@shield-agent/kya 0.32.9 → 0.33.1

package/dist/map/page.js

@@ -0,0 +1,374 @@
+/**
+ * Map page: one body renderer for `kya map --html` and the live report's Map tab, plus the browser draw script.
+ * Every string from the trail is untrusted. Server HTML escapes it with esc(). The embedded JSON escapes `<`, `>`,
+ * `&`, U+2028 and U+2029. The draw script writes labels through Cytoscape or textContent, never as HTML.
+ */
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { assertNoSecrets } from "../dash/render.js";
+/** The one line that says what the map is not. Shown on every map page. */
+export const ADVISORY_LINE = "Recorded by KYA. The open source check is advisory; this map shows what was recorded, not what was enforced.";
+/** Edge colours by dominant verdict. Deny beats hold, hold beats observed, observed beats allow (schema section 3). */
+export const TONE_COLOUR = { deny: "#b42318", hold: "#b54708", observed: "#667085", allow: "#067647" };
+/** Tone of an edge from its verdict counts. Any deny makes the edge red. */
+export function edgeTone(v) {
+    if (v.deny > 0)
+        return "deny";
+    if (v.hold > 0)
+        return "hold";
+    if (v.observed > 0)
+        return "observed";
+    return "allow";
+}
+/** Edge width grows with log(count): 1 for one event, about 3 for 10, about 5 for 100. */
+export function edgeWidth(count) {
+    return Math.round((1 + 2 * Math.log10(Math.max(1, count))) * 100) / 100;
+}
+/**
+ * JSON for a `<script type="application/json">` body. `<`, `>` and `&` and the two line separators become
+ * \u escapes, so the text can never close the script element or start a tag. JSON.parse reads them back unchanged.
+ */
+export function jsonForScript(value) {
+    return JSON.stringify(value).replace(/[<>&\u2028\u2029]/g, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`);
+}
+/**
+ * Secret scan for map output. The shared keyword rule reads `secret:<family>` class labels as a secret assignment
+ * (`secret:cloud-credential` is 16 characters), so those exact labels are masked first. Everything else is scanned.
+ */
+const SECRET_CLASS = /\bsecret:(ssh-key|cloud-credential|gpg|env-file|package-token|key-file|other)\b/g;
+export function scanMapOutput(text) {
+    assertNoSecrets(text.replace(SECRET_CLASS, "secret-class:$1"));
+}
+/** HTML text and attribute escape. */
+export function esc(s) {
+    return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+/** Data the draw script reads: nodes with a label and detail, edges with tone and width (computed here, not in the browser). */
+export function drawModel(graph) {
+    return {
+        colours: TONE_COLOUR,
+        nodes: graph.nodes.map((n) => ({
+            id: n.id,
+            kind: n.kind,
+            label: n.label ?? n.id,
+            detail: detailOf(n),
+            count: n.count,
+            verdicts: n.verdicts,
+            firstTs: n.firstTs,
+            lastTs: n.lastTs,
+        })),
+        edges: graph.edges.map((e, i) => {
+            const tone = edgeTone(e.verdicts);
+            return {
+                id: `e${i}`,
+                source: e.from,
+                target: e.to,
+                kind: e.kind,
+                tool: e.tool ?? null,
+                tone,
+                colour: TONE_COLOUR[tone],
+                width: edgeWidth(e.count),
+                count: e.count,
+                verdicts: e.verdicts,
+                firstTs: e.firstTs,
+                lastTs: e.lastTs,
+            };
+        }),
+    };
+}
+function detailOf(n) {
+    if (n.kind === "target")
+        return n.class;
+    if (n.kind === "tool")
+        return n.toolId;
+    if (n.kind === "agent")
+        return n.legacy ? `${n.product} (legacy rows)` : n.product;
+    return n.id;
+}
+const SHOWN_TARGETS = 5;
+function sum(nums) {
+    return nums.reduce((a, b) => a + b, 0);
+}
+/** Level 0 to 4 for a count, relative to the largest count on the page. */
+function level(count, max) {
+    if (count <= 0 || max <= 0)
+        return 0;
+    return Math.min(4, Math.ceil((4 * count) / max));
+}
+function summaryHtml(graph) {
+    const devices = graph.nodes.filter((n) => n.kind === "device");
+    const events = sum(devices.map((n) => n.count));
+    const sessions = sum(graph.nodes.filter((n) => n.kind === "agent").map((n) => n.grouped ?? 1));
+    const classes = graph.nodes
+        .filter((n) => n.kind === "target" && n.grouped === undefined)
+        .sort((a, b) => b.count - a.count || (a.class < b.class ? -1 : a.class > b.class ? 1 : 0))
+        .slice(0, SHOWN_TARGETS);
+    const top = classes.length
+        ? `<ol class="map-top">${classes.map((c) => `<li><code>${esc(c.class)}</code> ${c.count}</li>`).join("")}</ol>`
+        : `<p class="mute">No targets yet.</p>`;
+    return `<div class="map-stats">
+  <p><strong>${events}</strong> events · <strong>${sessions}</strong> sessions · <strong>${devices.length}</strong> device${devices.length === 1 ? "" : "s"}</p>
+  <p class="small">Top ${SHOWN_TARGETS} target classes:</p>
+  ${top}
+</div>`;
+}
+function whenTable(heat) {
+    const head = heat.when.hours.map((h) => `<th scope="col">${String(h).padStart(2, "0")}</th>`).join("");
+    const rows = heat.when.days.map((day, d) => {
+        const cells = heat.when.cells[d].map((count, h) => {
+            const v = heat.when.verdictCells[d][h];
+            const deny = v.deny > 0 ? " deny" : "";
+            const title = `${day} ${String(h).padStart(2, "0")}:00 - ${count} event${count === 1 ? "" : "s"}${v.deny > 0 ? `, ${v.deny} denied` : ""}`;
+            return `<td class="l${level(count, heat.when.max)}${deny}" title="${esc(title)}">${count || ""}</td>`;
+        });
+        return `<tr><th scope="row">${esc(day)}</th>${cells.join("")}</tr>`;
+    });
+    return `<table class="map-heat map-when">
+  <caption>When: events per hour, last 7 days (local time). A red outline marks an hour with a deny.</caption>
+  <thead><tr><th scope="col">Day</th>${head}</tr></thead>
+  <tbody>${rows.join("")}</tbody>
+</table>`;
+}
+function whereTable(heat) {
+    const rows = heat.where.rows.map((r) => {
+        const cell = (count, col) => `<td class="l${level(count, heat.where.max)}${col === "deny" && count > 0 ? " deny" : ""}">${count || ""}</td>`;
+        const name = r.grouped !== undefined ? `${r.class} (${r.grouped})` : r.class;
+        return `<tr><th scope="row"><code>${esc(name)}</code></th>${cell(r.allow, "allow")}${cell(r.deny, "deny")}${cell(r.hold, "hold")}${cell(r.observed, "observed")}</tr>`;
+    });
+    return `<table class="map-heat map-where">
+  <caption>Where: events per target class and verdict.</caption>
+  <thead><tr><th scope="col">Target class</th><th scope="col">Allow</th><th scope="col">Deny</th><th scope="col">Hold</th><th scope="col">Observed</th></tr></thead>
+  <tbody>${rows.join("") || `<tr><td colspan="5" class="mute">No targets.</td></tr>`}</tbody>
+</table>`;
+}
+/**
+ * The page body: summary, graph container, side panel, both heat tables, and the data. Used inside the standalone
+ * file and as the live report's Map fragment. The graph is drawn by MAP_SCRIPT from the data element.
+ */
+export function renderMapBody(graph, heat, days) {
+    const events = sum(graph.nodes.filter((n) => n.kind === "device").map((n) => n.count));
+    const empty = events === 0 ? `<p class="map-empty">No events in the last ${days} days.</p>` : "";
+    const graphBlock = events === 0
+        ? ""
+        : `<div class="map-canvas">
+  <div id="kya-map-graph" class="map-graph" aria-label="Map of agent actions"></div>
+  <aside id="kya-map-panel" class="map-panel" aria-live="polite"><p class="mute">Click a node to see its class, counts and first and last time.</p></aside>
+</div>
+<p class="map-legend small">Edges: red = deny, amber = hold, grey = observed (recorded, not enforced), green = allow. Width grows with the count.</p>`;
+    return `<div class="map-body">
+  <p class="map-advisory">${esc(ADVISORY_LINE)}</p>
+  ${summaryHtml(graph)}
+  ${empty}
+  ${graphBlock}
+  <h2>When</h2>
+  <div class="map-scroll">${whenTable(heat)}</div>
+  <h2>Where</h2>
+  <div class="map-scroll">${whereTable(heat)}</div>
+  <script type="application/json" id="kya-map-data">${jsonForScript(drawModel(graph))}</script>
+</div>`;
+}
+const LIBRARY_PATH = new URL("../../vendor/cytoscape/cytoscape.min.js", import.meta.url);
+let librarySource;
+/** The vendored Cytoscape.js (MIT, see vendor/cytoscape/LICENSE). `</script` is broken so it cannot end the element. */
+export function cytoscapeSource() {
+    if (librarySource === undefined) {
+        librarySource = readFileSync(fileURLToPath(LIBRARY_PATH), "utf8").replace(/<\/(script)/gi, "<\\/$1");
+    }
+    return librarySource;
+}
+/** Content-Security-Policy for the standalone file. No network: default-src none. */
+export const MAP_CSP = "default-src 'none'; style-src 'unsafe-inline'; script-src 'unsafe-inline'; img-src data:";
+/**
+ * The browser part. Labels go to Cytoscape (canvas) or textContent. The live body is parsed with DOMParser (the body
+ * has no executable script), so this file never assigns innerHTML.
+ */
+export const MAP_SCRIPT = `(function () {
+  'use strict';
+  var cy = null;
+  var last = null;
+  var live = !!document.querySelector('main[data-live-token]');
+  function token() {
+    var m = /(?:^|[?&])t=([^&]*)/.exec(location.search);
+    if (!m) return '';
+    try { return decodeURIComponent(m[1]); } catch (e) { return m[1]; }
+  }
+  function model() {
+    var el = document.getElementById('kya-map-data');
+    if (!el) return null;
+    try { return JSON.parse(el.textContent || 'null'); } catch (e) { return null; }
+  }
+  function add(parent, tag, text) {
+    var n = document.createElement(tag);
+    n.textContent = String(text);
+    parent.appendChild(n);
+    return n;
+  }
+  function showNode(node) {
+    var panel = document.getElementById('kya-map-panel');
+    if (!panel) return;
+    while (panel.firstChild) panel.removeChild(panel.firstChild);
+    add(panel, 'h3', node.kind + ': ' + node.label);
+    add(panel, 'p', 'Class: ' + node.detail);
+    var list = document.createElement('dl');
+    panel.appendChild(list);
+    [['Events', node.count], ['Allow', node.verdicts.allow], ['Deny', node.verdicts.deny], ['Hold', node.verdicts.hold],
+     ['Observed', node.verdicts.observed], ['First seen', node.firstTs || '-'], ['Last seen', node.lastTs || '-']]
+      .forEach(function (r) { add(list, 'dt', r[0]); add(list, 'dd', r[1]); });
+  }
+  function style(d) {
+    var out = [
+      { selector: 'node', style: { 'label': 'data(label)', 'font-size': 10, 'text-wrap': 'ellipsis', 'text-max-width': 130, 'min-zoomed-font-size': 9,
+        'text-background-color': '#ffffff', 'text-background-opacity': 0.8, 'text-background-padding': 1,
+        'width': 18, 'height': 18, 'background-color': '#98a2b3', 'color': '#101828' } },
+      { selector: 'node[kind = "device"]', style: { 'background-color': '#344054', 'shape': 'round-rectangle', 'width': 34, 'height': 34 } },
+      { selector: 'node[kind = "agent"]', style: { 'background-color': '#1d4ed8' } },
+      { selector: 'node[kind = "tool"]', style: { 'background-color': '#7a5af8', 'shape': 'round-rectangle' } },
+      { selector: 'node[kind = "target"]', style: { 'background-color': '#0e9384' } },
+      { selector: 'edge', style: { 'width': 'data(width)', 'line-color': 'data(colour)', 'target-arrow-color': 'data(colour)',
+        'target-arrow-shape': 'triangle', 'curve-style': 'bezier', 'opacity': 0.9 } }
+    ];
+    return out;
+  }
+  var MAX_DRAW_NODES = 400;
+  function draw() {
+    var host = document.getElementById('kya-map-graph');
+    var d = model();
+    if (cy) { cy.destroy(); cy = null; }
+    if (!host || !d || !window.cytoscape || !d.nodes || !d.nodes.length) return;
+    // A force layout on thousands of nodes hangs the tab. The JSON and both heat views still hold everything.
+    if (d.nodes.length > MAX_DRAW_NODES) {
+      host.textContent = 'Graph not drawn: ' + d.nodes.length + ' nodes is too many for the page. Use a shorter window (kya map --days 1) or kya map --json.';
+      return;
+    }
+    cy = window.cytoscape({
+      container: host,
+      elements: {
+        nodes: d.nodes.map(function (n) { return { data: n }; }),
+        edges: d.edges.map(function (e) { return { data: e }; })
+      },
+      style: style(d),
+      layout: { name: 'cose', animate: false, randomize: true, fit: true, padding: 24, numIter: 900, nodeRepulsion: function () { return 9000; }, idealEdgeLength: function () { return 80; }, nodeOverlap: 14, gravity: 0.35 }
+    });
+    cy.on('tap', 'node', function (evt) { showNode(evt.target.data()); });
+    cy.fit();
+  }
+  function refresh() {
+    if (!live) return;
+    var host = document.getElementById('frag-map');
+    if (!host) return;
+    fetch('/fragments?t=' + encodeURIComponent(token()), {
+      method: 'POST', headers: { 'Content-Type': 'application/json' }, body: '{"map":true}'
+    })
+      .then(function (r) { if (!r.ok) throw new Error('HTTP ' + r.status); return r.json(); })
+      .then(function (j) {
+        if (!j || !j.ok || !j.fragments || typeof j.fragments.mapBody !== 'string') return;
+        if (j.fragments.mapBody === last) return;
+        last = j.fragments.mapBody;
+        var doc = new DOMParser().parseFromString(j.fragments.mapBody, 'text/html');
+        var nodes = Array.prototype.slice.call(doc.body.childNodes);
+        while (host.firstChild) host.removeChild(host.firstChild);
+        nodes.forEach(function (n) { host.appendChild(n); });
+        draw();
+      })
+      .catch(function (err) { console.error('KYA map refresh failed', err); });
+  }
+  // Live only: fetch the vendored library with the token from this page's URL, then run it as a script element.
+  function loadLibrary(next) {
+    if (window.cytoscape) { next(); return; }
+    fetch('/vendor/cytoscape.min.js?t=' + encodeURIComponent(token()))
+      .then(function (r) { if (!r.ok) throw new Error('HTTP ' + r.status); return r.text(); })
+      .then(function (text) {
+        var s = document.createElement('script');
+        s.id = 'kya-cytoscape';
+        s.textContent = text;
+        document.head.appendChild(s);
+        next();
+      })
+      .catch(function (err) { console.error('KYA map library failed', err); });
+  }
+  window.kyaMapRefresh = refresh;
+  window.addEventListener('hashchange', function () {
+    if (location.hash !== '#map') return;
+    refresh();
+    setTimeout(function () { if (cy) { cy.resize(); cy.fit(); } }, 0);
+  });
+  if (live) loadLibrary(refresh); else draw();
+})();`;
+/**
+ * Live report: the draw script, in the page shell (not in the swapped fragment). The script reads the token from its
+ * own URL and fetches the library from /vendor/cytoscape.min.js, so the token never appears in the HTML.
+ */
+export function liveMapScripts() {
+    return `<script id="kya-map">${MAP_SCRIPT}</script>`;
+}
+/** Map components. Shared by the standalone file and the live report, so it uses the report's tokens (--line, --mute, --fg, --bg). */
+export const MAP_CSS = `
+  .map-body .map-advisory { border-left: 3px solid var(--line, #d0d5dd); padding: 4px 10px; font-weight: 600; }
+  .map-body .mute { color: var(--mute, #667085); }
+  .map-stats p { margin: 4px 0; }
+  .map-top { margin: 4px 0 12px 20px; padding: 0; }
+  .map-canvas { display: grid; grid-template-columns: minmax(0, 1fr) 260px; gap: 12px; margin: 12px 0; }
+  .map-graph { height: 60vh; min-height: 360px; border: 1px solid var(--line, #d0d5dd); border-radius: 6px; }
+  .map-panel { border: 1px solid var(--line, #d0d5dd); border-radius: 6px; padding: 8px 12px; overflow: auto; }
+  .map-panel dl { display: grid; grid-template-columns: auto 1fr; gap: 2px 10px; }
+  .map-panel dt { color: var(--mute, #667085); }
+  .map-panel dd { margin: 0; }
+  .map-scroll { overflow-x: auto; }
+  .map-heat { border-collapse: collapse; font-size: 12px; margin-bottom: 12px; }
+  .map-heat caption { text-align: left; color: var(--mute, #667085); padding: 4px 0; }
+  .map-heat th, .map-heat td { border: 1px solid var(--line, #d0d5dd); padding: 3px 5px; text-align: right; min-width: 22px; }
+  .map-heat th { text-align: left; font-weight: 600; }
+  .map-heat td.l0 { background: transparent; }
+  .map-heat td.l1 { background: #d1fadf; color: #101828; }
+  .map-heat td.l2 { background: #75e0a7; color: #101828; }
+  .map-heat td.l3 { background: #12b76a; color: #fff; }
+  .map-heat td.l4 { background: #027a48; color: #fff; }
+  .map-heat td.deny { outline: 2px solid #b42318; outline-offset: -2px; }
+  .map-empty { font-weight: 600; }
+  @media (max-width: 760px) { .map-canvas { grid-template-columns: 1fr; } }
+`;
+/** Live report: the Map zone shows only on its tab (same :target rule as the other zones). */
+export const MAP_LIVE_ZONE_CSS = `
+  @supports selector(body:has(*)) {
+    #map { display: none; }
+    #map:target { display: block; }
+    body:has(#map:target) #overview { display: none; }
+    body:has(#map:target) .nav-link[href="#map"] { color: var(--fg); background: var(--bg); border-color: var(--line); }
+  }
+`;
+/** Standalone file only: its own tokens and page frame (the live report has its own). */
+export const MAP_PAGE_CSS = `
+  :root { --fg: #101828; --mute: #667085; --line: #d0d5dd; --bg: #ffffff; }
+  @media (prefers-color-scheme: dark) { :root:not([data-theme="light"]) { --fg: #f2f4f7; --mute: #98a2b3; --line: #344054; --bg: #101828; } }
+  :root[data-theme="dark"] { --fg: #f2f4f7; --mute: #98a2b3; --line: #344054; --bg: #101828; }
+  body { background: var(--bg); color: var(--fg); font: 14px/1.45 system-ui, sans-serif; margin: 0; }
+  .map-page { max-width: 1100px; margin: 0 auto; padding: 16px; }
+`;
+/** Standalone file: one page, no network, CSP on. */
+export function renderMapPage(input) {
+    const body = renderMapBody(input.graph, input.heat, input.days);
+    return `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8"/>
+<meta name="viewport" content="width=device-width, initial-scale=1"/>
+<meta http-equiv="Content-Security-Policy" content="${MAP_CSP}"/>
+<meta name="referrer" content="no-referrer"/>
+<title>${esc(input.title)}</title>
+<style>${MAP_PAGE_CSS}${MAP_CSS}</style>
+</head>
+<body>
+<main class="map-page">
+<header>
+  <h1>Map of agent actions</h1>
+  <p class="mute">Last ${input.days} days · local only</p>
+</header>
+${body}
+</main>
+<script id="kya-cytoscape">${cytoscapeSource()}</script>
+<script id="kya-map">${MAP_SCRIPT}</script>
+</body>
+</html>
+`;
+}
+//# sourceMappingURL=page.js.map

package/dist/map/page.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"page.js","sourceRoot":"","sources":["../../src/map/page.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAIpD,2EAA2E;AAC3E,MAAM,CAAC,MAAM,aAAa,GACxB,8GAA8G,CAAC;AAEjH,uHAAuH;AACvH,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAW,CAAC;AAGhH,4EAA4E;AAC5E,MAAM,UAAU,QAAQ,CAAC,CAAW;IAClC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IAC9B,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IAC9B,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC;QAAE,OAAO,UAAU,CAAC;IACtC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC;AAC1E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;AAC3H,CAAC;AAED;;;GAGG;AACH,MAAM,YAAY,GAAG,kFAAkF,CAAC;AACxG,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,sCAAsC;AACtC,MAAM,UAAU,GAAG,CAAC,CAAS;IAC3B,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC7H,CAAC;AAED,gIAAgI;AAChI,MAAM,UAAU,SAAS,CAAC,KAAe;IACvC,OAAO;QACL,OAAO,EAAE,WAAW;QACpB,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC;YACtC,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE;YACtB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;YACnB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,MAAM,EAAE,CAAC,CAAC,MAAM;SACjB,CAAC,CAAC;QACH,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YAC9B,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YAClC,OAAO;gBACL,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,MAAM,EAAE,CAAC,CAAC,IAAI;gBACd,MAAM,EAAE,CAAC,CAAC,EAAE;gBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI;gBACpB,IAAI;gBACJ,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC;gBACzB,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;gBACzB,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,MAAM,EAAE,CAAC,CAAC,MAAM;aACjB,CAAC;QACJ,CAAC,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC;IACxC,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACnF,OAAO,CAAC,CAAC,EAAE,CAAC;AACd,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,CAAC;AAExB,SAAS,GAAG,CAAC,IAAuB;IAClC,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,2EAA2E;AAC3E,SAAS,KAAK,CAAC,KAAa,EAAE,GAAW;IACvC,IAAI,KAAK,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IACrC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,WAAW,CAAC,KAAe;IAClC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/F,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK;SACxB,MAAM,CAAC,CAAC,CAAC,EAA6C,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC;SACxG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACzF,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;IAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM;QACxB,CAAC,CAAC,uBAAuB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO;QAC/G,CAAC,CAAC,qCAAqC,CAAC;IAC1C,OAAO;eACM,MAAM,8BAA8B,QAAQ,gCAAgC,OAAO,CAAC,MAAM,mBAAmB,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG;yBAClI,aAAa;IAClC,GAAG;OACA,CAAC;AACR,CAAC;AAED,SAAS,SAAS,CAAC,IAAU;IAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvG,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;YACjD,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAE,CAAC,CAAC,CAAE,CAAC;YACzC,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,GAAG,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,SAAS,KAAK,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAC3I,OAAO,eAAe,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,YAAY,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,EAAE,OAAO,CAAC;QACxG,CAAC,CAAC,CAAC;QACH,OAAO,uBAAuB,GAAG,CAAC,GAAG,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;IACtE,CAAC,CAAC,CAAC;IACH,OAAO;;uCAE8B,IAAI;WAChC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;SACf,CAAC;AACV,CAAC;AAED,SAAS,UAAU,CAAC,IAAU;IAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,GAAW,EAAE,EAAE,CAC1C,eAAe,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,KAAK,MAAM,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,IAAI,EAAE,OAAO,CAAC;QAClH,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC7E,OAAO,6BAA6B,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC;IACzK,CAAC,CAAC,CAAC;IACH,OAAO;;;WAGE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,wDAAwD;SAC3E,CAAC;AACV,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAe,EAAE,IAAU,EAAE,IAAY;IACrE,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACvF,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,8CAA8C,IAAI,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IACjG,MAAM,UAAU,GACd,MAAM,KAAK,CAAC;QACV,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;;;;sJAI8I,CAAC;IACrJ,OAAO;4BACmB,GAAG,CAAC,aAAa,CAAC;IAC1C,WAAW,CAAC,KAAK,CAAC;IAClB,KAAK;IACL,UAAU;;4BAEc,SAAS,CAAC,IAAI,CAAC;;4BAEf,UAAU,CAAC,IAAI,CAAC;sDACU,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;OAC9E,CAAC;AACR,CAAC;AAED,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,yCAAyC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzF,IAAI,aAAiC,CAAC;AAEtC,wHAAwH;AACxH,MAAM,UAAU,eAAe;IAC7B,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,aAAa,GAAG,YAAY,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,MAAM,OAAO,GAAG,0FAA0F,CAAC;AAElH;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MA+GpB,CAAC;AAEP;;;GAGG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,wBAAwB,UAAU,WAAW,CAAC;AACvD,CAAC;AAED,sIAAsI;AACtI,MAAM,CAAC,MAAM,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;;;;CAwBtB,CAAC;AAEF,8FAA8F;AAC9F,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;CAOhC,CAAC;AAEF,yFAAyF;AACzF,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;CAM3B,CAAC;AAEF,qDAAqD;AACrD,MAAM,UAAU,aAAa,CAAC,KAAmE;IAC/F,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAChE,OAAO;;;;;sDAK6C,OAAO;;SAEpD,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;SAChB,YAAY,GAAG,OAAO;;;;;;yBAMN,KAAK,CAAC,IAAI;;EAEjC,IAAI;;6BAEuB,eAAe,EAAE;uBACvB,UAAU;;;CAGhC,CAAC;AACF,CAAC"}

package/dist/map/target-class.d.ts

@@ -0,0 +1,22 @@
+/** A class string such as `secret:ssh-key` or `project:app/src/**`. Never a raw path, file name or argument. */
+export type TargetClass = string;
+/** `other` holds absolute paths that match no named class (schema 4.4 rule 9). */
+export type TargetFamily = "network" | "secret" | "tmp" | "system" | "project" | "home" | "command" | "none" | "other";
+export interface TargetInput {
+    readonly toolId: string;
+    readonly targetPath?: string;
+    readonly summary?: string;
+    readonly project?: string;
+    /** Absolute working directory of the call. With it a path is "in the project" only when it is under this directory. */
+    readonly cwd?: string;
+    readonly home?: string;
+}
+/**
+ * Maps one event's target to a class. Pure: no fs, no env, no clock. Rules run in schema 4.4 order, first match wins.
+ * Output is a class only: a host for network, a binary for command, no path, file name or argument.
+ */
+export declare function classifyTarget(input: TargetInput): {
+    class: TargetClass;
+    family: TargetFamily;
+};
+//# sourceMappingURL=target-class.d.ts.map

package/dist/map/target-class.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"target-class.d.ts","sourceRoot":"","sources":["../../src/map/target-class.ts"],"names":[],"mappings":"AAEA,gHAAgH;AAChH,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC;AAEjC,kFAAkF;AAClF,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,QAAQ,GAAG,KAAK,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;AAEvH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,uHAAuH;IACvH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AA4FD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,WAAW,GAAG;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,CA2C/F"}

package/dist/map/target-class.js

@@ -0,0 +1,151 @@
+import { isSecretPath } from "../never-list-input.js";
+/** Same shape as the redacted shell line written by `summarizeShellCommand`. Only the binary and the arg count survive. */
+const SHELL_SUMMARY = /^shell (\S+?)( \(\+\d+ args\))?$/;
+const URL_SCHEME = /^[a-z][a-z0-9+.-]*:\/\//i;
+const BIN = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,63}$/;
+const TMP_ROOTS = ["/tmp", "/private/tmp", "/var/folders", "/private/var/folders"];
+const SYSTEM_ROOTS = ["/private/etc", "/etc", "/usr", "/bin", "/sbin", "/System", "/Library", "/opt", "/boot", "/dev", "/proc"];
+/** A path segment shown in a class. Anything that could carry a credential (`user:pass@`, `?x=`) becomes `(other)`. */
+function seg(s) {
+    return s === "" || s === "." || s === ".." || s.length > 64 || /[:@?#=&%\u0000-\u001f]/.test(s) ? "(other)" : s;
+}
+const NET_SCHEMES = new Set(["http:", "https:", "ws:", "wss:", "ftp:"]);
+const HOST = /^(?:[a-z0-9-]+(?:\.[a-z0-9-]+)*|\[[0-9a-f:.]+\])$/;
+/** Host of an absolute URL, or undefined. Only network schemes; the host must look like a host (no opaque text). */
+function urlHost(s) {
+    try {
+        const u = new URL(s);
+        const host = u.hostname.toLowerCase();
+        return NET_SCHEMES.has(u.protocol) && host.length <= 253 && HOST.test(host) ? host : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Local path of a file: URL, or undefined for any other scheme. The path stays inside this module: only a class leaves it. */
+function fileUrlPath(s) {
+    if (!/^file:\/\//i.test(s))
+        return undefined;
+    try {
+        const u = new URL(s);
+        if (u.protocol !== "file:")
+            return undefined;
+        try {
+            return decodeURIComponent(u.pathname);
+        }
+        catch {
+            return u.pathname;
+        }
+    }
+    catch {
+        return "/";
+    }
+}
+/** Directory names that carry no personal data. Used when the working directory is unknown (rows written before `targetClass`). */
+const COMMON_DIRS = new Set(["src", "lib", "test", "tests", "docs", "app", "web", "api", "scripts", "public", "dist", "build", "node_modules", ".github", ".kya", ".claude"]);
+const RESERVED_PROJECT = new Set(["home", "Users", "root", "tmp", "var", "etc", "usr", "opt", "private"]);
+/** `s` without trailing slashes. A loop, not `/\/+$/`: that regex is quadratic on a long run of slashes before another character. */
+function trimTrailingSlashes(s) {
+    let end = s.length;
+    while (end > 0 && s.charCodeAt(end - 1) === 47)
+        end--;
+    return s.slice(0, end);
+}
+/** Part of `t` inside the project, or undefined. Exact when `cwd` is known; a guarded guess from the project name otherwise. */
+function projectRest(t, input) {
+    const project = input.project;
+    if (!project || RESERVED_PROJECT.has(project))
+        return undefined;
+    const cwd = input.cwd === undefined ? undefined : trimTrailingSlashes(input.cwd);
+    if (cwd && cwd.startsWith("/")) {
+        // A project folder that is the home folder or above it names a user: no project class.
+        if (cwd === "" || (input.home && (cwd === input.home || input.home.startsWith(cwd + "/"))))
+            return undefined;
+        // Shaped like a home folder (another user, a container, a sandbox HOME): its name is a user name.
+        if (/^\/(?:Users|home)\/[^/]+$/.test(cwd) || cwd === "/root")
+            return undefined;
+        if (t === cwd)
+            return { rest: "", exact: true };
+        return t.startsWith(cwd + "/") ? { rest: t.slice(cwd.length + 1), exact: true } : undefined;
+    }
+    const at = t.indexOf(`/${project}/`);
+    return at > 0 ? { rest: t.slice(at + project.length + 2), exact: false } : undefined;
+}
+/** Secret family, a fixed label chosen from the path shape. `isSecretPath` decides whether it is secret. */
+function secretLabel(p) {
+    const base = p.slice(p.lastIndexOf("/") + 1);
+    if (/(^|\/)\.ssh\//.test(p))
+        return "ssh-key";
+    if (/(^|\/)\.aws\/|gcloud/.test(p))
+        return "cloud-credential";
+    if (base.startsWith(".env"))
+        return "env-file";
+    if (/\.(pem|key)$/.test(base))
+        return "key-file";
+    return "other";
+}
+/** Home-relative remainder of a path (`/.zshrc`, `/Documents/x`), or undefined when the path is not under a home. */
+function homeRest(p, home) {
+    if (home && (p === home || p.startsWith(home + "/")))
+        return p.slice(home.length);
+    if (p === "~" || p.startsWith("~/"))
+        return p.slice(1);
+    const user = /^\/(?:Users|home)\/[^/]+(\/.*)?$/.exec(p);
+    if (user)
+        return user[1] ?? "";
+    const root = /^\/root(\/.*)?$/.exec(p);
+    return root ? (root[1] ?? "") : undefined;
+}
+/**
+ * Maps one event's target to a class. Pure: no fs, no env, no clock. Rules run in schema 4.4 order, first match wins.
+ * Output is a class only: a host for network, a binary for command, no path, file name or argument.
+ */
+export function classifyTarget(input) {
+    let t = input.targetPath;
+    if (t && URL_SCHEME.test(t)) {
+        const file = fileUrlPath(t);
+        if (file === undefined) {
+            const host = urlHost(t);
+            return { class: `network:${host ?? "other"}`, family: "network" };
+        }
+        t = file; // file:///home/a/.aws/credentials is a path: the secret, system and home rules decide
+    }
+    if (t && isSecretPath(t, input.home))
+        return { class: `secret:${secretLabel(t)}`, family: "secret" };
+    if (t && TMP_ROOTS.some((r) => t === r || t.startsWith(r + "/")))
+        return { class: "tmp:/**", family: "tmp" };
+    const sys = t && SYSTEM_ROOTS.find((r) => t === r || t.startsWith(r + "/"));
+    if (sys)
+        return { class: `system:${sys}/**`, family: "system" };
+    const inProject = t ? projectRest(t, input) : undefined;
+    if (t && inProject) {
+        const name = seg(input.project ?? "");
+        const slash = inProject.rest.indexOf("/");
+        const dir = slash < 0 ? "" : inProject.rest.slice(0, slash);
+        const shown = inProject.exact || COMMON_DIRS.has(dir) ? seg(dir) : "(other)";
+        return { class: slash < 0 ? `project:${name}/*` : `project:${name}/${shown}/**`, family: "project" };
+    }
+    if (t && !t.startsWith("/") && !t.startsWith("~") && !t.startsWith("\\") && !/^[A-Za-z]:[\\/]/.test(t)) {
+        const slash = t.indexOf("/");
+        return { class: slash < 0 ? "project:(relative)/*" : `project:(relative)/${seg(t.slice(0, slash))}/**`, family: "project" };
+    }
+    const rest = t ? homeRest(t, input.home) : undefined;
+    if (rest !== undefined) {
+        const first = rest.replace(/^\/+/, "").split("/")[0] ?? "";
+        return first.startsWith(".") ? { class: "home:dot/**", family: "home" } : { class: "home:other", family: "home" };
+    }
+    if (t)
+        return { class: "absolute:other", family: "other" };
+    const m = input.summary ? SHELL_SUMMARY.exec(input.summary) : null;
+    if (m) {
+        const token = m[1] ?? "";
+        if (token.includes("://")) {
+            const host = urlHost(token);
+            return { class: `network:${host ?? "other"}`, family: "network" };
+        }
+        const bin = token.slice(token.lastIndexOf("/") + 1);
+        return { class: `command:${BIN.test(bin) ? bin : "other"}`, family: "command" };
+    }
+    return { class: "none", family: "none" };
+}
+//# sourceMappingURL=target-class.js.map

package/dist/map/target-class.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"target-class.js","sourceRoot":"","sources":["../../src/map/target-class.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAkBtD,2HAA2H;AAC3H,MAAM,aAAa,GAAG,kCAAkC,CAAC;AACzD,MAAM,UAAU,GAAG,0BAA0B,CAAC;AAC9C,MAAM,GAAG,GAAG,oCAAoC,CAAC;AACjD,MAAM,SAAS,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,sBAAsB,CAAC,CAAC;AACnF,MAAM,YAAY,GAAG,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAEhI,uHAAuH;AACvH,SAAS,GAAG,CAAC,CAAS;IACpB,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;AAClH,CAAC;AAED,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AACxE,MAAM,IAAI,GAAG,mDAAmD,CAAC;AAEjE,oHAAoH;AACpH,SAAS,OAAO,CAAC,CAAS;IACxB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;QACrB,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACtC,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACjG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,+HAA+H;AAC/H,SAAS,WAAW,CAAC,CAAS;IAC5B,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,SAAS,CAAC;QAC7C,IAAI,CAAC;YACH,OAAO,kBAAkB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,QAAQ,CAAC;QACpB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED,mIAAmI;AACnI,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAC9K,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;AAE1G,qIAAqI;AACrI,SAAS,mBAAmB,CAAC,CAAS;IACpC,IAAI,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC;IACnB,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE;QAAE,GAAG,EAAE,CAAC;IACtD,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,gIAAgI;AAChI,SAAS,WAAW,CAAC,CAAS,EAAE,KAAkB;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,CAAC,OAAO,IAAI,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAChE,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjF,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,uFAAuF;QACvF,IAAI,GAAG,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;QAC7G,kGAAkG;QAClG,IAAI,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,OAAO;YAAE,OAAO,SAAS,CAAC;QAC/E,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAChD,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9F,CAAC;IACD,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC;IACrC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACvF,CAAC;AAED,4GAA4G;AAC5G,SAAS,WAAW,CAAC,CAAS;IAC5B,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9C,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,kBAAkB,CAAC;IAC9D,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,UAAU,CAAC;IAC/C,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,UAAU,CAAC;IACjD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,qHAAqH;AACrH,SAAS,QAAQ,CAAC,CAAS,EAAE,IAAwB;IACnD,IAAI,IAAI,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,kCAAkC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxD,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,KAAkB;IAC/C,IAAI,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC;IACzB,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YACxB,OAAO,EAAE,KAAK,EAAE,WAAW,IAAI,IAAI,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACpE,CAAC;QACD,CAAC,GAAG,IAAI,CAAC,CAAC,sFAAsF;IAClG,CAAC;IACD,IAAI,CAAC,IAAI,YAAY,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,UAAU,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACrG,IAAI,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC7G,MAAM,GAAG,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAC5E,IAAI,GAAG;QAAE,OAAO,EAAE,KAAK,EAAE,UAAU,GAAG,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAChE,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxD,IAAI,CAAC,IAAI,SAAS,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7E,OAAO,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,IAAI,KAAK,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACvG,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACvG,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,OAAO,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,sBAAsB,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC9H,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3D,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACpH,CAAC;IACD,IAAI,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC3D,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnE,IAAI,CAAC,EAAE,CAAC;QACN,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO,EAAE,KAAK,EAAE,WAAW,IAAI,IAAI,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACpE,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACpD,OAAO,EAAE,KAAK,EAAE,WAAW,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAClF,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC3C,CAAC"}