@1claw/mcp 0.11.0 → 0.13.0

package/README.md

@@ -151,3 +151,28 @@ pnpm inspect
 - **Token scoping.** Use the 1claw dashboard to create agent tokens with the minimum permissions needed. Restrict by vault, path prefix, or action.
 - **No hardcoded credentials.** All auth is via environment variables (stdio) or headers (httpStream).
 - **410/404 handling.** Expired or missing secrets surface clear error messages rather than raw HTTP codes.
+
+### Security inspection pipeline
+
+All tool calls pass through an inspection pipeline before execution and after results are returned. The pipeline runs by default and is configurable via environment variables.
+
+**Input inspection** (before tool execution):
+1. **Unicode normalization** — Strips zero-width characters, replaces Cyrillic/Greek homoglyphs.
+2. **Threat detection** — Command injection, encoding obfuscation, social engineering, network threats.
+3. **PII detection** — Emails, SSNs, credit card numbers, phone numbers, AWS keys, private key headers.
+4. **Exfiltration protection** — Blocks or warns when a previously fetched secret value appears in a non-secret tool's input (e.g., an agent trying to send a secret to an external URL).
+
+**Output inspection** (after tool execution):
+1. **Threat detection** — Same patterns as input.
+2. **PII detection** — Same patterns as input.
+3. **Secret redaction** — Tracks every secret value fetched via `get_secret` or `get_env_bundle`. If a known secret appears in the output of a non-secret tool (e.g., `list_vaults`, `grant_access`), the value is replaced with `[REDACTED:path]` before it reaches the LLM context window.
+
+### Security environment variables
+
+| Variable                           | Default  | Description                                                                                      |
+| ---------------------------------- | -------- | ------------------------------------------------------------------------------------------------ |
+| `ONECLAW_MCP_SECURITY_ENABLED`     | `true`   | Master switch. Set to `false` to disable all inspection.                                         |
+| `ONECLAW_MCP_SANITIZATION_MODE`    | `block`  | `block` rejects critical/high threats; `surgical` normalizes Unicode but allows; `log_only` only logs. |
+| `ONECLAW_MCP_REDACT_SECRETS`       | `true`   | Redact known secret values from non-secret tool outputs. Requires security enabled.              |
+| `ONECLAW_MCP_PII_DETECTION`        | `true`   | Detect PII patterns (emails, SSNs, credit cards, etc.) in inputs and outputs.                    |
+| `ONECLAW_MCP_EXFIL_PROTECTION`     | `warn`   | `block` rejects tool inputs containing known secrets; `warn` logs but allows; `off` disables.    |

package/dist/__tests__/security.test.js

@@ -1,5 +1,5 @@
 import { describe, it, expect, beforeEach, afterEach } from "vitest";
-import { inspectInput, inspectOutput, normalizeUnicode, isSecurityEnabled, getSanitizationMode, } from "../security/index.js";
+import { inspectInput, inspectOutput, normalizeUnicode, isSecurityEnabled, getSanitizationMode, isSecretRedactionEnabled, isPiiDetectionEnabled, getExfilProtectionMode, registerSecret, clearSecrets, trackedSecretCount, } from "../security/index.js";
 describe("Security Module", () => {
     let originalEnv;
     beforeEach(() => {
@@ -193,7 +193,6 @@ describe("Security Module", () => {
     describe("inspectOutput", () => {
         it("detects threats in output", () => {
             const result = inspectOutput("test_tool", "Your API key is sk-12345");
-            // Output inspection logs but doesn't block
             expect(result.passed).toBe(true);
         });
         it("skips inspection when disabled", () => {
@@ -202,5 +201,142 @@ describe("Security Module", () => {
             expect(result.threats).toHaveLength(0);
         });
     });
+    describe("PII detection", () => {
+        it("detects email addresses in input", () => {
+            const result = inspectInput("test_tool", {
+                message: "Contact alice@example.com",
+            });
+            expect(result.threats.some((t) => t.pattern === "email")).toBe(true);
+        });
+        it("detects SSN in input", () => {
+            const result = inspectInput("test_tool", {
+                data: "SSN: 123-45-6789",
+            });
+            expect(result.threats.some((t) => t.pattern === "ssn")).toBe(true);
+        });
+        it("detects credit card numbers in input", () => {
+            const result = inspectInput("test_tool", {
+                card: "4111-1111-1111-1111",
+            });
+            expect(result.threats.some((t) => t.pattern === "credit_card")).toBe(true);
+        });
+        it("detects AWS access keys", () => {
+            const result = inspectInput("test_tool", {
+                key: "AKIAIOSFODNN7EXAMPLE",
+            });
+            expect(result.threats.some((t) => t.pattern === "aws_key")).toBe(true);
+        });
+        it("detects private key headers", () => {
+            const result = inspectInput("test_tool", {
+                key: "-----BEGIN RSA PRIVATE KEY-----",
+            });
+            expect(result.threats.some((t) => t.pattern === "private_key_header")).toBe(true);
+        });
+        it("detects PII in output", () => {
+            const result = inspectOutput("test_tool", "User email: alice@example.com");
+            expect(result.threats.some((t) => t.pattern === "email")).toBe(true);
+        });
+        it("skips PII detection when disabled", () => {
+            process.env.ONECLAW_MCP_PII_DETECTION = "false";
+            const result = inspectInput("test_tool", {
+                data: "SSN: 123-45-6789",
+            });
+            expect(result.threats.some((t) => t.type === "pii")).toBe(false);
+        });
+    });
+    describe("secret redaction", () => {
+        beforeEach(() => {
+            clearSecrets();
+        });
+        it("registers and counts secrets", () => {
+            registerSecret("api-keys/stripe", "sk_live_abc123def456");
+            expect(trackedSecretCount()).toBe(1);
+        });
+        it("ignores short values", () => {
+            registerSecret("short", "abc");
+            expect(trackedSecretCount()).toBe(0);
+        });
+        it("redacts known secret from non-secret tool output", () => {
+            registerSecret("api-keys/stripe", "sk_live_abc123def456");
+            const result = inspectOutput("list_vaults", "Found key: sk_live_abc123def456");
+            expect(result.redacted).toBe("Found key: [REDACTED:api-keys/stripe]");
+            expect(result.threats.some((t) => t.type === "secret_leak")).toBe(true);
+        });
+        it("does not redact get_secret output", () => {
+            registerSecret("api-keys/stripe", "sk_live_abc123def456");
+            const result = inspectOutput("get_secret", '{"value":"sk_live_abc123def456"}');
+            expect(result.redacted).toBeUndefined();
+        });
+        it("does not redact when feature is disabled", () => {
+            process.env.ONECLAW_MCP_REDACT_SECRETS = "false";
+            registerSecret("api-keys/stripe", "sk_live_abc123def456");
+            const result = inspectOutput("list_vaults", "Found key: sk_live_abc123def456");
+            expect(result.redacted).toBeUndefined();
+        });
+        it("clears secrets", () => {
+            registerSecret("api-keys/stripe", "sk_live_abc123def456");
+            clearSecrets();
+            expect(trackedSecretCount()).toBe(0);
+        });
+    });
+    describe("exfiltration protection", () => {
+        beforeEach(() => {
+            clearSecrets();
+            registerSecret("api-keys/stripe", "sk_live_abc123def456");
+        });
+        it("warns when secret appears in non-secret tool input (default mode)", () => {
+            delete process.env.ONECLAW_MCP_EXFIL_PROTECTION;
+            const result = inspectInput("share_secret", {
+                message: "Here is the key: sk_live_abc123def456",
+            });
+            expect(result.threats.some((t) => t.type === "secret_exfiltration")).toBe(true);
+            expect(result.passed).toBe(true);
+        });
+        it("blocks when exfil protection is set to block", () => {
+            process.env.ONECLAW_MCP_EXFIL_PROTECTION = "block";
+            const result = inspectInput("share_secret", {
+                message: "Here is the key: sk_live_abc123def456",
+            });
+            expect(result.passed).toBe(false);
+            expect(result.threats.some((t) => t.type === "secret_exfiltration")).toBe(true);
+        });
+        it("skips exfil check for secret tools (put_secret)", () => {
+            process.env.ONECLAW_MCP_EXFIL_PROTECTION = "block";
+            const result = inspectInput("put_secret", {
+                path: "api-keys/stripe",
+                value: "sk_live_abc123def456",
+            });
+            expect(result.threats.some((t) => t.type === "secret_exfiltration")).toBe(false);
+        });
+        it("skips exfil check when off", () => {
+            process.env.ONECLAW_MCP_EXFIL_PROTECTION = "off";
+            const result = inspectInput("share_secret", {
+                message: "Here is the key: sk_live_abc123def456",
+            });
+            expect(result.threats.some((t) => t.type === "secret_exfiltration")).toBe(false);
+        });
+    });
+    describe("feature flag helpers", () => {
+        it("isSecretRedactionEnabled defaults to true", () => {
+            delete process.env.ONECLAW_MCP_REDACT_SECRETS;
+            expect(isSecretRedactionEnabled()).toBe(true);
+        });
+        it("isSecretRedactionEnabled false when security disabled", () => {
+            process.env.ONECLAW_MCP_SECURITY_ENABLED = "false";
+            expect(isSecretRedactionEnabled()).toBe(false);
+        });
+        it("isPiiDetectionEnabled defaults to true", () => {
+            delete process.env.ONECLAW_MCP_PII_DETECTION;
+            expect(isPiiDetectionEnabled()).toBe(true);
+        });
+        it("getExfilProtectionMode defaults to warn", () => {
+            delete process.env.ONECLAW_MCP_EXFIL_PROTECTION;
+            expect(getExfilProtectionMode()).toBe("warn");
+        });
+        it("getExfilProtectionMode off when security disabled", () => {
+            process.env.ONECLAW_MCP_SECURITY_ENABLED = "false";
+            expect(getExfilProtectionMode()).toBe("off");
+        });
+    });
 });
 //# sourceMappingURL=security.test.js.map

package/dist/__tests__/security.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"security.test.js","sourceRoot":"","sources":["../../src/__tests__/security.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EACH,YAAY,EACZ,aAAa,EACb,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,GACtB,MAAM,sBAAsB,CAAC;AAE9B,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC7B,IAAI,WAA8B,CAAC;IAEnC,UAAU,CAAC,GAAG,EAAE;QACZ,WAAW,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACX,OAAO,CAAC,GAAG,GAAG,WAAW,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;QAC/B,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;YAC/B,OAAO,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;YAChD,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAC9C,OAAO,CAAC,GAAG,CAAC,4BAA4B,GAAG,OAAO,CAAC;YACnD,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;QACjC,EAAE,CAAC,mBAAmB,EAAE,GAAG,EAAE;YACzB,OAAO,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC;YACjD,MAAM,CAAC,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;YACjC,OAAO,CAAC,GAAG,CAAC,6BAA6B,GAAG,UAAU,CAAC;YACvD,MAAM,CAAC,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;YACjC,OAAO,CAAC,GAAG,CAAC,6BAA6B,GAAG,UAAU,CAAC;YACvD,MAAM,CAAC,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;QAC9B,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;YACpC,MAAM,KAAK,GAAG,6BAA6B,CAAC;YAC5C,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACzD,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAC3C,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;YACpC,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,sBAAsB;YAC9C,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACzD,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAClC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;YACnC,MAAM,KAAK,GAAG,aAAa,CAAC;YAC5B,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACzD,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC/B,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;QAC1B,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;YAC/B,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;gBACtC,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE;oBACrC,MAAM,EAAE,oCAAoC;iBAC/C,CAAC,CAAC;gBACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAClC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClF,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;gBACpC,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE;oBACrC,MAAM,EAAE,oBAAoB;iBAC/B,CAAC,CAAC;gBACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAClC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxF,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;gBAC9B,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE;oBACrC,MAAM,EAAE,0BAA0B;iBACrC,CAAC,CAAC;gBACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAClC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClF,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,oBAAoB,EAAE,GAAG,EAAE;gBAC1B,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE;oBACrC,MAAM,EAAE,sBAAsB;iBACjC,CAAC,CAAC;gBACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAC3C,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;YAChC,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;gBACnC,8CAA8C;gBAC9C,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE;oBACrC,IAAI,EAAE,kDAAkD;iBAC3D,CAAC,CAAC;gBACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/E,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,qBAAqB,EAAE,GAAG,EAAE;gBAC3B,oDAAoD;gBACpD,yEAAyE;gBACzE,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE;oBACrC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAA,0BAA0B;iBAC/C,CAAC,CAAC;gBACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9E,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;gBAC/B,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE;oBACrC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAA,cAAc;iBACnC,CAAC,CAAC;gBACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClF,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;YAChC,EAAE,CAAC,iBAAiB,EAAE,GAAG,EAAE;gBACvB,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE;oBACrC,MAAM,EAAE,8BAA8B;iBACzC,CAAC,CAAC;gBACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3E,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;gBAChC,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE;oBACrC,MAAM,EAAE,wCAAwC;iBACnD,CAAC,CAAC;gBACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAClC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7E,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;gBAChC,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE;oBACrC,MAAM,EAAE,+BAA+B;iBAC1C,CAAC,CAAC;gBACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAClC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3E,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;gBAC/B,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE;oBACrC,MAAM,EAAE,+BAA+B;iBAC1C,CAAC,CAAC;gBACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAClC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1E,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;gBACnC,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE;oBACrC,MAAM,EAAE,uBAAuB;iBAClC,CAAC,CAAC;gBACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAClC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtF,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;YAC7B,EAAE,CAAC,oBAAoB,EAAE,GAAG,EAAE;gBAC1B,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE;oBACrC,GAAG,EAAE,8BAA8B;iBACtC,CAAC,CAAC;gBACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAClC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzE,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;gBAC7B,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE;oBACrC,GAAG,EAAE,0BAA0B;iBAClC,CAAC,CAAC;gBACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAClC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5E,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;gBAC/B,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE;oBACrC,GAAG,EAAE,wBAAwB;iBAChC,CAAC,CAAC;gBACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1E,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;gBACjC,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE;oBACrC,OAAO,EAAE,+BAA+B;iBAC3C,CAAC,CAAC;gBACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAClC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9E,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;YACjC,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;gBAC7C,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE;oBACrC,MAAM,EAAE,QAAQ,EAAE,aAAa;iBAClC,CAAC,CAAC;gBACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpF,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;YAC/B,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;gBACvC,OAAO,CAAC,GAAG,CAAC,4BAA4B,GAAG,OAAO,CAAC;gBACnD,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE;oBACrC,MAAM,EAAE,YAAY;iBACvB,CAAC,CAAC;gBACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAC3C,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;QAC3B,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;YACjC,MAAM,MAAM,GAAG,aAAa,CAAC,WAAW,EAAE,0BAA0B,CAAC,CAAC;YACtE,2CAA2C;YAC3C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;YACtC,OAAO,CAAC,GAAG,CAAC,4BAA4B,GAAG,OAAO,CAAC;YACnD,MAAM,MAAM,GAAG,aAAa,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YACxD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}
+{"version":3,"file":"security.test.js","sourceRoot":"","sources":["../../src/__tests__/security.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EACH,YAAY,EACZ,aAAa,EACb,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,wBAAwB,EACxB,qBAAqB,EACrB,sBAAsB,EACtB,cAAc,EACd,YAAY,EACZ,kBAAkB,GACrB,MAAM,sBAAsB,CAAC;AAE9B,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC7B,IAAI,WAA8B,CAAC;IAEnC,UAAU,CAAC,GAAG,EAAE;QACZ,WAAW,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACX,OAAO,CAAC,GAAG,GAAG,WAAW,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;QAC/B,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;YAC/B,OAAO,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;YAChD,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAC9C,OAAO,CAAC,GAAG,CAAC,4BAA4B,GAAG,OAAO,CAAC;YACnD,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;QACjC,EAAE,CAAC,mBAAmB,EAAE,GAAG,EAAE;YACzB,OAAO,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC;YACjD,MAAM,CAAC,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;YACjC,OAAO,CAAC,GAAG,CAAC,6BAA6B,GAAG,UAAU,CAAC;YACvD,MAAM,CAAC,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;YACjC,OAAO,CAAC,GAAG,CAAC,6BAA6B,GAAG,UAAU,CAAC;YACvD,MAAM,CAAC,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;QAC9B,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;YACpC,MAAM,KAAK,GAAG,6BAA6B,CAAC;YAC5C,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACzD,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAC3C,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;YACpC,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,sBAAsB;YAC9C,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACzD,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAClC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;YACnC,MAAM,KAAK,GAAG,aAAa,CAAC;YAC5B,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACzD,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC/B,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;QAC1B,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;YAC/B,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;gBACtC,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE;oBACrC,MAAM,EAAE,oCAAoC;iBAC/C,CAAC,CAAC;gBACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAClC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClF,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;gBACpC,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE;oBACrC,MAAM,EAAE,oBAAoB;iBAC/B,CAAC,CAAC;gBACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAClC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxF,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;gBAC9B,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE;oBACrC,MAAM,EAAE,0BAA0B;iBACrC,CAAC,CAAC;gBACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAClC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClF,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,oBAAoB,EAAE,GAAG,EAAE;gBAC1B,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE;oBACrC,MAAM,EAAE,sBAAsB;iBACjC,CAAC,CAAC;gBACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAC3C,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;YAChC,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;gBACnC,8CAA8C;gBAC9C,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE;oBACrC,IAAI,EAAE,kDAAkD;iBAC3D,CAAC,CAAC;gBACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/E,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,qBAAqB,EAAE,GAAG,EAAE;gBAC3B,oDAAoD;gBACpD,yEAAyE;gBACzE,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE;oBACrC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAA,0BAA0B;iBAC/C,CAAC,CAAC;gBACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9E,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;gBAC/B,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE;oBACrC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAA,cAAc;iBACnC,CAAC,CAAC;gBACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClF,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;YAChC,EAAE,CAAC,iBAAiB,EAAE,GAAG,EAAE;gBACvB,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE;oBACrC,MAAM,EAAE,8BAA8B;iBACzC,CAAC,CAAC;gBACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3E,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;gBAChC,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE;oBACrC,MAAM,EAAE,wCAAwC;iBACnD,CAAC,CAAC;gBACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAClC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7E,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;gBAChC,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE;oBACrC,MAAM,EAAE,+BAA+B;iBAC1C,CAAC,CAAC;gBACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAClC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3E,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;gBAC/B,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE;oBACrC,MAAM,EAAE,+BAA+B;iBAC1C,CAAC,CAAC;gBACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAClC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1E,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;gBACnC,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE;oBACrC,MAAM,EAAE,uBAAuB;iBAClC,CAAC,CAAC;gBACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAClC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtF,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;YAC7B,EAAE,CAAC,oBAAoB,EAAE,GAAG,EAAE;gBAC1B,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE;oBACrC,GAAG,EAAE,8BAA8B;iBACtC,CAAC,CAAC;gBACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAClC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzE,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;gBAC7B,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE;oBACrC,GAAG,EAAE,0BAA0B;iBAClC,CAAC,CAAC;gBACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAClC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5E,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;gBAC/B,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE;oBACrC,GAAG,EAAE,wBAAwB;iBAChC,CAAC,CAAC;gBACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1E,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;gBACjC,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE;oBACrC,OAAO,EAAE,+BAA+B;iBAC3C,CAAC,CAAC;gBACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAClC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9E,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;YACjC,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;gBAC7C,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE;oBACrC,MAAM,EAAE,QAAQ,EAAE,aAAa;iBAClC,CAAC,CAAC;gBACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpF,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;YAC/B,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;gBACvC,OAAO,CAAC,GAAG,CAAC,4BAA4B,GAAG,OAAO,CAAC;gBACnD,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE;oBACrC,MAAM,EAAE,YAAY;iBACvB,CAAC,CAAC;gBACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAC3C,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;QAC3B,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;YACjC,MAAM,MAAM,GAAG,aAAa,CAAC,WAAW,EAAE,0BAA0B,CAAC,CAAC;YACtE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;YACtC,OAAO,CAAC,GAAG,CAAC,4BAA4B,GAAG,OAAO,CAAC;YACnD,MAAM,MAAM,GAAG,aAAa,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YACxD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;QAC3B,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;YACxC,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE;gBACrC,OAAO,EAAE,2BAA2B;aACvC,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;YAC5B,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE;gBACrC,IAAI,EAAE,kBAAkB;aAC3B,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;YAC5C,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE;gBACrC,IAAI,EAAE,qBAAqB;aAC9B,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;YAC/B,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE;gBACrC,GAAG,EAAE,sBAAsB;aAC9B,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;YACnC,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE;gBACrC,GAAG,EAAE,iCAAiC;aACzC,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtF,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;YAC7B,MAAM,MAAM,GAAG,aAAa,CAAC,WAAW,EAAE,+BAA+B,CAAC,CAAC;YAC3E,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;YACzC,OAAO,CAAC,GAAG,CAAC,yBAAyB,GAAG,OAAO,CAAC;YAChD,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE;gBACrC,IAAI,EAAE,kBAAkB;aAC3B,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;QAC9B,UAAU,CAAC,GAAG,EAAE;YACZ,YAAY,EAAE,CAAC;QACnB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;YACpC,cAAc,CAAC,iBAAiB,EAAE,sBAAsB,CAAC,CAAC;YAC1D,MAAM,CAAC,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;YAC5B,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC/B,MAAM,CAAC,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;YACxD,cAAc,CAAC,iBAAiB,EAAE,sBAAsB,CAAC,CAAC;YAC1D,MAAM,MAAM,GAAG,aAAa,CAAC,aAAa,EAAE,iCAAiC,CAAC,CAAC;YAC/E,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;YACtE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;YACzC,cAAc,CAAC,iBAAiB,EAAE,sBAAsB,CAAC,CAAC;YAC1D,MAAM,MAAM,GAAG,aAAa,CAAC,YAAY,EAAE,kCAAkC,CAAC,CAAC;YAC/E,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,aAAa,EAAE,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;YAChD,OAAO,CAAC,GAAG,CAAC,0BAA0B,GAAG,OAAO,CAAC;YACjD,cAAc,CAAC,iBAAiB,EAAE,sBAAsB,CAAC,CAAC;YAC1D,MAAM,MAAM,GAAG,aAAa,CAAC,aAAa,EAAE,iCAAiC,CAAC,CAAC;YAC/E,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,aAAa,EAAE,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gBAAgB,EAAE,GAAG,EAAE;YACtB,cAAc,CAAC,iBAAiB,EAAE,sBAAsB,CAAC,CAAC;YAC1D,YAAY,EAAE,CAAC;YACf,MAAM,CAAC,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACrC,UAAU,CAAC,GAAG,EAAE;YACZ,YAAY,EAAE,CAAC;YACf,cAAc,CAAC,iBAAiB,EAAE,sBAAsB,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;YACzE,OAAO,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;YAChD,MAAM,MAAM,GAAG,YAAY,CAAC,cAAc,EAAE;gBACxC,OAAO,EAAE,uCAAuC;aACnD,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;YACpD,OAAO,CAAC,GAAG,CAAC,4BAA4B,GAAG,OAAO,CAAC;YACnD,MAAM,MAAM,GAAG,YAAY,CAAC,cAAc,EAAE;gBACxC,OAAO,EAAE,uCAAuC;aACnD,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAClC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpF,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;YACvD,OAAO,CAAC,GAAG,CAAC,4BAA4B,GAAG,OAAO,CAAC;YACnD,MAAM,MAAM,GAAG,YAAY,CAAC,YAAY,EAAE;gBACtC,IAAI,EAAE,iBAAiB;gBACvB,KAAK,EAAE,sBAAsB;aAChC,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrF,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;YAClC,OAAO,CAAC,GAAG,CAAC,4BAA4B,GAAG,KAAK,CAAC;YACjD,MAAM,MAAM,GAAG,YAAY,CAAC,cAAc,EAAE;gBACxC,OAAO,EAAE,uCAAuC;aACnD,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrF,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;QAClC,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;YACjD,OAAO,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;YAC9C,MAAM,CAAC,wBAAwB,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;YAC7D,OAAO,CAAC,GAAG,CAAC,4BAA4B,GAAG,OAAO,CAAC;YACnD,MAAM,CAAC,wBAAwB,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAC9C,OAAO,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;YAC7C,MAAM,CAAC,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;YAC/C,OAAO,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;YAChD,MAAM,CAAC,sBAAsB,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;YACzD,OAAO,CAAC,GAAG,CAAC,4BAA4B,GAAG,OAAO,CAAC;YACnD,MAAM,CAAC,sBAAsB,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/dist/index.js

@@ -13,7 +13,7 @@ import { grantAccessTool } from "./tools/grant_access.js";
 import { shareSecretTool } from "./tools/share_secret.js";
 import { simulateTransactionTool } from "./tools/simulate_transaction.js";
 import { submitTransactionTool } from "./tools/submit_transaction.js";
-import { inspectInput, inspectOutput, isSecurityEnabled } from "./security/index.js";
+import { inspectInput, inspectOutput, isSecurityEnabled, registerSecret, isSecretRedactionEnabled } from "./security/index.js";
 const baseUrl = process.env.ONECLAW_BASE_URL ?? "https://api.1claw.xyz";
 const transport = process.env.MCP_TRANSPORT ?? "stdio";
 const port = parseInt(process.env.PORT ?? "8080", 10);
@@ -66,15 +66,35 @@ const serverOpts = {
     health: { enabled: true, path: "/health" },
 };
 if (transport === "httpStream") {
-    serverOpts.authenticate = (request) => {
+    serverOpts.authenticate = async (request) => {
         const auth = (request.headers["authorization"] ?? "");
         const token = auth.replace(/^Bearer\s+/i, "").trim();
         const vaultId = (request.headers["x-vault-id"] ?? "");
         if (!token)
-            return Promise.reject(new Error("Missing Authorization header (Bearer <agent-token>)"));
+            throw new Error("Missing Authorization header (Bearer <agent-token>)");
         if (!vaultId)
-            return Promise.reject(new Error("Missing X-Vault-ID header"));
-        return Promise.resolve({ token, vaultId });
+            throw new Error("Missing X-Vault-ID header");
+        // H-9: Validate token against the vault API (not just pass-through).
+        // Calls GET /v1/vaults to confirm the token is valid. An invalid or
+        // expired token will fail with 401, rejecting the session early.
+        const validationRes = await fetch(`${baseUrl}/v1/vaults/${vaultId}`, {
+            headers: { Authorization: `Bearer ${token}` },
+        });
+        if (!validationRes.ok) {
+            const status = validationRes.status;
+            if (status === 401) {
+                throw new Error("Invalid or expired Bearer token");
+            }
+            if (status === 403) {
+                // H-10: The token's vault_ids claim doesn't include this vault
+                throw new Error("X-Vault-ID is not accessible with this token (vault binding mismatch)");
+            }
+            if (status === 404) {
+                throw new Error(`Vault ${vaultId} not found`);
+            }
+            throw new Error(`Token validation failed (HTTP ${status})`);
+        }
+        return { token, vaultId };
     };
 }
 const server = new FastMCP(serverOpts);
@@ -100,12 +120,37 @@ function registerTool(factory) {
             const client = resolveClient(context.session);
             const tool = factory(client);
             const result = await tool.execute(args, context);
-            // Security inspection of output (log only)
+            // Track secret values for redaction and exfiltration protection
+            if (isSecretRedactionEnabled()) {
+                if (proto.name === "get_secret") {
+                    try {
+                        const parsed = JSON.parse(result);
+                        if (parsed.value && parsed.path)
+                            registerSecret(parsed.path, parsed.value);
+                    }
+                    catch { /* not JSON — skip */ }
+                }
+                if (proto.name === "get_env_bundle") {
+                    try {
+                        const env = JSON.parse(result);
+                        for (const [key, val] of Object.entries(env)) {
+                            if (typeof val === "string")
+                                registerSecret(`env:${key}`, val);
+                        }
+                    }
+                    catch { /* not JSON — skip */ }
+                }
+            }
+            // Security inspection of output (redacts secrets, detects PII, logs threats)
             if (isSecurityEnabled()) {
                 const outputCheck = inspectOutput(proto.name, result);
                 if (outputCheck.threats.length > 0) {
                     context.log.info(`[SECURITY] Output warnings for ${proto.name}: ${outputCheck.threats.map(t => t.pattern).join(", ")}`);
                 }
+                if (outputCheck.redacted) {
+                    context.log.info(`[SECURITY] Redacted secret values from ${proto.name} output`);
+                    return outputCheck.redacted;
+                }
             }
             return result;
         },
@@ -123,7 +168,8 @@ registerTool(shareSecretTool);
 registerTool(simulateTransactionTool);
 registerTool(submitTransactionTool);
 // ── Stretch: rotate_and_store ────────────────────────
-server.addTool({
+// Registered via registerTool so input/output go through security inspection.
+const rotateAndStoreTool = (client) => ({
     name: "rotate_and_store",
     description: "Store a new value for an existing secret (creating a new version) and return the version number. Useful when an agent has regenerated an API key and needs to persist it.",
     parameters: z.object({
@@ -131,7 +177,6 @@ server.addTool({
         value: z.string().min(1).describe("The new secret value"),
     }),
     execute: async (args, context) => {
-        const client = resolveClient(context.session);
         const result = await client.putSecret(args.path, {
             value: args.value,
             type: "api_key",
@@ -140,15 +185,16 @@ server.addTool({
         return `Rotated secret at '${args.path}'. New version: ${result.version}.`;
     },
 });
+registerTool(rotateAndStoreTool);
 // ── Stretch: get_env_bundle ──────────────────────────
-server.addTool({
+// Registered via registerTool so input/output go through security inspection.
+const getEnvBundleTool = (client) => ({
     name: "get_env_bundle",
     description: "Fetch a secret of type env_bundle, parse its KEY=VALUE lines, and return a structured JSON object. Useful for injecting environment variables into subprocesses.",
     parameters: z.object({
         path: z.string().min(1).describe("Path to an env_bundle secret"),
     }),
     execute: async (args, context) => {
-        const client = resolveClient(context.session);
         try {
             const secret = await client.getSecret(args.path);
             context.log.info(`env_bundle accessed: ${args.path}`);
@@ -180,6 +226,7 @@ server.addTool({
         }
     },
 });
+registerTool(getEnvBundleTool);
 // ── Resource: browsable secret listing ───────────────
 server.addResource({
     uri: "vault://secrets",

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAGA,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAIrF,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,uBAAuB,CAAC;AACxE,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC;AACvD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;AAEtD,uDAAuD;AAEvD,IAAI,YAAuC,CAAC;AAE5C,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;IACxB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC7C,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IACtD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IAE9C,IAAI,WAAW,EAAE,CAAC;QACd,mFAAmF;QACnF,YAAY,GAAG,IAAI,aAAa,CAAC;YAC7B,OAAO;YACP,OAAO,EAAE,OAAO,IAAI,SAAS;YAC7B,MAAM,EAAE,WAAW;YACnB,OAAO,EAAE,OAAO,IAAI,SAAS;SAChC,CAAC,CAAC;IACP,CAAC;SAAM,IAAI,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CACT,2EAA2E,CAC9E,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;QACD,YAAY,GAAG,IAAI,aAAa,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IAClE,CAAC;SAAM,CAAC;QACJ,OAAO,CAAC,KAAK,CACT,wCAAwC;YACpC,8FAA8F;YAC9F,oEAAoE;YACpE,oEAAoE,CAC3E,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,OAAqB;IACxC,IAAI,OAAO,EAAE,CAAC;QACV,OAAO,IAAI,aAAa,CAAC;YACrB,OAAO;YACP,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,OAAO,EAAE,OAAO,CAAC,OAAO;SAC3B,CAAC,CAAC;IACP,CAAC;IACD,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IACtC,MAAM,IAAI,SAAS,CACf,kEAAkE,CACrE,CAAC;AACN,CAAC;AAMD,MAAM,UAAU,GAAe;IAC3B,IAAI,EAAE,OAAO;IACb,OAAO,EAAE,OAAO;IAChB,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE;CAC7C,CAAC;AAEF,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;IAC7B,UAAU,CAAC,YAAY,GAAG,CACtB,OAA6B,EACT,EAAE;QACtB,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,CAAW,CAAC;QAChE,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrD,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAW,CAAC;QAEhE,IAAI,CAAC,KAAK;YACN,OAAO,OAAO,CAAC,MAAM,CACjB,IAAI,KAAK,CACL,qDAAqD,CACxD,CACJ,CAAC;QACN,IAAI,CAAC,OAAO;YACR,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC,CAAC;QAElE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC;AACN,CAAC;AAED,MAAM,MAAM,GAAG,IAAI,OAAO,CAAc,UAAU,CAAC,CAAC;AAapD,SAAS,YAAY,CAAC,OAAuB;IACzC,MAAM,KAAK,GAAG,OAAO,CACjB,YAAY,IAAI,IAAI,aAAa,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CACzE,CAAC;IACF,MAAM,CAAC,OAAO,CAAC;QACX,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,OAAO,EAAE,KAAK,EACV,IAA6B,EAC7B,OAGC,EACH,EAAE;YACA,+BAA+B;YAC/B,IAAI,iBAAiB,EAAE,EAAE,CAAC;gBACtB,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBAClD,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;oBACrB,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;oBACrC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,sBAAsB,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,IAAI,KAAK,MAAM,EAAE,OAAO,GAAG,CAAC,CAAC;oBAC3F,MAAM,IAAI,SAAS,CAAC,0BAA0B,MAAM,EAAE,IAAI,WAAW,CAAC,CAAC;gBAC3E,CAAC;gBACD,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAChC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,2BAA2B,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACpH,CAAC;YACL,CAAC;YAED,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;YAC7B,MAAM,MAAM,GAAG,MACX,IAAI,CAAC,OACR,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAEjB,2CAA2C;YAC3C,IAAI,iBAAiB,EAAE,EAAE,CAAC;gBACtB,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBACtD,IAAI,WAAW,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACjC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,kCAAkC,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC5H,CAAC;YACL,CAAC;YAED,OAAO,MAAM,CAAC;QAClB,CAAC;KACJ,CAAC,CAAC;AACP,CAAC;AAED,YAAY,CAAC,eAAiC,CAAC,CAAC;AAChD,YAAY,CAAC,aAA+B,CAAC,CAAC;AAC9C,YAAY,CAAC,aAA+B,CAAC,CAAC;AAC9C,YAAY,CAAC,gBAAkC,CAAC,CAAC;AACjD,YAAY,CAAC,kBAAoC,CAAC,CAAC;AACnD,YAAY,CAAC,eAAiC,CAAC,CAAC;AAChD,YAAY,CAAC,cAAgC,CAAC,CAAC;AAC/C,YAAY,CAAC,eAAiC,CAAC,CAAC;AAChD,YAAY,CAAC,eAAiC,CAAC,CAAC;AAChD,YAAY,CAAC,uBAAyC,CAAC,CAAC;AACxD,YAAY,CAAC,qBAAuC,CAAC,CAAC;AAEtD,wDAAwD;AAExD,MAAM,CAAC,OAAO,CAAC;IACX,IAAI,EAAE,kBAAkB;IACxB,WAAW,EACP,2KAA2K;IAC/K,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC;QACzD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC;KAC5D,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE;YAC7C,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,SAAS;SAClB,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACjD,OAAO,sBAAsB,IAAI,CAAC,IAAI,mBAAmB,MAAM,CAAC,OAAO,GAAG,CAAC;IAC/E,CAAC;CACJ,CAAC,CAAC;AAEH,wDAAwD;AAExD,MAAM,CAAC,OAAO,CAAC;IACX,IAAI,EAAE,gBAAgB;IACtB,WAAW,EACP,kKAAkK;IACtK,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,8BAA8B,CAAC;KACnE,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAEtD,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC/B,MAAM,IAAI,SAAS,CACf,cAAc,IAAI,CAAC,IAAI,cAAc,MAAM,CAAC,IAAI,sBAAsB,CACzE,CAAC;YACN,CAAC;YAED,MAAM,GAAG,GAA2B,EAAE,CAAC;YACvC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAClD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACnC,IAAI,KAAK,KAAK,CAAC,CAAC;oBAAE,SAAS;gBAC3B,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAC5D,CAAC;YAED,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,IAAI,GAAG,YAAY,eAAe,EAAE,CAAC;gBACjC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBACrB,MAAM,IAAI,SAAS,CACf,mBAAmB,IAAI,CAAC,IAAI,wDAAwD,CACvF,CAAC;gBACN,CAAC;gBACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBACrB,MAAM,IAAI,SAAS,CACf,4BAA4B,IAAI,CAAC,IAAI,IAAI,CAC5C,CAAC;gBACN,CAAC;YACL,CAAC;YACD,MAAM,GAAG,CAAC;QACd,CAAC;IACL,CAAC;CACJ,CAAC,CAAC;AAEH,wDAAwD;AAExD,MAAM,CAAC,WAAW,CAAC;IACf,GAAG,EAAE,iBAAiB;IACtB,IAAI,EAAE,eAAe;IACrB,WAAW,EACP,2FAA2F;IAC/F,QAAQ,EAAE,kBAAkB;IAC5B,KAAK,CAAC,IAAI,CAAC,IAAkB;QACzB,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;QACxC,OAAO;YACH,IAAI,EAAE,IAAI,CAAC,SAAS,CAChB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACrB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,UAAU,EAAE,CAAC,CAAC,UAAU;aAC3B,CAAC,CAAC,EACH,IAAI,EACJ,CAAC,CACJ;SACJ,CAAC;IACN,CAAC;CACJ,CAAC,CAAC;AAEH,wDAAwD;AAExD,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;IAC7B,MAAM,CAAC,KAAK,CAAC;QACT,aAAa,EAAE,YAAY;QAC3B,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE;KACxC,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,CAAC,sCAAsC,IAAI,mBAAmB,CAAC,CAAC;AAC/E,CAAC;KAAM,CAAC;IACJ,MAAM,CAAC,KAAK,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC;AAC7C,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAGA,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,iBAAiB,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAI/H,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,uBAAuB,CAAC;AACxE,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC;AACvD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;AAEtD,uDAAuD;AAEvD,IAAI,YAAuC,CAAC;AAE5C,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;IACxB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC7C,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IACtD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IAE9C,IAAI,WAAW,EAAE,CAAC;QACd,mFAAmF;QACnF,YAAY,GAAG,IAAI,aAAa,CAAC;YAC7B,OAAO;YACP,OAAO,EAAE,OAAO,IAAI,SAAS;YAC7B,MAAM,EAAE,WAAW;YACnB,OAAO,EAAE,OAAO,IAAI,SAAS;SAChC,CAAC,CAAC;IACP,CAAC;SAAM,IAAI,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CACT,2EAA2E,CAC9E,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;QACD,YAAY,GAAG,IAAI,aAAa,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IAClE,CAAC;SAAM,CAAC;QACJ,OAAO,CAAC,KAAK,CACT,wCAAwC;YACpC,8FAA8F;YAC9F,oEAAoE;YACpE,oEAAoE,CAC3E,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,OAAqB;IACxC,IAAI,OAAO,EAAE,CAAC;QACV,OAAO,IAAI,aAAa,CAAC;YACrB,OAAO;YACP,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,OAAO,EAAE,OAAO,CAAC,OAAO;SAC3B,CAAC,CAAC;IACP,CAAC;IACD,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IACtC,MAAM,IAAI,SAAS,CACf,kEAAkE,CACrE,CAAC;AACN,CAAC;AAMD,MAAM,UAAU,GAAe;IAC3B,IAAI,EAAE,OAAO;IACb,OAAO,EAAE,OAAO;IAChB,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE;CAC7C,CAAC;AAEF,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;IAC7B,UAAU,CAAC,YAAY,GAAG,KAAK,EAC3B,OAA6B,EACT,EAAE;QACtB,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,CAAW,CAAC;QAChE,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrD,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAW,CAAC;QAEhE,IAAI,CAAC,KAAK;YACN,MAAM,IAAI,KAAK,CACX,qDAAqD,CACxD,CAAC;QACN,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAE3D,qEAAqE;QACrE,oEAAoE;QACpE,iEAAiE;QACjE,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,cAAc,OAAO,EAAE,EAAE;YACjE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SAChD,CAAC,CAAC;QACH,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC;YACpC,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACvD,CAAC;YACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;gBACjB,+DAA+D;gBAC/D,MAAM,IAAI,KAAK,CACX,uEAAuE,CAC1E,CAAC;YACN,CAAC;YACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,SAAS,OAAO,YAAY,CAAC,CAAC;YAClD,CAAC;YACD,MAAM,IAAI,KAAK,CACX,iCAAiC,MAAM,GAAG,CAC7C,CAAC;QACN,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAC9B,CAAC,CAAC;AACN,CAAC;AAED,MAAM,MAAM,GAAG,IAAI,OAAO,CAAc,UAAU,CAAC,CAAC;AAapD,SAAS,YAAY,CAAC,OAAuB;IACzC,MAAM,KAAK,GAAG,OAAO,CACjB,YAAY,IAAI,IAAI,aAAa,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CACzE,CAAC;IACF,MAAM,CAAC,OAAO,CAAC;QACX,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,OAAO,EAAE,KAAK,EACV,IAA6B,EAC7B,OAGC,EACH,EAAE;YACA,+BAA+B;YAC/B,IAAI,iBAAiB,EAAE,EAAE,CAAC;gBACtB,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBAClD,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;oBACrB,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;oBACrC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,sBAAsB,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,IAAI,KAAK,MAAM,EAAE,OAAO,GAAG,CAAC,CAAC;oBAC3F,MAAM,IAAI,SAAS,CAAC,0BAA0B,MAAM,EAAE,IAAI,WAAW,CAAC,CAAC;gBAC3E,CAAC;gBACD,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAChC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,2BAA2B,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACpH,CAAC;YACL,CAAC;YAED,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;YAC7B,MAAM,MAAM,GAAG,MACX,IAAI,CAAC,OACR,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAEjB,gEAAgE;YAChE,IAAI,wBAAwB,EAAE,EAAE,CAAC;gBAC7B,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBAC9B,IAAI,CAAC;wBACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;wBAClC,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI;4BAAE,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;oBAC/E,CAAC;oBAAC,MAAM,CAAC,CAAC,qBAAqB,CAAC,CAAC;gBACrC,CAAC;gBACD,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;oBAClC,IAAI,CAAC;wBACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;wBAC/B,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;4BAC3C,IAAI,OAAO,GAAG,KAAK,QAAQ;gCAAE,cAAc,CAAC,OAAO,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;wBACnE,CAAC;oBACL,CAAC;oBAAC,MAAM,CAAC,CAAC,qBAAqB,CAAC,CAAC;gBACrC,CAAC;YACL,CAAC;YAED,6EAA6E;YAC7E,IAAI,iBAAiB,EAAE,EAAE,CAAC;gBACtB,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBACtD,IAAI,WAAW,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACjC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,kCAAkC,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC5H,CAAC;gBACD,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;oBACvB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,0CAA0C,KAAK,CAAC,IAAI,SAAS,CAAC,CAAC;oBAChF,OAAO,WAAW,CAAC,QAAQ,CAAC;gBAChC,CAAC;YACL,CAAC;YAED,OAAO,MAAM,CAAC;QAClB,CAAC;KACJ,CAAC,CAAC;AACP,CAAC;AAED,YAAY,CAAC,eAAiC,CAAC,CAAC;AAChD,YAAY,CAAC,aAA+B,CAAC,CAAC;AAC9C,YAAY,CAAC,aAA+B,CAAC,CAAC;AAC9C,YAAY,CAAC,gBAAkC,CAAC,CAAC;AACjD,YAAY,CAAC,kBAAoC,CAAC,CAAC;AACnD,YAAY,CAAC,eAAiC,CAAC,CAAC;AAChD,YAAY,CAAC,cAAgC,CAAC,CAAC;AAC/C,YAAY,CAAC,eAAiC,CAAC,CAAC;AAChD,YAAY,CAAC,eAAiC,CAAC,CAAC;AAChD,YAAY,CAAC,uBAAyC,CAAC,CAAC;AACxD,YAAY,CAAC,qBAAuC,CAAC,CAAC;AAEtD,wDAAwD;AACxD,8EAA8E;AAE9E,MAAM,kBAAkB,GAAG,CAAC,MAAqB,EAAE,EAAE,CAAC,CAAC;IACnD,IAAI,EAAE,kBAAkB;IACxB,WAAW,EACP,2KAA2K;IAC/K,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC;QACzD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC;KAC5D,CAAC;IACF,OAAO,EAAE,KAAK,EACV,IAAqC,EACrC,OAAiD,EACnD,EAAE;QACA,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE;YAC7C,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,SAAS;SAClB,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACjD,OAAO,sBAAsB,IAAI,CAAC,IAAI,mBAAmB,MAAM,CAAC,OAAO,GAAG,CAAC;IAC/E,CAAC;CACJ,CAAC,CAAC;AACH,YAAY,CAAC,kBAAoC,CAAC,CAAC;AAEnD,wDAAwD;AACxD,8EAA8E;AAE9E,MAAM,gBAAgB,GAAG,CAAC,MAAqB,EAAE,EAAE,CAAC,CAAC;IACjD,IAAI,EAAE,gBAAgB;IACtB,WAAW,EACP,kKAAkK;IACtK,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,8BAA8B,CAAC;KACnE,CAAC;IACF,OAAO,EAAE,KAAK,EACV,IAAsB,EACtB,OAAiD,EACnD,EAAE;QACA,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAEtD,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC/B,MAAM,IAAI,SAAS,CACf,cAAc,IAAI,CAAC,IAAI,cAAc,MAAM,CAAC,IAAI,sBAAsB,CACzE,CAAC;YACN,CAAC;YAED,MAAM,GAAG,GAA2B,EAAE,CAAC;YACvC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAClD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACnC,IAAI,KAAK,KAAK,CAAC,CAAC;oBAAE,SAAS;gBAC3B,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAC5D,CAAC;YAED,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,IAAI,GAAG,YAAY,eAAe,EAAE,CAAC;gBACjC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBACrB,MAAM,IAAI,SAAS,CACf,mBAAmB,IAAI,CAAC,IAAI,wDAAwD,CACvF,CAAC;gBACN,CAAC;gBACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBACrB,MAAM,IAAI,SAAS,CACf,4BAA4B,IAAI,CAAC,IAAI,IAAI,CAC5C,CAAC;gBACN,CAAC;YACL,CAAC;YACD,MAAM,GAAG,CAAC;QACd,CAAC;IACL,CAAC;CACJ,CAAC,CAAC;AACH,YAAY,CAAC,gBAAkC,CAAC,CAAC;AAEjD,wDAAwD;AAExD,MAAM,CAAC,WAAW,CAAC;IACf,GAAG,EAAE,iBAAiB;IACtB,IAAI,EAAE,eAAe;IACrB,WAAW,EACP,2FAA2F;IAC/F,QAAQ,EAAE,kBAAkB;IAC5B,KAAK,CAAC,IAAI,CAAC,IAAkB;QACzB,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;QACxC,OAAO;YACH,IAAI,EAAE,IAAI,CAAC,SAAS,CAChB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACrB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,UAAU,EAAE,CAAC,CAAC,UAAU;aAC3B,CAAC,CAAC,EACH,IAAI,EACJ,CAAC,CACJ;SACJ,CAAC;IACN,CAAC;CACJ,CAAC,CAAC;AAEH,wDAAwD;AAExD,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;IAC7B,MAAM,CAAC,KAAK,CAAC;QACT,aAAa,EAAE,YAAY;QAC3B,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE;KACxC,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,CAAC,sCAAsC,IAAI,mBAAmB,CAAC,CAAC;AAC/E,CAAC;KAAM,CAAC;IACJ,MAAM,CAAC,KAAK,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC;AAC7C,CAAC"}

package/dist/security/index.d.ts

@@ -1,6 +1,7 @@
 /**
  * Security inspection module for MCP tools.
- * Detects command injection, encoding obfuscation, and other threats.
+ * Detects command injection, encoding obfuscation, PII, and other threats.
+ * Tracks fetched secret values for redaction and exfiltration protection.
  */
 export interface ThreatDetection {
     type: string;
@@ -12,28 +13,36 @@ export interface InspectionResult {
     passed: boolean;
     threats: ThreatDetection[];
     sanitized?: string;
+    redacted?: string;
 }
 /**
- * Check if MCP security inspection is enabled.
+ * Register a secret value for redaction and exfiltration protection.
+ * Called after get_secret / get_env_bundle returns a value.
  */
-export declare function isSecurityEnabled(): boolean;
+export declare function registerSecret(path: string, value: string): void;
 /**
- * Get the configured sanitization mode.
+ * Clear all tracked secrets (e.g. on session teardown).
  */
-export declare function getSanitizationMode(): "block" | "surgical" | "log_only";
+export declare function clearSecrets(): void;
 /**
- * Normalize text by replacing confusables and stripping zero-width characters.
+ * Return the number of tracked secret values.
  */
+export declare function trackedSecretCount(): number;
+export declare function isSecurityEnabled(): boolean;
+export declare function isSecretRedactionEnabled(): boolean;
+export declare function isPiiDetectionEnabled(): boolean;
+export declare function getExfilProtectionMode(): "block" | "warn" | "off";
+export declare function getSanitizationMode(): "block" | "surgical" | "log_only";
 export declare function normalizeUnicode(text: string): {
     normalized: string;
     modified: boolean;
 };
 /**
- * Inspect tool input arguments for threats.
+ * Inspect tool input arguments for threats, PII, and secret exfiltration.
  */
 export declare function inspectInput(toolName: string, args: unknown): InspectionResult;
 /**
- * Inspect tool output for threats (mainly for logging).
+ * Inspect tool output for threats, PII, and optionally redact known secrets.
  */
 export declare function inspectOutput(toolName: string, result: string): InspectionResult;
 //# sourceMappingURL=index.d.ts.map

package/dist/security/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,eAAe;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;CACpD;AAED,MAAM,WAAW,gBAAgB;IAC7B,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AA8CD;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AAED;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,GAAG,UAAU,GAAG,UAAU,CAMvE;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAgBxF;AA+DD;;GAEG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,gBAAgB,CAwC9E;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAShF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,WAAW,eAAe;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;CACpD;AAED,MAAM,WAAW,gBAAgB;IAC7B,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB;AAsED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAIhE;AAED;;GAEG;AACH,wBAAgB,YAAY,IAAI,IAAI,CAEnC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAID,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AAED,wBAAgB,wBAAwB,IAAI,OAAO,CAGlD;AAED,wBAAgB,qBAAqB,IAAI,OAAO,CAG/C;AAED,wBAAgB,sBAAsB,IAAI,OAAO,GAAG,MAAM,GAAG,KAAK,CAKjE;AAED,wBAAgB,mBAAmB,IAAI,OAAO,GAAG,UAAU,GAAG,UAAU,CAMvE;AAID,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAcxF;AAoFD;;GAEG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,gBAAgB,CA0C9E;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAuBhF"}

package/dist/security/index.js

@@ -1,7 +1,9 @@
 /**
  * Security inspection module for MCP tools.
- * Detects command injection, encoding obfuscation, and other threats.
+ * Detects command injection, encoding obfuscation, PII, and other threats.
+ * Tracks fetched secret values for redaction and exfiltration protection.
  */
+// ── Threat patterns ──────────────────────────────────
 const COMMAND_INJECTION_PATTERNS = [
     { name: "shell_chain", pattern: /(?:;|\||&&|\|\|)\s*(?:curl|wget|bash|sh|nc|python|perl|ruby|php|node)\b/i, severity: "critical" },
     { name: "command_substitution", pattern: /\$\([^)]+\)|`[^`]+`/, severity: "critical" },
@@ -28,6 +30,14 @@ const NETWORK_PATTERNS = [
     { name: "ip_url", pattern: /https?:\/\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/, severity: "medium" },
     { name: "data_exfil", pattern: /(?:curl|wget|nc)\s+(?:-[a-zA-Z]*\s+)*https?:\/\//i, severity: "critical" },
 ];
+const PII_PATTERNS = [
+    { name: "email", pattern: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/, severity: "medium" },
+    { name: "ssn", pattern: /\b\d{3}-\d{2}-\d{4}\b/, severity: "critical" },
+    { name: "credit_card", pattern: /\b(?:4\d{3}|5[1-5]\d{2}|3[47]\d{2}|6(?:011|5\d{2}))[- ]?\d{4}[- ]?\d{4}[- ]?\d{1,4}\b/, severity: "critical" },
+    { name: "phone_us", pattern: /\b(?:\+1[- ]?)?\(?\d{3}\)?[- ]?\d{3}[- ]?\d{4}\b/, severity: "low" },
+    { name: "aws_key", pattern: /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/, severity: "critical" },
+    { name: "private_key_header", pattern: /-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/, severity: "critical" },
+];
 // Zero-width and invisible characters
 const ZERO_WIDTH_CHARS = /[\u200B\u200C\u200D\u200E\u200F\u202A-\u202E\u2060-\u2064\u2066-\u2069\uFEFF]/g;
 // Cyrillic/Greek confusables
@@ -39,15 +49,59 @@ const CONFUSABLES = {
     'Ο': 'O', 'Ρ': 'P', 'Τ': 'T', 'Υ': 'Y', 'Χ': 'X', 'Ζ': 'Z',
 };
 const CONFUSABLE_REGEX = new RegExp(`[${Object.keys(CONFUSABLES).join('')}]`, 'g');
+// ── Secret value registry (vault-manifest-aware redaction) ───
+const MIN_SECRET_LENGTH = 6;
+const secretValues = new Map();
+/** Tools that legitimately return or accept secret values. */
+const SECRET_TOOLS = new Set([
+    "get_secret",
+    "get_env_bundle",
+    "put_secret",
+    "rotate_and_store",
+]);
 /**
- * Check if MCP security inspection is enabled.
+ * Register a secret value for redaction and exfiltration protection.
+ * Called after get_secret / get_env_bundle returns a value.
  */
-export function isSecurityEnabled() {
-    return process.env.ONECLAW_MCP_SECURITY_ENABLED !== "false";
+export function registerSecret(path, value) {
+    if (value.length >= MIN_SECRET_LENGTH) {
+        secretValues.set(value, path);
+    }
 }
 /**
- * Get the configured sanitization mode.
+ * Clear all tracked secrets (e.g. on session teardown).
  */
+export function clearSecrets() {
+    secretValues.clear();
+}
+/**
+ * Return the number of tracked secret values.
+ */
+export function trackedSecretCount() {
+    return secretValues.size;
+}
+// ── Feature flags ────────────────────────────────────
+export function isSecurityEnabled() {
+    return process.env.ONECLAW_MCP_SECURITY_ENABLED !== "false";
+}
+export function isSecretRedactionEnabled() {
+    if (!isSecurityEnabled())
+        return false;
+    return process.env.ONECLAW_MCP_REDACT_SECRETS !== "false";
+}
+export function isPiiDetectionEnabled() {
+    if (!isSecurityEnabled())
+        return false;
+    return process.env.ONECLAW_MCP_PII_DETECTION !== "false";
+}
+export function getExfilProtectionMode() {
+    if (!isSecurityEnabled())
+        return "off";
+    const mode = process.env.ONECLAW_MCP_EXFIL_PROTECTION;
+    if (mode === "block" || mode === "off")
+        return mode;
+    return "warn";
+}
 export function getSanitizationMode() {
     const mode = process.env.ONECLAW_MCP_SANITIZATION_MODE;
     if (mode === "surgical" || mode === "log_only") {
@@ -55,100 +109,114 @@ export function getSanitizationMode() {
     }
     return "block";
 }
-/**
- * Normalize text by replacing confusables and stripping zero-width characters.
- */
+// ── Unicode normalization ────────────────────────────
 export function normalizeUnicode(text) {
     let modified = false;
-    // Strip zero-width chars
     let normalized = text.replace(ZERO_WIDTH_CHARS, () => {
         modified = true;
         return '';
     });
-    // Replace confusables
     normalized = normalized.replace(CONFUSABLE_REGEX, (char) => {
         modified = true;
         return CONFUSABLES[char] || char;
     });
     return { normalized, modified };
 }
-/**
- * Detect threats in a string.
- */
+// ── Threat detection ─────────────────────────────────
 function detectThreats(text) {
     const threats = [];
-    // Command injection
     for (const { name, pattern, severity } of COMMAND_INJECTION_PATTERNS) {
         const match = text.match(pattern);
         if (match) {
-            threats.push({
-                type: "command_injection",
-                pattern: name,
-                location: match[0],
-                severity,
-            });
+            threats.push({ type: "command_injection", pattern: name, location: match[0], severity });
         }
     }
-    // Encoding obfuscation
     for (const { name, pattern, severity } of ENCODING_PATTERNS) {
         const match = text.match(pattern);
         if (match) {
-            threats.push({
-                type: "encoding_obfuscation",
-                pattern: name,
-                location: match[0].slice(0, 50),
-                severity,
-            });
+            threats.push({ type: "encoding_obfuscation", pattern: name, location: match[0].slice(0, 50), severity });
         }
     }
-    // Social engineering
     for (const { name, pattern, severity } of SOCIAL_ENGINEERING_PATTERNS) {
         const match = text.match(pattern);
         if (match) {
-            threats.push({
-                type: "social_engineering",
-                pattern: name,
-                location: match[0],
-                severity,
-            });
+            threats.push({ type: "social_engineering", pattern: name, location: match[0], severity });
         }
     }
-    // Network threats
     for (const { name, pattern, severity } of NETWORK_PATTERNS) {
         const match = text.match(pattern);
         if (match) {
+            threats.push({ type: "network_threat", pattern: name, location: match[0], severity });
+        }
+    }
+    return threats;
+}
+function detectPii(text) {
+    if (!isPiiDetectionEnabled())
+        return [];
+    const threats = [];
+    for (const { name, pattern, severity } of PII_PATTERNS) {
+        const match = text.match(pattern);
+        if (match) {
+            threats.push({ type: "pii", pattern: name, location: match[0].slice(0, 30), severity });
+        }
+    }
+    return threats;
+}
+// ── Secret redaction ─────────────────────────────────
+function redactSecrets(text) {
+    const matches = [];
+    let redacted = text;
+    for (const [value, path] of secretValues) {
+        if (redacted.includes(value)) {
+            redacted = redacted.split(value).join(`[REDACTED:${path}]`);
+            matches.push({ path });
+        }
+    }
+    return { redacted, matches };
+}
+// ── Exfiltration detection (secrets in tool inputs) ──
+function detectExfiltration(text) {
+    const mode = getExfilProtectionMode();
+    if (mode === "off")
+        return [];
+    const threats = [];
+    for (const [value, path] of secretValues) {
+        if (text.includes(value)) {
             threats.push({
-                type: "network_threat",
-                pattern: name,
-                location: match[0],
-                severity,
+                type: "secret_exfiltration",
+                pattern: `known_secret:${path}`,
+                severity: "critical",
             });
         }
     }
     return threats;
 }
+// ── Public API ───────────────────────────────────────
 /**
- * Inspect tool input arguments for threats.
+ * Inspect tool input arguments for threats, PII, and secret exfiltration.
  */
 export function inspectInput(toolName, args) {
     if (!isSecurityEnabled()) {
         return { passed: true, threats: [] };
     }
     const text = JSON.stringify(args);
-    // Normalize Unicode first
     const { normalized, modified } = normalizeUnicode(text);
-    // Detect threats
     const threats = detectThreats(normalized);
-    // Add Unicode warnings if modified
     if (modified) {
-        threats.push({
-            type: "unicode_obfuscation",
-            pattern: "confusables_or_zero_width",
-            severity: "medium",
-        });
+        threats.push({ type: "unicode_obfuscation", pattern: "confusables_or_zero_width", severity: "medium" });
+    }
+    threats.push(...detectPii(normalized));
+    if (!SECRET_TOOLS.has(toolName)) {
+        const exfil = detectExfiltration(normalized);
+        threats.push(...exfil);
+        const exfilMode = getExfilProtectionMode();
+        if (exfil.length > 0 && exfilMode === "block") {
+            return { passed: false, threats };
+        }
     }
     const mode = getSanitizationMode();
-    const hasCritical = threats.some((t) => t.severity === "critical");
+    const hasCritical = threats.some((t) => t.severity === "critical" && t.type !== "secret_exfiltration");
     const hasHigh = threats.some((t) => t.severity === "high");
     if (mode === "block" && (hasCritical || hasHigh)) {
         return { passed: false, threats };
@@ -165,14 +233,27 @@ export function inspectInput(toolName, args) {
     return { passed: true, threats };
 }
 /**
- * Inspect tool output for threats (mainly for logging).
+ * Inspect tool output for threats, PII, and optionally redact known secrets.
  */
 export function inspectOutput(toolName, result) {
     if (!isSecurityEnabled()) {
         return { passed: true, threats: [] };
     }
     const threats = detectThreats(result);
-    // Output inspection is typically log-only
+    threats.push(...detectPii(result));
+    if (!SECRET_TOOLS.has(toolName) && isSecretRedactionEnabled()) {
+        const { redacted, matches } = redactSecrets(result);
+        if (matches.length > 0) {
+            for (const m of matches) {
+                threats.push({
+                    type: "secret_leak",
+                    pattern: `redacted:${m.path}`,
+                    severity: "critical",
+                });
+            }
+            return { passed: true, threats, redacted };
+        }
+    }
     return { passed: true, threats };
 }
 //# sourceMappingURL=index.js.map

package/dist/security/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAeH,MAAM,0BAA0B,GAAG;IAC/B,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,0EAA0E,EAAE,QAAQ,EAAE,UAAmB,EAAE;IAC3I,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,qBAAqB,EAAE,QAAQ,EAAE,UAAmB,EAAE;IAC/F,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,qEAAqE,EAAE,QAAQ,EAAE,UAAmB,EAAE;IACxI,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAe,EAAE;IAChF,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,sEAAsE,EAAE,QAAQ,EAAE,MAAe,EAAE;CAC1I,CAAC;AAEF,MAAM,iBAAiB,GAAG;IACtB,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,mEAAmE,EAAE,QAAQ,EAAE,QAAiB,EAAE;IAClI,uFAAuF;IACvF,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,6BAA6B,EAAE,QAAQ,EAAE,QAAiB,EAAE;IAC3F,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,6BAA6B,EAAE,QAAQ,EAAE,QAAiB,EAAE;CAClG,CAAC;AAEF,MAAM,2BAA2B,GAAG;IAChC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,+DAA+D,EAAE,QAAQ,EAAE,QAAiB,EAAE;IAC1H,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,2EAA2E,EAAE,QAAQ,EAAE,MAAe,EAAE;IACtI,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,sEAAsE,EAAE,QAAQ,EAAE,MAAe,EAAE;IAC/H,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,4GAA4G,EAAE,QAAQ,EAAE,UAAmB,EAAE;IACxK,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,8GAA8G,EAAE,QAAQ,EAAE,UAAmB,EAAE;CACzL,CAAC;AAEF,MAAM,gBAAgB,GAAG;IACrB,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,2BAA2B,EAAE,QAAQ,EAAE,MAAe,EAAE;IAClF,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAe,EAAE;IAC1E,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,+CAA+C,EAAE,QAAQ,EAAE,QAAiB,EAAE;IACzG,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,mDAAmD,EAAE,QAAQ,EAAE,UAAmB,EAAE;CACtH,CAAC;AAEF,sCAAsC;AACtC,MAAM,gBAAgB,GAAG,gFAAgF,CAAC;AAE1G,6BAA6B;AAC7B,MAAM,WAAW,GAA2B;IACxC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IAC1D,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IAC1D,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IAC1D,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IAC1D,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;CAC7D,CAAC;AAEF,MAAM,gBAAgB,GAAG,IAAI,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AAEnF;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC7B,OAAO,OAAO,CAAC,GAAG,CAAC,4BAA4B,KAAK,OAAO,CAAC;AAChE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB;IAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC;IACvD,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IACzC,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,yBAAyB;IACzB,IAAI,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,EAAE;QACjD,QAAQ,GAAG,IAAI,CAAC;QAChB,OAAO,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,sBAAsB;IACtB,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,IAAI,EAAE,EAAE;QACvD,QAAQ,GAAG,IAAI,CAAC;QAChB,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AACpC,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,IAAY;IAC/B,MAAM,OAAO,GAAsB,EAAE,CAAC;IAEtC,oBAAoB;IACpB,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,0BAA0B,EAAE,CAAC;QACnE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,KAAK,EAAE,CAAC;YACR,OAAO,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;gBAClB,QAAQ;aACX,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,uBAAuB;IACvB,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,iBAAiB,EAAE,CAAC;QAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,KAAK,EAAE,CAAC;YACR,OAAO,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;gBAC/B,QAAQ;aACX,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,qBAAqB;IACrB,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,2BAA2B,EAAE,CAAC;QACpE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,KAAK,EAAE,CAAC;YACR,OAAO,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;gBAClB,QAAQ;aACX,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,kBAAkB;IAClB,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,gBAAgB,EAAE,CAAC;QACzD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,KAAK,EAAE,CAAC;YACR,OAAO,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;gBAClB,QAAQ;aACX,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,IAAa;IACxD,IAAI,CAAC,iBAAiB,EAAE,EAAE,CAAC;QACvB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACzC,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAElC,0BAA0B;IAC1B,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAExD,iBAAiB;IACjB,MAAM,OAAO,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IAE1C,mCAAmC;IACnC,IAAI,QAAQ,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,2BAA2B;YACpC,QAAQ,EAAE,QAAQ;SACrB,CAAC,CAAC;IACP,CAAC;IAED,MAAM,IAAI,GAAG,mBAAmB,EAAE,CAAC;IACnC,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC;IAE3D,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC,EAAE,CAAC;QAC/C,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IACtC,CAAC;IAED,IAAI,IAAI,KAAK,UAAU,IAAI,QAAQ,EAAE,CAAC;QAClC,IAAI,CAAC;YACD,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAC7C,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC;QAC/E,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACrC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACrC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,MAAc;IAC1D,IAAI,CAAC,iBAAiB,EAAE,EAAE,CAAC;QACvB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACzC,CAAC;IAED,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAEtC,0CAA0C;IAC1C,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACrC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAgBH,wDAAwD;AAExD,MAAM,0BAA0B,GAAG;IAC/B,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,0EAA0E,EAAE,QAAQ,EAAE,UAAmB,EAAE;IAC3I,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,qBAAqB,EAAE,QAAQ,EAAE,UAAmB,EAAE;IAC/F,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,qEAAqE,EAAE,QAAQ,EAAE,UAAmB,EAAE;IACxI,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAe,EAAE;IAChF,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,sEAAsE,EAAE,QAAQ,EAAE,MAAe,EAAE;CAC1I,CAAC;AAEF,MAAM,iBAAiB,GAAG;IACtB,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,mEAAmE,EAAE,QAAQ,EAAE,QAAiB,EAAE;IAClI,uFAAuF;IACvF,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,6BAA6B,EAAE,QAAQ,EAAE,QAAiB,EAAE;IAC3F,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,6BAA6B,EAAE,QAAQ,EAAE,QAAiB,EAAE;CAClG,CAAC;AAEF,MAAM,2BAA2B,GAAG;IAChC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,+DAA+D,EAAE,QAAQ,EAAE,QAAiB,EAAE;IAC1H,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,2EAA2E,EAAE,QAAQ,EAAE,MAAe,EAAE;IACtI,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,sEAAsE,EAAE,QAAQ,EAAE,MAAe,EAAE;IAC/H,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,4GAA4G,EAAE,QAAQ,EAAE,UAAmB,EAAE;IACxK,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,8GAA8G,EAAE,QAAQ,EAAE,UAAmB,EAAE;CACzL,CAAC;AAEF,MAAM,gBAAgB,GAAG;IACrB,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,2BAA2B,EAAE,QAAQ,EAAE,MAAe,EAAE;IAClF,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAe,EAAE;IAC1E,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,+CAA+C,EAAE,QAAQ,EAAE,QAAiB,EAAE;IACzG,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,mDAAmD,EAAE,QAAQ,EAAE,UAAmB,EAAE;CACtH,CAAC;AAEF,MAAM,YAAY,GAAG;IACjB,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,gDAAgD,EAAE,QAAQ,EAAE,QAAiB,EAAE;IACzG,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE,QAAQ,EAAE,UAAmB,EAAE;IAChF,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,uFAAuF,EAAE,QAAQ,EAAE,UAAmB,EAAE;IACxJ,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,kDAAkD,EAAE,QAAQ,EAAE,KAAc,EAAE;IAC3G,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,+BAA+B,EAAE,QAAQ,EAAE,UAAmB,EAAE;IAC5F,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,wDAAwD,EAAE,QAAQ,EAAE,UAAmB,EAAE;CACnI,CAAC;AAEF,sCAAsC;AACtC,MAAM,gBAAgB,GAAG,gFAAgF,CAAC;AAE1G,6BAA6B;AAC7B,MAAM,WAAW,GAA2B;IACxC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IAC1D,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IAC1D,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IAC1D,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IAC1D,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;CAC7D,CAAC;AAEF,MAAM,gBAAgB,GAAG,IAAI,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AAEnF,gEAAgE;AAEhE,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAC5B,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE/C,8DAA8D;AAC9D,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IACzB,YAAY;IACZ,gBAAgB;IAChB,YAAY;IACZ,kBAAkB;CACrB,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,KAAa;IACtD,IAAI,KAAK,CAAC,MAAM,IAAI,iBAAiB,EAAE,CAAC;QACpC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY;IACxB,YAAY,CAAC,KAAK,EAAE,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB;IAC9B,OAAO,YAAY,CAAC,IAAI,CAAC;AAC7B,CAAC;AAED,wDAAwD;AAExD,MAAM,UAAU,iBAAiB;IAC7B,OAAO,OAAO,CAAC,GAAG,CAAC,4BAA4B,KAAK,OAAO,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,wBAAwB;IACpC,IAAI,CAAC,iBAAiB,EAAE;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,OAAO,CAAC,GAAG,CAAC,0BAA0B,KAAK,OAAO,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,qBAAqB;IACjC,IAAI,CAAC,iBAAiB,EAAE;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,OAAO,CAAC,GAAG,CAAC,yBAAyB,KAAK,OAAO,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,sBAAsB;IAClC,IAAI,CAAC,iBAAiB,EAAE;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;IACtD,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,mBAAmB;IAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC;IACvD,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC;AAED,wDAAwD;AAExD,MAAM,UAAU,gBAAgB,CAAC,IAAY;IACzC,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,IAAI,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,EAAE;QACjD,QAAQ,GAAG,IAAI,CAAC;QAChB,OAAO,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,IAAI,EAAE,EAAE;QACvD,QAAQ,GAAG,IAAI,CAAC;QAChB,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AACpC,CAAC;AAED,wDAAwD;AAExD,SAAS,aAAa,CAAC,IAAY;IAC/B,MAAM,OAAO,GAAsB,EAAE,CAAC;IAEtC,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,0BAA0B,EAAE,CAAC;QACnE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,KAAK,EAAE,CAAC;YACR,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC7F,CAAC;IACL,CAAC;IAED,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,iBAAiB,EAAE,CAAC;QAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,KAAK,EAAE,CAAC;YACR,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC7G,CAAC;IACL,CAAC;IAED,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,2BAA2B,EAAE,CAAC;QACpE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,KAAK,EAAE,CAAC;YACR,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC9F,CAAC;IACL,CAAC;IAED,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,gBAAgB,EAAE,CAAC;QACzD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,KAAK,EAAE,CAAC;YACR,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC1F,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACnB,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC3B,IAAI,CAAC,qBAAqB,EAAE;QAAE,OAAO,EAAE,CAAC;IACxC,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,YAAY,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,KAAK,EAAE,CAAC;YACR,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC5F,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC;AAED,wDAAwD;AAExD,SAAS,aAAa,CAAC,IAAY;IAC/B,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,YAAY,EAAE,CAAC;QACvC,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,aAAa,IAAI,GAAG,CAAC,CAAC;YAC5D,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3B,CAAC;IACL,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AACjC,CAAC;AAED,wDAAwD;AAExD,SAAS,kBAAkB,CAAC,IAAY;IACpC,MAAM,IAAI,GAAG,sBAAsB,EAAE,CAAC;IACtC,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,YAAY,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,gBAAgB,IAAI,EAAE;gBAC/B,QAAQ,EAAE,UAAU;aACvB,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC;AAED,wDAAwD;AAExD;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,IAAa;IACxD,IAAI,CAAC,iBAAiB,EAAE,EAAE,CAAC;QACvB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACzC,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IAE1C,IAAI,QAAQ,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,2BAA2B,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC5G,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;IAEvC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;QACvB,MAAM,SAAS,GAAG,sBAAsB,EAAE,CAAC;QAC3C,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YAC5C,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QACtC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,mBAAmB,EAAE,CAAC;IACnC,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,IAAI,KAAK,qBAAqB,CAAC,CAAC;IACvG,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC;IAE3D,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC,EAAE,CAAC;QAC/C,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IACtC,CAAC;IAED,IAAI,IAAI,KAAK,UAAU,IAAI,QAAQ,EAAE,CAAC;QAClC,IAAI,CAAC;YACD,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAC7C,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC;QAC/E,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACrC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACrC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,MAAc;IAC1D,IAAI,CAAC,iBAAiB,EAAE,EAAE,CAAC;QACvB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACzC,CAAC;IAED,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAEnC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,wBAAwB,EAAE,EAAE,CAAC;QAC5D,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACtB,OAAO,CAAC,IAAI,CAAC;oBACT,IAAI,EAAE,aAAa;oBACnB,OAAO,EAAE,YAAY,CAAC,CAAC,IAAI,EAAE;oBAC7B,QAAQ,EAAE,UAAU;iBACvB,CAAC,CAAC;YACP,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QAC/C,CAAC;IACL,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACrC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@1claw/mcp",
-    "version": "0.11.0",
+    "version": "0.13.0",
     "description": "MCP server for the 1claw secrets vault — lets AI agents fetch, store, and manage secrets at runtime",
     "type": "module",
     "main": "dist/index.js",