@akasecurity/cli 0.9.11 → 0.9.12

package/web-ui/web-ui/.next/server/chunks/905.js

@@ -1,959 +0,0 @@
-"use strict";exports.id=905,exports.ids=[905],exports.modules={15905:(a,b,c)=>{c.d(b,{WR:()=>aO,qA:()=>aP,qk:()=>bk,Pi:()=>c7,o8:()=>bl,zd:()=>h,Qo:()=>cl,Ru:()=>c3,KS:()=>a8,tI:()=>a6,_2:()=>cu,Dg:()=>cv,lG:()=>A,Wo:()=>a9,Rd:()=>cs,Ji:()=>ci,R8:()=>C,Hg:()=>B,y9:()=>cr,xR:()=>bi,Zu:()=>E,v5:()=>ct,Cn:()=>cw,VL:()=>a7,Yf:()=>ck,sF:()=>D,g5:()=>t});var d=c(73024),e=c(76760);let f="policy-cache.json",g=[f,"attached-sync-state.json","attached-state.json","attached-forward-drops.json","attached-history-sync.json"];function h(a){for(let b of g)try{(0,d.rmSync)((0,e.join)(a,b),{force:!0})}catch{}}var i=c(49008),j=c(75919);let k="aka.db";function l(a,b){if(!function(a){try{return(0,d.lstatSync)(a).isSymbolicLink()}catch{return!1}}(a))try{(0,d.chmodSync)(a,b)}catch{}}function m(a){l(a,448)}function n(a,b=!1){(0,d.mkdirSync)(a,{recursive:b,mode:448})}function o(a){n(a,!0),m(a)}function p(a){return[`${a}-wal`,`${a}-shm`,`${a}-journal`]}function q(a){l(a,384)}function r(a){for(let b of[a,...p(a)])l(b,384)}function s(a,b){(0,d.writeFileSync)(a,b,{mode:384,flag:"wx"})}function t(a,b){let c=`${a}.${String(process.pid)}.tmp`;try{(0,d.rmSync)(c,{force:!0})}catch{}try{s(c,b),(0,d.renameSync)(c,a)}finally{try{(0,d.rmSync)(c,{force:!0})}catch{}}q(a)}function u(a){try{if((0,d.lstatSync)(a).isSymbolicLink())return{kind:"symlink"};return{kind:"gone"}}catch(a){if("ENOENT"===a.code)return{kind:"gone"};return{kind:"unknown",cause:a}}}class v extends Error{constructor(a,b){super(a,void 0===b?void 0:{cause:b}),this.code="key-unclaimable",this.name="KeyUnclaimableError"}}function w(a,b){let c,e=`${a}.${String(process.pid)}.${String(j.threadId)}.new`;try{(0,d.rmSync)(e,{force:!0})}catch{}try{s(e,b),c=function(a,b,c){try{return(0,d.linkSync)(a,b),!0}catch(b){let a=b.code;if("EEXIST"===a)return!1;if(!x.has(a??""))throw b}try{return s(b,c),!0}catch(a){if("EEXIST"===a.code)return!1;throw a}}(e,a,b)}finally{try{(0,d.rmSync)(e,{force:!0})}catch{}}return c&&q(a),c}let x=new Set(["EPERM","ENOSYS","ENOTSUP","EOPNOTSUPP","EINVAL"]);function y(a){return(0,e.join)(a,i.leE)}let z=new Set(["localhost","127.0.0.1","::1","[::1]"]);function A(a){let b;try{b=new URL(a)}catch{return!1}return"https:"===b.protocol||"http:"===b.protocol&&z.has(b.hostname)}function B(a,b){let c,e,f=y(a),g=function(a){let b=(0,d.lstatSync)(a,{throwIfNoEntry:!1});if(void 0===b)return"absent";if(b.isSymbolicLink())return"untrusted";let c=(0,d.statSync)(a,{throwIfNoEntry:!1});if(void 0===c)return"absent";let e=process.getuid?.();if(void 0!==e&&c.uid!==e)return"untrusted";if("win32"!==process.platform&&(511&c.mode)!=384)try{(0,d.chmodSync)(a,384)}catch{return"untrusted"}return"ok"}(f);if("absent"===g)return{usable:!1,reason:"absent"};if("untrusted"===g)return{usable:!1,reason:"untrusted-file"};try{c=(0,d.readFileSync)(f,"utf8")}catch(a){return{usable:!1,reason:"ENOENT"===a.code?"absent":"unreadable"}}try{e=JSON.parse(c)}catch{return{usable:!1,reason:"malformed"}}let h=i.yi_.safeParse(e);return h.success?A(h.data.endpoint)?void 0!==b&&b.endpoint!==h.data.endpoint?{usable:!1,reason:"endpoint-mismatch",credentialEndpoint:h.data.endpoint,settingsEndpoint:b.endpoint}:{usable:!0,credential:h.data}:{usable:!1,reason:"unsafe-endpoint"}:{usable:!1,reason:"malformed"}}function C(a,b){let c=B(a,b);return c.usable?c.credential:null}function D(a,b){if(!A(b.endpoint))throw Error(`refusing to store a control-plane credential for a non-HTTPS endpoint: ${b.endpoint}`);o(a),t(y(a),`${JSON.stringify(b,null,2)}
-`)}function E(a){let b=y(a),c=void 0!==(0,d.lstatSync)(b,{throwIfNoEntry:!1});return(0,d.rmSync)(b,{force:!0}),c}var F=c(77598),G=c(79868);function H(a){return(0,F.createHash)("sha256").update(a).digest("hex")}function I(a){return H((0,i.tTV)(["source_project",a]))}function J(a,b){return H((0,i.tTV)(["inspection_definition",a,b]))}function K(a,b){return`${a}.${b}.${String(Date.now())}.${(0,F.randomUUID)().slice(0,8)}.bak`}let L=".partial",M=`.bak${L}`,N="copy";function O(a){let b,c=(0,e.dirname)(a),f=`${(0,e.basename)(a)}.`;try{b=(0,d.readdirSync)(c)}catch{return}for(let a of b){if(!a.startsWith(f)||!a.endsWith(M))continue;let b=(0,e.join)(c,a);try{let a=function(a){for(let b of[(0,e.join)(a,N),a])try{return Date.now()-(0,d.statSync)(b).mtimeMs}catch{}return null}(b);null!==a&&a>3e5&&(0,d.rmSync)(b,{recursive:!0,force:!0})}catch{}}}function P(a,b){let{stage:c,copy:f}=function(a){let b=`${a}${L}`;return(0,d.rmSync)(b,{recursive:!0,force:!0}),n(b),m(b),{stage:b,copy:(0,e.join)(b,N)}}(b);try{a.prepare("VACUUM INTO ?").run(f),q(f),(0,d.renameSync)(f,b)}catch(a){try{(0,d.rmSync)(c,{recursive:!0,force:!0})}catch{}throw a}try{(0,d.rmSync)(c,{recursive:!0,force:!0})}catch{}}function Q(a){return a.replace(/\\/g,"\\\\").replace(/%/g,"\\%").replace(/_/g,"\\_")}function R(a){return Array.from({length:a},()=>"?").join(", ")}function S(a){return`%${Q(a)}%`}function T(a){return`(${a.map(a=>`${a} LIKE ? ESCAPE '\\'`).join(" OR ")})`}let U=0;function V(a,b,c="DEFERRED"){if(a.isTransaction){let c=`aka_sp_${String(U+=1)}`;a.exec(`SAVEPOINT ${c}`);try{b(),a.exec(`RELEASE ${c}`)}catch(b){try{a.exec(`ROLLBACK TO ${c}`),a.exec(`RELEASE ${c}`)}catch{}throw b}return}a.exec("IMMEDIATE"===c?"BEGIN IMMEDIATE":"BEGIN");try{b(),a.exec("COMMIT")}catch(b){try{a.exec("ROLLBACK")}catch{}throw b}}function W(a,b,c="DEFERRED"){let d=a.isTransaction;try{return V(a,b,c),!0}catch(b){if(!a.isTransaction&&d)throw b;return!1}}function X(a){process.stderr.write(`[aka] ${a}
-`)}function Y(a,b,c){return void 0!==a.prepare("SELECT 1 FROM sqlite_master WHERE type = ? AND name = ? LIMIT 1").get(b,c)}function Z(a,b,c){let d=c?.includeGenerated?"table_xinfo":"table_info";return a.prepare(`PRAGMA ${d}(${b})`).all().map(a=>a.name)}function $(a,b){return void 0===b?a.all():Array.isArray(b)?a.all(...b):a.all(b)}function _(a,b){return void 0===b?a.get():Array.isArray(b)?a.get(...b):a.get(b)}function aa(a){return 1===a||!0===a}function ab(a){let b={};for(let[c,d]of Object.entries(a))b[c]=void 0===d?null:d;return b}function ac(a,b,c){return _(a.prepare(b),c)?.n??0}function ad(a,b,c){let d=new Map;for(let e of $(a.prepare(b),c))d.set(e.k,e.n);return d}function ae(a,b){let c=[];for(let d of a)try{c.push(b(d))}catch{}return c}function af(a){return"column"===a.kind?`column ${a.table}.${a.name}`:`table ${a.name}`}function ag(a){return a.split(/-->\s*statement-breakpoint/).map(a=>a.trim()).filter(a=>a.length>0)}let ah="0014_drop_legacy_events_findings";function ai(a){let b=!1,c=[];for(let d of["events","findings"])try{let e=a.prepare(`SELECT count(*) AS n, ifnull(max(rowid), -1) AS hi FROM ${d}`).get();if(void 0===e){b=!0,c.push(`${d}:unreadable`);continue}e.n>0&&(b=!0),c.push(`${d}:${String(e.n)}:${String(e.hi)}`)}catch{b=!0,c.push(`${d}:unreadable`)}return{holdsRows:b,mark:c.join("|")}}let aj=[{name:"input_tokens",ddl:"ALTER TABLE audit_events ADD COLUMN input_tokens integer GENERATED ALWAYS AS (json_extract(attributes, '$.input_tokens')) VIRTUAL"},{name:"output_tokens",ddl:"ALTER TABLE audit_events ADD COLUMN output_tokens integer GENERATED ALWAYS AS (json_extract(attributes, '$.output_tokens')) VIRTUAL"},{name:"cache_creation_input_tokens",ddl:"ALTER TABLE audit_events ADD COLUMN cache_creation_input_tokens integer GENERATED ALWAYS AS (json_extract(attributes, '$.cache_creation_input_tokens')) VIRTUAL"},{name:"cache_read_input_tokens",ddl:"ALTER TABLE audit_events ADD COLUMN cache_read_input_tokens integer GENERATED ALWAYS AS (json_extract(attributes, '$.cache_read_input_tokens')) VIRTUAL"},{name:"model",ddl:"ALTER TABLE audit_events ADD COLUMN model text GENERATED ALWAYS AS (json_extract(attributes, '$.model')) VIRTUAL"},{name:"provider",ddl:"ALTER TABLE audit_events ADD COLUMN provider text GENERATED ALWAYS AS (json_extract(attributes, '$.provider')) VIRTUAL"}];function ak(a,b,c,d){let e=function(a,b){let c=a.prepare("SELECT last_rowid AS lastRowid FROM legacy_copy_watermark WHERE source = ?").get(b);return c?.lastRowid??0}(a,b),f=0;for(;f<1e3;){let g=c.all(e,200);if(0===g.length||(V(a,()=>{var c;d(g),e=g[g.length-1]?.rowid??e,c=e,a.prepare(`INSERT INTO legacy_copy_watermark (source, last_rowid) VALUES (?, ?)
-     ON CONFLICT(source) DO UPDATE SET last_rowid = excluded.last_rowid`).run(b,c)},"IMMEDIATE"),f+=g.length,g.length<200))return!0}return!1}function al(a,b){if(null==a)return b;try{return JSON.parse(a)}catch{return b}}function am(a){if(null!=a)try{let b=JSON.parse(a);if("object"==typeof b&&null!==b)return b}catch{}}function an(a){return Buffer.from(JSON.stringify(a)).toString("base64url")}function ao(a){let b=am(Buffer.from(a,"base64url").toString("utf8"));return void 0!==b&&"startedAtMs"in b&&"id"in b&&Number.isInteger(b.startedAtMs)&&"string"==typeof b.id?b:null}function ap(){try{return Intl.DateTimeFormat().resolvedOptions().timeZone}catch{return"UTC"}}let aq={session:"session",prompt:"prompt",response:"response",tool_call:"tool",hook:"hook",detection:"detection",share:"share",permission:"permission",commit:"commit",error:"error",active:"active"},ar=Object.keys(aq).map(a=>`'${a}'`).join(", ");function as(a){if(!a)return[];let b=al(a,null);return Array.isArray(b)?b:[]}let at=i.tLs.ClaudeCode;function au(a){let b=i.TUN.safeParse(a);return b.success?b.data:at}function av(a,b,c){let d=Math.max(a.started_at,b.lastActivityMs),{status:e,endedAtMs:f}=function(a,b,c){if(a.status){let b=i.PhW.safeParse(a.status);if(b.success)return{status:b.data,endedAtMs:a.ended_at}}return null!==a.ended_at?{status:"completed",endedAtMs:a.ended_at}:b>=c-18e5?{status:"active",endedAtMs:null}:{status:"completed",endedAtMs:b}}(a,d,c);return{id:a.id,harness:au(a.harness),title:a.title||a.project||a.repo||`Session ${a.id.slice(0,8)}`,project:a.project??"",repo:a.repo??"",branches:as(a.branches),startedAt:(0,i.q11)(a.started_at),endedAt:null===f?null:(0,i.q11)(f),status:e,turns:b.turns,findings:b.findings,shares:b.shares}}function aw(a){let b=aq[a.event_type];if(!b)return null;let c=a.severity?i.U7X.safeParse(a.severity):null,d=a.link?i.Itg.safeParse(a.link):null;return{id:a.id,occurredAt:(0,i.q11)(a.started_at),kind:b,title:a.title??"",detail:a.detail??"",tool:a.tool,severity:c?.success?c.data:null,link:d?.success?d.data:null,targetId:a.target_id,internal:aa(a.internal),flagged:aa(a.flagged)}}let ax=`
-  id,
-  event_type,
-  started_at,
-  coalesce(content, json_extract(attributes, '$.tool_name')) AS title,
-  coalesce(json_extract(attributes, '$.detail'), json_extract(attributes, '$.target')) AS detail,
-  coalesce(json_extract(attributes, '$.tool_name'), json_extract(attributes, '$.tool')) AS tool,
-  json_extract(attributes, '$.severity') AS severity,
-  json_extract(attributes, '$.link') AS link,
-  json_extract(attributes, '$.targetId') AS target_id,
-  json_extract(attributes, '$.internal') AS internal,
-  json_extract(attributes, '$.flagged') AS flagged`,ay=`
-  SELECT root_session_id AS sessionId,
-         provider,
-         model,
-         service_tier AS serviceTier,
-         coalesce(sum(input_tokens), 0) AS inputTokens,
-         coalesce(sum(output_tokens), 0) AS outputTokens,
-         coalesce(sum(cache_creation_input_tokens), 0) AS cacheCreationTokens,
-         coalesce(sum(cache_read_input_tokens), 0) AS cacheReadTokens,
-         coalesce(sum(ephemeral_1h_input_tokens), 0) AS ephemeral1hTokens,
-         coalesce(sum(ephemeral_5m_input_tokens), 0) AS ephemeral5mTokens,
-         coalesce(sum(web_search_requests), 0) AS webSearchRequests`,az="event_type = 'llm_call' AND attributes IS NOT NULL AND root_session_id IS NOT NULL",aA="GROUP BY root_session_id, provider, model, service_tier";function aB(a){return a.map(a=>{let b={input_tokens:a.inputTokens,output_tokens:a.outputTokens,cache_creation_input_tokens:a.cacheCreationTokens,cache_read_input_tokens:a.cacheReadTokens,ephemeral_1h_input_tokens:a.ephemeral1hTokens,ephemeral_5m_input_tokens:a.ephemeral5mTokens,web_search_requests:a.webSearchRequests};return null!==a.provider&&(b.provider=a.provider),null!==a.model&&(b.model=a.model),null!==a.serviceTier&&(b.service_tier=a.serviceTier),{sessionId:a.sessionId,attributes:b}})}let aC="event_type = 'session'",aD=`EXISTS (
-  SELECT 1 FROM audit_events c
-  WHERE c.root_session_id = audit_events.id
-    AND c.event_type NOT IN ('hook', 'config_scan'))`;class aE{constructor(a,b=()=>Date.now()){this.db=a,this.now=b}stats(a){let{startMs:b,endMs:c}=function a(b,c){let d;try{d=new Intl.DateTimeFormat("en-US",{timeZone:b,year:"numeric",month:"2-digit",day:"2-digit",hour:"2-digit",minute:"2-digit",second:"2-digit",hourCycle:"h23"}).formatToParts(new Date(c))}catch{let d=ap();return b===d?function(a){let b=864e5*Math.floor(a/864e5);return{startMs:b,endMs:b+864e5}}(c):a(d,c)}let e=Object.fromEntries(d.map(a=>[a.type,a.value])),f=Number(e.year),g=Number(e.month),h=Number(e.day),i=Number(e.hour),j=Date.UTC(f,g-1,h,i,Number(e.minute),Number(e.second))-c,k=Date.UTC(f,g-1,h,0,0,0)-j;return{startMs:k,endMs:k+864e5}}(a??ap(),this.now()),d=ac(this.db,`SELECT count(*) AS n FROM audit_events
-           WHERE ${aC} AND started_at >= ? AND started_at < ?
-             AND ${aD}`,[b,c]),e=this.now()-18e5,f=ac(this.db,`SELECT count(*) AS n FROM audit_events s INDEXED BY sqlite_autoindex_audit_events_1
-           WHERE s.event_type = 'session' AND s.ended_at IS NULL
-             AND s.id IN (
-               SELECT id FROM audit_events WHERE event_type = 'session' AND started_at >= ?
-               UNION
-               SELECT root_session_id FROM audit_events INDEXED BY idx_audit_started_at
-                WHERE started_at >= ?
-               UNION
-               SELECT root_session_id FROM audit_events INDEXED BY idx_audit_ended_at
-                WHERE ended_at >= ?)`,[e,e,e]),g=ac(this.db,`SELECT count(*) AS n FROM audit_events
-           WHERE event_type = 'tool_call' AND started_at >= ? AND started_at < ?`,[b,c]);return Promise.resolve({sessionsToday:d,liveNow:f,toolCallsToday:g,findingsToday:ac(this.db,`SELECT count(*) AS n FROM inspection_findings f
-           JOIN audit_events e ON e.id = f.audit_event_id
-           WHERE e.started_at >= ? AND e.started_at < ?`,[b,c]),egressToday:ac(this.db,`SELECT count(DISTINCT json_extract(attributes, '$.destination')) AS n
-           FROM audit_events
-           WHERE event_type = 'share' AND started_at >= ? AND started_at < ?`,[b,c])})}listSessions(a){let b=a.cursor?ao(a.cursor):null,c=a.to?(0,i.I8t)(a.to):this.now(),d=a.from?(0,i.I8t)(a.from):void 0,e=[aC],f=[];if(a.harness&&a.harness.length>0&&(e.push(`coalesce(json_extract(attributes, '$.harness'), '${at}') IN (${R(a.harness.length)})`),f.push(...a.harness)),void 0!==d&&(e.push("started_at >= ?"),f.push(d)),e.push("started_at <= ?"),f.push(c),a.q){let b=S(a.q);e.push(`(content LIKE ? ESCAPE '\\'
-          OR json_extract(attributes, '$.project') LIKE ? ESCAPE '\\'
-          OR json_extract(attributes, '$.repo') LIKE ? ESCAPE '\\'
-          OR json_extract(attributes, '$.branches') LIKE ? ESCAPE '\\'
-          OR EXISTS (
-            SELECT 1 FROM audit_events d
-            WHERE d.root_session_id = audit_events.id
-              AND (d.content LIKE ? ESCAPE '\\'
-                   OR coalesce(json_extract(d.attributes, '$.detail'),
-                               json_extract(d.attributes, '$.target')) LIKE ? ESCAPE '\\')))`),f.push(b,b,b,b,b,b)}let g=ac(this.db,`SELECT count(*) AS n FROM audit_events
-        WHERE ${[...e,`NOT ${aD}`].join(" AND ")}`,f);a.excludeEmpty&&e.push(aD),b&&(e.push("(started_at < ? OR (started_at = ? AND id < ?))"),f.push(b.startedAtMs,b.startedAtMs,b.id));let h=a.limit,j=$(this.db.prepare(`SELECT id,
-                json_extract(attributes, '$.harness') AS harness,
-                content AS title,
-                json_extract(attributes, '$.project') AS project,
-                json_extract(attributes, '$.repo') AS repo,
-                json_extract(attributes, '$.branches') AS branches,
-                json_extract(attributes, '$.status') AS status,
-                started_at,
-                ended_at
-         FROM audit_events
-         WHERE ${e.join(" AND ")}
-         ORDER BY started_at DESC, id DESC
-         LIMIT ?`),[...f,h+1]),k=j.length>h,l=k?j.slice(0,h):j,m=this.rollupsFor(l.map(a=>a.id)),n=this.now(),o=l.map(a=>av(a,m.get(a.id)??{turns:0,findings:0,shares:0,lastActivityMs:0},n)),p=l[l.length-1];return Promise.resolve({items:o,nextCursor:k&&p?an({startedAtMs:p.started_at,id:p.id}):null,emptyCount:g})}getSession(a){let b=_(this.db.prepare(`SELECT id,
-                json_extract(attributes, '$.harness') AS harness,
-                content AS title,
-                json_extract(attributes, '$.project') AS project,
-                json_extract(attributes, '$.repo') AS repo,
-                json_extract(attributes, '$.branches') AS branches,
-                json_extract(attributes, '$.status') AS status,
-                json_extract(attributes, '$.host') AS host,
-                json_extract(attributes, '$.cwd') AS cwd,
-                json_extract(attributes, '$.models') AS models,
-                json_extract(attributes, '$.version') AS version,
-                json_extract(attributes, '$.files') AS files,
-                started_at,
-                ended_at
-         FROM audit_events
-         WHERE id = ? AND event_type = 'session'
-         LIMIT 1`),[a]);if(!b)return Promise.resolve(null);let c=$(this.db.prepare(`SELECT ${ax}
-         FROM audit_events
-         WHERE (id = ? OR root_session_id = ?) AND event_type IN (${ar})
-         ORDER BY started_at ASC, id ASC`),[a,a]).map(aw).filter(a=>null!==a),d=_(this.db.prepare(`SELECT
-           coalesce(sum(input_tokens), 0) AS input,
-           coalesce(sum(output_tokens), 0) AS output,
-           coalesce(sum(cache_creation_input_tokens), 0) AS cache_creation,
-           coalesce(sum(cache_read_input_tokens), 0) AS cache_read
-         FROM audit_events INDEXED BY idx_audit_session_type
-         WHERE root_session_id = ? AND event_type = 'llm_call'`),[a])??{input:0,output:0,cache_creation:0,cache_read:0},e=_(this.db.prepare(`SELECT model, provider FROM audit_events INDEXED BY idx_audit_session_type
-         WHERE root_session_id = ? AND event_type = 'llm_call'
-         ORDER BY started_at ASC, id ASC
-         LIMIT 1`),[a]),f=$(this.db.prepare(`SELECT coalesce(json_extract(attributes, '$.tool_name'), json_extract(attributes, '$.tool')) AS tool,
-                count(*) AS n
-         FROM audit_events INDEXED BY idx_audit_session
-         WHERE root_session_id = ? AND event_type = 'tool_call'
-         GROUP BY coalesce(json_extract(attributes, '$.tool_name'), json_extract(attributes, '$.tool'))`),[a]),g=$(this.db.prepare(`SELECT DISTINCT model FROM audit_events INDEXED BY idx_audit_session_type
-         WHERE root_session_id = ? AND event_type = 'llm_call' AND model IS NOT NULL AND model <> ''
-         ORDER BY model`),[a]).map(a=>a.model),h=ac(this.db,`SELECT count(*) AS n FROM audit_events INDEXED BY idx_audit_session
-           WHERE root_session_id = ? AND event_type = 'commit'`,[a]),i=this.rollupsFor([a]).get(a)??{turns:0,findings:0,shares:0,lastActivityMs:0},j={sessionId:a,model:e?.model??"",provider:e?.provider??"",inputTokens:d.input,outputTokens:d.output,cacheCreation:d.cache_creation,cacheRead:d.cache_read,totalTokens:d.input+d.output+d.cache_creation+d.cache_read,estimatedCostUsd:null};return Promise.resolve({...av(b,i,this.now()),host:b.host??"",cwd:b.cwd??"",models:g.length>0?g:as(b.models),version:b.version??"",tokens:j,tools:Object.fromEntries(f.flatMap(a=>a.tool?[[a.tool,a.n]]:[])),files:as(b.files),commits:h,events:c})}tokenReports(a){let b=$(this.db.prepare(`${ay}
-           FROM audit_events INDEXED BY idx_audit_llm_usage
-          WHERE ${az}${void 0===a?"":" AND started_at >= ?"}
-          ${aA}`),void 0===a?void 0:[a]);return Promise.resolve((0,i.ryv)(aB(b),i.q_t))}tokenReportForSession(a){let b=$(this.db.prepare(`${ay}
-           FROM audit_events
-          WHERE ${az} AND root_session_id = ?
-          ${aA}`),[a]);return Promise.resolve((0,i.ryv)(aB(b),i.q_t)[0]??null)}harnessFacets(a){let b=$(this.db.prepare(`SELECT DISTINCT coalesce(json_extract(attributes, '$.harness'), '${at}') AS harness
-         FROM audit_events WHERE ${aC}${void 0===a?"":" AND started_at >= ?"}`),void 0===a?void 0:[a]),c=new Set;for(let a of b)c.add(au(a.harness));return Promise.resolve([...c])}rollupsFor(a){let b=new Map(a.map(a=>[a,{turns:0,findings:0,shares:0,lastActivityMs:0}]));if(0===a.length)return b;let c=R(a.length);for(let c of $(this.db.prepare(`SELECT ids.value AS id,
-                (SELECT max(started_at) FROM audit_events e WHERE e.root_session_id = ids.value) AS ms,
-                (SELECT max(ended_at) FROM audit_events e
-                  WHERE e.root_session_id = ids.value AND e.ended_at IS NOT NULL) AS me
-         FROM json_each(?) AS ids`),[JSON.stringify(a)])){let a=b.get(c.id),d=Math.max(c.ms??0,c.me??0);a&&d>0&&(a.lastActivityMs=d)}for(let d of $(this.db.prepare(`SELECT root_session_id AS id, count(*) AS n
-         FROM audit_events INDEXED BY idx_audit_session_prompt
-         WHERE root_session_id IN (${c}) AND event_type = 'prompt'
-         GROUP BY root_session_id`),a)){if(null===d.id)continue;let a=b.get(d.id);a&&(a.turns=d.n)}for(let d of $(this.db.prepare(`SELECT root_session_id AS id,
-                count(DISTINCT json_extract(attributes, '$.run_key')) AS n
-         FROM audit_events INDEXED BY idx_audit_session_run_key
-         WHERE root_session_id IN (${c}) AND event_type = 'llm_call'
-           AND json_extract(attributes, '$.run_key') IS NOT NULL
-         GROUP BY root_session_id`),a)){if(null===d.id)continue;let a=b.get(d.id);a&&(a.turns=Math.max(a.turns,d.n))}for(let d of $(this.db.prepare(`SELECT e.root_session_id AS id, count(*) AS n FROM inspection_findings f
-         JOIN audit_events e ON e.id = f.audit_event_id
-         WHERE e.root_session_id IN (${c})
-         GROUP BY e.root_session_id`),a)){if(null===d.id)continue;let a=b.get(d.id);a&&(a.findings=d.n)}for(let d of $(this.db.prepare(`SELECT root_session_id AS id,
-                count(DISTINCT json_extract(attributes, '$.destination')) AS n
-         FROM audit_events INDEXED BY idx_audit_session_share
-         WHERE root_session_id IN (${c}) AND event_type = 'share'
-         GROUP BY root_session_id`),a)){if(null===d.id)continue;let a=b.get(d.id);a&&(a.shares=d.n)}return b}}class aF{constructor(a){this.db=a,this.insertStmt=a.prepare(`INSERT OR IGNORE INTO audit_events
-         (id, parent_id, root_session_id, event_type,
-          host_id, harness_id, source_project_id, started_at, ended_at,
-          severity, priority, content, content_hash, attributes)
-       VALUES
-         (:id, :parentId, :rootSessionId, :eventType,
-          :hostId, :harnessId, :sourceProjectId, :startedAt, :endedAt,
-          :severity, :priority, :content, :contentHash, :attributes)`),this.upsertLlmCallStmt=a.prepare(`INSERT INTO audit_events
-         (id, parent_id, root_session_id, event_type,
-          host_id, harness_id, source_project_id, started_at, ended_at,
-          severity, priority, content, content_hash, attributes)
-       VALUES
-         (:id, :parentId, :rootSessionId, :eventType,
-          :hostId, :harnessId, :sourceProjectId, :startedAt, :endedAt,
-          :severity, :priority, :content, :contentHash, :attributes)
-       ON CONFLICT(id) DO UPDATE SET
-         attributes = excluded.attributes,
-         ended_at   = excluded.ended_at
-       WHERE COALESCE(json_extract(excluded.attributes, '$.output_tokens'), 0)
-           > COALESCE(json_extract(audit_events.attributes, '$.output_tokens'), 0)`),this.upsertSessionRootStmt=a.prepare(`INSERT OR IGNORE INTO audit_events
-         (id, parent_id, root_session_id, event_type,
-          host_id, harness_id, source_project_id, started_at, ended_at,
-          severity, priority, content, content_hash, attributes)
-       VALUES
-         (:id, :parentId, :rootSessionId, :eventType,
-          :hostId, :harnessId, :sourceProjectId, :startedAt, :endedAt,
-          :severity, :priority, :content, :contentHash, :attributes)
-       ON CONFLICT(id) DO UPDATE SET
-         parent_id         = excluded.parent_id,
-         root_session_id   = excluded.root_session_id,
-         host_id           = excluded.host_id,
-         harness_id        = excluded.harness_id,
-         source_project_id = excluded.source_project_id,
-         started_at        = min(audit_events.started_at, excluded.started_at),
-         ended_at          = excluded.ended_at,
-         severity          = excluded.severity,
-         priority          = excluded.priority,
-         content           = excluded.content,
-         content_hash      = excluded.content_hash,
-         attributes        = excluded.attributes
-       WHERE audit_events.attributes IS NULL AND excluded.attributes IS NOT NULL`)}runInTransaction(a){V(this.db,a)}insertAuditEvent(a){let b=(0,i.V9M)(a);Number.isFinite(b.startedAt)&&("session"===b.eventType?this.upsertSessionRootStmt:this.insertStmt).run(ab({id:b.id,parentId:b.parentId,rootSessionId:b.rootSessionId,eventType:b.eventType,hostId:b.hostId,harnessId:b.harnessId,sourceProjectId:b.sourceProjectId,startedAt:b.startedAt,endedAt:b.endedAt,severity:b.severity,priority:b.priority,content:b.content,contentHash:b.contentHash,attributes:b.attributes}))}ensureSessionRoot(a,b){this.insertAuditEvent({id:a,eventType:"session",startedAt:b})}insertLlmCall(a){var b,c;let d=(0,i.I8t)(a.startedAt);if(!Number.isFinite(d))return;let e=(b=a.sessionId,c=a.messageId,H((0,i.tTV)(["audit_event_llm_call",b,c])));this.upsertLlmCallStmt.run(ab({id:e,parentId:a.parentId,rootSessionId:a.rootSessionId,eventType:"llm_call",hostId:null,harnessId:null,sourceProjectId:null,startedAt:d,endedAt:null,severity:null,priority:null,content:null,contentHash:null,attributes:JSON.stringify(a.attributes)}))}insertToolCall(a){var b,c;let d=(0,i.I8t)(a.startedAt);if(!Number.isFinite(d))return;let e=(b=a.sessionId,c=a.toolUseId,H((0,i.tTV)(["audit_event_tool_call",b,c])));this.insertStmt.run(ab({id:e,parentId:a.parentId,rootSessionId:a.rootSessionId,eventType:"tool_call",hostId:null,harnessId:null,sourceProjectId:null,startedAt:d,endedAt:null,severity:null,priority:null,content:null,contentHash:null,attributes:JSON.stringify(a.attributes)}))}findById(a){return _(this.db.prepare("SELECT * FROM audit_events WHERE id = :id"),{id:a})}sessionProvider(a){let b=this.findById(a);if(!b?.attributes)return;let c=am(b.attributes)?.provider;if("string"==typeof c)return c}llmCallLeaves(){return $(this.db.prepare(`SELECT root_session_id AS sessionId, attributes
-           FROM audit_events
-          WHERE event_type = 'llm_call' AND attributes IS NOT NULL`))}}class aG{constructor(a){this.db=a,this.insertStmt=a.prepare(`INSERT OR IGNORE INTO classified_data (id, class, label, attributes)
-       VALUES (:id, :class, :label, :attributes)`)}upsert(a){var b;let c=(b=a.class,H((0,i.tTV)(["classified_data",b]))),d=(0,i.$BP)(a,c);return this.insertStmt.run(ab({id:d.id,class:d.class,label:d.label,attributes:d.attributes})),c}}function aH(a){return _(a.prepare(`SELECT id, started_at, attributes FROM audit_events
-          WHERE event_type = 'config_scan'
-          ORDER BY started_at DESC, id DESC LIMIT 1`))}class aI{constructor(a){this.db=a}report(){let a=aH(this.db);if(!a)return{scannedAt:null,skills:[],hooks:[],mcpServers:[],configFiles:[],topics:[]};let b=$(this.db.prepare(`SELECT id, object_type AS objectType, title, location, attributes FROM inventory
-          WHERE object_type IN ('skill', 'hook', 'mcp_server', 'config_file') AND last_seen >= :startedAt
-          ORDER BY object_type, title`),{startedAt:a.started_at}),c=$(this.db.prepare(`SELECT f.masked_match AS maskedMatch, d.rule_id AS ruleId, d.name AS name
-           FROM inspection_findings f
-           JOIN inspection_definitions d ON d.id = f.inspection_definition_id
-          WHERE f.audit_event_id = :scanId`),{scanId:a.id}),d=[],e=[],f=[],g=[],h=this.trustOverrides();for(let a of b){let b=am(a.attributes);b&&("skill"===a.objectType?d.push(function(a,b){let c={id:a.id,name:a.title??"(unnamed)",source:aJ(b.source)??"unknown",scope:aJ(b.scope)??"unknown",status:"unknown"},d=aJ(b.description);void 0!==d&&(c.description=d);let e=aJ(b.version);void 0!==e&&(c.installedVersion=e);let f=aJ(b.updated_at);return void 0!==f&&(c.updatedAt=f),c}(a,b)):"hook"===a.objectType?e.push(function(a,b,c){let d=aJ(b.command)??"",e=c.filter(a=>a.maskedMatch===d),f={id:a.id,event:aJ(b.event)??"unknown",command:d,scope:aJ(b.scope)??"unknown",status:e.some(a=>"hook-external-egress"===a.ruleId)?"egress":e.some(a=>"hook-conflict"===a.ruleId)?"conflict":e.some(a=>"hook-unknown"===a.ruleId)?"unknown":"active",warnings:e.map(a=>a.name)},g=aJ(b.matcher);void 0!==g&&(f.matcher=g);let h=aJ(b.plugin_name);return void 0!==h&&(f.pluginName=h),f}(a,b,c)):"mcp_server"===a.objectType?f.push(function(a,b,c){let d={id:a.id,name:a.title??"(unnamed)",scope:aJ(b.scope)??"unknown",transport:aJ(b.transport)??"unknown",trust:c.get(a.id)??"unapproved"},e=aJ(b.command);void 0!==e&&(d.command=e);let f=aJ(b.url);if(void 0!==f&&(d.url=f),Array.isArray(b.env_keys)){let a=b.env_keys.filter(a=>"string"==typeof a);a.length>0&&(d.envKeys=a)}let g=aJ(b.plugin_name);void 0!==g&&(d.pluginName=g);let h=aJ(b.marketplace);void 0!==h&&(d.marketplace=h);let i=aJ(b.project);return void 0!==i&&(d.project=i),d}(a,b,h)):g.push(function(a,b){let c=aJ(b.scope)??"unknown",d={id:a.id,name:a.title??"(unnamed)",path:a.location??"",scope:c,kind:aJ(b.kind)??"Configuration file",untracked:"local"===c},e=aJ(b.detail);void 0!==e&&(d.detail=e),"number"==typeof b.entry_count&&(d.entryCount=b.entry_count);let f=aJ(b.updated_at);return void 0!==f&&(d.updatedAt=f),d}(a,b)))}return{scannedAt:new Date(a.started_at).toISOString(),skills:d,hooks:e,mcpServers:f,configFiles:g,topics:function(a,b,c,d,e){let f=[],g=a.filter(a=>"update_available"===a.status).length,h={topic:"skills",count:a.length};g>0&&(h.attention=`${String(g)} updates`),f.push(h);let i=b.filter(a=>"egress"===a.status).length,j=b.filter(a=>"conflict"===a.status).length,k=b.filter(a=>"unknown"===a.status).length,l=[];i>0&&l.push(`${String(i)} egress`),k>0&&l.push(`${String(k)} unknown`),j>0&&l.push(`${String(j)} conflict${j>1?"s":""}`);let m={topic:"hooks",count:b.length};l.length>0&&(m.attention=l.join(" \xb7 ")),f.push(m);let n=c.filter(a=>"unapproved"===a.trust).length,o={topic:"mcp",count:c.length};n>0&&(o.attention=`${String(n)} unapproved`),f.push(o);let p=d.filter(a=>a.untracked).length,q={topic:"config_files",count:d.length};p>0&&(q.attention=`${String(p)} untracked`),f.push(q);let r=function(a){let b=am(a)?.errors;return"number"==typeof b?b:0}(e),s={topic:"configuration",count:r};return r>0&&(s.attention=`${String(r)} sources failed to parse`),f.push(s),f}(d,e,f,g,a.attributes)}}trustOverrides(){let a=$(this.db.prepare("SELECT asset_id AS assetId, trust FROM mcp_trust_override")),b=new Map;for(let c of a)("known-good"===c.trust||"risky"===c.trust||"unapproved"===c.trust)&&b.set(c.assetId,c.trust);return b}}function aJ(a){return"string"==typeof a?a:void 0}function aK(a){let b=al(a,[]);if(!Array.isArray(b))return[];let c=[];for(let a of b)a&&"object"==typeof a&&c.push(a);return c}function aL(a,b){return a.version!==b.version||a.rulesJson!==b.rulesJson}class aM{constructor(a,b=()=>Date.now()){this.db=a,this.now=b}listDetections(a){let b=$(this.db.prepare(`SELECT namespace, pack_id AS packId, version, name, enabled, policy_id AS policyId,
-                rules_json AS rulesJson
-         FROM installed_packs`)),c=this.availableByPack(),d=b.map(a=>{let b=c.get(`${a.namespace}/${a.packId}`);return{namespace:a.namespace,packId:a.packId,version:a.version,name:a.name,enabled:aa(a.enabled),ruleCount:aK(a.rulesJson).length,policyId:a.policyId,...b&&aL(a,b)?{latestVersion:b.version}:{}}});return Promise.resolve((0,i.plk)(d,a))}availableByPack(){return new Map($(this.db.prepare(`SELECT namespace, pack_id AS packId, version, rules_json AS rulesJson
-         FROM available_packs`)).map(a=>[`${a.namespace}/${a.packId}`,a]))}getDetectionStats(){let a=$(this.db.prepare("SELECT enabled, rules_json AS rulesJson FROM installed_packs")),b=0,c=0,d=new Set;for(let e of a){aa(e.enabled)&&(c+=1);let a=aK(e.rulesJson);for(let c of(b+=a.length,a))"string"==typeof c.id&&d.add(c.id)}return Promise.resolve({detections:a.length,rules:b,active:c,findingsLast30d:this.countFindingsLast30d([...d])})}getDetectionDetail(a){let b=(0,i.pnU)(a);if(!b)return Promise.resolve(null);let{namespace:c,packId:d}=b,e=_(this.db.prepare(`SELECT namespace, pack_id AS packId, version, name, enabled, policy_id AS policyId,
-                rules_json AS rulesJson, updated_at AS updatedAt
-         FROM installed_packs
-         WHERE namespace = ? AND pack_id = ?`),[c,d]);if(!e)return Promise.resolve(null);let f=aK(e.rulesJson),g=f.map(a=>a.id).filter(a=>"string"==typeof a),h=this.countFindingsLast30d(g),j=this.availableByPack().get(`${e.namespace}/${e.packId}`),k=j?aL(e,j)?{available:!0,latestVersion:j.version,latestRuleCount:aK(j.rulesJson).length}:{available:!1,latestVersion:j.version}:null;return Promise.resolve((0,i.a45)({namespace:e.namespace,packId:e.packId,version:e.version,name:e.name,enabled:aa(e.enabled),rules:f,updatedAt:new Date(e.updatedAt),policyId:e.policyId},h,k))}countFindingsLast30d(a){if(0===a.length)return 0;let b=this.now()-2592e6,c=R(a.length);return ac(this.db,`SELECT count(*) AS n
-         FROM inspection_findings f
-         JOIN audit_events e ON e.id = f.audit_event_id
-         JOIN inspection_definitions d ON d.id = f.inspection_definition_id
-         WHERE e.started_at >= ?
-           AND e.event_type IN (${i.hfB})
-           AND d.rule_id IN (${c})`,[b,...a])}}class aN{constructor(a){this.db=a}contentHashes(){return Promise.resolve(new Set($(this.db.prepare(`SELECT content_hash FROM audit_events
-         WHERE event_type IN (${i.hfB})`)).map(a=>a.content_hash)))}}let aO=864e5;class aP extends Error{constructor(a){super(`duplicate-active-exception: an active exception already exists for rule "${a}" and this value — revoke it before granting a new one`),this.code="duplicate-active-exception",this.name="DuplicateActiveExceptionError"}}class aQ extends Error{constructor(a){super(`ambiguous-exception-id: "${a}" matches more than one exception — add more characters`),this.code="ambiguous-exception-id",this.name="AmbiguousExceptionIdError"}}let aR=`revoked_at IS NULL
-     AND (expires_at IS NULL OR expires_at > :now)
-     AND (max_uses IS NULL OR use_count < max_uses)`,aS=`capability = 'reveal_to_model'
-     AND conditions IS NULL
-     AND ${aR}`;class aT{constructor(a,b=()=>Date.now()){this.db=a,this.now=b,this.consumeStmt=a.prepare(`UPDATE exceptions
-          SET use_count = use_count + 1, last_used_at = :now, updated_at = :now
-        WHERE id = :id AND ${aR}`),this.insertBlockedStmt=a.prepare(`INSERT OR REPLACE INTO blocked_detections (reference, rule_id, category, value_fingerprint, key_version, masked_value, session_id, repo, blocked_at)
-       VALUES (:reference, :ruleId, :category, :valueFingerprint, :keyVersion, :maskedValue, :sessionId, :repo, :blockedAt)`),this.sweepBlockedStmt=a.prepare("DELETE FROM blocked_detections WHERE blocked_at <= :cutoff")}create(a){try{return Promise.resolve(this.createSync(a))}catch(a){return Promise.reject(a instanceof Error?a:Error(String(a)))}}createSync(a){if(a.conditions?.provider!==void 0)throw Error("provider conditions are not supported yet — a grant with one would never apply");let b=(0,F.randomUUID)(),c=this.now();try{this.insertExceptionRow(b,a,c)}catch(d){if(!(d instanceof Error&&(2067===d.errcode||d.message.includes("UNIQUE constraint failed"))))throw d;V(this.db,()=>{if(1!==Number(this.db.prepare(`UPDATE exceptions
-                SET revoked_at = :now, revoked_by = :revokedBy,
-                    revoke_reason = 'superseded by a new grant for the same value',
-                    updated_at = :now
-              WHERE rule_id = :ruleId AND value_fingerprint = :valueFingerprint
-                AND key_version = :keyVersion AND revoked_at IS NULL
-                AND ((expires_at IS NOT NULL AND expires_at <= :now)
-                  OR (max_uses IS NOT NULL AND use_count >= max_uses))`).run({now:c,revokedBy:a.createdBy,ruleId:a.ruleId,valueFingerprint:a.valueFingerprint,keyVersion:a.keyVersion}).changes))throw new aP(a.ruleId);this.insertExceptionRow(b,a,c)},"IMMEDIATE")}let d=_(this.db.prepare("SELECT * FROM exceptions WHERE id = :id"),{id:b});if(void 0===d)throw Error("exception row not found immediately after insert");return aU(d)}insertExceptionRow(a,b,c){this.db.prepare(`INSERT INTO exceptions (
-             id, rule_id, category, value_fingerprint, key_version, masked_value,
-             capability, scope, expires_at, max_uses, use_count, last_used_at,
-             justification, conditions, created_by, created_via, created_at, updated_at
-           ) VALUES (
-             :id, :ruleId, :category, :valueFingerprint, :keyVersion, :maskedValue,
-             :capability, :scope, :expiresAt, :maxUses, 0, NULL, :justification,
-             :conditions, :createdBy, :createdVia, :now, :now
-           )`).run({id:a,ruleId:b.ruleId,category:b.category,valueFingerprint:b.valueFingerprint,keyVersion:b.keyVersion,maskedValue:b.maskedValue,capability:b.capability??"suppress",scope:b.scope,expiresAt:null===b.expiresAt?null:(0,i.I8t)(b.expiresAt),maxUses:b.maxUses,justification:b.justification,conditions:null===b.conditions?null:JSON.stringify(b.conditions),createdBy:b.createdBy,createdVia:b.createdVia,now:c})}list(a){let b=a?.includeTerminal?"":`WHERE ${aR}`;return Promise.resolve(ae($(this.db.prepare(`SELECT * FROM exceptions ${b} ORDER BY created_at DESC, rowid DESC`),a?.includeTerminal?{}:{now:this.now()}),aU))}getByIdPrefix(a){if(0===a.length)return Promise.resolve(void 0);let b=$(this.db.prepare(String.raw`SELECT * FROM exceptions WHERE id LIKE :pattern ESCAPE '\' LIMIT 2`),{pattern:`${Q(a)}%`});if(b.length>1)return Promise.reject(new aQ(a));let c=b[0];if(!c)return Promise.resolve(void 0);try{return Promise.resolve(aU(c))}catch{return Promise.resolve(void 0)}}revoke(a,b,c){let d=this.now();return Promise.resolve(1===Number(this.db.prepare(`UPDATE exceptions
-            SET revoked_at = :now, revoked_by = :revokedBy, revoke_reason = :reason, updated_at = :now
-          WHERE id = :id AND revoked_at IS NULL`).run({id:a,revokedBy:b,reason:c??null,now:d}).changes))}consume(a,b=this.now()){return Promise.resolve(1===Number(this.consumeStmt.run({id:a,now:b}).changes))}activeBundleEntries(a,b=this.now()){return Promise.resolve(ae($(this.db.prepare(`SELECT * FROM exceptions
-          WHERE key_version = :keyVersion AND ${aR}
-          ORDER BY created_at DESC, rowid DESC`),{keyVersion:a,now:b}),a=>{let b=null===a.conditions?null:JSON.parse(a.conditions);return i.iRC.parse({id:a.id,ruleId:a.rule_id,valueFingerprint:a.value_fingerprint,keyVersion:a.key_version,capability:a.capability,expiresAt:null===a.expires_at?null:(0,i.q11)(a.expires_at),maxUses:a.max_uses,useCount:a.use_count,conditions:b})}))}recordBlocked(a){let b=this.now();return this.sweepBlockedStmt.run({cutoff:b-aO}),this.insertBlockedStmt.run({reference:a.reference,ruleId:a.ruleId,category:a.category,valueFingerprint:a.valueFingerprint,keyVersion:a.keyVersion,maskedValue:a.maskedValue,sessionId:a.sessionId,repo:a.repo,blockedAt:b}),Promise.resolve()}recentBlocked(a=18e5){return Promise.resolve($(this.db.prepare(`SELECT * FROM blocked_detections
-          WHERE blocked_at > :cutoff
-          ORDER BY blocked_at DESC, rowid DESC`),{cutoff:this.now()-a}).map(a=>({reference:a.reference,ruleId:a.rule_id,category:a.category,valueFingerprint:a.value_fingerprint,keyVersion:a.key_version,maskedValue:a.masked_value,sessionId:a.session_id,repo:a.repo,blockedAt:(0,i.q11)(a.blocked_at)})))}activeRevealGrant(a,b,c,d){try{let e=d??this.now(),f=_(this.db.prepare(`SELECT id FROM exceptions
-            WHERE rule_id = :ruleId AND value_fingerprint = :valueFingerprint
-              AND key_version = :keyVersion
-              AND ${aS}
-            LIMIT 1`),{ruleId:a,valueFingerprint:b,keyVersion:c,now:e});return Promise.resolve(f??null)}catch(a){return Promise.reject(a instanceof Error?a:Error(String(a)))}}sweepTerminal(a,b=this.now()){return Promise.resolve(Number(this.db.prepare(`DELETE FROM exceptions
-          WHERE updated_at < :cutoff
-            AND (revoked_at IS NOT NULL
-                 OR (expires_at IS NOT NULL AND expires_at <= :now)
-                 OR (max_uses IS NOT NULL AND use_count >= max_uses))`).run({cutoff:b-a,now:b}).changes))}}function aU(a){let b=null===a.conditions?null:JSON.parse(a.conditions);return i.V8B.parse({id:a.id,ruleId:a.rule_id,category:a.category,valueFingerprint:a.value_fingerprint,keyVersion:a.key_version,maskedValue:a.masked_value,capability:a.capability,scope:a.scope,expiresAt:null===a.expires_at?null:(0,i.q11)(a.expires_at),maxUses:a.max_uses,useCount:a.use_count,lastUsedAt:null===a.last_used_at?null:(0,i.q11)(a.last_used_at),justification:a.justification,conditions:b,createdBy:a.created_by,createdVia:a.created_via,createdAt:(0,i.q11)(a.created_at),updatedAt:(0,i.q11)(a.updated_at),revokedAt:null===a.revoked_at?null:(0,i.q11)(a.revoked_at),revokedBy:a.revoked_by,revokeReason:a.revoke_reason})}function aV(a){return`(
-    SELECT fr.status FROM finding_resolution fr
-     WHERE fr.finding_key = ${a}.finding_key
-     ORDER BY fr.created_at DESC, fr.rowid DESC
-     LIMIT 1
-  )`}let aW=`(
-  SELECT finding_key, status, method, resolved_at FROM (
-    SELECT fr.finding_key, fr.status, fr.method, fr.resolved_at,
-           ROW_NUMBER() OVER (
-             PARTITION BY fr.finding_key
-             ORDER BY fr.created_at DESC, fr.rowid DESC
-           ) AS rn
-      FROM finding_resolution fr
-  ) WHERE rn = 1
-)`;function aX(a){return null===a||""===a?[]:a.split(",")}function aY(a){return{id:a.id,ruleId:a.rule_id,category:a.category,severity:a.severity,maskedMatch:a.masked_match,actionTaken:a.action_taken,confidence:a.confidence,occurredAt:(0,i.q11)(a.occurred_at),sourceTool:a.source_tool,repo:a.repo??"",file:a.file??"",...null===a.tool_name?{}:{toolName:a.tool_name},eventId:a.event_id,...null===a.session_id?{}:{sessionId:a.session_id},status:(0,i.xog)({kind:a.kind,findingKey:a.finding_key,latestResolutionStatus:a.latest_status})}}let aZ=`f.id AS id, d.rule_id AS rule_id, d.category AS category,
-              d.severity AS severity, f.masked_match AS masked_match,
-              f.action_taken AS action_taken, f.confidence AS confidence,
-              e.started_at AS occurred_at,
-              e.source_tool AS source_tool,
-              e.repo AS repo,
-              e.file_path AS file,
-              e.tool_name AS tool_name,
-              f.audit_event_id AS event_id, e.root_session_id AS session_id,
-              e.event_type AS kind, f.finding_key AS finding_key,
-              ${aV("f")} AS latest_status`;class a${constructor(a){this.db=a}recentFindings(a){let b=a?.limit??50;return Promise.resolve($(this.db.prepare(`SELECT f.id, f.audit_event_id AS event_id, d.rule_id, d.category, d.severity,
-                f.masked_match, f.action_taken, f.confidence, e.started_at AS occurred_at,
-                e.source_tool AS source_tool,
-                e.event_type AS kind
-         FROM audit_events e
-         CROSS JOIN inspection_findings f ON f.audit_event_id = e.id
-         CROSS JOIN inspection_definitions d ON d.id = f.inspection_definition_id
-         WHERE +e.event_type IN (${i.hfB})
-         ORDER BY e.started_at DESC, f.rowid DESC
-         LIMIT :limit`),{limit:b}).map(a=>({id:a.id,eventId:a.event_id,ruleId:a.rule_id,category:a.category,severity:a.severity,maskedMatch:a.masked_match,actionTaken:a.action_taken,confidence:a.confidence,occurredAt:(0,i.q11)(a.occurred_at),sourceTool:a.source_tool,kind:a.kind})))}sessionFindingsCount(a){return a?Promise.resolve(ac(this.db,`SELECT count(*) AS n FROM inspection_findings f
-           JOIN audit_events e ON e.id = f.audit_event_id
-          WHERE e.root_session_id = :sessionId
-            AND e.event_type IN (${i.hfB})`,{sessionId:a})):Promise.resolve(0)}sessionFirings(a){return Object.fromEntries(ad(this.db,`SELECT d.rule_id AS k, count(*) AS n
-           FROM inspection_findings f
-           JOIN audit_events e ON e.id = f.audit_event_id
-           JOIN inspection_definitions d ON d.id = f.inspection_definition_id
-          WHERE e.root_session_id = :sessionId
-            AND e.event_type NOT IN (${i.hfB})
-          GROUP BY d.rule_id`,{sessionId:a}))}listFindingTypes(a){let b=a.sessionId?" AND e.root_session_id = :sessionId":"",c=void 0===a.from?void 0:(0,i.I8t)(a.from),d=`WHERE e.event_type IN (${i.hfB})${b}${void 0===c?"":" AND e.started_at >= :fromMs"}`,e={...a.sessionId?{sessionId:a.sessionId}:{},...void 0===c?{}:{fromMs:c}},f=this.groupAggregates(void 0!==a.q&&""!==a.q,{predicate:d,params:e}),g=(0,i.Ple)(f),h={severity:a.severity,providers:a.provider,actions:a.action,statuses:a.status,subtype:a.subtype,q:a.q},j=(0,i.rG)(g,h),k=(0,i.X0p)((0,i.tXp)(g,h)),l=a.status??[],m={findings:k.reduce((a,b)=>{if(0===l.length)return a+b.instanceCount;let c=f.get(b.id);return a+(c?(0,i.Bfj)(c.statusInputs,l)??b.instanceCount:b.instanceCount)},0),types:k.length},n=a.limit??i.IYX,o=void 0===a.cursor?null:function(a){let b=am(Buffer.from(a,"base64url").toString("utf8"));return void 0!==b&&"string"==typeof b.sev&&"string"==typeof b.t&&"string"==typeof b.id?{severity:b.sev,latestDetectedAt:b.t,id:b.id}:null}(a.cursor),p=null===o?0:function(a,b){let c=a.findIndex(a=>(0,i._6W)(a,b)>0);return -1===c?a.length:c}(k,o),q=k.slice(p,p+n),r=q.at(-1),s=p+n<k.length&&r?function(a){let b={sev:a.severity,t:a.latestDetectedAt,id:a.id};return Buffer.from(JSON.stringify(b)).toString("base64url")}(r):null,t=void 0===a.includeId||""===a.includeId?void 0:function(a,b,c){if(!b.some(a=>a.id===c))return a.find(a=>a.id===c)}(k,q,a.includeId);return Promise.resolve({totals:m,facets:j,items:[...q,...t?[t]:[]],nextCursor:s,...a.sessionId?{sessionFirings:this.sessionFirings(a.sessionId)}:{}})}listFindingInstances(a){let b,c={severity:a.severity,subtype:a.subtype,providers:a.provider,actions:a.action,statuses:a.status,tools:a.tool,repo:a.repo,file:a.file,q:a.q},d=a.limit??i.b2L,e=void 0===a.cursor?null:ao(a.cursor),f=null===e?()=>!0:a=>{let b=(0,i.I8t)(a.occurredAt);return b<=e.startedAtMs&&(b<e.startedAtMs||a.id<e.id)},g=(0,i.fj8)(c),h=[],j=0,k=!1;for(let e of this.scanFindingRows({sessionId:a.sessionId,from:a.from}))g.add(e),(0,i.am1)(e,c)&&(j+=1,f(e)&&(h.length<d?(h.push((0,i.MgS)(e)),b=e):k=!0));let l=k&&b?an({startedAtMs:(0,i.I8t)(b.occurredAt),id:b.id}):null;return Promise.resolve({totals:{findings:j},facets:g.facets(),items:h,nextCursor:l})}listFindingLocations(a){let b={severity:a.severity,subtype:a.subtype,providers:a.provider,actions:a.action,statuses:a.status,tools:a.tool,q:a.q},c=a.limit??i.p$t,d=void 0===a.cursor?null:function(a){let b=am(Buffer.from(a,"base64url").toString("utf8"));return void 0!==b&&"string"==typeof b.sev&&"string"==typeof b.t&&"string"==typeof b.r&&"string"==typeof b.f?{maxSeverity:b.sev,latestDetectedAt:b.t,repo:b.r,file:b.f}:null}(a.cursor),e=new Map,f=(0,i.fj8)(b),g=0;for(let c of this.scanFindingRows({sessionId:a.sessionId,from:a.from})){if(f.add(c),!(0,i.am1)(c,b))continue;g+=1;let a=e.get(c.repo);void 0===a&&(a=new Map,e.set(c.repo,a));let d=a.get(c.file);void 0===d&&(d=(0,i.SSj)(),a.set(c.file,d)),(0,i._5V)(d,c)}let h=[];for(let[a,b]of e)for(let[c,d]of b){let b=(0,i.JB8)(d.statuses);h.push({id:(0,i.ZoN)(a,c),repo:a,file:c,instanceCount:d.instanceCount,maxSeverity:d.maxSeverity,latestDetectedAt:d.latestDetectedAt,...void 0===b?{}:{status:b},ruleIds:[...d.ruleIds]})}h.sort(i.hml);let j=null===d?0:function(a,b){let c=a.findIndex(a=>(0,i.hml)(a,b)>0);return -1===c?a.length:c}(h,d),k=h.slice(j,j+c),l=k.at(-1),m=j+c<h.length&&l?function(a){let b={sev:a.maxSeverity,t:a.latestDetectedAt,r:a.repo,f:a.file};return Buffer.from(JSON.stringify(b)).toString("base64url")}(l):null,n=void 0===a.includeId||""===a.includeId?void 0:function(a,b,c){if(!b.some(a=>a.id===c))return a.find(a=>a.id===c)}(h,k,a.includeId);return Promise.resolve({totals:{findings:g,locations:h.length},facets:f.facets(),items:[...k,...n?[n]:[]],nextCursor:m})}*scanFindingRows(a){let{sql:b,params:c}=this.findingScanSql(a);for(let a of function*(a,b){for(let c of void 0===b?a.iterate():Array.isArray(b)?a.iterate(...b):a.iterate(b))yield c}(this.db.prepare(b),c))yield aY(a)}findingInstance(a){let b=this.db.prepare(`SELECT ${aZ}
-           FROM inspection_findings f
-           JOIN audit_events e ON e.id = f.audit_event_id
-           JOIN inspection_definitions d ON d.id = f.inspection_definition_id
-          WHERE f.id = ?`).get(a);return Promise.resolve(void 0===b?null:(0,i.MgS)(aY(b)))}findingScanSql(a){let b=[`+e.event_type IN (${i.hfB})`],c=[];return void 0!==a.sessionId&&""!==a.sessionId&&(b.push("e.root_session_id = ?"),c.push(a.sessionId)),void 0!==a.from&&(b.push("e.started_at >= ?"),c.push((0,i.I8t)(a.from))),{sql:`SELECT ${aZ}
-         FROM audit_events e
-         CROSS JOIN inspection_findings f ON f.audit_event_id = e.id
-         CROSS JOIN inspection_definitions d ON d.id = f.inspection_definition_id
-        WHERE ${b.join(" AND ")}
-        ORDER BY e.started_at DESC, f.id DESC`,params:c}}groupAggregates(a,b){let c=a?`, group_concat(DISTINCT e.repo) AS repos,
-           group_concat(DISTINCT e.file_path) AS files,
-           group_concat(DISTINCT 'via ' || e.tool_name) AS tool_names`:", NULL AS repos, NULL AS files, NULL AS tool_names";return new Map(this.db.prepare(`SELECT rule_id,
-                -- BARE columns beside max(latest_at), which is deliberate and
-                -- is SQLite's documented behaviour: with a single min()/max()
-                -- in an aggregate query, every bare column takes its value from
-                -- the row that produced the extremum. So these are the severity
-                -- and category of the definition whose finding is NEWEST, which
-                -- is what the row-based build they replaced read off its first
-                -- (newest-first) row.
-                --
-                -- min() is WRONG here and was the defect: inspection_definitions
-                -- holds one row per rule VERSION (see its writer — a version bump
-                -- mints a new row), so a rule whose severity moved between
-                -- versions has several, and min() picks the ALPHABETICALLY
-                -- smallest — 'low' over 'medium', but 'critical' over 'high'.
-                -- That is arbitrary in direction, and it feeds the badge, the
-                -- filter, the facet counts and the primary sort key.
-                --
-                -- Adding a second min()/max() aggregate here would make these
-                -- bare columns ambiguous again; keep max(latest_at) the only one.
-                severity,
-                category,
-                sum(tuple_count) AS instance_count,
-                max(latest_at) AS latest_at,
-                group_concat(source_tools) AS source_tools,
-                group_concat(actions_taken) AS actions_taken,
-                group_concat(status_tuple || '|' || tuple_count) AS status_inputs,
-                group_concat(repos) AS repos,
-                group_concat(files) AS files,
-                group_concat(tool_names) AS tool_names
-           FROM (
-             SELECT d.rule_id AS rule_id,
-                    -- Severity and category are columns of the DEFINITION, and
-                    -- a rule can have SEVERAL definitions (one per version), so
-                    -- these are grouped on below and resolved to the newest
-                    -- firing version by the outer query's bare-column select.
-                    -- They ride the aggregate because the type build has no rows
-                    -- to read them off — see buildFindingTypes.
-                    d.severity AS severity,
-                    d.category AS category,
-                    e.event_type || '|' ||
-                      (CASE WHEN f.finding_key IS NULL THEN '' ELSE 'k' END) || '|' ||
-                      coalesce(latest.status, '') AS status_tuple,
-                    count(*) AS tuple_count,
-                    max(e.started_at) AS latest_at,
-                    group_concat(DISTINCT e.source_tool) AS source_tools,
-                    group_concat(DISTINCT f.action_taken) AS actions_taken
-                    ${c}
-               FROM inspection_findings f
-               JOIN audit_events e ON e.id = f.audit_event_id
-               JOIN inspection_definitions d ON d.id = f.inspection_definition_id
-               LEFT JOIN ${aW} latest
-                 ON latest.finding_key = f.finding_key
-              ${b.predicate}
-              GROUP BY d.rule_id, d.severity, d.category, status_tuple
-           )
-          GROUP BY rule_id`).all(b.params).map(b=>[b.rule_id,{instanceCount:b.instance_count,severity:b.severity,category:b.category,sourceTools:aX(b.source_tools),actionsTaken:aX(b.actions_taken),statusInputs:aX(b.status_inputs).map(a=>{let[b="",c="",d="",e=""]=a.split("|");return{kind:b,findingKey:""===c?null:c,latestResolutionStatus:""===d?null:d,count:Number(e)}}),latestDetectedAt:(0,i.q11)(b.latest_at),...a?{searchText:[b.repos??"",b.files??"",b.tool_names??""].filter(a=>""!==a).join(" ")}:{}}]))}healthSummary(){let a=ac(this.db,`SELECT count(*) AS n FROM inspection_findings f
-         JOIN audit_events e ON e.id = f.audit_event_id
-        WHERE e.event_type IN (${i.hfB})`),b=Object.fromEntries(i.S8C.map(a=>[a,0]));for(let a of $(this.db.prepare(`SELECT f.action_taken AS action_taken, count(*) AS c
-           FROM inspection_findings f
-           JOIN audit_events e ON e.id = f.audit_event_id
-          WHERE e.event_type IN (${i.hfB})
-          GROUP BY f.action_taken`)))a.action_taken in b&&(b[a.action_taken]=a.c);let c={critical:0,high:0,medium:0,low:0};for(let a of $(this.db.prepare(`SELECT d.severity AS severity, count(*) AS c
-         FROM inspection_findings f
-         JOIN audit_events e ON e.id = f.audit_event_id
-         JOIN inspection_definitions d ON d.id = f.inspection_definition_id
-         LEFT JOIN ${aW} latest
-           ON latest.finding_key = f.finding_key
-         WHERE e.event_type IN (${i.hfB})
-           AND (latest.status IS NULL OR latest.status != 'resolved')
-         GROUP BY d.severity`)))a.severity in c&&(c[a.severity]=a.c);let d=i.IgC,e=new Set($(this.db.prepare(`SELECT DISTINCT json_extract(target, '$.category') AS category
-         FROM policies WHERE enabled = 1 AND json_extract(target, '$.category') IS NOT NULL`)).map(a=>a.category));return Promise.resolve({findings:a,byAction:b,bySeverity:c,coverage:0===d.length?0:d.filter(a=>e.has(a)).length/d.length})}activityByDay(a=7){let b=864e5*Math.floor(Date.now()/864e5)-(a-1)*864e5,c=$(this.db.prepare(`SELECT date(e.started_at / 1000, 'unixepoch') AS day, f.action_taken AS action, count(*) AS c
-         FROM inspection_findings f
-         JOIN audit_events e ON e.id = f.audit_event_id
-         WHERE e.started_at >= :since
-           AND e.event_type IN (${i.hfB})
-         GROUP BY day, f.action_taken`),{since:b}),d=new Map;for(let c=0;c<a;c++){let a=new Date(b+864e5*c).toISOString().slice(0,10);d.set(a,{day:a,total:0,redacted:0,warned:0,blocked:0})}for(let a of c){let b=d.get(a.day);b&&(b.total+=a.c,"redact"===a.action?b.redacted+=a.c:"warn"===a.action?b.warned+=a.c:"block"===a.action&&(b.blocked+=a.c))}return Promise.resolve([...d.values()].sort((a,b)=>a.day.localeCompare(b.day)))}}let a_=["session","llm_call","tool_call"].map(a=>`'${a}'`).join(", "),a0=["prompt","response","tool_use"].map(a=>`'${a}'`).join(", "),a1=`id,
-   parent_id AS parentId,
-   root_session_id AS rootSessionId,
-   event_type AS eventType,
-   host_id AS hostId,
-   harness_id AS harnessId,
-   source_project_id AS sourceProjectId,
-   started_at AS startedAt,
-   ended_at AS endedAt,
-   severity,
-   priority,
-   content,
-   content_hash AS contentHash,
-   attributes`;class a2{constructor(a){this.db=a,this.ensureRowStmt=a.prepare("INSERT OR IGNORE INTO history_sync (id) VALUES (1)"),this.sessionsStmt=a.prepare(`SELECT COALESCE(root_session_id, id) AS sessionId, MIN(started_at) AS earliest
-         FROM audit_events
-        WHERE synced_at IS NULL
-          AND event_type IN (${a_})
-          AND started_at < :before
-        GROUP BY sessionId
-        ORDER BY earliest
-        LIMIT :limit`),this.rowsStmt=a.prepare(`SELECT ${a1}
-         FROM audit_events
-        WHERE synced_at IS NULL
-          AND event_type IN (${a_})
-          AND started_at < :before
-          AND COALESCE(root_session_id, id) = :sessionId
-        ORDER BY (event_type = 'session') DESC, started_at
-        LIMIT :limit`),this.captureRowsStmt=a.prepare(`SELECT ${a1}
-         FROM audit_events
-        WHERE synced_at IS NULL
-          AND sync_claimed_at IS NULL
-          AND outbox_owed = 1
-          AND event_type IN (${a0})
-          AND started_at < :before
-        ORDER BY started_at
-        LIMIT :limit`),this.markOwedStmt=a.prepare("UPDATE audit_events SET outbox_owed = 1 WHERE id = :id AND synced_at IS NULL"),this.markCaptureBacklogOwedStmt=a.prepare(`UPDATE audit_events SET outbox_owed = 1
-        WHERE synced_at IS NULL
-          AND event_type IN (${a0})
-          AND started_at < :before`),this.stampStmt=a.prepare("UPDATE audit_events SET synced_at = :at, sync_claimed_at = NULL WHERE id = :id"),this.claimRowStmt=a.prepare("UPDATE audit_events SET sync_claimed_at = :at WHERE id = :id AND synced_at IS NULL"),this.releaseRowStmt=a.prepare("UPDATE audit_events SET sync_claimed_at = NULL WHERE id = :id"),this.releaseStaleClaimsStmt=a.prepare(`UPDATE audit_events SET sync_claimed_at = NULL
-        WHERE sync_claimed_at IS NOT NULL AND sync_claimed_at < :staleBefore`),this.partitionStmt=a.prepare(`SELECT
-         SUM(CASE WHEN synced_at IS NULL AND sync_claimed_at IS NULL THEN 1 ELSE 0 END) AS queued,
-         SUM(CASE WHEN synced_at IS NULL AND sync_claimed_at IS NOT NULL THEN 1 ELSE 0 END) AS inProgress,
-         SUM(CASE WHEN synced_at > 0 THEN 1 ELSE 0 END) AS synced,
-         SUM(CASE WHEN synced_at IS NOT NULL AND synced_at <= 0 THEN 1 ELSE 0 END) AS failed,
-         COUNT(*) AS total
-       FROM audit_events
-       WHERE event_type IN (${a_})`),this.countsStmt=a.prepare(`SELECT
-         SUM(CASE WHEN synced_at IS NULL AND started_at < :before THEN 1 ELSE 0 END) AS pending,
-         SUM(CASE WHEN synced_at > 0 THEN 1 ELSE 0 END) AS sent,
-         SUM(CASE WHEN synced_at = ${String(-1)} THEN 1 ELSE 0 END) AS skipped
-       FROM audit_events
-       WHERE event_type IN (${a_})`),this.captureSkipCountStmt=a.prepare(`SELECT COUNT(*) AS skipped
-         FROM audit_events
-        WHERE synced_at = ${String(-1)}
-          AND event_type IN (${a0})`),this.fingerprintStmt=a.prepare(`SELECT endpoint_fingerprint AS fingerprint, backlog_before AS backlogBefore
-         FROM history_sync WHERE id = 1`),this.setFingerprintStmt=a.prepare(`UPDATE history_sync
-          SET endpoint_fingerprint = :fingerprint, backlog_before = :backlogBefore
-        WHERE id = 1`),this.disownCapturesStmt=a.prepare(`UPDATE audit_events SET outbox_owed = NULL
-        WHERE outbox_owed IS NOT NULL
-          AND event_type IN (${a0})
-          AND started_at < :attachedAt`),this.rearmStmt=a.prepare(`UPDATE audit_events SET synced_at = NULL
-        WHERE synced_at > 0 AND event_type IN (${a_})`),this.claimStmt=a.prepare(`UPDATE history_sync
-          SET owner_pid = :pid, owner_host = :host, acquired_at = :now, heartbeat_at = :now
-        WHERE id = 1
-          AND (owner_pid IS NULL
-               OR heartbeat_at IS NULL
-               OR heartbeat_at < :staleBefore
-               OR heartbeat_at > :now)`),this.heartbeatStmt=a.prepare("UPDATE history_sync SET heartbeat_at = :now WHERE id = 1 AND owner_pid = :pid"),this.releaseStmt=a.prepare(`UPDATE history_sync
-          SET owner_pid = NULL, owner_host = NULL, acquired_at = NULL, heartbeat_at = NULL
-        WHERE id = 1 AND owner_pid = :pid`),this.closeWindowStmt=a.prepare(`UPDATE audit_events SET synced_at = :at
-        WHERE synced_at IS NULL
-          AND event_type IN (${a_})
-          AND started_at >= :attachedAt`),this.releaseBoundaryStmt=a.prepare("UPDATE history_sync SET backlog_before = NULL WHERE id = 1"),this.freezeBoundaryStmt=a.prepare("UPDATE history_sync SET backlog_before = :backlogBefore WHERE id = 1"),this.leaseStmt=a.prepare(`SELECT owner_pid AS ownerPid, owner_host AS ownerHost,
-              acquired_at AS acquiredAt, heartbeat_at AS heartbeatAt
-         FROM history_sync WHERE id = 1`),this.inspectionsStmt=a.prepare(`SELECT d.rule_id AS ruleId,
-              d.name AS ruleName,
-              d.version AS ruleVersion,
-              d.category AS category,
-              d.severity AS severity,
-              f.span_start AS spanStart,
-              f.span_end AS spanEnd,
-              f.masked_match AS maskedMatch,
-              f.action_taken AS actionTaken,
-              f.confidence AS confidence
-         FROM inspection_findings f
-         JOIN inspection_definitions d ON d.id = f.inspection_definition_id
-        WHERE f.audit_event_id = :auditEventId
-        ORDER BY f.span_start, f.id`)}inspectionsFor(a){return $(this.inspectionsStmt,{auditEventId:a})}pendingSessions(a,b){return $(this.sessionsStmt,{limit:a,before:b}).map(a=>a.sessionId)}pendingRows(a,b,c){return $(this.rowsStmt,{sessionId:a,limit:b,before:c})}pendingCaptureRows(a,b){return $(this.captureRowsStmt,{limit:a,before:b})}markCaptureOwed(a){this.markOwedStmt.run({id:a})}markCaptureBacklogOwed(a){return Number(this.markCaptureBacklogOwedStmt.run({before:a}).changes)}markSynced(a,b){this.stampAll(a,b)}markSkipped(a){this.stampAll(a,-1)}eachInTransaction(a,b){0!==a.length&&V(this.db,()=>{for(let c of a)b(c)},"IMMEDIATE")}stampAll(a,b){0!==a.length&&V(this.db,()=>{for(let c of a)this.stampStmt.run({at:b,id:c})},"IMMEDIATE")}claimRows(a,b){this.eachInTransaction(a,a=>this.claimRowStmt.run({at:b,id:a}))}releaseRows(a){this.eachInTransaction(a,a=>this.releaseRowStmt.run({id:a}))}releaseStaleClaims(a){return Number(this.releaseStaleClaimsStmt.run({staleBefore:a}).changes)}partition(){let a=_(this.partitionStmt,{});return{queued:a?.queued??0,inProgress:a?.inProgress??0,synced:a?.synced??0,failed:a?.failed??0,total:a?.total??0}}counts(a){let b=_(this.countsStmt,{before:a}),c=_(this.captureSkipCountStmt);return{pending:b?.pending??0,sent:b?.sent??0,skipped:b?.skipped??0,capturesSkipped:c?.skipped??0}}deployment(){let a=_(this.fingerprintStmt);return{fingerprint:a?.fingerprint??void 0,backlogBefore:a?.backlogBefore??void 0}}rearmFor(a,b,c){this.ensureRowStmt.run(),V(this.db,()=>{let d=_(this.fingerprintStmt)?.fingerprint;this.rearmStmt.run(),null!=d&&d!==a&&this.disownCapturesStmt.run({attachedAt:b}),void 0!==c&&this.markCaptureBacklogOwedStmt.run({before:c}),this.setFingerprintStmt.run({fingerprint:a,backlogBefore:b})},"IMMEDIATE")}closeAttachedWindow(a,b){this.ensureRowStmt.run(),V(this.db,()=>{let c=_(this.fingerprintStmt),d=c?.backlogBefore??a;this.closeWindowStmt.run({at:b,attachedAt:d}),this.releaseBoundaryStmt.run()},"IMMEDIATE")}freezeBoundary(a){this.ensureRowStmt.run(),this.freezeBoundaryStmt.run({backlogBefore:a})}claim(a,b,c,d){this.ensureRowStmt.run();let e=!1;return V(this.db,()=>{e=1===this.claimStmt.run({pid:a,host:b,now:c,staleBefore:c-d}).changes},"IMMEDIATE"),e}heartbeat(a,b){this.heartbeatStmt.run({now:b,pid:a})}release(a){this.releaseStmt.run({pid:a})}lease(){return _(this.leaseStmt)}}class a3{constructor(a){this.db=a,this.insertStmt=a.prepare(`INSERT OR IGNORE INTO inspection_definitions
-         (id, rule_id, name, category, severity, definition, version)
-       VALUES
-         (:id, :ruleId, :name, :category, :severity, :definition, :version)`)}upsert(a){let b=J(a.ruleId,a.version),c=(0,i.JAl)(a,b);return this.insertStmt.run({id:c.id,ruleId:c.ruleId,name:c.name,category:c.category,severity:c.severity,definition:c.definition,version:c.version}),b}}class a4{constructor(a){this.db=a,this.insertStmt=a.prepare(`INSERT INTO inspection_findings
-         (id, audit_event_id, inspection_definition_id, classified_data_id,
-          span_start, span_end, masked_match, action_taken, confidence,
-          finding_key, first_detected_at)
-       VALUES
-         (:id, :auditEventId, :inspectionDefinitionId, :classifiedDataId,
-          :spanStart, :spanEnd, :maskedMatch, :actionTaken, :confidence,
-          :findingKey,
-          COALESCE(:firstDetectedAt, (SELECT started_at FROM audit_events WHERE id = :auditEventId)))
-       ON CONFLICT(id) DO UPDATE SET
-         inspection_definition_id = excluded.inspection_definition_id
-       ON CONFLICT (finding_key) DO UPDATE SET
-         audit_event_id = excluded.audit_event_id,
-         inspection_definition_id = excluded.inspection_definition_id,
-         classified_data_id = excluded.classified_data_id,
-         span_start = excluded.span_start,
-         span_end = excluded.span_end,
-         masked_match = excluded.masked_match,
-         action_taken = excluded.action_taken,
-         confidence = excluded.confidence`),this.sessionDupStmt=a.prepare(`SELECT 1 FROM inspection_findings f
-         JOIN audit_events e ON e.id = f.audit_event_id
-         JOIN inspection_definitions d ON d.id = f.inspection_definition_id
-        WHERE d.rule_id = :ruleId AND f.masked_match = :maskedMatch
-          AND e.root_session_id = :sessionId
-          AND e.event_type IN (${i.hfB})
-        LIMIT 1`),this.eventDupStmt=a.prepare(`SELECT 1 FROM inspection_findings f
-         JOIN inspection_definitions d ON d.id = f.inspection_definition_id
-        WHERE f.audit_event_id = :auditEventId AND d.rule_id = :ruleId
-          AND f.masked_match = :maskedMatch
-          AND f.span_start = :spanStart AND f.span_end = :spanEnd
-        LIMIT 1`)}isSessionDuplicate(a,b,c){return void 0!==this.sessionDupStmt.get({ruleId:a,maskedMatch:b,sessionId:c})}isEventDuplicate(a,b,c,d,e){return void 0!==this.eventDupStmt.get({auditEventId:a,ruleId:b,maskedMatch:c,spanStart:d,spanEnd:e})}insertFinding(a){let b=(0,i.$3l)(a);this.insertStmt.run(ab({id:b.id,auditEventId:b.auditEventId,inspectionDefinitionId:b.inspectionDefinitionId,classifiedDataId:b.classifiedDataId,spanStart:b.spanStart,spanEnd:b.spanEnd,maskedMatch:b.maskedMatch,actionTaken:b.actionTaken,confidence:b.confidence,findingKey:b.findingKey,firstDetectedAt:b.firstDetectedAt}))}}c(51455);var a5=c(48161);function a6(){return(0,e.join)((0,a5.homedir)(),".aka")}function a7(a=a6()){return(0,e.join)(a,"settings")}function a8(a=a6()){return(0,e.join)(a,"data")}function a9(a=a6()){return(0,e.join)(a,"keys")}let ba=new Set(["EEXIST","EACCES","EPERM","EBUSY"]),bb=new Int32Array(new SharedArrayBuffer(4));class bc extends Error{constructor(a,b,c,d,e){super(`cannot lock ${b} for writing: ${c}`+(void 0===d?"":` (held by pid ${String(d)})`),e),this.name="FileLockError",this.reason=a,this.file=b,this.holderPid=d}}function bd(a){let b;try{b=(0,d.readFileSync)(a,"utf8")}catch{return null}try{let{pid:a,token:c,at:d,host:e}=JSON.parse(b);if("number"!=typeof a||"string"!=typeof c||"number"!=typeof d)return null;return{pid:a,token:c,at:d,host:"string"==typeof e?e:""}}catch{return null}}function be(a,b){let c,e=(0,F.randomUUID)();try{c=(0,d.openSync)(a,"wx",384)}catch(e){let c=e.code??"";if("EEXIST"===c||ba.has(c)&&((0,d.existsSync)(a)||function(a){let b=`${a}.probe-${(0,F.randomUUID)()}`;try{return(0,d.closeSync)((0,d.openSync)(b,"wx",384)),!0}catch{return!1}finally{try{(0,d.rmSync)(b,{force:!0})}catch{}}}(a)))return null;throw new bc("unavailable",b,e instanceof Error?e.message:String(e),void 0,{cause:e})}let f={pid:process.pid,token:e,at:Date.now(),host:(0,a5.hostname)()};try{(0,d.writeFileSync)(c,`${JSON.stringify(f)}
-`)}catch{try{(0,d.closeSync)(c)}catch{}return(0,d.rmSync)(a,{force:!0}),null}try{(0,d.closeSync)(c)}catch{}return e}function bf(a=function(a=process.platform){return"darwin"===a?[e.posix.join("/Library","Application Support","AKASecurity",i.WRR),e.posix.join("/Library","Managed Preferences",i.WRR)]:"win32"===a?[e.win32.join("C:\\","ProgramData","AKASecurity",i.WRR)]:[e.posix.join("/etc","aka",i.WRR)]}()){for(let b of a){let a;try{a=(0,d.readFileSync)(b,"utf8")}catch{continue}let c=am(a);if(!c)continue;let e=i.ZXz.safeParse(c);if(e.success)return e.data}return null}function bg(a,b,c=()=>new Date){if(!b)return a;let{values:d}=b,e={...a};return void 0!==d.runMode&&(e.runMode=d.runMode),void 0!==d.controlPlane&&(e.controlPlane={...d.controlPlane,attachedAt:a.controlPlane?.endpoint===d.controlPlane.endpoint?a.controlPlane.attachedAt:c().toISOString()}),void 0!==d.historicalAccess&&(e.historicalAccess=d.historicalAccess),void 0!==d.vaultKeyCustody&&(e.vaultKeyCustody=d.vaultKeyCustody),void 0!==d.vaultInlineReveal&&(e.vaultInlineReveal=d.vaultInlineReveal),void 0!==d.dataSharesInPlace&&(e.dataSharesInPlace=d.dataSharesInPlace),void 0!==d.redactFallback&&(e.redactFallback=d.redactFallback),void 0!==d.vaultConsent&&(e.vaultConsent=d.vaultConsent?a.vaultConsent?.version===i.DzG?a.vaultConsent:{acknowledgedAt:c().toISOString(),version:i.DzG}:void 0),void 0!==d.modelJudgeConsent&&(e.modelJudgeConsent=d.modelJudgeConsent?a.modelJudgeConsent?.payloadVersion===i.kxf?a.modelJudgeConsent:{acknowledgedAt:c().toISOString(),payloadVersion:i.kxf}:void 0),e}let bh="settings.json";function bi(a=a6()){return bg(bj(a),bf())}function bj(a){let b=function(a){let b;try{b=(0,d.readFileSync)(a,"utf8")}catch{return null}return am(b)??null}((0,e.join)(a7(a),bh));if(!b)return(0,i.i1j)();try{return i.hd_.parse(b)}catch{return(0,i.i1j)()}}class bk extends Error{constructor(a){super(`refusing to write administratively locked settings: ${a.join(", ")}`),this.name="ManagedFieldError",this.fields=a}}function bl(a,b=a6(),c){let f=a7(b);o(f);let g=(0,e.join)(f,bh),h=void 0===c?bf():c,j=h?{present:!0,...void 0===h.organization?{}:{organization:h.organization},lockedFields:h.lockedFields,...void 0===h.unknownLockedFields?{}:{unknownLockedFields:h.unknownLockedFields}}:i.MhX;return function(a,b,c={}){let e=c.timeoutMs??5e3,f=c.staleMs??2e3,g=`${a}.lock`,h=Date.now()+e,i=be(g,a);for(;null===i;){if(function(a,b){let c,e=`${a}.break`;try{c=(0,d.openSync)(e,"wx",384)}catch{return function(a){try{Date.now()-(0,d.statSync)(a).mtimeMs>=1e4&&(0,d.rmSync)(a,{force:!0})}catch{}}(e),!1}try{(0,d.closeSync)(c)}catch{}try{if(!(0,d.existsSync)(a)||!function(a,b,c){var e;if(!a)try{return Date.now()-(0,d.statSync)(b).mtimeMs>=c}catch{return!1}return!(Date.now()-a.at<c)&&(!(a.host===(0,a5.hostname)()&&function(a){if(!Number.isInteger(a)||a<=0)return!1;try{return process.kill(a,0),!0}catch(a){return"ESRCH"!==a.code}}(a.pid))||Date.now()-a.at>=(e=c,Math.max(30*e,6e4)))}(bd(a),a,b))return!1;return(0,d.rmSync)(a,{force:!0}),!0}catch{return!1}finally{try{(0,d.rmSync)(e,{force:!0})}catch{}}}(g,f)){i=be(g,a);continue}if(Date.now()>=h)throw new bc("timeout",a,`still held after ${String(e)}ms`,bd(g)?.pid);Atomics.wait(bb,0,0,5),i=be(g,a)}try{var j;let c=b();if(j=c,"object"==typeof j&&null!==j&&"function"==typeof j.then)throw c.then(()=>void 0,()=>void 0),TypeError(`withFileLock(${a}) was given an async body; the lock is released as soon as it returns, so the awaited work would run unguarded. Pass a synchronous function.`);return c}finally{!function(a,b){try{if(bd(a)?.token!==b)return;(0,d.rmSync)(a,{force:!0})}catch{}}(g,i)}}(g,()=>{let c=bj(b),d="function"==typeof a?a(c):a,e=function(a,b){let c=[],d=c=>c in b&&b[c]!==a[c],e="controlPlane"in b&&(b.controlPlane?.endpoint!==a.controlPlane?.endpoint||b.controlPlane?.label!==a.controlPlane?.label);return(d("runMode")||e)&&c.push("runMode"),d("historicalAccess")&&c.push("historicalAccess"),d("vaultKeyCustody")&&c.push("vaultKeyCustody"),d("vaultInlineReveal")&&c.push("vaultInlineReveal"),d("dataSharesInPlace")&&c.push("dataSharesInPlace"),d("redactFallback")&&c.push("redactFallback"),"vaultConsent"in b&&(0,i.hds)(b.vaultConsent)!==(0,i.hds)(a.vaultConsent)&&c.push("vaultConsent"),"modelJudgeConsent"in b&&(0,i.DLF)(b.modelJudgeConsent)!==(0,i.DLF)(a.modelJudgeConsent)&&c.push("modelJudgeConsent"),c}(bg(c,h),d),f=j.present?e.filter(a=>j.lockedFields.includes(a)):[];if(f.length>0)throw new bk(f);let k=i.hd_.parse({...c,...function(a,b,c,d){if(!b.present)return a;let e=a=>(b.lockedFields.includes(a)||c.includes(a))&&!d.includes(a),f={...a};return e("runMode")&&(delete f.runMode,delete f.controlPlane),e("historicalAccess")&&delete f.historicalAccess,e("vaultConsent")&&delete f.vaultConsent,e("vaultKeyCustody")&&delete f.vaultKeyCustody,e("vaultInlineReveal")&&delete f.vaultInlineReveal,e("modelJudgeConsent")&&delete f.modelJudgeConsent,e("dataSharesInPlace")&&delete f.dataSharesInPlace,e("redactFallback")&&delete f.redactFallback,f}(d,j,function(a){if(!a)return[];let{values:b}=a,c=[];return(void 0!==b.runMode||void 0!==b.controlPlane)&&c.push("runMode"),void 0!==b.historicalAccess&&c.push("historicalAccess"),void 0!==b.vaultConsent&&c.push("vaultConsent"),void 0!==b.vaultKeyCustody&&c.push("vaultKeyCustody"),void 0!==b.vaultInlineReveal&&c.push("vaultInlineReveal"),void 0!==b.modelJudgeConsent&&c.push("modelJudgeConsent"),void 0!==b.dataSharesInPlace&&c.push("dataSharesInPlace"),void 0!==b.redactFallback&&c.push("redactFallback"),c}(h),e),onboardedAt:d.onboardedAt??c.onboardedAt??new Date().toISOString()});return t(g,`${JSON.stringify(k,null,2)}
-`),k})}class bm extends Error{constructor(a,b,c,d){super(function(a,b,c,d){switch(d){case"lock":return`refusing to re-assign '${a}': its policy is set by the connected control plane`;case"disable":return`refusing to disable '${a}': it is governed by the connected control plane`;case"floor":return`refusing to set '${a}' to '${b??"unassigned"}': the connected control plane requires at least '${c}'`}}(a,b,c,d)),this.name="PolicyFloorError",this.pack=a,this.attempted=b,this.floor=c,this.refusal=d}}function bn(a=a6()){if(!(0,i.lgf)(bi(a)))return null;let b=function(a=a6()){try{let b=(0,d.readFileSync)((0,e.join)(a8(a),f),"utf8"),c=JSON.parse(b);if("object"!=typeof c||null===c)return null;return i.vap.parse(c.bundle)}catch{return null}}(a);if(null===b)return null;let c=function(a){let b=new Map,c=new Map;for(let d of a)d.enabled&&("ruleId"in d.target?b.has(d.target.ruleId)||b.set(d.target.ruleId,d.action):c.has(d.target.category)||c.set(d.target.category,d.action));return{byRuleId:b,byCategory:c}}(b.policies);return{floorFor:a=>(function(a,b,{byRuleId:c,byCategory:d}){let e=null;for(let b of a){let a=c.get(b.id)??d.get(b.category);void 0!==a&&(e=null===e?a:(0,i.Lq6)(e,a))}return null===e?null:{floor:(0,i.GWi)(e),locked:function(a,b,c){let d=new Set(b.map(a=>a.id)),e=new Set(b.map(a=>a.category)),f=b.some(a=>c.has(a.id));return a.some(a=>!!a.enabled&&"authored"===a.provenance&&("ruleId"in a.target?d.has(a.target.ruleId):f&&e.has(a.target.category)))}(b,a,c)}})(a,b.policies,c)}}function bo(a){let b=/^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z-.]+))?$/.exec(a.trim());return b?{core:[Number(b[1]),Number(b[2]),Number(b[3])],pre:b[4]?b[4].split("."):[]}:null}let bp=i.Jr;function bq(a){return a.map(a=>{var b;return`${a.namespace}/${a.packId}@${a.version}#${b=a.rulesJson,(0,F.createHash)("sha256").update(b).digest("hex")}`}).sort().join(",")}function br(a){let b=/^(\d+)\.(\d+)\.(\d+)/.exec(a);return b?[Number(b[1]),Number(b[2]),Number(b[3])]:null}class bs{constructor(a,b){this.db=a,this.baseDir=b,this.insertMissingStmt=a.prepare(`INSERT INTO installed_packs (id, namespace, pack_id, version, name, rules_json, enabled, created_at, updated_at)
-       VALUES (:id, :namespace, :packId, :version, :name, :rulesJson, 1, :now, :now)
-       ON CONFLICT (namespace, pack_id) DO NOTHING`),this.upsertAvailableStmt=a.prepare(`INSERT INTO available_packs (id, namespace, pack_id, version, name, rules_json, recorded_by, updated_at)
-       VALUES (:id, :namespace, :packId, :version, :name, :rulesJson, :recordedBy, :now)
-       ON CONFLICT (namespace, pack_id) DO UPDATE SET
-         version = excluded.version,
-         name = excluded.name,
-         rules_json = excluded.rules_json,
-         recorded_by = excluded.recorded_by,
-         updated_at = excluded.updated_at
-       WHERE available_packs.version <> excluded.version
-          OR available_packs.name <> excluded.name
-          OR available_packs.rules_json <> excluded.rules_json`),this.signatureStmt=a.prepare("SELECT namespace, pack_id AS packId, version, rules_json AS rulesJson FROM available_packs"),this.packRulesStmt=a.prepare(`SELECT rules_json AS rulesJson FROM installed_packs
-        WHERE namespace = ? AND pack_id = ?`)}recordInventory(a,b){if(0!==a.length)try{let c=a.map(a=>({namespace:a.namespace,packId:a.packId,version:a.version,name:a.name,rulesJson:JSON.stringify(a.rules),ruleIds:new Set(a.rules.map(a=>a.id))}));if(this.storedSignature()===bq(c))return;let d=Date.now();V(this.db,()=>{let a=this.mirrorState(),e=!1;for(let f of c){let c={id:(0,F.randomUUID)(),namespace:f.namespace,packId:f.packId,version:f.version,name:f.name,rulesJson:f.rulesJson,now:d},g=a.get(`${f.namespace}/${f.packId}`);void 0===g||!function(a,b){let c=br(a.version);if(null===c)return!0;let d=br(b.version);if(null===d)return!1;for(let a=0;a<3;a++){let b=c[a]??0,e=d[a]??0;if(b!==e)return b<e}for(let c of b.ruleIds)if(!a.ruleIds.has(c))return!0;return!1}(f,g)?this.upsertAvailableStmt.run({...c,id:(0,F.randomUUID)(),recordedBy:b?.recordedBy??null}):e=!0,this.insertMissingStmt.run(c)}e||this.pruneAvailable(c.map(a=>`${a.namespace}/${a.packId}`))},"IMMEDIATE")}catch{}}mirrorState(){return new Map($(this.db.prepare("SELECT namespace, pack_id AS packId, version, rules_json AS rulesJson FROM available_packs")).map(a=>[`${a.namespace}/${a.packId}`,{version:a.version,ruleIds:function(a){let b=new Set,c=al(a,[]);if(!Array.isArray(c))return b;for(let a of c)if(a&&"object"==typeof a){let c=a.id;"string"==typeof c&&b.add(c)}return b}(a.rulesJson)}]))}pruneAvailable(a){let b=$(this.db.prepare("SELECT namespace, pack_id AS packId FROM available_packs")),c=new Set(a),d=this.db.prepare("DELETE FROM available_packs WHERE namespace = ? AND pack_id = ?");for(let a of b)c.has(`${a.namespace}/${a.packId}`)||d.run(a.namespace,a.packId)}applyUpdate(a,b){if(this.db.isTransaction)throw Error("applyUpdate must not be called inside an open transaction");let c=!1;return V(this.db,()=>{this.db.exec("UPDATE _pack_write_gate SET open = 1 WHERE id = 1");let d=this.db.prepare(`UPDATE installed_packs SET
-             version = (SELECT a.version FROM available_packs a
-                        WHERE a.namespace = :namespace AND a.pack_id = :packId),
-             name = (SELECT a.name FROM available_packs a
-                     WHERE a.namespace = :namespace AND a.pack_id = :packId),
-             rules_json = (SELECT a.rules_json FROM available_packs a
-                           WHERE a.namespace = :namespace AND a.pack_id = :packId),
-             updated_at = :now
-           WHERE namespace = :namespace AND pack_id = :packId
-             AND EXISTS (SELECT 1 FROM available_packs a
-                         WHERE a.namespace = :namespace AND a.pack_id = :packId)`).run({namespace:a,packId:b,now:Date.now()});this.db.exec("UPDATE _pack_write_gate SET open = 0 WHERE id = 1"),c=Number(d.changes)>0},"IMMEDIATE"),c}installedRuleset(){let a=$(this.db.prepare(`SELECT enabled, policy_id AS policyId, rules_json AS rulesJson, version,
-                namespace, pack_id AS packId
-           FROM installed_packs
-          ORDER BY namespace, pack_id`)),b={installedPacks:a.length,enabledPacks:0,rules:[],invalidRules:0,rejectedRules:[],ruleActions:new Map,ruleVersions:new Map,reversibleRules:new Set},c=(a,c,d)=>{b.rejectedRules.length>=10||b.rejectedRules.push({pack:a,ruleId:c,reason:d})};for(let d of a){let a;if(!aa(d.enabled))continue;b.enabledPacks+=1;let e=(0,i.DhA)(d.policyId),f=(0,i.TdZ)(d.policyId),g=`${d.namespace}/${d.packId}`;try{a=JSON.parse(d.rulesJson)}catch{b.invalidRules+=1,c(g,null,"rules_json: malformed JSON");continue}if(!Array.isArray(a)){b.invalidRules+=1,c(g,null,"rules_json: not an array");continue}for(let h of a){let a=i.jON.safeParse(h);a.success?(b.rules.push(a.data),b.ruleActions.set(a.data.id,e),b.ruleVersions.set(a.data.id,d.version),f?b.reversibleRules.add(a.data.id):b.reversibleRules.delete(a.data.id)):(b.invalidRules+=1,c(g,function(a){if("object"!=typeof a||null===a)return null;let b=a.id;return i.jON.shape.id.safeParse(b).success?b:null}(h),function(a){let b=a.issues[0];if(!b)return"unknown";let c=b.path.map(a=>String(a)).join(".");return c?`${c}: ${b.code}`:b.code}(a.error)))}}return b}newestRecordedBinary(){let a=$(this.db.prepare("SELECT DISTINCT recorded_by AS recordedBy FROM available_packs WHERE recorded_by IS NOT NULL")),b=null;for(let c of a){let a=c.recordedBy.lastIndexOf("@");if(a<=0||a===c.recordedBy.length-1)continue;let d=c.recordedBy.slice(0,a),e=c.recordedBy.slice(a+1);null!==bo(e)&&(null===b||function(a,b){let c=bo(a),d=bo(b);if(!c||!d)return 0;for(let a=0;a<3;a++){let b=c.core[a]??0,e=d.core[a]??0;if(b!==e)return b<e?-1:1}return function(a,b){if(0===a.length&&0===b.length)return 0;if(0===a.length)return 1;if(0===b.length)return -1;let c=Math.min(a.length,b.length);for(let d=0;d<c;d++){let c=a[d]??"",e=b[d]??"";if(c===e)continue;let f=/^\d+$/.test(c),g=/^\d+$/.test(e);if(f&&!g)return -1;if(!f&&g)return 1;if(f&&g)return Number(c)<Number(e)?-1:1;return c<e?-1:1}return a.length===b.length?0:a.length<b.length?-1:1}(c.pre,d.pre)}(e,b.version)>0)&&(b={binary:d,version:e})}return b}counts(){return Promise.resolve(_(this.db.prepare(`SELECT count(*) AS packs,
-                coalesce(sum(json_array_length(rules_json)), 0) AS rules,
-                coalesce(sum(enabled), 0) AS enabled
-         FROM installed_packs`))??{packs:0,rules:0,enabled:0})}countsByPolicyId(){return ad(this.db,`SELECT coalesce(policy_id, '${bp}') AS k, count(*) AS n
-         FROM installed_packs
-         GROUP BY k`)}listByPolicyId(a){return $(this.db.prepare(`SELECT namespace, pack_id AS packId, name, enabled, rules_json AS rulesJson
-         FROM installed_packs
-         WHERE coalesce(policy_id, '${bp}') = ?
-         ORDER BY name ASC`),[a]).map(a=>({id:`${a.namespace}/${a.packId}`,name:a.name,ruleCount:aK(a.rulesJson).length,enabled:aa(a.enabled)}))}packFloorRules(a,b){let c=_(this.packRulesStmt,[a,b]);return c?aK(c.rulesJson).map(a=>({id:a.id,category:a.category})):[]}policyFloor(a,b){return void 0===this.baseDir?null:function(a,b=a6()){let c=bn(b);return null===c?null:c.floorFor(a)}(this.packFloorRules(a,b),this.baseDir)}policyFloors(a){let b=new Map;if(void 0===this.baseDir)return b;let c=bn(this.baseDir);if(null===c)return b;for(let d of a){let a=c.floorFor(this.packFloorRules(d.namespace,d.packId));null!==a&&b.set(`${d.namespace}/${d.packId}`,a)}return b}setPolicy(a,b,c){if(null!==c&&!i.HUb.safeParse(c).success)throw Error(`Unknown policy '${c}'. Must be one of: ${i.V0H.join(", ")}.`);let d=this.policyFloor(a,b);if(null!==d){let e=function(a,b){if(b.locked)return"lock";let c=a??i.Jr;return(0,i.T2I)((0,i.fhc)(c),(0,i.fhc)(b.floor))?null:"floor"}(c,d);if(null!==e)throw new bm(`${a}/${b}`,c,d.floor,e)}return Number(this.db.prepare(`UPDATE installed_packs SET policy_id = :policyId, updated_at = :now
-         WHERE namespace = :namespace AND pack_id = :packId`).run({policyId:c,now:Date.now(),namespace:a,packId:b}).changes)>0}setEnabled(a,b,c){let d=this.policyFloor(a,b);if(null!==d){let e=null===d||c?null:"disable";if(null!==e)throw new bm(`${a}/${b}`,null,d.floor,e)}return Number(this.db.prepare(`UPDATE installed_packs SET enabled = :enabled, updated_at = :now
-         WHERE namespace = :namespace AND pack_id = :packId`).run({enabled:+!!c,now:Date.now(),namespace:a,packId:b}).changes)>0}storedSignature(){return bq($(this.signatureStmt))}}class bt{constructor(a){this.db=a,this.upsertStmt=a.prepare(`INSERT INTO inventory
-         (id, object_type, location, title, host_id, attributes, first_seen, last_seen)
-       VALUES
-         (:id, :objectType, :location, :title, :hostId, :attributes, :firstSeen, :lastSeen)
-       ON CONFLICT(id) DO UPDATE SET
-         location = excluded.location,
-         title = excluded.title,
-         host_id = excluded.host_id,
-         attributes = excluded.attributes,
-         last_seen = excluded.last_seen`)}upsert(a,b=Date.now()){var c,d;let e=(c=a.objectType,d=a.identityKey,H((0,i.tTV)(["inventory",c,d]))),f=(0,i.gzP)(a,e,b);return this.upsertStmt.run(ab({id:f.id,objectType:f.objectType,location:f.location,title:f.title,hostId:f.hostId,attributes:f.attributes,firstSeen:f.firstSeen,lastSeen:f.lastSeen})),e}findById(a){return _(this.db.prepare("SELECT * FROM inventory WHERE id = :id"),{id:a})}distinctTitles(a){return $(this.db.prepare(`SELECT DISTINCT title FROM inventory
-         WHERE object_type = :objectType AND title IS NOT NULL
-         ORDER BY title`),{objectType:a}).map(a=>a.title)}osVersions(){return $(this.db.prepare(`SELECT DISTINCT os_version AS value FROM inventory
-         WHERE object_type = 'host' AND os_version IS NOT NULL
-         ORDER BY value`)).map(a=>a.value)}}let bu=["config","skill","mcp","hook"],bv=new Set(i.SHn.options),bw="(url IS NULL OR (url NOT LIKE '%/.claude/worktrees/%' AND url NOT LIKE '%\\.claude\\worktrees\\%'))",bx={[i.tLs.ClaudeCode]:"Claude Code",[i.tLs.Cursor]:"Cursor",[i.tLs.Codex]:"Codex",[i.tLs.Antigravity]:"Antigravity"},by={accessCounts:{open:0,approved:0,blocked:0,total:0},findingsCount:0},bz=a=>a.toLowerCase().replace(/[\s-]/g,""),bA={ClaudeCode:bz(i.Zdp.ClaudeCode),Cursor:bz(i.Zdp.Cursor),Codex:bz(i.Zdp.Codex),Antigravity:bz(i.Zdp.Antigravity)};function bB(a,b){if(a.provider&&bv.has(a.provider))return a.provider;let c=bz(b.title??"");return c.includes(bA.ClaudeCode)||"claude"===c?i.tLs.ClaudeCode:c.includes(bA.Cursor)?i.tLs.Cursor:c.includes(bA.Codex)?i.tLs.Codex:c.includes(bA.Antigravity)?i.tLs.Antigravity:null}function bC(a){return a.some(a=>{let b=al(a.attributes,{});return"sample"!==b.provenance&&bB(b,a)===i.tLs.ClaudeCode})}function bD(a){let b={id:a.id,type:a.assetType,name:a.name,sub:a.sub??"",flags:al(a.flagsJson,[])};return"mcp"===a.assetType&&a.effectiveTrust&&(b.trust=a.effectiveTrust),b}function bE(a){let b="update_available"===a.status?["update"]:[],c={source:a.source,scope:a.scope};return void 0!==a.installedVersion&&(c.installedVersion=a.installedVersion),void 0!==a.latestVersion&&(c.latestVersion=a.latestVersion),void 0!==a.updatedAt&&(c.updatedAt=a.updatedAt),{id:a.id,assetType:"skill",name:a.name,sub:`Skill \xb7 ${a.source}`,description:a.description??null,flagsJson:JSON.stringify(b),metaJson:JSON.stringify(c),trust:null,toolsJson:null,effectiveTrust:null}}function bF(a){let b="egress"===a.status?["risk"]:"conflict"===a.status?["conflict"]:"unknown"===a.status?["unknown"]:[],c={event:a.event,command:a.command,scope:a.scope,status:a.status};return void 0!==a.matcher&&(c.matcher=a.matcher),void 0!==a.pluginName&&(c.pluginName=a.pluginName),a.warnings.length>0&&(c.warnings=a.warnings),{id:a.id,assetType:"hook",name:bI(a.command.trim(),64),sub:a.matcher?`Hook \xb7 ${a.event} \xb7 ${a.matcher}`:`Hook \xb7 ${a.event}`,description:a.warnings.length>0?a.warnings.join(" \xb7 "):null,flagsJson:JSON.stringify(b),metaJson:JSON.stringify(c),trust:null,toolsJson:null,effectiveTrust:null}}function bG(a){let b={scope:a.scope,transport:a.transport};return void 0!==a.command&&(b.command=a.command),void 0!==a.url&&(b.url=a.url),void 0!==a.envKeys&&(b.envKeys=a.envKeys),void 0!==a.pluginName&&(b.pluginName=a.pluginName),void 0!==a.marketplace&&(b.marketplace=a.marketplace),void 0!==a.project&&(b.project=a.project),{id:a.id,assetType:"mcp",name:a.name,sub:`MCP server \xb7 ${a.transport} \xb7 ${bI(function(a){if(void 0!==a.url)try{return new URL(a.url).host}catch{return a.url}return a.command??a.name}(a),48)}`,description:null,flagsJson:"[]",metaJson:JSON.stringify(b),trust:"unapproved",toolsJson:null,effectiveTrust:a.trust}}function bH(a){let b=a.untracked?["untracked"]:[],c={kind:a.kind,scope:a.scope,path:a.path};return void 0!==a.detail&&(c.detail=a.detail),void 0!==a.entryCount&&(c.entryCount=a.entryCount),void 0!==a.updatedAt&&(c.updatedAt=a.updatedAt),{id:a.id,assetType:"config",name:a.name,sub:a.kind,description:a.detail??null,flagsJson:JSON.stringify(b),metaJson:JSON.stringify(c),trust:null,toolsJson:null,effectiveTrust:null}}function bI(a,b){return a.length>b?`${a.slice(0,b-1)}…`:a}function bJ(a,b,c){let d=al(a.attributes,{});return{id:a.id,name:a.name??"",repo:a.url??"",visibility:d.visibility??"private",language:d.language??"",policyDefault:d.policyDefault??"approved",updatedAt:new Date(a.lastSeen).toISOString(),accessCounts:b,findingsCount:c}}function bK(a){return{path:a.path,name:a.name,origin:a.origin,access:a.effectiveAccess,isCustom:null!==a.overrideAccess&&a.overrideAccess!==a.defaultAccess,findings:a.findingsCount,blockedAt:null!==a.blockedAtMs?new Date(a.blockedAtMs).toISOString():null,note:a.note}}class bL{constructor(a){this.db=a}getInventoryStats(){let a=ad(this.db,"SELECT asset_type AS k, count(*) AS n FROM inventory_asset GROUP BY asset_type"),b={project:0,skill:a.get("skill")??0,mcp:a.get("mcp")??0,hook:a.get("hook")??0,config:a.get("config")??0};b.project=ac(this.db,`SELECT count(*) AS n FROM source_project WHERE ${bw}`);let c=ad(this.db,`SELECT coalesce(o.trust, a.trust) AS k, count(*) AS n
-         FROM inventory_asset a
-         LEFT JOIN mcp_trust_override o ON o.asset_id = a.id
-         WHERE a.asset_type = 'mcp' AND coalesce(o.trust, a.trust) IS NOT NULL
-         GROUP BY coalesce(o.trust, a.trust)`),d={"known-good":c.get("known-good")??0,risky:c.get("risky")??0,unapproved:c.get("unapproved")??0},e=ac(this.db,`SELECT count(*) AS n FROM inventory
-           WHERE object_type = 'harness'
-             AND (last_seen >= :liveSince OR json_extract(attributes, '$.provenance') = 'sample')`,{liveSince:Date.now()-2592e6}),f=ac(this.db,"SELECT count(*) AS n FROM inventory_asset WHERE flags_json <> '[]'"),g=ac(this.db,"SELECT count(DISTINCT project_id) AS n FROM project_file WHERE findings_count > 0"),h=this.configAssetRows();for(let a of h)b[a.assetType]+=1,"mcp"===a.assetType&&a.effectiveTrust&&(d[a.effectiveTrust]+=1);return Promise.resolve({attention:f+g+h.filter(a=>"[]"!==a.flagsJson).length,byType:b,harnesses:e,mcpTrust:d})}listHarnesses(a){let b=this.fetchHarnessRows();if(0===b.length)return Promise.resolve({items:[]});let c=new Map;for(let a of b){let b=bB(al(a.attributes,{}),a);if(!b)continue;let d=c.get(b);d?d.push(a):c.set(b,[a])}let d=this.assetsByHarness(b.map(a=>a.id),a),e=[...new Set(b.flatMap(a=>al(a.attributes,{}).projectIds??[]))],f=this.fetchProjectsByIds(e),g=this.projectAggregates(e),h=this.configAssetRows(a,bC(b)),j=[];for(let[b,e]of c){let c=e.flatMap(a=>d.get(a.id)??[]),k=e.some(a=>"sample"!==al(a.attributes,{}).provenance)&&b===i.tLs.ClaudeCode&&h.length>0?[...c,...h].sort((a,b)=>a.name.localeCompare(b.name)):c;if(a&&0===k.length)continue;let l=e[0];if(!l)continue;let m=al(l.attributes,{}),n=[...new Set(e.flatMap(a=>al(a.attributes,{}).projectIds??[]))].map(a=>f.get(a)).filter(a=>void 0!==a).map(a=>{let b=g.get(a.id)??by;return bJ(a,b.accessCounts,b.findingsCount)}),o=e.reduce((a,b)=>a+(al(b.attributes,{}).sessions??0),0),p=k.reduce((a,b)=>a+al(b.flagsJson,[]).length,0),q=new Map;for(let a of k){let b=q.get(a.assetType);b?b.push(bD(a)):q.set(a.assetType,[bD(a)])}let r=bu.filter(a=>q.has(a)).map(a=>({type:a,assets:q.get(a)??[]}));j.push({id:b,label:m.label??bx[b],kind:m.kind??m.provider??b,version:m.harness_version??l.harnessVersion??"",sessions:o,assetCount:k.length,flagCount:p,projects:n,categories:r})}return Promise.resolve({items:j})}listAssets(a){let b=this.fetchAssets(a.type,a.q);if(0===b.length)return Promise.resolve({groups:[]});let c=new Map;for(let a of b){let b=c.get(a.assetType);b?b.push(a):c.set(a.assetType,[a])}let d=[...c.entries()].map(([a,b])=>{let c=new Map;for(let a of b)for(let b of al(a.flagsJson,[]))c.set(b,(c.get(b)??0)+1);let d={type:a,total:b.length,flagRollup:Object.fromEntries(c),items:b.map(bD)};if("mcp"===a){let a=new Map;for(let c of b)c.effectiveTrust&&a.set(c.effectiveTrust,(a.get(c.effectiveTrust)??0)+1);d.trustRollup=Object.fromEntries(a)}return d});return d.sort((a,b)=>bu.indexOf(a.type)-bu.indexOf(b.type)),Promise.resolve({groups:d})}getAsset(a){let b=this.fetchAssetById(a);return Promise.resolve(b?function(a){let b={id:a.id,type:a.assetType,name:a.name,sub:a.sub??"",flags:al(a.flagsJson,[]),description:a.description??null,trust:"mcp"===a.assetType?a.effectiveTrust??null:null,meta:al(a.metaJson,{}),finding:null};if("mcp"===a.assetType&&null!==a.toolsJson){let c=al(a.toolsJson,[]);b.tools="unapproved"===a.effectiveTrust?c.map(a=>({...a,risk:a.risk??"Tool access blocked: MCP server trust is unapproved."})):c}return b}(b):null)}listProjects(a){let b=this.fetchProjects(a),c=this.projectAggregates(b.map(a=>a.id));return Promise.resolve({items:b.map(a=>{let b=c.get(a.id)??by;return bJ(a,b.accessCounts,b.findingsCount)})})}getProjectTree(a,b){let c=this.fetchProjectById(a);if(!c)return Promise.resolve(null);let d=al(c.attributes,{}),e={id:c.id,repo:c.url??"",visibility:d.visibility??"private"},f=b.path??"";if("blocked"===b.filter){let b=this.fetchProjectFilesBlocked(a);return b.sort((a,b)=>(b.blockedAtMs??0)-(a.blockedAtMs??0)),Promise.resolve({project:e,path:f,files:b.map(bK)})}if(void 0!==b.q&&""!==b.q)return Promise.resolve({project:e,path:f,files:this.fetchProjectFilesSearch(a,b.q).map(bK)});let g=this.fetchProjectFilesUnder(a,f),h=""===f?"":`${f}/`,i=[],j=new Map;for(let a of g){let b=h.length>0?a.path.slice(h.length):a.path,c=b.indexOf("/");if(-1===c)i.push(a);else{let d=b.slice(0,c),e=j.get(d)??[];e.push(a),j.set(d,e)}}let k=[...j.entries()].sort(([a],[b])=>a.localeCompare(b)).map(([a,b])=>({name:a,path:h.length>0?`${f}/${a}`:a,accessCounts:function(a){let b={open:0,approved:0,blocked:0,total:0};for(let c of a)b.total++,b[c.effectiveAccess]++;return b}(b)}));return Promise.resolve({project:e,path:f,folders:k,files:i.map(bK)})}getProjectFile(a,b){let c=this.fetchProjectById(a);if(!c)return Promise.resolve(null);let d=this.fetchProjectFile(a,b);if(!d)return Promise.resolve(null);let e=al(c.attributes,{});return Promise.resolve({...bK(d),project:{repo:c.url??"",visibility:e.visibility??"private",language:e.language??"",policyDefault:e.policyDefault??"approved",updatedAt:new Date(c.lastSeen).toISOString()},findingsRefs:[]})}setFileAccess(a,b,c){let d=this.fetchProjectFile(a,b);return!!d&&(c===d.defaultAccess?this.db.prepare("DELETE FROM file_access_override WHERE project_id = ? AND path = ?").run(a,b):this.db.prepare(`INSERT INTO file_access_override (id, project_id, path, access, created_at, updated_at)
-           VALUES (:id, :projectId, :path, :access, :now, :now)
-           ON CONFLICT (project_id, path) DO UPDATE SET access = excluded.access, updated_at = excluded.updated_at`).run({id:(0,F.randomUUID)(),projectId:a,path:b,access:c,now:Date.now()}),!0)}setMcpTrust(a,b){let c=this.fetchAssetById(a);return c?"mcp"!==c.assetType?"not_mcp":(b===c.trust?this.db.prepare("DELETE FROM mcp_trust_override WHERE asset_id = ?").run(a):this.db.prepare(`INSERT INTO mcp_trust_override (id, asset_id, trust, created_at, updated_at)
-           VALUES (:id, :assetId, :trust, :now, :now)
-           ON CONFLICT (asset_id) DO UPDATE SET trust = excluded.trust, updated_at = excluded.updated_at`).run({id:(0,F.randomUUID)(),assetId:a,trust:b,now:Date.now()}),this.configRowsCache=void 0,"ok"):"not_found"}fetchHarnessRows(){return $(this.db.prepare(`SELECT id, title, attributes, harness_version AS harnessVersion
-         FROM inventory
-         WHERE object_type = 'harness'
-           AND (last_seen >= :liveSince OR json_extract(attributes, '$.provenance') = 'sample')`),{liveSince:Date.now()-2592e6})}assetsByHarness(a,b){let c=new Map;if(0===a.length)return c;let d=[...a],e=`ha.harness_id IN (${R(a.length)})`;if(b){let a=S(b);e+=` AND ${T(["a.name","a.sub"])}`,d.push(a,a)}for(let a of $(this.db.prepare(`SELECT ha.harness_id AS harnessInvId, a.id, a.asset_type AS assetType, a.name, a.sub,
-                a.description, a.flags_json AS flagsJson, a.meta_json AS metaJson, a.trust,
-                a.tools_json AS toolsJson, coalesce(o.trust, a.trust) AS effectiveTrust
-         FROM harness_asset ha
-         JOIN inventory_asset a ON a.id = ha.asset_id
-         LEFT JOIN mcp_trust_override o ON o.asset_id = a.id
-         WHERE ${e}
-         ORDER BY a.name ASC`),d)){let b=a.harnessInvId,[d]=this.mapAssetRows([a]);if(!d)continue;let e=c.get(b);e?e.push(d):c.set(b,[d])}return c}fetchAssets(a,b){let c=[],d=[];if(a&&a.length>0&&(c.push(`a.asset_type IN (${R(a.length)})`),d.push(...a)),b){let a=S(b);c.push(T(["a.name","a.sub"])),d.push(a,a)}let e=c.length?`WHERE ${c.join(" AND ")}`:"",f=this.mapAssetRows($(this.db.prepare(`SELECT a.id, a.asset_type AS assetType, a.name, a.sub, a.description,
-                  a.flags_json AS flagsJson, a.meta_json AS metaJson, a.trust,
-                  a.tools_json AS toolsJson, coalesce(o.trust, a.trust) AS effectiveTrust
-           FROM inventory_asset a
-           LEFT JOIN mcp_trust_override o ON o.asset_id = a.id
-           ${e}
-           ORDER BY a.name ASC`),d)),g=this.configAssetRows(b).filter(b=>!a||0===a.length||a.includes(b.assetType));return g.length>0?[...f,...g].sort((a,b)=>a.name.localeCompare(b.name)):f}fetchAssetById(a){return this.mapAssetRows($(this.db.prepare(`SELECT a.id, a.asset_type AS assetType, a.name, a.sub, a.description,
-                  a.flags_json AS flagsJson, a.meta_json AS metaJson, a.trust,
-                  a.tools_json AS toolsJson, coalesce(o.trust, a.trust) AS effectiveTrust
-           FROM inventory_asset a
-           LEFT JOIN mcp_trust_override o ON o.asset_id = a.id
-           WHERE a.id = ?`),[a]))[0]??this.configAssetRows().find(b=>b.id===a)??null}mapAssetRows(a){return a.map(a=>({id:a.id,assetType:a.assetType,name:a.name,sub:a.sub??null,description:a.description??null,flagsJson:a.flagsJson??"[]",metaJson:a.metaJson??"{}",trust:a.trust??null,toolsJson:a.toolsJson??null,effectiveTrust:a.effectiveTrust??null}))}configAssetRows(a,b){let c=this.liveConfigAssetRows(b);if(!a)return c;let d=a.toLowerCase();return c.filter(a=>a.name.toLowerCase().includes(d)||(a.sub??"").toLowerCase().includes(d))}liveConfigAssetRows(a){if(!(a??bC(this.fetchHarnessRows())))return[];let b=this.latestConfigScanId();if(null===b)return[];if(this.configRowsCache?.scanId===b)return this.configRowsCache.rows;let c=new aI(this.db).report(),d=[...c.skills.map(bE),...c.hooks.map(bF),...c.mcpServers.map(bG),...c.configFiles.map(bH)].sort((a,b)=>a.name.localeCompare(b.name));return this.configRowsCache={scanId:b,rows:d},d}latestConfigScanId(){return aH(this.db)?.id??null}fetchProjects(a){let b=`SELECT id, url, name, attributes, last_seen AS lastSeen FROM source_project
-               WHERE ${bw}`,c=[];if(a){let d=S(a);b+=` AND ${T(["name","url"])}`,c.push(d,d)}return b+=" ORDER BY name ASC",$(this.db.prepare(b),c)}fetchProjectById(a){return _(this.db.prepare("SELECT id, url, name, attributes, last_seen AS lastSeen FROM source_project WHERE id = ?"),[a])??null}fetchProjectsByIds(a){let b=new Map;if(0===a.length)return b;for(let c of $(this.db.prepare(`SELECT id, url, name, attributes, last_seen AS lastSeen
-         FROM source_project WHERE id IN (${R(a.length)})`),a))b.set(c.id,c);return b}projectAggregates(a){let b=new Map;if(0===a.length)return b;for(let c of $(this.db.prepare(`SELECT f.project_id AS projectId,
-                coalesce(o.access, f.default_access) AS eff,
-                count(*) AS n,
-                coalesce(sum(f.findings_count), 0) AS findings
-         FROM project_file f
-         LEFT JOIN file_access_override o ON o.project_id = f.project_id AND o.path = f.path
-         WHERE f.project_id IN (${R(a.length)})
-         GROUP BY f.project_id, eff`),a)){let a=b.get(c.projectId);a||(a={accessCounts:{open:0,approved:0,blocked:0,total:0},findingsCount:0},b.set(c.projectId,a)),a.accessCounts.total+=c.n,a.accessCounts[c.eff]+=c.n,a.findingsCount+=c.findings}return b}fileSelect(a){return`SELECT f.path, f.name, f.origin, f.default_access AS defaultAccess,
-                   f.findings_count AS findingsCount, f.blocked_at AS blockedAtMs, f.note,
-                   coalesce(o.access, f.default_access) AS effectiveAccess,
-                   o.access AS overrideAccess
-            FROM project_file f
-            LEFT JOIN file_access_override o ON o.project_id = f.project_id AND o.path = f.path
-            WHERE ${a}`}mapFileRows(a){return a.map(a=>({path:a.path,name:a.name,origin:a.origin,defaultAccess:a.defaultAccess,findingsCount:a.findingsCount??0,blockedAtMs:a.blockedAtMs??null,note:a.note??null,effectiveAccess:a.effectiveAccess,overrideAccess:a.overrideAccess??null}))}fetchProjectFilesUnder(a,b){return""===b?this.mapFileRows($(this.db.prepare(this.fileSelect("f.project_id = ? ORDER BY f.path ASC")),[a])):this.mapFileRows($(this.db.prepare(this.fileSelect("f.project_id = ? AND f.path LIKE ? ESCAPE '\\' ORDER BY f.path ASC")),[a,`${Q(b)}/%`]))}fetchProjectFilesSearch(a,b){let c=S(b);return this.mapFileRows($(this.db.prepare(this.fileSelect("f.project_id = ? AND (f.path LIKE ? ESCAPE '\\' OR f.name LIKE ? ESCAPE '\\') ORDER BY f.path ASC")),[a,c,c]))}fetchProjectFilesBlocked(a){return this.mapFileRows($(this.db.prepare(this.fileSelect("f.project_id = ? AND coalesce(o.access, f.default_access) = 'blocked' AND f.blocked_at IS NOT NULL")),[a]))}fetchProjectFile(a,b){return this.mapFileRows($(this.db.prepare(this.fileSelect("f.project_id = ? AND f.path = ?")),[a,b]))[0]??null}}class bM{constructor(a){this.db=a}readPolicies(){return Promise.resolve(ae($(this.db.prepare("SELECT * FROM policies")),a=>{let b=JSON.parse(a.target),c=a.custom_keywords?JSON.parse(a.custom_keywords):void 0;return i.PEm.parse({id:a.id,scope:a.scope,target:b,action:a.action,enabled:aa(a.enabled),customKeywords:c})}))}seedDefaults(){if(ac(this.db,"SELECT count(*) AS n FROM policies")>0)return;let a=this.db.prepare(`INSERT INTO policies (id, scope, target, action, enabled, created_at, updated_at)
-       VALUES (:id, 'global', :target, :action, 1, :now, :now)`);W(this.db,()=>{for(let[b,c]of Object.entries(i.unw))a.run({id:(0,F.randomUUID)(),target:JSON.stringify({category:b}),action:c,now:Date.now()})})}upsertCategoryAction(a,b){let c=Date.now();this.db.prepare(`INSERT INTO policies (id, scope, target, action, enabled, created_at, updated_at)
-         VALUES (:id, 'global', :target, :action, 1, :now, :now)
-         ON CONFLICT(scope, target) DO UPDATE SET action = excluded.action, enabled = 1, updated_at = excluded.updated_at`).run({id:(0,F.randomUUID)(),target:JSON.stringify({category:a}),action:b,now:c})}capCategoryActions(){return Number(this.db.prepare(`UPDATE policies SET action='warn', updated_at=:now
-         WHERE scope='global' AND action IN ('block','redact')
-           AND json_extract(target,'$.category') IS NOT NULL`).run({now:Date.now()}).changes)}getCategoryAction(a){let b=this.db.prepare("SELECT action FROM policies WHERE scope='global' AND json_extract(target,'$.category') = :category").get({category:a});return b?.action}}class bN{constructor(a){this.packs=a}getPolicyList(a){if("custom"===a)return Promise.resolve({items:[]});let b=this.packs.countsByPolicyId();return Promise.resolve({items:i.RRF.map(a=>({id:a,kind:"builtin",name:i.ZpU[a].name,enabled:!0,usedByCount:b.get(a)??0}))})}getPolicyStats(){let a=this.packs.countsByPolicyId(),b=i.V0H.reduce((b,c)=>b+(a.get(c)??0),0),c=i.V0H.length;return Promise.resolve({policies:c,builtin:c,custom:0,detectionsGoverned:b})}getPolicyDetail(a){let b=i.V0H.find(b=>b===a);if(void 0===b)return Promise.resolve(null);let c=i.ZpU[b];return Promise.resolve({specVersion:1,id:a,kind:"builtin",name:c.name,enabled:!0,description:c.description,usedBy:this.packs.listByPolicyId(a)})}}class bO{constructor(a){this.db=a,this.maxStampStmt=a.prepare("SELECT coalesce(max(updated_at), 0) AS maxStamp FROM project_file WHERE project_id = :projectId"),this.upsertStmt=a.prepare(`INSERT INTO project_file
-         (id, project_id, path, name, origin, default_access, findings_count, blocked_at, note, created_at, updated_at)
-       VALUES
-         (:id, :projectId, :path, :name, :origin, :defaultAccess, 0, NULL, NULL, :now, :now)
-       ON CONFLICT (project_id, path) DO UPDATE SET
-         name = excluded.name,
-         origin = excluded.origin,
-         default_access = excluded.default_access,
-         updated_at = excluded.updated_at`),this.pruneStmt=a.prepare("DELETE FROM project_file WHERE project_id = :projectId AND updated_at < :now")}replaceForProject(a,b,c){let d=Math.max(c,(_(this.maxStampStmt,{projectId:a})?.maxStamp??0)+1);for(let c of b.files)this.upsertStmt.run({id:(0,F.randomUUID)(),projectId:a,path:c.path,name:c.name,origin:c.origin,defaultAccess:c.defaultAccess,now:d});b.truncated||this.pruneStmt.run({projectId:a,now:d})}}class bP{constructor(a,b=()=>Date.now(),c=()=>(0,F.randomUUID)()){this.db=a,this.now=b,this.newId=c,this.insertStmt=a.prepare(`INSERT INTO finding_resolution (id, finding_key, status, method, resolved_at, evidence, created_at)
-       VALUES (:id, :findingKey, :status, :method, :resolvedAt, :evidence, :createdAt)`),this.latestStmt=a.prepare(`SELECT status, method, resolved_at, evidence
-         FROM finding_resolution
-        WHERE finding_key = :findingKey
-        ORDER BY created_at DESC, rowid DESC
-        LIMIT 1`),this.openAtRestStmt=a.prepare(`SELECT DISTINCT f.finding_key AS finding_key
-         FROM inspection_findings f
-         JOIN audit_events e ON e.id = f.audit_event_id
-        WHERE e.event_type = 'code_change'
-          AND json_extract(e.attributes, '$.file_path') = :path
-          AND f.finding_key IS NOT NULL
-          AND ${aV("f")} IS NOT 'resolved'`),this.resolvedAtRestStmt=a.prepare(`SELECT DISTINCT f.finding_key AS finding_key
-         FROM inspection_findings f
-         JOIN audit_events e ON e.id = f.audit_event_id
-        WHERE e.event_type = 'code_change'
-          AND json_extract(e.attributes, '$.file_path') = :path
-          AND f.finding_key IS NOT NULL
-          AND ${aV("f")} = 'resolved'`)}insertResolution(a){this.insertStmt.run({id:this.newId(),findingKey:a.findingKey,status:i.GCf.parse(a.status),method:i.cqq.parse(a.method),resolvedAt:a.resolvedAt,evidence:a.evidence,createdAt:this.now()})}latestByKey(a){let b=_(this.latestStmt,{findingKey:a});if(b)return{status:b.status,method:b.method,resolvedAt:b.resolved_at,evidence:b.evidence??""}}openAtRestKeysForPath(a){return $(this.openAtRestStmt,{path:a}).map(a=>a.finding_key)}resolvedAtRestKeysForPath(a){return $(this.resolvedAtRestStmt,{path:a}).map(a=>a.finding_key)}}class bQ{constructor(a){this.db=a,this.upsertStmt=a.prepare(`INSERT INTO rule_probe_cache (rule_key, verdict, worst_probe_ms, checked_at)
-       VALUES (:ruleKey, :verdict, :worstProbeMs, :checkedAt)
-       ON CONFLICT (rule_key) DO UPDATE SET
-         verdict = excluded.verdict,
-         worst_probe_ms = excluded.worst_probe_ms,
-         checked_at = excluded.checked_at`),this.readStmt=a.prepare("SELECT verdict, worst_probe_ms AS worstProbeMs FROM rule_probe_cache WHERE rule_key = :ruleKey"),this.countQuarantinedStmt=a.prepare("SELECT COUNT(*) AS n FROM rule_probe_cache WHERE verdict = 'quarantined'"),this.clearQuarantinedStmt=a.prepare("DELETE FROM rule_probe_cache WHERE verdict = 'quarantined'")}getVerdict(a){return _(this.readStmt,{ruleKey:a})}countQuarantined(){return _(this.countQuarantinedStmt,{})?.n??0}clearQuarantined(){let a=this.countQuarantined();return{refused:!W(this.db,()=>{this.clearQuarantinedStmt.run()}),cleared:a-this.countQuarantined()}}setVerdict(a,b,c){W(this.db,()=>{this.upsertStmt.run({ruleKey:a,verdict:b,worstProbeMs:c,checkedAt:Date.now()})})}}class bR{constructor(a){this.db=a,this.upsertStmt=a.prepare(`INSERT INTO scan_ledger (path, mtime, content_hash, ruleset_hash, scanned_at)
-       VALUES (:path, :mtime, :contentHash, :rulesetHash, :scannedAt)
-       ON CONFLICT (path) DO UPDATE SET
-         mtime = excluded.mtime,
-         content_hash = excluded.content_hash,
-         ruleset_hash = excluded.ruleset_hash,
-         scanned_at = excluded.scanned_at`),this.readStmt=a.prepare(`SELECT path, mtime, content_hash AS contentHash
-       FROM scan_ledger WHERE ruleset_hash = :rulesetHash`)}entriesForRuleset(a){return new Map($(this.readStmt,{rulesetHash:a}).map(a=>[a.path,{mtime:a.mtime,contentHash:a.contentHash}]))}upsertEntries(a){if(0===a.length)return;let b=Date.now();W(this.db,()=>{for(let c of a)this.upsertStmt.run({path:c.path,mtime:c.mtime,contentHash:c.contentHash,rulesetHash:c.rulesetHash,scannedAt:b})})}}function bS(a,b){return void 0===a?b:Math.min(Math.max(1,Math.trunc(a)),i.u8Q)}let bT=`(v.occurrence_count > 1
-     OR (SELECT count(*) FROM secret_vault_sighting s WHERE s.pointer_id = v.pointer_id) > 1)`,bU=`v.pointer_id, v.category, v.rule_id, v.masked_match, v.provider,
-          v.occurrence_count, v.first_seen, v.last_seen`,bV=`
-  pointer_id AS pointerId,
-  value_fingerprint AS valueFingerprint,
-  fingerprint_key_version AS fingerprintKeyVersion,
-  key_version AS keyVersion,
-  format_version AS formatVersion,
-  category,
-  rule_id AS ruleId,
-  masked_match AS maskedMatch,
-  provider,
-  ciphertext,
-  nonce,
-  auth_tag AS authTag,
-  user_authorized AS userAuthorized,
-  occurrence_count AS occurrenceCount,
-  first_seen AS firstSeen,
-  last_seen AS lastSeen`;function bW(a){let{provider:b,userAuthorized:c,...d}=a,e={...d,userAuthorized:0!==c};return null===b?e:{...e,provider:b}}class bX{constructor(a){this.db=a,this.insertStmt=a.prepare(`INSERT INTO secret_vault (
-         pointer_id, value_fingerprint, fingerprint_key_version, key_version,
-         format_version, category, rule_id, masked_match, provider,
-         ciphertext, nonce, auth_tag,
-         user_authorized, occurrence_count, first_seen, last_seen
-       ) VALUES (
-         :pointerId, :valueFingerprint, :fingerprintKeyVersion, :keyVersion,
-         :formatVersion, :category, :ruleId, :maskedMatch, :provider,
-         :ciphertext, :nonce, :authTag,
-         :userAuthorized, 1, :now, :now
-       )`),this.bumpStmt=a.prepare(`UPDATE secret_vault
-       SET occurrence_count = occurrence_count + 1, last_seen = :now,
-           user_authorized = max(user_authorized, :userAuthorized)
-       WHERE value_fingerprint = :valueFingerprint`),this.byPointerStmt=a.prepare(`SELECT ${bV} FROM secret_vault WHERE pointer_id = :pointerId`),this.byFingerprintStmt=a.prepare(`SELECT ${bV} FROM secret_vault WHERE value_fingerprint = :valueFingerprint`),this.listStmt=a.prepare(`SELECT ${bV} FROM secret_vault ORDER BY first_seen`),this.replaceCiphertextStmt=a.prepare(`UPDATE secret_vault
-       SET key_version = :keyVersion, ciphertext = :ciphertext, nonce = :nonce, auth_tag = :authTag
-       WHERE pointer_id = :pointerId`),this.refreshFingerprintStmt=a.prepare(`UPDATE secret_vault
-       SET value_fingerprint = :valueFingerprint, fingerprint_key_version = :fingerprintKeyVersion
-       WHERE pointer_id = :pointerId`),this.deleteByPointerStmt=a.prepare("DELETE FROM secret_vault WHERE pointer_id = :pointerId"),this.derefStmt=a.prepare(`INSERT INTO secret_vault_deref (id, pointer_id, at, target, reason, outcome, grant_id, pointer_count)
-       VALUES (:id, :pointerId, :at, :target, :reason, :outcome, :grantId, :pointerCount)`)}upsert(a,b){let c=!1;V(this.db,()=>{if(void 0===_(this.byFingerprintStmt,{valueFingerprint:a.valueFingerprint})){this.insertStmt.run(ab({pointerId:a.pointerId,valueFingerprint:a.valueFingerprint,fingerprintKeyVersion:a.fingerprintKeyVersion,keyVersion:a.keyVersion,formatVersion:a.formatVersion??i.viY,category:a.category,ruleId:a.ruleId,maskedMatch:a.maskedMatch,provider:a.provider,ciphertext:a.ciphertext,nonce:a.nonce,authTag:a.authTag,userAuthorized:+(!0===a.userAuthorized),now:b})),c=!0;return}this.bumpStmt.run({valueFingerprint:a.valueFingerprint,userAuthorized:+(!0===a.userAuthorized),now:b})},"IMMEDIATE");let d=_(this.byFingerprintStmt,{valueFingerprint:a.valueFingerprint});if(void 0===d)throw Error("vault: row vanished immediately after write");return{row:bW(d),minted:c}}byPointerId(a){let b=_(this.byPointerStmt,{pointerId:a});return void 0===b?null:bW(b)}byValueFingerprint(a){let b=_(this.byFingerprintStmt,{valueFingerprint:a});return void 0===b?null:bW(b)}recordDeref(a){this.derefStmt.run(ab({id:a.id,pointerId:a.pointerId,at:a.at,target:a.target,reason:a.reason,outcome:a.outcome,grantId:a.grantId,pointerCount:a.pointerCount??1}))}listAll(){return $(this.listStmt).map(bW)}replaceCiphertext(a,b){this.replaceCiphertextStmt.run({pointerId:a,...b})}refreshFingerprint(a,b){this.refreshFingerprintStmt.run({pointerId:a,...b})}purgeAll(){let a=0;return V(this.db,()=>{a=this.countEntries(),this.db.exec("DELETE FROM secret_vault")},"IMMEDIATE"),a}deleteByPointerIds(a){if(0===a.length)return[];let b=[];return V(this.db,()=>{for(let c of a)Number(this.deleteByPointerStmt.run({pointerId:c}).changes)>0&&b.push(c)},"IMMEDIATE"),b}recordSighting(a,b){this.db.prepare(`INSERT INTO secret_vault_sighting (id, pointer_id, location, kind, first_seen, last_seen)
-         VALUES (:id, :pointerId, :location, :kind, :now, :now)
-         ON CONFLICT (pointer_id, location) DO UPDATE SET last_seen = :now`).run({id:(0,F.randomUUID)(),pointerId:a.pointerId,location:a.location,kind:a.kind,now:b})}sightingsFor(a){let b=new Map(a.map(a=>[a,[]]));if(0===a.length)return b;for(let c of $(this.db.prepare(`SELECT pointer_id, location, kind, first_seen, last_seen
-           FROM secret_vault_sighting
-          WHERE pointer_id IN (${R(a.length)})
-          ORDER BY last_seen DESC`),a))b.get(c.pointer_id)?.push({location:c.location,kind:c.kind,firstSeen:new Date(c.first_seen).toISOString(),lastSeen:new Date(c.last_seen).toISOString()});return b}toInventoryEntries(a){let b=this.sightingsFor(a.map(a=>a.pointer_id));return a.map(a=>({pointerId:a.pointer_id,category:a.category,...null===a.provider?{}:{provider:a.provider},maskedMatch:a.masked_match,occurrences:a.occurrence_count,firstSeen:new Date(a.first_seen).toISOString(),lastSeen:new Date(a.last_seen).toISOString(),revealGrantId:a.grant_id,sightings:b.get(a.pointer_id)??[]}))}listInventory(a={},b=Date.now()){let c=bS(a.limit,i.mBk),d=void 0===a.cursor?null:ao(a.cursor),e=null===d?"":"WHERE (v.last_seen < :cursorLastSeen OR (v.last_seen = :cursorLastSeen AND v.pointer_id < :cursorPointerId))",f=$(this.db.prepare(`SELECT ${bU},
-                (SELECT e.id FROM exceptions e
-                  WHERE e.rule_id = v.rule_id
-                    AND e.value_fingerprint = v.value_fingerprint
-                    AND e.key_version = v.fingerprint_key_version
-                    AND ${aS}
-                  LIMIT 1) AS grant_id
-           FROM secret_vault v
-           ${e}
-          ORDER BY v.last_seen DESC, v.pointer_id DESC
-          LIMIT :limit`),ab({now:b,limit:c+1,...null===d?{}:{cursorLastSeen:d.startedAtMs,cursorPointerId:d.id}})),g=f.length>c,h=g?f.slice(0,c):f,j=h[h.length-1];return{totals:{values:this.countEntries()},items:this.toInventoryEntries(h),nextCursor:g&&j?an({startedAtMs:j.last_seen,id:j.pointer_id}):null}}listReuse(a={},b=Date.now()){var c;let d=bS(a.limit,i.mBk),e=void 0===a.cursor?null:function(a){let b=am(Buffer.from(a,"base64url").toString("utf8"));return void 0!==b&&Number.isInteger(b.occurrences)&&"string"==typeof b.pointerId?{occurrences:b.occurrences,pointerId:b.pointerId}:null}(a.cursor),f=null===e?"":`AND (v.occurrence_count < :cursorOccurrences
-              OR (v.occurrence_count = :cursorOccurrences AND v.pointer_id < :cursorPointerId))`,g=$(this.db.prepare(`SELECT ${bU},
-                (SELECT e.id FROM exceptions e
-                  WHERE e.rule_id = v.rule_id
-                    AND e.value_fingerprint = v.value_fingerprint
-                    AND e.key_version = v.fingerprint_key_version
-                    AND ${aS}
-                  LIMIT 1) AS grant_id
-           FROM secret_vault v
-          WHERE ${bT} ${f}
-          ORDER BY v.occurrence_count DESC, v.pointer_id DESC
-          LIMIT :limit`),ab({now:b,limit:d+1,...null===e?{}:{cursorOccurrences:e.occurrences,cursorPointerId:e.pointerId}})),h=g.length>d,j=h?g.slice(0,d):g,k=j[j.length-1];return{totals:{reused:this.countReused()},items:this.toInventoryEntries(j),nextCursor:h&&k?(c={occurrences:k.occurrence_count,pointerId:k.pointer_id},Buffer.from(JSON.stringify(c)).toString("base64url")):null}}listDerefs(a={}){let b=bS(a.limit,i.hdu),c=void 0===a.cursor?null:ao(a.cursor),d=[];!0!==a.includeBatched&&d.push("reason NOT IN ('display', 'view-render')"),null!==c&&d.push("(at < :cursorAt OR (at = :cursorAt AND id < :cursorId))");let e=0===d.length?"":`WHERE ${d.join(" AND ")}`,f=$(this.db.prepare(`SELECT id, pointer_id, at, target, reason, outcome, grant_id, pointer_count
-           FROM secret_vault_deref ${e}
-          ORDER BY at DESC, id DESC LIMIT :limit`),ab({limit:b+1,...null===c?{}:{cursorAt:c.startedAtMs,cursorId:c.id}})),g=f.length>b,h=g?f.slice(0,b):f,j=h[h.length-1],k=!0===a.includeBatched?0:ac(this.db,"SELECT count(*) AS n FROM secret_vault_deref WHERE reason IN ('display', 'view-render')");return{items:h.map(a=>({id:a.id,pointerId:a.pointer_id,at:new Date(a.at).toISOString(),target:a.target,reason:a.reason,outcome:a.outcome,...null===a.grant_id?{}:{grantId:a.grant_id},pointerCount:a.pointer_count})),nextCursor:g&&j?an({startedAtMs:j.at,id:j.id}):null,hiddenBatched:k}}countEntries(){return ac(this.db,"SELECT COUNT(*) AS n FROM secret_vault")}countReused(){return ac(this.db,`SELECT COUNT(*) AS n FROM secret_vault v WHERE ${bT}`)}}let bY=["critical","high","medium","low"],bZ={block:"blocked",redact:"redacted",warn:"warned"},b$=["blocked","redacted","warned"],b_={[i.tLs.Antigravity]:{coverage:60,supported:!0},[i.tLs.Api]:{coverage:0,supported:!1},[i.tLs.ChatGpt]:{coverage:40,supported:!0},[i.tLs.ClaudeAi]:{coverage:40,supported:!0},[i.tLs.ClaudeCode]:{coverage:100,supported:!0},[i.tLs.Codex]:{coverage:80,supported:!0},[i.tLs.Copilot]:{coverage:0,supported:!1},[i.tLs.Cursor]:{coverage:0,supported:!1}},b0={"7d":"day","30d":"day","3m":"week","6m":"week"};function b1(a){return 864e5*Math.floor(a/864e5)}function b2(a){return new Date(a).toISOString().slice(0,10)}class b3{constructor(a,b=()=>Date.now()){this.db=a,this.now=b}severitySummary(){let a=new Map($(this.db.prepare(`SELECT d.severity AS severity,
-                COUNT(*) AS count,
-                SUM(CASE
-                      WHEN e.event_type != 'code_change' THEN 1
-                      WHEN f.finding_key IS NULL THEN 0
-                      WHEN latest.status = 'resolved' THEN 1
-                      ELSE 0
-                    END) AS caught,
-                SUM(CASE
-                      WHEN e.event_type = 'code_change'
-                       AND f.finding_key IS NOT NULL
-                       AND (latest.status IS NULL OR latest.status != 'resolved') THEN 1
-                      ELSE 0
-                    END) AS open_at_rest
-         FROM inspection_findings f
-         JOIN audit_events e ON e.id = f.audit_event_id
-         JOIN inspection_definitions d ON d.id = f.inspection_definition_id
-         LEFT JOIN ${aW} latest
-           ON latest.finding_key = f.finding_key
-         WHERE e.event_type IN (${i.hfB})
-         GROUP BY d.severity`)).map(a=>[a.severity,a])),b=bY.map(b=>({severity:b,count:a.get(b)?.count??0,caught:a.get(b)?.caught??0,openAtRest:a.get(b)?.open_at_rest??0}));return Promise.resolve({total:b.reduce((a,b)=>a+b.count,0),needsRemediation:b.reduce((a,b)=>a+b.openAtRest,0),bySeverity:b})}scanCoverage(a){return Promise.resolve({range:a,providers:i.KqW.options.map(a=>({provider:a,...b_[a]}))})}enforcementActions(a){let b=864e5*i.eI7[a],c=this.now(),d=c-b,e=this.findingsInRange(c-2*b,c),f={blocked:0,redacted:0,warned:0},g={blocked:0,redacted:0,warned:0};for(let a of e){let b=bZ[a.actionTaken];b&&(a.occurredAt>=d?f[b]++:g[b]++)}let h=b$.map(a=>({kind:a,count:f[a],delta:f[a]-g[a]}));return Promise.resolve({range:a,total:h.reduce((a,b)=>a+b.count,0),actions:h})}findingsTimeseries(a){let b=b0[a],c=("day"===b?1:7)*864e5,d=i.eI7[a],e="day"===b?d:Math.ceil(d/7),f=this.now(),g=b1(f)-(d-1)*864e5,h=this.findingsInRange(g,f),j=Array.from({length:e},(a,b)=>({timestamp:b2(g+b*c),critical:0,high:0,medium:0,low:0}));for(let a of h){let b=j[Math.floor((a.occurredAt-g)/c)];if(b){var k;("critical"===(k=a.severity)||"high"===k||"medium"===k||"low"===k)&&b[a.severity]++}}return Promise.resolve({range:a,granularity:b,points:j})}mttrTrend(a){let b=b0[a],c=("day"===b?1:7)*864e5,d=i.eI7[a],e="day"===b?d:Math.ceil(d/7),f=this.now(),g=b1(f)-(d-1)*864e5,h=$(this.db.prepare(`SELECT DISTINCT f.finding_key AS finding_key,
-                COALESCE(f.first_detected_at, e.started_at) AS first_detected_at, d.severity AS severity,
-                latest.status AS latest_status,
-                latest.method AS latest_method,
-                latest.resolved_at AS latest_resolved_at
-         FROM finding_resolution fr
-         CROSS JOIN inspection_findings f ON f.finding_key = fr.finding_key
-         CROSS JOIN audit_events e ON e.id = f.audit_event_id
-         CROSS JOIN inspection_definitions d ON d.id = f.inspection_definition_id
-         LEFT JOIN ${aW} latest
-           ON latest.finding_key = f.finding_key
-         WHERE fr.resolved_at >= :windowStart
-           AND e.event_type IN (${i.hfB})`),{windowStart:g}),j=new Map,k=new Map;for(let a of h){if("resolved"!==a.latest_status||"fixed-at-source"!==a.latest_method||null==a.latest_resolved_at||a.latest_resolved_at<g||a.latest_resolved_at>=f)continue;let b=Math.floor((a.latest_resolved_at-g)/c);if(b<0||b>=e)continue;let d=`${String(b)}:${a.severity}`,h=Math.max(0,a.latest_resolved_at-a.first_detected_at);j.set(d,(j.get(d)??0)+h),k.set(d,(k.get(d)??0)+1)}return Promise.resolve({range:a,granularity:b,points:Array.from({length:e},(a,b)=>{let d={};for(let a of bY){let c=`${String(b)}:${a}`,e=k.get(c)??0;d[a]=e>0?(j.get(c)??0)/e:null}return{timestamp:b2(g+b*c),bySeverity:d}})})}topSources(a,b={}){let c=b.limit??5;if("user"===b.kind)return Promise.resolve({range:a,items:[]});let d=this.now(),e=d-864e5*i.eI7[a];return Promise.resolve({range:a,items:$(this.db.prepare(`SELECT e.repo AS repo, count(*) AS c
-         FROM inspection_findings f
-         JOIN audit_events e ON e.id = f.audit_event_id
-         WHERE e.started_at >= :from AND e.started_at < :to
-           AND e.event_type IN (${i.hfB})
-           AND e.repo IS NOT NULL
-           AND e.repo != ''
-         GROUP BY e.repo
-         ORDER BY c DESC, e.repo
-         LIMIT :limit`),{from:e,to:d,limit:c}).map(a=>({id:`repo_${a.repo}`,name:a.repo,kind:"repo",findingsCount:a.c}))})}recentlyResolved(a=20){return Promise.resolve({items:$(this.db.prepare(`SELECT f.finding_key AS finding_key,
-                d.rule_id AS rule_id,
-                d.severity AS severity,
-                e.repo AS repo,
-                e.file_path AS path,
-                COALESCE(f.first_detected_at, e.started_at) AS first_detected_at,
-                latest.resolved_at AS latest_resolved_at
-         FROM ${aW} latest
-         CROSS JOIN inspection_findings f ON f.finding_key = latest.finding_key
-         CROSS JOIN audit_events e ON e.id = f.audit_event_id
-         CROSS JOIN inspection_definitions d ON d.id = f.inspection_definition_id
-         WHERE latest.status = 'resolved'
-           AND latest.method = 'fixed-at-source'
-           AND latest.resolved_at IS NOT NULL
-           AND e.event_type = 'code_change'
-         ORDER BY latest.resolved_at DESC
-         LIMIT :limit`),{limit:a}).map(a=>({findingKey:a.finding_key,ruleId:a.rule_id,repo:a.repo??"",severity:a.severity,path:a.path??"",resolvedAt:new Date(a.latest_resolved_at).toISOString(),detectedAt:new Date(a.first_detected_at).toISOString()}))})}recommendationInputs(){return Promise.resolve($(this.db.prepare(`SELECT d.rule_id AS rule_id,
-                d.category AS category,
-                d.severity AS severity,
-                COUNT(*) AS count
-         FROM inspection_findings f
-         JOIN audit_events e ON e.id = f.audit_event_id
-         JOIN inspection_definitions d ON d.id = f.inspection_definition_id
-         LEFT JOIN ${aW} latest
-           ON latest.finding_key = f.finding_key
-         WHERE e.event_type IN (${i.hfB})
-           AND e.event_type = 'code_change'
-           AND (
-             f.finding_key IS NULL
-             OR latest.status IS NULL
-             OR latest.status NOT IN ('resolved', 'dismissed')
-           )
-         GROUP BY d.rule_id, d.category, d.severity`)).map(a=>({ruleId:a.rule_id,category:a.category,severity:a.severity,count:a.count})))}findingsInRange(a,b){return $(this.db.prepare(`SELECT e.started_at AS occurred_at, d.severity AS severity, f.action_taken AS action_taken,
-                d.rule_id AS rule_id, d.category AS category
-         FROM inspection_findings f
-         JOIN audit_events e ON e.id = f.audit_event_id
-         JOIN inspection_definitions d ON d.id = f.inspection_definition_id
-         WHERE e.started_at >= :from AND e.started_at < :to
-           AND e.event_type IN (${i.hfB})
-         ORDER BY e.started_at`),{from:a,to:b}).map(a=>({occurredAt:a.occurred_at,severity:a.severity,actionTaken:a.action_taken,ruleId:a.rule_id,category:a.category}))}}let b4=["provider","internal","external","ip"],b5="('http', 'ws')",b6=`LEFT JOIN egress_decision_override oh ON oh.host = d.host
-             LEFT JOIN egress_decision_override ol ON ol.destination_id = d.id AND ol.host IS NULL`;function b7(a,b){if(a.length<=5e3)return{hits:[...a],droppedFiles:[],truncated:!1};if("walk"===b)return{hits:a.slice(0,5e3),droppedFiles:[],truncated:!0};let c=new Map;for(let b of a){let a=c.get(b.site.file);void 0===a?c.set(b.site.file,[b]):a.push(b)}let d=[],e=[];for(let[a,b]of c)d.length+b.length>5e3?e.push(a):d.push(...b);return{hits:d,droppedFiles:e,truncated:!0}}function b8(a,b){if("walk"===a.mode||0===b.length)return a;let c=new Set(b);return{mode:"ledger",scannedFiles:a.scannedFiles.filter(a=>!c.has(a)),deletedFiles:a.deletedFiles.filter(a=>!c.has(a))}}function b9(a){return{id:a.id,method:a.method,transport:a.transport,url:a.url,template:a.template,dataClass:a.dataClass,lastSeen:new Date(a.lastSeenMs).toISOString(),callSiteCount:a.callSiteCount}}function ca(a,b){let c=b.map(a=>a.transport),d=b.map(a=>a.dataClass),e=b.reduce((a,b)=>a+b.callSiteCount,0),f=b.length>0?Math.max(...b.map(a=>a.lastSeenMs)):a.lastSeenMs;return{id:a.id,kind:a.kind,name:a.name,host:a.host,category:a.category,trust:a.trust,status:(0,i.Gw9)(a.trust,a.overrideDecision),isCustom:(0,i.y_0)(a.trust,a.overrideDecision),lastSeen:new Date(f).toISOString(),endpointCount:b.length,callSiteCount:e,transports:(0,i.by7)(c),dataClasses:(0,i.hzO)(d),review:(0,i.Fnc)(a.trust,c,null!==a.overrideDecision),network:"provider"===a.kind?null:al(a.networkJson,null),endpoints:b.map(b9)}}class cb{constructor(a){this.db=a}stats(){let a=ac(this.db,"SELECT count(*) AS n FROM share_destination"),b=ac(this.db,"SELECT count(*) AS n FROM share_endpoint"),c=ac(this.db,"SELECT count(*) AS n FROM share_call_site"),d=ac(this.db,`SELECT count(DISTINCT destination_id) AS n FROM share_endpoint
-       WHERE transport IN ${b5}`),e=ac(this.db,`SELECT count(DISTINCT d.id) AS n
-       FROM share_destination d
-       LEFT JOIN share_endpoint e ON e.destination_id = d.id
-         AND e.transport IN ${b5}
-       WHERE (d.trust IN ('unverified', 'ip') OR e.id IS NOT NULL)
-         AND NOT EXISTS (
-           SELECT 1 FROM egress_decision_override o
-           WHERE o.host = d.host OR (o.destination_id = d.id AND o.host IS NULL)
-         )`),f=ad(this.db,"SELECT kind AS k, count(*) AS n FROM share_destination GROUP BY kind"),g={provider:f.get("provider")??0,internal:f.get("internal")??0,external:f.get("external")??0,ip:f.get("ip")??0},h=ad(this.db,"SELECT trust AS k, count(*) AS n FROM share_destination GROUP BY trust");return Promise.resolve({destinations:a,endpoints:b,callSites:c,needsReview:e,insecure:d,byKind:g,byTrust:{recognized:h.get("recognized")??0,internal:h.get("internal")??0,unverified:h.get("unverified")??0,ip:h.get("ip")??0}})}listDestinations(a){let b=void 0===a.q||""===a.q?void 0:a.q,c=this.fetchDestinations(b,a.kind),d=this.groupEndpoints(c.map(a=>a.id)),e=c.map(a=>ca(a,d.get(a.id)??[])),f=new Map;for(let a of e){let b=f.get(a.kind);b?b.push(a):f.set(a.kind,[a])}return Promise.resolve({groups:b4.filter(a=>f.has(a)).map(a=>{let b=f.get(a)??[];return{kind:a,total:b.length,items:b}})})}needsReview(){let a=this.fetchDestinations(void 0,void 0,!0),b=this.groupEndpoints(a.map(a=>a.id));return Promise.resolve({items:a.map(a=>({dest:a,endpoints:b.get(a.id)??[]})).map(({dest:a,endpoints:b})=>({summary:ca(a,b),endpoints:b})).filter(({summary:a})=>a.review.needsReview).map(({summary:a,endpoints:b})=>({id:a.id,kind:a.kind,name:a.name,host:a.host,trust:a.trust,status:a.status,review:a.review,topDataClass:(0,i.C05)(b.map(a=>a.dataClass)),callSiteCount:a.callSiteCount,lastSeen:a.lastSeen})).sort((a,b)=>{let c=(0,i.WSs)(a.review.reasons)-(0,i.WSs)(b.review.reasons);return 0!==c?c:b.lastSeen.localeCompare(a.lastSeen)})})}getDestination(a){let b=this.fetchDestinationById(a);if(!b)return Promise.resolve(null);let c=this.fetchEndpoints([b.id]),d=this.fetchCallSites(c.map(a=>a.id));return Promise.resolve(function(a,b,c){let d=b.map(a=>a.transport),e=b.length>0?Math.max(...b.map(a=>a.lastSeenMs)):a.lastSeenMs,f=new Map;for(let a of c.slice(0,200)){let b={id:a.id,project:a.project,file:a.file,line:a.line,snippet:a.snippet,dynamic:a.dynamic,vendored:a.vendored,projectId:a.projectId},c=f.get(a.endpointId);c?c.push(b):f.set(a.endpointId,[b])}return{id:a.id,kind:a.kind,name:a.name,host:a.host,category:a.category,trust:a.trust,status:(0,i.Gw9)(a.trust,a.overrideDecision),isCustom:(0,i.y_0)(a.trust,a.overrideDecision),lastSeen:new Date(e).toISOString(),transports:(0,i.by7)(d),dataClasses:(0,i.hzO)(b.map(a=>a.dataClass)),review:(0,i.Fnc)(a.trust,d,null!==a.overrideDecision),network:"provider"===a.kind?null:al(a.networkJson,null),note:a.note,endpoints:b.map(a=>({...b9(a),sites:f.get(a.id)??[]}))}}(b,c,d))}setEgressDecision(a,b){let c=!1;return V(this.db,()=>{let d=this.db.prepare("SELECT host FROM share_destination WHERE id = ?").get(a);void 0!==d&&(c=!0,this.db.prepare(`DELETE FROM egress_decision_override
-             WHERE host = :host OR (destination_id = :destinationId AND host IS NULL)`).run({host:d.host,destinationId:a}),null!==b&&this.db.prepare(`INSERT INTO egress_decision_override
-               (id, destination_id, host, decision, created_at, updated_at)
-             VALUES (:id, :destinationId, :host, :decision, :now, :now)`).run({id:(0,F.randomUUID)(),destinationId:a,host:d.host,decision:b,now:Date.now()}))},"IMMEDIATE"),c}recordProjectEgress(a){let{hits:b,droppedFiles:c,truncated:d}=b7(a.hits,a.reconcile.mode),e=b8(a.reconcile,c),f=Date.now(),g={destinations:0,endpoints:0,callSites:0,truncated:d,droppedFiles:c};return V(this.db,()=>{let h=a.projectId??this.knownProjectId(a.projectKey);this.reconcileCallSites(a.projectKey,e),this.upsertHits(a,b,h,f),this.confirmLastSeen(a.projectKey,f),this.pruneOrphans(),g={...this.projectTotals(a.projectKey),truncated:d,droppedFiles:c}},"IMMEDIATE"),g}reconcileCallSites(a,b){if("walk"===b.mode){let c=b.walkedPrefix.replace(/\/+$/,"");this.db.prepare(`DELETE FROM share_call_site
-           WHERE project_key = :key
-             AND (:prefix = '' OR file = :prefix OR file LIKE :subtree ESCAPE '\\')
-             AND file NOT LIKE '.%'
-             AND file NOT LIKE '%/.%'`).run({key:a,prefix:c,subtree:`${Q(c)}/%`});return}let c=[...new Set([...b.scannedFiles,...b.deletedFiles])];for(let b=0;b<c.length;b+=500){let d=c.slice(b,b+500);this.db.prepare(`DELETE FROM share_call_site
-           WHERE project_key = ? AND file IN (${R(d.length)})`).run(a,...d)}}upsertHits(a,b,c,d){if(0===b.length)return;let e=this.db.prepare(`INSERT INTO share_destination
-         (id, kind, name, host, category, trust, network_json, last_seen, provenance,
-          created_at, updated_at)
-       VALUES (:id, :kind, :name, :host, :category, :trust, :networkJson, :now, 'scan', :now, :now)
-       ON CONFLICT (host) DO UPDATE SET
-         kind = excluded.kind,
-         name = excluded.name,
-         category = excluded.category,
-         trust = excluded.trust,
-         network_json = excluded.network_json,
-         last_seen = excluded.last_seen,
-         updated_at = excluded.updated_at`),f=this.db.prepare("SELECT id FROM share_destination WHERE host = ?"),g=this.db.prepare(`INSERT INTO share_endpoint
-         (id, destination_id, method, transport, url, template, data_class, last_seen,
-          created_at, updated_at)
-       VALUES (:id, :destinationId, :method, :transport, :url, :template, :dataClass, :now,
-               :now, :now)
-       ON CONFLICT (destination_id, method, url) DO UPDATE SET
-         transport = excluded.transport,
-         template = excluded.template,
-         data_class = excluded.data_class,
-         last_seen = excluded.last_seen,
-         updated_at = excluded.updated_at`),h=this.db.prepare("SELECT id FROM share_endpoint WHERE destination_id = ? AND method = ? AND url = ?"),i=this.db.prepare(`INSERT INTO share_call_site
-         (id, endpoint_id, project, project_key, file, line, snippet, dynamic, vendored,
-          project_id, created_at, updated_at)
-       VALUES (:id, :endpointId, :project, :projectKey, :file, :line, :snippet, :dynamic,
-               :vendored, :projectId, :now, :now)
-       ON CONFLICT (endpoint_id, project_key, file, line) DO UPDATE SET
-         snippet = excluded.snippet,
-         dynamic = excluded.dynamic,
-         vendored = excluded.vendored,
-         project = excluded.project,
-         project_id = COALESCE(excluded.project_id, share_call_site.project_id),
-         updated_at = excluded.updated_at`),j=new Map,k=new Map;for(let l of b){let b=j.get(l.host);void 0===b&&(e.run({id:(0,F.randomUUID)(),kind:l.kind,name:l.name,host:l.host,category:l.category,trust:l.trust,networkJson:null===l.network?null:JSON.stringify(l.network),now:d}),b=_(f,[l.host])?.id??"",j.set(l.host,b));let m=`${b}\0${l.method}\0${l.url}`,n=k.get(m);void 0===n&&(g.run({id:(0,F.randomUUID)(),destinationId:b,method:l.method,transport:l.transport,url:l.url,template:+!!l.template,dataClass:l.dataClass,now:d}),n=_(h,[b,l.method,l.url])?.id??"",k.set(m,n)),i.run({id:(0,F.randomUUID)(),endpointId:n,project:a.project,projectKey:a.projectKey,file:l.site.file,line:l.site.line,snippet:l.site.snippet,dynamic:+!!l.site.dynamic,vendored:+!!l.site.vendored,projectId:c,now:d})}}knownProjectId(a){return _(this.db.prepare(`SELECT project_id AS projectId FROM share_call_site
-           WHERE project_key = ? AND project_id IS NOT NULL LIMIT 1`),[a])?.projectId??null}confirmLastSeen(a,b){this.db.prepare(`UPDATE share_endpoint SET last_seen = :now, updated_at = :now
-         WHERE id IN (SELECT DISTINCT endpoint_id FROM share_call_site WHERE project_key = :key)`).run({now:b,key:a}),this.db.prepare(`UPDATE share_destination SET last_seen = :now, updated_at = :now
-         WHERE id IN (SELECT DISTINCT e.destination_id
-                      FROM share_endpoint e
-                      JOIN share_call_site c ON c.endpoint_id = e.id
-                      WHERE c.project_key = :key)`).run({now:b,key:a})}pruneOrphans(){this.db.exec(`DELETE FROM share_endpoint
-       WHERE NOT EXISTS (SELECT 1 FROM share_call_site c WHERE c.endpoint_id = share_endpoint.id)`),this.db.exec(`DELETE FROM egress_decision_override
-       WHERE host IS NULL
-         AND destination_id IN (
-           SELECT d.id FROM share_destination d
-           WHERE NOT EXISTS (SELECT 1 FROM share_endpoint e WHERE e.destination_id = d.id))`),this.db.exec(`DELETE FROM share_destination
-       WHERE NOT EXISTS (
-         SELECT 1 FROM share_endpoint e WHERE e.destination_id = share_destination.id)`)}projectTotals(a){return{destinations:ac(this.db,`SELECT count(DISTINCT e.destination_id) AS n
-         FROM share_endpoint e
-         JOIN share_call_site c ON c.endpoint_id = e.id
-         WHERE c.project_key = ?`,[a]),endpoints:ac(this.db,"SELECT count(DISTINCT endpoint_id) AS n FROM share_call_site WHERE project_key = ?",[a]),callSites:ac(this.db,"SELECT count(*) AS n FROM share_call_site WHERE project_key = ?",[a])}}mapDestRow(a){return{id:a.id,kind:a.kind,name:a.name,host:a.host,category:a.category,trust:a.trust,note:a.note,networkJson:a.networkJson,lastSeenMs:a.lastSeenMs,overrideDecision:a.overrideDecision??null}}fetchDestinations(a,b,c=!1){let d,e=`d.id, d.kind, d.name, d.host, d.category, d.trust, d.note,
-                  d.network_json AS networkJson, d.last_seen AS lastSeenMs,
-                  d.created_at AS createdAt,
-                  COALESCE(oh.decision, ol.decision) AS overrideDecision`,f=[],g=[];if(b&&b.length>0&&(f.push(`d.kind IN (${R(b.length)})`),g.push(...b)),c&&f.push(`(d.trust IN ('unverified', 'ip')
-          OR EXISTS (SELECT 1 FROM share_endpoint re
-                     WHERE re.destination_id = d.id
-                       AND re.transport IN ${b5}))`),a){let b=S(a);f.push(`(d.name LIKE ? ESCAPE '\\' OR d.category LIKE ? ESCAPE '\\' OR e.url LIKE ? ESCAPE '\\'
-          OR c.project LIKE ? ESCAPE '\\' OR c.file LIKE ? ESCAPE '\\')`),g.push(b,b,b,b,b),d=`SELECT DISTINCT ${e}
-             FROM share_destination d
-             ${b6}
-             LEFT JOIN share_endpoint e ON e.destination_id = d.id
-             LEFT JOIN share_call_site c ON c.endpoint_id = e.id
-             ${f.length?`WHERE ${f.join(" AND ")}`:""}
-             ORDER BY d.created_at ASC, d.id ASC`}else d=`SELECT ${e}
-             FROM share_destination d
-             ${b6}
-             ${f.length?`WHERE ${f.join(" AND ")}`:""}
-             ORDER BY d.created_at ASC, d.id ASC`;return $(this.db.prepare(d),g).map(a=>this.mapDestRow(a))}fetchDestinationById(a){let b=_(this.db.prepare(`SELECT d.id, d.kind, d.name, d.host, d.category, d.trust, d.note,
-                d.network_json AS networkJson, d.last_seen AS lastSeenMs,
-                COALESCE(oh.decision, ol.decision) AS overrideDecision
-         FROM share_destination d
-         ${b6}
-         WHERE d.id = ?`),[a]);return b?this.mapDestRow(b):null}fetchEndpoints(a){return 0===a.length?[]:$(this.db.prepare(`SELECT e.id, e.destination_id AS destinationId, e.method, e.transport, e.url,
-                e.template, e.data_class AS dataClass, e.last_seen AS lastSeenMs,
-                count(c.id) AS callSiteCount
-         FROM share_endpoint e
-         LEFT JOIN share_call_site c ON c.endpoint_id = e.id
-         WHERE e.destination_id IN (${R(a.length)})
-         GROUP BY e.id
-         ORDER BY e.created_at ASC, e.id ASC`),a).map(a=>({id:a.id,destinationId:a.destinationId,method:a.method,transport:a.transport,url:a.url,template:1===a.template,dataClass:a.dataClass,lastSeenMs:a.lastSeenMs,callSiteCount:a.callSiteCount}))}groupEndpoints(a){let b=new Map;for(let c of this.fetchEndpoints(a)){let a=b.get(c.destinationId);a?a.push(c):b.set(c.destinationId,[c])}return b}fetchCallSites(a){return 0===a.length?[]:$(this.db.prepare(`SELECT id, endpoint_id AS endpointId, project, file, line, snippet, dynamic, vendored,
-                project_id AS projectId
-         FROM share_call_site
-         WHERE endpoint_id IN (${R(a.length)})
-         ORDER BY created_at ASC, id ASC`),a).map(a=>({id:a.id,endpointId:a.endpointId,project:a.project,file:a.file,line:a.line,snippet:a.snippet,dynamic:1===a.dynamic,vendored:1===a.vendored,projectId:a.projectId}))}}class cc{constructor(a){this.db=a,this.upsertStmt=a.prepare(`INSERT INTO source_project
-         (id, url, name, attributes, first_seen, last_seen)
-       VALUES
-         (:id, :url, :name, :attributes, :firstSeen, :lastSeen)
-       ON CONFLICT(id) DO UPDATE SET
-         url = excluded.url,
-         name = excluded.name,
-         attributes = excluded.attributes,
-         last_seen = excluded.last_seen`)}upsert(a,b=Date.now()){let c=I(a.url),d=(0,i.QCA)(a,c,b);return this.upsertStmt.run(ab({id:d.id,url:d.url,name:d.name,attributes:d.attributes,firstSeen:d.firstSeen,lastSeen:d.lastSeen})),c}findById(a){return _(this.db.prepare("SELECT * FROM source_project WHERE id = :id"),{id:a})}distinctNames(){return $(this.db.prepare(`SELECT DISTINCT name FROM source_project
-         WHERE name IS NOT NULL
-         ORDER BY name`)).map(a=>a.name)}}let cd=new Set(i.ZYZ.options),ce=Symbol("aka.persistence.unsafeTestOnlyRawHandle");function cf(a,b){return b?{...a,hostId:b}:a}function cg(a){try{a.close()}catch{}}function ch(a){let b=new G.DatabaseSync(a);try{b.exec("PRAGMA journal_mode = WAL"),b.exec("PRAGMA busy_timeout = 2000"),b.exec("PRAGMA foreign_keys = ON")}catch(a){throw cg(b),a}return b}function ci(a){o(a);let b=(0,e.join)(a,k);O(b);let{db:c,events:f,findings:g,policies:h,installedPacks:j,scanLedger:l,historySync:m,secretVault:n,exceptions:q,resolutions:s,ruleProbeCache:t,security:u,detections:v,shares:w,policyCatalog:x,inventory:y,inventoryAssets:z,projectFiles:A,activity:B,sourceProject:C,auditEvents:D,classifiedData:E,inspectionDefinitions:G,inspectionFindings:L,configInventory:M}=function(a,b){let c=ch(a);try{var e;if(e=c,Y(e,"table","tenants")||Z(e,"events").includes("tenant_id")){let b=function(a,b){let c;O(b);let e=K(b,"legacy"),f=!1;try{P(a,e),f=!0}catch(a){c=a}finally{a.close()}if(!f){X(`Could not snapshot the incompatible ${k} (${String(c)}); moving the store aside with its sidecars instead.`);let a=[];(0,d.renameSync)(b,e),a.push([e,b]);try{for(let c of p(b)){let f=`${e}${c.slice(b.length)}`;try{(0,d.renameSync)(c,f),a.push([f,c])}catch{(0,d.rmSync)(c,{force:!0})}}}catch(b){for(let[b,c]of a.reverse())try{(0,d.renameSync)(b,c)}catch{}throw b}return r(e),e}try{for(let a of((0,d.rmSync)(b,{force:!0}),p(b)))(0,d.rmSync)(a,{force:!0})}catch(a){if((0,d.existsSync)(b))try{(0,d.rmSync)(e,{force:!0})}catch{}throw a}return e}(c,a);c=ch(a),X(`Detected an older, incompatible (tenant-bearing) ${k}; backed it up to ${b} and created a fresh store.`)}!function(a,b){var c,d;let e=a.prepare("PRAGMA user_version").get().user_version;a.exec("CREATE TABLE IF NOT EXISTS migration_ledger (tag TEXT PRIMARY KEY, applied_at INTEGER NOT NULL)");let f=new Set(a.prepare("SELECT tag FROM migration_ledger").all().map(a=>a.tag)),g=0===f.size&&e>0,h=a.prepare("INSERT OR IGNORE INTO migration_ledger (tag, applied_at) VALUES (?, ?)");for(let[b,c]of i.lFU.entries()){if(f.has(c.tag)||c.tag===ah)continue;let d=function(a){let b=[];for(let c of a.matchAll(/CREATE TABLE (?:IF NOT EXISTS )?`([^`]+)`/g))void 0===c[1]||c[1].startsWith("__new_")||b.push({kind:"table",name:c[1]});for(let c of a.matchAll(/ALTER TABLE `([^`]+)` ADD (?:COLUMN )?`([^`]+)`/g))void 0!==c[1]&&void 0!==c[2]&&b.push({kind:"column",table:c[1],name:c[2]});return b}(c.sql),i=d.filter(b=>"column"===b.kind?Z(a,b.table,{includeGenerated:!0}).includes(b.name):Y(a,"table",b.name));if(i.length>0&&i.length<d.length){let a=d.filter(a=>!i.includes(a)),b=`sqlite migration ${c.tag} has no ledger row, but the store already has ${i.map(af).join(", ")} while missing ${a.map(af).join(", ")} — the schema diverged from the migration history; refusing to replay or skip.`;throw X(b),Error(`[aka] ${b}`)}let j=d.length>0?i.length===d.length:g&&b<e,k=/PRAGMA foreign_keys\s*=\s*OFF/i.test(c.sql),l=ag(c.sql);k&&a.exec("PRAGMA foreign_keys = OFF");try{V(a,()=>{for(let b of l){let c=function(a){let b=a.replace(/^(?:\s*--[^\n]*\n?)+/,"").trimStart();return/^CREATE (?:UNIQUE )?INDEX (?:IF NOT EXISTS )?`([^`]+)`/.exec(b)?.[1]}(b);if(void 0===c){if(j)continue}else if(Y(a,"index",c))continue;a.exec(b)}if(k&&!j){let b=a.prepare("PRAGMA foreign_key_check").all();if(b.length>0)throw Error(`[aka] sqlite migration ${c.tag} left ${String(b.length)} foreign-key violation(s); rolling back.`)}h.run(c.tag,Date.now())},"IMMEDIATE")}finally{k&&a.exec("PRAGMA foreign_keys = ON")}}e<i.lFU.length&&a.exec(`PRAGMA user_version = ${String(i.lFU.length)}`),function(a,b){if(!Y(a,"table",b))return;let c=Z(a,b);c.includes("synced_at")||a.exec(`ALTER TABLE ${b} ADD COLUMN synced_at integer`),c.includes("sync_claimed_at")||a.exec(`ALTER TABLE ${b} ADD COLUMN sync_claimed_at integer`),c.includes("outbox_owed")||a.exec(`ALTER TABLE ${b} ADD COLUMN outbox_owed integer`),a.exec(`CREATE INDEX IF NOT EXISTS idx_audit_events_sync
-       ON audit_events (event_type, synced_at, sync_claimed_at, started_at)`),a.exec(`CREATE INDEX IF NOT EXISTS idx_audit_outbox_owed
-       ON audit_events (event_type, synced_at, sync_claimed_at, started_at) WHERE outbox_owed = 1`),a.exec(`CREATE INDEX IF NOT EXISTS idx_audit_claimed
-       ON audit_events (sync_claimed_at) WHERE sync_claimed_at IS NOT NULL`)}(a,"audit_events"),a.exec(`CREATE TABLE IF NOT EXISTS scan_ledger (
-    path TEXT PRIMARY KEY,
-    mtime TEXT NOT NULL,
-    content_hash TEXT NOT NULL,
-    ruleset_hash TEXT NOT NULL,
-    scanned_at INTEGER NOT NULL
-  )`),(c=a).exec(`CREATE TABLE IF NOT EXISTS history_sync (
-    id                   INTEGER PRIMARY KEY CHECK (id = 1),
-    endpoint_fingerprint TEXT,
-    backlog_before       INTEGER,
-    owner_pid            INTEGER,
-    owner_host           TEXT,
-    acquired_at          INTEGER,
-    heartbeat_at         INTEGER
-  )`),Z(c,"history_sync").includes("backlog_before")||c.exec("ALTER TABLE history_sync ADD COLUMN backlog_before integer"),a.exec(`CREATE TABLE IF NOT EXISTS blocked_detections (
-    reference TEXT PRIMARY KEY,
-    rule_id TEXT NOT NULL,
-    category TEXT NOT NULL,
-    value_fingerprint TEXT NOT NULL,
-    key_version INTEGER NOT NULL,
-    masked_value TEXT NOT NULL,
-    session_id TEXT,
-    repo TEXT,
-    blocked_at INTEGER NOT NULL
-  )`),a.exec(`CREATE TABLE IF NOT EXISTS rule_probe_cache (
-    rule_key TEXT PRIMARY KEY,
-    verdict TEXT NOT NULL,
-    worst_probe_ms REAL NOT NULL,
-    checked_at INTEGER NOT NULL
-  )`),(d=a).exec(`CREATE TABLE IF NOT EXISTS \`_pack_write_gate\` (
-	\`id\` integer PRIMARY KEY NOT NULL,
-	\`open\` integer DEFAULT 0 NOT NULL,
-	CONSTRAINT "ck_pack_write_gate_single_row" CHECK("_pack_write_gate"."id" = 1)
-)`),d.exec("INSERT OR IGNORE INTO _pack_write_gate (id, open) VALUES (1, 0)"),Y(d,"table","installed_packs")&&d.exec(`CREATE TRIGGER IF NOT EXISTS trg_installed_packs_write_gate
-BEFORE UPDATE OF version, name, rules_json ON installed_packs
-WHEN (SELECT open FROM _pack_write_gate WHERE id = 1) IS NOT 1
-BEGIN SELECT RAISE(IGNORE); END`),function(a){if(!Y(a,"table","audit_events"))return;let b=new Set(Z(a,"audit_events",{includeGenerated:!0}));for(let c of aj)b.has(c.name)||a.exec(c.ddl)}(a),function(a){try{let b=a.prepare(`SELECT id, url, name, attributes, first_seen AS firstSeen, last_seen AS lastSeen
-         FROM source_project
-         WHERE url IS NOT NULL AND id NOT LIKE 'sample:%'
-         ORDER BY last_seen DESC, id`).all().map(a=>({row:a,canonicalId:I(a.url)})).filter(({row:a,canonicalId:b})=>a.id!==b);if(0===b.length)return;let c=a.prepare(`INSERT INTO source_project (id, url, name, attributes, first_seen, last_seen)
-         VALUES (?, ?, ?, ?, ?, ?)
-       ON CONFLICT(id) DO UPDATE SET
-         first_seen = min(first_seen, excluded.first_seen),
-         last_seen = max(last_seen, excluded.last_seen)`),d=a.prepare("UPDATE audit_events SET source_project_id = ? WHERE source_project_id = ?"),e=a.prepare("UPDATE share_call_site SET project_id = ? WHERE project_id = ?"),f=["project_file","file_access_override"].map(b=>({dropCollisions:a.prepare(`DELETE FROM ${b} WHERE project_id = ?
-           AND path IN (SELECT path FROM ${b} WHERE project_id = ?)`),repoint:a.prepare(`UPDATE ${b} SET project_id = ? WHERE project_id = ?`)})),g=a.prepare("DELETE FROM source_project WHERE id = ?");V(a,()=>{for(let{row:a,canonicalId:h}of b){for(let{dropCollisions:b,repoint:e}of(c.run(h,a.url,a.name,a.attributes,a.firstSeen,a.lastSeen),d.run(h,a.id),f))b.run(a.id,h),e.run(h,a.id);e.run(h,a.id),g.run(a.id)}},"IMMEDIATE")}catch(a){X(`source_project id reconcile failed: ${String(a)}`)}}(a),!f.has(ah)&&function(a){try{if(!function(a){let b=a.prepare(`SELECT rowid AS rowid, id, source_tool AS sourceTool, kind, occurred_at AS occurredAt,
-            content_hash AS contentHash, content, metadata
-     FROM events WHERE rowid > ? ORDER BY rowid LIMIT ?`),c=a.prepare(`INSERT OR IGNORE INTO audit_events
-       (id, parent_id, root_session_id, event_type, started_at, content, content_hash, attributes)
-     VALUES (:id, :parentId, :rootSessionId, :eventType, :startedAt, :content, :contentHash, :attributes)`),d=a.prepare("INSERT OR IGNORE INTO audit_events (id, event_type, started_at) VALUES (?, 'session', ?)");return ak(a,"events",b,a=>{for(let e of a){var b;let a=function(a){if(null!==a)try{return JSON.parse(a)}catch{return}}(e.metadata),f=a?.sessionId??null;null!==f&&d.run(f,e.occurredAt),c.run(ab({id:e.id,parentId:f,rootSessionId:f,eventType:e.kind,startedAt:e.occurredAt,content:e.content,contentHash:e.contentHash,attributes:(b={...e,metadata:a},JSON.stringify((0,i.$w9)({id:b.id,sourceTool:b.sourceTool,kind:b.kind,occurredAt:new Date(b.occurredAt).toISOString(),contentHash:b.contentHash,content:b.content,metadata:b.metadata})))}))}})}(a))return!1;let b=a.prepare(`SELECT rowid AS rowid, id, event_id AS eventId, rule_id AS ruleId, category, severity,
-            span_start AS spanStart, span_end AS spanEnd, masked_match AS maskedMatch,
-            action_taken AS actionTaken, confidence, finding_key AS findingKey,
-            first_detected_at AS firstDetectedAt
-     FROM findings WHERE rowid > ? ORDER BY rowid LIMIT ?`),c=a.prepare(`INSERT OR IGNORE INTO inspection_definitions
-       (id, rule_id, name, category, severity, definition, version)
-     VALUES (:id, :ruleId, :name, :category, :severity, :definition, :version)`),d=a.prepare(`INSERT INTO inspection_findings
-       (id, audit_event_id, inspection_definition_id, classified_data_id,
-        span_start, span_end, masked_match, action_taken, confidence,
-        finding_key, first_detected_at)
-     VALUES
-       (:id, :auditEventId, :inspectionDefinitionId, NULL,
-        :spanStart, :spanEnd, :maskedMatch, :actionTaken, :confidence,
-        :findingKey, :firstDetectedAt)
-     ON CONFLICT(id) DO NOTHING
-     ON CONFLICT (finding_key) DO UPDATE SET
-       first_detected_at = CASE
-         WHEN first_detected_at IS NULL THEN excluded.first_detected_at
-         WHEN excluded.first_detected_at IS NULL THEN first_detected_at
-         ELSE min(first_detected_at, excluded.first_detected_at)
-       END`);return ak(a,"findings",b,a=>{let b=new Map;for(let e of a){let a=JSON.stringify([e.ruleId,e.category,e.severity]),f=b.get(a);if(void 0===f){let d=`unmigrated/${e.category}/${e.severity}`;f=J(e.ruleId,d),c.run(ab({id:f,ruleId:e.ruleId,name:e.ruleId,category:e.category,severity:e.severity,definition:"",version:d})),b.set(a,f)}d.run(ab({id:e.id,auditEventId:e.eventId,inspectionDefinitionId:f,spanStart:e.spanStart,spanEnd:e.spanEnd,maskedMatch:e.maskedMatch,actionTaken:e.actionTaken,confidence:e.confidence,findingKey:e.findingKey,firstDetectedAt:e.firstDetectedAt}))}})}catch(a){return X(`legacy history backfill failed: ${String(a)}`),!1}}(a)&&function(a,b){let c=i.lFU.find(a=>a.tag===ah);if(!c)return;let d=void 0===b?void 0:ai(a);if(void 0!==b&&d?.holdsRows===!0)try{var e=a,f=b;O(f);let c=K(f,"pre-drop");P(e,c)}catch(a){X(`legacy events/findings backup failed; deferring the drop: ${String(a)}`);return}try{V(a,()=>{if(!a.prepare("SELECT 1 FROM migration_ledger WHERE tag = ?").get(c.tag)){if(void 0!==d&&ai(a).mark!==d.mark)return void X("legacy events/findings rows changed after the pre-drop snapshot decision; deferring the drop so the next open can copy them first.");for(let b of ag(c.sql))a.exec(b);a.prepare("INSERT OR IGNORE INTO migration_ledger (tag, applied_at) VALUES (?, ?)").run(c.tag,Date.now())}},"IMMEDIATE")}catch(a){X(`legacy events/findings drop failed; deferring: ${String(a)}`)}}(a,b)}(c,a),r(a);let f=new bM(c),g=new bs(c,b),h={events:new aN(c),findings:new a$(c),policies:f,installedPacks:g,scanLedger:new bR(c),historySync:new a2(c),secretVault:new bX(c),exceptions:new aT(c),resolutions:new bP(c),ruleProbeCache:new bQ(c),security:new b3(c),detections:new aM(c),shares:new cb(c),policyCatalog:new bN(g),inventory:new bt(c),inventoryAssets:new bL(c),projectFiles:new bO(c),activity:new aE(c),sourceProject:new cc(c),auditEvents:new aF(c),classifiedData:new aG(c),inspectionDefinitions:new a3(c),inspectionFindings:new a4(c),configInventory:new aI(c)};return f.seedDefaults(),{db:c,...h}}catch(a){throw cg(c),a}}(b,(0,e.dirname)(a));function N(a){return function(a,b,c=null){return H((0,i.tTV)(["capture",a??"no_session",b,c??"no_path"]))}(a.metadata?.sessionId??null,a.contentHash,a.metadata?.filePath??null)}return{events:f,findings:g,policies:h,installedPacks:j,scanLedger:l,historySync:m,secretVault:n,exceptions:q,resolutions:s,ruleProbeCache:t,security:u,detections:v,shares:w,policyCatalog:x,inventory:y,inventoryAssets:z,activity:B,sourceProject:C,auditEvents:D,classifiedData:E,inspectionDefinitions:G,inspectionFindings:L,recordCapture:function(a,b){W(c,()=>{let c=a.metadata?.sessionId;c&&D.ensureSessionRoot(c,a.occurredAt);let d=N(a);D.insertAuditEvent({id:d,eventType:a.kind,startedAt:a.occurredAt,parentId:c,rootSessionId:c,content:a.content,contentHash:a.contentHash,attributes:(0,i.$w9)(a)});let e=new Map;for(let a of b){if(c&&L.isSessionDuplicate(a.ruleId,a.maskedMatch,c)||L.isEventDuplicate(d,a.ruleId,a.maskedMatch,a.span.start,a.span.end))continue;let b=`${a.ruleId}@${(0,i.qmP)(a)}`,f=e.get(b);f||(f=G.upsert((0,i.jTf)(a)),e.set(b,f)),L.insertFinding({id:a.id,auditEventId:d,inspectionDefinitionId:f,span:a.span,maskedMatch:a.maskedMatch,actionTaken:a.actionTaken,confidence:a.confidence,findingKey:a.findingKey??void 0})}})},markCaptureDelivered:function(a,b){W(c,()=>{m.markSynced([N(a)],b)})},markCaptureOwed:function(a){W(c,()=>{m.markCaptureOwed(N(a))})},markAuditEventsDelivered:function(a,b){let d=a.filter(a=>!cd.has(a.eventType));0!==d.length&&W(c,()=>{m.markSynced(d.map(a=>a.id),b)})},ensureInventory:function(a){let b={};return W(c,()=>{let c=Date.now();a.host&&(b.hostId=y.upsert(a.host,c)),a.harness&&(b.harnessId=y.upsert(cf(a.harness,b.hostId),c)),b.accountId=y.upsert(cf({objectType:"user",identityKey:"local",attributes:{source:"local"}},b.hostId),c),a.project&&(b.sourceProjectId=C.upsert(a.project,c))})?b:{}},recordConfigScan:function(a){W(c,()=>{let b=(0,i.I8t)(a.scanEvent.startedAt);for(let c of a.items)y.upsert(c,b);D.insertAuditEvent(a.scanEvent);let c=new Map;for(let b of a.definitions??[])c.set(`${b.ruleId}@${b.version}`,G.upsert(b));for(let b of a.findings??[]){let d=c.get(`${b.ruleId}@${b.version}`);d&&L.insertFinding({id:(0,F.randomUUID)(),auditEventId:a.scanEvent.id,inspectionDefinitionId:d,span:b.span,maskedMatch:b.maskedMatch,actionTaken:b.actionTaken,confidence:b.confidence})}})},recordProjectFiles:function(a,b){0!==b.files.length&&W(c,()=>{A.replaceForProject(a,b,Date.now())})},reconcileWorktreeProjects:function(a,b,d){try{let f=b.split(e.sep).join("/"),g=d.split(e.sep).join("/"),h=d===b?"":"url IN (:worktreePosix, :worktreeWin) OR ",i=c.prepare(`SELECT id FROM source_project
-           WHERE id <> :canonicalId
-             AND (${h}url LIKE :pattern ESCAPE '\\' OR url LIKE :patternWin ESCAPE '\\')`).all({canonicalId:a,...d===b?{}:{worktreePosix:g,worktreeWin:g.split("/").join("\\")},pattern:`${Q(f)}/.claude/worktrees/%`,patternWin:`${Q(f.split("/").join("\\"))}\\\\.claude\\\\worktrees\\\\%`});if(0===i.length)return;V(c,()=>{for(let{id:b}of i)c.prepare("UPDATE audit_events SET source_project_id = :canonicalId WHERE source_project_id = :id").run({canonicalId:a,id:b}),c.prepare("UPDATE OR IGNORE file_access_override SET project_id = :canonicalId WHERE project_id = :id").run({canonicalId:a,id:b}),c.prepare("DELETE FROM file_access_override WHERE project_id = :id").run({id:b}),c.prepare("DELETE FROM project_file WHERE project_id = :id").run({id:b}),c.prepare("DELETE FROM source_project WHERE id = :id").run({id:b})})}catch{}},configInventoryReport:()=>M.report(),facets:function(){return{hosts:y.distinctTitles("host"),harnesses:y.distinctTitles("harness"),osVersions:y.osVersions(),projects:C.distinctNames()}},purgeSampleData:()=>{!function(a){try{if(!a.prepare(`SELECT (
-         EXISTS(SELECT 1 FROM share_destination WHERE provenance = 'sample')
-         OR EXISTS(SELECT 1 FROM audit_events WHERE id LIKE 'sample:activity:%')
-         OR EXISTS(SELECT 1 FROM inventory_asset WHERE provenance = 'sample')
-       ) AS n`).get().n)return;V(a,()=>{a.exec(`DELETE FROM share_call_site WHERE endpoint_id IN (
-           SELECT e.id FROM share_endpoint e
-           JOIN share_destination d ON d.id = e.destination_id
-           WHERE d.provenance = 'sample')`),a.exec(`DELETE FROM egress_decision_override WHERE destination_id IN (
-           SELECT id FROM share_destination WHERE provenance = 'sample')`),a.exec(`DELETE FROM share_endpoint WHERE destination_id IN (
-           SELECT id FROM share_destination WHERE provenance = 'sample')`),a.exec("DELETE FROM share_destination WHERE provenance = 'sample'"),a.exec(`DELETE FROM harness_asset WHERE asset_id IN (SELECT id FROM inventory_asset WHERE provenance = 'sample')
-            OR harness_id IN (SELECT id FROM inventory WHERE object_type = 'harness' AND json_extract(attributes, '$.provenance') = 'sample')`),a.exec("DELETE FROM mcp_trust_override WHERE asset_id IN (SELECT id FROM inventory_asset WHERE provenance = 'sample')"),a.exec("DELETE FROM file_access_override WHERE project_id IN (SELECT id FROM source_project WHERE json_extract(attributes, '$.provenance') = 'sample')"),a.exec("DELETE FROM project_file WHERE project_id IN (SELECT id FROM source_project WHERE json_extract(attributes, '$.provenance') = 'sample')"),a.exec("DELETE FROM inventory_asset WHERE provenance = 'sample'"),a.exec("DELETE FROM source_project WHERE json_extract(attributes, '$.provenance') = 'sample'"),a.exec("DELETE FROM inventory WHERE object_type = 'harness' AND json_extract(attributes, '$.provenance') = 'sample'"),a.exec("DELETE FROM inspection_findings WHERE id LIKE 'sample:activity:%'"),a.exec("DELETE FROM inspection_definitions WHERE id LIKE 'sample:activity:%'"),a.exec("DELETE FROM audit_events WHERE root_session_id LIKE 'sample:activity:%'"),a.exec("DELETE FROM audit_events WHERE id LIKE 'sample:activity:%'"),a.exec(`CREATE TABLE IF NOT EXISTS app_meta (
-        key TEXT PRIMARY KEY,
-        value TEXT NOT NULL
-      )`),a.exec("DELETE FROM app_meta WHERE key LIKE 'sample_seeded:%'")})}catch{}}(c)},transaction:async function a(a){c.exec("BEGIN");try{let b=await a();return c.exec("COMMIT"),b}catch(a){try{c.exec("ROLLBACK")}catch{}throw a}},close:()=>{c.close()},[ce]:c}}function cj(a){return{host:a.host,kind:a.kind,name:a.name,category:a.category,trust:a.trust,network:a.network,method:a.method,transport:a.transport,url:a.url,template:a.template,dataClass:a.dataClass,site:{file:a.site.file,line:a.site.line,dynamic:a.site.dynamic,vendored:a.site.vendored}}}function ck(a){var b;let{hits:c,droppedFiles:d}=b7(a.hits,a.reconcile.mode),e=b8(a.reconcile,d);return{projectKey:(b=a.projectKey,(0,F.createHash)("sha256").update(b,"utf8").digest("hex")),project:a.project,reconcile:e,hits:c.map(cj)}}function cl(a){let b=a.filePath.replaceAll("\\","/");return(0,F.createHash)("sha256").update(`${a.ruleId}\0${b}\0${a.valueFingerprint}`).digest("hex")}function cm(a){return(0,e.join)(a,"exception.key")}let cn={exceptions:"key_version",blocked_detections:"key_version",secret_vault:"fingerprint_key_version"};class co extends Error{constructor(a){super(`cannot read the stored fingerprint key versions: ${a instanceof Error?a.message:String(a)}`,{cause:a}),this.code="floor-unreadable",this.name="FloorUnreadableError"}}function cp(a){let b,c=(0,e.join)(a,k);if(!(0,d.existsSync)(c))return 0;try{(b=new G.DatabaseSync(c,{readOnly:!0})).exec(`PRAGMA busy_timeout = ${String(250)}`);let a=0;for(let[c,d]of Object.entries(cn))try{let e=_(b.prepare(`SELECT MAX(${d}) AS v FROM ${c}`));a=Math.max(a,e?.v??0)}catch(a){if(1!==a.errcode)throw new co(a)}return a}catch(a){throw a instanceof co?a:new co(a)}finally{b?.close()}}function cq(a){return JSON.stringify({version:a.version,material:a.material.toString("base64")})}function cr(a){let b;try{b=(0,d.readFileSync)(cm(a),"utf8")}catch(a){if("ENOENT"===a.code)return null;throw a instanceof Error?a:Error(String(a))}let c=JSON.parse(b);if("object"!=typeof c||null===c)throw Error("exception key file is corrupt: not a JSON object");let{version:e,material:f}=c;if("number"!=typeof e||!Number.isInteger(e)||e<1)throw Error("exception key file is corrupt: bad version");if("string"!=typeof f)throw Error("exception key file is corrupt: bad material");let g=Buffer.from(f,"base64");if(32!==g.length)throw Error("exception key file is corrupt: bad material length");return{version:e,material:g}}function cs(a){let b=cr(a);return b?(q(cm(a)),b):function(a,b){o(a);let c=cm(a);if(w(c,`${cq(b)}
-`))return b;let d=cr(a);if(d)return q(c),d;let e=u(c);throw new v(function(a,b){switch(b){case"symlink":return`exception key file is a symlink (${a}); remove it so a key can be created`;case"gone":return"exception key file was removed while it was being created";case"unknown":return`exception key file (${a}) is occupied but cannot be inspected; check the permissions on its directory`}}(c,e.kind),e.cause)}(a,{version:cp(a)+1,material:(0,F.randomBytes)(32)})}function ct(a){var b;let c=cr(a);return b={version:Math.max(c?.version??0,cp(a))+1,material:(0,F.randomBytes)(32)},o(a),t(cm(a),`${cq(b)}
-`),b}function cu(a,b){return(0,F.createHmac)("sha256",a.material).update(b,"utf8").digest("hex")}function cv(a,b){var c;return(0,i.qEQ)(b,null===(c=a)?{status:"absent"}:{status:"present",version:c.version})}function cw(a,b){if((0,d.existsSync)((0,e.join)(a,k)))try{let c=ci(a);try{c.historySync.markCaptureBacklogOwed(b)}finally{c.close()}}catch{}}let cx="ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";function cy(a){let b="",c=0,d=0;for(let e of a)for(c=c<<8|e,d+=8;d>=5;)b+=cx.charAt(c>>>d-5&31),d-=5;return d>0&&(b+=cx.charAt(c<<5-d&31)),b}function cz(a){let b=[],c=0,d=0;for(let e of a){let a=cx.indexOf(e);if(a<0)throw Error("base32: character outside the alphabet");c=c<<5|a,(d+=5)>=8&&(b.push(c>>>d-8&255),d-=8)}return Buffer.from(b)}function cA(a){if(!Number.isInteger(a)||a<1||a>0xffffffff)throw Error("vault: key version out of range");let b=[],c=a;for(;c>0;)b.unshift(255&c),c=Math.floor(c/256);return cy(Uint8Array.from(b))}function cB(a){let b=b=>Buffer.from((0,F.hkdfSync)("sha256",a,"aka:vault:v1",b,32));return{enc:b("aka:vault:enc:v1"),sign:b("aka:vault:sign:v1")}}function cC(a,b,c,d=i.viY){if(16!==b.length)throw Error("vault: pointer id must be 16 bytes");let e=Buffer.alloc(6);return e.writeUInt16BE(d,0),e.writeUInt32BE(a,2),Buffer.concat([e,Buffer.from(b),Buffer.from(c,"utf8")])}function cD(a,b,c,d){let e=(0,F.createCipheriv)("aes-256-gcm",a,d);return e.setAAD(c),{ciphertext:Buffer.concat([e.update(b,"utf8"),e.final()]),nonce:d,authTag:e.getAuthTag()}}function cE(a,b,c){try{let d=(0,F.createDecipheriv)("aes-256-gcm",a,b.nonce);return d.setAAD(c),d.setAuthTag(b.authTag),Buffer.concat([d.update(b.ciphertext),d.final()]).toString("utf8")}catch{return null}}function cF(a,b,c,d){return(0,F.createHmac)("sha256",a).update(cC(b,c,d,i.viY)).digest().subarray(0,10)}function cG(a,b,c,d,e){if(10!==e.length)return!1;let f=cF(a,b,c,d);return(0,F.timingSafeEqual)(f,Buffer.from(e))}var cH=c(31421);let cI={symlink:"the path is a symlink; remove it so a keyring can be created",gone:"the path was occupied but holds no keyring (removed while it was being created)",unknown:"the path is occupied but cannot be inspected; check the permissions on its directory"};class cJ extends Error{constructor(a){super(`vault: key epoch ${String(a)} is not present in the keyring`),this.name="VaultKeyEpochMissingError",this.version=a}}let cK="vault.key",cL="aka-vault",cM="keyring";function cN(a){let b=JSON.parse(a);if("object"!=typeof b||null===b)throw Error("vault key file is corrupt: not a JSON object");let{current:c,keys:d}=b;if("number"!=typeof c||!Number.isInteger(c)||c<1)throw Error("vault key file is corrupt: bad current version");if("object"!=typeof d||null===d||Array.isArray(d))throw Error("vault key file is corrupt: bad keys map");let e=new Map;for(let[a,b]of Object.entries(d)){let c=Number(a);if(!Number.isInteger(c)||c<1)throw Error("vault key file is corrupt: bad key version");if("string"!=typeof b)throw Error("vault key file is corrupt: bad key material");let d=Buffer.from(b,"base64");if(32!==d.length)throw Error("vault key file is corrupt: bad key material length");e.set(c,d)}if(!e.has(c))throw Error("vault key file is corrupt: current version has no material");return{current:c,keys:e}}function cO(a){let b={};for(let c of[...a.keys.keys()].sort((a,b)=>a-b)){let d=a.keys.get(c);d&&(b[String(c)]=d.toString("base64"))}return JSON.stringify({current:a.current,keys:b})}function cP(){return{current:1,keys:new Map([[1,(0,F.randomBytes)(32)]])}}function cQ(a){let b=Math.max(...a.keys.keys())+1,c=new Map(a.keys);return c.set(b,(0,F.randomBytes)(32)),{current:b,keys:c}}function cR(a){let b=a.keys.get(a.current);if(!b)throw new cJ(a.current);return{material:b,version:a.current}}function cS(a,b){let c=a.keys.get(b);if(!c)throw new cJ(b);return{material:c,version:b}}function cT(a){try{return Promise.resolve(a())}catch(a){return Promise.reject(a instanceof Error?a:Error(String(a)))}}function cU(a){return a instanceof Error?a:Error(String(a))}let cV="owner",cW="vault: a key rotation is already in progress";function cX(a,b){try{n(a),m(a)}catch(a){if("EEXIST"===a.code)return!1;throw cU(a)}try{return(0,d.writeFileSync)((0,e.join)(a,cV),`${b}
-`,{mode:384}),!0}catch(b){throw(0,d.rmSync)(a,{recursive:!0,force:!0}),cU(b)}}function cY(a,b){o(a);let c=function(a){let b,c=(0,e.join)(a,`${cK}.lock`),f=(0,F.randomBytes)(16).toString("hex");if(cX(c,f))return{lock:c,owner:f};try{b=(0,d.statSync)(c)}catch{throw Error(cW)}if(Date.now()-b.mtimeMs<6e4)throw Error(cW);let g=`${c}.stale.${f}`;try{let a=(0,d.statSync)(c);if(a.ino!==b.ino||a.mtimeMs!==b.mtimeMs)throw Error(cW);(0,d.renameSync)(c,g)}catch(a){if(a instanceof Error&&a.message===cW)throw a;throw Error(cW,{cause:a})}if((0,d.rmSync)(g,{recursive:!0,force:!0}),!cX(c,f))throw Error(cW);return{lock:c,owner:f}}(a);try{return b()}finally{!function(a){try{if((0,d.readFileSync)((0,e.join)(a.lock,cV),"utf8").trim()!==a.owner)return}catch{return}(0,d.rmSync)(a.lock,{recursive:!0,force:!0})}(c)}}class cZ{#a;constructor(a){this.#a=a}get filePath(){return(0,e.join)(this.#a,cK)}loadOrCreate(){return cT(()=>{let a=this.#b();return a?(c$(this.filePath),cR(a)):cR(this.#c())})}rotate(){return cT(()=>cY(this.#a,()=>{let a=this.#b();return a?cR(this.#d(cQ(a))):cR(this.#c())}))}materialFor(a){return cT(()=>{let b=this.#b();if(!b)throw new cJ(a);return cS(b,a)})}#b(){let a;try{a=(0,d.readFileSync)(this.filePath,"utf8")}catch(a){if("ENOENT"===a.code)return null;throw a instanceof Error?a:Error(String(a))}return cN(a)}#c(){o(this.#a);let a=cP();if(w(this.filePath,`${cO(a)}
-`))return a;let b=this.#b();if(!b){let a=u(this.filePath);throw new v(`vault: cannot create a key file at ${this.filePath} — ${cI[a.kind]}`,a.cause)}return c$(this.filePath),b}#d(a){return o(this.#a),t(this.filePath,`${cO(a)}
-`),a}}function c$(a){try{(0,d.chmodSync)(a,384)}catch{}}let c_=(a,b)=>(0,cH.execFileSync)("/usr/bin/security",a,{encoding:"utf8",input:b,timeout:5e3,stdio:[void 0===b?"ignore":"pipe","pipe","ignore"]});function c0(a){let b=[];return"number"==typeof a.status&&b.push(`exit ${String(a.status)}`),"string"==typeof a.signal&&a.signal&&b.push(`signal ${a.signal}`),"string"==typeof a.code&&a.code&&b.push(a.code),b.length>0?b.join(", "):"unknown error"}function c1(a,b,c){let d=["add-generic-password",...b?["-U"]:[],"-s",cL,"-a",cM,"-X",Buffer.from(cO(a),"utf8").toString("hex")];if(void 0!==c){if(/['\\\n\r\0]/.test(c))throw Error("vault: keychain path contains a quote, backslash, line break or NUL, which security -i cannot carry intact");d.push(`'${c}'`)}return`${d.join(" ")}
-`}class c2{#a;#e;#f;#g;constructor(a,b=c_,c){if(b===c_&&"darwin"!==process.platform)throw Error(`keychain custody is not available on this platform (${process.platform}); use file custody`);this.#a=a,this.#e=b,this.#f=c,this.#g=void 0===c?[]:[c]}get keysDir(){return this.#a}loadOrCreate(){return cT(()=>{let a=this.#b();return a?cR(a):cR(this.#h(cP()))})}rotate(){return cT(()=>cY(this.#a,()=>{let a=this.#b();return a?cR(this.#i(cQ(a))):cR(this.#h(cP()))}))}materialFor(a){return cT(()=>{let b=this.#b();if(!b)throw new cJ(a);return cS(b,a)})}#b(){let a;try{a=this.#e(["find-generic-password","-s",cL,"-a",cM,"-w",...this.#g])}catch(a){if(44===a.status)return null;throw Error(`vault: keychain read failed (${c0(a)}); refusing to treat the failure as an absent keyring`)}let b=a.trim();if(0===b.length)return null;try{return cN(b)}catch(a){throw Error(`vault: keychain item is not a usable keyring (${a instanceof SyntaxError?"malformed JSON":a instanceof Error?a.message:"unknown"})`)}}#h(a){let b=c1(a,!1,this.#f);try{this.#e(["-i"],b)}catch(b){let a=this.#b();if(a)return a;throw Error(`vault: keychain write failed (${c0(b)})`)}return a}#i(a){let b=c1(a,!0,this.#f);try{this.#e(["-i"],b)}catch(a){throw Error(`vault: keychain write failed (${c0(a)})`)}return a}}function c3(a,b){return"keychain"===a?new c2(b):new cZ(b)}let c4=Symbol("aka.vault.consentAbsent"),c5=Symbol("aka.vault.unavailable");function c6(a){if(!i.XZo.test(a))return null;let b=a.slice(6,-2),c=b.indexOf(":");if(c<0)return null;let d=b.slice(0,c),[e,f,g]=b.slice(c+1).split(".");if(void 0===e||void 0===f||void 0===g)return null;try{let a=function(a){let b=cz(a);if(0===b.length||b.length>4)throw Error("vault: bad key version encoding");let c=0;for(let a of b)c=256*c+a;if(c<1)throw Error("vault: bad key version");return c}(e),b=cz(f),c=cz(g);if(cA(a)!==e||cy(b)!==f||cy(c)!==g)return null;return{category:d,keyVersion:a,pointerId:b,tag:c}}catch{return null}}class c7{#j;#k;#l;#m;#n;constructor(a){this.#j=a.repo,this.#k=a.keys,this.#l=a.isConsented,this.#m=a.verifyGrant,this.#n=a.now??(()=>Date.now())}async tokenize(a,b,c){if(!this.#l())return c4;let d=c(),e=cu(d,a),f=this.#j.byValueFingerprint(e),g=this.#n();if(f)return this.#j.upsert({...f,provider:f.provider??void 0,userAuthorized:!0===b.userAuthorized},g),await this.#o(f.keyVersion,f.pointerId,f.category);let{material:h,version:j}=await this.#k.loadOrCreate(),k=cB(h),l=(0,F.randomBytes)(16),m=cC(j,l,b.category,i.viY),n=cD(k.enc,a,m,(0,F.randomBytes)(12)),{row:o}=this.#j.upsert({pointerId:cy(l),valueFingerprint:e,fingerprintKeyVersion:d.version,keyVersion:j,formatVersion:i.viY,category:b.category,ruleId:b.ruleId,maskedMatch:b.maskedMatch,provider:b.provider,userAuthorized:!0===b.userAuthorized,ciphertext:n.ciphertext.toString("base64"),nonce:n.nonce.toString("base64"),authTag:n.authTag.toString("base64")},g);return await this.#o(o.keyVersion,o.pointerId,o.category)}async detokenize(a,b){let c,d,e=c6(a);if(!e)return c5;try{let a=await this.#k.materialFor(e.keyVersion);c=cB(a.material).sign}catch{return c5}if(!cG(c,e.keyVersion,e.pointerId,e.category,e.tag))return c5;let f=cy(e.pointerId),g=this.#j.byPointerId(f);if(!g)return this.#p(f,b,"unavailable"),c5;if(g.category!==e.category)return c5;if("model"===b.target){let a,c=b.grantId,d=this.#m;if(void 0===d||void 0===c||""===c)return this.#p(f,b,"refused"),c5;try{a=await d(c,{ruleId:g.ruleId,valueFingerprint:g.valueFingerprint,fingerprintKeyVersion:g.fingerprintKeyVersion})}catch{a=!1}if(!a)return this.#p(f,b,"refused"),c5}try{let a=await this.#k.materialFor(g.keyVersion);d=cE(cB(a.material).enc,{ciphertext:Buffer.from(g.ciphertext,"base64"),nonce:Buffer.from(g.nonce,"base64"),authTag:Buffer.from(g.authTag,"base64")},cC(g.keyVersion,e.pointerId,g.category,g.formatVersion))}catch{d=null}return null===d?(this.#p(f,b,"unavailable"),c5):(this.#p(f,b,"revealed"),d)}async revealEntry(a,b){let c=this.#j.byPointerId(a);if(!c)return this.#p(a,{target:"human",reason:b.reason},"unavailable"),c5;let d=await this.#q(c);return null===d?(this.#p(a,{target:"human",reason:b.reason},"unavailable"),c5):(this.#p(a,{target:"human",reason:b.reason},"revealed"),d)}async describePointer(a){let b=await this.#r(a);return b?{category:b.category,...void 0===b.provider?{}:{provider:b.provider},maskedMatch:b.maskedMatch,occurrences:b.occurrenceCount,firstSeen:new Date(b.firstSeen).toISOString(),lastSeen:new Date(b.lastSeen).toISOString()}:null}async resolvePointerIdentity(a){let b=await this.#r(a);return b?{ruleId:b.ruleId,valueFingerprint:b.valueFingerprint,fingerprintKeyVersion:b.fingerprintKeyVersion}:null}async rotateVaultKey(){let a=await this.#k.rotate(),b=cB(a.material).enc,c=0;for(let d of this.#j.listAll()){let e;if(d.keyVersion===a.version)continue;let f=cz(d.pointerId);try{let a=await this.#k.materialFor(d.keyVersion);e=cE(cB(a.material).enc,{ciphertext:Buffer.from(d.ciphertext,"base64"),nonce:Buffer.from(d.nonce,"base64"),authTag:Buffer.from(d.authTag,"base64")},cC(d.keyVersion,f,d.category,d.formatVersion))}catch{e=null}if(null===e)continue;let g=cD(b,e,cC(a.version,f,d.category,d.formatVersion),(0,F.randomBytes)(12));this.#j.replaceCiphertext(d.pointerId,{keyVersion:a.version,ciphertext:g.ciphertext.toString("base64"),nonce:g.nonce.toString("base64"),authTag:g.authTag.toString("base64")}),c+=1}return{version:a.version,reEncrypted:c}}async refreshFingerprints(a){let b=0;for(let c of this.#j.listAll())try{let d=await this.#q(c);if(null===d)continue;this.#j.refreshFingerprint(c.pointerId,{valueFingerprint:cu(a,d),fingerprintKeyVersion:a.version}),b+=1}catch{continue}return b}purgeVault(){let a=this.#j.purgeAll();return this.#j.recordDeref({id:(0,F.randomUUID)(),pointerId:"*",at:this.#n(),target:"human",reason:"purge",outcome:"unavailable",pointerCount:Math.max(a,1)}),a}async #o(a,b,c){var d;let e=cz(b),f=cB((await this.#k.materialFor(a)).material).sign;return d=cF(f,a,e,c),`[[aka:${c}:${cA(a)}.${cy(e)}.${cy(d)}]]`}async #q(a){try{let b=await this.#k.materialFor(a.keyVersion);return cE(cB(b.material).enc,{ciphertext:Buffer.from(a.ciphertext,"base64"),nonce:Buffer.from(a.nonce,"base64"),authTag:Buffer.from(a.authTag,"base64")},cC(a.keyVersion,cz(a.pointerId),a.category,a.formatVersion))}catch{return null}}async #r(a){let b=c6(a);if(!b)return null;try{let a=await this.#k.materialFor(b.keyVersion),c=cB(a.material).sign;if(!cG(c,b.keyVersion,b.pointerId,b.category,b.tag))return null}catch{return null}let c=this.#j.byPointerId(cy(b.pointerId));return c?.category!==b.category?null:c}#p(a,b,c){this.#j.recordDeref({id:(0,F.randomUUID)(),pointerId:a,at:this.#n(),target:b.target,reason:b.reason,outcome:c,...void 0===b.grantId?{}:{grantId:b.grantId},pointerCount:(0,i.kqf)(b.reason)?b.pointerCount??1:1})}}},49008:(a,b,c)=>{c.d(b,{S8C:()=>ak,leE:()=>bL,hxQ:()=>a8,Itg:()=>aY,Nh0:()=>cO,QcD:()=>cN,qeh:()=>fb,yi_:()=>bM,t8P:()=>bW,RRF:()=>dy,ZpU:()=>dL,HUb:()=>dw,hfB:()=>cD,unw:()=>dK,p$t:()=>aG,IYX:()=>aA,b2L:()=>aD,Jr:()=>dM,hdu:()=>d4,mBk:()=>d3,gbA:()=>ah,V8B:()=>cJ,B0R:()=>b7,CPm:()=>b5,IgC:()=>dt,aIg:()=>bv,BZd:()=>bU,ZYZ:()=>cC,iRC:()=>cK,GCf:()=>ap,agn:()=>cP,tLs:()=>ac,xIP:()=>ef,TUN:()=>ad,SHn:()=>be,rov:()=>ej,kg1:()=>bV,V0H:()=>dv,mzG:()=>aE,OXN:()=>aH,VEg:()=>aB,OVs:()=>d8,LsM:()=>d6,bm0:()=>d7,WRR:()=>eB,u8Q:()=>d5,kxf:()=>ee,ZXz:()=>eE,MhX:()=>eF,viY:()=>dQ,XZo:()=>dT,NtJ:()=>bZ,jUf:()=>dV,PEm:()=>dq,vap:()=>dr,KqW:()=>e0,eI7:()=>eJ,lBn:()=>bS,qhM:()=>bR,cqq:()=>aq,PUD:()=>aS,eYL:()=>cQ,JJC:()=>cR,jON:()=>cl,Zdp:()=>ae,lFU:()=>d,N3u:()=>fa,PhW:()=>aW,BIx:()=>ba,DzG:()=>eb,NFD:()=>ea,hd_:()=>eo,_5V:()=>dg,tXp:()=>c3,plk:()=>cB,Ple:()=>cZ,Fnc:()=>fr,ryv:()=>_,fhc:()=>dA,tTV:()=>aV,qmP:()=>ez,_6W:()=>c5,hml:()=>dh,rG:()=>c7,F$B:()=>er,Bfj:()=>c2,fj8:()=>dc,q_t:()=>Z,i1j:()=>ep,xog:()=>cY,hzO:()=>ft,by7:()=>fs,Gw9:()=>fp,ZoN:()=>di,q11:()=>V,U7X:()=>ai,JB8:()=>cX,T2I:()=>dE,lgf:()=>eq,kqf:()=>d$,y_0:()=>fq,EL9:()=>en,qEQ:()=>cL,DLF:()=>el,hds:()=>ed,I8t:()=>U,am1:()=>c9,SSj:()=>df,K7s:()=>cS,jwX:()=>dU,TdZ:()=>dJ,DhA:()=>dN,WSs:()=>fw,a45:()=>cz,N6N:()=>f,X0p:()=>c6,pnU:()=>cA,Lq6:()=>dF,V9M:()=>eu,$w9:()=>ey,jTf:()=>eA,$BP:()=>ev,JAl:()=>ew,$3l:()=>ex,MgS:()=>dd,gzP:()=>es,QCA:()=>et,C05:()=>fu,GWi:()=>dG});let d=[{tag:"0000_acoustic_felicia_hardy",sql:"CREATE TABLE `audit_events` (\n	`id` text PRIMARY KEY NOT NULL,\n	`parent_id` text,\n	`root_session_id` text,\n	`event_type` text NOT NULL,\n	`host_id` text,\n	`harness_id` text,\n	`source_project_id` text,\n	`started_at` integer NOT NULL,\n	`ended_at` integer,\n	`severity` text,\n	`priority` text,\n	`content` text,\n	`content_hash` text,\n	`attributes` text,\n	FOREIGN KEY (`parent_id`) REFERENCES `audit_events`(`id`) ON UPDATE no action ON DELETE no action,\n	FOREIGN KEY (`root_session_id`) REFERENCES `audit_events`(`id`) ON UPDATE no action ON DELETE no action,\n	FOREIGN KEY (`host_id`) REFERENCES `inventory`(`id`) ON UPDATE no action ON DELETE no action,\n	FOREIGN KEY (`harness_id`) REFERENCES `inventory`(`id`) ON UPDATE no action ON DELETE no action,\n	FOREIGN KEY (`source_project_id`) REFERENCES `source_project`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_audit_parent` ON `audit_events` (`parent_id`);--\x3e statement-breakpoint\nCREATE INDEX `idx_audit_session` ON `audit_events` (`root_session_id`,`started_at`);--\x3e statement-breakpoint\nCREATE INDEX `idx_audit_harness_t` ON `audit_events` (`harness_id`,`started_at`);--\x3e statement-breakpoint\nCREATE INDEX `idx_audit_project_t` ON `audit_events` (`source_project_id`,`started_at`);--\x3e statement-breakpoint\nCREATE TABLE `classified_data` (\n	`id` text PRIMARY KEY NOT NULL,\n	`class` text NOT NULL,\n	`label` text,\n	`attributes` text\n);\n--\x3e statement-breakpoint\nCREATE TABLE `events` (\n	`id` text PRIMARY KEY NOT NULL,\n	`source_tool` text NOT NULL,\n	`kind` text NOT NULL,\n	`occurred_at` integer NOT NULL,\n	`content_hash` text NOT NULL,\n	`content` text NOT NULL,\n	`metadata` text\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_events_occurred` ON `events` (`occurred_at`);--\x3e statement-breakpoint\nCREATE TABLE `findings` (\n	`id` text PRIMARY KEY NOT NULL,\n	`event_id` text NOT NULL,\n	`rule_id` text NOT NULL,\n	`category` text NOT NULL,\n	`severity` text NOT NULL,\n	`span_start` integer NOT NULL,\n	`span_end` integer NOT NULL,\n	`masked_match` text NOT NULL,\n	`action_taken` text NOT NULL,\n	`confidence` real NOT NULL,\n	FOREIGN KEY (`event_id`) REFERENCES `events`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_findings_event` ON `findings` (`event_id`);--\x3e statement-breakpoint\nCREATE TABLE `inspection_definitions` (\n	`id` text PRIMARY KEY NOT NULL,\n	`rule_id` text NOT NULL,\n	`name` text NOT NULL,\n	`category` text NOT NULL,\n	`severity` text NOT NULL,\n	`definition` text NOT NULL,\n	`version` text NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE TABLE `inspection_findings` (\n	`id` text PRIMARY KEY NOT NULL,\n	`audit_event_id` text NOT NULL,\n	`inspection_definition_id` text NOT NULL,\n	`classified_data_id` text,\n	`span_start` integer NOT NULL,\n	`span_end` integer NOT NULL,\n	`masked_match` text NOT NULL,\n	`action_taken` text NOT NULL,\n	`confidence` real NOT NULL,\n	FOREIGN KEY (`audit_event_id`) REFERENCES `audit_events`(`id`) ON UPDATE no action ON DELETE no action,\n	FOREIGN KEY (`inspection_definition_id`) REFERENCES `inspection_definitions`(`id`) ON UPDATE no action ON DELETE no action,\n	FOREIGN KEY (`classified_data_id`) REFERENCES `classified_data`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_inspection_findings_event` ON `inspection_findings` (`audit_event_id`);--\x3e statement-breakpoint\nCREATE TABLE `installed_packs` (\n	`id` text PRIMARY KEY NOT NULL,\n	`namespace` text NOT NULL,\n	`pack_id` text NOT NULL,\n	`version` text NOT NULL,\n	`name` text NOT NULL,\n	`rules_json` text NOT NULL,\n	`enabled` integer DEFAULT true NOT NULL,\n	`policy_id` text,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_installed_packs_pack` ON `installed_packs` (`namespace`,`pack_id`);--\x3e statement-breakpoint\nCREATE TABLE `inventory` (\n	`id` text PRIMARY KEY NOT NULL,\n	`object_type` text NOT NULL,\n	`location` text,\n	`title` text,\n	`host_id` text,\n	`attributes` text NOT NULL,\n	`os_version` text GENERATED ALWAYS AS (json_extract(attributes, '$.os_version')) VIRTUAL,\n	`harness_version` text GENERATED ALWAYS AS (json_extract(attributes, '$.harness_version')) VIRTUAL,\n	`first_seen` integer NOT NULL,\n	`last_seen` integer NOT NULL,\n	FOREIGN KEY (`host_id`) REFERENCES `inventory`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_inventory_type` ON `inventory` (`object_type`);--\x3e statement-breakpoint\nCREATE INDEX `idx_inventory_type_osver` ON `inventory` (`object_type`,`os_version`);--\x3e statement-breakpoint\nCREATE INDEX `idx_inventory_type_harnessver` ON `inventory` (`object_type`,`harness_version`);--\x3e statement-breakpoint\nCREATE TABLE `policies` (\n	`id` text PRIMARY KEY NOT NULL,\n	`scope` text DEFAULT 'global' NOT NULL,\n	`target` text NOT NULL,\n	`action` text NOT NULL,\n	`enabled` integer DEFAULT true NOT NULL,\n	`custom_keywords` text,\n	`name` text,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_policies_scope_target` ON `policies` (`scope`,`target`);--\x3e statement-breakpoint\nCREATE TABLE `source_project` (\n	`id` text PRIMARY KEY NOT NULL,\n	`url` text,\n	`name` text,\n	`attributes` text NOT NULL,\n	`first_seen` integer NOT NULL,\n	`last_seen` integer NOT NULL\n);\n"},{tag:"0001_adorable_marten_broadcloak",sql:"ALTER TABLE `audit_events` ADD `input_tokens` integer GENERATED ALWAYS AS (json_extract(attributes, '$.input_tokens')) VIRTUAL;--\x3e statement-breakpoint\nALTER TABLE `audit_events` ADD `output_tokens` integer GENERATED ALWAYS AS (json_extract(attributes, '$.output_tokens')) VIRTUAL;--\x3e statement-breakpoint\nALTER TABLE `audit_events` ADD `cache_creation_input_tokens` integer GENERATED ALWAYS AS (json_extract(attributes, '$.cache_creation_input_tokens')) VIRTUAL;--\x3e statement-breakpoint\nALTER TABLE `audit_events` ADD `cache_read_input_tokens` integer GENERATED ALWAYS AS (json_extract(attributes, '$.cache_read_input_tokens')) VIRTUAL;--\x3e statement-breakpoint\nALTER TABLE `audit_events` ADD `model` text GENERATED ALWAYS AS (json_extract(attributes, '$.model')) VIRTUAL;--\x3e statement-breakpoint\nALTER TABLE `audit_events` ADD `provider` text GENERATED ALWAYS AS (json_extract(attributes, '$.provider')) VIRTUAL;--\x3e statement-breakpoint\nCREATE INDEX `idx_audit_session_type` ON `audit_events` (`root_session_id`,`started_at`) WHERE event_type = 'llm_call';"},{tag:"0002_groovy_big_bertha",sql:"CREATE TABLE `exceptions` (\n	`id` text PRIMARY KEY NOT NULL,\n	`rule_id` text NOT NULL,\n	`category` text NOT NULL,\n	`value_fingerprint` text NOT NULL,\n	`key_version` integer NOT NULL,\n	`masked_value` text NOT NULL,\n	`scope` text NOT NULL,\n	`expires_at` integer,\n	`max_uses` integer,\n	`use_count` integer DEFAULT 0 NOT NULL,\n	`last_used_at` integer,\n	`justification` text NOT NULL,\n	`conditions` text,\n	`created_by` text NOT NULL,\n	`created_via` text NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL,\n	`revoked_at` integer,\n	`revoked_by` text,\n	`revoke_reason` text\n);\n--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_exceptions_active` ON `exceptions` (`rule_id`,`value_fingerprint`,`key_version`) WHERE revoked_at IS NULL;"},{tag:"0003_rich_sage",sql:"CREATE TABLE `egress_decision_override` (\n	`id` text PRIMARY KEY NOT NULL,\n	`destination_id` text NOT NULL,\n	`decision` text NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL,\n	FOREIGN KEY (`destination_id`) REFERENCES `share_destination`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_egress_decision_override` ON `egress_decision_override` (`destination_id`);--\x3e statement-breakpoint\nCREATE TABLE `file_access_override` (\n	`id` text PRIMARY KEY NOT NULL,\n	`project_id` text NOT NULL,\n	`path` text NOT NULL,\n	`access` text NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL,\n	FOREIGN KEY (`project_id`) REFERENCES `source_project`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_file_access_override_project` ON `file_access_override` (`project_id`);--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_file_access_override` ON `file_access_override` (`project_id`,`path`);--\x3e statement-breakpoint\nCREATE TABLE `harness_asset` (\n	`id` text PRIMARY KEY NOT NULL,\n	`harness_id` text NOT NULL,\n	`asset_id` text NOT NULL,\n	`created_at` integer NOT NULL,\n	FOREIGN KEY (`harness_id`) REFERENCES `inventory`(`id`) ON UPDATE no action ON DELETE no action,\n	FOREIGN KEY (`asset_id`) REFERENCES `inventory_asset`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_harness_asset_harness` ON `harness_asset` (`harness_id`);--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_harness_asset` ON `harness_asset` (`harness_id`,`asset_id`);--\x3e statement-breakpoint\nCREATE TABLE `inventory_asset` (\n	`id` text PRIMARY KEY NOT NULL,\n	`asset_type` text NOT NULL,\n	`name` text NOT NULL,\n	`sub` text,\n	`description` text,\n	`flags_json` text DEFAULT '[]' NOT NULL,\n	`meta_json` text DEFAULT '{}' NOT NULL,\n	`trust` text,\n	`tools_json` text,\n	`provenance` text DEFAULT 'scan' NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_inventory_asset_type` ON `inventory_asset` (`asset_type`);--\x3e statement-breakpoint\nCREATE TABLE `mcp_trust_override` (\n	`id` text PRIMARY KEY NOT NULL,\n	`asset_id` text NOT NULL,\n	`trust` text NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL,\n	FOREIGN KEY (`asset_id`) REFERENCES `inventory_asset`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_mcp_trust_override` ON `mcp_trust_override` (`asset_id`);--\x3e statement-breakpoint\nCREATE TABLE `project_file` (\n	`id` text PRIMARY KEY NOT NULL,\n	`project_id` text NOT NULL,\n	`path` text NOT NULL,\n	`name` text NOT NULL,\n	`origin` text NOT NULL,\n	`default_access` text NOT NULL,\n	`findings_count` integer DEFAULT 0 NOT NULL,\n	`blocked_at` integer,\n	`note` text,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL,\n	FOREIGN KEY (`project_id`) REFERENCES `source_project`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_project_file_project` ON `project_file` (`project_id`);--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_project_file` ON `project_file` (`project_id`,`path`);--\x3e statement-breakpoint\nCREATE TABLE `share_call_site` (\n	`id` text PRIMARY KEY NOT NULL,\n	`endpoint_id` text NOT NULL,\n	`project` text NOT NULL,\n	`file` text NOT NULL,\n	`line` integer NOT NULL,\n	`snippet` text NOT NULL,\n	`dynamic` integer DEFAULT false NOT NULL,\n	`vendored` integer DEFAULT false NOT NULL,\n	`project_id` text,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL,\n	FOREIGN KEY (`endpoint_id`) REFERENCES `share_endpoint`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_share_call_site_endpoint` ON `share_call_site` (`endpoint_id`);--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_share_call_site` ON `share_call_site` (`endpoint_id`,`project`,`file`,`line`);--\x3e statement-breakpoint\nCREATE TABLE `share_destination` (\n	`id` text PRIMARY KEY NOT NULL,\n	`kind` text NOT NULL,\n	`name` text NOT NULL,\n	`host` text NOT NULL,\n	`category` text NOT NULL,\n	`trust` text NOT NULL,\n	`note` text,\n	`network_json` text,\n	`last_seen` integer NOT NULL,\n	`provenance` text DEFAULT 'scan' NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_share_destination_kind` ON `share_destination` (`kind`);--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_share_destination_host` ON `share_destination` (`host`);--\x3e statement-breakpoint\nCREATE TABLE `share_endpoint` (\n	`id` text PRIMARY KEY NOT NULL,\n	`destination_id` text NOT NULL,\n	`method` text NOT NULL,\n	`transport` text NOT NULL,\n	`url` text NOT NULL,\n	`template` integer DEFAULT false NOT NULL,\n	`data_class` text NOT NULL,\n	`last_seen` integer NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL,\n	FOREIGN KEY (`destination_id`) REFERENCES `share_destination`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_share_endpoint_dest` ON `share_endpoint` (`destination_id`);--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_share_endpoint` ON `share_endpoint` (`destination_id`,`method`,`url`);"},{tag:"0004_glorious_mindworm",sql:"CREATE TABLE `available_packs` (\n	`id` text PRIMARY KEY NOT NULL,\n	`namespace` text NOT NULL,\n	`pack_id` text NOT NULL,\n	`version` text NOT NULL,\n	`name` text NOT NULL,\n	`rules_json` text NOT NULL,\n	`updated_at` integer NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_available_packs_pack` ON `available_packs` (`namespace`,`pack_id`);"},{tag:"0005_fast_vindicator",sql:'PRAGMA foreign_keys=OFF;--\x3e statement-breakpoint\nCREATE TABLE `__new_mcp_trust_override` (\n	`id` text PRIMARY KEY NOT NULL,\n	`asset_id` text NOT NULL,\n	`trust` text NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL\n);\n--\x3e statement-breakpoint\nINSERT INTO `__new_mcp_trust_override`("id", "asset_id", "trust", "created_at", "updated_at") SELECT "id", "asset_id", "trust", "created_at", "updated_at" FROM `mcp_trust_override`;--\x3e statement-breakpoint\nDROP TABLE `mcp_trust_override`;--\x3e statement-breakpoint\nALTER TABLE `__new_mcp_trust_override` RENAME TO `mcp_trust_override`;--\x3e statement-breakpoint\nPRAGMA foreign_keys=ON;--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_mcp_trust_override` ON `mcp_trust_override` (`asset_id`);'},{tag:"0006_magenta_flatman",sql:'CREATE TABLE `_pack_write_gate` (\n	`id` integer PRIMARY KEY NOT NULL,\n	`open` integer DEFAULT 0 NOT NULL,\n	CONSTRAINT "ck_pack_write_gate_single_row" CHECK("_pack_write_gate"."id" = 1)\n);\n--\x3e statement-breakpoint\nALTER TABLE `available_packs` ADD `recorded_by` text;--\x3e statement-breakpoint\nINSERT OR IGNORE INTO _pack_write_gate (id, open) VALUES (1, 0);\n--\x3e statement-breakpoint\nCREATE TRIGGER trg_installed_packs_write_gate\nBEFORE UPDATE OF version, name, rules_json ON installed_packs\nWHEN (SELECT open FROM _pack_write_gate WHERE id = 1) IS NOT 1\nBEGIN SELECT RAISE(IGNORE); END;'},{tag:"0007_thick_stick",sql:"CREATE TABLE `finding_resolution` (\n	`id` text PRIMARY KEY NOT NULL,\n	`finding_key` text NOT NULL,\n	`status` text NOT NULL,\n	`method` text NOT NULL,\n	`resolved_at` integer NOT NULL,\n	`evidence` text,\n	`created_at` integer NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_finding_resolution_key` ON `finding_resolution` (`finding_key`);--\x3e statement-breakpoint\nALTER TABLE `findings` ADD `finding_key` text;--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_findings_key` ON `findings` (`finding_key`);"},{tag:"0008_freezing_selene",sql:"ALTER TABLE `findings` ADD `first_detected_at` integer;--\x3e statement-breakpoint\nUPDATE `findings` SET `first_detected_at` = (SELECT `occurred_at` FROM `events` WHERE `events`.`id` = `findings`.`event_id`) WHERE `first_detected_at` IS NULL;"},{tag:"0009_findings_path_expression_index",sql:"-- Custom migration: partial expression index for the resolver's per-path reads.\n--\n-- openAtRestKeysForPath / resolvedAtRestKeysForPath (and the scanner's tier-3\n-- open-key probe) filter at-rest events by\n--   e.kind = 'code_change' AND json_extract(e.metadata, '$.filePath') = :path\n-- once per changed/deleted file on every scan — previously a full events scan\n-- per file. json_extract is deterministic, so SQLite allows it in an index;\n-- the WHERE kind = 'code_change' keeps the index to exactly the rows those\n-- queries can match (in-flight events are never path-addressed).\nCREATE INDEX `idx_events_code_change_path` ON `events` (json_extract(`metadata`, '$.filePath')) WHERE `kind` = 'code_change';\n"},{tag:"0010_events_session_expression_index",sql:"-- Custom migration: partial expression index for session-scoped finding reads.\n--\n-- sessionFindingsCount, the session-scoped listGroupedFindings paths, and the\n-- insert-time session dedup all filter live-capture events by\n--   json_extract(e.metadata, '$.sessionId') = :sessionId\n-- — previously a full findings-join scan with a JSON parse per row. The\n-- IS NOT NULL predicate keeps the index to session-stamped events only (an\n-- equality probe implies non-null, so SQLite still uses it).\nCREATE INDEX `idx_events_session_id` ON `events` (json_extract(`metadata`, '$.sessionId')) WHERE json_extract(`metadata`, '$.sessionId') IS NOT NULL;\n"},{tag:"0011_egress_writer",sql:'-- Stable per-project reconcile key for egress call sites, plus a host-keyed\n-- egress decision override that survives destination pruning.\n--\n-- DROP INDEX IF EXISTS, not a bare DROP: the applier replays a pending\n-- migration\'s non-index statements verbatim, so a store that lost\n-- uq_share_call_site out of band would throw here — and on the plugin hook path\n-- that throw is swallowed fail-open, silently stopping capture.\n--\n-- Existing rows carry the old key\'s discriminator into project_key\n-- (\'legacy:\' || project), so the new unique index is a re-encoding of the old\n-- one and cannot collide on rows the old one allowed. Leaving them on the\n-- column default would collapse two projects\' identical file/line hits onto\n-- one key and abort the whole migration. Writer keys are \'git:\'/\'path:\'-\n-- prefixed, so a backfilled row never collides with a captured one either.\n--\n-- egress_decision_override.destination_id becomes nullable with ON DELETE SET\n-- NULL, which SQLite can only do by rebuilding the table. `host` is ADDed\n-- before the rebuild so the copy has a column to read and so the migration\n-- still presents two probeable columns to the applier\'s evidence check.\nALTER TABLE `share_call_site` ADD `project_key` text DEFAULT \'\' NOT NULL;--\x3e statement-breakpoint\nUPDATE `share_call_site` SET `project_key` = \'legacy:\' || `project`;--\x3e statement-breakpoint\nDROP INDEX IF EXISTS `uq_share_call_site`;--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_share_call_site` ON `share_call_site` (`endpoint_id`,`project_key`,`file`,`line`);--\x3e statement-breakpoint\nCREATE INDEX `idx_share_call_site_project` ON `share_call_site` (`project_key`,`endpoint_id`);--\x3e statement-breakpoint\nALTER TABLE `egress_decision_override` ADD `host` text;--\x3e statement-breakpoint\nPRAGMA foreign_keys=OFF;--\x3e statement-breakpoint\nCREATE TABLE `__new_egress_decision_override` (\n	`id` text PRIMARY KEY NOT NULL,\n	`destination_id` text,\n	`host` text,\n	`decision` text NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL,\n	FOREIGN KEY (`destination_id`) REFERENCES `share_destination`(`id`) ON UPDATE no action ON DELETE set null\n);\n--\x3e statement-breakpoint\nINSERT INTO `__new_egress_decision_override`("id", "destination_id", "host", "decision", "created_at", "updated_at") SELECT "id", "destination_id", "host", "decision", "created_at", "updated_at" FROM `egress_decision_override`;--\x3e statement-breakpoint\nDROP TABLE `egress_decision_override`;--\x3e statement-breakpoint\nALTER TABLE `__new_egress_decision_override` RENAME TO `egress_decision_override`;--\x3e statement-breakpoint\nPRAGMA foreign_keys=ON;--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_egress_decision_override` ON `egress_decision_override` (`destination_id`);--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_egress_decision_override_host` ON `egress_decision_override` (`host`) WHERE `host` IS NOT NULL;\n'},{tag:"0012_handy_the_captain",sql:"ALTER TABLE `inspection_findings` ADD `finding_key` text;--\x3e statement-breakpoint\nALTER TABLE `inspection_findings` ADD `first_detected_at` integer;--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_inspection_findings_key` ON `inspection_findings` (`finding_key`);"},{tag:"0013_legacy_history_backfill_support",sql:"-- Legacy-to-generalized backfill support: the schema the resumable\n-- events/findings -> audit_events/inspection_findings copy needs (the row\n-- copy itself runs as a batched post-migration installer, not here — see\n-- @akasecurity/persistence's migrations.ts), plus the audit_events read-path\n-- indexes replacing the ones the legacy events table carried (0009/0010).\n\n-- Tracks how far the batched, resumable copy has advanced through each legacy\n-- table, by rowid, so a copy interrupted mid-run resumes instead of\n-- restarting, and a completed copy is a cheap no-op on every later open.\nCREATE TABLE `legacy_copy_watermark` (\n	`source` text PRIMARY KEY NOT NULL,\n	`last_rowid` integer DEFAULT 0 NOT NULL\n);\n--\x3e statement-breakpoint\n-- Serves the time-range read family that scans a single event_type across a\n-- start/end window (e.g. the Activity timeline) without a full-table scan.\nCREATE INDEX `idx_audit_type_t` ON `audit_events` (`event_type`,`started_at`);\n--\x3e statement-breakpoint\n-- Partial expression index mirroring `idx_events_code_change_path` (0009) for\n-- the generalized audit_events/attributes pair: file-path reads filter\n-- `event_type = 'code_change' AND json_extract(attributes, '$.file_path') = :path`.\nCREATE INDEX `idx_audit_code_change_path` ON `audit_events` (json_extract(`attributes`, '$.file_path')) WHERE `event_type` = 'code_change';\n--\x3e statement-breakpoint\n-- Synthesizes a stub session root (event_type = 'session', no attributes) for\n-- every legacy `events.metadata.sessionId` that has no audit_events row yet.\n-- audit_events.root_session_id is a self-FK, enforced with foreign-key\n-- checking on, and INSERT OR IGNORE does not suppress a foreign-key violation\n-- (only UNIQUE/PK/NOT NULL/CHECK) — so this must run before the events copy\n-- resolves root_session_id, or every session-scoped row's insert fails.\n-- started_at takes the earliest legacy occurred_at recorded under that\n-- session, so the stub root's own timeline position is never later than\n-- anything it will end up parenting.\nINSERT INTO audit_events (id, event_type, root_session_id, started_at)\nSELECT\n	json_extract(metadata, '$.sessionId'),\n	'session',\n	NULL,\n	min(occurred_at)\nFROM events\nWHERE json_valid(metadata)\n	AND json_extract(metadata, '$.sessionId') IS NOT NULL\n	AND json_extract(metadata, '$.sessionId') NOT IN (SELECT id FROM audit_events)\nGROUP BY json_extract(metadata, '$.sessionId');\n"},{tag:"0014_drop_legacy_events_findings",sql:"-- Custom migration: drops the frozen legacy `events`/`findings` tables\n-- (superseded by audit_events/inspection_definitions/inspection_findings) and\n-- replaces them with read-only views of the same name.\n--\n-- persistence's migrations.ts applies this migration ONLY once the batched\n-- history backfill (see runLegacyHistoryBackfill) has fully drained both\n-- tables, and only after copying the live file aside — see\n-- backupBeforeLegacyDrop in packages/persistence/src/migrations.ts. A store\n-- still mid-copy keeps its real tables and this migration stays pending.\n--\n-- The views exist for skew: the `aka` CLI and the Claude Code plugin update\n-- independently against one shared store, so an older, already-installed\n-- binary can open a store a newer binary already dropped these tables on.\n-- Every already-shipped repository constructor prepares its SQL eagerly at\n-- open time, so a bare \"table not found\" would fail the WHOLE open, not just\n-- a findings-specific read — these views keep `prepare()` succeeding so an\n-- old binary's unrelated features keep working; its own reads stay truthful,\n-- and its rare (already fail-open) writes fail at run time instead.\n--\n-- The 0009/0010 expression indexes existed only over the legacy `events`\n-- table; DROP TABLE below would remove them implicitly, but they are\n-- dropped explicitly first so the intent reads clearly. IF EXISTS so a store\n-- that reached here with an index missing out of band (an adopted-tag store\n-- whose physical index was never built) does not throw a deterministic \"no\n-- such index\" out of the fail-open drop path.\nDROP INDEX IF EXISTS `idx_events_code_change_path`;\n--\x3e statement-breakpoint\nDROP INDEX IF EXISTS `idx_events_session_id`;\n--\x3e statement-breakpoint\n-- `findings.event_id` references `events.id` — drop the child first.\nDROP TABLE `findings`;\n--\x3e statement-breakpoint\nDROP TABLE `events`;\n--\x3e statement-breakpoint\n-- Legacy `events` shape, projected from audit_events: `kind`/`occurred_at`/\n-- `source_tool` become real columns again (source_tool round-trips through\n-- the attributes bag, the only place a capture-typed audit row keeps it);\n-- `metadata` is reconstructed as the old camelCase JSON object from the new\n-- snake_case attributes bag, with `root_session_id` folded back in as\n-- `sessionId` (the one legacy metadata key that became a column, never an\n-- attribute, on the new table). Constrained to the four capture kinds so\n-- structural rows (session/run/tool_call/llm_call/source_lookup/config_scan)\n-- never leak into a legacy reader's result set — the old `events` table\n-- never held them either.\nCREATE VIEW `events` AS\nSELECT\n  id,\n  json_extract(attributes, '$.source_tool') AS source_tool,\n  event_type AS kind,\n  started_at AS occurred_at,\n  content_hash,\n  content,\n  -- Plugin-local bookkeeping column that `ensureSyncedAtColumn` adds to the\n  -- real `events` table at open time. A pre-cutover binary runs that probe on\n  -- EVERY open; without this projection its `columnNames('events')` check\n  -- misses `synced_at` and issues `ALTER TABLE events ADD COLUMN` against this\n  -- view, which SQLite rejects (\"Cannot add a column to a view\") — a hard,\n  -- non-fail-open crash of the whole open, the exact skew failure these views\n  -- exist to prevent. Projecting it (always NULL; no reader consumes it)\n  -- short-circuits that ALTER.\n  NULL AS synced_at,\n  json_object(\n    'sessionId', root_session_id,\n    'repo', json_extract(attributes, '$.repo'),\n    'filePath', json_extract(attributes, '$.file_path'),\n    'toolName', json_extract(attributes, '$.tool_name'),\n    'gitignored', json_extract(attributes, '$.gitignored'),\n    'wholeFile', json_extract(attributes, '$.whole_file'),\n    'model', json_extract(attributes, '$.model'),\n    'turnIndex', json_extract(attributes, '$.turn_index'),\n    'correlationId', json_extract(attributes, '$.correlation_id'),\n    'traceId', json_extract(attributes, '$.trace_id'),\n    'exceptionIds', json_extract(attributes, '$.exception_ids')\n  ) AS metadata\nFROM audit_events\nWHERE event_type IN ('prompt', 'response', 'code_change', 'tool_use');\n--\x3e statement-breakpoint\n-- A plain single-row INSERT (the old writer's shape — no ON CONFLICT) is\n-- accepted by prepare() against a view once an INSTEAD OF INSERT trigger\n-- exists, so it fails at run time instead of at open — landing in the same\n-- fail-open path the caller already wraps its write in.\nCREATE TRIGGER `trg_events_ro`\nINSTEAD OF INSERT ON `events`\nBEGIN SELECT RAISE(ABORT, 'events is read-only; write to audit_events instead'); END;\n--\x3e statement-breakpoint\n-- Legacy `findings` shape: rule_id/category/severity come from the joined\n-- inspection_definitions row (the legacy table inlined them per-row; the\n-- generalized schema normalizes them out into the shared definition). A view\n-- has no rowid of its own, so the underlying table's rowid is re-exposed\n-- explicitly under that name — a legacy reader ordering by `f.rowid` would\n-- otherwise fail to resolve the column at all. Joined to audit_events for the\n-- same four-capture-kind constraint as the events view above (a finding\n-- attached to a tool_call/config_scan row never existed in the legacy table\n-- either — see the persistence findings repository's identical predicate).\nCREATE VIEW `findings` AS\nSELECT\n  f.id AS id,\n  f.rowid AS rowid,\n  f.audit_event_id AS event_id,\n  d.rule_id AS rule_id,\n  d.category AS category,\n  d.severity AS severity,\n  f.span_start AS span_start,\n  f.span_end AS span_end,\n  f.masked_match AS masked_match,\n  f.action_taken AS action_taken,\n  f.confidence AS confidence,\n  f.finding_key AS finding_key,\n  f.first_detected_at AS first_detected_at\nFROM inspection_findings f\nJOIN audit_events e ON e.id = f.audit_event_id\nJOIN inspection_definitions d ON d.id = f.inspection_definition_id\nWHERE e.event_type IN ('prompt', 'response', 'code_change', 'tool_use');\n--\x3e statement-breakpoint\n-- Defense in depth only: SQLite refuses to plan ANY upsert against a view\n-- (\"cannot UPSERT a view\") no matter what trigger exists, so this can never\n-- rescue the real legacy writer, which always used\n-- `ON CONFLICT (finding_key) DO UPDATE` — that statement still fails at\n-- prepare() on an old binary, same as it would with no trigger at all. This\n-- only covers a plain-INSERT shape, should one ever exist.\nCREATE TRIGGER `trg_findings_ro`\nINSTEAD OF INSERT ON `findings`\nBEGIN SELECT RAISE(ABORT, 'findings is read-only; write to inspection_findings instead'); END;\n"},{tag:"0015_busy_vengeance",sql:"CREATE TABLE `secret_vault` (\n	`pointer_id` text PRIMARY KEY NOT NULL,\n	`value_fingerprint` text NOT NULL,\n	`fingerprint_key_version` integer NOT NULL,\n	`key_version` integer NOT NULL,\n	`category` text NOT NULL,\n	`rule_id` text NOT NULL,\n	`masked_match` text NOT NULL,\n	`provider` text,\n	`ciphertext` text NOT NULL,\n	`nonce` text NOT NULL,\n	`auth_tag` text NOT NULL,\n	`occurrence_count` integer DEFAULT 1 NOT NULL,\n	`first_seen` integer NOT NULL,\n	`last_seen` integer NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_secret_vault_value` ON `secret_vault` (`value_fingerprint`);--\x3e statement-breakpoint\nCREATE TABLE `secret_vault_deref` (\n	`id` text PRIMARY KEY NOT NULL,\n	`pointer_id` text NOT NULL,\n	`at` integer NOT NULL,\n	`target` text NOT NULL,\n	`reason` text NOT NULL,\n	`outcome` text NOT NULL,\n	`grant_id` text,\n	`pointer_count` integer DEFAULT 1 NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_secret_vault_deref_pointer` ON `secret_vault_deref` (`pointer_id`);--\x3e statement-breakpoint\nCREATE INDEX `idx_secret_vault_deref_reason_at` ON `secret_vault_deref` (`reason`,`at`);"},{tag:"0016_breezy_zodiak",sql:"ALTER TABLE `exceptions` ADD `capability` text DEFAULT 'suppress' NOT NULL;"},{tag:"0017_rainy_kat_farrell",sql:"CREATE TABLE `secret_vault_sighting` (\n	`id` text PRIMARY KEY NOT NULL,\n	`pointer_id` text NOT NULL,\n	`location` text NOT NULL,\n	`kind` text NOT NULL,\n	`first_seen` integer NOT NULL,\n	`last_seen` integer NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_secret_vault_sighting` ON `secret_vault_sighting` (`pointer_id`,`location`);"},{tag:"0018_serious_tana_nile",sql:"ALTER TABLE `secret_vault` ADD `format_version` integer DEFAULT 2 NOT NULL;"},{tag:"0019_audit_started_at_index",sql:"CREATE INDEX `idx_audit_started_at` ON `audit_events` (`started_at`);"},{tag:"0020_secret_vault_pagination_indexes",sql:"CREATE INDEX `idx_secret_vault_last_seen` ON `secret_vault` (`last_seen`,`pointer_id`);--\x3e statement-breakpoint\nCREATE INDEX `idx_secret_vault_reuse` ON `secret_vault` (`occurrence_count`,`pointer_id`);--\x3e statement-breakpoint\nCREATE INDEX `idx_secret_vault_deref_at` ON `secret_vault_deref` (`at`,`id`);--\x3e statement-breakpoint\nCREATE INDEX `idx_secret_vault_deref_signal` ON `secret_vault_deref` (`at`,`id`) WHERE `reason` NOT IN ('display', 'view-render');"},{tag:"0021_finding_resolution_resolved_at_index",sql:"CREATE INDEX `idx_finding_resolution_resolved_at` ON `finding_resolution` (`resolved_at`);\n"},{tag:"0022_audit_inspection_ms",sql:"ALTER TABLE `audit_events` ADD `inspection_ms` integer GENERATED ALWAYS AS (json_extract(attributes, '$.inspection_ms')) VIRTUAL;"},{tag:"0023_secret_vault_user_authorized",sql:"ALTER TABLE `secret_vault` ADD `user_authorized` integer DEFAULT 0 NOT NULL;"},{tag:"0024_finding_resolution_key_created_index",sql:"DROP INDEX IF EXISTS `idx_finding_resolution_key`;--\x3e statement-breakpoint\nCREATE INDEX `idx_finding_resolution_key_created` ON `finding_resolution` (`finding_key`,`created_at`);"},{tag:"0025_audit_capture_attribute_columns",sql:"ALTER TABLE `audit_events` ADD `source_tool` text GENERATED ALWAYS AS (json_extract(attributes, '$.source_tool')) VIRTUAL;--\x3e statement-breakpoint\nALTER TABLE `audit_events` ADD `repo` text GENERATED ALWAYS AS (json_extract(attributes, '$.repo')) VIRTUAL;--\x3e statement-breakpoint\nALTER TABLE `audit_events` ADD `file_path` text GENERATED ALWAYS AS (json_extract(attributes, '$.file_path')) VIRTUAL;--\x3e statement-breakpoint\nALTER TABLE `audit_events` ADD `tool_name` text GENERATED ALWAYS AS (json_extract(attributes, '$.tool_name')) VIRTUAL;"},{tag:"0026_audit_llm_call_usage_columns",sql:"ALTER TABLE `audit_events` ADD `service_tier` text GENERATED ALWAYS AS (json_extract(attributes, '$.service_tier')) VIRTUAL;--\x3e statement-breakpoint\nALTER TABLE `audit_events` ADD `ephemeral_1h_input_tokens` integer GENERATED ALWAYS AS (json_extract(attributes, '$.ephemeral_1h_input_tokens')) VIRTUAL;--\x3e statement-breakpoint\nALTER TABLE `audit_events` ADD `ephemeral_5m_input_tokens` integer GENERATED ALWAYS AS (json_extract(attributes, '$.ephemeral_5m_input_tokens')) VIRTUAL;--\x3e statement-breakpoint\nALTER TABLE `audit_events` ADD `web_search_requests` integer GENERATED ALWAYS AS (json_extract(attributes, '$.web_search_requests')) VIRTUAL;"},{tag:"0027_audit_llm_usage_index",sql:"CREATE INDEX `idx_audit_llm_usage` ON `audit_events` (`started_at`,`root_session_id`,`provider`,`model`,`service_tier`,`input_tokens`,`output_tokens`,`cache_creation_input_tokens`,`cache_read_input_tokens`,`ephemeral_1h_input_tokens`,`ephemeral_5m_input_tokens`,`web_search_requests`) WHERE event_type = 'llm_call' AND attributes IS NOT NULL;"},{tag:"0028_activity_session_probe_indexes",sql:"CREATE INDEX `idx_audit_session_prompt` ON `audit_events` (`root_session_id`) WHERE event_type = 'prompt';--\x3e statement-breakpoint\nCREATE INDEX `idx_audit_session_share` ON `audit_events` (`root_session_id`) WHERE event_type = 'share';--\x3e statement-breakpoint\nCREATE INDEX `idx_audit_ended_at` ON `audit_events` (`ended_at`,`root_session_id`) WHERE ended_at IS NOT NULL;--\x3e statement-breakpoint\nCREATE INDEX `idx_audit_session_ended` ON `audit_events` (`root_session_id`,`ended_at`) WHERE ended_at IS NOT NULL;--\x3e statement-breakpoint\n-- Expression index for the activity list's turns rollup: a live-captured\n-- session's turns are the DISTINCT `run_key` across its `llm_call` leaves, and\n-- carrying the extracted key in the index answers that count from the index\n-- alone instead of parsing every leaf's attribute bag. Written by hand, as\n-- 0013's `idx_audit_code_change_path` was: drizzle-kit cannot emit an\n-- expression containing a comma, so this index is not declared in sqlite.ts.\nCREATE INDEX `idx_audit_session_run_key` ON `audit_events` (`root_session_id`, json_extract(`attributes`, '$.run_key')) WHERE `event_type` = 'llm_call';\n"}],e=/^(\d+)([mh])$/;function f(a,b=Date.now()){let c=a.trim().toLowerCase();return"once"===c?{scope:"once",expiresAt:new Date(b+18e5).toISOString(),maxUses:1}:"permanent"===c?{scope:"permanent",expiresAt:null,maxUses:null}:{scope:"temporary",expiresAt:new Date(b+function(a){let b=e.exec(a.trim()),c=b?Number(b[1]):0;if(!b||c<=0)throw Error(`invalid duration '${a}' — use <n>m or <n>h (e.g. 30m, 1h, 24h)`);let d=c*("h"===b[2]?36e5:6e4);if(d>864e5)throw Error(`duration '${a}' exceeds the 24h maximum for --for — use --permanent (revocable any time) for an open-ended grant`);return d}(c)).toISOString(),maxUses:null}}var g=c(86879);let h=g.Ik({thresholdInputTokens:g.ai().int().positive(),input:g.ai().nonnegative().nullable(),output:g.ai().nonnegative().nullable()});function i(a,b,c){return Object.freeze({input:a,output:b,longContext:null,cacheWrite5m:1.25*a,cacheWrite1h:2*a,cacheRead:c,webSearch:.01})}function j(a,b,c={}){return Object.freeze({input:a,output:b,longContext:void 0===c.longContext?null:Object.freeze(c.longContext),cacheWrite5m:null,cacheWrite1h:null,cacheRead:c.cacheRead??null,webSearch:null})}g.Ik({input:g.ai().nonnegative(),output:g.ai().nonnegative(),longContext:h.nullable(),cacheWrite5m:g.ai().nonnegative().nullable(),cacheWrite1h:g.ai().nonnegative().nullable(),cacheRead:g.ai().nonnegative().nullable(),webSearch:g.ai().nonnegative().nullable()});let k=Object.freeze({input:0,output:0,longContext:null,cacheWrite5m:0,cacheWrite1h:0,cacheRead:0,webSearch:0}),l=new Map([["standard",1],["batch",.5],["priority",1.5]]);g.k5(["anthropic","openai","google","meta","mistral","deepseek","alibaba","xai","amazon","cohere","unknown"]),g.k5(["anthropic","openai","google-ai","mistral","deepseek","xai","cohere","bedrock","vertex","azure","foundry","together","fireworks","groq","openrouter","ollama","local"]),g.k5(["api","gateway","local"]);let m=new Map([["anthropic","api"],["openai","api"],["google-ai","api"],["mistral","api"],["deepseek","api"],["xai","api"],["cohere","api"],["bedrock","api"],["vertex","api"],["azure","api"],["foundry","api"],["together","gateway"],["fireworks","gateway"],["groq","gateway"],["openrouter","gateway"],["ollama","local"],["local","local"]]);function n(a){return m.get(a)??"api"}let o=new Map([["anthropic","anthropic"],["openai","openai"],["google","google-ai"],["mistral","mistral"],["deepseek","deepseek"],["xai","xai"],["cohere","cohere"]]),p=Object.freeze(["anthropic","amazon","meta","mistral","deepseek","qwen","cohere","ai21","writer","luma","stability"]),q=Object.freeze(["us","eu","apac","au","jp","global"]);class r{constructor(a,b={}){this.entries=[],this.vendor=a,this.defaults=b}model(a,b){var c,d;let e=b.family??this.defaults.family??{id:a,name:b.name},f=!1===b.firstParty?null:(c=this.vendor,o.get(c)??null),g=b.openWeights??this.defaults.openWeights??!1,h=b.region??this.defaults.region??null,i=b.retention??this.defaults.retention??"unknown",j=new Map;for(let a of(null!==f&&j.set(f,Object.freeze({platform:f,hosting:n(f),firstParty:!0,price:b.price??null,retention:i,region:h})),b.on??[])){let{platform:c,price:e,retention:f,region:g}="string"==typeof a?{platform:a}:a,l=(d=this.vendor,o.get(d)===c),m=n(c),p="local"===m;j.set(c,Object.freeze({platform:c,hosting:m,firstParty:l,price:e??(p?k:l?b.price??null:null),retention:f??(p?"on_infrastructure":l?i:"unknown"),region:void 0===g?l?h:null:g}))}let l=b.defaultHosting??this.defaults.defaultHosting??(null===f?"gateway":n(f));if(void 0!==b.price&&![...j.values()].some(a=>a.price===b.price))throw Error(`${a}: a first-party price was declared but no platform can carry it — vendor '${this.vendor}' has no first-party endpoint. Price the serving platform explicitly via the object form of \`on\`.`);let m={id:a,vendor:this.vendor,displayName:b.name,familyId:e.id,familyName:e.name,capability:b.capability??null,contextWindow:b.ctx??null,maxOutputTokens:b.maxOut??null,openWeights:g,aliases:Object.freeze([...b.aliases??[]]),training:this.defaults.training??null,platforms:j,defaultHosting:l,seen:b.seen??"managed"};return Object.freeze(m),Object.freeze(m.aliases),this.entries.push(m),m}models(){return this.entries}}function s(a,b={}){return new r(a,b)}let t=RegExp(`^(?:${q.join("|")})\\.`,"u"),u=RegExp(`^(?:${p.join("|")})\\.`,"u"),v=RegExp(`^(?:${p.join("|")})/`,"iu"),w=/^[a-z0-9][\w.-]*\//iu,x=/-v\d+:\d+$/u,y=/:\d+$/u,z=/@[\w-]+$/u,A=/-\d{8}$/u;function B(a,b){let c,d,e=b.byId.get(a);if(void 0!==e)return{entry:e,canonicalId:a,platform:null,raw:a};let{id:f,platform:g}=(c=a.trim(),d=null,t.test(c)&&(c=c.replace(t,""),d="bedrock"),u.test(c)&&(c=c.replace(u,""),d??="bedrock"),x.test(c)?(c=c.replace(x,""),d??="bedrock"):y.test(c)&&(c=c.replace(y,""),d??="bedrock"),z.test(c)&&(c=c.replace(z,""),d??="vertex"),v.test(c)?c=c.replace(v,""):w.test(c)&&(c=c.replace(w,"")),{id:c,platform:d}),h=b.byId.get(f);if(void 0!==h)return{entry:h,canonicalId:f,platform:g,raw:a};if(A.test(f)){let c=f.replace(A,""),d=b.byId.get(c);if(void 0!==d)return{entry:d,canonicalId:c,platform:g,raw:a}}return{entry:null,canonicalId:a,platform:g,raw:a}}let C=s("anthropic",{family:{id:"claude",name:"Claude"},region:"us",retention:"zero_retention",training:{apiDefault:"no",consumerDefault:"no",consumerControl:"opt-in",source:"https://privacy.claude.com/en/articles/7996868-is-my-data-used-for-model-training"}}),D=["bedrock","vertex","foundry"];C.model("claude-fable-5-1",{name:"Claude Fable 5.1",ctx:1e6,maxOut:128e3,capability:"reasoning",price:i(10,50,.25),on:[...D]}),C.model("claude-fable-5",{name:"Claude Fable 5",capability:"reasoning",price:i(10,50,1),on:[...D]}),C.model("claude-opus-5",{name:"Claude Opus 5",ctx:1e6,maxOut:128e3,capability:"reasoning",price:i(5,25,.5),on:[...D]}),C.model("claude-opus-4-8",{name:"Claude Opus 4.8",capability:"reasoning",price:i(5,25,.5),on:[...D]}),C.model("claude-opus-4-7",{name:"Claude Opus 4.7",capability:"reasoning",price:i(5,25,.5),on:[...D]}),C.model("claude-opus-4-6",{name:"Claude Opus 4.6",capability:"reasoning",price:i(5,25,.5),on:[...D]}),C.model("claude-opus-4-5",{name:"Claude Opus 4.5",capability:"reasoning",price:i(5,25,.5),on:[...D]}),C.model("claude-opus-4-1",{name:"Claude Opus 4.1",capability:"reasoning",price:i(15,75,1.5),on:[...D]}),C.model("claude-sonnet-5",{name:"Claude Sonnet 5",ctx:1e6,maxOut:128e3,capability:"reasoning",price:i(2,10,.2),on:[...D]}),C.model("claude-sonnet-4-6",{name:"Claude Sonnet 4.6",capability:"reasoning",price:i(3,15,.3),on:[...D]}),C.model("claude-sonnet-4-5",{name:"Claude Sonnet 4.5",capability:"reasoning",price:i(3,15,.3),on:[...D]}),C.model("claude-haiku-4-5",{name:"Claude Haiku 4.5",ctx:2e5,maxOut:64e3,capability:null,price:i(1,5,.1),aliases:["claude-haiku-4-5-20251001"],on:[...D]}),C.model("claude-sonnet-3-7",{name:"Claude Sonnet 3.7",on:[...D]});let E={thresholdInputTokens:272e3,input:null,output:null},F=s("openai",{family:{id:"gpt",name:"GPT"},region:"us",retention:"configurable",training:{apiDefault:"no",consumerDefault:"yes",consumerControl:"opt-out",source:"https://developers.openai.com/api/docs/guides/your-data"}}),G=["azure","foundry"];F.model("gpt-5.6-sol",{name:"GPT-5.6 Sol",ctx:105e4,maxOut:128e3,capability:"reasoning",price:j(4,20,{cacheRead:.4,longContext:E}),on:[...G]}),F.model("gpt-5.6-terra",{name:"GPT-5.6 Terra",ctx:105e4,maxOut:128e3,capability:"reasoning",price:j(2,12,{cacheRead:.2,longContext:E}),on:[...G]}),F.model("gpt-5.6-luna",{name:"GPT-5.6 Luna",ctx:105e4,maxOut:128e3,capability:null,price:j(.2,1.2,{cacheRead:.02,longContext:E}),on:[...G]}),F.model("gpt-5.5",{name:"GPT-5.5",ctx:105e4,maxOut:128e3,capability:"reasoning",price:j(5,30,{cacheRead:.5,longContext:E}),on:[...G]}),F.model("gpt-5.4",{name:"GPT-5.4",ctx:105e4,maxOut:128e3,capability:"reasoning",price:j(2.5,15,{cacheRead:.25,longContext:E}),on:[...G]}),F.model("gpt-5.4-mini",{name:"GPT-5.4 mini",ctx:4e5,maxOut:128e3,capability:null,price:j(.75,4.5,{cacheRead:.075}),on:[...G]}),F.model("gpt-5.4-nano",{name:"GPT-5.4 nano",ctx:4e5,maxOut:128e3,capability:null,price:j(.2,1.25,{cacheRead:.02}),on:[...G]}),F.model("gpt-5.3-codex",{name:"GPT-5.3 Codex",ctx:4e5,maxOut:128e3,capability:"code",price:j(1.75,14,{cacheRead:.175}),on:[...G]}),F.model("gpt-5.1",{name:"GPT-5.1",ctx:4e5,maxOut:128e3,capability:"reasoning",price:j(1.25,10,{cacheRead:.125}),on:[...G]}),F.model("gpt-5",{name:"GPT-5",ctx:4e5,maxOut:128e3,capability:"reasoning",price:j(1.25,10,{cacheRead:.125}),on:[...G]}),F.model("gpt-5-mini",{name:"GPT-5 mini",ctx:4e5,capability:null,price:j(.25,2,{cacheRead:.025}),on:[...G]}),F.model("gpt-5-nano",{name:"GPT-5 nano",ctx:4e5,maxOut:128e3,capability:null,price:j(.05,.4,{cacheRead:.005}),on:[...G]}),F.model("gpt-4.1",{name:"GPT-4.1",price:j(2,8,{cacheRead:.5}),on:[...G]}),F.model("gpt-4o",{name:"GPT-4o",price:j(2.5,10,{cacheRead:1.25}),on:[...G]}),F.model("gpt-4o-mini",{name:"GPT-4o mini",price:j(.15,.6,{cacheRead:.075}),on:[...G]}),F.model("gpt-4-turbo",{name:"GPT-4 Turbo",seen:"discovered",price:j(10,30),aliases:["gpt-4-turbo-2024-04-09"],on:[...G]}),F.model("o3",{name:"o3",capability:"reasoning",price:j(2,8,{cacheRead:.5}),on:[...G]}),F.model("gpt-oss-120b",{name:"GPT-OSS 120B",openWeights:!0,firstParty:!1,retention:"unknown",defaultHosting:"local",on:["together","fireworks","groq","openrouter","bedrock","ollama","local"]}),F.model("gpt-oss-20b",{name:"GPT-OSS 20B",openWeights:!0,firstParty:!1,retention:"unknown",defaultHosting:"local",on:["together","fireworks","groq","openrouter","ollama","local"]});let H=s("google",{family:{id:"gemini",name:"Gemini"},region:"us",retention:"configurable",training:{apiDefault:"no",consumerDefault:"yes",consumerControl:"none",source:"https://ai.google.dev/gemini-api/terms"}});H.model("gemini-3.7-flash",{name:"Gemini 3.7 Flash",capability:null,price:j(.75,3.75),on:["vertex"]}),H.model("gemini-3.6-flash",{name:"Gemini 3.6 Flash",capability:null,price:j(.75,3.75),on:["vertex"]}),H.model("gemini-3.5-flash",{name:"Gemini 3.5 Flash",capability:null,price:j(1.5,9),on:["vertex"]}),H.model("gemini-3.5-flash-lite",{name:"Gemini 3.5 Flash Lite",capability:null,price:j(.3,2.5),on:["vertex"]}),H.model("gemini-3.1-pro-preview",{name:"Gemini 3.1 Pro Preview",capability:"reasoning",price:j(2,12,{longContext:{thresholdInputTokens:2e5,input:4,output:18}}),on:["vertex"]}),H.model("gemini-2.5-pro",{name:"Gemini 2.5 Pro",capability:"reasoning",price:j(1.25,10,{longContext:{thresholdInputTokens:2e5,input:2.5,output:15}}),on:["vertex"]}),H.model("gemini-2.5-flash",{name:"Gemini 2.5 Flash",capability:null,price:j(.3,2.5),on:["vertex"]}),H.model("gemini-2.5-flash-lite",{name:"Gemini 2.5 Flash Lite",capability:null,price:j(.1,.4),on:["vertex"]}),H.model("gemini-1-5-pro",{name:"Gemini 1.5 Pro",on:["vertex"]}),H.model("gemini-1-5-flash",{name:"Gemini 1.5 Flash",on:["vertex"]});let I=s("xai",{family:{id:"grok",name:"Grok"},region:"us",retention:"configurable",training:{apiDefault:"no",consumerDefault:"unknown",consumerControl:"unknown",source:"https://docs.x.ai/developers/faq/security"}});I.model("grok-4.6",{name:"Grok 4.6",ctx:5e5,capability:"reasoning",price:j(2,6,{cacheRead:.5,longContext:{thresholdInputTokens:2e5,input:4,output:12}}),on:["bedrock"]}),I.model("grok-4.5",{name:"Grok 4.5",ctx:5e5,capability:"reasoning",price:j(2,6,{cacheRead:.3,longContext:{thresholdInputTokens:2e5,input:4,output:12}})}),I.model("grok-4.3",{name:"Grok 4.3",ctx:1e6,capability:"reasoning",price:j(1.25,2.5,{cacheRead:.2,longContext:{thresholdInputTokens:2e5,input:2.5,output:5}}),on:["bedrock"]}),I.model("grok-build-0.1",{name:"Grok Build 0.1",ctx:256e3,capability:"code",price:j(1,2,{cacheRead:.2,longContext:{thresholdInputTokens:2e5,input:2,output:4}})});let J=s("deepseek",{family:{id:"deepseek",name:"DeepSeek"},region:"cn",retention:"configurable",training:{apiDefault:"yes",consumerDefault:"yes",consumerControl:"opt-out",source:"https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html"}});J.model("deepseek-v4-flash",{name:"DeepSeek V4 Flash",ctx:1e6,capability:null,price:j(.44,1.32,{cacheRead:.014}),on:["bedrock","together","fireworks","openrouter","ollama","local"]}),J.model("deepseek-v4-pro",{name:"DeepSeek V4 Pro",ctx:1e6,capability:"reasoning",price:j(1.32,3.96,{cacheRead:.044}),on:["bedrock","together","fireworks","openrouter"]}),J.model("deepseek-r1",{name:"DeepSeek R1",seen:"discovered",capability:"reasoning",openWeights:!0,defaultHosting:"local",on:["bedrock","together","fireworks","openrouter","ollama","local"]});let K=s("cohere",{family:{id:"command",name:"Command"},region:"us",retention:"configurable",training:{apiDefault:"unknown",consumerDefault:"unknown",consumerControl:"opt-out",source:"https://cohere.com/security"}});K.model("command-a-plus-05-2026",{name:"Command A+",ctx:128e3,maxOut:64e3,on:["bedrock"]}),K.model("command-a-03-2025",{name:"Command A",ctx:256e3,maxOut:8e3,on:["bedrock"]}),K.model("command-a-reasoning-08-2025",{name:"Command A Reasoning",ctx:256e3,maxOut:32e3,capability:"reasoning"}),K.model("command-r-plus-08-2024",{name:"Command R+",ctx:128e3,maxOut:4e3,price:j(2.5,10),aliases:["command-r-plus"],on:["bedrock"]});let L=s("meta",{family:{id:"llama",name:"Llama"},openWeights:!0,retention:"unknown",defaultHosting:"local"}),M=["bedrock","together","fireworks","groq","openrouter","ollama","local"];L.model("llama-3-3-70b",{name:"Llama 3.3 70B",ctx:128e3,on:[...M]}),L.model("llama-3-1-70b",{name:"Llama 3.1 70B",ctx:128e3,on:[...M]}),L.model("llama-3-1-8b",{name:"Llama 3.1 8B",ctx:128e3,on:[...M]});let N=s("alibaba",{family:{id:"qwen",name:"Qwen"},openWeights:!0,retention:"unknown",defaultHosting:"local"});N.model("qwen-3-235b",{name:"Qwen 3 235B",on:[...M]}),N.model("qwen-3-coder-480b",{name:"Qwen 3 Coder 480B",capability:"code",on:[...M]});let O=s("amazon",{family:{id:"nova",name:"Nova"},retention:"configurable"});O.model("nova-2-lite",{name:"Nova 2 Lite",ctx:1e6,maxOut:64e3,aliases:["nova-2-lite-v1:0"],on:["bedrock"]});let P=s("mistral",{family:{id:"mistral",name:"Mistral"},openWeights:!0,retention:"unknown",defaultHosting:"local"});P.model("mixtral-8x7b",{name:"Mixtral 8x7B",seen:"discovered",on:[...M]});let Q=function(a){let b=new Map;for(let c of a)b.set(c.id,c);for(let c of a)for(let a of c.aliases)b.has(a)||b.set(a,c);return{byId:b,entries:Object.freeze([...a])}}(Object.freeze([...C.models(),...F.models(),...H.models(),...I.models(),...J.models(),...K.models(),...P.models(),...L.models(),...N.models(),...O.models()]));g.k5(["reasoning","code"]),g.k5(["zero_retention","no_storage","configurable","on_device","on_infrastructure","unknown"]),g.k5(["managed","discovered"]);let R=g.k5(["yes","no","unknown"]),S=g.k5(["opt-in","opt-out","none","unknown"]);g.Ik({apiDefault:R,consumerDefault:R,consumerControl:S,source:g.Yj().nullable()});let T=g.k5(["api","consumer","enterprise","unknown"]);function U(a){return new Date(a).getTime()}function V(a){return new Date(a).toISOString()}g.Ik({tier:T,controlExercised:g.zM().nullable()}),Object.freeze({tier:"unknown",controlExercised:null});let W=new Map([["anthropic","anthropic"],["openai","openai"],["google","google-ai"],["google-ai","google-ai"],["bedrock","bedrock"],["vertex","vertex"],["azure","azure"],["foundry","foundry"],["mistral","mistral"],["deepseek","deepseek"],["xai","xai"],["cohere","cohere"],["together","together"],["fireworks","fireworks"],["groq","groq"],["openrouter","openrouter"],["ollama","ollama"],["local","local"]]);function X(a){return W.get(a.trim().toLowerCase())??null}function Y(a){let b=X(a);return null!==b&&"local"===n(b)}Object.freeze(["gateway","unknown","cli","api"]);let Z={normalizeModelId(a,b){let c=a.trim().toLowerCase();if(Y(c))return{provider:c,model:"*"};let d=B(b,Q);return{provider:c,model:d.entry?.id??b}},costFor({provider:a,model:b,usage:c}){let d=function(a,b){if(Y(a))return k;let c=B(b,Q);if(null===c.entry)return null;let d=c.platform??X(a);return null===d?null:c.entry.platforms.get(d)?.price??null}(a,b);return null===d?null:function(a,b){var c;let d=[[b.cacheWrite1hTokens??0,a.cacheWrite1h],[b.cacheWrite5mTokens??0,a.cacheWrite5m],[b.cacheReadTokens??0,a.cacheRead]],e=null!==a.longContext&&(b.inputTokens??0)>a.longContext.thresholdInputTokens?a.longContext:null;if(null!==e&&(null===e.input||null===e.output))return null;let f=e?.input??a.input,g=e?.output??a.output,h=(b.inputTokens??0)*f+(b.outputTokens??0)*g;for(let[a,b]of d)if(0!==a){if(null===b)return null;h+=a*b}let i=h/1e6*(void 0===(c=b.serviceTier)?1:l.get(c)??1),j=b.webSearchRequests??0;return j>0&&null===a.webSearch?null:i+j*(a.webSearch??0)}(d,c)}};new Intl.NumberFormat("en-US",{notation:"compact",maximumFractionDigits:1});let $=a=>a??0;function _(a,b){let c=new Map;for(let{sessionId:d,attributes:e}of a){let a=e.provider??"unknown",f=e.model??"unknown",g=`${a} ${f}`,h=c.get(d);void 0===h&&(h=new Map,c.set(d,h));let i=h.get(g);void 0===i&&(i={provider:a,model:f,input:0,output:0,cacheCreation:0,cacheRead:0,costUsd:0,priced:!1},h.set(g,i)),i.input+=$(e.input_tokens),i.output+=$(e.output_tokens),i.cacheCreation+=$(e.cache_creation_input_tokens),i.cacheRead+=$(e.cache_read_input_tokens);let j=b.costFor({provider:a,model:f,usage:function(a){let b={inputTokens:$(a.input_tokens),outputTokens:$(a.output_tokens),cacheWrite1hTokens:$(a.ephemeral_1h_input_tokens),cacheWrite5mTokens:$(a.ephemeral_5m_input_tokens),cacheReadTokens:$(a.cache_read_input_tokens),webSearchRequests:$(a.web_search_requests)};return void 0!==a.service_tier&&(b.serviceTier=a.service_tier),b}(e)});null!==j&&(i.costUsd+=j,i.priced=!0)}let d=[];for(let[a,b]of c){let c=[],e=0,f=0,g=!1,h=!1;for(let d of b.values()){let b=d.input+d.output+d.cacheCreation+d.cacheRead;e+=b;let i=d.priced?d.costUsd:null;null===i?h=!0:(g=!0,f+=i),c.push({sessionId:a,model:d.model,provider:d.provider,inputTokens:d.input,outputTokens:d.output,cacheCreation:d.cacheCreation,cacheRead:d.cacheRead,totalTokens:b,estimatedCostUsd:i})}c.sort((a,b)=>b.totalTokens-a.totalTokens),d.push({sessionId:a,rollups:c,totalTokens:e,estimatedCostUsd:g?f:null,costIsPartial:h})}return d.sort((a,b)=>b.totalTokens-a.totalTokens),d}var aa=c(81852),ab=c(31518);let ac={ClaudeCode:"claudecode",Cursor:"cursor",Copilot:"copilot",Codex:"codex",Antigravity:"antigravity",Windsurf:"windsurf",ClaudeDesktop:"claudedesktop",ChatGpt:"chatgpt",ClaudeAi:"claudeai",Api:"api"},ad=g.k5(ac).meta({id:"Harness"}),ae={ClaudeCode:"claude-code",ClaudeDesktop:"claude-desktop",Cursor:"cursor",ChatGpt:"chatgpt",ClaudeAi:"claude-ai",Copilot:"github-copilot",Codex:"codex",Antigravity:"antigravity",Cli:"cli",Unknown:"unknown"},af=g.k5(ae).meta({id:"SourceTool"}),ag={[ae.ClaudeCode]:ac.ClaudeCode,[ae.ClaudeDesktop]:ac.ClaudeDesktop,[ae.Copilot]:ac.Copilot,[ae.Cursor]:ac.Cursor,[ae.ChatGpt]:ac.ChatGpt,[ae.Codex]:ac.Codex,[ae.Antigravity]:ac.Antigravity,[ae.ClaudeAi]:ac.ClaudeAi},ah=g.k5(["pii","financial","secret","phi","code_context","code_flaw","custom","config"]).meta({id:"DetectionCategory"}),ai=g.k5(["critical","high","medium","low"]).meta({id:"Severity"}),aj=g.k5(["warn","redact","block","allow","log"]).meta({id:"ActionTaken"}),ak=aj.options,al=g.Ik({start:g.ai().int().nonnegative(),end:g.ai().int().nonnegative()}).meta({id:"Span"});g.Ik({id:g.Os(),eventId:g.Os(),ruleId:g.Yj(),category:ah,severity:ai,span:al,maskedMatch:g.Yj(),actionTaken:aj,confidence:g.ai().min(0).max(1)}).meta({id:"Finding"}).meta({id:"DetectedFinding"});let am=g.k5(["blocked","redacted","warned","allowed","quarantined","monitored"]).meta({id:"FindingAction"}),an=ad.extract(["ClaudeCode","ClaudeDesktop","Cursor","Copilot","ChatGpt","ClaudeAi","Codex","Antigravity","Api"]).meta({id:"FindingProvider"}),ao=g.k5(["secret","pii","source_code","code_flaw","external_share","mcp_server","customer_data","financial","phi","custom"]).meta({id:"FindingCategory"});g.k5(["in-flight","at-rest"]).meta({id:"FindingOrigin"});let ap=g.k5(["open","handled","resolved","dismissed"]).meta({id:"FindingStatus"}),aq=g.k5(["enforced-in-flight","fixed-at-source","exception","acknowledged","false-positive","redetected"]).meta({id:"ResolutionMethod"}),ar=g.Ik({maskedValue:g.Yj(),contextPrefix:g.Yj()}).meta({id:"FindingMatch"}),as=g.Ik({id:g.Yj(),name:g.Yj().nullable()}).meta({id:"FindingDetectionRef"}),at=g.Ik({id:g.Yj(),name:g.Yj()}).meta({id:"FindingPolicyRef"}),au=g.Ik({id:g.Yj(),name:g.Yj()}).meta({id:"FindingUser"}),av=g.Ik({id:g.Yj(),provider:an,repo:g.Yj(),file:g.Yj(),user:au.optional(),toolName:g.Yj().optional(),action:am,detectedAt:aa.w$(),confidence:g.ai().min(0).max(1),status:ap.optional(),eventId:g.Yj().optional(),sessionId:g.Yj().optional()}).meta({id:"FindingInstance"}),aw=g.Ik({id:g.Yj(),category:ao,subtype:g.Yj(),severity:ai,match:ar,detection:as,policy:at,instanceCount:g.ai().int().nonnegative(),providers:g.YO(an),aggregateAction:am.nullable(),latestDetectedAt:aa.w$(),instances:g.YO(av),status:ap.optional(),users:g.YO(au).optional()}).meta({id:"FindingGroup"});g.Ik({findings:g.ai().int().nonnegative(),groups:g.ai().int().nonnegative(),bySeverity:g.Ik({critical:g.ai().int().nonnegative(),high:g.ai().int().nonnegative(),medium:g.ai().int().nonnegative(),low:g.ai().int().nonnegative()})}).meta({id:"FindingStats"});let ax=g.Ik({value:g.Yj(),count:g.ai().int().nonnegative()}).meta({id:"FindingFacetItem"}),ay=g.Ik({severity:g.YO(ax),subtype:g.YO(ax),provider:g.YO(ax),action:g.YO(ax),status:g.YO(ax),tool:g.YO(ax).optional()}).meta({id:"FindingFacets"}),az=aw.omit({instances:!0,match:!0}).meta({id:"FindingTypeSummary"}),aA=50,aB=g.Ik({severity:g.YO(ai).optional(),subtype:g.YO(g.Yj()).optional(),provider:g.YO(an).optional(),action:g.YO(am).optional(),status:g.YO(ap).optional(),q:g.Yj().optional(),sessionId:g.Yj().optional(),from:aa.w$().optional(),includeId:g.Yj().optional(),limit:ab.ai().int().min(1).max(100).optional(),cursor:g.Yj().optional()});g.Ik({totals:g.Ik({findings:g.ai().int().nonnegative(),types:g.ai().int().nonnegative()}),facets:ay,items:g.YO(az),nextCursor:g.Yj().nullable(),sessionFirings:g.g1(g.Yj(),g.ai().int().nonnegative()).optional()}).meta({id:"ListFindingTypesResponse"}),g.Ik({action:am.exclude(["quarantined"]),instanceId:g.Yj().optional()}).meta({id:"ApplyFindingActionRequest"}),aw.meta({id:"ApplyFindingActionResponse"}),g.Ik({severity:g.YO(ai).optional(),subtype:g.YO(g.Yj()).optional(),provider:g.YO(an).optional(),action:g.YO(am).optional(),q:g.Yj().optional(),format:g.k5(["csv","json"]).optional()});let aC=av.extend({groupId:g.Yj(),category:ao,subtype:g.Yj(),severity:ai,match:ar,detection:as,policy:at}).meta({id:"FindingInstanceDetail"}),aD=50,aE=g.Ik({severity:g.YO(ai).optional(),subtype:g.YO(g.Yj()).optional(),provider:g.YO(an).optional(),action:g.YO(am).optional(),status:g.YO(ap).optional(),tool:g.YO(g.Yj()).optional(),repo:g.Yj().optional(),file:g.Yj().optional(),q:g.Yj().optional(),sessionId:g.Yj().optional(),from:aa.w$().optional(),limit:ab.ai().int().min(1).max(200).optional(),cursor:g.Yj().optional()});g.Ik({totals:g.Ik({findings:g.ai().int().nonnegative()}),facets:ay,items:g.YO(aC),nextCursor:g.Yj().nullable()}).meta({id:"ListFindingInstancesResponse"});let aF=g.Ik({id:g.Yj(),repo:g.Yj(),file:g.Yj(),instanceCount:g.ai().int().nonnegative(),maxSeverity:ai,latestDetectedAt:aa.w$(),status:ap.optional(),ruleIds:g.YO(g.Yj())}).meta({id:"FindingLocationSummary"}),aG=50,aH=g.Ik({severity:g.YO(ai).optional(),subtype:g.YO(g.Yj()).optional(),provider:g.YO(an).optional(),action:g.YO(am).optional(),status:g.YO(ap).optional(),tool:g.YO(g.Yj()).optional(),q:g.Yj().optional(),sessionId:g.Yj().optional(),from:aa.w$().optional(),includeId:g.Yj().optional(),limit:ab.ai().int().min(1).max(100).optional(),cursor:g.Yj().optional()});g.Ik({totals:g.Ik({findings:g.ai().int().nonnegative(),locations:g.ai().int().nonnegative()}),facets:ay,items:g.YO(aF),nextCursor:g.Yj().nullable()}).meta({id:"ListFindingLocationsResponse"});let aI=g.k5(["host","harness","user","skill","hook","mcp_server","config_file"]).meta({id:"InventoryObjectType"}),aJ=g.k5(["session","run","tool_call","llm_call","source_lookup","prompt","response","code_change","tool_use","model_refusal","config_scan"]).meta({id:"AuditEventType"}),aK=g.g1(g.Yj(),g.L5());g.Ik({host_name:g.Yj().optional(),os:g.Yj().optional(),os_version:g.Yj().optional(),arch:g.Yj().optional()}).catchall(g.L5()),g.Ik({harness_version:g.Yj().optional(),interface:g.Yj().optional()}).catchall(g.L5()),g.Ik({display_name:g.Yj().optional(),email:g.Yj().optional()}).catchall(g.L5()),g.Ik({source:g.Yj().optional(),version:g.Yj().optional(),description:g.Yj().optional(),updated_at:g.Yj().optional(),scope:g.Yj().optional(),plugin_name:g.Yj().optional()}).catchall(g.L5()),g.Ik({event:g.Yj().optional(),matcher:g.Yj().optional(),command:g.Yj().optional(),scope:g.Yj().optional(),plugin_name:g.Yj().optional(),timeout:g.ai().optional()}).catchall(g.L5()),g.Ik({scope:g.Yj().optional(),transport:g.Yj().optional(),command:g.Yj().optional(),url:g.Yj().optional(),env_keys:g.YO(g.Yj()).optional(),plugin_name:g.Yj().optional(),marketplace:g.Yj().optional(),project:g.Yj().optional()}).catchall(g.L5()),g.Ik({kind:g.Yj().optional(),detail:g.Yj().optional(),scope:g.Yj().optional(),updated_at:g.Yj().optional(),entry_count:g.ai().optional()}).catchall(g.L5());let aL=g.Ik({model:g.Yj().optional(),provider:g.Yj().optional(),input_tokens:g.ai().int().nonnegative().optional(),output_tokens:g.ai().int().nonnegative().optional(),cache_creation_input_tokens:g.ai().int().nonnegative().optional(),cache_read_input_tokens:g.ai().int().nonnegative().optional(),ephemeral_1h_input_tokens:g.ai().int().nonnegative().optional(),ephemeral_5m_input_tokens:g.ai().int().nonnegative().optional(),web_search_requests:g.ai().int().nonnegative().optional(),web_fetch_requests:g.ai().int().nonnegative().optional(),service_tier:g.Yj().optional(),stop_reason:g.Yj().optional(),message_id:g.Yj().optional(),uuid:g.Yj().optional(),parent_uuid:g.Yj().optional(),run_key:g.Yj().optional()}).catchall(g.L5());g.Ik({sessionId:g.Yj().min(1),messageId:g.Yj().min(1),parentId:g.Yj().min(1),rootSessionId:g.Yj().min(1),startedAt:aa.w$(),attributes:aL});let aM=g.Ik({tool_name:g.Yj().optional(),tool_use_id:g.Yj().optional(),target:g.Yj().optional(),is_error:g.zM().optional(),input_size:g.ai().int().nonnegative().optional(),output_size:g.ai().int().nonnegative().optional(),uuid:g.Yj().optional(),parent_uuid:g.Yj().optional(),run_key:g.Yj().optional()}).catchall(g.L5());g.Ik({source_tool:g.Yj().optional(),file_path:g.Yj().optional(),repo:g.Yj().optional(),tool_name:g.Yj().optional(),gitignored:g.zM().optional(),whole_file:g.zM().optional(),correlation_id:g.uR().optional(),trace_id:g.Yj().regex(/^[0-9a-f]{32}$/).optional(),exception_ids:g.YO(g.Os()).optional(),inspection_ms:g.ai().int().nonnegative().optional()}).catchall(g.L5());let aN=g.Ik({ruleId:g.Yj().min(1),ruleName:g.Yj(),ruleVersion:g.Yj().min(1),category:ah,severity:ai,span:al,maskedMatch:g.Yj(),actionTaken:aj,confidence:g.ai().min(0).max(1)});g.Ik({sessionId:g.Yj().min(1),toolUseId:g.Yj().min(1),parentId:g.Yj().min(1),rootSessionId:g.Yj().min(1),startedAt:aa.w$(),attributes:aM,inspections:g.YO(aN).default([])});let aO=g.Ik({objectType:aI,identityKey:g.Yj().min(1),location:g.Yj().optional(),title:g.Yj().optional(),hostId:g.Yj().optional(),attributes:aK.default({})}).meta({id:"InventoryInput"}),aP=g.Ik({url:g.Yj().min(1),name:g.Yj().optional(),attributes:aK.default({})}).meta({id:"SourceProjectInput"}),aQ=g.Ik({id:g.Yj().min(1),eventType:aJ,startedAt:aa.w$(),endedAt:aa.w$().optional(),parentId:g.Yj().optional(),rootSessionId:g.Yj().optional(),hostId:g.Yj().optional(),harnessId:g.Yj().optional(),sourceProjectId:g.Yj().optional(),severity:ai.optional(),priority:g.Yj().optional(),content:g.Yj().optional(),contentHash:g.Yj().optional(),attributes:aK.optional()}).meta({id:"AuditEventInput"});g.Ik({class:g.Yj().min(1),label:g.Yj().optional(),attributes:aK.optional()});let aR=g.Ik({ruleId:g.Yj().min(1),version:g.Yj().min(1),name:g.Yj(),category:ah,severity:ai,definition:g.Yj()});g.Ik({id:g.Yj().min(1),auditEventId:g.Yj().min(1),inspectionDefinitionId:g.Yj().min(1),classifiedDataId:g.Yj().optional(),span:al,maskedMatch:g.Yj(),actionTaken:aj,confidence:g.ai().min(0).max(1),findingKey:g.Yj().optional(),firstDetectedAt:aa.w$().optional()}),g.Ik({host:aO.optional(),harness:aO.optional(),project:aP.optional()}).meta({id:"InventoryContext"});let aS=g.Ik({hostId:g.Yj().optional(),harnessId:g.Yj().optional(),accountId:g.Yj().optional(),sourceProjectId:g.Yj().optional()}).meta({id:"ResolvedInventory"});g.Ik({hosts:g.YO(g.Yj()),harnesses:g.YO(g.Yj()),osVersions:g.YO(g.Yj()),projects:g.YO(g.Yj())}).meta({id:"InventoryFacets"});let aT=g.Ik({sessionId:g.Yj(),model:g.Yj(),provider:g.Yj(),inputTokens:g.ai().int().nonnegative(),outputTokens:g.ai().int().nonnegative(),cacheCreation:g.ai().int().nonnegative(),cacheRead:g.ai().int().nonnegative(),totalTokens:g.ai().int().nonnegative(),estimatedCostUsd:g.ai().nullable()}).meta({id:"TokenRollup"});g.Ik({sessionId:g.Yj(),rollups:g.YO(aT),totalTokens:g.ai().int().nonnegative(),estimatedCostUsd:g.ai().nullable(),costIsPartial:g.zM()});let aU=g.Ik({provider:g.Yj(),model:g.Yj(),inputTokens:g.ai().int().nonnegative(),outputTokens:g.ai().int().nonnegative(),cacheTokens:g.ai().int().nonnegative(),totalTokens:g.ai().int().nonnegative(),estimatedCostUsd:g.ai().nullable()});function aV(a){return JSON.stringify(a)}g.Ik({models:g.YO(aU),sessionCount:g.ai().int().nonnegative(),totalTokens:g.ai().int().nonnegative(),estimatedCostUsd:g.ai(),costIsPartial:g.zM()});let aW=g.k5(["active","completed","interrupted","error"]),aX=g.k5(["session","prompt","response","tool","hook","detection","share","permission","commit","error","active"]),aY=g.k5(["detections","shares","inventory"]),aZ=g.Ik({id:g.Yj(),occurredAt:aa.w$(),kind:aX,title:g.Yj(),detail:g.Yj(),tool:g.Yj().nullable(),severity:ai.nullable(),link:aY.nullable(),targetId:g.Yj().nullable(),internal:g.zM(),flagged:g.zM()}).meta({id:"ActivityAuditEvent"}),a$=g.Ik({id:g.Yj(),harness:ad,title:g.Yj(),project:g.Yj(),repo:g.Yj(),branches:g.YO(g.Yj()),startedAt:aa.w$(),endedAt:aa.w$().nullable(),status:aW,turns:g.ai().int().nonnegative(),findings:g.ai().int().nonnegative(),shares:g.ai().int().nonnegative()}).meta({id:"ActivitySessionSummary"});a$.extend({host:g.Yj(),cwd:g.Yj(),models:g.YO(g.Yj()),version:g.Yj(),tokens:aT,tools:g.g1(g.Yj(),g.ai().int().nonnegative()),files:g.YO(g.Yj()),commits:g.ai().int().nonnegative(),events:g.YO(aZ)}).meta({id:"ActivitySession"}),g.Ik({tz:g.Yj().optional()});let a_=g.Ik({sessionsToday:g.ai().int().nonnegative(),liveNow:g.ai().int().nonnegative(),toolCallsToday:g.ai().int().nonnegative(),findingsToday:g.ai().int().nonnegative(),egressToday:g.ai().int().nonnegative()}).meta({id:"GetActivityStatsResponse"});g.Ik({q:g.Yj().optional(),harness:g.YO(ad).optional(),from:g.KC([aa.p6(),aa.w$()]).optional(),to:g.KC([aa.p6(),aa.w$()]).optional(),excludeEmpty:g.uE().optional(),limit:ab.ai().int().min(1).max(100).default(50),cursor:g.Yj().optional()});let a0=g.Ik({items:g.YO(a$),nextCursor:g.Yj().nullable(),emptyCount:g.ai().int().nonnegative()}).meta({id:"ListActivitySessionsResponse"});g.Ik({limit:ab.ai().int().min(1).max(500).default(100),cursor:g.Yj().optional(),order:g.k5(["asc","desc"]).default("asc")}),g.Ik({items:g.YO(aZ),nextCursor:g.Yj().nullable()}).meta({id:"ListSessionEventsResponse"}),g.Ik({format:g.k5(["ndjson","json"]).default("ndjson")}),g.Ik({format:g.k5(["csv","json"]).default("csv"),q:g.Yj().optional(),harness:g.YO(ad).optional(),from:g.KC([aa.p6(),aa.w$()]).optional(),to:g.KC([aa.p6(),aa.w$()]).optional()}),g.Ik({stats:a_,sessions:a0}).meta({id:"ActivityOverviewResponse"});let a1=g.k5(["user","project","local","plugin"]),a2=g.Ik({name:g.Yj().min(1),source:g.Yj().min(1),scope:a1,pluginName:g.Yj().optional(),version:g.Yj().optional(),description:g.Yj().optional(),updatedAt:aa.w$().optional(),location:g.Yj().optional()}),a3=g.Ik({event:g.Yj().min(1),matcher:g.Yj().optional(),command:g.Yj().min(1),timeout:g.ai().optional(),scope:a1,pluginName:g.Yj().optional(),location:g.Yj().optional()}),a4=g.Ik({name:g.Yj().min(1),scope:a1,pluginName:g.Yj().optional(),marketplace:g.Yj().optional(),project:g.Yj().optional(),transport:g.Yj().min(1),command:g.Yj().optional(),url:g.Yj().optional(),envKeys:g.YO(g.Yj()).optional(),location:g.Yj().optional()}),a5=g.Ik({name:g.Yj().min(1),path:g.Yj().min(1),scope:a1,kind:g.Yj().min(1),detail:g.Yj().optional(),entryCount:g.ai().optional(),updatedAt:aa.w$().optional()});g.Ik({scannedAt:aa.w$(),skills:g.YO(a2),hooks:g.YO(a3),mcpServers:g.YO(a4),configFiles:g.YO(a5),errors:g.YO(g.Ik({source:g.Yj(),reason:g.Yj()}))});let a6=g.Ik({ruleId:g.Yj().min(1),version:g.Yj().min(1),span:al,maskedMatch:g.Yj(),actionTaken:aj,confidence:g.ai().min(0).max(1)});g.Ik({items:g.YO(aO),scanEvent:aQ,definitions:g.YO(aR).optional(),findings:g.YO(a6).optional()});let a7=g.k5(["project","skill","mcp","hook","config"]).meta({id:"AssetType"}),a8=g.k5(["open","approved","blocked"]).meta({id:"AccessLevel"}),a9=g.k5(["source","public-dep","vendored","config","data","docs","generated"]).meta({id:"Origin"}),ba=g.k5(["known-good","risky","unapproved"]).meta({id:"TrustLevel"}),bb=g.k5(["update","stale","conflict","unknown","change","untracked","risk","findings"]).meta({id:"Flag"}),bc=g.k5(["public","private"]).meta({id:"Visibility"}),bd=g.k5(["block","redact","warn"]).meta({id:"HarnessEventKind"}),be=ad.extract(["ClaudeCode","Cursor","Codex","Antigravity"]).meta({id:"HarnessId"}),bf=g.Ik({open:g.ai().int().nonnegative(),approved:g.ai().int().nonnegative(),blocked:g.ai().int().nonnegative(),total:g.ai().int().nonnegative()}).meta({id:"AccessCounts"}),bg=g.Ik({id:g.Yj(),type:a7,name:g.Yj(),sub:g.Yj(),flags:g.YO(bb),trust:ba.optional()}).meta({id:"AssetSummary"}),bh=g.Ik({id:g.Yj(),name:g.Yj(),repo:g.Yj(),visibility:bc,language:g.Yj(),policyDefault:a8,updatedAt:aa.w$(),accessCounts:bf,findingsCount:g.ai().int().nonnegative()}).meta({id:"ProjectSummary"}),bi=g.Ik({type:a7,assets:g.YO(bg)}),bj=g.Ik({id:be,label:g.Yj(),kind:g.Yj(),version:g.Yj(),sessions:g.ai().int().nonnegative(),assetCount:g.ai().int().nonnegative(),flagCount:g.ai().int().nonnegative(),projects:g.YO(bh),categories:g.YO(bi)}).meta({id:"HarnessSummary"});g.Ik({items:g.YO(bj)}).meta({id:"ListHarnessesResponse"});let bk=g.Ik({type:a7,total:g.ai().int().nonnegative(),trustRollup:g.Ik({"known-good":g.ai().int().nonnegative(),risky:g.ai().int().nonnegative(),unapproved:g.ai().int().nonnegative()}).partial().strict().optional(),flagRollup:g.Ik({update:g.ai().int().nonnegative(),stale:g.ai().int().nonnegative(),conflict:g.ai().int().nonnegative(),unknown:g.ai().int().nonnegative(),change:g.ai().int().nonnegative(),untracked:g.ai().int().nonnegative(),risk:g.ai().int().nonnegative(),findings:g.ai().int().nonnegative()}).partial().strict(),items:g.YO(bg)}).meta({id:"AssetGroup"});g.Ik({groups:g.YO(bk)}).meta({id:"ListAssetsResponse"});let bl=g.Ik({name:g.Yj(),signature:g.Yj(),description:g.Yj(),write:g.zM(),risk:g.Yj().nullable()}).meta({id:"McpTool"}),bm=g.Ik({id:g.Yj(),title:g.Yj(),note:g.Yj()});bg.extend({description:g.Yj().nullable(),trust:ba.nullable(),meta:g.g1(g.Yj(),g.L5()),finding:bm.nullable(),tools:g.YO(bl).optional()}).meta({id:"AssetDetail"}),g.Ik({items:g.YO(bh)}).meta({id:"ListProjectsResponse"}),g.Ik({attention:g.ai().int().nonnegative(),byType:g.Ik({project:g.ai().int().nonnegative(),skill:g.ai().int().nonnegative(),mcp:g.ai().int().nonnegative(),hook:g.ai().int().nonnegative(),config:g.ai().int().nonnegative()}),harnesses:g.ai().int().nonnegative(),mcpTrust:g.Ik({"known-good":g.ai().int().nonnegative(),risky:g.ai().int().nonnegative(),unapproved:g.ai().int().nonnegative()})}).meta({id:"InventoryStats"});let bn=g.Ik({path:g.Yj(),name:g.Yj(),origin:a9,access:a8,isCustom:g.zM(),findings:g.ai().int().nonnegative(),blockedAt:aa.w$().nullable().optional(),note:g.Yj().nullable().optional()}).meta({id:"FileSummary"}),bo=g.Ik({name:g.Yj(),path:g.Yj(),accessCounts:bf}).meta({id:"FolderSummary"});g.Ik({project:g.Ik({id:g.Yj(),repo:g.Yj(),visibility:bc}),path:g.Yj(),folders:g.YO(bo).optional(),files:g.YO(bn)}).meta({id:"ProjectTreeResponse"}),bn.extend({project:g.Ik({repo:g.Yj(),visibility:bc,language:g.Yj(),policyDefault:a8,updatedAt:aa.w$()}),findingsRefs:g.YO(g.Ik({id:g.Yj(),title:g.Yj()}))}).meta({id:"FileDetail"}),g.Ik({path:g.Yj(),access:a8}).meta({id:"SetFileAccessBody"}),g.Ik({file:bn,accessCounts:bf}).meta({id:"SetFileAccessResponse"}),g.Ik({trust:ba}).meta({id:"SetMcpTrustBody"});let bp=g.Ik({kind:bd,title:g.Yj(),detail:g.Yj(),occurredAt:aa.w$(),findingId:g.Yj().nullable().optional()}).meta({id:"HarnessEventItem"});g.Ik({counts:g.Ik({block:g.ai().int().nonnegative(),redact:g.ai().int().nonnegative(),warn:g.ai().int().nonnegative()}),items:g.YO(bp)}).meta({id:"HarnessEventsResponse"}),g.Ik({jobId:g.Yj(),startedAt:aa.w$()}).meta({id:"RescanResponse"}),g.Ik({repo:g.Yj()}).meta({id:"ConnectProjectBody"}),g.Ik({type:g.YO(a7).optional(),q:g.Yj().optional()}),g.Ik({path:g.Yj().optional(),q:g.Yj().optional(),filter:g.k5(["blocked"]).optional()}),g.Ik({path:g.Yj()}),g.Ik({limit:ab.ai().int().min(1).max(50).default(7)});let bq=g.k5(["provider","internal","external","ip"]).meta({id:"DestinationKind"}),br=g.k5(["https","http","sftp","grpc","smtp","ws","wss"]).meta({id:"Transport"}),bs=g.k5(["secrets","pii","customer","source","telemetry","logs","metrics","none"]).meta({id:"DataClass"}),bt=bs.options,bu=g.k5(["recognized","internal","unverified","ip"]).meta({id:"ShareTrustLevel"}),bv=g.k5(["allow","block"]).meta({id:"EgressDecision"}),bw=g.k5(["allowed","blocked","review"]).meta({id:"EgressStatus"}),bx=g.k5(["raw_ip","unverified_domain","plaintext_transport"]).meta({id:"ReviewReason"}),by=g.k5(["GET","POST","PUT","DELETE","SDK","REF"]).meta({id:"HttpMethod"}),bz=g.Ik({needsReview:g.zM(),reasons:g.YO(bx)}).meta({id:"ReviewInfo"}),bA=g.Ik({port:g.ai().int().nullable(),geo:g.Yj().nullable(),ptr:g.Yj().nullable()}).meta({id:"DestinationNetwork"}),bB=g.Ik({id:g.Yj(),method:by,transport:br,url:g.Yj(),template:g.zM(),dataClass:bs,lastSeen:aa.w$(),callSiteCount:g.ai().int().nonnegative()}).meta({id:"EndpointSummary"}),bC=g.Ik({id:g.Yj(),project:g.Yj(),file:g.Yj(),line:g.ai().int().nonnegative(),snippet:g.Yj(),dynamic:g.zM(),vendored:g.zM(),projectId:g.Yj().nullable()}).meta({id:"CallSite"}),bD=bB.extend({sites:g.YO(bC)}).meta({id:"EndpointWithSites"}),bE=g.Ik({id:g.Yj(),kind:bq,name:g.Yj(),host:g.Yj(),category:g.Yj(),trust:bu,status:bw,isCustom:g.zM(),lastSeen:aa.w$(),endpointCount:g.ai().int().nonnegative(),callSiteCount:g.ai().int().nonnegative(),transports:g.YO(br),dataClasses:g.YO(bs),review:bz,network:bA.nullable(),endpoints:g.YO(bB)}).meta({id:"ShareDestinationSummary"});bE.omit({endpointCount:!0,callSiteCount:!0,endpoints:!0}).extend({note:g.Yj().nullable(),endpoints:g.YO(bD)}).meta({id:"ShareDestinationDetail"});let bF=g.Ik({id:g.Yj(),kind:bq,name:g.Yj(),host:g.Yj(),trust:bu,status:bw,review:bz,topDataClass:bs,callSiteCount:g.ai().int().nonnegative(),lastSeen:aa.w$()}).meta({id:"ReviewDestination"}),bG=g.Ik({kind:bq,total:g.ai().int().nonnegative(),items:g.YO(bE)}).meta({id:"ShareDestinationGroup"});g.Ik({groups:g.YO(bG)}).meta({id:"ListShareDestinationsResponse"}),g.Ik({items:g.YO(bF)}).meta({id:"NeedsReviewResponse"}),g.Ik({destinations:g.ai().int().nonnegative(),endpoints:g.ai().int().nonnegative(),callSites:g.ai().int().nonnegative(),needsReview:g.ai().int().nonnegative(),insecure:g.ai().int().nonnegative(),byKind:g.Ik({provider:g.ai().int().nonnegative(),internal:g.ai().int().nonnegative(),external:g.ai().int().nonnegative(),ip:g.ai().int().nonnegative()}),byTrust:g.Ik({recognized:g.ai().int().nonnegative(),internal:g.ai().int().nonnegative(),unverified:g.ai().int().nonnegative(),ip:g.ai().int().nonnegative()})}).meta({id:"SharesStats"}),g.Ik({decision:bv.nullable()}).meta({id:"SetEgressDecisionBody"}),g.Ik({destination:bE}).meta({id:"SetEgressDecisionResponse"}),g.Ik({q:g.Yj().optional(),kind:g.YO(bq).optional(),groupBy:g.k5(["destination"]).default("destination"),review:g.uE().default(!1)}),g.Ik({format:g.k5(["csv","json"]).default("csv"),q:g.Yj().optional(),kind:g.YO(bq).optional()});let bH=g.k5(["npm","pypi","go","maven","rubygems","cargo","composer","nuget"]).meta({id:"EgressEcosystem"});g.Ik({id:g.Yj(),name:g.Yj(),category:g.Yj(),hostSuffixes:g.YO(g.Yj()).min(1),apiBase:g.Yj(),defaultDataClasses:g.YO(bs).min(1),sdks:g.jg(bH,g.YO(g.Yj()))}).meta({id:"ProviderRegistryEntry"});let bI=g.Ik({file:g.Yj(),line:g.ai().int().positive(),snippet:g.Yj(),dynamic:g.zM(),vendored:g.zM()}).meta({id:"EgressCallSiteHit"}),bJ=g.Ik({host:g.Yj(),kind:bq,name:g.Yj(),category:g.Yj(),trust:bu,network:bA.nullable(),method:by,transport:br,url:g.Yj(),template:g.zM(),dataClass:bs,site:bI}).meta({id:"ResolvedEgressHit"}),bK=g.gM("mode",[g.Ik({mode:g.eu("walk"),walkedPrefix:g.Yj()}),g.Ik({mode:g.eu("ledger"),scannedFiles:g.YO(g.Yj()),deletedFiles:g.YO(g.Yj())})]).meta({id:"EgressReconcile"});g.Ik({projectKey:g.Yj().min(1),project:g.Yj(),projectId:g.Yj().nullable(),reconcile:bK,hits:g.YO(bJ)}).meta({id:"RecordProjectEgressInput"}),g.Ik({destinations:g.ai().int().nonnegative(),endpoints:g.ai().int().nonnegative(),callSites:g.ai().int().nonnegative(),truncated:g.zM(),droppedFiles:g.YO(g.Yj()).default([])}).meta({id:"EgressWriteSummary"});let bL="control-plane-credential.json",bM=g.Ik({specVersion:g.eu(1),endpoint:g.Yj().min(1),apiKey:g.Yj().min(1),keyPrefix:g.Yj().min(1).max(16).optional(),mintedAt:aa.w$().optional()}),bN=g.Ik({packId:g.Yj().min(1),version:g.Yj().min(1),enabled:g.zM(),updatedAt:g.Yj().nullable()}).meta({id:"StorePosturePack"}),bO=g.Ik({total:g.ai().int().min(0),disabled:g.ai().int().min(0),byAction:g.Ik({warn:g.ai().int().min(0),redact:g.ai().int().min(0),block:g.ai().int().min(0),allow:g.ai().int().min(0),log:g.ai().int().min(0)}).strict()}).meta({id:"StorePosturePolicyCounts"}),bP=g.Ik({package:g.Yj().min(1).max(200),version:g.Yj().min(1).max(64),ossVersion:g.Yj().max(64).nullable(),policyBundleVersion:g.Yj().max(200).nullable(),policyFetchedAt:g.ai().int().min(0).max(0xe677d21fdbff).nullable()}).meta({id:"StorePosturePlugin"});g.Ik({deviceId:g.Os(),hostname:g.Yj().min(1).max(253),capturedAt:g.ai().int().min(0).max(0xe677d21fdbff),storePresent:g.zM(),schemaVersion:g.ai().int().min(0).max(0x7fffffff).nullable(),findingsTotal:g.ai().int().min(0).max(0x7fffffff),findingsFirstAt:g.ai().int().min(0).max(0xe677d21fdbff).nullable(),findingsLastAt:g.ai().int().min(0).max(0xe677d21fdbff).nullable(),packs:g.YO(bN).max(500),policyCounts:bO,plugin:bP.optional()}).meta({id:"StorePostureSnapshot"});let bQ="capture/",bR=aQ.extend({inspections:g.YO(aN).default([])}).refine(a=>a.inspections.every(a=>!a.ruleVersion.startsWith(bQ)),{message:`inspections[].ruleVersion must not start with \`${bQ}\` — that namespace is reserved for capture definitions the control plane mints itself`,path:["inspections"]}).meta({id:"RecordAuditEventRequest"}),bS=g.Ik({events:g.YO(bR).min(1).max(50)}).meta({id:"RecordAuditEventBatch"}),bT=g.Ik({host:g.Yj(),kind:bq,name:g.Yj(),category:g.Yj(),trust:bu,network:bA.nullable(),method:by,transport:br,url:g.Yj(),template:g.zM(),dataClass:bs,site:g.Ik({file:g.Yj(),line:g.ai().int().positive(),dynamic:g.zM(),vendored:g.zM()})}).meta({id:"EgressIngestHit"}),bU=g.Ik({projectKey:g.Yj().regex(/^[0-9a-f]{64}$/,"projectKey must be a 64-character lowercase hex digest"),project:g.Yj(),reconcile:bK,hits:g.YO(bT)}).meta({id:"EgressIngestRequest"}),bV=g.Ik({accepted:g.ai().int().nonnegative(),duplicates:g.ai().int().nonnegative()}),bW=g.Ik({accepted:g.ai().int().nonnegative()}),bX=/^[^\p{Cc}\p{Cf}]*$/u,bY=a=>g.Yj().max(a).regex(bX,"must not contain control characters"),bZ=g.Ik({tenantName:bY(200),userEmail:bY(320),role:bY(64),keyKind:bY(64),serverTime:bY(64)});g.Ik({error:g.Ik({code:g.Yj().optional(),message:g.Yj().optional()}).optional()}),g.k5(["unauthorized","forbidden","route-absent","invalid-request","rejected","unreachable"]),g.Ik({deviceId:bY(128).min(1),hostname:bY(255).min(1),os:bY(64).min(1),cliVersion:bY(64).min(1),label:bY(200).optional()}).meta({id:"AttachDeviceRequest"}),g.Ik({deviceCode:bY(128).min(1)}).meta({id:"AttachTokenRequest"}),g.Ik({deviceCode:bY(128),userCode:bY(32),verificationUri:bY(512),verificationUriComplete:bY(512).optional(),expiresIn:g.ai().int().positive(),interval:g.ai().int().positive()});let b$=g.Ik({status:g.eu("pending")}),b_=g.Ik({status:g.eu("slow_down"),interval:g.ai().int().positive()}),b0=g.Ik({status:g.eu("denied"),message:bY(500).optional()}),b1=g.Ik({status:g.eu("expired")}),b2=g.Ik({status:g.eu("issued"),apiKey:g.Yj().min(1).max(512),endpoint:bY(512),tenantName:bY(200).optional(),userEmail:bY(320).optional()});g.KC([b2,b$,b_,b0,b1,g.Ik({status:bY(64)})]);let b3=g.k5(["shares_rescan"]),b4=g.Ik({id:bY(128).min(1),kind:b3,issuedAt:bY(64).min(1),expiresAt:bY(64).min(1)}).strict(),b5=g.Ik({command:b4.nullable()}),b6=g.k5(["scan_failed","no_projects","expired"]),b7=g.gM("outcome",[g.Ik({outcome:g.eu("reported"),projectsScanned:g.ai().int().nonnegative()}).strict(),g.Ik({outcome:g.eu("failed"),reason:b6,projectsScanned:g.ai().int().nonnegative()}).strict()]),b8=g.Yj().regex(/^[a-z][a-z0-9-]*$/),b9=g.Yj().regex(/^[a-z][a-z0-9-]*$/),ca=g.Yj().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-.]+)?$/),cb=g.k5(["labs","user","org"]),cc=g.k5(["keyword","regex"]).meta({id:"MatcherType"});g.k5(["safe","quarantined"]).meta({id:"RuleProbeVerdict"});let cd=g.re({type:g.eu("keyword"),keywords:g.YO(g.Yj().min(1)).min(1),caseSensitive:g.zM().default(!1)});function ce(a){return a.replace(/[gy]/g,"")}let cf=g.re({type:g.eu("regex"),pattern:g.Yj().min(1).max(2e3),flags:g.Yj().default("gi"),captureGroup:g.ai().int().nonnegative().optional()}).refine(a=>(function(a,b){try{return new RegExp(a,b),!0}catch{return!1}})(a.pattern,a.flags),{message:"pattern/flags do not form a valid JavaScript regular expression",path:["pattern"]}).refine(a=>!function(a){return void 0===a||0===a}(a.captureGroup)||!function(a,b){try{let c=new RegExp(a,ce(b));return c.exec("")?.[0].length===0}catch{return!1}}(a.pattern,a.flags),{message:'a whole-match regex that can match the empty string (e.g. "\\d*", "a?", "(?:)") can hang the matcher — scope the quantifier to a captureGroup, or require at least one character',path:["pattern"]}).superRefine((a,b)=>{if(void 0===a.captureGroup)return;let c=function(a,b){try{let c=RegExp(`${a}|`,ce(b)).exec("");return c?c.length-1:void 0}catch{return}}(a.pattern,a.flags);void 0===c||a.captureGroup<=c||b.addIssue({code:"custom",path:["captureGroup"],message:`captureGroup ${String(a.captureGroup)} is out of range — the pattern declares ${String(c)} capture group(s), so valid values are 0-${String(c)}. An out-of-range group never matches, which would make the rule silently never fire.`})}),cg=g.gM("type",[cd,cf]).meta({id:"Matcher"});cc.options;let ch=g.re({extensions:g.YO(g.Yj().regex(/^\.[A-Za-z0-9]+$/)).min(1)}).meta({id:"AppliesTo"}),ci=g.k5(["entropy","luhn"]).meta({id:"PostValidatorName"}),cj=g.KC([ci,g.re({name:ci,config:g.g1(g.Yj(),g.L5()).optional()})],{error:()=>`not a valid post-validator: use a bare name (${ci.options.map(a=>JSON.stringify(a)).join(" or ")}) or { "name": ..., "config": { ... } }. An unrecognized name would be a false-positive guard that never runs.`}).meta({id:"PostValidatorRef"}),ck=g.re({categories:g.YO(ah).min(1).optional(),ruleIds:g.YO(g.Yj().min(1)).min(1).optional(),labels:g.YO(g.Yj().min(1)).min(1).optional(),windowChars:g.ai().int().positive().default(160),confidenceBoost:g.ai().min(0).max(.3).optional()}).refine(a=>(a.categories?.length??0)+(a.ruleIds?.length??0)+(a.labels?.length??0)>0,{message:"requiresNearby needs at least one of categories, ruleIds, or labels"}).meta({id:"RequiresNearby"});g.re({label:g.Yj(),text:g.Yj().max(5e4),shouldMatch:g.zM(),filePath:g.Yj().optional(),expectedSpans:g.YO(g.re({start:g.ai(),end:g.ai()})).optional()}).meta({id:"RuleFixture"});let cl=g.re({specVersion:g.eu(1),id:g.Yj().regex(/^[a-z][a-z0-9-]*\/[a-z][a-z0-9-]*$/),name:g.Yj(),category:ah,severity:ai,matcher:cg,appliesTo:ch.optional(),postValidators:g.YO(cj).optional(),requiresNearby:ck.optional(),examples:g.YO(g.Yj()).optional()}).meta({id:"Rule"}),cm=g.Ik({name:g.Yj(),email:g.Rp().optional(),url:g.OZ().optional()}).meta({id:"Author"});g.Ik({specVersion:g.eu(1),id:g.Yj(),name:g.Yj(),version:g.Yj(),rules:g.YO(g.Yj()),description:g.Yj().optional(),author:cm.optional(),license:g.Yj().optional(),sourceUrl:g.OZ().optional()}).meta({id:"PackManifest"});let cn=g.k5(["library","custom"]).meta({id:"OriginEnum"}),co=g.k5(["all","library","custom","customized","updates"]),cp=g.k5(["new","imported","update"]).meta({id:"LibraryStateEnum"}),cq=g.Ik({all:g.ai().int().nonnegative(),library:g.ai().int().nonnegative(),custom:g.ai().int().nonnegative(),customized:g.ai().int().nonnegative(),updates:g.ai().int().nonnegative()}).meta({id:"DetectionCounts"}),cr=g.Ik({id:g.Yj(),name:g.Yj(),version:ca,enabled:g.zM(),origin:cn,publisher:b8.optional(),publisherKind:cb.optional(),ruleCount:g.ai().int().nonnegative(),namespace:b8,packId:b9,policyId:g.Yj().optional(),latestVersion:ca.optional()}).meta({id:"DetectionListItem"});g.Ik({counts:cq,items:g.YO(cr)}).meta({id:"ListDetectionsResponse"}),g.Ik({filter:co.optional().default("all"),q:g.Yj().optional()}),g.Ik({detections:g.ai().int().nonnegative(),rules:g.ai().int().nonnegative(),active:g.ai().int().nonnegative(),findingsLast30d:g.ai().int().nonnegative()}).meta({id:"DetectionStats"});let cs=g.Ik({id:g.Yj(),name:g.Yj(),category:ah,severity:ai,matcher:cg,appliesTo:ch.optional(),postValidators:g.YO(cj).optional(),requiresNearby:ck.optional(),examples:g.YO(g.Yj()).optional()}).meta({id:"DetectionRule"}),ct=g.Ik({available:g.zM(),latestVersion:ca,latestRuleCount:g.ai().int().nonnegative().optional()}).nullable().meta({id:"DetectionUpdate"});g.Ik({id:g.Yj(),name:g.Yj(),version:ca,enabled:g.zM(),origin:cn,publisher:b8.optional(),publisherKind:cb.optional(),ruleCount:g.ai().int().nonnegative(),namespace:b8,packId:b9,description:g.Yj().optional(),editedAt:aa.w$(),findingsLast30d:g.ai().int().nonnegative(),latestVersion:ca.nullable().optional(),update:ct,rules:g.YO(cs),modified:g.zM(),policyId:g.Yj().optional()}).meta({id:"DetectionDetail"});let cu=g.Ik({id:g.Yj(),name:g.Yj(),publisher:b8,publisherKind:cb.optional(),category:ah.optional(),version:ca,ruleCount:g.ai().int().nonnegative(),description:g.Yj().optional(),updatedAt:aa.w$(),state:cp,importedAs:g.Yj().nullable()}).meta({id:"LibraryItem"});function cv(a,b,c){return void 0!==c&&b.success&&void 0!==b.data?{[a]:b.data}:{}}g.Ik({categories:g.YO(ah),items:g.YO(cu)}).meta({id:"ListLibraryResponse"}),g.Ik({libraryId:g.Yj().refine(a=>/^[^/]+\/[^/]+$/.test(a),{message:"libraryId must be in namespace/packId format"})}).meta({id:"ImportDetectionRequest"});let cw={library:!0,custom:!0};function cx(a){return null!=a&&Object.hasOwn(cw,a)?a:"library"}function cy(a){return{id:`${a.namespace}/${a.packId}`,name:a.name,version:a.version,enabled:a.enabled,origin:cx(a.origin),namespace:a.namespace,packId:a.packId,ruleCount:a.ruleCount,...null!=a.policyId?{policyId:a.policyId}:{},...null!=a.latestVersion?{latestVersion:a.latestVersion}:{}}}function cz(a,b,c){let d=a.rules.flatMap(a=>{var b;let c=cg.safeParse(a.matcher);return c.success?[{id:a.id,name:a.name,category:a.category,severity:a.severity,matcher:c.data,...cv("appliesTo",ch.safeParse(a.appliesTo),a.appliesTo),...cv("postValidators",cj.array().safeParse(a.postValidators),a.postValidators),...cv("requiresNearby",ck.safeParse(a.requiresNearby),a.requiresNearby),...cv("examples",{success:Array.isArray(b=a.examples)&&b.every(a=>"string"==typeof a),data:a.examples},a.examples)}]:[]});return{id:`${a.namespace}/${a.packId}`,name:a.name,version:a.version,enabled:a.enabled,origin:cx(a.origin),namespace:a.namespace,packId:a.packId,ruleCount:a.rules.length,editedAt:a.updatedAt.toISOString(),findingsLast30d:b,latestVersion:c?c.latestVersion:null,update:c,rules:d,modified:!1,...null!=a.policyId?{policyId:a.policyId}:{}}}function cA(a){let b=a.indexOf("/");return b<1||b===a.length-1?null:{namespace:a.slice(0,b),packId:a.slice(b+1)}}function cB(a,b){let c=a.filter(a=>null!=a.latestVersion),d=a=>cx(a.origin),e={all:a.length,library:a.filter(a=>"library"===d(a)).length,custom:a.filter(a=>"custom"===d(a)).length,customized:0,updates:c.length},f=b.filter,g="customized"===f?[]:"custom"===f?a.filter(a=>"custom"===d(a)):"library"===f?a.filter(a=>"library"===d(a)):"updates"===f?[...c]:[...a];if(b.q){let a=b.q.toLowerCase();g=g.filter(b=>b.name.toLowerCase().includes(a)||b.packId.toLowerCase().includes(a)||b.namespace.toLowerCase().includes(a))}return g.sort((a,b)=>a.enabled!==b.enabled?a.enabled?-1:1:a.name.localeCompare(b.name)),{counts:e,items:g.map(cy)}}let cC=g.k5(["prompt","response","code_change","tool_use"]).meta({id:"EventKind"}),cD=cC.options.map(a=>`'${a}'`).join(","),cE=g.Ik({sessionId:g.Yj().optional(),repo:g.Yj().optional(),filePath:g.Yj().optional(),toolName:g.Yj().optional(),gitignored:g.zM().optional(),wholeFile:g.zM().optional(),model:g.Yj().optional(),turnIndex:g.ai().int().nonnegative().optional(),correlationId:g.uR().optional(),traceId:g.Yj().regex(/^[0-9a-f]{32}$/).optional(),exceptionIds:g.YO(g.Os()).optional(),inspectionMs:g.ai().int().nonnegative().optional()}).meta({id:"EventMetadata"}),cF=g.Ik({id:g.Os(),sourceTool:af,kind:cC,occurredAt:aa.w$(),contentHash:g.Yj(),content:g.Yj(),metadata:cE.optional()}).meta({id:"Event"}).meta({id:"IngestEvent"});g.Ik({events:g.YO(cF).min(1).max(100),dedupe:g.eu("content-hash").optional()}).meta({id:"IngestBatch"});let cG=g.k5(["once","temporary","permanent"]),cH=g.Ik({repo:g.Yj().optional(),sourceTool:g.Yj().optional(),provider:g.Yj().optional()}).strict(),cI=g.k5(["suppress","reveal_to_model"]),cJ=g.Ik({id:g.Os(),ruleId:g.Yj(),category:ah,valueFingerprint:g.Yj().regex(/^[0-9a-f]{64}$/),keyVersion:g.ai().int().positive(),maskedValue:g.Yj(),capability:cI.default("suppress"),scope:cG,expiresAt:aa.w$().nullable(),maxUses:g.ai().int().positive().nullable(),useCount:g.ai().int().nonnegative(),lastUsedAt:aa.w$().nullable(),justification:g.Yj().min(1),conditions:cH.nullable(),createdBy:g.Yj(),createdVia:g.k5(["cli-approve","cli-add","web-approve","web-add","api","setup-triage"]),createdAt:aa.w$(),updatedAt:aa.w$(),revokedAt:aa.w$().nullable(),revokedBy:g.Yj().nullable(),revokeReason:g.Yj().nullable()}),cK=cJ.pick({id:!0,ruleId:!0,valueFingerprint:!0,keyVersion:!0,capability:!0,expiresAt:!0,maxUses:!0,useCount:!0,conditions:!0});function cL(a,b){return"present"===b.status&&b.version===a}cJ.omit({valueFingerprint:!0});let cM=g.Yj().optional(),cN=g.Ik({reference:g.Yj(),scope:g.Yj(),reason:g.Yj(),confirmation:cM}),cO=g.Ik({ruleId:g.Yj(),value:g.Yj(),scope:g.Yj(),reason:g.Yj(),confirmation:cM}),cP=g.Ik({pointer:g.Yj(),scope:g.Yj(),justification:g.Yj(),confirmation:cM}),cQ=g.Ik({id:g.Yj(),reason:g.Yj()}),cR=g.Ik({confirmation:g.Yj()});function cS(a,b){let c=a.safeParse(b);if(c.success)return{ok:!0,data:c.data};for(let a of c.error.issues){let[b]=a.path;if("string"==typeof b)return{ok:!1,field:b,wrongType:"invalid_type"===a.code}}return{ok:!1,field:null,wrongType:!1}}function cT(a){return({log:"monitored",block:"blocked",redact:"redacted",warn:"warned",allow:"allowed"})[a]??"allowed"}function cU(a){if("code_context"===a)return"source_code";let b=ao.safeParse(a);return b.success?b.data:"custom"}function cV(a){return ag[a]??ac.Api}let cW=["open","handled","dismissed","resolved"];function cX(a){let b=new Set(a.filter(a=>void 0!==a));if(0!==b.size){for(let a of cW)if(b.has(a))return a}}function cY(a){return"code_change"!==a.kind?"handled":null===a.findingKey?"open":"resolved"===a.latestResolutionStatus?"resolved":"dismissed"===a.latestResolutionStatus?"dismissed":"open"}function cZ(a,b={}){let c=b.packNames,d=[];for(let[b,e]of a){let a=[...e.users??[]].sort((a,b)=>a.name.localeCompare(b.name)||a.id.localeCompare(b.id)),f=[...new Set(e.sourceTools.map(cV))].sort(),g=new Set(e.actionsTaken.map(cT)),h=1===g.size?[...g][0]??null:null,i=cU(e.category??"custom"),j={id:b,category:i,subtype:b,severity:e.severity??"low",detection:{id:b,name:c?.get(b)??null},policy:{id:`category:${i}`,name:i},instanceCount:e.instanceCount,providers:f,aggregateAction:h,latestDetectedAt:e.latestDetectedAt,status:cX(e.statusInputs.map(cY)),...a.length>0?{users:a}:{}};c0.set(j,[...g]),void 0!==e.searchText&&c$.set(j,c_(j,e.searchText)),d.push(j)}return d}let c$=new WeakMap;function c_(a,b){return[a.subtype,a.category,a.policy.name,a.id,...(a.users??[]).map(a=>a.name),...void 0===b?[]:[b]].join(" ").toLowerCase()}let c0=new WeakMap;function c1(a){return c0.get(a)??[]}function c2(a,b){let c=new Set(b),d=0;for(let b of a){if(void 0===b.count)return null;c.has(cY(b))&&(d+=b.count)}return d}function c3(a,b){let c=a;if(b.severity&&b.severity.length>0){let a=new Set(b.severity);c=c.filter(b=>a.has(b.severity))}if(b.providers&&b.providers.length>0){let a=new Set(b.providers);c=c.filter(b=>b.providers.some(b=>a.has(b)))}if(b.actions&&b.actions.length>0){let a=new Set(b.actions);c=c.filter(b=>c1(b).some(b=>a.has(b)))}if(b.subtype&&b.subtype.length>0){let a=new Set(b.subtype);c=c.filter(b=>a.has(b.subtype))}if(b.statuses&&b.statuses.length>0){let a=new Set(b.statuses);c=c.filter(b=>void 0!==b.status&&a.has(b.status))}if(b.q){let a=b.q.toLowerCase();c=c.filter(b=>(function(a){let b=c$.get(a);if(void 0!==b)return b;let c=c_(a);return c$.set(a,c),c})(b).includes(a))}return c}let c4={critical:0,high:1,medium:2,low:3};function c5(a,b){let c=(c4[a.severity]??-1)-(c4[b.severity]??-1);if(0!==c)return c;let d=b.latestDetectedAt.localeCompare(a.latestDetectedAt);return 0!==d?d:a.id.localeCompare(b.id)}function c6(a){return[...a].sort(c5)}function c7(a,b){let c=c3(a,{providers:b.providers,actions:b.actions,statuses:b.statuses,q:b.q,subtype:b.subtype}),d=new Map;for(let a of c)d.set(a.severity,(d.get(a.severity)??0)+1);let e=c3(a,{actions:b.actions,statuses:b.statuses,q:b.q,subtype:b.subtype,severity:b.severity}),f=new Map;for(let a of e)for(let b of a.providers)f.set(b,(f.get(b)??0)+1);let g=c3(a,{providers:b.providers,statuses:b.statuses,q:b.q,subtype:b.subtype,severity:b.severity}),h=new Map;for(let a of g)for(let b of c1(a))h.set(b,(h.get(b)??0)+1);let i=c3(a,{providers:b.providers,actions:b.actions,statuses:b.statuses,q:b.q,severity:b.severity}),j=new Map;for(let a of i)j.set(a.subtype,(j.get(a.subtype)??0)+1);let k=c3(a,{providers:b.providers,actions:b.actions,q:b.q,subtype:b.subtype,severity:b.severity}),l=new Map;for(let a of k)void 0!==a.status&&l.set(a.status,(l.get(a.status)??0)+1);let m=a=>[...a.entries()].map(([a,b])=>({value:a,count:b}));return{severity:m(d),provider:m(f),action:m(h),subtype:m(j),status:m(l)}}let c8=["severity","subtype","providers","actions","statuses","tools","repo","file","q"];function c9(a,b,c){for(let d of c8)if(d!==c&&!function(a,b,c){switch(c){case"severity":return!b.severity?.length||b.severity.includes(a.severity);case"subtype":return!b.subtype?.length||b.subtype.includes(a.ruleId);case"providers":return!b.providers?.length||b.providers.includes(cV(a.sourceTool));case"actions":return!b.actions?.length||b.actions.includes(cT(a.actionTaken));case"statuses":return!b.statuses?.length||void 0!==a.status&&b.statuses.includes(a.status);case"tools":return!b.tools?.length||void 0!==a.toolName&&b.tools.includes(a.toolName);case"repo":return void 0===b.repo||a.repo===b.repo;case"file":return void 0===b.file||a.file===b.file;case"q":return!b.q||[a.ruleId,a.category,a.maskedMatch,a.repo,a.file,a.toolName?`via ${a.toolName}`:"",a.id,a.user?.name??""].join(" ").toLowerCase().includes(b.q.toLowerCase())}}(a,b,d))return!1;return!0}function da(a){return[...a.entries()].map(([a,b])=>({value:a,count:b})).sort((a,b)=>b.count-a.count||a.value.localeCompare(b.value))}function db(a,b){a.set(b,(a.get(b)??0)+1)}function dc(a){let b=new Map,c=new Map,d=new Map,e=new Map,f=new Map,g=new Map;return{add(h){c9(h,a,"severity")&&db(b,h.severity),c9(h,a,"subtype")&&db(c,h.ruleId),c9(h,a,"providers")&&db(d,cV(h.sourceTool)),c9(h,a,"actions")&&db(e,cT(h.actionTaken)),void 0!==h.status&&c9(h,a,"statuses")&&db(f,h.status),void 0!==h.toolName&&c9(h,a,"tools")&&db(g,h.toolName)},facets:()=>({severity:da(b),subtype:da(c),provider:da(d),action:da(e),status:da(f),tool:da(g)})}}function dd(a){let b=cU(a.category);return{id:a.id,provider:cV(a.sourceTool),repo:a.repo,file:a.file,...void 0===a.toolName?{}:{toolName:a.toolName},eventId:a.eventId,...void 0===a.sessionId?{}:{sessionId:a.sessionId},...void 0===a.user?{}:{user:a.user},action:cT(a.actionTaken),detectedAt:a.occurredAt,confidence:a.confidence,...void 0===a.status?{}:{status:a.status},groupId:a.ruleId,category:b,subtype:a.ruleId,severity:a.severity,match:{maskedValue:a.maskedMatch,contextPrefix:""},detection:{id:a.ruleId,name:null},policy:{id:`category:${b}`,name:b}}}let de={critical:0,high:1,medium:2,low:3};function df(){return{instanceCount:0,maxSeverityRank:Number.MAX_SAFE_INTEGER,maxSeverity:"low",latestDetectedAt:"",statuses:[],ruleIds:new Set}}function dg(a,b){a.instanceCount+=1;let c=de[b.severity]??Number.MAX_SAFE_INTEGER-1;c<a.maxSeverityRank&&(a.maxSeverityRank=c,a.maxSeverity=b.severity),b.occurredAt>a.latestDetectedAt&&(a.latestDetectedAt=b.occurredAt),a.statuses.push(b.status),a.ruleIds.add(b.ruleId)}function dh(a,b){let c=de[a.maxSeverity]??-1,d=de[b.maxSeverity]??-1;return c!==d?c-d:a.latestDetectedAt!==b.latestDetectedAt?a.latestDetectedAt<b.latestDetectedAt?1:-1:a.repo!==b.repo?a.repo<b.repo?-1:1:a.file!==b.file?a.file<b.file?-1:1:0}function di(a,b){return`${dj(a)}/${dj(b)}`}function dj(a){return encodeURIComponent(a.replace(/[\uD800-\uDFFF]/gu,"�"))}let dk=g.Ik({id:g.Os(),namespace:b8,packId:b9,version:ca,name:g.Yj(),enabled:g.zM().default(!0),policyId:g.Yj().optional()}).meta({id:"InstalledPack"});g.Ik({namespace:b8,packId:b9,version:ca}).meta({id:"InstallPackRequest"}),g.Ik({items:g.YO(dk)}).meta({id:"ListInstalledPacksResponse"}),g.Ik({enabled:g.zM().optional(),policyId:g.Yj().nullable().optional()}).refine(a=>Object.keys(a).some(b=>void 0!==a[b]),{message:"At least one field must be provided"}).meta({id:"PatchInstalledPackRequest"});let dl=g.k5(["global","repo","user"]).meta({id:"PolicyScope"}),dm=g.KC([g.Ik({ruleId:g.Yj()}),g.Ik({category:ah})]).meta({id:"PolicyTarget"}),dn=g.k5(["builtin","custom"]).meta({id:"PolicyKind"}),dp=g.k5(["builtin","authored"]).meta({id:"PolicyProvenance"}),dq=g.Ik({id:g.Os(),scope:dl,target:dm,action:aj,enabled:g.zM().default(!0),customKeywords:g.YO(g.Yj()).optional(),name:g.Yj().optional(),provenance:dp.optional()}).meta({id:"Policy"}),dr=g.Ik({version:g.Yj(),policies:g.YO(dq),rules:g.YO(cl).optional(),rulesComplete:g.zM().optional(),exceptions:g.YO(cK).optional(),reversibleRuleIds:g.YO(g.Yj()).optional(),ruleVersions:g.g1(g.Yj(),g.Yj()).optional(),prohibitedModels:g.YO(g.Yj()).optional(),customKeywords:g.YO(g.Yj()),fetchedAt:aa.w$()}).meta({id:"PolicyBundle"});[...Object.keys(dr.shape),...Object.keys(dq.shape).map(a=>`policies.${a}`),...dm.options.flatMap(a=>"shape"in a?Object.keys(a.shape):[]).map(a=>`policies.target.${a}`),...Object.keys(cK.shape).map(a=>`exceptions.${a}`)].sort().join(",");let ds=["config"],dt=ah.options.filter(a=>!ds.includes(a)),du={secret:"critical",financial:"critical",code_flaw:"critical",pii:"high",phi:"high",custom:"high",code_context:"low",config:"low"},dv=["monitor","warn","redact","vault","block"],dw=g.k5(dv).meta({id:"BuiltinPolicyId"}),dx=dw.extract(["monitor","warn","block"]).meta({id:"RedactFallback"}),dy=dv,dz={monitor:{name:"Monitor",action:"log",reversible:!1,description:"Log every match for audit. The request is allowed through untouched."},warn:{name:"Warn",action:"warn",reversible:!1,description:"Allow the request, but warn the user inline before it is sent."},redact:{name:"Redact",action:"redact",reversible:!1,description:"Strip the matched value from the request and destroy it, then continue. What was removed cannot be recovered."},vault:{name:"Redact & Vault",action:"redact",reversible:!0,description:"Strip the matched value from the request and keep an encrypted, recoverable copy in the local vault, leaving a pointer in its place. Needs the vault consent granted under Settings; without it this behaves as Redact."},block:{name:"Block",action:"block",reversible:!1,description:"Refuse the request entirely whenever any rule in this detection matches."}};function dA(a){return dz[a].action}let dB=[...new Set(dv.map(dA))],dC=[...ak.filter(a=>!dB.includes(a)),...dB];function dD(a){return dC.indexOf(a)}function dE(a,b){return dD(a)>=dD(b)}function dF(a,b){return dD(a)>=dD(b)?a:b}function dG(a){return dv.find(b=>dE(dA(b),a))??"block"}g.Ik({floor:dw,locked:g.zM()}).describe("PackPolicyFloor");let dH=dv.filter(a=>!dz[a].reversible);dv.filter(a=>dz[a].reversible);let dI=g.k5(dH).meta({id:"CategoryPolicyId"});function dJ(a){let b=dw.safeParse(a??dM);return dz[b.success?b.data:dM].reversible}let dK=Object.fromEntries(ah.options.map(a=>[a,dA(function(a){if(ds.includes(a))return"monitor";let b=du[a];return"critical"===b||"high"===b?"warn":"monitor"}(a))])),dL=Object.fromEntries(dv.map(a=>[a,{id:a,...dz[a]}])),dM="monitor";function dN(a){let b=dw.safeParse(a??dM);return dL[b.success?b.data:dM].action}let dO=g.Ik({id:g.Yj(),name:g.Yj(),ruleCount:g.ai().int().nonnegative(),enabled:g.zM()}).meta({id:"UsedByItem"}),dP=g.Ik({id:g.Yj(),kind:dn,name:g.Yj(),enabled:g.zM(),usedByCount:g.ai().int().nonnegative()}).meta({id:"PolicyListItem"});g.Ik({items:g.YO(dP)}).meta({id:"ListPoliciesResponse"}),g.Ik({specVersion:g.eu(1),id:g.Yj(),kind:dn,name:g.Yj(),enabled:g.zM(),description:g.Yj(),usedBy:g.YO(dO)}).meta({id:"PolicyDetail"}),g.Ik({policies:g.ai().int().nonnegative(),builtin:g.ai().int().nonnegative(),custom:g.ai().int().nonnegative(),detectionsGoverned:g.ai().int().nonnegative()}).meta({id:"PolicyStatsResponse"});let dQ=2,dR=ah.options.join("|"),dS=RegExp(`\\[\\[aka:(?:${dR}):[A-Z2-7]{2,7}\\.[A-Z2-7]{26}\\.[A-Z2-7]{16}\\]\\]`),dT=RegExp(`^${dS.source}$`);function dU(){return RegExp(dS.source,"g")}let dV=g.Yj().regex(dT);g.Ik({category:ah,keyVersion:g.ai().int().positive(),pointerId:g.Yj(),tag:g.Yj()}),g.Ik({pointerId:g.Yj(),valueFingerprint:g.Yj().regex(/^[0-9a-f]{64}$/),fingerprintKeyVersion:g.ai().int().positive(),keyVersion:g.ai().int().positive(),category:ah,ruleId:g.Yj(),maskedMatch:g.Yj(),provider:g.Yj().optional(),ciphertext:g.Yj(),nonce:g.Yj(),authTag:g.Yj(),occurrenceCount:g.ai().int().nonnegative(),userAuthorized:g.zM(),firstSeen:g.Yj(),lastSeen:g.Yj()}),g.Ik({category:ah,provider:g.Yj().optional(),maskedMatch:g.Yj(),occurrences:g.ai().int().nonnegative(),firstSeen:g.Yj(),lastSeen:g.Yj()}),g.Ik({ruleId:g.Yj(),valueFingerprint:g.Yj().regex(/^[0-9a-f]{64}$/),fingerprintKeyVersion:g.ai().int().positive()});let dW=g.k5(["human","model"]),dX=g.k5(["display","explicit-reveal","view-render","model-input","remediation","purge"]),dY=g.k5(["revealed","refused","unavailable"]),dZ=["display","view-render"];function d$(a){return dZ.includes(a)}let d_=g.Ik({id:g.Os(),pointerId:g.Yj(),at:g.Yj(),target:dW,reason:dX,outcome:dY,grantId:g.Yj().optional(),pointerCount:g.ai().int().positive().default(1)}),d0=g.k5(["prompt","tool-input","tool-output","file","transcript"]),d1=g.Ik({location:g.Yj(),kind:d0,firstSeen:g.Yj(),lastSeen:g.Yj()}),d2=g.Ik({pointerId:g.Yj(),category:ah,provider:g.Yj().optional(),maskedMatch:g.Yj(),occurrences:g.ai().int().nonnegative(),firstSeen:g.Yj(),lastSeen:g.Yj(),revealGrantId:g.Yj().nullable(),sightings:g.YO(d1)}),d3=50,d4=50,d5=200,d6=g.Ik({limit:ab.ai().int().min(1).max(d5).optional(),cursor:g.Yj().optional()});g.Ik({totals:g.Ik({values:g.ai().int().nonnegative()}),items:g.YO(d2),nextCursor:g.Yj().nullable()});let d7=g.Ik({limit:ab.ai().int().min(1).max(d5).optional(),cursor:g.Yj().optional()});g.Ik({totals:g.Ik({reused:g.ai().int().nonnegative()}),items:g.YO(d2),nextCursor:g.Yj().nullable()});let d8=g.Ik({includeBatched:g.zM().optional(),limit:ab.ai().int().min(1).max(d5).optional(),cursor:g.Yj().optional()});g.Ik({items:g.YO(d_),nextCursor:g.Yj().nullable(),hiddenBatched:g.ai().int().nonnegative()});let d9=g.Yj(),ea=g.k5(["masked","full","off"]),eb=1,ec=g.Ik({acknowledgedAt:aa.w$(),version:g.ai().int().positive()});function ed(a){return a?.version===eb}let ee=1,ef=3,eg=g.k5(["standalone","attached"]),eh=g.Ik({endpoint:g.Yj().min(1),label:g.Yj().min(1).optional(),attachedAt:aa.w$()}).meta({id:"ControlPlaneConnection"}),ei=g.k5(["redact","warn"]),ej=g.k5(["full","session-only"]),ek=g.Ik({acknowledgedAt:aa.w$(),payloadVersion:g.ai().int().positive()});function el(a){return a?.payloadVersion===ee}let em=g.Ik({acknowledgedAt:aa.w$(),payloadVersion:g.ai().int().positive(),endpoint:g.Yj()});function en(a,b){return void 0!==a&&void 0!==b&&a.payloadVersion===ef&&a.endpoint===b}let eo=g.Ik({specVersion:g.ai().int().positive().default(7),runMode:eg.default("standalone"),controlPlane:eh.optional(),policy:ei.default("redact"),historicalAccess:ej.default("session-only"),dataSharesInPlace:g.zM().default(!0),vaultConsent:ec.optional(),vaultKeyCustody:d9.default("file"),vaultInlineReveal:ea.default("masked"),redactFallback:dx.default("warn"),onboardedAt:aa.w$().optional(),modelJudgeConsent:ek.optional(),historySyncConsent:em.optional()});function ep(){return eo.parse({})}function eq(a){return"attached"===a.runMode&&void 0!==a.controlPlane}function er(a){return a.label??a.endpoint}function es(a,b,c){return{id:b,objectType:a.objectType,location:a.location??null,title:a.title??null,hostId:a.hostId??null,attributes:JSON.stringify(a.attributes),firstSeen:c,lastSeen:c}}function et(a,b,c){return{id:b,url:a.url,name:a.name??null,attributes:JSON.stringify(a.attributes),firstSeen:c,lastSeen:c}}function eu(a){return{id:a.id,parentId:a.parentId??null,rootSessionId:a.rootSessionId??null,eventType:a.eventType,hostId:a.hostId??null,harnessId:a.harnessId??null,sourceProjectId:a.sourceProjectId??null,startedAt:U(a.startedAt),endedAt:a.endedAt?U(a.endedAt):null,severity:a.severity??null,priority:a.priority??null,content:a.content??null,contentHash:a.contentHash??null,attributes:a.attributes?JSON.stringify(a.attributes):null}}function ev(a,b){return{id:b,class:a.class,label:a.label??null,attributes:a.attributes?JSON.stringify(a.attributes):null}}function ew(a,b){return{id:b,ruleId:a.ruleId,name:a.name,category:a.category,severity:a.severity,definition:a.definition,version:a.version}}function ex(a){return{id:a.id,auditEventId:a.auditEventId,inspectionDefinitionId:a.inspectionDefinitionId,classifiedDataId:a.classifiedDataId??null,spanStart:a.span.start,spanEnd:a.span.end,maskedMatch:a.maskedMatch,actionTaken:a.actionTaken,confidence:a.confidence,findingKey:a.findingKey??null,firstDetectedAt:a.firstDetectedAt?U(a.firstDetectedAt):null}}function ey(a){let b=a.metadata;return{source_tool:a.sourceTool,...b?.repo!==void 0?{repo:b.repo}:{},...b?.filePath!==void 0?{file_path:b.filePath}:{},...b?.toolName!==void 0?{tool_name:b.toolName}:{},...b?.gitignored!==void 0?{gitignored:b.gitignored}:{},...b?.wholeFile!==void 0?{whole_file:b.wholeFile}:{},...b?.correlationId!==void 0?{correlation_id:b.correlationId}:{},...b?.traceId!==void 0?{trace_id:b.traceId}:{},...b?.exceptionIds!==void 0?{exception_ids:b.exceptionIds}:{},...b?.inspectionMs!==void 0?{inspection_ms:b.inspectionMs}:{},...b?.model!==void 0?{model:b.model}:{},...b?.turnIndex!==void 0?{turn_index:b.turnIndex}:{}}}function ez(a){return`capture/${a.category}/${a.severity}`}function eA(a){return{ruleId:a.ruleId,version:ez(a),name:a.ruleId,category:a.category,severity:a.severity,definition:JSON.stringify({ruleId:a.ruleId})}}let eB="managed-settings.json",eC=g.k5(["runMode","historicalAccess","vaultConsent","vaultKeyCustody","vaultInlineReveal","modelJudgeConsent","dataSharesInPlace","redactFallback"]).meta({id:"ManagedSettingKey"}),eD=g.Ik({runMode:g.k5(["standalone","attached"]).optional(),controlPlane:g.Ik({endpoint:g.Yj().min(1),label:g.Yj().min(1).optional()}).optional(),historicalAccess:g.k5(["full","session-only"]).optional(),vaultConsent:g.zM().optional(),vaultKeyCustody:g.k5(["file","keychain"]).optional(),vaultInlineReveal:g.k5(["masked","full","off"]).optional(),modelJudgeConsent:g.zM().optional(),dataSharesInPlace:g.zM().optional(),redactFallback:dx.optional()}).meta({id:"ManagedSettingsValues"}),eE=g.Ik({specVersion:g.ai().int().positive().default(1),organization:g.Yj().min(1).optional(),values:eD.default({}),lockedFields:g.YO(g.Yj()).default([])}).transform(({lockedFields:a,...b})=>{let c=[],d=[];for(let b of a)eC.safeParse(b).success?c.push(b):d.push(b);return{...b,lockedFields:c,...d.length>0?{unknownLockedFields:d}:{}}}).meta({id:"ManagedSettings"}),eF={present:!1,lockedFields:[]},eG=g.Ik({path:g.Yj().min(1),name:g.Yj().min(1),origin:a9,defaultAccess:a8});g.Ik({files:g.YO(eG),truncated:g.zM(),scannedAt:g.Yj()});let eH=["7d","30d","3m","6m"],eI=g.k5(eH).meta({id:"TimeRange"}),eJ={"7d":7,"30d":30,"3m":90,"6m":180};eI.catch("7d");let eK=g.k5(["still-valid","unknown","invalid"]),eL=g.Ik({filePath:g.Yj(),span:al.optional()}).strict(),eM=g.Ik({provider:g.Yj(),maskedToken:g.Yj(),where:eL,state:eK,observedAt:aa.w$().optional()}).strict();g.Ik({provider:g.Yj(),maskedToken:g.Yj(),consolePath:g.Yj(),occurrenceSpread:g.ai().int().positive()}).strict();let eN=g.k5(["redact-rotation-checklist","redact-only","set-secret-redact","leave"]),eO=g.k5(["first-run","pre-push","secret-scan"]);g.Ik({entrySource:eO}).strict();let eP=g.Ik({id:eN,label:g.Yj()}),eQ=g.Ik({kind:g.eu("decision"),entrySource:eO,secretCount:g.ai().int().positive(),prompt:g.Yj(),options:g.PV([eP.extend({id:g.eu("redact-rotation-checklist")}),eP.extend({id:g.eu("redact-only")}),eP.extend({id:g.eu("set-secret-redact")}),eP.extend({id:g.eu("leave")})])}),eR=g.Ik({kind:g.eu("no-decision")});g.gM("kind",[eQ,eR]);let eS=g.Ik({severity:ai,count:g.ai().int().nonnegative(),caught:g.ai().int().nonnegative().optional(),openAtRest:g.ai().int().nonnegative().optional()}).meta({id:"SeveritySummaryItem"});g.Ik({total:g.ai().int().nonnegative(),needsRemediation:g.ai().int().nonnegative().optional(),bySeverity:g.YO(eS)}).meta({id:"SeveritySummaryResponse"}),g.Ik({range:g.k5(eH).default("7d")});let eT=g.k5(["blocked","redacted","warned"]).meta({id:"EnforcementActionKind"}),eU=g.Ik({kind:eT,count:g.ai().int().nonnegative(),delta:g.ai().int()}).meta({id:"EnforcementAction"});g.Ik({range:eI,total:g.ai().int().nonnegative(),actions:g.YO(eU)}).meta({id:"EnforcementActionsResponse"});let eV=g.k5(["day","week"]).meta({id:"TimeseriesGranularity"}),eW=g.Ik({timestamp:aa.p6(),critical:g.ai().int().nonnegative(),high:g.ai().int().nonnegative(),medium:g.ai().int().nonnegative(),low:g.ai().int().nonnegative().optional()}).meta({id:"FindingsTimeseriesPoint"});g.Ik({range:eI,granularity:eV,points:g.YO(eW)}).meta({id:"FindingsTimeseriesResponse"});let eX=g.Ik({timestamp:aa.p6(),bySeverity:g.Ik({critical:g.ai().nonnegative().nullable(),high:g.ai().nonnegative().nullable(),medium:g.ai().nonnegative().nullable(),low:g.ai().nonnegative().nullable()})}).meta({id:"MttrTrendPoint"});g.Ik({range:eI,granularity:eV,points:g.YO(eX)}).meta({id:"MttrTrendResponse"});let eY=g.Ik({findingKey:g.Yj(),ruleId:g.Yj(),severity:ai,repo:g.Yj().optional(),path:g.Yj(),resolvedAt:aa.w$(),detectedAt:aa.w$()}).meta({id:"ResolvedFeedItem"});g.Ik({items:g.YO(eY)}).meta({id:"RecentlyResolvedResponse"});let eZ=["repo","user"],e$=g.k5(eZ).meta({id:"SourceKind"}),e_=g.Ik({id:g.Yj(),name:g.Yj(),kind:e$,findingsCount:g.ai().int().nonnegative()}).meta({id:"TopSource"});g.Ik({range:eI,items:g.YO(e_)}).meta({id:"TopSourcesResponse"}),g.Ik({range:g.k5(eH).default("7d"),limit:ab.ai().int().min(1).max(50).default(5),kind:g.k5(eZ).optional()});let e0=ad.extract(["ClaudeCode","Cursor","Codex","Antigravity","ClaudeAi","ChatGpt","Copilot","Api"]).meta({id:"Provider"}),e1=g.Ik({provider:e0,coverage:g.ai().int().min(0).max(100),supported:g.zM()}).meta({id:"ScanCoverageProvider"});g.Ik({range:eI,providers:g.YO(e1)}).meta({id:"ScanCoverageResponse"});let e2=g.k5(["repo","user","team","policy","share","rule"]).meta({id:"SubjectType"}),e3=g.Ik({type:e2,id:g.Yj(),label:g.Yj()}).meta({id:"RecommendationSubject"}),e4=g.k5(["apply","navigate"]).meta({id:"RecommendationActionMode"}),e5=g.Ik({mode:e4,type:g.Yj(),label:g.Yj(),href:g.Yj().optional(),policyId:g.Yj().optional(),teamId:g.Yj().optional()}).meta({id:"RecommendationAction"}),e6=g.Ik({id:g.Yj(),category:g.Yj(),severity:ai,title:g.Yj(),description:g.Yj(),subjects:g.YO(e3),action:e5}).meta({id:"RecommendedAction"});g.Ik({items:g.YO(e6)}).meta({id:"RecommendedActionsResponse"}),g.Ik({limit:ab.ai().int().min(1).max(20).default(3)});let e7=g.Ik({type:g.Yj(),policyId:g.Yj().optional(),teamId:g.Yj().optional()}).meta({id:"AppliedAction"});g.Ik({id:g.Yj(),status:g.eu("applied"),appliedAction:e7}).meta({id:"ApplyRecommendedActionResponse"}),g.Ik({id:g.Yj(),status:g.eu("dismissed")}).meta({id:"DismissRecommendedActionResponse"}),g.Ik({id:g.Yj()});let e8=g.k5(["granted","revoked","unchanged"]).meta({id:"HistorySyncConsentChoice"}),e9=g.k5(["granted","revoked","unchanged"]).meta({id:"ModelJudgeConsentChoice"}),fa=g.Ik({historicalAccess:g.Yj(),modelJudgeConsent:e9,historySyncConsent:e8,vaultConsent:g.Yj(),vaultInlineReveal:g.Yj()}),fb=g.Ik({endpoint:g.Yj(),label:bY(200).optional(),accessKey:g.Yj()});g.Ik({ruleId:g.Yj(),category:ah,severity:ai,maskedMatch:g.Yj(),rawMatch:g.Yj(),context:g.Yj(),filePath:g.Yj().optional(),confidence:g.ai().min(0).max(1),id:g.Yj().optional(),valueFingerprint:g.Yj().optional(),keyVersion:g.ai().int().nonnegative().optional()});let fc=g.Ik({category:ah,action:dI,reasoning:g.Yj(),genuineCount:g.ai().int().nonnegative(),fpCount:g.ai().int().nonnegative(),fpIds:g.YO(g.Yj())});g.Ik({perCategory:g.YO(fc),notes:g.Yj()});let fd=g.Ik({total:g.ai().int().nonnegative(),important:g.ai().int().nonnegative(),routine:g.ai().int().nonnegative()}).refine(a=>a.total===a.important+a.routine,{message:"total must equal important + routine",path:["total"]}),fe=g.Ik({ruleId:g.Yj(),category:ah,valueFingerprint:g.Yj(),keyVersion:g.ai().int().nonnegative()}),ff=g.Ik({pattern:g.Yj(),count:g.ai().int().nonnegative(),values:g.YO(fe).min(1)}),fg=g.Ik({category:ah,count:g.ai().int().nonnegative(),egress:g.zM()}),fh=g.Ik({counts:fd,routineCategories:g.YO(ah),surfacedCategories:g.YO(ah),findingKinds:g.YO(fg),posture:g.g1(ah,dw),maskedFindings:g.YO(eM).optional(),falsePositivePatterns:g.YO(ff).optional()}),fi=fc.pick({category:!0,genuineCount:!0,fpCount:!0}).extend({egress:g.zM()});g.Ik({categories:g.YO(fi),posture:g.g1(ah,dw)}),g.Ik({frame:fh,copy:g.Yj()}),g.k5(["scan","floor"]);let fj=g.Ik({id:g.k5(["enter-remediation","open-dashboard","not-now"]),label:g.Yj()}),fk=g.PV([fj.extend({id:g.eu("open-dashboard")}),fj.extend({id:g.eu("not-now")})]),fl=g.PV([fj.extend({id:g.eu("enter-remediation")}),fj.extend({id:g.eu("open-dashboard")}),fj.extend({id:g.eu("not-now")})]);g.Ik({worthALook:g.ai().int().nonnegative(),liveKeys:g.ai().int().nonnegative().optional(),options:g.KC([fk,fl])}).refine(a=>a.options.some(a=>"enter-remediation"===a.id)===(a.liveKeys??0)>0,{message:"the chain-entry option is present exactly when liveKeys > 0",path:["options"]}).refine(a=>(a.liveKeys??0)<=a.worthALook,{message:"liveKeys is a subset of worthALook and cannot exceed it",path:["liveKeys"]});let fm=new Set(["recognized","internal"]);function fn(a){return fm.has(a)?"allowed":"review"}function fo(a){return"block"===a?"blocked":"allowed"}function fp(a,b){return null===b?fn(a):fo(b)}function fq(a,b){return null!==b&&fo(b)!==fn(a)}function fr(a,b,c){let d=function(a,b){let c=[];return"ip"===a&&c.push("raw_ip"),"unverified"===a&&c.push("unverified_domain"),(b.includes("http")||b.includes("ws"))&&c.push("plaintext_transport"),c}(a,b);return{needsReview:d.length>0&&!c,reasons:d}}function fs(a){return Array.from(new Set(a))}function ft(a){let b=new Set(a);return bt.filter(a=>b.has(a))}function fu(a){return ft(a)[0]??"none"}let fv={raw_ip:0,unverified_domain:1,plaintext_transport:2};function fw(a){return 0===a.length?1/0:Math.min(...a.map(a=>fv[a]))}}};