@agentdocstore/core 0.2.0

package/dist/model/limits.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Size caps enforced across the app. Content is capped at write time (never
+ * stored oversized); the diff-input cap bounds the diff engine's inputs.
+ */
+export declare const LIMITS: {
+    /** Max doc title length in UTF-8 bytes. */
+    readonly MAX_TITLE_BYTES: 300;
+    /** Max stored content per version in UTF-8 bytes (write-time reject). */
+    readonly MAX_CONTENT_BYTES: number;
+    /**
+     * Max JSON request body in UTF-8 bytes. JSON writes a quote, backslash,
+     * newline or tab as two bytes, so the body of a write can be twice its
+     * content; this leaves room for that at MAX_CONTENT_BYTES, plus 1 MiB for
+     * the other fields. (Other control characters take six bytes each; text
+     * made of those can still pass it.)
+     */
+    readonly MAX_REQUEST_BYTES: number;
+    /** Max input size (per side) accepted by the diff engine in UTF-8 bytes. */
+    readonly MAX_DIFF_INPUT_BYTES: number;
+    /**
+     * Max lines a diff may add or remove. Finding a diff costs time that grows
+     * with the square of the lines that differ, and it runs on the server's
+     * only thread, so versions that share few lines could stall every other
+     * request for minutes; past this the diff engine stops and refuses.
+     */
+    readonly MAX_DIFF_CHANGED_LINES: 5000;
+    /** Max comment body length in UTF-8 bytes. */
+    readonly MAX_COMMENT_BYTES: 10000;
+    /** Max edit message length in characters, after trimming. */
+    readonly MAX_EDIT_MESSAGE_CHARS: 500;
+    /** Longest expiry, in days from now (about 100 years). Much further is not a date. */
+    readonly MAX_EXPIRY_DAYS: 36500;
+};
+/** The shape of {@link LIMITS}. */
+export type Limits = typeof LIMITS;
+/**
+ * The detail for a size-limit error: "10976 bytes; the limit is 10000 bytes".
+ * Size errors carry it so a REST or MCP client learns how much to cut, not
+ * only that the value was too big.
+ */
+export declare function sizeOverLimit(size: number, limit: number): string;
+//# sourceMappingURL=limits.d.ts.map

package/dist/model/limits.js

@@ -0,0 +1,43 @@
+const MAX_CONTENT_BYTES = 5 * 1024 * 1024;
+/**
+ * Size caps enforced across the app. Content is capped at write time (never
+ * stored oversized); the diff-input cap bounds the diff engine's inputs.
+ */
+export const LIMITS = {
+    /** Max doc title length in UTF-8 bytes. */
+    MAX_TITLE_BYTES: 300,
+    /** Max stored content per version in UTF-8 bytes (write-time reject). */
+    MAX_CONTENT_BYTES,
+    /**
+     * Max JSON request body in UTF-8 bytes. JSON writes a quote, backslash,
+     * newline or tab as two bytes, so the body of a write can be twice its
+     * content; this leaves room for that at MAX_CONTENT_BYTES, plus 1 MiB for
+     * the other fields. (Other control characters take six bytes each; text
+     * made of those can still pass it.)
+     */
+    MAX_REQUEST_BYTES: 2 * MAX_CONTENT_BYTES + 1024 * 1024,
+    /** Max input size (per side) accepted by the diff engine in UTF-8 bytes. */
+    MAX_DIFF_INPUT_BYTES: 2 * 1024 * 1024,
+    /**
+     * Max lines a diff may add or remove. Finding a diff costs time that grows
+     * with the square of the lines that differ, and it runs on the server's
+     * only thread, so versions that share few lines could stall every other
+     * request for minutes; past this the diff engine stops and refuses.
+     */
+    MAX_DIFF_CHANGED_LINES: 5_000,
+    /** Max comment body length in UTF-8 bytes. */
+    MAX_COMMENT_BYTES: 10_000,
+    /** Max edit message length in characters, after trimming. */
+    MAX_EDIT_MESSAGE_CHARS: 500,
+    /** Longest expiry, in days from now (about 100 years). Much further is not a date. */
+    MAX_EXPIRY_DAYS: 36_500,
+};
+/**
+ * The detail for a size-limit error: "10976 bytes; the limit is 10000 bytes".
+ * Size errors carry it so a REST or MCP client learns how much to cut, not
+ * only that the value was too big.
+ */
+export function sizeOverLimit(size, limit) {
+    return `${size} bytes; the limit is ${limit} bytes`;
+}
+//# sourceMappingURL=limits.js.map

package/dist/model/title.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Reject a title the built-in providers would refuse: blank, or longer than
+ * {@link LIMITS.MAX_TITLE_BYTES} bytes of UTF-8. REST and MCP call this before
+ * their first write, so an update with a bad title saves nothing — the
+ * provider's own check would only fire after the new version was stored.
+ */
+export declare function validateTitle(title: string): void;
+//# sourceMappingURL=title.d.ts.map

package/dist/model/title.js

@@ -0,0 +1,17 @@
+import { ValidationError } from '../errors.js';
+import { LIMITS, sizeOverLimit } from './limits.js';
+/**
+ * Reject a title the built-in providers would refuse: blank, or longer than
+ * {@link LIMITS.MAX_TITLE_BYTES} bytes of UTF-8. REST and MCP call this before
+ * their first write, so an update with a bad title saves nothing — the
+ * provider's own check would only fire after the new version was stored.
+ */
+export function validateTitle(title) {
+    if (title.trim().length === 0)
+        throw new ValidationError('Title must not be empty');
+    const size = Buffer.byteLength(title, 'utf8');
+    if (size > LIMITS.MAX_TITLE_BYTES) {
+        throw new ValidationError(`Title exceeds maximum length (${sizeOverLimit(size, LIMITS.MAX_TITLE_BYTES)})`);
+    }
+}
+//# sourceMappingURL=title.js.map

package/dist/model/version.d.ts

@@ -0,0 +1,20 @@
+/**
+ * An immutable version of a {@link Document}'s content. Versions are append-only and
+ * addressed by a 1-based monotonic number; the doc's `latestVersion` points at
+ * the newest one.
+ */
+export interface DocumentVersion {
+    /** Owning doc id. */
+    readonly documentId: string;
+    /** 1-based monotonic version number. */
+    readonly version: number;
+    /** Raw content of this version. */
+    readonly content: string;
+    /** Identity that authored this version. */
+    readonly createdBy: string;
+    /** ISO-8601 creation timestamp. */
+    readonly createdAt: string;
+    /** Optional note from the editor describing this change. */
+    readonly message?: string;
+}
+//# sourceMappingURL=version.d.ts.map

package/dist/model/version.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=version.js.map

package/dist/offline.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Runtime mode policy.
+ *
+ * AgentDocStore is offline by default and you opt OUT, never in. `offline` is not
+ * a decoration: this module is the single place that decides whether a given
+ * (mode, host, provider) combination is allowed, and the CLI refuses to start
+ * when it says no. The complementary runtime guard — severing actual outbound
+ * sockets — lives in the CLI, because it patches process globals; this module
+ * stays pure so it can be unit-tested and reused by a fork's own host process.
+ */
+import type { Capabilities } from './spi/capabilities.js';
+/**
+ * `offline` — loopback only, local provider only, outbound egress fused.
+ * `networked` — the operator has explicitly accepted egress and remote binding.
+ */
+export type RuntimeMode = 'offline' | 'networked';
+export declare const RUNTIME_MODES: readonly RuntimeMode[];
+export declare function isRuntimeMode(value: unknown): value is RuntimeMode;
+/**
+ * True when a host names this machine and nothing else.
+ *
+ * `localhost` is included because that is what an operator types, even though it
+ * resolves through DNS. Deliberately excluded: `0.0.0.0` and `::` — as a bind
+ * address they mean *every* interface, which is exactly what offline mode is
+ * meant to prevent.
+ */
+export declare function isLoopbackHost(host: string): boolean;
+export interface OfflinePolicyInput {
+    mode: RuntimeMode;
+    /** The address the server will bind, when it will bind one. */
+    host?: string;
+    /**
+     * The operator has explicitly accepted INBOUND exposure on a non-loopback
+     * address. Orthogonal to {@link RuntimeMode}: a container binding `0.0.0.0`
+     * inside its own network namespace is reachable only through a port mapping
+     * the operator chose, and says nothing about egress. Keeping the two separate
+     * is what lets a Docker deployment stay offline (fused egress, local store)
+     * while still serving.
+     */
+    expose?: boolean;
+    /** Capabilities of the provider that is about to be used. */
+    capabilities?: Pick<Capabilities, 'requiresNetwork'>;
+    /** Provider name, for a message that points at the actual culprit. */
+    providerName?: string;
+}
+/**
+ * Throw {@link OfflineViolationError} when the requested configuration would
+ * break the offline guarantee. A no-op in `networked` mode — that mode's whole
+ * purpose is to be permitted.
+ *
+ * Two independent clauses:
+ *  - the bind address, unless `expose` was set (inbound exposure);
+ *  - the provider's own network requirement (outbound egress), which `expose`
+ *    deliberately does NOT waive.
+ */
+export declare function assertOfflinePolicy(input: OfflinePolicyInput): void;
+//# sourceMappingURL=offline.d.ts.map

package/dist/offline.js

@@ -0,0 +1,58 @@
+/**
+ * Runtime mode policy.
+ *
+ * AgentDocStore is offline by default and you opt OUT, never in. `offline` is not
+ * a decoration: this module is the single place that decides whether a given
+ * (mode, host, provider) combination is allowed, and the CLI refuses to start
+ * when it says no. The complementary runtime guard — severing actual outbound
+ * sockets — lives in the CLI, because it patches process globals; this module
+ * stays pure so it can be unit-tested and reused by a fork's own host process.
+ */
+import { OfflineViolationError } from './errors.js';
+export const RUNTIME_MODES = ['offline', 'networked'];
+export function isRuntimeMode(value) {
+    return value === 'offline' || value === 'networked';
+}
+/** IPv4 loopback is the whole 127.0.0.0/8 block, not just 127.0.0.1. */
+const IPV4_LOOPBACK = /^127(?:\.(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}$/;
+/**
+ * True when a host names this machine and nothing else.
+ *
+ * `localhost` is included because that is what an operator types, even though it
+ * resolves through DNS. Deliberately excluded: `0.0.0.0` and `::` — as a bind
+ * address they mean *every* interface, which is exactly what offline mode is
+ * meant to prevent.
+ */
+export function isLoopbackHost(host) {
+    const h = host
+        .trim()
+        .toLowerCase()
+        .replace(/^\[|\]$/g, '');
+    if (h === 'localhost' || h === '::1' || h === '0:0:0:0:0:0:0:1')
+        return true;
+    return IPV4_LOOPBACK.test(h);
+}
+/**
+ * Throw {@link OfflineViolationError} when the requested configuration would
+ * break the offline guarantee. A no-op in `networked` mode — that mode's whole
+ * purpose is to be permitted.
+ *
+ * Two independent clauses:
+ *  - the bind address, unless `expose` was set (inbound exposure);
+ *  - the provider's own network requirement (outbound egress), which `expose`
+ *    deliberately does NOT waive.
+ */
+export function assertOfflinePolicy(input) {
+    if (input.mode === 'networked')
+        return;
+    if (input.host !== undefined && input.expose !== true && !isLoopbackHost(input.host)) {
+        throw new OfflineViolationError(`Offline mode refuses to bind '${input.host}': only loopback addresses are permitted.`, 'host', 'Pass --expose to accept inbound connections while staying offline, or ' +
+            '--networked to also allow egress.');
+    }
+    if (input.capabilities?.requiresNetwork === true) {
+        const name = input.providerName ?? 'the configured provider';
+        throw new OfflineViolationError(`Offline mode refuses provider '${name}': it declares requiresNetwork=true.`, 'provider', 'Use a local provider (fs, memory), or pass --networked to allow egress. ' +
+            '--expose does not waive this: it governs inbound only.');
+    }
+}
+//# sourceMappingURL=offline.js.map

package/dist/scanner.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Dependency-free credential scanner.
+ *
+ * `scan` detects secrets and credentials in text content by matching known
+ * patterns (PEM keys, AWS keys, JWTs, bearer tokens, platform tokens, generic
+ * assignments, connection strings). `redact` replaces detected spans with
+ * placeholder tags.
+ *
+ * Design constraints:
+ *   - Every regex quantifier is bounded to prevent catastrophic backtracking.
+ *   - The generic-assignment pattern is tuned to skip obvious placeholders.
+ *   - No external dependencies.
+ */
+/** A single credential finding within scanned content. */
+export interface Finding {
+    /** Credential type identifier (e.g. `'pem-private-key'`, `'aws-access-key'`). */
+    readonly type: string;
+    /** 1-based line number where the finding starts. */
+    readonly line: number;
+    /** Absolute byte offset of the match start within `content`. */
+    readonly start: number;
+    /** Absolute byte offset of the match end (exclusive) within `content`. */
+    readonly end: number;
+}
+/**
+ * Scan `content` for credential-like patterns.
+ *
+ * Returns an immutable array of {@link Finding} objects sorted by `start`
+ * offset. Overlapping findings are deduplicated: when two patterns match
+ * overlapping spans, the longer match wins.
+ *
+ * @param content - The text to scan (source code, config files, etc.).
+ * @returns Detected credential findings, sorted by offset.
+ */
+export declare function scan(content: string): readonly Finding[];
+/**
+ * Replace each finding span in `content` with `[REDACTED:<type>]`.
+ *
+ * Replacements are applied right-to-left so that earlier offsets remain valid
+ * even when replacement text differs in length from the original span.
+ *
+ * @param content  - The original text.
+ * @param findings - Findings from {@link scan} (or a subset).
+ * @returns The redacted text.
+ */
+export declare function redact(content: string, findings: readonly Finding[]): string;
+//# sourceMappingURL=scanner.d.ts.map

package/dist/scanner.js

@@ -0,0 +1,294 @@
+/**
+ * Dependency-free credential scanner.
+ *
+ * `scan` detects secrets and credentials in text content by matching known
+ * patterns (PEM keys, AWS keys, JWTs, bearer tokens, platform tokens, generic
+ * assignments, connection strings). `redact` replaces detected spans with
+ * placeholder tags.
+ *
+ * Design constraints:
+ *   - Every regex quantifier is bounded to prevent catastrophic backtracking.
+ *   - The generic-assignment pattern is tuned to skip obvious placeholders.
+ *   - No external dependencies.
+ */
+/**
+ * Placeholder values that the generic-assignment pattern must skip.
+ * Lowercased for comparison.
+ */
+const PLACEHOLDER_VALUES = new Set([
+    '',
+    'changeme',
+    'xxx',
+    'xxxx',
+    'xxxxx',
+    'example',
+    'redacted',
+    'todo',
+    'fixme',
+    'placeholder',
+    'your-password',
+    'your-secret',
+    'your-token',
+    'your-api-key',
+]);
+/** Returns true when a value looks like a placeholder rather than a real secret. */
+function isPlaceholder(value) {
+    const trimmed = value.replace(/^["'`]+|["'`]+$/g, '').trim();
+    if (trimmed.length === 0)
+        return true;
+    const lower = trimmed.toLowerCase();
+    if (PLACEHOLDER_VALUES.has(lower))
+        return true;
+    // Template / env-var references: ${VAR}, $VAR, {{VAR}}, <your-password>
+    if (/^\$\{[^}]{1,80}\}$/.test(trimmed))
+        return true;
+    if (/^\$[A-Z_][A-Z0-9_]{0,80}$/.test(trimmed))
+        return true;
+    if (/^\{\{[^}]{1,80}\}\}$/.test(trimmed))
+        return true;
+    if (/^<[^>]{1,80}>$/.test(trimmed))
+        return true;
+    return false;
+}
+const PATTERNS = [
+    {
+        type: 'aws-access-key',
+        // AWS access key IDs start with AKIA (long-term) or ASIA (temporary/STS).
+        // Followed by exactly 16 uppercase alphanumeric characters.
+        regex: /(?:^|[^A-Z0-9])(?:AKIA|ASIA)[A-Z0-9]{16}(?=[^A-Z0-9]|$)/gm,
+        comment: 'AWS access key IDs (AKIA/ASIA prefix + 16 uppercase alphanumerics)',
+    },
+    {
+        type: 'aws-secret-key',
+        // AWS secret access keys are 40 characters of base64-like characters.
+        // Anchored behind a keyword to reduce false positives.
+        regex: /(?:aws_secret_access_key|secret_access_key|SecretAccessKey)[\s]*[=:"']\s*[A-Za-z0-9/+=]{40}(?=[^A-Za-z0-9/+=]|$)/gi,
+        comment: 'AWS secret access key shapes (keyword + 40 base64 chars)',
+    },
+    {
+        type: 'jwt',
+        // JWTs are three dot-separated base64url segments. Header is short (< 512),
+        // payload moderate (< 4096), signature moderate (< 1024).
+        regex: /eyJ[A-Za-z0-9_-]{4,512}\.eyJ[A-Za-z0-9_-]{4,4096}\.[A-Za-z0-9_-]{4,1024}/g,
+        comment: 'JSON Web Tokens (three base64url dot-separated segments starting with eyJ)',
+    },
+    {
+        type: 'bearer-token',
+        // Bearer or OAuth tokens in Authorization-style headers.
+        regex: /[Bb]earer\s+[A-Za-z0-9_\-.~+/]{20,1024}/g,
+        comment: 'Bearer / OAuth tokens in authorization headers or config',
+    },
+    {
+        type: 'github-token',
+        // GitHub PAT / OAuth / user / server / refresh tokens.
+        regex: /gh[pousr]_[A-Za-z0-9_]{36,255}/g,
+        comment: 'GitHub tokens (ghp_, gho_, ghu_, ghs_, ghr_ prefixes)',
+    },
+    {
+        type: 'gitlab-token',
+        // GitLab personal access tokens.
+        regex: /glpat-[A-Za-z0-9_-]{20,255}/g,
+        comment: 'GitLab personal access tokens (glpat- prefix)',
+    },
+    {
+        type: 'slack-token',
+        // Slack bot, app, user, workspace, and refresh tokens.
+        regex: /xox[abprs]-[A-Za-z0-9-]{10,255}/g,
+        comment: 'Slack tokens (xoxb-, xoxa-, xoxp-, xoxr-, xoxs- prefixes)',
+    },
+    {
+        type: 'connection-string-password',
+        // scheme://user:password@host — captures the password portion.
+        // Password bounded to 256 chars; scheme, user, and host also bounded.
+        regex: /[a-zA-Z][a-zA-Z0-9+.-]{1,30}:\/\/[^\s:@]{1,128}:([^\s@]{1,256})@[^\s]{1,512}/g,
+        comment: 'Connection-string embedded passwords (scheme://user:password@host)',
+    },
+];
+/**
+ * PEM / OpenSSH private key blocks: a BEGIN line, 1 to 16,384 characters, then
+ * the first END line after them. The kind named on the two lines need not
+ * agree. This finds what
+ * `/-----BEGIN …PRIVATE KEY-----[\s\S]{1,16384}?-----END …PRIVATE KEY-----/g`
+ * finds, in one pass: that regex tried up to 16,384 positions for an END line
+ * after every BEGIN line, so text made of BEGIN lines alone took about a
+ * second per megabyte.
+ */
+const PEM_BEGIN_REGEX = /-----BEGIN (?:RSA |DSA |EC |OPENSSH |ENCRYPTED )?PRIVATE KEY-----/g;
+const PEM_END_REGEX = /-----END (?:RSA |DSA |EC |OPENSSH |ENCRYPTED )?PRIVATE KEY-----/g;
+const PEM_MAX_BODY = 16_384;
+function pemPrivateKeyBlocks(content) {
+    // Every place an END line starts, in order; overlapping ones included.
+    const ends = [];
+    PEM_END_REGEX.lastIndex = 0;
+    for (let m = PEM_END_REGEX.exec(content); m !== null; m = PEM_END_REGEX.exec(content)) {
+        ends.push({ start: m.index, end: m.index + m[0].length });
+        PEM_END_REGEX.lastIndex = m.index + 1;
+    }
+    const blocks = [];
+    let next = 0; // the first END line that could still close a block
+    PEM_BEGIN_REGEX.lastIndex = 0;
+    for (let m = PEM_BEGIN_REGEX.exec(content); m !== null; m = PEM_BEGIN_REGEX.exec(content)) {
+        const bodyStart = m.index + m[0].length;
+        // The body has at least one character, so an END must start after it.
+        while (next < ends.length && (ends[next]?.start ?? Infinity) <= bodyStart)
+            next++;
+        const end = ends[next];
+        if (end !== undefined && end.start - bodyStart <= PEM_MAX_BODY) {
+            blocks.push({ start: m.index, end: end.end });
+            PEM_BEGIN_REGEX.lastIndex = end.end;
+        }
+        else {
+            // As the regex did: look for the next block from one character on.
+            PEM_BEGIN_REGEX.lastIndex = m.index + 1;
+        }
+    }
+    return blocks;
+}
+/**
+ * Generic assignment pattern built separately because it requires a
+ * placeholder filter post-match.
+ *
+ * Matches: password = "value", api_key: 'value', token=value, and forms where
+ * the keyword is embedded in a longer identifier such as
+ * `aws_secret_access_key = ...`, `client_secret_id: ...` or `AUTH_TOKEN_V2=...`.
+ * The trailing `[A-Za-z0-9_.-]{0,64}` is what admits those: without it the
+ * keyword had to sit immediately before the separator, which missed the most
+ * common real-world config naming conventions. For a credential scanner a
+ * false negative is worse than a false positive, and the placeholder filter
+ * below absorbs the extra noise.
+ *
+ * That identifier tail is bounded because each keyword starts a match of its
+ * own: unbounded, every "token" in "tokentoken…" re-read the rest of the run,
+ * so the scan took time growing with the square of the input (256 KB took
+ * 13 s).
+ *
+ * The keywords and the value are captured so the placeholder filter can
+ * inspect the value group.
+ */
+const GENERIC_ASSIGNMENT_REGEX = /(?:password|passwd|secret|api_key|apikey|token)[A-Za-z0-9_.-]{0,64}\s*[=:]\s*["'`]?([^\s"'`]{1,512})["'`]?/gi;
+// ---------------------------------------------------------------------------
+// Implementation
+// ---------------------------------------------------------------------------
+/**
+ * The offset of every newline in `content`, in order. Found once per scan, so
+ * each finding's line is a binary search: counting from the start of the
+ * content for every finding made a finding on every line take time growing
+ * with the square of the content.
+ */
+function newlineOffsets(content) {
+    const offsets = [];
+    for (let i = content.indexOf('\n'); i !== -1; i = content.indexOf('\n', i + 1)) {
+        offsets.push(i);
+    }
+    return offsets;
+}
+/**
+ * The 1-based line number of `offset`: one more than the newlines before it.
+ */
+function lineNumberAt(newlines, offset) {
+    let lo = 0;
+    let hi = newlines.length;
+    while (lo < hi) {
+        const mid = (lo + hi) >>> 1;
+        if ((newlines[mid] ?? Infinity) < offset)
+            lo = mid + 1;
+        else
+            hi = mid;
+    }
+    return lo + 1;
+}
+/**
+ * Scan `content` for credential-like patterns.
+ *
+ * Returns an immutable array of {@link Finding} objects sorted by `start`
+ * offset. Overlapping findings are deduplicated: when two patterns match
+ * overlapping spans, the longer match wins.
+ *
+ * @param content - The text to scan (source code, config files, etc.).
+ * @returns Detected credential findings, sorted by offset.
+ */
+export function scan(content) {
+    const raw = [];
+    let newlines;
+    const lineOf = (offset) => lineNumberAt((newlines ??= newlineOffsets(content)), offset);
+    for (const block of pemPrivateKeyBlocks(content)) {
+        raw.push({ type: 'pem-private-key', line: lineOf(block.start), ...block });
+    }
+    // Run each fixed pattern.
+    for (const pat of PATTERNS) {
+        pat.regex.lastIndex = 0;
+        let m;
+        while ((m = pat.regex.exec(content)) !== null) {
+            let matchStart = m.index;
+            let matchStr = m[0];
+            // For aws-access-key, the leading non-alphanumeric char is a lookaround
+            // workaround. Trim it from the match span if present.
+            if (pat.type === 'aws-access-key' && matchStr.length > 20) {
+                matchStart += matchStr.length - 20;
+                matchStr = matchStr.slice(matchStr.length - 20);
+            }
+            // For connection-string-password, narrow the finding to the password
+            // capture group (group 1).
+            if (pat.type === 'connection-string-password' && m[1] !== undefined) {
+                const pwdOffset = m[0].indexOf(':' + m[1] + '@');
+                if (pwdOffset !== -1) {
+                    matchStart = m.index + pwdOffset + 1; // skip the ':'
+                    matchStr = m[1];
+                }
+            }
+            raw.push({
+                type: pat.type,
+                line: lineOf(matchStart),
+                start: matchStart,
+                end: matchStart + matchStr.length,
+            });
+        }
+    }
+    // Run the generic assignment pattern with placeholder filtering.
+    GENERIC_ASSIGNMENT_REGEX.lastIndex = 0;
+    let gm;
+    while ((gm = GENERIC_ASSIGNMENT_REGEX.exec(content)) !== null) {
+        const value = gm[1] ?? '';
+        if (isPlaceholder(value))
+            continue;
+        raw.push({
+            type: 'generic-secret',
+            line: lineOf(gm.index),
+            start: gm.index,
+            end: gm.index + gm[0].length,
+        });
+    }
+    // Sort by start offset ascending, then by length descending for overlap tie-breaking.
+    raw.sort((a, b) => a.start - b.start || b.end - b.start - (a.end - a.start));
+    // Deduplicate overlapping findings: keep the first (longest at each offset).
+    const deduped = [];
+    let lastEnd = -1;
+    for (const f of raw) {
+        if (f.start >= lastEnd) {
+            deduped.push(f);
+            lastEnd = f.end;
+        }
+    }
+    return deduped;
+}
+/**
+ * Replace each finding span in `content` with `[REDACTED:<type>]`.
+ *
+ * Replacements are applied right-to-left so that earlier offsets remain valid
+ * even when replacement text differs in length from the original span.
+ *
+ * @param content  - The original text.
+ * @param findings - Findings from {@link scan} (or a subset).
+ * @returns The redacted text.
+ */
+export function redact(content, findings) {
+    // Work on a copy of findings sorted by start offset descending (right-to-left).
+    const sorted = [...findings].sort((a, b) => b.start - a.start);
+    let result = content;
+    for (const f of sorted) {
+        const tag = `[REDACTED:${f.type}]`;
+        result = result.slice(0, f.start) + tag + result.slice(f.end);
+    }
+    return result;
+}
+//# sourceMappingURL=scanner.js.map

package/dist/search/CoreSearchIndex.d.ts

@@ -0,0 +1,21 @@
+import type { SearchDoc, SearchIndex, SearchQueryOptions, SearchResults } from '../spi/search.js';
+/**
+ * The default {@link SearchIndex} implementation, backed by MiniSearch. Used by
+ * any provider whose {@link Capabilities.search} is `'core-fallback'`.
+ *
+ * `query` returns PUBLIC hits plus the viewer's own PRIVATE hits — a PRIVATE
+ * doc owned by someone else is never returned.
+ */
+export declare class CoreSearchIndex implements SearchIndex {
+    private mini;
+    constructor();
+    add(doc: SearchDoc): void;
+    update(doc: SearchDoc): void;
+    remove(documentId: string): void;
+    query(q: string, viewer: string | null, opts?: SearchQueryOptions): SearchResults;
+    snapshot(): string;
+    restore(snapshot: string): void;
+    clear(): void;
+    size(): number;
+}
+//# sourceMappingURL=CoreSearchIndex.d.ts.map