@aimarket/warden 0.21.0 → 0.22.1

package/dist/flow-guard-fingerprints.js

@@ -0,0 +1,164 @@
+/** Flow guard: fingerprints of what the session read (private text, personal numbers, credentials) and the secret formats it knows. */
+import { createHash } from 'node:crypto';
+import { MAX_TEXT } from './flow-guard-text.js';
+export const WINDOW = 20;
+const STRIDE = 4;
+// Credentials are fingerprinted again in short windows of their letters and digits only, so a piece of a key, or the
+// key with separators between its characters, is still recognised. The sizes are the smallest at which none of 480
+// made-up keys in eight formats matched anywhere in 100 million letters and digits of ordinary text
+// (scripts/redteam/window-collisions.mjs): 8 for keys of letters and digits, 10 for hex keys, whose characters carry
+// half the information and which share their alphabet with every hash and address in the text around them.
+const TOKEN_WINDOW = 8;
+const HEX_TOKEN_WINDOW = 10;
+export const TOKEN_WINDOWS = [TOKEN_WINDOW, HEX_TOKEN_WINDOW];
+const NORMALIZED_CREDENTIAL_PREFIX = /^(?:[rs]k(?:live|test)|skantapi[0-9]+|skant|skproj|sk|gh[pousr]|githubpat|glpat|npm|xox[abprs]|akia|asia|aiza)/;
+// Text every key of a kind shares, so it is no piece of any one key: the RSA, EC and signature algorithm
+// identifiers of DER keys and certificates, in letters and digits.
+export const KEY_STRUCTURE = ['anbgkqhkig9w0baqefaa', 'a0gcsqgsib3dqebcwua', 'a0gcsqgsib3dqebbquaa', 'byqgsm49ageg', 'ccqgsm49aweh', 'bsubbaaiq', 'mcowbqydk2vw', 'mcowbqydk2vu'];
+export function normalizeText(s) {
+    return s.normalize('NFKC').toLowerCase().replace(/\s+/g, '');
+}
+export function fpHash(window) {
+    return createHash('sha256').update(window).digest('hex').slice(0, 12);
+}
+/** Windows of the private text at every STRIDE-th position: any leaked run of WINDOW+STRIDE-1 normalized chars hits one. */
+export function fingerprints(text) {
+    const n = normalizeText(text.slice(0, MAX_TEXT));
+    const out = new Set();
+    for (let i = 0; i + WINDOW <= n.length; i += STRIDE) {
+        const w = n.slice(i, i + WINDOW);
+        if (/^(.)\1+$/.test(w) || /^[0-9]+$/.test(w))
+            continue;
+        out.add(fpHash(w));
+    }
+    return [...out];
+}
+// Short structured values a 20-character window misses: card, passport, account and phone numbers.
+// Words are split on whitespace; consecutive words that carry digits ("DE89 3704 0044", "+1 (555) 123-4567")
+// join into one value, and a word without digits ends it.
+const DATE_LIKE = /^(19|20)\d{2}(0[1-9]|1[0-2])(0[1-9]|[12]\d|3[01])\d{0,6}$/;
+export function piiTokens(text) {
+    const out = new Set();
+    const flush = (group) => {
+        const t = group.join('').replace(/[^a-z0-9]/gi, '').toLowerCase();
+        const digits = (t.match(/\d/g) || []).length;
+        if (t.length < 8 || t.length > 34 || digits < 5 || DATE_LIKE.test(t))
+            return;
+        if (/^\d+$/.test(t) && t.length < 9)
+            return;
+        out.add(t);
+    };
+    let group = [];
+    for (const word of text.slice(0, MAX_TEXT).split(/\s+/)) {
+        const bare = word.replace(/^[^A-Za-z0-9+(]+|[^A-Za-z0-9)]+$/g, '');
+        if (/\d/.test(bare) && /^[A-Za-z0-9+()./-]+$/.test(bare)) {
+            group.push(bare);
+            continue;
+        }
+        if (group.length) {
+            flush(group);
+            group = [];
+        }
+    }
+    if (group.length)
+        flush(group);
+    return [...out];
+}
+const SECRET_PATTERNS = [
+    ['private key', /-----BEGIN [A-Z ]*PRIVATE KEY-----/],
+    ['AWS access key', /\b(AKIA|ASIA)[0-9A-Z]{16}\b/],
+    ['GitHub token', /\b(ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,}\b|\bgithub_pat_[A-Za-z0-9_]{60,}/],
+    ['GitLab token', /\bglpat-[A-Za-z0-9_-]{20,}/],
+    ['Slack token', /\bxox[abprs]-[A-Za-z0-9-]{10,}/],
+    ['npm token', /\bnpm_[A-Za-z0-9]{36}\b/],
+    ['API key', /\bsk-(ant-)?[A-Za-z0-9_-]{20,}/],
+    ['Google API key', /\bAIza[0-9A-Za-z_-]{35}\b/],
+];
+export function secretPattern(texts) {
+    for (const t of texts)
+        for (const [name, re] of SECRET_PATTERNS)
+            if (re.test(t))
+                return name;
+    return undefined;
+}
+// Cyrillic and Greek letters that look like Latin ones: a key retyped with them is the same key to a reader.
+export const CONFUSABLE = {
+    а: 'a', в: 'b', е: 'e', ё: 'e', к: 'k', м: 'm', н: 'h', о: 'o', р: 'p', с: 'c', т: 't', у: 'y', х: 'x', і: 'i', ј: 'j', ѕ: 's', ԁ: 'd', ԛ: 'q', ԝ: 'w',
+    α: 'a', β: 'b', ε: 'e', η: 'n', ι: 'i', κ: 'k', ν: 'v', ο: 'o', ρ: 'p', τ: 't', υ: 'u', χ: 'x', γ: 'y', ζ: 'z',
+};
+/** Letters and digits only, lower-cased: separators, case, spacing and look-alike letters do not hide a key. */
+export function alnum(s) {
+    return s.normalize('NFKC').toLowerCase().replace(/[^a-z0-9]/g, ch => CONFUSABLE[ch] ?? '');
+}
+function entropy(s) {
+    const counts = new Map();
+    for (const ch of s)
+        counts.set(ch, (counts.get(ch) ?? 0) + 1);
+    let h = 0;
+    for (const n of counts.values())
+        h -= (n / s.length) * Math.log2(n / s.length);
+    return h;
+}
+const TOKEN_RUN = /[A-Za-z0-9+/_-]{16,}={0,2}/g;
+/** Key-like values in private text: every random-looking run of a credential file, and every well-known
+ * secret format wherever it was read. Words, paths and host names are not random enough to count. */
+export function secretValues(text, credentialFile) {
+    const out = new Set();
+    const t = text.slice(0, MAX_TEXT);
+    const add = (raw) => {
+        // A base64 JSON object (a JWT's header or claims) is readable by anyone who holds the token; its signature,
+        // the run after the next dot, is the secret part and is kept.
+        if (raw.startsWith('eyJ'))
+            return;
+        const a = alnum(raw);
+        if (a.length >= 16 && /\d/.test(a) && /[a-z]/.test(a) && entropy(a) >= 3.5)
+            out.add(raw);
+    };
+    if (credentialFile)
+        for (const m of t.matchAll(TOKEN_RUN))
+            add(m[0]);
+    for (const [, re] of SECRET_PATTERNS)
+        for (const m of t.matchAll(new RegExp(re.source, 'g')))
+            add(m[0]);
+    return [...out];
+}
+/** Normalized credentials for the original strong-window check. Raw values exist only transiently. */
+export function secretTokens(text, credentialFile) {
+    return [...new Set(secretValues(text, credentialFile).map(alnum))];
+}
+/** Known providers' alphabetic payload prefixes are still secret: do not skip them merely because the first
+ * digit comes late. Keep every previously indexed window. Generic values retain the old conservative start:
+ * public word-based environment values ending in a year must not gain new hard-denial substrings. */
+export function tokenFingerprintStart(a) {
+    const leading = /^[a-z]*/.exec(a)[0].length;
+    if (/^(mii|mig|mhc|mc4|mco)/.test(a))
+        return Math.max(48, leading);
+    const prefix = NORMALIZED_CREDENTIAL_PREFIX.exec(a)?.[0];
+    return prefix ? Math.min(leading, prefix.length) : leading;
+}
+/** Windows hold both a letter and a digit; alphabetic-only words are not strong credential evidence.
+ * Public format/DER structure is excluded. The 8/10-character thresholds and stored hash format are unchanged. */
+export function tokenFingerprints(tokens) {
+    const out = new Set();
+    for (const a of tokens) {
+        const size = /^[0-9a-f]+$/.test(a) ? HEX_TOKEN_WINDOW : TOKEN_WINDOW;
+        const start = tokenFingerprintStart(a);
+        for (let i = start; i + size <= a.length; i++) {
+            const w = a.slice(i, i + size);
+            if (/\d/.test(w) && /[a-z]/.test(w) && !KEY_STRUCTURE.some(k => k.includes(w)))
+                out.add(fpHash(w));
+        }
+    }
+    return [...out];
+}
+/** Every window of letters and digits of both token sizes, forwards and backwards: what a call is checked by. */
+export function tokenWindows(text) {
+    const out = [];
+    for (const a of [alnum(text), alnum([...text].reverse().join(''))]) {
+        for (const size of TOKEN_WINDOWS)
+            for (let i = 0; i + size <= a.length; i++)
+                out.push(fpHash(a.slice(i, i + size)));
+    }
+    return out;
+}
+//# sourceMappingURL=flow-guard-fingerprints.js.map

package/dist/flow-guard-fingerprints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow-guard-fingerprints.js","sourceRoot":"","sources":["../src/flow-guard-fingerprints.ts"],"names":[],"mappings":"AAAA,uIAAuI;AACvI,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEhD,MAAM,CAAC,MAAM,MAAM,GAAG,EAAE,CAAC;AACzB,MAAM,MAAM,GAAG,CAAC,CAAC;AACjB,qHAAqH;AACrH,mHAAmH;AACnH,oGAAoG;AACpG,qHAAqH;AACrH,2GAA2G;AAC3G,MAAM,YAAY,GAAG,CAAC,CAAC;AACvB,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,YAAY,EAAE,gBAAgB,CAAU,CAAC;AACvE,MAAM,4BAA4B,GAAG,gHAAgH,CAAC;AACtJ,yGAAyG;AACzG,mEAAmE;AACnE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,sBAAsB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,cAAc,EAAE,cAAc,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;AAElL,MAAM,UAAU,aAAa,CAAC,CAAS;IACrC,OAAO,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,MAAc;IACnC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,4HAA4H;AAC5H,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,MAAM,EAAE,CAAC;QACpD,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC;QACjC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,SAAS;QACvD,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC;AAED,mGAAmG;AACnG,6GAA6G;AAC7G,0DAA0D;AAC1D,MAAM,SAAS,GAAG,2DAA2D,CAAC;AAC9E,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,MAAM,KAAK,GAAG,CAAC,KAAe,EAAE,EAAE;QAChC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAClE,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QAC7C,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE,IAAI,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO;QAC7E,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO;QAC5C,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACb,CAAC,CAAC;IACF,IAAI,KAAK,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;QACnE,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QACzF,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAAC,KAAK,GAAG,EAAE,CAAC;QAAC,CAAC;IACjD,CAAC;IACD,IAAI,KAAK,CAAC,MAAM;QAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/B,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,eAAe,GAA4B;IAC/C,CAAC,aAAa,EAAE,oCAAoC,CAAC;IACrD,CAAC,gBAAgB,EAAE,6BAA6B,CAAC;IACjD,CAAC,cAAc,EAAE,2EAA2E,CAAC;IAC7F,CAAC,cAAc,EAAE,4BAA4B,CAAC;IAC9C,CAAC,aAAa,EAAE,gCAAgC,CAAC;IACjD,CAAC,WAAW,EAAE,yBAAyB,CAAC;IACxC,CAAC,SAAS,EAAE,gCAAgC,CAAC;IAC7C,CAAC,gBAAgB,EAAE,2BAA2B,CAAC;CAChD,CAAC;AAEF,MAAM,UAAU,aAAa,CAAC,KAAwB;IACpD,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,eAAe;YAAE,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;IAC7F,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,6GAA6G;AAC7G,MAAM,CAAC,MAAM,UAAU,GAA2B;IAChD,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG;IACtJ,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG;CAC/G,CAAC;AACF,gHAAgH;AAChH,MAAM,UAAU,KAAK,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;AAC7F,CAAC;AAED,SAAS,OAAO,CAAC,CAAS;IACxB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,EAAE,IAAI,CAAC;QAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE;QAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAC/E,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,SAAS,GAAG,6BAA6B,CAAC;AAChD;qGACqG;AACrG,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,cAAuB;IAChE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,EAAE;QAC1B,4GAA4G;QAC5G,8DAA8D;QAC9D,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO;QAClC,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACrB,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,GAAG;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3F,CAAC,CAAC;IACF,IAAI,cAAc;QAAE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,IAAI,eAAe;QAAE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxG,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,cAAuB;IAChE,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACrE,CAAC;AAED;;qGAEqG;AACrG,MAAM,UAAU,qBAAqB,CAAC,CAAS;IAC7C,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC7C,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACzD,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AAC7D,CAAC;AAED;kHACkH;AAClH,MAAM,UAAU,iBAAiB,CAAC,MAAyB;IACzD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,YAAY,CAAC;QACrE,MAAM,KAAK,GAAG,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACvC,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC9C,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;YAC/B,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACrG,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC;AAED,iHAAiH;AACjH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,KAAK,MAAM,IAAI,IAAI,aAAa;YAAE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;gBAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACtH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/flow-guard-fragments.d.ts

@@ -0,0 +1,17 @@
+import type { FlowState, FragmentRecord } from './flow-guard-types.js';
+export declare const MAX_FRAGMENT_INDEX = 16384;
+export declare const MAX_FRAGMENT_SEEN = 256;
+export declare const fragmentKey: (r: FragmentRecord) => string;
+export declare const SHORT_SIZES: readonly [5, 6, 7];
+/** Weak evidence asks before its first transmission, never silently learns by sending it.
+ * Five-char windows require upper/lower/digit classes in the source, while 6/7-char atoms may be words.
+ * Exact prefix-boundary slices cover chunks that already contain payload but no full six-char window.
+ * Only hash/offset/size metadata is persisted; public format and DER structure alone do not count. */
+export declare function fragmentFingerprints(tokens: readonly string[], limit?: number): FragmentRecord[];
+/** Must run under the session lock when remembering evidence. Audit never consumes or whitelists a match. */
+export declare function checkFragments(input: Record<string, unknown>, state: FlowState, hasLegacyTokens: boolean, remember: boolean): {
+    secret?: string;
+    review?: boolean;
+    unavailable?: boolean;
+};
+//# sourceMappingURL=flow-guard-fragments.d.ts.map

package/dist/flow-guard-fragments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow-guard-fragments.d.ts","sourceRoot":"","sources":["../src/flow-guard-fragments.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAMvE,eAAO,MAAM,kBAAkB,QAAS,CAAC;AACzC,eAAO,MAAM,iBAAiB,MAAM,CAAC;AAGrC,eAAO,MAAM,WAAW,MAAO,cAAc,WAA8F,CAAC;AAG5I,eAAO,MAAM,WAAW,YAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAU,CAAC;AAE9C;;;sGAGsG;AACtG,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,SAAqB,GAAG,cAAc,EAAE,CA6B5G;AA+BD,6GAA6G;AAC7G,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,CAwB1L"}

package/dist/flow-guard-fragments.js

@@ -0,0 +1,122 @@
+/** Flow guard: short fragments of credentials, kept as hashes only, so a key sent in pieces is still recognised. */
+import { createHash } from 'node:crypto';
+import { strings } from './flow-guard-text.js';
+import { CONFUSABLE, KEY_STRUCTURE, alnum } from './flow-guard-fingerprints.js';
+import { scanCandidates } from './flow-guard-decode.js';
+const FRAGMENT_SIZE = 6;
+export const MAX_FRAGMENT_INDEX = 16_384;
+export const MAX_FRAGMENT_SEEN = 256;
+const fragmentHash = (s) => createHash('sha256').update(`warden-fragment-v1:${s}`).digest('hex').slice(0, 32);
+export const fragmentKey = (r) => `${r.group}:${r.offset}:${r.size ?? FRAGMENT_SIZE}:${r.edge ? 'edge' : 'atom'}:${r.hash}`;
+const CREDENTIAL_PREFIX = /^(?:[rs]k_(?:live|test)_|sk-ant-api[0-9]+-|sk-ant-|sk-proj-|sk-|gh[pousr]_|github_pat_|glpat-|npm_|xox[abprs]-|AKIA|ASIA|AIza)/i;
+const fragmentVisible = (s) => s.normalize('NFKC').toLowerCase().replace(/[^a-z0-9]/g, ch => CONFUSABLE[ch] ?? ch);
+export const SHORT_SIZES = [5, 6, 7];
+/** Weak evidence asks before its first transmission, never silently learns by sending it.
+ * Five-char windows require upper/lower/digit classes in the source, while 6/7-char atoms may be words.
+ * Exact prefix-boundary slices cover chunks that already contain payload but no full six-char window.
+ * Only hash/offset/size metadata is persisted; public format and DER structure alone do not count. */
+export function fragmentFingerprints(tokens, limit = MAX_FRAGMENT_INDEX) {
+    const out = [];
+    for (const raw of new Set(tokens)) {
+        const a = alnum(raw), prefix = CREDENTIAL_PREFIX.exec(raw)?.[0];
+        const normPrefix = /^(?:[rs]k(?:live|test)|skantapi[0-9]+|skant|skproj|sk|gh[pousr]|githubpat|glpat|npm|xox[abprs]|akia|asia|aiza)/.exec(a)?.[0];
+        const start = /^(mii|mig|mhc|mc4|mco)/.test(a) ? Math.max(48, /^[a-z]*/.exec(a)[0].length) : normPrefix?.length ?? /^[a-z]*/.exec(a)[0].length;
+        const group = fragmentHash(`key:${a}`);
+        // Preserve case only transiently to avoid indexing every short hex/hash or ordinary word.
+        const caseful = raw.normalize('NFKC').replace(/[^a-z0-9]/gi, '');
+        for (const size of SHORT_SIZES)
+            for (let offset = start; offset + size <= a.length; offset++) {
+                const piece = a.slice(offset, offset + size), original = caseful.slice(offset, offset + size);
+                if (size < FRAGMENT_SIZE && !(/[A-Z]/.test(original) && /[a-z]/.test(original) && /[0-9]/.test(original)))
+                    continue;
+                if (/^(.)\1+$/.test(piece) || KEY_STRUCTURE.some(k => k.includes(piece)))
+                    continue;
+                out.push({ group, hash: fragmentHash(piece), offset, size });
+                if (out.length > limit)
+                    return out;
+            }
+        if (prefix)
+            for (let offset = 0; offset < prefix.length; offset++) {
+                // Require a real format delimiter, or the entire delimiter-free prefix (AWS/Google).
+                const suffix = prefix.slice(offset);
+                if (offset !== 0 && (!/[_-]/.test(suffix) || !/[a-z]/i.test(suffix)))
+                    continue;
+                for (let length = 1; length <= 7 && prefix.length + length <= raw.length; length++) {
+                    const piece = fragmentVisible(raw.slice(offset, prefix.length + length));
+                    if (piece.length < 5)
+                        continue;
+                    out.push({ group, hash: fragmentHash(`edge:${piece}`), offset, size: piece.length, edge: true });
+                    if (out.length > limit)
+                        return out;
+                }
+            }
+    }
+    return out;
+}
+/** Full isolated atoms, not every substring of long ordinary hashes. Structured encoded candidates are included. */
+function fragmentAtoms(input) {
+    const hashes = new Set(), scan = scanCandidates(strings(input));
+    if (scan.incomplete)
+        return { hashes, incomplete: true };
+    for (const text of scan.values) {
+        const visible = fragmentVisible(text);
+        for (const run of visible.matchAll(/\b(?:[a-z0-9][\t ]+){4,6}[a-z0-9]\b/g)) {
+            const atom = alnum(run[0]);
+            hashes.add(fragmentHash(atom));
+            hashes.add(fragmentHash([...atom].reverse().join('')));
+        }
+        for (const m of visible.matchAll(/[a-z0-9+/_-]+/g)) {
+            const raw = m[0];
+            if (raw.length <= 64)
+                hashes.add(fragmentHash(`edge:${raw}`));
+            const joined = alnum(raw);
+            if (/^[a-z0-9]{5,7}$/.test(joined)) {
+                hashes.add(fragmentHash(joined));
+                hashes.add(fragmentHash([...joined].reverse().join('')));
+            }
+            // Separators delimit atoms; a long uninterrupted hash is never scanned with weak windows.
+            for (const atom of raw.matchAll(/[a-z0-9]+/g))
+                if (/^[a-z0-9]{5,7}$/.test(atom[0])) {
+                    hashes.add(fragmentHash(atom[0]));
+                    hashes.add(fragmentHash([...atom[0]].reverse().join('')));
+                }
+        }
+    }
+    return { hashes, incomplete: scan.incomplete };
+}
+/** Must run under the session lock when remembering evidence. Audit never consumes or whitelists a match. */
+export function checkFragments(input, state, hasLegacyTokens, remember) {
+    const f = state.fragments;
+    if (!f)
+        return hasLegacyTokens ? { unavailable: true } : {};
+    if (f.v !== 2 || f.full)
+        return { unavailable: true };
+    if (!f.index.length)
+        return {};
+    const { hashes, incomplete } = fragmentAtoms(input);
+    const matches = f.index.filter(r => hashes.has(r.hash));
+    if (!matches.length)
+        return incomplete ? { unavailable: true } : {};
+    const seen = new Map(f.seen.map(r => [fragmentKey(r), r]));
+    for (const r of matches)
+        seen.set(fragmentKey(r), r);
+    const all = [...seen.values()];
+    const offsets = new Map();
+    for (const r of all) {
+        if (r.edge || r.size !== FRAGMENT_SIZE)
+            continue;
+        const key = `${r.group}:${r.offset}`, at = offsets.get(key) ?? new Set();
+        at.add(r.hash);
+        offsets.set(key, at);
+    }
+    const paired = all.some(r => !r.edge && r.size === FRAGMENT_SIZE && [...(offsets.get(`${r.group}:${r.offset + FRAGMENT_SIZE}`) ?? [])].some(h => h !== r.hash));
+    if (remember) {
+        f.seen = all.slice(0, MAX_FRAGMENT_SEEN);
+        if (all.length > MAX_FRAGMENT_SEEN)
+            f.full = true;
+    }
+    if (paired)
+        return { secret: 'adjacent short fragments of a credential this session read' };
+    return { review: true, ...(incomplete || all.length > MAX_FRAGMENT_SEEN ? { unavailable: true } : {}) };
+}
+//# sourceMappingURL=flow-guard-fragments.js.map

package/dist/flow-guard-fragments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow-guard-fragments.js","sourceRoot":"","sources":["../src/flow-guard-fragments.ts"],"names":[],"mappings":"AAAA,oHAAoH;AACpH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAExD,MAAM,aAAa,GAAG,CAAC,CAAC;AACxB,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AACzC,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAErC,MAAM,YAAY,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACtH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAiB,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,IAAI,aAAa,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;AAC5I,MAAM,iBAAiB,GAAG,iIAAiI,CAAC;AAC5J,MAAM,eAAe,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;AAC3H,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAU,CAAC;AAE9C;;;sGAGsG;AACtG,MAAM,UAAU,oBAAoB,CAAC,MAAyB,EAAE,KAAK,GAAG,kBAAkB;IACxF,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,KAAK,MAAM,GAAG,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAChE,MAAM,UAAU,GAAG,gHAAgH,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACjJ,MAAM,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACjJ,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACvC,0FAA0F;QAC1F,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QACjE,KAAK,MAAM,IAAI,IAAI,WAAW;YAAE,KAAK,IAAI,MAAM,GAAG,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC;gBAC7F,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;gBAC9F,IAAI,IAAI,GAAG,aAAa,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;oBAAE,SAAS;gBACpH,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;oBAAE,SAAS;gBACnF,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC7D,IAAI,GAAG,CAAC,MAAM,GAAG,KAAK;oBAAE,OAAO,GAAG,CAAC;YACrC,CAAC;QACD,IAAI,MAAM;YAAE,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC;gBAClE,qFAAqF;gBACrF,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBACpC,IAAI,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBAAE,SAAS;gBAC/E,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC;oBACnF,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC;oBACzE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;wBAAE,SAAS;oBAC/B,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,CAAC,QAAQ,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;oBACjG,IAAI,GAAG,CAAC,MAAM,GAAG,KAAK;wBAAE,OAAO,GAAG,CAAC;gBACrC,CAAC;YACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oHAAoH;AACpH,SAAS,aAAa,CAAC,KAA8B;IACnD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,EAAE,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACxE,IAAI,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACzD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACtC,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,sCAAsC,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3B,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/B,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACzD,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACnD,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACjB,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE;gBAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,GAAG,EAAE,CAAC,CAAC,CAAC;YAC9D,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;gBACjC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC3D,CAAC;YACD,0FAA0F;YAC1F,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC;gBAAE,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnF,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBAClC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC5D,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;AACjD,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,cAAc,CAAC,KAA8B,EAAE,KAAgB,EAAE,eAAwB,EAAE,QAAiB;IAC1H,MAAM,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC;IAC1B,IAAI,CAAC,CAAC;QAAE,OAAO,eAAe,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI;QAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACtD,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IAC/B,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa;YAAE,SAAS;QACjD,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;QACjF,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAChK,IAAI,QAAQ,EAAE,CAAC;QACb,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;QACzC,IAAI,GAAG,CAAC,MAAM,GAAG,iBAAiB;YAAE,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC;IACpD,CAAC;IACD,IAAI,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,4DAA4D,EAAE,CAAC;IAC5F,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC1G,CAAC"}

package/dist/flow-guard-instructions.d.ts

@@ -0,0 +1,12 @@
+export declare const INJECTION_HINTS: RegExp;
+export interface InstructionSignal {
+    kind: string;
+    start: number;
+    end: number;
+}
+export interface InstructionSignals {
+    matches: InstructionSignal[];
+    limited: boolean;
+}
+export declare function instructionSignals(text: string): InstructionSignals;
+//# sourceMappingURL=flow-guard-instructions.d.ts.map

package/dist/flow-guard-instructions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow-guard-instructions.d.ts","sourceRoot":"","sources":["../src/flow-guard-instructions.ts"],"names":[],"mappings":"AAkBA,eAAO,MAAM,eAAe,QAA2E,CAAC;AACxG,MAAM,WAAW,iBAAiB;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE;AAC/E,MAAM,WAAW,kBAAkB;IAAG,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE;AAEtF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAenE"}

package/dist/flow-guard-instructions.js

@@ -0,0 +1,36 @@
+/** Bounded, fallible signals in source text. Never an authority or a semantic verdict. */
+import { MAX_TEXT } from './flow-guard-text.js';
+const LEGACY = /ignore (all |any |the )?(previous|prior|above) (instructions|messages)|disregard (the|your|all) (previous|prior|system)|<\/?(important|system|instructions?|critical[_-]?requirement)\b|do not (tell|show|inform|mention to) the user|you are now|new instructions:|assistant must|before (any|every) (reply|response), (call|run|use)/i;
+// Require instruction syntax or an authority claim together with a nearby directive.
+// Ordinary amenities, preferences and approvals alone are not instruction signals.
+const RULES = [
+    ['legacy', LEGACY],
+    ['role-boundary', /\[im_start\][ \t]*(?:system|developer|assistant)\b|<\|start_header_id\|>[ \t]*(?:system|developer|assistant)\b|<(?:system|developer|assistant)(?:[ \t][^>\n]{0,80})?>/i],
+    ['relayed-preference', /(?:verified|latest|newer|updated|final)\s+(?:customer|user)\s+(?:update|preference|request)[^\n]{0,360}?\b(?:return|choose|select|recommend|put)\b|(?:customer|user)\s+(?:update|preference|request)[^\n]{0,160}?\b(?:newer than|supersedes|overrides)\b[^\n]{0,160}?\b(?:return|choose|select|recommend|put)\b/i],
+    ['claimed-prior-decision', /(?:cached|previous|prior)\s+(?:assistant\s+)?(?:analysis|reasoning|decision)[^\n]{0,360}?\b(?:continue|return|choose|select|recommend)\b|(?:customer|user)\s+(?:already|previously)\s+(?:approved|selected|chose)[^\n]{0,240}?\b(?:continue|return|choose|select|recommend)\b/i],
+    ['private-rubric', /(?:internal|private|hidden)\s+(?:evaluation\s+)?(?:rubric|evaluator|scoring|benchmark)[^\n]{0,240}?\b(?:must\s+(?:choose|select|recommend)|expects?\b|(?:return|put)\b[^\n]{0,80}?\b(?:id|answer|response))/i],
+    ['concealed-directive', /do not\s+(?:reveal|disclose|mention|describe)\s+(?:this|the|our)\s+(?:(?:internal|private|scoring|hidden|selection)\s+){0,2}(?:instruction|note|rubric|handoff|relay)\b|without\s+(?:asking for confirmation or\s+)?(?:mentioning|describing)\s+(?:this|the)\s+(?:relay|handoff|instruction)\b/i],
+    ['relayed-preference-ru', /(?:последнее|обновл[её]нное|новое)\s+предпочтение\s+(?:пользователя|клиента)[^\n]{0,300}?(?:выберите|верните|рекомендуйте)|не\s+(?:упоминайте|раскрывайте)\s+(?:это|данное)\s+(?:служебное\s+)?(?:сообщение|указание|инструкцию)/i],
+];
+// Kept non-global for callers using .test(). It has no mutable lastIndex state.
+export const INJECTION_HINTS = new RegExp(RULES.map(([, rule]) => `(?:${rule.source})`).join('|'), 'i');
+export function instructionSignals(text) {
+    const input = text.slice(0, MAX_TEXT);
+    const matches = [];
+    // Upstream text extraction may already have stopped at this budget. Treat an
+    // exactly full buffer conservatively as limited rather than declaring coverage.
+    let limited = text.length >= MAX_TEXT;
+    for (const [kind, rule] of RULES) {
+        let count = 0;
+        for (const match of input.matchAll(new RegExp(rule.source, 'gi'))) {
+            if (count++ === 16) {
+                limited = true;
+                break;
+            }
+            matches.push({ kind, start: match.index, end: match.index + match[0].length });
+        }
+    }
+    matches.sort((a, b) => a.start - b.start || a.end - b.end);
+    return { matches, limited };
+}
+//# sourceMappingURL=flow-guard-instructions.js.map

package/dist/flow-guard-instructions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow-guard-instructions.js","sourceRoot":"","sources":["../src/flow-guard-instructions.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEhD,MAAM,MAAM,GAAG,yUAAyU,CAAC;AAEzV,qFAAqF;AACrF,mFAAmF;AACnF,MAAM,KAAK,GAAG;IACZ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAClB,CAAC,eAAe,EAAE,wKAAwK,CAAC;IAC3L,CAAC,oBAAoB,EAAE,kTAAkT,CAAC;IAC1U,CAAC,wBAAwB,EAAE,gRAAgR,CAAC;IAC5S,CAAC,gBAAgB,EAAE,8MAA8M,CAAC;IAClO,CAAC,qBAAqB,EAAE,iSAAiS,CAAC;IAC1T,CAAC,uBAAuB,EAAE,mOAAmO,CAAC;CACtP,CAAC;AAEX,gFAAgF;AAChF,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,MAAM,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;AAIxG,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACtC,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,6EAA6E;IAC7E,gFAAgF;IAChF,IAAI,OAAO,GAAG,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC;QACjC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;YAClE,IAAI,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;gBAAC,OAAO,GAAG,IAAI,CAAC;gBAAC,MAAM;YAAC,CAAC;YAC9C,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAM,EAAE,GAAG,EAAE,KAAK,CAAC,KAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;IAC3D,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC"}

package/dist/flow-guard-labels.d.ts

@@ -0,0 +1,10 @@
+import type { FlowLabel } from './flow-guard-types.js';
+/** MCP tools that sessions used without an operator label, with the guard's guess and the sessions that used them. */
+export declare function unlabeledTools(env?: NodeJS.ProcessEnv): Array<{
+    tool: string;
+    guessed: FlowLabel[];
+    sessions: number;
+}>;
+/** `warden-mcp flow-labels`: the unlabeled tools, and a labels block to review and paste into the policy file. */
+export declare function flowLabelsReport(env?: NodeJS.ProcessEnv): string;
+//# sourceMappingURL=flow-guard-labels.d.ts.map

package/dist/flow-guard-labels.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow-guard-labels.d.ts","sourceRoot":"","sources":["../src/flow-guard-labels.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAa,MAAM,uBAAuB,CAAC;AAKlE,sHAAsH;AACtH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,SAAS,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAgBpI;AAED,kHAAkH;AAClH,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAgB7E"}

package/dist/flow-guard-labels.js

@@ -0,0 +1,55 @@
+/** Flow guard: `warden-mcp flow-labels`, the MCP tools sessions used without an operator label. */
+import { readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { flowPaths, stateDir } from './flow-guard-paths.js';
+import { LABELS } from './flow-guard-policy.js';
+import { readFlowState, safeToolName } from './flow-guard-state.js';
+/** MCP tools that sessions used without an operator label, with the guard's guess and the sessions that used them. */
+export function unlabeledTools(env = process.env) {
+    const dir = flowPaths(stateDir(env), 'x').dir;
+    const seen = new Map();
+    let files = [];
+    try {
+        files = readdirSync(dir).filter(f => /^[0-9a-f]{64}\.json$/.test(f));
+    }
+    catch {
+        return [];
+    }
+    for (const f of files) {
+        let s;
+        try {
+            s = readFlowState(join(dir, f));
+        }
+        catch {
+            continue;
+        }
+        for (const [tool, labels] of Object.entries(s.unlabeled ?? {})) {
+            const e = seen.get(tool) ?? { guessed: new Set(), sessions: 0 };
+            for (const l of labels)
+                e.guessed.add(l);
+            e.sessions++;
+            seen.set(tool, e);
+        }
+    }
+    return [...seen].map(([tool, e]) => ({ tool, guessed: LABELS.filter(l => e.guessed.has(l)), sessions: e.sessions })).sort((a, b) => b.sessions - a.sessions || a.tool.localeCompare(b.tool));
+}
+/** `warden-mcp flow-labels`: the unlabeled tools, and a labels block to review and paste into the policy file. */
+export function flowLabelsReport(env = process.env) {
+    const tools = unlabeledTools(env);
+    const policyPath = env.WARDEN_FLOW_POLICY || join(stateDir(env), 'flow-policy.json');
+    if (!tools.length)
+        return `No MCP tool without a label has been used in a recorded session. Policy file: ${policyPath}\n`;
+    const lines = tools.map(t => `  ${safeToolName(t.tool).padEnd(48)} guessed: ${t.guessed.join(', ') || '-'}   sessions: ${t.sessions}`);
+    const labels = Object.fromEntries(tools.map(t => [t.tool, t.guessed]));
+    return [
+        `MCP tools used without an operator label (${tools.length}). The guard guessed from names and arguments; a guess only adds caution.`,
+        ...lines,
+        '',
+        `Check each guess against what the tool really does, then put the corrected labels into ${policyPath}:`,
+        '  private: returns the user\'s own data   untrusted: returns text others wrote   outbound: reaches a person or a host   destructive: changes or deletes things',
+        '',
+        JSON.stringify({ labels }, null, 2),
+        '',
+    ].join('\n');
+}
+//# sourceMappingURL=flow-guard-labels.js.map

package/dist/flow-guard-labels.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow-guard-labels.js","sourceRoot":"","sources":["../src/flow-guard-labels.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAEpE,sHAAsH;AACtH,MAAM,UAAU,cAAc,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IACjE,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC;IAC9C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAyD,CAAC;IAC9E,IAAI,KAAK,GAAa,EAAE,CAAC;IACzB,IAAI,CAAC;QAAC,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;IAClG,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAY,CAAC;QACjB,IAAI,CAAC;YAAC,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,SAAS;QAAC,CAAC;QAC5D,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/D,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,GAAG,EAAa,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;YAC3E,KAAK,MAAM,CAAC,IAAI,MAAM;gBAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACzC,CAAC,CAAC,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/L,CAAC;AAED,kHAAkH;AAClH,MAAM,UAAU,gBAAgB,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IACnE,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,UAAU,GAAG,GAAG,CAAC,kBAAkB,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACrF,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,iFAAiF,UAAU,IAAI,CAAC;IAC1H,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACvI,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACvE,OAAO;QACL,6CAA6C,KAAK,CAAC,MAAM,2EAA2E;QACpI,GAAG,KAAK;QACR,EAAE;QACF,0FAA0F,UAAU,GAAG;QACvG,gKAAgK;QAChK,EAAE;QACF,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACnC,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/flow-guard-leak.d.ts

@@ -0,0 +1,29 @@
+import type { OutTail } from './flow-guard-types.js';
+import { flowPaths } from './flow-guard-paths.js';
+export declare function readFp(path: string): Set<string>;
+export interface FpStores {
+    secret: Set<string>;
+    fp: Set<string>;
+    pii: Set<string>;
+    tok: Set<string>;
+}
+export declare function readStores(paths: ReturnType<typeof flowPaths>): FpStores;
+export interface LeakCheck {
+    secret?: string;
+    private?: boolean;
+    pii?: boolean;
+    incomplete?: boolean;
+}
+/** `typed`: what the user typed this session. A value the user typed is theirs to send; it is skipped
+ * for ordinary private text, never for secrets. */
+export declare function checkLeak(paths: ReturnType<typeof flowPaths>, input: Record<string, unknown>, typed?: readonly string[], stores?: FpStores): LeakCheck;
+/**
+ * A value sent in pieces, one call each, is checked whole: each argument name keeps the tail of what it carried,
+ * and the windows that cross from that tail into this call are checked like any other. Only pieces sent back to back
+ * through the same argument join; words between them break the run. Returns the new tails.
+ */
+export declare function checkStream(input: Record<string, unknown>, tails: Readonly<Record<string, OutTail>>, stores: FpStores): {
+    leak: LeakCheck;
+    next: Record<string, OutTail>;
+};
+//# sourceMappingURL=flow-guard-leak.d.ts.map

package/dist/flow-guard-leak.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow-guard-leak.d.ts","sourceRoot":"","sources":["../src/flow-guard-leak.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AA6BlD,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAShD;AAED,MAAM,WAAW,QAAQ;IAAG,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAAE;AACtG,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,SAAS,CAAC,GAAG,QAAQ,CAExE;AAED,MAAM,WAAW,SAAS;IAAG,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE;AACtG;mDACmD;AACnD,wBAAgB,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,GAAE,SAAS,MAAM,EAAO,EAAE,MAAM,GAAE,QAA4B,GAAG,SAAS,CAkB7K;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAgC1K"}