@monoes/monomindcli 2.11.9 → 2.11.11

package/dist/src/ui/routes-monoes.mjs

@@ -11,6 +11,11 @@
 import crypto from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
+import {
+  buildMonoesMcpEntry,
+  detectMonoesTokenLeak,
+  formatMonoesLeakWarning,
+} from '../mcp/monoes-mcp-entry.mjs';
 
 const MONOES_BASE_URL = process.env.MONOMIND_MONOES_URL || 'https://monoes.me';
 const MONOES_SCOPE = 'community:read community:write offline_access';
@@ -22,6 +27,25 @@ const MONOES_SCOPE = 'community:read community:write offline_access';
 const _pendingStates = new Map();
 const STATE_TTL_MS = 10 * 60 * 1000;
 
+// i-066 reviewer finding 4: detectMonoesTokenLeak() shells out to git;
+// throttle it to at most once per this interval per process instead of
+// once per dashboard status poll (the leak condition changes on the order
+// of "never", not per poll — see the /api/monoes/status handler below).
+let _lastLeakCheckAt = 0;
+const _leakCheckIntervalMs = 60_000;
+
+// i-066 follow-up finding 10 [MINOR]: this module-level throttle is shared
+// across every test in the same file (the module is imported once per test
+// file, not reset between `it()` blocks) — an earlier test's status poll
+// can silently suppress a later test's leak check for up to
+// _leakCheckIntervalMs of real time, for a reason unrelated to what that
+// later test is actually asserting. Test-only escape hatch so tests can
+// reset it in beforeEach instead of reaching for fake timers to defeat a
+// throttle they don't otherwise need to think about.
+export function __resetMonoesLeakThrottle() {
+  _lastLeakCheckAt = 0;
+}
+
 function _connectionFile(monomindHome) {
   return path.join(monomindHome, '.monomind', 'monoes-connection.json');
 }
@@ -90,19 +114,14 @@ async function _getOrRegisterClientId(monomindHome, redirectUri) {
   return clientId;
 }
 
-function _buildMonoesMcpEntry(accessToken) {
-  return {
-    type: 'http',
-    url: `${MONOES_BASE_URL}/api/mcp`,
-    headers: { Authorization: `Bearer ${accessToken}` },
-  };
-}
-
 /** Merges (or removes) the `monoes` entry in the project's existing
  * .mcp.json. Only touches that one key — never creates or rewrites the
  * rest of the file, since .mcp.json is otherwise owned by `init`/the user.
- * No-ops if .mcp.json doesn't exist yet (nothing to merge into). */
-function _syncMonoesMcpEntry(projectDir, accessToken) {
+ * No-ops if .mcp.json doesn't exist yet (nothing to merge into).
+ * `hasConnection` is a boolean, not a token — the entry is a local stdio
+ * proxy (mcp/monoes-proxy.ts) that resolves the Authorization header itself
+ * at request time, so there is no token to embed here at all. */
+function _syncMonoesMcpEntry(projectDir, hasConnection) {
   const mcpPath = path.join(projectDir, '.mcp.json');
   let config;
   try {
@@ -111,8 +130,8 @@ function _syncMonoesMcpEntry(projectDir, accessToken) {
     return;
   }
   config.mcpServers = config.mcpServers || {};
-  if (accessToken) {
-    config.mcpServers.monoes = _buildMonoesMcpEntry(accessToken);
+  if (hasConnection) {
+    config.mcpServers.monoes = buildMonoesMcpEntry();
   } else {
     delete config.mcpServers.monoes;
   }
@@ -244,7 +263,7 @@ export async function handleMonoesRoutes(req, res, url, corsOrigin, ctx) {
         expiresAt: Date.now() + (tokenData.expires_in || 3600) * 1000,
         connectedUsername: me.username || null,
       });
-      _syncMonoesMcpEntry(path.resolve(projectDir || process.cwd()), tokenData.access_token);
+      _syncMonoesMcpEntry(path.resolve(projectDir || process.cwd()), !!tokenData.access_token);
 
       closeTab('Connected to monoes.me — you can close this tab.');
     } catch (err) {
@@ -255,21 +274,86 @@ export async function handleMonoesRoutes(req, res, url, corsOrigin, ctx) {
 
   // ---------------------------------------------------- GET /api/monoes/status
   // Polled on every dashboard load — piggybacks the silent-refresh check so
-  // .mcp.json's embedded access token self-heals (refreshed or removed)
-  // roughly as often as the dashboard is opened, instead of only on the
-  // explicit connect/disconnect actions.
+  // .mcp.json's entry self-heals (added/removed/migrated) roughly as often
+  // as the dashboard is opened, instead of only on the explicit
+  // connect/disconnect actions. Since the entry no longer embeds a token
+  // (it's a stdio proxy that resolves the header itself — see
+  // mcp/monoes-mcp-entry.mjs), a refresh that only changes the *value* of
+  // the token no longer requires a re-sync; only a change in *whether*
+  // .mcp.json's actual current entry matches the actual current connection
+  // state does (checked directly against the file, so this self-heals even
+  // if .mcp.json drifted from the connection for some other reason — a hand
+  // edit, a stale/missing file, etc). Reviewer i-066 finding 2: "matches"
+  // must be shape-aware, not presence-aware — a pre-fix entry that still
+  // carries a literal `headers`/`type: 'http'` bearer shape counts as
+  // needing a re-sync too, or a connected user whose .mcp.json already
+  // leaked the token is warned forever but never migrated.
   if (req.method === 'GET' && url === '/api/monoes/status') {
     const beforeConn = readMonoesConnection(MONOMIND_HOME);
     const validToken = /* value */ beforeConn?.accessToken
       ? await getValidMonoesToken(MONOMIND_HOME)
       : null;
     const afterConn = readMonoesConnection(MONOMIND_HOME);
-    if (validToken !== (beforeConn?.accessToken || null)) {
-      _syncMonoesMcpEntry(path.resolve(projectDir || process.cwd()), validToken);
+    const isConnected = !!validToken;
+
+    const resolvedProjectDir = path.resolve(projectDir || process.cwd());
+    let entry;
+    try {
+      const currentMcp = JSON.parse(
+        fs.readFileSync(path.join(resolvedProjectDir, '.mcp.json'), 'utf8'),
+      );
+      entry = currentMcp?.mcpServers?.monoes;
+    } catch {
+      entry = undefined; // No .mcp.json, or unreadable — nothing to sync into; _syncMonoesMcpEntry no-ops too.
+    }
+    const hasEntry = !!entry;
+    // i-066 reviewer finding 8 [BLOCKER]: `'headers' in entry` throws a
+    // TypeError when entry isn't an object — a realistic shape for a file
+    // designed to be committed and merged (a typo, a hand edit, a bad merge
+    // resolution can leave mcpServers.monoes as a string/number/boolean/
+    // array). That throw would escape this handler uncaught, and
+    // ui/server.mjs's http.createServer callback has no enclosing
+    // try/catch, so it would kill the whole dashboard process. Guard with
+    // an explicit object check first — a non-object (or array) value is
+    // simply non-conforming, so it self-heals via the normal re-sync path
+    // instead of crashing.
+    const isObjectEntry = typeof entry === 'object' && entry !== null && !Array.isArray(entry);
+    const isConformingEntry = isObjectEntry && !('headers' in entry) && entry.type !== 'http';
+
+    // i-066 §3.5: if this project already leaked the token (a legacy literal
+    // bearer entry still in .mcp.json, or monoes-connection.json tracked by
+    // git), warn loudly on every status poll rather than migrating silently.
+    // Reviewer i-066 finding 4: detectMonoesTokenLeak() shells out to git —
+    // throttle to at most once per _leakCheckIntervalMs per process rather
+    // than spawning a subprocess on every single-threaded-server poll; the
+    // condition it detects changes on the order of "never", not per poll.
+    //
+    // Reviewer i-066 finding U5 [BLOCKER]: this MUST run and be SNAPSHOTTED
+    // before _syncMonoesMcpEntry below. detectMonoesTokenLeak() re-reads
+    // .mcp.json from disk, and _syncMonoesMcpEntry rewrites that same file —
+    // running the leak check after the migration inspects the
+    // ALREADY-MIGRATED file and always finds nothing. A connected victim's
+    // first-ever poll would migrate the token out of the file silently and
+    // never warn that it may already be committed and on teammates'
+    // machines — the exact silent-failure mode this warning exists to
+    // prevent. Compute (and throttle) the check here; only print it after
+    // the migration has actually happened, so one poll does both.
+    const now = Date.now();
+    let leakWarning = null;
+    if (now - _lastLeakCheckAt > _leakCheckIntervalMs) {
+      _lastLeakCheckAt = now;
+      leakWarning = formatMonoesLeakWarning(await detectMonoesTokenLeak(resolvedProjectDir));
+    }
+
+    if (isConnected !== hasEntry || (hasEntry && !isConformingEntry)) {
+      _syncMonoesMcpEntry(resolvedProjectDir, isConnected);
     }
+
+    if (leakWarning) console.error(leakWarning);
+
     _json(res, corsOrigin, 200, {
-      connected: !!validToken,
-      username: validToken ? afterConn?.connectedUsername || null : null,
+      connected: isConnected,
+      username: isConnected ? afterConn?.connectedUsername || null : null,
     });
     return true;
   }
@@ -277,7 +361,7 @@ export async function handleMonoesRoutes(req, res, url, corsOrigin, ctx) {
   // ------------------------------------------------ POST /api/monoes/disconnect
   if (req.method === 'POST' && url === '/api/monoes/disconnect') {
     _deleteMonoesConnection(MONOMIND_HOME);
-    _syncMonoesMcpEntry(path.resolve(projectDir || process.cwd()), null);
+    _syncMonoesMcpEntry(path.resolve(projectDir || process.cwd()), false);
     _json(res, corsOrigin, 200, { connected: false });
     return true;
   }

package/dist/src/utils/redaction.d.ts

@@ -19,6 +19,23 @@ export declare function redactSecrets(text: string): string;
  * `<user>`'s neighborhood correctly), and secret-pattern stripping runs
  * before that path collapse too (a secret string that happens to look
  * path-like should still hit the secret patterns first).
+ *
+ * i-116-redact: secret-pattern stripping now runs BEFORE stripSsnAndPhone(),
+ * not after. This is a hardening change, not a fix to any currently-shipped
+ * behaviour — verified (reviewer, through the real shipped redact()) that
+ * both orders leak identically for every pattern that existed before this
+ * item. The shipped keyword patterns use a permissive value class
+ * (`[^\s'"]`), which still matches through a `<phone>`/`<ssn>` placeholder,
+ * so going second never broke them. This item's new self-identifying-prefix
+ * patterns use restrictive classes (e.g. `[A-Za-z0-9-]`) that a placeholder
+ * falls outside of, so a value with a phone-shaped digit run in the middle
+ * (Slack's `xoxb-<team-id>-<bot-id>-<secret>`, where the IDs are always
+ * numeric) would have its PII-mangled remainder no longer match — the
+ * secret suffix would then survive, untouched, in the final output. Secrets
+ * must get first pass at the text: a cosmetic PII transform must never be
+ * able to defeat a security transform, independent of which patterns exist
+ * today, because the next pattern added after this one would inherit the
+ * same latent hazard otherwise.
  */
 export declare function redact(text: string): string;
 //# sourceMappingURL=redaction.d.ts.map

package/dist/src/utils/redaction.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../../../src/utils/redaction.ts"],"names":[],"mappings":"AAgKA;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMhD;AAED,4DAA4D;AAC5D,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAO9C;AAED,iFAAiF;AACjF,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAElD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAY3C"}
+{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../../../src/utils/redaction.ts"],"names":[],"mappings":"AA4LA;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMhD;AAED,4DAA4D;AAC5D,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAO9C;AAED,iFAAiF;AACjF,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAElD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAY3C"}

package/dist/src/utils/redaction.js

@@ -62,15 +62,43 @@ function stripSsnAndPhone(text) {
     return out;
 }
 const SECRET_PATTERNS = [
-    /(?:api[_-]?key|apikey)\s*[:=]\s*['"]?[^\s'"]{8,}['"]?/gi,
-    /(?:secret|password|passwd|pwd)\s*[:=]\s*['"]?[^\s'"]{8,}['"]?/gi,
-    /(?:token|bearer)\s*[:=]\s*['"]?[^\s'"]{10,}['"]?/gi,
+    // i-116-redact: `['"]?` inserted before `\s*[:=]` in these three so a
+    // quoted JSON key (`"accessToken":`, `"apiKey":`, `"secret":`) matches —
+    // previously the quote sat between the keyword and the colon and none of
+    // these fired on real JSON at all, the single most common shape.
+    /(?:api[_-]?key|apikey)['"]?\s*[:=]\s*['"]?[^\s'"]{8,}['"]?/gi,
+    /(?:secret|password|passwd|pwd)['"]?\s*[:=]\s*['"]?[^\s'"]{8,}['"]?/gi,
+    /(?:token|bearer)['"]?\s*[:=]\s*['"]?[^\s'"]{10,}['"]?/gi,
+    // i-116-redact: delimiterless header shape (`Authorization: Bearer <tok>`)
+    // has no `:`/`=` between "bearer" and the value at all — a space only —
+    // so none of the three keyword patterns above ever fired on it.
+    /\bbearer\s+['"]?[^\s'"]{10,}['"]?/gi,
     /-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/g,
     /sk-ant-[a-zA-Z0-9_-]{20,}/g,
     /sk-[a-zA-Z0-9_-]{20,}/g,
-    /ghp_[a-zA-Z0-9]{36}/g,
-    /gho_[a-zA-Z0-9]{36}/g,
-    /npm_[a-zA-Z0-9]{36}/g,
+    // i-116-redact: self-identifying credential prefixes — the prefix itself
+    // carries the specificity, so a generous length bound costs nothing (it
+    // only widens what's caught, never what's falsely caught) and needs no
+    // keyword or delimiter at all. Replaces the old exact-{36} ghp_/gho_/npm_
+    // patterns, which only matched a conformant classic-format value and
+    // missed GitHub's current fine-grained format (`github_pat_`) entirely —
+    // the credential most likely to be present, since crash-reporter.ts files
+    // issues to GitHub.
+    //
+    // Deliberately NOT `\b`-anchored (review finding 1, round 2): the old
+    // ghp_/gho_/npm_ patterns these replace had no boundary assertion either,
+    // and adding one narrows coverage relative to what it replaces — a value
+    // glued directly onto a preceding word character (`Xghp_<36 chars>`, e.g.
+    // a log line with no separator before the token) would stop matching.
+    // The prefix plus the length bound already supplies all the specificity
+    // a `\b` would add; dropping it costs no precision and is measurably
+    // faster (no boundary check per candidate position).
+    /gh[pousr]_[A-Za-z0-9]{20,}/g, // GitHub classic PAT/OAuth/user/server/refresh
+    /github_pat_[A-Za-z0-9_]{20,}/g, // GitHub fine-grained (current format)
+    /glpat-[A-Za-z0-9_-]{16,}/g, // GitLab
+    /xox[abprs]-[A-Za-z0-9-]{10,}/g, // Slack (bot/app/admin/refresh/other)
+    /sk_(?:live|test)_[A-Za-z0-9]{16,}/g, // Stripe
+    /npm_[A-Za-z0-9]{20,}/g, // npm, widened from {36}
     /AKIA[0-9A-Z]{16}/g,
     /eyJ[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]{10,}/g, // JWT
     /[a-zA-Z][a-zA-Z0-9+.-]*:\/\/[^:\s]+:[^@\s]+@[^\s'"]+/g, // user:pass@host connection strings
@@ -173,6 +201,23 @@ export function redactSecrets(text) {
  * `<user>`'s neighborhood correctly), and secret-pattern stripping runs
  * before that path collapse too (a secret string that happens to look
  * path-like should still hit the secret patterns first).
+ *
+ * i-116-redact: secret-pattern stripping now runs BEFORE stripSsnAndPhone(),
+ * not after. This is a hardening change, not a fix to any currently-shipped
+ * behaviour — verified (reviewer, through the real shipped redact()) that
+ * both orders leak identically for every pattern that existed before this
+ * item. The shipped keyword patterns use a permissive value class
+ * (`[^\s'"]`), which still matches through a `<phone>`/`<ssn>` placeholder,
+ * so going second never broke them. This item's new self-identifying-prefix
+ * patterns use restrictive classes (e.g. `[A-Za-z0-9-]`) that a placeholder
+ * falls outside of, so a value with a phone-shaped digit run in the middle
+ * (Slack's `xoxb-<team-id>-<bot-id>-<secret>`, where the IDs are always
+ * numeric) would have its PII-mangled remainder no longer match — the
+ * secret suffix would then survive, untouched, in the final output. Secrets
+ * must get first pass at the text: a cosmetic PII transform must never be
+ * able to defeat a security transform, independent of which patterns exist
+ * today, because the next pattern added after this one would inherit the
+ * same latent hazard otherwise.
  */
 export function redact(text) {
     const home = homedir();
@@ -180,8 +225,8 @@ export function redact(text) {
     out = stripGenericUserPrefixes(out);
     out = stripIPv4(out);
     out = stripEmail(out);
-    out = stripSsnAndPhone(out);
     out = stripSecretPatterns(out);
+    out = stripSsnAndPhone(out);
     out = collapseAbsolutePaths(out);
     out = stripHostnames(out);
     out = stripIPv6(out);

package/dist/src/utils/redaction.js.map

@@ -1 +1 @@
-{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../../../src/utils/redaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,2EAA2E;AAC3E,+DAA+D;AAE/D,SAAS,gBAAgB,CAAC,IAAY,EAAE,IAAY;IAClD,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,IAAI,IAAI;QAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE1C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IACvC,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,MAAM,QAAQ,KAAK,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,0EAA0E;AAC1E,2EAA2E;AAC3E,yEAAyE;AACzE,yDAAyD;AACzD,SAAS,wBAAwB,CAAC,IAAY;IAC5C,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAC;IACtD,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,EAAE,eAAe,CAAC,CAAC;IACxD,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,sBAAsB,EAAE,mBAAmB,CAAC,CAAC;IAC/D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,IAAI,CAAC,OAAO,CAAC,8BAA8B,EAAE,MAAM,CAAC,CAAC;AAC9D,CAAC;AAED,6EAA6E;AAC7E,2EAA2E;AAC3E,uEAAuE;AACvE,uEAAuE;AACvE,qEAAqE;AACrE,uEAAuE;AACvE,wEAAwE;AACxE,0EAA0E;AAC1E,0EAA0E;AAC1E,uEAAuE;AACvE,2EAA2E;AAC3E,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,CAAC,OAAO,CACjB,qGAAqG,EACrG,SAAS,CACV,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAC;IACrD,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,8DAA8D,EAAE,SAAS,CAAC,CAAC;IAC7F,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,eAAe,GAAa;IAChC,yDAAyD;IACzD,iEAAiE;IACjE,oDAAoD;IACpD,qHAAqH;IACrH,4BAA4B;IAC5B,wBAAwB;IACxB,sBAAsB;IACtB,sBAAsB;IACtB,sBAAsB;IACtB,mBAAmB;IACnB,gEAAgE,EAAE,MAAM;IACxE,uDAAuD,EAAE,oCAAoC;CAC9F,CAAC;AAEF,SAAS,mBAAmB,CAAC,IAAY;IACvC,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,OAAO,IAAI,eAAe;QAAE,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAChF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sEAAsE;AACtE,qEAAqE;AACrE,qEAAqE;AACrE,6EAA6E;AAC7E,SAAS,qBAAqB,CAAC,IAAY;IACzC,OAAO,IAAI,CAAC,OAAO,CACjB,oFAAoF,EACpF,WAAW,CACZ,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GACnB,gIAAgI,CAAC;AAEnI,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,0EAA0E;IAC1E,GAAG,GAAG,GAAG,CAAC,OAAO,CACf,oGAAoG,EACpG,UAAU,CACX,CAAC;IACF,wEAAwE;IACxE,yEAAyE;IACzE,sEAAsE;IACtE,EAAE;IACF,qEAAqE;IACrE,0EAA0E;IAC1E,gEAAgE;IAChE,oEAAoE;IACpE,oEAAoE;IACpE,yEAAyE;IACzE,kEAAkE;IAClE,yEAAyE;IACzE,yEAAyE;IACzE,sEAAsE;IACtE,0EAA0E;IAC1E,yEAAyE;IACzE,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,8DAA8D,EAAE,CAAC,KAAK,EAAE,EAAE;QAC1F,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,UAAU;QAC3D,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,WAAW;QAC1D,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,UAAU;QACzD,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,wBAAwB;QAChF,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,yDAAyD;IACzD,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,gDAAgD,EAAE,UAAU,CAAC,CAAC;IAChF,oFAAoF;IACpF,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,gEAAgE,EAAE,QAAQ,CAAC,CAAC;IAC9F,+DAA+D;IAC/D,0EAA0E;IAC1E,+CAA+C;IAC/C,GAAG,GAAG,GAAG,CAAC,OAAO,CACf,0FAA0F,EAC1F,QAAQ,CACT,CAAC;IACF,0DAA0D;IAC1D,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,mEAAmE,EAAE,QAAQ,CAAC,CAAC;IACjG,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,GAAG,GAAG,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACvC,GAAG,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;IACpC,GAAG,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,IAAI,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1B,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IACtB,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC5B,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAC1B,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IACrB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,MAAM,CAAC,IAAY;IACjC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,GAAG,GAAG,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACvC,GAAG,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;IACpC,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IACrB,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IACtB,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC5B,GAAG,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAC/B,GAAG,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IACjC,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAC1B,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IACrB,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../../../src/utils/redaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,2EAA2E;AAC3E,+DAA+D;AAE/D,SAAS,gBAAgB,CAAC,IAAY,EAAE,IAAY;IAClD,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,IAAI,IAAI;QAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE1C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IACvC,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,MAAM,QAAQ,KAAK,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,0EAA0E;AAC1E,2EAA2E;AAC3E,yEAAyE;AACzE,yDAAyD;AACzD,SAAS,wBAAwB,CAAC,IAAY;IAC5C,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAC;IACtD,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,EAAE,eAAe,CAAC,CAAC;IACxD,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,sBAAsB,EAAE,mBAAmB,CAAC,CAAC;IAC/D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,IAAI,CAAC,OAAO,CAAC,8BAA8B,EAAE,MAAM,CAAC,CAAC;AAC9D,CAAC;AAED,6EAA6E;AAC7E,2EAA2E;AAC3E,uEAAuE;AACvE,uEAAuE;AACvE,qEAAqE;AACrE,uEAAuE;AACvE,wEAAwE;AACxE,0EAA0E;AAC1E,0EAA0E;AAC1E,uEAAuE;AACvE,2EAA2E;AAC3E,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,CAAC,OAAO,CACjB,qGAAqG,EACrG,SAAS,CACV,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAC;IACrD,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,8DAA8D,EAAE,SAAS,CAAC,CAAC;IAC7F,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,eAAe,GAAa;IAChC,sEAAsE;IACtE,yEAAyE;IACzE,yEAAyE;IACzE,iEAAiE;IACjE,8DAA8D;IAC9D,sEAAsE;IACtE,yDAAyD;IACzD,2EAA2E;IAC3E,wEAAwE;IACxE,gEAAgE;IAChE,qCAAqC;IACrC,qHAAqH;IACrH,4BAA4B;IAC5B,wBAAwB;IACxB,yEAAyE;IACzE,wEAAwE;IACxE,uEAAuE;IACvE,0EAA0E;IAC1E,qEAAqE;IACrE,yEAAyE;IACzE,0EAA0E;IAC1E,oBAAoB;IACpB,EAAE;IACF,sEAAsE;IACtE,0EAA0E;IAC1E,yEAAyE;IACzE,0EAA0E;IAC1E,sEAAsE;IACtE,wEAAwE;IACxE,qEAAqE;IACrE,qDAAqD;IACrD,6BAA6B,EAAE,+CAA+C;IAC9E,+BAA+B,EAAE,uCAAuC;IACxE,2BAA2B,EAAE,SAAS;IACtC,+BAA+B,EAAE,sCAAsC;IACvE,oCAAoC,EAAE,SAAS;IAC/C,uBAAuB,EAAE,yBAAyB;IAClD,mBAAmB;IACnB,gEAAgE,EAAE,MAAM;IACxE,uDAAuD,EAAE,oCAAoC;CAC9F,CAAC;AAEF,SAAS,mBAAmB,CAAC,IAAY;IACvC,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,OAAO,IAAI,eAAe;QAAE,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAChF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sEAAsE;AACtE,qEAAqE;AACrE,qEAAqE;AACrE,6EAA6E;AAC7E,SAAS,qBAAqB,CAAC,IAAY;IACzC,OAAO,IAAI,CAAC,OAAO,CACjB,oFAAoF,EACpF,WAAW,CACZ,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GACnB,gIAAgI,CAAC;AAEnI,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,0EAA0E;IAC1E,GAAG,GAAG,GAAG,CAAC,OAAO,CACf,oGAAoG,EACpG,UAAU,CACX,CAAC;IACF,wEAAwE;IACxE,yEAAyE;IACzE,sEAAsE;IACtE,EAAE;IACF,qEAAqE;IACrE,0EAA0E;IAC1E,gEAAgE;IAChE,oEAAoE;IACpE,oEAAoE;IACpE,yEAAyE;IACzE,kEAAkE;IAClE,yEAAyE;IACzE,yEAAyE;IACzE,sEAAsE;IACtE,0EAA0E;IAC1E,yEAAyE;IACzE,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,8DAA8D,EAAE,CAAC,KAAK,EAAE,EAAE;QAC1F,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,UAAU;QAC3D,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,WAAW;QAC1D,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,UAAU;QACzD,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,wBAAwB;QAChF,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,yDAAyD;IACzD,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,gDAAgD,EAAE,UAAU,CAAC,CAAC;IAChF,oFAAoF;IACpF,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,gEAAgE,EAAE,QAAQ,CAAC,CAAC;IAC9F,+DAA+D;IAC/D,0EAA0E;IAC1E,+CAA+C;IAC/C,GAAG,GAAG,GAAG,CAAC,OAAO,CACf,0FAA0F,EAC1F,QAAQ,CACT,CAAC;IACF,0DAA0D;IAC1D,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,mEAAmE,EAAE,QAAQ,CAAC,CAAC;IACjG,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,GAAG,GAAG,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACvC,GAAG,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;IACpC,GAAG,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,IAAI,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1B,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IACtB,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC5B,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAC1B,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IACrB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,MAAM,CAAC,IAAY;IACjC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,GAAG,GAAG,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACvC,GAAG,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;IACpC,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IACrB,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IACtB,GAAG,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAC/B,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC5B,GAAG,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IACjC,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAC1B,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IACrB,OAAO,GAAG,CAAC;AACb,CAAC"}