@shield-agent/kya 0.33.6 → 0.35.3

package/amp/settings.example.json

@@ -2,7 +2,7 @@
   "amp.mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.33.6", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.35.3", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "https://shield-agent.com",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/assets/screenshot-features.json

@@ -0,0 +1,18 @@
+{
+  "$comment": "Links every screenshot, video or demo listed in channel-copy.json to the features.json ids it shows. Rule R9 of scripts/check-feature-coverage.mjs: a PR that changes one of these feature rows must retake the picture, or add stillValid.<id> = { rowSha, note } here (rowSha is printed by the failing check). Docs: docs/operations/kya-published-refs.md in the monorepo.",
+  "screenshots": {
+    "assets/logo.svg": { "features": [] },
+    "assets/activity-receipt.png": { "features": ["kya-receipt"] },
+    "assets/report-activity.png": { "features": ["kya-receipt"] },
+    "assets/report-blocked.png": { "features": ["kya-start", "kya-receipt"] },
+    "assets/report-certify.png": { "features": ["kya-certify", "kya-receipt"] },
+    "assets/report-changes.png": { "features": ["kya-diff-preview", "kya-receipt"] },
+    "assets/report-gateway-backends.png": { "features": ["kya-gate"] },
+    "assets/report-gateway-listeners.png": { "features": ["kya-gate"] },
+    "assets/report-gateway-playground.png": { "features": ["kya-gate"] },
+    "assets/report-gateway-policies.png": { "features": ["kya-gate", "kya-gate-deny"] },
+    "assets/report-gateway-routes.png": { "features": ["kya-gate"] },
+    "assets/report-gateway.png": { "features": ["kya-gate"] },
+    "assets/report-overview.png": { "features": ["kya-receipt", "kya-certify"] }
+  }
+}

package/claude/claude_desktop_config.example.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.33.6", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.35.3", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "https://shield-agent.com",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/cline/cline_mcp_settings.example.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.33.6", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.35.3", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "https://shield-agent.com",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/copilot/mcp-config.example.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.33.6", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.35.3", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "https://shield-agent.com",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/dist/alerts/config.d.ts

@@ -0,0 +1,22 @@
+import type { Severity } from "../investigate/detectors.js";
+export declare const SEVERITIES: readonly Severity[];
+export declare const DEFAULT_MIN_SEVERITY: Severity;
+export declare const DEFAULT_WINDOW_MINUTES = 120;
+/** Upper bound so a typo cannot make every flush read a huge window. */
+export declare const MAX_WINDOW_MINUTES: number;
+export interface AlertsConfig {
+    readonly enabled: boolean;
+    readonly minSeverity: Severity;
+    readonly windowMinutes: number;
+    /** Desktop notification for each new incident alert. `alerts.desktop: false` or KYA_ALERTS_DESKTOP=off turns it off. */
+    readonly desktop: boolean;
+    /** Where `enabled` came from. */
+    readonly source: "env" | "config" | "default";
+}
+export declare function severityRank(s: Severity): number;
+export declare function isSeverity(v: unknown): v is Severity;
+/** The user-level `alerts` object, defensively parsed. Never throws. */
+export declare function resolveAlertsConfig(env?: NodeJS.ProcessEnv): AlertsConfig;
+/** `kya alerts on|off`: write `alerts.enabled` to the user-level config, keep the other keys. */
+export declare function writeAlertsEnabled(env: NodeJS.ProcessEnv, enabled: boolean): void;
+//# sourceMappingURL=config.d.ts.map

package/dist/alerts/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/alerts/config.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAE5D,eAAO,MAAM,UAAU,EAAE,SAAS,QAAQ,EAA0C,CAAC;AACrF,eAAO,MAAM,oBAAoB,EAAE,QAAiB,CAAC;AACrD,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAC1C,wEAAwE;AACxE,eAAO,MAAM,kBAAkB,QAAc,CAAC;AAE9C,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,wHAAwH;IACxH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,iCAAiC;IACjC,QAAQ,CAAC,MAAM,EAAE,KAAK,GAAG,QAAQ,GAAG,SAAS,CAAC;CAC/C;AAED,wBAAgB,YAAY,CAAC,CAAC,EAAE,QAAQ,GAAG,MAAM,CAEhD;AAED,wBAAgB,UAAU,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,QAAQ,CAEpD;AAUD,wEAAwE;AACxE,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,YAAY,CAqBtF;AAED,iGAAiG;AACjG,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAKjF"}

package/dist/alerts/config.js

@@ -0,0 +1,59 @@
+/**
+ * Incident alert settings. User level only: they come from <KYA_HOME|home>/.kya/config.json
+ * and the KYA_ALERTS env switch. A project `.kya/config.json` is never read here, so a repo
+ * cannot turn alerts off, lower the floor, or add a receiver. Advisory: local KYA never blocks on this.
+ */
+import { kyaHome, readFileConfig, writeFileConfig } from "../config.js";
+export const SEVERITIES = ["low", "medium", "high", "critical"];
+export const DEFAULT_MIN_SEVERITY = "high";
+export const DEFAULT_WINDOW_MINUTES = 120;
+/** Upper bound so a typo cannot make every flush read a huge window. */
+export const MAX_WINDOW_MINUTES = 7 * 24 * 60;
+export function severityRank(s) {
+    return SEVERITIES.indexOf(s);
+}
+export function isSeverity(v) {
+    return typeof v === "string" && SEVERITIES.includes(v);
+}
+/** KYA_ALERTS=on|off (also 1/true, 0/false). Anything else: no override. */
+function envSwitch(env) {
+    const v = env.KYA_ALERTS?.trim().toLowerCase();
+    if (v === "on" || v === "1" || v === "true")
+        return true;
+    if (v === "off" || v === "0" || v === "false")
+        return false;
+    return undefined;
+}
+/** The user-level `alerts` object, defensively parsed. Never throws. */
+export function resolveAlertsConfig(env = process.env) {
+    let raw = {};
+    try {
+        const a = readFileConfig(kyaHome(env)).alerts;
+        if (a && typeof a === "object" && !Array.isArray(a))
+            raw = a;
+    }
+    catch {
+        /* unreadable config: defaults */
+    }
+    const minSeverity = isSeverity(raw["minSeverity"]) ? raw["minSeverity"] : DEFAULT_MIN_SEVERITY;
+    const w = raw["windowMinutes"];
+    const windowMinutes = typeof w === "number" && Number.isFinite(w) && w > 0
+        ? Math.min(Math.floor(w), MAX_WINDOW_MINUTES)
+        : DEFAULT_WINDOW_MINUTES;
+    const desktop = raw["desktop"] !== false && !/^(off|0|false)$/i.test(env.KYA_ALERTS_DESKTOP?.trim() ?? "");
+    const override = envSwitch(env);
+    if (override !== undefined)
+        return { enabled: override, minSeverity, windowMinutes, desktop, source: "env" };
+    if (typeof raw["enabled"] === "boolean") {
+        return { enabled: raw["enabled"], minSeverity, windowMinutes, desktop, source: "config" };
+    }
+    return { enabled: false, minSeverity, windowMinutes, desktop, source: "default" };
+}
+/** `kya alerts on|off`: write `alerts.enabled` to the user-level config, keep the other keys. */
+export function writeAlertsEnabled(env, enabled) {
+    const home = kyaHome(env);
+    const prev = readFileConfig(home).alerts;
+    const base = prev && typeof prev === "object" && !Array.isArray(prev) ? prev : {};
+    writeFileConfig(home, { alerts: { ...base, enabled } });
+}
+//# sourceMappingURL=config.js.map

package/dist/alerts/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/alerts/config.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAGxE,MAAM,CAAC,MAAM,UAAU,GAAwB,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;AACrF,MAAM,CAAC,MAAM,oBAAoB,GAAa,MAAM,CAAC;AACrD,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAC1C,wEAAwE;AACxE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;AAY9C,MAAM,UAAU,YAAY,CAAC,CAAW;IACtC,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,CAAU;IACnC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAK,UAAgC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,4EAA4E;AAC5E,SAAS,SAAS,CAAC,GAAsB;IACvC,MAAM,CAAC,GAAG,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACzD,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAC5D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,mBAAmB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACtE,IAAI,GAAG,GAA4B,EAAE,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,CAAC,GAAI,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAA0B,CAAC,MAAM,CAAC;QACxE,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,GAAG,GAAG,CAA4B,CAAC;IAC1F,CAAC;IAAC,MAAM,CAAC;QACP,iCAAiC;IACnC,CAAC;IACD,MAAM,WAAW,GAAG,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC;IAC/F,MAAM,CAAC,GAAG,GAAG,CAAC,eAAe,CAAC,CAAC;IAC/B,MAAM,aAAa,GACjB,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAClD,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,kBAAkB,CAAC;QAC7C,CAAC,CAAC,sBAAsB,CAAC;IAC7B,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,KAAK,KAAK,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3G,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC7G,IAAI,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC5F,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACpF,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,kBAAkB,CAAC,GAAsB,EAAE,OAAgB;IACzE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAI,cAAc,CAAC,IAAI,CAA0B,CAAC,MAAM,CAAC;IACnE,MAAM,IAAI,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAgC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/G,eAAe,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,EAAW,CAAC,CAAC;AACnE,CAAC"}

package/dist/alerts/constants.d.ts

@@ -0,0 +1,5 @@
+/** Light constants shared by the hook path (notify) and the alert modules. No imports on purpose. */
+export declare const INCIDENT_EVENT = "incident.opened";
+export declare const INCIDENT_KIND = "kya.incident.opened";
+export declare const ADVISORY_LINE = "Local KYA is advisory.";
+//# sourceMappingURL=constants.d.ts.map

package/dist/alerts/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/alerts/constants.ts"],"names":[],"mappings":"AAAA,qGAAqG;AACrG,eAAO,MAAM,cAAc,oBAAoB,CAAC;AAChD,eAAO,MAAM,aAAa,wBAAwB,CAAC;AACnD,eAAO,MAAM,aAAa,2BAA2B,CAAC"}

package/dist/alerts/constants.js

@@ -0,0 +1,5 @@
+/** Light constants shared by the hook path (notify) and the alert modules. No imports on purpose. */
+export const INCIDENT_EVENT = "incident.opened";
+export const INCIDENT_KIND = "kya.incident.opened";
+export const ADVISORY_LINE = "Local KYA is advisory.";
+//# sourceMappingURL=constants.js.map

package/dist/alerts/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/alerts/constants.ts"],"names":[],"mappings":"AAAA,qGAAqG;AACrG,MAAM,CAAC,MAAM,cAAc,GAAG,iBAAiB,CAAC;AAChD,MAAM,CAAC,MAAM,aAAa,GAAG,qBAAqB,CAAC;AACnD,MAAM,CAAC,MAAM,aAAa,GAAG,wBAAwB,CAAC"}

package/dist/alerts/desktop.d.ts

@@ -0,0 +1,19 @@
+import type { IncidentAlert } from "./incident-alert.js";
+export declare const DESKTOP_TITLE = "KYA security alert";
+export interface DesktopCommand {
+    readonly file: string;
+    readonly args: readonly string[];
+    readonly env?: Readonly<Record<string, string>>;
+}
+export declare function desktopCommand(platform: NodeJS.Platform, title: string, body: string): DesktopCommand | undefined;
+/** `severity: <level>. Detectors: <ids>.` Only fixed words and safe ids. */
+export declare function desktopBody(alert: Pick<IncidentAlert, "severity" | "detectorIds" | "test">): string;
+export type DesktopRunner = (cmd: DesktopCommand, env: NodeJS.ProcessEnv) => Promise<boolean>;
+export interface DesktopDeps {
+    /** Test seam: the platform. */
+    readonly platform?: NodeJS.Platform;
+    /** Test seam: runs the command. */
+    readonly run?: DesktopRunner;
+}
+export declare function desktopNotify(alert: IncidentAlert, env: NodeJS.ProcessEnv, deps?: DesktopDeps): Promise<boolean>;
+//# sourceMappingURL=desktop.d.ts.map

package/dist/alerts/desktop.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"desktop.d.ts","sourceRoot":"","sources":["../../src/alerts/desktop.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,eAAO,MAAM,aAAa,uBAAuB,CAAC;AAalD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACjD;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAejH;AAED,4EAA4E;AAC5E,wBAAgB,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,UAAU,GAAG,aAAa,GAAG,MAAM,CAAC,GAAG,MAAM,CAInG;AAED,MAAM,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAY9F,MAAM,WAAW,WAAW;IAC1B,+BAA+B;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IACpC,mCAAmC;IACnC,QAAQ,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC;CAC9B;AAED,wBAAsB,aAAa,CAAC,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,CAQ1H"}

package/dist/alerts/desktop.js

@@ -0,0 +1,57 @@
+/**
+ * Desktop notification for a new incident alert. macOS: osascript. Linux: notify-send when it exists.
+ * Windows: a PowerShell toast. The text is static: a fixed title, the severity and the detector ids
+ * (ids pass the safe-id check in triage-input.ts). No summary, tool name or path from the trail is shown.
+ * Arguments go to the program as argv (execFile, no shell). Windows reads the text from two environment
+ * variables, because PowerShell has no argv-safe way to pass text to a script block.
+ * Advisory and fail open: a missing notifier or a failure returns false and changes nothing else.
+ */
+import { execFile } from "node:child_process";
+export const DESKTOP_TITLE = "KYA security alert";
+const TIMEOUT_MS = 5_000;
+const OSA_SCRIPT = ["on run argv", "display notification (item 1 of argv) with title (item 2 of argv)", "end run"];
+const WIN_SCRIPT = [
+    "[Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null",
+    "$x = [Windows.UI.Notifications.ToastNotificationManager]::GetTemplateContent([Windows.UI.Notifications.ToastTemplateType]::ToastText02)",
+    "$t = $x.GetElementsByTagName('text')",
+    "$t.Item(0).AppendChild($x.CreateTextNode($env:KYA_TOAST_TITLE)) | Out-Null",
+    "$t.Item(1).AppendChild($x.CreateTextNode($env:KYA_TOAST_BODY)) | Out-Null",
+    "[Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier('KYA').Show([Windows.UI.Notifications.ToastNotification]::new($x))",
+].join("; ");
+export function desktopCommand(platform, title, body) {
+    switch (platform) {
+        case "darwin":
+            return { file: "osascript", args: [...OSA_SCRIPT.flatMap((l) => ["-e", l]), body, title] };
+        case "linux":
+            return { file: "notify-send", args: ["--app-name", "KYA", "--", title, body] };
+        case "win32":
+            return {
+                file: "powershell.exe",
+                args: ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-Command", WIN_SCRIPT],
+                env: { KYA_TOAST_TITLE: title, KYA_TOAST_BODY: body },
+            };
+        default:
+            return undefined;
+    }
+}
+/** `severity: <level>. Detectors: <ids>.` Only fixed words and safe ids. */
+export function desktopBody(alert) {
+    const safe = alert.detectorIds.filter((d) => /^[a-z0-9-]{1,40}$/.test(d));
+    const ids = safe.length > 0 ? safe.join(", ") : "none";
+    return `${alert.test ? "Test. " : ""}Severity: ${alert.severity}. Detectors: ${ids}. Open kya report.`;
+}
+const defaultRun = (cmd, env) => new Promise((resolve) => {
+    execFile(cmd.file, [...cmd.args], { env: { ...env, ...cmd.env }, timeout: TIMEOUT_MS, windowsHide: true, shell: false }, (err) => resolve(!err));
+});
+export async function desktopNotify(alert, env, deps = {}) {
+    try {
+        const cmd = desktopCommand(deps.platform ?? process.platform, DESKTOP_TITLE, desktopBody(alert));
+        if (!cmd)
+            return false;
+        return await (deps.run ?? defaultRun)(cmd, env);
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=desktop.js.map

package/dist/alerts/desktop.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"desktop.js","sourceRoot":"","sources":["../../src/alerts/desktop.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAG9C,MAAM,CAAC,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAClD,MAAM,UAAU,GAAG,KAAK,CAAC;AAEzB,MAAM,UAAU,GAAG,CAAC,aAAa,EAAE,mEAAmE,EAAE,SAAS,CAAC,CAAC;AACnH,MAAM,UAAU,GAAG;IACjB,wHAAwH;IACxH,yIAAyI;IACzI,sCAAsC;IACtC,4EAA4E;IAC5E,2EAA2E;IAC3E,6IAA6I;CAC9I,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAQb,MAAM,UAAU,cAAc,CAAC,QAAyB,EAAE,KAAa,EAAE,IAAY;IACnF,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;QAC7F,KAAK,OAAO;YACV,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;QACjF,KAAK,OAAO;YACV,OAAO;gBACL,IAAI,EAAE,gBAAgB;gBACtB,IAAI,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC;gBAC7F,GAAG,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE;aACtD,CAAC;QACJ;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,WAAW,CAAC,KAA+D;IACzF,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACvD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,aAAa,KAAK,CAAC,QAAQ,gBAAgB,GAAG,oBAAoB,CAAC;AACzG,CAAC;AAID,MAAM,UAAU,GAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAC7C,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;IACtB,QAAQ,CACN,GAAG,CAAC,IAAI,EACR,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,EACb,EAAE,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE,GAAG,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,EACrF,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CACvB,CAAC;AACJ,CAAC,CAAC,CAAC;AASL,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAoB,EAAE,GAAsB,EAAE,OAAoB,EAAE;IACtG,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;QACjG,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QACvB,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/alerts/incident-alert.d.ts

@@ -0,0 +1,42 @@
+/**
+ * The alert body for one detected incident. Built from the privacy-safe triage input (redacted,
+ * clipped summaries, counts, detector ids) and static detector text. The incident id, title and
+ * fix brief header can hold a session id or a raw tool key, so none of them is copied here.
+ * No raw args, argument hashes, target paths, diff previews, session ids or home folders.
+ */
+import type { Severity } from "../investigate/detectors.js";
+import { type Incident } from "../investigate/index.js";
+import type { TrailEvent } from "../trail.js";
+import type { IncidentTriage } from "./triage-model.js";
+export { ADVISORY_LINE, INCIDENT_EVENT, INCIDENT_KIND } from "./constants.js";
+export declare const MAX_ALERT_SUMMARIES = 3;
+export interface IncidentAlert {
+    readonly ref: string;
+    readonly title: string;
+    readonly severity: Severity;
+    readonly detectorIds: readonly string[];
+    readonly findingCount: number;
+    /** Verdict counts; absent when the triage input was not available. */
+    readonly counts?: {
+        readonly allow: number;
+        readonly hold: number;
+        readonly deny: number;
+    };
+    readonly firstTs: string;
+    readonly lastTs: string;
+    readonly tools: readonly string[];
+    readonly summaries: readonly string[];
+    /** First step of the suggested change, static text per detector. Empty when none. */
+    readonly fix: string;
+    /** Local model triage (optional, advisory). Absent when the model is not installed or failed. Never changes severity. */
+    readonly triage?: IncidentTriage;
+    readonly advisory: string;
+    readonly test: boolean;
+}
+/** First non-empty line under "## Suggested change" in a fix brief (static detector text). */
+export declare function fixBriefFirstLine(brief: string | undefined): string;
+export declare function incidentTitle(detectorIds: readonly string[]): string;
+export declare function buildIncidentAlert(incident: Incident, events: readonly TrailEvent[], brief?: string): IncidentAlert;
+/** The synthetic incident `kya alerts test` sends. Marked as a test in the title and the `test` flag. */
+export declare function buildTestIncidentAlert(now?: Date): IncidentAlert;
+//# sourceMappingURL=incident-alert.d.ts.map

package/dist/alerts/incident-alert.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"incident-alert.d.ts","sourceRoot":"","sources":["../../src/alerts/incident-alert.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAkC,KAAK,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACxF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAG9C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAIxD,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC9E,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,sEAAsE;IACtE,QAAQ,CAAC,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3F,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,qFAAqF;IACrF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,yHAAyH;IACzH,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB;AAED,8FAA8F;AAC9F,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAWnE;AAED,wBAAgB,aAAa,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAWpE;AAED,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,SAAS,UAAU,EAAE,EAC7B,KAAK,CAAC,EAAE,MAAM,GACb,aAAa,CA2Bf;AAED,yGAAyG;AACzG,wBAAgB,sBAAsB,CAAC,GAAG,GAAE,IAAiB,GAAG,aAAa,CAiB5E"}

package/dist/alerts/incident-alert.js

@@ -0,0 +1,84 @@
+import { detectorTitle } from "../investigate/index.js";
+import { buildTriageInput } from "./triage-input.js";
+import { incidentRef } from "./state.js";
+import { ADVISORY_LINE } from "./constants.js";
+export { ADVISORY_LINE, INCIDENT_EVENT, INCIDENT_KIND } from "./constants.js";
+export const MAX_ALERT_SUMMARIES = 3;
+/** First non-empty line under "## Suggested change" in a fix brief (static detector text). */
+export function fixBriefFirstLine(brief) {
+    if (!brief)
+        return "";
+    const lines = brief.split("\n");
+    const at = lines.findIndex((l) => l.trim() === "## Suggested change");
+    if (at === -1)
+        return "";
+    for (const line of lines.slice(at + 1)) {
+        const t = line.trim();
+        if (t.startsWith("## "))
+            return "";
+        if (t)
+            return t.slice(0, 240);
+    }
+    return "";
+}
+export function incidentTitle(detectorIds) {
+    const first = detectorIds[0];
+    let name = "Security incident";
+    if (first !== undefined) {
+        try {
+            name = detectorTitle(first) ?? name;
+        }
+        catch {
+            /* unknown id: generic name */
+        }
+    }
+    return `KYA incident: ${name}`;
+}
+export function buildIncidentAlert(incident, events, brief) {
+    // The builder may return nothing or a reduced input when its secret check trips: then send the minimum.
+    let triage;
+    try {
+        triage = buildTriageInput(incident, events);
+    }
+    catch {
+        triage = null;
+    }
+    const detectorIds = triage && triage.detectorIds.length > 0
+        ? [...triage.detectorIds]
+        : [...new Set(incident.findings.map((f) => f.detectorId))].sort();
+    return {
+        ref: incidentRef(incident.id),
+        title: incidentTitle(detectorIds),
+        severity: incident.severity,
+        detectorIds,
+        findingCount: incident.findingCount,
+        ...(triage ? { counts: { ...triage.counts } } : {}),
+        firstTs: incident.firstTs,
+        lastTs: incident.lastTs,
+        tools: triage ? triage.toolIds.slice(0, MAX_ALERT_SUMMARIES) : [],
+        summaries: triage ? triage.summaries.slice(0, MAX_ALERT_SUMMARIES) : [],
+        fix: fixBriefFirstLine(brief),
+        advisory: ADVISORY_LINE,
+        test: false,
+    };
+}
+/** The synthetic incident `kya alerts test` sends. Marked as a test in the title and the `test` flag. */
+export function buildTestIncidentAlert(now = new Date()) {
+    const ts = now.toISOString();
+    return {
+        ref: "test",
+        title: "[TEST] KYA incident: Never-list tool attempted repeatedly",
+        severity: "high",
+        detectorIds: ["never-repeat"],
+        findingCount: 1,
+        counts: { allow: 0, hold: 0, deny: 3 },
+        firstTs: ts,
+        lastTs: ts,
+        tools: ["kya.test"],
+        summaries: ["This is a test alert from kya alerts test. No action needed."],
+        fix: "This is a test. Nothing happened on your machine.",
+        advisory: ADVISORY_LINE,
+        test: true,
+    };
+}
+//# sourceMappingURL=incident-alert.js.map

package/dist/alerts/incident-alert.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"incident-alert.js","sourceRoot":"","sources":["../../src/alerts/incident-alert.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,aAAa,EAAkC,MAAM,yBAAyB,CAAC;AAExF,OAAO,EAAE,gBAAgB,EAAoB,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAGzC,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC9E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAsBrC,8FAA8F;AAC9F,MAAM,UAAU,iBAAiB,CAAC,KAAyB;IACzD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,qBAAqB,CAAC,CAAC;IACtE,IAAI,EAAE,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACnC,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,WAA8B;IAC1D,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAA2B,CAAC;IACvD,IAAI,IAAI,GAAG,mBAAmB,CAAC;IAC/B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,8BAA8B;QAChC,CAAC;IACH,CAAC;IACD,OAAO,iBAAiB,IAAI,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,QAAkB,EAClB,MAA6B,EAC7B,KAAc;IAEd,wGAAwG;IACxG,IAAI,MAAsC,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,GAAG,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAuB,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,WAAW,GACf,MAAM,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;QACrC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC;QACzB,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAoB,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAChF,OAAO;QACL,GAAG,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,KAAK,EAAE,aAAa,CAAC,WAAW,CAAC;QACjC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,WAAW;QACX,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,EAAE;QACjE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,EAAE;QACvE,GAAG,EAAE,iBAAiB,CAAC,KAAK,CAAC;QAC7B,QAAQ,EAAE,aAAa;QACvB,IAAI,EAAE,KAAK;KACZ,CAAC;AACJ,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,sBAAsB,CAAC,MAAY,IAAI,IAAI,EAAE;IAC3D,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAC7B,OAAO;QACL,GAAG,EAAE,MAAM;QACX,KAAK,EAAE,2DAA2D;QAClE,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,CAAC,cAAc,CAAC;QAC7B,YAAY,EAAE,CAAC;QACf,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE;QACtC,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,EAAE;QACV,KAAK,EAAE,CAAC,UAAU,CAAC;QACnB,SAAS,EAAE,CAAC,8DAA8D,CAAC;QAC3E,GAAG,EAAE,mDAAmD;QACxD,QAAQ,EAAE,aAAa;QACvB,IAAI,EAAE,IAAI;KACX,CAAC;AACJ,CAAC"}

package/dist/alerts/scan.d.ts

@@ -0,0 +1,37 @@
+import { type Incident, type Severity } from "../investigate/index.js";
+import type { NotifyDeps } from "../notify/sender.js";
+import { type TrailEvent } from "../trail.js";
+import { type DesktopDeps } from "./desktop.js";
+import { type IncidentAlert } from "./incident-alert.js";
+import { type TriageInput } from "./triage-input.js";
+import type { IncidentTriage } from "./triage-model.js";
+export interface AlertScanDeps extends NotifyDeps {
+    /** Test seam: the clock. */
+    readonly now?: () => Date;
+    /** Test seam: triage of one incident input. Default: the local model when it is installed. */
+    readonly triage?: (input: TriageInput) => Promise<IncidentTriage | undefined>;
+    /** Test seam: the desktop notifier. */
+    readonly desktop?: DesktopDeps;
+    /** Test seam: shorter triage timeout. */
+    readonly triageTimeoutMs?: number;
+}
+export interface AlertScanResult {
+    /** Incidents that passed the floor and the dedupe check and were sent. */
+    readonly alerted: readonly IncidentAlert[];
+    readonly delivered: number;
+}
+/** Model load plus one inference. Longer than this and the alert goes out without triage. */
+export declare const TRIAGE_TIMEOUT_MS = 8000;
+/** One scan opens at most this many desktop notifications (an incident storm must not flood the screen). */
+export declare const MAX_DESKTOP_PER_SCAN = 3;
+/** Events may be at most this far in the future (clock skew). Later ones are forged or broken. */
+export declare const MAX_FUTURE_MS: number;
+/** Events inside the window. A ts that does not parse, or lies more than 5 minutes ahead, is dropped. */
+export declare function windowEvents(events: readonly TrailEvent[], now: Date, windowMinutes: number): TrailEvent[];
+/** Pure core: events in, incidents at or above the floor out. */
+export declare function incidentsAboveFloor(events: readonly TrailEvent[], minSeverity: Severity): {
+    incidents: Incident[];
+    briefs: ReadonlyMap<string, string>;
+};
+export declare function runAlertScan(_cwd: string, env: NodeJS.ProcessEnv, deps?: AlertScanDeps): Promise<AlertScanResult>;
+//# sourceMappingURL=scan.d.ts.map

package/dist/alerts/scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../../src/alerts/scan.ts"],"names":[],"mappings":"AAaA,OAAO,EAAoB,KAAK,QAAQ,EAAE,KAAK,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAEzF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAmB,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAE/D,OAAO,EAAiB,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAsB,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAS7E,OAAO,EAAoB,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGxD,MAAM,WAAW,aAAc,SAAQ,UAAU;IAC/C,4BAA4B;IAC5B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B,8FAA8F;IAC9F,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAC9E,uCAAuC;IACvC,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC;IAC/B,yCAAyC;IACzC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,eAAe;IAC9B,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,CAAC;IAC3C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAID,6FAA6F;AAC7F,eAAO,MAAM,iBAAiB,OAAQ,CAAC;AACvC,4GAA4G;AAC5G,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAmDtC,kGAAkG;AAClG,eAAO,MAAM,aAAa,QAAa,CAAC;AAExC,yGAAyG;AACzG,wBAAgB,YAAY,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,GAAG,UAAU,EAAE,CAO1G;AAED,iEAAiE;AACjE,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,SAAS,UAAU,EAAE,EAC7B,WAAW,EAAE,QAAQ,GACpB;IAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;IAAC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAMhE;AAeD,wBAAsB,YAAY,CAChC,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,eAAe,CAAC,CAgF1B"}