@akasecurity/cli 0.9.14 → 0.9.15

package/web-ui/web-ui/.next/server/chunks/{74.js → 586.js}

@@ -1,4 +1,4 @@
-"use strict";exports.id=74,exports.ids=[74],exports.modules={61074:(a,b,c)=>{c.d(b,{WR:()=>a2,qA:()=>a3,qk:()=>bx,Pi:()=>dz,o8:()=>by,zd:()=>i,Qo:()=>cG,Ru:()=>dv,KS:()=>bk,tI:()=>bi,_2:()=>cP,Dg:()=>cQ,gt:()=>cS,lG:()=>j.lGs,Wo:()=>bl,Rd:()=>cN,V6:()=>cW,F3:()=>cX,Ji:()=>cy,R8:()=>C,Hg:()=>B,XK:()=>A,y9:()=>cM,cn:()=>cR,xR:()=>bv,Zu:()=>E,v5:()=>cO,Cn:()=>cT,VL:()=>bj,Yf:()=>cF,sF:()=>D,g5:()=>u});var d=c(73024),e=c(76760);let f="policy-cache.json",g="attached-state.json",h=[f,"attached-sync-state.json",g,"attached-forward-drops.json","attached-posture-report.json","attached-history-sync.json"];function i(a){for(let b of h)try{(0,d.rmSync)((0,e.join)(a,b),{force:!0})}catch{}}var j=c(88477),k=c(75919);let l="aka.db";function m(a,b){if(!function(a){try{return(0,d.lstatSync)(a).isSymbolicLink()}catch{return!1}}(a))try{(0,d.chmodSync)(a,b)}catch{}}function n(a){m(a,448)}function o(a,b=!1){(0,d.mkdirSync)(a,{recursive:b,mode:448})}function p(a){o(a,!0),n(a)}function q(a){return[`${a}-wal`,`${a}-shm`,`${a}-journal`]}function r(a){m(a,384)}function s(a){for(let b of[a,...q(a)])m(b,384)}function t(a,b){(0,d.writeFileSync)(a,b,{mode:384,flag:"wx"})}function u(a,b){let c=`${a}.${String(process.pid)}.tmp`;try{(0,d.rmSync)(c,{force:!0})}catch{}try{t(c,b),(0,d.renameSync)(c,a)}finally{try{(0,d.rmSync)(c,{force:!0})}catch{}}r(a)}function v(a){try{if((0,d.lstatSync)(a).isSymbolicLink())return{kind:"symlink"};return{kind:"gone"}}catch(a){if("ENOENT"===a.code)return{kind:"gone"};return{kind:"unknown",cause:a}}}class w extends Error{constructor(a,b){super(a,void 0===b?void 0:{cause:b}),this.code="key-unclaimable",this.name="KeyUnclaimableError"}}function x(a,b){let c,e=`${a}.${String(process.pid)}.${String(k.threadId)}.new`;try{(0,d.rmSync)(e,{force:!0})}catch{}try{t(e,b),c=function(a,b,c){try{return(0,d.linkSync)(a,b),!0}catch(b){let a=b.code;if("EEXIST"===a)return!1;if(!y.has(a??""))throw b}try{return t(b,c),!0}catch(a){if("EEXIST"===a.code)return!1;throw a}}(e,a,b)}finally{try{(0,d.rmSync)(e,{force:!0})}catch{}}return c&&r(a),c}let y=new Set(["EPERM","ENOSYS","ENOTSUP","EOPNOTSUPP","EINVAL"]);function z(a){return(0,e.join)(a,j.leE)}function A(a,b){let c=B(a,b);return c.usable?{usable:!0}:c}function B(a,b){let c,e,f=z(a),g=function(a){let b=(0,d.lstatSync)(a,{throwIfNoEntry:!1});if(void 0===b)return"absent";if(b.isSymbolicLink())return"untrusted";let c=(0,d.statSync)(a,{throwIfNoEntry:!1});if(void 0===c)return"absent";let e=process.getuid?.();if(void 0!==e&&c.uid!==e)return"untrusted";if("win32"!==process.platform&&(511&c.mode)!=384)try{(0,d.chmodSync)(a,384)}catch{return"untrusted"}return"ok"}(f);if("absent"===g)return{usable:!1,reason:"absent"};if("untrusted"===g)return{usable:!1,reason:"untrusted-file"};try{c=(0,d.readFileSync)(f,"utf8")}catch(a){return{usable:!1,reason:"ENOENT"===a.code?"absent":"unreadable"}}try{e=JSON.parse(c)}catch{return{usable:!1,reason:"malformed"}}let h=j.yi_.safeParse(e);return h.success?(0,j.lGs)(h.data.endpoint)?void 0!==b&&b.endpoint!==h.data.endpoint?{usable:!1,reason:"endpoint-mismatch",credentialEndpoint:h.data.endpoint,settingsEndpoint:b.endpoint}:{usable:!0,credential:h.data}:{usable:!1,reason:"unsafe-endpoint"}:{usable:!1,reason:"malformed"}}function C(a,b){let c=B(a,b);return c.usable?c.credential:null}function D(a,b){let c=(0,j.AaX)(b.endpoint);if(null!==c)throw Error(`refusing to store a control-plane credential for ${(0,j.Vgn)(b.endpoint)}: `+function(a){switch(a){case"unparseable":return"that does not look like a web address.";case"userinfo":return"the address carries a username or password, which must not be stored alongside the credential.";case"query-or-fragment":return"the address must be an origin, optionally with a path, not a query string or fragment.";case"insecure":return"an access key must not be stored for a non-HTTPS endpoint (http is accepted only for a loopback deployment)."}}(c));p(a),u(z(a),`${JSON.stringify(b,null,2)}
+"use strict";exports.id=586,exports.ids=[586],exports.modules={40557:(a,b,c)=>{c.d(b,{S8C:()=>ao,leE:()=>bT,hxQ:()=>bg,Itg:()=>a4,Nh0:()=>c_,QcD:()=>c$,qeh:()=>fE,yi_:()=>bU,t8P:()=>b6,RRF:()=>dO,ZpU:()=>d_,fDu:()=>eJ,HUb:()=>dI,hfB:()=>cQ,oz:()=>f9,Rf1:()=>f8,QA8:()=>ca,unw:()=>d$,p$t:()=>aN,IYX:()=>aH,b2L:()=>aK,Jr:()=>d0,hdu:()=>ek,mBk:()=>ej,vog:()=>d,H3X:()=>e7,qvI:()=>f_,gbA:()=>al,V8B:()=>cW,B0R:()=>ck,CPm:()=>ci,_td:()=>e8,Wmn:()=>e9,IgC:()=>dM,aIg:()=>bD,BZd:()=>b4,ZYZ:()=>cP,iRC:()=>cX,GCf:()=>at,agn:()=>c0,tLs:()=>af,xIP:()=>ev,TUN:()=>ag,SHn:()=>bm,rov:()=>ez,kg1:()=>b5,V0H:()=>dH,mzG:()=>aL,OXN:()=>aO,VEg:()=>aI,OVs:()=>eo,LsM:()=>em,bm0:()=>en,R4K:()=>f1,WRR:()=>eZ,u8Q:()=>el,kxf:()=>eu,ZXz:()=>e0,MhX:()=>e1,viY:()=>d4,XZo:()=>d7,NtJ:()=>b9,jUf:()=>d9,PEm:()=>dG,vap:()=>dK,KqW:()=>fs,eI7:()=>e6,UiT:()=>f$,pHc:()=>f0,lBn:()=>b2,qhM:()=>b1,suk:()=>dJ,cqq:()=>ax,PUD:()=>a$,eYL:()=>c1,JJC:()=>c2,jON:()=>cy,Zdp:()=>ah,lFU:()=>e,N3u:()=>fD,PhW:()=>a2,AJV:()=>au,BIx:()=>bi,DzG:()=>er,NFD:()=>eq,Fz0:()=>eE,AKh:()=>aj,hd_:()=>eK,_5V:()=>dx,tXp:()=>dj,plk:()=>cO,Ple:()=>dd,Fnc:()=>fU,ryv:()=>ac,fhc:()=>dQ,tTV:()=>a1,qmP:()=>eW,_6W:()=>dl,hml:()=>dy,rG:()=>dn,SVR:()=>e2,F$B:()=>eO,Bfj:()=>di,fj8:()=>du,q_t:()=>aa,i1j:()=>eL,xHz:()=>c5,xog:()=>dc,hzO:()=>fW,by7:()=>fV,Gw9:()=>fS,ZoN:()=>dz,q11:()=>Y,U7X:()=>am,JB8:()=>db,GVg:()=>ga,T2I:()=>dU,lgf:()=>eN,kqf:()=>ee,y_0:()=>fT,EL9:()=>eD,qEQ:()=>cY,DLF:()=>eB,lGs:()=>bX,hds:()=>et,dnP:()=>eI,I8t:()=>X,am1:()=>dr,SSj:()=>dw,Vgn:()=>bY,K7s:()=>c3,Pv3:()=>f7,jwX:()=>d8,TdZ:()=>dZ,DhA:()=>d1,g$R:()=>b8,WSs:()=>fZ,a45:()=>cM,N6N:()=>g,X0p:()=>dm,pnU:()=>cN,l0v:()=>i,Lq6:()=>dV,V9M:()=>eR,$w9:()=>eV,jTf:()=>eX,$BP:()=>eS,JAl:()=>eT,$3l:()=>eU,MgS:()=>dv,gzP:()=>eP,QCA:()=>eQ,C05:()=>fX,AaX:()=>bW,GWi:()=>dW,Yc8:()=>eM});let d=["0031_audit_capture_by_time_index","0032_audit_capture_by_id_index","0033_audit_capture_location_index","0034_findings_read_indexes"],e=[{tag:"0000_acoustic_felicia_hardy",sql:"CREATE TABLE `audit_events` (\n	`id` text PRIMARY KEY NOT NULL,\n	`parent_id` text,\n	`root_session_id` text,\n	`event_type` text NOT NULL,\n	`host_id` text,\n	`harness_id` text,\n	`source_project_id` text,\n	`started_at` integer NOT NULL,\n	`ended_at` integer,\n	`severity` text,\n	`priority` text,\n	`content` text,\n	`content_hash` text,\n	`attributes` text,\n	FOREIGN KEY (`parent_id`) REFERENCES `audit_events`(`id`) ON UPDATE no action ON DELETE no action,\n	FOREIGN KEY (`root_session_id`) REFERENCES `audit_events`(`id`) ON UPDATE no action ON DELETE no action,\n	FOREIGN KEY (`host_id`) REFERENCES `inventory`(`id`) ON UPDATE no action ON DELETE no action,\n	FOREIGN KEY (`harness_id`) REFERENCES `inventory`(`id`) ON UPDATE no action ON DELETE no action,\n	FOREIGN KEY (`source_project_id`) REFERENCES `source_project`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_audit_parent` ON `audit_events` (`parent_id`);--\x3e statement-breakpoint\nCREATE INDEX `idx_audit_session` ON `audit_events` (`root_session_id`,`started_at`);--\x3e statement-breakpoint\nCREATE INDEX `idx_audit_harness_t` ON `audit_events` (`harness_id`,`started_at`);--\x3e statement-breakpoint\nCREATE INDEX `idx_audit_project_t` ON `audit_events` (`source_project_id`,`started_at`);--\x3e statement-breakpoint\nCREATE TABLE `classified_data` (\n	`id` text PRIMARY KEY NOT NULL,\n	`class` text NOT NULL,\n	`label` text,\n	`attributes` text\n);\n--\x3e statement-breakpoint\nCREATE TABLE `events` (\n	`id` text PRIMARY KEY NOT NULL,\n	`source_tool` text NOT NULL,\n	`kind` text NOT NULL,\n	`occurred_at` integer NOT NULL,\n	`content_hash` text NOT NULL,\n	`content` text NOT NULL,\n	`metadata` text\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_events_occurred` ON `events` (`occurred_at`);--\x3e statement-breakpoint\nCREATE TABLE `findings` (\n	`id` text PRIMARY KEY NOT NULL,\n	`event_id` text NOT NULL,\n	`rule_id` text NOT NULL,\n	`category` text NOT NULL,\n	`severity` text NOT NULL,\n	`span_start` integer NOT NULL,\n	`span_end` integer NOT NULL,\n	`masked_match` text NOT NULL,\n	`action_taken` text NOT NULL,\n	`confidence` real NOT NULL,\n	FOREIGN KEY (`event_id`) REFERENCES `events`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_findings_event` ON `findings` (`event_id`);--\x3e statement-breakpoint\nCREATE TABLE `inspection_definitions` (\n	`id` text PRIMARY KEY NOT NULL,\n	`rule_id` text NOT NULL,\n	`name` text NOT NULL,\n	`category` text NOT NULL,\n	`severity` text NOT NULL,\n	`definition` text NOT NULL,\n	`version` text NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE TABLE `inspection_findings` (\n	`id` text PRIMARY KEY NOT NULL,\n	`audit_event_id` text NOT NULL,\n	`inspection_definition_id` text NOT NULL,\n	`classified_data_id` text,\n	`span_start` integer NOT NULL,\n	`span_end` integer NOT NULL,\n	`masked_match` text NOT NULL,\n	`action_taken` text NOT NULL,\n	`confidence` real NOT NULL,\n	FOREIGN KEY (`audit_event_id`) REFERENCES `audit_events`(`id`) ON UPDATE no action ON DELETE no action,\n	FOREIGN KEY (`inspection_definition_id`) REFERENCES `inspection_definitions`(`id`) ON UPDATE no action ON DELETE no action,\n	FOREIGN KEY (`classified_data_id`) REFERENCES `classified_data`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_inspection_findings_event` ON `inspection_findings` (`audit_event_id`);--\x3e statement-breakpoint\nCREATE TABLE `installed_packs` (\n	`id` text PRIMARY KEY NOT NULL,\n	`namespace` text NOT NULL,\n	`pack_id` text NOT NULL,\n	`version` text NOT NULL,\n	`name` text NOT NULL,\n	`rules_json` text NOT NULL,\n	`enabled` integer DEFAULT true NOT NULL,\n	`policy_id` text,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_installed_packs_pack` ON `installed_packs` (`namespace`,`pack_id`);--\x3e statement-breakpoint\nCREATE TABLE `inventory` (\n	`id` text PRIMARY KEY NOT NULL,\n	`object_type` text NOT NULL,\n	`location` text,\n	`title` text,\n	`host_id` text,\n	`attributes` text NOT NULL,\n	`os_version` text GENERATED ALWAYS AS (json_extract(attributes, '$.os_version')) VIRTUAL,\n	`harness_version` text GENERATED ALWAYS AS (json_extract(attributes, '$.harness_version')) VIRTUAL,\n	`first_seen` integer NOT NULL,\n	`last_seen` integer NOT NULL,\n	FOREIGN KEY (`host_id`) REFERENCES `inventory`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_inventory_type` ON `inventory` (`object_type`);--\x3e statement-breakpoint\nCREATE INDEX `idx_inventory_type_osver` ON `inventory` (`object_type`,`os_version`);--\x3e statement-breakpoint\nCREATE INDEX `idx_inventory_type_harnessver` ON `inventory` (`object_type`,`harness_version`);--\x3e statement-breakpoint\nCREATE TABLE `policies` (\n	`id` text PRIMARY KEY NOT NULL,\n	`scope` text DEFAULT 'global' NOT NULL,\n	`target` text NOT NULL,\n	`action` text NOT NULL,\n	`enabled` integer DEFAULT true NOT NULL,\n	`custom_keywords` text,\n	`name` text,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_policies_scope_target` ON `policies` (`scope`,`target`);--\x3e statement-breakpoint\nCREATE TABLE `source_project` (\n	`id` text PRIMARY KEY NOT NULL,\n	`url` text,\n	`name` text,\n	`attributes` text NOT NULL,\n	`first_seen` integer NOT NULL,\n	`last_seen` integer NOT NULL\n);\n"},{tag:"0001_adorable_marten_broadcloak",sql:"ALTER TABLE `audit_events` ADD `input_tokens` integer GENERATED ALWAYS AS (json_extract(attributes, '$.input_tokens')) VIRTUAL;--\x3e statement-breakpoint\nALTER TABLE `audit_events` ADD `output_tokens` integer GENERATED ALWAYS AS (json_extract(attributes, '$.output_tokens')) VIRTUAL;--\x3e statement-breakpoint\nALTER TABLE `audit_events` ADD `cache_creation_input_tokens` integer GENERATED ALWAYS AS (json_extract(attributes, '$.cache_creation_input_tokens')) VIRTUAL;--\x3e statement-breakpoint\nALTER TABLE `audit_events` ADD `cache_read_input_tokens` integer GENERATED ALWAYS AS (json_extract(attributes, '$.cache_read_input_tokens')) VIRTUAL;--\x3e statement-breakpoint\nALTER TABLE `audit_events` ADD `model` text GENERATED ALWAYS AS (json_extract(attributes, '$.model')) VIRTUAL;--\x3e statement-breakpoint\nALTER TABLE `audit_events` ADD `provider` text GENERATED ALWAYS AS (json_extract(attributes, '$.provider')) VIRTUAL;--\x3e statement-breakpoint\nCREATE INDEX `idx_audit_session_type` ON `audit_events` (`root_session_id`,`started_at`) WHERE event_type = 'llm_call';"},{tag:"0002_groovy_big_bertha",sql:"CREATE TABLE `exceptions` (\n	`id` text PRIMARY KEY NOT NULL,\n	`rule_id` text NOT NULL,\n	`category` text NOT NULL,\n	`value_fingerprint` text NOT NULL,\n	`key_version` integer NOT NULL,\n	`masked_value` text NOT NULL,\n	`scope` text NOT NULL,\n	`expires_at` integer,\n	`max_uses` integer,\n	`use_count` integer DEFAULT 0 NOT NULL,\n	`last_used_at` integer,\n	`justification` text NOT NULL,\n	`conditions` text,\n	`created_by` text NOT NULL,\n	`created_via` text NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL,\n	`revoked_at` integer,\n	`revoked_by` text,\n	`revoke_reason` text\n);\n--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_exceptions_active` ON `exceptions` (`rule_id`,`value_fingerprint`,`key_version`) WHERE revoked_at IS NULL;"},{tag:"0003_rich_sage",sql:"CREATE TABLE `egress_decision_override` (\n	`id` text PRIMARY KEY NOT NULL,\n	`destination_id` text NOT NULL,\n	`decision` text NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL,\n	FOREIGN KEY (`destination_id`) REFERENCES `share_destination`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_egress_decision_override` ON `egress_decision_override` (`destination_id`);--\x3e statement-breakpoint\nCREATE TABLE `file_access_override` (\n	`id` text PRIMARY KEY NOT NULL,\n	`project_id` text NOT NULL,\n	`path` text NOT NULL,\n	`access` text NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL,\n	FOREIGN KEY (`project_id`) REFERENCES `source_project`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_file_access_override_project` ON `file_access_override` (`project_id`);--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_file_access_override` ON `file_access_override` (`project_id`,`path`);--\x3e statement-breakpoint\nCREATE TABLE `harness_asset` (\n	`id` text PRIMARY KEY NOT NULL,\n	`harness_id` text NOT NULL,\n	`asset_id` text NOT NULL,\n	`created_at` integer NOT NULL,\n	FOREIGN KEY (`harness_id`) REFERENCES `inventory`(`id`) ON UPDATE no action ON DELETE no action,\n	FOREIGN KEY (`asset_id`) REFERENCES `inventory_asset`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_harness_asset_harness` ON `harness_asset` (`harness_id`);--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_harness_asset` ON `harness_asset` (`harness_id`,`asset_id`);--\x3e statement-breakpoint\nCREATE TABLE `inventory_asset` (\n	`id` text PRIMARY KEY NOT NULL,\n	`asset_type` text NOT NULL,\n	`name` text NOT NULL,\n	`sub` text,\n	`description` text,\n	`flags_json` text DEFAULT '[]' NOT NULL,\n	`meta_json` text DEFAULT '{}' NOT NULL,\n	`trust` text,\n	`tools_json` text,\n	`provenance` text DEFAULT 'scan' NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_inventory_asset_type` ON `inventory_asset` (`asset_type`);--\x3e statement-breakpoint\nCREATE TABLE `mcp_trust_override` (\n	`id` text PRIMARY KEY NOT NULL,\n	`asset_id` text NOT NULL,\n	`trust` text NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL,\n	FOREIGN KEY (`asset_id`) REFERENCES `inventory_asset`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_mcp_trust_override` ON `mcp_trust_override` (`asset_id`);--\x3e statement-breakpoint\nCREATE TABLE `project_file` (\n	`id` text PRIMARY KEY NOT NULL,\n	`project_id` text NOT NULL,\n	`path` text NOT NULL,\n	`name` text NOT NULL,\n	`origin` text NOT NULL,\n	`default_access` text NOT NULL,\n	`findings_count` integer DEFAULT 0 NOT NULL,\n	`blocked_at` integer,\n	`note` text,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL,\n	FOREIGN KEY (`project_id`) REFERENCES `source_project`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_project_file_project` ON `project_file` (`project_id`);--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_project_file` ON `project_file` (`project_id`,`path`);--\x3e statement-breakpoint\nCREATE TABLE `share_call_site` (\n	`id` text PRIMARY KEY NOT NULL,\n	`endpoint_id` text NOT NULL,\n	`project` text NOT NULL,\n	`file` text NOT NULL,\n	`line` integer NOT NULL,\n	`snippet` text NOT NULL,\n	`dynamic` integer DEFAULT false NOT NULL,\n	`vendored` integer DEFAULT false NOT NULL,\n	`project_id` text,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL,\n	FOREIGN KEY (`endpoint_id`) REFERENCES `share_endpoint`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_share_call_site_endpoint` ON `share_call_site` (`endpoint_id`);--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_share_call_site` ON `share_call_site` (`endpoint_id`,`project`,`file`,`line`);--\x3e statement-breakpoint\nCREATE TABLE `share_destination` (\n	`id` text PRIMARY KEY NOT NULL,\n	`kind` text NOT NULL,\n	`name` text NOT NULL,\n	`host` text NOT NULL,\n	`category` text NOT NULL,\n	`trust` text NOT NULL,\n	`note` text,\n	`network_json` text,\n	`last_seen` integer NOT NULL,\n	`provenance` text DEFAULT 'scan' NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_share_destination_kind` ON `share_destination` (`kind`);--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_share_destination_host` ON `share_destination` (`host`);--\x3e statement-breakpoint\nCREATE TABLE `share_endpoint` (\n	`id` text PRIMARY KEY NOT NULL,\n	`destination_id` text NOT NULL,\n	`method` text NOT NULL,\n	`transport` text NOT NULL,\n	`url` text NOT NULL,\n	`template` integer DEFAULT false NOT NULL,\n	`data_class` text NOT NULL,\n	`last_seen` integer NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL,\n	FOREIGN KEY (`destination_id`) REFERENCES `share_destination`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_share_endpoint_dest` ON `share_endpoint` (`destination_id`);--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_share_endpoint` ON `share_endpoint` (`destination_id`,`method`,`url`);"},{tag:"0004_glorious_mindworm",sql:"CREATE TABLE `available_packs` (\n	`id` text PRIMARY KEY NOT NULL,\n	`namespace` text NOT NULL,\n	`pack_id` text NOT NULL,\n	`version` text NOT NULL,\n	`name` text NOT NULL,\n	`rules_json` text NOT NULL,\n	`updated_at` integer NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_available_packs_pack` ON `available_packs` (`namespace`,`pack_id`);"},{tag:"0005_fast_vindicator",sql:'PRAGMA foreign_keys=OFF;--\x3e statement-breakpoint\nCREATE TABLE `__new_mcp_trust_override` (\n	`id` text PRIMARY KEY NOT NULL,\n	`asset_id` text NOT NULL,\n	`trust` text NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL\n);\n--\x3e statement-breakpoint\nINSERT INTO `__new_mcp_trust_override`("id", "asset_id", "trust", "created_at", "updated_at") SELECT "id", "asset_id", "trust", "created_at", "updated_at" FROM `mcp_trust_override`;--\x3e statement-breakpoint\nDROP TABLE `mcp_trust_override`;--\x3e statement-breakpoint\nALTER TABLE `__new_mcp_trust_override` RENAME TO `mcp_trust_override`;--\x3e statement-breakpoint\nPRAGMA foreign_keys=ON;--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_mcp_trust_override` ON `mcp_trust_override` (`asset_id`);'},{tag:"0006_magenta_flatman",sql:'CREATE TABLE `_pack_write_gate` (\n	`id` integer PRIMARY KEY NOT NULL,\n	`open` integer DEFAULT 0 NOT NULL,\n	CONSTRAINT "ck_pack_write_gate_single_row" CHECK("_pack_write_gate"."id" = 1)\n);\n--\x3e statement-breakpoint\nALTER TABLE `available_packs` ADD `recorded_by` text;--\x3e statement-breakpoint\nINSERT OR IGNORE INTO _pack_write_gate (id, open) VALUES (1, 0);\n--\x3e statement-breakpoint\nCREATE TRIGGER trg_installed_packs_write_gate\nBEFORE UPDATE OF version, name, rules_json ON installed_packs\nWHEN (SELECT open FROM _pack_write_gate WHERE id = 1) IS NOT 1\nBEGIN SELECT RAISE(IGNORE); END;'},{tag:"0007_thick_stick",sql:"CREATE TABLE `finding_resolution` (\n	`id` text PRIMARY KEY NOT NULL,\n	`finding_key` text NOT NULL,\n	`status` text NOT NULL,\n	`method` text NOT NULL,\n	`resolved_at` integer NOT NULL,\n	`evidence` text,\n	`created_at` integer NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_finding_resolution_key` ON `finding_resolution` (`finding_key`);--\x3e statement-breakpoint\nALTER TABLE `findings` ADD `finding_key` text;--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_findings_key` ON `findings` (`finding_key`);"},{tag:"0008_freezing_selene",sql:"ALTER TABLE `findings` ADD `first_detected_at` integer;--\x3e statement-breakpoint\nUPDATE `findings` SET `first_detected_at` = (SELECT `occurred_at` FROM `events` WHERE `events`.`id` = `findings`.`event_id`) WHERE `first_detected_at` IS NULL;"},{tag:"0009_findings_path_expression_index",sql:"-- Custom migration: partial expression index for the resolver's per-path reads.\n--\n-- openAtRestKeysForPath / resolvedAtRestKeysForPath (and the scanner's tier-3\n-- open-key probe) filter at-rest events by\n--   e.kind = 'code_change' AND json_extract(e.metadata, '$.filePath') = :path\n-- once per changed/deleted file on every scan — previously a full events scan\n-- per file. json_extract is deterministic, so SQLite allows it in an index;\n-- the WHERE kind = 'code_change' keeps the index to exactly the rows those\n-- queries can match (in-flight events are never path-addressed).\nCREATE INDEX `idx_events_code_change_path` ON `events` (json_extract(`metadata`, '$.filePath')) WHERE `kind` = 'code_change';\n"},{tag:"0010_events_session_expression_index",sql:"-- Custom migration: partial expression index for session-scoped finding reads.\n--\n-- sessionFindingsCount, the session-scoped listGroupedFindings paths, and the\n-- insert-time session dedup all filter live-capture events by\n--   json_extract(e.metadata, '$.sessionId') = :sessionId\n-- — previously a full findings-join scan with a JSON parse per row. The\n-- IS NOT NULL predicate keeps the index to session-stamped events only (an\n-- equality probe implies non-null, so SQLite still uses it).\nCREATE INDEX `idx_events_session_id` ON `events` (json_extract(`metadata`, '$.sessionId')) WHERE json_extract(`metadata`, '$.sessionId') IS NOT NULL;\n"},{tag:"0011_egress_writer",sql:'-- Stable per-project reconcile key for egress call sites, plus a host-keyed\n-- egress decision override that survives destination pruning.\n--\n-- DROP INDEX IF EXISTS, not a bare DROP: the applier replays a pending\n-- migration\'s non-index statements verbatim, so a store that lost\n-- uq_share_call_site out of band would throw here — and on the plugin hook path\n-- that throw is swallowed fail-open, silently stopping capture.\n--\n-- Existing rows carry the old key\'s discriminator into project_key\n-- (\'legacy:\' || project), so the new unique index is a re-encoding of the old\n-- one and cannot collide on rows the old one allowed. Leaving them on the\n-- column default would collapse two projects\' identical file/line hits onto\n-- one key and abort the whole migration. Writer keys are \'git:\'/\'path:\'-\n-- prefixed, so a backfilled row never collides with a captured one either.\n--\n-- egress_decision_override.destination_id becomes nullable with ON DELETE SET\n-- NULL, which SQLite can only do by rebuilding the table. `host` is ADDed\n-- before the rebuild so the copy has a column to read and so the migration\n-- still presents two probeable columns to the applier\'s evidence check.\nALTER TABLE `share_call_site` ADD `project_key` text DEFAULT \'\' NOT NULL;--\x3e statement-breakpoint\nUPDATE `share_call_site` SET `project_key` = \'legacy:\' || `project`;--\x3e statement-breakpoint\nDROP INDEX IF EXISTS `uq_share_call_site`;--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_share_call_site` ON `share_call_site` (`endpoint_id`,`project_key`,`file`,`line`);--\x3e statement-breakpoint\nCREATE INDEX `idx_share_call_site_project` ON `share_call_site` (`project_key`,`endpoint_id`);--\x3e statement-breakpoint\nALTER TABLE `egress_decision_override` ADD `host` text;--\x3e statement-breakpoint\nPRAGMA foreign_keys=OFF;--\x3e statement-breakpoint\nCREATE TABLE `__new_egress_decision_override` (\n	`id` text PRIMARY KEY NOT NULL,\n	`destination_id` text,\n	`host` text,\n	`decision` text NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL,\n	FOREIGN KEY (`destination_id`) REFERENCES `share_destination`(`id`) ON UPDATE no action ON DELETE set null\n);\n--\x3e statement-breakpoint\nINSERT INTO `__new_egress_decision_override`("id", "destination_id", "host", "decision", "created_at", "updated_at") SELECT "id", "destination_id", "host", "decision", "created_at", "updated_at" FROM `egress_decision_override`;--\x3e statement-breakpoint\nDROP TABLE `egress_decision_override`;--\x3e statement-breakpoint\nALTER TABLE `__new_egress_decision_override` RENAME TO `egress_decision_override`;--\x3e statement-breakpoint\nPRAGMA foreign_keys=ON;--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_egress_decision_override` ON `egress_decision_override` (`destination_id`);--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_egress_decision_override_host` ON `egress_decision_override` (`host`) WHERE `host` IS NOT NULL;\n'},{tag:"0012_handy_the_captain",sql:"ALTER TABLE `inspection_findings` ADD `finding_key` text;--\x3e statement-breakpoint\nALTER TABLE `inspection_findings` ADD `first_detected_at` integer;--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_inspection_findings_key` ON `inspection_findings` (`finding_key`);"},{tag:"0013_legacy_history_backfill_support",sql:"-- Legacy-to-generalized backfill support: the schema the resumable\n-- events/findings -> audit_events/inspection_findings copy needs (the row\n-- copy itself runs as a batched post-migration installer, not here — see\n-- @akasecurity/persistence's migrations.ts), plus the audit_events read-path\n-- indexes replacing the ones the legacy events table carried (0009/0010).\n\n-- Tracks how far the batched, resumable copy has advanced through each legacy\n-- table, by rowid, so a copy interrupted mid-run resumes instead of\n-- restarting, and a completed copy is a cheap no-op on every later open.\nCREATE TABLE `legacy_copy_watermark` (\n	`source` text PRIMARY KEY NOT NULL,\n	`last_rowid` integer DEFAULT 0 NOT NULL\n);\n--\x3e statement-breakpoint\n-- Serves the time-range read family that scans a single event_type across a\n-- start/end window (e.g. the Activity timeline) without a full-table scan.\nCREATE INDEX `idx_audit_type_t` ON `audit_events` (`event_type`,`started_at`);\n--\x3e statement-breakpoint\n-- Partial expression index mirroring `idx_events_code_change_path` (0009) for\n-- the generalized audit_events/attributes pair: file-path reads filter\n-- `event_type = 'code_change' AND json_extract(attributes, '$.file_path') = :path`.\nCREATE INDEX `idx_audit_code_change_path` ON `audit_events` (json_extract(`attributes`, '$.file_path')) WHERE `event_type` = 'code_change';\n--\x3e statement-breakpoint\n-- Synthesizes a stub session root (event_type = 'session', no attributes) for\n-- every legacy `events.metadata.sessionId` that has no audit_events row yet.\n-- audit_events.root_session_id is a self-FK, enforced with foreign-key\n-- checking on, and INSERT OR IGNORE does not suppress a foreign-key violation\n-- (only UNIQUE/PK/NOT NULL/CHECK) — so this must run before the events copy\n-- resolves root_session_id, or every session-scoped row's insert fails.\n-- started_at takes the earliest legacy occurred_at recorded under that\n-- session, so the stub root's own timeline position is never later than\n-- anything it will end up parenting.\nINSERT INTO audit_events (id, event_type, root_session_id, started_at)\nSELECT\n	json_extract(metadata, '$.sessionId'),\n	'session',\n	NULL,\n	min(occurred_at)\nFROM events\nWHERE json_valid(metadata)\n	AND json_extract(metadata, '$.sessionId') IS NOT NULL\n	AND json_extract(metadata, '$.sessionId') NOT IN (SELECT id FROM audit_events)\nGROUP BY json_extract(metadata, '$.sessionId');\n"},{tag:"0014_drop_legacy_events_findings",sql:"-- Custom migration: drops the frozen legacy `events`/`findings` tables\n-- (superseded by audit_events/inspection_definitions/inspection_findings) and\n-- replaces them with read-only views of the same name.\n--\n-- persistence's migrations.ts applies this migration ONLY once the batched\n-- history backfill (see runLegacyHistoryBackfill) has fully drained both\n-- tables, and only after copying the live file aside — see\n-- backupBeforeLegacyDrop in packages/persistence/src/migrations.ts. A store\n-- still mid-copy keeps its real tables and this migration stays pending.\n--\n-- The views exist for skew: the `aka` CLI and the Claude Code plugin update\n-- independently against one shared store, so an older, already-installed\n-- binary can open a store a newer binary already dropped these tables on.\n-- Every already-shipped repository constructor prepares its SQL eagerly at\n-- open time, so a bare \"table not found\" would fail the WHOLE open, not just\n-- a findings-specific read — these views keep `prepare()` succeeding so an\n-- old binary's unrelated features keep working; its own reads stay truthful,\n-- and its rare (already fail-open) writes fail at run time instead.\n--\n-- The 0009/0010 expression indexes existed only over the legacy `events`\n-- table; DROP TABLE below would remove them implicitly, but they are\n-- dropped explicitly first so the intent reads clearly. IF EXISTS so a store\n-- that reached here with an index missing out of band (an adopted-tag store\n-- whose physical index was never built) does not throw a deterministic \"no\n-- such index\" out of the fail-open drop path.\nDROP INDEX IF EXISTS `idx_events_code_change_path`;\n--\x3e statement-breakpoint\nDROP INDEX IF EXISTS `idx_events_session_id`;\n--\x3e statement-breakpoint\n-- `findings.event_id` references `events.id` — drop the child first.\nDROP TABLE `findings`;\n--\x3e statement-breakpoint\nDROP TABLE `events`;\n--\x3e statement-breakpoint\n-- Legacy `events` shape, projected from audit_events: `kind`/`occurred_at`/\n-- `source_tool` become real columns again (source_tool round-trips through\n-- the attributes bag, the only place a capture-typed audit row keeps it);\n-- `metadata` is reconstructed as the old camelCase JSON object from the new\n-- snake_case attributes bag, with `root_session_id` folded back in as\n-- `sessionId` (the one legacy metadata key that became a column, never an\n-- attribute, on the new table). Constrained to the four capture kinds so\n-- structural rows (session/run/tool_call/llm_call/source_lookup/config_scan)\n-- never leak into a legacy reader's result set — the old `events` table\n-- never held them either.\nCREATE VIEW `events` AS\nSELECT\n  id,\n  json_extract(attributes, '$.source_tool') AS source_tool,\n  event_type AS kind,\n  started_at AS occurred_at,\n  content_hash,\n  content,\n  -- Plugin-local bookkeeping column that `ensureSyncedAtColumn` adds to the\n  -- real `events` table at open time. A pre-cutover binary runs that probe on\n  -- EVERY open; without this projection its `columnNames('events')` check\n  -- misses `synced_at` and issues `ALTER TABLE events ADD COLUMN` against this\n  -- view, which SQLite rejects (\"Cannot add a column to a view\") — a hard,\n  -- non-fail-open crash of the whole open, the exact skew failure these views\n  -- exist to prevent. Projecting it (always NULL; no reader consumes it)\n  -- short-circuits that ALTER.\n  NULL AS synced_at,\n  json_object(\n    'sessionId', root_session_id,\n    'repo', json_extract(attributes, '$.repo'),\n    'filePath', json_extract(attributes, '$.file_path'),\n    'toolName', json_extract(attributes, '$.tool_name'),\n    'gitignored', json_extract(attributes, '$.gitignored'),\n    'wholeFile', json_extract(attributes, '$.whole_file'),\n    'model', json_extract(attributes, '$.model'),\n    'turnIndex', json_extract(attributes, '$.turn_index'),\n    'correlationId', json_extract(attributes, '$.correlation_id'),\n    'traceId', json_extract(attributes, '$.trace_id'),\n    'exceptionIds', json_extract(attributes, '$.exception_ids')\n  ) AS metadata\nFROM audit_events\nWHERE event_type IN ('prompt', 'response', 'code_change', 'tool_use');\n--\x3e statement-breakpoint\n-- A plain single-row INSERT (the old writer's shape — no ON CONFLICT) is\n-- accepted by prepare() against a view once an INSTEAD OF INSERT trigger\n-- exists, so it fails at run time instead of at open — landing in the same\n-- fail-open path the caller already wraps its write in.\nCREATE TRIGGER `trg_events_ro`\nINSTEAD OF INSERT ON `events`\nBEGIN SELECT RAISE(ABORT, 'events is read-only; write to audit_events instead'); END;\n--\x3e statement-breakpoint\n-- Legacy `findings` shape: rule_id/category/severity come from the joined\n-- inspection_definitions row (the legacy table inlined them per-row; the\n-- generalized schema normalizes them out into the shared definition). A view\n-- has no rowid of its own, so the underlying table's rowid is re-exposed\n-- explicitly under that name — a legacy reader ordering by `f.rowid` would\n-- otherwise fail to resolve the column at all. Joined to audit_events for the\n-- same four-capture-kind constraint as the events view above (a finding\n-- attached to a tool_call/config_scan row never existed in the legacy table\n-- either — see the persistence findings repository's identical predicate).\nCREATE VIEW `findings` AS\nSELECT\n  f.id AS id,\n  f.rowid AS rowid,\n  f.audit_event_id AS event_id,\n  d.rule_id AS rule_id,\n  d.category AS category,\n  d.severity AS severity,\n  f.span_start AS span_start,\n  f.span_end AS span_end,\n  f.masked_match AS masked_match,\n  f.action_taken AS action_taken,\n  f.confidence AS confidence,\n  f.finding_key AS finding_key,\n  f.first_detected_at AS first_detected_at\nFROM inspection_findings f\nJOIN audit_events e ON e.id = f.audit_event_id\nJOIN inspection_definitions d ON d.id = f.inspection_definition_id\nWHERE e.event_type IN ('prompt', 'response', 'code_change', 'tool_use');\n--\x3e statement-breakpoint\n-- Defense in depth only: SQLite refuses to plan ANY upsert against a view\n-- (\"cannot UPSERT a view\") no matter what trigger exists, so this can never\n-- rescue the real legacy writer, which always used\n-- `ON CONFLICT (finding_key) DO UPDATE` — that statement still fails at\n-- prepare() on an old binary, same as it would with no trigger at all. This\n-- only covers a plain-INSERT shape, should one ever exist.\nCREATE TRIGGER `trg_findings_ro`\nINSTEAD OF INSERT ON `findings`\nBEGIN SELECT RAISE(ABORT, 'findings is read-only; write to inspection_findings instead'); END;\n"},{tag:"0015_busy_vengeance",sql:"CREATE TABLE `secret_vault` (\n	`pointer_id` text PRIMARY KEY NOT NULL,\n	`value_fingerprint` text NOT NULL,\n	`fingerprint_key_version` integer NOT NULL,\n	`key_version` integer NOT NULL,\n	`category` text NOT NULL,\n	`rule_id` text NOT NULL,\n	`masked_match` text NOT NULL,\n	`provider` text,\n	`ciphertext` text NOT NULL,\n	`nonce` text NOT NULL,\n	`auth_tag` text NOT NULL,\n	`occurrence_count` integer DEFAULT 1 NOT NULL,\n	`first_seen` integer NOT NULL,\n	`last_seen` integer NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_secret_vault_value` ON `secret_vault` (`value_fingerprint`);--\x3e statement-breakpoint\nCREATE TABLE `secret_vault_deref` (\n	`id` text PRIMARY KEY NOT NULL,\n	`pointer_id` text NOT NULL,\n	`at` integer NOT NULL,\n	`target` text NOT NULL,\n	`reason` text NOT NULL,\n	`outcome` text NOT NULL,\n	`grant_id` text,\n	`pointer_count` integer DEFAULT 1 NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_secret_vault_deref_pointer` ON `secret_vault_deref` (`pointer_id`);--\x3e statement-breakpoint\nCREATE INDEX `idx_secret_vault_deref_reason_at` ON `secret_vault_deref` (`reason`,`at`);"},{tag:"0016_breezy_zodiak",sql:"ALTER TABLE `exceptions` ADD `capability` text DEFAULT 'suppress' NOT NULL;"},{tag:"0017_rainy_kat_farrell",sql:"CREATE TABLE `secret_vault_sighting` (\n	`id` text PRIMARY KEY NOT NULL,\n	`pointer_id` text NOT NULL,\n	`location` text NOT NULL,\n	`kind` text NOT NULL,\n	`first_seen` integer NOT NULL,\n	`last_seen` integer NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_secret_vault_sighting` ON `secret_vault_sighting` (`pointer_id`,`location`);"},{tag:"0018_serious_tana_nile",sql:"ALTER TABLE `secret_vault` ADD `format_version` integer DEFAULT 2 NOT NULL;"},{tag:"0019_audit_started_at_index",sql:"CREATE INDEX `idx_audit_started_at` ON `audit_events` (`started_at`);"},{tag:"0020_secret_vault_pagination_indexes",sql:"CREATE INDEX `idx_secret_vault_last_seen` ON `secret_vault` (`last_seen`,`pointer_id`);--\x3e statement-breakpoint\nCREATE INDEX `idx_secret_vault_reuse` ON `secret_vault` (`occurrence_count`,`pointer_id`);--\x3e statement-breakpoint\nCREATE INDEX `idx_secret_vault_deref_at` ON `secret_vault_deref` (`at`,`id`);--\x3e statement-breakpoint\nCREATE INDEX `idx_secret_vault_deref_signal` ON `secret_vault_deref` (`at`,`id`) WHERE `reason` NOT IN ('display', 'view-render');"},{tag:"0021_finding_resolution_resolved_at_index",sql:"CREATE INDEX `idx_finding_resolution_resolved_at` ON `finding_resolution` (`resolved_at`);\n"},{tag:"0022_audit_inspection_ms",sql:"ALTER TABLE `audit_events` ADD `inspection_ms` integer GENERATED ALWAYS AS (json_extract(attributes, '$.inspection_ms')) VIRTUAL;"},{tag:"0023_secret_vault_user_authorized",sql:"ALTER TABLE `secret_vault` ADD `user_authorized` integer DEFAULT 0 NOT NULL;"},{tag:"0024_finding_resolution_key_created_index",sql:"DROP INDEX IF EXISTS `idx_finding_resolution_key`;--\x3e statement-breakpoint\nCREATE INDEX `idx_finding_resolution_key_created` ON `finding_resolution` (`finding_key`,`created_at`);"},{tag:"0025_audit_capture_attribute_columns",sql:"ALTER TABLE `audit_events` ADD `source_tool` text GENERATED ALWAYS AS (json_extract(attributes, '$.source_tool')) VIRTUAL;--\x3e statement-breakpoint\nALTER TABLE `audit_events` ADD `repo` text GENERATED ALWAYS AS (json_extract(attributes, '$.repo')) VIRTUAL;--\x3e statement-breakpoint\nALTER TABLE `audit_events` ADD `file_path` text GENERATED ALWAYS AS (json_extract(attributes, '$.file_path')) VIRTUAL;--\x3e statement-breakpoint\nALTER TABLE `audit_events` ADD `tool_name` text GENERATED ALWAYS AS (json_extract(attributes, '$.tool_name')) VIRTUAL;"},{tag:"0026_audit_llm_call_usage_columns",sql:"ALTER TABLE `audit_events` ADD `service_tier` text GENERATED ALWAYS AS (json_extract(attributes, '$.service_tier')) VIRTUAL;--\x3e statement-breakpoint\nALTER TABLE `audit_events` ADD `ephemeral_1h_input_tokens` integer GENERATED ALWAYS AS (json_extract(attributes, '$.ephemeral_1h_input_tokens')) VIRTUAL;--\x3e statement-breakpoint\nALTER TABLE `audit_events` ADD `ephemeral_5m_input_tokens` integer GENERATED ALWAYS AS (json_extract(attributes, '$.ephemeral_5m_input_tokens')) VIRTUAL;--\x3e statement-breakpoint\nALTER TABLE `audit_events` ADD `web_search_requests` integer GENERATED ALWAYS AS (json_extract(attributes, '$.web_search_requests')) VIRTUAL;"},{tag:"0027_audit_llm_usage_index",sql:"CREATE INDEX `idx_audit_llm_usage` ON `audit_events` (`started_at`,`root_session_id`,`provider`,`model`,`service_tier`,`input_tokens`,`output_tokens`,`cache_creation_input_tokens`,`cache_read_input_tokens`,`ephemeral_1h_input_tokens`,`ephemeral_5m_input_tokens`,`web_search_requests`) WHERE event_type = 'llm_call' AND attributes IS NOT NULL;"},{tag:"0028_activity_session_probe_indexes",sql:"CREATE INDEX `idx_audit_session_prompt` ON `audit_events` (`root_session_id`) WHERE event_type = 'prompt';--\x3e statement-breakpoint\nCREATE INDEX `idx_audit_session_share` ON `audit_events` (`root_session_id`) WHERE event_type = 'share';--\x3e statement-breakpoint\nCREATE INDEX `idx_audit_ended_at` ON `audit_events` (`ended_at`,`root_session_id`) WHERE ended_at IS NOT NULL;--\x3e statement-breakpoint\nCREATE INDEX `idx_audit_session_ended` ON `audit_events` (`root_session_id`,`ended_at`) WHERE ended_at IS NOT NULL;--\x3e statement-breakpoint\n-- Expression index for the activity list's turns rollup: a live-captured\n-- session's turns are the DISTINCT `run_key` across its `llm_call` leaves, and\n-- carrying the extracted key in the index answers that count from the index\n-- alone instead of parsing every leaf's attribute bag. Written by hand, as\n-- 0013's `idx_audit_code_change_path` was: drizzle-kit cannot emit an\n-- expression containing a comma, so this index is not declared in sqlite.ts.\nCREATE INDEX `idx_audit_session_run_key` ON `audit_events` (`root_session_id`, json_extract(`attributes`, '$.run_key')) WHERE `event_type` = 'llm_call';\n"},{tag:"0029_audit_capture_rollup_index",sql:"CREATE INDEX `idx_audit_capture_rollup` ON `audit_events` (`event_type`,`started_at`,`repo`,`id`) WHERE event_type IN ('prompt','response','code_change','tool_use');"},{tag:"0030_audit_content_expiry",sql:"ALTER TABLE `audit_events` ADD `content_expired_at` integer;--\x3e statement-breakpoint\nCREATE INDEX `idx_audit_expirable_body` ON `audit_events` (`started_at`) WHERE content IS NOT NULL;"},{tag:"0031_audit_capture_by_time_index",sql:"CREATE INDEX `idx_audit_capture_by_time` ON `audit_events` (`started_at`,`id`,`event_type`,`root_session_id`,`source_tool`,`repo`,`file_path`,`tool_name`) WHERE event_type IN ('prompt','response','code_change','tool_use');"},{tag:"0032_audit_capture_by_id_index",sql:"CREATE INDEX `idx_audit_capture_by_id` ON `audit_events` (`id`,`started_at`,`event_type`,`root_session_id`,`source_tool`,`repo`,`file_path`,`tool_name`) WHERE event_type IN ('prompt','response','code_change','tool_use');"},{tag:"0033_audit_capture_location_index",sql:"CREATE INDEX `idx_audit_capture_location` ON `audit_events` (`repo`,`file_path`,`started_at`,`id`,`event_type`) WHERE event_type IN ('prompt','response','code_change','tool_use');"},{tag:"0034_findings_read_indexes",sql:"CREATE INDEX `idx_inspection_definitions_rule` ON `inspection_definitions` (`rule_id`,`severity`,`category`);--\x3e statement-breakpoint\nCREATE INDEX `idx_inspection_findings_def` ON `inspection_findings` (`inspection_definition_id`,`audit_event_id`);--\x3e statement-breakpoint\nCREATE INDEX `idx_inspection_findings_event_cover` ON `inspection_findings` (`audit_event_id`,`inspection_definition_id`,`action_taken`,`finding_key`,`id`);"},{tag:"0035_share_destination_provider_id",sql:"ALTER TABLE `share_destination` ADD `provider_id` text;"},{tag:"0036_secret_vault_identity_fingerprint",sql:"ALTER TABLE `secret_vault` ADD `value_identity_fingerprint` text DEFAULT '' NOT NULL;--\x3e statement-breakpoint\nUPDATE `secret_vault` SET `value_identity_fingerprint` = `value_fingerprint`;\n"}],f=/^(\d+)([mh])$/;function g(a,b=Date.now()){let c=a.trim().toLowerCase();return"once"===c?{scope:"once",expiresAt:new Date(b+18e5).toISOString(),maxUses:1}:"permanent"===c?{scope:"permanent",expiresAt:null,maxUses:null}:{scope:"temporary",expiresAt:new Date(b+function(a){let b=f.exec(a.trim()),c=b?Number(b[1]):0;if(!b||c<=0)throw Error(`invalid duration '${a}' — use <n>m or <n>h (e.g. 30m, 1h, 24h)`);let d=c*("h"===b[2]?36e5:6e4);if(d>864e5)throw Error(`duration '${a}' exceeds the 24h maximum for --for — use --permanent (revocable any time) for an open-ended grant`);return d}(c)).toISOString(),maxUses:null}}let h=/[\u00AD\u200B\u2060-\u2064\u202A-\u202E\u2066-\u2069\uFEFF\u{E0001}\u{E0020}-\u{E007F}]/gu;function i(a){return a.replace(h,"")}var j=c(87367);let k=j.Ikc({thresholdInputTokens:j.aig().int().positive(),input:j.aig().nonnegative().nullable(),output:j.aig().nonnegative().nullable()});function l(a,b,c){return Object.freeze({input:a,output:b,longContext:null,cacheWrite5m:1.25*a,cacheWrite1h:2*a,cacheRead:c,webSearch:.01})}function m(a,b,c={}){return Object.freeze({input:a,output:b,longContext:void 0===c.longContext?null:Object.freeze(c.longContext),cacheWrite5m:null,cacheWrite1h:null,cacheRead:c.cacheRead??null,webSearch:null})}j.Ikc({input:j.aig().nonnegative(),output:j.aig().nonnegative(),longContext:k.nullable(),cacheWrite5m:j.aig().nonnegative().nullable(),cacheWrite1h:j.aig().nonnegative().nullable(),cacheRead:j.aig().nonnegative().nullable(),webSearch:j.aig().nonnegative().nullable()});let n=Object.freeze({input:0,output:0,longContext:null,cacheWrite5m:0,cacheWrite1h:0,cacheRead:0,webSearch:0}),o=new Map([["standard",1],["batch",.5],["priority",1.5]]);j.k5n(["anthropic","openai","google","meta","mistral","deepseek","alibaba","xai","amazon","cohere","unknown"]),j.k5n(["anthropic","openai","google-ai","mistral","deepseek","xai","cohere","bedrock","vertex","azure","foundry","together","fireworks","groq","openrouter","ollama","local"]),j.k5n(["api","gateway","local"]);let p=new Map([["anthropic","api"],["openai","api"],["google-ai","api"],["mistral","api"],["deepseek","api"],["xai","api"],["cohere","api"],["bedrock","api"],["vertex","api"],["azure","api"],["foundry","api"],["together","gateway"],["fireworks","gateway"],["groq","gateway"],["openrouter","gateway"],["ollama","local"],["local","local"]]);function q(a){return p.get(a)??"api"}let r=new Map([["anthropic","anthropic"],["openai","openai"],["google","google-ai"],["mistral","mistral"],["deepseek","deepseek"],["xai","xai"],["cohere","cohere"]]),s=Object.freeze(["anthropic","amazon","meta","mistral","deepseek","qwen","cohere","ai21","writer","luma","stability"]),t=Object.freeze(["us","eu","apac","au","jp","global"]);class u{constructor(a,b={}){this.entries=[],this.vendor=a,this.defaults=b}model(a,b){var c,d;let e=b.family??this.defaults.family??{id:a,name:b.name},f=!1===b.firstParty?null:(c=this.vendor,r.get(c)??null),g=b.openWeights??this.defaults.openWeights??!1,h=b.region??this.defaults.region??null,i=b.retention??this.defaults.retention??"unknown",j=new Map;for(let a of(null!==f&&j.set(f,Object.freeze({platform:f,hosting:q(f),firstParty:!0,price:b.price??null,retention:i,region:h})),b.on??[])){let{platform:c,price:e,retention:f,region:g}="string"==typeof a?{platform:a}:a,k=(d=this.vendor,r.get(d)===c),l=q(c),m="local"===l;j.set(c,Object.freeze({platform:c,hosting:l,firstParty:k,price:e??(m?n:k?b.price??null:null),retention:f??(m?"on_infrastructure":k?i:"unknown"),region:void 0===g?k?h:null:g}))}let k=b.defaultHosting??this.defaults.defaultHosting??(null===f?"gateway":q(f));if(void 0!==b.price&&![...j.values()].some(a=>a.price===b.price))throw Error(`${a}: a first-party price was declared but no platform can carry it — vendor '${this.vendor}' has no first-party endpoint. Price the serving platform explicitly via the object form of \`on\`.`);let l={id:a,vendor:this.vendor,displayName:b.name,familyId:e.id,familyName:e.name,capability:b.capability??null,contextWindow:b.ctx??null,maxOutputTokens:b.maxOut??null,openWeights:g,aliases:Object.freeze([...b.aliases??[]]),training:this.defaults.training??null,platforms:j,defaultHosting:k,seen:b.seen??"managed"};return Object.freeze(l),Object.freeze(l.aliases),this.entries.push(l),l}models(){return this.entries}}function v(a,b={}){return new u(a,b)}let w=RegExp(`^(?:${t.join("|")})\\.`,"u"),x=RegExp(`^(?:${s.join("|")})\\.`,"u"),y=RegExp(`^(?:${s.join("|")})/`,"iu"),z=/^[a-z0-9][\w.-]*\//iu,A=/-v\d+:\d+$/u,B=/:\d+$/u,C=/@[\w-]+$/u,D=/-\d{8}$/u;function E(a,b){let c,d,e=b.byId.get(a);if(void 0!==e)return{entry:e,canonicalId:a,platform:null,raw:a};let{id:f,platform:g}=(c=a.trim(),d=null,w.test(c)&&(c=c.replace(w,""),d="bedrock"),x.test(c)&&(c=c.replace(x,""),d??="bedrock"),A.test(c)?(c=c.replace(A,""),d??="bedrock"):B.test(c)&&(c=c.replace(B,""),d??="bedrock"),C.test(c)&&(c=c.replace(C,""),d??="vertex"),y.test(c)?c=c.replace(y,""):z.test(c)&&(c=c.replace(z,"")),{id:c,platform:d}),h=b.byId.get(f);if(void 0!==h)return{entry:h,canonicalId:f,platform:g,raw:a};if(D.test(f)){let c=f.replace(D,""),d=b.byId.get(c);if(void 0!==d)return{entry:d,canonicalId:c,platform:g,raw:a}}return{entry:null,canonicalId:a,platform:g,raw:a}}let F=v("anthropic",{family:{id:"claude",name:"Claude"},region:"us",retention:"zero_retention",training:{apiDefault:"no",consumerDefault:"no",consumerControl:"opt-in",source:"https://privacy.claude.com/en/articles/7996868-is-my-data-used-for-model-training"}}),G=["bedrock","vertex","foundry"];F.model("claude-fable-5-1",{name:"Claude Fable 5.1",ctx:1e6,maxOut:128e3,capability:"reasoning",price:l(10,50,.25),on:[...G]}),F.model("claude-fable-5",{name:"Claude Fable 5",capability:"reasoning",price:l(10,50,1),on:[...G]}),F.model("claude-opus-5",{name:"Claude Opus 5",ctx:1e6,maxOut:128e3,capability:"reasoning",price:l(5,25,.5),on:[...G]}),F.model("claude-opus-4-8",{name:"Claude Opus 4.8",capability:"reasoning",price:l(5,25,.5),on:[...G]}),F.model("claude-opus-4-7",{name:"Claude Opus 4.7",capability:"reasoning",price:l(5,25,.5),on:[...G]}),F.model("claude-opus-4-6",{name:"Claude Opus 4.6",capability:"reasoning",price:l(5,25,.5),on:[...G]}),F.model("claude-opus-4-5",{name:"Claude Opus 4.5",capability:"reasoning",price:l(5,25,.5),on:[...G]}),F.model("claude-opus-4-1",{name:"Claude Opus 4.1",capability:"reasoning",price:l(15,75,1.5),on:[...G]}),F.model("claude-sonnet-5",{name:"Claude Sonnet 5",ctx:1e6,maxOut:128e3,capability:"reasoning",price:l(2,10,.2),on:[...G]}),F.model("claude-sonnet-4-6",{name:"Claude Sonnet 4.6",capability:"reasoning",price:l(3,15,.3),on:[...G]}),F.model("claude-sonnet-4-5",{name:"Claude Sonnet 4.5",capability:"reasoning",price:l(3,15,.3),on:[...G]}),F.model("claude-haiku-4-5",{name:"Claude Haiku 4.5",ctx:2e5,maxOut:64e3,capability:null,price:l(1,5,.1),aliases:["claude-haiku-4-5-20251001"],on:[...G]}),F.model("claude-sonnet-3-7",{name:"Claude Sonnet 3.7",on:[...G]});let H={thresholdInputTokens:272e3,input:null,output:null},I=v("openai",{family:{id:"gpt",name:"GPT"},region:"us",retention:"configurable",training:{apiDefault:"no",consumerDefault:"yes",consumerControl:"opt-out",source:"https://developers.openai.com/api/docs/guides/your-data"}}),J=["azure","foundry"];I.model("gpt-5.6-sol",{name:"GPT-5.6 Sol",ctx:105e4,maxOut:128e3,capability:"reasoning",price:m(4,20,{cacheRead:.4,longContext:H}),on:[...J]}),I.model("gpt-5.6-terra",{name:"GPT-5.6 Terra",ctx:105e4,maxOut:128e3,capability:"reasoning",price:m(2,12,{cacheRead:.2,longContext:H}),on:[...J]}),I.model("gpt-5.6-luna",{name:"GPT-5.6 Luna",ctx:105e4,maxOut:128e3,capability:null,price:m(.2,1.2,{cacheRead:.02,longContext:H}),on:[...J]}),I.model("gpt-5.5",{name:"GPT-5.5",ctx:105e4,maxOut:128e3,capability:"reasoning",price:m(5,30,{cacheRead:.5,longContext:H}),on:[...J]}),I.model("gpt-5.4",{name:"GPT-5.4",ctx:105e4,maxOut:128e3,capability:"reasoning",price:m(2.5,15,{cacheRead:.25,longContext:H}),on:[...J]}),I.model("gpt-5.4-mini",{name:"GPT-5.4 mini",ctx:4e5,maxOut:128e3,capability:null,price:m(.75,4.5,{cacheRead:.075}),on:[...J]}),I.model("gpt-5.4-nano",{name:"GPT-5.4 nano",ctx:4e5,maxOut:128e3,capability:null,price:m(.2,1.25,{cacheRead:.02}),on:[...J]}),I.model("gpt-5.3-codex",{name:"GPT-5.3 Codex",ctx:4e5,maxOut:128e3,capability:"code",price:m(1.75,14,{cacheRead:.175}),on:[...J]}),I.model("gpt-5.1",{name:"GPT-5.1",ctx:4e5,maxOut:128e3,capability:"reasoning",price:m(1.25,10,{cacheRead:.125}),on:[...J]}),I.model("gpt-5",{name:"GPT-5",ctx:4e5,maxOut:128e3,capability:"reasoning",price:m(1.25,10,{cacheRead:.125}),on:[...J]}),I.model("gpt-5-mini",{name:"GPT-5 mini",ctx:4e5,capability:null,price:m(.25,2,{cacheRead:.025}),on:[...J]}),I.model("gpt-5-nano",{name:"GPT-5 nano",ctx:4e5,maxOut:128e3,capability:null,price:m(.05,.4,{cacheRead:.005}),on:[...J]}),I.model("gpt-4.1",{name:"GPT-4.1",price:m(2,8,{cacheRead:.5}),on:[...J]}),I.model("gpt-4o",{name:"GPT-4o",price:m(2.5,10,{cacheRead:1.25}),on:[...J]}),I.model("gpt-4o-mini",{name:"GPT-4o mini",price:m(.15,.6,{cacheRead:.075}),on:[...J]}),I.model("gpt-4-turbo",{name:"GPT-4 Turbo",seen:"discovered",price:m(10,30),aliases:["gpt-4-turbo-2024-04-09"],on:[...J]}),I.model("o3",{name:"o3",capability:"reasoning",price:m(2,8,{cacheRead:.5}),on:[...J]}),I.model("gpt-oss-120b",{name:"GPT-OSS 120B",openWeights:!0,firstParty:!1,retention:"unknown",defaultHosting:"local",on:["together","fireworks","groq","openrouter","bedrock","ollama","local"]}),I.model("gpt-oss-20b",{name:"GPT-OSS 20B",openWeights:!0,firstParty:!1,retention:"unknown",defaultHosting:"local",on:["together","fireworks","groq","openrouter","ollama","local"]});let K=v("google",{family:{id:"gemini",name:"Gemini"},region:"us",retention:"configurable",training:{apiDefault:"no",consumerDefault:"yes",consumerControl:"none",source:"https://ai.google.dev/gemini-api/terms"}});K.model("gemini-3.7-flash",{name:"Gemini 3.7 Flash",capability:null,price:m(.75,3.75),on:["vertex"]}),K.model("gemini-3.6-flash",{name:"Gemini 3.6 Flash",capability:null,price:m(.75,3.75),on:["vertex"]}),K.model("gemini-3.5-flash",{name:"Gemini 3.5 Flash",capability:null,price:m(1.5,9),on:["vertex"]}),K.model("gemini-3.5-flash-lite",{name:"Gemini 3.5 Flash Lite",capability:null,price:m(.3,2.5),on:["vertex"]}),K.model("gemini-3.1-pro-preview",{name:"Gemini 3.1 Pro Preview",capability:"reasoning",price:m(2,12,{longContext:{thresholdInputTokens:2e5,input:4,output:18}}),on:["vertex"]}),K.model("gemini-2.5-pro",{name:"Gemini 2.5 Pro",capability:"reasoning",price:m(1.25,10,{longContext:{thresholdInputTokens:2e5,input:2.5,output:15}}),on:["vertex"]}),K.model("gemini-2.5-flash",{name:"Gemini 2.5 Flash",capability:null,price:m(.3,2.5),on:["vertex"]}),K.model("gemini-2.5-flash-lite",{name:"Gemini 2.5 Flash Lite",capability:null,price:m(.1,.4),on:["vertex"]}),K.model("gemini-1-5-pro",{name:"Gemini 1.5 Pro",on:["vertex"]}),K.model("gemini-1-5-flash",{name:"Gemini 1.5 Flash",on:["vertex"]});let L=v("xai",{family:{id:"grok",name:"Grok"},region:"us",retention:"configurable",training:{apiDefault:"no",consumerDefault:"unknown",consumerControl:"unknown",source:"https://docs.x.ai/developers/faq/security"}});L.model("grok-4.6",{name:"Grok 4.6",ctx:5e5,capability:"reasoning",price:m(2,6,{cacheRead:.5,longContext:{thresholdInputTokens:2e5,input:4,output:12}}),on:["bedrock"]}),L.model("grok-4.5",{name:"Grok 4.5",ctx:5e5,capability:"reasoning",price:m(2,6,{cacheRead:.3,longContext:{thresholdInputTokens:2e5,input:4,output:12}})}),L.model("grok-4.3",{name:"Grok 4.3",ctx:1e6,capability:"reasoning",price:m(1.25,2.5,{cacheRead:.2,longContext:{thresholdInputTokens:2e5,input:2.5,output:5}}),on:["bedrock"]}),L.model("grok-build-0.1",{name:"Grok Build 0.1",ctx:256e3,capability:"code",price:m(1,2,{cacheRead:.2,longContext:{thresholdInputTokens:2e5,input:2,output:4}})});let M=v("deepseek",{family:{id:"deepseek",name:"DeepSeek"},region:"cn",retention:"configurable",training:{apiDefault:"yes",consumerDefault:"yes",consumerControl:"opt-out",source:"https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html"}});M.model("deepseek-v4-flash",{name:"DeepSeek V4 Flash",ctx:1e6,capability:null,price:m(.44,1.32,{cacheRead:.014}),on:["bedrock","together","fireworks","openrouter","ollama","local"]}),M.model("deepseek-v4-pro",{name:"DeepSeek V4 Pro",ctx:1e6,capability:"reasoning",price:m(1.32,3.96,{cacheRead:.044}),on:["bedrock","together","fireworks","openrouter"]}),M.model("deepseek-r1",{name:"DeepSeek R1",seen:"discovered",capability:"reasoning",openWeights:!0,defaultHosting:"local",on:["bedrock","together","fireworks","openrouter","ollama","local"]});let N=v("cohere",{family:{id:"command",name:"Command"},region:"us",retention:"configurable",training:{apiDefault:"unknown",consumerDefault:"unknown",consumerControl:"opt-out",source:"https://cohere.com/security"}});N.model("command-a-plus-05-2026",{name:"Command A+",ctx:128e3,maxOut:64e3,on:["bedrock"]}),N.model("command-a-03-2025",{name:"Command A",ctx:256e3,maxOut:8e3,on:["bedrock"]}),N.model("command-a-reasoning-08-2025",{name:"Command A Reasoning",ctx:256e3,maxOut:32e3,capability:"reasoning"}),N.model("command-r-plus-08-2024",{name:"Command R+",ctx:128e3,maxOut:4e3,price:m(2.5,10),aliases:["command-r-plus"],on:["bedrock"]});let O=v("meta",{family:{id:"llama",name:"Llama"},openWeights:!0,retention:"unknown",defaultHosting:"local"}),P=["bedrock","together","fireworks","groq","openrouter","ollama","local"];O.model("llama-3-3-70b",{name:"Llama 3.3 70B",ctx:128e3,on:[...P]}),O.model("llama-3-1-70b",{name:"Llama 3.1 70B",ctx:128e3,on:[...P]}),O.model("llama-3-1-8b",{name:"Llama 3.1 8B",ctx:128e3,on:[...P]});let Q=v("alibaba",{family:{id:"qwen",name:"Qwen"},openWeights:!0,retention:"unknown",defaultHosting:"local"});Q.model("qwen-3-235b",{name:"Qwen 3 235B",on:[...P]}),Q.model("qwen-3-coder-480b",{name:"Qwen 3 Coder 480B",capability:"code",on:[...P]});let R=v("amazon",{family:{id:"nova",name:"Nova"},retention:"configurable"});R.model("nova-2-lite",{name:"Nova 2 Lite",ctx:1e6,maxOut:64e3,aliases:["nova-2-lite-v1:0"],on:["bedrock"]});let S=v("mistral",{family:{id:"mistral",name:"Mistral"},openWeights:!0,retention:"unknown",defaultHosting:"local"});S.model("mixtral-8x7b",{name:"Mixtral 8x7B",seen:"discovered",on:[...P]});let T=function(a){let b=new Map;for(let c of a)b.set(c.id,c);for(let c of a)for(let a of c.aliases)b.has(a)||b.set(a,c);return{byId:b,entries:Object.freeze([...a])}}(Object.freeze([...F.models(),...I.models(),...K.models(),...L.models(),...M.models(),...N.models(),...S.models(),...O.models(),...Q.models(),...R.models()]));j.k5n(["reasoning","code"]),j.k5n(["zero_retention","no_storage","configurable","on_device","on_infrastructure","unknown"]),j.k5n(["managed","discovered"]);let U=j.k5n(["yes","no","unknown"]),V=j.k5n(["opt-in","opt-out","none","unknown"]);j.Ikc({apiDefault:U,consumerDefault:U,consumerControl:V,source:j.YjP().nullable()});let W=j.k5n(["api","consumer","enterprise","unknown"]);function X(a){return new Date(a).getTime()}function Y(a){return new Date(a).toISOString()}j.Ikc({tier:W,controlExercised:j.zMY().nullable()}),Object.freeze({tier:"unknown",controlExercised:null});let Z=new Map([["anthropic","anthropic"],["openai","openai"],["google","google-ai"],["google-ai","google-ai"],["bedrock","bedrock"],["vertex","vertex"],["azure","azure"],["foundry","foundry"],["mistral","mistral"],["deepseek","deepseek"],["xai","xai"],["cohere","cohere"],["together","together"],["fireworks","fireworks"],["groq","groq"],["openrouter","openrouter"],["ollama","ollama"],["local","local"]]);function $(a){return Z.get(a.trim().toLowerCase())??null}function _(a){let b=$(a);return null!==b&&"local"===q(b)}Object.freeze(["gateway","unknown","cli","api","chatgpt","claude-ai"]);let aa={normalizeModelId(a,b){let c=a.trim().toLowerCase();if(_(c))return{provider:c,model:"*"};let d=E(b,T);return{provider:c,model:d.entry?.id??b}},costFor({provider:a,model:b,usage:c}){let d=function(a,b){if(_(a))return n;let c=E(b,T);if(null===c.entry)return null;let d=c.platform??$(a);return null===d?null:c.entry.platforms.get(d)?.price??null}(a,b);return null===d?null:function(a,b){var c;let d=[[b.cacheWrite1hTokens??0,a.cacheWrite1h],[b.cacheWrite5mTokens??0,a.cacheWrite5m],[b.cacheReadTokens??0,a.cacheRead]],e=null!==a.longContext&&(b.inputTokens??0)>a.longContext.thresholdInputTokens?a.longContext:null;if(null!==e&&(null===e.input||null===e.output))return null;let f=e?.input??a.input,g=e?.output??a.output,h=(b.inputTokens??0)*f+(b.outputTokens??0)*g;for(let[a,b]of d)if(0!==a){if(null===b)return null;h+=a*b}let i=h/1e6*(void 0===(c=b.serviceTier)?1:o.get(c)??1),j=b.webSearchRequests??0;return j>0&&null===a.webSearch?null:i+j*(a.webSearch??0)}(d,c)}};new Intl.NumberFormat("en-US",{notation:"compact",maximumFractionDigits:1});let ab=a=>a??0;function ac(a,b){let c=new Map;for(let{sessionId:d,attributes:e}of a){let a=e.provider??"unknown",f=e.model??"unknown",g=`${a} ${f}`,h=c.get(d);void 0===h&&(h=new Map,c.set(d,h));let i=h.get(g);void 0===i&&(i={provider:a,model:f,input:0,output:0,cacheCreation:0,cacheRead:0,costUsd:0,priced:!1},h.set(g,i)),i.input+=ab(e.input_tokens),i.output+=ab(e.output_tokens),i.cacheCreation+=ab(e.cache_creation_input_tokens),i.cacheRead+=ab(e.cache_read_input_tokens);let j=b.costFor({provider:a,model:f,usage:function(a){let b={inputTokens:ab(a.input_tokens),outputTokens:ab(a.output_tokens),cacheWrite1hTokens:ab(a.ephemeral_1h_input_tokens),cacheWrite5mTokens:ab(a.ephemeral_5m_input_tokens),cacheReadTokens:ab(a.cache_read_input_tokens),webSearchRequests:ab(a.web_search_requests)};return void 0!==a.service_tier&&(b.serviceTier=a.service_tier),b}(e)});null!==j&&(i.costUsd+=j,i.priced=!0)}let d=[];for(let[a,b]of c){let c=[],e=0,f=0,g=!1,h=!1;for(let d of b.values()){let b=d.input+d.output+d.cacheCreation+d.cacheRead;e+=b;let i=d.priced?d.costUsd:null;null===i?h=!0:(g=!0,f+=i),c.push({sessionId:a,model:d.model,provider:d.provider,inputTokens:d.input,outputTokens:d.output,cacheCreation:d.cacheCreation,cacheRead:d.cacheRead,totalTokens:b,estimatedCostUsd:i})}c.sort((a,b)=>b.totalTokens-a.totalTokens),d.push({sessionId:a,rollups:c,totalTokens:e,estimatedCostUsd:g?f:null,costIsPartial:h})}return d.sort((a,b)=>b.totalTokens-a.totalTokens),d}var ad=c(91456),ae=c(38906);let af={ClaudeCode:"claudecode",Cursor:"cursor",Copilot:"copilot",Codex:"codex",Antigravity:"antigravity",Windsurf:"windsurf",ClaudeDesktop:"claudedesktop",ChatGpt:"chatgpt",ClaudeAi:"claudeai",Api:"api",AiTcSdk:"ai-tc-sdk"},ag=j.k5n(af).meta({id:"Harness"}),ah={ClaudeCode:"claude-code",ClaudeDesktop:"claude-desktop",Cursor:"cursor",ChatGpt:"chatgpt",ClaudeAi:"claude-ai",Copilot:"github-copilot",Codex:"codex",Antigravity:"antigravity",Cli:"cli",Unknown:"unknown",AiTcSdk:"ai-tc-sdk"},ai=j.k5n(ah).meta({id:"SourceTool"}),aj=ai.extract(["ChatGpt","ClaudeAi"]),ak={[ah.ClaudeCode]:af.ClaudeCode,[ah.ClaudeDesktop]:af.ClaudeDesktop,[ah.Copilot]:af.Copilot,[ah.Cursor]:af.Cursor,[ah.ChatGpt]:af.ChatGpt,[ah.Codex]:af.Codex,[ah.Antigravity]:af.Antigravity,[ah.ClaudeAi]:af.ClaudeAi,[ah.AiTcSdk]:af.AiTcSdk},al=j.k5n(["pii","financial","secret","phi","code_context","code_flaw","custom","config"]).meta({id:"DetectionCategory"}),am=j.k5n(["critical","high","medium","low"]).meta({id:"Severity"}),an=j.k5n(["warn","redact","block","allow","log"]).meta({id:"ActionTaken"}),ao=an.options,ap=j.Ikc({start:j.aig().int().nonnegative(),end:j.aig().int().nonnegative()}).meta({id:"Span"});j.Ikc({id:j.OsD(),eventId:j.OsD(),ruleId:j.YjP(),category:al,severity:am,span:ap,maskedMatch:j.YjP(),actionTaken:an,confidence:j.aig().min(0).max(1)}).meta({id:"Finding"}).meta({id:"DetectedFinding"});let aq=j.k5n(["blocked","redacted","warned","allowed","quarantined","monitored"]).meta({id:"FindingAction"}),ar=ag.extract(["ClaudeCode","ClaudeDesktop","Cursor","Copilot","ChatGpt","ClaudeAi","Codex","Antigravity","Api","AiTcSdk"]).meta({id:"FindingProvider"}),as=j.k5n(["secret","pii","source_code","code_flaw","external_share","mcp_server","customer_data","financial","phi","custom"]).meta({id:"FindingCategory"});j.k5n(["in-flight","at-rest"]).meta({id:"FindingOrigin"});let at=j.k5n(["open","handled","resolved","dismissed"]).meta({id:"FindingStatus"}),au=j.k5n(["deployment_refused","payload_invalid","detached_undelivered"]).meta({id:"SyncFailureReason"}),av=j.k5n(["sent","queued","not_sent","never_offered","local_scan"]).meta({id:"FindingDeliveryState"}),aw=j.Ikc({state:av,at:ad.w$().optional(),reason:au.optional()}).meta({id:"FindingDelivery"}),ax=j.k5n(["enforced-in-flight","fixed-at-source","exception","acknowledged","false-positive","redetected"]).meta({id:"ResolutionMethod"}),ay=j.Ikc({maskedValue:j.YjP(),contextPrefix:j.YjP()}).meta({id:"FindingMatch"}),az=j.Ikc({id:j.YjP(),name:j.YjP().nullable()}).meta({id:"FindingDetectionRef"}),aA=j.Ikc({id:j.YjP(),name:j.YjP()}).meta({id:"FindingPolicyRef"}),aB=j.Ikc({id:j.YjP(),name:j.YjP()}).meta({id:"FindingUser"}),aC=j.Ikc({id:j.YjP(),provider:ar,repo:j.YjP(),file:j.YjP(),user:aB.optional(),toolName:j.YjP().optional(),action:aq,detectedAt:ad.w$(),confidence:j.aig().min(0).max(1),status:at.optional(),eventId:j.YjP().optional(),sessionId:j.YjP().optional(),delivery:aw.optional()}).meta({id:"FindingInstance"}),aD=j.Ikc({id:j.YjP(),category:as,subtype:j.YjP(),severity:am,match:ay,detection:az,policy:aA,instanceCount:j.aig().int().nonnegative(),providers:j.YOg(ar),aggregateAction:aq.nullable(),latestDetectedAt:ad.w$(),instances:j.YOg(aC),status:at.optional(),users:j.YOg(aB).optional()}).meta({id:"FindingGroup"});j.Ikc({findings:j.aig().int().nonnegative(),groups:j.aig().int().nonnegative(),bySeverity:j.Ikc({critical:j.aig().int().nonnegative(),high:j.aig().int().nonnegative(),medium:j.aig().int().nonnegative(),low:j.aig().int().nonnegative()})}).meta({id:"FindingStats"});let aE=j.Ikc({value:j.YjP(),count:j.aig().int().nonnegative()}).meta({id:"FindingFacetItem"}),aF=j.Ikc({severity:j.YOg(aE),subtype:j.YOg(aE),provider:j.YOg(aE),action:j.YOg(aE),status:j.YOg(aE),tool:j.YOg(aE).optional(),deployment:j.YOg(aE).optional()}).meta({id:"FindingFacets"}),aG=aD.omit({instances:!0,match:!0}).meta({id:"FindingTypeSummary"}),aH=50,aI=j.Ikc({severity:j.YOg(am).optional(),subtype:j.YOg(j.YjP()).optional(),provider:j.YOg(ar).optional(),action:j.YOg(aq).optional(),status:j.YOg(at).optional(),q:j.YjP().optional(),sessionId:j.YjP().optional(),from:ad.w$().optional(),includeId:j.YjP().optional(),limit:ae.ai().int().min(1).max(100).optional(),cursor:j.YjP().optional()});j.Ikc({totals:j.Ikc({findings:j.aig().int().nonnegative(),types:j.aig().int().nonnegative()}),facets:aF,items:j.YOg(aG),nextCursor:j.YjP().nullable(),sessionFirings:j.g1P(j.YjP(),j.aig().int().nonnegative()).optional()}).meta({id:"ListFindingTypesResponse"}),j.Ikc({action:aq.exclude(["quarantined"]),instanceId:j.YjP().optional()}).meta({id:"ApplyFindingActionRequest"}),aD.meta({id:"ApplyFindingActionResponse"}),j.Ikc({severity:j.YOg(am).optional(),subtype:j.YOg(j.YjP()).optional(),provider:j.YOg(ar).optional(),action:j.YOg(aq).optional(),q:j.YjP().optional(),format:j.k5n(["csv","json"]).optional()});let aJ=aC.extend({groupId:j.YjP(),category:as,subtype:j.YjP(),severity:am,match:ay,detection:az,policy:aA}).meta({id:"FindingInstanceDetail"}),aK=50,aL=j.Ikc({severity:j.YOg(am).optional(),subtype:j.YOg(j.YjP()).optional(),provider:j.YOg(ar).optional(),action:j.YOg(aq).optional(),status:j.YOg(at).optional(),tool:j.YOg(j.YjP()).optional(),deployment:j.YOg(av).optional(),repo:j.YjP().optional(),file:j.YjP().optional(),q:j.YjP().optional(),sessionId:j.YjP().optional(),from:ad.w$().optional(),limit:ae.ai().int().min(1).max(200).optional(),cursor:j.YjP().optional()});j.Ikc({totals:j.Ikc({findings:j.aig().int().nonnegative()}),facets:aF,items:j.YOg(aJ),nextCursor:j.YjP().nullable()}).meta({id:"ListFindingInstancesResponse"}),j.Ikc({items:j.YOg(aJ),nextCursor:j.YjP().nullable()}).meta({id:"ListFindingInstancesPage"});let aM=j.Ikc({id:j.YjP(),repo:j.YjP(),file:j.YjP(),instanceCount:j.aig().int().nonnegative(),maxSeverity:am,latestDetectedAt:ad.w$(),status:at.optional(),ruleIds:j.YOg(j.YjP())}).meta({id:"FindingLocationSummary"}),aN=50,aO=j.Ikc({severity:j.YOg(am).optional(),subtype:j.YOg(j.YjP()).optional(),provider:j.YOg(ar).optional(),action:j.YOg(aq).optional(),status:j.YOg(at).optional(),tool:j.YOg(j.YjP()).optional(),deployment:j.YOg(av).optional(),q:j.YjP().optional(),sessionId:j.YjP().optional(),from:ad.w$().optional(),includeId:j.YjP().optional(),limit:ae.ai().int().min(1).max(100).optional(),cursor:j.YjP().optional()});j.Ikc({totals:j.Ikc({findings:j.aig().int().nonnegative(),locations:j.aig().int().nonnegative()}),facets:aF,items:j.YOg(aM),nextCursor:j.YjP().nullable()}).meta({id:"ListFindingLocationsResponse"});let aP=j.k5n(["host","harness","user","skill","hook","mcp_server","config_file"]).meta({id:"InventoryObjectType"}),aQ=j.k5n(["session","run","tool_call","llm_call","source_lookup","prompt","response","code_change","tool_use","model_refusal","request_decision","config_scan","capture_status"]).meta({id:"AuditEventType"}),aR=j.g1P(j.YjP(),j.L5J());j.Ikc({host_name:j.YjP().optional(),os:j.YjP().optional(),os_version:j.YjP().optional(),arch:j.YjP().optional()}).catchall(j.L5J()),j.Ikc({harness_version:j.YjP().optional(),interface:j.YjP().optional()}).catchall(j.L5J()),j.Ikc({display_name:j.YjP().optional(),email:j.YjP().optional()}).catchall(j.L5J()),j.Ikc({source:j.YjP().optional(),version:j.YjP().optional(),description:j.YjP().optional(),updated_at:j.YjP().optional(),scope:j.YjP().optional(),plugin_name:j.YjP().optional()}).catchall(j.L5J()),j.Ikc({event:j.YjP().optional(),matcher:j.YjP().optional(),command:j.YjP().optional(),scope:j.YjP().optional(),plugin_name:j.YjP().optional(),timeout:j.aig().optional()}).catchall(j.L5J()),j.Ikc({scope:j.YjP().optional(),transport:j.YjP().optional(),command:j.YjP().optional(),url:j.YjP().optional(),env_keys:j.YOg(j.YjP()).optional(),plugin_name:j.YjP().optional(),marketplace:j.YjP().optional(),project:j.YjP().optional()}).catchall(j.L5J()),j.Ikc({kind:j.YjP().optional(),detail:j.YjP().optional(),scope:j.YjP().optional(),updated_at:j.YjP().optional(),entry_count:j.aig().optional()}).catchall(j.L5J());let aS=j.Ikc({model:j.YjP().optional(),provider:j.YjP().optional(),input_tokens:j.aig().int().nonnegative().optional(),output_tokens:j.aig().int().nonnegative().optional(),cache_creation_input_tokens:j.aig().int().nonnegative().optional(),cache_read_input_tokens:j.aig().int().nonnegative().optional(),ephemeral_1h_input_tokens:j.aig().int().nonnegative().optional(),ephemeral_5m_input_tokens:j.aig().int().nonnegative().optional(),web_search_requests:j.aig().int().nonnegative().optional(),web_fetch_requests:j.aig().int().nonnegative().optional(),service_tier:j.YjP().optional(),stop_reason:j.YjP().optional(),message_id:j.YjP().optional(),uuid:j.YjP().optional(),parent_uuid:j.YjP().optional(),run_key:j.YjP().optional()}).catchall(j.L5J());j.Ikc({sessionId:j.YjP().min(1),messageId:j.YjP().min(1),parentId:j.YjP().min(1),rootSessionId:j.YjP().min(1),startedAt:ad.w$(),attributes:aS});let aT=j.Ikc({tool_name:j.YjP().optional(),tool_use_id:j.YjP().optional(),target:j.YjP().optional(),is_error:j.zMY().optional(),input_size:j.aig().int().nonnegative().optional(),output_size:j.aig().int().nonnegative().optional(),uuid:j.YjP().optional(),parent_uuid:j.YjP().optional(),run_key:j.YjP().optional()}).catchall(j.L5J());j.Ikc({source_tool:j.YjP().optional(),file_path:j.YjP().optional(),repo:j.YjP().optional(),tool_name:j.YjP().optional(),gitignored:j.zMY().optional(),whole_file:j.zMY().optional(),correlation_id:j.uRe().optional(),trace_id:j.YjP().regex(/^[0-9a-f]{32}$/).optional(),exception_ids:j.YOg(j.OsD()).optional(),message_id:j.YjP().optional(),conversation_id:j.YjP().optional(),inspection_ms:j.aig().int().nonnegative().optional(),redact_degraded_to:an.optional()}).catchall(j.L5J());let aU=j.Ikc({source_tool:j.YjP().optional(),patched:j.zMY().optional(),live:j.zMY().optional(),blind:j.zMY().optional(),sends_seen_dom:j.aig().int().nonnegative().optional(),exchanges_seen_net:j.aig().int().nonnegative().optional(),parse_failures:j.aig().int().nonnegative().optional(),unparsed_bodies:j.aig().int().nonnegative().optional(),shape_misses:j.YOg(j.YjP()).optional(),conversation_endpoints:j.aig().int().nonnegative().optional(),closed:j.zMY().optional(),enforcement:j.YjP().optional()}).catchall(j.L5J()),aV=j.Ikc({ruleId:j.YjP().min(1),ruleName:j.YjP(),ruleVersion:j.YjP().min(1),category:al,severity:am,span:ap,maskedMatch:j.YjP(),actionTaken:an,confidence:j.aig().min(0).max(1)});j.Ikc({sessionId:j.YjP().min(1),toolUseId:j.YjP().min(1),parentId:j.YjP().min(1),rootSessionId:j.YjP().min(1),startedAt:ad.w$(),attributes:aT,inspections:j.YOg(aV).default([])});let aW=j.Ikc({objectType:aP,identityKey:j.YjP().min(1),location:j.YjP().optional(),title:j.YjP().optional(),hostId:j.YjP().optional(),attributes:aR.default({})}).meta({id:"InventoryInput"}),aX=j.Ikc({url:j.YjP().min(1),name:j.YjP().optional(),attributes:aR.default({})}).meta({id:"SourceProjectInput"}),aY=j.Ikc({id:j.YjP().min(1),eventType:aQ,startedAt:ad.w$(),endedAt:ad.w$().optional(),parentId:j.YjP().optional(),rootSessionId:j.YjP().optional(),hostId:j.YjP().optional(),harnessId:j.YjP().optional(),sourceProjectId:j.YjP().optional(),severity:am.optional(),priority:j.YjP().optional(),content:j.YjP().optional(),contentHash:j.YjP().optional(),attributes:aR.optional()}).meta({id:"AuditEventInput"});j.Ikc({class:j.YjP().min(1),label:j.YjP().optional(),attributes:aR.optional()});let aZ=j.Ikc({ruleId:j.YjP().min(1),version:j.YjP().min(1),name:j.YjP(),category:al,severity:am,definition:j.YjP()});j.Ikc({id:j.YjP().min(1),auditEventId:j.YjP().min(1),inspectionDefinitionId:j.YjP().min(1),classifiedDataId:j.YjP().optional(),span:ap,maskedMatch:j.YjP(),actionTaken:an,confidence:j.aig().min(0).max(1),findingKey:j.YjP().optional(),firstDetectedAt:ad.w$().optional()}),j.Ikc({host:aW.optional(),harness:aW.optional(),project:aX.optional()}).meta({id:"InventoryContext"});let a$=j.Ikc({hostId:j.YjP().optional(),harnessId:j.YjP().optional(),accountId:j.YjP().optional(),sourceProjectId:j.YjP().optional()}).meta({id:"ResolvedInventory"});j.Ikc({hosts:j.YOg(j.YjP()),harnesses:j.YOg(j.YjP()),osVersions:j.YOg(j.YjP()),projects:j.YOg(j.YjP())}).meta({id:"InventoryFacets"});let a_=j.Ikc({sessionId:j.YjP(),model:j.YjP(),provider:j.YjP(),inputTokens:j.aig().int().nonnegative(),outputTokens:j.aig().int().nonnegative(),cacheCreation:j.aig().int().nonnegative(),cacheRead:j.aig().int().nonnegative(),totalTokens:j.aig().int().nonnegative(),estimatedCostUsd:j.aig().nullable()}).meta({id:"TokenRollup"});j.Ikc({sessionId:j.YjP(),rollups:j.YOg(a_),totalTokens:j.aig().int().nonnegative(),estimatedCostUsd:j.aig().nullable(),costIsPartial:j.zMY()});let a0=j.Ikc({provider:j.YjP(),model:j.YjP(),inputTokens:j.aig().int().nonnegative(),outputTokens:j.aig().int().nonnegative(),cacheTokens:j.aig().int().nonnegative(),totalTokens:j.aig().int().nonnegative(),estimatedCostUsd:j.aig().nullable()});function a1(a){return JSON.stringify(a)}j.Ikc({models:j.YOg(a0),sessionCount:j.aig().int().nonnegative(),totalTokens:j.aig().int().nonnegative(),estimatedCostUsd:j.aig(),costIsPartial:j.zMY()});let a2=j.k5n(["active","completed","interrupted","error"]),a3=j.k5n(["session","prompt","response","tool","hook","detection","share","permission","commit","error","active"]),a4=j.k5n(["detections","shares","inventory"]),a5=j.Ikc({id:j.YjP(),occurredAt:ad.w$(),kind:a3,title:j.YjP(),detail:j.YjP(),tool:j.YjP().nullable(),severity:am.nullable(),link:a4.nullable(),targetId:j.YjP().nullable(),internal:j.zMY(),flagged:j.zMY(),bodyExpired:j.zMY().default(!1)}).meta({id:"ActivityAuditEvent"}),a6=j.Ikc({id:j.YjP(),harness:ag,title:j.YjP(),project:j.YjP(),repo:j.YjP(),branches:j.YOg(j.YjP()),startedAt:ad.w$(),endedAt:ad.w$().nullable(),status:a2,turns:j.aig().int().nonnegative(),findings:j.aig().int().nonnegative(),shares:j.aig().int().nonnegative()}).meta({id:"ActivitySessionSummary"});a6.extend({host:j.YjP(),cwd:j.YjP(),models:j.YOg(j.YjP()),version:j.YjP(),tokens:a_,tools:j.g1P(j.YjP(),j.aig().int().nonnegative()),files:j.YOg(j.YjP()),commits:j.aig().int().nonnegative(),events:j.YOg(a5)}).meta({id:"ActivitySession"}),j.Ikc({tz:j.YjP().optional()});let a7=j.Ikc({sessionsToday:j.aig().int().nonnegative(),liveNow:j.aig().int().nonnegative(),toolCallsToday:j.aig().int().nonnegative(),findingsToday:j.aig().int().nonnegative(),egressToday:j.aig().int().nonnegative()}).meta({id:"GetActivityStatsResponse"});j.Ikc({q:j.YjP().optional(),harness:j.YOg(ag).optional(),from:j.KCZ([ad.p6(),ad.w$()]).optional(),to:j.KCZ([ad.p6(),ad.w$()]).optional(),excludeEmpty:j.uEf().optional(),limit:ae.ai().int().min(1).max(100).default(50),cursor:j.YjP().optional()});let a8=j.Ikc({items:j.YOg(a6),nextCursor:j.YjP().nullable(),emptyCount:j.aig().int().nonnegative()}).meta({id:"ListActivitySessionsResponse"});j.Ikc({limit:ae.ai().int().min(1).max(500).default(100),cursor:j.YjP().optional(),order:j.k5n(["asc","desc"]).default("asc")}),j.Ikc({items:j.YOg(a5),nextCursor:j.YjP().nullable()}).meta({id:"ListSessionEventsResponse"}),j.Ikc({format:j.k5n(["ndjson","json"]).default("ndjson")}),j.Ikc({format:j.k5n(["csv","json"]).default("csv"),q:j.YjP().optional(),harness:j.YOg(ag).optional(),from:j.KCZ([ad.p6(),ad.w$()]).optional(),to:j.KCZ([ad.p6(),ad.w$()]).optional()}),j.Ikc({stats:a7,sessions:a8}).meta({id:"ActivityOverviewResponse"});let a9=j.k5n(["user","project","local","plugin"]),ba=j.Ikc({name:j.YjP().min(1),source:j.YjP().min(1),scope:a9,pluginName:j.YjP().optional(),version:j.YjP().optional(),description:j.YjP().optional(),updatedAt:ad.w$().optional(),location:j.YjP().optional()}),bb=j.Ikc({event:j.YjP().min(1),matcher:j.YjP().optional(),command:j.YjP().min(1),timeout:j.aig().optional(),scope:a9,pluginName:j.YjP().optional(),location:j.YjP().optional()}),bc=j.Ikc({name:j.YjP().min(1),scope:a9,pluginName:j.YjP().optional(),marketplace:j.YjP().optional(),project:j.YjP().optional(),transport:j.YjP().min(1),command:j.YjP().optional(),url:j.YjP().optional(),envKeys:j.YOg(j.YjP()).optional(),location:j.YjP().optional()}),bd=j.Ikc({name:j.YjP().min(1),path:j.YjP().min(1),scope:a9,kind:j.YjP().min(1),detail:j.YjP().optional(),entryCount:j.aig().optional(),updatedAt:ad.w$().optional()});j.Ikc({scannedAt:ad.w$(),skills:j.YOg(ba),hooks:j.YOg(bb),mcpServers:j.YOg(bc),configFiles:j.YOg(bd),errors:j.YOg(j.Ikc({source:j.YjP(),reason:j.YjP()}))});let be=j.Ikc({ruleId:j.YjP().min(1),version:j.YjP().min(1),span:ap,maskedMatch:j.YjP(),actionTaken:an,confidence:j.aig().min(0).max(1)});j.Ikc({items:j.YOg(aW),scanEvent:aY,definitions:j.YOg(aZ).optional(),findings:j.YOg(be).optional()});let bf=j.k5n(["project","skill","mcp","hook","config"]).meta({id:"AssetType"}),bg=j.k5n(["open","approved","blocked"]).meta({id:"AccessLevel"}),bh=j.k5n(["source","public-dep","vendored","config","data","docs","generated"]).meta({id:"Origin"}),bi=j.k5n(["known-good","risky","unapproved"]).meta({id:"TrustLevel"}),bj=j.k5n(["update","stale","conflict","unknown","change","untracked","risk","findings"]).meta({id:"Flag"}),bk=j.k5n(["public","private"]).meta({id:"Visibility"}),bl=j.k5n(["block","redact","warn"]).meta({id:"HarnessEventKind"}),bm=ag.extract(["ClaudeCode","Cursor","Codex","Antigravity","Copilot"]).meta({id:"HarnessId"}),bn=j.Ikc({open:j.aig().int().nonnegative(),approved:j.aig().int().nonnegative(),blocked:j.aig().int().nonnegative(),total:j.aig().int().nonnegative()}).meta({id:"AccessCounts"}),bo=j.Ikc({id:j.YjP(),type:bf,name:j.YjP(),sub:j.YjP(),flags:j.YOg(bj),trust:bi.optional()}).meta({id:"AssetSummary"}),bp=j.Ikc({id:j.YjP(),name:j.YjP(),repo:j.YjP(),visibility:bk,language:j.YjP(),policyDefault:bg,updatedAt:ad.w$(),accessCounts:bn,findingsCount:j.aig().int().nonnegative()}).meta({id:"ProjectSummary"}),bq=j.Ikc({type:bf,assets:j.YOg(bo)}),br=j.Ikc({id:bm,label:j.YjP(),kind:j.YjP(),version:j.YjP(),sessions:j.aig().int().nonnegative(),assetCount:j.aig().int().nonnegative(),flagCount:j.aig().int().nonnegative(),projects:j.YOg(bp),categories:j.YOg(bq)}).meta({id:"HarnessSummary"});j.Ikc({items:j.YOg(br)}).meta({id:"ListHarnessesResponse"});let bs=j.Ikc({type:bf,total:j.aig().int().nonnegative(),trustRollup:j.Ikc({"known-good":j.aig().int().nonnegative(),risky:j.aig().int().nonnegative(),unapproved:j.aig().int().nonnegative()}).partial().strict().optional(),flagRollup:j.Ikc({update:j.aig().int().nonnegative(),stale:j.aig().int().nonnegative(),conflict:j.aig().int().nonnegative(),unknown:j.aig().int().nonnegative(),change:j.aig().int().nonnegative(),untracked:j.aig().int().nonnegative(),risk:j.aig().int().nonnegative(),findings:j.aig().int().nonnegative()}).partial().strict(),items:j.YOg(bo)}).meta({id:"AssetGroup"});j.Ikc({groups:j.YOg(bs)}).meta({id:"ListAssetsResponse"});let bt=j.Ikc({name:j.YjP(),signature:j.YjP(),description:j.YjP(),write:j.zMY(),risk:j.YjP().nullable()}).meta({id:"McpTool"}),bu=j.Ikc({id:j.YjP(),title:j.YjP(),note:j.YjP()});bo.extend({description:j.YjP().nullable(),trust:bi.nullable(),meta:j.g1P(j.YjP(),j.L5J()),finding:bu.nullable(),tools:j.YOg(bt).optional()}).meta({id:"AssetDetail"}),j.Ikc({items:j.YOg(bp)}).meta({id:"ListProjectsResponse"}),j.Ikc({attention:j.aig().int().nonnegative(),byType:j.Ikc({project:j.aig().int().nonnegative(),skill:j.aig().int().nonnegative(),mcp:j.aig().int().nonnegative(),hook:j.aig().int().nonnegative(),config:j.aig().int().nonnegative()}),harnesses:j.aig().int().nonnegative(),mcpTrust:j.Ikc({"known-good":j.aig().int().nonnegative(),risky:j.aig().int().nonnegative(),unapproved:j.aig().int().nonnegative()})}).meta({id:"InventoryStats"});let bv=j.Ikc({path:j.YjP(),name:j.YjP(),origin:bh,access:bg,isCustom:j.zMY(),findings:j.aig().int().nonnegative(),blockedAt:ad.w$().nullable().optional(),note:j.YjP().nullable().optional()}).meta({id:"FileSummary"}),bw=j.Ikc({name:j.YjP(),path:j.YjP(),accessCounts:bn}).meta({id:"FolderSummary"});j.Ikc({project:j.Ikc({id:j.YjP(),repo:j.YjP(),visibility:bk}),path:j.YjP(),folders:j.YOg(bw).optional(),files:j.YOg(bv)}).meta({id:"ProjectTreeResponse"}),bv.extend({project:j.Ikc({repo:j.YjP(),visibility:bk,language:j.YjP(),policyDefault:bg,updatedAt:ad.w$()}),findingsRefs:j.YOg(j.Ikc({id:j.YjP(),title:j.YjP()}))}).meta({id:"FileDetail"}),j.Ikc({path:j.YjP(),access:bg}).meta({id:"SetFileAccessBody"}),j.Ikc({file:bv,accessCounts:bn}).meta({id:"SetFileAccessResponse"}),j.Ikc({trust:bi}).meta({id:"SetMcpTrustBody"});let bx=j.Ikc({kind:bl,title:j.YjP(),detail:j.YjP(),occurredAt:ad.w$(),findingId:j.YjP().nullable().optional()}).meta({id:"HarnessEventItem"});j.Ikc({counts:j.Ikc({block:j.aig().int().nonnegative(),redact:j.aig().int().nonnegative(),warn:j.aig().int().nonnegative()}),items:j.YOg(bx)}).meta({id:"HarnessEventsResponse"}),j.Ikc({jobId:j.YjP(),startedAt:ad.w$()}).meta({id:"RescanResponse"}),j.Ikc({repo:j.YjP()}).meta({id:"ConnectProjectBody"}),j.Ikc({type:j.YOg(bf).optional(),q:j.YjP().optional()}),j.Ikc({path:j.YjP().optional(),q:j.YjP().optional(),filter:j.k5n(["blocked"]).optional()}),j.Ikc({path:j.YjP()}),j.Ikc({limit:ae.ai().int().min(1).max(50).default(7)});let by=j.k5n(["provider","internal","external","ip"]).meta({id:"DestinationKind"}),bz=j.k5n(["https","http","sftp","grpc","smtp","ws","wss"]).meta({id:"Transport"}),bA=j.k5n(["secrets","pii","customer","source","telemetry","logs","metrics","none"]).meta({id:"DataClass"}),bB=bA.options,bC=j.k5n(["recognized","internal","unverified","ip"]).meta({id:"ShareTrustLevel"}),bD=j.k5n(["allow","block"]).meta({id:"EgressDecision"}),bE=j.k5n(["allowed","blocked","review"]).meta({id:"EgressStatus"}),bF=j.k5n(["raw_ip","unverified_domain","plaintext_transport"]).meta({id:"ReviewReason"}),bG=j.k5n(["GET","POST","PUT","DELETE","SDK","REF"]).meta({id:"HttpMethod"}),bH=j.Ikc({needsReview:j.zMY(),reasons:j.YOg(bF)}).meta({id:"ReviewInfo"}),bI=j.Ikc({port:j.aig().int().nullable(),geo:j.YjP().nullable(),ptr:j.YjP().nullable()}).meta({id:"DestinationNetwork"}),bJ=j.Ikc({id:j.YjP(),method:bG,transport:bz,url:j.YjP(),template:j.zMY(),dataClass:bA,lastSeen:ad.w$(),callSiteCount:j.aig().int().nonnegative()}).meta({id:"EndpointSummary"}),bK=j.Ikc({id:j.YjP(),project:j.YjP(),file:j.YjP(),line:j.aig().int().nonnegative(),snippet:j.YjP(),dynamic:j.zMY(),vendored:j.zMY(),projectId:j.YjP().nullable()}).meta({id:"CallSite"}),bL=bJ.extend({sites:j.YOg(bK)}).meta({id:"EndpointWithSites"}),bM=j.Ikc({id:j.YjP(),kind:by,name:j.YjP(),host:j.YjP(),providerId:j.YjP().nullable(),category:j.YjP(),trust:bC,status:bE,isCustom:j.zMY(),lastSeen:ad.w$(),endpointCount:j.aig().int().nonnegative(),callSiteCount:j.aig().int().nonnegative(),transports:j.YOg(bz),dataClasses:j.YOg(bA),review:bH,network:bI.nullable(),endpoints:j.YOg(bJ)}).meta({id:"ShareDestinationSummary"});bM.omit({endpointCount:!0,callSiteCount:!0,endpoints:!0}).extend({note:j.YjP().nullable(),endpoints:j.YOg(bL)}).meta({id:"ShareDestinationDetail"});let bN=j.Ikc({id:j.YjP(),kind:by,name:j.YjP(),host:j.YjP(),providerId:j.YjP().nullable(),trust:bC,status:bE,review:bH,topDataClass:bA,callSiteCount:j.aig().int().nonnegative(),lastSeen:ad.w$()}).meta({id:"ReviewDestination"}),bO=j.Ikc({kind:by,total:j.aig().int().nonnegative(),items:j.YOg(bM)}).meta({id:"ShareDestinationGroup"});j.Ikc({groups:j.YOg(bO)}).meta({id:"ListShareDestinationsResponse"}),j.Ikc({items:j.YOg(bN)}).meta({id:"NeedsReviewResponse"}),j.Ikc({destinations:j.aig().int().nonnegative(),endpoints:j.aig().int().nonnegative(),callSites:j.aig().int().nonnegative(),needsReview:j.aig().int().nonnegative(),insecure:j.aig().int().nonnegative(),byKind:j.Ikc({provider:j.aig().int().nonnegative(),internal:j.aig().int().nonnegative(),external:j.aig().int().nonnegative(),ip:j.aig().int().nonnegative()}),byTrust:j.Ikc({recognized:j.aig().int().nonnegative(),internal:j.aig().int().nonnegative(),unverified:j.aig().int().nonnegative(),ip:j.aig().int().nonnegative()})}).meta({id:"SharesStats"}),j.Ikc({decision:bD.nullable()}).meta({id:"SetEgressDecisionBody"}),j.Ikc({destination:bM}).meta({id:"SetEgressDecisionResponse"}),j.Ikc({q:j.YjP().optional(),kind:j.YOg(by).optional(),groupBy:j.k5n(["destination"]).default("destination"),review:j.uEf().default(!1)}),j.Ikc({format:j.k5n(["csv","json"]).default("csv"),q:j.YjP().optional(),kind:j.YOg(by).optional()});let bP=j.k5n(["npm","pypi","go","maven","rubygems","cargo","composer","nuget"]).meta({id:"EgressEcosystem"});j.Ikc({id:j.YjP(),name:j.YjP(),category:j.YjP(),hostSuffixes:j.YOg(j.YjP()).min(1),apiBase:j.YjP(),defaultDataClasses:j.YOg(bA).min(1),sdks:j.jgl(bP,j.YOg(j.YjP()))}).meta({id:"ProviderRegistryEntry"});let bQ=j.Ikc({file:j.YjP(),line:j.aig().int().positive(),snippet:j.YjP(),dynamic:j.zMY(),vendored:j.zMY()}).meta({id:"EgressCallSiteHit"}),bR=j.Ikc({host:j.YjP(),kind:by,name:j.YjP(),category:j.YjP(),providerId:j.YjP().nullable(),trust:bC,network:bI.nullable(),method:bG,transport:bz,url:j.YjP(),template:j.zMY(),dataClass:bA,site:bQ}).meta({id:"ResolvedEgressHit"}),bS=j.gMt("mode",[j.Ikc({mode:j.euz("walk"),walkedPrefix:j.YjP()}),j.Ikc({mode:j.euz("ledger"),scannedFiles:j.YOg(j.YjP()),deletedFiles:j.YOg(j.YjP())})]).meta({id:"EgressReconcile"});j.Ikc({projectKey:j.YjP().min(1),project:j.YjP(),projectId:j.YjP().nullable(),reconcile:bS,hits:j.YOg(bR)}).meta({id:"RecordProjectEgressInput"}),j.Ikc({destinations:j.aig().int().nonnegative(),endpoints:j.aig().int().nonnegative(),callSites:j.aig().int().nonnegative(),truncated:j.zMY(),droppedFiles:j.YOg(j.YjP()).default([])}).meta({id:"EgressWriteSummary"});let bT="control-plane-credential.json",bU=j.Ikc({specVersion:j.euz(1),endpoint:j.YjP().min(1),apiKey:j.YjP().min(1),keyPrefix:j.YjP().min(1).max(16).optional(),mintedAt:ad.w$().optional()}),bV=new Set(["localhost","127.0.0.1","::1","[::1]"]);function bW(a){let b;try{b=new URL(a)}catch{return"unparseable"}return""!==b.username||""!==b.password?"userinfo":""!==b.search||""!==b.hash?"query-or-fragment":"https:"===b.protocol||"http:"===b.protocol&&bV.has(b.hostname)?null:"insecure"}function bX(a){return null===bW(a)}function bY(a){try{let b=new URL(a);return`${b.protocol}//${b.host}`}catch{return"(unparseable endpoint)"}}let bZ=j.Ikc({packId:j.YjP().min(1),version:j.YjP().min(1),enabled:j.zMY(),updatedAt:j.YjP().nullable()}).meta({id:"StorePosturePack"}),b$=j.Ikc({total:j.aig().int().min(0),disabled:j.aig().int().min(0),byAction:j.Ikc({warn:j.aig().int().min(0),redact:j.aig().int().min(0),block:j.aig().int().min(0),allow:j.aig().int().min(0),log:j.aig().int().min(0)}).strict()}).meta({id:"StorePosturePolicyCounts"}),b_=j.Ikc({package:j.YjP().min(1).max(200),version:j.YjP().min(1).max(64),ossVersion:j.YjP().max(64).nullable(),policyBundleVersion:j.YjP().max(200).nullable(),policyFetchedAt:j.aig().int().min(0).max(0xe677d21fdbff).nullable(),installedVersion:j.YjP().max(64).nullable().optional(),buildSchemaVersion:j.aig().int().min(0).max(0x7fffffff).optional()}).meta({id:"StorePosturePlugin"});j.Ikc({deviceId:j.OsD(),hostname:j.YjP().min(1).max(253),capturedAt:j.aig().int().min(0).max(0xe677d21fdbff),storePresent:j.zMY(),schemaVersion:j.aig().int().min(0).max(0x7fffffff).nullable(),findingsTotal:j.aig().int().min(0).max(0x7fffffff),findingsFirstAt:j.aig().int().min(0).max(0xe677d21fdbff).nullable(),findingsLastAt:j.aig().int().min(0).max(0xe677d21fdbff).nullable(),packs:j.YOg(bZ).max(500),policyCounts:b$,plugin:b_.optional()}).meta({id:"StorePostureSnapshot"});let b0="capture/",b1=aY.extend({inspections:j.YOg(aV).default([])}).refine(a=>a.inspections.every(a=>!a.ruleVersion.startsWith(b0)),{message:`inspections[].ruleVersion must not start with \`${b0}\` — that namespace is reserved for capture definitions the control plane mints itself`,path:["inspections"]}).meta({id:"RecordAuditEventRequest"}),b2=j.Ikc({events:j.YOg(b1).min(1).max(50)}).meta({id:"RecordAuditEventBatch"}),b3=j.Ikc({host:j.YjP(),kind:by,name:j.YjP(),category:j.YjP(),providerId:j.YjP().nullable().optional(),trust:bC,network:bI.nullable(),method:bG,transport:bz,url:j.YjP(),template:j.zMY(),dataClass:bA,site:j.Ikc({file:j.YjP(),line:j.aig().int().positive(),dynamic:j.zMY(),vendored:j.zMY()})}).meta({id:"EgressIngestHit"}),b4=j.Ikc({projectKey:j.YjP().regex(/^[0-9a-f]{64}$/,"projectKey must be a 64-character lowercase hex digest"),project:j.YjP(),reconcile:bS,hits:j.YOg(b3)}).meta({id:"EgressIngestRequest"}),b5=j.Ikc({accepted:j.aig().int().nonnegative(),duplicates:j.aig().int().nonnegative()}),b6=j.Ikc({accepted:j.aig().int().nonnegative()}),b7=/^[^\p{Cc}\p{Cf}]*$/u,b8=a=>j.YjP().max(a).regex(b7,"must not contain control characters"),b9=j.Ikc({tenantName:b8(200),userEmail:b8(320),role:b8(64),keyKind:b8(64),serverTime:b8(64)});j.Ikc({error:j.Ikc({code:j.YjP().optional(),message:j.YjP().optional()}).optional()});let ca=j.k5n(["unauthorized","forbidden","route-absent","invalid-request","rejected","unreachable"]).extract(["unauthorized","forbidden","unreachable"]);j.Ikc({deviceId:b8(128).min(1),hostname:b8(255).min(1),os:b8(64).min(1),cliVersion:b8(64).min(1),label:b8(200).optional()}).meta({id:"AttachDeviceRequest"}),j.Ikc({deviceCode:b8(128).min(1)}).meta({id:"AttachTokenRequest"}),j.Ikc({deviceCode:b8(128),userCode:b8(32),verificationUri:b8(512),verificationUriComplete:b8(512).optional(),expiresIn:j.aig().int().positive(),interval:j.aig().int().positive()});let cb=j.Ikc({status:j.euz("pending")}),cc=j.Ikc({status:j.euz("slow_down"),interval:j.aig().int().positive()}),cd=j.Ikc({status:j.euz("denied"),message:b8(500).optional()}),ce=j.Ikc({status:j.euz("expired")}),cf=j.Ikc({status:j.euz("issued"),apiKey:j.YjP().min(1).max(512),endpoint:b8(512),tenantName:b8(200).optional(),userEmail:b8(320).optional()});j.KCZ([cf,cb,cc,cd,ce,j.Ikc({status:b8(64)})]);let cg=j.k5n(["shares_rescan"]),ch=j.Ikc({id:b8(128).min(1),kind:cg,issuedAt:b8(64).min(1),expiresAt:b8(64).min(1)}).strict(),ci=j.Ikc({command:ch.nullable()}),cj=j.k5n(["scan_failed","no_projects","expired"]),ck=j.gMt("outcome",[j.Ikc({outcome:j.euz("reported"),projectsScanned:j.aig().int().nonnegative()}).strict(),j.Ikc({outcome:j.euz("failed"),reason:cj,projectsScanned:j.aig().int().nonnegative()}).strict()]),cl=j.YjP().regex(/^[a-z][a-z0-9-]*$/),cm=j.YjP().regex(/^[a-z][a-z0-9-]*$/),cn=j.YjP().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-.]+)?$/),co=j.k5n(["labs","user","org"]),cp=j.k5n(["keyword","regex"]).meta({id:"MatcherType"});j.k5n(["safe","quarantined"]).meta({id:"RuleProbeVerdict"});let cq=j.rej({type:j.euz("keyword"),keywords:j.YOg(j.YjP().min(1)).min(1),caseSensitive:j.zMY().default(!1)});function cr(a){return a.replace(/[gy]/g,"")}let cs=j.rej({type:j.euz("regex"),pattern:j.YjP().min(1).max(2e3),flags:j.YjP().default("gi"),captureGroup:j.aig().int().nonnegative().optional()}).refine(a=>(function(a,b){try{return new RegExp(a,b),!0}catch{return!1}})(a.pattern,a.flags),{message:"pattern/flags do not form a valid JavaScript regular expression",path:["pattern"]}).refine(a=>!function(a){return void 0===a||0===a}(a.captureGroup)||!function(a,b){try{let c=new RegExp(a,cr(b));return c.exec("")?.[0].length===0}catch{return!1}}(a.pattern,a.flags),{message:'a whole-match regex that can match the empty string (e.g. "\\d*", "a?", "(?:)") can hang the matcher — scope the quantifier to a captureGroup, or require at least one character',path:["pattern"]}).superRefine((a,b)=>{if(void 0===a.captureGroup)return;let c=function(a,b){try{let c=RegExp(`${a}|`,cr(b)).exec("");return c?c.length-1:void 0}catch{return}}(a.pattern,a.flags);void 0===c||a.captureGroup<=c||b.addIssue({code:"custom",path:["captureGroup"],message:`captureGroup ${String(a.captureGroup)} is out of range — the pattern declares ${String(c)} capture group(s), so valid values are 0-${String(c)}. An out-of-range group never matches, which would make the rule silently never fire.`})}),ct=j.gMt("type",[cq,cs]).meta({id:"Matcher"});cp.options;let cu=j.rej({extensions:j.YOg(j.YjP().regex(/^\.[A-Za-z0-9]+$/)).min(1)}).meta({id:"AppliesTo"}),cv=j.k5n(["entropy","luhn"]).meta({id:"PostValidatorName"}),cw=j.KCZ([cv,j.rej({name:cv,config:j.g1P(j.YjP(),j.L5J()).optional()})],{error:()=>`not a valid post-validator: use a bare name (${cv.options.map(a=>JSON.stringify(a)).join(" or ")}) or { "name": ..., "config": { ... } }. An unrecognized name would be a false-positive guard that never runs.`}).meta({id:"PostValidatorRef"}),cx=j.rej({categories:j.YOg(al).min(1).optional(),ruleIds:j.YOg(j.YjP().min(1)).min(1).optional(),labels:j.YOg(j.YjP().min(1)).min(1).optional(),windowChars:j.aig().int().positive().default(160),confidenceBoost:j.aig().min(0).max(.3).optional()}).refine(a=>(a.categories?.length??0)+(a.ruleIds?.length??0)+(a.labels?.length??0)>0,{message:"requiresNearby needs at least one of categories, ruleIds, or labels"}).meta({id:"RequiresNearby"});j.rej({label:j.YjP(),text:j.YjP().max(5e4),shouldMatch:j.zMY(),filePath:j.YjP().optional(),expectedSpans:j.YOg(j.rej({start:j.aig(),end:j.aig()})).optional()}).meta({id:"RuleFixture"});let cy=j.rej({specVersion:j.euz(1),id:j.YjP().regex(/^[a-z][a-z0-9-]*\/[a-z][a-z0-9-]*$/),name:j.YjP(),category:al,severity:am,matcher:ct,appliesTo:cu.optional(),postValidators:j.YOg(cw).optional(),requiresNearby:cx.optional(),examples:j.YOg(j.YjP()).optional()}).meta({id:"Rule"}),cz=j.Ikc({name:j.YjP(),email:j.Rpp().optional(),url:j.OZ5().optional()}).meta({id:"Author"});j.Ikc({specVersion:j.euz(1),id:j.YjP(),name:j.YjP(),version:j.YjP(),rules:j.YOg(j.YjP()),description:j.YjP().optional(),author:cz.optional(),license:j.YjP().optional(),sourceUrl:j.OZ5().optional()}).meta({id:"PackManifest"});let cA=j.k5n(["library","custom"]).meta({id:"OriginEnum"}),cB=j.k5n(["all","library","custom","customized","updates"]),cC=j.k5n(["new","imported","update"]).meta({id:"LibraryStateEnum"}),cD=j.Ikc({all:j.aig().int().nonnegative(),library:j.aig().int().nonnegative(),custom:j.aig().int().nonnegative(),customized:j.aig().int().nonnegative(),updates:j.aig().int().nonnegative()}).meta({id:"DetectionCounts"}),cE=j.Ikc({id:j.YjP(),name:j.YjP(),version:cn,enabled:j.zMY(),origin:cA,publisher:cl.optional(),publisherKind:co.optional(),ruleCount:j.aig().int().nonnegative(),namespace:cl,packId:cm,policyId:j.YjP().optional(),latestVersion:cn.optional()}).meta({id:"DetectionListItem"});j.Ikc({counts:cD,items:j.YOg(cE)}).meta({id:"ListDetectionsResponse"}),j.Ikc({filter:cB.optional().default("all"),q:j.YjP().optional()}),j.Ikc({detections:j.aig().int().nonnegative(),rules:j.aig().int().nonnegative(),active:j.aig().int().nonnegative(),findingsLast30d:j.aig().int().nonnegative()}).meta({id:"DetectionStats"});let cF=j.Ikc({id:j.YjP(),name:j.YjP(),category:al,severity:am,matcher:ct,appliesTo:cu.optional(),postValidators:j.YOg(cw).optional(),requiresNearby:cx.optional(),examples:j.YOg(j.YjP()).optional()}).meta({id:"DetectionRule"}),cG=j.Ikc({available:j.zMY(),latestVersion:cn,latestRuleCount:j.aig().int().nonnegative().optional()}).nullable().meta({id:"DetectionUpdate"});j.Ikc({id:j.YjP(),name:j.YjP(),version:cn,enabled:j.zMY(),origin:cA,publisher:cl.optional(),publisherKind:co.optional(),ruleCount:j.aig().int().nonnegative(),namespace:cl,packId:cm,description:j.YjP().optional(),editedAt:ad.w$(),findingsLast30d:j.aig().int().nonnegative(),latestVersion:cn.nullable().optional(),update:cG,rules:j.YOg(cF),modified:j.zMY(),policyId:j.YjP().optional()}).meta({id:"DetectionDetail"});let cH=j.Ikc({id:j.YjP(),name:j.YjP(),publisher:cl,publisherKind:co.optional(),category:al.optional(),version:cn,ruleCount:j.aig().int().nonnegative(),description:j.YjP().optional(),updatedAt:ad.w$(),state:cC,importedAs:j.YjP().nullable()}).meta({id:"LibraryItem"});function cI(a,b,c){return void 0!==c&&b.success&&void 0!==b.data?{[a]:b.data}:{}}j.Ikc({categories:j.YOg(al),items:j.YOg(cH)}).meta({id:"ListLibraryResponse"}),j.Ikc({libraryId:j.YjP().refine(a=>/^[^/]+\/[^/]+$/.test(a),{message:"libraryId must be in namespace/packId format"})}).meta({id:"ImportDetectionRequest"});let cJ={library:!0,custom:!0};function cK(a){return null!=a&&Object.hasOwn(cJ,a)?a:"library"}function cL(a){return{id:`${a.namespace}/${a.packId}`,name:a.name,version:a.version,enabled:a.enabled,origin:cK(a.origin),namespace:a.namespace,packId:a.packId,ruleCount:a.ruleCount,...null!=a.policyId?{policyId:a.policyId}:{},...null!=a.latestVersion?{latestVersion:a.latestVersion}:{}}}function cM(a,b,c){let d=a.rules.flatMap(a=>{var b;let c=ct.safeParse(a.matcher);return c.success?[{id:a.id,name:a.name,category:a.category,severity:a.severity,matcher:c.data,...cI("appliesTo",cu.safeParse(a.appliesTo),a.appliesTo),...cI("postValidators",cw.array().safeParse(a.postValidators),a.postValidators),...cI("requiresNearby",cx.safeParse(a.requiresNearby),a.requiresNearby),...cI("examples",{success:Array.isArray(b=a.examples)&&b.every(a=>"string"==typeof a),data:a.examples},a.examples)}]:[]});return{id:`${a.namespace}/${a.packId}`,name:a.name,version:a.version,enabled:a.enabled,origin:cK(a.origin),namespace:a.namespace,packId:a.packId,ruleCount:a.rules.length,editedAt:a.updatedAt.toISOString(),findingsLast30d:b,latestVersion:c?c.latestVersion:null,update:c,rules:d,modified:!1,...null!=a.policyId?{policyId:a.policyId}:{}}}function cN(a){let b=a.indexOf("/");return b<1||b===a.length-1?null:{namespace:a.slice(0,b),packId:a.slice(b+1)}}function cO(a,b){let c=a.filter(a=>null!=a.latestVersion),d=a=>cK(a.origin),e={all:a.length,library:a.filter(a=>"library"===d(a)).length,custom:a.filter(a=>"custom"===d(a)).length,customized:0,updates:c.length},f=b.filter,g="customized"===f?[]:"custom"===f?a.filter(a=>"custom"===d(a)):"library"===f?a.filter(a=>"library"===d(a)):"updates"===f?[...c]:[...a];if(b.q){let a=b.q.toLowerCase();g=g.filter(b=>b.name.toLowerCase().includes(a)||b.packId.toLowerCase().includes(a)||b.namespace.toLowerCase().includes(a))}return g.sort((a,b)=>a.enabled!==b.enabled?a.enabled?-1:1:a.name.localeCompare(b.name)),{counts:e,items:g.map(cL)}}let cP=j.k5n(["prompt","response","code_change","tool_use"]).meta({id:"EventKind"}),cQ=cP.options.map(a=>`'${a}'`).join(","),cR=j.Ikc({sessionId:j.YjP().optional(),repo:j.YjP().optional(),filePath:j.YjP().optional(),toolName:j.YjP().optional(),gitignored:j.zMY().optional(),wholeFile:j.zMY().optional(),model:j.YjP().optional(),turnIndex:j.aig().int().nonnegative().optional(),correlationId:j.uRe().optional(),traceId:j.YjP().regex(/^[0-9a-f]{32}$/).optional(),exceptionIds:j.YOg(j.OsD()).optional(),messageId:j.YjP().min(1).optional(),conversationId:j.YjP().optional(),inspectionMs:j.aig().int().nonnegative().optional(),redactDegradedTo:an.optional()}).meta({id:"EventMetadata"}),cS=j.Ikc({id:j.OsD(),sourceTool:ai,kind:cP,occurredAt:ad.w$(),contentHash:j.YjP(),content:j.YjP(),metadata:cR.optional()}).meta({id:"Event"}).meta({id:"IngestEvent"});j.Ikc({events:j.YOg(cS).min(1).max(100),dedupe:j.euz("content-hash").optional()}).meta({id:"IngestBatch"});let cT=j.k5n(["once","temporary","permanent"]),cU=j.Ikc({repo:j.YjP().optional(),sourceTool:j.YjP().optional(),provider:j.YjP().optional()}).strict(),cV=j.k5n(["suppress","reveal_to_model"]),cW=j.Ikc({id:j.OsD(),ruleId:j.YjP(),category:al,valueFingerprint:j.YjP().regex(/^[0-9a-f]{64}$/),keyVersion:j.aig().int().positive(),maskedValue:j.YjP(),capability:cV.default("suppress"),scope:cT,expiresAt:ad.w$().nullable(),maxUses:j.aig().int().positive().nullable(),useCount:j.aig().int().nonnegative(),lastUsedAt:ad.w$().nullable(),justification:j.YjP().min(1),conditions:cU.nullable(),createdBy:j.YjP(),createdVia:j.k5n(["cli-approve","cli-add","web-approve","web-add","api","setup-triage"]),createdAt:ad.w$(),updatedAt:ad.w$(),revokedAt:ad.w$().nullable(),revokedBy:j.YjP().nullable(),revokeReason:j.YjP().nullable()}),cX=cW.pick({id:!0,ruleId:!0,valueFingerprint:!0,keyVersion:!0,capability:!0,expiresAt:!0,maxUses:!0,useCount:!0,conditions:!0});function cY(a,b){return"present"===b.status&&b.version===a}cW.omit({valueFingerprint:!0});let cZ=j.YjP().optional(),c$=j.Ikc({reference:j.YjP(),scope:j.YjP(),reason:j.YjP(),confirmation:cZ}),c_=j.Ikc({ruleId:j.YjP(),value:j.YjP(),scope:j.YjP(),reason:j.YjP(),confirmation:cZ}),c0=j.Ikc({pointer:j.YjP(),scope:j.YjP(),justification:j.YjP(),confirmation:cZ}),c1=j.Ikc({id:j.YjP(),reason:j.YjP()}),c2=j.Ikc({confirmation:j.YjP()});function c3(a,b){let c=a.safeParse(b);if(c.success)return{ok:!0,data:c.data};for(let a of c.error.issues){let[b]=a.path;if("string"==typeof b)return{ok:!1,field:b,wrongType:"invalid_type"===a.code}}return{ok:!1,field:null,wrongType:!1}}let c4=au.options;function c5(a){if("code_change"===a.kind)return{state:"local_scan"};if(null!==a.syncedAt&&a.syncedAt>0)return{state:"sent",at:Y(a.syncedAt)};if(null!==a.syncedAt){var b;let c=null!==(b=a.syncFailure)&&c4.includes(b)?b:void 0;return{state:"not_sent",...null===a.syncFailedAt?{}:{at:Y(a.syncFailedAt)},...void 0===c?{}:{reason:c}}}return 1===a.outboxOwed||null!==a.syncClaimedAt?{state:"queued"}:{state:"never_offered"}}function c6(a,b){return Object.hasOwn(a,b)?a[b]:void 0}function c7(a){return c6({log:"monitored",block:"blocked",redact:"redacted",warn:"warned",allow:"allowed"},a)??"allowed"}function c8(a){if("code_context"===a)return"source_code";let b=as.safeParse(a);return b.success?b.data:"custom"}function c9(a){return c6(ak,a)??af.Api}let da=["open","handled","dismissed","resolved"];function db(a){let b=new Set(a.filter(a=>void 0!==a));if(0!==b.size){for(let a of da)if(b.has(a))return a}}function dc(a){return"code_change"!==a.kind?"handled":null===a.findingKey?"open":"resolved"===a.latestResolutionStatus?"resolved":"dismissed"===a.latestResolutionStatus?"dismissed":"open"}function dd(a,b={}){let c=b.packNames,d=[];for(let[b,e]of a){let a=[...e.users??[]].sort((a,b)=>a.name.localeCompare(b.name)||a.id.localeCompare(b.id)),f=[...new Set(e.sourceTools.map(c9))].sort(),g=new Set(e.actionsTaken.map(c7)),h=1===g.size?[...g][0]??null:null,i=c8(e.category??"custom"),j={id:b,category:i,subtype:b,severity:e.severity??"low",detection:{id:b,name:c?.get(b)??null},policy:{id:`category:${i}`,name:i},instanceCount:e.instanceCount,providers:f,aggregateAction:h,latestDetectedAt:e.latestDetectedAt,status:db(e.statusInputs.map(dc)),...a.length>0?{users:a}:{}};dg.set(j,[...g]),void 0!==e.searchText&&de.set(j,df(j,e.searchText)),d.push(j)}return d}let de=new WeakMap;function df(a,b){return[a.subtype,a.category,a.policy.name,a.id,...(a.users??[]).map(a=>a.name),...void 0===b?[]:[b]].join(" ").toLowerCase()}let dg=new WeakMap;function dh(a){return dg.get(a)??[]}function di(a,b){let c=new Set(b),d=0;for(let b of a){if(void 0===b.count)return null;c.has(dc(b))&&(d+=b.count)}return d}function dj(a,b){let c=a;if(b.severity&&b.severity.length>0){let a=new Set(b.severity);c=c.filter(b=>a.has(b.severity))}if(b.providers&&b.providers.length>0){let a=new Set(b.providers);c=c.filter(b=>b.providers.some(b=>a.has(b)))}if(b.actions&&b.actions.length>0){let a=new Set(b.actions);c=c.filter(b=>dh(b).some(b=>a.has(b)))}if(b.subtype&&b.subtype.length>0){let a=new Set(b.subtype);c=c.filter(b=>a.has(b.subtype))}if(b.statuses&&b.statuses.length>0){let a=new Set(b.statuses);c=c.filter(b=>void 0!==b.status&&a.has(b.status))}if(b.q){let a=b.q.toLowerCase();c=c.filter(b=>(function(a){let b=de.get(a);if(void 0!==b)return b;let c=df(a);return de.set(a,c),c})(b).includes(a))}return c}let dk=Object.fromEntries(am.options.map((a,b)=>[a,b]));function dl(a,b){let c=(c6(dk,a.severity)??-1)-(c6(dk,b.severity)??-1);if(0!==c)return c;let d=b.latestDetectedAt.localeCompare(a.latestDetectedAt);return 0!==d?d:a.id.localeCompare(b.id)}function dm(a){return[...a].sort(dl)}function dn(a,b){let c=dj(a,{providers:b.providers,actions:b.actions,statuses:b.statuses,q:b.q,subtype:b.subtype}),d=new Map;for(let a of c)d.set(a.severity,(d.get(a.severity)??0)+1);let e=dj(a,{actions:b.actions,statuses:b.statuses,q:b.q,subtype:b.subtype,severity:b.severity}),f=new Map;for(let a of e)for(let b of a.providers)f.set(b,(f.get(b)??0)+1);let g=dj(a,{providers:b.providers,statuses:b.statuses,q:b.q,subtype:b.subtype,severity:b.severity}),h=new Map;for(let a of g)for(let b of dh(a))h.set(b,(h.get(b)??0)+1);let i=dj(a,{providers:b.providers,actions:b.actions,statuses:b.statuses,q:b.q,severity:b.severity}),j=new Map;for(let a of i)j.set(a.subtype,(j.get(a.subtype)??0)+1);let k=dj(a,{providers:b.providers,actions:b.actions,q:b.q,subtype:b.subtype,severity:b.severity}),l=new Map;for(let a of k)void 0!==a.status&&l.set(a.status,(l.get(a.status)??0)+1);let m=a=>[...a.entries()].map(([a,b])=>({value:a,count:b}));return{severity:m(d),provider:m(f),action:m(h),subtype:m(j),status:m(l)}}function dp(a,b){let c=a[Symbol.iterator](),d=b[Symbol.iterator]();for(;;){let a=c.next(),b=d.next();if(a.done&&b.done)return 0;if(a.done)return -1;if(b.done)return 1;let e=a.value.codePointAt(0)??0,f=b.value.codePointAt(0)??0;if(e!==f)return e-f}}let dq=["severity","subtype","providers","actions","statuses","deliveries","tools","repo","file","q"];function dr(a,b,c){for(let d of dq)if(d!==c&&!function(a,b,c){switch(c){case"severity":return!b.severity?.length||b.severity.includes(a.severity);case"subtype":return!b.subtype?.length||b.subtype.includes(a.ruleId);case"providers":return!b.providers?.length||b.providers.includes(c9(a.sourceTool));case"actions":return!b.actions?.length||b.actions.includes(c7(a.actionTaken));case"statuses":return!b.statuses?.length||void 0!==a.status&&b.statuses.includes(a.status);case"deliveries":return!b.deliveries?.length||void 0!==a.delivery&&b.deliveries.includes(a.delivery.state);case"tools":return!b.tools?.length||void 0!==a.toolName&&b.tools.includes(a.toolName);case"repo":return void 0===b.repo||a.repo===b.repo;case"file":return void 0===b.file||a.file===b.file;case"q":return!b.q||[a.ruleId,a.category,a.maskedMatch,a.repo,a.file,a.toolName?`via ${a.toolName}`:"",a.id,a.user?.name??""].join(" ").toLowerCase().includes(b.q.toLowerCase())}}(a,b,d))return!1;return!0}function ds(a){return[...a.entries()].map(([a,b])=>({value:a,count:b})).sort((a,b)=>b.count-a.count||a.value.localeCompare(b.value)||dp(a.value,b.value))}function dt(a,b,c=1){a.set(b,(a.get(b)??0)+c)}function du(a){let b=new Map,c=new Map,d=new Map,e=new Map,f=new Map,g=new Map,h=new Map;return{add(i){dr(i,a,"severity")&&dt(b,i.severity),dr(i,a,"subtype")&&dt(c,i.ruleId),dr(i,a,"providers")&&dt(d,c9(i.sourceTool)),dr(i,a,"actions")&&dt(e,c7(i.actionTaken)),void 0!==i.status&&dr(i,a,"statuses")&&dt(f,i.status),void 0!==i.toolName&&dr(i,a,"tools")&&dt(g,i.toolName),void 0!==i.delivery&&dr(i,a,"deliveries")&&dt(h,i.delivery.state)},facets:()=>({severity:ds(b),subtype:ds(c),provider:ds(d),action:ds(e),status:ds(f),tool:ds(g),deployment:ds(h)})}}function dv(a){let b=c8(a.category);return{id:a.id,provider:c9(a.sourceTool),repo:a.repo,file:a.file,...void 0===a.toolName?{}:{toolName:a.toolName},eventId:a.eventId,...void 0===a.sessionId?{}:{sessionId:a.sessionId},...void 0===a.delivery?{}:{delivery:a.delivery},...void 0===a.user?{}:{user:a.user},action:c7(a.actionTaken),detectedAt:a.occurredAt,confidence:a.confidence,...void 0===a.status?{}:{status:a.status},groupId:a.ruleId,category:b,subtype:a.ruleId,severity:a.severity,match:{maskedValue:a.maskedMatch,contextPrefix:""},detection:{id:a.ruleId,name:null},policy:{id:`category:${b}`,name:b}}}function dw(){return{instanceCount:0,maxSeverityRank:Number.MAX_SAFE_INTEGER,maxSeverity:"low",latestDetectedAt:"",statuses:[],ruleIds:new Set}}function dx(a,b){a.instanceCount+=1;let c=c6(dk,b.severity)??Number.MAX_SAFE_INTEGER-1;c<a.maxSeverityRank&&(a.maxSeverityRank=c,a.maxSeverity=b.severity),b.occurredAt>a.latestDetectedAt&&(a.latestDetectedAt=b.occurredAt),a.statuses.push(b.status),a.ruleIds.add(b.ruleId)}function dy(a,b){let c=c6(dk,a.maxSeverity)??-1,d=c6(dk,b.maxSeverity)??-1;if(c!==d)return c-d;if(a.latestDetectedAt!==b.latestDetectedAt)return a.latestDetectedAt<b.latestDetectedAt?1:-1;let e=dp(a.repo,b.repo);return 0!==e?e:dp(a.file,b.file)}function dz(a,b){return`${dA(a)}/${dA(b)}`}function dA(a){return encodeURIComponent(a.replace(/[\uD800-\uDFFF]/gu,"�"))}let dB=j.Ikc({id:j.OsD(),namespace:cl,packId:cm,version:cn,name:j.YjP(),enabled:j.zMY().default(!0),policyId:j.YjP().optional()}).meta({id:"InstalledPack"});j.Ikc({namespace:cl,packId:cm,version:cn}).meta({id:"InstallPackRequest"}),j.Ikc({items:j.YOg(dB)}).meta({id:"ListInstalledPacksResponse"}),j.Ikc({enabled:j.zMY().optional(),policyId:j.YjP().nullable().optional()}).refine(a=>Object.keys(a).some(b=>void 0!==a[b]),{message:"At least one field must be provided"}).meta({id:"PatchInstalledPackRequest"});let dC=j.k5n(["global","repo","user"]).meta({id:"PolicyScope"}),dD=j.KCZ([j.Ikc({ruleId:j.YjP()}),j.Ikc({category:al})]).meta({id:"PolicyTarget"}),dE=j.k5n(["builtin","custom"]).meta({id:"PolicyKind"}),dF=j.k5n(["builtin","authored"]).meta({id:"PolicyProvenance"}),dG=j.Ikc({id:j.OsD(),scope:dC,target:dD,action:an,enabled:j.zMY().default(!0),customKeywords:j.YOg(j.YjP()).optional(),name:j.YjP().optional(),provenance:dF.optional()}).meta({id:"Policy"}),dH=["monitor","warn","redact","vault","block"],dI=j.k5n(dH).meta({id:"BuiltinPolicyId"}),dJ=dI.extract(["monitor","warn","block"]).meta({id:"RedactFallback"}),dK=j.Ikc({version:j.YjP(),policies:j.YOg(dG),rules:j.YOg(cy).optional(),rulesComplete:j.zMY().optional(),exceptions:j.YOg(cX).optional(),reversibleRuleIds:j.YOg(j.YjP()).optional(),ruleVersions:j.g1P(j.YjP(),j.YjP()).optional(),prohibitedModels:j.YOg(j.YjP()).optional(),redactFallback:dJ.optional(),customKeywords:j.YOg(j.YjP()),fetchedAt:ad.w$()}).meta({id:"PolicyBundle"});[...Object.keys(dK.shape),...Object.keys(dG.shape).map(a=>`policies.${a}`),...dD.options.flatMap(a=>"shape"in a?Object.keys(a.shape):[]).map(a=>`policies.target.${a}`),...Object.keys(cX.shape).map(a=>`exceptions.${a}`)].sort().join(",");let dL=["config"],dM=al.options.filter(a=>!dL.includes(a)),dN={secret:"critical",financial:"critical",code_flaw:"critical",pii:"high",phi:"high",custom:"high",code_context:"low",config:"low"},dO=dH,dP={monitor:{name:"Monitor",action:"log",reversible:!1,description:"Log every match for audit. The request is allowed through untouched."},warn:{name:"Warn",action:"warn",reversible:!1,description:"Allow the request, but warn the user inline before it is sent."},redact:{name:"Redact",action:"redact",reversible:!1,description:"Strip the matched value from the request and destroy it, then continue. What was removed cannot be recovered."},vault:{name:"Redact & Vault",action:"redact",reversible:!0,description:"Strip the matched value from the request and keep an encrypted, recoverable copy in the local vault, leaving a pointer in its place. Needs the vault consent granted under Settings; without it this behaves as Redact."},block:{name:"Block",action:"block",reversible:!1,description:"Refuse the request entirely whenever any rule in this detection matches."}};function dQ(a){return dP[a].action}let dR=[...new Set(dH.map(dQ))],dS=[...ao.filter(a=>!dR.includes(a)),...dR];function dT(a){return dS.indexOf(a)}function dU(a,b){return dT(a)>=dT(b)}function dV(a,b){return dT(a)>=dT(b)?a:b}function dW(a){return dH.find(b=>dU(dQ(b),a))??"block"}j.Ikc({floor:dI,locked:j.zMY()}).describe("PackPolicyFloor");let dX=dH.filter(a=>!dP[a].reversible);dH.filter(a=>dP[a].reversible);let dY=j.k5n(dX).meta({id:"CategoryPolicyId"});function dZ(a){let b=dI.safeParse(a??d0);return dP[b.success?b.data:d0].reversible}let d$=Object.fromEntries(al.options.map(a=>[a,dQ(function(a){if(dL.includes(a))return"monitor";let b=dN[a];return"critical"===b||"high"===b?"warn":"monitor"}(a))])),d_=Object.fromEntries(dH.map(a=>[a,{id:a,...dP[a]}])),d0="monitor";function d1(a){let b=dI.safeParse(a??d0);return d_[b.success?b.data:d0].action}let d2=j.Ikc({id:j.YjP(),name:j.YjP(),ruleCount:j.aig().int().nonnegative(),enabled:j.zMY()}).meta({id:"UsedByItem"}),d3=j.Ikc({id:j.YjP(),kind:dE,name:j.YjP(),enabled:j.zMY(),usedByCount:j.aig().int().nonnegative()}).meta({id:"PolicyListItem"});j.Ikc({items:j.YOg(d3)}).meta({id:"ListPoliciesResponse"}),j.Ikc({specVersion:j.euz(1),id:j.YjP(),kind:dE,name:j.YjP(),enabled:j.zMY(),description:j.YjP(),usedBy:j.YOg(d2)}).meta({id:"PolicyDetail"}),j.Ikc({policies:j.aig().int().nonnegative(),builtin:j.aig().int().nonnegative(),custom:j.aig().int().nonnegative(),detectionsGoverned:j.aig().int().nonnegative()}).meta({id:"PolicyStatsResponse"});let d4=2,d5=al.options.join("|"),d6=RegExp(`\\[\\[aka:(?:${d5}):[A-Z2-7]{2,7}\\.[A-Z2-7]{26}\\.[A-Z2-7]{16}\\]\\]`),d7=RegExp(`^${d6.source}$`);function d8(){return RegExp(d6.source,"g")}let d9=j.YjP().regex(d7);j.Ikc({category:al,keyVersion:j.aig().int().positive(),pointerId:j.YjP(),tag:j.YjP()}),j.Ikc({pointerId:j.YjP(),valueFingerprint:j.YjP().regex(/^[0-9a-f]{64}$/),valueIdentityFingerprint:j.YjP().regex(/^[0-9a-f]{64}$/),fingerprintKeyVersion:j.aig().int().positive(),keyVersion:j.aig().int().positive(),category:al,ruleId:j.YjP(),maskedMatch:j.YjP(),provider:j.YjP().optional(),ciphertext:j.YjP(),nonce:j.YjP(),authTag:j.YjP(),occurrenceCount:j.aig().int().nonnegative(),userAuthorized:j.zMY(),firstSeen:j.YjP(),lastSeen:j.YjP()}),j.Ikc({category:al,provider:j.YjP().optional(),maskedMatch:j.YjP(),occurrences:j.aig().int().nonnegative(),firstSeen:j.YjP(),lastSeen:j.YjP()}),j.Ikc({ruleId:j.YjP(),valueFingerprint:j.YjP().regex(/^[0-9a-f]{64}$/),fingerprintKeyVersion:j.aig().int().positive()});let ea=j.k5n(["human","model"]),eb=j.k5n(["display","explicit-reveal","view-render","model-input","remediation","purge"]),ec=j.k5n(["revealed","refused","unavailable"]),ed=["display","view-render"];function ee(a){return ed.includes(a)}let ef=j.Ikc({id:j.OsD(),pointerId:j.YjP(),at:j.YjP(),target:ea,reason:eb,outcome:ec,grantId:j.YjP().optional(),pointerCount:j.aig().int().positive().default(1)}),eg=j.k5n(["prompt","tool-input","tool-output","file","transcript"]),eh=j.Ikc({location:j.YjP(),kind:eg,firstSeen:j.YjP(),lastSeen:j.YjP()}),ei=j.Ikc({pointerId:j.YjP(),category:al,provider:j.YjP().optional(),maskedMatch:j.YjP(),occurrences:j.aig().int().nonnegative(),firstSeen:j.YjP(),lastSeen:j.YjP(),revealGrantId:j.YjP().nullable(),sightings:j.YOg(eh)}),ej=50,ek=50,el=200,em=j.Ikc({limit:ae.ai().int().min(1).max(el).optional(),cursor:j.YjP().optional()});j.Ikc({totals:j.Ikc({values:j.aig().int().nonnegative()}),items:j.YOg(ei),nextCursor:j.YjP().nullable()});let en=j.Ikc({limit:ae.ai().int().min(1).max(el).optional(),cursor:j.YjP().optional()});j.Ikc({totals:j.Ikc({reused:j.aig().int().nonnegative()}),items:j.YOg(ei),nextCursor:j.YjP().nullable()});let eo=j.Ikc({includeBatched:j.zMY().optional(),limit:ae.ai().int().min(1).max(el).optional(),cursor:j.YjP().optional()});j.Ikc({items:j.YOg(ef),nextCursor:j.YjP().nullable(),hiddenBatched:j.aig().int().nonnegative()});let ep=j.YjP(),eq=j.k5n(["masked","full","off"]),er=1,es=j.Ikc({acknowledgedAt:ad.w$(),version:j.aig().int().positive()});function et(a){return a?.version===er}let eu=1,ev=3,ew=j.k5n(["standalone","attached"]),ex=j.Ikc({endpoint:j.YjP().min(1),label:j.YjP().min(1).optional(),attachedAt:ad.w$()}).meta({id:"ControlPlaneConnection"}),ey=j.k5n(["redact","warn"]),ez=j.k5n(["full","session-only"]),eA=j.Ikc({acknowledgedAt:ad.w$(),payloadVersion:j.aig().int().positive()});function eB(a){return a?.payloadVersion===eu}let eC=j.Ikc({acknowledgedAt:ad.w$(),payloadVersion:j.aig().int().positive(),endpoint:j.YjP()});function eD(a,b){return void 0!==a&&void 0!==b&&a.payloadVersion===ev&&a.endpoint===b}let eE=1,eF=j.Ikc({acknowledgedAt:ad.w$(),version:j.aig().int().positive()}),eG=j.k5n(["with-findings","always","never"]),eH=j.Ikc({responses:eG.default("with-findings"),account:j.zMY().default(!1),consent:eF.optional()});function eI(a){return a?.version===eE}let eJ=j.Ikc({enabled:j.zMY().default(!1),retainDays:j.aig().int().min(1).max(3650).default(30)}).meta({id:"BodyRetention"}),eK=j.Ikc({specVersion:j.aig().int().positive().default(8),runMode:ew.default("standalone"),controlPlane:ex.optional(),policy:ey.default("redact"),historicalAccess:ez.default("session-only"),dataSharesInPlace:j.zMY().default(!0),vaultConsent:es.optional(),vaultKeyCustody:ep.default("file"),vaultInlineReveal:eq.default("masked"),redactFallback:dJ.default("warn"),onboardedAt:ad.w$().optional(),modelJudgeConsent:eA.optional(),historySyncConsent:eC.optional(),webChatCapture:eH.optional(),bodyRetention:eJ.default({enabled:!1,retainDays:30})});function eL(){return eK.parse({})}function eM(a){return a.webChatCapture??eH.parse({})}function eN(a){return"attached"===a.runMode&&void 0!==a.controlPlane}function eO(a){return a.label??a.endpoint}function eP(a,b,c){return{id:b,objectType:a.objectType,location:a.location??null,title:a.title??null,hostId:a.hostId??null,attributes:JSON.stringify(a.attributes),firstSeen:c,lastSeen:c}}function eQ(a,b,c){return{id:b,url:a.url,name:a.name??null,attributes:JSON.stringify(a.attributes),firstSeen:c,lastSeen:c}}function eR(a){return{id:a.id,parentId:a.parentId??null,rootSessionId:a.rootSessionId??null,eventType:a.eventType,hostId:a.hostId??null,harnessId:a.harnessId??null,sourceProjectId:a.sourceProjectId??null,startedAt:X(a.startedAt),endedAt:a.endedAt?X(a.endedAt):null,severity:a.severity??null,priority:a.priority??null,content:a.content??null,contentHash:a.contentHash??null,attributes:a.attributes?JSON.stringify(a.attributes):null}}function eS(a,b){return{id:b,class:a.class,label:a.label??null,attributes:a.attributes?JSON.stringify(a.attributes):null}}function eT(a,b){return{id:b,ruleId:a.ruleId,name:a.name,category:a.category,severity:a.severity,definition:a.definition,version:a.version}}function eU(a){return{id:a.id,auditEventId:a.auditEventId,inspectionDefinitionId:a.inspectionDefinitionId,classifiedDataId:a.classifiedDataId??null,spanStart:a.span.start,spanEnd:a.span.end,maskedMatch:a.maskedMatch,actionTaken:a.actionTaken,confidence:a.confidence,findingKey:a.findingKey??null,firstDetectedAt:a.firstDetectedAt?X(a.firstDetectedAt):null}}function eV(a){let b=a.metadata;return{source_tool:a.sourceTool,...b?.repo!==void 0?{repo:b.repo}:{},...b?.filePath!==void 0?{file_path:b.filePath}:{},...b?.toolName!==void 0?{tool_name:b.toolName}:{},...b?.gitignored!==void 0?{gitignored:b.gitignored}:{},...b?.wholeFile!==void 0?{whole_file:b.wholeFile}:{},...b?.correlationId!==void 0?{correlation_id:b.correlationId}:{},...b?.traceId!==void 0?{trace_id:b.traceId}:{},...b?.exceptionIds!==void 0?{exception_ids:b.exceptionIds}:{},...b?.inspectionMs!==void 0?{inspection_ms:b.inspectionMs}:{},...b?.redactDegradedTo!==void 0?{redact_degraded_to:b.redactDegradedTo}:{},...b?.model!==void 0?{model:b.model}:{},...b?.turnIndex!==void 0?{turn_index:b.turnIndex}:{},...b?.messageId!==void 0&&""!==b.messageId?{message_id:b.messageId}:{},...b?.conversationId!==void 0?{conversation_id:b.conversationId}:{}}}function eW(a){return`capture/${a.category}/${a.severity}`}function eX(a){return{ruleId:a.ruleId,version:eW(a),name:a.ruleId,category:a.category,severity:a.severity,definition:JSON.stringify({ruleId:a.ruleId})}}var eY=c(65215);let eZ="managed-settings.json",e$=j.k5n(["runMode","historicalAccess","vaultConsent","vaultKeyCustody","vaultInlineReveal","modelJudgeConsent","dataSharesInPlace","redactFallback","bodyRetention"]).meta({id:"ManagedSettingKey"}),e_=j.Ikc({runMode:j.k5n(["standalone","attached"]).optional(),controlPlane:j.Ikc({endpoint:j.YjP().min(1),label:j.YjP().min(1).optional()}).optional(),historicalAccess:j.k5n(["full","session-only"]).optional(),vaultConsent:j.zMY().optional(),vaultKeyCustody:j.k5n(["file","keychain"]).optional(),vaultInlineReveal:j.k5n(["masked","full","off"]).optional(),modelJudgeConsent:j.zMY().optional(),dataSharesInPlace:j.zMY().optional(),redactFallback:dJ.optional(),bodyRetention:eJ.optional()}).meta({id:"ManagedSettingsValues"}),e0=j.Ikc({specVersion:j.aig().int().positive().default(1),organization:j.YjP().min(1).optional(),values:j.g1P(j.YjP(),j.L5J()).default({}),lockedFields:j.YOg(j.YjP()).default([])}).transform(({lockedFields:a,values:b,...c},d)=>{let e=[],f=[];for(let b of a)e$.safeParse(b).success?e.push(b):f.push(b);let g=Object.create(null),h=[];for(let[a,c]of Object.entries(b))Object.hasOwn(e_.shape,a)?g[a]=c:h.push(a);let i=e_.safeParse(g);if(!i.success){for(let a of i.error.issues)d.addIssue({...a,path:["values",...a.path]});return eY.tm}return{...c,values:i.data,lockedFields:e,...f.length>0?{unknownLockedFields:f}:{},...h.length>0?{unknownValueFields:h}:{}}}).meta({id:"ManagedSettings"}),e1={present:!1,lockedFields:[]};function e2(a){let b=a.organization??"Your organization";switch(a.reason){case"held-standalone":return`${b} manages this machine and has set it to standalone, so it cannot be attached here.`;case"pinned-endpoint":return`${b} manages this machine and has pinned it to ${a.endpoint}. Attach to that endpoint, or ask them to change it.`;case"pinned-label":case"label-required":return`${b} manages this machine name, so it cannot be renamed here.`;case"held-attached":return`${b} manages this machine's attachment to ${a.endpoint}, so it cannot be detached here. Ask them to change it.`}}let e3=j.Ikc({path:j.YjP().min(1),name:j.YjP().min(1),origin:bh,defaultAccess:bg});j.Ikc({files:j.YOg(e3),truncated:j.zMY(),scannedAt:j.YjP()});let e4=["7d","30d","3m","6m"],e5=j.k5n(e4).meta({id:"TimeRange"}),e6={"7d":7,"30d":30,"3m":90,"6m":180};e5.catch("7d");let e7="dismiss",e8=ax.extract(["acknowledged","false-positive"]).meta({id:"DismissMethod"}),e9=j.Ikc({ruleId:j.YjP().max(200),method:j.YjP(),confirmation:j.YjP()});j.Ikc({ruleId:j.YjP().max(200),method:e8,confirmation:j.YjP()});let fa=j.k5n(["still-valid","unknown","invalid"]),fb=j.Ikc({filePath:j.YjP(),span:ap.optional()}).strict(),fc=j.Ikc({provider:j.YjP(),maskedToken:j.YjP(),where:fb,state:fa,observedAt:ad.w$().optional()}).strict();j.Ikc({provider:j.YjP(),maskedToken:j.YjP(),consolePath:j.YjP(),occurrenceSpread:j.aig().int().positive()}).strict();let fd=j.k5n(["redact-rotation-checklist","redact-only","set-secret-redact","leave"]),fe=j.k5n(["first-run","pre-push","secret-scan"]);j.Ikc({entrySource:fe}).strict();let ff=j.Ikc({id:fd,label:j.YjP()}),fg=j.Ikc({kind:j.euz("decision"),entrySource:fe,secretCount:j.aig().int().positive(),prompt:j.YjP(),options:j.PVZ([ff.extend({id:j.euz("redact-rotation-checklist")}),ff.extend({id:j.euz("redact-only")}),ff.extend({id:j.euz("set-secret-redact")}),ff.extend({id:j.euz("leave")})])}),fh=j.Ikc({kind:j.euz("no-decision")});j.gMt("kind",[fg,fh]);let fi=j.Ikc({severity:am,count:j.aig().int().nonnegative(),caught:j.aig().int().nonnegative().optional(),openAtRest:j.aig().int().nonnegative().optional(),dismissed:j.aig().int().nonnegative().optional(),handled:j.aig().int().nonnegative().optional(),resolved:j.aig().int().nonnegative().optional()}).meta({id:"SeveritySummaryItem"});j.Ikc({total:j.aig().int().nonnegative(),needsRemediation:j.aig().int().nonnegative().optional(),dismissed:j.aig().int().nonnegative().optional(),bySeverity:j.YOg(fi)}).meta({id:"SeveritySummaryResponse"}),j.Ikc({range:j.k5n(e4).default("7d")});let fj=j.k5n(["blocked","redacted","warned"]).meta({id:"EnforcementActionKind"}),fk=j.Ikc({kind:fj,count:j.aig().int().nonnegative(),delta:j.aig().int()}).meta({id:"EnforcementAction"});j.Ikc({range:e5,total:j.aig().int().nonnegative(),actions:j.YOg(fk)}).meta({id:"EnforcementActionsResponse"});let fl=j.k5n(["day","week"]).meta({id:"TimeseriesGranularity"}),fm=j.Ikc({timestamp:ad.p6(),critical:j.aig().int().nonnegative(),high:j.aig().int().nonnegative(),medium:j.aig().int().nonnegative(),low:j.aig().int().nonnegative().optional()}).meta({id:"FindingsTimeseriesPoint"});j.Ikc({range:e5,granularity:fl,points:j.YOg(fm)}).meta({id:"FindingsTimeseriesResponse"});let fn=j.Ikc({timestamp:ad.p6(),bySeverity:j.Ikc({critical:j.aig().nonnegative().nullable(),high:j.aig().nonnegative().nullable(),medium:j.aig().nonnegative().nullable(),low:j.aig().nonnegative().nullable()})}).meta({id:"MttrTrendPoint"});j.Ikc({range:e5,granularity:fl,points:j.YOg(fn)}).meta({id:"MttrTrendResponse"});let fo=j.Ikc({findingKey:j.YjP(),ruleId:j.YjP(),severity:am,repo:j.YjP().optional(),path:j.YjP(),resolvedAt:ad.w$(),detectedAt:ad.w$()}).meta({id:"ResolvedFeedItem"});j.Ikc({items:j.YOg(fo)}).meta({id:"RecentlyResolvedResponse"});let fp=["repo","user"],fq=j.k5n(fp).meta({id:"SourceKind"}),fr=j.Ikc({id:j.YjP(),name:j.YjP(),kind:fq,findingsCount:j.aig().int().nonnegative()}).meta({id:"TopSource"});j.Ikc({range:e5,items:j.YOg(fr)}).meta({id:"TopSourcesResponse"}),j.Ikc({range:j.k5n(e4).default("7d"),limit:ae.ai().int().min(1).max(50).default(5),kind:j.k5n(fp).optional()});let fs=ag.extract(["ClaudeCode","Cursor","Codex","Antigravity","ClaudeAi","ChatGpt","Copilot","Api"]).meta({id:"Provider"}),ft=j.Ikc({provider:fs,coverage:j.aig().int().min(0).max(100),supported:j.zMY()}).meta({id:"ScanCoverageProvider"});j.Ikc({range:e5,providers:j.YOg(ft)}).meta({id:"ScanCoverageResponse"});let fu=j.k5n(["repo","user","team","policy","share","rule"]).meta({id:"SubjectType"}),fv=j.Ikc({type:fu,id:j.YjP(),label:j.YjP()}).meta({id:"RecommendationSubject"}),fw=j.k5n(["apply","navigate"]).meta({id:"RecommendationActionMode"}),fx=j.Ikc({mode:fw,type:j.YjP(),label:j.YjP(),href:j.YjP().optional(),policyId:j.YjP().optional(),teamId:j.YjP().optional()}).meta({id:"RecommendationAction"}),fy=j.Ikc({id:j.YjP(),category:j.YjP(),severity:am,title:j.YjP(),description:j.YjP(),subjects:j.YOg(fv),action:fx}).meta({id:"RecommendedAction"});j.Ikc({items:j.YOg(fy)}).meta({id:"RecommendedActionsResponse"}),j.Ikc({limit:ae.ai().int().min(1).max(20).default(3)});let fz=j.Ikc({type:j.YjP(),policyId:j.YjP().optional(),teamId:j.YjP().optional()}).meta({id:"AppliedAction"});j.Ikc({id:j.YjP(),status:j.euz("applied"),appliedAction:fz}).meta({id:"ApplyRecommendedActionResponse"}),j.Ikc({id:j.YjP(),status:j.euz("dismissed")}).meta({id:"DismissRecommendedActionResponse"}),j.Ikc({id:j.YjP()});let fA=j.k5n(["granted","revoked","unchanged"]).meta({id:"HistorySyncConsentChoice"}),fB=j.k5n(["granted","revoked","unchanged"]).meta({id:"ModelJudgeConsentChoice"}),fC=j.k5n(["granted","revoked","unchanged"]).meta({id:"WebChatCaptureConsentChoice"}),fD=j.Ikc({historicalAccess:j.YjP(),modelJudgeConsent:fB,historySyncConsent:fA,vaultConsent:j.YjP(),vaultInlineReveal:j.YjP(),webChatCaptureConsent:fC,redactFallback:j.YjP(),bodyRetention:j.Ikc({enabled:j.zMY(),retainDays:j.aig()})}),fE=j.Ikc({endpoint:j.YjP(),label:b8(200).optional(),accessKey:j.YjP()});j.Ikc({ruleId:j.YjP(),category:al,severity:am,maskedMatch:j.YjP(),rawMatch:j.YjP(),context:j.YjP(),filePath:j.YjP().optional(),confidence:j.aig().min(0).max(1),id:j.YjP().optional(),valueFingerprint:j.YjP().optional(),keyVersion:j.aig().int().nonnegative().optional()});let fF=j.Ikc({category:al,action:dY,reasoning:j.YjP(),genuineCount:j.aig().int().nonnegative(),fpCount:j.aig().int().nonnegative(),fpIds:j.YOg(j.YjP())});j.Ikc({perCategory:j.YOg(fF),notes:j.YjP()});let fG=j.Ikc({total:j.aig().int().nonnegative(),important:j.aig().int().nonnegative(),routine:j.aig().int().nonnegative()}).refine(a=>a.total===a.important+a.routine,{message:"total must equal important + routine",path:["total"]}),fH=j.Ikc({ruleId:j.YjP(),category:al,valueFingerprint:j.YjP(),keyVersion:j.aig().int().nonnegative()}),fI=j.Ikc({pattern:j.YjP(),count:j.aig().int().nonnegative(),values:j.YOg(fH).min(1)}),fJ=j.Ikc({category:al,count:j.aig().int().nonnegative(),egress:j.zMY()}),fK=j.Ikc({counts:fG,routineCategories:j.YOg(al),surfacedCategories:j.YOg(al),findingKinds:j.YOg(fJ),posture:j.g1P(al,dI),maskedFindings:j.YOg(fc).optional(),falsePositivePatterns:j.YOg(fI).optional()}),fL=fF.pick({category:!0,genuineCount:!0,fpCount:!0}).extend({egress:j.zMY()});j.Ikc({categories:j.YOg(fL),posture:j.g1P(al,dI)}),j.Ikc({frame:fK,copy:j.YjP()}),j.k5n(["scan","floor"]);let fM=j.Ikc({id:j.k5n(["enter-remediation","open-dashboard","not-now"]),label:j.YjP()}),fN=j.PVZ([fM.extend({id:j.euz("open-dashboard")}),fM.extend({id:j.euz("not-now")})]),fO=j.PVZ([fM.extend({id:j.euz("enter-remediation")}),fM.extend({id:j.euz("open-dashboard")}),fM.extend({id:j.euz("not-now")})]);j.Ikc({worthALook:j.aig().int().nonnegative(),liveKeys:j.aig().int().nonnegative().optional(),options:j.KCZ([fN,fO])}).refine(a=>a.options.some(a=>"enter-remediation"===a.id)===(a.liveKeys??0)>0,{message:"the chain-entry option is present exactly when liveKeys > 0",path:["options"]}).refine(a=>(a.liveKeys??0)<=a.worthALook,{message:"liveKeys is a subset of worthALook and cannot exceed it",path:["liveKeys"]});let fP=new Set(["recognized","internal"]);function fQ(a){return fP.has(a)?"allowed":"review"}function fR(a){return"block"===a?"blocked":"allowed"}function fS(a,b){return null===b?fQ(a):fR(b)}function fT(a,b){return null!==b&&fR(b)!==fQ(a)}function fU(a,b,c){let d=function(a,b){let c=[];return"ip"===a&&c.push("raw_ip"),"unverified"===a&&c.push("unverified_domain"),(b.includes("http")||b.includes("ws"))&&c.push("plaintext_transport"),c}(a,b);return{needsReview:d.length>0&&!c,reasons:d}}function fV(a){return Array.from(new Set(a))}function fW(a){let b=new Set(a);return bB.filter(a=>b.has(a))}function fX(a){return fW(a)[0]??"none"}let fY={raw_ip:0,unverified_domain:1,plaintext_transport:2};function fZ(a){return 0===a.length?1/0:Math.min(...a.map(a=>fY[a]))}let f$={Stable:"stable",Beta:"beta",Nightly:"nightly"},f_={[f$.Stable]:"latest",[f$.Beta]:"beta",[f$.Nightly]:"nightly"},f0={Channel:"channel",Graduated:"graduated",Unpublished:"unpublished",Unknown:"unknown"},f1="Your organization's managed settings install it and pin its version. Updates arrive through Claude Code's own plugin autoupdate when a new session starts, or /plugin → update inside a session.",f2=j.k5n(["site","estimated","none"]),f3=j.Ikc({inputTokens:j.aig().int().nonnegative().optional(),outputTokens:j.aig().int().nonnegative().optional(),cacheReadInputTokens:j.aig().int().nonnegative().optional(),cacheCreationInputTokens:j.aig().int().nonnegative().optional()}),f4=j.Ikc({toolUseId:j.YjP().min(1),toolName:j.YjP().min(1),target:j.YjP().optional(),isError:j.zMY().optional(),inputSize:j.aig().int().nonnegative().optional(),outputSize:j.aig().int().nonnegative().optional()});j.Ikc({messageId:j.YjP().min(1),startedAt:ad.w$(),model:j.YjP().optional(),usage:f3.optional(),usageSource:f2,stopReason:j.YjP().optional(),conversationId:j.YjP().optional(),turnIndex:j.aig().int().nonnegative().optional(),toolCalls:j.YOg(f4).default([]),responseText:j.YjP().optional(),truncated:j.zMY().default(!1)});let f5=j.k5n(["watching","composer-only","button-only","unattached","unknown"]),f6=j.Ikc({patched:j.zMY(),live:j.zMY(),blind:j.zMY(),sendsSeenDom:j.aig().int().nonnegative(),exchangesSeenNet:j.aig().int().nonnegative(),parseFailures:j.aig().int().nonnegative(),unparsedBodies:j.aig().int().nonnegative(),shapeMisses:j.YOg(j.YjP()).default([]),conversationEndpoints:j.aig().int().nonnegative().default(0),closed:j.zMY().default(!1),enforcement:f5.default("unknown")});function f7(a){return a.find(a=>{var b;return!(b=a.status).patched||0===b.conversationEndpoints||b.blind||b.shapeMisses.length>0||b.parseFailures>0||b.unparsedBodies>0||b.exchangesSeenNet>0})??a[0]}let f8=2592e6,f9=30;function ga(a){let b=aU.safeParse(a);if(!b.success)return null;let c=b.data,d=f6.safeParse({patched:c.patched,live:c.live,blind:c.blind,sendsSeenDom:c.sends_seen_dom,exchangesSeenNet:c.exchanges_seen_net,parseFailures:c.parse_failures,unparsedBodies:c.unparsed_bodies,shapeMisses:c.shape_misses,conversationEndpoints:c.conversation_endpoints,closed:c.closed,enforcement:c.enforcement});return d.success?d.data:null}},43586:(a,b,c)=>{c.d(b,{WR:()=>a2,qA:()=>a3,qk:()=>bx,Pi:()=>dB,o8:()=>by,zd:()=>i,Qo:()=>cH,Ru:()=>dx,KS:()=>bk,tI:()=>bi,_2:()=>cQ,Dg:()=>cS,gt:()=>cU,lG:()=>j.lGs,Wo:()=>bl,Rd:()=>cO,V6:()=>cY,F3:()=>cZ,Ji:()=>cz,R8:()=>C,Hg:()=>B,XK:()=>A,y9:()=>cN,cn:()=>cT,xR:()=>bv,Zu:()=>E,v5:()=>cP,Cn:()=>cV,VL:()=>bj,Yf:()=>cG,sF:()=>D,g5:()=>u});var d=c(73024),e=c(76760);let f="policy-cache.json",g="attached-state.json",h=[f,"attached-sync-state.json",g,"attached-forward-drops.json","attached-posture-report.json","attached-history-sync.json"];function i(a){for(let b of h)try{(0,d.rmSync)((0,e.join)(a,b),{force:!0})}catch{}}var j=c(40557),k=c(75919);let l="aka.db";function m(a,b){if(!function(a){try{return(0,d.lstatSync)(a).isSymbolicLink()}catch{return!1}}(a))try{(0,d.chmodSync)(a,b)}catch{}}function n(a){m(a,448)}function o(a,b=!1){(0,d.mkdirSync)(a,{recursive:b,mode:448})}function p(a){o(a,!0),n(a)}function q(a){return[`${a}-wal`,`${a}-shm`,`${a}-journal`]}function r(a){m(a,384)}function s(a){for(let b of[a,...q(a)])m(b,384)}function t(a,b){(0,d.writeFileSync)(a,b,{mode:384,flag:"wx"})}function u(a,b){let c=`${a}.${String(process.pid)}.tmp`;try{(0,d.rmSync)(c,{force:!0})}catch{}try{t(c,b),(0,d.renameSync)(c,a)}finally{try{(0,d.rmSync)(c,{force:!0})}catch{}}r(a)}function v(a){try{if((0,d.lstatSync)(a).isSymbolicLink())return{kind:"symlink"};return{kind:"gone"}}catch(a){if("ENOENT"===a.code)return{kind:"gone"};return{kind:"unknown",cause:a}}}class w extends Error{constructor(a,b){super(a,void 0===b?void 0:{cause:b}),this.code="key-unclaimable",this.name="KeyUnclaimableError"}}function x(a,b){let c,e=`${a}.${String(process.pid)}.${String(k.threadId)}.new`;try{(0,d.rmSync)(e,{force:!0})}catch{}try{t(e,b),c=function(a,b,c){try{return(0,d.linkSync)(a,b),!0}catch(b){let a=b.code;if("EEXIST"===a)return!1;if(!y.has(a??""))throw b}try{return t(b,c),!0}catch(a){if("EEXIST"===a.code)return!1;throw a}}(e,a,b)}finally{try{(0,d.rmSync)(e,{force:!0})}catch{}}return c&&r(a),c}let y=new Set(["EPERM","ENOSYS","ENOTSUP","EOPNOTSUPP","EINVAL"]);function z(a){return(0,e.join)(a,j.leE)}function A(a,b){let c=B(a,b);return c.usable?{usable:!0}:c}function B(a,b){let c,e,f=z(a),g=function(a){let b=(0,d.lstatSync)(a,{throwIfNoEntry:!1});if(void 0===b)return"absent";if(b.isSymbolicLink())return"untrusted";let c=(0,d.statSync)(a,{throwIfNoEntry:!1});if(void 0===c)return"absent";let e=process.getuid?.();if(void 0!==e&&c.uid!==e)return"untrusted";if("win32"!==process.platform&&(511&c.mode)!=384)try{(0,d.chmodSync)(a,384)}catch{return"untrusted"}return"ok"}(f);if("absent"===g)return{usable:!1,reason:"absent"};if("untrusted"===g)return{usable:!1,reason:"untrusted-file"};try{c=(0,d.readFileSync)(f,"utf8")}catch(a){return{usable:!1,reason:"ENOENT"===a.code?"absent":"unreadable"}}try{e=JSON.parse(c)}catch{return{usable:!1,reason:"malformed"}}let h=j.yi_.safeParse(e);return h.success?(0,j.lGs)(h.data.endpoint)?void 0!==b&&b.endpoint!==h.data.endpoint?{usable:!1,reason:"endpoint-mismatch",credentialEndpoint:h.data.endpoint,settingsEndpoint:b.endpoint}:{usable:!0,credential:h.data}:{usable:!1,reason:"unsafe-endpoint"}:{usable:!1,reason:"malformed"}}function C(a,b){let c=B(a,b);return c.usable?c.credential:null}function D(a,b){let c=(0,j.AaX)(b.endpoint);if(null!==c)throw Error(`refusing to store a control-plane credential for ${(0,j.Vgn)(b.endpoint)}: `+function(a){switch(a){case"unparseable":return"that does not look like a web address.";case"userinfo":return"the address carries a username or password, which must not be stored alongside the credential.";case"query-or-fragment":return"the address must be an origin, optionally with a path, not a query string or fragment.";case"insecure":return"an access key must not be stored for a non-HTTPS endpoint (http is accepted only for a loopback deployment)."}}(c));p(a),u(z(a),`${JSON.stringify(b,null,2)}
 `)}function E(a){let b=z(a),c=void 0!==(0,d.lstatSync)(b,{throwIfNoEntry:!1});return(0,d.rmSync)(b,{force:!0}),c}var F=c(77598),G=c(79868);function H(a){return(0,F.createHash)("sha256").update(a).digest("hex")}function I(a){return H((0,j.tTV)(["source_project",a]))}function J(a,b){return H((0,j.tTV)(["inspection_definition",a,b]))}function K(a,b){return`${a}.${b}.${String(Date.now())}.${(0,F.randomUUID)().slice(0,8)}.bak`}let L=".partial",M=`.bak${L}`,N="copy";function O(a){let b,c=(0,e.dirname)(a),f=`${(0,e.basename)(a)}.`;try{b=(0,d.readdirSync)(c)}catch{return}for(let a of b){if(!a.startsWith(f)||!a.endsWith(M))continue;let b=(0,e.join)(c,a);try{let a=function(a){for(let b of[(0,e.join)(a,N),a])try{return Date.now()-(0,d.statSync)(b).mtimeMs}catch{}return null}(b);null!==a&&a>3e5&&(0,d.rmSync)(b,{recursive:!0,force:!0})}catch{}}}function P(a,b){let{stage:c,copy:f}=function(a){let b=`${a}${L}`;return(0,d.rmSync)(b,{recursive:!0,force:!0}),o(b),n(b),{stage:b,copy:(0,e.join)(b,N)}}(b);try{a.prepare("VACUUM INTO ?").run(f),r(f),(0,d.renameSync)(f,b)}catch(a){try{(0,d.rmSync)(c,{recursive:!0,force:!0})}catch{}throw a}try{(0,d.rmSync)(c,{recursive:!0,force:!0})}catch{}}let Q=new TextDecoder;function R(a){return null===a?null:"string"==typeof a?a.toLowerCase():"number"==typeof a||"bigint"==typeof a?String(a).toLowerCase():Q.decode(a).toLowerCase()}function S(a){return a.replace(/\\/g,"\\\\").replace(/%/g,"\\%").replace(/_/g,"\\_")}function T(a){return Array.from({length:a},()=>"?").join(", ")}function U(a){return`%${S(a)}%`}function V(a){return`(${a.map(a=>`${a} LIKE ? ESCAPE '\\'`).join(" OR ")})`}let W=0;function X(a,b,c="DEFERRED"){if(a.isTransaction){let c=`aka_sp_${String(W+=1)}`;a.exec(`SAVEPOINT ${c}`);try{b(),a.exec(`RELEASE ${c}`)}catch(b){try{a.exec(`ROLLBACK TO ${c}`),a.exec(`RELEASE ${c}`)}catch{}throw b}return}a.exec("IMMEDIATE"===c?"BEGIN IMMEDIATE":"BEGIN");try{b(),a.exec("COMMIT")}catch(b){try{a.exec("ROLLBACK")}catch{}throw b}}function Y(a,b,c="DEFERRED"){let d=a.isTransaction;try{return X(a,b,c),!0}catch(b){if(!a.isTransaction&&d)throw b;return!1}}function Z(a){process.stderr.write(`[aka] ${a}
 `)}function $(a,b,c){return void 0!==a.prepare("SELECT 1 FROM sqlite_master WHERE type = ? AND name = ? LIMIT 1").get(b,c)}function _(a,b){return $(a,"index",b)}function aa(a,b,c){let d=c?.includeGenerated?"table_xinfo":"table_info";return a.prepare(`PRAGMA ${d}(${b})`).all().map(a=>a.name)}function ab(a,b){return void 0===b?a.all():Array.isArray(b)?a.all(...b):a.all(b)}function ac(a,b){return void 0===b?a.get():Array.isArray(b)?a.get(...b):a.get(b)}function ad(a){return 1===a||!0===a}function ae(a){let b={};for(let[c,d]of Object.entries(a))b[c]=void 0===d?null:d;return b}function af(a,b,c){return ac(a.prepare(b),c)?.n??0}function ag(a,b,c){let d=new Map;for(let e of ab(a.prepare(b),c))d.set(e.k,e.n);return d}function ah(a,b){let c=[];for(let d of a)try{c.push(b(d))}catch{}return c}let ai=["prompt","response","tool_use"],aj=ai.map(a=>`'${a}'`).join(", "),ak=["session","llm_call","tool_call"],al=ak.map(a=>`'${a}'`).join(", "),am=[...ak,...ai],an=am.map(a=>`'${a}'`).join(", "),ao=`
          SUM(CASE WHEN synced_at IS NULL AND sync_claimed_at IS NULL THEN 1 ELSE 0 END) AS queued,
@@ -678,6 +678,7 @@
           v.occurrence_count, v.first_seen, v.last_seen`,b6=`
   pointer_id AS pointerId,
   value_fingerprint AS valueFingerprint,
+  value_identity_fingerprint AS valueIdentityFingerprint,
   fingerprint_key_version AS fingerprintKeyVersion,
   key_version AS keyVersion,
   format_version AS formatVersion,
@@ -692,13 +693,13 @@
   occurrence_count AS occurrenceCount,
   first_seen AS firstSeen,
   last_seen AS lastSeen`;function b7(a){let{provider:b,userAuthorized:c,...d}=a,e={...d,userAuthorized:0!==c};return null===b?e:{...e,provider:b}}class b8{constructor(a){this.db=a,this.insertStmt=a.prepare(`INSERT INTO secret_vault (
-         pointer_id, value_fingerprint, fingerprint_key_version, key_version,
-         format_version, category, rule_id, masked_match, provider,
+         pointer_id, value_fingerprint, value_identity_fingerprint,
+         fingerprint_key_version, key_version, format_version, category, rule_id, masked_match, provider,
          ciphertext, nonce, auth_tag,
          user_authorized, occurrence_count, first_seen, last_seen
        ) VALUES (
-         :pointerId, :valueFingerprint, :fingerprintKeyVersion, :keyVersion,
-         :formatVersion, :category, :ruleId, :maskedMatch, :provider,
+         :pointerId, :valueFingerprint, :valueIdentityFingerprint,
+         :fingerprintKeyVersion, :keyVersion, :formatVersion, :category, :ruleId, :maskedMatch, :provider,
          :ciphertext, :nonce, :authTag,
          :userAuthorized, 1, :now, :now
        )`),this.bumpStmt=a.prepare(`UPDATE secret_vault
@@ -707,9 +708,12 @@
        WHERE value_fingerprint = :valueFingerprint`),this.byPointerStmt=a.prepare(`SELECT ${b6} FROM secret_vault WHERE pointer_id = :pointerId`),this.byFingerprintStmt=a.prepare(`SELECT ${b6} FROM secret_vault WHERE value_fingerprint = :valueFingerprint`),this.listStmt=a.prepare(`SELECT ${b6} FROM secret_vault ORDER BY first_seen`),this.replaceCiphertextStmt=a.prepare(`UPDATE secret_vault
        SET key_version = :keyVersion, ciphertext = :ciphertext, nonce = :nonce, auth_tag = :authTag
        WHERE pointer_id = :pointerId`),this.refreshFingerprintStmt=a.prepare(`UPDATE secret_vault
-       SET value_fingerprint = :valueFingerprint, fingerprint_key_version = :fingerprintKeyVersion
+       SET value_fingerprint = :valueFingerprint,
+           value_identity_fingerprint = :valueIdentityFingerprint,
+           fingerprint_key_version = :fingerprintKeyVersion
+       WHERE pointer_id = :pointerId`),this.setIdentityStmt=a.prepare(`UPDATE secret_vault SET value_identity_fingerprint = :valueIdentityFingerprint
        WHERE pointer_id = :pointerId`),this.deleteByPointerStmt=a.prepare("DELETE FROM secret_vault WHERE pointer_id = :pointerId"),this.derefStmt=a.prepare(`INSERT INTO secret_vault_deref (id, pointer_id, at, target, reason, outcome, grant_id, pointer_count)
-       VALUES (:id, :pointerId, :at, :target, :reason, :outcome, :grantId, :pointerCount)`)}upsert(a,b){let c=!1;X(this.db,()=>{if(void 0===ac(this.byFingerprintStmt,{valueFingerprint:a.valueFingerprint})){this.insertStmt.run(ae({pointerId:a.pointerId,valueFingerprint:a.valueFingerprint,fingerprintKeyVersion:a.fingerprintKeyVersion,keyVersion:a.keyVersion,formatVersion:a.formatVersion??j.viY,category:a.category,ruleId:a.ruleId,maskedMatch:a.maskedMatch,provider:a.provider,ciphertext:a.ciphertext,nonce:a.nonce,authTag:a.authTag,userAuthorized:+(!0===a.userAuthorized),now:b})),c=!0;return}this.bumpStmt.run({valueFingerprint:a.valueFingerprint,userAuthorized:+(!0===a.userAuthorized),now:b})},"IMMEDIATE");let d=ac(this.byFingerprintStmt,{valueFingerprint:a.valueFingerprint});if(void 0===d)throw Error("vault: row vanished immediately after write");return{row:b7(d),minted:c}}byPointerId(a){let b=ac(this.byPointerStmt,{pointerId:a});return void 0===b?null:b7(b)}byValueFingerprint(a){let b=ac(this.byFingerprintStmt,{valueFingerprint:a});return void 0===b?null:b7(b)}recordDeref(a){this.derefStmt.run(ae({id:a.id,pointerId:a.pointerId,at:a.at,target:a.target,reason:a.reason,outcome:a.outcome,grantId:a.grantId,pointerCount:a.pointerCount??1}))}listAll(){return ab(this.listStmt).map(b7)}replaceCiphertext(a,b){this.replaceCiphertextStmt.run({pointerId:a,...b})}refreshFingerprint(a,b){this.refreshFingerprintStmt.run({pointerId:a,...b})}purgeAll(){let a=0;return X(this.db,()=>{a=this.countEntries(),this.db.exec("DELETE FROM secret_vault")},"IMMEDIATE"),a}deleteByPointerIds(a){if(0===a.length)return[];let b=[];return X(this.db,()=>{for(let c of a)Number(this.deleteByPointerStmt.run({pointerId:c}).changes)>0&&b.push(c)},"IMMEDIATE"),b}recordSighting(a,b){this.db.prepare(`INSERT INTO secret_vault_sighting (id, pointer_id, location, kind, first_seen, last_seen)
+       VALUES (:id, :pointerId, :at, :target, :reason, :outcome, :grantId, :pointerCount)`)}upsert(a,b){let c=!1;X(this.db,()=>{if(void 0===ac(this.byFingerprintStmt,{valueFingerprint:a.valueFingerprint})){this.insertStmt.run(ae({pointerId:a.pointerId,valueFingerprint:a.valueFingerprint,valueIdentityFingerprint:a.valueIdentityFingerprint,fingerprintKeyVersion:a.fingerprintKeyVersion,keyVersion:a.keyVersion,formatVersion:a.formatVersion??j.viY,category:a.category,ruleId:a.ruleId,maskedMatch:a.maskedMatch,provider:a.provider,ciphertext:a.ciphertext,nonce:a.nonce,authTag:a.authTag,userAuthorized:+(!0===a.userAuthorized),now:b})),c=!0;return}this.bumpStmt.run({valueFingerprint:a.valueFingerprint,userAuthorized:+(!0===a.userAuthorized),now:b})},"IMMEDIATE");let d=ac(this.byFingerprintStmt,{valueFingerprint:a.valueFingerprint});if(void 0===d)throw Error("vault: row vanished immediately after write");return{row:b7(d),minted:c}}byPointerId(a){let b=ac(this.byPointerStmt,{pointerId:a});return void 0===b?null:b7(b)}byValueFingerprint(a){let b=ac(this.byFingerprintStmt,{valueFingerprint:a});return void 0===b?null:b7(b)}recordDeref(a){this.derefStmt.run(ae({id:a.id,pointerId:a.pointerId,at:a.at,target:a.target,reason:a.reason,outcome:a.outcome,grantId:a.grantId,pointerCount:a.pointerCount??1}))}listAll(){return ab(this.listStmt).map(b7)}replaceCiphertext(a,b){this.replaceCiphertextStmt.run({pointerId:a,...b})}setIdentityFingerprint(a,b){this.setIdentityStmt.run({pointerId:a,valueIdentityFingerprint:b})}refreshFingerprint(a,b){this.refreshFingerprintStmt.run({pointerId:a,...b})}purgeAll(){let a=0;return X(this.db,()=>{a=this.countEntries(),this.db.exec("DELETE FROM secret_vault")},"IMMEDIATE"),a}deleteByPointerIds(a){if(0===a.length)return[];let b=[];return X(this.db,()=>{for(let c of a)Number(this.deleteByPointerStmt.run({pointerId:c}).changes)>0&&b.push(c)},"IMMEDIATE"),b}recordSighting(a,b){this.db.prepare(`INSERT INTO secret_vault_sighting (id, pointer_id, location, kind, first_seen, last_seen)
          VALUES (:id, :pointerId, :location, :kind, :now, :now)
          ON CONFLICT (pointer_id, location) DO UPDATE SET last_seen = :now`).run({id:(0,F.randomUUID)(),pointerId:a.pointerId,location:a.location,kind:a.kind,now:b})}sightingsFor(a){let b=new Map(a.map(a=>[a,[]]));if(0===a.length)return b;for(let c of ab(this.db.prepare(`SELECT pointer_id, location, kind, first_seen, last_seen
            FROM secret_vault_sighting
@@ -717,7 +721,7 @@
           ORDER BY last_seen DESC`),a))b.get(c.pointer_id)?.push({location:c.location,kind:c.kind,firstSeen:new Date(c.first_seen).toISOString(),lastSeen:new Date(c.last_seen).toISOString()});return b}toInventoryEntries(a){let b=this.sightingsFor(a.map(a=>a.pointer_id));return a.map(a=>({pointerId:a.pointer_id,category:a.category,...null===a.provider?{}:{provider:a.provider},maskedMatch:a.masked_match,occurrences:a.occurrence_count,firstSeen:new Date(a.first_seen).toISOString(),lastSeen:new Date(a.last_seen).toISOString(),revealGrantId:a.grant_id,sightings:b.get(a.pointer_id)??[]}))}listInventory(a={},b=Date.now()){let c=b3(a.limit,j.mBk),d=void 0===a.cursor?null:aC(a.cursor),e=null===d?"":"WHERE (v.last_seen < :cursorLastSeen OR (v.last_seen = :cursorLastSeen AND v.pointer_id < :cursorPointerId))",f=ab(this.db.prepare(`SELECT ${b5},
                 (SELECT e.id FROM exceptions e
                   WHERE e.rule_id = v.rule_id
-                    AND e.value_fingerprint = v.value_fingerprint
+                    AND e.value_fingerprint = v.value_identity_fingerprint
                     AND e.key_version = v.fingerprint_key_version
                     AND ${a6}
                   LIMIT 1) AS grant_id
@@ -728,7 +732,7 @@
               OR (v.occurrence_count = :cursorOccurrences AND v.pointer_id < :cursorPointerId))`,g=ab(this.db.prepare(`SELECT ${b5},
                 (SELECT e.id FROM exceptions e
                   WHERE e.rule_id = v.rule_id
-                    AND e.value_fingerprint = v.value_fingerprint
+                    AND e.value_fingerprint = v.value_identity_fingerprint
                     AND e.key_version = v.fingerprint_key_version
                     AND ${a6}
                   LIMIT 1) AS grant_id
@@ -748,7 +752,10 @@
              f.finding_key IS NULL
              OR latest.status IS NULL
              OR latest.status NOT IN ('resolved', 'dismissed')
-           )`,ca=["critical","high","medium","low"],cb={block:"blocked",redact:"redacted",warn:"warned"},cc=["blocked","redacted","warned"],cd={[j.tLs.Antigravity]:{coverage:60,supported:!0},[j.tLs.Api]:{coverage:0,supported:!1},[j.tLs.ChatGpt]:{coverage:40,supported:!0},[j.tLs.ClaudeAi]:{coverage:40,supported:!0},[j.tLs.ClaudeCode]:{coverage:100,supported:!0},[j.tLs.Codex]:{coverage:80,supported:!0},[j.tLs.Copilot]:{coverage:30,supported:!0},[j.tLs.Cursor]:{coverage:0,supported:!1}},ce={"7d":"day","30d":"day","3m":"week","6m":"week"};function cf(a){return 864e5*Math.floor(a/864e5)}function cg(a){return new Date(a).toISOString().slice(0,10)}class ch{constructor(a,b=()=>Date.now()){this.db=a,this.now=b}severitySummary(){let a=new Map(ab(this.db.prepare(`SELECT d.severity AS severity,
+           )`;function ca(a,b){return ab(a.prepare(`SELECT DISTINCT f.finding_key AS finding_key
+       ${b9}
+         AND d.rule_id = :ruleId
+         AND f.finding_key IS NOT NULL`),{ruleId:b}).map(a=>a.finding_key)}let cb=["critical","high","medium","low"],cc={block:"blocked",redact:"redacted",warn:"warned"},cd=["blocked","redacted","warned"],ce={[j.tLs.Antigravity]:{coverage:60,supported:!0},[j.tLs.Api]:{coverage:0,supported:!1},[j.tLs.ChatGpt]:{coverage:40,supported:!0},[j.tLs.ClaudeAi]:{coverage:40,supported:!0},[j.tLs.ClaudeCode]:{coverage:100,supported:!0},[j.tLs.Codex]:{coverage:80,supported:!0},[j.tLs.Copilot]:{coverage:30,supported:!0},[j.tLs.Cursor]:{coverage:0,supported:!1}},cf={"7d":"day","30d":"day","3m":"week","6m":"week"};function cg(a){return 864e5*Math.floor(a/864e5)}function ch(a){return new Date(a).toISOString().slice(0,10)}class ci{constructor(a,b=()=>Date.now()){this.db=a,this.now=b}severitySummary(){let a=new Map(ab(this.db.prepare(`SELECT d.severity AS severity,
                 COUNT(*) AS count,
                 SUM(CASE
                       WHEN e.event_type != 'code_change' THEN 1
@@ -756,19 +763,32 @@
                       WHEN latest.status = 'resolved' THEN 1
                       ELSE 0
                     END) AS caught,
+                SUM(CASE WHEN e.event_type != 'code_change' THEN 1 ELSE 0 END) AS handled,
                 SUM(CASE
                       WHEN e.event_type = 'code_change'
                        AND f.finding_key IS NOT NULL
-                       AND (latest.status IS NULL OR latest.status != 'resolved') THEN 1
+                       AND latest.status = 'resolved' THEN 1
                       ELSE 0
-                    END) AS open_at_rest
+                    END) AS resolved,
+                SUM(CASE
+                      WHEN e.event_type = 'code_change'
+                       AND f.finding_key IS NOT NULL
+                       AND (latest.status IS NULL
+                            OR latest.status NOT IN ('resolved', 'dismissed')) THEN 1
+                      ELSE 0
+                    END) AS open_at_rest,
+                SUM(CASE
+                      WHEN e.event_type = 'code_change'
+                       AND latest.status = 'dismissed' THEN 1
+                      ELSE 0
+                    END) AS dismissed
          FROM inspection_findings f
          JOIN audit_events e INDEXED BY idx_audit_capture_rollup ON e.id = f.audit_event_id
          JOIN inspection_definitions d ON d.id = f.inspection_definition_id
          LEFT JOIN ${ba} latest
            ON latest.finding_key = f.finding_key
          WHERE e.event_type IN (${j.hfB})
-         GROUP BY d.severity`)).map(a=>[a.severity,a])),b=ca.map(b=>({severity:b,count:a.get(b)?.count??0,caught:a.get(b)?.caught??0,openAtRest:a.get(b)?.open_at_rest??0}));return Promise.resolve({total:b.reduce((a,b)=>a+b.count,0),needsRemediation:b.reduce((a,b)=>a+b.openAtRest,0),bySeverity:b})}scanCoverage(a){return Promise.resolve({range:a,providers:j.KqW.options.map(a=>({provider:a,...cd[a]}))})}enforcementActions(a){let b=864e5*j.eI7[a],c=this.now(),d=c-b,e=this.findingsInRange(c-2*b,c),f={blocked:0,redacted:0,warned:0},g={blocked:0,redacted:0,warned:0};for(let a of e){let b=cb[a.actionTaken];b&&(a.occurredAt>=d?f[b]++:g[b]++)}let h=cc.map(a=>({kind:a,count:f[a],delta:f[a]-g[a]}));return Promise.resolve({range:a,total:h.reduce((a,b)=>a+b.count,0),actions:h})}findingsTimeseries(a){let b=ce[a],c=("day"===b?1:7)*864e5,d=j.eI7[a],e="day"===b?d:Math.ceil(d/7),f=this.now(),g=cf(f)-(d-1)*864e5,h=this.findingsInRange(g,f),i=Array.from({length:e},(a,b)=>({timestamp:cg(g+b*c),critical:0,high:0,medium:0,low:0}));for(let a of h){let b=i[Math.floor((a.occurredAt-g)/c)];if(b){var k;("critical"===(k=a.severity)||"high"===k||"medium"===k||"low"===k)&&b[a.severity]++}}return Promise.resolve({range:a,granularity:b,points:i})}mttrTrend(a){let b=ce[a],c=("day"===b?1:7)*864e5,d=j.eI7[a],e="day"===b?d:Math.ceil(d/7),f=this.now(),g=cf(f)-(d-1)*864e5,h=ab(this.db.prepare(`SELECT DISTINCT f.finding_key AS finding_key,
+         GROUP BY d.severity`)).map(a=>[a.severity,a])),b=cb.map(b=>({severity:b,count:a.get(b)?.count??0,caught:a.get(b)?.caught??0,handled:a.get(b)?.handled??0,resolved:a.get(b)?.resolved??0,openAtRest:a.get(b)?.open_at_rest??0,dismissed:a.get(b)?.dismissed??0})),c=b.reduce((a,b)=>a+b.count,0);return Promise.resolve({total:c,needsRemediation:b.reduce((a,b)=>a+b.openAtRest,0),dismissed:b.reduce((a,b)=>a+b.dismissed,0),bySeverity:b})}scanCoverage(a){return Promise.resolve({range:a,providers:j.KqW.options.map(a=>({provider:a,...ce[a]}))})}enforcementActions(a){let b=864e5*j.eI7[a],c=this.now(),d=c-b,e=this.findingsInRange(c-2*b,c),f={blocked:0,redacted:0,warned:0},g={blocked:0,redacted:0,warned:0};for(let a of e){let b=cc[a.actionTaken];b&&(a.occurredAt>=d?f[b]++:g[b]++)}let h=cd.map(a=>({kind:a,count:f[a],delta:f[a]-g[a]}));return Promise.resolve({range:a,total:h.reduce((a,b)=>a+b.count,0),actions:h})}findingsTimeseries(a){let b=cf[a],c=("day"===b?1:7)*864e5,d=j.eI7[a],e="day"===b?d:Math.ceil(d/7),f=this.now(),g=cg(f)-(d-1)*864e5,h=this.findingsInRange(g,f),i=Array.from({length:e},(a,b)=>({timestamp:ch(g+b*c),critical:0,high:0,medium:0,low:0}));for(let a of h){let b=i[Math.floor((a.occurredAt-g)/c)];if(b){var k;("critical"===(k=a.severity)||"high"===k||"medium"===k||"low"===k)&&b[a.severity]++}}return Promise.resolve({range:a,granularity:b,points:i})}mttrTrend(a){let b=cf[a],c=("day"===b?1:7)*864e5,d=j.eI7[a],e="day"===b?d:Math.ceil(d/7),f=this.now(),g=cg(f)-(d-1)*864e5,h=ab(this.db.prepare(`SELECT DISTINCT f.finding_key AS finding_key,
                 COALESCE(f.first_detected_at, e.started_at) AS first_detected_at, d.severity AS severity,
                 latest.status AS latest_status,
                 latest.method AS latest_method,
@@ -780,7 +800,7 @@
          LEFT JOIN ${ba} latest
            ON latest.finding_key = f.finding_key
          WHERE fr.resolved_at >= :windowStart
-           AND e.event_type IN (${j.hfB})`),{windowStart:g}),i=new Map,k=new Map;for(let a of h){if("resolved"!==a.latest_status||"fixed-at-source"!==a.latest_method||null==a.latest_resolved_at||a.latest_resolved_at<g||a.latest_resolved_at>=f)continue;let b=Math.floor((a.latest_resolved_at-g)/c);if(b<0||b>=e)continue;let d=`${String(b)}:${a.severity}`,h=Math.max(0,a.latest_resolved_at-a.first_detected_at);i.set(d,(i.get(d)??0)+h),k.set(d,(k.get(d)??0)+1)}return Promise.resolve({range:a,granularity:b,points:Array.from({length:e},(a,b)=>{let d={};for(let a of ca){let c=`${String(b)}:${a}`,e=k.get(c)??0;d[a]=e>0?(i.get(c)??0)/e:null}return{timestamp:cg(g+b*c),bySeverity:d}})})}topSources(a,b={}){let c=b.limit??5;if("user"===b.kind)return Promise.resolve({range:a,items:[]});let d=this.now(),e=d-864e5*j.eI7[a];return Promise.resolve({range:a,items:ab(this.db.prepare(`SELECT e.repo AS repo, count(*) AS c
+           AND e.event_type IN (${j.hfB})`),{windowStart:g}),i=new Map,k=new Map;for(let a of h){if("resolved"!==a.latest_status||"fixed-at-source"!==a.latest_method||null==a.latest_resolved_at||a.latest_resolved_at<g||a.latest_resolved_at>=f)continue;let b=Math.floor((a.latest_resolved_at-g)/c);if(b<0||b>=e)continue;let d=`${String(b)}:${a.severity}`,h=Math.max(0,a.latest_resolved_at-a.first_detected_at);i.set(d,(i.get(d)??0)+h),k.set(d,(k.get(d)??0)+1)}return Promise.resolve({range:a,granularity:b,points:Array.from({length:e},(a,b)=>{let d={};for(let a of cb){let c=`${String(b)}:${a}`,e=k.get(c)??0;d[a]=e>0?(i.get(c)??0)/e:null}return{timestamp:ch(g+b*c),bySeverity:d}})})}topSources(a,b={}){let c=b.limit??5;if("user"===b.kind)return Promise.resolve({range:a,items:[]});let d=this.now(),e=d-864e5*j.eI7[a];return Promise.resolve({range:a,items:ab(this.db.prepare(`SELECT e.repo AS repo, count(*) AS c
          FROM inspection_findings f
          JOIN audit_events e INDEXED BY idx_audit_capture_rollup ON e.id = f.audit_event_id
          WHERE e.started_at >= :from AND e.started_at < :to
@@ -810,30 +830,27 @@
                 d.severity AS severity,
                 COUNT(*) AS count
          ${b9}
-         GROUP BY d.rule_id, d.category, d.severity`)).map(a=>({ruleId:a.rule_id,category:a.category,severity:a.severity,count:a.count})))}openFindingKeysForRule(a){return Promise.resolve(ab(this.db.prepare(`SELECT DISTINCT f.finding_key AS finding_key
-         ${b9}
-           AND d.rule_id = :ruleId
-           AND f.finding_key IS NOT NULL`),{ruleId:a}).map(a=>a.finding_key))}findingsInRange(a,b){return ab(this.db.prepare(`SELECT e.started_at AS occurred_at, d.severity AS severity, f.action_taken AS action_taken,
+         GROUP BY d.rule_id, d.category, d.severity`)).map(a=>({ruleId:a.rule_id,category:a.category,severity:a.severity,count:a.count})))}openFindingKeysForRule(a){return Promise.resolve(ca(this.db,a))}findingsInRange(a,b){return ab(this.db.prepare(`SELECT e.started_at AS occurred_at, d.severity AS severity, f.action_taken AS action_taken,
                 d.rule_id AS rule_id, d.category AS category
          FROM inspection_findings f
          JOIN audit_events e INDEXED BY idx_audit_capture_rollup ON e.id = f.audit_event_id
          JOIN inspection_definitions d ON d.id = f.inspection_definition_id
          WHERE e.started_at >= :from AND e.started_at < :to
            AND e.event_type IN (${j.hfB})
-         ORDER BY e.started_at`),{from:a,to:b}).map(a=>({occurredAt:a.occurred_at,severity:a.severity,actionTaken:a.action_taken,ruleId:a.rule_id,category:a.category}))}}let ci=["provider","internal","external","ip"],cj="('http', 'ws')",ck=`LEFT JOIN egress_decision_override oh ON oh.host = d.host
-             LEFT JOIN egress_decision_override ol ON ol.destination_id = d.id AND ol.host IS NULL`;function cl(a,b){if(a.length<=5e3)return{hits:[...a],droppedFiles:[],truncated:!1};if("walk"===b)return{hits:a.slice(0,5e3),droppedFiles:[],truncated:!0};let c=new Map;for(let b of a){let a=c.get(b.site.file);void 0===a?c.set(b.site.file,[b]):a.push(b)}let d=[],e=[];for(let[a,b]of c)d.length+b.length>5e3?e.push(a):d.push(...b);return{hits:d,droppedFiles:e,truncated:!0}}function cm(a,b){if("walk"===a.mode||0===b.length)return a;let c=new Set(b);return{mode:"ledger",scannedFiles:a.scannedFiles.filter(a=>!c.has(a)),deletedFiles:a.deletedFiles.filter(a=>!c.has(a))}}function cn(a){return{id:a.id,method:a.method,transport:a.transport,url:a.url,template:a.template,dataClass:a.dataClass,lastSeen:new Date(a.lastSeenMs).toISOString(),callSiteCount:a.callSiteCount}}function co(a,b){let c=b.map(a=>a.transport),d=b.map(a=>a.dataClass),e=b.reduce((a,b)=>a+b.callSiteCount,0),f=b.length>0?Math.max(...b.map(a=>a.lastSeenMs)):a.lastSeenMs;return{id:a.id,kind:a.kind,name:a.name,host:a.host,providerId:a.providerId,category:a.category,trust:a.trust,status:(0,j.Gw9)(a.trust,a.overrideDecision),isCustom:(0,j.y_0)(a.trust,a.overrideDecision),lastSeen:new Date(f).toISOString(),endpointCount:b.length,callSiteCount:e,transports:(0,j.by7)(c),dataClasses:(0,j.hzO)(d),review:(0,j.Fnc)(a.trust,c,null!==a.overrideDecision),network:"provider"===a.kind?null:az(a.networkJson,null),endpoints:b.map(cn)}}class cp{constructor(a){this.db=a}stats(){let a=af(this.db,"SELECT count(*) AS n FROM share_destination"),b=af(this.db,"SELECT count(*) AS n FROM share_endpoint"),c=af(this.db,"SELECT count(*) AS n FROM share_call_site"),d=af(this.db,`SELECT count(DISTINCT destination_id) AS n FROM share_endpoint
-       WHERE transport IN ${cj}`),e=af(this.db,`SELECT count(DISTINCT d.id) AS n
+         ORDER BY e.started_at`),{from:a,to:b}).map(a=>({occurredAt:a.occurred_at,severity:a.severity,actionTaken:a.action_taken,ruleId:a.rule_id,category:a.category}))}}let cj=["provider","internal","external","ip"],ck="('http', 'ws')",cl=`LEFT JOIN egress_decision_override oh ON oh.host = d.host
+             LEFT JOIN egress_decision_override ol ON ol.destination_id = d.id AND ol.host IS NULL`;function cm(a,b){if(a.length<=5e3)return{hits:[...a],droppedFiles:[],truncated:!1};if("walk"===b)return{hits:a.slice(0,5e3),droppedFiles:[],truncated:!0};let c=new Map;for(let b of a){let a=c.get(b.site.file);void 0===a?c.set(b.site.file,[b]):a.push(b)}let d=[],e=[];for(let[a,b]of c)d.length+b.length>5e3?e.push(a):d.push(...b);return{hits:d,droppedFiles:e,truncated:!0}}function cn(a,b){if("walk"===a.mode||0===b.length)return a;let c=new Set(b);return{mode:"ledger",scannedFiles:a.scannedFiles.filter(a=>!c.has(a)),deletedFiles:a.deletedFiles.filter(a=>!c.has(a))}}function co(a){return{id:a.id,method:a.method,transport:a.transport,url:a.url,template:a.template,dataClass:a.dataClass,lastSeen:new Date(a.lastSeenMs).toISOString(),callSiteCount:a.callSiteCount}}function cp(a,b){let c=b.map(a=>a.transport),d=b.map(a=>a.dataClass),e=b.reduce((a,b)=>a+b.callSiteCount,0),f=b.length>0?Math.max(...b.map(a=>a.lastSeenMs)):a.lastSeenMs;return{id:a.id,kind:a.kind,name:a.name,host:a.host,providerId:a.providerId,category:a.category,trust:a.trust,status:(0,j.Gw9)(a.trust,a.overrideDecision),isCustom:(0,j.y_0)(a.trust,a.overrideDecision),lastSeen:new Date(f).toISOString(),endpointCount:b.length,callSiteCount:e,transports:(0,j.by7)(c),dataClasses:(0,j.hzO)(d),review:(0,j.Fnc)(a.trust,c,null!==a.overrideDecision),network:"provider"===a.kind?null:az(a.networkJson,null),endpoints:b.map(co)}}class cq{constructor(a){this.db=a}stats(){let a=af(this.db,"SELECT count(*) AS n FROM share_destination"),b=af(this.db,"SELECT count(*) AS n FROM share_endpoint"),c=af(this.db,"SELECT count(*) AS n FROM share_call_site"),d=af(this.db,`SELECT count(DISTINCT destination_id) AS n FROM share_endpoint
+       WHERE transport IN ${ck}`),e=af(this.db,`SELECT count(DISTINCT d.id) AS n
        FROM share_destination d
        LEFT JOIN share_endpoint e ON e.destination_id = d.id
-         AND e.transport IN ${cj}
+         AND e.transport IN ${ck}
        WHERE (d.trust IN ('unverified', 'ip') OR e.id IS NOT NULL)
          AND NOT EXISTS (
            SELECT 1 FROM egress_decision_override o
            WHERE o.host = d.host OR (o.destination_id = d.id AND o.host IS NULL)
-         )`),f=ag(this.db,"SELECT kind AS k, count(*) AS n FROM share_destination GROUP BY kind"),g={provider:f.get("provider")??0,internal:f.get("internal")??0,external:f.get("external")??0,ip:f.get("ip")??0},h=ag(this.db,"SELECT trust AS k, count(*) AS n FROM share_destination GROUP BY trust");return Promise.resolve({destinations:a,endpoints:b,callSites:c,needsReview:e,insecure:d,byKind:g,byTrust:{recognized:h.get("recognized")??0,internal:h.get("internal")??0,unverified:h.get("unverified")??0,ip:h.get("ip")??0}})}listDestinations(a){let b=void 0===a.q||""===a.q?void 0:a.q,c=this.fetchDestinations(b,a.kind),d=this.groupEndpoints(c.map(a=>a.id)),e=c.map(a=>co(a,d.get(a.id)??[])),f=new Map;for(let a of e){let b=f.get(a.kind);b?b.push(a):f.set(a.kind,[a])}return Promise.resolve({groups:ci.filter(a=>f.has(a)).map(a=>{let b=f.get(a)??[];return{kind:a,total:b.length,items:b}})})}needsReview(){let a=this.fetchDestinations(void 0,void 0,!0),b=this.groupEndpoints(a.map(a=>a.id));return Promise.resolve({items:a.map(a=>({dest:a,endpoints:b.get(a.id)??[]})).map(({dest:a,endpoints:b})=>({summary:co(a,b),endpoints:b})).filter(({summary:a})=>a.review.needsReview).map(({summary:a,endpoints:b})=>({id:a.id,kind:a.kind,name:a.name,host:a.host,providerId:a.providerId,trust:a.trust,status:a.status,review:a.review,topDataClass:(0,j.C05)(b.map(a=>a.dataClass)),callSiteCount:a.callSiteCount,lastSeen:a.lastSeen})).sort((a,b)=>{let c=(0,j.WSs)(a.review.reasons)-(0,j.WSs)(b.review.reasons);return 0!==c?c:b.lastSeen.localeCompare(a.lastSeen)})})}getDestination(a){let b=this.fetchDestinationById(a);if(!b)return Promise.resolve(null);let c=this.fetchEndpoints([b.id]),d=this.fetchCallSites(c.map(a=>a.id));return Promise.resolve(function(a,b,c){let d=b.map(a=>a.transport),e=b.length>0?Math.max(...b.map(a=>a.lastSeenMs)):a.lastSeenMs,f=new Map;for(let a of c.slice(0,200)){let b={id:a.id,project:a.project,file:a.file,line:a.line,snippet:a.snippet,dynamic:a.dynamic,vendored:a.vendored,projectId:a.projectId},c=f.get(a.endpointId);c?c.push(b):f.set(a.endpointId,[b])}return{id:a.id,kind:a.kind,name:a.name,host:a.host,providerId:a.providerId,category:a.category,trust:a.trust,status:(0,j.Gw9)(a.trust,a.overrideDecision),isCustom:(0,j.y_0)(a.trust,a.overrideDecision),lastSeen:new Date(e).toISOString(),transports:(0,j.by7)(d),dataClasses:(0,j.hzO)(b.map(a=>a.dataClass)),review:(0,j.Fnc)(a.trust,d,null!==a.overrideDecision),network:"provider"===a.kind?null:az(a.networkJson,null),note:a.note,endpoints:b.map(a=>({...cn(a),sites:f.get(a.id)??[]}))}}(b,c,d))}setEgressDecision(a,b){let c=!1;return X(this.db,()=>{let d=this.db.prepare("SELECT host FROM share_destination WHERE id = ?").get(a);void 0!==d&&(c=!0,this.db.prepare(`DELETE FROM egress_decision_override
+         )`),f=ag(this.db,"SELECT kind AS k, count(*) AS n FROM share_destination GROUP BY kind"),g={provider:f.get("provider")??0,internal:f.get("internal")??0,external:f.get("external")??0,ip:f.get("ip")??0},h=ag(this.db,"SELECT trust AS k, count(*) AS n FROM share_destination GROUP BY trust");return Promise.resolve({destinations:a,endpoints:b,callSites:c,needsReview:e,insecure:d,byKind:g,byTrust:{recognized:h.get("recognized")??0,internal:h.get("internal")??0,unverified:h.get("unverified")??0,ip:h.get("ip")??0}})}listDestinations(a){let b=void 0===a.q||""===a.q?void 0:a.q,c=this.fetchDestinations(b,a.kind),d=this.groupEndpoints(c.map(a=>a.id)),e=c.map(a=>cp(a,d.get(a.id)??[])),f=new Map;for(let a of e){let b=f.get(a.kind);b?b.push(a):f.set(a.kind,[a])}return Promise.resolve({groups:cj.filter(a=>f.has(a)).map(a=>{let b=f.get(a)??[];return{kind:a,total:b.length,items:b}})})}needsReview(){let a=this.fetchDestinations(void 0,void 0,!0),b=this.groupEndpoints(a.map(a=>a.id));return Promise.resolve({items:a.map(a=>({dest:a,endpoints:b.get(a.id)??[]})).map(({dest:a,endpoints:b})=>({summary:cp(a,b),endpoints:b})).filter(({summary:a})=>a.review.needsReview).map(({summary:a,endpoints:b})=>({id:a.id,kind:a.kind,name:a.name,host:a.host,providerId:a.providerId,trust:a.trust,status:a.status,review:a.review,topDataClass:(0,j.C05)(b.map(a=>a.dataClass)),callSiteCount:a.callSiteCount,lastSeen:a.lastSeen})).sort((a,b)=>{let c=(0,j.WSs)(a.review.reasons)-(0,j.WSs)(b.review.reasons);return 0!==c?c:b.lastSeen.localeCompare(a.lastSeen)})})}getDestination(a){let b=this.fetchDestinationById(a);if(!b)return Promise.resolve(null);let c=this.fetchEndpoints([b.id]),d=this.fetchCallSites(c.map(a=>a.id));return Promise.resolve(function(a,b,c){let d=b.map(a=>a.transport),e=b.length>0?Math.max(...b.map(a=>a.lastSeenMs)):a.lastSeenMs,f=new Map;for(let a of c.slice(0,200)){let b={id:a.id,project:a.project,file:a.file,line:a.line,snippet:a.snippet,dynamic:a.dynamic,vendored:a.vendored,projectId:a.projectId},c=f.get(a.endpointId);c?c.push(b):f.set(a.endpointId,[b])}return{id:a.id,kind:a.kind,name:a.name,host:a.host,providerId:a.providerId,category:a.category,trust:a.trust,status:(0,j.Gw9)(a.trust,a.overrideDecision),isCustom:(0,j.y_0)(a.trust,a.overrideDecision),lastSeen:new Date(e).toISOString(),transports:(0,j.by7)(d),dataClasses:(0,j.hzO)(b.map(a=>a.dataClass)),review:(0,j.Fnc)(a.trust,d,null!==a.overrideDecision),network:"provider"===a.kind?null:az(a.networkJson,null),note:a.note,endpoints:b.map(a=>({...co(a),sites:f.get(a.id)??[]}))}}(b,c,d))}setEgressDecision(a,b){let c=!1;return X(this.db,()=>{let d=this.db.prepare("SELECT host FROM share_destination WHERE id = ?").get(a);void 0!==d&&(c=!0,this.db.prepare(`DELETE FROM egress_decision_override
              WHERE host = :host OR (destination_id = :destinationId AND host IS NULL)`).run({host:d.host,destinationId:a}),null!==b&&this.db.prepare(`INSERT INTO egress_decision_override
                (id, destination_id, host, decision, created_at, updated_at)
-             VALUES (:id, :destinationId, :host, :decision, :now, :now)`).run({id:(0,F.randomUUID)(),destinationId:a,host:d.host,decision:b,now:Date.now()}))},"IMMEDIATE"),c}recordProjectEgress(a){let{hits:b,droppedFiles:c,truncated:d}=cl(a.hits,a.reconcile.mode),e=cm(a.reconcile,c),f=Date.now(),g={destinations:0,endpoints:0,callSites:0,truncated:d,droppedFiles:c};return X(this.db,()=>{let h=a.projectId??this.knownProjectId(a.projectKey);this.reconcileCallSites(a.projectKey,e),this.upsertHits(a,b,h,f),this.confirmLastSeen(a.projectKey,f),this.pruneOrphans(),g={...this.projectTotals(a.projectKey),truncated:d,droppedFiles:c}},"IMMEDIATE"),g}reconcileCallSites(a,b){if("walk"===b.mode){let c=b.walkedPrefix.replace(/\/+$/,"");this.db.prepare(`DELETE FROM share_call_site
+             VALUES (:id, :destinationId, :host, :decision, :now, :now)`).run({id:(0,F.randomUUID)(),destinationId:a,host:d.host,decision:b,now:Date.now()}))},"IMMEDIATE"),c}recordProjectEgress(a){let{hits:b,droppedFiles:c,truncated:d}=cm(a.hits,a.reconcile.mode),e=cn(a.reconcile,c),f=Date.now(),g={destinations:0,endpoints:0,callSites:0,truncated:d,droppedFiles:c};return X(this.db,()=>{let h=a.projectId??this.knownProjectId(a.projectKey);this.reconcileCallSites(a.projectKey,e),this.upsertHits(a,b,h,f),this.confirmLastSeen(a.projectKey,f),this.pruneOrphans(),g={...this.projectTotals(a.projectKey),truncated:d,droppedFiles:c}},"IMMEDIATE"),g}reconcileCallSites(a,b){if("walk"===b.mode){let c=b.walkedPrefix.replace(/\/+$/,"");this.db.prepare(`DELETE FROM share_call_site
            WHERE project_key = :key
              AND (:prefix = '' OR file = :prefix OR file LIKE :subtree ESCAPE '\\')
              AND file NOT LIKE '.%'
@@ -894,22 +911,22 @@
                   COALESCE(oh.decision, ol.decision) AS overrideDecision`,f=[],g=[];if(b&&b.length>0&&(f.push(`d.kind IN (${T(b.length)})`),g.push(...b)),c&&f.push(`(d.trust IN ('unverified', 'ip')
           OR EXISTS (SELECT 1 FROM share_endpoint re
                      WHERE re.destination_id = d.id
-                       AND re.transport IN ${cj}))`),a){let b=U(a);f.push(`(d.name LIKE ? ESCAPE '\\' OR d.category LIKE ? ESCAPE '\\' OR e.url LIKE ? ESCAPE '\\'
+                       AND re.transport IN ${ck}))`),a){let b=U(a);f.push(`(d.name LIKE ? ESCAPE '\\' OR d.category LIKE ? ESCAPE '\\' OR e.url LIKE ? ESCAPE '\\'
           OR c.project LIKE ? ESCAPE '\\' OR c.file LIKE ? ESCAPE '\\')`),g.push(b,b,b,b,b),d=`SELECT DISTINCT ${e}
              FROM share_destination d
-             ${ck}
+             ${cl}
              LEFT JOIN share_endpoint e ON e.destination_id = d.id
              LEFT JOIN share_call_site c ON c.endpoint_id = e.id
              ${f.length?`WHERE ${f.join(" AND ")}`:""}
              ORDER BY d.created_at ASC, d.id ASC`}else d=`SELECT ${e}
              FROM share_destination d
-             ${ck}
+             ${cl}
              ${f.length?`WHERE ${f.join(" AND ")}`:""}
              ORDER BY d.created_at ASC, d.id ASC`;return ab(this.db.prepare(d),g).map(a=>this.mapDestRow(a))}fetchDestinationById(a){let b=ac(this.db.prepare(`SELECT d.id, d.kind, d.name, d.host, d.provider_id AS providerId, d.category, d.trust,
                 d.note, d.network_json AS networkJson, d.last_seen AS lastSeenMs,
                 COALESCE(oh.decision, ol.decision) AS overrideDecision
          FROM share_destination d
-         ${ck}
+         ${cl}
          WHERE d.id = ?`),[a]);return b?this.mapDestRow(b):null}fetchEndpoints(a){return 0===a.length?[]:ab(this.db.prepare(`SELECT e.id, e.destination_id AS destinationId, e.method, e.transport, e.url,
                 e.template, e.data_class AS dataClass, e.last_seen AS lastSeenMs,
                 count(c.id) AS callSiteCount
@@ -921,7 +938,7 @@
                 project_id AS projectId
          FROM share_call_site
          WHERE endpoint_id IN (${T(a.length)})
-         ORDER BY created_at ASC, id ASC`),a).map(a=>({id:a.id,endpointId:a.endpointId,project:a.project,file:a.file,line:a.line,snippet:a.snippet,dynamic:1===a.dynamic,vendored:1===a.vendored,projectId:a.projectId}))}}class cq{constructor(a){this.db=a,this.upsertStmt=a.prepare(`INSERT INTO source_project
+         ORDER BY created_at ASC, id ASC`),a).map(a=>({id:a.id,endpointId:a.endpointId,project:a.project,file:a.file,line:a.line,snippet:a.snippet,dynamic:1===a.dynamic,vendored:1===a.vendored,projectId:a.projectId}))}}class cr{constructor(a){this.db=a,this.upsertStmt=a.prepare(`INSERT INTO source_project
          (id, url, name, attributes, first_seen, last_seen)
        VALUES
          (:id, :url, :name, :attributes, :firstSeen, :lastSeen)
@@ -931,7 +948,7 @@
          attributes = excluded.attributes,
          last_seen = excluded.last_seen`)}upsert(a,b=Date.now()){let c=I(a.url),d=(0,j.QCA)(a,c,b);return this.upsertStmt.run(ae({id:d.id,url:d.url,name:d.name,attributes:d.attributes,firstSeen:d.firstSeen,lastSeen:d.lastSeen})),c}findById(a){return ac(this.db.prepare("SELECT * FROM source_project WHERE id = :id"),{id:a})}distinctNames(){return ab(this.db.prepare(`SELECT DISTINCT name FROM source_project
          WHERE name IS NOT NULL
-         ORDER BY name`)).map(a=>a.name)}}class cr extends Error{constructor(a,b){super(`[aka] the local store was written by a newer AKA build than this one: it carries migration(s) ${a.unknownTags.join(", ")} that this build does not define (store schema ${String(a.storeVersion)}, this build ${String(a.buildVersion)}). The store is intact and needs no repair — update AKA so every surface on this machine is on one version line.`,{cause:b}),this.name="StoreAheadOfBuildError",this.storeVersion=a.storeVersion,this.buildVersion=a.buildVersion,this.unknownTags=a.unknownTags}}let cs=new Set(j.ZYZ.options),ct=Symbol("aka.persistence.unsafeTestOnlyRawHandle");function cu(a,b){return b?{...a,hostId:b}:a}function cv(a){try{a.close()}catch{}}function cw(a){let b=new G.DatabaseSync(a);try{b.exec("PRAGMA journal_mode = WAL"),b.exec("PRAGMA busy_timeout = 2000"),b.exec("PRAGMA foreign_keys = ON"),b.function("aka_lower",{deterministic:!0,directOnly:!0,useBigIntArguments:!0},R)}catch(a){throw cv(b),a}return b}let cx=new Set(j.vog);function cy(a,b={}){p(a);let c=(0,e.join)(a,l);O(c);let{db:f,events:g,findings:h,policies:i,installedPacks:k,scanLedger:m,historySync:n,bodyRetention:o,secretVault:r,exceptions:t,resolutions:u,ruleProbeCache:v,security:w,detections:x,shares:y,policyCatalog:z,inventory:A,inventoryAssets:B,projectFiles:C,activity:D,sourceProject:E,auditEvents:G,captureStatus:L,classifiedData:M,inspectionDefinitions:N,inspectionFindings:Q,configInventory:R}=function(a,b,c){let e=cw(a);try{var f;if(f=e,$(f,"table","tenants")||aa(f,"events").includes("tenant_id")){let b=function(a,b){let c;O(b);let e=K(b,"legacy"),f=!1;try{P(a,e),f=!0}catch(a){c=a}finally{a.close()}if(!f){Z(`Could not snapshot the incompatible ${l} (${String(c)}); moving the store aside with its sidecars instead.`);let a=[];(0,d.renameSync)(b,e),a.push([e,b]);try{for(let c of q(b)){let f=`${e}${c.slice(b.length)}`;try{(0,d.renameSync)(c,f),a.push([f,c])}catch{(0,d.rmSync)(c,{force:!0})}}}catch(b){for(let[b,c]of a.reverse())try{(0,d.renameSync)(b,c)}catch{}throw b}return s(e),e}try{for(let a of((0,d.rmSync)(b,{force:!0}),q(b)))(0,d.rmSync)(a,{force:!0})}catch(a){if((0,d.existsSync)(b))try{(0,d.rmSync)(e,{force:!0})}catch{}throw a}return e}(e,a);e=cw(a),Z(`Detected an older, incompatible (tenant-bearing) ${l}; backed it up to ${b} and created a fresh store.`)}!function(a,b,c={}){var d,e;let f=a.prepare("PRAGMA user_version").get().user_version;a.exec("CREATE TABLE IF NOT EXISTS migration_ledger (tag TEXT PRIMARY KEY, applied_at INTEGER NOT NULL)");let g=new Set(a.prepare("SELECT tag FROM migration_ledger").all().map(a=>a.tag)),h=0===g.size&&f>0,i=a.prepare("INSERT OR IGNORE INTO migration_ledger (tag, applied_at) VALUES (?, ?)");for(let[b,d]of j.lFU.entries()){if(g.has(d.tag)||c.skipTags?.has(d.tag)===!0||d.tag===av)continue;let e=function(a){let b=[];for(let c of a.matchAll(/CREATE TABLE (?:IF NOT EXISTS )?`([^`]+)`/g))void 0===c[1]||c[1].startsWith("__new_")||b.push({kind:"table",name:c[1]});for(let c of a.matchAll(/ALTER TABLE `([^`]+)` ADD (?:COLUMN )?`([^`]+)`/g))void 0!==c[1]&&void 0!==c[2]&&b.push({kind:"column",table:c[1],name:c[2]});return b}(d.sql),j=e.filter(b=>"column"===b.kind?aa(a,b.table,{includeGenerated:!0}).includes(b.name):$(a,"table",b.name));if(j.length>0&&j.length<e.length){let a=e.filter(a=>!j.includes(a)),b=`sqlite migration ${d.tag} has no ledger row, but the store already has ${j.map(at).join(", ")} while missing ${a.map(at).join(", ")} — the schema diverged from the migration history; refusing to replay or skip.`;throw Z(b),Error(`[aka] ${b}`)}let k=e.length>0?j.length===e.length:h&&b<f,l=/PRAGMA foreign_keys\s*=\s*OFF/i.test(d.sql),m=au(d.sql);l&&a.exec("PRAGMA foreign_keys = OFF");try{X(a,()=>{for(let b of m){let c=function(a){let b=a.replace(/^(?:\s*--[^\n]*\n?)+/,"").trimStart();return/^CREATE (?:UNIQUE )?INDEX (?:IF NOT EXISTS )?`([^`]+)`/.exec(b)?.[1]}(b);if(void 0===c){if(k)continue}else if(_(a,c))continue;a.exec(b)}if(l&&!k){let b=a.prepare("PRAGMA foreign_key_check").all();if(b.length>0)throw Error(`[aka] sqlite migration ${d.tag} left ${String(b.length)} foreign-key violation(s); rolling back.`)}i.run(d.tag,Date.now())},"IMMEDIATE")}finally{l&&a.exec("PRAGMA foreign_keys = ON")}}f<j.lFU.length&&a.exec(`PRAGMA user_version = ${String(j.lFU.length)}`),function(a,b){var c;if(!$(a,"table",b))return;let d=aa(a,b);d.includes("synced_at")||a.exec(`ALTER TABLE ${b} ADD COLUMN synced_at integer`),d.includes("sync_claimed_at")||a.exec(`ALTER TABLE ${b} ADD COLUMN sync_claimed_at integer`),d.includes("outbox_owed")||a.exec(`ALTER TABLE ${b} ADD COLUMN outbox_owed integer`),d.includes("sync_failed_at")||a.exec(`ALTER TABLE ${b} ADD COLUMN sync_failed_at integer`),d.includes("sync_failure")||X(a,()=>{a.exec(`ALTER TABLE ${b} ADD COLUMN sync_failure text`),a.exec(`UPDATE ${b} SET synced_at = NULL
+         ORDER BY name`)).map(a=>a.name)}}class cs extends Error{constructor(a,b){super(`[aka] the local store was written by a newer AKA build than this one: it carries migration(s) ${a.unknownTags.join(", ")} that this build does not define (store schema ${String(a.storeVersion)}, this build ${String(a.buildVersion)}). The store is intact and needs no repair — update AKA so every surface on this machine is on one version line.`,{cause:b}),this.name="StoreAheadOfBuildError",this.storeVersion=a.storeVersion,this.buildVersion=a.buildVersion,this.unknownTags=a.unknownTags}}let ct=new Set(j.ZYZ.options),cu=Symbol("aka.persistence.unsafeTestOnlyRawHandle");function cv(a,b){return b?{...a,hostId:b}:a}function cw(a){try{a.close()}catch{}}function cx(a){let b=new G.DatabaseSync(a);try{b.exec("PRAGMA journal_mode = WAL"),b.exec("PRAGMA busy_timeout = 2000"),b.exec("PRAGMA foreign_keys = ON"),b.function("aka_lower",{deterministic:!0,directOnly:!0,useBigIntArguments:!0},R)}catch(a){throw cw(b),a}return b}let cy=new Set(j.vog);function cz(a,b={}){p(a);let c=(0,e.join)(a,l);O(c);let{db:f,events:g,findings:h,policies:i,installedPacks:k,scanLedger:m,historySync:n,bodyRetention:o,secretVault:r,exceptions:t,resolutions:u,ruleProbeCache:v,security:w,detections:x,shares:y,policyCatalog:z,inventory:A,inventoryAssets:B,projectFiles:C,activity:D,sourceProject:E,auditEvents:G,captureStatus:L,classifiedData:M,inspectionDefinitions:N,inspectionFindings:Q,configInventory:R}=function(a,b,c){let e=cx(a);try{var f;if(f=e,$(f,"table","tenants")||aa(f,"events").includes("tenant_id")){let b=function(a,b){let c;O(b);let e=K(b,"legacy"),f=!1;try{P(a,e),f=!0}catch(a){c=a}finally{a.close()}if(!f){Z(`Could not snapshot the incompatible ${l} (${String(c)}); moving the store aside with its sidecars instead.`);let a=[];(0,d.renameSync)(b,e),a.push([e,b]);try{for(let c of q(b)){let f=`${e}${c.slice(b.length)}`;try{(0,d.renameSync)(c,f),a.push([f,c])}catch{(0,d.rmSync)(c,{force:!0})}}}catch(b){for(let[b,c]of a.reverse())try{(0,d.renameSync)(b,c)}catch{}throw b}return s(e),e}try{for(let a of((0,d.rmSync)(b,{force:!0}),q(b)))(0,d.rmSync)(a,{force:!0})}catch(a){if((0,d.existsSync)(b))try{(0,d.rmSync)(e,{force:!0})}catch{}throw a}return e}(e,a);e=cx(a),Z(`Detected an older, incompatible (tenant-bearing) ${l}; backed it up to ${b} and created a fresh store.`)}!function(a,b,c={}){var d,e;let f=a.prepare("PRAGMA user_version").get().user_version;a.exec("CREATE TABLE IF NOT EXISTS migration_ledger (tag TEXT PRIMARY KEY, applied_at INTEGER NOT NULL)");let g=new Set(a.prepare("SELECT tag FROM migration_ledger").all().map(a=>a.tag)),h=0===g.size&&f>0,i=a.prepare("INSERT OR IGNORE INTO migration_ledger (tag, applied_at) VALUES (?, ?)");for(let[b,d]of j.lFU.entries()){if(g.has(d.tag)||c.skipTags?.has(d.tag)===!0||d.tag===av)continue;let e=function(a){let b=[];for(let c of a.matchAll(/CREATE TABLE (?:IF NOT EXISTS )?`([^`]+)`/g))void 0===c[1]||c[1].startsWith("__new_")||b.push({kind:"table",name:c[1]});for(let c of a.matchAll(/ALTER TABLE `([^`]+)` ADD (?:COLUMN )?`([^`]+)`/g))void 0!==c[1]&&void 0!==c[2]&&b.push({kind:"column",table:c[1],name:c[2]});return b}(d.sql),j=e.filter(b=>"column"===b.kind?aa(a,b.table,{includeGenerated:!0}).includes(b.name):$(a,"table",b.name));if(j.length>0&&j.length<e.length){let a=e.filter(a=>!j.includes(a)),b=`sqlite migration ${d.tag} has no ledger row, but the store already has ${j.map(at).join(", ")} while missing ${a.map(at).join(", ")} — the schema diverged from the migration history; refusing to replay or skip.`;throw Z(b),Error(`[aka] ${b}`)}let k=e.length>0?j.length===e.length:h&&b<f,l=/PRAGMA foreign_keys\s*=\s*OFF/i.test(d.sql),m=au(d.sql);l&&a.exec("PRAGMA foreign_keys = OFF");try{X(a,()=>{for(let b of m){let c=function(a){let b=a.replace(/^(?:\s*--[^\n]*\n?)+/,"").trimStart();return/^CREATE (?:UNIQUE )?INDEX (?:IF NOT EXISTS )?`([^`]+)`/.exec(b)?.[1]}(b);if(void 0===c){if(k)continue}else if(_(a,c))continue;a.exec(b)}if(l&&!k){let b=a.prepare("PRAGMA foreign_key_check").all();if(b.length>0)throw Error(`[aka] sqlite migration ${d.tag} left ${String(b.length)} foreign-key violation(s); rolling back.`)}i.run(d.tag,Date.now())},"IMMEDIATE")}finally{l&&a.exec("PRAGMA foreign_keys = ON")}}f<j.lFU.length&&a.exec(`PRAGMA user_version = ${String(j.lFU.length)}`),function(a,b){var c;if(!$(a,"table",b))return;let d=aa(a,b);d.includes("synced_at")||a.exec(`ALTER TABLE ${b} ADD COLUMN synced_at integer`),d.includes("sync_claimed_at")||a.exec(`ALTER TABLE ${b} ADD COLUMN sync_claimed_at integer`),d.includes("outbox_owed")||a.exec(`ALTER TABLE ${b} ADD COLUMN outbox_owed integer`),d.includes("sync_failed_at")||a.exec(`ALTER TABLE ${b} ADD COLUMN sync_failed_at integer`),d.includes("sync_failure")||X(a,()=>{a.exec(`ALTER TABLE ${b} ADD COLUMN sync_failure text`),a.exec(`UPDATE ${b} SET synced_at = NULL
             WHERE synced_at = -1
               AND event_type IN (${am.map(a=>`'${a}'`).join(", ")})`)},"IMMEDIATE"),a.exec(`CREATE TRIGGER IF NOT EXISTS aka_sync_failure_guard
        BEFORE UPDATE OF sync_failure ON ${b}
@@ -1007,7 +1024,7 @@ BEGIN SELECT RAISE(IGNORE); END`),function(a){if(!$(a,"table","audit_events"))re
          WHEN first_detected_at IS NULL THEN excluded.first_detected_at
          WHEN excluded.first_detected_at IS NULL THEN first_detected_at
          ELSE min(first_detected_at, excluded.first_detected_at)
-       END`);return ay(a,"findings",b,a=>{let b=new Map;for(let e of a){let a=JSON.stringify([e.ruleId,e.category,e.severity]),f=b.get(a);if(void 0===f){let d=`unmigrated/${e.category}/${e.severity}`;f=J(e.ruleId,d),c.run(ae({id:f,ruleId:e.ruleId,name:e.ruleId,category:e.category,severity:e.severity,definition:"",version:d})),b.set(a,f)}d.run(ae({id:e.id,auditEventId:e.eventId,inspectionDefinitionId:f,spanStart:e.spanStart,spanEnd:e.spanEnd,maskedMatch:e.maskedMatch,actionTaken:e.actionTaken,confidence:e.confidence,findingKey:e.findingKey,firstDetectedAt:e.firstDetectedAt}))}})}catch(a){return Z(`legacy history backfill failed: ${String(a)}`),!1}}(a)&&function(a,b){let c=j.lFU.find(a=>a.tag===av);if(!c)return;let d=void 0===b?void 0:aw(a);if(void 0!==b&&d?.holdsRows===!0)try{var e=a,f=b;O(f);let c=K(f,"pre-drop");P(e,c)}catch(a){Z(`legacy events/findings backup failed; deferring the drop: ${String(a)}`);return}try{X(a,()=>{if(!a.prepare("SELECT 1 FROM migration_ledger WHERE tag = ?").get(c.tag)){if(void 0!==d&&aw(a).mark!==d.mark)return void Z("legacy events/findings rows changed after the pre-drop snapshot decision; deferring the drop so the next open can copy them first.");for(let b of au(c.sql))a.exec(b);a.prepare("INSERT OR IGNORE INTO migration_ledger (tag, applied_at) VALUES (?, ?)").run(c.tag,Date.now())}},"IMMEDIATE")}catch(a){Z(`legacy events/findings drop failed; deferring: ${String(a)}`)}}(a,b)}(e,a,{skipTags:c}),s(a);let g=new bZ(e),h=new bF(e,b),i={events:new a1(e),findings:new be(e),policies:g,installedPacks:h,scanLedger:new b2(e),historySync:new ar(e),secretVault:new b8(e),exceptions:new a7(e),resolutions:new b0(e),ruleProbeCache:new b1(e),bodyRetention:new aU(e),security:new ch(e),detections:new a0(e),shares:new cp(e),policyCatalog:new b$(h),inventory:new bG(e),inventoryAssets:new bY(e),projectFiles:new b_(e),activity:new aS(e),sourceProject:new cq(e),auditEvents:new aT(e),captureStatus:new aV(e),classifiedData:new aW(e),inspectionDefinitions:new bf(e),inspectionFindings:new bg(e),configInventory:new aY(e)};return g.seedDefaults(),{db:e,...i}}catch(b){let a=function(a){try{let b=new Set(j.lFU.map(a=>a.tag)),c=a.prepare("SELECT tag FROM migration_ledger").all().map(a=>a.tag).filter(a=>!b.has(a)).sort();if(0===c.length)return null;return{storeVersion:a.prepare("PRAGMA user_version").get().user_version,buildVersion:j.lFU.length,unknownTags:c}}catch{return null}}(e);throw cv(e),null!==a&&function(a){let b=a?.errcode;if("number"!=typeof b)return!1;let c=255&b;return 1===c||19===c}(b)?new cr(a,b):b}}(c,(0,e.dirname)(a),!0===b.applyDeferredMigrations?void 0:cx);function T(a){return function(a,b,c=null){return H((0,j.tTV)(["capture",a??"no_session",b,c??"no_path"]))}(a.metadata?.sessionId??null,a.contentHash,a.metadata?.filePath??null)}return{events:g,findings:h,policies:i,installedPacks:k,scanLedger:m,historySync:n,bodyRetention:o,secretVault:r,exceptions:t,resolutions:u,ruleProbeCache:v,security:w,detections:x,shares:y,policyCatalog:z,inventory:A,inventoryAssets:B,activity:D,sourceProject:E,auditEvents:G,captureStatus:L,classifiedData:M,inspectionDefinitions:N,inspectionFindings:Q,recordCapture:function(a,b){Y(f,()=>{let c=a.metadata?.sessionId;c&&G.ensureSessionRoot(c,a.occurredAt);let d=T(a);G.insertAuditEvent({id:d,eventType:a.kind,startedAt:a.occurredAt,parentId:c,rootSessionId:c,content:a.content,contentHash:a.contentHash,attributes:(0,j.$w9)(a)});let e=new Map;for(let a of b){if(c&&Q.isSessionDuplicate(a.ruleId,a.maskedMatch,c)||Q.isEventDuplicate(d,a.ruleId,a.maskedMatch,a.span.start,a.span.end))continue;let b=`${a.ruleId}@${(0,j.qmP)(a)}`,f=e.get(b);f||(f=N.upsert((0,j.jTf)(a)),e.set(b,f)),Q.insertFinding({id:a.id,auditEventId:d,inspectionDefinitionId:f,span:a.span,maskedMatch:a.maskedMatch,actionTaken:a.actionTaken,confidence:a.confidence,findingKey:a.findingKey??void 0})}})},markCaptureDelivered:function(a,b){Y(f,()=>{n.markSynced([T(a)],b)})},markCaptureOwed:function(a){Y(f,()=>{n.markCaptureOwed(T(a))})},markAuditEventsDelivered:function(a,b){let c=a.filter(a=>!cs.has(a.eventType));0!==c.length&&Y(f,()=>{n.markSynced(c.map(a=>a.id),b)})},ensureInventory:function(a){let b={};return Y(f,()=>{let c=Date.now();a.host&&(b.hostId=A.upsert(a.host,c)),a.harness&&(b.harnessId=A.upsert(cu(a.harness,b.hostId),c)),b.accountId=A.upsert(cu({objectType:"user",identityKey:"local",attributes:{source:"local"}},b.hostId),c),a.project&&(b.sourceProjectId=E.upsert(a.project,c))})?b:{}},recordConfigScan:function(a){Y(f,()=>{let b=(0,j.I8t)(a.scanEvent.startedAt);for(let c of a.items)A.upsert(c,b);G.insertAuditEvent(a.scanEvent);let c=new Map;for(let b of a.definitions??[])c.set(`${b.ruleId}@${b.version}`,N.upsert(b));for(let b of a.findings??[]){let d=c.get(`${b.ruleId}@${b.version}`);d&&Q.insertFinding({id:(0,F.randomUUID)(),auditEventId:a.scanEvent.id,inspectionDefinitionId:d,span:b.span,maskedMatch:b.maskedMatch,actionTaken:b.actionTaken,confidence:b.confidence})}})},recordProjectFiles:function(a,b){0!==b.files.length&&Y(f,()=>{C.replaceForProject(a,b,Date.now())})},reconcileWorktreeProjects:function(a,b,c){try{let d=b.split(e.sep).join("/"),g=c.split(e.sep).join("/"),h=c===b?"":"url IN (:worktreePosix, :worktreeWin) OR ",i=f.prepare(`SELECT id FROM source_project
+       END`);return ay(a,"findings",b,a=>{let b=new Map;for(let e of a){let a=JSON.stringify([e.ruleId,e.category,e.severity]),f=b.get(a);if(void 0===f){let d=`unmigrated/${e.category}/${e.severity}`;f=J(e.ruleId,d),c.run(ae({id:f,ruleId:e.ruleId,name:e.ruleId,category:e.category,severity:e.severity,definition:"",version:d})),b.set(a,f)}d.run(ae({id:e.id,auditEventId:e.eventId,inspectionDefinitionId:f,spanStart:e.spanStart,spanEnd:e.spanEnd,maskedMatch:e.maskedMatch,actionTaken:e.actionTaken,confidence:e.confidence,findingKey:e.findingKey,firstDetectedAt:e.firstDetectedAt}))}})}catch(a){return Z(`legacy history backfill failed: ${String(a)}`),!1}}(a)&&function(a,b){let c=j.lFU.find(a=>a.tag===av);if(!c)return;let d=void 0===b?void 0:aw(a);if(void 0!==b&&d?.holdsRows===!0)try{var e=a,f=b;O(f);let c=K(f,"pre-drop");P(e,c)}catch(a){Z(`legacy events/findings backup failed; deferring the drop: ${String(a)}`);return}try{X(a,()=>{if(!a.prepare("SELECT 1 FROM migration_ledger WHERE tag = ?").get(c.tag)){if(void 0!==d&&aw(a).mark!==d.mark)return void Z("legacy events/findings rows changed after the pre-drop snapshot decision; deferring the drop so the next open can copy them first.");for(let b of au(c.sql))a.exec(b);a.prepare("INSERT OR IGNORE INTO migration_ledger (tag, applied_at) VALUES (?, ?)").run(c.tag,Date.now())}},"IMMEDIATE")}catch(a){Z(`legacy events/findings drop failed; deferring: ${String(a)}`)}}(a,b)}(e,a,{skipTags:c}),s(a);let g=new bZ(e),h=new bF(e,b),i={events:new a1(e),findings:new be(e),policies:g,installedPacks:h,scanLedger:new b2(e),historySync:new ar(e),secretVault:new b8(e),exceptions:new a7(e),resolutions:new b0(e),ruleProbeCache:new b1(e),bodyRetention:new aU(e),security:new ci(e),detections:new a0(e),shares:new cq(e),policyCatalog:new b$(h),inventory:new bG(e),inventoryAssets:new bY(e),projectFiles:new b_(e),activity:new aS(e),sourceProject:new cr(e),auditEvents:new aT(e),captureStatus:new aV(e),classifiedData:new aW(e),inspectionDefinitions:new bf(e),inspectionFindings:new bg(e),configInventory:new aY(e)};return g.seedDefaults(),{db:e,...i}}catch(b){let a=function(a){try{let b=new Set(j.lFU.map(a=>a.tag)),c=a.prepare("SELECT tag FROM migration_ledger").all().map(a=>a.tag).filter(a=>!b.has(a)).sort();if(0===c.length)return null;return{storeVersion:a.prepare("PRAGMA user_version").get().user_version,buildVersion:j.lFU.length,unknownTags:c}}catch{return null}}(e);throw cw(e),null!==a&&function(a){let b=a?.errcode;if("number"!=typeof b)return!1;let c=255&b;return 1===c||19===c}(b)?new cs(a,b):b}}(c,(0,e.dirname)(a),!0===b.applyDeferredMigrations?void 0:cy);function T(a){return function(a,b,c=null){return H((0,j.tTV)(["capture",a??"no_session",b,c??"no_path"]))}(a.metadata?.sessionId??null,a.contentHash,a.metadata?.filePath??null)}return{events:g,findings:h,policies:i,installedPacks:k,scanLedger:m,historySync:n,bodyRetention:o,secretVault:r,exceptions:t,resolutions:u,ruleProbeCache:v,security:w,detections:x,shares:y,policyCatalog:z,inventory:A,inventoryAssets:B,activity:D,sourceProject:E,auditEvents:G,captureStatus:L,classifiedData:M,inspectionDefinitions:N,inspectionFindings:Q,recordCapture:function(a,b){Y(f,()=>{let c=a.metadata?.sessionId;c&&G.ensureSessionRoot(c,a.occurredAt);let d=T(a);G.insertAuditEvent({id:d,eventType:a.kind,startedAt:a.occurredAt,parentId:c,rootSessionId:c,content:a.content,contentHash:a.contentHash,attributes:(0,j.$w9)(a)});let e=new Map;for(let a of b){if(c&&Q.isSessionDuplicate(a.ruleId,a.maskedMatch,c)||Q.isEventDuplicate(d,a.ruleId,a.maskedMatch,a.span.start,a.span.end))continue;let b=`${a.ruleId}@${(0,j.qmP)(a)}`,f=e.get(b);f||(f=N.upsert((0,j.jTf)(a)),e.set(b,f)),Q.insertFinding({id:a.id,auditEventId:d,inspectionDefinitionId:f,span:a.span,maskedMatch:a.maskedMatch,actionTaken:a.actionTaken,confidence:a.confidence,findingKey:a.findingKey??void 0})}})},dismissOpenFindingsForRule:function(a,b){let c=0;return X(f,()=>{let d=ca(f,a);u.insertResolutions(d.map(a=>({findingKey:a,status:"dismissed",method:b.method,resolvedAt:b.resolvedAt,evidence:b.evidence}))),c=d.length},"IMMEDIATE"),c},markCaptureDelivered:function(a,b){Y(f,()=>{n.markSynced([T(a)],b)})},markCaptureOwed:function(a){Y(f,()=>{n.markCaptureOwed(T(a))})},markAuditEventsDelivered:function(a,b){let c=a.filter(a=>!ct.has(a.eventType));0!==c.length&&Y(f,()=>{n.markSynced(c.map(a=>a.id),b)})},ensureInventory:function(a){let b={};return Y(f,()=>{let c=Date.now();a.host&&(b.hostId=A.upsert(a.host,c)),a.harness&&(b.harnessId=A.upsert(cv(a.harness,b.hostId),c)),b.accountId=A.upsert(cv({objectType:"user",identityKey:"local",attributes:{source:"local"}},b.hostId),c),a.project&&(b.sourceProjectId=E.upsert(a.project,c))})?b:{}},recordConfigScan:function(a){Y(f,()=>{let b=(0,j.I8t)(a.scanEvent.startedAt);for(let c of a.items)A.upsert(c,b);G.insertAuditEvent(a.scanEvent);let c=new Map;for(let b of a.definitions??[])c.set(`${b.ruleId}@${b.version}`,N.upsert(b));for(let b of a.findings??[]){let d=c.get(`${b.ruleId}@${b.version}`);d&&Q.insertFinding({id:(0,F.randomUUID)(),auditEventId:a.scanEvent.id,inspectionDefinitionId:d,span:b.span,maskedMatch:b.maskedMatch,actionTaken:b.actionTaken,confidence:b.confidence})}})},recordProjectFiles:function(a,b){0!==b.files.length&&Y(f,()=>{C.replaceForProject(a,b,Date.now())})},reconcileWorktreeProjects:function(a,b,c){try{let d=b.split(e.sep).join("/"),g=c.split(e.sep).join("/"),h=c===b?"":"url IN (:worktreePosix, :worktreeWin) OR ",i=f.prepare(`SELECT id FROM source_project
            WHERE id <> :canonicalId
              AND (${h}url LIKE :pattern ESCAPE '\\' OR url LIKE :patternWin ESCAPE '\\')`).all({canonicalId:a,...c===b?{}:{worktreePosix:g,worktreeWin:g.split("/").join("\\")},pattern:`${S(d)}/.claude/worktrees/%`,patternWin:`${S(d.split("/").join("\\"))}\\\\.claude\\\\worktrees\\\\%`});if(0===i.length)return;X(f,()=>{for(let{id:b}of i)f.prepare("UPDATE audit_events SET source_project_id = :canonicalId WHERE source_project_id = :id").run({canonicalId:a,id:b}),f.prepare("UPDATE OR IGNORE file_access_override SET project_id = :canonicalId WHERE project_id = :id").run({canonicalId:a,id:b}),f.prepare("DELETE FROM file_access_override WHERE project_id = :id").run({id:b}),f.prepare("DELETE FROM project_file WHERE project_id = :id").run({id:b}),f.prepare("DELETE FROM source_project WHERE id = :id").run({id:b})})}catch{}},configInventoryReport:()=>R.report(),facets:function(){return{hosts:A.distinctTitles("host"),harnesses:A.distinctTitles("harness"),osVersions:A.osVersions(),projects:E.distinctNames()}},purgeSampleData:()=>{!function(a){try{if(!a.prepare(`SELECT (
          EXISTS(SELECT 1 FROM share_destination WHERE provenance = 'sample')
@@ -1022,10 +1039,10 @@ BEGIN SELECT RAISE(IGNORE); END`),function(a){if(!$(a,"table","audit_events"))re
             OR harness_id IN (SELECT id FROM inventory WHERE object_type = 'harness' AND json_extract(attributes, '$.provenance') = 'sample')`),a.exec("DELETE FROM mcp_trust_override WHERE asset_id IN (SELECT id FROM inventory_asset WHERE provenance = 'sample')"),a.exec("DELETE FROM file_access_override WHERE project_id IN (SELECT id FROM source_project WHERE json_extract(attributes, '$.provenance') = 'sample')"),a.exec("DELETE FROM project_file WHERE project_id IN (SELECT id FROM source_project WHERE json_extract(attributes, '$.provenance') = 'sample')"),a.exec("DELETE FROM inventory_asset WHERE provenance = 'sample'"),a.exec("DELETE FROM source_project WHERE json_extract(attributes, '$.provenance') = 'sample'"),a.exec("DELETE FROM inventory WHERE object_type = 'harness' AND json_extract(attributes, '$.provenance') = 'sample'"),a.exec("DELETE FROM inspection_findings WHERE id LIKE 'sample:activity:%'"),a.exec("DELETE FROM inspection_definitions WHERE id LIKE 'sample:activity:%'"),a.exec("DELETE FROM audit_events WHERE root_session_id LIKE 'sample:activity:%'"),a.exec("DELETE FROM audit_events WHERE id LIKE 'sample:activity:%'"),a.exec(`CREATE TABLE IF NOT EXISTS app_meta (
         key TEXT PRIMARY KEY,
         value TEXT NOT NULL
-      )`),a.exec("DELETE FROM app_meta WHERE key LIKE 'sample_seeded:%'")})}catch{}}(f)},transaction:async function a(a){f.exec("BEGIN");try{let b=await a();return f.exec("COMMIT"),b}catch(a){try{f.exec("ROLLBACK")}catch{}throw a}},close:()=>{f.close()},[ct]:f}}let cz=/^(?:[^@/]+@)?([^/:]+):(.+)$/,cA=/^[A-Za-z]:[\\/]/,cB=/^file:\/\//i,cC=/^[a-z][a-z0-9+.-]*:\/\/(?:[^@/]+@)?([^/:]+)(?::\d+)?(\/.*)?$/i,cD=".git";function cE(a){return{host:a.host,kind:a.kind,name:a.name,category:a.category,providerId:a.providerId,trust:a.trust,network:a.network,method:a.method,transport:a.transport,url:a.url,template:a.template,dataClass:a.dataClass,site:{file:a.site.file,line:a.site.line,dynamic:a.site.dynamic,vendored:a.site.vendored}}}function cF(a){let{hits:b,droppedFiles:c}=cl(a.hits,a.reconcile.mode),d=cm(a.reconcile,c);return{projectKey:function(a){let b=a.startsWith("git:")?`git:${function(a){let b=a.trim();if(cA.test(b)||cB.test(b))return b;let c=cC.exec(b),d=null===c?cz.exec(b):null,e=(c?.[1]??d?.[1])?.toLowerCase();if(void 0===e)return b;let f=function(a){let b=0,c=a.length;for(;b<c&&47===a.charCodeAt(b);)b+=1;for(;c>b&&47===a.charCodeAt(c-1);)c-=1;return a.slice(b,c)}((null===c?d?.[2]:c[2])??""),g=f.endsWith(cD)?f.slice(0,-cD.length):f;return""===g?e:`${e}/${g}`}(a.slice(4))}`:a;return(0,F.createHash)("sha256").update(`v2:${b}`,"utf8").digest("hex")}(a.projectKey),project:a.project,reconcile:d,hits:b.map(cE)}}function cG(a){let b=a.filePath.replaceAll("\\","/");return(0,F.createHash)("sha256").update(`${a.ruleId}\0${b}\0${a.valueFingerprint}`).digest("hex")}function cH(a){return(0,e.join)(a,"exception.key")}let cI={exceptions:"key_version",blocked_detections:"key_version",secret_vault:"fingerprint_key_version"};class cJ extends Error{constructor(a){super(`cannot read the stored fingerprint key versions: ${a instanceof Error?a.message:String(a)}`,{cause:a}),this.code="floor-unreadable",this.name="FloorUnreadableError"}}function cK(a){let b,c=(0,e.join)(a,l);if(!(0,d.existsSync)(c))return 0;try{(b=new G.DatabaseSync(c,{readOnly:!0})).exec(`PRAGMA busy_timeout = ${String(250)}`);let a=0;for(let[c,d]of Object.entries(cI))try{let e=ac(b.prepare(`SELECT MAX(${d}) AS v FROM ${c}`));a=Math.max(a,e?.v??0)}catch(a){if(1!==a.errcode)throw new cJ(a)}return a}catch(a){throw a instanceof cJ?a:new cJ(a)}finally{b?.close()}}function cL(a){return JSON.stringify({version:a.version,material:a.material.toString("base64")})}function cM(a){let b;try{b=(0,d.readFileSync)(cH(a),"utf8")}catch(a){if("ENOENT"===a.code)return null;throw a instanceof Error?a:Error(String(a))}let c=JSON.parse(b);if("object"!=typeof c||null===c)throw Error("exception key file is corrupt: not a JSON object");let{version:e,material:f}=c;if("number"!=typeof e||!Number.isInteger(e)||e<1)throw Error("exception key file is corrupt: bad version");if("string"!=typeof f)throw Error("exception key file is corrupt: bad material");let g=Buffer.from(f,"base64");if(32!==g.length)throw Error("exception key file is corrupt: bad material length");return{version:e,material:g}}function cN(a){let b=cM(a);return b?(r(cH(a)),b):function(a,b){p(a);let c=cH(a);if(x(c,`${cL(b)}
-`))return b;let d=cM(a);if(d)return r(c),d;let e=v(c);throw new w(function(a,b){switch(b){case"symlink":return`exception key file is a symlink (${a}); remove it so a key can be created`;case"gone":return"exception key file was removed while it was being created";case"unknown":return`exception key file (${a}) is occupied but cannot be inspected; check the permissions on its directory`}}(c,e.kind),e.cause)}(a,{version:cK(a)+1,material:(0,F.randomBytes)(32)})}function cO(a){var b;let c=cM(a);return b={version:Math.max(c?.version??0,cK(a))+1,material:(0,F.randomBytes)(32)},p(a),u(cH(a),`${cL(b)}
-`),b}function cP(a,b){return(0,F.createHmac)("sha256",a.material).update(b,"utf8").digest("hex")}function cQ(a,b){var c;return(0,j.qEQ)(b,null===(c=a)?{status:"absent"}:{status:"present",version:c.version})}function cR(a,b=Date.now()){try{return function(a,b){try{let c=JSON.parse(a);if("object"!=typeof c||null===c)return null;let d="number"==typeof c.consecutiveFailures&&c.consecutiveFailures>=0?c.consecutiveFailures:0,e="number"==typeof c.openedAtMs&&Number.isFinite(c.openedAtMs)&&c.openedAtMs<=b?c.openedAtMs:null,f=j.QA8.safeParse(c.lastFailure),g=f.success?f.data:null;return{consecutiveFailures:d,openedAtMs:e,lastFailure:g}}catch{return null}}((0,d.readFileSync)((0,e.join)(a,g),"utf8"),b)}catch{return null}}function cS(a,b){let c=a?.openedAtMs??null;return null!==c&&b-c<3e4}function cT(a,b){if((0,d.existsSync)((0,e.join)(a,l)))try{let c=cy(a);try{c.historySync.markCaptureBacklogOwed(b)}finally{c.close()}}catch{}}function cU(a,b){let c,d;try{c=void 0===b?br():b,d=function(a=bi(),b){let c=void 0===b?br():b;return{settings:bt(bw(a),c),managed:bs(c)}}(a,c).settings}catch{return null}if(null===c)return null;let e=c.lockedFields.includes("runMode"),f=void 0!==c.values.runMode,g=void 0!==c.values.controlPlane;return e||f||g?{who:void 0===c.organization?{}:{organization:c.organization},settings:d,frozen:e,modePinned:f,planePinned:g,pinnedLabel:c.values.controlPlane?.label}:null}function cV(a){let{who:b,settings:c,frozen:d,modePinned:e}=a;if(!d&&!e)return null;if("attached"!==c.runMode)return{reason:"held-standalone",...b};let f=c.controlPlane;return(0,j.lgf)(c)&&void 0!==f?{reason:"held-attached",...b,endpoint:f.endpoint}:null}function cW(a,b=bi(),c){let d=cU(b,c);if(null===d)return null;let{who:e,settings:f,frozen:g,planePinned:h,pinnedLabel:i}=d,j=""===a.label?void 0:a.label,k=cV(d);if(k?.reason==="held-standalone")return k;let l=f.controlPlane;return g||h?void 0!==l&&l.endpoint!==a.endpoint?{reason:"pinned-endpoint",...e,endpoint:l.endpoint}:g&&void 0!==l&&j!==l.label?void 0===j?{reason:"label-required",...e}:{reason:"pinned-label",...e}:h&&void 0!==i&&void 0!==j&&j!==i?{reason:"pinned-label",...e}:null:null}function cX(a=bi(),b){let c=cU(a,b);if(null===c)return null;let d=cV(c);return d?.reason==="held-attached"?d:null}let cY="ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";function cZ(a){let b="",c=0,d=0;for(let e of a)for(c=c<<8|e,d+=8;d>=5;)b+=cY.charAt(c>>>d-5&31),d-=5;return d>0&&(b+=cY.charAt(c<<5-d&31)),b}function c$(a){let b=[],c=0,d=0;for(let e of a){let a=cY.indexOf(e);if(a<0)throw Error("base32: character outside the alphabet");c=c<<5|a,(d+=5)>=8&&(b.push(c>>>d-8&255),d-=8)}return Buffer.from(b)}function c_(a){if(!Number.isInteger(a)||a<1||a>0xffffffff)throw Error("vault: key version out of range");let b=[],c=a;for(;c>0;)b.unshift(255&c),c=Math.floor(c/256);return cZ(Uint8Array.from(b))}function c0(a){let b=b=>Buffer.from((0,F.hkdfSync)("sha256",a,"aka:vault:v1",b,32));return{enc:b("aka:vault:enc:v1"),sign:b("aka:vault:sign:v1")}}function c1(a,b,c,d=j.viY){if(16!==b.length)throw Error("vault: pointer id must be 16 bytes");let e=Buffer.alloc(6);return e.writeUInt16BE(d,0),e.writeUInt32BE(a,2),Buffer.concat([e,Buffer.from(b),Buffer.from(c,"utf8")])}function c2(a,b,c,d){let e=(0,F.createCipheriv)("aes-256-gcm",a,d);return e.setAAD(c),{ciphertext:Buffer.concat([e.update(b,"utf8"),e.final()]),nonce:d,authTag:e.getAuthTag()}}function c3(a,b,c){try{let d=(0,F.createDecipheriv)("aes-256-gcm",a,b.nonce);return d.setAAD(c),d.setAuthTag(b.authTag),Buffer.concat([d.update(b.ciphertext),d.final()]).toString("utf8")}catch{return null}}function c4(a,b,c,d){return(0,F.createHmac)("sha256",a).update(c1(b,c,d,j.viY)).digest().subarray(0,10)}function c5(a,b,c,d,e){if(10!==e.length)return!1;let f=c4(a,b,c,d);return(0,F.timingSafeEqual)(f,Buffer.from(e))}var c6=c(31421);let c7={symlink:"the path is a symlink; remove it so a keyring can be created",gone:"the path was occupied but holds no keyring (removed while it was being created)",unknown:"the path is occupied but cannot be inspected; check the permissions on its directory"};class c8 extends Error{constructor(a){super(`vault: key epoch ${String(a)} is not present in the keyring`),this.name="VaultKeyEpochMissingError",this.version=a}}let c9="vault.key",da="aka-vault",db="keyring";function dc(a){let b=JSON.parse(a);if("object"!=typeof b||null===b)throw Error("vault key file is corrupt: not a JSON object");let{current:c,keys:d}=b;if("number"!=typeof c||!Number.isInteger(c)||c<1)throw Error("vault key file is corrupt: bad current version");if("object"!=typeof d||null===d||Array.isArray(d))throw Error("vault key file is corrupt: bad keys map");let e=new Map;for(let[a,b]of Object.entries(d)){let c=Number(a);if(!Number.isInteger(c)||c<1)throw Error("vault key file is corrupt: bad key version");if("string"!=typeof b)throw Error("vault key file is corrupt: bad key material");let d=Buffer.from(b,"base64");if(32!==d.length)throw Error("vault key file is corrupt: bad key material length");e.set(c,d)}if(!e.has(c))throw Error("vault key file is corrupt: current version has no material");return{current:c,keys:e}}function dd(a){let b={};for(let c of[...a.keys.keys()].sort((a,b)=>a-b)){let d=a.keys.get(c);d&&(b[String(c)]=d.toString("base64"))}return JSON.stringify({current:a.current,keys:b})}function de(){return{current:1,keys:new Map([[1,(0,F.randomBytes)(32)]])}}function df(a){let b=Math.max(...a.keys.keys())+1,c=new Map(a.keys);return c.set(b,(0,F.randomBytes)(32)),{current:b,keys:c}}function dg(a){let b=a.keys.get(a.current);if(!b)throw new c8(a.current);return{material:b,version:a.current}}function dh(a,b){let c=a.keys.get(b);if(!c)throw new c8(b);return{material:c,version:b}}function di(a){try{return Promise.resolve(a())}catch(a){return Promise.reject(a instanceof Error?a:Error(String(a)))}}function dj(a){return a instanceof Error?a:Error(String(a))}let dk="owner",dl="vault: a key rotation is already in progress";function dm(a,b){try{o(a),n(a)}catch(a){if("EEXIST"===a.code)return!1;throw dj(a)}try{return(0,d.writeFileSync)((0,e.join)(a,dk),`${b}
-`,{mode:384}),!0}catch(b){throw(0,d.rmSync)(a,{recursive:!0,force:!0}),dj(b)}}function dn(a,b){p(a);let c=function(a){let b,c=(0,e.join)(a,`${c9}.lock`),f=(0,F.randomBytes)(16).toString("hex");if(dm(c,f))return{lock:c,owner:f};try{b=(0,d.statSync)(c)}catch{throw Error(dl)}if(Date.now()-b.mtimeMs<6e4)throw Error(dl);let g=`${c}.stale.${f}`;try{let a=(0,d.statSync)(c);if(a.ino!==b.ino||a.mtimeMs!==b.mtimeMs)throw Error(dl);(0,d.renameSync)(c,g)}catch(a){if(a instanceof Error&&a.message===dl)throw a;throw Error(dl,{cause:a})}if((0,d.rmSync)(g,{recursive:!0,force:!0}),!dm(c,f))throw Error(dl);return{lock:c,owner:f}}(a);try{return b()}finally{!function(a){try{if((0,d.readFileSync)((0,e.join)(a.lock,dk),"utf8").trim()!==a.owner)return}catch{return}(0,d.rmSync)(a.lock,{recursive:!0,force:!0})}(c)}}class dp{#a;constructor(a){this.#a=a}get filePath(){return(0,e.join)(this.#a,c9)}loadOrCreate(){return di(()=>{let a=this.#b();return a?(dq(this.filePath),dg(a)):dg(this.#c())})}rotate(){return di(()=>dn(this.#a,()=>{let a=this.#b();return a?dg(this.#d(df(a))):dg(this.#c())}))}materialFor(a){return di(()=>{let b=this.#b();if(!b)throw new c8(a);return dh(b,a)})}#b(){let a;try{a=(0,d.readFileSync)(this.filePath,"utf8")}catch(a){if("ENOENT"===a.code)return null;throw a instanceof Error?a:Error(String(a))}return dc(a)}#c(){p(this.#a);let a=de();if(x(this.filePath,`${dd(a)}
-`))return a;let b=this.#b();if(!b){let a=v(this.filePath);throw new w(`vault: cannot create a key file at ${this.filePath} — ${c7[a.kind]}`,a.cause)}return dq(this.filePath),b}#d(a){return p(this.#a),u(this.filePath,`${dd(a)}
-`),a}}function dq(a){try{(0,d.chmodSync)(a,384)}catch{}}let dr=(a,b)=>(0,c6.execFileSync)("/usr/bin/security",a,{encoding:"utf8",input:b,timeout:5e3,stdio:[void 0===b?"ignore":"pipe","pipe","ignore"]});function ds(a){let b=[];return"number"==typeof a.status&&b.push(`exit ${String(a.status)}`),"string"==typeof a.signal&&a.signal&&b.push(`signal ${a.signal}`),"string"==typeof a.code&&a.code&&b.push(a.code),b.length>0?b.join(", "):"unknown error"}function dt(a,b,c){let d=["add-generic-password",...b?["-U"]:[],"-s",da,"-a",db,"-X",Buffer.from(dd(a),"utf8").toString("hex")];if(void 0!==c){if(/['\\\n\r\0]/.test(c))throw Error("vault: keychain path contains a quote, backslash, line break or NUL, which security -i cannot carry intact");d.push(`'${c}'`)}return`${d.join(" ")}
-`}class du{#a;#e;#f;#g;constructor(a,b=dr,c){if(b===dr&&"darwin"!==process.platform)throw Error(`keychain custody is not available on this platform (${process.platform}); use file custody`);this.#a=a,this.#e=b,this.#f=c,this.#g=void 0===c?[]:[c]}get keysDir(){return this.#a}loadOrCreate(){return di(()=>{let a=this.#b();return a?dg(a):dg(this.#h(de()))})}rotate(){return di(()=>dn(this.#a,()=>{let a=this.#b();return a?dg(this.#i(df(a))):dg(this.#h(de()))}))}materialFor(a){return di(()=>{let b=this.#b();if(!b)throw new c8(a);return dh(b,a)})}#b(){let a;try{a=this.#e(["find-generic-password","-s",da,"-a",db,"-w",...this.#g])}catch(a){if(44===a.status)return null;throw Error(`vault: keychain read failed (${ds(a)}); refusing to treat the failure as an absent keyring`)}let b=a.trim();if(0===b.length)return null;try{return dc(b)}catch(a){throw Error(`vault: keychain item is not a usable keyring (${a instanceof SyntaxError?"malformed JSON":a instanceof Error?a.message:"unknown"})`)}}#h(a){let b=dt(a,!1,this.#f);try{this.#e(["-i"],b)}catch(b){let a=this.#b();if(a)return a;throw Error(`vault: keychain write failed (${ds(b)})`)}return a}#i(a){let b=dt(a,!0,this.#f);try{this.#e(["-i"],b)}catch(a){throw Error(`vault: keychain write failed (${ds(a)})`)}return a}}function dv(a,b){return"keychain"===a?new du(b):new dp(b)}let dw=Symbol("aka.vault.consentAbsent"),dx=Symbol("aka.vault.unavailable");function dy(a){if(!j.XZo.test(a))return null;let b=a.slice(6,-2),c=b.indexOf(":");if(c<0)return null;let d=b.slice(0,c),[e,f,g]=b.slice(c+1).split(".");if(void 0===e||void 0===f||void 0===g)return null;try{let a=function(a){let b=c$(a);if(0===b.length||b.length>4)throw Error("vault: bad key version encoding");let c=0;for(let a of b)c=256*c+a;if(c<1)throw Error("vault: bad key version");return c}(e),b=c$(f),c=c$(g);if(c_(a)!==e||cZ(b)!==f||cZ(c)!==g)return null;return{category:d,keyVersion:a,pointerId:b,tag:c}}catch{return null}}class dz{#j;#k;#l;#m;#n;constructor(a){this.#j=a.repo,this.#k=a.keys,this.#l=a.isConsented,this.#m=a.verifyGrant,this.#n=a.now??(()=>Date.now())}async tokenize(a,b,c){if(!this.#l())return dw;let d=c(),e=cP(d,a),f=this.#j.byValueFingerprint(e),g=this.#n();if(f)return this.#j.upsert({...f,provider:f.provider??void 0,userAuthorized:!0===b.userAuthorized},g),await this.#o(f.keyVersion,f.pointerId,f.category);let{material:h,version:i}=await this.#k.loadOrCreate(),k=c0(h),l=(0,F.randomBytes)(16),m=c1(i,l,b.category,j.viY),n=c2(k.enc,a,m,(0,F.randomBytes)(12)),{row:o}=this.#j.upsert({pointerId:cZ(l),valueFingerprint:e,fingerprintKeyVersion:d.version,keyVersion:i,formatVersion:j.viY,category:b.category,ruleId:b.ruleId,maskedMatch:b.maskedMatch,provider:b.provider,userAuthorized:!0===b.userAuthorized,ciphertext:n.ciphertext.toString("base64"),nonce:n.nonce.toString("base64"),authTag:n.authTag.toString("base64")},g);return await this.#o(o.keyVersion,o.pointerId,o.category)}async detokenize(a,b){let c,d,e=dy(a);if(!e)return dx;try{let a=await this.#k.materialFor(e.keyVersion);c=c0(a.material).sign}catch{return dx}if(!c5(c,e.keyVersion,e.pointerId,e.category,e.tag))return dx;let f=cZ(e.pointerId),g=this.#j.byPointerId(f);if(!g)return this.#p(f,b,"unavailable"),dx;if(g.category!==e.category)return dx;if("model"===b.target){let a,c=b.grantId,d=this.#m;if(void 0===d||void 0===c||""===c)return this.#p(f,b,"refused"),dx;try{a=await d(c,{ruleId:g.ruleId,valueFingerprint:g.valueFingerprint,fingerprintKeyVersion:g.fingerprintKeyVersion})}catch{a=!1}if(!a)return this.#p(f,b,"refused"),dx}try{let a=await this.#k.materialFor(g.keyVersion);d=c3(c0(a.material).enc,{ciphertext:Buffer.from(g.ciphertext,"base64"),nonce:Buffer.from(g.nonce,"base64"),authTag:Buffer.from(g.authTag,"base64")},c1(g.keyVersion,e.pointerId,g.category,g.formatVersion))}catch{d=null}return null===d?(this.#p(f,b,"unavailable"),dx):(this.#p(f,b,"revealed"),d)}async revealEntry(a,b){let c=this.#j.byPointerId(a);if(!c)return this.#p(a,{target:"human",reason:b.reason},"unavailable"),dx;let d=await this.#q(c);return null===d?(this.#p(a,{target:"human",reason:b.reason},"unavailable"),dx):(this.#p(a,{target:"human",reason:b.reason},"revealed"),d)}async describePointer(a){let b=await this.#r(a);return b?{category:b.category,...void 0===b.provider?{}:{provider:b.provider},maskedMatch:b.maskedMatch,occurrences:b.occurrenceCount,firstSeen:new Date(b.firstSeen).toISOString(),lastSeen:new Date(b.lastSeen).toISOString()}:null}async resolvePointerIdentity(a){let b=await this.#r(a);return b?{ruleId:b.ruleId,valueFingerprint:b.valueFingerprint,fingerprintKeyVersion:b.fingerprintKeyVersion}:null}async rotateVaultKey(){let a=await this.#k.rotate(),b=c0(a.material).enc,c=0;for(let d of this.#j.listAll()){let e;if(d.keyVersion===a.version)continue;let f=c$(d.pointerId);try{let a=await this.#k.materialFor(d.keyVersion);e=c3(c0(a.material).enc,{ciphertext:Buffer.from(d.ciphertext,"base64"),nonce:Buffer.from(d.nonce,"base64"),authTag:Buffer.from(d.authTag,"base64")},c1(d.keyVersion,f,d.category,d.formatVersion))}catch{e=null}if(null===e)continue;let g=c2(b,e,c1(a.version,f,d.category,d.formatVersion),(0,F.randomBytes)(12));this.#j.replaceCiphertext(d.pointerId,{keyVersion:a.version,ciphertext:g.ciphertext.toString("base64"),nonce:g.nonce.toString("base64"),authTag:g.authTag.toString("base64")}),c+=1}return{version:a.version,reEncrypted:c}}async refreshFingerprints(a){let b=0;for(let c of this.#j.listAll())try{let d=await this.#q(c);if(null===d)continue;this.#j.refreshFingerprint(c.pointerId,{valueFingerprint:cP(a,d),fingerprintKeyVersion:a.version}),b+=1}catch{continue}return b}purgeVault(){let a=this.#j.purgeAll();return this.#j.recordDeref({id:(0,F.randomUUID)(),pointerId:"*",at:this.#n(),target:"human",reason:"purge",outcome:"unavailable",pointerCount:Math.max(a,1)}),a}async #o(a,b,c){var d;let e=c$(b),f=c0((await this.#k.materialFor(a)).material).sign;return d=c4(f,a,e,c),`[[aka:${c}:${c_(a)}.${cZ(e)}.${cZ(d)}]]`}async #q(a){try{let b=await this.#k.materialFor(a.keyVersion);return c3(c0(b.material).enc,{ciphertext:Buffer.from(a.ciphertext,"base64"),nonce:Buffer.from(a.nonce,"base64"),authTag:Buffer.from(a.authTag,"base64")},c1(a.keyVersion,c$(a.pointerId),a.category,a.formatVersion))}catch{return null}}async #r(a){let b=dy(a);if(!b)return null;try{let a=await this.#k.materialFor(b.keyVersion),c=c0(a.material).sign;if(!c5(c,b.keyVersion,b.pointerId,b.category,b.tag))return null}catch{return null}let c=this.#j.byPointerId(cZ(b.pointerId));return c?.category!==b.category?null:c}#p(a,b,c){this.#j.recordDeref({id:(0,F.randomUUID)(),pointerId:a,at:this.#n(),target:b.target,reason:b.reason,outcome:c,...void 0===b.grantId?{}:{grantId:b.grantId},pointerCount:(0,j.kqf)(b.reason)?b.pointerCount??1:1})}}},88477:(a,b,c)=>{c.d(b,{S8C:()=>am,leE:()=>bR,hxQ:()=>be,Itg:()=>a2,Nh0:()=>cZ,QcD:()=>cY,qeh:()=>fC,yi_:()=>bS,t8P:()=>b4,RRF:()=>dM,ZpU:()=>dZ,fDu:()=>eH,HUb:()=>dG,hfB:()=>cO,oz:()=>f6,Rf1:()=>f5,QA8:()=>b8,unw:()=>dY,p$t:()=>aL,IYX:()=>aF,b2L:()=>aI,Jr:()=>d$,hdu:()=>ei,mBk:()=>eh,vog:()=>d,H3X:()=>e5,qvI:()=>fZ,gbA:()=>aj,V8B:()=>cU,B0R:()=>ci,CPm:()=>cg,_td:()=>e6,Wmn:()=>e7,IgC:()=>dK,aIg:()=>bB,BZd:()=>b2,ZYZ:()=>cN,iRC:()=>cV,GCf:()=>ar,agn:()=>c$,tLs:()=>ad,xIP:()=>et,TUN:()=>ae,SHn:()=>bk,rov:()=>ex,kg1:()=>b3,V0H:()=>dF,mzG:()=>aJ,OXN:()=>aM,VEg:()=>aG,OVs:()=>em,LsM:()=>ek,bm0:()=>el,WRR:()=>eX,u8Q:()=>ej,kxf:()=>es,ZXz:()=>e$,MhX:()=>e_,viY:()=>d2,XZo:()=>d5,NtJ:()=>b7,jUf:()=>d7,PEm:()=>dE,vap:()=>dI,KqW:()=>fq,eI7:()=>e4,UiT:()=>fY,pHc:()=>f$,lBn:()=>b0,qhM:()=>b_,suk:()=>dH,cqq:()=>av,PUD:()=>aY,eYL:()=>c_,JJC:()=>c0,jON:()=>cw,Zdp:()=>af,lFU:()=>e,N3u:()=>fB,PhW:()=>a0,AJV:()=>as,BIx:()=>bg,DzG:()=>ep,NFD:()=>eo,Fz0:()=>eC,AKh:()=>ah,hd_:()=>eI,_5V:()=>dv,tXp:()=>dh,plk:()=>cM,Ple:()=>db,Fnc:()=>fS,ryv:()=>aa,fhc:()=>dO,tTV:()=>a_,qmP:()=>eU,_6W:()=>dj,hml:()=>dw,rG:()=>dl,SVR:()=>e0,F$B:()=>eM,Bfj:()=>dg,fj8:()=>ds,q_t:()=>$,i1j:()=>eJ,xHz:()=>c3,xog:()=>da,hzO:()=>fU,by7:()=>fT,Gw9:()=>fQ,ZoN:()=>dx,q11:()=>W,U7X:()=>ak,JB8:()=>c9,GVg:()=>f7,T2I:()=>dS,lgf:()=>eL,kqf:()=>ec,y_0:()=>fR,EL9:()=>eB,qEQ:()=>cW,DLF:()=>ez,lGs:()=>bV,hds:()=>er,dnP:()=>eG,I8t:()=>V,am1:()=>dp,SSj:()=>du,Vgn:()=>bW,K7s:()=>c1,Pv3:()=>f4,jwX:()=>d6,TdZ:()=>dX,DhA:()=>d_,g$R:()=>b6,WSs:()=>fX,a45:()=>cK,N6N:()=>g,X0p:()=>dk,pnU:()=>cL,Lq6:()=>dT,V9M:()=>eP,$w9:()=>eT,jTf:()=>eV,$BP:()=>eQ,JAl:()=>eR,$3l:()=>eS,MgS:()=>dt,gzP:()=>eN,QCA:()=>eO,C05:()=>fV,AaX:()=>bU,GWi:()=>dU,Yc8:()=>eK});let d=["0031_audit_capture_by_time_index","0032_audit_capture_by_id_index","0033_audit_capture_location_index","0034_findings_read_indexes"],e=[{tag:"0000_acoustic_felicia_hardy",sql:"CREATE TABLE `audit_events` (\n	`id` text PRIMARY KEY NOT NULL,\n	`parent_id` text,\n	`root_session_id` text,\n	`event_type` text NOT NULL,\n	`host_id` text,\n	`harness_id` text,\n	`source_project_id` text,\n	`started_at` integer NOT NULL,\n	`ended_at` integer,\n	`severity` text,\n	`priority` text,\n	`content` text,\n	`content_hash` text,\n	`attributes` text,\n	FOREIGN KEY (`parent_id`) REFERENCES `audit_events`(`id`) ON UPDATE no action ON DELETE no action,\n	FOREIGN KEY (`root_session_id`) REFERENCES `audit_events`(`id`) ON UPDATE no action ON DELETE no action,\n	FOREIGN KEY (`host_id`) REFERENCES `inventory`(`id`) ON UPDATE no action ON DELETE no action,\n	FOREIGN KEY (`harness_id`) REFERENCES `inventory`(`id`) ON UPDATE no action ON DELETE no action,\n	FOREIGN KEY (`source_project_id`) REFERENCES `source_project`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_audit_parent` ON `audit_events` (`parent_id`);--\x3e statement-breakpoint\nCREATE INDEX `idx_audit_session` ON `audit_events` (`root_session_id`,`started_at`);--\x3e statement-breakpoint\nCREATE INDEX `idx_audit_harness_t` ON `audit_events` (`harness_id`,`started_at`);--\x3e statement-breakpoint\nCREATE INDEX `idx_audit_project_t` ON `audit_events` (`source_project_id`,`started_at`);--\x3e statement-breakpoint\nCREATE TABLE `classified_data` (\n	`id` text PRIMARY KEY NOT NULL,\n	`class` text NOT NULL,\n	`label` text,\n	`attributes` text\n);\n--\x3e statement-breakpoint\nCREATE TABLE `events` (\n	`id` text PRIMARY KEY NOT NULL,\n	`source_tool` text NOT NULL,\n	`kind` text NOT NULL,\n	`occurred_at` integer NOT NULL,\n	`content_hash` text NOT NULL,\n	`content` text NOT NULL,\n	`metadata` text\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_events_occurred` ON `events` (`occurred_at`);--\x3e statement-breakpoint\nCREATE TABLE `findings` (\n	`id` text PRIMARY KEY NOT NULL,\n	`event_id` text NOT NULL,\n	`rule_id` text NOT NULL,\n	`category` text NOT NULL,\n	`severity` text NOT NULL,\n	`span_start` integer NOT NULL,\n	`span_end` integer NOT NULL,\n	`masked_match` text NOT NULL,\n	`action_taken` text NOT NULL,\n	`confidence` real NOT NULL,\n	FOREIGN KEY (`event_id`) REFERENCES `events`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_findings_event` ON `findings` (`event_id`);--\x3e statement-breakpoint\nCREATE TABLE `inspection_definitions` (\n	`id` text PRIMARY KEY NOT NULL,\n	`rule_id` text NOT NULL,\n	`name` text NOT NULL,\n	`category` text NOT NULL,\n	`severity` text NOT NULL,\n	`definition` text NOT NULL,\n	`version` text NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE TABLE `inspection_findings` (\n	`id` text PRIMARY KEY NOT NULL,\n	`audit_event_id` text NOT NULL,\n	`inspection_definition_id` text NOT NULL,\n	`classified_data_id` text,\n	`span_start` integer NOT NULL,\n	`span_end` integer NOT NULL,\n	`masked_match` text NOT NULL,\n	`action_taken` text NOT NULL,\n	`confidence` real NOT NULL,\n	FOREIGN KEY (`audit_event_id`) REFERENCES `audit_events`(`id`) ON UPDATE no action ON DELETE no action,\n	FOREIGN KEY (`inspection_definition_id`) REFERENCES `inspection_definitions`(`id`) ON UPDATE no action ON DELETE no action,\n	FOREIGN KEY (`classified_data_id`) REFERENCES `classified_data`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_inspection_findings_event` ON `inspection_findings` (`audit_event_id`);--\x3e statement-breakpoint\nCREATE TABLE `installed_packs` (\n	`id` text PRIMARY KEY NOT NULL,\n	`namespace` text NOT NULL,\n	`pack_id` text NOT NULL,\n	`version` text NOT NULL,\n	`name` text NOT NULL,\n	`rules_json` text NOT NULL,\n	`enabled` integer DEFAULT true NOT NULL,\n	`policy_id` text,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_installed_packs_pack` ON `installed_packs` (`namespace`,`pack_id`);--\x3e statement-breakpoint\nCREATE TABLE `inventory` (\n	`id` text PRIMARY KEY NOT NULL,\n	`object_type` text NOT NULL,\n	`location` text,\n	`title` text,\n	`host_id` text,\n	`attributes` text NOT NULL,\n	`os_version` text GENERATED ALWAYS AS (json_extract(attributes, '$.os_version')) VIRTUAL,\n	`harness_version` text GENERATED ALWAYS AS (json_extract(attributes, '$.harness_version')) VIRTUAL,\n	`first_seen` integer NOT NULL,\n	`last_seen` integer NOT NULL,\n	FOREIGN KEY (`host_id`) REFERENCES `inventory`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_inventory_type` ON `inventory` (`object_type`);--\x3e statement-breakpoint\nCREATE INDEX `idx_inventory_type_osver` ON `inventory` (`object_type`,`os_version`);--\x3e statement-breakpoint\nCREATE INDEX `idx_inventory_type_harnessver` ON `inventory` (`object_type`,`harness_version`);--\x3e statement-breakpoint\nCREATE TABLE `policies` (\n	`id` text PRIMARY KEY NOT NULL,\n	`scope` text DEFAULT 'global' NOT NULL,\n	`target` text NOT NULL,\n	`action` text NOT NULL,\n	`enabled` integer DEFAULT true NOT NULL,\n	`custom_keywords` text,\n	`name` text,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_policies_scope_target` ON `policies` (`scope`,`target`);--\x3e statement-breakpoint\nCREATE TABLE `source_project` (\n	`id` text PRIMARY KEY NOT NULL,\n	`url` text,\n	`name` text,\n	`attributes` text NOT NULL,\n	`first_seen` integer NOT NULL,\n	`last_seen` integer NOT NULL\n);\n"},{tag:"0001_adorable_marten_broadcloak",sql:"ALTER TABLE `audit_events` ADD `input_tokens` integer GENERATED ALWAYS AS (json_extract(attributes, '$.input_tokens')) VIRTUAL;--\x3e statement-breakpoint\nALTER TABLE `audit_events` ADD `output_tokens` integer GENERATED ALWAYS AS (json_extract(attributes, '$.output_tokens')) VIRTUAL;--\x3e statement-breakpoint\nALTER TABLE `audit_events` ADD `cache_creation_input_tokens` integer GENERATED ALWAYS AS (json_extract(attributes, '$.cache_creation_input_tokens')) VIRTUAL;--\x3e statement-breakpoint\nALTER TABLE `audit_events` ADD `cache_read_input_tokens` integer GENERATED ALWAYS AS (json_extract(attributes, '$.cache_read_input_tokens')) VIRTUAL;--\x3e statement-breakpoint\nALTER TABLE `audit_events` ADD `model` text GENERATED ALWAYS AS (json_extract(attributes, '$.model')) VIRTUAL;--\x3e statement-breakpoint\nALTER TABLE `audit_events` ADD `provider` text GENERATED ALWAYS AS (json_extract(attributes, '$.provider')) VIRTUAL;--\x3e statement-breakpoint\nCREATE INDEX `idx_audit_session_type` ON `audit_events` (`root_session_id`,`started_at`) WHERE event_type = 'llm_call';"},{tag:"0002_groovy_big_bertha",sql:"CREATE TABLE `exceptions` (\n	`id` text PRIMARY KEY NOT NULL,\n	`rule_id` text NOT NULL,\n	`category` text NOT NULL,\n	`value_fingerprint` text NOT NULL,\n	`key_version` integer NOT NULL,\n	`masked_value` text NOT NULL,\n	`scope` text NOT NULL,\n	`expires_at` integer,\n	`max_uses` integer,\n	`use_count` integer DEFAULT 0 NOT NULL,\n	`last_used_at` integer,\n	`justification` text NOT NULL,\n	`conditions` text,\n	`created_by` text NOT NULL,\n	`created_via` text NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL,\n	`revoked_at` integer,\n	`revoked_by` text,\n	`revoke_reason` text\n);\n--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_exceptions_active` ON `exceptions` (`rule_id`,`value_fingerprint`,`key_version`) WHERE revoked_at IS NULL;"},{tag:"0003_rich_sage",sql:"CREATE TABLE `egress_decision_override` (\n	`id` text PRIMARY KEY NOT NULL,\n	`destination_id` text NOT NULL,\n	`decision` text NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL,\n	FOREIGN KEY (`destination_id`) REFERENCES `share_destination`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_egress_decision_override` ON `egress_decision_override` (`destination_id`);--\x3e statement-breakpoint\nCREATE TABLE `file_access_override` (\n	`id` text PRIMARY KEY NOT NULL,\n	`project_id` text NOT NULL,\n	`path` text NOT NULL,\n	`access` text NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL,\n	FOREIGN KEY (`project_id`) REFERENCES `source_project`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_file_access_override_project` ON `file_access_override` (`project_id`);--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_file_access_override` ON `file_access_override` (`project_id`,`path`);--\x3e statement-breakpoint\nCREATE TABLE `harness_asset` (\n	`id` text PRIMARY KEY NOT NULL,\n	`harness_id` text NOT NULL,\n	`asset_id` text NOT NULL,\n	`created_at` integer NOT NULL,\n	FOREIGN KEY (`harness_id`) REFERENCES `inventory`(`id`) ON UPDATE no action ON DELETE no action,\n	FOREIGN KEY (`asset_id`) REFERENCES `inventory_asset`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_harness_asset_harness` ON `harness_asset` (`harness_id`);--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_harness_asset` ON `harness_asset` (`harness_id`,`asset_id`);--\x3e statement-breakpoint\nCREATE TABLE `inventory_asset` (\n	`id` text PRIMARY KEY NOT NULL,\n	`asset_type` text NOT NULL,\n	`name` text NOT NULL,\n	`sub` text,\n	`description` text,\n	`flags_json` text DEFAULT '[]' NOT NULL,\n	`meta_json` text DEFAULT '{}' NOT NULL,\n	`trust` text,\n	`tools_json` text,\n	`provenance` text DEFAULT 'scan' NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_inventory_asset_type` ON `inventory_asset` (`asset_type`);--\x3e statement-breakpoint\nCREATE TABLE `mcp_trust_override` (\n	`id` text PRIMARY KEY NOT NULL,\n	`asset_id` text NOT NULL,\n	`trust` text NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL,\n	FOREIGN KEY (`asset_id`) REFERENCES `inventory_asset`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_mcp_trust_override` ON `mcp_trust_override` (`asset_id`);--\x3e statement-breakpoint\nCREATE TABLE `project_file` (\n	`id` text PRIMARY KEY NOT NULL,\n	`project_id` text NOT NULL,\n	`path` text NOT NULL,\n	`name` text NOT NULL,\n	`origin` text NOT NULL,\n	`default_access` text NOT NULL,\n	`findings_count` integer DEFAULT 0 NOT NULL,\n	`blocked_at` integer,\n	`note` text,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL,\n	FOREIGN KEY (`project_id`) REFERENCES `source_project`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_project_file_project` ON `project_file` (`project_id`);--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_project_file` ON `project_file` (`project_id`,`path`);--\x3e statement-breakpoint\nCREATE TABLE `share_call_site` (\n	`id` text PRIMARY KEY NOT NULL,\n	`endpoint_id` text NOT NULL,\n	`project` text NOT NULL,\n	`file` text NOT NULL,\n	`line` integer NOT NULL,\n	`snippet` text NOT NULL,\n	`dynamic` integer DEFAULT false NOT NULL,\n	`vendored` integer DEFAULT false NOT NULL,\n	`project_id` text,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL,\n	FOREIGN KEY (`endpoint_id`) REFERENCES `share_endpoint`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_share_call_site_endpoint` ON `share_call_site` (`endpoint_id`);--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_share_call_site` ON `share_call_site` (`endpoint_id`,`project`,`file`,`line`);--\x3e statement-breakpoint\nCREATE TABLE `share_destination` (\n	`id` text PRIMARY KEY NOT NULL,\n	`kind` text NOT NULL,\n	`name` text NOT NULL,\n	`host` text NOT NULL,\n	`category` text NOT NULL,\n	`trust` text NOT NULL,\n	`note` text,\n	`network_json` text,\n	`last_seen` integer NOT NULL,\n	`provenance` text DEFAULT 'scan' NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_share_destination_kind` ON `share_destination` (`kind`);--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_share_destination_host` ON `share_destination` (`host`);--\x3e statement-breakpoint\nCREATE TABLE `share_endpoint` (\n	`id` text PRIMARY KEY NOT NULL,\n	`destination_id` text NOT NULL,\n	`method` text NOT NULL,\n	`transport` text NOT NULL,\n	`url` text NOT NULL,\n	`template` integer DEFAULT false NOT NULL,\n	`data_class` text NOT NULL,\n	`last_seen` integer NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL,\n	FOREIGN KEY (`destination_id`) REFERENCES `share_destination`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_share_endpoint_dest` ON `share_endpoint` (`destination_id`);--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_share_endpoint` ON `share_endpoint` (`destination_id`,`method`,`url`);"},{tag:"0004_glorious_mindworm",sql:"CREATE TABLE `available_packs` (\n	`id` text PRIMARY KEY NOT NULL,\n	`namespace` text NOT NULL,\n	`pack_id` text NOT NULL,\n	`version` text NOT NULL,\n	`name` text NOT NULL,\n	`rules_json` text NOT NULL,\n	`updated_at` integer NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_available_packs_pack` ON `available_packs` (`namespace`,`pack_id`);"},{tag:"0005_fast_vindicator",sql:'PRAGMA foreign_keys=OFF;--\x3e statement-breakpoint\nCREATE TABLE `__new_mcp_trust_override` (\n	`id` text PRIMARY KEY NOT NULL,\n	`asset_id` text NOT NULL,\n	`trust` text NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL\n);\n--\x3e statement-breakpoint\nINSERT INTO `__new_mcp_trust_override`("id", "asset_id", "trust", "created_at", "updated_at") SELECT "id", "asset_id", "trust", "created_at", "updated_at" FROM `mcp_trust_override`;--\x3e statement-breakpoint\nDROP TABLE `mcp_trust_override`;--\x3e statement-breakpoint\nALTER TABLE `__new_mcp_trust_override` RENAME TO `mcp_trust_override`;--\x3e statement-breakpoint\nPRAGMA foreign_keys=ON;--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_mcp_trust_override` ON `mcp_trust_override` (`asset_id`);'},{tag:"0006_magenta_flatman",sql:'CREATE TABLE `_pack_write_gate` (\n	`id` integer PRIMARY KEY NOT NULL,\n	`open` integer DEFAULT 0 NOT NULL,\n	CONSTRAINT "ck_pack_write_gate_single_row" CHECK("_pack_write_gate"."id" = 1)\n);\n--\x3e statement-breakpoint\nALTER TABLE `available_packs` ADD `recorded_by` text;--\x3e statement-breakpoint\nINSERT OR IGNORE INTO _pack_write_gate (id, open) VALUES (1, 0);\n--\x3e statement-breakpoint\nCREATE TRIGGER trg_installed_packs_write_gate\nBEFORE UPDATE OF version, name, rules_json ON installed_packs\nWHEN (SELECT open FROM _pack_write_gate WHERE id = 1) IS NOT 1\nBEGIN SELECT RAISE(IGNORE); END;'},{tag:"0007_thick_stick",sql:"CREATE TABLE `finding_resolution` (\n	`id` text PRIMARY KEY NOT NULL,\n	`finding_key` text NOT NULL,\n	`status` text NOT NULL,\n	`method` text NOT NULL,\n	`resolved_at` integer NOT NULL,\n	`evidence` text,\n	`created_at` integer NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_finding_resolution_key` ON `finding_resolution` (`finding_key`);--\x3e statement-breakpoint\nALTER TABLE `findings` ADD `finding_key` text;--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_findings_key` ON `findings` (`finding_key`);"},{tag:"0008_freezing_selene",sql:"ALTER TABLE `findings` ADD `first_detected_at` integer;--\x3e statement-breakpoint\nUPDATE `findings` SET `first_detected_at` = (SELECT `occurred_at` FROM `events` WHERE `events`.`id` = `findings`.`event_id`) WHERE `first_detected_at` IS NULL;"},{tag:"0009_findings_path_expression_index",sql:"-- Custom migration: partial expression index for the resolver's per-path reads.\n--\n-- openAtRestKeysForPath / resolvedAtRestKeysForPath (and the scanner's tier-3\n-- open-key probe) filter at-rest events by\n--   e.kind = 'code_change' AND json_extract(e.metadata, '$.filePath') = :path\n-- once per changed/deleted file on every scan — previously a full events scan\n-- per file. json_extract is deterministic, so SQLite allows it in an index;\n-- the WHERE kind = 'code_change' keeps the index to exactly the rows those\n-- queries can match (in-flight events are never path-addressed).\nCREATE INDEX `idx_events_code_change_path` ON `events` (json_extract(`metadata`, '$.filePath')) WHERE `kind` = 'code_change';\n"},{tag:"0010_events_session_expression_index",sql:"-- Custom migration: partial expression index for session-scoped finding reads.\n--\n-- sessionFindingsCount, the session-scoped listGroupedFindings paths, and the\n-- insert-time session dedup all filter live-capture events by\n--   json_extract(e.metadata, '$.sessionId') = :sessionId\n-- — previously a full findings-join scan with a JSON parse per row. The\n-- IS NOT NULL predicate keeps the index to session-stamped events only (an\n-- equality probe implies non-null, so SQLite still uses it).\nCREATE INDEX `idx_events_session_id` ON `events` (json_extract(`metadata`, '$.sessionId')) WHERE json_extract(`metadata`, '$.sessionId') IS NOT NULL;\n"},{tag:"0011_egress_writer",sql:'-- Stable per-project reconcile key for egress call sites, plus a host-keyed\n-- egress decision override that survives destination pruning.\n--\n-- DROP INDEX IF EXISTS, not a bare DROP: the applier replays a pending\n-- migration\'s non-index statements verbatim, so a store that lost\n-- uq_share_call_site out of band would throw here — and on the plugin hook path\n-- that throw is swallowed fail-open, silently stopping capture.\n--\n-- Existing rows carry the old key\'s discriminator into project_key\n-- (\'legacy:\' || project), so the new unique index is a re-encoding of the old\n-- one and cannot collide on rows the old one allowed. Leaving them on the\n-- column default would collapse two projects\' identical file/line hits onto\n-- one key and abort the whole migration. Writer keys are \'git:\'/\'path:\'-\n-- prefixed, so a backfilled row never collides with a captured one either.\n--\n-- egress_decision_override.destination_id becomes nullable with ON DELETE SET\n-- NULL, which SQLite can only do by rebuilding the table. `host` is ADDed\n-- before the rebuild so the copy has a column to read and so the migration\n-- still presents two probeable columns to the applier\'s evidence check.\nALTER TABLE `share_call_site` ADD `project_key` text DEFAULT \'\' NOT NULL;--\x3e statement-breakpoint\nUPDATE `share_call_site` SET `project_key` = \'legacy:\' || `project`;--\x3e statement-breakpoint\nDROP INDEX IF EXISTS `uq_share_call_site`;--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_share_call_site` ON `share_call_site` (`endpoint_id`,`project_key`,`file`,`line`);--\x3e statement-breakpoint\nCREATE INDEX `idx_share_call_site_project` ON `share_call_site` (`project_key`,`endpoint_id`);--\x3e statement-breakpoint\nALTER TABLE `egress_decision_override` ADD `host` text;--\x3e statement-breakpoint\nPRAGMA foreign_keys=OFF;--\x3e statement-breakpoint\nCREATE TABLE `__new_egress_decision_override` (\n	`id` text PRIMARY KEY NOT NULL,\n	`destination_id` text,\n	`host` text,\n	`decision` text NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL,\n	FOREIGN KEY (`destination_id`) REFERENCES `share_destination`(`id`) ON UPDATE no action ON DELETE set null\n);\n--\x3e statement-breakpoint\nINSERT INTO `__new_egress_decision_override`("id", "destination_id", "host", "decision", "created_at", "updated_at") SELECT "id", "destination_id", "host", "decision", "created_at", "updated_at" FROM `egress_decision_override`;--\x3e statement-breakpoint\nDROP TABLE `egress_decision_override`;--\x3e statement-breakpoint\nALTER TABLE `__new_egress_decision_override` RENAME TO `egress_decision_override`;--\x3e statement-breakpoint\nPRAGMA foreign_keys=ON;--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_egress_decision_override` ON `egress_decision_override` (`destination_id`);--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_egress_decision_override_host` ON `egress_decision_override` (`host`) WHERE `host` IS NOT NULL;\n'},{tag:"0012_handy_the_captain",sql:"ALTER TABLE `inspection_findings` ADD `finding_key` text;--\x3e statement-breakpoint\nALTER TABLE `inspection_findings` ADD `first_detected_at` integer;--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_inspection_findings_key` ON `inspection_findings` (`finding_key`);"},{tag:"0013_legacy_history_backfill_support",sql:"-- Legacy-to-generalized backfill support: the schema the resumable\n-- events/findings -> audit_events/inspection_findings copy needs (the row\n-- copy itself runs as a batched post-migration installer, not here — see\n-- @akasecurity/persistence's migrations.ts), plus the audit_events read-path\n-- indexes replacing the ones the legacy events table carried (0009/0010).\n\n-- Tracks how far the batched, resumable copy has advanced through each legacy\n-- table, by rowid, so a copy interrupted mid-run resumes instead of\n-- restarting, and a completed copy is a cheap no-op on every later open.\nCREATE TABLE `legacy_copy_watermark` (\n	`source` text PRIMARY KEY NOT NULL,\n	`last_rowid` integer DEFAULT 0 NOT NULL\n);\n--\x3e statement-breakpoint\n-- Serves the time-range read family that scans a single event_type across a\n-- start/end window (e.g. the Activity timeline) without a full-table scan.\nCREATE INDEX `idx_audit_type_t` ON `audit_events` (`event_type`,`started_at`);\n--\x3e statement-breakpoint\n-- Partial expression index mirroring `idx_events_code_change_path` (0009) for\n-- the generalized audit_events/attributes pair: file-path reads filter\n-- `event_type = 'code_change' AND json_extract(attributes, '$.file_path') = :path`.\nCREATE INDEX `idx_audit_code_change_path` ON `audit_events` (json_extract(`attributes`, '$.file_path')) WHERE `event_type` = 'code_change';\n--\x3e statement-breakpoint\n-- Synthesizes a stub session root (event_type = 'session', no attributes) for\n-- every legacy `events.metadata.sessionId` that has no audit_events row yet.\n-- audit_events.root_session_id is a self-FK, enforced with foreign-key\n-- checking on, and INSERT OR IGNORE does not suppress a foreign-key violation\n-- (only UNIQUE/PK/NOT NULL/CHECK) — so this must run before the events copy\n-- resolves root_session_id, or every session-scoped row's insert fails.\n-- started_at takes the earliest legacy occurred_at recorded under that\n-- session, so the stub root's own timeline position is never later than\n-- anything it will end up parenting.\nINSERT INTO audit_events (id, event_type, root_session_id, started_at)\nSELECT\n	json_extract(metadata, '$.sessionId'),\n	'session',\n	NULL,\n	min(occurred_at)\nFROM events\nWHERE json_valid(metadata)\n	AND json_extract(metadata, '$.sessionId') IS NOT NULL\n	AND json_extract(metadata, '$.sessionId') NOT IN (SELECT id FROM audit_events)\nGROUP BY json_extract(metadata, '$.sessionId');\n"},{tag:"0014_drop_legacy_events_findings",sql:"-- Custom migration: drops the frozen legacy `events`/`findings` tables\n-- (superseded by audit_events/inspection_definitions/inspection_findings) and\n-- replaces them with read-only views of the same name.\n--\n-- persistence's migrations.ts applies this migration ONLY once the batched\n-- history backfill (see runLegacyHistoryBackfill) has fully drained both\n-- tables, and only after copying the live file aside — see\n-- backupBeforeLegacyDrop in packages/persistence/src/migrations.ts. A store\n-- still mid-copy keeps its real tables and this migration stays pending.\n--\n-- The views exist for skew: the `aka` CLI and the Claude Code plugin update\n-- independently against one shared store, so an older, already-installed\n-- binary can open a store a newer binary already dropped these tables on.\n-- Every already-shipped repository constructor prepares its SQL eagerly at\n-- open time, so a bare \"table not found\" would fail the WHOLE open, not just\n-- a findings-specific read — these views keep `prepare()` succeeding so an\n-- old binary's unrelated features keep working; its own reads stay truthful,\n-- and its rare (already fail-open) writes fail at run time instead.\n--\n-- The 0009/0010 expression indexes existed only over the legacy `events`\n-- table; DROP TABLE below would remove them implicitly, but they are\n-- dropped explicitly first so the intent reads clearly. IF EXISTS so a store\n-- that reached here with an index missing out of band (an adopted-tag store\n-- whose physical index was never built) does not throw a deterministic \"no\n-- such index\" out of the fail-open drop path.\nDROP INDEX IF EXISTS `idx_events_code_change_path`;\n--\x3e statement-breakpoint\nDROP INDEX IF EXISTS `idx_events_session_id`;\n--\x3e statement-breakpoint\n-- `findings.event_id` references `events.id` — drop the child first.\nDROP TABLE `findings`;\n--\x3e statement-breakpoint\nDROP TABLE `events`;\n--\x3e statement-breakpoint\n-- Legacy `events` shape, projected from audit_events: `kind`/`occurred_at`/\n-- `source_tool` become real columns again (source_tool round-trips through\n-- the attributes bag, the only place a capture-typed audit row keeps it);\n-- `metadata` is reconstructed as the old camelCase JSON object from the new\n-- snake_case attributes bag, with `root_session_id` folded back in as\n-- `sessionId` (the one legacy metadata key that became a column, never an\n-- attribute, on the new table). Constrained to the four capture kinds so\n-- structural rows (session/run/tool_call/llm_call/source_lookup/config_scan)\n-- never leak into a legacy reader's result set — the old `events` table\n-- never held them either.\nCREATE VIEW `events` AS\nSELECT\n  id,\n  json_extract(attributes, '$.source_tool') AS source_tool,\n  event_type AS kind,\n  started_at AS occurred_at,\n  content_hash,\n  content,\n  -- Plugin-local bookkeeping column that `ensureSyncedAtColumn` adds to the\n  -- real `events` table at open time. A pre-cutover binary runs that probe on\n  -- EVERY open; without this projection its `columnNames('events')` check\n  -- misses `synced_at` and issues `ALTER TABLE events ADD COLUMN` against this\n  -- view, which SQLite rejects (\"Cannot add a column to a view\") — a hard,\n  -- non-fail-open crash of the whole open, the exact skew failure these views\n  -- exist to prevent. Projecting it (always NULL; no reader consumes it)\n  -- short-circuits that ALTER.\n  NULL AS synced_at,\n  json_object(\n    'sessionId', root_session_id,\n    'repo', json_extract(attributes, '$.repo'),\n    'filePath', json_extract(attributes, '$.file_path'),\n    'toolName', json_extract(attributes, '$.tool_name'),\n    'gitignored', json_extract(attributes, '$.gitignored'),\n    'wholeFile', json_extract(attributes, '$.whole_file'),\n    'model', json_extract(attributes, '$.model'),\n    'turnIndex', json_extract(attributes, '$.turn_index'),\n    'correlationId', json_extract(attributes, '$.correlation_id'),\n    'traceId', json_extract(attributes, '$.trace_id'),\n    'exceptionIds', json_extract(attributes, '$.exception_ids')\n  ) AS metadata\nFROM audit_events\nWHERE event_type IN ('prompt', 'response', 'code_change', 'tool_use');\n--\x3e statement-breakpoint\n-- A plain single-row INSERT (the old writer's shape — no ON CONFLICT) is\n-- accepted by prepare() against a view once an INSTEAD OF INSERT trigger\n-- exists, so it fails at run time instead of at open — landing in the same\n-- fail-open path the caller already wraps its write in.\nCREATE TRIGGER `trg_events_ro`\nINSTEAD OF INSERT ON `events`\nBEGIN SELECT RAISE(ABORT, 'events is read-only; write to audit_events instead'); END;\n--\x3e statement-breakpoint\n-- Legacy `findings` shape: rule_id/category/severity come from the joined\n-- inspection_definitions row (the legacy table inlined them per-row; the\n-- generalized schema normalizes them out into the shared definition). A view\n-- has no rowid of its own, so the underlying table's rowid is re-exposed\n-- explicitly under that name — a legacy reader ordering by `f.rowid` would\n-- otherwise fail to resolve the column at all. Joined to audit_events for the\n-- same four-capture-kind constraint as the events view above (a finding\n-- attached to a tool_call/config_scan row never existed in the legacy table\n-- either — see the persistence findings repository's identical predicate).\nCREATE VIEW `findings` AS\nSELECT\n  f.id AS id,\n  f.rowid AS rowid,\n  f.audit_event_id AS event_id,\n  d.rule_id AS rule_id,\n  d.category AS category,\n  d.severity AS severity,\n  f.span_start AS span_start,\n  f.span_end AS span_end,\n  f.masked_match AS masked_match,\n  f.action_taken AS action_taken,\n  f.confidence AS confidence,\n  f.finding_key AS finding_key,\n  f.first_detected_at AS first_detected_at\nFROM inspection_findings f\nJOIN audit_events e ON e.id = f.audit_event_id\nJOIN inspection_definitions d ON d.id = f.inspection_definition_id\nWHERE e.event_type IN ('prompt', 'response', 'code_change', 'tool_use');\n--\x3e statement-breakpoint\n-- Defense in depth only: SQLite refuses to plan ANY upsert against a view\n-- (\"cannot UPSERT a view\") no matter what trigger exists, so this can never\n-- rescue the real legacy writer, which always used\n-- `ON CONFLICT (finding_key) DO UPDATE` — that statement still fails at\n-- prepare() on an old binary, same as it would with no trigger at all. This\n-- only covers a plain-INSERT shape, should one ever exist.\nCREATE TRIGGER `trg_findings_ro`\nINSTEAD OF INSERT ON `findings`\nBEGIN SELECT RAISE(ABORT, 'findings is read-only; write to inspection_findings instead'); END;\n"},{tag:"0015_busy_vengeance",sql:"CREATE TABLE `secret_vault` (\n	`pointer_id` text PRIMARY KEY NOT NULL,\n	`value_fingerprint` text NOT NULL,\n	`fingerprint_key_version` integer NOT NULL,\n	`key_version` integer NOT NULL,\n	`category` text NOT NULL,\n	`rule_id` text NOT NULL,\n	`masked_match` text NOT NULL,\n	`provider` text,\n	`ciphertext` text NOT NULL,\n	`nonce` text NOT NULL,\n	`auth_tag` text NOT NULL,\n	`occurrence_count` integer DEFAULT 1 NOT NULL,\n	`first_seen` integer NOT NULL,\n	`last_seen` integer NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_secret_vault_value` ON `secret_vault` (`value_fingerprint`);--\x3e statement-breakpoint\nCREATE TABLE `secret_vault_deref` (\n	`id` text PRIMARY KEY NOT NULL,\n	`pointer_id` text NOT NULL,\n	`at` integer NOT NULL,\n	`target` text NOT NULL,\n	`reason` text NOT NULL,\n	`outcome` text NOT NULL,\n	`grant_id` text,\n	`pointer_count` integer DEFAULT 1 NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_secret_vault_deref_pointer` ON `secret_vault_deref` (`pointer_id`);--\x3e statement-breakpoint\nCREATE INDEX `idx_secret_vault_deref_reason_at` ON `secret_vault_deref` (`reason`,`at`);"},{tag:"0016_breezy_zodiak",sql:"ALTER TABLE `exceptions` ADD `capability` text DEFAULT 'suppress' NOT NULL;"},{tag:"0017_rainy_kat_farrell",sql:"CREATE TABLE `secret_vault_sighting` (\n	`id` text PRIMARY KEY NOT NULL,\n	`pointer_id` text NOT NULL,\n	`location` text NOT NULL,\n	`kind` text NOT NULL,\n	`first_seen` integer NOT NULL,\n	`last_seen` integer NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_secret_vault_sighting` ON `secret_vault_sighting` (`pointer_id`,`location`);"},{tag:"0018_serious_tana_nile",sql:"ALTER TABLE `secret_vault` ADD `format_version` integer DEFAULT 2 NOT NULL;"},{tag:"0019_audit_started_at_index",sql:"CREATE INDEX `idx_audit_started_at` ON `audit_events` (`started_at`);"},{tag:"0020_secret_vault_pagination_indexes",sql:"CREATE INDEX `idx_secret_vault_last_seen` ON `secret_vault` (`last_seen`,`pointer_id`);--\x3e statement-breakpoint\nCREATE INDEX `idx_secret_vault_reuse` ON `secret_vault` (`occurrence_count`,`pointer_id`);--\x3e statement-breakpoint\nCREATE INDEX `idx_secret_vault_deref_at` ON `secret_vault_deref` (`at`,`id`);--\x3e statement-breakpoint\nCREATE INDEX `idx_secret_vault_deref_signal` ON `secret_vault_deref` (`at`,`id`) WHERE `reason` NOT IN ('display', 'view-render');"},{tag:"0021_finding_resolution_resolved_at_index",sql:"CREATE INDEX `idx_finding_resolution_resolved_at` ON `finding_resolution` (`resolved_at`);\n"},{tag:"0022_audit_inspection_ms",sql:"ALTER TABLE `audit_events` ADD `inspection_ms` integer GENERATED ALWAYS AS (json_extract(attributes, '$.inspection_ms')) VIRTUAL;"},{tag:"0023_secret_vault_user_authorized",sql:"ALTER TABLE `secret_vault` ADD `user_authorized` integer DEFAULT 0 NOT NULL;"},{tag:"0024_finding_resolution_key_created_index",sql:"DROP INDEX IF EXISTS `idx_finding_resolution_key`;--\x3e statement-breakpoint\nCREATE INDEX `idx_finding_resolution_key_created` ON `finding_resolution` (`finding_key`,`created_at`);"},{tag:"0025_audit_capture_attribute_columns",sql:"ALTER TABLE `audit_events` ADD `source_tool` text GENERATED ALWAYS AS (json_extract(attributes, '$.source_tool')) VIRTUAL;--\x3e statement-breakpoint\nALTER TABLE `audit_events` ADD `repo` text GENERATED ALWAYS AS (json_extract(attributes, '$.repo')) VIRTUAL;--\x3e statement-breakpoint\nALTER TABLE `audit_events` ADD `file_path` text GENERATED ALWAYS AS (json_extract(attributes, '$.file_path')) VIRTUAL;--\x3e statement-breakpoint\nALTER TABLE `audit_events` ADD `tool_name` text GENERATED ALWAYS AS (json_extract(attributes, '$.tool_name')) VIRTUAL;"},{tag:"0026_audit_llm_call_usage_columns",sql:"ALTER TABLE `audit_events` ADD `service_tier` text GENERATED ALWAYS AS (json_extract(attributes, '$.service_tier')) VIRTUAL;--\x3e statement-breakpoint\nALTER TABLE `audit_events` ADD `ephemeral_1h_input_tokens` integer GENERATED ALWAYS AS (json_extract(attributes, '$.ephemeral_1h_input_tokens')) VIRTUAL;--\x3e statement-breakpoint\nALTER TABLE `audit_events` ADD `ephemeral_5m_input_tokens` integer GENERATED ALWAYS AS (json_extract(attributes, '$.ephemeral_5m_input_tokens')) VIRTUAL;--\x3e statement-breakpoint\nALTER TABLE `audit_events` ADD `web_search_requests` integer GENERATED ALWAYS AS (json_extract(attributes, '$.web_search_requests')) VIRTUAL;"},{tag:"0027_audit_llm_usage_index",sql:"CREATE INDEX `idx_audit_llm_usage` ON `audit_events` (`started_at`,`root_session_id`,`provider`,`model`,`service_tier`,`input_tokens`,`output_tokens`,`cache_creation_input_tokens`,`cache_read_input_tokens`,`ephemeral_1h_input_tokens`,`ephemeral_5m_input_tokens`,`web_search_requests`) WHERE event_type = 'llm_call' AND attributes IS NOT NULL;"},{tag:"0028_activity_session_probe_indexes",sql:"CREATE INDEX `idx_audit_session_prompt` ON `audit_events` (`root_session_id`) WHERE event_type = 'prompt';--\x3e statement-breakpoint\nCREATE INDEX `idx_audit_session_share` ON `audit_events` (`root_session_id`) WHERE event_type = 'share';--\x3e statement-breakpoint\nCREATE INDEX `idx_audit_ended_at` ON `audit_events` (`ended_at`,`root_session_id`) WHERE ended_at IS NOT NULL;--\x3e statement-breakpoint\nCREATE INDEX `idx_audit_session_ended` ON `audit_events` (`root_session_id`,`ended_at`) WHERE ended_at IS NOT NULL;--\x3e statement-breakpoint\n-- Expression index for the activity list's turns rollup: a live-captured\n-- session's turns are the DISTINCT `run_key` across its `llm_call` leaves, and\n-- carrying the extracted key in the index answers that count from the index\n-- alone instead of parsing every leaf's attribute bag. Written by hand, as\n-- 0013's `idx_audit_code_change_path` was: drizzle-kit cannot emit an\n-- expression containing a comma, so this index is not declared in sqlite.ts.\nCREATE INDEX `idx_audit_session_run_key` ON `audit_events` (`root_session_id`, json_extract(`attributes`, '$.run_key')) WHERE `event_type` = 'llm_call';\n"},{tag:"0029_audit_capture_rollup_index",sql:"CREATE INDEX `idx_audit_capture_rollup` ON `audit_events` (`event_type`,`started_at`,`repo`,`id`) WHERE event_type IN ('prompt','response','code_change','tool_use');"},{tag:"0030_audit_content_expiry",sql:"ALTER TABLE `audit_events` ADD `content_expired_at` integer;--\x3e statement-breakpoint\nCREATE INDEX `idx_audit_expirable_body` ON `audit_events` (`started_at`) WHERE content IS NOT NULL;"},{tag:"0031_audit_capture_by_time_index",sql:"CREATE INDEX `idx_audit_capture_by_time` ON `audit_events` (`started_at`,`id`,`event_type`,`root_session_id`,`source_tool`,`repo`,`file_path`,`tool_name`) WHERE event_type IN ('prompt','response','code_change','tool_use');"},{tag:"0032_audit_capture_by_id_index",sql:"CREATE INDEX `idx_audit_capture_by_id` ON `audit_events` (`id`,`started_at`,`event_type`,`root_session_id`,`source_tool`,`repo`,`file_path`,`tool_name`) WHERE event_type IN ('prompt','response','code_change','tool_use');"},{tag:"0033_audit_capture_location_index",sql:"CREATE INDEX `idx_audit_capture_location` ON `audit_events` (`repo`,`file_path`,`started_at`,`id`,`event_type`) WHERE event_type IN ('prompt','response','code_change','tool_use');"},{tag:"0034_findings_read_indexes",sql:"CREATE INDEX `idx_inspection_definitions_rule` ON `inspection_definitions` (`rule_id`,`severity`,`category`);--\x3e statement-breakpoint\nCREATE INDEX `idx_inspection_findings_def` ON `inspection_findings` (`inspection_definition_id`,`audit_event_id`);--\x3e statement-breakpoint\nCREATE INDEX `idx_inspection_findings_event_cover` ON `inspection_findings` (`audit_event_id`,`inspection_definition_id`,`action_taken`,`finding_key`,`id`);"},{tag:"0035_share_destination_provider_id",sql:"ALTER TABLE `share_destination` ADD `provider_id` text;"}],f=/^(\d+)([mh])$/;function g(a,b=Date.now()){let c=a.trim().toLowerCase();return"once"===c?{scope:"once",expiresAt:new Date(b+18e5).toISOString(),maxUses:1}:"permanent"===c?{scope:"permanent",expiresAt:null,maxUses:null}:{scope:"temporary",expiresAt:new Date(b+function(a){let b=f.exec(a.trim()),c=b?Number(b[1]):0;if(!b||c<=0)throw Error(`invalid duration '${a}' — use <n>m or <n>h (e.g. 30m, 1h, 24h)`);let d=c*("h"===b[2]?36e5:6e4);if(d>864e5)throw Error(`duration '${a}' exceeds the 24h maximum for --for — use --permanent (revocable any time) for an open-ended grant`);return d}(c)).toISOString(),maxUses:null}}var h=c(74123);let i=h.Ikc({thresholdInputTokens:h.aig().int().positive(),input:h.aig().nonnegative().nullable(),output:h.aig().nonnegative().nullable()});function j(a,b,c){return Object.freeze({input:a,output:b,longContext:null,cacheWrite5m:1.25*a,cacheWrite1h:2*a,cacheRead:c,webSearch:.01})}function k(a,b,c={}){return Object.freeze({input:a,output:b,longContext:void 0===c.longContext?null:Object.freeze(c.longContext),cacheWrite5m:null,cacheWrite1h:null,cacheRead:c.cacheRead??null,webSearch:null})}h.Ikc({input:h.aig().nonnegative(),output:h.aig().nonnegative(),longContext:i.nullable(),cacheWrite5m:h.aig().nonnegative().nullable(),cacheWrite1h:h.aig().nonnegative().nullable(),cacheRead:h.aig().nonnegative().nullable(),webSearch:h.aig().nonnegative().nullable()});let l=Object.freeze({input:0,output:0,longContext:null,cacheWrite5m:0,cacheWrite1h:0,cacheRead:0,webSearch:0}),m=new Map([["standard",1],["batch",.5],["priority",1.5]]);h.k5n(["anthropic","openai","google","meta","mistral","deepseek","alibaba","xai","amazon","cohere","unknown"]),h.k5n(["anthropic","openai","google-ai","mistral","deepseek","xai","cohere","bedrock","vertex","azure","foundry","together","fireworks","groq","openrouter","ollama","local"]),h.k5n(["api","gateway","local"]);let n=new Map([["anthropic","api"],["openai","api"],["google-ai","api"],["mistral","api"],["deepseek","api"],["xai","api"],["cohere","api"],["bedrock","api"],["vertex","api"],["azure","api"],["foundry","api"],["together","gateway"],["fireworks","gateway"],["groq","gateway"],["openrouter","gateway"],["ollama","local"],["local","local"]]);function o(a){return n.get(a)??"api"}let p=new Map([["anthropic","anthropic"],["openai","openai"],["google","google-ai"],["mistral","mistral"],["deepseek","deepseek"],["xai","xai"],["cohere","cohere"]]),q=Object.freeze(["anthropic","amazon","meta","mistral","deepseek","qwen","cohere","ai21","writer","luma","stability"]),r=Object.freeze(["us","eu","apac","au","jp","global"]);class s{constructor(a,b={}){this.entries=[],this.vendor=a,this.defaults=b}model(a,b){var c,d;let e=b.family??this.defaults.family??{id:a,name:b.name},f=!1===b.firstParty?null:(c=this.vendor,p.get(c)??null),g=b.openWeights??this.defaults.openWeights??!1,h=b.region??this.defaults.region??null,i=b.retention??this.defaults.retention??"unknown",j=new Map;for(let a of(null!==f&&j.set(f,Object.freeze({platform:f,hosting:o(f),firstParty:!0,price:b.price??null,retention:i,region:h})),b.on??[])){let{platform:c,price:e,retention:f,region:g}="string"==typeof a?{platform:a}:a,k=(d=this.vendor,p.get(d)===c),m=o(c),n="local"===m;j.set(c,Object.freeze({platform:c,hosting:m,firstParty:k,price:e??(n?l:k?b.price??null:null),retention:f??(n?"on_infrastructure":k?i:"unknown"),region:void 0===g?k?h:null:g}))}let k=b.defaultHosting??this.defaults.defaultHosting??(null===f?"gateway":o(f));if(void 0!==b.price&&![...j.values()].some(a=>a.price===b.price))throw Error(`${a}: a first-party price was declared but no platform can carry it — vendor '${this.vendor}' has no first-party endpoint. Price the serving platform explicitly via the object form of \`on\`.`);let m={id:a,vendor:this.vendor,displayName:b.name,familyId:e.id,familyName:e.name,capability:b.capability??null,contextWindow:b.ctx??null,maxOutputTokens:b.maxOut??null,openWeights:g,aliases:Object.freeze([...b.aliases??[]]),training:this.defaults.training??null,platforms:j,defaultHosting:k,seen:b.seen??"managed"};return Object.freeze(m),Object.freeze(m.aliases),this.entries.push(m),m}models(){return this.entries}}function t(a,b={}){return new s(a,b)}let u=RegExp(`^(?:${r.join("|")})\\.`,"u"),v=RegExp(`^(?:${q.join("|")})\\.`,"u"),w=RegExp(`^(?:${q.join("|")})/`,"iu"),x=/^[a-z0-9][\w.-]*\//iu,y=/-v\d+:\d+$/u,z=/:\d+$/u,A=/@[\w-]+$/u,B=/-\d{8}$/u;function C(a,b){let c,d,e=b.byId.get(a);if(void 0!==e)return{entry:e,canonicalId:a,platform:null,raw:a};let{id:f,platform:g}=(c=a.trim(),d=null,u.test(c)&&(c=c.replace(u,""),d="bedrock"),v.test(c)&&(c=c.replace(v,""),d??="bedrock"),y.test(c)?(c=c.replace(y,""),d??="bedrock"):z.test(c)&&(c=c.replace(z,""),d??="bedrock"),A.test(c)&&(c=c.replace(A,""),d??="vertex"),w.test(c)?c=c.replace(w,""):x.test(c)&&(c=c.replace(x,"")),{id:c,platform:d}),h=b.byId.get(f);if(void 0!==h)return{entry:h,canonicalId:f,platform:g,raw:a};if(B.test(f)){let c=f.replace(B,""),d=b.byId.get(c);if(void 0!==d)return{entry:d,canonicalId:c,platform:g,raw:a}}return{entry:null,canonicalId:a,platform:g,raw:a}}let D=t("anthropic",{family:{id:"claude",name:"Claude"},region:"us",retention:"zero_retention",training:{apiDefault:"no",consumerDefault:"no",consumerControl:"opt-in",source:"https://privacy.claude.com/en/articles/7996868-is-my-data-used-for-model-training"}}),E=["bedrock","vertex","foundry"];D.model("claude-fable-5-1",{name:"Claude Fable 5.1",ctx:1e6,maxOut:128e3,capability:"reasoning",price:j(10,50,.25),on:[...E]}),D.model("claude-fable-5",{name:"Claude Fable 5",capability:"reasoning",price:j(10,50,1),on:[...E]}),D.model("claude-opus-5",{name:"Claude Opus 5",ctx:1e6,maxOut:128e3,capability:"reasoning",price:j(5,25,.5),on:[...E]}),D.model("claude-opus-4-8",{name:"Claude Opus 4.8",capability:"reasoning",price:j(5,25,.5),on:[...E]}),D.model("claude-opus-4-7",{name:"Claude Opus 4.7",capability:"reasoning",price:j(5,25,.5),on:[...E]}),D.model("claude-opus-4-6",{name:"Claude Opus 4.6",capability:"reasoning",price:j(5,25,.5),on:[...E]}),D.model("claude-opus-4-5",{name:"Claude Opus 4.5",capability:"reasoning",price:j(5,25,.5),on:[...E]}),D.model("claude-opus-4-1",{name:"Claude Opus 4.1",capability:"reasoning",price:j(15,75,1.5),on:[...E]}),D.model("claude-sonnet-5",{name:"Claude Sonnet 5",ctx:1e6,maxOut:128e3,capability:"reasoning",price:j(2,10,.2),on:[...E]}),D.model("claude-sonnet-4-6",{name:"Claude Sonnet 4.6",capability:"reasoning",price:j(3,15,.3),on:[...E]}),D.model("claude-sonnet-4-5",{name:"Claude Sonnet 4.5",capability:"reasoning",price:j(3,15,.3),on:[...E]}),D.model("claude-haiku-4-5",{name:"Claude Haiku 4.5",ctx:2e5,maxOut:64e3,capability:null,price:j(1,5,.1),aliases:["claude-haiku-4-5-20251001"],on:[...E]}),D.model("claude-sonnet-3-7",{name:"Claude Sonnet 3.7",on:[...E]});let F={thresholdInputTokens:272e3,input:null,output:null},G=t("openai",{family:{id:"gpt",name:"GPT"},region:"us",retention:"configurable",training:{apiDefault:"no",consumerDefault:"yes",consumerControl:"opt-out",source:"https://developers.openai.com/api/docs/guides/your-data"}}),H=["azure","foundry"];G.model("gpt-5.6-sol",{name:"GPT-5.6 Sol",ctx:105e4,maxOut:128e3,capability:"reasoning",price:k(4,20,{cacheRead:.4,longContext:F}),on:[...H]}),G.model("gpt-5.6-terra",{name:"GPT-5.6 Terra",ctx:105e4,maxOut:128e3,capability:"reasoning",price:k(2,12,{cacheRead:.2,longContext:F}),on:[...H]}),G.model("gpt-5.6-luna",{name:"GPT-5.6 Luna",ctx:105e4,maxOut:128e3,capability:null,price:k(.2,1.2,{cacheRead:.02,longContext:F}),on:[...H]}),G.model("gpt-5.5",{name:"GPT-5.5",ctx:105e4,maxOut:128e3,capability:"reasoning",price:k(5,30,{cacheRead:.5,longContext:F}),on:[...H]}),G.model("gpt-5.4",{name:"GPT-5.4",ctx:105e4,maxOut:128e3,capability:"reasoning",price:k(2.5,15,{cacheRead:.25,longContext:F}),on:[...H]}),G.model("gpt-5.4-mini",{name:"GPT-5.4 mini",ctx:4e5,maxOut:128e3,capability:null,price:k(.75,4.5,{cacheRead:.075}),on:[...H]}),G.model("gpt-5.4-nano",{name:"GPT-5.4 nano",ctx:4e5,maxOut:128e3,capability:null,price:k(.2,1.25,{cacheRead:.02}),on:[...H]}),G.model("gpt-5.3-codex",{name:"GPT-5.3 Codex",ctx:4e5,maxOut:128e3,capability:"code",price:k(1.75,14,{cacheRead:.175}),on:[...H]}),G.model("gpt-5.1",{name:"GPT-5.1",ctx:4e5,maxOut:128e3,capability:"reasoning",price:k(1.25,10,{cacheRead:.125}),on:[...H]}),G.model("gpt-5",{name:"GPT-5",ctx:4e5,maxOut:128e3,capability:"reasoning",price:k(1.25,10,{cacheRead:.125}),on:[...H]}),G.model("gpt-5-mini",{name:"GPT-5 mini",ctx:4e5,capability:null,price:k(.25,2,{cacheRead:.025}),on:[...H]}),G.model("gpt-5-nano",{name:"GPT-5 nano",ctx:4e5,maxOut:128e3,capability:null,price:k(.05,.4,{cacheRead:.005}),on:[...H]}),G.model("gpt-4.1",{name:"GPT-4.1",price:k(2,8,{cacheRead:.5}),on:[...H]}),G.model("gpt-4o",{name:"GPT-4o",price:k(2.5,10,{cacheRead:1.25}),on:[...H]}),G.model("gpt-4o-mini",{name:"GPT-4o mini",price:k(.15,.6,{cacheRead:.075}),on:[...H]}),G.model("gpt-4-turbo",{name:"GPT-4 Turbo",seen:"discovered",price:k(10,30),aliases:["gpt-4-turbo-2024-04-09"],on:[...H]}),G.model("o3",{name:"o3",capability:"reasoning",price:k(2,8,{cacheRead:.5}),on:[...H]}),G.model("gpt-oss-120b",{name:"GPT-OSS 120B",openWeights:!0,firstParty:!1,retention:"unknown",defaultHosting:"local",on:["together","fireworks","groq","openrouter","bedrock","ollama","local"]}),G.model("gpt-oss-20b",{name:"GPT-OSS 20B",openWeights:!0,firstParty:!1,retention:"unknown",defaultHosting:"local",on:["together","fireworks","groq","openrouter","ollama","local"]});let I=t("google",{family:{id:"gemini",name:"Gemini"},region:"us",retention:"configurable",training:{apiDefault:"no",consumerDefault:"yes",consumerControl:"none",source:"https://ai.google.dev/gemini-api/terms"}});I.model("gemini-3.7-flash",{name:"Gemini 3.7 Flash",capability:null,price:k(.75,3.75),on:["vertex"]}),I.model("gemini-3.6-flash",{name:"Gemini 3.6 Flash",capability:null,price:k(.75,3.75),on:["vertex"]}),I.model("gemini-3.5-flash",{name:"Gemini 3.5 Flash",capability:null,price:k(1.5,9),on:["vertex"]}),I.model("gemini-3.5-flash-lite",{name:"Gemini 3.5 Flash Lite",capability:null,price:k(.3,2.5),on:["vertex"]}),I.model("gemini-3.1-pro-preview",{name:"Gemini 3.1 Pro Preview",capability:"reasoning",price:k(2,12,{longContext:{thresholdInputTokens:2e5,input:4,output:18}}),on:["vertex"]}),I.model("gemini-2.5-pro",{name:"Gemini 2.5 Pro",capability:"reasoning",price:k(1.25,10,{longContext:{thresholdInputTokens:2e5,input:2.5,output:15}}),on:["vertex"]}),I.model("gemini-2.5-flash",{name:"Gemini 2.5 Flash",capability:null,price:k(.3,2.5),on:["vertex"]}),I.model("gemini-2.5-flash-lite",{name:"Gemini 2.5 Flash Lite",capability:null,price:k(.1,.4),on:["vertex"]}),I.model("gemini-1-5-pro",{name:"Gemini 1.5 Pro",on:["vertex"]}),I.model("gemini-1-5-flash",{name:"Gemini 1.5 Flash",on:["vertex"]});let J=t("xai",{family:{id:"grok",name:"Grok"},region:"us",retention:"configurable",training:{apiDefault:"no",consumerDefault:"unknown",consumerControl:"unknown",source:"https://docs.x.ai/developers/faq/security"}});J.model("grok-4.6",{name:"Grok 4.6",ctx:5e5,capability:"reasoning",price:k(2,6,{cacheRead:.5,longContext:{thresholdInputTokens:2e5,input:4,output:12}}),on:["bedrock"]}),J.model("grok-4.5",{name:"Grok 4.5",ctx:5e5,capability:"reasoning",price:k(2,6,{cacheRead:.3,longContext:{thresholdInputTokens:2e5,input:4,output:12}})}),J.model("grok-4.3",{name:"Grok 4.3",ctx:1e6,capability:"reasoning",price:k(1.25,2.5,{cacheRead:.2,longContext:{thresholdInputTokens:2e5,input:2.5,output:5}}),on:["bedrock"]}),J.model("grok-build-0.1",{name:"Grok Build 0.1",ctx:256e3,capability:"code",price:k(1,2,{cacheRead:.2,longContext:{thresholdInputTokens:2e5,input:2,output:4}})});let K=t("deepseek",{family:{id:"deepseek",name:"DeepSeek"},region:"cn",retention:"configurable",training:{apiDefault:"yes",consumerDefault:"yes",consumerControl:"opt-out",source:"https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html"}});K.model("deepseek-v4-flash",{name:"DeepSeek V4 Flash",ctx:1e6,capability:null,price:k(.44,1.32,{cacheRead:.014}),on:["bedrock","together","fireworks","openrouter","ollama","local"]}),K.model("deepseek-v4-pro",{name:"DeepSeek V4 Pro",ctx:1e6,capability:"reasoning",price:k(1.32,3.96,{cacheRead:.044}),on:["bedrock","together","fireworks","openrouter"]}),K.model("deepseek-r1",{name:"DeepSeek R1",seen:"discovered",capability:"reasoning",openWeights:!0,defaultHosting:"local",on:["bedrock","together","fireworks","openrouter","ollama","local"]});let L=t("cohere",{family:{id:"command",name:"Command"},region:"us",retention:"configurable",training:{apiDefault:"unknown",consumerDefault:"unknown",consumerControl:"opt-out",source:"https://cohere.com/security"}});L.model("command-a-plus-05-2026",{name:"Command A+",ctx:128e3,maxOut:64e3,on:["bedrock"]}),L.model("command-a-03-2025",{name:"Command A",ctx:256e3,maxOut:8e3,on:["bedrock"]}),L.model("command-a-reasoning-08-2025",{name:"Command A Reasoning",ctx:256e3,maxOut:32e3,capability:"reasoning"}),L.model("command-r-plus-08-2024",{name:"Command R+",ctx:128e3,maxOut:4e3,price:k(2.5,10),aliases:["command-r-plus"],on:["bedrock"]});let M=t("meta",{family:{id:"llama",name:"Llama"},openWeights:!0,retention:"unknown",defaultHosting:"local"}),N=["bedrock","together","fireworks","groq","openrouter","ollama","local"];M.model("llama-3-3-70b",{name:"Llama 3.3 70B",ctx:128e3,on:[...N]}),M.model("llama-3-1-70b",{name:"Llama 3.1 70B",ctx:128e3,on:[...N]}),M.model("llama-3-1-8b",{name:"Llama 3.1 8B",ctx:128e3,on:[...N]});let O=t("alibaba",{family:{id:"qwen",name:"Qwen"},openWeights:!0,retention:"unknown",defaultHosting:"local"});O.model("qwen-3-235b",{name:"Qwen 3 235B",on:[...N]}),O.model("qwen-3-coder-480b",{name:"Qwen 3 Coder 480B",capability:"code",on:[...N]});let P=t("amazon",{family:{id:"nova",name:"Nova"},retention:"configurable"});P.model("nova-2-lite",{name:"Nova 2 Lite",ctx:1e6,maxOut:64e3,aliases:["nova-2-lite-v1:0"],on:["bedrock"]});let Q=t("mistral",{family:{id:"mistral",name:"Mistral"},openWeights:!0,retention:"unknown",defaultHosting:"local"});Q.model("mixtral-8x7b",{name:"Mixtral 8x7B",seen:"discovered",on:[...N]});let R=function(a){let b=new Map;for(let c of a)b.set(c.id,c);for(let c of a)for(let a of c.aliases)b.has(a)||b.set(a,c);return{byId:b,entries:Object.freeze([...a])}}(Object.freeze([...D.models(),...G.models(),...I.models(),...J.models(),...K.models(),...L.models(),...Q.models(),...M.models(),...O.models(),...P.models()]));h.k5n(["reasoning","code"]),h.k5n(["zero_retention","no_storage","configurable","on_device","on_infrastructure","unknown"]),h.k5n(["managed","discovered"]);let S=h.k5n(["yes","no","unknown"]),T=h.k5n(["opt-in","opt-out","none","unknown"]);h.Ikc({apiDefault:S,consumerDefault:S,consumerControl:T,source:h.YjP().nullable()});let U=h.k5n(["api","consumer","enterprise","unknown"]);function V(a){return new Date(a).getTime()}function W(a){return new Date(a).toISOString()}h.Ikc({tier:U,controlExercised:h.zMY().nullable()}),Object.freeze({tier:"unknown",controlExercised:null});let X=new Map([["anthropic","anthropic"],["openai","openai"],["google","google-ai"],["google-ai","google-ai"],["bedrock","bedrock"],["vertex","vertex"],["azure","azure"],["foundry","foundry"],["mistral","mistral"],["deepseek","deepseek"],["xai","xai"],["cohere","cohere"],["together","together"],["fireworks","fireworks"],["groq","groq"],["openrouter","openrouter"],["ollama","ollama"],["local","local"]]);function Y(a){return X.get(a.trim().toLowerCase())??null}function Z(a){let b=Y(a);return null!==b&&"local"===o(b)}Object.freeze(["gateway","unknown","cli","api","chatgpt","claude-ai"]);let $={normalizeModelId(a,b){let c=a.trim().toLowerCase();if(Z(c))return{provider:c,model:"*"};let d=C(b,R);return{provider:c,model:d.entry?.id??b}},costFor({provider:a,model:b,usage:c}){let d=function(a,b){if(Z(a))return l;let c=C(b,R);if(null===c.entry)return null;let d=c.platform??Y(a);return null===d?null:c.entry.platforms.get(d)?.price??null}(a,b);return null===d?null:function(a,b){var c;let d=[[b.cacheWrite1hTokens??0,a.cacheWrite1h],[b.cacheWrite5mTokens??0,a.cacheWrite5m],[b.cacheReadTokens??0,a.cacheRead]],e=null!==a.longContext&&(b.inputTokens??0)>a.longContext.thresholdInputTokens?a.longContext:null;if(null!==e&&(null===e.input||null===e.output))return null;let f=e?.input??a.input,g=e?.output??a.output,h=(b.inputTokens??0)*f+(b.outputTokens??0)*g;for(let[a,b]of d)if(0!==a){if(null===b)return null;h+=a*b}let i=h/1e6*(void 0===(c=b.serviceTier)?1:m.get(c)??1),j=b.webSearchRequests??0;return j>0&&null===a.webSearch?null:i+j*(a.webSearch??0)}(d,c)}};new Intl.NumberFormat("en-US",{notation:"compact",maximumFractionDigits:1});let _=a=>a??0;function aa(a,b){let c=new Map;for(let{sessionId:d,attributes:e}of a){let a=e.provider??"unknown",f=e.model??"unknown",g=`${a} ${f}`,h=c.get(d);void 0===h&&(h=new Map,c.set(d,h));let i=h.get(g);void 0===i&&(i={provider:a,model:f,input:0,output:0,cacheCreation:0,cacheRead:0,costUsd:0,priced:!1},h.set(g,i)),i.input+=_(e.input_tokens),i.output+=_(e.output_tokens),i.cacheCreation+=_(e.cache_creation_input_tokens),i.cacheRead+=_(e.cache_read_input_tokens);let j=b.costFor({provider:a,model:f,usage:function(a){let b={inputTokens:_(a.input_tokens),outputTokens:_(a.output_tokens),cacheWrite1hTokens:_(a.ephemeral_1h_input_tokens),cacheWrite5mTokens:_(a.ephemeral_5m_input_tokens),cacheReadTokens:_(a.cache_read_input_tokens),webSearchRequests:_(a.web_search_requests)};return void 0!==a.service_tier&&(b.serviceTier=a.service_tier),b}(e)});null!==j&&(i.costUsd+=j,i.priced=!0)}let d=[];for(let[a,b]of c){let c=[],e=0,f=0,g=!1,h=!1;for(let d of b.values()){let b=d.input+d.output+d.cacheCreation+d.cacheRead;e+=b;let i=d.priced?d.costUsd:null;null===i?h=!0:(g=!0,f+=i),c.push({sessionId:a,model:d.model,provider:d.provider,inputTokens:d.input,outputTokens:d.output,cacheCreation:d.cacheCreation,cacheRead:d.cacheRead,totalTokens:b,estimatedCostUsd:i})}c.sort((a,b)=>b.totalTokens-a.totalTokens),d.push({sessionId:a,rollups:c,totalTokens:e,estimatedCostUsd:g?f:null,costIsPartial:h})}return d.sort((a,b)=>b.totalTokens-a.totalTokens),d}var ab=c(51938),ac=c(36688);let ad={ClaudeCode:"claudecode",Cursor:"cursor",Copilot:"copilot",Codex:"codex",Antigravity:"antigravity",Windsurf:"windsurf",ClaudeDesktop:"claudedesktop",ChatGpt:"chatgpt",ClaudeAi:"claudeai",Api:"api",AiTcSdk:"ai-tc-sdk"},ae=h.k5n(ad).meta({id:"Harness"}),af={ClaudeCode:"claude-code",ClaudeDesktop:"claude-desktop",Cursor:"cursor",ChatGpt:"chatgpt",ClaudeAi:"claude-ai",Copilot:"github-copilot",Codex:"codex",Antigravity:"antigravity",Cli:"cli",Unknown:"unknown",AiTcSdk:"ai-tc-sdk"},ag=h.k5n(af).meta({id:"SourceTool"}),ah=ag.extract(["ChatGpt","ClaudeAi"]),ai={[af.ClaudeCode]:ad.ClaudeCode,[af.ClaudeDesktop]:ad.ClaudeDesktop,[af.Copilot]:ad.Copilot,[af.Cursor]:ad.Cursor,[af.ChatGpt]:ad.ChatGpt,[af.Codex]:ad.Codex,[af.Antigravity]:ad.Antigravity,[af.ClaudeAi]:ad.ClaudeAi,[af.AiTcSdk]:ad.AiTcSdk},aj=h.k5n(["pii","financial","secret","phi","code_context","code_flaw","custom","config"]).meta({id:"DetectionCategory"}),ak=h.k5n(["critical","high","medium","low"]).meta({id:"Severity"}),al=h.k5n(["warn","redact","block","allow","log"]).meta({id:"ActionTaken"}),am=al.options,an=h.Ikc({start:h.aig().int().nonnegative(),end:h.aig().int().nonnegative()}).meta({id:"Span"});h.Ikc({id:h.OsD(),eventId:h.OsD(),ruleId:h.YjP(),category:aj,severity:ak,span:an,maskedMatch:h.YjP(),actionTaken:al,confidence:h.aig().min(0).max(1)}).meta({id:"Finding"}).meta({id:"DetectedFinding"});let ao=h.k5n(["blocked","redacted","warned","allowed","quarantined","monitored"]).meta({id:"FindingAction"}),ap=ae.extract(["ClaudeCode","ClaudeDesktop","Cursor","Copilot","ChatGpt","ClaudeAi","Codex","Antigravity","Api","AiTcSdk"]).meta({id:"FindingProvider"}),aq=h.k5n(["secret","pii","source_code","code_flaw","external_share","mcp_server","customer_data","financial","phi","custom"]).meta({id:"FindingCategory"});h.k5n(["in-flight","at-rest"]).meta({id:"FindingOrigin"});let ar=h.k5n(["open","handled","resolved","dismissed"]).meta({id:"FindingStatus"}),as=h.k5n(["deployment_refused","payload_invalid","detached_undelivered"]).meta({id:"SyncFailureReason"}),at=h.k5n(["sent","queued","not_sent","never_offered","local_scan"]).meta({id:"FindingDeliveryState"}),au=h.Ikc({state:at,at:ab.w$().optional(),reason:as.optional()}).meta({id:"FindingDelivery"}),av=h.k5n(["enforced-in-flight","fixed-at-source","exception","acknowledged","false-positive","redetected"]).meta({id:"ResolutionMethod"}),aw=h.Ikc({maskedValue:h.YjP(),contextPrefix:h.YjP()}).meta({id:"FindingMatch"}),ax=h.Ikc({id:h.YjP(),name:h.YjP().nullable()}).meta({id:"FindingDetectionRef"}),ay=h.Ikc({id:h.YjP(),name:h.YjP()}).meta({id:"FindingPolicyRef"}),az=h.Ikc({id:h.YjP(),name:h.YjP()}).meta({id:"FindingUser"}),aA=h.Ikc({id:h.YjP(),provider:ap,repo:h.YjP(),file:h.YjP(),user:az.optional(),toolName:h.YjP().optional(),action:ao,detectedAt:ab.w$(),confidence:h.aig().min(0).max(1),status:ar.optional(),eventId:h.YjP().optional(),sessionId:h.YjP().optional(),delivery:au.optional()}).meta({id:"FindingInstance"}),aB=h.Ikc({id:h.YjP(),category:aq,subtype:h.YjP(),severity:ak,match:aw,detection:ax,policy:ay,instanceCount:h.aig().int().nonnegative(),providers:h.YOg(ap),aggregateAction:ao.nullable(),latestDetectedAt:ab.w$(),instances:h.YOg(aA),status:ar.optional(),users:h.YOg(az).optional()}).meta({id:"FindingGroup"});h.Ikc({findings:h.aig().int().nonnegative(),groups:h.aig().int().nonnegative(),bySeverity:h.Ikc({critical:h.aig().int().nonnegative(),high:h.aig().int().nonnegative(),medium:h.aig().int().nonnegative(),low:h.aig().int().nonnegative()})}).meta({id:"FindingStats"});let aC=h.Ikc({value:h.YjP(),count:h.aig().int().nonnegative()}).meta({id:"FindingFacetItem"}),aD=h.Ikc({severity:h.YOg(aC),subtype:h.YOg(aC),provider:h.YOg(aC),action:h.YOg(aC),status:h.YOg(aC),tool:h.YOg(aC).optional(),deployment:h.YOg(aC).optional()}).meta({id:"FindingFacets"}),aE=aB.omit({instances:!0,match:!0}).meta({id:"FindingTypeSummary"}),aF=50,aG=h.Ikc({severity:h.YOg(ak).optional(),subtype:h.YOg(h.YjP()).optional(),provider:h.YOg(ap).optional(),action:h.YOg(ao).optional(),status:h.YOg(ar).optional(),q:h.YjP().optional(),sessionId:h.YjP().optional(),from:ab.w$().optional(),includeId:h.YjP().optional(),limit:ac.ai().int().min(1).max(100).optional(),cursor:h.YjP().optional()});h.Ikc({totals:h.Ikc({findings:h.aig().int().nonnegative(),types:h.aig().int().nonnegative()}),facets:aD,items:h.YOg(aE),nextCursor:h.YjP().nullable(),sessionFirings:h.g1P(h.YjP(),h.aig().int().nonnegative()).optional()}).meta({id:"ListFindingTypesResponse"}),h.Ikc({action:ao.exclude(["quarantined"]),instanceId:h.YjP().optional()}).meta({id:"ApplyFindingActionRequest"}),aB.meta({id:"ApplyFindingActionResponse"}),h.Ikc({severity:h.YOg(ak).optional(),subtype:h.YOg(h.YjP()).optional(),provider:h.YOg(ap).optional(),action:h.YOg(ao).optional(),q:h.YjP().optional(),format:h.k5n(["csv","json"]).optional()});let aH=aA.extend({groupId:h.YjP(),category:aq,subtype:h.YjP(),severity:ak,match:aw,detection:ax,policy:ay}).meta({id:"FindingInstanceDetail"}),aI=50,aJ=h.Ikc({severity:h.YOg(ak).optional(),subtype:h.YOg(h.YjP()).optional(),provider:h.YOg(ap).optional(),action:h.YOg(ao).optional(),status:h.YOg(ar).optional(),tool:h.YOg(h.YjP()).optional(),deployment:h.YOg(at).optional(),repo:h.YjP().optional(),file:h.YjP().optional(),q:h.YjP().optional(),sessionId:h.YjP().optional(),from:ab.w$().optional(),limit:ac.ai().int().min(1).max(200).optional(),cursor:h.YjP().optional()});h.Ikc({totals:h.Ikc({findings:h.aig().int().nonnegative()}),facets:aD,items:h.YOg(aH),nextCursor:h.YjP().nullable()}).meta({id:"ListFindingInstancesResponse"}),h.Ikc({items:h.YOg(aH),nextCursor:h.YjP().nullable()}).meta({id:"ListFindingInstancesPage"});let aK=h.Ikc({id:h.YjP(),repo:h.YjP(),file:h.YjP(),instanceCount:h.aig().int().nonnegative(),maxSeverity:ak,latestDetectedAt:ab.w$(),status:ar.optional(),ruleIds:h.YOg(h.YjP())}).meta({id:"FindingLocationSummary"}),aL=50,aM=h.Ikc({severity:h.YOg(ak).optional(),subtype:h.YOg(h.YjP()).optional(),provider:h.YOg(ap).optional(),action:h.YOg(ao).optional(),status:h.YOg(ar).optional(),tool:h.YOg(h.YjP()).optional(),deployment:h.YOg(at).optional(),q:h.YjP().optional(),sessionId:h.YjP().optional(),from:ab.w$().optional(),includeId:h.YjP().optional(),limit:ac.ai().int().min(1).max(100).optional(),cursor:h.YjP().optional()});h.Ikc({totals:h.Ikc({findings:h.aig().int().nonnegative(),locations:h.aig().int().nonnegative()}),facets:aD,items:h.YOg(aK),nextCursor:h.YjP().nullable()}).meta({id:"ListFindingLocationsResponse"});let aN=h.k5n(["host","harness","user","skill","hook","mcp_server","config_file"]).meta({id:"InventoryObjectType"}),aO=h.k5n(["session","run","tool_call","llm_call","source_lookup","prompt","response","code_change","tool_use","model_refusal","request_decision","config_scan","capture_status"]).meta({id:"AuditEventType"}),aP=h.g1P(h.YjP(),h.L5J());h.Ikc({host_name:h.YjP().optional(),os:h.YjP().optional(),os_version:h.YjP().optional(),arch:h.YjP().optional()}).catchall(h.L5J()),h.Ikc({harness_version:h.YjP().optional(),interface:h.YjP().optional()}).catchall(h.L5J()),h.Ikc({display_name:h.YjP().optional(),email:h.YjP().optional()}).catchall(h.L5J()),h.Ikc({source:h.YjP().optional(),version:h.YjP().optional(),description:h.YjP().optional(),updated_at:h.YjP().optional(),scope:h.YjP().optional(),plugin_name:h.YjP().optional()}).catchall(h.L5J()),h.Ikc({event:h.YjP().optional(),matcher:h.YjP().optional(),command:h.YjP().optional(),scope:h.YjP().optional(),plugin_name:h.YjP().optional(),timeout:h.aig().optional()}).catchall(h.L5J()),h.Ikc({scope:h.YjP().optional(),transport:h.YjP().optional(),command:h.YjP().optional(),url:h.YjP().optional(),env_keys:h.YOg(h.YjP()).optional(),plugin_name:h.YjP().optional(),marketplace:h.YjP().optional(),project:h.YjP().optional()}).catchall(h.L5J()),h.Ikc({kind:h.YjP().optional(),detail:h.YjP().optional(),scope:h.YjP().optional(),updated_at:h.YjP().optional(),entry_count:h.aig().optional()}).catchall(h.L5J());let aQ=h.Ikc({model:h.YjP().optional(),provider:h.YjP().optional(),input_tokens:h.aig().int().nonnegative().optional(),output_tokens:h.aig().int().nonnegative().optional(),cache_creation_input_tokens:h.aig().int().nonnegative().optional(),cache_read_input_tokens:h.aig().int().nonnegative().optional(),ephemeral_1h_input_tokens:h.aig().int().nonnegative().optional(),ephemeral_5m_input_tokens:h.aig().int().nonnegative().optional(),web_search_requests:h.aig().int().nonnegative().optional(),web_fetch_requests:h.aig().int().nonnegative().optional(),service_tier:h.YjP().optional(),stop_reason:h.YjP().optional(),message_id:h.YjP().optional(),uuid:h.YjP().optional(),parent_uuid:h.YjP().optional(),run_key:h.YjP().optional()}).catchall(h.L5J());h.Ikc({sessionId:h.YjP().min(1),messageId:h.YjP().min(1),parentId:h.YjP().min(1),rootSessionId:h.YjP().min(1),startedAt:ab.w$(),attributes:aQ});let aR=h.Ikc({tool_name:h.YjP().optional(),tool_use_id:h.YjP().optional(),target:h.YjP().optional(),is_error:h.zMY().optional(),input_size:h.aig().int().nonnegative().optional(),output_size:h.aig().int().nonnegative().optional(),uuid:h.YjP().optional(),parent_uuid:h.YjP().optional(),run_key:h.YjP().optional()}).catchall(h.L5J());h.Ikc({source_tool:h.YjP().optional(),file_path:h.YjP().optional(),repo:h.YjP().optional(),tool_name:h.YjP().optional(),gitignored:h.zMY().optional(),whole_file:h.zMY().optional(),correlation_id:h.uRe().optional(),trace_id:h.YjP().regex(/^[0-9a-f]{32}$/).optional(),exception_ids:h.YOg(h.OsD()).optional(),message_id:h.YjP().optional(),conversation_id:h.YjP().optional(),inspection_ms:h.aig().int().nonnegative().optional(),redact_degraded_to:al.optional()}).catchall(h.L5J());let aS=h.Ikc({source_tool:h.YjP().optional(),patched:h.zMY().optional(),live:h.zMY().optional(),blind:h.zMY().optional(),sends_seen_dom:h.aig().int().nonnegative().optional(),exchanges_seen_net:h.aig().int().nonnegative().optional(),parse_failures:h.aig().int().nonnegative().optional(),unparsed_bodies:h.aig().int().nonnegative().optional(),shape_misses:h.YOg(h.YjP()).optional(),conversation_endpoints:h.aig().int().nonnegative().optional(),closed:h.zMY().optional(),enforcement:h.YjP().optional()}).catchall(h.L5J()),aT=h.Ikc({ruleId:h.YjP().min(1),ruleName:h.YjP(),ruleVersion:h.YjP().min(1),category:aj,severity:ak,span:an,maskedMatch:h.YjP(),actionTaken:al,confidence:h.aig().min(0).max(1)});h.Ikc({sessionId:h.YjP().min(1),toolUseId:h.YjP().min(1),parentId:h.YjP().min(1),rootSessionId:h.YjP().min(1),startedAt:ab.w$(),attributes:aR,inspections:h.YOg(aT).default([])});let aU=h.Ikc({objectType:aN,identityKey:h.YjP().min(1),location:h.YjP().optional(),title:h.YjP().optional(),hostId:h.YjP().optional(),attributes:aP.default({})}).meta({id:"InventoryInput"}),aV=h.Ikc({url:h.YjP().min(1),name:h.YjP().optional(),attributes:aP.default({})}).meta({id:"SourceProjectInput"}),aW=h.Ikc({id:h.YjP().min(1),eventType:aO,startedAt:ab.w$(),endedAt:ab.w$().optional(),parentId:h.YjP().optional(),rootSessionId:h.YjP().optional(),hostId:h.YjP().optional(),harnessId:h.YjP().optional(),sourceProjectId:h.YjP().optional(),severity:ak.optional(),priority:h.YjP().optional(),content:h.YjP().optional(),contentHash:h.YjP().optional(),attributes:aP.optional()}).meta({id:"AuditEventInput"});h.Ikc({class:h.YjP().min(1),label:h.YjP().optional(),attributes:aP.optional()});let aX=h.Ikc({ruleId:h.YjP().min(1),version:h.YjP().min(1),name:h.YjP(),category:aj,severity:ak,definition:h.YjP()});h.Ikc({id:h.YjP().min(1),auditEventId:h.YjP().min(1),inspectionDefinitionId:h.YjP().min(1),classifiedDataId:h.YjP().optional(),span:an,maskedMatch:h.YjP(),actionTaken:al,confidence:h.aig().min(0).max(1),findingKey:h.YjP().optional(),firstDetectedAt:ab.w$().optional()}),h.Ikc({host:aU.optional(),harness:aU.optional(),project:aV.optional()}).meta({id:"InventoryContext"});let aY=h.Ikc({hostId:h.YjP().optional(),harnessId:h.YjP().optional(),accountId:h.YjP().optional(),sourceProjectId:h.YjP().optional()}).meta({id:"ResolvedInventory"});h.Ikc({hosts:h.YOg(h.YjP()),harnesses:h.YOg(h.YjP()),osVersions:h.YOg(h.YjP()),projects:h.YOg(h.YjP())}).meta({id:"InventoryFacets"});let aZ=h.Ikc({sessionId:h.YjP(),model:h.YjP(),provider:h.YjP(),inputTokens:h.aig().int().nonnegative(),outputTokens:h.aig().int().nonnegative(),cacheCreation:h.aig().int().nonnegative(),cacheRead:h.aig().int().nonnegative(),totalTokens:h.aig().int().nonnegative(),estimatedCostUsd:h.aig().nullable()}).meta({id:"TokenRollup"});h.Ikc({sessionId:h.YjP(),rollups:h.YOg(aZ),totalTokens:h.aig().int().nonnegative(),estimatedCostUsd:h.aig().nullable(),costIsPartial:h.zMY()});let a$=h.Ikc({provider:h.YjP(),model:h.YjP(),inputTokens:h.aig().int().nonnegative(),outputTokens:h.aig().int().nonnegative(),cacheTokens:h.aig().int().nonnegative(),totalTokens:h.aig().int().nonnegative(),estimatedCostUsd:h.aig().nullable()});function a_(a){return JSON.stringify(a)}h.Ikc({models:h.YOg(a$),sessionCount:h.aig().int().nonnegative(),totalTokens:h.aig().int().nonnegative(),estimatedCostUsd:h.aig(),costIsPartial:h.zMY()});let a0=h.k5n(["active","completed","interrupted","error"]),a1=h.k5n(["session","prompt","response","tool","hook","detection","share","permission","commit","error","active"]),a2=h.k5n(["detections","shares","inventory"]),a3=h.Ikc({id:h.YjP(),occurredAt:ab.w$(),kind:a1,title:h.YjP(),detail:h.YjP(),tool:h.YjP().nullable(),severity:ak.nullable(),link:a2.nullable(),targetId:h.YjP().nullable(),internal:h.zMY(),flagged:h.zMY(),bodyExpired:h.zMY().default(!1)}).meta({id:"ActivityAuditEvent"}),a4=h.Ikc({id:h.YjP(),harness:ae,title:h.YjP(),project:h.YjP(),repo:h.YjP(),branches:h.YOg(h.YjP()),startedAt:ab.w$(),endedAt:ab.w$().nullable(),status:a0,turns:h.aig().int().nonnegative(),findings:h.aig().int().nonnegative(),shares:h.aig().int().nonnegative()}).meta({id:"ActivitySessionSummary"});a4.extend({host:h.YjP(),cwd:h.YjP(),models:h.YOg(h.YjP()),version:h.YjP(),tokens:aZ,tools:h.g1P(h.YjP(),h.aig().int().nonnegative()),files:h.YOg(h.YjP()),commits:h.aig().int().nonnegative(),events:h.YOg(a3)}).meta({id:"ActivitySession"}),h.Ikc({tz:h.YjP().optional()});let a5=h.Ikc({sessionsToday:h.aig().int().nonnegative(),liveNow:h.aig().int().nonnegative(),toolCallsToday:h.aig().int().nonnegative(),findingsToday:h.aig().int().nonnegative(),egressToday:h.aig().int().nonnegative()}).meta({id:"GetActivityStatsResponse"});h.Ikc({q:h.YjP().optional(),harness:h.YOg(ae).optional(),from:h.KCZ([ab.p6(),ab.w$()]).optional(),to:h.KCZ([ab.p6(),ab.w$()]).optional(),excludeEmpty:h.uEf().optional(),limit:ac.ai().int().min(1).max(100).default(50),cursor:h.YjP().optional()});let a6=h.Ikc({items:h.YOg(a4),nextCursor:h.YjP().nullable(),emptyCount:h.aig().int().nonnegative()}).meta({id:"ListActivitySessionsResponse"});h.Ikc({limit:ac.ai().int().min(1).max(500).default(100),cursor:h.YjP().optional(),order:h.k5n(["asc","desc"]).default("asc")}),h.Ikc({items:h.YOg(a3),nextCursor:h.YjP().nullable()}).meta({id:"ListSessionEventsResponse"}),h.Ikc({format:h.k5n(["ndjson","json"]).default("ndjson")}),h.Ikc({format:h.k5n(["csv","json"]).default("csv"),q:h.YjP().optional(),harness:h.YOg(ae).optional(),from:h.KCZ([ab.p6(),ab.w$()]).optional(),to:h.KCZ([ab.p6(),ab.w$()]).optional()}),h.Ikc({stats:a5,sessions:a6}).meta({id:"ActivityOverviewResponse"});let a7=h.k5n(["user","project","local","plugin"]),a8=h.Ikc({name:h.YjP().min(1),source:h.YjP().min(1),scope:a7,pluginName:h.YjP().optional(),version:h.YjP().optional(),description:h.YjP().optional(),updatedAt:ab.w$().optional(),location:h.YjP().optional()}),a9=h.Ikc({event:h.YjP().min(1),matcher:h.YjP().optional(),command:h.YjP().min(1),timeout:h.aig().optional(),scope:a7,pluginName:h.YjP().optional(),location:h.YjP().optional()}),ba=h.Ikc({name:h.YjP().min(1),scope:a7,pluginName:h.YjP().optional(),marketplace:h.YjP().optional(),project:h.YjP().optional(),transport:h.YjP().min(1),command:h.YjP().optional(),url:h.YjP().optional(),envKeys:h.YOg(h.YjP()).optional(),location:h.YjP().optional()}),bb=h.Ikc({name:h.YjP().min(1),path:h.YjP().min(1),scope:a7,kind:h.YjP().min(1),detail:h.YjP().optional(),entryCount:h.aig().optional(),updatedAt:ab.w$().optional()});h.Ikc({scannedAt:ab.w$(),skills:h.YOg(a8),hooks:h.YOg(a9),mcpServers:h.YOg(ba),configFiles:h.YOg(bb),errors:h.YOg(h.Ikc({source:h.YjP(),reason:h.YjP()}))});let bc=h.Ikc({ruleId:h.YjP().min(1),version:h.YjP().min(1),span:an,maskedMatch:h.YjP(),actionTaken:al,confidence:h.aig().min(0).max(1)});h.Ikc({items:h.YOg(aU),scanEvent:aW,definitions:h.YOg(aX).optional(),findings:h.YOg(bc).optional()});let bd=h.k5n(["project","skill","mcp","hook","config"]).meta({id:"AssetType"}),be=h.k5n(["open","approved","blocked"]).meta({id:"AccessLevel"}),bf=h.k5n(["source","public-dep","vendored","config","data","docs","generated"]).meta({id:"Origin"}),bg=h.k5n(["known-good","risky","unapproved"]).meta({id:"TrustLevel"}),bh=h.k5n(["update","stale","conflict","unknown","change","untracked","risk","findings"]).meta({id:"Flag"}),bi=h.k5n(["public","private"]).meta({id:"Visibility"}),bj=h.k5n(["block","redact","warn"]).meta({id:"HarnessEventKind"}),bk=ae.extract(["ClaudeCode","Cursor","Codex","Antigravity","Copilot"]).meta({id:"HarnessId"}),bl=h.Ikc({open:h.aig().int().nonnegative(),approved:h.aig().int().nonnegative(),blocked:h.aig().int().nonnegative(),total:h.aig().int().nonnegative()}).meta({id:"AccessCounts"}),bm=h.Ikc({id:h.YjP(),type:bd,name:h.YjP(),sub:h.YjP(),flags:h.YOg(bh),trust:bg.optional()}).meta({id:"AssetSummary"}),bn=h.Ikc({id:h.YjP(),name:h.YjP(),repo:h.YjP(),visibility:bi,language:h.YjP(),policyDefault:be,updatedAt:ab.w$(),accessCounts:bl,findingsCount:h.aig().int().nonnegative()}).meta({id:"ProjectSummary"}),bo=h.Ikc({type:bd,assets:h.YOg(bm)}),bp=h.Ikc({id:bk,label:h.YjP(),kind:h.YjP(),version:h.YjP(),sessions:h.aig().int().nonnegative(),assetCount:h.aig().int().nonnegative(),flagCount:h.aig().int().nonnegative(),projects:h.YOg(bn),categories:h.YOg(bo)}).meta({id:"HarnessSummary"});h.Ikc({items:h.YOg(bp)}).meta({id:"ListHarnessesResponse"});let bq=h.Ikc({type:bd,total:h.aig().int().nonnegative(),trustRollup:h.Ikc({"known-good":h.aig().int().nonnegative(),risky:h.aig().int().nonnegative(),unapproved:h.aig().int().nonnegative()}).partial().strict().optional(),flagRollup:h.Ikc({update:h.aig().int().nonnegative(),stale:h.aig().int().nonnegative(),conflict:h.aig().int().nonnegative(),unknown:h.aig().int().nonnegative(),change:h.aig().int().nonnegative(),untracked:h.aig().int().nonnegative(),risk:h.aig().int().nonnegative(),findings:h.aig().int().nonnegative()}).partial().strict(),items:h.YOg(bm)}).meta({id:"AssetGroup"});h.Ikc({groups:h.YOg(bq)}).meta({id:"ListAssetsResponse"});let br=h.Ikc({name:h.YjP(),signature:h.YjP(),description:h.YjP(),write:h.zMY(),risk:h.YjP().nullable()}).meta({id:"McpTool"}),bs=h.Ikc({id:h.YjP(),title:h.YjP(),note:h.YjP()});bm.extend({description:h.YjP().nullable(),trust:bg.nullable(),meta:h.g1P(h.YjP(),h.L5J()),finding:bs.nullable(),tools:h.YOg(br).optional()}).meta({id:"AssetDetail"}),h.Ikc({items:h.YOg(bn)}).meta({id:"ListProjectsResponse"}),h.Ikc({attention:h.aig().int().nonnegative(),byType:h.Ikc({project:h.aig().int().nonnegative(),skill:h.aig().int().nonnegative(),mcp:h.aig().int().nonnegative(),hook:h.aig().int().nonnegative(),config:h.aig().int().nonnegative()}),harnesses:h.aig().int().nonnegative(),mcpTrust:h.Ikc({"known-good":h.aig().int().nonnegative(),risky:h.aig().int().nonnegative(),unapproved:h.aig().int().nonnegative()})}).meta({id:"InventoryStats"});let bt=h.Ikc({path:h.YjP(),name:h.YjP(),origin:bf,access:be,isCustom:h.zMY(),findings:h.aig().int().nonnegative(),blockedAt:ab.w$().nullable().optional(),note:h.YjP().nullable().optional()}).meta({id:"FileSummary"}),bu=h.Ikc({name:h.YjP(),path:h.YjP(),accessCounts:bl}).meta({id:"FolderSummary"});h.Ikc({project:h.Ikc({id:h.YjP(),repo:h.YjP(),visibility:bi}),path:h.YjP(),folders:h.YOg(bu).optional(),files:h.YOg(bt)}).meta({id:"ProjectTreeResponse"}),bt.extend({project:h.Ikc({repo:h.YjP(),visibility:bi,language:h.YjP(),policyDefault:be,updatedAt:ab.w$()}),findingsRefs:h.YOg(h.Ikc({id:h.YjP(),title:h.YjP()}))}).meta({id:"FileDetail"}),h.Ikc({path:h.YjP(),access:be}).meta({id:"SetFileAccessBody"}),h.Ikc({file:bt,accessCounts:bl}).meta({id:"SetFileAccessResponse"}),h.Ikc({trust:bg}).meta({id:"SetMcpTrustBody"});let bv=h.Ikc({kind:bj,title:h.YjP(),detail:h.YjP(),occurredAt:ab.w$(),findingId:h.YjP().nullable().optional()}).meta({id:"HarnessEventItem"});h.Ikc({counts:h.Ikc({block:h.aig().int().nonnegative(),redact:h.aig().int().nonnegative(),warn:h.aig().int().nonnegative()}),items:h.YOg(bv)}).meta({id:"HarnessEventsResponse"}),h.Ikc({jobId:h.YjP(),startedAt:ab.w$()}).meta({id:"RescanResponse"}),h.Ikc({repo:h.YjP()}).meta({id:"ConnectProjectBody"}),h.Ikc({type:h.YOg(bd).optional(),q:h.YjP().optional()}),h.Ikc({path:h.YjP().optional(),q:h.YjP().optional(),filter:h.k5n(["blocked"]).optional()}),h.Ikc({path:h.YjP()}),h.Ikc({limit:ac.ai().int().min(1).max(50).default(7)});let bw=h.k5n(["provider","internal","external","ip"]).meta({id:"DestinationKind"}),bx=h.k5n(["https","http","sftp","grpc","smtp","ws","wss"]).meta({id:"Transport"}),by=h.k5n(["secrets","pii","customer","source","telemetry","logs","metrics","none"]).meta({id:"DataClass"}),bz=by.options,bA=h.k5n(["recognized","internal","unverified","ip"]).meta({id:"ShareTrustLevel"}),bB=h.k5n(["allow","block"]).meta({id:"EgressDecision"}),bC=h.k5n(["allowed","blocked","review"]).meta({id:"EgressStatus"}),bD=h.k5n(["raw_ip","unverified_domain","plaintext_transport"]).meta({id:"ReviewReason"}),bE=h.k5n(["GET","POST","PUT","DELETE","SDK","REF"]).meta({id:"HttpMethod"}),bF=h.Ikc({needsReview:h.zMY(),reasons:h.YOg(bD)}).meta({id:"ReviewInfo"}),bG=h.Ikc({port:h.aig().int().nullable(),geo:h.YjP().nullable(),ptr:h.YjP().nullable()}).meta({id:"DestinationNetwork"}),bH=h.Ikc({id:h.YjP(),method:bE,transport:bx,url:h.YjP(),template:h.zMY(),dataClass:by,lastSeen:ab.w$(),callSiteCount:h.aig().int().nonnegative()}).meta({id:"EndpointSummary"}),bI=h.Ikc({id:h.YjP(),project:h.YjP(),file:h.YjP(),line:h.aig().int().nonnegative(),snippet:h.YjP(),dynamic:h.zMY(),vendored:h.zMY(),projectId:h.YjP().nullable()}).meta({id:"CallSite"}),bJ=bH.extend({sites:h.YOg(bI)}).meta({id:"EndpointWithSites"}),bK=h.Ikc({id:h.YjP(),kind:bw,name:h.YjP(),host:h.YjP(),providerId:h.YjP().nullable(),category:h.YjP(),trust:bA,status:bC,isCustom:h.zMY(),lastSeen:ab.w$(),endpointCount:h.aig().int().nonnegative(),callSiteCount:h.aig().int().nonnegative(),transports:h.YOg(bx),dataClasses:h.YOg(by),review:bF,network:bG.nullable(),endpoints:h.YOg(bH)}).meta({id:"ShareDestinationSummary"});bK.omit({endpointCount:!0,callSiteCount:!0,endpoints:!0}).extend({note:h.YjP().nullable(),endpoints:h.YOg(bJ)}).meta({id:"ShareDestinationDetail"});let bL=h.Ikc({id:h.YjP(),kind:bw,name:h.YjP(),host:h.YjP(),providerId:h.YjP().nullable(),trust:bA,status:bC,review:bF,topDataClass:by,callSiteCount:h.aig().int().nonnegative(),lastSeen:ab.w$()}).meta({id:"ReviewDestination"}),bM=h.Ikc({kind:bw,total:h.aig().int().nonnegative(),items:h.YOg(bK)}).meta({id:"ShareDestinationGroup"});h.Ikc({groups:h.YOg(bM)}).meta({id:"ListShareDestinationsResponse"}),h.Ikc({items:h.YOg(bL)}).meta({id:"NeedsReviewResponse"}),h.Ikc({destinations:h.aig().int().nonnegative(),endpoints:h.aig().int().nonnegative(),callSites:h.aig().int().nonnegative(),needsReview:h.aig().int().nonnegative(),insecure:h.aig().int().nonnegative(),byKind:h.Ikc({provider:h.aig().int().nonnegative(),internal:h.aig().int().nonnegative(),external:h.aig().int().nonnegative(),ip:h.aig().int().nonnegative()}),byTrust:h.Ikc({recognized:h.aig().int().nonnegative(),internal:h.aig().int().nonnegative(),unverified:h.aig().int().nonnegative(),ip:h.aig().int().nonnegative()})}).meta({id:"SharesStats"}),h.Ikc({decision:bB.nullable()}).meta({id:"SetEgressDecisionBody"}),h.Ikc({destination:bK}).meta({id:"SetEgressDecisionResponse"}),h.Ikc({q:h.YjP().optional(),kind:h.YOg(bw).optional(),groupBy:h.k5n(["destination"]).default("destination"),review:h.uEf().default(!1)}),h.Ikc({format:h.k5n(["csv","json"]).default("csv"),q:h.YjP().optional(),kind:h.YOg(bw).optional()});let bN=h.k5n(["npm","pypi","go","maven","rubygems","cargo","composer","nuget"]).meta({id:"EgressEcosystem"});h.Ikc({id:h.YjP(),name:h.YjP(),category:h.YjP(),hostSuffixes:h.YOg(h.YjP()).min(1),apiBase:h.YjP(),defaultDataClasses:h.YOg(by).min(1),sdks:h.jgl(bN,h.YOg(h.YjP()))}).meta({id:"ProviderRegistryEntry"});let bO=h.Ikc({file:h.YjP(),line:h.aig().int().positive(),snippet:h.YjP(),dynamic:h.zMY(),vendored:h.zMY()}).meta({id:"EgressCallSiteHit"}),bP=h.Ikc({host:h.YjP(),kind:bw,name:h.YjP(),category:h.YjP(),providerId:h.YjP().nullable(),trust:bA,network:bG.nullable(),method:bE,transport:bx,url:h.YjP(),template:h.zMY(),dataClass:by,site:bO}).meta({id:"ResolvedEgressHit"}),bQ=h.gMt("mode",[h.Ikc({mode:h.euz("walk"),walkedPrefix:h.YjP()}),h.Ikc({mode:h.euz("ledger"),scannedFiles:h.YOg(h.YjP()),deletedFiles:h.YOg(h.YjP())})]).meta({id:"EgressReconcile"});h.Ikc({projectKey:h.YjP().min(1),project:h.YjP(),projectId:h.YjP().nullable(),reconcile:bQ,hits:h.YOg(bP)}).meta({id:"RecordProjectEgressInput"}),h.Ikc({destinations:h.aig().int().nonnegative(),endpoints:h.aig().int().nonnegative(),callSites:h.aig().int().nonnegative(),truncated:h.zMY(),droppedFiles:h.YOg(h.YjP()).default([])}).meta({id:"EgressWriteSummary"});let bR="control-plane-credential.json",bS=h.Ikc({specVersion:h.euz(1),endpoint:h.YjP().min(1),apiKey:h.YjP().min(1),keyPrefix:h.YjP().min(1).max(16).optional(),mintedAt:ab.w$().optional()}),bT=new Set(["localhost","127.0.0.1","::1","[::1]"]);function bU(a){let b;try{b=new URL(a)}catch{return"unparseable"}return""!==b.username||""!==b.password?"userinfo":""!==b.search||""!==b.hash?"query-or-fragment":"https:"===b.protocol||"http:"===b.protocol&&bT.has(b.hostname)?null:"insecure"}function bV(a){return null===bU(a)}function bW(a){try{let b=new URL(a);return`${b.protocol}//${b.host}`}catch{return"(unparseable endpoint)"}}let bX=h.Ikc({packId:h.YjP().min(1),version:h.YjP().min(1),enabled:h.zMY(),updatedAt:h.YjP().nullable()}).meta({id:"StorePosturePack"}),bY=h.Ikc({total:h.aig().int().min(0),disabled:h.aig().int().min(0),byAction:h.Ikc({warn:h.aig().int().min(0),redact:h.aig().int().min(0),block:h.aig().int().min(0),allow:h.aig().int().min(0),log:h.aig().int().min(0)}).strict()}).meta({id:"StorePosturePolicyCounts"}),bZ=h.Ikc({package:h.YjP().min(1).max(200),version:h.YjP().min(1).max(64),ossVersion:h.YjP().max(64).nullable(),policyBundleVersion:h.YjP().max(200).nullable(),policyFetchedAt:h.aig().int().min(0).max(0xe677d21fdbff).nullable()}).meta({id:"StorePosturePlugin"});h.Ikc({deviceId:h.OsD(),hostname:h.YjP().min(1).max(253),capturedAt:h.aig().int().min(0).max(0xe677d21fdbff),storePresent:h.zMY(),schemaVersion:h.aig().int().min(0).max(0x7fffffff).nullable(),findingsTotal:h.aig().int().min(0).max(0x7fffffff),findingsFirstAt:h.aig().int().min(0).max(0xe677d21fdbff).nullable(),findingsLastAt:h.aig().int().min(0).max(0xe677d21fdbff).nullable(),packs:h.YOg(bX).max(500),policyCounts:bY,plugin:bZ.optional()}).meta({id:"StorePostureSnapshot"});let b$="capture/",b_=aW.extend({inspections:h.YOg(aT).default([])}).refine(a=>a.inspections.every(a=>!a.ruleVersion.startsWith(b$)),{message:`inspections[].ruleVersion must not start with \`${b$}\` — that namespace is reserved for capture definitions the control plane mints itself`,path:["inspections"]}).meta({id:"RecordAuditEventRequest"}),b0=h.Ikc({events:h.YOg(b_).min(1).max(50)}).meta({id:"RecordAuditEventBatch"}),b1=h.Ikc({host:h.YjP(),kind:bw,name:h.YjP(),category:h.YjP(),providerId:h.YjP().nullable().optional(),trust:bA,network:bG.nullable(),method:bE,transport:bx,url:h.YjP(),template:h.zMY(),dataClass:by,site:h.Ikc({file:h.YjP(),line:h.aig().int().positive(),dynamic:h.zMY(),vendored:h.zMY()})}).meta({id:"EgressIngestHit"}),b2=h.Ikc({projectKey:h.YjP().regex(/^[0-9a-f]{64}$/,"projectKey must be a 64-character lowercase hex digest"),project:h.YjP(),reconcile:bQ,hits:h.YOg(b1)}).meta({id:"EgressIngestRequest"}),b3=h.Ikc({accepted:h.aig().int().nonnegative(),duplicates:h.aig().int().nonnegative()}),b4=h.Ikc({accepted:h.aig().int().nonnegative()}),b5=/^[^\p{Cc}\p{Cf}]*$/u,b6=a=>h.YjP().max(a).regex(b5,"must not contain control characters"),b7=h.Ikc({tenantName:b6(200),userEmail:b6(320),role:b6(64),keyKind:b6(64),serverTime:b6(64)});h.Ikc({error:h.Ikc({code:h.YjP().optional(),message:h.YjP().optional()}).optional()});let b8=h.k5n(["unauthorized","forbidden","route-absent","invalid-request","rejected","unreachable"]).extract(["unauthorized","forbidden","unreachable"]);h.Ikc({deviceId:b6(128).min(1),hostname:b6(255).min(1),os:b6(64).min(1),cliVersion:b6(64).min(1),label:b6(200).optional()}).meta({id:"AttachDeviceRequest"}),h.Ikc({deviceCode:b6(128).min(1)}).meta({id:"AttachTokenRequest"}),h.Ikc({deviceCode:b6(128),userCode:b6(32),verificationUri:b6(512),verificationUriComplete:b6(512).optional(),expiresIn:h.aig().int().positive(),interval:h.aig().int().positive()});let b9=h.Ikc({status:h.euz("pending")}),ca=h.Ikc({status:h.euz("slow_down"),interval:h.aig().int().positive()}),cb=h.Ikc({status:h.euz("denied"),message:b6(500).optional()}),cc=h.Ikc({status:h.euz("expired")}),cd=h.Ikc({status:h.euz("issued"),apiKey:h.YjP().min(1).max(512),endpoint:b6(512),tenantName:b6(200).optional(),userEmail:b6(320).optional()});h.KCZ([cd,b9,ca,cb,cc,h.Ikc({status:b6(64)})]);let ce=h.k5n(["shares_rescan"]),cf=h.Ikc({id:b6(128).min(1),kind:ce,issuedAt:b6(64).min(1),expiresAt:b6(64).min(1)}).strict(),cg=h.Ikc({command:cf.nullable()}),ch=h.k5n(["scan_failed","no_projects","expired"]),ci=h.gMt("outcome",[h.Ikc({outcome:h.euz("reported"),projectsScanned:h.aig().int().nonnegative()}).strict(),h.Ikc({outcome:h.euz("failed"),reason:ch,projectsScanned:h.aig().int().nonnegative()}).strict()]),cj=h.YjP().regex(/^[a-z][a-z0-9-]*$/),ck=h.YjP().regex(/^[a-z][a-z0-9-]*$/),cl=h.YjP().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-.]+)?$/),cm=h.k5n(["labs","user","org"]),cn=h.k5n(["keyword","regex"]).meta({id:"MatcherType"});h.k5n(["safe","quarantined"]).meta({id:"RuleProbeVerdict"});let co=h.rej({type:h.euz("keyword"),keywords:h.YOg(h.YjP().min(1)).min(1),caseSensitive:h.zMY().default(!1)});function cp(a){return a.replace(/[gy]/g,"")}let cq=h.rej({type:h.euz("regex"),pattern:h.YjP().min(1).max(2e3),flags:h.YjP().default("gi"),captureGroup:h.aig().int().nonnegative().optional()}).refine(a=>(function(a,b){try{return new RegExp(a,b),!0}catch{return!1}})(a.pattern,a.flags),{message:"pattern/flags do not form a valid JavaScript regular expression",path:["pattern"]}).refine(a=>!function(a){return void 0===a||0===a}(a.captureGroup)||!function(a,b){try{let c=new RegExp(a,cp(b));return c.exec("")?.[0].length===0}catch{return!1}}(a.pattern,a.flags),{message:'a whole-match regex that can match the empty string (e.g. "\\d*", "a?", "(?:)") can hang the matcher — scope the quantifier to a captureGroup, or require at least one character',path:["pattern"]}).superRefine((a,b)=>{if(void 0===a.captureGroup)return;let c=function(a,b){try{let c=RegExp(`${a}|`,cp(b)).exec("");return c?c.length-1:void 0}catch{return}}(a.pattern,a.flags);void 0===c||a.captureGroup<=c||b.addIssue({code:"custom",path:["captureGroup"],message:`captureGroup ${String(a.captureGroup)} is out of range — the pattern declares ${String(c)} capture group(s), so valid values are 0-${String(c)}. An out-of-range group never matches, which would make the rule silently never fire.`})}),cr=h.gMt("type",[co,cq]).meta({id:"Matcher"});cn.options;let cs=h.rej({extensions:h.YOg(h.YjP().regex(/^\.[A-Za-z0-9]+$/)).min(1)}).meta({id:"AppliesTo"}),ct=h.k5n(["entropy","luhn"]).meta({id:"PostValidatorName"}),cu=h.KCZ([ct,h.rej({name:ct,config:h.g1P(h.YjP(),h.L5J()).optional()})],{error:()=>`not a valid post-validator: use a bare name (${ct.options.map(a=>JSON.stringify(a)).join(" or ")}) or { "name": ..., "config": { ... } }. An unrecognized name would be a false-positive guard that never runs.`}).meta({id:"PostValidatorRef"}),cv=h.rej({categories:h.YOg(aj).min(1).optional(),ruleIds:h.YOg(h.YjP().min(1)).min(1).optional(),labels:h.YOg(h.YjP().min(1)).min(1).optional(),windowChars:h.aig().int().positive().default(160),confidenceBoost:h.aig().min(0).max(.3).optional()}).refine(a=>(a.categories?.length??0)+(a.ruleIds?.length??0)+(a.labels?.length??0)>0,{message:"requiresNearby needs at least one of categories, ruleIds, or labels"}).meta({id:"RequiresNearby"});h.rej({label:h.YjP(),text:h.YjP().max(5e4),shouldMatch:h.zMY(),filePath:h.YjP().optional(),expectedSpans:h.YOg(h.rej({start:h.aig(),end:h.aig()})).optional()}).meta({id:"RuleFixture"});let cw=h.rej({specVersion:h.euz(1),id:h.YjP().regex(/^[a-z][a-z0-9-]*\/[a-z][a-z0-9-]*$/),name:h.YjP(),category:aj,severity:ak,matcher:cr,appliesTo:cs.optional(),postValidators:h.YOg(cu).optional(),requiresNearby:cv.optional(),examples:h.YOg(h.YjP()).optional()}).meta({id:"Rule"}),cx=h.Ikc({name:h.YjP(),email:h.Rpp().optional(),url:h.OZ5().optional()}).meta({id:"Author"});h.Ikc({specVersion:h.euz(1),id:h.YjP(),name:h.YjP(),version:h.YjP(),rules:h.YOg(h.YjP()),description:h.YjP().optional(),author:cx.optional(),license:h.YjP().optional(),sourceUrl:h.OZ5().optional()}).meta({id:"PackManifest"});let cy=h.k5n(["library","custom"]).meta({id:"OriginEnum"}),cz=h.k5n(["all","library","custom","customized","updates"]),cA=h.k5n(["new","imported","update"]).meta({id:"LibraryStateEnum"}),cB=h.Ikc({all:h.aig().int().nonnegative(),library:h.aig().int().nonnegative(),custom:h.aig().int().nonnegative(),customized:h.aig().int().nonnegative(),updates:h.aig().int().nonnegative()}).meta({id:"DetectionCounts"}),cC=h.Ikc({id:h.YjP(),name:h.YjP(),version:cl,enabled:h.zMY(),origin:cy,publisher:cj.optional(),publisherKind:cm.optional(),ruleCount:h.aig().int().nonnegative(),namespace:cj,packId:ck,policyId:h.YjP().optional(),latestVersion:cl.optional()}).meta({id:"DetectionListItem"});h.Ikc({counts:cB,items:h.YOg(cC)}).meta({id:"ListDetectionsResponse"}),h.Ikc({filter:cz.optional().default("all"),q:h.YjP().optional()}),h.Ikc({detections:h.aig().int().nonnegative(),rules:h.aig().int().nonnegative(),active:h.aig().int().nonnegative(),findingsLast30d:h.aig().int().nonnegative()}).meta({id:"DetectionStats"});let cD=h.Ikc({id:h.YjP(),name:h.YjP(),category:aj,severity:ak,matcher:cr,appliesTo:cs.optional(),postValidators:h.YOg(cu).optional(),requiresNearby:cv.optional(),examples:h.YOg(h.YjP()).optional()}).meta({id:"DetectionRule"}),cE=h.Ikc({available:h.zMY(),latestVersion:cl,latestRuleCount:h.aig().int().nonnegative().optional()}).nullable().meta({id:"DetectionUpdate"});h.Ikc({id:h.YjP(),name:h.YjP(),version:cl,enabled:h.zMY(),origin:cy,publisher:cj.optional(),publisherKind:cm.optional(),ruleCount:h.aig().int().nonnegative(),namespace:cj,packId:ck,description:h.YjP().optional(),editedAt:ab.w$(),findingsLast30d:h.aig().int().nonnegative(),latestVersion:cl.nullable().optional(),update:cE,rules:h.YOg(cD),modified:h.zMY(),policyId:h.YjP().optional()}).meta({id:"DetectionDetail"});let cF=h.Ikc({id:h.YjP(),name:h.YjP(),publisher:cj,publisherKind:cm.optional(),category:aj.optional(),version:cl,ruleCount:h.aig().int().nonnegative(),description:h.YjP().optional(),updatedAt:ab.w$(),state:cA,importedAs:h.YjP().nullable()}).meta({id:"LibraryItem"});function cG(a,b,c){return void 0!==c&&b.success&&void 0!==b.data?{[a]:b.data}:{}}h.Ikc({categories:h.YOg(aj),items:h.YOg(cF)}).meta({id:"ListLibraryResponse"}),h.Ikc({libraryId:h.YjP().refine(a=>/^[^/]+\/[^/]+$/.test(a),{message:"libraryId must be in namespace/packId format"})}).meta({id:"ImportDetectionRequest"});let cH={library:!0,custom:!0};function cI(a){return null!=a&&Object.hasOwn(cH,a)?a:"library"}function cJ(a){return{id:`${a.namespace}/${a.packId}`,name:a.name,version:a.version,enabled:a.enabled,origin:cI(a.origin),namespace:a.namespace,packId:a.packId,ruleCount:a.ruleCount,...null!=a.policyId?{policyId:a.policyId}:{},...null!=a.latestVersion?{latestVersion:a.latestVersion}:{}}}function cK(a,b,c){let d=a.rules.flatMap(a=>{var b;let c=cr.safeParse(a.matcher);return c.success?[{id:a.id,name:a.name,category:a.category,severity:a.severity,matcher:c.data,...cG("appliesTo",cs.safeParse(a.appliesTo),a.appliesTo),...cG("postValidators",cu.array().safeParse(a.postValidators),a.postValidators),...cG("requiresNearby",cv.safeParse(a.requiresNearby),a.requiresNearby),...cG("examples",{success:Array.isArray(b=a.examples)&&b.every(a=>"string"==typeof a),data:a.examples},a.examples)}]:[]});return{id:`${a.namespace}/${a.packId}`,name:a.name,version:a.version,enabled:a.enabled,origin:cI(a.origin),namespace:a.namespace,packId:a.packId,ruleCount:a.rules.length,editedAt:a.updatedAt.toISOString(),findingsLast30d:b,latestVersion:c?c.latestVersion:null,update:c,rules:d,modified:!1,...null!=a.policyId?{policyId:a.policyId}:{}}}function cL(a){let b=a.indexOf("/");return b<1||b===a.length-1?null:{namespace:a.slice(0,b),packId:a.slice(b+1)}}function cM(a,b){let c=a.filter(a=>null!=a.latestVersion),d=a=>cI(a.origin),e={all:a.length,library:a.filter(a=>"library"===d(a)).length,custom:a.filter(a=>"custom"===d(a)).length,customized:0,updates:c.length},f=b.filter,g="customized"===f?[]:"custom"===f?a.filter(a=>"custom"===d(a)):"library"===f?a.filter(a=>"library"===d(a)):"updates"===f?[...c]:[...a];if(b.q){let a=b.q.toLowerCase();g=g.filter(b=>b.name.toLowerCase().includes(a)||b.packId.toLowerCase().includes(a)||b.namespace.toLowerCase().includes(a))}return g.sort((a,b)=>a.enabled!==b.enabled?a.enabled?-1:1:a.name.localeCompare(b.name)),{counts:e,items:g.map(cJ)}}let cN=h.k5n(["prompt","response","code_change","tool_use"]).meta({id:"EventKind"}),cO=cN.options.map(a=>`'${a}'`).join(","),cP=h.Ikc({sessionId:h.YjP().optional(),repo:h.YjP().optional(),filePath:h.YjP().optional(),toolName:h.YjP().optional(),gitignored:h.zMY().optional(),wholeFile:h.zMY().optional(),model:h.YjP().optional(),turnIndex:h.aig().int().nonnegative().optional(),correlationId:h.uRe().optional(),traceId:h.YjP().regex(/^[0-9a-f]{32}$/).optional(),exceptionIds:h.YOg(h.OsD()).optional(),messageId:h.YjP().min(1).optional(),conversationId:h.YjP().optional(),inspectionMs:h.aig().int().nonnegative().optional(),redactDegradedTo:al.optional()}).meta({id:"EventMetadata"}),cQ=h.Ikc({id:h.OsD(),sourceTool:ag,kind:cN,occurredAt:ab.w$(),contentHash:h.YjP(),content:h.YjP(),metadata:cP.optional()}).meta({id:"Event"}).meta({id:"IngestEvent"});h.Ikc({events:h.YOg(cQ).min(1).max(100),dedupe:h.euz("content-hash").optional()}).meta({id:"IngestBatch"});let cR=h.k5n(["once","temporary","permanent"]),cS=h.Ikc({repo:h.YjP().optional(),sourceTool:h.YjP().optional(),provider:h.YjP().optional()}).strict(),cT=h.k5n(["suppress","reveal_to_model"]),cU=h.Ikc({id:h.OsD(),ruleId:h.YjP(),category:aj,valueFingerprint:h.YjP().regex(/^[0-9a-f]{64}$/),keyVersion:h.aig().int().positive(),maskedValue:h.YjP(),capability:cT.default("suppress"),scope:cR,expiresAt:ab.w$().nullable(),maxUses:h.aig().int().positive().nullable(),useCount:h.aig().int().nonnegative(),lastUsedAt:ab.w$().nullable(),justification:h.YjP().min(1),conditions:cS.nullable(),createdBy:h.YjP(),createdVia:h.k5n(["cli-approve","cli-add","web-approve","web-add","api","setup-triage"]),createdAt:ab.w$(),updatedAt:ab.w$(),revokedAt:ab.w$().nullable(),revokedBy:h.YjP().nullable(),revokeReason:h.YjP().nullable()}),cV=cU.pick({id:!0,ruleId:!0,valueFingerprint:!0,keyVersion:!0,capability:!0,expiresAt:!0,maxUses:!0,useCount:!0,conditions:!0});function cW(a,b){return"present"===b.status&&b.version===a}cU.omit({valueFingerprint:!0});let cX=h.YjP().optional(),cY=h.Ikc({reference:h.YjP(),scope:h.YjP(),reason:h.YjP(),confirmation:cX}),cZ=h.Ikc({ruleId:h.YjP(),value:h.YjP(),scope:h.YjP(),reason:h.YjP(),confirmation:cX}),c$=h.Ikc({pointer:h.YjP(),scope:h.YjP(),justification:h.YjP(),confirmation:cX}),c_=h.Ikc({id:h.YjP(),reason:h.YjP()}),c0=h.Ikc({confirmation:h.YjP()});function c1(a,b){let c=a.safeParse(b);if(c.success)return{ok:!0,data:c.data};for(let a of c.error.issues){let[b]=a.path;if("string"==typeof b)return{ok:!1,field:b,wrongType:"invalid_type"===a.code}}return{ok:!1,field:null,wrongType:!1}}let c2=as.options;function c3(a){if("code_change"===a.kind)return{state:"local_scan"};if(null!==a.syncedAt&&a.syncedAt>0)return{state:"sent",at:W(a.syncedAt)};if(null!==a.syncedAt){var b;let c=null!==(b=a.syncFailure)&&c2.includes(b)?b:void 0;return{state:"not_sent",...null===a.syncFailedAt?{}:{at:W(a.syncFailedAt)},...void 0===c?{}:{reason:c}}}return 1===a.outboxOwed||null!==a.syncClaimedAt?{state:"queued"}:{state:"never_offered"}}function c4(a,b){return Object.hasOwn(a,b)?a[b]:void 0}function c5(a){return c4({log:"monitored",block:"blocked",redact:"redacted",warn:"warned",allow:"allowed"},a)??"allowed"}function c6(a){if("code_context"===a)return"source_code";let b=aq.safeParse(a);return b.success?b.data:"custom"}function c7(a){return c4(ai,a)??ad.Api}let c8=["open","handled","dismissed","resolved"];function c9(a){let b=new Set(a.filter(a=>void 0!==a));if(0!==b.size){for(let a of c8)if(b.has(a))return a}}function da(a){return"code_change"!==a.kind?"handled":null===a.findingKey?"open":"resolved"===a.latestResolutionStatus?"resolved":"dismissed"===a.latestResolutionStatus?"dismissed":"open"}function db(a,b={}){let c=b.packNames,d=[];for(let[b,e]of a){let a=[...e.users??[]].sort((a,b)=>a.name.localeCompare(b.name)||a.id.localeCompare(b.id)),f=[...new Set(e.sourceTools.map(c7))].sort(),g=new Set(e.actionsTaken.map(c5)),h=1===g.size?[...g][0]??null:null,i=c6(e.category??"custom"),j={id:b,category:i,subtype:b,severity:e.severity??"low",detection:{id:b,name:c?.get(b)??null},policy:{id:`category:${i}`,name:i},instanceCount:e.instanceCount,providers:f,aggregateAction:h,latestDetectedAt:e.latestDetectedAt,status:c9(e.statusInputs.map(da)),...a.length>0?{users:a}:{}};de.set(j,[...g]),void 0!==e.searchText&&dc.set(j,dd(j,e.searchText)),d.push(j)}return d}let dc=new WeakMap;function dd(a,b){return[a.subtype,a.category,a.policy.name,a.id,...(a.users??[]).map(a=>a.name),...void 0===b?[]:[b]].join(" ").toLowerCase()}let de=new WeakMap;function df(a){return de.get(a)??[]}function dg(a,b){let c=new Set(b),d=0;for(let b of a){if(void 0===b.count)return null;c.has(da(b))&&(d+=b.count)}return d}function dh(a,b){let c=a;if(b.severity&&b.severity.length>0){let a=new Set(b.severity);c=c.filter(b=>a.has(b.severity))}if(b.providers&&b.providers.length>0){let a=new Set(b.providers);c=c.filter(b=>b.providers.some(b=>a.has(b)))}if(b.actions&&b.actions.length>0){let a=new Set(b.actions);c=c.filter(b=>df(b).some(b=>a.has(b)))}if(b.subtype&&b.subtype.length>0){let a=new Set(b.subtype);c=c.filter(b=>a.has(b.subtype))}if(b.statuses&&b.statuses.length>0){let a=new Set(b.statuses);c=c.filter(b=>void 0!==b.status&&a.has(b.status))}if(b.q){let a=b.q.toLowerCase();c=c.filter(b=>(function(a){let b=dc.get(a);if(void 0!==b)return b;let c=dd(a);return dc.set(a,c),c})(b).includes(a))}return c}let di=Object.fromEntries(ak.options.map((a,b)=>[a,b]));function dj(a,b){let c=(c4(di,a.severity)??-1)-(c4(di,b.severity)??-1);if(0!==c)return c;let d=b.latestDetectedAt.localeCompare(a.latestDetectedAt);return 0!==d?d:a.id.localeCompare(b.id)}function dk(a){return[...a].sort(dj)}function dl(a,b){let c=dh(a,{providers:b.providers,actions:b.actions,statuses:b.statuses,q:b.q,subtype:b.subtype}),d=new Map;for(let a of c)d.set(a.severity,(d.get(a.severity)??0)+1);let e=dh(a,{actions:b.actions,statuses:b.statuses,q:b.q,subtype:b.subtype,severity:b.severity}),f=new Map;for(let a of e)for(let b of a.providers)f.set(b,(f.get(b)??0)+1);let g=dh(a,{providers:b.providers,statuses:b.statuses,q:b.q,subtype:b.subtype,severity:b.severity}),h=new Map;for(let a of g)for(let b of df(a))h.set(b,(h.get(b)??0)+1);let i=dh(a,{providers:b.providers,actions:b.actions,statuses:b.statuses,q:b.q,severity:b.severity}),j=new Map;for(let a of i)j.set(a.subtype,(j.get(a.subtype)??0)+1);let k=dh(a,{providers:b.providers,actions:b.actions,q:b.q,subtype:b.subtype,severity:b.severity}),l=new Map;for(let a of k)void 0!==a.status&&l.set(a.status,(l.get(a.status)??0)+1);let m=a=>[...a.entries()].map(([a,b])=>({value:a,count:b}));return{severity:m(d),provider:m(f),action:m(h),subtype:m(j),status:m(l)}}function dm(a,b){let c=a[Symbol.iterator](),d=b[Symbol.iterator]();for(;;){let a=c.next(),b=d.next();if(a.done&&b.done)return 0;if(a.done)return -1;if(b.done)return 1;let e=a.value.codePointAt(0)??0,f=b.value.codePointAt(0)??0;if(e!==f)return e-f}}let dn=["severity","subtype","providers","actions","statuses","deliveries","tools","repo","file","q"];function dp(a,b,c){for(let d of dn)if(d!==c&&!function(a,b,c){switch(c){case"severity":return!b.severity?.length||b.severity.includes(a.severity);case"subtype":return!b.subtype?.length||b.subtype.includes(a.ruleId);case"providers":return!b.providers?.length||b.providers.includes(c7(a.sourceTool));case"actions":return!b.actions?.length||b.actions.includes(c5(a.actionTaken));case"statuses":return!b.statuses?.length||void 0!==a.status&&b.statuses.includes(a.status);case"deliveries":return!b.deliveries?.length||void 0!==a.delivery&&b.deliveries.includes(a.delivery.state);case"tools":return!b.tools?.length||void 0!==a.toolName&&b.tools.includes(a.toolName);case"repo":return void 0===b.repo||a.repo===b.repo;case"file":return void 0===b.file||a.file===b.file;case"q":return!b.q||[a.ruleId,a.category,a.maskedMatch,a.repo,a.file,a.toolName?`via ${a.toolName}`:"",a.id,a.user?.name??""].join(" ").toLowerCase().includes(b.q.toLowerCase())}}(a,b,d))return!1;return!0}function dq(a){return[...a.entries()].map(([a,b])=>({value:a,count:b})).sort((a,b)=>b.count-a.count||a.value.localeCompare(b.value)||dm(a.value,b.value))}function dr(a,b,c=1){a.set(b,(a.get(b)??0)+c)}function ds(a){let b=new Map,c=new Map,d=new Map,e=new Map,f=new Map,g=new Map,h=new Map;return{add(i){dp(i,a,"severity")&&dr(b,i.severity),dp(i,a,"subtype")&&dr(c,i.ruleId),dp(i,a,"providers")&&dr(d,c7(i.sourceTool)),dp(i,a,"actions")&&dr(e,c5(i.actionTaken)),void 0!==i.status&&dp(i,a,"statuses")&&dr(f,i.status),void 0!==i.toolName&&dp(i,a,"tools")&&dr(g,i.toolName),void 0!==i.delivery&&dp(i,a,"deliveries")&&dr(h,i.delivery.state)},facets:()=>({severity:dq(b),subtype:dq(c),provider:dq(d),action:dq(e),status:dq(f),tool:dq(g),deployment:dq(h)})}}function dt(a){let b=c6(a.category);return{id:a.id,provider:c7(a.sourceTool),repo:a.repo,file:a.file,...void 0===a.toolName?{}:{toolName:a.toolName},eventId:a.eventId,...void 0===a.sessionId?{}:{sessionId:a.sessionId},...void 0===a.delivery?{}:{delivery:a.delivery},...void 0===a.user?{}:{user:a.user},action:c5(a.actionTaken),detectedAt:a.occurredAt,confidence:a.confidence,...void 0===a.status?{}:{status:a.status},groupId:a.ruleId,category:b,subtype:a.ruleId,severity:a.severity,match:{maskedValue:a.maskedMatch,contextPrefix:""},detection:{id:a.ruleId,name:null},policy:{id:`category:${b}`,name:b}}}function du(){return{instanceCount:0,maxSeverityRank:Number.MAX_SAFE_INTEGER,maxSeverity:"low",latestDetectedAt:"",statuses:[],ruleIds:new Set}}function dv(a,b){a.instanceCount+=1;let c=c4(di,b.severity)??Number.MAX_SAFE_INTEGER-1;c<a.maxSeverityRank&&(a.maxSeverityRank=c,a.maxSeverity=b.severity),b.occurredAt>a.latestDetectedAt&&(a.latestDetectedAt=b.occurredAt),a.statuses.push(b.status),a.ruleIds.add(b.ruleId)}function dw(a,b){let c=c4(di,a.maxSeverity)??-1,d=c4(di,b.maxSeverity)??-1;if(c!==d)return c-d;if(a.latestDetectedAt!==b.latestDetectedAt)return a.latestDetectedAt<b.latestDetectedAt?1:-1;let e=dm(a.repo,b.repo);return 0!==e?e:dm(a.file,b.file)}function dx(a,b){return`${dy(a)}/${dy(b)}`}function dy(a){return encodeURIComponent(a.replace(/[\uD800-\uDFFF]/gu,"�"))}let dz=h.Ikc({id:h.OsD(),namespace:cj,packId:ck,version:cl,name:h.YjP(),enabled:h.zMY().default(!0),policyId:h.YjP().optional()}).meta({id:"InstalledPack"});h.Ikc({namespace:cj,packId:ck,version:cl}).meta({id:"InstallPackRequest"}),h.Ikc({items:h.YOg(dz)}).meta({id:"ListInstalledPacksResponse"}),h.Ikc({enabled:h.zMY().optional(),policyId:h.YjP().nullable().optional()}).refine(a=>Object.keys(a).some(b=>void 0!==a[b]),{message:"At least one field must be provided"}).meta({id:"PatchInstalledPackRequest"});let dA=h.k5n(["global","repo","user"]).meta({id:"PolicyScope"}),dB=h.KCZ([h.Ikc({ruleId:h.YjP()}),h.Ikc({category:aj})]).meta({id:"PolicyTarget"}),dC=h.k5n(["builtin","custom"]).meta({id:"PolicyKind"}),dD=h.k5n(["builtin","authored"]).meta({id:"PolicyProvenance"}),dE=h.Ikc({id:h.OsD(),scope:dA,target:dB,action:al,enabled:h.zMY().default(!0),customKeywords:h.YOg(h.YjP()).optional(),name:h.YjP().optional(),provenance:dD.optional()}).meta({id:"Policy"}),dF=["monitor","warn","redact","vault","block"],dG=h.k5n(dF).meta({id:"BuiltinPolicyId"}),dH=dG.extract(["monitor","warn","block"]).meta({id:"RedactFallback"}),dI=h.Ikc({version:h.YjP(),policies:h.YOg(dE),rules:h.YOg(cw).optional(),rulesComplete:h.zMY().optional(),exceptions:h.YOg(cV).optional(),reversibleRuleIds:h.YOg(h.YjP()).optional(),ruleVersions:h.g1P(h.YjP(),h.YjP()).optional(),prohibitedModels:h.YOg(h.YjP()).optional(),redactFallback:dH.optional(),customKeywords:h.YOg(h.YjP()),fetchedAt:ab.w$()}).meta({id:"PolicyBundle"});[...Object.keys(dI.shape),...Object.keys(dE.shape).map(a=>`policies.${a}`),...dB.options.flatMap(a=>"shape"in a?Object.keys(a.shape):[]).map(a=>`policies.target.${a}`),...Object.keys(cV.shape).map(a=>`exceptions.${a}`)].sort().join(",");let dJ=["config"],dK=aj.options.filter(a=>!dJ.includes(a)),dL={secret:"critical",financial:"critical",code_flaw:"critical",pii:"high",phi:"high",custom:"high",code_context:"low",config:"low"},dM=dF,dN={monitor:{name:"Monitor",action:"log",reversible:!1,description:"Log every match for audit. The request is allowed through untouched."},warn:{name:"Warn",action:"warn",reversible:!1,description:"Allow the request, but warn the user inline before it is sent."},redact:{name:"Redact",action:"redact",reversible:!1,description:"Strip the matched value from the request and destroy it, then continue. What was removed cannot be recovered."},vault:{name:"Redact & Vault",action:"redact",reversible:!0,description:"Strip the matched value from the request and keep an encrypted, recoverable copy in the local vault, leaving a pointer in its place. Needs the vault consent granted under Settings; without it this behaves as Redact."},block:{name:"Block",action:"block",reversible:!1,description:"Refuse the request entirely whenever any rule in this detection matches."}};function dO(a){return dN[a].action}let dP=[...new Set(dF.map(dO))],dQ=[...am.filter(a=>!dP.includes(a)),...dP];function dR(a){return dQ.indexOf(a)}function dS(a,b){return dR(a)>=dR(b)}function dT(a,b){return dR(a)>=dR(b)?a:b}function dU(a){return dF.find(b=>dS(dO(b),a))??"block"}h.Ikc({floor:dG,locked:h.zMY()}).describe("PackPolicyFloor");let dV=dF.filter(a=>!dN[a].reversible);dF.filter(a=>dN[a].reversible);let dW=h.k5n(dV).meta({id:"CategoryPolicyId"});function dX(a){let b=dG.safeParse(a??d$);return dN[b.success?b.data:d$].reversible}let dY=Object.fromEntries(aj.options.map(a=>[a,dO(function(a){if(dJ.includes(a))return"monitor";let b=dL[a];return"critical"===b||"high"===b?"warn":"monitor"}(a))])),dZ=Object.fromEntries(dF.map(a=>[a,{id:a,...dN[a]}])),d$="monitor";function d_(a){let b=dG.safeParse(a??d$);return dZ[b.success?b.data:d$].action}let d0=h.Ikc({id:h.YjP(),name:h.YjP(),ruleCount:h.aig().int().nonnegative(),enabled:h.zMY()}).meta({id:"UsedByItem"}),d1=h.Ikc({id:h.YjP(),kind:dC,name:h.YjP(),enabled:h.zMY(),usedByCount:h.aig().int().nonnegative()}).meta({id:"PolicyListItem"});h.Ikc({items:h.YOg(d1)}).meta({id:"ListPoliciesResponse"}),h.Ikc({specVersion:h.euz(1),id:h.YjP(),kind:dC,name:h.YjP(),enabled:h.zMY(),description:h.YjP(),usedBy:h.YOg(d0)}).meta({id:"PolicyDetail"}),h.Ikc({policies:h.aig().int().nonnegative(),builtin:h.aig().int().nonnegative(),custom:h.aig().int().nonnegative(),detectionsGoverned:h.aig().int().nonnegative()}).meta({id:"PolicyStatsResponse"});let d2=2,d3=aj.options.join("|"),d4=RegExp(`\\[\\[aka:(?:${d3}):[A-Z2-7]{2,7}\\.[A-Z2-7]{26}\\.[A-Z2-7]{16}\\]\\]`),d5=RegExp(`^${d4.source}$`);function d6(){return RegExp(d4.source,"g")}let d7=h.YjP().regex(d5);h.Ikc({category:aj,keyVersion:h.aig().int().positive(),pointerId:h.YjP(),tag:h.YjP()}),h.Ikc({pointerId:h.YjP(),valueFingerprint:h.YjP().regex(/^[0-9a-f]{64}$/),fingerprintKeyVersion:h.aig().int().positive(),keyVersion:h.aig().int().positive(),category:aj,ruleId:h.YjP(),maskedMatch:h.YjP(),provider:h.YjP().optional(),ciphertext:h.YjP(),nonce:h.YjP(),authTag:h.YjP(),occurrenceCount:h.aig().int().nonnegative(),userAuthorized:h.zMY(),firstSeen:h.YjP(),lastSeen:h.YjP()}),h.Ikc({category:aj,provider:h.YjP().optional(),maskedMatch:h.YjP(),occurrences:h.aig().int().nonnegative(),firstSeen:h.YjP(),lastSeen:h.YjP()}),h.Ikc({ruleId:h.YjP(),valueFingerprint:h.YjP().regex(/^[0-9a-f]{64}$/),fingerprintKeyVersion:h.aig().int().positive()});let d8=h.k5n(["human","model"]),d9=h.k5n(["display","explicit-reveal","view-render","model-input","remediation","purge"]),ea=h.k5n(["revealed","refused","unavailable"]),eb=["display","view-render"];function ec(a){return eb.includes(a)}let ed=h.Ikc({id:h.OsD(),pointerId:h.YjP(),at:h.YjP(),target:d8,reason:d9,outcome:ea,grantId:h.YjP().optional(),pointerCount:h.aig().int().positive().default(1)}),ee=h.k5n(["prompt","tool-input","tool-output","file","transcript"]),ef=h.Ikc({location:h.YjP(),kind:ee,firstSeen:h.YjP(),lastSeen:h.YjP()}),eg=h.Ikc({pointerId:h.YjP(),category:aj,provider:h.YjP().optional(),maskedMatch:h.YjP(),occurrences:h.aig().int().nonnegative(),firstSeen:h.YjP(),lastSeen:h.YjP(),revealGrantId:h.YjP().nullable(),sightings:h.YOg(ef)}),eh=50,ei=50,ej=200,ek=h.Ikc({limit:ac.ai().int().min(1).max(ej).optional(),cursor:h.YjP().optional()});h.Ikc({totals:h.Ikc({values:h.aig().int().nonnegative()}),items:h.YOg(eg),nextCursor:h.YjP().nullable()});let el=h.Ikc({limit:ac.ai().int().min(1).max(ej).optional(),cursor:h.YjP().optional()});h.Ikc({totals:h.Ikc({reused:h.aig().int().nonnegative()}),items:h.YOg(eg),nextCursor:h.YjP().nullable()});let em=h.Ikc({includeBatched:h.zMY().optional(),limit:ac.ai().int().min(1).max(ej).optional(),cursor:h.YjP().optional()});h.Ikc({items:h.YOg(ed),nextCursor:h.YjP().nullable(),hiddenBatched:h.aig().int().nonnegative()});let en=h.YjP(),eo=h.k5n(["masked","full","off"]),ep=1,eq=h.Ikc({acknowledgedAt:ab.w$(),version:h.aig().int().positive()});function er(a){return a?.version===ep}let es=1,et=3,eu=h.k5n(["standalone","attached"]),ev=h.Ikc({endpoint:h.YjP().min(1),label:h.YjP().min(1).optional(),attachedAt:ab.w$()}).meta({id:"ControlPlaneConnection"}),ew=h.k5n(["redact","warn"]),ex=h.k5n(["full","session-only"]),ey=h.Ikc({acknowledgedAt:ab.w$(),payloadVersion:h.aig().int().positive()});function ez(a){return a?.payloadVersion===es}let eA=h.Ikc({acknowledgedAt:ab.w$(),payloadVersion:h.aig().int().positive(),endpoint:h.YjP()});function eB(a,b){return void 0!==a&&void 0!==b&&a.payloadVersion===et&&a.endpoint===b}let eC=1,eD=h.Ikc({acknowledgedAt:ab.w$(),version:h.aig().int().positive()}),eE=h.k5n(["with-findings","always","never"]),eF=h.Ikc({responses:eE.default("with-findings"),account:h.zMY().default(!1),consent:eD.optional()});function eG(a){return a?.version===eC}let eH=h.Ikc({enabled:h.zMY().default(!1),retainDays:h.aig().int().min(1).max(3650).default(30)}).meta({id:"BodyRetention"}),eI=h.Ikc({specVersion:h.aig().int().positive().default(8),runMode:eu.default("standalone"),controlPlane:ev.optional(),policy:ew.default("redact"),historicalAccess:ex.default("session-only"),dataSharesInPlace:h.zMY().default(!0),vaultConsent:eq.optional(),vaultKeyCustody:en.default("file"),vaultInlineReveal:eo.default("masked"),redactFallback:dH.default("warn"),onboardedAt:ab.w$().optional(),modelJudgeConsent:ey.optional(),historySyncConsent:eA.optional(),webChatCapture:eF.optional(),bodyRetention:eH.default({enabled:!1,retainDays:30})});function eJ(){return eI.parse({})}function eK(a){return a.webChatCapture??eF.parse({})}function eL(a){return"attached"===a.runMode&&void 0!==a.controlPlane}function eM(a){return a.label??a.endpoint}function eN(a,b,c){return{id:b,objectType:a.objectType,location:a.location??null,title:a.title??null,hostId:a.hostId??null,attributes:JSON.stringify(a.attributes),firstSeen:c,lastSeen:c}}function eO(a,b,c){return{id:b,url:a.url,name:a.name??null,attributes:JSON.stringify(a.attributes),firstSeen:c,lastSeen:c}}function eP(a){return{id:a.id,parentId:a.parentId??null,rootSessionId:a.rootSessionId??null,eventType:a.eventType,hostId:a.hostId??null,harnessId:a.harnessId??null,sourceProjectId:a.sourceProjectId??null,startedAt:V(a.startedAt),endedAt:a.endedAt?V(a.endedAt):null,severity:a.severity??null,priority:a.priority??null,content:a.content??null,contentHash:a.contentHash??null,attributes:a.attributes?JSON.stringify(a.attributes):null}}function eQ(a,b){return{id:b,class:a.class,label:a.label??null,attributes:a.attributes?JSON.stringify(a.attributes):null}}function eR(a,b){return{id:b,ruleId:a.ruleId,name:a.name,category:a.category,severity:a.severity,definition:a.definition,version:a.version}}function eS(a){return{id:a.id,auditEventId:a.auditEventId,inspectionDefinitionId:a.inspectionDefinitionId,classifiedDataId:a.classifiedDataId??null,spanStart:a.span.start,spanEnd:a.span.end,maskedMatch:a.maskedMatch,actionTaken:a.actionTaken,confidence:a.confidence,findingKey:a.findingKey??null,firstDetectedAt:a.firstDetectedAt?V(a.firstDetectedAt):null}}function eT(a){let b=a.metadata;return{source_tool:a.sourceTool,...b?.repo!==void 0?{repo:b.repo}:{},...b?.filePath!==void 0?{file_path:b.filePath}:{},...b?.toolName!==void 0?{tool_name:b.toolName}:{},...b?.gitignored!==void 0?{gitignored:b.gitignored}:{},...b?.wholeFile!==void 0?{whole_file:b.wholeFile}:{},...b?.correlationId!==void 0?{correlation_id:b.correlationId}:{},...b?.traceId!==void 0?{trace_id:b.traceId}:{},...b?.exceptionIds!==void 0?{exception_ids:b.exceptionIds}:{},...b?.inspectionMs!==void 0?{inspection_ms:b.inspectionMs}:{},...b?.redactDegradedTo!==void 0?{redact_degraded_to:b.redactDegradedTo}:{},...b?.model!==void 0?{model:b.model}:{},...b?.turnIndex!==void 0?{turn_index:b.turnIndex}:{},...b?.messageId!==void 0&&""!==b.messageId?{message_id:b.messageId}:{},...b?.conversationId!==void 0?{conversation_id:b.conversationId}:{}}}function eU(a){return`capture/${a.category}/${a.severity}`}function eV(a){return{ruleId:a.ruleId,version:eU(a),name:a.ruleId,category:a.category,severity:a.severity,definition:JSON.stringify({ruleId:a.ruleId})}}var eW=c(35737);let eX="managed-settings.json",eY=h.k5n(["runMode","historicalAccess","vaultConsent","vaultKeyCustody","vaultInlineReveal","modelJudgeConsent","dataSharesInPlace","redactFallback","bodyRetention"]).meta({id:"ManagedSettingKey"}),eZ=h.Ikc({runMode:h.k5n(["standalone","attached"]).optional(),controlPlane:h.Ikc({endpoint:h.YjP().min(1),label:h.YjP().min(1).optional()}).optional(),historicalAccess:h.k5n(["full","session-only"]).optional(),vaultConsent:h.zMY().optional(),vaultKeyCustody:h.k5n(["file","keychain"]).optional(),vaultInlineReveal:h.k5n(["masked","full","off"]).optional(),modelJudgeConsent:h.zMY().optional(),dataSharesInPlace:h.zMY().optional(),redactFallback:dH.optional(),bodyRetention:eH.optional()}).meta({id:"ManagedSettingsValues"}),e$=h.Ikc({specVersion:h.aig().int().positive().default(1),organization:h.YjP().min(1).optional(),values:h.g1P(h.YjP(),h.L5J()).default({}),lockedFields:h.YOg(h.YjP()).default([])}).transform(({lockedFields:a,values:b,...c},d)=>{let e=[],f=[];for(let b of a)eY.safeParse(b).success?e.push(b):f.push(b);let g=Object.create(null),h=[];for(let[a,c]of Object.entries(b))Object.hasOwn(eZ.shape,a)?g[a]=c:h.push(a);let i=eZ.safeParse(g);if(!i.success){for(let a of i.error.issues)d.addIssue({...a,path:["values",...a.path]});return eW.tm}return{...c,values:i.data,lockedFields:e,...f.length>0?{unknownLockedFields:f}:{},...h.length>0?{unknownValueFields:h}:{}}}).meta({id:"ManagedSettings"}),e_={present:!1,lockedFields:[]};function e0(a){let b=a.organization??"Your organization";switch(a.reason){case"held-standalone":return`${b} manages this machine and has set it to standalone, so it cannot be attached here.`;case"pinned-endpoint":return`${b} manages this machine and has pinned it to ${a.endpoint}. Attach to that endpoint, or ask them to change it.`;case"pinned-label":case"label-required":return`${b} manages this machine name, so it cannot be renamed here.`;case"held-attached":return`${b} manages this machine's attachment to ${a.endpoint}, so it cannot be detached here. Ask them to change it.`}}let e1=h.Ikc({path:h.YjP().min(1),name:h.YjP().min(1),origin:bf,defaultAccess:be});h.Ikc({files:h.YOg(e1),truncated:h.zMY(),scannedAt:h.YjP()});let e2=["7d","30d","3m","6m"],e3=h.k5n(e2).meta({id:"TimeRange"}),e4={"7d":7,"30d":30,"3m":90,"6m":180};e3.catch("7d");let e5="dismiss",e6=av.extract(["acknowledged","false-positive"]).meta({id:"DismissMethod"}),e7=h.Ikc({ruleId:h.YjP().max(200),method:h.YjP(),confirmation:h.YjP()});h.Ikc({ruleId:h.YjP().max(200),method:e6,confirmation:h.YjP()});let e8=h.k5n(["still-valid","unknown","invalid"]),e9=h.Ikc({filePath:h.YjP(),span:an.optional()}).strict(),fa=h.Ikc({provider:h.YjP(),maskedToken:h.YjP(),where:e9,state:e8,observedAt:ab.w$().optional()}).strict();h.Ikc({provider:h.YjP(),maskedToken:h.YjP(),consolePath:h.YjP(),occurrenceSpread:h.aig().int().positive()}).strict();let fb=h.k5n(["redact-rotation-checklist","redact-only","set-secret-redact","leave"]),fc=h.k5n(["first-run","pre-push","secret-scan"]);h.Ikc({entrySource:fc}).strict();let fd=h.Ikc({id:fb,label:h.YjP()}),fe=h.Ikc({kind:h.euz("decision"),entrySource:fc,secretCount:h.aig().int().positive(),prompt:h.YjP(),options:h.PVZ([fd.extend({id:h.euz("redact-rotation-checklist")}),fd.extend({id:h.euz("redact-only")}),fd.extend({id:h.euz("set-secret-redact")}),fd.extend({id:h.euz("leave")})])}),ff=h.Ikc({kind:h.euz("no-decision")});h.gMt("kind",[fe,ff]);let fg=h.Ikc({severity:ak,count:h.aig().int().nonnegative(),caught:h.aig().int().nonnegative().optional(),openAtRest:h.aig().int().nonnegative().optional()}).meta({id:"SeveritySummaryItem"});h.Ikc({total:h.aig().int().nonnegative(),needsRemediation:h.aig().int().nonnegative().optional(),bySeverity:h.YOg(fg)}).meta({id:"SeveritySummaryResponse"}),h.Ikc({range:h.k5n(e2).default("7d")});let fh=h.k5n(["blocked","redacted","warned"]).meta({id:"EnforcementActionKind"}),fi=h.Ikc({kind:fh,count:h.aig().int().nonnegative(),delta:h.aig().int()}).meta({id:"EnforcementAction"});h.Ikc({range:e3,total:h.aig().int().nonnegative(),actions:h.YOg(fi)}).meta({id:"EnforcementActionsResponse"});let fj=h.k5n(["day","week"]).meta({id:"TimeseriesGranularity"}),fk=h.Ikc({timestamp:ab.p6(),critical:h.aig().int().nonnegative(),high:h.aig().int().nonnegative(),medium:h.aig().int().nonnegative(),low:h.aig().int().nonnegative().optional()}).meta({id:"FindingsTimeseriesPoint"});h.Ikc({range:e3,granularity:fj,points:h.YOg(fk)}).meta({id:"FindingsTimeseriesResponse"});let fl=h.Ikc({timestamp:ab.p6(),bySeverity:h.Ikc({critical:h.aig().nonnegative().nullable(),high:h.aig().nonnegative().nullable(),medium:h.aig().nonnegative().nullable(),low:h.aig().nonnegative().nullable()})}).meta({id:"MttrTrendPoint"});h.Ikc({range:e3,granularity:fj,points:h.YOg(fl)}).meta({id:"MttrTrendResponse"});let fm=h.Ikc({findingKey:h.YjP(),ruleId:h.YjP(),severity:ak,repo:h.YjP().optional(),path:h.YjP(),resolvedAt:ab.w$(),detectedAt:ab.w$()}).meta({id:"ResolvedFeedItem"});h.Ikc({items:h.YOg(fm)}).meta({id:"RecentlyResolvedResponse"});let fn=["repo","user"],fo=h.k5n(fn).meta({id:"SourceKind"}),fp=h.Ikc({id:h.YjP(),name:h.YjP(),kind:fo,findingsCount:h.aig().int().nonnegative()}).meta({id:"TopSource"});h.Ikc({range:e3,items:h.YOg(fp)}).meta({id:"TopSourcesResponse"}),h.Ikc({range:h.k5n(e2).default("7d"),limit:ac.ai().int().min(1).max(50).default(5),kind:h.k5n(fn).optional()});let fq=ae.extract(["ClaudeCode","Cursor","Codex","Antigravity","ClaudeAi","ChatGpt","Copilot","Api"]).meta({id:"Provider"}),fr=h.Ikc({provider:fq,coverage:h.aig().int().min(0).max(100),supported:h.zMY()}).meta({id:"ScanCoverageProvider"});h.Ikc({range:e3,providers:h.YOg(fr)}).meta({id:"ScanCoverageResponse"});let fs=h.k5n(["repo","user","team","policy","share","rule"]).meta({id:"SubjectType"}),ft=h.Ikc({type:fs,id:h.YjP(),label:h.YjP()}).meta({id:"RecommendationSubject"}),fu=h.k5n(["apply","navigate"]).meta({id:"RecommendationActionMode"}),fv=h.Ikc({mode:fu,type:h.YjP(),label:h.YjP(),href:h.YjP().optional(),policyId:h.YjP().optional(),teamId:h.YjP().optional()}).meta({id:"RecommendationAction"}),fw=h.Ikc({id:h.YjP(),category:h.YjP(),severity:ak,title:h.YjP(),description:h.YjP(),subjects:h.YOg(ft),action:fv}).meta({id:"RecommendedAction"});h.Ikc({items:h.YOg(fw)}).meta({id:"RecommendedActionsResponse"}),h.Ikc({limit:ac.ai().int().min(1).max(20).default(3)});let fx=h.Ikc({type:h.YjP(),policyId:h.YjP().optional(),teamId:h.YjP().optional()}).meta({id:"AppliedAction"});h.Ikc({id:h.YjP(),status:h.euz("applied"),appliedAction:fx}).meta({id:"ApplyRecommendedActionResponse"}),h.Ikc({id:h.YjP(),status:h.euz("dismissed")}).meta({id:"DismissRecommendedActionResponse"}),h.Ikc({id:h.YjP()});let fy=h.k5n(["granted","revoked","unchanged"]).meta({id:"HistorySyncConsentChoice"}),fz=h.k5n(["granted","revoked","unchanged"]).meta({id:"ModelJudgeConsentChoice"}),fA=h.k5n(["granted","revoked","unchanged"]).meta({id:"WebChatCaptureConsentChoice"}),fB=h.Ikc({historicalAccess:h.YjP(),modelJudgeConsent:fz,historySyncConsent:fy,vaultConsent:h.YjP(),vaultInlineReveal:h.YjP(),webChatCaptureConsent:fA,redactFallback:h.YjP(),bodyRetention:h.Ikc({enabled:h.zMY(),retainDays:h.aig()})}),fC=h.Ikc({endpoint:h.YjP(),label:b6(200).optional(),accessKey:h.YjP()});h.Ikc({ruleId:h.YjP(),category:aj,severity:ak,maskedMatch:h.YjP(),rawMatch:h.YjP(),context:h.YjP(),filePath:h.YjP().optional(),confidence:h.aig().min(0).max(1),id:h.YjP().optional(),valueFingerprint:h.YjP().optional(),keyVersion:h.aig().int().nonnegative().optional()});let fD=h.Ikc({category:aj,action:dW,reasoning:h.YjP(),genuineCount:h.aig().int().nonnegative(),fpCount:h.aig().int().nonnegative(),fpIds:h.YOg(h.YjP())});h.Ikc({perCategory:h.YOg(fD),notes:h.YjP()});let fE=h.Ikc({total:h.aig().int().nonnegative(),important:h.aig().int().nonnegative(),routine:h.aig().int().nonnegative()}).refine(a=>a.total===a.important+a.routine,{message:"total must equal important + routine",path:["total"]}),fF=h.Ikc({ruleId:h.YjP(),category:aj,valueFingerprint:h.YjP(),keyVersion:h.aig().int().nonnegative()}),fG=h.Ikc({pattern:h.YjP(),count:h.aig().int().nonnegative(),values:h.YOg(fF).min(1)}),fH=h.Ikc({category:aj,count:h.aig().int().nonnegative(),egress:h.zMY()}),fI=h.Ikc({counts:fE,routineCategories:h.YOg(aj),surfacedCategories:h.YOg(aj),findingKinds:h.YOg(fH),posture:h.g1P(aj,dG),maskedFindings:h.YOg(fa).optional(),falsePositivePatterns:h.YOg(fG).optional()}),fJ=fD.pick({category:!0,genuineCount:!0,fpCount:!0}).extend({egress:h.zMY()});h.Ikc({categories:h.YOg(fJ),posture:h.g1P(aj,dG)}),h.Ikc({frame:fI,copy:h.YjP()}),h.k5n(["scan","floor"]);let fK=h.Ikc({id:h.k5n(["enter-remediation","open-dashboard","not-now"]),label:h.YjP()}),fL=h.PVZ([fK.extend({id:h.euz("open-dashboard")}),fK.extend({id:h.euz("not-now")})]),fM=h.PVZ([fK.extend({id:h.euz("enter-remediation")}),fK.extend({id:h.euz("open-dashboard")}),fK.extend({id:h.euz("not-now")})]);h.Ikc({worthALook:h.aig().int().nonnegative(),liveKeys:h.aig().int().nonnegative().optional(),options:h.KCZ([fL,fM])}).refine(a=>a.options.some(a=>"enter-remediation"===a.id)===(a.liveKeys??0)>0,{message:"the chain-entry option is present exactly when liveKeys > 0",path:["options"]}).refine(a=>(a.liveKeys??0)<=a.worthALook,{message:"liveKeys is a subset of worthALook and cannot exceed it",path:["liveKeys"]});let fN=new Set(["recognized","internal"]);function fO(a){return fN.has(a)?"allowed":"review"}function fP(a){return"block"===a?"blocked":"allowed"}function fQ(a,b){return null===b?fO(a):fP(b)}function fR(a,b){return null!==b&&fP(b)!==fO(a)}function fS(a,b,c){let d=function(a,b){let c=[];return"ip"===a&&c.push("raw_ip"),"unverified"===a&&c.push("unverified_domain"),(b.includes("http")||b.includes("ws"))&&c.push("plaintext_transport"),c}(a,b);return{needsReview:d.length>0&&!c,reasons:d}}function fT(a){return Array.from(new Set(a))}function fU(a){let b=new Set(a);return bz.filter(a=>b.has(a))}function fV(a){return fU(a)[0]??"none"}let fW={raw_ip:0,unverified_domain:1,plaintext_transport:2};function fX(a){return 0===a.length?1/0:Math.min(...a.map(a=>fW[a]))}let fY={Stable:"stable",Beta:"beta",Nightly:"nightly"},fZ={[fY.Stable]:"latest",[fY.Beta]:"beta",[fY.Nightly]:"nightly"},f$={Channel:"channel",Graduated:"graduated",Unpublished:"unpublished",Unknown:"unknown"},f_=h.k5n(["site","estimated","none"]),f0=h.Ikc({inputTokens:h.aig().int().nonnegative().optional(),outputTokens:h.aig().int().nonnegative().optional(),cacheReadInputTokens:h.aig().int().nonnegative().optional(),cacheCreationInputTokens:h.aig().int().nonnegative().optional()}),f1=h.Ikc({toolUseId:h.YjP().min(1),toolName:h.YjP().min(1),target:h.YjP().optional(),isError:h.zMY().optional(),inputSize:h.aig().int().nonnegative().optional(),outputSize:h.aig().int().nonnegative().optional()});h.Ikc({messageId:h.YjP().min(1),startedAt:ab.w$(),model:h.YjP().optional(),usage:f0.optional(),usageSource:f_,stopReason:h.YjP().optional(),conversationId:h.YjP().optional(),turnIndex:h.aig().int().nonnegative().optional(),toolCalls:h.YOg(f1).default([]),responseText:h.YjP().optional(),truncated:h.zMY().default(!1)});let f2=h.k5n(["watching","composer-only","button-only","unattached","unknown"]),f3=h.Ikc({patched:h.zMY(),live:h.zMY(),blind:h.zMY(),sendsSeenDom:h.aig().int().nonnegative(),exchangesSeenNet:h.aig().int().nonnegative(),parseFailures:h.aig().int().nonnegative(),unparsedBodies:h.aig().int().nonnegative(),shapeMisses:h.YOg(h.YjP()).default([]),conversationEndpoints:h.aig().int().nonnegative().default(0),closed:h.zMY().default(!1),enforcement:f2.default("unknown")});function f4(a){return a.find(a=>{var b;return!(b=a.status).patched||0===b.conversationEndpoints||b.blind||b.shapeMisses.length>0||b.parseFailures>0||b.unparsedBodies>0||b.exchangesSeenNet>0})??a[0]}let f5=2592e6,f6=30;function f7(a){let b=aS.safeParse(a);if(!b.success)return null;let c=b.data,d=f3.safeParse({patched:c.patched,live:c.live,blind:c.blind,sendsSeenDom:c.sends_seen_dom,exchangesSeenNet:c.exchanges_seen_net,parseFailures:c.parse_failures,unparsedBodies:c.unparsed_bodies,shapeMisses:c.shape_misses,conversationEndpoints:c.conversation_endpoints,closed:c.closed,enforcement:c.enforcement});return d.success?d.data:null}}};
+      )`),a.exec("DELETE FROM app_meta WHERE key LIKE 'sample_seeded:%'")})}catch{}}(f)},transaction:async function a(a){f.exec("BEGIN");try{let b=await a();return f.exec("COMMIT"),b}catch(a){try{f.exec("ROLLBACK")}catch{}throw a}},close:()=>{f.close()},[cu]:f}}let cA=/^(?:[^@/]+@)?([^/:]+):(.+)$/,cB=/^[A-Za-z]:[\\/]/,cC=/^file:\/\//i,cD=/^[a-z][a-z0-9+.-]*:\/\/(?:[^@/]+@)?([^/:]+)(?::\d+)?(\/.*)?$/i,cE=".git";function cF(a){return{host:a.host,kind:a.kind,name:a.name,category:a.category,providerId:a.providerId,trust:a.trust,network:a.network,method:a.method,transport:a.transport,url:a.url,template:a.template,dataClass:a.dataClass,site:{file:a.site.file,line:a.site.line,dynamic:a.site.dynamic,vendored:a.site.vendored}}}function cG(a){let{hits:b,droppedFiles:c}=cm(a.hits,a.reconcile.mode),d=cn(a.reconcile,c);return{projectKey:function(a){let b=a.startsWith("git:")?`git:${function(a){let b=a.trim();if(cB.test(b)||cC.test(b))return b;let c=cD.exec(b),d=null===c?cA.exec(b):null,e=(c?.[1]??d?.[1])?.toLowerCase();if(void 0===e)return b;let f=function(a){let b=0,c=a.length;for(;b<c&&47===a.charCodeAt(b);)b+=1;for(;c>b&&47===a.charCodeAt(c-1);)c-=1;return a.slice(b,c)}((null===c?d?.[2]:c[2])??""),g=f.endsWith(cE)?f.slice(0,-cE.length):f;return""===g?e:`${e}/${g}`}(a.slice(4))}`:a;return(0,F.createHash)("sha256").update(`v2:${b}`,"utf8").digest("hex")}(a.projectKey),project:a.project,reconcile:d,hits:b.map(cF)}}function cH(a){let b=a.filePath.replaceAll("\\","/");return(0,F.createHash)("sha256").update(`${a.ruleId}\0${b}\0${a.valueFingerprint}`).digest("hex")}function cI(a){return(0,e.join)(a,"exception.key")}let cJ={exceptions:"key_version",blocked_detections:"key_version",secret_vault:"fingerprint_key_version"};class cK extends Error{constructor(a){super(`cannot read the stored fingerprint key versions: ${a instanceof Error?a.message:String(a)}`,{cause:a}),this.code="floor-unreadable",this.name="FloorUnreadableError"}}function cL(a){let b,c=(0,e.join)(a,l);if(!(0,d.existsSync)(c))return 0;try{(b=new G.DatabaseSync(c,{readOnly:!0})).exec(`PRAGMA busy_timeout = ${String(250)}`);let a=0;for(let[c,d]of Object.entries(cJ))try{let e=ac(b.prepare(`SELECT MAX(${d}) AS v FROM ${c}`));a=Math.max(a,e?.v??0)}catch(a){if(1!==a.errcode)throw new cK(a)}return a}catch(a){throw a instanceof cK?a:new cK(a)}finally{b?.close()}}function cM(a){return JSON.stringify({version:a.version,material:a.material.toString("base64")})}function cN(a){let b;try{b=(0,d.readFileSync)(cI(a),"utf8")}catch(a){if("ENOENT"===a.code)return null;throw a instanceof Error?a:Error(String(a))}let c=JSON.parse(b);if("object"!=typeof c||null===c)throw Error("exception key file is corrupt: not a JSON object");let{version:e,material:f}=c;if("number"!=typeof e||!Number.isInteger(e)||e<1)throw Error("exception key file is corrupt: bad version");if("string"!=typeof f)throw Error("exception key file is corrupt: bad material");let g=Buffer.from(f,"base64");if(32!==g.length)throw Error("exception key file is corrupt: bad material length");return{version:e,material:g}}function cO(a){let b=cN(a);return b?(r(cI(a)),b):function(a,b){p(a);let c=cI(a);if(x(c,`${cM(b)}
+`))return b;let d=cN(a);if(d)return r(c),d;let e=v(c);throw new w(function(a,b){switch(b){case"symlink":return`exception key file is a symlink (${a}); remove it so a key can be created`;case"gone":return"exception key file was removed while it was being created";case"unknown":return`exception key file (${a}) is occupied but cannot be inspected; check the permissions on its directory`}}(c,e.kind),e.cause)}(a,{version:cL(a)+1,material:(0,F.randomBytes)(32)})}function cP(a){var b;let c=cN(a);return b={version:Math.max(c?.version??0,cL(a))+1,material:(0,F.randomBytes)(32)},p(a),u(cI(a),`${cM(b)}
+`),b}function cQ(a,b){return cR(a,(0,j.l0v)(b))}function cR(a,b){return(0,F.createHmac)("sha256",a.material).update(b,"utf8").digest("hex")}function cS(a,b){var c;return(0,j.qEQ)(b,null===(c=a)?{status:"absent"}:{status:"present",version:c.version})}function cT(a,b=Date.now()){try{return function(a,b){try{let c=JSON.parse(a);if("object"!=typeof c||null===c)return null;let d="number"==typeof c.consecutiveFailures&&c.consecutiveFailures>=0?c.consecutiveFailures:0,e="number"==typeof c.openedAtMs&&Number.isFinite(c.openedAtMs)&&c.openedAtMs<=b?c.openedAtMs:null,f=j.QA8.safeParse(c.lastFailure),g=f.success?f.data:null;return{consecutiveFailures:d,openedAtMs:e,lastFailure:g}}catch{return null}}((0,d.readFileSync)((0,e.join)(a,g),"utf8"),b)}catch{return null}}function cU(a,b){let c=a?.openedAtMs??null;return null!==c&&b-c<3e4}function cV(a,b){if((0,d.existsSync)((0,e.join)(a,l)))try{let c=cz(a);try{c.historySync.markCaptureBacklogOwed(b)}finally{c.close()}}catch{}}function cW(a,b){let c,d;try{c=void 0===b?br():b,d=function(a=bi(),b){let c=void 0===b?br():b;return{settings:bt(bw(a),c),managed:bs(c)}}(a,c).settings}catch{return null}if(null===c)return null;let e=c.lockedFields.includes("runMode"),f=void 0!==c.values.runMode,g=void 0!==c.values.controlPlane;return e||f||g?{who:void 0===c.organization?{}:{organization:c.organization},settings:d,frozen:e,modePinned:f,planePinned:g,pinnedLabel:c.values.controlPlane?.label}:null}function cX(a){let{who:b,settings:c,frozen:d,modePinned:e}=a;if(!d&&!e)return null;if("attached"!==c.runMode)return{reason:"held-standalone",...b};let f=c.controlPlane;return(0,j.lgf)(c)&&void 0!==f?{reason:"held-attached",...b,endpoint:f.endpoint}:null}function cY(a,b=bi(),c){let d=cW(b,c);if(null===d)return null;let{who:e,settings:f,frozen:g,planePinned:h,pinnedLabel:i}=d,j=""===a.label?void 0:a.label,k=cX(d);if(k?.reason==="held-standalone")return k;let l=f.controlPlane;return g||h?void 0!==l&&l.endpoint!==a.endpoint?{reason:"pinned-endpoint",...e,endpoint:l.endpoint}:g&&void 0!==l&&j!==l.label?void 0===j?{reason:"label-required",...e}:{reason:"pinned-label",...e}:h&&void 0!==i&&void 0!==j&&j!==i?{reason:"pinned-label",...e}:null:null}function cZ(a=bi(),b){let c=cW(a,b);if(null===c)return null;let d=cX(c);return d?.reason==="held-attached"?d:null}let c$="ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";function c_(a){let b="",c=0,d=0;for(let e of a)for(c=c<<8|e,d+=8;d>=5;)b+=c$.charAt(c>>>d-5&31),d-=5;return d>0&&(b+=c$.charAt(c<<5-d&31)),b}function c0(a){let b=[],c=0,d=0;for(let e of a){let a=c$.indexOf(e);if(a<0)throw Error("base32: character outside the alphabet");c=c<<5|a,(d+=5)>=8&&(b.push(c>>>d-8&255),d-=8)}return Buffer.from(b)}function c1(a){if(!Number.isInteger(a)||a<1||a>0xffffffff)throw Error("vault: key version out of range");let b=[],c=a;for(;c>0;)b.unshift(255&c),c=Math.floor(c/256);return c_(Uint8Array.from(b))}function c2(a){let b=b=>Buffer.from((0,F.hkdfSync)("sha256",a,"aka:vault:v1",b,32));return{enc:b("aka:vault:enc:v1"),sign:b("aka:vault:sign:v1")}}function c3(a,b,c,d=j.viY){if(16!==b.length)throw Error("vault: pointer id must be 16 bytes");let e=Buffer.alloc(6);return e.writeUInt16BE(d,0),e.writeUInt32BE(a,2),Buffer.concat([e,Buffer.from(b),Buffer.from(c,"utf8")])}function c4(a,b,c,d){let e=(0,F.createCipheriv)("aes-256-gcm",a,d);return e.setAAD(c),{ciphertext:Buffer.concat([e.update(b,"utf8"),e.final()]),nonce:d,authTag:e.getAuthTag()}}function c5(a,b,c){try{let d=(0,F.createDecipheriv)("aes-256-gcm",a,b.nonce);return d.setAAD(c),d.setAuthTag(b.authTag),Buffer.concat([d.update(b.ciphertext),d.final()]).toString("utf8")}catch{return null}}function c6(a,b,c,d){return(0,F.createHmac)("sha256",a).update(c3(b,c,d,j.viY)).digest().subarray(0,10)}function c7(a,b,c,d,e){if(10!==e.length)return!1;let f=c6(a,b,c,d);return(0,F.timingSafeEqual)(f,Buffer.from(e))}var c8=c(31421);let c9={symlink:"the path is a symlink; remove it so a keyring can be created",gone:"the path was occupied but holds no keyring (removed while it was being created)",unknown:"the path is occupied but cannot be inspected; check the permissions on its directory"};class da extends Error{constructor(a){super(`vault: key epoch ${String(a)} is not present in the keyring`),this.name="VaultKeyEpochMissingError",this.version=a}}let db="vault.key",dc="aka-vault",dd="keyring";function de(a){let b=JSON.parse(a);if("object"!=typeof b||null===b)throw Error("vault key file is corrupt: not a JSON object");let{current:c,keys:d}=b;if("number"!=typeof c||!Number.isInteger(c)||c<1)throw Error("vault key file is corrupt: bad current version");if("object"!=typeof d||null===d||Array.isArray(d))throw Error("vault key file is corrupt: bad keys map");let e=new Map;for(let[a,b]of Object.entries(d)){let c=Number(a);if(!Number.isInteger(c)||c<1)throw Error("vault key file is corrupt: bad key version");if("string"!=typeof b)throw Error("vault key file is corrupt: bad key material");let d=Buffer.from(b,"base64");if(32!==d.length)throw Error("vault key file is corrupt: bad key material length");e.set(c,d)}if(!e.has(c))throw Error("vault key file is corrupt: current version has no material");return{current:c,keys:e}}function df(a){let b={};for(let c of[...a.keys.keys()].sort((a,b)=>a-b)){let d=a.keys.get(c);d&&(b[String(c)]=d.toString("base64"))}return JSON.stringify({current:a.current,keys:b})}function dg(){return{current:1,keys:new Map([[1,(0,F.randomBytes)(32)]])}}function dh(a){let b=Math.max(...a.keys.keys())+1,c=new Map(a.keys);return c.set(b,(0,F.randomBytes)(32)),{current:b,keys:c}}function di(a){let b=a.keys.get(a.current);if(!b)throw new da(a.current);return{material:b,version:a.current}}function dj(a,b){let c=a.keys.get(b);if(!c)throw new da(b);return{material:c,version:b}}function dk(a){try{return Promise.resolve(a())}catch(a){return Promise.reject(a instanceof Error?a:Error(String(a)))}}function dl(a){return a instanceof Error?a:Error(String(a))}let dm="owner",dn="vault: a key rotation is already in progress";function dp(a,b){try{o(a),n(a)}catch(a){if("EEXIST"===a.code)return!1;throw dl(a)}try{return(0,d.writeFileSync)((0,e.join)(a,dm),`${b}
+`,{mode:384}),!0}catch(b){throw(0,d.rmSync)(a,{recursive:!0,force:!0}),dl(b)}}function dq(a,b){p(a);let c=function(a){let b,c=(0,e.join)(a,`${db}.lock`),f=(0,F.randomBytes)(16).toString("hex");if(dp(c,f))return{lock:c,owner:f};try{b=(0,d.statSync)(c)}catch{throw Error(dn)}if(Date.now()-b.mtimeMs<6e4)throw Error(dn);let g=`${c}.stale.${f}`;try{let a=(0,d.statSync)(c);if(a.ino!==b.ino||a.mtimeMs!==b.mtimeMs)throw Error(dn);(0,d.renameSync)(c,g)}catch(a){if(a instanceof Error&&a.message===dn)throw a;throw Error(dn,{cause:a})}if((0,d.rmSync)(g,{recursive:!0,force:!0}),!dp(c,f))throw Error(dn);return{lock:c,owner:f}}(a);try{return b()}finally{!function(a){try{if((0,d.readFileSync)((0,e.join)(a.lock,dm),"utf8").trim()!==a.owner)return}catch{return}(0,d.rmSync)(a.lock,{recursive:!0,force:!0})}(c)}}class dr{#a;constructor(a){this.#a=a}get filePath(){return(0,e.join)(this.#a,db)}loadOrCreate(){return dk(()=>{let a=this.#b();return a?(ds(this.filePath),di(a)):di(this.#c())})}rotate(){return dk(()=>dq(this.#a,()=>{let a=this.#b();return a?di(this.#d(dh(a))):di(this.#c())}))}materialFor(a){return dk(()=>{let b=this.#b();if(!b)throw new da(a);return dj(b,a)})}#b(){let a;try{a=(0,d.readFileSync)(this.filePath,"utf8")}catch(a){if("ENOENT"===a.code)return null;throw a instanceof Error?a:Error(String(a))}return de(a)}#c(){p(this.#a);let a=dg();if(x(this.filePath,`${df(a)}
+`))return a;let b=this.#b();if(!b){let a=v(this.filePath);throw new w(`vault: cannot create a key file at ${this.filePath} — ${c9[a.kind]}`,a.cause)}return ds(this.filePath),b}#d(a){return p(this.#a),u(this.filePath,`${df(a)}
+`),a}}function ds(a){try{(0,d.chmodSync)(a,384)}catch{}}let dt=(a,b)=>(0,c8.execFileSync)("/usr/bin/security",a,{encoding:"utf8",input:b,timeout:5e3,stdio:[void 0===b?"ignore":"pipe","pipe","ignore"]});function du(a){let b=[];return"number"==typeof a.status&&b.push(`exit ${String(a.status)}`),"string"==typeof a.signal&&a.signal&&b.push(`signal ${a.signal}`),"string"==typeof a.code&&a.code&&b.push(a.code),b.length>0?b.join(", "):"unknown error"}function dv(a,b,c){let d=["add-generic-password",...b?["-U"]:[],"-s",dc,"-a",dd,"-X",Buffer.from(df(a),"utf8").toString("hex")];if(void 0!==c){if(/['\\\n\r\0]/.test(c))throw Error("vault: keychain path contains a quote, backslash, line break or NUL, which security -i cannot carry intact");d.push(`'${c}'`)}return`${d.join(" ")}
+`}class dw{#a;#e;#f;#g;constructor(a,b=dt,c){if(b===dt&&"darwin"!==process.platform)throw Error(`keychain custody is not available on this platform (${process.platform}); use file custody`);this.#a=a,this.#e=b,this.#f=c,this.#g=void 0===c?[]:[c]}get keysDir(){return this.#a}loadOrCreate(){return dk(()=>{let a=this.#b();return a?di(a):di(this.#h(dg()))})}rotate(){return dk(()=>dq(this.#a,()=>{let a=this.#b();return a?di(this.#i(dh(a))):di(this.#h(dg()))}))}materialFor(a){return dk(()=>{let b=this.#b();if(!b)throw new da(a);return dj(b,a)})}#b(){let a;try{a=this.#e(["find-generic-password","-s",dc,"-a",dd,"-w",...this.#g])}catch(a){if(44===a.status)return null;throw Error(`vault: keychain read failed (${du(a)}); refusing to treat the failure as an absent keyring`)}let b=a.trim();if(0===b.length)return null;try{return de(b)}catch(a){throw Error(`vault: keychain item is not a usable keyring (${a instanceof SyntaxError?"malformed JSON":a instanceof Error?a.message:"unknown"})`)}}#h(a){let b=dv(a,!1,this.#f);try{this.#e(["-i"],b)}catch(b){let a=this.#b();if(a)return a;throw Error(`vault: keychain write failed (${du(b)})`)}return a}#i(a){let b=dv(a,!0,this.#f);try{this.#e(["-i"],b)}catch(a){throw Error(`vault: keychain write failed (${du(a)})`)}return a}}function dx(a,b){return"keychain"===a?new dw(b):new dr(b)}let dy=Symbol("aka.vault.consentAbsent"),dz=Symbol("aka.vault.unavailable");function dA(a){if(!j.XZo.test(a))return null;let b=a.slice(6,-2),c=b.indexOf(":");if(c<0)return null;let d=b.slice(0,c),[e,f,g]=b.slice(c+1).split(".");if(void 0===e||void 0===f||void 0===g)return null;try{let a=function(a){let b=c0(a);if(0===b.length||b.length>4)throw Error("vault: bad key version encoding");let c=0;for(let a of b)c=256*c+a;if(c<1)throw Error("vault: bad key version");return c}(e),b=c0(f),c=c0(g);if(c1(a)!==e||c_(b)!==f||c_(c)!==g)return null;return{category:d,keyVersion:a,pointerId:b,tag:c}}catch{return null}}class dB{#j;#k;#l;#m;#n;constructor(a){this.#j=a.repo,this.#k=a.keys,this.#l=a.isConsented,this.#m=a.verifyGrant,this.#n=a.now??(()=>Date.now())}async tokenize(a,b,c){if(!this.#l())return dy;let d=c(),e=cR(d,a),f=cQ(d,a),g=this.#j.byValueFingerprint(e),h=this.#n();if(g)return g.valueIdentityFingerprint!==f&&this.#j.setIdentityFingerprint(g.pointerId,f),this.#j.upsert({...g,provider:g.provider??void 0,userAuthorized:!0===b.userAuthorized},h),await this.#o(g.keyVersion,g.pointerId,g.category);let{material:i,version:k}=await this.#k.loadOrCreate(),l=c2(i),m=(0,F.randomBytes)(16),n=c3(k,m,b.category,j.viY),o=c4(l.enc,a,n,(0,F.randomBytes)(12)),{row:p}=this.#j.upsert({pointerId:c_(m),valueFingerprint:e,valueIdentityFingerprint:f,fingerprintKeyVersion:d.version,keyVersion:k,formatVersion:j.viY,category:b.category,ruleId:b.ruleId,maskedMatch:b.maskedMatch,provider:b.provider,userAuthorized:!0===b.userAuthorized,ciphertext:o.ciphertext.toString("base64"),nonce:o.nonce.toString("base64"),authTag:o.authTag.toString("base64")},h);return await this.#o(p.keyVersion,p.pointerId,p.category)}async detokenize(a,b){let c,d,e=dA(a);if(!e)return dz;try{let a=await this.#k.materialFor(e.keyVersion);c=c2(a.material).sign}catch{return dz}if(!c7(c,e.keyVersion,e.pointerId,e.category,e.tag))return dz;let f=c_(e.pointerId),g=this.#j.byPointerId(f);if(!g)return this.#p(f,b,"unavailable"),dz;if(g.category!==e.category)return dz;if("model"===b.target){let a,c=b.grantId,d=this.#m;if(void 0===d||void 0===c||""===c)return this.#p(f,b,"refused"),dz;try{a=await d(c,{ruleId:g.ruleId,valueFingerprint:g.valueIdentityFingerprint,fingerprintKeyVersion:g.fingerprintKeyVersion})}catch{a=!1}if(!a)return this.#p(f,b,"refused"),dz}try{let a=await this.#k.materialFor(g.keyVersion);d=c5(c2(a.material).enc,{ciphertext:Buffer.from(g.ciphertext,"base64"),nonce:Buffer.from(g.nonce,"base64"),authTag:Buffer.from(g.authTag,"base64")},c3(g.keyVersion,e.pointerId,g.category,g.formatVersion))}catch{d=null}return null===d?(this.#p(f,b,"unavailable"),dz):(this.#p(f,b,"revealed"),d)}async revealEntry(a,b){let c=this.#j.byPointerId(a);if(!c)return this.#p(a,{target:"human",reason:b.reason},"unavailable"),dz;let d=await this.#q(c);return null===d?(this.#p(a,{target:"human",reason:b.reason},"unavailable"),dz):(this.#p(a,{target:"human",reason:b.reason},"revealed"),d)}async describePointer(a){let b=await this.#r(a);return b?{category:b.category,...void 0===b.provider?{}:{provider:b.provider},maskedMatch:b.maskedMatch,occurrences:b.occurrenceCount,firstSeen:new Date(b.firstSeen).toISOString(),lastSeen:new Date(b.lastSeen).toISOString()}:null}async resolvePointerIdentity(a){let b=await this.#r(a);return b?{ruleId:b.ruleId,valueFingerprint:b.valueIdentityFingerprint,fingerprintKeyVersion:b.fingerprintKeyVersion}:null}async resolvePointerRowId(a){let b=await this.#r(a);return b?b.pointerId:null}async rotateVaultKey(){let a=await this.#k.rotate(),b=c2(a.material).enc,c=0;for(let d of this.#j.listAll()){let e;if(d.keyVersion===a.version)continue;let f=c0(d.pointerId);try{let a=await this.#k.materialFor(d.keyVersion);e=c5(c2(a.material).enc,{ciphertext:Buffer.from(d.ciphertext,"base64"),nonce:Buffer.from(d.nonce,"base64"),authTag:Buffer.from(d.authTag,"base64")},c3(d.keyVersion,f,d.category,d.formatVersion))}catch{e=null}if(null===e)continue;let g=c4(b,e,c3(a.version,f,d.category,d.formatVersion),(0,F.randomBytes)(12));this.#j.replaceCiphertext(d.pointerId,{keyVersion:a.version,ciphertext:g.ciphertext.toString("base64"),nonce:g.nonce.toString("base64"),authTag:g.authTag.toString("base64")}),c+=1}return{version:a.version,reEncrypted:c}}async refreshFingerprints(a){let b=0;for(let c of this.#j.listAll())try{let d=await this.#q(c);if(null===d)continue;this.#j.refreshFingerprint(c.pointerId,{valueFingerprint:cR(a,d),valueIdentityFingerprint:cQ(a,d),fingerprintKeyVersion:a.version}),b+=1}catch{continue}return b}purgeVault(){let a=this.#j.purgeAll();return this.#j.recordDeref({id:(0,F.randomUUID)(),pointerId:"*",at:this.#n(),target:"human",reason:"purge",outcome:"unavailable",pointerCount:Math.max(a,1)}),a}async #o(a,b,c){var d;let e=c0(b),f=c2((await this.#k.materialFor(a)).material).sign;return d=c6(f,a,e,c),`[[aka:${c}:${c1(a)}.${c_(e)}.${c_(d)}]]`}async #q(a){try{let b=await this.#k.materialFor(a.keyVersion);return c5(c2(b.material).enc,{ciphertext:Buffer.from(a.ciphertext,"base64"),nonce:Buffer.from(a.nonce,"base64"),authTag:Buffer.from(a.authTag,"base64")},c3(a.keyVersion,c0(a.pointerId),a.category,a.formatVersion))}catch{return null}}async #r(a){let b=dA(a);if(!b)return null;try{let a=await this.#k.materialFor(b.keyVersion),c=c2(a.material).sign;if(!c7(c,b.keyVersion,b.pointerId,b.category,b.tag))return null}catch{return null}let c=this.#j.byPointerId(c_(b.pointerId));return c?.category!==b.category?null:c}#p(a,b,c){this.#j.recordDeref({id:(0,F.randomUUID)(),pointerId:a,at:this.#n(),target:b.target,reason:b.reason,outcome:c,...void 0===b.grantId?{}:{grantId:b.grantId},pointerCount:(0,j.kqf)(b.reason)?b.pointerCount??1:1})}}}};