@hawkeyexl/manni 4.10.0 → 4.12.0

package/dist/{chunk-7Y3N4Y72.js → chunk-OHUDZRLK.js}

@@ -6,10 +6,10 @@ import {
   shortPin,
   shortSrc,
   spellAt
-} from "./chunk-RZVCWX5R.js";
+} from "./chunk-AYVKN3PG.js";
 import {
   parseSrc
-} from "./chunk-PK7EKJ5T.js";
+} from "./chunk-24AJK2RG.js";
 import {
   palette
 } from "./chunk-RNVYGWIC.js";
@@ -452,4 +452,4 @@ export {
   removalLine,
   renderRemovePretty
 };
-//# sourceMappingURL=chunk-7Y3N4Y72.js.map
+//# sourceMappingURL=chunk-OHUDZRLK.js.map

package/dist/{chunk-GCKHSBEN.js → chunk-OKMTUAWO.js}

@@ -6,7 +6,7 @@ import {
 import {
   JEV,
   JEV_OUT_OF_LOOP
-} from "./chunk-NGTVREIH.js";
+} from "./chunk-U6IHLEWT.js";
 import {
   TracevalsError
 } from "./chunk-UKZNLVJW.js";
@@ -20,10 +20,10 @@ import {
   FAMILY_CONFIG_NAMES,
   findConfigFileSync,
   readConfigFileSync
-} from "./chunk-6M5VJOC2.js";
+} from "./chunk-OTJOBZJ5.js";
 import {
   assertKnownProvider
-} from "./chunk-QCHVR4ZM.js";
+} from "./chunk-VM7VAFJW.js";
 import {
   errorMessage
 } from "./chunk-G3T47CFV.js";
@@ -532,4 +532,4 @@ export {
   discoverConfig,
   loadConfig
 };
-//# sourceMappingURL=chunk-GCKHSBEN.js.map
+//# sourceMappingURL=chunk-OKMTUAWO.js.map

package/dist/{chunk-6M5VJOC2.js → chunk-OTJOBZJ5.js}

@@ -5,137 +5,11 @@ import {
 import {
   PROVIDERS_KEY,
   parseProviders
-} from "./chunk-QCHVR4ZM.js";
+} from "./chunk-VM7VAFJW.js";
 import {
   errorMessage
 } from "./chunk-G3T47CFV.js";
 
-// src/shared/encryption.ts
-import {
-  createCipheriv,
-  createDecipheriv,
-  createHmac,
-  hkdfSync,
-  randomBytes,
-  timingSafeEqual
-} from "node:crypto";
-import { TextDecoder } from "node:util";
-var ENCRYPTED_VALUE = /^~[A-Za-z0-9_-]{82,}$/;
-function isEncryptedValue(value) {
-  return typeof value === "string" && ENCRYPTED_VALUE.test(value);
-}
-var ENCRYPTION_KEY_SHAPE = /^[A-Za-z0-9_-]{32,}$/;
-function isValidEncryptionKey(value) {
-  return typeof value === "string" && ENCRYPTION_KEY_SHAPE.test(value);
-}
-function generateEncryptionKey() {
-  return randomBytes(32).toString("hex");
-}
-var VERSION = 1;
-var NONCE_BYTES = 12;
-var TAG_BYTES = 16;
-var BLOCK = 32;
-var MIN_BYTES = 1 + NONCE_BYTES + BLOCK + TAG_BYTES;
-var subkeyCache = /* @__PURE__ */ new Map();
-function subkeys(key) {
-  const cached = subkeyCache.get(key);
-  if (cached !== void 0) return cached;
-  const ikm = Buffer.from(key, "utf8");
-  const derive = (info) => Buffer.from(hkdfSync("sha256", ikm, Buffer.alloc(0), info, 32));
-  const made = {
-    encrypt: derive("manni/v1/encrypt"),
-    nonce: derive("manni/v1/nonce"),
-    pin: derive("manni/v1/pin")
-  };
-  subkeyCache.set(key, made);
-  return made;
-}
-function requireKey(key, caller) {
-  if (!isValidEncryptionKey(key)) {
-    throw new Error(
-      `${caller}: the key must be at least 32 hex or base64url characters.`
-    );
-  }
-}
-function pad(data) {
-  const out = Buffer.alloc((Math.floor(data.length / BLOCK) + 1) * BLOCK);
-  data.copy(out);
-  out[data.length] = 128;
-  return out;
-}
-function unpad(padded) {
-  let i = padded.length - 1;
-  while (i >= 0 && padded[i] === 0) i--;
-  if (i < 0 || padded[i] !== 128) return null;
-  if (padded.length !== (Math.floor(i / BLOCK) + 1) * BLOCK) return null;
-  return padded.subarray(0, i);
-}
-function nonceFor(keys, context, padded) {
-  return createHmac("sha256", keys.nonce).update(context).update(Buffer.from([0])).update(padded).digest().subarray(0, NONCE_BYTES);
-}
-function aad(context) {
-  return Buffer.concat([Buffer.from([VERSION]), context]);
-}
-function encryptValue(value, key, context) {
-  requireKey(key, "encryptValue");
-  const json = JSON.stringify(value);
-  if (json === void 0) {
-    throw new TypeError("encryptValue: the value is not JSON.");
-  }
-  const keys = subkeys(key);
-  const ctx = Buffer.from(context, "utf8");
-  const padded = pad(Buffer.from(json, "utf8"));
-  const nonce = nonceFor(keys, ctx, padded);
-  const cipher = createCipheriv("aes-256-gcm", keys.encrypt, nonce, {
-    authTagLength: TAG_BYTES
-  });
-  cipher.setAAD(aad(ctx));
-  const sealed = Buffer.concat([cipher.update(padded), cipher.final()]);
-  const tag = cipher.getAuthTag();
-  const bytes = Buffer.concat([Buffer.from([VERSION]), nonce, sealed, tag]);
-  return `~${bytes.toString("base64url")}`;
-}
-var FAILED = { ok: false };
-function decryptValue(token, key, context) {
-  try {
-    return open(token, key, context);
-  } catch {
-    return FAILED;
-  }
-}
-function open(token, key, context) {
-  if (!isEncryptedValue(token) || !isValidEncryptionKey(key)) return FAILED;
-  const body = token.slice(1);
-  const bytes = Buffer.from(body, "base64url");
-  if (bytes.toString("base64url") !== body) return FAILED;
-  if (bytes.length < MIN_BYTES) return FAILED;
-  if ((bytes.length - 1 - NONCE_BYTES - TAG_BYTES) % BLOCK !== 0) return FAILED;
-  if (bytes[0] !== VERSION) return FAILED;
-  const nonce = bytes.subarray(1, 1 + NONCE_BYTES);
-  const sealed = bytes.subarray(1 + NONCE_BYTES, bytes.length - TAG_BYTES);
-  const tag = bytes.subarray(bytes.length - TAG_BYTES);
-  const keys = subkeys(key);
-  const ctx = Buffer.from(context, "utf8");
-  const decipher = createDecipheriv("aes-256-gcm", keys.encrypt, nonce, {
-    authTagLength: TAG_BYTES
-  });
-  decipher.setAAD(aad(ctx));
-  decipher.setAuthTag(tag);
-  const padded = Buffer.concat([decipher.update(sealed), decipher.final()]);
-  if (!timingSafeEqual(nonceFor(keys, ctx, padded), nonce)) return FAILED;
-  const data = unpad(padded);
-  if (data === null) return FAILED;
-  const json = new TextDecoder("utf-8", { fatal: true }).decode(data);
-  const value = JSON.parse(json);
-  return { ok: true, value };
-}
-var KEYED_PIN_PREFIX = "hmac-sha256-";
-function keyedPin(text, key) {
-  requireKey(key, "keyedPin");
-  const mac = createHmac("sha256", subkeys(key).pin).update(text, "utf8").digest("hex");
-  return `${KEYED_PIN_PREFIX}${mac}`;
-}
-
 // src/shared/collections.ts
 import picomatch2 from "picomatch";
 
@@ -593,11 +467,135 @@ function isGlob(entry) {
   return picomatch2.scan(entry).isGlob;
 }
 
+// src/shared/encryption.ts
+import {
+  createCipheriv,
+  createDecipheriv,
+  createHmac,
+  hkdfSync,
+  randomBytes,
+  timingSafeEqual
+} from "node:crypto";
+import { TextDecoder } from "node:util";
+var ENCRYPTED_VALUE = /^~[A-Za-z0-9_-]{82,}$/;
+function isEncryptedValue(value) {
+  return typeof value === "string" && ENCRYPTED_VALUE.test(value);
+}
+var ENCRYPTION_KEY_SHAPE = /^[A-Za-z0-9_-]{32,}$/;
+function isValidEncryptionKey(value) {
+  return typeof value === "string" && ENCRYPTION_KEY_SHAPE.test(value);
+}
+function generateEncryptionKey() {
+  return randomBytes(32).toString("hex");
+}
+var VERSION = 1;
+var NONCE_BYTES = 12;
+var TAG_BYTES = 16;
+var BLOCK = 32;
+var MIN_BYTES = 1 + NONCE_BYTES + BLOCK + TAG_BYTES;
+var subkeyCache = /* @__PURE__ */ new Map();
+function subkeys(key) {
+  const cached = subkeyCache.get(key);
+  if (cached !== void 0) return cached;
+  const ikm = Buffer.from(key, "utf8");
+  const derive = (info) => Buffer.from(hkdfSync("sha256", ikm, Buffer.alloc(0), info, 32));
+  const made = {
+    encrypt: derive("manni/v1/encrypt"),
+    nonce: derive("manni/v1/nonce"),
+    pin: derive("manni/v1/pin")
+  };
+  subkeyCache.set(key, made);
+  return made;
+}
+function requireKey(key, caller) {
+  if (!isValidEncryptionKey(key)) {
+    throw new Error(
+      `${caller}: the key must be at least 32 hex or base64url characters.`
+    );
+  }
+}
+function pad(data) {
+  const out = Buffer.alloc((Math.floor(data.length / BLOCK) + 1) * BLOCK);
+  data.copy(out);
+  out[data.length] = 128;
+  return out;
+}
+function unpad(padded) {
+  let i = padded.length - 1;
+  while (i >= 0 && padded[i] === 0) i--;
+  if (i < 0 || padded[i] !== 128) return null;
+  if (padded.length !== (Math.floor(i / BLOCK) + 1) * BLOCK) return null;
+  return padded.subarray(0, i);
+}
+function nonceFor(keys, context, padded) {
+  return createHmac("sha256", keys.nonce).update(context).update(Buffer.from([0])).update(padded).digest().subarray(0, NONCE_BYTES);
+}
+function aad(context) {
+  return Buffer.concat([Buffer.from([VERSION]), context]);
+}
+function encryptValue(value, key, context) {
+  requireKey(key, "encryptValue");
+  const json = JSON.stringify(value);
+  if (json === void 0) {
+    throw new TypeError("encryptValue: the value is not JSON.");
+  }
+  const keys = subkeys(key);
+  const ctx = Buffer.from(context, "utf8");
+  const padded = pad(Buffer.from(json, "utf8"));
+  const nonce = nonceFor(keys, ctx, padded);
+  const cipher = createCipheriv("aes-256-gcm", keys.encrypt, nonce, {
+    authTagLength: TAG_BYTES
+  });
+  cipher.setAAD(aad(ctx));
+  const sealed = Buffer.concat([cipher.update(padded), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  const bytes = Buffer.concat([Buffer.from([VERSION]), nonce, sealed, tag]);
+  return `~${bytes.toString("base64url")}`;
+}
+var FAILED = { ok: false };
+function decryptValue(token, key, context) {
+  try {
+    return open(token, key, context);
+  } catch {
+    return FAILED;
+  }
+}
+function open(token, key, context) {
+  if (!isEncryptedValue(token) || !isValidEncryptionKey(key)) return FAILED;
+  const body = token.slice(1);
+  const bytes = Buffer.from(body, "base64url");
+  if (bytes.toString("base64url") !== body) return FAILED;
+  if (bytes.length < MIN_BYTES) return FAILED;
+  if ((bytes.length - 1 - NONCE_BYTES - TAG_BYTES) % BLOCK !== 0) return FAILED;
+  if (bytes[0] !== VERSION) return FAILED;
+  const nonce = bytes.subarray(1, 1 + NONCE_BYTES);
+  const sealed = bytes.subarray(1 + NONCE_BYTES, bytes.length - TAG_BYTES);
+  const tag = bytes.subarray(bytes.length - TAG_BYTES);
+  const keys = subkeys(key);
+  const ctx = Buffer.from(context, "utf8");
+  const decipher = createDecipheriv("aes-256-gcm", keys.encrypt, nonce, {
+    authTagLength: TAG_BYTES
+  });
+  decipher.setAAD(aad(ctx));
+  decipher.setAuthTag(tag);
+  const padded = Buffer.concat([decipher.update(sealed), decipher.final()]);
+  if (!timingSafeEqual(nonceFor(keys, ctx, padded), nonce)) return FAILED;
+  const data = unpad(padded);
+  if (data === null) return FAILED;
+  const json = new TextDecoder("utf-8", { fatal: true }).decode(data);
+  const value = JSON.parse(json);
+  return { ok: true, value };
+}
+var KEYED_PIN_PREFIX = "hmac-sha256-";
+function keyedPin(text, key) {
+  requireKey(key, "keyedPin");
+  const mac = createHmac("sha256", subkeys(key).pin).update(text, "utf8").digest("hex");
+  return `${KEYED_PIN_PREFIX}${mac}`;
+}
+
 // src/shared/tools.ts
 import { isAbsolute as isAbsolute2, resolve as resolve2 } from "node:path";
-var TOOL_KEYS = ["vale", "dita-ot"];
-var VALE_KEYS = ["config"];
-var DITA_OT_KEYS = ["home"];
+var TOOL_KEYS = ["vale", "dita-ot", "doc-detective"];
 function isMapping2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -618,52 +616,54 @@ function parseTools(raw, source, toError) {
   rejectUnknownKeys2(raw, TOOL_KEYS, "tools", source, toError);
   const tools = {};
   if (Object.hasOwn(raw, "vale")) {
-    tools.vale = parseVale(raw["vale"], source, toError);
+    tools.vale = parseStringKey(raw["vale"], "vale", "config", source, toError);
   }
   if (Object.hasOwn(raw, "dita-ot")) {
-    tools["dita-ot"] = parseDitaOt(raw["dita-ot"], source, toError);
+    tools["dita-ot"] = parseStringKey(raw["dita-ot"], "dita-ot", "home", source, toError);
+  }
+  if (Object.hasOwn(raw, "doc-detective")) {
+    tools["doc-detective"] = parseStringKey(
+      raw["doc-detective"],
+      "doc-detective",
+      "config",
+      source,
+      toError
+    );
   }
   return tools;
 }
-function parseVale(raw, source, toError) {
+function parseStringKey(raw, tool, key, source, toError) {
   if (!isMapping2(raw)) {
-    throw toError(`${source}: tools.vale must be a mapping.`);
+    throw toError(`${source}: tools.${tool} must be a mapping.`);
   }
-  rejectUnknownKeys2(raw, VALE_KEYS, "tools.vale", source, toError);
-  const vale = {};
-  if (Object.hasOwn(raw, "config")) {
-    const config = raw["config"];
-    if (typeof config !== "string" || config.trim() === "") {
-      throw toError(`${source}: tools.vale.config must be a non-empty string.`);
+  rejectUnknownKeys2(raw, [key], `tools.${tool}`, source, toError);
+  const out = {};
+  if (Object.hasOwn(raw, key)) {
+    const value = raw[key];
+    if (typeof value !== "string" || value.trim() === "") {
+      throw toError(`${source}: tools.${tool}.${key} must be a non-empty string.`);
     }
-    vale.config = config;
+    out[key] = value;
   }
-  return vale;
+  return out;
 }
-function parseDitaOt(raw, source, toError) {
-  if (!isMapping2(raw)) {
-    throw toError(`${source}: tools.dita-ot must be a mapping.`);
-  }
-  rejectUnknownKeys2(raw, DITA_OT_KEYS, "tools.dita-ot", source, toError);
-  const ditaOt = {};
-  if (Object.hasOwn(raw, "home")) {
-    const home = raw["home"];
-    if (typeof home !== "string" || home.trim() === "") {
-      throw toError(`${source}: tools.dita-ot.home must be a non-empty string.`);
-    }
-    ditaOt.home = home;
-  }
-  return ditaOt;
+function fromConfigDir(path, configDir) {
+  return isAbsolute2(path) ? path : resolve2(configDir, path);
 }
 function valeConfigPath(tools, configDir) {
   const config = tools.vale?.config;
   if (config === void 0) return void 0;
-  return isAbsolute2(config) ? config : resolve2(configDir, config);
+  return fromConfigDir(config, configDir);
 }
 function ditaOtHome(tools, configDir) {
   const home = tools["dita-ot"]?.home;
   if (home === void 0) return void 0;
-  return isAbsolute2(home) ? home : resolve2(configDir, home);
+  return fromConfigDir(home, configDir);
+}
+function docDetectiveConfigPath(tools, configDir) {
+  const config = tools["doc-detective"]?.config;
+  if (config === void 0) return void 0;
+  return fromConfigDir(config, configDir);
 }
 
 // src/shared/config-file.ts
@@ -930,13 +930,6 @@ function readFamilyConfigFileSync(explicitPath, cwd, toError) {
 }
 
 export {
-  isEncryptedValue,
-  isValidEncryptionKey,
-  generateEncryptionKey,
-  encryptValue,
-  decryptValue,
-  KEYED_PIN_PREFIX,
-  keyedPin,
   matchesFileGlob,
   PAGE_PLACEHOLDER,
   hasPagePlaceholder,
@@ -951,10 +944,18 @@ export {
   selectCollections,
   isMember,
   matchesCollectionPaths,
+  isEncryptedValue,
+  isValidEncryptionKey,
+  generateEncryptionKey,
+  encryptValue,
+  decryptValue,
+  KEYED_PIN_PREFIX,
+  keyedPin,
   findGitRoot,
   searchPath,
   valeConfigPath,
   ditaOtHome,
+  docDetectiveConfigPath,
   FAMILY_CONFIG_NAMES,
   ENCRYPTION_KEY_FIELD,
   ENCRYPTION_KEY_PREVIOUS_FIELD,
@@ -965,4 +966,4 @@ export {
   findFamilyConfigFile,
   readFamilyConfigFile
 };
-//# sourceMappingURL=chunk-6M5VJOC2.js.map
+//# sourceMappingURL=chunk-OTJOBZJ5.js.map