@guardbee/mcp-prompt-leak-scanner 0.1.0

package/README.md

@@ -0,0 +1,146 @@
+# @guardbee/mcp-prompt-leak-scanner
+
+**🇬🇧 English** | [🇹🇷 Türkçe](TR.md)
+
+An MCP (Model Context Protocol) server — and a standalone reverse proxy — that catches leaked credentials and PII in **outbound** LLM prompts, before they leave your application.
+
+`secret-scanner` finds secrets sitting in your codebase. This package finds secrets and PII that made it into a *runtime prompt* — a support agent that pastes a customer's ticket (email, card number) straight into a system prompt, a debugging session where someone pastes an API key into a chat, an internal tool that forwards raw user input to an LLM without ever checking what's in it. That's a different moment in the pipeline, and a different failure mode than a leaked `.env` file.
+
+> This package sends usage telemetry by default (tool name + short parameters, prompt content and audit findings are never included — see [`@guardbee/mcp-telemetry`](../telemetry/README.md)). Disable with `GUARDBEE_TELEMETRY=0`.
+
+```
+Your app ──► prompt-leak-scanner (proxy) ──► Real LLM API (OpenAI/Anthropic/...)
+                    │
+                    ├─ monitor: forward unchanged, log findings
+                    ├─ redact:  forward with matches replaced by [REDACTED:<id>]
+                    └─ block:   reject the request before it ever reaches the model
+```
+
+---
+
+## Two ways to use it
+
+**1. On-demand scanning (MCP tools)** — `scan_text`/`scan_messages`/`scan_file`/`scan_directory`. Ask Claude to check a prompt, a chat-request-body fixture, or a directory of prompt logs before you ship something that builds prompts from user input.
+
+**2. A live reverse proxy (`proxy` CLI command)** — sits between your application and the real LLM API. It buffers and inspects only the **outbound request body** (message/system text), then streams the upstream response straight back unmodified — so SSE/streaming completions pass through untouched; only the prompt going *out* is ever parsed. Point your app's `baseURL` at the proxy instead of the real API and nothing else in your integration needs to change.
+
+```bash
+guardbee-prompt-leak-scanner proxy --upstream=https://api.openai.com --port=8788 --mode=redact
+# your app: baseURL = http://localhost:8788 instead of https://api.openai.com
+```
+
+---
+
+## Detection quality: checksums, not just regex
+
+A bare regex for "11 digits" or "16 digits" would flag order numbers, phone extensions, and timestamps constantly. Every PII pattern that has a real checksum algorithm uses it:
+
+- **TC Kimlik No** — the actual 11-digit Turkish national ID checksum algorithm (not just a digit-count regex)
+- **Credit card numbers** — Luhn checksum
+- **IBAN** — ISO 7064 MOD97-10 checksum
+
+A random 11-digit number has roughly a 1-in-10 chance of passing the TC Kimlik checksum by coincidence — regex alone would be far noisier. Credential patterns (API keys, JWTs, private keys) are matched against real provider-specific prefixes/structure (`sk-`, `AKIA`, `ghp_`, `-----BEGIN...PRIVATE KEY-----`, JWT's three-segment base64url shape), the same low-false-positive approach `secret-scanner` uses.
+
+**Findings never echo the real value.** A finding's `maskedMatch` shows only the first 3 and last 2 characters (`sk-…wx`) — logging or displaying the very thing you just caught would defeat the point. The proxy's audit events go further: they record which pattern fired and where, never the matched text itself.
+
+---
+
+## Features
+
+- **13 patterns, 4 categories**: credential (9), financial-pii (2, checksum-validated), national-id (1, checksum-validated), contact-pii (2)
+- **Chat-body aware** — understands OpenAI/Anthropic-style `messages[].content` (string or content-block array) and `system` fields, not just flat text
+- **Live reverse-proxy mode** with monitor/redact/block policies — request-only inspection, response streamed through untouched
+- Masked findings and credential-free audit events — the tool never becomes a second copy of the leak
+- SARIF 2.1.0 output — CI/CD integration (GitHub Code Scanning, etc.)
+- Config file support via `guardbee.yml`
+- 29 unit tests — checksum validators verified against known-good/known-bad test vectors, proxy tested against a real local HTTP client/server round trip (not just in-process mocks) in all three modes
+
+---
+
+## Quick Start
+
+### Claude Desktop / MCP Client
+
+```json
+{
+  "mcpServers": {
+    "guardbee-prompt-leak-scanner": {
+      "command": "npx",
+      "args": ["-y", "@guardbee/mcp-prompt-leak-scanner"]
+    }
+  }
+}
+```
+
+### CLI (CI/CD)
+
+```bash
+npx @guardbee/mcp-prompt-leak-scanner scan ./prompt-fixtures --fail-on=high --format=sarif > results.sarif
+```
+
+### CLI (live proxy)
+
+```bash
+npx @guardbee/mcp-prompt-leak-scanner proxy --upstream=https://api.openai.com --mode=block --fail-on-severity=critical
+```
+
+---
+
+## MCP Tools
+
+| Tool | Description |
+|------|----------|
+| `scan_text` | Scans a raw text string |
+| `scan_messages` | Scans an OpenAI/Anthropic-style chat request body object |
+| `scan_file` | Scans a single file (plain text, or a JSON request-body fixture — auto-detected) |
+| `scan_directory` | Recursively scans a directory of prompt logs/fixtures |
+| `list_patterns` | Lists all supported patterns by category |
+
+---
+
+## Detected Patterns
+
+| Category | Pattern | Severity |
+|---|---|---|
+| credential | OpenAI / Anthropic / Google / Stripe API key, AWS access key ID, GitHub PAT, Slack token, PEM private key block | critical |
+| credential | JWT | high |
+| financial-pii | Credit card number (Luhn-validated) | high |
+| financial-pii | IBAN (mod-97 validated) | high |
+| national-id | TC Kimlik No (checksum-validated) | high |
+| contact-pii | Email address | medium |
+| contact-pii | Turkish phone number | medium |
+
+---
+
+## Configuration (`guardbee.yml`)
+
+```yaml
+prompt-leak-scanner:
+  fail-on: high       # any | critical | high | medium | low | none
+  max-files: 5000
+  exclude:
+    - "fixtures/known-safe/"
+```
+
+---
+
+## Limitations (by design)
+
+- The proxy only inspects the **request** body; it does not parse or modify streaming SSE responses — those are piped through untouched.
+- Only `messages[].content` (string or `{type:"text"}` content blocks) and top-level `system` are extracted from a chat body; provider-specific fields outside that shape aren't scanned.
+- This is pattern/checksum-based detection, not a general-purpose NER/PII model — it won't catch PII that doesn't match a known structural pattern (e.g. a name or street address in free text).
+
+---
+
+## Development
+
+```bash
+npm run build
+npm test             # 29 unit tests
+```
+
+---
+
+## License
+
+MIT — [GuardBee](https://guardbee.ai)

package/TR.md

@@ -0,0 +1,146 @@
+# @guardbee/mcp-prompt-leak-scanner
+
+[🇬🇧 English](README.md) | **🇹🇷 Türkçe**
+
+MCP (Model Context Protocol) sunucusu — ve bağımsız bir reverse proxy — **outbound** LLM prompt'larındaki sızmış credential ve PII'yi, uygulamanızdan çıkmadan önce yakalar.
+
+`secret-scanner` kod tabanınızda duran sırları bulur. Bu paket ise bir *runtime prompt*'a giren sır ve PII'yi bulur — bir müşteri destek agent'ının bir ticket'ı (email, kart no) doğrudan system prompt'a yapıştırması, birinin debug sırasında bir chat'e API key yapıştırması, ham kullanıcı girdisini hiç kontrol etmeden LLM'e ileten bir internal tool. Bu, pipeline'da farklı bir an ve sızmış bir `.env` dosyasından farklı bir hata modu.
+
+> Bu paket varsayılan olarak kullanım telemetrisi gönderir (tool adı + kısa parametreler, prompt içeriği ve audit bulguları hiçbir zaman dahil değil — bkz. [`@guardbee/mcp-telemetry`](../telemetry/TR.md)). Kapatmak için `GUARDBEE_TELEMETRY=0`.
+
+```
+Uygulamanız ──► prompt-leak-scanner (proxy) ──► Gerçek LLM API (OpenAI/Anthropic/...)
+                    │
+                    ├─ monitor: değiştirmeden ilet, bulguları logla
+                    ├─ redact:  eşleşmeleri [REDACTED:<id>] ile değiştirip ilet
+                    └─ block:   isteği modele hiç ulaşmadan reddet
+```
+
+---
+
+## İki kullanım şekli
+
+**1. Talep üzerine tarama (MCP tool'ları)** — `scan_text`/`scan_messages`/`scan_file`/`scan_directory`. Kullanıcı girdisinden prompt oluşturan bir şeyi shipping'lemeden önce Claude'a bir prompt'u, bir chat-request-body fixture'ını ya da bir prompt log dizinini kontrol ettirin.
+
+**2. Canlı bir reverse proxy (`proxy` CLI komutu)** — uygulamanızla gerçek LLM API arasına oturur. Sadece **outbound request body**'yi (message/system metni) buffer'layıp inceler, sonra upstream response'u değiştirmeden doğrudan geri stream eder — yani SSE/streaming completion'lar dokunulmadan geçer; sadece dışarı giden prompt hiç parse edilir. Uygulamanızın `baseURL`'ini gerçek API yerine proxy'ye yönlendirin, entegrasyonunuzda başka hiçbir şeyin değişmesi gerekmiyor.
+
+```bash
+guardbee-prompt-leak-scanner proxy --upstream=https://api.openai.com --port=8788 --mode=redact
+# uygulamanız: baseURL = http://localhost:8788 (https://api.openai.com yerine)
+```
+
+---
+
+## Tespit kalitesi: sadece regex değil, checksum
+
+"11 hane" ya da "16 hane" için çıplak bir regex sipariş numaralarını, telefon dahili hatlarını, timestamp'leri sürekli işaretlerdi. Gerçek bir checksum algoritması olan her PII kalıbı onu kullanıyor:
+
+- **TC Kimlik No** — gerçek 11 haneli Türkiye kimlik checksum algoritması (sadece hane-sayısı regex'i değil)
+- **Kredi kartı numaraları** — Luhn checksum
+- **IBAN** — ISO 7064 MOD97-10 checksum
+
+Rastgele 11 haneli bir sayının TC Kimlik checksum'ını tesadüfen geçme ihtimali kabaca 10'da 1 — tek başına regex çok daha gürültülü olurdu. Credential kalıpları (API key, JWT, private key) gerçek sağlayıcıya-özgü prefix/yapılara karşı eşleştiriliyor (`sk-`, `AKIA`, `ghp_`, `-----BEGIN...PRIVATE KEY-----`, JWT'nin üç-segmentli base64url şekli) — `secret-scanner`'ın kullandığı aynı düşük-yanlış-pozitif yaklaşım.
+
+**Bulgular gerçek değeri asla tam göstermez.** Bir bulgunun `maskedMatch`'i sadece ilk 3 ve son 2 karakteri gösterir (`sk-…wx`) — az önce yakaladığınız şeyi loglamak ya da göstermek amacı boşa çıkarırdı. Proxy'nin audit event'leri daha da ileri gider: hangi kalıbın tetiklendiğini ve nerede olduğunu kaydeder, eşleşen metni asla değil.
+
+---
+
+## Özellikler
+
+- **13 kalıp, 4 kategori**: credential (9), financial-pii (2, checksum-validated), national-id (1, checksum-validated), contact-pii (2)
+- **Chat-body farkında** — OpenAI/Anthropic tarzı `messages[].content`'i (string ya da content-block array) ve `system` alanlarını anlıyor, sadece düz metni değil
+- monitor/redact/block politikalarıyla **canlı reverse-proxy modu** — sadece request inceleniyor, response dokunulmadan stream ediliyor
+- Maskelenmiş bulgular ve credential-içermeyen audit event'leri — araç sızıntının ikinci bir kopyası haline gelmiyor
+- SARIF 2.1.0 çıktısı — CI/CD entegrasyonu (GitHub Code Scanning vb.)
+- `guardbee.yml` ile config dosyası desteği
+- 29 unit test — checksum doğrulayıcıları bilinen-geçerli/bilinen-geçersiz test vektörlerine karşı doğrulandı, proxy her üç modda gerçek bir lokal HTTP client/server round trip'ine karşı (sadece in-process mock değil) test edildi
+
+---
+
+## Hızlı Başlangıç
+
+### Claude Desktop / MCP Client
+
+```json
+{
+  "mcpServers": {
+    "guardbee-prompt-leak-scanner": {
+      "command": "npx",
+      "args": ["-y", "@guardbee/mcp-prompt-leak-scanner"]
+    }
+  }
+}
+```
+
+### CLI (CI/CD)
+
+```bash
+npx @guardbee/mcp-prompt-leak-scanner scan ./prompt-fixtures --fail-on=high --format=sarif > results.sarif
+```
+
+### CLI (canlı proxy)
+
+```bash
+npx @guardbee/mcp-prompt-leak-scanner proxy --upstream=https://api.openai.com --mode=block --fail-on-severity=critical
+```
+
+---
+
+## MCP Tools
+
+| Tool | Açıklama |
+|------|----------|
+| `scan_text` | Ham bir metin string'ini tarar |
+| `scan_messages` | OpenAI/Anthropic tarzı bir chat request body objesini tarar |
+| `scan_file` | Tek bir dosyayı tarar (düz metin, ya da bir JSON request-body fixture'ı — otomatik tespit edilir) |
+| `scan_directory` | Bir prompt log/fixture dizinini recursive tarar |
+| `list_patterns` | Desteklenen tüm kalıpları kategoriye göre listeler |
+
+---
+
+## Tespit Edilen Kalıplar
+
+| Kategori | Kalıp | Önem |
+|---|---|---|
+| credential | OpenAI / Anthropic / Google / Stripe API key, AWS access key ID, GitHub PAT, Slack token, PEM private key block | critical |
+| credential | JWT | high |
+| financial-pii | Kredi kartı numarası (Luhn-validated) | high |
+| financial-pii | IBAN (mod-97 validated) | high |
+| national-id | TC Kimlik No (checksum-validated) | high |
+| contact-pii | Email adresi | medium |
+| contact-pii | Türkiye telefon numarası | medium |
+
+---
+
+## Yapılandırma (`guardbee.yml`)
+
+```yaml
+prompt-leak-scanner:
+  fail-on: high       # any | critical | high | medium | low | none
+  max-files: 5000
+  exclude:
+    - "fixtures/known-safe/"
+```
+
+---
+
+## Kısıtlamalar (bilinçli tasarım)
+
+- Proxy sadece **request** body'sini inceler; streaming SSE response'ları parse etmez ya da değiştirmez — bunlar dokunulmadan geçer.
+- Bir chat body'sinden sadece `messages[].content` (string ya da `{type:"text"}` content block'ları) ve üst-seviye `system` çıkarılır; bu şeklin dışındaki sağlayıcıya-özgü alanlar taranmaz.
+- Bu kalıp/checksum tabanlı bir tespit, genel amaçlı bir NER/PII modeli değil — bilinen yapısal bir kalıpla eşleşmeyen PII'yi (örn. serbest metindeki bir isim ya da adres) yakalamaz.
+
+---
+
+## Geliştirme
+
+```bash
+npm run build
+npm test             # 29 unit test
+```
+
+---
+
+## Lisans
+
+MIT — [GuardBee](https://guardbee.ai)

package/dist/__tests__/proxy.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=proxy.test.d.ts.map

package/dist/__tests__/proxy.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/proxy.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/proxy.test.js

@@ -0,0 +1,107 @@
+import { describe, it, expect, afterEach } from "vitest";
+import { createServer } from "http";
+import { startProxy } from "../proxy.js";
+let proxyServer;
+let upstreamServer;
+afterEach(async () => {
+    if (proxyServer)
+        await new Promise((r) => proxyServer.close(r));
+    if (upstreamServer)
+        await new Promise((r) => upstreamServer.close(r));
+    proxyServer = undefined;
+    upstreamServer = undefined;
+});
+function startMockUpstream() {
+    const receivedBodies = [];
+    return new Promise((resolve) => {
+        upstreamServer = createServer((req, res) => {
+            const chunks = [];
+            req.on("data", (c) => chunks.push(c));
+            req.on("end", () => {
+                receivedBodies.push(Buffer.concat(chunks).toString("utf8"));
+                res.writeHead(200, { "content-type": "application/json" });
+                res.end(JSON.stringify({ ok: true, echoPath: req.url }));
+            });
+        });
+        upstreamServer.listen(0, "127.0.0.1", () => resolve({ port: upstreamServer.address().port, receivedBodies }));
+    });
+}
+function postJson(port, path, body) {
+    return fetch(`http://127.0.0.1:${port}${path}`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(body),
+    }).then(async (res) => ({ status: res.status, json: await res.json() }));
+}
+function freePort() {
+    return new Promise((resolve) => {
+        const probe = createServer();
+        probe.listen(0, "127.0.0.1", () => {
+            const port = probe.address().port;
+            probe.close(() => resolve(port));
+        });
+    });
+}
+describe("startProxy — monitor mode", () => {
+    it("temiz bir body'yi değiştirmeden upstream'e iletir", async () => {
+        const { port: upstreamPort, receivedBodies } = await startMockUpstream();
+        const proxyPort = await freePort();
+        const audits = [];
+        proxyServer = startProxy({ port: proxyPort, upstream: `http://127.0.0.1:${upstreamPort}`, mode: "monitor", onAudit: (e) => audits.push(e) });
+        const body = { messages: [{ role: "user", content: "hello there" }] };
+        const { status } = await postJson(proxyPort, "/v1/chat/completions", body);
+        expect(status).toBe(200);
+        expect(JSON.parse(receivedBodies[0])).toEqual(body);
+        expect(audits[0]).toMatchObject({ blocked: false, findingCount: 0 });
+    });
+    it("secret içeren bir body'yi DEĞİŞTİRMEDEN iletir (monitor sadece loglar)", async () => {
+        const { port: upstreamPort, receivedBodies } = await startMockUpstream();
+        const proxyPort = await freePort();
+        const audits = [];
+        proxyServer = startProxy({ port: proxyPort, upstream: `http://127.0.0.1:${upstreamPort}`, mode: "monitor", onAudit: (e) => audits.push(e) });
+        const body = { messages: [{ role: "user", content: "my key is sk-abcdefghijklmnopqrstuvwx" }] };
+        await postJson(proxyPort, "/v1/chat/completions", body);
+        expect(JSON.parse(receivedBodies[0])).toEqual(body);
+        expect(audits[0]).toMatchObject({ findingCount: 1 });
+        expect(audits[0].findingCodes).toContain("openai_api_key");
+    });
+    it("audit event ham secret değerini içermez", async () => {
+        const { port: upstreamPort } = await startMockUpstream();
+        const proxyPort = await freePort();
+        const audits = [];
+        proxyServer = startProxy({ port: proxyPort, upstream: `http://127.0.0.1:${upstreamPort}`, mode: "monitor", onAudit: (e) => audits.push(e) });
+        await postJson(proxyPort, "/v1/chat/completions", { messages: [{ role: "user", content: "my key is sk-abcdefghijklmnopqrstuvwx" }] });
+        const serialized = JSON.stringify(audits[0]);
+        expect(serialized).not.toContain("sk-abcdefghijklmnopqrstuvwx");
+    });
+});
+describe("startProxy — redact mode", () => {
+    it("secret içeren body'yi redakte edilmiş haliyle upstream'e iletir", async () => {
+        const { port: upstreamPort, receivedBodies } = await startMockUpstream();
+        const proxyPort = await freePort();
+        proxyServer = startProxy({ port: proxyPort, upstream: `http://127.0.0.1:${upstreamPort}`, mode: "redact" });
+        await postJson(proxyPort, "/v1/chat/completions", { messages: [{ role: "user", content: "my key is sk-abcdefghijklmnopqrstuvwx" }] });
+        const forwarded = JSON.parse(receivedBodies[0]);
+        expect(forwarded.messages[0].content).toBe("my key is [REDACTED:openai_api_key]");
+    });
+});
+describe("startProxy — block mode", () => {
+    it("critical bulgu varsa isteği upstream'e hiç iletmeden 400 döner", async () => {
+        const { port: upstreamPort, receivedBodies } = await startMockUpstream();
+        const proxyPort = await freePort();
+        proxyServer = startProxy({ port: proxyPort, upstream: `http://127.0.0.1:${upstreamPort}`, mode: "block", failOnSeverity: "high" });
+        const { status, json } = await postJson(proxyPort, "/v1/chat/completions", { messages: [{ role: "user", content: "my key is sk-abcdefghijklmnopqrstuvwx" }] });
+        expect(status).toBe(400);
+        expect(json.error).toBe("blocked_by_guardbee_prompt_leak_scanner");
+        expect(receivedBodies).toHaveLength(0);
+    });
+    it("temiz bir body'yi normal şekilde iletir", async () => {
+        const { port: upstreamPort, receivedBodies } = await startMockUpstream();
+        const proxyPort = await freePort();
+        proxyServer = startProxy({ port: proxyPort, upstream: `http://127.0.0.1:${upstreamPort}`, mode: "block" });
+        const { status } = await postJson(proxyPort, "/v1/chat/completions", { messages: [{ role: "user", content: "hello" }] });
+        expect(status).toBe(200);
+        expect(receivedBodies).toHaveLength(1);
+    });
+});
+//# sourceMappingURL=proxy.test.js.map

package/dist/__tests__/proxy.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.test.js","sourceRoot":"","sources":["../../src/__tests__/proxy.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,YAAY,EAAe,MAAM,MAAM,CAAC;AACjD,OAAO,EAAE,UAAU,EAAmB,MAAM,aAAa,CAAC;AAE1D,IAAI,WAA+B,CAAC;AACpC,IAAI,cAAkC,CAAC;AAEvC,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,IAAI,WAAW;QAAE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,IAAI,cAAc;QAAE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,WAAW,GAAG,SAAS,CAAC;IACxB,cAAc,GAAG,SAAS,CAAC;AAC7B,CAAC,CAAC,CAAC;AAEH,SAAS,iBAAiB;IACxB,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,cAAc,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACzC,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACtC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC5D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC3D,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,cAAc,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAG,cAAe,CAAC,OAAO,EAAuB,CAAC,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;IACvI,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,IAAY,EAAE,IAAa;IACzD,OAAO,KAAK,CAAC,oBAAoB,IAAI,GAAG,IAAI,EAAE,EAAE;QAC9C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,QAAQ;IACf,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;QAC7B,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YAChC,MAAM,IAAI,GAAI,KAAK,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;YACxD,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,cAAc,EAAE,GAAG,MAAM,iBAAiB,EAAE,CAAC;QACzE,MAAM,SAAS,GAAG,MAAM,QAAQ,EAAE,CAAC;QACnC,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,WAAW,GAAG,UAAU,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,oBAAoB,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAE7I,MAAM,IAAI,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;QACtE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,sBAAsB,EAAE,IAAI,CAAC,CAAC;QAE3E,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,cAAc,EAAE,GAAG,MAAM,iBAAiB,EAAE,CAAC;QACzE,MAAM,SAAS,GAAG,MAAM,QAAQ,EAAE,CAAC;QACnC,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,WAAW,GAAG,UAAU,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,oBAAoB,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAE7I,MAAM,IAAI,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,EAAE,CAAC;QAChG,MAAM,QAAQ,CAAC,SAAS,EAAE,sBAAsB,EAAE,IAAI,CAAC,CAAC;QAExD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC,CAAC;QACrD,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,MAAM,iBAAiB,EAAE,CAAC;QACzD,MAAM,SAAS,GAAG,MAAM,QAAQ,EAAE,CAAC;QACnC,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,WAAW,GAAG,UAAU,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,oBAAoB,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAE7I,MAAM,QAAQ,CAAC,SAAS,EAAE,sBAAsB,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,EAAE,CAAC,CAAC;QAEtI,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7C,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,6BAA6B,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,cAAc,EAAE,GAAG,MAAM,iBAAiB,EAAE,CAAC;QACzE,MAAM,SAAS,GAAG,MAAM,QAAQ,EAAE,CAAC;QACnC,WAAW,GAAG,UAAU,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,oBAAoB,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QAE5G,MAAM,QAAQ,CAAC,SAAS,EAAE,sBAAsB,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,EAAE,CAAC,CAAC;QAEtI,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;QAChD,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,cAAc,EAAE,GAAG,MAAM,iBAAiB,EAAE,CAAC;QACzE,MAAM,SAAS,GAAG,MAAM,QAAQ,EAAE,CAAC;QACnC,WAAW,GAAG,UAAU,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,oBAAoB,YAAY,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC;QAEnI,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,sBAAsB,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,EAAE,CAAC,CAAC;QAE/J,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,CAAE,IAA0B,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;QAC1F,MAAM,CAAC,cAAc,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,cAAc,EAAE,GAAG,MAAM,iBAAiB,EAAE,CAAC;QACzE,MAAM,SAAS,GAAG,MAAM,QAAQ,EAAE,CAAC;QACnC,WAAW,GAAG,UAAU,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,oBAAoB,YAAY,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAE3G,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,sBAAsB,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QAEzH,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,CAAC,cAAc,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/scanner.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=scanner.test.d.ts.map

package/dist/__tests__/scanner.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/scanner.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/scanner.test.js

@@ -0,0 +1,111 @@
+import { describe, it, expect } from "vitest";
+import { scanText, scanAndRedactText, scanBody, redactBody } from "../scanner.js";
+function idsOf(text) {
+    return scanText(text).map((f) => f.patternId);
+}
+describe("scanText — credentials", () => {
+    it("yakalar: OpenAI API key", () => {
+        expect(idsOf(`My key is sk-abcdefghijklmnopqrstuvwx and here is the prompt`)).toContain("openai_api_key");
+    });
+    it("yakalar: Anthropic API key", () => {
+        expect(idsOf(`key: sk-ant-abcdefghijklmnopqrstuvwx`)).toContain("anthropic_api_key");
+    });
+    it("yakalar: AWS access key ID", () => {
+        expect(idsOf(`AKIAIOSFODNN7EXAMPLE is the access key`)).toContain("aws_access_key_id");
+    });
+    it("yakalar: PEM private key block", () => {
+        expect(idsOf(`-----BEGIN RSA PRIVATE KEY-----\nMIIExyz...`)).toContain("private_key_block");
+    });
+    it("yakalar: JWT", () => {
+        const jwt = "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dQw4w9WgXcQ_abcdefghij";
+        expect(idsOf(`Authorization: Bearer ${jwt}`)).toContain("jwt_token");
+    });
+    it("normal metinde credential yakalamaz", () => {
+        expect(idsOf(`Please summarize this document for me.`)).toHaveLength(0);
+    });
+});
+describe("scanText — tc_kimlik_no (checksum-validated)", () => {
+    it("geçerli bir TC Kimlik No'yu yakalar", () => {
+        // 10000000146 gerçek algoritmayı sağlayan bilinen bir test değeri
+        expect(idsOf(`Müşteri TC: 10000000146`)).toContain("tc_kimlik_no");
+    });
+    it("checksum'ı geçersiz 11 haneli bir sayıyı yakalamaz", () => {
+        expect(idsOf(`Sipariş numarası: 12345678901`)).not.toContain("tc_kimlik_no");
+    });
+    it("0 ile başlayan 11 haneli bir sayıyı yakalamaz", () => {
+        expect(idsOf(`Kod: 01234567890`)).not.toContain("tc_kimlik_no");
+    });
+});
+describe("scanText — credit_card_number (Luhn-validated)", () => {
+    it("geçerli (Luhn) bir kart numarasını yakalar", () => {
+        expect(idsOf(`Card: 4532015112830366`)).toContain("credit_card_number");
+    });
+    it("Luhn'u geçmeyen 16 haneli bir sayıyı yakalamaz", () => {
+        expect(idsOf(`Reference: 1234567890123456`)).not.toContain("credit_card_number");
+    });
+});
+describe("scanText — iban (mod-97 validated)", () => {
+    it("geçerli bir IBAN'ı yakalar", () => {
+        expect(idsOf(`IBAN: TR330006100519786457841326`)).toContain("iban");
+    });
+    it("checksum'ı bozuk bir IBAN benzeri stringi yakalamaz", () => {
+        expect(idsOf(`Code: TR330006100519786457841327`)).not.toContain("iban");
+    });
+});
+describe("scanText — contact PII", () => {
+    it("yakalar: email", () => {
+        expect(idsOf(`Contact me at jane.doe@example.com`)).toContain("email_address");
+    });
+    it("yakalar: Türkiye telefon numarası", () => {
+        expect(idsOf(`Beni ara: 0532 123 45 67`)).toContain("turkish_phone_number");
+    });
+});
+describe("scanText — masking", () => {
+    it("maskedMatch gerçek değeri asla tam göstermez", () => {
+        const findings = scanText(`sk-abcdefghijklmnopqrstuvwx`);
+        expect(findings[0].maskedMatch).not.toBe("sk-abcdefghijklmnopqrstuvwx");
+        expect(findings[0].maskedMatch).toContain("…");
+    });
+});
+describe("scanAndRedactText", () => {
+    it("bulunan değeri [REDACTED:id] ile değiştirir", () => {
+        const { findings, redactedText } = scanAndRedactText(`My key is sk-abcdefghijklmnopqrstuvwx, thanks`);
+        expect(findings).toHaveLength(1);
+        expect(redactedText).toBe(`My key is [REDACTED:openai_api_key], thanks`);
+    });
+    it("birden fazla bulguyu doğru sırayla redakte eder", () => {
+        const { redactedText } = scanAndRedactText(`email jane@example.com and key sk-abcdefghijklmnopqrstuvwx`);
+        expect(redactedText).toBe(`email [REDACTED:email_address] and key [REDACTED:openai_api_key]`);
+    });
+});
+describe("scanBody — chat message extraction", () => {
+    it("messages[].content string alanındaki bulguyu location ile birlikte döner", () => {
+        const body = { messages: [{ role: "user", content: "my key is sk-abcdefghijklmnopqrstuvwx" }] };
+        const { findings } = scanBody(body);
+        expect(findings[0]).toMatchObject({ patternId: "openai_api_key", location: "messages[0].content" });
+    });
+    it("system alanındaki bulguyu yakalar", () => {
+        const body = { system: "user email is jane@example.com", messages: [] };
+        const { findings } = scanBody(body);
+        expect(findings[0]).toMatchObject({ patternId: "email_address", location: "system" });
+    });
+    it("content-block array formundaki text alanını tarar", () => {
+        const body = { messages: [{ role: "user", content: [{ type: "text", text: "key sk-abcdefghijklmnopqrstuvwx" }] }] };
+        const { findings } = scanBody(body);
+        expect(findings[0]).toMatchObject({ location: "messages[0].content[0].text" });
+    });
+    it("temiz bir body'de bulgu döndürmez", () => {
+        const body = { messages: [{ role: "user", content: "What's the weather like today?" }] };
+        expect(scanBody(body).findings).toHaveLength(0);
+    });
+});
+describe("redactBody", () => {
+    it("body'yi in-place redakte eder ve orijinal referansı döner", () => {
+        const body = { messages: [{ role: "user", content: "my key is sk-abcdefghijklmnopqrstuvwx" }] };
+        const { findings, redactedBody } = redactBody(body);
+        expect(findings).toHaveLength(1);
+        expect(redactedBody).toBe(body); // aynı obje referansı, in-place mutasyon
+        expect(body.messages[0].content).toBe("my key is [REDACTED:openai_api_key]");
+    });
+});
+//# sourceMappingURL=scanner.test.js.map

package/dist/__tests__/scanner.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.test.js","sourceRoot":"","sources":["../../src/__tests__/scanner.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAElF,SAAS,KAAK,CAAC,IAAY;IACzB,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAChD,CAAC;AAED,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,CAAC,KAAK,CAAC,8DAA8D,CAAC,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAC5G,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;IACvF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;IACzF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;IAC9F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,cAAc,EAAE,GAAG,EAAE;QACtB,MAAM,GAAG,GAAG,yEAAyE,CAAC;QACtF,MAAM,CAAC,KAAK,CAAC,yBAAyB,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,8CAA8C,EAAE,GAAG,EAAE;IAC5D,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,kEAAkE;QAClE,MAAM,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gDAAgD,EAAE,GAAG,EAAE;IAC9D,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;IAClD,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,gBAAgB,EAAE,GAAG,EAAE;QACxB,MAAM,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,QAAQ,GAAG,QAAQ,CAAC,6BAA6B,CAAC,CAAC;QACzD,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QACxE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,iBAAiB,CAAC,+CAA+C,CAAC,CAAC;QACtG,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,EAAE,YAAY,EAAE,GAAG,iBAAiB,CAAC,4DAA4D,CAAC,CAAC;QACzG,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;IAChG,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;IAClD,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,MAAM,IAAI,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,EAAE,CAAC;QAChG,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,gBAAgB,EAAE,QAAQ,EAAE,qBAAqB,EAAE,CAAC,CAAC;IACtG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,gCAAgC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QACxE,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,IAAI,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;QACpH,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,6BAA6B,EAAE,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,IAAI,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC,EAAE,CAAC;QACzF,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,IAAI,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,EAAE,CAAC;QAChG,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,yCAAyC;QAC1E,MAAM,CAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAyB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IACxG,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":""}