@shield-agent/kya 0.32.7 → 0.33.1

package/dist/ioc/spawn.d.ts

@@ -0,0 +1,26 @@
+export declare const IOC_SCAN_INTERVAL_MS: number;
+/** KYA_IOC=0 (or off/false) or ~/.kya/config.json {"ioc":{"enabled":false}} turns the background scan off. */
+export declare function iocEnabled(env: NodeJS.ProcessEnv): boolean;
+export declare function iocStampPath(env: NodeJS.ProcessEnv): string;
+type SpawnLike = (command: string, args: readonly string[], options: {
+    detached: boolean;
+    stdio: "ignore";
+    env: NodeJS.ProcessEnv;
+    cwd: string;
+    windowsHide: boolean;
+}) => {
+    unref(): void;
+    on(event: "error", listener: () => void): unknown;
+};
+/**
+ * Starts `kya ioc-scan` detached when the 24 h slot is free. Never throws, never waits.
+ * Returns whether a scan was started. A failed spawn keeps the slot claimed until tomorrow.
+ */
+export declare function maybeSpawnIocScan(deps: {
+    readonly env: NodeJS.ProcessEnv;
+    readonly entry?: string;
+    readonly spawnImpl?: SpawnLike;
+    readonly nowMs?: number;
+}): boolean;
+export {};
+//# sourceMappingURL=spawn.d.ts.map

package/dist/ioc/spawn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spawn.d.ts","sourceRoot":"","sources":["../../src/ioc/spawn.ts"],"names":[],"mappings":"AAYA,eAAO,MAAM,oBAAoB,QAAmB,CAAC;AAErD,8GAA8G;AAC9G,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAS1D;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAE3D;AAED,KAAK,SAAS,GAAG,CACf,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,EAAE;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAE,KACvG;IAAE,KAAK,IAAI,IAAI,CAAC;IAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,OAAO,CAAA;CAAE,CAAC;AAE1E;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAkBV"}

package/dist/ioc/spawn.js

@@ -0,0 +1,52 @@
+/**
+ * Hook-side throttle for the IoC scan. Lean on purpose: `kya hook` imports this module and nothing
+ * from ./scan.js, so the hook path loads no scan code. The scan itself runs in a detached child
+ * (`kya ioc-scan`) that the hook never waits for.
+ */
+import { spawn } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { isAbsolute, join } from "node:path";
+import { globalConfigDir } from "../config.js";
+import { claimDailySlot } from "../daily-slot.js";
+import { childCwd, childEnv } from "./exec.js";
+export const IOC_SCAN_INTERVAL_MS = 24 * 60 * 60_000;
+/** KYA_IOC=0 (or off/false) or ~/.kya/config.json {"ioc":{"enabled":false}} turns the background scan off. */
+export function iocEnabled(env) {
+    const flag = String(env["KYA_IOC"] ?? "").trim().toLowerCase();
+    if (flag === "0" || flag === "off" || flag === "false")
+        return false;
+    try {
+        const cfg = JSON.parse(readFileSync(join(globalConfigDir(env), "config.json"), "utf8"));
+        return cfg.ioc?.enabled !== false;
+    }
+    catch {
+        return true; // no config file (the usual case) or unreadable: the default is on
+    }
+}
+export function iocStampPath(env) {
+    return join(globalConfigDir(env), "ioc-scan-stamp");
+}
+/**
+ * Starts `kya ioc-scan` detached when the 24 h slot is free. Never throws, never waits.
+ * Returns whether a scan was started. A failed spawn keeps the slot claimed until tomorrow.
+ */
+export function maybeSpawnIocScan(deps) {
+    try {
+        if (!iocEnabled(deps.env))
+            return false;
+        const entry = deps.entry ?? process.argv[1];
+        // Absolute only: the child starts in the home directory, so a relative entry would not resolve.
+        if (entry === undefined || !isAbsolute(entry))
+            return false; // before claiming: a skipped spawn must not burn the slot
+        if (!claimDailySlot(iocStampPath(deps.env), IOC_SCAN_INTERVAL_MS, deps.nowMs))
+            return false;
+        const child = (deps.spawnImpl ?? spawn)(process.execPath, [entry, "ioc-scan"], { detached: true, stdio: "ignore", env: childEnv(deps.env), cwd: childCwd(), windowsHide: true });
+        child.on("error", () => undefined);
+        child.unref();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=spawn.js.map

package/dist/ioc/spawn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spawn.js","sourceRoot":"","sources":["../../src/ioc/spawn.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAE/C,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AAErD,8GAA8G;AAC9G,MAAM,UAAU,UAAU,CAAC,GAAsB;IAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/D,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAoC,CAAC;QAC3H,OAAO,GAAG,CAAC,GAAG,EAAE,OAAO,KAAK,KAAK,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,mEAAmE;IAClF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAsB;IACjD,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,gBAAgB,CAAC,CAAC;AACtD,CAAC;AAQD;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAKjC;IACC,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5C,gGAAgG;QAChG,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,0DAA0D;QACvH,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,oBAAoB,EAAE,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5F,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,SAAS,IAAK,KAA8B,CAAC,CAC/D,OAAO,CAAC,QAAQ,EAChB,CAAC,KAAK,EAAE,UAAU,CAAC,EACnB,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CACjG,CAAC;QACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACnC,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/login/credentials.d.ts

@@ -0,0 +1,17 @@
+export interface HostedCredentials {
+    /** Validated origin of the hosted console, no path, query or fragment. */
+    readonly baseUrl: string;
+    /** The hosted API key. Never print it. */
+    readonly apiKey: string;
+    /** Display prefix only (safe to print). */
+    readonly keyPrefix: string;
+    readonly createdAt: string;
+}
+export declare function credentialsPath(env?: NodeJS.ProcessEnv): string;
+/** The saved credentials, or undefined when missing, unreadable or malformed. Never throws. */
+export declare function readCredentials(env?: NodeJS.ProcessEnv): HostedCredentials | undefined;
+/** Write the credentials with mode 0600. Throws on I/O failure; the caller reports it. */
+export declare function writeCredentials(creds: HostedCredentials, env?: NodeJS.ProcessEnv): string;
+/** Delete the local file. Returns whether a file was removed. Never throws. */
+export declare function deleteCredentials(env?: NodeJS.ProcessEnv): boolean;
+//# sourceMappingURL=credentials.d.ts.map

package/dist/login/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/login/credentials.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,iBAAiB;IAChC,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,0CAA0C;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,2CAA2C;IAC3C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAID,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE5E;AAED,+FAA+F;AAC/F,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,iBAAiB,GAAG,SAAS,CAkBnG;AAED,0FAA0F;AAC1F,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAKvG;AAED,+EAA+E;AAC/E,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAS/E"}

package/dist/login/credentials.js

@@ -0,0 +1,64 @@
+/**
+ * Hosted login credentials for `kya login`: one JSON file in the user-level KYA dir
+ * (`<KYA_HOME|home>/.kya/hosted-credentials.json`), mode 0600, written crash-safe.
+ *
+ * The file holds a full-workspace hosted API key (no narrower scope exists yet). It is never printed, never sent to telemetry
+ * and never read by the hosted hook path (that path uses its own --plane-config file).
+ */
+import { existsSync, lstatSync, mkdirSync, readFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { globalConfigDir } from "../config.js";
+import { atomicWriteSecretSync } from "../fs-atomic.js";
+import { validateConsoleUrl } from "./device-flow.js";
+const KEY_RE = /^[\x21-\x7e]{8,512}$/;
+export function credentialsPath(env = process.env) {
+    return join(globalConfigDir(env), "hosted-credentials.json");
+}
+/** The saved credentials, or undefined when missing, unreadable or malformed. Never throws. */
+export function readCredentials(env = process.env) {
+    try {
+        const raw = JSON.parse(readFileSync(credentialsPath(env), "utf8"));
+        if (typeof raw.baseUrl === "string" &&
+            typeof raw.apiKey === "string" &&
+            KEY_RE.test(raw.apiKey) &&
+            typeof raw.keyPrefix === "string" &&
+            typeof raw.createdAt === "string") {
+            // Re-validated on every read: a file edited to point at a remote http host (or anything else) is not used.
+            validateConsoleUrl(raw.baseUrl);
+            return { baseUrl: raw.baseUrl, apiKey: raw.apiKey, keyPrefix: raw.keyPrefix, createdAt: raw.createdAt };
+        }
+    }
+    catch {
+        /* missing or corrupt */
+    }
+    return undefined;
+}
+/** Write the credentials with mode 0600. Throws on I/O failure; the caller reports it. */
+export function writeCredentials(creds, env = process.env) {
+    const path = credentialsPath(env);
+    mkdirSync(globalConfigDir(env), { recursive: true });
+    atomicWriteSecretSync(path, `${JSON.stringify(creds, null, 2)}\n`);
+    return path;
+}
+/** Delete the local file. Returns whether a file was removed. Never throws. */
+export function deleteCredentials(env = process.env) {
+    const path = credentialsPath(env);
+    try {
+        if (!existsSync(path) && !isLink(path))
+            return false;
+        rmSync(path, { force: true });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function isLink(path) {
+    try {
+        return lstatSync(path).isSymbolicLink();
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=credentials.js.map

package/dist/login/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/login/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAYtD,MAAM,MAAM,GAAG,sBAAsB,CAAC;AAEtC,MAAM,UAAU,eAAe,CAAC,MAAyB,OAAO,CAAC,GAAG;IAClE,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,yBAAyB,CAAC,CAAC;AAC/D,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,eAAe,CAAC,MAAyB,OAAO,CAAC,GAAG;IAClE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAA+B,CAAC;QACjG,IACE,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;YAC/B,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;YAC9B,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;YACvB,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ;YACjC,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,EACjC,CAAC;YACD,2GAA2G;YAC3G,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAChC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;QAC1G,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,wBAAwB;IAC1B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,gBAAgB,CAAC,KAAwB,EAAE,MAAyB,OAAO,CAAC,GAAG;IAC7F,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAClC,SAAS,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,qBAAqB,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACnE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,iBAAiB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACpE,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACrD,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/login/device-flow.d.ts

@@ -0,0 +1,44 @@
+export type LoginErrorCode = "LOGIN_UNAVAILABLE" | "LOGIN_NETWORK" | "LOGIN_WRONG_STATE" | "LOGIN_EXPIRED" | "LOGIN_DENIED" | "LOGIN_CAP_REACHED" | "LOGIN_RATE_LIMITED" | "LOGIN_BAD_URL";
+/** A login failure. `message` is fixed text chosen here, never server output or key material. */
+export declare class LoginError extends Error {
+    readonly code: LoginErrorCode;
+    constructor(code: LoginErrorCode, message: string);
+}
+export interface DeviceCode {
+    readonly deviceCode: string;
+    readonly userCode: string;
+    readonly verificationUri: string;
+    readonly expiresInSec: number;
+    readonly intervalSec: number;
+}
+export interface IssuedToken {
+    readonly apiKey: string;
+    readonly keyPrefix: string;
+}
+export interface DeviceFlowDeps {
+    readonly clientVersion: string;
+    readonly fetch?: typeof fetch;
+    /** Injected in tests so slow_down and expiry run without real waits. */
+    readonly sleep?: (ms: number) => Promise<void>;
+    readonly now?: () => number;
+    /** Per-request timeout. A slower answer counts as a transient failure. */
+    readonly requestTimeoutMs?: number;
+}
+export declare const DEVICE_CODE_PATH = "/api/v1/kya/device/code";
+export declare const DEVICE_TOKEN_PATH = "/api/v1/kya/device/token";
+/** Consecutive transient failures (network, timeout, 5xx) before the login gives up. */
+export declare const MAX_TRANSIENT_FAILURES = 3;
+/**
+ * Validate the console origin. https only, or loopback http (tests and local dev).
+ * No credentials, query or fragment. Returns the parsed URL (origin only is used).
+ */
+export declare function validateConsoleUrl(raw: string): URL;
+/** Step 1: ask the server for a device and user code. */
+export declare function requestDeviceCode(base: URL, deps: DeviceFlowDeps): Promise<DeviceCode>;
+/**
+ * Step 2: poll until the user approves, denies or the code expires.
+ * Transient failures (network, timeout, 5xx) are retried up to MAX_TRANSIENT_FAILURES in a row.
+ * An unknown answer aborts at once. Only a validated token is returned.
+ */
+export declare function pollForToken(base: URL, code: DeviceCode, deps: DeviceFlowDeps): Promise<IssuedToken>;
+//# sourceMappingURL=device-flow.d.ts.map

package/dist/login/device-flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-flow.d.ts","sourceRoot":"","sources":["../../src/login/device-flow.ts"],"names":[],"mappings":"AAaA,MAAM,MAAM,cAAc,GACtB,mBAAmB,GACnB,eAAe,GACf,mBAAmB,GACnB,eAAe,GACf,cAAc,GACd,mBAAmB,GACnB,oBAAoB,GACpB,eAAe,CAAC;AAEpB,iGAAiG;AACjG,qBAAa,UAAW,SAAQ,KAAK;IAEjC,QAAQ,CAAC,IAAI,EAAE,cAAc;gBAApB,IAAI,EAAE,cAAc,EAC7B,OAAO,EAAE,MAAM;CAKlB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,0EAA0E;IAC1E,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,eAAO,MAAM,gBAAgB,4BAA4B,CAAC;AAC1D,eAAO,MAAM,iBAAiB,6BAA6B,CAAC;AAI5D,wFAAwF;AACxF,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAMxC;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAiBnD;AAmCD,yDAAyD;AACzD,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,CAiD5F;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,WAAW,CAAC,CA8D1G"}

package/dist/login/device-flow.js

@@ -0,0 +1,205 @@
+/**
+ * OAuth 2.0 device authorization grant (RFC 8628) against the hosted console, for `kya login`.
+ *
+ * Endpoints (hosted side: web device-login controller, behind a feature flag):
+ *   POST {base}/api/v1/kya/device/code   {"client":"kya-cli","version":"x"}  -> device_code, user_code, ...
+ *   POST {base}/api/v1/kya/device/token  {"device_code":"..."}              -> 200 access_token | 400 error
+ * A 404 on either route means the feature is off on that server.
+ *
+ * Fails closed for login itself: any unknown answer aborts with a LoginError and nothing is stored.
+ * Nothing here runs in the OSS hook or evaluate path.
+ */
+import { isLoopbackUrl } from "../config.js";
+/** A login failure. `message` is fixed text chosen here, never server output or key material. */
+export class LoginError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "LoginError";
+    }
+}
+export const DEVICE_CODE_PATH = "/api/v1/kya/device/code";
+export const DEVICE_TOKEN_PATH = "/api/v1/kya/device/token";
+/** RFC 8628 section 3.5: slow_down adds 5 seconds to the polling interval. */
+const SLOW_DOWN_STEP_SEC = 5;
+const MAX_INTERVAL_SEC = 60;
+/** Consecutive transient failures (network, timeout, 5xx) before the login gives up. */
+export const MAX_TRANSIENT_FAILURES = 3;
+const DEFAULT_TIMEOUT_MS = 10_000;
+const DEVICE_CODE_RE = /^[\x21-\x7e]{16,512}$/;
+const USER_CODE_RE = /^[A-Za-z0-9-]{4,32}$/;
+const KEY_RE = /^[\x21-\x7e]{8,512}$/;
+/**
+ * Validate the console origin. https only, or loopback http (tests and local dev).
+ * No credentials, query or fragment. Returns the parsed URL (origin only is used).
+ */
+export function validateConsoleUrl(raw) {
+    const bad = (why) => {
+        throw new LoginError("LOGIN_BAD_URL", `hosted console URL ${why}`);
+    };
+    if (!raw || /[^\x21-\x7e]/.test(raw))
+        bad("must be a non-empty ASCII URL");
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return bad("is not a valid URL");
+    }
+    if (url.username || url.password)
+        bad("must not carry credentials");
+    if (url.search || url.hash)
+        bad("must not carry a query or fragment");
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && isLoopbackUrl(raw))) {
+        bad("must be https (http is allowed for loopback only)");
+    }
+    return url;
+}
+function isObject(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+/** One JSON POST. Returns the status and parsed body (undefined when not JSON). Throws on network or timeout. */
+async function postJson(url, body, deps) {
+    const doFetch = deps.fetch ?? fetch;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), deps.requestTimeoutMs ?? DEFAULT_TIMEOUT_MS);
+    try {
+        const res = await doFetch(url, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", Accept: "application/json" },
+            body: JSON.stringify(body),
+            signal: controller.signal,
+            redirect: "error",
+        });
+        let json;
+        try {
+            json = await res.json();
+        }
+        catch {
+            json = undefined;
+        }
+        return { status: res.status, json };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/** Step 1: ask the server for a device and user code. */
+export async function requestDeviceCode(base, deps) {
+    let res;
+    try {
+        res = await postJson(new URL(DEVICE_CODE_PATH, base).toString(), { client: "kya-cli", version: deps.clientVersion }, deps);
+    }
+    catch {
+        throw new LoginError("LOGIN_NETWORK", "could not reach the hosted console; nothing was saved");
+    }
+    if (res.status === 404) {
+        throw new LoginError("LOGIN_UNAVAILABLE", "hosted login is not available on this server; nothing was saved");
+    }
+    if (res.status === 429) {
+        throw new LoginError("LOGIN_RATE_LIMITED", "too many login starts from this network; wait a minute, then run kya login again");
+    }
+    if (res.status !== 200 || !isObject(res.json)) {
+        throw new LoginError("LOGIN_WRONG_STATE", "the hosted console sent an unexpected answer; nothing was saved");
+    }
+    const o = res.json;
+    const deviceCode = typeof o.device_code === "string" ? o.device_code : "";
+    const userCode = typeof o.user_code === "string" ? o.user_code : "";
+    const uri = typeof o.verification_uri === "string" ? o.verification_uri : "";
+    const expires = typeof o.expires_in === "number" && Number.isInteger(o.expires_in) ? o.expires_in : 0;
+    const interval = o.interval === undefined ? 5 : typeof o.interval === "number" && Number.isInteger(o.interval) ? o.interval : 0;
+    let verification;
+    try {
+        verification = new URL(uri);
+    }
+    catch {
+        verification = undefined;
+    }
+    // The verification page must live on the same origin the user chose: never open a foreign page.
+    const sameOrigin = verification !== undefined && verification.origin === base.origin;
+    if (!DEVICE_CODE_RE.test(deviceCode) ||
+        !USER_CODE_RE.test(userCode) ||
+        !sameOrigin ||
+        expires < 1 ||
+        expires > 3600 ||
+        interval < 1 ||
+        interval > MAX_INTERVAL_SEC) {
+        throw new LoginError("LOGIN_WRONG_STATE", "the hosted console sent an unexpected answer; nothing was saved");
+    }
+    return {
+        deviceCode,
+        userCode,
+        verificationUri: verification.toString(),
+        expiresInSec: expires,
+        intervalSec: interval,
+    };
+}
+/**
+ * Step 2: poll until the user approves, denies or the code expires.
+ * Transient failures (network, timeout, 5xx) are retried up to MAX_TRANSIENT_FAILURES in a row.
+ * An unknown answer aborts at once. Only a validated token is returned.
+ */
+export async function pollForToken(base, code, deps) {
+    const now = deps.now ?? Date.now;
+    const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const deadline = now() + code.expiresInSec * 1000;
+    const tokenUrl = new URL(DEVICE_TOKEN_PATH, base).toString();
+    let interval = code.intervalSec;
+    let transient = 0;
+    const expired = () => new LoginError("LOGIN_EXPIRED", "the code expired before it was approved; nothing was saved");
+    for (;;) {
+        if (now() >= deadline)
+            throw expired();
+        await sleep(interval * 1000);
+        if (now() >= deadline)
+            throw expired();
+        let res;
+        try {
+            res = await postJson(tokenUrl, { device_code: code.deviceCode }, deps);
+        }
+        catch {
+            if (++transient >= MAX_TRANSIENT_FAILURES) {
+                throw new LoginError("LOGIN_NETWORK", "lost the hosted console while waiting; nothing was saved");
+            }
+            continue;
+        }
+        if (res.status === 404) {
+            throw new LoginError("LOGIN_UNAVAILABLE", "hosted login is not available on this server; nothing was saved");
+        }
+        if (res.status >= 500) {
+            if (++transient >= MAX_TRANSIENT_FAILURES) {
+                throw new LoginError("LOGIN_NETWORK", "lost the hosted console while waiting; nothing was saved");
+            }
+            continue;
+        }
+        transient = 0;
+        if (res.status === 200) {
+            const o = isObject(res.json) ? res.json : {};
+            const apiKey = typeof o.access_token === "string" ? o.access_token : "";
+            if (!KEY_RE.test(apiKey)) {
+                throw new LoginError("LOGIN_WRONG_STATE", "the hosted console sent an unexpected answer; nothing was saved");
+            }
+            const keyPrefix = typeof o.key_prefix === "string" && o.key_prefix ? o.key_prefix : apiKey.slice(0, 12);
+            return { apiKey, keyPrefix };
+        }
+        const error = isObject(res.json) && typeof res.json.error === "string" ? res.json.error : "";
+        if (res.status === 429 || error === "slow_down") {
+            interval = Math.min(MAX_INTERVAL_SEC, interval + SLOW_DOWN_STEP_SEC);
+            continue;
+        }
+        if (error === "authorization_pending")
+            continue;
+        if (error === "expired_token")
+            throw expired();
+        if (error === "access_denied") {
+            throw new LoginError("LOGIN_DENIED", "the request was denied in the hosted console; nothing was saved");
+        }
+        if (error === "api_key.cap_reached") {
+            // Approved on the console, but the workspace is at its key cap. The request stays approved on the server.
+            throw new LoginError("LOGIN_CAP_REACHED", "this workspace has the maximum number of API keys; revoke an unused key in the console, then run kya login again");
+        }
+        throw new LoginError("LOGIN_WRONG_STATE", "the hosted console sent an unexpected answer; nothing was saved");
+    }
+}
+//# sourceMappingURL=device-flow.js.map

package/dist/login/device-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-flow.js","sourceRoot":"","sources":["../../src/login/device-flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAY7C,iGAAiG;AACjG,MAAM,OAAO,UAAW,SAAQ,KAAK;IAExB;IADX,YACW,IAAoB,EAC7B,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,SAAI,GAAJ,IAAI,CAAgB;QAI7B,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF;AAyBD,MAAM,CAAC,MAAM,gBAAgB,GAAG,yBAAyB,CAAC;AAC1D,MAAM,CAAC,MAAM,iBAAiB,GAAG,0BAA0B,CAAC;AAC5D,8EAA8E;AAC9E,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAC7B,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,wFAAwF;AACxF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AACxC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,cAAc,GAAG,uBAAuB,CAAC;AAC/C,MAAM,YAAY,GAAG,sBAAsB,CAAC;AAC5C,MAAM,MAAM,GAAG,sBAAsB,CAAC;AAEtC;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,MAAM,GAAG,GAAG,CAAC,GAAW,EAAS,EAAE;QACjC,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,sBAAsB,GAAG,EAAE,CAAC,CAAC;IACrE,CAAC,CAAC;IACF,IAAI,CAAC,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,GAAG,CAAC,+BAA+B,CAAC,CAAC;IAC3E,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;QAAE,GAAG,CAAC,4BAA4B,CAAC,CAAC;IACpE,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI;QAAE,GAAG,CAAC,oCAAoC,CAAC,CAAC;IACtE,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACnF,GAAG,CAAC,mDAAmD,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,iHAAiH;AACjH,KAAK,UAAU,QAAQ,CACrB,GAAW,EACX,IAAa,EACb,IAAoB;IAEpB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IACpC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,gBAAgB,IAAI,kBAAkB,CAAC,CAAC;IAChG,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YAC7B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;YAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;QACH,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,GAAG,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IACtC,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,yDAAyD;AACzD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAS,EAAE,IAAoB;IACrE,IAAI,GAAsC,CAAC;IAC3C,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,IAAI,CAAC,CAAC;IAC7H,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,uDAAuD,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,UAAU,CAAC,mBAAmB,EAAE,iEAAiE,CAAC,CAAC;IAC/G,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,UAAU,CAAC,oBAAoB,EAAE,kFAAkF,CAAC,CAAC;IACjI,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,UAAU,CAAC,mBAAmB,EAAE,iEAAiE,CAAC,CAAC;IAC/G,CAAC;IACD,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC;IACnB,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACtG,MAAM,QAAQ,GACZ,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACjH,IAAI,YAA6B,CAAC;IAClC,IAAI,CAAC;QACH,YAAY,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,YAAY,GAAG,SAAS,CAAC;IAC3B,CAAC;IACD,gGAAgG;IAChG,MAAM,UAAU,GAAG,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC;IACrF,IACE,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC;QAChC,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC5B,CAAC,UAAU;QACX,OAAO,GAAG,CAAC;QACX,OAAO,GAAG,IAAI;QACd,QAAQ,GAAG,CAAC;QACZ,QAAQ,GAAG,gBAAgB,EAC3B,CAAC;QACD,MAAM,IAAI,UAAU,CAAC,mBAAmB,EAAE,iEAAiE,CAAC,CAAC;IAC/G,CAAC;IACD,OAAO;QACL,UAAU;QACV,QAAQ;QACR,eAAe,EAAE,YAAa,CAAC,QAAQ,EAAE;QACzC,YAAY,EAAE,OAAO;QACrB,WAAW,EAAE,QAAQ;KACtB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAS,EAAE,IAAgB,EAAE,IAAoB;IAClF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1F,MAAM,QAAQ,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;IAClD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC7D,IAAI,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC;IAChC,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,IAAI,UAAU,CAAC,eAAe,EAAE,4DAA4D,CAAC,CAAC;IAEhG,SAAS,CAAC;QACR,IAAI,GAAG,EAAE,IAAI,QAAQ;YAAE,MAAM,OAAO,EAAE,CAAC;QACvC,MAAM,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;QAC7B,IAAI,GAAG,EAAE,IAAI,QAAQ;YAAE,MAAM,OAAO,EAAE,CAAC;QAEvC,IAAI,GAAsC,CAAC;QAC3C,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,EAAE,SAAS,IAAI,sBAAsB,EAAE,CAAC;gBAC1C,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,0DAA0D,CAAC,CAAC;YACpG,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,IAAI,UAAU,CAAC,mBAAmB,EAAE,iEAAiE,CAAC,CAAC;QAC/G,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YACtB,IAAI,EAAE,SAAS,IAAI,sBAAsB,EAAE,CAAC;gBAC1C,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,0DAA0D,CAAC,CAAC;YACpG,CAAC;YACD,SAAS;QACX,CAAC;QACD,SAAS,GAAG,CAAC,CAAC;QACd,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,UAAU,CAAC,mBAAmB,EAAE,iEAAiE,CAAC,CAAC;YAC/G,CAAC;YACD,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACxG,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC/B,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7F,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;YAChD,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,QAAQ,GAAG,kBAAkB,CAAC,CAAC;YACrE,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,uBAAuB;YAAE,SAAS;QAChD,IAAI,KAAK,KAAK,eAAe;YAAE,MAAM,OAAO,EAAE,CAAC;QAC/C,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;YAC9B,MAAM,IAAI,UAAU,CAAC,cAAc,EAAE,iEAAiE,CAAC,CAAC;QAC1G,CAAC;QACD,IAAI,KAAK,KAAK,qBAAqB,EAAE,CAAC;YACpC,0GAA0G;YAC1G,MAAM,IAAI,UAAU,CAClB,mBAAmB,EACnB,kHAAkH,CACnH,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,UAAU,CAAC,mBAAmB,EAAE,iEAAiE,CAAC,CAAC;IAC/G,CAAC;AACH,CAAC"}

package/dist/map/build.d.ts

@@ -0,0 +1,58 @@
+import { type TargetFamily } from "./target-class.js";
+import { type MapGraph, type ToolClass, type TrailEventLike, type Verdicts } from "./types.js";
+export interface BuildOptions {
+    /** Per-install salt for sessionHash. Tests pass a fixed value. */
+    salt: string;
+    /** Needed when `days` is set. The builder reads no clock. */
+    now?: Date;
+    /** Hard node cap per view (schema section 7). Default 100. */
+    maxNodes?: number;
+    /** Keep only rows at or after now minus `days`. */
+    days?: number;
+    /** Full export: no grouping, no caps. */
+    uncapped?: boolean;
+    /** Counts from readTrailFile, added to the view. */
+    read?: {
+        rowsRead: number;
+        rowsSkipped: number;
+        rowsOutOfWindow: number;
+    };
+}
+export interface TrailRead {
+    events: TrailEventLike[];
+    rowsRead: number;
+    rowsSkipped: number;
+    rowsOutOfWindow: number;
+}
+type Bucket = keyof Verdicts;
+/** Shape check for one row. Bad rows are skipped and counted, never thrown. */
+export declare function isTrailRow(x: unknown): x is TrailEventLike;
+/** Verdict bucket, schema section 3. First match wins. */
+export declare function bucketOf(e: TrailEventLike): Bucket;
+/** Tool class, schema 4.1. First match wins. */
+export declare function toolClassOf(e: TrailEventLike): ToolClass;
+/** A stored class is trusted only when it has the shape the writer produces: short, printable, `family:rest` or `none`. */
+export declare const SAFE_CLASS: RegExp;
+export declare function targetOf(e: TrailEventLike): {
+    cls: string;
+    family: TargetFamily;
+};
+/** Salted hash of one session (16 hex). The raw session id can be a host product id, so it never leaves the machine. */
+export declare function sessionHash(salt: string, product: string, sessionId: string): string;
+/**
+ * Builds the map graph from trail rows. Pure: same rows and options give the same JSON.
+ * Caps (schema section 7): 25 agents, 20 tools, 40 targets shown; the rest fold into "other" nodes.
+ * Deny, hold and secret targets are always shown. The node and edge caps shrink the per-type caps until they fit.
+ */
+export declare function buildMap(events: Iterable<TrailEventLike>, opts: BuildOptions): MapGraph;
+/**
+ * Streams the whole trail file line by line. Unlike readTrail (tail read, 1 MB), this reads every row.
+ * Bad lines (not JSON, or wrong shape) are skipped and counted. Rows older than `days` are counted, not kept.
+ * A filter, not a stop: the file is not sorted (import rows dated 2025 come first).
+ */
+export declare function readTrailFile(path: string, opts?: {
+    days?: number;
+    now?: Date;
+}): Promise<TrailRead>;
+export {};
+//# sourceMappingURL=build.d.ts.map

package/dist/map/build.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../src/map/build.ts"],"names":[],"mappings":"AAGA,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,EAIL,KAAK,QAAQ,EAGb,KAAK,SAAS,EAEd,KAAK,cAAc,EACnB,KAAK,QAAQ,EACd,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,YAAY;IAC3B,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,GAAG,CAAC,EAAE,IAAI,CAAC;IACX,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yCAAyC;IACzC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,oDAAoD;IACpD,IAAI,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3E;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;CACzB;AAYD,KAAK,MAAM,GAAG,MAAM,QAAQ,CAAC;AAE7B,+EAA+E;AAC/E,wBAAgB,UAAU,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,cAAc,CAa1D;AAED,0DAA0D;AAC1D,wBAAgB,QAAQ,CAAC,CAAC,EAAE,cAAc,GAAG,MAAM,CAMlD;AAED,gDAAgD;AAChD,wBAAgB,WAAW,CAAC,CAAC,EAAE,cAAc,GAAG,SAAS,CAWxD;AAQD,2HAA2H;AAC3H,eAAO,MAAM,UAAU,QAAyC,CAAC;AAEjE,wBAAgB,QAAQ,CAAC,CAAC,EAAE,cAAc,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,CAMjF;AAkGD,wHAAwH;AACxH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAEpF;AAgOD;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,YAAY,GAAG,QAAQ,CA8DvF;AAaD;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,IAAI,CAAA;CAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CA4B9G"}