@shield-agent/kya 0.32.9 → 0.33.2

package/dist/posture/collect.js

@@ -0,0 +1,182 @@
+/**
+ * Builds the posture report v1 (spec: shield-agent contract, "Posture report v1") from local
+ * facts only. Minimised on purpose: agent hosts, agent-related extensions, MCP server names with
+ * transport and command basename, the IoC result and the never-list status. No args, env values,
+ * file contents, paths, user names or addresses. The validator (validate.ts) is the last word.
+ */
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { basename, join } from "node:path";
+import { scanCliBinaries } from "../discover/scan.js";
+import { CLI_VERSION } from "../version.js";
+/** Agent-related extensions the client may report (plus any id an IoC check names). */
+export const AGENT_EXTENSIONS = {
+    "anthropic.claude-code": "claude-code",
+    "openai.chatgpt": "codex",
+    "github.copilot": "copilot",
+    "github.copilot-chat": "copilot",
+    "saoudrizwan.claude-dev": "cline",
+    "rooveterinaryinc.roo-cline": "roo-code",
+    "continue.continue": "continue",
+    "google.geminicodeassist": "gemini",
+    "sourcegraph.cody-ai": "cody",
+    "kilocode.kilo-code": "kilo-code",
+    "amazonwebservices.amazon-q-vscode": "amazon-q",
+    "codeium.codeium": "codeium",
+    "tabnine.tabnine-vscode": "tabnine",
+};
+/** Catalog id (discover/catalog.ts) to the host id the report uses. Only CLI agents appear here. */
+const CLI_HOSTS = {
+    claude: "claude-code",
+    "cursor-agent": "cursor",
+    codex: "codex",
+    gemini: "gemini",
+    opencode: "opencode",
+    aider: "aider",
+};
+const EXTENSION_ROOTS = [
+    [".vscode/extensions", "vscode"],
+    [".vscode-insiders/extensions", "vscode"],
+    [".cursor/extensions", "cursor"],
+    [".windsurf/extensions", "windsurf"],
+    [".vscode-oss/extensions", "vscodium"],
+];
+const MCP_FILES = [".mcp.json", join(".cursor", "mcp.json"), ".claude.json", join(".gemini", "settings.json")];
+const MAX_HOSTS = 32;
+const MAX_EXTENSIONS = 200;
+const MAX_MCP = 100;
+const MAX_FINDINGS = 50;
+const nodeFs = () => ({
+    existsSync,
+    statSync: (p) => statSync(p),
+    readdirSync: (p) => readdirSync(p),
+    readFileSync: (p, enc) => readFileSync(p, enc),
+});
+function readJson(path) {
+    try {
+        return JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch {
+        return undefined;
+    }
+}
+function hostsFrom(input, extensions) {
+    const out = new Map();
+    for (const f of scanCliBinaries(input.pathDirs, nodeFs(), input.platform)) {
+        if (f.category !== "cli-agent")
+            continue;
+        const host = CLI_HOSTS[f.id];
+        if (host && !out.has(host))
+            out.set(host, { id: host, version: null, kyaHook: false });
+    }
+    for (const e of extensions) {
+        const host = AGENT_EXTENSIONS[e.id];
+        if (host && !out.has(host))
+            out.set(host, { id: host, version: null, kyaHook: false });
+    }
+    const claude = out.get("claude-code");
+    if (claude) {
+        // kyaHook is true only when the host's own settings file names kya. Checked for Claude Code only.
+        const settings = readFileSync0(join(input.home, ".claude", "settings.json"));
+        out.set("claude-code", { ...claude, kyaHook: settings !== undefined && settings.includes("kya") });
+    }
+    return [...out.values()].slice(0, MAX_HOSTS);
+}
+function readFileSync0(path) {
+    try {
+        return readFileSync(path, "utf8");
+    }
+    catch {
+        return undefined;
+    }
+}
+function extensionsFrom(input) {
+    const allowed = [...new Set([...Object.keys(AGENT_EXTENSIONS), ...input.iocExtensionIds])];
+    const out = [];
+    const seen = new Set();
+    for (const [rel, editor] of EXTENSION_ROOTS) {
+        let names;
+        try {
+            names = readdirSync(join(input.home, rel));
+        }
+        catch {
+            continue;
+        }
+        for (const name of names) {
+            const lower = name.toLowerCase();
+            // Longest id wins: github.copilot-chat-x must not be read as github.copilot.
+            const id = allowed.filter((a) => lower.startsWith(`${a}-`)).sort((a, b) => b.length - a.length)[0];
+            if (id === undefined)
+                continue;
+            const m = /^(\d+(?:\.\d+)*)/.exec(lower.slice(id.length + 1));
+            const version = m ? m[1] : null;
+            const key = `${id}|${version}|${editor}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            out.push({ id, version, editor });
+        }
+    }
+    return out.slice(0, MAX_EXTENSIONS);
+}
+function mcpFrom(home) {
+    const out = [];
+    const seen = new Set();
+    for (const rel of MCP_FILES) {
+        const root = readJson(join(home, rel));
+        if (root === null || typeof root !== "object")
+            continue;
+        const servers = root["mcpServers"];
+        if (servers === null || typeof servers !== "object" || Array.isArray(servers))
+            continue;
+        for (const [name, raw] of Object.entries(servers)) {
+            const s = (raw !== null && typeof raw === "object" ? raw : {});
+            const kind = String(s["type"] ?? s["transport"] ?? "");
+            const isHttp = typeof s["url"] === "string" || ["http", "sse", "streamable-http"].includes(kind);
+            const transport = isHttp ? "http" : "stdio";
+            // Basename of the program only: no args, no directories.
+            const first = typeof s["command"] === "string" ? s["command"].trim().split(/\s+/)[0] ?? "" : "";
+            const command = !isHttp && first !== "" ? basename(first.replace(/\\/g, "/")) : null;
+            const key = `${name}|${transport}|${command ?? ""}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            out.push({ name, transport, command });
+        }
+    }
+    return out.slice(0, MAX_MCP);
+}
+/** The report object before validation. Callers must run checkReport on it before any send. */
+export function collectReport(input) {
+    const extensions = extensionsFrom(input);
+    const hosts = hostsFrom(input, extensions);
+    const mcp = mcpFrom(input.home);
+    const ioc = input.ioc;
+    return {
+        schema: 1,
+        reportedAt: input.now.toISOString(),
+        kyaVersion: CLI_VERSION,
+        deviceId: input.deviceId,
+        deviceLabel: input.label,
+        os: input.platform,
+        arch: input.arch,
+        hosts,
+        extensions,
+        mcpServers: mcp,
+        ioc: ioc === undefined
+            ? undefined
+            : {
+                listVersion: ioc.listVersion,
+                checkedAt: ioc.checkedAt,
+                skipped: ioc.skipped,
+                findings: ioc.findings.slice(0, MAX_FINDINGS).map((f) => ({
+                    ioc: f.ioc,
+                    check: f.check,
+                    severity: f.severity,
+                    evidence: f.evidence,
+                    hint: f.hint,
+                })),
+            },
+        never: { listActive: true, mode: input.hosted ? "hosted" : "advisory" },
+    };
+}
+//# sourceMappingURL=collect.js.map

package/dist/posture/collect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"collect.js","sourceRoot":"","sources":["../../src/posture/collect.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAe,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAG5C,uFAAuF;AACvF,MAAM,CAAC,MAAM,gBAAgB,GAAqC;IAChE,uBAAuB,EAAE,aAAa;IACtC,gBAAgB,EAAE,OAAO;IACzB,gBAAgB,EAAE,SAAS;IAC3B,qBAAqB,EAAE,SAAS;IAChC,wBAAwB,EAAE,OAAO;IACjC,4BAA4B,EAAE,UAAU;IACxC,mBAAmB,EAAE,UAAU;IAC/B,yBAAyB,EAAE,QAAQ;IACnC,qBAAqB,EAAE,MAAM;IAC7B,oBAAoB,EAAE,WAAW;IACjC,mCAAmC,EAAE,UAAU;IAC/C,iBAAiB,EAAE,SAAS;IAC5B,wBAAwB,EAAE,SAAS;CACpC,CAAC;AAEF,oGAAoG;AACpG,MAAM,SAAS,GAAqC;IAClD,MAAM,EAAE,aAAa;IACrB,cAAc,EAAE,QAAQ;IACxB,KAAK,EAAE,OAAO;IACd,MAAM,EAAE,QAAQ;IAChB,QAAQ,EAAE,UAAU;IACpB,KAAK,EAAE,OAAO;CACf,CAAC;AAEF,MAAM,eAAe,GAAoF;IACvG,CAAC,oBAAoB,EAAE,QAAQ,CAAC;IAChC,CAAC,6BAA6B,EAAE,QAAQ,CAAC;IACzC,CAAC,oBAAoB,EAAE,QAAQ,CAAC;IAChC,CAAC,sBAAsB,EAAE,UAAU,CAAC;IACpC,CAAC,wBAAwB,EAAE,UAAU,CAAC;CACvC,CAAC;AAEF,MAAM,SAAS,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC;AAC/G,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,OAAO,GAAG,GAAG,CAAC;AACpB,MAAM,YAAY,GAAG,EAAE,CAAC;AAgBxB,MAAM,MAAM,GAAG,GAAW,EAAE,CAAC,CAAC;IAC5B,UAAU;IACV,QAAQ,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpC,WAAW,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IAC1C,YAAY,EAAE,CAAC,CAAS,EAAE,GAAW,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,GAAG,CAAC;CAC/D,CAAC,CAAC;AAEH,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAY,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAmB,EAAE,UAA4B;IAClE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAoE,CAAC;IACxF,KAAK,MAAM,CAAC,IAAI,eAAe,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1E,IAAI,CAAC,CAAC,QAAQ,KAAK,WAAW;YAAE,SAAS;QACzC,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7B,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACpC,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACtC,IAAI,MAAM,EAAE,CAAC;QACX,kGAAkG;QAClG,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC;QAC7E,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACrG,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAmB;IACzC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,GAAG,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAC3F,MAAM,GAAG,GAA6D,EAAE,CAAC;IACzE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,eAAe,EAAE,CAAC;QAC5C,IAAI,KAAe,CAAC;QACpB,IAAI,CAAC;YACH,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YACjC,6EAA6E;YAC7E,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACnG,IAAI,EAAE,KAAK,SAAS;gBAAE,SAAS;YAC/B,MAAM,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;YAC9D,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACjC,MAAM,GAAG,GAAG,GAAG,EAAE,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;YACzC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,MAAM,GAAG,GAA4E,EAAE,CAAC;IACxF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QACvC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,SAAS;QACxD,MAAM,OAAO,GAAI,IAAgC,CAAC,YAAY,CAAC,CAAC;QAChE,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,SAAS;QACxF,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAkC,CAAC,EAAE,CAAC;YAC7E,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAA4B,CAAC;YAC1F,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;YACvD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,iBAAiB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACjG,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;YAC5C,yDAAyD;YACzD,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChG,MAAM,OAAO,GAAG,CAAC,MAAM,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACrF,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,SAAS,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;YACpD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,aAAa,CAAC,KAAmB;IAC/C,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACtB,OAAO;QACL,MAAM,EAAE,CAAC;QACT,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE;QACnC,UAAU,EAAE,WAAW;QACvB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW,EAAE,KAAK,CAAC,KAAK;QACxB,EAAE,EAAE,KAAK,CAAC,QAAQ;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,KAAK;QACL,UAAU;QACV,UAAU,EAAE,GAAG;QACf,GAAG,EACD,GAAG,KAAK,SAAS;YACf,CAAC,CAAC,SAAS;YACX,CAAC,CAAC;gBACE,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACxD,GAAG,EAAE,CAAC,CAAC,GAAG;oBACV,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;oBACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;oBACpB,IAAI,EAAE,CAAC,CAAC,IAAI;iBACb,CAAC,CAAC;aACJ;QACP,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE;KACxE,CAAC;AACJ,CAAC"}

package/dist/posture/send.d.ts

@@ -0,0 +1,24 @@
+import { type Violation } from "./validate.js";
+export declare const POLICY_PATH = "/api/v1/kya/posture/policy";
+export declare const REPORT_PATH = "/api/v1/kya/posture";
+export declare const POLICY_TTL_MS: number;
+export declare const REQUEST_TIMEOUT_MS = 5000;
+export type PostureOutcome = "off" | "no-credentials" | "policy-disabled" | "policy-unavailable" | "invalid" | "sent" | "rejected" | "failed";
+export interface PostureResult {
+    readonly outcome: PostureOutcome;
+    readonly detail?: string;
+}
+export interface BuiltReport {
+    readonly report: Record<string, unknown>;
+    readonly violations: readonly Violation[];
+}
+/** Full report for `posture send --dry-run`, `posture on` and the detached send. Scans once if no result is stored. */
+export declare function buildPostureReport(env: NodeJS.ProcessEnv, now?: Date): Promise<BuiltReport>;
+/** Sync preview for the dashboards: no scan, no network. The IoC part is absent until a result is stored. */
+export declare function previewPosture(env: NodeJS.ProcessEnv, now?: Date): BuiltReport;
+/** One send attempt. Never throws. Returns what happened, with a detail that carries no user data. */
+export declare function runPostureSend(env: NodeJS.ProcessEnv, deps?: {
+    readonly fetch?: typeof fetch;
+    readonly now?: Date;
+}): Promise<PostureResult>;
+//# sourceMappingURL=send.d.ts.map

package/dist/posture/send.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"send.d.ts","sourceRoot":"","sources":["../../src/posture/send.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAiC,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AAS9E,eAAO,MAAM,WAAW,+BAA+B,CAAC;AACxD,eAAO,MAAM,WAAW,wBAAwB,CAAC;AACjD,eAAO,MAAM,aAAa,QAAmB,CAAC;AAC9C,eAAO,MAAM,kBAAkB,OAAQ,CAAC;AAExC,MAAM,MAAM,cAAc,GACtB,KAAK,GACL,gBAAgB,GAChB,iBAAiB,GACjB,oBAAoB,GACpB,SAAS,GACT,MAAM,GACN,UAAU,GACV,QAAQ,CAAC;AAEb,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,QAAQ,CAAC,UAAU,EAAE,SAAS,SAAS,EAAE,CAAC;CAC3C;AAoCD,uHAAuH;AACvH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,GAAE,IAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,CAG7G;AAED,6GAA6G;AAC7G,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,GAAE,IAAiB,GAAG,WAAW,CAE1F;AAyCD,sGAAsG;AACtG,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,IAAI,GAAE;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAA;CAAO,GAChE,OAAO,CAAC,aAAa,CAAC,CA2DxB"}

package/dist/posture/send.js

@@ -0,0 +1,162 @@
+/**
+ * Posture sending. Order of gates, each one stops the send before any later step:
+ *   1. local toggle (~/.kya/config.json posture.share === true), checked before every request;
+ *   2. hosted credentials from `kya login` (remote http is refused by the credentials reader);
+ *   3. workspace policy (GET .../posture/policy), cached for one day; a 403 from the report
+ *      endpoint stops sending until the next policy check;
+ *   4. the report is built, checked by the validator, and only then posted (5 s timeout,
+ *      no redirects, https or loopback http only).
+ * Fail open for the user: every failure returns an outcome, never throws, never blocks a hook.
+ */
+import { hostname, userInfo } from "node:os";
+import { readCredentials } from "../login/credentials.js";
+import { validateConsoleUrl } from "../login/device-flow.js";
+import { applyPlaneAuth } from "../client.js";
+import { kyaHome } from "../config.js";
+import { readIocResult } from "../ioc/result.js";
+import { loadIocList } from "../ioc/list.js";
+import { runIocScan } from "../ioc/scan.js";
+import { collectReport } from "./collect.js";
+import { checkReport, forbiddenContext } from "./validate.js";
+import { deviceId, effectiveLabel, readPostureState, shareOn, writePostureState, } from "./store.js";
+export const POLICY_PATH = "/api/v1/kya/posture/policy";
+export const REPORT_PATH = "/api/v1/kya/posture";
+export const POLICY_TTL_MS = 24 * 60 * 60_000;
+export const REQUEST_TIMEOUT_MS = 5_000;
+function identity() {
+    let user = "";
+    try {
+        user = userInfo().username;
+    }
+    catch {
+        /* no user database entry: nothing to hide */
+    }
+    return { user, host: hostname() };
+}
+/** Read-only views pass create=false: they never write the device id file. */
+const PREVIEW_ID = "00000000-0000-4000-8000-000000000000";
+function build(env, ioc, now, create) {
+    const id = deviceId(env, create) ?? PREVIEW_ID;
+    const { user, host } = identity();
+    const report = collectReport({
+        deviceId: id,
+        label: effectiveLabel(env, id),
+        now,
+        home: kyaHome(env),
+        pathDirs: (env["PATH"] ?? "").split(process.platform === "win32" ? ";" : ":").filter((p) => p.trim() !== ""),
+        platform: process.platform,
+        arch: process.arch,
+        ioc,
+        iocExtensionIds: loadIocList()
+            .iocs.flatMap((i) => i.checks.filter((c) => c.kind === "extension").map((c) => c.id ?? ""))
+            .filter((s) => s !== ""),
+        hosted: readCredentials(env) !== undefined,
+    });
+    const violations = checkReport(report, forbiddenContext(env, user, host, kyaHome(env)));
+    return { report, violations };
+}
+/** Full report for `posture send --dry-run`, `posture on` and the detached send. Scans once if no result is stored. */
+export async function buildPostureReport(env, now = new Date()) {
+    const ioc = readIocResult(env) ?? (await runIocScan({ env, now }));
+    return build(env, ioc, now, true);
+}
+/** Sync preview for the dashboards: no scan, no network. The IoC part is absent until a result is stored. */
+export function previewPosture(env, now = new Date()) {
+    return build(env, readIocResult(env), now, false);
+}
+async function request(method, url, apiKey, body, fetchImpl) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
+    const headers = { Accept: "application/json" };
+    if (body !== undefined)
+        headers["Content-Type"] = "application/json";
+    applyPlaneAuth(headers, apiKey);
+    try {
+        const res = await fetchImpl(url.toString(), {
+            method,
+            headers,
+            body,
+            signal: controller.signal,
+            redirect: "error",
+        });
+        let json;
+        try {
+            json = await res.json();
+        }
+        catch {
+            json = undefined;
+        }
+        return { status: res.status, json };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+const isObj = (v) => v !== null && typeof v === "object";
+/** One send attempt. Never throws. Returns what happened, with a detail that carries no user data. */
+export async function runPostureSend(env, deps = {}) {
+    try {
+        if (!shareOn(env))
+            return { outcome: "off" };
+        const creds = readCredentials(env);
+        if (creds === undefined)
+            return { outcome: "no-credentials", detail: "no hosted login (kya login)" };
+        const base = validateConsoleUrl(creds.baseUrl);
+        const fetchImpl = deps.fetch ?? fetch;
+        const now = deps.now ?? new Date();
+        let state = readPostureState(env);
+        const fresh = state.policy !== undefined &&
+            now.getTime() - Date.parse(state.policy.checkedAt) < POLICY_TTL_MS &&
+            Date.parse(state.policy.checkedAt) <= now.getTime();
+        let enabled;
+        if (fresh && state.policy) {
+            enabled = state.policy.enabled;
+        }
+        else {
+            let res;
+            try {
+                res = await request("GET", new URL(POLICY_PATH, base), creds.apiKey, undefined, fetchImpl);
+            }
+            catch {
+                return { outcome: "policy-unavailable", detail: "network" };
+            }
+            if (res.status !== 200 || !isObj(res.json) || typeof res.json["enabled"] !== "boolean") {
+                return { outcome: "policy-unavailable", detail: `status ${res.status}` };
+            }
+            enabled = res.json["enabled"];
+            writePostureState(env, { ...state, policy: { enabled, checkedAt: now.toISOString() } });
+        }
+        if (!enabled)
+            return { outcome: "policy-disabled" };
+        // The toggle may have been switched off while the policy request was in flight.
+        if (!shareOn(env))
+            return { outcome: "off" };
+        const { report, violations } = await buildPostureReport(env, now);
+        if (violations.length > 0) {
+            return { outcome: "invalid", detail: violations.map((v) => `${v.path || "report"}: ${v.reason}`).join("; ") };
+        }
+        let res;
+        try {
+            res = await request("POST", new URL(REPORT_PATH, base), creds.apiKey, JSON.stringify(report), fetchImpl);
+        }
+        catch {
+            return { outcome: "failed", detail: "network" };
+        }
+        if (res.status === 403) {
+            // Workspace toggle is off: stop until the next daily policy check.
+            state = readPostureState(env);
+            writePostureState(env, { ...state, policy: { enabled: false, checkedAt: now.toISOString() } });
+            return { outcome: "rejected", detail: "workspace has posture sharing off" };
+        }
+        if (res.status >= 200 && res.status < 300) {
+            state = readPostureState(env);
+            writePostureState(env, { ...state, lastSentAt: now.toISOString() });
+            return { outcome: "sent" };
+        }
+        return { outcome: "failed", detail: `status ${res.status}` };
+    }
+    catch {
+        return { outcome: "failed", detail: "internal" };
+    }
+}
+//# sourceMappingURL=send.js.map

package/dist/posture/send.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"send.js","sourceRoot":"","sources":["../../src/posture/send.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,aAAa,EAAkB,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAkB,MAAM,eAAe,CAAC;AAC9E,OAAO,EACL,QAAQ,EACR,cAAc,EACd,gBAAgB,EAChB,OAAO,EACP,iBAAiB,GAClB,MAAM,YAAY,CAAC;AAEpB,MAAM,CAAC,MAAM,WAAW,GAAG,4BAA4B,CAAC;AACxD,MAAM,CAAC,MAAM,WAAW,GAAG,qBAAqB,CAAC;AACjD,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AAC9C,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAsBxC,SAAS,QAAQ;IACf,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,CAAC;QACH,IAAI,GAAG,QAAQ,EAAE,CAAC,QAAQ,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,6CAA6C;IAC/C,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;AACpC,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,GAAG,sCAAsC,CAAC;AAE1D,SAAS,KAAK,CAAC,GAAsB,EAAE,GAA0B,EAAE,GAAS,EAAE,MAAe;IAC3F,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,UAAU,CAAC;IAC/C,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,QAAQ,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,aAAa,CAAC;QAC3B,QAAQ,EAAE,EAAE;QACZ,KAAK,EAAE,cAAc,CAAC,GAAG,EAAE,EAAE,CAAC;QAC9B,GAAG;QACH,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;QAClB,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QAC5G,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,GAAG;QACH,eAAe,EAAE,WAAW,EAAE;aAC3B,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;aAC1F,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QAC1B,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC,KAAK,SAAS;KAC3C,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACxF,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAChC,CAAC;AAED,uHAAuH;AACvH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAsB,EAAE,MAAY,IAAI,IAAI,EAAE;IACrF,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACnE,OAAO,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,cAAc,CAAC,GAAsB,EAAE,MAAY,IAAI,IAAI,EAAE;IAC3E,OAAO,KAAK,CAAC,GAAG,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;AACpD,CAAC;AAOD,KAAK,UAAU,OAAO,CACpB,MAAsB,EACtB,GAAQ,EACR,MAAc,EACd,IAAwB,EACxB,SAAuB;IAEvB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,kBAAkB,CAAC,CAAC;IACvE,MAAM,OAAO,GAA2B,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACvE,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;IACrE,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;YAC1C,MAAM;YACN,OAAO;YACP,IAAI;YACJ,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;QACH,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,GAAG,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IACtC,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,CAAU,EAAgC,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC;AAEhG,sGAAsG;AACtG,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAsB,EACtB,OAA+D,EAAE;IAEjE,IAAI,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;QACrG,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;QACnC,IAAI,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAElC,MAAM,KAAK,GACT,KAAK,CAAC,MAAM,KAAK,SAAS;YAC1B,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,aAAa;YAClE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QACtD,IAAI,OAAgB,CAAC;QACrB,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YAC1B,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,IAAI,GAAS,CAAC;YACd,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,IAAI,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;YAC7F,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,OAAO,EAAE,oBAAoB,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC9D,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,OAAO,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC;gBACvF,OAAO,EAAE,OAAO,EAAE,oBAAoB,EAAE,MAAM,EAAE,UAAU,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3E,CAAC;YACD,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC9B,iBAAiB,CAAC,GAAG,EAAE,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;QACpD,gFAAgF;QAChF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAE7C,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAClE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,QAAQ,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChH,CAAC;QACD,IAAI,GAAS,CAAC;QACd,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,IAAI,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC;QAC3G,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAClD,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,mEAAmE;YACnE,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YAC9B,iBAAiB,CAAC,GAAG,EAAE,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;YAC/F,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC;QAC9E,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAC1C,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YAC9B,iBAAiB,CAAC,GAAG,EAAE,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YACpE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAC7B,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACnD,CAAC;AACH,CAAC"}

package/dist/posture/spawn.d.ts

@@ -0,0 +1,20 @@
+export declare const POSTURE_SEND_INTERVAL_MS: number;
+type SpawnLike = (command: string, args: readonly string[], options: {
+    detached: boolean;
+    stdio: "ignore";
+    env: NodeJS.ProcessEnv;
+    cwd: string;
+    windowsHide: boolean;
+}) => {
+    unref(): void;
+    on(event: "error", listener: () => void): unknown;
+};
+/** Never throws, never waits. Returns whether a send was started. */
+export declare function maybeSpawnPostureSend(deps: {
+    readonly env: NodeJS.ProcessEnv;
+    readonly entry?: string;
+    readonly spawnImpl?: SpawnLike;
+    readonly nowMs?: number;
+}): boolean;
+export {};
+//# sourceMappingURL=spawn.d.ts.map

package/dist/posture/spawn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spawn.d.ts","sourceRoot":"","sources":["../../src/posture/spawn.ts"],"names":[],"mappings":"AAaA,eAAO,MAAM,wBAAwB,QAAmB,CAAC;AAEzD,KAAK,SAAS,GAAG,CACf,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,EAAE;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAE,KACvG;IAAE,KAAK,IAAI,IAAI,CAAC;IAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,OAAO,CAAA;CAAE,CAAC;AAE1E,qEAAqE;AACrE,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAC1C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAiBV"}

package/dist/posture/spawn.js

@@ -0,0 +1,33 @@
+/**
+ * Hook-side start of the daily posture send. Lean on purpose: `kya hook` imports this module and
+ * nothing heavy. With the local toggle off this returns before it claims a slot or spawns
+ * anything. Otherwise it starts `kya posture-send` detached, at most once per 24 h, and never
+ * waits for it. Same shape as ioc/spawn.ts, but the child keeps the caller PATH: host detection
+ * reads PATH directories and never executes anything.
+ */
+import { spawn } from "node:child_process";
+import { isAbsolute } from "node:path";
+import { claimDailySlot } from "../daily-slot.js";
+import { childCwd } from "../ioc/exec.js";
+import { postureStampPath, shareOn } from "./store.js";
+export const POSTURE_SEND_INTERVAL_MS = 24 * 60 * 60_000;
+/** Never throws, never waits. Returns whether a send was started. */
+export function maybeSpawnPostureSend(deps) {
+    try {
+        if (!shareOn(deps.env))
+            return false; // toggle off: no slot, no process
+        const entry = deps.entry ?? process.argv[1];
+        if (entry === undefined || !isAbsolute(entry))
+            return false;
+        if (!claimDailySlot(postureStampPath(deps.env), POSTURE_SEND_INTERVAL_MS, deps.nowMs))
+            return false;
+        const child = (deps.spawnImpl ?? spawn)(process.execPath, [entry, "posture-send"], { detached: true, stdio: "ignore", env: { ...deps.env }, cwd: childCwd(), windowsHide: true });
+        child.on("error", () => undefined);
+        child.unref();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=spawn.js.map

package/dist/posture/spawn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spawn.js","sourceRoot":"","sources":["../../src/posture/spawn.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAEvD,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AAQzD,qEAAqE;AACrE,MAAM,UAAU,qBAAqB,CAAC,IAKrC;IACC,IAAI,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,kCAAkC;QACxE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5C,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5D,IAAI,CAAC,cAAc,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,wBAAwB,EAAE,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACpG,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,SAAS,IAAK,KAA8B,CAAC,CAC/D,OAAO,CAAC,QAAQ,EAChB,CAAC,KAAK,EAAE,cAAc,CAAC,EACvB,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAC9F,CAAC;QACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACnC,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/posture/store.d.ts

@@ -0,0 +1,34 @@
+export interface PostureConfig {
+    /** Local toggle. Default false: nothing is sent until `kya posture on`. */
+    readonly share?: boolean;
+    /** User-chosen label. Absent: the default label is derived from the device id. */
+    readonly label?: string;
+}
+export interface PolicyCache {
+    readonly enabled: boolean;
+    /** When the hosted policy was last read (ISO). Re-read at most once a day. */
+    readonly checkedAt: string;
+}
+export interface PostureState {
+    readonly policy?: PolicyCache;
+    readonly lastSentAt?: string;
+}
+export declare const devicePath: (env: NodeJS.ProcessEnv) => string;
+export declare const postureStatePath: (env: NodeJS.ProcessEnv) => string;
+export declare const postureStampPath: (env: NodeJS.ProcessEnv) => string;
+export declare function readPostureConfig(env: NodeJS.ProcessEnv): PostureConfig;
+/** Sharing is on only when the file says exactly `true`. */
+export declare function shareOn(env: NodeJS.ProcessEnv): boolean;
+/** Merges into ~/.kya/config.json. Other keys (for example `ioc`) are kept as they are. */
+export declare function writePostureConfig(env: NodeJS.ProcessEnv, patch: PostureConfig): void;
+/** The random device id. Created on first use with mode 0600. Not hardware based. */
+export declare function deviceId(env: NodeJS.ProcessEnv, create: boolean): string | undefined;
+/** Default label: first 8 hex of sha256(hostname + deviceId). The hostname itself is never sent. */
+export declare function defaultLabel(id: string, host?: string): string;
+export declare function effectiveLabel(env: NodeJS.ProcessEnv, id: string): string;
+export declare function readPostureState(env: NodeJS.ProcessEnv): PostureState;
+export declare function writePostureState(env: NodeJS.ProcessEnv, state: PostureState): void;
+export declare function hasDeviceFile(env: NodeJS.ProcessEnv): boolean;
+/** Label rules: 1 to 64 characters, no control characters, and nothing the local check forbids (user, host, paths). */
+export declare function labelProblem(label: string, problemOf: (v: string) => string | undefined): string | undefined;
+//# sourceMappingURL=store.d.ts.map

package/dist/posture/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/posture/store.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,aAAa;IAC5B,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,kFAAkF;IAClF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,8EAA8E;IAC9E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAMD,eAAO,MAAM,UAAU,GAAI,KAAK,MAAM,CAAC,UAAU,KAAG,MAAiD,CAAC;AACtG,eAAO,MAAM,gBAAgB,GAAI,KAAK,MAAM,CAAC,UAAU,KAAG,MAA0D,CAAC;AACrH,eAAO,MAAM,gBAAgB,GAAI,KAAK,MAAM,CAAC,UAAU,KAAG,MAA0D,CAAC;AAWrH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,aAAa,CAQvE;AAED,4DAA4D;AAC5D,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAEvD;AAED,2FAA2F;AAC3F,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,aAAa,GAAG,IAAI,CAQrF;AAED,qFAAqF;AACrF,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAapF;AAED,oGAAoG;AACpG,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,GAAE,MAAmB,GAAG,MAAM,CAE1E;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAEzE;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,YAAY,CAYrE;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,YAAY,GAAG,IAAI,CAGnF;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAE7D;AAED,uHAAuH;AACvH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAK5G"}

package/dist/posture/store.js

@@ -0,0 +1,107 @@
+/**
+ * Local state for the developer posture client: the sharing toggle and label (both in
+ * ~/.kya/config.json, key `posture`), the random device id (~/.kya/device-id, 0600) and the
+ * policy cache (~/.kya/posture-state.json). Reads fail closed: a missing or damaged file means
+ * "sharing off", never an error in the caller. Nothing here touches the network.
+ */
+import { randomUUID, createHash } from "node:crypto";
+import { hostname } from "node:os";
+import { existsSync, mkdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { globalConfigDir } from "../config.js";
+import { atomicWriteSecretSync, atomicWriteSync } from "../fs-atomic.js";
+const DEVICE_ID_RE = /^[A-Za-z0-9-]{8,64}$/;
+const LABEL_MAX = 64;
+const configPath = (env) => join(globalConfigDir(env), "config.json");
+export const devicePath = (env) => join(globalConfigDir(env), "device-id");
+export const postureStatePath = (env) => join(globalConfigDir(env), "posture-state.json");
+export const postureStampPath = (env) => join(globalConfigDir(env), "posture-send-stamp");
+function readJsonObject(path) {
+    try {
+        const raw = JSON.parse(readFileSync(path, "utf8"));
+        return raw !== null && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
+    }
+    catch {
+        return {};
+    }
+}
+export function readPostureConfig(env) {
+    const posture = readJsonObject(configPath(env))["posture"];
+    if (posture === null || typeof posture !== "object")
+        return {};
+    const p = posture;
+    return {
+        share: p["share"] === true,
+        label: typeof p["label"] === "string" ? p["label"] : undefined,
+    };
+}
+/** Sharing is on only when the file says exactly `true`. */
+export function shareOn(env) {
+    return readPostureConfig(env).share === true;
+}
+/** Merges into ~/.kya/config.json. Other keys (for example `ioc`) are kept as they are. */
+export function writePostureConfig(env, patch) {
+    const dir = globalConfigDir(env);
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const file = readJsonObject(configPath(env));
+    const merged = { ...readPostureConfig(env), ...patch };
+    const clean = Object.fromEntries(Object.entries(merged).filter(([, v]) => v !== undefined));
+    file["posture"] = clean;
+    atomicWriteSync(configPath(env), `${JSON.stringify(file, null, 2)}\n`);
+}
+/** The random device id. Created on first use with mode 0600. Not hardware based. */
+export function deviceId(env, create) {
+    const path = devicePath(env);
+    try {
+        const raw = readFileSync(path, "utf8").trim();
+        if (DEVICE_ID_RE.test(raw))
+            return raw;
+    }
+    catch {
+        /* missing: create below */
+    }
+    if (!create)
+        return undefined;
+    mkdirSync(globalConfigDir(env), { recursive: true, mode: 0o700 });
+    const id = randomUUID();
+    atomicWriteSecretSync(path, `${id}\n`);
+    return id;
+}
+/** Default label: first 8 hex of sha256(hostname + deviceId). The hostname itself is never sent. */
+export function defaultLabel(id, host = hostname()) {
+    return createHash("sha256").update(host + id).digest("hex").slice(0, 8);
+}
+export function effectiveLabel(env, id) {
+    return readPostureConfig(env).label ?? defaultLabel(id);
+}
+export function readPostureState(env) {
+    const raw = readJsonObject(postureStatePath(env));
+    const out = {};
+    const p = raw["policy"];
+    if (p && typeof p === "object") {
+        const pc = p;
+        if (typeof pc["enabled"] === "boolean" && typeof pc["checkedAt"] === "string") {
+            out.policy = { enabled: pc["enabled"], checkedAt: pc["checkedAt"] };
+        }
+    }
+    if (typeof raw["lastSentAt"] === "string")
+        out.lastSentAt = raw["lastSentAt"];
+    return out;
+}
+export function writePostureState(env, state) {
+    mkdirSync(globalConfigDir(env), { recursive: true, mode: 0o700 });
+    atomicWriteSync(postureStatePath(env), `${JSON.stringify(state, null, 2)}\n`);
+}
+export function hasDeviceFile(env) {
+    return existsSync(devicePath(env));
+}
+/** Label rules: 1 to 64 characters, no control characters, and nothing the local check forbids (user, host, paths). */
+export function labelProblem(label, problemOf) {
+    if (label.length < 1 || label.length > LABEL_MAX)
+        return `label must be 1 to ${LABEL_MAX} characters`;
+    if (/[\u0000-\u001f\u007f]/.test(label))
+        return "label must not contain control characters";
+    const why = problemOf(label);
+    return why === undefined ? undefined : `label must not contain: ${why}`;
+}
+//# sourceMappingURL=store.js.map

package/dist/posture/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/posture/store.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAoBzE,MAAM,YAAY,GAAG,sBAAsB,CAAC;AAC5C,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB,MAAM,UAAU,GAAG,CAAC,GAAsB,EAAU,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC,CAAC;AACjG,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,GAAsB,EAAU,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;AACtG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAsB,EAAU,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,oBAAoB,CAAC,CAAC;AACrH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAsB,EAAU,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,oBAAoB,CAAC,CAAC;AAErH,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAY,CAAC;QAC9D,OAAO,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,GAA+B,CAAC,CAAC,CAAC,EAAE,CAAC;IAChH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAsB;IACtD,MAAM,OAAO,GAAG,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC3D,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAC/D,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,OAAO;QACL,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,IAAI;QAC1B,KAAK,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;KAC/D,CAAC;AACJ,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,OAAO,CAAC,GAAsB;IAC5C,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC;AAC/C,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,kBAAkB,CAAC,GAAsB,EAAE,KAAoB;IAC7E,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACjC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC;IACvD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC;IAC5F,IAAI,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC;IACxB,eAAe,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AACzE,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,QAAQ,CAAC,GAAsB,EAAE,MAAe;IAC9D,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,2BAA2B;IAC7B,CAAC;IACD,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,SAAS,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,qBAAqB,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACvC,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,YAAY,CAAC,EAAU,EAAE,OAAe,QAAQ,EAAE;IAChE,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAsB,EAAE,EAAU;IAC/D,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,YAAY,CAAC,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAsB;IACrD,MAAM,GAAG,GAAG,cAAc,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,MAAM,GAAG,GAAkD,EAAE,CAAC;IAC9D,MAAM,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxB,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,EAAE,GAAG,CAA4B,CAAC;QACxC,IAAI,OAAO,EAAE,CAAC,SAAS,CAAC,KAAK,SAAS,IAAI,OAAO,EAAE,CAAC,WAAW,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC9E,GAAG,CAAC,MAAM,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;QACtE,CAAC;IACH,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,YAAY,CAAC,KAAK,QAAQ;QAAE,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC;IAC9E,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAsB,EAAE,KAAmB;IAC3E,SAAS,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,eAAe,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAsB;IAClD,OAAO,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,uHAAuH;AACvH,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,SAA4C;IACtF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS;QAAE,OAAO,sBAAsB,SAAS,aAAa,CAAC;IACtG,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,2CAA2C,CAAC;IAC5F,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,2BAA2B,GAAG,EAAE,CAAC;AAC1E,CAAC"}