@cmnwlth/core 0.1.0

package/dist/index.js

@@ -0,0 +1,2195 @@
+// src/schema.ts
+import { z } from "zod";
+var NOTE_KINDS = ["memory", "decision", "work-state", "person"];
+var KIND_DIR = {
+  memory: "memory",
+  decision: "decisions",
+  "work-state": "work-state",
+  person: "people"
+};
+var IsoDate = z.preprocess(
+  (v) => v instanceof Date ? v.toISOString().slice(0, 10) : v,
+  z.string().regex(/^\d{4}-\d{2}-\d{2}$/, "expected a YYYY-MM-DD date")
+);
+var SafeId = z.string().min(1).refine((s) => !s.includes("/") && !s.includes("\\") && s !== "." && s !== "..", {
+  message: "id must be a single path segment (no '/', '\\\\', or '..')"
+});
+var baseShape = {
+  id: SafeId,
+  title: z.string().min(1),
+  tags: z.array(z.string()).default([]),
+  created: IsoDate,
+  updated: IsoDate.optional(),
+  author: z.string().optional(),
+  /**
+   * Originating project the note was captured from — a stable repo identity (git `origin`
+   * slug, else the repo-root basename). Lets a shared brain group/filter notes by project
+   * (ADR-0015). Optional: pre-existing and non-project notes are "unattributed".
+   */
+  source: z.string().optional(),
+  /** Wikilink targets (`[[id]]` or bare id) to related notes. */
+  relates: z.array(z.string()).default([])
+};
+var MemoryFrontmatter = z.object({
+  ...baseShape,
+  kind: z.literal("memory"),
+  status: z.enum(["active", "superseded", "stale"]).default("active"),
+  /** Last time this fact was checked against reality (Kage-style verification). */
+  verified: IsoDate.optional(),
+  sources: z.array(z.string()).default([]),
+  superseded_by: z.string().nullable().optional()
+}).passthrough();
+var DecisionFrontmatter = z.object({
+  ...baseShape,
+  kind: z.literal("decision"),
+  status: z.enum(["proposed", "accepted", "superseded"]).default("proposed"),
+  supersedes: z.array(z.string()).default([]),
+  superseded_by: z.string().nullable().optional(),
+  deciders: z.array(z.string()).default([])
+}).passthrough();
+var WorkStateFrontmatter = z.object({
+  ...baseShape,
+  kind: z.literal("work-state"),
+  owner: z.string().optional(),
+  status: z.enum(["planned", "in-progress", "blocked", "done"]).default("planned")
+}).passthrough();
+var PersonFrontmatter = z.object({
+  ...baseShape,
+  kind: z.literal("person"),
+  name: z.string().min(1),
+  org: z.string().optional(),
+  role: z.string().optional()
+}).passthrough();
+var Frontmatter = z.discriminatedUnion("kind", [
+  MemoryFrontmatter,
+  DecisionFrontmatter,
+  WorkStateFrontmatter,
+  PersonFrontmatter
+]);
+var SCHEMA_VERSION = 1;
+
+// src/config.ts
+import { promises as fs } from "fs";
+import path from "path";
+function scanOptions(config) {
+  return { detectEntropy: config.secretScan.entropy, allowlist: config.secretScan.allowlist };
+}
+var FEATURE_FLAGS = [
+  {
+    name: "autoAdr",
+    description: "Auto-create ADR/decision notes in the brain when a decision is captured",
+    default: false
+  },
+  {
+    name: "autoPromote",
+    description: "Auto-promote captured notes straight into canon instead of holding them in the review queue. Curation gating (dedup/validation) still applies; only the manual review step is skipped (ADR-0014). Set false to require manual /commonwealth:promote.",
+    default: true
+  }
+];
+function defaultFeatures() {
+  const features = {};
+  for (const flag of FEATURE_FLAGS) {
+    features[flag.name] = flag.default;
+  }
+  return features;
+}
+function defaultBrainConfig(name) {
+  return {
+    name,
+    schemaVersion: SCHEMA_VERSION,
+    remotes: [],
+    curation: {},
+    features: defaultFeatures(),
+    secretScan: { entropy: false, allowlist: [] }
+  };
+}
+var schemaSkewWarned = /* @__PURE__ */ new Set();
+function warnSchemaSkewOnce(brainDir, found) {
+  const key = path.resolve(brainDir);
+  if (schemaSkewWarned.has(key)) return;
+  schemaSkewWarned.add(key);
+  console.error(
+    `[commonwealth] brain at ${key} is schema v${found} but this build understands v${SCHEMA_VERSION}; some fields may not be read correctly \u2014 upgrade Commonwealth.`
+  );
+}
+var CONFIG_REL = path.join(".commonwealth", "config.json");
+function brainConfigPath(brainDir) {
+  return path.join(brainDir, CONFIG_REL);
+}
+async function loadBrainConfig(brainDir) {
+  const defaults = defaultBrainConfig(path.basename(path.resolve(brainDir)));
+  let raw;
+  try {
+    raw = await fs.readFile(brainConfigPath(brainDir), "utf8");
+  } catch {
+    return defaults;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return defaults;
+  }
+  const obj = typeof parsed === "object" && parsed !== null ? parsed : {};
+  if (typeof obj.schemaVersion === "number" && obj.schemaVersion > SCHEMA_VERSION) {
+    warnSchemaSkewOnce(brainDir, obj.schemaVersion);
+  }
+  return {
+    name: typeof obj.name === "string" ? obj.name : defaults.name,
+    schemaVersion: typeof obj.schemaVersion === "number" ? obj.schemaVersion : defaults.schemaVersion,
+    remotes: Array.isArray(obj.remotes) ? obj.remotes : defaults.remotes,
+    curation: typeof obj.curation === "object" && obj.curation !== null ? obj.curation : defaults.curation,
+    // Defaults first so missing flags are filled; file values win, unknown keys preserved.
+    features: {
+      ...defaults.features,
+      ...typeof obj.features === "object" && obj.features !== null ? obj.features : {}
+    },
+    secretScan: normalizeSecretScan(obj.secretScan, defaults.secretScan)
+  };
+}
+function normalizeSecretScan(raw, fallback) {
+  if (typeof raw !== "object" || raw === null) return fallback;
+  const obj = raw;
+  return {
+    entropy: typeof obj.entropy === "boolean" ? obj.entropy : fallback.entropy,
+    allowlist: Array.isArray(obj.allowlist) && obj.allowlist.every((v) => typeof v === "string") ? obj.allowlist : fallback.allowlist
+  };
+}
+async function saveBrainConfig(brainDir, config) {
+  const file = brainConfigPath(brainDir);
+  await fs.mkdir(path.dirname(file), { recursive: true });
+  const tmp = `${file}.${process.pid}.tmp`;
+  await fs.writeFile(tmp, `${JSON.stringify(config, null, 2)}
+`, "utf8");
+  await fs.rename(tmp, file);
+}
+async function isFeatureEnabled(brainDir, feature) {
+  const config = await loadBrainConfig(brainDir);
+  return Boolean(config.features[feature]);
+}
+async function setFeature(brainDir, feature, on) {
+  const config = await loadBrainConfig(brainDir);
+  config.features[feature] = on;
+  await saveBrainConfig(brainDir, config);
+}
+
+// src/ids.ts
+import GithubSlugger from "github-slugger";
+import { customAlphabet } from "nanoid";
+var nano = customAlphabet("0123456789abcdefghijklmnopqrstuvwxyz", 4);
+function shortId() {
+  return nano();
+}
+function slugify(title) {
+  const slugger = new GithubSlugger();
+  const slug = slugger.slug(title).slice(0, 60);
+  return slug.replace(/-+$/, "");
+}
+function makeNoteId(title, created, suffix = shortId()) {
+  return `${created}-${slugify(title)}-${suffix}`;
+}
+function sourceSegment(source) {
+  if (typeof source !== "string") return "";
+  const seg = source.trim().replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^[-.]+|[-.]+$/g, "").slice(0, 80);
+  return seg;
+}
+function pathForNote(kind, id, source) {
+  const seg = sourceSegment(source);
+  return seg ? `${seg}/${KIND_DIR[kind]}/${id}.md` : `${KIND_DIR[kind]}/${id}.md`;
+}
+function today(date = /* @__PURE__ */ new Date()) {
+  return date.toISOString().slice(0, 10);
+}
+
+// src/notes.ts
+import { promises as fs2 } from "fs";
+import path2 from "path";
+import matter from "gray-matter";
+var KEY_ORDER = [
+  "id",
+  "kind",
+  "title",
+  "name",
+  "org",
+  "role",
+  "owner",
+  "status",
+  "tags",
+  "created",
+  "updated",
+  "author",
+  "source",
+  "verified",
+  "deciders",
+  "supersedes",
+  "superseded_by",
+  "sources",
+  "relates"
+];
+function orderFrontmatter(fm) {
+  const out = {};
+  for (const key of KEY_ORDER) {
+    if (key in fm && fm[key] !== void 0) out[key] = fm[key];
+  }
+  for (const key of Object.keys(fm).sort()) {
+    if (!(key in out) && fm[key] !== void 0) out[key] = fm[key];
+  }
+  return out;
+}
+function parseNote(raw, notePath) {
+  const parsed = matter(raw);
+  const frontmatter = Frontmatter.parse(parsed.data);
+  return { frontmatter, body: parsed.content.trim(), path: notePath };
+}
+function resolveWithinBrain(brainDir, relPath) {
+  const base = path2.resolve(brainDir);
+  const abs = path2.resolve(base, relPath);
+  if (abs !== base && !abs.startsWith(base + path2.sep)) {
+    throw new Error(`Path escapes the brain directory: ${relPath}`);
+  }
+  return abs;
+}
+function serializeNote(note) {
+  const ordered = orderFrontmatter(note.frontmatter);
+  const body = note.body.trim();
+  return matter.stringify(body ? `${body}
+` : "", ordered);
+}
+async function writeNote(brainDir, input) {
+  const created = input.created ?? today();
+  const id = makeNoteId(input.title, created);
+  const relPath = pathForNote(input.kind, id, input.source);
+  const absPath = resolveWithinBrain(brainDir, relPath);
+  const raw = {
+    ...input.fields ?? {},
+    id,
+    kind: input.kind,
+    title: input.title,
+    tags: input.tags ?? [],
+    created,
+    ...input.author ? { author: input.author } : {},
+    ...input.source ? { source: input.source } : {}
+  };
+  const frontmatter = Frontmatter.parse(raw);
+  const note = { frontmatter, body: input.body.trim(), path: relPath };
+  const content = serializeNote(note);
+  await fs2.mkdir(path2.dirname(absPath), { recursive: true });
+  const tmp = `${absPath}.${shortId()}.tmp`;
+  await fs2.writeFile(tmp, content, "utf8");
+  try {
+    await fs2.link(tmp, absPath);
+  } catch (err) {
+    await fs2.rm(tmp, { force: true });
+    if (err.code === "EEXIST") {
+      throw new Error(`Refusing to overwrite an existing note at ${relPath} (id collision)`);
+    }
+    throw err;
+  }
+  await fs2.rm(tmp, { force: true });
+  return note;
+}
+async function overwriteNote(brainDir, note) {
+  const absPath = resolveWithinBrain(brainDir, note.path);
+  const content = serializeNote(note);
+  await fs2.mkdir(path2.dirname(absPath), { recursive: true });
+  const tmp = `${absPath}.${shortId()}.tmp`;
+  await fs2.writeFile(tmp, content, "utf8");
+  await fs2.rename(tmp, absPath);
+}
+async function supersedeNote(brainDir, relPath, survivorId) {
+  const note = await readNote(brainDir, relPath);
+  const fm = note.frontmatter;
+  if (fm.kind !== "memory" && fm.kind !== "decision") return note;
+  if (fm.status === "superseded" && fm.superseded_by === survivorId) return note;
+  const updated = {
+    ...note,
+    frontmatter: { ...fm, status: "superseded", superseded_by: survivorId }
+  };
+  await overwriteNote(brainDir, updated);
+  return updated;
+}
+async function readNote(brainDir, relPath) {
+  const raw = await fs2.readFile(resolveWithinBrain(brainDir, relPath), "utf8");
+  return parseNote(raw, relPath);
+}
+var KIND_FOLDERS = new Set(Object.values(KIND_DIR));
+var NON_NOTE_DIRS = /* @__PURE__ */ new Set([".git", ".commonwealth", "index", "staging", "node_modules"]);
+async function listNotes(brainDir, kind) {
+  const found = [];
+  async function walk(absDir) {
+    let entries;
+    try {
+      entries = await fs2.readdir(absDir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (entry.isDirectory()) {
+        if (NON_NOTE_DIRS.has(entry.name)) continue;
+        await walk(path2.join(absDir, entry.name));
+      } else if (entry.isFile() && entry.name.endsWith(".md") && entry.name !== "INDEX.md" && KIND_FOLDERS.has(path2.basename(absDir))) {
+        found.push(path2.relative(brainDir, path2.join(absDir, entry.name)));
+      }
+    }
+  }
+  await walk(brainDir);
+  const notes = [];
+  for (const rel of found.sort()) {
+    let note;
+    try {
+      note = await readNote(brainDir, rel);
+    } catch (err) {
+      console.error(
+        `[commonwealth] skipping unreadable note ${rel}: ${err instanceof Error ? err.message : err}`
+      );
+      continue;
+    }
+    if (!kind || note.frontmatter.kind === kind) notes.push(note);
+  }
+  return notes;
+}
+
+// src/scaffold.ts
+import { execFile } from "child_process";
+import { existsSync, promises as fs3 } from "fs";
+import path3 from "path";
+import { promisify } from "util";
+var pexec = promisify(execFile);
+var KIND_DIRS = Object.values(KIND_DIR);
+var KIND_INDEX_TITLE = {
+  memory: "Memory",
+  decisions: "Decisions",
+  "work-state": "Work-state",
+  people: "People"
+};
+var IGNORED_ENTRIES = /* @__PURE__ */ new Set([".git", ".gitkeep"]);
+var BRAIN_ENTRIES = /* @__PURE__ */ new Set([
+  ".commonwealth",
+  ".gitattributes",
+  ".gitignore",
+  "COMMONWEALTH.md",
+  "index",
+  ...KIND_DIRS
+]);
+var GITATTRIBUTES = ["COMMONWEALTH.md merge=union", "**/INDEX.md merge=union", ""].join("\n");
+var GITIGNORE = ["index/", "staging/", "*.db", "*.db-shm", "*.db-wal", ".DS_Store", ""].join(
+  "\n"
+);
+async function initGitRepo(dir) {
+  if (existsSync(path3.join(dir, ".git"))) return;
+  try {
+    await pexec("git", ["init", "-q", "-b", "main", dir]);
+    await pexec("git", ["add", "-A"], { cwd: dir });
+    let identity = [];
+    try {
+      const email = (await pexec("git", ["config", "user.email"], { cwd: dir })).stdout.trim();
+      if (email.length === 0) throw new Error("no identity");
+    } catch {
+      identity = ["-c", "user.name=Commonwealth", "-c", "user.email=commonwealth@localhost"];
+    }
+    await pexec(
+      "git",
+      [...identity, "commit", "-q", "-m", "Initialize Commonwealth brain scaffold"],
+      {
+        cwd: dir
+      }
+    );
+  } catch {
+  }
+}
+async function isSafeToInit(dir) {
+  if (existsSync(path3.join(dir, ".commonwealth", "schema-version"))) return true;
+  let entries;
+  try {
+    entries = await fs3.readdir(dir);
+  } catch {
+    return true;
+  }
+  for (const entry of entries) {
+    if (IGNORED_ENTRIES.has(entry)) continue;
+    if (!BRAIN_ENTRIES.has(entry)) return false;
+  }
+  return true;
+}
+async function writeFile(file, contents) {
+  await fs3.mkdir(path3.dirname(file), { recursive: true });
+  await fs3.writeFile(file, contents, "utf8");
+}
+async function writeFileIfAbsent(file, contents) {
+  await fs3.mkdir(path3.dirname(file), { recursive: true });
+  try {
+    await fs3.writeFile(file, contents, { encoding: "utf8", flag: "wx" });
+  } catch (err) {
+    if (err.code === "EEXIST") return;
+    throw err;
+  }
+}
+async function initBrain(dir, opts = {}) {
+  if (!opts.force && !await isSafeToInit(dir)) {
+    throw new Error(
+      `Refusing to initialize a Commonwealth brain in a non-empty directory: ${dir}. Pass { force: true } to proceed.`
+    );
+  }
+  const name = opts.name ?? path3.basename(path3.resolve(dir));
+  await fs3.mkdir(dir, { recursive: true });
+  for (const kindDir of KIND_DIRS) {
+    const abs = path3.join(dir, kindDir);
+    await fs3.mkdir(abs, { recursive: true });
+    await writeFile(path3.join(abs, ".gitkeep"), "");
+    const title = KIND_INDEX_TITLE[kindDir] ?? kindDir;
+    await writeFile(path3.join(abs, "INDEX.md"), `# ${title} index
+
+_generated_
+`);
+  }
+  await writeFileIfAbsent(path3.join(dir, ".commonwealth", "schema-version"), `${SCHEMA_VERSION}
+`);
+  const config = defaultBrainConfig(name);
+  await writeFileIfAbsent(
+    path3.join(dir, ".commonwealth", "config.json"),
+    `${JSON.stringify(config, null, 2)}
+`
+  );
+  await writeFileIfAbsent(path3.join(dir, ".gitattributes"), GITATTRIBUTES);
+  await writeFileIfAbsent(path3.join(dir, ".gitignore"), GITIGNORE);
+  const commonwealth = [
+    `# ${name} \u2014 Commonwealth brain`,
+    "",
+    "_This file is generated. Do not edit by hand \u2014 it is regenerated from the note set._",
+    "",
+    "Run the Commonwealth index to populate the router with active work-state and recent decisions.",
+    ""
+  ].join("\n");
+  await writeFile(path3.join(dir, "COMMONWEALTH.md"), commonwealth);
+  await initGitRepo(dir);
+}
+var BRAIN_KIND_DIRS = KIND_DIRS;
+
+// src/secrets-gitleaks.generated.ts
+var GITLEAKS_PATTERNS = [
+  {
+    kind: "gitleaks:1password-secret-key",
+    re: new RegExp(
+      "\\bA3-[A-Z0-9]{6}-(?:(?:[A-Z0-9]{11})|(?:[A-Z0-9]{6}-[A-Z0-9]{5}))-[A-Z0-9]{5}-[A-Z0-9]{5}-[A-Z0-9]{5}\\b",
+      "g"
+    )
+  },
+  {
+    kind: "gitleaks:1password-service-account-token",
+    re: new RegExp("ops_eyJ[a-zA-Z0-9+/]{250,}={0,3}", "g")
+  },
+  {
+    kind: "gitleaks:adafruit-api-key",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:adafruit)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-z0-9_-]{32})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:adobe-client-id",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:adobe)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-f0-9]{32})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:age-secret-key",
+    re: new RegExp("AGE-SECRET-KEY-1[QPZRY9X8GF2TVDW0S3JN54KHCE6MUA7L]{58}", "g")
+  },
+  {
+    kind: "gitleaks:airtable-api-key",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:airtable)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-z0-9]{17})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:airtable-personnal-access-token",
+    re: new RegExp("\\b(pat[A-Za-z0-9]{14}\\.[a-f0-9]{64})\\b", "g")
+  },
+  {
+    kind: "gitleaks:algolia-api-key",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:algolia)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-z0-9]{32})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:alibaba-secret-key",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:alibaba)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-z0-9]{30})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:anthropic-admin-api-key",
+    re: new RegExp(`\\b(sk-ant-admin01-[a-zA-Z0-9_\\-]{93}AA)(?:[\\x60'"\\s;]|\\\\[nr]|$)`, "g")
+  },
+  {
+    kind: "gitleaks:anthropic-api-key",
+    re: new RegExp(`\\b(sk-ant-api03-[a-zA-Z0-9_\\-]{93}AA)(?:[\\x60'"\\s;]|\\\\[nr]|$)`, "g")
+  },
+  { kind: "gitleaks:artifactory-api-key", re: new RegExp("\\bAKCp[A-Za-z0-9]{69}\\b", "g") },
+  {
+    kind: "gitleaks:artifactory-reference-token",
+    re: new RegExp("\\bcmVmd[A-Za-z0-9]{59}\\b", "g")
+  },
+  {
+    kind: "gitleaks:asana-client-id",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:asana)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([0-9]{16})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:asana-client-secret",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:asana)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-z0-9]{32})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:aws-access-token",
+    re: new RegExp("\\b((?:A3T[A-Z0-9]|AKIA|ASIA|ABIA|ACCA)[A-Z2-7]{16})\\b", "g")
+  },
+  {
+    kind: "gitleaks:aws-amazon-bedrock-api-key-long-lived",
+    re: new RegExp(`\\b(ABSK[A-Za-z0-9+/]{109,269}={0,2})(?:[\\x60'"\\s;]|\\\\[nr]|$)`, "g")
+  },
+  {
+    kind: "gitleaks:aws-amazon-bedrock-api-key-short-lived",
+    re: new RegExp("bedrock-api-key-YmVkcm9jay5hbWF6b25hd3MuY29t", "g")
+  },
+  {
+    kind: "gitleaks:azure-ad-client-secret",
+    re: new RegExp(
+      `(?:^|[\\\\'"\\x60\\s>=:(,)])([a-zA-Z0-9_~.]{3}\\dQ~[a-zA-Z0-9_~.-]{31,34})(?:$|[\\\\'"\\x60\\s<),])`,
+      "g"
+    )
+  },
+  {
+    kind: "gitleaks:beamer-api-token",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:beamer)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}(b_[a-z0-9=_\\-]{44})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:bitbucket-client-id",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:bitbucket)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-z0-9]{32})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:bitbucket-client-secret",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:bitbucket)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-z0-9=_\\-]{64})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:bittrex-access-key",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:bittrex)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-z0-9]{32})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:bittrex-secret-key",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:bittrex)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-z0-9]{32})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:clickhouse-cloud-api-secret-key",
+    re: new RegExp("\\b(4b1d[A-Za-z0-9]{38})\\b", "g")
+  },
+  { kind: "gitleaks:clojars-api-token", re: new RegExp("CLOJARS_[a-z0-9]{60}", "gi") },
+  {
+    kind: "gitleaks:cloudflare-api-key",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:cloudflare)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-z0-9_-]{40})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:cloudflare-global-api-key",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:cloudflare)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-f0-9]{37})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:cloudflare-origin-ca-key",
+    re: new RegExp(`\\b(v1\\.0-[a-f0-9]{24}-[a-f0-9]{146})(?:[\\x60'"\\s;]|\\\\[nr]|$)`, "g")
+  },
+  {
+    kind: "gitleaks:codecov-access-token",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:codecov)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-z0-9]{32})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:coinbase-access-token",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:coinbase)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-z0-9_-]{64})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:confluent-access-token",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:confluent)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-z0-9]{16})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:confluent-secret-key",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:confluent)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-z0-9]{64})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:contentful-delivery-api-token",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:contentful)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-z0-9=_\\-]{43})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:curl-auth-user",
+    re: new RegExp(
+      `\\bcurl\\b(?:.*|.*(?:[\\r\\n]{1,2}.*){1,5})[ \\t\\n\\r](?:-u|--user)(?:=|[ \\t]{0,5})("(:[^"]{3,}|[^:"]{3,}:|[^:"]{3,}:[^"]{3,})"|'([^:']{3,}:[^']{3,})'|((?:"[^"]{3,}"|'[^']{3,}'|[\\w$@.-]+):(?:"[^"]{3,}"|'[^']{3,}'|[\\w\${}@.-]+)))(?:\\s|\\z)`,
+      "g"
+    )
+  },
+  {
+    kind: "gitleaks:databricks-api-token",
+    re: new RegExp(`\\b(dapi[a-f0-9]{32}(?:-\\d)?)(?:[\\x60'"\\s;]|\\\\[nr]|$)`, "g")
+  },
+  {
+    kind: "gitleaks:datadog-access-token",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:datadog)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-z0-9]{40})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:defined-networking-api-token",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:dnkey)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}(dnkey-[a-z0-9=_\\-]{26}-[a-z0-9=_\\-]{52})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:digitalocean-access-token",
+    re: new RegExp(`\\b(doo_v1_[a-f0-9]{64})(?:[\\x60'"\\s;]|\\\\[nr]|$)`, "g")
+  },
+  {
+    kind: "gitleaks:digitalocean-pat",
+    re: new RegExp(`\\b(dop_v1_[a-f0-9]{64})(?:[\\x60'"\\s;]|\\\\[nr]|$)`, "g")
+  },
+  {
+    kind: "gitleaks:digitalocean-refresh-token",
+    re: new RegExp(`\\b(dor_v1_[a-f0-9]{64})(?:[\\x60'"\\s;]|\\\\[nr]|$)`, "gi")
+  },
+  {
+    kind: "gitleaks:discord-api-token",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:discord)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-f0-9]{64})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:discord-client-id",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:discord)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([0-9]{18})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:discord-client-secret",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:discord)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-z0-9=_\\-]{32})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:droneci-access-token",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:droneci)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-z0-9]{32})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:dropbox-api-token",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:dropbox)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-z0-9]{15})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:dropbox-long-lived-api-token",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:dropbox)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-z0-9]{11}(AAAAAAAAAA)[a-z0-9\\-_=]{43})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:dropbox-short-lived-api-token",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:dropbox)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}(sl\\.[a-z0-9\\-=_]{135})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:facebook-access-token",
+    re: new RegExp(`\\b(\\d{15,16}(\\||%)[0-9a-z\\-_]{27,40})(?:[\\x60'"\\s;]|\\\\[nr]|$)`, "gi")
+  },
+  {
+    kind: "gitleaks:facebook-secret",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:facebook)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-f0-9]{32})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:fastly-api-token",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:fastly)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-z0-9=_\\-]{32})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:finicity-api-token",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:finicity)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-f0-9]{32})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:finicity-client-secret",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:finicity)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-z0-9]{20})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:finnhub-access-token",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:finnhub)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-z0-9]{20})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:flickr-access-token",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:flickr)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-z0-9]{32})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:flyio-access-token",
+    re: new RegExp(
+      `\\b((?:fo1_[\\w-]{43}|fm1[ar]_[a-zA-Z0-9+\\/]{100,}={0,3}|fm2_[a-zA-Z0-9+\\/]{100,}={0,3}))(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "g"
+    )
+  },
+  {
+    kind: "gitleaks:freemius-secret-key",
+    re: new RegExp(`["']secret_key["']\\s*=>\\s*["'](sk_[\\S]{29})["']`, "gi")
+  },
+  {
+    kind: "gitleaks:freshbooks-access-token",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:freshbooks)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-z0-9]{64})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:gcp-api-key",
+    re: new RegExp(`\\b(AIza[\\w-]{35})(?:[\\x60'"\\s;]|\\\\[nr]|$)`, "g")
+  },
+  { kind: "gitleaks:github-app-token", re: new RegExp("(?:ghu|ghs)_[0-9a-zA-Z]{36}", "g") },
+  { kind: "gitleaks:github-fine-grained-pat", re: new RegExp("github_pat_\\w{82}", "g") },
+  { kind: "gitleaks:github-oauth", re: new RegExp("gho_[0-9a-zA-Z]{36}", "g") },
+  { kind: "gitleaks:github-pat", re: new RegExp("ghp_[0-9a-zA-Z]{36}", "g") },
+  { kind: "gitleaks:github-refresh-token", re: new RegExp("ghr_[0-9a-zA-Z]{36}", "g") },
+  {
+    kind: "gitleaks:gitlab-cicd-job-token",
+    re: new RegExp("glcbt-[0-9a-zA-Z]{1,5}_[0-9a-zA-Z_-]{20}", "g")
+  },
+  { kind: "gitleaks:gitlab-deploy-token", re: new RegExp("gldt-[0-9a-zA-Z_\\-]{20}", "g") },
+  {
+    kind: "gitleaks:gitlab-feature-flag-client-token",
+    re: new RegExp("glffct-[0-9a-zA-Z_\\-]{20}", "g")
+  },
+  { kind: "gitleaks:gitlab-feed-token", re: new RegExp("glft-[0-9a-zA-Z_\\-]{20}", "g") },
+  { kind: "gitleaks:gitlab-incoming-mail-token", re: new RegExp("glimt-[0-9a-zA-Z_\\-]{25}", "g") },
+  {
+    kind: "gitleaks:gitlab-kubernetes-agent-token",
+    re: new RegExp("glagent-[0-9a-zA-Z_\\-]{50}", "g")
+  },
+  { kind: "gitleaks:gitlab-oauth-app-secret", re: new RegExp("gloas-[0-9a-zA-Z_\\-]{64}", "g") },
+  { kind: "gitleaks:gitlab-pat", re: new RegExp("glpat-[\\w-]{20}", "g") },
+  {
+    kind: "gitleaks:gitlab-pat-routable",
+    re: new RegExp("\\bglpat-[0-9a-zA-Z_-]{27,300}\\.[0-9a-z]{2}[0-9a-z]{7}\\b", "g")
+  },
+  { kind: "gitleaks:gitlab-ptt", re: new RegExp("glptt-[0-9a-f]{40}", "g") },
+  { kind: "gitleaks:gitlab-rrt", re: new RegExp("GR1348941[\\w-]{20}", "g") },
+  {
+    kind: "gitleaks:gitlab-runner-authentication-token",
+    re: new RegExp("glrt-[0-9a-zA-Z_\\-]{20}", "g")
+  },
+  {
+    kind: "gitleaks:gitlab-runner-authentication-token-routable",
+    re: new RegExp("\\bglrt-t\\d_[0-9a-zA-Z_\\-]{27,300}\\.[0-9a-z]{2}[0-9a-z]{7}\\b", "g")
+  },
+  { kind: "gitleaks:gitlab-scim-token", re: new RegExp("glsoat-[0-9a-zA-Z_\\-]{20}", "g") },
+  { kind: "gitleaks:gitlab-session-cookie", re: new RegExp("_gitlab_session=[0-9a-z]{32}", "g") },
+  {
+    kind: "gitleaks:gitter-access-token",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:gitter)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-z0-9_-]{40})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:grafana-api-key",
+    re: new RegExp(`\\b(eyJrIjoi[A-Za-z0-9]{70,400}={0,3})(?:[\\x60'"\\s;]|\\\\[nr]|$)`, "gi")
+  },
+  {
+    kind: "gitleaks:grafana-cloud-api-token",
+    re: new RegExp(`\\b(glc_[A-Za-z0-9+/]{32,400}={0,3})(?:[\\x60'"\\s;]|\\\\[nr]|$)`, "gi")
+  },
+  {
+    kind: "gitleaks:grafana-service-account-token",
+    re: new RegExp(`\\b(glsa_[A-Za-z0-9]{32}_[A-Fa-f0-9]{8})(?:[\\x60'"\\s;]|\\\\[nr]|$)`, "gi")
+  },
+  {
+    kind: "gitleaks:harness-api-key",
+    re: new RegExp("(?:pat|sat)\\.[a-zA-Z0-9_-]{22}\\.[a-zA-Z0-9]{24}\\.[a-zA-Z0-9]{20}", "g")
+  },
+  {
+    kind: "gitleaks:hashicorp-tf-password",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:administrator_login_password|password)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}("[a-z0-9=_\\-]{8,20}")(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:heroku-api-key",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:heroku)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:heroku-api-key-v2",
+    re: new RegExp(`\\b((HRKU-AA[0-9a-zA-Z_-]{58}))(?:[\\x60'"\\s;]|\\\\[nr]|$)`, "g")
+  },
+  {
+    kind: "gitleaks:hubspot-api-key",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:hubspot)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:infracost-api-token",
+    re: new RegExp(`\\b(ico-[a-zA-Z0-9]{32})(?:[\\x60'"\\s;]|\\\\[nr]|$)`, "g")
+  },
+  {
+    kind: "gitleaks:intercom-api-key",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:intercom)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-z0-9=_\\-]{60})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:jfrog-api-key",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:jfrog|artifactory|bintray|xray)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-z0-9]{73})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:jfrog-identity-token",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:jfrog|artifactory|bintray|xray)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-z0-9]{64})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:jwt",
+    re: new RegExp(
+      `\\b(ey[a-zA-Z0-9]{17,}\\.ey[a-zA-Z0-9\\/\\\\_-]{17,}\\.(?:[a-zA-Z0-9\\/\\\\_-]{10,}={0,2})?)(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "g"
+    )
+  },
+  {
+    kind: "gitleaks:jwt-base64",
+    re: new RegExp(
+      "\\bZXlK(?:(?<alg>aGJHY2lPaU)|(?<apu>aGNIVWlPaU)|(?<apv>aGNIWWlPaU)|(?<aud>aGRXUWlPaU)|(?<b64>aU5qUWlP)|(?<crit>amNtbDBJanBi)|(?<cty>amRIa2lPaU)|(?<epk>bGNHc2lPbn)|(?<enc>bGJtTWlPaU)|(?<jku>cWEzVWlPaU)|(?<jwk>cWQyc2lPb)|(?<iss>cGMzTWlPaU)|(?<iv>cGRpSTZJ)|(?<kid>cmFXUWlP)|(?<key_ops>clpYbGZiM0J6SWpwY)|(?<kty>cmRIa2lPaUp)|(?<nonce>dWIyNWpaU0k2)|(?<p2c>d01tTWlP)|(?<p2s>d01uTWlPaU)|(?<ppt>d2NIUWlPaU)|(?<sub>emRXSWlPaU)|(?<svt>emRuUWlP)|(?<tag>MFlXY2lPaU)|(?<typ>MGVYQWlPaUp)|(?<url>MWNtd2l)|(?<use>MWMyVWlPaUp)|(?<ver>MlpYSWlPaU)|(?<version>MlpYSnphVzl1SWpv)|(?<x>NElqb2)|(?<x5c>NE5XTWlP)|(?<x5t>NE5YUWlPaU)|(?<x5ts256>NE5YUWpVekkxTmlJNkl)|(?<x5u>NE5YVWlPaU)|(?<zip>NmFYQWlPaU))[a-zA-Z0-9\\/\\\\_+\\-\\r\\n]{40,}={0,2}",
+      "g"
+    )
+  },
+  {
+    kind: "gitleaks:kraken-access-token",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:kraken)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-z0-9\\/=_\\+\\-]{80,90})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:kucoin-access-token",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:kucoin)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-f0-9]{24})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:kucoin-secret-key",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:kucoin)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:launchdarkly-access-token",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:launchdarkly)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-z0-9=_\\-]{40})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:linear-client-secret",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:linear)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-f0-9]{32})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:linkedin-client-id",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:linked[_-]?in)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-z0-9]{14})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:linkedin-client-secret",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:linked[_-]?in)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-z0-9]{16})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:lob-api-key",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:lob)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}((live|test)_[a-f0-9]{35})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:lob-pub-api-key",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:lob)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}((test|live)_pub_[a-f0-9]{31})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:looker-client-id",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:looker)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-z0-9]{20})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:looker-client-secret",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:looker)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-z0-9]{24})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:mailchimp-api-key",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:MailchimpSDK.initialize|mailchimp)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-f0-9]{32}-us\\d\\d)(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:mailgun-private-api-token",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:mailgun)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}(key-[a-f0-9]{32})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:mailgun-pub-key",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:mailgun)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}(pubkey-[a-f0-9]{32})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:mailgun-signing-key",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:mailgun)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-h0-9]{32}-[a-h0-9]{8}-[a-h0-9]{8})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:mapbox-api-token",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:mapbox)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}(pk\\.[a-z0-9]{60}\\.[a-z0-9]{22})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:mattermost-access-token",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:mattermost)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-z0-9]{26})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:maxmind-license-key",
+    re: new RegExp(`\\b([A-Za-z0-9]{6}_[A-Za-z0-9]{29}_mmk)(?:[\\x60'"\\s;]|\\\\[nr]|$)`, "g")
+  },
+  {
+    kind: "gitleaks:messagebird-api-token",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:message[_-]?bird)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-z0-9]{25})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:messagebird-client-id",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:message[_-]?bird)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:microsoft-teams-webhook",
+    re: new RegExp(
+      "https://[a-z0-9]+\\.webhook\\.office\\.com/webhookb2/[a-z0-9]{8}-([a-z0-9]{4}-){3}[a-z0-9]{12}@[a-z0-9]{8}-([a-z0-9]{4}-){3}[a-z0-9]{12}/IncomingWebhook/[a-z0-9]{32}/[a-z0-9]{8}-([a-z0-9]{4}-){3}[a-z0-9]{12}",
+      "g"
+    )
+  },
+  {
+    kind: "gitleaks:netlify-access-token",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:netlify)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-z0-9=_\\-]{40,46})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:new-relic-browser-api-token",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:new-relic|newrelic|new_relic)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}(NRJS-[a-f0-9]{19})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:new-relic-insert-key",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:new-relic|newrelic|new_relic)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}(NRII-[a-z0-9-]{32})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:new-relic-user-api-id",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:new-relic|newrelic|new_relic)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-z0-9]{64})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:new-relic-user-api-key",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:new-relic|newrelic|new_relic)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}(NRAK-[a-z0-9]{27})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:notion-api-token",
+    re: new RegExp(
+      `\\b(ntn_[0-9]{11}[A-Za-z0-9]{32}[A-Za-z0-9]{3})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "g"
+    )
+  },
+  {
+    kind: "gitleaks:npm-access-token",
+    re: new RegExp(`\\b(npm_[a-z0-9]{36})(?:[\\x60'"\\s;]|\\\\[nr]|$)`, "gi")
+  },
+  {
+    kind: "gitleaks:nuget-config-password",
+    re: new RegExp('<add key=\\"(?:(?:ClearText)?Password)\\"\\s*value=\\"(.{8,})\\"\\s*/>', "gi")
+  },
+  {
+    kind: "gitleaks:nytimes-access-token",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:nytimes|new-york-times,|newyorktimes)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-z0-9=_\\-]{32})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:octopus-deploy-api-key",
+    re: new RegExp(`\\b(API-[A-Z0-9]{26})(?:[\\x60'"\\s;]|\\\\[nr]|$)`, "g")
+  },
+  {
+    kind: "gitleaks:openai-api-key",
+    re: new RegExp(
+      `\\b(sk-(?:proj|svcacct|admin)-(?:[A-Za-z0-9_-]{74}|[A-Za-z0-9_-]{58})T3BlbkFJ(?:[A-Za-z0-9_-]{74}|[A-Za-z0-9_-]{58})\\b|sk-[a-zA-Z0-9]{20}T3BlbkFJ[a-zA-Z0-9]{20})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "g"
+    )
+  },
+  {
+    kind: "gitleaks:openshift-user-token",
+    re: new RegExp("\\b(sha256~[\\w-]{43})(?:[^\\w-]|\\z)", "g")
+  },
+  {
+    kind: "gitleaks:perplexity-api-key",
+    re: new RegExp(`\\b(pplx-[a-zA-Z0-9]{48})(?:[\\x60'"\\s;]|\\\\[nr]|$|\\b)`, "g")
+  },
+  {
+    kind: "gitleaks:plaid-api-token",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:plaid)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}(access-(?:sandbox|development|production)-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:plaid-client-id",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:plaid)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-z0-9]{24})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:plaid-secret-key",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:plaid)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-z0-9]{30})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:planetscale-oauth-token",
+    re: new RegExp(`\\b(pscale_oauth_[\\w=\\.-]{32,64})(?:[\\x60'"\\s;]|\\\\[nr]|$)`, "g")
+  },
+  {
+    kind: "gitleaks:prefect-api-token",
+    re: new RegExp(`\\b(pnu_[a-zA-Z0-9]{36})(?:[\\x60'"\\s;]|\\\\[nr]|$)`, "g")
+  },
+  {
+    kind: "gitleaks:private-key",
+    re: new RegExp(
+      "-----BEGIN[ A-Z0-9_-]{0,100}PRIVATE KEY(?: BLOCK)?-----[\\s\\S-]{64,}?KEY(?: BLOCK)?-----",
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:pulumi-api-token",
+    re: new RegExp(`\\b(pul-[a-f0-9]{40})(?:[\\x60'"\\s;]|\\\\[nr]|$)`, "g")
+  },
+  {
+    kind: "gitleaks:pypi-upload-token",
+    re: new RegExp("pypi-AgEIcHlwaS5vcmc[\\w-]{50,1000}", "g")
+  },
+  {
+    kind: "gitleaks:rapidapi-access-token",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:rapidapi)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-z0-9_-]{50})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:readme-api-token",
+    re: new RegExp(`\\b(rdme_[a-z0-9]{70})(?:[\\x60'"\\s;]|\\\\[nr]|$)`, "g")
+  },
+  {
+    kind: "gitleaks:rubygems-api-token",
+    re: new RegExp(`\\b(rubygems_[a-f0-9]{48})(?:[\\x60'"\\s;]|\\\\[nr]|$)`, "g")
+  },
+  {
+    kind: "gitleaks:scalingo-api-token",
+    re: new RegExp(`\\b(tk-us-[\\w-]{48})(?:[\\x60'"\\s;]|\\\\[nr]|$)`, "g")
+  },
+  {
+    kind: "gitleaks:sendbird-access-id",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:sendbird)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:sendbird-access-token",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:sendbird)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-f0-9]{40})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:sentry-access-token",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:sentry)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-f0-9]{64})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:sentry-org-token",
+    re: new RegExp(
+      "\\bsntrys_eyJpYXQiO[a-zA-Z0-9+/]{10,200}(?:LCJyZWdpb25fdXJs|InJlZ2lvbl91cmwi|cmVnaW9uX3VybCI6)[a-zA-Z0-9+/]{10,200}={0,2}_[a-zA-Z0-9+/]{43}(?:[^a-zA-Z0-9+/]|\\z)",
+      "g"
+    )
+  },
+  {
+    kind: "gitleaks:sentry-user-token",
+    re: new RegExp(`\\b(sntryu_[a-f0-9]{64})(?:[\\x60'"\\s;]|\\\\[nr]|$)`, "g")
+  },
+  {
+    kind: "gitleaks:settlemint-application-access-token",
+    re: new RegExp(`\\b(sm_aat_[a-zA-Z0-9]{16})(?:[\\x60'"\\s;]|\\\\[nr]|$)`, "g")
+  },
+  {
+    kind: "gitleaks:settlemint-personal-access-token",
+    re: new RegExp(`\\b(sm_pat_[a-zA-Z0-9]{16})(?:[\\x60'"\\s;]|\\\\[nr]|$)`, "g")
+  },
+  {
+    kind: "gitleaks:settlemint-service-access-token",
+    re: new RegExp(`\\b(sm_sat_[a-zA-Z0-9]{16})(?:[\\x60'"\\s;]|\\\\[nr]|$)`, "g")
+  },
+  {
+    kind: "gitleaks:shippo-api-token",
+    re: new RegExp(`\\b(shippo_(?:live|test)_[a-fA-F0-9]{40})(?:[\\x60'"\\s;]|\\\\[nr]|$)`, "g")
+  },
+  { kind: "gitleaks:shopify-access-token", re: new RegExp("shpat_[a-fA-F0-9]{32}", "g") },
+  { kind: "gitleaks:shopify-custom-access-token", re: new RegExp("shpca_[a-fA-F0-9]{32}", "g") },
+  {
+    kind: "gitleaks:shopify-private-app-access-token",
+    re: new RegExp("shppa_[a-fA-F0-9]{32}", "g")
+  },
+  { kind: "gitleaks:shopify-shared-secret", re: new RegExp("shpss_[a-fA-F0-9]{32}", "g") },
+  {
+    kind: "gitleaks:sidekiq-secret",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:BUNDLE_ENTERPRISE__CONTRIBSYS__COM|BUNDLE_GEMS__CONTRIBSYS__COM)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-f0-9]{8}:[a-f0-9]{8})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:sidekiq-sensitive-url",
+    re: new RegExp(
+      "\\bhttps?://([a-f0-9]{8}:[a-f0-9]{8})@(?:gems.contribsys.com|enterprise.contribsys.com)(?:[\\/|\\#|\\?|:]|$)",
+      "gi"
+    )
+  },
+  { kind: "gitleaks:slack-app-token", re: new RegExp("xapp-\\d-[A-Z0-9]+-\\d+-[a-z0-9]+", "gi") },
+  {
+    kind: "gitleaks:slack-bot-token",
+    re: new RegExp("xoxb-[0-9]{10,13}-[0-9]{10,13}[a-zA-Z0-9-]*", "g")
+  },
+  {
+    kind: "gitleaks:slack-config-access-token",
+    re: new RegExp("xoxe.xox[bp]-\\d-[A-Z0-9]{163,166}", "gi")
+  },
+  { kind: "gitleaks:slack-config-refresh-token", re: new RegExp("xoxe-\\d-[A-Z0-9]{146}", "gi") },
+  {
+    kind: "gitleaks:slack-legacy-bot-token",
+    re: new RegExp("xoxb-[0-9]{8,14}-[a-zA-Z0-9]{18,26}", "g")
+  },
+  {
+    kind: "gitleaks:slack-legacy-token",
+    re: new RegExp("xox[os]-\\d+-\\d+-\\d+-[a-fA-F\\d]+", "g")
+  },
+  {
+    kind: "gitleaks:slack-legacy-workspace-token",
+    re: new RegExp("xox[ar]-(?:\\d-)?[0-9a-zA-Z]{8,48}", "g")
+  },
+  {
+    kind: "gitleaks:slack-user-token",
+    re: new RegExp("xox[pe](?:-[0-9]{10,13}){3}-[a-zA-Z0-9-]{28,34}", "g")
+  },
+  {
+    kind: "gitleaks:slack-webhook-url",
+    re: new RegExp(
+      "(?:https?://)?hooks.slack.com/(?:services|workflows|triggers)/[A-Za-z0-9+/]{43,56}",
+      "g"
+    )
+  },
+  {
+    kind: "gitleaks:snyk-api-token",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:snyk[_.-]?(?:(?:api|oauth)[_.-]?)?(?:key|token))(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:sonar-api-token",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:sonar[_.-]?(login|token))(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}((?:squ_|sqp_|sqa_)?[a-z0-9=_\\-]{40})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:square-access-token",
+    re: new RegExp(`\\b((?:EAAA|sq0atp-)[\\w-]{22,60})(?:[\\x60'"\\s;]|\\\\[nr]|$)`, "g")
+  },
+  {
+    kind: "gitleaks:squarespace-access-token",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:squarespace)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:stripe-access-token",
+    re: new RegExp(
+      `\\b((?:sk|rk)_(?:test|live|prod)_[a-zA-Z0-9]{10,99})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "g"
+    )
+  },
+  {
+    kind: "gitleaks:travisci-access-token",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:travis)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-z0-9]{22})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  { kind: "gitleaks:twilio-api-key", re: new RegExp("SK[0-9a-fA-F]{32}", "g") },
+  {
+    kind: "gitleaks:twitch-api-token",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:twitch)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-z0-9]{30})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:twitter-access-secret",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:twitter)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-z0-9]{45})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:twitter-access-token",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:twitter)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([0-9]{15,25}-[a-zA-Z0-9]{20,40})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:twitter-api-key",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:twitter)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-z0-9]{25})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:twitter-api-secret",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:twitter)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-z0-9]{50})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:twitter-bearer-token",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:twitter)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}(A{22}[a-zA-Z0-9%]{80,100})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:typeform-api-token",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:typeform)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}(tfp_[a-z0-9\\-_\\.=]{59})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:vault-batch-token",
+    re: new RegExp(`\\b(hvb\\.[\\w-]{138,300})(?:[\\x60'"\\s;]|\\\\[nr]|$)`, "g")
+  },
+  {
+    kind: "gitleaks:yandex-access-token",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:yandex)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}(t1\\.[A-Z0-9a-z_-]+[=]{0,2}\\.[A-Z0-9a-z_-]{86}[=]{0,2})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:yandex-api-key",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:yandex)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}(AQVN[A-Za-z0-9_\\-]{35,38})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:yandex-aws-access-token",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:yandex)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}(YC[a-zA-Z0-9_\\-]{38})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  },
+  {
+    kind: "gitleaks:zendesk-secret-key",
+    re: new RegExp(
+      `[\\w.-]{0,50}?(?:zendesk)(?:[ \\t\\w.-]{0,20})[\\s'"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'"\\s=]{0,5}([a-z0-9]{40})(?:[\\x60'"\\s;]|\\\\[nr]|$)`,
+      "gi"
+    )
+  }
+];
+
+// src/secrets.ts
+var SECRET_PATTERNS = [
+  { kind: "aws-access-key-id", re: /AKIA[0-9A-Z]{16}/g },
+  { kind: "github-token", re: /(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,}/g },
+  { kind: "github-pat", re: /github_pat_[A-Za-z0-9_]{20,}/g },
+  // Anthropic base64url bodies include "_", and modern keys are sk-ant-api03-… .
+  { kind: "anthropic-api-key", re: /sk-ant-[A-Za-z0-9_-]{20,}/g },
+  // Modern OpenAI keys are prefixed (sk-proj-/sk-svcacct-/sk-admin-) with hyphens in the
+  // body; keep the legacy pure-alnum form too. Ordered after anthropic so sk-ant- wins.
+  {
+    kind: "openai-api-key",
+    re: /sk-(?:proj|svcacct|admin)-[A-Za-z0-9_-]{20,}|sk-[A-Za-z0-9]{20,}/g
+  },
+  { kind: "google-api-key", re: /AIza[0-9A-Za-z_-]{35}/g },
+  { kind: "google-oauth-token", re: /ya29\.[0-9A-Za-z_-]{20,}/g },
+  { kind: "slack-token", re: /xox[baprs]-[A-Za-z0-9-]{10,}/g },
+  {
+    kind: "slack-webhook",
+    re: /https:\/\/hooks\.slack\.com\/services\/T[A-Za-z0-9_]+\/B[A-Za-z0-9_]+\/[A-Za-z0-9_]+/g
+  },
+  // Stripe (sk_live_/pk_live_/rk_test_…), SendGrid, npm, Twilio SID/key — distinctive
+  // prefixes, low false-positive. Inspired by the SecretFinder pattern set.
+  { kind: "stripe-key", re: /(?:sk|rk|pk)_(?:live|test)_[0-9A-Za-z]{16,}/g },
+  { kind: "sendgrid-key", re: /SG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}/g },
+  { kind: "npm-token", re: /npm_[A-Za-z0-9]{36}/g },
+  { kind: "twilio-account-sid", re: /AC[0-9a-fA-F]{32}/g },
+  { kind: "twilio-api-key", re: /SK[0-9a-fA-F]{32}/g },
+  { kind: "private-key", re: /-----BEGIN [A-Z ]*PRIVATE KEY-----/g },
+  {
+    // A sensitive word as a whole `_`-delimited token inside an identifier (so
+    // aws_secret_access_key / OPENAI_API_KEY / DATABASE_PASSWORD match) followed by an
+    // assignment of an 8+ char value. Token-bounded to avoid prose ("the password is…")
+    // and look-alikes ("secretary = …", "tokenize the input").
+    kind: "generic-secret-assignment",
+    re: /(?<![A-Za-z0-9_])(?:[A-Za-z0-9]+_)*(?:password|passwd|secret|token|api[_-]?key|access[_-]?token|auth[_-]?token|client[_-]?secret|private[_-]?key|credentials?)(?:_[A-Za-z0-9]+)*\s*[:=]\s*["']?[^\s"']{8,}/gi
+  }
+];
+var ALL_PATTERNS = [
+  ...SECRET_PATTERNS,
+  ...GITLEAKS_PATTERNS
+];
+function maskPreview(match) {
+  if (match.length <= 6) return "*".repeat(match.length);
+  return `${match.slice(0, 4)}...${match.slice(-2)}`;
+}
+function shannonEntropy(s) {
+  if (s.length === 0) return 0;
+  const counts = /* @__PURE__ */ new Map();
+  for (const ch of s) counts.set(ch, (counts.get(ch) ?? 0) + 1);
+  let bits = 0;
+  for (const n of counts.values()) {
+    const p = n / s.length;
+    bits -= p * Math.log2(p);
+  }
+  return bits;
+}
+var ENTROPY_TOKEN_RES = [
+  /[A-Za-z0-9+/_-]{20,}={0,2}/g,
+  // base64 / base64url
+  /\b[0-9a-fA-F]{32,}\b/g
+  // long hex
+];
+var BASE64_ENTROPY_MIN = 4.5;
+var HEX_ENTROPY_MIN = 3;
+function isHex(s) {
+  return /^[0-9a-fA-F]+$/.test(s);
+}
+function findSecrets(text, opts = {}) {
+  const allow = opts.allowlist && opts.allowlist.length > 0 ? new Set(opts.allowlist) : null;
+  const byIndex = /* @__PURE__ */ new Map();
+  for (const { kind, re } of ALL_PATTERNS) {
+    re.lastIndex = 0;
+    let m;
+    while ((m = re.exec(text)) !== null) {
+      const value = m[0];
+      if (value.length === 0) {
+        re.lastIndex += 1;
+        continue;
+      }
+      if (allow?.has(value)) continue;
+      if (!byIndex.has(m.index)) {
+        byIndex.set(m.index, {
+          kind,
+          index: m.index,
+          length: value.length,
+          preview: maskPreview(value)
+        });
+      }
+    }
+  }
+  if (opts.detectEntropy) addEntropyMatches(text, byIndex, allow);
+  return [...byIndex.values()].sort((a, b) => a.index - b.index);
+}
+function addEntropyMatches(text, byIndex, allow) {
+  for (const re of ENTROPY_TOKEN_RES) {
+    re.lastIndex = 0;
+    let m;
+    while ((m = re.exec(text)) !== null) {
+      const value = m[0];
+      if (value.length === 0) {
+        re.lastIndex += 1;
+        continue;
+      }
+      if (byIndex.has(m.index) || allow?.has(value)) continue;
+      const min = isHex(value) ? HEX_ENTROPY_MIN : BASE64_ENTROPY_MIN;
+      if (shannonEntropy(value) < min) continue;
+      byIndex.set(m.index, {
+        kind: "high-entropy-string",
+        index: m.index,
+        length: value.length,
+        preview: maskPreview(value)
+      });
+    }
+  }
+}
+function hasSecrets(text, opts = {}) {
+  if (opts.detectEntropy || opts.allowlist && opts.allowlist.length > 0) {
+    return findSecrets(text, opts).length > 0;
+  }
+  for (const { re } of ALL_PATTERNS) {
+    re.lastIndex = 0;
+    if (re.test(text)) return true;
+  }
+  return false;
+}
+function redactSecrets(text, opts = {}) {
+  const matches = findSecrets(text, opts);
+  let out = text;
+  for (let i = matches.length - 1; i >= 0; i--) {
+    const { kind, index, length } = matches[i];
+    out = `${out.slice(0, index)}[REDACTED:${kind}]${out.slice(index + length)}`;
+  }
+  return out;
+}
+
+// src/index-db.ts
+import { promises as fs4 } from "fs";
+import path4 from "path";
+import Database from "better-sqlite3";
+var INDEX_DIR = "index";
+var DB_FILE = "commonwealth.db";
+function dbPath(brainDir) {
+  return path4.join(brainDir, INDEX_DIR, DB_FILE);
+}
+function toRow(note) {
+  return {
+    id: note.frontmatter.id,
+    kind: note.frontmatter.kind,
+    title: note.frontmatter.title,
+    tags: note.frontmatter.tags.join(" "),
+    body: note.body,
+    path: note.path,
+    source: note.frontmatter.source ?? ""
+  };
+}
+async function buildIndex(brainDir) {
+  await fs4.mkdir(path4.join(brainDir, INDEX_DIR), { recursive: true });
+  const notes = await listNotes(brainDir);
+  const db = new Database(dbPath(brainDir));
+  try {
+    const rebuild = db.transaction((rows) => {
+      db.exec("DROP TABLE IF EXISTS notes_fts;");
+      db.exec(
+        "CREATE VIRTUAL TABLE notes_fts USING fts5(id, kind, title, tags, body, path UNINDEXED, source UNINDEXED);"
+      );
+      const insert = db.prepare(
+        "INSERT INTO notes_fts (id, kind, title, tags, body, path, source) VALUES (@id, @kind, @title, @tags, @body, @path, @source);"
+      );
+      for (const row of rows) insert.run(row);
+    });
+    rebuild(notes.map(toRow));
+    return { indexed: notes.length };
+  } finally {
+    db.close();
+  }
+}
+function hasFtsTable(db) {
+  const row = db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'notes_fts'").get();
+  return row !== void 0;
+}
+function toMatchQuery(query) {
+  return query.split(/\s+/).map((t) => t.replace(/"/g, "")).filter((t) => t.length > 0).map((t) => `"${t}"`).join(" ");
+}
+async function search(brainDir, query, opts) {
+  try {
+    await fs4.access(dbPath(brainDir));
+  } catch {
+    await buildIndex(brainDir);
+  }
+  {
+    const probe = new Database(dbPath(brainDir), { readonly: true });
+    let healthy;
+    try {
+      healthy = hasFtsTable(probe);
+    } finally {
+      probe.close();
+    }
+    if (!healthy) await buildIndex(brainDir);
+  }
+  const match = toMatchQuery(query);
+  if (match === "") return [];
+  const limit = opts?.limit ?? 20;
+  const db = new Database(dbPath(brainDir), { readonly: true });
+  try {
+    const params = [match];
+    let sql = "SELECT id, kind, title, path, source, snippet(notes_fts, 4, '[', ']', '\u2026', 12) AS snippet, -bm25(notes_fts) AS score FROM notes_fts WHERE notes_fts MATCH ?";
+    if (opts?.kind) {
+      sql += " AND kind = ?";
+      params.push(opts.kind);
+    }
+    if (opts?.source) {
+      sql += " AND source = ?";
+      params.push(opts.source);
+    }
+    sql += " ORDER BY bm25(notes_fts) LIMIT ?";
+    params.push(limit);
+    const rows = db.prepare(sql).all(...params);
+    return rows.map((r) => ({
+      id: r.id,
+      kind: r.kind,
+      title: r.title,
+      path: r.path,
+      ...r.source ? { source: r.source } : {},
+      snippet: r.snippet,
+      score: r.score
+    }));
+  } finally {
+    db.close();
+  }
+}
+function inlineText(value) {
+  return value.replace(/[\r\n]+/g, " ").replace(/[[\]`]/g, (c) => `\\${c}`).replace(/\s+/g, " ").trim().slice(0, 200);
+}
+function isActiveWorkState(note) {
+  return note.frontmatter.kind === "work-state" && note.frontmatter.status !== "done";
+}
+function byId(a, b) {
+  return a.frontmatter.id < b.frontmatter.id ? -1 : a.frontmatter.id > b.frontmatter.id ? 1 : 0;
+}
+function byCreatedDesc(a, b) {
+  if (a.frontmatter.created !== b.frontmatter.created) {
+    return a.frontmatter.created < b.frontmatter.created ? 1 : -1;
+  }
+  return byId(a, b);
+}
+var UNATTRIBUTED = "(unattributed)";
+function sourceOf(note) {
+  return note.frontmatter.source && note.frontmatter.source.length > 0 ? note.frontmatter.source : UNATTRIBUTED;
+}
+function bySourceLabel(a, b) {
+  if (a === UNATTRIBUTED) return b === UNATTRIBUTED ? 0 : 1;
+  if (b === UNATTRIBUTED) return -1;
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+function commonwealthMarkdown(notes) {
+  const lines = [];
+  lines.push("# Commonwealth");
+  lines.push("");
+  lines.push("> Generated router. Do not edit by hand \u2014 regenerated from the note set (ADR-0003).");
+  lines.push("");
+  const bySource = /* @__PURE__ */ new Map();
+  for (const n of notes) {
+    const key = sourceOf(n);
+    (bySource.get(key) ?? bySource.set(key, []).get(key)).push(n);
+  }
+  const sources = [...bySource.keys()].sort(bySourceLabel);
+  if (sources.length === 0) {
+    lines.push("_No notes yet._");
+    lines.push("");
+    return lines.join("\n");
+  }
+  for (const source of sources) {
+    const group = bySource.get(source);
+    const active = group.filter(isActiveWorkState).sort(byId);
+    const decisions = group.filter((n) => n.frontmatter.kind === "decision").sort(byCreatedDesc);
+    lines.push(`## ${inlineText(source)}`);
+    lines.push("");
+    lines.push("**Active work-state**");
+    if (active.length === 0) {
+      lines.push("- _None._");
+    } else {
+      for (const n of active) {
+        const status = n.frontmatter.kind === "work-state" ? n.frontmatter.status : "";
+        lines.push(`- [${inlineText(n.frontmatter.title)}](${n.path}) \u2014 ${status}`);
+      }
+    }
+    lines.push("");
+    lines.push("**Recent decisions**");
+    if (decisions.length === 0) {
+      lines.push("- _None._");
+    } else {
+      for (const n of decisions) {
+        lines.push(`- [${inlineText(n.frontmatter.title)}](${n.path}) \u2014 ${n.frontmatter.created}`);
+      }
+    }
+    lines.push("");
+  }
+  return lines.join("\n");
+}
+function indexMarkdown(dirRel, notes) {
+  const sorted = [...notes].sort(byId);
+  const lines = [];
+  lines.push(`# ${dirRel}`);
+  lines.push("");
+  lines.push("> Generated index. Do not edit by hand \u2014 regenerated from the note set.");
+  lines.push("");
+  if (sorted.length === 0) {
+    lines.push("_None._");
+  } else {
+    for (const n of sorted) {
+      lines.push(`- [${inlineText(n.frontmatter.title)}](${path4.posix.basename(n.path)})`);
+    }
+  }
+  lines.push("");
+  return lines.join("\n");
+}
+async function regenerateDerived(brainDir) {
+  const notes = await listNotes(brainDir);
+  await fs4.writeFile(path4.join(brainDir, "COMMONWEALTH.md"), commonwealthMarkdown(notes), "utf8");
+  const byDir = /* @__PURE__ */ new Map();
+  for (const n of notes) {
+    const dir = path4.posix.dirname(n.path.split(path4.sep).join("/"));
+    (byDir.get(dir) ?? byDir.set(dir, []).get(dir)).push(n);
+  }
+  for (const [dir, group] of byDir) {
+    const abs = path4.join(brainDir, dir);
+    await fs4.mkdir(abs, { recursive: true });
+    await fs4.writeFile(path4.join(abs, "INDEX.md"), indexMarkdown(dir, group), "utf8");
+  }
+}
+
+// src/registry.ts
+import { promises as fs5 } from "fs";
+import os from "os";
+import path5 from "path";
+var MARKER_REL = path5.join(".commonwealth", "brain");
+var BRAIN_IDENTITY_REL = path5.join(".commonwealth", "schema-version");
+function expand(entry, base) {
+  const home = os.homedir();
+  if (entry === "~") return path5.resolve(home);
+  if (entry.startsWith("~/")) return path5.resolve(home, entry.slice(2));
+  return base ? path5.resolve(base, entry) : path5.resolve(entry);
+}
+function isUnder(child, parent) {
+  if (parent === path5.sep) return true;
+  return child === parent || child.startsWith(parent + path5.sep);
+}
+function* walkUp(startDir) {
+  let current = path5.resolve(startDir);
+  for (; ; ) {
+    yield current;
+    const parent = path5.dirname(current);
+    if (parent === current) return;
+    current = parent;
+  }
+}
+async function readFileOrNull(file) {
+  try {
+    return await fs5.readFile(file, "utf8");
+  } catch {
+    return null;
+  }
+}
+async function isFile(file) {
+  try {
+    const stat = await fs5.stat(file);
+    return stat.isFile();
+  } catch {
+    return false;
+  }
+}
+async function isDir(dir) {
+  try {
+    return (await fs5.stat(dir)).isDirectory();
+  } catch {
+    return false;
+  }
+}
+function resolveRegistryPath(explicit) {
+  if (explicit) return explicit;
+  if (process.env.COMMONWEALTH_REGISTRY) return process.env.COMMONWEALTH_REGISTRY;
+  if (process.env.COMMONWEALTH_CONFIG) {
+    return path5.join(path5.dirname(process.env.COMMONWEALTH_CONFIG), "registry.json");
+  }
+  return path5.join(os.homedir(), ".commonwealth", "registry.json");
+}
+async function readRegistryFile(registryPath) {
+  const raw = await readFileOrNull(registryPath);
+  if (raw === null) return { status: "missing" };
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return { status: "corrupt", raw };
+  }
+  const obj = typeof parsed === "object" && parsed !== null ? parsed : {};
+  const mappings = Array.isArray(obj.mappings) ? obj.mappings : [];
+  const clean = [];
+  for (const m of mappings) {
+    if (m && typeof m === "object" && typeof m.prefix === "string" && typeof m.brain === "string") {
+      clean.push({ prefix: m.prefix, brain: m.brain });
+    }
+  }
+  return { status: "ok", registry: { mappings: clean } };
+}
+async function loadRegistry(registryPath) {
+  const load = await readRegistryFile(registryPath);
+  return load.status === "ok" ? load.registry : null;
+}
+async function resolveBrainDir(startDir, opts = {}) {
+  const start = path5.resolve(startDir);
+  const registryPath = resolveRegistryPath(opts.registryPath);
+  for (const dir of walkUp(start)) {
+    const markerPath = path5.join(dir, MARKER_REL);
+    const raw = await readFileOrNull(markerPath);
+    if (raw !== null) {
+      const target = raw.trim();
+      if (target.length > 0) {
+        const resolved = expand(target, dir);
+        if (await isDir(resolved)) return resolved;
+      }
+    }
+  }
+  for (const dir of walkUp(start)) {
+    if (await isFile(path5.join(dir, BRAIN_IDENTITY_REL))) return dir;
+  }
+  const registry = await loadRegistry(registryPath);
+  if (registry) {
+    let bestBrain = null;
+    let bestLen = -1;
+    for (const mapping of registry.mappings) {
+      const prefix = expand(mapping.prefix);
+      if (isUnder(start, prefix) && prefix.length > bestLen) {
+        bestLen = prefix.length;
+        bestBrain = expand(mapping.brain);
+      }
+    }
+    if (bestBrain !== null) return bestBrain;
+  }
+  const env = opts.env ?? process.env.COMMONWEALTH_BRAIN_DIR;
+  if (env && env.length > 0) return path5.resolve(env);
+  return null;
+}
+async function setBrainMarker(projectDir, brainPath) {
+  const markerPath = path5.join(projectDir, MARKER_REL);
+  await fs5.mkdir(path5.dirname(markerPath), { recursive: true });
+  await fs5.writeFile(markerPath, `${brainPath}
+`, "utf8");
+}
+function defaultRegistryPath() {
+  return resolveRegistryPath();
+}
+function defaultBrainsDir() {
+  return path5.join(path5.dirname(defaultRegistryPath()), "brains");
+}
+async function addRegistryMapping(prefix, brain, registryPath = defaultRegistryPath()) {
+  const absPrefix = expand(prefix);
+  const absBrain = expand(brain);
+  const load = await readRegistryFile(registryPath);
+  if (load.status === "corrupt") {
+    const backup = `${registryPath}.corrupt-${Date.now()}`;
+    await fs5.rename(registryPath, backup).catch(() => fs5.writeFile(backup, load.raw, "utf8"));
+    throw new Error(
+      `Refusing to overwrite a corrupt registry at ${registryPath} (backed up to ${backup}). Fix or remove it, then retry.`
+    );
+  }
+  const registry = load.status === "ok" ? load.registry : { mappings: [] };
+  const existing = registry.mappings.find((m) => expand(m.prefix) === absPrefix);
+  let added = false;
+  let updated = false;
+  if (!existing) {
+    registry.mappings.push({ prefix: absPrefix, brain: absBrain });
+    added = true;
+  } else if (expand(existing.brain) !== absBrain) {
+    existing.prefix = absPrefix;
+    existing.brain = absBrain;
+    updated = true;
+  } else {
+    return { added, updated };
+  }
+  await fs5.mkdir(path5.dirname(registryPath), { recursive: true });
+  const tmp = `${registryPath}.${process.pid}.tmp`;
+  await fs5.writeFile(tmp, `${JSON.stringify(registry, null, 2)}
+`, "utf8");
+  await fs5.rename(tmp, registryPath);
+  return { added, updated };
+}
+async function linkBrain(name, brainDir, brainsDir = defaultBrainsDir()) {
+  const safe = path5.basename(name);
+  if (safe === "" || safe === "." || safe === "..") {
+    return { path: "", linked: false, skipped: "invalid name" };
+  }
+  const target = path5.resolve(brainDir);
+  const symlinkPath = path5.join(brainsDir, safe);
+  try {
+    await fs5.mkdir(brainsDir, { recursive: true });
+  } catch (err) {
+    const code = err.code;
+    return { path: symlinkPath, linked: false, skipped: code ?? "cannot create brains dir" };
+  }
+  let existingStat = null;
+  try {
+    existingStat = await fs5.lstat(symlinkPath);
+  } catch {
+    existingStat = null;
+  }
+  if (existingStat) {
+    if (existingStat.isSymbolicLink()) {
+      let resolved = null;
+      try {
+        resolved = path5.resolve(brainsDir, await fs5.readlink(symlinkPath));
+      } catch {
+        resolved = null;
+      }
+      if (resolved === target) return { path: symlinkPath, linked: true };
+      try {
+        await fs5.unlink(symlinkPath);
+      } catch (err) {
+        const code = err.code;
+        return { path: symlinkPath, linked: false, skipped: code ?? "symlink unsupported" };
+      }
+    } else {
+      return { path: symlinkPath, linked: false, skipped: "exists (not a symlink)" };
+    }
+  }
+  try {
+    await fs5.symlink(target, symlinkPath);
+  } catch (err) {
+    const code = err.code;
+    return { path: symlinkPath, linked: false, skipped: code ?? "symlink unsupported" };
+  }
+  return { path: symlinkPath, linked: true };
+}
+
+// src/source.ts
+import { execFile as execFile2 } from "child_process";
+import { existsSync as existsSync2 } from "fs";
+import path6 from "path";
+import { promisify as promisify2 } from "util";
+var pexec2 = promisify2(execFile2);
+async function resolveProjectSource(cwd) {
+  if (typeof cwd !== "string" || cwd.length === 0) return null;
+  const start = path6.resolve(cwd);
+  const root = findGitRoot(start);
+  if (root) {
+    const remote = await originUrl(root);
+    const slug = remote ? slugFromRemote(remote) : null;
+    return slug ?? path6.basename(root);
+  }
+  return path6.basename(start);
+}
+function findGitRoot(startDir) {
+  let dir = path6.resolve(startDir);
+  for (; ; ) {
+    if (existsSync2(path6.join(dir, ".git"))) return dir;
+    const parent = path6.dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+async function originUrl(root) {
+  try {
+    const { stdout } = await pexec2("git", ["-C", root, "config", "--get", "remote.origin.url"]);
+    const url = stdout.trim();
+    return url.length > 0 ? url : null;
+  } catch {
+    return null;
+  }
+}
+function slugFromRemote(remote) {
+  let s = remote.trim().replace(/\.git$/i, "");
+  s = s.replace(/^[a-z]+:\/\//i, "").replace(/^[^@]+@/, "");
+  s = s.replace(/^[^/:]+[:/]/, "");
+  const parts = s.split("/").filter((p) => p.length > 0);
+  if (parts.length === 0) return null;
+  return parts.slice(-2).join("/");
+}
+
+// src/health.ts
+var DEFAULT_STALE_AFTER_DAYS = 90;
+function daysBetween(now, then) {
+  const a = Date.parse(`${now}T00:00:00Z`);
+  const b = Date.parse(`${then}T00:00:00Z`);
+  if (Number.isNaN(a) || Number.isNaN(b)) return 0;
+  return Math.max(0, Math.floor((a - b) / 864e5));
+}
+function isContradicted(note) {
+  return note.frontmatter.tags.some((t) => t.toLowerCase() === "contradicted");
+}
+function brainHealth(notes, opts = {}) {
+  const staleAfterDays = opts.staleAfterDays ?? DEFAULT_STALE_AFTER_DAYS;
+  const now = opts.now ?? today();
+  const referenced = /* @__PURE__ */ new Set();
+  for (const n of notes) {
+    const fm = n.frontmatter;
+    const refs = [
+      ...fm.relates,
+      ...fm.kind === "memory" ? fm.sources : [],
+      ...fm.kind === "decision" ? fm.supersedes : [],
+      ...fm.kind === "memory" || fm.kind === "decision" ? [fm.superseded_by].filter((v) => typeof v === "string") : []
+    ];
+    for (const r of refs) referenced.add(r.replace(/^\[\[|\]\]$/g, ""));
+  }
+  const stale = [];
+  const unverified = [];
+  const contradicted = [];
+  const orphaned = [];
+  for (const n of notes) {
+    const fm = n.frontmatter;
+    const id = fm.id;
+    if (fm.kind === "memory") {
+      if (fm.status === "stale") {
+        stale.push(id);
+      } else if (fm.status === "active") {
+        const lastTouch = fm.verified ?? fm.updated ?? fm.created;
+        if (daysBetween(now, lastTouch) > staleAfterDays) stale.push(id);
+        if (!fm.verified) unverified.push(id);
+      }
+    }
+    if (isContradicted(n)) contradicted.push(id);
+    if (!referenced.has(id)) orphaned.push(id);
+  }
+  const serious = /* @__PURE__ */ new Set([...stale, ...contradicted]);
+  const soft = new Set([...unverified, ...orphaned].filter((id) => !serious.has(id)));
+  const total = notes.length;
+  const score = total === 0 ? 100 : Math.max(
+    0,
+    Math.min(100, Math.round(100 * (1 - (serious.size + 0.5 * soft.size) / total)))
+  );
+  const bucket = (ids) => ({ count: ids.length, ids: ids.sort() });
+  return {
+    total,
+    stale: bucket(stale),
+    unverified: bucket(unverified),
+    contradicted: bucket(contradicted),
+    orphaned: bucket(orphaned),
+    score
+  };
+}
+async function computeBrainHealth(brainDir, opts = {}) {
+  return brainHealth(await listNotes(brainDir), opts);
+}
+
+// src/lock.ts
+import { promises as fs6 } from "fs";
+import path7 from "path";
+var LOCK_REL = path7.join(".commonwealth", "sync.lock");
+function lockPath(brainDir) {
+  return path7.join(brainDir, LOCK_REL);
+}
+function isAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function readOwner(file) {
+  try {
+    const pid = Number.parseInt((await fs6.readFile(file, "utf8")).trim(), 10);
+    return Number.isFinite(pid) ? pid : null;
+  } catch {
+    return null;
+  }
+}
+async function acquireSyncLock(brainDir) {
+  const file = lockPath(brainDir);
+  await fs6.mkdir(path7.dirname(file), { recursive: true });
+  for (let attempt = 0; attempt < 2; attempt++) {
+    try {
+      const fh = await fs6.open(file, "wx");
+      try {
+        await fh.write(`${process.pid}
+`);
+      } finally {
+        await fh.close();
+      }
+      return async () => {
+        await fs6.rm(file, { force: true });
+      };
+    } catch (err) {
+      if (err.code !== "EEXIST") throw err;
+      const owner = await readOwner(file);
+      if (owner !== null && isAlive(owner)) return null;
+      await fs6.rm(file, { force: true });
+    }
+  }
+  return null;
+}
+export {
+  BRAIN_KIND_DIRS,
+  DEFAULT_STALE_AFTER_DAYS,
+  DecisionFrontmatter,
+  FEATURE_FLAGS,
+  Frontmatter,
+  IsoDate,
+  KIND_DIR,
+  MemoryFrontmatter,
+  NOTE_KINDS,
+  PersonFrontmatter,
+  SCHEMA_VERSION,
+  SECRET_PATTERNS,
+  WorkStateFrontmatter,
+  acquireSyncLock,
+  addRegistryMapping,
+  brainConfigPath,
+  brainHealth,
+  buildIndex,
+  computeBrainHealth,
+  defaultBrainConfig,
+  defaultBrainsDir,
+  defaultRegistryPath,
+  findSecrets,
+  hasSecrets,
+  initBrain,
+  isFeatureEnabled,
+  linkBrain,
+  listNotes,
+  loadBrainConfig,
+  makeNoteId,
+  overwriteNote,
+  parseNote,
+  pathForNote,
+  readNote,
+  redactSecrets,
+  regenerateDerived,
+  resolveBrainDir,
+  resolveProjectSource,
+  resolveWithinBrain,
+  saveBrainConfig,
+  scanOptions,
+  search,
+  serializeNote,
+  setBrainMarker,
+  setFeature,
+  shannonEntropy,
+  shortId,
+  slugFromRemote,
+  slugify,
+  sourceSegment,
+  supersedeNote,
+  today,
+  writeNote
+};
+//# sourceMappingURL=index.js.map