@codraoss/core 0.9.4

package/dist/chunk-V3RF6GQW.js

@@ -0,0 +1,137 @@
+// src/prompts/verify.ts
+import { z } from "zod";
+import { jsonrepair } from "jsonrepair";
+var verifyResultSchema = z.object({
+  results: z.array(
+    z.object({
+      index: z.number().int(),
+      reason: z.string().optional(),
+      // decidable" -- only an explicit `false` costs a finding. See the note on the prompt below.
+      decidable: z.boolean().optional(),
+      verdict: z.enum(["keep", "drop"]),
+      confidence: z.number().min(0).max(1).optional()
+    })
+  ).default([])
+});
+var VERIFY_RESPONSE_SCHEMA = {
+  name: "codra_verify_findings",
+  schema: {
+    type: "object",
+    additionalProperties: false,
+    required: ["results"],
+    properties: {
+      results: {
+        type: "array",
+        items: {
+          type: "object",
+          additionalProperties: false,
+          required: ["index", "reason", "decidable", "verdict"],
+          properties: {
+            index: { type: "integer", minimum: 0 },
+            reason: { type: "string", maxLength: 300 },
+            decidable: { type: "boolean" },
+            verdict: { type: "string", enum: ["keep", "drop"] },
+            confidence: { type: "number", minimum: 0, maximum: 1 }
+          }
+        }
+      }
+    }
+  }
+};
+var VERIFY_SYSTEM_PROMPT = `You are a meticulous senior engineer checking whether each candidate code-review finding is actually supported by the code it points at.
+
+For EACH finding you are given the claim and a SHORT WINDOW of diff context around the line it was anchored to. That window is all you have: you cannot see the rest of the file, any other file, the project's dependencies and their versions, its build target, or its runtime.
+
+Answer two questions per finding, in this order.
+
+1. "decidable": can this claim be settled from the window you were given?
+   - true  - the window contains everything needed to say whether the claim holds.
+   - false - settling it would need something outside the window: which files import this one, what a function defined elsewhere does, which version of a dependency is installed, what engine or renderer the code runs on, or how a caller uses the result.
+   Watch for claims that assert a CONSEQUENCE somewhere you cannot see: "this breaks importers", "this throws on older runtimes", "this fails during server rendering", "the caller will not await this". The anchored line can be exactly as quoted and the consequence still be unverifiable - confirming that the quote is real is NOT confirming the claim.
+   When "decidable" is false, say in "reason" what you would have to look at, e.g. "would need the importers of this module".
+
+   Two rules, because both have been got wrong on real reviews:
+
+   a) A claim of the form "if X() fails / rejects / throws, this is unhandled" is NOT decidable unless the
+      BODY of X is inside your window. A function whose body you cannot see may well handle its own
+      errors, in which case there is nothing to report. Seeing the CALL is not seeing the body. Mark it
+      not decidable and say you would need that function's implementation.
+
+   b) Read the diff markers before you agree that something was removed or changed. A line prefixed "-"
+      is the OLD code and a line prefixed "+" is the NEW code. A claim that says "X was replaced by Y" is
+      false if the diff shows Y being replaced by X, and a claim that a safeguard was "removed" is false
+      if the "+" line still carries an equivalent one under a different name. State the direction in your
+      reason: "the + line adds strict validation, so the claim is backwards".
+
+2. "verdict":
+   - "keep": the code in the window genuinely exhibits the problem the claim describes.
+   - "drop": the claim is not supported by the code shown - it describes something that isn't there, it is speculative, it is a subjective style preference, or it is not decidable from this window.
+   A claim you marked not decidable is always a "drop".
+
+Judge the CLAIM against the CODE. Do not defer to the claim's confidence or phrasing; a well-written claim about code that doesn't do what it says is still a drop.
+Be strict: when in doubt, "drop". It is better to drop a borderline finding than to keep a wrong one.
+
+Output MUST be valid JSON, exactly one object, no prose before or after:
+{
+  "results": [
+    { "index": <number>, "reason": "<why, and if not decidable what you would need to see>", "decidable": true | false, "verdict": "keep" | "drop", "confidence": <float 0.0-1.0> }
+  ]
+}
+Include exactly one result object for every finding index provided, and use the same index numbers you were given.`;
+function buildVerifyPrompt(candidates) {
+  const blocks = candidates.map((c) => {
+    const location = c.line != null ? `${c.path}:${c.line}` : c.path;
+    return [
+      `### Finding index ${c.index}`,
+      `Location: ${location}`,
+      `Title: ${c.title}`,
+      `Claim: ${c.body}`,
+      ...c.evidence ? [`Code the claim cites: ${c.evidence}`] : [],
+      "Relevant diff:",
+      c.snippet || "(no diff context available for this location)"
+    ].join("\n");
+  });
+  return [
+    "Validate each finding below against its diff context. Return a verdict for every index.",
+    "",
+    blocks.join("\n\n")
+  ].join("\n");
+}
+function renderDiffSnippet(file, line, radius = 12) {
+  if (!file) return "";
+  const flat = file.hunks.flatMap((hunk) => hunk.lines);
+  if (flat.length === 0) return "";
+  if (line == null) return "";
+  const byNewLine = flat.findIndex((l) => l.newLineNumber === line);
+  const anchor = byNewLine !== -1 ? byNewLine : flat.findIndex((l) => l.oldLineNumber === line);
+  if (anchor === -1) return "";
+  const start = Math.max(0, anchor - radius);
+  const end = Math.min(flat.length, anchor + radius + 1);
+  return flat.slice(start, end).map((l) => {
+    const prefix = l.kind === "add" ? "+" : l.kind === "del" ? "-" : " ";
+    const gutter = String(l.newLineNumber ?? l.oldLineNumber ?? "").padStart(4, " ");
+    return `${gutter} ${prefix}${l.content}`;
+  }).join("\n");
+}
+function parseVerifyResponse(raw) {
+  const trimmed = raw.trim();
+  const start = trimmed.indexOf("{");
+  const end = trimmed.lastIndexOf("}");
+  const candidate = start !== -1 && end !== -1 && end > start ? trimmed.slice(start, end + 1) : trimmed;
+  let json;
+  try {
+    json = JSON.parse(candidate);
+  } catch {
+    json = JSON.parse(jsonrepair(candidate));
+  }
+  return verifyResultSchema.parse(json).results;
+}
+
+export {
+  VERIFY_RESPONSE_SCHEMA,
+  VERIFY_SYSTEM_PROMPT,
+  buildVerifyPrompt,
+  renderDiffSnippet,
+  parseVerifyResponse
+};
+//# sourceMappingURL=chunk-V3RF6GQW.js.map

package/dist/chunk-V3RF6GQW.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/prompts/verify.ts"],"sourcesContent":["import { z } from 'zod';\r\nimport { jsonrepair } from 'jsonrepair';\r\nimport type { FileDiff } from '../diff';\r\n\r\nexport type VerifyCandidate = {\r\n  index: number;\r\n  path: string;\r\n  line: number | null;\r\n  title: string;\r\n  body: string;\r\n  snippet: string;\r\n  evidence?: string | null;\r\n};\r\n\r\nconst verifyResultSchema = z.object({\r\n  results: z\r\n    .array(\r\n      z.object({\r\n        index: z.number().int(),\r\n        reason: z.string().optional(),\r\n        // decidable\" -- only an explicit `false` costs a finding. See the note on the prompt below.\r\n        decidable: z.boolean().optional(),\r\n        verdict: z.enum(['keep', 'drop']),\r\n        confidence: z.number().min(0).max(1).optional(),\r\n      }),\r\n    )\r\n    .default([]),\r\n});\r\n\r\nexport type VerifyResult = z.infer<typeof verifyResultSchema>['results'][number];\r\n\r\nexport const VERIFY_RESPONSE_SCHEMA = {\r\n  name: 'codra_verify_findings',\r\n  schema: {\r\n    type: 'object',\r\n    additionalProperties: false,\r\n    required: ['results'],\r\n    properties: {\r\n      results: {\r\n        type: 'array',\r\n        items: {\r\n          type: 'object',\r\n          additionalProperties: false,\r\n          required: ['index', 'reason', 'decidable', 'verdict'],\r\n          properties: {\r\n            index: { type: 'integer', minimum: 0 },\r\n            reason: { type: 'string', maxLength: 300 },\r\n            decidable: { type: 'boolean' },\r\n            verdict: { type: 'string', enum: ['keep', 'drop'] },\r\n            confidence: { type: 'number', minimum: 0, maximum: 1 },\r\n          },\r\n        },\r\n      },\r\n    },\r\n  },\r\n} as const;\r\n\r\nexport const VERIFY_SYSTEM_PROMPT = `You are a meticulous senior engineer checking whether each candidate code-review finding is actually supported by the code it points at.\r\n\r\nFor EACH finding you are given the claim and a SHORT WINDOW of diff context around the line it was anchored to. That window is all you have: you cannot see the rest of the file, any other file, the project's dependencies and their versions, its build target, or its runtime.\r\n\r\nAnswer two questions per finding, in this order.\r\n\r\n1. \"decidable\": can this claim be settled from the window you were given?\r\n   - true  - the window contains everything needed to say whether the claim holds.\r\n   - false - settling it would need something outside the window: which files import this one, what a function defined elsewhere does, which version of a dependency is installed, what engine or renderer the code runs on, or how a caller uses the result.\r\n   Watch for claims that assert a CONSEQUENCE somewhere you cannot see: \"this breaks importers\", \"this throws on older runtimes\", \"this fails during server rendering\", \"the caller will not await this\". The anchored line can be exactly as quoted and the consequence still be unverifiable - confirming that the quote is real is NOT confirming the claim.\r\n   When \"decidable\" is false, say in \"reason\" what you would have to look at, e.g. \"would need the importers of this module\".\r\n\r\n   Two rules, because both have been got wrong on real reviews:\r\n\r\n   a) A claim of the form \"if X() fails / rejects / throws, this is unhandled\" is NOT decidable unless the\r\n      BODY of X is inside your window. A function whose body you cannot see may well handle its own\r\n      errors, in which case there is nothing to report. Seeing the CALL is not seeing the body. Mark it\r\n      not decidable and say you would need that function's implementation.\r\n\r\n   b) Read the diff markers before you agree that something was removed or changed. A line prefixed \"-\"\r\n      is the OLD code and a line prefixed \"+\" is the NEW code. A claim that says \"X was replaced by Y\" is\r\n      false if the diff shows Y being replaced by X, and a claim that a safeguard was \"removed\" is false\r\n      if the \"+\" line still carries an equivalent one under a different name. State the direction in your\r\n      reason: \"the + line adds strict validation, so the claim is backwards\".\r\n\r\n2. \"verdict\":\r\n   - \"keep\": the code in the window genuinely exhibits the problem the claim describes.\r\n   - \"drop\": the claim is not supported by the code shown - it describes something that isn't there, it is speculative, it is a subjective style preference, or it is not decidable from this window.\r\n   A claim you marked not decidable is always a \"drop\".\r\n\r\nJudge the CLAIM against the CODE. Do not defer to the claim's confidence or phrasing; a well-written claim about code that doesn't do what it says is still a drop.\r\nBe strict: when in doubt, \"drop\". It is better to drop a borderline finding than to keep a wrong one.\r\n\r\nOutput MUST be valid JSON, exactly one object, no prose before or after:\r\n{\r\n  \"results\": [\r\n    { \"index\": <number>, \"reason\": \"<why, and if not decidable what you would need to see>\", \"decidable\": true | false, \"verdict\": \"keep\" | \"drop\", \"confidence\": <float 0.0-1.0> }\r\n  ]\r\n}\r\nInclude exactly one result object for every finding index provided, and use the same index numbers you were given.`;\r\n\r\nexport function buildVerifyPrompt(candidates: VerifyCandidate[]): string {\r\n  const blocks = candidates.map((c) => {\r\n    const location = c.line != null ? `${c.path}:${c.line}` : c.path;\r\n    return [\r\n      `### Finding index ${c.index}`,\r\n      `Location: ${location}`,\r\n      `Title: ${c.title}`,\r\n      `Claim: ${c.body}`,\r\n      ...(c.evidence ? [`Code the claim cites: ${c.evidence}`] : []),\r\n      'Relevant diff:',\r\n      c.snippet || '(no diff context available for this location)',\r\n    ].join('\\n');\r\n  });\r\n\r\n  return [\r\n    'Validate each finding below against its diff context. Return a verdict for every index.',\r\n    '',\r\n    blocks.join('\\n\\n'),\r\n  ].join('\\n');\r\n}\r\n\r\nexport function renderDiffSnippet(file: FileDiff | undefined, line: number | undefined, radius = 12): string {\r\n  if (!file) return '';\r\n  const flat = file.hunks.flatMap((hunk) => hunk.lines);\r\n  if (flat.length === 0) return '';\r\n\r\n  if (line == null) return '';\r\n\r\n  const byNewLine = flat.findIndex((l) => l.newLineNumber === line);\r\n  const anchor = byNewLine !== -1 ? byNewLine : flat.findIndex((l) => l.oldLineNumber === line);\r\n  if (anchor === -1) return '';\r\n\r\n  const start = Math.max(0, anchor - radius);\r\n  const end = Math.min(flat.length, anchor + radius + 1);\r\n\r\n  return flat\r\n    .slice(start, end)\r\n    .map((l) => {\r\n      const prefix = l.kind === 'add' ? '+' : l.kind === 'del' ? '-' : ' ';\r\n      const gutter = String(l.newLineNumber ?? l.oldLineNumber ?? '').padStart(4, ' ');\r\n      return `${gutter} ${prefix}${l.content}`;\r\n    })\r\n    .join('\\n');\r\n}\r\n\r\nexport function parseVerifyResponse(raw: string): VerifyResult[] {\r\n  const trimmed = raw.trim();\r\n  const start = trimmed.indexOf('{');\r\n  const end = trimmed.lastIndexOf('}');\r\n  const candidate = start !== -1 && end !== -1 && end > start ? trimmed.slice(start, end + 1) : trimmed;\r\n\r\n  let json: unknown;\r\n  try {\r\n    json = JSON.parse(candidate);\r\n  } catch {\r\n    json = JSON.parse(jsonrepair(candidate));\r\n  }\r\n\r\n  return verifyResultSchema.parse(json).results;\r\n}\r\n"],"mappings":";AAAA,SAAS,SAAS;AAClB,SAAS,kBAAkB;AAa3B,IAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,SAAS,EACN;AAAA,IACC,EAAE,OAAO;AAAA,MACP,OAAO,EAAE,OAAO,EAAE,IAAI;AAAA,MACtB,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,MAE5B,WAAW,EAAE,QAAQ,EAAE,SAAS;AAAA,MAChC,SAAS,EAAE,KAAK,CAAC,QAAQ,MAAM,CAAC;AAAA,MAChC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,IAChD,CAAC;AAAA,EACH,EACC,QAAQ,CAAC,CAAC;AACf,CAAC;AAIM,IAAM,yBAAyB;AAAA,EACpC,MAAM;AAAA,EACN,QAAQ;AAAA,IACN,MAAM;AAAA,IACN,sBAAsB;AAAA,IACtB,UAAU,CAAC,SAAS;AAAA,IACpB,YAAY;AAAA,MACV,SAAS;AAAA,QACP,MAAM;AAAA,QACN,OAAO;AAAA,UACL,MAAM;AAAA,UACN,sBAAsB;AAAA,UACtB,UAAU,CAAC,SAAS,UAAU,aAAa,SAAS;AAAA,UACpD,YAAY;AAAA,YACV,OAAO,EAAE,MAAM,WAAW,SAAS,EAAE;AAAA,YACrC,QAAQ,EAAE,MAAM,UAAU,WAAW,IAAI;AAAA,YACzC,WAAW,EAAE,MAAM,UAAU;AAAA,YAC7B,SAAS,EAAE,MAAM,UAAU,MAAM,CAAC,QAAQ,MAAM,EAAE;AAAA,YAClD,YAAY,EAAE,MAAM,UAAU,SAAS,GAAG,SAAS,EAAE;AAAA,UACvD;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEO,IAAM,uBAAuB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAyC7B,SAAS,kBAAkB,YAAuC;AACvE,QAAM,SAAS,WAAW,IAAI,CAAC,MAAM;AACnC,UAAM,WAAW,EAAE,QAAQ,OAAO,GAAG,EAAE,IAAI,IAAI,EAAE,IAAI,KAAK,EAAE;AAC5D,WAAO;AAAA,MACL,qBAAqB,EAAE,KAAK;AAAA,MAC5B,aAAa,QAAQ;AAAA,MACrB,UAAU,EAAE,KAAK;AAAA,MACjB,UAAU,EAAE,IAAI;AAAA,MAChB,GAAI,EAAE,WAAW,CAAC,yBAAyB,EAAE,QAAQ,EAAE,IAAI,CAAC;AAAA,MAC5D;AAAA,MACA,EAAE,WAAW;AAAA,IACf,EAAE,KAAK,IAAI;AAAA,EACb,CAAC;AAED,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,OAAO,KAAK,MAAM;AAAA,EACpB,EAAE,KAAK,IAAI;AACb;AAEO,SAAS,kBAAkB,MAA4B,MAA0B,SAAS,IAAY;AAC3G,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,OAAO,KAAK,MAAM,QAAQ,CAAC,SAAS,KAAK,KAAK;AACpD,MAAI,KAAK,WAAW,EAAG,QAAO;AAE9B,MAAI,QAAQ,KAAM,QAAO;AAEzB,QAAM,YAAY,KAAK,UAAU,CAAC,MAAM,EAAE,kBAAkB,IAAI;AAChE,QAAM,SAAS,cAAc,KAAK,YAAY,KAAK,UAAU,CAAC,MAAM,EAAE,kBAAkB,IAAI;AAC5F,MAAI,WAAW,GAAI,QAAO;AAE1B,QAAM,QAAQ,KAAK,IAAI,GAAG,SAAS,MAAM;AACzC,QAAM,MAAM,KAAK,IAAI,KAAK,QAAQ,SAAS,SAAS,CAAC;AAErD,SAAO,KACJ,MAAM,OAAO,GAAG,EAChB,IAAI,CAAC,MAAM;AACV,UAAM,SAAS,EAAE,SAAS,QAAQ,MAAM,EAAE,SAAS,QAAQ,MAAM;AACjE,UAAM,SAAS,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,EAAE,SAAS,GAAG,GAAG;AAC/E,WAAO,GAAG,MAAM,IAAI,MAAM,GAAG,EAAE,OAAO;AAAA,EACxC,CAAC,EACA,KAAK,IAAI;AACd;AAEO,SAAS,oBAAoB,KAA6B;AAC/D,QAAM,UAAU,IAAI,KAAK;AACzB,QAAM,QAAQ,QAAQ,QAAQ,GAAG;AACjC,QAAM,MAAM,QAAQ,YAAY,GAAG;AACnC,QAAM,YAAY,UAAU,MAAM,QAAQ,MAAM,MAAM,QAAQ,QAAQ,MAAM,OAAO,MAAM,CAAC,IAAI;AAE9F,MAAI;AACJ,MAAI;AACF,WAAO,KAAK,MAAM,SAAS;AAAA,EAC7B,QAAQ;AACN,WAAO,KAAK,MAAM,WAAW,SAAS,CAAC;AAAA,EACzC;AAEA,SAAO,mBAAmB,MAAM,IAAI,EAAE;AACxC;","names":[]}

package/dist/chunk-WSK45HW4.js

@@ -0,0 +1,79 @@
+// src/logger.ts
+var SENSITIVE_KEYS = [
+  "api_key",
+  "api-key",
+  "apikey",
+  "secret",
+  "password",
+  "token",
+  "private_key",
+  "private-key",
+  "database_url",
+  "authorization",
+  "session",
+  "cookie"
+];
+var JWT = /\beyJ[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]*/g;
+var BEARER = /\b(Bearer|Basic)\s+[A-Za-z0-9._~+/=-]{8,}/gi;
+function scrubString(value) {
+  return value.replace(JWT, "[REDACTED_JWT]").replace(BEARER, (m) => `${m.split(/\s+/)[0]} [REDACTED]`);
+}
+function redact(obj) {
+  if (obj === null || obj === void 0) return obj;
+  if (typeof obj !== "object") {
+    return typeof obj === "string" ? scrubString(obj) : obj;
+  }
+  if (Array.isArray(obj)) return obj.map(redact);
+  if (obj instanceof Error) {
+    return {
+      name: obj.name,
+      message: scrubString(obj.message),
+      ...obj.stack ? { stack: scrubString(obj.stack) } : {}
+    };
+  }
+  const redacted = {};
+  for (const [key, value] of Object.entries(obj)) {
+    const lowerKey = key.toLowerCase();
+    if (SENSITIVE_KEYS.some((sk) => lowerKey.includes(sk))) {
+      redacted[key] = "[REDACTED]";
+    } else {
+      redacted[key] = redact(value);
+    }
+  }
+  return redacted;
+}
+function formatLogRecord(level, message, contexts, data) {
+  return {
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    level,
+    message: scrubString(message),
+    ...contexts.reduce((merged, context) => Object.assign(merged, redact(context)), {}),
+    ...data ? { data: redact(data) } : {}
+  };
+}
+var consoleLogger = {
+  info: (message, data) => console.log(JSON.stringify(formatLogRecord("info", message, [], data))),
+  warn: (message, data) => console.warn(JSON.stringify(formatLogRecord("warn", message, [], data))),
+  error: (message, data) => console.error(JSON.stringify(formatLogRecord("error", message, [], data))),
+  debug: (message, data) => console.log(JSON.stringify(formatLogRecord("debug", message, [], data)))
+};
+var sink = consoleLogger;
+function setLoggerSink(next) {
+  sink = next;
+}
+var logger = {
+  info: (message, data) => sink.info(message, data),
+  warn: (message, data) => sink.warn(message, data),
+  error: (message, data) => sink.error(message, data),
+  debug: (message, data) => sink.debug(message, data)
+};
+
+export {
+  scrubString,
+  redact,
+  formatLogRecord,
+  consoleLogger,
+  setLoggerSink,
+  logger
+};
+//# sourceMappingURL=chunk-WSK45HW4.js.map

package/dist/chunk-WSK45HW4.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/logger.ts"],"sourcesContent":["\r\n/**\r\n * The logging port. A correct implementation must:\r\n *  - never throw, for any input, including circular objects (callers log on failure paths, so a\r\n *    throwing logger converts a handled error into an unhandled one);\r\n *  - never block the caller on I/O;\r\n *  - scrub secrets before emitting, using `scrubString`/`redact` below rather than its own rules.\r\n * Ordering between calls is not guaranteed and callers must not rely on it.\r\n */\r\nexport interface Logger {\r\n  info(message: string, data?: unknown): void;\r\n  warn(message: string, data?: unknown): void;\r\n  error(message: string, data?: unknown): void;\r\n  debug(message: string, data?: unknown): void;\r\n}\r\n\r\nconst SENSITIVE_KEYS = [\r\n  'api_key',\r\n  'api-key',\r\n  'apikey',\r\n  'secret',\r\n  'password',\r\n  'token',\r\n  'private_key',\r\n  'private-key',\r\n  'database_url',\r\n  'authorization',\r\n  'session',\r\n  'cookie',\r\n];\r\n\r\nconst JWT = /\\beyJ[A-Za-z0-9_-]{4,}\\.[A-Za-z0-9_-]{4,}\\.[A-Za-z0-9_-]*/g;\r\nconst BEARER = /\\b(Bearer|Basic)\\s+[A-Za-z0-9._~+/=-]{8,}/gi;\r\n\r\nexport function scrubString(value: string): string {\r\n  return value.replace(JWT, '[REDACTED_JWT]').replace(BEARER, (m) => `${m.split(/\\s+/)[0]} [REDACTED]`);\r\n}\r\n\r\nexport function redact(obj: any): any {\r\n  if (obj === null || obj === undefined) return obj;\r\n  if (typeof obj !== 'object') {\r\n    return typeof obj === 'string' ? scrubString(obj) : obj;\r\n  }\r\n  if (Array.isArray(obj)) return obj.map(redact);\r\n  if (obj instanceof Error) {\r\n    return {\r\n      name: obj.name,\r\n      message: scrubString(obj.message),\r\n      ...(obj.stack ? { stack: scrubString(obj.stack) } : {}),\r\n    };\r\n  }\r\n\r\n  const redacted: any = {};\r\n  for (const [key, value] of Object.entries(obj)) {\r\n    const lowerKey = key.toLowerCase();\r\n    if (SENSITIVE_KEYS.some((sk) => lowerKey.includes(sk))) {\r\n      redacted[key] = '[REDACTED]';\r\n    } else {\r\n      redacted[key] = redact(value);\r\n    }\r\n  }\r\n  return redacted;\r\n}\r\n\r\nexport function formatLogRecord(\r\n  level: string,\r\n  message: string,\r\n  contexts: Array<Record<string, any>>,\r\n  data?: any,\r\n): Record<string, unknown> {\r\n  return {\r\n    timestamp: new Date().toISOString(),\r\n    level,\r\n    message: scrubString(message),\r\n    ...contexts.reduce<Record<string, unknown>>((merged, context) => Object.assign(merged, redact(context)), {}),\r\n    ...(data ? { data: redact(data) } : {}),\r\n  };\r\n}\r\n\r\nexport const consoleLogger: Logger = {\r\n  info: (message, data) => console.log(JSON.stringify(formatLogRecord('info', message, [], data))),\r\n  warn: (message, data) => console.warn(JSON.stringify(formatLogRecord('warn', message, [], data))),\r\n  error: (message, data) => console.error(JSON.stringify(formatLogRecord('error', message, [], data))),\r\n  debug: (message, data) => console.log(JSON.stringify(formatLogRecord('debug', message, [], data))),\r\n};\r\n\r\nlet sink: Logger = consoleLogger;\r\n\r\n/**\r\n * Installs the host's logger. Called once at import scope by src/server/core/logger.ts, and by tests\r\n * that want to capture output.\r\n *\r\n * This is the one piece of module-level mutable state in this package, and it is deliberate: `logger`\r\n * below is used at import scope by fifteen modules here, several of them (model-output/*, rules/*,\r\n * finding-gates.ts) pure functions with no runtime parameter to hang a port off. Threading a Logger\r\n * argument through all of them would be by far the largest and least mechanical part of the\r\n * extraction, for no behavioural gain.\r\n */\r\nexport function setLoggerSink(next: Logger) {\r\n  sink = next;\r\n}\r\n\r\nexport const logger: Logger = {\r\n  info: (message, data) => sink.info(message, data),\r\n  warn: (message, data) => sink.warn(message, data),\r\n  error: (message, data) => sink.error(message, data),\r\n  debug: (message, data) => sink.debug(message, data),\r\n};\r\n"],"mappings":";AAgBA,IAAM,iBAAiB;AAAA,EACrB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,MAAM;AACZ,IAAM,SAAS;AAER,SAAS,YAAY,OAAuB;AACjD,SAAO,MAAM,QAAQ,KAAK,gBAAgB,EAAE,QAAQ,QAAQ,CAAC,MAAM,GAAG,EAAE,MAAM,KAAK,EAAE,CAAC,CAAC,aAAa;AACtG;AAEO,SAAS,OAAO,KAAe;AACpC,MAAI,QAAQ,QAAQ,QAAQ,OAAW,QAAO;AAC9C,MAAI,OAAO,QAAQ,UAAU;AAC3B,WAAO,OAAO,QAAQ,WAAW,YAAY,GAAG,IAAI;AAAA,EACtD;AACA,MAAI,MAAM,QAAQ,GAAG,EAAG,QAAO,IAAI,IAAI,MAAM;AAC7C,MAAI,eAAe,OAAO;AACxB,WAAO;AAAA,MACL,MAAM,IAAI;AAAA,MACV,SAAS,YAAY,IAAI,OAAO;AAAA,MAChC,GAAI,IAAI,QAAQ,EAAE,OAAO,YAAY,IAAI,KAAK,EAAE,IAAI,CAAC;AAAA,IACvD;AAAA,EACF;AAEA,QAAM,WAAgB,CAAC;AACvB,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,GAAG,GAAG;AAC9C,UAAM,WAAW,IAAI,YAAY;AACjC,QAAI,eAAe,KAAK,CAAC,OAAO,SAAS,SAAS,EAAE,CAAC,GAAG;AACtD,eAAS,GAAG,IAAI;AAAA,IAClB,OAAO;AACL,eAAS,GAAG,IAAI,OAAO,KAAK;AAAA,IAC9B;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,gBACd,OACA,SACA,UACA,MACyB;AACzB,SAAO;AAAA,IACL,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IAClC;AAAA,IACA,SAAS,YAAY,OAAO;AAAA,IAC5B,GAAG,SAAS,OAAgC,CAAC,QAAQ,YAAY,OAAO,OAAO,QAAQ,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;AAAA,IAC3G,GAAI,OAAO,EAAE,MAAM,OAAO,IAAI,EAAE,IAAI,CAAC;AAAA,EACvC;AACF;AAEO,IAAM,gBAAwB;AAAA,EACnC,MAAM,CAAC,SAAS,SAAS,QAAQ,IAAI,KAAK,UAAU,gBAAgB,QAAQ,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC;AAAA,EAC/F,MAAM,CAAC,SAAS,SAAS,QAAQ,KAAK,KAAK,UAAU,gBAAgB,QAAQ,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC;AAAA,EAChG,OAAO,CAAC,SAAS,SAAS,QAAQ,MAAM,KAAK,UAAU,gBAAgB,SAAS,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC;AAAA,EACnG,OAAO,CAAC,SAAS,SAAS,QAAQ,IAAI,KAAK,UAAU,gBAAgB,SAAS,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC;AACnG;AAEA,IAAI,OAAe;AAYZ,SAAS,cAAc,MAAc;AAC1C,SAAO;AACT;AAEO,IAAM,SAAiB;AAAA,EAC5B,MAAM,CAAC,SAAS,SAAS,KAAK,KAAK,SAAS,IAAI;AAAA,EAChD,MAAM,CAAC,SAAS,SAAS,KAAK,KAAK,SAAS,IAAI;AAAA,EAChD,OAAO,CAAC,SAAS,SAAS,KAAK,MAAM,SAAS,IAAI;AAAA,EAClD,OAAO,CAAC,SAAS,SAAS,KAAK,MAAM,SAAS,IAAI;AACpD;","names":[]}