coverage:0,supported:!1},{provider:"copilot",coverage:0,supported:!1},{provider:"api",coverage:0,supported:!1}];function aA(a){return"7d"===a||"30d"===a?"day":"week"}function aB(a){return 864e5*Math.floor(a/864e5)}function aC(a){return new Date(a).toISOString().slice(0,10)}class aD{constructor(a,b=()=>Date.now()){this.db=a,this.now=b}severitySummary(){let a=new Map(this.db.prepare(`SELECT f.severity AS severity,
-                COUNT(*) AS count,
-                SUM(CASE
-                      WHEN e.kind != 'code_change' THEN 1
-                      WHEN f.finding_key IS NULL THEN 0
-                      WHEN latest.status = 'resolved' THEN 1
-                      ELSE 0
-                    END) AS caught,
-                SUM(CASE
-                      WHEN e.kind = 'code_change'
-                       AND f.finding_key IS NOT NULL
-                       AND (latest.status IS NULL OR latest.status != 'resolved') THEN 1
-                      ELSE 0
-                    END) AS open_at_rest
-         FROM findings f
-         JOIN events e ON e.id = f.event_id
-         LEFT JOIN ${R} latest
-           ON latest.finding_key = f.finding_key
-         GROUP BY f.severity`).all().map(a=>[a.severity,a])),b=av.map(b=>({severity:b,count:a.get(b)?.count??0,caught:a.get(b)?.caught??0,openAtRest:a.get(b)?.open_at_rest??0}));return Promise.resolve({total:b.reduce((a,b)=>a+b.count,0),needsRemediation:b.reduce((a,b)=>a+b.openAtRest,0),bySeverity:b})}scanCoverage(a){return Promise.resolve({range:a,providers:az.map(a=>({...a}))})}enforcementActions(a){let b=864e5*aw[a],c=this.now(),d=c-b,e=this.findingsInRange(c-2*b,c),f={blocked:0,redacted:0,warned:0},g={blocked:0,redacted:0,warned:0};for(let a of e){let b=ax[a.actionTaken];b&&(a.occurredAt>=d?f[b]++:g[b]++)}let h=ay.map(a=>({kind:a,count:f[a],delta:f[a]-g[a]}));return Promise.resolve({range:a,total:h.reduce((a,b)=>a+b.count,0),actions:h})}findingsTimeseries(a){let b=aA(a),c=("day"===b?1:7)*864e5,d=aw[a],e="day"===b?d:Math.ceil(d/7),f=this.now(),g=aB(f)-(d-1)*864e5,h=this.findingsInRange(g,f),i=Array.from({length:e},(a,b)=>({timestamp:aC(g+b*c),critical:0,high:0,medium:0}));for(let a of h){let b=i[Math.floor((a.occurredAt-g)/c)];if(b){var j;("critical"===(j=a.severity)||"high"===j||"medium"===j)&&b[a.severity]++}}return Promise.resolve({range:a,granularity:b,points:i})}mttrTrend(a){let b=aA(a),c=("day"===b?1:7)*864e5,d=aw[a],e="day"===b?d:Math.ceil(d/7),f=this.now(),g=aB(f)-(d-1)*864e5,h=this.db.prepare(`SELECT COALESCE(f.first_detected_at, e.occurred_at) AS first_detected_at, f.severity AS severity,
-                (
-                  SELECT fr.status FROM finding_resolution fr
-                   WHERE fr.finding_key = f.finding_key
-                   ORDER BY fr.created_at DESC, fr.rowid DESC
-                   LIMIT 1
-                ) AS latest_status,
-                (
-                  SELECT fr.method FROM finding_resolution fr
-                   WHERE fr.finding_key = f.finding_key
-                   ORDER BY fr.created_at DESC, fr.rowid DESC
-                   LIMIT 1
-                ) AS latest_method,
-                (
-                  SELECT fr.resolved_at FROM finding_resolution fr
-                   WHERE fr.finding_key = f.finding_key
-                   ORDER BY fr.created_at DESC, fr.rowid DESC
-                   LIMIT 1
-                ) AS latest_resolved_at
-         FROM findings f JOIN events e ON e.id = f.event_id
-         WHERE f.finding_key IS NOT NULL
-           AND EXISTS (
-             SELECT 1 FROM finding_resolution fr
-              WHERE fr.finding_key = f.finding_key
-                AND fr.resolved_at >= :windowStart
-           )`).all({windowStart:g}),i=new Map,j=new Map;for(let a of h){if("resolved"!==a.latest_status||"fixed-at-source"!==a.latest_method||null==a.latest_resolved_at||a.latest_resolved_at<g||a.latest_resolved_at>=f)continue;let b=Math.floor((a.latest_resolved_at-g)/c);if(b<0||b>=e)continue;let d=`${String(b)}:${a.severity}`,h=Math.max(0,a.latest_resolved_at-a.first_detected_at);i.set(d,(i.get(d)??0)+h),j.set(d,(j.get(d)??0)+1)}return Promise.resolve({range:a,granularity:b,points:Array.from({length:e},(a,b)=>{let d={};for(let a of av){let c=`${String(b)}:${a}`,e=j.get(c)??0;d[a]=e>0?(i.get(c)??0)/e:null}return{timestamp:aC(g+b*c),bySeverity:d}})})}topSources(a,b={}){let c=b.limit??5;if("user"===b.kind)return Promise.resolve({range:a,items:[]});let d=this.now(),e=d-864e5*aw[a];return Promise.resolve({range:a,items:this.db.prepare(`SELECT json_extract(e.metadata, '$.repo') AS repo, count(*) AS c
-         FROM findings f JOIN events e ON e.id = f.event_id
-         WHERE e.occurred_at >= :from AND e.occurred_at < :to
-           AND json_extract(e.metadata, '$.repo') IS NOT NULL
-           AND json_extract(e.metadata, '$.repo') != ''
-         GROUP BY repo
-         ORDER BY c DESC, repo
-         LIMIT :limit`).all({from:e,to:d,limit:c}).map(a=>({id:`repo_${a.repo}`,name:a.repo,kind:"repo",findingsCount:a.c}))})}recentlyResolved(a=20){return Promise.resolve({items:this.db.prepare(`SELECT f.finding_key AS finding_key,
-                f.rule_id AS rule_id,
-                f.severity AS severity,
-                json_extract(e.metadata, '$.filePath') AS path,
-                COALESCE(f.first_detected_at, e.occurred_at) AS first_detected_at,
-                (
-                  SELECT fr.resolved_at FROM finding_resolution fr
-                   WHERE fr.finding_key = f.finding_key
-                   ORDER BY fr.created_at DESC, fr.rowid DESC
-                   LIMIT 1
-                ) AS latest_resolved_at
-         FROM findings f JOIN events e ON e.id = f.event_id
-         WHERE e.kind = 'code_change'
-           AND f.finding_key IS NOT NULL
-           AND (
-             SELECT fr.status FROM finding_resolution fr
-              WHERE fr.finding_key = f.finding_key
-              ORDER BY fr.created_at DESC, fr.rowid DESC
-              LIMIT 1
-           ) = 'resolved'
-           AND (
-             SELECT fr.method FROM finding_resolution fr
-              WHERE fr.finding_key = f.finding_key
-              ORDER BY fr.created_at DESC, fr.rowid DESC
-              LIMIT 1
-           ) = 'fixed-at-source'
-           AND (
-             SELECT fr.resolved_at FROM finding_resolution fr
-              WHERE fr.finding_key = f.finding_key
-              ORDER BY fr.created_at DESC, fr.rowid DESC
-              LIMIT 1
-           ) IS NOT NULL
-         ORDER BY latest_resolved_at DESC
-         LIMIT :limit`).all({limit:a}).map(a=>({findingKey:a.finding_key,ruleId:a.rule_id,severity:a.severity,path:a.path??"",resolvedAt:new Date(a.latest_resolved_at).toISOString(),detectedAt:new Date(a.first_detected_at).toISOString()}))})}findingsInRange(a,b){return this.db.prepare(`SELECT e.occurred_at AS occurred_at, f.severity AS severity, f.action_taken AS action_taken
-         FROM findings f JOIN events e ON e.id = f.event_id
-         WHERE e.occurred_at >= :from AND e.occurred_at < :to
-         ORDER BY e.occurred_at`).all({from:a,to:b}).map(a=>({occurredAt:a.occurred_at,severity:a.severity,actionTaken:a.action_taken}))}}let aE=["provider","internal","ip"];function aF(a){if(!a)return null;try{return JSON.parse(a)}catch{return null}}function aG(a){return{id:a.id,method:a.method,transport:a.transport,url:a.url,template:a.template,dataClass:a.dataClass,lastSeen:new Date(a.lastSeenMs).toISOString(),callSiteCount:a.callSiteCount}}function aH(a,b){let c=b.map(a=>a.transport),d=b.map(a=>a.dataClass),e=b.reduce((a,b)=>a+b.callSiteCount,0),f=b.length>0?Math.max(...b.map(a=>a.lastSeenMs)):a.lastSeenMs;return{id:a.id,kind:a.kind,name:a.name,host:a.host,category:a.category,trust:a.trust,status:(0,h.Gw9)(a.trust,a.overrideDecision),isCustom:(0,h.y_0)(a.trust,a.overrideDecision),lastSeen:new Date(f).toISOString(),endpointCount:b.length,callSiteCount:e,transports:(0,h.by7)(c),dataClasses:(0,h.hzO)(d),review:(0,h.Fnc)(a.trust,c),network:"provider"===a.kind?null:aF(a.networkJson),endpoints:b.map(aG)}}class aI{constructor(a){this.db=a}stats(){let a=a=>this.db.prepare(a).get()?.n??0,b=a("SELECT count(*) AS n FROM share_destination"),c=a("SELECT count(*) AS n FROM share_endpoint"),d=a("SELECT count(*) AS n FROM share_call_site"),e=a("SELECT count(DISTINCT destination_id) AS n FROM share_endpoint WHERE transport = 'http'"),f=a(`SELECT count(DISTINCT d.id) AS n
-       FROM share_destination d
-       LEFT JOIN share_endpoint e ON e.destination_id = d.id AND e.transport = 'http'
-       WHERE d.trust IN ('unverified', 'ip') OR e.id IS NOT NULL`),g={provider:0,internal:0,ip:0};for(let a of this.db.prepare("SELECT kind, count(*) AS n FROM share_destination GROUP BY kind").all())g[a.kind]=a.n;let h={recognized:0,internal:0,unverified:0,ip:0};for(let a of this.db.prepare("SELECT trust, count(*) AS n FROM share_destination GROUP BY trust").all())h[a.trust]=a.n;return Promise.resolve({destinations:b,endpoints:c,callSites:d,needsReview:f,insecure:e,byKind:g,byTrust:h})}listDestinations(a){let b=void 0===a.q||""===a.q?void 0:a.q,c=this.fetchDestinations(b,a.kind),d=this.groupEndpoints(c.map(a=>a.id)),e=c.map(a=>aH(a,d.get(a.id)??[])),f=new Map;for(let a of e){let b=f.get(a.kind);b?b.push(a):f.set(a.kind,[a])}return Promise.resolve({groups:aE.filter(a=>f.has(a)).map(a=>{let b=f.get(a)??[];return{kind:a,total:b.length,items:b}})})}needsReview(){let a=this.fetchDestinations(void 0,void 0,!0),b=this.groupEndpoints(a.map(a=>a.id));return Promise.resolve({items:a.map(a=>({dest:a,endpoints:b.get(a.id)??[]})).map(({dest:a,endpoints:b})=>({summary:aH(a,b),endpoints:b})).filter(({summary:a})=>a.review.needsReview).map(({summary:a,endpoints:b})=>({id:a.id,kind:a.kind,name:a.name,host:a.host,trust:a.trust,status:a.status,review:a.review,topDataClass:(0,h.C05)(b.map(a=>a.dataClass)),callSiteCount:a.callSiteCount,lastSeen:a.lastSeen})).sort((a,b)=>{let c=(0,h.WSs)(a.review.reasons)-(0,h.WSs)(b.review.reasons);return 0!==c?c:b.lastSeen.localeCompare(a.lastSeen)})})}getDestination(a){let b=this.fetchDestinationById(a);if(!b)return Promise.resolve(null);let c=this.fetchEndpoints([b.id]),d=this.fetchCallSites(c.map(a=>a.id));return Promise.resolve(function(a,b,c){let d=b.map(a=>a.transport),e=b.length>0?Math.max(...b.map(a=>a.lastSeenMs)):a.lastSeenMs,f=new Map;for(let a of c.slice(0,200)){let b={id:a.id,project:a.project,file:a.file,line:a.line,snippet:a.snippet,dynamic:a.dynamic,vendored:a.vendored,projectId:a.projectId},c=f.get(a.endpointId);c?c.push(b):f.set(a.endpointId,[b])}return{id:a.id,kind:a.kind,name:a.name,host:a.host,category:a.category,trust:a.trust,status:(0,h.Gw9)(a.trust,a.overrideDecision),isCustom:(0,h.y_0)(a.trust,a.overrideDecision),lastSeen:new Date(e).toISOString(),transports:(0,h.by7)(d),dataClasses:(0,h.hzO)(b.map(a=>a.dataClass)),review:(0,h.Fnc)(a.trust,d),network:"provider"===a.kind?null:aF(a.networkJson),note:a.note,endpoints:b.map(a=>({...aG(a),sites:f.get(a.id)??[]}))}}(b,c,d))}setEgressDecision(a,b){return void 0!==this.db.prepare("SELECT 1 FROM share_destination WHERE id = ?").get(a)&&(null===b?this.db.prepare("DELETE FROM egress_decision_override WHERE destination_id = ?").run(a):this.db.prepare(`INSERT INTO egress_decision_override (id, destination_id, decision, created_at, updated_at)
-         VALUES (:id, :destinationId, :decision, :now, :now)
-         ON CONFLICT (destination_id) DO UPDATE SET
-           decision = excluded.decision,
-           updated_at = excluded.updated_at`).run({id:(0,d.randomUUID)(),destinationId:a,decision:b,now:Date.now()}),!0)}mapDestRow(a){return{id:a.id,kind:a.kind,name:a.name,host:a.host,category:a.category,trust:a.trust,note:a.note,networkJson:a.networkJson,lastSeenMs:a.lastSeenMs,overrideDecision:a.overrideDecision??null}}fetchDestinations(a,b,c=!1){let d,e=`d.id, d.kind, d.name, d.host, d.category, d.trust, d.note,
-                  d.network_json AS networkJson, d.last_seen AS lastSeenMs,
-                  d.created_at AS createdAt, o.decision AS overrideDecision`,f=[],g=[];if(b&&b.length>0&&(f.push(`d.kind IN (${q(b.length)})`),g.push(...b)),c&&f.push(`(d.trust IN ('unverified', 'ip')
-          OR EXISTS (SELECT 1 FROM share_endpoint re
-                     WHERE re.destination_id = d.id AND re.transport = 'http'))`),a){let b=`%${p(a)}%`;f.push(`(d.name LIKE ? ESCAPE '\\' OR d.category LIKE ? ESCAPE '\\' OR e.url LIKE ? ESCAPE '\\'
-          OR c.project LIKE ? ESCAPE '\\' OR c.file LIKE ? ESCAPE '\\')`),g.push(b,b,b,b,b),d=`SELECT DISTINCT ${e}
-             FROM share_destination d
-             LEFT JOIN egress_decision_override o ON o.destination_id = d.id
-             LEFT JOIN share_endpoint e ON e.destination_id = d.id
-             LEFT JOIN share_call_site c ON c.endpoint_id = e.id
-             ${f.length?`WHERE ${f.join(" AND ")}`:""}
-             ORDER BY d.created_at ASC, d.id ASC`}else d=`SELECT ${e}
-             FROM share_destination d
-             LEFT JOIN egress_decision_override o ON o.destination_id = d.id
-             ${f.length?`WHERE ${f.join(" AND ")}`:""}
-             ORDER BY d.created_at ASC, d.id ASC`;return this.db.prepare(d).all(...g).map(a=>this.mapDestRow(a))}fetchDestinationById(a){let b=this.db.prepare(`SELECT d.id, d.kind, d.name, d.host, d.category, d.trust, d.note,
-                d.network_json AS networkJson, d.last_seen AS lastSeenMs,
-                o.decision AS overrideDecision
-         FROM share_destination d
-         LEFT JOIN egress_decision_override o ON o.destination_id = d.id
-         WHERE d.id = ?`).get(a);return b?this.mapDestRow(b):null}fetchEndpoints(a){return 0===a.length?[]:this.db.prepare(`SELECT e.id, e.destination_id AS destinationId, e.method, e.transport, e.url,
-                e.template, e.data_class AS dataClass, e.last_seen AS lastSeenMs,
-                count(c.id) AS callSiteCount
-         FROM share_endpoint e
-         LEFT JOIN share_call_site c ON c.endpoint_id = e.id
-         WHERE e.destination_id IN (${q(a.length)})
-         GROUP BY e.id
-         ORDER BY e.created_at ASC, e.id ASC`).all(...a).map(a=>({id:a.id,destinationId:a.destinationId,method:a.method,transport:a.transport,url:a.url,template:1===a.template,dataClass:a.dataClass,lastSeenMs:a.lastSeenMs,callSiteCount:a.callSiteCount}))}groupEndpoints(a){let b=new Map;for(let c of this.fetchEndpoints(a)){let a=b.get(c.destinationId);a?a.push(c):b.set(c.destinationId,[c])}return b}fetchCallSites(a){return 0===a.length?[]:this.db.prepare(`SELECT id, endpoint_id AS endpointId, project, file, line, snippet, dynamic, vendored,
-                project_id AS projectId
-         FROM share_call_site
-         WHERE endpoint_id IN (${q(a.length)})
-         ORDER BY created_at ASC, id ASC`).all(...a).map(a=>({id:a.id,endpointId:a.endpointId,project:a.project,file:a.file,line:a.line,snippet:a.snippet,dynamic:1===a.dynamic,vendored:1===a.vendored,projectId:a.projectId}))}}class aJ{constructor(a){this.db=a,this.upsertStmt=a.prepare(`INSERT INTO source_project
-         (id, url, name, attributes, first_seen, last_seen)
-       VALUES
-         (:id, :url, :name, :attributes, :firstSeen, :lastSeen)
-       ON CONFLICT(id) DO UPDATE SET
-         url = excluded.url,
-         name = excluded.name,
-         attributes = excluded.attributes,
-         last_seen = excluded.last_seen`)}upsert(a,b=Date.now()){let c=j(a.url),d=(0,h.QCA)(a,c,b);return this.upsertStmt.run({id:d.id,url:d.url??null,name:d.name??null,attributes:d.attributes,firstSeen:d.firstSeen,lastSeen:d.lastSeen}),c}findById(a){return this.db.prepare("SELECT * FROM source_project WHERE id = :id").get({id:a})}distinctNames(){return this.db.prepare(`SELECT DISTINCT name FROM source_project
-         WHERE name IS NOT NULL
-         ORDER BY name`).all().map(a=>a.name)}}function aK(a,b){return b?{...a,hostId:b}:a}function aL(a){let b=new g.DatabaseSync(a);return b.exec("PRAGMA journal_mode = WAL"),b.exec("PRAGMA busy_timeout = 2000"),b.exec("PRAGMA foreign_keys = ON"),b}function aM(a){var b;o(a);let c=(0,f.join)(a,n),g=aL(c);if(void 0!==(b=g).prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'tenants' LIMIT 1").get()||b.prepare("PRAGMA table_info(events)").all().some(a=>"tenant_id"===a.name)){g.close();let a=function(a){let b=`${a}.legacy.${String(Date.now())}.bak`;for(let c of((0,e.renameSync)(a,b),[`${a}-wal`,`${a}-shm`]))(0,e.existsSync)(c)&&(0,e.rmSync)(c);return b}(c);g=aL(c),process.stderr.write(`[aka] Detected an older, incompatible (tenant-bearing) ${n}; backed it up to ${a} and created a fresh store.
-`)}for(let a of(!function(a){var b;let c=a.prepare("PRAGMA user_version").get().user_version;a.exec("CREATE TABLE IF NOT EXISTS migration_ledger (tag TEXT PRIMARY KEY, applied_at INTEGER NOT NULL)");let d=new Set(a.prepare("SELECT tag FROM migration_ledger").all().map(a=>a.tag)),e=0===d.size&&c>0,f=a.prepare("INSERT OR IGNORE INTO migration_ledger (tag, applied_at) VALUES (?, ?)");for(let[b,g]of h.lFU.entries()){if(d.has(g.tag))continue;let h=function(a){let b=[];for(let c of a.matchAll(/CREATE TABLE (?:IF NOT EXISTS )?`([^`]+)`/g))void 0===c[1]||c[1].startsWith("__new_")||b.push({kind:"table",name:c[1]});for(let c of a.matchAll(/ALTER TABLE `([^`]+)` ADD (?:COLUMN )?`([^`]+)`/g))void 0!==c[1]&&void 0!==c[2]&&b.push({kind:"column",table:c[1],name:c[2]});return b}(g.sql),i=h.filter(b=>(function(a,b){return"column"===b.kind?a.prepare(`PRAGMA table_xinfo(${b.table})`).all().some(a=>a.name===b.name):void 0!==a.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ? LIMIT 1").get(b.name)})(a,b));if(i.length>0&&i.length<h.length){let a=h.filter(a=>!i.includes(a)),b=`[aka] sqlite migration ${g.tag} has no ledger row, but the store already has ${i.map(k).join(", ")} while missing ${a.map(k).join(", ")} — the schema diverged from the migration history; refusing to replay or skip.`;throw process.stderr.write(`${b}
-`),Error(b)}let j=h.length>0?i.length===h.length:e&&b<c,l=/PRAGMA foreign_keys\s*=\s*OFF/i.test(g.sql),m=g.sql.split(/-->\s*statement-breakpoint/).map(a=>a.trim()).filter(a=>a.length>0);l&&a.exec("PRAGMA foreign_keys = OFF");try{a.exec("BEGIN IMMEDIATE");try{for(let b of m){let c=function(a){let b=a.replace(/^(?:\s*--[^\n]*\n?)+/,"").trimStart();return/^CREATE (?:UNIQUE )?INDEX (?:IF NOT EXISTS )?`([^`]+)`/.exec(b)?.[1]}(b);if(void 0===c){if(j)continue}else if(void 0!==a.prepare("SELECT 1 FROM sqlite_master WHERE type = 'index' AND name = ? LIMIT 1").get(c))continue;a.exec(b)}if(l&&!j){let b=a.prepare("PRAGMA foreign_key_check").all();if(b.length>0)throw Error(`[aka] sqlite migration ${g.tag} left ${String(b.length)} foreign-key violation(s); rolling back.`)}f.run(g.tag,Date.now()),a.exec("COMMIT")}catch(b){try{a.exec("ROLLBACK")}catch{}throw b}}finally{l&&a.exec("PRAGMA foreign_keys = ON")}}c<h.lFU.length&&a.exec(`PRAGMA user_version = ${String(h.lFU.length)}`),m(a,"events"),m(a,"audit_events"),a.exec(`CREATE TABLE IF NOT EXISTS scan_ledger (
-    path TEXT PRIMARY KEY,
-    mtime TEXT NOT NULL,
-    content_hash TEXT NOT NULL,
-    ruleset_hash TEXT NOT NULL,
-    scanned_at INTEGER NOT NULL
-  )`),a.exec(`CREATE TABLE IF NOT EXISTS blocked_detections (
-    reference TEXT PRIMARY KEY,
-    rule_id TEXT NOT NULL,
-    category TEXT NOT NULL,
-    value_fingerprint TEXT NOT NULL,
-    key_version INTEGER NOT NULL,
-    masked_value TEXT NOT NULL,
-    session_id TEXT,
-    repo TEXT,
-    blocked_at INTEGER NOT NULL
-  )`),(b=a).exec(`CREATE TABLE IF NOT EXISTS \`_pack_write_gate\` (
-	\`id\` integer PRIMARY KEY NOT NULL,
-	\`open\` integer DEFAULT 0 NOT NULL,
-	CONSTRAINT "ck_pack_write_gate_single_row" CHECK("_pack_write_gate"."id" = 1)
-)`),b.exec("INSERT OR IGNORE INTO _pack_write_gate (id, open) VALUES (1, 0)"),b.exec(`CREATE TRIGGER IF NOT EXISTS trg_installed_packs_write_gate
-BEFORE UPDATE OF version, name, rules_json ON installed_packs
-WHEN (SELECT open FROM _pack_write_gate WHERE id = 1) IS NOT 1
-BEGIN SELECT RAISE(IGNORE); END`),function(a){let b=new Set(a.prepare("PRAGMA table_xinfo(audit_events)").all().map(a=>a.name));for(let c of l)b.has(c.name)||a.exec(c.ddl)}(a),function(a){try{let b=a.prepare(`SELECT id, url, name, attributes, first_seen AS firstSeen, last_seen AS lastSeen
-         FROM source_project
-         WHERE url IS NOT NULL AND id NOT LIKE 'sample:%'
-         ORDER BY last_seen DESC, id`).all().map(a=>({row:a,canonicalId:j(a.url)})).filter(({row:a,canonicalId:b})=>a.id!==b);if(0===b.length)return;let c=a.prepare(`INSERT INTO source_project (id, url, name, attributes, first_seen, last_seen)
-         VALUES (?, ?, ?, ?, ?, ?)
-       ON CONFLICT(id) DO UPDATE SET
-         first_seen = min(first_seen, excluded.first_seen),
-         last_seen = max(last_seen, excluded.last_seen)`),d=a.prepare("UPDATE audit_events SET source_project_id = ? WHERE source_project_id = ?"),e=a.prepare("UPDATE share_call_site SET project_id = ? WHERE project_id = ?"),f=["project_file","file_access_override"].map(b=>({dropCollisions:a.prepare(`DELETE FROM ${b} WHERE project_id = ?
-           AND path IN (SELECT path FROM ${b} WHERE project_id = ?)`),repoint:a.prepare(`UPDATE ${b} SET project_id = ? WHERE project_id = ?`)})),g=a.prepare("DELETE FROM source_project WHERE id = ?");a.exec("BEGIN IMMEDIATE");try{for(let{row:a,canonicalId:h}of b){for(let{dropCollisions:b,repoint:e}of(c.run(h,a.url,a.name,a.attributes,a.firstSeen,a.lastSeen),d.run(h,a.id),f))b.run(a.id,h),e.run(h,a.id);e.run(h,a.id),g.run(a.id)}a.exec("COMMIT")}catch(b){try{a.exec("ROLLBACK")}catch{}throw b}}catch(a){process.stderr.write(`[aka] source_project id reconcile failed: ${String(a)}
-`)}}(a)}(g),[c,`${c}-wal`,`${c}-shm`]))try{(0,e.chmodSync)(a,384)}catch{}let i=new J(g),q=new S(g),r=new aq(g),s=new Z(g),t=new au(g),u=new O(g),v=new at(g),w=new aD(g),x=new I(g),y=new aI(g),z=new ar(s),A=new $(g),F=new ap(g),G=new as(g),H=new B(g),K=new aJ(g),L=new C(g),M=new D(g),N=new T(g),P=new U(g),Q=new E(g);return r.seedDefaults(),{events:i,findings:q,policies:r,installedPacks:s,scanLedger:t,exceptions:u,resolutions:v,security:w,detections:x,shares:y,policyCatalog:z,inventory:A,inventoryAssets:F,activity:H,sourceProject:K,auditEvents:L,classifiedData:M,inspectionDefinitions:N,inspectionFindings:P,recordCapture:function(a,b){try{g.exec("BEGIN");try{i.insertEvent(a);let c=a.metadata?.sessionId;q.insertFindings(b,c?{sessionId:c}:{}),g.exec("COMMIT")}catch(a){throw g.exec("ROLLBACK"),a}}catch{}},ensureInventory:function(a){let b={};try{g.exec("BEGIN");try{let c=Date.now();a.host&&(b.hostId=A.upsert(a.host,c)),a.harness&&(b.harnessId=A.upsert(aK(a.harness,b.hostId),c)),b.accountId=A.upsert(aK({objectType:"user",identityKey:"local",attributes:{source:"local"}},b.hostId),c),a.project&&(b.sourceProjectId=K.upsert(a.project,c)),g.exec("COMMIT")}catch(a){throw g.exec("ROLLBACK"),a}}catch{return{}}return b},recordConfigScan:function(a){try{g.exec("BEGIN");try{let b=(0,h.I8t)(a.scanEvent.startedAt);for(let c of a.items)A.upsert(c,b);L.insertAuditEvent(a.scanEvent);let c=new Map;for(let b of a.definitions??[])c.set(`${b.ruleId}@${b.version}`,N.upsert(b));for(let b of a.findings??[]){let e=c.get(`${b.ruleId}@${b.version}`);e&&P.insertFinding({id:(0,d.randomUUID)(),auditEventId:a.scanEvent.id,inspectionDefinitionId:e,span:b.span,maskedMatch:b.maskedMatch,actionTaken:b.actionTaken,confidence:b.confidence})}g.exec("COMMIT")}catch(a){throw g.exec("ROLLBACK"),a}}catch{}},recordProjectFiles:function(a,b){if(0!==b.files.length)try{g.exec("BEGIN");try{G.replaceForProject(a,b,Date.now()),g.exec("COMMIT")}catch(a){throw g.exec("ROLLBACK"),a}}catch{}},reconcileWorktreeProjects:function(a,b,c){try{let d=b.split(f.sep).join("/"),e=c.split(f.sep).join("/"),h=c===b?"":"url IN (:worktreePosix, :worktreeWin) OR ",i=g.prepare(`SELECT id FROM source_project
-           WHERE id <> :canonicalId
-             AND (${h}url LIKE :pattern ESCAPE '\\' OR url LIKE :patternWin ESCAPE '\\')`).all({canonicalId:a,...c===b?{}:{worktreePosix:e,worktreeWin:e.split("/").join("\\")},pattern:`${p(d)}/.claude/worktrees/%`,patternWin:`${p(d.split("/").join("\\"))}\\\\.claude\\\\worktrees\\\\%`});if(0===i.length)return;g.exec("BEGIN");try{for(let{id:b}of i)g.prepare("UPDATE audit_events SET source_project_id = :canonicalId WHERE source_project_id = :id").run({canonicalId:a,id:b}),g.prepare("UPDATE OR IGNORE file_access_override SET project_id = :canonicalId WHERE project_id = :id").run({canonicalId:a,id:b}),g.prepare("DELETE FROM file_access_override WHERE project_id = :id").run({id:b}),g.prepare("DELETE FROM project_file WHERE project_id = :id").run({id:b}),g.prepare("DELETE FROM source_project WHERE id = :id").run({id:b});g.exec("COMMIT")}catch(a){throw g.exec("ROLLBACK"),a}}catch{}},configInventoryReport:()=>Q.report(),facets:function(){return{hosts:A.distinctTitles("host"),harnesses:A.distinctTitles("harness"),osVersions:A.osVersions(),projects:K.distinctNames()}},purgeSampleData:()=>{!function(a){try{if(!a.prepare(`SELECT (
-         EXISTS(SELECT 1 FROM share_destination WHERE provenance = 'sample')
-         OR EXISTS(SELECT 1 FROM audit_events WHERE id LIKE 'sample:activity:%')
-         OR EXISTS(SELECT 1 FROM inventory_asset WHERE provenance = 'sample')
-       ) AS n`).get().n)return;a.exec("BEGIN");try{a.exec(`DELETE FROM share_call_site WHERE endpoint_id IN (
-           SELECT e.id FROM share_endpoint e
-           JOIN share_destination d ON d.id = e.destination_id
-           WHERE d.provenance = 'sample')`),a.exec(`DELETE FROM egress_decision_override WHERE destination_id IN (
-           SELECT id FROM share_destination WHERE provenance = 'sample')`),a.exec(`DELETE FROM share_endpoint WHERE destination_id IN (
-           SELECT id FROM share_destination WHERE provenance = 'sample')`),a.exec("DELETE FROM share_destination WHERE provenance = 'sample'"),a.exec(`DELETE FROM harness_asset WHERE asset_id IN (SELECT id FROM inventory_asset WHERE provenance = 'sample')
-            OR harness_id IN (SELECT id FROM inventory WHERE object_type = 'harness' AND json_extract(attributes, '$.provenance') = 'sample')`),a.exec("DELETE FROM mcp_trust_override WHERE asset_id IN (SELECT id FROM inventory_asset WHERE provenance = 'sample')"),a.exec("DELETE FROM file_access_override WHERE project_id IN (SELECT id FROM source_project WHERE json_extract(attributes, '$.provenance') = 'sample')"),a.exec("DELETE FROM project_file WHERE project_id IN (SELECT id FROM source_project WHERE json_extract(attributes, '$.provenance') = 'sample')"),a.exec("DELETE FROM inventory_asset WHERE provenance = 'sample'"),a.exec("DELETE FROM source_project WHERE json_extract(attributes, '$.provenance') = 'sample'"),a.exec("DELETE FROM inventory WHERE object_type = 'harness' AND json_extract(attributes, '$.provenance') = 'sample'"),a.exec("DELETE FROM inspection_findings WHERE id LIKE 'sample:activity:%'"),a.exec("DELETE FROM inspection_definitions WHERE id LIKE 'sample:activity:%'"),a.exec("DELETE FROM audit_events WHERE root_session_id LIKE 'sample:activity:%'"),a.exec("DELETE FROM audit_events WHERE id LIKE 'sample:activity:%'"),a.exec(`CREATE TABLE IF NOT EXISTS app_meta (
-        key TEXT PRIMARY KEY,
-        value TEXT NOT NULL
-      )`),a.exec("DELETE FROM app_meta WHERE key LIKE 'sample_seeded:%'"),a.exec("COMMIT")}catch(b){throw a.exec("ROLLBACK"),b}}catch{}}(g)},close:()=>{g.close()}}}function aN(a){return(0,f.join)(a,"exception.key")}function aO(a,b){o(a);let c=aN(a),d=`${c}.tmp`,f=JSON.stringify({version:b.version,material:b.material.toString("base64")});(0,e.writeFileSync)(d,`${f}
-`,{mode:384}),(0,e.renameSync)(d,c);try{(0,e.chmodSync)(c,384)}catch{}return b}function aP(a){let b;try{b=(0,e.readFileSync)(aN(a),"utf8")}catch(a){if("ENOENT"===a.code)return null;throw a instanceof Error?a:Error(String(a))}let c=JSON.parse(b);if("object"!=typeof c||null===c)throw Error("exception key file is corrupt: not a JSON object");let{version:d,material:f}=c;if("number"!=typeof d||!Number.isInteger(d)||d<1)throw Error("exception key file is corrupt: bad version");if("string"!=typeof f)throw Error("exception key file is corrupt: bad material");let g=Buffer.from(f,"base64");if(32!==g.length)throw Error("exception key file is corrupt: bad material length");return{version:d,material:g}}function aQ(a){let b=aP(a);if(b){try{(0,e.chmodSync)(aN(a),384)}catch{}return b}return aO(a,{version:1,material:(0,d.randomBytes)(32)})}function aR(a){let b=aP(a);return aO(a,{version:(b?.version??0)+1,material:(0,d.randomBytes)(32)})}function aS(a,b){return(0,d.createHmac)("sha256",a.material).update(b,"utf8").digest("hex")}c(51455);var aT=c(48161);function aU(){return(0,f.join)((0,aT.homedir)(),".aka")}function aV(a=aU()){return(0,f.join)(a,"settings")}function aW(a=aU()){return(0,f.join)(a,"data")}function aX(a,b=aU()){let c=aV(b),d=function(a=aU()){let b=function(a){try{let b=JSON.parse((0,e.readFileSync)(a,"utf8"));return"object"==typeof b&&null!==b?b:null}catch{return null}}((0,f.join)(aV(a),"settings.json"));if(!b)return(0,h.i1j)();try{return h.hd_.parse(b)}catch{return(0,h.i1j)()}}(b),g=h.hd_.parse({...d,...a,onboardedAt:a.onboardedAt??d.onboardedAt??new Date().toISOString()});o(c);let i=(0,f.join)(c,"settings.json"),j=`${i}.tmp`;return(0,e.writeFileSync)(j,`${JSON.stringify(g,null,2)}
-`,{mode:384}),(0,e.renameSync)(j,i),g}}};