npm - @evalops/maestro - Versions diffs - 0.10.18 → 0.10.21 - Mend

@evalops/maestro 0.10.18 → 0.10.21

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (2490) hide show

package/dist/evalops/managed-context.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"managed-context.js","sourceRoot":"","sources":["../../src/evalops/managed-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAEN,uBAAuB,EACvB,oBAAoB,GACpB,MAAM,qBAAqB,CAAC;AAqD7B,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAC3C,IAAI,sBAMQ,CAAC;AAEb,MAAM,OAAO,GAAG;IACf,wBAAwB;IACxB,yBAAyB;IACzB,gBAAgB;IAChB,2BAA2B;IAC3B,4BAA4B;IAC5B,8BAA8B;CACrB,CAAC;AAEX,MAAM,aAAa,GAAG;IACrB,8BAA8B;IAC9B,sBAAsB;IACtB,oCAAoC;IACpC,sBAAsB;CACb,CAAC;AAEX,MAAM,QAAQ,GAAG;IAChB,yBAAyB;IACzB,iBAAiB;IACjB,iBAAiB;CACR,CAAC;AAEX,MAAM,SAAS,GAAG,CAAC,8BAA8B,EAAE,eAAe,CAAU,CAAC;AAC7E,MAAM,uBAAuB,GAAG;IAC/B,qCAAqC;IACrC,6BAA6B;CACpB,CAAC;AACX,MAAM,eAAe,GAAG;IACvB,6BAA6B;IAC7B,qBAAqB;CACZ,CAAC;AACX,MAAM,iBAAiB,GAAG;IACzB,+BAA+B;IAC/B,uBAAuB;CACd,CAAC;AACX,MAAM,aAAa,GAAG;IACrB,2BAA2B;IAC3B,mBAAmB;CACV,CAAC;AACX,MAAM,cAAc,GAAG;IACtB,4BAA4B;IAC5B,oBAAoB;CACX,CAAC;AAEX,SAAS,cAAc,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAC1D,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE;QACd,CAAC,CAAC,SAAS,CAAC;AACd,CAAC;AAED,SAAS,OAAO,CAAC,GAAQ,EAAE,KAAwB;IAClD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACxC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IACzB,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,WAAW,CACnB,MAA2C,EAC3C,GAAW;IAEX,OAAO,cAAc,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACjE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,SAAS,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CACtB,WAAoC;IAEpC,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC3D,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,OAAO;QACN,OAAO,EAAE,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC;QACzC,MAAM,EAAE,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC;QACvC,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,UAAU,CAAC;QAC3C,kBAAkB,EAAE,WAAW,CAAC,QAAQ,EAAE,oBAAoB,CAAC;QAC/D,SAAS,EAAE,WAAW,CAAC,QAAQ,EAAE,WAAW,CAAC;QAC7C,UAAU,EAAE,WAAW,CAAC,QAAQ,EAAE,YAAY,CAAC;QAC/C,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC;QACrC,YAAY,EAAE,WAAW,CAAC,QAAQ,EAAE,cAAc,CAAC;QACnD,gBAAgB,EAAE,WAAW,CAAC,QAAQ,EAAE,kBAAkB,CAAC;QAC3D,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,UAAU,CAAC;QAC3C,SAAS,EAAE,WAAW,CAAC,QAAQ,EAAE,WAAW,CAAC;QAC7C,WAAW,EAAE,WAAW,CAAC,QAAQ,EAAE,aAAa,CAAC;KACjD,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAC/B,QAA4B;IAE5B,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjC,IAAI,MAAM,CAAC,QAAQ,KAAK,iBAAiB;YAAE,OAAO,YAAY,CAAC;QAC/D,IAAI,MAAM,CAAC,QAAQ,KAAK,qBAAqB;YAAE,OAAO,SAAS,CAAC;QAChE,OAAO,MAAM,CAAC,QAAQ,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,QAAQ,CAAC;IACjB,CAAC;AACF,CAAC;AAED,SAAS,mBAAmB,CAAC,eAAuC;IACnE,IAAI,CAAC;QACJ,OAAO,eAAe,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED,SAAS,mCAAmC;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,QAAQ,GAAG,uBAAuB,EAAE,CAAC;IAC3C,IACC,sBAAsB;QACtB,sBAAsB,CAAC,QAAQ,KAAK,QAAQ;QAC5C,sBAAsB,CAAC,SAAS,GAAG,GAAG,EACrC,CAAC;QACF,OAAO,sBAAsB,CAAC,WAAW,CAAC;IAC3C,CAAC;IACD,MAAM,WAAW,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;IACpD,sBAAsB,GAAG;QACxB,WAAW;QACX,SAAS,EAAE,GAAG,GAAG,2BAA2B;QAC5C,QAAQ;KACR,CAAC;IACF,OAAO,WAAW,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC3C,MAAW,OAAO,CAAC,GAAG,EACtB,eAAwC;IAExC,MAAM,WAAW,GAAG,mBAAmB,CACtC,eAAe;QACd,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CACzE,CAAC;IACF,MAAM,QAAQ,GAAG,WAAW,EAAE,QAAQ,CAAC;IACvC,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAC7C,MAAM,WAAW,GAChB,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,cAAc,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAChE,MAAM,cAAc,GACnB,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACnE,MAAM,WAAW,GAChB,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,IAAI,QAAQ,EAAE,WAAW,IAAI,cAAc,CAAC;IACxE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,CAAC,IAAI,QAAQ,EAAE,OAAO,CAAC;IACxE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,sBAAsB,CAAC,CAAC,IAAI,QAAQ,EAAE,KAAK,CAAC;IACxE,MAAM,aAAa,GAAG,OAAO,CAAC,WAAW,IAAI,WAAW,CAAC,CAAC;IAC1D,MAAM,mBAAmB,GAAG,OAAO,CAClC,QAAQ,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,CAAC,CACnE,CAAC;IACF,MAAM,OAAO,GAAG,OAAO,CAAC,cAAc,IAAI,mBAAmB,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,OAAO;QACnB,CAAC,CAAC,iBAAiB;QACnB,CAAC,CAAC,aAAa;YACd,CAAC,CAAC,uBAAuB;YACzB,CAAC,CAAC,OAAO,CAAC;IAEZ,OAAO;QACN,WAAW;QACX,OAAO;QACP,aAAa;QACb,uBAAuB,EAAE,uBAAuB,CAAC,QAAQ,EAAE,QAAQ,CAAC;QACpE,eAAe,EAAE,QAAQ,EAAE,QAAQ;QACnC,iBAAiB,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM;QAC/C,SAAS,EAAE,WAAW,EAAE,OAAO;QAC/B,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;QACxC,kBAAkB,EACjB,OAAO,CAAC,GAAG,EAAE,uBAAuB,CAAC,IAAI,QAAQ,EAAE,kBAAkB;QACtE,SAAS,EAAE,QAAQ,EAAE,SAAS;QAC9B,OAAO;QACP,UAAU,EAAE,OAAO,CAAC,GAAG,EAAE,eAAe,CAAC,IAAI,QAAQ,EAAE,UAAU;QACjE,IAAI;QACJ,cAAc;QACd,WAAW;QACX,KAAK;QACL,YAAY,EAAE,OAAO,CAAC,GAAG,EAAE,iBAAiB,CAAC,IAAI,QAAQ,EAAE,YAAY;QACvE,gBAAgB,EAAE,QAAQ,EAAE,gBAAgB;QAC5C,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,CAAC;QAC/C,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,IAAI,QAAQ,EAAE,QAAQ;QAC3D,cAAc,EAAE,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB;QAC5D,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,IAAI,QAAQ,EAAE,SAAS;QAC9D,SAAS,EAAE,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC;QAC1C,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC;QAClE,WAAW;KACX,CAAC;AACH,CAAC;AAED,MAAM,UAAU,0BAA0B,CACzC,OAA8B,EAC9B,UAA+B,EAAE;IAEjC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC;IACpC,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACrE,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG;QACb,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,IAAI,EAAE;QAClC,GAAG,IAAI,CAAC,eAAe,CAAC,KAAK,OAAO,CAAC,uBAAuB,IAAI,gBAAgB,EAAE;KAClF,CAAC;IACF,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,mBAAmB,CAAC,KAAK,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,OAAO,CAAC,SAAS;QACpB,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,kBAAkB,CAAC,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAChE,IAAI,OAAO,CAAC,cAAc;QACzB,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,cAAc,CAAC,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IACjE,IAAI,OAAO,CAAC,WAAW;QACtB,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,WAAW,CAAC,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3D,KAAK,CAAC,IAAI,CACT,GAAG,IAAI,CAAC,eAAe,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAChF,CAAC;IACF,IAAI,OAAO,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACvE,IAAI,OAAO,CAAC,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IACjE,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,qBAAqB,CAAC,KAAK,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,OAAO,CAAC,YAAY;QACvB,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,eAAe,CAAC,KAAK,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAChE,IAAI,OAAO,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IACxE,IAAI,OAAO,CAAC,SAAS;QACpB,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAC1D,IAAI,OAAO,CAAC,UAAU;QACrB,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,aAAa,CAAC,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAC5D,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IACpE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAC1E,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACzD,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC;QAC1E,MAAM,WAAW,GAChB,cAAc,CAAC,OAAO,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC;QAC3D,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,cAAc,CAAC,KAAK,QAAQ,IAAI,WAAW,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,OAAO,CAAC,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAC7E,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,uBAAuB,CAAC,KAAK,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,MAAM,CAAC,CAAC;QACjD,KAAK,CAAC,IAAI,CACT,GAAG,GAAG,CAAC,cAAc,CAAC,iBAAiB,OAAO,UAAU,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAClF,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC","sourcesContent":["import chalk from \"chalk\";\nimport {\n\ttype OAuthCredentials,\n\tgetOAuthStorageRevision,\n\tloadOAuthCredentials,\n} from \"../oauth/storage.js\";\n\ntype Env = Record<string, string \| undefined>;\n\nexport type EvalOpsManagedTraceState = \"live\" \| \"not configured\";\nexport type EvalOpsManagedEvidencePublisher = \"EvalOps\" \| \"none\";\nexport type EvalOpsManagedInferenceState = \"managed\" \| \"local\";\n\nexport interface EvalOpsManagedContext {\n\taccessToken?: string;\n\tagentId?: string;\n\tauthenticated: boolean;\n\tcontrolPlaneEnvironment?: string;\n\tcontrolPlaneUrl?: string;\n\tevidencePublisher: EvalOpsManagedEvidencePublisher;\n\texpiresAt?: number;\n\tinference: EvalOpsManagedInferenceState;\n\tintegrationProfile?: string;\n\tkeyPrefix?: string;\n\tmanaged: boolean;\n\tmemoryMode?: string;\n\tmode: \"EvalOps managed\" \| \"EvalOps authenticated\" \| \"local\";\n\torganizationId?: string;\n\tproviderRef?: Record<string, unknown>;\n\trunId?: string;\n\truntimeOwner?: string;\n\tsessionExpiresAt?: string;\n\tsessionId?: string;\n\tshimType?: string;\n\ttraceIngestion: EvalOpsManagedTraceState;\n\ttraceMode?: string;\n\tuserEmail?: string;\n\tuserId?: string;\n\tworkspaceId?: string;\n}\n\ninterface StoredAgentMcpMetadata {\n\tagentId?: string;\n\tapiKey?: string;\n\tendpoint?: string;\n\tintegrationProfile?: string;\n\tkeyPrefix?: string;\n\tmemoryMode?: string;\n\trunId?: string;\n\truntimeOwner?: string;\n\tsessionExpiresAt?: string;\n\tshimType?: string;\n\ttraceMode?: string;\n\tworkspaceId?: string;\n}\n\nexport type LoadEvalOpsCredentials = () => OAuthCredentials \| null;\n\nconst PROCESS_CREDENTIAL_CACHE_MS = 30_000;\nlet processCredentialCache:\n\t\| {\n\t\t\tcredentials: OAuthCredentials \| null;\n\t\t\texpiresAt: number;\n\t\t\trevision: number;\n\t }\n\t\| undefined;\n\nconst ORG_ENV = [\n\t\"MAESTRO_EVALOPS_ORG_ID\",\n\t\"EVALOPS_ORGANIZATION_ID\",\n\t\"EVALOPS_ORG_ID\",\n\t\"MAESTRO_ENTERPRISE_ORG_ID\",\n\t\"MAESTRO_LLM_GATEWAY_ORG_ID\",\n\t\"MAESTRO_REMOTE_RUNNER_ORG_ID\",\n] as const;\n\nconst WORKSPACE_ENV = [\n\t\"MAESTRO_EVALOPS_WORKSPACE_ID\",\n\t\"EVALOPS_WORKSPACE_ID\",\n\t\"MAESTRO_REMOTE_RUNNER_WORKSPACE_ID\",\n\t\"MAESTRO_WORKSPACE_ID\",\n] as const;\n\nconst USER_ENV = [\n\t\"MAESTRO_EVALOPS_USER_ID\",\n\t\"EVALOPS_USER_ID\",\n\t\"MAESTRO_USER_ID\",\n] as const;\n\nconst TOKEN_ENV = [\"MAESTRO_EVALOPS_ACCESS_TOKEN\", \"EVALOPS_TOKEN\"] as const;\nconst INTEGRATION_PROFILE_ENV = [\n\t\"MAESTRO_EVALOPS_INTEGRATION_PROFILE\",\n\t\"MAESTRO_INTEGRATION_PROFILE\",\n] as const;\nconst MEMORY_MODE_ENV = [\n\t\"MAESTRO_EVALOPS_MEMORY_MODE\",\n\t\"MAESTRO_MEMORY_MODE\",\n] as const;\nconst RUNTIME_OWNER_ENV = [\n\t\"MAESTRO_EVALOPS_RUNTIME_OWNER\",\n\t\"MAESTRO_RUNTIME_OWNER\",\n] as const;\nconst SHIM_TYPE_ENV = [\n\t\"MAESTRO_EVALOPS_SHIM_TYPE\",\n\t\"MAESTRO_SHIM_TYPE\",\n] as const;\nconst TRACE_MODE_ENV = [\n\t\"MAESTRO_EVALOPS_TRACE_MODE\",\n\t\"MAESTRO_TRACE_MODE\",\n] as const;\n\nfunction nonEmptyString(value: unknown): string \| undefined {\n\treturn typeof value === \"string\" && value.trim().length > 0\n\t\t? value.trim()\n\t\t: undefined;\n}\n\nfunction readEnv(env: Env, names: readonly string[]): string \| undefined {\n\tfor (const name of names) {\n\t\tconst value = nonEmptyString(env[name]);\n\t\tif (value) return value;\n\t}\n\treturn undefined;\n}\n\nfunction recordValue(\n\trecord: Record<string, unknown> \| undefined,\n\tkey: string,\n): string \| undefined {\n\treturn nonEmptyString(record?.[key]);\n}\n\nfunction asRecord(value: unknown): Record<string, unknown> \| undefined {\n\treturn value && typeof value === \"object\" && !Array.isArray(value)\n\t\t? (value as Record<string, unknown>)\n\t\t: undefined;\n}\n\nfunction storedAgentMcp(\n\tcredentials: OAuthCredentials \| null,\n): StoredAgentMcpMetadata \| undefined {\n\tconst agentMcp = asRecord(credentials?.metadata?.agentMcp);\n\tif (!agentMcp) return undefined;\n\treturn {\n\t\tagentId: recordValue(agentMcp, \"agentId\"),\n\t\tapiKey: recordValue(agentMcp, \"apiKey\"),\n\t\tendpoint: recordValue(agentMcp, \"endpoint\"),\n\t\tintegrationProfile: recordValue(agentMcp, \"integrationProfile\"),\n\t\tkeyPrefix: recordValue(agentMcp, \"keyPrefix\"),\n\t\tmemoryMode: recordValue(agentMcp, \"memoryMode\"),\n\t\trunId: recordValue(agentMcp, \"runId\"),\n\t\truntimeOwner: recordValue(agentMcp, \"runtimeOwner\"),\n\t\tsessionExpiresAt: recordValue(agentMcp, \"sessionExpiresAt\"),\n\t\tshimType: recordValue(agentMcp, \"shimType\"),\n\t\ttraceMode: recordValue(agentMcp, \"traceMode\"),\n\t\tworkspaceId: recordValue(agentMcp, \"workspaceId\"),\n\t};\n}\n\nfunction controlPlaneEnvironment(\n\tendpoint: string \| undefined,\n): string \| undefined {\n\tif (!endpoint) return undefined;\n\ttry {\n\t\tconst parsed = new URL(endpoint);\n\t\tif (parsed.hostname === \"app.evalops.dev\") return \"production\";\n\t\tif (parsed.hostname === \"staging.evalops.dev\") return \"staging\";\n\t\treturn parsed.hostname;\n\t} catch {\n\t\treturn endpoint;\n\t}\n}\n\nfunction safeLoadCredentials(loadCredentials: LoadEvalOpsCredentials) {\n\ttry {\n\t\treturn loadCredentials();\n\t} catch {\n\t\treturn null;\n\t}\n}\n\nfunction loadProcessEvalOpsCredentialsCached(): OAuthCredentials \| null {\n\tconst now = Date.now();\n\tconst revision = getOAuthStorageRevision();\n\tif (\n\t\tprocessCredentialCache &&\n\t\tprocessCredentialCache.revision === revision &&\n\t\tprocessCredentialCache.expiresAt > now\n\t) {\n\t\treturn processCredentialCache.credentials;\n\t}\n\tconst credentials = loadOAuthCredentials(\"evalops\");\n\tprocessCredentialCache = {\n\t\tcredentials,\n\t\texpiresAt: now + PROCESS_CREDENTIAL_CACHE_MS,\n\t\trevision,\n\t};\n\treturn credentials;\n}\n\nexport function resolveManagedEvalOpsContext(\n\tenv: Env = process.env,\n\tloadCredentials?: LoadEvalOpsCredentials,\n): EvalOpsManagedContext {\n\tconst credentials = safeLoadCredentials(\n\t\tloadCredentials ??\n\t\t\t(env === process.env ? loadProcessEvalOpsCredentialsCached : () => null),\n\t);\n\tconst metadata = credentials?.metadata;\n\tconst providerRef = asRecord(metadata?.providerRef);\n\tconst agentMcp = storedAgentMcp(credentials);\n\tconst accessToken =\n\t\treadEnv(env, TOKEN_ENV) ?? nonEmptyString(credentials?.access);\n\tconst organizationId =\n\t\treadEnv(env, ORG_ENV) ?? nonEmptyString(metadata?.organizationId);\n\tconst workspaceId =\n\t\treadEnv(env, WORKSPACE_ENV) ?? agentMcp?.workspaceId ?? organizationId;\n\tconst agentId = readEnv(env, [\"MAESTRO_AGENT_ID\"]) ?? agentMcp?.agentId;\n\tconst runId = readEnv(env, [\"MAESTRO_AGENT_RUN_ID\"]) ?? agentMcp?.runId;\n\tconst authenticated = Boolean(accessToken \|\| credentials);\n\tconst managedAgentSession = Boolean(\n\t\tagentMcp?.apiKey \|\| (readEnv(env, TOKEN_ENV) && (agentId \|\| runId)),\n\t);\n\tconst managed = Boolean(organizationId && managedAgentSession);\n\tconst mode = managed\n\t\t? \"EvalOps managed\"\n\t\t: authenticated\n\t\t\t? \"EvalOps authenticated\"\n\t\t\t: \"local\";\n\n\treturn {\n\t\taccessToken,\n\t\tagentId,\n\t\tauthenticated,\n\t\tcontrolPlaneEnvironment: controlPlaneEnvironment(agentMcp?.endpoint),\n\t\tcontrolPlaneUrl: agentMcp?.endpoint,\n\t\tevidencePublisher: managed ? \"EvalOps\" : \"none\",\n\t\texpiresAt: credentials?.expires,\n\t\tinference: managed ? \"managed\" : \"local\",\n\t\tintegrationProfile:\n\t\t\treadEnv(env, INTEGRATION_PROFILE_ENV) ?? agentMcp?.integrationProfile,\n\t\tkeyPrefix: agentMcp?.keyPrefix,\n\t\tmanaged,\n\t\tmemoryMode: readEnv(env, MEMORY_MODE_ENV) ?? agentMcp?.memoryMode,\n\t\tmode,\n\t\torganizationId,\n\t\tproviderRef,\n\t\trunId,\n\t\truntimeOwner: readEnv(env, RUNTIME_OWNER_ENV) ?? agentMcp?.runtimeOwner,\n\t\tsessionExpiresAt: agentMcp?.sessionExpiresAt,\n\t\tsessionId: readEnv(env, [\"MAESTRO_SESSION_ID\"]),\n\t\tshimType: readEnv(env, SHIM_TYPE_ENV) ?? agentMcp?.shimType,\n\t\ttraceIngestion: managed && runId ? \"live\" : \"not configured\",\n\t\ttraceMode: readEnv(env, TRACE_MODE_ENV) ?? agentMcp?.traceMode,\n\t\tuserEmail: nonEmptyString(metadata?.email),\n\t\tuserId: readEnv(env, USER_ENV) ?? nonEmptyString(metadata?.userId),\n\t\tworkspaceId,\n\t};\n}\n\nexport function formatManagedEvalOpsStatus(\n\tcontext: EvalOpsManagedContext,\n\toptions: { color?: boolean } = {},\n): string {\n\tconst color = options.color ?? true;\n\tconst good = (value: string) => (color ? chalk.green(value) : value);\n\tconst dim = (value: string) => (color ? chalk.dim(value) : value);\n\tconst lines = [\n\t\t`${good(\"Mode\")}: ${context.mode}`,\n\t\t`${good(\"Control plane\")}: ${context.controlPlaneEnvironment ?? \"not configured\"}`,\n\t];\n\tif (context.controlPlaneUrl) {\n\t\tlines.push(`${dim(\"Control plane URL\")}: ${context.controlPlaneUrl}`);\n\t}\n\tif (context.userEmail)\n\t\tlines.push(`${dim(\"Authenticated as\")}: ${context.userEmail}`);\n\tif (context.organizationId)\n\t\tlines.push(`${dim(\"Organization\")}: ${context.organizationId}`);\n\tif (context.workspaceId)\n\t\tlines.push(`${dim(\"Workspace\")}: ${context.workspaceId}`);\n\tlines.push(\n\t\t`${good(\"Agent runtime\")}: ${context.agentId ? \"registered\" : \"not registered\"}`,\n\t);\n\tif (context.agentId) lines.push(`${dim(\"Agent\")}: ${context.agentId}`);\n\tif (context.runId) lines.push(`${dim(\"Run\")}: ${context.runId}`);\n\tif (context.integrationProfile) {\n\t\tlines.push(`${dim(\"Integration profile\")}: ${context.integrationProfile}`);\n\t}\n\tif (context.runtimeOwner)\n\t\tlines.push(`${dim(\"Runtime owner\")}: ${context.runtimeOwner}`);\n\tif (context.shimType) lines.push(`${dim(\"Shim\")}: ${context.shimType}`);\n\tif (context.traceMode)\n\t\tlines.push(`${dim(\"Trace mode\")}: ${context.traceMode}`);\n\tif (context.memoryMode)\n\t\tlines.push(`${dim(\"Memory mode\")}: ${context.memoryMode}`);\n\tlines.push(`${good(\"Trace ingestion\")}: ${context.traceIngestion}`);\n\tlines.push(`${good(\"Evidence publisher\")}: ${context.evidencePublisher}`);\n\tlines.push(`${good(\"Inference\")}: ${context.inference}`);\n\tif (context.providerRef) {\n\t\tconst provider = nonEmptyString(context.providerRef.provider) ?? \"openai\";\n\t\tconst environment =\n\t\t\tnonEmptyString(context.providerRef.environment) ?? \"prod\";\n\t\tlines.push(`${dim(\"Provider ref\")}: ${provider}/${environment}`);\n\t}\n\tif (context.keyPrefix) lines.push(`${dim(\"API key\")}: ${context.keyPrefix}`);\n\tif (context.sessionExpiresAt) {\n\t\tlines.push(`${dim(\"Agent session expires\")}: ${context.sessionExpiresAt}`);\n\t}\n\tif (context.expiresAt) {\n\t\tconst remainingMs = Math.max(0, context.expiresAt - Date.now());\n\t\tconst minutes = Math.round(remainingMs / 60_000);\n\t\tlines.push(\n\t\t\t`${dim(\"Access token\")}: expires in ~${minutes} minute${minutes === 1 ? \"\" : \"s\"}`,\n\t\t);\n\t}\n\treturn lines.join(\"\\n\");\n}\n"]}
1	+ {"version":3,"file":"managed-context.js","sourceRoot":"","sources":["../../src/evalops/managed-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAEN,uBAAuB,EACvB,oBAAoB,GACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACN,6BAA6B,EAC7B,oCAAoC,EACpC,4BAA4B,EAC5B,gCAAgC,EAChC,8BAA8B,EAC9B,0BAA0B,EAC1B,2BAA2B,EAC3B,wBAAwB,EACxB,6BAA6B,EAC7B,cAAc,EACd,mBAAmB,GACnB,MAAM,kBAAkB,CAAC;AAqD1B,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAC3C,MAAM,wCAAwC,GAAG;IAChD,GAAG,gCAAgC;IACnC,4BAA4B;IAC5B,8BAA8B;CACrB,CAAC;AACX,MAAM,qCAAqC,GAAG,6BAA6B,CAAC;AAC5E,IAAI,sBAMQ,CAAC;AAEb,SAAS,cAAc,CAAC,KAAc;IACrC,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,WAAW,CACnB,MAA2C,EAC3C,GAAW;IAEX,OAAO,cAAc,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACjE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,SAAS,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CACtB,WAAoC;IAEpC,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC3D,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,OAAO;QACN,OAAO,EAAE,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC;QACzC,MAAM,EAAE,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC;QACvC,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,UAAU,CAAC;QAC3C,kBAAkB,EAAE,WAAW,CAAC,QAAQ,EAAE,oBAAoB,CAAC;QAC/D,SAAS,EAAE,WAAW,CAAC,QAAQ,EAAE,WAAW,CAAC;QAC7C,UAAU,EAAE,WAAW,CAAC,QAAQ,EAAE,YAAY,CAAC;QAC/C,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC;QACrC,YAAY,EAAE,WAAW,CAAC,QAAQ,EAAE,cAAc,CAAC;QACnD,gBAAgB,EAAE,WAAW,CAAC,QAAQ,EAAE,kBAAkB,CAAC;QAC3D,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,UAAU,CAAC;QAC3C,SAAS,EAAE,WAAW,CAAC,QAAQ,EAAE,WAAW,CAAC;QAC7C,WAAW,EAAE,WAAW,CAAC,QAAQ,EAAE,aAAa,CAAC;KACjD,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAC/B,QAA4B;IAE5B,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjC,IAAI,MAAM,CAAC,QAAQ,KAAK,iBAAiB;YAAE,OAAO,YAAY,CAAC;QAC/D,IAAI,MAAM,CAAC,QAAQ,KAAK,qBAAqB;YAAE,OAAO,SAAS,CAAC;QAChE,OAAO,MAAM,CAAC,QAAQ,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,QAAQ,CAAC;IACjB,CAAC;AACF,CAAC;AAED,SAAS,mBAAmB,CAAC,eAAuC;IACnE,IAAI,CAAC;QACJ,OAAO,eAAe,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED,SAAS,mCAAmC;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,QAAQ,GAAG,uBAAuB,EAAE,CAAC;IAC3C,IACC,sBAAsB;QACtB,sBAAsB,CAAC,QAAQ,KAAK,QAAQ;QAC5C,sBAAsB,CAAC,SAAS,GAAG,GAAG,EACrC,CAAC;QACF,OAAO,sBAAsB,CAAC,WAAW,CAAC;IAC3C,CAAC;IACD,MAAM,WAAW,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;IACpD,sBAAsB,GAAG;QACxB,WAAW;QACX,SAAS,EAAE,GAAG,GAAG,2BAA2B;QAC5C,QAAQ;KACR,CAAC;IACF,OAAO,WAAW,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC3C,MAAW,OAAO,CAAC,GAAG,EACtB,eAAwC;IAExC,MAAM,WAAW,GAAG,mBAAmB,CACtC,eAAe;QACd,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CACzE,CAAC;IACF,MAAM,QAAQ,GAAG,WAAW,EAAE,QAAQ,CAAC;IACvC,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAC7C,MAAM,WAAW,GAChB,cAAc,CAAC,GAAG,EAAE,6BAA6B,CAAC;QAClD,cAAc,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACrC,MAAM,cAAc,GACnB,cAAc,CAAC,GAAG,EAAE,wCAAwC,CAAC;QAC7D,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAC1C,MAAM,WAAW,GAChB,cAAc,CAAC,GAAG,EAAE,qCAAqC,CAAC;QAC1D,QAAQ,EAAE,WAAW;QACrB,cAAc,CAAC;IAChB,MAAM,OAAO,GACZ,cAAc,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,CAAC,IAAI,QAAQ,EAAE,OAAO,CAAC;IAChE,MAAM,KAAK,GACV,cAAc,CAAC,GAAG,EAAE,CAAC,sBAAsB,CAAC,CAAC,IAAI,QAAQ,EAAE,KAAK,CAAC;IAClE,MAAM,aAAa,GAAG,OAAO,CAAC,WAAW,IAAI,WAAW,CAAC,CAAC;IAC1D,MAAM,mBAAmB,GAAG,OAAO,CAClC,QAAQ,EAAE,MAAM;QACf,CAAC,cAAc,CAAC,GAAG,EAAE,6BAA6B,CAAC;YAClD,CAAC,OAAO,IAAI,KAAK,CAAC,CAAC,CACrB,CAAC;IACF,MAAM,OAAO,GAAG,OAAO,CAAC,cAAc,IAAI,mBAAmB,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,OAAO;QACnB,CAAC,CAAC,iBAAiB;QACnB,CAAC,CAAC,aAAa;YACd,CAAC,CAAC,uBAAuB;YACzB,CAAC,CAAC,OAAO,CAAC;IAEZ,OAAO;QACN,WAAW;QACX,OAAO;QACP,aAAa;QACb,uBAAuB,EAAE,uBAAuB,CAAC,QAAQ,EAAE,QAAQ,CAAC;QACpE,eAAe,EAAE,QAAQ,EAAE,QAAQ;QACnC,iBAAiB,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM;QAC/C,SAAS,EAAE,WAAW,EAAE,OAAO;QAC/B,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;QACxC,kBAAkB,EACjB,cAAc,CAAC,GAAG,EAAE,oCAAoC,CAAC;YACzD,QAAQ,EAAE,kBAAkB;QAC7B,SAAS,EAAE,QAAQ,EAAE,SAAS;QAC9B,OAAO;QACP,UAAU,EACT,cAAc,CAAC,GAAG,EAAE,4BAA4B,CAAC,IAAI,QAAQ,EAAE,UAAU;QAC1E,IAAI;QACJ,cAAc;QACd,WAAW;QACX,KAAK;QACL,YAAY,EACX,cAAc,CAAC,GAAG,EAAE,8BAA8B,CAAC;YACnD,QAAQ,EAAE,YAAY;QACvB,gBAAgB,EAAE,QAAQ,EAAE,gBAAgB;QAC5C,SAAS,EAAE,cAAc,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,CAAC;QACtD,QAAQ,EACP,cAAc,CAAC,GAAG,EAAE,0BAA0B,CAAC,IAAI,QAAQ,EAAE,QAAQ;QACtE,cAAc,EAAE,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB;QAC5D,SAAS,EACR,cAAc,CAAC,GAAG,EAAE,2BAA2B,CAAC,IAAI,QAAQ,EAAE,SAAS;QACxE,SAAS,EAAE,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC;QAC1C,MAAM,EACL,cAAc,CAAC,GAAG,EAAE,wBAAwB,CAAC;YAC7C,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC;QACjC,WAAW;KACX,CAAC;AACH,CAAC;AAED,MAAM,UAAU,0BAA0B,CACzC,OAA8B,EAC9B,UAA+B,EAAE;IAEjC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC;IACpC,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACrE,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG;QACb,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,IAAI,EAAE;QAClC,GAAG,IAAI,CAAC,eAAe,CAAC,KAAK,OAAO,CAAC,uBAAuB,IAAI,gBAAgB,EAAE;KAClF,CAAC;IACF,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,mBAAmB,CAAC,KAAK,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,OAAO,CAAC,SAAS;QACpB,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,kBAAkB,CAAC,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAChE,IAAI,OAAO,CAAC,cAAc;QACzB,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,cAAc,CAAC,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IACjE,IAAI,OAAO,CAAC,WAAW;QACtB,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,WAAW,CAAC,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3D,KAAK,CAAC,IAAI,CACT,GAAG,IAAI,CAAC,eAAe,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAChF,CAAC;IACF,IAAI,OAAO,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACvE,IAAI,OAAO,CAAC,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IACjE,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,qBAAqB,CAAC,KAAK,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,OAAO,CAAC,YAAY;QACvB,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,eAAe,CAAC,KAAK,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAChE,IAAI,OAAO,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IACxE,IAAI,OAAO,CAAC,SAAS;QACpB,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAC1D,IAAI,OAAO,CAAC,UAAU;QACrB,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,aAAa,CAAC,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAC5D,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IACpE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAC1E,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACzD,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC;QAC1E,MAAM,WAAW,GAChB,cAAc,CAAC,OAAO,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC;QAC3D,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,cAAc,CAAC,KAAK,QAAQ,IAAI,WAAW,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,OAAO,CAAC,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAC7E,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,uBAAuB,CAAC,KAAK,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,MAAM,CAAC,CAAC;QACjD,KAAK,CAAC,IAAI,CACT,GAAG,GAAG,CAAC,cAAc,CAAC,iBAAiB,OAAO,UAAU,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAClF,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC","sourcesContent":["import chalk from \"chalk\";\nimport {\n\ttype OAuthCredentials,\n\tgetOAuthStorageRevision,\n\tloadOAuthCredentials,\n} from \"../oauth/storage.js\";\nimport {\n\tEVALOPS_ACCESS_TOKEN_ENV_VARS,\n\tEVALOPS_INTEGRATION_PROFILE_ENV_VARS,\n\tEVALOPS_MEMORY_MODE_ENV_VARS,\n\tEVALOPS_ORGANIZATION_ID_ENV_VARS,\n\tEVALOPS_RUNTIME_OWNER_ENV_VARS,\n\tEVALOPS_SHIM_TYPE_ENV_VARS,\n\tEVALOPS_TRACE_MODE_ENV_VARS,\n\tEVALOPS_USER_ID_ENV_VARS,\n\tEVALOPS_WORKSPACE_ID_ENV_VARS,\n\treadEvalOpsEnv,\n\ttrimEvalOpsEnvValue,\n} from \"./env-aliases.js\";\n\ntype Env = Record<string, string \| undefined>;\n\nexport type EvalOpsManagedTraceState = \"live\" \| \"not configured\";\nexport type EvalOpsManagedEvidencePublisher = \"EvalOps\" \| \"none\";\nexport type EvalOpsManagedInferenceState = \"managed\" \| \"local\";\n\nexport interface EvalOpsManagedContext {\n\taccessToken?: string;\n\tagentId?: string;\n\tauthenticated: boolean;\n\tcontrolPlaneEnvironment?: string;\n\tcontrolPlaneUrl?: string;\n\tevidencePublisher: EvalOpsManagedEvidencePublisher;\n\texpiresAt?: number;\n\tinference: EvalOpsManagedInferenceState;\n\tintegrationProfile?: string;\n\tkeyPrefix?: string;\n\tmanaged: boolean;\n\tmemoryMode?: string;\n\tmode: \"EvalOps managed\" \| \"EvalOps authenticated\" \| \"local\";\n\torganizationId?: string;\n\tproviderRef?: Record<string, unknown>;\n\trunId?: string;\n\truntimeOwner?: string;\n\tsessionExpiresAt?: string;\n\tsessionId?: string;\n\tshimType?: string;\n\ttraceIngestion: EvalOpsManagedTraceState;\n\ttraceMode?: string;\n\tuserEmail?: string;\n\tuserId?: string;\n\tworkspaceId?: string;\n}\n\ninterface StoredAgentMcpMetadata {\n\tagentId?: string;\n\tapiKey?: string;\n\tendpoint?: string;\n\tintegrationProfile?: string;\n\tkeyPrefix?: string;\n\tmemoryMode?: string;\n\trunId?: string;\n\truntimeOwner?: string;\n\tsessionExpiresAt?: string;\n\tshimType?: string;\n\ttraceMode?: string;\n\tworkspaceId?: string;\n}\n\nexport type LoadEvalOpsCredentials = () => OAuthCredentials \| null;\n\nconst PROCESS_CREDENTIAL_CACHE_MS = 30_000;\nconst MANAGED_EVALOPS_ORGANIZATION_ID_ENV_VARS = [\n\t...EVALOPS_ORGANIZATION_ID_ENV_VARS,\n\t\"MAESTRO_LLM_GATEWAY_ORG_ID\",\n\t\"MAESTRO_REMOTE_RUNNER_ORG_ID\",\n] as const;\nconst MANAGED_EVALOPS_WORKSPACE_ID_ENV_VARS = EVALOPS_WORKSPACE_ID_ENV_VARS;\nlet processCredentialCache:\n\t\| {\n\t\t\tcredentials: OAuthCredentials \| null;\n\t\t\texpiresAt: number;\n\t\t\trevision: number;\n\t }\n\t\| undefined;\n\nfunction nonEmptyString(value: unknown): string \| undefined {\n\treturn trimEvalOpsEnvValue(value);\n}\n\nfunction recordValue(\n\trecord: Record<string, unknown> \| undefined,\n\tkey: string,\n): string \| undefined {\n\treturn nonEmptyString(record?.[key]);\n}\n\nfunction asRecord(value: unknown): Record<string, unknown> \| undefined {\n\treturn value && typeof value === \"object\" && !Array.isArray(value)\n\t\t? (value as Record<string, unknown>)\n\t\t: undefined;\n}\n\nfunction storedAgentMcp(\n\tcredentials: OAuthCredentials \| null,\n): StoredAgentMcpMetadata \| undefined {\n\tconst agentMcp = asRecord(credentials?.metadata?.agentMcp);\n\tif (!agentMcp) return undefined;\n\treturn {\n\t\tagentId: recordValue(agentMcp, \"agentId\"),\n\t\tapiKey: recordValue(agentMcp, \"apiKey\"),\n\t\tendpoint: recordValue(agentMcp, \"endpoint\"),\n\t\tintegrationProfile: recordValue(agentMcp, \"integrationProfile\"),\n\t\tkeyPrefix: recordValue(agentMcp, \"keyPrefix\"),\n\t\tmemoryMode: recordValue(agentMcp, \"memoryMode\"),\n\t\trunId: recordValue(agentMcp, \"runId\"),\n\t\truntimeOwner: recordValue(agentMcp, \"runtimeOwner\"),\n\t\tsessionExpiresAt: recordValue(agentMcp, \"sessionExpiresAt\"),\n\t\tshimType: recordValue(agentMcp, \"shimType\"),\n\t\ttraceMode: recordValue(agentMcp, \"traceMode\"),\n\t\tworkspaceId: recordValue(agentMcp, \"workspaceId\"),\n\t};\n}\n\nfunction controlPlaneEnvironment(\n\tendpoint: string \| undefined,\n): string \| undefined {\n\tif (!endpoint) return undefined;\n\ttry {\n\t\tconst parsed = new URL(endpoint);\n\t\tif (parsed.hostname === \"app.evalops.dev\") return \"production\";\n\t\tif (parsed.hostname === \"staging.evalops.dev\") return \"staging\";\n\t\treturn parsed.hostname;\n\t} catch {\n\t\treturn endpoint;\n\t}\n}\n\nfunction safeLoadCredentials(loadCredentials: LoadEvalOpsCredentials) {\n\ttry {\n\t\treturn loadCredentials();\n\t} catch {\n\t\treturn null;\n\t}\n}\n\nfunction loadProcessEvalOpsCredentialsCached(): OAuthCredentials \| null {\n\tconst now = Date.now();\n\tconst revision = getOAuthStorageRevision();\n\tif (\n\t\tprocessCredentialCache &&\n\t\tprocessCredentialCache.revision === revision &&\n\t\tprocessCredentialCache.expiresAt > now\n\t) {\n\t\treturn processCredentialCache.credentials;\n\t}\n\tconst credentials = loadOAuthCredentials(\"evalops\");\n\tprocessCredentialCache = {\n\t\tcredentials,\n\t\texpiresAt: now + PROCESS_CREDENTIAL_CACHE_MS,\n\t\trevision,\n\t};\n\treturn credentials;\n}\n\nexport function resolveManagedEvalOpsContext(\n\tenv: Env = process.env,\n\tloadCredentials?: LoadEvalOpsCredentials,\n): EvalOpsManagedContext {\n\tconst credentials = safeLoadCredentials(\n\t\tloadCredentials ??\n\t\t\t(env === process.env ? loadProcessEvalOpsCredentialsCached : () => null),\n\t);\n\tconst metadata = credentials?.metadata;\n\tconst providerRef = asRecord(metadata?.providerRef);\n\tconst agentMcp = storedAgentMcp(credentials);\n\tconst accessToken =\n\t\treadEvalOpsEnv(env, EVALOPS_ACCESS_TOKEN_ENV_VARS) ??\n\t\tnonEmptyString(credentials?.access);\n\tconst organizationId =\n\t\treadEvalOpsEnv(env, MANAGED_EVALOPS_ORGANIZATION_ID_ENV_VARS) ??\n\t\tnonEmptyString(metadata?.organizationId);\n\tconst workspaceId =\n\t\treadEvalOpsEnv(env, MANAGED_EVALOPS_WORKSPACE_ID_ENV_VARS) ??\n\t\tagentMcp?.workspaceId ??\n\t\torganizationId;\n\tconst agentId =\n\t\treadEvalOpsEnv(env, [\"MAESTRO_AGENT_ID\"]) ?? agentMcp?.agentId;\n\tconst runId =\n\t\treadEvalOpsEnv(env, [\"MAESTRO_AGENT_RUN_ID\"]) ?? agentMcp?.runId;\n\tconst authenticated = Boolean(accessToken \|\| credentials);\n\tconst managedAgentSession = Boolean(\n\t\tagentMcp?.apiKey \|\|\n\t\t\t(readEvalOpsEnv(env, EVALOPS_ACCESS_TOKEN_ENV_VARS) &&\n\t\t\t\t(agentId \|\| runId)),\n\t);\n\tconst managed = Boolean(organizationId && managedAgentSession);\n\tconst mode = managed\n\t\t? \"EvalOps managed\"\n\t\t: authenticated\n\t\t\t? \"EvalOps authenticated\"\n\t\t\t: \"local\";\n\n\treturn {\n\t\taccessToken,\n\t\tagentId,\n\t\tauthenticated,\n\t\tcontrolPlaneEnvironment: controlPlaneEnvironment(agentMcp?.endpoint),\n\t\tcontrolPlaneUrl: agentMcp?.endpoint,\n\t\tevidencePublisher: managed ? \"EvalOps\" : \"none\",\n\t\texpiresAt: credentials?.expires,\n\t\tinference: managed ? \"managed\" : \"local\",\n\t\tintegrationProfile:\n\t\t\treadEvalOpsEnv(env, EVALOPS_INTEGRATION_PROFILE_ENV_VARS) ??\n\t\t\tagentMcp?.integrationProfile,\n\t\tkeyPrefix: agentMcp?.keyPrefix,\n\t\tmanaged,\n\t\tmemoryMode:\n\t\t\treadEvalOpsEnv(env, EVALOPS_MEMORY_MODE_ENV_VARS) ?? agentMcp?.memoryMode,\n\t\tmode,\n\t\torganizationId,\n\t\tproviderRef,\n\t\trunId,\n\t\truntimeOwner:\n\t\t\treadEvalOpsEnv(env, EVALOPS_RUNTIME_OWNER_ENV_VARS) ??\n\t\t\tagentMcp?.runtimeOwner,\n\t\tsessionExpiresAt: agentMcp?.sessionExpiresAt,\n\t\tsessionId: readEvalOpsEnv(env, [\"MAESTRO_SESSION_ID\"]),\n\t\tshimType:\n\t\t\treadEvalOpsEnv(env, EVALOPS_SHIM_TYPE_ENV_VARS) ?? agentMcp?.shimType,\n\t\ttraceIngestion: managed && runId ? \"live\" : \"not configured\",\n\t\ttraceMode:\n\t\t\treadEvalOpsEnv(env, EVALOPS_TRACE_MODE_ENV_VARS) ?? agentMcp?.traceMode,\n\t\tuserEmail: nonEmptyString(metadata?.email),\n\t\tuserId:\n\t\t\treadEvalOpsEnv(env, EVALOPS_USER_ID_ENV_VARS) ??\n\t\t\tnonEmptyString(metadata?.userId),\n\t\tworkspaceId,\n\t};\n}\n\nexport function formatManagedEvalOpsStatus(\n\tcontext: EvalOpsManagedContext,\n\toptions: { color?: boolean } = {},\n): string {\n\tconst color = options.color ?? true;\n\tconst good = (value: string) => (color ? chalk.green(value) : value);\n\tconst dim = (value: string) => (color ? chalk.dim(value) : value);\n\tconst lines = [\n\t\t`${good(\"Mode\")}: ${context.mode}`,\n\t\t`${good(\"Control plane\")}: ${context.controlPlaneEnvironment ?? \"not configured\"}`,\n\t];\n\tif (context.controlPlaneUrl) {\n\t\tlines.push(`${dim(\"Control plane URL\")}: ${context.controlPlaneUrl}`);\n\t}\n\tif (context.userEmail)\n\t\tlines.push(`${dim(\"Authenticated as\")}: ${context.userEmail}`);\n\tif (context.organizationId)\n\t\tlines.push(`${dim(\"Organization\")}: ${context.organizationId}`);\n\tif (context.workspaceId)\n\t\tlines.push(`${dim(\"Workspace\")}: ${context.workspaceId}`);\n\tlines.push(\n\t\t`${good(\"Agent runtime\")}: ${context.agentId ? \"registered\" : \"not registered\"}`,\n\t);\n\tif (context.agentId) lines.push(`${dim(\"Agent\")}: ${context.agentId}`);\n\tif (context.runId) lines.push(`${dim(\"Run\")}: ${context.runId}`);\n\tif (context.integrationProfile) {\n\t\tlines.push(`${dim(\"Integration profile\")}: ${context.integrationProfile}`);\n\t}\n\tif (context.runtimeOwner)\n\t\tlines.push(`${dim(\"Runtime owner\")}: ${context.runtimeOwner}`);\n\tif (context.shimType) lines.push(`${dim(\"Shim\")}: ${context.shimType}`);\n\tif (context.traceMode)\n\t\tlines.push(`${dim(\"Trace mode\")}: ${context.traceMode}`);\n\tif (context.memoryMode)\n\t\tlines.push(`${dim(\"Memory mode\")}: ${context.memoryMode}`);\n\tlines.push(`${good(\"Trace ingestion\")}: ${context.traceIngestion}`);\n\tlines.push(`${good(\"Evidence publisher\")}: ${context.evidencePublisher}`);\n\tlines.push(`${good(\"Inference\")}: ${context.inference}`);\n\tif (context.providerRef) {\n\t\tconst provider = nonEmptyString(context.providerRef.provider) ?? \"openai\";\n\t\tconst environment =\n\t\t\tnonEmptyString(context.providerRef.environment) ?? \"prod\";\n\t\tlines.push(`${dim(\"Provider ref\")}: ${provider}/${environment}`);\n\t}\n\tif (context.keyPrefix) lines.push(`${dim(\"API key\")}: ${context.keyPrefix}`);\n\tif (context.sessionExpiresAt) {\n\t\tlines.push(`${dim(\"Agent session expires\")}: ${context.sessionExpiresAt}`);\n\t}\n\tif (context.expiresAt) {\n\t\tconst remainingMs = Math.max(0, context.expiresAt - Date.now());\n\t\tconst minutes = Math.round(remainingMs / 60_000);\n\t\tlines.push(\n\t\t\t`${dim(\"Access token\")}: expires in ~${minutes} minute${minutes === 1 ? \"\" : \"s\"}`,\n\t\t);\n\t}\n\treturn lines.join(\"\\n\");\n}\n"]}

package/dist/guardian/config.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/guardian/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAIjD,qCAAqC;AACrC,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,cAAc,~~CAc5D~~,CAAC;AAwBF;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAgDD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,CAAC,EAAE;IAC/C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,cAAc,CAAC;CACxB,GAAG,QAAQ,CAAC,cAAc,CAAC,CAiC3B;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG;IAC3D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACnD,CAiBA;AAkBD;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,QAAQ,CAAC,cAAc,CAAC,GAAG,MAAM,CAiCzE"}
1	+ {"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/guardian/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAIjD,qCAAqC;AACrC,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,cAAc,CAe5D,CAAC;AAwBF;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAgDD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,CAAC,EAAE;IAC/C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,cAAc,CAAC;CACxB,GAAG,QAAQ,CAAC,cAAc,CAAC,CAiC3B;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG;IAC3D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACnD,CAiBA;AAkBD;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,QAAQ,CAAC,cAAc,CAAC,GAAG,MAAM,CAiCzE"}

package/dist/guardian/config.js CHANGED Viewed

@@ -20,6 +20,7 @@ export const DEFAULT_GUARDIAN_CONFIG = {
     customSecretPatterns: [],
     excludePatterns: [],
     tools: {
+        evidenceIntegrity: true,
         semgrep: true,
         gitSecrets: true,
         trufflehog: true,

package/dist/guardian/config.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/guardian/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGlD,MAAM,MAAM,GAAG,YAAY,CAAC,iBAAiB,CAAC,CAAC;AAE/C,qCAAqC;AACrC,MAAM,CAAC,MAAM,uBAAuB,GAA6B;IAChE,OAAO,EAAE,IAAI;IACb,iBAAiB,EAAE,IAAI;IACvB,uBAAuB,EAAE,IAAI;IAC7B,oBAAoB,EAAE,EAAE;IACxB,eAAe,EAAE,EAAE;IACnB,KAAK,EAAE;QACN,OAAO,EAAE,IAAI;QACb,UAAU,EAAE,IAAI;QAChB,UAAU,EAAE,IAAI;QAChB,aAAa,EAAE,IAAI;KACnB;IACD,aAAa,EAAE,OAAO;IACtB,eAAe,EAAE,IAAI;CACrB,CAAC;AAEF;;GAEG;AACH,SAAS,cAAc,CAAC,IAAY;IACnC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAmB,CAAC;QACrD,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACzD,OAAO,MAAM,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE;YAC7C,IAAI;YACJ,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC7D,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAa;IACjD,MAAM,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IACzD,OAAO,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;AACvD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAChC,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;AAClD,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,GAAG,OAAkC;IAC1D,MAAM,MAAM,GAAmB,EAAE,GAAG,uBAAuB,EAAE,CAAC;IAE9D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM;YAAE,SAAS;QAEtB,2BAA2B;QAC3B,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;YAAE,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAClE,IAAI,MAAM,CAAC,iBAAiB,KAAK,SAAS;YACzC,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,CAAC;QACrD,IAAI,MAAM,CAAC,uBAAuB,KAAK,SAAS;YAC/C,MAAM,CAAC,uBAAuB,GAAG,MAAM,CAAC,uBAAuB,CAAC;QACjE,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS;YACrC,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;QAC7C,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS;YACvC,MAAM,CAAC,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;QAEjD,+BAA+B;QAC/B,IAAI,MAAM,CAAC,oBAAoB,EAAE,CAAC;YACjC,MAAM,CAAC,oBAAoB,GAAG;gBAC7B,GAAG,CAAC,MAAM,CAAC,oBAAoB,IAAI,EAAE,CAAC;gBACtC,GAAG,MAAM,CAAC,oBAAoB;aAC9B,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAC5B,MAAM,CAAC,eAAe,GAAG;gBACxB,GAAG,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC;gBACjC,GAAG,MAAM,CAAC,eAAe;aACzB,CAAC;QACH,CAAC;QAED,qBAAqB;QACrB,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,CAAC,KAAK,GAAG;gBACd,GAAG,MAAM,CAAC,KAAK;gBACf,GAAG,MAAM,CAAC,KAAK;aACf,CAAC;QACH,CAAC;IACF,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAGrC;IACA,MAAM,UAAU,GAAG,cAAc,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACvD,MAAM,aAAa,GAAG,cAAc,CAAC,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IAE1E,MAAM,MAAM,GAAG,YAAY,CAC1B,uBAAuB,EACvB,UAAU,EACV,aAAa,EACb,OAAO,EAAE,MAAM,IAAI,IAAI,CACvB,CAAC;IAEF,6CAA6C;IAC7C,OAAO;QACN,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,uBAAuB,CAAC,OAAO;QAC1D,iBAAiB,EAChB,MAAM,CAAC,iBAAiB,IAAI,uBAAuB,CAAC,iBAAiB;QACtE,uBAAuB,EACtB,MAAM,CAAC,uBAAuB;YAC9B,uBAAuB,CAAC,uBAAuB;QAChD,oBAAoB,EACnB,MAAM,CAAC,oBAAoB;YAC3B,uBAAuB,CAAC,oBAAoB;QAC7C,eAAe,EACd,MAAM,CAAC,eAAe,IAAI,uBAAuB,CAAC,eAAe;QAClE,KAAK,EAAE;YACN,GAAG,uBAAuB,CAAC,KAAK;YAChC,GAAG,MAAM,CAAC,KAAK;SACf;QACD,aAAa,EACZ,MAAM,CAAC,aAAa,IAAI,uBAAuB,CAAC,aAAa;QAC9D,eAAe,EACd,MAAM,CAAC,eAAe,IAAI,uBAAuB,CAAC,eAAe;KAClE,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAkB;IAIxD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAA8C,EAAE,CAAC;IAE9D,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,QAAQ,EAAE,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrB,CAAC;aAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC;gBACZ,OAAO;gBACP,KAAK,EAAE,iCAAiC;aACxC,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CAAC,OAAe;IACxC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,CAAC;QACJ,gGAAgG;QAChG,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAgC;IAChE,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACtC,KAAK,CAAC,IAAI,CAAC,cAAc,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3C,KAAK,CAAC,IAAI,CAAC,0BAA0B,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACjE,KAAK,CAAC,IAAI,CAAC,gCAAgC,MAAM,CAAC,uBAAuB,EAAE,CAAC,CAAC;IAC7E,KAAK,CAAC,IAAI,CAAC,wBAAwB,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC;IAC7D,KAAK,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;IAExD,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;SAC/C,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC;SAChC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;SAChD,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC;SACjC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IAExB,KAAK,CAAC,IAAI,CAAC,oBAAoB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC;IACpE,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,qBAAqB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,MAAM,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,KAAK,CAAC,IAAI,CACT,6BAA6B,MAAM,CAAC,oBAAoB,CAAC,MAAM,EAAE,CACjE,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC,sBAAsB,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC","sourcesContent":["/*\n Guardian configuration loader\n \n Loads configuration from (in order of precedence):\n * 1. Programmatic options passed to runGuardian()\n * 2. Project-level: .maestro/guardian.json\n * 3. User-level: ~/.maestro/guardian.json\n * 4. Default configuration\n /\n\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { join, resolve } from \"node:path\";\nimport { PATHS } from \"../config/constants.js\";\nimport { createLogger } from \"../utils/logger.js\";\nimport type { GuardianConfig } from \"./types.js\";\n\nconst logger = createLogger(\"guardian:config\");\n\n/* Default Guardian configuration /\nexport const DEFAULT_GUARDIAN_CONFIG: Required<GuardianConfig> = {\n\tenabled: true,\n\tscanGitOperations: true,\n\tscanDestructiveCommands: true,\n\tcustomSecretPatterns: [],\n\texcludePatterns: [],\n\ttools: {\n\t\tsemgrep: true,\n\t\tgitSecrets: true,\n\t\ttrufflehog: true,\n\t\theuristicScan: true,\n\t},\n\ttoolTimeoutMs: 120_000,\n\tblockOnFindings: true,\n};\n\n/\n Load and parse a Guardian config file\n /\nfunction loadConfigFile(path: string): GuardianConfig \| null {\n\tif (!existsSync(path)) {\n\t\treturn null;\n\t}\n\n\ttry {\n\t\tconst content = readFileSync(path, \"utf-8\");\n\t\tconst config = JSON.parse(content) as GuardianConfig;\n\t\tlogger.debug(\"Loaded Guardian config\", { path, config });\n\t\treturn config;\n\t} catch (error) {\n\t\tlogger.warn(\"Failed to load Guardian config\", {\n\t\t\tpath,\n\t\t\terror: error instanceof Error ? error.message : String(error),\n\t\t});\n\t\treturn null;\n\t}\n}\n\n/\n Get the project-level config file path\n /\nexport function getProjectConfigPath(root?: string): string {\n\tconst projectRoot = root ? resolve(root) : process.cwd();\n\treturn join(projectRoot, \".maestro\", \"guardian.json\");\n}\n\n/\n Get the user-level config file path\n /\nexport function getUserConfigPath(): string {\n\treturn join(PATHS.MAESTRO_HOME, \"guardian.json\");\n}\n\n/\n Merge multiple configs with later configs taking precedence\n /\nfunction mergeConfigs(...configs: (GuardianConfig \| null)[]): GuardianConfig {\n\tconst result: GuardianConfig = { ...DEFAULT_GUARDIAN_CONFIG };\n\n\tfor (const config of configs) {\n\t\tif (!config) continue;\n\n\t\t// Simple scalar properties\n\t\tif (config.enabled !== undefined) result.enabled = config.enabled;\n\t\tif (config.scanGitOperations !== undefined)\n\t\t\tresult.scanGitOperations = config.scanGitOperations;\n\t\tif (config.scanDestructiveCommands !== undefined)\n\t\t\tresult.scanDestructiveCommands = config.scanDestructiveCommands;\n\t\tif (config.toolTimeoutMs !== undefined)\n\t\t\tresult.toolTimeoutMs = config.toolTimeoutMs;\n\t\tif (config.blockOnFindings !== undefined)\n\t\t\tresult.blockOnFindings = config.blockOnFindings;\n\n\t\t// Arrays - merge with defaults\n\t\tif (config.customSecretPatterns) {\n\t\t\tresult.customSecretPatterns = [\n\t\t\t\t...(result.customSecretPatterns \|\| []),\n\t\t\t\t...config.customSecretPatterns,\n\t\t\t];\n\t\t}\n\t\tif (config.excludePatterns) {\n\t\t\tresult.excludePatterns = [\n\t\t\t\t...(result.excludePatterns \|\| []),\n\t\t\t\t...config.excludePatterns,\n\t\t\t];\n\t\t}\n\n\t\t// Tools - deep merge\n\t\tif (config.tools) {\n\t\t\tresult.tools = {\n\t\t\t\t...result.tools,\n\t\t\t\t...config.tools,\n\t\t\t};\n\t\t}\n\t}\n\n\treturn result;\n}\n\n/\n Resolve the effective Guardian configuration\n \n Order of precedence (highest to lowest):\n * 1. Programmatic options\n * 2. Project-level config (.maestro/guardian.json)\n * 3. User-level config (~/.maestro/guardian.json)\n * 4. Default config\n /\nexport function resolveGuardianConfig(options?: {\n\troot?: string;\n\tconfig?: GuardianConfig;\n}): Required<GuardianConfig> {\n\tconst userConfig = loadConfigFile(getUserConfigPath());\n\tconst projectConfig = loadConfigFile(getProjectConfigPath(options?.root));\n\n\tconst merged = mergeConfigs(\n\t\tDEFAULT_GUARDIAN_CONFIG,\n\t\tuserConfig,\n\t\tprojectConfig,\n\t\toptions?.config ?? null,\n\t);\n\n\t// Ensure all required properties are present\n\treturn {\n\t\tenabled: merged.enabled ?? DEFAULT_GUARDIAN_CONFIG.enabled,\n\t\tscanGitOperations:\n\t\t\tmerged.scanGitOperations ?? DEFAULT_GUARDIAN_CONFIG.scanGitOperations,\n\t\tscanDestructiveCommands:\n\t\t\tmerged.scanDestructiveCommands ??\n\t\t\tDEFAULT_GUARDIAN_CONFIG.scanDestructiveCommands,\n\t\tcustomSecretPatterns:\n\t\t\tmerged.customSecretPatterns ??\n\t\t\tDEFAULT_GUARDIAN_CONFIG.customSecretPatterns,\n\t\texcludePatterns:\n\t\t\tmerged.excludePatterns ?? DEFAULT_GUARDIAN_CONFIG.excludePatterns,\n\t\ttools: {\n\t\t\t...DEFAULT_GUARDIAN_CONFIG.tools,\n\t\t\t...merged.tools,\n\t\t},\n\t\ttoolTimeoutMs:\n\t\t\tmerged.toolTimeoutMs ?? DEFAULT_GUARDIAN_CONFIG.toolTimeoutMs,\n\t\tblockOnFindings:\n\t\t\tmerged.blockOnFindings ?? DEFAULT_GUARDIAN_CONFIG.blockOnFindings,\n\t};\n}\n\n/\n Validate custom secret patterns\n /\nexport function validateSecretPatterns(patterns: string[]): {\n\tvalid: string[];\n\tinvalid: Array<{ pattern: string; error: string }>;\n} {\n\tconst valid: string[] = [];\n\tconst invalid: Array<{ pattern: string; error: string }> = [];\n\n\tfor (const pattern of patterns) {\n\t\tconst compiled = compileUserRegex(pattern);\n\t\tif (compiled) {\n\t\t\tvalid.push(pattern);\n\t\t} else {\n\t\t\tinvalid.push({\n\t\t\t\tpattern,\n\t\t\t\terror: \"Invalid or unsafe regex pattern\",\n\t\t\t});\n\t\t}\n\t}\n\n\treturn { valid, invalid };\n}\n\n/\n Compile a user-provided regex string with basic safety guards.\n /\nfunction compileUserRegex(pattern: string): RegExp \| null {\n\tif (!pattern \|\| pattern.length > 500) {\n\t\treturn null;\n\t}\n\n\ttry {\n\t\t// nosemgrep: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp\n\t\treturn new RegExp(pattern);\n\t} catch {\n\t\treturn null;\n\t}\n}\n\n/\n Get a summary of the current Guardian configuration\n */\nexport function getConfigSummary(config: Required<GuardianConfig>): string {\n\tconst lines: string[] = [];\n\n\tlines.push(\"Guardian Configuration:\");\n\tlines.push(` Enabled: ${config.enabled}`);\n\tlines.push(` Scan Git Operations: ${config.scanGitOperations}`);\n\tlines.push(` Scan Destructive Commands: ${config.scanDestructiveCommands}`);\n\tlines.push(` Block on Findings: ${config.blockOnFindings}`);\n\tlines.push(` Tool Timeout: ${config.toolTimeoutMs}ms`);\n\n\tconst enabledTools = Object.entries(config.tools)\n\t\t.filter(([, enabled]) => enabled)\n\t\t.map(([name]) => name);\n\tconst disabledTools = Object.entries(config.tools)\n\t\t.filter(([, enabled]) => !enabled)\n\t\t.map(([name]) => name);\n\n\tlines.push(` Enabled Tools: ${enabledTools.join(\", \") \|\| \"none\"}`);\n\tif (disabledTools.length > 0) {\n\t\tlines.push(` Disabled Tools: ${disabledTools.join(\", \")}`);\n\t}\n\n\tif (config.customSecretPatterns.length > 0) {\n\t\tlines.push(\n\t\t\t` Custom Secret Patterns: ${config.customSecretPatterns.length}`,\n\t\t);\n\t}\n\n\tif (config.excludePatterns.length > 0) {\n\t\tlines.push(` Custom Excludes: ${config.excludePatterns.join(\", \")}`);\n\t}\n\n\treturn lines.join(\"\\n\");\n}\n"]}
1	+ {"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/guardian/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGlD,MAAM,MAAM,GAAG,YAAY,CAAC,iBAAiB,CAAC,CAAC;AAE/C,qCAAqC;AACrC,MAAM,CAAC,MAAM,uBAAuB,GAA6B;IAChE,OAAO,EAAE,IAAI;IACb,iBAAiB,EAAE,IAAI;IACvB,uBAAuB,EAAE,IAAI;IAC7B,oBAAoB,EAAE,EAAE;IACxB,eAAe,EAAE,EAAE;IACnB,KAAK,EAAE;QACN,iBAAiB,EAAE,IAAI;QACvB,OAAO,EAAE,IAAI;QACb,UAAU,EAAE,IAAI;QAChB,UAAU,EAAE,IAAI;QAChB,aAAa,EAAE,IAAI;KACnB;IACD,aAAa,EAAE,OAAO;IACtB,eAAe,EAAE,IAAI;CACrB,CAAC;AAEF;;GAEG;AACH,SAAS,cAAc,CAAC,IAAY;IACnC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAmB,CAAC;QACrD,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACzD,OAAO,MAAM,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE;YAC7C,IAAI;YACJ,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC7D,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAa;IACjD,MAAM,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IACzD,OAAO,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;AACvD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAChC,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;AAClD,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,GAAG,OAAkC;IAC1D,MAAM,MAAM,GAAmB,EAAE,GAAG,uBAAuB,EAAE,CAAC;IAE9D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM;YAAE,SAAS;QAEtB,2BAA2B;QAC3B,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;YAAE,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAClE,IAAI,MAAM,CAAC,iBAAiB,KAAK,SAAS;YACzC,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,CAAC;QACrD,IAAI,MAAM,CAAC,uBAAuB,KAAK,SAAS;YAC/C,MAAM,CAAC,uBAAuB,GAAG,MAAM,CAAC,uBAAuB,CAAC;QACjE,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS;YACrC,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;QAC7C,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS;YACvC,MAAM,CAAC,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;QAEjD,+BAA+B;QAC/B,IAAI,MAAM,CAAC,oBAAoB,EAAE,CAAC;YACjC,MAAM,CAAC,oBAAoB,GAAG;gBAC7B,GAAG,CAAC,MAAM,CAAC,oBAAoB,IAAI,EAAE,CAAC;gBACtC,GAAG,MAAM,CAAC,oBAAoB;aAC9B,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAC5B,MAAM,CAAC,eAAe,GAAG;gBACxB,GAAG,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC;gBACjC,GAAG,MAAM,CAAC,eAAe;aACzB,CAAC;QACH,CAAC;QAED,qBAAqB;QACrB,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,CAAC,KAAK,GAAG;gBACd,GAAG,MAAM,CAAC,KAAK;gBACf,GAAG,MAAM,CAAC,KAAK;aACf,CAAC;QACH,CAAC;IACF,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAGrC;IACA,MAAM,UAAU,GAAG,cAAc,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACvD,MAAM,aAAa,GAAG,cAAc,CAAC,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IAE1E,MAAM,MAAM,GAAG,YAAY,CAC1B,uBAAuB,EACvB,UAAU,EACV,aAAa,EACb,OAAO,EAAE,MAAM,IAAI,IAAI,CACvB,CAAC;IAEF,6CAA6C;IAC7C,OAAO;QACN,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,uBAAuB,CAAC,OAAO;QAC1D,iBAAiB,EAChB,MAAM,CAAC,iBAAiB,IAAI,uBAAuB,CAAC,iBAAiB;QACtE,uBAAuB,EACtB,MAAM,CAAC,uBAAuB;YAC9B,uBAAuB,CAAC,uBAAuB;QAChD,oBAAoB,EACnB,MAAM,CAAC,oBAAoB;YAC3B,uBAAuB,CAAC,oBAAoB;QAC7C,eAAe,EACd,MAAM,CAAC,eAAe,IAAI,uBAAuB,CAAC,eAAe;QAClE,KAAK,EAAE;YACN,GAAG,uBAAuB,CAAC,KAAK;YAChC,GAAG,MAAM,CAAC,KAAK;SACf;QACD,aAAa,EACZ,MAAM,CAAC,aAAa,IAAI,uBAAuB,CAAC,aAAa;QAC9D,eAAe,EACd,MAAM,CAAC,eAAe,IAAI,uBAAuB,CAAC,eAAe;KAClE,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAkB;IAIxD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAA8C,EAAE,CAAC;IAE9D,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,QAAQ,EAAE,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrB,CAAC;aAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC;gBACZ,OAAO;gBACP,KAAK,EAAE,iCAAiC;aACxC,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CAAC,OAAe;IACxC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,CAAC;QACJ,gGAAgG;QAChG,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAgC;IAChE,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACtC,KAAK,CAAC,IAAI,CAAC,cAAc,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3C,KAAK,CAAC,IAAI,CAAC,0BAA0B,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACjE,KAAK,CAAC,IAAI,CAAC,gCAAgC,MAAM,CAAC,uBAAuB,EAAE,CAAC,CAAC;IAC7E,KAAK,CAAC,IAAI,CAAC,wBAAwB,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC;IAC7D,KAAK,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;IAExD,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;SAC/C,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC;SAChC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;SAChD,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC;SACjC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IAExB,KAAK,CAAC,IAAI,CAAC,oBAAoB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC;IACpE,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,qBAAqB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,MAAM,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,KAAK,CAAC,IAAI,CACT,6BAA6B,MAAM,CAAC,oBAAoB,CAAC,MAAM,EAAE,CACjE,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC,sBAAsB,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC","sourcesContent":["/*\n Guardian configuration loader\n \n Loads configuration from (in order of precedence):\n * 1. Programmatic options passed to runGuardian()\n * 2. Project-level: .maestro/guardian.json\n * 3. User-level: ~/.maestro/guardian.json\n * 4. Default configuration\n /\n\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { join, resolve } from \"node:path\";\nimport { PATHS } from \"../config/constants.js\";\nimport { createLogger } from \"../utils/logger.js\";\nimport type { GuardianConfig } from \"./types.js\";\n\nconst logger = createLogger(\"guardian:config\");\n\n/* Default Guardian configuration /\nexport const DEFAULT_GUARDIAN_CONFIG: Required<GuardianConfig> = {\n\tenabled: true,\n\tscanGitOperations: true,\n\tscanDestructiveCommands: true,\n\tcustomSecretPatterns: [],\n\texcludePatterns: [],\n\ttools: {\n\t\tevidenceIntegrity: true,\n\t\tsemgrep: true,\n\t\tgitSecrets: true,\n\t\ttrufflehog: true,\n\t\theuristicScan: true,\n\t},\n\ttoolTimeoutMs: 120_000,\n\tblockOnFindings: true,\n};\n\n/\n Load and parse a Guardian config file\n /\nfunction loadConfigFile(path: string): GuardianConfig \| null {\n\tif (!existsSync(path)) {\n\t\treturn null;\n\t}\n\n\ttry {\n\t\tconst content = readFileSync(path, \"utf-8\");\n\t\tconst config = JSON.parse(content) as GuardianConfig;\n\t\tlogger.debug(\"Loaded Guardian config\", { path, config });\n\t\treturn config;\n\t} catch (error) {\n\t\tlogger.warn(\"Failed to load Guardian config\", {\n\t\t\tpath,\n\t\t\terror: error instanceof Error ? error.message : String(error),\n\t\t});\n\t\treturn null;\n\t}\n}\n\n/\n Get the project-level config file path\n /\nexport function getProjectConfigPath(root?: string): string {\n\tconst projectRoot = root ? resolve(root) : process.cwd();\n\treturn join(projectRoot, \".maestro\", \"guardian.json\");\n}\n\n/\n Get the user-level config file path\n /\nexport function getUserConfigPath(): string {\n\treturn join(PATHS.MAESTRO_HOME, \"guardian.json\");\n}\n\n/\n Merge multiple configs with later configs taking precedence\n /\nfunction mergeConfigs(...configs: (GuardianConfig \| null)[]): GuardianConfig {\n\tconst result: GuardianConfig = { ...DEFAULT_GUARDIAN_CONFIG };\n\n\tfor (const config of configs) {\n\t\tif (!config) continue;\n\n\t\t// Simple scalar properties\n\t\tif (config.enabled !== undefined) result.enabled = config.enabled;\n\t\tif (config.scanGitOperations !== undefined)\n\t\t\tresult.scanGitOperations = config.scanGitOperations;\n\t\tif (config.scanDestructiveCommands !== undefined)\n\t\t\tresult.scanDestructiveCommands = config.scanDestructiveCommands;\n\t\tif (config.toolTimeoutMs !== undefined)\n\t\t\tresult.toolTimeoutMs = config.toolTimeoutMs;\n\t\tif (config.blockOnFindings !== undefined)\n\t\t\tresult.blockOnFindings = config.blockOnFindings;\n\n\t\t// Arrays - merge with defaults\n\t\tif (config.customSecretPatterns) {\n\t\t\tresult.customSecretPatterns = [\n\t\t\t\t...(result.customSecretPatterns \|\| []),\n\t\t\t\t...config.customSecretPatterns,\n\t\t\t];\n\t\t}\n\t\tif (config.excludePatterns) {\n\t\t\tresult.excludePatterns = [\n\t\t\t\t...(result.excludePatterns \|\| []),\n\t\t\t\t...config.excludePatterns,\n\t\t\t];\n\t\t}\n\n\t\t// Tools - deep merge\n\t\tif (config.tools) {\n\t\t\tresult.tools = {\n\t\t\t\t...result.tools,\n\t\t\t\t...config.tools,\n\t\t\t};\n\t\t}\n\t}\n\n\treturn result;\n}\n\n/\n Resolve the effective Guardian configuration\n \n Order of precedence (highest to lowest):\n * 1. Programmatic options\n * 2. Project-level config (.maestro/guardian.json)\n * 3. User-level config (~/.maestro/guardian.json)\n * 4. Default config\n /\nexport function resolveGuardianConfig(options?: {\n\troot?: string;\n\tconfig?: GuardianConfig;\n}): Required<GuardianConfig> {\n\tconst userConfig = loadConfigFile(getUserConfigPath());\n\tconst projectConfig = loadConfigFile(getProjectConfigPath(options?.root));\n\n\tconst merged = mergeConfigs(\n\t\tDEFAULT_GUARDIAN_CONFIG,\n\t\tuserConfig,\n\t\tprojectConfig,\n\t\toptions?.config ?? null,\n\t);\n\n\t// Ensure all required properties are present\n\treturn {\n\t\tenabled: merged.enabled ?? DEFAULT_GUARDIAN_CONFIG.enabled,\n\t\tscanGitOperations:\n\t\t\tmerged.scanGitOperations ?? DEFAULT_GUARDIAN_CONFIG.scanGitOperations,\n\t\tscanDestructiveCommands:\n\t\t\tmerged.scanDestructiveCommands ??\n\t\t\tDEFAULT_GUARDIAN_CONFIG.scanDestructiveCommands,\n\t\tcustomSecretPatterns:\n\t\t\tmerged.customSecretPatterns ??\n\t\t\tDEFAULT_GUARDIAN_CONFIG.customSecretPatterns,\n\t\texcludePatterns:\n\t\t\tmerged.excludePatterns ?? DEFAULT_GUARDIAN_CONFIG.excludePatterns,\n\t\ttools: {\n\t\t\t...DEFAULT_GUARDIAN_CONFIG.tools,\n\t\t\t...merged.tools,\n\t\t},\n\t\ttoolTimeoutMs:\n\t\t\tmerged.toolTimeoutMs ?? DEFAULT_GUARDIAN_CONFIG.toolTimeoutMs,\n\t\tblockOnFindings:\n\t\t\tmerged.blockOnFindings ?? DEFAULT_GUARDIAN_CONFIG.blockOnFindings,\n\t};\n}\n\n/\n Validate custom secret patterns\n /\nexport function validateSecretPatterns(patterns: string[]): {\n\tvalid: string[];\n\tinvalid: Array<{ pattern: string; error: string }>;\n} {\n\tconst valid: string[] = [];\n\tconst invalid: Array<{ pattern: string; error: string }> = [];\n\n\tfor (const pattern of patterns) {\n\t\tconst compiled = compileUserRegex(pattern);\n\t\tif (compiled) {\n\t\t\tvalid.push(pattern);\n\t\t} else {\n\t\t\tinvalid.push({\n\t\t\t\tpattern,\n\t\t\t\terror: \"Invalid or unsafe regex pattern\",\n\t\t\t});\n\t\t}\n\t}\n\n\treturn { valid, invalid };\n}\n\n/\n Compile a user-provided regex string with basic safety guards.\n /\nfunction compileUserRegex(pattern: string): RegExp \| null {\n\tif (!pattern \|\| pattern.length > 500) {\n\t\treturn null;\n\t}\n\n\ttry {\n\t\t// nosemgrep: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp\n\t\treturn new RegExp(pattern);\n\t} catch {\n\t\treturn null;\n\t}\n}\n\n/\n Get a summary of the current Guardian configuration\n */\nexport function getConfigSummary(config: Required<GuardianConfig>): string {\n\tconst lines: string[] = [];\n\n\tlines.push(\"Guardian Configuration:\");\n\tlines.push(` Enabled: ${config.enabled}`);\n\tlines.push(` Scan Git Operations: ${config.scanGitOperations}`);\n\tlines.push(` Scan Destructive Commands: ${config.scanDestructiveCommands}`);\n\tlines.push(` Block on Findings: ${config.blockOnFindings}`);\n\tlines.push(` Tool Timeout: ${config.toolTimeoutMs}ms`);\n\n\tconst enabledTools = Object.entries(config.tools)\n\t\t.filter(([, enabled]) => enabled)\n\t\t.map(([name]) => name);\n\tconst disabledTools = Object.entries(config.tools)\n\t\t.filter(([, enabled]) => !enabled)\n\t\t.map(([name]) => name);\n\n\tlines.push(` Enabled Tools: ${enabledTools.join(\", \") \|\| \"none\"}`);\n\tif (disabledTools.length > 0) {\n\t\tlines.push(` Disabled Tools: ${disabledTools.join(\", \")}`);\n\t}\n\n\tif (config.customSecretPatterns.length > 0) {\n\t\tlines.push(\n\t\t\t` Custom Secret Patterns: ${config.customSecretPatterns.length}`,\n\t\t);\n\t}\n\n\tif (config.excludePatterns.length > 0) {\n\t\tlines.push(` Custom Excludes: ${config.excludePatterns.join(\", \")}`);\n\t}\n\n\treturn lines.join(\"\\n\");\n}\n"]}

package/dist/guardian/runner.d.ts CHANGED Viewed

@@ -1,6 +1,8 @@
 import type { GuardianRunOptions, GuardianRunResult } from "./types.js";
 export type HeuristicFindingName = "AWS access key" | "AWS secret key" | "Private key block" | "Generic API key" | "Slack token" | "GitHub token" | "GitLab token" | "Google API key" | "Stripe key" | "OpenAI API key" | "SendGrid API key" | "Twilio auth token" | "Discord webhook" | "Database URL with credentials" | "JWT token";
+export type EvidenceIntegrityFindingName = "Synthetic production commit SHA" | "Synthetic production PR reference" | "Synthetic local GitHub Actions run ID" | "Local proof identifier" | "Replay artifact claimed as production evidence";
 export declare function detectHeuristicFindings(contents: string): HeuristicFindingName[];
+export declare function detectEvidenceIntegrityFindings(contents: string): EvidenceIntegrityFindingName[];
 export declare function formatGuardianResult(result: GuardianRunResult): string;
 export declare function shouldGuardCommand(command: string): {
     shouldGuard: boolean;

package/dist/guardian/runner.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../src/guardian/runner.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAEX,kBAAkB,EAClB,iBAAiB,EAGjB,MAAM,YAAY,CAAC;~~AA+VpB~~,MAAM,MAAM,oBAAoB,GAC7B,gBAAgB,GAChB,gBAAgB,GAChB,mBAAmB,GACnB,iBAAiB,GACjB,aAAa,GACb,cAAc,GACd,cAAc,GACd,gBAAgB,GAChB,YAAY,GACZ,gBAAgB,GAChB,kBAAkB,GAClB,mBAAmB,GACnB,iBAAiB,GACjB,+BAA+B,GAC/B,WAAW,CAAC;~~AA8Ff~~,wBAAgB,uBAAuB,CACtC,QAAQ,EAAE,MAAM,GACd,oBAAoB,EAAE,CAQxB;~~AA2FD~~,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAoCtE;AAYD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG;IACpD,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CA+BA;AAED,wBAAsB,WAAW,CAChC,OAAO,GAAE,kBAAuB,GAC9B,OAAO,CAAC,iBAAiB,CAAC,~~CAiI5B~~"}
1	+ {"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../src/guardian/runner.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAEX,kBAAkB,EAClB,iBAAiB,EAGjB,MAAM,YAAY,CAAC;AAqWpB,MAAM,MAAM,oBAAoB,GAC7B,gBAAgB,GAChB,gBAAgB,GAChB,mBAAmB,GACnB,iBAAiB,GACjB,aAAa,GACb,cAAc,GACd,cAAc,GACd,gBAAgB,GAChB,YAAY,GACZ,gBAAgB,GAChB,kBAAkB,GAClB,mBAAmB,GACnB,iBAAiB,GACjB,+BAA+B,GAC/B,WAAW,CAAC;AAEf,MAAM,MAAM,4BAA4B,GACrC,iCAAiC,GACjC,mCAAmC,GACnC,uCAAuC,GACvC,wBAAwB,GACxB,gDAAgD,CAAC;AA2IpD,wBAAgB,uBAAuB,CACtC,QAAQ,EAAE,MAAM,GACd,oBAAoB,EAAE,CAQxB;AAED,wBAAgB,+BAA+B,CAC9C,QAAQ,EAAE,MAAM,GACd,4BAA4B,EAAE,CAYhC;AAiJD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAoCtE;AAYD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG;IACpD,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CA+BA;AAED,wBAAsB,WAAW,CAChC,OAAO,GAAE,kBAAuB,GAC9B,OAAO,CAAC,iBAAiB,CAAC,CAqI5B"}

package/dist/guardian/runner.js CHANGED Viewed

@@ -16,12 +16,13 @@ function commandExists(command, cwd) {
     });
     return (result.status ?? 1) === 0;
 }
-function runCommand(command, args, cwd, timeoutMs = DEFAULT_TIMEOUT_MS) {
+function runCommand(command, args, cwd, timeoutMs = DEFAULT_TIMEOUT_MS, env) {
     const started = Date.now();
     try {
         const result = spawnSync(command, args, {
             cwd,
             encoding: "utf-8",
+            env: env ? { ...process.env, ...env } : process.env,
             maxBuffer: 8 * 1024 * 1024,
             timeout: timeoutMs,
         });
@@ -151,13 +152,17 @@ function runSemgrep(files, root) {
         "--error",
         "--timeout",
         "7",
+        "--jobs",
+        "1",
         "--metrics=off",
         "--disable-version-check",
         ...includeArgs,
         ".",
     ];
     // Semgrep can take longer on larger workspaces; allow up to 2 minutes before timing out
-    const result = runCommand(cmd.command, args, root, 120_000);
+    const result = runCommand(cmd.command, args, root, 120_000, {
+        SEMGREP_SEND_METRICS: "off",
+    });
     return {
         tool: "semgrep",
         exitCode: result.exitCode,
@@ -387,6 +392,38 @@ const HEURISTIC_PATTERNS = [
         regex: /\beyJ[A-Za-z0-9_-]{20,}\.eyJ[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}\b/,
     },
 ];
+const EVIDENCE_CONTEXT_REGEX = /(?<![A-Za-z0-9_-])(?:production[\s_-]+evidence|productionEvidence|production[\s_-]+proof|productionProof|live[\s_-]+evidence|liveEvidence|live[\s_-]+proof|liveProof|dereferenceable|evidence[\s_-]+bundle|evidenceBundle|deploy-verifier|hard[_-]identifiers|hardIdentifiers)(?![A-Za-z0-9_-])/i;
+const REPLAY_EVIDENCE_MARKER_PATTERN = String.raw `(?:\bdeterministic_replay\b|(?<![A-Za-z0-9_])["']?replay["']?\s*:\s*true)`;
+const PRODUCTION_EVIDENCE_CLAIM_PATTERN = String.raw `(?<![A-Za-z0-9_-])["']?(?:production[_-]?evidence|live[_-]?proof)["']?\s*:\s*["']?(?:true|verified)["']?(?![A-Za-z0-9_-])`;
+const EVIDENCE_PATTERNS = [
+    {
+        name: "Synthetic production commit SHA",
+        // A 40-hex "SHA" containing an embedded UTC timestamp plus cutesy marker
+        // text is a fixture identifier, not dereferenceable git evidence.
+        regex: /\b[0-9a-f]{4,12}20\d{12}[0-9a-f]{0,16}(?:c0de|cafe|5afe)[0-9a-f]{0,20}\b/i,
+        requiresEvidenceContext: true,
+    },
+    {
+        name: "Synthetic production PR reference",
+        regex: /\b[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+#(?!\d+\b)[A-Za-z][A-Za-z0-9_.:-]*(?:local|prod-pr-lane)[A-Za-z0-9_.:-]*\b/i,
+        requiresEvidenceContext: true,
+    },
+    {
+        name: "Synthetic local GitHub Actions run ID",
+        regex: /\bgha-run-[A-Za-z0-9_.:-]*-local\b/i,
+        requiresEvidenceContext: true,
+    },
+    {
+        name: "Local proof identifier",
+        regex: /\bproof(?:[_-]?id|Id)?\b["']?\s*[:=]\s*["']?[A-Za-z0-9_.:-]+-local\b/i,
+        requiresEvidenceContext: true,
+    },
+    {
+        name: "Replay artifact claimed as production evidence",
+        matches: (contents) => new RegExp(REPLAY_EVIDENCE_MARKER_PATTERN, "i").test(contents) &&
+            new RegExp(PRODUCTION_EVIDENCE_CLAIM_PATTERN, "i").test(contents),
+    },
+];
 export function detectHeuristicFindings(contents) {
     const matches = [];
     for (const pattern of HEURISTIC_PATTERNS) {
@@ -396,6 +433,67 @@ export function detectHeuristicFindings(contents) {
     }
     return matches;
 }
+export function detectEvidenceIntegrityFindings(contents) {
+    const matches = [];
+    const hasEvidenceContext = EVIDENCE_CONTEXT_REGEX.test(contents);
+    for (const pattern of EVIDENCE_PATTERNS) {
+        if (pattern.requiresEvidenceContext && !hasEvidenceContext) {
+            continue;
+        }
+        if (pattern.matches?.(contents) ?? pattern.regex?.test(contents)) {
+            matches.push(pattern.name);
+        }
+    }
+    return matches;
+}
+function runEvidenceIntegrityScan(files, root) {
+    const started = Date.now();
+    const findings = [];
+    const ignorePatterns = [
+        /test\/guardian\/evidence-integrity\.test\.ts$/,
+        /src\/guardian\/runner\.ts$/,
+    ];
+    for (const relative of files) {
+        if (ignorePatterns.some((pattern) => pattern.test(relative))) {
+            continue;
+        }
+        const fullPath = resolve(root, relative);
+        if (!existsSync(fullPath))
+            continue;
+        let contents;
+        try {
+            const stats = statSync(fullPath);
+            if (stats.size > 2 * 1024 * 1024) {
+                continue;
+            }
+            contents = readFileSync(fullPath, "utf-8");
+        }
+        catch {
+            continue;
+        }
+        if (contents.includes("\0"))
+            continue;
+        for (const match of detectEvidenceIntegrityFindings(contents)) {
+            findings.push(`${match}: ${relative}`);
+        }
+    }
+    if (!findings.length) {
+        return {
+            tool: "evidence-integrity",
+            exitCode: 0,
+            stdout: "",
+            stderr: "",
+            durationMs: Date.now() - started,
+        };
+    }
+    return {
+        tool: "evidence-integrity",
+        exitCode: 1,
+        stdout: findings.join("\n"),
+        stderr: "Live-production claims must use dereferenceable git, PR, Actions, deploy, and signature identifiers. Mark deterministic fixtures as replay evidence instead.",
+        durationMs: Date.now() - started,
+    };
+}
 function runHeuristicScan(files, root) {
     const started = Date.now();
     const findings = [];
@@ -407,6 +505,8 @@ function runHeuristicScan(files, root) {
         /test\/safety\/context-firewall\.test\.ts$/,
         /test\/safety\/edge-cases\.test\.ts$/,
         /test\/safety\/safety-middleware\.test\.ts$/,
+        /test\/telemetry\/beacon\.test\.ts$/,
+        /test\/telemetry\/telemetry-metadata-split\.test\.ts$/,
         // The runner itself contains regex patterns that look like secrets
         /src\/guardian\/runner\.ts$/,
     ];
@@ -606,6 +706,9 @@ export async function runGuardian(options = {}) {
         config: options.config,
     });
     const toolResults = [];
+    if (config.tools.evidenceIntegrity) {
+        toolResults.push(runEvidenceIntegrityScan(files, scanRoot));
+    }
     if (config.tools.semgrep) {
         toolResults.push(runSemgrep(files, scanRoot));
     }

package/dist/guardian/runner.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"runner.js","sourceRoot":"","sources":["../../src/guardian/runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EACN,YAAY,EACZ,UAAU,EACV,SAAS,EACT,WAAW,EACX,YAAY,EACZ,MAAM,EACN,QAAQ,EACR,aAAa,GACb,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAS9C,MAAM,uBAAuB,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AAC5D,MAAM,sBAAsB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;AACnD,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAclC,SAAS,aAAa,CAAC,OAAe,EAAE,GAAW;IAClD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE;QAChD,GAAG;QACH,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,OAAO;KACjB,CAAC,CAAC;IACH,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,UAAU,CAClB,OAAe,EACf,IAAc,EACd,GAAW,EACX,SAAS,GAAG,kBAAkB;IAE9B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE;YACvC,GAAG;YACH,QAAQ,EAAE,OAAO;YACjB,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;YAC1B,OAAO,EAAE,SAAS;SAClB,CAAC,CAAC;QACH,OAAO;YACN,QAAQ,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC;YAC5B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;SAChC,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO;YACN,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAC9D,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAC7D,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;SAChC,CAAC;IACH,CAAC;AACF,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY;IACxC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACrE,OAAO,CACN,MAAM,CAAC,QAAQ,KAAK,CAAC;QACrB,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CACrC,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAe;IACnC,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC5C,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAC5B,CAAC,OAAO,EAAE,EAAE,CACX,UAAU,KAAK,OAAO;YACtB,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC;YAC9B,UAAU,CAAC,QAAQ,CAAC,IAAI,OAAO,EAAE,CAAC,CACnC,CAAC;IACH,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACpC,MAAM,MAAM,GAAG,UAAU,CACxB,KAAK,EACL,CAAC,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,wBAAwB,CAAC,EAC7D,IAAI,CACJ,CAAC;IACF,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO;YACN,EAAE,EAAE,KAAK;YACT,KAAK,EACJ,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;gBACpB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;gBACpB,6BAA6B;YAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ;SACzB,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,CACxB,MAAM,CAAC,MAAM;SACX,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CACjB,CAAC;IACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACrC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO;YACN,EAAE,EAAE,KAAK;YACT,KAAK,EACJ,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;gBACpB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;gBACpB,8BAA8B;YAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;SACzB,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,CACxB,MAAM,CAAC,MAAM;SACX,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CACjB,CAAC;IACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,iBAAiB,CACzB,UAA+B;IAE/B,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;IAClC,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IACnC,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC5C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC/C,IAAI,uBAAuB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAClD,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,+BAA+B;gBACvC,WAAW,EAAE,UAAU;aACvB,CAAC;QACH,CAAC;QACD,IAAI,sBAAsB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACjD,OAAO;gBACN,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,gCAAgC;gBACxC,WAAW,EAAE,SAAS;aACtB,CAAC;QACH,CAAC;IACF,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,aAAa,CACrB,IAAY;IAEZ,IAAI,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACzC,CAAC;IACD,IAAI,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;IACvD,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,KAAe,EAAE,IAAY;IAChD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,OAAO;YACN,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;YAChC,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,mBAAmB;SAC3B,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG;QACZ,GAAG,GAAG,CAAC,IAAI;QACX,MAAM;QACN,UAAU;QACV,WAAW;QACX,UAAU;QACV,MAAM;QACN,QAAQ;QACR,2BAA2B;QAC3B,SAAS;QACT,WAAW;QACX,GAAG;QACH,eAAe;QACf,yBAAyB;QACzB,GAAG,WAAW;QACd,GAAG;KACH,CAAC;IACF,wFAAwF;IACxF,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5D,OAAO;QACN,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU;KAC7B,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAY,EAAE,KAAe;IAC5D,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,2BAA2B,CAAC,CAAC,CAAC;IAC5E,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5B,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACtE,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YACzB,wCAAwC;YACxC,SAAS;QACV,CAAC;QACD,IAAI,CAAC;YACJ,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACR,4CAA4C;QAC7C,CAAC;IACF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,KAAe;IACrD,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACrE,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACvC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,SAAS;QACV,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5B,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC;YACJ,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACR,0CAA0C;QAC3C,CAAC;IACF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,KAAe,EAAE,IAAY;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO;YACN,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;YAChC,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,UAAU;SAClB,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,CAAC,SAAS,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;QAC9B,OAAO;YACN,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;YAChC,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,2BAA2B;SACnC,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,SAAS;QACrB,CAAC,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;QAC1C,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACzE,OAAO;QACN,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU;KAC7B,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAe,EAAE,IAAY;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC;QACxC,OAAO;YACN,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;YAChC,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,0BAA0B;SAClC,CAAC;IACH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO;YACN,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;YAChC,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,UAAU;SAClB,CAAC;IACH,CAAC;IAED,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,CAAC;QACJ,OAAO,GAAG,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO;gBACN,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE,CAAC;gBACX,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,EAAE;gBACV,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;gBAChC,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,UAAU;aAClB,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,CACxB,YAAY,EACZ,CAAC,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,EACpE,OAAO,CACP,CAAC;QACF,OAAO;YACN,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,UAAU,EAAE,MAAM,CAAC,UAAU;SAC7B,CAAC;IACH,CAAC;YAAS,CAAC;QACV,IAAI,OAAO,EAAE,CAAC;YACb,IAAI,CAAC;gBACJ,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,CAAC;YAAC,MAAM,CAAC;gBACR,sBAAsB;YACvB,CAAC;QACF,CAAC;IACF,CAAC;AACF,CAAC;AAmBD,MAAM,kBAAkB,GACvB;IACC,kBAAkB;IAClB,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,sBAAsB,EAAE;IACzD;QACC,IAAI,EAAE,gBAAgB;QACtB,8DAA8D;QAC9D,KAAK,EACJ,+FAA+F;KAChG;IACD;QACC,IAAI,EAAE,mBAAmB;QACzB,KAAK,EAAE,0BAA0B;KACjC;IACD;QACC,IAAI,EAAE,iBAAiB;QACvB,8EAA8E;QAC9E,gCAAgC;QAChC,mCAAmC;QACnC,sCAAsC;QACtC,kBAAkB;QAClB,oBAAoB;QACpB,KAAK,EACJ,4IAA4I;KAC7I;IACD;QACC,IAAI,EAAE,aAAa;QACnB,gEAAgE;QAChE,oCAAoC;QACpC,oCAAoC;QACpC,+DAA+D;QAC/D,KAAK,EAAE,kEAAkE;KACzE;IACD;QACC,IAAI,EAAE,cAAc;QACpB,uEAAuE;QACvE,uDAAuD;QACvD,KAAK,EAAE,+DAA+D;KACtE;IACD;QACC,IAAI,EAAE,cAAc;QACpB,2CAA2C;QAC3C,KAAK,EAAE,8BAA8B;KACrC;IACD;QACC,IAAI,EAAE,gBAAgB;QACtB,kCAAkC;QAClC,KAAK,EAAE,2BAA2B;KAClC;IACD;QACC,IAAI,EAAE,YAAY;QAClB,0EAA0E;QAC1E,KAAK,EAAE,2CAA2C;KAClD;IACD;QACC,IAAI,EAAE,gBAAgB;QACtB,kDAAkD;QAClD,KAAK,EAAE,yBAAyB;KAChC;IACD;QACC,IAAI,EAAE,kBAAkB;QACxB,+BAA+B;QAC/B,KAAK,EAAE,gDAAgD;KACvD;IACD;QACC,IAAI,EAAE,mBAAmB;QACzB,wCAAwC;QACxC,KAAK,EACJ,oFAAoF;KACrF;IACD;QACC,IAAI,EAAE,iBAAiB;QACvB,gDAAgD;QAChD,KAAK,EACJ,6FAA6F;KAC9F;IACD;QACC,IAAI,EAAE,+BAA+B;QACrC,wDAAwD;QACxD,kFAAkF;QAClF,KAAK,EACJ,mFAAmF;KACpF;IACD;QACC,IAAI,EAAE,WAAW;QACjB,kDAAkD;QAClD,oFAAoF;QACpF,KAAK,EACJ,sEAAsE;KACvE;CACD,CAAC;AAEH,MAAM,UAAU,uBAAuB,CACtC,QAAgB;IAEhB,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;QAC1C,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;IACF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAe,EAAE,IAAY;IACtD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,cAAc,GAAG;QACtB,2CAA2C;QAC3C,2CAA2C;QAC3C,6DAA6D;QAC7D,mDAAmD;QACnD,2CAA2C;QAC3C,qCAAqC;QACrC,4CAA4C;QAC5C,mEAAmE;QACnE,4BAA4B;KAC5B,CAAC;IAEF,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;QAC9B,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC9D,SAAS;QACV,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,SAAS;QACpC,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACJ,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACjC,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;gBAClC,SAAS;YACV,CAAC;YACD,QAAQ,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACR,SAAS;QACV,CAAC;QACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAS,CAAC,gBAAgB;QACvD,KAAK,MAAM,KAAK,IAAI,uBAAuB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvD,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,QAAQ,EAAE,CAAC,CAAC;QACxC,CAAC;IACF,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACtB,OAAO;YACN,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;SAChC,CAAC;IACH,CAAC;IACD,OAAO;QACN,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,CAAC;QACX,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QAC3B,MAAM,EAAE,EAAE;QACV,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;KAChC,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CACpB,MAAsB,EACtB,KAAe,EACf,KAA2B,EAC3B,MAAwB,EACxB,UAAmB;IAEnB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,qBAAqB,UAAU,IAAI,UAAU,GAAG,CAAC;IACzD,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,iBAAiB,CAAC;IAC7E,MAAM,MAAM,GACX,MAAM,KAAK,QAAQ;QAClB,CAAC,CAAC,iBAAiB;QACnB,CAAC,CAAC,MAAM,KAAK,QAAQ;YACpB,CAAC,CAAC,yBAAyB;YAC3B,CAAC,CAAC,gBAAgB,CAAC;IACtB,MAAM,GAAG,GAAG,KAAK;SACf,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;SAC/B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;SACxB,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,MAAM,OAAO,GAAG,KAAK;SACnB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;SAC9B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;SACxB,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,MAAM,WAAW,GAChB,GAAG,IAAI,OAAO;QACb,CAAC,CAAC,GAAG,GAAG,cAAc,OAAO,GAAG;QAChC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClD,OAAO,GAAG,MAAM,OAAO,KAAK,CAAC,MAAM,IAAI,SAAS,GAC/C,WAAW,CAAC,CAAC,CAAC,UAAU,WAAW,EAAE,CAAC,CAAC,CAAC,EACzC,EAAE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAyB;IAC7D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3B,KAAK,CAAC,IAAI,CACT,WAAW,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,MAAM,gBAClD,MAAM,CAAC,UACR,IAAI,CACJ,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvC,MAAM,MAAM,GACX,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM;YAC1B,CAAC,CAAC,YAAY,IAAI,CAAC,MAAM,GAAG;YAC5B,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC;gBACpB,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC;oBACpB,CAAC,CAAC,UAAU;oBACZ,CAAC,CAAC,OAAO,CAAC;QACd,KAAK,CAAC,IAAI,CACT,KAAK,IAAI,CAAC,IAAI,KAAK,MAAM,KAAK,IAAI,CAAC,UAAU,KAC5C,IAAI,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EACnD,GAAG,CACH,CAAC;QACF,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC/C,CAAC;IACF,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,MAAM,GACX,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,KAAK,CAAC,IAAI,CAAC,UAAU,OAAO,GAAG,MAAM,EAAE,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAA2B;IACrD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;IAC1E,IAAI,QAAQ;QAAE,OAAO,OAAO,CAAC;IAC7B,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAC7B,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC,CAC9C,CAAC;IACF,IAAI,WAAW;QAAE,OAAO,QAAQ,CAAC;IACjC,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAIjD,MAAM,aAAa,GAAG,0CAA0C,CAAC;IACjE,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC9C,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC3D,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnB,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC;IAC3E,CAAC;IAED,MAAM,mBAAmB,GAA4C;QACpE,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE;QAC3C;YACC,KAAK,EAAE,4CAA4C;YACnD,KAAK,EAAE,OAAO;SACd;QACD,EAAE,KAAK,EAAE,2BAA2B,EAAE,KAAK,EAAE,cAAc,EAAE;QAC7D,EAAE,KAAK,EAAE,qBAAqB,EAAE,KAAK,EAAE,WAAW,EAAE;QACpD,EAAE,KAAK,EAAE,0BAA0B,EAAE,KAAK,EAAE,YAAY,EAAE;QAC1D,EAAE,KAAK,EAAE,4BAA4B,EAAE,KAAK,EAAE,cAAc,EAAE;QAC9D,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE;QACrC,EAAE,KAAK,EAAE,wBAAwB,EAAE,KAAK,EAAE,eAAe,EAAE;KAC3D,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,mBAAmB,EAAE,CAAC;QAC3C,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QACtD,CAAC;IACF,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAChC,UAA8B,EAAE;IAEhC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC;IAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IAClE,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QACzB,MAAM,MAAM,GAAsB;YACjC,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE,CAAC;YACX,SAAS;YACT,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YAClC,MAAM;YACN,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,YAAY,EAAE,CAAC;YACf,OAAO,EAAE,oCAAoC;YAC7C,UAAU,EAAE,UAAU,CAAC,MAAM,IAAI,UAAU;YAC3C,WAAW,EAAE,EAAE;SACf,CAAC;QACF,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC1B,OAAO,MAAM,CAAC;IACf,CAAC;IAED,MAAM,WAAW,GAChB,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IACnE,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;QACrB,MAAM,MAAM,GAAsB;YACjC,MAAM,EAAE,OAAO;YACf,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,SAAS;YACT,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YAClC,MAAM;YACN,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,YAAY,EAAE,CAAC;YACf,OAAO,EAAE,WAAW,CAAC,KAAK;YAC1B,WAAW,EAAE,EAAE;SACf,CAAC;QACF,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC1B,OAAO,MAAM,CAAC;IACf,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC;IAChC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,MAAM,GAAsB;YACjC,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE,CAAC;YACX,SAAS;YACT,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YAClC,MAAM;YACN,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,YAAY,EAAE,CAAC;YACf,OAAO,EAAE,kBAAkB;YAC3B,UAAU,EAAE,UAAU;YACtB,WAAW,EAAE,EAAE;SACf,CAAC;QACF,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC1B,OAAO,MAAM,CAAC;IACf,CAAC;IAED,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACzB,WAAW,GAAG,sBAAsB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAClD,IAAI,WAAW,EAAE,CAAC;YACjB,QAAQ,GAAG,WAAW,CAAC;QACxB,CAAC;IACF,CAAC;IAED,MAAM,MAAM,GAAG,qBAAqB,CAAC;QACpC,IAAI;QACJ,MAAM,EAAE,OAAO,CAAC,MAAM;KACtB,CAAC,CAAC;IAEH,MAAM,WAAW,GAAyB,EAAE,CAAC;IAE7C,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAC1B,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,QAAQ,GAA8B,IAAI,CAAC;IAC/C,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QAC7B,MAAM,gBAAgB,GAAG,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACxD,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAC/B,QAAQ,GAAG,gBAAgB,CAAC;QAC7B,CAAC;IACF,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QAC1C,MAAM,aAAa,GAAG,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;YAC5B,QAAQ,GAAG,aAAa,CAAC;QAC1B,CAAC;IACF,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QAC7C,QAAQ,GAAG,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACd,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,QAAQ,GACb,MAAM,KAAK,QAAQ;QAClB,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC,CAAC;YACjE,EAAE,QAAQ,IAAI,CAAC,CAAC,CAAC;IAErB,MAAM,MAAM,GAAsB;QACjC,MAAM;QACN,QAAQ;QACR,SAAS;QACT,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;QAClC,MAAM;QACN,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,YAAY,EAAE,KAAK,CAAC,MAAM;QAC1B,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK;QACxC,OAAO,EAAE,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC;QACzD,WAAW;KACX,CAAC;IAEF,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAE1B,IAAI,WAAW,EAAE,CAAC;QACjB,IAAI,CAAC;YACJ,MAAM,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACR,sBAAsB;QACvB,CAAC;IACF,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC","sourcesContent":["import { spawnSync } from \"node:child_process\";\nimport {\n\tcopyFileSync,\n\texistsSync,\n\tmkdirSync,\n\tmkdtempSync,\n\treadFileSync,\n\trmSync,\n\tstatSync,\n\twriteFileSync,\n} from \"node:fs\";\nimport os from \"node:os\";\nimport { dirname, join, resolve } from \"node:path\";\nimport { resolveGuardianConfig } from \"./config.js\";\nimport { loadGuardianState, recordGuardianRun } from \"./state.js\";\nimport { DEFAULT_EXCLUDES } from \"./types.js\";\nimport type {\n\tGuardianEnablement,\n\tGuardianRunOptions,\n\tGuardianRunResult,\n\tGuardianStatus,\n\tGuardianToolResult,\n} from \"./types.js\";\n\nconst GUARDIAN_DISABLE_VALUES = [\"0\", \"false\", \"off\", \"no\"];\nconst GUARDIAN_ENABLE_VALUES = [\"1\", \"true\", \"on\"];\nconst DEFAULT_TIMEOUT_MS = 10_000;\n\ntype FileListResult =\n\t\| { ok: true; files: string[] }\n\t\| { ok: false; error: string; exitCode: number };\n\ntype CommandResult = {\n\texitCode: number;\n\tstdout: string;\n\tstderr: string;\n\terror?: string;\n\tdurationMs: number;\n};\n\nfunction commandExists(command: string, cwd: string): boolean {\n\tconst result = spawnSync(command, [\"--version\"], {\n\t\tcwd,\n\t\tstdio: \"pipe\",\n\t\tencoding: \"utf-8\",\n\t});\n\treturn (result.status ?? 1) === 0;\n}\n\nfunction runCommand(\n\tcommand: string,\n\targs: string[],\n\tcwd: string,\n\ttimeoutMs = DEFAULT_TIMEOUT_MS,\n): CommandResult {\n\tconst started = Date.now();\n\ttry {\n\t\tconst result = spawnSync(command, args, {\n\t\t\tcwd,\n\t\t\tencoding: \"utf-8\",\n\t\t\tmaxBuffer: 8 * 1024 * 1024,\n\t\t\ttimeout: timeoutMs,\n\t\t});\n\t\treturn {\n\t\t\texitCode: result.status ?? 1,\n\t\t\tstdout: result.stdout ?? \"\",\n\t\t\tstderr: result.stderr ?? \"\",\n\t\t\tdurationMs: Date.now() - started,\n\t\t};\n\t} catch (error) {\n\t\treturn {\n\t\t\texitCode: 1,\n\t\t\tstdout: \"\",\n\t\t\tstderr: error instanceof Error ? error.message : String(error),\n\t\t\terror: error instanceof Error ? error.message : String(error),\n\t\t\tdurationMs: Date.now() - started,\n\t\t};\n\t}\n}\n\nfunction hasGitSecretsPlugin(root: string): boolean {\n\tconst result = runCommand(\"git\", [\"secrets\", \"--help\"], root, 4_000);\n\treturn (\n\t\tresult.exitCode === 0 \|\|\n\t\tresult.stderr.includes(\"git secrets\") \|\|\n\t\tresult.stdout.includes(\"git secrets\")\n\t);\n}\n\nfunction filterFiles(files: string[]): string[] {\n\treturn files.filter((file) => {\n\t\tconst normalized = file.replace(/\\\\/g, \"/\");\n\t\treturn !DEFAULT_EXCLUDES.some(\n\t\t\t(exclude) =>\n\t\t\t\tnormalized === exclude \|\|\n\t\t\t\tnormalized.startsWith(exclude) \|\|\n\t\t\t\tnormalized.includes(`/${exclude}`),\n\t\t);\n\t});\n}\n\nfunction listStagedFiles(root: string): FileListResult {\n\tconst result = runCommand(\n\t\t\"git\",\n\t\t[\"diff\", \"--name-only\", \"--cached\", \"--diff-filter=ACMRTUXB\"],\n\t\troot,\n\t);\n\tif (result.exitCode !== 0) {\n\t\treturn {\n\t\t\tok: false,\n\t\t\terror:\n\t\t\t\tresult.stderr.trim() \|\|\n\t\t\t\tresult.stdout.trim() \|\|\n\t\t\t\t\"Unable to list staged files\",\n\t\t\texitCode: result.exitCode,\n\t\t};\n\t}\n\tconst files = filterFiles(\n\t\tresult.stdout\n\t\t\t.split(\"\\n\")\n\t\t\t.map((line) => line.trim())\n\t\t\t.filter(Boolean),\n\t);\n\treturn { ok: true, files };\n}\n\nfunction listTrackedFiles(root: string): FileListResult {\n\tconst result = runCommand(\"git\", [\"ls-files\"], root);\n\tif (result.exitCode !== 0) {\n\t\treturn {\n\t\t\tok: false,\n\t\t\terror:\n\t\t\t\tresult.stderr.trim() \|\|\n\t\t\t\tresult.stdout.trim() \|\|\n\t\t\t\t\"Unable to list tracked files\",\n\t\t\texitCode: result.exitCode,\n\t\t};\n\t}\n\tconst files = filterFiles(\n\t\tresult.stdout\n\t\t\t.split(\"\\n\")\n\t\t\t.map((line) => line.trim())\n\t\t\t.filter(Boolean),\n\t);\n\treturn { ok: true, files };\n}\n\nfunction resolveEnablement(\n\trespectEnv: boolean \| undefined,\n): GuardianEnablement {\n\tconst state = loadGuardianState();\n\tif (!respectEnv) {\n\t\treturn { enabled: state.enabled };\n\t}\n\tconst rawEnv = process.env.MAESTRO_GUARDIAN;\n\tif (typeof rawEnv === \"string\" && rawEnv.trim().length > 0) {\n\t\tconst normalized = rawEnv.trim().toLowerCase();\n\t\tif (GUARDIAN_DISABLE_VALUES.includes(normalized)) {\n\t\t\treturn {\n\t\t\t\tenabled: false,\n\t\t\t\treason: \"MAESTRO_GUARDIAN=0 (disabled)\",\n\t\t\t\tenvOverride: \"disabled\",\n\t\t\t};\n\t\t}\n\t\tif (GUARDIAN_ENABLE_VALUES.includes(normalized)) {\n\t\t\treturn {\n\t\t\t\tenabled: true,\n\t\t\t\treason: \"MAESTRO_GUARDIAN=1 (forced on)\",\n\t\t\t\tenvOverride: \"enabled\",\n\t\t\t};\n\t\t}\n\t}\n\treturn { enabled: state.enabled };\n}\n\nfunction locateSemgrep(\n\troot: string,\n): { command: string; args: string[] } \| null {\n\tif (commandExists(\"semgrep\", root)) {\n\t\treturn { command: \"semgrep\", args: [] };\n\t}\n\tif (commandExists(\"npx\", root)) {\n\t\treturn { command: \"npx\", args: [\"--yes\", \"semgrep\"] };\n\t}\n\treturn null;\n}\n\nfunction runSemgrep(files: string[], root: string): GuardianToolResult {\n\tconst started = Date.now();\n\tconst cmd = locateSemgrep(root);\n\tif (!cmd) {\n\t\treturn {\n\t\t\ttool: \"semgrep\",\n\t\t\texitCode: 0,\n\t\t\tstdout: \"\",\n\t\t\tstderr: \"\",\n\t\t\tdurationMs: Date.now() - started,\n\t\t\tskipped: true,\n\t\t\treason: \"semgrep not found\",\n\t\t};\n\t}\n\tconst includeArgs = files.flatMap((file) => [\"--include\", file]);\n\tconst args = [\n\t\t...cmd.args,\n\t\t\"scan\",\n\t\t\"--config\",\n\t\t\"p/secrets\",\n\t\t\"--config\",\n\t\t\"p/ci\",\n\t\t\"--json\",\n\t\t\"--skip-unknown-extensions\",\n\t\t\"--error\",\n\t\t\"--timeout\",\n\t\t\"7\",\n\t\t\"--metrics=off\",\n\t\t\"--disable-version-check\",\n\t\t...includeArgs,\n\t\t\".\",\n\t];\n\t// Semgrep can take longer on larger workspaces; allow up to 2 minutes before timing out\n\tconst result = runCommand(cmd.command, args, root, 120_000);\n\treturn {\n\t\ttool: \"semgrep\",\n\t\texitCode: result.exitCode,\n\t\tstdout: result.stdout,\n\t\tstderr: result.stderr,\n\t\tdurationMs: result.durationMs,\n\t};\n}\n\nfunction materializeStagedFiles(root: string, files: string[]): string \| null {\n\tconst tempDir = mkdtempSync(join(os.tmpdir(), \"composer-guardian-staged-\"));\n\tfor (const relative of files) {\n\t\tconst target = join(tempDir, relative);\n\t\tconst dir = dirname(target);\n\t\tmkdirSync(dir, { recursive: true });\n\t\tconst show = runCommand(\"git\", [\"show\", `:${relative}`], root, 5_000);\n\t\tif (show.exitCode !== 0) {\n\t\t\t// skip files we fail to read from index\n\t\t\tcontinue;\n\t\t}\n\t\ttry {\n\t\t\twriteFileSync(target, show.stdout, \"utf-8\");\n\t\t} catch {\n\t\t\t// ignore write errors for problematic files\n\t\t}\n\t}\n\treturn tempDir;\n}\n\nfunction copyFilesToTemp(root: string, files: string[]): string \| null {\n\tif (!files.length) return null;\n\tconst tempDir = mkdtempSync(join(os.tmpdir(), \"composer-guardian-\"));\n\tfor (const relative of files) {\n\t\tconst source = resolve(root, relative);\n\t\tif (!existsSync(source)) {\n\t\t\tcontinue;\n\t\t}\n\t\tconst target = join(tempDir, relative);\n\t\tconst dir = dirname(target);\n\t\tmkdirSync(dir, { recursive: true });\n\t\ttry {\n\t\t\tcopyFileSync(source, target);\n\t\t} catch {\n\t\t\t// ignore copy errors; file may be removed\n\t\t}\n\t}\n\treturn tempDir;\n}\n\nfunction runGitSecrets(files: string[], root: string): GuardianToolResult {\n\tconst started = Date.now();\n\tif (!files.length) {\n\t\treturn {\n\t\t\ttool: \"git-secrets\",\n\t\t\texitCode: 0,\n\t\t\tstdout: \"\",\n\t\t\tstderr: \"\",\n\t\t\tdurationMs: Date.now() - started,\n\t\t\tskipped: true,\n\t\t\treason: \"no files\",\n\t\t};\n\t}\n\n\tconst hasBinary = commandExists(\"git-secrets\", root);\n\tconst hasPlugin = !hasBinary && hasGitSecretsPlugin(root);\n\tif (!hasBinary && !hasPlugin) {\n\t\treturn {\n\t\t\ttool: \"git-secrets\",\n\t\t\texitCode: 0,\n\t\t\tstdout: \"\",\n\t\t\tstderr: \"\",\n\t\t\tdurationMs: Date.now() - started,\n\t\t\tskipped: true,\n\t\t\treason: \"git-secrets not installed\",\n\t\t};\n\t}\n\n\tconst args = hasBinary\n\t\t? [\"--scan\", \"--no-index\", \"--\", ...files]\n\t\t: [\"secrets\", \"--scan\", \"--no-index\", \"--\", ...files];\n\tconst result = runCommand(hasBinary ? \"git-secrets\" : \"git\", args, root);\n\treturn {\n\t\ttool: \"git-secrets\",\n\t\texitCode: result.exitCode,\n\t\tstdout: result.stdout,\n\t\tstderr: result.stderr,\n\t\tdurationMs: result.durationMs,\n\t};\n}\n\nfunction runTrufflehog(files: string[], root: string): GuardianToolResult {\n\tconst started = Date.now();\n\tif (!commandExists(\"trufflehog\", root)) {\n\t\treturn {\n\t\t\ttool: \"trufflehog\",\n\t\t\texitCode: 0,\n\t\t\tstdout: \"\",\n\t\t\tstderr: \"\",\n\t\t\tdurationMs: Date.now() - started,\n\t\t\tskipped: true,\n\t\t\treason: \"trufflehog not installed\",\n\t\t};\n\t}\n\tif (!files.length) {\n\t\treturn {\n\t\t\ttool: \"trufflehog\",\n\t\t\texitCode: 0,\n\t\t\tstdout: \"\",\n\t\t\tstderr: \"\",\n\t\t\tdurationMs: Date.now() - started,\n\t\t\tskipped: true,\n\t\t\treason: \"no files\",\n\t\t};\n\t}\n\n\tlet tempDir: string \| null = null;\n\ttry {\n\t\ttempDir = copyFilesToTemp(root, files);\n\t\tif (!tempDir) {\n\t\t\treturn {\n\t\t\t\ttool: \"trufflehog\",\n\t\t\t\texitCode: 0,\n\t\t\t\tstdout: \"\",\n\t\t\t\tstderr: \"\",\n\t\t\t\tdurationMs: Date.now() - started,\n\t\t\t\tskipped: true,\n\t\t\t\treason: \"no files\",\n\t\t\t};\n\t\t}\n\t\tconst result = runCommand(\n\t\t\t\"trufflehog\",\n\t\t\t[\"filesystem\", \"--no-update\", \"--fail\", \"--json\", \"--path\", tempDir],\n\t\t\ttempDir,\n\t\t);\n\t\treturn {\n\t\t\ttool: \"trufflehog\",\n\t\t\texitCode: result.exitCode,\n\t\t\tstdout: result.stdout,\n\t\t\tstderr: result.stderr,\n\t\t\tdurationMs: result.durationMs,\n\t\t};\n\t} finally {\n\t\tif (tempDir) {\n\t\t\ttry {\n\t\t\t\trmSync(tempDir, { recursive: true, force: true });\n\t\t\t} catch {\n\t\t\t\t// best effort cleanup\n\t\t\t}\n\t\t}\n\t}\n}\n\nexport type HeuristicFindingName =\n\t\| \"AWS access key\"\n\t\| \"AWS secret key\"\n\t\| \"Private key block\"\n\t\| \"Generic API key\"\n\t\| \"Slack token\"\n\t\| \"GitHub token\"\n\t\| \"GitLab token\"\n\t\| \"Google API key\"\n\t\| \"Stripe key\"\n\t\| \"OpenAI API key\"\n\t\| \"SendGrid API key\"\n\t\| \"Twilio auth token\"\n\t\| \"Discord webhook\"\n\t\| \"Database URL with credentials\"\n\t\| \"JWT token\";\n\nconst HEURISTIC_PATTERNS: Array<{ name: HeuristicFindingName; regex: RegExp }> =\n\t[\n\t\t// AWS credentials\n\t\t{ name: \"AWS access key\", regex: /\\bAKIA[0-9A-Z]{16}\\b/ },\n\t\t{\n\t\t\tname: \"AWS secret key\",\n\t\t\t// AWS secret keys are 40 characters of base64-like characters\n\t\t\tregex:\n\t\t\t\t/(?:aws_secret_access_key\|secret_access_key\|aws_secret)\\s[:=]\\s['\"]?[A-Za-z0-9/+=]{40}['\"]?/i,\n\t\t},\n\t\t{\n\t\t\tname: \"Private key block\",\n\t\t\tregex: /BEGIN [A-Z ]PRIVATE KEY/,\n\t\t},\n\t\t{\n\t\t\tname: \"Generic API key\",\n\t\t\t// Avoid matching natural language inside string literals while still catching\n\t\t\t// typical config patterns like:\n\t\t\t// token: \"....\" / token = \"....\"\n\t\t\t// apiKey: \"....\" / api_key = \"....\"\n\t\t\t// And JSON-style:\n\t\t\t// \"token\": \"....\"\n\t\t\tregex:\n\t\t\t\t/(?:(?<!['\"])\\b(?:api[_-]?key\|token)\\b\\s[:=]\\s['\"][A-Za-z0-9_-]{20,}['\"]\|['\"](?:api[_-]?key\|token)['\"]\\s:\\s['\"][A-Za-z0-9_-]{20,}['\"])/i,\n\t\t},\n\t\t{\n\t\t\tname: \"Slack token\",\n\t\t\t// Slack tokens are typically segmented and include numeric IDs:\n\t\t\t// xoxb-<digits>-<digits>-<secret>\n\t\t\t// xapp-<digits>-<digits>-<secret>\n\t\t\t// Use a stricter shape to avoid false positives in tests/docs.\n\t\t\tregex: /\\b(?:xox[baprs]\|xapp)-\\d{6,}(?:-\\d{6,}){1,2}-[A-Za-z0-9-]{10,}\\b/,\n\t\t},\n\t\t{\n\t\t\tname: \"GitHub token\",\n\t\t\t// GitHub tokens: ghp_ (personal), gho_ (OAuth), ghu_ (user-to-server),\n\t\t\t// ghs_ (server-to-server), ghr_ (refresh), github_pat_\n\t\t\tregex: /\\b(?:ghp_\|gho_\|ghu_\|ghs_\|ghr_\|github_pat_)[A-Za-z0-9_]{36,}\\b/,\n\t\t},\n\t\t{\n\t\t\tname: \"GitLab token\",\n\t\t\t// GitLab personal access tokens: glpat-...\n\t\t\tregex: /\\bglpat-[A-Za-z0-9_-]{20,}\\b/,\n\t\t},\n\t\t{\n\t\t\tname: \"Google API key\",\n\t\t\t// Google API keys start with AIza\n\t\t\tregex: /\\bAIza[A-Za-z0-9_-]{35}\\b/,\n\t\t},\n\t\t{\n\t\t\tname: \"Stripe key\",\n\t\t\t// Stripe keys: sk_live_, pk_live_, sk_test_, pk_test_, rk_live_, rk_test_\n\t\t\tregex: /\\b[spr]k_(?:live\|test)_[A-Za-z0-9]{24,}\\b/,\n\t\t},\n\t\t{\n\t\t\tname: \"OpenAI API key\",\n\t\t\t// OpenAI keys: sk-... (typically 48+ chars total)\n\t\t\tregex: /\\bsk-[A-Za-z0-9]{32,}\\b/,\n\t\t},\n\t\t{\n\t\t\tname: \"SendGrid API key\",\n\t\t\t// SendGrid keys start with SG.\n\t\t\tregex: /\\bSG\\.[A-Za-z0-9_-]{22,}\\.[A-Za-z0-9_-]{22,}\\b/,\n\t\t},\n\t\t{\n\t\t\tname: \"Twilio auth token\",\n\t\t\t// Twilio auth tokens in config patterns\n\t\t\tregex:\n\t\t\t\t/twilio[_-]?(?:auth[_-]?token\|account[_-]?sid)\\s[:=]\\s['\"]?[A-Za-z0-9]{32,}['\"]?/i,\n\t\t},\n\t\t{\n\t\t\tname: \"Discord webhook\",\n\t\t\t// Discord webhook URLs contain sensitive tokens\n\t\t\tregex:\n\t\t\t\t/https:\\/\\/(?:discord(?:app)?\\.com\|canary\\.discord\\.com)\\/api\\/webhooks\\/\\d+\\/[A-Za-z0-9_-]+/,\n\t\t},\n\t\t{\n\t\t\tname: \"Database URL with credentials\",\n\t\t\t// Database connection strings with embedded credentials\n\t\t\t// postgres://user:password@host, mysql://user:pass@host, mongodb://user:pass@host\n\t\t\tregex:\n\t\t\t\t/\\b(?:postgres(?:ql)?\|mysql\|mongodb(?:\\+srv)?\|redis):\\/\\/[^\\s:]+:[^\\s@]+@[^\\s'\"]+/i,\n\t\t},\n\t\t{\n\t\t\tname: \"JWT token\",\n\t\t\t// JWT tokens have a distinctive structure: eyJ...\n\t\t\t// Only flag if it looks like a real token (has all three parts with decent lengths)\n\t\t\tregex:\n\t\t\t\t/\\beyJ[A-Za-z0-9_-]{20,}\\.eyJ[A-Za-z0-9_-]{20,}\\.[A-Za-z0-9_-]{20,}\\b/,\n\t\t},\n\t];\n\nexport function detectHeuristicFindings(\n\tcontents: string,\n): HeuristicFindingName[] {\n\tconst matches: HeuristicFindingName[] = [];\n\tfor (const pattern of HEURISTIC_PATTERNS) {\n\t\tif (pattern.regex.test(contents)) {\n\t\t\tmatches.push(pattern.name);\n\t\t}\n\t}\n\treturn matches;\n}\n\nfunction runHeuristicScan(files: string[], root: string): GuardianToolResult {\n\tconst started = Date.now();\n\tconst findings: string[] = [];\n\tconst ignorePatterns = [\n\t\t/test\\/enterprise\\/pii-detector\\.test\\.ts$/,\n\t\t/test\\/guardian\\/heuristic-scan\\.test\\.ts$/,\n\t\t// Tests that intentionally include credential-like fixtures.\n\t\t/test\\/integration\\/security-middleware\\.test\\.ts$/,\n\t\t/test\\/safety\\/context-firewall\\.test\\.ts$/,\n\t\t/test\\/safety\\/edge-cases\\.test\\.ts$/,\n\t\t/test\\/safety\\/safety-middleware\\.test\\.ts$/,\n\t\t// The runner itself contains regex patterns that look like secrets\n\t\t/src\\/guardian\\/runner\\.ts$/,\n\t];\n\n\tfor (const relative of files) {\n\t\tif (ignorePatterns.some((pattern) => pattern.test(relative))) {\n\t\t\tcontinue;\n\t\t}\n\t\tconst fullPath = resolve(root, relative);\n\t\tif (!existsSync(fullPath)) continue;\n\t\tlet contents: string;\n\t\ttry {\n\t\t\tconst stats = statSync(fullPath);\n\t\t\tif (stats.size > 2 1024 * 1024) {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tcontents = readFileSync(fullPath, \"utf-8\");\n\t\t} catch {\n\t\t\tcontinue;\n\t\t}\n\t\tif (contents.includes(\"\\0\")) continue; // likely binary\n\t\tfor (const match of detectHeuristicFindings(contents)) {\n\t\t\tfindings.push(`${match}: ${relative}`);\n\t\t}\n\t}\n\n\tif (!findings.length) {\n\t\treturn {\n\t\t\ttool: \"heuristic-scan\",\n\t\t\texitCode: 0,\n\t\t\tstdout: \"\",\n\t\t\tstderr: \"\",\n\t\t\tdurationMs: Date.now() - started,\n\t\t};\n\t}\n\treturn {\n\t\ttool: \"heuristic-scan\",\n\t\texitCode: 1,\n\t\tstdout: findings.join(\"\\n\"),\n\t\tstderr: \"\",\n\t\tdurationMs: Date.now() - started,\n\t};\n}\n\nfunction buildSummary(\n\tstatus: GuardianStatus,\n\tfiles: string[],\n\ttools: GuardianToolResult[],\n\ttarget: \"staged\" \| \"all\",\n\tskipReason?: string,\n): string {\n\tif (status === \"skipped\") {\n\t\treturn `Guardian skipped (${skipReason ?? \"disabled\"})`;\n\t}\n\tconst fileLabel = target === \"staged\" ? \"staged file(s)\" : \"tracked file(s)\";\n\tconst prefix =\n\t\tstatus === \"passed\"\n\t\t\t? \"Guardian passed\"\n\t\t\t: status === \"failed\"\n\t\t\t\t? \"Guardian blocked commit\"\n\t\t\t\t: \"Guardian error\";\n\tconst ran = tools\n\t\t.filter((tool) => !tool.skipped)\n\t\t.map((tool) => tool.tool)\n\t\t.join(\" + \");\n\tconst skipped = tools\n\t\t.filter((tool) => tool.skipped)\n\t\t.map((tool) => tool.tool)\n\t\t.join(\", \");\n\tconst toolSummary =\n\t\tran && skipped\n\t\t\t? `${ran} (skipped: ${skipped})`\n\t\t\t: ran \|\| (skipped ? `skipped: ${skipped}` : \"\");\n\treturn `${prefix} on ${files.length} ${fileLabel}${\n\t\ttoolSummary ? ` using ${toolSummary}` : \"\"\n\t}`;\n}\n\nexport function formatGuardianResult(result: GuardianRunResult): string {\n\tconst lines: string[] = [];\n\tlines.push(result.summary);\n\tlines.push(\n\t\t`Status: ${result.status} • Target: ${result.target} • Duration: ${\n\t\t\tresult.durationMs\n\t\t}ms`,\n\t);\n\tfor (const tool of result.toolResults) {\n\t\tconst status =\n\t\t\ttool.skipped && tool.reason\n\t\t\t\t? `skipped (${tool.reason})`\n\t\t\t\t: tool.exitCode === 0\n\t\t\t\t\t? \"clean\"\n\t\t\t\t\t: tool.exitCode === 1\n\t\t\t\t\t\t? \"findings\"\n\t\t\t\t\t\t: \"error\";\n\t\tlines.push(\n\t\t\t`- ${tool.tool}: ${status} (${tool.durationMs}ms${\n\t\t\t\ttool.exitCode !== 0 ? `, exit ${tool.exitCode}` : \"\"\n\t\t\t})`,\n\t\t);\n\t\tif (tool.stdout.trim()) {\n\t\t\tlines.push(` stdout: ${tool.stdout.trim()}`);\n\t\t}\n\t\tif (tool.stderr.trim()) {\n\t\t\tlines.push(` stderr: ${tool.stderr.trim()}`);\n\t\t}\n\t}\n\tif (result.files?.length) {\n\t\tconst preview = result.files.slice(0, 8).join(\", \");\n\t\tconst suffix =\n\t\t\tresult.files.length > 8 ? ` … +${result.files.length - 8} more` : \"\";\n\t\tlines.push(`Files: ${preview}${suffix}`);\n\t}\n\treturn lines.join(\"\\n\");\n}\n\nfunction pickOverallStatus(tools: GuardianToolResult[]): GuardianStatus {\n\tconst hadError = tools.some((tool) => !tool.skipped && tool.exitCode > 1);\n\tif (hadError) return \"error\";\n\tconst hadFindings = tools.some(\n\t\t(tool) => !tool.skipped && tool.exitCode === 1,\n\t);\n\tif (hadFindings) return \"failed\";\n\treturn \"passed\";\n}\n\nexport function shouldGuardCommand(command: string): {\n\tshouldGuard: boolean;\n\ttrigger: string \| null;\n} {\n\tconst inlineDisable = /MAESTRO_GUARDIAN\\s=\\s(0\|false\|off\|no)/i;\n\tif (inlineDisable.test(command)) {\n\t\treturn { shouldGuard: false, trigger: null };\n\t}\n\tconst gitMatch = command.match(/\\bgit\\s+(commit\|push)\\b/i);\n\tif (gitMatch?.[1]) {\n\t\treturn { shouldGuard: true, trigger: `git ${gitMatch[1].toLowerCase()}` };\n\t}\n\n\tconst destructivePatterns: Array<{ regex: RegExp; label: string }> = [\n\t\t{ regex: /\\brm\\s+-rf\\b/i, label: \"rm -rf\" },\n\t\t{\n\t\t\tregex: /\\brm\\s+(?:-[a-z]r[a-z]\\b\|--recursive\\b)/i,\n\t\t\tlabel: \"rm -r\",\n\t\t},\n\t\t{ regex: /\\bfind\\s+[^\\n]-delete\\b/i, label: \"find -delete\" },\n\t\t{ regex: /\\bchmod\\s+0{3,4}\\b/i, label: \"chmod 000\" },\n\t\t{ regex: /\\bchown\\b[^\\n]\\broot\\b/i, label: \"chown root\" },\n\t\t{ regex: /\\bdd\\s+if=.*\\s+of=\\/dev\\//i, label: \"dd to device\" },\n\t\t{ regex: /\\bmkfs\\./i, label: \"mkfs\" },\n\t\t{ regex: /\\btruncate\\s+-s\\s+0\\b/i, label: \"truncate -s 0\" },\n\t];\n\n\tfor (const pattern of destructivePatterns) {\n\t\tif (pattern.regex.test(command)) {\n\t\t\treturn { shouldGuard: true, trigger: pattern.label };\n\t\t}\n\t}\n\n\treturn { shouldGuard: false, trigger: null };\n}\n\nexport async function runGuardian(\n\toptions: GuardianRunOptions = {},\n): Promise<GuardianRunResult> {\n\tconst target = options.target ?? \"staged\";\n\tconst root = options.root ? resolve(options.root) : process.cwd();\n\tlet scanRoot = root;\n\tlet snapshotDir: string \| null = null;\n\tconst enablement = resolveEnablement(options.respectEnv ?? true);\n\tconst startedAt = Date.now();\n\n\tif (!enablement.enabled) {\n\t\tconst result: GuardianRunResult = {\n\t\t\tstatus: \"skipped\",\n\t\t\texitCode: 0,\n\t\t\tstartedAt,\n\t\t\tdurationMs: Date.now() - startedAt,\n\t\t\ttarget,\n\t\t\ttrigger: options.trigger,\n\t\t\tfilesScanned: 0,\n\t\t\tsummary: \"Guardian disabled by configuration\",\n\t\t\tskipReason: enablement.reason ?? \"disabled\",\n\t\t\ttoolResults: [],\n\t\t};\n\t\trecordGuardianRun(result);\n\t\treturn result;\n\t}\n\n\tconst filesResult =\n\t\ttarget === \"all\" ? listTrackedFiles(root) : listStagedFiles(root);\n\tif (!filesResult.ok) {\n\t\tconst result: GuardianRunResult = {\n\t\t\tstatus: \"error\",\n\t\t\texitCode: filesResult.exitCode,\n\t\t\tstartedAt,\n\t\t\tdurationMs: Date.now() - startedAt,\n\t\t\ttarget,\n\t\t\ttrigger: options.trigger,\n\t\t\tfilesScanned: 0,\n\t\t\tsummary: filesResult.error,\n\t\t\ttoolResults: [],\n\t\t};\n\t\trecordGuardianRun(result);\n\t\treturn result;\n\t}\n\n\tconst files = filesResult.files;\n\tif (!files.length) {\n\t\tconst result: GuardianRunResult = {\n\t\t\tstatus: \"skipped\",\n\t\t\texitCode: 0,\n\t\t\tstartedAt,\n\t\t\tdurationMs: Date.now() - startedAt,\n\t\t\ttarget,\n\t\t\ttrigger: options.trigger,\n\t\t\tfilesScanned: 0,\n\t\t\tsummary: \"No files to scan\",\n\t\t\tskipReason: \"no files\",\n\t\t\ttoolResults: [],\n\t\t};\n\t\trecordGuardianRun(result);\n\t\treturn result;\n\t}\n\n\tif (target === \"staged\") {\n\t\tsnapshotDir = materializeStagedFiles(root, files);\n\t\tif (snapshotDir) {\n\t\t\tscanRoot = snapshotDir;\n\t\t}\n\t}\n\n\tconst config = resolveGuardianConfig({\n\t\troot,\n\t\tconfig: options.config,\n\t});\n\n\tconst toolResults: GuardianToolResult[] = [];\n\n\tif (config.tools.semgrep) {\n\t\ttoolResults.push(runSemgrep(files, scanRoot));\n\t}\n\n\tlet fallback: GuardianToolResult \| null = null;\n\tif (config.tools.gitSecrets) {\n\t\tconst gitSecretsResult = runGitSecrets(files, scanRoot);\n\t\tif (!gitSecretsResult.skipped) {\n\t\t\tfallback = gitSecretsResult;\n\t\t}\n\t}\n\tif (!fallback && config.tools.trufflehog) {\n\t\tconst truffleResult = runTrufflehog(files, scanRoot);\n\t\tif (!truffleResult.skipped) {\n\t\t\tfallback = truffleResult;\n\t\t}\n\t}\n\tif (!fallback && config.tools.heuristicScan) {\n\t\tfallback = runHeuristicScan(files, scanRoot);\n\t}\n\tif (fallback) {\n\t\ttoolResults.push(fallback);\n\t}\n\n\tconst status = pickOverallStatus(toolResults);\n\tconst exitCode =\n\t\tstatus === \"passed\"\n\t\t\t? 0\n\t\t\t: (toolResults.find((tool) => !tool.skipped && tool.exitCode !== 0)\n\t\t\t\t\t?.exitCode ?? 1);\n\n\tconst result: GuardianRunResult = {\n\t\tstatus,\n\t\texitCode,\n\t\tstartedAt,\n\t\tdurationMs: Date.now() - startedAt,\n\t\ttarget,\n\t\ttrigger: options.trigger,\n\t\tfilesScanned: files.length,\n\t\tfiles: options.quiet ? undefined : files,\n\t\tsummary: buildSummary(status, files, toolResults, target),\n\t\ttoolResults,\n\t};\n\n\trecordGuardianRun(result);\n\n\tif (snapshotDir) {\n\t\ttry {\n\t\t\trmSync(snapshotDir, { recursive: true, force: true });\n\t\t} catch {\n\t\t\t// best effort cleanup\n\t\t}\n\t}\n\treturn result;\n}\n"]}
1	+ {"version":3,"file":"runner.js","sourceRoot":"","sources":["../../src/guardian/runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EACN,YAAY,EACZ,UAAU,EACV,SAAS,EACT,WAAW,EACX,YAAY,EACZ,MAAM,EACN,QAAQ,EACR,aAAa,GACb,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAS9C,MAAM,uBAAuB,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AAC5D,MAAM,sBAAsB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;AACnD,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAclC,SAAS,aAAa,CAAC,OAAe,EAAE,GAAW;IAClD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE;QAChD,GAAG;QACH,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,OAAO;KACjB,CAAC,CAAC;IACH,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,UAAU,CAClB,OAAe,EACf,IAAc,EACd,GAAW,EACX,SAAS,GAAG,kBAAkB,EAC9B,GAAuB;IAEvB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE;YACvC,GAAG;YACH,QAAQ,EAAE,OAAO;YACjB,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG;YACnD,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;YAC1B,OAAO,EAAE,SAAS;SAClB,CAAC,CAAC;QACH,OAAO;YACN,QAAQ,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC;YAC5B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;SAChC,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO;YACN,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAC9D,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAC7D,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;SAChC,CAAC;IACH,CAAC;AACF,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY;IACxC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACrE,OAAO,CACN,MAAM,CAAC,QAAQ,KAAK,CAAC;QACrB,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CACrC,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAe;IACnC,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC5C,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAC5B,CAAC,OAAO,EAAE,EAAE,CACX,UAAU,KAAK,OAAO;YACtB,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC;YAC9B,UAAU,CAAC,QAAQ,CAAC,IAAI,OAAO,EAAE,CAAC,CACnC,CAAC;IACH,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACpC,MAAM,MAAM,GAAG,UAAU,CACxB,KAAK,EACL,CAAC,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,wBAAwB,CAAC,EAC7D,IAAI,CACJ,CAAC;IACF,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO;YACN,EAAE,EAAE,KAAK;YACT,KAAK,EACJ,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;gBACpB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;gBACpB,6BAA6B;YAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ;SACzB,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,CACxB,MAAM,CAAC,MAAM;SACX,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CACjB,CAAC;IACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACrC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO;YACN,EAAE,EAAE,KAAK;YACT,KAAK,EACJ,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;gBACpB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;gBACpB,8BAA8B;YAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;SACzB,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,CACxB,MAAM,CAAC,MAAM;SACX,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CACjB,CAAC;IACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,iBAAiB,CACzB,UAA+B;IAE/B,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;IAClC,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IACnC,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC5C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC/C,IAAI,uBAAuB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAClD,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,+BAA+B;gBACvC,WAAW,EAAE,UAAU;aACvB,CAAC;QACH,CAAC;QACD,IAAI,sBAAsB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACjD,OAAO;gBACN,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,gCAAgC;gBACxC,WAAW,EAAE,SAAS;aACtB,CAAC;QACH,CAAC;IACF,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,aAAa,CACrB,IAAY;IAEZ,IAAI,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACzC,CAAC;IACD,IAAI,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;IACvD,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,KAAe,EAAE,IAAY;IAChD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,OAAO;YACN,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;YAChC,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,mBAAmB;SAC3B,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG;QACZ,GAAG,GAAG,CAAC,IAAI;QACX,MAAM;QACN,UAAU;QACV,WAAW;QACX,UAAU;QACV,MAAM;QACN,QAAQ;QACR,2BAA2B;QAC3B,SAAS;QACT,WAAW;QACX,GAAG;QACH,QAAQ;QACR,GAAG;QACH,eAAe;QACf,yBAAyB;QACzB,GAAG,WAAW;QACd,GAAG;KACH,CAAC;IACF,wFAAwF;IACxF,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE;QAC3D,oBAAoB,EAAE,KAAK;KAC3B,CAAC,CAAC;IACH,OAAO;QACN,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU;KAC7B,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAY,EAAE,KAAe;IAC5D,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,2BAA2B,CAAC,CAAC,CAAC;IAC5E,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5B,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACtE,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YACzB,wCAAwC;YACxC,SAAS;QACV,CAAC;QACD,IAAI,CAAC;YACJ,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACR,4CAA4C;QAC7C,CAAC;IACF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,KAAe;IACrD,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACrE,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACvC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,SAAS;QACV,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5B,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC;YACJ,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACR,0CAA0C;QAC3C,CAAC;IACF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,KAAe,EAAE,IAAY;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO;YACN,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;YAChC,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,UAAU;SAClB,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,CAAC,SAAS,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;QAC9B,OAAO;YACN,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;YAChC,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,2BAA2B;SACnC,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,SAAS;QACrB,CAAC,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;QAC1C,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACzE,OAAO;QACN,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU;KAC7B,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAe,EAAE,IAAY;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC;QACxC,OAAO;YACN,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;YAChC,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,0BAA0B;SAClC,CAAC;IACH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO;YACN,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;YAChC,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,UAAU;SAClB,CAAC;IACH,CAAC;IAED,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,CAAC;QACJ,OAAO,GAAG,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO;gBACN,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE,CAAC;gBACX,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,EAAE;gBACV,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;gBAChC,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,UAAU;aAClB,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,CACxB,YAAY,EACZ,CAAC,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,EACpE,OAAO,CACP,CAAC;QACF,OAAO;YACN,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,UAAU,EAAE,MAAM,CAAC,UAAU;SAC7B,CAAC;IACH,CAAC;YAAS,CAAC;QACV,IAAI,OAAO,EAAE,CAAC;YACb,IAAI,CAAC;gBACJ,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,CAAC;YAAC,MAAM,CAAC;gBACR,sBAAsB;YACvB,CAAC;QACF,CAAC;IACF,CAAC;AACF,CAAC;AA0BD,MAAM,kBAAkB,GACvB;IACC,kBAAkB;IAClB,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,sBAAsB,EAAE;IACzD;QACC,IAAI,EAAE,gBAAgB;QACtB,8DAA8D;QAC9D,KAAK,EACJ,+FAA+F;KAChG;IACD;QACC,IAAI,EAAE,mBAAmB;QACzB,KAAK,EAAE,0BAA0B;KACjC;IACD;QACC,IAAI,EAAE,iBAAiB;QACvB,8EAA8E;QAC9E,gCAAgC;QAChC,mCAAmC;QACnC,sCAAsC;QACtC,kBAAkB;QAClB,oBAAoB;QACpB,KAAK,EACJ,4IAA4I;KAC7I;IACD;QACC,IAAI,EAAE,aAAa;QACnB,gEAAgE;QAChE,oCAAoC;QACpC,oCAAoC;QACpC,+DAA+D;QAC/D,KAAK,EAAE,kEAAkE;KACzE;IACD;QACC,IAAI,EAAE,cAAc;QACpB,uEAAuE;QACvE,uDAAuD;QACvD,KAAK,EAAE,+DAA+D;KACtE;IACD;QACC,IAAI,EAAE,cAAc;QACpB,2CAA2C;QAC3C,KAAK,EAAE,8BAA8B;KACrC;IACD;QACC,IAAI,EAAE,gBAAgB;QACtB,kCAAkC;QAClC,KAAK,EAAE,2BAA2B;KAClC;IACD;QACC,IAAI,EAAE,YAAY;QAClB,0EAA0E;QAC1E,KAAK,EAAE,2CAA2C;KAClD;IACD;QACC,IAAI,EAAE,gBAAgB;QACtB,kDAAkD;QAClD,KAAK,EAAE,yBAAyB;KAChC;IACD;QACC,IAAI,EAAE,kBAAkB;QACxB,+BAA+B;QAC/B,KAAK,EAAE,gDAAgD;KACvD;IACD;QACC,IAAI,EAAE,mBAAmB;QACzB,wCAAwC;QACxC,KAAK,EACJ,oFAAoF;KACrF;IACD;QACC,IAAI,EAAE,iBAAiB;QACvB,gDAAgD;QAChD,KAAK,EACJ,6FAA6F;KAC9F;IACD;QACC,IAAI,EAAE,+BAA+B;QACrC,wDAAwD;QACxD,kFAAkF;QAClF,KAAK,EACJ,mFAAmF;KACpF;IACD;QACC,IAAI,EAAE,WAAW;QACjB,kDAAkD;QAClD,oFAAoF;QACpF,KAAK,EACJ,sEAAsE;KACvE;CACD,CAAC;AAEH,MAAM,sBAAsB,GAC3B,kSAAkS,CAAC;AAEpS,MAAM,8BAA8B,GAAG,MAAM,CAAC,GAAG,CAAA,2EAA2E,CAAC;AAC7H,MAAM,iCAAiC,GAAG,MAAM,CAAC,GAAG,CAAA,2HAA2H,CAAC;AAEhL,MAAM,iBAAiB,GAKlB;IACJ;QACC,IAAI,EAAE,iCAAiC;QACvC,yEAAyE;QACzE,kEAAkE;QAClE,KAAK,EACJ,2EAA2E;QAC5E,uBAAuB,EAAE,IAAI;KAC7B;IACD;QACC,IAAI,EAAE,mCAAmC;QACzC,KAAK,EACJ,+GAA+G;QAChH,uBAAuB,EAAE,IAAI;KAC7B;IACD;QACC,IAAI,EAAE,uCAAuC;QAC7C,KAAK,EAAE,qCAAqC;QAC5C,uBAAuB,EAAE,IAAI;KAC7B;IACD;QACC,IAAI,EAAE,wBAAwB;QAC9B,KAAK,EACJ,uEAAuE;QACxE,uBAAuB,EAAE,IAAI;KAC7B;IACD;QACC,IAAI,EAAE,gDAAgD;QACtD,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CACrB,IAAI,MAAM,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;YAC9D,IAAI,MAAM,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;KAClE;CACD,CAAC;AAEF,MAAM,UAAU,uBAAuB,CACtC,QAAgB;IAEhB,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;QAC1C,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;IACF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC9C,QAAgB;IAEhB,MAAM,OAAO,GAAmC,EAAE,CAAC;IACnD,MAAM,kBAAkB,GAAG,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjE,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;QACzC,IAAI,OAAO,CAAC,uBAAuB,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5D,SAAS;QACV,CAAC;QACD,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;IACF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,wBAAwB,CAChC,KAAe,EACf,IAAY;IAEZ,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,cAAc,GAAG;QACtB,+CAA+C;QAC/C,4BAA4B;KAC5B,CAAC;IAEF,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;QAC9B,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC9D,SAAS;QACV,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,SAAS;QACpC,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACJ,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACjC,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;gBAClC,SAAS;YACV,CAAC;YACD,QAAQ,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACR,SAAS;QACV,CAAC;QACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAS;QACtC,KAAK,MAAM,KAAK,IAAI,+BAA+B,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/D,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,QAAQ,EAAE,CAAC,CAAC;QACxC,CAAC;IACF,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACtB,OAAO;YACN,IAAI,EAAE,oBAAoB;YAC1B,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;SAChC,CAAC;IACH,CAAC;IACD,OAAO;QACN,IAAI,EAAE,oBAAoB;QAC1B,QAAQ,EAAE,CAAC;QACX,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QAC3B,MAAM,EACL,8JAA8J;QAC/J,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;KAChC,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAe,EAAE,IAAY;IACtD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,cAAc,GAAG;QACtB,2CAA2C;QAC3C,2CAA2C;QAC3C,6DAA6D;QAC7D,mDAAmD;QACnD,2CAA2C;QAC3C,qCAAqC;QACrC,4CAA4C;QAC5C,oCAAoC;QACpC,sDAAsD;QACtD,mEAAmE;QACnE,4BAA4B;KAC5B,CAAC;IAEF,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;QAC9B,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC9D,SAAS;QACV,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,SAAS;QACpC,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACJ,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACjC,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;gBAClC,SAAS;YACV,CAAC;YACD,QAAQ,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACR,SAAS;QACV,CAAC;QACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAS,CAAC,gBAAgB;QACvD,KAAK,MAAM,KAAK,IAAI,uBAAuB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvD,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,QAAQ,EAAE,CAAC,CAAC;QACxC,CAAC;IACF,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACtB,OAAO;YACN,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;SAChC,CAAC;IACH,CAAC;IACD,OAAO;QACN,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,CAAC;QACX,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QAC3B,MAAM,EAAE,EAAE;QACV,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;KAChC,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CACpB,MAAsB,EACtB,KAAe,EACf,KAA2B,EAC3B,MAAwB,EACxB,UAAmB;IAEnB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,qBAAqB,UAAU,IAAI,UAAU,GAAG,CAAC;IACzD,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,iBAAiB,CAAC;IAC7E,MAAM,MAAM,GACX,MAAM,KAAK,QAAQ;QAClB,CAAC,CAAC,iBAAiB;QACnB,CAAC,CAAC,MAAM,KAAK,QAAQ;YACpB,CAAC,CAAC,yBAAyB;YAC3B,CAAC,CAAC,gBAAgB,CAAC;IACtB,MAAM,GAAG,GAAG,KAAK;SACf,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;SAC/B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;SACxB,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,MAAM,OAAO,GAAG,KAAK;SACnB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;SAC9B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;SACxB,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,MAAM,WAAW,GAChB,GAAG,IAAI,OAAO;QACb,CAAC,CAAC,GAAG,GAAG,cAAc,OAAO,GAAG;QAChC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClD,OAAO,GAAG,MAAM,OAAO,KAAK,CAAC,MAAM,IAAI,SAAS,GAC/C,WAAW,CAAC,CAAC,CAAC,UAAU,WAAW,EAAE,CAAC,CAAC,CAAC,EACzC,EAAE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAyB;IAC7D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3B,KAAK,CAAC,IAAI,CACT,WAAW,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,MAAM,gBAClD,MAAM,CAAC,UACR,IAAI,CACJ,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvC,MAAM,MAAM,GACX,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM;YAC1B,CAAC,CAAC,YAAY,IAAI,CAAC,MAAM,GAAG;YAC5B,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC;gBACpB,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC;oBACpB,CAAC,CAAC,UAAU;oBACZ,CAAC,CAAC,OAAO,CAAC;QACd,KAAK,CAAC,IAAI,CACT,KAAK,IAAI,CAAC,IAAI,KAAK,MAAM,KAAK,IAAI,CAAC,UAAU,KAC5C,IAAI,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EACnD,GAAG,CACH,CAAC;QACF,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC/C,CAAC;IACF,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,MAAM,GACX,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,KAAK,CAAC,IAAI,CAAC,UAAU,OAAO,GAAG,MAAM,EAAE,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAA2B;IACrD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;IAC1E,IAAI,QAAQ;QAAE,OAAO,OAAO,CAAC;IAC7B,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAC7B,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC,CAC9C,CAAC;IACF,IAAI,WAAW;QAAE,OAAO,QAAQ,CAAC;IACjC,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAIjD,MAAM,aAAa,GAAG,0CAA0C,CAAC;IACjE,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC9C,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC3D,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnB,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC;IAC3E,CAAC;IAED,MAAM,mBAAmB,GAA4C;QACpE,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE;QAC3C;YACC,KAAK,EAAE,4CAA4C;YACnD,KAAK,EAAE,OAAO;SACd;QACD,EAAE,KAAK,EAAE,2BAA2B,EAAE,KAAK,EAAE,cAAc,EAAE;QAC7D,EAAE,KAAK,EAAE,qBAAqB,EAAE,KAAK,EAAE,WAAW,EAAE;QACpD,EAAE,KAAK,EAAE,0BAA0B,EAAE,KAAK,EAAE,YAAY,EAAE;QAC1D,EAAE,KAAK,EAAE,4BAA4B,EAAE,KAAK,EAAE,cAAc,EAAE;QAC9D,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE;QACrC,EAAE,KAAK,EAAE,wBAAwB,EAAE,KAAK,EAAE,eAAe,EAAE;KAC3D,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,mBAAmB,EAAE,CAAC;QAC3C,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QACtD,CAAC;IACF,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAChC,UAA8B,EAAE;IAEhC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC;IAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IAClE,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QACzB,MAAM,MAAM,GAAsB;YACjC,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE,CAAC;YACX,SAAS;YACT,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YAClC,MAAM;YACN,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,YAAY,EAAE,CAAC;YACf,OAAO,EAAE,oCAAoC;YAC7C,UAAU,EAAE,UAAU,CAAC,MAAM,IAAI,UAAU;YAC3C,WAAW,EAAE,EAAE;SACf,CAAC;QACF,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC1B,OAAO,MAAM,CAAC;IACf,CAAC;IAED,MAAM,WAAW,GAChB,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IACnE,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;QACrB,MAAM,MAAM,GAAsB;YACjC,MAAM,EAAE,OAAO;YACf,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,SAAS;YACT,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YAClC,MAAM;YACN,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,YAAY,EAAE,CAAC;YACf,OAAO,EAAE,WAAW,CAAC,KAAK;YAC1B,WAAW,EAAE,EAAE;SACf,CAAC;QACF,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC1B,OAAO,MAAM,CAAC;IACf,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC;IAChC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,MAAM,GAAsB;YACjC,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE,CAAC;YACX,SAAS;YACT,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YAClC,MAAM;YACN,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,YAAY,EAAE,CAAC;YACf,OAAO,EAAE,kBAAkB;YAC3B,UAAU,EAAE,UAAU;YACtB,WAAW,EAAE,EAAE;SACf,CAAC;QACF,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC1B,OAAO,MAAM,CAAC;IACf,CAAC;IAED,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACzB,WAAW,GAAG,sBAAsB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAClD,IAAI,WAAW,EAAE,CAAC;YACjB,QAAQ,GAAG,WAAW,CAAC;QACxB,CAAC;IACF,CAAC;IAED,MAAM,MAAM,GAAG,qBAAqB,CAAC;QACpC,IAAI;QACJ,MAAM,EAAE,OAAO,CAAC,MAAM;KACtB,CAAC,CAAC;IAEH,MAAM,WAAW,GAAyB,EAAE,CAAC;IAE7C,IAAI,MAAM,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC;QACpC,WAAW,CAAC,IAAI,CAAC,wBAAwB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAC1B,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,QAAQ,GAA8B,IAAI,CAAC;IAC/C,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QAC7B,MAAM,gBAAgB,GAAG,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACxD,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAC/B,QAAQ,GAAG,gBAAgB,CAAC;QAC7B,CAAC;IACF,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QAC1C,MAAM,aAAa,GAAG,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;YAC5B,QAAQ,GAAG,aAAa,CAAC;QAC1B,CAAC;IACF,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QAC7C,QAAQ,GAAG,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACd,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,QAAQ,GACb,MAAM,KAAK,QAAQ;QAClB,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC,CAAC;YACjE,EAAE,QAAQ,IAAI,CAAC,CAAC,CAAC;IAErB,MAAM,MAAM,GAAsB;QACjC,MAAM;QACN,QAAQ;QACR,SAAS;QACT,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;QAClC,MAAM;QACN,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,YAAY,EAAE,KAAK,CAAC,MAAM;QAC1B,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK;QACxC,OAAO,EAAE,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC;QACzD,WAAW;KACX,CAAC;IAEF,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAE1B,IAAI,WAAW,EAAE,CAAC;QACjB,IAAI,CAAC;YACJ,MAAM,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACR,sBAAsB;QACvB,CAAC;IACF,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC","sourcesContent":["import { spawnSync } from \"node:child_process\";\nimport {\n\tcopyFileSync,\n\texistsSync,\n\tmkdirSync,\n\tmkdtempSync,\n\treadFileSync,\n\trmSync,\n\tstatSync,\n\twriteFileSync,\n} from \"node:fs\";\nimport os from \"node:os\";\nimport { dirname, join, resolve } from \"node:path\";\nimport { resolveGuardianConfig } from \"./config.js\";\nimport { loadGuardianState, recordGuardianRun } from \"./state.js\";\nimport { DEFAULT_EXCLUDES } from \"./types.js\";\nimport type {\n\tGuardianEnablement,\n\tGuardianRunOptions,\n\tGuardianRunResult,\n\tGuardianStatus,\n\tGuardianToolResult,\n} from \"./types.js\";\n\nconst GUARDIAN_DISABLE_VALUES = [\"0\", \"false\", \"off\", \"no\"];\nconst GUARDIAN_ENABLE_VALUES = [\"1\", \"true\", \"on\"];\nconst DEFAULT_TIMEOUT_MS = 10_000;\n\ntype FileListResult =\n\t\| { ok: true; files: string[] }\n\t\| { ok: false; error: string; exitCode: number };\n\ntype CommandResult = {\n\texitCode: number;\n\tstdout: string;\n\tstderr: string;\n\terror?: string;\n\tdurationMs: number;\n};\n\nfunction commandExists(command: string, cwd: string): boolean {\n\tconst result = spawnSync(command, [\"--version\"], {\n\t\tcwd,\n\t\tstdio: \"pipe\",\n\t\tencoding: \"utf-8\",\n\t});\n\treturn (result.status ?? 1) === 0;\n}\n\nfunction runCommand(\n\tcommand: string,\n\targs: string[],\n\tcwd: string,\n\ttimeoutMs = DEFAULT_TIMEOUT_MS,\n\tenv?: NodeJS.ProcessEnv,\n): CommandResult {\n\tconst started = Date.now();\n\ttry {\n\t\tconst result = spawnSync(command, args, {\n\t\t\tcwd,\n\t\t\tencoding: \"utf-8\",\n\t\t\tenv: env ? { ...process.env, ...env } : process.env,\n\t\t\tmaxBuffer: 8 * 1024 * 1024,\n\t\t\ttimeout: timeoutMs,\n\t\t});\n\t\treturn {\n\t\t\texitCode: result.status ?? 1,\n\t\t\tstdout: result.stdout ?? \"\",\n\t\t\tstderr: result.stderr ?? \"\",\n\t\t\tdurationMs: Date.now() - started,\n\t\t};\n\t} catch (error) {\n\t\treturn {\n\t\t\texitCode: 1,\n\t\t\tstdout: \"\",\n\t\t\tstderr: error instanceof Error ? error.message : String(error),\n\t\t\terror: error instanceof Error ? error.message : String(error),\n\t\t\tdurationMs: Date.now() - started,\n\t\t};\n\t}\n}\n\nfunction hasGitSecretsPlugin(root: string): boolean {\n\tconst result = runCommand(\"git\", [\"secrets\", \"--help\"], root, 4_000);\n\treturn (\n\t\tresult.exitCode === 0 \|\|\n\t\tresult.stderr.includes(\"git secrets\") \|\|\n\t\tresult.stdout.includes(\"git secrets\")\n\t);\n}\n\nfunction filterFiles(files: string[]): string[] {\n\treturn files.filter((file) => {\n\t\tconst normalized = file.replace(/\\\\/g, \"/\");\n\t\treturn !DEFAULT_EXCLUDES.some(\n\t\t\t(exclude) =>\n\t\t\t\tnormalized === exclude \|\|\n\t\t\t\tnormalized.startsWith(exclude) \|\|\n\t\t\t\tnormalized.includes(`/${exclude}`),\n\t\t);\n\t});\n}\n\nfunction listStagedFiles(root: string): FileListResult {\n\tconst result = runCommand(\n\t\t\"git\",\n\t\t[\"diff\", \"--name-only\", \"--cached\", \"--diff-filter=ACMRTUXB\"],\n\t\troot,\n\t);\n\tif (result.exitCode !== 0) {\n\t\treturn {\n\t\t\tok: false,\n\t\t\terror:\n\t\t\t\tresult.stderr.trim() \|\|\n\t\t\t\tresult.stdout.trim() \|\|\n\t\t\t\t\"Unable to list staged files\",\n\t\t\texitCode: result.exitCode,\n\t\t};\n\t}\n\tconst files = filterFiles(\n\t\tresult.stdout\n\t\t\t.split(\"\\n\")\n\t\t\t.map((line) => line.trim())\n\t\t\t.filter(Boolean),\n\t);\n\treturn { ok: true, files };\n}\n\nfunction listTrackedFiles(root: string): FileListResult {\n\tconst result = runCommand(\"git\", [\"ls-files\"], root);\n\tif (result.exitCode !== 0) {\n\t\treturn {\n\t\t\tok: false,\n\t\t\terror:\n\t\t\t\tresult.stderr.trim() \|\|\n\t\t\t\tresult.stdout.trim() \|\|\n\t\t\t\t\"Unable to list tracked files\",\n\t\t\texitCode: result.exitCode,\n\t\t};\n\t}\n\tconst files = filterFiles(\n\t\tresult.stdout\n\t\t\t.split(\"\\n\")\n\t\t\t.map((line) => line.trim())\n\t\t\t.filter(Boolean),\n\t);\n\treturn { ok: true, files };\n}\n\nfunction resolveEnablement(\n\trespectEnv: boolean \| undefined,\n): GuardianEnablement {\n\tconst state = loadGuardianState();\n\tif (!respectEnv) {\n\t\treturn { enabled: state.enabled };\n\t}\n\tconst rawEnv = process.env.MAESTRO_GUARDIAN;\n\tif (typeof rawEnv === \"string\" && rawEnv.trim().length > 0) {\n\t\tconst normalized = rawEnv.trim().toLowerCase();\n\t\tif (GUARDIAN_DISABLE_VALUES.includes(normalized)) {\n\t\t\treturn {\n\t\t\t\tenabled: false,\n\t\t\t\treason: \"MAESTRO_GUARDIAN=0 (disabled)\",\n\t\t\t\tenvOverride: \"disabled\",\n\t\t\t};\n\t\t}\n\t\tif (GUARDIAN_ENABLE_VALUES.includes(normalized)) {\n\t\t\treturn {\n\t\t\t\tenabled: true,\n\t\t\t\treason: \"MAESTRO_GUARDIAN=1 (forced on)\",\n\t\t\t\tenvOverride: \"enabled\",\n\t\t\t};\n\t\t}\n\t}\n\treturn { enabled: state.enabled };\n}\n\nfunction locateSemgrep(\n\troot: string,\n): { command: string; args: string[] } \| null {\n\tif (commandExists(\"semgrep\", root)) {\n\t\treturn { command: \"semgrep\", args: [] };\n\t}\n\tif (commandExists(\"npx\", root)) {\n\t\treturn { command: \"npx\", args: [\"--yes\", \"semgrep\"] };\n\t}\n\treturn null;\n}\n\nfunction runSemgrep(files: string[], root: string): GuardianToolResult {\n\tconst started = Date.now();\n\tconst cmd = locateSemgrep(root);\n\tif (!cmd) {\n\t\treturn {\n\t\t\ttool: \"semgrep\",\n\t\t\texitCode: 0,\n\t\t\tstdout: \"\",\n\t\t\tstderr: \"\",\n\t\t\tdurationMs: Date.now() - started,\n\t\t\tskipped: true,\n\t\t\treason: \"semgrep not found\",\n\t\t};\n\t}\n\tconst includeArgs = files.flatMap((file) => [\"--include\", file]);\n\tconst args = [\n\t\t...cmd.args,\n\t\t\"scan\",\n\t\t\"--config\",\n\t\t\"p/secrets\",\n\t\t\"--config\",\n\t\t\"p/ci\",\n\t\t\"--json\",\n\t\t\"--skip-unknown-extensions\",\n\t\t\"--error\",\n\t\t\"--timeout\",\n\t\t\"7\",\n\t\t\"--jobs\",\n\t\t\"1\",\n\t\t\"--metrics=off\",\n\t\t\"--disable-version-check\",\n\t\t...includeArgs,\n\t\t\".\",\n\t];\n\t// Semgrep can take longer on larger workspaces; allow up to 2 minutes before timing out\n\tconst result = runCommand(cmd.command, args, root, 120_000, {\n\t\tSEMGREP_SEND_METRICS: \"off\",\n\t});\n\treturn {\n\t\ttool: \"semgrep\",\n\t\texitCode: result.exitCode,\n\t\tstdout: result.stdout,\n\t\tstderr: result.stderr,\n\t\tdurationMs: result.durationMs,\n\t};\n}\n\nfunction materializeStagedFiles(root: string, files: string[]): string \| null {\n\tconst tempDir = mkdtempSync(join(os.tmpdir(), \"composer-guardian-staged-\"));\n\tfor (const relative of files) {\n\t\tconst target = join(tempDir, relative);\n\t\tconst dir = dirname(target);\n\t\tmkdirSync(dir, { recursive: true });\n\t\tconst show = runCommand(\"git\", [\"show\", `:${relative}`], root, 5_000);\n\t\tif (show.exitCode !== 0) {\n\t\t\t// skip files we fail to read from index\n\t\t\tcontinue;\n\t\t}\n\t\ttry {\n\t\t\twriteFileSync(target, show.stdout, \"utf-8\");\n\t\t} catch {\n\t\t\t// ignore write errors for problematic files\n\t\t}\n\t}\n\treturn tempDir;\n}\n\nfunction copyFilesToTemp(root: string, files: string[]): string \| null {\n\tif (!files.length) return null;\n\tconst tempDir = mkdtempSync(join(os.tmpdir(), \"composer-guardian-\"));\n\tfor (const relative of files) {\n\t\tconst source = resolve(root, relative);\n\t\tif (!existsSync(source)) {\n\t\t\tcontinue;\n\t\t}\n\t\tconst target = join(tempDir, relative);\n\t\tconst dir = dirname(target);\n\t\tmkdirSync(dir, { recursive: true });\n\t\ttry {\n\t\t\tcopyFileSync(source, target);\n\t\t} catch {\n\t\t\t// ignore copy errors; file may be removed\n\t\t}\n\t}\n\treturn tempDir;\n}\n\nfunction runGitSecrets(files: string[], root: string): GuardianToolResult {\n\tconst started = Date.now();\n\tif (!files.length) {\n\t\treturn {\n\t\t\ttool: \"git-secrets\",\n\t\t\texitCode: 0,\n\t\t\tstdout: \"\",\n\t\t\tstderr: \"\",\n\t\t\tdurationMs: Date.now() - started,\n\t\t\tskipped: true,\n\t\t\treason: \"no files\",\n\t\t};\n\t}\n\n\tconst hasBinary = commandExists(\"git-secrets\", root);\n\tconst hasPlugin = !hasBinary && hasGitSecretsPlugin(root);\n\tif (!hasBinary && !hasPlugin) {\n\t\treturn {\n\t\t\ttool: \"git-secrets\",\n\t\t\texitCode: 0,\n\t\t\tstdout: \"\",\n\t\t\tstderr: \"\",\n\t\t\tdurationMs: Date.now() - started,\n\t\t\tskipped: true,\n\t\t\treason: \"git-secrets not installed\",\n\t\t};\n\t}\n\n\tconst args = hasBinary\n\t\t? [\"--scan\", \"--no-index\", \"--\", ...files]\n\t\t: [\"secrets\", \"--scan\", \"--no-index\", \"--\", ...files];\n\tconst result = runCommand(hasBinary ? \"git-secrets\" : \"git\", args, root);\n\treturn {\n\t\ttool: \"git-secrets\",\n\t\texitCode: result.exitCode,\n\t\tstdout: result.stdout,\n\t\tstderr: result.stderr,\n\t\tdurationMs: result.durationMs,\n\t};\n}\n\nfunction runTrufflehog(files: string[], root: string): GuardianToolResult {\n\tconst started = Date.now();\n\tif (!commandExists(\"trufflehog\", root)) {\n\t\treturn {\n\t\t\ttool: \"trufflehog\",\n\t\t\texitCode: 0,\n\t\t\tstdout: \"\",\n\t\t\tstderr: \"\",\n\t\t\tdurationMs: Date.now() - started,\n\t\t\tskipped: true,\n\t\t\treason: \"trufflehog not installed\",\n\t\t};\n\t}\n\tif (!files.length) {\n\t\treturn {\n\t\t\ttool: \"trufflehog\",\n\t\t\texitCode: 0,\n\t\t\tstdout: \"\",\n\t\t\tstderr: \"\",\n\t\t\tdurationMs: Date.now() - started,\n\t\t\tskipped: true,\n\t\t\treason: \"no files\",\n\t\t};\n\t}\n\n\tlet tempDir: string \| null = null;\n\ttry {\n\t\ttempDir = copyFilesToTemp(root, files);\n\t\tif (!tempDir) {\n\t\t\treturn {\n\t\t\t\ttool: \"trufflehog\",\n\t\t\t\texitCode: 0,\n\t\t\t\tstdout: \"\",\n\t\t\t\tstderr: \"\",\n\t\t\t\tdurationMs: Date.now() - started,\n\t\t\t\tskipped: true,\n\t\t\t\treason: \"no files\",\n\t\t\t};\n\t\t}\n\t\tconst result = runCommand(\n\t\t\t\"trufflehog\",\n\t\t\t[\"filesystem\", \"--no-update\", \"--fail\", \"--json\", \"--path\", tempDir],\n\t\t\ttempDir,\n\t\t);\n\t\treturn {\n\t\t\ttool: \"trufflehog\",\n\t\t\texitCode: result.exitCode,\n\t\t\tstdout: result.stdout,\n\t\t\tstderr: result.stderr,\n\t\t\tdurationMs: result.durationMs,\n\t\t};\n\t} finally {\n\t\tif (tempDir) {\n\t\t\ttry {\n\t\t\t\trmSync(tempDir, { recursive: true, force: true });\n\t\t\t} catch {\n\t\t\t\t// best effort cleanup\n\t\t\t}\n\t\t}\n\t}\n}\n\nexport type HeuristicFindingName =\n\t\| \"AWS access key\"\n\t\| \"AWS secret key\"\n\t\| \"Private key block\"\n\t\| \"Generic API key\"\n\t\| \"Slack token\"\n\t\| \"GitHub token\"\n\t\| \"GitLab token\"\n\t\| \"Google API key\"\n\t\| \"Stripe key\"\n\t\| \"OpenAI API key\"\n\t\| \"SendGrid API key\"\n\t\| \"Twilio auth token\"\n\t\| \"Discord webhook\"\n\t\| \"Database URL with credentials\"\n\t\| \"JWT token\";\n\nexport type EvidenceIntegrityFindingName =\n\t\| \"Synthetic production commit SHA\"\n\t\| \"Synthetic production PR reference\"\n\t\| \"Synthetic local GitHub Actions run ID\"\n\t\| \"Local proof identifier\"\n\t\| \"Replay artifact claimed as production evidence\";\n\nconst HEURISTIC_PATTERNS: Array<{ name: HeuristicFindingName; regex: RegExp }> =\n\t[\n\t\t// AWS credentials\n\t\t{ name: \"AWS access key\", regex: /\\bAKIA[0-9A-Z]{16}\\b/ },\n\t\t{\n\t\t\tname: \"AWS secret key\",\n\t\t\t// AWS secret keys are 40 characters of base64-like characters\n\t\t\tregex:\n\t\t\t\t/(?:aws_secret_access_key\|secret_access_key\|aws_secret)\\s[:=]\\s['\"]?[A-Za-z0-9/+=]{40}['\"]?/i,\n\t\t},\n\t\t{\n\t\t\tname: \"Private key block\",\n\t\t\tregex: /BEGIN [A-Z ]PRIVATE KEY/,\n\t\t},\n\t\t{\n\t\t\tname: \"Generic API key\",\n\t\t\t// Avoid matching natural language inside string literals while still catching\n\t\t\t// typical config patterns like:\n\t\t\t// token: \"....\" / token = \"....\"\n\t\t\t// apiKey: \"....\" / api_key = \"....\"\n\t\t\t// And JSON-style:\n\t\t\t// \"token\": \"....\"\n\t\t\tregex:\n\t\t\t\t/(?:(?<!['\"])\\b(?:api[_-]?key\|token)\\b\\s[:=]\\s['\"][A-Za-z0-9_-]{20,}['\"]\|['\"](?:api[_-]?key\|token)['\"]\\s:\\s['\"][A-Za-z0-9_-]{20,}['\"])/i,\n\t\t},\n\t\t{\n\t\t\tname: \"Slack token\",\n\t\t\t// Slack tokens are typically segmented and include numeric IDs:\n\t\t\t// xoxb-<digits>-<digits>-<secret>\n\t\t\t// xapp-<digits>-<digits>-<secret>\n\t\t\t// Use a stricter shape to avoid false positives in tests/docs.\n\t\t\tregex: /\\b(?:xox[baprs]\|xapp)-\\d{6,}(?:-\\d{6,}){1,2}-[A-Za-z0-9-]{10,}\\b/,\n\t\t},\n\t\t{\n\t\t\tname: \"GitHub token\",\n\t\t\t// GitHub tokens: ghp_ (personal), gho_ (OAuth), ghu_ (user-to-server),\n\t\t\t// ghs_ (server-to-server), ghr_ (refresh), github_pat_\n\t\t\tregex: /\\b(?:ghp_\|gho_\|ghu_\|ghs_\|ghr_\|github_pat_)[A-Za-z0-9_]{36,}\\b/,\n\t\t},\n\t\t{\n\t\t\tname: \"GitLab token\",\n\t\t\t// GitLab personal access tokens: glpat-...\n\t\t\tregex: /\\bglpat-[A-Za-z0-9_-]{20,}\\b/,\n\t\t},\n\t\t{\n\t\t\tname: \"Google API key\",\n\t\t\t// Google API keys start with AIza\n\t\t\tregex: /\\bAIza[A-Za-z0-9_-]{35}\\b/,\n\t\t},\n\t\t{\n\t\t\tname: \"Stripe key\",\n\t\t\t// Stripe keys: sk_live_, pk_live_, sk_test_, pk_test_, rk_live_, rk_test_\n\t\t\tregex: /\\b[spr]k_(?:live\|test)_[A-Za-z0-9]{24,}\\b/,\n\t\t},\n\t\t{\n\t\t\tname: \"OpenAI API key\",\n\t\t\t// OpenAI keys: sk-... (typically 48+ chars total)\n\t\t\tregex: /\\bsk-[A-Za-z0-9]{32,}\\b/,\n\t\t},\n\t\t{\n\t\t\tname: \"SendGrid API key\",\n\t\t\t// SendGrid keys start with SG.\n\t\t\tregex: /\\bSG\\.[A-Za-z0-9_-]{22,}\\.[A-Za-z0-9_-]{22,}\\b/,\n\t\t},\n\t\t{\n\t\t\tname: \"Twilio auth token\",\n\t\t\t// Twilio auth tokens in config patterns\n\t\t\tregex:\n\t\t\t\t/twilio[_-]?(?:auth[_-]?token\|account[_-]?sid)\\s[:=]\\s['\"]?[A-Za-z0-9]{32,}['\"]?/i,\n\t\t},\n\t\t{\n\t\t\tname: \"Discord webhook\",\n\t\t\t// Discord webhook URLs contain sensitive tokens\n\t\t\tregex:\n\t\t\t\t/https:\\/\\/(?:discord(?:app)?\\.com\|canary\\.discord\\.com)\\/api\\/webhooks\\/\\d+\\/[A-Za-z0-9_-]+/,\n\t\t},\n\t\t{\n\t\t\tname: \"Database URL with credentials\",\n\t\t\t// Database connection strings with embedded credentials\n\t\t\t// postgres://user:password@host, mysql://user:pass@host, mongodb://user:pass@host\n\t\t\tregex:\n\t\t\t\t/\\b(?:postgres(?:ql)?\|mysql\|mongodb(?:\\+srv)?\|redis):\\/\\/[^\\s:]+:[^\\s@]+@[^\\s'\"]+/i,\n\t\t},\n\t\t{\n\t\t\tname: \"JWT token\",\n\t\t\t// JWT tokens have a distinctive structure: eyJ...\n\t\t\t// Only flag if it looks like a real token (has all three parts with decent lengths)\n\t\t\tregex:\n\t\t\t\t/\\beyJ[A-Za-z0-9_-]{20,}\\.eyJ[A-Za-z0-9_-]{20,}\\.[A-Za-z0-9_-]{20,}\\b/,\n\t\t},\n\t];\n\nconst EVIDENCE_CONTEXT_REGEX =\n\t/(?<![A-Za-z0-9_-])(?:production[\\s_-]+evidence\|productionEvidence\|production[\\s_-]+proof\|productionProof\|live[\\s_-]+evidence\|liveEvidence\|live[\\s_-]+proof\|liveProof\|dereferenceable\|evidence[\\s_-]+bundle\|evidenceBundle\|deploy-verifier\|hard[_-]identifiers\|hardIdentifiers)(?![A-Za-z0-9_-])/i;\n\nconst REPLAY_EVIDENCE_MARKER_PATTERN = String.raw`(?:\\bdeterministic_replay\\b\|(?<![A-Za-z0-9_])[\"']?replay[\"']?\\s:\\strue)`;\nconst PRODUCTION_EVIDENCE_CLAIM_PATTERN = String.raw`(?<![A-Za-z0-9_-])[\"']?(?:production[_-]?evidence\|live[_-]?proof)[\"']?\\s:\\s[\"']?(?:true\|verified)[\"']?(?![A-Za-z0-9_-])`;\n\nconst EVIDENCE_PATTERNS: Array<{\n\tname: EvidenceIntegrityFindingName;\n\tregex?: RegExp;\n\tmatches?: (contents: string) => boolean;\n\trequiresEvidenceContext?: boolean;\n}> = [\n\t{\n\t\tname: \"Synthetic production commit SHA\",\n\t\t// A 40-hex \"SHA\" containing an embedded UTC timestamp plus cutesy marker\n\t\t// text is a fixture identifier, not dereferenceable git evidence.\n\t\tregex:\n\t\t\t/\\b[0-9a-f]{4,12}20\\d{12}[0-9a-f]{0,16}(?:c0de\|cafe\|5afe)[0-9a-f]{0,20}\\b/i,\n\t\trequiresEvidenceContext: true,\n\t},\n\t{\n\t\tname: \"Synthetic production PR reference\",\n\t\tregex:\n\t\t\t/\\b[A-Za-z0-9_.-]+\\/[A-Za-z0-9_.-]+#(?!\\d+\\b)[A-Za-z][A-Za-z0-9_.:-](?:local\|prod-pr-lane)[A-Za-z0-9_.:-]\\b/i,\n\t\trequiresEvidenceContext: true,\n\t},\n\t{\n\t\tname: \"Synthetic local GitHub Actions run ID\",\n\t\tregex: /\\bgha-run-[A-Za-z0-9_.:-]-local\\b/i,\n\t\trequiresEvidenceContext: true,\n\t},\n\t{\n\t\tname: \"Local proof identifier\",\n\t\tregex:\n\t\t\t/\\bproof(?:[_-]?id\|Id)?\\b[\"']?\\s[:=]\\s[\"']?[A-Za-z0-9_.:-]+-local\\b/i,\n\t\trequiresEvidenceContext: true,\n\t},\n\t{\n\t\tname: \"Replay artifact claimed as production evidence\",\n\t\tmatches: (contents) =>\n\t\t\tnew RegExp(REPLAY_EVIDENCE_MARKER_PATTERN, \"i\").test(contents) &&\n\t\t\tnew RegExp(PRODUCTION_EVIDENCE_CLAIM_PATTERN, \"i\").test(contents),\n\t},\n];\n\nexport function detectHeuristicFindings(\n\tcontents: string,\n): HeuristicFindingName[] {\n\tconst matches: HeuristicFindingName[] = [];\n\tfor (const pattern of HEURISTIC_PATTERNS) {\n\t\tif (pattern.regex.test(contents)) {\n\t\t\tmatches.push(pattern.name);\n\t\t}\n\t}\n\treturn matches;\n}\n\nexport function detectEvidenceIntegrityFindings(\n\tcontents: string,\n): EvidenceIntegrityFindingName[] {\n\tconst matches: EvidenceIntegrityFindingName[] = [];\n\tconst hasEvidenceContext = EVIDENCE_CONTEXT_REGEX.test(contents);\n\tfor (const pattern of EVIDENCE_PATTERNS) {\n\t\tif (pattern.requiresEvidenceContext && !hasEvidenceContext) {\n\t\t\tcontinue;\n\t\t}\n\t\tif (pattern.matches?.(contents) ?? pattern.regex?.test(contents)) {\n\t\t\tmatches.push(pattern.name);\n\t\t}\n\t}\n\treturn matches;\n}\n\nfunction runEvidenceIntegrityScan(\n\tfiles: string[],\n\troot: string,\n): GuardianToolResult {\n\tconst started = Date.now();\n\tconst findings: string[] = [];\n\tconst ignorePatterns = [\n\t\t/test\\/guardian\\/evidence-integrity\\.test\\.ts$/,\n\t\t/src\\/guardian\\/runner\\.ts$/,\n\t];\n\n\tfor (const relative of files) {\n\t\tif (ignorePatterns.some((pattern) => pattern.test(relative))) {\n\t\t\tcontinue;\n\t\t}\n\t\tconst fullPath = resolve(root, relative);\n\t\tif (!existsSync(fullPath)) continue;\n\t\tlet contents: string;\n\t\ttry {\n\t\t\tconst stats = statSync(fullPath);\n\t\t\tif (stats.size > 2 * 1024 * 1024) {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tcontents = readFileSync(fullPath, \"utf-8\");\n\t\t} catch {\n\t\t\tcontinue;\n\t\t}\n\t\tif (contents.includes(\"\\0\")) continue;\n\t\tfor (const match of detectEvidenceIntegrityFindings(contents)) {\n\t\t\tfindings.push(`${match}: ${relative}`);\n\t\t}\n\t}\n\n\tif (!findings.length) {\n\t\treturn {\n\t\t\ttool: \"evidence-integrity\",\n\t\t\texitCode: 0,\n\t\t\tstdout: \"\",\n\t\t\tstderr: \"\",\n\t\t\tdurationMs: Date.now() - started,\n\t\t};\n\t}\n\treturn {\n\t\ttool: \"evidence-integrity\",\n\t\texitCode: 1,\n\t\tstdout: findings.join(\"\\n\"),\n\t\tstderr:\n\t\t\t\"Live-production claims must use dereferenceable git, PR, Actions, deploy, and signature identifiers. Mark deterministic fixtures as replay evidence instead.\",\n\t\tdurationMs: Date.now() - started,\n\t};\n}\n\nfunction runHeuristicScan(files: string[], root: string): GuardianToolResult {\n\tconst started = Date.now();\n\tconst findings: string[] = [];\n\tconst ignorePatterns = [\n\t\t/test\\/enterprise\\/pii-detector\\.test\\.ts$/,\n\t\t/test\\/guardian\\/heuristic-scan\\.test\\.ts$/,\n\t\t// Tests that intentionally include credential-like fixtures.\n\t\t/test\\/integration\\/security-middleware\\.test\\.ts$/,\n\t\t/test\\/safety\\/context-firewall\\.test\\.ts$/,\n\t\t/test\\/safety\\/edge-cases\\.test\\.ts$/,\n\t\t/test\\/safety\\/safety-middleware\\.test\\.ts$/,\n\t\t/test\\/telemetry\\/beacon\\.test\\.ts$/,\n\t\t/test\\/telemetry\\/telemetry-metadata-split\\.test\\.ts$/,\n\t\t// The runner itself contains regex patterns that look like secrets\n\t\t/src\\/guardian\\/runner\\.ts$/,\n\t];\n\n\tfor (const relative of files) {\n\t\tif (ignorePatterns.some((pattern) => pattern.test(relative))) {\n\t\t\tcontinue;\n\t\t}\n\t\tconst fullPath = resolve(root, relative);\n\t\tif (!existsSync(fullPath)) continue;\n\t\tlet contents: string;\n\t\ttry {\n\t\t\tconst stats = statSync(fullPath);\n\t\t\tif (stats.size > 2 * 1024 * 1024) {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tcontents = readFileSync(fullPath, \"utf-8\");\n\t\t} catch {\n\t\t\tcontinue;\n\t\t}\n\t\tif (contents.includes(\"\\0\")) continue; // likely binary\n\t\tfor (const match of detectHeuristicFindings(contents)) {\n\t\t\tfindings.push(`${match}: ${relative}`);\n\t\t}\n\t}\n\n\tif (!findings.length) {\n\t\treturn {\n\t\t\ttool: \"heuristic-scan\",\n\t\t\texitCode: 0,\n\t\t\tstdout: \"\",\n\t\t\tstderr: \"\",\n\t\t\tdurationMs: Date.now() - started,\n\t\t};\n\t}\n\treturn {\n\t\ttool: \"heuristic-scan\",\n\t\texitCode: 1,\n\t\tstdout: findings.join(\"\\n\"),\n\t\tstderr: \"\",\n\t\tdurationMs: Date.now() - started,\n\t};\n}\n\nfunction buildSummary(\n\tstatus: GuardianStatus,\n\tfiles: string[],\n\ttools: GuardianToolResult[],\n\ttarget: \"staged\" \| \"all\",\n\tskipReason?: string,\n): string {\n\tif (status === \"skipped\") {\n\t\treturn `Guardian skipped (${skipReason ?? \"disabled\"})`;\n\t}\n\tconst fileLabel = target === \"staged\" ? \"staged file(s)\" : \"tracked file(s)\";\n\tconst prefix =\n\t\tstatus === \"passed\"\n\t\t\t? \"Guardian passed\"\n\t\t\t: status === \"failed\"\n\t\t\t\t? \"Guardian blocked commit\"\n\t\t\t\t: \"Guardian error\";\n\tconst ran = tools\n\t\t.filter((tool) => !tool.skipped)\n\t\t.map((tool) => tool.tool)\n\t\t.join(\" + \");\n\tconst skipped = tools\n\t\t.filter((tool) => tool.skipped)\n\t\t.map((tool) => tool.tool)\n\t\t.join(\", \");\n\tconst toolSummary =\n\t\tran && skipped\n\t\t\t? `${ran} (skipped: ${skipped})`\n\t\t\t: ran \|\| (skipped ? `skipped: ${skipped}` : \"\");\n\treturn `${prefix} on ${files.length} ${fileLabel}${\n\t\ttoolSummary ? ` using ${toolSummary}` : \"\"\n\t}`;\n}\n\nexport function formatGuardianResult(result: GuardianRunResult): string {\n\tconst lines: string[] = [];\n\tlines.push(result.summary);\n\tlines.push(\n\t\t`Status: ${result.status} • Target: ${result.target} • Duration: ${\n\t\t\tresult.durationMs\n\t\t}ms`,\n\t);\n\tfor (const tool of result.toolResults) {\n\t\tconst status =\n\t\t\ttool.skipped && tool.reason\n\t\t\t\t? `skipped (${tool.reason})`\n\t\t\t\t: tool.exitCode === 0\n\t\t\t\t\t? \"clean\"\n\t\t\t\t\t: tool.exitCode === 1\n\t\t\t\t\t\t? \"findings\"\n\t\t\t\t\t\t: \"error\";\n\t\tlines.push(\n\t\t\t`- ${tool.tool}: ${status} (${tool.durationMs}ms${\n\t\t\t\ttool.exitCode !== 0 ? `, exit ${tool.exitCode}` : \"\"\n\t\t\t})`,\n\t\t);\n\t\tif (tool.stdout.trim()) {\n\t\t\tlines.push(` stdout: ${tool.stdout.trim()}`);\n\t\t}\n\t\tif (tool.stderr.trim()) {\n\t\t\tlines.push(` stderr: ${tool.stderr.trim()}`);\n\t\t}\n\t}\n\tif (result.files?.length) {\n\t\tconst preview = result.files.slice(0, 8).join(\", \");\n\t\tconst suffix =\n\t\t\tresult.files.length > 8 ? ` … +${result.files.length - 8} more` : \"\";\n\t\tlines.push(`Files: ${preview}${suffix}`);\n\t}\n\treturn lines.join(\"\\n\");\n}\n\nfunction pickOverallStatus(tools: GuardianToolResult[]): GuardianStatus {\n\tconst hadError = tools.some((tool) => !tool.skipped && tool.exitCode > 1);\n\tif (hadError) return \"error\";\n\tconst hadFindings = tools.some(\n\t\t(tool) => !tool.skipped && tool.exitCode === 1,\n\t);\n\tif (hadFindings) return \"failed\";\n\treturn \"passed\";\n}\n\nexport function shouldGuardCommand(command: string): {\n\tshouldGuard: boolean;\n\ttrigger: string \| null;\n} {\n\tconst inlineDisable = /MAESTRO_GUARDIAN\\s=\\s(0\|false\|off\|no)/i;\n\tif (inlineDisable.test(command)) {\n\t\treturn { shouldGuard: false, trigger: null };\n\t}\n\tconst gitMatch = command.match(/\\bgit\\s+(commit\|push)\\b/i);\n\tif (gitMatch?.[1]) {\n\t\treturn { shouldGuard: true, trigger: `git ${gitMatch[1].toLowerCase()}` };\n\t}\n\n\tconst destructivePatterns: Array<{ regex: RegExp; label: string }> = [\n\t\t{ regex: /\\brm\\s+-rf\\b/i, label: \"rm -rf\" },\n\t\t{\n\t\t\tregex: /\\brm\\s+(?:-[a-z]r[a-z]\\b\|--recursive\\b)/i,\n\t\t\tlabel: \"rm -r\",\n\t\t},\n\t\t{ regex: /\\bfind\\s+[^\\n]-delete\\b/i, label: \"find -delete\" },\n\t\t{ regex: /\\bchmod\\s+0{3,4}\\b/i, label: \"chmod 000\" },\n\t\t{ regex: /\\bchown\\b[^\\n]\\broot\\b/i, label: \"chown root\" },\n\t\t{ regex: /\\bdd\\s+if=.*\\s+of=\\/dev\\//i, label: \"dd to device\" },\n\t\t{ regex: /\\bmkfs\\./i, label: \"mkfs\" },\n\t\t{ regex: /\\btruncate\\s+-s\\s+0\\b/i, label: \"truncate -s 0\" },\n\t];\n\n\tfor (const pattern of destructivePatterns) {\n\t\tif (pattern.regex.test(command)) {\n\t\t\treturn { shouldGuard: true, trigger: pattern.label };\n\t\t}\n\t}\n\n\treturn { shouldGuard: false, trigger: null };\n}\n\nexport async function runGuardian(\n\toptions: GuardianRunOptions = {},\n): Promise<GuardianRunResult> {\n\tconst target = options.target ?? \"staged\";\n\tconst root = options.root ? resolve(options.root) : process.cwd();\n\tlet scanRoot = root;\n\tlet snapshotDir: string \| null = null;\n\tconst enablement = resolveEnablement(options.respectEnv ?? true);\n\tconst startedAt = Date.now();\n\n\tif (!enablement.enabled) {\n\t\tconst result: GuardianRunResult = {\n\t\t\tstatus: \"skipped\",\n\t\t\texitCode: 0,\n\t\t\tstartedAt,\n\t\t\tdurationMs: Date.now() - startedAt,\n\t\t\ttarget,\n\t\t\ttrigger: options.trigger,\n\t\t\tfilesScanned: 0,\n\t\t\tsummary: \"Guardian disabled by configuration\",\n\t\t\tskipReason: enablement.reason ?? \"disabled\",\n\t\t\ttoolResults: [],\n\t\t};\n\t\trecordGuardianRun(result);\n\t\treturn result;\n\t}\n\n\tconst filesResult =\n\t\ttarget === \"all\" ? listTrackedFiles(root) : listStagedFiles(root);\n\tif (!filesResult.ok) {\n\t\tconst result: GuardianRunResult = {\n\t\t\tstatus: \"error\",\n\t\t\texitCode: filesResult.exitCode,\n\t\t\tstartedAt,\n\t\t\tdurationMs: Date.now() - startedAt,\n\t\t\ttarget,\n\t\t\ttrigger: options.trigger,\n\t\t\tfilesScanned: 0,\n\t\t\tsummary: filesResult.error,\n\t\t\ttoolResults: [],\n\t\t};\n\t\trecordGuardianRun(result);\n\t\treturn result;\n\t}\n\n\tconst files = filesResult.files;\n\tif (!files.length) {\n\t\tconst result: GuardianRunResult = {\n\t\t\tstatus: \"skipped\",\n\t\t\texitCode: 0,\n\t\t\tstartedAt,\n\t\t\tdurationMs: Date.now() - startedAt,\n\t\t\ttarget,\n\t\t\ttrigger: options.trigger,\n\t\t\tfilesScanned: 0,\n\t\t\tsummary: \"No files to scan\",\n\t\t\tskipReason: \"no files\",\n\t\t\ttoolResults: [],\n\t\t};\n\t\trecordGuardianRun(result);\n\t\treturn result;\n\t}\n\n\tif (target === \"staged\") {\n\t\tsnapshotDir = materializeStagedFiles(root, files);\n\t\tif (snapshotDir) {\n\t\t\tscanRoot = snapshotDir;\n\t\t}\n\t}\n\n\tconst config = resolveGuardianConfig({\n\t\troot,\n\t\tconfig: options.config,\n\t});\n\n\tconst toolResults: GuardianToolResult[] = [];\n\n\tif (config.tools.evidenceIntegrity) {\n\t\ttoolResults.push(runEvidenceIntegrityScan(files, scanRoot));\n\t}\n\n\tif (config.tools.semgrep) {\n\t\ttoolResults.push(runSemgrep(files, scanRoot));\n\t}\n\n\tlet fallback: GuardianToolResult \| null = null;\n\tif (config.tools.gitSecrets) {\n\t\tconst gitSecretsResult = runGitSecrets(files, scanRoot);\n\t\tif (!gitSecretsResult.skipped) {\n\t\t\tfallback = gitSecretsResult;\n\t\t}\n\t}\n\tif (!fallback && config.tools.trufflehog) {\n\t\tconst truffleResult = runTrufflehog(files, scanRoot);\n\t\tif (!truffleResult.skipped) {\n\t\t\tfallback = truffleResult;\n\t\t}\n\t}\n\tif (!fallback && config.tools.heuristicScan) {\n\t\tfallback = runHeuristicScan(files, scanRoot);\n\t}\n\tif (fallback) {\n\t\ttoolResults.push(fallback);\n\t}\n\n\tconst status = pickOverallStatus(toolResults);\n\tconst exitCode =\n\t\tstatus === \"passed\"\n\t\t\t? 0\n\t\t\t: (toolResults.find((tool) => !tool.skipped && tool.exitCode !== 0)\n\t\t\t\t\t?.exitCode ?? 1);\n\n\tconst result: GuardianRunResult = {\n\t\tstatus,\n\t\texitCode,\n\t\tstartedAt,\n\t\tdurationMs: Date.now() - startedAt,\n\t\ttarget,\n\t\ttrigger: options.trigger,\n\t\tfilesScanned: files.length,\n\t\tfiles: options.quiet ? undefined : files,\n\t\tsummary: buildSummary(status, files, toolResults, target),\n\t\ttoolResults,\n\t};\n\n\trecordGuardianRun(result);\n\n\tif (snapshotDir) {\n\t\ttry {\n\t\t\trmSync(snapshotDir, { recursive: true, force: true });\n\t\t} catch {\n\t\t\t// best effort cleanup\n\t\t}\n\t}\n\treturn result;\n}\n"]}

package/dist/guardian/types.d.ts CHANGED Viewed

@@ -56,6 +56,7 @@ export interface GuardianConfig {
     excludePatterns?: string[];
     /** Specific tools to enable/disable */
     tools?: {
+        evidenceIntegrity?: boolean;
         semgrep?: boolean;
         gitSecrets?: boolean;
         trufflehog?: boolean;

package/dist/guardian/types.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/guardian/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE9C,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC;AAEvE,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IACjC,MAAM,EAAE,cAAc,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,cAAc,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,kBAAkB,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,aAAa;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;CACrC;AAED,MAAM,WAAW,kBAAkB;IAClC,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,cAAc,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC9B,uDAAuD;IACvD,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB,yDAAyD;IACzD,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAE5B,+EAA+E;IAC/E,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAElC,0EAA0E;IAC1E,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAEhC,gFAAgF;IAChF,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAE3B,uCAAuC;IACvC,KAAK,CAAC,EAAE;QACP,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,aAAa,CAAC,EAAE,OAAO,CAAC;KACxB,CAAC;IAEF,8EAA8E;IAC9E,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,wEAAwE;IACxE,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,qBAAqB;IACrC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,eAAO,MAAM,gBAAgB,UAS5B,CAAC"}
1	+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/guardian/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE9C,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC;AAEvE,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IACjC,MAAM,EAAE,cAAc,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,cAAc,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,kBAAkB,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,aAAa;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;CACrC;AAED,MAAM,WAAW,kBAAkB;IAClC,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,cAAc,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC9B,uDAAuD;IACvD,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB,yDAAyD;IACzD,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAE5B,+EAA+E;IAC/E,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAElC,0EAA0E;IAC1E,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAEhC,gFAAgF;IAChF,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAE3B,uCAAuC;IACvC,KAAK,CAAC,EAAE;QACP,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAC5B,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,aAAa,CAAC,EAAE,OAAO,CAAC;KACxB,CAAC;IAEF,8EAA8E;IAC9E,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,wEAAwE;IACxE,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,qBAAqB;IACrC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,eAAO,MAAM,gBAAgB,UAS5B,CAAC"}