@shield-agent/kya 0.32.7 → 0.33.1

package/dist/posture/validate.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Gate in front of every posture send. The rules are the hosted validator's rules (shield-agent
+ * core DevicePostureValidator: exact key sets, enums, caps, forbidden path and e-mail fragments)
+ * plus local checks the hosted side cannot make: the user name, the host name, the home directory,
+ * environment names and values, IP addresses and absolute paths of any kind. Pure logic.
+ *
+ * A violation names the field path only, never the value. The caller sends nothing when the
+ * list of violations is not empty (fail closed).
+ */
+export declare const MAX_REPORT_BYTES: number;
+/** What the local check must keep out of a report. Built from the live environment. */
+export interface ForbiddenContext {
+    /** Case-insensitive substrings: user name, host name, home directory, secret-looking env values. */
+    readonly substrings: readonly string[];
+    /** Short user or host names (under 4 characters), matched as whole words only. */
+    readonly words: readonly string[];
+    /** Exact tokens: environment variable names. */
+    readonly tokens: readonly string[];
+}
+export declare function forbiddenContext(env: NodeJS.ProcessEnv, user: string, host: string, home: string): ForbiddenContext;
+export interface Violation {
+    readonly path: string;
+    readonly reason: string;
+}
+/** Every violation found. Empty list = the report may be sent. */
+export declare function checkReport(report: unknown, ctx: ForbiddenContext): Violation[];
+/**
+ * Why one string is forbidden, or undefined. Never returns the string itself. `path` is the field
+ * path, used for one rule: a short user name is matched as a word, except inside the hint text,
+ * which comes from the shipped IoC list (a user named "it" must not block "it could read").
+ */
+export declare function forbiddenReason(v: string, ctx: ForbiddenContext, path?: string): string | undefined;
+//# sourceMappingURL=validate.d.ts.map

package/dist/posture/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/posture/validate.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,eAAO,MAAM,gBAAgB,QAAY,CAAC;AAkC1C,uFAAuF;AACvF,MAAM,WAAW,gBAAgB;IAC/B,oGAAoG;IACpG,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,kFAAkF;IAClF,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,gDAAgD;IAChD,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,gBAAgB,CASnH;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAKD,kEAAkE;AAClE,wBAAgB,WAAW,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,gBAAgB,GAAG,SAAS,EAAE,CAyH/E;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,gBAAgB,EAAE,IAAI,SAAK,GAAG,MAAM,GAAG,SAAS,CAmB/F"}

package/dist/posture/validate.js

@@ -0,0 +1,232 @@
+/**
+ * Gate in front of every posture send. The rules are the hosted validator's rules (shield-agent
+ * core DevicePostureValidator: exact key sets, enums, caps, forbidden path and e-mail fragments)
+ * plus local checks the hosted side cannot make: the user name, the host name, the home directory,
+ * environment names and values, IP addresses and absolute paths of any kind. Pure logic.
+ *
+ * A violation names the field path only, never the value. The caller sends nothing when the
+ * list of violations is not empty (fail closed).
+ */
+export const MAX_REPORT_BYTES = 64 * 1024;
+const MAX_HOSTS = 32;
+const MAX_EXTENSIONS = 200;
+const MAX_MCP = 100;
+const MAX_FINDINGS = 50;
+const TOP = ["schema", "reportedAt", "kyaVersion", "deviceId", "deviceLabel", "os", "arch", "hosts", "extensions", "mcpServers", "ioc", "never"];
+const HOST_KEYS = ["id", "version", "kyaHook"];
+const EXT_KEYS = ["id", "version", "editor"];
+const MCP_KEYS = ["name", "transport", "command"];
+const IOC_KEYS = ["listVersion", "checkedAt", "skipped", "findings"];
+const FINDING_KEYS = ["ioc", "check", "severity", "evidence", "hint"];
+const NEVER_KEYS = ["listActive", "mode"];
+const OS = ["darwin", "linux", "win32"];
+const ARCH = ["arm64", "x64"];
+const EDITORS = ["vscode", "cursor", "windsurf", "vscodium"];
+const TRANSPORTS = ["stdio", "http"];
+const NEVER_MODES = ["advisory", "strict", "hosted"];
+const CHECKS = ["extension", "ssh_authorized_keys_comment", "net_indicator", "file_exists"];
+const SEVERITIES = ["critical", "high", "medium"];
+const DEVICE_ID = /^[A-Za-z0-9-]{8,64}$/;
+const HOST_ID = /^[a-z0-9-]{1,40}$/;
+const EXT_ID = /^[A-Za-z0-9._-]{1,128}$/;
+const EMAIL = /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/;
+const IPV4 = /\b(?:\d{1,3}\.){3}\d{1,3}\b/;
+const IPV6 = /::|(?:[0-9A-Fa-f]{1,4}:){7}[0-9A-Fa-f]{1,4}/;
+/** Absolute POSIX path: a slash that starts the value or follows a separator, then a name. */
+const POSIX_ABS = /(^|[\s"'=(,:])\/[A-Za-z0-9._~-]/;
+const WIN_ABS = /[A-Za-z]:\\|\\\\|\\Users\\/;
+/** Fragments the hosted validator refuses (kept in step with it), plus file URLs. */
+const HOSTED_FRAGMENTS = ["/Users/", "/home/", "/root/", "/private/", "\\Users\\", "file://"];
+export function forbiddenContext(env, user, host, home) {
+    const substrings = [user, host, home].filter((s) => s.length >= 4);
+    const words = [user, host].filter((s) => s.length > 0 && s.length < 4);
+    for (const v of Object.values(env)) {
+        // Secret-looking values only (long, with a digit). Short or plain words would block honest reports.
+        if (typeof v === "string" && v.length >= 12 && /\d/.test(v))
+            substrings.push(v);
+    }
+    const tokens = Object.keys(env).filter((k) => /^[A-Z][A-Z0-9_]{3,}$/.test(k));
+    return { substrings, words, tokens };
+}
+const isObj = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+/** Every violation found. Empty list = the report may be sent. */
+export function checkReport(report, ctx) {
+    const out = [];
+    const bad = (path, reason = "invalid field") => {
+        out.push({ path, reason });
+    };
+    if (!isObj(report))
+        return [{ path: "", reason: "report must be an object" }];
+    const top = report;
+    for (const k of Object.keys(top))
+        if (!TOP.includes(k))
+            bad(k, "unknown field");
+    for (const k of TOP)
+        if (!(k in top))
+            bad(k, "missing field");
+    const keysOf = (node, allowed, path) => {
+        if (!isObj(node)) {
+            bad(path, "must be an object");
+            return false;
+        }
+        for (const k of Object.keys(node))
+            if (!allowed.includes(k))
+                bad(`${path}.${k}`, "unknown field");
+        return true;
+    };
+    const str = (node, key, min, max, path) => {
+        const v = node[key];
+        if (typeof v !== "string")
+            return bad(path), undefined;
+        const len = [...v].length;
+        if (len < min || len > max)
+            return bad(path), undefined;
+        return v;
+    };
+    const nullableStr = (node, key, max, path) => {
+        const v = node[key];
+        if (v === null || v === undefined)
+            return;
+        if (typeof v !== "string" || v.length > max)
+            bad(path);
+    };
+    const oneOf = (node, key, allowed, path) => {
+        const v = node[key];
+        if (typeof v !== "string" || !allowed.includes(v))
+            bad(path);
+    };
+    const isoTime = (node, key, path) => {
+        const v = node[key];
+        if (typeof v !== "string" || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d{1,9})?Z$/.test(v) || Number.isNaN(Date.parse(v)))
+            bad(path);
+    };
+    const list = (node, key, max, path) => {
+        const v = node[key];
+        if (!Array.isArray(v) || v.length > max) {
+            bad(path);
+            return [];
+        }
+        return v;
+    };
+    if (top["schema"] !== 1)
+        bad("schema");
+    isoTime(top, "reportedAt", "reportedAt");
+    str(top, "kyaVersion", 1, 32, "kyaVersion");
+    const id = str(top, "deviceId", 8, 64, "deviceId");
+    if (id !== undefined && !DEVICE_ID.test(id))
+        bad("deviceId");
+    const label = str(top, "deviceLabel", 1, 64, "deviceLabel");
+    if (label !== undefined && /[\u0000-\u001f\u007f]/.test(label))
+        bad("deviceLabel");
+    oneOf(top, "os", OS, "os");
+    oneOf(top, "arch", ARCH, "arch");
+    for (const [i, h] of list(top, "hosts", MAX_HOSTS, "hosts").entries()) {
+        const p = `hosts[${i}]`;
+        if (!keysOf(h, HOST_KEYS, p))
+            continue;
+        const hid = str(h, "id", 1, 40, `${p}.id`);
+        if (hid !== undefined && !HOST_ID.test(hid))
+            bad(`${p}.id`);
+        nullableStr(h, "version", 32, `${p}.version`);
+        if (typeof h["kyaHook"] !== "boolean")
+            bad(`${p}.kyaHook`);
+    }
+    for (const [i, e] of list(top, "extensions", MAX_EXTENSIONS, "extensions").entries()) {
+        const p = `extensions[${i}]`;
+        if (!keysOf(e, EXT_KEYS, p))
+            continue;
+        const eid = str(e, "id", 1, 128, `${p}.id`);
+        if (eid !== undefined && !EXT_ID.test(eid))
+            bad(`${p}.id`);
+        nullableStr(e, "version", 32, `${p}.version`);
+        oneOf(e, "editor", EDITORS, `${p}.editor`);
+    }
+    for (const [i, m] of list(top, "mcpServers", MAX_MCP, "mcpServers").entries()) {
+        const p = `mcpServers[${i}]`;
+        if (!keysOf(m, MCP_KEYS, p))
+            continue;
+        str(m, "name", 1, 128, `${p}.name`);
+        oneOf(m, "transport", TRANSPORTS, `${p}.transport`);
+        const cmd = m["command"];
+        if (cmd !== null && cmd !== undefined && (typeof cmd !== "string" || cmd.length > 128 || cmd.includes("/") || cmd.includes("\\"))) {
+            bad(`${p}.command`);
+        }
+    }
+    if (keysOf(top["ioc"], IOC_KEYS, "ioc")) {
+        const ioc = top["ioc"];
+        str(ioc, "listVersion", 1, 32, "ioc.listVersion");
+        isoTime(ioc, "checkedAt", "ioc.checkedAt");
+        const sk = ioc["skipped"];
+        if (typeof sk !== "number" || !Number.isInteger(sk) || sk < 0 || sk > 100000)
+            bad("ioc.skipped");
+        for (const [i, f] of list(ioc, "findings", MAX_FINDINGS, "ioc.findings").entries()) {
+            const p = `ioc.findings[${i}]`;
+            if (!keysOf(f, FINDING_KEYS, p))
+                continue;
+            str(f, "ioc", 1, 96, `${p}.ioc`);
+            oneOf(f, "check", CHECKS, `${p}.check`);
+            oneOf(f, "severity", SEVERITIES, `${p}.severity`);
+            str(f, "evidence", 1, 512, `${p}.evidence`);
+            str(f, "hint", 1, 300, `${p}.hint`);
+        }
+    }
+    if (keysOf(top["never"], NEVER_KEYS, "never")) {
+        const n = top["never"];
+        if (typeof n["listActive"] !== "boolean")
+            bad("never.listActive");
+        oneOf(n, "mode", NEVER_MODES, "never.mode");
+    }
+    // Forbidden content, every string value at any depth (keys are checked above).
+    const scan = (v, path) => {
+        if (typeof v === "string") {
+            const reason = forbiddenReason(v, ctx, path);
+            if (reason)
+                bad(path, reason);
+        }
+        else if (Array.isArray(v)) {
+            v.forEach((c, i) => scan(c, `${path}[${i}]`));
+        }
+        else if (isObj(v)) {
+            for (const [k, c] of Object.entries(v))
+                scan(c, path ? `${path}.${k}` : k);
+        }
+    };
+    scan(top, "");
+    const bytes = new TextEncoder().encode(JSON.stringify(report)).length;
+    if (bytes > MAX_REPORT_BYTES)
+        bad("report", "larger than 64 KB");
+    return out;
+}
+/**
+ * Why one string is forbidden, or undefined. Never returns the string itself. `path` is the field
+ * path, used for one rule: a short user name is matched as a word, except inside the hint text,
+ * which comes from the shipped IoC list (a user named "it" must not block "it could read").
+ */
+export function forbiddenReason(v, ctx, path = "") {
+    if (/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/.test(v))
+        return "control character";
+    if (HOSTED_FRAGMENTS.some((f) => v.includes(f)))
+        return "forbidden path";
+    if (POSIX_ABS.test(v) || WIN_ABS.test(v))
+        return "absolute path";
+    if (EMAIL.test(v))
+        return "e-mail address";
+    if (IPV4.test(v) || IPV6.test(v))
+        return "IP address";
+    const lower = v.toLowerCase();
+    for (const s of ctx.substrings) {
+        if (lower.includes(s.toLowerCase()))
+            return "user, host, home or environment value";
+    }
+    for (const w of path.endsWith(".hint") ? [] : ctx.words) {
+        if (new RegExp(`(^|[^A-Za-z0-9])${w.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}($|[^A-Za-z0-9])`, "i").test(v)) {
+            return "user or host name";
+        }
+    }
+    for (const t of ctx.tokens) {
+        if (new RegExp(`(^|[^A-Za-z0-9_])${t}($|[^A-Za-z0-9_])`).test(v))
+            return "environment variable name";
+    }
+    return undefined;
+}
+//# sourceMappingURL=validate.js.map

package/dist/posture/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/posture/validate.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,CAAC;AAC1C,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,OAAO,GAAG,GAAG,CAAC;AACpB,MAAM,YAAY,GAAG,EAAE,CAAC;AAExB,MAAM,GAAG,GAAG,CAAC,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;AACjJ,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;AAC/C,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;AAC7C,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;AAClD,MAAM,QAAQ,GAAG,CAAC,aAAa,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;AACrE,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;AACtE,MAAM,UAAU,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;AAE1C,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACxC,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AAC9B,MAAM,OAAO,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;AAC7D,MAAM,UAAU,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACrC,MAAM,WAAW,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACrD,MAAM,MAAM,GAAG,CAAC,WAAW,EAAE,6BAA6B,EAAE,eAAe,EAAE,aAAa,CAAC,CAAC;AAC5F,MAAM,UAAU,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;AAElD,MAAM,SAAS,GAAG,sBAAsB,CAAC;AACzC,MAAM,OAAO,GAAG,mBAAmB,CAAC;AACpC,MAAM,MAAM,GAAG,yBAAyB,CAAC;AACzC,MAAM,KAAK,GAAG,gDAAgD,CAAC;AAC/D,MAAM,IAAI,GAAG,6BAA6B,CAAC;AAC3C,MAAM,IAAI,GAAG,6CAA6C,CAAC;AAC3D,8FAA8F;AAC9F,MAAM,SAAS,GAAG,iCAAiC,CAAC;AACpD,MAAM,OAAO,GAAG,4BAA4B,CAAC;AAC7C,qFAAqF;AACrF,MAAM,gBAAgB,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;AAY9F,MAAM,UAAU,gBAAgB,CAAC,GAAsB,EAAE,IAAY,EAAE,IAAY,EAAE,IAAY;IAC/F,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,oGAAoG;QACpG,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AACvC,CAAC;AAQD,MAAM,KAAK,GAAG,CAAC,CAAU,EAAY,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAEjG,kEAAkE;AAClE,MAAM,UAAU,WAAW,CAAC,MAAe,EAAE,GAAqB;IAChE,MAAM,GAAG,GAAgB,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,MAAM,GAAG,eAAe,EAAQ,EAAE;QAC3D,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7B,CAAC,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC,CAAC;IAC9E,MAAM,GAAG,GAAG,MAAM,CAAC;IACnB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;IAChF,KAAK,MAAM,CAAC,IAAI,GAAG;QAAE,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;YAAE,GAAG,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;IAE9D,MAAM,MAAM,GAAG,CAAC,IAAa,EAAE,OAAiB,EAAE,IAAY,EAAe,EAAE;QAC7E,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACjB,GAAG,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;YAC/B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAAE,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;QAClG,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,CAAC,IAAS,EAAE,GAAW,EAAE,GAAW,EAAE,GAAW,EAAE,IAAY,EAAsB,EAAE;QACjG,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACpB,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;QACvD,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1B,IAAI,GAAG,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG;YAAE,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;QACxD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,MAAM,WAAW,GAAG,CAAC,IAAS,EAAE,GAAW,EAAE,GAAW,EAAE,IAAY,EAAQ,EAAE;QAC9E,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACpB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO;QAC1C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,IAAS,EAAE,GAAW,EAAE,OAAiB,EAAE,IAAY,EAAQ,EAAE;QAC9E,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACpB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/D,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,IAAS,EAAE,GAAW,EAAE,IAAY,EAAQ,EAAE;QAC7D,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACpB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,oDAAoD,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACvI,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,IAAS,EAAE,GAAW,EAAE,GAAW,EAAE,IAAY,EAAa,EAAE;QAC5E,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACpB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACxC,GAAG,CAAC,IAAI,CAAC,CAAC;YACV,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IAEF,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;IACzC,GAAG,CAAC,GAAG,EAAE,YAAY,EAAE,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,CAAC;IAC5C,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC;IACnD,IAAI,EAAE,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,GAAG,CAAC,UAAU,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,EAAE,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,aAAa,CAAC,CAAC;IAC5D,IAAI,KAAK,KAAK,SAAS,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,GAAG,CAAC,aAAa,CAAC,CAAC;IACnF,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;IAC3B,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAEjC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QACtE,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC;QACxB,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;YAAE,SAAS;QACvC,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5D,WAAW,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC7D,CAAC;IACD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,YAAY,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QACrF,MAAM,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;YAAE,SAAS;QACtC,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3D,WAAW,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9C,KAAK,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7C,CAAC;IACD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9E,MAAM,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;YAAE,SAAS;QACtC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACpC,KAAK,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;QACzB,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAClI,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAQ,CAAC;QAC9B,GAAG,CAAC,GAAG,EAAE,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,iBAAiB,CAAC,CAAC;QAClD,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;QAC3C,MAAM,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1B,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,MAAM;YAAE,GAAG,CAAC,aAAa,CAAC,CAAC;QACjG,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YACnF,MAAM,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC;gBAAE,SAAS;YAC1C,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YACjC,KAAK,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;YACxC,KAAK,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;YAClD,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;YAC5C,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC;QAC9C,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAQ,CAAC;QAC9B,IAAI,OAAO,CAAC,CAAC,YAAY,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAClE,KAAK,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;IAC9C,CAAC;IAED,+EAA+E;IAC/E,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,IAAY,EAAQ,EAAE;QAC9C,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,eAAe,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YAC7C,IAAI,MAAM;gBAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAChC,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5B,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAChD,CAAC;aAAM,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACpB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;gBAAE,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAEd,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;IACtE,IAAI,KAAK,GAAG,gBAAgB;QAAE,GAAG,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IACjE,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,CAAS,EAAE,GAAqB,EAAE,IAAI,GAAG,EAAE;IACzE,IAAI,gDAAgD,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,mBAAmB,CAAC;IACzF,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,gBAAgB,CAAC;IACzE,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,eAAe,CAAC;IACjE,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,gBAAgB,CAAC;IAC3C,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,YAAY,CAAC;IACtD,MAAM,KAAK,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,uCAAuC,CAAC;IACtF,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QACxD,IAAI,IAAI,MAAM,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3G,OAAO,mBAAmB,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QAC3B,IAAI,IAAI,MAAM,CAAC,oBAAoB,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,2BAA2B,CAAC;IACvG,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/project-policy.d.ts

@@ -0,0 +1,23 @@
+export declare const POLICY_FILE: string;
+export declare const POLICY_VERSION = 1;
+/** Policy files are small lists; a larger file is refused, not parsed. */
+export declare const POLICY_MAX_BYTES: number;
+export interface ProjectPolicy {
+    readonly deny: ReadonlySet<string>;
+    readonly requireApprove: ReadonlySet<string>;
+}
+/** The scaffold `kya team init` writes when the file is absent. No rules yet, so it changes no verdict. */
+export declare const POLICY_SCAFFOLD: string;
+type Warn = (message: string) => void;
+/** Parse and validate a policy document. Returns undefined when any rule is broken. */
+export declare function parseProjectPolicy(text: string): {
+    policy?: ProjectPolicy;
+    error?: string;
+};
+/**
+ * Load `<cwd>/.kya/policy.json`. Missing file: undefined, silently. Symlink, non-regular file, oversize,
+ * or invalid content: undefined plus one warning (fail open). Never throws.
+ */
+export declare function loadProjectPolicy(cwd: string, warn?: Warn): ProjectPolicy | undefined;
+export {};
+//# sourceMappingURL=project-policy.d.ts.map

package/dist/project-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-policy.d.ts","sourceRoot":"","sources":["../src/project-policy.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,WAAW,QAA8B,CAAC;AACvD,eAAO,MAAM,cAAc,IAAI,CAAC;AAChC,0EAA0E;AAC1E,eAAO,MAAM,gBAAgB,QAAY,CAAC;AAK1C,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC9C;AAED,2GAA2G;AAC3G,eAAO,MAAM,eAAe,QAA4F,CAAC;AAEzH,KAAK,IAAI,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;AAKtC,uFAAuF;AACvF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,MAAM,CAAC,EAAE,aAAa,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CA+B3F;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,IAAiB,GAAG,aAAa,GAAG,SAAS,CAcjG"}

package/dist/project-policy.js

@@ -0,0 +1,95 @@
+/**
+ * Repository policy: `<project>/.kya/policy.json`, committed with the repo by `kya team init`.
+ *
+ * Tighten only. The file can add tool ids to `deny` or `requireApprove`. It can never relax a verdict:
+ * the never-list and every DENY from the base tier stay DENY, and an unknown key (for example `allow`)
+ * makes the whole file invalid. The file is supply-chain input, so every problem fails open: the file is
+ * ignored and one stderr note says why. The gate then runs with its base rules, exactly as without the file.
+ */
+import { lstatSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+export const POLICY_FILE = join(".kya", "policy.json");
+export const POLICY_VERSION = 1;
+/** Policy files are small lists; a larger file is refused, not parsed. */
+export const POLICY_MAX_BYTES = 64 * 1024;
+const MAX_ENTRY_CHARS = 200;
+const MAX_ENTRIES = 1000;
+const KEYS = new Set(["version", "deny", "requireApprove"]);
+/** The scaffold `kya team init` writes when the file is absent. No rules yet, so it changes no verdict. */
+export const POLICY_SCAFFOLD = `${JSON.stringify({ version: POLICY_VERSION, deny: [], requireApprove: [] }, null, 2)}\n`;
+const stderrWarn = (m) => {
+    process.stderr.write(`kya: ignoring ${POLICY_FILE}: ${m}\n`);
+};
+/** Parse and validate a policy document. Returns undefined when any rule is broken. */
+export function parseProjectPolicy(text) {
+    let doc;
+    try {
+        doc = JSON.parse(text);
+    }
+    catch (err) {
+        return { error: `not valid JSON (${err.message})` };
+    }
+    if (typeof doc !== "object" || doc === null || Array.isArray(doc))
+        return { error: "top level must be an object" };
+    const obj = doc;
+    for (const key of Object.keys(obj)) {
+        if (!KEYS.has(key))
+            return { error: `unknown key "${key}" (only version, deny, requireApprove are read)` };
+    }
+    if (obj.version !== POLICY_VERSION)
+        return { error: `version must be ${POLICY_VERSION}` };
+    const list = (name) => {
+        const raw = obj[name] ?? [];
+        if (!Array.isArray(raw))
+            return `${name} must be an array`;
+        if (raw.length > MAX_ENTRIES)
+            return `${name} has more than ${MAX_ENTRIES} entries`;
+        const out = new Set();
+        for (const item of raw) {
+            if (typeof item !== "string")
+                return `${name} entries must be strings`;
+            const id = item.trim();
+            if (id === "" || id.length > MAX_ENTRY_CHARS)
+                return `${name} entries must be 1 to ${MAX_ENTRY_CHARS} characters`;
+            out.add(id);
+        }
+        return out;
+    };
+    const deny = list("deny");
+    if (typeof deny === "string")
+        return { error: deny };
+    const requireApprove = list("requireApprove");
+    if (typeof requireApprove === "string")
+        return { error: requireApprove };
+    return { policy: { deny, requireApprove } };
+}
+/**
+ * Load `<cwd>/.kya/policy.json`. Missing file: undefined, silently. Symlink, non-regular file, oversize,
+ * or invalid content: undefined plus one warning (fail open). Never throws.
+ */
+export function loadProjectPolicy(cwd, warn = stderrWarn) {
+    const path = join(cwd, POLICY_FILE);
+    try {
+        const link = lstatSync(path, { throwIfNoEntry: false });
+        if (!link)
+            return undefined;
+        if (link.isSymbolicLink())
+            return failOpen(warn, "it is a symlink");
+        if (!link.isFile())
+            return failOpen(warn, "it is not a regular file");
+        if (statSync(path).size > POLICY_MAX_BYTES)
+            return failOpen(warn, `it is larger than ${POLICY_MAX_BYTES} bytes`);
+        const parsed = parseProjectPolicy(readFileSync(path, "utf8"));
+        if (!parsed.policy)
+            return failOpen(warn, parsed.error ?? "invalid");
+        return parsed.policy;
+    }
+    catch (err) {
+        return failOpen(warn, `unreadable (${err.code ?? "error"})`);
+    }
+}
+function failOpen(warn, why) {
+    warn(`${why}; the base rules apply`);
+    return undefined;
+}
+//# sourceMappingURL=project-policy.js.map

package/dist/project-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-policy.js","sourceRoot":"","sources":["../src/project-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AACvD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC;AAChC,0EAA0E;AAC1E,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,CAAC;AAC1C,MAAM,eAAe,GAAG,GAAG,CAAC;AAC5B,MAAM,WAAW,GAAG,IAAI,CAAC;AACzB,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAO5D,2GAA2G;AAC3G,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAGzH,MAAM,UAAU,GAAS,CAAC,CAAC,EAAE,EAAE;IAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,WAAW,KAAK,CAAC,IAAI,CAAC,CAAC;AAC/D,CAAC,CAAC;AAEF,uFAAuF;AACvF,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,EAAE,mBAAoB,GAAa,CAAC,OAAO,GAAG,EAAE,CAAC;IACjE,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;IACnH,MAAM,GAAG,GAAG,GAA8B,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,GAAG,iDAAiD,EAAE,CAAC;IAC7G,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,KAAK,cAAc;QAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,cAAc,EAAE,EAAE,CAAC;IAC1F,MAAM,IAAI,GAAG,CAAC,IAA+B,EAAwB,EAAE;QACrE,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,IAAI,mBAAmB,CAAC;QAC3D,IAAI,GAAG,CAAC,MAAM,GAAG,WAAW;YAAE,OAAO,GAAG,IAAI,kBAAkB,WAAW,UAAU,CAAC;QACpF,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;YACvB,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,OAAO,GAAG,IAAI,0BAA0B,CAAC;YACvE,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACvB,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,MAAM,GAAG,eAAe;gBAAE,OAAO,GAAG,IAAI,yBAAyB,eAAe,aAAa,CAAC;YAClH,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACd,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1B,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACrD,MAAM,cAAc,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC9C,IAAI,OAAO,cAAc,KAAK,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;IACzE,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW,EAAE,OAAa,UAAU;IACpE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QAC5B,IAAI,IAAI,CAAC,cAAc,EAAE;YAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QACpE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC,CAAC;QACtE,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,gBAAgB;YAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,qBAAqB,gBAAgB,QAAQ,CAAC,CAAC;QACjH,MAAM,MAAM,GAAG,kBAAkB,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,IAAI,SAAS,CAAC,CAAC;QACrE,OAAO,MAAM,CAAC,MAAM,CAAC;IACvB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC,IAAI,EAAE,eAAgB,GAA6B,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAU,EAAE,GAAW;IACvC,IAAI,CAAC,GAAG,GAAG,wBAAwB,CAAC,CAAC;IACrC,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/receipt/daemon.d.ts

@@ -45,15 +45,15 @@ export interface DaemonProc {
  */
 export declare function listOwnedProcesses(platform?: NodeJS.Platform): DaemonProc[];
 /**
- * Pids of running `cli.js receipt-serve` daemons - any install path, any
- * cwd - so `stop --all` can sweep orphans the cwd state file does not know
- * about. Never matches this process. `receipt-serve` must appear as a
- * standalone argv token (the daemon always spawns it as one), so an editor
- * with `receipt-serve-notes.txt` open does not match. Residual risk,
- * accepted: a same-uid process deliberately built to look like the daemon
- * (`node cli.js receipt-serve`) still matches - but the sweep is scoped to
- * the current user's processes and only ever sends SIGTERM, so the worst
- * case is a graceful stop of a same-user lookalike.
+ * Pids of running receipt-serve daemons (`cli.js receipt-serve` or
+ * `kya receipt-serve`) - any install path, any cwd - so `stop --all` can sweep
+ * orphans the cwd state file does not know about. Never matches this process.
+ * `receipt-serve` must appear as a standalone argv token (the daemon always
+ * spawns it as one), so an editor with `receipt-serve-notes.txt` open does not
+ * match. Residual risk, accepted: a same-uid process deliberately built to look
+ * like the daemon still matches - but the sweep is scoped to the current user's
+ * processes and only ever sends SIGTERM, so the worst case is a graceful stop of
+ * a same-user lookalike.
  */
 export declare function findReceiptDaemonPids(procs: readonly DaemonProc[]): number[];
 /**

package/dist/receipt/daemon.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../../src/receipt/daemon.ts"],"names":[],"mappings":"AAqBA,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAK7E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAiB3E;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAc7E;AAUD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAMxE;AAED,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAS7C;AAcD;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAY3D;AAED,MAAM,WAAW,WAAW;IAC1B,qEAAqE;IACrE,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAAG,UAAU,EAAE,CAmB7F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,GAAG,MAAM,EAAE,CAU5E;AAoDD;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAE,GACnE,OAAO,CAAC,mBAAmB,CAAC,CAmD9B"}
+{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../../src/receipt/daemon.ts"],"names":[],"mappings":"AAqBA,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAK7E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAiB3E;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAc7E;AAUD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAMxE;AAED,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAS7C;AAcD;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAY3D;AAED,MAAM,WAAW,WAAW;IAC1B,qEAAqE;IACrE,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAAG,UAAU,EAAE,CAmB7F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,GAAG,MAAM,EAAE,CAU5E;AAqED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAE,GACnE,OAAO,CAAC,mBAAmB,CAAC,CAmD9B"}

package/dist/receipt/daemon.js

@@ -150,24 +150,39 @@ export function listOwnedProcesses(platform = process.platform) {
     }
 }
 /**
- * Pids of running `cli.js receipt-serve` daemons - any install path, any
- * cwd - so `stop --all` can sweep orphans the cwd state file does not know
- * about. Never matches this process. `receipt-serve` must appear as a
- * standalone argv token (the daemon always spawns it as one), so an editor
- * with `receipt-serve-notes.txt` open does not match. Residual risk,
- * accepted: a same-uid process deliberately built to look like the daemon
- * (`node cli.js receipt-serve`) still matches - but the sweep is scoped to
- * the current user's processes and only ever sends SIGTERM, so the worst
- * case is a graceful stop of a same-user lookalike.
+ * Pids of running receipt-serve daemons (`cli.js receipt-serve` or
+ * `kya receipt-serve`) - any install path, any cwd - so `stop --all` can sweep
+ * orphans the cwd state file does not know about. Never matches this process.
+ * `receipt-serve` must appear as a standalone argv token (the daemon always
+ * spawns it as one), so an editor with `receipt-serve-notes.txt` open does not
+ * match. Residual risk, accepted: a same-uid process deliberately built to look
+ * like the daemon still matches - but the sweep is scoped to the current user's
+ * processes and only ever sends SIGTERM, so the worst case is a graceful stop of
+ * a same-user lookalike.
  */
 export function findReceiptDaemonPids(procs) {
     const receiptServeToken = /(^|\s|\/)receipt-serve(\s|$)/;
     return procs
         .filter((p) => p.pid !== process.pid &&
-        p.args.includes("cli.js") &&
-        receiptServeToken.test(p.args))
+        ((p.args.includes("cli.js") && receiptServeToken.test(p.args)) ||
+            isKyaReceiptServe(p.args)))
         .map((p) => p.pid);
 }
+/**
+ * `kya receipt-serve` as a binary runs it, or as the npm bin shim runs it
+ * (`node <bin>/kya receipt-serve`). The subcommand must be the argument right
+ * after the program, so `node other.js x receipt-serve` does not match. A path
+ * with a space is missed, never over-matched.
+ */
+function isKyaReceiptServe(args) {
+    const argv = args.trim().split(/\s+/);
+    const base = (token) => token?.split("/").pop() ?? "";
+    if (base(argv[0]) === "kya")
+        return argv[1] === "receipt-serve";
+    return (base(argv[0]) === "node" &&
+        ["kya", "shield-kya", "cli.js"].includes(base(argv[1])) &&
+        argv[2] === "receipt-serve");
+}
 /**
  * A stored state file is only trustworthy if its url is loopback and the
  * server behind it answers a token-authenticated handshake with 200.

package/dist/receipt/daemon.js.map

@@ -1 +1 @@
-{"version":3,"file":"daemon.js","sourceRoot":"","sources":["../../src/receipt/daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EACL,SAAS,EACT,UAAU,EACV,UAAU,EACV,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,MAAM,EACN,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,aAAa,EAAuB,MAAM,cAAc,CAAC;AAC7E,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAgB5C,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,qBAAqB,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,oBAAoB,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAgC,CAAC;QAClF,IACE,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;YAC3B,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;YAC3B,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;YAC7B,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAC5B,CAAC;YACD,OAAO,GAAyB,CAAC;QACnC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,qCAAqC;IACvC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,KAAyB;IACrE,gBAAgB,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAClC,0EAA0E;IAC1E,+EAA+E;IAC/E,eAAe,CAAC,IAAI,CAAC,CAAC;IACtB,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC5B,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACtC,IAAI,CAAC;QACH,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACtB,aAAa,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnE,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,CAAC;QACH,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE;YAAE,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,gCAAgC;IAClC,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,WAAoB;IAChE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,IAAI,KAAK,CAAC,GAAG,KAAK,WAAW;YAAE,OAAO;IACjD,CAAC;IACD,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,iEAAiE;QACjE,OAAQ,GAA6B,CAAC,IAAI,KAAK,OAAO,CAAC;IACzD,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,SAAS;IAChB,uCAAuC;IACvC,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACnE,IAAI,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,oDAAoD;IACpD,OAAO,aAAa,CAAC,IAAI,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACtE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE;YAClE,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACpC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAcD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAA4B,OAAO,CAAC,QAAQ;IAC7E,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,EAAE,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,iBAAiB,CAAC,EAAE;YAC1D,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACpC,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAChF,MAAM,KAAK,GAAiB,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,GAAG,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjD,IAAI,CAAC,CAAC;gBAAE,SAAS;YACjB,IAAI,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,SAAS;YACxD,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAA4B;IAChE,MAAM,iBAAiB,GAAG,8BAA8B,CAAC;IACzD,OAAO,KAAK;SACT,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG;QACrB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzB,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CACjC;SACA,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,iBAAiB,CAAC,KAAyB;IACxD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACpD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE;YAC9B,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,KAAK,EAAE,EAAE;YACnD,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QACvB,CAAC;QACD,oEAAoE;QACpE,sEAAsE;QACtE,0BAA0B;QAC1B,IAAI,OAA2B,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0B,CAAC;YACnE,OAAO,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,SAAS,CAAC;QACtB,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED;uEACuE;AACvE,KAAK,UAAU,eAAe,CAAC,GAAW;IACxC,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,KAAK,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,GAAG,EAAE,CAAC;QACpE,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAsB,EACtB,KAAoE;IAEpE,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;YAC9C,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAChE,CAAC;QACD,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;YACb,mEAAmE;YACnE,oEAAoE;YACpE,iEAAiE;YACjE,MAAM,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACtC,CAAC;aAAM,IAAI,sBAAsB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAChD,MAAM,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IACD,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAE7B,gBAAgB,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1C,eAAe,CAAC,OAAO,CAAC,CAAC;IACzB,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,CAAC,SAAS,EAAE,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1E,IAAI,KAAK,CAAC,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE;QAC1C,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC;QAC/B,GAAG,EAAE;YACH,GAAG,OAAO,CAAC,GAAG;YACd,GAAG,KAAK,CAAC,GAAG;YACZ,cAAc,EAAE,GAAG;YACnB,gBAAgB,EAAE,GAAG;SACtB;KACF,CAAC,CAAC;IACH,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IAE5B,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,GAAG,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,KAAK,IAAI,KAAK,CAAC,GAAG,KAAK,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAChD,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAChD,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI;YAAE,MAAM;QACnC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,QAAQ,CAChB,wCAAwC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACnE,uBAAuB,CACxB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"daemon.js","sourceRoot":"","sources":["../../src/receipt/daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EACL,SAAS,EACT,UAAU,EACV,UAAU,EACV,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,MAAM,EACN,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,aAAa,EAAuB,MAAM,cAAc,CAAC;AAC7E,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAgB5C,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,qBAAqB,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,oBAAoB,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAgC,CAAC;QAClF,IACE,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;YAC3B,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;YAC3B,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;YAC7B,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAC5B,CAAC;YACD,OAAO,GAAyB,CAAC;QACnC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,qCAAqC;IACvC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,KAAyB;IACrE,gBAAgB,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAClC,0EAA0E;IAC1E,+EAA+E;IAC/E,eAAe,CAAC,IAAI,CAAC,CAAC;IACtB,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC5B,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACtC,IAAI,CAAC;QACH,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACtB,aAAa,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnE,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,CAAC;QACH,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE;YAAE,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,gCAAgC;IAClC,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,WAAoB;IAChE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,IAAI,KAAK,CAAC,GAAG,KAAK,WAAW;YAAE,OAAO;IACjD,CAAC;IACD,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,iEAAiE;QACjE,OAAQ,GAA6B,CAAC,IAAI,KAAK,OAAO,CAAC;IACzD,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,SAAS;IAChB,uCAAuC;IACvC,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACnE,IAAI,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,oDAAoD;IACpD,OAAO,aAAa,CAAC,IAAI,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACtE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE;YAClE,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACpC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAcD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAA4B,OAAO,CAAC,QAAQ;IAC7E,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,EAAE,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,iBAAiB,CAAC,EAAE;YAC1D,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACpC,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAChF,MAAM,KAAK,GAAiB,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,GAAG,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjD,IAAI,CAAC,CAAC;gBAAE,SAAS;YACjB,IAAI,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,SAAS;YACxD,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAA4B;IAChE,MAAM,iBAAiB,GAAG,8BAA8B,CAAC;IACzD,OAAO,KAAK;SACT,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG;QACrB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC5D,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAC/B;SACA,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,CAAC,KAAyB,EAAU,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAClF,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,eAAe,CAAC;IAChE,OAAO,CACL,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM;QACxB,CAAC,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC,CAAC,CAAC,KAAK,eAAe,CAC5B,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,iBAAiB,CAAC,KAAyB;IACxD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACpD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE;YAC9B,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,KAAK,EAAE,EAAE;YACnD,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QACvB,CAAC;QACD,oEAAoE;QACpE,sEAAsE;QACtE,0BAA0B;QAC1B,IAAI,OAA2B,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0B,CAAC;YACnE,OAAO,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,SAAS,CAAC;QACtB,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED;uEACuE;AACvE,KAAK,UAAU,eAAe,CAAC,GAAW;IACxC,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,KAAK,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,GAAG,EAAE,CAAC;QACpE,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAsB,EACtB,KAAoE;IAEpE,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;YAC9C,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAChE,CAAC;QACD,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;YACb,mEAAmE;YACnE,oEAAoE;YACpE,iEAAiE;YACjE,MAAM,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACtC,CAAC;aAAM,IAAI,sBAAsB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAChD,MAAM,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IACD,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAE7B,gBAAgB,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1C,eAAe,CAAC,OAAO,CAAC,CAAC;IACzB,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,CAAC,SAAS,EAAE,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1E,IAAI,KAAK,CAAC,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE;QAC1C,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC;QAC/B,GAAG,EAAE;YACH,GAAG,OAAO,CAAC,GAAG;YACd,GAAG,KAAK,CAAC,GAAG;YACZ,cAAc,EAAE,GAAG;YACnB,gBAAgB,EAAE,GAAG;SACtB;KACF,CAAC,CAAC;IACH,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IAE5B,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,GAAG,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,KAAK,IAAI,KAAK,CAAC,GAAG,KAAK,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAChD,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAChD,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI;YAAE,MAAM;QACnC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,QAAQ,CAChB,wCAAwC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACnE,uBAAuB,CACxB,CAAC;AACJ,CAAC"}

package/dist/receipt/embeddings.d.ts

@@ -5,7 +5,8 @@ export interface EmbeddingProvider {
      * orders of magnitude faster than one-by-one calls. */
     embedBatch?(texts: string[]): Promise<(number[] | undefined)[] | undefined>;
 }
-/** Local MiniLM provider via fastembed; loaded on first use. */
+export { semanticInstallCommand, semanticRuntimeDir } from "./semantic-status.js";
+/** Local MiniLM provider via the opt-in fastembed runtime; loaded on first use. */
 export declare class LocalMiniLmProvider implements EmbeddingProvider {
     private readonly env;
     private queryModel;
@@ -20,16 +21,37 @@ export declare class LocalMiniLmProvider implements EmbeddingProvider {
     embed(text: string): Promise<number[] | undefined>;
     embedBatch(texts: string[]): Promise<(number[] | undefined)[] | undefined>;
 }
-/** On-disk cache for event embeddings keyed by event id and document sha1. */
+/**
+ * On-disk cache for event embeddings keyed by event id and document sha1.
+ * New vectors are appended to search-index.bin; the whole file is rewritten only
+ * to compact it. A legacy search-index.json is read once, converted, and renamed
+ * to search-index.json.migrated (kept, never deleted).
+ */
 export declare class EventEmbeddingCache {
-    private data;
-    private readonly cacheFile;
-    constructor(cacheFile?: string);
+    private entries;
+    private readonly binFile;
+    private readonly legacyFile;
+    private readonly max;
+    /** The file exists but could not be read: never write over it with a near-empty index. */
+    private unreadable;
+    /** Records in the file as last read or written; undefined = no valid file to append to. */
+    private diskRecords;
+    private window;
+    constructor(cacheFile?: string, env?: NodeJS.ProcessEnv);
+    private loaded;
     private load;
-    private save;
+    private readBin;
+    private migrate;
+    /** Write every live entry to a new file in one atomic step. */
+    private rewrite;
+    private append;
+    /** Drop the oldest entries above the cap. Ids in the current report window go last. */
+    private evictOverCap;
+    /** Ids of the events in the current report window: pruning keeps these before older ones. */
+    setWindow(eventIds: Iterable<string>): void;
     getCached(eventId: string, textSha1: string): number[] | undefined;
     setCached(eventId: string, textSha1: string, vector: number[]): void;
-    /** Replace many entries in one pass instead of filtering on every item. */
+    /** Add or replace many entries; only the new records are written. */
     setMany(batch: readonly {
         readonly id: string;
         readonly sha1: string;

package/dist/receipt/embeddings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"embeddings.d.ts","sourceRoot":"","sources":["../../src/receipt/embeddings.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACnD;2DACuD;IACvD,UAAU,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,GAAG,SAAS,CAAC,CAAC;CAC7E;AAsBD,gEAAgE;AAChE,qBAAa,mBAAoB,YAAW,iBAAiB;IAQ/C,OAAO,CAAC,QAAQ,CAAC,GAAG;IAPhC,OAAO,CAAC,UAAU,CAA6B;IAC/C,OAAO,CAAC,UAAU,CAA6B;IAC/C,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,UAAU,CAAS;IAC3B,yEAAyE;IACzE,OAAO,CAAC,QAAQ,CAAuC;gBAE1B,GAAG,GAAE,MAAM,CAAC,UAAwB;YAEnD,YAAY;YAMZ,SAAS;IA4BjB,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,SAAS,CAAC;IAmBlD,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,GAAG,SAAS,CAAC;CA0BjF;AAgBD,8EAA8E;AAC9E,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,IAAI,CAAY;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAEvB,SAAS,CAAC,EAAE,MAAM;IAK9B,OAAO,CAAC,IAAI;IAWZ,OAAO,CAAC,IAAI;IASZ,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS;IAIlE,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI;IAIpE,2EAA2E;IAC3E,OAAO,CAAC,KAAK,EAAE,SAAS;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,GAAG,IAAI;CAO3G;AAID;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,SAAS,UAAU,EAAE,EAC7B,QAAQ,EAAE,iBAAiB,EAC3B,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAgDhC"}
+{"version":3,"file":"embeddings.d.ts","sourceRoot":"","sources":["../../src/receipt/embeddings.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACnD;2DACuD;IACvD,UAAU,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,GAAG,SAAS,CAAC,CAAC;CAC7E;AAsBD,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAgDlF,mFAAmF;AACnF,qBAAa,mBAAoB,YAAW,iBAAiB;IAQ/C,OAAO,CAAC,QAAQ,CAAC,GAAG;IAPhC,OAAO,CAAC,UAAU,CAA6B;IAC/C,OAAO,CAAC,UAAU,CAA6B;IAC/C,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,UAAU,CAAS;IAC3B,yEAAyE;IACzE,OAAO,CAAC,QAAQ,CAAuC;gBAE1B,GAAG,GAAE,MAAM,CAAC,UAAwB;YAEnD,YAAY;YAMZ,SAAS;IA+BjB,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,SAAS,CAAC;IAmBlD,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,GAAG,SAAS,CAAC;CA0BjF;AAsED;;;;;GAKG;AACH,qBAAa,mBAAmB;IAE9B,OAAO,CAAC,OAAO,CAAsC;IACrD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAqB;IAChD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,0FAA0F;IAC1F,OAAO,CAAC,UAAU,CAAS;IAC3B,2FAA2F;IAC3F,OAAO,CAAC,WAAW,CAAqB;IACxC,OAAO,CAAC,MAAM,CAAqB;gBAEvB,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB;IAOpE,OAAO,CAAC,MAAM;IAQd,OAAO,CAAC,IAAI;IAYZ,OAAO,CAAC,OAAO;IAuBf,OAAO,CAAC,OAAO;IA2Bf,+DAA+D;IAC/D,OAAO,CAAC,OAAO;IAiBf,OAAO,CAAC,MAAM;IAgBd,uFAAuF;IACvF,OAAO,CAAC,YAAY;IAcpB,6FAA6F;IAC7F,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,IAAI;IAI3C,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS;IAKlE,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI;IAIpE,qEAAqE;IACrE,OAAO,CAAC,KAAK,EAAE,SAAS;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,GAAG,IAAI;CAmB3G;AAID;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,SAAS,UAAU,EAAE,EAC7B,QAAQ,EAAE,iBAAiB,EAC3B,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAiDhC"}