@ebrindley/build 0.0.0-stage → 1.42.1-rc28

package/dist/chunk-CJBSZX3F.js

@@ -0,0 +1,127 @@
+import {
+  ProviderRegistry
+} from "./chunk-QJ6OEH4K.js";
+
+// src/core/providers/codex/config.ts
+var CODEX_MODELS = {
+  // Current models
+  O3: "o3",
+  O4_MINI: "o4-mini",
+  GPT_5_MINI: "gpt-5-mini",
+  GPT_5: "gpt-5",
+  GPT_5_PRO: "gpt-5-pro",
+  GPT_5_1: "gpt-5.1",
+  GPT_5_5: "gpt-5.5",
+  GPT_5_6_SOL: "gpt-5.6-sol",
+  GPT_5_6_LUNA: "gpt-5.6-luna",
+  GPT_6_LUNA: "gpt-6-luna",
+  GPT_6_SOL: "gpt-6-sol",
+  GPT_6_1_SOL: "gpt-6.1-sol",
+  GPT_5_4_MINI: "gpt-5.4-mini",
+  GPT_5_4: "gpt-5.4",
+  GPT_5_3_CODEX_SPARK: "gpt-5.3-codex-spark",
+  GPT_5_3_CODEX: "gpt-5.3-codex",
+  GPT_5_2_CODEX: "gpt-5.2-codex",
+  GPT_5_2: "gpt-5.2",
+  /** Registry-available GPT-5.1 Codex exact CLI pin (not the same as mini/max). */
+  GPT_5_1_CODEX: "gpt-5.1-codex",
+  GPT_5_1_CODEX_MINI: "gpt-5.1-codex-mini",
+  GPT_5_1_CODEX_MAX: "gpt-5.1-codex-max",
+  // Legacy models
+  GPT_5_CODEX: "gpt-5-codex",
+  GPT_5_CODEX_MINI: "gpt-5-codex-mini"
+};
+var ADDITIONAL_CODEX_CLI_MODELS = [
+  "gpt-5-codex-max",
+  "gpt-5.2-pro",
+  "gpt-5.2-thinking",
+  // Registry-available (models.available) and priced since the packaged catalog
+  // gained it; the execution inventory must admit the same id or the catalog
+  // advertises a model an explicit pin cannot spawn.
+  "gpt-6-astra"
+];
+var CODEX_API_KEY_ENV_VARS = ["OPENAI_API_KEY", "CODEX_API_KEY", "CODEX_TOKEN"];
+function getAllowedCodexExecutionModels() {
+  return /* @__PURE__ */ new Set([...Object.values(CODEX_MODELS), ...ADDITIONAL_CODEX_CLI_MODELS]);
+}
+function isDiscoveredCodexModel(model) {
+  try {
+    return ProviderRegistry.getProviderConfig("codex").models.available.some(
+      (entry) => entry.id === model && (entry.discovery_source === "native" || /^(?:gpt-|o[1-9](?:[-.]|$))/.test(model) && (entry.discovery_source === "API" || entry.discovery_source === "community"))
+    );
+  } catch {
+    return false;
+  }
+}
+function isOpaqueNativeCodexModel(model) {
+  return !/^(?:gpt-|o[1-9](?:[-.]|$))/.test(model) && isDiscoveredCodexModel(model);
+}
+function isBundledCodexModel(model) {
+  if (getAllowedCodexExecutionModels().has(model)) return true;
+  if (!/^(?:gpt-|o[1-9](?:[-.]|$))/.test(model)) return false;
+  try {
+    return ProviderRegistry.getProviderConfig("codex").models.available.some(
+      (entry) => entry.id === model && entry.discovery_source === void 0
+    );
+  } catch {
+    return false;
+  }
+}
+function resolveModel(model) {
+  if (!model) {
+    return void 0;
+  }
+  const trimmed = model.trim();
+  if (trimmed === "" || trimmed.toLowerCase() === "auto") {
+    return void 0;
+  }
+  return isBundledCodexModel(trimmed) || isDiscoveredCodexModel(trimmed) ? trimmed : void 0;
+}
+function assertCodexExecutionModel(model) {
+  if (!model) {
+    return void 0;
+  }
+  const trimmed = model.trim();
+  if (trimmed === "" || trimmed.toLowerCase() === "auto") {
+    return void 0;
+  }
+  if (isBundledCodexModel(trimmed) || isDiscoveredCodexModel(trimmed)) {
+    return trimmed;
+  }
+  const backendWireCandidate = trimmed.startsWith("openai.") ? trimmed.slice("openai.".length) : void 0;
+  if (backendWireCandidate && getAllowedCodexExecutionModels().has(backendWireCandidate)) {
+    throw new Error(
+      `[Codex] Invalid model pin "${trimmed}". "${trimmed}" is a backend wire ID. Use "codex:${backendWireCandidate}"; Build performs backend translation.`
+    );
+  }
+  throw new Error(
+    `[Codex] Invalid model pin "${trimmed}". Explicit model pins must match a known Codex CLI execution ID (bundled or supported catalog selector). Omit the model to use the Codex CLI default.`
+  );
+}
+function detectCodexAuthMode(env = process.env) {
+  const override = env.BUILD_CODEX_AUTH_MODE?.trim().toLowerCase();
+  if (override === "api_key" || override === "chatgpt_login") {
+    return override;
+  }
+  if (env.BUILD_SKIP_AUTH === "1") {
+    return "unknown";
+  }
+  return "chatgpt_login";
+}
+function shouldPassCodexApiKeys(env = process.env) {
+  return detectCodexAuthMode(env) === "api_key";
+}
+
+export {
+  CODEX_MODELS,
+  ADDITIONAL_CODEX_CLI_MODELS,
+  CODEX_API_KEY_ENV_VARS,
+  isDiscoveredCodexModel,
+  isOpaqueNativeCodexModel,
+  isBundledCodexModel,
+  resolveModel,
+  assertCodexExecutionModel,
+  detectCodexAuthMode,
+  shouldPassCodexApiKeys
+};
+//# sourceMappingURL=chunk-CJBSZX3F.js.map

package/dist/chunk-CLA6QIJM.js

@@ -0,0 +1,43 @@
+// src/planning/plan-artifact-envelope.ts
+import { z } from "zod";
+var MAX_SUPPORTED_PLAN_ARTIFACT_VERSION = 2;
+var PlanArtifactKindSchema = z.enum([
+  "planning-backlog",
+  "decomposition-plan",
+  "workflow"
+]);
+var PlanArtifactTaskTypeSchema = z.object({
+  id: z.string().min(1),
+  resolvedBy: z.enum(["frontmatter", "cli", "declared", "matcher", "fallback", "manual"]),
+  confidence: z.number().min(0).max(1).optional(),
+  policySnapshot: z.unknown().optional()
+}).passthrough();
+var PlanArtifactEnvelopeSchema = z.object({
+  kind: PlanArtifactKindSchema,
+  artifactVersion: z.number().int().positive().max(MAX_SUPPORTED_PLAN_ARTIFACT_VERSION),
+  createdAt: z.string().min(1),
+  parentArtifactPath: z.string().min(1).optional(),
+  taskType: PlanArtifactTaskTypeSchema.optional(),
+  payload: z.unknown().optional()
+}).passthrough();
+function parsePlanArtifactEnvelope(value) {
+  return PlanArtifactEnvelopeSchema.parse(value);
+}
+function bumpArtifactVersion(envelope, options) {
+  if (envelope.artifactVersion >= MAX_SUPPORTED_PLAN_ARTIFACT_VERSION) {
+    throw new Error(
+      `Cannot bump plan artifact version beyond ${MAX_SUPPORTED_PLAN_ARTIFACT_VERSION}`
+    );
+  }
+  return {
+    ...envelope,
+    artifactVersion: envelope.artifactVersion + 1,
+    parentArtifactPath: options?.parentArtifactPath ?? envelope.parentArtifactPath
+  };
+}
+
+export {
+  parsePlanArtifactEnvelope,
+  bumpArtifactVersion
+};
+//# sourceMappingURL=chunk-CLA6QIJM.js.map

package/dist/chunk-CPSVQR2I.js

@@ -0,0 +1,365 @@
+// src/utils/provider-secret-patterns.ts
+var PROVIDER_SECRET_PATTERNS = [
+  {
+    id: "anthropic-api-key",
+    source: "sk-ant-[a-zA-Z0-9_-]{20,}",
+    caseInsensitive: true
+  },
+  {
+    id: "openai-project-api-key",
+    source: "sk-proj-[a-zA-Z0-9_-]{20,}",
+    caseInsensitive: true
+  },
+  {
+    id: "openai-service-account-key",
+    source: "sk-svcacct-[a-zA-Z0-9_-]{20,}",
+    caseInsensitive: true
+  },
+  {
+    id: "openai-admin-api-key",
+    source: "sk-admin-[a-zA-Z0-9_-]{20,}",
+    caseInsensitive: true
+  },
+  {
+    id: "openrouter-api-key",
+    source: "sk-or-v1-[a-zA-Z0-9]{20,}",
+    caseInsensitive: true
+  },
+  {
+    id: "google-api-key",
+    source: "AIzaSy[a-zA-Z0-9_-]{20,}",
+    caseInsensitive: false
+  },
+  {
+    id: "xai-api-key",
+    source: "xai-[a-zA-Z0-9]{20,}",
+    caseInsensitive: true
+  },
+  {
+    id: "slack-token",
+    source: "xox[baprs]-[a-zA-Z0-9-]{10,}",
+    caseInsensitive: true
+  },
+  {
+    id: "gitlab-token",
+    source: "glpat-[a-zA-Z0-9_-]{20,}",
+    caseInsensitive: false
+  },
+  {
+    id: "npm-token",
+    source: "npm_[a-zA-Z0-9]{36,}",
+    caseInsensitive: false
+  },
+  {
+    id: "github-token",
+    source: "gh[pousr]_[a-zA-Z0-9]{20,}",
+    caseInsensitive: true
+  },
+  {
+    id: "github-fine-grained-pat",
+    source: "github_pat_[a-zA-Z0-9_]{50,}",
+    caseInsensitive: true
+  }
+];
+
+// src/utils/type-guards.ts
+function isObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function hasProperty(value, key) {
+  return isObject(value) && key in value;
+}
+function isStringProperty(value, key) {
+  return hasProperty(value, key) && typeof value[key] === "string";
+}
+function isNumberProperty(value, key) {
+  return hasProperty(value, key) && typeof value[key] === "number";
+}
+function isError(value) {
+  return value instanceof Error;
+}
+function hasStderr(error) {
+  return isStringProperty(error, "stderr");
+}
+function hasStdout(error) {
+  return isStringProperty(error, "stdout");
+}
+function hasExitCode(error) {
+  return isNumberProperty(error, "exitCode");
+}
+function hasErrorCode(error) {
+  return isStringProperty(error, "code");
+}
+function getStderr(error) {
+  if (hasStderr(error)) {
+    return error.stderr;
+  }
+  return "";
+}
+function getStdout(error) {
+  if (hasStdout(error)) {
+    return error.stdout;
+  }
+  return "";
+}
+function getExitCode(error) {
+  if (hasExitCode(error)) {
+    return error.exitCode;
+  }
+  return void 0;
+}
+function getErrorCode(error) {
+  if (hasErrorCode(error)) {
+    return error.code;
+  }
+  return void 0;
+}
+function deepMerge(base, override) {
+  if (!isObject(base) || !isObject(override)) {
+    return override ?? base;
+  }
+  const result = { ...base };
+  for (const [key, value] of Object.entries(override)) {
+    const existing = result[key];
+    if (Array.isArray(value)) {
+      result[key] = value;
+      continue;
+    }
+    if (isObject(existing) && isObject(value)) {
+      result[key] = deepMerge(existing, value);
+      continue;
+    }
+    result[key] = value;
+  }
+  return result;
+}
+
+// src/utils/error-sanitizer.ts
+function compileProviderSecretPatterns() {
+  return PROVIDER_SECRET_PATTERNS.map(
+    (pattern) => new RegExp(pattern.source, pattern.caseInsensitive ? "gi" : "g")
+  );
+}
+var SENSITIVE_PATTERNS = [
+  // Database connection strings (MUST come first to capture full credentials)
+  /mongodb(\+srv)?:\/\/[^:]+:[^@]+@/gi,
+  /postgres(ql)?:\/\/[^:]+:[^@]+@/gi,
+  /mysql:\/\/[^:]+:[^@]+@/gi,
+  // Generic URL userinfo credentials (any scheme: https, redis(s), amqp(s), ftp, etc.).
+  // The `://` lookbehind keeps the scheme and host visible while redacting only the
+  // `user:pass@` portion; DB-specific patterns above still handle their own schemes.
+  /(?<=:\/\/)[^:/@\s]+:[^@/\s]+@/g,
+  // AWS credentials (MUST come before generic secret pattern)
+  /AKIA[0-9A-Z]{16}/g,
+  // AWS Access Key ID
+  /aws_access_key_id[=:]\s*['"]?[A-Z0-9]{16,}['"]?/gi,
+  /aws_secret_access_key[=:]\s*['"]?[a-zA-Z0-9+/=]{32,}['"]?/gi,
+  // Generic API keys and tokens (with broader matching)
+  /api[_-]?key[=:]\s*['"]?[a-zA-Z0-9_\-.]{8,}['"]?/gi,
+  /token[=:]\s*['"]?(?!\[REDACTED\])[^\s'"]{8,}['"]?/gi,
+  /secret[=:]\s*['"]?[a-zA-Z0-9_\-.]{10,}['"]?/gi,
+  /password[=:]\s*['"]?[^\s'"]{6,}['"]?/gi,
+  /passwd[=:]\s*['"]?[^\s'"]{6,}['"]?/gi,
+  /pwd[=:]\s*['"]?[^\s'"]{6,}['"]?/gi,
+  // Bearer tokens (Authorization headers)
+  /bearer\s+[a-zA-Z0-9_\-.]{10,}/gi,
+  /authorization[=:]\s*['"]?(?!\[REDACTED\])bearer\s+[a-zA-Z0-9_\-.]{10,}['"]?/gi,
+  // Allow an optional auth scheme (Basic|Digest|Negotiate|Bearer) before the value so
+  // scheme-prefixed forms like `Authorization: Basic <base64>` are redacted; the base64
+  // characters `+/=` are permitted in the value token for Basic credentials.
+  /authorization[=:]\s*['"]?(?!\[REDACTED\])(?:(?:basic|digest|negotiate|bearer)\s+)?[a-zA-Z0-9+/=_\-.]{10,}['"]?/gi,
+  // Common API key formats: Stripe-style `sk_live_`/`sk_test_`/`pk_live_`/`pk_test_`
+  // and bare `sk_`/`sk-`/`pk_`/`pk-` secret tokens. The `sk`/`pk` vendor prefix is
+  // required: bare `live_`/`test_` prefixes were removed because no mainstream key
+  // format uses them without a vendor prefix, while ordinary identifiers do
+  // (`test_currency_mismatch_raises` was being mangled into `[REDACTED]_mismatch_raises`,
+  // which corrupted source code passed through judge prompts). The leading
+  // non-alphanumeric lookbehind keeps `sk`/`pk` from matching mid-word.
+  /(?<![a-zA-Z0-9])(?:(?:sk|pk)[_-](?:live|test)[_-][a-zA-Z0-9]{8,}|(?:sk|pk)[_-][a-zA-Z0-9]{8,})/gi,
+  // Provider-specific key forms (F1–F5, GitHub) from shared inventory —
+  // same sources/min lengths as flywheel-security; replacement remains [REDACTED].
+  ...compileProviderSecretPatterns(),
+  // GCP service account keys (base64-encoded JSON)
+  /"private_key":\s*"[^"]{100,}"/gi,
+  /"client_email":\s*"[^"]+@[^"]+\.gserviceaccount\.com"/gi,
+  // Azure connection strings
+  /AccountKey=[a-zA-Z0-9+/=]{32,}/gi,
+  /SharedAccessSignature=[a-zA-Z0-9%=&]+/gi,
+  // Private keys (any algorithm label: RSA, EC, DSA, OPENSSH, ENCRYPTED, etc.)
+  /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/gi,
+  // JWT tokens (base64.base64.base64 format with more flexibility)
+  /eyJ[a-zA-Z0-9_-]{4,}\.eyJ[a-zA-Z0-9_-]{4,}\.[a-zA-Z0-9_-]{4,}/g,
+  // Generic base64-encoded secrets (64+ chars)
+  /[=:]\s*['"]?[a-zA-Z0-9+/]{64,}={0,2}['"]?/g
+];
+var SENSITIVE_HEADER_VALUE_PATTERNS = [
+  {
+    pattern: /(^|[\r\n]|[^\S\r\n])([ \t]*)(set-cookie|cookie|proxy-authorization|www-authenticate|x-amz-security-token|x-api-key|x-auth-token)([ \t]*:[ \t]*)([^\r\n]*)/gi,
+    replace: (_match, prefix, indentation, headerName, separator) => `${prefix}${indentation}${headerName}${separator}${REDACTION_PLACEHOLDER}`
+  },
+  {
+    pattern: /(['"])(set-cookie|cookie|proxy-authorization|www-authenticate|x-amz-security-token|x-api-key|x-auth-token)\1([ \t]*:[ \t]*)"[^"\r\n]*"/gi,
+    replace: (_match, quote, headerName, separator) => `${quote}${headerName}${quote}${separator}"${REDACTION_PLACEHOLDER}"`
+  },
+  {
+    pattern: /(['"])(set-cookie|cookie|proxy-authorization|www-authenticate|x-amz-security-token|x-api-key|x-auth-token)\1([ \t]*:[ \t]*)'[^'\r\n]*'/gi,
+    replace: (_match, quote, headerName, separator) => `${quote}${headerName}${quote}${separator}'${REDACTION_PLACEHOLDER}'`
+  },
+  {
+    pattern: /(['"])(set-cookie|cookie|proxy-authorization|www-authenticate|x-amz-security-token|x-api-key|x-auth-token)\1([ \t]*:[ \t]*)\[[^\]\r\n]*\]/gi,
+    replace: (_match, quote, headerName, separator) => `${quote}${headerName}${quote}${separator}[${REDACTION_PLACEHOLDER}]`
+  }
+];
+var QUOTED_CREDENTIAL_VALUE_PATTERN = /(?<![A-Za-z0-9_.-])(["']?)([A-Za-z_][A-Za-z0-9_.-]*)\1([ \t]*[:=][ \t]*)(?:"([^"\r\n]{6,})"|'([^'\r\n]{6,})')/g;
+function redactQuotedCredentialValues(input) {
+  QUOTED_CREDENTIAL_VALUE_PATTERN.lastIndex = 0;
+  return input.replace(
+    QUOTED_CREDENTIAL_VALUE_PATTERN,
+    (match, keyQuote, key, separator, doubleQuoted) => {
+      if (keyQuote === "" && !/^[ \t]/.test(separator)) return match;
+      if (!hasCredentialNameSuffix(key)) return match;
+      if (keyQuote !== "" && /(?:credentials?|pwd)$/i.test(key)) return match;
+      const valueQuote = doubleQuoted === void 0 ? "'" : '"';
+      return `${keyQuote}${key}${keyQuote}${separator}${valueQuote}${REDACTION_PLACEHOLDER}${valueQuote}`;
+    }
+  );
+}
+var HOME_DIR_PATTERN = /(\/Users\/|\/home\/)([^/\s]+)\//g;
+var PATH_SEGMENT_CHARACTER = /[.]|[^\s!-/:-@[-^`{-~]/u;
+var REDACTION_PLACEHOLDER = "[REDACTED]";
+var SENSITIVE_ARG_VALUE_PLACEHOLDER = "<redacted>";
+function nameParts(rawName) {
+  const name = rawName.replace(/^-+/, "").split(/[=:]/, 1)[0] ?? "";
+  return name.toLowerCase().split(/[._-]+/).filter(Boolean);
+}
+function hasCredentialNameSuffix(rawName) {
+  const compact = nameParts(rawName).join("");
+  return compact.endsWith("token") || compact.endsWith("apikey") || compact.endsWith("authkey") || compact.endsWith("accesskey") || compact.endsWith("privatekey") || compact.endsWith("authtoken") || compact.endsWith("accesstoken") || compact.endsWith("refreshtoken") || compact.endsWith("bearertoken") || compact.endsWith("credential") || compact.endsWith("credentials") || compact.endsWith("secret") || compact.endsWith("secretkey") || compact.endsWith("password") || compact.endsWith("passwd") || compact.endsWith("pwd");
+}
+function isSensitiveArgName(rawName) {
+  return hasCredentialNameSuffix(rawName) || nameParts(rawName).includes("token");
+}
+function sanitizeArgvForLogging(argv) {
+  const sanitized = [];
+  let redactNext = false;
+  for (const arg of argv) {
+    if (redactNext) {
+      sanitized.push(SENSITIVE_ARG_VALUE_PLACEHOLDER);
+      redactNext = false;
+      continue;
+    }
+    const assignmentMatch = arg.match(/^(-{1,2}[^=\s:]+)([=:])(.+)$/);
+    if (assignmentMatch && isSensitiveArgName(assignmentMatch[1] ?? "")) {
+      sanitized.push(
+        `${assignmentMatch[1]}${assignmentMatch[2]}${SENSITIVE_ARG_VALUE_PLACEHOLDER}`
+      );
+      continue;
+    }
+    if (/^-{1,2}/.test(arg) && isSensitiveArgName(arg)) {
+      sanitized.push(sanitizeString(arg));
+      redactNext = true;
+      continue;
+    }
+    sanitized.push(sanitizeString(arg));
+  }
+  return sanitized;
+}
+function sanitizeCommandLineForLogging(commandLine) {
+  const assignmentPattern = /(^|\s)(-{1,2}[^\s=:]+)([=:])(?:"[^"]*"|'[^']*'|\S+)/g;
+  const valuePattern = /(^|\s)(-{1,2}[^\s=:]+)(\s+)(?:"[^"]*"|'[^']*'|\S+)/g;
+  const protectedValues = [];
+  const protectRedactedArg = (value) => {
+    const index = protectedValues.push(value) - 1;
+    return `__BUILD_REDACTED_ARG_${index}__`;
+  };
+  const redactAssignments = commandLine.replace(
+    assignmentPattern,
+    (match, prefix, flag, separator) => {
+      if (!isSensitiveArgName(flag)) {
+        return match;
+      }
+      return `${prefix}${protectRedactedArg(`${flag}${separator}${SENSITIVE_ARG_VALUE_PLACEHOLDER}`)}`;
+    }
+  );
+  const redactFlagValues = redactAssignments.replace(
+    valuePattern,
+    (match, prefix, flag, spacing) => {
+      if (!isSensitiveArgName(flag)) {
+        return match;
+      }
+      return `${prefix}${protectRedactedArg(`${flag}${spacing}${SENSITIVE_ARG_VALUE_PLACEHOLDER}`)}`;
+    }
+  );
+  return sanitizeString(redactFlagValues).replace(
+    /__BUILD_REDACTED_ARG_(\d+)__/g,
+    (match, rawIndex) => {
+      const replacement = protectedValues[Number(rawIndex)];
+      return replacement ?? match;
+    }
+  );
+}
+function sanitizeString(input) {
+  let sanitized = redactQuotedCredentialValues(input);
+  for (const { pattern, replace } of SENSITIVE_HEADER_VALUE_PATTERNS) {
+    pattern.lastIndex = 0;
+    sanitized = sanitized.replace(pattern, replace);
+  }
+  for (const pattern of SENSITIVE_PATTERNS) {
+    pattern.lastIndex = 0;
+    sanitized = sanitized.replace(pattern, REDACTION_PLACEHOLDER);
+  }
+  HOME_DIR_PATTERN.lastIndex = 0;
+  sanitized = sanitized.replace(
+    HOME_DIR_PATTERN,
+    (_match, root, _username, offset, whole) => {
+      const previousCharacter = offset > 0 ? whole.charAt(offset - 1) : "";
+      if (previousCharacter !== "" && PATH_SEGMENT_CHARACTER.test(previousCharacter)) {
+        return `${root}${REDACTION_PLACEHOLDER}/`;
+      }
+      return "~/";
+    }
+  );
+  return sanitized;
+}
+function sanitizeError(error) {
+  const sanitizedMessage = sanitizeString(error.message);
+  const sanitizedError = new Error(sanitizedMessage);
+  sanitizedError.name = error.name;
+  if (error.stack !== void 0) {
+    sanitizedError.stack = sanitizeString(error.stack);
+  } else {
+    delete sanitizedError.stack;
+  }
+  if ("cause" in error && error.cause) {
+    const sanitizedWithCause = sanitizedError;
+    if (error.cause instanceof Error) {
+      sanitizedWithCause.cause = sanitizeError(error.cause);
+    } else {
+      sanitizedWithCause.cause = sanitizeString(String(error.cause));
+    }
+  }
+  return sanitizedError;
+}
+function sanitizeValue(value) {
+  if (isError(value)) {
+    return sanitizeError(value).message;
+  }
+  return sanitizeString(String(value));
+}
+
+export {
+  PROVIDER_SECRET_PATTERNS,
+  isObject,
+  isStringProperty,
+  getStderr,
+  getStdout,
+  getExitCode,
+  getErrorCode,
+  deepMerge,
+  sanitizeArgvForLogging,
+  sanitizeCommandLineForLogging,
+  sanitizeString,
+  sanitizeError,
+  sanitizeValue
+};
+//# sourceMappingURL=chunk-CPSVQR2I.js.map