@cello-protocol/gateway 0.0.10 → 0.0.12

package/dist/detect/corpus-digest.d.ts

@@ -0,0 +1,19 @@
+/**
+ * M10B / DOD-END-SCAN-1 (`M10B-D15`) — a stable digest of the ACTIVE detector corpus.
+ *
+ * The intake scanner's `scanner_version` is DERIVED from this, never hand-maintained. A hand-bumped
+ * constant goes stale the first time someone edits a regex and forgets — and because the directory
+ * cannot re-run the scan, that stale value is notarized as evidence of a scan that did not happen,
+ * which is the stated reason `DOD-DIR-WRITE-1` made the field signed in the first place.
+ *
+ * Returns null when either corpus is uncompiled. A digest over "no rules" would be a perfectly
+ * stable, perfectly meaningless value that a fail-closed caller could not distinguish from a real
+ * one — so the absence is reported as absence (§5a), and the caller refuses.
+ *
+ * SORTED before hashing, because corpus ORDER is not a property anyone should depend on: reordering
+ * the source array changes nothing about which text is caught, and a digest that moved on a reorder
+ * would force a spurious `scanner_version` change and read as a rule change to anyone auditing it.
+ * What the digest MUST track is the SET of active rules.
+ */
+export declare function detectorCorpusDigest(): string | null;
+//# sourceMappingURL=corpus-digest.d.ts.map

package/dist/detect/corpus-digest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"corpus-digest.d.ts","sourceRoot":"","sources":["../../src/detect/corpus-digest.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,GAAG,IAAI,CASpD"}

package/dist/detect/corpus-digest.js

@@ -0,0 +1,32 @@
+import { createHash } from "node:crypto";
+import { injectionPatternIds } from "./injection-patterns.js";
+import { secretRuleIds } from "./secrets.js";
+/**
+ * M10B / DOD-END-SCAN-1 (`M10B-D15`) — a stable digest of the ACTIVE detector corpus.
+ *
+ * The intake scanner's `scanner_version` is DERIVED from this, never hand-maintained. A hand-bumped
+ * constant goes stale the first time someone edits a regex and forgets — and because the directory
+ * cannot re-run the scan, that stale value is notarized as evidence of a scan that did not happen,
+ * which is the stated reason `DOD-DIR-WRITE-1` made the field signed in the first place.
+ *
+ * Returns null when either corpus is uncompiled. A digest over "no rules" would be a perfectly
+ * stable, perfectly meaningless value that a fail-closed caller could not distinguish from a real
+ * one — so the absence is reported as absence (§5a), and the caller refuses.
+ *
+ * SORTED before hashing, because corpus ORDER is not a property anyone should depend on: reordering
+ * the source array changes nothing about which text is caught, and a digest that moved on a reorder
+ * would force a spurious `scanner_version` change and read as a rule change to anyone auditing it.
+ * What the digest MUST track is the SET of active rules.
+ */
+export function detectorCorpusDigest() {
+    const patterns = injectionPatternIds();
+    const secrets = secretRuleIds();
+    if (patterns === null || secrets === null)
+        return null;
+    const canonical = JSON.stringify({
+        injection: [...patterns].sort(),
+        secrets: [...secrets].sort(),
+    });
+    return createHash("sha256").update(canonical, "utf8").digest("hex");
+}
+//# sourceMappingURL=corpus-digest.js.map

package/dist/detect/corpus-digest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"corpus-digest.js","sourceRoot":"","sources":["../../src/detect/corpus-digest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,QAAQ,GAAG,mBAAmB,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC;IAChC,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC/B,SAAS,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE;QAC/B,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE;KAC7B,CAAC,CAAC;IACH,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACtE,CAAC"}

package/dist/detect/index.d.ts

@@ -28,7 +28,16 @@
  * constraint 3). Reusing `InboundScreener`'s disposition would produce a scanner that passes its
  * tests and never refuses anything (`M10B-D16`). The corpus is shared; the policy is the portal's.
  */
-export { compileInjectionPatterns, injectionPatternsReady, scanInjectionPatterns } from "./injection-patterns.js";
-export { compileSecretRules, secretRulesReady, redactSecrets } from "./secrets.js";
+export { compileInjectionPatterns, injectionPatternsReady, scanInjectionPatterns, injectionPatternIds } from "./injection-patterns.js";
+export { compileSecretRules, secretRulesReady, redactSecrets, secretRuleIds } from "./secrets.js";
+export { detectorCorpusDigest } from "./corpus-digest.js";
+/**
+ * The RE2 engine initializer, exported because THE CORPUS CANNOT COMPILE WITHOUT IT. Omitting it
+ * made this subpath look complete while being unusable: `compileInjectionPatterns` runs, leaves
+ * `compiled` null, and every rule silently matches nothing — the exact degrade-open behaviour a
+ * fail-closed intake must never inherit. A consumer has no other way to reach it, since the exports
+ * map deliberately offers no deep-import escape.
+ */
+export { initLinearRegex, linearRegexEngine } from "./linear-regex.js";
 export type { SecretFinding, SecretScanResult } from "./secrets.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/detect/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/detect/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAClH,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AACnF,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/detect/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AACvI,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClG,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D;;;;;;GAMG;AACH,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACvE,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC"}

package/dist/detect/index.js

@@ -28,6 +28,15 @@
  * constraint 3). Reusing `InboundScreener`'s disposition would produce a scanner that passes its
  * tests and never refuses anything (`M10B-D16`). The corpus is shared; the policy is the portal's.
  */
-export { compileInjectionPatterns, injectionPatternsReady, scanInjectionPatterns } from "./injection-patterns.js";
-export { compileSecretRules, secretRulesReady, redactSecrets } from "./secrets.js";
+export { compileInjectionPatterns, injectionPatternsReady, scanInjectionPatterns, injectionPatternIds } from "./injection-patterns.js";
+export { compileSecretRules, secretRulesReady, redactSecrets, secretRuleIds } from "./secrets.js";
+export { detectorCorpusDigest } from "./corpus-digest.js";
+/**
+ * The RE2 engine initializer, exported because THE CORPUS CANNOT COMPILE WITHOUT IT. Omitting it
+ * made this subpath look complete while being unusable: `compileInjectionPatterns` runs, leaves
+ * `compiled` null, and every rule silently matches nothing — the exact degrade-open behaviour a
+ * fail-closed intake must never inherit. A consumer has no other way to reach it, since the exports
+ * map deliberately offers no deep-import escape.
+ */
+export { initLinearRegex, linearRegexEngine } from "./linear-regex.js";
 //# sourceMappingURL=index.js.map

package/dist/detect/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/detect/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAClH,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/detect/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AACvI,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClG,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D;;;;;;GAMG;AACH,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/detect/injection-patterns.d.ts

@@ -1,5 +1,16 @@
 /** Compile the pattern set. Call once at gateway startup, after `initLinearRegex()` resolves. */
 export declare function compileInjectionPatterns(): void;
+/**
+ * The ids of the patterns that ACTUALLY COMPILED, in corpus order — the input to the intake
+ * scanner's derived `scanner_version` (`M10B-D15`).
+ *
+ * The ACTIVE set, not the source list, and the difference is the point: if two deployments compile
+ * different subsets (a different RE2 build, a rule that fails to compile), their digests diverge —
+ * which is what makes "byte-identical across nodes" mechanically checkable rather than aspirational.
+ * Returns null when nothing is compiled, so a caller that must fail closed can tell "no rules" from
+ * "not ready".
+ */
+export declare function injectionPatternIds(): string[] | null;
 /** Whether the patterns are compiled (the RE2 engine was initialized). */
 export declare function injectionPatternsReady(): boolean;
 /**

package/dist/detect/injection-patterns.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"injection-patterns.d.ts","sourceRoot":"","sources":["../../src/detect/injection-patterns.ts"],"names":[],"mappings":"AAmCA,iGAAiG;AACjG,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C;AAED,0EAA0E;AAC1E,wBAAgB,sBAAsB,IAAI,OAAO,CAEhD;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAO5D"}
+{"version":3,"file":"injection-patterns.d.ts","sourceRoot":"","sources":["../../src/detect/injection-patterns.ts"],"names":[],"mappings":"AAmCA,iGAAiG;AACjG,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,EAAE,GAAG,IAAI,CAErD;AAED,0EAA0E;AAC1E,wBAAgB,sBAAsB,IAAI,OAAO,CAEhD;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAO5D"}

package/dist/detect/injection-patterns.js

@@ -32,6 +32,19 @@ const PATTERN_SOURCES = [
 export function compileInjectionPatterns() {
     compiled = PATTERN_SOURCES.map(({ id, src }) => ({ id, re: new LinearRegex(src, "i") }));
 }
+/**
+ * The ids of the patterns that ACTUALLY COMPILED, in corpus order — the input to the intake
+ * scanner's derived `scanner_version` (`M10B-D15`).
+ *
+ * The ACTIVE set, not the source list, and the difference is the point: if two deployments compile
+ * different subsets (a different RE2 build, a rule that fails to compile), their digests diverge —
+ * which is what makes "byte-identical across nodes" mechanically checkable rather than aspirational.
+ * Returns null when nothing is compiled, so a caller that must fail closed can tell "no rules" from
+ * "not ready".
+ */
+export function injectionPatternIds() {
+    return compiled === null ? null : compiled.map((c) => c.id);
+}
 /** Whether the patterns are compiled (the RE2 engine was initialized). */
 export function injectionPatternsReady() {
     return compiled !== null;

package/dist/detect/injection-patterns.js.map

@@ -1 +1 @@
-{"version":3,"file":"injection-patterns.js","sourceRoot":"","sources":["../../src/detect/injection-patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAIhD,IAAI,QAAQ,GAA6B,IAAI,CAAC;AAE9C,MAAM,eAAe,GAAuC;IAC1D,iGAAiG;IACjG,EAAE,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,oHAAoH,EAAE;IAChJ,qBAAqB;IACrB,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,2LAA2L,EAAE;IACpN,EAAE,EAAE,EAAE,mBAAmB,EAAE,GAAG,EAAE,8EAA8E,EAAE;IAChH,sCAAsC;IACtC,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,6EAA6E,EAAE;IACrG,2CAA2C;IAC3C,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,8DAA8D,EAAE;IACxF,gCAAgC;IAChC,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,+EAA+E,EAAE;IACxG,iCAAiC;IACjC,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,mCAAmC,EAAE;CAC9D,CAAC;AAEF,iGAAiG;AACjG,MAAM,UAAU,wBAAwB;IACtC,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,sBAAsB;IACpC,OAAO,QAAQ,KAAK,IAAI,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IACzB,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,QAAQ,EAAE,CAAC;QAClC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"injection-patterns.js","sourceRoot":"","sources":["../../src/detect/injection-patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAIhD,IAAI,QAAQ,GAA6B,IAAI,CAAC;AAE9C,MAAM,eAAe,GAAuC;IAC1D,iGAAiG;IACjG,EAAE,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,oHAAoH,EAAE;IAChJ,qBAAqB;IACrB,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,2LAA2L,EAAE;IACpN,EAAE,EAAE,EAAE,mBAAmB,EAAE,GAAG,EAAE,8EAA8E,EAAE;IAChH,sCAAsC;IACtC,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,6EAA6E,EAAE;IACrG,2CAA2C;IAC3C,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,8DAA8D,EAAE;IACxF,gCAAgC;IAChC,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,+EAA+E,EAAE;IACxG,iCAAiC;IACjC,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,mCAAmC,EAAE;CAC9D,CAAC;AAEF,iGAAiG;AACjG,MAAM,UAAU,wBAAwB;IACtC,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,sBAAsB;IACpC,OAAO,QAAQ,KAAK,IAAI,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IACzB,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,QAAQ,EAAE,CAAC;QAClC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/detect/secrets.d.ts

@@ -1,3 +1,9 @@
+/**
+ * The ids of the secret rules that ACTUALLY COMPILED — see `injectionPatternIds` for why the active
+ * set rather than the source list. `compileSecretRules` deliberately skips a rule that will not
+ * compile under RE2, so the two can differ, and the digest must follow what is really running.
+ */
+export declare function secretRuleIds(): string[] | null;
 /** Compile the rule set + the false-positive layer. Returns how many of the 222 rules compiled. */
 export declare function compileSecretRules(): {
     compiled: number;

package/dist/detect/secrets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/detect/secrets.ts"],"names":[],"mappings":"AAuBA,mGAAmG;AACnG,wBAAgB,kBAAkB,IAAI;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAexE;AAED,wBAAgB,gBAAgB,IAAI,OAAO,CAE1C;AAED,MAAM,WAAW,aAAa;IAAG,MAAM,EAAE,MAAM,CAAA;CAAE;AACjD,MAAM,WAAW,gBAAgB;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,aAAa,EAAE,CAAA;CAAE;AAmB7E;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,gBAAgB,CA6B7D"}
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/detect/secrets.ts"],"names":[],"mappings":"AAqBA;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,MAAM,EAAE,GAAG,IAAI,CAE/C;AAID,mGAAmG;AACnG,wBAAgB,kBAAkB,IAAI;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAexE;AAED,wBAAgB,gBAAgB,IAAI,OAAO,CAE1C;AAED,MAAM,WAAW,aAAa;IAAG,MAAM,EAAE,MAAM,CAAA;CAAE;AACjD,MAAM,WAAW,gBAAgB;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,aAAa,EAAE,CAAA;CAAE;AAmB7E;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,gBAAgB,CA6B7D"}

package/dist/detect/secrets.js

@@ -15,6 +15,14 @@
 import { LinearRegex } from "./linear-regex.js";
 import { GITLEAKS_RULES, GITLEAKS_STOPWORDS, GITLEAKS_ALLOW_REGEXES } from "./gitleaks-rules.js";
 let RULES = null;
+/**
+ * The ids of the secret rules that ACTUALLY COMPILED — see `injectionPatternIds` for why the active
+ * set rather than the source list. `compileSecretRules` deliberately skips a rule that will not
+ * compile under RE2, so the two can differ, and the digest must follow what is really running.
+ */
+export function secretRuleIds() {
+    return RULES === null ? null : RULES.map((r) => r.id);
+}
 let STOPWORDS = [];
 let ALLOW = [];
 /** Compile the rule set + the false-positive layer. Returns how many of the 222 rules compiled. */

package/dist/detect/secrets.js.map

@@ -1 +1 @@
-{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/detect/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAIjG,IAAI,KAAK,GAA0B,IAAI,CAAC;AACxC,IAAI,SAAS,GAAa,EAAE,CAAC;AAC7B,IAAI,KAAK,GAAkB,EAAE,CAAC;AAE9B,mGAAmG;AACnG,MAAM,UAAU,kBAAkB;IAChC,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACtG,CAAC;QAAC,MAAM,CAAC;YACP,sFAAsF;QACxF,CAAC;IACH,CAAC;IACD,KAAK,GAAG,QAAQ,CAAC;IACjB,SAAS,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3D,KAAK,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACvC,IAAI,CAAC;YAAC,OAAO,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;IAC3D,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAoB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IAC/C,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,cAAc,CAAC,MAAM,EAAE,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,OAAO,KAAK,KAAK,IAAI,CAAC;AACxB,CAAC;AAKD,SAAS,WAAW,CAAC,CAAS;IAC5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,EAAE,IAAI,CAAC;QAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QAAC,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IACjF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,qGAAqG;AACrG,SAAS,eAAe,CAAC,KAAa,EAAE,WAAmB;IACzD,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAClC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,WAAW,GAAG,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,GAAG,WAAW;QAAE,OAAO,IAAI,CAAC;IACrE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACjD,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,YAAY,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAEzC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,4FAA4F;QAC5F,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;QAE/F,8FAA8F;QAC9F,uCAAuC;QACvC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,OAAO,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC;YAC9C,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAC3C,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;gBAAE,MAAM;YACvC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACnC,IAAI,KAAK,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;YACvD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/detect/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAIjG,IAAI,KAAK,GAA0B,IAAI,CAAC;AAExC;;;;GAIG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACxD,CAAC;AACD,IAAI,SAAS,GAAa,EAAE,CAAC;AAC7B,IAAI,KAAK,GAAkB,EAAE,CAAC;AAE9B,mGAAmG;AACnG,MAAM,UAAU,kBAAkB;IAChC,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACtG,CAAC;QAAC,MAAM,CAAC;YACP,sFAAsF;QACxF,CAAC;IACH,CAAC;IACD,KAAK,GAAG,QAAQ,CAAC;IACjB,SAAS,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3D,KAAK,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACvC,IAAI,CAAC;YAAC,OAAO,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;IAC3D,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAoB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IAC/C,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,cAAc,CAAC,MAAM,EAAE,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,OAAO,KAAK,KAAK,IAAI,CAAC;AACxB,CAAC;AAKD,SAAS,WAAW,CAAC,CAAS;IAC5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,EAAE,IAAI,CAAC;QAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QAAC,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IACjF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,qGAAqG;AACrG,SAAS,eAAe,CAAC,KAAa,EAAE,WAAmB;IACzD,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAClC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,WAAW,GAAG,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,GAAG,WAAW;QAAE,OAAO,IAAI,CAAC;IACrE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACjD,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,YAAY,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAEzC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,4FAA4F;QAC5F,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;QAE/F,8FAA8F;QAC9F,uCAAuC;QACvC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,OAAO,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC;YAC9C,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAC3C,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;gBAAE,MAAM;YACvC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACnC,IAAI,KAAK,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;YACvD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cello-protocol/gateway",
-  "version": "0.0.10",
+  "version": "0.0.12",
   "private": false,
   "type": "module",
   "engines": {