@mnemonik/shared 7.97.2 → 7.98.0

package/dist/secretPatterns.js

@@ -2,26 +2,26 @@
  * Single source of truth for secret-redaction patterns.
  *
  * Used by:
- * - packages/shared CodeScanner — scrubs chunk content before computing
+ * - packages/shared CodeScanner - scrubs chunk content before computing
  *   contentHash, so daemon ships scrubbed content (correct hash for
  *   server-side cache dedup).
- * - server /api/v1/scan/push handler — re-applies scrub as defense in
- *   depth (idempotent — already-scrubbed content stays the same), so
+ * - server /api/v1/scan/push handler - re-applies scrub as defense in
+ *   depth (idempotent - already-scrubbed content stays the same), so
  *   older daemons or compromised daemons can't leak secrets through us.
- * - server GitMiner — scrubs commit messages before storing as memories.
+ * - server GitMiner - scrubs commit messages before storing as memories.
  *
  * Patterns target high-confidence credential shapes:
  *   1. key=value style: api_key, secret, token, password, credential, auth
  *   2. Stripe-style sk_live_/pk_test_ keys
  *   3. GitHub personal access tokens (ghp_ prefix, exact 36 chars)
  *   4. GitLab personal access tokens (glpat- prefix, 20+ chars)
- *   5. PEM private keys — whole block, header through footer
+ *   5. PEM private keys - whole block, header through footer
  *   6. Provider prefixes: AWS (AKIA/ASIA + labeled secret key), JWT,
  *      Slack (xox*), Google (AIza), Anthropic (sk-ant-), npm (npm_/npms_)
  *   7. Credentials inside scheme://user:pass@host connection strings
  *   8. Authorization: Bearer headers
  *   9. Standalone high-entropy tokens matching no known prefix
- *      (`redactHighEntropyTokens` — heavily guarded, see below)
+ *      (`redactHighEntropyTokens` - heavily guarded, see below)
  *
  * False-positive cost: a few legitimate strings get replaced with the
  * placeholder. False-negative cost: a credential ships to the server and
@@ -32,10 +32,10 @@
  * FIDELITY IS A PEER CONCERN, NOT A ROUNDING ERROR. Over-scrubbing is the
  * same class of failure as under-scrubbing: a pattern that eats prose,
  * identifiers, hashes or paths silently blinds doc-truth's authority
- * extractors — exactly what happened when a `process.env.X` read was
+ * extractors - exactly what happened when a `process.env.X` read was
  * redacted as if it were a literal (see ENV_READ_VALUE_RE below). Every
  * pattern here carries positive AND negative tests in
- * tests/SecretPatterns.test.ts, and the entropy detector is additionally
+ * tests/SecretPatterns.test.ts, and the entropy detector is also
  * guarded against hashes, UUIDs, paths, slugs and identifiers.
  */
 export const SECRET_REDACTION_PLACEHOLDER = '[REDACTED]';
@@ -43,7 +43,7 @@ export const SECRET_REDACTION_PLACEHOLDER = '[REDACTED]';
 export const SECRET_PATTERNS = [
     /(?:api[_-]?key|secret|token|password|credential|auth)\s*[:=]\s*\S+/gi,
     // Stripe-shape: (sk|pk)_(live|test)_<24+ alphanumerics>. Catches modern
-    // Stripe keys whose body is split by an environment underscore that
+    // Stripe keys whose body is split by an environment separator that
     // breaks the contiguous-alphanum pattern below. Required `live|test`
     // literal prevents false-positives on snake_case identifiers like
     // pkg_install_helper_function_xyz_abc_def.
@@ -51,7 +51,7 @@ export const SECRET_PATTERNS = [
     /(?:sk|pk)[-_][a-zA-Z0-9]{20,}/g,
     /ghp_[a-zA-Z0-9]{36}/g,
     /glpat-[a-zA-Z0-9-]{20,}/g,
-    // PEM private keys. The BLOCK pattern runs first so header→footer (the
+    // PEM private keys. The BLOCK pattern runs first so header->footer (the
     // actual key material) is redacted as one unit; the header-only pattern
     // stays as the fallback for the case a chunk boundary lands between
     // header and footer, where the block never closes inside the chunk.
@@ -80,7 +80,7 @@ export const SECRET_PATTERNS = [
     /\b[a-z][a-z0-9+.-]*:\/\/[^/\s?#]*@/gi,
     // Authorization: Bearer <token>. The token class deliberately excludes
     // `<` and `$`, so documentation placeholders (`Bearer <your-api-key>`,
-    // `Bearer $MNEMONIK_PROXY_TOKEN`) are left intact — redacting those would
+    // `Bearer $MNEMONIK_PROXY_TOKEN`) are left intact - redacting those would
     // destroy the instruction without hiding a secret.
     /Authorization\s*:\s*Bearer\s+[A-Za-z0-9._~+/-]+=*/gi,
 ];
@@ -94,7 +94,7 @@ export const SECRET_PATTERNS = [
 /**
  * A key=value match whose value side is a code REFERENCE to an env read
  * (`process.env.X`, `process.env['X']`, `import.meta.env.X`) contains no
- * literal secret — redacting it destroys information (it blinded the
+ * literal secret - redacting it destroys information (it blinded the
  * doc-truth env_vars authority to every secret-named variable) without
  * protecting anything.
  */
@@ -102,7 +102,7 @@ const ENV_READ_VALUE_RE = /[:=]\s*(?:await\s+)?(?:process\.env[.[]|import\.meta\
 /* ------------------------------------------------------------------ *
  * High-entropy token detector
  *
- * Catches credentials that carry no recognizable provider prefix — the
+ * Catches credentials that carry no recognizable provider prefix - the
  * long random blob in `"webhook": "<40 random chars>"`. A naive entropy
  * threshold cannot do this safely: measured over this repository, a
  * camelCase identifier scores 4.49 bits/char against 4.66 for a real AWS
@@ -110,10 +110,10 @@ const ENV_READ_VALUE_RE = /[:=]\s*(?:await\s+)?(?:process\.env[.[]|import\.meta\
  * below carry the discrimination; entropy is only the final filter.
  *
  * Every candidate must clear ALL of:
- *   1. CONTEXT     — sits immediately after `=`/`:` or an opening quote.
+ *   1. CONTEXT     - sits immediately after `=`/`:` or an opening quote.
  *                    Bare prose positions are never touched, which is what
  *                    keeps the detector out of documentation.
- *   2. LENGTH      — >= 36 characters. The floor started at 32 and was
+ *   2. LENGTH      - >= 36 characters. The floor started at 32 and was
  *                    raised by the claim-yield guard: 32-char opaque
  *                    RESOURCE IDS (Vercel `dpl_`/`prj_`, Stripe object ids)
  *                    are public identifiers, not credentials, and eating
@@ -123,19 +123,19 @@ const ENV_READ_VALUE_RE = /[:=]\s*(?:await\s+)?(?:process\.env[.[]|import\.meta\
  *                    base64 32-byte key 44); shorter non-hex randomness is
  *                    almost always an object id, and anything hex is
  *                    already exempt by rule 4.
- *   3. CHARSET MIX — contains lowercase AND uppercase AND a digit.
- *   4. NOT HEX-ISH — hex after stripping `-`/`_` is a digest or UUID
+ *   3. CHARSET MIX - contains lowercase AND uppercase AND a digit.
+ *   4. NOT HEX-ISH - hex after stripping `-`/`_` is a digest or UUID
  *                    (commit SHAs, contentHash, snippet_hash, project ids).
- *   5. NOT STRUCTURED — if every `/`, `-`, `_` separated segment is <= 16
+ *   5. NOT STRUCTURED - if every `/`, `-`, `_` separated segment is <= 16
  *                    chars the token is a path, slug or SCREAMING_SNAKE
  *                    identifier ("tests/fixtures/docTruth/dogfood-2026-06-06").
- *   6. NOT WORDY   — a lowercase run longer than 5 means natural words
+ *   6. NOT WORDY   - a lowercase run longer than 5 means natural words
  *                    ("...FromCache..."), not random output.
- *   7. ENTROPY     — Shannon entropy >= 4.0 bits/char.
+ *   7. ENTROPY     - Shannon entropy >= 4.0 bits/char.
  *
  * Calibrated by sweeping every file this scanner would chunk across this
  * repository (1426 files): 8 tokens fire, every one of them a credential
- * shape — JWT headers, an AWS example secret key, a leaked Stripe
+ * shape - JWT headers, an AWS example secret key, a leaked Stripe
  * `whsec_`, and this suite's own fixtures. Zero prose, zero paths, zero
  * identifiers, zero resource ids.
  *
@@ -148,14 +148,16 @@ const ENTROPY_MAX_STRUCTURED_SEGMENT = 16;
 const ENTROPY_MAX_LOWERCASE_RUN = 5;
 /**
  * Maximal runs of base64url/base64 characters. `=` is admitted only as
- * trailing padding — allowing it inside the run let a candidate span an
+ * trailing padding - allowing it inside the run let a candidate span an
  * assignment (`HARNESS_PROJECT_ID=<uuid>` matched as one token, defeating
  * the UUID exemption).
  */
-const ENTROPY_CANDIDATE_RE = /[A-Za-z0-9+/_-]{36,}={0,2}/g;
+// Keep the same 36-character floor without an unbounded counted repetition:
+// V8 retains backtracking state for {36,} and overflows on a 10 MiB line.
+const ENTROPY_CANDIDATE_RE = /[A-Za-z0-9+/_-]{35}[A-Za-z0-9+/_-]+={0,2}/g;
 /** Opening quote, or `=`/`:` with optional whitespace and optional quote. */
 const ENTROPY_CONTEXT_RE = /(?:["'`]|[:=]\s*["'`]?)$/;
-/** `==`, `=>`, `!=`, `<=`, `>=`, `+=` … are comparisons, not assignments. */
+/** `==`, `=>`, `!=`, `<=`, `>=`, `+=` ... are comparisons, not assignments. */
 const ENTROPY_OPERATOR_TAIL_RE = /[=!<>+\-*/%&|^]$/;
 const ENTROPY_HEXISH_RE = /^[0-9a-fA-F]+$/;
 const ENTROPY_STRUCTURED_RE = /^[A-Za-z0-9]+(?:[/_-][A-Za-z0-9]+)+$/;
@@ -204,7 +206,7 @@ function isHighEntropySecret(token) {
 }
 /**
  * Redact standalone high-entropy tokens that no provider pattern claimed.
- * Only the token is replaced — the surrounding key, quote and punctuation
+ * Only the token is replaced - the surrounding key, quote and punctuation
  * survive, so `{"webhook": "<secret>"}` stays valid, readable JSON.
  *
  * Exported for direct testing of the guard behavior; production callers

package/dist/secretPatterns.js.map

@@ -1 +1 @@
-{"version":3,"file":"secretPatterns.js","sourceRoot":"","sources":["../src/secretPatterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,YAAY,CAAC;AAEzD,4DAA4D;AAC5D,MAAM,CAAC,MAAM,eAAe,GAA0B;IACpD,sEAAsE;IACtE,wEAAwE;IACxE,oEAAoE;IACpE,qEAAqE;IACrE,kEAAkE;IAClE,2CAA2C;IAC3C,2CAA2C;IAC3C,gCAAgC;IAChC,sBAAsB;IACtB,0BAA0B;IAC1B,uEAAuE;IACvE,wEAAwE;IACxE,oEAAoE;IACpE,oEAAoE;IACpE,sEAAsE;IACtE,qHAAqH;IACrH,yDAAyD;IACzD,0EAA0E;IAC1E,mEAAmE;IACnE,uBAAuB;IACvB,uBAAuB;IACvB,2EAA2E;IAC3E,2EAA2E;IAC3E,oDAAoD;IACpD,yDAAyD;IACzD,yEAAyE;IACzE,oCAAoC;IACpC,mEAAmE;IACnE,mCAAmC;IACnC,4BAA4B;IAC5B,gCAAgC;IAChC,qCAAqC;IACrC,sEAAsE;IACtE,0EAA0E;IAC1E,0EAA0E;IAC1E,8EAA8E;IAC9E,sCAAsC;IACtC,uEAAuE;IACvE,uEAAuE;IACvE,0EAA0E;IAC1E,mDAAmD;IACnD,qDAAqD;CACtD,CAAC;AAEF;;;;;;GAMG;AACH;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,gEAAgE,CAAC;AAE3F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wEA0CwE;AAExE,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,MAAM,yBAAyB,GAAG,GAAG,CAAC;AACtC,MAAM,8BAA8B,GAAG,EAAE,CAAC;AAC1C,MAAM,yBAAyB,GAAG,CAAC,CAAC;AAEpC;;;;;GAKG;AACH,MAAM,oBAAoB,GAAG,6BAA6B,CAAC;AAC3D,6EAA6E;AAC7E,MAAM,kBAAkB,GAAG,0BAA0B,CAAC;AACtD,6EAA6E;AAC7E,MAAM,wBAAwB,GAAG,kBAAkB,CAAC;AACpD,MAAM,iBAAiB,GAAG,gBAAgB,CAAC;AAC3C,MAAM,qBAAqB,GAAG,sCAAsC,CAAC;AAErE,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,EAAE,IAAI,KAAK;QAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC;QAC/B,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,IAAI,EAAE,IAAI,GAAG,IAAI,EAAE,IAAI,GAAG,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,CAAC;YACb,IAAI,OAAO,GAAG,GAAG;gBAAE,GAAG,GAAG,OAAO,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,CAAC,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yEAAyE;AACzE,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,KAAK,CAAC,MAAM,GAAG,kBAAkB;QAAE,OAAO,KAAK,CAAC;IACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC5C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,iBAAiB;IAC5F,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvF,IACE,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC;QACjC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,8BAA8B,CAAC,EACjF,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,wCAAwC;IACxD,CAAC;IACD,IAAI,eAAe,CAAC,KAAK,CAAC,GAAG,yBAAyB;QAAE,OAAO,KAAK,CAAC,CAAC,gBAAgB;IACtF,OAAO,cAAc,CAAC,KAAK,CAAC,IAAI,yBAAyB,CAAC;AAC5D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC,KAAK,EAAE,MAAc,EAAE,EAAE;QAClE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC3D,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QACnD,wEAAwE;QACxE,MAAM,eAAe,GAAG,MAAM;aAC3B,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;aACrB,OAAO,EAAE;aACT,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAChB,IAAI,wBAAwB,CAAC,IAAI,CAAC,eAAe,CAAC;YAAE,OAAO,KAAK,CAAC;QACjE,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACzD,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,KAAK,CAAC;IAC3E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACtC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACzC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,4BAA4B,CACrE,CAAC;IACJ,CAAC;IACD,yEAAyE;IACzE,iEAAiE;IACjE,OAAO,uBAAuB,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC"}
+{"version":3,"file":"secretPatterns.js","sourceRoot":"","sources":["../src/secretPatterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,YAAY,CAAC;AAEzD,4DAA4D;AAC5D,MAAM,CAAC,MAAM,eAAe,GAA0B;IACpD,sEAAsE;IACtE,wEAAwE;IACxE,mEAAmE;IACnE,qEAAqE;IACrE,kEAAkE;IAClE,2CAA2C;IAC3C,2CAA2C;IAC3C,gCAAgC;IAChC,sBAAsB;IACtB,0BAA0B;IAC1B,wEAAwE;IACxE,wEAAwE;IACxE,oEAAoE;IACpE,oEAAoE;IACpE,sEAAsE;IACtE,qHAAqH;IACrH,yDAAyD;IACzD,0EAA0E;IAC1E,mEAAmE;IACnE,uBAAuB;IACvB,uBAAuB;IACvB,2EAA2E;IAC3E,2EAA2E;IAC3E,oDAAoD;IACpD,yDAAyD;IACzD,yEAAyE;IACzE,oCAAoC;IACpC,mEAAmE;IACnE,mCAAmC;IACnC,4BAA4B;IAC5B,gCAAgC;IAChC,qCAAqC;IACrC,sEAAsE;IACtE,0EAA0E;IAC1E,0EAA0E;IAC1E,8EAA8E;IAC9E,sCAAsC;IACtC,uEAAuE;IACvE,uEAAuE;IACvE,0EAA0E;IAC1E,mDAAmD;IACnD,qDAAqD;CACtD,CAAC;AAEF;;;;;;GAMG;AACH;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,gEAAgE,CAAC;AAE3F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wEA0CwE;AAExE,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,MAAM,yBAAyB,GAAG,GAAG,CAAC;AACtC,MAAM,8BAA8B,GAAG,EAAE,CAAC;AAC1C,MAAM,yBAAyB,GAAG,CAAC,CAAC;AAEpC;;;;;GAKG;AACH,4EAA4E;AAC5E,0EAA0E;AAC1E,MAAM,oBAAoB,GAAG,4CAA4C,CAAC;AAC1E,6EAA6E;AAC7E,MAAM,kBAAkB,GAAG,0BAA0B,CAAC;AACtD,+EAA+E;AAC/E,MAAM,wBAAwB,GAAG,kBAAkB,CAAC;AACpD,MAAM,iBAAiB,GAAG,gBAAgB,CAAC;AAC3C,MAAM,qBAAqB,GAAG,sCAAsC,CAAC;AAErE,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,EAAE,IAAI,KAAK;QAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC;QAC/B,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,IAAI,EAAE,IAAI,GAAG,IAAI,EAAE,IAAI,GAAG,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,CAAC;YACb,IAAI,OAAO,GAAG,GAAG;gBAAE,GAAG,GAAG,OAAO,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,CAAC,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yEAAyE;AACzE,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,KAAK,CAAC,MAAM,GAAG,kBAAkB;QAAE,OAAO,KAAK,CAAC;IACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC5C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,iBAAiB;IAC5F,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvF,IACE,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC;QACjC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,8BAA8B,CAAC,EACjF,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,wCAAwC;IACxD,CAAC;IACD,IAAI,eAAe,CAAC,KAAK,CAAC,GAAG,yBAAyB;QAAE,OAAO,KAAK,CAAC,CAAC,gBAAgB;IACtF,OAAO,cAAc,CAAC,KAAK,CAAC,IAAI,yBAAyB,CAAC;AAC5D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC,KAAK,EAAE,MAAc,EAAE,EAAE;QAClE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC3D,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QACnD,wEAAwE;QACxE,MAAM,eAAe,GAAG,MAAM;aAC3B,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;aACrB,OAAO,EAAE;aACT,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAChB,IAAI,wBAAwB,CAAC,IAAI,CAAC,eAAe,CAAC;YAAE,OAAO,KAAK,CAAC;QACjE,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACzD,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,KAAK,CAAC;IAC3E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACtC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACzC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,4BAA4B,CACrE,CAAC;IACJ,CAAC;IACD,yEAAyE;IACzE,iEAAiE;IACjE,OAAO,uBAAuB,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC"}

package/dist/testing/hostAdapterConformance.d.ts

@@ -0,0 +1,17 @@
+import type { AdapterDependencies, FileChange, HostAdapter, Target } from '../hostAdapter.js';
+export declare function writeChanges(changes: FileChange[]): Promise<void>;
+/** Named, isolated checks that any package test runner can register. No test-framework dependency. */
+export declare function hostAdapterConformance(create: (deps?: AdapterDependencies) => HostAdapter, options: {
+    name: string;
+    config: string;
+    mcpConfig?: {
+        user: string;
+        project: string;
+        toml?: boolean;
+        type?: string;
+    };
+    scopes: Target['scope'][];
+    flat?: boolean;
+    deferred?: boolean;
+}): Record<string, () => Promise<void>>;
+//# sourceMappingURL=hostAdapterConformance.d.ts.map

package/dist/testing/hostAdapterConformance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hostAdapterConformance.d.ts","sourceRoot":"","sources":["../../src/testing/hostAdapterConformance.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,mBAAmB,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE9F,wBAAsB,YAAY,CAAC,OAAO,EAAE,UAAU,EAAE,iBASvD;AAUD,sGAAsG;AACtG,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,mBAAmB,KAAK,WAAW,EACnD,OAAO,EAAE;IACP,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7E,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,GACA,MAAM,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAqfrC"}