@agenttrail/guardrails 0.0.1-rc.1 → 0.0.2

package/README.md

@@ -185,8 +185,7 @@ somebody forgot.
   project" **cannot be written as a rule**, and `file-scope` is limited to well-known absolute paths
   for good. For the same reason, a rule cannot tell a scratch database from a production one.
 - **Nothing hidden inside a quoted payload.** Where the danger is inside a quoted argument —
-  `psql -c "<sql>"`, `python -c "<code>"` — a text rule can only guess. In our own measurements,
-  roughly three quarters of matches were inside scripts of 300 characters or more, where a match says
+  `psql -c "<sql>"`, `python -c "<code>"` — a text rule can only guess. In a long script, a match says
   very little about what the script actually does.
 - **Nothing a wrapper hides.** `./deploy.sh` that runs `terraform apply -auto-approve` inside it is
   just a shell script from the outside.
@@ -290,11 +289,8 @@ rules that were already checked before release.
 
 Independently authored. No block list, pattern or wording is copied from any other project.
 
-The sources are our own: a hand-labelled set of 130 real agent commands, a measured run over real
-usage, ten first-party rules from the agenttrail policy library, and four candidates carried over
-from an internal security-mapping experiment. Where a rule's shape follows an obvious convention — an
-`rm -rf` pattern looks like an `rm -rf` pattern — that is two people meeting the same shell, not one
-copying the other.
+Where a rule's shape follows an obvious convention — an `rm -rf` pattern looks like an `rm -rf`
+pattern — that is two people meeting the same shell, not one copying the other.
 
 Four vendors' own tools inspired specific rules through their *documented failure modes*, not their
 code.

package/dist/{chunk-CDYD5WBH.js → chunk-AUGYGUPX.js}

@@ -116,7 +116,7 @@ var FixturesSchema = z.object({
   allow: z.array(FixtureSchema).min(1)
 }).strict();
 var RuleSchema = z.object({
-  /** Stable forever. Never renamed — it is the join key for hosted metadata. */
+  /** Stable: a rule id is never renamed. */
   id: z.string().min(1),
   /** The pack this rule belongs to. Validated against `PACKS` by the registry. */
   category: z.string().min(1),
@@ -159,4 +159,4 @@ export {
   parseRuleOrThrow,
   defineRule
 };
-//# sourceMappingURL=chunk-CDYD5WBH.js.map
+//# sourceMappingURL=chunk-AUGYGUPX.js.map

package/dist/chunk-AUGYGUPX.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/schema.ts"],"sourcesContent":["/**\n * The guardrails rule format — self-contained, and deliberately so.\n *\n * This file defines the rule format and imports nothing but zod, so the package\n * builds on its own. The condition and match shapes mirror the evaluator's rather\n * than importing them; a change to either has to be made in both places.\n *\n * A rule carries `defaultAction` (what the guard does when it matches) and no\n * `version`; the package version is the corpus version.\n */\n\nimport { z } from \"zod\";\n\n// ── Severity ────────────────────────────────────────────────────────────────\n\n/**\n * The five severities, in order, most→least severe.\n *\n * `info` earns its place: five of the eight packs default to `ask`/`warn`, and a\n * warn-only rule labelled `low` overstates itself.\n *\n * Severity says how serious a match is. This package maps it to nothing else,\n * including cost: the guard prints no currency.\n */\nexport const SEVERITIES = [\"critical\", \"high\", \"medium\", \"low\", \"info\"] as const;\n\n/** How dangerous the thing a rule catches is. An authoring signal, not a price. */\nexport const SeveritySchema = z.enum(SEVERITIES);\n\n// ── Actions ─────────────────────────────────────────────────────────────────\n\n/**\n * What the guard does when a rule matches.\n *\n * The guard maps these onto Claude Code's `PreToolUse` verdicts:\n * `block` → deny, `require_approval` → ask, `warn` → allow-but-recorded.\n */\nexport const ACTIONS = [\"block\", \"require_approval\", \"warn\"] as const;\n\n/** The action a rule takes by default, before any user override. */\nexport const ActionSchema = z.enum(ACTIONS);\n\n// ── detail_matches: regex limits, mirrored from the engine ───────────────────\n\n/** Longest accepted `detail_matches` pattern. Long enough for any real rule. */\nexport const DETAIL_MATCHES_MAX_PATTERN_LENGTH = 200;\n\n/** Most `detail_matches` patterns allowed on one condition (they are ORed). */\nexport const DETAIL_MATCHES_MAX_PATTERNS = 10;\n\n/**\n * Reject a regex that can backtrack catastrophically, at PARSE time.\n *\n * Node has no regex timeout, so the only real bounds are a non-backtracking\n * engine (RE2 — a runtime dependency deliberately not taken) or a syntactic\n * restriction. This is the syntactic one: it rejects **star height >= 2**, an\n * unbounded quantifier applied to a group that itself contains an unbounded\n * quantifier — `(a+)+`, `(a*)*`, `(\\s+x?)+` — the shape behind essentially every\n * practical ReDoS.\n *\n * The guard's hook has a 10s Claude Code timeout, no internal watchdog, and it\n * **fails open**: a pattern that backtracks does not merely make enforcement slow,\n * it lets the action through. A slow rule in the guard is a disabled rule.\n *\n * HONEST LIMIT: this is a bound, not a proof. Star height 1 can still be\n * quadratic (`(a|a)*`), which is slow but not exponential, and is acceptable\n * against the length cap above. A hard guarantee needs RE2.\n *\n * @param source - The regex body (no delimiters, no flags).\n * @returns `true` when the pattern nests unbounded quantifiers.\n */\nexport function hasNestedUnboundedQuantifier(source: string): boolean {\n  /** Is `source[i]` an unbounded quantifier (`*`, `+`, or `{n,}`)? */\n  const unboundedQuantifierAt = (s: string, i: number): boolean => {\n    const ch = s[i];\n    if (ch === \"*\" || ch === \"+\") return true;\n    if (ch !== \"{\") return false;\n    const close = s.indexOf(\"}\", i);\n    // `{n,}` is unbounded; `{n}` and `{n,m}` are not.\n    return close !== -1 && /^\\{\\d*,\\}$/.test(s.slice(i, close + 1));\n  };\n\n  /** Does `body` contain an unbounded quantifier outside a character class? */\n  const containsUnbounded = (body: string): boolean => {\n    let inClass = false;\n    for (let i = 0; i < body.length; i++) {\n      const ch = body[i];\n      if (ch === \"\\\\\") {\n        i++;\n        continue;\n      }\n      if (inClass) {\n        if (ch === \"]\") inClass = false;\n        continue;\n      }\n      if (ch === \"[\") {\n        inClass = true;\n        continue;\n      }\n      if (unboundedQuantifierAt(body, i)) return true;\n    }\n    return false;\n  };\n\n  const groupStarts: number[] = [];\n  let inClass = false;\n  for (let i = 0; i < source.length; i++) {\n    const ch = source[i];\n    if (ch === \"\\\\\") {\n      i++; // skip the escaped char — `\\(` is a literal, not a group\n      continue;\n    }\n    if (inClass) {\n      if (ch === \"]\") inClass = false;\n      continue;\n    }\n    if (ch === \"[\") {\n      inClass = true;\n      continue;\n    }\n    if (ch === \"(\") {\n      groupStarts.push(i);\n      continue;\n    }\n    if (ch === \")\") {\n      const start = groupStarts.pop();\n      if (start === undefined) continue; // unbalanced — the RegExp compile catches it\n      // Quantified group? Then its body must not itself repeat unboundedly.\n      if (unboundedQuantifierAt(source, i + 1) && containsUnbounded(source.slice(start + 1, i))) {\n        return true;\n      }\n    }\n  }\n  return false;\n}\n\n/**\n * One `detail_matches` pattern: compilable, length-capped, and free of nested\n * unbounded quantifiers. The engine compiles these with `i` and never `g`/`y` —\n * a global regex carries `lastIndex` between calls and would intermittently miss.\n */\nconst DetailMatchPatternSchema = z\n  .string()\n  .min(1)\n  .max(DETAIL_MATCHES_MAX_PATTERN_LENGTH)\n  .superRefine((pattern, ctx) => {\n    try {\n      new RegExp(pattern, \"i\");\n    } catch (error) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: `detail_matches: not a valid regular expression (${\n          error instanceof Error ? error.message : \"unknown error\"\n        })`,\n      });\n      return;\n    }\n    if (hasNestedUnboundedQuantifier(pattern)) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message:\n          \"detail_matches: nested unbounded quantifier (e.g. `(a+)+`) can backtrack catastrophically; rewrite without repeating a repeating group\",\n      });\n    }\n  });\n\n// ── Match conditions ────────────────────────────────────────────────────────\n\n/**\n * One condition matched against a tool call.\n *\n * - `kind`: required. The span kind, e.g. `execute_tool`. Case-insensitive.\n * - `label`: optional. The tool name — a case-insensitive GLOB, so\n *   `mcp__chrome__*` and `{Bash,PowerShell}` are one condition rather than a\n *   list that rots. A plain label has no glob character and matches exactly.\n * - `detail_contains`: optional. Substrings that must ALL appear (AND).\n *   **CASE-SENSITIVE**, and deliberately: `AKIA`, `ghp_`, `sk_live_` and the\n *   upper-case `TRUNCATE` arm are rules where case IS the signal. Author\n *   case-insensitive text matches with `detail_matches` instead.\n * - `detail_matches`: optional. Regex patterns against the same text; at least\n *   one must match (OR, unlike `detail_contains`). Case-insensitive.\n * - `file_glob`: optional. Case-insensitive glob against the file path.\n *\n * ── Two engine fields are deliberately absent ────────────────────────────────\n *\n * `numeric` is BANNED. At guard decision time `tokens`,\n * `cachedTokens` and `durationMs` are all 0, because the action has not run yet.\n * `gt` is therefore always false — the rule can never fire — and, worse, **`lt`\n * is always true, so the rule fires on every single command.** Omitting the key\n * from a `.strict()` object makes that a parse error rather than a lint finding.\n *\n * `scope` is BANNED for the same class of reason and is absent from the rule\n * envelope below: `agent_in` compares literally against an agent id that is\n * always a UUID, never the string `\"claude-code\"`, so a scoped rule matches\n * nothing, forever, silently.\n *\n * ── The third ban needs an actual check ──────────────────────────────────────\n *\n * A command matcher (`detail_contains` / `detail_matches`) and a file matcher\n * (`file_glob`) in ONE condition can never both be satisfied: the guard's mapper\n * is an if/else chain, so no real tool call ever carries both a command and a\n * file path. This schema refuses the combination.\n */\nexport const MatchConditionSchema = z\n  .object({\n    kind: z.string().min(1),\n    label: z.string().min(1).optional(),\n    detail_contains: z.array(z.string().min(1)).min(1).optional(),\n    detail_matches: z\n      .array(DetailMatchPatternSchema)\n      .min(1)\n      .max(DETAIL_MATCHES_MAX_PATTERNS)\n      .optional(),\n    file_glob: z.string().min(1).optional(),\n  })\n  .strict()\n  .superRefine((condition, ctx) => {\n    const hasCommandMatcher =\n      condition.detail_contains !== undefined || condition.detail_matches !== undefined;\n    if (hasCommandMatcher && condition.file_glob !== undefined) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message:\n          \"a condition may not combine a command matcher (detail_contains / detail_matches) with a file matcher (file_glob): no real tool call carries both, so the condition can never match. Split it into two conditions under any_of.\",\n      });\n    }\n  });\n\n/**\n * Match composition — conditions combined with `any_of` (OR), `all_of` (AND)\n * and/or `none_of` (negation).\n *\n * At least one of `any_of` or `all_of` must be present. `none_of` is an optional\n * refinement that CANNOT stand alone: a match must positively select calls\n * before excluding some. A pure-negation match is satisfied by every\n * non-matching call and, at `block`, would deny everything the agent does.\n */\nexport const MatchSchema = z\n  .object({\n    any_of: z.array(MatchConditionSchema).min(1).optional(),\n    all_of: z.array(MatchConditionSchema).min(1).optional(),\n    none_of: z.array(MatchConditionSchema).min(1).optional(),\n  })\n  .strict()\n  .refine((data) => data.any_of !== undefined || data.all_of !== undefined, {\n    message: \"At least one of 'any_of' or 'all_of' must be provided\",\n  });\n\n// ── Fixtures ────────────────────────────────────────────────────────────────\n\n/**\n * The tools a fixture may name. Free-form on purpose — the guard's matcher grows\n * (`mcp__*` alone is unbounded) and a closed enum here would reject a valid rule\n * for a tool this package has not heard of yet.\n */\nconst FixtureToolSchema = z.string().min(1);\n\n/**\n * A fixture on the COMMAND channel: `Bash`, `PowerShell`, `WebSearch` (its\n * query is ordinary text), and `mcp__*` (its serialized input).\n */\nconst CommandFixtureSchema = z\n  .object({ tool: FixtureToolSchema, command: z.string().min(1) })\n  .strict();\n\n/** A fixture on the FILE channel: `Edit`, `Write`, `Read`, `NotebookEdit`. */\nconst FileFixtureSchema = z\n  .object({ tool: FixtureToolSchema, file_path: z.string().min(1) })\n  .strict();\n\n/**\n * One fixture: a tool call this rule must match, or must not.\n *\n * A bare string is shorthand for `{ tool: \"Bash\", command: \"<string>\" }`, which\n * covers most rules and keeps them terse. Anything else is an object with a\n * `tool` plus **exactly one** of `command` or `file_path` — the two channels.\n * `.strict()` on each variant is what makes \"exactly one\" true: a\n * `command` object carrying a `file_path` matches neither variant.\n *\n * The parse output is always normalized to the object form, so the harness has\n * exactly one shape to feed the evaluator.\n *\n * ── There is no `url` channel ─────────────────────────────────────────────────\n *\n * **The evaluator cannot see a URL**: the only two attribute keys any matcher\n * reads are `detail` and `file_path`, and there is no `url` field in the condition\n * schema. A value written to `url` would be read by nothing, so a `WebFetch` rule\n * would match nothing, silently — the same failure `scope` is banned for. There\n * are no website rules and `WebFetch` is not intercepted; `WebSearch` is, because\n * its query is text on the command channel.\n *\n * A `url` key therefore fails to parse rather than becoming a fixture that tests\n * nothing. `__tests__/schema.test.ts` pins that.\n */\nexport const FixtureSchema = z.union([\n  z\n    .string()\n    .min(1)\n    .transform((command) => ({ tool: \"Bash\" as const, command })),\n  CommandFixtureSchema,\n  FileFixtureSchema,\n]);\n\n/**\n * The two directions every rule must prove, through the real evaluator.\n *\n * **`block` means \"this rule MUST match\"; `allow` means \"this rule MUST NOT\n * match\".** They are not verdicts. Five of the eight packs default to `ask` or\n * `warn`, and `warn` folds into an allow verdict, so reading `block` as \"the\n * guard denies\" would fail every `warn` rule and make the negative fixture\n * vacuous for them.\n *\n * Both are `.min(1)`: CI only has to fail on a rule missing a\n * negative fixture, but requiring it here moves that failure to authoring time,\n * where it costs a keystroke instead of a pull-request round trip.\n */\nexport const FixturesSchema = z\n  .object({\n    block: z.array(FixtureSchema).min(1),\n    allow: z.array(FixtureSchema).min(1),\n  })\n  .strict();\n\n// ── The rule ────────────────────────────────────────────────────────────────\n\n/**\n * One published rule.\n *\n * `.strict()` rejects any key not declared here, so an unknown field fails to parse\n * rather than riding along into the published package.\n *\n * `description` carries the rule's COVERAGE LIMITS, verbatim — e.g. that an\n * `rm -rf` rule misses `rm -fr`. It is a convention rather than a schema\n * constraint, because no validator can tell a real limit from a sentence shaped\n * like one.\n */\nexport const RuleSchema = z\n  .object({\n    /** Stable: a rule id is never renamed. */\n    id: z.string().min(1),\n    /** The pack this rule belongs to. Validated against `PACKS` by the registry. */\n    category: z.string().min(1),\n    severity: SeveritySchema,\n    defaultAction: ActionSchema,\n    title: z.string().min(1),\n    description: z.string().min(1),\n    match: MatchSchema,\n    fixtures: FixturesSchema,\n  })\n  .strict();\n\n// ── Types ───────────────────────────────────────────────────────────────────\n\n/** How dangerous the caught action is. Never a price. */\nexport type Severity = (typeof SEVERITIES)[number];\n\n/** What the guard does on a match. */\nexport type Action = (typeof ACTIONS)[number];\n\n/** One condition matched against a tool call. */\nexport type MatchCondition = z.infer<typeof MatchConditionSchema>;\n\n/** A composed match — `any_of` / `all_of` / `none_of`. */\nexport type Match = z.infer<typeof MatchSchema>;\n\n/** A fixture as authored: a bare command string, or a tagged single-channel object. */\nexport type FixtureInput = z.input<typeof FixtureSchema>;\n\n/** A fixture after parsing — always the tagged object form. */\nexport type Fixture = z.output<typeof FixtureSchema>;\n\n/** The must-match / must-not-match pair every rule ships. */\nexport type Fixtures = z.infer<typeof FixturesSchema>;\n\n/** One published rule, as authored. */\nexport type RuleInput = z.input<typeof RuleSchema>;\n\n/** One published rule, parsed and normalized. */\nexport type Rule = z.output<typeof RuleSchema>;\n\n// ── Parsing ─────────────────────────────────────────────────────────────────\n\n/**\n * Validate a rule from unknown input.\n *\n * It answers \"is this a well-formed rule?\" — it does NOT answer \"does this rule\n * actually fire on the command you think it does.\" That needs the evaluator, which\n * is not part of this package.\n *\n * @param input - Unknown input, e.g. parsed JSON or a rule module's default export.\n * @returns A Zod SafeParseReturnType — check `.success` before reading `.data`.\n */\nexport function parseRule(input: unknown): z.SafeParseReturnType<unknown, Rule> {\n  return RuleSchema.safeParse(input);\n}\n\n/**\n * Parse a rule, or throw with the reason.\n *\n * Used by rule modules themselves via {@link defineRule}, so an authoring\n * mistake fails at import — which is to say, at test time — rather than\n * surviving into a corpus that only validates what it remembers to check.\n */\nexport function parseRuleOrThrow(input: unknown): Rule {\n  const result = parseRule(input);\n  if (!result.success) {\n    const id =\n      typeof input === \"object\" && input !== null && \"id\" in input\n        ? String((input as { id: unknown }).id)\n        : \"<unknown id>\";\n    throw new Error(`invalid guardrails rule ${id}: ${result.error.message}`);\n  }\n  return result.data;\n}\n\n/**\n * Declare a rule. Validates at module load, so a malformed rule cannot reach the\n * registry — the corpus is only as trustworthy as its weakest unvalidated entry.\n */\nexport function defineRule(rule: RuleInput): Rule {\n  return parseRuleOrThrow(rule);\n}\n"],"mappings":";AAWA,SAAS,SAAS;AAaX,IAAM,aAAa,CAAC,YAAY,QAAQ,UAAU,OAAO,MAAM;AAG/D,IAAM,iBAAiB,EAAE,KAAK,UAAU;AAUxC,IAAM,UAAU,CAAC,SAAS,oBAAoB,MAAM;AAGpD,IAAM,eAAe,EAAE,KAAK,OAAO;AAKnC,IAAM,oCAAoC;AAG1C,IAAM,8BAA8B;AAuBpC,SAAS,6BAA6B,QAAyB;AAEpE,QAAM,wBAAwB,CAAC,GAAW,MAAuB;AAC/D,UAAM,KAAK,EAAE,CAAC;AACd,QAAI,OAAO,OAAO,OAAO,IAAK,QAAO;AACrC,QAAI,OAAO,IAAK,QAAO;AACvB,UAAM,QAAQ,EAAE,QAAQ,KAAK,CAAC;AAE9B,WAAO,UAAU,MAAM,aAAa,KAAK,EAAE,MAAM,GAAG,QAAQ,CAAC,CAAC;AAAA,EAChE;AAGA,QAAM,oBAAoB,CAAC,SAA0B;AACnD,QAAIA,WAAU;AACd,aAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,YAAM,KAAK,KAAK,CAAC;AACjB,UAAI,OAAO,MAAM;AACf;AACA;AAAA,MACF;AACA,UAAIA,UAAS;AACX,YAAI,OAAO,IAAK,CAAAA,WAAU;AAC1B;AAAA,MACF;AACA,UAAI,OAAO,KAAK;AACd,QAAAA,WAAU;AACV;AAAA,MACF;AACA,UAAI,sBAAsB,MAAM,CAAC,EAAG,QAAO;AAAA,IAC7C;AACA,WAAO;AAAA,EACT;AAEA,QAAM,cAAwB,CAAC;AAC/B,MAAI,UAAU;AACd,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,UAAM,KAAK,OAAO,CAAC;AACnB,QAAI,OAAO,MAAM;AACf;AACA;AAAA,IACF;AACA,QAAI,SAAS;AACX,UAAI,OAAO,IAAK,WAAU;AAC1B;AAAA,IACF;AACA,QAAI,OAAO,KAAK;AACd,gBAAU;AACV;AAAA,IACF;AACA,QAAI,OAAO,KAAK;AACd,kBAAY,KAAK,CAAC;AAClB;AAAA,IACF;AACA,QAAI,OAAO,KAAK;AACd,YAAM,QAAQ,YAAY,IAAI;AAC9B,UAAI,UAAU,OAAW;AAEzB,UAAI,sBAAsB,QAAQ,IAAI,CAAC,KAAK,kBAAkB,OAAO,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG;AACzF,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAOA,IAAM,2BAA2B,EAC9B,OAAO,EACP,IAAI,CAAC,EACL,IAAI,iCAAiC,EACrC,YAAY,CAAC,SAAS,QAAQ;AAC7B,MAAI;AACF,QAAI,OAAO,SAAS,GAAG;AAAA,EACzB,SAAS,OAAO;AACd,QAAI,SAAS;AAAA,MACX,MAAM,EAAE,aAAa;AAAA,MACrB,SAAS,mDACP,iBAAiB,QAAQ,MAAM,UAAU,eAC3C;AAAA,IACF,CAAC;AACD;AAAA,EACF;AACA,MAAI,6BAA6B,OAAO,GAAG;AACzC,QAAI,SAAS;AAAA,MACX,MAAM,EAAE,aAAa;AAAA,MACrB,SACE;AAAA,IACJ,CAAC;AAAA,EACH;AACF,CAAC;AAuCI,IAAM,uBAAuB,EACjC,OAAO;AAAA,EACN,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAClC,iBAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC5D,gBAAgB,EACb,MAAM,wBAAwB,EAC9B,IAAI,CAAC,EACL,IAAI,2BAA2B,EAC/B,SAAS;AAAA,EACZ,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AACxC,CAAC,EACA,OAAO,EACP,YAAY,CAAC,WAAW,QAAQ;AAC/B,QAAM,oBACJ,UAAU,oBAAoB,UAAa,UAAU,mBAAmB;AAC1E,MAAI,qBAAqB,UAAU,cAAc,QAAW;AAC1D,QAAI,SAAS;AAAA,MACX,MAAM,EAAE,aAAa;AAAA,MACrB,SACE;AAAA,IACJ,CAAC;AAAA,EACH;AACF,CAAC;AAWI,IAAM,cAAc,EACxB,OAAO;AAAA,EACN,QAAQ,EAAE,MAAM,oBAAoB,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACtD,QAAQ,EAAE,MAAM,oBAAoB,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACtD,SAAS,EAAE,MAAM,oBAAoB,EAAE,IAAI,CAAC,EAAE,SAAS;AACzD,CAAC,EACA,OAAO,EACP,OAAO,CAAC,SAAS,KAAK,WAAW,UAAa,KAAK,WAAW,QAAW;AAAA,EACxE,SAAS;AACX,CAAC;AASH,IAAM,oBAAoB,EAAE,OAAO,EAAE,IAAI,CAAC;AAM1C,IAAM,uBAAuB,EAC1B,OAAO,EAAE,MAAM,mBAAmB,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,EAC9D,OAAO;AAGV,IAAM,oBAAoB,EACvB,OAAO,EAAE,MAAM,mBAAmB,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,EAChE,OAAO;AA0BH,IAAM,gBAAgB,EAAE,MAAM;AAAA,EACnC,EACG,OAAO,EACP,IAAI,CAAC,EACL,UAAU,CAAC,aAAa,EAAE,MAAM,QAAiB,QAAQ,EAAE;AAAA,EAC9D;AAAA,EACA;AACF,CAAC;AAeM,IAAM,iBAAiB,EAC3B,OAAO;AAAA,EACN,OAAO,EAAE,MAAM,aAAa,EAAE,IAAI,CAAC;AAAA,EACnC,OAAO,EAAE,MAAM,aAAa,EAAE,IAAI,CAAC;AACrC,CAAC,EACA,OAAO;AAeH,IAAM,aAAa,EACvB,OAAO;AAAA;AAAA,EAEN,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAEpB,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,UAAU;AAAA,EACV,eAAe;AAAA,EACf,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC7B,OAAO;AAAA,EACP,UAAU;AACZ,CAAC,EACA,OAAO;AA2CH,SAAS,UAAU,OAAsD;AAC9E,SAAO,WAAW,UAAU,KAAK;AACnC;AASO,SAAS,iBAAiB,OAAsB;AACrD,QAAM,SAAS,UAAU,KAAK;AAC9B,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,KACJ,OAAO,UAAU,YAAY,UAAU,QAAQ,QAAQ,QACnD,OAAQ,MAA0B,EAAE,IACpC;AACN,UAAM,IAAI,MAAM,2BAA2B,EAAE,KAAK,OAAO,MAAM,OAAO,EAAE;AAAA,EAC1E;AACA,SAAO,OAAO;AAChB;AAMO,SAAS,WAAW,MAAuB;AAChD,SAAO,iBAAiB,IAAI;AAC9B;","names":["inClass"]}

package/dist/{chunk-EQOZGDJ7.js → chunk-IQBU26ZF.js}

@@ -1680,7 +1680,7 @@ var blockHardcodedSecrets = {
       bash(`export AWS_ACCESS_KEY_ID=ASIA${"EXAMPLE".repeat(3).slice(0, 16)}`),
       bash(`export GH_TOKEN=ghp_${"EXAMPLE".repeat(6)}`),
       bash("ssh-add - <<< '-----BEGIN OPENSSH PRIVATE KEY-----'"),
-      // The ruling, as fixtures rather than as prose. These two are `block` — MUST
+      // The carrier rule above, as fixtures. These two are `block` — MUST
       // match — precisely because they are quoted mentions, which everywhere else
       // in this corpus means "leave it alone".
       mentionInCommit("export AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE"),
@@ -2413,7 +2413,7 @@ function isPack(value) {
 }
 
 // src/stamp.ts
-var CATALOG_VERSION = "0.0.1-rc.1";
+var CATALOG_VERSION = "0.0.2";
 var CATALOG_PUBLISHED_AT = "2026-09-07T12:44:09Z";
 
 // src/rules.ts
@@ -2458,4 +2458,4 @@ export {
   getRule,
   rulesForPack
 };
-//# sourceMappingURL=chunk-EQOZGDJ7.js.map
+//# sourceMappingURL=chunk-IQBU26ZF.js.map