@cat-factory/kernel 0.324.0 → 0.326.0

package/dist/shared/environment-host-bridge.logic.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"environment-host-bridge.logic.d.ts","sourceRoot":"","sources":["../../src/shared/environment-host-bridge.logic.ts"],"names":[],"mappings":"AA0CA;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAUhE;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,sBAAsB;AAChC,gGAAgG;AAC9F;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE;AAClB,6FAA6F;GAC3F;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AAClC,8FAA8F;GAC5F;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAA;AAgC1C;;;;;;;;GAQG;AACH,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,MAAM,GAAG,sBAAsB,CAKvF"}
+{"version":3,"file":"environment-host-bridge.logic.d.ts","sourceRoot":"","sources":["../../src/shared/environment-host-bridge.logic.ts"],"names":[],"mappings":"AAkDA;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAUhE;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,sBAAsB;AAChC,2FAA2F;AACzF;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE;AAClB,2EAA2E;GACzE;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE;AAC5D,2FAA2F;GACzF;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,iBAAiB,CAAA;CAAE,CAAA;AAEpE;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,iBAAiB,GAAG,eAAe,GAAG,kBAAkB,CAAA;AAEpE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,gBAAgB,GAAG,cAAc,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CAAA;AAE9D;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAe5D;AAmDD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,GACtB,sBAAsB,CAcxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,GAAG,MAAM,CAGxF"}

package/dist/shared/environment-host-bridge.logic.js

@@ -24,7 +24,7 @@
 // name to the gateway inside the container does that, and it keeps the `Host` header the ingress
 // routes on correct for free, which a rewritten authority would not.
 import { wildcardDnsSuffix, wildcardDnsWindows } from '@cat-factory/contracts';
-import { decodeIpv4, isLocalMachineHost, isLoopbackHost } from './ip-host.logic.js';
+import { decimalV4, decodeIpv4, decodeIpv6, isCloudMetadataHost, isLocalMachineHost, isLoopbackHost, mappedV4, } from './ip-host.logic.js';
 /**
  * The one spelling every rule here compares against: lower-cased, trimmed, IPv6 brackets and the
  * fully-qualified trailing dot removed. Shared rather than repeated so a hostname cannot be judged
@@ -67,6 +67,77 @@ export function resolvesToLocalMachine(hostname) {
     const [resolved] = wildcardDnsWindows(host);
     return resolved !== undefined && isLoopbackHost(resolved);
 }
+/**
+ * Whether an address a provider stated may be used as a bridge target.
+ *
+ * Until this existed the target was the fixed literal `host-gateway`, so the destination of every
+ * bridge was CODE. An address makes it DATA, on a path whose container is itself the trust
+ * boundary, so the rule is stated here beside the classifier rather than left to whichever
+ * adapter interpolates the string.
+ *
+ * Deliberately NOT {@link isBlockedPrivateHost}, which is the strict policy for a URL an org
+ * supplies and blocks the whole RFC1918 space. An internal load balancer on `10.x` is precisely
+ * the population this feature exists for, and refusing it would leave the feature with nothing to
+ * name. What is refused instead is the set an address bridge could only ever be ABUSED to reach:
+ *
+ *   - Anything that is not a CANONICAL literal. `decodeIpv4` accepts a bare 32-bit integer and
+ *     hex/octal octets because a URL guard must see through those encodings; a bridge target has
+ *     no reason to be spelled that way, and accepting the obfuscated forms is how `2130706433`
+ *     becomes loopback in a reader that only pattern-matched `127.`.
+ *   - LOOPBACK, which inside a container is the container's own namespace, where the harness
+ *     itself is listening. A name re-pointed there does not reach the host; it reaches us.
+ *   - LINK-LOCAL and the vendor metadata addresses, the endpoint an SSRF aims at for instance
+ *     credentials, reached here by a name the agent has every reason to fetch.
+ *   - The unspecified, multicast and broadcast addresses, which name no host at all.
+ *
+ * Every one of those classes is judged on the DECODED address rather than on how it is written.
+ * IPv6 has many spellings of one value, so a `host === '::1'` comparison admits `0::1` and
+ * `0:0:0:0:0:0:0:1`, and a `startsWith('fe80:')` test covers an eighth of `fe80::/10`; the
+ * metadata targets are read out of `isCloudMetadataHost`, the swept definition every other guard
+ * in the tree shares, rather than restated here where a vendor added there would not reach.
+ */
+export function isBridgeableAddress(address) {
+    const host = normalizeHostname(address);
+    if (!host)
+        return false;
+    // Link-local (169.254/16, incl. IMDS), every vendor metadata address and the metadata NAMES,
+    // across every obfuscated encoding. One definition, shared with the SSRF guards.
+    if (isCloudMetadataHost(host))
+        return false;
+    if (host.includes(':')) {
+        // IPv6. An IPv4-mapped literal is judged on the address it carries, never on its spelling.
+        const mapped = mappedV4(host);
+        if (mapped)
+            return isBridgeableV4(mapped);
+        const groups = decodeIpv6(host);
+        return groups !== null && isBridgeableV6(groups);
+    }
+    const v4 = decimalV4(host);
+    return v4 !== null && isBridgeableV4(v4);
+}
+/** The IPv4 half of {@link isBridgeableAddress}, once the literal has been decoded. */
+function isBridgeableV4(parts) {
+    const [a] = parts;
+    if (a === 0 || a === 127)
+        return false; // unspecified / loopback
+    if (a >= 224)
+        return false; // multicast, reserved, and 255.255.255.255
+    return true;
+}
+/** The IPv6 half, judged on the decoded groups so no spelling of a refused class gets through. */
+function isBridgeableV6(groups) {
+    if (groups.every((group) => group === 0))
+        return false; // unspecified, `::`
+    // Loopback, `::1` in any spelling.
+    if (groups.every((group, index) => group === (index === 7 ? 1 : 0)))
+        return false;
+    const first = groups[0] ?? 0;
+    if ((first & 0xffc0) === 0xfe80)
+        return false; // link-local, fe80::/10
+    if ((first & 0xff00) === 0xff00)
+        return false; // multicast, ff00::/8
+    return true;
+}
 /**
  * Whether mapping `host` to the container's host gateway would achieve anything.
  *
@@ -99,21 +170,57 @@ function isHostsFileAddressable(host) {
     return decodeIpv4(host) === null;
 }
 /**
- * Grade a hostname for the host-gateway bridge: leave it alone, map it, or report that it names
- * this machine and cannot be mapped.
+ * Grade a hostname for a host bridge: leave it alone, map it (to the host gateway or to a stated
+ * address), or report that it names this machine and cannot be mapped.
  *
  * The whole rule lives here rather than beside the container runtime because more than one layer
  * has to agree about it, and because both wrong answers are silent in production: bridging a
  * remote host breaks an environment that worked, and not bridging a wildcard-DNS loopback name
  * leaves the tester on connection failures it reports as a dead environment.
+ *
+ * `address` is the address the environment's provider stated for THIS hostname, already PROVED to
+ * carry (see `EnvironmentRouteProof`); absent means the name is all anyone has. The two cases are
+ * ordered rather than combined, and the order is not arbitrary: a name that answers with this
+ * machine's own address is a dead end inside a container whatever a provider says about it, so it
+ * takes the gateway branch first and a stated address never overrides it.
+ *
+ * Note the asymmetry this leaves, which is correct. A REMOTE name with NO address is reported
+ * `none`: it reaches whatever it reaches from inside the container exactly as it does outside, and
+ * there is nothing to report. A remote name WITH one is a different fact, because an address is
+ * only ever present when the proof established that the name did not carry and the address did
+ * (`EnvironmentRouteProof.via`). Failing to install THAT is a run heading for the connection
+ * failures this mechanism exists to stop, with a proof on the record vouching for a route the
+ * container never got, so it is reported `unbridgeable` rather than passed over as `none`.
  */
-export function classifyLocalMachineHostBridge(hostname) {
+export function classifyLocalMachineHostBridge(hostname, address) {
     const host = normalizeHostname(hostname);
     if (!host)
         return { kind: 'none' };
-    if (!resolvesToLocalMachine(host))
+    if (resolvesToLocalMachine(host)) {
+        return isHostsFileAddressable(host)
+            ? { kind: 'bridge', host, target: 'host-gateway' }
+            : { kind: 'unbridgeable', host, cause: 'local_machine' };
+    }
+    if (!address)
         return { kind: 'none' };
-    return isHostsFileAddressable(host) ? { kind: 'bridge', host } : { kind: 'unbridgeable', host };
+    const ip = normalizeHostname(address);
+    if (!isBridgeableAddress(ip) || !isHostsFileAddressable(host)) {
+        return { kind: 'unbridgeable', host, cause: 'unusable_address' };
+    }
+    return { kind: 'bridge', host, target: { ip } };
+}
+/**
+ * The one spelling of a bridge, for comparing a needed bridge against what a running container
+ * was CREATED with and for recording it on that container's handle.
+ *
+ * Derived rather than hand-formatted at each site because the comparison is an IDENTITY: a
+ * mismatch destroys and rebuilds a warm container, so two spellings of the same bridge would
+ * replace one for nothing, and one spelling covering two different targets would leave a run
+ * wedged against a stale address in a container nothing will replace.
+ */
+export function hostBridgeKey(bridge) {
+    const target = bridge.target === 'host-gateway' ? 'host-gateway' : bridge.target.ip;
+    return bridge.host + '=' + target;
 }
 // The URL half of this (pull the hostname out, decide whether to bridge it) is deliberately NOT
 // here: kernel compiles against `lib: ["ES2022"]` with no DOM and no Node types, so `URL` is

package/dist/shared/environment-host-bridge.logic.js.map

@@ -1 +1 @@
-{"version":3,"file":"environment-host-bridge.logic.js","sourceRoot":"","sources":["../../src/shared/environment-host-bridge.logic.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,EAAE;AACF,oGAAoG;AACpG,8FAA8F;AAC9F,8FAA8F;AAC9F,iGAAiG;AACjG,iGAAiG;AACjG,8FAA8F;AAC9F,oGAAoG;AACpG,mGAAmG;AACnG,6DAA6D;AAC7D,EAAE;AACF,iGAAiG;AACjG,oGAAoG;AACpG,2FAA2F;AAC3F,0FAA0F;AAC1F,EAAE;AACF,oGAAoG;AACpG,wFAAwF;AACxF,mGAAmG;AACnG,kGAAkG;AAClG,gGAAgG;AAChG,mGAAmG;AACnG,iGAAiG;AACjG,qEAAqE;AAErE,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAC9E,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAEnF;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,QAAgB;IACzC,OAAO,QAAQ;SACZ,IAAI,EAAE;SACN,WAAW,EAAE;SACb,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AACvB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACrD,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAA;IACxC,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IACvB,IAAI,kBAAkB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACzC,+FAA+F;IAC/F,gGAAgG;IAChG,2EAA2E;IAC3E,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IAC1C,MAAM,CAAC,QAAQ,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAA;IAC3C,OAAO,QAAQ,KAAK,SAAS,IAAI,cAAc,CAAC,QAAQ,CAAC,CAAA;AAC3D,CAAC;AAoBD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAS,sBAAsB,CAAC,IAAY;IAC1C,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,KAAK,CAAA;IACtC,mGAAmG;IACnG,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IACpC,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,IAAI,CAAA;AAClC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,8BAA8B,CAAC,QAAgB;IAC7D,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAA;IACxC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IAClC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IAC1D,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAA;AACjG,CAAC;AAED,gGAAgG;AAChG,6FAA6F;AAC7F,kGAAkG;AAClG,oGAAoG;AACpG,mGAAmG;AACnG,4DAA4D"}
+{"version":3,"file":"environment-host-bridge.logic.js","sourceRoot":"","sources":["../../src/shared/environment-host-bridge.logic.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,EAAE;AACF,oGAAoG;AACpG,8FAA8F;AAC9F,8FAA8F;AAC9F,iGAAiG;AACjG,iGAAiG;AACjG,8FAA8F;AAC9F,oGAAoG;AACpG,mGAAmG;AACnG,6DAA6D;AAC7D,EAAE;AACF,iGAAiG;AACjG,oGAAoG;AACpG,2FAA2F;AAC3F,0FAA0F;AAC1F,EAAE;AACF,oGAAoG;AACpG,wFAAwF;AACxF,mGAAmG;AACnG,kGAAkG;AAClG,gGAAgG;AAChG,mGAAmG;AACnG,iGAAiG;AACjG,qEAAqE;AAErE,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAC9E,OAAO,EACL,SAAS,EACT,UAAU,EACV,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,QAAQ,GACT,MAAM,oBAAoB,CAAA;AAE3B;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,QAAgB;IACzC,OAAO,QAAQ;SACZ,IAAI,EAAE;SACN,WAAW,EAAE;SACb,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AACvB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACrD,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAA;IACxC,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IACvB,IAAI,kBAAkB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACzC,+FAA+F;IAC/F,gGAAgG;IAChG,2EAA2E;IAC3E,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IAC1C,MAAM,CAAC,QAAQ,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAA;IAC3C,OAAO,QAAQ,KAAK,SAAS,IAAI,cAAc,CAAC,QAAQ,CAAC,CAAA;AAC3D,CAAC;AAuDD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAA;IACvC,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IACvB,6FAA6F;IAC7F,iFAAiF;IACjF,IAAI,mBAAmB,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IAC3C,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,2FAA2F;QAC3F,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;QAC7B,IAAI,MAAM;YAAE,OAAO,cAAc,CAAC,MAAM,CAAC,CAAA;QACzC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;QAC/B,OAAO,MAAM,KAAK,IAAI,IAAI,cAAc,CAAC,MAAM,CAAC,CAAA;IAClD,CAAC;IACD,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAC1B,OAAO,EAAE,KAAK,IAAI,IAAI,cAAc,CAAC,EAAE,CAAC,CAAA;AAC1C,CAAC;AAED,uFAAuF;AACvF,SAAS,cAAc,CAAC,KAAuC;IAC7D,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,CAAA;IACjB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,KAAK,CAAA,CAAC,yBAAyB;IAChE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,KAAK,CAAA,CAAC,2CAA2C;IACtE,OAAO,IAAI,CAAA;AACb,CAAC;AAED,kGAAkG;AAClG,SAAS,cAAc,CAAC,MAAyB;IAC/C,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA,CAAC,oBAAoB;IAC3E,mCAAmC;IACnC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IACjF,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;IAC5B,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,MAAM;QAAE,OAAO,KAAK,CAAA,CAAC,wBAAwB;IACtE,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,MAAM;QAAE,OAAO,KAAK,CAAA,CAAC,sBAAsB;IACpE,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAS,sBAAsB,CAAC,IAAY;IAC1C,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,KAAK,CAAA;IACtC,mGAAmG;IACnG,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IACpC,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,IAAI,CAAA;AAClC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,8BAA8B,CAC5C,QAAgB,EAChB,OAAuB;IAEvB,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAA;IACxC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IAClC,IAAI,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,OAAO,sBAAsB,CAAC,IAAI,CAAC;YACjC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE;YAClD,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,KAAK,EAAE,eAAe,EAAE,CAAA;IAC5D,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IACrC,MAAM,EAAE,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAA;IACrC,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9D,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAA;IAClE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,CAAA;AACjD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,MAAkD;IAC9E,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAA;IACnF,OAAO,MAAM,CAAC,IAAI,GAAG,GAAG,GAAG,MAAM,CAAA;AACnC,CAAC;AAED,gGAAgG;AAChG,6FAA6F;AAC7F,kGAAkG;AAClG,oGAAoG;AACpG,mGAAmG;AACnG,4DAA4D"}

package/dist/shared/ip-host.logic.d.ts

@@ -12,6 +12,22 @@ export declare function mappedV4(host: string): [number, number, number, number]
  * rejects ALL numeric forms outright should use {@link isBlockedPrivateHost}.
  */
 export declare function decodeIpv4(host: string): [number, number, number, number] | null;
+/**
+ * Decode an IPv6 literal to its eight 16-bit groups, or null when it is not one.
+ *
+ * Exists because an IPv6 address has MANY spellings of one value and a rule that pattern-matches
+ * the canonical one is not a rule: `::1`, `0::1` and `0:0:0:0:0:0:0:1` are the same loopback
+ * address, and a check comparing against the literal `'::1'` admits the other two. Same for
+ * `fe80::/10`, where a `startsWith('fe80:')` test covers an eighth of the range and passes
+ * `fe90::1`. Callers that must classify an IPv6 target (link-local, multicast, loopback) decode
+ * first and judge the NUMBER, exactly as {@link decodeIpv4} exists so a guard never judges a v4
+ * spelling.
+ *
+ * Refused rather than decoded: a zone id (`fe80::1%eth0`), which names a local interface and can
+ * never be a routable target, and any group that is not 1-4 hex digits. A trailing dotted-quad is
+ * accepted, being the ordinary spelling of a mapped or translated address.
+ */
+export declare function decodeIpv6(hostname: string): number[] | null;
 /**
  * Whether a host resolves to a known cloud-metadata / link-local target — the endpoint
  * an SSRF would aim at for instance credentials. Covers the metadata hostnames plus the

package/dist/shared/ip-host.logic.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ip-host.logic.d.ts","sourceRoot":"","sources":["../../src/shared/ip-host.logic.ts"],"names":[],"mappings":"AAUA,oFAAoF;AACpF,wBAAgB,WAAW,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAO5E;AAED,6EAA6E;AAC7E,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAS/E;AAED,sFAAsF;AACtF,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAmB9E;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAWhF;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAe7D;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAGxD;AAmBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAM5D;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAiC9D"}
+{"version":3,"file":"ip-host.logic.d.ts","sourceRoot":"","sources":["../../src/shared/ip-host.logic.ts"],"names":[],"mappings":"AAUA,oFAAoF;AACpF,wBAAgB,WAAW,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAO5E;AAED,6EAA6E;AAC7E,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAS/E;AAED,sFAAsF;AACtF,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAmB9E;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAWhF;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAY5D;AAoBD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAe7D;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAGxD;AAmBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAM5D;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAiC9D"}

package/dist/shared/ip-host.logic.js

@@ -77,6 +77,58 @@ export function decodeIpv4(host) {
     }
     return null;
 }
+/**
+ * Decode an IPv6 literal to its eight 16-bit groups, or null when it is not one.
+ *
+ * Exists because an IPv6 address has MANY spellings of one value and a rule that pattern-matches
+ * the canonical one is not a rule: `::1`, `0::1` and `0:0:0:0:0:0:0:1` are the same loopback
+ * address, and a check comparing against the literal `'::1'` admits the other two. Same for
+ * `fe80::/10`, where a `startsWith('fe80:')` test covers an eighth of the range and passes
+ * `fe90::1`. Callers that must classify an IPv6 target (link-local, multicast, loopback) decode
+ * first and judge the NUMBER, exactly as {@link decodeIpv4} exists so a guard never judges a v4
+ * spelling.
+ *
+ * Refused rather than decoded: a zone id (`fe80::1%eth0`), which names a local interface and can
+ * never be a routable target, and any group that is not 1-4 hex digits. A trailing dotted-quad is
+ * accepted, being the ordinary spelling of a mapped or translated address.
+ */
+export function decodeIpv6(hostname) {
+    const host = hostname.toLowerCase().replace(/^\[|\]$/g, '');
+    if (!host.includes(':') || host.includes('%'))
+        return null;
+    const halves = host.split('::');
+    if (halves.length > 2)
+        return null;
+    const head = expandIpv6Groups(halves[0] ?? '');
+    const tail = halves.length === 2 ? expandIpv6Groups(halves[1] ?? '') : [];
+    if (!head || !tail)
+        return null;
+    if (halves.length === 1)
+        return head.length === 8 ? head : null;
+    // `::` stands for at least one all-zero group, so a compression that saves nothing is malformed.
+    const filled = 8 - head.length - tail.length;
+    return filled >= 1 ? [...head, ...Array.from({ length: filled }, () => 0), ...tail] : null;
+}
+/** One colon-separated run of an IPv6 literal as 16-bit groups, or null when it is malformed. */
+function expandIpv6Groups(part) {
+    if (part === '')
+        return [];
+    const chunks = part.split(':');
+    const groups = [];
+    for (const [index, chunk] of chunks.entries()) {
+        if (index === chunks.length - 1 && chunk.includes('.')) {
+            const v4 = decimalV4(chunk);
+            if (!v4)
+                return null;
+            groups.push((v4[0] << 8) | v4[1], (v4[2] << 8) | v4[3]);
+            continue;
+        }
+        if (!/^[0-9a-f]{1,4}$/.test(chunk))
+            return null;
+        groups.push(parseInt(chunk, 16));
+    }
+    return groups;
+}
 /**
  * Whether a host resolves to a known cloud-metadata / link-local target — the endpoint
  * an SSRF would aim at for instance credentials. Covers the metadata hostnames plus the

package/dist/shared/ip-host.logic.js.map

@@ -1 +1 @@
-{"version":3,"file":"ip-host.logic.js","sourceRoot":"","sources":["../../src/shared/ip-host.logic.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,sFAAsF;AACtF,gFAAgF;AAChF,gFAAgF;AAChF,mFAAmF;AACnF,sFAAsF;AACtF,oFAAoF;AACpF,oFAAoF;AACpF,iDAAiD;AAEjD,oFAAoF;AACpF,MAAM,UAAU,WAAW,CAAC,KAAuC;IACjE,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAA;IACpB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,IAAI,CAAA;IACjD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IACvC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IACvC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAA;IAChD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAA;IACpE,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IACnB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACtB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACtB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACtB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACtB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,GAAG;QAAE,OAAO,IAAI,CAAA;IACzD,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;AACrB,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,iBAAiB;IACjB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAA;IAChF,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3B,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,GAAG;YAAE,OAAO,IAAI,CAAA;QACzD,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IACrB,CAAC;IACD,wEAAwE;IACxE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAA;IAClE,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAA;QACtC,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAA;QACtC,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,CAAA;IACnE,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAC9B,IAAI,MAAM;QAAE,OAAO,MAAM,CAAA;IACzB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC7B,IAAI,MAAM;QAAE,OAAO,MAAM,CAAA;IACzB,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;QACtB,IAAI,CAAC,GAAG,UAAU;YAAE,OAAO,IAAI,CAAA;QAC/B,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAA;IAC3E,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IAC3D,IAAI,IAAI,KAAK,0BAA0B;QAAE,OAAO,IAAI,CAAA;IACpD,iBAAiB;IACjB,IAAI,IAAI,KAAK,eAAe;QAAE,OAAO,IAAI,CAAA;IACzC,MAAM,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;IAC3B,IAAI,EAAE,EAAE,CAAC;QACP,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAA;QACvB,iFAAiF;QACjF,+EAA+E;QAC/E,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAA;QACvC,0BAA0B;QAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAA;IACnE,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IAC3D,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACpF,CAAC;AAED;;;;GAIG;AACH,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,6FAA6F;IAC7F,gFAAgF;IAChF,SAAS;IACT,IAAI;IACJ,+FAA+F;IAC/F,uEAAuE;IACvE,sBAAsB;IACtB,4BAA4B;IAC5B,yBAAyB;CAC1B,CAAC,CAAA;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IAC3D,IAAI,cAAc,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACrC,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAChD,6DAA6D;IAC7D,OAAO,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IAC3D,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,IAAI,CAAA;IAC5B,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAA;IACpE,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAA;IAEtE,mCAAmC;IACnC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QAChD,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QAC3F,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;QAC7B,IAAI,MAAM;YAAE,OAAO,WAAW,CAAC,MAAM,CAAC,CAAA;QACtC,OAAO,KAAK,CAAA;IACd,CAAC;IAED,wEAAwE;IACxE,gDAAgD;IAChD,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA,CAAC,mBAAmB;QAChE,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA,CAAC,oCAAoC;IAC/E,CAAC;IAED,6EAA6E;IAC7E,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAC1B,IAAI,EAAE;QAAE,OAAO,WAAW,CAAC,EAAE,CAAC,CAAA;IAE9B,8EAA8E;IAC9E,wEAAwE;IACxE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IAE1E,OAAO,KAAK,CAAA;AACd,CAAC"}
+{"version":3,"file":"ip-host.logic.js","sourceRoot":"","sources":["../../src/shared/ip-host.logic.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,sFAAsF;AACtF,gFAAgF;AAChF,gFAAgF;AAChF,mFAAmF;AACnF,sFAAsF;AACtF,oFAAoF;AACpF,oFAAoF;AACpF,iDAAiD;AAEjD,oFAAoF;AACpF,MAAM,UAAU,WAAW,CAAC,KAAuC;IACjE,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAA;IACpB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,IAAI,CAAA;IACjD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IACvC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IACvC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAA;IAChD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAA;IACpE,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IACnB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACtB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACtB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACtB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACtB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,GAAG;QAAE,OAAO,IAAI,CAAA;IACzD,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;AACrB,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,iBAAiB;IACjB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAA;IAChF,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3B,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,GAAG;YAAE,OAAO,IAAI,CAAA;QACzD,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IACrB,CAAC;IACD,wEAAwE;IACxE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAA;IAClE,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAA;QACtC,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAA;QACtC,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,CAAA;IACnE,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAC9B,IAAI,MAAM;QAAE,OAAO,MAAM,CAAA;IACzB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC7B,IAAI,MAAM;QAAE,OAAO,MAAM,CAAA;IACzB,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;QACtB,IAAI,CAAC,GAAG,UAAU;YAAE,OAAO,IAAI,CAAA;QAC/B,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAA;IAC3E,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,UAAU,CAAC,QAAgB;IACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IAC3D,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC/B,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAClC,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;IAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACzE,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IAC/B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;IAC/D,iGAAiG;IACjG,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;IAC5C,OAAO,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AAC5F,CAAC;AAED,iGAAiG;AACjG,SAAS,gBAAgB,CAAC,IAAY;IACpC,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,EAAE,CAAA;IAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9B,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9C,IAAI,KAAK,KAAK,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACvD,MAAM,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;YAC3B,IAAI,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAA;YACpB,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;YACvD,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QAC/C,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAA;IAClC,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IAC3D,IAAI,IAAI,KAAK,0BAA0B;QAAE,OAAO,IAAI,CAAA;IACpD,iBAAiB;IACjB,IAAI,IAAI,KAAK,eAAe;QAAE,OAAO,IAAI,CAAA;IACzC,MAAM,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;IAC3B,IAAI,EAAE,EAAE,CAAC;QACP,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAA;QACvB,iFAAiF;QACjF,+EAA+E;QAC/E,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAA;QACvC,0BAA0B;QAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAA;IACnE,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IAC3D,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACpF,CAAC;AAED;;;;GAIG;AACH,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,6FAA6F;IAC7F,gFAAgF;IAChF,SAAS;IACT,IAAI;IACJ,+FAA+F;IAC/F,uEAAuE;IACvE,sBAAsB;IACtB,4BAA4B;IAC5B,yBAAyB;CAC1B,CAAC,CAAA;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IAC3D,IAAI,cAAc,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACrC,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAChD,6DAA6D;IAC7D,OAAO,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IAC3D,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,IAAI,CAAA;IAC5B,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAA;IACpE,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAA;IAEtE,mCAAmC;IACnC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QAChD,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QAC3F,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;QAC7B,IAAI,MAAM;YAAE,OAAO,WAAW,CAAC,MAAM,CAAC,CAAA;QACtC,OAAO,KAAK,CAAA;IACd,CAAC;IAED,wEAAwE;IACxE,gDAAgD;IAChD,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA,CAAC,mBAAmB;QAChE,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA,CAAC,oCAAoC;IAC/E,CAAC;IAED,6EAA6E;IAC7E,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAC1B,IAAI,EAAE;QAAE,OAAO,WAAW,CAAC,EAAE,CAAC,CAAA;IAE9B,8EAA8E;IAC9E,wEAAwE;IACxE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IAE1E,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/shared/redact-secrets.logic.d.ts

@@ -26,4 +26,24 @@ export declare function isSecretShapedFilename(path: string | null | undefined):
  * Best-effort and never throws, mirroring {@link redactSecrets}.
  */
 export declare function redactSecretsDeep<T>(value: T): T;
+/**
+ * Scrub a flat `key -> value` bag, giving each value its OWN KEY as scrubbing context.
+ *
+ * {@link redactSecretsDeep} is the wrong tool for one: it walks to the string LEAF and scrubs it
+ * alone, so a bag whose secret is `{ apiToken: "9f2c…" }` keeps it: every field-name rule needs
+ * the name, and by the time the walk reaches the value the name is gone. The bag shape is exactly
+ * how a provider's captured provision fields arrive, and that bag is now read by something other
+ * than teardown, so the gap became reachable.
+ *
+ * Implemented by scrubbing a rendered `name=value` pair and slicing the name back off, so there is
+ * ONE rule set rather than a second list of secret-ish names to drift from the first. The name
+ * probed is {@link boundaryFieldName}'s, not the caller's, because the rules are boundary-anchored;
+ * the OUTPUT bag keeps the caller's keys untouched, since they are read by a human and by the
+ * teardown path.
+ *
+ * A pair whose scrubbed form no longer opens with the probed prefix means a rule consumed part of
+ * the NAME, so there is no value to slice back out; that answers {@link REPLACEMENT} rather than
+ * the mangled remainder, which would otherwise splice the field name into its own value.
+ */
+export declare function redactSecretFields(fields: Readonly<Record<string, string>>): Record<string, string>;
 //# sourceMappingURL=redact-secrets.logic.d.ts.map

package/dist/shared/redact-secrets.logic.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redact-secrets.logic.d.ts","sourceRoot":"","sources":["../../src/shared/redact-secrets.logic.ts"],"names":[],"mappings":"AA8IA;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAcjE;AA6CD;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAe/E;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAShD"}
+{"version":3,"file":"redact-secrets.logic.d.ts","sourceRoot":"","sources":["../../src/shared/redact-secrets.logic.ts"],"names":[],"mappings":"AA8IA;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAcjE;AA6CD;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAe/E;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAShD;AAqBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GACvC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQxB"}

package/dist/shared/redact-secrets.logic.js

@@ -247,4 +247,50 @@ export function redactSecretsDeep(value) {
     }
     return value;
 }
+/**
+ * Rewrite a field NAME so a secret word buried inside it starts at a regex word boundary.
+ *
+ * Every {@link RULES} entry that keys off a name opens with `\b`, and `_` is a word character, so
+ * `apiToken` matches while `kargoApiToken`, `provider_api_key` and `deployPassword` do not: there
+ * is no boundary between `o` and `A`, nor between `r` and `a`. Compound names are the NORMAL shape
+ * of a provider's captured field bag, which is the one thing {@link redactSecretFields} exists for,
+ * so the names it probes are split on their own case and separator changes first. `-` rather than
+ * a space because the rules already accept it as an internal separator (`api[_-]?`), so
+ * `provider-api-key` matches the same `api-key` rule `api_key` does.
+ */
+function boundaryFieldName(key) {
+    return key
+        .replace(/([a-z0-9])([A-Z])/g, '$1-$2')
+        .replace(/([A-Z]+)([A-Z][a-z])/g, '$1-$2')
+        .replace(/_/g, '-')
+        .toLowerCase();
+}
+/**
+ * Scrub a flat `key -> value` bag, giving each value its OWN KEY as scrubbing context.
+ *
+ * {@link redactSecretsDeep} is the wrong tool for one: it walks to the string LEAF and scrubs it
+ * alone, so a bag whose secret is `{ apiToken: "9f2c…" }` keeps it: every field-name rule needs
+ * the name, and by the time the walk reaches the value the name is gone. The bag shape is exactly
+ * how a provider's captured provision fields arrive, and that bag is now read by something other
+ * than teardown, so the gap became reachable.
+ *
+ * Implemented by scrubbing a rendered `name=value` pair and slicing the name back off, so there is
+ * ONE rule set rather than a second list of secret-ish names to drift from the first. The name
+ * probed is {@link boundaryFieldName}'s, not the caller's, because the rules are boundary-anchored;
+ * the OUTPUT bag keeps the caller's keys untouched, since they are read by a human and by the
+ * teardown path.
+ *
+ * A pair whose scrubbed form no longer opens with the probed prefix means a rule consumed part of
+ * the NAME, so there is no value to slice back out; that answers {@link REPLACEMENT} rather than
+ * the mangled remainder, which would otherwise splice the field name into its own value.
+ */
+export function redactSecretFields(fields) {
+    const out = {};
+    for (const [key, value] of Object.entries(fields)) {
+        const prefix = `${boundaryFieldName(key)}=`;
+        const scrubbed = redactSecrets(`${prefix}${value}`) ?? '';
+        out[key] = scrubbed.startsWith(prefix) ? scrubbed.slice(prefix.length) : REPLACEMENT;
+    }
+    return out;
+}
 //# sourceMappingURL=redact-secrets.logic.js.map

package/dist/shared/redact-secrets.logic.js.map

@@ -1 +1 @@
-{"version":3,"file":"redact-secrets.logic.js","sourceRoot":"","sources":["../../src/shared/redact-secrets.logic.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,yFAAyF;AACzF,sFAAsF;AACtF,oFAAoF;AACpF,yFAAyF;AACzF,yFAAyF;AACzF,2FAA2F;AAC3F,yFAAyF;AACzF,yEAAyE;AAEzE,MAAM,WAAW,GAAG,YAAY,CAAA;AAEhC,4FAA4F;AAC5F,0FAA0F;AAC1F,4BAA4B;AAC5B,MAAM,qBAAqB,GAAG,iDAAiD,CAAA;AAC/E,MAAM,mBAAmB,GAAG,+CAA+C,CAAA;AAE3E;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAS,sBAAsB,CAAC,KAAa;IAC3C,qBAAqB,CAAC,SAAS,GAAG,CAAC,CAAA;IACnC,IAAI,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC7C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAChC,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,OAAO,KAAK,KAAK,IAAI,EAAE,CAAC;QACtB,mBAAmB,CAAC,SAAS,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;QAC7D,MAAM,GAAG,GAAG,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC3C,IAAI,GAAG,KAAK,IAAI;YAAE,MAAK;QACvB,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,WAAW,CAAA;QACvD,QAAQ,GAAG,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;QACpC,qBAAqB,CAAC,SAAS,GAAG,QAAQ,CAAA;QAC1C,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC3C,CAAC;IACD,OAAO,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;AAC7D,CAAC;AAED,6FAA6F;AAC7F,6FAA6F;AAC7F,qEAAqE;AACrE,MAAM,YAAY,GAAG,iCAAiC,CAAA;AACtD,iGAAiG;AACjG,4FAA4F;AAC5F,sEAAsE;AACtE,MAAM,UAAU,GAAG,iCAAiC,CAAA;AACpD,8FAA8F;AAC9F,6FAA6F;AAC7F,2CAA2C;AAC3C,MAAM,2BAA2B,GAAG,EAAE,CAAA;AAEtC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,oBAAoB,CAAC,KAAa;IACzC,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAC1C,OAAO,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,2BAA2B,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;AAChF,CAAC;AAED,wFAAwF;AACxF,sFAAsF;AACtF,MAAM,KAAK,GAAoE;IAC7E,gFAAgF;IAChF;QACE,OAAO,EAAE,qDAAqD;QAC9D,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;KAC7F;IACD,uEAAuE;IACvE;QACE,OAAO,EACL,kGAAkG;QACpG,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,WAAW,EAAE;KAC/C;IACD,yFAAyF;IACzF,yFAAyF;IACzF,wFAAwF;IACxF,yFAAyF;IACzF,mFAAmF;IACnF,0FAA0F;IAC1F,2FAA2F;IAC3F,qFAAqF;IACrF,2FAA2F;IAC3F,yFAAyF;IACzF;QACE,OAAO,EAAE,2DAA2D;QACpE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,WAAW,GAAG;KAC1C;IACD,8EAA8E;IAC9E,mFAAmF;IACnF;QACE,OAAO,EACL,+JAA+J;QACjK,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CACb,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;KACnF;IACD,2EAA2E;IAC3E,EAAE,OAAO,EAAE,kCAAkC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE;IAC3E,EAAE,OAAO,EAAE,+BAA+B,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE;IACxE,EAAE,OAAO,EAAE,iCAAiC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE;IAC1E,EAAE,OAAO,EAAE,iCAAiC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE;IAC1E,EAAE,OAAO,EAAE,uBAAuB,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE;IAChE,gFAAgF;IAChF;QACE,OAAO,EAAE,sDAAsD;QAC/D,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW;KAC3B;CACF,CAAA;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,KAAoB;IAChD,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,KAAK,CAAA;IAC/B,wFAAwF;IACxF,mEAAmE;IACnE,IAAI,GAAG,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAA;IACvC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE;YAC1C,4EAA4E;YAC5E,0EAA0E;YAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAa,CAAA;YAC5C,OAAO,IAAI,CAAC,OAAO,CAAC,MAAqC,CAAC,CAAA;QAC5D,CAAC,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,4FAA4F;AAC5F,4FAA4F;AAC5F,4FAA4F;AAC5F,0FAA0F;AAC1F,6FAA6F;AAC7F,0FAA0F;AAC1F,MAAM,qBAAqB,GAAwB,IAAI,GAAG,CAAC;IACzD,aAAa,EAAE,yBAAyB;IACxC,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,YAAY;CACb,CAAC,CAAA;AAEF,sFAAsF;AACtF,sFAAsF;AACtF,2CAA2C;AAC3C,MAAM,eAAe,GAAsB;IACzC,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,WAAW;IACX,SAAS;IACT,MAAM,EAAE,4BAA4B;IACpC,MAAM,EAAE,oBAAoB;IAC5B,KAAK,EAAE,4CAA4C;IACnD,QAAQ;CACT,CAAA;AAED,uFAAuF;AACvF,uDAAuD;AACvD,MAAM,uBAAuB,GAAsB;IACjD,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,WAAW;IACX,kBAAkB,EAAE,+DAA+D;IACnF,YAAY,EAAE,8BAA8B;CAC7C,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAA+B;IACpE,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IACvB,oFAAoF;IACpF,MAAM,IAAI,GAAG,IAAI;SACd,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;SACtB,KAAK,CAAC,OAAO,CAAC;SACd,GAAG,EAAE;QACN,EAAE,WAAW,EAAE,CAAA;IACjB,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IACvB,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAChD,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IACxE,sFAAsF;IACtF,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC;QAC5F,OAAO,IAAI,CAAA;IACb,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAI,KAAQ;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,aAAa,CAAC,KAAK,CAAM,CAAA;IAC/D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAM,CAAA;IAClF,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,GAAG,GAA4B,EAAE,CAAA;QACvC,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;QACnF,OAAO,GAAQ,CAAA;IACjB,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}
+{"version":3,"file":"redact-secrets.logic.js","sourceRoot":"","sources":["../../src/shared/redact-secrets.logic.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,yFAAyF;AACzF,sFAAsF;AACtF,oFAAoF;AACpF,yFAAyF;AACzF,yFAAyF;AACzF,2FAA2F;AAC3F,yFAAyF;AACzF,yEAAyE;AAEzE,MAAM,WAAW,GAAG,YAAY,CAAA;AAEhC,4FAA4F;AAC5F,0FAA0F;AAC1F,4BAA4B;AAC5B,MAAM,qBAAqB,GAAG,iDAAiD,CAAA;AAC/E,MAAM,mBAAmB,GAAG,+CAA+C,CAAA;AAE3E;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAS,sBAAsB,CAAC,KAAa;IAC3C,qBAAqB,CAAC,SAAS,GAAG,CAAC,CAAA;IACnC,IAAI,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC7C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAChC,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,OAAO,KAAK,KAAK,IAAI,EAAE,CAAC;QACtB,mBAAmB,CAAC,SAAS,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;QAC7D,MAAM,GAAG,GAAG,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC3C,IAAI,GAAG,KAAK,IAAI;YAAE,MAAK;QACvB,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,WAAW,CAAA;QACvD,QAAQ,GAAG,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;QACpC,qBAAqB,CAAC,SAAS,GAAG,QAAQ,CAAA;QAC1C,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC3C,CAAC;IACD,OAAO,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;AAC7D,CAAC;AAED,6FAA6F;AAC7F,6FAA6F;AAC7F,qEAAqE;AACrE,MAAM,YAAY,GAAG,iCAAiC,CAAA;AACtD,iGAAiG;AACjG,4FAA4F;AAC5F,sEAAsE;AACtE,MAAM,UAAU,GAAG,iCAAiC,CAAA;AACpD,8FAA8F;AAC9F,6FAA6F;AAC7F,2CAA2C;AAC3C,MAAM,2BAA2B,GAAG,EAAE,CAAA;AAEtC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,oBAAoB,CAAC,KAAa;IACzC,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAC1C,OAAO,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,2BAA2B,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;AAChF,CAAC;AAED,wFAAwF;AACxF,sFAAsF;AACtF,MAAM,KAAK,GAAoE;IAC7E,gFAAgF;IAChF;QACE,OAAO,EAAE,qDAAqD;QAC9D,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;KAC7F;IACD,uEAAuE;IACvE;QACE,OAAO,EACL,kGAAkG;QACpG,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,WAAW,EAAE;KAC/C;IACD,yFAAyF;IACzF,yFAAyF;IACzF,wFAAwF;IACxF,yFAAyF;IACzF,mFAAmF;IACnF,0FAA0F;IAC1F,2FAA2F;IAC3F,qFAAqF;IACrF,2FAA2F;IAC3F,yFAAyF;IACzF;QACE,OAAO,EAAE,2DAA2D;QACpE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,WAAW,GAAG;KAC1C;IACD,8EAA8E;IAC9E,mFAAmF;IACnF;QACE,OAAO,EACL,+JAA+J;QACjK,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CACb,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;KACnF;IACD,2EAA2E;IAC3E,EAAE,OAAO,EAAE,kCAAkC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE;IAC3E,EAAE,OAAO,EAAE,+BAA+B,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE;IACxE,EAAE,OAAO,EAAE,iCAAiC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE;IAC1E,EAAE,OAAO,EAAE,iCAAiC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE;IAC1E,EAAE,OAAO,EAAE,uBAAuB,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE;IAChE,gFAAgF;IAChF;QACE,OAAO,EAAE,sDAAsD;QAC/D,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW;KAC3B;CACF,CAAA;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,KAAoB;IAChD,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,KAAK,CAAA;IAC/B,wFAAwF;IACxF,mEAAmE;IACnE,IAAI,GAAG,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAA;IACvC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE;YAC1C,4EAA4E;YAC5E,0EAA0E;YAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAa,CAAA;YAC5C,OAAO,IAAI,CAAC,OAAO,CAAC,MAAqC,CAAC,CAAA;QAC5D,CAAC,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,4FAA4F;AAC5F,4FAA4F;AAC5F,4FAA4F;AAC5F,0FAA0F;AAC1F,6FAA6F;AAC7F,0FAA0F;AAC1F,MAAM,qBAAqB,GAAwB,IAAI,GAAG,CAAC;IACzD,aAAa,EAAE,yBAAyB;IACxC,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,YAAY;CACb,CAAC,CAAA;AAEF,sFAAsF;AACtF,sFAAsF;AACtF,2CAA2C;AAC3C,MAAM,eAAe,GAAsB;IACzC,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,WAAW;IACX,SAAS;IACT,MAAM,EAAE,4BAA4B;IACpC,MAAM,EAAE,oBAAoB;IAC5B,KAAK,EAAE,4CAA4C;IACnD,QAAQ;CACT,CAAA;AAED,uFAAuF;AACvF,uDAAuD;AACvD,MAAM,uBAAuB,GAAsB;IACjD,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,WAAW;IACX,kBAAkB,EAAE,+DAA+D;IACnF,YAAY,EAAE,8BAA8B;CAC7C,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAA+B;IACpE,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IACvB,oFAAoF;IACpF,MAAM,IAAI,GAAG,IAAI;SACd,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;SACtB,KAAK,CAAC,OAAO,CAAC;SACd,GAAG,EAAE;QACN,EAAE,WAAW,EAAE,CAAA;IACjB,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IACvB,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAChD,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IACxE,sFAAsF;IACtF,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC;QAC5F,OAAO,IAAI,CAAA;IACb,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAI,KAAQ;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,aAAa,CAAC,KAAK,CAAM,CAAA;IAC/D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAM,CAAA;IAClF,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,GAAG,GAA4B,EAAE,CAAA;QACvC,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;QACnF,OAAO,GAAQ,CAAA;IACjB,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,iBAAiB,CAAC,GAAW;IACpC,OAAO,GAAG;SACP,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC;SACtC,OAAO,CAAC,uBAAuB,EAAE,OAAO,CAAC;SACzC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;SAClB,WAAW,EAAE,CAAA;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAwC;IAExC,MAAM,GAAG,GAA2B,EAAE,CAAA;IACtC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAA;QAC3C,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,MAAM,GAAG,KAAK,EAAE,CAAC,IAAI,EAAE,CAAA;QACzD,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAA;IACtF,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/kernel",
-  "version": "0.324.0",
+  "version": "0.326.0",
   "description": "Shared vocabulary, pure logic, and port interfaces for the Agent Architecture Board.",
   "repository": {
     "type": "git",
@@ -24,7 +24,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@cat-factory/contracts": "0.335.0",
+    "@cat-factory/contracts": "0.337.0",
     "ai": "^7.0.85",
     "yaml": "^2.9.0"
   },