@molecule/api-ai-tools 1.11.1 → 1.12.0

package/README.md

@@ -3,7 +3,7 @@ AUTO-GENERATED — DO NOT EDIT THIS FILE.
 Generated by `mlcl sync-docs` from the package's src/index.ts JSDoc + mlcl/registry.json.
 Edits here are overwritten on the next commit (molecule's pre-commit hook regenerates).
 To change this document, edit the module-level JSDoc in src/index.ts.
-Generated: 2026-10-21T08:55:11.822Z
+Generated: 2026-10-21T20:10:49.315Z
 -->
 
 # @molecule/api-ai-tools
@@ -444,6 +444,35 @@ interface DiagnosisRunContext {
 }
 ```
 
+#### `DeferredToolCatalogOptions`
+
+Options for exposing a small tool set while retaining access to other allowed tools.
+
+```typescript
+interface DeferredToolCatalogOptions {
+  /** The caller's current permission/mode-filtered tools. Discovery never grants access. */
+  available: () => readonly AITool[]
+  /** Tools that should be offered without a discovery call. */
+  initialNames: ReadonlySet<string>
+  /** Previously loaded names, in load order; useful across turns and compaction. */
+  loadedNames?: readonly string[]
+  /** Persist names after a successful load. No tool content is passed to this callback. */
+  onLoad?: (names: string[]) => void
+}
+```
+
+#### `DeferredToolCatalog`
+
+A provider-independent deferred catalog. The caller still executes and authorizes tools.
+
+```typescript
+interface DeferredToolCatalog {
+  loader: AITool
+  /** Initial tools, loader, then requested tools in stable load order. */
+  select: () => AITool[]
+}
+```
+
 #### `InstalledPackageFacts`
 
 What the filesystem says about a write target under `node_modules` — the half
@@ -2231,7 +2260,8 @@ function pipelineExitCodeNote(command: string, exitCode: number, output: string)
 Whether a command, read from its TEXT alone, starts a server that stays up in the foreground.
 
 The over-budget reader's shape: at that point the command has already run, and only its text is
-left to say whether "run a smaller unit" was ever the right advice.
+left to say whether "run a smaller unit" was ever the right advice. Inline/stdin programs
+remain unclassified and use the normal bounded command runner.
 
 ```typescript
 function startsServerProgram(command: string): boolean
@@ -2244,7 +2274,9 @@ function startsServerProgram(command: string): boolean
 #### `foregroundServerCommand(command, readScript)`
 
 A FOREGROUND command that starts a server, including one that only names a script whose SOURCE
-imports the app's server and calls its `create()`/`listen()`.
+imports the app's server and calls its `create()`/`listen()`. Inline/stdin programs
+(`node -e …`, `python3 -c …`) use normal bounded execution: interpreting arbitrary
+program text is outside this filename/script preflight's contract.
 
 The script read is best-effort: a path the backend will not answer for is a command this reading
 cannot classify, never a refusal. A backgrounded launch, a test runner and a test file are all
@@ -2539,6 +2571,24 @@ function buildAgentPrompt(ctx: PromptContext): string
 
 **Returns:** Fully assembled system prompt text for the coding agent.
 
+#### `createDeferredToolCatalog(options)`
+
+Offer common tools and let the model load other schemas by exact name.
+
+This is ordinary allowlist selection, not semantic routing or authorization.
+Pass tools already filtered by the current mode and permissions. Loading never
+executes a tool; the caller must keep its normal execution-time guards. Loaded
+schemas append in request order and stay available, avoiding an LRU that changes
+the schema prefix on every request. Only names need persistence across turns.
+
+```typescript
+function createDeferredToolCatalog(options: DeferredToolCatalogOptions): DeferredToolCatalog
+```
+
+- `options` — Allowed tools, initial selection and optional durable load state.
+
+**Returns:** A loader tool and the current provider-facing selection.
+
 #### `taskStopCommand(backend, taskId)`
 
 The command that stops a running background task, read from the sandbox's own pid files.
@@ -2996,6 +3046,24 @@ function redactSecretsInCode(s: string): string
 
 **Returns:** A redacted copy that preserves ordinary code verbatim.
 
+#### `addedRedactionMask(next, previous)`
+
+The redaction mask `next` adds over `previous`, or null when it adds none.
+
+`previous` is the file's previous content for `write_file`, and the replacement's own
+`old_string` for `edit_file` — an edit that carries an existing mask through (a file that
+already had one, read back and rewritten) adds no occurrence. A new occurrence may
+be copied output or intentional source; the caller declares the latter explicitly.
+
+```typescript
+function addedRedactionMask(next: string, previous: string): string | null
+```
+
+- `next` — The content about to be written (or the replacement's `new_string`).
+- `previous` — The content it replaces, already on disk (or the `old_string`).
+
+**Returns:** The added mask as written (`'[REDACTED]'`, `"[REDACTED]"`, `=[REDACTED]`), or null.
+
 #### `printsOnlySource(command)`
 
 Whether a shell command only PRINTS source files (`cat a.tsx`, `sed -n '1,40p' x.ts`,
@@ -3012,6 +3080,35 @@ function printsOnlySource(command: string): boolean
 
 **Returns:** True when the command prints source files, with only literal headings and filters.
 
+#### `isReadOnlyInspection(command)`
+
+Whether a shell command only INSPECTS the workspace WITHOUT printing a file's contents:
+it prints source files (a pure literal read, {@link printsOnlySource}), lists names
+(`ls`, `find`), or counts lines (`wc`) — joined by `;`, `&&` or `|`, with literal
+`echo`/`printf` headings and `cd`.
+
+Its output is code or names, not an env dump, so it gets the code-safe redaction
+({@link redactSecretsInCode}) instead of the name-keyed env-dump passes. Without this,
+ordinary code values such as `tokenKey: 'jwtToken'` in a mixed source read and
+`ls | head` command would be masked by the environment-dump rules.
+
+A RECURSIVE SEARCH IS NOT INSPECTION (`grep -rn x .`, `rg x src/`): its output is the
+content of whichever files matched, including `.env` files and JSON secret dumps, so it
+keeps the full grade. A path with no extension is not evidence that it is a directory —
+`/dev/stdin` and an ordinary `secrets` file read the same way.
+
+Env dumps keep the full grade: `.env` anywhere in the command, `env`/`printenv`, a
+non-literal or redirecting form, and an interpreter one-liner (`node -e`, `python -c`)
+all return false.
+
+```typescript
+function isReadOnlyInspection(command: string): boolean
+```
+
+- `command` — The shell command.
+
+**Returns:** True when the command only reads or lists workspace content.
+
 #### `isEnvFilePath(path)`
 
 Whether a path is an env file, for which {@link redactSecrets}' full env-dump
@@ -4310,7 +4407,10 @@ const BACKGROUNDED: RegExp
 A program that SERVES: the scaffold's entry (`server.ts`/`server.js`), a package manager's
 `start`/`dev`/`serve`/`preview` script, a Vite dev or preview server, `next start|dev`, or a
 Python WSGI server. Matched against a command segment's own text, and against a script's SOURCE
-when the command only names the script file.
+when the command only names the script file — but NEVER against an inline program's code
+(`node -e …`, `python3 -c …`), where this text is the user's program rather than a file being
+run: `require('…/node_modules/vite')` imports a module, it does not start a dev server
+(xr-molecule-flash-m391 +13:13, refused as "node starts a server" for exactly that line).
 
 ```typescript
 const SERVER_PROGRAM: RegExp
@@ -4915,6 +5015,11 @@ Peer dependencies:
   as a broken tool and routes around, taking its verification with it. Use
   `guardAITool` to give tools built elsewhere the same treatment, passing
   `redactError` so a thrown message is masked by your own redactor.
+- **Defer occasional tools** with `createDeferredToolCatalog`: pass your current
+  permission-filtered tools and a small initial name set, offer `catalog.select()`
+  to the model, and execute `catalog.loader` like any other tool. Loading only
+  exposes schemas, never grants permission or runs a tool. Persist its loaded
+  names with `onLoad` to keep them available across turns and compaction.
 - **Scope the tool set per agent** with `include`/`exclude` — a read-only agent
   should not receive `write_file`/`exec_command`.
 - Outputs are size-capped (`MAX_READ_SIZE`, `MAX_OUTPUT_SIZE`, …) and searches

package/dist/index.d.ts

@@ -70,6 +70,11 @@
  *   as a broken tool and routes around, taking its verification with it. Use
  *   `guardAITool` to give tools built elsewhere the same treatment, passing
  *   `redactError` so a thrown message is masked by your own redactor.
+ * - **Defer occasional tools** with `createDeferredToolCatalog`: pass your current
+ *   permission-filtered tools and a small initial name set, offer `catalog.select()`
+ *   to the model, and execute `catalog.loader` like any other tool. Loading only
+ *   exposes schemas, never grants permission or runs a tool. Persist its loaded
+ *   names with `onLoad` to keep them available across turns and compaction.
  * - **Scope the tool set per agent** with `include`/`exclude` — a read-only agent
  *   should not receive `write_file`/`exec_command`.
  * - Outputs are size-capped (`MAX_READ_SIZE`, `MAX_OUTPUT_SIZE`, …) and searches
@@ -147,6 +152,7 @@ export * from './server-command.js';
 export * from './sleep-peek.js';
 export * from './suite-overlap.js';
 export * from './system-prompt.js';
+export * from './tool-catalog.js';
 export * from './tools.js';
 export * from './trace-artifacts.js';
 export * from './types.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkIG;AAEH,cAAc,qBAAqB,CAAA;AACnC,cAAc,uBAAuB,CAAA;AACrC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,uBAAuB,CAAA;AACrC,cAAc,cAAc,CAAA;AAC5B,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,uBAAuB,CAAA;AACrC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,kBAAkB,CAAA;AAChC,cAAc,oBAAoB,CAAA;AAClC,cAAc,yBAAyB,CAAA;AACvC,cAAc,cAAc,CAAA;AAC5B,cAAc,qBAAqB,CAAA;AACnC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,YAAY,CAAA;AAC1B,cAAc,sBAAsB,CAAA;AACpC,cAAc,YAAY,CAAA;AAC1B,cAAc,gBAAgB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuIG;AAEH,cAAc,qBAAqB,CAAA;AACnC,cAAc,uBAAuB,CAAA;AACrC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,uBAAuB,CAAA;AACrC,cAAc,cAAc,CAAA;AAC5B,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,uBAAuB,CAAA;AACrC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,kBAAkB,CAAA;AAChC,cAAc,oBAAoB,CAAA;AAClC,cAAc,yBAAyB,CAAA;AACvC,cAAc,cAAc,CAAA;AAC5B,cAAc,qBAAqB,CAAA;AACnC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,mBAAmB,CAAA;AACjC,cAAc,YAAY,CAAA;AAC1B,cAAc,sBAAsB,CAAA;AACpC,cAAc,YAAY,CAAA;AAC1B,cAAc,gBAAgB,CAAA"}

package/dist/index.js

@@ -70,6 +70,11 @@
  *   as a broken tool and routes around, taking its verification with it. Use
  *   `guardAITool` to give tools built elsewhere the same treatment, passing
  *   `redactError` so a thrown message is masked by your own redactor.
+ * - **Defer occasional tools** with `createDeferredToolCatalog`: pass your current
+ *   permission-filtered tools and a small initial name set, offer `catalog.select()`
+ *   to the model, and execute `catalog.loader` like any other tool. Loading only
+ *   exposes schemas, never grants permission or runs a tool. Persist its loaded
+ *   names with `onLoad` to keep them available across turns and compaction.
  * - **Scope the tool set per agent** with `include`/`exclude` — a read-only agent
  *   should not receive `write_file`/`exec_command`.
  * - Outputs are size-capped (`MAX_READ_SIZE`, `MAX_OUTPUT_SIZE`, …) and searches
@@ -147,6 +152,7 @@ export * from './server-command.js';
 export * from './sleep-peek.js';
 export * from './suite-overlap.js';
 export * from './system-prompt.js';
+export * from './tool-catalog.js';
 export * from './tools.js';
 export * from './trace-artifacts.js';
 export * from './types.js';

package/dist/schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../src/schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAElD;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,UAAU,CAAA;CACvB;AAED;;GAEG;AACH,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CA8V1C,CAAA"}
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../src/schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAElD;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,UAAU,CAAA;CACvB;AAED;;GAEG;AACH,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAwW1C,CAAA"}

package/dist/schemas.js

@@ -71,6 +71,10 @@ export const TOOL_SCHEMAS = {
         parameters: {
             type: 'object',
             properties: {
+                intentional_redaction_placeholder: {
+                    type: 'boolean',
+                    description: 'Set true only when intentionally authoring a literal [REDACTED] placeholder. Default false: newly copied output placeholders are refused. This never disables secret-output masking.',
+                },
                 path: {
                     type: 'string',
                     description: 'Path to the file to write.',
@@ -89,6 +93,10 @@ export const TOOL_SCHEMAS = {
         parameters: {
             type: 'object',
             properties: {
+                intentional_redaction_placeholder: {
+                    type: 'boolean',
+                    description: 'Set true only when intentionally authoring a literal [REDACTED] placeholder. Default false: newly copied output placeholders are refused. This never disables secret-output masking.',
+                },
                 path: {
                     type: 'string',
                     description: 'Path to the file to edit.',

package/dist/server-command.d.ts

@@ -26,14 +26,18 @@ export declare const BACKGROUNDED: RegExp;
  * A program that SERVES: the scaffold's entry (`server.ts`/`server.js`), a package manager's
  * `start`/`dev`/`serve`/`preview` script, a Vite dev or preview server, `next start|dev`, or a
  * Python WSGI server. Matched against a command segment's own text, and against a script's SOURCE
- * when the command only names the script file.
+ * when the command only names the script file — but NEVER against an inline program's code
+ * (`node -e …`, `python3 -c …`), where this text is the user's program rather than a file being
+ * run: `require('…/node_modules/vite')` imports a module, it does not start a dev server
+ * (xr-molecule-flash-m391 +13:13, refused as "node starts a server" for exactly that line).
  */
 export declare const SERVER_PROGRAM: RegExp;
 /**
  * Whether a command, read from its TEXT alone, starts a server that stays up in the foreground.
  *
  * The over-budget reader's shape: at that point the command has already run, and only its text is
- * left to say whether "run a smaller unit" was ever the right advice.
+ * left to say whether "run a smaller unit" was ever the right advice. Inline/stdin programs
+ * remain unclassified and use the normal bounded command runner.
  *
  * @param command - The command as the executor sent it.
  * @returns True when a foreground statement of the command starts a server.
@@ -46,7 +50,9 @@ export interface ForegroundServer {
 }
 /**
  * A FOREGROUND command that starts a server, including one that only names a script whose SOURCE
- * imports the app's server and calls its `create()`/`listen()`.
+ * imports the app's server and calls its `create()`/`listen()`. Inline/stdin programs
+ * (`node -e …`, `python3 -c …`) use normal bounded execution: interpreting arbitrary
+ * program text is outside this filename/script preflight's contract.
  *
  * The script read is best-effort: a path the backend will not answer for is a command this reading
  * cannot classify, never a refusal. A backgrounded launch, a test runner and a test file are all

package/dist/server-command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-command.d.ts","sourceRoot":"","sources":["../src/server-command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,KAAK,sBAAsB,EAAyB,MAAM,oBAAoB,CAAA;AAKvF;;;GAGG;AACH,eAAO,MAAM,YAAY,QAA6C,CAAA;AAEtE;;;;;GAKG;AACH,eAAO,MAAM,cAAc,QACmP,CAAA;AAmF9Q;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAI5D;AAED,0EAA0E;AAC1E,MAAM,WAAW,gBAAgB;IAC/B,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,GAC5C,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAmBlC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,GAC5C,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAiBxC;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAO5F;AAED;;;GAGG;AACH,eAAO,MAAM,yBAAyB,QAG0B,CAAA"}
+{"version":3,"file":"server-command.d.ts","sourceRoot":"","sources":["../src/server-command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,KAAK,sBAAsB,EAAyB,MAAM,oBAAoB,CAAA;AAKvF;;;GAGG;AACH,eAAO,MAAM,YAAY,QAA6C,CAAA;AAEtE;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,QACmP,CAAA;AA8G9Q;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAI5D;AAED,0EAA0E;AAC1E,MAAM,WAAW,gBAAgB;IAC/B,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,GAC5C,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAmBlC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,GAC5C,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAiBxC;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAO5F;AAED;;;GAGG;AACH,eAAO,MAAM,yBAAyB,QAG0B,CAAA"}

package/dist/server-command.js

@@ -28,7 +28,10 @@ export const BACKGROUNDED = /(?:^|[^&>])&(?!&|>)|\b(?:nohup|setsid)\b/;
  * A program that SERVES: the scaffold's entry (`server.ts`/`server.js`), a package manager's
  * `start`/`dev`/`serve`/`preview` script, a Vite dev or preview server, `next start|dev`, or a
  * Python WSGI server. Matched against a command segment's own text, and against a script's SOURCE
- * when the command only names the script file.
+ * when the command only names the script file — but NEVER against an inline program's code
+ * (`node -e …`, `python3 -c …`), where this text is the user's program rather than a file being
+ * run: `require('…/node_modules/vite')` imports a module, it does not start a dev server
+ * (xr-molecule-flash-m391 +13:13, refused as "node starts a server" for exactly that line).
  */
 export const SERVER_PROGRAM = /\bserver\.[cm]?[jt]s\b|\b(?:npm|pnpm|yarn|bun)\s+(?:run\s+)?(?:start|dev|serve|preview)\b|\bvite\s+(?:preview|dev|serve)\b|\bvite(?![.\w-])(?!\s+(?:build|optimize)\b)|\bnext\s+(?:start|dev)\b|\b(?:uvicorn|gunicorn)\b|\bflask\s+run\b|\bpython\d?\s+-m\s+http\.server\b/;
 /** Programs that run a script FILE, so the file's own source decides whether it serves. */
@@ -66,6 +69,26 @@ const SERVE_SCRIPTS = /^(?:start|dev|serve|preview)$/;
 const TEST_RUNNERS = /^(?:hurl|jest|mocha|playwright|vitest)$/;
 /** A script's SOURCE that binds a listener even when it does not name a server file. */
 const STARTS_LISTENING = /\b(?:server|app)\.listen\s*\(/;
+/** Node inline-program flags; the shell parser already separated their arguments. */
+const NODE_INLINE_FLAG = /^(?:-[A-Za-z]*[ep]|--(?:eval|print)(?:=|$))/;
+/** Python inline programs use -c, including combined interpreter flags. */
+const PYTHON_INLINE_FLAG = /^-[A-Za-z]*c$/;
+/**
+ * Inline/stdin programs have no server filename to classify. Their source is arbitrary
+ * code; the normal bounded command runner, rather than another partial JS/Python
+ * parser, owns their execution. Named script and package-server checks remain below.
+ * @param segment - One parsed shell statement.
+ * @returns Whether the interpreter reads an inline/stdin program.
+ */
+function isInlineProgram(segment) {
+    const flag = /^python(?:3(?:\.\d+)?)?$/.test(segment.program)
+        ? PYTHON_INLINE_FLAG
+        : NODE_INLINE_FLAG;
+    return segment.args.some((word) => {
+        const arg = bare(word);
+        return arg === '-' || flag.test(arg);
+    });
+}
 /** A word with its shell quotes taken off (`'src/server.ts'` → `src/server.ts`). */
 function bare(word) {
     const match = /^(['"])(.*)\1$/s.exec(word);
@@ -75,6 +98,8 @@ function bare(word) {
  * Whether one parsed statement starts a server: a package manager's serving script, or a program
  * that IS a server, named in command position (so `cat server.ts` is a read, not a launch).
  *
+ * Inline/stdin programs use normal bounded execution: their code is not a server filename.
+ *
  * @param segment - One statement of the command.
  * @returns True when the statement starts a server that does not exit.
  */
@@ -87,7 +112,11 @@ function runsServerProgram(segment) {
         if (script !== undefined && SERVE_SCRIPTS.test(script))
             return true;
     }
-    return SERVER_PROGRAMS.has(segment.program) && SERVER_PROGRAM.test(segment.text);
+    if (!SERVER_PROGRAMS.has(segment.program))
+        return false;
+    if (isInlineProgram(segment))
+        return false;
+    return SERVER_PROGRAM.test(segment.text);
 }
 /**
  * The script file a runner statement executes, when it names one.
@@ -98,6 +127,9 @@ function runsServerProgram(segment) {
 function scriptPath(segment) {
     if (!SCRIPT_RUNNERS.has(segment.program))
         return null;
+    // An inline program (`node -e …`) is code, not a file to read.
+    if (isInlineProgram(segment))
+        return null;
     for (const arg of segment.args) {
         const word = bare(arg);
         if (word.startsWith('-'))
@@ -111,7 +143,8 @@ function scriptPath(segment) {
  * Whether a command, read from its TEXT alone, starts a server that stays up in the foreground.
  *
  * The over-budget reader's shape: at that point the command has already run, and only its text is
- * left to say whether "run a smaller unit" was ever the right advice.
+ * left to say whether "run a smaller unit" was ever the right advice. Inline/stdin programs
+ * remain unclassified and use the normal bounded command runner.
  *
  * @param command - The command as the executor sent it.
  * @returns True when a foreground statement of the command starts a server.
@@ -124,7 +157,9 @@ export function startsServerProgram(command) {
 }
 /**
  * A FOREGROUND command that starts a server, including one that only names a script whose SOURCE
- * imports the app's server and calls its `create()`/`listen()`.
+ * imports the app's server and calls its `create()`/`listen()`. Inline/stdin programs
+ * (`node -e …`, `python3 -c …`) use normal bounded execution: interpreting arbitrary
+ * program text is outside this filename/script preflight's contract.
  *
  * The script read is best-effort: a path the backend will not answer for is a command this reading
  * cannot classify, never a refusal. A backgrounded launch, a test runner and a test file are all

package/dist/tool-catalog.d.ts

@@ -0,0 +1,32 @@
+import type { AITool } from '@molecule/api-ai';
+/** Options for exposing a small tool set while retaining access to other allowed tools. */
+export interface DeferredToolCatalogOptions {
+    /** The caller's current permission/mode-filtered tools. Discovery never grants access. */
+    available: () => readonly AITool[];
+    /** Tools that should be offered without a discovery call. */
+    initialNames: ReadonlySet<string>;
+    /** Previously loaded names, in load order; useful across turns and compaction. */
+    loadedNames?: readonly string[];
+    /** Persist names after a successful load. No tool content is passed to this callback. */
+    onLoad?: (names: string[]) => void;
+}
+/** A provider-independent deferred catalog. The caller still executes and authorizes tools. */
+export interface DeferredToolCatalog {
+    loader: AITool;
+    /** Initial tools, loader, then requested tools in stable load order. */
+    select: () => AITool[];
+}
+/**
+ * Offer common tools and let the model load other schemas by exact name.
+ *
+ * This is ordinary allowlist selection, not semantic routing or authorization.
+ * Pass tools already filtered by the current mode and permissions. Loading never
+ * executes a tool; the caller must keep its normal execution-time guards. Loaded
+ * schemas append in request order and stay available, avoiding an LRU that changes
+ * the schema prefix on every request. Only names need persistence across turns.
+ *
+ * @param options - Allowed tools, initial selection and optional durable load state.
+ * @returns A loader tool and the current provider-facing selection.
+ */
+export declare function createDeferredToolCatalog(options: DeferredToolCatalogOptions): DeferredToolCatalog;
+//# sourceMappingURL=tool-catalog.d.ts.map

package/dist/tool-catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-catalog.d.ts","sourceRoot":"","sources":["../src/tool-catalog.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAE9C,2FAA2F;AAC3F,MAAM,WAAW,0BAA0B;IACzC,0FAA0F;IAC1F,SAAS,EAAE,MAAM,SAAS,MAAM,EAAE,CAAA;IAClC,6DAA6D;IAC7D,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACjC,kFAAkF;IAClF,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC/B,yFAAyF;IACzF,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,CAAA;CACnC;AAED,+FAA+F;AAC/F,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAA;IACd,wEAAwE;IACxE,MAAM,EAAE,MAAM,MAAM,EAAE,CAAA;CACvB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,0BAA0B,GAClC,mBAAmB,CAsErB"}

package/dist/tool-catalog.js

@@ -0,0 +1,76 @@
+/**
+ * Offer common tools and let the model load other schemas by exact name.
+ *
+ * This is ordinary allowlist selection, not semantic routing or authorization.
+ * Pass tools already filtered by the current mode and permissions. Loading never
+ * executes a tool; the caller must keep its normal execution-time guards. Loaded
+ * schemas append in request order and stay available, avoiding an LRU that changes
+ * the schema prefix on every request. Only names need persistence across turns.
+ *
+ * @param options - Allowed tools, initial selection and optional durable load state.
+ * @returns A loader tool and the current provider-facing selection.
+ */
+export function createDeferredToolCatalog(options) {
+    const loaded = new Set(options.loadedNames);
+    const available = () => options.available().filter((tool) => tool.name !== 'load_tools');
+    const loader = {
+        name: 'load_tools',
+        get description() {
+            const deferred = available().filter((tool) => !options.initialNames.has(tool.name));
+            return ('Load additional tools by exact name before calling them. Loading only exposes their ' +
+                'schemas; it does not run them. They remain available for later requests. Other tools: ' +
+                deferred
+                    .map((tool) => `${tool.name}: ${tool.description.split(/\n|(?<=[.!?])\s/)[0].slice(0, 160)}`)
+                    .join('; '));
+        },
+        parameters: {
+            type: 'object',
+            properties: {
+                names: {
+                    type: 'array',
+                    items: { type: 'string' },
+                    minItems: 1,
+                    description: 'Exact tool names to load together, for example ["git_push", "git_pull"].',
+                },
+            },
+            required: ['names'],
+        },
+        async execute(input) {
+            const names = input?.names;
+            if (!Array.isArray(names) ||
+                names.length === 0 ||
+                names.some((name) => typeof name !== 'string')) {
+                return { error: 'names must be a nonempty array of exact tool names. Nothing was loaded.' };
+            }
+            const permitted = new Set(available().map((tool) => tool.name));
+            const refused = names.filter((name) => !permitted.has(name));
+            if (refused.length > 0) {
+                return {
+                    error: `Tools unavailable in the current mode: ${refused.join(', ')}. Nothing was loaded.`,
+                };
+            }
+            for (const name of names)
+                loaded.add(name);
+            options.onLoad?.([...loaded]);
+            return {
+                loaded: [...new Set(names)],
+                message: 'Schemas loaded. Call these tools with their declared arguments.',
+            };
+        },
+    };
+    return {
+        loader,
+        select() {
+            const tools = available();
+            const byName = new Map(tools.map((tool) => [tool.name, tool]));
+            return [
+                ...tools.filter((tool) => options.initialNames.has(tool.name)),
+                loader,
+                ...[...loaded].flatMap((name) => {
+                    const tool = byName.get(name);
+                    return tool && !options.initialNames.has(name) ? [tool] : [];
+                }),
+            ];
+        },
+    };
+}

package/dist/tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AA4O9C;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAahG;AAudD,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AA8HnE;;;GAGG;AACH,eAAO,MAAM,iBAAiB,QAEA,CAAA;AAE9B;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,wBAAwB,QAI6C,CAAA;AA2DlF;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAUhE;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,qBAAqB;IACpC,iFAAiF;IACjF,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,8FAA8F;IAC9F,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;CAC5B;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,qBAAqB,CAAC,CAAA;AAoBpF;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,CAAC,GACxE,qBAAqB,CAkBvB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAsB,4BAA4B,CAChD,IAAI,EAAE,MAAM,EACZ,KAAK,CAAC,EAAE,qBAAqB,GAC5B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAiCxB;AA2GD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,eAAe,GAAG,MAAM,EAAE,CAi5FxF"}
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AA4O9C;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAahG;AAudD,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AA+HnE;;;GAGG;AACH,eAAO,MAAM,iBAAiB,QAEA,CAAA;AAE9B;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,wBAAwB,QAI6C,CAAA;AA2DlF;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAUhE;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,qBAAqB;IACpC,iFAAiF;IACjF,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,8FAA8F;IAC9F,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;CAC5B;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,qBAAqB,CAAC,CAAA;AAoBpF;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,CAAC,GACxE,qBAAqB,CAkBvB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAsB,4BAA4B,CAChD,IAAI,EAAE,MAAM,EACZ,KAAK,CAAC,EAAE,qBAAqB,GAC5B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAiCxB;AA2GD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,eAAe,GAAG,MAAM,EAAE,CA27FxF"}

package/dist/tools.js

@@ -663,7 +663,7 @@ async function backgroundTaskState(backend, command, seconds, ceilingMs) {
 }
 import { suiteCommandTarget } from './suite-overlap.js';
 import { diagnosisTraceCommand } from './trace-artifacts.js';
-import { BRACE_GLOB_HINT, checkBlockedCommand, declaredBudgetSeconds, DEFAULT_SEARCH_EXCLUDED_DIRS, directoryReadHint, earlyReturnCause, emptyCallError, expandBraceGlob, failureCausesNote, findPathArgs, findPatternArgs, fusedLine, htmlOutline, isCommandTimeout, isEnvFilePath, isOutsideRoot, isPlaywrightRunCommand, isSuiteRunCommand, linesWithinSerialized, literalDirPrefix, logShowsInlineFailureBodies, MAX_BATCH_READ_FILES, MAX_FIND_RESULTS, MAX_HTML_INLINE_CHARS, MAX_OUTPUT_SIZE, MAX_READ_CALL_CHARS, MAX_READ_RETURN_CHARS, MAX_READ_SIZE, MAX_SEARCH_CONTEXT_LINES, MAX_SEARCH_RESULTS, MAX_WRITE_SIZE, outputIsWithheldUntilExit, outputRedirectTarget, parseCheckCommand, parseCheckProblem, pathArgError, printsOnlySource, READ_RESULT_ENVELOPE_CHARS, redactSecrets, redactSecretsInCode, repeatedSuiteRunError, repeatingFailure, repeatingFailureNote, resolvePath, RUNNING_FAILURE_LINES, runningCauseCommand, runningOutputSliceCommand, searchTimeoutError, serializedChars, shellQuote, sliceLines, SMALL_FILE_WHOLE_CHARS, streamingBackgroundCommand, stripControlChars, suiteRunBudgetCommand, suiteRunConfigCommand, suiteRunPipelinePlacement, suiteRunPriorityLaunch, TOOL_RESULT_CHARS, truncateMiddle, universalCause, whitespaceTolerantReplace, withoutSuiteTimeout, } from './utilities.js';
+import { addedRedactionMask, BRACE_GLOB_HINT, checkBlockedCommand, declaredBudgetSeconds, DEFAULT_SEARCH_EXCLUDED_DIRS, directoryReadHint, earlyReturnCause, emptyCallError, expandBraceGlob, failureCausesNote, findPathArgs, findPatternArgs, fusedLine, htmlOutline, isCommandTimeout, isEnvFilePath, isOutsideRoot, isPlaywrightRunCommand, isReadOnlyInspection, isSuiteRunCommand, linesWithinSerialized, literalDirPrefix, logShowsInlineFailureBodies, MAX_BATCH_READ_FILES, MAX_FIND_RESULTS, MAX_HTML_INLINE_CHARS, MAX_OUTPUT_SIZE, MAX_READ_CALL_CHARS, MAX_READ_RETURN_CHARS, MAX_READ_SIZE, MAX_SEARCH_CONTEXT_LINES, MAX_SEARCH_RESULTS, MAX_WRITE_SIZE, outputIsWithheldUntilExit, outputRedirectTarget, parseCheckCommand, parseCheckProblem, pathArgError, READ_RESULT_ENVELOPE_CHARS, redactSecrets, redactSecretsInCode, repeatedSuiteRunError, repeatingFailure, repeatingFailureNote, resolvePath, RUNNING_FAILURE_LINES, runningCauseCommand, runningOutputSliceCommand, searchTimeoutError, serializedChars, shellQuote, sliceLines, SMALL_FILE_WHOLE_CHARS, streamingBackgroundCommand, stripControlChars, suiteRunBudgetCommand, suiteRunConfigCommand, suiteRunPipelinePlacement, suiteRunPriorityLaunch, TOOL_RESULT_CHARS, truncateMiddle, universalCause, whitespaceTolerantReplace, withoutSuiteTimeout, } from './utilities.js';
 /**
  * How long exec_command waits for a command it backgrounded only because the
  * command asked for more than the tool's ceiling, before handing back a task id.
@@ -1219,6 +1219,23 @@ export function buildTools(backend, config) {
             result = isEnvFilePath(path) ? redactSecrets(result) : redactSecretsInCode(result);
         return result;
     }
+    /**
+     * The refusal for a write that would put the output filter's placeholder into a file.
+     *
+     * A placeholder may have been copied from filtered output or intentionally authored.
+     * Ask the caller to recover the source value or explicitly declare intentional use;
+     * the guard cannot infer the literal's origin from its bytes.
+     *
+     * @param path - The file the write targets.
+     * @param mask - The added mask, exactly as the content writes it.
+     * @returns The error message shown to the model.
+     */
+    function redactionMaskError(path, mask) {
+        return (`Refused: the new content adds ${mask}, which may be the tool output filter's placeholder ` +
+            `rather than the original value. Use read_file (${path} itself, or the source of the value) ` +
+            'to recover the original. If the application intentionally defines this redaction literal, ' +
+            'retry with intentional_redaction_placeholder: true.');
+    }
     // ── Binary reads ───────────────────────────────────────────────
     /** Extensions whose files are never text: a `read_file` on one is refused by name. */
     const BINARY_FILE_EXTENSIONS = new Set([
@@ -1823,6 +1840,13 @@ export function buildTools(backend, config) {
                 catch (_error) {
                     /* file doesn't exist yet — oldContent stays null */
                 }
+                // A mask the output filter produced is not a value: refuse writing a NEW one into the
+                // project, while allowing a file that already carries one to be rewritten unchanged.
+                if (doRedact && input.intentional_redaction_placeholder !== true) {
+                    const mask = addedRedactionMask(content, oldContent ?? '');
+                    if (mask !== null)
+                        return { error: redactionMaskError(path, mask) };
+                }
                 if (onFileDiff)
                     onFileDiff({ path, oldContent, newContent: content });
                 await backend.writeFile(path, content);
@@ -1969,6 +1993,19 @@ export function buildTools(backend, config) {
                         });
                         continue;
                     }
+                    // Same guard as write_file, judged per replacement against its own old_string: an
+                    // edit that carries an existing mask through is fine, one that ADDS a mask is refused.
+                    if (doRedact && input.intentional_redaction_placeholder !== true) {
+                        const mask = addedRedactionMask(newString, oldString);
+                        if (mask !== null) {
+                            failures.push({
+                                index: index + 1,
+                                start: startOf(oldString),
+                                message: redactionMaskError(path, mask),
+                            });
+                            continue;
+                        }
+                    }
                     const count = content.split(oldString).length - 1;
                     // The edit is ALREADY in the file: old_string is gone and a distinctive
                     // new_string is there exactly once. The executor re-sends an edit it
@@ -3043,9 +3080,12 @@ export function buildTools(backend, config) {
                 // truncateMiddle (not truncate): a failing build/test/migration puts its
                 // error at the TAIL, so keep the head AND the tail — head-only truncation
                 // strands the executor with passing progress and no failure reason.
-                // A command that only prints source files returns file content: the code-safe grade,
-                // as read_file uses (utilities.ts printsOnlySource).
-                const grade = printsOnlySource(command)
+                // A command that only INSPECTS the workspace without printing arbitrary file content
+                // (a pure source read, `ls`/`find`/`wc`) returns code, not an env dump: the code-safe
+                // grade, as read_file uses (utilities.ts isReadOnlyInspection). A recursive search
+                // (`.env` and JSON secret dumps are in its match set), an `.env` read, `env`/`printenv`
+                // and an interpreter one-liner all keep the full name-keyed grade.
+                const grade = isReadOnlyInspection(command)
                     ? (s) => sanitizeFileContent(s, 'printed.ts')
                     : sanitizeOutput;
                 const stdout = grade(truncateMiddle(result.stdout, MAX_OUTPUT_SIZE));

package/dist/utilities.d.ts

@@ -57,6 +57,19 @@ export declare function redactSecrets(s: string): string;
  * @returns A redacted copy that preserves ordinary code verbatim.
  */
 export declare function redactSecretsInCode(s: string): string;
+/**
+ * The redaction mask `next` adds over `previous`, or null when it adds none.
+ *
+ * `previous` is the file's previous content for `write_file`, and the replacement's own
+ * `old_string` for `edit_file` — an edit that carries an existing mask through (a file that
+ * already had one, read back and rewritten) adds no occurrence. A new occurrence may
+ * be copied output or intentional source; the caller declares the latter explicitly.
+ *
+ * @param next - The content about to be written (or the replacement's `new_string`).
+ * @param previous - The content it replaces, already on disk (or the `old_string`).
+ * @returns The added mask as written (`'[REDACTED]'`, `"[REDACTED]"`, `=[REDACTED]`), or null.
+ */
+export declare function addedRedactionMask(next: string, previous: string): string | null;
 /**
  * Whether a shell command only PRINTS source files (`cat a.tsx`, `sed -n '1,40p' x.ts`,
  * `head -50 b.hurl`): its output is file content and gets the code-safe redaction, like
@@ -68,6 +81,30 @@ export declare function redactSecretsInCode(s: string): string;
  * @returns True when the command prints source files, with only literal headings and filters.
  */
 export declare function printsOnlySource(command: string): boolean;
+/**
+ * Whether a shell command only INSPECTS the workspace WITHOUT printing a file's contents:
+ * it prints source files (a pure literal read, {@link printsOnlySource}), lists names
+ * (`ls`, `find`), or counts lines (`wc`) — joined by `;`, `&&` or `|`, with literal
+ * `echo`/`printf` headings and `cd`.
+ *
+ * Its output is code or names, not an env dump, so it gets the code-safe redaction
+ * ({@link redactSecretsInCode}) instead of the name-keyed env-dump passes. Without this,
+ * ordinary code values such as `tokenKey: 'jwtToken'` in a mixed source read and
+ * `ls | head` command would be masked by the environment-dump rules.
+ *
+ * A RECURSIVE SEARCH IS NOT INSPECTION (`grep -rn x .`, `rg x src/`): its output is the
+ * content of whichever files matched, including `.env` files and JSON secret dumps, so it
+ * keeps the full grade. A path with no extension is not evidence that it is a directory —
+ * `/dev/stdin` and an ordinary `secrets` file read the same way.
+ *
+ * Env dumps keep the full grade: `.env` anywhere in the command, `env`/`printenv`, a
+ * non-literal or redirecting form, and an interpreter one-liner (`node -e`, `python -c`)
+ * all return false.
+ *
+ * @param command - The shell command.
+ * @returns True when the command only reads or lists workspace content.
+ */
+export declare function isReadOnlyInspection(command: string): boolean;
 /**
  * Whether a path is an env file, for which {@link redactSecrets}' full env-dump
  * treatment is appropriate rather than {@link redactSecretsInCode}. Matches

package/dist/utilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utilities.d.ts","sourceRoot":"","sources":["../src/utilities.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAYH,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAE3E,OAAO,EACL,KAAK,mBAAmB,EAExB,KAAK,aAAa,EAMnB,MAAM,oBAAoB,CAAA;AAE3B;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAS5C;AAED;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,GAAI,GAAG,MAAM,KAAG,MAEE,CAAA;AAuGhD;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAK/C;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAErD;AA0ED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAwEzD;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGnD;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,GAAG,MAAM,CAUpF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAElE;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQnE;AAuDD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,8BAA8B,0CAA0C,CAAA;AAsBrF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,mBAAmB,GAC5B;IACD,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CA0NA;AA+BD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAQ5D;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA8BpE;AAuBD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,SAAS,MAAM,EAAE,GACvB;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAsC3D;AAKD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,CA8BtC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG;IACpD,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CACvB,CAEA;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAG/D;AAuJD,wEAAwE;AACxE,MAAM,WAAW,gBAAgB;IAC/B,0BAA0B;IAC1B,OAAO,EAAE,MAAM,CAAA;IACf,6FAA6F;IAC7F,OAAO,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,CAkC3E;AAED,oFAAoF;AACpF,MAAM,WAAW,yBAAyB;IACxC;;;OAGG;IACH,KAAK,EAAE,OAAO,CAAA;IACd;;;;;OAKG;IACH,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,yBAAyB,CAkBpF;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEjE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAalC;AA6HD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA4BlE;AAID;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAQrE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAOxE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAQpD;AAED;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,KAAK,CAAA;AAE7C;;;GAGG;AACH,eAAO,MAAM,eAAe,QAEQ,CAAA;AAEpC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAiBhE;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGvD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGpD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAU/D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAGxD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,GACX,MAAM,CAKR;AAkCD;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIvE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAU1E;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI9E;AAID,yCAAyC;AACzC,eAAO,MAAM,aAAa,QAAkB,CAAA;AAC5C,8CAA8C;AAC9C,eAAO,MAAM,cAAc,QAAmB,CAAA;AAC9C,kDAAkD;AAClD,eAAO,MAAM,eAAe,QAAa,CAAA;AACzC;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,KAAK,CAAA;AAE1C;;;;;;;;;;;;GAYG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CA6BhG;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAY5E;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,KAAK,CAAA;AAEtC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,mBAAmB,QAAS,CAAA;AAEzC;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,OAAQ,CAAA;AAE/C;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,qBAAqB,QAAmD,CAAA;AAErF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,QAAwB,CAAA;AAE3D;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,qBAAqB,QAAY,CAAA;AAE9C,qEAAqE;AACrE,eAAO,MAAM,sBAAsB,MAAM,CAAA;AAKzC,6EAA6E;AAC7E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,SAAa,GAAG,MAAM,GAAG,IAAI,CAyC3E;AAED,0BAA0B;AAC1B,eAAO,MAAM,kBAAkB,KAAK,CAAA;AACpC,wBAAwB;AACxB,eAAO,MAAM,gBAAgB,MAAM,CAAA;AAEnC;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,mHAW/B,CAAA;AAEV;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAG7D;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAOnE;AAmFD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAiBjD;AAED,kEAAkE;AAClE,eAAO,MAAM,qBAAqB,KAAK,CAAA;AAEvC,qEAAqE;AACrE,eAAO,MAAM,kBAAkB,OAAO,CAAA;AAEtC;;;GAGG;AACH,eAAO,MAAM,uBAAuB,0KAC4G,CAAA;AAEhJ;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAM3E;AAED,gEAAgE;AAChE,eAAO,MAAM,0BAA0B,QAAS,CAAA;AAEhD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAGrE;AAED;;;GAGG;AACH,eAAO,MAAM,qBAAqB,IAAI,CAAA;AAEtC,0DAA0D;AAC1D,MAAM,WAAW,UAAU;IACzB,gGAAgG;IAChG,KAAK,EAAE,MAAM,CAAA;IACb,iEAAiE;IACjE,KAAK,EAAE,MAAM,CAAA;IACb,qFAAqF;IACrF,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CACvB;AAED,0DAA0D;AAC1D,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAA;IACb,0FAA0F;IAC1F,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,sFAAsF;IACtF,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,sDAAsD;IACtD,KAAK,EAAE,UAAU,EAAE,CAAA;CACpB;AA6TD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CA+CrE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAWhE;AAED,2FAA2F;AAC3F,eAAO,MAAM,wBAAwB,IAAI,CAAA;AAEzC;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,OAAO,CAAA;AAErC;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,QAA2B,CAAA;AAE5D;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,KAAK,CAAA;AAKvC,oFAAoF;AACpF,eAAO,MAAM,0BAA0B,IAAI,CAAA;AA8D3C;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,IAAI,CAAA;AAEtC,oFAAoF;AACpF,MAAM,WAAW,cAAc;IAC7B,wCAAwC;IACxC,KAAK,EAAE,MAAM,CAAA;IACb,6EAA6E;IAC7E,KAAK,EAAE,MAAM,EAAE,CAAA;IACf;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,IAAI,CAAA;IACzB,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;OAIG;IACH,KAAK,CAAC,EAAE,UAAU,EAAE,CAAA;CACrB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,sBAAsB,IAAI,CAAA;AAsIvC;;;GAGG;AACH,eAAO,MAAM,sBAAsB,IAAI,CAAA;AAuCvC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA2BhE;AA+DD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,gBAAgB,GAAG,IAAI,EAC9B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,GACtB,cAAc,GAAG,IAAI,CAiCvB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,gBAAgB,GAAG,IAAI,EAC9B,SAAS,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,GAC3C,cAAc,GAAG,IAAI,CAOvB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAQ7F;AAED,2DAA2D;AAC3D,MAAM,WAAW,YAAY;IAC3B,gGAAgG;IAChG,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,yFAAyF;IACzF,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,kEAAkE;IAClE,KAAK,EAAE,UAAU,EAAE,CAAA;IACnB;;;;OAIG;IACH,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;;OAKG;IACH,IAAI,EAAE,cAAc,CAAA;IACpB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;CACtB;AAED,2EAA2E;AAC3E,MAAM,WAAW,eAAe;IAC9B,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAA;IACb,uEAAuE;IACvE,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IACxB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC7B;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAA;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,GAAE,SAAS,MAAM,EAAO,GAAG,YAAY,EAAE,CAE7F;AAsPD,uGAAuG;AACvG,MAAM,MAAM,gBAAgB,GAAG,YAAY,GAAG,QAAQ,CAAA;AA0BtD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAI1E;AA+FD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,MAAM,EACX,UAAU,GAAE,SAAS,eAAe,EAAO,GAC1C,MAAM,GAAG,IAAI,CAoCf;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,MAAM,EACX,QAAQ,GAAE,SAAS,MAAM,EAAO,EAChC,GAAG,CAAC,EAAE;IACJ,OAAO,EAAE,MAAM,CAAA;IACf,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,GAAG,CAAC,EAAE,SAAS,aAAa,EAAE,CAAA;CAC/B,EACD,UAAU,GAAE,SAAS,eAAe,EAAO;AAC3C;;;;;GAKG;AACH,cAAc,GAAE,SAAS,MAAM,EAAO,GACrC,MAAM,GAAG,IAAI,CAkHf;AA+GD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,GAAG,CAAC,EAAE,SAAS,aAAa,EAAE,CAAA;CAAE,EAC9F,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,QAAQ,GAAE,SAAS,MAAM,EAAO,GAC/B,MAAM,GAAG,IAAI,CAiBf;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,gBAAgB,EACvB,CAAC,EAAE;IACD,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,CAAC,EAAE,cAAc,GAAG,IAAI,CAAA;IACjC,GAAG,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,SAAS,aAAa,EAAE,CAAA;KAAE,CAAA;IACvE,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAC7B,GACA,MAAM,CAuIR;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,MAAM,GAAG,IAAI,CAsCf;AAED,qEAAqE;AACrE,eAAO,MAAM,eAAe,QAA0C,CAAA;AAEtE;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgB7D;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE;IACxC,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;CACjB,GAAG,MAAM,GAAG,IAAI,CAKhB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CACvB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAChB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAgBvC"}
+{"version":3,"file":"utilities.d.ts","sourceRoot":"","sources":["../src/utilities.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAYH,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAE3E,OAAO,EACL,KAAK,mBAAmB,EAExB,KAAK,aAAa,EAMnB,MAAM,oBAAoB,CAAA;AAE3B;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAS5C;AAED;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,GAAI,GAAG,MAAM,KAAG,MAEE,CAAA;AAuGhD;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAK/C;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAErD;AAaD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAKhF;AAgFD;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE7D;AAyFD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGnD;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,GAAG,MAAM,CAUpF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAElE;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQnE;AAuDD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,8BAA8B,0CAA0C,CAAA;AAsBrF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,mBAAmB,GAC5B;IACD,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CA0NA;AA+BD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAQ5D;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA8BpE;AAuBD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,SAAS,MAAM,EAAE,GACvB;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAsC3D;AAKD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,CA8BtC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG;IACpD,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CACvB,CAEA;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAG/D;AAuJD,wEAAwE;AACxE,MAAM,WAAW,gBAAgB;IAC/B,0BAA0B;IAC1B,OAAO,EAAE,MAAM,CAAA;IACf,6FAA6F;IAC7F,OAAO,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,CAkC3E;AAED,oFAAoF;AACpF,MAAM,WAAW,yBAAyB;IACxC;;;OAGG;IACH,KAAK,EAAE,OAAO,CAAA;IACd;;;;;OAKG;IACH,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,yBAAyB,CAkBpF;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEjE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAalC;AA6HD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA4BlE;AAID;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAQrE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAOxE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAQpD;AAED;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,KAAK,CAAA;AAE7C;;;GAGG;AACH,eAAO,MAAM,eAAe,QAEQ,CAAA;AAEpC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAiBhE;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGvD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGpD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAU/D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAGxD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,GACX,MAAM,CAKR;AAkCD;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIvE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAU1E;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI9E;AAID,yCAAyC;AACzC,eAAO,MAAM,aAAa,QAAkB,CAAA;AAC5C,8CAA8C;AAC9C,eAAO,MAAM,cAAc,QAAmB,CAAA;AAC9C,kDAAkD;AAClD,eAAO,MAAM,eAAe,QAAa,CAAA;AACzC;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,KAAK,CAAA;AAE1C;;;;;;;;;;;;GAYG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CA6BhG;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAY5E;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,KAAK,CAAA;AAEtC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,mBAAmB,QAAS,CAAA;AAEzC;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,OAAQ,CAAA;AAE/C;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,qBAAqB,QAAmD,CAAA;AAErF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,QAAwB,CAAA;AAE3D;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,qBAAqB,QAAY,CAAA;AAE9C,qEAAqE;AACrE,eAAO,MAAM,sBAAsB,MAAM,CAAA;AAKzC,6EAA6E;AAC7E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,SAAa,GAAG,MAAM,GAAG,IAAI,CAyC3E;AAED,0BAA0B;AAC1B,eAAO,MAAM,kBAAkB,KAAK,CAAA;AACpC,wBAAwB;AACxB,eAAO,MAAM,gBAAgB,MAAM,CAAA;AAEnC;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,mHAW/B,CAAA;AAEV;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAG7D;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAOnE;AAmFD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAiBjD;AAED,kEAAkE;AAClE,eAAO,MAAM,qBAAqB,KAAK,CAAA;AAEvC,qEAAqE;AACrE,eAAO,MAAM,kBAAkB,OAAO,CAAA;AAEtC;;;GAGG;AACH,eAAO,MAAM,uBAAuB,0KAC4G,CAAA;AAEhJ;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAM3E;AAED,gEAAgE;AAChE,eAAO,MAAM,0BAA0B,QAAS,CAAA;AAEhD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAGrE;AAED;;;GAGG;AACH,eAAO,MAAM,qBAAqB,IAAI,CAAA;AAEtC,0DAA0D;AAC1D,MAAM,WAAW,UAAU;IACzB,gGAAgG;IAChG,KAAK,EAAE,MAAM,CAAA;IACb,iEAAiE;IACjE,KAAK,EAAE,MAAM,CAAA;IACb,qFAAqF;IACrF,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CACvB;AAED,0DAA0D;AAC1D,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAA;IACb,0FAA0F;IAC1F,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,sFAAsF;IACtF,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,sDAAsD;IACtD,KAAK,EAAE,UAAU,EAAE,CAAA;CACpB;AA6TD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CA+CrE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAWhE;AAED,2FAA2F;AAC3F,eAAO,MAAM,wBAAwB,IAAI,CAAA;AAEzC;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,OAAO,CAAA;AAErC;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,QAA2B,CAAA;AAE5D;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,KAAK,CAAA;AAKvC,oFAAoF;AACpF,eAAO,MAAM,0BAA0B,IAAI,CAAA;AA8D3C;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,IAAI,CAAA;AAEtC,oFAAoF;AACpF,MAAM,WAAW,cAAc;IAC7B,wCAAwC;IACxC,KAAK,EAAE,MAAM,CAAA;IACb,6EAA6E;IAC7E,KAAK,EAAE,MAAM,EAAE,CAAA;IACf;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,IAAI,CAAA;IACzB,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;OAIG;IACH,KAAK,CAAC,EAAE,UAAU,EAAE,CAAA;CACrB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,sBAAsB,IAAI,CAAA;AAsIvC;;;GAGG;AACH,eAAO,MAAM,sBAAsB,IAAI,CAAA;AAuCvC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA2BhE;AA+DD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,gBAAgB,GAAG,IAAI,EAC9B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,GACtB,cAAc,GAAG,IAAI,CAiCvB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,gBAAgB,GAAG,IAAI,EAC9B,SAAS,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,GAC3C,cAAc,GAAG,IAAI,CAOvB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAQ7F;AAED,2DAA2D;AAC3D,MAAM,WAAW,YAAY;IAC3B,gGAAgG;IAChG,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,yFAAyF;IACzF,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,kEAAkE;IAClE,KAAK,EAAE,UAAU,EAAE,CAAA;IACnB;;;;OAIG;IACH,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;;OAKG;IACH,IAAI,EAAE,cAAc,CAAA;IACpB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;CACtB;AAED,2EAA2E;AAC3E,MAAM,WAAW,eAAe;IAC9B,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAA;IACb,uEAAuE;IACvE,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IACxB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC7B;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAA;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,GAAE,SAAS,MAAM,EAAO,GAAG,YAAY,EAAE,CAE7F;AAsPD,uGAAuG;AACvG,MAAM,MAAM,gBAAgB,GAAG,YAAY,GAAG,QAAQ,CAAA;AA0BtD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAI1E;AA+FD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,MAAM,EACX,UAAU,GAAE,SAAS,eAAe,EAAO,GAC1C,MAAM,GAAG,IAAI,CAoCf;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,MAAM,EACX,QAAQ,GAAE,SAAS,MAAM,EAAO,EAChC,GAAG,CAAC,EAAE;IACJ,OAAO,EAAE,MAAM,CAAA;IACf,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,GAAG,CAAC,EAAE,SAAS,aAAa,EAAE,CAAA;CAC/B,EACD,UAAU,GAAE,SAAS,eAAe,EAAO;AAC3C;;;;;GAKG;AACH,cAAc,GAAE,SAAS,MAAM,EAAO,GACrC,MAAM,GAAG,IAAI,CAkHf;AA+GD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,GAAG,CAAC,EAAE,SAAS,aAAa,EAAE,CAAA;CAAE,EAC9F,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,QAAQ,GAAE,SAAS,MAAM,EAAO,GAC/B,MAAM,GAAG,IAAI,CAiBf;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,gBAAgB,EACvB,CAAC,EAAE;IACD,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,CAAC,EAAE,cAAc,GAAG,IAAI,CAAA;IACjC,GAAG,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,SAAS,aAAa,EAAE,CAAA;KAAE,CAAA;IACvE,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAC7B,GACA,MAAM,CAmIR;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,MAAM,GAAG,IAAI,CAsCf;AAED,qEAAqE;AACrE,eAAO,MAAM,eAAe,QAA0C,CAAA;AAEtE;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgB7D;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE;IACxC,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;CACjB,GAAG,MAAM,GAAG,IAAI,CAKhB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CACvB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAChB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAgBvC"}

package/dist/utilities.js

@@ -163,8 +163,41 @@ export function redactSecrets(s) {
 export function redactSecretsInCode(s) {
     return s.replace(SECRET_ENV_ASSIGNMENT, '$1=[REDACTED]');
 }
+/**
+ * The placeholder the output filter substitutes for a hidden value. Copying it into
+ * application configuration changes the value rather than recovering it. The write
+ * tools check for added occurrences ({@link addedRedactionMask}); intentional literals
+ * require the caller's explicit per-call declaration.
+ *
+ * Only the shapes a value can take count: quoted (`'[REDACTED]'`, `"[REDACTED]"`) or
+ * assigned (`=[REDACTED]`). Prose that mentions the token is ordinary text.
+ */
+const REDACTION_MASK = /'\[REDACTED\]'|"\[REDACTED\]"|=[ \t]*\[REDACTED\]/g;
+/**
+ * The redaction mask `next` adds over `previous`, or null when it adds none.
+ *
+ * `previous` is the file's previous content for `write_file`, and the replacement's own
+ * `old_string` for `edit_file` — an edit that carries an existing mask through (a file that
+ * already had one, read back and rewritten) adds no occurrence. A new occurrence may
+ * be copied output or intentional source; the caller declares the latter explicitly.
+ *
+ * @param next - The content about to be written (or the replacement's `new_string`).
+ * @param previous - The content it replaces, already on disk (or the `old_string`).
+ * @returns The added mask as written (`'[REDACTED]'`, `"[REDACTED]"`, `=[REDACTED]`), or null.
+ */
+export function addedRedactionMask(next, previous) {
+    const before = previous.match(REDACTION_MASK)?.length ?? 0;
+    const after = next.match(REDACTION_MASK) ?? [];
+    if (after.length <= before)
+        return null;
+    return after[before] ?? after[0] ?? '[REDACTED]';
+}
 /** Source-file extensions a printing command's output is read as code for. */
 const SOURCE_FILE_RE = /\.(?:[cm]?[jt]sx?|css|scss|html|vue|svelte|md|sql|hurl)$/;
+/** Programs whose output is file NAMES or counts, never another file's content. */
+const INSPECTION_PROGRAMS = new Set(['find', 'ls', 'wc']);
+/** `find` options that run a program or write a file — not read-only inspection. */
+const FIND_NOT_INSPECTION = /^-(?:exec|execdir|ok|okdir|delete|fls|fprint|fprint0|fprintf)/;
 /**
  * A literal argument, not a shell expansion. The shared parser owns statement boundaries;
  * this deliberately small word grammar only decides whether an argument can read other data.
@@ -253,9 +286,46 @@ function sourcePrintFiles(program, args) {
  * @returns True when the command prints source files, with only literal headings and filters.
  */
 export function printsOnlySource(command) {
+    return printsOnly(command, false);
+}
+/**
+ * Whether a shell command only INSPECTS the workspace WITHOUT printing a file's contents:
+ * it prints source files (a pure literal read, {@link printsOnlySource}), lists names
+ * (`ls`, `find`), or counts lines (`wc`) — joined by `;`, `&&` or `|`, with literal
+ * `echo`/`printf` headings and `cd`.
+ *
+ * Its output is code or names, not an env dump, so it gets the code-safe redaction
+ * ({@link redactSecretsInCode}) instead of the name-keyed env-dump passes. Without this,
+ * ordinary code values such as `tokenKey: 'jwtToken'` in a mixed source read and
+ * `ls | head` command would be masked by the environment-dump rules.
+ *
+ * A RECURSIVE SEARCH IS NOT INSPECTION (`grep -rn x .`, `rg x src/`): its output is the
+ * content of whichever files matched, including `.env` files and JSON secret dumps, so it
+ * keeps the full grade. A path with no extension is not evidence that it is a directory —
+ * `/dev/stdin` and an ordinary `secrets` file read the same way.
+ *
+ * Env dumps keep the full grade: `.env` anywhere in the command, `env`/`printenv`, a
+ * non-literal or redirecting form, and an interpreter one-liner (`node -e`, `python -c`)
+ * all return false.
+ *
+ * @param command - The shell command.
+ * @returns True when the command only reads or lists workspace content.
+ */
+export function isReadOnlyInspection(command) {
+    return printsOnly(command, true);
+}
+/**
+ * The one segment grammar both grades share: literal words only, no wrapper or group, no
+ * backgrounding, and every byte between segments a separator.
+ *
+ * @param command - The shell command.
+ * @param inspection - Also accept name/count listing (`ls`, `find`, `wc`).
+ * @returns True when every segment is allowed and at least one prints something.
+ */
+function printsOnly(command, inspection) {
     if (/\.env\b/.test(command))
         return false;
-    let readsSource = false;
+    let prints = false;
     let previousEnd = 0;
     for (const located of locatedCommandSegments(command)) {
         const { segment, start, end, programOffset, separator, terminator } = located;
@@ -302,6 +372,13 @@ export function printsOnlySource(command) {
                 return false;
             }
         }
+        else if (inspection && INSPECTION_PROGRAMS.has(program) && separator !== '|') {
+            // Names and counts only — nothing here can be another file's content. `find` is the
+            // exception that can run a program or write a file.
+            if (program === 'find' && args.some((arg) => FIND_NOT_INSPECTION.test(arg)))
+                return false;
+            prints = true;
+        }
         else {
             const filter = separator === '|';
             if (!(filter ? /^(?:head|tail|sort|uniq|wc|cut|nl|grep)$/ : /^(?:cat|head|tail|nl|sed|grep|rg)$/).test(program)) {
@@ -319,11 +396,11 @@ export function printsOnlySource(command) {
                     !files.every((file) => !file.startsWith('-') && SOURCE_FILE_RE.test(file))) {
                     return false;
                 }
-                readsSource = true;
+                prints = true;
             }
         }
     }
-    return readsSource && /^[\s;]*$/.test(command.slice(previousEnd));
+    return prints && /^[\s;]*$/.test(command.slice(previousEnd));
 }
 /**
  * Whether a path is an env file, for which {@link redactSecrets}' full env-dump
@@ -3980,11 +4057,8 @@ export function repeatingFailureNote(found, o) {
             `repeats this one cause. Stop it and fix that cause first: \`exec_command: ${o.stop}\`, ` +
             `then run the whole suite again. It is still going (${where}).${reproduce}`);
     }
-    // Everything else is a note on a run the wait is still waiting for, and both its shapes end the
-    // same way: the run finishes, because it is the only thing that names the causes this finding is
-    // not. What it does NOT carry is the "Stop it if every test fails this way" clause — that one
-    // belongs to a PROVEN cause the run is still walking (the sentence below), never to a lead:
-    // xr-molecule-flash-m99's executor read it on a shared duration and voided the run.
+    // The same predicate controls both an early return and stop advice. Without
+    // that verdict, neither a repeated error nor a shared duration asks for a stop.
     const keepGoing = `Let the rest of the run finish — it is the only thing that will name the causes that are NOT ` +
         `this one, and a run stopped at its first repeating cause costs a second whole run to find ` +
         `them. It is still going (${where}).`;
@@ -3992,10 +4066,9 @@ export function repeatingFailureNote(found, o) {
         return (`${found.count} different tests in this run have already failed the same way — ${signature} — ` +
             `so one cause is repeating:\n${rows}${more}\n` +
             (o.editsInvalidateRun
-                ? `Work out the fix now: apply it when the run ends, not while it walks. Stop it only if every test it walks `
-                : `Start fixing it now, while the run keeps walking. Stop it only if every test it walks `) +
-            `fails this same way (the app unreachable, a 5xx on every request, the same selector timing ` +
-            `out on every test of every file so far).${reproduce} ${keepGoing}${thenRun}`);
+                ? `Work out the fix now: apply it when the run ends, not while it walks.`
+                : `Start fixing it now, while the run keeps walking.`) +
+            `${reproduce} ${keepGoing}${thenRun}`);
     return (`${found.count} different tests in this run each failed after ~${found.seconds}s — the same ` +
         `duration to within half a second. A shared duration is a lead, not a cause: a suite whose ` +
         `config sets a timeout spends that timeout on every failure that waits for anything, so ` +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@molecule/api-ai-tools",
-  "version": "1.11.1",
+  "version": "1.12.0",
   "description": "Shared AI agent tools with backend abstraction for sandbox and local execution",
   "type": "module",
   "main": "dist/index.js",