@event4u/agent-config 16.4.0 → 17.0.0

package/dist/scripts/_lib/svg_urls.js

@@ -0,0 +1,67 @@
+/**
+ * How a browser reads the URLs and names in an SVG, for the safety rules in
+ * `svg_rules.ts`: references decoded, controls stripped, CSS escapes resolved,
+ * and an element prefix stripped only where it is bound to the SVG namespace.
+ * Its own module so `svg_rules.ts` stays under the source-size ceiling.
+ */
+/** Prefixes the document binds to the SVG namespace (`xmlns:svg="…/2000/svg"`). */
+export function svgPrefixes(content) {
+    const out = new Set();
+    const re = /xmlns:([\w.-]+)\s*=\s*["']http:\/\/www\.w3\.org\/2000\/svg["']/gi;
+    let m;
+    while ((m = re.exec(content)) !== null)
+        out.add((m[1] ?? '').toLowerCase());
+    return out;
+}
+/** The SVG local name: `svg:script` is a `script` where `svg` is bound to SVG; `foo:script` is not. */
+export function localName(name, prefixes) {
+    const colon = name.indexOf(':');
+    return colon !== -1 && prefixes.has(name.slice(0, colon)) ? name.slice(colon + 1) : name;
+}
+/** Attributes read from the raw tag, unquoted values included — HTML parses those. */
+export function rawAttrs(raw) {
+    const out = {};
+    const re = /([\w:.-]+)\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>"'`=]+))/g;
+    let m;
+    while ((m = re.exec(raw)) !== null)
+        out[(m[1] ?? '').toLowerCase()] = m[2] ?? m[3] ?? m[4] ?? '';
+    return out;
+}
+/** Attributes whose value is followed as a URL. */
+export const URL_ATTRS = new Set(['href', 'xlink:href', 'src']);
+/** A URL that executes or opens a document when followed. */
+export const isActiveUrl = (raw) => /^(javascript:|data:text\/html)/i.test(resolvedUrl(raw));
+const NAMED_URL_ENTITIES = {
+    colon: ':', sol: '/', tab: '\t', newline: '\n', period: '.', lpar: '(', rpar: ')', amp: '&',
+};
+/**
+ * The URL a browser would actually resolve from an attribute value: character
+ * references decoded, leading/trailing C0 controls and spaces stripped, tab and
+ * newline removed anywhere. The trailing `;` of a reference is optional on
+ * purpose: an `.svg` parsed as XML needs it, but the same graphic inlined in an
+ * HTML host is parsed by the HTML tokenizer, which decodes `&#106avascript:`
+ * too — over-reading XML here costs precision, under-reading HTML costs a miss.
+ * The raw value is attacker-chosen, so a scheme test
+ * against it is a test of one spelling — ` https:`, `ht\ttps:`, `javascript:`
+ * all load, and all passed.
+ */
+export function resolvedUrl(raw) {
+    const decoded = raw.replace(/&(?:#x([0-9a-f]+)|#(\d+)|([a-z]+));?/gi, (m, hex, dec, name) => {
+        const cp = hex ? parseInt(hex, 16) : dec ? parseInt(dec, 10) : NaN;
+        if (!Number.isNaN(cp))
+            return cp <= 0x10ffff ? String.fromCodePoint(cp) : m;
+        return NAMED_URL_ENTITIES[name.toLowerCase()] ?? m;
+    });
+    return decoded.replace(/^[\u0000- ]+|[\u0000- ]+$/g, '').replace(/[\t\n\r]/g, '');
+}
+/** CSS escapes decoded: `\\68 ` and `\\h` both read `h`. */
+export function cssUnescape(raw) {
+    return raw.replace(/\\([0-9a-f]{1,6})\s?|\\(.)/gi, (m, hex, ch) => {
+        if (hex) {
+            const cp = parseInt(hex, 16);
+            return cp <= 0x10ffff ? String.fromCodePoint(cp) : m;
+        }
+        return ch;
+    });
+}
+//# sourceMappingURL=svg_urls.js.map

package/dist/scripts/_lib/ui_surface.js

@@ -86,4 +86,23 @@ export function isUiTreePath(p) {
         return false;
     return UI_PATH_FRAGMENTS.some((fragment) => normalized.includes(fragment));
 }
+/**
+ * The file-shaped triggers of `design-fidelity` — the ONE list every handover
+ * carrier reads (`isArtifactRead`, `isHandoverPath`, `HANDOVER_TRIGGERS`).
+ * Three hand copies drifted: one lacked `*.dc.html`. `design_pass.test.ts`
+ * pins this list to the rule's frontmatter in both directions.
+ */
+export const HANDOVER_SHAPES = [
+    { file_pattern: '*design.html' },
+    { file_pattern: '*.dc.html' },
+    { path_prefix: '.claude/design-system/' },
+    { path_prefix: '.design-sync/' },
+];
+/** True when `file` has a handover shape. Direction-agnostic, case-insensitive. */
+export function isHandoverShape(file) {
+    if (!file)
+        return false;
+    const normalized = file.replace(/\\/g, '/').toLowerCase();
+    return HANDOVER_SHAPES.some((s) => 'path_prefix' in s ? normalized.includes(s.path_prefix) : normalized.endsWith(s.file_pattern.slice(1)));
+}
 //# sourceMappingURL=ui_surface.js.map

package/dist/scripts/_lib/verification_command.js

@@ -0,0 +1,364 @@
+/**
+ * The verification-command selector — one predicate, two importers.
+ *
+ * It first moved here byte-identical out of `hooks/turn_end_gate_hook.ts` so
+ * that `_lib/verification_evidence.ts` could read it without importing a hook
+ * that imports the evidence module straight back. That cycle resolves at
+ * runtime today and breaks the day either side grows a module-level constant
+ * reading the other, which is a failure nobody would trace to an import line.
+ *
+ * The hook re-exports the name, so every existing consumer — including both
+ * pinning test files — addresses it at the path it always did.
+ *
+ * WHY IT STOPPED BEING A REGEX (2026-09-30).
+ * The tree carried TWO expressions answering "did this command verify
+ * anything", and they disagreed in both directions:
+ *
+ * - `_VERIFY_RE` here matched a verification token **anywhere on the line**, so
+ *   `ls tests`, `cat build.log`, `git checkout main`, `mkdir build` and
+ *   `git commit -m "fix ci"` all cleared detector C — the exact case this
+ *   header claimed to reject. Measured at the pin: all six returned `true`.
+ * - `_VERIFICATION_RE` in `before_complete_hook.ts` was head-anchored to a
+ *   fixed vendor list and refused `npx vitest run`, `tsc --noEmit` and every
+ *   `./scripts-run src/scripts/lint_*` — commands this project runs constantly.
+ *   Measured at the pin: all three returned `false`.
+ *
+ * Both accepted `npm test || true`, where the shell discards the failure.
+ *
+ * The audited allowlist passed the whole time the first defect was live,
+ * because not one of its seven negatives put a verify token in an ARGUMENT
+ * position. A word-boundary regex cannot express "the head of the segment",
+ * which is the property that actually distinguishes `npm test` from `ls tests`,
+ * so the predicate is now structural: split on shell separators, drop a
+ * segment whose failure the shell discards, and classify each remaining
+ * segment on its HEAD.
+ *
+ * THE LISTS ARE STILL DELIBERATELY NARROW.
+ * A positive list. The alternative — treating any `Bash` call as verification —
+ * was rejected because `ls` would then clear an unverified edit, which is the
+ * failure mode `verify-before-complete` names ("relying on partial
+ * verification"). The cost of narrowness is a MISSED detection when a project
+ * verifies by some command not listed here, and that is the safe direction for
+ * a gate that can refuse a turn: a false negative costs one unguarded turn, a
+ * false positive teaches the user to switch the gate off.
+ *
+ * AUDITED 2026-08-17, re-seeded 2026-09-30 from the union of both lists minus
+ * every row that only ever matched on an argument. The table of every command
+ * with its verdict is `turn_end_verify_allowlist.test.ts`; the two directions
+ * of the old disagreement are `verification_command_anchoring.test.ts`.
+ *
+ * Deliberate NON-additions, kept because Risk 2 of the originating roadmap is
+ * that every addition is a way to satisfy the gate without verifying anything:
+ *
+ *   · `npm run prepack` — a lifecycle hook whose content is per-project. Here
+ *     it validates; elsewhere it copies files.
+ *   · `task sync` / `task generate-tools` / `agent-config roadmap:progress` —
+ *     GENERATORS. They rewrite the tree; they check nothing.
+ *   · `agent-config gates --all` — enumerates gates, runs none.
+ *   · `rector` — a refactoring tool. Its dry run prints a diff; it asserts
+ *     nothing. It appears in `_VERIFICATION_RE`'s list and is dropped from the
+ *     union on the strength of the audited `false` row, which carries a reason
+ *     where the other list carried only a name.
+ *   · `./scripts-run src/scripts/rule_activation_census` — a census writes a
+ *     report; it asserts nothing. This is why the `scripts-run` rule keys on
+ *     the `check_` / `lint_` prefix rather than on the runner.
+ *
+ * `psalm` IS carried, unlike the pre-2026-09-30 note here which argued it out
+ * for want of a local user: it was in `_VERIFICATION_RE` all along, so the
+ * union rule admits it and dropping it would be a narrowing this change did not
+ * set out to make.
+ *
+ * WHAT THIS SELECTOR STILL CANNOT DO: it reads the command TEXT, so
+ * `vitest run` matches whether or not it passed. Deciding whether a run proved
+ * anything is `verification_evidence.ts`, which reads the exit code and the
+ * summary the command printed. This selector decides only what is WORTH
+ * recording and classifying.
+ */
+/** Binaries that verify when they are the head of a segment. */
+const VERIFY_BINARIES = new Set([
+    'vitest',
+    'jest',
+    'pytest',
+    'phpunit',
+    'pest',
+    'tsc',
+    'eslint',
+    'ruff',
+    'mypy',
+    'pyright',
+    'clippy',
+    'phpstan',
+    'psalm',
+    'ecs',
+]);
+/** Prefixes that delegate to the real command; dropped before classifying. */
+const DELEGATING_HEADS = new Set([
+    'npx',
+    'bunx',
+    'sudo',
+    'time',
+    'command',
+]);
+/** Path prefixes a binary is commonly reached through. */
+const PATH_PREFIXES = [
+    './',
+    'vendor/bin/',
+    '.venv/bin/',
+    'node_modules/.bin/',
+    'bin/',
+];
+/** A script or subcommand name that names a check rather than a build step. */
+const VERIFY_WORD = /(^|[-_:])(test|tests|check|checks|lint|typecheck|tsc|qa|preflight|smoke|validate)([-_:]|$)/i;
+/** `npm run build` verifies here; `task build` is not in the audited surface. */
+const NPM_SCRIPT_WORD = /(^|[-_:])(test|tests|check|checks|lint|typecheck|tsc|build)([-_:]|$)/i;
+/** Strip an unquoted trailing `#` comment. */
+function stripComment(command) {
+    let inSingle = false;
+    let inDouble = false;
+    for (let i = 0; i < command.length; i += 1) {
+        const ch = command[i];
+        if (ch === "'" && !inDouble)
+            inSingle = !inSingle;
+        else if (ch === '"' && !inSingle)
+            inDouble = !inDouble;
+        else if (ch === '#' && !inSingle && !inDouble && (i === 0 || /\s/.test(command[i - 1] ?? ''))) {
+            return command.slice(0, i);
+        }
+    }
+    return command;
+}
+/** Split into segments, remembering the separator that follows each. */
+function splitSegments(command) {
+    const raw = [];
+    let buf = '';
+    let inSingle = false;
+    let inDouble = false;
+    for (let i = 0; i < command.length; i += 1) {
+        const ch = command[i];
+        const two = command.slice(i, i + 2);
+        if (ch === "'" && !inDouble) {
+            inSingle = !inSingle;
+            buf += ch;
+            continue;
+        }
+        if (ch === '"' && !inSingle) {
+            inDouble = !inDouble;
+            buf += ch;
+            continue;
+        }
+        if (!inSingle && !inDouble) {
+            if (two === '&&' || two === '||') {
+                raw.push({ text: buf, sep: two });
+                buf = '';
+                i += 1;
+                continue;
+            }
+            if (ch === ';' || ch === '|') {
+                raw.push({ text: buf, sep: ch });
+                buf = '';
+                continue;
+            }
+        }
+        buf += ch;
+    }
+    raw.push({ text: buf, sep: null });
+    return raw.map((entry, idx) => {
+        const next = raw[idx + 1];
+        const nextWords = next ? words(next.text) : [];
+        return {
+            words: words(entry.text),
+            nextSep: entry.sep,
+            nextHead: (nextWords[0] ?? null)?.toLowerCase() ?? null,
+        };
+    });
+}
+/** Tokenise a segment, dropping leading `VAR=value` assignments. */
+function words(text) {
+    const tokens = text.trim().split(/\s+/).filter((w) => w.length > 0);
+    let i = 0;
+    while (i < tokens.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(tokens[i]))
+        i += 1;
+    return tokens.slice(i);
+}
+/** Strip a path prefix from a binary name. */
+function bareName(word) {
+    let w = word;
+    for (const prefix of PATH_PREFIXES) {
+        if (w.startsWith(prefix)) {
+            w = w.slice(prefix.length);
+            break;
+        }
+    }
+    const slash = w.lastIndexOf('/');
+    return (slash >= 0 ? w.slice(slash + 1) : w).toLowerCase();
+}
+/**
+ * Does the shell discard this segment's failure?
+ *
+ * `cmd || true`, `cmd || :` and `cmd ; true` all leave the caller with exit 0
+ * whatever `cmd` did, so a verification there proves nothing about the tree.
+ * Deliberately narrow: `cmd || exit 1` propagates the failure and still counts.
+ */
+function failureIsDiscarded(seg) {
+    if (seg.nextSep === '||')
+        return seg.nextHead === 'true' || seg.nextHead === ':';
+    if (seg.nextSep === ';')
+        return seg.nextHead === 'true' || seg.nextHead === ':';
+    return false;
+}
+/** Classify one segment on its head. */
+function segmentVerifies(rawWords) {
+    const w = rawWords.filter((x) => x.length > 0);
+    let idx = 0;
+    // Peel delegating prefixes: `npx vitest run`, `sudo make test`.
+    while (idx < w.length && DELEGATING_HEADS.has(bareName(w[idx])))
+        idx += 1;
+    if (idx >= w.length)
+        return false;
+    const head = bareName(w[idx]);
+    const rest = w.slice(idx + 1).map((x) => x.toLowerCase());
+    const arg1 = rest[0] ?? '';
+    if (VERIFY_BINARIES.has(head))
+        return true;
+    switch (head) {
+        case 'npm':
+        case 'pnpm':
+        case 'yarn':
+        case 'bun': {
+            // `pnpm dlx vitest` delegates; `npm run test:ts` names a script.
+            if (arg1 === 'dlx' || arg1 === 'exec')
+                return segmentVerifies(rest.slice(1));
+            const script = arg1 === 'run' ? (rest[1] ?? '') : arg1;
+            return NPM_SCRIPT_WORD.test(script);
+        }
+        case 'task':
+            return VERIFY_WORD.test(arg1) || /^ci([-_:]|$)/i.test(arg1);
+        case 'cargo':
+            return arg1 === 'test' || arg1 === 'check' || arg1 === 'clippy';
+        case 'go':
+            return arg1 === 'test' || arg1 === 'vet';
+        case 'make':
+            return VERIFY_WORD.test(arg1) || /^ci([-_:]|$)/i.test(arg1);
+        case 'composer':
+            return VERIFY_WORD.test(arg1) || arg1 === 'phpstan';
+        case 'php':
+            return arg1 === 'artisan' && (rest[1] ?? '') === 'test';
+        case 'artisan':
+            return arg1 === 'test';
+        case 'python':
+        case 'python3':
+            return arg1 === '-m' && VERIFY_BINARIES.has(rest[1] ?? '');
+        case 'node':
+        case 'deno':
+            // `node --test` is a runner selected by a FLAG, not by a
+            // subcommand, so head-anchoring alone would refuse it. Caught by
+            // `verification_evidence.test.ts` when this predicate narrowed:
+            // the old token-anywhere regex accepted it by accident and neither
+            // explicit list named it, so the union seeding missed it too.
+            return rest.some((a) => a === 'test' || a.startsWith('--test'));
+        case 'agent-config':
+            // NEITHER `ui:render` NOR `xmllint` verifies here, and the first
+            // half of that was true, then false, and is true again.
+            //
+            // Step 3.5 of `road-to-svg-with-a-witness` taught this predicate
+            // `ui:render --profile asset`, reasoning that it is the one
+            // subcommand which opens the delivered file in a real engine. Step
+            // 2.1(b) of `road-to-svg-review-followups` removed it again on
+            // review claim C2, which is narrower than the first argument and
+            // refutes it: the turn-end gate's TRANSCRIPT path matches a command
+            // and never sees an exit code, so a call that rendered nothing —
+            // the ordinary case on a machine with no Playwright, where the
+            // command also exited 0 until the same day — discharged the
+            // obligation from its text alone.
+            //
+            // What replaces it reads the RENDER instead of the call:
+            // `hooks/svg_obligation.ts` matches a manifest to the file's own
+            // digest, and accepts a renderer-absent manifest only together with
+            // a clean static witness on those same bytes. `xmllint --noout`
+            // stays out for its original reason (S6): a file can parse and
+            // still be the wrong picture.
+            return false;
+        case 'scripts-run': {
+            // `./scripts-run src/scripts/lint_x` verifies; `…/rule_activation_census`
+            // writes a report and asserts nothing, which is why this keys on the
+            // script's own prefix rather than on the runner.
+            const script = bareName(arg1);
+            return /^(check|lint|verify|validate)[-_]/.test(script);
+        }
+        default:
+            return false;
+    }
+}
+/**
+ * True when the command runs something that asserts the tree still holds.
+ *
+ * Classified per shell segment on the segment's HEAD, so a verification token
+ * appearing as an argument — `ls tests`, `git commit -m "fix ci"` — never
+ * counts, and a chained `task sync && task ci` counts on its second segment.
+ */
+export function isVerificationCommand(command) {
+    if (!command)
+        return false;
+    const segments = splitSegments(stripComment(command));
+    return segments.some((seg) => !failureIsDiscarded(seg) && segmentVerifies(seg.words));
+}
+/**
+ * The RECORDER's net — deliberately wider than the predicate above, and not a
+ * leftover of the two-regex era it replaces.
+ *
+ * The two answer different questions. `isVerificationCommand` answers *did
+ * this verify*, and a false positive there clears an unverified edit, so it is
+ * head-anchored and narrow. This one answers *is this worth writing down for
+ * `classifyRun` to judge*, and there the costly error is the opposite: a
+ * recorder that filtered `echo test` out would leave the turn-end gate unable
+ * to tell "the turn ran a non-verification command" from "the turn ran
+ * nothing at all", and `not_a_verification_command` is a verdict the gate
+ * needs to SEE rather than infer from silence.
+ *
+ * That is why unifying the two call sites into one predicate was tried and
+ * rejected on 2026-09-30: it is not two spellings of one idea, it is two
+ * questions with opposite error costs. What was wrong before was that each
+ * question had its own private regex in its own file and the two also
+ * disagreed about the FIRST question. Both now live here, and only this one
+ * matches on a token anywhere in the line.
+ */
+const _WIDE_CANDIDATE_RE = /\b(test|tests|vitest|jest|pytest|phpunit|pest|tsc|eslint|ruff|mypy|pyright|clippy|phpstan|typecheck|lint[-_:a-z]*|build|ci|preflight|smoke[-_:a-z]*|check[-_:a-z]*|validate[-_:a-z]*)\b|\b(task|npm|pnpm|yarn|composer|cargo|go|make|php artisan|bun)\s+(run\s+)?\S*(test|check|lint|build|ci|typecheck)/i;
+export function mightBeVerification(command) {
+    return _WIDE_CANDIDATE_RE.test(command);
+}
+/**
+ * `agent-config ui:render … --profile asset`, by shape.
+ *
+ * Moved here from `hooks/svg_obligation.ts` by finding 3 of this change's
+ * SECOND completion review: two detectors need it and one of them is in
+ * `_lib`, so a hook module was the wrong home. Re-exported there, so no
+ * caller moved.
+ */
+export function isAssetRenderCommand(command) {
+    return /\bui:render\b/.test(command) && /--profile[= ]\s*asset\b/.test(command);
+}
+/**
+ * Did this command ATTEMPT to verify something — as opposed to: did it produce
+ * a verdict this gate may read?
+ *
+ * The distinction is the whole point, and the first review round and the
+ * second each saw one half of it. Round one (claim C2) was right that
+ * `isVerificationCommand` must NOT learn the asset render: the transcript path
+ * never sees an exit code, so the command's TEXT would have discharged the SVG
+ * obligation on a machine where the render produced nothing. Round two
+ * (finding 3) was right that removing it left detector C — "did any
+ * verification command follow the last edit" — unable to see the one command
+ * this package PRESCRIBES for an `.svg`, so the prescribed turn was refused.
+ *
+ * Both hold because they are about different detectors. Detector C asks
+ * whether the author tried; it is satisfied by `eslint` and must be satisfied
+ * by a render too. The SVG obligation asks what the render FOUND, and still
+ * reads the manifest and the file's digest — an attempt that produced nothing
+ * discharges nothing there, with a far better reason than detector C's.
+ *
+ * So: one predicate per question, and `isVerificationCommand` is unchanged.
+ */
+export function isVerificationAttempt(command) {
+    return isVerificationCommand(command) || isAssetRenderCommand(command);
+}
+//# sourceMappingURL=verification_command.js.map

package/dist/scripts/_lib/workspace_secrets.js

@@ -0,0 +1,229 @@
+/**
+ * Shared secret-detection + scrub primitives for the workspace stores.
+ *
+ * Lives under `src/scripts/_lib/` because a shipped module
+ * (`cross_repo_retrieve.ts`) reads it and `src/cli/` is not in the package;
+ * `src/cli/python/workspace_secrets.ts` re-exports it for the workspace stores.
+ * The contract — the exported names, the per-call match counts, `scrub_obj`'s
+ * depth and cycle guard and the `[SECRET]` placeholder — is pinned by
+ * `tests/scripts/cli/python/workspace_secrets.test.ts`, and what it detects by
+ * `egress_legacy_superset.test.ts`.
+ *
+ * Near-leaf module — its one import is the pure rule table (no I/O) — so the
+ * hot-path analytics `emit()` and the heavier `knowledge_ingest` can both
+ * depend on it cheaply without dragging in PII redaction, chunking, or file
+ * I/O. Every workspace store that persists text or arbitrary payloads at rest
+ * routes through this module before writing (Phase 8 Step 5 secret-hygiene
+ * sweep).
+ *
+ * Two confidence tiers:
+ *
+ * - **HIGH** — structurally unambiguous credentials: the credential rows of
+ *   the one rule table (vendor keys, tokens, PEM private-key block, a
+ *   connection URI with an inline password). Near-zero false-positive rate, so
+ *   safe to scrub destructively or to refuse a write over.
+ * - **FUZZY** — the generic `key/secret/token/password = <value>` assignment.
+ *   Fires on legitimate prose ("password reset token: see attached"), so it is
+ *   warn-only on user-authored content and only scrubbed on disposable,
+ *   machine-generated telemetry (sessions / analytics).
+ *
+ * The `[SECRET]` placeholder matches the knowledge-ingestion redactor so the
+ * two surfaces stay byte-consistent.
+ */
+import { assignmentPattern, detect, EGRESS_RULES, maskingEnd, prefixesOf, rawKeyPrefixPattern, } from './egress_rules.js';
+export const PLACEHOLDER = '[SECRET]';
+// --- HIGH-confidence tier: the credential rows of the one rule table -------
+//
+// Detection lives in `src/scripts/_lib/egress_rules.ts`, the only place a
+// credential pattern is defined (road-to-one-detector-and-the-senders-we-own
+// 2.2); this module keeps its own policy — the `[SECRET]` placeholder, the
+// HIGH/FUZZY tiers and the counts. `generic-assignment` is left to the FUZZY tier
+// below, which is this module's own, looser reading of the same shape.
+const HIGH_RULES = EGRESS_RULES.filter((r) => r.class === 'credential' && r.rule !== 'generic-assignment');
+// The finding names this module has always reported; a row without one reports
+// its rule id.
+const LEGACY_NAME = {
+    'pem-private-key': 'private_key',
+    'aws-access-key': 'aws_access_key',
+    'github-pat': 'github_pat',
+    'github-app-token': 'github_pat',
+    'openai-api-key': 'openai_key',
+};
+const LEGACY_ORDER = ['private_key', 'aws_access_key', 'github_pat', 'openai_key'];
+const rank = (name) => {
+    const i = LEGACY_ORDER.indexOf(name);
+    return i < 0 ? LEGACY_ORDER.length : i;
+};
+// This module's own, looser readings of two shapes, kept so the move to the
+// table narrows nothing: the GitHub token family at any length and an OpenAI key
+// glued to a preceding word. The prefixes are the table's.
+const OWN_SHAPES = [
+    [
+        'github_pat',
+        rawKeyPrefixPattern(36, [...prefixesOf('github-pat'), ...prefixesOf('github-app-token')], {
+            boundary: 'never',
+            tail: 'A-Za-z0-9',
+        }),
+    ],
+    ['openai_key', rawKeyPrefixPattern(20, prefixesOf('openai-api-key'), { boundary: 'never', tail: 'A-Za-z0-9' })],
+];
+/** HIGH spans in report order, each widened to the bytes a scrub must remove. */
+function highSpans(text) {
+    const spans = detect(text, HIGH_RULES).map((s) => ({
+        name: LEGACY_NAME[s.rule] ?? s.rule,
+        start: s.start,
+        end: maskingEnd(text, s),
+    }));
+    for (const [name, re] of OWN_SHAPES) {
+        for (const m of text.matchAll(re))
+            spans.push({ name, start: m.index, end: m.index + m[0].length });
+    }
+    // One finding per value: a span inside another span of the same name is that span.
+    const kept = spans.filter((a, i) => !spans.some((b, j) => j !== i &&
+        b.name === a.name &&
+        b.start <= a.start &&
+        b.end >= a.end &&
+        (b.end - b.start > a.end - a.start || j < i)));
+    return kept.sort((x, y) => rank(x.name) - rank(y.name) || x.start - y.start);
+}
+// --- FUZZY pattern (heuristic key/value assignment) -------------------------
+// Python `(?i)` inline flag → JS `i` flag. Character class is identical.
+// The keyword shape is the table's; the 12-character value is this module's threshold.
+const _RE_KV_SECRET = assignmentPattern({
+    keywords: ['apiKey', 'secret', 'token', 'password', 'passwd', 'bearer'],
+    value: `['"]?[A-Za-z0-9_\\-+/=]{12,}['"]?`,
+}, 'i');
+export const FUZZY = [['kv_secret', _RE_KV_SECRET]];
+// Recursion guard for `scrub_obj` — deep / cyclic structures degrade to a
+// controlled return instead of a RangeError on the never-raises hot path.
+const _MAX_DEPTH = 50;
+/**
+ * Build a global-flagged clone of `pat` so `matchAll` / `replace` get
+ * left-to-right non-overlapping iteration matching Python `finditer` / `subn`,
+ * without mutating the shared stateless module-level pattern.
+ */
+function _global(pat) {
+    const flags = pat.flags.includes('g') ? pat.flags : pat.flags + 'g';
+    return new RegExp(pat.source, flags);
+}
+/** Count of non-overlapping matches — mirrors `len(list(pat.finditer(text)))`. */
+function _finditerCount(pat, text) {
+    let n = 0;
+    for (const _m of text.matchAll(_global(pat)))
+        n += 1;
+    return n;
+}
+/** `pat.subn(repl, text)` → `[clean, count]` (non-overlapping, left-to-right). */
+function _subn(pat, repl, text) {
+    let count = 0;
+    const clean = text.replace(_global(pat), () => {
+        count += 1;
+        return repl;
+    });
+    return [clean, count];
+}
+/**
+ * Non-destructive detection: one {@link Finding} per match.
+ *
+ * Never echoes the matched secret value — only the pattern name and tier,
+ * so a caller can warn or refuse without re-leaking the secret into a log.
+ */
+export function scan(text, opts) {
+    const include_fuzzy = opts?.include_fuzzy ?? true;
+    if (typeof text !== 'string' || !text) {
+        return [];
+    }
+    const out = highSpans(text).map((s) => ({ pattern: s.name, confidence: 'high' }));
+    if (include_fuzzy) {
+        for (const [name, pat] of FUZZY) {
+            const n = _finditerCount(pat, text);
+            for (let i = 0; i < n; i += 1)
+                out.push({ pattern: name, confidence: 'fuzzy' });
+        }
+    }
+    return out;
+}
+/** Replace every secret match with `[SECRET]`; return `[clean, count]`. */
+export function scrub(text, opts) {
+    const include_fuzzy = opts?.include_fuzzy ?? true;
+    if (typeof text !== 'string' || !text) {
+        return [text, 0];
+    }
+    const spans = highSpans(text).sort((x, y) => x.start - y.start);
+    const merged = [];
+    for (const sp of spans) {
+        const last = merged[merged.length - 1];
+        if (last !== undefined && sp.start < last.end)
+            last.end = Math.max(last.end, sp.end);
+        else
+            merged.push({ start: sp.start, end: sp.end });
+    }
+    let out = text;
+    for (let i = merged.length - 1; i >= 0; i -= 1) {
+        const m = merged[i];
+        out = out.slice(0, m.start) + PLACEHOLDER + out.slice(m.end);
+    }
+    let count = merged.length;
+    if (include_fuzzy) {
+        for (const [, pat] of FUZZY) {
+            const [next, n] = _subn(pat, PLACEHOLDER, out);
+            out = next;
+            count += n;
+        }
+    }
+    return [out, count];
+}
+/**
+ * Recursively scrub string leaves in object / array structures.
+ *
+ * Non-string leaves (number, boolean, null) pass through untouched. Recursion
+ * is bounded by a depth cap and a cycle guard so malformed or self-referential
+ * payloads degrade to a controlled return, never a stack overflow — callers on
+ * a never-raises hot path (`workspace_analytics.emit`) rely on this. Returns
+ * `[clean, count]`.
+ *
+ * Python distinguishes `list` (→ list) from `tuple` (→ tuple); JS has only
+ * `Array`, so an array round-trips as an array, matching the Python `list`
+ * branch (the workspace stores never feed a tuple through this path).
+ */
+export function scrub_obj(obj, opts) {
+    const include_fuzzy = opts?.include_fuzzy ?? true;
+    const _depth = opts?._depth ?? 0;
+    const _seen = opts?._seen ?? new Set();
+    if (_depth > _MAX_DEPTH) {
+        return [obj, 0];
+    }
+    if (typeof obj === 'string') {
+        return scrub(obj, { include_fuzzy });
+    }
+    if (Array.isArray(obj)) {
+        if (_seen.has(obj)) {
+            return [obj, 0];
+        }
+        _seen.add(obj);
+        let total = 0;
+        const items = [];
+        for (const value of obj) {
+            const [cv, n] = scrub_obj(value, { include_fuzzy, _depth: _depth + 1, _seen });
+            items.push(cv);
+            total += n;
+        }
+        return [items, total];
+    }
+    if (obj !== null && typeof obj === 'object') {
+        if (_seen.has(obj)) {
+            return [obj, 0];
+        }
+        _seen.add(obj);
+        let total = 0;
+        const clean = {};
+        for (const [key, value] of Object.entries(obj)) {
+            const [cv, n] = scrub_obj(value, { include_fuzzy, _depth: _depth + 1, _seen });
+            clean[key] = cv;
+            total += n;
+        }
+        return [clean, total];
+    }
+    return [obj, 0];
+}
+//# sourceMappingURL=workspace_secrets.js.map