@fractary/core 0.4.0 → 0.5.0

package/dist/common/__tests__/secrets.test.d.ts

@@ -0,0 +1,7 @@
+/**
+ * @fractary/core - Secrets Sanitization Tests
+ *
+ * Comprehensive unit tests for the secrets sanitization utilities.
+ */
+export {};
+//# sourceMappingURL=secrets.test.d.ts.map

package/dist/common/__tests__/secrets.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.test.d.ts","sourceRoot":"","sources":["../../../src/common/__tests__/secrets.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG"}

package/dist/common/__tests__/secrets.test.js

@@ -0,0 +1,320 @@
+"use strict";
+/**
+ * @fractary/core - Secrets Sanitization Tests
+ *
+ * Comprehensive unit tests for the secrets sanitization utilities.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const secrets_1 = require("../secrets");
+describe('sanitizeSecrets', () => {
+    describe('GitHub tokens', () => {
+        it('should redact GitHub personal access tokens (ghp_)', () => {
+            const input = 'Token: ghp_1234567890abcdefghijklmnopqrstuvwxyz12';
+            const result = (0, secrets_1.sanitizeSecrets)(input);
+            expect(result).toBe('Token: [REDACTED_GITHUB_TOKEN]');
+        });
+        it('should redact GitHub OAuth tokens (gho_)', () => {
+            const input = 'Auth: gho_1234567890abcdefghijklmnopqrstuvwxyz12';
+            const result = (0, secrets_1.sanitizeSecrets)(input);
+            expect(result).toBe('Auth: [REDACTED_GITHUB_TOKEN]');
+        });
+        it('should redact GitHub user-to-server tokens (ghu_)', () => {
+            const input = 'ghu_abcdefghijklmnopqrstuvwxyz1234567890ab';
+            const result = (0, secrets_1.sanitizeSecrets)(input);
+            expect(result).toBe('[REDACTED_GITHUB_TOKEN]');
+        });
+        it('should redact GitHub server-to-server tokens (ghs_)', () => {
+            const input = 'ghs_abcdefghijklmnopqrstuvwxyz1234567890ab';
+            const result = (0, secrets_1.sanitizeSecrets)(input);
+            expect(result).toBe('[REDACTED_GITHUB_TOKEN]');
+        });
+        it('should redact GitHub refresh tokens (ghr_)', () => {
+            const input = 'ghr_abcdefghijklmnopqrstuvwxyz1234567890ab';
+            const result = (0, secrets_1.sanitizeSecrets)(input);
+            expect(result).toBe('[REDACTED_GITHUB_TOKEN]');
+        });
+        it('should redact multiple GitHub tokens in one string', () => {
+            const input = 'Token1: ghp_abc123456789012345678901234567890123 and Token2: gho_xyz123456789012345678901234567890123';
+            const result = (0, secrets_1.sanitizeSecrets)(input);
+            expect(result).toBe('Token1: [REDACTED_GITHUB_TOKEN] and Token2: [REDACTED_GITHUB_TOKEN]');
+        });
+    });
+    describe('GitLab tokens', () => {
+        it('should redact GitLab personal access tokens', () => {
+            const input = 'token: glpat-xxxxxxxxxxxxxxxxxxxx';
+            const result = (0, secrets_1.sanitizeSecrets)(input);
+            expect(result).toBe('token: [REDACTED]');
+        });
+        it('should redact GitLab tokens with hyphens and underscores', () => {
+            const input = 'glpat-abc_def-123_456_789_012_345';
+            const result = (0, secrets_1.sanitizeSecrets)(input);
+            expect(result).toBe('[REDACTED_GITLAB_TOKEN]');
+        });
+    });
+    describe('Bearer tokens', () => {
+        it('should redact Bearer tokens', () => {
+            const input = 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0';
+            const result = (0, secrets_1.sanitizeSecrets)(input);
+            expect(result).toBe('Authorization: Bearer [REDACTED]');
+        });
+        it('should redact Bearer tokens with padding', () => {
+            const input = 'Bearer abc123==';
+            const result = (0, secrets_1.sanitizeSecrets)(input);
+            expect(result).toBe('Bearer [REDACTED]');
+        });
+    });
+    describe('Basic auth', () => {
+        it('should redact Basic auth tokens', () => {
+            const input = 'Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ=';
+            const result = (0, secrets_1.sanitizeSecrets)(input);
+            expect(result).toBe('Authorization: Basic [REDACTED]');
+        });
+    });
+    describe('key-value patterns', () => {
+        it('should redact token in JSON format', () => {
+            const input = '{"token": "secret123"}';
+            const result = (0, secrets_1.sanitizeSecrets)(input);
+            expect(result).toContain('[REDACTED]');
+        });
+        it('should redact password in config', () => {
+            const input = 'password: mysecretpassword';
+            const result = (0, secrets_1.sanitizeSecrets)(input);
+            expect(result).toBe('password: [REDACTED]');
+        });
+        it('should redact api_key values', () => {
+            const input = 'api_key=sk-1234567890abcdefghij';
+            const result = (0, secrets_1.sanitizeSecrets)(input);
+            expect(result).toBe('api_key: [REDACTED]');
+        });
+        it('should redact secret values', () => {
+            const input = 'secret: "my_super_secret_value"';
+            const result = (0, secrets_1.sanitizeSecrets)(input);
+            expect(result).toBe('secret: [REDACTED]');
+        });
+        it('should redact access_token values', () => {
+            const input = 'access_token=abcdef123456';
+            const result = (0, secrets_1.sanitizeSecrets)(input);
+            expect(result).toBe('access_token: [REDACTED]');
+        });
+    });
+    describe('edge cases', () => {
+        it('should handle empty string', () => {
+            expect((0, secrets_1.sanitizeSecrets)('')).toBe('');
+        });
+        it('should handle string with no secrets', () => {
+            const input = 'This is a normal message with no secrets';
+            expect((0, secrets_1.sanitizeSecrets)(input)).toBe(input);
+        });
+        it('should handle very long strings', () => {
+            const longString = 'a'.repeat(10000) + 'ghp_' + 'b'.repeat(36) + 'c'.repeat(10000);
+            const result = (0, secrets_1.sanitizeSecrets)(longString);
+            expect(result).toContain('[REDACTED_GITHUB_TOKEN]');
+            expect(result).not.toContain('ghp_');
+        });
+        it('should handle strings with special characters', () => {
+            const input = 'token: ghp_abc123!@#$%^&*()_+-=[]{}|;:,.<>?';
+            const result = (0, secrets_1.sanitizeSecrets)(input);
+            expect(result).toContain('[REDACTED]');
+        });
+    });
+});
+describe('containsSecrets', () => {
+    it('should detect token keyword', () => {
+        expect((0, secrets_1.containsSecrets)('my token is here')).toBe(true);
+    });
+    it('should detect password keyword', () => {
+        expect((0, secrets_1.containsSecrets)('enter your password')).toBe(true);
+    });
+    it('should detect secret keyword', () => {
+        expect((0, secrets_1.containsSecrets)('this is a secret')).toBe(true);
+    });
+    it('should detect api_key keyword', () => {
+        expect((0, secrets_1.containsSecrets)('set your api_key')).toBe(true);
+    });
+    it('should detect api-key keyword', () => {
+        expect((0, secrets_1.containsSecrets)('set your api-key')).toBe(true);
+    });
+    it('should detect bearer keyword', () => {
+        expect((0, secrets_1.containsSecrets)('Bearer token required')).toBe(true);
+    });
+    it('should detect authorization keyword', () => {
+        expect((0, secrets_1.containsSecrets)('Authorization header')).toBe(true);
+    });
+    it('should detect GitHub token prefix', () => {
+        expect((0, secrets_1.containsSecrets)('ghp_token')).toBe(true);
+        expect((0, secrets_1.containsSecrets)('gho_token')).toBe(true);
+    });
+    it('should detect GitLab token prefix', () => {
+        expect((0, secrets_1.containsSecrets)('glpat-token')).toBe(true);
+    });
+    it('should return false for normal text', () => {
+        expect((0, secrets_1.containsSecrets)('hello world')).toBe(false);
+        expect((0, secrets_1.containsSecrets)('this is normal text')).toBe(false);
+    });
+    it('should be case insensitive', () => {
+        expect((0, secrets_1.containsSecrets)('TOKEN')).toBe(true);
+        expect((0, secrets_1.containsSecrets)('Password')).toBe(true);
+        expect((0, secrets_1.containsSecrets)('SECRET')).toBe(true);
+    });
+});
+describe('isSensitiveKey', () => {
+    it('should identify token keys', () => {
+        expect((0, secrets_1.isSensitiveKey)('token')).toBe(true);
+        expect((0, secrets_1.isSensitiveKey)('access_token')).toBe(true);
+        expect((0, secrets_1.isSensitiveKey)('refresh_token')).toBe(true);
+        expect((0, secrets_1.isSensitiveKey)('GITHUB_TOKEN')).toBe(true);
+    });
+    it('should identify key keys', () => {
+        expect((0, secrets_1.isSensitiveKey)('api_key')).toBe(true);
+        expect((0, secrets_1.isSensitiveKey)('apiKey')).toBe(true);
+        expect((0, secrets_1.isSensitiveKey)('private_key')).toBe(true);
+    });
+    it('should identify secret keys', () => {
+        expect((0, secrets_1.isSensitiveKey)('secret')).toBe(true);
+        expect((0, secrets_1.isSensitiveKey)('client_secret')).toBe(true);
+        expect((0, secrets_1.isSensitiveKey)('SECRET_KEY')).toBe(true);
+    });
+    it('should identify password keys', () => {
+        expect((0, secrets_1.isSensitiveKey)('password')).toBe(true);
+        expect((0, secrets_1.isSensitiveKey)('db_password')).toBe(true);
+        expect((0, secrets_1.isSensitiveKey)('PASSWORD')).toBe(true);
+    });
+    it('should identify auth keys', () => {
+        expect((0, secrets_1.isSensitiveKey)('auth')).toBe(true);
+        expect((0, secrets_1.isSensitiveKey)('authorization')).toBe(true);
+        expect((0, secrets_1.isSensitiveKey)('auth_token')).toBe(true);
+    });
+    it('should return false for non-sensitive keys', () => {
+        expect((0, secrets_1.isSensitiveKey)('name')).toBe(false);
+        expect((0, secrets_1.isSensitiveKey)('email')).toBe(false);
+        expect((0, secrets_1.isSensitiveKey)('description')).toBe(false);
+        expect((0, secrets_1.isSensitiveKey)('owner')).toBe(false);
+    });
+    it('should be case insensitive', () => {
+        expect((0, secrets_1.isSensitiveKey)('TOKEN')).toBe(true);
+        expect((0, secrets_1.isSensitiveKey)('Token')).toBe(true);
+        expect((0, secrets_1.isSensitiveKey)('tOkEn')).toBe(true);
+    });
+});
+describe('redactConfig', () => {
+    it('should redact top-level token values', () => {
+        const config = { token: 'secret123', owner: 'myorg' };
+        const result = (0, secrets_1.redactConfig)(config);
+        expect(result.token).toBe('********');
+        expect(result.owner).toBe('myorg');
+    });
+    it('should redact nested sensitive values', () => {
+        const config = {
+            github: {
+                token: 'ghp_secret',
+                owner: 'myorg',
+            },
+        };
+        const result = (0, secrets_1.redactConfig)(config);
+        expect(result.github.token).toBe('********');
+        expect(result.github.owner).toBe('myorg');
+    });
+    it('should redact deeply nested values', () => {
+        const config = {
+            level1: {
+                level2: {
+                    level3: {
+                        api_key: 'secret',
+                    },
+                },
+            },
+        };
+        const result = (0, secrets_1.redactConfig)(config);
+        expect(result.level1.level2.level3.api_key).toBe('********');
+    });
+    it('should preserve environment variable references', () => {
+        const config = { token: '${GITHUB_TOKEN}', secret: '${MY_SECRET}' };
+        const result = (0, secrets_1.redactConfig)(config);
+        expect(result.token).toBe('${GITHUB_TOKEN}');
+        expect(result.secret).toBe('${MY_SECRET}');
+    });
+    it('should not mutate original config', () => {
+        const original = { token: 'secret123' };
+        const originalToken = original.token;
+        (0, secrets_1.redactConfig)(original);
+        expect(original.token).toBe(originalToken);
+    });
+    it('should handle null and undefined', () => {
+        expect((0, secrets_1.redactConfig)(null)).toBe(null);
+        expect((0, secrets_1.redactConfig)(undefined)).toBe(undefined);
+    });
+    it('should handle arrays in config', () => {
+        const config = {
+            handlers: [{ token: 'secret1' }, { token: 'secret2' }],
+        };
+        const result = (0, secrets_1.redactConfig)(config);
+        expect(result.handlers[0].token).toBe('********');
+        expect(result.handlers[1].token).toBe('********');
+    });
+    it('should handle mixed content', () => {
+        const config = {
+            work: {
+                active_handler: 'github',
+                handlers: {
+                    github: {
+                        token: 'ghp_secret',
+                        owner: 'myorg',
+                        repo: 'myrepo',
+                    },
+                },
+            },
+            repo: {
+                defaults: {
+                    default_branch: 'main',
+                },
+            },
+        };
+        const result = (0, secrets_1.redactConfig)(config);
+        expect(result.work.handlers.github.token).toBe('********');
+        expect(result.work.handlers.github.owner).toBe('myorg');
+        expect(result.work.active_handler).toBe('github');
+        expect(result.repo.defaults.default_branch).toBe('main');
+    });
+});
+describe('redactValue', () => {
+    it('should redact value when key is sensitive', () => {
+        expect((0, secrets_1.redactValue)('secret123', 'token')).toBe('********');
+        expect((0, secrets_1.redactValue)('secret123', 'password')).toBe('********');
+        expect((0, secrets_1.redactValue)('secret123', 'api_key')).toBe('********');
+    });
+    it('should preserve env var references even with sensitive key', () => {
+        expect((0, secrets_1.redactValue)('${GITHUB_TOKEN}', 'token')).toBe('${GITHUB_TOKEN}');
+        expect((0, secrets_1.redactValue)('${DB_PASSWORD}', 'password')).toBe('${DB_PASSWORD}');
+    });
+    it('should redact GitHub tokens regardless of key', () => {
+        expect((0, secrets_1.redactValue)('ghp_1234567890abcdefghijklmnopqrstuvwxyz12')).toBe('[REDACTED_GITHUB_TOKEN]');
+    });
+    it('should redact GitLab tokens regardless of key', () => {
+        expect((0, secrets_1.redactValue)('glpat-xxxxxxxxxxxxxxxxxxxx')).toBe('[REDACTED_GITLAB_TOKEN]');
+    });
+    it('should return original value for non-sensitive content', () => {
+        expect((0, secrets_1.redactValue)('myorg', 'owner')).toBe('myorg');
+        expect((0, secrets_1.redactValue)('main', 'branch')).toBe('main');
+    });
+});
+describe('performance', () => {
+    it('should handle large strings efficiently', () => {
+        const largeString = 'x'.repeat(100000);
+        const start = Date.now();
+        (0, secrets_1.sanitizeSecrets)(largeString);
+        const elapsed = Date.now() - start;
+        // Should complete in under 100ms
+        expect(elapsed).toBeLessThan(100);
+    });
+    it('should handle many secrets efficiently', () => {
+        const manySecrets = Array(100)
+            .fill('token: ghp_1234567890abcdefghijklmnopqrstuvwxyz12')
+            .join('\n');
+        const start = Date.now();
+        const result = (0, secrets_1.sanitizeSecrets)(manySecrets);
+        const elapsed = Date.now() - start;
+        expect(elapsed).toBeLessThan(100);
+        expect(result).not.toContain('ghp_');
+    });
+});
+//# sourceMappingURL=secrets.test.js.map

package/dist/common/__tests__/secrets.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.test.js","sourceRoot":"","sources":["../../../src/common/__tests__/secrets.test.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;AAEH,wCAMoB;AAEpB,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;QAC7B,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;YAC5D,MAAM,KAAK,GAAG,mDAAmD,CAAC;YAClE,MAAM,MAAM,GAAG,IAAA,yBAAe,EAAC,KAAK,CAAC,CAAC;YACtC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;YAClD,MAAM,KAAK,GAAG,kDAAkD,CAAC;YACjE,MAAM,MAAM,GAAG,IAAA,yBAAe,EAAC,KAAK,CAAC,CAAC;YACtC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;YAC3D,MAAM,KAAK,GAAG,4CAA4C,CAAC;YAC3D,MAAM,MAAM,GAAG,IAAA,yBAAe,EAAC,KAAK,CAAC,CAAC;YACtC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;YAC7D,MAAM,KAAK,GAAG,4CAA4C,CAAC;YAC3D,MAAM,MAAM,GAAG,IAAA,yBAAe,EAAC,KAAK,CAAC,CAAC;YACtC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;YACpD,MAAM,KAAK,GAAG,4CAA4C,CAAC;YAC3D,MAAM,MAAM,GAAG,IAAA,yBAAe,EAAC,KAAK,CAAC,CAAC;YACtC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;YAC5D,MAAM,KAAK,GACT,uGAAuG,CAAC;YAC1G,MAAM,MAAM,GAAG,IAAA,yBAAe,EAAC,KAAK,CAAC,CAAC;YACtC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;QAC7F,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;QAC7B,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;YACrD,MAAM,KAAK,GAAG,mCAAmC,CAAC;YAClD,MAAM,MAAM,GAAG,IAAA,yBAAe,EAAC,KAAK,CAAC,CAAC;YACtC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;YAClE,MAAM,KAAK,GAAG,mCAAmC,CAAC;YAClD,MAAM,MAAM,GAAG,IAAA,yBAAe,EAAC,KAAK,CAAC,CAAC;YACtC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;QAC7B,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;YACrC,MAAM,KAAK,GAAG,wFAAwF,CAAC;YACvG,MAAM,MAAM,GAAG,IAAA,yBAAe,EAAC,KAAK,CAAC,CAAC;YACtC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;YAClD,MAAM,KAAK,GAAG,iBAAiB,CAAC;YAChC,MAAM,MAAM,GAAG,IAAA,yBAAe,EAAC,KAAK,CAAC,CAAC;YACtC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;QAC1B,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;YACzC,MAAM,KAAK,GAAG,+CAA+C,CAAC;YAC9D,MAAM,MAAM,GAAG,IAAA,yBAAe,EAAC,KAAK,CAAC,CAAC;YACtC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAClC,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;YAC5C,MAAM,KAAK,GAAG,wBAAwB,CAAC;YACvC,MAAM,MAAM,GAAG,IAAA,yBAAe,EAAC,KAAK,CAAC,CAAC;YACtC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;YAC1C,MAAM,KAAK,GAAG,4BAA4B,CAAC;YAC3C,MAAM,MAAM,GAAG,IAAA,yBAAe,EAAC,KAAK,CAAC,CAAC;YACtC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;YACtC,MAAM,KAAK,GAAG,iCAAiC,CAAC;YAChD,MAAM,MAAM,GAAG,IAAA,yBAAe,EAAC,KAAK,CAAC,CAAC;YACtC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;YACrC,MAAM,KAAK,GAAG,iCAAiC,CAAC;YAChD,MAAM,MAAM,GAAG,IAAA,yBAAe,EAAC,KAAK,CAAC,CAAC;YACtC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;YAC3C,MAAM,KAAK,GAAG,2BAA2B,CAAC;YAC1C,MAAM,MAAM,GAAG,IAAA,yBAAe,EAAC,KAAK,CAAC,CAAC;YACtC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;QAC1B,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;YACpC,MAAM,CAAC,IAAA,yBAAe,EAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;YAC9C,MAAM,KAAK,GAAG,0CAA0C,CAAC;YACzD,MAAM,CAAC,IAAA,yBAAe,EAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;YACzC,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnF,MAAM,MAAM,GAAG,IAAA,yBAAe,EAAC,UAAU,CAAC,CAAC;YAC3C,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;YACpD,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;YACvD,MAAM,KAAK,GAAG,6CAA6C,CAAC;YAC5D,MAAM,MAAM,GAAG,IAAA,yBAAe,EAAC,KAAK,CAAC,CAAC;YACtC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,CAAC,IAAA,yBAAe,EAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,CAAC,IAAA,yBAAe,EAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,CAAC,IAAA,yBAAe,EAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,IAAA,yBAAe,EAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,IAAA,yBAAe,EAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,CAAC,IAAA,yBAAe,EAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,IAAA,yBAAe,EAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,IAAA,yBAAe,EAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChD,MAAM,CAAC,IAAA,yBAAe,EAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,IAAA,yBAAe,EAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,IAAA,yBAAe,EAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,CAAC,IAAA,yBAAe,EAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,CAAC,IAAA,yBAAe,EAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,CAAC,IAAA,yBAAe,EAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,CAAC,IAAA,yBAAe,EAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,CAAC,IAAA,wBAAc,EAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAA,wBAAc,EAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,CAAC,IAAA,wBAAc,EAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,CAAC,IAAA,wBAAc,EAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;QAClC,MAAM,CAAC,IAAA,wBAAc,EAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,CAAC,IAAA,wBAAc,EAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,CAAC,IAAA,wBAAc,EAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,CAAC,IAAA,wBAAc,EAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,CAAC,IAAA,wBAAc,EAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,CAAC,IAAA,wBAAc,EAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,IAAA,wBAAc,EAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,CAAC,IAAA,wBAAc,EAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,CAAC,IAAA,wBAAc,EAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,CAAC,IAAA,wBAAc,EAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,CAAC,IAAA,wBAAc,EAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,CAAC,IAAA,wBAAc,EAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,IAAA,wBAAc,EAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAA,wBAAc,EAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,CAAC,IAAA,wBAAc,EAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,CAAC,IAAA,wBAAc,EAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,CAAC,IAAA,wBAAc,EAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAA,wBAAc,EAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAA,wBAAc,EAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QACtD,MAAM,MAAM,GAAG,IAAA,sBAAY,EAAC,MAAM,CAAkB,CAAC;QACrD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,MAAM,GAAG;YACb,MAAM,EAAE;gBACN,KAAK,EAAE,YAAY;gBACnB,KAAK,EAAE,OAAO;aACf;SACF,CAAC;QACF,MAAM,MAAM,GAAG,IAAA,sBAAY,EAAC,MAAM,CAAkB,CAAC;QACrD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,MAAM,GAAG;YACb,MAAM,EAAE;gBACN,MAAM,EAAE;oBACN,MAAM,EAAE;wBACN,OAAO,EAAE,QAAQ;qBAClB;iBACF;aACF;SACF,CAAC;QACF,MAAM,MAAM,GAAG,IAAA,sBAAY,EAAC,MAAM,CAAkB,CAAC;QACrD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QACpE,MAAM,MAAM,GAAG,IAAA,sBAAY,EAAC,MAAM,CAAkB,CAAC;QACrD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,QAAQ,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QACxC,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC;QACrC,IAAA,sBAAY,EAAC,QAAQ,CAAC,CAAC;QACvB,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,CAAC,IAAA,sBAAY,EAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,CAAC,IAAA,sBAAY,EAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,MAAM,GAAG;YACb,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;SACvD,CAAC;QACF,MAAM,MAAM,GAAG,IAAA,sBAAY,EAAC,MAAM,CAAkB,CAAC;QACrD,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAClD,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,MAAM,GAAG;YACb,IAAI,EAAE;gBACJ,cAAc,EAAE,QAAQ;gBACxB,QAAQ,EAAE;oBACR,MAAM,EAAE;wBACN,KAAK,EAAE,YAAY;wBACnB,KAAK,EAAE,OAAO;wBACd,IAAI,EAAE,QAAQ;qBACf;iBACF;aACF;YACD,IAAI,EAAE;gBACJ,QAAQ,EAAE;oBACR,cAAc,EAAE,MAAM;iBACvB;aACF;SACF,CAAC;QACF,MAAM,MAAM,GAAG,IAAA,sBAAY,EAAC,MAAM,CAAkB,CAAC;QACrD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC3D,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,IAAA,qBAAW,EAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC3D,MAAM,CAAC,IAAA,qBAAW,EAAC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9D,MAAM,CAAC,IAAA,qBAAW,EAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,CAAC,IAAA,qBAAW,EAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACxE,MAAM,CAAC,IAAA,qBAAW,EAAC,gBAAgB,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,CAAC,IAAA,qBAAW,EAAC,4CAA4C,CAAC,CAAC,CAAC,IAAI,CACpE,yBAAyB,CAC1B,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,CAAC,IAAA,qBAAW,EAAC,4BAA4B,CAAC,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,IAAA,qBAAW,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,CAAC,IAAA,qBAAW,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,IAAA,yBAAe,EAAC,WAAW,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QACnC,iCAAiC;QACjC,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC;aAC3B,IAAI,CAAC,mDAAmD,CAAC;aACzD,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,IAAA,yBAAe,EAAC,WAAW,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QACnC,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/common/config.d.ts

@@ -3,10 +3,8 @@
  *
  * Utilities for finding project roots and loading configuration.
  */
-/**
- * Find the project root directory by looking for common markers
- */
-export declare function findProjectRoot(startDir?: string): string;
+import { findProjectRoot as yamlFindProjectRoot } from './yaml-config';
+export { yamlFindProjectRoot as findProjectRoot };
 /**
  * Check if a directory is a git repository
  */
@@ -19,6 +17,10 @@ export declare function getFractaryDir(projectRoot?: string): string;
  * Ensure a directory exists
  */
 export declare function ensureDir(dirPath: string): void;
+/**
+ * Config loaders - extract plugin sections from unified YAML config
+ * Uses .fractary/core/config.yaml as the single source of truth
+ */
 /**
  * Load work plugin configuration from unified YAML
  */

package/dist/common/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/common/config.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,GAAE,MAAsB,GAAG,MAAM,CA2BxE;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAsB,GAAG,OAAO,CAGpE;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAG3D;AAED;;GAEG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAI/C;AASD;;GAEG;AACH,wBAAgB,cAAc,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,GAAG,GAAG,IAAI,CAG/D;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,GAAG,GAAG,IAAI,CAG/D;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,GAAG,GAAG,IAAI,CAG/D;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,GAAG,GAAG,IAAI,CAG9D;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,GAAG,GAAG,IAAI,CAG/D;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,GAAG,GAAG,IAAI,CAG/D"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/common/config.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,eAAe,IAAI,mBAAmB,EAAkB,MAAM,eAAe,CAAC;AAIvF,OAAO,EAAE,mBAAmB,IAAI,eAAe,EAAE,CAAC;AAElD;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAsB,GAAG,OAAO,CAGpE;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAG3D;AAED;;GAEG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAI/C;AAED;;;GAGG;AAEH;;GAEG;AACH,wBAAgB,cAAc,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,GAAG,GAAG,IAAI,CAG/D;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,GAAG,GAAG,IAAI,CAG/D;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,GAAG,GAAG,IAAI,CAG/D;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,GAAG,GAAG,IAAI,CAG9D;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,GAAG,GAAG,IAAI,CAG/D;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,GAAG,GAAG,IAAI,CAG/D"}

package/dist/common/config.js

@@ -38,7 +38,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.findProjectRoot = findProjectRoot;
+exports.findProjectRoot = void 0;
 exports.isGitRepository = isGitRepository;
 exports.getFractaryDir = getFractaryDir;
 exports.ensureDir = ensureDir;
@@ -50,33 +50,8 @@ exports.loadFileConfig = loadFileConfig;
 exports.loadDocsConfig = loadDocsConfig;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
-/**
- * Find the project root directory by looking for common markers
- */
-function findProjectRoot(startDir = process.cwd()) {
-    let currentDir = startDir;
-    // Common project root markers
-    const markers = [
-        'package.json',
-        '.git',
-        'tsconfig.json',
-        'pyproject.toml',
-        'setup.py',
-    ];
-    while (currentDir !== path.parse(currentDir).root) {
-        // Check if any marker exists in current directory
-        for (const marker of markers) {
-            const markerPath = path.join(currentDir, marker);
-            if (fs.existsSync(markerPath)) {
-                return currentDir;
-            }
-        }
-        // Move up one directory
-        currentDir = path.dirname(currentDir);
-    }
-    // If no marker found, return the starting directory
-    return startDir;
-}
+const yaml_config_1 = require("./yaml-config");
+Object.defineProperty(exports, "findProjectRoot", { enumerable: true, get: function () { return yaml_config_1.findProjectRoot; } });
 /**
  * Check if a directory is a git repository
  */
@@ -88,7 +63,7 @@ function isGitRepository(dir = process.cwd()) {
  * Get the .fractary directory path
  */
 function getFractaryDir(projectRoot) {
-    const root = projectRoot || findProjectRoot();
+    const root = projectRoot || (0, yaml_config_1.findProjectRoot)();
     return path.join(root, '.fractary');
 }
 /**
@@ -103,7 +78,6 @@ function ensureDir(dirPath) {
  * Config loaders - extract plugin sections from unified YAML config
  * Uses .fractary/core/config.yaml as the single source of truth
  */
-const yaml_config_1 = require("./yaml-config");
 /**
  * Load work plugin configuration from unified YAML
  */

package/dist/common/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/common/config.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAQH,0CA2BC;AAKD,0CAGC;AAKD,wCAGC;AAKD,8BAIC;AAYD,wCAGC;AAKD,wCAGC;AAKD,wCAGC;AAKD,sCAGC;AAKD,wCAGC;AAKD,wCAGC;AAjHD,uCAAyB;AACzB,2CAA6B;AAE7B;;GAEG;AACH,SAAgB,eAAe,CAAC,WAAmB,OAAO,CAAC,GAAG,EAAE;IAC9D,IAAI,UAAU,GAAG,QAAQ,CAAC;IAE1B,8BAA8B;IAC9B,MAAM,OAAO,GAAG;QACd,cAAc;QACd,MAAM;QACN,eAAe;QACf,gBAAgB;QAChB,UAAU;KACX,CAAC;IAEF,OAAO,UAAU,KAAK,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;QAClD,kDAAkD;QAClD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YACjD,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9B,OAAO,UAAU,CAAC;YACpB,CAAC;QACH,CAAC;QAED,wBAAwB;QACxB,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACxC,CAAC;IAED,oDAAoD;IACpD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,SAAgB,eAAe,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE;IACzD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACtC,OAAO,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,SAAgB,cAAc,CAAC,WAAoB;IACjD,MAAM,IAAI,GAAG,WAAW,IAAI,eAAe,EAAE,CAAC;IAC9C,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,SAAgB,SAAS,CAAC,OAAe;IACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED;;;GAGG;AAEH,+CAA+C;AAE/C;;GAEG;AACH,SAAgB,cAAc,CAAC,WAAoB;IACjD,MAAM,MAAM,GAAG,IAAA,4BAAc,EAAC,EAAE,WAAW,EAAE,CAAC,CAAC;IAC/C,OAAO,MAAM,EAAE,IAAI,IAAI,IAAI,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,SAAgB,cAAc,CAAC,WAAoB;IACjD,MAAM,MAAM,GAAG,IAAA,4BAAc,EAAC,EAAE,WAAW,EAAE,CAAC,CAAC;IAC/C,OAAO,MAAM,EAAE,IAAI,IAAI,IAAI,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,SAAgB,cAAc,CAAC,WAAoB;IACjD,MAAM,MAAM,GAAG,IAAA,4BAAc,EAAC,EAAE,WAAW,EAAE,CAAC,CAAC;IAC/C,OAAO,MAAM,EAAE,IAAI,IAAI,IAAI,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,SAAgB,aAAa,CAAC,WAAoB;IAChD,MAAM,MAAM,GAAG,IAAA,4BAAc,EAAC,EAAE,WAAW,EAAE,CAAC,CAAC;IAC/C,OAAO,MAAM,EAAE,IAAI,IAAI,IAAI,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,SAAgB,cAAc,CAAC,WAAoB;IACjD,MAAM,MAAM,GAAG,IAAA,4BAAc,EAAC,EAAE,WAAW,EAAE,CAAC,CAAC;IAC/C,OAAO,MAAM,EAAE,IAAI,IAAI,IAAI,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,SAAgB,cAAc,CAAC,WAAoB;IACjD,MAAM,MAAM,GAAG,IAAA,4BAAc,EAAC,EAAE,WAAW,EAAE,CAAC,CAAC;IAC/C,OAAO,MAAM,EAAE,IAAI,IAAI,IAAI,CAAC;AAC9B,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/common/config.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAaH,0CAGC;AAKD,wCAGC;AAKD,8BAIC;AAUD,wCAGC;AAKD,wCAGC;AAKD,wCAGC;AAKD,sCAGC;AAKD,wCAGC;AAKD,wCAGC;AApFD,uCAAyB;AACzB,2CAA6B;AAC7B,+CAAuF;AAIvD,gGAJJ,6BAAmB,OAIA;AAE/C;;GAEG;AACH,SAAgB,eAAe,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE;IACzD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACtC,OAAO,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,SAAgB,cAAc,CAAC,WAAoB;IACjD,MAAM,IAAI,GAAG,WAAW,IAAI,IAAA,6BAAmB,GAAE,CAAC;IAClD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,SAAgB,SAAS,CAAC,OAAe;IACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED;;;GAGG;AAEH;;GAEG;AACH,SAAgB,cAAc,CAAC,WAAoB;IACjD,MAAM,MAAM,GAAG,IAAA,4BAAc,EAAC,EAAE,WAAW,EAAE,CAAC,CAAC;IAC/C,OAAO,MAAM,EAAE,IAAI,IAAI,IAAI,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,SAAgB,cAAc,CAAC,WAAoB;IACjD,MAAM,MAAM,GAAG,IAAA,4BAAc,EAAC,EAAE,WAAW,EAAE,CAAC,CAAC;IAC/C,OAAO,MAAM,EAAE,IAAI,IAAI,IAAI,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,SAAgB,cAAc,CAAC,WAAoB;IACjD,MAAM,MAAM,GAAG,IAAA,4BAAc,EAAC,EAAE,WAAW,EAAE,CAAC,CAAC;IAC/C,OAAO,MAAM,EAAE,IAAI,IAAI,IAAI,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,SAAgB,aAAa,CAAC,WAAoB;IAChD,MAAM,MAAM,GAAG,IAAA,4BAAc,EAAC,EAAE,WAAW,EAAE,CAAC,CAAC;IAC/C,OAAO,MAAM,EAAE,IAAI,IAAI,IAAI,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,SAAgB,cAAc,CAAC,WAAoB;IACjD,MAAM,MAAM,GAAG,IAAA,4BAAc,EAAC,EAAE,WAAW,EAAE,CAAC,CAAC;IAC/C,OAAO,MAAM,EAAE,IAAI,IAAI,IAAI,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,SAAgB,cAAc,CAAC,WAAoB;IACjD,MAAM,MAAM,GAAG,IAAA,4BAAc,EAAC,EAAE,WAAW,EAAE,CAAC,CAAC;IAC/C,OAAO,MAAM,EAAE,IAAI,IAAI,IAAI,CAAC;AAC9B,CAAC"}

package/dist/common/index.d.ts

@@ -6,4 +6,5 @@
 export * from './types';
 export * from './errors';
 export * from './config';
+export * from './secrets';
 //# sourceMappingURL=index.d.ts.map

package/dist/common/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/common/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,SAAS,CAAC;AACxB,cAAc,UAAU,CAAC;AACzB,cAAc,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/common/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,SAAS,CAAC;AACxB,cAAc,UAAU,CAAC;AACzB,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC"}

package/dist/common/index.js

@@ -22,4 +22,5 @@ Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./types"), exports);
 __exportStar(require("./errors"), exports);
 __exportStar(require("./config"), exports);
+__exportStar(require("./secrets"), exports);
 //# sourceMappingURL=index.js.map

package/dist/common/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/common/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;;;;;;;;;;;;;;AAEH,0CAAwB;AACxB,2CAAyB;AACzB,2CAAyB"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/common/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;;;;;;;;;;;;;;AAEH,0CAAwB;AACxB,2CAAyB;AACzB,2CAAyB;AACzB,4CAA0B"}

package/dist/common/secrets.d.ts

@@ -0,0 +1,68 @@
+/**
+ * @fractary/core - Secrets Sanitization Utilities
+ *
+ * Unified utilities for redacting sensitive values from strings and objects.
+ * Used by CLI, MCP server, and other components to prevent token/secret exposure.
+ */
+/**
+ * Sanitize token/secret values from error messages and logs.
+ * Replaces common secret patterns with [REDACTED].
+ *
+ * @param message - Error message or log string
+ * @returns Sanitized message with secrets redacted
+ *
+ * @example
+ * ```typescript
+ * const safe = sanitizeSecrets('Failed with token ghp_abc123...');
+ * // Returns: 'Failed with token [REDACTED_GITHUB_TOKEN]'
+ * ```
+ */
+export declare function sanitizeSecrets(message: string): string;
+/**
+ * Check if a string contains potential security-sensitive information.
+ *
+ * @param value - String to check
+ * @returns True if string might contain secrets
+ *
+ * @example
+ * ```typescript
+ * containsSecrets('my api_key is xyz'); // true
+ * containsSecrets('hello world'); // false
+ * ```
+ */
+export declare function containsSecrets(value: string): boolean;
+/**
+ * Check if a key name indicates it holds a sensitive value.
+ *
+ * @param key - Key name to check
+ * @returns True if the key likely holds a secret
+ */
+export declare function isSensitiveKey(key: string): boolean;
+/**
+ * Redact sensitive values from a configuration object for display.
+ * Preserves environment variable references like `${GITHUB_TOKEN}`.
+ *
+ * @param config - Configuration object to redact
+ * @returns Deep copy with sensitive values redacted
+ *
+ * @example
+ * ```typescript
+ * const config = {
+ *   token: 'ghp_secret123',
+ *   owner: 'myorg',
+ *   nested: { api_key: 'abc123' }
+ * };
+ * const safe = redactConfig(config);
+ * // Returns: { token: '********', owner: 'myorg', nested: { api_key: '********' } }
+ * ```
+ */
+export declare function redactConfig(config: unknown): unknown;
+/**
+ * Redact a single value if it appears to be a secret.
+ *
+ * @param value - Value to potentially redact
+ * @param key - Optional key name for context-aware redaction
+ * @returns Redacted value or original value if not sensitive
+ */
+export declare function redactValue(value: string, key?: string): string;
+//# sourceMappingURL=secrets.d.ts.map

package/dist/common/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/common/secrets.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAqCH;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAgBvD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAatD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAGnD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAgCrD;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAmB/D"}

package/dist/common/secrets.js

@@ -0,0 +1,180 @@
+"use strict";
+/**
+ * @fractary/core - Secrets Sanitization Utilities
+ *
+ * Unified utilities for redacting sensitive values from strings and objects.
+ * Used by CLI, MCP server, and other components to prevent token/secret exposure.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sanitizeSecrets = sanitizeSecrets;
+exports.containsSecrets = containsSecrets;
+exports.isSensitiveKey = isSensitiveKey;
+exports.redactConfig = redactConfig;
+exports.redactValue = redactValue;
+/**
+ * Sensitive key names that should be redacted
+ */
+const SENSITIVE_KEYS = ['token', 'key', 'secret', 'password', 'api_key', 'apikey', 'auth'];
+/**
+ * Token patterns for detection and redaction
+ */
+const TOKEN_PATTERNS = {
+    // GitHub tokens (ghp_, gho_, ghs_, ghu_, ghr_)
+    github: /gh[posuhr]_[A-Za-z0-9]{36,}/gi,
+    // GitLab tokens
+    gitlab: /glpat-[A-Za-z0-9_\-]{20,}/gi,
+    // Bearer tokens
+    bearer: /Bearer\s+[A-Za-z0-9\-._~+/]+=*/gi,
+    // Basic auth
+    basic: /Basic\s+[A-Za-z0-9+/=]+/gi,
+    // Generic key-value patterns (JSON, env vars, config)
+    keyValue: /(token|key|password|secret|api[_-]?key|access[_-]?token|auth[_-]?token|bearer)["']?\s*[=:]\s*["']?[^\s"',}]+/gi,
+    // Generic API keys (long alphanumeric strings after common keywords)
+    genericKey: /(api[_-]?key|apikey|access[_-]?key)\s*[=:]\s*["']?[A-Za-z0-9\-._~+/]{20,}["']?/gi,
+};
+/**
+ * Redaction placeholders
+ */
+const REDACTED = {
+    default: '[REDACTED]',
+    github: '[REDACTED_GITHUB_TOKEN]',
+    gitlab: '[REDACTED_GITLAB_TOKEN]',
+    value: '********',
+};
+/**
+ * Sanitize token/secret values from error messages and logs.
+ * Replaces common secret patterns with [REDACTED].
+ *
+ * @param message - Error message or log string
+ * @returns Sanitized message with secrets redacted
+ *
+ * @example
+ * ```typescript
+ * const safe = sanitizeSecrets('Failed with token ghp_abc123...');
+ * // Returns: 'Failed with token [REDACTED_GITHUB_TOKEN]'
+ * ```
+ */
+function sanitizeSecrets(message) {
+    return (message
+        // Redact tokens in key-value patterns (JSON, env vars, config)
+        .replace(TOKEN_PATTERNS.keyValue, '$1: [REDACTED]')
+        // Redact bearer tokens
+        .replace(TOKEN_PATTERNS.bearer, 'Bearer [REDACTED]')
+        // Redact Basic auth
+        .replace(TOKEN_PATTERNS.basic, 'Basic [REDACTED]')
+        // Redact GitHub tokens (ghp_, gho_, ghs_, ghu_, ghr_)
+        .replace(TOKEN_PATTERNS.github, REDACTED.github)
+        // Redact GitLab tokens
+        .replace(TOKEN_PATTERNS.gitlab, REDACTED.gitlab)
+        // Redact generic API keys (long alphanumeric strings after common keywords)
+        .replace(TOKEN_PATTERNS.genericKey, '$1: [REDACTED]'));
+}
+/**
+ * Check if a string contains potential security-sensitive information.
+ *
+ * @param value - String to check
+ * @returns True if string might contain secrets
+ *
+ * @example
+ * ```typescript
+ * containsSecrets('my api_key is xyz'); // true
+ * containsSecrets('hello world'); // false
+ * ```
+ */
+function containsSecrets(value) {
+    const secretPatterns = [
+        /token/i,
+        /password/i,
+        /secret/i,
+        /api[_-]?key/i,
+        /bearer/i,
+        /authorization/i,
+        /gh[posuhr]_/,
+        /glpat-/,
+    ];
+    return secretPatterns.some((pattern) => pattern.test(value));
+}
+/**
+ * Check if a key name indicates it holds a sensitive value.
+ *
+ * @param key - Key name to check
+ * @returns True if the key likely holds a secret
+ */
+function isSensitiveKey(key) {
+    const lowerKey = key.toLowerCase();
+    return SENSITIVE_KEYS.some((sensitiveKey) => lowerKey.includes(sensitiveKey));
+}
+/**
+ * Redact sensitive values from a configuration object for display.
+ * Preserves environment variable references like `${GITHUB_TOKEN}`.
+ *
+ * @param config - Configuration object to redact
+ * @returns Deep copy with sensitive values redacted
+ *
+ * @example
+ * ```typescript
+ * const config = {
+ *   token: 'ghp_secret123',
+ *   owner: 'myorg',
+ *   nested: { api_key: 'abc123' }
+ * };
+ * const safe = redactConfig(config);
+ * // Returns: { token: '********', owner: 'myorg', nested: { api_key: '********' } }
+ * ```
+ */
+function redactConfig(config) {
+    if (!config)
+        return config;
+    // Deep clone to avoid mutating original
+    const redacted = JSON.parse(JSON.stringify(config));
+    function redactObject(obj) {
+        for (const key in obj) {
+            const value = obj[key];
+            if (typeof value === 'string') {
+                // Check if key indicates sensitive data
+                if (isSensitiveKey(key)) {
+                    // Preserve environment variable references
+                    if (value.includes('${')) {
+                        // Keep env var reference as-is
+                        continue;
+                    }
+                    // Redact actual values
+                    obj[key] = REDACTED.value;
+                }
+            }
+            else if (typeof value === 'object' && value !== null) {
+                redactObject(value);
+            }
+        }
+    }
+    if (typeof redacted === 'object' && redacted !== null) {
+        redactObject(redacted);
+    }
+    return redacted;
+}
+/**
+ * Redact a single value if it appears to be a secret.
+ *
+ * @param value - Value to potentially redact
+ * @param key - Optional key name for context-aware redaction
+ * @returns Redacted value or original value if not sensitive
+ */
+function redactValue(value, key) {
+    // If key suggests it's sensitive, redact
+    if (key && isSensitiveKey(key)) {
+        // Preserve env var references
+        if (value.includes('${')) {
+            return value;
+        }
+        return REDACTED.value;
+    }
+    // Check for known token patterns
+    if (TOKEN_PATTERNS.github.test(value)) {
+        return REDACTED.github;
+    }
+    if (TOKEN_PATTERNS.gitlab.test(value)) {
+        return REDACTED.gitlab;
+    }
+    return value;
+}
+//# sourceMappingURL=secrets.js.map

package/dist/common/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/common/secrets.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AAkDH,0CAgBC;AAcD,0CAaC;AAQD,wCAGC;AAoBD,oCAgCC;AASD,kCAmBC;AAtLD;;GAEG;AACH,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;AAE3F;;GAEG;AACH,MAAM,cAAc,GAAG;IACrB,+CAA+C;IAC/C,MAAM,EAAE,+BAA+B;IACvC,gBAAgB;IAChB,MAAM,EAAE,6BAA6B;IACrC,gBAAgB;IAChB,MAAM,EAAE,kCAAkC;IAC1C,aAAa;IACb,KAAK,EAAE,2BAA2B;IAClC,sDAAsD;IACtD,QAAQ,EACN,gHAAgH;IAClH,qEAAqE;IACrE,UAAU,EACR,kFAAkF;CACrF,CAAC;AAEF;;GAEG;AACH,MAAM,QAAQ,GAAG;IACf,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,yBAAyB;IACjC,MAAM,EAAE,yBAAyB;IACjC,KAAK,EAAE,UAAU;CAClB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,SAAgB,eAAe,CAAC,OAAe;IAC7C,OAAO,CACL,OAAO;QACL,+DAA+D;SAC9D,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,gBAAgB,CAAC;QACnD,uBAAuB;SACtB,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,mBAAmB,CAAC;QACpD,oBAAoB;SACnB,OAAO,CAAC,cAAc,CAAC,KAAK,EAAE,kBAAkB,CAAC;QAClD,sDAAsD;SACrD,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC;QAChD,uBAAuB;SACtB,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC;QAChD,4EAA4E;SAC3E,OAAO,CAAC,cAAc,CAAC,UAAU,EAAE,gBAAgB,CAAC,CACxD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAgB,eAAe,CAAC,KAAa;IAC3C,MAAM,cAAc,GAAG;QACrB,QAAQ;QACR,WAAW;QACX,SAAS;QACT,cAAc;QACd,SAAS;QACT,gBAAgB;QAChB,aAAa;QACb,QAAQ;KACT,CAAC;IAEF,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;GAKG;AACH,SAAgB,cAAc,CAAC,GAAW;IACxC,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IACnC,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;AAChF,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,YAAY,CAAC,MAAe;IAC1C,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IAE3B,wCAAwC;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAEpD,SAAS,YAAY,CAAC,GAA4B;QAChD,KAAK,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;YAEvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,wCAAwC;gBACxC,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxB,2CAA2C;oBAC3C,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;wBACzB,+BAA+B;wBAC/B,SAAS;oBACX,CAAC;oBACD,uBAAuB;oBACvB,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC;gBAC5B,CAAC;YACH,CAAC;iBAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACvD,YAAY,CAAC,KAAgC,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtD,YAAY,CAAC,QAAmC,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,WAAW,CAAC,KAAa,EAAE,GAAY;IACrD,yCAAyC;IACzC,IAAI,GAAG,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,8BAA8B;QAC9B,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,QAAQ,CAAC,KAAK,CAAC;IACxB,CAAC;IAED,iCAAiC;IACjC,IAAI,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,QAAQ,CAAC,MAAM,CAAC;IACzB,CAAC;IACD,IAAI,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,QAAQ,CAAC,MAAM,CAAC;IACzB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/package.json

@@ -1,17 +1,23 @@
 {
   "name": "@fractary/core",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Fractary Core SDK - Primitive operations for work tracking, repository management, specifications, logging, file storage, and documentation",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "typesVersions": {
     "*": {
+      "config": [
+        "dist/config/index.d.ts"
+      ],
       "common/config": [
         "dist/common/config.d.ts"
       ],
       "common/yaml-config": [
         "dist/common/yaml-config.d.ts"
       ],
+      "common/secrets": [
+        "dist/common/secrets.d.ts"
+      ],
       "work": [
         "dist/work/index.d.ts"
       ],
@@ -37,6 +43,10 @@
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
     },
+    "./config": {
+      "types": "./dist/config/index.d.ts",
+      "default": "./dist/config/index.js"
+    },
     "./work": {
       "types": "./dist/work/index.d.ts",
       "default": "./dist/work/index.js"
@@ -68,6 +78,10 @@
     "./common/config": {
       "types": "./dist/common/config.d.ts",
       "default": "./dist/common/config.js"
+    },
+    "./common/secrets": {
+      "types": "./dist/common/secrets.d.ts",
+      "default": "./dist/common/secrets.js"
     }
   },
   "files": [