@akasecurity/cli 0.9.2 → 0.9.3

package/web-ui/web-ui/.next/server/chunks/142.js

@@ -1,4 +1,4 @@
-"use strict";exports.id=142,exports.ids=[142],exports.modules={42142:(a,b,c)=>{c.d(b,{WR:()=>ah,qA:()=>ai,o8:()=>bn,Qo:()=>bb,KS:()=>bl,tI:()=>bj,_2:()=>bh,Rd:()=>bf,Ji:()=>ba,xR:()=>bm,v5:()=>bg});var d=c(77598),e=c(73024),f=c(76760),g=c(79868),h=c(45615);function i(a){return(0,d.createHash)("sha256").update(a).digest("hex")}function j(a){return i((0,h.tTV)(["source_project",a]))}function k(a,b){return i((0,h.tTV)(["inspection_definition",a,b]))}function l(a){return a.replace(/\\/g,"\\\\").replace(/%/g,"\\%").replace(/_/g,"\\_")}function m(a){return Array.from({length:a},()=>"?").join(", ")}function n(a){return`%${l(a)}%`}function o(a){return`(${a.map(a=>`${a} LIKE ? ESCAPE '\\'`).join(" OR ")})`}let p=0;function q(a,b,c="DEFERRED"){if(a.isTransaction){let c=`aka_sp_${String(p+=1)}`;a.exec(`SAVEPOINT ${c}`);try{b(),a.exec(`RELEASE ${c}`)}catch(b){try{a.exec(`ROLLBACK TO ${c}`),a.exec(`RELEASE ${c}`)}catch{}throw b}return}a.exec("IMMEDIATE"===c?"BEGIN IMMEDIATE":"BEGIN");try{b(),a.exec("COMMIT")}catch(b){try{a.exec("ROLLBACK")}catch{}throw b}}function r(a,b,c="DEFERRED"){let d=a.isTransaction;try{return q(a,b,c),!0}catch(b){if(!a.isTransaction&&d)throw b;return!1}}function s(a){process.stderr.write(`[aka] ${a}
+"use strict";exports.id=142,exports.ids=[142],exports.modules={42142:(a,b,c)=>{c.d(b,{WR:()=>ah,qA:()=>ai,o8:()=>bs,Qo:()=>bc,KS:()=>bq,tI:()=>bo,_2:()=>bl,Dg:()=>bm,Rd:()=>bj,Ji:()=>bb,y9:()=>bi,xR:()=>br,v5:()=>bk});var d=c(77598),e=c(73024),f=c(76760),g=c(79868),h=c(45615);function i(a){return(0,d.createHash)("sha256").update(a).digest("hex")}function j(a){return i((0,h.tTV)(["source_project",a]))}function k(a,b){return i((0,h.tTV)(["inspection_definition",a,b]))}function l(a){return a.replace(/\\/g,"\\\\").replace(/%/g,"\\%").replace(/_/g,"\\_")}function m(a){return Array.from({length:a},()=>"?").join(", ")}function n(a){return`%${l(a)}%`}function o(a){return`(${a.map(a=>`${a} LIKE ? ESCAPE '\\'`).join(" OR ")})`}let p=0;function q(a,b,c="DEFERRED"){if(a.isTransaction){let c=`aka_sp_${String(p+=1)}`;a.exec(`SAVEPOINT ${c}`);try{b(),a.exec(`RELEASE ${c}`)}catch(b){try{a.exec(`ROLLBACK TO ${c}`),a.exec(`RELEASE ${c}`)}catch{}throw b}return}a.exec("IMMEDIATE"===c?"BEGIN IMMEDIATE":"BEGIN");try{b(),a.exec("COMMIT")}catch(b){try{a.exec("ROLLBACK")}catch{}throw b}}function r(a,b,c="DEFERRED"){let d=a.isTransaction;try{return q(a,b,c),!0}catch(b){if(!a.isTransaction&&d)throw b;return!1}}function s(a){process.stderr.write(`[aka] ${a}
 `)}function t(a,b,c){return void 0!==a.prepare("SELECT 1 FROM sqlite_master WHERE type = ? AND name = ? LIMIT 1").get(b,c)}function u(a,b,c){let d=c?.includeGenerated?"table_xinfo":"table_info";return a.prepare(`PRAGMA ${d}(${b})`).all().map(a=>a.name)}function v(a,b){return void 0===b?a.all():Array.isArray(b)?a.all(...b):a.all(b)}function w(a,b){return void 0===b?a.get():Array.isArray(b)?a.get(...b):a.get(b)}function x(a){return 1===a||!0===a}function y(a){let b={};for(let[c,d]of Object.entries(a))b[c]=void 0===d?null:d;return b}function z(a,b,c){return w(a.prepare(b),c)?.n??0}function A(a,b,c){let d=new Map;for(let e of v(a.prepare(b),c))d.set(e.k,e.n);return d}function B(a,b){let c=[];for(let d of a)try{c.push(b(d))}catch{}return c}let C="aka.db";function D(a,b){try{(0,e.chmodSync)(a,b)}catch{}}function E(a){(0,e.mkdirSync)(a,{recursive:!0,mode:448}),D(a,448)}function F(a){return[`${a}-wal`,`${a}-shm`,`${a}-journal`]}function G(a){try{if((0,e.lstatSync)(a).isSymbolicLink())return}catch{}D(a,384)}function H(a,b){let c=`${a}.${String(process.pid)}.tmp`;try{(0,e.rmSync)(c,{force:!0})}catch{}try{(0,e.writeFileSync)(c,b,{mode:384,flag:"wx"}),(0,e.renameSync)(c,a)}finally{try{(0,e.rmSync)(c,{force:!0})}catch{}}G(a)}function I(a){return"column"===a.kind?`column ${a.table}.${a.name}`:`table ${a.name}`}function J(a){return a.split(/-->\s*statement-breakpoint/).map(a=>a.trim()).filter(a=>a.length>0)}let K="0014_drop_legacy_events_findings",L=[{name:"input_tokens",ddl:"ALTER TABLE audit_events ADD COLUMN input_tokens integer GENERATED ALWAYS AS (json_extract(attributes, '$.input_tokens')) VIRTUAL"},{name:"output_tokens",ddl:"ALTER TABLE audit_events ADD COLUMN output_tokens integer GENERATED ALWAYS AS (json_extract(attributes, '$.output_tokens')) VIRTUAL"},{name:"cache_creation_input_tokens",ddl:"ALTER TABLE audit_events ADD COLUMN cache_creation_input_tokens integer GENERATED ALWAYS AS (json_extract(attributes, '$.cache_creation_input_tokens')) VIRTUAL"},{name:"cache_read_input_tokens",ddl:"ALTER TABLE audit_events ADD COLUMN cache_read_input_tokens integer GENERATED ALWAYS AS (json_extract(attributes, '$.cache_read_input_tokens')) VIRTUAL"},{name:"model",ddl:"ALTER TABLE audit_events ADD COLUMN model text GENERATED ALWAYS AS (json_extract(attributes, '$.model')) VIRTUAL"},{name:"provider",ddl:"ALTER TABLE audit_events ADD COLUMN provider text GENERATED ALWAYS AS (json_extract(attributes, '$.provider')) VIRTUAL"}];function M(a,b,c,d){let e=function(a,b){let c=a.prepare("SELECT last_rowid AS lastRowid FROM legacy_copy_watermark WHERE source = ?").get(b);return c?.lastRowid??0}(a,b),f=0;for(;f<1e3;){let g=c.all(e,200);if(0===g.length||(q(a,()=>{var c;d(g),e=g[g.length-1]?.rowid??e,c=e,a.prepare(`INSERT INTO legacy_copy_watermark (source, last_rowid) VALUES (?, ?)
      ON CONFLICT(source) DO UPDATE SET last_rowid = excluded.last_rowid`).run(b,c)},"IMMEDIATE"),f+=g.length,g.length<200))return!0}return!1}function N(a,b){if(null==a)return b;try{return JSON.parse(a)}catch{return b}}function O(a){if(null!=a)try{let b=JSON.parse(a);if("object"==typeof b&&null!==b)return b}catch{}}let P="max(started_at, coalesce(ended_at, started_at))";function Q(){try{return Intl.DateTimeFormat().resolvedOptions().timeZone}catch{return"UTC"}}let R={session:"session",prompt:"prompt",response:"response",tool_call:"tool",hook:"hook",detection:"detection",share:"share",permission:"permission",commit:"commit",error:"error",active:"active"};function S(a){if(!a)return[];let b=N(a,null);return Array.isArray(b)?b:[]}function T(a){let b=h.TUN.safeParse(a);return b.success?b.data:"claudecode"}function U(a,b,c){let d=Math.max(a.started_at,b.lastActivityMs),{status:e,endedAtMs:f}=function(a,b,c){if(a.status){let b=h.PhW.safeParse(a.status);if(b.success)return{status:b.data,endedAtMs:a.ended_at}}return null!==a.ended_at?{status:"completed",endedAtMs:a.ended_at}:b>=c-18e5?{status:"active",endedAtMs:null}:{status:"completed",endedAtMs:b}}(a,d,c);return{id:a.id,harness:T(a.harness),title:a.title||a.project||a.repo||`Session ${a.id.slice(0,8)}`,project:a.project??"",repo:a.repo??"",branches:S(a.branches),startedAt:(0,h.q11)(a.started_at),endedAt:null===f?null:(0,h.q11)(f),status:e,turns:b.turns,findings:b.findings,shares:b.shares}}function V(a){let b=R[a.event_type];if(!b)return null;let c=a.severity?h.U7X.safeParse(a.severity):null,d=a.link?h.Itg.safeParse(a.link):null;return{id:a.id,occurredAt:(0,h.q11)(a.started_at),kind:b,title:a.title??"",detail:a.detail??"",tool:a.tool,severity:c?.success?c.data:null,link:d?.success?d.data:null,targetId:a.target_id,internal:x(a.internal),flagged:x(a.flagged)}}let W=`
   id,
@@ -620,7 +620,7 @@
          attributes = excluded.attributes,
          last_seen = excluded.last_seen`)}upsert(a,b=Date.now()){let c=j(a.url),d=(0,h.QCA)(a,c,b);return this.upsertStmt.run(y({id:d.id,url:d.url,name:d.name,attributes:d.attributes,firstSeen:d.firstSeen,lastSeen:d.lastSeen})),c}findById(a){return w(this.db.prepare("SELECT * FROM source_project WHERE id = :id"),{id:a})}distinctNames(){return v(this.db.prepare(`SELECT DISTINCT name FROM source_project
          WHERE name IS NOT NULL
-         ORDER BY name`)).map(a=>a.name)}}function a8(a,b){return b?{...a,hostId:b}:a}function a9(a){let b=new g.DatabaseSync(a);return b.exec("PRAGMA journal_mode = WAL"),b.exec("PRAGMA busy_timeout = 2000"),b.exec("PRAGMA foreign_keys = ON"),b}function ba(a){var b;E(a);let c=(0,f.join)(a,C),g=a9(c);if(t(b=g,"table","tenants")||u(b,"events").includes("tenant_id")){g.close();let a=function(a){let b=`${a}.legacy.${String(Date.now())}.bak`;for(let c of((0,e.renameSync)(a,b),G(b),F(a)))(0,e.existsSync)(c)&&(0,e.rmSync)(c);return b}(c);g=a9(c),s(`Detected an older, incompatible (tenant-bearing) ${C}; backed it up to ${a} and created a fresh store.`)}for(let a of(!function(a,b){var c,d,e;let f=a.prepare("PRAGMA user_version").get().user_version;a.exec("CREATE TABLE IF NOT EXISTS migration_ledger (tag TEXT PRIMARY KEY, applied_at INTEGER NOT NULL)");let g=new Set(a.prepare("SELECT tag FROM migration_ledger").all().map(a=>a.tag)),i=0===g.size&&f>0,l=a.prepare("INSERT OR IGNORE INTO migration_ledger (tag, applied_at) VALUES (?, ?)");for(let[b,c]of h.lFU.entries()){if(g.has(c.tag)||c.tag===K)continue;let d=function(a){let b=[];for(let c of a.matchAll(/CREATE TABLE (?:IF NOT EXISTS )?`([^`]+)`/g))void 0===c[1]||c[1].startsWith("__new_")||b.push({kind:"table",name:c[1]});for(let c of a.matchAll(/ALTER TABLE `([^`]+)` ADD (?:COLUMN )?`([^`]+)`/g))void 0!==c[1]&&void 0!==c[2]&&b.push({kind:"column",table:c[1],name:c[2]});return b}(c.sql),e=d.filter(b=>"column"===b.kind?u(a,b.table,{includeGenerated:!0}).includes(b.name):t(a,"table",b.name));if(e.length>0&&e.length<d.length){let a=d.filter(a=>!e.includes(a)),b=`sqlite migration ${c.tag} has no ledger row, but the store already has ${e.map(I).join(", ")} while missing ${a.map(I).join(", ")} — the schema diverged from the migration history; refusing to replay or skip.`;throw s(b),Error(`[aka] ${b}`)}let h=d.length>0?e.length===d.length:i&&b<f,j=/PRAGMA foreign_keys\s*=\s*OFF/i.test(c.sql),k=J(c.sql);j&&a.exec("PRAGMA foreign_keys = OFF");try{q(a,()=>{for(let b of k){let c=function(a){let b=a.replace(/^(?:\s*--[^\n]*\n?)+/,"").trimStart();return/^CREATE (?:UNIQUE )?INDEX (?:IF NOT EXISTS )?`([^`]+)`/.exec(b)?.[1]}(b);if(void 0===c){if(h)continue}else if(t(a,"index",c))continue;a.exec(b)}if(j&&!h){let b=a.prepare("PRAGMA foreign_key_check").all();if(b.length>0)throw Error(`[aka] sqlite migration ${c.tag} left ${String(b.length)} foreign-key violation(s); rolling back.`)}l.run(c.tag,Date.now())},"IMMEDIATE")}finally{j&&a.exec("PRAGMA foreign_keys = ON")}}f<h.lFU.length&&a.exec(`PRAGMA user_version = ${String(h.lFU.length)}`),d="audit_events",t(c=a,"table",d)&&(u(c,d).includes("synced_at")||c.exec(`ALTER TABLE ${d} ADD COLUMN synced_at integer`)),a.exec(`CREATE TABLE IF NOT EXISTS scan_ledger (
+         ORDER BY name`)).map(a=>a.name)}}function a8(a,b){return b?{...a,hostId:b}:a}function a9(a){try{a.close()}catch{}}function ba(a){let b=new g.DatabaseSync(a);try{b.exec("PRAGMA journal_mode = WAL"),b.exec("PRAGMA busy_timeout = 2000"),b.exec("PRAGMA foreign_keys = ON")}catch(a){throw a9(b),a}return b}function bb(a){E(a);let{db:b,events:c,findings:g,policies:m,installedPacks:n,scanLedger:o,exceptions:p,resolutions:v,ruleProbeCache:w,security:x,detections:z,shares:A,policyCatalog:B,inventory:H,inventoryAssets:N,projectFiles:O,activity:P,sourceProject:Q,auditEvents:R,classifiedData:S,inspectionDefinitions:T,inspectionFindings:U,configInventory:V}=function(a){let b=ba(a);try{var c;if(c=b,t(c,"table","tenants")||u(c,"events").includes("tenant_id")){b.close();let c=function(a){let b=`${a}.legacy.${String(Date.now())}.bak`;for(let c of((0,e.renameSync)(a,b),G(b),F(a)))(0,e.existsSync)(c)&&(0,e.rmSync)(c);return b}(a);b=ba(a),s(`Detected an older, incompatible (tenant-bearing) ${C}; backed it up to ${c} and created a fresh store.`)}for(let c of(!function(a,b){var c,d,e;let f=a.prepare("PRAGMA user_version").get().user_version;a.exec("CREATE TABLE IF NOT EXISTS migration_ledger (tag TEXT PRIMARY KEY, applied_at INTEGER NOT NULL)");let g=new Set(a.prepare("SELECT tag FROM migration_ledger").all().map(a=>a.tag)),i=0===g.size&&f>0,l=a.prepare("INSERT OR IGNORE INTO migration_ledger (tag, applied_at) VALUES (?, ?)");for(let[b,c]of h.lFU.entries()){if(g.has(c.tag)||c.tag===K)continue;let d=function(a){let b=[];for(let c of a.matchAll(/CREATE TABLE (?:IF NOT EXISTS )?`([^`]+)`/g))void 0===c[1]||c[1].startsWith("__new_")||b.push({kind:"table",name:c[1]});for(let c of a.matchAll(/ALTER TABLE `([^`]+)` ADD (?:COLUMN )?`([^`]+)`/g))void 0!==c[1]&&void 0!==c[2]&&b.push({kind:"column",table:c[1],name:c[2]});return b}(c.sql),e=d.filter(b=>"column"===b.kind?u(a,b.table,{includeGenerated:!0}).includes(b.name):t(a,"table",b.name));if(e.length>0&&e.length<d.length){let a=d.filter(a=>!e.includes(a)),b=`sqlite migration ${c.tag} has no ledger row, but the store already has ${e.map(I).join(", ")} while missing ${a.map(I).join(", ")} — the schema diverged from the migration history; refusing to replay or skip.`;throw s(b),Error(`[aka] ${b}`)}let h=d.length>0?e.length===d.length:i&&b<f,j=/PRAGMA foreign_keys\s*=\s*OFF/i.test(c.sql),k=J(c.sql);j&&a.exec("PRAGMA foreign_keys = OFF");try{q(a,()=>{for(let b of k){let c=function(a){let b=a.replace(/^(?:\s*--[^\n]*\n?)+/,"").trimStart();return/^CREATE (?:UNIQUE )?INDEX (?:IF NOT EXISTS )?`([^`]+)`/.exec(b)?.[1]}(b);if(void 0===c){if(h)continue}else if(t(a,"index",c))continue;a.exec(b)}if(j&&!h){let b=a.prepare("PRAGMA foreign_key_check").all();if(b.length>0)throw Error(`[aka] sqlite migration ${c.tag} left ${String(b.length)} foreign-key violation(s); rolling back.`)}l.run(c.tag,Date.now())},"IMMEDIATE")}finally{j&&a.exec("PRAGMA foreign_keys = ON")}}f<h.lFU.length&&a.exec(`PRAGMA user_version = ${String(h.lFU.length)}`),c=a,d="audit_events",t(c,"table",d)&&(u(c,d).includes("synced_at")||c.exec(`ALTER TABLE ${d} ADD COLUMN synced_at integer`)),a.exec(`CREATE TABLE IF NOT EXISTS scan_ledger (
     path TEXT PRIMARY KEY,
     mtime TEXT NOT NULL,
     content_hash TEXT NOT NULL,
@@ -680,9 +680,9 @@ BEGIN SELECT RAISE(IGNORE); END`),function(a){if(!t(a,"table","audit_events"))re
          WHEN first_detected_at IS NULL THEN excluded.first_detected_at
          WHEN excluded.first_detected_at IS NULL THEN first_detected_at
          ELSE min(first_detected_at, excluded.first_detected_at)
-       END`);return M(a,"findings",b,a=>{let b=new Map;for(let e of a){let a=JSON.stringify([e.ruleId,e.category,e.severity]),f=b.get(a);if(void 0===f){let d=`unmigrated/${e.category}/${e.severity}`;f=k(e.ruleId,d),c.run(y({id:f,ruleId:e.ruleId,name:e.ruleId,category:e.category,severity:e.severity,definition:"",version:d})),b.set(a,f)}d.run(y({id:e.id,auditEventId:e.eventId,inspectionDefinitionId:f,spanStart:e.spanStart,spanEnd:e.spanEnd,maskedMatch:e.maskedMatch,actionTaken:e.actionTaken,confidence:e.confidence,findingKey:e.findingKey,firstDetectedAt:e.firstDetectedAt}))}})}catch(a){return s(`legacy history backfill failed: ${String(a)}`),!1}}(a)&&function(a,b){let c=h.lFU.find(a=>a.tag===K);if(c){if(b)try{var d=a,e=b;let c=`${e}.pre-drop.${String(Date.now())}.bak`;d.prepare("VACUUM INTO ?").run(c),G(c)}catch(a){s(`legacy events/findings backup failed; deferring the drop: ${String(a)}`);return}try{q(a,()=>{if(!a.prepare("SELECT 1 FROM migration_ledger WHERE tag = ?").get(c.tag)){for(let b of J(c.sql))a.exec(b);a.prepare("INSERT OR IGNORE INTO migration_ledger (tag, applied_at) VALUES (?, ?)").run(c.tag,Date.now())}},"IMMEDIATE")}catch(a){s(`legacy events/findings drop failed; deferring: ${String(a)}`)}}}(a,b)}(g,c),[c,...F(c)]))D(a,384);let m=new ag(g),n=new aq(g),o=new aP(g),p=new ax(g),v=new aU(g),w=new al(g),x=new aS(g),z=new aT(g),A=new a0(g),B=new af(g),H=new a6(g),N=new aQ(p),O=new ay(g),P=new aO(g),Q=new aR(g),R=new Z(g),S=new a7(g),T=new $(g),U=new _(g),V=new ar(g),W=new as(g),X=new ab(g);return o.seedDefaults(),{events:m,findings:n,policies:o,installedPacks:p,scanLedger:v,exceptions:w,resolutions:x,ruleProbeCache:z,security:A,detections:B,shares:H,policyCatalog:N,inventory:O,inventoryAssets:P,activity:R,sourceProject:S,auditEvents:T,classifiedData:U,inspectionDefinitions:V,inspectionFindings:W,recordCapture:function(a,b){r(g,()=>{let c=a.metadata?.sessionId;c&&T.ensureSessionRoot(c,a.occurredAt);let d=function(a,b,c=null){return i((0,h.tTV)(["capture",a??"no_session",b,c??"no_path"]))}(c??null,a.contentHash,a.metadata?.filePath??null);T.insertAuditEvent({id:d,eventType:a.kind,startedAt:a.occurredAt,parentId:c,rootSessionId:c,content:a.content,contentHash:a.contentHash,attributes:(0,h.$w9)(a)});let e=new Map;for(let a of b){if(c&&W.isSessionDuplicate(a.ruleId,a.maskedMatch,c)||W.isEventDuplicate(d,a.ruleId,a.maskedMatch,a.span.start,a.span.end))continue;let b=`${a.ruleId}@${(0,h.qmP)(a)}`,f=e.get(b);f||(f=V.upsert((0,h.jTf)(a)),e.set(b,f)),W.insertFinding({id:a.id,auditEventId:d,inspectionDefinitionId:f,span:a.span,maskedMatch:a.maskedMatch,actionTaken:a.actionTaken,confidence:a.confidence,findingKey:a.findingKey??void 0})}})},ensureInventory:function(a){let b={};return r(g,()=>{let c=Date.now();a.host&&(b.hostId=O.upsert(a.host,c)),a.harness&&(b.harnessId=O.upsert(a8(a.harness,b.hostId),c)),b.accountId=O.upsert(a8({objectType:"user",identityKey:"local",attributes:{source:"local"}},b.hostId),c),a.project&&(b.sourceProjectId=S.upsert(a.project,c))})?b:{}},recordConfigScan:function(a){r(g,()=>{let b=(0,h.I8t)(a.scanEvent.startedAt);for(let c of a.items)O.upsert(c,b);T.insertAuditEvent(a.scanEvent);let c=new Map;for(let b of a.definitions??[])c.set(`${b.ruleId}@${b.version}`,V.upsert(b));for(let b of a.findings??[]){let e=c.get(`${b.ruleId}@${b.version}`);e&&W.insertFinding({id:(0,d.randomUUID)(),auditEventId:a.scanEvent.id,inspectionDefinitionId:e,span:b.span,maskedMatch:b.maskedMatch,actionTaken:b.actionTaken,confidence:b.confidence})}})},recordProjectFiles:function(a,b){0!==b.files.length&&r(g,()=>{Q.replaceForProject(a,b,Date.now())})},reconcileWorktreeProjects:function(a,b,c){try{let d=b.split(f.sep).join("/"),e=c.split(f.sep).join("/"),h=c===b?"":"url IN (:worktreePosix, :worktreeWin) OR ",i=g.prepare(`SELECT id FROM source_project
+       END`);return M(a,"findings",b,a=>{let b=new Map;for(let e of a){let a=JSON.stringify([e.ruleId,e.category,e.severity]),f=b.get(a);if(void 0===f){let d=`unmigrated/${e.category}/${e.severity}`;f=k(e.ruleId,d),c.run(y({id:f,ruleId:e.ruleId,name:e.ruleId,category:e.category,severity:e.severity,definition:"",version:d})),b.set(a,f)}d.run(y({id:e.id,auditEventId:e.eventId,inspectionDefinitionId:f,spanStart:e.spanStart,spanEnd:e.spanEnd,maskedMatch:e.maskedMatch,actionTaken:e.actionTaken,confidence:e.confidence,findingKey:e.findingKey,firstDetectedAt:e.firstDetectedAt}))}})}catch(a){return s(`legacy history backfill failed: ${String(a)}`),!1}}(a)&&function(a,b){let c=h.lFU.find(a=>a.tag===K);if(c){if(b)try{var d=a,e=b;let c=`${e}.pre-drop.${String(Date.now())}.bak`;d.prepare("VACUUM INTO ?").run(c),G(c)}catch(a){s(`legacy events/findings backup failed; deferring the drop: ${String(a)}`);return}try{q(a,()=>{if(!a.prepare("SELECT 1 FROM migration_ledger WHERE tag = ?").get(c.tag)){for(let b of J(c.sql))a.exec(b);a.prepare("INSERT OR IGNORE INTO migration_ledger (tag, applied_at) VALUES (?, ?)").run(c.tag,Date.now())}},"IMMEDIATE")}catch(a){s(`legacy events/findings drop failed; deferring: ${String(a)}`)}}}(a,b)}(b,a),[a,...F(a)]))D(c,384);let d=new aP(b),f=new ax(b),g={events:new ag(b),findings:new aq(b),policies:d,installedPacks:f,scanLedger:new aU(b),exceptions:new al(b),resolutions:new aS(b),ruleProbeCache:new aT(b),security:new a0(b),detections:new af(b),shares:new a6(b),policyCatalog:new aQ(f),inventory:new ay(b),inventoryAssets:new aO(b),projectFiles:new aR(b),activity:new Z(b),sourceProject:new a7(b),auditEvents:new $(b),classifiedData:new _(b),inspectionDefinitions:new ar(b),inspectionFindings:new as(b),configInventory:new ab(b)};return d.seedDefaults(),{db:b,...g}}catch(a){throw a9(b),a}}((0,f.join)(a,C));return{events:c,findings:g,policies:m,installedPacks:n,scanLedger:o,exceptions:p,resolutions:v,ruleProbeCache:w,security:x,detections:z,shares:A,policyCatalog:B,inventory:H,inventoryAssets:N,activity:P,sourceProject:Q,auditEvents:R,classifiedData:S,inspectionDefinitions:T,inspectionFindings:U,recordCapture:function(a,c){r(b,()=>{let b=a.metadata?.sessionId;b&&R.ensureSessionRoot(b,a.occurredAt);let d=function(a,b,c=null){return i((0,h.tTV)(["capture",a??"no_session",b,c??"no_path"]))}(b??null,a.contentHash,a.metadata?.filePath??null);R.insertAuditEvent({id:d,eventType:a.kind,startedAt:a.occurredAt,parentId:b,rootSessionId:b,content:a.content,contentHash:a.contentHash,attributes:(0,h.$w9)(a)});let e=new Map;for(let a of c){if(b&&U.isSessionDuplicate(a.ruleId,a.maskedMatch,b)||U.isEventDuplicate(d,a.ruleId,a.maskedMatch,a.span.start,a.span.end))continue;let c=`${a.ruleId}@${(0,h.qmP)(a)}`,f=e.get(c);f||(f=T.upsert((0,h.jTf)(a)),e.set(c,f)),U.insertFinding({id:a.id,auditEventId:d,inspectionDefinitionId:f,span:a.span,maskedMatch:a.maskedMatch,actionTaken:a.actionTaken,confidence:a.confidence,findingKey:a.findingKey??void 0})}})},ensureInventory:function(a){let c={};return r(b,()=>{let b=Date.now();a.host&&(c.hostId=H.upsert(a.host,b)),a.harness&&(c.harnessId=H.upsert(a8(a.harness,c.hostId),b)),c.accountId=H.upsert(a8({objectType:"user",identityKey:"local",attributes:{source:"local"}},c.hostId),b),a.project&&(c.sourceProjectId=Q.upsert(a.project,b))})?c:{}},recordConfigScan:function(a){r(b,()=>{let b=(0,h.I8t)(a.scanEvent.startedAt);for(let c of a.items)H.upsert(c,b);R.insertAuditEvent(a.scanEvent);let c=new Map;for(let b of a.definitions??[])c.set(`${b.ruleId}@${b.version}`,T.upsert(b));for(let b of a.findings??[]){let e=c.get(`${b.ruleId}@${b.version}`);e&&U.insertFinding({id:(0,d.randomUUID)(),auditEventId:a.scanEvent.id,inspectionDefinitionId:e,span:b.span,maskedMatch:b.maskedMatch,actionTaken:b.actionTaken,confidence:b.confidence})}})},recordProjectFiles:function(a,c){0!==c.files.length&&r(b,()=>{O.replaceForProject(a,c,Date.now())})},reconcileWorktreeProjects:function(a,c,d){try{let e=c.split(f.sep).join("/"),g=d.split(f.sep).join("/"),h=d===c?"":"url IN (:worktreePosix, :worktreeWin) OR ",i=b.prepare(`SELECT id FROM source_project
            WHERE id <> :canonicalId
-             AND (${h}url LIKE :pattern ESCAPE '\\' OR url LIKE :patternWin ESCAPE '\\')`).all({canonicalId:a,...c===b?{}:{worktreePosix:e,worktreeWin:e.split("/").join("\\")},pattern:`${l(d)}/.claude/worktrees/%`,patternWin:`${l(d.split("/").join("\\"))}\\\\.claude\\\\worktrees\\\\%`});if(0===i.length)return;q(g,()=>{for(let{id:b}of i)g.prepare("UPDATE audit_events SET source_project_id = :canonicalId WHERE source_project_id = :id").run({canonicalId:a,id:b}),g.prepare("UPDATE OR IGNORE file_access_override SET project_id = :canonicalId WHERE project_id = :id").run({canonicalId:a,id:b}),g.prepare("DELETE FROM file_access_override WHERE project_id = :id").run({id:b}),g.prepare("DELETE FROM project_file WHERE project_id = :id").run({id:b}),g.prepare("DELETE FROM source_project WHERE id = :id").run({id:b})})}catch{}},configInventoryReport:()=>X.report(),facets:function(){return{hosts:O.distinctTitles("host"),harnesses:O.distinctTitles("harness"),osVersions:O.osVersions(),projects:S.distinctNames()}},purgeSampleData:()=>{!function(a){try{if(!a.prepare(`SELECT (
+             AND (${h}url LIKE :pattern ESCAPE '\\' OR url LIKE :patternWin ESCAPE '\\')`).all({canonicalId:a,...d===c?{}:{worktreePosix:g,worktreeWin:g.split("/").join("\\")},pattern:`${l(e)}/.claude/worktrees/%`,patternWin:`${l(e.split("/").join("\\"))}\\\\.claude\\\\worktrees\\\\%`});if(0===i.length)return;q(b,()=>{for(let{id:c}of i)b.prepare("UPDATE audit_events SET source_project_id = :canonicalId WHERE source_project_id = :id").run({canonicalId:a,id:c}),b.prepare("UPDATE OR IGNORE file_access_override SET project_id = :canonicalId WHERE project_id = :id").run({canonicalId:a,id:c}),b.prepare("DELETE FROM file_access_override WHERE project_id = :id").run({id:c}),b.prepare("DELETE FROM project_file WHERE project_id = :id").run({id:c}),b.prepare("DELETE FROM source_project WHERE id = :id").run({id:c})})}catch{}},configInventoryReport:()=>V.report(),facets:function(){return{hosts:H.distinctTitles("host"),harnesses:H.distinctTitles("harness"),osVersions:H.osVersions(),projects:Q.distinctNames()}},purgeSampleData:()=>{!function(a){try{if(!a.prepare(`SELECT (
          EXISTS(SELECT 1 FROM share_destination WHERE provenance = 'sample')
          OR EXISTS(SELECT 1 FROM audit_events WHERE id LIKE 'sample:activity:%')
          OR EXISTS(SELECT 1 FROM inventory_asset WHERE provenance = 'sample')
@@ -695,6 +695,6 @@ BEGIN SELECT RAISE(IGNORE); END`),function(a){if(!t(a,"table","audit_events"))re
             OR harness_id IN (SELECT id FROM inventory WHERE object_type = 'harness' AND json_extract(attributes, '$.provenance') = 'sample')`),a.exec("DELETE FROM mcp_trust_override WHERE asset_id IN (SELECT id FROM inventory_asset WHERE provenance = 'sample')"),a.exec("DELETE FROM file_access_override WHERE project_id IN (SELECT id FROM source_project WHERE json_extract(attributes, '$.provenance') = 'sample')"),a.exec("DELETE FROM project_file WHERE project_id IN (SELECT id FROM source_project WHERE json_extract(attributes, '$.provenance') = 'sample')"),a.exec("DELETE FROM inventory_asset WHERE provenance = 'sample'"),a.exec("DELETE FROM source_project WHERE json_extract(attributes, '$.provenance') = 'sample'"),a.exec("DELETE FROM inventory WHERE object_type = 'harness' AND json_extract(attributes, '$.provenance') = 'sample'"),a.exec("DELETE FROM inspection_findings WHERE id LIKE 'sample:activity:%'"),a.exec("DELETE FROM inspection_definitions WHERE id LIKE 'sample:activity:%'"),a.exec("DELETE FROM audit_events WHERE root_session_id LIKE 'sample:activity:%'"),a.exec("DELETE FROM audit_events WHERE id LIKE 'sample:activity:%'"),a.exec(`CREATE TABLE IF NOT EXISTS app_meta (
         key TEXT PRIMARY KEY,
         value TEXT NOT NULL
-      )`),a.exec("DELETE FROM app_meta WHERE key LIKE 'sample_seeded:%'")})}catch{}}(g)},transaction:async function a(a){g.exec("BEGIN");try{let b=await a();return g.exec("COMMIT"),b}catch(a){try{g.exec("ROLLBACK")}catch{}throw a}},close:()=>{g.close()}}}function bb(a){let b=a.filePath.replaceAll("\\","/");return(0,d.createHash)("sha256").update(`${a.ruleId}\0${b}\0${a.valueFingerprint}`).digest("hex")}function bc(a){return(0,f.join)(a,"exception.key")}function bd(a,b){E(a);let c=bc(a),d=JSON.stringify({version:b.version,material:b.material.toString("base64")});return H(c,`${d}
-`),b}function be(a){let b;try{b=(0,e.readFileSync)(bc(a),"utf8")}catch(a){if("ENOENT"===a.code)return null;throw a instanceof Error?a:Error(String(a))}let c=JSON.parse(b);if("object"!=typeof c||null===c)throw Error("exception key file is corrupt: not a JSON object");let{version:d,material:f}=c;if("number"!=typeof d||!Number.isInteger(d)||d<1)throw Error("exception key file is corrupt: bad version");if("string"!=typeof f)throw Error("exception key file is corrupt: bad material");let g=Buffer.from(f,"base64");if(32!==g.length)throw Error("exception key file is corrupt: bad material length");return{version:d,material:g}}function bf(a){let b=be(a);return b?(G(bc(a)),b):bd(a,{version:1,material:(0,d.randomBytes)(32)})}function bg(a){let b=be(a);return bd(a,{version:(b?.version??0)+1,material:(0,d.randomBytes)(32)})}function bh(a,b){return(0,d.createHmac)("sha256",a.material).update(b,"utf8").digest("hex")}c(51455);var bi=c(70542);function bj(){return(0,f.join)((0,bi.homedir)(),".aka")}function bk(a=bj()){return(0,f.join)(a,"settings")}function bl(a=bj()){return(0,f.join)(a,"data")}function bm(a=bj()){let b=function(a){let b;try{b=(0,e.readFileSync)(a,"utf8")}catch{return null}return O(b)??null}((0,f.join)(bk(a),"settings.json"));if(!b)return(0,h.i1j)();try{return h.hd_.parse(b)}catch{return(0,h.i1j)()}}function bn(a,b=bj()){let c=bk(b),d=bm(b),e=h.hd_.parse({...d,...a,onboardedAt:a.onboardedAt??d.onboardedAt??new Date().toISOString()});return E(c),H((0,f.join)(c,"settings.json"),`${JSON.stringify(e,null,2)}
-`),e}},45615:(a,b,c)=>{c.d(b,{S8C:()=>y,hxQ:()=>ap,Itg:()=>ad,RRF:()=>a2,ZpU:()=>a5,HUb:()=>a1,hfB:()=>aj,unw:()=>a4,goN:()=>N,Jr:()=>a6,V8B:()=>aJ,IgC:()=>aZ,aIg:()=>bB,iRC:()=>aK,GCf:()=>E,TUN:()=>O,SHn:()=>av,rov:()=>b7,V0H:()=>a0,kxf:()=>b4,PEm:()=>aX,eI7:()=>cn,cqq:()=>F,jON:()=>aT,lFU:()=>d,PhW:()=>ab,uQz:()=>b6,BIx:()=>ar,hd_:()=>b9,tXp:()=>b_,plk:()=>bv,mAj:()=>bV,Fnc:()=>c3,ryv:()=>r,tTV:()=>aa,qmP:()=>ci,rG:()=>b2,Bfj:()=>b$,q_t:()=>p,i1j:()=>ca,xog:()=>bU,hzO:()=>c5,by7:()=>c4,Gw9:()=>c1,q11:()=>h,U7X:()=>w,y_0:()=>c2,I8t:()=>g,DhA:()=>a7,WSs:()=>c8,a45:()=>bt,N6N:()=>f,A6E:()=>b1,pnU:()=>bu,V9M:()=>cd,$w9:()=>ch,jTf:()=>cj,$BP:()=>ce,JAl:()=>cf,$3l:()=>cg,gzP:()=>cb,QCA:()=>cc,C05:()=>c6});let d=[{tag:"0000_acoustic_felicia_hardy",sql:"CREATE TABLE `audit_events` (\n	`id` text PRIMARY KEY NOT NULL,\n	`parent_id` text,\n	`root_session_id` text,\n	`event_type` text NOT NULL,\n	`host_id` text,\n	`harness_id` text,\n	`source_project_id` text,\n	`started_at` integer NOT NULL,\n	`ended_at` integer,\n	`severity` text,\n	`priority` text,\n	`content` text,\n	`content_hash` text,\n	`attributes` text,\n	FOREIGN KEY (`parent_id`) REFERENCES `audit_events`(`id`) ON UPDATE no action ON DELETE no action,\n	FOREIGN KEY (`root_session_id`) REFERENCES `audit_events`(`id`) ON UPDATE no action ON DELETE no action,\n	FOREIGN KEY (`host_id`) REFERENCES `inventory`(`id`) ON UPDATE no action ON DELETE no action,\n	FOREIGN KEY (`harness_id`) REFERENCES `inventory`(`id`) ON UPDATE no action ON DELETE no action,\n	FOREIGN KEY (`source_project_id`) REFERENCES `source_project`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_audit_parent` ON `audit_events` (`parent_id`);--\x3e statement-breakpoint\nCREATE INDEX `idx_audit_session` ON `audit_events` (`root_session_id`,`started_at`);--\x3e statement-breakpoint\nCREATE INDEX `idx_audit_harness_t` ON `audit_events` (`harness_id`,`started_at`);--\x3e statement-breakpoint\nCREATE INDEX `idx_audit_project_t` ON `audit_events` (`source_project_id`,`started_at`);--\x3e statement-breakpoint\nCREATE TABLE `classified_data` (\n	`id` text PRIMARY KEY NOT NULL,\n	`class` text NOT NULL,\n	`label` text,\n	`attributes` text\n);\n--\x3e statement-breakpoint\nCREATE TABLE `events` (\n	`id` text PRIMARY KEY NOT NULL,\n	`source_tool` text NOT NULL,\n	`kind` text NOT NULL,\n	`occurred_at` integer NOT NULL,\n	`content_hash` text NOT NULL,\n	`content` text NOT NULL,\n	`metadata` text\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_events_occurred` ON `events` (`occurred_at`);--\x3e statement-breakpoint\nCREATE TABLE `findings` (\n	`id` text PRIMARY KEY NOT NULL,\n	`event_id` text NOT NULL,\n	`rule_id` text NOT NULL,\n	`category` text NOT NULL,\n	`severity` text NOT NULL,\n	`span_start` integer NOT NULL,\n	`span_end` integer NOT NULL,\n	`masked_match` text NOT NULL,\n	`action_taken` text NOT NULL,\n	`confidence` real NOT NULL,\n	FOREIGN KEY (`event_id`) REFERENCES `events`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_findings_event` ON `findings` (`event_id`);--\x3e statement-breakpoint\nCREATE TABLE `inspection_definitions` (\n	`id` text PRIMARY KEY NOT NULL,\n	`rule_id` text NOT NULL,\n	`name` text NOT NULL,\n	`category` text NOT NULL,\n	`severity` text NOT NULL,\n	`definition` text NOT NULL,\n	`version` text NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE TABLE `inspection_findings` (\n	`id` text PRIMARY KEY NOT NULL,\n	`audit_event_id` text NOT NULL,\n	`inspection_definition_id` text NOT NULL,\n	`classified_data_id` text,\n	`span_start` integer NOT NULL,\n	`span_end` integer NOT NULL,\n	`masked_match` text NOT NULL,\n	`action_taken` text NOT NULL,\n	`confidence` real NOT NULL,\n	FOREIGN KEY (`audit_event_id`) REFERENCES `audit_events`(`id`) ON UPDATE no action ON DELETE no action,\n	FOREIGN KEY (`inspection_definition_id`) REFERENCES `inspection_definitions`(`id`) ON UPDATE no action ON DELETE no action,\n	FOREIGN KEY (`classified_data_id`) REFERENCES `classified_data`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_inspection_findings_event` ON `inspection_findings` (`audit_event_id`);--\x3e statement-breakpoint\nCREATE TABLE `installed_packs` (\n	`id` text PRIMARY KEY NOT NULL,\n	`namespace` text NOT NULL,\n	`pack_id` text NOT NULL,\n	`version` text NOT NULL,\n	`name` text NOT NULL,\n	`rules_json` text NOT NULL,\n	`enabled` integer DEFAULT true NOT NULL,\n	`policy_id` text,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_installed_packs_pack` ON `installed_packs` (`namespace`,`pack_id`);--\x3e statement-breakpoint\nCREATE TABLE `inventory` (\n	`id` text PRIMARY KEY NOT NULL,\n	`object_type` text NOT NULL,\n	`location` text,\n	`title` text,\n	`host_id` text,\n	`attributes` text NOT NULL,\n	`os_version` text GENERATED ALWAYS AS (json_extract(attributes, '$.os_version')) VIRTUAL,\n	`harness_version` text GENERATED ALWAYS AS (json_extract(attributes, '$.harness_version')) VIRTUAL,\n	`first_seen` integer NOT NULL,\n	`last_seen` integer NOT NULL,\n	FOREIGN KEY (`host_id`) REFERENCES `inventory`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_inventory_type` ON `inventory` (`object_type`);--\x3e statement-breakpoint\nCREATE INDEX `idx_inventory_type_osver` ON `inventory` (`object_type`,`os_version`);--\x3e statement-breakpoint\nCREATE INDEX `idx_inventory_type_harnessver` ON `inventory` (`object_type`,`harness_version`);--\x3e statement-breakpoint\nCREATE TABLE `policies` (\n	`id` text PRIMARY KEY NOT NULL,\n	`scope` text DEFAULT 'global' NOT NULL,\n	`target` text NOT NULL,\n	`action` text NOT NULL,\n	`enabled` integer DEFAULT true NOT NULL,\n	`custom_keywords` text,\n	`name` text,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_policies_scope_target` ON `policies` (`scope`,`target`);--\x3e statement-breakpoint\nCREATE TABLE `source_project` (\n	`id` text PRIMARY KEY NOT NULL,\n	`url` text,\n	`name` text,\n	`attributes` text NOT NULL,\n	`first_seen` integer NOT NULL,\n	`last_seen` integer NOT NULL\n);\n"},{tag:"0001_adorable_marten_broadcloak",sql:"ALTER TABLE `audit_events` ADD `input_tokens` integer GENERATED ALWAYS AS (json_extract(attributes, '$.input_tokens')) VIRTUAL;--\x3e statement-breakpoint\nALTER TABLE `audit_events` ADD `output_tokens` integer GENERATED ALWAYS AS (json_extract(attributes, '$.output_tokens')) VIRTUAL;--\x3e statement-breakpoint\nALTER TABLE `audit_events` ADD `cache_creation_input_tokens` integer GENERATED ALWAYS AS (json_extract(attributes, '$.cache_creation_input_tokens')) VIRTUAL;--\x3e statement-breakpoint\nALTER TABLE `audit_events` ADD `cache_read_input_tokens` integer GENERATED ALWAYS AS (json_extract(attributes, '$.cache_read_input_tokens')) VIRTUAL;--\x3e statement-breakpoint\nALTER TABLE `audit_events` ADD `model` text GENERATED ALWAYS AS (json_extract(attributes, '$.model')) VIRTUAL;--\x3e statement-breakpoint\nALTER TABLE `audit_events` ADD `provider` text GENERATED ALWAYS AS (json_extract(attributes, '$.provider')) VIRTUAL;--\x3e statement-breakpoint\nCREATE INDEX `idx_audit_session_type` ON `audit_events` (`root_session_id`,`started_at`) WHERE event_type = 'llm_call';"},{tag:"0002_groovy_big_bertha",sql:"CREATE TABLE `exceptions` (\n	`id` text PRIMARY KEY NOT NULL,\n	`rule_id` text NOT NULL,\n	`category` text NOT NULL,\n	`value_fingerprint` text NOT NULL,\n	`key_version` integer NOT NULL,\n	`masked_value` text NOT NULL,\n	`scope` text NOT NULL,\n	`expires_at` integer,\n	`max_uses` integer,\n	`use_count` integer DEFAULT 0 NOT NULL,\n	`last_used_at` integer,\n	`justification` text NOT NULL,\n	`conditions` text,\n	`created_by` text NOT NULL,\n	`created_via` text NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL,\n	`revoked_at` integer,\n	`revoked_by` text,\n	`revoke_reason` text\n);\n--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_exceptions_active` ON `exceptions` (`rule_id`,`value_fingerprint`,`key_version`) WHERE revoked_at IS NULL;"},{tag:"0003_rich_sage",sql:"CREATE TABLE `egress_decision_override` (\n	`id` text PRIMARY KEY NOT NULL,\n	`destination_id` text NOT NULL,\n	`decision` text NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL,\n	FOREIGN KEY (`destination_id`) REFERENCES `share_destination`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_egress_decision_override` ON `egress_decision_override` (`destination_id`);--\x3e statement-breakpoint\nCREATE TABLE `file_access_override` (\n	`id` text PRIMARY KEY NOT NULL,\n	`project_id` text NOT NULL,\n	`path` text NOT NULL,\n	`access` text NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL,\n	FOREIGN KEY (`project_id`) REFERENCES `source_project`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_file_access_override_project` ON `file_access_override` (`project_id`);--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_file_access_override` ON `file_access_override` (`project_id`,`path`);--\x3e statement-breakpoint\nCREATE TABLE `harness_asset` (\n	`id` text PRIMARY KEY NOT NULL,\n	`harness_id` text NOT NULL,\n	`asset_id` text NOT NULL,\n	`created_at` integer NOT NULL,\n	FOREIGN KEY (`harness_id`) REFERENCES `inventory`(`id`) ON UPDATE no action ON DELETE no action,\n	FOREIGN KEY (`asset_id`) REFERENCES `inventory_asset`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_harness_asset_harness` ON `harness_asset` (`harness_id`);--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_harness_asset` ON `harness_asset` (`harness_id`,`asset_id`);--\x3e statement-breakpoint\nCREATE TABLE `inventory_asset` (\n	`id` text PRIMARY KEY NOT NULL,\n	`asset_type` text NOT NULL,\n	`name` text NOT NULL,\n	`sub` text,\n	`description` text,\n	`flags_json` text DEFAULT '[]' NOT NULL,\n	`meta_json` text DEFAULT '{}' NOT NULL,\n	`trust` text,\n	`tools_json` text,\n	`provenance` text DEFAULT 'scan' NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_inventory_asset_type` ON `inventory_asset` (`asset_type`);--\x3e statement-breakpoint\nCREATE TABLE `mcp_trust_override` (\n	`id` text PRIMARY KEY NOT NULL,\n	`asset_id` text NOT NULL,\n	`trust` text NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL,\n	FOREIGN KEY (`asset_id`) REFERENCES `inventory_asset`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_mcp_trust_override` ON `mcp_trust_override` (`asset_id`);--\x3e statement-breakpoint\nCREATE TABLE `project_file` (\n	`id` text PRIMARY KEY NOT NULL,\n	`project_id` text NOT NULL,\n	`path` text NOT NULL,\n	`name` text NOT NULL,\n	`origin` text NOT NULL,\n	`default_access` text NOT NULL,\n	`findings_count` integer DEFAULT 0 NOT NULL,\n	`blocked_at` integer,\n	`note` text,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL,\n	FOREIGN KEY (`project_id`) REFERENCES `source_project`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_project_file_project` ON `project_file` (`project_id`);--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_project_file` ON `project_file` (`project_id`,`path`);--\x3e statement-breakpoint\nCREATE TABLE `share_call_site` (\n	`id` text PRIMARY KEY NOT NULL,\n	`endpoint_id` text NOT NULL,\n	`project` text NOT NULL,\n	`file` text NOT NULL,\n	`line` integer NOT NULL,\n	`snippet` text NOT NULL,\n	`dynamic` integer DEFAULT false NOT NULL,\n	`vendored` integer DEFAULT false NOT NULL,\n	`project_id` text,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL,\n	FOREIGN KEY (`endpoint_id`) REFERENCES `share_endpoint`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_share_call_site_endpoint` ON `share_call_site` (`endpoint_id`);--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_share_call_site` ON `share_call_site` (`endpoint_id`,`project`,`file`,`line`);--\x3e statement-breakpoint\nCREATE TABLE `share_destination` (\n	`id` text PRIMARY KEY NOT NULL,\n	`kind` text NOT NULL,\n	`name` text NOT NULL,\n	`host` text NOT NULL,\n	`category` text NOT NULL,\n	`trust` text NOT NULL,\n	`note` text,\n	`network_json` text,\n	`last_seen` integer NOT NULL,\n	`provenance` text DEFAULT 'scan' NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_share_destination_kind` ON `share_destination` (`kind`);--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_share_destination_host` ON `share_destination` (`host`);--\x3e statement-breakpoint\nCREATE TABLE `share_endpoint` (\n	`id` text PRIMARY KEY NOT NULL,\n	`destination_id` text NOT NULL,\n	`method` text NOT NULL,\n	`transport` text NOT NULL,\n	`url` text NOT NULL,\n	`template` integer DEFAULT false NOT NULL,\n	`data_class` text NOT NULL,\n	`last_seen` integer NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL,\n	FOREIGN KEY (`destination_id`) REFERENCES `share_destination`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_share_endpoint_dest` ON `share_endpoint` (`destination_id`);--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_share_endpoint` ON `share_endpoint` (`destination_id`,`method`,`url`);"},{tag:"0004_glorious_mindworm",sql:"CREATE TABLE `available_packs` (\n	`id` text PRIMARY KEY NOT NULL,\n	`namespace` text NOT NULL,\n	`pack_id` text NOT NULL,\n	`version` text NOT NULL,\n	`name` text NOT NULL,\n	`rules_json` text NOT NULL,\n	`updated_at` integer NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_available_packs_pack` ON `available_packs` (`namespace`,`pack_id`);"},{tag:"0005_fast_vindicator",sql:'PRAGMA foreign_keys=OFF;--\x3e statement-breakpoint\nCREATE TABLE `__new_mcp_trust_override` (\n	`id` text PRIMARY KEY NOT NULL,\n	`asset_id` text NOT NULL,\n	`trust` text NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL\n);\n--\x3e statement-breakpoint\nINSERT INTO `__new_mcp_trust_override`("id", "asset_id", "trust", "created_at", "updated_at") SELECT "id", "asset_id", "trust", "created_at", "updated_at" FROM `mcp_trust_override`;--\x3e statement-breakpoint\nDROP TABLE `mcp_trust_override`;--\x3e statement-breakpoint\nALTER TABLE `__new_mcp_trust_override` RENAME TO `mcp_trust_override`;--\x3e statement-breakpoint\nPRAGMA foreign_keys=ON;--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_mcp_trust_override` ON `mcp_trust_override` (`asset_id`);'},{tag:"0006_magenta_flatman",sql:'CREATE TABLE `_pack_write_gate` (\n	`id` integer PRIMARY KEY NOT NULL,\n	`open` integer DEFAULT 0 NOT NULL,\n	CONSTRAINT "ck_pack_write_gate_single_row" CHECK("_pack_write_gate"."id" = 1)\n);\n--\x3e statement-breakpoint\nALTER TABLE `available_packs` ADD `recorded_by` text;--\x3e statement-breakpoint\nINSERT OR IGNORE INTO _pack_write_gate (id, open) VALUES (1, 0);\n--\x3e statement-breakpoint\nCREATE TRIGGER trg_installed_packs_write_gate\nBEFORE UPDATE OF version, name, rules_json ON installed_packs\nWHEN (SELECT open FROM _pack_write_gate WHERE id = 1) IS NOT 1\nBEGIN SELECT RAISE(IGNORE); END;'},{tag:"0007_thick_stick",sql:"CREATE TABLE `finding_resolution` (\n	`id` text PRIMARY KEY NOT NULL,\n	`finding_key` text NOT NULL,\n	`status` text NOT NULL,\n	`method` text NOT NULL,\n	`resolved_at` integer NOT NULL,\n	`evidence` text,\n	`created_at` integer NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_finding_resolution_key` ON `finding_resolution` (`finding_key`);--\x3e statement-breakpoint\nALTER TABLE `findings` ADD `finding_key` text;--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_findings_key` ON `findings` (`finding_key`);"},{tag:"0008_freezing_selene",sql:"ALTER TABLE `findings` ADD `first_detected_at` integer;--\x3e statement-breakpoint\nUPDATE `findings` SET `first_detected_at` = (SELECT `occurred_at` FROM `events` WHERE `events`.`id` = `findings`.`event_id`) WHERE `first_detected_at` IS NULL;"},{tag:"0009_findings_path_expression_index",sql:"-- Custom migration: partial expression index for the resolver's per-path reads.\n--\n-- openAtRestKeysForPath / resolvedAtRestKeysForPath (and the scanner's tier-3\n-- open-key probe) filter at-rest events by\n--   e.kind = 'code_change' AND json_extract(e.metadata, '$.filePath') = :path\n-- once per changed/deleted file on every scan — previously a full events scan\n-- per file. json_extract is deterministic, so SQLite allows it in an index;\n-- the WHERE kind = 'code_change' keeps the index to exactly the rows those\n-- queries can match (in-flight events are never path-addressed).\nCREATE INDEX `idx_events_code_change_path` ON `events` (json_extract(`metadata`, '$.filePath')) WHERE `kind` = 'code_change';\n"},{tag:"0010_events_session_expression_index",sql:"-- Custom migration: partial expression index for session-scoped finding reads.\n--\n-- sessionFindingsCount, the session-scoped listGroupedFindings paths, and the\n-- insert-time session dedup all filter live-capture events by\n--   json_extract(e.metadata, '$.sessionId') = :sessionId\n-- — previously a full findings-join scan with a JSON parse per row. The\n-- IS NOT NULL predicate keeps the index to session-stamped events only (an\n-- equality probe implies non-null, so SQLite still uses it).\nCREATE INDEX `idx_events_session_id` ON `events` (json_extract(`metadata`, '$.sessionId')) WHERE json_extract(`metadata`, '$.sessionId') IS NOT NULL;\n"},{tag:"0011_egress_writer",sql:'-- Stable per-project reconcile key for egress call sites, plus a host-keyed\n-- egress decision override that survives destination pruning.\n--\n-- DROP INDEX IF EXISTS, not a bare DROP: the applier replays a pending\n-- migration\'s non-index statements verbatim, so a store that lost\n-- uq_share_call_site out of band would throw here — and on the plugin hook path\n-- that throw is swallowed fail-open, silently stopping capture.\n--\n-- Existing rows carry the old key\'s discriminator into project_key\n-- (\'legacy:\' || project), so the new unique index is a re-encoding of the old\n-- one and cannot collide on rows the old one allowed. Leaving them on the\n-- column default would collapse two projects\' identical file/line hits onto\n-- one key and abort the whole migration. Writer keys are \'git:\'/\'path:\'-\n-- prefixed, so a backfilled row never collides with a captured one either.\n--\n-- egress_decision_override.destination_id becomes nullable with ON DELETE SET\n-- NULL, which SQLite can only do by rebuilding the table. `host` is ADDed\n-- before the rebuild so the copy has a column to read and so the migration\n-- still presents two probeable columns to the applier\'s evidence check.\nALTER TABLE `share_call_site` ADD `project_key` text DEFAULT \'\' NOT NULL;--\x3e statement-breakpoint\nUPDATE `share_call_site` SET `project_key` = \'legacy:\' || `project`;--\x3e statement-breakpoint\nDROP INDEX IF EXISTS `uq_share_call_site`;--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_share_call_site` ON `share_call_site` (`endpoint_id`,`project_key`,`file`,`line`);--\x3e statement-breakpoint\nCREATE INDEX `idx_share_call_site_project` ON `share_call_site` (`project_key`,`endpoint_id`);--\x3e statement-breakpoint\nALTER TABLE `egress_decision_override` ADD `host` text;--\x3e statement-breakpoint\nPRAGMA foreign_keys=OFF;--\x3e statement-breakpoint\nCREATE TABLE `__new_egress_decision_override` (\n	`id` text PRIMARY KEY NOT NULL,\n	`destination_id` text,\n	`host` text,\n	`decision` text NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL,\n	FOREIGN KEY (`destination_id`) REFERENCES `share_destination`(`id`) ON UPDATE no action ON DELETE set null\n);\n--\x3e statement-breakpoint\nINSERT INTO `__new_egress_decision_override`("id", "destination_id", "host", "decision", "created_at", "updated_at") SELECT "id", "destination_id", "host", "decision", "created_at", "updated_at" FROM `egress_decision_override`;--\x3e statement-breakpoint\nDROP TABLE `egress_decision_override`;--\x3e statement-breakpoint\nALTER TABLE `__new_egress_decision_override` RENAME TO `egress_decision_override`;--\x3e statement-breakpoint\nPRAGMA foreign_keys=ON;--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_egress_decision_override` ON `egress_decision_override` (`destination_id`);--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_egress_decision_override_host` ON `egress_decision_override` (`host`) WHERE `host` IS NOT NULL;\n'},{tag:"0012_handy_the_captain",sql:"ALTER TABLE `inspection_findings` ADD `finding_key` text;--\x3e statement-breakpoint\nALTER TABLE `inspection_findings` ADD `first_detected_at` integer;--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_inspection_findings_key` ON `inspection_findings` (`finding_key`);"},{tag:"0013_legacy_history_backfill_support",sql:"-- Legacy-to-generalized backfill support: the schema the resumable\n-- events/findings -> audit_events/inspection_findings copy needs (the row\n-- copy itself runs as a batched post-migration installer, not here — see\n-- @akasecurity/persistence's migrations.ts), plus the audit_events read-path\n-- indexes replacing the ones the legacy events table carried (0009/0010).\n\n-- Tracks how far the batched, resumable copy has advanced through each legacy\n-- table, by rowid, so a copy interrupted mid-run resumes instead of\n-- restarting, and a completed copy is a cheap no-op on every later open.\nCREATE TABLE `legacy_copy_watermark` (\n	`source` text PRIMARY KEY NOT NULL,\n	`last_rowid` integer DEFAULT 0 NOT NULL\n);\n--\x3e statement-breakpoint\n-- Serves the time-range read family that scans a single event_type across a\n-- start/end window (e.g. the Activity timeline) without a full-table scan.\nCREATE INDEX `idx_audit_type_t` ON `audit_events` (`event_type`,`started_at`);\n--\x3e statement-breakpoint\n-- Partial expression index mirroring `idx_events_code_change_path` (0009) for\n-- the generalized audit_events/attributes pair: file-path reads filter\n-- `event_type = 'code_change' AND json_extract(attributes, '$.file_path') = :path`.\nCREATE INDEX `idx_audit_code_change_path` ON `audit_events` (json_extract(`attributes`, '$.file_path')) WHERE `event_type` = 'code_change';\n--\x3e statement-breakpoint\n-- Synthesizes a stub session root (event_type = 'session', no attributes) for\n-- every legacy `events.metadata.sessionId` that has no audit_events row yet.\n-- audit_events.root_session_id is a self-FK, enforced with foreign-key\n-- checking on, and INSERT OR IGNORE does not suppress a foreign-key violation\n-- (only UNIQUE/PK/NOT NULL/CHECK) — so this must run before the events copy\n-- resolves root_session_id, or every session-scoped row's insert fails.\n-- started_at takes the earliest legacy occurred_at recorded under that\n-- session, so the stub root's own timeline position is never later than\n-- anything it will end up parenting.\nINSERT INTO audit_events (id, event_type, root_session_id, started_at)\nSELECT\n	json_extract(metadata, '$.sessionId'),\n	'session',\n	NULL,\n	min(occurred_at)\nFROM events\nWHERE json_valid(metadata)\n	AND json_extract(metadata, '$.sessionId') IS NOT NULL\n	AND json_extract(metadata, '$.sessionId') NOT IN (SELECT id FROM audit_events)\nGROUP BY json_extract(metadata, '$.sessionId');\n"},{tag:"0014_drop_legacy_events_findings",sql:"-- Custom migration: drops the frozen legacy `events`/`findings` tables\n-- (superseded by audit_events/inspection_definitions/inspection_findings) and\n-- replaces them with read-only views of the same name.\n--\n-- persistence's migrations.ts applies this migration ONLY once the batched\n-- history backfill (see runLegacyHistoryBackfill) has fully drained both\n-- tables, and only after copying the live file aside — see\n-- backupBeforeLegacyDrop in packages/persistence/src/migrations.ts. A store\n-- still mid-copy keeps its real tables and this migration stays pending.\n--\n-- The views exist for skew: the `aka` CLI and the Claude Code plugin update\n-- independently against one shared store, so an older, already-installed\n-- binary can open a store a newer binary already dropped these tables on.\n-- Every already-shipped repository constructor prepares its SQL eagerly at\n-- open time, so a bare \"table not found\" would fail the WHOLE open, not just\n-- a findings-specific read — these views keep `prepare()` succeeding so an\n-- old binary's unrelated features keep working; its own reads stay truthful,\n-- and its rare (already fail-open) writes fail at run time instead.\n--\n-- The 0009/0010 expression indexes existed only over the legacy `events`\n-- table; DROP TABLE below would remove them implicitly, but they are\n-- dropped explicitly first so the intent reads clearly. IF EXISTS so a store\n-- that reached here with an index missing out of band (an adopted-tag store\n-- whose physical index was never built) does not throw a deterministic \"no\n-- such index\" out of the fail-open drop path.\nDROP INDEX IF EXISTS `idx_events_code_change_path`;\n--\x3e statement-breakpoint\nDROP INDEX IF EXISTS `idx_events_session_id`;\n--\x3e statement-breakpoint\n-- `findings.event_id` references `events.id` — drop the child first.\nDROP TABLE `findings`;\n--\x3e statement-breakpoint\nDROP TABLE `events`;\n--\x3e statement-breakpoint\n-- Legacy `events` shape, projected from audit_events: `kind`/`occurred_at`/\n-- `source_tool` become real columns again (source_tool round-trips through\n-- the attributes bag, the only place a capture-typed audit row keeps it);\n-- `metadata` is reconstructed as the old camelCase JSON object from the new\n-- snake_case attributes bag, with `root_session_id` folded back in as\n-- `sessionId` (the one legacy metadata key that became a column, never an\n-- attribute, on the new table). Constrained to the four capture kinds so\n-- structural rows (session/run/tool_call/llm_call/source_lookup/config_scan)\n-- never leak into a legacy reader's result set — the old `events` table\n-- never held them either.\nCREATE VIEW `events` AS\nSELECT\n  id,\n  json_extract(attributes, '$.source_tool') AS source_tool,\n  event_type AS kind,\n  started_at AS occurred_at,\n  content_hash,\n  content,\n  -- Plugin-local bookkeeping column that `ensureSyncedAtColumn` adds to the\n  -- real `events` table at open time. A pre-cutover binary runs that probe on\n  -- EVERY open; without this projection its `columnNames('events')` check\n  -- misses `synced_at` and issues `ALTER TABLE events ADD COLUMN` against this\n  -- view, which SQLite rejects (\"Cannot add a column to a view\") — a hard,\n  -- non-fail-open crash of the whole open, the exact skew failure these views\n  -- exist to prevent. Projecting it (always NULL; no reader consumes it)\n  -- short-circuits that ALTER.\n  NULL AS synced_at,\n  json_object(\n    'sessionId', root_session_id,\n    'repo', json_extract(attributes, '$.repo'),\n    'filePath', json_extract(attributes, '$.file_path'),\n    'toolName', json_extract(attributes, '$.tool_name'),\n    'gitignored', json_extract(attributes, '$.gitignored'),\n    'wholeFile', json_extract(attributes, '$.whole_file'),\n    'model', json_extract(attributes, '$.model'),\n    'turnIndex', json_extract(attributes, '$.turn_index'),\n    'correlationId', json_extract(attributes, '$.correlation_id'),\n    'traceId', json_extract(attributes, '$.trace_id'),\n    'exceptionIds', json_extract(attributes, '$.exception_ids')\n  ) AS metadata\nFROM audit_events\nWHERE event_type IN ('prompt', 'response', 'code_change', 'tool_use');\n--\x3e statement-breakpoint\n-- A plain single-row INSERT (the old writer's shape — no ON CONFLICT) is\n-- accepted by prepare() against a view once an INSTEAD OF INSERT trigger\n-- exists, so it fails at run time instead of at open — landing in the same\n-- fail-open path the caller already wraps its write in.\nCREATE TRIGGER `trg_events_ro`\nINSTEAD OF INSERT ON `events`\nBEGIN SELECT RAISE(ABORT, 'events is read-only; write to audit_events instead'); END;\n--\x3e statement-breakpoint\n-- Legacy `findings` shape: rule_id/category/severity come from the joined\n-- inspection_definitions row (the legacy table inlined them per-row; the\n-- generalized schema normalizes them out into the shared definition). A view\n-- has no rowid of its own, so the underlying table's rowid is re-exposed\n-- explicitly under that name — a legacy reader ordering by `f.rowid` would\n-- otherwise fail to resolve the column at all. Joined to audit_events for the\n-- same four-capture-kind constraint as the events view above (a finding\n-- attached to a tool_call/config_scan row never existed in the legacy table\n-- either — see the persistence findings repository's identical predicate).\nCREATE VIEW `findings` AS\nSELECT\n  f.id AS id,\n  f.rowid AS rowid,\n  f.audit_event_id AS event_id,\n  d.rule_id AS rule_id,\n  d.category AS category,\n  d.severity AS severity,\n  f.span_start AS span_start,\n  f.span_end AS span_end,\n  f.masked_match AS masked_match,\n  f.action_taken AS action_taken,\n  f.confidence AS confidence,\n  f.finding_key AS finding_key,\n  f.first_detected_at AS first_detected_at\nFROM inspection_findings f\nJOIN audit_events e ON e.id = f.audit_event_id\nJOIN inspection_definitions d ON d.id = f.inspection_definition_id\nWHERE e.event_type IN ('prompt', 'response', 'code_change', 'tool_use');\n--\x3e statement-breakpoint\n-- Defense in depth only: SQLite refuses to plan ANY upsert against a view\n-- (\"cannot UPSERT a view\") no matter what trigger exists, so this can never\n-- rescue the real legacy writer, which always used\n-- `ON CONFLICT (finding_key) DO UPDATE` — that statement still fails at\n-- prepare() on an old binary, same as it would with no trigger at all. This\n-- only covers a plain-INSERT shape, should one ever exist.\nCREATE TRIGGER `trg_findings_ro`\nINSTEAD OF INSERT ON `findings`\nBEGIN SELECT RAISE(ABORT, 'findings is read-only; write to inspection_findings instead'); END;\n"}],e=/^(\d+)([mh])$/;function f(a,b=Date.now()){let c=a.trim().toLowerCase();return"once"===c?{scope:"once",expiresAt:new Date(b+18e5).toISOString(),maxUses:1}:"permanent"===c?{scope:"permanent",expiresAt:null,maxUses:null}:{scope:"temporary",expiresAt:new Date(b+function(a){let b=e.exec(a.trim()),c=b?Number(b[1]):0;if(!b||c<=0)throw Error(`invalid duration '${a}' — use <n>m or <n>h (e.g. 30m, 1h, 24h)`);let d=c*("h"===b[2]?36e5:6e4);if(d>864e5)throw Error(`duration '${a}' exceeds the 24h maximum for --for — use --permanent (revocable any time) for an open-ended grant`);return d}(c)).toISOString(),maxUses:null}}function g(a){return new Date(a).getTime()}function h(a){return new Date(a).toISOString()}function i(a,b){return{input:a,output:b,cacheWrite5m:1.25*a,cacheWrite1h:2*a,cacheRead:.1*a,webSearch:.01}}let j={input:0,output:0,cacheWrite5m:0,cacheWrite1h:0,cacheRead:0,webSearch:0},k={"claude-fable-5":i(10,50),"claude-opus-4-8":i(5,25),"claude-opus-4-7":i(5,25),"claude-opus-4-6":i(5,25),"claude-opus-4-5":i(5,25),"claude-sonnet-5":i(3,15),"claude-sonnet-4-6":i(3,15),"claude-sonnet-4-5":i(3,15),"claude-haiku-4-5":i(1,5)},l={...Object.fromEntries(Object.entries(k).map(([a,b])=>[`anthropic/${a}`,b])),"ollama/*":j,"local/*":j},m={standard:1,batch:.5,priority:1.5},n=Object.keys(k);function o(a){let b=a.replace(/^(us|eu|apac|global)\./,"").replace(/^anthropic[./]/,"").replace(/@[\w-]+$/,"").replace(/-v\d+:\d+$/,"").replace(/:\d+$/,"").replace(/-\d{8}$/,"");for(let a of n)if(b===a)return a;return b}let p={normalizeModelId(a,b){let c=a.trim().toLowerCase();if("ollama"===c||"local"===c)return{provider:c,model:"*"};if("anthropic"===c||"bedrock"===c||"vertex"===c)return{provider:c,model:o(b)};let d=/^anthropic\/(.+)$/.exec(b);return d?.[1]!==void 0?{provider:c,model:o(d[1])}:{provider:c,model:b}},costFor({provider:a,model:b,usage:c}){var d;let e=this.normalizeModelId(a,b),f=l[`${e.provider}/${e.model}`];return void 0===f?null:((c.inputTokens??0)*f.input+(c.outputTokens??0)*f.output+(c.cacheWrite1hTokens??0)*f.cacheWrite1h+(c.cacheWrite5mTokens??0)*f.cacheWrite5m+(c.cacheReadTokens??0)*f.cacheRead)/1e6*(void 0===(d=c.serviceTier)?1:m[d]??1)+(c.webSearchRequests??0)*f.webSearch}};new Intl.NumberFormat("en-US",{notation:"compact",maximumFractionDigits:1});let q=a=>a??0;function r(a,b){let c=new Map;for(let{sessionId:d,attributes:e}of a){let a=e.provider??"unknown",f=e.model??"unknown",g=`${a} ${f}`,h=c.get(d);void 0===h&&(h=new Map,c.set(d,h));let i=h.get(g);void 0===i&&(i={provider:a,model:f,input:0,output:0,cacheCreation:0,cacheRead:0,costUsd:0,priced:!1},h.set(g,i)),i.input+=q(e.input_tokens),i.output+=q(e.output_tokens),i.cacheCreation+=q(e.cache_creation_input_tokens),i.cacheRead+=q(e.cache_read_input_tokens);let j=b.costFor({provider:a,model:f,usage:function(a){let b={inputTokens:q(a.input_tokens),outputTokens:q(a.output_tokens),cacheWrite1hTokens:q(a.ephemeral_1h_input_tokens),cacheWrite5mTokens:q(a.ephemeral_5m_input_tokens),cacheReadTokens:q(a.cache_read_input_tokens),webSearchRequests:q(a.web_search_requests)};return void 0!==a.service_tier&&(b.serviceTier=a.service_tier),b}(e)});null!==j&&(i.costUsd+=j,i.priced=!0)}let d=[];for(let[a,b]of c){let c=[],e=0,f=0,g=!1,h=!1;for(let d of b.values()){let b=d.input+d.output+d.cacheCreation+d.cacheRead;e+=b;let i=d.priced?d.costUsd:null;null===i?h=!0:(g=!0,f+=i),c.push({sessionId:a,model:d.model,provider:d.provider,inputTokens:d.input,outputTokens:d.output,cacheCreation:d.cacheCreation,cacheRead:d.cacheRead,totalTokens:b,estimatedCostUsd:i})}c.sort((a,b)=>b.totalTokens-a.totalTokens),d.push({sessionId:a,rollups:c,totalTokens:e,estimatedCostUsd:g?f:null,costIsPartial:h})}return d.sort((a,b)=>b.totalTokens-a.totalTokens),d}var s=c(72844),t=c(72446),u=c(24036);let v=s.k5(["pii","financial","secret","phi","code_context","code_flaw","custom","config"]).meta({id:"DetectionCategory"}),w=s.k5(["critical","high","medium","low"]).meta({id:"Severity"}),x=s.k5(["warn","redact","block","allow","log"]).meta({id:"ActionTaken"}),y=x.options,z=s.Ik({start:s.ai().int().nonnegative(),end:s.ai().int().nonnegative()}).meta({id:"Span"}),A=s.Ik({id:s.Os(),eventId:s.Os(),ruleId:s.Yj(),category:v,severity:w,span:z,maskedMatch:s.Yj(),actionTaken:x,confidence:s.ai().min(0).max(1)}).meta({id:"Finding"});A.meta({id:"DetectedFinding"});let B=s.k5(["blocked","redacted","warned","allowed","quarantined","monitored"]).meta({id:"FindingAction"}),C=s.k5(["claudecode","claudedesktop","cursor","copilot","chatgpt","api"]).meta({id:"FindingProvider"}),D=s.k5(["secret","pii","source_code","external_share","mcp_server","customer_data","financial","phi","custom"]).meta({id:"FindingCategory"});s.k5(["in-flight","at-rest"]).meta({id:"FindingOrigin"});let E=s.k5(["open","handled","resolved","dismissed"]).meta({id:"FindingStatus"}),F=s.k5(["enforced-in-flight","fixed-at-source","exception","acknowledged","false-positive","redetected"]).meta({id:"ResolutionMethod"}),G=s.Ik({maskedValue:s.Yj(),contextPrefix:s.Yj()}).meta({id:"FindingMatch"}),H=s.Ik({id:s.Yj(),name:s.Yj().nullable()}).meta({id:"FindingDetectionRef"}),I=s.Ik({id:s.Yj(),name:s.Yj()}).meta({id:"FindingPolicyRef"}),J=s.Ik({id:s.Yj(),provider:C,repo:s.Yj(),file:s.Yj(),toolName:s.Yj().optional(),action:B,detectedAt:t.w$(),confidence:s.ai().min(0).max(1),status:E.optional()}).meta({id:"FindingInstance"}),K=s.Ik({id:s.Yj(),category:D,subtype:s.Yj(),severity:w,match:G,detection:H,policy:I,instanceCount:s.ai().int().nonnegative(),providers:s.YO(C),aggregateAction:B.nullable(),latestDetectedAt:t.w$(),instances:s.YO(J),status:E.optional()}).meta({id:"FindingGroup"});s.Ik({findings:s.ai().int().nonnegative(),groups:s.ai().int().nonnegative(),bySeverity:s.Ik({critical:s.ai().int().nonnegative(),high:s.ai().int().nonnegative(),medium:s.ai().int().nonnegative(),low:s.ai().int().nonnegative()})}).meta({id:"FindingStats"});let L=s.Ik({value:s.Yj(),count:s.ai().int().nonnegative()}).meta({id:"FindingFacetItem"}),M=s.Ik({severity:s.YO(L),subtype:s.YO(L),provider:s.YO(L),action:s.YO(L),status:s.YO(L)}).meta({id:"FindingFacets"}),N=50;s.Ik({severity:s.YO(w).optional(),subtype:s.YO(s.Yj()).optional(),provider:s.YO(C).optional(),action:s.YO(B).optional(),status:s.YO(E).optional(),q:s.Yj().optional(),sessionId:s.Yj().optional(),groupBy:s.eu("type").optional(),limit:u.ai().int().min(1).max(100).optional(),cursor:s.Yj().optional()}),s.Ik({totals:s.Ik({findings:s.ai().int().nonnegative(),groups:s.ai().int().nonnegative()}),facets:M,items:s.YO(K),nextCursor:s.Yj().nullable(),sessionFirings:s.g1(s.Yj(),s.ai().int().nonnegative()).optional()}).meta({id:"ListGroupedFindingsResponse"}),s.Ik({action:B.exclude(["quarantined"]),instanceId:s.Yj().optional()}).meta({id:"ApplyFindingActionRequest"}),K.meta({id:"ApplyFindingActionResponse"}),s.Ik({severity:s.YO(w).optional(),subtype:s.YO(s.Yj()).optional(),provider:s.YO(C).optional(),action:s.YO(B).optional(),q:s.Yj().optional(),format:s.k5(["csv","json"]).optional()}),J.extend({groupId:s.Yj(),category:D,subtype:s.Yj(),severity:w,match:G,detection:H,policy:I}).meta({id:"FindingInstanceDetail"});let O=s.k5(["claudecode","cursor","copilot","codex","windsurf","claudedesktop","chatgpt","api"]).meta({id:"Harness"}),P={"claude-code":"claudecode","claude-desktop":"claudedesktop","github-copilot":"copilot",cursor:"cursor",chatgpt:"chatgpt"},Q=s.k5(["host","harness","user","skill","hook","mcp_server","config_file"]).meta({id:"InventoryObjectType"}),R=s.k5(["session","run","tool_call","llm_call","source_lookup","prompt","response","code_change","tool_use","config_scan"]).meta({id:"AuditEventType"}),S=s.g1(s.Yj(),s.L5());s.Ik({host_name:s.Yj().optional(),os:s.Yj().optional(),os_version:s.Yj().optional(),arch:s.Yj().optional()}).catchall(s.L5()),s.Ik({harness_version:s.Yj().optional(),interface:s.Yj().optional()}).catchall(s.L5()),s.Ik({display_name:s.Yj().optional(),email:s.Yj().optional()}).catchall(s.L5()),s.Ik({source:s.Yj().optional(),version:s.Yj().optional(),description:s.Yj().optional(),updated_at:s.Yj().optional(),scope:s.Yj().optional(),plugin_name:s.Yj().optional()}).catchall(s.L5()),s.Ik({event:s.Yj().optional(),matcher:s.Yj().optional(),command:s.Yj().optional(),scope:s.Yj().optional(),plugin_name:s.Yj().optional(),timeout:s.ai().optional()}).catchall(s.L5()),s.Ik({scope:s.Yj().optional(),transport:s.Yj().optional(),command:s.Yj().optional(),url:s.Yj().optional(),env_keys:s.YO(s.Yj()).optional(),plugin_name:s.Yj().optional(),marketplace:s.Yj().optional(),project:s.Yj().optional()}).catchall(s.L5()),s.Ik({kind:s.Yj().optional(),detail:s.Yj().optional(),scope:s.Yj().optional(),updated_at:s.Yj().optional(),entry_count:s.ai().optional()}).catchall(s.L5());let T=s.Ik({model:s.Yj().optional(),provider:s.Yj().optional(),input_tokens:s.ai().int().nonnegative().optional(),output_tokens:s.ai().int().nonnegative().optional(),cache_creation_input_tokens:s.ai().int().nonnegative().optional(),cache_read_input_tokens:s.ai().int().nonnegative().optional(),ephemeral_1h_input_tokens:s.ai().int().nonnegative().optional(),ephemeral_5m_input_tokens:s.ai().int().nonnegative().optional(),web_search_requests:s.ai().int().nonnegative().optional(),web_fetch_requests:s.ai().int().nonnegative().optional(),service_tier:s.Yj().optional(),stop_reason:s.Yj().optional(),message_id:s.Yj().optional(),uuid:s.Yj().optional(),parent_uuid:s.Yj().optional(),run_key:s.Yj().optional()}).catchall(s.L5());s.Ik({sessionId:s.Yj().min(1),messageId:s.Yj().min(1),parentId:s.Yj().min(1),rootSessionId:s.Yj().min(1),startedAt:t.w$(),attributes:T});let U=s.Ik({tool_name:s.Yj().optional(),tool_use_id:s.Yj().optional(),target:s.Yj().optional(),is_error:s.zM().optional(),input_size:s.ai().int().nonnegative().optional(),output_size:s.ai().int().nonnegative().optional(),uuid:s.Yj().optional(),parent_uuid:s.Yj().optional(),run_key:s.Yj().optional()}).catchall(s.L5());s.Ik({source_tool:s.Yj().optional(),file_path:s.Yj().optional(),repo:s.Yj().optional(),tool_name:s.Yj().optional(),gitignored:s.zM().optional(),whole_file:s.zM().optional(),correlation_id:s.uR().optional(),trace_id:s.Yj().regex(/^[0-9a-f]{32}$/).optional(),exception_ids:s.YO(s.Os()).optional()}).catchall(s.L5());let V=s.Ik({ruleId:s.Yj().min(1),ruleName:s.Yj(),ruleVersion:s.Yj().min(1),category:v,severity:w,span:z,maskedMatch:s.Yj(),actionTaken:x,confidence:s.ai().min(0).max(1)});s.Ik({sessionId:s.Yj().min(1),toolUseId:s.Yj().min(1),parentId:s.Yj().min(1),rootSessionId:s.Yj().min(1),startedAt:t.w$(),attributes:U,inspections:s.YO(V).default([])});let W=s.Ik({objectType:Q,identityKey:s.Yj().min(1),location:s.Yj().optional(),title:s.Yj().optional(),hostId:s.Yj().optional(),attributes:S.default({})}).meta({id:"InventoryInput"}),X=s.Ik({url:s.Yj().min(1),name:s.Yj().optional(),attributes:S.default({})}).meta({id:"SourceProjectInput"}),Y=s.Ik({id:s.Yj().min(1),eventType:R,startedAt:t.w$(),endedAt:t.w$().optional(),parentId:s.Yj().optional(),rootSessionId:s.Yj().optional(),hostId:s.Yj().optional(),harnessId:s.Yj().optional(),sourceProjectId:s.Yj().optional(),severity:w.optional(),priority:s.Yj().optional(),content:s.Yj().optional(),contentHash:s.Yj().optional(),attributes:S.optional()}).meta({id:"AuditEventInput"});s.Ik({class:s.Yj().min(1),label:s.Yj().optional(),attributes:S.optional()});let Z=s.Ik({ruleId:s.Yj().min(1),version:s.Yj().min(1),name:s.Yj(),category:v,severity:w,definition:s.Yj()});s.Ik({id:s.Yj().min(1),auditEventId:s.Yj().min(1),inspectionDefinitionId:s.Yj().min(1),classifiedDataId:s.Yj().optional(),span:z,maskedMatch:s.Yj(),actionTaken:x,confidence:s.ai().min(0).max(1),findingKey:s.Yj().optional(),firstDetectedAt:t.w$().optional()}),s.Ik({host:W.optional(),harness:W.optional(),project:X.optional()}).meta({id:"InventoryContext"}),s.Ik({hostId:s.Yj().optional(),harnessId:s.Yj().optional(),accountId:s.Yj().optional(),sourceProjectId:s.Yj().optional()}).meta({id:"ResolvedInventory"}),s.Ik({hosts:s.YO(s.Yj()),harnesses:s.YO(s.Yj()),osVersions:s.YO(s.Yj()),projects:s.YO(s.Yj())}).meta({id:"InventoryFacets"});let $=s.Ik({sessionId:s.Yj(),model:s.Yj(),provider:s.Yj(),inputTokens:s.ai().int().nonnegative(),outputTokens:s.ai().int().nonnegative(),cacheCreation:s.ai().int().nonnegative(),cacheRead:s.ai().int().nonnegative(),totalTokens:s.ai().int().nonnegative(),estimatedCostUsd:s.ai().nullable()}).meta({id:"TokenRollup"});s.Ik({sessionId:s.Yj(),rollups:s.YO($),totalTokens:s.ai().int().nonnegative(),estimatedCostUsd:s.ai().nullable(),costIsPartial:s.zM()});let _=s.Ik({provider:s.Yj(),model:s.Yj(),inputTokens:s.ai().int().nonnegative(),outputTokens:s.ai().int().nonnegative(),cacheTokens:s.ai().int().nonnegative(),totalTokens:s.ai().int().nonnegative(),estimatedCostUsd:s.ai().nullable()});function aa(a){return JSON.stringify(a)}s.Ik({models:s.YO(_),sessionCount:s.ai().int().nonnegative(),totalTokens:s.ai().int().nonnegative(),estimatedCostUsd:s.ai(),costIsPartial:s.zM()});let ab=s.k5(["active","completed","interrupted","error"]),ac=s.k5(["session","prompt","response","tool","hook","detection","share","permission","commit","error","active"]),ad=s.k5(["detections","shares","inventory"]),ae=s.Ik({id:s.Yj(),occurredAt:t.w$(),kind:ac,title:s.Yj(),detail:s.Yj(),tool:s.Yj().nullable(),severity:w.nullable(),link:ad.nullable(),targetId:s.Yj().nullable(),internal:s.zM(),flagged:s.zM()}).meta({id:"ActivityAuditEvent"}),af=s.Ik({id:s.Yj(),harness:O,title:s.Yj(),project:s.Yj(),repo:s.Yj(),branches:s.YO(s.Yj()),startedAt:t.w$(),endedAt:t.w$().nullable(),status:ab,turns:s.ai().int().nonnegative(),findings:s.ai().int().nonnegative(),shares:s.ai().int().nonnegative()}).meta({id:"ActivitySessionSummary"});af.extend({host:s.Yj(),cwd:s.Yj(),models:s.YO(s.Yj()),version:s.Yj(),tokens:$,tools:s.g1(s.Yj(),s.ai().int().nonnegative()),files:s.YO(s.Yj()),commits:s.ai().int().nonnegative(),events:s.YO(ae)}).meta({id:"ActivitySession"}),s.Ik({tz:s.Yj().optional()});let ag=s.Ik({sessionsToday:s.ai().int().nonnegative(),liveNow:s.ai().int().nonnegative(),toolCallsToday:s.ai().int().nonnegative(),findingsToday:s.ai().int().nonnegative(),egressToday:s.ai().int().nonnegative()}).meta({id:"GetActivityStatsResponse"});s.Ik({q:s.Yj().optional(),harness:s.YO(O).optional(),from:s.KC([t.p6(),t.w$()]).optional(),to:s.KC([t.p6(),t.w$()]).optional(),excludeEmpty:s.uE().optional(),limit:u.ai().int().min(1).max(100).default(50),cursor:s.Yj().optional()});let ah=s.Ik({items:s.YO(af),nextCursor:s.Yj().nullable(),emptyCount:s.ai().int().nonnegative()}).meta({id:"ListActivitySessionsResponse"});s.Ik({limit:u.ai().int().min(1).max(500).default(100),cursor:s.Yj().optional(),order:s.k5(["asc","desc"]).default("asc")}),s.Ik({items:s.YO(ae),nextCursor:s.Yj().nullable()}).meta({id:"ListSessionEventsResponse"}),s.Ik({format:s.k5(["ndjson","json"]).default("ndjson")}),s.Ik({format:s.k5(["csv","json"]).default("csv"),q:s.Yj().optional(),harness:s.YO(O).optional(),from:s.KC([t.p6(),t.w$()]).optional(),to:s.KC([t.p6(),t.w$()]).optional()}),s.Ik({stats:ag,sessions:ah}).meta({id:"ActivityOverviewResponse"});let ai=s.k5(["prompt","response","code_change","tool_use"]).meta({id:"EventKind"}),aj=ai.options.map(a=>`'${a}'`).join(","),ak=s.k5(["claude-code","claude-desktop","cursor","chatgpt","github-copilot","cli","unknown"]).meta({id:"SourceTool"}),al=s.Ik({sessionId:s.Yj().optional(),repo:s.Yj().optional(),filePath:s.Yj().optional(),toolName:s.Yj().optional(),gitignored:s.zM().optional(),wholeFile:s.zM().optional(),model:s.Yj().optional(),turnIndex:s.ai().int().nonnegative().optional(),correlationId:s.uR().optional(),traceId:s.Yj().regex(/^[0-9a-f]{32}$/).optional(),exceptionIds:s.YO(s.Os()).optional()}).meta({id:"EventMetadata"}),am=s.Ik({id:s.Os(),sourceTool:ak,kind:ai,occurredAt:t.w$(),contentHash:s.Yj(),content:s.Yj(),metadata:al.optional()}).meta({id:"Event"}),an=am.meta({id:"IngestEvent"});s.Ik({events:s.YO(an).min(1).max(100),dedupe:s.eu("content-hash").optional()}).meta({id:"IngestBatch"});let ao=s.k5(["project","skill","mcp","hook","config"]).meta({id:"AssetType"}),ap=s.k5(["open","approved","blocked"]).meta({id:"AccessLevel"}),aq=s.k5(["source","public-dep","vendored","config","data","docs","generated"]).meta({id:"Origin"}),ar=s.k5(["known-good","risky","unapproved"]).meta({id:"TrustLevel"}),as=s.k5(["update","stale","conflict","unknown","change","untracked","risk","findings"]).meta({id:"Flag"}),at=s.k5(["public","private"]).meta({id:"Visibility"}),au=s.k5(["block","redact","warn"]).meta({id:"HarnessEventKind"}),av=s.k5(["claudecode","cursor","codex"]).meta({id:"HarnessId"}),aw=s.Ik({open:s.ai().int().nonnegative(),approved:s.ai().int().nonnegative(),blocked:s.ai().int().nonnegative(),total:s.ai().int().nonnegative()}).meta({id:"AccessCounts"}),ax=s.Ik({id:s.Yj(),type:ao,name:s.Yj(),sub:s.Yj(),flags:s.YO(as),trust:ar.optional()}).meta({id:"AssetSummary"}),ay=s.Ik({id:s.Yj(),name:s.Yj(),repo:s.Yj(),visibility:at,language:s.Yj(),policyDefault:ap,updatedAt:t.w$(),accessCounts:aw,findingsCount:s.ai().int().nonnegative()}).meta({id:"ProjectSummary"}),az=s.Ik({type:ao,assets:s.YO(ax)}),aA=s.Ik({id:av,label:s.Yj(),kind:s.Yj(),version:s.Yj(),sessions:s.ai().int().nonnegative(),assetCount:s.ai().int().nonnegative(),flagCount:s.ai().int().nonnegative(),projects:s.YO(ay),categories:s.YO(az)}).meta({id:"HarnessSummary"});s.Ik({items:s.YO(aA)}).meta({id:"ListHarnessesResponse"});let aB=s.Ik({type:ao,total:s.ai().int().nonnegative(),trustRollup:s.Ik({"known-good":s.ai().int().nonnegative(),risky:s.ai().int().nonnegative(),unapproved:s.ai().int().nonnegative()}).partial().strict().optional(),flagRollup:s.Ik({update:s.ai().int().nonnegative(),stale:s.ai().int().nonnegative(),conflict:s.ai().int().nonnegative(),unknown:s.ai().int().nonnegative(),change:s.ai().int().nonnegative(),untracked:s.ai().int().nonnegative(),risk:s.ai().int().nonnegative(),findings:s.ai().int().nonnegative()}).partial().strict(),items:s.YO(ax)}).meta({id:"AssetGroup"});s.Ik({groups:s.YO(aB)}).meta({id:"ListAssetsResponse"});let aC=s.Ik({name:s.Yj(),signature:s.Yj(),description:s.Yj(),write:s.zM(),risk:s.Yj().nullable()}).meta({id:"McpTool"}),aD=s.Ik({id:s.Yj(),title:s.Yj(),note:s.Yj()});ax.extend({description:s.Yj().nullable(),trust:ar.nullable(),meta:s.g1(s.Yj(),s.L5()),finding:aD.nullable(),tools:s.YO(aC).optional()}).meta({id:"AssetDetail"}),s.Ik({items:s.YO(ay)}).meta({id:"ListProjectsResponse"}),s.Ik({attention:s.ai().int().nonnegative(),byType:s.Ik({project:s.ai().int().nonnegative(),skill:s.ai().int().nonnegative(),mcp:s.ai().int().nonnegative(),hook:s.ai().int().nonnegative(),config:s.ai().int().nonnegative()}),harnesses:s.ai().int().nonnegative(),mcpTrust:s.Ik({"known-good":s.ai().int().nonnegative(),risky:s.ai().int().nonnegative(),unapproved:s.ai().int().nonnegative()})}).meta({id:"InventoryStats"});let aE=s.Ik({path:s.Yj(),name:s.Yj(),origin:aq,access:ap,isCustom:s.zM(),findings:s.ai().int().nonnegative(),blockedAt:t.w$().nullable().optional(),note:s.Yj().nullable().optional()}).meta({id:"FileSummary"}),aF=s.Ik({name:s.Yj(),path:s.Yj(),accessCounts:aw}).meta({id:"FolderSummary"});s.Ik({project:s.Ik({id:s.Yj(),repo:s.Yj(),visibility:at}),path:s.Yj(),folders:s.YO(aF).optional(),files:s.YO(aE)}).meta({id:"ProjectTreeResponse"}),aE.extend({project:s.Ik({repo:s.Yj(),visibility:at,language:s.Yj(),policyDefault:ap,updatedAt:t.w$()}),findingsRefs:s.YO(s.Ik({id:s.Yj(),title:s.Yj()}))}).meta({id:"FileDetail"}),s.Ik({path:s.Yj(),access:ap}).meta({id:"SetFileAccessBody"}),s.Ik({file:aE,accessCounts:aw}).meta({id:"SetFileAccessResponse"}),s.Ik({trust:ar}).meta({id:"SetMcpTrustBody"});let aG=s.Ik({kind:au,title:s.Yj(),detail:s.Yj(),occurredAt:t.w$(),findingId:s.Yj().nullable().optional()}).meta({id:"HarnessEventItem"});s.Ik({counts:s.Ik({block:s.ai().int().nonnegative(),redact:s.ai().int().nonnegative(),warn:s.ai().int().nonnegative()}),items:s.YO(aG)}).meta({id:"HarnessEventsResponse"}),s.Ik({jobId:s.Yj(),startedAt:t.w$()}).meta({id:"RescanResponse"}),s.Ik({repo:s.Yj()}).meta({id:"ConnectProjectBody"}),s.Ik({type:s.YO(ao).optional(),q:s.Yj().optional()}),s.Ik({path:s.Yj().optional(),q:s.Yj().optional(),filter:s.k5(["blocked"]).optional()}),s.Ik({path:s.Yj()}),s.Ik({limit:u.ai().int().min(1).max(50).default(7)});let aH=s.k5(["once","temporary","permanent"]),aI=s.Ik({repo:s.Yj().optional(),sourceTool:s.Yj().optional(),provider:s.Yj().optional()}).strict(),aJ=s.Ik({id:s.Os(),ruleId:s.Yj(),category:v,valueFingerprint:s.Yj().regex(/^[0-9a-f]{64}$/),keyVersion:s.ai().int().positive(),maskedValue:s.Yj(),scope:aH,expiresAt:t.w$().nullable(),maxUses:s.ai().int().positive().nullable(),useCount:s.ai().int().nonnegative(),lastUsedAt:t.w$().nullable(),justification:s.Yj().min(1),conditions:aI.nullable(),createdBy:s.Yj(),createdVia:s.k5(["cli-approve","cli-add","web-approve","web-add","api","setup-triage"]),createdAt:t.w$(),updatedAt:t.w$(),revokedAt:t.w$().nullable(),revokedBy:s.Yj().nullable(),revokeReason:s.Yj().nullable()}),aK=aJ.pick({id:!0,ruleId:!0,valueFingerprint:!0,keyVersion:!0,expiresAt:!0,maxUses:!0,useCount:!0,conditions:!0});s.k5(["keyword","regex","validator"]).meta({id:"MatcherType"}),s.k5(["safe","quarantined"]).meta({id:"RuleProbeVerdict"});let aL=s.Ik({type:s.eu("keyword"),keywords:s.YO(s.Yj().min(1)).min(1),caseSensitive:s.zM().default(!1)}),aM=s.Ik({type:s.eu("regex"),pattern:s.Yj().min(1).max(2e3),flags:s.Yj().default("gi"),captureGroup:s.ai().int().nonnegative().optional()}).refine(a=>(function(a,b){try{return new RegExp(a,b),!0}catch{return!1}})(a.pattern,a.flags),{message:"pattern/flags do not form a valid JavaScript regular expression",path:["pattern"]}).refine(a=>void 0!==a.captureGroup||!function(a,b){try{let c=new RegExp(a,b.replace(/[gy]/g,""));return c.exec("")?.[0].length===0}catch{return!1}}(a.pattern,a.flags),{message:'a whole-match regex that can match the empty string (e.g. "\\d*", "a?", "(?:)") can hang the matcher — scope the quantifier to a captureGroup, or require at least one character',path:["pattern"]}),aN=s.Ik({type:s.eu("validator"),name:s.k5(["luhn","entropy","ssn-checksum"]),config:s.g1(s.Yj(),s.L5()).optional()}),aO=s.gM("type",[aL,aM,aN]).meta({id:"Matcher"}),aP=s.Ik({extensions:s.YO(s.Yj().regex(/^\.[A-Za-z0-9]+$/)).min(1)}).meta({id:"AppliesTo"}),aQ=s.KC([s.Yj(),s.Ik({name:s.Yj(),config:s.g1(s.Yj(),s.L5()).optional()})]).meta({id:"PostValidatorRef"}),aR=s.Ik({categories:s.YO(v).min(1).optional(),ruleIds:s.YO(s.Yj().min(1)).min(1).optional(),labels:s.YO(s.Yj().min(1)).min(1).optional(),windowChars:s.ai().int().positive().default(160),confidenceBoost:s.ai().min(0).max(.3).optional()}).refine(a=>(a.categories?.length??0)+(a.ruleIds?.length??0)+(a.labels?.length??0)>0,{message:"requiresNearby needs at least one of categories, ruleIds, or labels"}).meta({id:"RequiresNearby"}),aS=s.Ik({label:s.Yj(),text:s.Yj().max(5e4),shouldMatch:s.zM(),filePath:s.Yj().optional(),expectedSpans:s.YO(s.Ik({start:s.ai(),end:s.ai()})).optional()}).meta({id:"RuleFixture"}),aT=s.Ik({specVersion:s.eu(1),id:s.Yj().regex(/^[a-z][a-z0-9-]*\/[a-z][a-z0-9-]*$/),name:s.Yj(),category:v,severity:w,matcher:aO,appliesTo:aP.optional(),postValidators:s.YO(aQ).optional(),requiresNearby:aR.optional(),examples:s.YO(s.Yj()).optional()}).meta({id:"Rule"}),aU=s.Ik({name:s.Yj(),email:s.Rp().optional(),url:s.OZ().optional()}).meta({id:"Author"});s.Ik({specVersion:s.eu(1),id:s.Yj(),name:s.Yj(),version:s.Yj(),rules:s.YO(s.Yj()),description:s.Yj().optional(),author:aU.optional(),license:s.Yj().optional(),sourceUrl:s.OZ().optional()}).meta({id:"PackManifest"});let aV=s.k5(["global","repo","user"]).meta({id:"PolicyScope"}),aW=s.KC([s.Ik({ruleId:s.Yj()}),s.Ik({category:v})]).meta({id:"PolicyTarget"}),aX=s.Ik({id:s.Os(),scope:aV,target:aW,action:x,enabled:s.zM().default(!0),customKeywords:s.YO(s.Yj()).optional(),name:s.Yj().optional()}).meta({id:"Policy"});s.Ik({version:s.Yj(),policies:s.YO(aX),rules:s.YO(aT).optional(),rulesComplete:s.zM().optional(),exceptions:s.YO(aK).optional(),ruleVersions:s.g1(s.Yj(),s.Yj()).optional(),customKeywords:s.YO(s.Yj()),fetchedAt:t.w$()}).meta({id:"PolicyBundle"});let aY=["config"],aZ=v.options.filter(a=>!aY.includes(a)),a$={secret:"critical",financial:"critical",code_flaw:"critical",pii:"high",phi:"high",custom:"high",code_context:"low",config:"low"},a_=s.k5(["builtin","custom"]).meta({id:"PolicyKind"}),a0=["monitor","warn","redact","block"],a1=s.k5(a0).meta({id:"BuiltinPolicyId"}),a2=a0,a3={monitor:{name:"Monitor",action:"log",description:"Log every match for audit. The request is allowed through untouched."},warn:{name:"Warn",action:"warn",description:"Allow the request, but warn the user inline before it is sent."},redact:{name:"Redact",action:"redact",description:"Automatically strip the matched value from the request, then continue."},block:{name:"Block",action:"block",description:"Refuse the request entirely whenever any rule in this detection matches."}},a4=Object.fromEntries(v.options.map(a=>[a,a3[function(a){if(aY.includes(a))return"monitor";let b=a$[a];return"critical"===b||"high"===b?"warn":"monitor"}(a)].action])),a5=Object.fromEntries(a0.map(a=>[a,{id:a,...a3[a]}])),a6="monitor";function a7(a){let b=a1.safeParse(a??a6);return a5[b.success?b.data:a6].action}let a8=s.Ik({id:s.Yj(),name:s.Yj(),ruleCount:s.ai().int().nonnegative(),enabled:s.zM()}).meta({id:"UsedByItem"}),a9=s.Ik({id:s.Yj(),kind:a_,name:s.Yj(),enabled:s.zM(),usedByCount:s.ai().int().nonnegative()}).meta({id:"PolicyListItem"});s.Ik({specVersion:s.eu(1),id:s.Yj(),kind:a_,name:s.Yj(),enabled:s.zM(),description:s.Yj(),usedBy:s.YO(a8)}).meta({id:"PolicyDetail"}),s.Ik({policies:s.ai().int().nonnegative(),builtin:s.ai().int().nonnegative(),custom:s.ai().int().nonnegative(),detectionsGoverned:s.ai().int().nonnegative()}).meta({id:"PolicyStatsResponse"}),s.Ik({cursor:s.Yj().optional(),limit:u.ai().int().min(1).max(200).default(50),sourceTool:s.Yj().optional(),kind:s.Yj().optional(),from:t.w$().optional(),to:t.w$().optional()}),s.Ik({items:s.YO(am),nextCursor:s.Yj().nullable()}).meta({id:"ListEventsResponse"}),s.Ik({accepted:s.ai().int().nonnegative(),duplicates:s.ai().int().nonnegative()}).meta({id:"IngestResponse"}),s.Ik({cursor:s.Yj().optional(),limit:u.ai().int().min(1).max(200).default(50),severity:s.Yj().optional(),category:s.Yj().optional(),eventId:s.Os().optional()}),s.Ik({items:s.YO(A),nextCursor:s.Yj().nullable()}).meta({id:"ListFindingsResponse"}),s.Ik({items:s.YO(a9)}).meta({id:"ListPoliciesResponse"}),aX.omit({id:!0}).meta({id:"CreatePolicyRequest"}),aX.partial().required({id:!0}).meta({id:"UpdatePolicyRequest"}),s.Ik({accepted:s.zM()}).meta({id:"RecordAuditEventResponse"}),s.Ik({error:s.Ik({code:s.Yj(),message:s.Yj(),details:s.L5().optional()})}).meta({id:"ErrorResponse"});let ba=s.k5(["user","project","local","plugin"]),bb=s.Ik({name:s.Yj().min(1),source:s.Yj().min(1),scope:ba,pluginName:s.Yj().optional(),version:s.Yj().optional(),description:s.Yj().optional(),updatedAt:t.w$().optional(),location:s.Yj().optional()}),bc=s.Ik({event:s.Yj().min(1),matcher:s.Yj().optional(),command:s.Yj().min(1),timeout:s.ai().optional(),scope:ba,pluginName:s.Yj().optional(),location:s.Yj().optional()}),bd=s.Ik({name:s.Yj().min(1),scope:ba,pluginName:s.Yj().optional(),marketplace:s.Yj().optional(),project:s.Yj().optional(),transport:s.Yj().min(1),command:s.Yj().optional(),url:s.Yj().optional(),envKeys:s.YO(s.Yj()).optional(),location:s.Yj().optional()}),be=s.Ik({name:s.Yj().min(1),path:s.Yj().min(1),scope:ba,kind:s.Yj().min(1),detail:s.Yj().optional(),entryCount:s.ai().optional(),updatedAt:t.w$().optional()});s.Ik({scannedAt:t.w$(),skills:s.YO(bb),hooks:s.YO(bc),mcpServers:s.YO(bd),configFiles:s.YO(be),errors:s.YO(s.Ik({source:s.Yj(),reason:s.Yj()}))});let bf=s.Ik({ruleId:s.Yj().min(1),version:s.Yj().min(1),span:z,maskedMatch:s.Yj(),actionTaken:x,confidence:s.ai().min(0).max(1)});s.Ik({items:s.YO(W),scanEvent:Y,definitions:s.YO(Z).optional(),findings:s.YO(bf).optional()});let bg=s.Yj().regex(/^[a-z][a-z0-9-]*$/),bh=s.Yj().regex(/^[a-z][a-z0-9-]*$/),bi=s.Yj().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-.]+)?$/),bj=s.k5(["labs","user","org"]),bk=s.k5(["library"]).meta({id:"OriginEnum"}),bl=s.k5(["all","library","custom","customized","updates"]),bm=s.k5(["new","imported","update"]).meta({id:"LibraryStateEnum"}),bn=s.Ik({all:s.ai().int().nonnegative(),library:s.ai().int().nonnegative(),custom:s.ai().int().nonnegative(),customized:s.ai().int().nonnegative(),updates:s.ai().int().nonnegative()}).meta({id:"DetectionCounts"}),bo=s.Ik({id:s.Yj(),name:s.Yj(),version:bi,enabled:s.zM(),origin:bk,publisher:bg.optional(),publisherKind:bj.optional(),ruleCount:s.ai().int().nonnegative(),namespace:bg,packId:bh,policyId:s.Yj().optional(),latestVersion:bi.optional()}).meta({id:"DetectionListItem"});s.Ik({counts:bn,items:s.YO(bo)}).meta({id:"ListDetectionsResponse"}),s.Ik({filter:bl.optional().default("all"),q:s.Yj().optional()}),s.Ik({detections:s.ai().int().nonnegative(),rules:s.ai().int().nonnegative(),active:s.ai().int().nonnegative(),findingsLast30d:s.ai().int().nonnegative()}).meta({id:"DetectionStats"});let bp=s.Ik({id:s.Yj(),name:s.Yj(),category:v,severity:w,matcher:aO}).meta({id:"DetectionRule"}),bq=s.Ik({available:s.zM(),latestVersion:bi,latestRuleCount:s.ai().int().nonnegative().optional()}).nullable().meta({id:"DetectionUpdate"});s.Ik({id:s.Yj(),name:s.Yj(),version:bi,enabled:s.zM(),origin:bk,publisher:bg.optional(),publisherKind:bj.optional(),ruleCount:s.ai().int().nonnegative(),namespace:bg,packId:bh,description:s.Yj().optional(),editedAt:t.w$(),findingsLast30d:s.ai().int().nonnegative(),latestVersion:bi.nullable().optional(),update:bq,rules:s.YO(bp),modified:s.zM(),policyId:s.Yj().optional()}).meta({id:"DetectionDetail"});let br=s.Ik({id:s.Yj(),name:s.Yj(),publisher:bg,publisherKind:bj.optional(),category:v.optional(),version:bi,ruleCount:s.ai().int().nonnegative(),description:s.Yj().optional(),updatedAt:t.w$(),state:bm,importedAs:s.Yj().nullable()}).meta({id:"LibraryItem"});function bs(a){return{id:`${a.namespace}/${a.packId}`,name:a.name,version:a.version,enabled:a.enabled,origin:"library",namespace:a.namespace,packId:a.packId,ruleCount:a.ruleCount,...null!=a.policyId?{policyId:a.policyId}:{},...null!=a.latestVersion?{latestVersion:a.latestVersion}:{}}}function bt(a,b,c){let d=a.rules.flatMap(a=>{let b=aO.safeParse(a.matcher);return b.success?[{id:a.id,name:a.name,category:a.category,severity:a.severity,matcher:b.data}]:[]});return{id:`${a.namespace}/${a.packId}`,name:a.name,version:a.version,enabled:a.enabled,origin:"library",namespace:a.namespace,packId:a.packId,ruleCount:a.rules.length,editedAt:a.updatedAt.toISOString(),findingsLast30d:b,latestVersion:c?c.latestVersion:null,update:c,rules:d,modified:!1,...null!=a.policyId?{policyId:a.policyId}:{}}}function bu(a){let b=a.indexOf("/");return b<1||b===a.length-1?null:{namespace:a.slice(0,b),packId:a.slice(b+1)}}function bv(a,b){let c=a.filter(a=>null!=a.latestVersion),d={all:a.length,library:a.length,custom:0,customized:0,updates:c.length},e=b.filter,f="custom"===e||"customized"===e?[]:"updates"===e?[...c]:[...a];if(b.q){let a=b.q.toLowerCase();f=f.filter(b=>b.name.toLowerCase().includes(a)||b.packId.toLowerCase().includes(a)||b.namespace.toLowerCase().includes(a))}return f.sort((a,b)=>a.enabled!==b.enabled?a.enabled?-1:1:a.name.localeCompare(b.name)),{counts:d,items:f.map(bs)}}s.Ik({categories:s.YO(v),items:s.YO(br)}).meta({id:"ListLibraryResponse"}),s.Ik({libraryId:s.Yj().refine(a=>/^[^/]+\/[^/]+$/.test(a),{message:"libraryId must be in namespace/packId format"})}).meta({id:"ImportDetectionRequest"});let bw=s.k5(["provider","internal","external","ip"]).meta({id:"DestinationKind"}),bx=s.k5(["https","http","sftp","grpc","smtp","ws","wss"]).meta({id:"Transport"}),by=s.k5(["secrets","pii","customer","source","telemetry","logs","metrics","none"]).meta({id:"DataClass"}),bz=by.options,bA=s.k5(["recognized","internal","unverified","ip"]).meta({id:"ShareTrustLevel"}),bB=s.k5(["allow","block"]).meta({id:"EgressDecision"}),bC=s.k5(["allowed","blocked","review"]).meta({id:"EgressStatus"}),bD=s.k5(["raw_ip","unverified_domain","plaintext_transport"]).meta({id:"ReviewReason"}),bE=s.k5(["GET","POST","PUT","DELETE","SDK","REF"]).meta({id:"HttpMethod"}),bF=s.Ik({needsReview:s.zM(),reasons:s.YO(bD)}).meta({id:"ReviewInfo"}),bG=s.Ik({port:s.ai().int().nullable(),geo:s.Yj().nullable(),ptr:s.Yj().nullable()}).meta({id:"DestinationNetwork"}),bH=s.Ik({id:s.Yj(),method:bE,transport:bx,url:s.Yj(),template:s.zM(),dataClass:by,lastSeen:t.w$(),callSiteCount:s.ai().int().nonnegative()}).meta({id:"EndpointSummary"}),bI=s.Ik({id:s.Yj(),project:s.Yj(),file:s.Yj(),line:s.ai().int().nonnegative(),snippet:s.Yj(),dynamic:s.zM(),vendored:s.zM(),projectId:s.Yj().nullable()}).meta({id:"CallSite"}),bJ=bH.extend({sites:s.YO(bI)}).meta({id:"EndpointWithSites"}),bK=s.Ik({id:s.Yj(),kind:bw,name:s.Yj(),host:s.Yj(),category:s.Yj(),trust:bA,status:bC,isCustom:s.zM(),lastSeen:t.w$(),endpointCount:s.ai().int().nonnegative(),callSiteCount:s.ai().int().nonnegative(),transports:s.YO(bx),dataClasses:s.YO(by),review:bF,network:bG.nullable(),endpoints:s.YO(bH)}).meta({id:"ShareDestinationSummary"});bK.omit({endpointCount:!0,callSiteCount:!0,endpoints:!0}).extend({note:s.Yj().nullable(),endpoints:s.YO(bJ)}).meta({id:"ShareDestinationDetail"});let bL=s.Ik({id:s.Yj(),kind:bw,name:s.Yj(),host:s.Yj(),trust:bA,status:bC,review:bF,topDataClass:by,callSiteCount:s.ai().int().nonnegative(),lastSeen:t.w$()}).meta({id:"ReviewDestination"}),bM=s.Ik({kind:bw,total:s.ai().int().nonnegative(),items:s.YO(bK)}).meta({id:"ShareDestinationGroup"});s.Ik({groups:s.YO(bM)}).meta({id:"ListShareDestinationsResponse"}),s.Ik({items:s.YO(bL)}).meta({id:"NeedsReviewResponse"}),s.Ik({destinations:s.ai().int().nonnegative(),endpoints:s.ai().int().nonnegative(),callSites:s.ai().int().nonnegative(),needsReview:s.ai().int().nonnegative(),insecure:s.ai().int().nonnegative(),byKind:s.Ik({provider:s.ai().int().nonnegative(),internal:s.ai().int().nonnegative(),external:s.ai().int().nonnegative(),ip:s.ai().int().nonnegative()}),byTrust:s.Ik({recognized:s.ai().int().nonnegative(),internal:s.ai().int().nonnegative(),unverified:s.ai().int().nonnegative(),ip:s.ai().int().nonnegative()})}).meta({id:"SharesStats"}),s.Ik({decision:bB.nullable()}).meta({id:"SetEgressDecisionBody"}),s.Ik({destination:bK}).meta({id:"SetEgressDecisionResponse"}),s.Ik({q:s.Yj().optional(),kind:s.YO(bw).optional(),groupBy:s.k5(["destination"]).default("destination"),review:s.uE().default(!1)}),s.Ik({format:s.k5(["csv","json"]).default("csv"),q:s.Yj().optional(),kind:s.YO(bw).optional()});let bN=s.k5(["npm","pypi","go","maven","rubygems","cargo","composer","nuget"]).meta({id:"EgressEcosystem"});s.Ik({id:s.Yj(),name:s.Yj(),category:s.Yj(),hostSuffixes:s.YO(s.Yj()).min(1),apiBase:s.Yj(),defaultDataClasses:s.YO(by).min(1),sdks:s.jg(bN,s.YO(s.Yj()))}).meta({id:"ProviderRegistryEntry"});let bO=s.Ik({file:s.Yj(),line:s.ai().int().positive(),snippet:s.Yj(),dynamic:s.zM(),vendored:s.zM()}).meta({id:"EgressCallSiteHit"}),bP=s.Ik({host:s.Yj(),kind:bw,name:s.Yj(),category:s.Yj(),trust:bA,network:bG.nullable(),method:bE,transport:bx,url:s.Yj(),template:s.zM(),dataClass:by,site:bO}).meta({id:"ResolvedEgressHit"}),bQ=s.gM("mode",[s.Ik({mode:s.eu("walk"),walkedPrefix:s.Yj()}),s.Ik({mode:s.eu("ledger"),scannedFiles:s.YO(s.Yj()),deletedFiles:s.YO(s.Yj())})]).meta({id:"EgressReconcile"});function bR(a){return({log:"monitored",block:"blocked",redact:"redacted",warn:"warned",allow:"allowed"})[a]??"allowed"}function bS(a){return P[a]??"api"}s.Ik({projectKey:s.Yj().min(1),project:s.Yj(),projectId:s.Yj().nullable(),reconcile:bQ,hits:s.YO(bP)}).meta({id:"RecordProjectEgressInput"}),s.Ik({destinations:s.ai().int().nonnegative(),endpoints:s.ai().int().nonnegative(),callSites:s.ai().int().nonnegative(),truncated:s.zM(),droppedFiles:s.YO(s.Yj()).default([])}).meta({id:"EgressWriteSummary"});let bT=["open","handled","dismissed","resolved"];function bU(a){return"code_change"!==a.kind?"handled":null===a.findingKey?"open":"resolved"===a.latestResolutionStatus?"resolved":"dismissed"===a.latestResolutionStatus?"dismissed":"open"}function bV(a,b={}){let c=b.overrides,d=b.packNames,e=b.aggregates,f=new Map;for(let b of a){let a=f.get(b.ruleId);a?a.push(b):f.set(b.ruleId,[b])}let g=[];for(let[a,b]of f){var h;let f=b.map(a=>{let b=c?.get(a.id)??a.actionTaken;return{id:a.id,provider:bS(a.sourceTool),repo:a.repo,file:a.file,...void 0===a.toolName?{}:{toolName:a.toolName},action:bR(b),detectedAt:a.occurredAt,confidence:a.confidence,status:a.status}}),i=e?.get(a),j=i?.latestDetectedAt??b.reduce((a,b)=>b.occurredAt>a?b.occurredAt:a,b[0]?.occurredAt??new Date(0).toISOString()),k=new Set,l=(i?[...new Set(i.sourceTools.map(bS))].sort():f.map(a=>a.provider)).filter(a=>!k.has(a)&&(k.add(a),!0)),m=new Set(i?i.actionsTaken.map(bR):f.map(a=>a.action)),n=1===m.size?[...m][0]??null:null,o=b[0]?.severity??"low",p={id:a,name:d?.get(a)??null},q="code_context"===(h=b[0]?.category??"custom")?"source_code":h,r={id:`category:${q}`,name:q},s={maskedValue:b[0]?.maskedMatch??"",contextPrefix:""},t=function(a){let b=new Set(a.filter(a=>void 0!==a));if(0!==b.size){for(let a of bT)if(b.has(a))return a}}(i?i.statusInputs.map(bU):f.map(a=>a.status)),u={id:a,category:q,subtype:a,severity:o,match:s,detection:p,policy:r,instanceCount:i?.instanceCount??f.length,providers:l,aggregateAction:n,latestDetectedAt:j,instances:f,status:t};i&&(bY.set(u,[...m]),void 0!==i.searchText&&bW.set(u,bX(u,i.searchText))),g.push(u)}return g}let bW=new WeakMap;function bX(a,b){return[a.subtype,a.category,a.match.maskedValue,a.policy.name,a.id,...a.instances.map(a=>a.repo),...a.instances.map(a=>a.file),...a.instances.map(a=>a.toolName?`via ${a.toolName}`:""),...a.instances.map(a=>a.id),...void 0===b?[]:[b]].join(" ").toLowerCase()}let bY=new WeakMap;function bZ(a){let b=bY.get(a);if(void 0!==b)return b;let c=[...new Set(a.instances.map(a=>a.action))];return bY.set(a,c),c}function b$(a,b){let c=new Set(b),d=0;for(let b of a){if(void 0===b.count)return null;c.has(bU(b))&&(d+=b.count)}return d}function b_(a,b){let c=a;if(b.severity&&b.severity.length>0){let a=new Set(b.severity);c=c.filter(b=>a.has(b.severity))}if(b.providers&&b.providers.length>0){let a=new Set(b.providers);c=c.filter(b=>b.providers.some(b=>a.has(b)))}if(b.actions&&b.actions.length>0){let a=new Set(b.actions);c=c.filter(b=>bZ(b).some(b=>a.has(b)))}if(b.subtype&&b.subtype.length>0){let a=new Set(b.subtype);c=c.filter(b=>a.has(b.subtype))}if(b.statuses&&b.statuses.length>0){let a=new Set(b.statuses);c=c.filter(b=>void 0!==b.status&&a.has(b.status))}if(b.q){let a=b.q.toLowerCase();c=c.filter(b=>(function(a){let b=bW.get(a);if(void 0!==b)return b;let c=bX(a);return bW.set(a,c),c})(b).includes(a))}return c}let b0={critical:0,high:1,medium:2,low:3};function b1(a){return[...a].sort((a,b)=>{let c=(b0[a.severity]??-1)-(b0[b.severity]??-1);return 0!==c?c:b.latestDetectedAt.localeCompare(a.latestDetectedAt)})}function b2(a,b){let c=b_(a,{providers:b.providers,actions:b.actions,statuses:b.statuses,q:b.q,subtype:b.subtype}),d=new Map;for(let a of c)d.set(a.severity,(d.get(a.severity)??0)+1);let e=b_(a,{actions:b.actions,statuses:b.statuses,q:b.q,subtype:b.subtype,severity:b.severity}),f=new Map;for(let a of e)for(let b of a.providers)f.set(b,(f.get(b)??0)+1);let g=b_(a,{providers:b.providers,statuses:b.statuses,q:b.q,subtype:b.subtype,severity:b.severity}),h=new Map;for(let a of g)for(let b of bZ(a))h.set(b,(h.get(b)??0)+1);let i=b_(a,{providers:b.providers,actions:b.actions,statuses:b.statuses,q:b.q,severity:b.severity}),j=new Map;for(let a of i)j.set(a.subtype,(j.get(a.subtype)??0)+1);let k=b_(a,{providers:b.providers,actions:b.actions,q:b.q,subtype:b.subtype,severity:b.severity}),l=new Map;for(let a of k)void 0!==a.status&&l.set(a.status,(l.get(a.status)??0)+1);let m=a=>[...a.entries()].map(([a,b])=>({value:a,count:b}));return{severity:m(d),provider:m(f),action:m(h),subtype:m(j),status:m(l)}}let b3=s.Ik({id:s.Os(),namespace:bg,packId:bh,version:bi,name:s.Yj(),enabled:s.zM().default(!0),policyId:s.Yj().optional()}).meta({id:"InstalledPack"});s.Ik({namespace:bg,packId:bh,version:bi}).meta({id:"InstallPackRequest"}),s.Ik({items:s.YO(b3)}).meta({id:"ListInstalledPacksResponse"}),s.Ik({enabled:s.zM().optional(),policyId:s.Yj().nullable().optional()}).refine(a=>Object.keys(a).some(b=>void 0!==a[b]),{message:"At least one field must be provided"}).meta({id:"PatchInstalledPackRequest"});let b4=1,b5=s.k5(["standalone"]),b6=s.k5(["redact","warn"]),b7=s.k5(["full","session-only"]),b8=s.Ik({acknowledgedAt:t.w$(),payloadVersion:s.ai().int().positive()}),b9=s.Ik({specVersion:s.ai().int().positive().default(4),runMode:s.vk(a=>"attached"===a?"standalone":a,b5.default("standalone")),policy:b6.default("redact"),historicalAccess:b7.default("session-only"),dataSharesInPlace:s.zM().default(!0),onboardedAt:t.w$().optional(),modelJudgeConsent:b8.optional()});function ca(){return b9.parse({})}function cb(a,b,c){return{id:b,objectType:a.objectType,location:a.location??null,title:a.title??null,hostId:a.hostId??null,attributes:JSON.stringify(a.attributes),firstSeen:c,lastSeen:c}}function cc(a,b,c){return{id:b,url:a.url,name:a.name??null,attributes:JSON.stringify(a.attributes),firstSeen:c,lastSeen:c}}function cd(a){return{id:a.id,parentId:a.parentId??null,rootSessionId:a.rootSessionId??null,eventType:a.eventType,hostId:a.hostId??null,harnessId:a.harnessId??null,sourceProjectId:a.sourceProjectId??null,startedAt:g(a.startedAt),endedAt:a.endedAt?g(a.endedAt):null,severity:a.severity??null,priority:a.priority??null,content:a.content??null,contentHash:a.contentHash??null,attributes:a.attributes?JSON.stringify(a.attributes):null}}function ce(a,b){return{id:b,class:a.class,label:a.label??null,attributes:a.attributes?JSON.stringify(a.attributes):null}}function cf(a,b){return{id:b,ruleId:a.ruleId,name:a.name,category:a.category,severity:a.severity,definition:a.definition,version:a.version}}function cg(a){return{id:a.id,auditEventId:a.auditEventId,inspectionDefinitionId:a.inspectionDefinitionId,classifiedDataId:a.classifiedDataId??null,spanStart:a.span.start,spanEnd:a.span.end,maskedMatch:a.maskedMatch,actionTaken:a.actionTaken,confidence:a.confidence,findingKey:a.findingKey??null,firstDetectedAt:a.firstDetectedAt?g(a.firstDetectedAt):null}}function ch(a){let b=a.metadata;return{source_tool:a.sourceTool,...b?.repo!==void 0?{repo:b.repo}:{},...b?.filePath!==void 0?{file_path:b.filePath}:{},...b?.toolName!==void 0?{tool_name:b.toolName}:{},...b?.gitignored!==void 0?{gitignored:b.gitignored}:{},...b?.wholeFile!==void 0?{whole_file:b.wholeFile}:{},...b?.correlationId!==void 0?{correlation_id:b.correlationId}:{},...b?.traceId!==void 0?{trace_id:b.traceId}:{},...b?.exceptionIds!==void 0?{exception_ids:b.exceptionIds}:{},...b?.model!==void 0?{model:b.model}:{},...b?.turnIndex!==void 0?{turn_index:b.turnIndex}:{}}}function ci(a){return`capture/${a.category}/${a.severity}`}function cj(a){return{ruleId:a.ruleId,version:ci(a),name:a.ruleId,category:a.category,severity:a.severity,definition:JSON.stringify({ruleId:a.ruleId})}}let ck=s.Ik({path:s.Yj().min(1),name:s.Yj().min(1),origin:aq,defaultAccess:ap});s.Ik({files:s.YO(ck),truncated:s.zM(),scannedAt:s.Yj()});let cl=["7d","30d","3m","6m"],cm=s.k5(cl).meta({id:"TimeRange"}),cn={"7d":7,"30d":30,"3m":90,"6m":180};cm.catch("7d");let co=s.k5(["still-valid","unknown","invalid"]),cp=s.Ik({filePath:s.Yj(),span:z.optional()}).strict(),cq=s.Ik({provider:s.Yj(),maskedToken:s.Yj(),where:cp,state:co,observedAt:t.w$().optional()}).strict();s.Ik({provider:s.Yj(),maskedToken:s.Yj(),consolePath:s.Yj(),occurrenceSpread:s.ai().int().positive()}).strict();let cr=s.k5(["redact-rotation-checklist","redact-only","set-secret-redact","leave"]),cs=s.k5(["first-run","pre-push","secret-scan"]);s.Ik({entrySource:cs}).strict();let ct=s.Ik({id:cr,label:s.Yj()}),cu=s.Ik({kind:s.eu("decision"),entrySource:cs,secretCount:s.ai().int().positive(),prompt:s.Yj(),options:s.PV([ct.extend({id:s.eu("redact-rotation-checklist")}),ct.extend({id:s.eu("redact-only")}),ct.extend({id:s.eu("set-secret-redact")}),ct.extend({id:s.eu("leave")})])}),cv=s.Ik({kind:s.eu("no-decision")});s.gM("kind",[cu,cv]),s.Ik({rules:s.YO(aT).min(1).max(100),text:s.Yj().max(5e4).optional(),fixtures:s.YO(aS).max(200).optional()}).refine(a=>void 0!==a.text||(a.fixtures?.length??0)>0,{message:"Provide `text`, `fixtures`, or both — there must be something to test"}).meta({id:"TestRulesRequest"});let cw=s.Ik({ruleId:s.Yj(),category:v,severity:w,span:z,confidence:s.ai().min(0).max(1),match:s.Yj()}).meta({id:"RuleTestMatch"}),cx=s.Ik({label:s.Yj(),shouldMatch:s.zM(),didMatch:s.zM(),passed:s.zM(),matches:s.YO(cw)}).meta({id:"FixtureResult"});s.Ik({adhoc:s.Ik({matches:s.YO(cw)}).optional(),fixtures:s.YO(cx),summary:s.Ik({total:s.ai().int().nonnegative(),passed:s.ai().int().nonnegative(),failed:s.ai().int().nonnegative()}),unsupportedRuleIds:s.YO(s.Yj())}).meta({id:"TestRulesResponse"});let cy=s.Ik({severity:w,count:s.ai().int().nonnegative(),caught:s.ai().int().nonnegative().optional(),openAtRest:s.ai().int().nonnegative().optional()}).meta({id:"SeveritySummaryItem"});s.Ik({total:s.ai().int().nonnegative(),needsRemediation:s.ai().int().nonnegative().optional(),bySeverity:s.YO(cy)}).meta({id:"SeveritySummaryResponse"}),s.Ik({range:s.k5(cl).default("7d")});let cz=s.k5(["blocked","redacted","warned"]).meta({id:"EnforcementActionKind"}),cA=s.Ik({kind:cz,count:s.ai().int().nonnegative(),delta:s.ai().int()}).meta({id:"EnforcementAction"});s.Ik({range:cm,total:s.ai().int().nonnegative(),actions:s.YO(cA)}).meta({id:"EnforcementActionsResponse"});let cB=s.k5(["day","week"]).meta({id:"TimeseriesGranularity"}),cC=s.Ik({timestamp:t.p6(),critical:s.ai().int().nonnegative(),high:s.ai().int().nonnegative(),medium:s.ai().int().nonnegative()}).meta({id:"FindingsTimeseriesPoint"});s.Ik({range:cm,granularity:cB,points:s.YO(cC)}).meta({id:"FindingsTimeseriesResponse"});let cD=s.Ik({timestamp:t.p6(),bySeverity:s.Ik({critical:s.ai().nonnegative().nullable(),high:s.ai().nonnegative().nullable(),medium:s.ai().nonnegative().nullable(),low:s.ai().nonnegative().nullable()})}).meta({id:"MttrTrendPoint"});s.Ik({range:cm,granularity:cB,points:s.YO(cD)}).meta({id:"MttrTrendResponse"});let cE=s.Ik({findingKey:s.Yj(),ruleId:s.Yj(),severity:w,path:s.Yj(),resolvedAt:t.w$(),detectedAt:t.w$()}).meta({id:"ResolvedFeedItem"});s.Ik({items:s.YO(cE)}).meta({id:"RecentlyResolvedResponse"});let cF=["repo","user"],cG=s.k5(cF).meta({id:"SourceKind"}),cH=s.Ik({id:s.Yj(),name:s.Yj(),kind:cG,findingsCount:s.ai().int().nonnegative()}).meta({id:"TopSource"});s.Ik({range:cm,items:s.YO(cH)}).meta({id:"TopSourcesResponse"}),s.Ik({range:s.k5(cl).default("7d"),limit:u.ai().int().min(1).max(50).default(5),kind:s.k5(cF).optional()});let cI=s.k5(["claudecode","cursor","codex","chatgpt","copilot","api"]).meta({id:"Provider"}),cJ=s.Ik({provider:cI,coverage:s.ai().int().min(0).max(100),supported:s.zM()}).meta({id:"ScanCoverageProvider"});s.Ik({range:cm,providers:s.YO(cJ)}).meta({id:"ScanCoverageResponse"});let cK=s.k5(["repo","user","team","policy","share","rule"]).meta({id:"SubjectType"}),cL=s.Ik({type:cK,id:s.Yj(),label:s.Yj()}).meta({id:"RecommendationSubject"}),cM=s.k5(["apply","navigate"]).meta({id:"RecommendationActionMode"}),cN=s.Ik({mode:cM,type:s.Yj(),label:s.Yj(),href:s.Yj().optional(),policyId:s.Yj().optional(),teamId:s.Yj().optional()}).meta({id:"RecommendationAction"}),cO=s.Ik({id:s.Yj(),category:s.Yj(),severity:w,title:s.Yj(),description:s.Yj(),subjects:s.YO(cL),action:cN}).meta({id:"RecommendedAction"});s.Ik({items:s.YO(cO)}).meta({id:"RecommendedActionsResponse"}),s.Ik({limit:u.ai().int().min(1).max(20).default(3)});let cP=s.Ik({type:s.Yj(),policyId:s.Yj().optional(),teamId:s.Yj().optional()}).meta({id:"AppliedAction"});s.Ik({id:s.Yj(),status:s.eu("applied"),appliedAction:cP}).meta({id:"ApplyRecommendedActionResponse"}),s.Ik({id:s.Yj(),status:s.eu("dismissed")}).meta({id:"DismissRecommendedActionResponse"}),s.Ik({id:s.Yj()}),s.Ik({ruleId:s.Yj(),category:v,severity:w,maskedMatch:s.Yj(),rawMatch:s.Yj(),context:s.Yj(),filePath:s.Yj().optional(),confidence:s.ai().min(0).max(1),id:s.Yj().optional(),valueFingerprint:s.Yj().optional(),keyVersion:s.ai().int().nonnegative().optional()});let cQ=s.Ik({category:v,action:a1,reasoning:s.Yj(),genuineCount:s.ai().int().nonnegative(),fpCount:s.ai().int().nonnegative(),fpIds:s.YO(s.Yj())});s.Ik({perCategory:s.YO(cQ),notes:s.Yj()});let cR=s.Ik({total:s.ai().int().nonnegative(),important:s.ai().int().nonnegative(),routine:s.ai().int().nonnegative()}).refine(a=>a.total===a.important+a.routine,{message:"total must equal important + routine",path:["total"]}),cS=s.Ik({ruleId:s.Yj(),category:v,valueFingerprint:s.Yj(),keyVersion:s.ai().int().nonnegative()}),cT=s.Ik({pattern:s.Yj(),count:s.ai().int().nonnegative(),values:s.YO(cS).min(1)}),cU=s.Ik({category:v,count:s.ai().int().nonnegative(),egress:s.zM()}),cV=s.Ik({counts:cR,routineCategories:s.YO(v),surfacedCategories:s.YO(v),findingKinds:s.YO(cU),posture:s.g1(v,a1),maskedFindings:s.YO(cq).optional(),falsePositivePatterns:s.YO(cT).optional()}),cW=cQ.pick({category:!0,genuineCount:!0,fpCount:!0}).extend({egress:s.zM()});s.Ik({categories:s.YO(cW),posture:s.g1(v,a1)}),s.Ik({frame:cV,copy:s.Yj()}),s.k5(["scan","floor"]);let cX=s.Ik({id:s.k5(["enter-remediation","open-dashboard","not-now"]),label:s.Yj()}),cY=s.PV([cX.extend({id:s.eu("open-dashboard")}),cX.extend({id:s.eu("not-now")})]),cZ=s.PV([cX.extend({id:s.eu("enter-remediation")}),cX.extend({id:s.eu("open-dashboard")}),cX.extend({id:s.eu("not-now")})]);s.Ik({worthALook:s.ai().int().nonnegative(),liveKeys:s.ai().int().nonnegative().optional(),options:s.KC([cY,cZ])}).refine(a=>a.options.some(a=>"enter-remediation"===a.id)===(a.liveKeys??0)>0,{message:"the chain-entry option is present exactly when liveKeys > 0",path:["options"]}).refine(a=>(a.liveKeys??0)<=a.worthALook,{message:"liveKeys is a subset of worthALook and cannot exceed it",path:["liveKeys"]});let c$=new Set(["recognized","internal"]);function c_(a){return c$.has(a)?"allowed":"review"}function c0(a){return"block"===a?"blocked":"allowed"}function c1(a,b){return null===b?c_(a):c0(b)}function c2(a,b){return null!==b&&c0(b)!==c_(a)}function c3(a,b){let c=function(a,b){let c=[];return"ip"===a&&c.push("raw_ip"),"unverified"===a&&c.push("unverified_domain"),(b.includes("http")||b.includes("ws"))&&c.push("plaintext_transport"),c}(a,b);return{needsReview:c.length>0,reasons:c}}function c4(a){return Array.from(new Set(a))}function c5(a){let b=new Set(a);return bz.filter(a=>b.has(a))}function c6(a){return c5(a)[0]??"none"}let c7={raw_ip:0,unverified_domain:1,plaintext_transport:2};function c8(a){return 0===a.length?1/0:Math.min(...a.map(a=>c7[a]))}}};
+      )`),a.exec("DELETE FROM app_meta WHERE key LIKE 'sample_seeded:%'")})}catch{}}(b)},transaction:async function a(a){b.exec("BEGIN");try{let c=await a();return b.exec("COMMIT"),c}catch(a){try{b.exec("ROLLBACK")}catch{}throw a}},close:()=>{b.close()}}}function bc(a){let b=a.filePath.replaceAll("\\","/");return(0,d.createHash)("sha256").update(`${a.ruleId}\0${b}\0${a.valueFingerprint}`).digest("hex")}function bd(a){return(0,f.join)(a,"exception.key")}let be=["exceptions","blocked_detections"];class bf extends Error{constructor(a){super(`cannot read the stored fingerprint key versions: ${a instanceof Error?a.message:String(a)}`,{cause:a}),this.code="floor-unreadable",this.name="FloorUnreadableError"}}function bg(a){let b,c=(0,f.join)(a,C);if(!(0,e.existsSync)(c))return 0;try{(b=new g.DatabaseSync(c,{readOnly:!0})).exec(`PRAGMA busy_timeout = ${String(250)}`);let a=0;for(let c of be)try{let d=w(b.prepare(`SELECT MAX(key_version) AS v FROM ${c}`));a=Math.max(a,d?.v??0)}catch(a){if(1!==a.errcode)throw new bf(a)}return a}catch(a){throw a instanceof bf?a:new bf(a)}finally{b?.close()}}function bh(a,b){E(a);let c=bd(a),d=JSON.stringify({version:b.version,material:b.material.toString("base64")});return H(c,`${d}
+`),b}function bi(a){let b;try{b=(0,e.readFileSync)(bd(a),"utf8")}catch(a){if("ENOENT"===a.code)return null;throw a instanceof Error?a:Error(String(a))}let c=JSON.parse(b);if("object"!=typeof c||null===c)throw Error("exception key file is corrupt: not a JSON object");let{version:d,material:f}=c;if("number"!=typeof d||!Number.isInteger(d)||d<1)throw Error("exception key file is corrupt: bad version");if("string"!=typeof f)throw Error("exception key file is corrupt: bad material");let g=Buffer.from(f,"base64");if(32!==g.length)throw Error("exception key file is corrupt: bad material length");return{version:d,material:g}}function bj(a){let b=bi(a);return b?(G(bd(a)),b):bh(a,{version:bg(a)+1,material:(0,d.randomBytes)(32)})}function bk(a){let b=bi(a);return bh(a,{version:Math.max(b?.version??0,bg(a))+1,material:(0,d.randomBytes)(32)})}function bl(a,b){return(0,d.createHmac)("sha256",a.material).update(b,"utf8").digest("hex")}function bm(a,b){var c;return(0,h.qEQ)(b,null===(c=a)?{status:"absent"}:{status:"present",version:c.version})}c(51455);var bn=c(70542);function bo(){return(0,f.join)((0,bn.homedir)(),".aka")}function bp(a=bo()){return(0,f.join)(a,"settings")}function bq(a=bo()){return(0,f.join)(a,"data")}function br(a=bo()){let b=function(a){let b;try{b=(0,e.readFileSync)(a,"utf8")}catch{return null}return O(b)??null}((0,f.join)(bp(a),"settings.json"));if(!b)return(0,h.i1j)();try{return h.hd_.parse(b)}catch{return(0,h.i1j)()}}function bs(a,b=bo()){let c=bp(b),d=br(b),e=h.hd_.parse({...d,...a,onboardedAt:a.onboardedAt??d.onboardedAt??new Date().toISOString()});return E(c),H((0,f.join)(c,"settings.json"),`${JSON.stringify(e,null,2)}
+`),e}},45615:(a,b,c)=>{c.d(b,{S8C:()=>y,hxQ:()=>ap,Itg:()=>ad,RRF:()=>a3,ZpU:()=>a6,HUb:()=>a2,hfB:()=>aj,unw:()=>a5,goN:()=>N,Jr:()=>a7,V8B:()=>aJ,IgC:()=>a$,aIg:()=>bC,iRC:()=>aK,GCf:()=>E,TUN:()=>O,SHn:()=>av,rov:()=>b8,V0H:()=>a1,kxf:()=>b5,PEm:()=>aY,eI7:()=>co,cqq:()=>F,jON:()=>aU,lFU:()=>d,PhW:()=>ab,uQz:()=>b7,BIx:()=>ar,hd_:()=>ca,tXp:()=>b0,plk:()=>bw,mAj:()=>bW,Fnc:()=>c4,ryv:()=>r,tTV:()=>aa,qmP:()=>cj,rG:()=>b3,Bfj:()=>b_,q_t:()=>p,i1j:()=>cb,xog:()=>bV,hzO:()=>c6,by7:()=>c5,Gw9:()=>c2,q11:()=>h,U7X:()=>w,y_0:()=>c3,qEQ:()=>aL,I8t:()=>g,DhA:()=>a8,WSs:()=>c9,a45:()=>bu,N6N:()=>f,A6E:()=>b2,pnU:()=>bv,V9M:()=>ce,$w9:()=>ci,jTf:()=>ck,$BP:()=>cf,JAl:()=>cg,$3l:()=>ch,gzP:()=>cc,QCA:()=>cd,C05:()=>c7});let d=[{tag:"0000_acoustic_felicia_hardy",sql:"CREATE TABLE `audit_events` (\n	`id` text PRIMARY KEY NOT NULL,\n	`parent_id` text,\n	`root_session_id` text,\n	`event_type` text NOT NULL,\n	`host_id` text,\n	`harness_id` text,\n	`source_project_id` text,\n	`started_at` integer NOT NULL,\n	`ended_at` integer,\n	`severity` text,\n	`priority` text,\n	`content` text,\n	`content_hash` text,\n	`attributes` text,\n	FOREIGN KEY (`parent_id`) REFERENCES `audit_events`(`id`) ON UPDATE no action ON DELETE no action,\n	FOREIGN KEY (`root_session_id`) REFERENCES `audit_events`(`id`) ON UPDATE no action ON DELETE no action,\n	FOREIGN KEY (`host_id`) REFERENCES `inventory`(`id`) ON UPDATE no action ON DELETE no action,\n	FOREIGN KEY (`harness_id`) REFERENCES `inventory`(`id`) ON UPDATE no action ON DELETE no action,\n	FOREIGN KEY (`source_project_id`) REFERENCES `source_project`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_audit_parent` ON `audit_events` (`parent_id`);--\x3e statement-breakpoint\nCREATE INDEX `idx_audit_session` ON `audit_events` (`root_session_id`,`started_at`);--\x3e statement-breakpoint\nCREATE INDEX `idx_audit_harness_t` ON `audit_events` (`harness_id`,`started_at`);--\x3e statement-breakpoint\nCREATE INDEX `idx_audit_project_t` ON `audit_events` (`source_project_id`,`started_at`);--\x3e statement-breakpoint\nCREATE TABLE `classified_data` (\n	`id` text PRIMARY KEY NOT NULL,\n	`class` text NOT NULL,\n	`label` text,\n	`attributes` text\n);\n--\x3e statement-breakpoint\nCREATE TABLE `events` (\n	`id` text PRIMARY KEY NOT NULL,\n	`source_tool` text NOT NULL,\n	`kind` text NOT NULL,\n	`occurred_at` integer NOT NULL,\n	`content_hash` text NOT NULL,\n	`content` text NOT NULL,\n	`metadata` text\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_events_occurred` ON `events` (`occurred_at`);--\x3e statement-breakpoint\nCREATE TABLE `findings` (\n	`id` text PRIMARY KEY NOT NULL,\n	`event_id` text NOT NULL,\n	`rule_id` text NOT NULL,\n	`category` text NOT NULL,\n	`severity` text NOT NULL,\n	`span_start` integer NOT NULL,\n	`span_end` integer NOT NULL,\n	`masked_match` text NOT NULL,\n	`action_taken` text NOT NULL,\n	`confidence` real NOT NULL,\n	FOREIGN KEY (`event_id`) REFERENCES `events`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_findings_event` ON `findings` (`event_id`);--\x3e statement-breakpoint\nCREATE TABLE `inspection_definitions` (\n	`id` text PRIMARY KEY NOT NULL,\n	`rule_id` text NOT NULL,\n	`name` text NOT NULL,\n	`category` text NOT NULL,\n	`severity` text NOT NULL,\n	`definition` text NOT NULL,\n	`version` text NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE TABLE `inspection_findings` (\n	`id` text PRIMARY KEY NOT NULL,\n	`audit_event_id` text NOT NULL,\n	`inspection_definition_id` text NOT NULL,\n	`classified_data_id` text,\n	`span_start` integer NOT NULL,\n	`span_end` integer NOT NULL,\n	`masked_match` text NOT NULL,\n	`action_taken` text NOT NULL,\n	`confidence` real NOT NULL,\n	FOREIGN KEY (`audit_event_id`) REFERENCES `audit_events`(`id`) ON UPDATE no action ON DELETE no action,\n	FOREIGN KEY (`inspection_definition_id`) REFERENCES `inspection_definitions`(`id`) ON UPDATE no action ON DELETE no action,\n	FOREIGN KEY (`classified_data_id`) REFERENCES `classified_data`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_inspection_findings_event` ON `inspection_findings` (`audit_event_id`);--\x3e statement-breakpoint\nCREATE TABLE `installed_packs` (\n	`id` text PRIMARY KEY NOT NULL,\n	`namespace` text NOT NULL,\n	`pack_id` text NOT NULL,\n	`version` text NOT NULL,\n	`name` text NOT NULL,\n	`rules_json` text NOT NULL,\n	`enabled` integer DEFAULT true NOT NULL,\n	`policy_id` text,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_installed_packs_pack` ON `installed_packs` (`namespace`,`pack_id`);--\x3e statement-breakpoint\nCREATE TABLE `inventory` (\n	`id` text PRIMARY KEY NOT NULL,\n	`object_type` text NOT NULL,\n	`location` text,\n	`title` text,\n	`host_id` text,\n	`attributes` text NOT NULL,\n	`os_version` text GENERATED ALWAYS AS (json_extract(attributes, '$.os_version')) VIRTUAL,\n	`harness_version` text GENERATED ALWAYS AS (json_extract(attributes, '$.harness_version')) VIRTUAL,\n	`first_seen` integer NOT NULL,\n	`last_seen` integer NOT NULL,\n	FOREIGN KEY (`host_id`) REFERENCES `inventory`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_inventory_type` ON `inventory` (`object_type`);--\x3e statement-breakpoint\nCREATE INDEX `idx_inventory_type_osver` ON `inventory` (`object_type`,`os_version`);--\x3e statement-breakpoint\nCREATE INDEX `idx_inventory_type_harnessver` ON `inventory` (`object_type`,`harness_version`);--\x3e statement-breakpoint\nCREATE TABLE `policies` (\n	`id` text PRIMARY KEY NOT NULL,\n	`scope` text DEFAULT 'global' NOT NULL,\n	`target` text NOT NULL,\n	`action` text NOT NULL,\n	`enabled` integer DEFAULT true NOT NULL,\n	`custom_keywords` text,\n	`name` text,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_policies_scope_target` ON `policies` (`scope`,`target`);--\x3e statement-breakpoint\nCREATE TABLE `source_project` (\n	`id` text PRIMARY KEY NOT NULL,\n	`url` text,\n	`name` text,\n	`attributes` text NOT NULL,\n	`first_seen` integer NOT NULL,\n	`last_seen` integer NOT NULL\n);\n"},{tag:"0001_adorable_marten_broadcloak",sql:"ALTER TABLE `audit_events` ADD `input_tokens` integer GENERATED ALWAYS AS (json_extract(attributes, '$.input_tokens')) VIRTUAL;--\x3e statement-breakpoint\nALTER TABLE `audit_events` ADD `output_tokens` integer GENERATED ALWAYS AS (json_extract(attributes, '$.output_tokens')) VIRTUAL;--\x3e statement-breakpoint\nALTER TABLE `audit_events` ADD `cache_creation_input_tokens` integer GENERATED ALWAYS AS (json_extract(attributes, '$.cache_creation_input_tokens')) VIRTUAL;--\x3e statement-breakpoint\nALTER TABLE `audit_events` ADD `cache_read_input_tokens` integer GENERATED ALWAYS AS (json_extract(attributes, '$.cache_read_input_tokens')) VIRTUAL;--\x3e statement-breakpoint\nALTER TABLE `audit_events` ADD `model` text GENERATED ALWAYS AS (json_extract(attributes, '$.model')) VIRTUAL;--\x3e statement-breakpoint\nALTER TABLE `audit_events` ADD `provider` text GENERATED ALWAYS AS (json_extract(attributes, '$.provider')) VIRTUAL;--\x3e statement-breakpoint\nCREATE INDEX `idx_audit_session_type` ON `audit_events` (`root_session_id`,`started_at`) WHERE event_type = 'llm_call';"},{tag:"0002_groovy_big_bertha",sql:"CREATE TABLE `exceptions` (\n	`id` text PRIMARY KEY NOT NULL,\n	`rule_id` text NOT NULL,\n	`category` text NOT NULL,\n	`value_fingerprint` text NOT NULL,\n	`key_version` integer NOT NULL,\n	`masked_value` text NOT NULL,\n	`scope` text NOT NULL,\n	`expires_at` integer,\n	`max_uses` integer,\n	`use_count` integer DEFAULT 0 NOT NULL,\n	`last_used_at` integer,\n	`justification` text NOT NULL,\n	`conditions` text,\n	`created_by` text NOT NULL,\n	`created_via` text NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL,\n	`revoked_at` integer,\n	`revoked_by` text,\n	`revoke_reason` text\n);\n--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_exceptions_active` ON `exceptions` (`rule_id`,`value_fingerprint`,`key_version`) WHERE revoked_at IS NULL;"},{tag:"0003_rich_sage",sql:"CREATE TABLE `egress_decision_override` (\n	`id` text PRIMARY KEY NOT NULL,\n	`destination_id` text NOT NULL,\n	`decision` text NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL,\n	FOREIGN KEY (`destination_id`) REFERENCES `share_destination`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_egress_decision_override` ON `egress_decision_override` (`destination_id`);--\x3e statement-breakpoint\nCREATE TABLE `file_access_override` (\n	`id` text PRIMARY KEY NOT NULL,\n	`project_id` text NOT NULL,\n	`path` text NOT NULL,\n	`access` text NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL,\n	FOREIGN KEY (`project_id`) REFERENCES `source_project`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_file_access_override_project` ON `file_access_override` (`project_id`);--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_file_access_override` ON `file_access_override` (`project_id`,`path`);--\x3e statement-breakpoint\nCREATE TABLE `harness_asset` (\n	`id` text PRIMARY KEY NOT NULL,\n	`harness_id` text NOT NULL,\n	`asset_id` text NOT NULL,\n	`created_at` integer NOT NULL,\n	FOREIGN KEY (`harness_id`) REFERENCES `inventory`(`id`) ON UPDATE no action ON DELETE no action,\n	FOREIGN KEY (`asset_id`) REFERENCES `inventory_asset`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_harness_asset_harness` ON `harness_asset` (`harness_id`);--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_harness_asset` ON `harness_asset` (`harness_id`,`asset_id`);--\x3e statement-breakpoint\nCREATE TABLE `inventory_asset` (\n	`id` text PRIMARY KEY NOT NULL,\n	`asset_type` text NOT NULL,\n	`name` text NOT NULL,\n	`sub` text,\n	`description` text,\n	`flags_json` text DEFAULT '[]' NOT NULL,\n	`meta_json` text DEFAULT '{}' NOT NULL,\n	`trust` text,\n	`tools_json` text,\n	`provenance` text DEFAULT 'scan' NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_inventory_asset_type` ON `inventory_asset` (`asset_type`);--\x3e statement-breakpoint\nCREATE TABLE `mcp_trust_override` (\n	`id` text PRIMARY KEY NOT NULL,\n	`asset_id` text NOT NULL,\n	`trust` text NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL,\n	FOREIGN KEY (`asset_id`) REFERENCES `inventory_asset`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_mcp_trust_override` ON `mcp_trust_override` (`asset_id`);--\x3e statement-breakpoint\nCREATE TABLE `project_file` (\n	`id` text PRIMARY KEY NOT NULL,\n	`project_id` text NOT NULL,\n	`path` text NOT NULL,\n	`name` text NOT NULL,\n	`origin` text NOT NULL,\n	`default_access` text NOT NULL,\n	`findings_count` integer DEFAULT 0 NOT NULL,\n	`blocked_at` integer,\n	`note` text,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL,\n	FOREIGN KEY (`project_id`) REFERENCES `source_project`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_project_file_project` ON `project_file` (`project_id`);--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_project_file` ON `project_file` (`project_id`,`path`);--\x3e statement-breakpoint\nCREATE TABLE `share_call_site` (\n	`id` text PRIMARY KEY NOT NULL,\n	`endpoint_id` text NOT NULL,\n	`project` text NOT NULL,\n	`file` text NOT NULL,\n	`line` integer NOT NULL,\n	`snippet` text NOT NULL,\n	`dynamic` integer DEFAULT false NOT NULL,\n	`vendored` integer DEFAULT false NOT NULL,\n	`project_id` text,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL,\n	FOREIGN KEY (`endpoint_id`) REFERENCES `share_endpoint`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_share_call_site_endpoint` ON `share_call_site` (`endpoint_id`);--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_share_call_site` ON `share_call_site` (`endpoint_id`,`project`,`file`,`line`);--\x3e statement-breakpoint\nCREATE TABLE `share_destination` (\n	`id` text PRIMARY KEY NOT NULL,\n	`kind` text NOT NULL,\n	`name` text NOT NULL,\n	`host` text NOT NULL,\n	`category` text NOT NULL,\n	`trust` text NOT NULL,\n	`note` text,\n	`network_json` text,\n	`last_seen` integer NOT NULL,\n	`provenance` text DEFAULT 'scan' NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_share_destination_kind` ON `share_destination` (`kind`);--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_share_destination_host` ON `share_destination` (`host`);--\x3e statement-breakpoint\nCREATE TABLE `share_endpoint` (\n	`id` text PRIMARY KEY NOT NULL,\n	`destination_id` text NOT NULL,\n	`method` text NOT NULL,\n	`transport` text NOT NULL,\n	`url` text NOT NULL,\n	`template` integer DEFAULT false NOT NULL,\n	`data_class` text NOT NULL,\n	`last_seen` integer NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL,\n	FOREIGN KEY (`destination_id`) REFERENCES `share_destination`(`id`) ON UPDATE no action ON DELETE no action\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_share_endpoint_dest` ON `share_endpoint` (`destination_id`);--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_share_endpoint` ON `share_endpoint` (`destination_id`,`method`,`url`);"},{tag:"0004_glorious_mindworm",sql:"CREATE TABLE `available_packs` (\n	`id` text PRIMARY KEY NOT NULL,\n	`namespace` text NOT NULL,\n	`pack_id` text NOT NULL,\n	`version` text NOT NULL,\n	`name` text NOT NULL,\n	`rules_json` text NOT NULL,\n	`updated_at` integer NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_available_packs_pack` ON `available_packs` (`namespace`,`pack_id`);"},{tag:"0005_fast_vindicator",sql:'PRAGMA foreign_keys=OFF;--\x3e statement-breakpoint\nCREATE TABLE `__new_mcp_trust_override` (\n	`id` text PRIMARY KEY NOT NULL,\n	`asset_id` text NOT NULL,\n	`trust` text NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL\n);\n--\x3e statement-breakpoint\nINSERT INTO `__new_mcp_trust_override`("id", "asset_id", "trust", "created_at", "updated_at") SELECT "id", "asset_id", "trust", "created_at", "updated_at" FROM `mcp_trust_override`;--\x3e statement-breakpoint\nDROP TABLE `mcp_trust_override`;--\x3e statement-breakpoint\nALTER TABLE `__new_mcp_trust_override` RENAME TO `mcp_trust_override`;--\x3e statement-breakpoint\nPRAGMA foreign_keys=ON;--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_mcp_trust_override` ON `mcp_trust_override` (`asset_id`);'},{tag:"0006_magenta_flatman",sql:'CREATE TABLE `_pack_write_gate` (\n	`id` integer PRIMARY KEY NOT NULL,\n	`open` integer DEFAULT 0 NOT NULL,\n	CONSTRAINT "ck_pack_write_gate_single_row" CHECK("_pack_write_gate"."id" = 1)\n);\n--\x3e statement-breakpoint\nALTER TABLE `available_packs` ADD `recorded_by` text;--\x3e statement-breakpoint\nINSERT OR IGNORE INTO _pack_write_gate (id, open) VALUES (1, 0);\n--\x3e statement-breakpoint\nCREATE TRIGGER trg_installed_packs_write_gate\nBEFORE UPDATE OF version, name, rules_json ON installed_packs\nWHEN (SELECT open FROM _pack_write_gate WHERE id = 1) IS NOT 1\nBEGIN SELECT RAISE(IGNORE); END;'},{tag:"0007_thick_stick",sql:"CREATE TABLE `finding_resolution` (\n	`id` text PRIMARY KEY NOT NULL,\n	`finding_key` text NOT NULL,\n	`status` text NOT NULL,\n	`method` text NOT NULL,\n	`resolved_at` integer NOT NULL,\n	`evidence` text,\n	`created_at` integer NOT NULL\n);\n--\x3e statement-breakpoint\nCREATE INDEX `idx_finding_resolution_key` ON `finding_resolution` (`finding_key`);--\x3e statement-breakpoint\nALTER TABLE `findings` ADD `finding_key` text;--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_findings_key` ON `findings` (`finding_key`);"},{tag:"0008_freezing_selene",sql:"ALTER TABLE `findings` ADD `first_detected_at` integer;--\x3e statement-breakpoint\nUPDATE `findings` SET `first_detected_at` = (SELECT `occurred_at` FROM `events` WHERE `events`.`id` = `findings`.`event_id`) WHERE `first_detected_at` IS NULL;"},{tag:"0009_findings_path_expression_index",sql:"-- Custom migration: partial expression index for the resolver's per-path reads.\n--\n-- openAtRestKeysForPath / resolvedAtRestKeysForPath (and the scanner's tier-3\n-- open-key probe) filter at-rest events by\n--   e.kind = 'code_change' AND json_extract(e.metadata, '$.filePath') = :path\n-- once per changed/deleted file on every scan — previously a full events scan\n-- per file. json_extract is deterministic, so SQLite allows it in an index;\n-- the WHERE kind = 'code_change' keeps the index to exactly the rows those\n-- queries can match (in-flight events are never path-addressed).\nCREATE INDEX `idx_events_code_change_path` ON `events` (json_extract(`metadata`, '$.filePath')) WHERE `kind` = 'code_change';\n"},{tag:"0010_events_session_expression_index",sql:"-- Custom migration: partial expression index for session-scoped finding reads.\n--\n-- sessionFindingsCount, the session-scoped listGroupedFindings paths, and the\n-- insert-time session dedup all filter live-capture events by\n--   json_extract(e.metadata, '$.sessionId') = :sessionId\n-- — previously a full findings-join scan with a JSON parse per row. The\n-- IS NOT NULL predicate keeps the index to session-stamped events only (an\n-- equality probe implies non-null, so SQLite still uses it).\nCREATE INDEX `idx_events_session_id` ON `events` (json_extract(`metadata`, '$.sessionId')) WHERE json_extract(`metadata`, '$.sessionId') IS NOT NULL;\n"},{tag:"0011_egress_writer",sql:'-- Stable per-project reconcile key for egress call sites, plus a host-keyed\n-- egress decision override that survives destination pruning.\n--\n-- DROP INDEX IF EXISTS, not a bare DROP: the applier replays a pending\n-- migration\'s non-index statements verbatim, so a store that lost\n-- uq_share_call_site out of band would throw here — and on the plugin hook path\n-- that throw is swallowed fail-open, silently stopping capture.\n--\n-- Existing rows carry the old key\'s discriminator into project_key\n-- (\'legacy:\' || project), so the new unique index is a re-encoding of the old\n-- one and cannot collide on rows the old one allowed. Leaving them on the\n-- column default would collapse two projects\' identical file/line hits onto\n-- one key and abort the whole migration. Writer keys are \'git:\'/\'path:\'-\n-- prefixed, so a backfilled row never collides with a captured one either.\n--\n-- egress_decision_override.destination_id becomes nullable with ON DELETE SET\n-- NULL, which SQLite can only do by rebuilding the table. `host` is ADDed\n-- before the rebuild so the copy has a column to read and so the migration\n-- still presents two probeable columns to the applier\'s evidence check.\nALTER TABLE `share_call_site` ADD `project_key` text DEFAULT \'\' NOT NULL;--\x3e statement-breakpoint\nUPDATE `share_call_site` SET `project_key` = \'legacy:\' || `project`;--\x3e statement-breakpoint\nDROP INDEX IF EXISTS `uq_share_call_site`;--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_share_call_site` ON `share_call_site` (`endpoint_id`,`project_key`,`file`,`line`);--\x3e statement-breakpoint\nCREATE INDEX `idx_share_call_site_project` ON `share_call_site` (`project_key`,`endpoint_id`);--\x3e statement-breakpoint\nALTER TABLE `egress_decision_override` ADD `host` text;--\x3e statement-breakpoint\nPRAGMA foreign_keys=OFF;--\x3e statement-breakpoint\nCREATE TABLE `__new_egress_decision_override` (\n	`id` text PRIMARY KEY NOT NULL,\n	`destination_id` text,\n	`host` text,\n	`decision` text NOT NULL,\n	`created_at` integer NOT NULL,\n	`updated_at` integer NOT NULL,\n	FOREIGN KEY (`destination_id`) REFERENCES `share_destination`(`id`) ON UPDATE no action ON DELETE set null\n);\n--\x3e statement-breakpoint\nINSERT INTO `__new_egress_decision_override`("id", "destination_id", "host", "decision", "created_at", "updated_at") SELECT "id", "destination_id", "host", "decision", "created_at", "updated_at" FROM `egress_decision_override`;--\x3e statement-breakpoint\nDROP TABLE `egress_decision_override`;--\x3e statement-breakpoint\nALTER TABLE `__new_egress_decision_override` RENAME TO `egress_decision_override`;--\x3e statement-breakpoint\nPRAGMA foreign_keys=ON;--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_egress_decision_override` ON `egress_decision_override` (`destination_id`);--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_egress_decision_override_host` ON `egress_decision_override` (`host`) WHERE `host` IS NOT NULL;\n'},{tag:"0012_handy_the_captain",sql:"ALTER TABLE `inspection_findings` ADD `finding_key` text;--\x3e statement-breakpoint\nALTER TABLE `inspection_findings` ADD `first_detected_at` integer;--\x3e statement-breakpoint\nCREATE UNIQUE INDEX `uq_inspection_findings_key` ON `inspection_findings` (`finding_key`);"},{tag:"0013_legacy_history_backfill_support",sql:"-- Legacy-to-generalized backfill support: the schema the resumable\n-- events/findings -> audit_events/inspection_findings copy needs (the row\n-- copy itself runs as a batched post-migration installer, not here — see\n-- @akasecurity/persistence's migrations.ts), plus the audit_events read-path\n-- indexes replacing the ones the legacy events table carried (0009/0010).\n\n-- Tracks how far the batched, resumable copy has advanced through each legacy\n-- table, by rowid, so a copy interrupted mid-run resumes instead of\n-- restarting, and a completed copy is a cheap no-op on every later open.\nCREATE TABLE `legacy_copy_watermark` (\n	`source` text PRIMARY KEY NOT NULL,\n	`last_rowid` integer DEFAULT 0 NOT NULL\n);\n--\x3e statement-breakpoint\n-- Serves the time-range read family that scans a single event_type across a\n-- start/end window (e.g. the Activity timeline) without a full-table scan.\nCREATE INDEX `idx_audit_type_t` ON `audit_events` (`event_type`,`started_at`);\n--\x3e statement-breakpoint\n-- Partial expression index mirroring `idx_events_code_change_path` (0009) for\n-- the generalized audit_events/attributes pair: file-path reads filter\n-- `event_type = 'code_change' AND json_extract(attributes, '$.file_path') = :path`.\nCREATE INDEX `idx_audit_code_change_path` ON `audit_events` (json_extract(`attributes`, '$.file_path')) WHERE `event_type` = 'code_change';\n--\x3e statement-breakpoint\n-- Synthesizes a stub session root (event_type = 'session', no attributes) for\n-- every legacy `events.metadata.sessionId` that has no audit_events row yet.\n-- audit_events.root_session_id is a self-FK, enforced with foreign-key\n-- checking on, and INSERT OR IGNORE does not suppress a foreign-key violation\n-- (only UNIQUE/PK/NOT NULL/CHECK) — so this must run before the events copy\n-- resolves root_session_id, or every session-scoped row's insert fails.\n-- started_at takes the earliest legacy occurred_at recorded under that\n-- session, so the stub root's own timeline position is never later than\n-- anything it will end up parenting.\nINSERT INTO audit_events (id, event_type, root_session_id, started_at)\nSELECT\n	json_extract(metadata, '$.sessionId'),\n	'session',\n	NULL,\n	min(occurred_at)\nFROM events\nWHERE json_valid(metadata)\n	AND json_extract(metadata, '$.sessionId') IS NOT NULL\n	AND json_extract(metadata, '$.sessionId') NOT IN (SELECT id FROM audit_events)\nGROUP BY json_extract(metadata, '$.sessionId');\n"},{tag:"0014_drop_legacy_events_findings",sql:"-- Custom migration: drops the frozen legacy `events`/`findings` tables\n-- (superseded by audit_events/inspection_definitions/inspection_findings) and\n-- replaces them with read-only views of the same name.\n--\n-- persistence's migrations.ts applies this migration ONLY once the batched\n-- history backfill (see runLegacyHistoryBackfill) has fully drained both\n-- tables, and only after copying the live file aside — see\n-- backupBeforeLegacyDrop in packages/persistence/src/migrations.ts. A store\n-- still mid-copy keeps its real tables and this migration stays pending.\n--\n-- The views exist for skew: the `aka` CLI and the Claude Code plugin update\n-- independently against one shared store, so an older, already-installed\n-- binary can open a store a newer binary already dropped these tables on.\n-- Every already-shipped repository constructor prepares its SQL eagerly at\n-- open time, so a bare \"table not found\" would fail the WHOLE open, not just\n-- a findings-specific read — these views keep `prepare()` succeeding so an\n-- old binary's unrelated features keep working; its own reads stay truthful,\n-- and its rare (already fail-open) writes fail at run time instead.\n--\n-- The 0009/0010 expression indexes existed only over the legacy `events`\n-- table; DROP TABLE below would remove them implicitly, but they are\n-- dropped explicitly first so the intent reads clearly. IF EXISTS so a store\n-- that reached here with an index missing out of band (an adopted-tag store\n-- whose physical index was never built) does not throw a deterministic \"no\n-- such index\" out of the fail-open drop path.\nDROP INDEX IF EXISTS `idx_events_code_change_path`;\n--\x3e statement-breakpoint\nDROP INDEX IF EXISTS `idx_events_session_id`;\n--\x3e statement-breakpoint\n-- `findings.event_id` references `events.id` — drop the child first.\nDROP TABLE `findings`;\n--\x3e statement-breakpoint\nDROP TABLE `events`;\n--\x3e statement-breakpoint\n-- Legacy `events` shape, projected from audit_events: `kind`/`occurred_at`/\n-- `source_tool` become real columns again (source_tool round-trips through\n-- the attributes bag, the only place a capture-typed audit row keeps it);\n-- `metadata` is reconstructed as the old camelCase JSON object from the new\n-- snake_case attributes bag, with `root_session_id` folded back in as\n-- `sessionId` (the one legacy metadata key that became a column, never an\n-- attribute, on the new table). Constrained to the four capture kinds so\n-- structural rows (session/run/tool_call/llm_call/source_lookup/config_scan)\n-- never leak into a legacy reader's result set — the old `events` table\n-- never held them either.\nCREATE VIEW `events` AS\nSELECT\n  id,\n  json_extract(attributes, '$.source_tool') AS source_tool,\n  event_type AS kind,\n  started_at AS occurred_at,\n  content_hash,\n  content,\n  -- Plugin-local bookkeeping column that `ensureSyncedAtColumn` adds to the\n  -- real `events` table at open time. A pre-cutover binary runs that probe on\n  -- EVERY open; without this projection its `columnNames('events')` check\n  -- misses `synced_at` and issues `ALTER TABLE events ADD COLUMN` against this\n  -- view, which SQLite rejects (\"Cannot add a column to a view\") — a hard,\n  -- non-fail-open crash of the whole open, the exact skew failure these views\n  -- exist to prevent. Projecting it (always NULL; no reader consumes it)\n  -- short-circuits that ALTER.\n  NULL AS synced_at,\n  json_object(\n    'sessionId', root_session_id,\n    'repo', json_extract(attributes, '$.repo'),\n    'filePath', json_extract(attributes, '$.file_path'),\n    'toolName', json_extract(attributes, '$.tool_name'),\n    'gitignored', json_extract(attributes, '$.gitignored'),\n    'wholeFile', json_extract(attributes, '$.whole_file'),\n    'model', json_extract(attributes, '$.model'),\n    'turnIndex', json_extract(attributes, '$.turn_index'),\n    'correlationId', json_extract(attributes, '$.correlation_id'),\n    'traceId', json_extract(attributes, '$.trace_id'),\n    'exceptionIds', json_extract(attributes, '$.exception_ids')\n  ) AS metadata\nFROM audit_events\nWHERE event_type IN ('prompt', 'response', 'code_change', 'tool_use');\n--\x3e statement-breakpoint\n-- A plain single-row INSERT (the old writer's shape — no ON CONFLICT) is\n-- accepted by prepare() against a view once an INSTEAD OF INSERT trigger\n-- exists, so it fails at run time instead of at open — landing in the same\n-- fail-open path the caller already wraps its write in.\nCREATE TRIGGER `trg_events_ro`\nINSTEAD OF INSERT ON `events`\nBEGIN SELECT RAISE(ABORT, 'events is read-only; write to audit_events instead'); END;\n--\x3e statement-breakpoint\n-- Legacy `findings` shape: rule_id/category/severity come from the joined\n-- inspection_definitions row (the legacy table inlined them per-row; the\n-- generalized schema normalizes them out into the shared definition). A view\n-- has no rowid of its own, so the underlying table's rowid is re-exposed\n-- explicitly under that name — a legacy reader ordering by `f.rowid` would\n-- otherwise fail to resolve the column at all. Joined to audit_events for the\n-- same four-capture-kind constraint as the events view above (a finding\n-- attached to a tool_call/config_scan row never existed in the legacy table\n-- either — see the persistence findings repository's identical predicate).\nCREATE VIEW `findings` AS\nSELECT\n  f.id AS id,\n  f.rowid AS rowid,\n  f.audit_event_id AS event_id,\n  d.rule_id AS rule_id,\n  d.category AS category,\n  d.severity AS severity,\n  f.span_start AS span_start,\n  f.span_end AS span_end,\n  f.masked_match AS masked_match,\n  f.action_taken AS action_taken,\n  f.confidence AS confidence,\n  f.finding_key AS finding_key,\n  f.first_detected_at AS first_detected_at\nFROM inspection_findings f\nJOIN audit_events e ON e.id = f.audit_event_id\nJOIN inspection_definitions d ON d.id = f.inspection_definition_id\nWHERE e.event_type IN ('prompt', 'response', 'code_change', 'tool_use');\n--\x3e statement-breakpoint\n-- Defense in depth only: SQLite refuses to plan ANY upsert against a view\n-- (\"cannot UPSERT a view\") no matter what trigger exists, so this can never\n-- rescue the real legacy writer, which always used\n-- `ON CONFLICT (finding_key) DO UPDATE` — that statement still fails at\n-- prepare() on an old binary, same as it would with no trigger at all. This\n-- only covers a plain-INSERT shape, should one ever exist.\nCREATE TRIGGER `trg_findings_ro`\nINSTEAD OF INSERT ON `findings`\nBEGIN SELECT RAISE(ABORT, 'findings is read-only; write to inspection_findings instead'); END;\n"}],e=/^(\d+)([mh])$/;function f(a,b=Date.now()){let c=a.trim().toLowerCase();return"once"===c?{scope:"once",expiresAt:new Date(b+18e5).toISOString(),maxUses:1}:"permanent"===c?{scope:"permanent",expiresAt:null,maxUses:null}:{scope:"temporary",expiresAt:new Date(b+function(a){let b=e.exec(a.trim()),c=b?Number(b[1]):0;if(!b||c<=0)throw Error(`invalid duration '${a}' — use <n>m or <n>h (e.g. 30m, 1h, 24h)`);let d=c*("h"===b[2]?36e5:6e4);if(d>864e5)throw Error(`duration '${a}' exceeds the 24h maximum for --for — use --permanent (revocable any time) for an open-ended grant`);return d}(c)).toISOString(),maxUses:null}}function g(a){return new Date(a).getTime()}function h(a){return new Date(a).toISOString()}function i(a,b){return{input:a,output:b,cacheWrite5m:1.25*a,cacheWrite1h:2*a,cacheRead:.1*a,webSearch:.01}}let j={input:0,output:0,cacheWrite5m:0,cacheWrite1h:0,cacheRead:0,webSearch:0},k={"claude-fable-5":i(10,50),"claude-opus-4-8":i(5,25),"claude-opus-4-7":i(5,25),"claude-opus-4-6":i(5,25),"claude-opus-4-5":i(5,25),"claude-sonnet-5":i(3,15),"claude-sonnet-4-6":i(3,15),"claude-sonnet-4-5":i(3,15),"claude-haiku-4-5":i(1,5)},l={...Object.fromEntries(Object.entries(k).map(([a,b])=>[`anthropic/${a}`,b])),"ollama/*":j,"local/*":j},m={standard:1,batch:.5,priority:1.5},n=Object.keys(k);function o(a){let b=a.replace(/^(us|eu|apac|global)\./,"").replace(/^anthropic[./]/,"").replace(/@[\w-]+$/,"").replace(/-v\d+:\d+$/,"").replace(/:\d+$/,"").replace(/-\d{8}$/,"");for(let a of n)if(b===a)return a;return b}let p={normalizeModelId(a,b){let c=a.trim().toLowerCase();if("ollama"===c||"local"===c)return{provider:c,model:"*"};if("anthropic"===c||"bedrock"===c||"vertex"===c)return{provider:c,model:o(b)};let d=/^anthropic\/(.+)$/.exec(b);return d?.[1]!==void 0?{provider:c,model:o(d[1])}:{provider:c,model:b}},costFor({provider:a,model:b,usage:c}){var d;let e=this.normalizeModelId(a,b),f=l[`${e.provider}/${e.model}`];return void 0===f?null:((c.inputTokens??0)*f.input+(c.outputTokens??0)*f.output+(c.cacheWrite1hTokens??0)*f.cacheWrite1h+(c.cacheWrite5mTokens??0)*f.cacheWrite5m+(c.cacheReadTokens??0)*f.cacheRead)/1e6*(void 0===(d=c.serviceTier)?1:m[d]??1)+(c.webSearchRequests??0)*f.webSearch}};new Intl.NumberFormat("en-US",{notation:"compact",maximumFractionDigits:1});let q=a=>a??0;function r(a,b){let c=new Map;for(let{sessionId:d,attributes:e}of a){let a=e.provider??"unknown",f=e.model??"unknown",g=`${a} ${f}`,h=c.get(d);void 0===h&&(h=new Map,c.set(d,h));let i=h.get(g);void 0===i&&(i={provider:a,model:f,input:0,output:0,cacheCreation:0,cacheRead:0,costUsd:0,priced:!1},h.set(g,i)),i.input+=q(e.input_tokens),i.output+=q(e.output_tokens),i.cacheCreation+=q(e.cache_creation_input_tokens),i.cacheRead+=q(e.cache_read_input_tokens);let j=b.costFor({provider:a,model:f,usage:function(a){let b={inputTokens:q(a.input_tokens),outputTokens:q(a.output_tokens),cacheWrite1hTokens:q(a.ephemeral_1h_input_tokens),cacheWrite5mTokens:q(a.ephemeral_5m_input_tokens),cacheReadTokens:q(a.cache_read_input_tokens),webSearchRequests:q(a.web_search_requests)};return void 0!==a.service_tier&&(b.serviceTier=a.service_tier),b}(e)});null!==j&&(i.costUsd+=j,i.priced=!0)}let d=[];for(let[a,b]of c){let c=[],e=0,f=0,g=!1,h=!1;for(let d of b.values()){let b=d.input+d.output+d.cacheCreation+d.cacheRead;e+=b;let i=d.priced?d.costUsd:null;null===i?h=!0:(g=!0,f+=i),c.push({sessionId:a,model:d.model,provider:d.provider,inputTokens:d.input,outputTokens:d.output,cacheCreation:d.cacheCreation,cacheRead:d.cacheRead,totalTokens:b,estimatedCostUsd:i})}c.sort((a,b)=>b.totalTokens-a.totalTokens),d.push({sessionId:a,rollups:c,totalTokens:e,estimatedCostUsd:g?f:null,costIsPartial:h})}return d.sort((a,b)=>b.totalTokens-a.totalTokens),d}var s=c(72844),t=c(72446),u=c(24036);let v=s.k5(["pii","financial","secret","phi","code_context","code_flaw","custom","config"]).meta({id:"DetectionCategory"}),w=s.k5(["critical","high","medium","low"]).meta({id:"Severity"}),x=s.k5(["warn","redact","block","allow","log"]).meta({id:"ActionTaken"}),y=x.options,z=s.Ik({start:s.ai().int().nonnegative(),end:s.ai().int().nonnegative()}).meta({id:"Span"}),A=s.Ik({id:s.Os(),eventId:s.Os(),ruleId:s.Yj(),category:v,severity:w,span:z,maskedMatch:s.Yj(),actionTaken:x,confidence:s.ai().min(0).max(1)}).meta({id:"Finding"});A.meta({id:"DetectedFinding"});let B=s.k5(["blocked","redacted","warned","allowed","quarantined","monitored"]).meta({id:"FindingAction"}),C=s.k5(["claudecode","claudedesktop","cursor","copilot","chatgpt","api"]).meta({id:"FindingProvider"}),D=s.k5(["secret","pii","source_code","external_share","mcp_server","customer_data","financial","phi","custom"]).meta({id:"FindingCategory"});s.k5(["in-flight","at-rest"]).meta({id:"FindingOrigin"});let E=s.k5(["open","handled","resolved","dismissed"]).meta({id:"FindingStatus"}),F=s.k5(["enforced-in-flight","fixed-at-source","exception","acknowledged","false-positive","redetected"]).meta({id:"ResolutionMethod"}),G=s.Ik({maskedValue:s.Yj(),contextPrefix:s.Yj()}).meta({id:"FindingMatch"}),H=s.Ik({id:s.Yj(),name:s.Yj().nullable()}).meta({id:"FindingDetectionRef"}),I=s.Ik({id:s.Yj(),name:s.Yj()}).meta({id:"FindingPolicyRef"}),J=s.Ik({id:s.Yj(),provider:C,repo:s.Yj(),file:s.Yj(),toolName:s.Yj().optional(),action:B,detectedAt:t.w$(),confidence:s.ai().min(0).max(1),status:E.optional()}).meta({id:"FindingInstance"}),K=s.Ik({id:s.Yj(),category:D,subtype:s.Yj(),severity:w,match:G,detection:H,policy:I,instanceCount:s.ai().int().nonnegative(),providers:s.YO(C),aggregateAction:B.nullable(),latestDetectedAt:t.w$(),instances:s.YO(J),status:E.optional()}).meta({id:"FindingGroup"});s.Ik({findings:s.ai().int().nonnegative(),groups:s.ai().int().nonnegative(),bySeverity:s.Ik({critical:s.ai().int().nonnegative(),high:s.ai().int().nonnegative(),medium:s.ai().int().nonnegative(),low:s.ai().int().nonnegative()})}).meta({id:"FindingStats"});let L=s.Ik({value:s.Yj(),count:s.ai().int().nonnegative()}).meta({id:"FindingFacetItem"}),M=s.Ik({severity:s.YO(L),subtype:s.YO(L),provider:s.YO(L),action:s.YO(L),status:s.YO(L)}).meta({id:"FindingFacets"}),N=50;s.Ik({severity:s.YO(w).optional(),subtype:s.YO(s.Yj()).optional(),provider:s.YO(C).optional(),action:s.YO(B).optional(),status:s.YO(E).optional(),q:s.Yj().optional(),sessionId:s.Yj().optional(),groupBy:s.eu("type").optional(),limit:u.ai().int().min(1).max(100).optional(),cursor:s.Yj().optional()}),s.Ik({totals:s.Ik({findings:s.ai().int().nonnegative(),groups:s.ai().int().nonnegative()}),facets:M,items:s.YO(K),nextCursor:s.Yj().nullable(),sessionFirings:s.g1(s.Yj(),s.ai().int().nonnegative()).optional()}).meta({id:"ListGroupedFindingsResponse"}),s.Ik({action:B.exclude(["quarantined"]),instanceId:s.Yj().optional()}).meta({id:"ApplyFindingActionRequest"}),K.meta({id:"ApplyFindingActionResponse"}),s.Ik({severity:s.YO(w).optional(),subtype:s.YO(s.Yj()).optional(),provider:s.YO(C).optional(),action:s.YO(B).optional(),q:s.Yj().optional(),format:s.k5(["csv","json"]).optional()}),J.extend({groupId:s.Yj(),category:D,subtype:s.Yj(),severity:w,match:G,detection:H,policy:I}).meta({id:"FindingInstanceDetail"});let O=s.k5(["claudecode","cursor","copilot","codex","windsurf","claudedesktop","chatgpt","api"]).meta({id:"Harness"}),P={"claude-code":"claudecode","claude-desktop":"claudedesktop","github-copilot":"copilot",cursor:"cursor",chatgpt:"chatgpt"},Q=s.k5(["host","harness","user","skill","hook","mcp_server","config_file"]).meta({id:"InventoryObjectType"}),R=s.k5(["session","run","tool_call","llm_call","source_lookup","prompt","response","code_change","tool_use","config_scan"]).meta({id:"AuditEventType"}),S=s.g1(s.Yj(),s.L5());s.Ik({host_name:s.Yj().optional(),os:s.Yj().optional(),os_version:s.Yj().optional(),arch:s.Yj().optional()}).catchall(s.L5()),s.Ik({harness_version:s.Yj().optional(),interface:s.Yj().optional()}).catchall(s.L5()),s.Ik({display_name:s.Yj().optional(),email:s.Yj().optional()}).catchall(s.L5()),s.Ik({source:s.Yj().optional(),version:s.Yj().optional(),description:s.Yj().optional(),updated_at:s.Yj().optional(),scope:s.Yj().optional(),plugin_name:s.Yj().optional()}).catchall(s.L5()),s.Ik({event:s.Yj().optional(),matcher:s.Yj().optional(),command:s.Yj().optional(),scope:s.Yj().optional(),plugin_name:s.Yj().optional(),timeout:s.ai().optional()}).catchall(s.L5()),s.Ik({scope:s.Yj().optional(),transport:s.Yj().optional(),command:s.Yj().optional(),url:s.Yj().optional(),env_keys:s.YO(s.Yj()).optional(),plugin_name:s.Yj().optional(),marketplace:s.Yj().optional(),project:s.Yj().optional()}).catchall(s.L5()),s.Ik({kind:s.Yj().optional(),detail:s.Yj().optional(),scope:s.Yj().optional(),updated_at:s.Yj().optional(),entry_count:s.ai().optional()}).catchall(s.L5());let T=s.Ik({model:s.Yj().optional(),provider:s.Yj().optional(),input_tokens:s.ai().int().nonnegative().optional(),output_tokens:s.ai().int().nonnegative().optional(),cache_creation_input_tokens:s.ai().int().nonnegative().optional(),cache_read_input_tokens:s.ai().int().nonnegative().optional(),ephemeral_1h_input_tokens:s.ai().int().nonnegative().optional(),ephemeral_5m_input_tokens:s.ai().int().nonnegative().optional(),web_search_requests:s.ai().int().nonnegative().optional(),web_fetch_requests:s.ai().int().nonnegative().optional(),service_tier:s.Yj().optional(),stop_reason:s.Yj().optional(),message_id:s.Yj().optional(),uuid:s.Yj().optional(),parent_uuid:s.Yj().optional(),run_key:s.Yj().optional()}).catchall(s.L5());s.Ik({sessionId:s.Yj().min(1),messageId:s.Yj().min(1),parentId:s.Yj().min(1),rootSessionId:s.Yj().min(1),startedAt:t.w$(),attributes:T});let U=s.Ik({tool_name:s.Yj().optional(),tool_use_id:s.Yj().optional(),target:s.Yj().optional(),is_error:s.zM().optional(),input_size:s.ai().int().nonnegative().optional(),output_size:s.ai().int().nonnegative().optional(),uuid:s.Yj().optional(),parent_uuid:s.Yj().optional(),run_key:s.Yj().optional()}).catchall(s.L5());s.Ik({source_tool:s.Yj().optional(),file_path:s.Yj().optional(),repo:s.Yj().optional(),tool_name:s.Yj().optional(),gitignored:s.zM().optional(),whole_file:s.zM().optional(),correlation_id:s.uR().optional(),trace_id:s.Yj().regex(/^[0-9a-f]{32}$/).optional(),exception_ids:s.YO(s.Os()).optional()}).catchall(s.L5());let V=s.Ik({ruleId:s.Yj().min(1),ruleName:s.Yj(),ruleVersion:s.Yj().min(1),category:v,severity:w,span:z,maskedMatch:s.Yj(),actionTaken:x,confidence:s.ai().min(0).max(1)});s.Ik({sessionId:s.Yj().min(1),toolUseId:s.Yj().min(1),parentId:s.Yj().min(1),rootSessionId:s.Yj().min(1),startedAt:t.w$(),attributes:U,inspections:s.YO(V).default([])});let W=s.Ik({objectType:Q,identityKey:s.Yj().min(1),location:s.Yj().optional(),title:s.Yj().optional(),hostId:s.Yj().optional(),attributes:S.default({})}).meta({id:"InventoryInput"}),X=s.Ik({url:s.Yj().min(1),name:s.Yj().optional(),attributes:S.default({})}).meta({id:"SourceProjectInput"}),Y=s.Ik({id:s.Yj().min(1),eventType:R,startedAt:t.w$(),endedAt:t.w$().optional(),parentId:s.Yj().optional(),rootSessionId:s.Yj().optional(),hostId:s.Yj().optional(),harnessId:s.Yj().optional(),sourceProjectId:s.Yj().optional(),severity:w.optional(),priority:s.Yj().optional(),content:s.Yj().optional(),contentHash:s.Yj().optional(),attributes:S.optional()}).meta({id:"AuditEventInput"});s.Ik({class:s.Yj().min(1),label:s.Yj().optional(),attributes:S.optional()});let Z=s.Ik({ruleId:s.Yj().min(1),version:s.Yj().min(1),name:s.Yj(),category:v,severity:w,definition:s.Yj()});s.Ik({id:s.Yj().min(1),auditEventId:s.Yj().min(1),inspectionDefinitionId:s.Yj().min(1),classifiedDataId:s.Yj().optional(),span:z,maskedMatch:s.Yj(),actionTaken:x,confidence:s.ai().min(0).max(1),findingKey:s.Yj().optional(),firstDetectedAt:t.w$().optional()}),s.Ik({host:W.optional(),harness:W.optional(),project:X.optional()}).meta({id:"InventoryContext"}),s.Ik({hostId:s.Yj().optional(),harnessId:s.Yj().optional(),accountId:s.Yj().optional(),sourceProjectId:s.Yj().optional()}).meta({id:"ResolvedInventory"}),s.Ik({hosts:s.YO(s.Yj()),harnesses:s.YO(s.Yj()),osVersions:s.YO(s.Yj()),projects:s.YO(s.Yj())}).meta({id:"InventoryFacets"});let $=s.Ik({sessionId:s.Yj(),model:s.Yj(),provider:s.Yj(),inputTokens:s.ai().int().nonnegative(),outputTokens:s.ai().int().nonnegative(),cacheCreation:s.ai().int().nonnegative(),cacheRead:s.ai().int().nonnegative(),totalTokens:s.ai().int().nonnegative(),estimatedCostUsd:s.ai().nullable()}).meta({id:"TokenRollup"});s.Ik({sessionId:s.Yj(),rollups:s.YO($),totalTokens:s.ai().int().nonnegative(),estimatedCostUsd:s.ai().nullable(),costIsPartial:s.zM()});let _=s.Ik({provider:s.Yj(),model:s.Yj(),inputTokens:s.ai().int().nonnegative(),outputTokens:s.ai().int().nonnegative(),cacheTokens:s.ai().int().nonnegative(),totalTokens:s.ai().int().nonnegative(),estimatedCostUsd:s.ai().nullable()});function aa(a){return JSON.stringify(a)}s.Ik({models:s.YO(_),sessionCount:s.ai().int().nonnegative(),totalTokens:s.ai().int().nonnegative(),estimatedCostUsd:s.ai(),costIsPartial:s.zM()});let ab=s.k5(["active","completed","interrupted","error"]),ac=s.k5(["session","prompt","response","tool","hook","detection","share","permission","commit","error","active"]),ad=s.k5(["detections","shares","inventory"]),ae=s.Ik({id:s.Yj(),occurredAt:t.w$(),kind:ac,title:s.Yj(),detail:s.Yj(),tool:s.Yj().nullable(),severity:w.nullable(),link:ad.nullable(),targetId:s.Yj().nullable(),internal:s.zM(),flagged:s.zM()}).meta({id:"ActivityAuditEvent"}),af=s.Ik({id:s.Yj(),harness:O,title:s.Yj(),project:s.Yj(),repo:s.Yj(),branches:s.YO(s.Yj()),startedAt:t.w$(),endedAt:t.w$().nullable(),status:ab,turns:s.ai().int().nonnegative(),findings:s.ai().int().nonnegative(),shares:s.ai().int().nonnegative()}).meta({id:"ActivitySessionSummary"});af.extend({host:s.Yj(),cwd:s.Yj(),models:s.YO(s.Yj()),version:s.Yj(),tokens:$,tools:s.g1(s.Yj(),s.ai().int().nonnegative()),files:s.YO(s.Yj()),commits:s.ai().int().nonnegative(),events:s.YO(ae)}).meta({id:"ActivitySession"}),s.Ik({tz:s.Yj().optional()});let ag=s.Ik({sessionsToday:s.ai().int().nonnegative(),liveNow:s.ai().int().nonnegative(),toolCallsToday:s.ai().int().nonnegative(),findingsToday:s.ai().int().nonnegative(),egressToday:s.ai().int().nonnegative()}).meta({id:"GetActivityStatsResponse"});s.Ik({q:s.Yj().optional(),harness:s.YO(O).optional(),from:s.KC([t.p6(),t.w$()]).optional(),to:s.KC([t.p6(),t.w$()]).optional(),excludeEmpty:s.uE().optional(),limit:u.ai().int().min(1).max(100).default(50),cursor:s.Yj().optional()});let ah=s.Ik({items:s.YO(af),nextCursor:s.Yj().nullable(),emptyCount:s.ai().int().nonnegative()}).meta({id:"ListActivitySessionsResponse"});s.Ik({limit:u.ai().int().min(1).max(500).default(100),cursor:s.Yj().optional(),order:s.k5(["asc","desc"]).default("asc")}),s.Ik({items:s.YO(ae),nextCursor:s.Yj().nullable()}).meta({id:"ListSessionEventsResponse"}),s.Ik({format:s.k5(["ndjson","json"]).default("ndjson")}),s.Ik({format:s.k5(["csv","json"]).default("csv"),q:s.Yj().optional(),harness:s.YO(O).optional(),from:s.KC([t.p6(),t.w$()]).optional(),to:s.KC([t.p6(),t.w$()]).optional()}),s.Ik({stats:ag,sessions:ah}).meta({id:"ActivityOverviewResponse"});let ai=s.k5(["prompt","response","code_change","tool_use"]).meta({id:"EventKind"}),aj=ai.options.map(a=>`'${a}'`).join(","),ak=s.k5(["claude-code","claude-desktop","cursor","chatgpt","github-copilot","cli","unknown"]).meta({id:"SourceTool"}),al=s.Ik({sessionId:s.Yj().optional(),repo:s.Yj().optional(),filePath:s.Yj().optional(),toolName:s.Yj().optional(),gitignored:s.zM().optional(),wholeFile:s.zM().optional(),model:s.Yj().optional(),turnIndex:s.ai().int().nonnegative().optional(),correlationId:s.uR().optional(),traceId:s.Yj().regex(/^[0-9a-f]{32}$/).optional(),exceptionIds:s.YO(s.Os()).optional()}).meta({id:"EventMetadata"}),am=s.Ik({id:s.Os(),sourceTool:ak,kind:ai,occurredAt:t.w$(),contentHash:s.Yj(),content:s.Yj(),metadata:al.optional()}).meta({id:"Event"}),an=am.meta({id:"IngestEvent"});s.Ik({events:s.YO(an).min(1).max(100),dedupe:s.eu("content-hash").optional()}).meta({id:"IngestBatch"});let ao=s.k5(["project","skill","mcp","hook","config"]).meta({id:"AssetType"}),ap=s.k5(["open","approved","blocked"]).meta({id:"AccessLevel"}),aq=s.k5(["source","public-dep","vendored","config","data","docs","generated"]).meta({id:"Origin"}),ar=s.k5(["known-good","risky","unapproved"]).meta({id:"TrustLevel"}),as=s.k5(["update","stale","conflict","unknown","change","untracked","risk","findings"]).meta({id:"Flag"}),at=s.k5(["public","private"]).meta({id:"Visibility"}),au=s.k5(["block","redact","warn"]).meta({id:"HarnessEventKind"}),av=s.k5(["claudecode","cursor","codex"]).meta({id:"HarnessId"}),aw=s.Ik({open:s.ai().int().nonnegative(),approved:s.ai().int().nonnegative(),blocked:s.ai().int().nonnegative(),total:s.ai().int().nonnegative()}).meta({id:"AccessCounts"}),ax=s.Ik({id:s.Yj(),type:ao,name:s.Yj(),sub:s.Yj(),flags:s.YO(as),trust:ar.optional()}).meta({id:"AssetSummary"}),ay=s.Ik({id:s.Yj(),name:s.Yj(),repo:s.Yj(),visibility:at,language:s.Yj(),policyDefault:ap,updatedAt:t.w$(),accessCounts:aw,findingsCount:s.ai().int().nonnegative()}).meta({id:"ProjectSummary"}),az=s.Ik({type:ao,assets:s.YO(ax)}),aA=s.Ik({id:av,label:s.Yj(),kind:s.Yj(),version:s.Yj(),sessions:s.ai().int().nonnegative(),assetCount:s.ai().int().nonnegative(),flagCount:s.ai().int().nonnegative(),projects:s.YO(ay),categories:s.YO(az)}).meta({id:"HarnessSummary"});s.Ik({items:s.YO(aA)}).meta({id:"ListHarnessesResponse"});let aB=s.Ik({type:ao,total:s.ai().int().nonnegative(),trustRollup:s.Ik({"known-good":s.ai().int().nonnegative(),risky:s.ai().int().nonnegative(),unapproved:s.ai().int().nonnegative()}).partial().strict().optional(),flagRollup:s.Ik({update:s.ai().int().nonnegative(),stale:s.ai().int().nonnegative(),conflict:s.ai().int().nonnegative(),unknown:s.ai().int().nonnegative(),change:s.ai().int().nonnegative(),untracked:s.ai().int().nonnegative(),risk:s.ai().int().nonnegative(),findings:s.ai().int().nonnegative()}).partial().strict(),items:s.YO(ax)}).meta({id:"AssetGroup"});s.Ik({groups:s.YO(aB)}).meta({id:"ListAssetsResponse"});let aC=s.Ik({name:s.Yj(),signature:s.Yj(),description:s.Yj(),write:s.zM(),risk:s.Yj().nullable()}).meta({id:"McpTool"}),aD=s.Ik({id:s.Yj(),title:s.Yj(),note:s.Yj()});ax.extend({description:s.Yj().nullable(),trust:ar.nullable(),meta:s.g1(s.Yj(),s.L5()),finding:aD.nullable(),tools:s.YO(aC).optional()}).meta({id:"AssetDetail"}),s.Ik({items:s.YO(ay)}).meta({id:"ListProjectsResponse"}),s.Ik({attention:s.ai().int().nonnegative(),byType:s.Ik({project:s.ai().int().nonnegative(),skill:s.ai().int().nonnegative(),mcp:s.ai().int().nonnegative(),hook:s.ai().int().nonnegative(),config:s.ai().int().nonnegative()}),harnesses:s.ai().int().nonnegative(),mcpTrust:s.Ik({"known-good":s.ai().int().nonnegative(),risky:s.ai().int().nonnegative(),unapproved:s.ai().int().nonnegative()})}).meta({id:"InventoryStats"});let aE=s.Ik({path:s.Yj(),name:s.Yj(),origin:aq,access:ap,isCustom:s.zM(),findings:s.ai().int().nonnegative(),blockedAt:t.w$().nullable().optional(),note:s.Yj().nullable().optional()}).meta({id:"FileSummary"}),aF=s.Ik({name:s.Yj(),path:s.Yj(),accessCounts:aw}).meta({id:"FolderSummary"});s.Ik({project:s.Ik({id:s.Yj(),repo:s.Yj(),visibility:at}),path:s.Yj(),folders:s.YO(aF).optional(),files:s.YO(aE)}).meta({id:"ProjectTreeResponse"}),aE.extend({project:s.Ik({repo:s.Yj(),visibility:at,language:s.Yj(),policyDefault:ap,updatedAt:t.w$()}),findingsRefs:s.YO(s.Ik({id:s.Yj(),title:s.Yj()}))}).meta({id:"FileDetail"}),s.Ik({path:s.Yj(),access:ap}).meta({id:"SetFileAccessBody"}),s.Ik({file:aE,accessCounts:aw}).meta({id:"SetFileAccessResponse"}),s.Ik({trust:ar}).meta({id:"SetMcpTrustBody"});let aG=s.Ik({kind:au,title:s.Yj(),detail:s.Yj(),occurredAt:t.w$(),findingId:s.Yj().nullable().optional()}).meta({id:"HarnessEventItem"});s.Ik({counts:s.Ik({block:s.ai().int().nonnegative(),redact:s.ai().int().nonnegative(),warn:s.ai().int().nonnegative()}),items:s.YO(aG)}).meta({id:"HarnessEventsResponse"}),s.Ik({jobId:s.Yj(),startedAt:t.w$()}).meta({id:"RescanResponse"}),s.Ik({repo:s.Yj()}).meta({id:"ConnectProjectBody"}),s.Ik({type:s.YO(ao).optional(),q:s.Yj().optional()}),s.Ik({path:s.Yj().optional(),q:s.Yj().optional(),filter:s.k5(["blocked"]).optional()}),s.Ik({path:s.Yj()}),s.Ik({limit:u.ai().int().min(1).max(50).default(7)});let aH=s.k5(["once","temporary","permanent"]),aI=s.Ik({repo:s.Yj().optional(),sourceTool:s.Yj().optional(),provider:s.Yj().optional()}).strict(),aJ=s.Ik({id:s.Os(),ruleId:s.Yj(),category:v,valueFingerprint:s.Yj().regex(/^[0-9a-f]{64}$/),keyVersion:s.ai().int().positive(),maskedValue:s.Yj(),scope:aH,expiresAt:t.w$().nullable(),maxUses:s.ai().int().positive().nullable(),useCount:s.ai().int().nonnegative(),lastUsedAt:t.w$().nullable(),justification:s.Yj().min(1),conditions:aI.nullable(),createdBy:s.Yj(),createdVia:s.k5(["cli-approve","cli-add","web-approve","web-add","api","setup-triage"]),createdAt:t.w$(),updatedAt:t.w$(),revokedAt:t.w$().nullable(),revokedBy:s.Yj().nullable(),revokeReason:s.Yj().nullable()}),aK=aJ.pick({id:!0,ruleId:!0,valueFingerprint:!0,keyVersion:!0,expiresAt:!0,maxUses:!0,useCount:!0,conditions:!0});function aL(a,b){return"present"===b.status&&b.version===a}s.k5(["keyword","regex","validator"]).meta({id:"MatcherType"}),s.k5(["safe","quarantined"]).meta({id:"RuleProbeVerdict"});let aM=s.Ik({type:s.eu("keyword"),keywords:s.YO(s.Yj().min(1)).min(1),caseSensitive:s.zM().default(!1)}),aN=s.Ik({type:s.eu("regex"),pattern:s.Yj().min(1).max(2e3),flags:s.Yj().default("gi"),captureGroup:s.ai().int().nonnegative().optional()}).refine(a=>(function(a,b){try{return new RegExp(a,b),!0}catch{return!1}})(a.pattern,a.flags),{message:"pattern/flags do not form a valid JavaScript regular expression",path:["pattern"]}).refine(a=>void 0!==a.captureGroup||!function(a,b){try{let c=new RegExp(a,b.replace(/[gy]/g,""));return c.exec("")?.[0].length===0}catch{return!1}}(a.pattern,a.flags),{message:'a whole-match regex that can match the empty string (e.g. "\\d*", "a?", "(?:)") can hang the matcher — scope the quantifier to a captureGroup, or require at least one character',path:["pattern"]}),aO=s.Ik({type:s.eu("validator"),name:s.k5(["luhn","entropy","ssn-checksum"]),config:s.g1(s.Yj(),s.L5()).optional()}),aP=s.gM("type",[aM,aN,aO]).meta({id:"Matcher"}),aQ=s.Ik({extensions:s.YO(s.Yj().regex(/^\.[A-Za-z0-9]+$/)).min(1)}).meta({id:"AppliesTo"}),aR=s.KC([s.Yj(),s.Ik({name:s.Yj(),config:s.g1(s.Yj(),s.L5()).optional()})]).meta({id:"PostValidatorRef"}),aS=s.Ik({categories:s.YO(v).min(1).optional(),ruleIds:s.YO(s.Yj().min(1)).min(1).optional(),labels:s.YO(s.Yj().min(1)).min(1).optional(),windowChars:s.ai().int().positive().default(160),confidenceBoost:s.ai().min(0).max(.3).optional()}).refine(a=>(a.categories?.length??0)+(a.ruleIds?.length??0)+(a.labels?.length??0)>0,{message:"requiresNearby needs at least one of categories, ruleIds, or labels"}).meta({id:"RequiresNearby"}),aT=s.Ik({label:s.Yj(),text:s.Yj().max(5e4),shouldMatch:s.zM(),filePath:s.Yj().optional(),expectedSpans:s.YO(s.Ik({start:s.ai(),end:s.ai()})).optional()}).meta({id:"RuleFixture"}),aU=s.Ik({specVersion:s.eu(1),id:s.Yj().regex(/^[a-z][a-z0-9-]*\/[a-z][a-z0-9-]*$/),name:s.Yj(),category:v,severity:w,matcher:aP,appliesTo:aQ.optional(),postValidators:s.YO(aR).optional(),requiresNearby:aS.optional(),examples:s.YO(s.Yj()).optional()}).meta({id:"Rule"}),aV=s.Ik({name:s.Yj(),email:s.Rp().optional(),url:s.OZ().optional()}).meta({id:"Author"});s.Ik({specVersion:s.eu(1),id:s.Yj(),name:s.Yj(),version:s.Yj(),rules:s.YO(s.Yj()),description:s.Yj().optional(),author:aV.optional(),license:s.Yj().optional(),sourceUrl:s.OZ().optional()}).meta({id:"PackManifest"});let aW=s.k5(["global","repo","user"]).meta({id:"PolicyScope"}),aX=s.KC([s.Ik({ruleId:s.Yj()}),s.Ik({category:v})]).meta({id:"PolicyTarget"}),aY=s.Ik({id:s.Os(),scope:aW,target:aX,action:x,enabled:s.zM().default(!0),customKeywords:s.YO(s.Yj()).optional(),name:s.Yj().optional()}).meta({id:"Policy"});s.Ik({version:s.Yj(),policies:s.YO(aY),rules:s.YO(aU).optional(),rulesComplete:s.zM().optional(),exceptions:s.YO(aK).optional(),ruleVersions:s.g1(s.Yj(),s.Yj()).optional(),customKeywords:s.YO(s.Yj()),fetchedAt:t.w$()}).meta({id:"PolicyBundle"});let aZ=["config"],a$=v.options.filter(a=>!aZ.includes(a)),a_={secret:"critical",financial:"critical",code_flaw:"critical",pii:"high",phi:"high",custom:"high",code_context:"low",config:"low"},a0=s.k5(["builtin","custom"]).meta({id:"PolicyKind"}),a1=["monitor","warn","redact","block"],a2=s.k5(a1).meta({id:"BuiltinPolicyId"}),a3=a1,a4={monitor:{name:"Monitor",action:"log",description:"Log every match for audit. The request is allowed through untouched."},warn:{name:"Warn",action:"warn",description:"Allow the request, but warn the user inline before it is sent."},redact:{name:"Redact",action:"redact",description:"Automatically strip the matched value from the request, then continue."},block:{name:"Block",action:"block",description:"Refuse the request entirely whenever any rule in this detection matches."}},a5=Object.fromEntries(v.options.map(a=>[a,a4[function(a){if(aZ.includes(a))return"monitor";let b=a_[a];return"critical"===b||"high"===b?"warn":"monitor"}(a)].action])),a6=Object.fromEntries(a1.map(a=>[a,{id:a,...a4[a]}])),a7="monitor";function a8(a){let b=a2.safeParse(a??a7);return a6[b.success?b.data:a7].action}let a9=s.Ik({id:s.Yj(),name:s.Yj(),ruleCount:s.ai().int().nonnegative(),enabled:s.zM()}).meta({id:"UsedByItem"}),ba=s.Ik({id:s.Yj(),kind:a0,name:s.Yj(),enabled:s.zM(),usedByCount:s.ai().int().nonnegative()}).meta({id:"PolicyListItem"});s.Ik({specVersion:s.eu(1),id:s.Yj(),kind:a0,name:s.Yj(),enabled:s.zM(),description:s.Yj(),usedBy:s.YO(a9)}).meta({id:"PolicyDetail"}),s.Ik({policies:s.ai().int().nonnegative(),builtin:s.ai().int().nonnegative(),custom:s.ai().int().nonnegative(),detectionsGoverned:s.ai().int().nonnegative()}).meta({id:"PolicyStatsResponse"}),s.Ik({cursor:s.Yj().optional(),limit:u.ai().int().min(1).max(200).default(50),sourceTool:s.Yj().optional(),kind:s.Yj().optional(),from:t.w$().optional(),to:t.w$().optional()}),s.Ik({items:s.YO(am),nextCursor:s.Yj().nullable()}).meta({id:"ListEventsResponse"}),s.Ik({accepted:s.ai().int().nonnegative(),duplicates:s.ai().int().nonnegative()}).meta({id:"IngestResponse"}),s.Ik({cursor:s.Yj().optional(),limit:u.ai().int().min(1).max(200).default(50),severity:s.Yj().optional(),category:s.Yj().optional(),eventId:s.Os().optional()}),s.Ik({items:s.YO(A),nextCursor:s.Yj().nullable()}).meta({id:"ListFindingsResponse"}),s.Ik({items:s.YO(ba)}).meta({id:"ListPoliciesResponse"}),aY.omit({id:!0}).meta({id:"CreatePolicyRequest"}),aY.partial().required({id:!0}).meta({id:"UpdatePolicyRequest"}),s.Ik({accepted:s.zM()}).meta({id:"RecordAuditEventResponse"}),s.Ik({error:s.Ik({code:s.Yj(),message:s.Yj(),details:s.L5().optional()})}).meta({id:"ErrorResponse"});let bb=s.k5(["user","project","local","plugin"]),bc=s.Ik({name:s.Yj().min(1),source:s.Yj().min(1),scope:bb,pluginName:s.Yj().optional(),version:s.Yj().optional(),description:s.Yj().optional(),updatedAt:t.w$().optional(),location:s.Yj().optional()}),bd=s.Ik({event:s.Yj().min(1),matcher:s.Yj().optional(),command:s.Yj().min(1),timeout:s.ai().optional(),scope:bb,pluginName:s.Yj().optional(),location:s.Yj().optional()}),be=s.Ik({name:s.Yj().min(1),scope:bb,pluginName:s.Yj().optional(),marketplace:s.Yj().optional(),project:s.Yj().optional(),transport:s.Yj().min(1),command:s.Yj().optional(),url:s.Yj().optional(),envKeys:s.YO(s.Yj()).optional(),location:s.Yj().optional()}),bf=s.Ik({name:s.Yj().min(1),path:s.Yj().min(1),scope:bb,kind:s.Yj().min(1),detail:s.Yj().optional(),entryCount:s.ai().optional(),updatedAt:t.w$().optional()});s.Ik({scannedAt:t.w$(),skills:s.YO(bc),hooks:s.YO(bd),mcpServers:s.YO(be),configFiles:s.YO(bf),errors:s.YO(s.Ik({source:s.Yj(),reason:s.Yj()}))});let bg=s.Ik({ruleId:s.Yj().min(1),version:s.Yj().min(1),span:z,maskedMatch:s.Yj(),actionTaken:x,confidence:s.ai().min(0).max(1)});s.Ik({items:s.YO(W),scanEvent:Y,definitions:s.YO(Z).optional(),findings:s.YO(bg).optional()});let bh=s.Yj().regex(/^[a-z][a-z0-9-]*$/),bi=s.Yj().regex(/^[a-z][a-z0-9-]*$/),bj=s.Yj().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-.]+)?$/),bk=s.k5(["labs","user","org"]),bl=s.k5(["library"]).meta({id:"OriginEnum"}),bm=s.k5(["all","library","custom","customized","updates"]),bn=s.k5(["new","imported","update"]).meta({id:"LibraryStateEnum"}),bo=s.Ik({all:s.ai().int().nonnegative(),library:s.ai().int().nonnegative(),custom:s.ai().int().nonnegative(),customized:s.ai().int().nonnegative(),updates:s.ai().int().nonnegative()}).meta({id:"DetectionCounts"}),bp=s.Ik({id:s.Yj(),name:s.Yj(),version:bj,enabled:s.zM(),origin:bl,publisher:bh.optional(),publisherKind:bk.optional(),ruleCount:s.ai().int().nonnegative(),namespace:bh,packId:bi,policyId:s.Yj().optional(),latestVersion:bj.optional()}).meta({id:"DetectionListItem"});s.Ik({counts:bo,items:s.YO(bp)}).meta({id:"ListDetectionsResponse"}),s.Ik({filter:bm.optional().default("all"),q:s.Yj().optional()}),s.Ik({detections:s.ai().int().nonnegative(),rules:s.ai().int().nonnegative(),active:s.ai().int().nonnegative(),findingsLast30d:s.ai().int().nonnegative()}).meta({id:"DetectionStats"});let bq=s.Ik({id:s.Yj(),name:s.Yj(),category:v,severity:w,matcher:aP}).meta({id:"DetectionRule"}),br=s.Ik({available:s.zM(),latestVersion:bj,latestRuleCount:s.ai().int().nonnegative().optional()}).nullable().meta({id:"DetectionUpdate"});s.Ik({id:s.Yj(),name:s.Yj(),version:bj,enabled:s.zM(),origin:bl,publisher:bh.optional(),publisherKind:bk.optional(),ruleCount:s.ai().int().nonnegative(),namespace:bh,packId:bi,description:s.Yj().optional(),editedAt:t.w$(),findingsLast30d:s.ai().int().nonnegative(),latestVersion:bj.nullable().optional(),update:br,rules:s.YO(bq),modified:s.zM(),policyId:s.Yj().optional()}).meta({id:"DetectionDetail"});let bs=s.Ik({id:s.Yj(),name:s.Yj(),publisher:bh,publisherKind:bk.optional(),category:v.optional(),version:bj,ruleCount:s.ai().int().nonnegative(),description:s.Yj().optional(),updatedAt:t.w$(),state:bn,importedAs:s.Yj().nullable()}).meta({id:"LibraryItem"});function bt(a){return{id:`${a.namespace}/${a.packId}`,name:a.name,version:a.version,enabled:a.enabled,origin:"library",namespace:a.namespace,packId:a.packId,ruleCount:a.ruleCount,...null!=a.policyId?{policyId:a.policyId}:{},...null!=a.latestVersion?{latestVersion:a.latestVersion}:{}}}function bu(a,b,c){let d=a.rules.flatMap(a=>{let b=aP.safeParse(a.matcher);return b.success?[{id:a.id,name:a.name,category:a.category,severity:a.severity,matcher:b.data}]:[]});return{id:`${a.namespace}/${a.packId}`,name:a.name,version:a.version,enabled:a.enabled,origin:"library",namespace:a.namespace,packId:a.packId,ruleCount:a.rules.length,editedAt:a.updatedAt.toISOString(),findingsLast30d:b,latestVersion:c?c.latestVersion:null,update:c,rules:d,modified:!1,...null!=a.policyId?{policyId:a.policyId}:{}}}function bv(a){let b=a.indexOf("/");return b<1||b===a.length-1?null:{namespace:a.slice(0,b),packId:a.slice(b+1)}}function bw(a,b){let c=a.filter(a=>null!=a.latestVersion),d={all:a.length,library:a.length,custom:0,customized:0,updates:c.length},e=b.filter,f="custom"===e||"customized"===e?[]:"updates"===e?[...c]:[...a];if(b.q){let a=b.q.toLowerCase();f=f.filter(b=>b.name.toLowerCase().includes(a)||b.packId.toLowerCase().includes(a)||b.namespace.toLowerCase().includes(a))}return f.sort((a,b)=>a.enabled!==b.enabled?a.enabled?-1:1:a.name.localeCompare(b.name)),{counts:d,items:f.map(bt)}}s.Ik({categories:s.YO(v),items:s.YO(bs)}).meta({id:"ListLibraryResponse"}),s.Ik({libraryId:s.Yj().refine(a=>/^[^/]+\/[^/]+$/.test(a),{message:"libraryId must be in namespace/packId format"})}).meta({id:"ImportDetectionRequest"});let bx=s.k5(["provider","internal","external","ip"]).meta({id:"DestinationKind"}),by=s.k5(["https","http","sftp","grpc","smtp","ws","wss"]).meta({id:"Transport"}),bz=s.k5(["secrets","pii","customer","source","telemetry","logs","metrics","none"]).meta({id:"DataClass"}),bA=bz.options,bB=s.k5(["recognized","internal","unverified","ip"]).meta({id:"ShareTrustLevel"}),bC=s.k5(["allow","block"]).meta({id:"EgressDecision"}),bD=s.k5(["allowed","blocked","review"]).meta({id:"EgressStatus"}),bE=s.k5(["raw_ip","unverified_domain","plaintext_transport"]).meta({id:"ReviewReason"}),bF=s.k5(["GET","POST","PUT","DELETE","SDK","REF"]).meta({id:"HttpMethod"}),bG=s.Ik({needsReview:s.zM(),reasons:s.YO(bE)}).meta({id:"ReviewInfo"}),bH=s.Ik({port:s.ai().int().nullable(),geo:s.Yj().nullable(),ptr:s.Yj().nullable()}).meta({id:"DestinationNetwork"}),bI=s.Ik({id:s.Yj(),method:bF,transport:by,url:s.Yj(),template:s.zM(),dataClass:bz,lastSeen:t.w$(),callSiteCount:s.ai().int().nonnegative()}).meta({id:"EndpointSummary"}),bJ=s.Ik({id:s.Yj(),project:s.Yj(),file:s.Yj(),line:s.ai().int().nonnegative(),snippet:s.Yj(),dynamic:s.zM(),vendored:s.zM(),projectId:s.Yj().nullable()}).meta({id:"CallSite"}),bK=bI.extend({sites:s.YO(bJ)}).meta({id:"EndpointWithSites"}),bL=s.Ik({id:s.Yj(),kind:bx,name:s.Yj(),host:s.Yj(),category:s.Yj(),trust:bB,status:bD,isCustom:s.zM(),lastSeen:t.w$(),endpointCount:s.ai().int().nonnegative(),callSiteCount:s.ai().int().nonnegative(),transports:s.YO(by),dataClasses:s.YO(bz),review:bG,network:bH.nullable(),endpoints:s.YO(bI)}).meta({id:"ShareDestinationSummary"});bL.omit({endpointCount:!0,callSiteCount:!0,endpoints:!0}).extend({note:s.Yj().nullable(),endpoints:s.YO(bK)}).meta({id:"ShareDestinationDetail"});let bM=s.Ik({id:s.Yj(),kind:bx,name:s.Yj(),host:s.Yj(),trust:bB,status:bD,review:bG,topDataClass:bz,callSiteCount:s.ai().int().nonnegative(),lastSeen:t.w$()}).meta({id:"ReviewDestination"}),bN=s.Ik({kind:bx,total:s.ai().int().nonnegative(),items:s.YO(bL)}).meta({id:"ShareDestinationGroup"});s.Ik({groups:s.YO(bN)}).meta({id:"ListShareDestinationsResponse"}),s.Ik({items:s.YO(bM)}).meta({id:"NeedsReviewResponse"}),s.Ik({destinations:s.ai().int().nonnegative(),endpoints:s.ai().int().nonnegative(),callSites:s.ai().int().nonnegative(),needsReview:s.ai().int().nonnegative(),insecure:s.ai().int().nonnegative(),byKind:s.Ik({provider:s.ai().int().nonnegative(),internal:s.ai().int().nonnegative(),external:s.ai().int().nonnegative(),ip:s.ai().int().nonnegative()}),byTrust:s.Ik({recognized:s.ai().int().nonnegative(),internal:s.ai().int().nonnegative(),unverified:s.ai().int().nonnegative(),ip:s.ai().int().nonnegative()})}).meta({id:"SharesStats"}),s.Ik({decision:bC.nullable()}).meta({id:"SetEgressDecisionBody"}),s.Ik({destination:bL}).meta({id:"SetEgressDecisionResponse"}),s.Ik({q:s.Yj().optional(),kind:s.YO(bx).optional(),groupBy:s.k5(["destination"]).default("destination"),review:s.uE().default(!1)}),s.Ik({format:s.k5(["csv","json"]).default("csv"),q:s.Yj().optional(),kind:s.YO(bx).optional()});let bO=s.k5(["npm","pypi","go","maven","rubygems","cargo","composer","nuget"]).meta({id:"EgressEcosystem"});s.Ik({id:s.Yj(),name:s.Yj(),category:s.Yj(),hostSuffixes:s.YO(s.Yj()).min(1),apiBase:s.Yj(),defaultDataClasses:s.YO(bz).min(1),sdks:s.jg(bO,s.YO(s.Yj()))}).meta({id:"ProviderRegistryEntry"});let bP=s.Ik({file:s.Yj(),line:s.ai().int().positive(),snippet:s.Yj(),dynamic:s.zM(),vendored:s.zM()}).meta({id:"EgressCallSiteHit"}),bQ=s.Ik({host:s.Yj(),kind:bx,name:s.Yj(),category:s.Yj(),trust:bB,network:bH.nullable(),method:bF,transport:by,url:s.Yj(),template:s.zM(),dataClass:bz,site:bP}).meta({id:"ResolvedEgressHit"}),bR=s.gM("mode",[s.Ik({mode:s.eu("walk"),walkedPrefix:s.Yj()}),s.Ik({mode:s.eu("ledger"),scannedFiles:s.YO(s.Yj()),deletedFiles:s.YO(s.Yj())})]).meta({id:"EgressReconcile"});function bS(a){return({log:"monitored",block:"blocked",redact:"redacted",warn:"warned",allow:"allowed"})[a]??"allowed"}function bT(a){return P[a]??"api"}s.Ik({projectKey:s.Yj().min(1),project:s.Yj(),projectId:s.Yj().nullable(),reconcile:bR,hits:s.YO(bQ)}).meta({id:"RecordProjectEgressInput"}),s.Ik({destinations:s.ai().int().nonnegative(),endpoints:s.ai().int().nonnegative(),callSites:s.ai().int().nonnegative(),truncated:s.zM(),droppedFiles:s.YO(s.Yj()).default([])}).meta({id:"EgressWriteSummary"});let bU=["open","handled","dismissed","resolved"];function bV(a){return"code_change"!==a.kind?"handled":null===a.findingKey?"open":"resolved"===a.latestResolutionStatus?"resolved":"dismissed"===a.latestResolutionStatus?"dismissed":"open"}function bW(a,b={}){let c=b.overrides,d=b.packNames,e=b.aggregates,f=new Map;for(let b of a){let a=f.get(b.ruleId);a?a.push(b):f.set(b.ruleId,[b])}let g=[];for(let[a,b]of f){var h;let f=b.map(a=>{let b=c?.get(a.id)??a.actionTaken;return{id:a.id,provider:bT(a.sourceTool),repo:a.repo,file:a.file,...void 0===a.toolName?{}:{toolName:a.toolName},action:bS(b),detectedAt:a.occurredAt,confidence:a.confidence,status:a.status}}),i=e?.get(a),j=i?.latestDetectedAt??b.reduce((a,b)=>b.occurredAt>a?b.occurredAt:a,b[0]?.occurredAt??new Date(0).toISOString()),k=new Set,l=(i?[...new Set(i.sourceTools.map(bT))].sort():f.map(a=>a.provider)).filter(a=>!k.has(a)&&(k.add(a),!0)),m=new Set(i?i.actionsTaken.map(bS):f.map(a=>a.action)),n=1===m.size?[...m][0]??null:null,o=b[0]?.severity??"low",p={id:a,name:d?.get(a)??null},q="code_context"===(h=b[0]?.category??"custom")?"source_code":h,r={id:`category:${q}`,name:q},s={maskedValue:b[0]?.maskedMatch??"",contextPrefix:""},t=function(a){let b=new Set(a.filter(a=>void 0!==a));if(0!==b.size){for(let a of bU)if(b.has(a))return a}}(i?i.statusInputs.map(bV):f.map(a=>a.status)),u={id:a,category:q,subtype:a,severity:o,match:s,detection:p,policy:r,instanceCount:i?.instanceCount??f.length,providers:l,aggregateAction:n,latestDetectedAt:j,instances:f,status:t};i&&(bZ.set(u,[...m]),void 0!==i.searchText&&bX.set(u,bY(u,i.searchText))),g.push(u)}return g}let bX=new WeakMap;function bY(a,b){return[a.subtype,a.category,a.match.maskedValue,a.policy.name,a.id,...a.instances.map(a=>a.repo),...a.instances.map(a=>a.file),...a.instances.map(a=>a.toolName?`via ${a.toolName}`:""),...a.instances.map(a=>a.id),...void 0===b?[]:[b]].join(" ").toLowerCase()}let bZ=new WeakMap;function b$(a){let b=bZ.get(a);if(void 0!==b)return b;let c=[...new Set(a.instances.map(a=>a.action))];return bZ.set(a,c),c}function b_(a,b){let c=new Set(b),d=0;for(let b of a){if(void 0===b.count)return null;c.has(bV(b))&&(d+=b.count)}return d}function b0(a,b){let c=a;if(b.severity&&b.severity.length>0){let a=new Set(b.severity);c=c.filter(b=>a.has(b.severity))}if(b.providers&&b.providers.length>0){let a=new Set(b.providers);c=c.filter(b=>b.providers.some(b=>a.has(b)))}if(b.actions&&b.actions.length>0){let a=new Set(b.actions);c=c.filter(b=>b$(b).some(b=>a.has(b)))}if(b.subtype&&b.subtype.length>0){let a=new Set(b.subtype);c=c.filter(b=>a.has(b.subtype))}if(b.statuses&&b.statuses.length>0){let a=new Set(b.statuses);c=c.filter(b=>void 0!==b.status&&a.has(b.status))}if(b.q){let a=b.q.toLowerCase();c=c.filter(b=>(function(a){let b=bX.get(a);if(void 0!==b)return b;let c=bY(a);return bX.set(a,c),c})(b).includes(a))}return c}let b1={critical:0,high:1,medium:2,low:3};function b2(a){return[...a].sort((a,b)=>{let c=(b1[a.severity]??-1)-(b1[b.severity]??-1);return 0!==c?c:b.latestDetectedAt.localeCompare(a.latestDetectedAt)})}function b3(a,b){let c=b0(a,{providers:b.providers,actions:b.actions,statuses:b.statuses,q:b.q,subtype:b.subtype}),d=new Map;for(let a of c)d.set(a.severity,(d.get(a.severity)??0)+1);let e=b0(a,{actions:b.actions,statuses:b.statuses,q:b.q,subtype:b.subtype,severity:b.severity}),f=new Map;for(let a of e)for(let b of a.providers)f.set(b,(f.get(b)??0)+1);let g=b0(a,{providers:b.providers,statuses:b.statuses,q:b.q,subtype:b.subtype,severity:b.severity}),h=new Map;for(let a of g)for(let b of b$(a))h.set(b,(h.get(b)??0)+1);let i=b0(a,{providers:b.providers,actions:b.actions,statuses:b.statuses,q:b.q,severity:b.severity}),j=new Map;for(let a of i)j.set(a.subtype,(j.get(a.subtype)??0)+1);let k=b0(a,{providers:b.providers,actions:b.actions,q:b.q,subtype:b.subtype,severity:b.severity}),l=new Map;for(let a of k)void 0!==a.status&&l.set(a.status,(l.get(a.status)??0)+1);let m=a=>[...a.entries()].map(([a,b])=>({value:a,count:b}));return{severity:m(d),provider:m(f),action:m(h),subtype:m(j),status:m(l)}}let b4=s.Ik({id:s.Os(),namespace:bh,packId:bi,version:bj,name:s.Yj(),enabled:s.zM().default(!0),policyId:s.Yj().optional()}).meta({id:"InstalledPack"});s.Ik({namespace:bh,packId:bi,version:bj}).meta({id:"InstallPackRequest"}),s.Ik({items:s.YO(b4)}).meta({id:"ListInstalledPacksResponse"}),s.Ik({enabled:s.zM().optional(),policyId:s.Yj().nullable().optional()}).refine(a=>Object.keys(a).some(b=>void 0!==a[b]),{message:"At least one field must be provided"}).meta({id:"PatchInstalledPackRequest"});let b5=1,b6=s.k5(["standalone"]),b7=s.k5(["redact","warn"]),b8=s.k5(["full","session-only"]),b9=s.Ik({acknowledgedAt:t.w$(),payloadVersion:s.ai().int().positive()}),ca=s.Ik({specVersion:s.ai().int().positive().default(4),runMode:s.vk(a=>"attached"===a?"standalone":a,b6.default("standalone")),policy:b7.default("redact"),historicalAccess:b8.default("session-only"),dataSharesInPlace:s.zM().default(!0),onboardedAt:t.w$().optional(),modelJudgeConsent:b9.optional()});function cb(){return ca.parse({})}function cc(a,b,c){return{id:b,objectType:a.objectType,location:a.location??null,title:a.title??null,hostId:a.hostId??null,attributes:JSON.stringify(a.attributes),firstSeen:c,lastSeen:c}}function cd(a,b,c){return{id:b,url:a.url,name:a.name??null,attributes:JSON.stringify(a.attributes),firstSeen:c,lastSeen:c}}function ce(a){return{id:a.id,parentId:a.parentId??null,rootSessionId:a.rootSessionId??null,eventType:a.eventType,hostId:a.hostId??null,harnessId:a.harnessId??null,sourceProjectId:a.sourceProjectId??null,startedAt:g(a.startedAt),endedAt:a.endedAt?g(a.endedAt):null,severity:a.severity??null,priority:a.priority??null,content:a.content??null,contentHash:a.contentHash??null,attributes:a.attributes?JSON.stringify(a.attributes):null}}function cf(a,b){return{id:b,class:a.class,label:a.label??null,attributes:a.attributes?JSON.stringify(a.attributes):null}}function cg(a,b){return{id:b,ruleId:a.ruleId,name:a.name,category:a.category,severity:a.severity,definition:a.definition,version:a.version}}function ch(a){return{id:a.id,auditEventId:a.auditEventId,inspectionDefinitionId:a.inspectionDefinitionId,classifiedDataId:a.classifiedDataId??null,spanStart:a.span.start,spanEnd:a.span.end,maskedMatch:a.maskedMatch,actionTaken:a.actionTaken,confidence:a.confidence,findingKey:a.findingKey??null,firstDetectedAt:a.firstDetectedAt?g(a.firstDetectedAt):null}}function ci(a){let b=a.metadata;return{source_tool:a.sourceTool,...b?.repo!==void 0?{repo:b.repo}:{},...b?.filePath!==void 0?{file_path:b.filePath}:{},...b?.toolName!==void 0?{tool_name:b.toolName}:{},...b?.gitignored!==void 0?{gitignored:b.gitignored}:{},...b?.wholeFile!==void 0?{whole_file:b.wholeFile}:{},...b?.correlationId!==void 0?{correlation_id:b.correlationId}:{},...b?.traceId!==void 0?{trace_id:b.traceId}:{},...b?.exceptionIds!==void 0?{exception_ids:b.exceptionIds}:{},...b?.model!==void 0?{model:b.model}:{},...b?.turnIndex!==void 0?{turn_index:b.turnIndex}:{}}}function cj(a){return`capture/${a.category}/${a.severity}`}function ck(a){return{ruleId:a.ruleId,version:cj(a),name:a.ruleId,category:a.category,severity:a.severity,definition:JSON.stringify({ruleId:a.ruleId})}}let cl=s.Ik({path:s.Yj().min(1),name:s.Yj().min(1),origin:aq,defaultAccess:ap});s.Ik({files:s.YO(cl),truncated:s.zM(),scannedAt:s.Yj()});let cm=["7d","30d","3m","6m"],cn=s.k5(cm).meta({id:"TimeRange"}),co={"7d":7,"30d":30,"3m":90,"6m":180};cn.catch("7d");let cp=s.k5(["still-valid","unknown","invalid"]),cq=s.Ik({filePath:s.Yj(),span:z.optional()}).strict(),cr=s.Ik({provider:s.Yj(),maskedToken:s.Yj(),where:cq,state:cp,observedAt:t.w$().optional()}).strict();s.Ik({provider:s.Yj(),maskedToken:s.Yj(),consolePath:s.Yj(),occurrenceSpread:s.ai().int().positive()}).strict();let cs=s.k5(["redact-rotation-checklist","redact-only","set-secret-redact","leave"]),ct=s.k5(["first-run","pre-push","secret-scan"]);s.Ik({entrySource:ct}).strict();let cu=s.Ik({id:cs,label:s.Yj()}),cv=s.Ik({kind:s.eu("decision"),entrySource:ct,secretCount:s.ai().int().positive(),prompt:s.Yj(),options:s.PV([cu.extend({id:s.eu("redact-rotation-checklist")}),cu.extend({id:s.eu("redact-only")}),cu.extend({id:s.eu("set-secret-redact")}),cu.extend({id:s.eu("leave")})])}),cw=s.Ik({kind:s.eu("no-decision")});s.gM("kind",[cv,cw]),s.Ik({rules:s.YO(aU).min(1).max(100),text:s.Yj().max(5e4).optional(),fixtures:s.YO(aT).max(200).optional()}).refine(a=>void 0!==a.text||(a.fixtures?.length??0)>0,{message:"Provide `text`, `fixtures`, or both — there must be something to test"}).meta({id:"TestRulesRequest"});let cx=s.Ik({ruleId:s.Yj(),category:v,severity:w,span:z,confidence:s.ai().min(0).max(1),match:s.Yj()}).meta({id:"RuleTestMatch"}),cy=s.Ik({label:s.Yj(),shouldMatch:s.zM(),didMatch:s.zM(),passed:s.zM(),matches:s.YO(cx)}).meta({id:"FixtureResult"});s.Ik({adhoc:s.Ik({matches:s.YO(cx)}).optional(),fixtures:s.YO(cy),summary:s.Ik({total:s.ai().int().nonnegative(),passed:s.ai().int().nonnegative(),failed:s.ai().int().nonnegative()}),unsupportedRuleIds:s.YO(s.Yj())}).meta({id:"TestRulesResponse"});let cz=s.Ik({severity:w,count:s.ai().int().nonnegative(),caught:s.ai().int().nonnegative().optional(),openAtRest:s.ai().int().nonnegative().optional()}).meta({id:"SeveritySummaryItem"});s.Ik({total:s.ai().int().nonnegative(),needsRemediation:s.ai().int().nonnegative().optional(),bySeverity:s.YO(cz)}).meta({id:"SeveritySummaryResponse"}),s.Ik({range:s.k5(cm).default("7d")});let cA=s.k5(["blocked","redacted","warned"]).meta({id:"EnforcementActionKind"}),cB=s.Ik({kind:cA,count:s.ai().int().nonnegative(),delta:s.ai().int()}).meta({id:"EnforcementAction"});s.Ik({range:cn,total:s.ai().int().nonnegative(),actions:s.YO(cB)}).meta({id:"EnforcementActionsResponse"});let cC=s.k5(["day","week"]).meta({id:"TimeseriesGranularity"}),cD=s.Ik({timestamp:t.p6(),critical:s.ai().int().nonnegative(),high:s.ai().int().nonnegative(),medium:s.ai().int().nonnegative()}).meta({id:"FindingsTimeseriesPoint"});s.Ik({range:cn,granularity:cC,points:s.YO(cD)}).meta({id:"FindingsTimeseriesResponse"});let cE=s.Ik({timestamp:t.p6(),bySeverity:s.Ik({critical:s.ai().nonnegative().nullable(),high:s.ai().nonnegative().nullable(),medium:s.ai().nonnegative().nullable(),low:s.ai().nonnegative().nullable()})}).meta({id:"MttrTrendPoint"});s.Ik({range:cn,granularity:cC,points:s.YO(cE)}).meta({id:"MttrTrendResponse"});let cF=s.Ik({findingKey:s.Yj(),ruleId:s.Yj(),severity:w,path:s.Yj(),resolvedAt:t.w$(),detectedAt:t.w$()}).meta({id:"ResolvedFeedItem"});s.Ik({items:s.YO(cF)}).meta({id:"RecentlyResolvedResponse"});let cG=["repo","user"],cH=s.k5(cG).meta({id:"SourceKind"}),cI=s.Ik({id:s.Yj(),name:s.Yj(),kind:cH,findingsCount:s.ai().int().nonnegative()}).meta({id:"TopSource"});s.Ik({range:cn,items:s.YO(cI)}).meta({id:"TopSourcesResponse"}),s.Ik({range:s.k5(cm).default("7d"),limit:u.ai().int().min(1).max(50).default(5),kind:s.k5(cG).optional()});let cJ=s.k5(["claudecode","cursor","codex","chatgpt","copilot","api"]).meta({id:"Provider"}),cK=s.Ik({provider:cJ,coverage:s.ai().int().min(0).max(100),supported:s.zM()}).meta({id:"ScanCoverageProvider"});s.Ik({range:cn,providers:s.YO(cK)}).meta({id:"ScanCoverageResponse"});let cL=s.k5(["repo","user","team","policy","share","rule"]).meta({id:"SubjectType"}),cM=s.Ik({type:cL,id:s.Yj(),label:s.Yj()}).meta({id:"RecommendationSubject"}),cN=s.k5(["apply","navigate"]).meta({id:"RecommendationActionMode"}),cO=s.Ik({mode:cN,type:s.Yj(),label:s.Yj(),href:s.Yj().optional(),policyId:s.Yj().optional(),teamId:s.Yj().optional()}).meta({id:"RecommendationAction"}),cP=s.Ik({id:s.Yj(),category:s.Yj(),severity:w,title:s.Yj(),description:s.Yj(),subjects:s.YO(cM),action:cO}).meta({id:"RecommendedAction"});s.Ik({items:s.YO(cP)}).meta({id:"RecommendedActionsResponse"}),s.Ik({limit:u.ai().int().min(1).max(20).default(3)});let cQ=s.Ik({type:s.Yj(),policyId:s.Yj().optional(),teamId:s.Yj().optional()}).meta({id:"AppliedAction"});s.Ik({id:s.Yj(),status:s.eu("applied"),appliedAction:cQ}).meta({id:"ApplyRecommendedActionResponse"}),s.Ik({id:s.Yj(),status:s.eu("dismissed")}).meta({id:"DismissRecommendedActionResponse"}),s.Ik({id:s.Yj()}),s.Ik({ruleId:s.Yj(),category:v,severity:w,maskedMatch:s.Yj(),rawMatch:s.Yj(),context:s.Yj(),filePath:s.Yj().optional(),confidence:s.ai().min(0).max(1),id:s.Yj().optional(),valueFingerprint:s.Yj().optional(),keyVersion:s.ai().int().nonnegative().optional()});let cR=s.Ik({category:v,action:a2,reasoning:s.Yj(),genuineCount:s.ai().int().nonnegative(),fpCount:s.ai().int().nonnegative(),fpIds:s.YO(s.Yj())});s.Ik({perCategory:s.YO(cR),notes:s.Yj()});let cS=s.Ik({total:s.ai().int().nonnegative(),important:s.ai().int().nonnegative(),routine:s.ai().int().nonnegative()}).refine(a=>a.total===a.important+a.routine,{message:"total must equal important + routine",path:["total"]}),cT=s.Ik({ruleId:s.Yj(),category:v,valueFingerprint:s.Yj(),keyVersion:s.ai().int().nonnegative()}),cU=s.Ik({pattern:s.Yj(),count:s.ai().int().nonnegative(),values:s.YO(cT).min(1)}),cV=s.Ik({category:v,count:s.ai().int().nonnegative(),egress:s.zM()}),cW=s.Ik({counts:cS,routineCategories:s.YO(v),surfacedCategories:s.YO(v),findingKinds:s.YO(cV),posture:s.g1(v,a2),maskedFindings:s.YO(cr).optional(),falsePositivePatterns:s.YO(cU).optional()}),cX=cR.pick({category:!0,genuineCount:!0,fpCount:!0}).extend({egress:s.zM()});s.Ik({categories:s.YO(cX),posture:s.g1(v,a2)}),s.Ik({frame:cW,copy:s.Yj()}),s.k5(["scan","floor"]);let cY=s.Ik({id:s.k5(["enter-remediation","open-dashboard","not-now"]),label:s.Yj()}),cZ=s.PV([cY.extend({id:s.eu("open-dashboard")}),cY.extend({id:s.eu("not-now")})]),c$=s.PV([cY.extend({id:s.eu("enter-remediation")}),cY.extend({id:s.eu("open-dashboard")}),cY.extend({id:s.eu("not-now")})]);s.Ik({worthALook:s.ai().int().nonnegative(),liveKeys:s.ai().int().nonnegative().optional(),options:s.KC([cZ,c$])}).refine(a=>a.options.some(a=>"enter-remediation"===a.id)===(a.liveKeys??0)>0,{message:"the chain-entry option is present exactly when liveKeys > 0",path:["options"]}).refine(a=>(a.liveKeys??0)<=a.worthALook,{message:"liveKeys is a subset of worthALook and cannot exceed it",path:["liveKeys"]});let c_=new Set(["recognized","internal"]);function c0(a){return c_.has(a)?"allowed":"review"}function c1(a){return"block"===a?"blocked":"allowed"}function c2(a,b){return null===b?c0(a):c1(b)}function c3(a,b){return null!==b&&c1(b)!==c0(a)}function c4(a,b){let c=function(a,b){let c=[];return"ip"===a&&c.push("raw_ip"),"unverified"===a&&c.push("unverified_domain"),(b.includes("http")||b.includes("ws"))&&c.push("plaintext_transport"),c}(a,b);return{needsReview:c.length>0,reasons:c}}function c5(a){return Array.from(new Set(a))}function c6(a){let b=new Set(a);return bA.filter(a=>b.has(a))}function c7(a){return c6(a)[0]??"none"}let c8={raw_ip:0,unverified_domain:1,plaintext_transport:2};function c9(a){return 0===a.length?1/0:Math.min(...a.map(a=>c8[a]))}}};