@claudexor/util 1.0.1 → 2.1.0

package/dist/index.d.ts

@@ -1,4 +1,6 @@
 export { CLAUDEXOR_VERSION } from "./version.js";
+export * from "./secret-names.js";
+export * from "./sensitive-resource.js";
 /** Generate a short unique id, optionally prefixed (e.g. "run-3f2a...."). */
 export declare function newId(prefix?: string): string;
 /** Current time as an ISO-8601 string. */
@@ -10,6 +12,13 @@ export declare function hashJson(value: unknown): string;
 /** JSON.stringify with sorted object keys for stable hashing. */
 export declare function stableStringify(value: unknown): string;
 export declare function ensureDir(path: string): void;
+/**
+ * Establish a private daemon-owned directory without following any symlink in
+ * the supplied spelling. The direct parent must already exist canonically;
+ * callers create nested owned roots one level at a time. No chmod occurs until
+ * pathname identity has been proven.
+ */
+export declare function ensureCanonicalPrivateDirectory(path: string): string;
 export declare function writeText(path: string, text: string): void;
 export declare function writeJson(path: string, value: unknown): void;
 export declare function appendLine(path: string, line: string): void;
@@ -28,6 +37,27 @@ export declare function listDir(path: string): string[];
  */
 export declare function userHomeDir(): string;
 export declare function userConfigDir(): string;
+/**
+ * The ONE Claudexor-owned confinement root (round-22 DRY): under an explicit
+ * CLAUDEXOR_CONFIG_DIR override, that override IS the complete relocatable
+ * root; without it the owned tree is ~/.claudexor. Credential-profile
+ * locators and the isolation-locator confinement both derive from here —
+ * never re-derive this ternary inline.
+ */
+export declare function claudexorOwnedRoot(): string;
+/**
+ * Stable external runtime namespace for a project.
+ *
+ * A repository's `.claudexor/` directory is user-owned, versionable project
+ * configuration. Runtime state (runs, worktrees, scoped homes, review packets)
+ * therefore must never be placed below the repository or require Claudexor to
+ * edit either of the user's `.gitignore` files. Existing roots are resolved
+ * through symlinks before hashing so two spellings of the same project share a
+ * single namespace; a not-yet-existing root still gets a deterministic absolute
+ * identity and is re-keyed only after it exists and is registered.
+ */
+export declare function canonicalProjectRoot(repoRoot: string): string;
+export declare function projectRuntimeDir(repoRoot: string): string;
 export declare function noProjectRepoRoot(): string;
 /**
  * Best-effort redaction of obvious secret tokens from text destined for logs or
@@ -36,7 +66,7 @@ export declare function noProjectRepoRoot(): string;
  */
 export declare function redactSecrets(text: string): string;
 export declare function containsSecretLikeToken(text: string): boolean;
-export declare function assertNoInlineSecretValues(value: unknown, path?: string, context?: string): void;
+export declare function assertNoInlineSecretValues(value: unknown, path?: string, context?: string, valuesOnly?: boolean): void;
 /** The machine-readable `code` a typed error carries (e.g. inline_secret_rejected), if any. */
 export declare function errorCode(err: unknown): string | undefined;
 /**

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAYjD,6EAA6E;AAC7E,wBAAgB,KAAK,CAAC,MAAM,SAAK,GAAG,MAAM,CAGzC;AAED,0CAA0C;AAC1C,wBAAgB,MAAM,IAAI,MAAM,CAE/B;AAED,sDAAsD;AACtD,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE3C;AAED,6EAA6E;AAC7E,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAE/C;AAED,iEAAiE;AACjE,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEtD;AAcD,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAO5C;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAG1D;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAE5D;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAG3D;AAED;;iDAEiD;AACjD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMxD;AAED,oFAAoF;AACpF,wBAAgB,YAAY,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,GAAG,IAAI,CAQhE;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEhD;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAM9C;AAQD;;;;GAIG;AACH,wBAAgB,WAAW,IAAI,MAAM,CASpC;AAED,wBAAgB,aAAa,IAAI,MAAM,CAQtC;AAED,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AA+BD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIlD;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,SAAM,EAAE,OAAO,SAAe,GAAG,IAAI,CAgCnG;AAED,+FAA+F;AAC/F,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAK1D;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,GAAG,SAAS,EAAE,GAAG,EAAE,CAAC,GAAG,IAAI,CAO9E"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,cAAc,mBAAmB,CAAC;AAClC,cAAc,yBAAyB,CAAC;AAqBxC,6EAA6E;AAC7E,wBAAgB,KAAK,CAAC,MAAM,SAAK,GAAG,MAAM,CAGzC;AAED,0CAA0C;AAC1C,wBAAgB,MAAM,IAAI,MAAM,CAE/B;AAED,sDAAsD;AACtD,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE3C;AAED,6EAA6E;AAC7E,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAE/C;AAED,iEAAiE;AACjE,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEtD;AAcD,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAO5C;AAED;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA+CpE;AAWD,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAG1D;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAE5D;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAG3D;AAED;;iDAEiD;AACjD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMxD;AAED,oFAAoF;AACpF,wBAAgB,YAAY,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,GAAG,IAAI,CAQhE;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEhD;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAM9C;AAQD;;;;GAIG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAWpC;AAED,wBAAgB,aAAa,IAAI,MAAM,CAatC;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAI3C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAO7D;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE7D;AAQD,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,OAAO,EACd,IAAI,SAAM,EACV,OAAO,SAAe,EACtB,UAAU,UAAQ,GACjB,IAAI,CA8DN;AAED,+FAA+F;AAC/F,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAU1D;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,GAAG,SAAS,EAAE,GAAG,EAAE,CAAC,GAAG,IAAI,CAO9E"}

package/dist/index.js

@@ -1,8 +1,11 @@
 export { CLAUDEXOR_VERSION } from "./version.js";
+export * from "./secret-names.js";
+export * from "./sensitive-resource.js";
+import { sensitiveResourcePolicy } from "./sensitive-resource.js";
 import { createHash, randomUUID } from "node:crypto";
-import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync, } from "node:fs";
+import { closeSync, constants, existsSync, fchmodSync, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, readdirSync, readFileSync, realpathSync, writeFileSync, } from "node:fs";
 import { homedir } from "node:os";
-import { dirname, isAbsolute, join } from "node:path";
+import { dirname, isAbsolute, join, resolve } from "node:path";
 /** Generate a short unique id, optionally prefixed (e.g. "run-3f2a...."). */
 export function newId(prefix = "") {
     const id = randomUUID().replace(/-/g, "").slice(0, 12);
@@ -44,6 +47,67 @@ export function ensureDir(path) {
     // (secrets, daemon token) assert their own permissions at their writers.
     mkdirSync(path, { recursive: true, mode: 0o700 });
 }
+/**
+ * Establish a private daemon-owned directory without following any symlink in
+ * the supplied spelling. The direct parent must already exist canonically;
+ * callers create nested owned roots one level at a time. No chmod occurs until
+ * pathname identity has been proven.
+ */
+export function ensureCanonicalPrivateDirectory(path) {
+    const absolute = resolve(path);
+    if (!existsSync(absolute)) {
+        const parent = dirname(absolute);
+        const parentStat = lstatSync(parent);
+        if (parentStat.isSymbolicLink() ||
+            !parentStat.isDirectory() ||
+            realpathSync.native(parent) !== parent) {
+            throw new Error(`owned directory parent is not canonical: ${parent}`);
+        }
+        mkdirSync(absolute, { recursive: false, mode: 0o700 });
+        fsyncCanonicalDirectory(parent);
+    }
+    const preliminary = lstatSync(absolute);
+    if (preliminary.isSymbolicLink() || !preliminary.isDirectory()) {
+        throw new Error(`owned directory path is not canonical: ${absolute}`);
+    }
+    let fd;
+    try {
+        fd = openSync(absolute, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+    }
+    catch {
+        throw new Error(`owned directory path is not canonical: ${absolute}`);
+    }
+    try {
+        const opened = fstatSync(fd);
+        const named = lstatSync(absolute);
+        if (!opened.isDirectory() ||
+            named.isSymbolicLink() ||
+            !named.isDirectory() ||
+            opened.dev !== named.dev ||
+            opened.ino !== named.ino ||
+            realpathSync.native(absolute) !== absolute ||
+            (typeof process.getuid === "function" && opened.uid !== process.getuid())) {
+            throw new Error(`owned directory path is not canonical: ${absolute}`);
+        }
+        // Mutate permissions only through the descriptor whose inode and pathname
+        // identity were proven above; never follow a replacement path with chmod.
+        fchmodSync(fd, 0o700);
+        fsyncSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+    return absolute;
+}
+function fsyncCanonicalDirectory(path) {
+    const fd = openSync(path, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+    try {
+        fsyncSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
 export function writeText(path, text) {
     ensureDir(dirname(path));
     writeFileSync(path, text, { encoding: "utf8", mode: 0o600 });
@@ -117,54 +181,69 @@ export function userConfigDir() {
             throw new Error("CLAUDEXOR_CONFIG_DIR must be a safe absolute path");
         return safe;
     }
-    return join(userHomeDir(), ".claudexor");
+    // v2 is an intentionally empty, non-migrating namespace. Keeping the
+    // version boundary in the default root prevents the daemon from even
+    // probing v1 config, trust, secret, token, or journal bytes. An explicit
+    // CLAUDEXOR_CONFIG_DIR remains the hermetic test/operator override and is
+    // already treated as the complete v2 root.
+    return join(userHomeDir(), ".claudexor", "v2");
+}
+/**
+ * The ONE Claudexor-owned confinement root (round-22 DRY): under an explicit
+ * CLAUDEXOR_CONFIG_DIR override, that override IS the complete relocatable
+ * root; without it the owned tree is ~/.claudexor. Credential-profile
+ * locators and the isolation-locator confinement both derive from here —
+ * never re-derive this ternary inline.
+ */
+export function claudexorOwnedRoot() {
+    return process.env.CLAUDEXOR_CONFIG_DIR?.trim()
+        ? userConfigDir()
+        : join(userHomeDir(), ".claudexor");
+}
+/**
+ * Stable external runtime namespace for a project.
+ *
+ * A repository's `.claudexor/` directory is user-owned, versionable project
+ * configuration. Runtime state (runs, worktrees, scoped homes, review packets)
+ * therefore must never be placed below the repository or require Claudexor to
+ * edit either of the user's `.gitignore` files. Existing roots are resolved
+ * through symlinks before hashing so two spellings of the same project share a
+ * single namespace; a not-yet-existing root still gets a deterministic absolute
+ * identity and is re-keyed only after it exists and is registered.
+ */
+export function canonicalProjectRoot(repoRoot) {
+    const absolute = resolve(repoRoot);
+    try {
+        return realpathSync.native(absolute);
+    }
+    catch {
+        return absolute;
+    }
+}
+export function projectRuntimeDir(repoRoot) {
+    const digest = sha256(canonicalProjectRoot(repoRoot)).slice("sha256:".length);
+    return join(userConfigDir(), "projects", digest);
 }
 export function noProjectRepoRoot() {
     return join(userHomeDir(), ".cache", "claudexor", "no-project");
 }
-const SECRET_PATTERNS = [
-    /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,
-    /\bghp_[A-Za-z0-9]{20,}\b/g,
-    /\bgho_[A-Za-z0-9]{20,}\b/g,
-    /\bghs_[A-Za-z0-9]{20,}\b/g,
-    /\bghu_[A-Za-z0-9]{20,}\b/g,
-    /\bglpat-[A-Za-z0-9_-]{16,}\b/g,
-    /\bsk-ant-[A-Za-z0-9_-]{20,}\b/g,
-    /\bsk-or-v1-[A-Za-z0-9]{20,}\b/g,
-    /\bsk-[A-Za-z0-9_-]{20,}\b/g,
-    /\bAIza[A-Za-z0-9_-]{30,}\b/g,
-    /\bxai-[A-Za-z0-9_-]{20,}\b/g,
-    /\bAKIA[0-9A-Z]{16}\b/g,
-    // Slack tokens incl. xoxe (refresh) and xoxc (session) classes.
-    /\bxox[abceprs]-[A-Za-z0-9-]{10,}\b/g,
-    // Cursor API keys (key_<hex>); OpenRouter keys (sk-or-v1-... handled above).
-    /\bkey_[A-Za-z0-9]{20,}\b/g,
-    // Google OAuth access tokens.
-    /\bya29\.[A-Za-z0-9._-]{20,}\b/g,
-    // npm granular access tokens.
-    /\bnpm_[A-Za-z0-9]{20,}\b/g,
-    // PEM private key blocks (RSA/EC/OPENSSH/PKCS8 headers all match).
-    /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
-    // Bearer tokens (length-gated to avoid redacting prose like "Bearer of news").
-    /\bBearer\s+[A-Za-z0-9._~+/-]{20,}=*/gi,
-    // JWTs (header.payload.signature) — anthropic/cursor/openai OAuth tokens.
-    /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{6,}\b/g,
-];
 /**
  * Best-effort redaction of obvious secret tokens from text destined for logs or
  * artifacts. This is defense-in-depth, never the primary control: secrets must
  * not reach this layer in the first place.
  */
 export function redactSecrets(text) {
-    let out = text;
-    for (const pattern of SECRET_PATTERNS)
-        out = out.replace(pattern, "[redacted]");
-    return out;
+    return sensitiveResourcePolicy.redact(text);
 }
 export function containsSecretLikeToken(text) {
-    return redactSecrets(text) !== text;
+    return sensitiveResourcePolicy.containsSensitiveContent(text);
 }
-export function assertNoInlineSecretValues(value, path = "$", context = "run params") {
+/** Keys whose subtree is a caller-authored JSON SCHEMA: its object keys are
+ *  field NAMES (a `token` or `password` property is legitimate), so the
+ *  key-based secret check must not fire there — but string VALUES inside it
+ *  (const/default/enum literals) are still scanned for real secrets. */
+const SCHEMA_VALUE_SUBTREE_KEYS = new Set(["outputSchema", "output_schema"]);
+export function assertNoInlineSecretValues(value, path = "$", context = "run params", valuesOnly = false) {
     if (typeof value === "string") {
         if (containsSecretLikeToken(value)) {
             // Prompts get a tailored remediation: they are DURABLE run artifacts
@@ -185,19 +264,35 @@ export function assertNoInlineSecretValues(value, path = "$", context = "run par
     if (!value || typeof value !== "object")
         return;
     if (Array.isArray(value)) {
-        value.forEach((v, i) => assertNoInlineSecretValues(v, `${path}[${i}]`, context));
+        value.forEach((v, i) => assertNoInlineSecretValues(v, `${path}[${i}]`, context, valuesOnly));
         return;
     }
     for (const [key, child] of Object.entries(value)) {
-        if (key === "env" || key === "secrets" || /(^|[_-])(secret|token|password|api[_-]?key)($|[_-])/i.test(key)) {
+        // A real secret embedded in a KEY (e.g. a schema property literally named
+        // with a live token) is rejected in EVERY mode — valuesOnly only relaxes
+        // the NAME heuristic (a legitimate `token`/`password` field name), never
+        // the actual-secret detector. Never echo the raw key in the message.
+        if (containsSecretLikeToken(key)) {
+            throw Object.assign(new Error(`secret-like value is not accepted in ${context} (${path}: object key); store values via secrets and pass refs/profiles`), { status: 400, code: "inline_secret_rejected" });
+        }
+        // Inside a JSON Schema subtree, keys are field names — skip the name-word
+        // heuristic (a `token`/`password`/`env` FIELD is legitimate), but string
+        // VALUES are still scanned below.
+        if (!valuesOnly &&
+            (key === "env" ||
+                key === "secrets" ||
+                /(^|[_-])(secret|token|password|api[_-]?key)($|[_-])/i.test(key))) {
             throw Object.assign(new Error(`inline secrets/env are not accepted in ${context} (${path}.${key}); store values via secrets and pass refs/profiles`), { status: 400, code: "inline_secret_rejected" });
         }
-        assertNoInlineSecretValues(child, `${path}.${key}`, context);
+        assertNoInlineSecretValues(child, `${path}.${key}`, context, valuesOnly || SCHEMA_VALUE_SUBTREE_KEYS.has(key));
     }
 }
 /** The machine-readable `code` a typed error carries (e.g. inline_secret_rejected), if any. */
 export function errorCode(err) {
-    if (err && typeof err === "object" && "code" in err && typeof err.code === "string") {
+    if (err &&
+        typeof err === "object" &&
+        "code" in err &&
+        typeof err.code === "string") {
         return err.code;
     }
     return undefined;

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,UAAU,EACV,SAAS,EACT,WAAW,EACX,YAAY,EACZ,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEtD,6EAA6E;AAC7E,MAAM,UAAU,KAAK,CAAC,MAAM,GAAG,EAAE;IAC/B,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvD,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACzC,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,MAAM;IACpB,OAAO,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAClC,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,MAAM,CAAC,IAAY;IACjC,OAAO,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACrE,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACvE,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAE,KAAiC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,uEAAuE;IACvE,yEAAyE;IACzE,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,IAAY;IAClD,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACzB,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,KAAc;IACpD,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,IAAY;IACnD,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACzB,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC5F,CAAC;AAED;;iDAEiD;AACjD,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,YAAY,CAAc,IAAY;IACpD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAuB;IAChD,MAAM,KAAK,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjG,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW;IACzB,MAAM,IAAI,GACR,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QACnC,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;QAC1C,iBAAiB,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,CAAC;IAC1D,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QAChF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC,WAAW,EAAE,EAAE,YAAY,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO,IAAI,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,eAAe,GAAa;IAChC,mCAAmC;IACnC,2BAA2B;IAC3B,2BAA2B;IAC3B,2BAA2B;IAC3B,2BAA2B;IAC3B,+BAA+B;IAC/B,gCAAgC;IAChC,gCAAgC;IAChC,4BAA4B;IAC5B,6BAA6B;IAC7B,6BAA6B;IAC7B,uBAAuB;IACvB,gEAAgE;IAChE,qCAAqC;IACrC,6EAA6E;IAC7E,2BAA2B;IAC3B,8BAA8B;IAC9B,gCAAgC;IAChC,8BAA8B;IAC9B,2BAA2B;IAC3B,mEAAmE;IACnE,6EAA6E;IAC7E,+EAA+E;IAC/E,uCAAuC;IACvC,0EAA0E;IAC1E,mEAAmE;CACpE,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,OAAO,IAAI,eAAe;QAAE,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAChF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,OAAO,aAAa,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAAc,EAAE,IAAI,GAAG,GAAG,EAAE,OAAO,GAAG,YAAY;IAC3F,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;YACnC,qEAAqE;YACrE,kEAAkE;YAClE,oEAAoE;YACpE,uBAAuB;YACvB,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChD,MAAM,WAAW,GAAG,QAAQ;gBAC1B,CAAC,CAAC,+KAA+K;gBACjL,CAAC,CAAC,iDAAiD,CAAC;YACtD,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,wCAAwC,OAAO,KAAK,IAAI,MAAM,WAAW,EAAE,CAAC,EAAE;gBAC1G,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,wBAAwB;aAC/B,CAAC,CAAC;QACL,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO;IAChD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,0BAA0B,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;QACjF,OAAO;IACT,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QAC5E,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,SAAS,IAAI,sDAAsD,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3G,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CAAC,0CAA0C,OAAO,KAAK,IAAI,IAAI,GAAG,oDAAoD,CAAC,EAChI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAChD,CAAC;QACJ,CAAC;QACD,0BAA0B,CAAC,KAAK,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,EAAE,OAAO,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,SAAS,CAAC,GAAY;IACpC,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG,IAAI,OAAQ,GAAyB,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC3G,OAAQ,GAAwB,CAAC,IAAI,CAAC;IACxC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAI,EAAkC,EAAE,GAAM;IACtE,IAAI,CAAC,EAAE;QAAE,OAAO;IAChB,IAAI,CAAC;QACH,EAAE,CAAC,GAAG,CAAC,CAAC;IACV,CAAC;IAAC,MAAM,CAAC;QACP,2DAA2D;IAC7D,CAAC;AACH,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,cAAc,mBAAmB,CAAC;AAClC,cAAc,yBAAyB,CAAC;AACxC,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,SAAS,EACT,SAAS,EACT,UAAU,EACV,UAAU,EACV,SAAS,EACT,SAAS,EACT,SAAS,EACT,SAAS,EACT,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE/D,6EAA6E;AAC7E,MAAM,UAAU,KAAK,CAAC,MAAM,GAAG,EAAE;IAC/B,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvD,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACzC,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,MAAM;IACpB,OAAO,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAClC,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,MAAM,CAAC,IAAY;IACjC,OAAO,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACrE,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACvE,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAE,KAAiC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,uEAAuE;IACvE,yEAAyE;IACzE,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B,CAAC,IAAY;IAC1D,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QACrC,IACE,UAAU,CAAC,cAAc,EAAE;YAC3B,CAAC,UAAU,CAAC,WAAW,EAAE;YACzB,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,MAAM,EACtC,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,4CAA4C,MAAM,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACvD,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,WAAW,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,WAAW,CAAC,cAAc,EAAE,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,0CAA0C,QAAQ,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,WAAW,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IAC7F,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,0CAA0C,QAAQ,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QAC7B,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QAClC,IACE,CAAC,MAAM,CAAC,WAAW,EAAE;YACrB,KAAK,CAAC,cAAc,EAAE;YACtB,CAAC,KAAK,CAAC,WAAW,EAAE;YACpB,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG;YACxB,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG;YACxB,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,QAAQ;YAC1C,CAAC,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,EACzE,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,0CAA0C,QAAQ,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,0EAA0E;QAC1E,0EAA0E;QAC1E,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACtB,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAY;IAC3C,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,WAAW,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IAC7F,IAAI,CAAC;QACH,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,IAAY;IAClD,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACzB,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,KAAc;IACpD,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,IAAY;IACnD,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACzB,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC5F,CAAC;AAED;;iDAEiD;AACjD,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,YAAY,CAAc,IAAY;IACpD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAuB;IAChD,MAAM,KAAK,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjG,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW;IACzB,MAAM,IAAI,GACR,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QACnC,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;QAC1C,iBAAiB,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,gFAAgF,CACjF,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,CAAC;IAC1D,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QAChF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,qEAAqE;IACrE,qEAAqE;IACrE,yEAAyE;IACzE,0EAA0E;IAC1E,2CAA2C;IAC3C,OAAO,IAAI,CAAC,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE;QAC7C,CAAC,CAAC,aAAa,EAAE;QACjB,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,YAAY,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,MAAM,MAAM,GAAG,MAAM,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC,aAAa,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO,IAAI,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,uBAAuB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,OAAO,uBAAuB,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;AAChE,CAAC;AAED;;;wEAGwE;AACxE,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC,CAAC;AAE7E,MAAM,UAAU,0BAA0B,CACxC,KAAc,EACd,IAAI,GAAG,GAAG,EACV,OAAO,GAAG,YAAY,EACtB,UAAU,GAAG,KAAK;IAElB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;YACnC,qEAAqE;YACrE,kEAAkE;YAClE,oEAAoE;YACpE,uBAAuB;YACvB,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChD,MAAM,WAAW,GAAG,QAAQ;gBAC1B,CAAC,CAAC,+KAA+K;gBACjL,CAAC,CAAC,iDAAiD,CAAC;YACtD,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CAAC,wCAAwC,OAAO,KAAK,IAAI,MAAM,WAAW,EAAE,CAAC,EACtF;gBACE,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,wBAAwB;aAC/B,CACF,CAAC;QACJ,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO;IAChD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,0BAA0B,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;QAC7F,OAAO;IACT,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QAC5E,0EAA0E;QAC1E,yEAAyE;QACzE,yEAAyE;QACzE,qEAAqE;QACrE,IAAI,uBAAuB,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,wCAAwC,OAAO,KAAK,IAAI,gEAAgE,CACzH,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAChD,CAAC;QACJ,CAAC;QACD,0EAA0E;QAC1E,yEAAyE;QACzE,kCAAkC;QAClC,IACE,CAAC,UAAU;YACX,CAAC,GAAG,KAAK,KAAK;gBACZ,GAAG,KAAK,SAAS;gBACjB,sDAAsD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EACnE,CAAC;YACD,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,0CAA0C,OAAO,KAAK,IAAI,IAAI,GAAG,oDAAoD,CACtH,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAChD,CAAC;QACJ,CAAC;QACD,0BAA0B,CACxB,KAAK,EACL,GAAG,IAAI,IAAI,GAAG,EAAE,EAChB,OAAO,EACP,UAAU,IAAI,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC,CACjD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,SAAS,CAAC,GAAY;IACpC,IACE,GAAG;QACH,OAAO,GAAG,KAAK,QAAQ;QACvB,MAAM,IAAI,GAAG;QACb,OAAQ,GAAyB,CAAC,IAAI,KAAK,QAAQ,EACnD,CAAC;QACD,OAAQ,GAAwB,CAAC,IAAI,CAAC;IACxC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAI,EAAkC,EAAE,GAAM;IACtE,IAAI,CAAC,EAAE;QAAE,OAAO;IAChB,IAAI,CAAC;QACH,EAAE,CAAC,GAAG,CAAC,CAAC;IACV,CAAC;IAAC,MAAM,CAAC;QACP,2DAA2D;IAC7D,CAAC;AACH,CAAC"}

package/dist/secret-names.d.ts

@@ -0,0 +1,25 @@
+/**
+ * The single owner of the managed secret NAME grammar (names are secret REFS,
+ * never values). It lives in the dependency-free util package so the schema
+ * (CredentialProfile.secret_ref), the secret store, the CLI/HTTP surfaces,
+ * and every harness adapter validate against exactly one grammar; the secrets
+ * package re-exports it for its historical importers.
+ */
+/**
+ * The single allowlist of managed secret names (previously duplicated in
+ * the CLI and the control API, and BOTH were missing `claude_oauth` — the
+ * claude adapter reads it, so it must be settable). Adding a name here makes
+ * it settable via CLI and HTTP alike.
+ */
+export declare const MANAGED_SECRET_NAMES: readonly ["openai", "anthropic", "claude_oauth", "openrouter", "cursor", "opencode", "raw"];
+export declare function isManagedSecretName(name: string): boolean;
+/**
+ * The managed base of a NAMESPACED profile secret_ref, or null when the ref
+ * is malformed OR bare (release wave round-15 #5): a profile's ref must carry
+ * its own `<base>:<profile>` namespace — a bare engine-default slot (e.g.
+ * "anthropic") would silently alias the default credential, and profiles are
+ * ADDITIVE identities. Adapters compare the returned base against their own
+ * provider slot so a key stored for one provider is never sent to another.
+ */
+export declare function namespacedSecretRefBase(ref: string | null | undefined): string | null;
+//# sourceMappingURL=secret-names.d.ts.map

package/dist/secret-names.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-names.d.ts","sourceRoot":"","sources":["../src/secret-names.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,6FAQvB,CAAC;AAUX,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAKzD;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAIrF"}

package/dist/secret-names.js

@@ -0,0 +1,51 @@
+/**
+ * The single owner of the managed secret NAME grammar (names are secret REFS,
+ * never values). It lives in the dependency-free util package so the schema
+ * (CredentialProfile.secret_ref), the secret store, the CLI/HTTP surfaces,
+ * and every harness adapter validate against exactly one grammar; the secrets
+ * package re-exports it for its historical importers.
+ */
+/**
+ * The single allowlist of managed secret names (previously duplicated in
+ * the CLI and the control API, and BOTH were missing `claude_oauth` — the
+ * claude adapter reads it, so it must be settable). Adding a name here makes
+ * it settable via CLI and HTTP alike.
+ */
+export const MANAGED_SECRET_NAMES = [
+    "openai",
+    "anthropic",
+    "claude_oauth",
+    "openrouter",
+    "cursor",
+    "opencode",
+    "raw",
+];
+/**
+ * Managed names accept an optional per-profile namespace suffix (INV-135):
+ * `<base>` (the engine-default slot) or `<base>:<profile>` where base stays in
+ * the allowlist and profile is a bounded slug. One grammar for CLI, HTTP, and
+ * adapters — a profile's secret_ref is exactly such a name.
+ */
+const PROFILE_SUFFIX = /^[a-z0-9][a-z0-9_-]{0,63}$/;
+export function isManagedSecretName(name) {
+    const sep = name.indexOf(":");
+    const base = sep === -1 ? name : name.slice(0, sep);
+    if (!MANAGED_SECRET_NAMES.includes(base))
+        return false;
+    return sep === -1 || PROFILE_SUFFIX.test(name.slice(sep + 1));
+}
+/**
+ * The managed base of a NAMESPACED profile secret_ref, or null when the ref
+ * is malformed OR bare (release wave round-15 #5): a profile's ref must carry
+ * its own `<base>:<profile>` namespace — a bare engine-default slot (e.g.
+ * "anthropic") would silently alias the default credential, and profiles are
+ * ADDITIVE identities. Adapters compare the returned base against their own
+ * provider slot so a key stored for one provider is never sent to another.
+ */
+export function namespacedSecretRefBase(ref) {
+    if (!ref || !isManagedSecretName(ref))
+        return null;
+    const sep = ref.indexOf(":");
+    return sep === -1 ? null : ref.slice(0, sep);
+}
+//# sourceMappingURL=secret-names.js.map

package/dist/secret-names.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-names.js","sourceRoot":"","sources":["../src/secret-names.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,QAAQ;IACR,WAAW;IACX,cAAc;IACd,YAAY;IACZ,QAAQ;IACR,UAAU;IACV,KAAK;CACG,CAAC;AAEX;;;;;GAKG;AACH,MAAM,cAAc,GAAG,4BAA4B,CAAC;AAEpD,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACpD,IAAI,CAAE,oBAA0C,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,OAAO,GAAG,KAAK,CAAC,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAA8B;IACpE,IAAI,CAAC,GAAG,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC/C,CAAC"}

package/dist/sensitive-resource.d.ts

@@ -0,0 +1,55 @@
+export type SensitiveResourcePathClass = "credential_file" | "credential_store" | "environment_file" | "private_key" | "secret_container";
+export interface SensitiveResourcePathDecision {
+    readonly sensitive: boolean;
+    readonly class: SensitiveResourcePathClass | null;
+    readonly matchedPart: string | null;
+    readonly reason: string | null;
+}
+export type SensitiveContentHandling = "redact" | "reject";
+export type SensitiveContentSignature = "anthropic_api_key" | "aws_access_key" | "bearer_token" | "cursor_api_key" | "github_token" | "gitlab_token" | "google_api_key" | "google_oauth_token" | "jwt" | "npm_token" | "openai_compatible_api_key" | "private_key_block" | "slack_token" | "xai_api_key";
+export interface SensitiveContentDecision {
+    readonly action: "allow" | "redact" | "reject";
+    readonly containsSensitiveContent: boolean;
+    readonly signatures: readonly SensitiveContentSignature[];
+    readonly text: string;
+}
+export type SymlinkTargetKind = "directory" | "file" | "other" | "unknown";
+export type SensitiveSymlinkDenyReason = "absolute_target" | "excluded_target" | "invalid_source" | "relocation_escape" | "sensitive_source" | "sensitive_target" | "target_kind" | "target_outside_root" | "unresolved_target";
+export interface SensitiveSymlinkInput {
+    /** Logical root containing the symlink. */
+    sourceRoot: string;
+    /** Canonical identity of sourceRoot (normally realpath(sourceRoot)). */
+    canonicalSourceRoot: string;
+    sourcePath: string;
+    linkTarget: string;
+    resolvedTargetPath: string | null;
+    targetKind: SymlinkTargetKind;
+    allowedTargetKinds: readonly SymlinkTargetKind[];
+    /** Roots that must not be reachable from the copied/mapped tree. */
+    excludedRoots?: readonly string[];
+    /** Destination root used to prove that a relative link remains contained after relocation. */
+    relocationRoot?: string;
+}
+export interface SensitiveSymlinkDecision {
+    readonly allowed: boolean;
+    readonly reason: SensitiveSymlinkDenyReason | null;
+    readonly detail: string | null;
+    readonly pathDecision: SensitiveResourcePathDecision | null;
+}
+/**
+ * Single owner for sensitive path, symlink-target, and content decisions.
+ *
+ * The API is deliberately surface-neutral: context/review consume it now;
+ * upload and release scanners can consume the same typed decisions later
+ * without growing another classifier or weakening this policy.
+ */
+export declare class SensitiveResourcePolicy {
+    readonly redactionMarker = "[redacted]";
+    classifyPath(path: string): SensitiveResourcePathDecision;
+    inspectContent(text: string, handling?: SensitiveContentHandling): SensitiveContentDecision;
+    redact(text: string): string;
+    containsSensitiveContent(text: string): boolean;
+    assessSymlink(input: SensitiveSymlinkInput): SensitiveSymlinkDecision;
+}
+export declare const sensitiveResourcePolicy: Readonly<SensitiveResourcePolicy>;
+//# sourceMappingURL=sensitive-resource.d.ts.map

package/dist/sensitive-resource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sensitive-resource.d.ts","sourceRoot":"","sources":["../src/sensitive-resource.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,0BAA0B,GACpC,iBAAiB,GAAG,kBAAkB,GAAG,kBAAkB,GAAG,aAAa,GAAG,kBAAkB,CAAC;AAEnG,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,0BAA0B,GAAG,IAAI,CAAC;IAClD,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED,MAAM,MAAM,wBAAwB,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE3D,MAAM,MAAM,yBAAyB,GACjC,mBAAmB,GACnB,gBAAgB,GAChB,cAAc,GACd,gBAAgB,GAChB,cAAc,GACd,cAAc,GACd,gBAAgB,GAChB,oBAAoB,GACpB,KAAK,GACL,WAAW,GACX,2BAA2B,GAC3B,mBAAmB,GACnB,aAAa,GACb,aAAa,CAAC;AAElB,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAC/C,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAC;IAC3C,QAAQ,CAAC,UAAU,EAAE,SAAS,yBAAyB,EAAE,CAAC;IAC1D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,iBAAiB,GAAG,WAAW,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;AAE3E,MAAM,MAAM,0BAA0B,GAClC,iBAAiB,GACjB,iBAAiB,GACjB,gBAAgB,GAChB,mBAAmB,GACnB,kBAAkB,GAClB,kBAAkB,GAClB,aAAa,GACb,qBAAqB,GACrB,mBAAmB,CAAC;AAExB,MAAM,WAAW,qBAAqB;IACpC,2CAA2C;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,mBAAmB,EAAE,MAAM,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,UAAU,EAAE,iBAAiB,CAAC;IAC9B,kBAAkB,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACjD,oEAAoE;IACpE,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,8FAA8F;IAC9F,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,0BAA0B,GAAG,IAAI,CAAC;IACnD,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,6BAA6B,GAAG,IAAI,CAAC;CAC7D;AAoED;;;;;;GAMG;AACH,qBAAa,uBAAuB;IAClC,QAAQ,CAAC,eAAe,gBAAgB;IAExC,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,6BAA6B;IA2DzD,cAAc,CACZ,IAAI,EAAE,MAAM,EACZ,QAAQ,GAAE,wBAAmC,GAC5C,wBAAwB;IAqB3B,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAI5B,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI/C,aAAa,CAAC,KAAK,EAAE,qBAAqB,GAAG,wBAAwB;CA2CtE;AAED,eAAO,MAAM,uBAAuB,mCAA+C,CAAC"}

package/dist/sensitive-resource.js

@@ -0,0 +1,221 @@
+import { dirname, extname, isAbsolute, join, normalize, relative, resolve } from "node:path";
+const SAFE_ENV_TEMPLATE_BASENAMES = new Set([".env.example", ".env.sample", ".env.template"]);
+const CREDENTIAL_STORE_PARTS = new Set([
+    ".anthropic",
+    ".aws",
+    ".azure",
+    ".claude",
+    ".codex",
+    ".cursor",
+    ".docker",
+    ".gcloud",
+    ".gnupg",
+    ".kube",
+    ".openai",
+    ".ssh",
+]);
+const CREDENTIAL_FILE_BASENAMES = new Set([
+    ".git-credentials",
+    ".netrc",
+    ".npmrc",
+    ".pypirc",
+    "application_default_credentials.json",
+]);
+const PRIVATE_KEY_EXTENSIONS = new Set([".jks", ".key", ".keystore", ".p12", ".pem", ".pfx"]);
+const PRIVATE_KEY_BASENAME = /^id_(?:dsa|ecdsa|ed25519|rsa)(?:[._-].+)?$/;
+const CREDENTIAL_FILE_BASENAME = /^(?:credentials(?:[._-].*)?|service-account(?:[._-].*)?\.json)$/;
+const CONTENT_RULES = [
+    { id: "github_token", pattern: /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g },
+    { id: "github_token", pattern: /\bghp_[A-Za-z0-9]{20,}\b/g },
+    { id: "github_token", pattern: /\bgho_[A-Za-z0-9]{20,}\b/g },
+    { id: "github_token", pattern: /\bghs_[A-Za-z0-9]{20,}\b/g },
+    { id: "github_token", pattern: /\bghu_[A-Za-z0-9]{20,}\b/g },
+    { id: "gitlab_token", pattern: /\bglpat-[A-Za-z0-9_-]{16,}\b/g },
+    { id: "anthropic_api_key", pattern: /\bsk-ant-[A-Za-z0-9_-]{20,}\b/g },
+    { id: "openai_compatible_api_key", pattern: /\bsk-or-v1-[A-Za-z0-9]{20,}\b/g },
+    { id: "openai_compatible_api_key", pattern: /\bsk-[A-Za-z0-9_-]{20,}\b/g },
+    { id: "google_api_key", pattern: /\bAIza[A-Za-z0-9_-]{30,}\b/g },
+    { id: "xai_api_key", pattern: /\bxai-[A-Za-z0-9_-]{20,}\b/g },
+    { id: "aws_access_key", pattern: /\bAKIA[0-9A-Z]{16}\b/g },
+    { id: "slack_token", pattern: /\bxox[abceprs]-[A-Za-z0-9-]{10,}\b/g },
+    { id: "cursor_api_key", pattern: /\bkey_[A-Za-z0-9]{20,}\b/g },
+    { id: "google_oauth_token", pattern: /\bya29\.[A-Za-z0-9._-]{20,}\b/g },
+    { id: "npm_token", pattern: /\bnpm_[A-Za-z0-9]{20,}\b/g },
+    {
+        id: "private_key_block",
+        pattern: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+    },
+    { id: "bearer_token", pattern: /\bBearer\s+[A-Za-z0-9._~+/-]{20,}=*/gi },
+    { id: "jwt", pattern: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{6,}\b/g },
+];
+const ALLOW_PATH = Object.freeze({
+    sensitive: false,
+    class: null,
+    matchedPart: null,
+    reason: null,
+});
+/**
+ * Single owner for sensitive path, symlink-target, and content decisions.
+ *
+ * The API is deliberately surface-neutral: context/review consume it now;
+ * upload and release scanners can consume the same typed decisions later
+ * without growing another classifier or weakening this policy.
+ */
+export class SensitiveResourcePolicy {
+    redactionMarker = "[redacted]";
+    classifyPath(path) {
+        const parts = normalizedPathParts(path);
+        for (let index = 0; index < parts.length; index += 1) {
+            const part = parts[index] ?? "";
+            const lower = part.toLowerCase();
+            if (CREDENTIAL_STORE_PARTS.has(lower)) {
+                return sensitivePath("credential_store", part, `credential-store path component: ${part}`);
+            }
+            if (lower === ".config" && parts[index + 1]?.toLowerCase() === "gcloud") {
+                return sensitivePath("credential_store", `${part}/${parts[index + 1]}`, `credential-store path component: ${part}/${parts[index + 1]}`);
+            }
+            // A monorepo package may legitimately own secret-management source code
+            // (`packages/secrets/**`). Its files still pass the shared content scan;
+            // every other `secrets` container remains path-sensitive.
+            const sourcePackage = index > 0 && parts[index - 1]?.toLowerCase() === "packages";
+            if (lower === "secrets" && !sourcePackage) {
+                return sensitivePath("secret_container", part, `secret-container path component: ${part}`);
+            }
+            if (lower === ".env" ||
+                lower === ".envrc" ||
+                lower.startsWith(".envrc.") ||
+                (lower.startsWith(".env.") && !SAFE_ENV_TEMPLATE_BASENAMES.has(lower))) {
+                return sensitivePath("environment_file", part, `environment secret file: ${part}`);
+            }
+            if (CREDENTIAL_FILE_BASENAMES.has(lower) || CREDENTIAL_FILE_BASENAME.test(lower)) {
+                return sensitivePath("credential_file", part, `credential file: ${part}`);
+            }
+            if (!lower.endsWith(".pub") && PRIVATE_KEY_BASENAME.test(lower)) {
+                return sensitivePath("private_key", part, `private-key basename: ${part}`);
+            }
+            if (PRIVATE_KEY_EXTENSIONS.has(extname(lower))) {
+                return sensitivePath("private_key", part, `private-key/container extension: ${extname(lower)}`);
+            }
+            if (lower === ".claudexor") {
+                const runtimePart = parts[index + 1]?.toLowerCase();
+                if (runtimePart && ["auth", "home", "homes", "secrets"].includes(runtimePart)) {
+                    return sensitivePath("credential_store", `${part}/${parts[index + 1]}`, `Claudexor credential/runtime path: ${part}/${parts[index + 1]}`);
+                }
+            }
+        }
+        return ALLOW_PATH;
+    }
+    inspectContent(text, handling = "redact") {
+        let redacted = text;
+        const signatures = new Set();
+        for (const rule of CONTENT_RULES) {
+            const before = redacted;
+            redacted = redacted.replace(rule.pattern, this.redactionMarker);
+            if (redacted !== before)
+                signatures.add(rule.id);
+        }
+        if (signatures.size === 0) {
+            return { action: "allow", containsSensitiveContent: false, signatures: [], text };
+        }
+        return {
+            action: handling,
+            containsSensitiveContent: true,
+            signatures: [...signatures],
+            // Never echo a matched secret from a policy decision, including a reject
+            // decision that a caller might later persist as diagnostic evidence.
+            text: redacted,
+        };
+    }
+    redact(text) {
+        return this.inspectContent(text, "redact").text;
+    }
+    containsSensitiveContent(text) {
+        return this.inspectContent(text, "reject").containsSensitiveContent;
+    }
+    assessSymlink(input) {
+        const sourceRoot = resolve(input.sourceRoot);
+        const canonicalRoot = resolve(input.canonicalSourceRoot);
+        const sourcePath = resolve(input.sourcePath);
+        const excludedRoots = (input.excludedRoots ?? []).map((path) => resolve(path));
+        if (!isSameOrInside(sourceRoot, sourcePath)) {
+            return denySymlink("invalid_source", "symlink source is outside the allowed root");
+        }
+        const sourceDecision = this.classifyPath(relative(sourceRoot, sourcePath));
+        if (sourceDecision.sensitive) {
+            return denySymlink("sensitive_source", sourceDecision.reason ?? "symlink source is sensitive", sourceDecision);
+        }
+        if (!input.resolvedTargetPath) {
+            return denySymlink("unresolved_target", "symlink target cannot be resolved");
+        }
+        if (!input.allowedTargetKinds.includes(input.targetKind)) {
+            return denySymlink("target_kind", `symlink target kind is not allowed: ${input.targetKind}`);
+        }
+        const resolvedTarget = resolve(input.resolvedTargetPath);
+        if (!isSameOrInside(canonicalRoot, resolvedTarget)) {
+            return denySymlink("target_outside_root", "symlink resolves outside the allowed root");
+        }
+        if (excludedRoots.some((root) => isSameOrInside(root, resolvedTarget))) {
+            return denySymlink("excluded_target", "symlink resolves into an excluded root");
+        }
+        const targetDecision = this.classifyPath(relative(canonicalRoot, resolvedTarget));
+        if (targetDecision.sensitive) {
+            return denySymlink("sensitive_target", targetDecision.reason ?? "symlink target is sensitive", targetDecision);
+        }
+        return assessRelocation(input, sourceRoot, sourcePath, excludedRoots);
+    }
+}
+export const sensitiveResourcePolicy = Object.freeze(new SensitiveResourcePolicy());
+function normalizedPathParts(path) {
+    return path
+        .replace(/\\/g, "/")
+        .split("/")
+        .filter((part) => part.length > 0 && part !== ".");
+}
+function sensitivePath(pathClass, matchedPart, reason) {
+    return { sensitive: true, class: pathClass, matchedPart, reason };
+}
+function denySymlink(reason, detail, pathDecision = null) {
+    return { allowed: false, reason, detail, pathDecision };
+}
+function allowSymlink() {
+    return { allowed: true, reason: null, detail: null, pathDecision: null };
+}
+function assessRelocation(input, sourceRoot, sourcePath, excludedRoots) {
+    if (isAbsolute(input.linkTarget)) {
+        return input.relocationRoot
+            ? denySymlink("absolute_target", "absolute symlink targets are not relocatable")
+            : allowSymlink();
+    }
+    if (!input.relocationRoot)
+        return allowSymlink();
+    const relocationRoot = resolve(input.relocationRoot);
+    const sourceParentRelative = relative(sourceRoot, dirname(sourcePath));
+    if (escapesRelativeRoot(sourceParentRelative)) {
+        return denySymlink("invalid_source", "symlink source parent is outside the allowed root");
+    }
+    const relocatedTargetRelative = normalize(join(sourceParentRelative, input.linkTarget));
+    if (escapesRelativeRoot(relocatedTargetRelative)) {
+        return denySymlink("relocation_escape", "symlink escapes when relocated");
+    }
+    const relocatedTarget = resolve(relocationRoot, relocatedTargetRelative);
+    if (!isSameOrInside(relocationRoot, relocatedTarget)) {
+        return denySymlink("relocation_escape", "symlink escapes the relocation root");
+    }
+    if (excludedRoots.some((root) => isSameOrInside(root, relocatedTarget))) {
+        return denySymlink("excluded_target", "relocated symlink resolves into an excluded root");
+    }
+    return allowSymlink();
+}
+function escapesRelativeRoot(path) {
+    if (isAbsolute(path))
+        return true;
+    const normalized = normalize(path);
+    const first = normalized.split(/[\\/]+/)[0];
+    return normalized === ".." || first === "..";
+}
+function isSameOrInside(parent, target) {
+    const rel = relative(resolve(parent), resolve(target));
+    const firstPart = rel.split(/[\\/]+/)[0];
+    return rel === "" || (!!rel && firstPart !== ".." && !isAbsolute(rel));
+}
+//# sourceMappingURL=sensitive-resource.js.map

package/dist/sensitive-resource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sensitive-resource.js","sourceRoot":"","sources":["../src/sensitive-resource.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA8E7F,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC,CAAC;AAE9F,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,YAAY;IACZ,MAAM;IACN,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,SAAS;IACT,SAAS;IACT,SAAS;IACT,QAAQ;IACR,OAAO;IACP,SAAS;IACT,MAAM;CACP,CAAC,CAAC;AAEH,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,kBAAkB;IAClB,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,sCAAsC;CACvC,CAAC,CAAC;AAEH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAC9F,MAAM,oBAAoB,GAAG,4CAA4C,CAAC;AAC1E,MAAM,wBAAwB,GAAG,iEAAiE,CAAC;AAEnG,MAAM,aAAa,GAA2B;IAC5C,EAAE,EAAE,EAAE,cAAc,EAAE,OAAO,EAAE,mCAAmC,EAAE;IACpE,EAAE,EAAE,EAAE,cAAc,EAAE,OAAO,EAAE,2BAA2B,EAAE;IAC5D,EAAE,EAAE,EAAE,cAAc,EAAE,OAAO,EAAE,2BAA2B,EAAE;IAC5D,EAAE,EAAE,EAAE,cAAc,EAAE,OAAO,EAAE,2BAA2B,EAAE;IAC5D,EAAE,EAAE,EAAE,cAAc,EAAE,OAAO,EAAE,2BAA2B,EAAE;IAC5D,EAAE,EAAE,EAAE,cAAc,EAAE,OAAO,EAAE,+BAA+B,EAAE;IAChE,EAAE,EAAE,EAAE,mBAAmB,EAAE,OAAO,EAAE,gCAAgC,EAAE;IACtE,EAAE,EAAE,EAAE,2BAA2B,EAAE,OAAO,EAAE,gCAAgC,EAAE;IAC9E,EAAE,EAAE,EAAE,2BAA2B,EAAE,OAAO,EAAE,4BAA4B,EAAE;IAC1E,EAAE,EAAE,EAAE,gBAAgB,EAAE,OAAO,EAAE,6BAA6B,EAAE;IAChE,EAAE,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,6BAA6B,EAAE;IAC7D,EAAE,EAAE,EAAE,gBAAgB,EAAE,OAAO,EAAE,uBAAuB,EAAE;IAC1D,EAAE,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,qCAAqC,EAAE;IACrE,EAAE,EAAE,EAAE,gBAAgB,EAAE,OAAO,EAAE,2BAA2B,EAAE;IAC9D,EAAE,EAAE,EAAE,oBAAoB,EAAE,OAAO,EAAE,gCAAgC,EAAE;IACvE,EAAE,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,2BAA2B,EAAE;IACzD;QACE,EAAE,EAAE,mBAAmB;QACvB,OAAO,EAAE,6EAA6E;KACvF;IACD,EAAE,EAAE,EAAE,cAAc,EAAE,OAAO,EAAE,uCAAuC,EAAE;IACxE,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,mEAAmE,EAAE;CAC5F,CAAC;AAEF,MAAM,UAAU,GAAkC,MAAM,CAAC,MAAM,CAAC;IAC9D,SAAS,EAAE,KAAK;IAChB,KAAK,EAAE,IAAI;IACX,WAAW,EAAE,IAAI;IACjB,MAAM,EAAE,IAAI;CACb,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,OAAO,uBAAuB;IACzB,eAAe,GAAG,YAAY,CAAC;IAExC,YAAY,CAAC,IAAY;QACvB,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACxC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YAEjC,IAAI,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtC,OAAO,aAAa,CAAC,kBAAkB,EAAE,IAAI,EAAE,oCAAoC,IAAI,EAAE,CAAC,CAAC;YAC7F,CAAC;YACD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACxE,OAAO,aAAa,CAClB,kBAAkB,EAClB,GAAG,IAAI,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,EAC7B,oCAAoC,IAAI,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAC/D,CAAC;YACJ,CAAC;YACD,wEAAwE;YACxE,yEAAyE;YACzE,0DAA0D;YAC1D,MAAM,aAAa,GAAG,KAAK,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,UAAU,CAAC;YAClF,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,aAAa,EAAE,CAAC;gBAC1C,OAAO,aAAa,CAAC,kBAAkB,EAAE,IAAI,EAAE,oCAAoC,IAAI,EAAE,CAAC,CAAC;YAC7F,CAAC;YACD,IACE,KAAK,KAAK,MAAM;gBAChB,KAAK,KAAK,QAAQ;gBAClB,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;gBAC3B,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EACtE,CAAC;gBACD,OAAO,aAAa,CAAC,kBAAkB,EAAE,IAAI,EAAE,4BAA4B,IAAI,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,IAAI,yBAAyB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjF,OAAO,aAAa,CAAC,iBAAiB,EAAE,IAAI,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC;YAC5E,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChE,OAAO,aAAa,CAAC,aAAa,EAAE,IAAI,EAAE,yBAAyB,IAAI,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,IAAI,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBAC/C,OAAO,aAAa,CAClB,aAAa,EACb,IAAI,EACJ,oCAAoC,OAAO,CAAC,KAAK,CAAC,EAAE,CACrD,CAAC;YACJ,CAAC;YAED,IAAI,KAAK,KAAK,YAAY,EAAE,CAAC;gBAC3B,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;gBACpD,IAAI,WAAW,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC9E,OAAO,aAAa,CAClB,kBAAkB,EAClB,GAAG,IAAI,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,EAC7B,sCAAsC,IAAI,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CACjE,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,cAAc,CACZ,IAAY,EACZ,WAAqC,QAAQ;QAE7C,IAAI,QAAQ,GAAG,IAAI,CAAC;QACpB,MAAM,UAAU,GAAG,IAAI,GAAG,EAA6B,CAAC;QACxD,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,QAAQ,CAAC;YACxB,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YAChE,IAAI,QAAQ,KAAK,MAAM;gBAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,wBAAwB,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACpF,CAAC;QACD,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,wBAAwB,EAAE,IAAI;YAC9B,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC;YAC3B,yEAAyE;YACzE,qEAAqE;YACrE,IAAI,EAAE,QAAQ;SACf,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,IAAY;QACjB,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC;IAClD,CAAC;IAED,wBAAwB,CAAC,IAAY;QACnC,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,wBAAwB,CAAC;IACtE,CAAC;IAED,aAAa,CAAC,KAA4B;QACxC,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC7C,MAAM,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACzD,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC7C,MAAM,aAAa,GAAG,CAAC,KAAK,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAE/E,IAAI,CAAC,cAAc,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC;YAC5C,OAAO,WAAW,CAAC,gBAAgB,EAAE,4CAA4C,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;QAC3E,IAAI,cAAc,CAAC,SAAS,EAAE,CAAC;YAC7B,OAAO,WAAW,CAChB,kBAAkB,EAClB,cAAc,CAAC,MAAM,IAAI,6BAA6B,EACtD,cAAc,CACf,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC;YAC9B,OAAO,WAAW,CAAC,mBAAmB,EAAE,mCAAmC,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YACzD,OAAO,WAAW,CAAC,aAAa,EAAE,uCAAuC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;QAC/F,CAAC;QAED,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACzD,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,cAAc,CAAC,EAAE,CAAC;YACnD,OAAO,WAAW,CAAC,qBAAqB,EAAE,2CAA2C,CAAC,CAAC;QACzF,CAAC;QACD,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;YACvE,OAAO,WAAW,CAAC,iBAAiB,EAAE,wCAAwC,CAAC,CAAC;QAClF,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC;QAClF,IAAI,cAAc,CAAC,SAAS,EAAE,CAAC;YAC7B,OAAO,WAAW,CAChB,kBAAkB,EAClB,cAAc,CAAC,MAAM,IAAI,6BAA6B,EACtD,cAAc,CACf,CAAC;QACJ,CAAC;QAED,OAAO,gBAAgB,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;IACxE,CAAC;CACF;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,uBAAuB,EAAE,CAAC,CAAC;AAEpF,SAAS,mBAAmB,CAAC,IAAY;IACvC,OAAO,IAAI;SACR,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,aAAa,CACpB,SAAqC,EACrC,WAAmB,EACnB,MAAc;IAEd,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,WAAW,CAClB,MAAkC,EAClC,MAAc,EACd,eAAqD,IAAI;IAEzD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;AAC3E,CAAC;AAED,SAAS,gBAAgB,CACvB,KAA4B,EAC5B,UAAkB,EAClB,UAAkB,EAClB,aAAgC;IAEhC,IAAI,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC,cAAc;YACzB,CAAC,CAAC,WAAW,CAAC,iBAAiB,EAAE,8CAA8C,CAAC;YAChF,CAAC,CAAC,YAAY,EAAE,CAAC;IACrB,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,cAAc;QAAE,OAAO,YAAY,EAAE,CAAC;IAEjD,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACrD,MAAM,oBAAoB,GAAG,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IACvE,IAAI,mBAAmB,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC9C,OAAO,WAAW,CAAC,gBAAgB,EAAE,mDAAmD,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,uBAAuB,GAAG,SAAS,CAAC,IAAI,CAAC,oBAAoB,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;IACxF,IAAI,mBAAmB,CAAC,uBAAuB,CAAC,EAAE,CAAC;QACjD,OAAO,WAAW,CAAC,mBAAmB,EAAE,gCAAgC,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,eAAe,GAAG,OAAO,CAAC,cAAc,EAAE,uBAAuB,CAAC,CAAC;IACzE,IAAI,CAAC,cAAc,CAAC,cAAc,EAAE,eAAe,CAAC,EAAE,CAAC;QACrD,OAAO,WAAW,CAAC,mBAAmB,EAAE,qCAAqC,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC;QACxE,OAAO,WAAW,CAAC,iBAAiB,EAAE,kDAAkD,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,YAAY,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY;IACvC,IAAI,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,OAAO,UAAU,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,CAAC;AAC/C,CAAC;AAED,SAAS,cAAc,CAAC,MAAc,EAAE,MAAc;IACpD,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,SAAS,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AACzE,CAAC"}

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const CLAUDEXOR_VERSION = "1.0.1";
+export declare const CLAUDEXOR_VERSION = "2.1.0";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1,5 +1,5 @@
 // GENERATED by scripts/gen-version.mjs from the root package.json — do not edit by hand.
 // Run `pnpm gen:version` after bumping the root version (changesets keeps the
 // workspace manifests in lockstep). The docs-truth gate enforces parity.
-export const CLAUDEXOR_VERSION = "1.0.1";
+export const CLAUDEXOR_VERSION = "2.1.0";
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claudexor/util",
-  "version": "1.0.1",
+  "version": "2.1.0",
   "license": "MIT",
   "description": "Low-level utilities (ids, hashing, fs, redaction) with no Claudexor deps.",
   "type": "module",