@shield-agent/kya 0.21.0 → 0.22.0

package/dist/telemetry.js

@@ -0,0 +1,427 @@
+/**
+ * Opt-in anonymous usage telemetry (`kya telemetry`). Off until the user says yes.
+ *
+ * What it is: a start / heartbeat / end beacon from the LONG-LIVED KYA processes (MCP gate over
+ * stdio or http, the report daemon, the gateway supervisor) so the maintainers can see how many
+ * installs are live, which versions and platforms run, and how long sessions last.
+ *
+ * `kya hook` is spawn-per-tool-call and stays network-free: when the user opted in, it spawns a
+ * detached helper (`kya telemetry ping`) at most once a day and returns immediately, so installs that
+ * only use hooks still show up as active. The hook itself never waits on the network. The beacon is
+ * not imported by the SDK surface (`src/sdk`), which promises no telemetry or network clients.
+ *
+ * Hard rules (see docs/telemetry.md):
+ *  - consent is an explicit `y`/`yes` (default NO), asked once, interactive terminals only, on
+ *    stderr, never in `--json` mode and never from an MCP stdio process (stdout is its protocol);
+ *  - nothing is sent in CI or when DO_NOT_TRACK / KYA_TELEMETRY=0 is set;
+ *  - the payload is a fixed allow-list (see {@link buildPayload}); no paths, names, args, prompts;
+ *  - a failed send never affects the CLI: short timeout, errors swallowed on purpose, three
+ *    consecutive failures stop the beacon for the rest of the process.
+ *
+ * `KYA_OFFLINE` deliberately does NOT block telemetry: it is documented as "sample evaluate", and
+ * `kya connect` writes KYA_OFFLINE=1 into every MCP host config, so honouring it would silence every
+ * session a connected host launches even for someone who answered yes.
+ */
+import { randomUUID } from "node:crypto";
+import { spawn } from "node:child_process";
+import { mkdirSync, readFileSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { createInterface } from "node:readline";
+import { join } from "node:path";
+import { globalConfigDir, resolveGateMode } from "./config.js";
+import { atomicWriteSync } from "./fs-atomic.js";
+import { CLI_VERSION } from "./version.js";
+export const DEFAULT_TELEMETRY_ENDPOINT = "https://shield-agent.com/api/v1/telemetry/kya";
+const SEND_TIMEOUT_MS = 3_000;
+const DEFAULT_HEARTBEAT_MS = 5 * 60_000;
+const MAX_CONSECUTIVE_FAILURES = 3;
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const OFF_RE = /^(0|false|no|off)$/i;
+const truthy = (value) => value !== undefined && value.trim() !== "" && !OFF_RE.test(value.trim());
+// ---------------------------------------------------------------------------------------------
+// State (~/.kya/telemetry.json)
+// ---------------------------------------------------------------------------------------------
+export function telemetryStatePath(env) {
+    return join(globalConfigDir(env), "telemetry.json");
+}
+/** Tolerant read: a missing, corrupt or hand-edited file is "never asked", never an error. */
+export function readTelemetryState(env) {
+    try {
+        const raw = JSON.parse(readFileSync(telemetryStatePath(env), "utf8"));
+        return {
+            ...(typeof raw["enabled"] === "boolean" ? { enabled: raw["enabled"] } : {}),
+            ...(typeof raw["installId"] === "string" && UUID_RE.test(raw["installId"])
+                ? { installId: raw["installId"].toLowerCase() }
+                : {}),
+            ...(typeof raw["askedAt"] === "string" ? { askedAt: raw["askedAt"] } : {}),
+        };
+    }
+    catch {
+        return {};
+    }
+}
+export function writeTelemetryState(env, state) {
+    mkdirSync(globalConfigDir(env), { recursive: true, mode: 0o700 });
+    atomicWriteSync(telemetryStatePath(env), `${JSON.stringify(state, null, 2)}\n`);
+}
+// ---------------------------------------------------------------------------------------------
+// Gates
+// ---------------------------------------------------------------------------------------------
+/** Why telemetry is forced off for THIS process regardless of the saved answer, or undefined. */
+export function telemetryDisabledReason(env) {
+    if (truthy(env["DO_NOT_TRACK"]))
+        return "DO_NOT_TRACK is set";
+    if (env["KYA_TELEMETRY"] !== undefined && OFF_RE.test(env["KYA_TELEMETRY"].trim())) {
+        return "KYA_TELEMETRY is off";
+    }
+    if (truthy(env["CI"]) || env["GITHUB_ACTIONS"] === "true")
+        return "running in CI";
+    return undefined;
+}
+/** True only when the user opted in AND nothing overrides it for this process. */
+export function isTelemetryEnabled(env) {
+    if (telemetryDisabledReason(env) !== undefined)
+        return false;
+    const state = readTelemetryState(env);
+    return state.enabled === true && state.installId !== undefined;
+}
+/** https, or http on a loopback host (tests, self-hosting). Anything else falls back to the default. */
+export function telemetryEndpoint(env) {
+    const raw = env["KYA_TELEMETRY_URL"]?.trim();
+    if (raw) {
+        try {
+            const url = new URL(raw);
+            const loopback = ["127.0.0.1", "localhost", "[::1]"].includes(url.hostname);
+            const credentials = url.username !== "" || url.password !== "";
+            if (!credentials && (url.protocol === "https:" || (url.protocol === "http:" && loopback))) {
+                return url.toString();
+            }
+        }
+        catch {
+            /* unparsable override: use the default */
+        }
+    }
+    return DEFAULT_TELEMETRY_ENDPOINT;
+}
+function eraseEndpoint(env) {
+    return `${telemetryEndpoint(env).replace(/\/+$/, "")}/erase`;
+}
+// ---------------------------------------------------------------------------------------------
+// Payload
+// ---------------------------------------------------------------------------------------------
+/** Host registry slug from the session id `kya connect` writes (`mcp:<host>`), else "unknown". */
+export function telemetryHostId(env) {
+    const match = /^mcp:([a-z][a-z0-9-]{0,31})$/.exec(env["KYA_SESSION_ID"] ?? "");
+    return match?.[1] ?? "unknown";
+}
+/**
+ * The ONLY fields that ever leave the machine. A test pins this exact key set; adding a field here
+ * is a privacy change that needs the server validator, docs/telemetry.md and the privacy page updated.
+ */
+export function buildPayload(input) {
+    return {
+        schema: 1,
+        installId: input.installId,
+        sessionId: input.sessionId,
+        event: input.event,
+        surface: input.surface,
+        cliVersion: CLI_VERSION,
+        os: process.platform,
+        arch: process.arch,
+        nodeMajor: Number.parseInt(process.versions.node, 10),
+        hostId: telemetryHostId(input.env),
+        gateMode: resolveGateMode({ cwd: input.cwd, env: input.env }),
+        hostedLinked: (input.env["KYA_API_KEY"] ?? "").trim() !== "",
+    };
+}
+/**
+ * POST one JSON body. Returns whether the server accepted it. Never throws: telemetry must not be
+ * able to change what the CLI does, so every failure (network, timeout, redirect, non-2xx) is just
+ * `false`. The deliberate swallow is the whole point of this function.
+ */
+export async function postTelemetry(url, body, fetchImpl = fetch) {
+    try {
+        const res = await fetchImpl(url, {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                "user-agent": `shield-agent-kya-cli/${CLI_VERSION}`,
+            },
+            body: JSON.stringify(body),
+            redirect: "error",
+            signal: AbortSignal.timeout(SEND_TIMEOUT_MS),
+        });
+        return res.ok;
+    }
+    catch {
+        return false;
+    }
+}
+const NOOP_BEACON = { stop: async () => { } };
+function heartbeatMs(env, override) {
+    if (override !== undefined)
+        return override;
+    // Test/diagnostic knob, clamped so a typo cannot turn the beacon into a flood.
+    const raw = Number(env["KYA_TELEMETRY_INTERVAL_MS"]);
+    return Number.isFinite(raw) && raw >= 100 && raw <= 3_600_000 ? raw : DEFAULT_HEARTBEAT_MS;
+}
+/**
+ * Start reporting for one long-lived process. A no-op unless the user opted in and nothing overrides
+ * it. Writes NOTHING to stdout or stderr (an MCP stdio process owns stdout as its protocol channel).
+ */
+export function startSessionBeacon(surface, deps) {
+    if (!isTelemetryEnabled(deps.env))
+        return NOOP_BEACON;
+    const installId = readTelemetryState(deps.env).installId;
+    const sessionId = randomUUID();
+    const url = telemetryEndpoint(deps.env);
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    let failures = 0;
+    let stopped = false;
+    const send = async (event) => {
+        if (failures >= MAX_CONSECUTIVE_FAILURES)
+            return;
+        const ok = await postTelemetry(url, buildPayload({ installId, sessionId, event, surface, env: deps.env, cwd: deps.cwd }), fetchImpl);
+        failures = ok ? 0 : failures + 1;
+    };
+    void send("start");
+    const timer = setInterval(() => {
+        void send("heartbeat");
+    }, heartbeatMs(deps.env, deps.intervalMs));
+    timer.unref();
+    return {
+        async stop() {
+            if (stopped)
+                return;
+            stopped = true;
+            clearInterval(timer);
+            await send("end");
+        },
+    };
+}
+// ---------------------------------------------------------------------------------------------
+// Hook ping (hook-only installs have no long-lived process to heartbeat from)
+// ---------------------------------------------------------------------------------------------
+/** At most one ping per this window, however many tool calls fire the hook. */
+export const HOOK_PING_INTERVAL_MS = 24 * 60 * 60_000;
+/** Its mtime is the time of the last ping attempt. Content is empty: nothing to leak or corrupt. */
+export function hookPingStampPath(env) {
+    return join(globalConfigDir(env), "telemetry-ping");
+}
+/**
+ * Claims today's ping slot: true for exactly one caller per interval. A fresh stamp means someone
+ * already did; a stale one is removed and re-created with an exclusive create (`wx`), so of several
+ * hooks racing on a stale stamp only the one whose create succeeds gets the slot.
+ */
+export function claimHookPingSlot(env, nowMs = Date.now()) {
+    const stamp = hookPingStampPath(env);
+    try {
+        if (nowMs - statSync(stamp).mtimeMs < HOOK_PING_INTERVAL_MS)
+            return false;
+        unlinkSync(stamp);
+    }
+    catch {
+        /* no stamp yet, or another hook removed it first: fall through to the exclusive create */
+    }
+    mkdirSync(globalConfigDir(env), { recursive: true, mode: 0o700 });
+    try {
+        writeFileSync(stamp, "", { flag: "wx" });
+        return true;
+    }
+    catch {
+        return false; // EEXIST: another hook won the race
+    }
+}
+/**
+ * Called by `kya hook` after it has produced its answer. Cheap on the hot path: when telemetry is off
+ * or a ping already went out today this is one file read and one stat. Otherwise it claims the day's
+ * slot (see {@link claimHookPingSlot}) and starts the helper detached with ignored stdio, so the
+ * hook's stdout, stderr and exit code are untouched and it never waits. `host` is the hook's `--host`
+ * (claude, grok, ...), handed to the helper so the host mix stays meaningful for hook-only installs.
+ * A failed ping is not retried until tomorrow: a spawn storm while offline would be worse than a gap.
+ * Never throws. Returns whether a helper was started.
+ */
+export function maybeSpawnHookPing(deps) {
+    try {
+        if (!isTelemetryEnabled(deps.env))
+            return false;
+        const entry = deps.entry ?? process.argv[1];
+        if (entry === undefined)
+            return false; // before claiming: a skipped spawn must not burn the day's slot
+        if (!claimHookPingSlot(deps.env, deps.nowMs))
+            return false;
+        const helperEnv = deps.host !== undefined && /^[a-z][a-z0-9-]{0,31}$/.test(deps.host) && deps.env["KYA_SESSION_ID"] === undefined
+            ? { ...deps.env, KYA_SESSION_ID: `mcp:${deps.host}` } // the form telemetryHostId reads
+            : deps.env;
+        const child = (deps.spawnImpl ?? spawn)(process.execPath, [entry, "telemetry", "ping"], { detached: true, stdio: "ignore", env: helperEnv, cwd: deps.cwd, windowsHide: true });
+        child.on("error", () => undefined);
+        child.unref();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** The helper's job (`kya telemetry ping`): one `ping` as surface `hook`, same gates as every beacon. */
+export async function sendHookPing(env, cwd, fetchImpl = fetch) {
+    if (!isTelemetryEnabled(env))
+        return false;
+    const installId = readTelemetryState(env).installId;
+    return postTelemetry(telemetryEndpoint(env), buildPayload({ installId, sessionId: randomUUID(), event: "ping", surface: "hook", env, cwd }), fetchImpl);
+}
+export const CONSENT_NOTICE = [
+    "Share anonymous usage stats to help improve KYA?",
+    "  Sends: a random install ID, KYA version, OS/arch, Node version, which KYA part is running.",
+    "  Never: file paths, repo names, prompts, tool arguments, or code.",
+    "  See exactly what is sent with `kya telemetry show`; change your mind any time with `kya telemetry off`.",
+];
+function defaultAsk(question) {
+    return new Promise((resolve) => {
+        // Prompt on stderr so stdout stays clean for anything piping the command's output.
+        const rl = createInterface({ input: process.stdin, output: process.stderr });
+        rl.question(`${question} `, (answer) => {
+            rl.close();
+            resolve(answer);
+        });
+    });
+}
+/**
+ * Ask once, on an interactive terminal, in the setup commands (`start`, `init`, `connect`). Strict
+ * opt-in: only an explicit `y` / `yes` enables; empty input, anything else, or closing the prompt is No.
+ * Skipped when already answered, when an override forces telemetry off, and when not interactive
+ * (nothing is saved then, so the next interactive run can ask).
+ */
+export async function maybePromptConsent(io, env) {
+    if (telemetryDisabledReason(env) !== undefined)
+        return "skipped";
+    if (readTelemetryState(env).askedAt !== undefined)
+        return "skipped";
+    const interactive = io.isTty ?? Boolean(process.stdin.isTTY && process.stderr.isTTY);
+    if (!interactive)
+        return "skipped";
+    for (const line of CONSENT_NOTICE)
+        io.error(line);
+    const answer = await (io.ask ?? defaultAsk)("Share anonymous usage stats? [y/N]");
+    const yes = /^y(es)?$/i.test(answer.trim());
+    try {
+        writeTelemetryState(env, {
+            enabled: yes,
+            ...(yes ? { installId: randomUUID() } : {}),
+            askedAt: new Date().toISOString(),
+        });
+    }
+    catch {
+        io.error("(could not save your telemetry choice; nothing will be sent)");
+        return "no";
+    }
+    io.error(yes
+        ? "Thanks. Telemetry is on. Turn it off any time: kya telemetry off"
+        : "No problem, nothing will be sent. Turn it on later: kya telemetry on");
+    return yes ? "yes" : "no";
+}
+const NEVER_SENT = "Never sent: file paths, repo names, host or user names, environment variables, command arguments, " +
+    "tool names, prompts, code, trail contents, API keys, or email addresses.";
+export async function runTelemetryCommand(input, io, env, cwd, fetchImpl = fetch) {
+    const state = readTelemetryState(env);
+    const reason = telemetryDisabledReason(env);
+    switch (input.sub ?? "status") {
+        case "status": {
+            const effective = isTelemetryEnabled(env);
+            if (input.json) {
+                io.log(JSON.stringify({
+                    enabled: state.enabled ?? null,
+                    effective,
+                    installId: state.installId ?? null,
+                    endpoint: telemetryEndpoint(env),
+                    overriddenBy: reason ?? null,
+                }, null, 2));
+                return 0;
+            }
+            io.log(`Telemetry: ${state.enabled === true ? "on" : state.enabled === false ? "off" : "not asked yet"}`);
+            if (state.enabled === true && reason !== undefined) {
+                io.log(`Overridden for this process: ${reason}. Nothing is sent from here.`);
+            }
+            io.log(`Install ID: ${state.installId ?? "none"}`);
+            io.log(`Endpoint: ${telemetryEndpoint(env)}`);
+            io.log("See exactly what is sent: kya telemetry show");
+            return 0;
+        }
+        case "on": {
+            writeTelemetryState(env, {
+                enabled: true,
+                installId: state.installId ?? randomUUID(),
+                askedAt: state.askedAt ?? new Date().toISOString(),
+            });
+            io.log("Telemetry is on. See what is sent: kya telemetry show. Turn off: kya telemetry off");
+            if (reason !== undefined)
+                io.log(`Note: ${reason}, so nothing is sent from this shell.`);
+            return 0;
+        }
+        case "off": {
+            // One timestamp for every write below: a purge must not drop the "already asked" marker, or the
+            // next interactive setup command would ask the consent question again after an explicit erase.
+            const askedAt = state.askedAt ?? new Date().toISOString();
+            writeTelemetryState(env, {
+                enabled: false,
+                ...(state.installId !== undefined ? { installId: state.installId } : {}),
+                askedAt,
+            });
+            io.log("Telemetry is off. Nothing will be sent.");
+            if (!input.purge)
+                return 0;
+            if (state.installId === undefined) {
+                io.log("No install ID on this machine, so there is nothing to erase.");
+                return 0;
+            }
+            const erased = await postTelemetry(eraseEndpoint(env), { installId: state.installId }, fetchImpl);
+            if (!erased) {
+                io.error("Could not reach the server to erase your data. Your install ID is kept so you can retry: kya telemetry off --purge");
+                return 1;
+            }
+            writeTelemetryState(env, { enabled: false, askedAt });
+            io.log("Erased everything stored for this install and removed the local install ID.");
+            return 0;
+        }
+        case "ping": {
+            // Internal: started detached by `kya hook`. Silent, always exit 0 (nothing waits on the result).
+            await sendHookPing(env, cwd, fetchImpl);
+            return 0;
+        }
+        case "show": {
+            const sample = buildPayload({
+                installId: state.installId ?? "<random id, created only when you opt in>",
+                sessionId: "<random per process>",
+                event: "heartbeat",
+                surface: "mcp-stdio",
+                env,
+                cwd,
+            });
+            if (input.json) {
+                io.log(JSON.stringify(sample, null, 2));
+                return 0;
+            }
+            io.log("Sent about every 5 minutes while a KYA process (MCP gate, report, gateway) is running,");
+            io.log('and as one `event: "ping"`, `surface: "hook"` message per day when only `kya hook` is used:');
+            io.log(JSON.stringify(sample, null, 2));
+            io.log(NEVER_SENT);
+            io.log(`Endpoint: ${telemetryEndpoint(env)}`);
+            return 0;
+        }
+        case "reset": {
+            if (state.enabled !== true && state.installId === undefined) {
+                io.log("Nothing to reset: telemetry is off and there is no install ID.");
+                return 0;
+            }
+            writeTelemetryState(env, {
+                ...(state.enabled !== undefined ? { enabled: state.enabled } : {}),
+                installId: randomUUID(),
+                askedAt: state.askedAt ?? new Date().toISOString(),
+            });
+            io.log("Generated a new random install ID. The old one is no longer linked to this machine.");
+            return 0;
+        }
+        default:
+            io.error("Usage: kya telemetry [status|on|off [--purge]|show|reset] [--json]");
+            return 2;
+    }
+}
+//# sourceMappingURL=telemetry.js.map

package/dist/telemetry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry.js","sourceRoot":"","sources":["../src/telemetry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACvF,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAkC3C,MAAM,CAAC,MAAM,0BAA0B,GAAG,+CAA+C,CAAC;AAC1F,MAAM,eAAe,GAAG,KAAK,CAAC;AAC9B,MAAM,oBAAoB,GAAG,CAAC,GAAG,MAAM,CAAC;AACxC,MAAM,wBAAwB,GAAG,CAAC,CAAC;AACnC,MAAM,OAAO,GAAG,iEAAiE,CAAC;AAClF,MAAM,MAAM,GAAG,qBAAqB,CAAC;AAErC,MAAM,MAAM,GAAG,CAAC,KAAyB,EAAW,EAAE,CACpD,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AAE3E,gGAAgG;AAChG,gCAAgC;AAChC,gGAAgG;AAEhG,MAAM,UAAU,kBAAkB,CAAC,GAAsB;IACvD,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,gBAAgB,CAAC,CAAC;AACtD,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,kBAAkB,CAAC,GAAsB;IACvD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAA4B,CAAC;QACjG,OAAO;YACL,GAAG,CAAC,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,GAAG,CAAC,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACxE,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,EAAE;gBAC/C,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3E,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAsB,EAAE,KAAqB;IAC/E,SAAS,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,eAAe,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AAClF,CAAC;AAED,gGAAgG;AAChG,QAAQ;AACR,gGAAgG;AAEhG,iGAAiG;AACjG,MAAM,UAAU,uBAAuB,CAAC,GAAsB;IAC5D,IAAI,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAAE,OAAO,qBAAqB,CAAC;IAC9D,IAAI,GAAG,CAAC,eAAe,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QACnF,OAAO,sBAAsB,CAAC;IAChC,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,gBAAgB,CAAC,KAAK,MAAM;QAAE,OAAO,eAAe,CAAC;IAClF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,kBAAkB,CAAC,GAAsB;IACvD,IAAI,uBAAuB,CAAC,GAAG,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7D,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACtC,OAAO,KAAK,CAAC,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC;AACjE,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,iBAAiB,CAAC,GAAsB;IACtD,MAAM,GAAG,GAAG,GAAG,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,CAAC;IAC7C,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YACzB,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC5E,MAAM,WAAW,GAAG,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,CAAC;YAC/D,IAAI,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,CAAC,EAAE,CAAC;gBAC1F,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;YACxB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,0CAA0C;QAC5C,CAAC;IACH,CAAC;IACD,OAAO,0BAA0B,CAAC;AACpC,CAAC;AAED,SAAS,aAAa,CAAC,GAAsB;IAC3C,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC;AAC/D,CAAC;AAED,gGAAgG;AAChG,UAAU;AACV,gGAAgG;AAEhG,kGAAkG;AAClG,MAAM,UAAU,eAAe,CAAC,GAAsB;IACpD,MAAM,KAAK,GAAG,8BAA8B,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/E,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,KAO5B;IACC,OAAO;QACL,MAAM,EAAE,CAAC;QACT,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,WAAW;QACvB,EAAE,EAAE,OAAO,CAAC,QAAQ;QACpB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QACrD,MAAM,EAAE,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC;QAClC,QAAQ,EAAE,eAAe,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC;QAC7D,YAAY,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;KAC7D,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAW,EACX,IAAa,EACb,YAAuB,KAAK;IAE5B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;YAC/B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,YAAY,EAAE,wBAAwB,WAAW,EAAE;aACpD;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC;SAC7C,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,EAAE,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAWD,MAAM,WAAW,GAAkB,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC,EAAE,CAAC;AAE5D,SAAS,WAAW,CAAC,GAAsB,EAAE,QAA4B;IACvE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC5C,+EAA+E;IAC/E,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,oBAAoB,CAAC;AAC7F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAyB,EACzB,IAKC;IAED,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,WAAW,CAAC;IACtD,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,SAAmB,CAAC;IACnE,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,MAAM,IAAI,GAAG,KAAK,EAAE,KAAyB,EAAiB,EAAE;QAC9D,IAAI,QAAQ,IAAI,wBAAwB;YAAE,OAAO;QACjD,MAAM,EAAE,GAAG,MAAM,aAAa,CAC5B,GAAG,EACH,YAAY,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,EACpF,SAAS,CACV,CAAC;QACF,QAAQ,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC;IACnC,CAAC,CAAC;IAEF,KAAK,IAAI,CAAC,OAAO,CAAC,CAAC;IACnB,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,KAAK,IAAI,CAAC,WAAW,CAAC,CAAC;IACzB,CAAC,EAAE,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IAC3C,KAAK,CAAC,KAAK,EAAE,CAAC;IAEd,OAAO;QACL,KAAK,CAAC,IAAI;YACR,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,aAAa,CAAC,KAAK,CAAC,CAAC;YACrB,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,gGAAgG;AAChG,8EAA8E;AAC9E,gGAAgG;AAEhG,+EAA+E;AAC/E,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AAEtD,oGAAoG;AACpG,MAAM,UAAU,iBAAiB,CAAC,GAAsB;IACtD,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,gBAAgB,CAAC,CAAC;AACtD,CAAC;AAQD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAsB,EAAE,QAAgB,IAAI,CAAC,GAAG,EAAE;IAClF,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC;QACH,IAAI,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,GAAG,qBAAqB;YAAE,OAAO,KAAK,CAAC;QAC1E,UAAU,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,0FAA0F;IAC5F,CAAC;IACD,SAAS,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,IAAI,CAAC;QACH,aAAa,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,CAAC,oCAAoC;IACpD,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAOlC;IACC,IAAI,CAAC;QACH,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5C,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC,CAAC,gEAAgE;QACvG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3D,MAAM,SAAS,GACb,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,KAAK,SAAS;YAC7G,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,OAAO,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,iCAAiC;YACvF,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QACf,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,SAAS,IAAK,KAA8B,CAAC,CAC/D,OAAO,CAAC,QAAQ,EAChB,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,EAC5B,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,CACtF,CAAC;QACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACnC,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,yGAAyG;AACzG,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAsB,EACtB,GAAW,EACX,YAAuB,KAAK;IAE5B,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,MAAM,SAAS,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,SAAmB,CAAC;IAC9D,OAAO,aAAa,CAClB,iBAAiB,CAAC,GAAG,CAAC,EACtB,YAAY,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAC9F,SAAS,CACV,CAAC;AACJ,CAAC;AAcD,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,kDAAkD;IAClD,8FAA8F;IAC9F,oEAAoE;IACpE,2GAA2G;CAC5G,CAAC;AAEF,SAAS,UAAU,CAAC,QAAgB;IAClC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,mFAAmF;QACnF,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7E,EAAE,CAAC,QAAQ,CAAC,GAAG,QAAQ,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE;YACrC,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,EAAa,EACb,GAAsB;IAEtB,IAAI,uBAAuB,CAAC,GAAG,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACjE,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACpE,MAAM,WAAW,GAAG,EAAE,CAAC,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrF,IAAI,CAAC,WAAW;QAAE,OAAO,SAAS,CAAC;IAEnC,KAAK,MAAM,IAAI,IAAI,cAAc;QAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,GAAG,IAAI,UAAU,CAAC,CAAC,oCAAoC,CAAC,CAAC;IAClF,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,mBAAmB,CAAC,GAAG,EAAE;YACvB,OAAO,EAAE,GAAG;YACZ,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAClC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,EAAE,CAAC,KAAK,CAAC,8DAA8D,CAAC,CAAC;QACzE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,EAAE,CAAC,KAAK,CACN,GAAG;QACD,CAAC,CAAC,kEAAkE;QACpE,CAAC,CAAC,sEAAsE,CAC3E,CAAC;IACF,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5B,CAAC;AAWD,MAAM,UAAU,GACd,oGAAoG;IACpG,0EAA0E,CAAC;AAE7E,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAA4F,EAC5F,EAAsB,EACtB,GAAsB,EACtB,GAAW,EACX,YAAuB,KAAK;IAE5B,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAE5C,QAAQ,KAAK,CAAC,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC9B,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,SAAS,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;gBACf,EAAE,CAAC,GAAG,CACJ,IAAI,CAAC,SAAS,CACZ;oBACE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI;oBAC9B,SAAS;oBACT,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;oBAClC,QAAQ,EAAE,iBAAiB,CAAC,GAAG,CAAC;oBAChC,YAAY,EAAE,MAAM,IAAI,IAAI;iBAC7B,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;gBACF,OAAO,CAAC,CAAC;YACX,CAAC;YACD,EAAE,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;YAC1G,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACnD,EAAE,CAAC,GAAG,CAAC,gCAAgC,MAAM,8BAA8B,CAAC,CAAC;YAC/E,CAAC;YACD,EAAE,CAAC,GAAG,CAAC,eAAe,KAAK,CAAC,SAAS,IAAI,MAAM,EAAE,CAAC,CAAC;YACnD,EAAE,CAAC,GAAG,CAAC,aAAa,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9C,EAAE,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;YACvD,OAAO,CAAC,CAAC;QACX,CAAC;QAED,KAAK,IAAI,CAAC,CAAC,CAAC;YACV,mBAAmB,CAAC,GAAG,EAAE;gBACvB,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,UAAU,EAAE;gBAC1C,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACnD,CAAC,CAAC;YACH,EAAE,CAAC,GAAG,CAAC,oFAAoF,CAAC,CAAC;YAC7F,IAAI,MAAM,KAAK,SAAS;gBAAE,EAAE,CAAC,GAAG,CAAC,SAAS,MAAM,uCAAuC,CAAC,CAAC;YACzF,OAAO,CAAC,CAAC;QACX,CAAC;QAED,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,gGAAgG;YAChG,+FAA+F;YAC/F,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC1D,mBAAmB,CAAC,GAAG,EAAE;gBACvB,OAAO,EAAE,KAAK;gBACd,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxE,OAAO;aACR,CAAC,CAAC;YACH,EAAE,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;YAClD,IAAI,CAAC,KAAK,CAAC,KAAK;gBAAE,OAAO,CAAC,CAAC;YAC3B,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBAClC,EAAE,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;gBACvE,OAAO,CAAC,CAAC;YACX,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,CAAC,CAAC;YAClG,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,EAAE,CAAC,KAAK,CAAC,oHAAoH,CAAC,CAAC;gBAC/H,OAAO,CAAC,CAAC;YACX,CAAC;YACD,mBAAmB,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YACtD,EAAE,CAAC,GAAG,CAAC,6EAA6E,CAAC,CAAC;YACtF,OAAO,CAAC,CAAC;QACX,CAAC;QAED,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,iGAAiG;YACjG,MAAM,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;YACxC,OAAO,CAAC,CAAC;QACX,CAAC;QAED,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,MAAM,GAAG,YAAY,CAAC;gBAC1B,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,2CAA2C;gBACzE,SAAS,EAAE,sBAAsB;gBACjC,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,WAAW;gBACpB,GAAG;gBACH,GAAG;aACJ,CAAC,CAAC;YACH,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;gBACf,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBACxC,OAAO,CAAC,CAAC;YACX,CAAC;YACD,EAAE,CAAC,GAAG,CAAC,wFAAwF,CAAC,CAAC;YACjG,EAAE,CAAC,GAAG,CAAC,6FAA6F,CAAC,CAAC;YACtG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACxC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACnB,EAAE,CAAC,GAAG,CAAC,aAAa,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9C,OAAO,CAAC,CAAC;QACX,CAAC;QAED,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5D,EAAE,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAC;gBACzE,OAAO,CAAC,CAAC;YACX,CAAC;YACD,mBAAmB,CAAC,GAAG,EAAE;gBACvB,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClE,SAAS,EAAE,UAAU,EAAE;gBACvB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACnD,CAAC,CAAC;YACH,EAAE,CAAC,GAAG,CAAC,qFAAqF,CAAC,CAAC;YAC9F,OAAO,CAAC,CAAC;QACX,CAAC;QAED;YACE,EAAE,CAAC,KAAK,CAAC,oEAAoE,CAAC,CAAC;YAC/E,OAAO,CAAC,CAAC;IACb,CAAC;AACH,CAAC"}

package/droid/README.md

@@ -1,6 +1,6 @@
 # Droid (Factory) + Shield KYA
 
-Preferred path is Droid's own CLI: `droid mcp add shield-kya "npx --no-install @shield-agent/kya@0.21.0 serve-mcp --stdio" --env KYA_BASE_URL=https://shield-agent.com --env KYA_API_KEY=$KYA_API_KEY --env KYA_HOST=ide`.
+Preferred path is Droid's own CLI: `droid mcp add shield-kya "npx --no-install @shield-agent/kya@0.22.0 serve-mcp --stdio" --env KYA_BASE_URL=https://shield-agent.com --env KYA_API_KEY=$KYA_API_KEY --env KYA_HOST=ide`.
 
 `mcp.example.json` shows the expected on-disk shape (`~/.factory/mcp.json`) — **schema not yet verified against a live Droid install**; treat as a starting point and prefer `droid mcp add`.
 

package/droid/mcp.example.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.21.0", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.22.0", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "https://shield-agent.com",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/gemini/settings.example.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.21.0", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.22.0", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "https://shield-agent.com",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/grok/README.md

@@ -40,7 +40,7 @@ chat = client.chat.create(
 There is no grok.com stdio path. For a local agent host use the same stdio launch as Claude:
 
 ```bash
-npx --no-install @shield-agent/kya@0.21.0 serve-mcp --stdio
+npx --no-install @shield-agent/kya@0.22.0 serve-mcp --stdio
 ```
 
 Env: `KYA_BASE_URL`, `KYA_API_KEY`, `KYA_HOST`. Codex and Gemini example configs in this package show the full snippets.

package/kilo/kilo.example.json

@@ -2,7 +2,7 @@
   "mcp": {
     "shield-kya": {
       "type": "local",
-      "command": ["npx", "--no-install", "@shield-agent/kya@0.21.0", "serve-mcp", "--stdio"],
+      "command": ["npx", "--no-install", "@shield-agent/kya@0.22.0", "serve-mcp", "--stdio"],
       "enabled": true,
       "environment": {
         "KYA_BASE_URL": "https://shield-agent.com",

package/kimi/mcp.example.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.21.0", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.22.0", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "https://shield-agent.com",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/kiro/mcp.example.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.21.0", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.22.0", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "https://shield-agent.com",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": "0.3",
   "name": "shield-kya",
   "display_name": "Shield KYA",
-  "version": "0.21.0",
+  "version": "0.22.0",
   "description": "Know Your Agent MCP gate: ALLOW / DENY / REQUIRE_APPROVE. Sole PEP is Shield.",
   "long_description": "Local Claude Desktop extension that runs the packaged `dist/cli.js serve-mcp --stdio` against your Shield control plane (local or https://shield-agent.com). Tools evaluate policy, ingest session risk, and open Hold tickets. They never execute irreversible side effects.",
   "author": {

package/mastracode/mcp.example.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.21.0", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.22.0", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "https://shield-agent.com",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/mcp.json

@@ -3,7 +3,7 @@
     "shield-kya": {
       "description": "Know Your Agent local MCP gate: wrap-before-write, named-agent registry, Hold/Clear.",
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.21.0", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.22.0", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "${KYA_BASE_URL}",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/openai/codex.config.example.toml

@@ -11,7 +11,7 @@
 # --- Local stdio (OSS) ---
 [mcp_servers.shield-kya]
 command = "npx"
-args = ["--no-install", "@shield-agent/kya@0.21.0", "serve-mcp", "--stdio"]
+args = ["--no-install", "@shield-agent/kya@0.22.0", "serve-mcp", "--stdio"]
 startup_timeout_sec = 20
 env_vars = ["KYA_BASE_URL", "KYA_API_KEY", "KYA_HOST", "KYA_AGENT_ID"]
 

package/opencode/opencode.example.json

@@ -2,7 +2,7 @@
   "mcp": {
     "shield-kya": {
       "type": "local",
-      "command": ["npx", "--no-install", "@shield-agent/kya@0.21.0", "serve-mcp", "--stdio"],
+      "command": ["npx", "--no-install", "@shield-agent/kya@0.22.0", "serve-mcp", "--stdio"],
       "enabled": true,
       "environment": {
         "KYA_BASE_URL": "https://shield-agent.com",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shield-agent/kya",
-  "version": "0.21.0",
+  "version": "0.22.0",
   "description": "AI agents audit trail & traceability — gate every tool call (Allow / Review / Deny), live activity dashboard, and continuous trust-baseline certification.",
   "license": "MIT",
   "type": "module",
@@ -104,6 +104,7 @@
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
     "pack:check": "pnpm run build && pnpm pack --pack-destination /tmp && node dist/cli.js --help",
-    "sync:version": "node scripts/sync-version.mjs"
+    "sync:version": "node scripts/sync-version.mjs",
+    "check:version": "node scripts/check-version-pins.mjs"
   }
 }

package/qwen/settings.example.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.21.0", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.22.0", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "https://shield-agent.com",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/server.json

@@ -7,12 +7,12 @@
     "url": "https://github.com/The-Pixel-Boys/shield-kya",
     "source": "github"
   },
-  "version": "0.21.0",
+  "version": "0.22.0",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@shield-agent/kya",
-      "version": "0.21.0",
+      "version": "0.22.0",
       "transport": {
         "type": "stdio"
       },