@evalops/maestro 0.10.17 → 0.10.20

package/dist/guardian/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/guardian/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGlD,MAAM,MAAM,GAAG,YAAY,CAAC,iBAAiB,CAAC,CAAC;AAE/C,qCAAqC;AACrC,MAAM,CAAC,MAAM,uBAAuB,GAA6B;IAChE,OAAO,EAAE,IAAI;IACb,iBAAiB,EAAE,IAAI;IACvB,uBAAuB,EAAE,IAAI;IAC7B,oBAAoB,EAAE,EAAE;IACxB,eAAe,EAAE,EAAE;IACnB,KAAK,EAAE;QACN,OAAO,EAAE,IAAI;QACb,UAAU,EAAE,IAAI;QAChB,UAAU,EAAE,IAAI;QAChB,aAAa,EAAE,IAAI;KACnB;IACD,aAAa,EAAE,OAAO;IACtB,eAAe,EAAE,IAAI;CACrB,CAAC;AAEF;;GAEG;AACH,SAAS,cAAc,CAAC,IAAY;IACnC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAmB,CAAC;QACrD,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACzD,OAAO,MAAM,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE;YAC7C,IAAI;YACJ,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC7D,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAa;IACjD,MAAM,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IACzD,OAAO,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;AACvD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAChC,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;AAClD,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,GAAG,OAAkC;IAC1D,MAAM,MAAM,GAAmB,EAAE,GAAG,uBAAuB,EAAE,CAAC;IAE9D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM;YAAE,SAAS;QAEtB,2BAA2B;QAC3B,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;YAAE,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAClE,IAAI,MAAM,CAAC,iBAAiB,KAAK,SAAS;YACzC,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,CAAC;QACrD,IAAI,MAAM,CAAC,uBAAuB,KAAK,SAAS;YAC/C,MAAM,CAAC,uBAAuB,GAAG,MAAM,CAAC,uBAAuB,CAAC;QACjE,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS;YACrC,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;QAC7C,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS;YACvC,MAAM,CAAC,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;QAEjD,+BAA+B;QAC/B,IAAI,MAAM,CAAC,oBAAoB,EAAE,CAAC;YACjC,MAAM,CAAC,oBAAoB,GAAG;gBAC7B,GAAG,CAAC,MAAM,CAAC,oBAAoB,IAAI,EAAE,CAAC;gBACtC,GAAG,MAAM,CAAC,oBAAoB;aAC9B,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAC5B,MAAM,CAAC,eAAe,GAAG;gBACxB,GAAG,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC;gBACjC,GAAG,MAAM,CAAC,eAAe;aACzB,CAAC;QACH,CAAC;QAED,qBAAqB;QACrB,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,CAAC,KAAK,GAAG;gBACd,GAAG,MAAM,CAAC,KAAK;gBACf,GAAG,MAAM,CAAC,KAAK;aACf,CAAC;QACH,CAAC;IACF,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAGrC;IACA,MAAM,UAAU,GAAG,cAAc,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACvD,MAAM,aAAa,GAAG,cAAc,CAAC,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IAE1E,MAAM,MAAM,GAAG,YAAY,CAC1B,uBAAuB,EACvB,UAAU,EACV,aAAa,EACb,OAAO,EAAE,MAAM,IAAI,IAAI,CACvB,CAAC;IAEF,6CAA6C;IAC7C,OAAO;QACN,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,uBAAuB,CAAC,OAAO;QAC1D,iBAAiB,EAChB,MAAM,CAAC,iBAAiB,IAAI,uBAAuB,CAAC,iBAAiB;QACtE,uBAAuB,EACtB,MAAM,CAAC,uBAAuB;YAC9B,uBAAuB,CAAC,uBAAuB;QAChD,oBAAoB,EACnB,MAAM,CAAC,oBAAoB;YAC3B,uBAAuB,CAAC,oBAAoB;QAC7C,eAAe,EACd,MAAM,CAAC,eAAe,IAAI,uBAAuB,CAAC,eAAe;QAClE,KAAK,EAAE;YACN,GAAG,uBAAuB,CAAC,KAAK;YAChC,GAAG,MAAM,CAAC,KAAK;SACf;QACD,aAAa,EACZ,MAAM,CAAC,aAAa,IAAI,uBAAuB,CAAC,aAAa;QAC9D,eAAe,EACd,MAAM,CAAC,eAAe,IAAI,uBAAuB,CAAC,eAAe;KAClE,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAkB;IAIxD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAA8C,EAAE,CAAC;IAE9D,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,QAAQ,EAAE,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrB,CAAC;aAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC;gBACZ,OAAO;gBACP,KAAK,EAAE,iCAAiC;aACxC,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CAAC,OAAe;IACxC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,CAAC;QACJ,gGAAgG;QAChG,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAgC;IAChE,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACtC,KAAK,CAAC,IAAI,CAAC,cAAc,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3C,KAAK,CAAC,IAAI,CAAC,0BAA0B,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACjE,KAAK,CAAC,IAAI,CAAC,gCAAgC,MAAM,CAAC,uBAAuB,EAAE,CAAC,CAAC;IAC7E,KAAK,CAAC,IAAI,CAAC,wBAAwB,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC;IAC7D,KAAK,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;IAExD,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;SAC/C,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC;SAChC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;SAChD,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC;SACjC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IAExB,KAAK,CAAC,IAAI,CAAC,oBAAoB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC;IACpE,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,qBAAqB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,MAAM,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,KAAK,CAAC,IAAI,CACT,6BAA6B,MAAM,CAAC,oBAAoB,CAAC,MAAM,EAAE,CACjE,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC,sBAAsB,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC","sourcesContent":["/**\n * Guardian configuration loader\n *\n * Loads configuration from (in order of precedence):\n * 1. Programmatic options passed to runGuardian()\n * 2. Project-level: .maestro/guardian.json\n * 3. User-level: ~/.maestro/guardian.json\n * 4. Default configuration\n */\n\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { join, resolve } from \"node:path\";\nimport { PATHS } from \"../config/constants.js\";\nimport { createLogger } from \"../utils/logger.js\";\nimport type { GuardianConfig } from \"./types.js\";\n\nconst logger = createLogger(\"guardian:config\");\n\n/** Default Guardian configuration */\nexport const DEFAULT_GUARDIAN_CONFIG: Required<GuardianConfig> = {\n\tenabled: true,\n\tscanGitOperations: true,\n\tscanDestructiveCommands: true,\n\tcustomSecretPatterns: [],\n\texcludePatterns: [],\n\ttools: {\n\t\tsemgrep: true,\n\t\tgitSecrets: true,\n\t\ttrufflehog: true,\n\t\theuristicScan: true,\n\t},\n\ttoolTimeoutMs: 120_000,\n\tblockOnFindings: true,\n};\n\n/**\n * Load and parse a Guardian config file\n */\nfunction loadConfigFile(path: string): GuardianConfig | null {\n\tif (!existsSync(path)) {\n\t\treturn null;\n\t}\n\n\ttry {\n\t\tconst content = readFileSync(path, \"utf-8\");\n\t\tconst config = JSON.parse(content) as GuardianConfig;\n\t\tlogger.debug(\"Loaded Guardian config\", { path, config });\n\t\treturn config;\n\t} catch (error) {\n\t\tlogger.warn(\"Failed to load Guardian config\", {\n\t\t\tpath,\n\t\t\terror: error instanceof Error ? error.message : String(error),\n\t\t});\n\t\treturn null;\n\t}\n}\n\n/**\n * Get the project-level config file path\n */\nexport function getProjectConfigPath(root?: string): string {\n\tconst projectRoot = root ? resolve(root) : process.cwd();\n\treturn join(projectRoot, \".maestro\", \"guardian.json\");\n}\n\n/**\n * Get the user-level config file path\n */\nexport function getUserConfigPath(): string {\n\treturn join(PATHS.MAESTRO_HOME, \"guardian.json\");\n}\n\n/**\n * Merge multiple configs with later configs taking precedence\n */\nfunction mergeConfigs(...configs: (GuardianConfig | null)[]): GuardianConfig {\n\tconst result: GuardianConfig = { ...DEFAULT_GUARDIAN_CONFIG };\n\n\tfor (const config of configs) {\n\t\tif (!config) continue;\n\n\t\t// Simple scalar properties\n\t\tif (config.enabled !== undefined) result.enabled = config.enabled;\n\t\tif (config.scanGitOperations !== undefined)\n\t\t\tresult.scanGitOperations = config.scanGitOperations;\n\t\tif (config.scanDestructiveCommands !== undefined)\n\t\t\tresult.scanDestructiveCommands = config.scanDestructiveCommands;\n\t\tif (config.toolTimeoutMs !== undefined)\n\t\t\tresult.toolTimeoutMs = config.toolTimeoutMs;\n\t\tif (config.blockOnFindings !== undefined)\n\t\t\tresult.blockOnFindings = config.blockOnFindings;\n\n\t\t// Arrays - merge with defaults\n\t\tif (config.customSecretPatterns) {\n\t\t\tresult.customSecretPatterns = [\n\t\t\t\t...(result.customSecretPatterns || []),\n\t\t\t\t...config.customSecretPatterns,\n\t\t\t];\n\t\t}\n\t\tif (config.excludePatterns) {\n\t\t\tresult.excludePatterns = [\n\t\t\t\t...(result.excludePatterns || []),\n\t\t\t\t...config.excludePatterns,\n\t\t\t];\n\t\t}\n\n\t\t// Tools - deep merge\n\t\tif (config.tools) {\n\t\t\tresult.tools = {\n\t\t\t\t...result.tools,\n\t\t\t\t...config.tools,\n\t\t\t};\n\t\t}\n\t}\n\n\treturn result;\n}\n\n/**\n * Resolve the effective Guardian configuration\n *\n * Order of precedence (highest to lowest):\n * 1. Programmatic options\n * 2. Project-level config (.maestro/guardian.json)\n * 3. User-level config (~/.maestro/guardian.json)\n * 4. Default config\n */\nexport function resolveGuardianConfig(options?: {\n\troot?: string;\n\tconfig?: GuardianConfig;\n}): Required<GuardianConfig> {\n\tconst userConfig = loadConfigFile(getUserConfigPath());\n\tconst projectConfig = loadConfigFile(getProjectConfigPath(options?.root));\n\n\tconst merged = mergeConfigs(\n\t\tDEFAULT_GUARDIAN_CONFIG,\n\t\tuserConfig,\n\t\tprojectConfig,\n\t\toptions?.config ?? null,\n\t);\n\n\t// Ensure all required properties are present\n\treturn {\n\t\tenabled: merged.enabled ?? DEFAULT_GUARDIAN_CONFIG.enabled,\n\t\tscanGitOperations:\n\t\t\tmerged.scanGitOperations ?? DEFAULT_GUARDIAN_CONFIG.scanGitOperations,\n\t\tscanDestructiveCommands:\n\t\t\tmerged.scanDestructiveCommands ??\n\t\t\tDEFAULT_GUARDIAN_CONFIG.scanDestructiveCommands,\n\t\tcustomSecretPatterns:\n\t\t\tmerged.customSecretPatterns ??\n\t\t\tDEFAULT_GUARDIAN_CONFIG.customSecretPatterns,\n\t\texcludePatterns:\n\t\t\tmerged.excludePatterns ?? DEFAULT_GUARDIAN_CONFIG.excludePatterns,\n\t\ttools: {\n\t\t\t...DEFAULT_GUARDIAN_CONFIG.tools,\n\t\t\t...merged.tools,\n\t\t},\n\t\ttoolTimeoutMs:\n\t\t\tmerged.toolTimeoutMs ?? DEFAULT_GUARDIAN_CONFIG.toolTimeoutMs,\n\t\tblockOnFindings:\n\t\t\tmerged.blockOnFindings ?? DEFAULT_GUARDIAN_CONFIG.blockOnFindings,\n\t};\n}\n\n/**\n * Validate custom secret patterns\n */\nexport function validateSecretPatterns(patterns: string[]): {\n\tvalid: string[];\n\tinvalid: Array<{ pattern: string; error: string }>;\n} {\n\tconst valid: string[] = [];\n\tconst invalid: Array<{ pattern: string; error: string }> = [];\n\n\tfor (const pattern of patterns) {\n\t\tconst compiled = compileUserRegex(pattern);\n\t\tif (compiled) {\n\t\t\tvalid.push(pattern);\n\t\t} else {\n\t\t\tinvalid.push({\n\t\t\t\tpattern,\n\t\t\t\terror: \"Invalid or unsafe regex pattern\",\n\t\t\t});\n\t\t}\n\t}\n\n\treturn { valid, invalid };\n}\n\n/**\n * Compile a user-provided regex string with basic safety guards.\n */\nfunction compileUserRegex(pattern: string): RegExp | null {\n\tif (!pattern || pattern.length > 500) {\n\t\treturn null;\n\t}\n\n\ttry {\n\t\t// nosemgrep: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp\n\t\treturn new RegExp(pattern);\n\t} catch {\n\t\treturn null;\n\t}\n}\n\n/**\n * Get a summary of the current Guardian configuration\n */\nexport function getConfigSummary(config: Required<GuardianConfig>): string {\n\tconst lines: string[] = [];\n\n\tlines.push(\"Guardian Configuration:\");\n\tlines.push(`  Enabled: ${config.enabled}`);\n\tlines.push(`  Scan Git Operations: ${config.scanGitOperations}`);\n\tlines.push(`  Scan Destructive Commands: ${config.scanDestructiveCommands}`);\n\tlines.push(`  Block on Findings: ${config.blockOnFindings}`);\n\tlines.push(`  Tool Timeout: ${config.toolTimeoutMs}ms`);\n\n\tconst enabledTools = Object.entries(config.tools)\n\t\t.filter(([, enabled]) => enabled)\n\t\t.map(([name]) => name);\n\tconst disabledTools = Object.entries(config.tools)\n\t\t.filter(([, enabled]) => !enabled)\n\t\t.map(([name]) => name);\n\n\tlines.push(`  Enabled Tools: ${enabledTools.join(\", \") || \"none\"}`);\n\tif (disabledTools.length > 0) {\n\t\tlines.push(`  Disabled Tools: ${disabledTools.join(\", \")}`);\n\t}\n\n\tif (config.customSecretPatterns.length > 0) {\n\t\tlines.push(\n\t\t\t`  Custom Secret Patterns: ${config.customSecretPatterns.length}`,\n\t\t);\n\t}\n\n\tif (config.excludePatterns.length > 0) {\n\t\tlines.push(`  Custom Excludes: ${config.excludePatterns.join(\", \")}`);\n\t}\n\n\treturn lines.join(\"\\n\");\n}\n"]}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/guardian/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGlD,MAAM,MAAM,GAAG,YAAY,CAAC,iBAAiB,CAAC,CAAC;AAE/C,qCAAqC;AACrC,MAAM,CAAC,MAAM,uBAAuB,GAA6B;IAChE,OAAO,EAAE,IAAI;IACb,iBAAiB,EAAE,IAAI;IACvB,uBAAuB,EAAE,IAAI;IAC7B,oBAAoB,EAAE,EAAE;IACxB,eAAe,EAAE,EAAE;IACnB,KAAK,EAAE;QACN,iBAAiB,EAAE,IAAI;QACvB,OAAO,EAAE,IAAI;QACb,UAAU,EAAE,IAAI;QAChB,UAAU,EAAE,IAAI;QAChB,aAAa,EAAE,IAAI;KACnB;IACD,aAAa,EAAE,OAAO;IACtB,eAAe,EAAE,IAAI;CACrB,CAAC;AAEF;;GAEG;AACH,SAAS,cAAc,CAAC,IAAY;IACnC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAmB,CAAC;QACrD,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACzD,OAAO,MAAM,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE;YAC7C,IAAI;YACJ,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC7D,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAa;IACjD,MAAM,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IACzD,OAAO,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;AACvD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAChC,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;AAClD,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,GAAG,OAAkC;IAC1D,MAAM,MAAM,GAAmB,EAAE,GAAG,uBAAuB,EAAE,CAAC;IAE9D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM;YAAE,SAAS;QAEtB,2BAA2B;QAC3B,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;YAAE,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAClE,IAAI,MAAM,CAAC,iBAAiB,KAAK,SAAS;YACzC,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,CAAC;QACrD,IAAI,MAAM,CAAC,uBAAuB,KAAK,SAAS;YAC/C,MAAM,CAAC,uBAAuB,GAAG,MAAM,CAAC,uBAAuB,CAAC;QACjE,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS;YACrC,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;QAC7C,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS;YACvC,MAAM,CAAC,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;QAEjD,+BAA+B;QAC/B,IAAI,MAAM,CAAC,oBAAoB,EAAE,CAAC;YACjC,MAAM,CAAC,oBAAoB,GAAG;gBAC7B,GAAG,CAAC,MAAM,CAAC,oBAAoB,IAAI,EAAE,CAAC;gBACtC,GAAG,MAAM,CAAC,oBAAoB;aAC9B,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAC5B,MAAM,CAAC,eAAe,GAAG;gBACxB,GAAG,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC;gBACjC,GAAG,MAAM,CAAC,eAAe;aACzB,CAAC;QACH,CAAC;QAED,qBAAqB;QACrB,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,CAAC,KAAK,GAAG;gBACd,GAAG,MAAM,CAAC,KAAK;gBACf,GAAG,MAAM,CAAC,KAAK;aACf,CAAC;QACH,CAAC;IACF,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAGrC;IACA,MAAM,UAAU,GAAG,cAAc,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACvD,MAAM,aAAa,GAAG,cAAc,CAAC,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IAE1E,MAAM,MAAM,GAAG,YAAY,CAC1B,uBAAuB,EACvB,UAAU,EACV,aAAa,EACb,OAAO,EAAE,MAAM,IAAI,IAAI,CACvB,CAAC;IAEF,6CAA6C;IAC7C,OAAO;QACN,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,uBAAuB,CAAC,OAAO;QAC1D,iBAAiB,EAChB,MAAM,CAAC,iBAAiB,IAAI,uBAAuB,CAAC,iBAAiB;QACtE,uBAAuB,EACtB,MAAM,CAAC,uBAAuB;YAC9B,uBAAuB,CAAC,uBAAuB;QAChD,oBAAoB,EACnB,MAAM,CAAC,oBAAoB;YAC3B,uBAAuB,CAAC,oBAAoB;QAC7C,eAAe,EACd,MAAM,CAAC,eAAe,IAAI,uBAAuB,CAAC,eAAe;QAClE,KAAK,EAAE;YACN,GAAG,uBAAuB,CAAC,KAAK;YAChC,GAAG,MAAM,CAAC,KAAK;SACf;QACD,aAAa,EACZ,MAAM,CAAC,aAAa,IAAI,uBAAuB,CAAC,aAAa;QAC9D,eAAe,EACd,MAAM,CAAC,eAAe,IAAI,uBAAuB,CAAC,eAAe;KAClE,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAkB;IAIxD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAA8C,EAAE,CAAC;IAE9D,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,QAAQ,EAAE,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrB,CAAC;aAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC;gBACZ,OAAO;gBACP,KAAK,EAAE,iCAAiC;aACxC,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CAAC,OAAe;IACxC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,CAAC;QACJ,gGAAgG;QAChG,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAgC;IAChE,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACtC,KAAK,CAAC,IAAI,CAAC,cAAc,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3C,KAAK,CAAC,IAAI,CAAC,0BAA0B,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACjE,KAAK,CAAC,IAAI,CAAC,gCAAgC,MAAM,CAAC,uBAAuB,EAAE,CAAC,CAAC;IAC7E,KAAK,CAAC,IAAI,CAAC,wBAAwB,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC;IAC7D,KAAK,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;IAExD,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;SAC/C,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC;SAChC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;SAChD,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC;SACjC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IAExB,KAAK,CAAC,IAAI,CAAC,oBAAoB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC;IACpE,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,qBAAqB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,MAAM,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,KAAK,CAAC,IAAI,CACT,6BAA6B,MAAM,CAAC,oBAAoB,CAAC,MAAM,EAAE,CACjE,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC,sBAAsB,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC","sourcesContent":["/**\n * Guardian configuration loader\n *\n * Loads configuration from (in order of precedence):\n * 1. Programmatic options passed to runGuardian()\n * 2. Project-level: .maestro/guardian.json\n * 3. User-level: ~/.maestro/guardian.json\n * 4. Default configuration\n */\n\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { join, resolve } from \"node:path\";\nimport { PATHS } from \"../config/constants.js\";\nimport { createLogger } from \"../utils/logger.js\";\nimport type { GuardianConfig } from \"./types.js\";\n\nconst logger = createLogger(\"guardian:config\");\n\n/** Default Guardian configuration */\nexport const DEFAULT_GUARDIAN_CONFIG: Required<GuardianConfig> = {\n\tenabled: true,\n\tscanGitOperations: true,\n\tscanDestructiveCommands: true,\n\tcustomSecretPatterns: [],\n\texcludePatterns: [],\n\ttools: {\n\t\tevidenceIntegrity: true,\n\t\tsemgrep: true,\n\t\tgitSecrets: true,\n\t\ttrufflehog: true,\n\t\theuristicScan: true,\n\t},\n\ttoolTimeoutMs: 120_000,\n\tblockOnFindings: true,\n};\n\n/**\n * Load and parse a Guardian config file\n */\nfunction loadConfigFile(path: string): GuardianConfig | null {\n\tif (!existsSync(path)) {\n\t\treturn null;\n\t}\n\n\ttry {\n\t\tconst content = readFileSync(path, \"utf-8\");\n\t\tconst config = JSON.parse(content) as GuardianConfig;\n\t\tlogger.debug(\"Loaded Guardian config\", { path, config });\n\t\treturn config;\n\t} catch (error) {\n\t\tlogger.warn(\"Failed to load Guardian config\", {\n\t\t\tpath,\n\t\t\terror: error instanceof Error ? error.message : String(error),\n\t\t});\n\t\treturn null;\n\t}\n}\n\n/**\n * Get the project-level config file path\n */\nexport function getProjectConfigPath(root?: string): string {\n\tconst projectRoot = root ? resolve(root) : process.cwd();\n\treturn join(projectRoot, \".maestro\", \"guardian.json\");\n}\n\n/**\n * Get the user-level config file path\n */\nexport function getUserConfigPath(): string {\n\treturn join(PATHS.MAESTRO_HOME, \"guardian.json\");\n}\n\n/**\n * Merge multiple configs with later configs taking precedence\n */\nfunction mergeConfigs(...configs: (GuardianConfig | null)[]): GuardianConfig {\n\tconst result: GuardianConfig = { ...DEFAULT_GUARDIAN_CONFIG };\n\n\tfor (const config of configs) {\n\t\tif (!config) continue;\n\n\t\t// Simple scalar properties\n\t\tif (config.enabled !== undefined) result.enabled = config.enabled;\n\t\tif (config.scanGitOperations !== undefined)\n\t\t\tresult.scanGitOperations = config.scanGitOperations;\n\t\tif (config.scanDestructiveCommands !== undefined)\n\t\t\tresult.scanDestructiveCommands = config.scanDestructiveCommands;\n\t\tif (config.toolTimeoutMs !== undefined)\n\t\t\tresult.toolTimeoutMs = config.toolTimeoutMs;\n\t\tif (config.blockOnFindings !== undefined)\n\t\t\tresult.blockOnFindings = config.blockOnFindings;\n\n\t\t// Arrays - merge with defaults\n\t\tif (config.customSecretPatterns) {\n\t\t\tresult.customSecretPatterns = [\n\t\t\t\t...(result.customSecretPatterns || []),\n\t\t\t\t...config.customSecretPatterns,\n\t\t\t];\n\t\t}\n\t\tif (config.excludePatterns) {\n\t\t\tresult.excludePatterns = [\n\t\t\t\t...(result.excludePatterns || []),\n\t\t\t\t...config.excludePatterns,\n\t\t\t];\n\t\t}\n\n\t\t// Tools - deep merge\n\t\tif (config.tools) {\n\t\t\tresult.tools = {\n\t\t\t\t...result.tools,\n\t\t\t\t...config.tools,\n\t\t\t};\n\t\t}\n\t}\n\n\treturn result;\n}\n\n/**\n * Resolve the effective Guardian configuration\n *\n * Order of precedence (highest to lowest):\n * 1. Programmatic options\n * 2. Project-level config (.maestro/guardian.json)\n * 3. User-level config (~/.maestro/guardian.json)\n * 4. Default config\n */\nexport function resolveGuardianConfig(options?: {\n\troot?: string;\n\tconfig?: GuardianConfig;\n}): Required<GuardianConfig> {\n\tconst userConfig = loadConfigFile(getUserConfigPath());\n\tconst projectConfig = loadConfigFile(getProjectConfigPath(options?.root));\n\n\tconst merged = mergeConfigs(\n\t\tDEFAULT_GUARDIAN_CONFIG,\n\t\tuserConfig,\n\t\tprojectConfig,\n\t\toptions?.config ?? null,\n\t);\n\n\t// Ensure all required properties are present\n\treturn {\n\t\tenabled: merged.enabled ?? DEFAULT_GUARDIAN_CONFIG.enabled,\n\t\tscanGitOperations:\n\t\t\tmerged.scanGitOperations ?? DEFAULT_GUARDIAN_CONFIG.scanGitOperations,\n\t\tscanDestructiveCommands:\n\t\t\tmerged.scanDestructiveCommands ??\n\t\t\tDEFAULT_GUARDIAN_CONFIG.scanDestructiveCommands,\n\t\tcustomSecretPatterns:\n\t\t\tmerged.customSecretPatterns ??\n\t\t\tDEFAULT_GUARDIAN_CONFIG.customSecretPatterns,\n\t\texcludePatterns:\n\t\t\tmerged.excludePatterns ?? DEFAULT_GUARDIAN_CONFIG.excludePatterns,\n\t\ttools: {\n\t\t\t...DEFAULT_GUARDIAN_CONFIG.tools,\n\t\t\t...merged.tools,\n\t\t},\n\t\ttoolTimeoutMs:\n\t\t\tmerged.toolTimeoutMs ?? DEFAULT_GUARDIAN_CONFIG.toolTimeoutMs,\n\t\tblockOnFindings:\n\t\t\tmerged.blockOnFindings ?? DEFAULT_GUARDIAN_CONFIG.blockOnFindings,\n\t};\n}\n\n/**\n * Validate custom secret patterns\n */\nexport function validateSecretPatterns(patterns: string[]): {\n\tvalid: string[];\n\tinvalid: Array<{ pattern: string; error: string }>;\n} {\n\tconst valid: string[] = [];\n\tconst invalid: Array<{ pattern: string; error: string }> = [];\n\n\tfor (const pattern of patterns) {\n\t\tconst compiled = compileUserRegex(pattern);\n\t\tif (compiled) {\n\t\t\tvalid.push(pattern);\n\t\t} else {\n\t\t\tinvalid.push({\n\t\t\t\tpattern,\n\t\t\t\terror: \"Invalid or unsafe regex pattern\",\n\t\t\t});\n\t\t}\n\t}\n\n\treturn { valid, invalid };\n}\n\n/**\n * Compile a user-provided regex string with basic safety guards.\n */\nfunction compileUserRegex(pattern: string): RegExp | null {\n\tif (!pattern || pattern.length > 500) {\n\t\treturn null;\n\t}\n\n\ttry {\n\t\t// nosemgrep: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp\n\t\treturn new RegExp(pattern);\n\t} catch {\n\t\treturn null;\n\t}\n}\n\n/**\n * Get a summary of the current Guardian configuration\n */\nexport function getConfigSummary(config: Required<GuardianConfig>): string {\n\tconst lines: string[] = [];\n\n\tlines.push(\"Guardian Configuration:\");\n\tlines.push(`  Enabled: ${config.enabled}`);\n\tlines.push(`  Scan Git Operations: ${config.scanGitOperations}`);\n\tlines.push(`  Scan Destructive Commands: ${config.scanDestructiveCommands}`);\n\tlines.push(`  Block on Findings: ${config.blockOnFindings}`);\n\tlines.push(`  Tool Timeout: ${config.toolTimeoutMs}ms`);\n\n\tconst enabledTools = Object.entries(config.tools)\n\t\t.filter(([, enabled]) => enabled)\n\t\t.map(([name]) => name);\n\tconst disabledTools = Object.entries(config.tools)\n\t\t.filter(([, enabled]) => !enabled)\n\t\t.map(([name]) => name);\n\n\tlines.push(`  Enabled Tools: ${enabledTools.join(\", \") || \"none\"}`);\n\tif (disabledTools.length > 0) {\n\t\tlines.push(`  Disabled Tools: ${disabledTools.join(\", \")}`);\n\t}\n\n\tif (config.customSecretPatterns.length > 0) {\n\t\tlines.push(\n\t\t\t`  Custom Secret Patterns: ${config.customSecretPatterns.length}`,\n\t\t);\n\t}\n\n\tif (config.excludePatterns.length > 0) {\n\t\tlines.push(`  Custom Excludes: ${config.excludePatterns.join(\", \")}`);\n\t}\n\n\treturn lines.join(\"\\n\");\n}\n"]}

package/dist/guardian/runner.d.ts

@@ -1,6 +1,8 @@
 import type { GuardianRunOptions, GuardianRunResult } from "./types.js";
 export type HeuristicFindingName = "AWS access key" | "AWS secret key" | "Private key block" | "Generic API key" | "Slack token" | "GitHub token" | "GitLab token" | "Google API key" | "Stripe key" | "OpenAI API key" | "SendGrid API key" | "Twilio auth token" | "Discord webhook" | "Database URL with credentials" | "JWT token";
+export type EvidenceIntegrityFindingName = "Synthetic production commit SHA" | "Synthetic production PR reference" | "Synthetic local GitHub Actions run ID" | "Local proof identifier" | "Replay artifact claimed as production evidence";
 export declare function detectHeuristicFindings(contents: string): HeuristicFindingName[];
+export declare function detectEvidenceIntegrityFindings(contents: string): EvidenceIntegrityFindingName[];
 export declare function formatGuardianResult(result: GuardianRunResult): string;
 export declare function shouldGuardCommand(command: string): {
     shouldGuard: boolean;

package/dist/guardian/runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../src/guardian/runner.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAEX,kBAAkB,EAClB,iBAAiB,EAGjB,MAAM,YAAY,CAAC;AA+VpB,MAAM,MAAM,oBAAoB,GAC7B,gBAAgB,GAChB,gBAAgB,GAChB,mBAAmB,GACnB,iBAAiB,GACjB,aAAa,GACb,cAAc,GACd,cAAc,GACd,gBAAgB,GAChB,YAAY,GACZ,gBAAgB,GAChB,kBAAkB,GAClB,mBAAmB,GACnB,iBAAiB,GACjB,+BAA+B,GAC/B,WAAW,CAAC;AA8Ff,wBAAgB,uBAAuB,CACtC,QAAQ,EAAE,MAAM,GACd,oBAAoB,EAAE,CAQxB;AA2FD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAoCtE;AAYD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG;IACpD,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CA+BA;AAED,wBAAsB,WAAW,CAChC,OAAO,GAAE,kBAAuB,GAC9B,OAAO,CAAC,iBAAiB,CAAC,CAiI5B"}
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../src/guardian/runner.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAEX,kBAAkB,EAClB,iBAAiB,EAGjB,MAAM,YAAY,CAAC;AAqWpB,MAAM,MAAM,oBAAoB,GAC7B,gBAAgB,GAChB,gBAAgB,GAChB,mBAAmB,GACnB,iBAAiB,GACjB,aAAa,GACb,cAAc,GACd,cAAc,GACd,gBAAgB,GAChB,YAAY,GACZ,gBAAgB,GAChB,kBAAkB,GAClB,mBAAmB,GACnB,iBAAiB,GACjB,+BAA+B,GAC/B,WAAW,CAAC;AAEf,MAAM,MAAM,4BAA4B,GACrC,iCAAiC,GACjC,mCAAmC,GACnC,uCAAuC,GACvC,wBAAwB,GACxB,gDAAgD,CAAC;AA2IpD,wBAAgB,uBAAuB,CACtC,QAAQ,EAAE,MAAM,GACd,oBAAoB,EAAE,CAQxB;AAED,wBAAgB,+BAA+B,CAC9C,QAAQ,EAAE,MAAM,GACd,4BAA4B,EAAE,CAYhC;AAiJD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAoCtE;AAYD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG;IACpD,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CA+BA;AAED,wBAAsB,WAAW,CAChC,OAAO,GAAE,kBAAuB,GAC9B,OAAO,CAAC,iBAAiB,CAAC,CAqI5B"}

package/dist/guardian/runner.js

@@ -16,12 +16,13 @@ function commandExists(command, cwd) {
     });
     return (result.status ?? 1) === 0;
 }
-function runCommand(command, args, cwd, timeoutMs = DEFAULT_TIMEOUT_MS) {
+function runCommand(command, args, cwd, timeoutMs = DEFAULT_TIMEOUT_MS, env) {
     const started = Date.now();
     try {
         const result = spawnSync(command, args, {
             cwd,
             encoding: "utf-8",
+            env: env ? { ...process.env, ...env } : process.env,
             maxBuffer: 8 * 1024 * 1024,
             timeout: timeoutMs,
         });
@@ -151,13 +152,17 @@ function runSemgrep(files, root) {
         "--error",
         "--timeout",
         "7",
+        "--jobs",
+        "1",
         "--metrics=off",
         "--disable-version-check",
         ...includeArgs,
         ".",
     ];
     // Semgrep can take longer on larger workspaces; allow up to 2 minutes before timing out
-    const result = runCommand(cmd.command, args, root, 120_000);
+    const result = runCommand(cmd.command, args, root, 120_000, {
+        SEMGREP_SEND_METRICS: "off",
+    });
     return {
         tool: "semgrep",
         exitCode: result.exitCode,
@@ -387,6 +392,38 @@ const HEURISTIC_PATTERNS = [
         regex: /\beyJ[A-Za-z0-9_-]{20,}\.eyJ[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}\b/,
     },
 ];
+const EVIDENCE_CONTEXT_REGEX = /(?<![A-Za-z0-9_-])(?:production[\s_-]+evidence|productionEvidence|production[\s_-]+proof|productionProof|live[\s_-]+evidence|liveEvidence|live[\s_-]+proof|liveProof|dereferenceable|evidence[\s_-]+bundle|evidenceBundle|deploy-verifier|hard[_-]identifiers|hardIdentifiers)(?![A-Za-z0-9_-])/i;
+const REPLAY_EVIDENCE_MARKER_PATTERN = String.raw `(?:\bdeterministic_replay\b|(?<![A-Za-z0-9_])["']?replay["']?\s*:\s*true)`;
+const PRODUCTION_EVIDENCE_CLAIM_PATTERN = String.raw `(?<![A-Za-z0-9_-])["']?(?:production[_-]?evidence|live[_-]?proof)["']?\s*:\s*["']?(?:true|verified)["']?(?![A-Za-z0-9_-])`;
+const EVIDENCE_PATTERNS = [
+    {
+        name: "Synthetic production commit SHA",
+        // A 40-hex "SHA" containing an embedded UTC timestamp plus cutesy marker
+        // text is a fixture identifier, not dereferenceable git evidence.
+        regex: /\b[0-9a-f]{4,12}20\d{12}[0-9a-f]{0,16}(?:c0de|cafe|5afe)[0-9a-f]{0,20}\b/i,
+        requiresEvidenceContext: true,
+    },
+    {
+        name: "Synthetic production PR reference",
+        regex: /\b[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+#(?!\d+\b)[A-Za-z][A-Za-z0-9_.:-]*(?:local|prod-pr-lane)[A-Za-z0-9_.:-]*\b/i,
+        requiresEvidenceContext: true,
+    },
+    {
+        name: "Synthetic local GitHub Actions run ID",
+        regex: /\bgha-run-[A-Za-z0-9_.:-]*-local\b/i,
+        requiresEvidenceContext: true,
+    },
+    {
+        name: "Local proof identifier",
+        regex: /\bproof(?:[_-]?id|Id)?\b["']?\s*[:=]\s*["']?[A-Za-z0-9_.:-]+-local\b/i,
+        requiresEvidenceContext: true,
+    },
+    {
+        name: "Replay artifact claimed as production evidence",
+        matches: (contents) => new RegExp(REPLAY_EVIDENCE_MARKER_PATTERN, "i").test(contents) &&
+            new RegExp(PRODUCTION_EVIDENCE_CLAIM_PATTERN, "i").test(contents),
+    },
+];
 export function detectHeuristicFindings(contents) {
     const matches = [];
     for (const pattern of HEURISTIC_PATTERNS) {
@@ -396,6 +433,67 @@ export function detectHeuristicFindings(contents) {
     }
     return matches;
 }
+export function detectEvidenceIntegrityFindings(contents) {
+    const matches = [];
+    const hasEvidenceContext = EVIDENCE_CONTEXT_REGEX.test(contents);
+    for (const pattern of EVIDENCE_PATTERNS) {
+        if (pattern.requiresEvidenceContext && !hasEvidenceContext) {
+            continue;
+        }
+        if (pattern.matches?.(contents) ?? pattern.regex?.test(contents)) {
+            matches.push(pattern.name);
+        }
+    }
+    return matches;
+}
+function runEvidenceIntegrityScan(files, root) {
+    const started = Date.now();
+    const findings = [];
+    const ignorePatterns = [
+        /test\/guardian\/evidence-integrity\.test\.ts$/,
+        /src\/guardian\/runner\.ts$/,
+    ];
+    for (const relative of files) {
+        if (ignorePatterns.some((pattern) => pattern.test(relative))) {
+            continue;
+        }
+        const fullPath = resolve(root, relative);
+        if (!existsSync(fullPath))
+            continue;
+        let contents;
+        try {
+            const stats = statSync(fullPath);
+            if (stats.size > 2 * 1024 * 1024) {
+                continue;
+            }
+            contents = readFileSync(fullPath, "utf-8");
+        }
+        catch {
+            continue;
+        }
+        if (contents.includes("\0"))
+            continue;
+        for (const match of detectEvidenceIntegrityFindings(contents)) {
+            findings.push(`${match}: ${relative}`);
+        }
+    }
+    if (!findings.length) {
+        return {
+            tool: "evidence-integrity",
+            exitCode: 0,
+            stdout: "",
+            stderr: "",
+            durationMs: Date.now() - started,
+        };
+    }
+    return {
+        tool: "evidence-integrity",
+        exitCode: 1,
+        stdout: findings.join("\n"),
+        stderr: "Live-production claims must use dereferenceable git, PR, Actions, deploy, and signature identifiers. Mark deterministic fixtures as replay evidence instead.",
+        durationMs: Date.now() - started,
+    };
+}
 function runHeuristicScan(files, root) {
     const started = Date.now();
     const findings = [];
@@ -407,6 +505,8 @@ function runHeuristicScan(files, root) {
         /test\/safety\/context-firewall\.test\.ts$/,
         /test\/safety\/edge-cases\.test\.ts$/,
         /test\/safety\/safety-middleware\.test\.ts$/,
+        /test\/telemetry\/beacon\.test\.ts$/,
+        /test\/telemetry\/telemetry-metadata-split\.test\.ts$/,
         // The runner itself contains regex patterns that look like secrets
         /src\/guardian\/runner\.ts$/,
     ];
@@ -606,6 +706,9 @@ export async function runGuardian(options = {}) {
         config: options.config,
     });
     const toolResults = [];
+    if (config.tools.evidenceIntegrity) {
+        toolResults.push(runEvidenceIntegrityScan(files, scanRoot));
+    }
     if (config.tools.semgrep) {
         toolResults.push(runSemgrep(files, scanRoot));
     }

package/dist/guardian/runner.js.map

@@ -1 +1 @@
-{"version":3,"file":"runner.js","sourceRoot":"","sources":["../../src/guardian/runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EACN,YAAY,EACZ,UAAU,EACV,SAAS,EACT,WAAW,EACX,YAAY,EACZ,MAAM,EACN,QAAQ,EACR,aAAa,GACb,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAS9C,MAAM,uBAAuB,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AAC5D,MAAM,sBAAsB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;AACnD,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAclC,SAAS,aAAa,CAAC,OAAe,EAAE,GAAW;IAClD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE;QAChD,GAAG;QACH,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,OAAO;KACjB,CAAC,CAAC;IACH,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,UAAU,CAClB,OAAe,EACf,IAAc,EACd,GAAW,EACX,SAAS,GAAG,kBAAkB;IAE9B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE;YACvC,GAAG;YACH,QAAQ,EAAE,OAAO;YACjB,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;YAC1B,OAAO,EAAE,SAAS;SAClB,CAAC,CAAC;QACH,OAAO;YACN,QAAQ,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC;YAC5B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;SAChC,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO;YACN,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAC9D,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAC7D,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;SAChC,CAAC;IACH,CAAC;AACF,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY;IACxC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACrE,OAAO,CACN,MAAM,CAAC,QAAQ,KAAK,CAAC;QACrB,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CACrC,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAe;IACnC,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC5C,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAC5B,CAAC,OAAO,EAAE,EAAE,CACX,UAAU,KAAK,OAAO;YACtB,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC;YAC9B,UAAU,CAAC,QAAQ,CAAC,IAAI,OAAO,EAAE,CAAC,CACnC,CAAC;IACH,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACpC,MAAM,MAAM,GAAG,UAAU,CACxB,KAAK,EACL,CAAC,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,wBAAwB,CAAC,EAC7D,IAAI,CACJ,CAAC;IACF,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO;YACN,EAAE,EAAE,KAAK;YACT,KAAK,EACJ,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;gBACpB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;gBACpB,6BAA6B;YAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ;SACzB,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,CACxB,MAAM,CAAC,MAAM;SACX,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CACjB,CAAC;IACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACrC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO;YACN,EAAE,EAAE,KAAK;YACT,KAAK,EACJ,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;gBACpB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;gBACpB,8BAA8B;YAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;SACzB,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,CACxB,MAAM,CAAC,MAAM;SACX,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CACjB,CAAC;IACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,iBAAiB,CACzB,UAA+B;IAE/B,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;IAClC,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IACnC,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC5C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC/C,IAAI,uBAAuB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAClD,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,+BAA+B;gBACvC,WAAW,EAAE,UAAU;aACvB,CAAC;QACH,CAAC;QACD,IAAI,sBAAsB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACjD,OAAO;gBACN,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,gCAAgC;gBACxC,WAAW,EAAE,SAAS;aACtB,CAAC;QACH,CAAC;IACF,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,aAAa,CACrB,IAAY;IAEZ,IAAI,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACzC,CAAC;IACD,IAAI,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;IACvD,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,KAAe,EAAE,IAAY;IAChD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,OAAO;YACN,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;YAChC,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,mBAAmB;SAC3B,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG;QACZ,GAAG,GAAG,CAAC,IAAI;QACX,MAAM;QACN,UAAU;QACV,WAAW;QACX,UAAU;QACV,MAAM;QACN,QAAQ;QACR,2BAA2B;QAC3B,SAAS;QACT,WAAW;QACX,GAAG;QACH,eAAe;QACf,yBAAyB;QACzB,GAAG,WAAW;QACd,GAAG;KACH,CAAC;IACF,wFAAwF;IACxF,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5D,OAAO;QACN,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU;KAC7B,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAY,EAAE,KAAe;IAC5D,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,2BAA2B,CAAC,CAAC,CAAC;IAC5E,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5B,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACtE,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YACzB,wCAAwC;YACxC,SAAS;QACV,CAAC;QACD,IAAI,CAAC;YACJ,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACR,4CAA4C;QAC7C,CAAC;IACF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,KAAe;IACrD,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACrE,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACvC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,SAAS;QACV,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5B,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC;YACJ,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACR,0CAA0C;QAC3C,CAAC;IACF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,KAAe,EAAE,IAAY;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO;YACN,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;YAChC,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,UAAU;SAClB,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,CAAC,SAAS,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;QAC9B,OAAO;YACN,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;YAChC,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,2BAA2B;SACnC,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,SAAS;QACrB,CAAC,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;QAC1C,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACzE,OAAO;QACN,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU;KAC7B,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAe,EAAE,IAAY;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC;QACxC,OAAO;YACN,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;YAChC,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,0BAA0B;SAClC,CAAC;IACH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO;YACN,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;YAChC,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,UAAU;SAClB,CAAC;IACH,CAAC;IAED,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,CAAC;QACJ,OAAO,GAAG,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO;gBACN,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE,CAAC;gBACX,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,EAAE;gBACV,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;gBAChC,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,UAAU;aAClB,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,CACxB,YAAY,EACZ,CAAC,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,EACpE,OAAO,CACP,CAAC;QACF,OAAO;YACN,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,UAAU,EAAE,MAAM,CAAC,UAAU;SAC7B,CAAC;IACH,CAAC;YAAS,CAAC;QACV,IAAI,OAAO,EAAE,CAAC;YACb,IAAI,CAAC;gBACJ,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,CAAC;YAAC,MAAM,CAAC;gBACR,sBAAsB;YACvB,CAAC;QACF,CAAC;IACF,CAAC;AACF,CAAC;AAmBD,MAAM,kBAAkB,GACvB;IACC,kBAAkB;IAClB,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,sBAAsB,EAAE;IACzD;QACC,IAAI,EAAE,gBAAgB;QACtB,8DAA8D;QAC9D,KAAK,EACJ,+FAA+F;KAChG;IACD;QACC,IAAI,EAAE,mBAAmB;QACzB,KAAK,EAAE,0BAA0B;KACjC;IACD;QACC,IAAI,EAAE,iBAAiB;QACvB,8EAA8E;QAC9E,gCAAgC;QAChC,mCAAmC;QACnC,sCAAsC;QACtC,kBAAkB;QAClB,oBAAoB;QACpB,KAAK,EACJ,4IAA4I;KAC7I;IACD;QACC,IAAI,EAAE,aAAa;QACnB,gEAAgE;QAChE,oCAAoC;QACpC,oCAAoC;QACpC,+DAA+D;QAC/D,KAAK,EAAE,kEAAkE;KACzE;IACD;QACC,IAAI,EAAE,cAAc;QACpB,uEAAuE;QACvE,uDAAuD;QACvD,KAAK,EAAE,+DAA+D;KACtE;IACD;QACC,IAAI,EAAE,cAAc;QACpB,2CAA2C;QAC3C,KAAK,EAAE,8BAA8B;KACrC;IACD;QACC,IAAI,EAAE,gBAAgB;QACtB,kCAAkC;QAClC,KAAK,EAAE,2BAA2B;KAClC;IACD;QACC,IAAI,EAAE,YAAY;QAClB,0EAA0E;QAC1E,KAAK,EAAE,2CAA2C;KAClD;IACD;QACC,IAAI,EAAE,gBAAgB;QACtB,kDAAkD;QAClD,KAAK,EAAE,yBAAyB;KAChC;IACD;QACC,IAAI,EAAE,kBAAkB;QACxB,+BAA+B;QAC/B,KAAK,EAAE,gDAAgD;KACvD;IACD;QACC,IAAI,EAAE,mBAAmB;QACzB,wCAAwC;QACxC,KAAK,EACJ,oFAAoF;KACrF;IACD;QACC,IAAI,EAAE,iBAAiB;QACvB,gDAAgD;QAChD,KAAK,EACJ,6FAA6F;KAC9F;IACD;QACC,IAAI,EAAE,+BAA+B;QACrC,wDAAwD;QACxD,kFAAkF;QAClF,KAAK,EACJ,mFAAmF;KACpF;IACD;QACC,IAAI,EAAE,WAAW;QACjB,kDAAkD;QAClD,oFAAoF;QACpF,KAAK,EACJ,sEAAsE;KACvE;CACD,CAAC;AAEH,MAAM,UAAU,uBAAuB,CACtC,QAAgB;IAEhB,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;QAC1C,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;IACF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAe,EAAE,IAAY;IACtD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,cAAc,GAAG;QACtB,2CAA2C;QAC3C,2CAA2C;QAC3C,6DAA6D;QAC7D,mDAAmD;QACnD,2CAA2C;QAC3C,qCAAqC;QACrC,4CAA4C;QAC5C,mEAAmE;QACnE,4BAA4B;KAC5B,CAAC;IAEF,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;QAC9B,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC9D,SAAS;QACV,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,SAAS;QACpC,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACJ,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACjC,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;gBAClC,SAAS;YACV,CAAC;YACD,QAAQ,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACR,SAAS;QACV,CAAC;QACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAS,CAAC,gBAAgB;QACvD,KAAK,MAAM,KAAK,IAAI,uBAAuB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvD,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,QAAQ,EAAE,CAAC,CAAC;QACxC,CAAC;IACF,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACtB,OAAO;YACN,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;SAChC,CAAC;IACH,CAAC;IACD,OAAO;QACN,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,CAAC;QACX,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QAC3B,MAAM,EAAE,EAAE;QACV,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;KAChC,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CACpB,MAAsB,EACtB,KAAe,EACf,KAA2B,EAC3B,MAAwB,EACxB,UAAmB;IAEnB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,qBAAqB,UAAU,IAAI,UAAU,GAAG,CAAC;IACzD,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,iBAAiB,CAAC;IAC7E,MAAM,MAAM,GACX,MAAM,KAAK,QAAQ;QAClB,CAAC,CAAC,iBAAiB;QACnB,CAAC,CAAC,MAAM,KAAK,QAAQ;YACpB,CAAC,CAAC,yBAAyB;YAC3B,CAAC,CAAC,gBAAgB,CAAC;IACtB,MAAM,GAAG,GAAG,KAAK;SACf,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;SAC/B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;SACxB,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,MAAM,OAAO,GAAG,KAAK;SACnB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;SAC9B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;SACxB,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,MAAM,WAAW,GAChB,GAAG,IAAI,OAAO;QACb,CAAC,CAAC,GAAG,GAAG,cAAc,OAAO,GAAG;QAChC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClD,OAAO,GAAG,MAAM,OAAO,KAAK,CAAC,MAAM,IAAI,SAAS,GAC/C,WAAW,CAAC,CAAC,CAAC,UAAU,WAAW,EAAE,CAAC,CAAC,CAAC,EACzC,EAAE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAyB;IAC7D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3B,KAAK,CAAC,IAAI,CACT,WAAW,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,MAAM,gBAClD,MAAM,CAAC,UACR,IAAI,CACJ,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvC,MAAM,MAAM,GACX,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM;YAC1B,CAAC,CAAC,YAAY,IAAI,CAAC,MAAM,GAAG;YAC5B,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC;gBACpB,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC;oBACpB,CAAC,CAAC,UAAU;oBACZ,CAAC,CAAC,OAAO,CAAC;QACd,KAAK,CAAC,IAAI,CACT,KAAK,IAAI,CAAC,IAAI,KAAK,MAAM,KAAK,IAAI,CAAC,UAAU,KAC5C,IAAI,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EACnD,GAAG,CACH,CAAC;QACF,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC/C,CAAC;IACF,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,MAAM,GACX,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,KAAK,CAAC,IAAI,CAAC,UAAU,OAAO,GAAG,MAAM,EAAE,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAA2B;IACrD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;IAC1E,IAAI,QAAQ;QAAE,OAAO,OAAO,CAAC;IAC7B,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAC7B,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC,CAC9C,CAAC;IACF,IAAI,WAAW;QAAE,OAAO,QAAQ,CAAC;IACjC,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAIjD,MAAM,aAAa,GAAG,0CAA0C,CAAC;IACjE,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC9C,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC3D,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnB,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC;IAC3E,CAAC;IAED,MAAM,mBAAmB,GAA4C;QACpE,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE;QAC3C;YACC,KAAK,EAAE,4CAA4C;YACnD,KAAK,EAAE,OAAO;SACd;QACD,EAAE,KAAK,EAAE,2BAA2B,EAAE,KAAK,EAAE,cAAc,EAAE;QAC7D,EAAE,KAAK,EAAE,qBAAqB,EAAE,KAAK,EAAE,WAAW,EAAE;QACpD,EAAE,KAAK,EAAE,0BAA0B,EAAE,KAAK,EAAE,YAAY,EAAE;QAC1D,EAAE,KAAK,EAAE,4BAA4B,EAAE,KAAK,EAAE,cAAc,EAAE;QAC9D,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE;QACrC,EAAE,KAAK,EAAE,wBAAwB,EAAE,KAAK,EAAE,eAAe,EAAE;KAC3D,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,mBAAmB,EAAE,CAAC;QAC3C,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QACtD,CAAC;IACF,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAChC,UAA8B,EAAE;IAEhC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC;IAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IAClE,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QACzB,MAAM,MAAM,GAAsB;YACjC,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE,CAAC;YACX,SAAS;YACT,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YAClC,MAAM;YACN,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,YAAY,EAAE,CAAC;YACf,OAAO,EAAE,oCAAoC;YAC7C,UAAU,EAAE,UAAU,CAAC,MAAM,IAAI,UAAU;YAC3C,WAAW,EAAE,EAAE;SACf,CAAC;QACF,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC1B,OAAO,MAAM,CAAC;IACf,CAAC;IAED,MAAM,WAAW,GAChB,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IACnE,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;QACrB,MAAM,MAAM,GAAsB;YACjC,MAAM,EAAE,OAAO;YACf,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,SAAS;YACT,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YAClC,MAAM;YACN,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,YAAY,EAAE,CAAC;YACf,OAAO,EAAE,WAAW,CAAC,KAAK;YAC1B,WAAW,EAAE,EAAE;SACf,CAAC;QACF,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC1B,OAAO,MAAM,CAAC;IACf,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC;IAChC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,MAAM,GAAsB;YACjC,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE,CAAC;YACX,SAAS;YACT,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YAClC,MAAM;YACN,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,YAAY,EAAE,CAAC;YACf,OAAO,EAAE,kBAAkB;YAC3B,UAAU,EAAE,UAAU;YACtB,WAAW,EAAE,EAAE;SACf,CAAC;QACF,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC1B,OAAO,MAAM,CAAC;IACf,CAAC;IAED,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACzB,WAAW,GAAG,sBAAsB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAClD,IAAI,WAAW,EAAE,CAAC;YACjB,QAAQ,GAAG,WAAW,CAAC;QACxB,CAAC;IACF,CAAC;IAED,MAAM,MAAM,GAAG,qBAAqB,CAAC;QACpC,IAAI;QACJ,MAAM,EAAE,OAAO,CAAC,MAAM;KACtB,CAAC,CAAC;IAEH,MAAM,WAAW,GAAyB,EAAE,CAAC;IAE7C,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAC1B,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,QAAQ,GAA8B,IAAI,CAAC;IAC/C,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QAC7B,MAAM,gBAAgB,GAAG,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACxD,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAC/B,QAAQ,GAAG,gBAAgB,CAAC;QAC7B,CAAC;IACF,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QAC1C,MAAM,aAAa,GAAG,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;YAC5B,QAAQ,GAAG,aAAa,CAAC;QAC1B,CAAC;IACF,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QAC7C,QAAQ,GAAG,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACd,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,QAAQ,GACb,MAAM,KAAK,QAAQ;QAClB,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC,CAAC;YACjE,EAAE,QAAQ,IAAI,CAAC,CAAC,CAAC;IAErB,MAAM,MAAM,GAAsB;QACjC,MAAM;QACN,QAAQ;QACR,SAAS;QACT,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;QAClC,MAAM;QACN,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,YAAY,EAAE,KAAK,CAAC,MAAM;QAC1B,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK;QACxC,OAAO,EAAE,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC;QACzD,WAAW;KACX,CAAC;IAEF,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAE1B,IAAI,WAAW,EAAE,CAAC;QACjB,IAAI,CAAC;YACJ,MAAM,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACR,sBAAsB;QACvB,CAAC;IACF,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC","sourcesContent":["import { spawnSync } from \"node:child_process\";\nimport {\n\tcopyFileSync,\n\texistsSync,\n\tmkdirSync,\n\tmkdtempSync,\n\treadFileSync,\n\trmSync,\n\tstatSync,\n\twriteFileSync,\n} from \"node:fs\";\nimport os from \"node:os\";\nimport { dirname, join, resolve } from \"node:path\";\nimport { resolveGuardianConfig } from \"./config.js\";\nimport { loadGuardianState, recordGuardianRun } from \"./state.js\";\nimport { DEFAULT_EXCLUDES } from \"./types.js\";\nimport type {\n\tGuardianEnablement,\n\tGuardianRunOptions,\n\tGuardianRunResult,\n\tGuardianStatus,\n\tGuardianToolResult,\n} from \"./types.js\";\n\nconst GUARDIAN_DISABLE_VALUES = [\"0\", \"false\", \"off\", \"no\"];\nconst GUARDIAN_ENABLE_VALUES = [\"1\", \"true\", \"on\"];\nconst DEFAULT_TIMEOUT_MS = 10_000;\n\ntype FileListResult =\n\t| { ok: true; files: string[] }\n\t| { ok: false; error: string; exitCode: number };\n\ntype CommandResult = {\n\texitCode: number;\n\tstdout: string;\n\tstderr: string;\n\terror?: string;\n\tdurationMs: number;\n};\n\nfunction commandExists(command: string, cwd: string): boolean {\n\tconst result = spawnSync(command, [\"--version\"], {\n\t\tcwd,\n\t\tstdio: \"pipe\",\n\t\tencoding: \"utf-8\",\n\t});\n\treturn (result.status ?? 1) === 0;\n}\n\nfunction runCommand(\n\tcommand: string,\n\targs: string[],\n\tcwd: string,\n\ttimeoutMs = DEFAULT_TIMEOUT_MS,\n): CommandResult {\n\tconst started = Date.now();\n\ttry {\n\t\tconst result = spawnSync(command, args, {\n\t\t\tcwd,\n\t\t\tencoding: \"utf-8\",\n\t\t\tmaxBuffer: 8 * 1024 * 1024,\n\t\t\ttimeout: timeoutMs,\n\t\t});\n\t\treturn {\n\t\t\texitCode: result.status ?? 1,\n\t\t\tstdout: result.stdout ?? \"\",\n\t\t\tstderr: result.stderr ?? \"\",\n\t\t\tdurationMs: Date.now() - started,\n\t\t};\n\t} catch (error) {\n\t\treturn {\n\t\t\texitCode: 1,\n\t\t\tstdout: \"\",\n\t\t\tstderr: error instanceof Error ? error.message : String(error),\n\t\t\terror: error instanceof Error ? error.message : String(error),\n\t\t\tdurationMs: Date.now() - started,\n\t\t};\n\t}\n}\n\nfunction hasGitSecretsPlugin(root: string): boolean {\n\tconst result = runCommand(\"git\", [\"secrets\", \"--help\"], root, 4_000);\n\treturn (\n\t\tresult.exitCode === 0 ||\n\t\tresult.stderr.includes(\"git secrets\") ||\n\t\tresult.stdout.includes(\"git secrets\")\n\t);\n}\n\nfunction filterFiles(files: string[]): string[] {\n\treturn files.filter((file) => {\n\t\tconst normalized = file.replace(/\\\\/g, \"/\");\n\t\treturn !DEFAULT_EXCLUDES.some(\n\t\t\t(exclude) =>\n\t\t\t\tnormalized === exclude ||\n\t\t\t\tnormalized.startsWith(exclude) ||\n\t\t\t\tnormalized.includes(`/${exclude}`),\n\t\t);\n\t});\n}\n\nfunction listStagedFiles(root: string): FileListResult {\n\tconst result = runCommand(\n\t\t\"git\",\n\t\t[\"diff\", \"--name-only\", \"--cached\", \"--diff-filter=ACMRTUXB\"],\n\t\troot,\n\t);\n\tif (result.exitCode !== 0) {\n\t\treturn {\n\t\t\tok: false,\n\t\t\terror:\n\t\t\t\tresult.stderr.trim() ||\n\t\t\t\tresult.stdout.trim() ||\n\t\t\t\t\"Unable to list staged files\",\n\t\t\texitCode: result.exitCode,\n\t\t};\n\t}\n\tconst files = filterFiles(\n\t\tresult.stdout\n\t\t\t.split(\"\\n\")\n\t\t\t.map((line) => line.trim())\n\t\t\t.filter(Boolean),\n\t);\n\treturn { ok: true, files };\n}\n\nfunction listTrackedFiles(root: string): FileListResult {\n\tconst result = runCommand(\"git\", [\"ls-files\"], root);\n\tif (result.exitCode !== 0) {\n\t\treturn {\n\t\t\tok: false,\n\t\t\terror:\n\t\t\t\tresult.stderr.trim() ||\n\t\t\t\tresult.stdout.trim() ||\n\t\t\t\t\"Unable to list tracked files\",\n\t\t\texitCode: result.exitCode,\n\t\t};\n\t}\n\tconst files = filterFiles(\n\t\tresult.stdout\n\t\t\t.split(\"\\n\")\n\t\t\t.map((line) => line.trim())\n\t\t\t.filter(Boolean),\n\t);\n\treturn { ok: true, files };\n}\n\nfunction resolveEnablement(\n\trespectEnv: boolean | undefined,\n): GuardianEnablement {\n\tconst state = loadGuardianState();\n\tif (!respectEnv) {\n\t\treturn { enabled: state.enabled };\n\t}\n\tconst rawEnv = process.env.MAESTRO_GUARDIAN;\n\tif (typeof rawEnv === \"string\" && rawEnv.trim().length > 0) {\n\t\tconst normalized = rawEnv.trim().toLowerCase();\n\t\tif (GUARDIAN_DISABLE_VALUES.includes(normalized)) {\n\t\t\treturn {\n\t\t\t\tenabled: false,\n\t\t\t\treason: \"MAESTRO_GUARDIAN=0 (disabled)\",\n\t\t\t\tenvOverride: \"disabled\",\n\t\t\t};\n\t\t}\n\t\tif (GUARDIAN_ENABLE_VALUES.includes(normalized)) {\n\t\t\treturn {\n\t\t\t\tenabled: true,\n\t\t\t\treason: \"MAESTRO_GUARDIAN=1 (forced on)\",\n\t\t\t\tenvOverride: \"enabled\",\n\t\t\t};\n\t\t}\n\t}\n\treturn { enabled: state.enabled };\n}\n\nfunction locateSemgrep(\n\troot: string,\n): { command: string; args: string[] } | null {\n\tif (commandExists(\"semgrep\", root)) {\n\t\treturn { command: \"semgrep\", args: [] };\n\t}\n\tif (commandExists(\"npx\", root)) {\n\t\treturn { command: \"npx\", args: [\"--yes\", \"semgrep\"] };\n\t}\n\treturn null;\n}\n\nfunction runSemgrep(files: string[], root: string): GuardianToolResult {\n\tconst started = Date.now();\n\tconst cmd = locateSemgrep(root);\n\tif (!cmd) {\n\t\treturn {\n\t\t\ttool: \"semgrep\",\n\t\t\texitCode: 0,\n\t\t\tstdout: \"\",\n\t\t\tstderr: \"\",\n\t\t\tdurationMs: Date.now() - started,\n\t\t\tskipped: true,\n\t\t\treason: \"semgrep not found\",\n\t\t};\n\t}\n\tconst includeArgs = files.flatMap((file) => [\"--include\", file]);\n\tconst args = [\n\t\t...cmd.args,\n\t\t\"scan\",\n\t\t\"--config\",\n\t\t\"p/secrets\",\n\t\t\"--config\",\n\t\t\"p/ci\",\n\t\t\"--json\",\n\t\t\"--skip-unknown-extensions\",\n\t\t\"--error\",\n\t\t\"--timeout\",\n\t\t\"7\",\n\t\t\"--metrics=off\",\n\t\t\"--disable-version-check\",\n\t\t...includeArgs,\n\t\t\".\",\n\t];\n\t// Semgrep can take longer on larger workspaces; allow up to 2 minutes before timing out\n\tconst result = runCommand(cmd.command, args, root, 120_000);\n\treturn {\n\t\ttool: \"semgrep\",\n\t\texitCode: result.exitCode,\n\t\tstdout: result.stdout,\n\t\tstderr: result.stderr,\n\t\tdurationMs: result.durationMs,\n\t};\n}\n\nfunction materializeStagedFiles(root: string, files: string[]): string | null {\n\tconst tempDir = mkdtempSync(join(os.tmpdir(), \"composer-guardian-staged-\"));\n\tfor (const relative of files) {\n\t\tconst target = join(tempDir, relative);\n\t\tconst dir = dirname(target);\n\t\tmkdirSync(dir, { recursive: true });\n\t\tconst show = runCommand(\"git\", [\"show\", `:${relative}`], root, 5_000);\n\t\tif (show.exitCode !== 0) {\n\t\t\t// skip files we fail to read from index\n\t\t\tcontinue;\n\t\t}\n\t\ttry {\n\t\t\twriteFileSync(target, show.stdout, \"utf-8\");\n\t\t} catch {\n\t\t\t// ignore write errors for problematic files\n\t\t}\n\t}\n\treturn tempDir;\n}\n\nfunction copyFilesToTemp(root: string, files: string[]): string | null {\n\tif (!files.length) return null;\n\tconst tempDir = mkdtempSync(join(os.tmpdir(), \"composer-guardian-\"));\n\tfor (const relative of files) {\n\t\tconst source = resolve(root, relative);\n\t\tif (!existsSync(source)) {\n\t\t\tcontinue;\n\t\t}\n\t\tconst target = join(tempDir, relative);\n\t\tconst dir = dirname(target);\n\t\tmkdirSync(dir, { recursive: true });\n\t\ttry {\n\t\t\tcopyFileSync(source, target);\n\t\t} catch {\n\t\t\t// ignore copy errors; file may be removed\n\t\t}\n\t}\n\treturn tempDir;\n}\n\nfunction runGitSecrets(files: string[], root: string): GuardianToolResult {\n\tconst started = Date.now();\n\tif (!files.length) {\n\t\treturn {\n\t\t\ttool: \"git-secrets\",\n\t\t\texitCode: 0,\n\t\t\tstdout: \"\",\n\t\t\tstderr: \"\",\n\t\t\tdurationMs: Date.now() - started,\n\t\t\tskipped: true,\n\t\t\treason: \"no files\",\n\t\t};\n\t}\n\n\tconst hasBinary = commandExists(\"git-secrets\", root);\n\tconst hasPlugin = !hasBinary && hasGitSecretsPlugin(root);\n\tif (!hasBinary && !hasPlugin) {\n\t\treturn {\n\t\t\ttool: \"git-secrets\",\n\t\t\texitCode: 0,\n\t\t\tstdout: \"\",\n\t\t\tstderr: \"\",\n\t\t\tdurationMs: Date.now() - started,\n\t\t\tskipped: true,\n\t\t\treason: \"git-secrets not installed\",\n\t\t};\n\t}\n\n\tconst args = hasBinary\n\t\t? [\"--scan\", \"--no-index\", \"--\", ...files]\n\t\t: [\"secrets\", \"--scan\", \"--no-index\", \"--\", ...files];\n\tconst result = runCommand(hasBinary ? \"git-secrets\" : \"git\", args, root);\n\treturn {\n\t\ttool: \"git-secrets\",\n\t\texitCode: result.exitCode,\n\t\tstdout: result.stdout,\n\t\tstderr: result.stderr,\n\t\tdurationMs: result.durationMs,\n\t};\n}\n\nfunction runTrufflehog(files: string[], root: string): GuardianToolResult {\n\tconst started = Date.now();\n\tif (!commandExists(\"trufflehog\", root)) {\n\t\treturn {\n\t\t\ttool: \"trufflehog\",\n\t\t\texitCode: 0,\n\t\t\tstdout: \"\",\n\t\t\tstderr: \"\",\n\t\t\tdurationMs: Date.now() - started,\n\t\t\tskipped: true,\n\t\t\treason: \"trufflehog not installed\",\n\t\t};\n\t}\n\tif (!files.length) {\n\t\treturn {\n\t\t\ttool: \"trufflehog\",\n\t\t\texitCode: 0,\n\t\t\tstdout: \"\",\n\t\t\tstderr: \"\",\n\t\t\tdurationMs: Date.now() - started,\n\t\t\tskipped: true,\n\t\t\treason: \"no files\",\n\t\t};\n\t}\n\n\tlet tempDir: string | null = null;\n\ttry {\n\t\ttempDir = copyFilesToTemp(root, files);\n\t\tif (!tempDir) {\n\t\t\treturn {\n\t\t\t\ttool: \"trufflehog\",\n\t\t\t\texitCode: 0,\n\t\t\t\tstdout: \"\",\n\t\t\t\tstderr: \"\",\n\t\t\t\tdurationMs: Date.now() - started,\n\t\t\t\tskipped: true,\n\t\t\t\treason: \"no files\",\n\t\t\t};\n\t\t}\n\t\tconst result = runCommand(\n\t\t\t\"trufflehog\",\n\t\t\t[\"filesystem\", \"--no-update\", \"--fail\", \"--json\", \"--path\", tempDir],\n\t\t\ttempDir,\n\t\t);\n\t\treturn {\n\t\t\ttool: \"trufflehog\",\n\t\t\texitCode: result.exitCode,\n\t\t\tstdout: result.stdout,\n\t\t\tstderr: result.stderr,\n\t\t\tdurationMs: result.durationMs,\n\t\t};\n\t} finally {\n\t\tif (tempDir) {\n\t\t\ttry {\n\t\t\t\trmSync(tempDir, { recursive: true, force: true });\n\t\t\t} catch {\n\t\t\t\t// best effort cleanup\n\t\t\t}\n\t\t}\n\t}\n}\n\nexport type HeuristicFindingName =\n\t| \"AWS access key\"\n\t| \"AWS secret key\"\n\t| \"Private key block\"\n\t| \"Generic API key\"\n\t| \"Slack token\"\n\t| \"GitHub token\"\n\t| \"GitLab token\"\n\t| \"Google API key\"\n\t| \"Stripe key\"\n\t| \"OpenAI API key\"\n\t| \"SendGrid API key\"\n\t| \"Twilio auth token\"\n\t| \"Discord webhook\"\n\t| \"Database URL with credentials\"\n\t| \"JWT token\";\n\nconst HEURISTIC_PATTERNS: Array<{ name: HeuristicFindingName; regex: RegExp }> =\n\t[\n\t\t// AWS credentials\n\t\t{ name: \"AWS access key\", regex: /\\bAKIA[0-9A-Z]{16}\\b/ },\n\t\t{\n\t\t\tname: \"AWS secret key\",\n\t\t\t// AWS secret keys are 40 characters of base64-like characters\n\t\t\tregex:\n\t\t\t\t/(?:aws_secret_access_key|secret_access_key|aws_secret)\\s*[:=]\\s*['\"]?[A-Za-z0-9/+=]{40}['\"]?/i,\n\t\t},\n\t\t{\n\t\t\tname: \"Private key block\",\n\t\t\tregex: /BEGIN [A-Z ]*PRIVATE KEY/,\n\t\t},\n\t\t{\n\t\t\tname: \"Generic API key\",\n\t\t\t// Avoid matching natural language inside string literals while still catching\n\t\t\t// typical config patterns like:\n\t\t\t//   token: \"....\" / token = \"....\"\n\t\t\t//   apiKey: \"....\" / api_key = \"....\"\n\t\t\t// And JSON-style:\n\t\t\t//   \"token\": \"....\"\n\t\t\tregex:\n\t\t\t\t/(?:(?<!['\"])\\b(?:api[_-]?key|token)\\b\\s*[:=]\\s*['\"][A-Za-z0-9_-]{20,}['\"]|['\"](?:api[_-]?key|token)['\"]\\s*:\\s*['\"][A-Za-z0-9_-]{20,}['\"])/i,\n\t\t},\n\t\t{\n\t\t\tname: \"Slack token\",\n\t\t\t// Slack tokens are typically segmented and include numeric IDs:\n\t\t\t//   xoxb-<digits>-<digits>-<secret>\n\t\t\t//   xapp-<digits>-<digits>-<secret>\n\t\t\t// Use a stricter shape to avoid false positives in tests/docs.\n\t\t\tregex: /\\b(?:xox[baprs]|xapp)-\\d{6,}(?:-\\d{6,}){1,2}-[A-Za-z0-9-]{10,}\\b/,\n\t\t},\n\t\t{\n\t\t\tname: \"GitHub token\",\n\t\t\t// GitHub tokens: ghp_ (personal), gho_ (OAuth), ghu_ (user-to-server),\n\t\t\t// ghs_ (server-to-server), ghr_ (refresh), github_pat_\n\t\t\tregex: /\\b(?:ghp_|gho_|ghu_|ghs_|ghr_|github_pat_)[A-Za-z0-9_]{36,}\\b/,\n\t\t},\n\t\t{\n\t\t\tname: \"GitLab token\",\n\t\t\t// GitLab personal access tokens: glpat-...\n\t\t\tregex: /\\bglpat-[A-Za-z0-9_-]{20,}\\b/,\n\t\t},\n\t\t{\n\t\t\tname: \"Google API key\",\n\t\t\t// Google API keys start with AIza\n\t\t\tregex: /\\bAIza[A-Za-z0-9_-]{35}\\b/,\n\t\t},\n\t\t{\n\t\t\tname: \"Stripe key\",\n\t\t\t// Stripe keys: sk_live_, pk_live_, sk_test_, pk_test_, rk_live_, rk_test_\n\t\t\tregex: /\\b[spr]k_(?:live|test)_[A-Za-z0-9]{24,}\\b/,\n\t\t},\n\t\t{\n\t\t\tname: \"OpenAI API key\",\n\t\t\t// OpenAI keys: sk-... (typically 48+ chars total)\n\t\t\tregex: /\\bsk-[A-Za-z0-9]{32,}\\b/,\n\t\t},\n\t\t{\n\t\t\tname: \"SendGrid API key\",\n\t\t\t// SendGrid keys start with SG.\n\t\t\tregex: /\\bSG\\.[A-Za-z0-9_-]{22,}\\.[A-Za-z0-9_-]{22,}\\b/,\n\t\t},\n\t\t{\n\t\t\tname: \"Twilio auth token\",\n\t\t\t// Twilio auth tokens in config patterns\n\t\t\tregex:\n\t\t\t\t/twilio[_-]?(?:auth[_-]?token|account[_-]?sid)\\s*[:=]\\s*['\"]?[A-Za-z0-9]{32,}['\"]?/i,\n\t\t},\n\t\t{\n\t\t\tname: \"Discord webhook\",\n\t\t\t// Discord webhook URLs contain sensitive tokens\n\t\t\tregex:\n\t\t\t\t/https:\\/\\/(?:discord(?:app)?\\.com|canary\\.discord\\.com)\\/api\\/webhooks\\/\\d+\\/[A-Za-z0-9_-]+/,\n\t\t},\n\t\t{\n\t\t\tname: \"Database URL with credentials\",\n\t\t\t// Database connection strings with embedded credentials\n\t\t\t// postgres://user:password@host, mysql://user:pass@host, mongodb://user:pass@host\n\t\t\tregex:\n\t\t\t\t/\\b(?:postgres(?:ql)?|mysql|mongodb(?:\\+srv)?|redis):\\/\\/[^\\s:]+:[^\\s@]+@[^\\s'\"]+/i,\n\t\t},\n\t\t{\n\t\t\tname: \"JWT token\",\n\t\t\t// JWT tokens have a distinctive structure: eyJ...\n\t\t\t// Only flag if it looks like a real token (has all three parts with decent lengths)\n\t\t\tregex:\n\t\t\t\t/\\beyJ[A-Za-z0-9_-]{20,}\\.eyJ[A-Za-z0-9_-]{20,}\\.[A-Za-z0-9_-]{20,}\\b/,\n\t\t},\n\t];\n\nexport function detectHeuristicFindings(\n\tcontents: string,\n): HeuristicFindingName[] {\n\tconst matches: HeuristicFindingName[] = [];\n\tfor (const pattern of HEURISTIC_PATTERNS) {\n\t\tif (pattern.regex.test(contents)) {\n\t\t\tmatches.push(pattern.name);\n\t\t}\n\t}\n\treturn matches;\n}\n\nfunction runHeuristicScan(files: string[], root: string): GuardianToolResult {\n\tconst started = Date.now();\n\tconst findings: string[] = [];\n\tconst ignorePatterns = [\n\t\t/test\\/enterprise\\/pii-detector\\.test\\.ts$/,\n\t\t/test\\/guardian\\/heuristic-scan\\.test\\.ts$/,\n\t\t// Tests that intentionally include credential-like fixtures.\n\t\t/test\\/integration\\/security-middleware\\.test\\.ts$/,\n\t\t/test\\/safety\\/context-firewall\\.test\\.ts$/,\n\t\t/test\\/safety\\/edge-cases\\.test\\.ts$/,\n\t\t/test\\/safety\\/safety-middleware\\.test\\.ts$/,\n\t\t// The runner itself contains regex patterns that look like secrets\n\t\t/src\\/guardian\\/runner\\.ts$/,\n\t];\n\n\tfor (const relative of files) {\n\t\tif (ignorePatterns.some((pattern) => pattern.test(relative))) {\n\t\t\tcontinue;\n\t\t}\n\t\tconst fullPath = resolve(root, relative);\n\t\tif (!existsSync(fullPath)) continue;\n\t\tlet contents: string;\n\t\ttry {\n\t\t\tconst stats = statSync(fullPath);\n\t\t\tif (stats.size > 2 * 1024 * 1024) {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tcontents = readFileSync(fullPath, \"utf-8\");\n\t\t} catch {\n\t\t\tcontinue;\n\t\t}\n\t\tif (contents.includes(\"\\0\")) continue; // likely binary\n\t\tfor (const match of detectHeuristicFindings(contents)) {\n\t\t\tfindings.push(`${match}: ${relative}`);\n\t\t}\n\t}\n\n\tif (!findings.length) {\n\t\treturn {\n\t\t\ttool: \"heuristic-scan\",\n\t\t\texitCode: 0,\n\t\t\tstdout: \"\",\n\t\t\tstderr: \"\",\n\t\t\tdurationMs: Date.now() - started,\n\t\t};\n\t}\n\treturn {\n\t\ttool: \"heuristic-scan\",\n\t\texitCode: 1,\n\t\tstdout: findings.join(\"\\n\"),\n\t\tstderr: \"\",\n\t\tdurationMs: Date.now() - started,\n\t};\n}\n\nfunction buildSummary(\n\tstatus: GuardianStatus,\n\tfiles: string[],\n\ttools: GuardianToolResult[],\n\ttarget: \"staged\" | \"all\",\n\tskipReason?: string,\n): string {\n\tif (status === \"skipped\") {\n\t\treturn `Guardian skipped (${skipReason ?? \"disabled\"})`;\n\t}\n\tconst fileLabel = target === \"staged\" ? \"staged file(s)\" : \"tracked file(s)\";\n\tconst prefix =\n\t\tstatus === \"passed\"\n\t\t\t? \"Guardian passed\"\n\t\t\t: status === \"failed\"\n\t\t\t\t? \"Guardian blocked commit\"\n\t\t\t\t: \"Guardian error\";\n\tconst ran = tools\n\t\t.filter((tool) => !tool.skipped)\n\t\t.map((tool) => tool.tool)\n\t\t.join(\" + \");\n\tconst skipped = tools\n\t\t.filter((tool) => tool.skipped)\n\t\t.map((tool) => tool.tool)\n\t\t.join(\", \");\n\tconst toolSummary =\n\t\tran && skipped\n\t\t\t? `${ran} (skipped: ${skipped})`\n\t\t\t: ran || (skipped ? `skipped: ${skipped}` : \"\");\n\treturn `${prefix} on ${files.length} ${fileLabel}${\n\t\ttoolSummary ? ` using ${toolSummary}` : \"\"\n\t}`;\n}\n\nexport function formatGuardianResult(result: GuardianRunResult): string {\n\tconst lines: string[] = [];\n\tlines.push(result.summary);\n\tlines.push(\n\t\t`Status: ${result.status} • Target: ${result.target} • Duration: ${\n\t\t\tresult.durationMs\n\t\t}ms`,\n\t);\n\tfor (const tool of result.toolResults) {\n\t\tconst status =\n\t\t\ttool.skipped && tool.reason\n\t\t\t\t? `skipped (${tool.reason})`\n\t\t\t\t: tool.exitCode === 0\n\t\t\t\t\t? \"clean\"\n\t\t\t\t\t: tool.exitCode === 1\n\t\t\t\t\t\t? \"findings\"\n\t\t\t\t\t\t: \"error\";\n\t\tlines.push(\n\t\t\t`- ${tool.tool}: ${status} (${tool.durationMs}ms${\n\t\t\t\ttool.exitCode !== 0 ? `, exit ${tool.exitCode}` : \"\"\n\t\t\t})`,\n\t\t);\n\t\tif (tool.stdout.trim()) {\n\t\t\tlines.push(`  stdout: ${tool.stdout.trim()}`);\n\t\t}\n\t\tif (tool.stderr.trim()) {\n\t\t\tlines.push(`  stderr: ${tool.stderr.trim()}`);\n\t\t}\n\t}\n\tif (result.files?.length) {\n\t\tconst preview = result.files.slice(0, 8).join(\", \");\n\t\tconst suffix =\n\t\t\tresult.files.length > 8 ? ` … +${result.files.length - 8} more` : \"\";\n\t\tlines.push(`Files: ${preview}${suffix}`);\n\t}\n\treturn lines.join(\"\\n\");\n}\n\nfunction pickOverallStatus(tools: GuardianToolResult[]): GuardianStatus {\n\tconst hadError = tools.some((tool) => !tool.skipped && tool.exitCode > 1);\n\tif (hadError) return \"error\";\n\tconst hadFindings = tools.some(\n\t\t(tool) => !tool.skipped && tool.exitCode === 1,\n\t);\n\tif (hadFindings) return \"failed\";\n\treturn \"passed\";\n}\n\nexport function shouldGuardCommand(command: string): {\n\tshouldGuard: boolean;\n\ttrigger: string | null;\n} {\n\tconst inlineDisable = /MAESTRO_GUARDIAN\\s*=\\s*(0|false|off|no)/i;\n\tif (inlineDisable.test(command)) {\n\t\treturn { shouldGuard: false, trigger: null };\n\t}\n\tconst gitMatch = command.match(/\\bgit\\s+(commit|push)\\b/i);\n\tif (gitMatch?.[1]) {\n\t\treturn { shouldGuard: true, trigger: `git ${gitMatch[1].toLowerCase()}` };\n\t}\n\n\tconst destructivePatterns: Array<{ regex: RegExp; label: string }> = [\n\t\t{ regex: /\\brm\\s+-rf\\b/i, label: \"rm -rf\" },\n\t\t{\n\t\t\tregex: /\\brm\\s+(?:-[a-z]*r[a-z]*\\b|--recursive\\b)/i,\n\t\t\tlabel: \"rm -r\",\n\t\t},\n\t\t{ regex: /\\bfind\\s+[^\\n]*-delete\\b/i, label: \"find -delete\" },\n\t\t{ regex: /\\bchmod\\s+0{3,4}\\b/i, label: \"chmod 000\" },\n\t\t{ regex: /\\bchown\\b[^\\n]*\\broot\\b/i, label: \"chown root\" },\n\t\t{ regex: /\\bdd\\s+if=.*\\s+of=\\/dev\\//i, label: \"dd to device\" },\n\t\t{ regex: /\\bmkfs\\./i, label: \"mkfs\" },\n\t\t{ regex: /\\btruncate\\s+-s\\s+0\\b/i, label: \"truncate -s 0\" },\n\t];\n\n\tfor (const pattern of destructivePatterns) {\n\t\tif (pattern.regex.test(command)) {\n\t\t\treturn { shouldGuard: true, trigger: pattern.label };\n\t\t}\n\t}\n\n\treturn { shouldGuard: false, trigger: null };\n}\n\nexport async function runGuardian(\n\toptions: GuardianRunOptions = {},\n): Promise<GuardianRunResult> {\n\tconst target = options.target ?? \"staged\";\n\tconst root = options.root ? resolve(options.root) : process.cwd();\n\tlet scanRoot = root;\n\tlet snapshotDir: string | null = null;\n\tconst enablement = resolveEnablement(options.respectEnv ?? true);\n\tconst startedAt = Date.now();\n\n\tif (!enablement.enabled) {\n\t\tconst result: GuardianRunResult = {\n\t\t\tstatus: \"skipped\",\n\t\t\texitCode: 0,\n\t\t\tstartedAt,\n\t\t\tdurationMs: Date.now() - startedAt,\n\t\t\ttarget,\n\t\t\ttrigger: options.trigger,\n\t\t\tfilesScanned: 0,\n\t\t\tsummary: \"Guardian disabled by configuration\",\n\t\t\tskipReason: enablement.reason ?? \"disabled\",\n\t\t\ttoolResults: [],\n\t\t};\n\t\trecordGuardianRun(result);\n\t\treturn result;\n\t}\n\n\tconst filesResult =\n\t\ttarget === \"all\" ? listTrackedFiles(root) : listStagedFiles(root);\n\tif (!filesResult.ok) {\n\t\tconst result: GuardianRunResult = {\n\t\t\tstatus: \"error\",\n\t\t\texitCode: filesResult.exitCode,\n\t\t\tstartedAt,\n\t\t\tdurationMs: Date.now() - startedAt,\n\t\t\ttarget,\n\t\t\ttrigger: options.trigger,\n\t\t\tfilesScanned: 0,\n\t\t\tsummary: filesResult.error,\n\t\t\ttoolResults: [],\n\t\t};\n\t\trecordGuardianRun(result);\n\t\treturn result;\n\t}\n\n\tconst files = filesResult.files;\n\tif (!files.length) {\n\t\tconst result: GuardianRunResult = {\n\t\t\tstatus: \"skipped\",\n\t\t\texitCode: 0,\n\t\t\tstartedAt,\n\t\t\tdurationMs: Date.now() - startedAt,\n\t\t\ttarget,\n\t\t\ttrigger: options.trigger,\n\t\t\tfilesScanned: 0,\n\t\t\tsummary: \"No files to scan\",\n\t\t\tskipReason: \"no files\",\n\t\t\ttoolResults: [],\n\t\t};\n\t\trecordGuardianRun(result);\n\t\treturn result;\n\t}\n\n\tif (target === \"staged\") {\n\t\tsnapshotDir = materializeStagedFiles(root, files);\n\t\tif (snapshotDir) {\n\t\t\tscanRoot = snapshotDir;\n\t\t}\n\t}\n\n\tconst config = resolveGuardianConfig({\n\t\troot,\n\t\tconfig: options.config,\n\t});\n\n\tconst toolResults: GuardianToolResult[] = [];\n\n\tif (config.tools.semgrep) {\n\t\ttoolResults.push(runSemgrep(files, scanRoot));\n\t}\n\n\tlet fallback: GuardianToolResult | null = null;\n\tif (config.tools.gitSecrets) {\n\t\tconst gitSecretsResult = runGitSecrets(files, scanRoot);\n\t\tif (!gitSecretsResult.skipped) {\n\t\t\tfallback = gitSecretsResult;\n\t\t}\n\t}\n\tif (!fallback && config.tools.trufflehog) {\n\t\tconst truffleResult = runTrufflehog(files, scanRoot);\n\t\tif (!truffleResult.skipped) {\n\t\t\tfallback = truffleResult;\n\t\t}\n\t}\n\tif (!fallback && config.tools.heuristicScan) {\n\t\tfallback = runHeuristicScan(files, scanRoot);\n\t}\n\tif (fallback) {\n\t\ttoolResults.push(fallback);\n\t}\n\n\tconst status = pickOverallStatus(toolResults);\n\tconst exitCode =\n\t\tstatus === \"passed\"\n\t\t\t? 0\n\t\t\t: (toolResults.find((tool) => !tool.skipped && tool.exitCode !== 0)\n\t\t\t\t\t?.exitCode ?? 1);\n\n\tconst result: GuardianRunResult = {\n\t\tstatus,\n\t\texitCode,\n\t\tstartedAt,\n\t\tdurationMs: Date.now() - startedAt,\n\t\ttarget,\n\t\ttrigger: options.trigger,\n\t\tfilesScanned: files.length,\n\t\tfiles: options.quiet ? undefined : files,\n\t\tsummary: buildSummary(status, files, toolResults, target),\n\t\ttoolResults,\n\t};\n\n\trecordGuardianRun(result);\n\n\tif (snapshotDir) {\n\t\ttry {\n\t\t\trmSync(snapshotDir, { recursive: true, force: true });\n\t\t} catch {\n\t\t\t// best effort cleanup\n\t\t}\n\t}\n\treturn result;\n}\n"]}
+{"version":3,"file":"runner.js","sourceRoot":"","sources":["../../src/guardian/runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EACN,YAAY,EACZ,UAAU,EACV,SAAS,EACT,WAAW,EACX,YAAY,EACZ,MAAM,EACN,QAAQ,EACR,aAAa,GACb,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAS9C,MAAM,uBAAuB,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AAC5D,MAAM,sBAAsB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;AACnD,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAclC,SAAS,aAAa,CAAC,OAAe,EAAE,GAAW;IAClD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE;QAChD,GAAG;QACH,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,OAAO;KACjB,CAAC,CAAC;IACH,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,UAAU,CAClB,OAAe,EACf,IAAc,EACd,GAAW,EACX,SAAS,GAAG,kBAAkB,EAC9B,GAAuB;IAEvB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE;YACvC,GAAG;YACH,QAAQ,EAAE,OAAO;YACjB,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG;YACnD,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;YAC1B,OAAO,EAAE,SAAS;SAClB,CAAC,CAAC;QACH,OAAO;YACN,QAAQ,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC;YAC5B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;SAChC,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO;YACN,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAC9D,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAC7D,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;SAChC,CAAC;IACH,CAAC;AACF,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY;IACxC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACrE,OAAO,CACN,MAAM,CAAC,QAAQ,KAAK,CAAC;QACrB,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CACrC,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAe;IACnC,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC5C,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAC5B,CAAC,OAAO,EAAE,EAAE,CACX,UAAU,KAAK,OAAO;YACtB,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC;YAC9B,UAAU,CAAC,QAAQ,CAAC,IAAI,OAAO,EAAE,CAAC,CACnC,CAAC;IACH,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACpC,MAAM,MAAM,GAAG,UAAU,CACxB,KAAK,EACL,CAAC,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,wBAAwB,CAAC,EAC7D,IAAI,CACJ,CAAC;IACF,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO;YACN,EAAE,EAAE,KAAK;YACT,KAAK,EACJ,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;gBACpB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;gBACpB,6BAA6B;YAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ;SACzB,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,CACxB,MAAM,CAAC,MAAM;SACX,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CACjB,CAAC;IACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACrC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO;YACN,EAAE,EAAE,KAAK;YACT,KAAK,EACJ,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;gBACpB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;gBACpB,8BAA8B;YAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;SACzB,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,CACxB,MAAM,CAAC,MAAM;SACX,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CACjB,CAAC;IACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,iBAAiB,CACzB,UAA+B;IAE/B,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;IAClC,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IACnC,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC5C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC/C,IAAI,uBAAuB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAClD,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,+BAA+B;gBACvC,WAAW,EAAE,UAAU;aACvB,CAAC;QACH,CAAC;QACD,IAAI,sBAAsB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACjD,OAAO;gBACN,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,gCAAgC;gBACxC,WAAW,EAAE,SAAS;aACtB,CAAC;QACH,CAAC;IACF,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,aAAa,CACrB,IAAY;IAEZ,IAAI,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACzC,CAAC;IACD,IAAI,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;IACvD,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,KAAe,EAAE,IAAY;IAChD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,OAAO;YACN,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;YAChC,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,mBAAmB;SAC3B,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG;QACZ,GAAG,GAAG,CAAC,IAAI;QACX,MAAM;QACN,UAAU;QACV,WAAW;QACX,UAAU;QACV,MAAM;QACN,QAAQ;QACR,2BAA2B;QAC3B,SAAS;QACT,WAAW;QACX,GAAG;QACH,QAAQ;QACR,GAAG;QACH,eAAe;QACf,yBAAyB;QACzB,GAAG,WAAW;QACd,GAAG;KACH,CAAC;IACF,wFAAwF;IACxF,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE;QAC3D,oBAAoB,EAAE,KAAK;KAC3B,CAAC,CAAC;IACH,OAAO;QACN,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU;KAC7B,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAY,EAAE,KAAe;IAC5D,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,2BAA2B,CAAC,CAAC,CAAC;IAC5E,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5B,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACtE,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YACzB,wCAAwC;YACxC,SAAS;QACV,CAAC;QACD,IAAI,CAAC;YACJ,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACR,4CAA4C;QAC7C,CAAC;IACF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,KAAe;IACrD,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACrE,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACvC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,SAAS;QACV,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5B,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC;YACJ,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACR,0CAA0C;QAC3C,CAAC;IACF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,KAAe,EAAE,IAAY;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO;YACN,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;YAChC,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,UAAU;SAClB,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,CAAC,SAAS,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;QAC9B,OAAO;YACN,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;YAChC,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,2BAA2B;SACnC,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,SAAS;QACrB,CAAC,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;QAC1C,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACzE,OAAO;QACN,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU;KAC7B,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAe,EAAE,IAAY;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC;QACxC,OAAO;YACN,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;YAChC,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,0BAA0B;SAClC,CAAC;IACH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO;YACN,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;YAChC,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,UAAU;SAClB,CAAC;IACH,CAAC;IAED,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,CAAC;QACJ,OAAO,GAAG,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO;gBACN,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE,CAAC;gBACX,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,EAAE;gBACV,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;gBAChC,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,UAAU;aAClB,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,CACxB,YAAY,EACZ,CAAC,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,EACpE,OAAO,CACP,CAAC;QACF,OAAO;YACN,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,UAAU,EAAE,MAAM,CAAC,UAAU;SAC7B,CAAC;IACH,CAAC;YAAS,CAAC;QACV,IAAI,OAAO,EAAE,CAAC;YACb,IAAI,CAAC;gBACJ,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,CAAC;YAAC,MAAM,CAAC;gBACR,sBAAsB;YACvB,CAAC;QACF,CAAC;IACF,CAAC;AACF,CAAC;AA0BD,MAAM,kBAAkB,GACvB;IACC,kBAAkB;IAClB,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,sBAAsB,EAAE;IACzD;QACC,IAAI,EAAE,gBAAgB;QACtB,8DAA8D;QAC9D,KAAK,EACJ,+FAA+F;KAChG;IACD;QACC,IAAI,EAAE,mBAAmB;QACzB,KAAK,EAAE,0BAA0B;KACjC;IACD;QACC,IAAI,EAAE,iBAAiB;QACvB,8EAA8E;QAC9E,gCAAgC;QAChC,mCAAmC;QACnC,sCAAsC;QACtC,kBAAkB;QAClB,oBAAoB;QACpB,KAAK,EACJ,4IAA4I;KAC7I;IACD;QACC,IAAI,EAAE,aAAa;QACnB,gEAAgE;QAChE,oCAAoC;QACpC,oCAAoC;QACpC,+DAA+D;QAC/D,KAAK,EAAE,kEAAkE;KACzE;IACD;QACC,IAAI,EAAE,cAAc;QACpB,uEAAuE;QACvE,uDAAuD;QACvD,KAAK,EAAE,+DAA+D;KACtE;IACD;QACC,IAAI,EAAE,cAAc;QACpB,2CAA2C;QAC3C,KAAK,EAAE,8BAA8B;KACrC;IACD;QACC,IAAI,EAAE,gBAAgB;QACtB,kCAAkC;QAClC,KAAK,EAAE,2BAA2B;KAClC;IACD;QACC,IAAI,EAAE,YAAY;QAClB,0EAA0E;QAC1E,KAAK,EAAE,2CAA2C;KAClD;IACD;QACC,IAAI,EAAE,gBAAgB;QACtB,kDAAkD;QAClD,KAAK,EAAE,yBAAyB;KAChC;IACD;QACC,IAAI,EAAE,kBAAkB;QACxB,+BAA+B;QAC/B,KAAK,EAAE,gDAAgD;KACvD;IACD;QACC,IAAI,EAAE,mBAAmB;QACzB,wCAAwC;QACxC,KAAK,EACJ,oFAAoF;KACrF;IACD;QACC,IAAI,EAAE,iBAAiB;QACvB,gDAAgD;QAChD,KAAK,EACJ,6FAA6F;KAC9F;IACD;QACC,IAAI,EAAE,+BAA+B;QACrC,wDAAwD;QACxD,kFAAkF;QAClF,KAAK,EACJ,mFAAmF;KACpF;IACD;QACC,IAAI,EAAE,WAAW;QACjB,kDAAkD;QAClD,oFAAoF;QACpF,KAAK,EACJ,sEAAsE;KACvE;CACD,CAAC;AAEH,MAAM,sBAAsB,GAC3B,kSAAkS,CAAC;AAEpS,MAAM,8BAA8B,GAAG,MAAM,CAAC,GAAG,CAAA,2EAA2E,CAAC;AAC7H,MAAM,iCAAiC,GAAG,MAAM,CAAC,GAAG,CAAA,2HAA2H,CAAC;AAEhL,MAAM,iBAAiB,GAKlB;IACJ;QACC,IAAI,EAAE,iCAAiC;QACvC,yEAAyE;QACzE,kEAAkE;QAClE,KAAK,EACJ,2EAA2E;QAC5E,uBAAuB,EAAE,IAAI;KAC7B;IACD;QACC,IAAI,EAAE,mCAAmC;QACzC,KAAK,EACJ,+GAA+G;QAChH,uBAAuB,EAAE,IAAI;KAC7B;IACD;QACC,IAAI,EAAE,uCAAuC;QAC7C,KAAK,EAAE,qCAAqC;QAC5C,uBAAuB,EAAE,IAAI;KAC7B;IACD;QACC,IAAI,EAAE,wBAAwB;QAC9B,KAAK,EACJ,uEAAuE;QACxE,uBAAuB,EAAE,IAAI;KAC7B;IACD;QACC,IAAI,EAAE,gDAAgD;QACtD,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CACrB,IAAI,MAAM,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;YAC9D,IAAI,MAAM,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;KAClE;CACD,CAAC;AAEF,MAAM,UAAU,uBAAuB,CACtC,QAAgB;IAEhB,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;QAC1C,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;IACF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC9C,QAAgB;IAEhB,MAAM,OAAO,GAAmC,EAAE,CAAC;IACnD,MAAM,kBAAkB,GAAG,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjE,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;QACzC,IAAI,OAAO,CAAC,uBAAuB,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5D,SAAS;QACV,CAAC;QACD,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;IACF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,wBAAwB,CAChC,KAAe,EACf,IAAY;IAEZ,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,cAAc,GAAG;QACtB,+CAA+C;QAC/C,4BAA4B;KAC5B,CAAC;IAEF,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;QAC9B,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC9D,SAAS;QACV,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,SAAS;QACpC,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACJ,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACjC,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;gBAClC,SAAS;YACV,CAAC;YACD,QAAQ,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACR,SAAS;QACV,CAAC;QACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAS;QACtC,KAAK,MAAM,KAAK,IAAI,+BAA+B,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/D,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,QAAQ,EAAE,CAAC,CAAC;QACxC,CAAC;IACF,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACtB,OAAO;YACN,IAAI,EAAE,oBAAoB;YAC1B,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;SAChC,CAAC;IACH,CAAC;IACD,OAAO;QACN,IAAI,EAAE,oBAAoB;QAC1B,QAAQ,EAAE,CAAC;QACX,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QAC3B,MAAM,EACL,8JAA8J;QAC/J,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;KAChC,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAe,EAAE,IAAY;IACtD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,cAAc,GAAG;QACtB,2CAA2C;QAC3C,2CAA2C;QAC3C,6DAA6D;QAC7D,mDAAmD;QACnD,2CAA2C;QAC3C,qCAAqC;QACrC,4CAA4C;QAC5C,oCAAoC;QACpC,sDAAsD;QACtD,mEAAmE;QACnE,4BAA4B;KAC5B,CAAC;IAEF,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;QAC9B,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC9D,SAAS;QACV,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,SAAS;QACpC,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACJ,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACjC,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;gBAClC,SAAS;YACV,CAAC;YACD,QAAQ,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACR,SAAS;QACV,CAAC;QACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAS,CAAC,gBAAgB;QACvD,KAAK,MAAM,KAAK,IAAI,uBAAuB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvD,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,QAAQ,EAAE,CAAC,CAAC;QACxC,CAAC;IACF,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACtB,OAAO;YACN,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;SAChC,CAAC;IACH,CAAC;IACD,OAAO;QACN,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,CAAC;QACX,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QAC3B,MAAM,EAAE,EAAE;QACV,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;KAChC,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CACpB,MAAsB,EACtB,KAAe,EACf,KAA2B,EAC3B,MAAwB,EACxB,UAAmB;IAEnB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,qBAAqB,UAAU,IAAI,UAAU,GAAG,CAAC;IACzD,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,iBAAiB,CAAC;IAC7E,MAAM,MAAM,GACX,MAAM,KAAK,QAAQ;QAClB,CAAC,CAAC,iBAAiB;QACnB,CAAC,CAAC,MAAM,KAAK,QAAQ;YACpB,CAAC,CAAC,yBAAyB;YAC3B,CAAC,CAAC,gBAAgB,CAAC;IACtB,MAAM,GAAG,GAAG,KAAK;SACf,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;SAC/B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;SACxB,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,MAAM,OAAO,GAAG,KAAK;SACnB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;SAC9B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;SACxB,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,MAAM,WAAW,GAChB,GAAG,IAAI,OAAO;QACb,CAAC,CAAC,GAAG,GAAG,cAAc,OAAO,GAAG;QAChC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClD,OAAO,GAAG,MAAM,OAAO,KAAK,CAAC,MAAM,IAAI,SAAS,GAC/C,WAAW,CAAC,CAAC,CAAC,UAAU,WAAW,EAAE,CAAC,CAAC,CAAC,EACzC,EAAE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAyB;IAC7D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3B,KAAK,CAAC,IAAI,CACT,WAAW,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,MAAM,gBAClD,MAAM,CAAC,UACR,IAAI,CACJ,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvC,MAAM,MAAM,GACX,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM;YAC1B,CAAC,CAAC,YAAY,IAAI,CAAC,MAAM,GAAG;YAC5B,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC;gBACpB,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC;oBACpB,CAAC,CAAC,UAAU;oBACZ,CAAC,CAAC,OAAO,CAAC;QACd,KAAK,CAAC,IAAI,CACT,KAAK,IAAI,CAAC,IAAI,KAAK,MAAM,KAAK,IAAI,CAAC,UAAU,KAC5C,IAAI,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EACnD,GAAG,CACH,CAAC;QACF,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC/C,CAAC;IACF,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,MAAM,GACX,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,KAAK,CAAC,IAAI,CAAC,UAAU,OAAO,GAAG,MAAM,EAAE,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAA2B;IACrD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;IAC1E,IAAI,QAAQ;QAAE,OAAO,OAAO,CAAC;IAC7B,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAC7B,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC,CAC9C,CAAC;IACF,IAAI,WAAW;QAAE,OAAO,QAAQ,CAAC;IACjC,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAIjD,MAAM,aAAa,GAAG,0CAA0C,CAAC;IACjE,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC9C,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC3D,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnB,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC;IAC3E,CAAC;IAED,MAAM,mBAAmB,GAA4C;QACpE,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE;QAC3C;YACC,KAAK,EAAE,4CAA4C;YACnD,KAAK,EAAE,OAAO;SACd;QACD,EAAE,KAAK,EAAE,2BAA2B,EAAE,KAAK,EAAE,cAAc,EAAE;QAC7D,EAAE,KAAK,EAAE,qBAAqB,EAAE,KAAK,EAAE,WAAW,EAAE;QACpD,EAAE,KAAK,EAAE,0BAA0B,EAAE,KAAK,EAAE,YAAY,EAAE;QAC1D,EAAE,KAAK,EAAE,4BAA4B,EAAE,KAAK,EAAE,cAAc,EAAE;QAC9D,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE;QACrC,EAAE,KAAK,EAAE,wBAAwB,EAAE,KAAK,EAAE,eAAe,EAAE;KAC3D,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,mBAAmB,EAAE,CAAC;QAC3C,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QACtD,CAAC;IACF,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAChC,UAA8B,EAAE;IAEhC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC;IAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IAClE,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QACzB,MAAM,MAAM,GAAsB;YACjC,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE,CAAC;YACX,SAAS;YACT,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YAClC,MAAM;YACN,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,YAAY,EAAE,CAAC;YACf,OAAO,EAAE,oCAAoC;YAC7C,UAAU,EAAE,UAAU,CAAC,MAAM,IAAI,UAAU;YAC3C,WAAW,EAAE,EAAE;SACf,CAAC;QACF,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC1B,OAAO,MAAM,CAAC;IACf,CAAC;IAED,MAAM,WAAW,GAChB,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IACnE,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;QACrB,MAAM,MAAM,GAAsB;YACjC,MAAM,EAAE,OAAO;YACf,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,SAAS;YACT,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YAClC,MAAM;YACN,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,YAAY,EAAE,CAAC;YACf,OAAO,EAAE,WAAW,CAAC,KAAK;YAC1B,WAAW,EAAE,EAAE;SACf,CAAC;QACF,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC1B,OAAO,MAAM,CAAC;IACf,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC;IAChC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,MAAM,GAAsB;YACjC,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE,CAAC;YACX,SAAS;YACT,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YAClC,MAAM;YACN,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,YAAY,EAAE,CAAC;YACf,OAAO,EAAE,kBAAkB;YAC3B,UAAU,EAAE,UAAU;YACtB,WAAW,EAAE,EAAE;SACf,CAAC;QACF,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC1B,OAAO,MAAM,CAAC;IACf,CAAC;IAED,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACzB,WAAW,GAAG,sBAAsB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAClD,IAAI,WAAW,EAAE,CAAC;YACjB,QAAQ,GAAG,WAAW,CAAC;QACxB,CAAC;IACF,CAAC;IAED,MAAM,MAAM,GAAG,qBAAqB,CAAC;QACpC,IAAI;QACJ,MAAM,EAAE,OAAO,CAAC,MAAM;KACtB,CAAC,CAAC;IAEH,MAAM,WAAW,GAAyB,EAAE,CAAC;IAE7C,IAAI,MAAM,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC;QACpC,WAAW,CAAC,IAAI,CAAC,wBAAwB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAC1B,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,QAAQ,GAA8B,IAAI,CAAC;IAC/C,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QAC7B,MAAM,gBAAgB,GAAG,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACxD,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAC/B,QAAQ,GAAG,gBAAgB,CAAC;QAC7B,CAAC;IACF,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QAC1C,MAAM,aAAa,GAAG,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;YAC5B,QAAQ,GAAG,aAAa,CAAC;QAC1B,CAAC;IACF,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QAC7C,QAAQ,GAAG,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACd,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,QAAQ,GACb,MAAM,KAAK,QAAQ;QAClB,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC,CAAC;YACjE,EAAE,QAAQ,IAAI,CAAC,CAAC,CAAC;IAErB,MAAM,MAAM,GAAsB;QACjC,MAAM;QACN,QAAQ;QACR,SAAS;QACT,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;QAClC,MAAM;QACN,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,YAAY,EAAE,KAAK,CAAC,MAAM;QAC1B,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK;QACxC,OAAO,EAAE,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC;QACzD,WAAW;KACX,CAAC;IAEF,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAE1B,IAAI,WAAW,EAAE,CAAC;QACjB,IAAI,CAAC;YACJ,MAAM,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACR,sBAAsB;QACvB,CAAC;IACF,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC","sourcesContent":["import { spawnSync } from \"node:child_process\";\nimport {\n\tcopyFileSync,\n\texistsSync,\n\tmkdirSync,\n\tmkdtempSync,\n\treadFileSync,\n\trmSync,\n\tstatSync,\n\twriteFileSync,\n} from \"node:fs\";\nimport os from \"node:os\";\nimport { dirname, join, resolve } from \"node:path\";\nimport { resolveGuardianConfig } from \"./config.js\";\nimport { loadGuardianState, recordGuardianRun } from \"./state.js\";\nimport { DEFAULT_EXCLUDES } from \"./types.js\";\nimport type {\n\tGuardianEnablement,\n\tGuardianRunOptions,\n\tGuardianRunResult,\n\tGuardianStatus,\n\tGuardianToolResult,\n} from \"./types.js\";\n\nconst GUARDIAN_DISABLE_VALUES = [\"0\", \"false\", \"off\", \"no\"];\nconst GUARDIAN_ENABLE_VALUES = [\"1\", \"true\", \"on\"];\nconst DEFAULT_TIMEOUT_MS = 10_000;\n\ntype FileListResult =\n\t| { ok: true; files: string[] }\n\t| { ok: false; error: string; exitCode: number };\n\ntype CommandResult = {\n\texitCode: number;\n\tstdout: string;\n\tstderr: string;\n\terror?: string;\n\tdurationMs: number;\n};\n\nfunction commandExists(command: string, cwd: string): boolean {\n\tconst result = spawnSync(command, [\"--version\"], {\n\t\tcwd,\n\t\tstdio: \"pipe\",\n\t\tencoding: \"utf-8\",\n\t});\n\treturn (result.status ?? 1) === 0;\n}\n\nfunction runCommand(\n\tcommand: string,\n\targs: string[],\n\tcwd: string,\n\ttimeoutMs = DEFAULT_TIMEOUT_MS,\n\tenv?: NodeJS.ProcessEnv,\n): CommandResult {\n\tconst started = Date.now();\n\ttry {\n\t\tconst result = spawnSync(command, args, {\n\t\t\tcwd,\n\t\t\tencoding: \"utf-8\",\n\t\t\tenv: env ? { ...process.env, ...env } : process.env,\n\t\t\tmaxBuffer: 8 * 1024 * 1024,\n\t\t\ttimeout: timeoutMs,\n\t\t});\n\t\treturn {\n\t\t\texitCode: result.status ?? 1,\n\t\t\tstdout: result.stdout ?? \"\",\n\t\t\tstderr: result.stderr ?? \"\",\n\t\t\tdurationMs: Date.now() - started,\n\t\t};\n\t} catch (error) {\n\t\treturn {\n\t\t\texitCode: 1,\n\t\t\tstdout: \"\",\n\t\t\tstderr: error instanceof Error ? error.message : String(error),\n\t\t\terror: error instanceof Error ? error.message : String(error),\n\t\t\tdurationMs: Date.now() - started,\n\t\t};\n\t}\n}\n\nfunction hasGitSecretsPlugin(root: string): boolean {\n\tconst result = runCommand(\"git\", [\"secrets\", \"--help\"], root, 4_000);\n\treturn (\n\t\tresult.exitCode === 0 ||\n\t\tresult.stderr.includes(\"git secrets\") ||\n\t\tresult.stdout.includes(\"git secrets\")\n\t);\n}\n\nfunction filterFiles(files: string[]): string[] {\n\treturn files.filter((file) => {\n\t\tconst normalized = file.replace(/\\\\/g, \"/\");\n\t\treturn !DEFAULT_EXCLUDES.some(\n\t\t\t(exclude) =>\n\t\t\t\tnormalized === exclude ||\n\t\t\t\tnormalized.startsWith(exclude) ||\n\t\t\t\tnormalized.includes(`/${exclude}`),\n\t\t);\n\t});\n}\n\nfunction listStagedFiles(root: string): FileListResult {\n\tconst result = runCommand(\n\t\t\"git\",\n\t\t[\"diff\", \"--name-only\", \"--cached\", \"--diff-filter=ACMRTUXB\"],\n\t\troot,\n\t);\n\tif (result.exitCode !== 0) {\n\t\treturn {\n\t\t\tok: false,\n\t\t\terror:\n\t\t\t\tresult.stderr.trim() ||\n\t\t\t\tresult.stdout.trim() ||\n\t\t\t\t\"Unable to list staged files\",\n\t\t\texitCode: result.exitCode,\n\t\t};\n\t}\n\tconst files = filterFiles(\n\t\tresult.stdout\n\t\t\t.split(\"\\n\")\n\t\t\t.map((line) => line.trim())\n\t\t\t.filter(Boolean),\n\t);\n\treturn { ok: true, files };\n}\n\nfunction listTrackedFiles(root: string): FileListResult {\n\tconst result = runCommand(\"git\", [\"ls-files\"], root);\n\tif (result.exitCode !== 0) {\n\t\treturn {\n\t\t\tok: false,\n\t\t\terror:\n\t\t\t\tresult.stderr.trim() ||\n\t\t\t\tresult.stdout.trim() ||\n\t\t\t\t\"Unable to list tracked files\",\n\t\t\texitCode: result.exitCode,\n\t\t};\n\t}\n\tconst files = filterFiles(\n\t\tresult.stdout\n\t\t\t.split(\"\\n\")\n\t\t\t.map((line) => line.trim())\n\t\t\t.filter(Boolean),\n\t);\n\treturn { ok: true, files };\n}\n\nfunction resolveEnablement(\n\trespectEnv: boolean | undefined,\n): GuardianEnablement {\n\tconst state = loadGuardianState();\n\tif (!respectEnv) {\n\t\treturn { enabled: state.enabled };\n\t}\n\tconst rawEnv = process.env.MAESTRO_GUARDIAN;\n\tif (typeof rawEnv === \"string\" && rawEnv.trim().length > 0) {\n\t\tconst normalized = rawEnv.trim().toLowerCase();\n\t\tif (GUARDIAN_DISABLE_VALUES.includes(normalized)) {\n\t\t\treturn {\n\t\t\t\tenabled: false,\n\t\t\t\treason: \"MAESTRO_GUARDIAN=0 (disabled)\",\n\t\t\t\tenvOverride: \"disabled\",\n\t\t\t};\n\t\t}\n\t\tif (GUARDIAN_ENABLE_VALUES.includes(normalized)) {\n\t\t\treturn {\n\t\t\t\tenabled: true,\n\t\t\t\treason: \"MAESTRO_GUARDIAN=1 (forced on)\",\n\t\t\t\tenvOverride: \"enabled\",\n\t\t\t};\n\t\t}\n\t}\n\treturn { enabled: state.enabled };\n}\n\nfunction locateSemgrep(\n\troot: string,\n): { command: string; args: string[] } | null {\n\tif (commandExists(\"semgrep\", root)) {\n\t\treturn { command: \"semgrep\", args: [] };\n\t}\n\tif (commandExists(\"npx\", root)) {\n\t\treturn { command: \"npx\", args: [\"--yes\", \"semgrep\"] };\n\t}\n\treturn null;\n}\n\nfunction runSemgrep(files: string[], root: string): GuardianToolResult {\n\tconst started = Date.now();\n\tconst cmd = locateSemgrep(root);\n\tif (!cmd) {\n\t\treturn {\n\t\t\ttool: \"semgrep\",\n\t\t\texitCode: 0,\n\t\t\tstdout: \"\",\n\t\t\tstderr: \"\",\n\t\t\tdurationMs: Date.now() - started,\n\t\t\tskipped: true,\n\t\t\treason: \"semgrep not found\",\n\t\t};\n\t}\n\tconst includeArgs = files.flatMap((file) => [\"--include\", file]);\n\tconst args = [\n\t\t...cmd.args,\n\t\t\"scan\",\n\t\t\"--config\",\n\t\t\"p/secrets\",\n\t\t\"--config\",\n\t\t\"p/ci\",\n\t\t\"--json\",\n\t\t\"--skip-unknown-extensions\",\n\t\t\"--error\",\n\t\t\"--timeout\",\n\t\t\"7\",\n\t\t\"--jobs\",\n\t\t\"1\",\n\t\t\"--metrics=off\",\n\t\t\"--disable-version-check\",\n\t\t...includeArgs,\n\t\t\".\",\n\t];\n\t// Semgrep can take longer on larger workspaces; allow up to 2 minutes before timing out\n\tconst result = runCommand(cmd.command, args, root, 120_000, {\n\t\tSEMGREP_SEND_METRICS: \"off\",\n\t});\n\treturn {\n\t\ttool: \"semgrep\",\n\t\texitCode: result.exitCode,\n\t\tstdout: result.stdout,\n\t\tstderr: result.stderr,\n\t\tdurationMs: result.durationMs,\n\t};\n}\n\nfunction materializeStagedFiles(root: string, files: string[]): string | null {\n\tconst tempDir = mkdtempSync(join(os.tmpdir(), \"composer-guardian-staged-\"));\n\tfor (const relative of files) {\n\t\tconst target = join(tempDir, relative);\n\t\tconst dir = dirname(target);\n\t\tmkdirSync(dir, { recursive: true });\n\t\tconst show = runCommand(\"git\", [\"show\", `:${relative}`], root, 5_000);\n\t\tif (show.exitCode !== 0) {\n\t\t\t// skip files we fail to read from index\n\t\t\tcontinue;\n\t\t}\n\t\ttry {\n\t\t\twriteFileSync(target, show.stdout, \"utf-8\");\n\t\t} catch {\n\t\t\t// ignore write errors for problematic files\n\t\t}\n\t}\n\treturn tempDir;\n}\n\nfunction copyFilesToTemp(root: string, files: string[]): string | null {\n\tif (!files.length) return null;\n\tconst tempDir = mkdtempSync(join(os.tmpdir(), \"composer-guardian-\"));\n\tfor (const relative of files) {\n\t\tconst source = resolve(root, relative);\n\t\tif (!existsSync(source)) {\n\t\t\tcontinue;\n\t\t}\n\t\tconst target = join(tempDir, relative);\n\t\tconst dir = dirname(target);\n\t\tmkdirSync(dir, { recursive: true });\n\t\ttry {\n\t\t\tcopyFileSync(source, target);\n\t\t} catch {\n\t\t\t// ignore copy errors; file may be removed\n\t\t}\n\t}\n\treturn tempDir;\n}\n\nfunction runGitSecrets(files: string[], root: string): GuardianToolResult {\n\tconst started = Date.now();\n\tif (!files.length) {\n\t\treturn {\n\t\t\ttool: \"git-secrets\",\n\t\t\texitCode: 0,\n\t\t\tstdout: \"\",\n\t\t\tstderr: \"\",\n\t\t\tdurationMs: Date.now() - started,\n\t\t\tskipped: true,\n\t\t\treason: \"no files\",\n\t\t};\n\t}\n\n\tconst hasBinary = commandExists(\"git-secrets\", root);\n\tconst hasPlugin = !hasBinary && hasGitSecretsPlugin(root);\n\tif (!hasBinary && !hasPlugin) {\n\t\treturn {\n\t\t\ttool: \"git-secrets\",\n\t\t\texitCode: 0,\n\t\t\tstdout: \"\",\n\t\t\tstderr: \"\",\n\t\t\tdurationMs: Date.now() - started,\n\t\t\tskipped: true,\n\t\t\treason: \"git-secrets not installed\",\n\t\t};\n\t}\n\n\tconst args = hasBinary\n\t\t? [\"--scan\", \"--no-index\", \"--\", ...files]\n\t\t: [\"secrets\", \"--scan\", \"--no-index\", \"--\", ...files];\n\tconst result = runCommand(hasBinary ? \"git-secrets\" : \"git\", args, root);\n\treturn {\n\t\ttool: \"git-secrets\",\n\t\texitCode: result.exitCode,\n\t\tstdout: result.stdout,\n\t\tstderr: result.stderr,\n\t\tdurationMs: result.durationMs,\n\t};\n}\n\nfunction runTrufflehog(files: string[], root: string): GuardianToolResult {\n\tconst started = Date.now();\n\tif (!commandExists(\"trufflehog\", root)) {\n\t\treturn {\n\t\t\ttool: \"trufflehog\",\n\t\t\texitCode: 0,\n\t\t\tstdout: \"\",\n\t\t\tstderr: \"\",\n\t\t\tdurationMs: Date.now() - started,\n\t\t\tskipped: true,\n\t\t\treason: \"trufflehog not installed\",\n\t\t};\n\t}\n\tif (!files.length) {\n\t\treturn {\n\t\t\ttool: \"trufflehog\",\n\t\t\texitCode: 0,\n\t\t\tstdout: \"\",\n\t\t\tstderr: \"\",\n\t\t\tdurationMs: Date.now() - started,\n\t\t\tskipped: true,\n\t\t\treason: \"no files\",\n\t\t};\n\t}\n\n\tlet tempDir: string | null = null;\n\ttry {\n\t\ttempDir = copyFilesToTemp(root, files);\n\t\tif (!tempDir) {\n\t\t\treturn {\n\t\t\t\ttool: \"trufflehog\",\n\t\t\t\texitCode: 0,\n\t\t\t\tstdout: \"\",\n\t\t\t\tstderr: \"\",\n\t\t\t\tdurationMs: Date.now() - started,\n\t\t\t\tskipped: true,\n\t\t\t\treason: \"no files\",\n\t\t\t};\n\t\t}\n\t\tconst result = runCommand(\n\t\t\t\"trufflehog\",\n\t\t\t[\"filesystem\", \"--no-update\", \"--fail\", \"--json\", \"--path\", tempDir],\n\t\t\ttempDir,\n\t\t);\n\t\treturn {\n\t\t\ttool: \"trufflehog\",\n\t\t\texitCode: result.exitCode,\n\t\t\tstdout: result.stdout,\n\t\t\tstderr: result.stderr,\n\t\t\tdurationMs: result.durationMs,\n\t\t};\n\t} finally {\n\t\tif (tempDir) {\n\t\t\ttry {\n\t\t\t\trmSync(tempDir, { recursive: true, force: true });\n\t\t\t} catch {\n\t\t\t\t// best effort cleanup\n\t\t\t}\n\t\t}\n\t}\n}\n\nexport type HeuristicFindingName =\n\t| \"AWS access key\"\n\t| \"AWS secret key\"\n\t| \"Private key block\"\n\t| \"Generic API key\"\n\t| \"Slack token\"\n\t| \"GitHub token\"\n\t| \"GitLab token\"\n\t| \"Google API key\"\n\t| \"Stripe key\"\n\t| \"OpenAI API key\"\n\t| \"SendGrid API key\"\n\t| \"Twilio auth token\"\n\t| \"Discord webhook\"\n\t| \"Database URL with credentials\"\n\t| \"JWT token\";\n\nexport type EvidenceIntegrityFindingName =\n\t| \"Synthetic production commit SHA\"\n\t| \"Synthetic production PR reference\"\n\t| \"Synthetic local GitHub Actions run ID\"\n\t| \"Local proof identifier\"\n\t| \"Replay artifact claimed as production evidence\";\n\nconst HEURISTIC_PATTERNS: Array<{ name: HeuristicFindingName; regex: RegExp }> =\n\t[\n\t\t// AWS credentials\n\t\t{ name: \"AWS access key\", regex: /\\bAKIA[0-9A-Z]{16}\\b/ },\n\t\t{\n\t\t\tname: \"AWS secret key\",\n\t\t\t// AWS secret keys are 40 characters of base64-like characters\n\t\t\tregex:\n\t\t\t\t/(?:aws_secret_access_key|secret_access_key|aws_secret)\\s*[:=]\\s*['\"]?[A-Za-z0-9/+=]{40}['\"]?/i,\n\t\t},\n\t\t{\n\t\t\tname: \"Private key block\",\n\t\t\tregex: /BEGIN [A-Z ]*PRIVATE KEY/,\n\t\t},\n\t\t{\n\t\t\tname: \"Generic API key\",\n\t\t\t// Avoid matching natural language inside string literals while still catching\n\t\t\t// typical config patterns like:\n\t\t\t//   token: \"....\" / token = \"....\"\n\t\t\t//   apiKey: \"....\" / api_key = \"....\"\n\t\t\t// And JSON-style:\n\t\t\t//   \"token\": \"....\"\n\t\t\tregex:\n\t\t\t\t/(?:(?<!['\"])\\b(?:api[_-]?key|token)\\b\\s*[:=]\\s*['\"][A-Za-z0-9_-]{20,}['\"]|['\"](?:api[_-]?key|token)['\"]\\s*:\\s*['\"][A-Za-z0-9_-]{20,}['\"])/i,\n\t\t},\n\t\t{\n\t\t\tname: \"Slack token\",\n\t\t\t// Slack tokens are typically segmented and include numeric IDs:\n\t\t\t//   xoxb-<digits>-<digits>-<secret>\n\t\t\t//   xapp-<digits>-<digits>-<secret>\n\t\t\t// Use a stricter shape to avoid false positives in tests/docs.\n\t\t\tregex: /\\b(?:xox[baprs]|xapp)-\\d{6,}(?:-\\d{6,}){1,2}-[A-Za-z0-9-]{10,}\\b/,\n\t\t},\n\t\t{\n\t\t\tname: \"GitHub token\",\n\t\t\t// GitHub tokens: ghp_ (personal), gho_ (OAuth), ghu_ (user-to-server),\n\t\t\t// ghs_ (server-to-server), ghr_ (refresh), github_pat_\n\t\t\tregex: /\\b(?:ghp_|gho_|ghu_|ghs_|ghr_|github_pat_)[A-Za-z0-9_]{36,}\\b/,\n\t\t},\n\t\t{\n\t\t\tname: \"GitLab token\",\n\t\t\t// GitLab personal access tokens: glpat-...\n\t\t\tregex: /\\bglpat-[A-Za-z0-9_-]{20,}\\b/,\n\t\t},\n\t\t{\n\t\t\tname: \"Google API key\",\n\t\t\t// Google API keys start with AIza\n\t\t\tregex: /\\bAIza[A-Za-z0-9_-]{35}\\b/,\n\t\t},\n\t\t{\n\t\t\tname: \"Stripe key\",\n\t\t\t// Stripe keys: sk_live_, pk_live_, sk_test_, pk_test_, rk_live_, rk_test_\n\t\t\tregex: /\\b[spr]k_(?:live|test)_[A-Za-z0-9]{24,}\\b/,\n\t\t},\n\t\t{\n\t\t\tname: \"OpenAI API key\",\n\t\t\t// OpenAI keys: sk-... (typically 48+ chars total)\n\t\t\tregex: /\\bsk-[A-Za-z0-9]{32,}\\b/,\n\t\t},\n\t\t{\n\t\t\tname: \"SendGrid API key\",\n\t\t\t// SendGrid keys start with SG.\n\t\t\tregex: /\\bSG\\.[A-Za-z0-9_-]{22,}\\.[A-Za-z0-9_-]{22,}\\b/,\n\t\t},\n\t\t{\n\t\t\tname: \"Twilio auth token\",\n\t\t\t// Twilio auth tokens in config patterns\n\t\t\tregex:\n\t\t\t\t/twilio[_-]?(?:auth[_-]?token|account[_-]?sid)\\s*[:=]\\s*['\"]?[A-Za-z0-9]{32,}['\"]?/i,\n\t\t},\n\t\t{\n\t\t\tname: \"Discord webhook\",\n\t\t\t// Discord webhook URLs contain sensitive tokens\n\t\t\tregex:\n\t\t\t\t/https:\\/\\/(?:discord(?:app)?\\.com|canary\\.discord\\.com)\\/api\\/webhooks\\/\\d+\\/[A-Za-z0-9_-]+/,\n\t\t},\n\t\t{\n\t\t\tname: \"Database URL with credentials\",\n\t\t\t// Database connection strings with embedded credentials\n\t\t\t// postgres://user:password@host, mysql://user:pass@host, mongodb://user:pass@host\n\t\t\tregex:\n\t\t\t\t/\\b(?:postgres(?:ql)?|mysql|mongodb(?:\\+srv)?|redis):\\/\\/[^\\s:]+:[^\\s@]+@[^\\s'\"]+/i,\n\t\t},\n\t\t{\n\t\t\tname: \"JWT token\",\n\t\t\t// JWT tokens have a distinctive structure: eyJ...\n\t\t\t// Only flag if it looks like a real token (has all three parts with decent lengths)\n\t\t\tregex:\n\t\t\t\t/\\beyJ[A-Za-z0-9_-]{20,}\\.eyJ[A-Za-z0-9_-]{20,}\\.[A-Za-z0-9_-]{20,}\\b/,\n\t\t},\n\t];\n\nconst EVIDENCE_CONTEXT_REGEX =\n\t/(?<![A-Za-z0-9_-])(?:production[\\s_-]+evidence|productionEvidence|production[\\s_-]+proof|productionProof|live[\\s_-]+evidence|liveEvidence|live[\\s_-]+proof|liveProof|dereferenceable|evidence[\\s_-]+bundle|evidenceBundle|deploy-verifier|hard[_-]identifiers|hardIdentifiers)(?![A-Za-z0-9_-])/i;\n\nconst REPLAY_EVIDENCE_MARKER_PATTERN = String.raw`(?:\\bdeterministic_replay\\b|(?<![A-Za-z0-9_])[\"']?replay[\"']?\\s*:\\s*true)`;\nconst PRODUCTION_EVIDENCE_CLAIM_PATTERN = String.raw`(?<![A-Za-z0-9_-])[\"']?(?:production[_-]?evidence|live[_-]?proof)[\"']?\\s*:\\s*[\"']?(?:true|verified)[\"']?(?![A-Za-z0-9_-])`;\n\nconst EVIDENCE_PATTERNS: Array<{\n\tname: EvidenceIntegrityFindingName;\n\tregex?: RegExp;\n\tmatches?: (contents: string) => boolean;\n\trequiresEvidenceContext?: boolean;\n}> = [\n\t{\n\t\tname: \"Synthetic production commit SHA\",\n\t\t// A 40-hex \"SHA\" containing an embedded UTC timestamp plus cutesy marker\n\t\t// text is a fixture identifier, not dereferenceable git evidence.\n\t\tregex:\n\t\t\t/\\b[0-9a-f]{4,12}20\\d{12}[0-9a-f]{0,16}(?:c0de|cafe|5afe)[0-9a-f]{0,20}\\b/i,\n\t\trequiresEvidenceContext: true,\n\t},\n\t{\n\t\tname: \"Synthetic production PR reference\",\n\t\tregex:\n\t\t\t/\\b[A-Za-z0-9_.-]+\\/[A-Za-z0-9_.-]+#(?!\\d+\\b)[A-Za-z][A-Za-z0-9_.:-]*(?:local|prod-pr-lane)[A-Za-z0-9_.:-]*\\b/i,\n\t\trequiresEvidenceContext: true,\n\t},\n\t{\n\t\tname: \"Synthetic local GitHub Actions run ID\",\n\t\tregex: /\\bgha-run-[A-Za-z0-9_.:-]*-local\\b/i,\n\t\trequiresEvidenceContext: true,\n\t},\n\t{\n\t\tname: \"Local proof identifier\",\n\t\tregex:\n\t\t\t/\\bproof(?:[_-]?id|Id)?\\b[\"']?\\s*[:=]\\s*[\"']?[A-Za-z0-9_.:-]+-local\\b/i,\n\t\trequiresEvidenceContext: true,\n\t},\n\t{\n\t\tname: \"Replay artifact claimed as production evidence\",\n\t\tmatches: (contents) =>\n\t\t\tnew RegExp(REPLAY_EVIDENCE_MARKER_PATTERN, \"i\").test(contents) &&\n\t\t\tnew RegExp(PRODUCTION_EVIDENCE_CLAIM_PATTERN, \"i\").test(contents),\n\t},\n];\n\nexport function detectHeuristicFindings(\n\tcontents: string,\n): HeuristicFindingName[] {\n\tconst matches: HeuristicFindingName[] = [];\n\tfor (const pattern of HEURISTIC_PATTERNS) {\n\t\tif (pattern.regex.test(contents)) {\n\t\t\tmatches.push(pattern.name);\n\t\t}\n\t}\n\treturn matches;\n}\n\nexport function detectEvidenceIntegrityFindings(\n\tcontents: string,\n): EvidenceIntegrityFindingName[] {\n\tconst matches: EvidenceIntegrityFindingName[] = [];\n\tconst hasEvidenceContext = EVIDENCE_CONTEXT_REGEX.test(contents);\n\tfor (const pattern of EVIDENCE_PATTERNS) {\n\t\tif (pattern.requiresEvidenceContext && !hasEvidenceContext) {\n\t\t\tcontinue;\n\t\t}\n\t\tif (pattern.matches?.(contents) ?? pattern.regex?.test(contents)) {\n\t\t\tmatches.push(pattern.name);\n\t\t}\n\t}\n\treturn matches;\n}\n\nfunction runEvidenceIntegrityScan(\n\tfiles: string[],\n\troot: string,\n): GuardianToolResult {\n\tconst started = Date.now();\n\tconst findings: string[] = [];\n\tconst ignorePatterns = [\n\t\t/test\\/guardian\\/evidence-integrity\\.test\\.ts$/,\n\t\t/src\\/guardian\\/runner\\.ts$/,\n\t];\n\n\tfor (const relative of files) {\n\t\tif (ignorePatterns.some((pattern) => pattern.test(relative))) {\n\t\t\tcontinue;\n\t\t}\n\t\tconst fullPath = resolve(root, relative);\n\t\tif (!existsSync(fullPath)) continue;\n\t\tlet contents: string;\n\t\ttry {\n\t\t\tconst stats = statSync(fullPath);\n\t\t\tif (stats.size > 2 * 1024 * 1024) {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tcontents = readFileSync(fullPath, \"utf-8\");\n\t\t} catch {\n\t\t\tcontinue;\n\t\t}\n\t\tif (contents.includes(\"\\0\")) continue;\n\t\tfor (const match of detectEvidenceIntegrityFindings(contents)) {\n\t\t\tfindings.push(`${match}: ${relative}`);\n\t\t}\n\t}\n\n\tif (!findings.length) {\n\t\treturn {\n\t\t\ttool: \"evidence-integrity\",\n\t\t\texitCode: 0,\n\t\t\tstdout: \"\",\n\t\t\tstderr: \"\",\n\t\t\tdurationMs: Date.now() - started,\n\t\t};\n\t}\n\treturn {\n\t\ttool: \"evidence-integrity\",\n\t\texitCode: 1,\n\t\tstdout: findings.join(\"\\n\"),\n\t\tstderr:\n\t\t\t\"Live-production claims must use dereferenceable git, PR, Actions, deploy, and signature identifiers. Mark deterministic fixtures as replay evidence instead.\",\n\t\tdurationMs: Date.now() - started,\n\t};\n}\n\nfunction runHeuristicScan(files: string[], root: string): GuardianToolResult {\n\tconst started = Date.now();\n\tconst findings: string[] = [];\n\tconst ignorePatterns = [\n\t\t/test\\/enterprise\\/pii-detector\\.test\\.ts$/,\n\t\t/test\\/guardian\\/heuristic-scan\\.test\\.ts$/,\n\t\t// Tests that intentionally include credential-like fixtures.\n\t\t/test\\/integration\\/security-middleware\\.test\\.ts$/,\n\t\t/test\\/safety\\/context-firewall\\.test\\.ts$/,\n\t\t/test\\/safety\\/edge-cases\\.test\\.ts$/,\n\t\t/test\\/safety\\/safety-middleware\\.test\\.ts$/,\n\t\t/test\\/telemetry\\/beacon\\.test\\.ts$/,\n\t\t/test\\/telemetry\\/telemetry-metadata-split\\.test\\.ts$/,\n\t\t// The runner itself contains regex patterns that look like secrets\n\t\t/src\\/guardian\\/runner\\.ts$/,\n\t];\n\n\tfor (const relative of files) {\n\t\tif (ignorePatterns.some((pattern) => pattern.test(relative))) {\n\t\t\tcontinue;\n\t\t}\n\t\tconst fullPath = resolve(root, relative);\n\t\tif (!existsSync(fullPath)) continue;\n\t\tlet contents: string;\n\t\ttry {\n\t\t\tconst stats = statSync(fullPath);\n\t\t\tif (stats.size > 2 * 1024 * 1024) {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tcontents = readFileSync(fullPath, \"utf-8\");\n\t\t} catch {\n\t\t\tcontinue;\n\t\t}\n\t\tif (contents.includes(\"\\0\")) continue; // likely binary\n\t\tfor (const match of detectHeuristicFindings(contents)) {\n\t\t\tfindings.push(`${match}: ${relative}`);\n\t\t}\n\t}\n\n\tif (!findings.length) {\n\t\treturn {\n\t\t\ttool: \"heuristic-scan\",\n\t\t\texitCode: 0,\n\t\t\tstdout: \"\",\n\t\t\tstderr: \"\",\n\t\t\tdurationMs: Date.now() - started,\n\t\t};\n\t}\n\treturn {\n\t\ttool: \"heuristic-scan\",\n\t\texitCode: 1,\n\t\tstdout: findings.join(\"\\n\"),\n\t\tstderr: \"\",\n\t\tdurationMs: Date.now() - started,\n\t};\n}\n\nfunction buildSummary(\n\tstatus: GuardianStatus,\n\tfiles: string[],\n\ttools: GuardianToolResult[],\n\ttarget: \"staged\" | \"all\",\n\tskipReason?: string,\n): string {\n\tif (status === \"skipped\") {\n\t\treturn `Guardian skipped (${skipReason ?? \"disabled\"})`;\n\t}\n\tconst fileLabel = target === \"staged\" ? \"staged file(s)\" : \"tracked file(s)\";\n\tconst prefix =\n\t\tstatus === \"passed\"\n\t\t\t? \"Guardian passed\"\n\t\t\t: status === \"failed\"\n\t\t\t\t? \"Guardian blocked commit\"\n\t\t\t\t: \"Guardian error\";\n\tconst ran = tools\n\t\t.filter((tool) => !tool.skipped)\n\t\t.map((tool) => tool.tool)\n\t\t.join(\" + \");\n\tconst skipped = tools\n\t\t.filter((tool) => tool.skipped)\n\t\t.map((tool) => tool.tool)\n\t\t.join(\", \");\n\tconst toolSummary =\n\t\tran && skipped\n\t\t\t? `${ran} (skipped: ${skipped})`\n\t\t\t: ran || (skipped ? `skipped: ${skipped}` : \"\");\n\treturn `${prefix} on ${files.length} ${fileLabel}${\n\t\ttoolSummary ? ` using ${toolSummary}` : \"\"\n\t}`;\n}\n\nexport function formatGuardianResult(result: GuardianRunResult): string {\n\tconst lines: string[] = [];\n\tlines.push(result.summary);\n\tlines.push(\n\t\t`Status: ${result.status} • Target: ${result.target} • Duration: ${\n\t\t\tresult.durationMs\n\t\t}ms`,\n\t);\n\tfor (const tool of result.toolResults) {\n\t\tconst status =\n\t\t\ttool.skipped && tool.reason\n\t\t\t\t? `skipped (${tool.reason})`\n\t\t\t\t: tool.exitCode === 0\n\t\t\t\t\t? \"clean\"\n\t\t\t\t\t: tool.exitCode === 1\n\t\t\t\t\t\t? \"findings\"\n\t\t\t\t\t\t: \"error\";\n\t\tlines.push(\n\t\t\t`- ${tool.tool}: ${status} (${tool.durationMs}ms${\n\t\t\t\ttool.exitCode !== 0 ? `, exit ${tool.exitCode}` : \"\"\n\t\t\t})`,\n\t\t);\n\t\tif (tool.stdout.trim()) {\n\t\t\tlines.push(`  stdout: ${tool.stdout.trim()}`);\n\t\t}\n\t\tif (tool.stderr.trim()) {\n\t\t\tlines.push(`  stderr: ${tool.stderr.trim()}`);\n\t\t}\n\t}\n\tif (result.files?.length) {\n\t\tconst preview = result.files.slice(0, 8).join(\", \");\n\t\tconst suffix =\n\t\t\tresult.files.length > 8 ? ` … +${result.files.length - 8} more` : \"\";\n\t\tlines.push(`Files: ${preview}${suffix}`);\n\t}\n\treturn lines.join(\"\\n\");\n}\n\nfunction pickOverallStatus(tools: GuardianToolResult[]): GuardianStatus {\n\tconst hadError = tools.some((tool) => !tool.skipped && tool.exitCode > 1);\n\tif (hadError) return \"error\";\n\tconst hadFindings = tools.some(\n\t\t(tool) => !tool.skipped && tool.exitCode === 1,\n\t);\n\tif (hadFindings) return \"failed\";\n\treturn \"passed\";\n}\n\nexport function shouldGuardCommand(command: string): {\n\tshouldGuard: boolean;\n\ttrigger: string | null;\n} {\n\tconst inlineDisable = /MAESTRO_GUARDIAN\\s*=\\s*(0|false|off|no)/i;\n\tif (inlineDisable.test(command)) {\n\t\treturn { shouldGuard: false, trigger: null };\n\t}\n\tconst gitMatch = command.match(/\\bgit\\s+(commit|push)\\b/i);\n\tif (gitMatch?.[1]) {\n\t\treturn { shouldGuard: true, trigger: `git ${gitMatch[1].toLowerCase()}` };\n\t}\n\n\tconst destructivePatterns: Array<{ regex: RegExp; label: string }> = [\n\t\t{ regex: /\\brm\\s+-rf\\b/i, label: \"rm -rf\" },\n\t\t{\n\t\t\tregex: /\\brm\\s+(?:-[a-z]*r[a-z]*\\b|--recursive\\b)/i,\n\t\t\tlabel: \"rm -r\",\n\t\t},\n\t\t{ regex: /\\bfind\\s+[^\\n]*-delete\\b/i, label: \"find -delete\" },\n\t\t{ regex: /\\bchmod\\s+0{3,4}\\b/i, label: \"chmod 000\" },\n\t\t{ regex: /\\bchown\\b[^\\n]*\\broot\\b/i, label: \"chown root\" },\n\t\t{ regex: /\\bdd\\s+if=.*\\s+of=\\/dev\\//i, label: \"dd to device\" },\n\t\t{ regex: /\\bmkfs\\./i, label: \"mkfs\" },\n\t\t{ regex: /\\btruncate\\s+-s\\s+0\\b/i, label: \"truncate -s 0\" },\n\t];\n\n\tfor (const pattern of destructivePatterns) {\n\t\tif (pattern.regex.test(command)) {\n\t\t\treturn { shouldGuard: true, trigger: pattern.label };\n\t\t}\n\t}\n\n\treturn { shouldGuard: false, trigger: null };\n}\n\nexport async function runGuardian(\n\toptions: GuardianRunOptions = {},\n): Promise<GuardianRunResult> {\n\tconst target = options.target ?? \"staged\";\n\tconst root = options.root ? resolve(options.root) : process.cwd();\n\tlet scanRoot = root;\n\tlet snapshotDir: string | null = null;\n\tconst enablement = resolveEnablement(options.respectEnv ?? true);\n\tconst startedAt = Date.now();\n\n\tif (!enablement.enabled) {\n\t\tconst result: GuardianRunResult = {\n\t\t\tstatus: \"skipped\",\n\t\t\texitCode: 0,\n\t\t\tstartedAt,\n\t\t\tdurationMs: Date.now() - startedAt,\n\t\t\ttarget,\n\t\t\ttrigger: options.trigger,\n\t\t\tfilesScanned: 0,\n\t\t\tsummary: \"Guardian disabled by configuration\",\n\t\t\tskipReason: enablement.reason ?? \"disabled\",\n\t\t\ttoolResults: [],\n\t\t};\n\t\trecordGuardianRun(result);\n\t\treturn result;\n\t}\n\n\tconst filesResult =\n\t\ttarget === \"all\" ? listTrackedFiles(root) : listStagedFiles(root);\n\tif (!filesResult.ok) {\n\t\tconst result: GuardianRunResult = {\n\t\t\tstatus: \"error\",\n\t\t\texitCode: filesResult.exitCode,\n\t\t\tstartedAt,\n\t\t\tdurationMs: Date.now() - startedAt,\n\t\t\ttarget,\n\t\t\ttrigger: options.trigger,\n\t\t\tfilesScanned: 0,\n\t\t\tsummary: filesResult.error,\n\t\t\ttoolResults: [],\n\t\t};\n\t\trecordGuardianRun(result);\n\t\treturn result;\n\t}\n\n\tconst files = filesResult.files;\n\tif (!files.length) {\n\t\tconst result: GuardianRunResult = {\n\t\t\tstatus: \"skipped\",\n\t\t\texitCode: 0,\n\t\t\tstartedAt,\n\t\t\tdurationMs: Date.now() - startedAt,\n\t\t\ttarget,\n\t\t\ttrigger: options.trigger,\n\t\t\tfilesScanned: 0,\n\t\t\tsummary: \"No files to scan\",\n\t\t\tskipReason: \"no files\",\n\t\t\ttoolResults: [],\n\t\t};\n\t\trecordGuardianRun(result);\n\t\treturn result;\n\t}\n\n\tif (target === \"staged\") {\n\t\tsnapshotDir = materializeStagedFiles(root, files);\n\t\tif (snapshotDir) {\n\t\t\tscanRoot = snapshotDir;\n\t\t}\n\t}\n\n\tconst config = resolveGuardianConfig({\n\t\troot,\n\t\tconfig: options.config,\n\t});\n\n\tconst toolResults: GuardianToolResult[] = [];\n\n\tif (config.tools.evidenceIntegrity) {\n\t\ttoolResults.push(runEvidenceIntegrityScan(files, scanRoot));\n\t}\n\n\tif (config.tools.semgrep) {\n\t\ttoolResults.push(runSemgrep(files, scanRoot));\n\t}\n\n\tlet fallback: GuardianToolResult | null = null;\n\tif (config.tools.gitSecrets) {\n\t\tconst gitSecretsResult = runGitSecrets(files, scanRoot);\n\t\tif (!gitSecretsResult.skipped) {\n\t\t\tfallback = gitSecretsResult;\n\t\t}\n\t}\n\tif (!fallback && config.tools.trufflehog) {\n\t\tconst truffleResult = runTrufflehog(files, scanRoot);\n\t\tif (!truffleResult.skipped) {\n\t\t\tfallback = truffleResult;\n\t\t}\n\t}\n\tif (!fallback && config.tools.heuristicScan) {\n\t\tfallback = runHeuristicScan(files, scanRoot);\n\t}\n\tif (fallback) {\n\t\ttoolResults.push(fallback);\n\t}\n\n\tconst status = pickOverallStatus(toolResults);\n\tconst exitCode =\n\t\tstatus === \"passed\"\n\t\t\t? 0\n\t\t\t: (toolResults.find((tool) => !tool.skipped && tool.exitCode !== 0)\n\t\t\t\t\t?.exitCode ?? 1);\n\n\tconst result: GuardianRunResult = {\n\t\tstatus,\n\t\texitCode,\n\t\tstartedAt,\n\t\tdurationMs: Date.now() - startedAt,\n\t\ttarget,\n\t\ttrigger: options.trigger,\n\t\tfilesScanned: files.length,\n\t\tfiles: options.quiet ? undefined : files,\n\t\tsummary: buildSummary(status, files, toolResults, target),\n\t\ttoolResults,\n\t};\n\n\trecordGuardianRun(result);\n\n\tif (snapshotDir) {\n\t\ttry {\n\t\t\trmSync(snapshotDir, { recursive: true, force: true });\n\t\t} catch {\n\t\t\t// best effort cleanup\n\t\t}\n\t}\n\treturn result;\n}\n"]}

package/dist/guardian/types.d.ts

@@ -56,6 +56,7 @@ export interface GuardianConfig {
     excludePatterns?: string[];
     /** Specific tools to enable/disable */
     tools?: {
+        evidenceIntegrity?: boolean;
         semgrep?: boolean;
         gitSecrets?: boolean;
         trufflehog?: boolean;

package/dist/guardian/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/guardian/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE9C,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC;AAEvE,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IACjC,MAAM,EAAE,cAAc,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,cAAc,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,kBAAkB,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,aAAa;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;CACrC;AAED,MAAM,WAAW,kBAAkB;IAClC,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,cAAc,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC9B,uDAAuD;IACvD,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB,yDAAyD;IACzD,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAE5B,+EAA+E;IAC/E,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAElC,0EAA0E;IAC1E,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAEhC,gFAAgF;IAChF,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAE3B,uCAAuC;IACvC,KAAK,CAAC,EAAE;QACP,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,aAAa,CAAC,EAAE,OAAO,CAAC;KACxB,CAAC;IAEF,8EAA8E;IAC9E,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,wEAAwE;IACxE,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,qBAAqB;IACrC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,eAAO,MAAM,gBAAgB,UAS5B,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/guardian/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE9C,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC;AAEvE,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IACjC,MAAM,EAAE,cAAc,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,cAAc,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,kBAAkB,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,aAAa;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;CACrC;AAED,MAAM,WAAW,kBAAkB;IAClC,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,cAAc,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC9B,uDAAuD;IACvD,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB,yDAAyD;IACzD,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAE5B,+EAA+E;IAC/E,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAElC,0EAA0E;IAC1E,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAEhC,gFAAgF;IAChF,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAE3B,uCAAuC;IACvC,KAAK,CAAC,EAAE;QACP,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAC5B,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,aAAa,CAAC,EAAE,OAAO,CAAC;KACxB,CAAC;IAEF,8EAA8E;IAC9E,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,wEAAwE;IACxE,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,qBAAqB;IACrC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,eAAO,MAAM,gBAAgB,UAS5B,CAAC"}

package/dist/guardian/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/guardian/types.ts"],"names":[],"mappings":"AAwFA,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC/B,eAAe;IACf,OAAO;IACP,MAAM;IACN,OAAO;IACP,WAAW;IACX,QAAQ;IACR,MAAM;IACN,SAAS;CACT,CAAC","sourcesContent":["export type GuardianTarget = \"staged\" | \"all\";\n\nexport type GuardianStatus = \"passed\" | \"failed\" | \"skipped\" | \"error\";\n\nexport interface GuardianToolResult {\n\ttool: string;\n\texitCode: number;\n\tstdout: string;\n\tstderr: string;\n\tdurationMs: number;\n\tskipped?: boolean;\n\treason?: string;\n}\n\nexport interface GuardianRunResult {\n\tstatus: GuardianStatus;\n\texitCode: number;\n\tstartedAt: number;\n\tdurationMs: number;\n\ttarget: GuardianTarget;\n\ttrigger?: string;\n\tfilesScanned: number;\n\tfiles?: string[];\n\tsummary: string;\n\tskipReason?: string;\n\ttoolResults: GuardianToolResult[];\n}\n\nexport interface GuardianState {\n\tenabled: boolean;\n\tlastRun?: GuardianRunResult;\n}\n\nexport interface GuardianEnablement {\n\tenabled: boolean;\n\treason?: string;\n\tenvOverride?: \"disabled\" | \"enabled\";\n}\n\nexport interface GuardianRunOptions {\n\ttarget?: GuardianTarget;\n\ttrigger?: string;\n\troot?: string;\n\trespectEnv?: boolean;\n\tquiet?: boolean;\n\tconfig?: GuardianConfig;\n}\n\n/**\n * User-configurable Guardian settings\n * Can be specified in .maestro/guardian.json or ~/.maestro/guardian.json\n */\nexport interface GuardianConfig {\n\t/** Enable/disable Guardian globally (default: true) */\n\tenabled?: boolean;\n\n\t/** Enable scanning on git commit/push (default: true) */\n\tscanGitOperations?: boolean;\n\n\t/** Enable scanning on destructive bash commands like rm -rf (default: true) */\n\tscanDestructiveCommands?: boolean;\n\n\t/** Custom secret patterns to detect (in addition to built-in patterns) */\n\tcustomSecretPatterns?: string[];\n\n\t/** Files/directories to exclude from scanning (merged with DEFAULT_EXCLUDES) */\n\texcludePatterns?: string[];\n\n\t/** Specific tools to enable/disable */\n\ttools?: {\n\t\tsemgrep?: boolean;\n\t\tgitSecrets?: boolean;\n\t\ttrufflehog?: boolean;\n\t\theuristicScan?: boolean;\n\t};\n\n\t/** Timeout in milliseconds for individual tool execution (default: 120000) */\n\ttoolTimeoutMs?: number;\n\n\t/** Whether to block on findings or just warn (default: true = block) */\n\tblockOnFindings?: boolean;\n}\n\nexport interface GuardianFormatOptions {\n\tcompact?: boolean;\n\tincludeFiles?: boolean;\n}\n\nexport const DEFAULT_EXCLUDES = [\n\t\"node_modules/\",\n\t\"dist/\",\n\t\"tmp/\",\n\t\".git/\",\n\t\"coverage/\",\n\t\"build/\",\n\t\"out/\",\n\t\".turbo/\",\n];\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/guardian/types.ts"],"names":[],"mappings":"AAyFA,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC/B,eAAe;IACf,OAAO;IACP,MAAM;IACN,OAAO;IACP,WAAW;IACX,QAAQ;IACR,MAAM;IACN,SAAS;CACT,CAAC","sourcesContent":["export type GuardianTarget = \"staged\" | \"all\";\n\nexport type GuardianStatus = \"passed\" | \"failed\" | \"skipped\" | \"error\";\n\nexport interface GuardianToolResult {\n\ttool: string;\n\texitCode: number;\n\tstdout: string;\n\tstderr: string;\n\tdurationMs: number;\n\tskipped?: boolean;\n\treason?: string;\n}\n\nexport interface GuardianRunResult {\n\tstatus: GuardianStatus;\n\texitCode: number;\n\tstartedAt: number;\n\tdurationMs: number;\n\ttarget: GuardianTarget;\n\ttrigger?: string;\n\tfilesScanned: number;\n\tfiles?: string[];\n\tsummary: string;\n\tskipReason?: string;\n\ttoolResults: GuardianToolResult[];\n}\n\nexport interface GuardianState {\n\tenabled: boolean;\n\tlastRun?: GuardianRunResult;\n}\n\nexport interface GuardianEnablement {\n\tenabled: boolean;\n\treason?: string;\n\tenvOverride?: \"disabled\" | \"enabled\";\n}\n\nexport interface GuardianRunOptions {\n\ttarget?: GuardianTarget;\n\ttrigger?: string;\n\troot?: string;\n\trespectEnv?: boolean;\n\tquiet?: boolean;\n\tconfig?: GuardianConfig;\n}\n\n/**\n * User-configurable Guardian settings\n * Can be specified in .maestro/guardian.json or ~/.maestro/guardian.json\n */\nexport interface GuardianConfig {\n\t/** Enable/disable Guardian globally (default: true) */\n\tenabled?: boolean;\n\n\t/** Enable scanning on git commit/push (default: true) */\n\tscanGitOperations?: boolean;\n\n\t/** Enable scanning on destructive bash commands like rm -rf (default: true) */\n\tscanDestructiveCommands?: boolean;\n\n\t/** Custom secret patterns to detect (in addition to built-in patterns) */\n\tcustomSecretPatterns?: string[];\n\n\t/** Files/directories to exclude from scanning (merged with DEFAULT_EXCLUDES) */\n\texcludePatterns?: string[];\n\n\t/** Specific tools to enable/disable */\n\ttools?: {\n\t\tevidenceIntegrity?: boolean;\n\t\tsemgrep?: boolean;\n\t\tgitSecrets?: boolean;\n\t\ttrufflehog?: boolean;\n\t\theuristicScan?: boolean;\n\t};\n\n\t/** Timeout in milliseconds for individual tool execution (default: 120000) */\n\ttoolTimeoutMs?: number;\n\n\t/** Whether to block on findings or just warn (default: true = block) */\n\tblockOnFindings?: boolean;\n}\n\nexport interface GuardianFormatOptions {\n\tcompact?: boolean;\n\tincludeFiles?: boolean;\n}\n\nexport const DEFAULT_EXCLUDES = [\n\t\"node_modules/\",\n\t\"dist/\",\n\t\"tmp/\",\n\t\".git/\",\n\t\"coverage/\",\n\t\"build/\",\n\t\"out/\",\n\t\".turbo/\",\n];\n"]}

package/dist/index.d.ts

@@ -1,7 +1,12 @@
 export { main } from "./main.js";
 export { SessionManager } from "./session/manager.js";
 export { askUserTool, bashTool, backgroundTasksTool, codingTools, editTool, notebookEditTool, readTool, todoTool, writeTool, ToolResultCache, createToolResultCache, getGlobalToolResultCache, } from "./tools/index.js";
-export { recordEvaluationResult, recordToolExecution, } from "./telemetry.js";
+export { recordEvaluationResult, recordSubagentDispatch, recordToolExecution, } from "./telemetry.js";
 export * from "./sdk-tools.js";
+export * from "./platform/a2a-client.js";
+export * from "./platform/a2a-peer-pairing.js";
+export * from "./platform/a2a-peer-registry.js";
+export * from "./platform/operating-plane-client.js";
+export * from "./platform/operating-plane-summary.js";
 export { DistributedLockManager, createLockManager, getGlobalLockManager, resetGlobalLockManager, withLock, type LockResult, type LockInfo, type LockOptions, type LockManagerConfig, } from "./db/distributed-lock-manager.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EACN,WAAW,EACX,QAAQ,EACR,mBAAmB,EACnB,WAAW,EACX,QAAQ,EACR,gBAAgB,EAChB,QAAQ,EACR,QAAQ,EACR,SAAS,EAET,eAAe,EACf,qBAAqB,EACrB,wBAAwB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACN,sBAAsB,EACtB,mBAAmB,GACnB,MAAM,gBAAgB,CAAC;AAGxB,cAAc,gBAAgB,CAAC;AAG/B,OAAO,EACN,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,QAAQ,EACR,KAAK,UAAU,EACf,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,iBAAiB,GACtB,MAAM,kCAAkC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EACN,WAAW,EACX,QAAQ,EACR,mBAAmB,EACnB,WAAW,EACX,QAAQ,EACR,gBAAgB,EAChB,QAAQ,EACR,QAAQ,EACR,SAAS,EAET,eAAe,EACf,qBAAqB,EACrB,wBAAwB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACN,sBAAsB,EACtB,sBAAsB,EACtB,mBAAmB,GACnB,MAAM,gBAAgB,CAAC;AAGxB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,0BAA0B,CAAC;AACzC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,iCAAiC,CAAC;AAChD,cAAc,sCAAsC,CAAC;AACrD,cAAc,uCAAuC,CAAC;AAGtD,OAAO,EACN,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,QAAQ,EACR,KAAK,UAAU,EACf,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,iBAAiB,GACtB,MAAM,kCAAkC,CAAC"}

package/dist/index.js

@@ -3,9 +3,14 @@ export { SessionManager } from "./session/manager.js";
 export { askUserTool, bashTool, backgroundTasksTool, codingTools, editTool, notebookEditTool, readTool, todoTool, writeTool, 
 // Tool result caching
 ToolResultCache, createToolResultCache, getGlobalToolResultCache, } from "./tools/index.js";
-export { recordEvaluationResult, recordToolExecution, } from "./telemetry.js";
+export { recordEvaluationResult, recordSubagentDispatch, recordToolExecution, } from "./telemetry.js";
 // SDK tool types for external consumers
 export * from "./sdk-tools.js";
+export * from "./platform/a2a-client.js";
+export * from "./platform/a2a-peer-pairing.js";
+export * from "./platform/a2a-peer-registry.js";
+export * from "./platform/operating-plane-client.js";
+export * from "./platform/operating-plane-summary.js";
 // Distributed lock manager for concurrent operations
 export { DistributedLockManager, createLockManager, getGlobalLockManager, resetGlobalLockManager, withLock, } from "./db/distributed-lock-manager.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EACN,WAAW,EACX,QAAQ,EACR,mBAAmB,EACnB,WAAW,EACX,QAAQ,EACR,gBAAgB,EAChB,QAAQ,EACR,QAAQ,EACR,SAAS;AACT,sBAAsB;AACtB,eAAe,EACf,qBAAqB,EACrB,wBAAwB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACN,sBAAsB,EACtB,mBAAmB,GACnB,MAAM,gBAAgB,CAAC;AAExB,wCAAwC;AACxC,cAAc,gBAAgB,CAAC;AAE/B,qDAAqD;AACrD,OAAO,EACN,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,QAAQ,GAKR,MAAM,kCAAkC,CAAC","sourcesContent":["export { main } from \"./main.js\";\nexport { SessionManager } from \"./session/manager.js\";\nexport {\n\taskUserTool,\n\tbashTool,\n\tbackgroundTasksTool,\n\tcodingTools,\n\teditTool,\n\tnotebookEditTool,\n\treadTool,\n\ttodoTool,\n\twriteTool,\n\t// Tool result caching\n\tToolResultCache,\n\tcreateToolResultCache,\n\tgetGlobalToolResultCache,\n} from \"./tools/index.js\";\nexport {\n\trecordEvaluationResult,\n\trecordToolExecution,\n} from \"./telemetry.js\";\n\n// SDK tool types for external consumers\nexport * from \"./sdk-tools.js\";\n\n// Distributed lock manager for concurrent operations\nexport {\n\tDistributedLockManager,\n\tcreateLockManager,\n\tgetGlobalLockManager,\n\tresetGlobalLockManager,\n\twithLock,\n\ttype LockResult,\n\ttype LockInfo,\n\ttype LockOptions,\n\ttype LockManagerConfig,\n} from \"./db/distributed-lock-manager.js\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EACN,WAAW,EACX,QAAQ,EACR,mBAAmB,EACnB,WAAW,EACX,QAAQ,EACR,gBAAgB,EAChB,QAAQ,EACR,QAAQ,EACR,SAAS;AACT,sBAAsB;AACtB,eAAe,EACf,qBAAqB,EACrB,wBAAwB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACN,sBAAsB,EACtB,sBAAsB,EACtB,mBAAmB,GACnB,MAAM,gBAAgB,CAAC;AAExB,wCAAwC;AACxC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,0BAA0B,CAAC;AACzC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,iCAAiC,CAAC;AAChD,cAAc,sCAAsC,CAAC;AACrD,cAAc,uCAAuC,CAAC;AAEtD,qDAAqD;AACrD,OAAO,EACN,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,QAAQ,GAKR,MAAM,kCAAkC,CAAC","sourcesContent":["export { main } from \"./main.js\";\nexport { SessionManager } from \"./session/manager.js\";\nexport {\n\taskUserTool,\n\tbashTool,\n\tbackgroundTasksTool,\n\tcodingTools,\n\teditTool,\n\tnotebookEditTool,\n\treadTool,\n\ttodoTool,\n\twriteTool,\n\t// Tool result caching\n\tToolResultCache,\n\tcreateToolResultCache,\n\tgetGlobalToolResultCache,\n} from \"./tools/index.js\";\nexport {\n\trecordEvaluationResult,\n\trecordSubagentDispatch,\n\trecordToolExecution,\n} from \"./telemetry.js\";\n\n// SDK tool types for external consumers\nexport * from \"./sdk-tools.js\";\nexport * from \"./platform/a2a-client.js\";\nexport * from \"./platform/a2a-peer-pairing.js\";\nexport * from \"./platform/a2a-peer-registry.js\";\nexport * from \"./platform/operating-plane-client.js\";\nexport * from \"./platform/operating-plane-summary.js\";\n\n// Distributed lock manager for concurrent operations\nexport {\n\tDistributedLockManager,\n\tcreateLockManager,\n\tgetGlobalLockManager,\n\tresetGlobalLockManager,\n\twithLock,\n\ttype LockResult,\n\ttype LockInfo,\n\ttype LockOptions,\n\ttype LockManagerConfig,\n} from \"./db/distributed-lock-manager.js\";\n"]}

package/dist/main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuFG;AA4TH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,iBA+/BxC"}
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuFG;AA0XH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,iBAitCxC"}