@shield-agent/kya 0.32.7 → 0.33.1

package/dist/map/load.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Loads the map for one trail: streams the file, filters one session, builds the graph and the heat views.
+ * Shared by `kya map` and the live report, so both show the same numbers.
+ */
+import { type TrailRead } from "./build.js";
+import { type Heat } from "./heat.js";
+import type { MapGraph, TrailEventLike } from "./types.js";
+/** The When view is always seven days, so the read covers at least seven. */
+export declare const HEAT_DAYS = 7;
+export interface LoadMapOptions {
+    readonly path: string;
+    /** Graph window in days. */
+    readonly days: number;
+    readonly now: Date;
+    /** Per-install salt for sessionHash. */
+    readonly salt: string;
+    readonly session?: string;
+    /** Offset east of UTC in minutes, for the When view. */
+    readonly tzOffsetMinutes: number;
+}
+export interface LoadedMap {
+    readonly graph: MapGraph;
+    readonly heat: Heat;
+    /** Events in the graph window (after the session filter). */
+    readonly windowEvents: number;
+}
+/** Rows of the last `days` days, one session when `session` is set. Shared by `kya map` and `kya export`. */
+export declare function loadTrailEvents(opts: {
+    path: string;
+    days: number;
+    now: Date;
+    session?: string;
+}): Promise<{
+    read: TrailRead;
+    events: TrailEventLike[];
+}>;
+export declare function loadMap(opts: LoadMapOptions): Promise<LoadedMap>;
+//# sourceMappingURL=load.d.ts.map

package/dist/map/load.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load.d.ts","sourceRoot":"","sources":["../../src/map/load.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAA2B,KAAK,SAAS,EAAE,MAAM,YAAY,CAAC;AACrE,OAAO,EAAa,KAAK,IAAI,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE3D,6EAA6E;AAC7E,eAAO,MAAM,SAAS,IAAI,CAAC;AAE3B,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4BAA4B;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;IACnB,wCAAwC;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,wDAAwD;IACxD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,6DAA6D;IAC7D,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAcD,6GAA6G;AAC7G,wBAAsB,eAAe,CAAC,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,IAAI,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,cAAc,EAAE,CAAA;CAAE,CAAC,CAG/J;AAED,wBAAsB,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,CAAC,CAWtE"}

package/dist/map/load.js

@@ -0,0 +1,38 @@
+/**
+ * Loads the map for one trail: streams the file, filters one session, builds the graph and the heat views.
+ * Shared by `kya map` and the live report, so both show the same numbers.
+ */
+import { buildMap, readTrailFile } from "./build.js";
+import { buildHeat } from "./heat.js";
+/** The When view is always seven days, so the read covers at least seven. */
+export const HEAT_DAYS = 7;
+const EMPTY_READ = { events: [], rowsRead: 0, rowsSkipped: 0, rowsOutOfWindow: 0 };
+/** A missing trail is an empty trail. Any other read error is thrown. */
+async function readOrEmpty(path, days, now) {
+    try {
+        return await readTrailFile(path, { days, now });
+    }
+    catch (err) {
+        if (err?.code === "ENOENT")
+            return EMPTY_READ;
+        throw err;
+    }
+}
+/** Rows of the last `days` days, one session when `session` is set. Shared by `kya map` and `kya export`. */
+export async function loadTrailEvents(opts) {
+    const read = await readOrEmpty(opts.path, opts.days, opts.now);
+    return { read, events: opts.session ? read.events.filter((e) => e.sessionId === opts.session) : read.events };
+}
+export async function loadMap(opts) {
+    const { read, events } = await loadTrailEvents({ path: opts.path, days: Math.max(opts.days, HEAT_DAYS), now: opts.now, session: opts.session });
+    const graph = buildMap(events, {
+        salt: opts.salt,
+        now: opts.now,
+        days: opts.days,
+        read: { rowsRead: read.rowsRead, rowsSkipped: read.rowsSkipped, rowsOutOfWindow: read.rowsOutOfWindow },
+    });
+    const heat = buildHeat(events, { now: opts.now, days: HEAT_DAYS, tzOffsetMinutes: opts.tzOffsetMinutes });
+    const windowEvents = graph.nodes.filter((n) => n.kind === "device").reduce((s, n) => s + n.count, 0);
+    return { graph, heat, windowEvents };
+}
+//# sourceMappingURL=load.js.map

package/dist/map/load.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"load.js","sourceRoot":"","sources":["../../src/map/load.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAkB,MAAM,YAAY,CAAC;AACrE,OAAO,EAAE,SAAS,EAAa,MAAM,WAAW,CAAC;AAGjD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC;AAqB3B,MAAM,UAAU,GAAc,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC;AAE9F,yEAAyE;AACzE,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,IAAY,EAAE,GAAS;IAC9D,IAAI,CAAC;QACH,OAAO,MAAM,aAAa,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,EAAE,IAAI,KAAK,QAAQ;YAAE,OAAO,UAAU,CAAC;QACzE,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,6GAA6G;AAC7G,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAiE;IACrG,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;AAChH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAoB;IAChD,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAChJ,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE;QAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE;KACxG,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;IAC1G,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACrG,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AACvC,CAAC"}

package/dist/map/page.d.ts

@@ -0,0 +1,90 @@
+import type { Heat } from "./heat.js";
+import type { MapGraph, Verdicts } from "./types.js";
+/** The one line that says what the map is not. Shown on every map page. */
+export declare const ADVISORY_LINE = "Recorded by KYA. The open source check is advisory; this map shows what was recorded, not what was enforced.";
+/** Edge colours by dominant verdict. Deny beats hold, hold beats observed, observed beats allow (schema section 3). */
+export declare const TONE_COLOUR: {
+    readonly deny: "#b42318";
+    readonly hold: "#b54708";
+    readonly observed: "#667085";
+    readonly allow: "#067647";
+};
+export type EdgeTone = keyof typeof TONE_COLOUR;
+/** Tone of an edge from its verdict counts. Any deny makes the edge red. */
+export declare function edgeTone(v: Verdicts): EdgeTone;
+/** Edge width grows with log(count): 1 for one event, about 3 for 10, about 5 for 100. */
+export declare function edgeWidth(count: number): number;
+/**
+ * JSON for a `<script type="application/json">` body. `<`, `>` and `&` and the two line separators become
+ * \u escapes, so the text can never close the script element or start a tag. JSON.parse reads them back unchanged.
+ */
+export declare function jsonForScript(value: unknown): string;
+export declare function scanMapOutput(text: string): void;
+/** HTML text and attribute escape. */
+export declare function esc(s: string): string;
+/** Data the draw script reads: nodes with a label and detail, edges with tone and width (computed here, not in the browser). */
+export declare function drawModel(graph: MapGraph): {
+    colours: {
+        readonly deny: "#b42318";
+        readonly hold: "#b54708";
+        readonly observed: "#667085";
+        readonly allow: "#067647";
+    };
+    nodes: {
+        id: string;
+        kind: "target" | "agent" | "device" | "tool";
+        label: string;
+        detail: string;
+        count: number;
+        verdicts: Verdicts;
+        firstTs: string;
+        lastTs: string;
+    }[];
+    edges: {
+        id: string;
+        source: string;
+        target: string;
+        kind: "runs" | "uses" | "touches";
+        tool: string | null;
+        tone: "hold" | "deny" | "allow" | "observed";
+        colour: "#b42318" | "#b54708" | "#667085" | "#067647";
+        width: number;
+        count: number;
+        verdicts: Verdicts;
+        firstTs: string;
+        lastTs: string;
+    }[];
+};
+/**
+ * The page body: summary, graph container, side panel, both heat tables, and the data. Used inside the standalone
+ * file and as the live report's Map fragment. The graph is drawn by MAP_SCRIPT from the data element.
+ */
+export declare function renderMapBody(graph: MapGraph, heat: Heat, days: number): string;
+/** The vendored Cytoscape.js (MIT, see vendor/cytoscape/LICENSE). `</script` is broken so it cannot end the element. */
+export declare function cytoscapeSource(): string;
+/** Content-Security-Policy for the standalone file. No network: default-src none. */
+export declare const MAP_CSP = "default-src 'none'; style-src 'unsafe-inline'; script-src 'unsafe-inline'; img-src data:";
+/**
+ * The browser part. Labels go to Cytoscape (canvas) or textContent. The live body is parsed with DOMParser (the body
+ * has no executable script), so this file never assigns innerHTML.
+ */
+export declare const MAP_SCRIPT = "(function () {\n  'use strict';\n  var cy = null;\n  var last = null;\n  var live = !!document.querySelector('main[data-live-token]');\n  function token() {\n    var m = /(?:^|[?&])t=([^&]*)/.exec(location.search);\n    if (!m) return '';\n    try { return decodeURIComponent(m[1]); } catch (e) { return m[1]; }\n  }\n  function model() {\n    var el = document.getElementById('kya-map-data');\n    if (!el) return null;\n    try { return JSON.parse(el.textContent || 'null'); } catch (e) { return null; }\n  }\n  function add(parent, tag, text) {\n    var n = document.createElement(tag);\n    n.textContent = String(text);\n    parent.appendChild(n);\n    return n;\n  }\n  function showNode(node) {\n    var panel = document.getElementById('kya-map-panel');\n    if (!panel) return;\n    while (panel.firstChild) panel.removeChild(panel.firstChild);\n    add(panel, 'h3', node.kind + ': ' + node.label);\n    add(panel, 'p', 'Class: ' + node.detail);\n    var list = document.createElement('dl');\n    panel.appendChild(list);\n    [['Events', node.count], ['Allow', node.verdicts.allow], ['Deny', node.verdicts.deny], ['Hold', node.verdicts.hold],\n     ['Observed', node.verdicts.observed], ['First seen', node.firstTs || '-'], ['Last seen', node.lastTs || '-']]\n      .forEach(function (r) { add(list, 'dt', r[0]); add(list, 'dd', r[1]); });\n  }\n  function style(d) {\n    var out = [\n      { selector: 'node', style: { 'label': 'data(label)', 'font-size': 10, 'text-wrap': 'ellipsis', 'text-max-width': 130, 'min-zoomed-font-size': 9,\n        'text-background-color': '#ffffff', 'text-background-opacity': 0.8, 'text-background-padding': 1,\n        'width': 18, 'height': 18, 'background-color': '#98a2b3', 'color': '#101828' } },\n      { selector: 'node[kind = \"device\"]', style: { 'background-color': '#344054', 'shape': 'round-rectangle', 'width': 34, 'height': 34 } },\n      { selector: 'node[kind = \"agent\"]', style: { 'background-color': '#1d4ed8' } },\n      { selector: 'node[kind = \"tool\"]', style: { 'background-color': '#7a5af8', 'shape': 'round-rectangle' } },\n      { selector: 'node[kind = \"target\"]', style: { 'background-color': '#0e9384' } },\n      { selector: 'edge', style: { 'width': 'data(width)', 'line-color': 'data(colour)', 'target-arrow-color': 'data(colour)',\n        'target-arrow-shape': 'triangle', 'curve-style': 'bezier', 'opacity': 0.9 } }\n    ];\n    return out;\n  }\n  var MAX_DRAW_NODES = 400;\n  function draw() {\n    var host = document.getElementById('kya-map-graph');\n    var d = model();\n    if (cy) { cy.destroy(); cy = null; }\n    if (!host || !d || !window.cytoscape || !d.nodes || !d.nodes.length) return;\n    // A force layout on thousands of nodes hangs the tab. The JSON and both heat views still hold everything.\n    if (d.nodes.length > MAX_DRAW_NODES) {\n      host.textContent = 'Graph not drawn: ' + d.nodes.length + ' nodes is too many for the page. Use a shorter window (kya map --days 1) or kya map --json.';\n      return;\n    }\n    cy = window.cytoscape({\n      container: host,\n      elements: {\n        nodes: d.nodes.map(function (n) { return { data: n }; }),\n        edges: d.edges.map(function (e) { return { data: e }; })\n      },\n      style: style(d),\n      layout: { name: 'cose', animate: false, randomize: true, fit: true, padding: 24, numIter: 900, nodeRepulsion: function () { return 9000; }, idealEdgeLength: function () { return 80; }, nodeOverlap: 14, gravity: 0.35 }\n    });\n    cy.on('tap', 'node', function (evt) { showNode(evt.target.data()); });\n    cy.fit();\n  }\n  function refresh() {\n    if (!live) return;\n    var host = document.getElementById('frag-map');\n    if (!host) return;\n    fetch('/fragments?t=' + encodeURIComponent(token()), {\n      method: 'POST', headers: { 'Content-Type': 'application/json' }, body: '{\"map\":true}'\n    })\n      .then(function (r) { if (!r.ok) throw new Error('HTTP ' + r.status); return r.json(); })\n      .then(function (j) {\n        if (!j || !j.ok || !j.fragments || typeof j.fragments.mapBody !== 'string') return;\n        if (j.fragments.mapBody === last) return;\n        last = j.fragments.mapBody;\n        var doc = new DOMParser().parseFromString(j.fragments.mapBody, 'text/html');\n        var nodes = Array.prototype.slice.call(doc.body.childNodes);\n        while (host.firstChild) host.removeChild(host.firstChild);\n        nodes.forEach(function (n) { host.appendChild(n); });\n        draw();\n      })\n      .catch(function (err) { console.error('KYA map refresh failed', err); });\n  }\n  // Live only: fetch the vendored library with the token from this page's URL, then run it as a script element.\n  function loadLibrary(next) {\n    if (window.cytoscape) { next(); return; }\n    fetch('/vendor/cytoscape.min.js?t=' + encodeURIComponent(token()))\n      .then(function (r) { if (!r.ok) throw new Error('HTTP ' + r.status); return r.text(); })\n      .then(function (text) {\n        var s = document.createElement('script');\n        s.id = 'kya-cytoscape';\n        s.textContent = text;\n        document.head.appendChild(s);\n        next();\n      })\n      .catch(function (err) { console.error('KYA map library failed', err); });\n  }\n  window.kyaMapRefresh = refresh;\n  window.addEventListener('hashchange', function () {\n    if (location.hash !== '#map') return;\n    refresh();\n    setTimeout(function () { if (cy) { cy.resize(); cy.fit(); } }, 0);\n  });\n  if (live) loadLibrary(refresh); else draw();\n})();";
+/**
+ * Live report: the draw script, in the page shell (not in the swapped fragment). The script reads the token from its
+ * own URL and fetches the library from /vendor/cytoscape.min.js, so the token never appears in the HTML.
+ */
+export declare function liveMapScripts(): string;
+/** Map components. Shared by the standalone file and the live report, so it uses the report's tokens (--line, --mute, --fg, --bg). */
+export declare const MAP_CSS = "\n  .map-body .map-advisory { border-left: 3px solid var(--line, #d0d5dd); padding: 4px 10px; font-weight: 600; }\n  .map-body .mute { color: var(--mute, #667085); }\n  .map-stats p { margin: 4px 0; }\n  .map-top { margin: 4px 0 12px 20px; padding: 0; }\n  .map-canvas { display: grid; grid-template-columns: minmax(0, 1fr) 260px; gap: 12px; margin: 12px 0; }\n  .map-graph { height: 60vh; min-height: 360px; border: 1px solid var(--line, #d0d5dd); border-radius: 6px; }\n  .map-panel { border: 1px solid var(--line, #d0d5dd); border-radius: 6px; padding: 8px 12px; overflow: auto; }\n  .map-panel dl { display: grid; grid-template-columns: auto 1fr; gap: 2px 10px; }\n  .map-panel dt { color: var(--mute, #667085); }\n  .map-panel dd { margin: 0; }\n  .map-scroll { overflow-x: auto; }\n  .map-heat { border-collapse: collapse; font-size: 12px; margin-bottom: 12px; }\n  .map-heat caption { text-align: left; color: var(--mute, #667085); padding: 4px 0; }\n  .map-heat th, .map-heat td { border: 1px solid var(--line, #d0d5dd); padding: 3px 5px; text-align: right; min-width: 22px; }\n  .map-heat th { text-align: left; font-weight: 600; }\n  .map-heat td.l0 { background: transparent; }\n  .map-heat td.l1 { background: #d1fadf; color: #101828; }\n  .map-heat td.l2 { background: #75e0a7; color: #101828; }\n  .map-heat td.l3 { background: #12b76a; color: #fff; }\n  .map-heat td.l4 { background: #027a48; color: #fff; }\n  .map-heat td.deny { outline: 2px solid #b42318; outline-offset: -2px; }\n  .map-empty { font-weight: 600; }\n  @media (max-width: 760px) { .map-canvas { grid-template-columns: 1fr; } }\n";
+/** Live report: the Map zone shows only on its tab (same :target rule as the other zones). */
+export declare const MAP_LIVE_ZONE_CSS = "\n  @supports selector(body:has(*)) {\n    #map { display: none; }\n    #map:target { display: block; }\n    body:has(#map:target) #overview { display: none; }\n    body:has(#map:target) .nav-link[href=\"#map\"] { color: var(--fg); background: var(--bg); border-color: var(--line); }\n  }\n";
+/** Standalone file only: its own tokens and page frame (the live report has its own). */
+export declare const MAP_PAGE_CSS = "\n  :root { --fg: #101828; --mute: #667085; --line: #d0d5dd; --bg: #ffffff; }\n  @media (prefers-color-scheme: dark) { :root:not([data-theme=\"light\"]) { --fg: #f2f4f7; --mute: #98a2b3; --line: #344054; --bg: #101828; } }\n  :root[data-theme=\"dark\"] { --fg: #f2f4f7; --mute: #98a2b3; --line: #344054; --bg: #101828; }\n  body { background: var(--bg); color: var(--fg); font: 14px/1.45 system-ui, sans-serif; margin: 0; }\n  .map-page { max-width: 1100px; margin: 0 auto; padding: 16px; }\n";
+/** Standalone file: one page, no network, CSP on. */
+export declare function renderMapPage(input: {
+    graph: MapGraph;
+    heat: Heat;
+    days: number;
+    title: string;
+}): string;
+//# sourceMappingURL=page.d.ts.map

package/dist/map/page.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"page.d.ts","sourceRoot":"","sources":["../../src/map/page.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,KAAK,EAAE,QAAQ,EAAW,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE9D,2EAA2E;AAC3E,eAAO,MAAM,aAAa,iHACsF,CAAC;AAEjH,uHAAuH;AACvH,eAAO,MAAM,WAAW;;;;;CAAuF,CAAC;AAChH,MAAM,MAAM,QAAQ,GAAG,MAAM,OAAO,WAAW,CAAC;AAEhD,4EAA4E;AAC5E,wBAAgB,QAAQ,CAAC,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAK9C;AAED,0FAA0F;AAC1F,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEpD;AAOD,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAEhD;AAED,sCAAsC;AACtC,wBAAgB,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAErC;AAED,gIAAgI;AAChI,wBAAgB,SAAS,CAAC,KAAK,EAAE,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA+BxC;AAuED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAsB/E;AAKD,wHAAwH;AACxH,wBAAgB,eAAe,IAAI,MAAM,CAKxC;AAED,qFAAqF;AACrF,eAAO,MAAM,OAAO,6FAA6F,CAAC;AAElH;;;GAGG;AACH,eAAO,MAAM,UAAU,y5KA+GjB,CAAC;AAEP;;;GAGG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED,sIAAsI;AACtI,eAAO,MAAM,OAAO,ilDAwBnB,CAAC;AAEF,8FAA8F;AAC9F,eAAO,MAAM,iBAAiB,uSAO7B,CAAC;AAEF,yFAAyF;AACzF,eAAO,MAAM,YAAY,ifAMxB,CAAC;AAEF,qDAAqD;AACrD,wBAAgB,aAAa,CAAC,KAAK,EAAE;IAAE,KAAK,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAyBzG"}

package/dist/map/page.js

@@ -0,0 +1,374 @@
+/**
+ * Map page: one body renderer for `kya map --html` and the live report's Map tab, plus the browser draw script.
+ * Every string from the trail is untrusted. Server HTML escapes it with esc(). The embedded JSON escapes `<`, `>`,
+ * `&`, U+2028 and U+2029. The draw script writes labels through Cytoscape or textContent, never as HTML.
+ */
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { assertNoSecrets } from "../dash/render.js";
+/** The one line that says what the map is not. Shown on every map page. */
+export const ADVISORY_LINE = "Recorded by KYA. The open source check is advisory; this map shows what was recorded, not what was enforced.";
+/** Edge colours by dominant verdict. Deny beats hold, hold beats observed, observed beats allow (schema section 3). */
+export const TONE_COLOUR = { deny: "#b42318", hold: "#b54708", observed: "#667085", allow: "#067647" };
+/** Tone of an edge from its verdict counts. Any deny makes the edge red. */
+export function edgeTone(v) {
+    if (v.deny > 0)
+        return "deny";
+    if (v.hold > 0)
+        return "hold";
+    if (v.observed > 0)
+        return "observed";
+    return "allow";
+}
+/** Edge width grows with log(count): 1 for one event, about 3 for 10, about 5 for 100. */
+export function edgeWidth(count) {
+    return Math.round((1 + 2 * Math.log10(Math.max(1, count))) * 100) / 100;
+}
+/**
+ * JSON for a `<script type="application/json">` body. `<`, `>` and `&` and the two line separators become
+ * \u escapes, so the text can never close the script element or start a tag. JSON.parse reads them back unchanged.
+ */
+export function jsonForScript(value) {
+    return JSON.stringify(value).replace(/[<>&\u2028\u2029]/g, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`);
+}
+/**
+ * Secret scan for map output. The shared keyword rule reads `secret:<family>` class labels as a secret assignment
+ * (`secret:cloud-credential` is 16 characters), so those exact labels are masked first. Everything else is scanned.
+ */
+const SECRET_CLASS = /\bsecret:(ssh-key|cloud-credential|gpg|env-file|package-token|key-file|other)\b/g;
+export function scanMapOutput(text) {
+    assertNoSecrets(text.replace(SECRET_CLASS, "secret-class:$1"));
+}
+/** HTML text and attribute escape. */
+export function esc(s) {
+    return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+/** Data the draw script reads: nodes with a label and detail, edges with tone and width (computed here, not in the browser). */
+export function drawModel(graph) {
+    return {
+        colours: TONE_COLOUR,
+        nodes: graph.nodes.map((n) => ({
+            id: n.id,
+            kind: n.kind,
+            label: n.label ?? n.id,
+            detail: detailOf(n),
+            count: n.count,
+            verdicts: n.verdicts,
+            firstTs: n.firstTs,
+            lastTs: n.lastTs,
+        })),
+        edges: graph.edges.map((e, i) => {
+            const tone = edgeTone(e.verdicts);
+            return {
+                id: `e${i}`,
+                source: e.from,
+                target: e.to,
+                kind: e.kind,
+                tool: e.tool ?? null,
+                tone,
+                colour: TONE_COLOUR[tone],
+                width: edgeWidth(e.count),
+                count: e.count,
+                verdicts: e.verdicts,
+                firstTs: e.firstTs,
+                lastTs: e.lastTs,
+            };
+        }),
+    };
+}
+function detailOf(n) {
+    if (n.kind === "target")
+        return n.class;
+    if (n.kind === "tool")
+        return n.toolId;
+    if (n.kind === "agent")
+        return n.legacy ? `${n.product} (legacy rows)` : n.product;
+    return n.id;
+}
+const SHOWN_TARGETS = 5;
+function sum(nums) {
+    return nums.reduce((a, b) => a + b, 0);
+}
+/** Level 0 to 4 for a count, relative to the largest count on the page. */
+function level(count, max) {
+    if (count <= 0 || max <= 0)
+        return 0;
+    return Math.min(4, Math.ceil((4 * count) / max));
+}
+function summaryHtml(graph) {
+    const devices = graph.nodes.filter((n) => n.kind === "device");
+    const events = sum(devices.map((n) => n.count));
+    const sessions = sum(graph.nodes.filter((n) => n.kind === "agent").map((n) => n.grouped ?? 1));
+    const classes = graph.nodes
+        .filter((n) => n.kind === "target" && n.grouped === undefined)
+        .sort((a, b) => b.count - a.count || (a.class < b.class ? -1 : a.class > b.class ? 1 : 0))
+        .slice(0, SHOWN_TARGETS);
+    const top = classes.length
+        ? `<ol class="map-top">${classes.map((c) => `<li><code>${esc(c.class)}</code> ${c.count}</li>`).join("")}</ol>`
+        : `<p class="mute">No targets yet.</p>`;
+    return `<div class="map-stats">
+  <p><strong>${events}</strong> events · <strong>${sessions}</strong> sessions · <strong>${devices.length}</strong> device${devices.length === 1 ? "" : "s"}</p>
+  <p class="small">Top ${SHOWN_TARGETS} target classes:</p>
+  ${top}
+</div>`;
+}
+function whenTable(heat) {
+    const head = heat.when.hours.map((h) => `<th scope="col">${String(h).padStart(2, "0")}</th>`).join("");
+    const rows = heat.when.days.map((day, d) => {
+        const cells = heat.when.cells[d].map((count, h) => {
+            const v = heat.when.verdictCells[d][h];
+            const deny = v.deny > 0 ? " deny" : "";
+            const title = `${day} ${String(h).padStart(2, "0")}:00 - ${count} event${count === 1 ? "" : "s"}${v.deny > 0 ? `, ${v.deny} denied` : ""}`;
+            return `<td class="l${level(count, heat.when.max)}${deny}" title="${esc(title)}">${count || ""}</td>`;
+        });
+        return `<tr><th scope="row">${esc(day)}</th>${cells.join("")}</tr>`;
+    });
+    return `<table class="map-heat map-when">
+  <caption>When: events per hour, last 7 days (local time). A red outline marks an hour with a deny.</caption>
+  <thead><tr><th scope="col">Day</th>${head}</tr></thead>
+  <tbody>${rows.join("")}</tbody>
+</table>`;
+}
+function whereTable(heat) {
+    const rows = heat.where.rows.map((r) => {
+        const cell = (count, col) => `<td class="l${level(count, heat.where.max)}${col === "deny" && count > 0 ? " deny" : ""}">${count || ""}</td>`;
+        const name = r.grouped !== undefined ? `${r.class} (${r.grouped})` : r.class;
+        return `<tr><th scope="row"><code>${esc(name)}</code></th>${cell(r.allow, "allow")}${cell(r.deny, "deny")}${cell(r.hold, "hold")}${cell(r.observed, "observed")}</tr>`;
+    });
+    return `<table class="map-heat map-where">
+  <caption>Where: events per target class and verdict.</caption>
+  <thead><tr><th scope="col">Target class</th><th scope="col">Allow</th><th scope="col">Deny</th><th scope="col">Hold</th><th scope="col">Observed</th></tr></thead>
+  <tbody>${rows.join("") || `<tr><td colspan="5" class="mute">No targets.</td></tr>`}</tbody>
+</table>`;
+}
+/**
+ * The page body: summary, graph container, side panel, both heat tables, and the data. Used inside the standalone
+ * file and as the live report's Map fragment. The graph is drawn by MAP_SCRIPT from the data element.
+ */
+export function renderMapBody(graph, heat, days) {
+    const events = sum(graph.nodes.filter((n) => n.kind === "device").map((n) => n.count));
+    const empty = events === 0 ? `<p class="map-empty">No events in the last ${days} days.</p>` : "";
+    const graphBlock = events === 0
+        ? ""
+        : `<div class="map-canvas">
+  <div id="kya-map-graph" class="map-graph" aria-label="Map of agent actions"></div>
+  <aside id="kya-map-panel" class="map-panel" aria-live="polite"><p class="mute">Click a node to see its class, counts and first and last time.</p></aside>
+</div>
+<p class="map-legend small">Edges: red = deny, amber = hold, grey = observed (recorded, not enforced), green = allow. Width grows with the count.</p>`;
+    return `<div class="map-body">
+  <p class="map-advisory">${esc(ADVISORY_LINE)}</p>
+  ${summaryHtml(graph)}
+  ${empty}
+  ${graphBlock}
+  <h2>When</h2>
+  <div class="map-scroll">${whenTable(heat)}</div>
+  <h2>Where</h2>
+  <div class="map-scroll">${whereTable(heat)}</div>
+  <script type="application/json" id="kya-map-data">${jsonForScript(drawModel(graph))}</script>
+</div>`;
+}
+const LIBRARY_PATH = new URL("../../vendor/cytoscape/cytoscape.min.js", import.meta.url);
+let librarySource;
+/** The vendored Cytoscape.js (MIT, see vendor/cytoscape/LICENSE). `</script` is broken so it cannot end the element. */
+export function cytoscapeSource() {
+    if (librarySource === undefined) {
+        librarySource = readFileSync(fileURLToPath(LIBRARY_PATH), "utf8").replace(/<\/(script)/gi, "<\\/$1");
+    }
+    return librarySource;
+}
+/** Content-Security-Policy for the standalone file. No network: default-src none. */
+export const MAP_CSP = "default-src 'none'; style-src 'unsafe-inline'; script-src 'unsafe-inline'; img-src data:";
+/**
+ * The browser part. Labels go to Cytoscape (canvas) or textContent. The live body is parsed with DOMParser (the body
+ * has no executable script), so this file never assigns innerHTML.
+ */
+export const MAP_SCRIPT = `(function () {
+  'use strict';
+  var cy = null;
+  var last = null;
+  var live = !!document.querySelector('main[data-live-token]');
+  function token() {
+    var m = /(?:^|[?&])t=([^&]*)/.exec(location.search);
+    if (!m) return '';
+    try { return decodeURIComponent(m[1]); } catch (e) { return m[1]; }
+  }
+  function model() {
+    var el = document.getElementById('kya-map-data');
+    if (!el) return null;
+    try { return JSON.parse(el.textContent || 'null'); } catch (e) { return null; }
+  }
+  function add(parent, tag, text) {
+    var n = document.createElement(tag);
+    n.textContent = String(text);
+    parent.appendChild(n);
+    return n;
+  }
+  function showNode(node) {
+    var panel = document.getElementById('kya-map-panel');
+    if (!panel) return;
+    while (panel.firstChild) panel.removeChild(panel.firstChild);
+    add(panel, 'h3', node.kind + ': ' + node.label);
+    add(panel, 'p', 'Class: ' + node.detail);
+    var list = document.createElement('dl');
+    panel.appendChild(list);
+    [['Events', node.count], ['Allow', node.verdicts.allow], ['Deny', node.verdicts.deny], ['Hold', node.verdicts.hold],
+     ['Observed', node.verdicts.observed], ['First seen', node.firstTs || '-'], ['Last seen', node.lastTs || '-']]
+      .forEach(function (r) { add(list, 'dt', r[0]); add(list, 'dd', r[1]); });
+  }
+  function style(d) {
+    var out = [
+      { selector: 'node', style: { 'label': 'data(label)', 'font-size': 10, 'text-wrap': 'ellipsis', 'text-max-width': 130, 'min-zoomed-font-size': 9,
+        'text-background-color': '#ffffff', 'text-background-opacity': 0.8, 'text-background-padding': 1,
+        'width': 18, 'height': 18, 'background-color': '#98a2b3', 'color': '#101828' } },
+      { selector: 'node[kind = "device"]', style: { 'background-color': '#344054', 'shape': 'round-rectangle', 'width': 34, 'height': 34 } },
+      { selector: 'node[kind = "agent"]', style: { 'background-color': '#1d4ed8' } },
+      { selector: 'node[kind = "tool"]', style: { 'background-color': '#7a5af8', 'shape': 'round-rectangle' } },
+      { selector: 'node[kind = "target"]', style: { 'background-color': '#0e9384' } },
+      { selector: 'edge', style: { 'width': 'data(width)', 'line-color': 'data(colour)', 'target-arrow-color': 'data(colour)',
+        'target-arrow-shape': 'triangle', 'curve-style': 'bezier', 'opacity': 0.9 } }
+    ];
+    return out;
+  }
+  var MAX_DRAW_NODES = 400;
+  function draw() {
+    var host = document.getElementById('kya-map-graph');
+    var d = model();
+    if (cy) { cy.destroy(); cy = null; }
+    if (!host || !d || !window.cytoscape || !d.nodes || !d.nodes.length) return;
+    // A force layout on thousands of nodes hangs the tab. The JSON and both heat views still hold everything.
+    if (d.nodes.length > MAX_DRAW_NODES) {
+      host.textContent = 'Graph not drawn: ' + d.nodes.length + ' nodes is too many for the page. Use a shorter window (kya map --days 1) or kya map --json.';
+      return;
+    }
+    cy = window.cytoscape({
+      container: host,
+      elements: {
+        nodes: d.nodes.map(function (n) { return { data: n }; }),
+        edges: d.edges.map(function (e) { return { data: e }; })
+      },
+      style: style(d),
+      layout: { name: 'cose', animate: false, randomize: true, fit: true, padding: 24, numIter: 900, nodeRepulsion: function () { return 9000; }, idealEdgeLength: function () { return 80; }, nodeOverlap: 14, gravity: 0.35 }
+    });
+    cy.on('tap', 'node', function (evt) { showNode(evt.target.data()); });
+    cy.fit();
+  }
+  function refresh() {
+    if (!live) return;
+    var host = document.getElementById('frag-map');
+    if (!host) return;
+    fetch('/fragments?t=' + encodeURIComponent(token()), {
+      method: 'POST', headers: { 'Content-Type': 'application/json' }, body: '{"map":true}'
+    })
+      .then(function (r) { if (!r.ok) throw new Error('HTTP ' + r.status); return r.json(); })
+      .then(function (j) {
+        if (!j || !j.ok || !j.fragments || typeof j.fragments.mapBody !== 'string') return;
+        if (j.fragments.mapBody === last) return;
+        last = j.fragments.mapBody;
+        var doc = new DOMParser().parseFromString(j.fragments.mapBody, 'text/html');
+        var nodes = Array.prototype.slice.call(doc.body.childNodes);
+        while (host.firstChild) host.removeChild(host.firstChild);
+        nodes.forEach(function (n) { host.appendChild(n); });
+        draw();
+      })
+      .catch(function (err) { console.error('KYA map refresh failed', err); });
+  }
+  // Live only: fetch the vendored library with the token from this page's URL, then run it as a script element.
+  function loadLibrary(next) {
+    if (window.cytoscape) { next(); return; }
+    fetch('/vendor/cytoscape.min.js?t=' + encodeURIComponent(token()))
+      .then(function (r) { if (!r.ok) throw new Error('HTTP ' + r.status); return r.text(); })
+      .then(function (text) {
+        var s = document.createElement('script');
+        s.id = 'kya-cytoscape';
+        s.textContent = text;
+        document.head.appendChild(s);
+        next();
+      })
+      .catch(function (err) { console.error('KYA map library failed', err); });
+  }
+  window.kyaMapRefresh = refresh;
+  window.addEventListener('hashchange', function () {
+    if (location.hash !== '#map') return;
+    refresh();
+    setTimeout(function () { if (cy) { cy.resize(); cy.fit(); } }, 0);
+  });
+  if (live) loadLibrary(refresh); else draw();
+})();`;
+/**
+ * Live report: the draw script, in the page shell (not in the swapped fragment). The script reads the token from its
+ * own URL and fetches the library from /vendor/cytoscape.min.js, so the token never appears in the HTML.
+ */
+export function liveMapScripts() {
+    return `<script id="kya-map">${MAP_SCRIPT}</script>`;
+}
+/** Map components. Shared by the standalone file and the live report, so it uses the report's tokens (--line, --mute, --fg, --bg). */
+export const MAP_CSS = `
+  .map-body .map-advisory { border-left: 3px solid var(--line, #d0d5dd); padding: 4px 10px; font-weight: 600; }
+  .map-body .mute { color: var(--mute, #667085); }
+  .map-stats p { margin: 4px 0; }
+  .map-top { margin: 4px 0 12px 20px; padding: 0; }
+  .map-canvas { display: grid; grid-template-columns: minmax(0, 1fr) 260px; gap: 12px; margin: 12px 0; }
+  .map-graph { height: 60vh; min-height: 360px; border: 1px solid var(--line, #d0d5dd); border-radius: 6px; }
+  .map-panel { border: 1px solid var(--line, #d0d5dd); border-radius: 6px; padding: 8px 12px; overflow: auto; }
+  .map-panel dl { display: grid; grid-template-columns: auto 1fr; gap: 2px 10px; }
+  .map-panel dt { color: var(--mute, #667085); }
+  .map-panel dd { margin: 0; }
+  .map-scroll { overflow-x: auto; }
+  .map-heat { border-collapse: collapse; font-size: 12px; margin-bottom: 12px; }
+  .map-heat caption { text-align: left; color: var(--mute, #667085); padding: 4px 0; }
+  .map-heat th, .map-heat td { border: 1px solid var(--line, #d0d5dd); padding: 3px 5px; text-align: right; min-width: 22px; }
+  .map-heat th { text-align: left; font-weight: 600; }
+  .map-heat td.l0 { background: transparent; }
+  .map-heat td.l1 { background: #d1fadf; color: #101828; }
+  .map-heat td.l2 { background: #75e0a7; color: #101828; }
+  .map-heat td.l3 { background: #12b76a; color: #fff; }
+  .map-heat td.l4 { background: #027a48; color: #fff; }
+  .map-heat td.deny { outline: 2px solid #b42318; outline-offset: -2px; }
+  .map-empty { font-weight: 600; }
+  @media (max-width: 760px) { .map-canvas { grid-template-columns: 1fr; } }
+`;
+/** Live report: the Map zone shows only on its tab (same :target rule as the other zones). */
+export const MAP_LIVE_ZONE_CSS = `
+  @supports selector(body:has(*)) {
+    #map { display: none; }
+    #map:target { display: block; }
+    body:has(#map:target) #overview { display: none; }
+    body:has(#map:target) .nav-link[href="#map"] { color: var(--fg); background: var(--bg); border-color: var(--line); }
+  }
+`;
+/** Standalone file only: its own tokens and page frame (the live report has its own). */
+export const MAP_PAGE_CSS = `
+  :root { --fg: #101828; --mute: #667085; --line: #d0d5dd; --bg: #ffffff; }
+  @media (prefers-color-scheme: dark) { :root:not([data-theme="light"]) { --fg: #f2f4f7; --mute: #98a2b3; --line: #344054; --bg: #101828; } }
+  :root[data-theme="dark"] { --fg: #f2f4f7; --mute: #98a2b3; --line: #344054; --bg: #101828; }
+  body { background: var(--bg); color: var(--fg); font: 14px/1.45 system-ui, sans-serif; margin: 0; }
+  .map-page { max-width: 1100px; margin: 0 auto; padding: 16px; }
+`;
+/** Standalone file: one page, no network, CSP on. */
+export function renderMapPage(input) {
+    const body = renderMapBody(input.graph, input.heat, input.days);
+    return `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8"/>
+<meta name="viewport" content="width=device-width, initial-scale=1"/>
+<meta http-equiv="Content-Security-Policy" content="${MAP_CSP}"/>
+<meta name="referrer" content="no-referrer"/>
+<title>${esc(input.title)}</title>
+<style>${MAP_PAGE_CSS}${MAP_CSS}</style>
+</head>
+<body>
+<main class="map-page">
+<header>
+  <h1>Map of agent actions</h1>
+  <p class="mute">Last ${input.days} days · local only</p>
+</header>
+${body}
+</main>
+<script id="kya-cytoscape">${cytoscapeSource()}</script>
+<script id="kya-map">${MAP_SCRIPT}</script>
+</body>
+</html>
+`;
+}
+//# sourceMappingURL=page.js.map

package/dist/map/page.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"page.js","sourceRoot":"","sources":["../../src/map/page.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAIpD,2EAA2E;AAC3E,MAAM,CAAC,MAAM,aAAa,GACxB,8GAA8G,CAAC;AAEjH,uHAAuH;AACvH,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAW,CAAC;AAGhH,4EAA4E;AAC5E,MAAM,UAAU,QAAQ,CAAC,CAAW;IAClC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IAC9B,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IAC9B,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC;QAAE,OAAO,UAAU,CAAC;IACtC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC;AAC1E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;AAC3H,CAAC;AAED;;;GAGG;AACH,MAAM,YAAY,GAAG,kFAAkF,CAAC;AACxG,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,sCAAsC;AACtC,MAAM,UAAU,GAAG,CAAC,CAAS;IAC3B,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC7H,CAAC;AAED,gIAAgI;AAChI,MAAM,UAAU,SAAS,CAAC,KAAe;IACvC,OAAO;QACL,OAAO,EAAE,WAAW;QACpB,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC;YACtC,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE;YACtB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;YACnB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,MAAM,EAAE,CAAC,CAAC,MAAM;SACjB,CAAC,CAAC;QACH,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YAC9B,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YAClC,OAAO;gBACL,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,MAAM,EAAE,CAAC,CAAC,IAAI;gBACd,MAAM,EAAE,CAAC,CAAC,EAAE;gBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI;gBACpB,IAAI;gBACJ,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC;gBACzB,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;gBACzB,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,MAAM,EAAE,CAAC,CAAC,MAAM;aACjB,CAAC;QACJ,CAAC,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC;IACxC,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACnF,OAAO,CAAC,CAAC,EAAE,CAAC;AACd,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,CAAC;AAExB,SAAS,GAAG,CAAC,IAAuB;IAClC,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,2EAA2E;AAC3E,SAAS,KAAK,CAAC,KAAa,EAAE,GAAW;IACvC,IAAI,KAAK,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IACrC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,WAAW,CAAC,KAAe;IAClC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/F,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK;SACxB,MAAM,CAAC,CAAC,CAAC,EAA6C,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC;SACxG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACzF,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;IAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM;QACxB,CAAC,CAAC,uBAAuB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO;QAC/G,CAAC,CAAC,qCAAqC,CAAC;IAC1C,OAAO;eACM,MAAM,8BAA8B,QAAQ,gCAAgC,OAAO,CAAC,MAAM,mBAAmB,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG;yBAClI,aAAa;IAClC,GAAG;OACA,CAAC;AACR,CAAC;AAED,SAAS,SAAS,CAAC,IAAU;IAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvG,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;YACjD,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAE,CAAC,CAAC,CAAE,CAAC;YACzC,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,GAAG,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,SAAS,KAAK,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAC3I,OAAO,eAAe,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,YAAY,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,EAAE,OAAO,CAAC;QACxG,CAAC,CAAC,CAAC;QACH,OAAO,uBAAuB,GAAG,CAAC,GAAG,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;IACtE,CAAC,CAAC,CAAC;IACH,OAAO;;uCAE8B,IAAI;WAChC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;SACf,CAAC;AACV,CAAC;AAED,SAAS,UAAU,CAAC,IAAU;IAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,GAAW,EAAE,EAAE,CAC1C,eAAe,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,KAAK,MAAM,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,IAAI,EAAE,OAAO,CAAC;QAClH,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC7E,OAAO,6BAA6B,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC;IACzK,CAAC,CAAC,CAAC;IACH,OAAO;;;WAGE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,wDAAwD;SAC3E,CAAC;AACV,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAe,EAAE,IAAU,EAAE,IAAY;IACrE,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACvF,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,8CAA8C,IAAI,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IACjG,MAAM,UAAU,GACd,MAAM,KAAK,CAAC;QACV,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;;;;sJAI8I,CAAC;IACrJ,OAAO;4BACmB,GAAG,CAAC,aAAa,CAAC;IAC1C,WAAW,CAAC,KAAK,CAAC;IAClB,KAAK;IACL,UAAU;;4BAEc,SAAS,CAAC,IAAI,CAAC;;4BAEf,UAAU,CAAC,IAAI,CAAC;sDACU,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;OAC9E,CAAC;AACR,CAAC;AAED,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,yCAAyC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzF,IAAI,aAAiC,CAAC;AAEtC,wHAAwH;AACxH,MAAM,UAAU,eAAe;IAC7B,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,aAAa,GAAG,YAAY,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,MAAM,OAAO,GAAG,0FAA0F,CAAC;AAElH;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MA+GpB,CAAC;AAEP;;;GAGG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,wBAAwB,UAAU,WAAW,CAAC;AACvD,CAAC;AAED,sIAAsI;AACtI,MAAM,CAAC,MAAM,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;;;;CAwBtB,CAAC;AAEF,8FAA8F;AAC9F,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;CAOhC,CAAC;AAEF,yFAAyF;AACzF,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;CAM3B,CAAC;AAEF,qDAAqD;AACrD,MAAM,UAAU,aAAa,CAAC,KAAmE;IAC/F,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAChE,OAAO;;;;;sDAK6C,OAAO;;SAEpD,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;SAChB,YAAY,GAAG,OAAO;;;;;;yBAMN,KAAK,CAAC,IAAI;;EAEjC,IAAI;;6BAEuB,eAAe,EAAE;uBACvB,UAAU;;;CAGhC,CAAC;AACF,CAAC"}

package/dist/map/target-class.d.ts

@@ -0,0 +1,22 @@
+/** A class string such as `secret:ssh-key` or `project:app/src/**`. Never a raw path, file name or argument. */
+export type TargetClass = string;
+/** `other` holds absolute paths that match no named class (schema 4.4 rule 9). */
+export type TargetFamily = "network" | "secret" | "tmp" | "system" | "project" | "home" | "command" | "none" | "other";
+export interface TargetInput {
+    readonly toolId: string;
+    readonly targetPath?: string;
+    readonly summary?: string;
+    readonly project?: string;
+    /** Absolute working directory of the call. With it a path is "in the project" only when it is under this directory. */
+    readonly cwd?: string;
+    readonly home?: string;
+}
+/**
+ * Maps one event's target to a class. Pure: no fs, no env, no clock. Rules run in schema 4.4 order, first match wins.
+ * Output is a class only: a host for network, a binary for command, no path, file name or argument.
+ */
+export declare function classifyTarget(input: TargetInput): {
+    class: TargetClass;
+    family: TargetFamily;
+};
+//# sourceMappingURL=target-class.d.ts.map

package/dist/map/target-class.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"target-class.d.ts","sourceRoot":"","sources":["../../src/map/target-class.ts"],"names":[],"mappings":"AAEA,gHAAgH;AAChH,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC;AAEjC,kFAAkF;AAClF,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,QAAQ,GAAG,KAAK,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;AAEvH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,uHAAuH;IACvH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AA4FD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,WAAW,GAAG;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,CA2C/F"}