@nodatachat/mcp 1.3.16 → 1.3.17

package/dist/index.js

@@ -1,32 +1,33 @@
 #!/usr/bin/env node
-/*! @nodatachat/mcp 1.3.16 | Copyright 2026 Capsule Ltd. | FSL-1.1-ALv2 | see LICENSE.md */
+/*! @nodatachat/mcp 1.3.17 | Copyright 2026 Capsule Ltd. | FSL-1.1-ALv2 | see LICENSE.md */
 import{createRequire as __ndReq}from"node:module";const require=__ndReq(import.meta.url);
-var ed=Object.create;var ji=Object.defineProperty;var td=Object.getOwnPropertyDescriptor;var nd=Object.getOwnPropertyNames;var rd=Object.getPrototypeOf,od=Object.prototype.hasOwnProperty;var C=(e=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(e,{get:(t,n)=>(typeof require<"u"?require:t)[n]}):e)(function(e){if(typeof require<"u")return require.apply(this,arguments);throw Error('Dynamic require of "'+e+'" is not supported')});var M=(e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports);var id=(e,t,n,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of nd(t))!od.call(e,o)&&o!==n&&ji(e,o,{get:()=>t[o],enumerable:!(r=td(t,o))||r.enumerable});return e};var Lr=(e,t,n)=>(n=e!=null?ed(rd(e)):{},id(t||!e||!e.__esModule?ji(n,"default",{value:e,enumerable:!0}):n,e));var so=M(oe=>{"use strict";Object.defineProperty(oe,"__esModule",{value:!0});oe.MAX_SEALED_BYTES=void 0;oe.kidForPublicKey=As;oe.deriveKeyPairFromSeed=yu;oe.generateSeed=_u;oe.buildEnvInfo=bu;oe.sealDek=vu;oe.openSealedDek=ku;oe.decodeSealHeader=Ts;var Ss=C("crypto"),ws=C("@hpke/core"),pu=C("@hpke/dhkem-x25519"),fu=C("@hpke/chacha20poly1305"),hu=C("@noble/curves/ed25519.js"),mu=C("@noble/hashes/hkdf.js"),gu=C("@noble/hashes/sha2.js"),Kn=new ws.CipherSuite({kem:new pu.DhkemX25519HkdfSha256,kdf:new ws.HkdfSha256,aead:new fu.Chacha20Poly1305}),Es=1,xs=1;oe.MAX_SEALED_BYTES=4096;function As(e){return(0,Ss.createHash)("sha256").update(e).digest("hex").slice(0,16)}function yu(e){if(e.length<16)throw new Error("seed too short (need at least 16 bytes)");let t=new TextEncoder().encode("protect.env.x25519.v1"),n=Buffer.from((0,mu.hkdf)(gu.sha256,e,new Uint8Array(0),t,32)),r=Buffer.from(hu.x25519.scalarMultBase(n));return{secretKey:n,publicKey:r,kid:As(r)}}function _u(){return(0,Ss.randomBytes)(32)}function bu(e){return Buffer.from(`protect.env.v3|${e}`,"utf8")}async function vu(e,t,n){if(e.length!==32)throw new Error("sealDek: DEK must be 32 bytes");if(t.length!==32)throw new Error("sealDek: public key must be 32 bytes");let r=await Kn.kem.deserializePublicKey(ze(t)),o=await Kn.createSenderContext({recipientPublicKey:r,info:ze(n)}),i=Buffer.from(await o.seal(ze(e),new ArrayBuffer(0))),s=Buffer.from(o.enc),a=Buffer.alloc(6+s.length+i.length);return a[0]=Es,a[1]=xs,a.writeUInt16BE(s.length,2),a.writeUInt16BE(i.length,4),s.copy(a,6),i.copy(a,6+s.length),a}async function ku(e,t,n){let r=Ts(e),o=e.subarray(6,6+r.encLen),i=e.subarray(6+r.encLen),s=await Kn.kem.deserializePrivateKey(ze(t)),a=await Kn.createRecipientContext({recipientKey:s,enc:ze(o),info:ze(n)});return Buffer.from(await a.open(ze(i)))}function Ts(e){if(e.length<6)throw new Error("sealed bytes too short");if(e.length>oe.MAX_SEALED_BYTES)throw new Error("sealed bytes too long");let t=e[0],n=e[1];if(t!==Es)throw new Error(`unsupported seal version 0x${t.toString(16)}`);if(n!==xs)throw new Error(`unsupported HPKE suite 0x${n.toString(16)}`);let r=e.readUInt16BE(2),o=e.readUInt16BE(4);if(e.length!==6+r+o)throw new Error("sealed length mismatch");if(r!==32)throw new Error("unexpected KEM enc length (X25519 is 32 bytes)");if(o<16)throw new Error("ciphertext shorter than the AEAD tag");return{ver:t,suite:n,encLen:r,ctLen:o}}function ze(e){return e.buffer.slice(e.byteOffset,e.byteOffset+e.byteLength)}});var Ps=M(Ee=>{"use strict";Object.defineProperty(Ee,"__esModule",{value:!0});Ee.V3_PREFIX=void 0;Ee.sealValue=wu;Ee.formatToken=Su;Ee.parseToken=Is;Ee.openValue=Eu;var Hn=C("crypto"),Un=so();Ee.V3_PREFIX="aes256gcm:v3:";async function wu(e,t){let n=(0,Hn.randomBytes)(32),r=(0,Hn.randomBytes)(12),o=(0,Hn.createCipheriv)("aes-256-gcm",n,r),i=Buffer.concat([o.update(e,"utf8"),o.final()]),s=Buffer.concat([i,o.getAuthTag()]),a=await(0,Un.sealDek)(n,t.publicKey,(0,Un.buildEnvInfo)(t.kid));return n.fill(0),{sealedDekB64:a.toString("base64"),iv:r,cipher:s}}function Su(e,t){return`${Ee.V3_PREFIX}${e.iv.toString("base64")}:${e.cipher.toString("base64")}:${t}`}function Is(e){let t=e.split(":");if(t.length!==5||t[0]!=="aes256gcm"||t[1]!=="v3")throw new Error("not a v3 token");let[,,n,r,o]=t;if(!o)throw new Error("v3 token has no seal id");let i=Buffer.from(n,"base64"),s=Buffer.from(r,"base64");if(i.length!==12)throw new Error("v3 token has a malformed iv");if(s.length<17)throw new Error("v3 token ciphertext is too short");return{iv:i,cipher:s,sealId:o}}async function Eu(e,t,n){let{iv:r,cipher:o}=Is(e),i=await(0,Un.openSealedDek)(Buffer.from(t,"base64"),n.secretKey,(0,Un.buildEnvInfo)(n.kid)),s=o.subarray(o.length-16),a=o.subarray(0,o.length-16),c=(0,Hn.createDecipheriv)("aes-256-gcm",i,r);c.setAuthTag(s);try{return Buffer.concat([c.update(a),c.final()]).toString("utf8")}finally{i.fill(0)}}});var Cs=M(Z=>{"use strict";var xu=Z&&Z.__createBinding||(Object.create?(function(e,t,n,r){r===void 0&&(r=n);var o=Object.getOwnPropertyDescriptor(t,n);(!o||("get"in o?!t.__esModule:o.writable||o.configurable))&&(o={enumerable:!0,get:function(){return t[n]}}),Object.defineProperty(e,r,o)}):(function(e,t,n,r){r===void 0&&(r=n),e[r]=t[n]})),Au=Z&&Z.__setModuleDefault||(Object.create?(function(e,t){Object.defineProperty(e,"default",{enumerable:!0,value:t})}):function(e,t){e.default=t}),co=Z&&Z.__importStar||(function(){var e=function(t){return e=Object.getOwnPropertyNames||function(n){var r=[];for(var o in n)Object.prototype.hasOwnProperty.call(n,o)&&(r[r.length]=o);return r},e(t)};return function(t){if(t&&t.__esModule)return t;var n={};if(t!=null)for(var r=e(t),o=0;o<r.length;o++)r[o]!=="default"&&xu(n,t,r[o]);return Au(n,t),n}})();Object.defineProperty(Z,"__esModule",{value:!0});Z.deviceKeyPath=Iu;Z.hasDeviceKey=Pu;Z.loadDeviceKey=$u;Z.createDeviceKey=Ru;Z.importDeviceKey=Du;Z.exportSeedHex=Cu;Z.deviceKeyIsExposed=Nu;var te=co(C("fs")),Tu=co(C("os")),$s=co(C("path")),Kt=so(),ao=$s.join(Tu.homedir(),".nodata"),W=$s.join(ao,"device-key.json");function Iu(){return W}function Rs(){let e=process.env.NODATA_DEVICE_SEED;if(!e)return null;let t=e.trim();if(!/^[0-9a-fA-F]{64}$/.test(t))throw new Error("NODATA_DEVICE_SEED must be 64 hex characters (32 bytes)");return Buffer.from(t,"hex")}function Pu(){return Rs()!==null||te.existsSync(W)}function $u(){let e=Rs();if(e)return(0,Kt.deriveKeyPairFromSeed)(e);if(!te.existsSync(W))return null;let t;try{t=JSON.parse(te.readFileSync(W,"utf-8"))}catch{throw new Error(`Device key file is unreadable: ${W}`)}if(!t.seed_hex||!/^[0-9a-f]{64}$/i.test(t.seed_hex))throw new Error(`Device key file is malformed (bad seed): ${W}`);let n=(0,Kt.deriveKeyPairFromSeed)(Buffer.from(t.seed_hex,"hex"));if(t.kid&&t.kid!==n.kid)throw new Error(`Device key file is inconsistent: stored kid ${t.kid} does not match the seed (${n.kid}).`);return n}function Ru(e={}){if(te.existsSync(W)&&!e.force)throw new Error(`A device key already exists at ${W}. Replacing it makes every existing v3 seal unopenable. Back up the seed first (nodata key export), then pass --force.`);let t=(0,Kt.generateSeed)(),n=(0,Kt.deriveKeyPairFromSeed)(t);return Ds(t,n),n}function Du(e,t={}){let n=e.trim().replace(/\s+/g,"");if(!/^[0-9a-fA-F]{64}$/.test(n))throw new Error("Seed must be 64 hex characters (32 bytes).");if(te.existsSync(W)&&!t.force)throw new Error(`A device key already exists at ${W}. Pass --force to replace it.`);let r=Buffer.from(n,"hex"),o=(0,Kt.deriveKeyPairFromSeed)(r);return Ds(r,o),o}function Cu(){if(!te.existsSync(W))throw new Error("No device key file to export.");return JSON.parse(te.readFileSync(W,"utf-8")).seed_hex}function Ds(e,t){te.existsSync(ao)||te.mkdirSync(ao,{recursive:!0});let n={version:1,kid:t.kid,pubkey_hex:t.publicKey.toString("hex"),seed_hex:e.toString("hex"),created_at:new Date().toISOString()};te.writeFileSync(W,JSON.stringify(n,null,2)+`
-`,{mode:384});try{te.chmodSync(W,384)}catch{}}function Nu(){if(process.platform==="win32"||!te.existsSync(W))return!1;try{return(te.statSync(W).mode&63)!==0}catch{return!1}}});var fo=M(ne=>{"use strict";var Ou=ne&&ne.__createBinding||(Object.create?(function(e,t,n,r){r===void 0&&(r=n);var o=Object.getOwnPropertyDescriptor(t,n);(!o||("get"in o?!t.__esModule:o.writable||o.configurable))&&(o={enumerable:!0,get:function(){return t[n]}}),Object.defineProperty(e,r,o)}):(function(e,t,n,r){r===void 0&&(r=n),e[r]=t[n]})),ju=ne&&ne.__setModuleDefault||(Object.create?(function(e,t){Object.defineProperty(e,"default",{enumerable:!0,value:t})}):function(e,t){e.default=t}),Ns=ne&&ne.__importStar||(function(){var e=function(t){return e=Object.getOwnPropertyNames||function(n){var r=[];for(var o in n)Object.prototype.hasOwnProperty.call(n,o)&&(r[r.length]=o);return r},e(t)};return function(t){if(t&&t.__esModule)return t;var n={};if(t!=null)for(var r=e(t),o=0;o<r.length;o++)r[o]!=="default"&&Ou(n,t,r[o]);return ju(n,t),n}})();Object.defineProperty(ne,"__esModule",{value:!0});ne.ensureDeviceKey=Lu;ne.sealFile=Bu;ne.readManifest=Os;ne.openFile=Fu;ne.writeLocalReceipt=Mu;var lo=C("crypto"),Re=C("fs"),Ht=C("path"),uo=Ns(Ps()),po=Ns(Cs());function Lu(){let e=po.loadDeviceKey();return e?{key:e,created:!1}:{key:po.createDeviceKey(),created:!0}}async function Bu(e,t,n){let r=(0,Re.readFileSync)(e),o=(0,lo.createHash)("sha256").update(r).digest("hex"),i=n??"local-"+(0,lo.randomUUID)(),s=await uo.sealValue(r.toString("base64"),t),a={v:3,alg:"aes256gcm:v3",kid:t.kid,orig:(0,Ht.basename)(e),enc:"base64",token:uo.formatToken(s,i),sealed_dek:s.sealedDekB64,sha256:o,sealed_at:new Date().toISOString()},c=e+".ndc";return(0,Re.writeFileSync)(c,JSON.stringify(a,null,2)+`
-`,{mode:384}),{path:e,ndc:c,sha256:o,sealId:i}}function Os(e){try{let t=JSON.parse((0,Re.readFileSync)(e,"utf8"));return t.alg==="aes256gcm:v3"&&t.token&&t.sealed_dek?t:null}catch{return null}}async function Fu(e,t){if(!(0,Re.existsSync)(e))return{ok:!1,error:"not_found"};let n=Os(e);if(!n)return{ok:!1,error:"not_a_seal"};let r=t===void 0?po.loadDeviceKey():t;if(!r)return{ok:!1,error:"no_device_key"};let o;try{o=await uo.openValue(n.token,n.sealed_dek,r)}catch{return{ok:!1,error:"wrong_key"}}let i=Buffer.from(o,"base64"),s=e.endsWith(".ndc")?e.slice(0,-4):e+".opened";(0,Re.existsSync)(s)&&(s=s+".opened"),(0,Re.writeFileSync)(s,i);let a=(0,lo.createHash)("sha256").update(i).digest("hex")===n.sha256;return{ok:!0,outPath:s,sha256:n.sha256,intact:a}}function Mu(e,t){let n=(0,Ht.join)(e,".nodata","receipts");(0,Re.mkdirSync)(n,{recursive:!0});let r={action:t.action,at:new Date().toISOString(),governed:"local",device_kid:t.kid,removed_plaintext:t.removed_plaintext,files:t.files.map(i=>({path:(0,Ht.relative)(e,i.path),sha256:i.sha256,seal_id:i.sealId,sealed:(0,Ht.basename)(i.ndc)})),...t.extra??{}},o=(0,Ht.join)(n,`${t.action}-${Date.now()}.json`);return(0,Re.writeFileSync)(o,JSON.stringify(r,null,2)+`
-`),o}});var Ye=M(Po=>{"use strict";Object.defineProperty(Po,"__esModule",{value:!0});var Yt=class{static async generateKeyPair(){let t=await crypto.subtle.generateKey({name:"RSA-OAEP",modulusLength:4096,publicExponent:new Uint8Array([1,0,1]),hash:"SHA-256"},!0,["encrypt","decrypt"]),n=await crypto.subtle.exportKey("jwk",t.publicKey),r=await crypto.subtle.exportKey("jwk",t.privateKey);return{publicKeyJwk:n,privateKeyJwk:r}}static async encryptMessage(t,n){let r=await crypto.subtle.importKey("jwk",n,{name:"RSA-OAEP",hash:"SHA-256"},!1,["encrypt"]),o=await crypto.subtle.generateKey({name:"AES-GCM",length:256},!0,["encrypt","decrypt"]),i=crypto.getRandomValues(new Uint8Array(12)),s=new TextEncoder().encode(t),a=await crypto.subtle.encrypt({name:"AES-GCM",iv:i,tagLength:128},o,s),c=await crypto.subtle.exportKey("raw",o),l=await crypto.subtle.encrypt({name:"RSA-OAEP"},r,c);return{encrypted_blob:this.arrayBufferToBase64(a),encrypted_aes_key:this.arrayBufferToBase64(l),iv:this.arrayBufferToBase64(i)}}static async decryptMessage(t,n){let r=await crypto.subtle.importKey("jwk",n,{name:"RSA-OAEP",hash:"SHA-256"},!1,["decrypt"]),o=this.base64ToArrayBuffer(t.encrypted_aes_key),i=await crypto.subtle.decrypt({name:"RSA-OAEP"},r,o),s=await crypto.subtle.importKey("raw",i,{name:"AES-GCM",length:256},!1,["decrypt"]),a=this.base64ToArrayBuffer(t.iv),c=this.base64ToArrayBuffer(t.encrypted_blob),l=await crypto.subtle.decrypt({name:"AES-GCM",iv:a,tagLength:128},s,c);return new TextDecoder().decode(l)}static async encryptFile(t,n){let r=await t.arrayBuffer(),o=await crypto.subtle.generateKey({name:"AES-GCM",length:256},!0,["encrypt","decrypt"]),i=crypto.getRandomValues(new Uint8Array(12)),s=await crypto.subtle.encrypt({name:"AES-GCM",iv:i,tagLength:128},o,r),a=JSON.stringify({name:t.name,type:t.type,size:t.size,lastModified:t.lastModified}),c=crypto.getRandomValues(new Uint8Array(12)),l=await crypto.subtle.encrypt({name:"AES-GCM",iv:c,tagLength:128},o,new TextEncoder().encode(a)),u=await crypto.subtle.importKey("jwk",n,{name:"RSA-OAEP",hash:"SHA-256"},!1,["encrypt"]),p=await crypto.subtle.exportKey("raw",o),f=await crypto.subtle.encrypt({name:"RSA-OAEP"},u,p);return{encrypted_file:this.arrayBufferToBase64(s),encrypted_file_key:this.arrayBufferToBase64(f),iv:this.arrayBufferToBase64(i),encrypted_metadata:this.arrayBufferToBase64(l),metadata_iv:this.arrayBufferToBase64(c),encrypted_size:s.byteLength}}static async importKeyFromFragment(t){let n=t.replace(/-/g,"+").replace(/_/g,"/"),r=this.base64ToArrayBuffer(n.padEnd(Math.ceil(n.length/4)*4,"="));if(r.byteLength!==32)throw new Error("channel key must be 32 bytes");return crypto.subtle.importKey("raw",r,{name:"AES-GCM",length:256},!1,["encrypt","decrypt"])}static async deriveKeyFromOTP(t,n,r="SHA-512"){let o=await crypto.subtle.importKey("raw",new TextEncoder().encode(t),"PBKDF2",!1,["deriveBits","deriveKey"]);return await crypto.subtle.deriveKey({name:"PBKDF2",salt:new TextEncoder().encode(n),iterations:31e4,hash:r},o,{name:"AES-GCM",length:256},!0,["encrypt","decrypt"])}static async encryptWithDerivedKey(t,n){let r=crypto.getRandomValues(new Uint8Array(12)),o=new TextEncoder().encode(t),i=await crypto.subtle.encrypt({name:"AES-GCM",iv:r,tagLength:128},n,o);return{encrypted:this.arrayBufferToBase64(i),iv:this.arrayBufferToBase64(r)}}static async decryptWithDerivedKey(t,n,r){let o=this.base64ToArrayBuffer(t),i=this.base64ToArrayBuffer(n),s=await crypto.subtle.decrypt({name:"AES-GCM",iv:i,tagLength:128},r,o);return new TextDecoder().decode(s)}static async sha256Hex(t){let n=t instanceof Uint8Array?t.buffer.slice(t.byteOffset,t.byteOffset+t.byteLength):t,r=await crypto.subtle.digest("SHA-256",n);return Array.from(new Uint8Array(r)).map(o=>o.toString(16).padStart(2,"0")).join("")}static async encryptFileWithDerivedKey(t,n){let r=await t.arrayBuffer(),o=await this.sha256Hex(r),i=crypto.getRandomValues(new Uint8Array(12)),s=await crypto.subtle.encrypt({name:"AES-GCM",iv:i,tagLength:128},n,r),a=JSON.stringify({name:t.name,type:t.type,size:t.size,lastModified:t.lastModified}),c=crypto.getRandomValues(new Uint8Array(12)),l=await crypto.subtle.encrypt({name:"AES-GCM",iv:c,tagLength:128},n,new TextEncoder().encode(a));return{encrypted_file:this.arrayBufferToBase64(s),iv:this.arrayBufferToBase64(i),encrypted_metadata:this.arrayBufferToBase64(l),metadata_iv:this.arrayBufferToBase64(c),encrypted_size:s.byteLength,plaintext_sha256:o,ciphertext_sha256:await this.sha256Hex(s)}}static async decryptFileBytesWithDerivedKey(t,n,r){let o=this.base64ToArrayBuffer(n);return crypto.subtle.decrypt({name:"AES-GCM",iv:o,tagLength:128},r,t)}static async decryptFileWithDerivedKey(t,n,r){let o=this.base64ToArrayBuffer(t),i=this.base64ToArrayBuffer(n);return crypto.subtle.decrypt({name:"AES-GCM",iv:i,tagLength:128},r,o)}static async deriveSeedKey(t,n="SHA-512"){let r=t.trim().toLowerCase(),o=await crypto.subtle.importKey("raw",new TextEncoder().encode(r),"PBKDF2",!1,["deriveBits","deriveKey"]);return await crypto.subtle.deriveKey({name:"PBKDF2",salt:new TextEncoder().encode(this.SEED_SALT),iterations:this.PBKDF2_ITERATIONS,hash:n},o,{name:"AES-GCM",length:256},!1,["encrypt","decrypt"])}static async exportKeyWithSeed(t,n){let r=await crypto.subtle.exportKey("jwk",t),o=new TextEncoder().encode(JSON.stringify(r)),i=crypto.getRandomValues(new Uint8Array(12)),s=await crypto.subtle.encrypt({name:"AES-GCM",iv:i,tagLength:128},n,o),a=new Uint8Array(i.byteLength+s.byteLength);return a.set(i,0),a.set(new Uint8Array(s),i.byteLength),a.buffer}static async importKeyWithSeed(t,n){let r=new Uint8Array(t),o=r.slice(0,12),i=r.slice(12),s=await crypto.subtle.decrypt({name:"AES-GCM",iv:o,tagLength:128},n,i),a=new TextDecoder().decode(s),c=JSON.parse(a),l=await crypto.subtle.importKey("jwk",c,{name:"RSA-OAEP",hash:"SHA-256"},!0,["decrypt"]);return new Uint8Array(s).fill(0),l}static async hashPhone(t){let n=new TextEncoder().encode(t.replace(/\D/g,"")),r=await crypto.subtle.digest("SHA-256",n);return Array.from(new Uint8Array(r)).map(o=>o.toString(16).padStart(2,"0")).join("")}static arrayBufferToBase64(t){let n=new Uint8Array(t),r=32768,o=[];for(let i=0;i<n.length;i+=r)o.push(String.fromCharCode(...n.subarray(i,i+r)));return btoa(o.join(""))}static async encryptFileToBytesWithDerivedKey(t,n){let r=await t.arrayBuffer(),o=await this.sha256Hex(r),i=crypto.getRandomValues(new Uint8Array(12)),s=await crypto.subtle.encrypt({name:"AES-GCM",iv:i,tagLength:128},n,r),a=JSON.stringify({name:t.name,type:t.type,size:t.size,lastModified:t.lastModified}),c=crypto.getRandomValues(new Uint8Array(12)),l=await crypto.subtle.encrypt({name:"AES-GCM",iv:c,tagLength:128},n,new TextEncoder().encode(a));return{ciphertext:s,iv:this.arrayBufferToBase64(i),encrypted_metadata:this.arrayBufferToBase64(l),metadata_iv:this.arrayBufferToBase64(c),encrypted_size:s.byteLength,plaintext_sha256:o,ciphertext_sha256:await this.sha256Hex(s)}}static base64ToArrayBuffer(t){let n=atob(t),r=new Uint8Array(n.length);for(let o=0;o<n.length;o++)r[o]=n.charCodeAt(o);return r.buffer}static wipeFromMemory(t){new Uint8Array(t).fill(0)}};Yt.PBKDF2_ITERATIONS=31e4;Yt.SEED_SALT="NoDataChat-Seed-v1";Po.default=Yt});var xa=M(Xn=>{"use strict";Object.defineProperty(Xn,"__esModule",{value:!0});Xn.solveProofOfWork=Np;Xn.verifyProofOfWork=Op;function Cp(e){let t=new Uint8Array(e),n="";for(let r=0;r<t.length;r++)n+=t[r].toString(16).padStart(2,"0");return n}async function Ea(e){let t=new TextEncoder().encode(e),n=await crypto.subtle.digest("SHA-256",t);return Cp(n)}async function Np(e,t=4){if(t<1||t>16)throw new Error("Difficulty must be between 1 and 16");let n="0".repeat(t),r=0;for(;;){let o=e+r.toString(),i=await Ea(o);if(i.startsWith(n))return{nonce:r,hash:i};if(r++,r>2e9)throw new Error("Proof of work exceeded maximum attempts")}}async function Op(e,t,n=4){if(n<1||n>16)return!1;let r="0".repeat(n),o=e+t.toString();return(await Ea(o)).startsWith(r)}});var Ro=M(_t=>{"use strict";var jp=_t&&_t.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(_t,"__esModule",{value:!0});_t.NoDataEmail=void 0;var ye=jp(Ye()),$o=class{static async seal(t,n,r,o,i,s={}){let{encrypt_subject:a=!0,ttl_hours:c=72,attachments:l=[]}=s,u=await ye.default.encryptMessage(o,i),p=r,f=!1;if(a){let _=await ye.default.encryptMessage(r,i);p=JSON.stringify(_),f=!0}let h=[];for(let _ of l){let y=await ye.default.encryptFile(_,i);h.push({encrypted_file:y})}return{from_alias:t,to:n,subject:p,subject_encrypted:f,body:u,attachments:h,sealed_at:new Date().toISOString(),ttl_hours:c,envelope_id:crypto.randomUUID(),crypto_version:"0.2.0"}}static async open(t,n){let r=await ye.default.decryptMessage(t.body,n),o=t.subject;if(t.subject_encrypted){let s=JSON.parse(t.subject);o=await ye.default.decryptMessage(s,n)}let i=[];for(let s of t.attachments){let{encrypted_file:a}=s,c=ye.default.base64ToArrayBuffer(a.metadata_iv),l=ye.default.base64ToArrayBuffer(a.encrypted_metadata),u=ye.default.base64ToArrayBuffer(a.encrypted_file_key),p=await crypto.subtle.importKey("jwk",n,{name:"RSA-OAEP",hash:"SHA-256"},!1,["decrypt"]),f=await crypto.subtle.decrypt({name:"RSA-OAEP"},p,u),h=await crypto.subtle.importKey("raw",f,{name:"AES-GCM",length:256},!1,["decrypt"]),_=await crypto.subtle.decrypt({name:"AES-GCM",iv:c,tagLength:128},h,l),y=JSON.parse(new TextDecoder().decode(_)),k=ye.default.base64ToArrayBuffer(a.iv),E=ye.default.base64ToArrayBuffer(a.encrypted_file),R=await crypto.subtle.decrypt({name:"AES-GCM",iv:k,tagLength:128},h,E);i.push({filename:y.name,mime_type:y.type,data:R,size:y.size})}return{subject:o,body:r,attachments:i,sealed_at:t.sealed_at,ttl_hours:t.ttl_hours,envelope_id:t.envelope_id}}static isExpired(t){let r=new Date(t.sealed_at).getTime()+t.ttl_hours*60*60*1e3;return Date.now()>r}static toMimeBody(t,n){let r=JSON.stringify(t),o=btoa(unescape(encodeURIComponent(r)));return['Content-Type: multipart/mixed; boundary="nodata-boundary"',"","--nodata-boundary","Content-Type: text/html; charset=utf-8","",'<div style="font-family:system-ui;padding:24px;text-align:center">',"<h2>This email is encrypted with Capsule</h2>","<p>The sender used end-to-end encryption. To read this message:</p>",`<a href="${n}?env=${t.envelope_id}" `,'style="display:inline-block;padding:12px 24px;background:#000;color:#fff;','border-radius:8px;text-decoration:none;font-weight:600">',"Open Encrypted Email</a>",'<p style="color:#888;font-size:12px;margin-top:16px">',"Powered by Capsule &mdash; Nothing is ever stored. Ever.</p>","</div>","--nodata-boundary",'Content-Type: application/x-nodata-envelope; name="envelope.nodata"',"Content-Transfer-Encoding: base64",'Content-Disposition: attachment; filename="envelope.nodata"',"",o,"--nodata-boundary--"].join(`\r
-`)}};_t.NoDataEmail=$o});var No=M(bt=>{"use strict";var Lp=bt&&bt.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(bt,"__esModule",{value:!0});bt.NoDataWebhook=void 0;var Do=Lp(Ye()),Co=class{static async encrypt(t,n,r,o){let{event_type:i,source:s,ttl_seconds:a=3600}=o,c=JSON.stringify(t),l=await Do.default.encryptMessage(c,n),u=new Date().toISOString(),p=crypto.randomUUID(),f=`${p}.${u}.${l.encrypted_blob}`,h=await this.hmacSign(f,r);return{encrypted_event:l,event_type:i,source:s,signature:h,timestamp:u,delivery_id:p,ttl_seconds:a,crypto_version:"0.2.0"}}static async verify(t,n){let r=`${t.delivery_id}.${t.timestamp}.${t.encrypted_event.encrypted_blob}`,o=await this.hmacSign(r,n),i=new TextEncoder().encode(t.signature),s=new TextEncoder().encode(o),a=i.length^s.length,c=Math.min(i.length,s.length);for(let h=0;h<c;h++)a|=i[h]^s[h];let l=a===0,p=new Date(t.timestamp).getTime()+t.ttl_seconds*1e3,f=Date.now()>p;return{valid:l,expired:f,event_type:t.event_type,source:t.source,delivery_id:t.delivery_id}}static async decrypt(t,n){let r=await Do.default.decryptMessage(t.encrypted_event,n);return JSON.parse(r)}static async verifyAndDecrypt(t,n,r){let o=await this.verify(t,r);if(!o.valid)throw new Error(`[NoDataWebhook] Invalid signature for delivery ${o.delivery_id}`);if(o.expired)throw new Error(`[NoDataWebhook] Payload expired for delivery ${o.delivery_id}`);return{data:await this.decrypt(t,n),delivery_id:o.delivery_id,event_type:o.event_type}}static async hmacSign(t,n){let r=await crypto.subtle.importKey("raw",new TextEncoder().encode(n),{name:"HMAC",hash:"SHA-256"},!1,["sign"]),o=await crypto.subtle.sign("HMAC",r,new TextEncoder().encode(t));return Do.default.arrayBufferToBase64(o)}};bt.NoDataWebhook=Co});var jo=M(vt=>{"use strict";var Bp=vt&&vt.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(vt,"__esModule",{value:!0});vt.NoDataSystems=void 0;var Zn=Bp(Ye()),Oo=class{static async encryptRecord(t,n,r,o,i,s){let a=[],c={};for(let[l,u]of Object.entries(r))if(o.sensitive.includes(l)){let p=typeof u=="string"?u:JSON.stringify(u),f=await Zn.default.encryptMessage(p,i),h=await this.hashValue(p);a.push({value:f,search_hash:h,field_name:l,encrypted_at:new Date().toISOString()})}else c[l]=u;return{record_id:t,record_type:n,encrypted_fields:a,clear_fields:c,encrypted_by:s,created_at:new Date().toISOString(),crypto_version:"0.2.0"}}static async decryptRecord(t,n){let r={...t.clear_fields};for(let o of t.encrypted_fields){let i=await Zn.default.decryptMessage(o.value,n);try{r[o.field_name]=JSON.parse(i)}catch{r[o.field_name]=i}}return{record_id:t.record_id,record_type:t.record_type,fields:r,created_at:t.created_at}}static async searchByHash(t,n,r){let o=await this.hashValue(r);return t.filter(i=>i.encrypted_fields.some(s=>s.field_name===n&&s.search_hash===o))}static async encryptField(t,n,r){let o=typeof n=="string"?n:JSON.stringify(n),i=await Zn.default.encryptMessage(o,r),s=await this.hashValue(o);return{value:i,search_hash:s,field_name:t,encrypted_at:new Date().toISOString()}}static async decryptField(t,n){let r=await Zn.default.decryptMessage(t.value,n);try{return JSON.parse(r)}catch{return r}}static createSchema(t,n){return{sensitive:n,clear:t.filter(r=>!n.includes(r))}}static async hashValue(t){let n=`nodatachat:field:${t}`,r=new TextEncoder().encode(n),o=await crypto.subtle.digest("SHA-256",r);return Array.from(new Uint8Array(o)).map(i=>i.toString(16).padStart(2,"0")).join("")}};vt.NoDataSystems=Oo});var Bo=M(kt=>{"use strict";var Fp=kt&&kt.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(kt,"__esModule",{value:!0});kt.NoDataForms=void 0;var _e=Fp(Ye()),Lo=class{static async encryptSubmission(t,n,r,o,i={}){let{ttl_hours:s=0,view_once:a=!1,attachments:c=[]}=i,l={},u={};for(let k of n)k.sensitive!==!1?l[k.name]=k.value:u[k.name]=k.value;let p=JSON.stringify(n.map(k=>({name:k.name,value:k.value}))),f=await this.sha256(p),h=await _e.default.encryptMessage(JSON.stringify(l),r),_=[];for(let k of c){let E=await _e.default.encryptFile(k,r);_.push(E)}let y=n.map(k=>k.name);return{submission_id:crypto.randomUUID(),form_id:t,encrypted_fields:h,clear_fields:u,attachments:_,integrity_hash:f,field_order:y,submitter_id:o,submitted_at:new Date().toISOString(),ttl_hours:s,view_once:a,crypto_version:"0.2.0"}}static async decryptSubmission(t,n){let r=await _e.default.decryptMessage(t.encrypted_fields,n),o=JSON.parse(r),i={...t.clear_fields,...o},a=(t.field_order||Object.keys(i).sort()).map(p=>({name:p,value:i[p]})),l=await this.sha256(JSON.stringify(a))===t.integrity_hash,u=[];for(let p of t.attachments){let f=await crypto.subtle.importKey("jwk",n,{name:"RSA-OAEP",hash:"SHA-256"},!1,["decrypt"]),h=await crypto.subtle.decrypt({name:"RSA-OAEP"},f,_e.default.base64ToArrayBuffer(p.encrypted_file_key)),_=await crypto.subtle.importKey("raw",h,{name:"AES-GCM",length:256},!1,["decrypt"]),y=await crypto.subtle.decrypt({name:"AES-GCM",iv:_e.default.base64ToArrayBuffer(p.metadata_iv),tagLength:128},_,_e.default.base64ToArrayBuffer(p.encrypted_metadata)),k=JSON.parse(new TextDecoder().decode(y)),E=await crypto.subtle.decrypt({name:"AES-GCM",iv:_e.default.base64ToArrayBuffer(p.iv),tagLength:128},_,_e.default.base64ToArrayBuffer(p.encrypted_file));u.push({filename:k.name,mime_type:k.type,data:E,size:k.size})}return{submission_id:t.submission_id,form_id:t.form_id,fields:i,attachments:u,integrity_valid:l,submitted_at:t.submitted_at}}static isExpired(t){if(t.ttl_hours===0)return!1;let r=new Date(t.submitted_at).getTime()+t.ttl_hours*60*60*1e3;return Date.now()>r}static async encryptGrade(t,n,r,o,i=0){let s=await _e.default.encryptMessage(JSON.stringify(t),n),a=await this.sha256(`nodatachat:student:${t.student_id}`);return{encrypted_grade:s,student_hash:a,course_id:r,term:o,delivery_id:crypto.randomUUID(),delivered_at:new Date().toISOString(),ttl_hours:i,crypto_version:"0.2.0"}}static async decryptGrade(t,n){let r=await _e.default.decryptMessage(t.encrypted_grade,n);return JSON.parse(r)}static async sha256(t){let n=new TextEncoder().encode(t),r=await crypto.subtle.digest("SHA-256",n);return Array.from(new Uint8Array(r)).map(o=>o.toString(16).padStart(2,"0")).join("")}};kt.NoDataForms=Lo});var Aa=M(wt=>{"use strict";var Mp=wt&&wt.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(wt,"__esModule",{value:!0});wt.NoDataSDK=void 0;var Qn=Mp(Ye()),Ne=Ro(),Oe=No(),se=jo(),be=Bo(),Fo=class{static async init(t={}){let n;return t.keyPair?n=t.keyPair:(n=await Qn.default.generateKeyPair(),t.onKeysGenerated&&await t.onKeysGenerated(n)),{publicKey:n.publicKeyJwk,email:{seal:Ne.NoDataEmail.seal.bind(Ne.NoDataEmail),open:Ne.NoDataEmail.open.bind(Ne.NoDataEmail),isExpired:Ne.NoDataEmail.isExpired.bind(Ne.NoDataEmail),toMimeBody:Ne.NoDataEmail.toMimeBody.bind(Ne.NoDataEmail)},webhook:{encrypt:Oe.NoDataWebhook.encrypt.bind(Oe.NoDataWebhook),verify:Oe.NoDataWebhook.verify.bind(Oe.NoDataWebhook),decrypt:Oe.NoDataWebhook.decrypt.bind(Oe.NoDataWebhook),verifyAndDecrypt:Oe.NoDataWebhook.verifyAndDecrypt.bind(Oe.NoDataWebhook)},systems:{encryptRecord:se.NoDataSystems.encryptRecord.bind(se.NoDataSystems),decryptRecord:se.NoDataSystems.decryptRecord.bind(se.NoDataSystems),searchByHash:se.NoDataSystems.searchByHash.bind(se.NoDataSystems),encryptField:se.NoDataSystems.encryptField.bind(se.NoDataSystems),decryptField:se.NoDataSystems.decryptField.bind(se.NoDataSystems),createSchema:se.NoDataSystems.createSchema.bind(se.NoDataSystems)},forms:{encryptSubmission:be.NoDataForms.encryptSubmission.bind(be.NoDataForms),decryptSubmission:be.NoDataForms.decryptSubmission.bind(be.NoDataForms),isExpired:be.NoDataForms.isExpired.bind(be.NoDataForms),encryptGrade:be.NoDataForms.encryptGrade.bind(be.NoDataForms),decryptGrade:be.NoDataForms.decryptGrade.bind(be.NoDataForms)},crypto:Qn.default}}static async quickEncrypt(t,n){let r=typeof t=="string"?t:JSON.stringify(t),o=await Qn.default.encryptMessage(r,n);return JSON.stringify(o)}static async quickDecrypt(t,n){let r=JSON.parse(t),o=await Qn.default.decryptMessage(r,n);try{return JSON.parse(o)}catch{return o}}};wt.NoDataSDK=Fo});var Ta=M(ae=>{"use strict";Object.defineProperty(ae,"__esModule",{value:!0});ae.NoDataSDK=ae.NoDataForms=ae.NoDataSystems=ae.NoDataWebhook=ae.NoDataEmail=void 0;var Kp=Ro();Object.defineProperty(ae,"NoDataEmail",{enumerable:!0,get:function(){return Kp.NoDataEmail}});var Hp=No();Object.defineProperty(ae,"NoDataWebhook",{enumerable:!0,get:function(){return Hp.NoDataWebhook}});var Up=jo();Object.defineProperty(ae,"NoDataSystems",{enumerable:!0,get:function(){return Up.NoDataSystems}});var Vp=Bo();Object.defineProperty(ae,"NoDataForms",{enumerable:!0,get:function(){return Vp.NoDataForms}});var Gp=Aa();Object.defineProperty(ae,"NoDataSDK",{enumerable:!0,get:function(){return Gp.NoDataSDK}})});var Et=M(N=>{"use strict";Object.defineProperty(N,"__esModule",{value:!0});N.PQ_SIZES=N.NDC_WIRE_V03=N.NDC_WIRE_V1=N.NDC_V03_RATCHET_DOMAIN=N.NDC_V03_CONTENT_KEY_DOMAIN=N.NDC_V03_KEM_DOMAIN=N.PQ_SUITE=void 0;N.generateHybridKemKeypair=Wp;N.deriveHybridKemKeypairFromSeed=zp;N.hybridKemEncapsulate=qp;N.hybridKemDecapsulate=Jp;N.deriveContentKey=Yp;N.ratchetAdvance=Xp;N.generateHybridSigKeypair=Zp;N.hybridSign=Qp;N.hybridVerify=ef;N.generateMlDsa65Keypair=tf;N.mlDsa65SignDetached=nf;N.mlDsa65VerifyDetached=rf;var je=C("@noble/curves/ed25519.js"),Xt=C("@noble/hashes/sha2.js"),Zt=C("@noble/hashes/hkdf.js"),er=C("@noble/post-quantum/ml-kem.js"),St=C("@noble/post-quantum/ml-dsa.js");N.PQ_SUITE={KEM:"X25519+ML-KEM-768",SIG:"Ed25519+ML-DSA-65",AEAD:"AES-256-GCM",KDF:"HKDF-SHA-256"};N.NDC_V03_KEM_DOMAIN="NDC-v0.3-hybrid-kem";N.NDC_V03_CONTENT_KEY_DOMAIN="NDC-v0.3-content-key";N.NDC_V03_RATCHET_DOMAIN="NDC-ratchet";N.NDC_WIRE_V1=1;N.NDC_WIRE_V03=2;function Ia(...e){let t=0;for(let o of e)t+=o.length;let n=new Uint8Array(t),r=0;for(let o of e)n.set(o,r),r+=o.length;return n}function Qt(e){return new TextEncoder().encode(e)}function Pa(e,t,n,r){let o=Ia(e,t),i=Ia(Qt(N.NDC_V03_KEM_DOMAIN),n,r);return(0,Zt.hkdf)(Xt.sha256,o,new Uint8Array(0),i,32)}function Wp(){let{secretKey:e,publicKey:t}=je.x25519.keygen(),{publicKey:n,secretKey:r}=er.ml_kem768.keygen();return{publicKey:{x25519:t,mlKem:n},secretKey:{x25519:e,mlKem:r}}}function zp(e){if(e.length<32)throw new Error("seed too short (need >=32 bytes)");let t=(0,Zt.hkdf)(Xt.sha256,e,new Uint8Array(0),Qt("ndc-hybrid-kem-x25519-v1"),32),n=(0,Zt.hkdf)(Xt.sha256,e,new Uint8Array(0),Qt("ndc-hybrid-kem-mlkem768-v1"),64),r=je.x25519.getPublicKey(t),{publicKey:o,secretKey:i}=er.ml_kem768.keygen(n);return{publicKey:{x25519:r,mlKem:o},secretKey:{x25519:t,mlKem:i}}}function qp(e){let{secretKey:t,publicKey:n}=je.x25519.keygen(),r=je.x25519.getSharedSecret(t,e.x25519),{cipherText:o,sharedSecret:i}=er.ml_kem768.encapsulate(e.mlKem),s=Pa(i,r,n,e.x25519);return{ciphertext:{ctClassical:n,ctPq:o},sharedSecret:s,ephemeralX25519Pk:n}}function Jp(e,t,n){let r=je.x25519.getSharedSecret(e.x25519,n.ctClassical),o=er.ml_kem768.decapsulate(n.ctPq,e.mlKem);return Pa(o,r,n.ctClassical,t)}function Yp(e){return(0,Zt.hkdf)(Xt.sha256,e,new Uint8Array(0),Qt(N.NDC_V03_CONTENT_KEY_DOMAIN),32)}function Xp(e,t){return(0,Zt.hkdf)(Xt.sha256,e,t,Qt(N.NDC_V03_RATCHET_DOMAIN),32)}function Zp(){let{secretKey:e,publicKey:t}=je.ed25519.keygen(),{publicKey:n,secretKey:r}=St.ml_dsa65.keygen();return{publicKey:{ed25519:t,mlDsa:n},secretKey:{ed25519:e,mlDsa:r}}}function Qp(e,t){return{ed25519:je.ed25519.sign(t,e.ed25519),mlDsa:St.ml_dsa65.sign(t,e.mlDsa)}}function ef(e,t,n){return je.ed25519.verify(n.ed25519,t,e.ed25519)?St.ml_dsa65.verify(n.mlDsa,t,e.mlDsa):!1}function tf(){let{publicKey:e,secretKey:t}=St.ml_dsa65.keygen();return{publicKey:e,secretKey:t}}function nf(e,t){return St.ml_dsa65.sign(t,e)}function rf(e,t,n){return St.ml_dsa65.verify(n,t,e)}N.PQ_SIZES={X25519_PK:32,X25519_SK:32,ML_KEM_768_PK:1184,ML_KEM_768_SK:2400,ML_KEM_768_CT:1088,ED25519_PK:32,ED25519_SK:32,ED25519_SIG:64,ML_DSA_65_PK:1952,ML_DSA_65_SK:4032,ML_DSA_65_SIG:3309,HYBRID_SHARED_SECRET:32}});var nr=M(O=>{"use strict";Object.defineProperty(O,"__esModule",{value:!0});O.deriveContentKey=O.ContainerV3Error=O.CONTAINER_HEADER_MAX_BYTES=O.CONTAINER_FIXED_PREFIX_BYTES=O.CONTAINER_MAGIC=void 0;O.canonicalJson=tr;O.headerSigningBytes=Mo;O.signContainerHeader=Ca;O.verifyContainerHeader=Na;O.encodeContainerV3=Oa;O.decodeContainerV3=ja;O.sealHybrid=df;O.openHybrid=uf;var of=C("@noble/hashes/hkdf.js"),sf=C("@noble/hashes/sha2.js"),G=Et();Object.defineProperty(O,"deriveContentKey",{enumerable:!0,get:function(){return G.deriveContentKey}});O.CONTAINER_MAGIC=new Uint8Array([78,68,76,66]);O.CONTAINER_FIXED_PREFIX_BYTES=8;O.CONTAINER_HEADER_MAX_BYTES=16777215;var af="NDC-v0.3-wrap-key",z=class extends Error{constructor(t,n){super(n),this.name="ContainerV3Error",this.code=t}};O.ContainerV3Error=z;var Ae=e=>{if(typeof Buffer<"u")return Buffer.from(e).toString("base64");let t="";for(let n=0;n<e.length;n++)t+=String.fromCharCode(e[n]);return btoa(t)},Xe=e=>{if(typeof Buffer<"u")return new Uint8Array(Buffer.from(e,"base64"));let t=atob(e),n=new Uint8Array(t.length);for(let r=0;r<t.length;r++)n[r]=t.charCodeAt(r);return n},Da=e=>{let t="";for(let n=0;n<e.length;n++)t+=e[n].toString(16).padStart(2,"0");return t};function tr(e){if(e===null||typeof e!="object")return JSON.stringify(e);if(Array.isArray(e))return"["+e.map(tr).join(",")+"]";let t=e;return"{"+Object.keys(t).sort().map(r=>JSON.stringify(r)+":"+tr(t[r])).join(",")+"}"}function Mo(e){let t={...e};return delete t.sig,new TextEncoder().encode(tr(t))}function Ca(e,t,n){let r=(0,G.hybridSign)(n.secretKey,Mo(e));return{...e,sig:{signer_kid:t,ed25519:Ae(r.ed25519),ml_dsa_65:Ae(r.mlDsa)}}}function Na(e,t){let n={ed25519:Xe(e.sig.ed25519),mlDsa:Xe(e.sig.ml_dsa_65)};return(0,G.hybridVerify)(t,Mo(e),n)}var cf=["lockbox_id","format_version","profile","suite","server","kem","wrapped_content_key","iv","tag","bearer","dpop_required","ciphertext_sha256","issued_at","cache_ttl_seconds","original_filename","original_content_type","sig"];function lf(e){if(!e||typeof e!="object")throw new z("header_schema_mismatch","header is not an object");let t=e;for(let r of cf)if(t[r]===void 0)throw new z("header_schema_mismatch",`header missing required field: ${String(r)}`);if(t.format_version!==3)throw new z("unsupported_version",`format_version ${t.format_version} unknown`);if(t.profile!=="pq-hybrid")throw new z("suite_unknown",`profile must be 'pq-hybrid', got '${String(t.profile)}'`);let n=t.suite;if(n.kem!==G.PQ_SUITE.KEM||n.sig!==G.PQ_SUITE.SIG||n.aead!==G.PQ_SUITE.AEAD||n.kdf!==G.PQ_SUITE.KDF)throw new z("suite_unknown",`suite mismatch: viewer supports ${JSON.stringify(G.PQ_SUITE)}, header has ${JSON.stringify(n)}`)}function Oa(e,t){let n=new TextEncoder().encode(JSON.stringify(e));if(n.length>O.CONTAINER_HEADER_MAX_BYTES)throw new z("header_schema_mismatch",`header too large (${n.length} bytes; max 16 MB)`);let r=new Uint8Array(O.CONTAINER_FIXED_PREFIX_BYTES+n.length+t.length);return r.set(O.CONTAINER_MAGIC,0),r[4]=G.NDC_WIRE_V03,r[5]=n.length>>16&255,r[6]=n.length>>8&255,r[7]=n.length&255,r.set(n,O.CONTAINER_FIXED_PREFIX_BYTES),r.set(t,O.CONTAINER_FIXED_PREFIX_BYTES+n.length),r}function ja(e){if(e.length<O.CONTAINER_FIXED_PREFIX_BYTES)throw new z("header_truncated",`container truncated: ${e.length} bytes (need \u2265 ${O.CONTAINER_FIXED_PREFIX_BYTES})`);for(let o=0;o<4;o++)if(e[o]!==O.CONTAINER_MAGIC[o])throw new z("bad_magic",`bad magic: expected NDLB, got ${Da(e.slice(0,4))}`);if(e[4]!==G.NDC_WIRE_V03)throw new z("unsupported_version",`expected wire version 0x${G.NDC_WIRE_V03.toString(16)}, got 0x${e[4].toString(16)}`);let t=e[5]<<16|e[6]<<8|e[7],n=O.CONTAINER_FIXED_PREFIX_BYTES+t;if(e.length<n)throw new z("header_truncated",`header truncated: declared ${t}, only ${e.length-O.CONTAINER_FIXED_PREFIX_BYTES} bytes left`);let r;try{r=JSON.parse(new TextDecoder("utf-8").decode(e.slice(O.CONTAINER_FIXED_PREFIX_BYTES,n)))}catch(o){throw new z("header_invalid_json",`header JSON parse failed: ${o.message}`)}return lf(r),{header:r,ciphertextWithTag:e.slice(n)}}var Ze=e=>e;async function $a(e,t,n){let r=await crypto.subtle.importKey("raw",Ze(e),{name:"AES-GCM"},!1,["encrypt"]),o=await crypto.subtle.encrypt({name:"AES-GCM",iv:Ze(t)},r,Ze(n));return new Uint8Array(o)}async function Ra(e,t,n){let r=await crypto.subtle.importKey("raw",Ze(e),{name:"AES-GCM"},!1,["decrypt"]),o=await crypto.subtle.decrypt({name:"AES-GCM",iv:Ze(t)},r,Ze(n));return new Uint8Array(o)}function La(e){return(0,of.hkdf)(sf.sha256,e,new Uint8Array(0),new TextEncoder().encode(af),32)}async function Ba(e){let t=await crypto.subtle.digest("SHA-256",Ze(e));return Da(new Uint8Array(t))}async function df(e){let t=crypto.getRandomValues(new Uint8Array(32)),n=crypto.getRandomValues(new Uint8Array(12)),r=await $a(t,n,e.plaintext),o=r.slice(r.length-16),i=r.slice(0,r.length-16),s=(0,G.hybridKemEncapsulate)(e.recipientPublicKey),a=La(s.sharedSecret),c=crypto.getRandomValues(new Uint8Array(12)),l=await $a(a,c,t),u=await Ba(i),p={lockbox_id:e.meta.lockbox_id,format_version:3,profile:"pq-hybrid",suite:{kem:G.PQ_SUITE.KEM,sig:G.PQ_SUITE.SIG,aead:G.PQ_SUITE.AEAD,kdf:G.PQ_SUITE.KDF},server:e.meta.server,kem:{recipient_kid:e.recipientKid,ct_classical:Ae(s.ciphertext.ctClassical),ct_pq:Ae(s.ciphertext.ctPq),ephemeral_x25519_pk:Ae(s.ephemeralX25519Pk)},wrapped_content_key:{wrapped:Ae(l),wrap_iv:Ae(c)},iv:Ae(n),tag:Ae(o),bearer:e.meta.bearer,dpop_required:e.meta.dpop_required,ratchet_state:e.meta.ratchet_state,tee_attestation_url:e.meta.tee_attestation_url,original_filename:e.meta.original_filename,original_content_type:e.meta.original_content_type,ciphertext_sha256:u,issued_at:new Date().toISOString(),cache_ttl_seconds:e.meta.cache_ttl_seconds},f=Ca(p,e.signerKid,e.signerKeypair),h=Oa(f,r);return t.fill(0),{container:h,header:f,serverState:{lockbox_id:e.meta.lockbox_id,kem_ct_classical_b64:f.kem.ct_classical,kem_ct_pq_b64:f.kem.ct_pq,wrapped_content_key_b64:f.wrapped_content_key.wrapped,wrap_iv_b64:f.wrapped_content_key.wrap_iv}}}async function uf(e){let{header:t,ciphertextWithTag:n}=ja(e.container);if(!Na(t,e.signerPublicKey))throw new z("signature_invalid","hybrid signature verification failed");let r=n.slice(0,n.length-16),o=await Ba(r);if(o!==t.ciphertext_sha256)throw new z("integrity_mismatch",`ciphertext sha256 mismatch: expected ${t.ciphertext_sha256.slice(0,16)}\u2026, got ${o.slice(0,16)}\u2026`);let i={ctClassical:Xe(t.kem.ct_classical),ctPq:Xe(t.kem.ct_pq)},s=(0,G.hybridKemDecapsulate)(e.recipientSecretKey,e.recipientPublicX25519,i),a=La(s),c=Xe(t.wrapped_content_key.wrapped),l=Xe(t.wrapped_content_key.wrap_iv),u=await Ra(a,l,c),p=Xe(t.iv),f=await Ra(u,p,n);return u.fill(0),{plaintext:f,header:t}}});var Ho=M(At=>{"use strict";Object.defineProperty(At,"__esModule",{value:!0});At.publicJwkFromBytes=Ma;At.jwkThumbprint=Ka;At.createDpop=ff;At.verifyDpop=mf;var Fa=C("@noble/curves/ed25519.js"),pf=C("@noble/hashes/sha2.js"),xt=e=>{if(typeof Buffer<"u")return Buffer.from(e).toString("base64").replace(/=+$/,"").replace(/\+/g,"-").replace(/\//g,"_");let t="";for(let n=0;n<e.length;n++)t+=String.fromCharCode(e[n]);return btoa(t).replace(/=+$/,"").replace(/\+/g,"-").replace(/\//g,"_")},rr=e=>{let t=e.replace(/-/g,"+").replace(/_/g,"/"),n=t.length%4?4-t.length%4:0,r=t+"=".repeat(n);if(typeof Buffer<"u")return new Uint8Array(Buffer.from(r,"base64"));let o=atob(r),i=new Uint8Array(o.length);for(let s=0;s<o.length;s++)i[s]=o.charCodeAt(s);return i},en=e=>new TextEncoder().encode(e);function Ma(e){if(e.length!==32)throw new Error(`expected 32-byte Ed25519 public key, got ${e.length}`);return{kty:"OKP",crv:"Ed25519",x:xt(e)}}function Ka(e){let t=`{"crv":"${e.crv}","kty":"${e.kty}","x":"${e.x}"}`,n=(0,pf.sha256)(en(t));return xt(n)}function ff(e){let n={typ:"dpop+jwt",alg:"EdDSA",jwk:Ma(e.publicKey)},r={htm:e.htm.toUpperCase(),htu:Ko(e.htu),jti:e.jti??hf(),iat:e.iat??Math.floor(Date.now()/1e3)};e.nonce&&(r.nonce=e.nonce);let o=xt(en(JSON.stringify(n))),i=xt(en(JSON.stringify(r))),s=`${o}.${i}`,a=Fa.ed25519.sign(en(s),e.secretKey);return`${s}.${xt(a)}`}function hf(){return xt(crypto.getRandomValues(new Uint8Array(16)))}function Ko(e){try{let t=new URL(e);return`${t.protocol}//${t.host}${t.pathname}`}catch{return e}}async function mf(e,t){let n=e.split(".");if(n.length!==3)return q("malformed","expected three JWT parts");let[r,o,i]=n,s;try{s=JSON.parse(new TextDecoder().decode(rr(r)))}catch{return q("bad_header","header is not valid base64url JSON")}if(s.typ!=="dpop+jwt")return q("bad_typ",`typ must be 'dpop+jwt', got '${String(s.typ)}'`);if(s.alg!=="EdDSA")return q("bad_alg",`alg must be 'EdDSA', got '${String(s.alg)}'`);if(!s.jwk||s.jwk.kty!=="OKP"||s.jwk.crv!=="Ed25519")return q("bad_header","jwk must be an Ed25519 OKP key");let a=Ka(s.jwk);if(a!==t.expectedJkt)return q("jkt_mismatch",`jkt does not match registered key: expected ${t.expectedJkt.slice(0,12)}\u2026, got ${a.slice(0,12)}\u2026`);let c;try{c=JSON.parse(new TextDecoder().decode(rr(o)))}catch{return q("bad_payload","payload is not valid base64url JSON")}if(c.htm!==t.expectedHtm.toUpperCase())return q("htm_mismatch",`htm '${c.htm}' \u2260 expected '${t.expectedHtm.toUpperCase()}'`);if(c.htu!==Ko(t.expectedHtu))return q("htu_mismatch",`htu '${c.htu}' \u2260 expected '${Ko(t.expectedHtu)}'`);if(t.expectedNonce!==void 0&&c.nonce!==t.expectedNonce)return q("nonce_mismatch","DPoP nonce does not match server-issued nonce");let l=Math.floor(Date.now()/1e3),u=t.maxAgeSeconds??30;if(typeof c.iat!="number")return q("bad_payload","iat missing or not a number");if(c.iat>l+5)return q("iat_in_future",`iat ${c.iat} > now+skew`);if(l-c.iat>u)return q("iat_too_old",`iat ${c.iat} older than ${u}s`);let p;try{p=rr(s.jwk.x)}catch{return q("bad_header","jwk.x is not base64url")}let f=rr(i),h=en(`${r}.${o}`);return Fa.ed25519.verify(f,h,p)?await t.isJtiFresh(c.jti)?{ok:!0,jti:c.jti,iat:c.iat}:q("replay",`jti ${c.jti} was already seen`):q("signature_invalid","Ed25519 signature does not verify")}function q(e,t){return{ok:!1,code:e,reason:t}}});var qa=M(A=>{"use strict";Object.defineProperty(A,"__esModule",{value:!0});A.ABSORB_STATUS=A.DELTA_KIND=A.RCPT_TOTAL_LEN=A.RCPT_SIGNED_LEN=A.PVE_TOTAL_LEN=A.PVE_SIGNED_LEN=A.RCPT_VERSION=A.PVE_VERSION=A.RCPT_MAGIC=A.PVE_MAGIC=void 0;A.deltaIdFromUuid=bf;A.uuidFromDeltaId=vf;A.originJktForPublicKey=nn;A.encodePveSignedBytes=Va;A.signPve=kf;A.parsePve=Ga;A.pveHash=wf;A.verifyPve=Sf;A.encodeReceiptSignedBytes=Wa;A.signReceipt=Ef;A.parseReceipt=za;A.verifyReceipt=xf;var or=C("@noble/curves/ed25519.js"),gf=C("@noble/hashes/sha2.js"),Ha=Ho();A.PVE_MAGIC=new Uint8Array([80,86,69,49]);A.RCPT_MAGIC=new Uint8Array([82,67,86,49]);A.PVE_VERSION=1;A.RCPT_VERSION=1;A.PVE_SIGNED_LEN=160;A.PVE_TOTAL_LEN=A.PVE_SIGNED_LEN+64;A.RCPT_SIGNED_LEN=78;A.RCPT_TOTAL_LEN=A.RCPT_SIGNED_LEN+64;var Ua=new Uint8Array(32);A.DELTA_KIND={relay:1,ndc:2,v4section:3,chatmsg:4};A.ABSORB_STATUS={decrypted_ok:1,verified_only:2,denied:3};function yf(e){if(typeof Buffer<"u")return Buffer.from(e).toString("base64").replace(/=+$/,"").replace(/\+/g,"-").replace(/\//g,"_");let t="";for(let n=0;n<e.length;n++)t+=String.fromCharCode(e[n]);return btoa(t).replace(/=+$/,"").replace(/\+/g,"-").replace(/\//g,"_")}function _f(e){let t=e.replace(/-/g,"+").replace(/_/g,"/"),n=t.length%4?4-t.length%4:0,r=t+"=".repeat(n);if(typeof Buffer<"u")return new Uint8Array(Buffer.from(r,"base64"));let o=atob(r),i=new Uint8Array(o.length);for(let s=0;s<o.length;s++)i[s]=o.charCodeAt(s);return i}function Go(e,t){if(e.length!==t.length)return!1;let n=0;for(let r=0;r<e.length;r++)n|=e[r]^t[r];return n===0}function tn(e){for(let t=0;t<e.length;t++)if(e[t]!==0)return!1;return!0}function Uo(e){if(e==null)return Ua;if(e instanceof Uint8Array){if(e.length!==32)throw new Error(`jkt bytes must be 32, got ${e.length}`);return e}let t=_f(e);if(t.length!==32)throw new Error(`jkt must decode to 32 bytes, got ${t.length}`);return t}function Vo(e){return tn(e)?null:yf(e)}function bf(e){let t=e.replace(/-/g,"");if(t.length!==32)throw new Error(`expected a 16-byte UUID, got '${e}'`);let n=new Uint8Array(16);for(let r=0;r<16;r++)n[r]=parseInt(t.slice(r*2,r*2+2),16);return n}function vf(e){if(e.length!==16)throw new Error(`expected 16 bytes, got ${e.length}`);let t=Array.from(e,n=>n.toString(16).padStart(2,"0")).join("");return`${t.slice(0,8)}-${t.slice(8,12)}-${t.slice(12,16)}-${t.slice(16,20)}-${t.slice(20)}`}function nn(e){return(0,Ha.jwkThumbprint)((0,Ha.publicJwkFromBytes)(e))}function Va(e){if(e.deltaId.length!==16)throw new Error("delta_id must be 16 bytes");if(e.ciphertextSha256.length!==32)throw new Error("ciphertext_sha256 must be 32 bytes");if(e.classification<0||e.classification>65535)throw new Error("classification must fit in uint16");let t=new Uint8Array(A.PVE_SIGNED_LEN),n=new DataView(t.buffer),r=0;return t.set(A.PVE_MAGIC,r),r+=4,t[r]=A.PVE_VERSION,r+=1,t[r]=e.deltaKind,r+=1,t.set(e.deltaId,r),r+=16,t.set(e.ciphertextSha256,r),r+=32,t.set(Uo(e.originJkt),r),r+=32,t.set(Uo(e.destJkt??null),r),r+=32,t.set(e.prevDeltaHash??Ua,r),r+=32,n.setUint16(r,e.classification,!1),r+=2,n.setBigUint64(r,BigInt(e.issuedAt),!1),r+=8,t}function kf(e,t){let n=nn(e.originPublicKey),r=Va({deltaKind:e.deltaKind,deltaId:e.deltaId,ciphertextSha256:e.ciphertextSha256,originJkt:n,destJkt:e.destJkt??null,prevDeltaHash:e.prevDeltaHash??null,classification:e.classification,issuedAt:e.issuedAt??Date.now()}),o=or.ed25519.sign(r,t),i=new Uint8Array(A.PVE_TOTAL_LEN);return i.set(r,0),i.set(o,A.PVE_SIGNED_LEN),i}function Ga(e){if(e.length!==A.PVE_TOTAL_LEN)throw new Error(`PVE must be ${A.PVE_TOTAL_LEN} bytes, got ${e.length}`);if(!Go(e.subarray(0,4),A.PVE_MAGIC))throw new Error("bad PVE magic");let t=new DataView(e.buffer,e.byteOffset,e.byteLength),n=4,r=e[n];n+=1;let o=e[n];n+=1;let i=e.slice(n,n+16);n+=16;let s=e.slice(n,n+32);n+=32;let a=e.slice(n,n+32);n+=32;let c=e.slice(n,n+32);n+=32;let l=e.slice(n,n+32);n+=32;let u=t.getUint16(n,!1);n+=2;let p=Number(t.getBigUint64(n,!1));n+=8;let f=e.slice(0,A.PVE_SIGNED_LEN),h=e.slice(A.PVE_SIGNED_LEN,A.PVE_TOTAL_LEN),_=Vo(a);if(_===null)throw new Error("origin_jkt must not be zero");return{fields:{version:r,deltaKind:o,deltaId:i,ciphertextSha256:s,originJkt:_,destJkt:Vo(c),prevDeltaHash:tn(l)?null:l,classification:u,issuedAt:p},signedBytes:f,originSig:h,broadcast:tn(c),genesis:tn(l)}}function wf(e){return(0,gf.sha256)(e)}function Sf(e,t){let n;try{n=Ga(e)}catch(o){let i=o instanceof Error?o.message:String(o);return i.includes("magic")?{ok:!1,code:"bad_magic",reason:i}:{ok:!1,code:"malformed",reason:i}}if(n.fields.version!==A.PVE_VERSION)return{ok:!1,code:"bad_version",reason:`unsupported PVE version ${n.fields.version}`};let r;try{r=nn(t)}catch(o){return{ok:!1,code:"malformed",reason:o instanceof Error?o.message:String(o)}}return r!==n.fields.originJkt?{ok:!1,code:"jkt_mismatch",reason:`presented key thumbprint ${r.slice(0,12)}\u2026 \u2260 committed origin_jkt ${n.fields.originJkt.slice(0,12)}\u2026`}:or.ed25519.verify(n.originSig,n.signedBytes,t)?{ok:!0,parsed:n}:{ok:!1,code:"signature_invalid",reason:"Ed25519 origin signature does not verify"}}function Wa(e){if(e.pveHash.length!==32)throw new Error("pve_hash must be 32 bytes");let t=Uo(e.destJkt);if(tn(t))throw new Error("receipt dest_jkt must not be zero");let n=new Uint8Array(A.RCPT_SIGNED_LEN),r=new DataView(n.buffer),o=0;return n.set(A.RCPT_MAGIC,o),o+=4,n[o]=A.RCPT_VERSION,o+=1,n.set(e.pveHash,o),o+=32,n.set(t,o),o+=32,n[o]=e.absorbStatus,o+=1,r.setBigUint64(o,BigInt(e.absorbedAt),!1),o+=8,n}function Ef(e,t){let n=nn(e.destPublicKey),r=Wa({pveHash:e.pveHash,destJkt:n,absorbStatus:e.absorbStatus,absorbedAt:e.absorbedAt??Date.now()}),o=or.ed25519.sign(r,t),i=new Uint8Array(A.RCPT_TOTAL_LEN);return i.set(r,0),i.set(o,A.RCPT_SIGNED_LEN),i}function za(e){if(e.length!==A.RCPT_TOTAL_LEN)throw new Error(`receipt must be ${A.RCPT_TOTAL_LEN} bytes, got ${e.length}`);if(!Go(e.subarray(0,4),A.RCPT_MAGIC))throw new Error("bad receipt magic");let t=new DataView(e.buffer,e.byteOffset,e.byteLength),n=4,r=e[n];n+=1;let o=e.slice(n,n+32);n+=32;let i=e.slice(n,n+32);n+=32;let s=e[n];n+=1;let a=Number(t.getBigUint64(n,!1));n+=8;let c=Vo(i);if(c===null)throw new Error("receipt dest_jkt must not be zero");return{fields:{version:r,pveHash:o,destJkt:c,absorbStatus:s,absorbedAt:a},signedBytes:e.slice(0,A.RCPT_SIGNED_LEN),destSig:e.slice(A.RCPT_SIGNED_LEN,A.RCPT_TOTAL_LEN)}}function xf(e,t,n){let r;try{r=za(e)}catch(i){let s=i instanceof Error?i.message:String(i);return s.includes("magic")?{ok:!1,code:"bad_magic",reason:s}:{ok:!1,code:"malformed",reason:s}}if(r.fields.version!==A.RCPT_VERSION)return{ok:!1,code:"bad_version",reason:`unsupported receipt version ${r.fields.version}`};let o;try{o=nn(t)}catch(i){return{ok:!1,code:"malformed",reason:i instanceof Error?i.message:String(i)}}return o!==r.fields.destJkt?{ok:!1,code:"jkt_mismatch",reason:`presented key thumbprint ${o.slice(0,12)}\u2026 \u2260 committed dest_jkt ${r.fields.destJkt.slice(0,12)}\u2026`}:n!==void 0&&!Go(n,r.fields.pveHash)?{ok:!1,code:"pve_hash_mismatch",reason:"receipt does not acknowledge the expected PVE"}:or.ed25519.verify(r.destSig,r.signedBytes,t)?{ok:!0,parsed:r}:{ok:!1,code:"signature_invalid",reason:"Ed25519 destination signature does not verify"}}});var Ya=M(rn=>{"use strict";Object.defineProperty(rn,"__esModule",{value:!0});rn.stepRatchet=Af;rn.replayRatchet=Tf;rn.destroyKey=If;var Ja=Et();function Af(e,t){if(t.length!==32)throw new Error(`ratchet token must be 32 bytes, got ${t.length}`);return{nextContentKey:(0,Ja.ratchetAdvance)(e.contentKey,t),openCount:e.openCount+1}}function Tf(e,t){let n=[e],r=e;for(let o of t)r=(0,Ja.ratchetAdvance)(r,o),n.push(r);return n}function If(e){e.fill(0)}});var qo=M(Tt=>{"use strict";Object.defineProperty(Tt,"__esModule",{value:!0});Tt.__coseInternals=void 0;Tt.verifyCoseSign1Es384=Rf;Tt.decodeAttestationPayload=Df;var Pf=C("@noble/curves/nist.js"),$f=C("@noble/hashes/sha2.js"),Wo=class{constructor(t){this.b=t,this.p=0}u8(){if(this.p>=this.b.length)throw new Error("cbor: truncated");return this.b[this.p++]}uN(t){let n=0;for(let r=0;r<t;r++)n=n*256+this.u8();return n}len(t){if(t<24)return t;if(t===24)return this.u8();if(t===25)return this.uN(2);if(t===26)return this.uN(4);if(t===27){let n=this.uN(4),r=this.uN(4);return n*4294967296+r}throw new Error(`cbor: unsupported additional info ${t}`)}read(){let t=this.u8(),n=t>>5,r=t&31;switch(n){case 0:return this.len(r);case 1:return-1-this.len(r);case 2:{let o=this.len(r),i=this.b.subarray(this.p,this.p+o);if(i.length!==o)throw new Error("cbor: bstr truncated");return this.p+=o,i.slice()}case 3:{let o=this.len(r),i=this.b.subarray(this.p,this.p+o);if(i.length!==o)throw new Error("cbor: tstr truncated");return this.p+=o,new TextDecoder("utf-8").decode(i)}case 4:{let o=this.len(r),i=[];for(let s=0;s<o;s++)i.push(this.read());return i}case 5:{let o=this.len(r),i=new Map;for(let s=0;s<o;s++){let a=this.read(),c=this.read();i.set(a,c)}return i}case 6:return this.len(r),this.read();case 7:if(r===20)return!1;if(r===21)return!0;if(r===22||r===23)return null;throw new Error(`cbor: unsupported simple/float ${r}`);default:throw new Error(`cbor: unknown major ${n}`)}}};function zo(e){return new Wo(e).read()}function sr(e,t){let n=e<<5;return t<24?Uint8Array.of(n|t):t<=255?Uint8Array.of(n|24,t):t<=65535?Uint8Array.of(n|25,t>>8&255,t&255):Uint8Array.of(n|26,t>>>24&255,t>>16&255,t>>8&255,t&255)}function ar(...e){let t=e.reduce((o,i)=>o+i.length,0),n=new Uint8Array(t),r=0;for(let o of e)n.set(o,r),r+=o.length;return n}function ir(e){return ar(sr(2,e.length),e)}function Xa(e){let t=new TextEncoder().encode(e);return ar(sr(3,t.length),t)}function Za(e,t){return ar(sr(4,4),Xa("Signature1"),ir(e),ir(new Uint8Array(0)),ir(t))}function Rf(e,t){let n;try{n=zo(e)}catch(l){return{ok:!1,code:"malformed",reason:`cbor decode failed: ${l.message}`}}if(!Array.isArray(n)||n.length!==4)return{ok:!1,code:"bad_structure",reason:"COSE_Sign1 must be a 4-element array"};let[r,,o,i]=n;if(!(r instanceof Uint8Array))return{ok:!1,code:"bad_structure",reason:"protected header must be a byte string"};if(!(o instanceof Uint8Array)||o.length===0)return{ok:!1,code:"no_payload",reason:"detached/empty payload is not supported"};if(!(i instanceof Uint8Array))return{ok:!1,code:"bad_structure",reason:"signature must be a byte string"};if(i.length!==96)return{ok:!1,code:"bad_signature_len",reason:`expected 96-byte ES384 sig, got ${i.length}`};let s=Za(r,o),a=(0,$f.sha384)(s),c=!1;try{c=Pf.p384.verify(i,a,t,{prehash:!1})}catch(l){return{ok:!1,code:"signature_invalid",reason:`verify threw: ${l.message}`}}return c?{ok:!0,payload:o}:{ok:!1,code:"signature_invalid",reason:"ECDSA P-384 verification failed"}}function Df(e){try{let t=zo(e);return t instanceof Map?t:null}catch{return null}}Tt.__coseInternals={sig1Structure:Za,encBstr:ir,encText:Xa,encHead:sr,concat:ar,decodeCbor:zo}});var Qa=M(on=>{"use strict";Object.defineProperty(on,"__esModule",{value:!0});on.parseAttestation=Nf;on.verifyAttestation=Of;on.fetchAttestation=jf;var Cf=qo();function Nf(e){try{let t=new TextDecoder("utf-8").decode(e),n=JSON.parse(t);return n.vendor?n.module_id?!n.pcrs||typeof n.pcrs!="object"?{error:"missing pcrs"}:typeof n.timestamp!="number"?{error:"missing timestamp"}:typeof n.user_data_sha256!="string"?{error:"missing user_data_sha256"}:{vendor:n.vendor,module_id:n.module_id,pcrs:n.pcrs,timestamp:n.timestamp,user_data_sha256:n.user_data_sha256,raw:e}:{error:"missing module_id"}:{error:"missing vendor"}}catch(t){return{error:`parse failed: ${t.message}`}}}function Of(e,t){if(e.vendor!==t.vendor)return{ok:!1,code:"vendor_mismatch",reason:`vendor '${e.vendor}' \u2260 expected '${t.vendor}'`};if(e.module_id!==t.module_id)return{ok:!1,code:"module_id_mismatch",reason:`module_id mismatch (got '${e.module_id.slice(0,16)}\u2026')`};for(let[i,s]of Object.entries(t.pcrs))if(e.pcrs[i]!==s)return{ok:!1,code:"pcr_mismatch",reason:`PCR ${i}: got '${(e.pcrs[i]??"").slice(0,16)}\u2026', expected '${s.slice(0,16)}\u2026'`};if(e.user_data_sha256!==t.expected_user_data_sha256)return{ok:!1,code:"user_data_mismatch",reason:"attested user_data does not match presented key"};let n=Math.floor(Date.now()/1e3),r=t.maxAgeSeconds??600;if(e.timestamp>n+30)return{ok:!1,code:"in_future",reason:`attestation timestamp ${e.timestamp} > now+30s`};if(n-e.timestamp>r)return{ok:!1,code:"expired",reason:`attestation ${n-e.timestamp}s old (max ${r}s)`};let o=!1;if(t.cose){if(!t.trustedLeafPubKey)return{ok:!1,code:"signature_invalid",reason:"cose supplied without trustedLeafPubKey \u2014 cannot verify, refusing"};let i=(0,Cf.verifyCoseSign1Es384)(t.cose,t.trustedLeafPubKey);if(!i.ok)return{ok:!1,code:"signature_invalid",reason:`cose: ${i.code}: ${i.reason}`};o=!0}return{ok:!0,vendor:e.vendor,module_id:e.module_id,signature_verified:o}}async function jf(e){let n=await(e.fetchImpl??fetch)(e.attestationUrl,{method:"GET"});if(!n.ok)throw new Error(`attestation fetch failed: ${n.status} ${n.statusText}`);return new Uint8Array(await n.arrayBuffer())}});var nc=M(It=>{"use strict";Object.defineProperty(It,"__esModule",{value:!0});It.splitSecret=Mf;It.combineShares=Kf;It.serializeShare=Vf;It.deserializeShare=Gf;var Qe=null,et=null;function ec(){if(Qe&&et)return;Qe=new Uint8Array(512),et=new Uint8Array(256);let e=1;for(let t=0;t<255;t++){Qe[t]=e,et[e]=t;let n=e<<1;n&256&&(n^=283),n^=e,e=n&255}for(let t=255;t<512;t++)Qe[t]=Qe[t-255]}function cr(e,t){return e===0||t===0?0:(ec(),Qe[et[e]+et[t]])}function Lf(e,t){if(e===0)return 0;if(t===0)throw new Error("division by zero in GF(2^8)");ec();let n=et[e]-et[t];return Qe[n<0?n+255:n]}function tc(e,t){return e^t}function Bf(e,t){let n=0;for(let r=e.length-1;r>=0;r--)n=tc(cr(n,t),e[r]);return n}var Ff=e=>crypto.getRandomValues(new Uint8Array(e));function Mf(e,t){if(t.k<2)throw new Error("threshold k must be \u2265 2");if(t.n<t.k)throw new Error(`total shares n (${t.n}) must be \u2265 threshold k (${t.k})`);if(t.n>255)throw new Error("total shares n must be \u2264 255 (limit of GF(2^8))");if(e.length===0)throw new Error("secret must be non-empty");let n=t.randomBytes??Ff,r=[];for(let o=1;o<=t.n;o++)r.push({x:o,y:new Uint8Array(e.length)});for(let o=0;o<e.length;o++){let i=new Uint8Array(t.k);i[0]=e[o];let s=n(t.k-1);for(let a=1;a<t.k;a++)i[a]=s[a-1];for(let a=0;a<t.n;a++)r[a].y[o]=Bf(i,r[a].x)}return r}function Kf(e){if(e.length<2)throw new Error("need at least 2 shares to reconstruct");let t=e[0].y.length;for(let o of e){if(o.y.length!==t)throw new Error("shares have inconsistent length");if(o.x===0)throw new Error("share x must not be 0")}let n=new Set;for(let o of e){if(n.has(o.x))throw new Error(`duplicate share x=${o.x}`);n.add(o.x)}let r=new Uint8Array(t);for(let o=0;o<t;o++){let i=0;for(let s=0;s<e.length;s++){let a=1,c=1;for(let u=0;u<e.length;u++)s!==u&&(a=cr(a,e[u].x),c=cr(c,e[s].x^e[u].x));let l=Lf(a,c);i=tc(i,cr(e[s].y[o],l))}r[o]=i}return r}var Hf=e=>{if(typeof Buffer<"u")return Buffer.from(e).toString("base64");let t="";for(let n=0;n<e.length;n++)t+=String.fromCharCode(e[n]);return btoa(t)},Uf=e=>{if(typeof Buffer<"u")return new Uint8Array(Buffer.from(e,"base64"));let t=atob(e),n=new Uint8Array(t.length);for(let r=0;r<t.length;r++)n[r]=t.charCodeAt(r);return n};function Vf(e){return{x:e.x,y_b64:Hf(e.y)}}function Gf(e){return{x:e.x,y:Uf(e.y_b64)}}});var sc=M(Le=>{"use strict";Object.defineProperty(Le,"__esModule",{value:!0});Le.SegmentError=void 0;Le.sealSegments=Yf;Le.openSegments=Xf;Le.manifestDigest=Zf;Le.buildCapability=Qf;var Jo=C("@noble/hashes/sha2.js"),Wf="pq-hybrid-segments",zf="AES-256-GCM",Pt=e=>e,rc=e=>{if(typeof Buffer<"u")return Buffer.from(e).toString("base64");let t="";for(let n=0;n<e.length;n++)t+=String.fromCharCode(e[n]);return btoa(t)},oc=e=>{if(typeof Buffer<"u")return new Uint8Array(Buffer.from(e,"base64"));let t=atob(e),n=new Uint8Array(t.length);for(let r=0;r<t.length;r++)n[r]=t.charCodeAt(r);return n},ic=e=>{let t="";for(let n=0;n<e.length;n++)t+=e[n].toString(16).padStart(2,"0");return t};async function qf(e,t,n){let r=await crypto.subtle.importKey("raw",Pt(e),{name:"AES-GCM"},!1,["encrypt"]),o=await crypto.subtle.encrypt({name:"AES-GCM",iv:Pt(t)},r,Pt(n));return new Uint8Array(o)}async function Jf(e,t,n){let r=await crypto.subtle.importKey("raw",Pt(e),{name:"AES-GCM"},!1,["decrypt"]),o=await crypto.subtle.decrypt({name:"AES-GCM",iv:Pt(t)},r,Pt(n));return new Uint8Array(o)}var tt=class extends Error{constructor(t,n){super(n),this.name="SegmentError",this.code=t}};Le.SegmentError=tt;async function Yf(e){let t=new Set;for(let o of e){if(t.has(o.segment_id))throw new tt("duplicate_segment_id",`segment_id '${o.segment_id}' appears twice`);t.add(o.segment_id)}let n=[],r=[];for(let o of e){let i=crypto.getRandomValues(new Uint8Array(32)),s=crypto.getRandomValues(new Uint8Array(12)),a=await qf(i,s,o.plaintext),c=a.slice(0,a.length-16),l=ic((0,Jo.sha256)(c));n.push({segment_id:o.segment_id,key:i}),r.push({segment_id:o.segment_id,label:o.label,content_type:o.content_type,iv_b64:rc(s),ciphertext_b64:rc(a),ciphertext_sha256:l})}return{manifest:{profile:Wf,aead:zf,segments:r},keys:n}}async function Xf(e,t){let n=new Map;for(let o of t.keys)n.set(o.segment_id,o.key);let r=[];for(let o of e.segments){if(!t.allowed_segment_ids.includes(o.segment_id))continue;let i=n.get(o.segment_id);if(!i)throw new tt("key_missing",`capability lists ${o.segment_id} as allowed but holds no key for it`);let s=oc(o.ciphertext_b64),a=s.slice(0,s.length-16);if(ic((0,Jo.sha256)(a))!==o.ciphertext_sha256)throw new tt("integrity_mismatch",`segment ${o.segment_id}: ciphertext sha256 mismatch`);let l=oc(o.iv_b64),u=await Jf(i,l,s);r.push({segment_id:o.segment_id,label:o.label,content_type:o.content_type,plaintext:u})}return r}function Zf(e){let t=e.segments.map(r=>({id:r.segment_id,h:r.ciphertext_sha256})),n=JSON.stringify({profile:e.profile,aead:e.aead,segments:t});return(0,Jo.sha256)(new TextEncoder().encode(n))}function Qf(e,t,n){let r=new Set(t),o=n.filter(i=>r.has(i.segment_id));if(o.length!==t.length){let i=t.filter(s=>!o.find(a=>a.segment_id===s));throw new tt("segment_not_found",`cannot build capability \u2014 no key for: ${i.join(", ")}`)}return{recipient_kid:e,allowed_segment_ids:t,keys:o}}});var lc=M(sn=>{"use strict";Object.defineProperty(sn,"__esModule",{value:!0});sn.computeWatermark=cc;sn.findLeakSource=nh;sn.watermarkSvgOverlay=rh;var eh=C("@noble/hashes/hmac.js"),th=C("@noble/hashes/sha2.js");function cc(e){let t=[e.recipientId,e.lockboxId,String(e.openCount),String(e.iat)].join("|"),n=(0,eh.hmac)(th.sha256,e.tenantSecret,new TextEncoder().encode(t)),r=ac(n.slice(0,16)),o=ac(n.slice(0,4)),i=new Date(e.iat*1e3).toISOString().slice(0,10),s=`${e.recipientId} \xB7 ${i} \xB7 ${o}`;return{short_hex:o,full_hex:r,display_label:s}}function nh(e,t,n){let r=e.toLowerCase();for(let o of n){let i=cc({tenantSecret:t,...o});if(r===i.full_hex)return{matched:!0,candidate:o,matched_on:"full_hex"};if(r===i.short_hex)return{matched:!0,candidate:o,matched_on:"short_hex"}}return{matched:!1,reason:"no_candidate_matched"}}function rh(e,t){let n=t?.width??800,r=t?.height??1e3,o=t?.opacity??.1,s=(a=>a.replace(/[<>&"]/g,c=>({"<":"&lt;",">":"&gt;","&":"&amp;",'"':"&quot;"})[c]))(e.display_label);return`<svg xmlns="http://www.w3.org/2000/svg" width="${n}" height="${r}" pointer-events="none">
+var td=Object.create;var Bi=Object.defineProperty;var nd=Object.getOwnPropertyDescriptor;var rd=Object.getOwnPropertyNames;var od=Object.getPrototypeOf,id=Object.prototype.hasOwnProperty;var C=(e=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(e,{get:(t,n)=>(typeof require<"u"?require:t)[n]}):e)(function(e){if(typeof require<"u")return require.apply(this,arguments);throw Error('Dynamic require of "'+e+'" is not supported')});var M=(e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports);var sd=(e,t,n,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of rd(t))!id.call(e,o)&&o!==n&&Bi(e,o,{get:()=>t[o],enumerable:!(r=nd(t,o))||r.enumerable});return e};var Br=(e,t,n)=>(n=e!=null?td(od(e)):{},sd(t||!e||!e.__esModule?Bi(n,"default",{value:e,enumerable:!0}):n,e));var co=M(oe=>{"use strict";Object.defineProperty(oe,"__esModule",{value:!0});oe.MAX_SEALED_BYTES=void 0;oe.kidForPublicKey=Ts;oe.deriveKeyPairFromSeed=bu;oe.generateSeed=vu;oe.buildEnvInfo=ku;oe.sealDek=wu;oe.openSealedDek=Su;oe.decodeSealHeader=Is;var Es=C("crypto"),Ss=C("@hpke/core"),hu=C("@hpke/dhkem-x25519"),mu=C("@hpke/chacha20poly1305"),gu=C("@noble/curves/ed25519.js"),yu=C("@noble/hashes/hkdf.js"),_u=C("@noble/hashes/sha2.js"),Un=new Ss.CipherSuite({kem:new hu.DhkemX25519HkdfSha256,kdf:new Ss.HkdfSha256,aead:new mu.Chacha20Poly1305}),xs=1,As=1;oe.MAX_SEALED_BYTES=4096;function Ts(e){return(0,Es.createHash)("sha256").update(e).digest("hex").slice(0,16)}function bu(e){if(e.length<16)throw new Error("seed too short (need at least 16 bytes)");let t=new TextEncoder().encode("protect.env.x25519.v1"),n=Buffer.from((0,yu.hkdf)(_u.sha256,e,new Uint8Array(0),t,32)),r=Buffer.from(gu.x25519.scalarMultBase(n));return{secretKey:n,publicKey:r,kid:Ts(r)}}function vu(){return(0,Es.randomBytes)(32)}function ku(e){return Buffer.from(`protect.env.v3|${e}`,"utf8")}async function wu(e,t,n){if(e.length!==32)throw new Error("sealDek: DEK must be 32 bytes");if(t.length!==32)throw new Error("sealDek: public key must be 32 bytes");let r=await Un.kem.deserializePublicKey(ze(t)),o=await Un.createSenderContext({recipientPublicKey:r,info:ze(n)}),i=Buffer.from(await o.seal(ze(e),new ArrayBuffer(0))),s=Buffer.from(o.enc),a=Buffer.alloc(6+s.length+i.length);return a[0]=xs,a[1]=As,a.writeUInt16BE(s.length,2),a.writeUInt16BE(i.length,4),s.copy(a,6),i.copy(a,6+s.length),a}async function Su(e,t,n){let r=Is(e),o=e.subarray(6,6+r.encLen),i=e.subarray(6+r.encLen),s=await Un.kem.deserializePrivateKey(ze(t)),a=await Un.createRecipientContext({recipientKey:s,enc:ze(o),info:ze(n)});return Buffer.from(await a.open(ze(i)))}function Is(e){if(e.length<6)throw new Error("sealed bytes too short");if(e.length>oe.MAX_SEALED_BYTES)throw new Error("sealed bytes too long");let t=e[0],n=e[1];if(t!==xs)throw new Error(`unsupported seal version 0x${t.toString(16)}`);if(n!==As)throw new Error(`unsupported HPKE suite 0x${n.toString(16)}`);let r=e.readUInt16BE(2),o=e.readUInt16BE(4);if(e.length!==6+r+o)throw new Error("sealed length mismatch");if(r!==32)throw new Error("unexpected KEM enc length (X25519 is 32 bytes)");if(o<16)throw new Error("ciphertext shorter than the AEAD tag");return{ver:t,suite:n,encLen:r,ctLen:o}}function ze(e){return e.buffer.slice(e.byteOffset,e.byteOffset+e.byteLength)}});var Ps=M(Ee=>{"use strict";Object.defineProperty(Ee,"__esModule",{value:!0});Ee.V3_PREFIX=void 0;Ee.sealValue=Eu;Ee.formatToken=xu;Ee.parseToken=$s;Ee.openValue=Au;var Vn=C("crypto"),Gn=co();Ee.V3_PREFIX="aes256gcm:v3:";async function Eu(e,t){let n=(0,Vn.randomBytes)(32),r=(0,Vn.randomBytes)(12),o=(0,Vn.createCipheriv)("aes-256-gcm",n,r),i=Buffer.concat([o.update(e,"utf8"),o.final()]),s=Buffer.concat([i,o.getAuthTag()]),a=await(0,Gn.sealDek)(n,t.publicKey,(0,Gn.buildEnvInfo)(t.kid));return n.fill(0),{sealedDekB64:a.toString("base64"),iv:r,cipher:s}}function xu(e,t){return`${Ee.V3_PREFIX}${e.iv.toString("base64")}:${e.cipher.toString("base64")}:${t}`}function $s(e){let t=e.split(":");if(t.length!==5||t[0]!=="aes256gcm"||t[1]!=="v3")throw new Error("not a v3 token");let[,,n,r,o]=t;if(!o)throw new Error("v3 token has no seal id");let i=Buffer.from(n,"base64"),s=Buffer.from(r,"base64");if(i.length!==12)throw new Error("v3 token has a malformed iv");if(s.length<17)throw new Error("v3 token ciphertext is too short");return{iv:i,cipher:s,sealId:o}}async function Au(e,t,n){let{iv:r,cipher:o}=$s(e),i=await(0,Gn.openSealedDek)(Buffer.from(t,"base64"),n.secretKey,(0,Gn.buildEnvInfo)(n.kid)),s=o.subarray(o.length-16),a=o.subarray(0,o.length-16),c=(0,Vn.createDecipheriv)("aes-256-gcm",i,r);c.setAuthTag(s);try{return Buffer.concat([c.update(a),c.final()]).toString("utf8")}finally{i.fill(0)}}});var Ns=M(Z=>{"use strict";var Tu=Z&&Z.__createBinding||(Object.create?(function(e,t,n,r){r===void 0&&(r=n);var o=Object.getOwnPropertyDescriptor(t,n);(!o||("get"in o?!t.__esModule:o.writable||o.configurable))&&(o={enumerable:!0,get:function(){return t[n]}}),Object.defineProperty(e,r,o)}):(function(e,t,n,r){r===void 0&&(r=n),e[r]=t[n]})),Iu=Z&&Z.__setModuleDefault||(Object.create?(function(e,t){Object.defineProperty(e,"default",{enumerable:!0,value:t})}):function(e,t){e.default=t}),uo=Z&&Z.__importStar||(function(){var e=function(t){return e=Object.getOwnPropertyNames||function(n){var r=[];for(var o in n)Object.prototype.hasOwnProperty.call(n,o)&&(r[r.length]=o);return r},e(t)};return function(t){if(t&&t.__esModule)return t;var n={};if(t!=null)for(var r=e(t),o=0;o<r.length;o++)r[o]!=="default"&&Tu(n,t,r[o]);return Iu(n,t),n}})();Object.defineProperty(Z,"__esModule",{value:!0});Z.deviceKeyPath=Pu;Z.hasDeviceKey=Ru;Z.loadDeviceKey=Du;Z.createDeviceKey=Cu;Z.importDeviceKey=Nu;Z.exportSeedHex=Ou;Z.deviceKeyIsExposed=ju;var te=uo(C("fs")),$u=uo(C("os")),Rs=uo(C("path")),Kt=co(),lo=Rs.join($u.homedir(),".nodata"),W=Rs.join(lo,"device-key.json");function Pu(){return W}function Ds(){let e=process.env.NODATA_DEVICE_SEED;if(!e)return null;let t=e.trim();if(!/^[0-9a-fA-F]{64}$/.test(t))throw new Error("NODATA_DEVICE_SEED must be 64 hex characters (32 bytes)");return Buffer.from(t,"hex")}function Ru(){return Ds()!==null||te.existsSync(W)}function Du(){let e=Ds();if(e)return(0,Kt.deriveKeyPairFromSeed)(e);if(!te.existsSync(W))return null;let t;try{t=JSON.parse(te.readFileSync(W,"utf-8"))}catch{throw new Error(`Device key file is unreadable: ${W}`)}if(!t.seed_hex||!/^[0-9a-f]{64}$/i.test(t.seed_hex))throw new Error(`Device key file is malformed (bad seed): ${W}`);let n=(0,Kt.deriveKeyPairFromSeed)(Buffer.from(t.seed_hex,"hex"));if(t.kid&&t.kid!==n.kid)throw new Error(`Device key file is inconsistent: stored kid ${t.kid} does not match the seed (${n.kid}).`);return n}function Cu(e={}){if(te.existsSync(W)&&!e.force)throw new Error(`A device key already exists at ${W}. Replacing it makes every existing v3 seal unopenable. Back up the seed first (nodata key export), then pass --force.`);let t=(0,Kt.generateSeed)(),n=(0,Kt.deriveKeyPairFromSeed)(t);return Cs(t,n),n}function Nu(e,t={}){let n=e.trim().replace(/\s+/g,"");if(!/^[0-9a-fA-F]{64}$/.test(n))throw new Error("Seed must be 64 hex characters (32 bytes).");if(te.existsSync(W)&&!t.force)throw new Error(`A device key already exists at ${W}. Pass --force to replace it.`);let r=Buffer.from(n,"hex"),o=(0,Kt.deriveKeyPairFromSeed)(r);return Cs(r,o),o}function Ou(){if(!te.existsSync(W))throw new Error("No device key file to export.");return JSON.parse(te.readFileSync(W,"utf-8")).seed_hex}function Cs(e,t){te.existsSync(lo)||te.mkdirSync(lo,{recursive:!0});let n={version:1,kid:t.kid,pubkey_hex:t.publicKey.toString("hex"),seed_hex:e.toString("hex"),created_at:new Date().toISOString()};te.writeFileSync(W,JSON.stringify(n,null,2)+`
+`,{mode:384});try{te.chmodSync(W,384)}catch{}}function ju(){if(process.platform==="win32"||!te.existsSync(W))return!1;try{return(te.statSync(W).mode&63)!==0}catch{return!1}}});var mo=M(ne=>{"use strict";var Lu=ne&&ne.__createBinding||(Object.create?(function(e,t,n,r){r===void 0&&(r=n);var o=Object.getOwnPropertyDescriptor(t,n);(!o||("get"in o?!t.__esModule:o.writable||o.configurable))&&(o={enumerable:!0,get:function(){return t[n]}}),Object.defineProperty(e,r,o)}):(function(e,t,n,r){r===void 0&&(r=n),e[r]=t[n]})),Bu=ne&&ne.__setModuleDefault||(Object.create?(function(e,t){Object.defineProperty(e,"default",{enumerable:!0,value:t})}):function(e,t){e.default=t}),Os=ne&&ne.__importStar||(function(){var e=function(t){return e=Object.getOwnPropertyNames||function(n){var r=[];for(var o in n)Object.prototype.hasOwnProperty.call(n,o)&&(r[r.length]=o);return r},e(t)};return function(t){if(t&&t.__esModule)return t;var n={};if(t!=null)for(var r=e(t),o=0;o<r.length;o++)r[o]!=="default"&&Lu(n,t,r[o]);return Bu(n,t),n}})();Object.defineProperty(ne,"__esModule",{value:!0});ne.ensureDeviceKey=Fu;ne.sealFile=Mu;ne.readManifest=js;ne.openFile=Ku;ne.writeLocalReceipt=Hu;var po=C("crypto"),Re=C("fs"),Ht=C("path"),fo=Os(Ps()),ho=Os(Ns());function Fu(){let e=ho.loadDeviceKey();return e?{key:e,created:!1}:{key:ho.createDeviceKey(),created:!0}}async function Mu(e,t,n){let r=(0,Re.readFileSync)(e),o=(0,po.createHash)("sha256").update(r).digest("hex"),i=n??"local-"+(0,po.randomUUID)(),s=await fo.sealValue(r.toString("base64"),t),a={v:3,alg:"aes256gcm:v3",kid:t.kid,orig:(0,Ht.basename)(e),enc:"base64",token:fo.formatToken(s,i),sealed_dek:s.sealedDekB64,sha256:o,sealed_at:new Date().toISOString()},c=e+".ndc";return(0,Re.writeFileSync)(c,JSON.stringify(a,null,2)+`
+`,{mode:384}),{path:e,ndc:c,sha256:o,sealId:i}}function js(e){try{let t=JSON.parse((0,Re.readFileSync)(e,"utf8"));return t.alg==="aes256gcm:v3"&&t.token&&t.sealed_dek?t:null}catch{return null}}async function Ku(e,t){if(!(0,Re.existsSync)(e))return{ok:!1,error:"not_found"};let n=js(e);if(!n)return{ok:!1,error:"not_a_seal"};let r=t===void 0?ho.loadDeviceKey():t;if(!r)return{ok:!1,error:"no_device_key"};let o;try{o=await fo.openValue(n.token,n.sealed_dek,r)}catch{return{ok:!1,error:"wrong_key"}}let i=Buffer.from(o,"base64"),s=e.endsWith(".ndc")?e.slice(0,-4):e+".opened";(0,Re.existsSync)(s)&&(s=s+".opened"),(0,Re.writeFileSync)(s,i);let a=(0,po.createHash)("sha256").update(i).digest("hex")===n.sha256;return{ok:!0,outPath:s,sha256:n.sha256,intact:a}}function Hu(e,t){let n=(0,Ht.join)(e,".nodata","receipts");(0,Re.mkdirSync)(n,{recursive:!0});let r={action:t.action,at:new Date().toISOString(),governed:"local",device_kid:t.kid,removed_plaintext:t.removed_plaintext,files:t.files.map(i=>({path:(0,Ht.relative)(e,i.path),sha256:i.sha256,seal_id:i.sealId,sealed:(0,Ht.basename)(i.ndc)})),...t.extra??{}},o=(0,Ht.join)(n,`${t.action}-${Date.now()}.json`);return(0,Re.writeFileSync)(o,JSON.stringify(r,null,2)+`
+`),o}});var Ze=M(Ro=>{"use strict";Object.defineProperty(Ro,"__esModule",{value:!0});var Xt=class{static async generateKeyPair(){let t=await crypto.subtle.generateKey({name:"RSA-OAEP",modulusLength:4096,publicExponent:new Uint8Array([1,0,1]),hash:"SHA-256"},!0,["encrypt","decrypt"]),n=await crypto.subtle.exportKey("jwk",t.publicKey),r=await crypto.subtle.exportKey("jwk",t.privateKey);return{publicKeyJwk:n,privateKeyJwk:r}}static async encryptMessage(t,n){let r=await crypto.subtle.importKey("jwk",n,{name:"RSA-OAEP",hash:"SHA-256"},!1,["encrypt"]),o=await crypto.subtle.generateKey({name:"AES-GCM",length:256},!0,["encrypt","decrypt"]),i=crypto.getRandomValues(new Uint8Array(12)),s=new TextEncoder().encode(t),a=await crypto.subtle.encrypt({name:"AES-GCM",iv:i,tagLength:128},o,s),c=await crypto.subtle.exportKey("raw",o),l=await crypto.subtle.encrypt({name:"RSA-OAEP"},r,c);return{encrypted_blob:this.arrayBufferToBase64(a),encrypted_aes_key:this.arrayBufferToBase64(l),iv:this.arrayBufferToBase64(i)}}static async decryptMessage(t,n){let r=await crypto.subtle.importKey("jwk",n,{name:"RSA-OAEP",hash:"SHA-256"},!1,["decrypt"]),o=this.base64ToArrayBuffer(t.encrypted_aes_key),i=await crypto.subtle.decrypt({name:"RSA-OAEP"},r,o),s=await crypto.subtle.importKey("raw",i,{name:"AES-GCM",length:256},!1,["decrypt"]),a=this.base64ToArrayBuffer(t.iv),c=this.base64ToArrayBuffer(t.encrypted_blob),l=await crypto.subtle.decrypt({name:"AES-GCM",iv:a,tagLength:128},s,c);return new TextDecoder().decode(l)}static async encryptFile(t,n){let r=await t.arrayBuffer(),o=await crypto.subtle.generateKey({name:"AES-GCM",length:256},!0,["encrypt","decrypt"]),i=crypto.getRandomValues(new Uint8Array(12)),s=await crypto.subtle.encrypt({name:"AES-GCM",iv:i,tagLength:128},o,r),a=JSON.stringify({name:t.name,type:t.type,size:t.size,lastModified:t.lastModified}),c=crypto.getRandomValues(new Uint8Array(12)),l=await crypto.subtle.encrypt({name:"AES-GCM",iv:c,tagLength:128},o,new TextEncoder().encode(a)),d=await crypto.subtle.importKey("jwk",n,{name:"RSA-OAEP",hash:"SHA-256"},!1,["encrypt"]),p=await crypto.subtle.exportKey("raw",o),f=await crypto.subtle.encrypt({name:"RSA-OAEP"},d,p);return{encrypted_file:this.arrayBufferToBase64(s),encrypted_file_key:this.arrayBufferToBase64(f),iv:this.arrayBufferToBase64(i),encrypted_metadata:this.arrayBufferToBase64(l),metadata_iv:this.arrayBufferToBase64(c),encrypted_size:s.byteLength}}static async importKeyFromFragment(t){let n=t.replace(/-/g,"+").replace(/_/g,"/"),r=this.base64ToArrayBuffer(n.padEnd(Math.ceil(n.length/4)*4,"="));if(r.byteLength!==32)throw new Error("channel key must be 32 bytes");return crypto.subtle.importKey("raw",r,{name:"AES-GCM",length:256},!1,["encrypt","decrypt"])}static async deriveKeyFromOTP(t,n,r="SHA-512"){let o=await crypto.subtle.importKey("raw",new TextEncoder().encode(t),"PBKDF2",!1,["deriveBits","deriveKey"]);return await crypto.subtle.deriveKey({name:"PBKDF2",salt:new TextEncoder().encode(n),iterations:31e4,hash:r},o,{name:"AES-GCM",length:256},!0,["encrypt","decrypt"])}static async encryptWithDerivedKey(t,n){let r=crypto.getRandomValues(new Uint8Array(12)),o=new TextEncoder().encode(t),i=await crypto.subtle.encrypt({name:"AES-GCM",iv:r,tagLength:128},n,o);return{encrypted:this.arrayBufferToBase64(i),iv:this.arrayBufferToBase64(r)}}static async decryptWithDerivedKey(t,n,r){let o=this.base64ToArrayBuffer(t),i=this.base64ToArrayBuffer(n),s=await crypto.subtle.decrypt({name:"AES-GCM",iv:i,tagLength:128},r,o);return new TextDecoder().decode(s)}static async sha256Hex(t){let n=t instanceof Uint8Array?t.buffer.slice(t.byteOffset,t.byteOffset+t.byteLength):t,r=await crypto.subtle.digest("SHA-256",n);return Array.from(new Uint8Array(r)).map(o=>o.toString(16).padStart(2,"0")).join("")}static async encryptFileWithDerivedKey(t,n){let r=await t.arrayBuffer(),o=await this.sha256Hex(r),i=crypto.getRandomValues(new Uint8Array(12)),s=await crypto.subtle.encrypt({name:"AES-GCM",iv:i,tagLength:128},n,r),a=JSON.stringify({name:t.name,type:t.type,size:t.size,lastModified:t.lastModified}),c=crypto.getRandomValues(new Uint8Array(12)),l=await crypto.subtle.encrypt({name:"AES-GCM",iv:c,tagLength:128},n,new TextEncoder().encode(a));return{encrypted_file:this.arrayBufferToBase64(s),iv:this.arrayBufferToBase64(i),encrypted_metadata:this.arrayBufferToBase64(l),metadata_iv:this.arrayBufferToBase64(c),encrypted_size:s.byteLength,plaintext_sha256:o,ciphertext_sha256:await this.sha256Hex(s)}}static async decryptFileBytesWithDerivedKey(t,n,r){let o=this.base64ToArrayBuffer(n);return crypto.subtle.decrypt({name:"AES-GCM",iv:o,tagLength:128},r,t)}static async decryptFileWithDerivedKey(t,n,r){let o=this.base64ToArrayBuffer(t),i=this.base64ToArrayBuffer(n);return crypto.subtle.decrypt({name:"AES-GCM",iv:i,tagLength:128},r,o)}static async deriveSeedKey(t,n="SHA-512"){let r=t.trim().toLowerCase(),o=await crypto.subtle.importKey("raw",new TextEncoder().encode(r),"PBKDF2",!1,["deriveBits","deriveKey"]);return await crypto.subtle.deriveKey({name:"PBKDF2",salt:new TextEncoder().encode(this.SEED_SALT),iterations:this.PBKDF2_ITERATIONS,hash:n},o,{name:"AES-GCM",length:256},!1,["encrypt","decrypt"])}static async exportKeyWithSeed(t,n){let r=await crypto.subtle.exportKey("jwk",t),o=new TextEncoder().encode(JSON.stringify(r)),i=crypto.getRandomValues(new Uint8Array(12)),s=await crypto.subtle.encrypt({name:"AES-GCM",iv:i,tagLength:128},n,o),a=new Uint8Array(i.byteLength+s.byteLength);return a.set(i,0),a.set(new Uint8Array(s),i.byteLength),a.buffer}static async importKeyWithSeed(t,n){let r=new Uint8Array(t),o=r.slice(0,12),i=r.slice(12),s=await crypto.subtle.decrypt({name:"AES-GCM",iv:o,tagLength:128},n,i),a=new TextDecoder().decode(s),c=JSON.parse(a),l=await crypto.subtle.importKey("jwk",c,{name:"RSA-OAEP",hash:"SHA-256"},!0,["decrypt"]);return new Uint8Array(s).fill(0),l}static async hashPhone(t){let n=new TextEncoder().encode(t.replace(/\D/g,"")),r=await crypto.subtle.digest("SHA-256",n);return Array.from(new Uint8Array(r)).map(o=>o.toString(16).padStart(2,"0")).join("")}static arrayBufferToBase64(t){let n=new Uint8Array(t),r=32768,o=[];for(let i=0;i<n.length;i+=r)o.push(String.fromCharCode(...n.subarray(i,i+r)));return btoa(o.join(""))}static async encryptFileToBytesWithDerivedKey(t,n){let r=await t.arrayBuffer(),o=await this.sha256Hex(r),i=crypto.getRandomValues(new Uint8Array(12)),s=await crypto.subtle.encrypt({name:"AES-GCM",iv:i,tagLength:128},n,r),a=JSON.stringify({name:t.name,type:t.type,size:t.size,lastModified:t.lastModified}),c=crypto.getRandomValues(new Uint8Array(12)),l=await crypto.subtle.encrypt({name:"AES-GCM",iv:c,tagLength:128},n,new TextEncoder().encode(a));return{ciphertext:s,iv:this.arrayBufferToBase64(i),encrypted_metadata:this.arrayBufferToBase64(l),metadata_iv:this.arrayBufferToBase64(c),encrypted_size:s.byteLength,plaintext_sha256:o,ciphertext_sha256:await this.sha256Hex(s)}}static base64ToArrayBuffer(t){let n=atob(t),r=new Uint8Array(n.length);for(let o=0;o<n.length;o++)r[o]=n.charCodeAt(o);return r.buffer}static wipeFromMemory(t){new Uint8Array(t).fill(0)}};Xt.PBKDF2_ITERATIONS=31e4;Xt.SEED_SALT="NoDataChat-Seed-v1";Ro.default=Xt});var Aa=M(Zn=>{"use strict";Object.defineProperty(Zn,"__esModule",{value:!0});Zn.solveProofOfWork=jp;Zn.verifyProofOfWork=Lp;function Op(e){let t=new Uint8Array(e),n="";for(let r=0;r<t.length;r++)n+=t[r].toString(16).padStart(2,"0");return n}async function xa(e){let t=new TextEncoder().encode(e),n=await crypto.subtle.digest("SHA-256",t);return Op(n)}async function jp(e,t=4){if(t<1||t>16)throw new Error("Difficulty must be between 1 and 16");let n="0".repeat(t),r=0;for(;;){let o=e+r.toString(),i=await xa(o);if(i.startsWith(n))return{nonce:r,hash:i};if(r++,r>2e9)throw new Error("Proof of work exceeded maximum attempts")}}async function Lp(e,t,n=4){if(n<1||n>16)return!1;let r="0".repeat(n),o=e+t.toString();return(await xa(o)).startsWith(r)}});var Co=M(_t=>{"use strict";var Bp=_t&&_t.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(_t,"__esModule",{value:!0});_t.NoDataEmail=void 0;var ye=Bp(Ze()),Do=class{static async seal(t,n,r,o,i,s={}){let{encrypt_subject:a=!0,ttl_hours:c=72,attachments:l=[]}=s,d=await ye.default.encryptMessage(o,i),p=r,f=!1;if(a){let y=await ye.default.encryptMessage(r,i);p=JSON.stringify(y),f=!0}let h=[];for(let y of l){let _=await ye.default.encryptFile(y,i);h.push({encrypted_file:_})}return{from_alias:t,to:n,subject:p,subject_encrypted:f,body:d,attachments:h,sealed_at:new Date().toISOString(),ttl_hours:c,envelope_id:crypto.randomUUID(),crypto_version:"0.2.0"}}static async open(t,n){let r=await ye.default.decryptMessage(t.body,n),o=t.subject;if(t.subject_encrypted){let s=JSON.parse(t.subject);o=await ye.default.decryptMessage(s,n)}let i=[];for(let s of t.attachments){let{encrypted_file:a}=s,c=ye.default.base64ToArrayBuffer(a.metadata_iv),l=ye.default.base64ToArrayBuffer(a.encrypted_metadata),d=ye.default.base64ToArrayBuffer(a.encrypted_file_key),p=await crypto.subtle.importKey("jwk",n,{name:"RSA-OAEP",hash:"SHA-256"},!1,["decrypt"]),f=await crypto.subtle.decrypt({name:"RSA-OAEP"},p,d),h=await crypto.subtle.importKey("raw",f,{name:"AES-GCM",length:256},!1,["decrypt"]),y=await crypto.subtle.decrypt({name:"AES-GCM",iv:c,tagLength:128},h,l),_=JSON.parse(new TextDecoder().decode(y)),S=ye.default.base64ToArrayBuffer(a.iv),E=ye.default.base64ToArrayBuffer(a.encrypted_file),P=await crypto.subtle.decrypt({name:"AES-GCM",iv:S,tagLength:128},h,E);i.push({filename:_.name,mime_type:_.type,data:P,size:_.size})}return{subject:o,body:r,attachments:i,sealed_at:t.sealed_at,ttl_hours:t.ttl_hours,envelope_id:t.envelope_id}}static isExpired(t){let r=new Date(t.sealed_at).getTime()+t.ttl_hours*60*60*1e3;return Date.now()>r}static toMimeBody(t,n){let r=JSON.stringify(t),o=btoa(unescape(encodeURIComponent(r)));return['Content-Type: multipart/mixed; boundary="nodata-boundary"',"","--nodata-boundary","Content-Type: text/html; charset=utf-8","",'<div style="font-family:system-ui;padding:24px;text-align:center">',"<h2>This email is encrypted with Capsule</h2>","<p>The sender used end-to-end encryption. To read this message:</p>",`<a href="${n}?env=${t.envelope_id}" `,'style="display:inline-block;padding:12px 24px;background:#000;color:#fff;','border-radius:8px;text-decoration:none;font-weight:600">',"Open Encrypted Email</a>",'<p style="color:#888;font-size:12px;margin-top:16px">',"Powered by Capsule &mdash; Nothing is ever stored. Ever.</p>","</div>","--nodata-boundary",'Content-Type: application/x-nodata-envelope; name="envelope.nodata"',"Content-Transfer-Encoding: base64",'Content-Disposition: attachment; filename="envelope.nodata"',"",o,"--nodata-boundary--"].join(`\r
+`)}};_t.NoDataEmail=Do});var jo=M(bt=>{"use strict";var Fp=bt&&bt.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(bt,"__esModule",{value:!0});bt.NoDataWebhook=void 0;var No=Fp(Ze()),Oo=class{static async encrypt(t,n,r,o){let{event_type:i,source:s,ttl_seconds:a=3600}=o,c=JSON.stringify(t),l=await No.default.encryptMessage(c,n),d=new Date().toISOString(),p=crypto.randomUUID(),f=`${p}.${d}.${l.encrypted_blob}`,h=await this.hmacSign(f,r);return{encrypted_event:l,event_type:i,source:s,signature:h,timestamp:d,delivery_id:p,ttl_seconds:a,crypto_version:"0.2.0"}}static async verify(t,n){let r=`${t.delivery_id}.${t.timestamp}.${t.encrypted_event.encrypted_blob}`,o=await this.hmacSign(r,n),i=new TextEncoder().encode(t.signature),s=new TextEncoder().encode(o),a=i.length^s.length,c=Math.min(i.length,s.length);for(let h=0;h<c;h++)a|=i[h]^s[h];let l=a===0,p=new Date(t.timestamp).getTime()+t.ttl_seconds*1e3,f=Date.now()>p;return{valid:l,expired:f,event_type:t.event_type,source:t.source,delivery_id:t.delivery_id}}static async decrypt(t,n){let r=await No.default.decryptMessage(t.encrypted_event,n);return JSON.parse(r)}static async verifyAndDecrypt(t,n,r){let o=await this.verify(t,r);if(!o.valid)throw new Error(`[NoDataWebhook] Invalid signature for delivery ${o.delivery_id}`);if(o.expired)throw new Error(`[NoDataWebhook] Payload expired for delivery ${o.delivery_id}`);return{data:await this.decrypt(t,n),delivery_id:o.delivery_id,event_type:o.event_type}}static async hmacSign(t,n){let r=await crypto.subtle.importKey("raw",new TextEncoder().encode(n),{name:"HMAC",hash:"SHA-256"},!1,["sign"]),o=await crypto.subtle.sign("HMAC",r,new TextEncoder().encode(t));return No.default.arrayBufferToBase64(o)}};bt.NoDataWebhook=Oo});var Bo=M(vt=>{"use strict";var Mp=vt&&vt.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(vt,"__esModule",{value:!0});vt.NoDataSystems=void 0;var Qn=Mp(Ze()),Lo=class{static async encryptRecord(t,n,r,o,i,s){let a=[],c={};for(let[l,d]of Object.entries(r))if(o.sensitive.includes(l)){let p=typeof d=="string"?d:JSON.stringify(d),f=await Qn.default.encryptMessage(p,i),h=await this.hashValue(p);a.push({value:f,search_hash:h,field_name:l,encrypted_at:new Date().toISOString()})}else c[l]=d;return{record_id:t,record_type:n,encrypted_fields:a,clear_fields:c,encrypted_by:s,created_at:new Date().toISOString(),crypto_version:"0.2.0"}}static async decryptRecord(t,n){let r={...t.clear_fields};for(let o of t.encrypted_fields){let i=await Qn.default.decryptMessage(o.value,n);try{r[o.field_name]=JSON.parse(i)}catch{r[o.field_name]=i}}return{record_id:t.record_id,record_type:t.record_type,fields:r,created_at:t.created_at}}static async searchByHash(t,n,r){let o=await this.hashValue(r);return t.filter(i=>i.encrypted_fields.some(s=>s.field_name===n&&s.search_hash===o))}static async encryptField(t,n,r){let o=typeof n=="string"?n:JSON.stringify(n),i=await Qn.default.encryptMessage(o,r),s=await this.hashValue(o);return{value:i,search_hash:s,field_name:t,encrypted_at:new Date().toISOString()}}static async decryptField(t,n){let r=await Qn.default.decryptMessage(t.value,n);try{return JSON.parse(r)}catch{return r}}static createSchema(t,n){return{sensitive:n,clear:t.filter(r=>!n.includes(r))}}static async hashValue(t){let n=`nodatachat:field:${t}`,r=new TextEncoder().encode(n),o=await crypto.subtle.digest("SHA-256",r);return Array.from(new Uint8Array(o)).map(i=>i.toString(16).padStart(2,"0")).join("")}};vt.NoDataSystems=Lo});var Mo=M(kt=>{"use strict";var Kp=kt&&kt.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(kt,"__esModule",{value:!0});kt.NoDataForms=void 0;var _e=Kp(Ze()),Fo=class{static async encryptSubmission(t,n,r,o,i={}){let{ttl_hours:s=0,view_once:a=!1,attachments:c=[]}=i,l={},d={};for(let S of n)S.sensitive!==!1?l[S.name]=S.value:d[S.name]=S.value;let p=JSON.stringify(n.map(S=>({name:S.name,value:S.value}))),f=await this.sha256(p),h=await _e.default.encryptMessage(JSON.stringify(l),r),y=[];for(let S of c){let E=await _e.default.encryptFile(S,r);y.push(E)}let _=n.map(S=>S.name);return{submission_id:crypto.randomUUID(),form_id:t,encrypted_fields:h,clear_fields:d,attachments:y,integrity_hash:f,field_order:_,submitter_id:o,submitted_at:new Date().toISOString(),ttl_hours:s,view_once:a,crypto_version:"0.2.0"}}static async decryptSubmission(t,n){let r=await _e.default.decryptMessage(t.encrypted_fields,n),o=JSON.parse(r),i={...t.clear_fields,...o},a=(t.field_order||Object.keys(i).sort()).map(p=>({name:p,value:i[p]})),l=await this.sha256(JSON.stringify(a))===t.integrity_hash,d=[];for(let p of t.attachments){let f=await crypto.subtle.importKey("jwk",n,{name:"RSA-OAEP",hash:"SHA-256"},!1,["decrypt"]),h=await crypto.subtle.decrypt({name:"RSA-OAEP"},f,_e.default.base64ToArrayBuffer(p.encrypted_file_key)),y=await crypto.subtle.importKey("raw",h,{name:"AES-GCM",length:256},!1,["decrypt"]),_=await crypto.subtle.decrypt({name:"AES-GCM",iv:_e.default.base64ToArrayBuffer(p.metadata_iv),tagLength:128},y,_e.default.base64ToArrayBuffer(p.encrypted_metadata)),S=JSON.parse(new TextDecoder().decode(_)),E=await crypto.subtle.decrypt({name:"AES-GCM",iv:_e.default.base64ToArrayBuffer(p.iv),tagLength:128},y,_e.default.base64ToArrayBuffer(p.encrypted_file));d.push({filename:S.name,mime_type:S.type,data:E,size:S.size})}return{submission_id:t.submission_id,form_id:t.form_id,fields:i,attachments:d,integrity_valid:l,submitted_at:t.submitted_at}}static isExpired(t){if(t.ttl_hours===0)return!1;let r=new Date(t.submitted_at).getTime()+t.ttl_hours*60*60*1e3;return Date.now()>r}static async encryptGrade(t,n,r,o,i=0){let s=await _e.default.encryptMessage(JSON.stringify(t),n),a=await this.sha256(`nodatachat:student:${t.student_id}`);return{encrypted_grade:s,student_hash:a,course_id:r,term:o,delivery_id:crypto.randomUUID(),delivered_at:new Date().toISOString(),ttl_hours:i,crypto_version:"0.2.0"}}static async decryptGrade(t,n){let r=await _e.default.decryptMessage(t.encrypted_grade,n);return JSON.parse(r)}static async sha256(t){let n=new TextEncoder().encode(t),r=await crypto.subtle.digest("SHA-256",n);return Array.from(new Uint8Array(r)).map(o=>o.toString(16).padStart(2,"0")).join("")}};kt.NoDataForms=Fo});var Ta=M(wt=>{"use strict";var Hp=wt&&wt.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(wt,"__esModule",{value:!0});wt.NoDataSDK=void 0;var er=Hp(Ze()),Ne=Co(),Oe=jo(),se=Bo(),be=Mo(),Ko=class{static async init(t={}){let n;return t.keyPair?n=t.keyPair:(n=await er.default.generateKeyPair(),t.onKeysGenerated&&await t.onKeysGenerated(n)),{publicKey:n.publicKeyJwk,email:{seal:Ne.NoDataEmail.seal.bind(Ne.NoDataEmail),open:Ne.NoDataEmail.open.bind(Ne.NoDataEmail),isExpired:Ne.NoDataEmail.isExpired.bind(Ne.NoDataEmail),toMimeBody:Ne.NoDataEmail.toMimeBody.bind(Ne.NoDataEmail)},webhook:{encrypt:Oe.NoDataWebhook.encrypt.bind(Oe.NoDataWebhook),verify:Oe.NoDataWebhook.verify.bind(Oe.NoDataWebhook),decrypt:Oe.NoDataWebhook.decrypt.bind(Oe.NoDataWebhook),verifyAndDecrypt:Oe.NoDataWebhook.verifyAndDecrypt.bind(Oe.NoDataWebhook)},systems:{encryptRecord:se.NoDataSystems.encryptRecord.bind(se.NoDataSystems),decryptRecord:se.NoDataSystems.decryptRecord.bind(se.NoDataSystems),searchByHash:se.NoDataSystems.searchByHash.bind(se.NoDataSystems),encryptField:se.NoDataSystems.encryptField.bind(se.NoDataSystems),decryptField:se.NoDataSystems.decryptField.bind(se.NoDataSystems),createSchema:se.NoDataSystems.createSchema.bind(se.NoDataSystems)},forms:{encryptSubmission:be.NoDataForms.encryptSubmission.bind(be.NoDataForms),decryptSubmission:be.NoDataForms.decryptSubmission.bind(be.NoDataForms),isExpired:be.NoDataForms.isExpired.bind(be.NoDataForms),encryptGrade:be.NoDataForms.encryptGrade.bind(be.NoDataForms),decryptGrade:be.NoDataForms.decryptGrade.bind(be.NoDataForms)},crypto:er.default}}static async quickEncrypt(t,n){let r=typeof t=="string"?t:JSON.stringify(t),o=await er.default.encryptMessage(r,n);return JSON.stringify(o)}static async quickDecrypt(t,n){let r=JSON.parse(t),o=await er.default.decryptMessage(r,n);try{return JSON.parse(o)}catch{return o}}};wt.NoDataSDK=Ko});var Ia=M(ae=>{"use strict";Object.defineProperty(ae,"__esModule",{value:!0});ae.NoDataSDK=ae.NoDataForms=ae.NoDataSystems=ae.NoDataWebhook=ae.NoDataEmail=void 0;var Up=Co();Object.defineProperty(ae,"NoDataEmail",{enumerable:!0,get:function(){return Up.NoDataEmail}});var Vp=jo();Object.defineProperty(ae,"NoDataWebhook",{enumerable:!0,get:function(){return Vp.NoDataWebhook}});var Gp=Bo();Object.defineProperty(ae,"NoDataSystems",{enumerable:!0,get:function(){return Gp.NoDataSystems}});var Wp=Mo();Object.defineProperty(ae,"NoDataForms",{enumerable:!0,get:function(){return Wp.NoDataForms}});var zp=Ta();Object.defineProperty(ae,"NoDataSDK",{enumerable:!0,get:function(){return zp.NoDataSDK}})});var Et=M(O=>{"use strict";Object.defineProperty(O,"__esModule",{value:!0});O.PQ_SIZES=O.NDC_WIRE_V03=O.NDC_WIRE_V1=O.NDC_V03_RATCHET_DOMAIN=O.NDC_V03_CONTENT_KEY_DOMAIN=O.NDC_V03_KEM_DOMAIN=O.PQ_SUITE=void 0;O.generateHybridKemKeypair=qp;O.deriveHybridKemKeypairFromSeed=Jp;O.hybridKemEncapsulate=Yp;O.hybridKemDecapsulate=Xp;O.deriveContentKey=Zp;O.ratchetAdvance=Qp;O.generateHybridSigKeypair=ef;O.hybridSign=tf;O.hybridVerify=nf;O.generateMlDsa65Keypair=rf;O.mlDsa65SignDetached=of;O.mlDsa65VerifyDetached=sf;var je=C("@noble/curves/ed25519.js"),Zt=C("@noble/hashes/sha2.js"),Qt=C("@noble/hashes/hkdf.js"),tr=C("@noble/post-quantum/ml-kem.js"),St=C("@noble/post-quantum/ml-dsa.js");O.PQ_SUITE={KEM:"X25519+ML-KEM-768",SIG:"Ed25519+ML-DSA-65",AEAD:"AES-256-GCM",KDF:"HKDF-SHA-256"};O.NDC_V03_KEM_DOMAIN="NDC-v0.3-hybrid-kem";O.NDC_V03_CONTENT_KEY_DOMAIN="NDC-v0.3-content-key";O.NDC_V03_RATCHET_DOMAIN="NDC-ratchet";O.NDC_WIRE_V1=1;O.NDC_WIRE_V03=2;function $a(...e){let t=0;for(let o of e)t+=o.length;let n=new Uint8Array(t),r=0;for(let o of e)n.set(o,r),r+=o.length;return n}function en(e){return new TextEncoder().encode(e)}function Pa(e,t,n,r){let o=$a(e,t),i=$a(en(O.NDC_V03_KEM_DOMAIN),n,r);return(0,Qt.hkdf)(Zt.sha256,o,new Uint8Array(0),i,32)}function qp(){let{secretKey:e,publicKey:t}=je.x25519.keygen(),{publicKey:n,secretKey:r}=tr.ml_kem768.keygen();return{publicKey:{x25519:t,mlKem:n},secretKey:{x25519:e,mlKem:r}}}function Jp(e){if(e.length<32)throw new Error("seed too short (need >=32 bytes)");let t=(0,Qt.hkdf)(Zt.sha256,e,new Uint8Array(0),en("ndc-hybrid-kem-x25519-v1"),32),n=(0,Qt.hkdf)(Zt.sha256,e,new Uint8Array(0),en("ndc-hybrid-kem-mlkem768-v1"),64),r=je.x25519.getPublicKey(t),{publicKey:o,secretKey:i}=tr.ml_kem768.keygen(n);return{publicKey:{x25519:r,mlKem:o},secretKey:{x25519:t,mlKem:i}}}function Yp(e){let{secretKey:t,publicKey:n}=je.x25519.keygen(),r=je.x25519.getSharedSecret(t,e.x25519),{cipherText:o,sharedSecret:i}=tr.ml_kem768.encapsulate(e.mlKem),s=Pa(i,r,n,e.x25519);return{ciphertext:{ctClassical:n,ctPq:o},sharedSecret:s,ephemeralX25519Pk:n}}function Xp(e,t,n){let r=je.x25519.getSharedSecret(e.x25519,n.ctClassical),o=tr.ml_kem768.decapsulate(n.ctPq,e.mlKem);return Pa(o,r,n.ctClassical,t)}function Zp(e){return(0,Qt.hkdf)(Zt.sha256,e,new Uint8Array(0),en(O.NDC_V03_CONTENT_KEY_DOMAIN),32)}function Qp(e,t){return(0,Qt.hkdf)(Zt.sha256,e,t,en(O.NDC_V03_RATCHET_DOMAIN),32)}function ef(){let{secretKey:e,publicKey:t}=je.ed25519.keygen(),{publicKey:n,secretKey:r}=St.ml_dsa65.keygen();return{publicKey:{ed25519:t,mlDsa:n},secretKey:{ed25519:e,mlDsa:r}}}function tf(e,t){return{ed25519:je.ed25519.sign(t,e.ed25519),mlDsa:St.ml_dsa65.sign(t,e.mlDsa)}}function nf(e,t,n){return je.ed25519.verify(n.ed25519,t,e.ed25519)?St.ml_dsa65.verify(n.mlDsa,t,e.mlDsa):!1}function rf(){let{publicKey:e,secretKey:t}=St.ml_dsa65.keygen();return{publicKey:e,secretKey:t}}function of(e,t){return St.ml_dsa65.sign(t,e)}function sf(e,t,n){return St.ml_dsa65.verify(n,t,e)}O.PQ_SIZES={X25519_PK:32,X25519_SK:32,ML_KEM_768_PK:1184,ML_KEM_768_SK:2400,ML_KEM_768_CT:1088,ED25519_PK:32,ED25519_SK:32,ED25519_SIG:64,ML_DSA_65_PK:1952,ML_DSA_65_SK:4032,ML_DSA_65_SIG:3309,HYBRID_SHARED_SECRET:32}});var rr=M(j=>{"use strict";Object.defineProperty(j,"__esModule",{value:!0});j.deriveContentKey=j.ContainerV3Error=j.CONTAINER_HEADER_MAX_BYTES=j.CONTAINER_FIXED_PREFIX_BYTES=j.CONTAINER_MAGIC=void 0;j.canonicalJson=nr;j.headerSigningBytes=Ho;j.signContainerHeader=Na;j.verifyContainerHeader=Oa;j.encodeContainerV3=ja;j.decodeContainerV3=La;j.sealHybrid=pf;j.openHybrid=ff;var af=C("@noble/hashes/hkdf.js"),cf=C("@noble/hashes/sha2.js"),G=Et();Object.defineProperty(j,"deriveContentKey",{enumerable:!0,get:function(){return G.deriveContentKey}});j.CONTAINER_MAGIC=new Uint8Array([78,68,76,66]);j.CONTAINER_FIXED_PREFIX_BYTES=8;j.CONTAINER_HEADER_MAX_BYTES=16777215;var lf="NDC-v0.3-wrap-key",z=class extends Error{constructor(t,n){super(n),this.name="ContainerV3Error",this.code=t}};j.ContainerV3Error=z;var Ae=e=>{if(typeof Buffer<"u")return Buffer.from(e).toString("base64");let t="";for(let n=0;n<e.length;n++)t+=String.fromCharCode(e[n]);return btoa(t)},Qe=e=>{if(typeof Buffer<"u")return new Uint8Array(Buffer.from(e,"base64"));let t=atob(e),n=new Uint8Array(t.length);for(let r=0;r<t.length;r++)n[r]=t.charCodeAt(r);return n},Ca=e=>{let t="";for(let n=0;n<e.length;n++)t+=e[n].toString(16).padStart(2,"0");return t};function nr(e){if(e===null||typeof e!="object")return JSON.stringify(e);if(Array.isArray(e))return"["+e.map(nr).join(",")+"]";let t=e;return"{"+Object.keys(t).sort().map(r=>JSON.stringify(r)+":"+nr(t[r])).join(",")+"}"}function Ho(e){let t={...e};return delete t.sig,new TextEncoder().encode(nr(t))}function Na(e,t,n){let r=(0,G.hybridSign)(n.secretKey,Ho(e));return{...e,sig:{signer_kid:t,ed25519:Ae(r.ed25519),ml_dsa_65:Ae(r.mlDsa)}}}function Oa(e,t){let n={ed25519:Qe(e.sig.ed25519),mlDsa:Qe(e.sig.ml_dsa_65)};return(0,G.hybridVerify)(t,Ho(e),n)}var df=["lockbox_id","format_version","profile","suite","server","kem","wrapped_content_key","iv","tag","bearer","dpop_required","ciphertext_sha256","issued_at","cache_ttl_seconds","original_filename","original_content_type","sig"];function uf(e){if(!e||typeof e!="object")throw new z("header_schema_mismatch","header is not an object");let t=e;for(let r of df)if(t[r]===void 0)throw new z("header_schema_mismatch",`header missing required field: ${String(r)}`);if(t.format_version!==3)throw new z("unsupported_version",`format_version ${t.format_version} unknown`);if(t.profile!=="pq-hybrid")throw new z("suite_unknown",`profile must be 'pq-hybrid', got '${String(t.profile)}'`);let n=t.suite;if(n.kem!==G.PQ_SUITE.KEM||n.sig!==G.PQ_SUITE.SIG||n.aead!==G.PQ_SUITE.AEAD||n.kdf!==G.PQ_SUITE.KDF)throw new z("suite_unknown",`suite mismatch: viewer supports ${JSON.stringify(G.PQ_SUITE)}, header has ${JSON.stringify(n)}`)}function ja(e,t){let n=new TextEncoder().encode(JSON.stringify(e));if(n.length>j.CONTAINER_HEADER_MAX_BYTES)throw new z("header_schema_mismatch",`header too large (${n.length} bytes; max 16 MB)`);let r=new Uint8Array(j.CONTAINER_FIXED_PREFIX_BYTES+n.length+t.length);return r.set(j.CONTAINER_MAGIC,0),r[4]=G.NDC_WIRE_V03,r[5]=n.length>>16&255,r[6]=n.length>>8&255,r[7]=n.length&255,r.set(n,j.CONTAINER_FIXED_PREFIX_BYTES),r.set(t,j.CONTAINER_FIXED_PREFIX_BYTES+n.length),r}function La(e){if(e.length<j.CONTAINER_FIXED_PREFIX_BYTES)throw new z("header_truncated",`container truncated: ${e.length} bytes (need \u2265 ${j.CONTAINER_FIXED_PREFIX_BYTES})`);for(let o=0;o<4;o++)if(e[o]!==j.CONTAINER_MAGIC[o])throw new z("bad_magic",`bad magic: expected NDLB, got ${Ca(e.slice(0,4))}`);if(e[4]!==G.NDC_WIRE_V03)throw new z("unsupported_version",`expected wire version 0x${G.NDC_WIRE_V03.toString(16)}, got 0x${e[4].toString(16)}`);let t=e[5]<<16|e[6]<<8|e[7],n=j.CONTAINER_FIXED_PREFIX_BYTES+t;if(e.length<n)throw new z("header_truncated",`header truncated: declared ${t}, only ${e.length-j.CONTAINER_FIXED_PREFIX_BYTES} bytes left`);let r;try{r=JSON.parse(new TextDecoder("utf-8").decode(e.slice(j.CONTAINER_FIXED_PREFIX_BYTES,n)))}catch(o){throw new z("header_invalid_json",`header JSON parse failed: ${o.message}`)}return uf(r),{header:r,ciphertextWithTag:e.slice(n)}}var et=e=>e;async function Ra(e,t,n){let r=await crypto.subtle.importKey("raw",et(e),{name:"AES-GCM"},!1,["encrypt"]),o=await crypto.subtle.encrypt({name:"AES-GCM",iv:et(t)},r,et(n));return new Uint8Array(o)}async function Da(e,t,n){let r=await crypto.subtle.importKey("raw",et(e),{name:"AES-GCM"},!1,["decrypt"]),o=await crypto.subtle.decrypt({name:"AES-GCM",iv:et(t)},r,et(n));return new Uint8Array(o)}function Ba(e){return(0,af.hkdf)(cf.sha256,e,new Uint8Array(0),new TextEncoder().encode(lf),32)}async function Fa(e){let t=await crypto.subtle.digest("SHA-256",et(e));return Ca(new Uint8Array(t))}async function pf(e){let t=crypto.getRandomValues(new Uint8Array(32)),n=crypto.getRandomValues(new Uint8Array(12)),r=await Ra(t,n,e.plaintext),o=r.slice(r.length-16),i=r.slice(0,r.length-16),s=(0,G.hybridKemEncapsulate)(e.recipientPublicKey),a=Ba(s.sharedSecret),c=crypto.getRandomValues(new Uint8Array(12)),l=await Ra(a,c,t),d=await Fa(i),p={lockbox_id:e.meta.lockbox_id,format_version:3,profile:"pq-hybrid",suite:{kem:G.PQ_SUITE.KEM,sig:G.PQ_SUITE.SIG,aead:G.PQ_SUITE.AEAD,kdf:G.PQ_SUITE.KDF},server:e.meta.server,kem:{recipient_kid:e.recipientKid,ct_classical:Ae(s.ciphertext.ctClassical),ct_pq:Ae(s.ciphertext.ctPq),ephemeral_x25519_pk:Ae(s.ephemeralX25519Pk)},wrapped_content_key:{wrapped:Ae(l),wrap_iv:Ae(c)},iv:Ae(n),tag:Ae(o),bearer:e.meta.bearer,dpop_required:e.meta.dpop_required,ratchet_state:e.meta.ratchet_state,tee_attestation_url:e.meta.tee_attestation_url,original_filename:e.meta.original_filename,original_content_type:e.meta.original_content_type,ciphertext_sha256:d,issued_at:new Date().toISOString(),cache_ttl_seconds:e.meta.cache_ttl_seconds},f=Na(p,e.signerKid,e.signerKeypair),h=ja(f,r);return t.fill(0),{container:h,header:f,serverState:{lockbox_id:e.meta.lockbox_id,kem_ct_classical_b64:f.kem.ct_classical,kem_ct_pq_b64:f.kem.ct_pq,wrapped_content_key_b64:f.wrapped_content_key.wrapped,wrap_iv_b64:f.wrapped_content_key.wrap_iv}}}async function ff(e){let{header:t,ciphertextWithTag:n}=La(e.container);if(!Oa(t,e.signerPublicKey))throw new z("signature_invalid","hybrid signature verification failed");let r=n.slice(0,n.length-16),o=await Fa(r);if(o!==t.ciphertext_sha256)throw new z("integrity_mismatch",`ciphertext sha256 mismatch: expected ${t.ciphertext_sha256.slice(0,16)}\u2026, got ${o.slice(0,16)}\u2026`);let i={ctClassical:Qe(t.kem.ct_classical),ctPq:Qe(t.kem.ct_pq)},s=(0,G.hybridKemDecapsulate)(e.recipientSecretKey,e.recipientPublicX25519,i),a=Ba(s),c=Qe(t.wrapped_content_key.wrapped),l=Qe(t.wrapped_content_key.wrap_iv),d=await Da(a,l,c),p=Qe(t.iv),f=await Da(d,p,n);return d.fill(0),{plaintext:f,header:t}}});var Vo=M(At=>{"use strict";Object.defineProperty(At,"__esModule",{value:!0});At.publicJwkFromBytes=Ka;At.jwkThumbprint=Ha;At.createDpop=mf;At.verifyDpop=yf;var Ma=C("@noble/curves/ed25519.js"),hf=C("@noble/hashes/sha2.js"),xt=e=>{if(typeof Buffer<"u")return Buffer.from(e).toString("base64").replace(/=+$/,"").replace(/\+/g,"-").replace(/\//g,"_");let t="";for(let n=0;n<e.length;n++)t+=String.fromCharCode(e[n]);return btoa(t).replace(/=+$/,"").replace(/\+/g,"-").replace(/\//g,"_")},or=e=>{let t=e.replace(/-/g,"+").replace(/_/g,"/"),n=t.length%4?4-t.length%4:0,r=t+"=".repeat(n);if(typeof Buffer<"u")return new Uint8Array(Buffer.from(r,"base64"));let o=atob(r),i=new Uint8Array(o.length);for(let s=0;s<o.length;s++)i[s]=o.charCodeAt(s);return i},tn=e=>new TextEncoder().encode(e);function Ka(e){if(e.length!==32)throw new Error(`expected 32-byte Ed25519 public key, got ${e.length}`);return{kty:"OKP",crv:"Ed25519",x:xt(e)}}function Ha(e){let t=`{"crv":"${e.crv}","kty":"${e.kty}","x":"${e.x}"}`,n=(0,hf.sha256)(tn(t));return xt(n)}function mf(e){let n={typ:"dpop+jwt",alg:"EdDSA",jwk:Ka(e.publicKey)},r={htm:e.htm.toUpperCase(),htu:Uo(e.htu),jti:e.jti??gf(),iat:e.iat??Math.floor(Date.now()/1e3)};e.nonce&&(r.nonce=e.nonce);let o=xt(tn(JSON.stringify(n))),i=xt(tn(JSON.stringify(r))),s=`${o}.${i}`,a=Ma.ed25519.sign(tn(s),e.secretKey);return`${s}.${xt(a)}`}function gf(){return xt(crypto.getRandomValues(new Uint8Array(16)))}function Uo(e){try{let t=new URL(e);return`${t.protocol}//${t.host}${t.pathname}`}catch{return e}}async function yf(e,t){let n=e.split(".");if(n.length!==3)return q("malformed","expected three JWT parts");let[r,o,i]=n,s;try{s=JSON.parse(new TextDecoder().decode(or(r)))}catch{return q("bad_header","header is not valid base64url JSON")}if(s.typ!=="dpop+jwt")return q("bad_typ",`typ must be 'dpop+jwt', got '${String(s.typ)}'`);if(s.alg!=="EdDSA")return q("bad_alg",`alg must be 'EdDSA', got '${String(s.alg)}'`);if(!s.jwk||s.jwk.kty!=="OKP"||s.jwk.crv!=="Ed25519")return q("bad_header","jwk must be an Ed25519 OKP key");let a=Ha(s.jwk);if(a!==t.expectedJkt)return q("jkt_mismatch",`jkt does not match registered key: expected ${t.expectedJkt.slice(0,12)}\u2026, got ${a.slice(0,12)}\u2026`);let c;try{c=JSON.parse(new TextDecoder().decode(or(o)))}catch{return q("bad_payload","payload is not valid base64url JSON")}if(c.htm!==t.expectedHtm.toUpperCase())return q("htm_mismatch",`htm '${c.htm}' \u2260 expected '${t.expectedHtm.toUpperCase()}'`);if(c.htu!==Uo(t.expectedHtu))return q("htu_mismatch",`htu '${c.htu}' \u2260 expected '${Uo(t.expectedHtu)}'`);if(t.expectedNonce!==void 0&&c.nonce!==t.expectedNonce)return q("nonce_mismatch","DPoP nonce does not match server-issued nonce");let l=Math.floor(Date.now()/1e3),d=t.maxAgeSeconds??30;if(typeof c.iat!="number")return q("bad_payload","iat missing or not a number");if(c.iat>l+5)return q("iat_in_future",`iat ${c.iat} > now+skew`);if(l-c.iat>d)return q("iat_too_old",`iat ${c.iat} older than ${d}s`);let p;try{p=or(s.jwk.x)}catch{return q("bad_header","jwk.x is not base64url")}let f=or(i),h=tn(`${r}.${o}`);return Ma.ed25519.verify(f,h,p)?await t.isJtiFresh(c.jti)?{ok:!0,jti:c.jti,iat:c.iat}:q("replay",`jti ${c.jti} was already seen`):q("signature_invalid","Ed25519 signature does not verify")}function q(e,t){return{ok:!1,code:e,reason:t}}});var Ja=M(A=>{"use strict";Object.defineProperty(A,"__esModule",{value:!0});A.ABSORB_STATUS=A.DELTA_KIND=A.RCPT_TOTAL_LEN=A.RCPT_SIGNED_LEN=A.PVE_TOTAL_LEN=A.PVE_SIGNED_LEN=A.RCPT_VERSION=A.PVE_VERSION=A.RCPT_MAGIC=A.PVE_MAGIC=void 0;A.deltaIdFromUuid=kf;A.uuidFromDeltaId=wf;A.originJktForPublicKey=rn;A.encodePveSignedBytes=Ga;A.signPve=Sf;A.parsePve=Wa;A.pveHash=Ef;A.verifyPve=xf;A.encodeReceiptSignedBytes=za;A.signReceipt=Af;A.parseReceipt=qa;A.verifyReceipt=Tf;var ir=C("@noble/curves/ed25519.js"),_f=C("@noble/hashes/sha2.js"),Ua=Vo();A.PVE_MAGIC=new Uint8Array([80,86,69,49]);A.RCPT_MAGIC=new Uint8Array([82,67,86,49]);A.PVE_VERSION=1;A.RCPT_VERSION=1;A.PVE_SIGNED_LEN=160;A.PVE_TOTAL_LEN=A.PVE_SIGNED_LEN+64;A.RCPT_SIGNED_LEN=78;A.RCPT_TOTAL_LEN=A.RCPT_SIGNED_LEN+64;var Va=new Uint8Array(32);A.DELTA_KIND={relay:1,ndc:2,v4section:3,chatmsg:4};A.ABSORB_STATUS={decrypted_ok:1,verified_only:2,denied:3};function bf(e){if(typeof Buffer<"u")return Buffer.from(e).toString("base64").replace(/=+$/,"").replace(/\+/g,"-").replace(/\//g,"_");let t="";for(let n=0;n<e.length;n++)t+=String.fromCharCode(e[n]);return btoa(t).replace(/=+$/,"").replace(/\+/g,"-").replace(/\//g,"_")}function vf(e){let t=e.replace(/-/g,"+").replace(/_/g,"/"),n=t.length%4?4-t.length%4:0,r=t+"=".repeat(n);if(typeof Buffer<"u")return new Uint8Array(Buffer.from(r,"base64"));let o=atob(r),i=new Uint8Array(o.length);for(let s=0;s<o.length;s++)i[s]=o.charCodeAt(s);return i}function zo(e,t){if(e.length!==t.length)return!1;let n=0;for(let r=0;r<e.length;r++)n|=e[r]^t[r];return n===0}function nn(e){for(let t=0;t<e.length;t++)if(e[t]!==0)return!1;return!0}function Go(e){if(e==null)return Va;if(e instanceof Uint8Array){if(e.length!==32)throw new Error(`jkt bytes must be 32, got ${e.length}`);return e}let t=vf(e);if(t.length!==32)throw new Error(`jkt must decode to 32 bytes, got ${t.length}`);return t}function Wo(e){return nn(e)?null:bf(e)}function kf(e){let t=e.replace(/-/g,"");if(t.length!==32)throw new Error(`expected a 16-byte UUID, got '${e}'`);let n=new Uint8Array(16);for(let r=0;r<16;r++)n[r]=parseInt(t.slice(r*2,r*2+2),16);return n}function wf(e){if(e.length!==16)throw new Error(`expected 16 bytes, got ${e.length}`);let t=Array.from(e,n=>n.toString(16).padStart(2,"0")).join("");return`${t.slice(0,8)}-${t.slice(8,12)}-${t.slice(12,16)}-${t.slice(16,20)}-${t.slice(20)}`}function rn(e){return(0,Ua.jwkThumbprint)((0,Ua.publicJwkFromBytes)(e))}function Ga(e){if(e.deltaId.length!==16)throw new Error("delta_id must be 16 bytes");if(e.ciphertextSha256.length!==32)throw new Error("ciphertext_sha256 must be 32 bytes");if(e.classification<0||e.classification>65535)throw new Error("classification must fit in uint16");let t=new Uint8Array(A.PVE_SIGNED_LEN),n=new DataView(t.buffer),r=0;return t.set(A.PVE_MAGIC,r),r+=4,t[r]=A.PVE_VERSION,r+=1,t[r]=e.deltaKind,r+=1,t.set(e.deltaId,r),r+=16,t.set(e.ciphertextSha256,r),r+=32,t.set(Go(e.originJkt),r),r+=32,t.set(Go(e.destJkt??null),r),r+=32,t.set(e.prevDeltaHash??Va,r),r+=32,n.setUint16(r,e.classification,!1),r+=2,n.setBigUint64(r,BigInt(e.issuedAt),!1),r+=8,t}function Sf(e,t){let n=rn(e.originPublicKey),r=Ga({deltaKind:e.deltaKind,deltaId:e.deltaId,ciphertextSha256:e.ciphertextSha256,originJkt:n,destJkt:e.destJkt??null,prevDeltaHash:e.prevDeltaHash??null,classification:e.classification,issuedAt:e.issuedAt??Date.now()}),o=ir.ed25519.sign(r,t),i=new Uint8Array(A.PVE_TOTAL_LEN);return i.set(r,0),i.set(o,A.PVE_SIGNED_LEN),i}function Wa(e){if(e.length!==A.PVE_TOTAL_LEN)throw new Error(`PVE must be ${A.PVE_TOTAL_LEN} bytes, got ${e.length}`);if(!zo(e.subarray(0,4),A.PVE_MAGIC))throw new Error("bad PVE magic");let t=new DataView(e.buffer,e.byteOffset,e.byteLength),n=4,r=e[n];n+=1;let o=e[n];n+=1;let i=e.slice(n,n+16);n+=16;let s=e.slice(n,n+32);n+=32;let a=e.slice(n,n+32);n+=32;let c=e.slice(n,n+32);n+=32;let l=e.slice(n,n+32);n+=32;let d=t.getUint16(n,!1);n+=2;let p=Number(t.getBigUint64(n,!1));n+=8;let f=e.slice(0,A.PVE_SIGNED_LEN),h=e.slice(A.PVE_SIGNED_LEN,A.PVE_TOTAL_LEN),y=Wo(a);if(y===null)throw new Error("origin_jkt must not be zero");return{fields:{version:r,deltaKind:o,deltaId:i,ciphertextSha256:s,originJkt:y,destJkt:Wo(c),prevDeltaHash:nn(l)?null:l,classification:d,issuedAt:p},signedBytes:f,originSig:h,broadcast:nn(c),genesis:nn(l)}}function Ef(e){return(0,_f.sha256)(e)}function xf(e,t){let n;try{n=Wa(e)}catch(o){let i=o instanceof Error?o.message:String(o);return i.includes("magic")?{ok:!1,code:"bad_magic",reason:i}:{ok:!1,code:"malformed",reason:i}}if(n.fields.version!==A.PVE_VERSION)return{ok:!1,code:"bad_version",reason:`unsupported PVE version ${n.fields.version}`};let r;try{r=rn(t)}catch(o){return{ok:!1,code:"malformed",reason:o instanceof Error?o.message:String(o)}}return r!==n.fields.originJkt?{ok:!1,code:"jkt_mismatch",reason:`presented key thumbprint ${r.slice(0,12)}\u2026 \u2260 committed origin_jkt ${n.fields.originJkt.slice(0,12)}\u2026`}:ir.ed25519.verify(n.originSig,n.signedBytes,t)?{ok:!0,parsed:n}:{ok:!1,code:"signature_invalid",reason:"Ed25519 origin signature does not verify"}}function za(e){if(e.pveHash.length!==32)throw new Error("pve_hash must be 32 bytes");let t=Go(e.destJkt);if(nn(t))throw new Error("receipt dest_jkt must not be zero");let n=new Uint8Array(A.RCPT_SIGNED_LEN),r=new DataView(n.buffer),o=0;return n.set(A.RCPT_MAGIC,o),o+=4,n[o]=A.RCPT_VERSION,o+=1,n.set(e.pveHash,o),o+=32,n.set(t,o),o+=32,n[o]=e.absorbStatus,o+=1,r.setBigUint64(o,BigInt(e.absorbedAt),!1),o+=8,n}function Af(e,t){let n=rn(e.destPublicKey),r=za({pveHash:e.pveHash,destJkt:n,absorbStatus:e.absorbStatus,absorbedAt:e.absorbedAt??Date.now()}),o=ir.ed25519.sign(r,t),i=new Uint8Array(A.RCPT_TOTAL_LEN);return i.set(r,0),i.set(o,A.RCPT_SIGNED_LEN),i}function qa(e){if(e.length!==A.RCPT_TOTAL_LEN)throw new Error(`receipt must be ${A.RCPT_TOTAL_LEN} bytes, got ${e.length}`);if(!zo(e.subarray(0,4),A.RCPT_MAGIC))throw new Error("bad receipt magic");let t=new DataView(e.buffer,e.byteOffset,e.byteLength),n=4,r=e[n];n+=1;let o=e.slice(n,n+32);n+=32;let i=e.slice(n,n+32);n+=32;let s=e[n];n+=1;let a=Number(t.getBigUint64(n,!1));n+=8;let c=Wo(i);if(c===null)throw new Error("receipt dest_jkt must not be zero");return{fields:{version:r,pveHash:o,destJkt:c,absorbStatus:s,absorbedAt:a},signedBytes:e.slice(0,A.RCPT_SIGNED_LEN),destSig:e.slice(A.RCPT_SIGNED_LEN,A.RCPT_TOTAL_LEN)}}function Tf(e,t,n){let r;try{r=qa(e)}catch(i){let s=i instanceof Error?i.message:String(i);return s.includes("magic")?{ok:!1,code:"bad_magic",reason:s}:{ok:!1,code:"malformed",reason:s}}if(r.fields.version!==A.RCPT_VERSION)return{ok:!1,code:"bad_version",reason:`unsupported receipt version ${r.fields.version}`};let o;try{o=rn(t)}catch(i){return{ok:!1,code:"malformed",reason:i instanceof Error?i.message:String(i)}}return o!==r.fields.destJkt?{ok:!1,code:"jkt_mismatch",reason:`presented key thumbprint ${o.slice(0,12)}\u2026 \u2260 committed dest_jkt ${r.fields.destJkt.slice(0,12)}\u2026`}:n!==void 0&&!zo(n,r.fields.pveHash)?{ok:!1,code:"pve_hash_mismatch",reason:"receipt does not acknowledge the expected PVE"}:ir.ed25519.verify(r.destSig,r.signedBytes,t)?{ok:!0,parsed:r}:{ok:!1,code:"signature_invalid",reason:"Ed25519 destination signature does not verify"}}});var Xa=M(on=>{"use strict";Object.defineProperty(on,"__esModule",{value:!0});on.stepRatchet=If;on.replayRatchet=$f;on.destroyKey=Pf;var Ya=Et();function If(e,t){if(t.length!==32)throw new Error(`ratchet token must be 32 bytes, got ${t.length}`);return{nextContentKey:(0,Ya.ratchetAdvance)(e.contentKey,t),openCount:e.openCount+1}}function $f(e,t){let n=[e],r=e;for(let o of t)r=(0,Ya.ratchetAdvance)(r,o),n.push(r);return n}function Pf(e){e.fill(0)}});var Yo=M(Tt=>{"use strict";Object.defineProperty(Tt,"__esModule",{value:!0});Tt.__coseInternals=void 0;Tt.verifyCoseSign1Es384=Cf;Tt.decodeAttestationPayload=Nf;var Rf=C("@noble/curves/nist.js"),Df=C("@noble/hashes/sha2.js"),qo=class{constructor(t){this.b=t,this.p=0}u8(){if(this.p>=this.b.length)throw new Error("cbor: truncated");return this.b[this.p++]}uN(t){let n=0;for(let r=0;r<t;r++)n=n*256+this.u8();return n}len(t){if(t<24)return t;if(t===24)return this.u8();if(t===25)return this.uN(2);if(t===26)return this.uN(4);if(t===27){let n=this.uN(4),r=this.uN(4);return n*4294967296+r}throw new Error(`cbor: unsupported additional info ${t}`)}read(){let t=this.u8(),n=t>>5,r=t&31;switch(n){case 0:return this.len(r);case 1:return-1-this.len(r);case 2:{let o=this.len(r),i=this.b.subarray(this.p,this.p+o);if(i.length!==o)throw new Error("cbor: bstr truncated");return this.p+=o,i.slice()}case 3:{let o=this.len(r),i=this.b.subarray(this.p,this.p+o);if(i.length!==o)throw new Error("cbor: tstr truncated");return this.p+=o,new TextDecoder("utf-8").decode(i)}case 4:{let o=this.len(r),i=[];for(let s=0;s<o;s++)i.push(this.read());return i}case 5:{let o=this.len(r),i=new Map;for(let s=0;s<o;s++){let a=this.read(),c=this.read();i.set(a,c)}return i}case 6:return this.len(r),this.read();case 7:if(r===20)return!1;if(r===21)return!0;if(r===22||r===23)return null;throw new Error(`cbor: unsupported simple/float ${r}`);default:throw new Error(`cbor: unknown major ${n}`)}}};function Jo(e){return new qo(e).read()}function ar(e,t){let n=e<<5;return t<24?Uint8Array.of(n|t):t<=255?Uint8Array.of(n|24,t):t<=65535?Uint8Array.of(n|25,t>>8&255,t&255):Uint8Array.of(n|26,t>>>24&255,t>>16&255,t>>8&255,t&255)}function cr(...e){let t=e.reduce((o,i)=>o+i.length,0),n=new Uint8Array(t),r=0;for(let o of e)n.set(o,r),r+=o.length;return n}function sr(e){return cr(ar(2,e.length),e)}function Za(e){let t=new TextEncoder().encode(e);return cr(ar(3,t.length),t)}function Qa(e,t){return cr(ar(4,4),Za("Signature1"),sr(e),sr(new Uint8Array(0)),sr(t))}function Cf(e,t){let n;try{n=Jo(e)}catch(l){return{ok:!1,code:"malformed",reason:`cbor decode failed: ${l.message}`}}if(!Array.isArray(n)||n.length!==4)return{ok:!1,code:"bad_structure",reason:"COSE_Sign1 must be a 4-element array"};let[r,,o,i]=n;if(!(r instanceof Uint8Array))return{ok:!1,code:"bad_structure",reason:"protected header must be a byte string"};if(!(o instanceof Uint8Array)||o.length===0)return{ok:!1,code:"no_payload",reason:"detached/empty payload is not supported"};if(!(i instanceof Uint8Array))return{ok:!1,code:"bad_structure",reason:"signature must be a byte string"};if(i.length!==96)return{ok:!1,code:"bad_signature_len",reason:`expected 96-byte ES384 sig, got ${i.length}`};let s=Qa(r,o),a=(0,Df.sha384)(s),c=!1;try{c=Rf.p384.verify(i,a,t,{prehash:!1})}catch(l){return{ok:!1,code:"signature_invalid",reason:`verify threw: ${l.message}`}}return c?{ok:!0,payload:o}:{ok:!1,code:"signature_invalid",reason:"ECDSA P-384 verification failed"}}function Nf(e){try{let t=Jo(e);return t instanceof Map?t:null}catch{return null}}Tt.__coseInternals={sig1Structure:Qa,encBstr:sr,encText:Za,encHead:ar,concat:cr,decodeCbor:Jo}});var ec=M(sn=>{"use strict";Object.defineProperty(sn,"__esModule",{value:!0});sn.parseAttestation=jf;sn.verifyAttestation=Lf;sn.fetchAttestation=Bf;var Of=Yo();function jf(e){try{let t=new TextDecoder("utf-8").decode(e),n=JSON.parse(t);return n.vendor?n.module_id?!n.pcrs||typeof n.pcrs!="object"?{error:"missing pcrs"}:typeof n.timestamp!="number"?{error:"missing timestamp"}:typeof n.user_data_sha256!="string"?{error:"missing user_data_sha256"}:{vendor:n.vendor,module_id:n.module_id,pcrs:n.pcrs,timestamp:n.timestamp,user_data_sha256:n.user_data_sha256,raw:e}:{error:"missing module_id"}:{error:"missing vendor"}}catch(t){return{error:`parse failed: ${t.message}`}}}function Lf(e,t){if(e.vendor!==t.vendor)return{ok:!1,code:"vendor_mismatch",reason:`vendor '${e.vendor}' \u2260 expected '${t.vendor}'`};if(e.module_id!==t.module_id)return{ok:!1,code:"module_id_mismatch",reason:`module_id mismatch (got '${e.module_id.slice(0,16)}\u2026')`};for(let[i,s]of Object.entries(t.pcrs))if(e.pcrs[i]!==s)return{ok:!1,code:"pcr_mismatch",reason:`PCR ${i}: got '${(e.pcrs[i]??"").slice(0,16)}\u2026', expected '${s.slice(0,16)}\u2026'`};if(e.user_data_sha256!==t.expected_user_data_sha256)return{ok:!1,code:"user_data_mismatch",reason:"attested user_data does not match presented key"};let n=Math.floor(Date.now()/1e3),r=t.maxAgeSeconds??600;if(e.timestamp>n+30)return{ok:!1,code:"in_future",reason:`attestation timestamp ${e.timestamp} > now+30s`};if(n-e.timestamp>r)return{ok:!1,code:"expired",reason:`attestation ${n-e.timestamp}s old (max ${r}s)`};let o=!1;if(t.cose){if(!t.trustedLeafPubKey)return{ok:!1,code:"signature_invalid",reason:"cose supplied without trustedLeafPubKey \u2014 cannot verify, refusing"};let i=(0,Of.verifyCoseSign1Es384)(t.cose,t.trustedLeafPubKey);if(!i.ok)return{ok:!1,code:"signature_invalid",reason:`cose: ${i.code}: ${i.reason}`};o=!0}return{ok:!0,vendor:e.vendor,module_id:e.module_id,signature_verified:o}}async function Bf(e){let n=await(e.fetchImpl??fetch)(e.attestationUrl,{method:"GET"});if(!n.ok)throw new Error(`attestation fetch failed: ${n.status} ${n.statusText}`);return new Uint8Array(await n.arrayBuffer())}});var rc=M(It=>{"use strict";Object.defineProperty(It,"__esModule",{value:!0});It.splitSecret=Hf;It.combineShares=Uf;It.serializeShare=Wf;It.deserializeShare=zf;var tt=null,nt=null;function tc(){if(tt&&nt)return;tt=new Uint8Array(512),nt=new Uint8Array(256);let e=1;for(let t=0;t<255;t++){tt[t]=e,nt[e]=t;let n=e<<1;n&256&&(n^=283),n^=e,e=n&255}for(let t=255;t<512;t++)tt[t]=tt[t-255]}function lr(e,t){return e===0||t===0?0:(tc(),tt[nt[e]+nt[t]])}function Ff(e,t){if(e===0)return 0;if(t===0)throw new Error("division by zero in GF(2^8)");tc();let n=nt[e]-nt[t];return tt[n<0?n+255:n]}function nc(e,t){return e^t}function Mf(e,t){let n=0;for(let r=e.length-1;r>=0;r--)n=nc(lr(n,t),e[r]);return n}var Kf=e=>crypto.getRandomValues(new Uint8Array(e));function Hf(e,t){if(t.k<2)throw new Error("threshold k must be \u2265 2");if(t.n<t.k)throw new Error(`total shares n (${t.n}) must be \u2265 threshold k (${t.k})`);if(t.n>255)throw new Error("total shares n must be \u2264 255 (limit of GF(2^8))");if(e.length===0)throw new Error("secret must be non-empty");let n=t.randomBytes??Kf,r=[];for(let o=1;o<=t.n;o++)r.push({x:o,y:new Uint8Array(e.length)});for(let o=0;o<e.length;o++){let i=new Uint8Array(t.k);i[0]=e[o];let s=n(t.k-1);for(let a=1;a<t.k;a++)i[a]=s[a-1];for(let a=0;a<t.n;a++)r[a].y[o]=Mf(i,r[a].x)}return r}function Uf(e){if(e.length<2)throw new Error("need at least 2 shares to reconstruct");let t=e[0].y.length;for(let o of e){if(o.y.length!==t)throw new Error("shares have inconsistent length");if(o.x===0)throw new Error("share x must not be 0")}let n=new Set;for(let o of e){if(n.has(o.x))throw new Error(`duplicate share x=${o.x}`);n.add(o.x)}let r=new Uint8Array(t);for(let o=0;o<t;o++){let i=0;for(let s=0;s<e.length;s++){let a=1,c=1;for(let d=0;d<e.length;d++)s!==d&&(a=lr(a,e[d].x),c=lr(c,e[s].x^e[d].x));let l=Ff(a,c);i=nc(i,lr(e[s].y[o],l))}r[o]=i}return r}var Vf=e=>{if(typeof Buffer<"u")return Buffer.from(e).toString("base64");let t="";for(let n=0;n<e.length;n++)t+=String.fromCharCode(e[n]);return btoa(t)},Gf=e=>{if(typeof Buffer<"u")return new Uint8Array(Buffer.from(e,"base64"));let t=atob(e),n=new Uint8Array(t.length);for(let r=0;r<t.length;r++)n[r]=t.charCodeAt(r);return n};function Wf(e){return{x:e.x,y_b64:Vf(e.y)}}function zf(e){return{x:e.x,y:Gf(e.y_b64)}}});var ac=M(Le=>{"use strict";Object.defineProperty(Le,"__esModule",{value:!0});Le.SegmentError=void 0;Le.sealSegments=Zf;Le.openSegments=Qf;Le.manifestDigest=eh;Le.buildCapability=th;var Xo=C("@noble/hashes/sha2.js"),qf="pq-hybrid-segments",Jf="AES-256-GCM",$t=e=>e,oc=e=>{if(typeof Buffer<"u")return Buffer.from(e).toString("base64");let t="";for(let n=0;n<e.length;n++)t+=String.fromCharCode(e[n]);return btoa(t)},ic=e=>{if(typeof Buffer<"u")return new Uint8Array(Buffer.from(e,"base64"));let t=atob(e),n=new Uint8Array(t.length);for(let r=0;r<t.length;r++)n[r]=t.charCodeAt(r);return n},sc=e=>{let t="";for(let n=0;n<e.length;n++)t+=e[n].toString(16).padStart(2,"0");return t};async function Yf(e,t,n){let r=await crypto.subtle.importKey("raw",$t(e),{name:"AES-GCM"},!1,["encrypt"]),o=await crypto.subtle.encrypt({name:"AES-GCM",iv:$t(t)},r,$t(n));return new Uint8Array(o)}async function Xf(e,t,n){let r=await crypto.subtle.importKey("raw",$t(e),{name:"AES-GCM"},!1,["decrypt"]),o=await crypto.subtle.decrypt({name:"AES-GCM",iv:$t(t)},r,$t(n));return new Uint8Array(o)}var rt=class extends Error{constructor(t,n){super(n),this.name="SegmentError",this.code=t}};Le.SegmentError=rt;async function Zf(e){let t=new Set;for(let o of e){if(t.has(o.segment_id))throw new rt("duplicate_segment_id",`segment_id '${o.segment_id}' appears twice`);t.add(o.segment_id)}let n=[],r=[];for(let o of e){let i=crypto.getRandomValues(new Uint8Array(32)),s=crypto.getRandomValues(new Uint8Array(12)),a=await Yf(i,s,o.plaintext),c=a.slice(0,a.length-16),l=sc((0,Xo.sha256)(c));n.push({segment_id:o.segment_id,key:i}),r.push({segment_id:o.segment_id,label:o.label,content_type:o.content_type,iv_b64:oc(s),ciphertext_b64:oc(a),ciphertext_sha256:l})}return{manifest:{profile:qf,aead:Jf,segments:r},keys:n}}async function Qf(e,t){let n=new Map;for(let o of t.keys)n.set(o.segment_id,o.key);let r=[];for(let o of e.segments){if(!t.allowed_segment_ids.includes(o.segment_id))continue;let i=n.get(o.segment_id);if(!i)throw new rt("key_missing",`capability lists ${o.segment_id} as allowed but holds no key for it`);let s=ic(o.ciphertext_b64),a=s.slice(0,s.length-16);if(sc((0,Xo.sha256)(a))!==o.ciphertext_sha256)throw new rt("integrity_mismatch",`segment ${o.segment_id}: ciphertext sha256 mismatch`);let l=ic(o.iv_b64),d=await Xf(i,l,s);r.push({segment_id:o.segment_id,label:o.label,content_type:o.content_type,plaintext:d})}return r}function eh(e){let t=e.segments.map(r=>({id:r.segment_id,h:r.ciphertext_sha256})),n=JSON.stringify({profile:e.profile,aead:e.aead,segments:t});return(0,Xo.sha256)(new TextEncoder().encode(n))}function th(e,t,n){let r=new Set(t),o=n.filter(i=>r.has(i.segment_id));if(o.length!==t.length){let i=t.filter(s=>!o.find(a=>a.segment_id===s));throw new rt("segment_not_found",`cannot build capability \u2014 no key for: ${i.join(", ")}`)}return{recipient_kid:e,allowed_segment_ids:t,keys:o}}});var dc=M(an=>{"use strict";Object.defineProperty(an,"__esModule",{value:!0});an.computeWatermark=lc;an.findLeakSource=oh;an.watermarkSvgOverlay=ih;var nh=C("@noble/hashes/hmac.js"),rh=C("@noble/hashes/sha2.js");function lc(e){let t=[e.recipientId,e.lockboxId,String(e.openCount),String(e.iat)].join("|"),n=(0,nh.hmac)(rh.sha256,e.tenantSecret,new TextEncoder().encode(t)),r=cc(n.slice(0,16)),o=cc(n.slice(0,4)),i=new Date(e.iat*1e3).toISOString().slice(0,10),s=`${e.recipientId} \xB7 ${i} \xB7 ${o}`;return{short_hex:o,full_hex:r,display_label:s}}function oh(e,t,n){let r=e.toLowerCase();for(let o of n){let i=lc({tenantSecret:t,...o});if(r===i.full_hex)return{matched:!0,candidate:o,matched_on:"full_hex"};if(r===i.short_hex)return{matched:!0,candidate:o,matched_on:"short_hex"}}return{matched:!1,reason:"no_candidate_matched"}}function ih(e,t){let n=t?.width??800,r=t?.height??1e3,o=t?.opacity??.1,s=(a=>a.replace(/[<>&"]/g,c=>({"<":"&lt;",">":"&gt;","&":"&amp;",'"':"&quot;"})[c]))(e.display_label);return`<svg xmlns="http://www.w3.org/2000/svg" width="${n}" height="${r}" pointer-events="none">
   <g fill="#000" opacity="${o}" font-family="Helvetica, Arial, sans-serif" font-size="20" text-anchor="middle">
     <text x="${n/2}" y="${r*.2}" transform="rotate(-30 ${n/2} ${r*.2})">${s}</text>
     <text x="${n/2}" y="${r*.5}" transform="rotate(-30 ${n/2} ${r*.5})">${s}</text>
     <text x="${n/2}" y="${r*.8}" transform="rotate(-30 ${n/2} ${r*.8})">${s}</text>
   </g>
   <text x="${n-12}" y="${r-8}" font-family="monospace" font-size="10" fill="#000" opacity="${o*2}" text-anchor="end">${e.short_hex}</text>
-</svg>`}function ac(e){let t="";for(let n=0;n<e.length;n++)t+=e[n].toString(16).padStart(2,"0");return t}});var gc=M(Q=>{"use strict";Object.defineProperty(Q,"__esModule",{value:!0});Q.DRAND_LOE_MAINNET=Q.TimeGateError=void 0;Q.timeGateEncrypt=oh;Q.timeGateDecrypt=ih;Q.roundForTime=sh;Q.timeForRound=ah;Q.drandTimeLockEncrypt=lh;Q.drandTimeLockDecrypt=hc;Q.makeFakeDrandChain=dh;Q.fetchDrandRound=mc;Q.drandTimeLockOpen=ph;var ve=C("@noble/curves/bls12-381.js"),ur=C("@noble/hashes/sha2.js"),Be=e=>e,uc="NDC-v0.3-server-time-gate";async function oh(e){let t=crypto.getRandomValues(new Uint8Array(12)),n=new TextEncoder().encode(`${uc}|${e.notBeforeUnixSec}`),r=await crypto.subtle.importKey("raw",Be(e.serverWrapKey),{name:"AES-GCM"},!1,["encrypt"]),o=await crypto.subtle.encrypt({name:"AES-GCM",iv:Be(t),additionalData:Be(n)},r,Be(e.plaintext));return{variant:"server-attested",notBeforeUnixSec:e.notBeforeUnixSec,iv_b64:lr(t),ciphertext_b64:lr(new Uint8Array(o))}}var an=class extends Error{constructor(t,n){super(n),this.name="TimeGateError",this.code=t}};Q.TimeGateError=an;async function ih(e){if(e.currentUnixSec<e.ciphertext.notBeforeUnixSec)throw new an("not_yet",`time-gate not yet open: now ${e.currentUnixSec} < notBefore ${e.ciphertext.notBeforeUnixSec}`);let t=new TextEncoder().encode(`${uc}|${e.ciphertext.notBeforeUnixSec}`),n=await crypto.subtle.importKey("raw",Be(e.serverWrapKey),{name:"AES-GCM"},!1,["decrypt"]);try{let r=await crypto.subtle.decrypt({name:"AES-GCM",iv:Be(dr(e.ciphertext.iv_b64)),additionalData:Be(t)},n,Be(dr(e.ciphertext.ciphertext_b64)));return new Uint8Array(r)}catch{throw new an("tamper_detected","AES-GCM authentication tag failed \u2014 ciphertext or AAD tampered")}}Q.DRAND_LOE_MAINNET={publicKeyHex:"868f005eb8e6e4ca0a47c8a77ceaa5309a47978a7c71bc5cce96366b5d7a569937c529eeda66c7293784a9402801af31",chainHashHex:"8990e7a9aaed2ffed73dbd7092123d6f289930540d7651336225dc172e51b2ce",genesisUnixSec:1595431050,periodSec:30,hashDst:"BLS_SIG_BLS12381G2_XMD:SHA-256_SSWU_RO_NUL_"};function sh(e,t){return e<=t.genesisUnixSec?1:Math.ceil((e-t.genesisUnixSec)/t.periodSec)}function ah(e,t){return t.genesisUnixSec+e*t.periodSec}function pc(e){let t=new Uint8Array(8),n=e;for(let r=7;r>=0;r--)t[r]=n&255,n=Math.floor(n/256);return(0,ur.sha256)(t)}function fc(e){let t=new Uint8Array(576),n=0;for(let r of[e.c0,e.c1])for(let o of[r.c0,r.c1,r.c2])for(let i of[o.c0,o.c1])ch(i,t,n,48),n+=48;return t}function ch(e,t,n,r){let o=e,i=BigInt(255),s=BigInt(8);for(let a=r-1;a>=0;a--)t[n+a]=Number(o&i),o>>=s}function lh(e,t,n,r){if(e.length!==32)throw new Error(`drand-IBE expects a 32-byte content key, got ${e.length}`);let o=ve.bls12_381.G1.Point,i=ve.bls12_381.fields.Fr,s=o.fromBytes(n),a;do a=fh(crypto.getRandomValues(new Uint8Array(32)))%i.ORDER;while(a===BigInt(0));let c=o.BASE.multiply(a),l=ve.bls12_381.longSignatures.hash(pc(t),r.hashDst),u=s.multiply(a),p=ve.bls12_381.pairing(u,l,!0),f=(0,ur.sha256)(fc(p)),h=new Uint8Array(32);for(let _=0;_<32;_++)h[_]=e[_]^f[_];return{variant:"drand-ibe",chainHashHex:r.chainHashHex,round:t,u_b64:lr(c.toBytes()),v_b64:lr(h)}}function hc(e){if(e.ciphertext.variant!=="drand-ibe")throw new Error("not a drand-IBE ciphertext");if(e.ciphertext.chainHashHex!==e.chain.chainHashHex)throw new Error("chain hash mismatch \u2014 ciphertext sealed to a different drand chain");let n=ve.bls12_381.G1.Point.fromBytes(dr(e.ciphertext.u_b64)),r=ve.bls12_381.longSignatures.Signature.fromBytes(e.roundSignature),o=ve.bls12_381.pairing(n,r,!0),i=(0,ur.sha256)(fc(o)),s=dr(e.ciphertext.v_b64);if(s.length!==32)throw new Error("drand-IBE V must be 32 bytes");let a=new Uint8Array(32);for(let c=0;c<32;c++)a[c]=s[c]^i[c];return a}function dh(e){let t;if(e&&e.length===48)t=e;else{t=new Uint8Array(48);let i=e??crypto.getRandomValues(new Uint8Array(48));t.set(i.slice(0,48),0)}let{secretKey:n,publicKey:r}=ve.bls12_381.longSignatures.keygen(t),o={publicKeyHex:dc(r.toBytes()),chainHashHex:dc((0,ur.sha256)(r.toBytes())),genesisUnixSec:17e8,periodSec:30,hashDst:"BLS_SIG_BLS12381G2_XMD:SHA-256_SSWU_RO_NUL_"};return{config:o,publicKey:r.toBytes(),signRound(i){let s=ve.bls12_381.longSignatures.hash(pc(i),o.hashDst);return ve.bls12_381.longSignatures.sign(s,n).toBytes()}}}function dc(e){let t="";for(let n=0;n<e.length;n++)t+=e[n].toString(16).padStart(2,"0");return t}function uh(e){if(e.length%2!==0)throw new Error("hex must have even length");let t=new Uint8Array(e.length/2);for(let n=0;n<t.length;n++)t[n]=parseInt(e.substr(n*2,2),16);return t}async function mc(e,t,n={}){let r=n.fetchImpl??fetch,o=n.timeoutMs??8e3,i=`${t.replace(/\/$/,"")}/public/${e}`,s,a;typeof AbortController<"u"&&(s=new AbortController,a=setTimeout(()=>s.abort(),o));let c;try{c=await r(i,{signal:s?.signal})}finally{a&&clearTimeout(a)}if(!c.ok)throw new Error(`drand fetch failed: ${i} \u2192 HTTP ${c.status}`);let l=await c.json();if(typeof l.round!="number"||typeof l.signature!="string"||typeof l.randomness!="string")throw new Error(`drand response malformed at ${i}`);let u=uh(l.signature);if(u.length!==96)throw new Error(`drand signature wrong length: expected 96 bytes (compressed G2), got ${u.length}`);return{round:l.round,randomness_hex:l.randomness,signature_bytes:u,previous_signature_hex:l.previous_signature}}async function ph(e,t,n,r={}){let o=await mc(e.round,t,r);return hc({ciphertext:e,roundSignature:o.signature_bytes,chain:n})}function lr(e){if(typeof Buffer<"u")return Buffer.from(e).toString("base64");let t="";for(let n=0;n<e.length;n++)t+=String.fromCharCode(e[n]);return btoa(t)}function dr(e){if(typeof Buffer<"u")return new Uint8Array(Buffer.from(e,"base64"));let t=atob(e),n=new Uint8Array(t.length);for(let r=0;r<t.length;r++)n[r]=t.charCodeAt(r);return n}function fh(e){let t=BigInt(0),n=BigInt(8);for(let r=0;r<e.length;r++)t=t<<n|BigInt(e[r]);return t}});var kc=M(ce=>{"use strict";Object.defineProperty(ce,"__esModule",{value:!0});ce.GENESIS_PREV_HASH=void 0;ce.receiptHash=Xo;ce.issueReceipt=Zo;ce.verifyReceipt=vc;ce.auditChain=gh;ce.issueGenesisReceipt=yh;ce.appendReceipt=_h;var hh=C("@noble/hashes/sha2.js"),Yo=nr(),bc=Et();ce.GENESIS_PREV_HASH="0".repeat(64);var yc=e=>{if(typeof Buffer<"u")return Buffer.from(e).toString("base64");let t="";for(let n=0;n<e.length;n++)t+=String.fromCharCode(e[n]);return btoa(t)},_c=e=>{if(typeof Buffer<"u")return new Uint8Array(Buffer.from(e,"base64"));let t=atob(e),n=new Uint8Array(t.length);for(let r=0;r<t.length;r++)n[r]=t.charCodeAt(r);return n},mh=e=>{let t="";for(let n=0;n<e.length;n++)t+=e[n].toString(16).padStart(2,"0");return t};function Xo(e){return mh((0,hh.sha256)(new TextEncoder().encode((0,Yo.canonicalJson)(e))))}function Zo(e){let t={event_type:e.event_type,sequence:e.sequence,iat:e.iat??new Date().toISOString(),lockbox_id:e.lockbox_id,prev_hash:e.prev_hash,payload:e.payload},n=new TextEncoder().encode((0,Yo.canonicalJson)(t)),r=(0,bc.hybridSign)(e.signing_key.secretKey,n);return{body:t,sig:{signer_kid:e.signer_kid,ed25519_b64:yc(r.ed25519),ml_dsa_65_b64:yc(r.mlDsa)}}}function vc(e,t){let n=new TextEncoder().encode((0,Yo.canonicalJson)(e.body)),r={ed25519:_c(e.sig.ed25519_b64),mlDsa:_c(e.sig.ml_dsa_65_b64)};return(0,bc.hybridVerify)(t,n,r)}function gh(e,t,n=1){if(e.length===0)return{ok:!0,receipts_checked:0};let r=n,o=n===1?ce.GENESIS_PREV_HASH:null;for(let i of e){if(i.body.sequence!==r)return{ok:!1,code:i.body.sequence<r?"duplicate_sequence":"out_of_order",at_sequence:i.body.sequence,reason:`expected sequence ${r}, got ${i.body.sequence}`};if(o!==null&&i.body.prev_hash!==o)return{ok:!1,code:r===1?"missing_genesis":"broken_prev_hash",at_sequence:i.body.sequence,reason:`prev_hash mismatch: expected ${o.slice(0,16)}\u2026, got ${i.body.prev_hash.slice(0,16)}\u2026`};if(!vc(i,t))return{ok:!1,code:"bad_signature",at_sequence:i.body.sequence,reason:"hybrid signature does not verify"};o=Xo(i.body),r+=1}return{ok:!0,receipts_checked:e.length}}function yh(e){return Zo({event_type:e.initial_event,lockbox_id:e.lockbox_id,prev_hash:ce.GENESIS_PREV_HASH,sequence:1,payload:e.initial_payload,signer_kid:e.signer_kid,signing_key:e.signing_key,iat:e.iat})}function _h(e,t){return Zo({...t,prev_hash:Xo(e.body),sequence:e.body.sequence+1})}});var Sc=M(pr=>{"use strict";Object.defineProperty(pr,"__esModule",{value:!0});pr.recommend=Eh;pr.summarise=xh;var bh={healthcare:{mode:"mode-4h",ttlSeconds:3600,forensicWatermark:!0,teeAttestation:!0,rationale:"HIPAA \xB7 BAA \xB7 per-recipient attribution required"},insurance:{mode:"mode-4",ttlSeconds:28800,forensicWatermark:!0,teeAttestation:!1,rationale:"Adjusters need offline access during field visits"},bank:{mode:"mode-4h",ttlSeconds:3600,forensicWatermark:!0,teeAttestation:!1,rationale:"SOX \xB7 per-open audit \xB7 forward secrecy on signed mandates"},legal:{mode:"mode-4p",ttlSeconds:86400,forensicWatermark:!0,teeAttestation:!1,rationale:"Client privilege \xB7 approval-quorum patterns common"},government:{mode:"mode-4h",ttlSeconds:3600,forensicWatermark:!0,teeAttestation:!0,rationale:"Classified \xB7 per-open attestation \xB7 k-of-N release"},media:{mode:"mode-4p",ttlSeconds:604800,forensicWatermark:!0,teeAttestation:!1,rationale:"Source protection \xB7 leak attribution \xB7 light verification UX"},hr:{mode:"mode-4",ttlSeconds:86400,forensicWatermark:!0,teeAttestation:!1,rationale:"Performance reviews \xB7 separation packages \xB7 low compliance"},smb:{mode:"mode-4",ttlSeconds:604800,forensicWatermark:!1,teeAttestation:!1,rationale:"Cost-sensitive \xB7 low compliance overhead"}},vh={"medical-phi":{minMode:"mode-4h",maxTtlSeconds:3600,watermarkRequired:!0,selectiveDisclosure:!0,thresholdSuggested:!1,teeRequired:!0},"financial-statements":{minMode:"mode-4",maxTtlSeconds:28800,watermarkRequired:!0,selectiveDisclosure:!0,thresholdSuggested:!0,teeRequired:!1},"identity-documents":{minMode:"mode-4h",maxTtlSeconds:3600,watermarkRequired:!0,selectiveDisclosure:!0,thresholdSuggested:!1,teeRequired:!0},"legal-contracts":{minMode:"mode-4p",maxTtlSeconds:86400,watermarkRequired:!0,selectiveDisclosure:!0,thresholdSuggested:!0,teeRequired:!1},"board-materials":{minMode:"mode-4p",maxTtlSeconds:86400,watermarkRequired:!0,selectiveDisclosure:!0,thresholdSuggested:!0,teeRequired:!1},"source-code":{minMode:"mode-4h",maxTtlSeconds:3600,watermarkRequired:!0,selectiveDisclosure:!0,thresholdSuggested:!1,teeRequired:!0},marketing:{minMode:"mode-4",maxTtlSeconds:604800,watermarkRequired:!1,selectiveDisclosure:!1,thresholdSuggested:!1,teeRequired:!1},"internal-memo":{minMode:"mode-4",maxTtlSeconds:86400,watermarkRequired:!1,selectiveDisclosure:!1,thresholdSuggested:!1,teeRequired:!1},"live-ops-data":{minMode:"mode-4",maxTtlSeconds:86400,watermarkRequired:!1,selectiveDisclosure:!1,thresholdSuggested:!1,teeRequired:!1}},kh={email:{deliveryMode:"attachment",adapters:["gmail","outlook","smtp"],notes:[]},chat:{deliveryMode:"link",adapters:["whatsapp","telegram","slack","teams"],notes:["Send the ndc:// link only; file bytes never traverse the chat provider"]},"cloud-share":{deliveryMode:"link",adapters:["drive","sharepoint","dropbox","box"],notes:[]},sftp:{deliveryMode:"attachment",adapters:["sftp","ftps"],notes:["Legacy partners often require this"]},sms:{deliveryMode:"link",adapters:["sms-short-link"],notes:["Link only; SMS cannot carry binary"]},voice:{deliveryMode:"link",adapters:["voice-readback"],notes:["Voice carries the unlock factor, not the content"]},"web-portal":{deliveryMode:"link",adapters:["web-portal-pickup","embed-iframe"],notes:[]},"qr-physical":{deliveryMode:"in-person",adapters:["qr-code","usb-handoff","airdrop"],notes:["Recipient must scan / plug in physically"]},webhook:{deliveryMode:"attachment",adapters:["webhook-push"],notes:["B2B server-to-server only"]}},wh=[{channel:"chat",fileClass:"medical-phi",note:"PHI over chat \u2192 link only; never attach the bytes"},{channel:"chat",fileClass:"identity-documents",note:"ID documents over chat \u2192 link only"},{channel:"chat",fileClass:"legal-contracts",note:"Legal contracts over chat are discouraged; use email/portal"},{channel:"chat",fileClass:"board-materials",note:"Board materials over chat are discouraged; use email/portal"},{channel:"chat",fileClass:"source-code",note:"Source code over chat is discouraged; use cloud-share/portal"},{channel:"cloud-share",fileClass:"identity-documents",note:"ID documents on cloud share discouraged; prefer email or portal"},{channel:"sms",fileClass:"medical-phi",note:"PHI over SMS is not compliant; reroute to web-portal"},{channel:"voice",fileClass:"medical-phi",note:"Voice only carries the unlock; the bytes must travel another channel"}],wc={"mode-4":1,"mode-4p":2,"mode-4h":3,"mode-6":4};function Sh(e,t){return wc[e]>=wc[t]?e:t}function Eh(e){let t=bh[e.orgType],n=vh[e.fileClass],r=kh[e.channel],o=Sh(t.mode,n.minMode);e.recipientLacksPasskey&&o==="mode-4h"&&(o="mode-4p");let i=Math.min(t.ttlSeconds,n.maxTtlSeconds),s={forensicWatermark:t.forensicWatermark||n.watermarkRequired,selectiveDisclosureSegments:n.selectiveDisclosure||!!e.perRecipientPolicy,thresholdKofN:e.multipleApproversRequired??null,teeAttestation:t.teeAttestation||n.teeRequired,perOpenRatchet:o==="mode-4h"||o==="mode-4p"||o==="mode-6",dpopRequired:o!=="mode-4",timelockDrand:!!e.timeLockUnixSec&&!!e.timeLockDecentralized,timelockServerGate:!!e.timeLockUnixSec&&!e.timeLockDecentralized},a={...r,adapterCandidates:[...r.adapters]},c=[...a.notes],l=wh.find(u=>u.channel===e.channel&&u.fileClass===e.fileClass);return l&&(c.unshift(`\u26A0 ${l.note}`),a.deliveryMode==="attachment"&&(a.deliveryMode="link")),e.fileClass==="live-ops-data"&&e.channel==="email"&&c.push("Live ops data over email is non-standard; consider webhook-push or web-portal."),{sensitivityMode:o,cacheTtlSeconds:i,features:s,delivery:{deliveryMode:a.deliveryMode,adapterCandidates:a.adapterCandidates},notes:c}}function xh(e){let t=[e.sensitivityMode,`TTL ${e.cacheTtlSeconds}s`];return e.features.forensicWatermark&&t.push("watermark"),e.features.selectiveDisclosureSegments&&t.push("segments"),e.features.thresholdKofN&&t.push(`threshold ${e.features.thresholdKofN.k}-of-${e.features.thresholdKofN.n}`),e.features.teeAttestation&&t.push("TEE"),e.features.perOpenRatchet&&t.push("ratchet"),e.features.dpopRequired&&t.push("DPoP"),e.features.timelockDrand?t.push("drand-tlock"):e.features.timelockServerGate&&t.push("server-timegate"),t.push(`via ${e.delivery.deliveryMode} (${e.delivery.adapterCandidates.join("/")})`),t.join(" \xB7 ")}});var xc=M($t=>{"use strict";Object.defineProperty($t,"__esModule",{value:!0});$t.recommendationToMandate=$h;$t.v3SealReceiptPayload=Rh;$t.v3OpenReceiptPayload=Dh;$t.showcaseChips=Ch;function Ah(e){switch(e){case"mode-4":return"name_email";case"mode-4p":return"name_email";case"mode-4h":return"hardware_attest";case"mode-6":return"name_email_phone"}}function Th(e){return e.features.dpopRequired?"device_mfa":e.sensitivityMode==="mode-4h"?"first_device":e.sensitivityMode==="mode-4"?"any":"first_device"}function Ih(e){return e.delivery.deliveryMode==="attachment"?"file":e.delivery.deliveryMode==="link"?"link":"view_only"}function Ec(e){let t=e.delivery.adapterCandidates;return t.some(n=>n==="outlook"||n==="sharepoint"||n==="teams")?"m365":t.some(n=>n==="webhook-push"||n==="web-portal-pickup"||n==="embed-iframe")?"in_app":"capsule"}function Ph(e){let t=Ec(e);return t==="m365"?"m365_only":t==="in_app"?"in_app":"any"}function $h(e){let{recommendation:t,source:n}=e,r=t.sensitivityMode==="mode-6",o=n.timeLockUnixSec?new Date(n.timeLockUnixSec*1e3).toISOString():null;return{time:{ttl_seconds:t.cacheTtlSeconds,burn_after_first_read:r,unlock_at:o,max_opens:r?1:null},identity:{capture:Ah(t.sensitivityMode),claim_required:t.sensitivityMode!=="mode-4",allow_magic_link:t.sensitivityMode==="mode-4",allowed_emails:null},device:{binding:Th(t),listed_fingerprints:null},channel:{delivery:Ih(t),route:Ec(t),channel_constraint:Ph(t)},burn:{crypto_shred_on_burn:!0,mdm_wipe_webhook:!1,undo_window_s:0,dual_control:!!t.features.thresholdKofN},encrypt:{mode:"hpke",vault_mirror:t.features.teeAttestation,scoped_key_release:!0},proof:{signing:"ed25519",anchor:t.features.teeAttestation?"rekor":"none",c2pa_in_file:!1,ndc_seal:!0},watermark:{visible:t.features.forensicWatermark,forensic:t.features.forensicWatermark,content:t.features.forensicWatermark?"recipient_id":null,custom_text:null,forensics_lookup:t.features.forensicWatermark},ndc_v3_extensions:{profile:"pq-hybrid",suite:{kem:"X25519+ML-KEM-768",sig:"Ed25519+ML-DSA-65",aead:"AES-256-GCM",kdf:"HKDF-SHA-256"},dpop_required:t.features.dpopRequired,ratchet_enabled:t.features.perOpenRatchet,tee_attestation_required:t.features.teeAttestation,threshold_k_of_n:t.features.thresholdKofN,segments_enabled:t.features.selectiveDisclosureSegments,timelock_drand:t.features.timelockDrand,timelock_server_gate:t.features.timelockServerGate,timelock_unix_sec:n.timeLockUnixSec??null}}}function Rh(e){return{event_kind:"ndc_v3_sealed",lockbox_id:e.lockbox_id,ciphertext_sha256:e.ciphertext_sha256,recipient_kid:e.recipient_kid,signer_kid:e.signer_kid,mandate:e.mandate,bytes_sealed:e.bytes_sealed,issued_at:e.issued_at??new Date().toISOString()}}function Dh(e){return{event_kind:"ndc_v3_opened",lockbox_id:e.lockbox_id,ratchet_sequence:e.ratchet_sequence,dpop_jkt:e.dpop_jkt,ip_hash:e.ip_hash,opened_at:e.opened_at??new Date().toISOString()}}function Ch(e){let t=[],n=e.ndc_v3_extensions;return t.push("PQ-hybrid"),n.dpop_required&&t.push("DPoP"),n.ratchet_enabled&&t.push("per-open ratchet"),e.watermark.forensic&&t.push("forensic watermark"),n.segments_enabled&&t.push("selective disclosure"),n.threshold_k_of_n&&t.push(`${n.threshold_k_of_n.k}-of-${n.threshold_k_of_n.n} quorum`),n.tee_attestation_required&&t.push("TEE attest"),n.timelock_drand?t.push("drand time-lock"):n.timelock_server_gate&&t.push("server time-gate"),e.time.burn_after_first_read&&t.push("burn-after-read"),t}});var $c=M(ke=>{"use strict";Object.defineProperty(ke,"__esModule",{value:!0});ke.encodeFragment=Pc;ke.decodeFragment=Nh;ke.extractProofToken=Oh;ke.encodeProofToken=jh;ke.decodeShareCredential=Lh;ke.sealBytesForPublicShare=Mh;ke.openPublicShare=Kh;ke.wrapFragmentForShortLink=Hh;var Ac=Et(),Tc=nr();function Fe(e){let t="";for(let n=0;n<e.length;n++)t+=String.fromCharCode(e[n]);return btoa(t)}function cn(e){let t=atob(e),n=new Uint8Array(t.length);for(let r=0;r<t.length;r++)n[r]=t.charCodeAt(r);return n}function Ic(e){return Fe(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function Pc(e){return encodeURIComponent(JSON.stringify(e))}function Nh(e){let t=JSON.parse(decodeURIComponent(e));if(t.v!==3)throw new Error(`fragment version unsupported: ${t.v}`);return t}function Oh(e){return{v:3,kind:"proof",n:e.n,t:e.t,spe:e.spe,spm:e.spm}}function jh(e){return encodeURIComponent(JSON.stringify(e))}function Lh(e){let t=e.trim(),n=t.indexOf("#"),r=n>=0?t.slice(n+1):t,o;try{o=JSON.parse(decodeURIComponent(r))}catch(i){throw new Error(`credential parse failed: ${i.message??"invalid_json"}`)}if(o.v!==3)throw new Error(`credential version unsupported: ${String(o.v)}`);return o.kind==="proof"?{kind:"proof",value:o}:{kind:"fragment",value:o}}function Bh(){let e=new Uint8Array(16);crypto.getRandomValues(e);let t="";for(let n=0;n<e.length;n++)t+=e[n].toString(16).padStart(2,"0");return t}function Fh(){let e=new Uint8Array(32);return crypto.getRandomValues(e),Ic(e)}async function Mh(e){let t=e.bytes,n={name:e.filename,type:e.contentType},r=(0,Ac.generateHybridKemKeypair)(),o=(0,Ac.generateHybridSigKeypair)(),i=Bh(),s=Fh(),a=await(0,Tc.sealHybrid)({plaintext:t,recipientPublicKey:r.publicKey,recipientKid:`ephemeral-${i}`,signerKeypair:o,signerKid:`lock-${i}`,meta:{lockbox_id:i,server:e.server,bearer:s,original_filename:n.name,original_content_type:n.type||"application/octet-stream",cache_ttl_seconds:e.ttlSeconds,dpop_required:!1,tee_attestation_url:null,ratchet_state:null}}),c=Pc({v:3,n:n.name,t:n.type||"application/octet-stream",rsx:Fe(r.secretKey.x25519),rsm:Fe(r.secretKey.mlKem),rpx:Fe(r.publicKey.x25519),spe:Fe(o.publicKey.ed25519),spm:Fe(o.publicKey.mlDsa)});return{container:a.container,fragment:c,lockboxId:i}}async function Kh(e){let t={x25519:cn(e.fragment.rsx),mlKem:cn(e.fragment.rsm)},n=cn(e.fragment.rpx),r={ed25519:cn(e.fragment.spe),mlDsa:cn(e.fragment.spm)},{plaintext:o,header:i}=await(0,Tc.openHybrid)({container:e.container,recipientSecretKey:t,recipientPublicX25519:n,signerPublicKey:r});return{plaintext:o,filename:i.original_filename||e.fragment.n,contentType:i.original_content_type||e.fragment.t,signerKid:i.sig.signer_kid,issuedAt:i.issued_at,ciphertextSha256:i.ciphertext_sha256}}async function Hh(e){let t=crypto.getRandomValues(new Uint8Array(32)),n=crypto.getRandomValues(new Uint8Array(12)),r=new TextEncoder().encode(e),o=new ArrayBuffer(32);new Uint8Array(o).set(t);let i=new ArrayBuffer(12);new Uint8Array(i).set(n);let s=new ArrayBuffer(r.byteLength);new Uint8Array(s).set(r);let a=await crypto.subtle.importKey("raw",o,{name:"AES-GCM"},!1,["encrypt"]),c=new Uint8Array(await crypto.subtle.encrypt({name:"AES-GCM",iv:i},a,s));return{wrapKeyB64Url:Ic(t),wrappedFragmentB64:Fe(c),wrapIvB64:Fe(n)}}});var Nc=M(d=>{"use strict";var Uh=d&&d.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(d,"__esModule",{value:!0});d.PVE_SIGNED_LEN=d.RCPT_VERSION=d.PVE_VERSION=d.RCPT_MAGIC=d.PVE_MAGIC=d.verifyDpop=d.publicJwkFromBytes=d.jwkThumbprint=d.createDpop=d.verifyContainerHeader=d.signContainerHeader=d.sealHybrid=d.openHybrid=d.headerSigningBytes=d.encodeContainerV3=d.decodeContainerV3=d.ContainerV3Error=d.CONTAINER_HEADER_MAX_BYTES=d.CONTAINER_FIXED_PREFIX_BYTES=d.CONTAINER_MAGIC=d.canonicalJson=d.NDC_V03_RATCHET_DOMAIN=d.NDC_V03_CONTENT_KEY_DOMAIN=d.NDC_V03_KEM_DOMAIN=d.NDC_WIRE_V03=d.NDC_WIRE_V1=d.PQ_SIZES=d.PQ_SUITE=d.ratchetAdvance=d.deriveContentKey=d.mlDsa65VerifyDetached=d.mlDsa65SignDetached=d.generateMlDsa65Keypair=d.hybridVerify=d.hybridSign=d.hybridKemDecapsulate=d.hybridKemEncapsulate=d.generateHybridSigKeypair=d.deriveHybridKemKeypairFromSeed=d.generateHybridKemKeypair=d.ALGORITHMS=d.CRYPTO_VERSION=d.NoDataSDK=d.NoDataForms=d.NoDataSystems=d.NoDataWebhook=d.NoDataEmail=d.verifyProofOfWork=d.solveProofOfWork=d.NoDataCrypto=void 0;d.auditChain=d.appendReceipt=d.timeGateEncrypt=d.timeGateDecrypt=d.timeForRound=d.TimeGateError=d.roundForTime=d.makeFakeDrandChain=d.fetchDrandRound=d.drandTimeLockOpen=d.drandTimeLockEncrypt=d.drandTimeLockDecrypt=d.DRAND_LOE_MAINNET=d.watermarkSvgOverlay=d.findLeakSource=d.computeWatermark=d.SegmentError=d.sealSegments=d.openSegments=d.manifestDigest=d.buildCapability=d.splitSecret=d.serializeShare=d.deserializeShare=d.combineShares=d.decodeAttestationPayload=d.verifyCoseSign1Es384=d.verifyAttestation=d.parseAttestation=d.fetchAttestation=d.stepRatchet=d.replayRatchet=d.destroyKey=d.verifyReceiptDelta=d.parseReceiptDelta=d.signReceiptDelta=d.encodeReceiptDeltaSignedBytes=d.verifyPve=d.pveHash=d.parsePve=d.signPve=d.encodePveSignedBytes=d.originJktForPublicKey=d.uuidFromDeltaId=d.deltaIdFromUuid=d.ABSORB_STATUS=d.DELTA_KIND=d.RCPT_TOTAL_LEN=d.RCPT_SIGNED_LEN=d.PVE_TOTAL_LEN=void 0;d.wrapFragmentForShortLink=d.openPublicShare=d.sealBytesForPublicShare=d.decodeShareCredential=d.encodeProofToken=d.extractProofToken=d.decodeFragment=d.encodeFragment=d.v3SealReceiptPayload=d.v3OpenReceiptPayload=d.showcaseChips=d.recommendationToMandate=d.summarise=d.recommend=d.verifyReceipt=d.receiptHash=d.issueReceipt=d.issueGenesisReceipt=d.GENESIS_PREV_HASH=void 0;var Vh=Ye();Object.defineProperty(d,"NoDataCrypto",{enumerable:!0,get:function(){return Uh(Vh).default}});var Rc=xa();Object.defineProperty(d,"solveProofOfWork",{enumerable:!0,get:function(){return Rc.solveProofOfWork}});Object.defineProperty(d,"verifyProofOfWork",{enumerable:!0,get:function(){return Rc.verifyProofOfWork}});var ln=Ta();Object.defineProperty(d,"NoDataEmail",{enumerable:!0,get:function(){return ln.NoDataEmail}});Object.defineProperty(d,"NoDataWebhook",{enumerable:!0,get:function(){return ln.NoDataWebhook}});Object.defineProperty(d,"NoDataSystems",{enumerable:!0,get:function(){return ln.NoDataSystems}});Object.defineProperty(d,"NoDataForms",{enumerable:!0,get:function(){return ln.NoDataForms}});Object.defineProperty(d,"NoDataSDK",{enumerable:!0,get:function(){return ln.NoDataSDK}});d.CRYPTO_VERSION="0.2.0";d.ALGORITHMS={ENCRYPTION:"AES-256-GCM",KEY_EXCHANGE:"RSA-OAEP-4096",KEY_DERIVATION:"PBKDF2-SHA256-310K",SIGNING:"Ed25519",HASHING:"SHA-256",PROOF_OF_WORK:"SHA-256-NONCE"};var V=Et();Object.defineProperty(d,"generateHybridKemKeypair",{enumerable:!0,get:function(){return V.generateHybridKemKeypair}});Object.defineProperty(d,"deriveHybridKemKeypairFromSeed",{enumerable:!0,get:function(){return V.deriveHybridKemKeypairFromSeed}});Object.defineProperty(d,"generateHybridSigKeypair",{enumerable:!0,get:function(){return V.generateHybridSigKeypair}});Object.defineProperty(d,"hybridKemEncapsulate",{enumerable:!0,get:function(){return V.hybridKemEncapsulate}});Object.defineProperty(d,"hybridKemDecapsulate",{enumerable:!0,get:function(){return V.hybridKemDecapsulate}});Object.defineProperty(d,"hybridSign",{enumerable:!0,get:function(){return V.hybridSign}});Object.defineProperty(d,"hybridVerify",{enumerable:!0,get:function(){return V.hybridVerify}});Object.defineProperty(d,"generateMlDsa65Keypair",{enumerable:!0,get:function(){return V.generateMlDsa65Keypair}});Object.defineProperty(d,"mlDsa65SignDetached",{enumerable:!0,get:function(){return V.mlDsa65SignDetached}});Object.defineProperty(d,"mlDsa65VerifyDetached",{enumerable:!0,get:function(){return V.mlDsa65VerifyDetached}});Object.defineProperty(d,"deriveContentKey",{enumerable:!0,get:function(){return V.deriveContentKey}});Object.defineProperty(d,"ratchetAdvance",{enumerable:!0,get:function(){return V.ratchetAdvance}});Object.defineProperty(d,"PQ_SUITE",{enumerable:!0,get:function(){return V.PQ_SUITE}});Object.defineProperty(d,"PQ_SIZES",{enumerable:!0,get:function(){return V.PQ_SIZES}});Object.defineProperty(d,"NDC_WIRE_V1",{enumerable:!0,get:function(){return V.NDC_WIRE_V1}});Object.defineProperty(d,"NDC_WIRE_V03",{enumerable:!0,get:function(){return V.NDC_WIRE_V03}});Object.defineProperty(d,"NDC_V03_KEM_DOMAIN",{enumerable:!0,get:function(){return V.NDC_V03_KEM_DOMAIN}});Object.defineProperty(d,"NDC_V03_CONTENT_KEY_DOMAIN",{enumerable:!0,get:function(){return V.NDC_V03_CONTENT_KEY_DOMAIN}});Object.defineProperty(d,"NDC_V03_RATCHET_DOMAIN",{enumerable:!0,get:function(){return V.NDC_V03_RATCHET_DOMAIN}});var le=nr();Object.defineProperty(d,"canonicalJson",{enumerable:!0,get:function(){return le.canonicalJson}});Object.defineProperty(d,"CONTAINER_MAGIC",{enumerable:!0,get:function(){return le.CONTAINER_MAGIC}});Object.defineProperty(d,"CONTAINER_FIXED_PREFIX_BYTES",{enumerable:!0,get:function(){return le.CONTAINER_FIXED_PREFIX_BYTES}});Object.defineProperty(d,"CONTAINER_HEADER_MAX_BYTES",{enumerable:!0,get:function(){return le.CONTAINER_HEADER_MAX_BYTES}});Object.defineProperty(d,"ContainerV3Error",{enumerable:!0,get:function(){return le.ContainerV3Error}});Object.defineProperty(d,"decodeContainerV3",{enumerable:!0,get:function(){return le.decodeContainerV3}});Object.defineProperty(d,"encodeContainerV3",{enumerable:!0,get:function(){return le.encodeContainerV3}});Object.defineProperty(d,"headerSigningBytes",{enumerable:!0,get:function(){return le.headerSigningBytes}});Object.defineProperty(d,"openHybrid",{enumerable:!0,get:function(){return le.openHybrid}});Object.defineProperty(d,"sealHybrid",{enumerable:!0,get:function(){return le.sealHybrid}});Object.defineProperty(d,"signContainerHeader",{enumerable:!0,get:function(){return le.signContainerHeader}});Object.defineProperty(d,"verifyContainerHeader",{enumerable:!0,get:function(){return le.verifyContainerHeader}});var fr=Ho();Object.defineProperty(d,"createDpop",{enumerable:!0,get:function(){return fr.createDpop}});Object.defineProperty(d,"jwkThumbprint",{enumerable:!0,get:function(){return fr.jwkThumbprint}});Object.defineProperty(d,"publicJwkFromBytes",{enumerable:!0,get:function(){return fr.publicJwkFromBytes}});Object.defineProperty(d,"verifyDpop",{enumerable:!0,get:function(){return fr.verifyDpop}});var H=qa();Object.defineProperty(d,"PVE_MAGIC",{enumerable:!0,get:function(){return H.PVE_MAGIC}});Object.defineProperty(d,"RCPT_MAGIC",{enumerable:!0,get:function(){return H.RCPT_MAGIC}});Object.defineProperty(d,"PVE_VERSION",{enumerable:!0,get:function(){return H.PVE_VERSION}});Object.defineProperty(d,"RCPT_VERSION",{enumerable:!0,get:function(){return H.RCPT_VERSION}});Object.defineProperty(d,"PVE_SIGNED_LEN",{enumerable:!0,get:function(){return H.PVE_SIGNED_LEN}});Object.defineProperty(d,"PVE_TOTAL_LEN",{enumerable:!0,get:function(){return H.PVE_TOTAL_LEN}});Object.defineProperty(d,"RCPT_SIGNED_LEN",{enumerable:!0,get:function(){return H.RCPT_SIGNED_LEN}});Object.defineProperty(d,"RCPT_TOTAL_LEN",{enumerable:!0,get:function(){return H.RCPT_TOTAL_LEN}});Object.defineProperty(d,"DELTA_KIND",{enumerable:!0,get:function(){return H.DELTA_KIND}});Object.defineProperty(d,"ABSORB_STATUS",{enumerable:!0,get:function(){return H.ABSORB_STATUS}});Object.defineProperty(d,"deltaIdFromUuid",{enumerable:!0,get:function(){return H.deltaIdFromUuid}});Object.defineProperty(d,"uuidFromDeltaId",{enumerable:!0,get:function(){return H.uuidFromDeltaId}});Object.defineProperty(d,"originJktForPublicKey",{enumerable:!0,get:function(){return H.originJktForPublicKey}});Object.defineProperty(d,"encodePveSignedBytes",{enumerable:!0,get:function(){return H.encodePveSignedBytes}});Object.defineProperty(d,"signPve",{enumerable:!0,get:function(){return H.signPve}});Object.defineProperty(d,"parsePve",{enumerable:!0,get:function(){return H.parsePve}});Object.defineProperty(d,"pveHash",{enumerable:!0,get:function(){return H.pveHash}});Object.defineProperty(d,"verifyPve",{enumerable:!0,get:function(){return H.verifyPve}});Object.defineProperty(d,"encodeReceiptDeltaSignedBytes",{enumerable:!0,get:function(){return H.encodeReceiptSignedBytes}});Object.defineProperty(d,"signReceiptDelta",{enumerable:!0,get:function(){return H.signReceipt}});Object.defineProperty(d,"parseReceiptDelta",{enumerable:!0,get:function(){return H.parseReceipt}});Object.defineProperty(d,"verifyReceiptDelta",{enumerable:!0,get:function(){return H.verifyReceipt}});var Qo=Ya();Object.defineProperty(d,"destroyKey",{enumerable:!0,get:function(){return Qo.destroyKey}});Object.defineProperty(d,"replayRatchet",{enumerable:!0,get:function(){return Qo.replayRatchet}});Object.defineProperty(d,"stepRatchet",{enumerable:!0,get:function(){return Qo.stepRatchet}});var ei=Qa();Object.defineProperty(d,"fetchAttestation",{enumerable:!0,get:function(){return ei.fetchAttestation}});Object.defineProperty(d,"parseAttestation",{enumerable:!0,get:function(){return ei.parseAttestation}});Object.defineProperty(d,"verifyAttestation",{enumerable:!0,get:function(){return ei.verifyAttestation}});var Dc=qo();Object.defineProperty(d,"verifyCoseSign1Es384",{enumerable:!0,get:function(){return Dc.verifyCoseSign1Es384}});Object.defineProperty(d,"decodeAttestationPayload",{enumerable:!0,get:function(){return Dc.decodeAttestationPayload}});var hr=nc();Object.defineProperty(d,"combineShares",{enumerable:!0,get:function(){return hr.combineShares}});Object.defineProperty(d,"deserializeShare",{enumerable:!0,get:function(){return hr.deserializeShare}});Object.defineProperty(d,"serializeShare",{enumerable:!0,get:function(){return hr.serializeShare}});Object.defineProperty(d,"splitSecret",{enumerable:!0,get:function(){return hr.splitSecret}});var dn=sc();Object.defineProperty(d,"buildCapability",{enumerable:!0,get:function(){return dn.buildCapability}});Object.defineProperty(d,"manifestDigest",{enumerable:!0,get:function(){return dn.manifestDigest}});Object.defineProperty(d,"openSegments",{enumerable:!0,get:function(){return dn.openSegments}});Object.defineProperty(d,"sealSegments",{enumerable:!0,get:function(){return dn.sealSegments}});Object.defineProperty(d,"SegmentError",{enumerable:!0,get:function(){return dn.SegmentError}});var ti=lc();Object.defineProperty(d,"computeWatermark",{enumerable:!0,get:function(){return ti.computeWatermark}});Object.defineProperty(d,"findLeakSource",{enumerable:!0,get:function(){return ti.findLeakSource}});Object.defineProperty(d,"watermarkSvgOverlay",{enumerable:!0,get:function(){return ti.watermarkSvgOverlay}});var me=gc();Object.defineProperty(d,"DRAND_LOE_MAINNET",{enumerable:!0,get:function(){return me.DRAND_LOE_MAINNET}});Object.defineProperty(d,"drandTimeLockDecrypt",{enumerable:!0,get:function(){return me.drandTimeLockDecrypt}});Object.defineProperty(d,"drandTimeLockEncrypt",{enumerable:!0,get:function(){return me.drandTimeLockEncrypt}});Object.defineProperty(d,"drandTimeLockOpen",{enumerable:!0,get:function(){return me.drandTimeLockOpen}});Object.defineProperty(d,"fetchDrandRound",{enumerable:!0,get:function(){return me.fetchDrandRound}});Object.defineProperty(d,"makeFakeDrandChain",{enumerable:!0,get:function(){return me.makeFakeDrandChain}});Object.defineProperty(d,"roundForTime",{enumerable:!0,get:function(){return me.roundForTime}});Object.defineProperty(d,"TimeGateError",{enumerable:!0,get:function(){return me.TimeGateError}});Object.defineProperty(d,"timeForRound",{enumerable:!0,get:function(){return me.timeForRound}});Object.defineProperty(d,"timeGateDecrypt",{enumerable:!0,get:function(){return me.timeGateDecrypt}});Object.defineProperty(d,"timeGateEncrypt",{enumerable:!0,get:function(){return me.timeGateEncrypt}});var nt=kc();Object.defineProperty(d,"appendReceipt",{enumerable:!0,get:function(){return nt.appendReceipt}});Object.defineProperty(d,"auditChain",{enumerable:!0,get:function(){return nt.auditChain}});Object.defineProperty(d,"GENESIS_PREV_HASH",{enumerable:!0,get:function(){return nt.GENESIS_PREV_HASH}});Object.defineProperty(d,"issueGenesisReceipt",{enumerable:!0,get:function(){return nt.issueGenesisReceipt}});Object.defineProperty(d,"issueReceipt",{enumerable:!0,get:function(){return nt.issueReceipt}});Object.defineProperty(d,"receiptHash",{enumerable:!0,get:function(){return nt.receiptHash}});Object.defineProperty(d,"verifyReceipt",{enumerable:!0,get:function(){return nt.verifyReceipt}});var Cc=Sc();Object.defineProperty(d,"recommend",{enumerable:!0,get:function(){return Cc.recommend}});Object.defineProperty(d,"summarise",{enumerable:!0,get:function(){return Cc.summarise}});var mr=xc();Object.defineProperty(d,"recommendationToMandate",{enumerable:!0,get:function(){return mr.recommendationToMandate}});Object.defineProperty(d,"showcaseChips",{enumerable:!0,get:function(){return mr.showcaseChips}});Object.defineProperty(d,"v3OpenReceiptPayload",{enumerable:!0,get:function(){return mr.v3OpenReceiptPayload}});Object.defineProperty(d,"v3SealReceiptPayload",{enumerable:!0,get:function(){return mr.v3SealReceiptPayload}});var Me=$c();Object.defineProperty(d,"encodeFragment",{enumerable:!0,get:function(){return Me.encodeFragment}});Object.defineProperty(d,"decodeFragment",{enumerable:!0,get:function(){return Me.decodeFragment}});Object.defineProperty(d,"extractProofToken",{enumerable:!0,get:function(){return Me.extractProofToken}});Object.defineProperty(d,"encodeProofToken",{enumerable:!0,get:function(){return Me.encodeProofToken}});Object.defineProperty(d,"decodeShareCredential",{enumerable:!0,get:function(){return Me.decodeShareCredential}});Object.defineProperty(d,"sealBytesForPublicShare",{enumerable:!0,get:function(){return Me.sealBytesForPublicShare}});Object.defineProperty(d,"openPublicShare",{enumerable:!0,get:function(){return Me.openPublicShare}});Object.defineProperty(d,"wrapFragmentForShortLink",{enumerable:!0,get:function(){return Me.wrapFragmentForShortLink}})});import{McpServer as Rg}from"@modelcontextprotocol/sdk/server/mcp.js";import{StdioServerTransport as Dg}from"@modelcontextprotocol/sdk/server/stdio.js";import{z as g}from"zod";import{z as fe}from"zod";import{createHash as Jd}from"node:crypto";import{readdirSync as ms,readFileSync as gs,statSync as Mn}from"node:fs";import{basename as ys,join as Jr}from"node:path";var ue={text:[],header:[],secrets:[],table:null};function Br(e){e.table&&(ue.table=e.table);for(let t of e.text??[])ue.text.some(n=>n.kind===t.kind)||ue.text.push(t);e.header&&!ue.header.includes(e.header)&&ue.header.push(e.header);for(let t of e.secrets??[])ue.secrets.some(n=>n.id===t.id)||ue.secrets.push(t)}function Tn(){return ue.text}function Li(){return ue.header}function it(){return ue.table}function Bi(){return ue.secrets}var In=[{id:"aws-access-key",name:"AWS Access Key",pattern:/(?:^|[^A-Z0-9])AKIA[A-Z2-7]{16}(?:[^A-Z2-7]|$)/,severity:"critical"},{id:"aws-secret-key",name:"AWS Secret Key",pattern:/(?:aws_secret_access_key|aws_secret_key|secret_access_key)\s*[=:]\s*['"]?[A-Za-z0-9/+=]{40}['"]?/,severity:"critical"},{id:"gcp-api-key",name:"GCP API Key",pattern:/AIza[0-9A-Za-z_-]{35}/,severity:"critical"},{id:"gcp-service-account",name:"GCP Service Account",pattern:/"type"\s*:\s*"service_account"/,severity:"critical"},{id:"github-token",name:"GitHub Token",pattern:/gh[pousr]_[0-9a-zA-Z]{36,}/,severity:"critical"},{id:"github-fine-grained",name:"GitHub Fine-Grained Token",pattern:/github_pat_[0-9a-zA-Z_]{22,}/,severity:"critical"},{id:"gitlab-token",name:"GitLab Token",pattern:/glpat-[0-9a-zA-Z_-]{20,}/,severity:"critical"},{id:"stripe-secret",name:"Stripe Secret Key",pattern:/sk_live_[0-9a-zA-Z]{24,}/,severity:"critical"},{id:"stripe-restricted",name:"Stripe Restricted Key",pattern:/rk_live_[0-9a-zA-Z]{24,}/,severity:"critical"},{id:"slack-token",name:"Slack Token",pattern:/xox[baprs]-[0-9a-zA-Z-]{10,}/,severity:"high"},{id:"slack-webhook",name:"Slack Webhook",pattern:/hooks\.slack\.com\/services\/T[0-9A-Z]{8,}\/B[0-9A-Z]{8,}\/[0-9a-zA-Z]{24}/,severity:"high"},{id:"twilio-api-key",name:"Twilio API Key",pattern:/SK[0-9a-fA-F]{32}/,severity:"high"},{id:"sendgrid-api-key",name:"SendGrid API Key",pattern:/SG\.[0-9a-zA-Z_-]{22}\.[0-9a-zA-Z_-]{43}/,severity:"critical"},{id:"postgres-uri",name:"PostgreSQL Connection String",pattern:/postgres(?:ql)?:\/\/[^\s'"]{10,}/,severity:"critical"},{id:"mongodb-uri",name:"MongoDB Connection String",pattern:/mongodb(?:\+srv)?:\/\/[^\s'"]{10,}/,severity:"critical"},{id:"redis-uri",name:"Redis Connection String",pattern:/redis(?:s)?:\/\/[^\s'"]{10,}/,severity:"high"},{id:"openai-key",name:"OpenAI API Key",pattern:/sk-[0-9a-zA-Z]{20,}T3BlbkFJ[0-9a-zA-Z]{20,}/,severity:"critical"},{id:"openai-project-key",name:"OpenAI API Key",pattern:/sk-(?:proj|svcacct|admin)-[0-9A-Za-z_-]{40,}/,severity:"critical"},{id:"anthropic-key",name:"Anthropic API Key",pattern:/sk-ant-[0-9a-zA-Z_-]{40,}/,severity:"critical"},{id:"firebase-key",name:"Firebase API Key",pattern:/AIza[0-9A-Za-z_-]{35}/,severity:"high"},{id:"supabase-key",name:"Supabase Service Key",pattern:/eyJ[0-9a-zA-Z_-]{100,}/,severity:"critical"},{id:"private-key",name:"Private Key",pattern:/-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/,severity:"critical"},{id:"jwt-secret",name:"JWT/Generic Secret",pattern:/(?:jwt_secret|JWT_SECRET|secret_key|SECRET_KEY|api_secret|API_SECRET)\s*[=:]\s*['"][^'"]{8,}['"]/,severity:"high"},{id:"password-in-code",name:"Password in Code",pattern:/(?:password|passwd|pwd)\s*[=:]\s*['"][^'"]{8,}['"]/,severity:"high"},{id:"bearer-token",name:"Bearer Token in Code",pattern:/['"]Bearer\s+[0-9a-zA-Z._-]{20,}['"]/,severity:"high"}];function st(){let e=Bi().filter(t=>!In.some(n=>n.id===t.id));return[...In,...e]}var Fi=/node_modules\/|\.next\/|\.test\.|\.spec\.|__tests__\/|\.nodata-proof\.json$|\.git\//,Mi=/(^|\/)\.env(\.[\w-]+)*\.(example|sample|template|dist)$|\.(example|sample|template)$|(^|\/)[^/]*\.(example|sample)\.[a-z0-9]+$/i,Kr=/(^|\/)(__tests__|__mocks__|tests?|spec|fixtures?|mocks?|samples?|examples?|demo|testdata)(\/|$)|\.(test|spec)\.[a-z0-9]+$|\.min\.(m?js|css)$|(^|\/)[^/]*\.worker\.min\.m?js$/i,sd=[{name:"lodash",below:"4.17.21",severity:"critical",cve:"CVE-2021-23337",desc:"Command injection via template"},{name:"minimist",below:"1.2.6",severity:"critical",cve:"CVE-2021-44906",desc:"Prototype pollution"},{name:"json5",below:"2.2.2",severity:"high",cve:"CVE-2022-46175",desc:"Prototype pollution"},{name:"express",below:"4.19.2",severity:"high",cve:"CVE-2024-29041",desc:"Open redirect"},{name:"path-to-regexp",below:"6.3.0",severity:"high",cve:"CVE-2024-45296",desc:"ReDoS"},{name:"sanitize-html",below:"2.12.1",severity:"high",cve:"CVE-2024-21501",desc:"XSS bypass"},{name:"dompurify",below:"3.0.9",severity:"high",cve:"CVE-2024-45801",desc:"mXSS"},{name:"jsonwebtoken",below:"9.0.0",severity:"critical",cve:"CVE-2022-23529",desc:"Key confusion attack"},{name:"jose",below:"4.15.5",severity:"high",cve:"CVE-2024-28176",desc:"DoS via JWE"},{name:"axios",below:"1.6.0",severity:"high",cve:"CVE-2023-45857",desc:"CSRF cookie leak"},{name:"node-fetch",below:"2.6.7",severity:"high",cve:"CVE-2022-0235",desc:"Header leak on redirect"},{name:"serialize-javascript",below:"6.0.2",severity:"critical",cve:"CVE-2024-11831",desc:"XSS via serialization"},{name:"xml2js",below:"0.6.0",severity:"high",cve:"CVE-2023-0842",desc:"Prototype pollution"},{name:"next",below:"14.1.1",severity:"high",cve:"CVE-2024-34350",desc:"SSRF via headers"},{name:"sharp",below:"0.32.6",severity:"high",cve:"CVE-2023-4863",desc:"libwebp heap overflow"},{name:"multer",below:"1.4.5",severity:"high",cve:"CVE-2022-24434",desc:"Prototype pollution"},{name:"tough-cookie",below:"4.1.3",severity:"medium",cve:"CVE-2023-26136",desc:"Prototype pollution"},{name:"semver",below:"7.5.4",severity:"medium",cve:"CVE-2022-25883",desc:"ReDoS"},{name:"ip",below:"2.0.1",severity:"critical",cve:"CVE-2024-29415",desc:"SSRF bypass via octal IP"},{name:"tar",below:"6.2.1",severity:"high",cve:"CVE-2024-28863",desc:"DoS via path traversal"}];function ad(e,t){let n=i=>i.replace(/^[^0-9]*/,"").split(".").map(s=>parseInt(s,10)||0),r=n(e),o=n(t);for(let i=0;i<3;i++){if((r[i]||0)<(o[i]||0))return!0;if((r[i]||0)>(o[i]||0))return!1}return!1}function Ki(e){let t=[],n;try{n=JSON.parse(e)}catch{return t}let r={...n.dependencies??{},...n.devDependencies??{}};for(let[o,i]of Object.entries(r)){let s=(i||"").replace(/^[\^~>=<\s]+/,""),a=sd.find(c=>c.name===o&&ad(s,c.below));a&&t.push({name:o,version:s,vuln:a})}return t}var cd=[{pattern:/^(full_?name|first_?name|last_?name|spouse_?name|beneficiary_?name)$/i,type:"name",label:"Person name"},{pattern:/^(email|e_?mail|email_?address)$/i,type:"email",label:"Email address"},{pattern:/^(phone|mobile|telephone|phone_?number|cell_?phone)$/i,type:"phone",label:"Phone number"},{pattern:/^(id_?number|identity|ssn|social_?security|national_?id|teudat_?zehut)$/i,type:"id",label:"ID number"},{pattern:/^(address|street_?address|home_?address)$/i,type:"address",label:"Address"},{pattern:/^(date_?of_?birth|dob|birth_?date|birthday)$/i,type:"dob",label:"Date of birth"},{pattern:/^(bank_?account|iban|account_?number|bank_?details|routing_?number)$/i,type:"financial",label:"Bank account"},{pattern:/^(credit_?card|card_?number|cvv|cc_?number)$/i,type:"financial",label:"Credit card"},{pattern:/^(salary|income|commission|premium|compensation)$/i,type:"financial",label:"Salary / income"},{pattern:/^(medical_?info|health_?conditions|diagnosis|medication|prescription)$/i,type:"medical",label:"Medical"},{pattern:/^(passport|passport_?number|passport_?id)$/i,type:"id",label:"Passport"},{pattern:/^(driver_?license|drivers_?license|dl_?number)$/i,type:"id",label:"Driver license"},{pattern:/^(tax_?id|tin|vat_?number|ein)$/i,type:"financial",label:"Tax ID"},{pattern:/^(insurance_?number|policy_?number|member_?id)$/i,type:"id",label:"Insurance/Policy"},{pattern:/^(biometric|fingerprint|face_?id|retina)$/i,type:"biometric",label:"Biometric"},{pattern:/^(latitude|longitude|lat|lng|geo_?location|coordinates)$/i,type:"location",label:"Geolocation"}],ld=[{pattern:/^(?:שם|שם_מלא|שם פרטי|שם_פרטי|שם משפחה|שם_משפחה|שם הלקוח|שם בן זוג|שם המבוטח|שם המוטב|שם הילד|שם הקטין)$/i,type:"name",label:"\u05E9\u05DD \u05D0\u05D3\u05DD"},{pattern:/^(?:ת"ז|ת\.ז|ת ז|תז|תעודת זהות|תעודת_זהות|מספר זהות|מס' זהות|teudat_zehut|tz|israeli_id|il_id)$/i,type:"id",label:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA"},{pattern:/^(?:דרכון|מספר דרכון|רישיון נהיגה|רישיון_נהיגה|רשיון נהיגה)$/i,type:"id",label:"\u05D3\u05E8\u05DB\u05D5\u05DF/\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF"},{pattern:/^(?:מייל|דוא"ל|דוא_ל|דואר אלקטרוני|אימייל|כתובת מייל)$/i,type:"email",label:"\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9"},{pattern:/^(?:טלפון|טל'|נייד|פלאפון|סלולרי|מספר טלפון|טלפון נייד)$/i,type:"phone",label:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF"},{pattern:/^(?:כתובת|כתובת מגורים|רחוב|מס בית|עיר|ישוב|יישוב|מיקוד|כתובת מלאה|מען)$/i,type:"address",label:"\u05DB\u05EA\u05D5\u05D1\u05EA"},{pattern:/^(?:תאריך לידה|ת לידה|תאריך הולדת|יום הולדת|גיל)$/i,type:"dob",label:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"},{pattern:/^(?:חשבון בנק|מספר חשבון|מס חשבון|סניף|iban|iban_il)$/i,type:"financial",label:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7"},{pattern:/^(?:כרטיס אשראי|מספר אשראי|cvv|אשראי)$/i,type:"financial",label:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"},{pattern:/^(?:שכר|משכורת|הכנסה|פרמיה|שכר ברוטו|שכר נטו|תגמול|בונוס|פיצוי)$/i,type:"financial",label:"\u05E9\u05DB\u05E8/\u05D4\u05DB\u05E0\u05E1\u05D4"},{pattern:/^(?:אבחון|אבחנה|מחלה|תרופה|מרשם|בדיקה רפואית|מצב רפואי|חיסון|רגישות|אלרגיה|סוג דם)$/i,type:"medical",label:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(?:מספר פוליסה|מס פוליסה|פוליסה|מספר חבר|מספר ביטוח)$/i,type:"id",label:"\u05E4\u05D5\u05DC\u05D9\u05E1\u05D4/\u05D7\u05D1\u05E8\u05D5\u05EA"},{pattern:/^(?:שם הילד|תעודת זהות של ילד|ילדים|קטין|מספר ילדים|תעודת לידה)$/i,type:"minor_data",label:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05DF"},{pattern:/^(?:דת|לאום|מין|נטייה מינית|השקפה פוליטית|מצב משפחתי|עדה|מוצא)$/i,type:"sensitive_personal",label:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9"},{pattern:/^(?:מספר רכב|מס רכב|לוחית רישוי|מספר רישוי)$/i,type:"tracking",label:"\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"}],dd=/^(id|uuid|created_?at|updated_?at|deleted_?at|status|type|category|description|title|slug|url|path|key|value|enabled|active|public|version|metadata|config|settings|data|content|note|comment|label|color|icon)$/i,ud=/^שם[ _](?:ה)?(?:קובץ|מוצר|פריט|חברה|ארגון|עסק|פרויקט|גיליון|טבלה|שדה|קטגוריה|סניף|בנק|עיר|רחוב|ישוב|יישוב|מסמך|תוכנית|חבילה|קורס|מחלקה|אתר|דומיין|מותג|ספק|שירות|תפקיד)$|^(file|product|item|company|org|organization|project|sheet|table|field|category|branch|bank|city|street|document|plan|course|department|site|domain|brand|vendor|service|role)[ _-]?name$/i;function Ue(e){if(!e)return null;let t=e.trim();if(dd.test(t)||/^name$/i.test(t))return null;let n=t.replace(/[\s-]+/g,"_");for(let r of[...ld,...cd])if(r.pattern.test(t)||r.pattern.test(n))return{type:r.type,label:r.label};if(ud.test(t))return null;if(/^שם[ _][\u0590-\u05FF"'׳ ]{2,20}$/.test(t))return{type:"name",label:"\u05E9\u05DD \u05D0\u05D3\u05DD"};if(/^(customer|client|employee|inspector|supervisor|contact|person|patient|user|owner|manager|agent|member|driver|tenant|student|parent|beneficiary|insured)_?(full_?)?name$/i.test(n))return{type:"name",label:"Person name"};for(let r of Li()){let o=r(t);if(o)return{type:o.type,label:o.label}}return null}var Pn={id:"critical",financial:"critical",medical:"critical",biometric:"critical",minor_data:"critical",sensitive_personal:"critical",email:"high",phone:"high",name:"high",address:"high",dob:"high",tracking:"medium",location:"medium"};function $n(e){let t=String(e??"").replace(/\D/g,"");if(t.length===0||t.length>9)return!1;let n=t.padStart(9,"0"),r=0;for(let o=0;o<9;o++){let i=parseInt(n[o]??"0",10)*(o%2+1);i>9&&(i-=9),r+=i}return r%10===0&&parseInt(n,10)>0}var Ot=/(?:\+972[\s-]?|0)(?:5[0-9]|[2-4]|[89])(?:[\s-]?\d){7}/g;var jt=/\bIL\d{2}\s?(?:\d{4}\s?){4}\d{3}\b/g;function pd(e){let t=String(e??"").replace(/\D/g,"");if(t.length<12||t.length>19)return!1;let n=0,r=!1;for(let o=t.length-1;o>=0;o-=1){let i=parseInt(t[o]??"0",10);r&&(i*=2,i>9&&(i-=9)),n+=i,r=!r}return n%10===0}function fd(e){let t=String(e??"").replace(/\s/g,"").toUpperCase();if(!/^[A-Z]{2}\d{2}[A-Z0-9]{10,30}$/.test(t))return!1;let n=t.slice(4)+t.slice(0,4),r=0;for(let o of n){let i=o>="A"&&o<="Z"?String(o.charCodeAt(0)-55):o;for(let s of i)r=(r*10+Number(s))%97}return r===1}var Fr="(?<!\\d)(?<!\\d[.,])",Mr="(?!\\d)(?![.,]\\d)",Hr=[{subkind:"israeli_id",severity:"high",pattern:new RegExp(`${Fr}\\d{9}${Mr}`,"g"),validate:$n,hint:"Israeli national ID (check digit verified) in plaintext. Encrypt the column or mask it at rest."},{subkind:"credit_card",severity:"critical",pattern:new RegExp(`${Fr}[2-6][ -]?(?:\\d[ -]?){11,17}\\d${Mr}`,"g"),validate:pd,hint:"Payment card number (Luhn verified) in plaintext. This is PCI scope."},{subkind:"iban",severity:"high",pattern:/\b[A-Z]{2}\d{2}(?: ?[A-Z0-9]{4}){2,7}(?: ?[A-Z0-9]{1,4})?\b/g,validate:fd,hint:"Bank account in IBAN form (mod-97 verified) in plaintext."},{subkind:"israeli_phone",severity:"medium",pattern:new RegExp(`${Fr}(?:\\+972[- ]?|0)(?:[57]\\d|[2-489])[- ]?\\d{3}[- ]?\\d{4}${Mr}`,"g"),validate:e=>{let t=e.replace(/\D/g,"").replace(/^972/,"0");return/^0[57]\d{8}$/.test(t)?!0:/^0[2-489]\d{7}$/.test(t)&&(/[- ]/.test(e)||e.startsWith("+972"))},hint:"Israeli phone number in plaintext."}];function Hi(e){if(e.length!==14&&e.length!==17)return!1;let t=+e.slice(0,4),n=+e.slice(4,6),r=+e.slice(6,8),o=+e.slice(8,10),i=+e.slice(10,12),s=+e.slice(12,14);return t>=1970&&t<=2099&&n>=1&&n<=12&&r>=1&&r<=31&&o<24&&i<60&&s<60}function Ui(e){let t=Number(e);return!Number.isSafeInteger(t)||t<1024?!1:Number.isInteger(Math.log2(t))||t%1048576===0}var hd=new Set(["000000018","123456782","111111118","222222226","333333334","999999998","4111111111111111","4242424242424242","4000056655665556","5555555555554444","5105105105105100","2223003122003222","378282246310005","371449635398431","6011111111111117","3056930009020004","4012888888881881","4000000000000002"]);function Nt(e){return hd.has(e.replace(/\D/g,""))}function Rn(e){let t=e.replace(/\D/g,"");return Hi(t)||Ui(t)}function Dn(e,t){let n=[];for(let r of Hr){r.pattern.lastIndex=0;let o=new Set,i,s=0;for(;(i=r.pattern.exec(e))!==null&&(s+=1,!(s>2e5));){let a=i[0];if(!(r.subkind!=="iban"&&r.subkind!=="israeli_phone"&&Rn(a))&&(r.validate(a)&&o.add(a.replace(/[\s-]/g,"")),o.size>=1e5))break}if(o.size>0){if(t)for(let c of o)Nt(c)||t(r.subkind,c);let a=[...o].filter(c=>!Nt(c)).length;n.push({subkind:r.subkind,severity:a===0?"low":r.severity,hint:a===0?`${r.hint} All ${o.size} are published test numbers.`:r.hint,count:o.size,real:a})}}for(let r of Tn()){let o=new Set;for(let i of r.find(e))o.add(e.slice(i.start,i.end).trim());o.size>0&&n.push({subkind:r.kind,severity:r.severity,hint:r.hint,count:o.size})}return n}function Ve(e,t){let n=[],r="",o=!1;for(let i=0;i<e.length;i++){let s=e[i];o?s==='"'&&e[i+1]==='"'?(r+='"',i++):s==='"'?o=!1:r+=s:s==='"'?o=!0:s===t?(n.push(r),r=""):r+=s}return n.push(r),n}import{inflateRawSync as Ed}from"node:zlib";import{inflateSync as md}from"node:zlib";var Ur=new Set([".pdf"]),Vi=8*1024*1024;function gd(e){let t=e.toString("latin1"),n=new Map,r=/(\d+)\s+(\d+)\s+obj\b/g,o;for(;(o=r.exec(t))!==null;){let i=Number(o[1]),s=r.lastIndex,a=t.indexOf("endobj",s);if(a<0)continue;let c=t.indexOf("stream",s),l,u=null;if(c>=0&&c<a){l=t.slice(s,c);let p=c+6;t[p]==="\r"&&(p+=1),t[p]===`
-`&&(p+=1);let f=t.indexOf("endstream",p);f>p&&(u=e.subarray(p,f))}else l=t.slice(s,a);n.set(i,{num:i,dict:l,stream:u})}return n}function yd(e){let t=e.toString("latin1").replace(/\s/g,"");t.startsWith("<~")&&(t=t.slice(2));let n=t.indexOf("~>");n>=0&&(t=t.slice(0,n));let r=[],o=0,i=0;for(let s of t){if(s==="z"&&i===0){r.push(0,0,0,0);continue}let a=s.charCodeAt(0)-33;if(a<0||a>84)return null;o=o*85+a,i+=1,i===5&&(r.push(o>>>24&255,o>>>16&255,o>>>8&255,o&255),o=0,i=0)}if(i>0){for(let a=i;a<5;a+=1)o=o*85+84;let s=[o>>>24&255,o>>>16&255,o>>>8&255,o&255];for(let a=0;a<i-1;a+=1)r.push(s[a]??0)}return Buffer.from(r)}function _d(e){let t=e.toString("latin1").replace(/\s/g,"").split(">")[0]??"",n=t.length%2?t+"0":t;return/^[0-9A-Fa-f]*$/.test(n)?Buffer.from(n,"hex"):null}function bd(e){let t=/\/Filter\s*(\[[^\]]*\]|\/\w+)/.exec(e);return!t||!t[1]?[]:[...t[1].matchAll(/\/(\w+)/g)].map(n=>n[1]??"")}function Wi(e){if(!e.stream)return null;let t=e.stream;for(let n of bd(e.dict)){let r=null;if(n==="FlateDecode")try{r=md(t)}catch{return null}else if(n==="ASCII85Decode")r=yd(t);else if(n==="ASCIIHexDecode")r=_d(t);else return null;if(r===null)return null;t=r}return t.toString("latin1")}function vd(e){let t=new Map,n=1,r=/begincodespacerange([\s\S]*?)endcodespacerange/.exec(e);if(r&&r[1]){let c=/<([0-9A-Fa-f]+)>/.exec(r[1]);c&&c[1]&&c[1].length>=4&&(n=2)}let o=c=>{let l="";for(let u=0;u+3<c.length+1;u+=4){let p=parseInt(c.slice(u,u+4),16);Number.isFinite(p)&&p>0&&(l+=String.fromCharCode(p))}return l},i=/beginbfchar([\s\S]*?)endbfchar/g,s;for(;(s=i.exec(e))!==null;){let c=/<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]*)>/g,l;for(;(l=c.exec(s[1]??""))!==null;)t.set(parseInt(l[1]??"0",16),o(l[2]??""))}let a=/beginbfrange([\s\S]*?)endbfrange/g;for(;(s=a.exec(e))!==null;){let c=s[1]??"",l=/<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]*)>/g,u;for(;(u=l.exec(c))!==null;){let p=parseInt(u[1]??"0",16),f=parseInt(u[2]??"0",16),h=parseInt((u[3]??"0").slice(0,4)||"0",16);if(!(f-p>65535))for(let _=p;_<=f;_+=1)t.set(_,String.fromCharCode(h+(_-p)))}}return{map:t,bytes:n}}function kd(e){let t=new Map,n=new Map,r=[];for(let o of e.values()){let i=/\/Font\s*<<([\s\S]*?)>>/.exec(o.dict);i?.[1]&&r.push(i[1]);let s=/\/Font\s+(\d+)\s+\d+\s+R/.exec(o.dict);if(s){let a=e.get(Number(s[1]));a&&r.push(a.dict)}}for(let o of r){let i=/\/([^\s/<>[\]()]+)\s+(\d+)\s+\d+\s+R/g,s;for(;(s=i.exec(o))!==null;)n.set(s[1]??"",Number(s[2]))}for(let[o,i]of n){let s=e.get(i);if(!s)continue;let a=/\/ToUnicode\s+(\d+)\s+\d+\s+R/.exec(s.dict);if(!a)continue;let c=e.get(Number(a[1]));if(!c)continue;let l=Wi(c);l&&t.set(o,vd(l))}return t}function zi(e){let t=[];for(let n=0;n<e.length;n+=1){let r=e[n];if(r!=="\\"){t.push(r.charCodeAt(0)&255);continue}let o=e[n+1];if(o===void 0)break;if(o>="0"&&o<="7"){let s="",a=n+1;for(;a<e.length&&s.length<3&&e[a]>="0"&&e[a]<="7";)s+=e[a],a+=1;t.push(parseInt(s,8)&255),n=a-1;continue}let i={n:10,r:13,t:9,b:8,f:12};t.push(i[o]??o.charCodeAt(0)&255),n+=1}return t}function qi(e){if(e.length<2||e[0]!==254||e[1]!==255)return null;let t="";for(let n=2;n+1<e.length;n+=2)t+=String.fromCharCode((e[n]??0)<<8|(e[n+1]??0));return t}function Gi(e,t){let n=qi(e);if(n!==null)return n;if(!t)return e.map(o=>String.fromCharCode(o)).join("");let r="";if(t.bytes===2)for(let o=0;o+1<e.length;o+=2){let i=(e[o]??0)<<8|(e[o+1]??0);r+=t.map.get(i)??""}else for(let o of e)r+=t.map.get(o)??String.fromCharCode(o);return r}function wd(e,t){let n="",r,o=/\/([^\s/<>[\]()]+)\s+[\d.]+\s+Tf|\((?:\\.|[^\\)])*\)|<[0-9A-Fa-f\s]*>|TJ|Tj|'|"/g,i,s="";for(;(i=o.exec(e))!==null;){let a=i[0];if(a.endsWith("Tf")){r=t.get(i[1]??"");continue}if(a==="TJ"||a==="Tj"||a==="'"||a==='"'){s&&(n+=s+`
-`,s="");continue}if(a.startsWith("("))s+=Gi(zi(a.slice(1,-1)),r);else if(a.startsWith("<")){let c=a.slice(1,-1).replace(/\s+/g,""),l=[];for(let u=0;u+1<c.length;u+=2)l.push(parseInt(c.slice(u,u+2),16));s+=Gi(l,r)}}return s&&(n+=s+`
-`),n}function Sd(e,t){let n=e.toString("latin1"),r=/\/Info\s+(\d+)\s+\d+\s+R/.exec(n),o=r?t.get(Number(r[1]))?.dict:void 0;if(!o)return"";let i=[],s=/\/(Author|Title|Subject|Keywords|Creator|Producer)\s*(\((?:\\.|[^\\)])*\)|<[0-9A-Fa-f\s]*>)/g,a;for(;(a=s.exec(o))!==null;){let c=a[2]??"";if(c.startsWith("(")){let l=zi(c.slice(1,-1));i.push(qi(l)??l.map(u=>String.fromCharCode(u)).join(""))}else{let l=c.slice(1,-1).replace(/\s+/g,""),u="";if(l.toUpperCase().startsWith("FEFF"))for(let p=4;p+3<l.length+1;p+=4)u+=String.fromCharCode(parseInt(l.slice(p,p+4),16));else for(let p=0;p+1<l.length;p+=2)u+=String.fromCharCode(parseInt(l.slice(p,p+2),16));i.push(u)}}return i.join(`
-`)}function Ji(e){if(!e.subarray(0,8).toString("latin1").startsWith("%PDF-")||e.toString("latin1",0,Math.min(e.length,4096)).includes("/Encrypt"))return null;let n=gd(e);if(n.size===0)return null;let r=kd(n),o=[];o.push(Sd(e,n));let i=0,s=0,a=!1;for(let c of n.values()){if(!c.stream||/\/Subtype|\/Type\s*\/(XObject|Font|Metadata)|\/FontFile/.test(c.dict))continue;let l=Wi(c);if(l===null||!/(TJ|Tj)\b/.test(l))continue;let u=wd(l,r);if(u.trim().length!==0){if(s+=1,i+u.length>Vi){o.push(u.slice(0,Math.max(0,Vi-i))),a=!0;break}o.push(u),i+=u.length}}return s===0?null:{text:o.join(`
-`),truncated:a,streams:s}}var Yi=new Set([".xlsx",".xlsm",".docx",".pptx"]),Vr=8*1024*1024,xd=101010256,Ad=33639248,Td=67324752;function at(e){let t=Math.min(e.length,67584),n=-1;for(let s=e.length-22;s>=e.length-t&&s>=0;s-=1)if(e.readUInt32LE(s)===xd){n=s;break}if(n<0)return null;let r=e.readUInt16LE(n+10),o=e.readUInt32LE(n+16);if(o>=e.length)return null;let i=[];for(let s=0;s<r&&!(o+46>e.length||e.readUInt32LE(o)!==Ad);s+=1){let a=e.readUInt16LE(o+10),c=e.readUInt32LE(o+20),l=e.readUInt32LE(o+24),u=e.readUInt16LE(o+28),p=e.readUInt16LE(o+30),f=e.readUInt16LE(o+32),h=e.readUInt32LE(o+42),_=e.subarray(o+46,o+46+u).toString("utf8");i.push({name:_,method:a,compSize:c,uncompSize:l,localHeaderOffset:h}),o+=46+u+p+f}return i}function ct(e,t){let n=t.localHeaderOffset;if(n+30>e.length||e.readUInt32LE(n)!==Td)return null;let r=e.readUInt16LE(n+26),o=e.readUInt16LE(n+28),i=n+30+r+o,s=i+t.compSize;if(s>e.length)return null;let a=e.subarray(i,s);try{if(t.method===0)return Buffer.from(a);if(t.method===8)return Ed(a)}catch{return null}return null}function Id(e,t){return ct(e,t)?.toString("utf8")??null}var Pd={"&amp;":"&","&lt;":"<","&gt;":">","&quot;":'"',"&apos;":"'"};function Pe(e){return e.replace(/&(amp|lt|gt|quot|apos);/g,t=>Pd[t]??t).replace(/&#(\d+);/g,(t,n)=>{let r=Number(n);return r>0&&r<1114112?String.fromCodePoint(r):""}).replace(/&#x([0-9a-fA-F]+);/g,(t,n)=>{let r=parseInt(n,16);return r>0&&r<1114112?String.fromCodePoint(r):""})}function $d(e){return Pe(e.replace(/<[^>]*>/g,`
+</svg>`}function cc(e){let t="";for(let n=0;n<e.length;n++)t+=e[n].toString(16).padStart(2,"0");return t}});var yc=M(ee=>{"use strict";Object.defineProperty(ee,"__esModule",{value:!0});ee.DRAND_LOE_MAINNET=ee.TimeGateError=void 0;ee.timeGateEncrypt=sh;ee.timeGateDecrypt=ah;ee.roundForTime=ch;ee.timeForRound=lh;ee.drandTimeLockEncrypt=uh;ee.drandTimeLockDecrypt=mc;ee.makeFakeDrandChain=ph;ee.fetchDrandRound=gc;ee.drandTimeLockOpen=hh;var ve=C("@noble/curves/bls12-381.js"),pr=C("@noble/hashes/sha2.js"),Be=e=>e,pc="NDC-v0.3-server-time-gate";async function sh(e){let t=crypto.getRandomValues(new Uint8Array(12)),n=new TextEncoder().encode(`${pc}|${e.notBeforeUnixSec}`),r=await crypto.subtle.importKey("raw",Be(e.serverWrapKey),{name:"AES-GCM"},!1,["encrypt"]),o=await crypto.subtle.encrypt({name:"AES-GCM",iv:Be(t),additionalData:Be(n)},r,Be(e.plaintext));return{variant:"server-attested",notBeforeUnixSec:e.notBeforeUnixSec,iv_b64:dr(t),ciphertext_b64:dr(new Uint8Array(o))}}var cn=class extends Error{constructor(t,n){super(n),this.name="TimeGateError",this.code=t}};ee.TimeGateError=cn;async function ah(e){if(e.currentUnixSec<e.ciphertext.notBeforeUnixSec)throw new cn("not_yet",`time-gate not yet open: now ${e.currentUnixSec} < notBefore ${e.ciphertext.notBeforeUnixSec}`);let t=new TextEncoder().encode(`${pc}|${e.ciphertext.notBeforeUnixSec}`),n=await crypto.subtle.importKey("raw",Be(e.serverWrapKey),{name:"AES-GCM"},!1,["decrypt"]);try{let r=await crypto.subtle.decrypt({name:"AES-GCM",iv:Be(ur(e.ciphertext.iv_b64)),additionalData:Be(t)},n,Be(ur(e.ciphertext.ciphertext_b64)));return new Uint8Array(r)}catch{throw new cn("tamper_detected","AES-GCM authentication tag failed \u2014 ciphertext or AAD tampered")}}ee.DRAND_LOE_MAINNET={publicKeyHex:"868f005eb8e6e4ca0a47c8a77ceaa5309a47978a7c71bc5cce96366b5d7a569937c529eeda66c7293784a9402801af31",chainHashHex:"8990e7a9aaed2ffed73dbd7092123d6f289930540d7651336225dc172e51b2ce",genesisUnixSec:1595431050,periodSec:30,hashDst:"BLS_SIG_BLS12381G2_XMD:SHA-256_SSWU_RO_NUL_"};function ch(e,t){return e<=t.genesisUnixSec?1:Math.ceil((e-t.genesisUnixSec)/t.periodSec)}function lh(e,t){return t.genesisUnixSec+e*t.periodSec}function fc(e){let t=new Uint8Array(8),n=e;for(let r=7;r>=0;r--)t[r]=n&255,n=Math.floor(n/256);return(0,pr.sha256)(t)}function hc(e){let t=new Uint8Array(576),n=0;for(let r of[e.c0,e.c1])for(let o of[r.c0,r.c1,r.c2])for(let i of[o.c0,o.c1])dh(i,t,n,48),n+=48;return t}function dh(e,t,n,r){let o=e,i=BigInt(255),s=BigInt(8);for(let a=r-1;a>=0;a--)t[n+a]=Number(o&i),o>>=s}function uh(e,t,n,r){if(e.length!==32)throw new Error(`drand-IBE expects a 32-byte content key, got ${e.length}`);let o=ve.bls12_381.G1.Point,i=ve.bls12_381.fields.Fr,s=o.fromBytes(n),a;do a=mh(crypto.getRandomValues(new Uint8Array(32)))%i.ORDER;while(a===BigInt(0));let c=o.BASE.multiply(a),l=ve.bls12_381.longSignatures.hash(fc(t),r.hashDst),d=s.multiply(a),p=ve.bls12_381.pairing(d,l,!0),f=(0,pr.sha256)(hc(p)),h=new Uint8Array(32);for(let y=0;y<32;y++)h[y]=e[y]^f[y];return{variant:"drand-ibe",chainHashHex:r.chainHashHex,round:t,u_b64:dr(c.toBytes()),v_b64:dr(h)}}function mc(e){if(e.ciphertext.variant!=="drand-ibe")throw new Error("not a drand-IBE ciphertext");if(e.ciphertext.chainHashHex!==e.chain.chainHashHex)throw new Error("chain hash mismatch \u2014 ciphertext sealed to a different drand chain");let n=ve.bls12_381.G1.Point.fromBytes(ur(e.ciphertext.u_b64)),r=ve.bls12_381.longSignatures.Signature.fromBytes(e.roundSignature),o=ve.bls12_381.pairing(n,r,!0),i=(0,pr.sha256)(hc(o)),s=ur(e.ciphertext.v_b64);if(s.length!==32)throw new Error("drand-IBE V must be 32 bytes");let a=new Uint8Array(32);for(let c=0;c<32;c++)a[c]=s[c]^i[c];return a}function ph(e){let t;if(e&&e.length===48)t=e;else{t=new Uint8Array(48);let i=e??crypto.getRandomValues(new Uint8Array(48));t.set(i.slice(0,48),0)}let{secretKey:n,publicKey:r}=ve.bls12_381.longSignatures.keygen(t),o={publicKeyHex:uc(r.toBytes()),chainHashHex:uc((0,pr.sha256)(r.toBytes())),genesisUnixSec:17e8,periodSec:30,hashDst:"BLS_SIG_BLS12381G2_XMD:SHA-256_SSWU_RO_NUL_"};return{config:o,publicKey:r.toBytes(),signRound(i){let s=ve.bls12_381.longSignatures.hash(fc(i),o.hashDst);return ve.bls12_381.longSignatures.sign(s,n).toBytes()}}}function uc(e){let t="";for(let n=0;n<e.length;n++)t+=e[n].toString(16).padStart(2,"0");return t}function fh(e){if(e.length%2!==0)throw new Error("hex must have even length");let t=new Uint8Array(e.length/2);for(let n=0;n<t.length;n++)t[n]=parseInt(e.substr(n*2,2),16);return t}async function gc(e,t,n={}){let r=n.fetchImpl??fetch,o=n.timeoutMs??8e3,i=`${t.replace(/\/$/,"")}/public/${e}`,s,a;typeof AbortController<"u"&&(s=new AbortController,a=setTimeout(()=>s.abort(),o));let c;try{c=await r(i,{signal:s?.signal})}finally{a&&clearTimeout(a)}if(!c.ok)throw new Error(`drand fetch failed: ${i} \u2192 HTTP ${c.status}`);let l=await c.json();if(typeof l.round!="number"||typeof l.signature!="string"||typeof l.randomness!="string")throw new Error(`drand response malformed at ${i}`);let d=fh(l.signature);if(d.length!==96)throw new Error(`drand signature wrong length: expected 96 bytes (compressed G2), got ${d.length}`);return{round:l.round,randomness_hex:l.randomness,signature_bytes:d,previous_signature_hex:l.previous_signature}}async function hh(e,t,n,r={}){let o=await gc(e.round,t,r);return mc({ciphertext:e,roundSignature:o.signature_bytes,chain:n})}function dr(e){if(typeof Buffer<"u")return Buffer.from(e).toString("base64");let t="";for(let n=0;n<e.length;n++)t+=String.fromCharCode(e[n]);return btoa(t)}function ur(e){if(typeof Buffer<"u")return new Uint8Array(Buffer.from(e,"base64"));let t=atob(e),n=new Uint8Array(t.length);for(let r=0;r<t.length;r++)n[r]=t.charCodeAt(r);return n}function mh(e){let t=BigInt(0),n=BigInt(8);for(let r=0;r<e.length;r++)t=t<<n|BigInt(e[r]);return t}});var wc=M(ce=>{"use strict";Object.defineProperty(ce,"__esModule",{value:!0});ce.GENESIS_PREV_HASH=void 0;ce.receiptHash=Qo;ce.issueReceipt=ei;ce.verifyReceipt=kc;ce.auditChain=_h;ce.issueGenesisReceipt=bh;ce.appendReceipt=vh;var gh=C("@noble/hashes/sha2.js"),Zo=rr(),vc=Et();ce.GENESIS_PREV_HASH="0".repeat(64);var _c=e=>{if(typeof Buffer<"u")return Buffer.from(e).toString("base64");let t="";for(let n=0;n<e.length;n++)t+=String.fromCharCode(e[n]);return btoa(t)},bc=e=>{if(typeof Buffer<"u")return new Uint8Array(Buffer.from(e,"base64"));let t=atob(e),n=new Uint8Array(t.length);for(let r=0;r<t.length;r++)n[r]=t.charCodeAt(r);return n},yh=e=>{let t="";for(let n=0;n<e.length;n++)t+=e[n].toString(16).padStart(2,"0");return t};function Qo(e){return yh((0,gh.sha256)(new TextEncoder().encode((0,Zo.canonicalJson)(e))))}function ei(e){let t={event_type:e.event_type,sequence:e.sequence,iat:e.iat??new Date().toISOString(),lockbox_id:e.lockbox_id,prev_hash:e.prev_hash,payload:e.payload},n=new TextEncoder().encode((0,Zo.canonicalJson)(t)),r=(0,vc.hybridSign)(e.signing_key.secretKey,n);return{body:t,sig:{signer_kid:e.signer_kid,ed25519_b64:_c(r.ed25519),ml_dsa_65_b64:_c(r.mlDsa)}}}function kc(e,t){let n=new TextEncoder().encode((0,Zo.canonicalJson)(e.body)),r={ed25519:bc(e.sig.ed25519_b64),mlDsa:bc(e.sig.ml_dsa_65_b64)};return(0,vc.hybridVerify)(t,n,r)}function _h(e,t,n=1){if(e.length===0)return{ok:!0,receipts_checked:0};let r=n,o=n===1?ce.GENESIS_PREV_HASH:null;for(let i of e){if(i.body.sequence!==r)return{ok:!1,code:i.body.sequence<r?"duplicate_sequence":"out_of_order",at_sequence:i.body.sequence,reason:`expected sequence ${r}, got ${i.body.sequence}`};if(o!==null&&i.body.prev_hash!==o)return{ok:!1,code:r===1?"missing_genesis":"broken_prev_hash",at_sequence:i.body.sequence,reason:`prev_hash mismatch: expected ${o.slice(0,16)}\u2026, got ${i.body.prev_hash.slice(0,16)}\u2026`};if(!kc(i,t))return{ok:!1,code:"bad_signature",at_sequence:i.body.sequence,reason:"hybrid signature does not verify"};o=Qo(i.body),r+=1}return{ok:!0,receipts_checked:e.length}}function bh(e){return ei({event_type:e.initial_event,lockbox_id:e.lockbox_id,prev_hash:ce.GENESIS_PREV_HASH,sequence:1,payload:e.initial_payload,signer_kid:e.signer_kid,signing_key:e.signing_key,iat:e.iat})}function vh(e,t){return ei({...t,prev_hash:Qo(e.body),sequence:e.body.sequence+1})}});var Ec=M(fr=>{"use strict";Object.defineProperty(fr,"__esModule",{value:!0});fr.recommend=Ah;fr.summarise=Th;var kh={healthcare:{mode:"mode-4h",ttlSeconds:3600,forensicWatermark:!0,teeAttestation:!0,rationale:"HIPAA \xB7 BAA \xB7 per-recipient attribution required"},insurance:{mode:"mode-4",ttlSeconds:28800,forensicWatermark:!0,teeAttestation:!1,rationale:"Adjusters need offline access during field visits"},bank:{mode:"mode-4h",ttlSeconds:3600,forensicWatermark:!0,teeAttestation:!1,rationale:"SOX \xB7 per-open audit \xB7 forward secrecy on signed mandates"},legal:{mode:"mode-4p",ttlSeconds:86400,forensicWatermark:!0,teeAttestation:!1,rationale:"Client privilege \xB7 approval-quorum patterns common"},government:{mode:"mode-4h",ttlSeconds:3600,forensicWatermark:!0,teeAttestation:!0,rationale:"Classified \xB7 per-open attestation \xB7 k-of-N release"},media:{mode:"mode-4p",ttlSeconds:604800,forensicWatermark:!0,teeAttestation:!1,rationale:"Source protection \xB7 leak attribution \xB7 light verification UX"},hr:{mode:"mode-4",ttlSeconds:86400,forensicWatermark:!0,teeAttestation:!1,rationale:"Performance reviews \xB7 separation packages \xB7 low compliance"},smb:{mode:"mode-4",ttlSeconds:604800,forensicWatermark:!1,teeAttestation:!1,rationale:"Cost-sensitive \xB7 low compliance overhead"}},wh={"medical-phi":{minMode:"mode-4h",maxTtlSeconds:3600,watermarkRequired:!0,selectiveDisclosure:!0,thresholdSuggested:!1,teeRequired:!0},"financial-statements":{minMode:"mode-4",maxTtlSeconds:28800,watermarkRequired:!0,selectiveDisclosure:!0,thresholdSuggested:!0,teeRequired:!1},"identity-documents":{minMode:"mode-4h",maxTtlSeconds:3600,watermarkRequired:!0,selectiveDisclosure:!0,thresholdSuggested:!1,teeRequired:!0},"legal-contracts":{minMode:"mode-4p",maxTtlSeconds:86400,watermarkRequired:!0,selectiveDisclosure:!0,thresholdSuggested:!0,teeRequired:!1},"board-materials":{minMode:"mode-4p",maxTtlSeconds:86400,watermarkRequired:!0,selectiveDisclosure:!0,thresholdSuggested:!0,teeRequired:!1},"source-code":{minMode:"mode-4h",maxTtlSeconds:3600,watermarkRequired:!0,selectiveDisclosure:!0,thresholdSuggested:!1,teeRequired:!0},marketing:{minMode:"mode-4",maxTtlSeconds:604800,watermarkRequired:!1,selectiveDisclosure:!1,thresholdSuggested:!1,teeRequired:!1},"internal-memo":{minMode:"mode-4",maxTtlSeconds:86400,watermarkRequired:!1,selectiveDisclosure:!1,thresholdSuggested:!1,teeRequired:!1},"live-ops-data":{minMode:"mode-4",maxTtlSeconds:86400,watermarkRequired:!1,selectiveDisclosure:!1,thresholdSuggested:!1,teeRequired:!1}},Sh={email:{deliveryMode:"attachment",adapters:["gmail","outlook","smtp"],notes:[]},chat:{deliveryMode:"link",adapters:["whatsapp","telegram","slack","teams"],notes:["Send the ndc:// link only; file bytes never traverse the chat provider"]},"cloud-share":{deliveryMode:"link",adapters:["drive","sharepoint","dropbox","box"],notes:[]},sftp:{deliveryMode:"attachment",adapters:["sftp","ftps"],notes:["Legacy partners often require this"]},sms:{deliveryMode:"link",adapters:["sms-short-link"],notes:["Link only; SMS cannot carry binary"]},voice:{deliveryMode:"link",adapters:["voice-readback"],notes:["Voice carries the unlock factor, not the content"]},"web-portal":{deliveryMode:"link",adapters:["web-portal-pickup","embed-iframe"],notes:[]},"qr-physical":{deliveryMode:"in-person",adapters:["qr-code","usb-handoff","airdrop"],notes:["Recipient must scan / plug in physically"]},webhook:{deliveryMode:"attachment",adapters:["webhook-push"],notes:["B2B server-to-server only"]}},Eh=[{channel:"chat",fileClass:"medical-phi",note:"PHI over chat \u2192 link only; never attach the bytes"},{channel:"chat",fileClass:"identity-documents",note:"ID documents over chat \u2192 link only"},{channel:"chat",fileClass:"legal-contracts",note:"Legal contracts over chat are discouraged; use email/portal"},{channel:"chat",fileClass:"board-materials",note:"Board materials over chat are discouraged; use email/portal"},{channel:"chat",fileClass:"source-code",note:"Source code over chat is discouraged; use cloud-share/portal"},{channel:"cloud-share",fileClass:"identity-documents",note:"ID documents on cloud share discouraged; prefer email or portal"},{channel:"sms",fileClass:"medical-phi",note:"PHI over SMS is not compliant; reroute to web-portal"},{channel:"voice",fileClass:"medical-phi",note:"Voice only carries the unlock; the bytes must travel another channel"}],Sc={"mode-4":1,"mode-4p":2,"mode-4h":3,"mode-6":4};function xh(e,t){return Sc[e]>=Sc[t]?e:t}function Ah(e){let t=kh[e.orgType],n=wh[e.fileClass],r=Sh[e.channel],o=xh(t.mode,n.minMode);e.recipientLacksPasskey&&o==="mode-4h"&&(o="mode-4p");let i=Math.min(t.ttlSeconds,n.maxTtlSeconds),s={forensicWatermark:t.forensicWatermark||n.watermarkRequired,selectiveDisclosureSegments:n.selectiveDisclosure||!!e.perRecipientPolicy,thresholdKofN:e.multipleApproversRequired??null,teeAttestation:t.teeAttestation||n.teeRequired,perOpenRatchet:o==="mode-4h"||o==="mode-4p"||o==="mode-6",dpopRequired:o!=="mode-4",timelockDrand:!!e.timeLockUnixSec&&!!e.timeLockDecentralized,timelockServerGate:!!e.timeLockUnixSec&&!e.timeLockDecentralized},a={...r,adapterCandidates:[...r.adapters]},c=[...a.notes],l=Eh.find(d=>d.channel===e.channel&&d.fileClass===e.fileClass);return l&&(c.unshift(`\u26A0 ${l.note}`),a.deliveryMode==="attachment"&&(a.deliveryMode="link")),e.fileClass==="live-ops-data"&&e.channel==="email"&&c.push("Live ops data over email is non-standard; consider webhook-push or web-portal."),{sensitivityMode:o,cacheTtlSeconds:i,features:s,delivery:{deliveryMode:a.deliveryMode,adapterCandidates:a.adapterCandidates},notes:c}}function Th(e){let t=[e.sensitivityMode,`TTL ${e.cacheTtlSeconds}s`];return e.features.forensicWatermark&&t.push("watermark"),e.features.selectiveDisclosureSegments&&t.push("segments"),e.features.thresholdKofN&&t.push(`threshold ${e.features.thresholdKofN.k}-of-${e.features.thresholdKofN.n}`),e.features.teeAttestation&&t.push("TEE"),e.features.perOpenRatchet&&t.push("ratchet"),e.features.dpopRequired&&t.push("DPoP"),e.features.timelockDrand?t.push("drand-tlock"):e.features.timelockServerGate&&t.push("server-timegate"),t.push(`via ${e.delivery.deliveryMode} (${e.delivery.adapterCandidates.join("/")})`),t.join(" \xB7 ")}});var Ac=M(Pt=>{"use strict";Object.defineProperty(Pt,"__esModule",{value:!0});Pt.recommendationToMandate=Dh;Pt.v3SealReceiptPayload=Ch;Pt.v3OpenReceiptPayload=Nh;Pt.showcaseChips=Oh;function Ih(e){switch(e){case"mode-4":return"name_email";case"mode-4p":return"name_email";case"mode-4h":return"hardware_attest";case"mode-6":return"name_email_phone"}}function $h(e){return e.features.dpopRequired?"device_mfa":e.sensitivityMode==="mode-4h"?"first_device":e.sensitivityMode==="mode-4"?"any":"first_device"}function Ph(e){return e.delivery.deliveryMode==="attachment"?"file":e.delivery.deliveryMode==="link"?"link":"view_only"}function xc(e){let t=e.delivery.adapterCandidates;return t.some(n=>n==="outlook"||n==="sharepoint"||n==="teams")?"m365":t.some(n=>n==="webhook-push"||n==="web-portal-pickup"||n==="embed-iframe")?"in_app":"capsule"}function Rh(e){let t=xc(e);return t==="m365"?"m365_only":t==="in_app"?"in_app":"any"}function Dh(e){let{recommendation:t,source:n}=e,r=t.sensitivityMode==="mode-6",o=n.timeLockUnixSec?new Date(n.timeLockUnixSec*1e3).toISOString():null;return{time:{ttl_seconds:t.cacheTtlSeconds,burn_after_first_read:r,unlock_at:o,max_opens:r?1:null},identity:{capture:Ih(t.sensitivityMode),claim_required:t.sensitivityMode!=="mode-4",allow_magic_link:t.sensitivityMode==="mode-4",allowed_emails:null},device:{binding:$h(t),listed_fingerprints:null},channel:{delivery:Ph(t),route:xc(t),channel_constraint:Rh(t)},burn:{crypto_shred_on_burn:!0,mdm_wipe_webhook:!1,undo_window_s:0,dual_control:!!t.features.thresholdKofN},encrypt:{mode:"hpke",vault_mirror:t.features.teeAttestation,scoped_key_release:!0},proof:{signing:"ed25519",anchor:t.features.teeAttestation?"rekor":"none",c2pa_in_file:!1,ndc_seal:!0},watermark:{visible:t.features.forensicWatermark,forensic:t.features.forensicWatermark,content:t.features.forensicWatermark?"recipient_id":null,custom_text:null,forensics_lookup:t.features.forensicWatermark},ndc_v3_extensions:{profile:"pq-hybrid",suite:{kem:"X25519+ML-KEM-768",sig:"Ed25519+ML-DSA-65",aead:"AES-256-GCM",kdf:"HKDF-SHA-256"},dpop_required:t.features.dpopRequired,ratchet_enabled:t.features.perOpenRatchet,tee_attestation_required:t.features.teeAttestation,threshold_k_of_n:t.features.thresholdKofN,segments_enabled:t.features.selectiveDisclosureSegments,timelock_drand:t.features.timelockDrand,timelock_server_gate:t.features.timelockServerGate,timelock_unix_sec:n.timeLockUnixSec??null}}}function Ch(e){return{event_kind:"ndc_v3_sealed",lockbox_id:e.lockbox_id,ciphertext_sha256:e.ciphertext_sha256,recipient_kid:e.recipient_kid,signer_kid:e.signer_kid,mandate:e.mandate,bytes_sealed:e.bytes_sealed,issued_at:e.issued_at??new Date().toISOString()}}function Nh(e){return{event_kind:"ndc_v3_opened",lockbox_id:e.lockbox_id,ratchet_sequence:e.ratchet_sequence,dpop_jkt:e.dpop_jkt,ip_hash:e.ip_hash,opened_at:e.opened_at??new Date().toISOString()}}function Oh(e){let t=[],n=e.ndc_v3_extensions;return t.push("PQ-hybrid"),n.dpop_required&&t.push("DPoP"),n.ratchet_enabled&&t.push("per-open ratchet"),e.watermark.forensic&&t.push("forensic watermark"),n.segments_enabled&&t.push("selective disclosure"),n.threshold_k_of_n&&t.push(`${n.threshold_k_of_n.k}-of-${n.threshold_k_of_n.n} quorum`),n.tee_attestation_required&&t.push("TEE attest"),n.timelock_drand?t.push("drand time-lock"):n.timelock_server_gate&&t.push("server time-gate"),e.time.burn_after_first_read&&t.push("burn-after-read"),t}});var Rc=M(ke=>{"use strict";Object.defineProperty(ke,"__esModule",{value:!0});ke.encodeFragment=Pc;ke.decodeFragment=jh;ke.extractProofToken=Lh;ke.encodeProofToken=Bh;ke.decodeShareCredential=Fh;ke.sealBytesForPublicShare=Hh;ke.openPublicShare=Uh;ke.wrapFragmentForShortLink=Vh;var Tc=Et(),Ic=rr();function Fe(e){let t="";for(let n=0;n<e.length;n++)t+=String.fromCharCode(e[n]);return btoa(t)}function ln(e){let t=atob(e),n=new Uint8Array(t.length);for(let r=0;r<t.length;r++)n[r]=t.charCodeAt(r);return n}function $c(e){return Fe(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function Pc(e){return encodeURIComponent(JSON.stringify(e))}function jh(e){let t=JSON.parse(decodeURIComponent(e));if(t.v!==3)throw new Error(`fragment version unsupported: ${t.v}`);return t}function Lh(e){return{v:3,kind:"proof",n:e.n,t:e.t,spe:e.spe,spm:e.spm}}function Bh(e){return encodeURIComponent(JSON.stringify(e))}function Fh(e){let t=e.trim(),n=t.indexOf("#"),r=n>=0?t.slice(n+1):t,o;try{o=JSON.parse(decodeURIComponent(r))}catch(i){throw new Error(`credential parse failed: ${i.message??"invalid_json"}`)}if(o.v!==3)throw new Error(`credential version unsupported: ${String(o.v)}`);return o.kind==="proof"?{kind:"proof",value:o}:{kind:"fragment",value:o}}function Mh(){let e=new Uint8Array(16);crypto.getRandomValues(e);let t="";for(let n=0;n<e.length;n++)t+=e[n].toString(16).padStart(2,"0");return t}function Kh(){let e=new Uint8Array(32);return crypto.getRandomValues(e),$c(e)}async function Hh(e){let t=e.bytes,n={name:e.filename,type:e.contentType},r=(0,Tc.generateHybridKemKeypair)(),o=(0,Tc.generateHybridSigKeypair)(),i=Mh(),s=Kh(),a=await(0,Ic.sealHybrid)({plaintext:t,recipientPublicKey:r.publicKey,recipientKid:`ephemeral-${i}`,signerKeypair:o,signerKid:`lock-${i}`,meta:{lockbox_id:i,server:e.server,bearer:s,original_filename:n.name,original_content_type:n.type||"application/octet-stream",cache_ttl_seconds:e.ttlSeconds,dpop_required:!1,tee_attestation_url:null,ratchet_state:null}}),c=Pc({v:3,n:n.name,t:n.type||"application/octet-stream",rsx:Fe(r.secretKey.x25519),rsm:Fe(r.secretKey.mlKem),rpx:Fe(r.publicKey.x25519),spe:Fe(o.publicKey.ed25519),spm:Fe(o.publicKey.mlDsa)});return{container:a.container,fragment:c,lockboxId:i}}async function Uh(e){let t={x25519:ln(e.fragment.rsx),mlKem:ln(e.fragment.rsm)},n=ln(e.fragment.rpx),r={ed25519:ln(e.fragment.spe),mlDsa:ln(e.fragment.spm)},{plaintext:o,header:i}=await(0,Ic.openHybrid)({container:e.container,recipientSecretKey:t,recipientPublicX25519:n,signerPublicKey:r});return{plaintext:o,filename:i.original_filename||e.fragment.n,contentType:i.original_content_type||e.fragment.t,signerKid:i.sig.signer_kid,issuedAt:i.issued_at,ciphertextSha256:i.ciphertext_sha256}}async function Vh(e){let t=crypto.getRandomValues(new Uint8Array(32)),n=crypto.getRandomValues(new Uint8Array(12)),r=new TextEncoder().encode(e),o=new ArrayBuffer(32);new Uint8Array(o).set(t);let i=new ArrayBuffer(12);new Uint8Array(i).set(n);let s=new ArrayBuffer(r.byteLength);new Uint8Array(s).set(r);let a=await crypto.subtle.importKey("raw",o,{name:"AES-GCM"},!1,["encrypt"]),c=new Uint8Array(await crypto.subtle.encrypt({name:"AES-GCM",iv:i},a,s));return{wrapKeyB64Url:$c(t),wrappedFragmentB64:Fe(c),wrapIvB64:Fe(n)}}});var Oc=M(u=>{"use strict";var Gh=u&&u.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(u,"__esModule",{value:!0});u.PVE_SIGNED_LEN=u.RCPT_VERSION=u.PVE_VERSION=u.RCPT_MAGIC=u.PVE_MAGIC=u.verifyDpop=u.publicJwkFromBytes=u.jwkThumbprint=u.createDpop=u.verifyContainerHeader=u.signContainerHeader=u.sealHybrid=u.openHybrid=u.headerSigningBytes=u.encodeContainerV3=u.decodeContainerV3=u.ContainerV3Error=u.CONTAINER_HEADER_MAX_BYTES=u.CONTAINER_FIXED_PREFIX_BYTES=u.CONTAINER_MAGIC=u.canonicalJson=u.NDC_V03_RATCHET_DOMAIN=u.NDC_V03_CONTENT_KEY_DOMAIN=u.NDC_V03_KEM_DOMAIN=u.NDC_WIRE_V03=u.NDC_WIRE_V1=u.PQ_SIZES=u.PQ_SUITE=u.ratchetAdvance=u.deriveContentKey=u.mlDsa65VerifyDetached=u.mlDsa65SignDetached=u.generateMlDsa65Keypair=u.hybridVerify=u.hybridSign=u.hybridKemDecapsulate=u.hybridKemEncapsulate=u.generateHybridSigKeypair=u.deriveHybridKemKeypairFromSeed=u.generateHybridKemKeypair=u.ALGORITHMS=u.CRYPTO_VERSION=u.NoDataSDK=u.NoDataForms=u.NoDataSystems=u.NoDataWebhook=u.NoDataEmail=u.verifyProofOfWork=u.solveProofOfWork=u.NoDataCrypto=void 0;u.auditChain=u.appendReceipt=u.timeGateEncrypt=u.timeGateDecrypt=u.timeForRound=u.TimeGateError=u.roundForTime=u.makeFakeDrandChain=u.fetchDrandRound=u.drandTimeLockOpen=u.drandTimeLockEncrypt=u.drandTimeLockDecrypt=u.DRAND_LOE_MAINNET=u.watermarkSvgOverlay=u.findLeakSource=u.computeWatermark=u.SegmentError=u.sealSegments=u.openSegments=u.manifestDigest=u.buildCapability=u.splitSecret=u.serializeShare=u.deserializeShare=u.combineShares=u.decodeAttestationPayload=u.verifyCoseSign1Es384=u.verifyAttestation=u.parseAttestation=u.fetchAttestation=u.stepRatchet=u.replayRatchet=u.destroyKey=u.verifyReceiptDelta=u.parseReceiptDelta=u.signReceiptDelta=u.encodeReceiptDeltaSignedBytes=u.verifyPve=u.pveHash=u.parsePve=u.signPve=u.encodePveSignedBytes=u.originJktForPublicKey=u.uuidFromDeltaId=u.deltaIdFromUuid=u.ABSORB_STATUS=u.DELTA_KIND=u.RCPT_TOTAL_LEN=u.RCPT_SIGNED_LEN=u.PVE_TOTAL_LEN=void 0;u.wrapFragmentForShortLink=u.openPublicShare=u.sealBytesForPublicShare=u.decodeShareCredential=u.encodeProofToken=u.extractProofToken=u.decodeFragment=u.encodeFragment=u.v3SealReceiptPayload=u.v3OpenReceiptPayload=u.showcaseChips=u.recommendationToMandate=u.summarise=u.recommend=u.verifyReceipt=u.receiptHash=u.issueReceipt=u.issueGenesisReceipt=u.GENESIS_PREV_HASH=void 0;var Wh=Ze();Object.defineProperty(u,"NoDataCrypto",{enumerable:!0,get:function(){return Gh(Wh).default}});var Dc=Aa();Object.defineProperty(u,"solveProofOfWork",{enumerable:!0,get:function(){return Dc.solveProofOfWork}});Object.defineProperty(u,"verifyProofOfWork",{enumerable:!0,get:function(){return Dc.verifyProofOfWork}});var dn=Ia();Object.defineProperty(u,"NoDataEmail",{enumerable:!0,get:function(){return dn.NoDataEmail}});Object.defineProperty(u,"NoDataWebhook",{enumerable:!0,get:function(){return dn.NoDataWebhook}});Object.defineProperty(u,"NoDataSystems",{enumerable:!0,get:function(){return dn.NoDataSystems}});Object.defineProperty(u,"NoDataForms",{enumerable:!0,get:function(){return dn.NoDataForms}});Object.defineProperty(u,"NoDataSDK",{enumerable:!0,get:function(){return dn.NoDataSDK}});u.CRYPTO_VERSION="0.2.0";u.ALGORITHMS={ENCRYPTION:"AES-256-GCM",KEY_EXCHANGE:"RSA-OAEP-4096",KEY_DERIVATION:"PBKDF2-SHA256-310K",SIGNING:"Ed25519",HASHING:"SHA-256",PROOF_OF_WORK:"SHA-256-NONCE"};var V=Et();Object.defineProperty(u,"generateHybridKemKeypair",{enumerable:!0,get:function(){return V.generateHybridKemKeypair}});Object.defineProperty(u,"deriveHybridKemKeypairFromSeed",{enumerable:!0,get:function(){return V.deriveHybridKemKeypairFromSeed}});Object.defineProperty(u,"generateHybridSigKeypair",{enumerable:!0,get:function(){return V.generateHybridSigKeypair}});Object.defineProperty(u,"hybridKemEncapsulate",{enumerable:!0,get:function(){return V.hybridKemEncapsulate}});Object.defineProperty(u,"hybridKemDecapsulate",{enumerable:!0,get:function(){return V.hybridKemDecapsulate}});Object.defineProperty(u,"hybridSign",{enumerable:!0,get:function(){return V.hybridSign}});Object.defineProperty(u,"hybridVerify",{enumerable:!0,get:function(){return V.hybridVerify}});Object.defineProperty(u,"generateMlDsa65Keypair",{enumerable:!0,get:function(){return V.generateMlDsa65Keypair}});Object.defineProperty(u,"mlDsa65SignDetached",{enumerable:!0,get:function(){return V.mlDsa65SignDetached}});Object.defineProperty(u,"mlDsa65VerifyDetached",{enumerable:!0,get:function(){return V.mlDsa65VerifyDetached}});Object.defineProperty(u,"deriveContentKey",{enumerable:!0,get:function(){return V.deriveContentKey}});Object.defineProperty(u,"ratchetAdvance",{enumerable:!0,get:function(){return V.ratchetAdvance}});Object.defineProperty(u,"PQ_SUITE",{enumerable:!0,get:function(){return V.PQ_SUITE}});Object.defineProperty(u,"PQ_SIZES",{enumerable:!0,get:function(){return V.PQ_SIZES}});Object.defineProperty(u,"NDC_WIRE_V1",{enumerable:!0,get:function(){return V.NDC_WIRE_V1}});Object.defineProperty(u,"NDC_WIRE_V03",{enumerable:!0,get:function(){return V.NDC_WIRE_V03}});Object.defineProperty(u,"NDC_V03_KEM_DOMAIN",{enumerable:!0,get:function(){return V.NDC_V03_KEM_DOMAIN}});Object.defineProperty(u,"NDC_V03_CONTENT_KEY_DOMAIN",{enumerable:!0,get:function(){return V.NDC_V03_CONTENT_KEY_DOMAIN}});Object.defineProperty(u,"NDC_V03_RATCHET_DOMAIN",{enumerable:!0,get:function(){return V.NDC_V03_RATCHET_DOMAIN}});var le=rr();Object.defineProperty(u,"canonicalJson",{enumerable:!0,get:function(){return le.canonicalJson}});Object.defineProperty(u,"CONTAINER_MAGIC",{enumerable:!0,get:function(){return le.CONTAINER_MAGIC}});Object.defineProperty(u,"CONTAINER_FIXED_PREFIX_BYTES",{enumerable:!0,get:function(){return le.CONTAINER_FIXED_PREFIX_BYTES}});Object.defineProperty(u,"CONTAINER_HEADER_MAX_BYTES",{enumerable:!0,get:function(){return le.CONTAINER_HEADER_MAX_BYTES}});Object.defineProperty(u,"ContainerV3Error",{enumerable:!0,get:function(){return le.ContainerV3Error}});Object.defineProperty(u,"decodeContainerV3",{enumerable:!0,get:function(){return le.decodeContainerV3}});Object.defineProperty(u,"encodeContainerV3",{enumerable:!0,get:function(){return le.encodeContainerV3}});Object.defineProperty(u,"headerSigningBytes",{enumerable:!0,get:function(){return le.headerSigningBytes}});Object.defineProperty(u,"openHybrid",{enumerable:!0,get:function(){return le.openHybrid}});Object.defineProperty(u,"sealHybrid",{enumerable:!0,get:function(){return le.sealHybrid}});Object.defineProperty(u,"signContainerHeader",{enumerable:!0,get:function(){return le.signContainerHeader}});Object.defineProperty(u,"verifyContainerHeader",{enumerable:!0,get:function(){return le.verifyContainerHeader}});var hr=Vo();Object.defineProperty(u,"createDpop",{enumerable:!0,get:function(){return hr.createDpop}});Object.defineProperty(u,"jwkThumbprint",{enumerable:!0,get:function(){return hr.jwkThumbprint}});Object.defineProperty(u,"publicJwkFromBytes",{enumerable:!0,get:function(){return hr.publicJwkFromBytes}});Object.defineProperty(u,"verifyDpop",{enumerable:!0,get:function(){return hr.verifyDpop}});var H=Ja();Object.defineProperty(u,"PVE_MAGIC",{enumerable:!0,get:function(){return H.PVE_MAGIC}});Object.defineProperty(u,"RCPT_MAGIC",{enumerable:!0,get:function(){return H.RCPT_MAGIC}});Object.defineProperty(u,"PVE_VERSION",{enumerable:!0,get:function(){return H.PVE_VERSION}});Object.defineProperty(u,"RCPT_VERSION",{enumerable:!0,get:function(){return H.RCPT_VERSION}});Object.defineProperty(u,"PVE_SIGNED_LEN",{enumerable:!0,get:function(){return H.PVE_SIGNED_LEN}});Object.defineProperty(u,"PVE_TOTAL_LEN",{enumerable:!0,get:function(){return H.PVE_TOTAL_LEN}});Object.defineProperty(u,"RCPT_SIGNED_LEN",{enumerable:!0,get:function(){return H.RCPT_SIGNED_LEN}});Object.defineProperty(u,"RCPT_TOTAL_LEN",{enumerable:!0,get:function(){return H.RCPT_TOTAL_LEN}});Object.defineProperty(u,"DELTA_KIND",{enumerable:!0,get:function(){return H.DELTA_KIND}});Object.defineProperty(u,"ABSORB_STATUS",{enumerable:!0,get:function(){return H.ABSORB_STATUS}});Object.defineProperty(u,"deltaIdFromUuid",{enumerable:!0,get:function(){return H.deltaIdFromUuid}});Object.defineProperty(u,"uuidFromDeltaId",{enumerable:!0,get:function(){return H.uuidFromDeltaId}});Object.defineProperty(u,"originJktForPublicKey",{enumerable:!0,get:function(){return H.originJktForPublicKey}});Object.defineProperty(u,"encodePveSignedBytes",{enumerable:!0,get:function(){return H.encodePveSignedBytes}});Object.defineProperty(u,"signPve",{enumerable:!0,get:function(){return H.signPve}});Object.defineProperty(u,"parsePve",{enumerable:!0,get:function(){return H.parsePve}});Object.defineProperty(u,"pveHash",{enumerable:!0,get:function(){return H.pveHash}});Object.defineProperty(u,"verifyPve",{enumerable:!0,get:function(){return H.verifyPve}});Object.defineProperty(u,"encodeReceiptDeltaSignedBytes",{enumerable:!0,get:function(){return H.encodeReceiptSignedBytes}});Object.defineProperty(u,"signReceiptDelta",{enumerable:!0,get:function(){return H.signReceipt}});Object.defineProperty(u,"parseReceiptDelta",{enumerable:!0,get:function(){return H.parseReceipt}});Object.defineProperty(u,"verifyReceiptDelta",{enumerable:!0,get:function(){return H.verifyReceipt}});var ti=Xa();Object.defineProperty(u,"destroyKey",{enumerable:!0,get:function(){return ti.destroyKey}});Object.defineProperty(u,"replayRatchet",{enumerable:!0,get:function(){return ti.replayRatchet}});Object.defineProperty(u,"stepRatchet",{enumerable:!0,get:function(){return ti.stepRatchet}});var ni=ec();Object.defineProperty(u,"fetchAttestation",{enumerable:!0,get:function(){return ni.fetchAttestation}});Object.defineProperty(u,"parseAttestation",{enumerable:!0,get:function(){return ni.parseAttestation}});Object.defineProperty(u,"verifyAttestation",{enumerable:!0,get:function(){return ni.verifyAttestation}});var Cc=Yo();Object.defineProperty(u,"verifyCoseSign1Es384",{enumerable:!0,get:function(){return Cc.verifyCoseSign1Es384}});Object.defineProperty(u,"decodeAttestationPayload",{enumerable:!0,get:function(){return Cc.decodeAttestationPayload}});var mr=rc();Object.defineProperty(u,"combineShares",{enumerable:!0,get:function(){return mr.combineShares}});Object.defineProperty(u,"deserializeShare",{enumerable:!0,get:function(){return mr.deserializeShare}});Object.defineProperty(u,"serializeShare",{enumerable:!0,get:function(){return mr.serializeShare}});Object.defineProperty(u,"splitSecret",{enumerable:!0,get:function(){return mr.splitSecret}});var un=ac();Object.defineProperty(u,"buildCapability",{enumerable:!0,get:function(){return un.buildCapability}});Object.defineProperty(u,"manifestDigest",{enumerable:!0,get:function(){return un.manifestDigest}});Object.defineProperty(u,"openSegments",{enumerable:!0,get:function(){return un.openSegments}});Object.defineProperty(u,"sealSegments",{enumerable:!0,get:function(){return un.sealSegments}});Object.defineProperty(u,"SegmentError",{enumerable:!0,get:function(){return un.SegmentError}});var ri=dc();Object.defineProperty(u,"computeWatermark",{enumerable:!0,get:function(){return ri.computeWatermark}});Object.defineProperty(u,"findLeakSource",{enumerable:!0,get:function(){return ri.findLeakSource}});Object.defineProperty(u,"watermarkSvgOverlay",{enumerable:!0,get:function(){return ri.watermarkSvgOverlay}});var me=yc();Object.defineProperty(u,"DRAND_LOE_MAINNET",{enumerable:!0,get:function(){return me.DRAND_LOE_MAINNET}});Object.defineProperty(u,"drandTimeLockDecrypt",{enumerable:!0,get:function(){return me.drandTimeLockDecrypt}});Object.defineProperty(u,"drandTimeLockEncrypt",{enumerable:!0,get:function(){return me.drandTimeLockEncrypt}});Object.defineProperty(u,"drandTimeLockOpen",{enumerable:!0,get:function(){return me.drandTimeLockOpen}});Object.defineProperty(u,"fetchDrandRound",{enumerable:!0,get:function(){return me.fetchDrandRound}});Object.defineProperty(u,"makeFakeDrandChain",{enumerable:!0,get:function(){return me.makeFakeDrandChain}});Object.defineProperty(u,"roundForTime",{enumerable:!0,get:function(){return me.roundForTime}});Object.defineProperty(u,"TimeGateError",{enumerable:!0,get:function(){return me.TimeGateError}});Object.defineProperty(u,"timeForRound",{enumerable:!0,get:function(){return me.timeForRound}});Object.defineProperty(u,"timeGateDecrypt",{enumerable:!0,get:function(){return me.timeGateDecrypt}});Object.defineProperty(u,"timeGateEncrypt",{enumerable:!0,get:function(){return me.timeGateEncrypt}});var ot=wc();Object.defineProperty(u,"appendReceipt",{enumerable:!0,get:function(){return ot.appendReceipt}});Object.defineProperty(u,"auditChain",{enumerable:!0,get:function(){return ot.auditChain}});Object.defineProperty(u,"GENESIS_PREV_HASH",{enumerable:!0,get:function(){return ot.GENESIS_PREV_HASH}});Object.defineProperty(u,"issueGenesisReceipt",{enumerable:!0,get:function(){return ot.issueGenesisReceipt}});Object.defineProperty(u,"issueReceipt",{enumerable:!0,get:function(){return ot.issueReceipt}});Object.defineProperty(u,"receiptHash",{enumerable:!0,get:function(){return ot.receiptHash}});Object.defineProperty(u,"verifyReceipt",{enumerable:!0,get:function(){return ot.verifyReceipt}});var Nc=Ec();Object.defineProperty(u,"recommend",{enumerable:!0,get:function(){return Nc.recommend}});Object.defineProperty(u,"summarise",{enumerable:!0,get:function(){return Nc.summarise}});var gr=Ac();Object.defineProperty(u,"recommendationToMandate",{enumerable:!0,get:function(){return gr.recommendationToMandate}});Object.defineProperty(u,"showcaseChips",{enumerable:!0,get:function(){return gr.showcaseChips}});Object.defineProperty(u,"v3OpenReceiptPayload",{enumerable:!0,get:function(){return gr.v3OpenReceiptPayload}});Object.defineProperty(u,"v3SealReceiptPayload",{enumerable:!0,get:function(){return gr.v3SealReceiptPayload}});var Me=Rc();Object.defineProperty(u,"encodeFragment",{enumerable:!0,get:function(){return Me.encodeFragment}});Object.defineProperty(u,"decodeFragment",{enumerable:!0,get:function(){return Me.decodeFragment}});Object.defineProperty(u,"extractProofToken",{enumerable:!0,get:function(){return Me.extractProofToken}});Object.defineProperty(u,"encodeProofToken",{enumerable:!0,get:function(){return Me.encodeProofToken}});Object.defineProperty(u,"decodeShareCredential",{enumerable:!0,get:function(){return Me.decodeShareCredential}});Object.defineProperty(u,"sealBytesForPublicShare",{enumerable:!0,get:function(){return Me.sealBytesForPublicShare}});Object.defineProperty(u,"openPublicShare",{enumerable:!0,get:function(){return Me.openPublicShare}});Object.defineProperty(u,"wrapFragmentForShortLink",{enumerable:!0,get:function(){return Me.wrapFragmentForShortLink}})});import{McpServer as Cg}from"@modelcontextprotocol/sdk/server/mcp.js";import{StdioServerTransport as Ng}from"@modelcontextprotocol/sdk/server/stdio.js";import{z as g}from"zod";import{z as fe}from"zod";import{createHash as Xd}from"node:crypto";import{readdirSync as gs,readFileSync as ys,statSync as Hn}from"node:fs";import{basename as _s,join as Xr}from"node:path";var ue={text:[],header:[],secrets:[],table:null};function Fr(e){e.table&&(ue.table=e.table);for(let t of e.text??[])ue.text.some(n=>n.kind===t.kind)||ue.text.push(t);e.header&&!ue.header.includes(e.header)&&ue.header.push(e.header);for(let t of e.secrets??[])ue.secrets.some(n=>n.id===t.id)||ue.secrets.push(t)}function $n(){return ue.text}function Fi(){return ue.header}function at(){return ue.table}function Mi(){return ue.secrets}var Pn=[{id:"aws-access-key",name:"AWS Access Key",pattern:/(?:^|[^A-Z0-9])AKIA[A-Z2-7]{16}(?:[^A-Z2-7]|$)/,severity:"critical"},{id:"aws-secret-key",name:"AWS Secret Key",pattern:/(?:aws_secret_access_key|aws_secret_key|secret_access_key)\s*[=:]\s*['"]?[A-Za-z0-9/+=]{40}['"]?/,severity:"critical"},{id:"gcp-api-key",name:"GCP API Key",pattern:/AIza[0-9A-Za-z_-]{35}/,severity:"critical"},{id:"gcp-service-account",name:"GCP Service Account",pattern:/"type"\s*:\s*"service_account"/,severity:"critical"},{id:"github-token",name:"GitHub Token",pattern:/gh[pousr]_[0-9a-zA-Z]{36,}/,severity:"critical"},{id:"github-fine-grained",name:"GitHub Fine-Grained Token",pattern:/github_pat_[0-9a-zA-Z_]{22,}/,severity:"critical"},{id:"gitlab-token",name:"GitLab Token",pattern:/glpat-[0-9a-zA-Z_-]{20,}/,severity:"critical"},{id:"stripe-secret",name:"Stripe Secret Key",pattern:/sk_live_[0-9a-zA-Z]{24,}/,severity:"critical"},{id:"stripe-restricted",name:"Stripe Restricted Key",pattern:/rk_live_[0-9a-zA-Z]{24,}/,severity:"critical"},{id:"slack-token",name:"Slack Token",pattern:/xox[baprs]-[0-9a-zA-Z-]{10,}/,severity:"high"},{id:"slack-webhook",name:"Slack Webhook",pattern:/hooks\.slack\.com\/services\/T[0-9A-Z]{8,}\/B[0-9A-Z]{8,}\/[0-9a-zA-Z]{24}/,severity:"high"},{id:"twilio-api-key",name:"Twilio API Key",pattern:/SK[0-9a-fA-F]{32}/,severity:"high"},{id:"sendgrid-api-key",name:"SendGrid API Key",pattern:/SG\.[0-9a-zA-Z_-]{22}\.[0-9a-zA-Z_-]{43}/,severity:"critical"},{id:"postgres-uri",name:"PostgreSQL Connection String",pattern:/postgres(?:ql)?:\/\/[^\s'"]{10,}/,severity:"critical"},{id:"mongodb-uri",name:"MongoDB Connection String",pattern:/mongodb(?:\+srv)?:\/\/[^\s'"]{10,}/,severity:"critical"},{id:"redis-uri",name:"Redis Connection String",pattern:/redis(?:s)?:\/\/[^\s'"]{10,}/,severity:"high"},{id:"openai-key",name:"OpenAI API Key",pattern:/sk-[0-9a-zA-Z]{20,}T3BlbkFJ[0-9a-zA-Z]{20,}/,severity:"critical"},{id:"openai-project-key",name:"OpenAI API Key",pattern:/sk-(?:proj|svcacct|admin)-[0-9A-Za-z_-]{40,}/,severity:"critical"},{id:"anthropic-key",name:"Anthropic API Key",pattern:/sk-ant-[0-9a-zA-Z_-]{40,}/,severity:"critical"},{id:"firebase-key",name:"Firebase API Key",pattern:/AIza[0-9A-Za-z_-]{35}/,severity:"high"},{id:"supabase-key",name:"Supabase Service Key",pattern:/eyJ[0-9a-zA-Z_-]{100,}/,severity:"critical"},{id:"private-key",name:"Private Key",pattern:/-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/,severity:"critical"},{id:"jwt-secret",name:"JWT/Generic Secret",pattern:/(?:jwt_secret|JWT_SECRET|secret_key|SECRET_KEY|api_secret|API_SECRET)\s*[=:]\s*['"][^'"]{8,}['"]/,severity:"high"},{id:"password-in-code",name:"Password in Code",pattern:/(?:password|passwd|pwd)\s*[=:]\s*['"][^'"]{8,}['"]/,severity:"high"},{id:"bearer-token",name:"Bearer Token in Code",pattern:/['"]Bearer\s+[0-9a-zA-Z._-]{20,}['"]/,severity:"high"}];function ct(){let e=Mi().filter(t=>!Pn.some(n=>n.id===t.id));return[...Pn,...e]}var Ki=/node_modules\/|\.next\/|\.test\.|\.spec\.|__tests__\/|\.nodata-proof\.json$|\.git\//,Hi=/(^|\/)\.env(\.[\w-]+)*\.(example|sample|template|dist)$|\.(example|sample|template)$|(^|\/)[^/]*\.(example|sample)\.[a-z0-9]+$/i,Hr=/(^|\/)(__tests__|__mocks__|tests?|spec|fixtures?|mocks?|samples?|examples?|demo|testdata)(\/|$)|\.(test|spec)\.[a-z0-9]+$|\.min\.(m?js|css)$|(^|\/)[^/]*\.worker\.min\.m?js$/i,ad=[{name:"lodash",below:"4.17.21",severity:"critical",cve:"CVE-2021-23337",desc:"Command injection via template"},{name:"minimist",below:"1.2.6",severity:"critical",cve:"CVE-2021-44906",desc:"Prototype pollution"},{name:"json5",below:"2.2.2",severity:"high",cve:"CVE-2022-46175",desc:"Prototype pollution"},{name:"express",below:"4.19.2",severity:"high",cve:"CVE-2024-29041",desc:"Open redirect"},{name:"path-to-regexp",below:"6.3.0",severity:"high",cve:"CVE-2024-45296",desc:"ReDoS"},{name:"sanitize-html",below:"2.12.1",severity:"high",cve:"CVE-2024-21501",desc:"XSS bypass"},{name:"dompurify",below:"3.0.9",severity:"high",cve:"CVE-2024-45801",desc:"mXSS"},{name:"jsonwebtoken",below:"9.0.0",severity:"critical",cve:"CVE-2022-23529",desc:"Key confusion attack"},{name:"jose",below:"4.15.5",severity:"high",cve:"CVE-2024-28176",desc:"DoS via JWE"},{name:"axios",below:"1.6.0",severity:"high",cve:"CVE-2023-45857",desc:"CSRF cookie leak"},{name:"node-fetch",below:"2.6.7",severity:"high",cve:"CVE-2022-0235",desc:"Header leak on redirect"},{name:"serialize-javascript",below:"6.0.2",severity:"critical",cve:"CVE-2024-11831",desc:"XSS via serialization"},{name:"xml2js",below:"0.6.0",severity:"high",cve:"CVE-2023-0842",desc:"Prototype pollution"},{name:"next",below:"14.1.1",severity:"high",cve:"CVE-2024-34350",desc:"SSRF via headers"},{name:"sharp",below:"0.32.6",severity:"high",cve:"CVE-2023-4863",desc:"libwebp heap overflow"},{name:"multer",below:"1.4.5",severity:"high",cve:"CVE-2022-24434",desc:"Prototype pollution"},{name:"tough-cookie",below:"4.1.3",severity:"medium",cve:"CVE-2023-26136",desc:"Prototype pollution"},{name:"semver",below:"7.5.4",severity:"medium",cve:"CVE-2022-25883",desc:"ReDoS"},{name:"ip",below:"2.0.1",severity:"critical",cve:"CVE-2024-29415",desc:"SSRF bypass via octal IP"},{name:"tar",below:"6.2.1",severity:"high",cve:"CVE-2024-28863",desc:"DoS via path traversal"}];function cd(e,t){let n=i=>i.replace(/^[^0-9]*/,"").split(".").map(s=>parseInt(s,10)||0),r=n(e),o=n(t);for(let i=0;i<3;i++){if((r[i]||0)<(o[i]||0))return!0;if((r[i]||0)>(o[i]||0))return!1}return!1}function Ui(e){let t=[],n;try{n=JSON.parse(e)}catch{return t}let r={...n.dependencies??{},...n.devDependencies??{}};for(let[o,i]of Object.entries(r)){let s=(i||"").replace(/^[\^~>=<\s]+/,""),a=ad.find(c=>c.name===o&&cd(s,c.below));a&&t.push({name:o,version:s,vuln:a})}return t}var ld=[{pattern:/^(full_?name|first_?name|last_?name|spouse_?name|beneficiary_?name)$/i,type:"name",label:"Person name"},{pattern:/^(email|e_?mail|email_?address)$/i,type:"email",label:"Email address"},{pattern:/^(phone|mobile|telephone|phone_?number|cell_?phone)$/i,type:"phone",label:"Phone number"},{pattern:/^(id_?number|identity|ssn|social_?security|national_?id|teudat_?zehut)$/i,type:"id",label:"ID number"},{pattern:/^(address|street_?address|home_?address)$/i,type:"address",label:"Address"},{pattern:/^(date_?of_?birth|dob|birth_?date|birthday)$/i,type:"dob",label:"Date of birth"},{pattern:/^(bank_?account|iban|account_?number|bank_?details|routing_?number)$/i,type:"financial",label:"Bank account"},{pattern:/^(credit_?card|card_?number|cvv|cc_?number)$/i,type:"financial",label:"Credit card"},{pattern:/^(salary|income|commission|premium|compensation)$/i,type:"financial",label:"Salary / income"},{pattern:/^(medical_?info|health_?conditions|diagnosis|medication|prescription)$/i,type:"medical",label:"Medical"},{pattern:/^(passport|passport_?number|passport_?id)$/i,type:"id",label:"Passport"},{pattern:/^(driver_?license|drivers_?license|dl_?number)$/i,type:"id",label:"Driver license"},{pattern:/^(tax_?id|tin|vat_?number|ein)$/i,type:"financial",label:"Tax ID"},{pattern:/^(insurance_?number|policy_?number|member_?id)$/i,type:"id",label:"Insurance/Policy"},{pattern:/^(biometric|fingerprint|face_?id|retina)$/i,type:"biometric",label:"Biometric"},{pattern:/^(latitude|longitude|lat|lng|geo_?location|coordinates)$/i,type:"location",label:"Geolocation"}],dd=[{pattern:/^(?:שם|שם_מלא|שם פרטי|שם_פרטי|שם משפחה|שם_משפחה|שם הלקוח|שם בן זוג|שם המבוטח|שם המוטב|שם הילד|שם הקטין)$/i,type:"name",label:"\u05E9\u05DD \u05D0\u05D3\u05DD"},{pattern:/^(?:ת"ז|ת\.ז|ת ז|תז|תעודת זהות|תעודת_זהות|מספר זהות|מס' זהות|teudat_zehut|tz|israeli_id|il_id)$/i,type:"id",label:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA"},{pattern:/^(?:דרכון|מספר דרכון|רישיון נהיגה|רישיון_נהיגה|רשיון נהיגה)$/i,type:"id",label:"\u05D3\u05E8\u05DB\u05D5\u05DF/\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF"},{pattern:/^(?:מייל|דוא"ל|דוא_ל|דואר אלקטרוני|אימייל|כתובת מייל)$/i,type:"email",label:"\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9"},{pattern:/^(?:טלפון|טל'|נייד|פלאפון|סלולרי|מספר טלפון|טלפון נייד)$/i,type:"phone",label:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF"},{pattern:/^(?:כתובת|כתובת מגורים|רחוב|מס בית|עיר|ישוב|יישוב|מיקוד|כתובת מלאה|מען)$/i,type:"address",label:"\u05DB\u05EA\u05D5\u05D1\u05EA"},{pattern:/^(?:תאריך לידה|ת לידה|תאריך הולדת|יום הולדת|גיל)$/i,type:"dob",label:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"},{pattern:/^(?:חשבון בנק|מספר חשבון|מס חשבון|סניף|iban|iban_il)$/i,type:"financial",label:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7"},{pattern:/^(?:כרטיס אשראי|מספר אשראי|cvv|אשראי)$/i,type:"financial",label:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"},{pattern:/^(?:שכר|משכורת|הכנסה|פרמיה|שכר ברוטו|שכר נטו|תגמול|בונוס|פיצוי)$/i,type:"financial",label:"\u05E9\u05DB\u05E8/\u05D4\u05DB\u05E0\u05E1\u05D4"},{pattern:/^(?:אבחון|אבחנה|מחלה|תרופה|מרשם|בדיקה רפואית|מצב רפואי|חיסון|רגישות|אלרגיה|סוג דם)$/i,type:"medical",label:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(?:מספר פוליסה|מס פוליסה|פוליסה|מספר חבר|מספר ביטוח)$/i,type:"id",label:"\u05E4\u05D5\u05DC\u05D9\u05E1\u05D4/\u05D7\u05D1\u05E8\u05D5\u05EA"},{pattern:/^(?:שם הילד|תעודת זהות של ילד|ילדים|קטין|מספר ילדים|תעודת לידה)$/i,type:"minor_data",label:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05DF"},{pattern:/^(?:דת|לאום|מין|נטייה מינית|השקפה פוליטית|מצב משפחתי|עדה|מוצא)$/i,type:"sensitive_personal",label:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9"},{pattern:/^(?:מספר רכב|מס רכב|לוחית רישוי|מספר רישוי)$/i,type:"tracking",label:"\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"}],ud=/^(id|uuid|created_?at|updated_?at|deleted_?at|status|type|category|description|title|slug|url|path|key|value|enabled|active|public|version|metadata|config|settings|data|content|note|comment|label|color|icon)$/i,pd=/^שם[ _](?:ה)?(?:קובץ|מוצר|פריט|חברה|ארגון|עסק|פרויקט|גיליון|טבלה|שדה|קטגוריה|סניף|בנק|עיר|רחוב|ישוב|יישוב|מסמך|תוכנית|חבילה|קורס|מחלקה|אתר|דומיין|מותג|ספק|שירות|תפקיד)$|^(file|product|item|company|org|organization|project|sheet|table|field|category|branch|bank|city|street|document|plan|course|department|site|domain|brand|vendor|service|role)[ _-]?name$/i;function Ue(e){if(!e)return null;let t=e.trim();if(ud.test(t)||/^name$/i.test(t))return null;let n=t.replace(/[\s-]+/g,"_");for(let r of[...dd,...ld])if(r.pattern.test(t)||r.pattern.test(n))return{type:r.type,label:r.label};if(pd.test(t))return null;if(/^שם[ _][\u0590-\u05FF"'׳ ]{2,20}$/.test(t))return{type:"name",label:"\u05E9\u05DD \u05D0\u05D3\u05DD"};if(/^(customer|client|employee|inspector|supervisor|contact|person|patient|user|owner|manager|agent|member|driver|tenant|student|parent|beneficiary|insured)_?(full_?)?name$/i.test(n))return{type:"name",label:"Person name"};for(let r of Fi()){let o=r(t);if(o)return{type:o.type,label:o.label}}return null}var Rn={id:"critical",financial:"critical",medical:"critical",biometric:"critical",minor_data:"critical",sensitive_personal:"critical",email:"high",phone:"high",name:"high",address:"high",dob:"high",tracking:"medium",location:"medium"};function Dn(e){let t=String(e??"").replace(/\D/g,"");if(t.length===0||t.length>9)return!1;let n=t.padStart(9,"0"),r=0;for(let o=0;o<9;o++){let i=parseInt(n[o]??"0",10)*(o%2+1);i>9&&(i-=9),r+=i}return r%10===0&&parseInt(n,10)>0}var Ot=/(?:\+972[\s-]?|0)(?:5[0-9]|[2-4]|[89])(?:[\s-]?\d){7}/g;var jt=/\bIL\d{2}\s?(?:\d{4}\s?){4}\d{3}\b/g;function fd(e){let t=String(e??"").replace(/\D/g,"");if(t.length<12||t.length>19)return!1;let n=0,r=!1;for(let o=t.length-1;o>=0;o-=1){let i=parseInt(t[o]??"0",10);r&&(i*=2,i>9&&(i-=9)),n+=i,r=!r}return n%10===0}function hd(e){let t=String(e??"").replace(/\s/g,"").toUpperCase();if(!/^[A-Z]{2}\d{2}[A-Z0-9]{10,30}$/.test(t))return!1;let n=t.slice(4)+t.slice(0,4),r=0;for(let o of n){let i=o>="A"&&o<="Z"?String(o.charCodeAt(0)-55):o;for(let s of i)r=(r*10+Number(s))%97}return r===1}var Mr="(?<!\\d)(?<!\\d[.,])",Kr="(?!\\d)(?![.,]\\d)",Ur=[{subkind:"israeli_id",severity:"high",pattern:new RegExp(`${Mr}\\d{9}${Kr}`,"g"),validate:Dn,hint:"Israeli national ID (check digit verified) in plaintext. Encrypt the column or mask it at rest."},{subkind:"credit_card",severity:"critical",pattern:new RegExp(`${Mr}[2-6][ -]?(?:\\d[ -]?){11,17}\\d${Kr}`,"g"),validate:fd,hint:"Payment card number (Luhn verified) in plaintext. This is PCI scope."},{subkind:"iban",severity:"high",pattern:/\b[A-Z]{2}\d{2}(?: ?[A-Z0-9]{4}){2,7}(?: ?[A-Z0-9]{1,4})?\b/g,validate:hd,hint:"Bank account in IBAN form (mod-97 verified) in plaintext."},{subkind:"israeli_phone",severity:"medium",pattern:new RegExp(`${Mr}(?:\\+972[- ]?|0)(?:[57]\\d|[2-489])[- ]?\\d{3}[- ]?\\d{4}${Kr}`,"g"),validate:e=>{let t=e.replace(/\D/g,"").replace(/^972/,"0");return/^0[57]\d{8}$/.test(t)?!0:/^0[2-489]\d{7}$/.test(t)&&(/[- ]/.test(e)||e.startsWith("+972"))},hint:"Israeli phone number in plaintext."}];function Vi(e){if(e.length!==14&&e.length!==17)return!1;let t=+e.slice(0,4),n=+e.slice(4,6),r=+e.slice(6,8),o=+e.slice(8,10),i=+e.slice(10,12),s=+e.slice(12,14);return t>=1970&&t<=2099&&n>=1&&n<=12&&r>=1&&r<=31&&o<24&&i<60&&s<60}function Gi(e){let t=Number(e);return!Number.isSafeInteger(t)||t<1024?!1:Number.isInteger(Math.log2(t))||t%1048576===0}var md=new Set(["000000018","123456782","111111118","222222226","333333334","999999998","4111111111111111","4242424242424242","4000056655665556","5555555555554444","5105105105105100","2223003122003222","378282246310005","371449635398431","6011111111111117","3056930009020004","4012888888881881","4000000000000002"]);function Nt(e){return md.has(e.replace(/\D/g,""))}function Cn(e){let t=e.replace(/\D/g,"");return Vi(t)||Gi(t)}function Nn(e,t){let n=[];for(let r of Ur){r.pattern.lastIndex=0;let o=new Set,i,s=0;for(;(i=r.pattern.exec(e))!==null&&(s+=1,!(s>2e5));){let a=i[0];if(!(r.subkind!=="iban"&&r.subkind!=="israeli_phone"&&Cn(a))&&(r.validate(a)&&o.add(a.replace(/[\s-]/g,"")),o.size>=1e5))break}if(o.size>0){if(t)for(let c of o)Nt(c)||t(r.subkind,c);let a=[...o].filter(c=>!Nt(c)).length;n.push({subkind:r.subkind,severity:a===0?"low":r.severity,hint:a===0?`${r.hint} All ${o.size} are published test numbers.`:r.hint,count:o.size,real:a})}}for(let r of $n()){let o=new Set;for(let i of r.find(e))o.add(e.slice(i.start,i.end).trim());o.size>0&&n.push({subkind:r.kind,severity:r.severity,hint:r.hint,count:o.size})}return n}function Ve(e,t){let n=[],r="",o=!1;for(let i=0;i<e.length;i++){let s=e[i];o?s==='"'&&e[i+1]==='"'?(r+='"',i++):s==='"'?o=!1:r+=s:s==='"'?o=!0:s===t?(n.push(r),r=""):r+=s}return n.push(r),n}import{inflateRawSync as Ad}from"node:zlib";import{inflateSync as gd}from"node:zlib";var Vr=new Set([".pdf"]),Wi=8*1024*1024;function yd(e){let t=e.toString("latin1"),n=new Map,r=/(\d+)\s+(\d+)\s+obj\b/g,o;for(;(o=r.exec(t))!==null;){let i=Number(o[1]),s=r.lastIndex,a=t.indexOf("endobj",s);if(a<0)continue;let c=t.indexOf("stream",s),l,d=null;if(c>=0&&c<a){l=t.slice(s,c);let p=c+6;t[p]==="\r"&&(p+=1),t[p]===`
+`&&(p+=1);let f=t.indexOf("endstream",p);f>p&&(d=e.subarray(p,f))}else l=t.slice(s,a);n.set(i,{num:i,dict:l,stream:d})}for(let i of[...n.values()]){if(!i.stream||!/\/Type\s*\/ObjStm\b/.test(i.dict))continue;let s=Gr(i),a=Number(/\/N\s+(\d+)/.exec(i.dict)?.[1]??0),c=Number(/\/First\s+(\d+)/.exec(i.dict)?.[1]??-1);if(s===null||!a||c<0)continue;let l=s.slice(0,c).trim().split(/\s+/).map(Number);for(let d=0;d<a;d+=1){let p=l[2*d],f=l[2*d+1];if(p===void 0||f===void 0||Number.isNaN(p)||Number.isNaN(f))break;let h=d+1<a?l[2*(d+1)+1]:void 0,y=s.slice(c+f,h!==void 0?c+h:void 0);n.has(p)||n.set(p,{num:p,dict:y,stream:null})}}return n}function _d(e){let t=[...e.replace(/\s+/g,"")];if(t.length<40)return!1;let n=0,r=0;for(let o of t){let i=o.codePointAt(0)??0;i<32||i>=127&&i<=191||i===65533||i>=57344&&i<=63743?n+=1:/[\p{L}\p{N}]/u.test(o)&&(r+=1)}return n/t.length>.2||r/t.length<.25}function bd(e){let t=e.toString("latin1").replace(/\s/g,"");t.startsWith("<~")&&(t=t.slice(2));let n=t.indexOf("~>");n>=0&&(t=t.slice(0,n));let r=[],o=0,i=0;for(let s of t){if(s==="z"&&i===0){r.push(0,0,0,0);continue}let a=s.charCodeAt(0)-33;if(a<0||a>84)return null;o=o*85+a,i+=1,i===5&&(r.push(o>>>24&255,o>>>16&255,o>>>8&255,o&255),o=0,i=0)}if(i>0){for(let a=i;a<5;a+=1)o=o*85+84;let s=[o>>>24&255,o>>>16&255,o>>>8&255,o&255];for(let a=0;a<i-1;a+=1)r.push(s[a]??0)}return Buffer.from(r)}function vd(e){let t=e.toString("latin1").replace(/\s/g,"").split(">")[0]??"",n=t.length%2?t+"0":t;return/^[0-9A-Fa-f]*$/.test(n)?Buffer.from(n,"hex"):null}function kd(e){let t=/\/Filter\s*(\[[^\]]*\]|\/\w+)/.exec(e);return!t||!t[1]?[]:[...t[1].matchAll(/\/(\w+)/g)].map(n=>n[1]??"")}function Gr(e){if(!e.stream)return null;let t=e.stream;for(let n of kd(e.dict)){let r=null;if(n==="FlateDecode")try{r=gd(t)}catch{return null}else if(n==="ASCII85Decode")r=bd(t);else if(n==="ASCIIHexDecode")r=vd(t);else return null;if(r===null)return null;t=r}return t.toString("latin1")}function wd(e){let t=new Map,n=1,r=/begincodespacerange([\s\S]*?)endcodespacerange/.exec(e);if(r&&r[1]){let c=/<([0-9A-Fa-f]+)>/.exec(r[1]);c&&c[1]&&c[1].length>=4&&(n=2)}let o=c=>{let l="";for(let d=0;d+3<c.length+1;d+=4){let p=parseInt(c.slice(d,d+4),16);Number.isFinite(p)&&p>0&&(l+=String.fromCharCode(p))}return l},i=/beginbfchar([\s\S]*?)endbfchar/g,s;for(;(s=i.exec(e))!==null;){let c=/<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]*)>/g,l;for(;(l=c.exec(s[1]??""))!==null;)t.set(parseInt(l[1]??"0",16),o(l[2]??""))}let a=/beginbfrange([\s\S]*?)endbfrange/g;for(;(s=a.exec(e))!==null;){let c=s[1]??"",l=/<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]*)>/g,d;for(;(d=l.exec(c))!==null;){let p=parseInt(d[1]??"0",16),f=parseInt(d[2]??"0",16),h=parseInt((d[3]??"0").slice(0,4)||"0",16);if(!(f-p>65535))for(let y=p;y<=f;y+=1)t.set(y,String.fromCharCode(h+(y-p)))}}return{map:t,bytes:n}}function Sd(e){let t=new Map,n=new Map,r=[];for(let o of e.values()){let i=/\/Font\s*<<([\s\S]*?)>>/.exec(o.dict);i?.[1]&&r.push(i[1]);let s=/\/Font\s+(\d+)\s+\d+\s+R/.exec(o.dict);if(s){let a=e.get(Number(s[1]));a&&r.push(a.dict)}}for(let o of r){let i=/\/([^\s/<>[\]()]+)\s+(\d+)\s+\d+\s+R/g,s;for(;(s=i.exec(o))!==null;)n.set(s[1]??"",Number(s[2]))}for(let[o,i]of n){let s=e.get(i);if(!s)continue;let a=/\/ToUnicode\s+(\d+)\s+\d+\s+R/.exec(s.dict);if(!a)continue;let c=e.get(Number(a[1]));if(!c)continue;let l=Gr(c);l&&t.set(o,wd(l))}return t}function qi(e){let t=[];for(let n=0;n<e.length;n+=1){let r=e[n];if(r!=="\\"){t.push(r.charCodeAt(0)&255);continue}let o=e[n+1];if(o===void 0)break;if(o>="0"&&o<="7"){let s="",a=n+1;for(;a<e.length&&s.length<3&&e[a]>="0"&&e[a]<="7";)s+=e[a],a+=1;t.push(parseInt(s,8)&255),n=a-1;continue}let i={n:10,r:13,t:9,b:8,f:12};t.push(i[o]??o.charCodeAt(0)&255),n+=1}return t}function Ji(e){if(e.length<2||e[0]!==254||e[1]!==255)return null;let t="";for(let n=2;n+1<e.length;n+=2)t+=String.fromCharCode((e[n]??0)<<8|(e[n+1]??0));return t}function zi(e,t){let n=Ji(e);if(n!==null)return n;if(!t)return e.map(o=>String.fromCharCode(o)).join("");let r="";if(t.bytes===2)for(let o=0;o+1<e.length;o+=2){let i=(e[o]??0)<<8|(e[o+1]??0);r+=t.map.get(i)??""}else for(let o of e)r+=t.map.get(o)??String.fromCharCode(o);return r}function Ed(e,t){let n="",r,o=/\/([^\s/<>[\]()]+)\s+[\d.]+\s+Tf|\((?:\\.|[^\\)])*\)|<[0-9A-Fa-f\s]*>|TJ|Tj|'|"/g,i,s="";for(;(i=o.exec(e))!==null;){let a=i[0];if(a.endsWith("Tf")){r=t.get(i[1]??"");continue}if(a==="TJ"||a==="Tj"||a==="'"||a==='"'){s&&(n+=s+`
+`,s="");continue}if(a.startsWith("("))s+=zi(qi(a.slice(1,-1)),r);else if(a.startsWith("<")){let c=a.slice(1,-1).replace(/\s+/g,""),l=[];for(let d=0;d+1<c.length;d+=2)l.push(parseInt(c.slice(d,d+2),16));s+=zi(l,r)}}return s&&(n+=s+`
+`),n}function xd(e,t){let n=e.toString("latin1"),r=/\/Info\s+(\d+)\s+\d+\s+R/.exec(n),o=r?t.get(Number(r[1]))?.dict:void 0;if(!o)return"";let i=[],s=/\/(Author|Title|Subject|Keywords|Creator|Producer)\s*(\((?:\\.|[^\\)])*\)|<[0-9A-Fa-f\s]*>)/g,a;for(;(a=s.exec(o))!==null;){let c=a[2]??"";if(c.startsWith("(")){let l=qi(c.slice(1,-1));i.push(Ji(l)??l.map(d=>String.fromCharCode(d)).join(""))}else{let l=c.slice(1,-1).replace(/\s+/g,""),d="";if(l.toUpperCase().startsWith("FEFF"))for(let p=4;p+3<l.length+1;p+=4)d+=String.fromCharCode(parseInt(l.slice(p,p+4),16));else for(let p=0;p+1<l.length;p+=2)d+=String.fromCharCode(parseInt(l.slice(p,p+2),16));i.push(d)}}return i.join(`
+`)}function Yi(e){if(!e.subarray(0,8).toString("latin1").startsWith("%PDF-")||e.toString("latin1",0,Math.min(e.length,4096)).includes("/Encrypt"))return null;let n=yd(e);if(n.size===0)return null;let r=Sd(n),o=[];o.push(xd(e,n));let i=0,s=0,a=!1;for(let l of n.values()){if(!l.stream||/\/Subtype|\/Type\s*\/(XObject|Font|Metadata)|\/FontFile/.test(l.dict))continue;let d=Gr(l);if(d===null||!/(TJ|Tj)\b/.test(d))continue;let p=Ed(d,r);if(p.trim().length!==0){if(s+=1,i+p.length>Wi){o.push(p.slice(0,Math.max(0,Wi-i))),a=!0;break}o.push(p),i+=p.length}}if(s===0)return null;let c=o.slice(1).join(`
+`);return _d(c)?null:{text:o.join(`
+`),truncated:a,streams:s}}var Xi=new Set([".xlsx",".xlsm",".docx",".pptx"]),Wr=8*1024*1024,Td=101010256,Id=33639248,$d=67324752;function lt(e){let t=Math.min(e.length,67584),n=-1;for(let s=e.length-22;s>=e.length-t&&s>=0;s-=1)if(e.readUInt32LE(s)===Td){n=s;break}if(n<0)return null;let r=e.readUInt16LE(n+10),o=e.readUInt32LE(n+16);if(o>=e.length)return null;let i=[];for(let s=0;s<r&&!(o+46>e.length||e.readUInt32LE(o)!==Id);s+=1){let a=e.readUInt16LE(o+10),c=e.readUInt32LE(o+20),l=e.readUInt32LE(o+24),d=e.readUInt16LE(o+28),p=e.readUInt16LE(o+30),f=e.readUInt16LE(o+32),h=e.readUInt32LE(o+42),y=e.subarray(o+46,o+46+d).toString("utf8");i.push({name:y,method:a,compSize:c,uncompSize:l,localHeaderOffset:h}),o+=46+d+p+f}return i}function dt(e,t){let n=t.localHeaderOffset;if(n+30>e.length||e.readUInt32LE(n)!==$d)return null;let r=e.readUInt16LE(n+26),o=e.readUInt16LE(n+28),i=n+30+r+o,s=i+t.compSize;if(s>e.length)return null;let a=e.subarray(i,s);try{if(t.method===0)return Buffer.from(a);if(t.method===8)return Ad(a)}catch{return null}return null}function Pd(e,t){return dt(e,t)?.toString("utf8")??null}var Rd={"&amp;":"&","&lt;":"<","&gt;":">","&quot;":'"',"&apos;":"'"};function $e(e){return e.replace(/&(amp|lt|gt|quot|apos);/g,t=>Rd[t]??t).replace(/&#(\d+);/g,(t,n)=>{let r=Number(n);return r>0&&r<1114112?String.fromCodePoint(r):""}).replace(/&#x([0-9a-fA-F]+);/g,(t,n)=>{let r=parseInt(n,16);return r>0&&r<1114112?String.fromCodePoint(r):""})}function Dd(e){return $e(e.replace(/<[^>]*>/g,`
 `)).replace(/\n{2,}/g,`
-`)}function Rd(e,t,n){let r=new RegExp(`<${t}\\b[^>]*\\b${n}="([^"]*)"`,"g"),o=[],i;for(;(i=r.exec(e))!==null;)i[1]&&o.push(Pe(i[1]));return o}function Dd(e,t){let n=[];for(let r of t)(r==="docProps/core.xml"||r==="docProps/app.xml")&&n.push(r);if(e===".xlsx"||e===".xlsm")for(let r of t)(r==="xl/sharedStrings.xml"||r==="xl/workbook.xml"||/^xl\/worksheets\/sheet\d+\.xml$/.test(r)||/^xl\/comments\d*\.xml$/.test(r))&&n.push(r);else if(e===".docx")for(let r of t)(r==="word/document.xml"||/^word\/(header|footer|footnotes|endnotes|comments)\d*\.xml$/.test(r))&&n.push(r);else if(e===".pptx")for(let r of t)/^ppt\/(slides|notesSlides)\/(slide|notesSlide)\d+\.xml$/.test(r)&&n.push(r);return n}function Cd(e,t){let n=at(e);if(!n||n.length===0)return null;let r=new Map(n.map(l=>[l.name,l])),o=Dd(t,n.map(l=>l.name));if(o.length===0)return null;let i=[],s=[],a=0,c=!1;for(let l of o){if(a>=Vr){c=!0;break}let u=r.get(l);if(!u)continue;let p=Id(e,u);if(p===null)continue;let f=$d(p);if(l==="xl/workbook.xml"){let h=Rd(p,"sheet","name");h.length&&(f+=`
+`)}function Cd(e,t,n){let r=new RegExp(`<${t}\\b[^>]*\\b${n}="([^"]*)"`,"g"),o=[],i;for(;(i=r.exec(e))!==null;)i[1]&&o.push($e(i[1]));return o}function Nd(e,t){let n=[];for(let r of t)(r==="docProps/core.xml"||r==="docProps/app.xml")&&n.push(r);if(e===".xlsx"||e===".xlsm")for(let r of t)(r==="xl/sharedStrings.xml"||r==="xl/workbook.xml"||/^xl\/worksheets\/sheet\d+\.xml$/.test(r)||/^xl\/comments\d*\.xml$/.test(r))&&n.push(r);else if(e===".docx")for(let r of t)(r==="word/document.xml"||/^word\/(header|footer|footnotes|endnotes|comments)\d*\.xml$/.test(r))&&n.push(r);else if(e===".pptx")for(let r of t)/^ppt\/(slides|notesSlides)\/(slide|notesSlide)\d+\.xml$/.test(r)&&n.push(r);return n}function Od(e,t){let n=lt(e);if(!n||n.length===0)return null;let r=new Map(n.map(l=>[l.name,l])),o=Nd(t,n.map(l=>l.name));if(o.length===0)return null;let i=[],s=[],a=0,c=!1;for(let l of o){if(a>=Wr){c=!0;break}let d=r.get(l);if(!d)continue;let p=Pd(e,d);if(p===null)continue;let f=Dd(p);if(l==="xl/workbook.xml"){let h=Cd(p,"sheet","name");h.length&&(f+=`
 `+h.join(`
-`))}a+f.length>Vr&&(f=f.slice(0,Math.max(0,Vr-a)),c=!0),f.trim().length!==0&&(i.push(f),s.push(l),a+=f.length)}return i.length===0?null:{text:i.join(`
-`),truncated:c,parts:s}}function Se(e,t){if(Yi.has(t))return Cd(e,t);if(Ur.has(t)){let n=Ji(e);return n?{text:n.text,truncated:n.truncated,parts:[`pdf:${n.streams}-streams`]}:null}return null}var Cn=new Set([...Yi,...Ur]);import{deflateRawSync as Ld}from"node:zlib";var Xi={israeli_id:"[ID]",credit_card:"[CARD]",iban:"[IBAN]",israeli_phone:"[PHONE]",email:"[EMAIL]"},Nd=/[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g,Od=[...Hr].sort((e,t)=>+(t.subkind==="iban")-+(e.subkind==="iban"));function Nn(e,t,n=1){e[t]=(e[t]??0)+n}var lt=null,On=e=>{let t=e.trim();lt&&t&&lt.add(t)};function jn(e){let t=lt;lt=new Set;try{return{result:e(),replaced:lt}}finally{lt=t}}function pe(e,t={}){let n=e;for(let r of Od)r.pattern.lastIndex=0,n=n.replace(r.pattern,o=>r.validate(o)?(Nn(t,r.subkind),On(o),Xi[r.subkind]??`[${r.subkind.toUpperCase()}]`):o);n=n.replace(Nd,r=>(Nn(t,"email"),On(r),Xi.email));for(let r of Tn()){let o=r.find(n).sort((i,s)=>s.start-i.start);for(let i of o)On(n.slice(i.start,i.end)),n=n.slice(0,i.start)+`[${r.kind.toUpperCase()}]`+n.slice(i.end),Nn(t,r.kind)}return{text:n,counts:t,columnsHidden:[]}}function Gr(){let e=new Map,t={};return(n,r)=>{On(r);let o=`${n}\0${r.trim()}`,i=e.get(o);return i===void 0&&(i=t[n]=(t[n]??0)+1,e.set(o,i)),`[${n.toUpperCase()}-${i}]`}}function Ln(e){let t=e.trim();return/^\[[A-Z_]+(?:-\d+)?\]$/.test(t)||/^[\d]{0,4}[*•xX]{3,}[\d]{0,4}$/.test(t)}var Qi=/^\s*-?\d+(?:\.\d+)?\s*$/;function Wr(e){let t=new Set;for(let[n,r]of e){let o=r.filter(s=>Qi.test(s));if(o.length<3)continue;o.filter(s=>pe(s).text!==s).length/o.length<.5&&t.add(n)}return t}function Zi(e,t){return e.includes(t)||e.includes('"')||e.includes(`
-`)?`"${e.replace(/"/g,'""')}"`:e}function jd(e){let t=(e.match(/\t/g)??[]).length,n=(e.match(/;/g)??[]).length,r=(e.match(/,/g)??[]).length;return t>r&&t>=n?"	":n>r?";":","}function Lt(e,t){let n=e.split(/\r?\n/),r=t??jd(n[0]??""),o=Ve(n[0]??"",r),i=o.map(h=>Ue(h)),s={},a=Gr(),c=n.slice(1).map(h=>h===""?null:Ve(h,r)),l=new Map;for(let h of c)h?.forEach((_,y)=>l.set(y,[...l.get(y)??[],_]));let u=Wr(l),p=it();if(p){let h=c.filter(_=>_!==null).slice(0,200);for(let _ of p({name:"table",headers:o,rows:h})){let y=o.indexOf(_.column);y>=0&&!(_.how==="header"&&u.has(y))&&(i[y]={type:_.type,label:_.category})}}let f=[o.map(h=>Zi(h,r)).join(r)];for(let h of c){if(h===null){f.push("");continue}let _=h.map((y,k)=>{let E=i[k];return E&&y.trim()!==""&&!Ln(y)?(Nn(s,`column:${E.type}`),a(E.type,y)):u.has(k)&&Qi.test(y)?y:pe(y,s).text});f.push(_.map(y=>Zi(y,r)).join(r))}return{text:f.join(`
-`),counts:s,columnsHidden:o.filter((h,_)=>i[_])}}var Bd=/^xl\/(pivotCache|charts|externalLinks)\//,ns=10;function Fd(e,t,n=1){e[t]=(e[t]??0)+n}function rs(e){return e.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;")}function os(e){let t=e.replace(/<rPh\b[\s\S]*?<\/rPh>/g,""),n="";for(let r of t.matchAll(/<t(?:\s[^>]*)?>([\s\S]*?)<\/t>/g))n+=r[1];return Pe(n)}function is(e){return e?[...e.matchAll(/<si\b[^>]*>([\s\S]*?)<\/si>|<si\b[^>]*\/>/g)].map(t=>os(t[1]??"")):[]}var ss=/<c\b([^>]*?)(?:\/>|>([\s\S]*?)<\/c>)/g;function Bn(e,t){let n=new RegExp(`\\b${t}="([^"]*)"`).exec(e);return n?n[1]:null}function Ge(e,t){if(e.type==="s"){let r=/<v>([^<]*)<\/v>/.exec(e.inner);return r?t[Number(r[1])]??null:null}if(e.type==="inlineStr"){let r=/<is>([\s\S]*?)<\/is>/.exec(e.inner);return r?os(r[1]):null}if(e.type==="b"||e.type==="e")return null;let n=/<v>([^<]*)<\/v>/.exec(e.inner);return n?Pe(n[1]):null}function as(e){let t=[];for(let n of e.matchAll(ss)){let r=Bn(n[1],"r"),o=r?/^([A-Z]+)(\d+)$/.exec(r):null;if(!o)return null;t.push({full:n[0],attrs:n[1],inner:n[2]??"",col:o[1],row:Number(o[2]),type:Bn(n[1],"t")??"n"})}return t}function Md(e,t){let n=[...new Set(e.map(r=>r.row))].sort((r,o)=>r-o).slice(0,ns);for(let r of n){let o=new Map;for(let i of e.filter(s=>s.row===r)){let s=Ge(i,t),a=s?Ue(s):null;a&&o.set(i.col,{type:a.type,header:s.trim()})}if(o.size>0)return{row:r,cols:o}}return{row:-1,cols:new Map}}var cs=/^xl\/worksheets\/sheet\d+\.xml$/,Kd=200;function Hd(e){let t=e.trim();return/^[\d.,\-+/:%$₪€\s]+$/.test(t)||t.length>60}function Ud(e,t){let n=[...new Set(e.map(i=>i.row))].sort((i,s)=>i-s).slice(0,ns),r=-1,o=-1/0;for(let i of n){let s=e.filter(l=>l.row===i).map(l=>(Ge(l,t)??"").trim()).filter(Boolean);if(s.length<2)continue;let a=s.filter(l=>!Hd(l)).length,c=a*2-(s.length-a);c>o&&(o=c,r=i)}return r}function ls(e,t,n){let r=Md(t,n),o=it();if(!o)return r;let i=r.row>=0?r.row:Ud(t,n);if(i<0)return r;let s=t.filter(p=>p.row===i).map(p=>({col:p.col,text:(Ge(p,n)??"").trim()})).filter(p=>p.text),a=new Map(s.map((p,f)=>[p.col,f])),c=new Map;for(let p of t){if(p.row<=i)continue;let f=a.get(p.col);if(f!==void 0){if(!c.has(p.row)){if(c.size>=Kd)continue;c.set(p.row,s.map(()=>""))}c.get(p.row)[f]=Ge(p,n)??""}}let l=new Map(i===r.row?r.cols:[]),u=s.map(p=>p.text);for(let p of o({name:e,headers:u,rows:[...c.values()]})){let f=u.indexOf(p.column);f<0||l.set(s[f].col,{type:p.type,header:p.column,category:p.category,severity:p.severity,how:p.how})}return{row:i,cols:l}}function zr(e){let t=at(e);if(!t||t.length===0)return null;let n=i=>{let s=t.find(c=>c.name===i),a=s?ct(e,s):null;return a?a.toString("utf8"):null},r=is(n("xl/sharedStrings.xml")),o=[];for(let i of t.filter(s=>cs.test(s.name))){let s=n(i.name),a=s?as(s):null;if(!a)continue;let c=i.name.replace(/^xl\/worksheets\//,"").replace(/\.xml$/,""),l=ls(c,a,r);for(let[u,p]of l.cols){let f=a.filter(h=>{let _=h.col===u&&h.row>l.row?(Ge(h,r)??"").trim():"";return _!==""&&!Ln(_)}).length;f>0&&o.push({...p,sheet:c,count:f})}}return o}function es(e,t){return`<c${e.replace(/\s*\bt="[^"]*"/,"")} t="inlineStr"><is><t xml:space="preserve">${rs(t)}</t></is></c>`}var Vd=(()=>{let e=new Uint32Array(256);for(let t=0;t<256;t+=1){let n=t;for(let r=0;r<8;r+=1)n=n&1?3988292384^n>>>1:n>>>1;e[t]=n>>>0}return e})();function Gd(e){let t=4294967295;for(let n=0;n<e.length;n+=1)t=Vd[(t^e[n])&255]^t>>>8;return(t^4294967295)>>>0}var ts=33;function ds(e){let t=[],n=[],r=0;for(let s of e){let a=Buffer.from(s.name,"utf8"),c=s.name.endsWith("/"),l=c?Buffer.alloc(0):Ld(s.data),u=c?0:8,p=c?0:Gd(s.data),f=Buffer.alloc(30);f.writeUInt32LE(67324752,0),f.writeUInt16LE(20,4),f.writeUInt16LE(2048,6),f.writeUInt16LE(u,8),f.writeUInt16LE(ts,12),f.writeUInt32LE(p,14),f.writeUInt32LE(l.length,18),f.writeUInt32LE(s.data.length,22),f.writeUInt16LE(a.length,26),t.push(f,a,l);let h=Buffer.alloc(46);h.writeUInt32LE(33639248,0),h.writeUInt16LE(20,4),h.writeUInt16LE(20,6),h.writeUInt16LE(2048,8),h.writeUInt16LE(u,10),h.writeUInt16LE(ts,14),h.writeUInt32LE(p,16),h.writeUInt32LE(l.length,20),h.writeUInt32LE(s.data.length,24),h.writeUInt16LE(a.length,28),h.writeUInt32LE(r,42),n.push(h,a),r+=f.length+a.length+l.length}let o=Buffer.concat(n),i=Buffer.alloc(22);return i.writeUInt32LE(101010256,0),i.writeUInt16LE(e.length,8),i.writeUInt16LE(e.length,10),i.writeUInt32LE(o.length,12),i.writeUInt32LE(r,16),Buffer.concat([...t,o,i])}function Bt(e){let t=at(e);if(!t||t.length===0||t.some(y=>Bd.test(y.name)))return null;let n=new Map;for(let y of t){if(y.name.endsWith("/")){n.set(y.name,Buffer.alloc(0));continue}let k=ct(e,y);if(!k)return null;n.set(y.name,k)}let r=[...n.keys()].filter(y=>cs.test(y));if(r.length===0)return null;let o=n.get("xl/sharedStrings.xml")?.toString("utf8")??null,i=is(o),s=new Set,a={},c=new Set,l=Gr();for(let y of r){let k=n.get(y).toString("utf8"),E=as(k);if(!E)return null;let R=ls(y.replace(/^xl\/worksheets\//,"").replace(/\.xml$/,""),E,i),B=R.row,m=new Map;for(let T of E){if(T.type!=="n"||T.row<=B)continue;let I=Ge(T,i);I!==null&&m.set(T.col,[...m.get(T.col)??[],I])}let v=Wr(m),w=new Map;for(let[T,{type:I,header:L,how:j}]of R.cols)j==="header"&&v.has(T)||(w.set(T,I),c.add(L));let $=k.replace(ss,(T,I,L)=>{let j=Bn(I,"r"),[,b,S]=/^([A-Z]+)(\d+)$/.exec(j),x={full:T,attrs:I,inner:L??"",col:b,row:Number(S),type:Bn(I,"t")??"n"},P=Ge(x,i),D=()=>{if(x.type==="s"){let F=/<v>([^<]*)<\/v>/.exec(x.inner);F&&s.add(Number(F[1]))}return T};if(P===null||P.trim()==="")return D();let U=w.get(b);if(U&&x.row>B&&!Ln(P))return Fd(a,`column:${U}`),es(I,l(U,P));if(x.type==="n"&&v.has(b))return D();let X=pe(P,a);return X.text===P?D():es(I,X.text)});n.set(y,Buffer.from($,"utf8"))}if(o){let y=-1,k=o.replace(/<si\b[^>]*>[\s\S]*?<\/si>|<si\b[^>]*\/>/g,E=>(y+=1,s.has(y)?E:"<si><t></t></si>"));n.set("xl/sharedStrings.xml",Buffer.from(k,"utf8"))}for(let y of[...n.keys()].filter(k=>/^xl\/comments\d*\.xml$/.test(k))){let E=n.get(y).toString("utf8").replace(/(<t(?:\s[^>]*)?>)([\s\S]*?)(<\/t>)/g,(R,B,m,v)=>{let w=pe(Pe(m),a);return`${B}${rs(w.text)}${v}`});n.set(y,Buffer.from(E,"utf8"))}let u=n.get("docProps/core.xml");if(u){let y=u.toString("utf8").replace(/(<dc:creator>)[\s\S]*?(<\/dc:creator>)/,"$1$2").replace(/(<cp:lastModifiedBy>)[\s\S]*?(<\/cp:lastModifiedBy>)/,"$1$2");n.set("docProps/core.xml",Buffer.from(y,"utf8"))}let p=n.get("xl/workbook.xml");if(p){let y=p.toString("utf8").replace(/<(\w+:)?absPath\b[^>]*\/>|<(\w+:)?absPath\b[^>]*>[\s\S]*?<\/(\w+:)?absPath>/g,"");n.set("xl/workbook.xml",Buffer.from(y,"utf8"))}let f=n.get("docProps/app.xml");if(f){let y=f.toString("utf8").replace(/(<Company>)[\s\S]*?(<\/Company>)/,"$1$2").replace(/(<Manager>)[\s\S]*?(<\/Manager>)/,"$1$2");n.set("docProps/app.xml",Buffer.from(y,"utf8"))}let h=n.has("xl/calcChain.xml"),_=t.map(y=>y.name).filter(y=>!(h&&y==="xl/calcChain.xml"));if(h)for(let y of["[Content_Types].xml","xl/_rels/workbook.xml.rels"]){let k=n.get(y);k&&n.set(y,Buffer.from(k.toString("utf8").replace(/<(Override|Relationship)\b[^>]*calcChain[^>]*\/>/g,""),"utf8"))}return{bytes:ds(_.map(y=>({name:y,data:n.get(y)}))),counts:a,columnsHidden:[...c]}}import{createHash as Wd}from"node:crypto";var $e=/(^|\/)(\.env(\.[\w.-]+)?|[\w.-]+\.env(\.[\w.-]+)?)$/i,ps=/(SECRET|PASSWORD|PASSWD|PASS|PWD|TOKEN|PRIVATE|CREDENTIAL|API_?KEY|_KEY|KEY_ID|DSN|DATABASE_URL|_URI|POOLER_URL|SALT|PEPPER)$/i,fs=/(^NEXT_PUBLIC_|^VITE_|^EXPO_PUBLIC_|ANON_KEY$|PUBLISHABLE_KEY$|PUBLIC_KEY$)/i,us=/(ENCRYPT|CIPHER|PII|DATA_?KEY|KMS|MASTER_?KEY|BLIND_?INDEX|VAULT_?KEY)/i,zd=12;function qr(e){let t=0;for(let n of e.split(/\r?\n/)){let r=/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/.exec(n);if(!r||!ps.test(r[1])||fs.test(r[1]))continue;let o=r[2].trim().replace(/^(['"])(.*)\1$/,"$2");o.length>=8&&!/^\$\{?[A-Z_]+\}?$/.test(o)&&t++}return t}var Fn=class{byHash=new Map;add(t,n){for(let r of n.split(/\r?\n/)){let o=/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/.exec(r);if(!o)continue;let i=o[1];if(!ps.test(i)||fs.test(i))continue;let s=o[2].trim();if(s.startsWith('"')&&s.endsWith('"')||s.startsWith("'")&&s.endsWith("'")?s=s.slice(1,-1):s=s.replace(/\s+#.*$/,""),s.length<zd||/^\$\{?[A-Z_]+\}?$/.test(s))continue;let a=/^[a-z][a-z0-9+.-]*:\/\/[^:/@\s]+:([^@\s]+)@/i.exec(s);if(/^[a-z][a-z0-9+.-]*:\/\//i.test(s)&&!a)continue;let c=a?qd(a[1]):s;if(c.length<8)continue;let l=Wd("sha256").update(c).digest("hex"),u=this.byHash.get(l)??[];u.some(p=>p.file===t&&p.name===i)||u.push({file:t,name:i}),this.byHash.set(l,u)}}groups(){let t=[];for(let n of this.byHash.values()){let r=[...new Set(n.map(s=>s.name))].sort(),o=[...new Set(n.map(s=>s.file))].sort();if(r.length<2&&o.length<2)continue;let i=r.some(s=>us.test(s));t.push({names:r,files:o,encryption:i&&r.some(s=>!us.test(s))})}return t}};function qd(e){try{return decodeURIComponent(e)}catch{return e}}function hs(e){let t=[];e.names.length>1&&t.push(`one secret is used as ${e.names.length} variables (${e.names.join(", ")})`),e.files.length>1&&t.push(`${e.names.length===1?e.names[0]:"the same secret"} is copied in ${e.files.length} files (${e.files.join(", ")})`);let n=`Shared secret: ${t.join("; and ")}.`;return e.encryption?n+=" \u26A0 It is ALSO a data-encryption key: do NOT rotate it like a normal key \u2014 everything already encrypted with it would stop decrypting. First give the other uses their own new secret, then change the encryption key only in a planned re-encryption.":e.names.length>1?n+=" Replacing it breaks every use at once \u2014 give each use its own secret first, then retire the shared one.":n+=" Every copy has to be removed or updated when the key is replaced; keep one source (the vault) instead.",n}var Yr=10,Yd=5e3,Xd=5e4,Zd=64*1024*1024,Xr=32*1024,Qd=new Set([".exe",".dll",".so",".dylib",".msi",".bin",".iso",".zip",".tar",".gz",".7z",".rar",".png",".jpg",".jpeg",".gif",".bmp",".tif",".tiff",".webp",".ico",".mp3",".mp4",".mov",".avi",".mkv",".wav",".flac",".ogg",".psd",".ai",".fla",".dwg",".dxf",".sqlite",".sqlite3",".db",".pyc",".class"]),_s=new Set(["node_modules",".git",".hg",".svn"]),bs=new Set([".cache",".cargo",".rustup",".npm",".pnpm-store",".yarn",".gradle",".m2",".nuget",".conda",".pyenv",".rbenv",".nvm",".volta",".bun",".deno",".docker",".android",".vscode-server",".agents",".agent",".codeium",".continue","antigravity",".antigravity","__pycache__",".venv","venv","site-packages",".next",".turbo",".expo",".nx",".parcel-cache",".svelte-kit","appdata",".trash","$recycle.bin"].map(e=>e.toLowerCase())),eu=/(^|\/)\.(vscode|cursor|windsurf|antigravity|vscode-server)\/extensions$/i,Zr=40,tu=/^(agent|bot|model|service|tool|app|job|task|queue|test|qa|suite|runner|worker|host|server|project|repo|package|file|table|column|field)[_-]?name$/i,nu={critical:"high",high:"medium",medium:"low",low:"info",info:"info"},ru=[{re:/\b\d{3}-\d{2}-\d{4}\b/,kind:"pii_unencrypted",subkind:"ssn",severity:"high",hint:"US Social Security Number pattern in plaintext."},{re:/\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/i,kind:"pii_unencrypted",subkind:"email",severity:"low",hint:"Email addresses in plaintext."},{re:/(passport|teudat.?zehut|(?<![א-ת])תעודת.?זהות(?![א-ת])|(?<![א-ת])ת["'׳״]?\.?ז(?![א-ת]))/i,kind:"pii_unencrypted",subkind:"passport_keyword",severity:"low",hint:"Mentions the word passport / national ID \u2014 a word, not a number. The numbers themselves are reported by the ID rules."}],ou=[{re:/(salary|payroll|משכורת|ssn|social.?security|passport|דרכון|תעודת.?זהות)/i,kind:"pii_unencrypted",subkind:"sensitive_filename",severity:"medium",hint:"Filename suggests sensitive PII content."},{re:/\.(env|env\.local|pem|key|p12|pfx)$/i,kind:"pii_unencrypted",subkind:"secret_file",severity:"high",hint:"File extension implies secret / credential bundle in plaintext."}];function iu(e){let t=e.lastIndexOf(".");return t<0?"":e.slice(t).toLowerCase()}async function Ft(e){let t=Date.now(),n=[],r=new Fn,o=new Map,i=[],s=0,a=0,c={hit_file_cap:!1,hit_depth_cap:!1,max_files:Math.min(Math.max(1,e.max_files??Yd),Xd),max_depth:Yr,tool_dirs_skipped:0,tool_dir_names:[],not_reached:[],skipped_by_extension:0,documents_extracted:0,documents_truncated:0,documents_unreadable:0,files_too_large:0,files_sampled_only:0,sample_bytes:Xr};function l(m){return(m.startsWith(e.target_path)?m.slice(e.target_path.length).replace(/^[\\/]+/,"")||ys(m):m).replace(/\\/g,"/")}function u(m,v,w,$,T){let I=l(m);I!==""&&i.push({target_id:e.target_id,path:I,kind:v,size_bytes:w,modified_at:$?$.toISOString():null,child_count:T})}function p(m,v){n.push({target_id:e.target_id,relative_path:m,finding_kind:v.kind,finding_subkind:v.subkind,severity:v.severity,remediation_hint:v.hint})}function f(m,v,w,$,T,I=!1){I&&Kr.test(m)?T=`${T??""} (In a test / sample file, but not a published test number \u2014 this looks real.)`.trim():v!=="hardcoded_secret"&&Kr.test(m)&&(w=nu[w],T=`${T??""} (Test / sample / minified file \u2014 probably sample data; check before acting.)`.trim()),n.push({target_id:e.target_id,relative_path:m,finding_kind:v,finding_subkind:$,severity:w,remediation_hint:T})}function h(m,v){if(s+=1,s>c.max_files){c.hit_file_cap=!0;return}let w=l(m);for(let S of ou)S.re.test(v)&&p(w,S);let $=iu(v);if(Qd.has($)){c.skipped_by_extension+=1;return}let T=Cn.has($),I=0;try{I=Mn(m).size}catch{return}if(T&&I>Zd){c.files_too_large+=1;return}let L;try{let S=gs(m,{flag:"r"});L=T?S:S.subarray(0,Xr)}catch{return}a+=1;let j;if(T){let S=Se(L,$);if(!S){c.documents_unreadable+=1;return}j=S.text,c.documents_extracted+=1,S.truncated&&(c.documents_truncated+=1)}else{let S=0;for(let x=0;x<L.length;x+=1)L[x]===0&&(S+=1);if(L.length>0&&S/L.length>.05)return;j=L.toString("utf8"),I>Xr&&(c.files_sampled_only+=1)}let b=new Set;$e.test(w)&&r.add(w,j);for(let S of ru)if(S.re.test(j)){let x=`${S.subkind}::${w}`;b.has(x)||(b.add(x),p(w,S))}for(let S of Dn(j,(x,P)=>{if(x!=="israeli_id"&&x!=="credit_card"&&x!=="iban")return;let D=Jd("sha256").update(`${x}:${P}`).digest("hex"),U=o.get(D)??new Set;U.add(w),o.set(D,U)})){let x=`validated::${S.subkind}::${w}`;b.has(x)||(b.add(x),f(w,"pii_unencrypted",S.severity,S.subkind,`${S.hint} ${S.count} distinct value${S.count===1?"":"s"} in this file.`,(S.real??0)>0))}if(!Fi.test(w)){let S=st(),x=j.split(`
-`),P=Math.min(x.length,2e3);for(let D=0;D<P;D++){let U=x[D];if(!U)continue;let X=U.trimStart();if(!(X.startsWith("//")||X.startsWith("/*")||X.startsWith("*")||X.startsWith("#"))&&!/process\.env/.test(U)&&!/\$\{[A-Z_]+/.test(U)){for(let F of S)if(F.pattern.test(U)){let de=`secret::${F.id}::${w}::${D+1}`;if(b.has(de))break;b.add(de);let Or=Mi.test(w);f(w,"hardcoded_secret",Or?"critical":F.severity,F.id,Or?`A real-looking ${F.name} in an EXAMPLE file near line ${D+1}. Example files are committed to Git and shared on purpose \u2014 rotate this key at its source and put a placeholder in the example.`:`Looks like a ${F.name} hardcoded near line ${D+1}. Move to an env var or secret manager.`);break}}}}if(v==="package.json"&&!w.includes("node_modules"))try{let S=gs(m,"utf8"),x=Ki(S);for(let P of x){let D=`vuln::${P.name}::${w}`;b.has(D)||(b.add(D),f(w,"vulnerable_dependency",P.vuln.severity,P.name,`${P.name}@${P.version} is below ${P.vuln.below} (${P.vuln.cve} \xB7 ${P.vuln.desc}). Bump to ${P.vuln.below} or higher.`))}}catch{}if($===".csv"||$===".tsv"){let S=$===".tsv"?"	":",",x=j.split(/\r?\n/);if(x.length>0){let P=Ve(x[0]??"",S),D=x.slice(1,51).map(X=>Ve(X??"",S)),U=it();if(U){let X=x.slice(1,201).filter(F=>F!=="").map(F=>Ve(F,S));for(let F of U({name:"table",headers:P,rows:X})){let de=`header::${w}::${F.column}::${F.type}`;b.has(de)||(b.add(de),f(w,"pii_header_match",F.severity,`${F.type}:${F.column}`,`Column "${F.column}" holds ${F.category} (${F.how==="value"?`${F.hits} sampled values matched`:"by its header"}). Wrap with envelope or keep a clean copy for work.`))}}U||P.forEach((X,F)=>{let de=(X??"").trim();if(!de)return;let He=Ue(de)?.type??null;if(!He){let Dt=[];for(let Ql of D){let jr=Ql[F];if(jr&&jr.trim().length>0&&Dt.push(jr),Dt.length>=50)break}let Ct=y(Dt);Ct&&(He=Ct)}if(He){let Dt=Pn[He]??"medium",Ct=`header::${w}::${de}::${He}`;if(b.has(Ct))return;b.add(Ct),f(w,"pii_header_match",Dt,`${He}:${de}`,`Column "${de}" looks like ${He} data. Wrap with envelope or move to a vault-backed reference.`)}})}}if($===".xlsx"||$===".xlsm")for(let S of zr(L)??[]){let x=`xlsxheader::${w}::${S.sheet}::${S.header}::${S.type}`;b.has(x)||(b.add(x),f(w,"pii_header_match",S.severity??Pn[S.type]??"medium",`${S.type}:${S.header}`,`Column "${S.header}" (${S.sheet}) holds ${S.category??`${S.type} data`}${S.how==="value"?" (found by its values)":""} \u2014 ${S.count} filled cell${S.count===1?"":"s"}. Wrap with envelope or keep a clean copy for work.`))}if($===".json"&&!v.endsWith(".nodata-proof.json"))try{let S=JSON.parse(j),x=Array.isArray(S)?S[0]:S;if(x&&typeof x=="object")for(let P of Object.keys(x)){let D=Ue(P);if(D){let U=D.type==="name"&&tu.test(P),X=U?"low":Pn[D.type]??"medium",F=`jsonkey::${w}::${P}::${D.type}`;if(b.has(F))continue;b.add(F),f(w,"pii_header_match",X,`${D.type}:${P}`,U?`JSON key "${P}" is usually the name of a system (an agent, bot or service), not a person \u2014 check if yours holds people.`:`JSON key "${P}" looks like ${D.type} data.`)}}}catch{}/\.(txt|log|md|csv|tsv|json|jsonl|xml|html?|yaml|yml|sql)$/i.test(v)&&_(j,w,b)}function _(m,v,w){let $=m.split(`
-`),T=Math.min($.length,1e3),I=-1,L=-1,j=-1;for(let b=0;b<T;b++){let S=$[b]??"";if(j<0){let x=S.match(/\b\d{9}\b/);x&&$n(x[0])&&!Rn(x[0])&&!Nt(x[0])&&(j=b+1)}if(I<0&&(Ot.lastIndex=0,Ot.test(S)&&(I=b+1)),L<0&&(jt.lastIndex=0,jt.test(S)&&(L=b+1)),j>0&&I>0&&L>0)break}j>0&&!w.has(`ilid::${v}`)&&(w.add(`ilid::${v}`),f(v,"israeli_id_value","critical",`near_line:${j}`,`Israeli ID with valid Luhn checksum detected near line ${j}. Strong signal that real customer IDs are in plaintext.`,!0)),I>0&&!w.has(`ilphone::${v}`)&&(w.add(`ilphone::${v}`),f(v,"israeli_phone_value","high",`near_line:${I}`,`Israeli phone number detected near line ${I}.`)),L>0&&!w.has(`iliban::${v}`)&&(w.add(`iliban::${v}`),f(v,"israeli_iban_value","critical",`near_line:${L}`,`Israeli IBAN (IL prefix) detected near line ${L}.`))}function y(m){if(m.length===0)return null;let v=0,w=0,$=0;for(let I of m)typeof I=="string"&&($n(I)&&v++,Ot.lastIndex=0,Ot.test(I)&&w++,jt.lastIndex=0,jt.test(I)&&$++);let T=m.length;return v/T>=.3?"id":w/T>=.3?"phone":$/T>=.3?"financial":null}function k(m,v){if(v>Yr){c.hit_depth_cap=!0;return}if(s>c.max_files){c.hit_file_cap=!0;return}let w;try{w=ms(m)}catch{return}for(let $=0;$<w.length;$++){let T=w[$];if(s>c.max_files){c.hit_file_cap=!0;let j=l(m);j&&!c.not_reached.includes(`${j} (partly)`)&&c.not_reached.length<Zr&&c.not_reached.push(`${j} (partly)`);for(let b of w.slice($)){if(c.not_reached.length>=Zr)break;try{Mn(Jr(m,b)).isDirectory()&&!_s.has(b)&&!bs.has(b.toLowerCase())&&c.not_reached.push(l(Jr(m,b)))}catch{}}return}let I=Jr(m,T),L;try{L=Mn(I)}catch{continue}if(!L.isSymbolicLink())if(L.isDirectory()){if(_s.has(T))continue;if(!e.include_tool_dirs&&(bs.has(T.toLowerCase())||eu.test(l(I)))){c.tool_dirs_skipped+=1,!c.tool_dir_names.includes(T)&&c.tool_dir_names.length<Zr&&c.tool_dir_names.push(T);continue}let j=null;try{j=ms(I).length}catch{j=null}u(I,"folder",null,L.mtime??null,j),k(I,v+1)}else L.isFile()&&(u(I,"file",L.size,L.mtime??null,null),h(I,T))}}let E,R=null;try{let m=Mn(e.target_path);E=m.isDirectory()||m.isFile(),m.isFile()&&(R={size:m.size,mtime:m.mtime??null})}catch{E=!1}if(!E)return{target_id:e.target_id,target_label:e.target_label,target_path:e.target_path,files_walked:0,files_inspected:0,duration_ms:Date.now()-t,findings:[],inventory:[],coverage:c,error:"target_path_not_found_or_not_directory"};e.log.info("folder-scanner: starting",{target_label:e.target_label,target_path:e.target_path,max_files:c.max_files,max_depth:Yr}),R?(u(e.target_path,"file",R.size,R.mtime,null),h(e.target_path,ys(e.target_path))):k(e.target_path,0);let B=new Map;for(let m of o.values())if(!(m.size<2))for(let v of m){let w=B.get(v)??new Set;for(let $ of m)$!==v&&w.add($);B.set(v,w)}for(let m of n){let v=B.get(m.relative_path);if(!v||m.finding_kind!=="pii_unencrypted"||!["israeli_id","credit_card","iban"].includes(m.finding_subkind??""))continue;let w=[...v].sort();m.remediation_hint=`${m.remediation_hint??""} The same value also appears in ${w.length} other file${w.length===1?"":"s"}: ${w.slice(0,5).join(", ")}${w.length>5?` \u2026 +${w.length-5}`:""} \u2014 likely one real person copied across files.`.trim()}for(let m of r.groups()){let v=hs(m);for(let w of m.files)f(w,"secret_reuse",m.encryption?"critical":"high",m.encryption?"shared_encryption_key":m.names.length>1?"shared_secret":"copied_secret",v)}return{target_id:e.target_id,target_label:e.target_label,target_path:e.target_path,files_walked:s,files_inspected:a,duration_ms:Date.now()-t,findings:n,inventory:i,coverage:c}}var Mt={info(){}};var dt={critical:4,high:3,medium:2,low:1,info:0},no=["critical","high","medium","low","info"];function Qr(e,t,n){let r=e.get(t)??{key:t,total:0,worst:"info",bySeverity:{}};r.total+=1,r.bySeverity[n.severity]=(r.bySeverity[n.severity]??0)+1,(dt[n.severity]??0)>(dt[r.worst]??0)&&(r.worst=n.severity),e.set(t,r)}function eo(e){return[...e.values()].sort((t,n)=>(dt[n.worst]??0)-(dt[t.worst]??0)||n.total-t.total||t.key.localeCompare(n.key))}function We(e){let t=e.findings??[],n={},r=new Map,o=new Map,i=new Map;for(let a of t){n[a.severity]=(n[a.severity]??0)+1;let c=a.finding_subkind&&!/^near_line/.test(a.finding_subkind)?a.finding_subkind:"";Qr(r,c||a.finding_kind,a);let l=a.relative_path.replace(/\\/g,"/"),u=l.includes("/")?l.slice(0,l.indexOf("/")):".";Qr(o,u,a),Qr(i,l,a)}let s=eo(i);return{total:t.length,bySeverity:n,byType:eo(r),byFolder:eo(o),byFile:s,filesWithFindings:s.map(a=>a.key)}}function ge(e){return e.replace(/[&<>"']/g,t=>({"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&#39;"})[t])}function to(e,t,n){let r=`<tr><th>${ge(n)}</th><th>total</th>${no.map(i=>`<th class="${i}">${i}</th>`).join("")}</tr>`,o=t.map(i=>`<tr><td class="k">${ge(i.key)}</td><td>${i.total}</td>${no.map(s=>`<td>${i.bySeverity[s]??""}</td>`).join("")}</tr>`).join("");return`<h2>${ge(e)} <span class="n">${t.length}</span></h2><table>${r}${o}</table>`}function ro(e,t=We(e)){let n=no.filter(a=>t.bySeverity[a]).map(a=>`<span class="pill ${a}">${t.bySeverity[a]} ${a}</span>`).join(" "),r=e.coverage,o=[];r?.hit_file_cap&&o.push(`stopped at the ${r.max_files}-file cap${r.not_reached?.length?` \u2014 not reached: ${r.not_reached.join(", ")}`:""}`),r?.tool_dirs_skipped&&o.push(`${r.tool_dirs_skipped} tool / cache folder(s) skipped (${r.tool_dir_names.join(", ")})`),r?.hit_depth_cap&&o.push(`folders deeper than ${r.max_depth} levels were not descended`),r?.files_too_large&&o.push(`${r.files_too_large} file(s) too large to read`),r?.documents_unreadable&&o.push(`${r.documents_unreadable} document(s) unreadable`);let i=[...e.findings??[]].sort((a,c)=>(dt[c.severity]??0)-(dt[a.severity]??0)),s=i.map(a=>`<tr><td><span class="pill ${a.severity}">${a.severity}</span></td><td>${ge(a.finding_subkind||a.finding_kind)}</td><td class="k">${ge(a.relative_path)}</td><td class="h">${ge(a.remediation_hint??"")}</td></tr>`).join("");return`<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+`))}a+f.length>Wr&&(f=f.slice(0,Math.max(0,Wr-a)),c=!0),f.trim().length!==0&&(i.push(f),s.push(l),a+=f.length)}return i.length===0?null:{text:i.join(`
+`),truncated:c,parts:s}}function Se(e,t){if(Xi.has(t))return Od(e,t);if(Vr.has(t)){let n=Yi(e);return n?{text:n.text,truncated:n.truncated,parts:[`pdf:${n.streams}-streams`]}:null}return null}var On=new Set([...Xi,...Vr]);import{deflateRawSync as Fd}from"node:zlib";var Zi={israeli_id:"[ID]",credit_card:"[CARD]",iban:"[IBAN]",israeli_phone:"[PHONE]",email:"[EMAIL]"},jd=/[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g,Ld=[...Ur].sort((e,t)=>+(t.subkind==="iban")-+(e.subkind==="iban"));function jn(e,t,n=1){e[t]=(e[t]??0)+n}var ut=null,Ln=e=>{let t=e.trim();ut&&t&&ut.add(t)};function Bn(e){let t=ut;ut=new Set;try{return{result:e(),replaced:ut}}finally{ut=t}}function pe(e,t={}){let n=e;for(let r of Ld)r.pattern.lastIndex=0,n=n.replace(r.pattern,o=>r.validate(o)?(jn(t,r.subkind),Ln(o),Zi[r.subkind]??`[${r.subkind.toUpperCase()}]`):o);n=n.replace(jd,r=>(jn(t,"email"),Ln(r),Zi.email));for(let r of $n()){let o=r.find(n).sort((i,s)=>s.start-i.start);for(let i of o)Ln(n.slice(i.start,i.end)),n=n.slice(0,i.start)+`[${r.kind.toUpperCase()}]`+n.slice(i.end),jn(t,r.kind)}return{text:n,counts:t,columnsHidden:[]}}function zr(){let e=new Map,t={};return(n,r)=>{Ln(r);let o=`${n}\0${r.trim()}`,i=e.get(o);return i===void 0&&(i=t[n]=(t[n]??0)+1,e.set(o,i)),`[${n.toUpperCase()}-${i}]`}}function Fn(e){let t=e.trim();return/^\[[A-Z_]+(?:-\d+)?\]$/.test(t)||/^[\d]{0,4}[*•xX]{3,}[\d]{0,4}$/.test(t)}var es=/^\s*-?\d+(?:\.\d+)?\s*$/;function qr(e){let t=new Set;for(let[n,r]of e){let o=r.filter(s=>es.test(s));if(o.length<3)continue;o.filter(s=>pe(s).text!==s).length/o.length<.5&&t.add(n)}return t}function Qi(e,t){return e.includes(t)||e.includes('"')||e.includes(`
+`)?`"${e.replace(/"/g,'""')}"`:e}function Bd(e){let t=(e.match(/\t/g)??[]).length,n=(e.match(/;/g)??[]).length,r=(e.match(/,/g)??[]).length;return t>r&&t>=n?"	":n>r?";":","}function Lt(e,t){let n=e.split(/\r?\n/),r=t??Bd(n[0]??""),o=Ve(n[0]??"",r),i=o.map(h=>Ue(h)),s={},a=zr(),c=n.slice(1).map(h=>h===""?null:Ve(h,r)),l=new Map;for(let h of c)h?.forEach((y,_)=>l.set(_,[...l.get(_)??[],y]));let d=qr(l),p=at();if(p){let h=c.filter(y=>y!==null).slice(0,200);for(let y of p({name:"table",headers:o,rows:h})){let _=o.indexOf(y.column);_>=0&&!(y.how==="header"&&d.has(_))&&(i[_]={type:y.type,label:y.category})}}let f=[o.map(h=>Qi(h,r)).join(r)];for(let h of c){if(h===null){f.push("");continue}let y=h.map((_,S)=>{let E=i[S];return E&&_.trim()!==""&&!Fn(_)?(jn(s,`column:${E.type}`),a(E.type,_)):d.has(S)&&es.test(_)?_:pe(_,s).text});f.push(y.map(_=>Qi(_,r)).join(r))}return{text:f.join(`
+`),counts:s,columnsHidden:o.filter((h,y)=>i[y])}}var Md=/^xl\/(pivotCache|charts|externalLinks)\//,rs=10;function Kd(e,t,n=1){e[t]=(e[t]??0)+n}function os(e){return e.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;")}function is(e){let t=e.replace(/<rPh\b[\s\S]*?<\/rPh>/g,""),n="";for(let r of t.matchAll(/<t(?:\s[^>]*)?>([\s\S]*?)<\/t>/g))n+=r[1];return $e(n)}function ss(e){return e?[...e.matchAll(/<si\b[^>]*>([\s\S]*?)<\/si>|<si\b[^>]*\/>/g)].map(t=>is(t[1]??"")):[]}var as=/<c\b([^>]*?)(?:\/>|>([\s\S]*?)<\/c>)/g;function Mn(e,t){let n=new RegExp(`\\b${t}="([^"]*)"`).exec(e);return n?n[1]:null}function Ge(e,t){if(e.type==="s"){let r=/<v>([^<]*)<\/v>/.exec(e.inner);return r?t[Number(r[1])]??null:null}if(e.type==="inlineStr"){let r=/<is>([\s\S]*?)<\/is>/.exec(e.inner);return r?is(r[1]):null}if(e.type==="b"||e.type==="e")return null;let n=/<v>([^<]*)<\/v>/.exec(e.inner);return n?$e(n[1]):null}function cs(e){let t=[];for(let n of e.matchAll(as)){let r=Mn(n[1],"r"),o=r?/^([A-Z]+)(\d+)$/.exec(r):null;if(!o)return null;t.push({full:n[0],attrs:n[1],inner:n[2]??"",col:o[1],row:Number(o[2]),type:Mn(n[1],"t")??"n"})}return t}function Hd(e,t){let n=[...new Set(e.map(r=>r.row))].sort((r,o)=>r-o).slice(0,rs);for(let r of n){let o=new Map;for(let i of e.filter(s=>s.row===r)){let s=Ge(i,t),a=s?Ue(s):null;a&&o.set(i.col,{type:a.type,header:s.trim()})}if(o.size>0)return{row:r,cols:o}}return{row:-1,cols:new Map}}var ls=/^xl\/worksheets\/sheet\d+\.xml$/,Ud=200;function Vd(e){let t=e.trim();return/^[\d.,\-+/:%$₪€\s]+$/.test(t)||t.length>60}function Gd(e,t){let n=[...new Set(e.map(i=>i.row))].sort((i,s)=>i-s).slice(0,rs),r=-1,o=-1/0;for(let i of n){let s=e.filter(l=>l.row===i).map(l=>(Ge(l,t)??"").trim()).filter(Boolean);if(s.length<2)continue;let a=s.filter(l=>!Vd(l)).length,c=a*2-(s.length-a);c>o&&(o=c,r=i)}return r}function ds(e,t,n){let r=Hd(t,n),o=at();if(!o)return r;let i=r.row>=0?r.row:Gd(t,n);if(i<0)return r;let s=t.filter(p=>p.row===i).map(p=>({col:p.col,text:(Ge(p,n)??"").trim()})).filter(p=>p.text),a=new Map(s.map((p,f)=>[p.col,f])),c=new Map;for(let p of t){if(p.row<=i)continue;let f=a.get(p.col);if(f!==void 0){if(!c.has(p.row)){if(c.size>=Ud)continue;c.set(p.row,s.map(()=>""))}c.get(p.row)[f]=Ge(p,n)??""}}let l=new Map(i===r.row?r.cols:[]),d=s.map(p=>p.text);for(let p of o({name:e,headers:d,rows:[...c.values()]})){let f=d.indexOf(p.column);f<0||l.set(s[f].col,{type:p.type,header:p.column,category:p.category,severity:p.severity,how:p.how})}return{row:i,cols:l}}function Jr(e){let t=lt(e);if(!t||t.length===0)return null;let n=i=>{let s=t.find(c=>c.name===i),a=s?dt(e,s):null;return a?a.toString("utf8"):null},r=ss(n("xl/sharedStrings.xml")),o=[];for(let i of t.filter(s=>ls.test(s.name))){let s=n(i.name),a=s?cs(s):null;if(!a)continue;let c=i.name.replace(/^xl\/worksheets\//,"").replace(/\.xml$/,""),l=ds(c,a,r);for(let[d,p]of l.cols){let f=a.filter(h=>{let y=h.col===d&&h.row>l.row?(Ge(h,r)??"").trim():"";return y!==""&&!Fn(y)}).length;f>0&&o.push({...p,sheet:c,count:f})}}return o}function ts(e,t){return`<c${e.replace(/\s*\bt="[^"]*"/,"")} t="inlineStr"><is><t xml:space="preserve">${os(t)}</t></is></c>`}var Wd=(()=>{let e=new Uint32Array(256);for(let t=0;t<256;t+=1){let n=t;for(let r=0;r<8;r+=1)n=n&1?3988292384^n>>>1:n>>>1;e[t]=n>>>0}return e})();function zd(e){let t=4294967295;for(let n=0;n<e.length;n+=1)t=Wd[(t^e[n])&255]^t>>>8;return(t^4294967295)>>>0}var ns=33;function us(e){let t=[],n=[],r=0;for(let s of e){let a=Buffer.from(s.name,"utf8"),c=s.name.endsWith("/"),l=c?Buffer.alloc(0):Fd(s.data),d=c?0:8,p=c?0:zd(s.data),f=Buffer.alloc(30);f.writeUInt32LE(67324752,0),f.writeUInt16LE(20,4),f.writeUInt16LE(2048,6),f.writeUInt16LE(d,8),f.writeUInt16LE(ns,12),f.writeUInt32LE(p,14),f.writeUInt32LE(l.length,18),f.writeUInt32LE(s.data.length,22),f.writeUInt16LE(a.length,26),t.push(f,a,l);let h=Buffer.alloc(46);h.writeUInt32LE(33639248,0),h.writeUInt16LE(20,4),h.writeUInt16LE(20,6),h.writeUInt16LE(2048,8),h.writeUInt16LE(d,10),h.writeUInt16LE(ns,14),h.writeUInt32LE(p,16),h.writeUInt32LE(l.length,20),h.writeUInt32LE(s.data.length,24),h.writeUInt16LE(a.length,28),h.writeUInt32LE(r,42),n.push(h,a),r+=f.length+a.length+l.length}let o=Buffer.concat(n),i=Buffer.alloc(22);return i.writeUInt32LE(101010256,0),i.writeUInt16LE(e.length,8),i.writeUInt16LE(e.length,10),i.writeUInt32LE(o.length,12),i.writeUInt32LE(r,16),Buffer.concat([...t,o,i])}function Bt(e){let t=lt(e);if(!t||t.length===0||t.some(_=>Md.test(_.name)))return null;let n=new Map;for(let _ of t){if(_.name.endsWith("/")){n.set(_.name,Buffer.alloc(0));continue}let S=dt(e,_);if(!S)return null;n.set(_.name,S)}let r=[...n.keys()].filter(_=>ls.test(_));if(r.length===0)return null;let o=n.get("xl/sharedStrings.xml")?.toString("utf8")??null,i=ss(o),s=new Set,a={},c=new Set,l=zr();for(let _ of r){let S=n.get(_).toString("utf8"),E=cs(S);if(!E)return null;let P=ds(_.replace(/^xl\/worksheets\//,"").replace(/\.xml$/,""),E,i),N=P.row,m=new Map;for(let T of E){if(T.type!=="n"||T.row<=N)continue;let I=Ge(T,i);I!==null&&m.set(T.col,[...m.get(T.col)??[],I])}let v=qr(m),k=new Map;for(let[T,{type:I,header:B,how:L}]of P.cols)L==="header"&&v.has(T)||(k.set(T,I),c.add(B));let R=S.replace(as,(T,I,B)=>{let L=Mn(I,"r"),[,b,w]=/^([A-Z]+)(\d+)$/.exec(L),x={full:T,attrs:I,inner:B??"",col:b,row:Number(w),type:Mn(I,"t")??"n"},$=Ge(x,i),D=()=>{if(x.type==="s"){let F=/<v>([^<]*)<\/v>/.exec(x.inner);F&&s.add(Number(F[1]))}return T};if($===null||$.trim()==="")return D();let U=k.get(b);if(U&&x.row>N&&!Fn($))return Kd(a,`column:${U}`),ts(I,l(U,$));if(x.type==="n"&&v.has(b))return D();let X=pe($,a);return X.text===$?D():ts(I,X.text)});n.set(_,Buffer.from(R,"utf8"))}if(o){let _=-1,S=o.replace(/<si\b[^>]*>[\s\S]*?<\/si>|<si\b[^>]*\/>/g,E=>(_+=1,s.has(_)?E:"<si><t></t></si>"));n.set("xl/sharedStrings.xml",Buffer.from(S,"utf8"))}for(let _ of[...n.keys()].filter(S=>/^xl\/comments\d*\.xml$/.test(S))){let E=n.get(_).toString("utf8").replace(/(<t(?:\s[^>]*)?>)([\s\S]*?)(<\/t>)/g,(P,N,m,v)=>{let k=pe($e(m),a);return`${N}${os(k.text)}${v}`});n.set(_,Buffer.from(E,"utf8"))}let d=n.get("docProps/core.xml");if(d){let _=d.toString("utf8").replace(/(<dc:creator>)[\s\S]*?(<\/dc:creator>)/,"$1$2").replace(/(<cp:lastModifiedBy>)[\s\S]*?(<\/cp:lastModifiedBy>)/,"$1$2");n.set("docProps/core.xml",Buffer.from(_,"utf8"))}let p=n.get("xl/workbook.xml");if(p){let _=p.toString("utf8").replace(/<(\w+:)?absPath\b[^>]*\/>|<(\w+:)?absPath\b[^>]*>[\s\S]*?<\/(\w+:)?absPath>/g,"");n.set("xl/workbook.xml",Buffer.from(_,"utf8"))}let f=n.get("docProps/app.xml");if(f){let _=f.toString("utf8").replace(/(<Company>)[\s\S]*?(<\/Company>)/,"$1$2").replace(/(<Manager>)[\s\S]*?(<\/Manager>)/,"$1$2");n.set("docProps/app.xml",Buffer.from(_,"utf8"))}let h=n.has("xl/calcChain.xml"),y=t.map(_=>_.name).filter(_=>!(h&&_==="xl/calcChain.xml"));if(h)for(let _ of["[Content_Types].xml","xl/_rels/workbook.xml.rels"]){let S=n.get(_);S&&n.set(_,Buffer.from(S.toString("utf8").replace(/<(Override|Relationship)\b[^>]*calcChain[^>]*\/>/g,""),"utf8"))}return{bytes:us(y.map(_=>({name:_,data:n.get(_)}))),counts:a,columnsHidden:[...c]}}import{createHash as qd}from"node:crypto";var Pe=/(^|\/)(\.env(\.[\w.-]+)?|[\w.-]+\.env(\.[\w.-]+)?)$/i,fs=/(SECRET|PASSWORD|PASSWD|PASS|PWD|TOKEN|PRIVATE|CREDENTIAL|API_?KEY|_KEY|KEY_ID|DSN|DATABASE_URL|_URI|POOLER_URL|SALT|PEPPER)$/i,hs=/(^NEXT_PUBLIC_|^VITE_|^EXPO_PUBLIC_|ANON_KEY$|PUBLISHABLE_KEY$|PUBLIC_KEY$)/i,ps=/(ENCRYPT|CIPHER|PII|DATA_?KEY|KMS|MASTER_?KEY|BLIND_?INDEX|VAULT_?KEY)/i,Jd=12;function Yr(e){let t=0;for(let n of e.split(/\r?\n/)){let r=/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/.exec(n);if(!r||!fs.test(r[1])||hs.test(r[1]))continue;let o=r[2].trim().replace(/^(['"])(.*)\1$/,"$2");o.length>=8&&!/^\$\{?[A-Z_]+\}?$/.test(o)&&t++}return t}var Kn=class{byHash=new Map;add(t,n){for(let r of n.split(/\r?\n/)){let o=/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/.exec(r);if(!o)continue;let i=o[1];if(!fs.test(i)||hs.test(i))continue;let s=o[2].trim();if(s.startsWith('"')&&s.endsWith('"')||s.startsWith("'")&&s.endsWith("'")?s=s.slice(1,-1):s=s.replace(/\s+#.*$/,""),s.length<Jd||/^\$\{?[A-Z_]+\}?$/.test(s))continue;let a=/^[a-z][a-z0-9+.-]*:\/\/[^:/@\s]+:([^@\s]+)@/i.exec(s);if(/^[a-z][a-z0-9+.-]*:\/\//i.test(s)&&!a)continue;let c=a?Yd(a[1]):s;if(c.length<8)continue;let l=qd("sha256").update(c).digest("hex"),d=this.byHash.get(l)??[];d.some(p=>p.file===t&&p.name===i)||d.push({file:t,name:i}),this.byHash.set(l,d)}}groups(){let t=[];for(let n of this.byHash.values()){let r=[...new Set(n.map(s=>s.name))].sort(),o=[...new Set(n.map(s=>s.file))].sort();if(r.length<2&&o.length<2)continue;let i=r.some(s=>ps.test(s));t.push({names:r,files:o,encryption:i&&r.some(s=>!ps.test(s))})}return t}};function Yd(e){try{return decodeURIComponent(e)}catch{return e}}function ms(e){let t=[];e.names.length>1&&t.push(`one secret is used as ${e.names.length} variables (${e.names.join(", ")})`),e.files.length>1&&t.push(`${e.names.length===1?e.names[0]:"the same secret"} is copied in ${e.files.length} files (${e.files.join(", ")})`);let n=`Shared secret: ${t.join("; and ")}.`;return e.encryption?n+=" \u26A0 It is ALSO a data-encryption key: do NOT rotate it like a normal key \u2014 everything already encrypted with it would stop decrypting. First give the other uses their own new secret, then change the encryption key only in a planned re-encryption.":e.names.length>1?n+=" Replacing it breaks every use at once \u2014 give each use its own secret first, then retire the shared one.":n+=" Every copy has to be removed or updated when the key is replaced; keep one source (the vault) instead.",n}var Zr=10,Zd=5e3,Qd=5e4,eu=64*1024*1024,Qr=32*1024,tu=new Set([".exe",".dll",".so",".dylib",".msi",".bin",".iso",".zip",".tar",".gz",".7z",".rar",".png",".jpg",".jpeg",".gif",".bmp",".tif",".tiff",".webp",".ico",".mp3",".mp4",".mov",".avi",".mkv",".wav",".flac",".ogg",".psd",".ai",".fla",".dwg",".dxf",".sqlite",".sqlite3",".db",".pyc",".class"]),bs=new Set(["node_modules",".git",".hg",".svn"]),vs=new Set([".cache",".cargo",".rustup",".npm",".pnpm-store",".yarn",".gradle",".m2",".nuget",".conda",".pyenv",".rbenv",".nvm",".volta",".bun",".deno",".docker",".android",".vscode-server",".agents",".agent",".codeium",".continue","antigravity",".antigravity","__pycache__",".venv","venv","site-packages",".next",".turbo",".expo",".nx",".parcel-cache",".svelte-kit","appdata",".trash","$recycle.bin"].map(e=>e.toLowerCase())),nu=/(^|\/)\.(vscode|cursor|windsurf|antigravity|vscode-server)\/extensions$/i,eo=40,ru=/^(agent|bot|model|service|tool|app|job|task|queue|test|qa|suite|runner|worker|host|server|project|repo|package|file|table|column|field)[_-]?name$/i,ou={critical:"high",high:"medium",medium:"low",low:"info",info:"info"},iu=[{re:/\b\d{3}-\d{2}-\d{4}\b/,kind:"pii_unencrypted",subkind:"ssn",severity:"high",hint:"US Social Security Number pattern in plaintext."},{re:/\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/i,kind:"pii_unencrypted",subkind:"email",severity:"low",hint:"Email addresses in plaintext."},{re:/(passport|teudat.?zehut|(?<![א-ת])תעודת.?זהות(?![א-ת])|(?<![א-ת])ת["'׳״]?\.?ז(?![א-ת]))/i,kind:"pii_unencrypted",subkind:"passport_keyword",severity:"low",hint:"Mentions the word passport / national ID \u2014 a word, not a number. The numbers themselves are reported by the ID rules."}],su=[{re:/(salary|payroll|משכורת|ssn|social.?security|passport|דרכון|תעודת.?זהות)/i,kind:"pii_unencrypted",subkind:"sensitive_filename",severity:"medium",hint:"Filename suggests sensitive PII content."},{re:/\.(env|env\.local|pem|key|p12|pfx)$/i,kind:"pii_unencrypted",subkind:"secret_file",severity:"high",hint:"File extension implies secret / credential bundle in plaintext."}];function au(e){let t=e.lastIndexOf(".");return t<0?"":e.slice(t).toLowerCase()}async function Ft(e){let t=Date.now(),n=[],r=new Kn,o=new Map,i=[],s=0,a=0,c={hit_file_cap:!1,hit_depth_cap:!1,max_files:Math.min(Math.max(1,e.max_files??Zd),Qd),max_depth:Zr,tool_dirs_skipped:0,tool_dir_names:[],not_reached:[],skipped_by_extension:0,documents_extracted:0,documents_truncated:0,documents_unreadable:0,files_too_large:0,files_sampled_only:0,sample_bytes:Qr};function l(m){return(m.startsWith(e.target_path)?m.slice(e.target_path.length).replace(/^[\\/]+/,"")||_s(m):m).replace(/\\/g,"/")}function d(m,v,k,R,T){let I=l(m);I!==""&&i.push({target_id:e.target_id,path:I,kind:v,size_bytes:k,modified_at:R?R.toISOString():null,child_count:T})}function p(m,v){n.push({target_id:e.target_id,relative_path:m,finding_kind:v.kind,finding_subkind:v.subkind,severity:v.severity,remediation_hint:v.hint})}function f(m,v,k,R,T,I=!1){I&&Hr.test(m)?T=`${T??""} (In a test / sample file, but not a published test number \u2014 this looks real.)`.trim():v!=="hardcoded_secret"&&Hr.test(m)&&(k=ou[k],T=`${T??""} (Test / sample / minified file \u2014 probably sample data; check before acting.)`.trim()),n.push({target_id:e.target_id,relative_path:m,finding_kind:v,finding_subkind:R,severity:k,remediation_hint:T})}function h(m,v){if(s+=1,s>c.max_files){c.hit_file_cap=!0;return}let k=l(m);for(let w of su)w.re.test(v)&&p(k,w);let R=au(v);if(tu.has(R)){c.skipped_by_extension+=1;return}let T=On.has(R),I=0;try{I=Hn(m).size}catch{return}if(T&&I>eu){c.files_too_large+=1;return}let B;try{let w=ys(m,{flag:"r"});B=T?w:w.subarray(0,Qr)}catch{return}a+=1;let L;if(T){let w=Se(B,R);if(!w){c.documents_unreadable+=1,(c.unreadable_files??=[]).length<500&&c.unreadable_files.push(k);return}L=w.text,c.documents_extracted+=1,w.truncated&&(c.documents_truncated+=1)}else{let w=0;for(let x=0;x<B.length;x+=1)B[x]===0&&(w+=1);if(B.length>0&&w/B.length>.05)return;L=B.toString("utf8"),I>Qr&&(c.files_sampled_only+=1)}let b=new Set;Pe.test(k)&&r.add(k,L);for(let w of iu)if(w.re.test(L)){let x=`${w.subkind}::${k}`;b.has(x)||(b.add(x),p(k,w))}for(let w of Nn(L,(x,$)=>{if(x!=="israeli_id"&&x!=="credit_card"&&x!=="iban")return;let D=Xd("sha256").update(`${x}:${$}`).digest("hex"),U=o.get(D)??new Set;U.add(k),o.set(D,U)})){let x=`validated::${w.subkind}::${k}`;b.has(x)||(b.add(x),f(k,"pii_unencrypted",w.severity,w.subkind,`${w.hint} ${w.count} distinct value${w.count===1?"":"s"} in this file.`,(w.real??0)>0))}if(!Ki.test(k)){let w=ct(),x=L.split(`
+`),$=Math.min(x.length,2e3);for(let D=0;D<$;D++){let U=x[D];if(!U)continue;let X=U.trimStart();if(!(X.startsWith("//")||X.startsWith("/*")||X.startsWith("*")||X.startsWith("#"))&&!/process\.env/.test(U)&&!/\$\{[A-Z_]+/.test(U)){for(let F of w)if(F.pattern.test(U)){let de=`secret::${F.id}::${k}::${D+1}`;if(b.has(de))break;b.add(de);let jr=Hi.test(k);f(k,"hardcoded_secret",jr?"critical":F.severity,F.id,jr?`A real-looking ${F.name} in an EXAMPLE file near line ${D+1}. Example files are committed to Git and shared on purpose \u2014 rotate this key at its source and put a placeholder in the example.`:`Looks like a ${F.name} hardcoded near line ${D+1}. Move to an env var or secret manager.`);break}}}}if(v==="package.json"&&!k.includes("node_modules"))try{let w=ys(m,"utf8"),x=Ui(w);for(let $ of x){let D=`vuln::${$.name}::${k}`;b.has(D)||(b.add(D),f(k,"vulnerable_dependency",$.vuln.severity,$.name,`${$.name}@${$.version} is below ${$.vuln.below} (${$.vuln.cve} \xB7 ${$.vuln.desc}). Bump to ${$.vuln.below} or higher.`))}}catch{}if(R===".csv"||R===".tsv"){let w=R===".tsv"?"	":",",x=L.split(/\r?\n/);if(x.length>0){let $=Ve(x[0]??"",w),D=x.slice(1,51).map(X=>Ve(X??"",w)),U=at();if(U){let X=x.slice(1,201).filter(F=>F!=="").map(F=>Ve(F,w));for(let F of U({name:"table",headers:$,rows:X})){let de=`header::${k}::${F.column}::${F.type}`;b.has(de)||(b.add(de),f(k,"pii_header_match",F.severity,`${F.type}:${F.column}`,`Column "${F.column}" holds ${F.category} (${F.how==="value"?`${F.hits} sampled values matched`:"by its header"}). Wrap with envelope or keep a clean copy for work.`))}}U||$.forEach((X,F)=>{let de=(X??"").trim();if(!de)return;let He=Ue(de)?.type??null;if(!He){let Dt=[];for(let ed of D){let Lr=ed[F];if(Lr&&Lr.trim().length>0&&Dt.push(Lr),Dt.length>=50)break}let Ct=_(Dt);Ct&&(He=Ct)}if(He){let Dt=Rn[He]??"medium",Ct=`header::${k}::${de}::${He}`;if(b.has(Ct))return;b.add(Ct),f(k,"pii_header_match",Dt,`${He}:${de}`,`Column "${de}" looks like ${He} data. Wrap with envelope or move to a vault-backed reference.`)}})}}if(R===".xlsx"||R===".xlsm")for(let w of Jr(B)??[]){let x=`xlsxheader::${k}::${w.sheet}::${w.header}::${w.type}`;b.has(x)||(b.add(x),f(k,"pii_header_match",w.severity??Rn[w.type]??"medium",`${w.type}:${w.header}`,`Column "${w.header}" (${w.sheet}) holds ${w.category??`${w.type} data`}${w.how==="value"?" (found by its values)":""} \u2014 ${w.count} filled cell${w.count===1?"":"s"}. Wrap with envelope or keep a clean copy for work.`))}if(R===".json"&&!v.endsWith(".nodata-proof.json"))try{let w=JSON.parse(L),x=Array.isArray(w)?w[0]:w;if(x&&typeof x=="object")for(let $ of Object.keys(x)){let D=Ue($);if(D){let U=D.type==="name"&&ru.test($),X=U?"low":Rn[D.type]??"medium",F=`jsonkey::${k}::${$}::${D.type}`;if(b.has(F))continue;b.add(F),f(k,"pii_header_match",X,`${D.type}:${$}`,U?`JSON key "${$}" is usually the name of a system (an agent, bot or service), not a person \u2014 check if yours holds people.`:`JSON key "${$}" looks like ${D.type} data.`)}}}catch{}/\.(txt|log|md|csv|tsv|json|jsonl|xml|html?|yaml|yml|sql)$/i.test(v)&&y(L,k,b)}function y(m,v,k){let R=m.split(`
+`),T=Math.min(R.length,1e3),I=-1,B=-1,L=-1;for(let b=0;b<T;b++){let w=R[b]??"";if(L<0){let x=w.match(/\b\d{9}\b/);x&&Dn(x[0])&&!Cn(x[0])&&!Nt(x[0])&&(L=b+1)}if(I<0&&(Ot.lastIndex=0,Ot.test(w)&&(I=b+1)),B<0&&(jt.lastIndex=0,jt.test(w)&&(B=b+1)),L>0&&I>0&&B>0)break}L>0&&!k.has(`ilid::${v}`)&&(k.add(`ilid::${v}`),f(v,"israeli_id_value","critical",`near_line:${L}`,`Israeli ID with valid Luhn checksum detected near line ${L}. Strong signal that real customer IDs are in plaintext.`,!0)),I>0&&!k.has(`ilphone::${v}`)&&(k.add(`ilphone::${v}`),f(v,"israeli_phone_value","high",`near_line:${I}`,`Israeli phone number detected near line ${I}.`)),B>0&&!k.has(`iliban::${v}`)&&(k.add(`iliban::${v}`),f(v,"israeli_iban_value","critical",`near_line:${B}`,`Israeli IBAN (IL prefix) detected near line ${B}.`))}function _(m){if(m.length===0)return null;let v=0,k=0,R=0;for(let I of m)typeof I=="string"&&(Dn(I)&&v++,Ot.lastIndex=0,Ot.test(I)&&k++,jt.lastIndex=0,jt.test(I)&&R++);let T=m.length;return v/T>=.3?"id":k/T>=.3?"phone":R/T>=.3?"financial":null}function S(m,v){if(v>Zr){c.hit_depth_cap=!0;return}if(s>c.max_files){c.hit_file_cap=!0;return}let k;try{k=gs(m)}catch{return}for(let R=0;R<k.length;R++){let T=k[R];if(s>c.max_files){c.hit_file_cap=!0;let L=l(m);L&&!c.not_reached.includes(`${L} (partly)`)&&c.not_reached.length<eo&&c.not_reached.push(`${L} (partly)`);for(let b of k.slice(R)){if(c.not_reached.length>=eo)break;try{Hn(Xr(m,b)).isDirectory()&&!bs.has(b)&&!vs.has(b.toLowerCase())&&c.not_reached.push(l(Xr(m,b)))}catch{}}return}let I=Xr(m,T),B;try{B=Hn(I)}catch{continue}if(!B.isSymbolicLink())if(B.isDirectory()){if(bs.has(T))continue;if(!e.include_tool_dirs&&(vs.has(T.toLowerCase())||nu.test(l(I)))){c.tool_dirs_skipped+=1,!c.tool_dir_names.includes(T)&&c.tool_dir_names.length<eo&&c.tool_dir_names.push(T);continue}let L=null;try{L=gs(I).length}catch{L=null}d(I,"folder",null,B.mtime??null,L),S(I,v+1)}else B.isFile()&&(d(I,"file",B.size,B.mtime??null,null),h(I,T))}}let E,P=null;try{let m=Hn(e.target_path);E=m.isDirectory()||m.isFile(),m.isFile()&&(P={size:m.size,mtime:m.mtime??null})}catch{E=!1}if(!E)return{target_id:e.target_id,target_label:e.target_label,target_path:e.target_path,files_walked:0,files_inspected:0,duration_ms:Date.now()-t,findings:[],inventory:[],coverage:c,error:"target_path_not_found_or_not_directory"};e.log.info("folder-scanner: starting",{target_label:e.target_label,target_path:e.target_path,max_files:c.max_files,max_depth:Zr}),P?(d(e.target_path,"file",P.size,P.mtime,null),h(e.target_path,_s(e.target_path))):S(e.target_path,0);let N=new Map;for(let m of o.values())if(!(m.size<2))for(let v of m){let k=N.get(v)??new Set;for(let R of m)R!==v&&k.add(R);N.set(v,k)}for(let m of n){let v=N.get(m.relative_path);if(!v||m.finding_kind!=="pii_unencrypted"||!["israeli_id","credit_card","iban"].includes(m.finding_subkind??""))continue;let k=[...v].sort();m.remediation_hint=`${m.remediation_hint??""} The same value also appears in ${k.length} other file${k.length===1?"":"s"}: ${k.slice(0,5).join(", ")}${k.length>5?` \u2026 +${k.length-5}`:""} \u2014 likely one real person copied across files.`.trim()}for(let m of r.groups()){let v=ms(m);for(let k of m.files)f(k,"secret_reuse",m.encryption?"critical":"high",m.encryption?"shared_encryption_key":m.names.length>1?"shared_secret":"copied_secret",v)}return{target_id:e.target_id,target_label:e.target_label,target_path:e.target_path,files_walked:s,files_inspected:a,duration_ms:Date.now()-t,findings:n,inventory:i,coverage:c}}var Mt={info(){}};var pt={critical:4,high:3,medium:2,low:1,info:0},oo=["critical","high","medium","low","info"];function to(e,t,n){let r=e.get(t)??{key:t,total:0,worst:"info",bySeverity:{}};r.total+=1,r.bySeverity[n.severity]=(r.bySeverity[n.severity]??0)+1,(pt[n.severity]??0)>(pt[r.worst]??0)&&(r.worst=n.severity),e.set(t,r)}function no(e){return[...e.values()].sort((t,n)=>(pt[n.worst]??0)-(pt[t.worst]??0)||n.total-t.total||t.key.localeCompare(n.key))}function We(e){let t=e.findings??[],n={},r=new Map,o=new Map,i=new Map;for(let a of t){n[a.severity]=(n[a.severity]??0)+1;let c=a.finding_subkind&&!/^near_line/.test(a.finding_subkind)?a.finding_subkind:"";to(r,c||a.finding_kind,a);let l=a.relative_path.replace(/\\/g,"/"),d=l.includes("/")?l.slice(0,l.indexOf("/")):".";to(o,d,a),to(i,l,a)}let s=no(i);return{total:t.length,bySeverity:n,byType:no(r),byFolder:no(o),byFile:s,filesWithFindings:s.map(a=>a.key)}}function ge(e){return e.replace(/[&<>"']/g,t=>({"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&#39;"})[t])}function ro(e,t,n){let r=`<tr><th>${ge(n)}</th><th>total</th>${oo.map(i=>`<th class="${i}">${i}</th>`).join("")}</tr>`,o=t.map(i=>`<tr><td class="k">${ge(i.key)}</td><td>${i.total}</td>${oo.map(s=>`<td>${i.bySeverity[s]??""}</td>`).join("")}</tr>`).join("");return`<h2>${ge(e)} <span class="n">${t.length}</span></h2><table>${r}${o}</table>`}function io(e,t=We(e)){let n=oo.filter(a=>t.bySeverity[a]).map(a=>`<span class="pill ${a}">${t.bySeverity[a]} ${a}</span>`).join(" "),r=e.coverage,o=[];r?.hit_file_cap&&o.push(`stopped at the ${r.max_files}-file cap${r.not_reached?.length?` \u2014 not reached: ${r.not_reached.join(", ")}`:""}`),r?.tool_dirs_skipped&&o.push(`${r.tool_dirs_skipped} tool / cache folder(s) skipped (${r.tool_dir_names.join(", ")})`),r?.hit_depth_cap&&o.push(`folders deeper than ${r.max_depth} levels were not descended`),r?.files_too_large&&o.push(`${r.files_too_large} file(s) too large to read`),r?.documents_unreadable&&o.push(`${r.documents_unreadable} document(s) unreadable`);let i=[...e.findings??[]].sort((a,c)=>(pt[c.severity]??0)-(pt[a.severity]??0)),s=i.map(a=>`<tr><td><span class="pill ${a.severity}">${a.severity}</span></td><td>${ge(a.finding_subkind||a.finding_kind)}</td><td class="k">${ge(a.relative_path)}</td><td class="h">${ge(a.remediation_hint??"")}</td></tr>`).join("");return`<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
 <title>NoData scan \xB7 ${ge(e.target_label||e.target_path)}</title>
 <style>
 body{margin:0;background:#FAF7F0;color:#1a1a1a;font:14px/1.5 Inter,Heebo,system-ui,sans-serif}
@@ -44,111 +45,111 @@ td.k{font-family:ui-monospace,Menlo,monospace;font-size:12.5px;word-break:break-
 <p class="sub">${ge(e.target_path)} \xB7 ${e.files_walked} files walked, ${e.files_inspected} inspected in ${e.duration_ms} ms \xB7 ran on this machine, nothing uploaded</p>
 <p><strong>${t.total}</strong> findings ${n}</p>
 ${o.length?`<p class="note">Coverage: ${ge(o.join("; "))}.</p>`:""}
-${to("By type",t.byType,"type")}
-${to("By folder",t.byFolder,"folder")}
-${to("By file",t.byFile,"file")}
+${ro("By type",t.byType,"type")}
+${ro("By folder",t.byFolder,"folder")}
+${ro("By file",t.byFile,"file")}
 <h2>Every finding <span class="n">${i.length}</span></h2>
 <table><tr><th>severity</th><th>type</th><th>file</th><th>what to do</th></tr>${s}</table>
 <p class="note">Content-free: this report lists where and what kind \u2014 never a matched value.</p>
-</main></body></html>`}import{createHash as su}from"node:crypto";var au=4,vs=e=>su("sha256").update(e).digest("hex");function cu(e){return e.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&apos;")}function oo(e,t,n,r){let o=t.length>4&&t.readUInt32LE(0)===67324752?at(t):null,i=o?o.filter(p=>!p.name.endsWith("/")).map(p=>{let f=ct(t,p)?.toString("utf8")??"";return f+`
-`+Pe(f)}):[t.toString("utf8")],s=[...r],a=s.filter(p=>p.length>=au),c=0;for(let p of a){let f=new Set([p,cu(p)]);i.some(h=>[...f].some(_=>h.includes(_)))&&c++}let l=o?Se(t,n)?.text??i.join(`
-`):i[0],u=Dn(l).reduce((p,f)=>p+f.count,0);return{method:"every replaced value searched, as written and XML-escaped, in every part of the clean file; clean text re-scanned with the validated detectors; both files fingerprinted",original_sha256:vs(e),clean_sha256:vs(t),values_checked:a.length,values_too_short_to_check:s.length-a.length,parts_searched:i.length,values_found:c,rescan_hits:u,ok:c===0}}var lu=["Put the new key where the app reads it (for a developer machine: the NoData vault + nodata_run, not a .env file).","Check that the app still works with the new key.","Only then delete / revoke the OLD key \u2014 until you do, whoever copied it can still use it."],K=(e,t,n)=>({provider:e,url:t,steps:[...n,...lu]}),du={"aws-access-key":K("AWS","https://console.aws.amazon.com/iam/home#/security_credentials",["Open IAM \u2192 your user \u2192 Security credentials.","Create a NEW access key (you see its secret once \u2014 keep it only in the vault)."]),"aws-secret-key":K("AWS","https://console.aws.amazon.com/iam/home#/security_credentials",["Open IAM \u2192 your user \u2192 Security credentials.","Create a NEW access key (you see its secret once \u2014 keep it only in the vault).","Mark the old key Inactive before deleting it."]),"gcp-api-key":K("Google Cloud","https://console.cloud.google.com/apis/credentials",["Open APIs & Services \u2192 Credentials.","Pick the key \u2192 Regenerate key (or create a new one and restrict it to the APIs you use)."]),"gcp-service-account":K("Google Cloud (service account)","https://console.cloud.google.com/iam-admin/serviceaccounts",["Open IAM & Admin \u2192 Service accounts \u2192 the account \u2192 Keys.","Add key \u2192 Create new key (JSON). Keep the file out of Git and out of shared folders."]),"firebase-key":K("Firebase / Google Cloud","https://console.cloud.google.com/apis/credentials",["A Firebase web key is meant to be public \u2014 restrict it instead: Credentials \u2192 the key \u2192 Application restrictions (your domains only).","If it is not a web key, regenerate it."]),"github-token":K("GitHub","https://github.com/settings/tokens",["Open Settings \u2192 Developer settings \u2192 Personal access tokens.","Generate a new token with only the scopes you need."]),"github-fine-grained":K("GitHub","https://github.com/settings/tokens?type=beta",["Open Fine-grained tokens.","Regenerate the token (or create a new one for only the repositories you need)."]),"gitlab-token":K("GitLab","https://gitlab.com/-/user_settings/personal_access_tokens",["Open Access tokens.","Create a new token with only the scopes you need."]),"stripe-secret":K("Stripe","https://dashboard.stripe.com/apikeys",["Open Developers \u2192 API keys.","Roll the secret key (Stripe can keep the old one alive for a short overlap)."]),"stripe-restricted":K("Stripe","https://dashboard.stripe.com/apikeys",["Open Developers \u2192 API keys \u2192 Restricted keys.","Roll the key, or create a new restricted key."]),"slack-token":K("Slack","https://api.slack.com/apps",["Open your app \u2192 OAuth & Permissions.","Rotate / reinstall to get a new token."]),"slack-webhook":K("Slack","https://api.slack.com/apps",["Open your app \u2192 Incoming Webhooks.","Add a new webhook URL for the channel."]),"twilio-api-key":K("Twilio","https://console.twilio.com/us1/account/keys-credentials/api-keys",["Open Account \u2192 API keys & tokens.","Create a new API key."]),"sendgrid-api-key":K("SendGrid","https://app.sendgrid.com/settings/api_keys",["Open Settings \u2192 API Keys.","Create a new key with only the permissions you need."]),"openai-key":K("OpenAI","https://platform.openai.com/api-keys",["Open API keys.","Create a new secret key."]),"openai-project-key":K("OpenAI","https://platform.openai.com/api-keys",["Open API keys (per project).","Create a new secret key for the same project."]),"anthropic-key":K("Anthropic","https://console.anthropic.com/settings/keys",["Open Settings \u2192 API keys.","Create a new key."]),"supabase-key":K("Supabase","https://supabase.com/dashboard/project/_/settings/api-keys",["Open the project \u2192 Project Settings \u2192 API Keys.","Create a new SECRET key (a service_role / secret key bypasses every database rule \u2014 treat it like a root password).","Older projects with JWT keys: rotating the JWT secret replaces every key and signs everyone out \u2014 plan it."]),"postgres-uri":K("PostgreSQL (the password in the connection string)","https://supabase.com/dashboard/project/_/settings/database",["Change the database user's password: in Supabase \u2192 Project Settings \u2192 Database \u2192 Reset password; elsewhere, your host's console or ALTER USER \u2026 WITH PASSWORD.","Update the connection string with the new password."]),"mongodb-uri":K("MongoDB","https://cloud.mongodb.com/",["Open Atlas \u2192 Database Access \u2192 the user \u2192 Edit \u2192 Edit password.","Update the connection string."]),"redis-uri":K("Redis","",["Reset the password in your Redis host's console (or CONFIG SET requirepass on your own server).","Update the connection string."]),"private-key":K("Private key (SSH / TLS / signing)","",["Generate a new key pair.","Register the new PUBLIC key where the old one was trusted (server authorized_keys, certificate, service settings)."]),"jwt-secret":K("Your app's JWT secret","",["Set a new long random secret in the app's configuration.","Every signed-in user will be signed out \u2014 plan the moment."]),"password-in-code":K("A password in code","",["Change the password in the system it belongs to."]),"bearer-token":K("An access token","",["Revoke the token in the service that issued it and issue a new one."])},uu=K("A credential","",["Find the service it belongs to and issue a new credential there."]);function ks(e){return du[e]??uu}function io(e){let t=new Map;for(let n of e){if(n.finding_kind!=="hardcoded_secret"||!n.finding_subkind)continue;let r=ks(n.finding_subkind),o=t.get(r.provider)??{...r,ruleIds:[],files:[],count:0};o.count+=1,o.ruleIds.includes(n.finding_subkind)||o.ruleIds.push(n.finding_subkind),o.files.includes(n.relative_path)||o.files.push(n.relative_path),t.set(r.provider,o)}return[...t.values()].sort((n,r)=>r.count-n.count)}var he=Lr(fo(),1);import{homedir as Ip}from"node:os";import{basename as yt,dirname as qe,extname as Pp,join as Je,resolve as Jn}from"node:path";import{existsSync as zt,mkdirSync as ka,readFileSync as Io,rmSync as wa,statSync as qt,writeFileSync as Yn}from"node:fs";import{pathToFileURL as Jt}from"node:url";function xe(e){return/\.ndc$/i.test(e)||/\.clean\.[A-Za-z0-9]+$/.test(e)}import{z as ht}from"zod";var mt=Lr(fo(),1);import{execFileSync as np}from"node:child_process";import{mkdirSync as rp,writeFileSync as op}from"node:fs";import{homedir as ip}from"node:os";import{existsSync as oa,rmSync as sp,statSync as ap}from"node:fs";import{basename as cp,dirname as lp,join as ko,relative as _o,resolve as dp}from"node:path";import{pathToFileURL as ia}from"node:url";import{z as Us}from"zod";import{createHash as Gs}from"node:crypto";import{appendFileSync as Vu,existsSync as Ws,mkdirSync as zs,readFileSync as qs,writeFileSync as Gu}from"node:fs";import{homedir as Wu}from"node:os";import{join as Wn}from"node:path";import{existsSync as js,mkdirSync as Ku,readFileSync as Ls,writeFileSync as Hu}from"node:fs";import{homedir as Bs}from"node:os";import{join as Fs}from"node:path";var Ut=()=>Fs(Bs(),".nodata","prefs.json");function Ms(){try{let e=js(Ut())?JSON.parse(Ls(Ut(),"utf8")).lang:null;return e==="he"||e==="en"?e:null}catch{return null}}function Uu(){let t=process.env.LC_ALL||process.env.LC_MESSAGES||process.env.LANG||"";try{t||=Intl.DateTimeFormat().resolvedOptions().locale}catch{}return/^(he|iw)(?:[-_.@]|$)/i.test(t)?"he":"en"}function De(){return Ms()??Uu()}function ut(){return Ms()!==null}function ho(e){Ku(Fs(Bs(),".nodata"),{recursive:!0});let t={};try{js(Ut())&&(t=JSON.parse(Ls(Ut(),"utf8")))}catch{}Hu(Ut(),JSON.stringify({...t,lang:e},null,2)+`
-`)}function Vn(e,t,n=De()){return n==="he"?e:t}function Ks(e=De()){return e==="he"?"The user chose Hebrew. Always write to the user in clear, correct Hebrew \u2014 every answer, question, summary and relayed tool result \u2014 for the whole session. Keep tool, file and command names as they are.":"The user chose English. Always write to the user in English for the whole session."}function Hs(e){return e!=="he"&&e!=="en"?`Language: ${De()==="he"?"\u05E2\u05D1\u05E8\u05D9\u05EA (he)":"English (en)"}${ut()?"":" \u2014 from this machine's settings"}.
-Change with: nodata-mcp lang he | nodata-mcp lang en`:(ho(e),e==="he"?"\u2713 \u05D4\u05E9\u05E4\u05D4 \u05E0\u05E7\u05D1\u05E2\u05D4: \u05E2\u05D1\u05E8\u05D9\u05EA. NoData \u05D9\u05D3\u05D1\u05E8 \u05E2\u05D1\u05E8\u05D9\u05EA, \u05D5\u05DB\u05DC \u05E1\u05D5\u05DB\u05DF \u05D1\u05DE\u05D7\u05E9\u05D1 \u05D4\u05D6\u05D4 \u05D9\u05E7\u05D1\u05DC \u05D4\u05D5\u05E8\u05D0\u05D4 \u05DC\u05E2\u05E0\u05D5\u05EA \u05D1\u05E2\u05D1\u05E8\u05D9\u05EA. \u05D4\u05E4\u05E2\u05DC \u05DE\u05D7\u05D3\u05E9 \u05D0\u05EA Claude Code.":"\u2713 Language set: English. Restart Claude Code to apply.")}var ie="2026-09-24-v3";var zu=new Set(["nodata_terms","nodata_get_started","nodata_connect"]),Vt=()=>Wn(Wu(),".nodata"),Gn=()=>Wn(Vt(),"consent.json");function zn(){try{return Ws(Gn())?JSON.parse(qs(Gn(),"utf8")):null}catch{return null}}function Gt(){return zn()?.terms_version===ie}function Js(e){zs(Vt(),{recursive:!0}),Gu(Gn(),JSON.stringify(e,null,2)+`
-`,{mode:384})}async function mo(e,t){try{let n=await e.token();if(!n)return!1;let r=await fetch(`${e.baseUrl}/api/audit-log`,{method:"POST",headers:{"content-type":"application/json",authorization:`Bearer ${n}`},body:JSON.stringify(t)}),o=await r.json().catch(()=>({}));return r.ok&&o.logged===!0}catch{return!1}}function qu(e,t){return e.org?`${e.baseUrl}/tenant-v2/${encodeURIComponent(e.org)}/proofs?q=proof:${t.slice(0,16)}`:null}function Ce(e){return e?` and recorded at NoData for your organisation${typeof e=="string"?` \u2014 proof: ${e}`:""}`:""}async function Wt(e,t,n,r){let o=new Date().toISOString(),i=Gs("sha256").update(`${t}|${n}|${r}|${o}`).digest("hex");try{zs(Vt(),{recursive:!0}),Vu(Wn(Vt(),"acks.jsonl"),JSON.stringify({at:o,context:t,agent:n,detail:r,proof_hash:i})+`
-`,{mode:384})}catch{}return e&&await mo(e,{action:"action_ack",actionDetail:`${t}:${r}`,agent:n,proofHash:i,tosVersion:ie})?qu(e,i)??!0:!1}async function Ju(e,t){let n=new Date().toISOString(),r=Gs("sha256").update(`${ie}|mcp|${t}|${e?.org??""}|${n}`).digest("hex"),o={terms_version:ie,accepted_at:n,agent:t,org:e?.org??null,consent_hash:r,server_recorded:!1};return e&&(o.server_recorded=await mo(e,{action:"tos_accept",tosVersion:ie,context:"mcp",agent:t,proofHash:r})),Js(o),o}async function Ys(e){let t=zn();if(!t||t.terms_version!==ie||t.server_recorded)return;await mo(e,{action:"tos_accept",tosVersion:ie,context:"mcp-sync",agent:t.agent,proofHash:t.consent_hash})&&Js({...t,org:e.org,server_recorded:!0})}function Vs(e){try{return qs(Wn(Vt(),e),"utf8").split(`
-`).filter(Boolean).length}catch{return 0}}function Yu(){return["What is recorded about this machine (all in ~/.nodata, operational only):",`  \xB7 consent.json \u2014 ${Ws(Gn())?"your terms acceptance":"none yet"}`,`  \xB7 acks.jsonl \u2014 ${Vs("acks.jsonl")} acknowledgement(s), e.g. installing the read gate`,`  \xB7 gate.log \u2014 ${Vs("gate.log")} read-gate decision(s): tool and ask/deny, no path, no value`,"NoData's copy of the acceptance and acknowledgements is also written to your organisation's proof vault, encrypted to your 12 words."].join(`
-`)}var Xu=e=>[`NoData terms ${ie} \u2014 ${e}`,"","Section 7, AI agents, MCP and local tools, in short:","  \xB7 NoData is responsible for what passes through its tools: scan, lock/encrypt, clean copies, grants and revocation, governed sharing, proofs.","  \xB7 NoData is NOT responsible for code or programs an AI agent writes or runs by itself, for an agent reaching files without NoData's tools, or for reads the user approved.","  \xB7 The read gate is an aid, not a guarantee; locking a file (nodata_protect / nodata_wrap) is full protection.","  \xB7 NoData is designed not to know your data (no data seen, no keys held, every action proven), but coding with agents opens many doors \u2014 check, ask NoData to act, and verify from the proof that it did. Consider a code-review policy before agent-written code touches real data.","  \xB7 Like everything built on language models, agents and tools can make mistakes: check results, don't rely on them blindly.","  \xB7 A proposed policy is not an accepted one: accepting, changing or rejecting it is your decision, and its results are your responsibility.","  \xB7 You choose the agents you connect, the permissions you grant and the approvals you give.","","Recorded on acceptance \u2014 here (~/.nodata/consent.json) and at NoData: organisation, agent, terms version, time and a hash. No file content, no values."].join(`
-`);function Xs(e,t,n,r){e.registerTool("nodata_terms",{description:"Show NoData's terms of use (current version) and, on the user's explicit approval, accept them. Data tools stay off until the current version is accepted. ASKS FIRST: without confirm:true it only shows the terms summary and link \u2014 show it to the user and call again with confirm:true only if they say they accept. Records operational identity only (organisation, agent, version, time, hash), never content. LANGUAGE: if the user has not chosen one, ask them \u2014 \u05E2\u05D1\u05E8\u05D9\u05EA or English \u2014 and pass it as `language`; it is kept for every later session and every agent on this machine.",inputSchema:{confirm:Us.boolean().optional().describe("true = the user accepts these terms. Omit to show them."),language:Us.enum(["he","en"]).optional().describe("The language the user chose for NoData and their agents: he (\u05E2\u05D1\u05E8\u05D9\u05EA) or en (English).")}},async({confirm:o,language:i})=>{i&&ho(i);let s=zn();if(!o){let c=Gt()?`Already accepted by ${s.agent} on ${s.accepted_at}${s.server_recorded?" (recorded at NoData)":" (recorded locally; NoData copy pending)"}.`:s?`Accepted version ${s.terms_version} earlier \u2014 the terms have changed and need accepting again.`:"Not accepted yet.";return{content:[{type:"text",text:`${Xu(r)}
+</main></body></html>`}import{createHash as cu}from"node:crypto";var lu=4,ks=e=>cu("sha256").update(e).digest("hex");function du(e){return e.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&apos;")}function so(e,t,n,r){let o=t.length>4&&t.readUInt32LE(0)===67324752?lt(t):null,i=o?o.filter(p=>!p.name.endsWith("/")).map(p=>{let f=dt(t,p)?.toString("utf8")??"";return f+`
+`+$e(f)}):[t.toString("utf8")],s=[...r],a=s.filter(p=>p.length>=lu),c=0;for(let p of a){let f=new Set([p,du(p)]);i.some(h=>[...f].some(y=>h.includes(y)))&&c++}let l=o?Se(t,n)?.text??i.join(`
+`):i[0],d=Nn(l).reduce((p,f)=>p+f.count,0);return{method:"every replaced value searched, as written and XML-escaped, in every part of the clean file; clean text re-scanned with the validated detectors; both files fingerprinted",original_sha256:ks(e),clean_sha256:ks(t),values_checked:a.length,values_too_short_to_check:s.length-a.length,parts_searched:i.length,values_found:c,rescan_hits:d,ok:c===0}}var uu=["Put the new key where the app reads it (for a developer machine: the NoData vault + nodata_run, not a .env file).","Check that the app still works with the new key.","Only then delete / revoke the OLD key \u2014 until you do, whoever copied it can still use it."],K=(e,t,n)=>({provider:e,url:t,steps:[...n,...uu]}),pu={"aws-access-key":K("AWS","https://console.aws.amazon.com/iam/home#/security_credentials",["Open IAM \u2192 your user \u2192 Security credentials.","Create a NEW access key (you see its secret once \u2014 keep it only in the vault)."]),"aws-secret-key":K("AWS","https://console.aws.amazon.com/iam/home#/security_credentials",["Open IAM \u2192 your user \u2192 Security credentials.","Create a NEW access key (you see its secret once \u2014 keep it only in the vault).","Mark the old key Inactive before deleting it."]),"gcp-api-key":K("Google Cloud","https://console.cloud.google.com/apis/credentials",["Open APIs & Services \u2192 Credentials.","Pick the key \u2192 Regenerate key (or create a new one and restrict it to the APIs you use)."]),"gcp-service-account":K("Google Cloud (service account)","https://console.cloud.google.com/iam-admin/serviceaccounts",["Open IAM & Admin \u2192 Service accounts \u2192 the account \u2192 Keys.","Add key \u2192 Create new key (JSON). Keep the file out of Git and out of shared folders."]),"firebase-key":K("Firebase / Google Cloud","https://console.cloud.google.com/apis/credentials",["A Firebase web key is meant to be public \u2014 restrict it instead: Credentials \u2192 the key \u2192 Application restrictions (your domains only).","If it is not a web key, regenerate it."]),"github-token":K("GitHub","https://github.com/settings/tokens",["Open Settings \u2192 Developer settings \u2192 Personal access tokens.","Generate a new token with only the scopes you need."]),"github-fine-grained":K("GitHub","https://github.com/settings/tokens?type=beta",["Open Fine-grained tokens.","Regenerate the token (or create a new one for only the repositories you need)."]),"gitlab-token":K("GitLab","https://gitlab.com/-/user_settings/personal_access_tokens",["Open Access tokens.","Create a new token with only the scopes you need."]),"stripe-secret":K("Stripe","https://dashboard.stripe.com/apikeys",["Open Developers \u2192 API keys.","Roll the secret key (Stripe can keep the old one alive for a short overlap)."]),"stripe-restricted":K("Stripe","https://dashboard.stripe.com/apikeys",["Open Developers \u2192 API keys \u2192 Restricted keys.","Roll the key, or create a new restricted key."]),"slack-token":K("Slack","https://api.slack.com/apps",["Open your app \u2192 OAuth & Permissions.","Rotate / reinstall to get a new token."]),"slack-webhook":K("Slack","https://api.slack.com/apps",["Open your app \u2192 Incoming Webhooks.","Add a new webhook URL for the channel."]),"twilio-api-key":K("Twilio","https://console.twilio.com/us1/account/keys-credentials/api-keys",["Open Account \u2192 API keys & tokens.","Create a new API key."]),"sendgrid-api-key":K("SendGrid","https://app.sendgrid.com/settings/api_keys",["Open Settings \u2192 API Keys.","Create a new key with only the permissions you need."]),"openai-key":K("OpenAI","https://platform.openai.com/api-keys",["Open API keys.","Create a new secret key."]),"openai-project-key":K("OpenAI","https://platform.openai.com/api-keys",["Open API keys (per project).","Create a new secret key for the same project."]),"anthropic-key":K("Anthropic","https://console.anthropic.com/settings/keys",["Open Settings \u2192 API keys.","Create a new key."]),"supabase-key":K("Supabase","https://supabase.com/dashboard/project/_/settings/api-keys",["Open the project \u2192 Project Settings \u2192 API Keys.","Create a new SECRET key (a service_role / secret key bypasses every database rule \u2014 treat it like a root password).","Older projects with JWT keys: rotating the JWT secret replaces every key and signs everyone out \u2014 plan it."]),"postgres-uri":K("PostgreSQL (the password in the connection string)","https://supabase.com/dashboard/project/_/settings/database",["Change the database user's password: in Supabase \u2192 Project Settings \u2192 Database \u2192 Reset password; elsewhere, your host's console or ALTER USER \u2026 WITH PASSWORD.","Update the connection string with the new password."]),"mongodb-uri":K("MongoDB","https://cloud.mongodb.com/",["Open Atlas \u2192 Database Access \u2192 the user \u2192 Edit \u2192 Edit password.","Update the connection string."]),"redis-uri":K("Redis","",["Reset the password in your Redis host's console (or CONFIG SET requirepass on your own server).","Update the connection string."]),"private-key":K("Private key (SSH / TLS / signing)","",["Generate a new key pair.","Register the new PUBLIC key where the old one was trusted (server authorized_keys, certificate, service settings)."]),"jwt-secret":K("Your app's JWT secret","",["Set a new long random secret in the app's configuration.","Every signed-in user will be signed out \u2014 plan the moment."]),"password-in-code":K("A password in code","",["Change the password in the system it belongs to."]),"bearer-token":K("An access token","",["Revoke the token in the service that issued it and issue a new one."])},fu=K("A credential","",["Find the service it belongs to and issue a new credential there."]);function ws(e){return pu[e]??fu}function ao(e){let t=new Map;for(let n of e){if(n.finding_kind!=="hardcoded_secret"||!n.finding_subkind)continue;let r=ws(n.finding_subkind),o=t.get(r.provider)??{...r,ruleIds:[],files:[],count:0};o.count+=1,o.ruleIds.includes(n.finding_subkind)||o.ruleIds.push(n.finding_subkind),o.files.includes(n.relative_path)||o.files.push(n.relative_path),t.set(r.provider,o)}return[...t.values()].sort((n,r)=>r.count-n.count)}var he=Br(mo(),1);import{homedir as Pp}from"node:os";import{basename as yt,dirname as Ye,extname as Rp,join as Xe,resolve as Yn}from"node:path";import{existsSync as qt,mkdirSync as wa,readFileSync as Po,rmSync as Sa,statSync as Jt,writeFileSync as Xn}from"node:fs";import{pathToFileURL as Yt}from"node:url";function xe(e){return/\.ndc$/i.test(e)||/\.clean\.[A-Za-z0-9]+$/.test(e)}import{z as ht}from"zod";var mt=Br(mo(),1);import{execFileSync as op}from"node:child_process";import{mkdirSync as ip,writeFileSync as sp}from"node:fs";import{homedir as ap}from"node:os";import{existsSync as ia,rmSync as cp,statSync as lp}from"node:fs";import{basename as dp,dirname as up,join as So,relative as vo,resolve as pp}from"node:path";import{pathToFileURL as sa}from"node:url";import{z as Vs}from"zod";import{createHash as Ws}from"node:crypto";import{appendFileSync as Wu,existsSync as zs,mkdirSync as qs,readFileSync as Js,writeFileSync as zu}from"node:fs";import{homedir as qu}from"node:os";import{join as zn}from"node:path";import{existsSync as Ls,mkdirSync as Uu,readFileSync as Bs,writeFileSync as Vu}from"node:fs";import{homedir as Fs}from"node:os";import{join as Ms}from"node:path";var Ut=()=>Ms(Fs(),".nodata","prefs.json");function Ks(){try{let e=Ls(Ut())?JSON.parse(Bs(Ut(),"utf8")).lang:null;return e==="he"||e==="en"?e:null}catch{return null}}function Gu(){let t=process.env.LC_ALL||process.env.LC_MESSAGES||process.env.LANG||"";try{t||=Intl.DateTimeFormat().resolvedOptions().locale}catch{}return/^(he|iw)(?:[-_.@]|$)/i.test(t)?"he":"en"}function De(){return Ks()??Gu()}function ft(){return Ks()!==null}function go(e){Uu(Ms(Fs(),".nodata"),{recursive:!0});let t={};try{Ls(Ut())&&(t=JSON.parse(Bs(Ut(),"utf8")))}catch{}Vu(Ut(),JSON.stringify({...t,lang:e},null,2)+`
+`)}function Vt(e,t,n=De()){return n==="he"?e:t}function Hs(e=De()){return e==="he"?"The user chose Hebrew. Always write to the user in clear, correct Hebrew \u2014 every answer, question, summary and relayed tool result \u2014 for the whole session. Keep tool, file and command names as they are.":"The user chose English. Always write to the user in English for the whole session."}function Us(e){return e!=="he"&&e!=="en"?`Language: ${De()==="he"?"\u05E2\u05D1\u05E8\u05D9\u05EA (he)":"English (en)"}${ft()?"":" \u2014 from this machine's settings"}.
+Change with: nodata-mcp lang he | nodata-mcp lang en`:(go(e),e==="he"?"\u2713 \u05D4\u05E9\u05E4\u05D4 \u05E0\u05E7\u05D1\u05E2\u05D4: \u05E2\u05D1\u05E8\u05D9\u05EA. NoData \u05D9\u05D3\u05D1\u05E8 \u05E2\u05D1\u05E8\u05D9\u05EA, \u05D5\u05DB\u05DC \u05E1\u05D5\u05DB\u05DF \u05D1\u05DE\u05D7\u05E9\u05D1 \u05D4\u05D6\u05D4 \u05D9\u05E7\u05D1\u05DC \u05D4\u05D5\u05E8\u05D0\u05D4 \u05DC\u05E2\u05E0\u05D5\u05EA \u05D1\u05E2\u05D1\u05E8\u05D9\u05EA. \u05D4\u05E4\u05E2\u05DC \u05DE\u05D7\u05D3\u05E9 \u05D0\u05EA Claude Code.":"\u2713 Language set: English. Restart Claude Code to apply.")}var ie="2026-09-24-v3";var Ju=new Set(["nodata_terms","nodata_get_started","nodata_connect"]),Gt=()=>zn(qu(),".nodata"),Wn=()=>zn(Gt(),"consent.json");function qn(){try{return zs(Wn())?JSON.parse(Js(Wn(),"utf8")):null}catch{return null}}function Wt(){return qn()?.terms_version===ie}function Ys(e){qs(Gt(),{recursive:!0}),zu(Wn(),JSON.stringify(e,null,2)+`
+`,{mode:384})}async function yo(e,t){try{let n=await e.token();if(!n)return!1;let r=await fetch(`${e.baseUrl}/api/audit-log`,{method:"POST",headers:{"content-type":"application/json",authorization:`Bearer ${n}`},body:JSON.stringify(t)}),o=await r.json().catch(()=>({}));return r.ok&&o.logged===!0}catch{return!1}}function Yu(e,t){return e.org?`${e.baseUrl}/tenant-v2/${encodeURIComponent(e.org)}/proofs?q=proof:${t.slice(0,16)}`:null}function Ce(e){return e?` and recorded at NoData for your organisation${typeof e=="string"?` \u2014 proof: ${e}`:""}`:""}async function zt(e,t,n,r){let o=new Date().toISOString(),i=Ws("sha256").update(`${t}|${n}|${r}|${o}`).digest("hex");try{qs(Gt(),{recursive:!0}),Wu(zn(Gt(),"acks.jsonl"),JSON.stringify({at:o,context:t,agent:n,detail:r,proof_hash:i})+`
+`,{mode:384})}catch{}return e&&await yo(e,{action:"action_ack",actionDetail:`${t}:${r}`,agent:n,proofHash:i,tosVersion:ie})?Yu(e,i)??!0:!1}async function Xu(e,t){let n=new Date().toISOString(),r=Ws("sha256").update(`${ie}|mcp|${t}|${e?.org??""}|${n}`).digest("hex"),o={terms_version:ie,accepted_at:n,agent:t,org:e?.org??null,consent_hash:r,server_recorded:!1};return e&&(o.server_recorded=await yo(e,{action:"tos_accept",tosVersion:ie,context:"mcp",agent:t,proofHash:r})),Ys(o),o}async function Xs(e){let t=qn();if(!t||t.terms_version!==ie||t.server_recorded)return;await yo(e,{action:"tos_accept",tosVersion:ie,context:"mcp-sync",agent:t.agent,proofHash:t.consent_hash})&&Ys({...t,org:e.org,server_recorded:!0})}function Gs(e){try{return Js(zn(Gt(),e),"utf8").split(`
+`).filter(Boolean).length}catch{return 0}}function Zu(){return["What is recorded about this machine (all in ~/.nodata, operational only):",`  \xB7 consent.json \u2014 ${zs(Wn())?"your terms acceptance":"none yet"}`,`  \xB7 acks.jsonl \u2014 ${Gs("acks.jsonl")} acknowledgement(s), e.g. installing the read gate`,`  \xB7 gate.log \u2014 ${Gs("gate.log")} read-gate decision(s): tool and ask/deny, no path, no value`,"NoData's copy of the acceptance and acknowledgements is also written to your organisation's proof vault, encrypted to your 12 words."].join(`
+`)}var Qu=e=>[`NoData terms ${ie} \u2014 ${e}`,"","Section 7, AI agents, MCP and local tools, in short:","  \xB7 NoData is responsible for what passes through its tools: scan, lock/encrypt, clean copies, grants and revocation, governed sharing, proofs.","  \xB7 NoData is NOT responsible for code or programs an AI agent writes or runs by itself, for an agent reaching files without NoData's tools, or for reads the user approved.","  \xB7 The read gate is an aid, not a guarantee; locking a file (nodata_protect / nodata_wrap) is full protection.","  \xB7 NoData is designed not to know your data (no data seen, no keys held, every action proven), but coding with agents opens many doors \u2014 check, ask NoData to act, and verify from the proof that it did. Consider a code-review policy before agent-written code touches real data.","  \xB7 Like everything built on language models, agents and tools can make mistakes: check results, don't rely on them blindly.","  \xB7 A proposed policy is not an accepted one: accepting, changing or rejecting it is your decision, and its results are your responsibility.","  \xB7 You choose the agents you connect, the permissions you grant and the approvals you give.","","Recorded on acceptance \u2014 here (~/.nodata/consent.json) and at NoData: organisation, agent, terms version, time and a hash. No file content, no values."].join(`
+`);function Zs(e,t,n,r){e.registerTool("nodata_terms",{description:"Show NoData's terms of use (current version) and, on the user's explicit approval, accept them. Data tools stay off until the current version is accepted. ASKS FIRST: without confirm:true it only shows the terms summary and link \u2014 show it to the user and call again with confirm:true only if they say they accept. Records operational identity only (organisation, agent, version, time, hash), never content. LANGUAGE: if the user has not chosen one, ask them \u2014 \u05E2\u05D1\u05E8\u05D9\u05EA or English \u2014 and pass it as `language`; it is kept for every later session and every agent on this machine.",inputSchema:{confirm:Vs.boolean().optional().describe("true = the user accepts these terms. Omit to show them."),language:Vs.enum(["he","en"]).optional().describe("The language the user chose for NoData and their agents: he (\u05E2\u05D1\u05E8\u05D9\u05EA) or en (English).")}},async({confirm:o,language:i})=>{i&&go(i);let s=qn();if(!o){let c=Wt()?`Already accepted by ${s.agent} on ${s.accepted_at}${s.server_recorded?" (recorded at NoData)":" (recorded locally; NoData copy pending)"}.`:s?`Accepted version ${s.terms_version} earlier \u2014 the terms have changed and need accepting again.`:"Not accepted yet.";return{content:[{type:"text",text:`${Qu(r)}
 
 ${c}
 
-${Yu()}
+${Zu()}
 
-`+(ut()?"":`Also ask which language they want NoData and their agents to use with them \u2014 \u05E2\u05D1\u05E8\u05D9\u05EA or English \u2014 and pass it as language: "he" | "en".
-`)+"Ask the user whether they accept, then call nodata_terms again with confirm: true."}]}}let a=await Ju(t,n());return{content:[{type:"text",text:`ACCEPTED terms ${a.terms_version} \u2014 ${a.agent}${a.org?` \xB7 org ${a.org}`:""} \xB7 ${a.accepted_at}
+`+(ft()?"":`Also ask which language they want NoData and their agents to use with them \u2014 \u05E2\u05D1\u05E8\u05D9\u05EA or English \u2014 and pass it as language: "he" | "en".
+`)+"Ask the user whether they accept, then call nodata_terms again with confirm: true."}]}}let a=await Xu(t,n());return{content:[{type:"text",text:`ACCEPTED terms ${a.terms_version} \u2014 ${a.agent}${a.org?` \xB7 org ${a.org}`:""} \xB7 ${a.accepted_at}
   local copy: ~/.nodata/consent.json \xB7 hash ${a.consent_hash.slice(0,16)}\u2026
 `+(a.server_recorded?"  recorded at NoData (tied to your organisation).":t?"  NoData could not be reached \u2014 kept locally; it is sent on the next connected run.":"  not connected yet \u2014 kept locally; it is recorded at NoData the first time you connect.")+`
-The data tools are on.`}]}})}function Zs(e){let t=e,n=t.registerTool.bind(e);t.registerTool=(r,o,i)=>n(r,o,async(...s)=>{if(zu.has(r)||Gt())return i(...s);let a=zn();return{content:[{type:"text",text:(a?`NoData's terms changed (you accepted ${a.terms_version}; current is ${ie}).`:"NoData's terms of use have not been accepted on this machine yet.")+` ${r} is held until they are. Call nodata_terms to show them to the user, and nodata_terms confirm:true once they accept.`}],isError:!0}})}import{existsSync as Zu,mkdirSync as Qu,readFileSync as Qs,writeFileSync as ep}from"node:fs";import{homedir as tp}from"node:os";import{join as go}from"node:path";var yo=()=>go(tp(),".nodata"),ea=()=>go(yo(),"device-key.json"),ta=()=>go(yo(),"key-backup.json");function na(){try{return JSON.parse(Qs(ea(),"utf8")).kid??null}catch{return null}}function pt(){if(!Zu(ea()))return!1;try{return JSON.parse(Qs(ta(),"utf8")).kid!==na()}catch{return!0}}function ft(){return"back up the device key NOW \u2014 it is the only key that opens these files: copy ~/.nodata/device-key.json (Windows: %USERPROFILE%\\.nodata\\device-key.json) to a USB stick or a password manager yourself, outside Claude, then run `npx -y @nodatachat/mcp@latest key-backed-up`. Never paste it into a chat."}function ra(){let e=na();return e?(Qu(yo(),{recursive:!0}),ep(ta(),JSON.stringify({kid:e,confirmed_at:new Date().toISOString()},null,2)+`
-`,{mode:384}),`\u2713 Backup confirmed for device key ${e}. NoData will stop reminding you.`):"No device key on this machine yet \u2014 nothing to back up."}var sa={keep:0,redact:1,protect:2,both:3},up={critical:"Restricted",high:"Confidential",medium:"Internal",low:"Internal",info:"Internal"},aa={critical:4,high:3,medium:2,low:1,info:0},bo={both:"clean copy to work on + lock the original",protect:"lock",redact:"clean copy to work on",keep:"leave as is"},pp={credit_card:"card",israeli_id:"ID",israeli_id_value:"ID",iban:"IBAN",israeli_iban_value:"IBAN",israeli_phone:"phone",israeli_phone_value:"phone",email:"email"};function ca(e){if(e.finding_kind==="hardcoded_secret")return"secret";if(e.finding_kind==="secret_reuse")return e.finding_subkind==="shared_encryption_key"?"shared encryption key":"shared secret";if(e.finding_kind==="pii_header_match")return`${(e.finding_subkind??"personal").split(":")[0]} column`;let t=e.finding_subkind&&!e.finding_subkind.startsWith("near_line")?e.finding_subkind:e.finding_kind;return pp[t]??t.replace(/_/g," ")}function fp(e){let t=new Map;for(let o of e)t.set(o.relative_path,[...t.get(o.relative_path)??[],o]);let n=[];for(let[o,i]of t){let s=i.reduce((h,_)=>(aa[_.severity]??0)>(aa[h]??0)?_.severity:h,"info"),a=up[s]??"Internal",c=i.some(h=>h.finding_kind==="hardcoded_secret"||h.finding_kind==="secret_reuse"),l=new Map;for(let h of i){let _=ca(h);l.set(_,Math.max(l.get(_)??0,i.filter(y=>ca(y)===_&&y.finding_kind===h.finding_kind).length))}let u=[...l].map(([h,_])=>`${_} ${h}`).join(", "),p,f;c?(p="protect",f="a credential in plaintext \u2014 lock the file, and ROTATE the credential at its source: a leaked key stays valid until it is replaced"):a==="Restricted"?(p="both",f="restricted data \u2014 keep a clean copy for work and lock the original away from people and AI"):a==="Confidential"?(p="protect",f="confidential personal data (IDs, accounts) \u2014 lock it; make a clean copy when you need to work on it"):(p="redact",f="internal contact data \u2014 a clean copy is enough to work safely"),n.push({file:o,tier:a,found:u,secret:c,action:p,why:f})}let r={Restricted:0,Confidential:1,Internal:2};return n.sort((o,i)=>r[o.tier]-r[i.tier]||o.file.localeCompare(i.file))}function hp(e,t){let n=new Map;if(!t.length)return n;let r=(o,i)=>np("git",["-C",e,...o],{input:i,encoding:"utf8",timeout:15e3,maxBuffer:64*1024*1024,stdio:["pipe","pipe","ignore"]});try{let o=new Set(r(["ls-files","-z"]).split("\0").filter(Boolean)),i=t.filter(a=>!o.has(a)),s=new Set;if(i.length)try{s=new Set(r(["check-ignore","-z","--stdin"],i.join("\0")+"\0").split("\0").filter(Boolean))}catch{}for(let a of t)n.set(a,o.has(a)?"tracked":s.has(a)?"ignored":"untracked")}catch{}return n}var mp="tracked by git \u2014 a lock would show as a deletion in git and break the working copy. FIX AT SOURCE: take the values out of the code (a placeholder, an env variable, a synthetic test value), commit, and replace any key; the repository history still holds the old values",gp="an app reads this env file \u2014 a lock that KEEPS the original protects nothing. Either lock it with remove_originals (only if nothing reads it), or move the values to the vault, run with nodata_run, and then delete the file. Replace every key that was ever exposed";function yp(e,t){return e.map(n=>{let r=t.get(n.file),o=r?{...n,git:r}:{...n};if(r==="tracked"&&(n.action==="protect"||n.action==="both"))return{...o,action:"keep",fixAtSource:!0,why:mp};let i=n.file.split("/").pop()??n.file;return n.secret&&$e.test(i)?{...o,why:gp}:o})}function _p(e,t){return e.map(n=>{let r=bp(n.file,t),o=!!t&&Object.prototype.hasOwnProperty.call(t,n.file),i=!!r&&!o&&sa[r]<sa[n.action]&&(n.tier==="Restricted"||n.tier==="Confidential"),s=i?n.action:r??n.action;return{...n,chosen:s,changed:s!==n.action,heldBack:i,wanted:i?r:void 0}})}function da(e){let n=e.replace(/\\/g,"/").replace(/\/$/,"/**").replace(/[.+^${}()|[\]]/g,"\\$&").replace(/\*\*/g,"\0").replace(/\*/g,"[^/]*").replace(/\?/g,"[^/]").replace(/\u0000/g,".*");return new RegExp(`^${n}$`)}function bp(e,t){if(!t)return;if(t[e])return t[e];let n=null;for(let[r,o]of Object.entries(t)){if(!/[*?/]/.test(r)||!da(r).test(e))continue;let i=r.replace(/[*?]/g,"").length;(!n||i>n.score)&&(n={score:i,act:o})}return n?.act}function la(e){let t=io(e),n=[...new Set(e.filter(o=>o.finding_kind==="secret_reuse").map(o=>o.remediation_hint??""))].filter(Boolean),r=[];if(n.length){r.push("","SHARED SECRETS \u2014 read this BEFORE replacing keys:");for(let o of n.sort((i,s)=>Number(s.includes("\u26A0"))-Number(i.includes("\u26A0"))))r.push(`  ${o.includes("\u26A0")?"\u{1F534}":"\u25A0"} ${o}`)}if(!t.length)return r;r.push("",`ROTATE AT THE SOURCE \u2014 ${t.reduce((o,i)=>o+i.count,0)} leaked key(s); locking a file does not un-leak a key:`);for(let o of t)r.push(`  \u25A0 ${o.provider} \u2014 ${o.count} in ${o.files.length} file(s)${o.url?` \xB7 ${o.url}`:""}`),o.steps.forEach((i,s)=>r.push(`      ${s+1}. ${i}`)),r.push(`      files: ${o.files.slice(0,6).join(", ")}${o.files.length>6?` \u2026 +${o.files.length-6}`:""}`);return r}function vp(e,t){let n=ko(ip(),".nodata","reports");rp(n,{recursive:!0});let r=ko(n,`plan-${e.replace(/[^A-Za-z0-9_-]+/g,"_").slice(0,40)||"folder"}-${new Date().toISOString().replace(/[:.]/g,"-")}.csv`),o=i=>`"${i.replace(/"/g,'""')}"`;return op(r,["file,tier,found,secret,git,recommended,chosen,held_back",...t.map(i=>[o(i.file),i.tier,o(i.found),i.secret,i.git??"",i.action,i.chosen,!!i.heldBack].join(","))].join(`
+The data tools are on.`}]}})}function Qs(e){let t=e,n=t.registerTool.bind(e);t.registerTool=(r,o,i)=>n(r,o,async(...s)=>{if(Ju.has(r)||Wt())return i(...s);let a=qn();return{content:[{type:"text",text:(a?`NoData's terms changed (you accepted ${a.terms_version}; current is ${ie}).`:"NoData's terms of use have not been accepted on this machine yet.")+` ${r} is held until they are. Call nodata_terms to show them to the user, and nodata_terms confirm:true once they accept.`}],isError:!0}})}import{existsSync as ep,mkdirSync as tp,readFileSync as ea,writeFileSync as np}from"node:fs";import{homedir as rp}from"node:os";import{join as _o}from"node:path";var bo=()=>_o(rp(),".nodata"),ta=()=>_o(bo(),"device-key.json"),na=()=>_o(bo(),"key-backup.json");function ra(){try{return JSON.parse(ea(ta(),"utf8")).kid??null}catch{return null}}function qe(){if(!ep(ta()))return!1;try{return JSON.parse(ea(na(),"utf8")).kid!==ra()}catch{return!0}}function Je(){return"back up the device key NOW \u2014 it is the only key that opens these files: copy ~/.nodata/device-key.json (Windows: %USERPROFILE%\\.nodata\\device-key.json) to a USB stick or a password manager yourself, outside Claude, then run `npx -y @nodatachat/mcp@latest key-backed-up`. Never paste it into a chat."}function oa(){let e=ra();return e?(tp(bo(),{recursive:!0}),np(na(),JSON.stringify({kid:e,confirmed_at:new Date().toISOString()},null,2)+`
+`,{mode:384}),`\u2713 Backup confirmed for device key ${e}. NoData will stop reminding you.`):"No device key on this machine yet \u2014 nothing to back up."}var aa={keep:0,redact:1,protect:2,both:3},fp={critical:"Restricted",high:"Confidential",medium:"Internal",low:"Internal",info:"Internal"},ca={critical:4,high:3,medium:2,low:1,info:0},ko={both:"clean copy to work on + lock the original",protect:"lock",redact:"clean copy to work on",keep:"leave as is"},hp={credit_card:"card",israeli_id:"ID",israeli_id_value:"ID",iban:"IBAN",israeli_iban_value:"IBAN",israeli_phone:"phone",israeli_phone_value:"phone",email:"email"};function la(e){if(e.finding_kind==="hardcoded_secret")return"secret";if(e.finding_kind==="secret_reuse")return e.finding_subkind==="shared_encryption_key"?"shared encryption key":"shared secret";if(e.finding_kind==="pii_header_match")return`${(e.finding_subkind??"personal").split(":")[0]} column`;let t=e.finding_subkind&&!e.finding_subkind.startsWith("near_line")?e.finding_subkind:e.finding_kind;return hp[t]??t.replace(/_/g," ")}function mp(e){let t=new Map;for(let o of e)t.set(o.relative_path,[...t.get(o.relative_path)??[],o]);let n=[];for(let[o,i]of t){let s=i.reduce((h,y)=>(ca[y.severity]??0)>(ca[h]??0)?y.severity:h,"info"),a=fp[s]??"Internal",c=i.some(h=>h.finding_kind==="hardcoded_secret"||h.finding_kind==="secret_reuse"),l=new Map;for(let h of i){let y=la(h);l.set(y,Math.max(l.get(y)??0,i.filter(_=>la(_)===y&&_.finding_kind===h.finding_kind).length))}let d=[...l].map(([h,y])=>`${y} ${h}`).join(", "),p,f;c?(p="protect",f="a credential in plaintext \u2014 lock the file, and ROTATE the credential at its source: a leaked key stays valid until it is replaced"):a==="Restricted"?(p="both",f="restricted data \u2014 keep a clean copy for work and lock the original away from people and AI"):a==="Confidential"?(p="protect",f="confidential personal data (IDs, accounts) \u2014 lock it; make a clean copy when you need to work on it"):(p="redact",f="internal contact data \u2014 a clean copy is enough to work safely"),n.push({file:o,tier:a,found:d,secret:c,action:p,why:f})}let r={Restricted:0,Confidential:1,Internal:2};return n.sort((o,i)=>r[o.tier]-r[i.tier]||o.file.localeCompare(i.file))}function gp(e,t){let n=new Map;if(!t.length)return n;let r=(o,i)=>op("git",["-C",e,...o],{input:i,encoding:"utf8",timeout:15e3,maxBuffer:64*1024*1024,stdio:["pipe","pipe","ignore"]});try{let o=new Set(r(["ls-files","-z"]).split("\0").filter(Boolean)),i=t.filter(a=>!o.has(a)),s=new Set;if(i.length)try{s=new Set(r(["check-ignore","-z","--stdin"],i.join("\0")+"\0").split("\0").filter(Boolean))}catch{}for(let a of t)n.set(a,o.has(a)?"tracked":s.has(a)?"ignored":"untracked")}catch{}return n}var yp="tracked by git \u2014 a lock would show as a deletion in git and break the working copy. FIX AT SOURCE: take the values out of the code (a placeholder, an env variable, a synthetic test value), commit, and replace any key; the repository history still holds the old values",_p="an app reads this env file \u2014 a lock that KEEPS the original protects nothing. Either lock it with remove_originals (only if nothing reads it), or move the values to the vault, run with nodata_run, and then delete the file. Replace every key that was ever exposed";function bp(e,t){return e.map(n=>{let r=t.get(n.file),o=r?{...n,git:r}:{...n};if(r==="tracked"&&(n.action==="protect"||n.action==="both"))return{...o,action:"keep",fixAtSource:!0,why:yp};let i=n.file.split("/").pop()??n.file;return n.secret&&Pe.test(i)?{...o,why:_p}:o})}function vp(e,t){return e.map(n=>{let r=kp(n.file,t),o=!!t&&Object.prototype.hasOwnProperty.call(t,n.file),i=!!r&&!o&&aa[r]<aa[n.action]&&(n.tier==="Restricted"||n.tier==="Confidential"),s=i?n.action:r??n.action;return{...n,chosen:s,changed:s!==n.action,heldBack:i,wanted:i?r:void 0}})}function ua(e){let n=e.replace(/\\/g,"/").replace(/\/$/,"/**").replace(/[.+^${}()|[\]]/g,"\\$&").replace(/\*\*/g,"\0").replace(/\*/g,"[^/]*").replace(/\?/g,"[^/]").replace(/\u0000/g,".*");return new RegExp(`^${n}$`)}function kp(e,t){if(!t)return;if(t[e])return t[e];let n=null;for(let[r,o]of Object.entries(t)){if(!/[*?/]/.test(r)||!ua(r).test(e))continue;let i=r.replace(/[*?]/g,"").length;(!n||i>n.score)&&(n={score:i,act:o})}return n?.act}function da(e){let t=ao(e),n=[...new Set(e.filter(o=>o.finding_kind==="secret_reuse").map(o=>o.remediation_hint??""))].filter(Boolean),r=[];if(n.length){r.push("","SHARED SECRETS \u2014 read this BEFORE replacing keys:");for(let o of n.sort((i,s)=>Number(s.includes("\u26A0"))-Number(i.includes("\u26A0"))))r.push(`  ${o.includes("\u26A0")?"\u{1F534}":"\u25A0"} ${o}`)}if(!t.length)return r;r.push("",`ROTATE AT THE SOURCE \u2014 ${t.reduce((o,i)=>o+i.count,0)} leaked key(s); locking a file does not un-leak a key:`);for(let o of t)r.push(`  \u25A0 ${o.provider} \u2014 ${o.count} in ${o.files.length} file(s)${o.url?` \xB7 ${o.url}`:""}`),o.steps.forEach((i,s)=>r.push(`      ${s+1}. ${i}`)),r.push(`      files: ${o.files.slice(0,6).join(", ")}${o.files.length>6?` \u2026 +${o.files.length-6}`:""}`);return r}function wp(e,t){let n=So(ap(),".nodata","reports");ip(n,{recursive:!0});let r=So(n,`plan-${e.replace(/[^A-Za-z0-9_-]+/g,"_").slice(0,40)||"folder"}-${new Date().toISOString().replace(/[:.]/g,"-")}.csv`),o=i=>`"${i.replace(/"/g,'""')}"`;return sp(r,["file,tier,found,secret,git,recommended,chosen,held_back",...t.map(i=>[o(i.file),i.tier,o(i.found),i.secret,i.git??"",i.action,i.chosen,!!i.heldBack].join(","))].join(`
 `)+`
-`,{mode:384}),r}var vo=40;function ua(e,t){e.registerTool("nodata_plan",{description:'RECOMMEND a policy after a scan, per file, and apply it only once the user approves. For every file with findings it proposes a tier (Restricted / Confidential / Internal) and an action: "both" (clean copy to work on + lock the original), "protect" (lock), "redact" (clean copy) or "keep"; credentials also get a rotate-at-source step. ASKS FIRST: without confirm:true it only shows the plan. The user may change any action \u2014 pass them as `actions` {"relative/path": "protect"|"redact"|"both"|"keep"} \u2014 then call again with the same path, the same actions and confirm:true. Proposing is not accepting: never confirm on the user\'s behalf. Content-free: paths and counts only.',inputSchema:{path:ht.string().describe("Folder or file to plan for."),actions:ht.record(ht.string(),ht.enum(["both","protect","redact","keep"])).optional().describe(`The user's changes: by relative path, or by folder / pattern for many files at once ("scripts/**": "keep", ".next/**": "keep", "*.env": "protect"). An exact path beats a pattern; a more specific pattern beats a broader one.`),remove_originals:ht.boolean().optional().describe("When locking, delete the plaintext original. Default false (originals kept)."),confirm:ht.boolean().optional().describe("true = the user approved this plan. Omit to show it.")}},async({path:n,actions:r,remove_originals:o,confirm:i})=>{let s=dp(n);if(!oa(s))return{content:[{type:"text",text:`Nothing found at: ${s}`}],isError:!0};let a=ap(s).isDirectory()?s:lp(s),c=await t.scan(s),l=fp(c.findings.filter(b=>!xe(b.relative_path))),u=yp(l,(t.git??hp)(a,l.map(b=>b.file)));if(u.length===0)return{content:[{type:"text",text:`No findings in ${s} \u2014 nothing to decide. ${t.who()}`}]};let p=Object.keys(r??{}).filter(b=>!u.some(S=>S.file===b||/[*?/]/.test(b)&&da(b).test(S.file))),f=_p(u,r),h=f.filter(b=>b.heldBack),_=f.length>vo,y=_?vp(cp(s),f):null,k=new Map;for(let b of f){let S=b.file.split("/"),x=S.length>1?S.slice(0,Math.min(2,S.length-1)).join("/"):"(top level)",P=k.get(x)??{};P[b.chosen]=(P[b.chosen]??0)+1,k.set(x,P)}let E=[...k].sort((b,S)=>Object.values(S[1]).reduce((x,P)=>x+P,0)-Object.values(b[1]).reduce((x,P)=>x+P,0)).slice(0,25).map(([b,S])=>`  ${b} \u2014 ${Object.entries(S).map(([x,P])=>`${P} ${bo[x]}`).join(" \xB7 ")}`),R=(_?f.filter(b=>b.tier!=="Internal"||b.changed).slice(0,vo):f).map(b=>`  [${b.tier}] ${b.file} \u2014 ${b.found}
-      \u2192 ${b.fixAtSource&&b.chosen==="keep"?"FIX AT SOURCE (no lock)":bo[b.chosen]}${b.changed?`  (changed by you; recommended: ${bo[b.action]})`:`  \u2014 ${b.why}`}`+(b.git?`
+`,{mode:384}),r}var wo=40;function pa(e,t){e.registerTool("nodata_plan",{description:'RECOMMEND a policy after a scan, per file, and apply it only once the user approves. For every file with findings it proposes a tier (Restricted / Confidential / Internal) and an action: "both" (clean copy to work on + lock the original), "protect" (lock), "redact" (clean copy) or "keep"; credentials also get a rotate-at-source step. ASKS FIRST: without confirm:true it only shows the plan. The user may change any action \u2014 pass them as `actions` {"relative/path": "protect"|"redact"|"both"|"keep"} \u2014 then call again with the same path, the same actions and confirm:true. Proposing is not accepting: never confirm on the user\'s behalf. Content-free: paths and counts only.',inputSchema:{path:ht.string().describe("Folder or file to plan for."),actions:ht.record(ht.string(),ht.enum(["both","protect","redact","keep"])).optional().describe(`The user's changes: by relative path, or by folder / pattern for many files at once ("scripts/**": "keep", ".next/**": "keep", "*.env": "protect"). An exact path beats a pattern; a more specific pattern beats a broader one.`),remove_originals:ht.boolean().optional().describe("When locking, delete the plaintext original. Default false (originals kept)."),confirm:ht.boolean().optional().describe("true = the user approved this plan. Omit to show it.")}},async({path:n,actions:r,remove_originals:o,confirm:i})=>{let s=pp(n);if(!ia(s))return{content:[{type:"text",text:`Nothing found at: ${s}`}],isError:!0};let a=lp(s).isDirectory()?s:up(s),c=await t.scan(s),l=mp(c.findings.filter(b=>!xe(b.relative_path))),d=bp(l,(t.git??gp)(a,l.map(b=>b.file)));if(d.length===0)return{content:[{type:"text",text:`No findings in ${s} \u2014 nothing to decide. ${t.who()}`}]};let p=Object.keys(r??{}).filter(b=>!d.some(w=>w.file===b||/[*?/]/.test(b)&&ua(b).test(w.file))),f=vp(d,r),h=f.filter(b=>b.heldBack),y=f.length>wo,_=y?wp(dp(s),f):null,S=new Map;for(let b of f){let w=b.file.split("/"),x=w.length>1?w.slice(0,Math.min(2,w.length-1)).join("/"):"(top level)",$=S.get(x)??{};$[b.chosen]=($[b.chosen]??0)+1,S.set(x,$)}let E=[...S].sort((b,w)=>Object.values(w[1]).reduce((x,$)=>x+$,0)-Object.values(b[1]).reduce((x,$)=>x+$,0)).slice(0,25).map(([b,w])=>`  ${b} \u2014 ${Object.entries(w).map(([x,$])=>`${$} ${ko[x]}`).join(" \xB7 ")}`),P=(y?f.filter(b=>b.tier!=="Internal"||b.changed).slice(0,wo):f).map(b=>`  [${b.tier}] ${b.file} \u2014 ${b.found}
+      \u2192 ${b.fixAtSource&&b.chosen==="keep"?"FIX AT SOURCE (no lock)":ko[b.chosen]}${b.changed?`  (changed by you; recommended: ${ko[b.action]})`:`  \u2014 ${b.why}`}`+(b.git?`
       git: ${b.git}`:"")+(b.secret?`
-      \u26A0 also rotate the credential at its source (NoData cannot do that step)`:"")),B=h.length?["",`DOWNGRADED BY A PATTERN \u2014 NOT applied (${h.length} file(s)): a folder rule would lower protection on restricted / confidential files. They keep the recommendation; to lower one, name it exactly in actions:`,...h.slice(0,20).map(b=>`  \u26A0 [${b.tier}] ${b.file} \u2014 ${b.found}: rule says "${b.wanted}", stays "${b.action}"`),...h.length>20?[`  \u2026 +${h.length-20} more (all in the CSV)`]:[]]:[],m=f.filter(b=>b.fixAtSource).length,v=m?`
-FIX AT SOURCE \u2014 ${m} file(s) are tracked by git: not locked (that breaks the working copy). The values have to come out of the code; nodata_redact can show which ones without printing them.`:"";if(!i)return{content:[{type:"text",text:[`RECOMMENDED POLICY \u2014 nothing changed yet. ${t.who()}`,`${u.length} file(s) with findings under ${s}:`,..._?["BY FOLDER",...E,"",`MOST SENSITIVE (first ${vo}; every file is in the list below):`]:[],...R,...B,v,y?`
-The whole plan, one line per file, content-free: ${ia(y).href}`:"",_?'Decide by folder rather than by file \u2014 e.g. actions: {"scripts/**": "keep", ".next/**": "keep", "*.env": "protect"}.':"",...la(c.findings),p.length?`
+      \u26A0 also rotate the credential at its source (NoData cannot do that step)`:"")),N=h.length?["",`DOWNGRADED BY A PATTERN \u2014 NOT applied (${h.length} file(s)): a folder rule would lower protection on restricted / confidential files. They keep the recommendation; to lower one, name it exactly in actions:`,...h.slice(0,20).map(b=>`  \u26A0 [${b.tier}] ${b.file} \u2014 ${b.found}: rule says "${b.wanted}", stays "${b.action}"`),...h.length>20?[`  \u2026 +${h.length-20} more (all in the CSV)`]:[]]:[],m=f.filter(b=>b.fixAtSource).length,v=m?`
+FIX AT SOURCE \u2014 ${m} file(s) are tracked by git: not locked (that breaks the working copy). The values have to come out of the code; nodata_redact can show which ones without printing them.`:"";if(!i)return{content:[{type:"text",text:[`RECOMMENDED POLICY \u2014 nothing changed yet. ${t.who()}`,`${d.length} file(s) with findings under ${s}:`,...y?["BY FOLDER",...E,"",`MOST SENSITIVE (first ${wo}; every file is in the list below):`]:[],...P,...N,v,_?`
+The whole plan, one line per file, content-free: ${sa(_).href}`:"",y?'Decide by folder rather than by file \u2014 e.g. actions: {"scripts/**": "keep", ".next/**": "keep", "*.env": "protect"}.':"",...da(c.findings),p.length?`
 Not in the scan (ignored): ${p.join(", ")}`:"","","Locking keeps the plaintext originals unless remove_originals: true.",'This is a proposal. Show it to the user; they can change any line (e.g. "keep" a file, or "redact" instead of "protect").',"Then call nodata_plan again with the same path, their changes in `actions`, and confirm: true \u2014 only after they approve."].filter(b=>b!=="").join(`
-`)}]};let w=[],$=[],T=[];for(let b of f){let S=ko(a,b.file);if(!oa(S)){$.push(`  \u2717 ${b.file} \u2014 no longer there`);continue}if(b.chosen==="redact"||b.chosen==="both"){let x=t.cleanCopy(S);"error"in x?$.push(`  \u2717 ${b.file} \u2014 ${x.error}`):w.push(`  \u2713 ${b.file} \u2192 clean copy ${_o(a,x.outPath)} (checked: ${x.verification.values_found} of ${x.verification.values_checked} hidden values left in it)`)}(b.chosen==="protect"||b.chosen==="both")&&T.push(S),b.chosen==="keep"&&w.push(`  \xB7 ${b.file} \u2014 left as is (your choice)`)}let I="";if(T.length){let{key:b,created:S}=mt.ensureDeviceKey();(S||pt())&&w.push(`  \u26A0 ${S?"A new device key was created. ":""}${ft()}`);let x=[];for(let D of T)x.push(await mt.sealFile(D,b)),o&&sp(D),w.push(`  \u{1F512} ${_o(a,D)} \u2192 ${_o(a,D)}.ndc${o?" (original deleted)":""}`);let P=f.map(D=>({file:D.file,tier:D.tier,recommended:D.action,chosen:D.chosen}));I=mt.writeLocalReceipt(a,{action:"policy-apply",kid:b.kid,removed_plaintext:!!o,files:x,extra:{approved_by:t.who(),surface:"mcp",plan:P}})}for(let b of h)w.push(`  \u26A0 ${b.file} \u2014 kept "${b.action}": a folder rule cannot lower a ${b.tier.toLowerCase()} file; name it to change it`);let L=f.filter(b=>b.changed).length,j=await t.ack(`${f.length} files \xB7 ${L} changed by the user \xB7 ${T.length} locked`);return{content:[{type:"text",text:[`APPLIED the approved policy \u2014 ${t.who()}`,...w,...$,...la(c.findings),I?`Receipt (the plan, hashes, seal ids \u2014 no content): ${ia(I).href}`:"",`Approval kept in ~/.nodata/acks.jsonl${Ce(j)}.`].filter(Boolean).join(`
-`)}]}})}import{existsSync as kp,mkdirSync as wp,readFileSync as Sp,statSync as Eo,writeFileSync as Ep}from"node:fs";import{homedir as pa}from"node:os";import{join as wo}from"node:path";var fa=()=>wo(pa(),".nodata","flagged.json"),xp=5e3;function So(e){let t=e.replace(/\\/g,"/");return process.platform==="win32"?t.toLowerCase():t}var gt=null;function ha(){let e=fa();try{if(!kp(e))return{};let t=Eo(e).mtimeMs;if(gt&&gt.path===e&&gt.mtimeMs===t)return gt.store;let n=JSON.parse(Sp(e,"utf8"));return gt={path:e,mtimeMs:t,store:n},n}catch{return{}}}function ma(e,t,n=()=>!1,r=e){try{let o=So(r).replace(/\/+$/,""),i=ha();for(let a of Object.keys(i))(a===o||a.startsWith(o+"/"))&&delete i[a];for(let a of t){if(a.severity!=="critical"&&a.severity!=="high")continue;let c=wo(e,a.relative_path);if(n(c))continue;let l=So(c),u=0;try{u=Eo(c).mtimeMs}catch{continue}let p=i[l]??{mtimeMs:u,kinds:{}},f=a.finding_subkind||a.finding_kind;p.kinds[f]=(p.kinds[f]??0)+1,i[l]=p}let s=Object.keys(i);for(let a of s.slice(0,Math.max(0,s.length-xp)))delete i[a];wp(wo(pa(),".nodata"),{recursive:!0}),Ep(fa(),JSON.stringify(i)+`
-`,{mode:384}),gt=null}catch{}}function qn(e){let t=ha()[So(e)];if(!t)return null;try{if(Eo(e).mtimeMs>t.mtimeMs+1e3)return null}catch{return null}return t.kinds}import{execFileSync as Ap}from"node:child_process";var Tp=500;function ga(e,t=Tp){let n=u=>Ap("git",["-C",e,...u],{encoding:"utf8",timeout:6e4,maxBuffer:536870912,stdio:["ignore","pipe","ignore"]}),r;try{r=n(["log","--all","-p","--no-color","--unified=0",`-n${t}`,"--format=commit %h"])}catch{return{ok:!1,commitsScanned:0,hits:[],reason:"not a git repository, or git is not installed"}}let o=st(),i=new Set,s=[],a="",c="",l=0;for(let u of r.split(`
-`)){if(u.startsWith("commit ")){a=u.slice(7).trim(),l++;continue}if(u.startsWith("+++ ")){c=u.startsWith("+++ b/")?u.slice(6):"";continue}if(!c||!u.startsWith("+")||u.startsWith("+++"))continue;let p=u.slice(1);if(!/process\.env|\$\{[A-Z_]+/.test(p))for(let f of o){if(!f.pattern.test(p))continue;let h=`${f.id}::${c}`;i.has(h)||(i.add(h),s.push({rule:f.id,file:c,commit:a,removedSince:!1}));break}}for(let u of s)try{let p=n(["show",`HEAD:${u.file}`]),f=o.find(h=>h.id===u.rule);u.removedSince=!f||!p.split(`
-`).some(h=>f.pattern.test(h))}catch{u.removedSince=!0}return{ok:!0,commitsScanned:l,hits:s}}function ya(e){if(!e.ok)return["",`GIT HISTORY \u2014 not checked: ${e.reason}.`];if(!e.hits.length)return["",`GIT HISTORY \u2014 ${e.commitsScanned} commit(s) checked: no secret was ever committed.`];let t=e.hits.filter(n=>n.removedSince);return["",`GIT HISTORY \u2014 ${e.hits.length} secret(s) committed in the last ${e.commitsScanned} commit(s)${t.length?`; ${t.length} of them deleted since, but still in every clone`:""}:`,...e.hits.slice(0,30).map(n=>`  ${n.removedSince?"\u{1F573}":"\u25A0"} ${n.rule} \xB7 ${n.file} \xB7 first seen in ${n.commit}${n.removedSince?" (gone from the code, not from history)":""}`),...e.hits.length>30?[`  \u2026 +${e.hits.length-30} more`]:[],"  Every one of these keys has to be REPLACED at its provider \u2014 deleting the line does not help. Rewriting history (git filter-repo) is a separate decision for the repository's owner."]}var ee=(e,t=!1)=>({content:[{type:"text",text:e}],...t?{isError:t}:{}}),_a=Je(Ip(),".nodata","reports"),xo=25;function $p(){return new Date().toISOString().replace(/[:.]/g,"-").slice(0,19)}function Rp(e){return e.replace(/[^A-Za-z0-9_-]+/g,"_").slice(0,60)||"folder"}function ba(e,t,n,r){let o=oo(Io(e),Io(t),n,r),i=Je(qe(e),".nodata","receipts");ka(i,{recursive:!0});let s=Je(i,`redact-verify-${Date.now()}.json`);return Yn(s,JSON.stringify({action:"redact-verify",at:new Date().toISOString(),governed:"local",original:{path:yt(e)},clean:{path:yt(t)},...o},null,2)+`
-`),o.ok?{verification:o,receiptPath:s}:(wa(t,{force:!0}),{error:`The clean copy still held ${o.values_found} of the ${o.values_checked} hidden values, so it was removed \u2014 nothing was handed on. Receipt: ${Jt(s).href}`})}function va(e){let t=Pp(e).toLowerCase(),n=Io(e),r=t===".xlsx"||t===".xlsm"?jn(()=>Bt(n)):null,o=r?.result??null;if(o&&r){let f=Je(qe(e),`${yt(e,t)}.clean${t}`);Yn(f,o.bytes,{mode:384});let h=ba(e,f,t,r.replaced);return"error"in h?h:{outPath:f,result:{text:Se(o.bytes,t)?.text??"",counts:o.counts,columnsHidden:o.columnsHidden},note:"",...h}}let i=t===".xlsx"||t===".xlsm"?"This workbook has pivot tables, charts or external links, which keep their own copies of the values \u2014 the clean copy is plain text, not a workbook.":"",s=t||".txt",a;if(Cn.has(t)){let f=Se(n,t);if(!f)return{error:`Could not read the text of ${e}.`};a=f.text,s=".txt"}else a=n.toString("utf8");let{result:c,replaced:l}=jn(()=>t===".csv"||t===".tsv"?Lt(a,t===".tsv"?"	":void 0):pe(a)),u=Je(qe(e),`${yt(e,t)}.clean${s}`);Yn(u,c.text,{mode:384});let p=ba(e,u,s,l);return"error"in p?p:{outPath:u,result:c,note:i,...p}}async function Ao(e,t={}){let n=await Ft({target_id:"mcp",target_label:yt(e),target_path:e,log:Mt,...t}),r=!1;try{r=qt(e).isFile()}catch{}return ma(r?qe(e):e,n.findings,xe,e),n}function To(e,t){let n=e.slice(0,t).map(r=>`  ${String(r.total).padStart(6)}  ${r.worst.padEnd(8)}  ${r.key}`);return e.length>t&&n.push(`  \u2026 ${e.length-t} more in the full report`),n.join(`
-`)}function Dp(e,t,n,r){if(e.error)return`Could not scan ${e.target_path}: ${e.error}`;let o=["critical","high","medium","low","info"].filter(c=>t.bySeverity[c]).map(c=>`${t.bySeverity[c]} ${c}`).join(" \xB7 "),i=[`SCAN  ${e.target_path}`,`      ${r} \xB7 ran on this machine, nothing uploaded`,`      ${e.files_walked} files walked, ${e.files_inspected} inspected, ${e.duration_ms} ms`,"",`FOUND ${t.total} findings${o?" \u2014 "+o:""} in ${t.filesWithFindings.length} files`];t.total>0&&(i.push("","BY TYPE (all)",To(t.byType,100)),i.push("","BY FOLDER",To(t.byFolder,10)),i.push("","WORST FILES",To(t.byFile,12)));let s=e.coverage,a=[];return s?.hit_file_cap&&(a.push(`  \u26A0 stopped after ${s.max_files} files \u2014 NOT everything was scanned.`),s.not_reached?.length&&a.push(`    not reached: ${s.not_reached.join(", ")}`,"    \u2192 scan those folders on their own, or raise max_files (up to 50000).")),s?.hit_depth_cap&&a.push(`  \u26A0 folders deeper than ${s.max_depth} levels were not descended.`),s?.tool_dirs_skipped&&a.push(`  \xB7 skipped ${s.tool_dirs_skipped} tool / cache folder(s) \u2014 not your files: ${s.tool_dir_names.join(", ")} (include_tool_dirs: true to scan them).`),a.length&&i.push("","COVERAGE",...a),n&&i.push("","FULL REPORT (every finding, content-free) \u2014 open in a browser:",`  ${Jt(n).href}`),t.total>0&&i.push("","NEXT \u2014 same workspace:",`  \xB7 RECOMMEND a policy per file (you approve or change it):  nodata_plan path: "${e.target_path}"`,...e.findings.some(c=>c.finding_kind==="hardcoded_secret")?["  \xB7 LEAKED KEYS: nodata_plan also lists, per provider, where and how to replace each one \u2014 the step that actually stops their use."]:[],`  \xB7 LOCK the ${t.filesWithFindings.length} files with findings:  nodata_protect path: "${e.target_path}"   (asks before it changes anything)`,'  \xB7 WORK on a clean copy (values replaced by [CARD], [ID] \u2026):  nodata_redact path: "<file>"',"  \xB7 A database table instead of files:  nodata_register_table \u2192 nodata_grant"),i.join(`
-`)}function Sa(e,t,n=async()=>!1){ua(e,{who:t,scan:Ao,cleanCopy:va,ack:n}),e.registerTool("nodata_scan_folder",{description:"SEE what's sensitive. Scans a LOCAL folder for hardcoded secrets and unencrypted PII (checksum-validated Israeli ID, Luhn credit card, IBAN, phones), reading PDF and Office files too, entirely on this machine. Returns the WHOLE result \u2014 counts by type, by folder and by file \u2014 and writes a full content-free HTML report (every finding) to ~/.nodata/reports, with a link to open it. Then offers the next step in the same workspace: nodata_protect (lock the files with findings) or nodata_redact (a clean copy to work on). Call this when the user asks to scan/audit/check a folder.",inputSchema:{path:fe.string().optional().describe("Folder or single file to scan. Default: the directory the server runs in."),max_files:fe.number().int().min(1).max(5e4).optional().describe("Files to walk before stopping. Default 5000; raise it for a home folder or a large drive."),include_tool_dirs:fe.boolean().optional().describe("Also scan tool / cache folders (.cache, .cargo, editor extensions, AppData \u2026). Default false \u2014 they hold samples, not the user's files."),git_history:fe.boolean().optional().describe("Also check the folder's git history for secrets that were committed and later deleted (they stay in every clone). Content-free: rule, file, commit id.")}},async({path:i,max_files:s,include_tool_dirs:a,git_history:c})=>{let l=Jn((i??".").trim()||".");if(!zt(l))return ee(`Nothing found at: ${l}`);try{let u=await Ao(l,{max_files:s,include_tool_dirs:a}),p=We(u),f=null;u.error||(ka(_a,{recursive:!0}),f=Je(_a,`scan-${Rp(yt(l))}-${$p()}.html`),Yn(f,ro(u,p),{mode:384}));let h=c?ya(ga(qt(l).isDirectory()?l:qe(l))).join(`
-`):"";return ee(Dp(u,p,f,t())+(h?`
-${h}`:""))}catch(u){return ee(`Scan failed: ${u instanceof Error?u.message:String(u)}`,!0)}}),e.registerTool("nodata_protect",{description:"LOCK files: seal each one to this device's key as <file>.ndc (AES-256-GCM, the key never leaves this machine; the same format as `nodata protect`, so `nodata open` opens it too). Given a folder, seals only the files the scan finds exposure in; given a file, seals that file. ASKS FIRST: without confirm:true it only lists what would be sealed and changes nothing \u2014 show that list to the user and call again with confirm:true only after they approve. Writes a local receipt (hashes, seal ids) under <folder>/.nodata/receipts. remove:true also deletes the plaintext originals.",inputSchema:{path:fe.string().describe("File or folder to protect."),confirm:fe.boolean().optional().describe("true = do it. Omit to preview."),remove:fe.boolean().optional().describe("Delete the plaintext originals after sealing. Default false.")}},async({path:i,confirm:s,remove:a})=>{let c=Jn(i);if(!zt(c))return ee(`Not found: ${c}`,!0);let l=qt(c).isDirectory(),u;if(l?u=We(await Ao(c)).filesWithFindings.map(E=>Je(c,E)).filter(E=>zt(E)&&qt(E).isFile()&&!xe(E)):u=c.endsWith(".ndc")?[]:[c],u.length===0)return ee(`Nothing to seal in ${c} \u2014 no file with findings.`);if(!s){let k=u.slice(0,xo).map(E=>`  \xB7 ${E}`);return u.length>xo&&k.push(`  \u2026 and ${u.length-xo} more`),ee([`PREVIEW \u2014 nothing changed yet. ${t()}`,`Would seal ${u.length} file(s) to this device's key${a?" and DELETE the plaintext originals":" (originals kept)"}:`,...k,"","Ask the user to approve, then call nodata_protect again with confirm: true."].join(`
-`))}let{key:p,created:f}=he.ensureDeviceKey(),h=[];for(let k of u)h.push(await he.sealFile(k,p)),a&&wa(k);let _=l?c:qe(c),y=he.writeLocalReceipt(_,{action:"protect",kid:p.kid,removed_plaintext:!!a,files:h,extra:{approved_by:t(),surface:"mcp"}});return ee([`SEALED ${h.length} file(s) \u2014 ${t()}${f||pt()?`
-\u26A0 ${f?"A new device key was created. ":""}${ft()}`:""}`,`device key id: ${p.kid}`,a?"Plaintext originals deleted.":"Originals are still in place \u2014 run again with remove: true to leave only the sealed copies.",`Receipt (hashes + seal ids, content-free): ${Jt(y).href}`,'Open one again: nodata_open path: "<file>.ndc"'].join(`
-`))}),e.registerTool("nodata_open",{description:"RELEASE a sealed file: open <file>.ndc back to its original next to it (never overwrites), with this device's key, and check its hash matches what was sealed. ASKS FIRST: without confirm:true it only says what would be opened. Writes a local receipt.",inputSchema:{path:fe.string().describe("The .ndc file to open."),confirm:fe.boolean().optional().describe("true = open it. Omit to preview.")}},async({path:i,confirm:s})=>{let a=Jn(i),c=zt(a)?he.readManifest(a):null;if(!c)return ee(`Not a NoData sealed file: ${a}`,!0);if(!s)return ee(`PREVIEW \u2014 nothing changed yet. ${t()}
+`)}]};let k=[],R=[],T=[];for(let b of f){let w=So(a,b.file);if(!ia(w)){R.push(`  \u2717 ${b.file} \u2014 no longer there`);continue}if(b.chosen==="redact"||b.chosen==="both"){let x=t.cleanCopy(w);"error"in x?R.push(`  \u2717 ${b.file} \u2014 ${x.error}`):k.push(`  \u2713 ${b.file} \u2192 clean copy ${vo(a,x.outPath)} (checked: ${x.verification.values_found} of ${x.verification.values_checked} hidden values left in it)`)}(b.chosen==="protect"||b.chosen==="both")&&T.push(w),b.chosen==="keep"&&k.push(`  \xB7 ${b.file} \u2014 left as is (your choice)`)}let I="";if(T.length){let{key:b,created:w}=mt.ensureDeviceKey();(w||qe())&&k.push(`  \u26A0 ${w?"A new device key was created. ":""}${Je()}`);let x=[];for(let D of T)x.push(await mt.sealFile(D,b)),o&&cp(D),k.push(`  \u{1F512} ${vo(a,D)} \u2192 ${vo(a,D)}.ndc${o?" (original deleted)":""}`);let $=f.map(D=>({file:D.file,tier:D.tier,recommended:D.action,chosen:D.chosen}));I=mt.writeLocalReceipt(a,{action:"policy-apply",kid:b.kid,removed_plaintext:!!o,files:x,extra:{approved_by:t.who(),surface:"mcp",plan:$}})}for(let b of h)k.push(`  \u26A0 ${b.file} \u2014 kept "${b.action}": a folder rule cannot lower a ${b.tier.toLowerCase()} file; name it to change it`);let B=f.filter(b=>b.changed).length,L=await t.ack(`${f.length} files \xB7 ${B} changed by the user \xB7 ${T.length} locked`);return{content:[{type:"text",text:[`APPLIED the approved policy \u2014 ${t.who()}`,...k,...R,...da(c.findings),I?`Receipt (the plan, hashes, seal ids \u2014 no content): ${sa(I).href}`:"",`Approval kept in ~/.nodata/acks.jsonl${Ce(L)}.`].filter(Boolean).join(`
+`)}]}})}import{existsSync as Sp,mkdirSync as Ep,readFileSync as xp,statSync as Ao,writeFileSync as Ap}from"node:fs";import{homedir as fa}from"node:os";import{join as Eo}from"node:path";var ha=()=>Eo(fa(),".nodata","flagged.json"),Tp=5e3;function xo(e){let t=e.replace(/\\/g,"/");return process.platform==="win32"?t.toLowerCase():t}var gt=null;function ma(){let e=ha();try{if(!Sp(e))return{};let t=Ao(e).mtimeMs;if(gt&&gt.path===e&&gt.mtimeMs===t)return gt.store;let n=JSON.parse(xp(e,"utf8"));return gt={path:e,mtimeMs:t,store:n},n}catch{return{}}}function ga(e,t,n=()=>!1,r=e){try{let o=xo(r).replace(/\/+$/,""),i=ma();for(let a of Object.keys(i))(a===o||a.startsWith(o+"/"))&&delete i[a];for(let a of t){if(a.severity!=="critical"&&a.severity!=="high")continue;let c=Eo(e,a.relative_path);if(n(c))continue;let l=xo(c),d=0;try{d=Ao(c).mtimeMs}catch{continue}let p=i[l]??{mtimeMs:d,kinds:{}},f=a.finding_subkind||a.finding_kind;p.kinds[f]=(p.kinds[f]??0)+1,i[l]=p}let s=Object.keys(i);for(let a of s.slice(0,Math.max(0,s.length-Tp)))delete i[a];Ep(Eo(fa(),".nodata"),{recursive:!0}),Ap(ha(),JSON.stringify(i)+`
+`,{mode:384}),gt=null}catch{}}function Jn(e){let t=ma()[xo(e)];if(!t)return null;try{if(Ao(e).mtimeMs>t.mtimeMs+1e3)return null}catch{return null}return t.kinds}import{execFileSync as Ip}from"node:child_process";var $p=500;function ya(e,t=$p){let n=d=>Ip("git",["-C",e,...d],{encoding:"utf8",timeout:6e4,maxBuffer:536870912,stdio:["ignore","pipe","ignore"]}),r;try{r=n(["log","--all","-p","--no-color","--unified=0",`-n${t}`,"--format=commit %h"])}catch{return{ok:!1,commitsScanned:0,hits:[],reason:"not a git repository, or git is not installed"}}let o=ct(),i=new Set,s=[],a="",c="",l=0;for(let d of r.split(`
+`)){if(d.startsWith("commit ")){a=d.slice(7).trim(),l++;continue}if(d.startsWith("+++ ")){c=d.startsWith("+++ b/")?d.slice(6):"";continue}if(!c||!d.startsWith("+")||d.startsWith("+++"))continue;let p=d.slice(1);if(!/process\.env|\$\{[A-Z_]+/.test(p))for(let f of o){if(!f.pattern.test(p))continue;let h=`${f.id}::${c}`;i.has(h)||(i.add(h),s.push({rule:f.id,file:c,commit:a,removedSince:!1}));break}}for(let d of s)try{let p=n(["show",`HEAD:${d.file}`]),f=o.find(h=>h.id===d.rule);d.removedSince=!f||!p.split(`
+`).some(h=>f.pattern.test(h))}catch{d.removedSince=!0}return{ok:!0,commitsScanned:l,hits:s}}function _a(e){if(!e.ok)return["",`GIT HISTORY \u2014 not checked: ${e.reason}.`];if(!e.hits.length)return["",`GIT HISTORY \u2014 ${e.commitsScanned} commit(s) checked: no secret was ever committed.`];let t=e.hits.filter(n=>n.removedSince);return["",`GIT HISTORY \u2014 ${e.hits.length} secret(s) committed in the last ${e.commitsScanned} commit(s)${t.length?`; ${t.length} of them deleted since, but still in every clone`:""}:`,...e.hits.slice(0,30).map(n=>`  ${n.removedSince?"\u{1F573}":"\u25A0"} ${n.rule} \xB7 ${n.file} \xB7 first seen in ${n.commit}${n.removedSince?" (gone from the code, not from history)":""}`),...e.hits.length>30?[`  \u2026 +${e.hits.length-30} more`]:[],"  Every one of these keys has to be REPLACED at its provider \u2014 deleting the line does not help. Rewriting history (git filter-repo) is a separate decision for the repository's owner."]}var Q=(e,t=!1)=>({content:[{type:"text",text:e}],...t?{isError:t}:{}}),ba=Xe(Pp(),".nodata","reports"),To=25;function Dp(){return new Date().toISOString().replace(/[:.]/g,"-").slice(0,19)}function Cp(e){return e.replace(/[^A-Za-z0-9_-]+/g,"_").slice(0,60)||"folder"}function va(e,t,n,r){let o=so(Po(e),Po(t),n,r),i=Xe(Ye(e),".nodata","receipts");wa(i,{recursive:!0});let s=Xe(i,`redact-verify-${Date.now()}.json`);return Xn(s,JSON.stringify({action:"redact-verify",at:new Date().toISOString(),governed:"local",original:{path:yt(e)},clean:{path:yt(t)},...o},null,2)+`
+`),o.ok?{verification:o,receiptPath:s}:(Sa(t,{force:!0}),{error:`The clean copy still held ${o.values_found} of the ${o.values_checked} hidden values, so it was removed \u2014 nothing was handed on. Receipt: ${Yt(s).href}`})}function ka(e){let t=Rp(e).toLowerCase(),n=Po(e),r=t===".xlsx"||t===".xlsm"?Bn(()=>Bt(n)):null,o=r?.result??null;if(o&&r){let f=Xe(Ye(e),`${yt(e,t)}.clean${t}`);Xn(f,o.bytes,{mode:384});let h=va(e,f,t,r.replaced);return"error"in h?h:{outPath:f,result:{text:Se(o.bytes,t)?.text??"",counts:o.counts,columnsHidden:o.columnsHidden},note:"",...h}}let i=t===".xlsx"||t===".xlsm"?"This workbook has pivot tables, charts or external links, which keep their own copies of the values \u2014 the clean copy is plain text, not a workbook.":"",s=t||".txt",a;if(On.has(t)){let f=Se(n,t);if(!f)return{error:`Could not read the text of ${e}.`};a=f.text,s=".txt"}else a=n.toString("utf8");let{result:c,replaced:l}=Bn(()=>t===".csv"||t===".tsv"?Lt(a,t===".tsv"?"	":void 0):pe(a)),d=Xe(Ye(e),`${yt(e,t)}.clean${s}`);Xn(d,c.text,{mode:384});let p=va(e,d,s,l);return"error"in p?p:{outPath:d,result:c,note:i,...p}}async function Io(e,t={}){let n=await Ft({target_id:"mcp",target_label:yt(e),target_path:e,log:Mt,...t}),r=!1;try{r=Jt(e).isFile()}catch{}return ga(r?Ye(e):e,n.findings,xe,e),n}function $o(e,t){let n=e.slice(0,t).map(r=>`  ${String(r.total).padStart(6)}  ${r.worst.padEnd(8)}  ${r.key}`);return e.length>t&&n.push(`  \u2026 ${e.length-t} more in the full report`),n.join(`
+`)}function Np(e,t,n,r){if(e.error)return`Could not scan ${e.target_path}: ${e.error}`;let o=["critical","high","medium","low","info"].filter(c=>t.bySeverity[c]).map(c=>`${t.bySeverity[c]} ${c}`).join(" \xB7 "),i=[`SCAN  ${e.target_path}`,`      ${r} \xB7 ran on this machine, nothing uploaded`,`      ${e.files_walked} files walked, ${e.files_inspected} inspected, ${e.duration_ms} ms`,"",`FOUND ${t.total} findings${o?" \u2014 "+o:""} in ${t.filesWithFindings.length} files`];t.total>0&&(i.push("","BY TYPE (all)",$o(t.byType,100)),i.push("","BY FOLDER",$o(t.byFolder,10)),i.push("","WORST FILES",$o(t.byFile,12)));let s=e.coverage,a=[];return s?.hit_file_cap&&(a.push(`  \u26A0 stopped after ${s.max_files} files \u2014 NOT everything was scanned.`),s.not_reached?.length&&a.push(`    not reached: ${s.not_reached.join(", ")}`,"    \u2192 scan those folders on their own, or raise max_files (up to 50000).")),s?.documents_unreadable&&a.push(`  \u26A0 ${s.documents_unreadable} document(s) could NOT be read (a scan, encryption, or a font without a usable map) \u2014 NOT checked; "0 findings" does not cover them. Treat them as sensitive: lock them, or check them by hand:`,...(s.unreadable_files??[]).slice(0,20).map(c=>`      ${c}`),...(s.unreadable_files?.length??0)>20?[`      \u2026 +${s.unreadable_files.length-20} more`]:[]),s?.hit_depth_cap&&a.push(`  \u26A0 folders deeper than ${s.max_depth} levels were not descended.`),s?.tool_dirs_skipped&&a.push(`  \xB7 skipped ${s.tool_dirs_skipped} tool / cache folder(s) \u2014 not your files: ${s.tool_dir_names.join(", ")} (include_tool_dirs: true to scan them).`),a.length&&i.push("","COVERAGE",...a),n&&i.push("","FULL REPORT (every finding, content-free) \u2014 open in a browser:",`  ${Yt(n).href}`),t.total>0&&i.push("","NEXT \u2014 same workspace:",`  \xB7 RECOMMEND a policy per file (you approve or change it):  nodata_plan path: "${e.target_path}"`,...e.findings.some(c=>c.finding_kind==="hardcoded_secret")?["  \xB7 LEAKED KEYS: nodata_plan also lists, per provider, where and how to replace each one \u2014 the step that actually stops their use."]:[],`  \xB7 LOCK the ${t.filesWithFindings.length} files with findings:  nodata_protect path: "${e.target_path}"   (asks before it changes anything)`,'  \xB7 WORK on a clean copy (values replaced by [CARD], [ID] \u2026):  nodata_redact path: "<file>"',"  \xB7 A database table instead of files:  nodata_register_table \u2192 nodata_grant"),i.join(`
+`)}function Ea(e,t,n=async()=>!1){pa(e,{who:t,scan:Io,cleanCopy:ka,ack:n}),e.registerTool("nodata_scan_folder",{description:"SEE what's sensitive. Scans a LOCAL folder for hardcoded secrets and unencrypted PII (checksum-validated Israeli ID, Luhn credit card, IBAN, phones), reading PDF and Office files too, entirely on this machine. Returns the WHOLE result \u2014 counts by type, by folder and by file \u2014 and writes a full content-free HTML report (every finding) to ~/.nodata/reports, with a link to open it. Then offers the next step in the same workspace: nodata_protect (lock the files with findings) or nodata_redact (a clean copy to work on). Call this when the user asks to scan/audit/check a folder.",inputSchema:{path:fe.string().optional().describe("Folder or single file to scan. Default: the directory the server runs in."),max_files:fe.number().int().min(1).max(5e4).optional().describe("Files to walk before stopping. Default 5000; raise it for a home folder or a large drive."),include_tool_dirs:fe.boolean().optional().describe("Also scan tool / cache folders (.cache, .cargo, editor extensions, AppData \u2026). Default false \u2014 they hold samples, not the user's files."),git_history:fe.boolean().optional().describe("Also check the folder's git history for secrets that were committed and later deleted (they stay in every clone). Content-free: rule, file, commit id.")}},async({path:i,max_files:s,include_tool_dirs:a,git_history:c})=>{let l=Yn((i??".").trim()||".");if(!qt(l))return Q(`Nothing found at: ${l}`);try{let d=await Io(l,{max_files:s,include_tool_dirs:a}),p=We(d),f=null;d.error||(wa(ba,{recursive:!0}),f=Xe(ba,`scan-${Cp(yt(l))}-${Dp()}.html`),Xn(f,io(d,p),{mode:384}));let h=c?_a(ya(Jt(l).isDirectory()?l:Ye(l))).join(`
+`):"";return Q(Np(d,p,f,t())+(h?`
+${h}`:""))}catch(d){return Q(`Scan failed: ${d instanceof Error?d.message:String(d)}`,!0)}}),e.registerTool("nodata_protect",{description:"LOCK files: seal each one to this device's key as <file>.ndc (AES-256-GCM, the key never leaves this machine; the same format as `nodata protect`, so `nodata open` opens it too). Given a folder, seals only the files the scan finds exposure in; given a file, seals that file. ASKS FIRST: without confirm:true it only lists what would be sealed and changes nothing \u2014 show that list to the user and call again with confirm:true only after they approve. Writes a local receipt (hashes, seal ids) under <folder>/.nodata/receipts. remove:true also deletes the plaintext originals.",inputSchema:{path:fe.string().describe("File or folder to protect."),confirm:fe.boolean().optional().describe("true = do it. Omit to preview."),remove:fe.boolean().optional().describe("Delete the plaintext originals after sealing. Default false.")}},async({path:i,confirm:s,remove:a})=>{let c=Yn(i);if(!qt(c))return Q(`Not found: ${c}`,!0);let l=Jt(c).isDirectory(),d,p=0;if(l){let E=await Io(c),P=We(E),N=E.coverage?.unreadable_files??[];p=N.length,d=[...new Set([...P.filesWithFindings,...N])].map(m=>Xe(c,m)).filter(m=>qt(m)&&Jt(m).isFile()&&!xe(m))}else d=c.endsWith(".ndc")?[]:[c];if(d.length===0)return Q(`Nothing to seal in ${c} \u2014 no file with findings, and none the scan could not read.`);if(a&&qe())return Q(`NOT done \u2014 the originals would be deleted, but the device key that opens the sealed copies has no confirmed backup. First ${Je()} Then ask again.`,!0);if(!s){let E=d.slice(0,To).map(P=>`  \xB7 ${P}`);return d.length>To&&E.push(`  \u2026 and ${d.length-To} more`),Q([`PREVIEW \u2014 nothing changed yet. ${t()}`,`Would seal ${d.length} file(s) to this device's key${a?" and DELETE the plaintext originals":" (originals kept)"}${p?` \u2014 including ${p} the scan could not read (unchecked, so treated as sensitive)`:""}:`,...E,"","Ask the user to approve, then call nodata_protect again with confirm: true."].join(`
+`))}let{key:f,created:h}=he.ensureDeviceKey(),y=[];for(let E of d)y.push(await he.sealFile(E,f)),a&&Sa(E);let _=l?c:Ye(c),S=he.writeLocalReceipt(_,{action:"protect",kid:f.kid,removed_plaintext:!!a,files:y,extra:{approved_by:t(),surface:"mcp"}});return Q([`SEALED ${y.length} file(s) \u2014 ${t()}${h||qe()?`
+\u26A0 ${h?"A new device key was created. ":""}${Je()}`:""}`,`device key id: ${f.kid}`,a?"Plaintext originals deleted.":"Originals are still in place \u2014 run again with remove: true to leave only the sealed copies.",`Receipt (hashes + seal ids, content-free): ${Yt(S).href}`,'Open one again: nodata_open path: "<file>.ndc"'].join(`
+`))}),e.registerTool("nodata_open",{description:"RELEASE a sealed file: open <file>.ndc back to its original next to it (never overwrites), with this device's key, and check its hash matches what was sealed. ASKS FIRST: without confirm:true it only says what would be opened. Writes a local receipt.",inputSchema:{path:fe.string().describe("The .ndc file to open."),confirm:fe.boolean().optional().describe("true = open it. Omit to preview.")}},async({path:i,confirm:s})=>{let a=Yn(i),c=qt(a)?he.readManifest(a):null;if(!c)return Q(`Not a NoData sealed file: ${a}`,!0);if(!s)return Q(`PREVIEW \u2014 nothing changed yet. ${t()}
 Would open "${c.orig}" (sealed ${c.sealed_at}, device key ${c.kid}) as plaintext next to ${a}.
-Ask the user to approve, then call nodata_open again with confirm: true.`);let l=await he.openFile(a);if(!l.ok){let p=l.error==="wrong_key"?"this device's key is not the one it was sealed to":l.error==="no_device_key"?"this machine has no device key (~/.nodata/device-key.json)":l.error;return ee(`Could not open ${a}: ${p}.`,!0)}let u=he.writeLocalReceipt(qe(a),{action:"open",kid:c.kid,removed_plaintext:!1,files:[{path:l.outPath,ndc:a,sha256:l.sha256,sealId:c.token.split(":").pop()??""}],extra:{approved_by:t(),surface:"mcp",hash_matches:l.intact}});return ee([`OPENED ${l.outPath} \u2014 ${t()}`,l.intact?"Hash matches what was sealed \u2014 the file is unaltered.":"WARNING: hash differs from the sealed record.",`Receipt: ${Jt(u).href}`].join(`
-`))}),e.registerTool("nodata_redact",{description:"WORK on the rest: make a clean copy of a file with every sensitive value replaced by a typed token ([CARD], [ID], [IBAN], [PHONE], [EMAIL]); in CSV/TSV and Excel a column whose header names personal data (name, address, account number\u2026) is replaced whole with one stable token per value ([NAME-1], [NAME-2] \u2026 \u2014 the same person keeps the same token), so rows and columns still line up and still group by person. Columns of amounts stay whole. Same detectors as the scan. In Excel (.xlsx) the same column rule applies per sheet and the copy stays a workbook with its formatting. The original is untouched; the copy is written next to it as <name>.clean.<ext> (Word/PowerPoint/PDF \u2192 .clean.txt). return_text:true also returns the clean text (up to 60 KB) so it can be analysed right here \u2014 it contains no detected value. ON SCREEN: someone may be sitting next to the user. Answer with totals, counts and summaries by default; ask before printing rows or individual values, even from the clean copy (a value the detectors did not recognise is still in it).",inputSchema:{path:fe.string().describe("The file to redact (csv, tsv, txt, md, json, log, docx, xlsx, pptx, pdf)."),return_text:fe.boolean().optional().describe("Also return the clean text for analysis.")}},async({path:i,return_text:s})=>{let a=Jn(i);if(!zt(a)||!qt(a).isFile())return ee(`Not a file: ${a}`,!0);let c=va(a);if("error"in c)return ee(c.error,!0);let l=c.verification,u=await n(`redact-verify \xB7 ${l.values_checked} values checked \xB7 ${l.values_found} found \xB7 clean ${l.clean_sha256.slice(0,16)}`);return ee(o(c.outPath,c.result,s,c.note)+`
+Ask the user to approve, then call nodata_open again with confirm: true.`);let l=await he.openFile(a);if(!l.ok){let p=l.error==="wrong_key"?"this device's key is not the one it was sealed to":l.error==="no_device_key"?"this machine has no device key (~/.nodata/device-key.json)":l.error;return Q(`Could not open ${a}: ${p}.`,!0)}let d=he.writeLocalReceipt(Ye(a),{action:"open",kid:c.kid,removed_plaintext:!1,files:[{path:l.outPath,ndc:a,sha256:l.sha256,sealId:c.token.split(":").pop()??""}],extra:{approved_by:t(),surface:"mcp",hash_matches:l.intact}});return Q([`OPENED ${l.outPath} \u2014 ${t()}`,l.intact?"Hash matches what was sealed \u2014 the file is unaltered.":"WARNING: hash differs from the sealed record.",`Receipt: ${Yt(d).href}`].join(`
+`))}),e.registerTool("nodata_redact",{description:"WORK on the rest: make a clean copy of a file with every sensitive value replaced by a typed token ([CARD], [ID], [IBAN], [PHONE], [EMAIL]); in CSV/TSV and Excel a column whose header names personal data (name, address, account number\u2026) is replaced whole with one stable token per value ([NAME-1], [NAME-2] \u2026 \u2014 the same person keeps the same token), so rows and columns still line up and still group by person. Columns of amounts stay whole. Same detectors as the scan. In Excel (.xlsx) the same column rule applies per sheet and the copy stays a workbook with its formatting. The original is untouched; the copy is written next to it as <name>.clean.<ext> (Word/PowerPoint/PDF \u2192 .clean.txt). return_text:true also returns the clean text (up to 60 KB) so it can be analysed right here \u2014 it contains no detected value. ON SCREEN: someone may be sitting next to the user. Answer with totals, counts and summaries by default; ask before printing rows or individual values, even from the clean copy (a value the detectors did not recognise is still in it).",inputSchema:{path:fe.string().describe("The file to redact (csv, tsv, txt, md, json, log, docx, xlsx, pptx, pdf)."),return_text:fe.boolean().optional().describe("Also return the clean text for analysis.")}},async({path:i,return_text:s})=>{let a=Yn(i);if(!qt(a)||!Jt(a).isFile())return Q(`Not a file: ${a}`,!0);let c=ka(a);if("error"in c)return Q(c.error,!0);let l=c.verification,d=await n(`redact-verify \xB7 ${l.values_checked} values checked \xB7 ${l.values_found} found \xB7 clean ${l.clean_sha256.slice(0,16)}`);return Q(o(c.outPath,c.result,s,c.note)+`
 
-`+r(c,u))});function r(i,s){let a=i.verification;return["PROOF \u2014 the copy was checked before it was kept:",`  ${a.values_checked} hidden values searched in all ${a.parts_searched} part(s) of the clean file \u2192 ${a.values_found} found.`+(a.values_too_short_to_check?` (${a.values_too_short_to_check} too short to search reliably.)`:""),`  Re-scan of the clean text: ${a.rescan_hits===0?"no validated value":`${a.rescan_hits} validated-looking value(s) \u2014 amounts the amount rule keeps can pass a check digit; review if unexpected`}.`,`  Fingerprints (SHA-256): original ${a.original_sha256.slice(0,16)}\u2026 \xB7 clean ${a.clean_sha256.slice(0,16)}\u2026`,`  Receipt: ${Jt(i.receiptPath).href}${Ce(s)}`,"  Limit: proves the copy holds none of the values the detectors found; a value they did not recognise was never hidden."].join(`
-`)}function o(i,s,a,c=""){let l=Object.entries(s.counts).sort((p,f)=>f[1]-p[1]).map(([p,f])=>`  ${String(f).padStart(6)}  ${p}`),u=[`CLEAN COPY ${i} \u2014 ${t()} \xB7 original untouched`,c,l.length?`Replaced:
+`+r(c,d))});function r(i,s){let a=i.verification;return["PROOF \u2014 the copy was checked before it was kept:",`  ${a.values_checked} hidden values searched in all ${a.parts_searched} part(s) of the clean file \u2192 ${a.values_found} found.`+(a.values_too_short_to_check?` (${a.values_too_short_to_check} too short to search reliably.)`:""),`  Re-scan of the clean text: ${a.rescan_hits===0?"no validated value":`${a.rescan_hits} validated-looking value(s) \u2014 amounts the amount rule keeps can pass a check digit; review if unexpected`}.`,`  Fingerprints (SHA-256): original ${a.original_sha256.slice(0,16)}\u2026 \xB7 clean ${a.clean_sha256.slice(0,16)}\u2026`,`  Receipt: ${Yt(i.receiptPath).href}${Ce(s)}`,"  Limit: proves the copy holds none of the values the detectors found; a value they did not recognise was never hidden."].join(`
+`)}function o(i,s,a,c=""){let l=Object.entries(s.counts).sort((p,f)=>f[1]-p[1]).map(([p,f])=>`  ${String(f).padStart(6)}  ${p}`),d=[`CLEAN COPY ${i} \u2014 ${t()} \xB7 original untouched`,c,l.length?`Replaced:
 ${l.join(`
-`)}`:"Nothing sensitive detected \u2014 the copy equals the original text.",s.columnsHidden.length?`Columns hidden whole: ${s.columnsHidden.join(", ")}`:""].filter(Boolean);return a&&u.push("",`--- clean text${s.text.length>6e4?" (first 60000 chars)":""} ---`,s.text.slice(0,6e4)),u.join(`
-`)}}var yr=Lr(Nc(),1);import{z as rt}from"zod";import{createHash as Gh}from"node:crypto";import{existsSync as ri,mkdirSync as Wh,readFileSync as Fc,readdirSync as zh,statSync as Oc,writeFileSync as qh}from"node:fs";import{homedir as Jh}from"node:os";import{basename as ni,extname as Yh,join as Mc,resolve as Xh}from"node:path";var re=(e,t=!1)=>({content:[{type:"text",text:e}],...t?{isError:t}:{}}),gr=Mc(Jh(),".nodata","shares"),Zh=12*1024*1024,Qh={".pdf":"application/pdf",".txt":"text/plain",".csv":"text/csv",".md":"text/markdown",".json":"application/json",".png":"image/png",".jpg":"image/jpeg",".jpeg":"image/jpeg",".docx":"application/vnd.openxmlformats-officedocument.wordprocessingml.document",".xlsx":"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",".pptx":"application/vnd.openxmlformats-officedocument.presentationml.presentation"};function Kc(e){return Mc(gr,`${e.replace(/[^a-f0-9]/gi,"")}.json`)}function jc(e){let t=Kc(e);if(!ri(t))return null;try{return JSON.parse(Fc(t,"utf8"))}catch{return null}}function Lc(e){let t=e.match(/\/lock\/open\/([a-f0-9]{8,64})/i);return(t?t[1]:e.trim()).toLowerCase()}async function Bc(e,t,n){let r=await fetch(e,{method:"POST",headers:{"content-type":"application/json",...n?{authorization:`Bearer ${n}`}:{}},body:JSON.stringify(t)});return{status:r.status,body:await r.json().catch(()=>({}))}}function Hc(e,t,n,r){e.registerTool("nodata_send",{description:"SEND a file as a governed link: encrypted on this machine (post-quantum hybrid), stored by NoData only as ciphertext \u2014 the key rides in the link's #fragment, which NoData never receives. Expires after ttl and after max_opens opens; can be burned (nodata_burn) at any time, after which nobody can open it again. Filed under your organization with a signed receipt and a proof_url. ASKS FIRST: without confirm:true it only shows what would be sent. Returns the link to hand to the recipient.",inputSchema:{path:rt.string().describe("The file to send (up to 12 MB)."),ttl_hours:rt.number().optional().describe("Hours until the link expires. Default 72, max 168 (7 days)."),max_opens:rt.number().optional().describe("Opens allowed before it burns itself. Default 3, max 1000."),confirm:rt.boolean().optional().describe("true = send it. Omit to preview.")}},async({path:o,ttl_hours:i,max_opens:s,confirm:a})=>{let c=Xh(o);if(!ri(c)||!Oc(c).isFile())return re(`Not a file: ${c}`,!0);let l=Oc(c).size;if(l>Zh)return re(`${ni(c)} is ${(l/1048576).toFixed(1)} MB; a governed link carries up to 12 MB.`,!0);let u=Math.round(Math.min(Math.max(i??72,1/60),168)*3600),p=Math.round(Math.min(Math.max(s??3,1),1e3));if(!a)return re([`PREVIEW \u2014 nothing sent yet. ${r()}`,`Would send "${ni(c)}" (${(l/1024).toFixed(1)} KB) as a governed link:`,"  \xB7 encrypted here; NoData stores only ciphertext and never gets the key",`  \xB7 expires in ${(u/3600).toFixed(u<3600?2:0)} h, or after ${p} open(s)`,"  \xB7 revocable any time with nodata_burn; every open is counted","","Ask the user to approve, then call nodata_send again with the same arguments and confirm: true."].join(`
-`));let f=Fc(c),h=ni(c),_=Qh[Yh(c).toLowerCase()]??"application/octet-stream",y=await(0,yr.sealBytesForPublicShare)({bytes:f,filename:h,contentType:_,ttlSeconds:u,server:t}),k=await(0,yr.wrapFragmentForShortLink)(y.fragment),E;try{E=await Bc(`${t}/api/lock/public/issue`,{formatVersion:3,lockboxId:y.lockboxId,containerB64:Buffer.from(y.container).toString("base64"),filename:h,contentType:_,ttlSeconds:u,maxOpens:p,wrappedFragmentB64:k.wrappedFragmentB64,wrapIvB64:k.wrapIvB64},await n())}catch(m){return re(`Could not reach NoData: ${m instanceof Error?m.message:String(m)}`,!0)}if(E.status>=400||E.body.ok!==!0)return re(`Send refused (HTTP ${E.status}): ${JSON.stringify(E.body)}`,!0);let R=String(E.body.id),B={id:R,file:c,filename:h,sha256:Gh("sha256").update(f).digest("hex"),link:`${t}/lock/open/${R}#${k.wrapKeyB64Url}`,wrap_key_b64url:k.wrapKeyB64Url,expires_at:String(E.body.expiresAt??""),max_opens:p,sent_by:r(),sent_at:new Date().toISOString(),receipt_id:E.body.receipt_id??null,proof_url:E.body.proof_url??null};return Wh(gr,{recursive:!0}),qh(Kc(R),JSON.stringify(B,null,2)+`
-`,{mode:384}),re([`SENT "${h}" \u2014 ${r()}`,"Link (give this to the recipient; anyone holding it can open it until it expires or is burned):",`  ${B.link}`,`Expires ${B.expires_at} \xB7 max ${p} open(s) \xB7 id ${R}`,B.proof_url?`Proof (signed receipt, public): ${B.proof_url}`:"No receipt: the link was not attributed to an organization.",`Check it: nodata_link_status id: "${R}"  \xB7  Revoke it: nodata_burn id: "${R}"`].join(`
-`))}),e.registerTool("nodata_link_status",{description:"STATUS of links sent with nodata_send: opens so far, expiry, whether burned. Pass an id or link for one; omit to list every link sent from this machine.",inputSchema:{id:rt.string().optional().describe("Share id or /lock/open link. Omit to list all.")}},async({id:o})=>{let i=o?[Lc(o)]:ri(gr)?zh(gr).filter(a=>a.endsWith(".json")).map(a=>a.slice(0,-5)):[];if(i.length===0)return re("No links sent from this machine yet. Send one with nodata_send.");let s=[`LINKS \u2014 ${r()}`];for(let a of i.slice(0,50)){let c=jc(a),l={};try{let p=await fetch(`${t}/api/lock/public/status/${a}`);l=await p.json().catch(()=>({})),p.status===404&&(l={missing:!0})}catch{l={unreachable:!0}}let u=l.missing?"not found":l.unreachable?"status unavailable":l.burned?"BURNED":l.expired?"expired":"live";s.push(`  ${a}  ${u.padEnd(10)} opens ${l.openCount??"?"}/${l.maxOpens??c?.max_opens??"?"}  expires ${l.expiresAt??c?.expires_at??"?"}  ${c?c.filename:""}`)}return re(s.join(`
-`))}),e.registerTool("nodata_burn",{description:"BURN a link sent with nodata_send: the stored ciphertext is zeroed, so nobody \u2014 the recipient, a forwarded copy, NoData \u2014 can open it again. Irreversible. ASKS FIRST: without confirm:true it only says what would be burned. Returns the signed burn receipt and its proof_url.",inputSchema:{id:rt.string().describe("Share id or the /lock/open link."),confirm:rt.boolean().optional().describe("true = burn it. Omit to preview.")}},async({id:o,confirm:i})=>{let s=Lc(o),a=o.match(/#([A-Za-z0-9_-]{43})/)?.[1],c=jc(s),l=c?.wrap_key_b64url??a;if(!l)return re(`No burn key for ${s} on this machine. Pass the full link (it carries the key after #), or burn it from the machine that sent it.`,!0);if(!i)return re(`PREVIEW \u2014 nothing burned yet. ${r()}
+`)}`:"Nothing sensitive detected \u2014 the copy equals the original text.",s.columnsHidden.length?`Columns hidden whole: ${s.columnsHidden.join(", ")}`:""].filter(Boolean);return a&&d.push("",`--- clean text${s.text.length>6e4?" (first 60000 chars)":""} ---`,s.text.slice(0,6e4)),d.join(`
+`)}}var _r=Br(Oc(),1);import{z as it}from"zod";import{createHash as zh}from"node:crypto";import{existsSync as ii,mkdirSync as qh,readFileSync as Mc,readdirSync as Jh,statSync as jc,writeFileSync as Yh}from"node:fs";import{homedir as Xh}from"node:os";import{basename as oi,extname as Zh,join as Kc,resolve as Qh}from"node:path";var re=(e,t=!1)=>({content:[{type:"text",text:e}],...t?{isError:t}:{}}),yr=Kc(Xh(),".nodata","shares"),em=12*1024*1024,tm={".pdf":"application/pdf",".txt":"text/plain",".csv":"text/csv",".md":"text/markdown",".json":"application/json",".png":"image/png",".jpg":"image/jpeg",".jpeg":"image/jpeg",".docx":"application/vnd.openxmlformats-officedocument.wordprocessingml.document",".xlsx":"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",".pptx":"application/vnd.openxmlformats-officedocument.presentationml.presentation"};function Hc(e){return Kc(yr,`${e.replace(/[^a-f0-9]/gi,"")}.json`)}function Lc(e){let t=Hc(e);if(!ii(t))return null;try{return JSON.parse(Mc(t,"utf8"))}catch{return null}}function Bc(e){let t=e.match(/\/lock\/open\/([a-f0-9]{8,64})/i);return(t?t[1]:e.trim()).toLowerCase()}async function Fc(e,t,n){let r=await fetch(e,{method:"POST",headers:{"content-type":"application/json",...n?{authorization:`Bearer ${n}`}:{}},body:JSON.stringify(t)});return{status:r.status,body:await r.json().catch(()=>({}))}}function Uc(e,t,n,r){e.registerTool("nodata_send",{description:"SEND a file as a governed link: encrypted on this machine (post-quantum hybrid), stored by NoData only as ciphertext \u2014 the key rides in the link's #fragment, which NoData never receives. Expires after ttl and after max_opens opens; can be burned (nodata_burn) at any time, after which nobody can open it again. Filed under your organization with a signed receipt and a proof_url. ASKS FIRST: without confirm:true it only shows what would be sent. Returns the link to hand to the recipient.",inputSchema:{path:it.string().describe("The file to send (up to 12 MB)."),ttl_hours:it.number().optional().describe("Hours until the link expires. Default 72, max 168 (7 days)."),max_opens:it.number().optional().describe("Opens allowed before it burns itself. Default 3, max 1000."),confirm:it.boolean().optional().describe("true = send it. Omit to preview.")}},async({path:o,ttl_hours:i,max_opens:s,confirm:a})=>{let c=Qh(o);if(!ii(c)||!jc(c).isFile())return re(`Not a file: ${c}`,!0);let l=jc(c).size;if(l>em)return re(`${oi(c)} is ${(l/1048576).toFixed(1)} MB; a governed link carries up to 12 MB.`,!0);let d=Math.round(Math.min(Math.max(i??72,1/60),168)*3600),p=Math.round(Math.min(Math.max(s??3,1),1e3));if(!a)return re([`PREVIEW \u2014 nothing sent yet. ${r()}`,`Would send "${oi(c)}" (${(l/1024).toFixed(1)} KB) as a governed link:`,"  \xB7 encrypted here; NoData stores only ciphertext and never gets the key",`  \xB7 expires in ${(d/3600).toFixed(d<3600?2:0)} h, or after ${p} open(s)`,"  \xB7 revocable any time with nodata_burn; every open is counted","","Ask the user to approve, then call nodata_send again with the same arguments and confirm: true."].join(`
+`));let f=Mc(c),h=oi(c),y=tm[Zh(c).toLowerCase()]??"application/octet-stream",_=await(0,_r.sealBytesForPublicShare)({bytes:f,filename:h,contentType:y,ttlSeconds:d,server:t}),S=await(0,_r.wrapFragmentForShortLink)(_.fragment),E;try{E=await Fc(`${t}/api/lock/public/issue`,{formatVersion:3,lockboxId:_.lockboxId,containerB64:Buffer.from(_.container).toString("base64"),filename:h,contentType:y,ttlSeconds:d,maxOpens:p,wrappedFragmentB64:S.wrappedFragmentB64,wrapIvB64:S.wrapIvB64},await n())}catch(m){return re(`Could not reach NoData: ${m instanceof Error?m.message:String(m)}`,!0)}if(E.status>=400||E.body.ok!==!0)return re(`Send refused (HTTP ${E.status}): ${JSON.stringify(E.body)}`,!0);let P=String(E.body.id),N={id:P,file:c,filename:h,sha256:zh("sha256").update(f).digest("hex"),link:`${t}/lock/open/${P}#${S.wrapKeyB64Url}`,wrap_key_b64url:S.wrapKeyB64Url,expires_at:String(E.body.expiresAt??""),max_opens:p,sent_by:r(),sent_at:new Date().toISOString(),receipt_id:E.body.receipt_id??null,proof_url:E.body.proof_url??null};return qh(yr,{recursive:!0}),Yh(Hc(P),JSON.stringify(N,null,2)+`
+`,{mode:384}),re([`SENT "${h}" \u2014 ${r()}`,"Link (give this to the recipient; anyone holding it can open it until it expires or is burned):",`  ${N.link}`,`Expires ${N.expires_at} \xB7 max ${p} open(s) \xB7 id ${P}`,N.proof_url?`Proof (signed receipt, public): ${N.proof_url}`:"No receipt: the link was not attributed to an organization.",`Check it: nodata_link_status id: "${P}"  \xB7  Revoke it: nodata_burn id: "${P}"`].join(`
+`))}),e.registerTool("nodata_link_status",{description:"STATUS of links sent with nodata_send: opens so far, expiry, whether burned. Pass an id or link for one; omit to list every link sent from this machine.",inputSchema:{id:it.string().optional().describe("Share id or /lock/open link. Omit to list all.")}},async({id:o})=>{let i=o?[Bc(o)]:ii(yr)?Jh(yr).filter(a=>a.endsWith(".json")).map(a=>a.slice(0,-5)):[];if(i.length===0)return re("No links sent from this machine yet. Send one with nodata_send.");let s=[`LINKS \u2014 ${r()}`];for(let a of i.slice(0,50)){let c=Lc(a),l={};try{let p=await fetch(`${t}/api/lock/public/status/${a}`);l=await p.json().catch(()=>({})),p.status===404&&(l={missing:!0})}catch{l={unreachable:!0}}let d=l.missing?"not found":l.unreachable?"status unavailable":l.burned?"BURNED":l.expired?"expired":"live";s.push(`  ${a}  ${d.padEnd(10)} opens ${l.openCount??"?"}/${l.maxOpens??c?.max_opens??"?"}  expires ${l.expiresAt??c?.expires_at??"?"}  ${c?c.filename:""}`)}return re(s.join(`
+`))}),e.registerTool("nodata_burn",{description:"BURN a link sent with nodata_send: the stored ciphertext is zeroed, so nobody \u2014 the recipient, a forwarded copy, NoData \u2014 can open it again. Irreversible. ASKS FIRST: without confirm:true it only says what would be burned. Returns the signed burn receipt and its proof_url.",inputSchema:{id:it.string().describe("Share id or the /lock/open link."),confirm:it.boolean().optional().describe("true = burn it. Omit to preview.")}},async({id:o,confirm:i})=>{let s=Bc(o),a=o.match(/#([A-Za-z0-9_-]{43})/)?.[1],c=Lc(s),l=c?.wrap_key_b64url??a;if(!l)return re(`No burn key for ${s} on this machine. Pass the full link (it carries the key after #), or burn it from the machine that sent it.`,!0);if(!i)return re(`PREVIEW \u2014 nothing burned yet. ${r()}
 Would burn ${c?`"${c.filename}" `:""}(${s}). After this NOBODY can open it again \u2014 irreversible.
-Ask the user to approve, then call nodata_burn again with confirm: true.`);let u;try{u=await Bc(`${t}/api/lock/public/burn/${s}`,{wrapKeyB64Url:l})}catch(p){return re(`Could not reach NoData: ${p instanceof Error?p.message:String(p)}`,!0)}return u.status>=400||u.body.ok!==!0?re(`Burn refused (HTTP ${u.status}): ${JSON.stringify(u.body)}`,!0):re([`BURNED ${s} \u2014 ${r()}. The ciphertext is zeroed; the link is dead for everyone.`,u.body.proof_url?`Proof (signed receipt, public): ${u.body.proof_url}`:""].filter(Boolean).join(`
-`))})}import{appendFileSync as em,copyFileSync as Uc,existsSync as ai,mkdirSync as ci,readFileSync as li,statSync as Gc,writeFileSync as Wc}from"node:fs";import{homedir as Ie}from"node:os";import{basename as zc,extname as qc,isAbsolute as Jc,join as Te,resolve as Yc}from"node:path";var tm=new Set([".csv",".tsv",".txt",".md",".json",".log",".xml",".sql",".yaml",".yml",".xlsx",".xlsm",".docx",".pptx",".pdf"]),nm=50*1024*1024,rm=8,om={israeli_id:"Israeli ID",credit_card:"card",iban:"IBAN",israeli_phone:"phone",email:"email",secret:"secret"};function di(e){let t=zc(e).toLowerCase();return tm.has(qc(t))||$e.test(t)}var im=/^(reports|receipts)(\/|$)|^(prefs|consent|flagged|statusline-prev|key-backup)\.json$|^(gate|status)\.mjs$|^gate\.log$/i,sm=/\.nodata[\\/]+(device-key\.json|secrets\.json|credentials\.json|issuer-ed25519\.json|capsule\.json|capsule-key|shares|approvals)\b/i;function ii(e){let t=Te(Ie(),".nodata").replace(/\\/g,"/").toLowerCase();if(!e.replace(/\\/g,"/").toLowerCase().startsWith(t+"/"))return!1;let r=e.replace(/\\/g,"/").slice(t.length+1);return r!==""&&!im.test(r)}function am(e){return sm.test(e)}function cm(e){return di(e)||qn(e)!==null}function lm(e){let t=qc(e).toLowerCase(),n=li(e),r,o;if(t===".csv"||t===".tsv")o=n.toString("utf8"),r=Lt(o,t===".tsv"?"	":void 0).counts;else if(t===".xlsx"||t===".xlsm"||t===".docx"||t===".pptx"||t===".pdf"){let s=t===".xlsx"||t===".xlsm"?Bt(n):null;o=Se(n,t)?.text??"",r=s?s.counts:pe(o).counts}else o=n.toString("utf8"),r=pe(o).counts;let i=In.filter(s=>s.pattern.test(o)).length;return $e.test(zc(e).toLowerCase())&&(i=Math.max(i,qr(o))),i&&(r.secret=(r.secret??0)+i),r}var dm={israeli_id:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA",id:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA",credit_card:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9",iban:"IBAN",israeli_phone:"\u05D8\u05DC\u05E4\u05D5\u05DF",phone:"\u05D8\u05DC\u05E4\u05D5\u05DF",email:'\u05D3\u05D5\u05D0"\u05DC',secret:"\u05E1\u05D5\u05D3",name:"\u05E9\u05DD",address:"\u05DB\u05EA\u05D5\u05D1\u05EA",policy:"\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4",agent_id:"\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF",financial:"\u05DE\u05D9\u05D3\u05E2 \u05E4\u05D9\u05E0\u05E0\u05E1\u05D9",medical:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9",dob:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4",bank_account:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7",plate:"\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"};function Xc(e){let t=De()==="he",n=r=>(t?dm[r]:om[r])??r;return Object.entries(e).sort((r,o)=>o[1]-r[1]).map(([r,o])=>`${o} ${r.startsWith("column:")?`${n(r.slice(7))} (${t?"\u05E2\u05DE\u05D5\u05D3\u05D4":"column"})`:n(r)}`).join(", ")}function um(e){return Xc(e)}function Zc(e,t,n){let r=i=>Jc(i)?i:Yc(n,i),o=i=>{try{return Gc(i).isFile()}catch{return!1}};if(e==="Read"&&typeof t.file_path=="string")return[r(t.file_path)];if(e==="Grep"&&typeof t.path=="string"&&o(r(t.path)))return[r(t.path)];if((e==="Bash"||e==="PowerShell")&&typeof t.command=="string"){let i=t.command,s=[...[...i.matchAll(/"([^"]*)"/g)].map(c=>c[1]),...[...i.matchAll(/'([^']*)'/g)].map(c=>c[1]),...i.split(/[\s|;&<>(),=`]+/)],a=[];for(let c of s){let l=c.trim().replace(/^['"]|['"]$/g,"").replace(/\\\\/g,"\\").replace(/^~(?=[\\/])/,Ie()).replace(/^\/([a-zA-Z])\//,(p,f)=>process.platform==="win32"?`${f}:/`:p);if(!l)continue;let u=r(l);if(!(!di(l)&&!ii(u)&&qn(u)===null)&&(o(u)&&!a.includes(u)&&a.push(u),a.length>=rm))break}return a}return[]}function _r(e){return e.replace(/\\+/g,"/")}function pm(e){let t=e.trim();return/[;|&\n]|`|\$\(/.test(t.replace(/^cmd(?:\.exe)?\s+\/c\s+/i,""))?!1:/^(?:cmd(?:\.exe)?\s+\/c\s+)?(?:explorer(?:\.exe)?|start|invoke-item|ii|start-process|open|xdg-open)\b/i.test(t)}function Qc(e,t,n){let r=[];if((e==="Bash"||e==="PowerShell")&&typeof t.command=="string"&&pm(t.command))return r;for(let o of Zc(e,t,n)){if(!cm(o)||xe(o)||!ai(o))continue;let i,s=di(o)?null:qn(o);if(s){i=`${_r(o)}: ${Vn("\u05E7\u05D5\u05D3 \u05E9\u05D4\u05E1\u05E8\u05D9\u05E7\u05D4 \u05D4\u05D0\u05D7\u05E8\u05D5\u05E0\u05D4 \u05E1\u05D9\u05DE\u05E0\u05D4","code your last scan flagged")} \u2014 ${um(s)}`,r.push(i);continue}try{if(Gc(o).size>nm)i=`${_r(o)}: too large to check here (over 50 MB)`;else{let a=lm(o);if(Object.keys(a).length===0)continue;i=`${_r(o)}: ${Xc(a)}`}}catch{i=`${_r(o)}: could not be checked`}r.push(i)}return r}function fm(e,t,n){let r=(e==="Bash"||e==="PowerShell")&&typeof t.command=="string"?t.command:"",o=e==="Grep"&&typeof t.path=="string"?t.path:e==="Read"&&typeof t.file_path=="string"?t.file_path:"";return r&&am(r)||o&&ii(Jc(o)?o:Yc(n,o))||Zc(e,t,n).some(ii)?Vn("NoData \u05D7\u05E1\u05DD: \u05D6\u05D4 \u05E7\u05D5\u05D1\u05E5 \u05DE\u05E4\u05EA\u05D7 \u05E9\u05DC NoData (\u05DE\u05E4\u05EA\u05D7 \u05D4\u05DE\u05DB\u05E9\u05D9\u05E8, \u05D4\u05DB\u05E1\u05E4\u05EA \u05D0\u05D5 \u05D4\u05D0\u05E8\u05D2\u05D5\u05DF). \u05DE\u05D9 \u05E9\u05E7\u05D5\u05E8\u05D0 \u05D0\u05D5\u05EA\u05D5 \u05D9\u05DB\u05D5\u05DC \u05DC\u05E4\u05EA\u05D5\u05D7 \u05DB\u05DC \u05E7\u05D5\u05D1\u05E5 \u05E0\u05E2\u05D5\u05DC, \u05D5\u05DC\u05DB\u05DF \u05D0\u05E3 \u05E1\u05D5\u05DB\u05DF \u05DC\u05D0 \u05E7\u05D5\u05E8\u05D0 \u05D0\u05D5\u05EA\u05D5 \u2014 \u05D2\u05DD \u05DC\u05D0 \u05D1\u05D0\u05D9\u05E9\u05D5\u05E8. \u05DC\u05D2\u05D9\u05D1\u05D5\u05D9 \u05D4\u05DE\u05E4\u05EA\u05D7: \u05D4\u05E2\u05EA\u05E7 \u05D0\u05EA \u05D4\u05E7\u05D5\u05D1\u05E5 \u05D1\u05E2\u05E6\u05DE\u05DA, \u05DE\u05D7\u05D5\u05E5 \u05DC-Claude.","NoData refused: this is one of NoData's own key files (the device key, the vault login or the org credential). Whoever reads it can open every sealed file, so no agent reads it \u2014 not even with approval. To back the key up, copy the file yourself, outside Claude."):null}function hm(e,t,n,r){let o=fm(e,t,n);if(o)return{decision:"deny",reason:o};let i=Qc(e,t,n);if(i.length===0)return{decision:"allow"};let s=Vn(`NoData \u05E1\u05E8\u05E7 \u05D0\u05EA \u05D4\u05E7\u05D5\u05D1\u05E5 \u05D1\u05DE\u05D7\u05E9\u05D1 \u05E9\u05DC\u05DA \u2014 \u05E9\u05D5\u05DD \u05D3\u05D1\u05E8 \u05DC\u05D0 \u05D9\u05E6\u05D0:
+Ask the user to approve, then call nodata_burn again with confirm: true.`);let d;try{d=await Fc(`${t}/api/lock/public/burn/${s}`,{wrapKeyB64Url:l})}catch(p){return re(`Could not reach NoData: ${p instanceof Error?p.message:String(p)}`,!0)}return d.status>=400||d.body.ok!==!0?re(`Burn refused (HTTP ${d.status}): ${JSON.stringify(d.body)}`,!0):re([`BURNED ${s} \u2014 ${r()}. The ciphertext is zeroed; the link is dead for everyone.`,d.body.proof_url?`Proof (signed receipt, public): ${d.body.proof_url}`:""].filter(Boolean).join(`
+`))})}import{appendFileSync as nm,copyFileSync as Vc,existsSync as li,mkdirSync as di,readFileSync as ui,statSync as Wc,writeFileSync as zc}from"node:fs";import{homedir as Ie}from"node:os";import{basename as qc,extname as Jc,isAbsolute as Yc,join as Te,resolve as Xc}from"node:path";var rm=new Set([".csv",".tsv",".txt",".md",".json",".log",".xml",".sql",".yaml",".yml",".xlsx",".xlsm",".docx",".pptx",".pdf"]),om=50*1024*1024,im=8,sm={israeli_id:"Israeli ID",credit_card:"card",iban:"IBAN",israeli_phone:"phone",email:"email",secret:"secret"};function pi(e){let t=qc(e).toLowerCase();return rm.has(Jc(t))||Pe.test(t)}var am=/^(reports|receipts)(\/|$)|^(prefs|consent|flagged|statusline-prev|key-backup)\.json$|^(gate|status)\.mjs$|^gate\.log$/i,cm=/\.nodata[\\/]+(device-key\.json|secrets\.json|credentials\.json|issuer-ed25519\.json|capsule\.json|capsule-key|shares|approvals)\b/i;function ai(e){let t=Te(Ie(),".nodata").replace(/\\/g,"/").toLowerCase();if(!e.replace(/\\/g,"/").toLowerCase().startsWith(t+"/"))return!1;let r=e.replace(/\\/g,"/").slice(t.length+1);return r!==""&&!am.test(r)}function lm(e){return cm.test(e)}function dm(e){return pi(e)||Jn(e)!==null}var vr=class extends Error{};function um(e){let t=Jc(e).toLowerCase(),n=ui(e),r,o;if(t===".csv"||t===".tsv")o=n.toString("utf8"),r=Lt(o,t===".tsv"?"	":void 0).counts;else if(t===".xlsx"||t===".xlsm"||t===".docx"||t===".pptx"||t===".pdf"){let s=t===".xlsx"||t===".xlsm"?Bt(n):null,a=Se(n,t);if(!a&&!s)throw new vr;o=a?.text??"",r=s?s.counts:pe(o).counts}else o=n.toString("utf8"),r=pe(o).counts;let i=Pn.filter(s=>s.pattern.test(o)).length;return Pe.test(qc(e).toLowerCase())&&(i=Math.max(i,Yr(o))),i&&(r.secret=(r.secret??0)+i),r}var pm={israeli_id:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA",id:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA",credit_card:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9",iban:"IBAN",israeli_phone:"\u05D8\u05DC\u05E4\u05D5\u05DF",phone:"\u05D8\u05DC\u05E4\u05D5\u05DF",email:'\u05D3\u05D5\u05D0"\u05DC',secret:"\u05E1\u05D5\u05D3",name:"\u05E9\u05DD",address:"\u05DB\u05EA\u05D5\u05D1\u05EA",policy:"\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4",agent_id:"\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF",financial:"\u05DE\u05D9\u05D3\u05E2 \u05E4\u05D9\u05E0\u05E0\u05E1\u05D9",medical:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9",dob:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4",bank_account:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7",plate:"\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"};function Zc(e){let t=De()==="he",n=r=>(t?pm[r]:sm[r])??r;return Object.entries(e).sort((r,o)=>o[1]-r[1]).map(([r,o])=>`${o} ${r.startsWith("column:")?`${n(r.slice(7))} (${t?"\u05E2\u05DE\u05D5\u05D3\u05D4":"column"})`:n(r)}`).join(", ")}function fm(e){return Zc(e)}function Qc(e,t,n){let r=i=>Yc(i)?i:Xc(n,i),o=i=>{try{return Wc(i).isFile()}catch{return!1}};if(e==="Read"&&typeof t.file_path=="string")return[r(t.file_path)];if(e==="Grep"&&typeof t.path=="string"&&o(r(t.path)))return[r(t.path)];if((e==="Bash"||e==="PowerShell")&&typeof t.command=="string"){let i=t.command,s=[...[...i.matchAll(/"([^"]*)"/g)].map(c=>c[1]),...[...i.matchAll(/'([^']*)'/g)].map(c=>c[1]),...i.split(/[\s|;&<>(),=`]+/)],a=[];for(let c of s){let l=c.trim().replace(/^['"]|['"]$/g,"").replace(/\\\\/g,"\\").replace(/^~(?=[\\/])/,Ie()).replace(/^\/([a-zA-Z])\//,(p,f)=>process.platform==="win32"?`${f}:/`:p);if(!l)continue;let d=r(l);if(!(!pi(l)&&!ai(d)&&Jn(d)===null)&&(o(d)&&!a.includes(d)&&a.push(d),a.length>=im))break}return a}return[]}function pn(e){return e.replace(/\\+/g,"/")}function hm(e){let t=e.trim();return/[;|&\n]|`|\$\(/.test(t.replace(/^cmd(?:\.exe)?\s+\/c\s+/i,""))?!1:/^(?:cmd(?:\.exe)?\s+\/c\s+)?(?:explorer(?:\.exe)?|start|invoke-item|ii|start-process|open|xdg-open)\b/i.test(t)}function el(e,t,n){let r=[];if((e==="Bash"||e==="PowerShell")&&typeof t.command=="string"&&hm(t.command))return r;for(let o of Qc(e,t,n)){if(!dm(o)||xe(o)||!li(o))continue;let i,s=pi(o)?null:Jn(o);if(s){i=`${pn(o)}: ${Vt("\u05E7\u05D5\u05D3 \u05E9\u05D4\u05E1\u05E8\u05D9\u05E7\u05D4 \u05D4\u05D0\u05D7\u05E8\u05D5\u05E0\u05D4 \u05E1\u05D9\u05DE\u05E0\u05D4","code your last scan flagged")} \u2014 ${fm(s)}`,r.push(i);continue}try{if(Wc(o).size>om)i=`${pn(o)}: too large to check here (over 50 MB)`;else{let a=um(o);if(Object.keys(a).length===0)continue;i=`${pn(o)}: ${Zc(a)}`}}catch(a){i=a instanceof vr?`${pn(o)}: ${Vt("\u05DC\u05D0 \u05E0\u05D9\u05EA\u05DF \u05DC\u05E7\u05E8\u05D5\u05D0 \u05D0\u05EA \u05D4\u05D8\u05E7\u05E1\u05D8 (\u05E1\u05E8\u05D9\u05E7\u05D4, \u05D4\u05E6\u05E4\u05E0\u05D4 \u05D0\u05D5 \u05D2\u05D5\u05E4\u05DF \u05DC\u05D0 \u05E0\u05EA\u05DE\u05DA) \u2014 \u05DC\u05D0 \u05E0\u05D1\u05D3\u05E7, \u05D4\u05EA\u05D9\u05D9\u05D7\u05E1 \u05D0\u05DC\u05D9\u05D5 \u05DB\u05E8\u05D2\u05D9\u05E9","its text could not be read (a scan, encryption or an unsupported font) \u2014 NOT checked, treat it as sensitive")}`:`${pn(o)}: could not be checked`}r.push(i)}return r}function mm(e,t,n){let r=(e==="Bash"||e==="PowerShell")&&typeof t.command=="string"?t.command:"",o=e==="Grep"&&typeof t.path=="string"?t.path:e==="Read"&&typeof t.file_path=="string"?t.file_path:"";return r&&lm(r)||o&&ai(Yc(o)?o:Xc(n,o))||Qc(e,t,n).some(ai)?Vt("NoData \u05D7\u05E1\u05DD: \u05D6\u05D4 \u05E7\u05D5\u05D1\u05E5 \u05DE\u05E4\u05EA\u05D7 \u05E9\u05DC NoData (\u05DE\u05E4\u05EA\u05D7 \u05D4\u05DE\u05DB\u05E9\u05D9\u05E8, \u05D4\u05DB\u05E1\u05E4\u05EA \u05D0\u05D5 \u05D4\u05D0\u05E8\u05D2\u05D5\u05DF). \u05DE\u05D9 \u05E9\u05E7\u05D5\u05E8\u05D0 \u05D0\u05D5\u05EA\u05D5 \u05D9\u05DB\u05D5\u05DC \u05DC\u05E4\u05EA\u05D5\u05D7 \u05DB\u05DC \u05E7\u05D5\u05D1\u05E5 \u05E0\u05E2\u05D5\u05DC, \u05D5\u05DC\u05DB\u05DF \u05D0\u05E3 \u05E1\u05D5\u05DB\u05DF \u05DC\u05D0 \u05E7\u05D5\u05E8\u05D0 \u05D0\u05D5\u05EA\u05D5 \u2014 \u05D2\u05DD \u05DC\u05D0 \u05D1\u05D0\u05D9\u05E9\u05D5\u05E8. \u05DC\u05D2\u05D9\u05D1\u05D5\u05D9 \u05D4\u05DE\u05E4\u05EA\u05D7: \u05D4\u05E2\u05EA\u05E7 \u05D0\u05EA \u05D4\u05E7\u05D5\u05D1\u05E5 \u05D1\u05E2\u05E6\u05DE\u05DA, \u05DE\u05D7\u05D5\u05E5 \u05DC-Claude.","NoData refused: this is one of NoData's own key files (the device key, the vault login or the org credential). Whoever reads it can open every sealed file, so no agent reads it \u2014 not even with approval. To back the key up, copy the file yourself, outside Claude."):null}function gm(e,t,n,r){let o=mm(e,t,n);if(o)return{decision:"deny",reason:o};let i=el(e,t,n);if(i.length===0)return{decision:"allow"};let s=Vt(`NoData \u05E1\u05E8\u05E7 \u05D0\u05EA \u05D4\u05E7\u05D5\u05D1\u05E5 \u05D1\u05DE\u05D7\u05E9\u05D1 \u05E9\u05DC\u05DA \u2014 \u05E9\u05D5\u05DD \u05D3\u05D1\u05E8 \u05DC\u05D0 \u05D9\u05E6\u05D0:
   ${i.join(`
   `)}
 `+(r?"\u05D4\u05E7\u05E8\u05D9\u05D0\u05D4 \u05E0\u05D7\u05E1\u05DE\u05D4: Claude \u05DC\u05D0 \u05D9\u05E7\u05E8\u05D0 \u05D0\u05EA \u05D4\u05DE\u05E7\u05D5\u05E8. \u05D1\u05DE\u05E7\u05D5\u05DD \u05D6\u05D4: nodata_redact (\u05E2\u05D5\u05EA\u05E7 \u05E0\u05E7\u05D9 \u05DC\u05E2\u05D1\u05D5\u05D3\u05D4) \u05D0\u05D5 nodata_protect (\u05E0\u05E2\u05D9\u05DC\u05D4).":"\u05D0\u05DD \u05EA\u05D0\u05E9\u05E8, Claude \u05D9\u05E7\u05E8\u05D0 \u05D0\u05EA \u05D4\u05E7\u05D5\u05D1\u05E5 \u05E2\u05E6\u05DE\u05D5 \u05D5\u05D4\u05EA\u05D5\u05DB\u05DF \u05D9\u05D9\u05E9\u05DC\u05D7 \u05DC\u05DE\u05D5\u05D3\u05DC \u05D4\u05D1\u05D9\u05E0\u05D4 \u05D4\u05DE\u05DC\u05D0\u05DB\u05D5\u05EA\u05D9\u05EA. \u05D1\u05DE\u05E7\u05D5\u05DD \u05D6\u05D4: nodata_redact (\u05E2\u05D5\u05EA\u05E7 \u05E0\u05E7\u05D9 \u05DC\u05E2\u05D1\u05D5\u05D3\u05D4) \u05D0\u05D5 nodata_protect (\u05E0\u05E2\u05D9\u05DC\u05D4). \u05DC\u05D0\u05E9\u05E8 \u05D1\u05DB\u05DC \u05D6\u05D0\u05EA?"),`NoData scanned this file on your machine \u2014 nothing left it:
   ${i.join(`
   `)}
-`+(r?"Read refused: Claude will not read the original. Instead: nodata_redact (a clean copy to work on) or nodata_protect (lock it).":"If you allow it, Claude reads the file itself and its content goes to the AI model. Instead: nodata_redact (a clean copy to work on) or nodata_protect (lock it). Allow anyway?"));return{decision:r?"deny":"ask",reason:s}}function mm(e,t,n){let r=Qc(e,t,n);return r.length===0?null:`NoData \xB7 ON SCREEN rule. What you just read holds personal data:
+`+(r?"Read refused: Claude will not read the original. Instead: nodata_redact (a clean copy to work on) or nodata_protect (lock it).":"If you allow it, Claude reads the file itself and its content goes to the AI model. Instead: nodata_redact (a clean copy to work on) or nodata_protect (lock it). Allow anyway?"));return{decision:r?"deny":"ask",reason:s}}function ym(e,t,n){let r=el(e,t,n);return r.length===0?null:`NoData \xB7 ON SCREEN rule. What you just read holds personal data:
   ${r.join(`
   `)}
-The user's screen is not private \u2014 someone may be beside them. Answer with totals, counts, groupings and trends. Do not print names, ID / policy / account numbers, addresses, phones, or amounts tied to a person \u2014 not in a table, not as an "example" \u2014 unless the user explicitly asks to see those values. For a clean, anonymised or shareable version use nodata_redact \u2014 never your own script: it verifies the copy and records a proof.`+(De()==="he"?" Answer the user in Hebrew.":"")}function gm(e){try{let t=Te(Ie(),".nodata");ci(t,{recursive:!0}),em(Te(t,"gate.log"),JSON.stringify({at:new Date().toISOString(),...e})+`
-`,{mode:384})}catch{}}async function el(e){let t=e.includes("--block"),n=e.includes("--post"),r="";for await(let a of process.stdin)r+=a;let o;try{o=JSON.parse(r)}catch{return}let i=o.tool_name??"";if(n){let a=mm(i,o.tool_input??{},o.cwd??process.cwd());a&&process.stdout.write(JSON.stringify({hookSpecificOutput:{hookEventName:"PostToolUse",additionalContext:a}}));return}let s=hm(i,o.tool_input??{},o.cwd??process.cwd(),t);s.decision!=="allow"&&(gm({tool:i,decision:s.decision}),process.stdout.write(JSON.stringify({hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:s.decision,permissionDecisionReason:s.reason}})))}var br=()=>Te(Ie(),".nodata","gate.mjs"),ui=()=>Te(Ie(),".claude","settings.json"),oi="Read|Grep|Bash|PowerShell",Vc=()=>Te(Ie(),".nodata","status.mjs"),si=()=>Te(Ie(),".nodata","statusline-prev.json"),tl=e=>!!e&&(e.command.includes(".nodata/status.mjs")||e.command.includes(".nodata\\status.mjs")),un=e=>(e.hooks??[]).some(t=>t.command.includes(".nodata/gate.mjs")||t.command.includes(".nodata\\gate.mjs"));function nl(){let e=ui();return ai(e)?JSON.parse(li(e,"utf8")):{}}function rl(e){ci(Te(Ie(),".claude"),{recursive:!0}),Wc(ui(),JSON.stringify(e,null,2)+`
-`)}function ol(e,t){ci(Te(Ie(),".nodata"),{recursive:!0}),Uc(e,br());let n=nl(),r=n.hooks??={},o=(r.PreToolUse??=[]).filter(s=>!un(s));o.push({matcher:oi,hooks:[{type:"command",command:`node "${br().replace(/\\/g,"/")}"${t?" --block":""}`,timeout:30}]}),r.PreToolUse=o;let i=(r.PostToolUse??=[]).filter(s=>!un(s));return i.push({matcher:oi,hooks:[{type:"command",command:`node "${br().replace(/\\/g,"/")}" --post`,timeout:30}]}),r.PostToolUse=i,Uc(new URL("./status.js",e),Vc()),n.statusLine&&!tl(n.statusLine)&&Wc(si(),JSON.stringify(n.statusLine,null,2)+`
-`),n.statusLine={type:"command",command:`node "${Vc().replace(/\\/g,"/")}"`},rl(n),`NoData read gate installed (${t?"block":"ask"} mode).
-  hook:     ${ui()} \u2192 PreToolUse ${oi} (+ PostToolUse: on-screen reminder after an approved read)
+The user's screen is not private \u2014 someone may be beside them. Answer with totals, counts, groupings and trends. Do not print names, ID / policy / account numbers, addresses, phones, or amounts tied to a person \u2014 not in a table, not as an "example" \u2014 unless the user explicitly asks to see those values. For a clean, anonymised or shareable version use nodata_redact \u2014 never your own script: it verifies the copy and records a proof.`+(De()==="he"?" Answer the user in Hebrew.":"")}function _m(e){try{let t=Te(Ie(),".nodata");di(t,{recursive:!0}),nm(Te(t,"gate.log"),JSON.stringify({at:new Date().toISOString(),...e})+`
+`,{mode:384})}catch{}}async function tl(e){let t=e.includes("--block"),n=e.includes("--post"),r="";for await(let a of process.stdin)r+=a;let o;try{o=JSON.parse(r)}catch{return}let i=o.tool_name??"";if(n){let a=ym(i,o.tool_input??{},o.cwd??process.cwd());a&&process.stdout.write(JSON.stringify({hookSpecificOutput:{hookEventName:"PostToolUse",additionalContext:a}}));return}let s=gm(i,o.tool_input??{},o.cwd??process.cwd(),t);s.decision!=="allow"&&(_m({tool:i,decision:s.decision}),process.stdout.write(JSON.stringify({hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:s.decision,permissionDecisionReason:s.reason}})))}var br=()=>Te(Ie(),".nodata","gate.mjs"),fi=()=>Te(Ie(),".claude","settings.json"),si="Read|Grep|Bash|PowerShell",Gc=()=>Te(Ie(),".nodata","status.mjs"),ci=()=>Te(Ie(),".nodata","statusline-prev.json"),nl=e=>!!e&&(e.command.includes(".nodata/status.mjs")||e.command.includes(".nodata\\status.mjs")),fn=e=>(e.hooks??[]).some(t=>t.command.includes(".nodata/gate.mjs")||t.command.includes(".nodata\\gate.mjs"));function rl(){let e=fi();return li(e)?JSON.parse(ui(e,"utf8")):{}}function ol(e){di(Te(Ie(),".claude"),{recursive:!0}),zc(fi(),JSON.stringify(e,null,2)+`
+`)}function il(e,t){di(Te(Ie(),".nodata"),{recursive:!0}),Vc(e,br());let n=rl(),r=n.hooks??={},o=(r.PreToolUse??=[]).filter(s=>!fn(s));o.push({matcher:si,hooks:[{type:"command",command:`node "${br().replace(/\\/g,"/")}"${t?" --block":""}`,timeout:30}]}),r.PreToolUse=o;let i=(r.PostToolUse??=[]).filter(s=>!fn(s));return i.push({matcher:si,hooks:[{type:"command",command:`node "${br().replace(/\\/g,"/")}" --post`,timeout:30}]}),r.PostToolUse=i,Vc(new URL("./status.js",e),Gc()),n.statusLine&&!nl(n.statusLine)&&zc(ci(),JSON.stringify(n.statusLine,null,2)+`
+`),n.statusLine={type:"command",command:`node "${Gc().replace(/\\/g,"/")}"`},ol(n),`NoData read gate installed (${t?"block":"ask"} mode).
+  hook:     ${fi()} \u2192 PreToolUse ${si} (+ PostToolUse: on-screen reminder after an approved read)
   scanner:  ${br()}
 Before Claude Code reads a data file (csv, xlsx, docx, pdf, .env \u2026), NoData scans it here.
 Findings \u2192 ${t?"the read is refused":"you are asked first"}, with the counts and the safer step.
 Status line: "\u25CF NoData" at the bottom of Claude Code \u2014 green = guarded, yellow = gate off, red = terms not accepted; no segment = not guarded.
-Restart Claude Code to load it. Remove with: npx @nodatachat/mcp uninstall-gate`}function il(){let e=nl(),t=e.hooks?.PreToolUse;if(!t||!t.some(un))return"The NoData read gate is not installed.";if(e.hooks.PreToolUse=t.filter(n=>!un(n)),e.hooks.PreToolUse.length===0&&delete e.hooks.PreToolUse,e.hooks.PostToolUse&&(e.hooks.PostToolUse=e.hooks.PostToolUse.filter(n=>!un(n)),e.hooks.PostToolUse.length===0&&delete e.hooks.PostToolUse),tl(e.statusLine)){let n=ai(si())?JSON.parse(li(si(),"utf8")):null;n?e.statusLine=n:delete e.statusLine}return rl(e),"NoData read gate removed. Restart Claude Code to unload it."}var ym=[{type:"id_number",patterns:[/\b\d{9}\b/g,/ת\.?ז\.?\s*:?\s*(\d{9})/g,/זהות\s*:?\s*(\d{9})/g],confidence:.9,replacement:()=>"[\u05EA.\u05D6. \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"phone",patterns:[/\b0[2-9]\d[\s\-]?\d{7}\b/g,/\b05[0-9][\s\-]?\d{7}\b/g,/\+972[\s\-]?[2-9]\d[\s\-]?\d{7}\b/g],confidence:.95,replacement:()=>"[\u05D8\u05DC\u05E4\u05D5\u05DF \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"email",patterns:[/[a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}/g],confidence:.99,replacement:e=>{let[,t]=e.split("@");return`[\u05D0\u05D9\u05DE\u05D9\u05D9\u05DC: ***@${t}]`}},{type:"full_name",patterns:[/(?:לקוח|מטופל|מועמד|שם|נהג|מבוטח|תובע|נתבע|שוכר|מחזיק)[:\s]+([א-ת][א-ת"'\-\s]{2,30}?)(?=[,\n\d]|ת\.ז)/g,/(?:עו"ד|ד"ר|פרופ'|מר|גברת)\s+([א-ת][א-ת"'\-\s]{2,25}?)(?=[,\n])/g],confidence:.75,replacement:()=>"[\u05E9\u05DD \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"bank_account",patterns:[/\b\d{2}[\-]\d{5,9}[\-]\d{2,3}\b/g,/(?:חשבון|ח-ן)\s*:?\s*(\d[\d\-]{8,15})/g],confidence:.88,replacement:()=>"[\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"medical",patterns:[/(?<![א-ת])[בהוכלמש]{0,2}(?:סוכרת|יתר לחץ דם|אסתמה|דיכאון|חרדה|סרטן|אי ספיקת לב|אפילפסיה)(?![א-ת])/g,/\b(?:Metformin|Lisinopril|Atorvastatin|Amlodipine|Sertraline|Fluoxetine|Omeprazole|Warfarin|Aspirin|Insulin)\b/gi,/\bHbA1c\s*:?\s*[\d.]+%?/g,/\bBMI\s*:?\s*[\d.]+/g,/(?<![א-ת])[בהוכלמש]{0,2}אבחנ[הות]\s*:?\s*[^,\n.]{2,40}/g],confidence:.85,replacement:()=>"[\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"financial_amount",patterns:[/[\d,]+(?:\.\d{2})?\s*(?:₪|ש"ח|NIS|שקל(?:ים)?)/g,/(?:₪|NIS)\s*[\d,]+(?:\.\d{2})?/g],confidence:.92,replacement:()=>"[\u05E1\u05DB\u05D5\u05DD \u05DB\u05E1\u05E4\u05D9 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"birth_date",patterns:[/(?:תאריך לידה|נולד|נולדה|ד\.ל\.)\s*:?\s*\d{1,2}[\/\.\-]\d{1,2}[\/\.\-]\d{2,4}/g,/(?<![א-ת])[בהוכלמש]{0,2}גיל\s*:?\s*\d{1,3}\b/g],confidence:.88,replacement:()=>"[\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"address",patterns:[/רחוב\s+[א-ת][א-ת\s"'\-]{2,30}\s+\d{1,5}/g,/(?:רח'|רח\.)\s+[א-ת][א-ת\s"'\-]{2,30}\d{1,5}/g],confidence:.72,replacement:()=>"[\u05DB\u05EA\u05D5\u05D1\u05EA \u05DE\u05D5\u05E1\u05EA\u05E8\u05EA]"},{type:"license_plate",patterns:[/\b\d{2,3}[\-]\d{2,3}[\-]\d{2,3}\b/g],confidence:.8,replacement:()=>"[\u05DC\u05D5\u05D7\u05D9\u05EA \u05E8\u05D9\u05E9\u05D5\u05D9 \u05DE\u05D5\u05E1\u05EA\u05E8\u05EA]"}];function _m(e){if(e.length!==9)return!1;let t=e.split("").map(Number),n=0;for(let r=0;r<9;r++){let o=t[r]*(r%2===0?1:2);o>9&&(o-=9),n+=o}return n%10===0}var vr=class{constructor(t){this.enabledTypes=new Set(t)}detect(t){let n=[],r=new Set;for(let i of ym)if(this.enabledTypes.has(i.type))for(let s of i.patterns){let a=new RegExp(s.source,s.flags),c;for(;(c=a.exec(t))!==null;){let l=c[0],u=`${i.type}:${c.index}`;if(!r.has(u)){if(r.add(u),i.type==="id_number"){let p=l.replace(/\D/g,"");if(/^\d{9}$/.test(l)&&p.length===9&&!_m(p))continue}n.push({type:i.type,value:l,startIndex:c.index,endIndex:c.index+l.length,confidence:i.confidence,replacement:i.replacement(l,i.type)})}}}n.sort((i,s)=>i.startIndex-s.startIndex||s.confidence-i.confidence);let o=[];for(let i of n)o.some(a=>i.startIndex<a.endIndex&&i.endIndex>a.startIndex)||o.push(i);return o}};var bm=[{pattern:/^(?:שם|שם_מלא|שם פרטי|שם_פרטי|שם משפחה|שם_משפחה|שם_אדם|שם הלקוח|שם_הלקוח|שם בן זוג|שם בן_זוג|שם המבוטח|שם_המבוטח|שם המוטב|שם_המוטב|שם מבוטח|שם_מבוטח|שם מוטב|שם_מוטב|שם הילד|שם_הילד|שם הקטין|שם_הקטין|firstname_he|lastname_he|shem|shem_mishpacha|shem_prati)$/i,type:"name",label:"Person name (Hebrew)",labelHe:"\u05E9\u05DD \u05D0\u05D3\u05DD"},{pattern:/^(?:ת"ז|ת\.ז|ת ז|תז|תעודת זהות|תעודת_זהות|מספר זהות|מספר_זהות|מס' זהות|מס_זהות|מס' ת"ז|teudat_zehut|tz|t_z|israeli_id|il_id)$/i,type:"id",label:"Israeli ID",labelHe:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA"},{pattern:/^(?:דרכון|מספר דרכון|מס דרכון|רישיון נהיגה|רישיון_נהיגה|רשיון נהיגה|מס רישיון|דרכון_מספר)$/i,type:"id",label:"Passport / DL (Hebrew)",labelHe:"\u05D3\u05E8\u05DB\u05D5\u05DF/\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF"},{pattern:/^(?:מייל|דוא"ל|דוא_ל|דואר אלקטרוני|דואר_אלקטרוני|אימייל|כתובת מייל|כתובת_מייל|כתובת דואר|כתובת_דואר)$/i,type:"email",label:"Email (Hebrew)",labelHe:"\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9"},{pattern:/^(?:טלפון|טל'|נייד|פלאפון|סלולרי|מספר טלפון|מספר_טלפון|טלפון נייד|טלפון_נייד|מס נייד|מס_נייד|מס' טל)$/i,type:"phone",label:"Phone (Hebrew)",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF"},{pattern:/^(?:כתובת|כתובת מגורים|כתובת_מגורים|רחוב|מס בית|מספר בית|עיר|ישוב|יישוב|מיקוד|כתובת מלאה|כתובת_מלאה|מען)$/i,type:"address",label:"Address (Hebrew)",labelHe:"\u05DB\u05EA\u05D5\u05D1\u05EA"},{pattern:/^(?:תאריך לידה|תאריך_לידה|ת לידה|תאריך הולדת|תאריך_הולדת|יום הולדת|יום_הולדת|גיל)$/i,type:"dob",label:"Date of birth (Hebrew)",labelHe:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"},{pattern:/^(?:חשבון בנק|חשבון_בנק|מספר חשבון|מספר_חשבון|מס חשבון|מס' חשבון|בנק|סניף|מס סניף|iban|iban_il)$/i,type:"financial",label:"Bank account (Hebrew)",labelHe:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7"},{pattern:/^(?:כרטיס אשראי|כרטיס_אשראי|מספר אשראי|מס אשראי|מס' אשראי|cvv|אשראי|מס כרטיס|מס_כרטיס)$/i,type:"financial",label:"Credit card (Hebrew)",labelHe:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"},{pattern:/^(?:שכר|משכורת|הכנסה|פרמיה|שכר ברוטו|שכר_ברוטו|שכר נטו|שכר_נטו|תגמול|בונוס|פיצוי)$/i,type:"financial",label:"Salary / income (Hebrew)",labelHe:"\u05E9\u05DB\u05E8/\u05D4\u05DB\u05E0\u05E1\u05D4"},{pattern:/^(?:אבחון|אבחנה|מחלה|תרופה|מרשם|בדיקה רפואית|בדיקה_רפואית|מצב רפואי|מצב_רפואי|חיסון|תוצאת בדיקה|תוצאת_בדיקה|רופא|רגישות|אלרגיה|סוג דם|סוג_דם)$/i,type:"medical",label:"Medical (Hebrew)",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(?:מספר פוליסה|מספר_פוליסה|מס פוליסה|מס' פוליסה|פוליסה|מספר חבר|מספר_חבר|מס חבר|מספר ביטוח|מספר_ביטוח|policy_?number|policy_?no|policy_?id)$/i,type:"policy",label:"Insurance policy number (Hebrew)",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4"},{pattern:/^(?:מספר סוכן|מספר_סוכן|מס סוכן|מס' סוכן|מס_סוכן|קוד סוכן|קוד_סוכן|מספר משווק|מספר_משווק|מספר יצרן|סוכן ביטוח|agent_?number|agent_?no|agent_?id|agent_?code|broker_?id|broker_?number)$/i,type:"agent_id",label:"Insurance agent / broker number (Hebrew)",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF"},{pattern:/^(?:שם הילד|שם_הילד|תעודת זהות של ילד|ילדים|קטין|מספר ילדים|מספר_ילדים|תעודת לידה|ת לידה ילד)$/i,type:"minor_data",label:"Minor data (Hebrew)",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05DF"},{pattern:/^(?:דת|לאום|מין|נטייה מינית|נטייה_מינית|השקפה פוליטית|השקפה_פוליטית|מצב משפחתי|מצב_משפחתי|עדה|מוצא)$/i,type:"sensitive_personal",label:"Sensitive personal (Hebrew)",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9"},{pattern:/^(?:מספר רכב|מספר_רכב|מס רכב|מס' רכב|לוחית רישוי|לוחית_רישוי|מספר רישוי|מספר_רישוי)$/i,type:"tracking",label:"Vehicle ID (Hebrew)",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"}];function pi(e){let t=String(e??"").replace(/\D/g,"");if(t.length===0||t.length>9)return!1;let n=t.padStart(9,"0"),r=0;for(let o=0;o<9;o++){let i=parseInt(n[o]??"0",10)*(o%2+1);i>9&&(i-=9),r+=i}return r%10===0&&parseInt(n,10)>0}var kr=/(?:\+972[\s-]?|0)(?:5[0-9]|[2-4]|[89])(?:[\s-]?\d){7}/g,wr=/[a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,}/gi,Sr=/\bIL\d{2}\s?(?:\d{4}\s?){4}\d{3}\b/g;function sl(e){let t=String(e??"").replace(/\D/g,"");if(t.length<13||t.length>19)return!1;let n=0,r=!1;for(let o=t.length-1;o>=0;o--){let i=t.charCodeAt(o)-48;if(i<0||i>9)return!1;r&&(i*=2,i>9&&(i-=9)),n+=i,r=!r}return n%10===0}function al(e){if(!e)return null;let t=e.trim();for(let n of bm)if(n.pattern.test(t))return{type:n.type,label:n.label,labelHe:n.labelHe};return null}var vm=[{type:"biometric",tokens:["biometric","fingerprint","\u05D1\u05D9\u05D5\u05DE\u05D8\u05E8\u05D9"],phrases:["face id","\u05D8\u05D1\u05D9\u05E2\u05EA \u05D0\u05E6\u05D1\u05E2"]},{type:"medical",tokens:["diagnosis","medical","disease","medication","prescription","allergy","vaccine","\u05D0\u05D1\u05D7\u05D5\u05DF","\u05D0\u05D1\u05D7\u05E0\u05D4","\u05DE\u05D7\u05DC\u05D4","\u05EA\u05E8\u05D5\u05E4\u05D4","\u05DE\u05E8\u05E9\u05DD","\u05D7\u05D9\u05E1\u05D5\u05DF","\u05D0\u05DC\u05E8\u05D2\u05D9\u05D4"],phrases:["medical record","blood type","\u05DE\u05E6\u05D1 \u05E8\u05E4\u05D5\u05D0\u05D9","\u05E1\u05D5\u05D2 \u05D3\u05DD"]},{type:"sensitive_personal",tokens:["religion","ethnicity","nationality","\u05D3\u05EA","\u05DC\u05D0\u05D5\u05DD","\u05E2\u05D3\u05D4","\u05DE\u05D5\u05E6\u05D0"],phrases:["sexual orientation","marital status","\u05DE\u05E6\u05D1 \u05DE\u05E9\u05E4\u05D7\u05EA\u05D9","\u05E0\u05D8\u05D9\u05D9\u05D4 \u05DE\u05D9\u05E0\u05D9\u05EA"]},{type:"minor_data",tokens:["minor","\u05E7\u05D8\u05D9\u05DF"],phrases:["child name","\u05E9\u05DD \u05D4\u05D9\u05DC\u05D3","\u05E9\u05DD \u05D4\u05E7\u05D8\u05D9\u05DF"]},{type:"id",tokens:["ssn","passport","\u05D6\u05D4\u05D5\u05EA","\u05D3\u05E8\u05DB\u05D5\u05DF"],phrases:["national id","id number","identity number","social security","driver license","driving license","drivers license","passport number","tax id","\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA","\u05DE\u05E1\u05E4\u05E8 \u05D6\u05D4\u05D5\u05EA","\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF \u05E0\u05D4\u05D9\u05D2\u05D4"]},{type:"financial",tokens:["iban","swift","bic","salary","income","wage","\u05D0\u05E9\u05E8\u05D0\u05D9","\u05E9\u05DB\u05E8","\u05DE\u05E9\u05DB\u05D5\u05E8\u05EA","\u05D4\u05DB\u05E0\u05E1\u05D4"],phrases:["bank account","account number","credit card","card number","routing number","sort code","\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7","\u05DE\u05E1\u05E4\u05E8 \u05D7\u05E9\u05D1\u05D5\u05DF","\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"]},{type:"policy",tokens:["policy","\u05E4\u05D5\u05DC\u05D9\u05E1\u05D4"],phrases:["policy number","member number","\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4"]},{type:"agent_id",tokens:["\u05DE\u05E9\u05D5\u05D5\u05E7"],phrases:["agent number","agent code","broker id","\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF"]},{type:"dob",tokens:["dob","birthdate","birthday","\u05DC\u05D9\u05D3\u05D4","\u05D4\u05D5\u05DC\u05D3\u05EA","\u05D2\u05D9\u05DC"],phrases:["date of birth","birth date","\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"]},{type:"phone",tokens:["phone","tel","mobile","cell","fax","\u05D8\u05DC\u05E4\u05D5\u05DF","\u05E0\u05D9\u05D9\u05D3","\u05E4\u05DC\u05D0\u05E4\u05D5\u05DF","\u05E1\u05DC\u05D5\u05DC\u05E8\u05D9"],phrases:["phone number","mobile number","cell phone","\u05D8\u05DC\u05E4\u05D5\u05DF \u05E0\u05D9\u05D9\u05D3"]},{type:"email",tokens:["email","mail","\u05D0\u05D9\u05DE\u05D9\u05D9\u05DC","\u05DE\u05D9\u05D9\u05DC","\u05D3\u05D5\u05D0\u05DC"],phrases:["email address","e mail","\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9","\u05DB\u05EA\u05D5\u05D1\u05EA \u05DE\u05D9\u05D9\u05DC"]},{type:"address",tokens:["address","street","city","zipcode","zip","postcode","\u05DB\u05EA\u05D5\u05D1\u05EA","\u05E8\u05D7\u05D5\u05D1","\u05E2\u05D9\u05E8","\u05D9\u05E9\u05D5\u05D1","\u05D9\u05D9\u05E9\u05D5\u05D1","\u05DE\u05D9\u05E7\u05D5\u05D3","\u05DE\u05E2\u05DF"],phrases:["home address","postal code","street address","zip code","\u05DB\u05EA\u05D5\u05D1\u05EA \u05DE\u05D2\u05D5\u05E8\u05D9\u05DD"]},{type:"location",tokens:["gps","latitude","longitude","geolocation","\u05DE\u05D9\u05E7\u05D5\u05DD"],phrases:["gps coordinates"]},{type:"tracking",tokens:["plate","vehicle","\u05E8\u05DB\u05D1","\u05E8\u05D9\u05E9\u05D5\u05D9"],phrases:["license plate","vehicle number","plate number","\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"]},{type:"name",tokens:["name","\u05E9\u05DD"],phrases:["first name","last name","full name","family name","given name","surname","\u05E9\u05DD \u05E4\u05E8\u05D8\u05D9","\u05E9\u05DD \u05DE\u05E9\u05E4\u05D7\u05D4","\u05E9\u05DD \u05DE\u05DC\u05D0"]}];function Er(e){if(!e)return null;let t=e.trim().toLowerCase().replace(/["'`׳״]/g,"").replace(/[_\-.]+/g," ").replace(/\s+/g," ").trim();if(!t)return null;let n=new Set(t.match(/[\p{L}\p{N}]+/gu)??[]);for(let r of vm)if(r.phrases?.some(i=>t.includes(i))||r.tokens?.some(i=>n.has(i)))return{type:r.type,label:r.type,labelHe:xr(r.type)};return null}function xr(e){return{id:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA",agent_id:"\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF",policy:"\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4",name:"\u05E9\u05DD \u05D0\u05D3\u05DD",email:"\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9",phone:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF",address:"\u05DB\u05EA\u05D5\u05D1\u05EA",dob:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4",financial:"\u05E4\u05E8\u05D8\u05D9\u05DD \u05E4\u05D9\u05E0\u05E0\u05E1\u05D9\u05D9\u05DD",medical:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9",minor_data:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05DF",sensitive_personal:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9",biometric:"\u05DE\u05D9\u05D3\u05E2 \u05D1\u05D9\u05D5\u05DE\u05D8\u05E8\u05D9",auth:"\u05E1\u05D9\u05E1\u05DE\u05D0\u05D5\u05EA/\u05E1\u05D5\u05D3\u05D5\u05EA",tracking:"\u05DE\u05D6\u05D4\u05D9 \u05DE\u05E2\u05E7\u05D1",location:"\u05DE\u05D9\u05E7\u05D5\u05DD"}[e]??"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9"}function cl(e){let t=0,n=0,r=0,o=0,i=0;for(let a of e)typeof a=="string"&&(pi(a)&&t++,kr.lastIndex=0,kr.test(a)&&n++,wr.lastIndex=0,wr.test(a)&&r++,Sr.lastIndex=0,Sr.test(a)&&o++,sl(a)&&i++);let s=e.length||1;return t/s>=.3?{type:"id",label:"Israeli ID (sniffed)",matchedSample:t}:o/s>=.3?{type:"financial",label:"IBAN-IL (sniffed)",matchedSample:o}:n/s>=.3?{type:"phone",label:"IL phone (sniffed)",matchedSample:n}:r/s>=.3?{type:"email",label:"Email (sniffed)",matchedSample:r}:i/s>=.3?{type:"financial",label:"Credit card (sniffed)",matchedSample:i}:null}var ll={_comment:"CANONICAL secret ruleset \u2014 the SINGLE SOURCE OF TRUTH for hardcoded-secret detection, loaded by BOTH the web scanner (lib/soc/exposure-map.ts) and the installed Capsule agent (apps/desktop/src-tauri/src/scanner.rs, via include_str!). Patterns are written in the regex subset both JavaScript and the Rust `regex` crate accept (no lookaround, no backreferences). A connection string counts only WITH credentials (user:pass@). Edit here once and both engines stay aligned.",rules:[{id:"aws-access-key",subkind:"aws_access_key",name:"AWS Access Key",severity:"critical",pattern:"(?:^|[^A-Z0-9])AKIA[A-Z2-7]{16}(?:[^A-Z2-7]|$)",hint:"AWS access key id detected. Rotate via IAM and move to an environment variable."},{id:"aws-secret-key",subkind:"aws_secret_key",name:"AWS Secret Key",severity:"critical",pattern:`(?:aws_secret_access_key|aws_secret_key|secret_access_key)\\s*[=:]\\s*['"]?[A-Za-z0-9/+=]{40}['"]?`,hint:"AWS secret access key detected. Rotate immediately."},{id:"gcp-api-key",subkind:"gcp_api_key",name:"GCP API Key",severity:"critical",pattern:"AIza[0-9A-Za-z_-]{35}",hint:"Google API key detected. Restrict or rotate it in the Google Cloud console."},{id:"gcp-service-account",subkind:"gcp_service_account",name:"GCP Service Account",severity:"critical",pattern:'"type"\\s*:\\s*"service_account"',hint:"GCP service-account JSON detected. Move it out of the repo and rotate the key."},{id:"github-token",subkind:"github_token",name:"GitHub Token",severity:"critical",pattern:"gh[pousr]_[0-9a-zA-Z]{36,}",hint:"GitHub token detected. Revoke at https://github.com/settings/tokens."},{id:"github-fine-grained",subkind:"github_fine_grained_token",name:"GitHub Fine-Grained Token",severity:"critical",pattern:"github_pat_[0-9a-zA-Z_]{22,}",hint:"GitHub fine-grained token detected. Revoke it in GitHub settings."},{id:"gitlab-token",subkind:"gitlab_token",name:"GitLab Token",severity:"critical",pattern:"glpat-[0-9a-zA-Z_-]{20,}",hint:"GitLab token detected. Revoke it in GitLab access tokens."},{id:"stripe-secret",subkind:"stripe_key",name:"Stripe Secret Key",severity:"critical",pattern:"sk_live_[0-9a-zA-Z]{24,}",hint:"Stripe live secret key detected. Roll it in the Stripe dashboard."},{id:"stripe-restricted",subkind:"stripe_restricted_key",name:"Stripe Restricted Key",severity:"critical",pattern:"rk_live_[0-9a-zA-Z]{24,}",hint:"Stripe restricted key detected. Roll it in the Stripe dashboard."},{id:"slack-token",subkind:"slack_token",name:"Slack Token",severity:"high",pattern:"xox[baprs]-[0-9a-zA-Z-]{10,}",hint:"Slack token detected. Revoke it in the Slack app settings."},{id:"slack-webhook",subkind:"slack_webhook",name:"Slack Webhook",severity:"high",pattern:"hooks\\.slack\\.com/services/T[0-9A-Z]{8,}/B[0-9A-Z]{8,}/[0-9a-zA-Z]{24}",hint:"Slack incoming-webhook URL detected. Regenerate it."},{id:"twilio-api-key",subkind:"twilio_api_key",name:"Twilio API Key",severity:"high",pattern:"SK[0-9a-fA-F]{32}",hint:"Twilio API key detected. Rotate it in the Twilio console."},{id:"sendgrid-api-key",subkind:"sendgrid_api_key",name:"SendGrid API Key",severity:"critical",pattern:"SG\\.[0-9a-zA-Z_-]{22}\\.[0-9a-zA-Z_-]{43}",hint:"SendGrid API key detected. Rotate it in the SendGrid console."},{id:"postgres-uri",subkind:"postgres_uri",name:"PostgreSQL Connection String",severity:"critical",pattern:`postgres(?:ql)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"PostgreSQL connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"mongodb-uri",subkind:"mongodb_uri",name:"MongoDB Connection String",severity:"critical",pattern:`mongodb(?:\\+srv)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"MongoDB connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"redis-uri",subkind:"redis_uri",name:"Redis Connection String",severity:"high",pattern:`redis(?:s)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"Redis connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"openai-key",subkind:"openai_key",name:"OpenAI API Key",severity:"critical",pattern:"sk-[0-9a-zA-Z]{20,}T3BlbkFJ[0-9a-zA-Z]{20,}",hint:"OpenAI API key detected. Rotate at https://platform.openai.com/api-keys."},{id:"anthropic-key",subkind:"anthropic_key",name:"Anthropic API Key",severity:"critical",pattern:"sk-ant-[0-9a-zA-Z_-]{40,}",hint:"Anthropic API key detected. Rotate at https://console.anthropic.com/."},{id:"firebase-key",subkind:"firebase_key",name:"Firebase API Key",severity:"high",pattern:"AIza[0-9A-Za-z_-]{35}",hint:"Firebase API key detected. Restrict it in the Firebase console."},{id:"supabase-key",subkind:"supabase_key",name:"Supabase Service Key",severity:"critical",pattern:"eyJ[0-9a-zA-Z_-]{100,}",hint:"Long JWT (possible Supabase service key) detected. Rotate it and keep it server-side only."},{id:"private-key",subkind:"private_key",name:"Private Key",severity:"critical",pattern:"-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----",hint:"Private key material in plaintext. Rotate immediately and move to a key manager (KMS/Vault).",skipPlaceholder:!0},{id:"jwt-secret",subkind:"jwt_secret",name:"JWT/Generic Secret",severity:"high",pattern:`(?:jwt_secret|JWT_SECRET|secret_key|SECRET_KEY|api_secret|API_SECRET)\\s*[=:]\\s*['"][^'"]{8,}['"]`,hint:"Hardcoded signing/API secret detected. Move it to an environment variable and rotate it."},{id:"password-in-code",subkind:"password_in_code",name:"Password in Code",severity:"high",pattern:`(?:password|passwd|pwd)\\s*[=:]\\s*['"][^'"]{8,}['"]`,hint:"Hardcoded password detected. Move it to a secret manager and rotate it."},{id:"bearer-token",subkind:"bearer_token",name:"Bearer Token in Code",severity:"high",pattern:`['"]Bearer\\s+[0-9a-zA-Z._-]{20,}['"]`,hint:"Hardcoded bearer token detected. Move it to a secret manager and rotate it."},{id:"hex-secret-32",subkind:"hex_secret",name:"Hardcoded 32+ Hex Secret",severity:"medium",pattern:`['"][0-9a-f]{32,}['"]`,hint:"Long hex string that looks like a secret/hash. Confirm it is not a live credential."},{id:"base64-secret",subkind:"base64_secret",name:"Hardcoded Base64 Secret (long)",severity:"medium",pattern:`['"][A-Za-z0-9+/]{64,}={0,2}['"]`,hint:"Long base64 blob that looks like an embedded secret. Confirm it is not a live credential."}]};var Sm=[{pattern:/^(full_?name|first_?name|last_?name|spouse_?name|beneficiary_?name)$/i,type:"name",label:"Person name",labelHe:"\u05E9\u05DD \u05D0\u05D3\u05DD"},{pattern:/^(email|e_?mail|email_?address)$/i,type:"email",label:"Email address",labelHe:"\u05DB\u05EA\u05D5\u05D1\u05EA \u05D0\u05D9\u05DE\u05D9\u05D9\u05DC"},{pattern:/^(phone|mobile|telephone|phone_?number|cell_?phone)$/i,type:"phone",label:"Phone number",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF"},{pattern:/^(id_?number|identity|ssn|social_?security|national_?id|teudat_?zehut)$/i,type:"id",label:"ID number",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05DE\u05D6\u05D4\u05D4"},{pattern:/^(address|street_?address|home_?address)$/i,type:"address",label:"Address",labelHe:"\u05DB\u05EA\u05D5\u05D1\u05EA"},{pattern:/^(date_?of_?birth|dob|birth_?date|birthday)$/i,type:"dob",label:"Date of birth",labelHe:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"},{pattern:/^(bank_?account|iban|account_?number|bank_?details|routing_?number)$/i,type:"financial",label:"Bank account",labelHe:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7"},{pattern:/^(credit_?card|card_?number|cvv|cc_?number)$/i,type:"financial",label:"Credit card",labelHe:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"},{pattern:/^(salary|income|commission|premium|compensation)$/i,type:"financial",label:"Financial data",labelHe:"\u05E0\u05EA\u05D5\u05DF \u05E4\u05D9\u05E0\u05E0\u05E1\u05D9"},{pattern:/^(medical_?info|health_?conditions|diagnosis|medication)$/i,type:"medical",label:"Medical data",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(ip_?address)$/i,type:"tracking",label:"IP address",labelHe:"\u05DB\u05EA\u05D5\u05D1\u05EA IP"},{pattern:/^(passport|passport_?number|passport_?id)$/i,type:"id",label:"Passport number",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05D3\u05E8\u05DB\u05D5\u05DF"},{pattern:/^(driver_?license|drivers_?license|dl_?number)$/i,type:"id",label:"Driver license",labelHe:"\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF \u05E0\u05D4\u05D9\u05D2\u05D4"},{pattern:/^(iban|swift_?code|bic)$/i,type:"financial",label:"Banking code",labelHe:"\u05E7\u05D5\u05D3 \u05D1\u05E0\u05E7\u05D0\u05D9"},{pattern:/^(tax_?id|tin|vat_?number|ein)$/i,type:"financial",label:"Tax ID",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05DE\u05E1"},{pattern:/^(insurance_?number|policy_?number|member_?id)$/i,type:"id",label:"Insurance/Member ID",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05D1\u05D9\u05D8\u05D5\u05D7/\u05D7\u05D1\u05E8"},{pattern:/^(blood_?type|allergy|allergies|prescription)$/i,type:"medical",label:"Medical data",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(biometric|fingerprint|face_?id|retina)$/i,type:"biometric",label:"Biometric data",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05D1\u05D9\u05D5\u05DE\u05D8\u05E8\u05D9"},{pattern:/^(latitude|longitude|lat|lng|geo_?location|coordinates)$/i,type:"location",label:"Geolocation",labelHe:"\u05DE\u05D9\u05E7\u05D5\u05DD \u05D2\u05D9\u05D0\u05D5\u05D2\u05E8\u05E4\u05D9"},{pattern:/^(mac_?address|device_?fingerprint|imei|serial_?number)$/i,type:"tracking",label:"Device identifier",labelHe:"\u05DE\u05D6\u05D4\u05D4 \u05DE\u05DB\u05E9\u05D9\u05E8"},{pattern:/^(ethnicity|race|religion|political_?affiliation|sexual_?orientation)$/i,type:"sensitive_personal",label:"Sensitive personal",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9"},{pattern:/^(minor|child_?name|child_?age|dependent)$/i,type:"minor_data",label:"Minor data",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05E0\u05D9\u05DD"},{pattern:/^(signature|digital_?signature)$/i,type:"id",label:"Signature",labelHe:"\u05D7\u05EA\u05D9\u05DE\u05D4"},{pattern:/^(vehicle_?number|license_?plate|plate_?number)$/i,type:"tracking",label:"Vehicle ID",labelHe:"\u05DE\u05D6\u05D4\u05D4 \u05E8\u05DB\u05D1"}],Em=/^(id|uuid|created_?at|updated_?at|deleted_?at|status|type|category|description|title|slug|url|path|key|value|sort_?order|position|enabled|active|public|version|metadata|config|settings|options|data|content|body|raw|json|text|note|comment|label|color|icon|image|avatar|logo|thumbnail|preview|template|schema|format|mode|level|priority|severity|source|target|parent|child|owner|creator|modifier|assignee|project|workspace|organization|team|group|channel|thread|room|session|device|platform|browser|locale|timezone|currency|country|region|city|zip|postal|state|province|name|display_?name|user_?agent|password_?hash|secret|token|private_?key|auth_?token|constraint|index|sequence|trigger|function|procedure|database|namespace|migration|revision)$/i,xm=/^(beacon_?registr|device_?config|hardware|sensor|firmware|telemetry|metric|analytic|log_?event|audit_?log|system_?config|cache|queue|job|migration|schema_?version|spatial_?ref)/i,Am=/^(minor|major|uuid|rssi|tx_?power|beacon_?id|device_?type|firmware_?version|batch_?id|zone_?id)$/i;function dl(e,t){if(Em.test(e)||/^name$/i.test(e)||t&&xm.test(t)||Am.test(e))return null;for(let r of Sm)if(r.pattern.test(e))return r.type;let n=al(e);return n?n.type:null}var Xb=ll.rules.map(e=>({id:e.id,name:e.name,pattern:new RegExp(e.pattern),severity:e.severity}));var Zb=512*1024,Qb=50*1024*1024;var Tm={id:"high",agent_id:"high",policy:"high",financial:"high",medical:"critical",sensitive_personal:"critical",minor_data:"critical",biometric:"critical",auth:"critical",name:"medium",email:"high",phone:"high",address:"high",dob:"high",location:"high",tracking:"low"};function Im(e){return Tm[e]??"low"}function pl(e,t){let n=[];for(let r of t){let o=r.rows.length;for(let i=0;i<r.headers.length;i++){let s=r.headers[i]??"",a=s?dl(s.trim().replace(/["'`׳״:]/g,"").replace(/\s+/g,"_"),r.name)??Er(s)?.type??null:null,c=[];for(let u of r.rows){let p=u[i];typeof p=="string"&&p.length>0&&c.push(p)}let l=c.length>0?cl(c):null;l?n.push(ul(e,r.name,s,l.type,l.label,"value",l.matchedSample,o)):a&&n.push(ul(e,r.name,s,a,xr(a),"header",0,o))}}return n}function ul(e,t,n,r,o,i,s,a){return{file:e,location:t,column:n,type:r,label:o,category:xr(r),severity:Im(r),matchKind:i,hits:s,sampleSize:a}}var fl={_comment:"CANONICAL secret ruleset \u2014 the SINGLE SOURCE OF TRUTH for hardcoded-secret detection, loaded by BOTH the web scanner (lib/soc/exposure-map.ts) and the installed Capsule agent (apps/desktop/src-tauri/src/scanner.rs, via include_str!). Patterns are written in the regex subset both JavaScript and the Rust `regex` crate accept (no lookaround, no backreferences). A connection string counts only WITH credentials (user:pass@). Edit here once and both engines stay aligned.",rules:[{id:"aws-access-key",subkind:"aws_access_key",name:"AWS Access Key",severity:"critical",pattern:"(?:^|[^A-Z0-9])AKIA[A-Z2-7]{16}(?:[^A-Z2-7]|$)",hint:"AWS access key id detected. Rotate via IAM and move to an environment variable."},{id:"aws-secret-key",subkind:"aws_secret_key",name:"AWS Secret Key",severity:"critical",pattern:`(?:aws_secret_access_key|aws_secret_key|secret_access_key)\\s*[=:]\\s*['"]?[A-Za-z0-9/+=]{40}['"]?`,hint:"AWS secret access key detected. Rotate immediately."},{id:"gcp-api-key",subkind:"gcp_api_key",name:"GCP API Key",severity:"critical",pattern:"AIza[0-9A-Za-z_-]{35}",hint:"Google API key detected. Restrict or rotate it in the Google Cloud console."},{id:"gcp-service-account",subkind:"gcp_service_account",name:"GCP Service Account",severity:"critical",pattern:'"type"\\s*:\\s*"service_account"',hint:"GCP service-account JSON detected. Move it out of the repo and rotate the key."},{id:"github-token",subkind:"github_token",name:"GitHub Token",severity:"critical",pattern:"gh[pousr]_[0-9a-zA-Z]{36,}",hint:"GitHub token detected. Revoke at https://github.com/settings/tokens."},{id:"github-fine-grained",subkind:"github_fine_grained_token",name:"GitHub Fine-Grained Token",severity:"critical",pattern:"github_pat_[0-9a-zA-Z_]{22,}",hint:"GitHub fine-grained token detected. Revoke it in GitHub settings."},{id:"gitlab-token",subkind:"gitlab_token",name:"GitLab Token",severity:"critical",pattern:"glpat-[0-9a-zA-Z_-]{20,}",hint:"GitLab token detected. Revoke it in GitLab access tokens."},{id:"stripe-secret",subkind:"stripe_key",name:"Stripe Secret Key",severity:"critical",pattern:"sk_live_[0-9a-zA-Z]{24,}",hint:"Stripe live secret key detected. Roll it in the Stripe dashboard."},{id:"stripe-restricted",subkind:"stripe_restricted_key",name:"Stripe Restricted Key",severity:"critical",pattern:"rk_live_[0-9a-zA-Z]{24,}",hint:"Stripe restricted key detected. Roll it in the Stripe dashboard."},{id:"slack-token",subkind:"slack_token",name:"Slack Token",severity:"high",pattern:"xox[baprs]-[0-9a-zA-Z-]{10,}",hint:"Slack token detected. Revoke it in the Slack app settings."},{id:"slack-webhook",subkind:"slack_webhook",name:"Slack Webhook",severity:"high",pattern:"hooks\\.slack\\.com/services/T[0-9A-Z]{8,}/B[0-9A-Z]{8,}/[0-9a-zA-Z]{24}",hint:"Slack incoming-webhook URL detected. Regenerate it."},{id:"twilio-api-key",subkind:"twilio_api_key",name:"Twilio API Key",severity:"high",pattern:"SK[0-9a-fA-F]{32}",hint:"Twilio API key detected. Rotate it in the Twilio console."},{id:"sendgrid-api-key",subkind:"sendgrid_api_key",name:"SendGrid API Key",severity:"critical",pattern:"SG\\.[0-9a-zA-Z_-]{22}\\.[0-9a-zA-Z_-]{43}",hint:"SendGrid API key detected. Rotate it in the SendGrid console."},{id:"postgres-uri",subkind:"postgres_uri",name:"PostgreSQL Connection String",severity:"critical",pattern:`postgres(?:ql)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"PostgreSQL connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"mongodb-uri",subkind:"mongodb_uri",name:"MongoDB Connection String",severity:"critical",pattern:`mongodb(?:\\+srv)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"MongoDB connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"redis-uri",subkind:"redis_uri",name:"Redis Connection String",severity:"high",pattern:`redis(?:s)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"Redis connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"openai-key",subkind:"openai_key",name:"OpenAI API Key",severity:"critical",pattern:"sk-[0-9a-zA-Z]{20,}T3BlbkFJ[0-9a-zA-Z]{20,}",hint:"OpenAI API key detected. Rotate at https://platform.openai.com/api-keys."},{id:"anthropic-key",subkind:"anthropic_key",name:"Anthropic API Key",severity:"critical",pattern:"sk-ant-[0-9a-zA-Z_-]{40,}",hint:"Anthropic API key detected. Rotate at https://console.anthropic.com/."},{id:"firebase-key",subkind:"firebase_key",name:"Firebase API Key",severity:"high",pattern:"AIza[0-9A-Za-z_-]{35}",hint:"Firebase API key detected. Restrict it in the Firebase console."},{id:"supabase-key",subkind:"supabase_key",name:"Supabase Service Key",severity:"critical",pattern:"eyJ[0-9a-zA-Z_-]{100,}",hint:"Long JWT (possible Supabase service key) detected. Rotate it and keep it server-side only."},{id:"private-key",subkind:"private_key",name:"Private Key",severity:"critical",pattern:"-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----",hint:"Private key material in plaintext. Rotate immediately and move to a key manager (KMS/Vault).",skipPlaceholder:!0},{id:"jwt-secret",subkind:"jwt_secret",name:"JWT/Generic Secret",severity:"high",pattern:`(?:jwt_secret|JWT_SECRET|secret_key|SECRET_KEY|api_secret|API_SECRET)\\s*[=:]\\s*['"][^'"]{8,}['"]`,hint:"Hardcoded signing/API secret detected. Move it to an environment variable and rotate it."},{id:"password-in-code",subkind:"password_in_code",name:"Password in Code",severity:"high",pattern:`(?:password|passwd|pwd)\\s*[=:]\\s*['"][^'"]{8,}['"]`,hint:"Hardcoded password detected. Move it to a secret manager and rotate it."},{id:"bearer-token",subkind:"bearer_token",name:"Bearer Token in Code",severity:"high",pattern:`['"]Bearer\\s+[0-9a-zA-Z._-]{20,}['"]`,hint:"Hardcoded bearer token detected. Move it to a secret manager and rotate it."},{id:"hex-secret-32",subkind:"hex_secret",name:"Hardcoded 32+ Hex Secret",severity:"medium",pattern:`['"][0-9a-f]{32,}['"]`,hint:"Long hex string that looks like a secret/hash. Confirm it is not a live credential."},{id:"base64-secret",subkind:"base64_secret",name:"Hardcoded Base64 Secret (long)",severity:"medium",pattern:`['"][A-Za-z0-9+/]{64,}={0,2}['"]`,hint:"Long base64 blob that looks like an embedded secret. Confirm it is not a live credential."}]};var $m=[{type:"full_name",kind:"name",severity:"medium",hint:`A person's name in free text (after a role word such as \u05DC\u05E7\u05D5\u05D7 / \u05DE\u05E8 / \u05E2\u05D5"\u05D3).`},{type:"bank_account",kind:"bank_account",severity:"high",hint:"An Israeli bank account number (branch-account-check form) in plaintext."},{type:"medical",kind:"medical",severity:"high",hint:"Medical information (diagnosis, medication, lab value) in plaintext."},{type:"birth_date",kind:"dob",severity:"medium",hint:"A date of birth in plaintext."},{type:"address",kind:"address",severity:"medium",hint:"A street address in plaintext."},{type:"license_plate",kind:"plate",severity:"low",hint:"A vehicle licence plate in plaintext."}],Rm=/^(?:לקוח|מטופל|מועמד|שם|נהג|מבוטח|תובע|נתבע|שוכר|מחזיק|עו"ד|ד"ר|פרופ'|מר|גברת|חשבון|ח-ן|[בהוכלמש]{0,2}אבחנ[הות]|תאריך לידה|נולד|נולדה|ד\.ל\.|[בהוכלמש]{0,2}גיל)\s*:?\s*/;function Dm(e,t,n,r){if(r==="address")return{start:t,end:n};let o=Rm.exec(e.slice(t,n));return o&&t+o[0].length<n?{start:t+o[0].length,end:n}:{start:t,end:n}}var Cm=new Set(["hex-secret-32","base64-secret"]),hl=!1;function ml(){if(hl)return;hl=!0;let e=$m.map(({type:n,kind:r,severity:o,hint:i})=>{let s=new vr([n]);return{kind:r,severity:o,hint:i,find:a=>s.detect(a).map(c=>Dm(a,c.startIndex,c.endIndex,r))}}),t=fl.rules.filter(n=>!Cm.has(n.id)).map(n=>({id:n.id,name:n.name,severity:n.severity,pattern:new RegExp(n.pattern)}));Br({text:e,header:n=>{let r=Er(n);return r?{type:r.type,label:r.labelHe||r.label}:null},secrets:t,table:n=>pl("",[n]).filter(r=>r.column).map(r=>({column:r.column,type:r.type,category:r.category,severity:r.severity,hits:r.hits,how:r.matchKind==="value"?"value":"header"}))})}import{z as Fm}from"zod";import{existsSync as Mm,mkdirSync as Km,readFileSync as Hm,writeFileSync as Um}from"node:fs";import{homedir as _l,hostname as Ar}from"node:os";import{join as Rt}from"node:path";function ot(e){if(e===null||typeof e!="object")return JSON.stringify(e);if(Array.isArray(e))return"["+e.map(ot).join(",")+"]";let t=e;return"{"+Object.keys(t).sort().map(r=>JSON.stringify(r)+":"+ot(t[r])).join(",")+"}"}import{mkdirSync as Nm,readFileSync as fi,writeFileSync as hi,existsSync as mi,chmodSync as Om,statSync as jm}from"node:fs";import{join as yi}from"node:path";import _i from"node:crypto";function pn(e){return yi(e,"agent-private-key.pem")}function bi(e){return yi(e,"agent-public-key.pem")}function gi(e){return yi(e,"agent-key-meta.json")}function vi(e){Nm(e,{recursive:!0});let t=pn(e),n=bi(e);if(mi(t)&&mi(n))try{return Lm(e)}catch(r){throw new Error(`agent keystore corrupted at ${e}: ${r.message}`)}return Bm(e)}function Lm(e){let t=fi(pn(e),"utf8"),n=fi(bi(e),"utf8"),r=mi(gi(e))?JSON.parse(fi(gi(e),"utf8")):{},o=_i.createPrivateKey({key:t,format:"pem"});if(o.asymmetricKeyType!=="ed25519")throw new Error(`expected ed25519 key, got ${o.asymmetricKeyType}`);return{privateKey:o,publicKeyPem:n,generatedAt:r.generatedAt??new Date(jm(pn(e)).mtime).toISOString()}}function Bm(e){let{publicKey:t,privateKey:n}=_i.generateKeyPairSync("ed25519"),r=n.export({type:"pkcs8",format:"pem"}),o=t.export({type:"spki",format:"pem"}),i=new Date().toISOString();if(hi(pn(e),r,{encoding:"utf8"}),hi(bi(e),o,{encoding:"utf8"}),hi(gi(e),JSON.stringify({generatedAt:i},null,2),"utf8"),process.platform!=="win32")try{Om(pn(e),384)}catch{}return{privateKey:n,publicKeyPem:o,generatedAt:i}}function fn(e,t){return _i.sign(null,Buffer.from(t,"utf8"),e.privateKey).toString("hex")}var gl=3e4,hn=class{constructor(t){this.apiBase=t}url(t){return this.apiBase.replace(/\/+$/,"")+t}async request(t,n){let r=this.url(t);try{return await fetch(r,{...n,signal:AbortSignal.timeout(gl)})}catch(o){let i=o;if(i?.name==="TimeoutError"||i?.name==="AbortError")throw new Error(`${t} timed out after ${gl}ms (${r})`);let s=i?.cause?.code;throw new Error(`${t} could not reach ${r}${s?` (${s})`:""}: ${i?.message??String(o)}`)}}async enroll(t){let n=await this.request("/api/capsule/enroll",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(t)}),r=await n.text();if(!n.ok)throw new Error(`enroll failed: HTTP ${n.status} \u2014 ${r}`);return JSON.parse(r)}async heartbeat(t,n){let r=ot({deployment_id:t.deployment_id,agent_version:t.agent_version,applied_config:t.applied_config??null,discovered_release_version:t.discovered_release_version??null}),o=fn(n,r),i={...t,signature_hex:o},s=await this.request("/api/capsule/heartbeat",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(i)}),a=await s.text();if(!s.ok)throw new Error(`heartbeat failed: HTTP ${s.status} \u2014 ${a}`);try{return JSON.parse(a)}catch{return{ok:!0,desired_config:null,apply_update:!1}}}async submitSealBackup(t,n){let{deployment_id:r,...o}=t,i=ot(o),s=fn(n,i),a={deployment_id:r,...o,signature_hex:s},c=await this.request("/api/capsule/seal/backup",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(a)}),l=await c.text();if(!c.ok)throw new Error(`seal backup failed: HTTP ${c.status} \u2014 ${l}`);return JSON.parse(l)}async submitScan(t,n){let r=ot(t),o=fn(n,r),i={...t,signature_hex:o},s=await this.request("/api/capsule/scan/submit",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(i)}),a=await s.text();if(!s.ok)throw new Error(`scan submit failed: HTTP ${s.status} \u2014 ${a}`);return JSON.parse(a)}async submitSeal(t,n){let{deployment_id:r,...o}=t,i=ot(o),s=fn(n,i),a={deployment_id:r,...o,signature_hex:s},c=await this.request("/api/capsule/seal/submit",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(a)}),l=await c.text();if(!c.ok)throw new Error(`seal submit failed: HTTP ${c.status} \u2014 ${l}`);return JSON.parse(l)}};var Vm=300*1e3,Gm=1440*60*1e3,gn=()=>Rt(_l(),".nodata"),Tr=()=>Rt(gn(),"capsule.json"),yl=()=>Rt(gn(),"capsule-agents.json"),bl=()=>Rt(gn(),"capsule-key");function Pr(e){try{return Mm(e)?JSON.parse(Hm(e,"utf8")):null}catch{return null}}function Ir(e,t){Km(gn(),{recursive:!0}),Um(e,JSON.stringify(t,null,2)+`
-`,{mode:384})}function yn(){return Pr(Tr())}function Wm(e){let t=Date.now(),n=Pr(yl())??{};n[e]=t;let r=Object.fromEntries(Object.entries(n).filter(([,o])=>t-o<Gm));return Ir(yl(),r),Object.keys(r).sort()}function $r(){let t=(Pr(Rt(_l(),".claude","settings.json"))?.hooks?.PreToolUse??[]).flatMap(n=>n.hooks??[]).find(n=>n.command.includes("gate.mjs"))?.command;return t?t.includes("--block")?"block":"ask":null}function vl(){return Pr(Rt(gn(),"consent.json"))?.terms_version??null}var mn=null;async function ki(e){let t=yn();if(!t)return null;let n=Wm(e.agent()),r=new hn(t.api_base);try{let o=await r.heartbeat({deployment_id:t.deployment_id,agent_version:`mcp-${e.version}`,applied_config:{scan_interval_minutes:mn?.scan_interval_minutes??1440,release_channel:mn?.release_channel??"stable",enabled_apps:mn?.enabled_apps??null,scan_scope:{surface:"mcp",host:Ar(),agents:n,gate:$r(),terms_version:vl(),current_terms:ie}}},vi(bl()));mn=o.desired_config??mn;let i={...t,last_heartbeat_ok_at:new Date().toISOString(),last_error:null,revoked:!!o.revoked};return Ir(Tr(),i),i}catch(o){let i={...t,last_error:o instanceof Error?o.message.slice(0,200):String(o)};return Ir(Tr(),i),i}}function wi(e){if(!yn())return;let t=()=>{ki(e)};setTimeout(t,3e3).unref(),setInterval(t,Vm).unref()}function zm(e){if(!e)return"never";let t=Math.round((Date.now()-Date.parse(e))/6e4);return t<1?"just now":t<60?`${t} min ago`:`${Math.round(t/60)} h ago`}function kl(e,t){e.registerTool("nodata_node",{description:`Register THIS MACHINE as a Capsule node of the organisation \u2014 so "this machine is guarded" is something the organisation can verify, not only the user. One node per machine; every agent here (Claude Code, Cursor \u2026) is a workload on it; billing stays per decision, a node is not a billing unit. Uses the Capsule agent's own enrolment and signed heartbeat. The heartbeat reports only: the host name, the agents' names, whether the read gate is on, and the accepted terms version \u2014 never content. ASKS FIRST: without confirm:true it shows the status, or what registering would send. Call with confirm:true only after the user approves.`,inputSchema:{confirm:Fm.boolean().optional().describe("true = register this machine. Omit to see status / preview.")}},async({confirm:n})=>{let r=yn();if(r){let f=await ki(t);return{content:[{type:"text",text:[`CAPSULE NODE ${r.deployment_id} \u2014 org ${r.org_id} \xB7 ${t.who()}`,`  last verified heartbeat: ${zm(f?.last_heartbeat_ok_at)}${f?.last_error?`  (last error: ${f.last_error})`:""}`,f?.revoked?"  \u26A0 The organisation has paused this node.":"",`  reported: host ${Ar()}, agents, read gate ${$r()??"off"}, terms ${vl()??"not accepted"} \u2014 no content.`].filter(Boolean).join(`
-`)}]}}if(!t.org)return{content:[{type:"text",text:"This machine has no enrolled device identity, so it cannot register as a node. Connect first with nodata_connect (it enrolls the device), restart, then run nodata_node again."}],isError:!0};if(!n)return{content:[{type:"text",text:[`PREVIEW \u2014 nothing registered yet. ${t.who()}`,`Register this machine (${Ar()}) as a Capsule node of org ${t.org.id}:`,"  \xB7 a signing key is created in ~/.nodata/capsule-key (it never leaves this machine);","  \xB7 while an agent runs here, a signed heartbeat every 5 minutes reports: host name, the agents' names, read gate on/off, accepted terms version;","  \xB7 never file names, paths, findings or content;","  \xB7 the organisation sees the machine in its fleet, and can pause it.","A node is not a billing unit \u2014 billing stays per decision.","","Ask the user to approve, then call nodata_node again with confirm: true."].join(`
-`)}]};let o=await t.org.token();if(!o)return{content:[{type:"text",text:"No usable org credential \u2014 run nodata_connect."}],isError:!0};let i=await fetch(`${t.org.baseUrl}/api/v1/tenants/${encodeURIComponent(t.org.id)}/capsule/install-token`,{method:"POST",headers:{authorization:`Bearer ${o}`}}),s=await i.json().catch(()=>({}));if(!i.ok||!s.install_token)return{content:[{type:"text",text:`Could not start registration (HTTP ${i.status}): ${s.error??"no install token"}`}],isError:!0};let a=vi(bl()),l=await new hn(t.org.baseUrl).enroll({install_token:s.install_token,pubkey_pem:a.publicKeyPem,agent_version:`mcp-${t.version}`,agent_kind:"npm_cli"});Ir(Tr(),{deployment_id:l.deployment_id,org_id:t.org.id,api_base:t.org.baseUrl,enrolled_at:new Date().toISOString()});let u=await ki(t);wi(t);let p=await t.ack(`node ${l.deployment_id} on ${Ar()}`);return{content:[{type:"text",text:[`REGISTERED \u2014 this machine is Capsule node ${l.deployment_id} of org ${t.org.id}. ${t.who()}`,`  first heartbeat: ${u?.last_heartbeat_ok_at?"verified":`failed (${u?.last_error??"unknown"})`}`,"  the status line now shows when NoData last verified this node.",`Approval kept in ~/.nodata/acks.jsonl${Ce(p)}.`].join(`
-`)}]}})}import{z as _n}from"zod";import{spawn as qm}from"node:child_process";import{createHash as Jm,randomBytes as Ym}from"node:crypto";import{existsSync as Si,mkdirSync as Xm,readFileSync as Zm,rmSync as Qm,statSync as eg,writeFileSync as tg}from"node:fs";import{homedir as wl}from"node:os";import{join as Sl,resolve as ng}from"node:path";var kn=()=>Sl(wl(),".nodata","secrets.json"),vn=64*1024,rg=600*1e3,og=6;function ig(){try{return Si(kn())?JSON.parse(Zm(kn(),"utf8")):null}catch{return null}}function sg(e){return new Promise(t=>{let n=process.stdin;if(process.stderr.write(e),!n.isTTY){let i="";n.setEncoding("utf8"),n.on("data",s=>i+=s),n.on("end",()=>t(i.trim()));return}let r="";n.setRawMode(!0),n.resume(),n.setEncoding("utf8");let o=i=>{for(let s of i){if(s==="\r"||s===`
+Restart Claude Code to load it. Remove with: npx @nodatachat/mcp uninstall-gate`}function sl(){let e=rl(),t=e.hooks?.PreToolUse;if(!t||!t.some(fn))return"The NoData read gate is not installed.";if(e.hooks.PreToolUse=t.filter(n=>!fn(n)),e.hooks.PreToolUse.length===0&&delete e.hooks.PreToolUse,e.hooks.PostToolUse&&(e.hooks.PostToolUse=e.hooks.PostToolUse.filter(n=>!fn(n)),e.hooks.PostToolUse.length===0&&delete e.hooks.PostToolUse),nl(e.statusLine)){let n=li(ci())?JSON.parse(ui(ci(),"utf8")):null;n?e.statusLine=n:delete e.statusLine}return ol(e),"NoData read gate removed. Restart Claude Code to unload it."}var bm=[{type:"id_number",patterns:[/\b\d{9}\b/g,/ת\.?ז\.?\s*:?\s*(\d{9})/g,/זהות\s*:?\s*(\d{9})/g],confidence:.9,replacement:()=>"[\u05EA.\u05D6. \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"phone",patterns:[/\b0[2-9]\d[\s\-]?\d{7}\b/g,/\b05[0-9][\s\-]?\d{7}\b/g,/\+972[\s\-]?[2-9]\d[\s\-]?\d{7}\b/g],confidence:.95,replacement:()=>"[\u05D8\u05DC\u05E4\u05D5\u05DF \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"email",patterns:[/[a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}/g],confidence:.99,replacement:e=>{let[,t]=e.split("@");return`[\u05D0\u05D9\u05DE\u05D9\u05D9\u05DC: ***@${t}]`}},{type:"full_name",patterns:[/(?:לקוח|מטופל|מועמד|שם|נהג|מבוטח|תובע|נתבע|שוכר|מחזיק)[:\s]+([א-ת][א-ת"'\-\s]{2,30}?)(?=[,\n\d]|ת\.ז)/g,/(?:עו"ד|ד"ר|פרופ'|מר|גברת)\s+([א-ת][א-ת"'\-\s]{2,25}?)(?=[,\n])/g],confidence:.75,replacement:()=>"[\u05E9\u05DD \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"bank_account",patterns:[/\b\d{2}[\-]\d{5,9}[\-]\d{2,3}\b/g,/(?:חשבון|ח-ן)\s*:?\s*(\d[\d\-]{8,15})/g],confidence:.88,replacement:()=>"[\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"medical",patterns:[/(?<![א-ת])[בהוכלמש]{0,2}(?:סוכרת|יתר לחץ דם|אסתמה|דיכאון|חרדה|סרטן|אי ספיקת לב|אפילפסיה)(?![א-ת])/g,/\b(?:Metformin|Lisinopril|Atorvastatin|Amlodipine|Sertraline|Fluoxetine|Omeprazole|Warfarin|Aspirin|Insulin)\b/gi,/\bHbA1c\s*:?\s*[\d.]+%?/g,/\bBMI\s*:?\s*[\d.]+/g,/(?<![א-ת])[בהוכלמש]{0,2}אבחנ[הות]\s*:?\s*[^,\n.]{2,40}/g],confidence:.85,replacement:()=>"[\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"financial_amount",patterns:[/[\d,]+(?:\.\d{2})?\s*(?:₪|ש"ח|NIS|שקל(?:ים)?)/g,/(?:₪|NIS)\s*[\d,]+(?:\.\d{2})?/g],confidence:.92,replacement:()=>"[\u05E1\u05DB\u05D5\u05DD \u05DB\u05E1\u05E4\u05D9 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"birth_date",patterns:[/(?:תאריך לידה|נולד|נולדה|ד\.ל\.)\s*:?\s*\d{1,2}[\/\.\-]\d{1,2}[\/\.\-]\d{2,4}/g,/(?<![א-ת])[בהוכלמש]{0,2}גיל\s*:?\s*\d{1,3}\b/g],confidence:.88,replacement:()=>"[\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"address",patterns:[/רחוב\s+[א-ת][א-ת\s"'\-]{2,30}\s+\d{1,5}/g,/(?:רח'|רח\.)\s+[א-ת][א-ת\s"'\-]{2,30}\d{1,5}/g],confidence:.72,replacement:()=>"[\u05DB\u05EA\u05D5\u05D1\u05EA \u05DE\u05D5\u05E1\u05EA\u05E8\u05EA]"},{type:"license_plate",patterns:[/\b\d{2,3}[\-]\d{2,3}[\-]\d{2,3}\b/g],confidence:.8,replacement:()=>"[\u05DC\u05D5\u05D7\u05D9\u05EA \u05E8\u05D9\u05E9\u05D5\u05D9 \u05DE\u05D5\u05E1\u05EA\u05E8\u05EA]"}];function vm(e){if(e.length!==9)return!1;let t=e.split("").map(Number),n=0;for(let r=0;r<9;r++){let o=t[r]*(r%2===0?1:2);o>9&&(o-=9),n+=o}return n%10===0}var kr=class{constructor(t){this.enabledTypes=new Set(t)}detect(t){let n=[],r=new Set;for(let i of bm)if(this.enabledTypes.has(i.type))for(let s of i.patterns){let a=new RegExp(s.source,s.flags),c;for(;(c=a.exec(t))!==null;){let l=c[0],d=`${i.type}:${c.index}`;if(!r.has(d)){if(r.add(d),i.type==="id_number"){let p=l.replace(/\D/g,"");if(/^\d{9}$/.test(l)&&p.length===9&&!vm(p))continue}n.push({type:i.type,value:l,startIndex:c.index,endIndex:c.index+l.length,confidence:i.confidence,replacement:i.replacement(l,i.type)})}}}n.sort((i,s)=>i.startIndex-s.startIndex||s.confidence-i.confidence);let o=[];for(let i of n)o.some(a=>i.startIndex<a.endIndex&&i.endIndex>a.startIndex)||o.push(i);return o}};var km=[{pattern:/^(?:שם|שם_מלא|שם פרטי|שם_פרטי|שם משפחה|שם_משפחה|שם_אדם|שם הלקוח|שם_הלקוח|שם בן זוג|שם בן_זוג|שם המבוטח|שם_המבוטח|שם המוטב|שם_המוטב|שם מבוטח|שם_מבוטח|שם מוטב|שם_מוטב|שם הילד|שם_הילד|שם הקטין|שם_הקטין|firstname_he|lastname_he|shem|shem_mishpacha|shem_prati)$/i,type:"name",label:"Person name (Hebrew)",labelHe:"\u05E9\u05DD \u05D0\u05D3\u05DD"},{pattern:/^(?:ת"ז|ת\.ז|ת ז|תז|תעודת זהות|תעודת_זהות|מספר זהות|מספר_זהות|מס' זהות|מס_זהות|מס' ת"ז|teudat_zehut|tz|t_z|israeli_id|il_id)$/i,type:"id",label:"Israeli ID",labelHe:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA"},{pattern:/^(?:דרכון|מספר דרכון|מס דרכון|רישיון נהיגה|רישיון_נהיגה|רשיון נהיגה|מס רישיון|דרכון_מספר)$/i,type:"id",label:"Passport / DL (Hebrew)",labelHe:"\u05D3\u05E8\u05DB\u05D5\u05DF/\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF"},{pattern:/^(?:מייל|דוא"ל|דוא_ל|דואר אלקטרוני|דואר_אלקטרוני|אימייל|כתובת מייל|כתובת_מייל|כתובת דואר|כתובת_דואר)$/i,type:"email",label:"Email (Hebrew)",labelHe:"\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9"},{pattern:/^(?:טלפון|טל'|נייד|פלאפון|סלולרי|מספר טלפון|מספר_טלפון|טלפון נייד|טלפון_נייד|מס נייד|מס_נייד|מס' טל)$/i,type:"phone",label:"Phone (Hebrew)",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF"},{pattern:/^(?:כתובת|כתובת מגורים|כתובת_מגורים|רחוב|מס בית|מספר בית|עיר|ישוב|יישוב|מיקוד|כתובת מלאה|כתובת_מלאה|מען)$/i,type:"address",label:"Address (Hebrew)",labelHe:"\u05DB\u05EA\u05D5\u05D1\u05EA"},{pattern:/^(?:תאריך לידה|תאריך_לידה|ת לידה|תאריך הולדת|תאריך_הולדת|יום הולדת|יום_הולדת|גיל)$/i,type:"dob",label:"Date of birth (Hebrew)",labelHe:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"},{pattern:/^(?:חשבון בנק|חשבון_בנק|מספר חשבון|מספר_חשבון|מס חשבון|מס' חשבון|בנק|סניף|מס סניף|iban|iban_il)$/i,type:"financial",label:"Bank account (Hebrew)",labelHe:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7"},{pattern:/^(?:כרטיס אשראי|כרטיס_אשראי|מספר אשראי|מס אשראי|מס' אשראי|cvv|אשראי|מס כרטיס|מס_כרטיס)$/i,type:"financial",label:"Credit card (Hebrew)",labelHe:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"},{pattern:/^(?:שכר|משכורת|הכנסה|פרמיה|שכר ברוטו|שכר_ברוטו|שכר נטו|שכר_נטו|תגמול|בונוס|פיצוי)$/i,type:"financial",label:"Salary / income (Hebrew)",labelHe:"\u05E9\u05DB\u05E8/\u05D4\u05DB\u05E0\u05E1\u05D4"},{pattern:/^(?:אבחון|אבחנה|מחלה|תרופה|מרשם|בדיקה רפואית|בדיקה_רפואית|מצב רפואי|מצב_רפואי|חיסון|תוצאת בדיקה|תוצאת_בדיקה|רופא|רגישות|אלרגיה|סוג דם|סוג_דם)$/i,type:"medical",label:"Medical (Hebrew)",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(?:מספר פוליסה|מספר_פוליסה|מס פוליסה|מס' פוליסה|פוליסה|מספר חבר|מספר_חבר|מס חבר|מספר ביטוח|מספר_ביטוח|policy_?number|policy_?no|policy_?id)$/i,type:"policy",label:"Insurance policy number (Hebrew)",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4"},{pattern:/^(?:מספר סוכן|מספר_סוכן|מס סוכן|מס' סוכן|מס_סוכן|קוד סוכן|קוד_סוכן|מספר משווק|מספר_משווק|מספר יצרן|סוכן ביטוח|agent_?number|agent_?no|agent_?id|agent_?code|broker_?id|broker_?number)$/i,type:"agent_id",label:"Insurance agent / broker number (Hebrew)",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF"},{pattern:/^(?:שם הילד|שם_הילד|תעודת זהות של ילד|ילדים|קטין|מספר ילדים|מספר_ילדים|תעודת לידה|ת לידה ילד)$/i,type:"minor_data",label:"Minor data (Hebrew)",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05DF"},{pattern:/^(?:דת|לאום|מין|נטייה מינית|נטייה_מינית|השקפה פוליטית|השקפה_פוליטית|מצב משפחתי|מצב_משפחתי|עדה|מוצא)$/i,type:"sensitive_personal",label:"Sensitive personal (Hebrew)",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9"},{pattern:/^(?:מספר רכב|מספר_רכב|מס רכב|מס' רכב|לוחית רישוי|לוחית_רישוי|מספר רישוי|מספר_רישוי)$/i,type:"tracking",label:"Vehicle ID (Hebrew)",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"}];function hi(e){let t=String(e??"").replace(/\D/g,"");if(t.length===0||t.length>9)return!1;let n=t.padStart(9,"0"),r=0;for(let o=0;o<9;o++){let i=parseInt(n[o]??"0",10)*(o%2+1);i>9&&(i-=9),r+=i}return r%10===0&&parseInt(n,10)>0}var wr=/(?:\+972[\s-]?|0)(?:5[0-9]|[2-4]|[89])(?:[\s-]?\d){7}/g,Sr=/[a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,}/gi,Er=/\bIL\d{2}\s?(?:\d{4}\s?){4}\d{3}\b/g;function al(e){let t=String(e??"").replace(/\D/g,"");if(t.length<13||t.length>19)return!1;let n=0,r=!1;for(let o=t.length-1;o>=0;o--){let i=t.charCodeAt(o)-48;if(i<0||i>9)return!1;r&&(i*=2,i>9&&(i-=9)),n+=i,r=!r}return n%10===0}function cl(e){if(!e)return null;let t=e.trim();for(let n of km)if(n.pattern.test(t))return{type:n.type,label:n.label,labelHe:n.labelHe};return null}var wm=[{type:"biometric",tokens:["biometric","fingerprint","\u05D1\u05D9\u05D5\u05DE\u05D8\u05E8\u05D9"],phrases:["face id","\u05D8\u05D1\u05D9\u05E2\u05EA \u05D0\u05E6\u05D1\u05E2"]},{type:"medical",tokens:["diagnosis","medical","disease","medication","prescription","allergy","vaccine","\u05D0\u05D1\u05D7\u05D5\u05DF","\u05D0\u05D1\u05D7\u05E0\u05D4","\u05DE\u05D7\u05DC\u05D4","\u05EA\u05E8\u05D5\u05E4\u05D4","\u05DE\u05E8\u05E9\u05DD","\u05D7\u05D9\u05E1\u05D5\u05DF","\u05D0\u05DC\u05E8\u05D2\u05D9\u05D4"],phrases:["medical record","blood type","\u05DE\u05E6\u05D1 \u05E8\u05E4\u05D5\u05D0\u05D9","\u05E1\u05D5\u05D2 \u05D3\u05DD"]},{type:"sensitive_personal",tokens:["religion","ethnicity","nationality","\u05D3\u05EA","\u05DC\u05D0\u05D5\u05DD","\u05E2\u05D3\u05D4","\u05DE\u05D5\u05E6\u05D0"],phrases:["sexual orientation","marital status","\u05DE\u05E6\u05D1 \u05DE\u05E9\u05E4\u05D7\u05EA\u05D9","\u05E0\u05D8\u05D9\u05D9\u05D4 \u05DE\u05D9\u05E0\u05D9\u05EA"]},{type:"minor_data",tokens:["minor","\u05E7\u05D8\u05D9\u05DF"],phrases:["child name","\u05E9\u05DD \u05D4\u05D9\u05DC\u05D3","\u05E9\u05DD \u05D4\u05E7\u05D8\u05D9\u05DF"]},{type:"id",tokens:["ssn","passport","\u05D6\u05D4\u05D5\u05EA","\u05D3\u05E8\u05DB\u05D5\u05DF"],phrases:["national id","id number","identity number","social security","driver license","driving license","drivers license","passport number","tax id","\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA","\u05DE\u05E1\u05E4\u05E8 \u05D6\u05D4\u05D5\u05EA","\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF \u05E0\u05D4\u05D9\u05D2\u05D4"]},{type:"financial",tokens:["iban","swift","bic","salary","income","wage","\u05D0\u05E9\u05E8\u05D0\u05D9","\u05E9\u05DB\u05E8","\u05DE\u05E9\u05DB\u05D5\u05E8\u05EA","\u05D4\u05DB\u05E0\u05E1\u05D4"],phrases:["bank account","account number","credit card","card number","routing number","sort code","\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7","\u05DE\u05E1\u05E4\u05E8 \u05D7\u05E9\u05D1\u05D5\u05DF","\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"]},{type:"policy",tokens:["policy","\u05E4\u05D5\u05DC\u05D9\u05E1\u05D4"],phrases:["policy number","member number","\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4"]},{type:"agent_id",tokens:["\u05DE\u05E9\u05D5\u05D5\u05E7"],phrases:["agent number","agent code","broker id","\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF"]},{type:"dob",tokens:["dob","birthdate","birthday","\u05DC\u05D9\u05D3\u05D4","\u05D4\u05D5\u05DC\u05D3\u05EA","\u05D2\u05D9\u05DC"],phrases:["date of birth","birth date","\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"]},{type:"phone",tokens:["phone","tel","mobile","cell","fax","\u05D8\u05DC\u05E4\u05D5\u05DF","\u05E0\u05D9\u05D9\u05D3","\u05E4\u05DC\u05D0\u05E4\u05D5\u05DF","\u05E1\u05DC\u05D5\u05DC\u05E8\u05D9"],phrases:["phone number","mobile number","cell phone","\u05D8\u05DC\u05E4\u05D5\u05DF \u05E0\u05D9\u05D9\u05D3"]},{type:"email",tokens:["email","mail","\u05D0\u05D9\u05DE\u05D9\u05D9\u05DC","\u05DE\u05D9\u05D9\u05DC","\u05D3\u05D5\u05D0\u05DC"],phrases:["email address","e mail","\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9","\u05DB\u05EA\u05D5\u05D1\u05EA \u05DE\u05D9\u05D9\u05DC"]},{type:"address",tokens:["address","street","city","zipcode","zip","postcode","\u05DB\u05EA\u05D5\u05D1\u05EA","\u05E8\u05D7\u05D5\u05D1","\u05E2\u05D9\u05E8","\u05D9\u05E9\u05D5\u05D1","\u05D9\u05D9\u05E9\u05D5\u05D1","\u05DE\u05D9\u05E7\u05D5\u05D3","\u05DE\u05E2\u05DF"],phrases:["home address","postal code","street address","zip code","\u05DB\u05EA\u05D5\u05D1\u05EA \u05DE\u05D2\u05D5\u05E8\u05D9\u05DD"]},{type:"location",tokens:["gps","latitude","longitude","geolocation","\u05DE\u05D9\u05E7\u05D5\u05DD"],phrases:["gps coordinates"]},{type:"tracking",tokens:["plate","vehicle","\u05E8\u05DB\u05D1","\u05E8\u05D9\u05E9\u05D5\u05D9"],phrases:["license plate","vehicle number","plate number","\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"]},{type:"name",tokens:["name","\u05E9\u05DD"],phrases:["first name","last name","full name","family name","given name","surname","\u05E9\u05DD \u05E4\u05E8\u05D8\u05D9","\u05E9\u05DD \u05DE\u05E9\u05E4\u05D7\u05D4","\u05E9\u05DD \u05DE\u05DC\u05D0"]}];function xr(e){if(!e)return null;let t=e.trim().toLowerCase().replace(/["'`׳״]/g,"").replace(/[_\-.]+/g," ").replace(/\s+/g," ").trim();if(!t)return null;let n=new Set(t.match(/[\p{L}\p{N}]+/gu)??[]);for(let r of wm)if(r.phrases?.some(i=>t.includes(i))||r.tokens?.some(i=>n.has(i)))return{type:r.type,label:r.type,labelHe:Ar(r.type)};return null}function Ar(e){return{id:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA",agent_id:"\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF",policy:"\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4",name:"\u05E9\u05DD \u05D0\u05D3\u05DD",email:"\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9",phone:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF",address:"\u05DB\u05EA\u05D5\u05D1\u05EA",dob:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4",financial:"\u05E4\u05E8\u05D8\u05D9\u05DD \u05E4\u05D9\u05E0\u05E0\u05E1\u05D9\u05D9\u05DD",medical:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9",minor_data:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05DF",sensitive_personal:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9",biometric:"\u05DE\u05D9\u05D3\u05E2 \u05D1\u05D9\u05D5\u05DE\u05D8\u05E8\u05D9",auth:"\u05E1\u05D9\u05E1\u05DE\u05D0\u05D5\u05EA/\u05E1\u05D5\u05D3\u05D5\u05EA",tracking:"\u05DE\u05D6\u05D4\u05D9 \u05DE\u05E2\u05E7\u05D1",location:"\u05DE\u05D9\u05E7\u05D5\u05DD"}[e]??"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9"}function ll(e){let t=0,n=0,r=0,o=0,i=0;for(let a of e)typeof a=="string"&&(hi(a)&&t++,wr.lastIndex=0,wr.test(a)&&n++,Sr.lastIndex=0,Sr.test(a)&&r++,Er.lastIndex=0,Er.test(a)&&o++,al(a)&&i++);let s=e.length||1;return t/s>=.3?{type:"id",label:"Israeli ID (sniffed)",matchedSample:t}:o/s>=.3?{type:"financial",label:"IBAN-IL (sniffed)",matchedSample:o}:n/s>=.3?{type:"phone",label:"IL phone (sniffed)",matchedSample:n}:r/s>=.3?{type:"email",label:"Email (sniffed)",matchedSample:r}:i/s>=.3?{type:"financial",label:"Credit card (sniffed)",matchedSample:i}:null}var dl={_comment:"CANONICAL secret ruleset \u2014 the SINGLE SOURCE OF TRUTH for hardcoded-secret detection, loaded by BOTH the web scanner (lib/soc/exposure-map.ts) and the installed Capsule agent (apps/desktop/src-tauri/src/scanner.rs, via include_str!). Patterns are written in the regex subset both JavaScript and the Rust `regex` crate accept (no lookaround, no backreferences). A connection string counts only WITH credentials (user:pass@). Edit here once and both engines stay aligned.",rules:[{id:"aws-access-key",subkind:"aws_access_key",name:"AWS Access Key",severity:"critical",pattern:"(?:^|[^A-Z0-9])AKIA[A-Z2-7]{16}(?:[^A-Z2-7]|$)",hint:"AWS access key id detected. Rotate via IAM and move to an environment variable."},{id:"aws-secret-key",subkind:"aws_secret_key",name:"AWS Secret Key",severity:"critical",pattern:`(?:aws_secret_access_key|aws_secret_key|secret_access_key)\\s*[=:]\\s*['"]?[A-Za-z0-9/+=]{40}['"]?`,hint:"AWS secret access key detected. Rotate immediately."},{id:"gcp-api-key",subkind:"gcp_api_key",name:"GCP API Key",severity:"critical",pattern:"AIza[0-9A-Za-z_-]{35}",hint:"Google API key detected. Restrict or rotate it in the Google Cloud console."},{id:"gcp-service-account",subkind:"gcp_service_account",name:"GCP Service Account",severity:"critical",pattern:'"type"\\s*:\\s*"service_account"',hint:"GCP service-account JSON detected. Move it out of the repo and rotate the key."},{id:"github-token",subkind:"github_token",name:"GitHub Token",severity:"critical",pattern:"gh[pousr]_[0-9a-zA-Z]{36,}",hint:"GitHub token detected. Revoke at https://github.com/settings/tokens."},{id:"github-fine-grained",subkind:"github_fine_grained_token",name:"GitHub Fine-Grained Token",severity:"critical",pattern:"github_pat_[0-9a-zA-Z_]{22,}",hint:"GitHub fine-grained token detected. Revoke it in GitHub settings."},{id:"gitlab-token",subkind:"gitlab_token",name:"GitLab Token",severity:"critical",pattern:"glpat-[0-9a-zA-Z_-]{20,}",hint:"GitLab token detected. Revoke it in GitLab access tokens."},{id:"stripe-secret",subkind:"stripe_key",name:"Stripe Secret Key",severity:"critical",pattern:"sk_live_[0-9a-zA-Z]{24,}",hint:"Stripe live secret key detected. Roll it in the Stripe dashboard."},{id:"stripe-restricted",subkind:"stripe_restricted_key",name:"Stripe Restricted Key",severity:"critical",pattern:"rk_live_[0-9a-zA-Z]{24,}",hint:"Stripe restricted key detected. Roll it in the Stripe dashboard."},{id:"slack-token",subkind:"slack_token",name:"Slack Token",severity:"high",pattern:"xox[baprs]-[0-9a-zA-Z-]{10,}",hint:"Slack token detected. Revoke it in the Slack app settings."},{id:"slack-webhook",subkind:"slack_webhook",name:"Slack Webhook",severity:"high",pattern:"hooks\\.slack\\.com/services/T[0-9A-Z]{8,}/B[0-9A-Z]{8,}/[0-9a-zA-Z]{24}",hint:"Slack incoming-webhook URL detected. Regenerate it."},{id:"twilio-api-key",subkind:"twilio_api_key",name:"Twilio API Key",severity:"high",pattern:"SK[0-9a-fA-F]{32}",hint:"Twilio API key detected. Rotate it in the Twilio console."},{id:"sendgrid-api-key",subkind:"sendgrid_api_key",name:"SendGrid API Key",severity:"critical",pattern:"SG\\.[0-9a-zA-Z_-]{22}\\.[0-9a-zA-Z_-]{43}",hint:"SendGrid API key detected. Rotate it in the SendGrid console."},{id:"postgres-uri",subkind:"postgres_uri",name:"PostgreSQL Connection String",severity:"critical",pattern:`postgres(?:ql)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"PostgreSQL connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"mongodb-uri",subkind:"mongodb_uri",name:"MongoDB Connection String",severity:"critical",pattern:`mongodb(?:\\+srv)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"MongoDB connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"redis-uri",subkind:"redis_uri",name:"Redis Connection String",severity:"high",pattern:`redis(?:s)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"Redis connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"openai-key",subkind:"openai_key",name:"OpenAI API Key",severity:"critical",pattern:"sk-[0-9a-zA-Z]{20,}T3BlbkFJ[0-9a-zA-Z]{20,}",hint:"OpenAI API key detected. Rotate at https://platform.openai.com/api-keys."},{id:"anthropic-key",subkind:"anthropic_key",name:"Anthropic API Key",severity:"critical",pattern:"sk-ant-[0-9a-zA-Z_-]{40,}",hint:"Anthropic API key detected. Rotate at https://console.anthropic.com/."},{id:"firebase-key",subkind:"firebase_key",name:"Firebase API Key",severity:"high",pattern:"AIza[0-9A-Za-z_-]{35}",hint:"Firebase API key detected. Restrict it in the Firebase console."},{id:"supabase-key",subkind:"supabase_key",name:"Supabase Service Key",severity:"critical",pattern:"eyJ[0-9a-zA-Z_-]{100,}",hint:"Long JWT (possible Supabase service key) detected. Rotate it and keep it server-side only."},{id:"private-key",subkind:"private_key",name:"Private Key",severity:"critical",pattern:"-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----",hint:"Private key material in plaintext. Rotate immediately and move to a key manager (KMS/Vault).",skipPlaceholder:!0},{id:"jwt-secret",subkind:"jwt_secret",name:"JWT/Generic Secret",severity:"high",pattern:`(?:jwt_secret|JWT_SECRET|secret_key|SECRET_KEY|api_secret|API_SECRET)\\s*[=:]\\s*['"][^'"]{8,}['"]`,hint:"Hardcoded signing/API secret detected. Move it to an environment variable and rotate it."},{id:"password-in-code",subkind:"password_in_code",name:"Password in Code",severity:"high",pattern:`(?:password|passwd|pwd)\\s*[=:]\\s*['"][^'"]{8,}['"]`,hint:"Hardcoded password detected. Move it to a secret manager and rotate it."},{id:"bearer-token",subkind:"bearer_token",name:"Bearer Token in Code",severity:"high",pattern:`['"]Bearer\\s+[0-9a-zA-Z._-]{20,}['"]`,hint:"Hardcoded bearer token detected. Move it to a secret manager and rotate it."},{id:"hex-secret-32",subkind:"hex_secret",name:"Hardcoded 32+ Hex Secret",severity:"medium",pattern:`['"][0-9a-f]{32,}['"]`,hint:"Long hex string that looks like a secret/hash. Confirm it is not a live credential."},{id:"base64-secret",subkind:"base64_secret",name:"Hardcoded Base64 Secret (long)",severity:"medium",pattern:`['"][A-Za-z0-9+/]{64,}={0,2}['"]`,hint:"Long base64 blob that looks like an embedded secret. Confirm it is not a live credential."}]};var xm=[{pattern:/^(full_?name|first_?name|last_?name|spouse_?name|beneficiary_?name)$/i,type:"name",label:"Person name",labelHe:"\u05E9\u05DD \u05D0\u05D3\u05DD"},{pattern:/^(email|e_?mail|email_?address)$/i,type:"email",label:"Email address",labelHe:"\u05DB\u05EA\u05D5\u05D1\u05EA \u05D0\u05D9\u05DE\u05D9\u05D9\u05DC"},{pattern:/^(phone|mobile|telephone|phone_?number|cell_?phone)$/i,type:"phone",label:"Phone number",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF"},{pattern:/^(id_?number|identity|ssn|social_?security|national_?id|teudat_?zehut)$/i,type:"id",label:"ID number",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05DE\u05D6\u05D4\u05D4"},{pattern:/^(address|street_?address|home_?address)$/i,type:"address",label:"Address",labelHe:"\u05DB\u05EA\u05D5\u05D1\u05EA"},{pattern:/^(date_?of_?birth|dob|birth_?date|birthday)$/i,type:"dob",label:"Date of birth",labelHe:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"},{pattern:/^(bank_?account|iban|account_?number|bank_?details|routing_?number)$/i,type:"financial",label:"Bank account",labelHe:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7"},{pattern:/^(credit_?card|card_?number|cvv|cc_?number)$/i,type:"financial",label:"Credit card",labelHe:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"},{pattern:/^(salary|income|commission|premium|compensation)$/i,type:"financial",label:"Financial data",labelHe:"\u05E0\u05EA\u05D5\u05DF \u05E4\u05D9\u05E0\u05E0\u05E1\u05D9"},{pattern:/^(medical_?info|health_?conditions|diagnosis|medication)$/i,type:"medical",label:"Medical data",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(ip_?address)$/i,type:"tracking",label:"IP address",labelHe:"\u05DB\u05EA\u05D5\u05D1\u05EA IP"},{pattern:/^(passport|passport_?number|passport_?id)$/i,type:"id",label:"Passport number",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05D3\u05E8\u05DB\u05D5\u05DF"},{pattern:/^(driver_?license|drivers_?license|dl_?number)$/i,type:"id",label:"Driver license",labelHe:"\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF \u05E0\u05D4\u05D9\u05D2\u05D4"},{pattern:/^(iban|swift_?code|bic)$/i,type:"financial",label:"Banking code",labelHe:"\u05E7\u05D5\u05D3 \u05D1\u05E0\u05E7\u05D0\u05D9"},{pattern:/^(tax_?id|tin|vat_?number|ein)$/i,type:"financial",label:"Tax ID",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05DE\u05E1"},{pattern:/^(insurance_?number|policy_?number|member_?id)$/i,type:"id",label:"Insurance/Member ID",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05D1\u05D9\u05D8\u05D5\u05D7/\u05D7\u05D1\u05E8"},{pattern:/^(blood_?type|allergy|allergies|prescription)$/i,type:"medical",label:"Medical data",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(biometric|fingerprint|face_?id|retina)$/i,type:"biometric",label:"Biometric data",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05D1\u05D9\u05D5\u05DE\u05D8\u05E8\u05D9"},{pattern:/^(latitude|longitude|lat|lng|geo_?location|coordinates)$/i,type:"location",label:"Geolocation",labelHe:"\u05DE\u05D9\u05E7\u05D5\u05DD \u05D2\u05D9\u05D0\u05D5\u05D2\u05E8\u05E4\u05D9"},{pattern:/^(mac_?address|device_?fingerprint|imei|serial_?number)$/i,type:"tracking",label:"Device identifier",labelHe:"\u05DE\u05D6\u05D4\u05D4 \u05DE\u05DB\u05E9\u05D9\u05E8"},{pattern:/^(ethnicity|race|religion|political_?affiliation|sexual_?orientation)$/i,type:"sensitive_personal",label:"Sensitive personal",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9"},{pattern:/^(minor|child_?name|child_?age|dependent)$/i,type:"minor_data",label:"Minor data",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05E0\u05D9\u05DD"},{pattern:/^(signature|digital_?signature)$/i,type:"id",label:"Signature",labelHe:"\u05D7\u05EA\u05D9\u05DE\u05D4"},{pattern:/^(vehicle_?number|license_?plate|plate_?number)$/i,type:"tracking",label:"Vehicle ID",labelHe:"\u05DE\u05D6\u05D4\u05D4 \u05E8\u05DB\u05D1"}],Am=/^(id|uuid|created_?at|updated_?at|deleted_?at|status|type|category|description|title|slug|url|path|key|value|sort_?order|position|enabled|active|public|version|metadata|config|settings|options|data|content|body|raw|json|text|note|comment|label|color|icon|image|avatar|logo|thumbnail|preview|template|schema|format|mode|level|priority|severity|source|target|parent|child|owner|creator|modifier|assignee|project|workspace|organization|team|group|channel|thread|room|session|device|platform|browser|locale|timezone|currency|country|region|city|zip|postal|state|province|name|display_?name|user_?agent|password_?hash|secret|token|private_?key|auth_?token|constraint|index|sequence|trigger|function|procedure|database|namespace|migration|revision)$/i,Tm=/^(beacon_?registr|device_?config|hardware|sensor|firmware|telemetry|metric|analytic|log_?event|audit_?log|system_?config|cache|queue|job|migration|schema_?version|spatial_?ref)/i,Im=/^(minor|major|uuid|rssi|tx_?power|beacon_?id|device_?type|firmware_?version|batch_?id|zone_?id)$/i;function ul(e,t){if(Am.test(e)||/^name$/i.test(e)||t&&Tm.test(t)||Im.test(e))return null;for(let r of xm)if(r.pattern.test(e))return r.type;let n=cl(e);return n?n.type:null}var ev=dl.rules.map(e=>({id:e.id,name:e.name,pattern:new RegExp(e.pattern),severity:e.severity}));var tv=512*1024,nv=50*1024*1024;var $m={id:"high",agent_id:"high",policy:"high",financial:"high",medical:"critical",sensitive_personal:"critical",minor_data:"critical",biometric:"critical",auth:"critical",name:"medium",email:"high",phone:"high",address:"high",dob:"high",location:"high",tracking:"low"};function Pm(e){return $m[e]??"low"}function fl(e,t){let n=[];for(let r of t){let o=r.rows.length;for(let i=0;i<r.headers.length;i++){let s=r.headers[i]??"",a=s?ul(s.trim().replace(/["'`׳״:]/g,"").replace(/\s+/g,"_"),r.name)??xr(s)?.type??null:null,c=[];for(let d of r.rows){let p=d[i];typeof p=="string"&&p.length>0&&c.push(p)}let l=c.length>0?ll(c):null;l?n.push(pl(e,r.name,s,l.type,l.label,"value",l.matchedSample,o)):a&&n.push(pl(e,r.name,s,a,Ar(a),"header",0,o))}}return n}function pl(e,t,n,r,o,i,s,a){return{file:e,location:t,column:n,type:r,label:o,category:Ar(r),severity:Pm(r),matchKind:i,hits:s,sampleSize:a}}var hl={_comment:"CANONICAL secret ruleset \u2014 the SINGLE SOURCE OF TRUTH for hardcoded-secret detection, loaded by BOTH the web scanner (lib/soc/exposure-map.ts) and the installed Capsule agent (apps/desktop/src-tauri/src/scanner.rs, via include_str!). Patterns are written in the regex subset both JavaScript and the Rust `regex` crate accept (no lookaround, no backreferences). A connection string counts only WITH credentials (user:pass@). Edit here once and both engines stay aligned.",rules:[{id:"aws-access-key",subkind:"aws_access_key",name:"AWS Access Key",severity:"critical",pattern:"(?:^|[^A-Z0-9])AKIA[A-Z2-7]{16}(?:[^A-Z2-7]|$)",hint:"AWS access key id detected. Rotate via IAM and move to an environment variable."},{id:"aws-secret-key",subkind:"aws_secret_key",name:"AWS Secret Key",severity:"critical",pattern:`(?:aws_secret_access_key|aws_secret_key|secret_access_key)\\s*[=:]\\s*['"]?[A-Za-z0-9/+=]{40}['"]?`,hint:"AWS secret access key detected. Rotate immediately."},{id:"gcp-api-key",subkind:"gcp_api_key",name:"GCP API Key",severity:"critical",pattern:"AIza[0-9A-Za-z_-]{35}",hint:"Google API key detected. Restrict or rotate it in the Google Cloud console."},{id:"gcp-service-account",subkind:"gcp_service_account",name:"GCP Service Account",severity:"critical",pattern:'"type"\\s*:\\s*"service_account"',hint:"GCP service-account JSON detected. Move it out of the repo and rotate the key."},{id:"github-token",subkind:"github_token",name:"GitHub Token",severity:"critical",pattern:"gh[pousr]_[0-9a-zA-Z]{36,}",hint:"GitHub token detected. Revoke at https://github.com/settings/tokens."},{id:"github-fine-grained",subkind:"github_fine_grained_token",name:"GitHub Fine-Grained Token",severity:"critical",pattern:"github_pat_[0-9a-zA-Z_]{22,}",hint:"GitHub fine-grained token detected. Revoke it in GitHub settings."},{id:"gitlab-token",subkind:"gitlab_token",name:"GitLab Token",severity:"critical",pattern:"glpat-[0-9a-zA-Z_-]{20,}",hint:"GitLab token detected. Revoke it in GitLab access tokens."},{id:"stripe-secret",subkind:"stripe_key",name:"Stripe Secret Key",severity:"critical",pattern:"sk_live_[0-9a-zA-Z]{24,}",hint:"Stripe live secret key detected. Roll it in the Stripe dashboard."},{id:"stripe-restricted",subkind:"stripe_restricted_key",name:"Stripe Restricted Key",severity:"critical",pattern:"rk_live_[0-9a-zA-Z]{24,}",hint:"Stripe restricted key detected. Roll it in the Stripe dashboard."},{id:"slack-token",subkind:"slack_token",name:"Slack Token",severity:"high",pattern:"xox[baprs]-[0-9a-zA-Z-]{10,}",hint:"Slack token detected. Revoke it in the Slack app settings."},{id:"slack-webhook",subkind:"slack_webhook",name:"Slack Webhook",severity:"high",pattern:"hooks\\.slack\\.com/services/T[0-9A-Z]{8,}/B[0-9A-Z]{8,}/[0-9a-zA-Z]{24}",hint:"Slack incoming-webhook URL detected. Regenerate it."},{id:"twilio-api-key",subkind:"twilio_api_key",name:"Twilio API Key",severity:"high",pattern:"SK[0-9a-fA-F]{32}",hint:"Twilio API key detected. Rotate it in the Twilio console."},{id:"sendgrid-api-key",subkind:"sendgrid_api_key",name:"SendGrid API Key",severity:"critical",pattern:"SG\\.[0-9a-zA-Z_-]{22}\\.[0-9a-zA-Z_-]{43}",hint:"SendGrid API key detected. Rotate it in the SendGrid console."},{id:"postgres-uri",subkind:"postgres_uri",name:"PostgreSQL Connection String",severity:"critical",pattern:`postgres(?:ql)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"PostgreSQL connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"mongodb-uri",subkind:"mongodb_uri",name:"MongoDB Connection String",severity:"critical",pattern:`mongodb(?:\\+srv)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"MongoDB connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"redis-uri",subkind:"redis_uri",name:"Redis Connection String",severity:"high",pattern:`redis(?:s)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"Redis connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"openai-key",subkind:"openai_key",name:"OpenAI API Key",severity:"critical",pattern:"sk-[0-9a-zA-Z]{20,}T3BlbkFJ[0-9a-zA-Z]{20,}",hint:"OpenAI API key detected. Rotate at https://platform.openai.com/api-keys."},{id:"anthropic-key",subkind:"anthropic_key",name:"Anthropic API Key",severity:"critical",pattern:"sk-ant-[0-9a-zA-Z_-]{40,}",hint:"Anthropic API key detected. Rotate at https://console.anthropic.com/."},{id:"firebase-key",subkind:"firebase_key",name:"Firebase API Key",severity:"high",pattern:"AIza[0-9A-Za-z_-]{35}",hint:"Firebase API key detected. Restrict it in the Firebase console."},{id:"supabase-key",subkind:"supabase_key",name:"Supabase Service Key",severity:"critical",pattern:"eyJ[0-9a-zA-Z_-]{100,}",hint:"Long JWT (possible Supabase service key) detected. Rotate it and keep it server-side only."},{id:"private-key",subkind:"private_key",name:"Private Key",severity:"critical",pattern:"-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----",hint:"Private key material in plaintext. Rotate immediately and move to a key manager (KMS/Vault).",skipPlaceholder:!0},{id:"jwt-secret",subkind:"jwt_secret",name:"JWT/Generic Secret",severity:"high",pattern:`(?:jwt_secret|JWT_SECRET|secret_key|SECRET_KEY|api_secret|API_SECRET)\\s*[=:]\\s*['"][^'"]{8,}['"]`,hint:"Hardcoded signing/API secret detected. Move it to an environment variable and rotate it."},{id:"password-in-code",subkind:"password_in_code",name:"Password in Code",severity:"high",pattern:`(?:password|passwd|pwd)\\s*[=:]\\s*['"][^'"]{8,}['"]`,hint:"Hardcoded password detected. Move it to a secret manager and rotate it."},{id:"bearer-token",subkind:"bearer_token",name:"Bearer Token in Code",severity:"high",pattern:`['"]Bearer\\s+[0-9a-zA-Z._-]{20,}['"]`,hint:"Hardcoded bearer token detected. Move it to a secret manager and rotate it."},{id:"hex-secret-32",subkind:"hex_secret",name:"Hardcoded 32+ Hex Secret",severity:"medium",pattern:`['"][0-9a-f]{32,}['"]`,hint:"Long hex string that looks like a secret/hash. Confirm it is not a live credential."},{id:"base64-secret",subkind:"base64_secret",name:"Hardcoded Base64 Secret (long)",severity:"medium",pattern:`['"][A-Za-z0-9+/]{64,}={0,2}['"]`,hint:"Long base64 blob that looks like an embedded secret. Confirm it is not a live credential."}]};var Dm=[{type:"full_name",kind:"name",severity:"medium",hint:`A person's name in free text (after a role word such as \u05DC\u05E7\u05D5\u05D7 / \u05DE\u05E8 / \u05E2\u05D5"\u05D3).`},{type:"bank_account",kind:"bank_account",severity:"high",hint:"An Israeli bank account number (branch-account-check form) in plaintext."},{type:"medical",kind:"medical",severity:"high",hint:"Medical information (diagnosis, medication, lab value) in plaintext."},{type:"birth_date",kind:"dob",severity:"medium",hint:"A date of birth in plaintext."},{type:"address",kind:"address",severity:"medium",hint:"A street address in plaintext."},{type:"license_plate",kind:"plate",severity:"low",hint:"A vehicle licence plate in plaintext."}],Cm=/^(?:לקוח|מטופל|מועמד|שם|נהג|מבוטח|תובע|נתבע|שוכר|מחזיק|עו"ד|ד"ר|פרופ'|מר|גברת|חשבון|ח-ן|[בהוכלמש]{0,2}אבחנ[הות]|תאריך לידה|נולד|נולדה|ד\.ל\.|[בהוכלמש]{0,2}גיל)\s*:?\s*/;function Nm(e,t,n,r){if(r==="address")return{start:t,end:n};let o=Cm.exec(e.slice(t,n));return o&&t+o[0].length<n?{start:t+o[0].length,end:n}:{start:t,end:n}}var Om=new Set(["hex-secret-32","base64-secret"]),ml=!1;function gl(){if(ml)return;ml=!0;let e=Dm.map(({type:n,kind:r,severity:o,hint:i})=>{let s=new kr([n]);return{kind:r,severity:o,hint:i,find:a=>s.detect(a).map(c=>Nm(a,c.startIndex,c.endIndex,r))}}),t=hl.rules.filter(n=>!Om.has(n.id)).map(n=>({id:n.id,name:n.name,severity:n.severity,pattern:new RegExp(n.pattern)}));Fr({text:e,header:n=>{let r=xr(n);return r?{type:r.type,label:r.labelHe||r.label}:null},secrets:t,table:n=>fl("",[n]).filter(r=>r.column).map(r=>({column:r.column,type:r.type,category:r.category,severity:r.severity,hits:r.hits,how:r.matchKind==="value"?"value":"header"}))})}import{z as Km}from"zod";import{existsSync as Hm,mkdirSync as Um,readFileSync as Vm,writeFileSync as Gm}from"node:fs";import{homedir as bl,hostname as Tr}from"node:os";import{join as Rt}from"node:path";function st(e){if(e===null||typeof e!="object")return JSON.stringify(e);if(Array.isArray(e))return"["+e.map(st).join(",")+"]";let t=e;return"{"+Object.keys(t).sort().map(r=>JSON.stringify(r)+":"+st(t[r])).join(",")+"}"}import{mkdirSync as jm,readFileSync as mi,writeFileSync as gi,existsSync as yi,chmodSync as Lm,statSync as Bm}from"node:fs";import{join as bi}from"node:path";import vi from"node:crypto";function hn(e){return bi(e,"agent-private-key.pem")}function ki(e){return bi(e,"agent-public-key.pem")}function _i(e){return bi(e,"agent-key-meta.json")}function wi(e){jm(e,{recursive:!0});let t=hn(e),n=ki(e);if(yi(t)&&yi(n))try{return Fm(e)}catch(r){throw new Error(`agent keystore corrupted at ${e}: ${r.message}`)}return Mm(e)}function Fm(e){let t=mi(hn(e),"utf8"),n=mi(ki(e),"utf8"),r=yi(_i(e))?JSON.parse(mi(_i(e),"utf8")):{},o=vi.createPrivateKey({key:t,format:"pem"});if(o.asymmetricKeyType!=="ed25519")throw new Error(`expected ed25519 key, got ${o.asymmetricKeyType}`);return{privateKey:o,publicKeyPem:n,generatedAt:r.generatedAt??new Date(Bm(hn(e)).mtime).toISOString()}}function Mm(e){let{publicKey:t,privateKey:n}=vi.generateKeyPairSync("ed25519"),r=n.export({type:"pkcs8",format:"pem"}),o=t.export({type:"spki",format:"pem"}),i=new Date().toISOString();if(gi(hn(e),r,{encoding:"utf8"}),gi(ki(e),o,{encoding:"utf8"}),gi(_i(e),JSON.stringify({generatedAt:i},null,2),"utf8"),process.platform!=="win32")try{Lm(hn(e),384)}catch{}return{privateKey:n,publicKeyPem:o,generatedAt:i}}function mn(e,t){return vi.sign(null,Buffer.from(t,"utf8"),e.privateKey).toString("hex")}var yl=3e4,gn=class{constructor(t){this.apiBase=t}url(t){return this.apiBase.replace(/\/+$/,"")+t}async request(t,n){let r=this.url(t);try{return await fetch(r,{...n,signal:AbortSignal.timeout(yl)})}catch(o){let i=o;if(i?.name==="TimeoutError"||i?.name==="AbortError")throw new Error(`${t} timed out after ${yl}ms (${r})`);let s=i?.cause?.code;throw new Error(`${t} could not reach ${r}${s?` (${s})`:""}: ${i?.message??String(o)}`)}}async enroll(t){let n=await this.request("/api/capsule/enroll",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(t)}),r=await n.text();if(!n.ok)throw new Error(`enroll failed: HTTP ${n.status} \u2014 ${r}`);return JSON.parse(r)}async heartbeat(t,n){let r=st({deployment_id:t.deployment_id,agent_version:t.agent_version,applied_config:t.applied_config??null,discovered_release_version:t.discovered_release_version??null}),o=mn(n,r),i={...t,signature_hex:o},s=await this.request("/api/capsule/heartbeat",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(i)}),a=await s.text();if(!s.ok)throw new Error(`heartbeat failed: HTTP ${s.status} \u2014 ${a}`);try{return JSON.parse(a)}catch{return{ok:!0,desired_config:null,apply_update:!1}}}async submitSealBackup(t,n){let{deployment_id:r,...o}=t,i=st(o),s=mn(n,i),a={deployment_id:r,...o,signature_hex:s},c=await this.request("/api/capsule/seal/backup",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(a)}),l=await c.text();if(!c.ok)throw new Error(`seal backup failed: HTTP ${c.status} \u2014 ${l}`);return JSON.parse(l)}async submitScan(t,n){let r=st(t),o=mn(n,r),i={...t,signature_hex:o},s=await this.request("/api/capsule/scan/submit",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(i)}),a=await s.text();if(!s.ok)throw new Error(`scan submit failed: HTTP ${s.status} \u2014 ${a}`);return JSON.parse(a)}async submitSeal(t,n){let{deployment_id:r,...o}=t,i=st(o),s=mn(n,i),a={deployment_id:r,...o,signature_hex:s},c=await this.request("/api/capsule/seal/submit",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(a)}),l=await c.text();if(!c.ok)throw new Error(`seal submit failed: HTTP ${c.status} \u2014 ${l}`);return JSON.parse(l)}};var Wm=300*1e3,zm=1440*60*1e3,_n=()=>Rt(bl(),".nodata"),Ir=()=>Rt(_n(),"capsule.json"),_l=()=>Rt(_n(),"capsule-agents.json"),vl=()=>Rt(_n(),"capsule-key");function Pr(e){try{return Hm(e)?JSON.parse(Vm(e,"utf8")):null}catch{return null}}function $r(e,t){Um(_n(),{recursive:!0}),Gm(e,JSON.stringify(t,null,2)+`
+`,{mode:384})}function bn(){return Pr(Ir())}function qm(e){let t=Date.now(),n=Pr(_l())??{};n[e]=t;let r=Object.fromEntries(Object.entries(n).filter(([,o])=>t-o<zm));return $r(_l(),r),Object.keys(r).sort()}function Rr(){let t=(Pr(Rt(bl(),".claude","settings.json"))?.hooks?.PreToolUse??[]).flatMap(n=>n.hooks??[]).find(n=>n.command.includes("gate.mjs"))?.command;return t?t.includes("--block")?"block":"ask":null}function kl(){return Pr(Rt(_n(),"consent.json"))?.terms_version??null}var yn=null;async function Si(e){let t=bn();if(!t)return null;let n=qm(e.agent()),r=new gn(t.api_base);try{let o=await r.heartbeat({deployment_id:t.deployment_id,agent_version:`mcp-${e.version}`,applied_config:{scan_interval_minutes:yn?.scan_interval_minutes??1440,release_channel:yn?.release_channel??"stable",enabled_apps:yn?.enabled_apps??null,scan_scope:{surface:"mcp",host:Tr(),agents:n,gate:Rr(),terms_version:kl(),current_terms:ie}}},wi(vl()));yn=o.desired_config??yn;let i={...t,last_heartbeat_ok_at:new Date().toISOString(),last_error:null,revoked:!!o.revoked};return $r(Ir(),i),i}catch(o){let i={...t,last_error:o instanceof Error?o.message.slice(0,200):String(o)};return $r(Ir(),i),i}}function Ei(e){if(!bn())return;let t=()=>{Si(e)};setTimeout(t,3e3).unref(),setInterval(t,Wm).unref()}function Jm(e){if(!e)return"never";let t=Math.round((Date.now()-Date.parse(e))/6e4);return t<1?"just now":t<60?`${t} min ago`:`${Math.round(t/60)} h ago`}function wl(e,t){e.registerTool("nodata_node",{description:`Register THIS MACHINE as a Capsule node of the organisation \u2014 so "this machine is guarded" is something the organisation can verify, not only the user. One node per machine; every agent here (Claude Code, Cursor \u2026) is a workload on it; billing stays per decision, a node is not a billing unit. Uses the Capsule agent's own enrolment and signed heartbeat. The heartbeat reports only: the host name, the agents' names, whether the read gate is on, and the accepted terms version \u2014 never content. ASKS FIRST: without confirm:true it shows the status, or what registering would send. Call with confirm:true only after the user approves.`,inputSchema:{confirm:Km.boolean().optional().describe("true = register this machine. Omit to see status / preview.")}},async({confirm:n})=>{let r=bn();if(r){let f=await Si(t);return{content:[{type:"text",text:[`CAPSULE NODE ${r.deployment_id} \u2014 org ${r.org_id} \xB7 ${t.who()}`,`  last verified heartbeat: ${Jm(f?.last_heartbeat_ok_at)}${f?.last_error?`  (last error: ${f.last_error})`:""}`,f?.revoked?"  \u26A0 The organisation has paused this node.":"",`  reported: host ${Tr()}, agents, read gate ${Rr()??"off"}, terms ${kl()??"not accepted"} \u2014 no content.`].filter(Boolean).join(`
+`)}]}}if(!t.org)return{content:[{type:"text",text:"This machine has no enrolled device identity, so it cannot register as a node. Connect first with nodata_connect (it enrolls the device), restart, then run nodata_node again."}],isError:!0};if(!n)return{content:[{type:"text",text:[`PREVIEW \u2014 nothing registered yet. ${t.who()}`,`Register this machine (${Tr()}) as a Capsule node of org ${t.org.id}:`,"  \xB7 a signing key is created in ~/.nodata/capsule-key (it never leaves this machine);","  \xB7 while an agent runs here, a signed heartbeat every 5 minutes reports: host name, the agents' names, read gate on/off, accepted terms version;","  \xB7 never file names, paths, findings or content;","  \xB7 the organisation sees the machine in its fleet, and can pause it.","A node is not a billing unit \u2014 billing stays per decision.","","Ask the user to approve, then call nodata_node again with confirm: true."].join(`
+`)}]};let o=await t.org.token();if(!o)return{content:[{type:"text",text:"No usable org credential \u2014 run nodata_connect."}],isError:!0};let i=await fetch(`${t.org.baseUrl}/api/v1/tenants/${encodeURIComponent(t.org.id)}/capsule/install-token`,{method:"POST",headers:{authorization:`Bearer ${o}`}}),s=await i.json().catch(()=>({}));if(!i.ok||!s.install_token)return{content:[{type:"text",text:`Could not start registration (HTTP ${i.status}): ${s.error??"no install token"}`}],isError:!0};let a=wi(vl()),l=await new gn(t.org.baseUrl).enroll({install_token:s.install_token,pubkey_pem:a.publicKeyPem,agent_version:`mcp-${t.version}`,agent_kind:"npm_cli"});$r(Ir(),{deployment_id:l.deployment_id,org_id:t.org.id,api_base:t.org.baseUrl,enrolled_at:new Date().toISOString()});let d=await Si(t);Ei(t);let p=await t.ack(`node ${l.deployment_id} on ${Tr()}`);return{content:[{type:"text",text:[`REGISTERED \u2014 this machine is Capsule node ${l.deployment_id} of org ${t.org.id}. ${t.who()}`,`  first heartbeat: ${d?.last_heartbeat_ok_at?"verified":`failed (${d?.last_error??"unknown"})`}`,"  the status line now shows when NoData last verified this node.",`Approval kept in ~/.nodata/acks.jsonl${Ce(p)}.`].join(`
+`)}]}})}import{z as vn}from"zod";import{spawn as Ym}from"node:child_process";import{createHash as Xm,randomBytes as Zm}from"node:crypto";import{existsSync as xi,mkdirSync as Qm,readFileSync as eg,rmSync as tg,statSync as ng,writeFileSync as rg}from"node:fs";import{homedir as Sl}from"node:os";import{join as El,resolve as og}from"node:path";var Sn=()=>El(Sl(),".nodata","secrets.json"),wn=64*1024,ig=600*1e3,sg=6;function ag(){try{return xi(Sn())?JSON.parse(eg(Sn(),"utf8")):null}catch{return null}}function cg(e){return new Promise(t=>{let n=process.stdin;if(process.stderr.write(e),!n.isTTY){let i="";n.setEncoding("utf8"),n.on("data",s=>i+=s),n.on("end",()=>t(i.trim()));return}let r="";n.setRawMode(!0),n.resume(),n.setEncoding("utf8");let o=i=>{for(let s of i){if(s==="\r"||s===`
 `)return n.setRawMode(!1),n.pause(),n.off("data",o),process.stderr.write(`
 `),t(r.trim());s===""&&(n.setRawMode(!1),process.stderr.write(`
-`),process.exit(130)),s==="\x7F"||s==="\b"?r=r.slice(0,-1):r+=s}};n.on("data",o)})}async function El(e,t){let n=e.indexOf("--project"),r=n>=0?e[n+1]??null:null,o=await sg("Paste your NoData CLI token (ndcs_\u2026; Courier \u2192 \u{1F511} \u05E1\u05D5\u05D3\u05D5\u05EA \u2192 CLI token). It is not shown: ");return o.startsWith("ndcs_")?(Xm(Sl(wl(),".nodata"),{recursive:!0}),tg(kn(),JSON.stringify({token:o,base_url:t,project:r,saved_at:new Date().toISOString()},null,2)+`
-`,{mode:384}),`\u2713 Saved to ~/.nodata/secrets.json (readable by you only)${r?` \xB7 project ${r}`:""}. The agent can now ask to run commands with these secrets \u2014 each one needs your approval.`):"\u2717 That is not a NoData CLI token (it starts with ndcs_). Nothing saved."}function xl(){return Si(kn())?(Qm(kn()),"\u2713 Removed ~/.nodata/secrets.json. Revoke the token itself in Courier \u2192 \u{1F511} \u05E1\u05D5\u05D3\u05D5\u05EA if it may have leaked."):"No saved CLI token."}function ag(e,t){let n=e,r=0,o=[];for(let[i,s]of Object.entries(t)){if(!s||s.length<og)continue;let a=Buffer.from(s,"utf8");for(let c of new Set([s,a.toString("base64"),a.toString("base64url"),a.toString("hex"),encodeURIComponent(s),JSON.stringify(s).slice(1,-1)]))o.push([c,`[secret:${i}]`])}o.sort((i,s)=>s[0].length-i[0].length);for(let[i,s]of o){let a=n.split(i);a.length>1&&(r+=a.length-1,n=a.join(s))}for(let i of st()){let s=new RegExp(i.pattern.source,i.pattern.flags.includes("g")?i.pattern.flags:i.pattern.flags+"g");n=n.replace(s,a=>a.startsWith("[secret")?a:(r++,`[secret:${i.id}]`))}return{text:n,blanked:r}}function cg(e){return e.length>vn?`\u2026 (${e.length-vn} earlier characters not shown)
-`+e.slice(-vn):e}function lg(e,t,n,r){return new Promise(o=>{let i=Date.now(),s=qm(e,{cwd:t,env:n,shell:!0,stdio:["ignore","pipe","pipe"]}),a="",c=!1,l=p=>{if(a+=p.toString("utf8"),a.length>vn*32){let f=a.slice(-vn*16);a=f.slice(f.indexOf(`
-`)+1)}};s.stdout.on("data",l),s.stderr.on("data",l);let u=setTimeout(()=>{c=!0,s.kill("SIGTERM")},r);s.on("error",p=>{clearTimeout(u),o({code:null,output:a+`
-${p.message}`,timedOut:c,ms:Date.now()-i})}),s.on("close",p=>{clearTimeout(u),o({code:p,output:a,timedOut:c,ms:Date.now()-i})})})}async function dg(e,t){let n=await fetch(`${e.base_url}/api/secrets/pull`,{method:"POST",headers:{authorization:`Bearer ${e.token}`,"content-type":"application/json"},body:JSON.stringify(t?{projectLabel:t}:{})}),r=await n.json().catch(()=>({}));return n.ok?{secrets:r.secrets??{},project:r.project??t}:{error:`HTTP ${n.status}${r.error?` \u2014 ${r.error}`:""}`}}var bn=new Map,ug=(e,t,n)=>Jm("sha256").update(`${e}\0${t}\0${n??""}`).digest("hex");function Al(e,t){let n=t.pull??dg;e.registerTool("nodata_run",{description:"Run a command on this machine (tests, a migration, a deploy script) WITH the project's secrets from the NoData vault as environment variables \u2014 without you seeing them. The secrets are pulled into memory only (no .env is written); you get back the exit code and the output with every secret value blanked. EVERY command needs the user's approval, as written: the user is asked directly when the client supports it; otherwise call without `approval` to get a preview and a code, show the user the exact command, and call again with the code only after they approve. Never embed a secret value in the command, never try to print or encode one, and never confirm on the user's behalf. Needs a CLI token saved once in the terminal: `npx -y @nodatachat/mcp secrets-login` \u2014 never ask for the token in the chat.",inputSchema:{command:_n.string().min(1).describe("The exact command line to run, e.g. `npm test`."),cwd:_n.string().optional().describe("Folder to run in. Default: the current folder."),project:_n.string().optional().describe("Secrets project label. Default: the token's project."),timeout_seconds:_n.number().int().min(5).max(1800).optional().describe("Default 300."),approval:_n.string().optional().describe("The code from the preview \u2014 only after the user approved this exact command.")}},async({command:r,cwd:o,project:i,timeout_seconds:s,approval:a})=>{let c=ig();if(!c)return{content:[{type:"text",text:`No NoData CLI token on this machine. Ask the user to run, in their own terminal (not here):
+`),process.exit(130)),s==="\x7F"||s==="\b"?r=r.slice(0,-1):r+=s}};n.on("data",o)})}async function xl(e,t){let n=e.indexOf("--project"),r=n>=0?e[n+1]??null:null,o=await cg("Paste your NoData CLI token (ndcs_\u2026; Courier \u2192 \u{1F511} \u05E1\u05D5\u05D3\u05D5\u05EA \u2192 CLI token). It is not shown: ");return o.startsWith("ndcs_")?(Qm(El(Sl(),".nodata"),{recursive:!0}),rg(Sn(),JSON.stringify({token:o,base_url:t,project:r,saved_at:new Date().toISOString()},null,2)+`
+`,{mode:384}),`\u2713 Saved to ~/.nodata/secrets.json (readable by you only)${r?` \xB7 project ${r}`:""}. The agent can now ask to run commands with these secrets \u2014 each one needs your approval.`):"\u2717 That is not a NoData CLI token (it starts with ndcs_). Nothing saved."}function Al(){return xi(Sn())?(tg(Sn()),"\u2713 Removed ~/.nodata/secrets.json. Revoke the token itself in Courier \u2192 \u{1F511} \u05E1\u05D5\u05D3\u05D5\u05EA if it may have leaked."):"No saved CLI token."}function lg(e,t){let n=e,r=0,o=[];for(let[i,s]of Object.entries(t)){if(!s||s.length<sg)continue;let a=Buffer.from(s,"utf8");for(let c of new Set([s,a.toString("base64"),a.toString("base64url"),a.toString("hex"),encodeURIComponent(s),JSON.stringify(s).slice(1,-1)]))o.push([c,`[secret:${i}]`])}o.sort((i,s)=>s[0].length-i[0].length);for(let[i,s]of o){let a=n.split(i);a.length>1&&(r+=a.length-1,n=a.join(s))}for(let i of ct()){let s=new RegExp(i.pattern.source,i.pattern.flags.includes("g")?i.pattern.flags:i.pattern.flags+"g");n=n.replace(s,a=>a.startsWith("[secret")?a:(r++,`[secret:${i.id}]`))}return{text:n,blanked:r}}function dg(e){return e.length>wn?`\u2026 (${e.length-wn} earlier characters not shown)
+`+e.slice(-wn):e}function ug(e,t,n,r){return new Promise(o=>{let i=Date.now(),s=Ym(e,{cwd:t,env:n,shell:!0,stdio:["ignore","pipe","pipe"]}),a="",c=!1,l=p=>{if(a+=p.toString("utf8"),a.length>wn*32){let f=a.slice(-wn*16);a=f.slice(f.indexOf(`
+`)+1)}};s.stdout.on("data",l),s.stderr.on("data",l);let d=setTimeout(()=>{c=!0,s.kill("SIGTERM")},r);s.on("error",p=>{clearTimeout(d),o({code:null,output:a+`
+${p.message}`,timedOut:c,ms:Date.now()-i})}),s.on("close",p=>{clearTimeout(d),o({code:p,output:a,timedOut:c,ms:Date.now()-i})})})}async function pg(e,t){let n=await fetch(`${e.base_url}/api/secrets/pull`,{method:"POST",headers:{authorization:`Bearer ${e.token}`,"content-type":"application/json"},body:JSON.stringify(t?{projectLabel:t}:{})}),r=await n.json().catch(()=>({}));return n.ok?{secrets:r.secrets??{},project:r.project??t}:{error:`HTTP ${n.status}${r.error?` \u2014 ${r.error}`:""}`}}var kn=new Map,fg=(e,t,n)=>Xm("sha256").update(`${e}\0${t}\0${n??""}`).digest("hex");function Tl(e,t){let n=t.pull??pg;e.registerTool("nodata_run",{description:"Run a command on this machine (tests, a migration, a deploy script) WITH the project's secrets from the NoData vault as environment variables \u2014 without you seeing them. The secrets are pulled into memory only (no .env is written); you get back the exit code and the output with every secret value blanked. EVERY command needs the user's approval, as written: the user is asked directly when the client supports it; otherwise call without `approval` to get a preview and a code, show the user the exact command, and call again with the code only after they approve. Never embed a secret value in the command, never try to print or encode one, and never confirm on the user's behalf. Needs a CLI token saved once in the terminal: `npx -y @nodatachat/mcp secrets-login` \u2014 never ask for the token in the chat.",inputSchema:{command:vn.string().min(1).describe("The exact command line to run, e.g. `npm test`."),cwd:vn.string().optional().describe("Folder to run in. Default: the current folder."),project:vn.string().optional().describe("Secrets project label. Default: the token's project."),timeout_seconds:vn.number().int().min(5).max(1800).optional().describe("Default 300."),approval:vn.string().optional().describe("The code from the preview \u2014 only after the user approved this exact command.")}},async({command:r,cwd:o,project:i,timeout_seconds:s,approval:a})=>{let c=ag();if(!c)return{content:[{type:"text",text:`No NoData CLI token on this machine. Ask the user to run, in their own terminal (not here):
   npx -y @nodatachat/mcp secrets-login [--project <label>]
-The token is minted in Courier \u2192 \u{1F511} \u05E1\u05D5\u05D3\u05D5\u05EA \u2192 CLI token. Never ask the user to paste it into the chat.`}],isError:!0};let l=ng(o??process.cwd());if(!Si(l)||!eg(l).isDirectory())return{content:[{type:"text",text:`No such folder: ${l}`}],isError:!0};let u=i??c.project??null,p=ug(r,l,u),f=[`  command: ${r}`,`  folder:  ${l}`,`  secrets: ${u?`project "${u}"`:"the token's secrets"} (values stay hidden from the agent)`].join(`
-`),h;if(e.server.getClientCapabilities()?.elicitation){let B;try{B=(await e.server.elicitInput({message:`NoData \u2014 run this command with your secrets?
+The token is minted in Courier \u2192 \u{1F511} \u05E1\u05D5\u05D3\u05D5\u05EA \u2192 CLI token. Never ask the user to paste it into the chat.`}],isError:!0};let l=og(o??process.cwd());if(!xi(l)||!ng(l).isDirectory())return{content:[{type:"text",text:`No such folder: ${l}`}],isError:!0};let d=i??c.project??null,p=fg(r,l,d),f=[`  command: ${r}`,`  folder:  ${l}`,`  secrets: ${d?`project "${d}"`:"the token's secrets"} (values stay hidden from the agent)`].join(`
+`),h;if(e.server.getClientCapabilities()?.elicitation){let N;try{N=(await e.server.elicitInput({message:`NoData \u2014 run this command with your secrets?
 ${f}
 
-A command that holds a secret can also send it out. Approve only a command you recognise.`,requestedSchema:{type:"object",properties:{}}})).action}catch(m){return{content:[{type:"text",text:`NOT RUN \u2014 no approval was received from the user${m instanceof Error?` (${m.message.slice(0,80)})`:""}. ${t.who()}`}],isError:!0}}if(B!=="accept")return await t.ack(`declined \xB7 ${u??"token project"}`),{content:[{type:"text",text:`NOT RUN \u2014 the user did not approve. ${t.who()}`}]};h="user-dialog"}else{let B=Date.now();for(let[v,w]of bn)B-w.at>rg&&bn.delete(v);let m=a?bn.get(a):void 0;if(!m||m.bind!==p){let v=Ym(4).toString("hex");return bn.set(v,{bind:p,at:B}),{content:[{type:"text",text:[`PREVIEW \u2014 nothing run yet. ${t.who()}`,f,a?"(The code given does not match this exact command, or expired \u2014 a new one is below.)":"","",`Show the user this exact command. Only if they approve it, call nodata_run again with the same command, folder and project and approval: "${v}" (valid 10 minutes, once).`,"A command that holds a secret can also send it out \u2014 the user should approve only a command they recognise."].filter(Boolean).join(`
-`)}]}}bn.delete(a),h="code"}let _=await n(c,u);if("error"in _)return{content:[{type:"text",text:`Could not get the secrets (${_.error}). Nothing was run.`}],isError:!0};let y=Object.keys(_.secrets).sort(),k=await lg(r,l,{...process.env,..._.secrets},(s??300)*1e3),E=ag(k.output,_.secrets),R=await t.ack(`${_.project??"token project"} \xB7 ${y.length} secrets \xB7 exit ${k.code??"none"}${k.timedOut?" (timed out)":""} \xB7 approved by ${h}`);return{content:[{type:"text",text:[`RAN with ${y.length} secret(s) from ${_.project?`project "${_.project}"`:"the token's secrets"} \u2014 ${t.who()}`,`  exit ${k.code??"none"}${k.timedOut?" (stopped: timeout)":""} \xB7 ${(k.ms/1e3).toFixed(1)}s \xB7 ${E.blanked} secret value(s) blanked in the output`,y.length?`  injected (names only): ${y.join(", ")}`:"  no secrets were granted to this token \u2014 the command ran without any",`Approval kept in ~/.nodata/acks.jsonl${Ce(R)}; each released value has its own proof at NoData.`,"","\u2500\u2500 output (secret values blanked) \u2500\u2500",cg(E.text)||"(no output)"].join(`
-`)}],isError:k.code!==0}})}var Tl=["\u{1F7E3}","\u{1F535}","\u{1F7E0}","\u{1F7E4}","\u{1F7E1}"];function pg(e){let t=0;for(let n of e)t=t*31+n.codePointAt(0)>>>0;return Tl[t%Tl.length]}function Ei(e,t){let n=(e||"agent").toLowerCase().replace(/[^a-z0-9._-]+/g,"-").slice(0,40);return t?`${n}@${t}`:n}function Il(e){return`${pg(e)} ${e}`}import{z as Rr}from"zod";import Ke from"node:crypto";var xi=Buffer.from([78,68,67,49]),fg=2,Ai=36,wn=32,hg=64,mg=12,gg=16,yg=4096,_g=256,Pl=32,Ti=8,bg=1;async function vg(){let[{CipherSuite:e,HkdfSha256:t},{DhkemX25519HkdfSha256:n},{Chacha20Poly1305:r}]=await Promise.all([import("@hpke/core"),import("@hpke/dhkem-x25519"),import("@hpke/chacha20poly1305")]);return new e({kem:new n,kdf:new t,aead:new r})}function Ii(e){let t=new Uint8Array(e.length);return t.set(e),t.buffer}async function kg(e,t){let n=t.trim();if(n.includes("-----BEGIN PUBLIC KEY-----")){let o=n.replace(/-----BEGIN PUBLIC KEY-----/,"").replace(/-----END PUBLIC KEY-----/,"").replace(/\s+/g,"");return e.kem.deserializePublicKey(Ii(Buffer.from(o,"base64")))}let r=Buffer.from(n.replace(/-/g,"+").replace(/_/g,"/"),"base64");if(r.length!==32)throw new Error(`master pubkey must be a 32-byte X25519 key, got ${r.length} bytes`);return e.kem.deserializePublicKey(Ii(r))}function wg(e){let t=Ke.createPublicKey({key:e,format:"pem"}).export({format:"der",type:"spki"});if(t.length<wn)throw new Error("unexpected Ed25519 SPKI DER length");return t.subarray(t.length-wn)}function Sg(e){return Ke.createHash("sha256").update(e,"utf8").digest().subarray(0,Ti)}async function $l(e){let t=Buffer.from(e.filename,"utf8");if(t.length>yg)throw new Error("filename too long");let n=Buffer.from(e.contentType,"utf8");if(n.length>_g)throw new Error("content-type too long");let r=e.receiptId??Ke.randomUUID(),o=Buffer.from(r,"utf8");if(o.length!==Ai)throw new Error("receiptId must be a 36-char canonical UUID");let i=wg(e.issuerPubkeyPem);if(i.length!==wn)throw new Error("issuer pubkey must be 32 bytes");let s=Ke.randomBytes(32),a=Ke.randomBytes(mg),c=Ke.createCipheriv("aes-256-gcm",s,a),l=Buffer.concat([c.update(e.fileBytes),c.final()]),u=c.getAuthTag();if(u.length!==gg)throw new Error("unexpected GCM tag length");let p=Ke.createHash("sha256").update(e.fileBytes).digest(),f=await vg(),h=await kg(f,e.recipientPubkeyB64),_=await f.createSenderContext({recipientPublicKey:h}),y=Buffer.from(_.enc),k=Buffer.from(await _.seal(Ii(s))),E=Sg(e.recipientPubkeyB64),R=1+Ti+2+y.length+2+k.length,B=xi.length+1+Ai+wn+2+t.length+2+n.length+8+Pl+R,m=Buffer.alloc(B),v=0;xi.copy(m,v),v+=xi.length,m[v++]=fg,o.copy(m,v),v+=Ai,i.copy(m,v),v+=wn,m.writeUInt16LE(t.length,v),v+=2,t.copy(m,v),v+=t.length,m.writeUInt16LE(n.length,v),v+=2,n.copy(m,v),v+=n.length,m.writeBigUInt64LE(BigInt(e.issuedAt??Date.now()),v),v+=8,p.copy(m,v),v+=Pl,m[v++]=bg,E.copy(m,v),v+=Ti,m.writeUInt16LE(y.length,v),v+=2,y.copy(m,v),v+=y.length,m.writeUInt16LE(k.length,v),v+=2,k.copy(m,v),v+=k.length;let w=Ke.sign(null,m,e.issuerPrivateKey);if(w.length!==hg)throw new Error("header signature must be 64 bytes");let $=Buffer.concat([m,w,a,u,l]),T={relative_path:"",plaintext_sha256:p.toString("hex"),size_bytes:e.fileBytes.length,lockbox_id:e.lockboxId??null,ndc_version:2,recovery_alg:1,recovery_master_fp:E.toString("hex"),header_sig_b64:w.toString("base64"),content_key_b64:s.toString("base64")};return{ndcBytes:$,report:T}}import{createPrivateKey as Rl,createPublicKey as Dl,generateKeyPairSync as Eg}from"node:crypto";import{existsSync as $i,mkdirSync as xg,readFileSync as Ol,rmSync as Ag,statSync as Dr,writeFileSync as jl}from"node:fs";import{homedir as Cl}from"node:os";import{basename as Sn,extname as Tg,join as Ri,resolve as Ig}from"node:path";var we=(e,t=!1)=>({content:[{type:"text",text:e}],...t?{isError:t}:{}}),En="mcp-archive",Pi=25,Nl=25*1024*1024,Pg={".pdf":"application/pdf",".txt":"text/plain",".csv":"text/csv",".md":"text/markdown",".json":"application/json",".png":"image/png",".jpg":"image/jpeg",".jpeg":"image/jpeg",".docx":"application/vnd.openxmlformats-officedocument.wordprocessingml.document",".xlsx":"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",".pptx":"application/vnd.openxmlformats-officedocument.presentationml.presentation"},$g={critical:"restricted",high:"confidential",medium:"internal",low:"internal",info:"internal"};function Ll(e,t){if(e){let o=Rl({key:Buffer.from(e,"base64"),format:"der",type:"pkcs8"});return{privateKey:o,publicPem:Dl(o).export({format:"pem",type:"spki"}),label:`device ${t??""}`.trim()}}let n=Ri(Cl(),".nodata","issuer-ed25519.json");if($i(n)){let o=JSON.parse(Ol(n,"utf8")).private_pem,i=Rl(o);return{privateKey:i,publicPem:Dl(i).export({format:"pem",type:"spki"}),label:"this machine"}}let r=Eg("ed25519");return xg(Ri(Cl(),".nodata"),{recursive:!0}),jl(n,JSON.stringify({private_pem:r.privateKey.export({format:"pem",type:"pkcs8"})},null,2)+`
-`,{mode:384}),{privateKey:r.privateKey,publicPem:r.publicKey.export({format:"pem",type:"spki"}),label:"this machine"}}function Bl(e,t,n,r){e.registerTool("nodata_wrap",{description:"WRAP files into your organization's sovereign archive (a zero-knowledge capsule): each file is encrypted ON THIS MACHINE to the public half of your org master key \u2014 the 12 words from signup \u2014 and only ciphertext is uploaded. NoData can never open it; your 12 words (or recovery file) always can, even if this computer is lost or NoData is offline. Each document gets a signed receipt and proof_url. Given a folder, wraps the files the scan finds exposure in (classified by severity); given a file, wraps that file. ASKS FIRST: without confirm:true it only lists what would be wrapped. keep_local:true (default) also writes <file>.capsule.ndc next to the original; remove:true deletes the plaintext originals after a successful upload.",inputSchema:{path:Rr.string().describe("File or folder to wrap."),confirm:Rr.boolean().optional().describe("true = wrap it. Omit to preview."),keep_local:Rr.boolean().optional().describe("Also keep <file>.capsule.ndc next to the original. Default true."),remove:Rr.boolean().optional().describe("Delete plaintext originals after upload. Default false.")}},async({path:o,confirm:i,keep_local:s,remove:a})=>{let c=Ig(o);if(!$i(c))return we(`Not found: ${c}`,!0);let l;if(Dr(c).isDirectory()?l=We(await Ft({target_id:"mcp",target_label:Sn(c),target_path:c,log:Mt})).byFile.map(v=>({path:Ri(c,v.key),classification:$g[v.worst]??"internal"})):l=[{path:c,classification:"confidential"}],l=l.filter(m=>$i(m.path)&&Dr(m.path).isFile()&&!xe(m.path)),l.length===0)return we(`Nothing to wrap in ${c} \u2014 no file with findings.`);let u=l.filter(m=>Dr(m.path).size>Nl);l=l.filter(m=>Dr(m.path).size<=Nl);let p=await t.get("/api/v1/recovery/pubkey");if(p.status===401||p.status===403)return we(`Not authorized to read the org key (HTTP ${p.status}). Connect with nodata_connect.`,!0);let f=typeof p.body.pubkeyB64=="string"?p.body.pubkeyB64:null;if(!f)return we(`Your organization has no master key yet \u2014 the 12-word recovery setup was not completed, so there is nothing to wrap to.
-Finish it once in the console (Recovery setup), then wrap again. NoData never sees the words.`,!0);if(!i){let m=l.slice(0,Pi).map(v=>`  \xB7 [${v.classification}] ${v.path}`);return l.length>Pi&&m.push(`  \u2026 and ${l.length-Pi} more`),we([`PREVIEW \u2014 nothing wrapped yet. ${r()}`,`Would wrap ${l.length} file(s) into the "${En}" capsule, sealed to your org master key (fingerprint ${p.body.fingerprint??"?"}):`,...m,u.length?`Skipped (over 25 MB): ${u.map(v=>Sn(v.path)).join(", ")}`:"",`Encrypted here; only ciphertext is uploaded. Opens with your 12 words \u2014 never with NoData.${a?" Plaintext originals WILL BE DELETED after upload.":""}`,"","Ask the user to approve, then call nodata_wrap again with the same arguments and confirm: true."].filter(Boolean).join(`
-`))}let h=await t.get("/api/v1/capsules");if(h.status>=400)return we(`Could not list capsules (HTTP ${h.status}): ${JSON.stringify(h.body)}`,!0);let y=(h.body.capsules??[]).find(m=>m.slug===En);if(y&&y.key_mode!=="zk")return we(`A "${En}" capsule exists but is not zero-knowledge (key_mode ${String(y.key_mode)}) \u2014 refusing to wrap into it.`,!0);if(!y){let m=await t.post("/api/v1/capsules",{handle:En,display_name:"MCP archive",key_mode:"zk",capsule_pubkey:f});if(m.status>=400)return we(`Could not create the archive capsule (HTTP ${m.status}): ${JSON.stringify(m.body)}`,!0);y=m.body}let k=String(y.slug??y.capsule_id??"");if(!k)return we(`Capsule id missing in ${JSON.stringify(y)}`,!0);let E=n(),R=[],B=[];for(let m of l){let v=Ol(m.path),{ndcBytes:w,report:$}=await $l({fileBytes:v,filename:Sn(m.path),contentType:Pg[Tg(m.path).toLowerCase()]??"application/octet-stream",recipientPubkeyB64:f,issuerPrivateKey:E.privateKey,issuerPubkeyPem:E.publicPem}),T=await t.post(`/api/v1/capsules/${encodeURIComponent(k)}/documents`,{title:Sn(m.path),ndc_b64:w.toString("base64"),classification:m.classification,plaintext_sha256:$.plaintext_sha256,size_bytes:$.size_bytes});if(T.status>=400||T.body.ok!==!0){B.push(`  \u2717 ${m.path} \u2014 HTTP ${T.status}: ${JSON.stringify(T.body).slice(0,200)}`);continue}s!==!1&&jl(`${m.path}.capsule.ndc`,w,{mode:384}),a&&Ag(m.path),R.push(`  \u2713 [${m.classification}] ${Sn(m.path)}${T.body.proof_url?`  proof: ${T.body.proof_url}`:""}`)}return we([`WRAPPED ${R.length}/${l.length} into "${En}" \u2014 ${r()} \xB7 signed by ${E.label}`,...R,...B,"Sealed to your org master key: NoData stores ciphertext only and cannot open it. Your 12 words (or recovery file) open every document.",s!==!1?"Local copies: <file>.capsule.ndc next to each original.":"",a?"Plaintext originals deleted (only for files that uploaded).":""].filter(Boolean).join(`
-`),B.length>0&&R.length===0)})}import{homedir as Wl,hostname as zl}from"node:os";import{join as Cr,resolve as Di}from"node:path";import{existsSync as Oi,readFileSync as ql,writeFileSync as Jl,mkdirSync as Yl,chmodSync as Cg}from"node:fs";import{spawn as Ng}from"node:child_process";import{generateKeyPairSync as Og,createPrivateKey as jg,sign as Lg,randomBytes as Bg}from"node:crypto";var xn="1.3.16",Xl=Cr(Wl(),".nodata"),Nr=Cr(Xl,"credentials.json");function Fg(){try{if(!Oi(Nr))return null;let e=JSON.parse(ql(Nr,"utf8"));if(!e)return null;let t=e.device&&typeof e.device.private_key_pkcs8_b64=="string",n=typeof e.api_key=="string"&&e.api_key;return t||n?e:null}catch{return null}}function Fl(e){Yl(Xl,{recursive:!0});let t=JSON.stringify({...e,saved_at:new Date().toISOString()},null,2);Jl(Nr,t,{mode:384});try{Cg(Nr,384)}catch{}}var Mg=`nodata-mcp v${xn} \u2014 NoData MCP server
+A command that holds a secret can also send it out. Approve only a command you recognise.`,requestedSchema:{type:"object",properties:{}}})).action}catch(m){return{content:[{type:"text",text:`NOT RUN \u2014 no approval was received from the user${m instanceof Error?` (${m.message.slice(0,80)})`:""}. ${t.who()}`}],isError:!0}}if(N!=="accept")return await t.ack(`declined \xB7 ${d??"token project"}`),{content:[{type:"text",text:`NOT RUN \u2014 the user did not approve. ${t.who()}`}]};h="user-dialog"}else{let N=Date.now();for(let[v,k]of kn)N-k.at>ig&&kn.delete(v);let m=a?kn.get(a):void 0;if(!m||m.bind!==p){let v=Zm(4).toString("hex");return kn.set(v,{bind:p,at:N}),{content:[{type:"text",text:[`PREVIEW \u2014 nothing run yet. ${t.who()}`,f,a?"(The code given does not match this exact command, or expired \u2014 a new one is below.)":"","",`Show the user this exact command. Only if they approve it, call nodata_run again with the same command, folder and project and approval: "${v}" (valid 10 minutes, once).`,"A command that holds a secret can also send it out \u2014 the user should approve only a command they recognise."].filter(Boolean).join(`
+`)}]}}kn.delete(a),h="code"}let y=await n(c,d);if("error"in y)return{content:[{type:"text",text:`Could not get the secrets (${y.error}). Nothing was run.`}],isError:!0};let _=Object.keys(y.secrets).sort(),S=await ug(r,l,{...process.env,...y.secrets},(s??300)*1e3),E=lg(S.output,y.secrets),P=await t.ack(`${y.project??"token project"} \xB7 ${_.length} secrets \xB7 exit ${S.code??"none"}${S.timedOut?" (timed out)":""} \xB7 approved by ${h}`);return{content:[{type:"text",text:[`RAN with ${_.length} secret(s) from ${y.project?`project "${y.project}"`:"the token's secrets"} \u2014 ${t.who()}`,`  exit ${S.code??"none"}${S.timedOut?" (stopped: timeout)":""} \xB7 ${(S.ms/1e3).toFixed(1)}s \xB7 ${E.blanked} secret value(s) blanked in the output`,_.length?`  injected (names only): ${_.join(", ")}`:"  no secrets were granted to this token \u2014 the command ran without any",`Approval kept in ~/.nodata/acks.jsonl${Ce(P)}; each released value has its own proof at NoData.`,"","\u2500\u2500 output (secret values blanked) \u2500\u2500",dg(E.text)||"(no output)"].join(`
+`)}],isError:S.code!==0}})}var Il=["\u{1F7E3}","\u{1F535}","\u{1F7E0}","\u{1F7E4}","\u{1F7E1}"];function hg(e){let t=0;for(let n of e)t=t*31+n.codePointAt(0)>>>0;return Il[t%Il.length]}function Ai(e,t){let n=(e||"agent").toLowerCase().replace(/[^a-z0-9._-]+/g,"-").slice(0,40);return t?`${n}@${t}`:n}function $l(e){return`${hg(e)} ${e}`}import{z as Dr}from"zod";import Ke from"node:crypto";var Ti=Buffer.from([78,68,67,49]),mg=2,Ii=36,En=32,gg=64,yg=12,_g=16,bg=4096,vg=256,Pl=32,$i=8,kg=1;async function wg(){let[{CipherSuite:e,HkdfSha256:t},{DhkemX25519HkdfSha256:n},{Chacha20Poly1305:r}]=await Promise.all([import("@hpke/core"),import("@hpke/dhkem-x25519"),import("@hpke/chacha20poly1305")]);return new e({kem:new n,kdf:new t,aead:new r})}function Pi(e){let t=new Uint8Array(e.length);return t.set(e),t.buffer}async function Sg(e,t){let n=t.trim();if(n.includes("-----BEGIN PUBLIC KEY-----")){let o=n.replace(/-----BEGIN PUBLIC KEY-----/,"").replace(/-----END PUBLIC KEY-----/,"").replace(/\s+/g,"");return e.kem.deserializePublicKey(Pi(Buffer.from(o,"base64")))}let r=Buffer.from(n.replace(/-/g,"+").replace(/_/g,"/"),"base64");if(r.length!==32)throw new Error(`master pubkey must be a 32-byte X25519 key, got ${r.length} bytes`);return e.kem.deserializePublicKey(Pi(r))}function Eg(e){let t=Ke.createPublicKey({key:e,format:"pem"}).export({format:"der",type:"spki"});if(t.length<En)throw new Error("unexpected Ed25519 SPKI DER length");return t.subarray(t.length-En)}function xg(e){return Ke.createHash("sha256").update(e,"utf8").digest().subarray(0,$i)}async function Rl(e){let t=Buffer.from(e.filename,"utf8");if(t.length>bg)throw new Error("filename too long");let n=Buffer.from(e.contentType,"utf8");if(n.length>vg)throw new Error("content-type too long");let r=e.receiptId??Ke.randomUUID(),o=Buffer.from(r,"utf8");if(o.length!==Ii)throw new Error("receiptId must be a 36-char canonical UUID");let i=Eg(e.issuerPubkeyPem);if(i.length!==En)throw new Error("issuer pubkey must be 32 bytes");let s=Ke.randomBytes(32),a=Ke.randomBytes(yg),c=Ke.createCipheriv("aes-256-gcm",s,a),l=Buffer.concat([c.update(e.fileBytes),c.final()]),d=c.getAuthTag();if(d.length!==_g)throw new Error("unexpected GCM tag length");let p=Ke.createHash("sha256").update(e.fileBytes).digest(),f=await wg(),h=await Sg(f,e.recipientPubkeyB64),y=await f.createSenderContext({recipientPublicKey:h}),_=Buffer.from(y.enc),S=Buffer.from(await y.seal(Pi(s))),E=xg(e.recipientPubkeyB64),P=1+$i+2+_.length+2+S.length,N=Ti.length+1+Ii+En+2+t.length+2+n.length+8+Pl+P,m=Buffer.alloc(N),v=0;Ti.copy(m,v),v+=Ti.length,m[v++]=mg,o.copy(m,v),v+=Ii,i.copy(m,v),v+=En,m.writeUInt16LE(t.length,v),v+=2,t.copy(m,v),v+=t.length,m.writeUInt16LE(n.length,v),v+=2,n.copy(m,v),v+=n.length,m.writeBigUInt64LE(BigInt(e.issuedAt??Date.now()),v),v+=8,p.copy(m,v),v+=Pl,m[v++]=kg,E.copy(m,v),v+=$i,m.writeUInt16LE(_.length,v),v+=2,_.copy(m,v),v+=_.length,m.writeUInt16LE(S.length,v),v+=2,S.copy(m,v),v+=S.length;let k=Ke.sign(null,m,e.issuerPrivateKey);if(k.length!==gg)throw new Error("header signature must be 64 bytes");let R=Buffer.concat([m,k,a,d,l]),T={relative_path:"",plaintext_sha256:p.toString("hex"),size_bytes:e.fileBytes.length,lockbox_id:e.lockboxId??null,ndc_version:2,recovery_alg:1,recovery_master_fp:E.toString("hex"),header_sig_b64:k.toString("base64"),content_key_b64:s.toString("base64")};return{ndcBytes:R,report:T}}import{createPrivateKey as Dl,createPublicKey as Cl,generateKeyPairSync as Ag}from"node:crypto";import{existsSync as Di,mkdirSync as Tg,readFileSync as jl,rmSync as Ig,statSync as Cr,writeFileSync as Ll}from"node:fs";import{homedir as Nl}from"node:os";import{basename as xn,extname as $g,join as Ci,resolve as Pg}from"node:path";var we=(e,t=!1)=>({content:[{type:"text",text:e}],...t?{isError:t}:{}}),An="mcp-archive",Ri=25,Ol=25*1024*1024,Rg={".pdf":"application/pdf",".txt":"text/plain",".csv":"text/csv",".md":"text/markdown",".json":"application/json",".png":"image/png",".jpg":"image/jpeg",".jpeg":"image/jpeg",".docx":"application/vnd.openxmlformats-officedocument.wordprocessingml.document",".xlsx":"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",".pptx":"application/vnd.openxmlformats-officedocument.presentationml.presentation"},Dg={critical:"restricted",high:"confidential",medium:"internal",low:"internal",info:"internal"};function Bl(e,t){if(e){let o=Dl({key:Buffer.from(e,"base64"),format:"der",type:"pkcs8"});return{privateKey:o,publicPem:Cl(o).export({format:"pem",type:"spki"}),label:`device ${t??""}`.trim()}}let n=Ci(Nl(),".nodata","issuer-ed25519.json");if(Di(n)){let o=JSON.parse(jl(n,"utf8")).private_pem,i=Dl(o);return{privateKey:i,publicPem:Cl(i).export({format:"pem",type:"spki"}),label:"this machine"}}let r=Ag("ed25519");return Tg(Ci(Nl(),".nodata"),{recursive:!0}),Ll(n,JSON.stringify({private_pem:r.privateKey.export({format:"pem",type:"pkcs8"})},null,2)+`
+`,{mode:384}),{privateKey:r.privateKey,publicPem:r.publicKey.export({format:"pem",type:"spki"}),label:"this machine"}}function Fl(e,t,n,r){e.registerTool("nodata_wrap",{description:"WRAP files into your organization's sovereign archive (a zero-knowledge capsule): each file is encrypted ON THIS MACHINE to the public half of your org master key \u2014 the 12 words from signup \u2014 and only ciphertext is uploaded. NoData can never open it; your 12 words (or recovery file) always can, even if this computer is lost or NoData is offline. Each document gets a signed receipt and proof_url. Given a folder, wraps the files the scan finds exposure in (classified by severity); given a file, wraps that file. ASKS FIRST: without confirm:true it only lists what would be wrapped. keep_local:true (default) also writes <file>.capsule.ndc next to the original; remove:true deletes the plaintext originals after a successful upload.",inputSchema:{path:Dr.string().describe("File or folder to wrap."),confirm:Dr.boolean().optional().describe("true = wrap it. Omit to preview."),keep_local:Dr.boolean().optional().describe("Also keep <file>.capsule.ndc next to the original. Default true."),remove:Dr.boolean().optional().describe("Delete plaintext originals after upload. Default false.")}},async({path:o,confirm:i,keep_local:s,remove:a})=>{let c=Pg(o);if(!Di(c))return we(`Not found: ${c}`,!0);let l;if(Cr(c).isDirectory()?l=We(await Ft({target_id:"mcp",target_label:xn(c),target_path:c,log:Mt})).byFile.map(v=>({path:Ci(c,v.key),classification:Dg[v.worst]??"internal"})):l=[{path:c,classification:"confidential"}],l=l.filter(m=>Di(m.path)&&Cr(m.path).isFile()&&!xe(m.path)),l.length===0)return we(`Nothing to wrap in ${c} \u2014 no file with findings.`);let d=l.filter(m=>Cr(m.path).size>Ol);l=l.filter(m=>Cr(m.path).size<=Ol);let p=await t.get("/api/v1/recovery/pubkey");if(p.status===401||p.status===403)return we(`Not authorized to read the org key (HTTP ${p.status}). Connect with nodata_connect.`,!0);let f=typeof p.body.pubkeyB64=="string"?p.body.pubkeyB64:null;if(!f)return we(`Your organization has no master key yet \u2014 the 12-word recovery setup was not completed, so there is nothing to wrap to.
+Finish it once in the console (Recovery setup), then wrap again. NoData never sees the words.`,!0);if(!i){let m=l.slice(0,Ri).map(v=>`  \xB7 [${v.classification}] ${v.path}`);return l.length>Ri&&m.push(`  \u2026 and ${l.length-Ri} more`),we([`PREVIEW \u2014 nothing wrapped yet. ${r()}`,`Would wrap ${l.length} file(s) into the "${An}" capsule, sealed to your org master key (fingerprint ${p.body.fingerprint??"?"}):`,...m,d.length?`Skipped (over 25 MB): ${d.map(v=>xn(v.path)).join(", ")}`:"",`Encrypted here; only ciphertext is uploaded. Opens with your 12 words \u2014 never with NoData.${a?" Plaintext originals WILL BE DELETED after upload.":""}`,"","Ask the user to approve, then call nodata_wrap again with the same arguments and confirm: true."].filter(Boolean).join(`
+`))}let h=await t.get("/api/v1/capsules");if(h.status>=400)return we(`Could not list capsules (HTTP ${h.status}): ${JSON.stringify(h.body)}`,!0);let _=(h.body.capsules??[]).find(m=>m.slug===An);if(_&&_.key_mode!=="zk")return we(`A "${An}" capsule exists but is not zero-knowledge (key_mode ${String(_.key_mode)}) \u2014 refusing to wrap into it.`,!0);if(!_){let m=await t.post("/api/v1/capsules",{handle:An,display_name:"MCP archive",key_mode:"zk",capsule_pubkey:f});if(m.status>=400)return we(`Could not create the archive capsule (HTTP ${m.status}): ${JSON.stringify(m.body)}`,!0);_=m.body}let S=String(_.slug??_.capsule_id??"");if(!S)return we(`Capsule id missing in ${JSON.stringify(_)}`,!0);let E=n(),P=[],N=[];for(let m of l){let v=jl(m.path),{ndcBytes:k,report:R}=await Rl({fileBytes:v,filename:xn(m.path),contentType:Rg[$g(m.path).toLowerCase()]??"application/octet-stream",recipientPubkeyB64:f,issuerPrivateKey:E.privateKey,issuerPubkeyPem:E.publicPem}),T=await t.post(`/api/v1/capsules/${encodeURIComponent(S)}/documents`,{title:xn(m.path),ndc_b64:k.toString("base64"),classification:m.classification,plaintext_sha256:R.plaintext_sha256,size_bytes:R.size_bytes});if(T.status>=400||T.body.ok!==!0){N.push(`  \u2717 ${m.path} \u2014 HTTP ${T.status}: ${JSON.stringify(T.body).slice(0,200)}`);continue}s!==!1&&Ll(`${m.path}.capsule.ndc`,k,{mode:384}),a&&Ig(m.path),P.push(`  \u2713 [${m.classification}] ${xn(m.path)}${T.body.proof_url?`  proof: ${T.body.proof_url}`:""}`)}return we([`WRAPPED ${P.length}/${l.length} into "${An}" \u2014 ${r()} \xB7 signed by ${E.label}`,...P,...N,"Sealed to your org master key: NoData stores ciphertext only and cannot open it. Your 12 words (or recovery file) open every document.",s!==!1?"Local copies: <file>.capsule.ndc next to each original.":"",a?"Plaintext originals deleted (only for files that uploaded).":""].filter(Boolean).join(`
+`),N.length>0&&P.length===0)})}import{homedir as zl,hostname as ql}from"node:os";import{join as Nr,resolve as Ni}from"node:path";import{existsSync as Li,readFileSync as Jl,writeFileSync as Yl,mkdirSync as Xl,chmodSync as Og}from"node:fs";import{spawn as jg}from"node:child_process";import{generateKeyPairSync as Lg,createPrivateKey as Bg,sign as Fg,randomBytes as Mg}from"node:crypto";var Tn="1.3.17",Zl=Nr(zl(),".nodata"),Or=Nr(Zl,"credentials.json");function Kg(){try{if(!Li(Or))return null;let e=JSON.parse(Jl(Or,"utf8"));if(!e)return null;let t=e.device&&typeof e.device.private_key_pkcs8_b64=="string",n=typeof e.api_key=="string"&&e.api_key;return t||n?e:null}catch{return null}}function Ml(e){Xl(Zl,{recursive:!0});let t=JSON.stringify({...e,saved_at:new Date().toISOString()},null,2);Yl(Or,t,{mode:384});try{Og(Or,384)}catch{}}var Hg=`nodata-mcp v${Tn} \u2014 NoData MCP server
 
   ADMIN mode:  nodata-mcp --api-key sk_live_...
   AGENT mode:  nodata-mcp --grant-token ndca-...
@@ -162,15 +163,15 @@ Finish it once in the console (Recovery setup), then wrap again. NoData never se
 
 Env vars: NODATA_API_KEY \xB7 NODATA_GRANT_TOKEN \xB7 NODATA_BASE_URL
 Get a free API key: https://www.nodatacapsule.com/developers/get-started
-Mint a grant token: POST /api/v1/governance/grant (or the nodata_grant tool).`;function Ci(e){let t="",n="",r="https://www.nodatacapsule.com";for(let s=0;s<e.length;s++)e[s]==="--api-key"&&e[s+1]?t=e[++s]:e[s]==="--grant-token"&&e[s+1]?n=e[++s]:e[s]==="--base-url"&&e[s+1]?r=e[++s]:e[s]==="--help"||e[s]==="-h"?(console.log(Mg),process.exit(0)):e[s]==="--version"||e[s]==="-v"?(console.log(xn),process.exit(0)):e[s].startsWith("--")&&console.error(`nodata-mcp: unknown option '${e[s]}' (see --help)`);let o=t||n?"flag":"none";!t&&process.env.NODATA_API_KEY&&(t=process.env.NODATA_API_KEY,o="env"),!n&&process.env.NODATA_GRANT_TOKEN&&(n=process.env.NODATA_GRANT_TOKEN,o==="none"&&(o="env")),process.env.NODATA_BASE_URL&&(r=process.env.NODATA_BASE_URL);let i;if(!t&&!n){let s=Fg();s&&(!process.env.NODATA_BASE_URL&&r==="https://www.nodatacapsule.com"&&s.base_url&&(r=s.base_url),s.device?(i=s.device,o="stored"):s.api_key&&(t=s.api_key,o="stored"))}return r=r.replace(/\/+$/,""),{apiKey:t,grantToken:n,baseUrl:r,credentialSource:o,device:i}}var Ml=3e4;async function Zl(e,t){let n;try{n=await fetch(e,{...t,signal:AbortSignal.timeout(Ml)})}catch(o){return{ok:!1,status:0,body:{error:o instanceof Error&&o.name==="TimeoutError"?`Request timed out after ${Ml/1e3}s: ${e}`:`Network error reaching ${e}: ${o instanceof Error?o.message:String(o)}`}}}let r;try{r=await n.json()}catch{r={error:`Non-JSON response (HTTP ${n.status})`}}return{ok:n.ok,status:n.status,body:r}}async function An(e){if(typeof e=="string")return{token:e};try{return{token:await e()}}catch(t){return{error:{ok:!1,status:0,body:{error:`Could not obtain an access token: ${t instanceof Error?t.message:String(t)}`}}}}}function Kl(e){return async()=>{let t=await An(e);return"error"in t?null:t.token}}async function Y(e,t,n,r){let o=await An(t);return"error"in o?o.error:Zl(`${e}${n}`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${o.token}`},body:JSON.stringify(r)})}async function Ni(e,t,n,r){let o=await An(t);if("error"in o)return o.error;let i=new URL(`${e}${n}`);for(let[s,a]of Object.entries(r))a!==void 0&&a!==""&&i.searchParams.set(s,a);return Zl(i.toString(),{method:"GET",headers:{Authorization:`Bearer ${o.token}`}})}function J(e){let t=JSON.stringify(e.body,null,2);return e.ok?{content:[{type:"text",text:t}]}:{content:[{type:"text",text:`Error (HTTP ${e.status}):
-${t}`}],isError:!0}}function Kg(e){let t=e?[Di(e)]:[Di(".env.local"),Di(".env")];if(e&&!Oi(t[0]))return{error:`env file not found: ${t[0]}`};let n={},r=[];for(let i of t)if(Oi(i)){r.push(i);for(let s of ql(i,"utf8").split(/\r?\n/)){let a=s.match(/^\s*(?:export\s+)?([A-Z0-9_]+)\s*=\s*(.*)\s*$/);!a||a[1]in n||(n[a[1]]=a[2].replace(/^(['"])(.*)\1$/,"$2").trim())}}let o=i=>{for(let s of i){let a=n[s]??process.env[s];if(a)return{name:s,value:a}}};return{url:o(["SUPABASE_URL","NEXT_PUBLIC_SUPABASE_URL","VITE_SUPABASE_URL","EXPO_PUBLIC_SUPABASE_URL"]),anon:o(["SUPABASE_ANON_KEY","NEXT_PUBLIC_SUPABASE_ANON_KEY","VITE_SUPABASE_ANON_KEY","EXPO_PUBLIC_SUPABASE_ANON_KEY","SUPABASE_PUBLISHABLE_KEY","NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY"]),jwt:o(["SUPABASE_JWT_SECRET","JWT_SECRET"]),files:r}}function Hg(e){try{let n=(e.startsWith("ndca-")?e.slice(5):e).split(".")[1];return n?JSON.parse(Buffer.from(n.replace(/-/g,"+").replace(/_/g,"/"),"base64").toString("utf8")).handle??null:null}catch{return null}}var Ug=5*6e4;function Vg(){let{publicKey:e,privateKey:t}=Og("ed25519"),n=e.export({format:"der",type:"spki"}),r=t.export({format:"der",type:"pkcs8"});return{publicKeyHex:n.subarray(-32).toString("hex"),privateKeyPkcs8B64:r.toString("base64")}}function Gg(e,t){let n=jg({key:Buffer.from(e,"base64"),format:"der",type:"pkcs8"});return Lg(null,Buffer.from(t,"utf8"),n).toString("base64")}function Wg(){let e=zl().toLowerCase().replace(/[^a-z0-9-]+/g,"-").replace(/^-+|-+$/g,"").slice(0,20)||"device";return`${/^[a-z]/.test(e)?e:`d-${e}`}-${Bg(3).toString("hex")}`.slice(0,32)}async function zg(e,t,n,r,o){let i=await Y(e,t,"/api/v1/attest/devices",{handle:n,label:r,ed25519_pubkey_hex:o});if(i.ok){let s=i.body.org_id??"";return s?{ok:!0,orgId:s}:{ok:!1,status:i.status,error:"enroll response missing org_id"}}return{ok:!1,status:i.status,error:i.body?.error??`HTTP ${i.status}`}}async function qg(e,t){let n=await Y(e,"","/api/v1/attest/challenge",{org_id:t.org_id,handle:t.handle});if(!n.ok)throw new Error(`challenge: ${n.body?.error??`HTTP ${n.status}`}`);let{challenge:r,nonce:o}=n.body;if(!r||!o)throw new Error("challenge response malformed");let i=Gg(t.private_key_pkcs8_b64,r),s=await Y(e,"","/api/v1/attest",{org_id:t.org_id,handle:t.handle,nonce:o,signature:i});if(!s.ok)throw new Error(`attest: ${s.body?.error??`HTTP ${s.status}`}`);let a=s.body;if(!a.allowed||!a.access_token)throw new Error(`attestation rejected: ${a.reason??"denied"}`);return{token:a.access_token,expiresAtMs:a.expires_at?Date.parse(a.expires_at):Date.now()+15*6e4}}function Hl(e,t){let n=null;return async()=>((!n||Date.now()>=n.expiresAtMs-Ug)&&(n=await qg(e,t)),n.token)}function Jg(e,t){let n=Cr(Wl(),".nodata","approvals");Yl(n,{recursive:!0});let r=Cr(n,`${new Date().toISOString().replace(/[:.]/g,"-").slice(0,19)}-${e}.json`);return Jl(r,JSON.stringify({kind:e,approved_at:new Date().toISOString(),...t},null,2)+`
-`,{mode:384}),r}function Yg(e,t,n,r){e.registerTool("nodata_register_table",{description:"Register one of your own tables as AI-agent-readable. This writes POLICY only: it declares which columns are sensitive (released per-column only if their ciphertext exists) and which are plaintext metadata. It does NOT encrypt or change anything in the user's database \u2014 never tell the user their data is now encrypted. Relay the response's `message` and `next_steps` verbatim. After this, grants can target the table.",inputSchema:{table_name:g.string().describe("Your SQL table name"),encrypted_columns:g.array(g.string()).describe("Columns stored as <col>_ct/_iv/_tag triplets"),plaintext_columns:g.array(g.string()).optional().describe("Plaintext metadata/filter columns"),classification_column:g.string().optional().describe("Plaintext column carrying the classification value")}},async({table_name:o,encrypted_columns:i,plaintext_columns:s,classification_column:a})=>{let c=await Y(t,n,"/api/v1/governance/tables",{table_name:o,encrypted_columns:i,plaintext_columns:s??[],classification_column:a});return J(c)}),e.registerTool("nodata_connect_source",{description:"Connect the user's own Supabase project as the data source for their registered tables, so granted agents can read metadata through NoData. Reads the project URL, anon key and JWT secret from the user's LOCAL env file (e.g. .env.local) and sends them directly to NoData \u2014 never ask the user to paste a key or secret into the chat, and never print them. Only allowed_tables are readable (deny-by-default).",inputSchema:{allowed_tables:g.array(g.string()).describe("Tables agents may read through this source"),env_file:g.string().optional().describe("Path to the env file holding the Supabase keys (default: .env.local, then .env in the working directory)"),source_url:g.string().optional().describe("Override the project URL (https://<ref>.supabase.co) if the env file lacks it")}},async({allowed_tables:o,env_file:i,source_url:s})=>{let a=Kg(i);if("error"in a)return{content:[{type:"text",text:`Error: ${a.error}`}],isError:!0};let c=s??a.url?.value,l=[c?null:"project URL (SUPABASE_URL / NEXT_PUBLIC_SUPABASE_URL)",a.anon?null:"anon key (SUPABASE_ANON_KEY / NEXT_PUBLIC_SUPABASE_ANON_KEY)",a.jwt?null:"JWT secret (SUPABASE_JWT_SECRET \xB7 Supabase \u2192 Settings \u2192 API \u2192 JWT secret)"].filter(Boolean);if(l.length>0)return{content:[{type:"text",text:`Not sent. Missing in ${a.files.join(", ")||"the environment"}: ${l.join("; ")}.
-Ask the user to add them to that file themselves (not in this chat), then call this tool again.`}],isError:!0};let u=await Y(t,n,"/api/connector/secrets",{source_url:c,allowed_tables:o,anon_key:a.anon.value,jwt_secret:a.jwt.value}),p={read_from:a.files,variables_used:[a.url?.name,a.anon.name,a.jwt.name].filter(Boolean)};return J({...u,body:{...u.body,...p}})}),e.registerTool("nodata_grant",{description:"Issue ONE AI agent a claim-scoped grant over your data \u2014 claims, not blanket access. Returns a grant_token (shown once) the agent presents to read. Denied columns never decrypt. For one agent over several tables pass `tables` in a single call \u2014 do NOT call this once per table, that creates a separate agent each time. ASKS FIRST: without confirm:true it returns the exact policy change and grants nothing \u2014 show it to the user and call again with confirm:true only after they approve. On confirm, a copy of the approval (who, what, when, the receipt and its proof_url \u2014 never the token) is kept in ~/.nodata/approvals.",inputSchema:{agent:g.string().describe("Agent label (becomes its handle)"),tables:g.array(g.object({table:g.string(),columns:g.array(g.string()).describe("Columns the agent may read in this table"),where:g.record(g.string(),g.union([g.string(),g.number(),g.boolean()])).optional()})).optional().describe("Several tables for the same agent. When set, table/columns/where are ignored."),table:g.string().optional().describe("Single target table (default agent_demo_records)"),columns:g.array(g.string()).optional().describe("Columns the agent may read (single-table form)"),where:g.record(g.string(),g.union([g.string(),g.number(),g.boolean()])).optional().describe("Equality filter (plaintext cols only)"),classifications:g.array(g.string()).optional().describe("Allowed classification values; empty = no gating"),ttl_seconds:g.number().optional().describe("Token lifetime (default 30d, max 1y)"),confirm:g.boolean().optional().describe("true = grant it. Omit to preview the policy change.")}},async({agent:o,tables:i,table:s,columns:a,where:c,classifications:l,ttl_seconds:u,confirm:p})=>{let f={agent:o,...i?{tables:i}:{table:s??"agent_demo_records",columns:a,where:c},classifications:l,ttl_seconds:u};if(!p){let y=(i??[{table:s??"agent_demo_records",columns:a??[],where:c}]).map(E=>`  \xB7 ${E.table}: ${(E.columns??[]).join(", ")||"(no columns)"}${E.where?`  where ${JSON.stringify(E.where)}`:""}`),k=u?`${Math.round(u/86400*10)/10} days`:"30 days (default)";return{content:[{type:"text",text:[`POLICY CHANGE \u2014 PREVIEW, nothing granted yet. Requested by ${r()}`,`Agent "${o}" would be able to read ONLY:`,...y,`Classifications: ${l?.length?l.join(", "):"not gated"}`,`Valid for: ${k}. Every other column stays sealed and every read is receipted.`,"","Ask the user to approve this change, then call nodata_grant again with the same arguments and confirm: true."].join(`
-`)}]}}let h=await Y(t,n,"/api/v1/governance/grant",f);if(h.ok){let _=h.body,y=Jg("grant",{approved_by:r(),request:f,result:{handle:_.handle,agent_id:_.agent_id,expires_at:_.expires_at,grant_receipt_id:_.grant_receipt_id,proof_url:_.proof_url}});h.body.approval_copy=y}return J(h)}),e.registerTool("nodata_policy",{description:"The POLICY BOARD: every AI agent in the organization and exactly what it can reach \u2014 tables, columns, classifications \u2014 plus status. Deny-by-default: an agent with no grant reaches nothing. Change it with nodata_grant (asks for approval first) and nodata_revoke (immediate). Content-free: names only, never a value.",inputSchema:{}},async()=>{let o=await Ni(t,n,"/api/v1/agents",{});if(!o.ok)return J(o);let s=o.body.agents??[],a=[`POLICY BOARD \u2014 ${r()}`,`${s.length} agent(s). Deny-by-default: no grant \u21D2 no access.`,""];for(let c of s){let l=c.scope,u=l?l.grants===0?"reaches nothing":`${l.tables_allowed.join(", ")||"(tables)"} \u2192 ${l.columns_allowed.join(", ")||"(no columns)"} \xB7 classifications: ${l.unrestricted_classifications?"not gated":l.classifications_allowed.join(", ")||"none"}`:"scope unavailable";a.push(`  ${String(c.handle??c.name).padEnd(24)} ${String(c.status??"").padEnd(8)} ${u}`)}return a.push("",'Change: nodata_grant (preview \u2192 approve) \xB7 nodata_revoke handle: "<agent>" (immediate) \xB7 proofs: nodata_proofs'),{content:[{type:"text",text:a.join(`
-`)}]}}),e.registerTool("nodata_revoke",{description:"Revoke an agent's grant by handle (kills all its active credentials) or by a specific jti. Revocation is mathematics \u2014 the next read 401s and any cached data is governance-dead.",inputSchema:{handle:g.string().optional().describe("Agent handle to revoke"),jti:g.string().optional().describe("Specific credential jti to revoke"),reason:g.string().optional()}},async({handle:o,jti:i,reason:s})=>{let a=await Y(t,n,"/api/v1/governance/revoke",{handle:o,jti:i,reason:s});return J(a)}),e.registerTool("nodata_encrypt",{description:"LEGACY (v0.1). Encrypt a field value with Capsule Blind Relay. The key is EMBEDDED in the returned string: whoever holds the string can decrypt it, so this is not protection at rest. Prefer nodata_protect for files, nodata_run for secrets, nodata_send to share. Use only when the user asks for this format by name.",inputSchema:{field:g.string(),value:g.string(),context:g.string().optional()}},async({field:o,value:i,context:s})=>{let a={field:o,value:i};return s&&(a.context=s),J(await Y(t,n,"/api/v1/encrypt",a))}),e.registerTool("nodata_decrypt",{description:"LEGACY (v0.1). Decrypt a Blind Relay string (aes256gcm:v1:iv:cipher:key \u2014 the key travels inside it). Returns plaintext: show counts, not the value, unless the user asks.",inputSchema:{ciphertext:g.string(),field:g.string().optional(),requester:g.string().optional()}},async({ciphertext:o,field:i,requester:s})=>{let a={ciphertext:o};return i&&(a.field=i),s&&(a.requester=s),J(await Y(t,n,"/api/v1/decrypt",a))}),e.registerTool("nodata_deliver",{description:"Create a burn-after-read secure link for delivering sensitive content. Returns a view URL and OTP.",inputSchema:{content:g.string(),to:g.string().optional(),maxViews:g.number().optional(),ttl:g.string().optional(),burn:g.boolean().optional()}},async({content:o,to:i,maxViews:s,ttl:a,burn:c})=>{let l={content:o};return i&&(l.to=i),s!==void 0&&(l.maxViews=s),a&&(l.ttl=a),c!==void 0&&(l.burn=c),J(await Y(t,n,"/api/v1/deliver",l))}),e.registerTool("nodata_evidence",{description:"Field-level encrypt/decrypt/deliver events (field_access_log). Requires the Engine scope on the key. For the signed decision-receipt chain \u2014 grants, agent reads, denials \u2014 use nodata_proofs instead, which every org key can call. Metadata only.",inputSchema:{from:g.string().optional(),to:g.string().optional(),action:g.string().optional(),limit:g.number().optional()}},async({from:o,to:i,action:s,limit:a})=>{let c={from:o,to:i,action:s,limit:a!==void 0?String(a):void 0};return J(await Ni(t,n,"/api/v1/evidence",c))}),e.registerTool("nodata_proofs",{description:"List your organization's signed proofs: every grant, agent read and denial, newest first. Content-free (labels, hashes, timestamps). Each proof can be verified by anyone, without an account, by POSTing {proof_id: <its receipt_id>} to /api/access/verify. The response's `plan` says which proof types the user's plan includes and which need an upgrade (with the plan name) \u2014 relay it as is.",inputSchema:{receipt_id:g.string().optional().describe("Fetch one proof by id"),surface:g.string().optional().describe("Filter, e.g. 'governance.grant', 'agent.read'"),decision:g.string().optional().describe("Filter: 'grant' | 'allow' | 'deny' | 'revoke'"),from:g.string().optional().describe("ISO timestamp"),to:g.string().optional().describe("ISO timestamp"),limit:g.number().optional().describe("1..1000, default 50")}},async({receipt_id:o,surface:i,decision:s,from:a,to:c,limit:l})=>J(await Ni(t,n,"/api/v1/proofs",{receipt_id:o,surface:i,decision:s,from:a,to:c,limit:l!==void 0?String(l):void 0})))}function Xg(e,t,n){let r=Hg(n);r||console.error("nodata-mcp: warning \u2014 could not derive an agent handle from the grant token (expected ndca-<jwt> with a 'handle' claim). nodata_decide/nodata_retrieve will work; nodata_read/nodata_use will fail until a valid grant token is provided."),e.registerTool("nodata_decide",{description:"Ask whether this agent MAY reach a resource, WITHOUT reading it. Returns a decision (allow / degrade / deny), the reachable column subset, an access-distance cost, and a signed proof \u2014 never any data. Use it to plan: check reachability before you retrieve. Hard-scoped to this server's grant token.",inputSchema:{table:g.string().describe("Table to check (must be in your grant)"),columns:g.array(g.string()).describe("Columns you want to reach"),where:g.record(g.string(),g.union([g.string(),g.number(),g.boolean()])).optional().describe("Equality filter (readable columns only)")}},async({table:o,columns:i,where:s})=>{let a=await Y(t,n,"/api/access/decide",{resource:{table:o,columns:i,where:s},intent:"read"});return J(a)}),e.registerTool("nodata_retrieve",{description:"Retrieve prompt-ready context for a resource, filtered to exactly what this agent may see. Denied columns are never decrypted; the response includes an accounting of what was withheld (columns + estimated tokens saved) and a signed proof. Prefer this over a raw read when assembling an LLM prompt. Hard-scoped to this server's grant token.",inputSchema:{table:g.string().describe("Table to retrieve from (must be in your grant)"),columns:g.array(g.string()).describe("Columns to include in context"),where:g.record(g.string(),g.union([g.string(),g.number(),g.boolean()])).optional(),top_k:g.number().optional().describe("Max rows (default 50, max 200)")}},async({table:o,columns:i,where:s,top_k:a})=>{let c=await Y(t,n,"/api/access/retrieve",{resource:{table:o,columns:i,where:s},top_k:a});return J(c)}),e.registerTool("nodata_read",{description:"Read governed data within this agent's grant. You may only request columns your grant allows \u2014 denied columns never decrypt server-side, and every read emits a cryptographic receipt. This tool is hard-scoped to the grant token this server was started with.",inputSchema:{table:g.string().describe("Table to read (must be in your grant)"),columns:g.array(g.string()).describe("Columns to read (must be in your grant)"),where:g.record(g.string(),g.union([g.string(),g.number(),g.boolean()])).optional(),limit:g.number().optional().describe("Max rows (default 50, max 200)")}},async({table:o,columns:i,where:s,limit:a})=>{if(!r)return{content:[{type:"text",text:"Error: could not derive agent handle from grant token."}],isError:!0};let c=await Y(t,n,`/api/agents/${encodeURIComponent(r)}/read`,{table:o,columns:i,where:s,limit:a});return J(c)}),e.registerTool("nodata_use",{description:"Invoke a pre-registered capability (deploy, send, charge, query, \u2026) WITHOUT receiving the secret. The Capsule injects the sealed credential server-side and returns only the result. You may invoke only capabilities your grant allows; the secret never reaches you. Hard-scoped to the grant token this server was started with.",inputSchema:{capability:g.string().describe("Capability name to invoke (must be in your grant, e.g. 'deploy-prod')"),params:g.record(g.string(),g.unknown()).optional().describe("Allowlisted params; unknown keys are dropped server-side"),resource_key:g.string().optional().describe("Optional folder/resource the action targets (enforced against corpus scope)")}},async({capability:o,params:i,resource_key:s})=>{if(!r)return{content:[{type:"text",text:"Error: could not derive agent handle from grant token."}],isError:!0};let a=await Y(t,n,`/api/agents/${encodeURIComponent(r)}/use`,{capability:o,params:i,resource_key:s});return J(a)}),e.registerTool("nodata_code_advise",{description:"Ask the blind code advisor to diagnose/fix a bug in a code capsule WITHOUT seeing its source. You receive guidance + a targeted diff + an exposure proof (source never left the boundary); the source is never returned to you. Requires the capsule owner to have granted this agent (scope.fabric_developers). Hard-scoped to this server's grant token.",inputSchema:{capsule_id:g.string().describe("The code capsule to advise on (you must be granted on it)"),question:g.string().optional().describe("What to fix / improve, in natural language"),note:g.string().optional().describe("Extra context for the advisor"),error:g.object({message:g.string().optional(),stack:g.string().optional(),kind:g.string().optional()}).optional().describe("An error the code produced, to guide the fix"),steer:g.string().optional().describe("A steer on a refine turn (e.g. 'no, round half-up')"),prior_diff:g.string().optional().describe("The previously proposed diff, to refine")}},async({capsule_id:o,question:i,note:s,error:a,steer:c,prior_diff:l})=>{if(!r)return{content:[{type:"text",text:"Error: could not derive agent handle from grant token."}],isError:!0};let u=await Y(t,n,`/api/agents/${encodeURIComponent(r)}/code-capsule/${encodeURIComponent(o)}/advise`,{question:i,note:s,error:a,steer:c,prior_diff:l});return J(u)}),e.registerTool("nodata_code_patch",{description:"Submit a fix to a code capsule as a SIGNED, queued patch WITHOUT seeing its source. Provide a raw unified `diff`, or a whole-file `replace` ({path, content}) that is diffed server-side against the sealed source. The source is never persisted or returned; you get back a patch id, the diff hash, and a receipt. Requires a capsule grant (scope.fabric_developers). Hard-scoped to this server's grant token.",inputSchema:{capsule_id:g.string().describe("The code capsule to patch (you must be granted on it)"),summary:g.string().optional().describe("Short human-readable summary of the fix"),diff:g.string().optional().describe("A raw unified diff (advanced)"),replace:g.object({path:g.string(),content:g.string()}).optional().describe("Whole-file replacement; the diff is synthesized server-side against sealed source")}},async({capsule_id:o,summary:i,diff:s,replace:a})=>{if(!r)return{content:[{type:"text",text:"Error: could not derive agent handle from grant token."}],isError:!0};let c=await Y(t,n,`/api/agents/${encodeURIComponent(r)}/code-capsule/${encodeURIComponent(o)}/patch`,{summary:i,diff:s,replace:a});return J(c)})}var Ul=`WHAT NODATA DOES \u2014 in one line:
+Mint a grant token: POST /api/v1/governance/grant (or the nodata_grant tool).`;function Oi(e){let t="",n="",r="https://www.nodatacapsule.com";for(let s=0;s<e.length;s++)e[s]==="--api-key"&&e[s+1]?t=e[++s]:e[s]==="--grant-token"&&e[s+1]?n=e[++s]:e[s]==="--base-url"&&e[s+1]?r=e[++s]:e[s]==="--help"||e[s]==="-h"?(console.log(Hg),process.exit(0)):e[s]==="--version"||e[s]==="-v"?(console.log(Tn),process.exit(0)):e[s].startsWith("--")&&console.error(`nodata-mcp: unknown option '${e[s]}' (see --help)`);let o=t||n?"flag":"none";!t&&process.env.NODATA_API_KEY&&(t=process.env.NODATA_API_KEY,o="env"),!n&&process.env.NODATA_GRANT_TOKEN&&(n=process.env.NODATA_GRANT_TOKEN,o==="none"&&(o="env")),process.env.NODATA_BASE_URL&&(r=process.env.NODATA_BASE_URL);let i;if(!t&&!n){let s=Kg();s&&(!process.env.NODATA_BASE_URL&&r==="https://www.nodatacapsule.com"&&s.base_url&&(r=s.base_url),s.device?(i=s.device,o="stored"):s.api_key&&(t=s.api_key,o="stored"))}return r=r.replace(/\/+$/,""),{apiKey:t,grantToken:n,baseUrl:r,credentialSource:o,device:i}}var Kl=3e4;async function Ql(e,t){let n;try{n=await fetch(e,{...t,signal:AbortSignal.timeout(Kl)})}catch(o){return{ok:!1,status:0,body:{error:o instanceof Error&&o.name==="TimeoutError"?`Request timed out after ${Kl/1e3}s: ${e}`:`Network error reaching ${e}: ${o instanceof Error?o.message:String(o)}`}}}let r;try{r=await n.json()}catch{r={error:`Non-JSON response (HTTP ${n.status})`}}return{ok:n.ok,status:n.status,body:r}}async function In(e){if(typeof e=="string")return{token:e};try{return{token:await e()}}catch(t){return{error:{ok:!1,status:0,body:{error:`Could not obtain an access token: ${t instanceof Error?t.message:String(t)}`}}}}}function Hl(e){return async()=>{let t=await In(e);return"error"in t?null:t.token}}async function Y(e,t,n,r){let o=await In(t);return"error"in o?o.error:Ql(`${e}${n}`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${o.token}`},body:JSON.stringify(r)})}async function ji(e,t,n,r){let o=await In(t);if("error"in o)return o.error;let i=new URL(`${e}${n}`);for(let[s,a]of Object.entries(r))a!==void 0&&a!==""&&i.searchParams.set(s,a);return Ql(i.toString(),{method:"GET",headers:{Authorization:`Bearer ${o.token}`}})}function J(e){let t=JSON.stringify(e.body,null,2);return e.ok?{content:[{type:"text",text:t}]}:{content:[{type:"text",text:`Error (HTTP ${e.status}):
+${t}`}],isError:!0}}function Ug(e){let t=e?[Ni(e)]:[Ni(".env.local"),Ni(".env")];if(e&&!Li(t[0]))return{error:`env file not found: ${t[0]}`};let n={},r=[];for(let i of t)if(Li(i)){r.push(i);for(let s of Jl(i,"utf8").split(/\r?\n/)){let a=s.match(/^\s*(?:export\s+)?([A-Z0-9_]+)\s*=\s*(.*)\s*$/);!a||a[1]in n||(n[a[1]]=a[2].replace(/^(['"])(.*)\1$/,"$2").trim())}}let o=i=>{for(let s of i){let a=n[s]??process.env[s];if(a)return{name:s,value:a}}};return{url:o(["SUPABASE_URL","NEXT_PUBLIC_SUPABASE_URL","VITE_SUPABASE_URL","EXPO_PUBLIC_SUPABASE_URL"]),anon:o(["SUPABASE_ANON_KEY","NEXT_PUBLIC_SUPABASE_ANON_KEY","VITE_SUPABASE_ANON_KEY","EXPO_PUBLIC_SUPABASE_ANON_KEY","SUPABASE_PUBLISHABLE_KEY","NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY"]),jwt:o(["SUPABASE_JWT_SECRET","JWT_SECRET"]),files:r}}function Vg(e){try{let n=(e.startsWith("ndca-")?e.slice(5):e).split(".")[1];return n?JSON.parse(Buffer.from(n.replace(/-/g,"+").replace(/_/g,"/"),"base64").toString("utf8")).handle??null:null}catch{return null}}var Gg=5*6e4;function Wg(){let{publicKey:e,privateKey:t}=Lg("ed25519"),n=e.export({format:"der",type:"spki"}),r=t.export({format:"der",type:"pkcs8"});return{publicKeyHex:n.subarray(-32).toString("hex"),privateKeyPkcs8B64:r.toString("base64")}}function zg(e,t){let n=Bg({key:Buffer.from(e,"base64"),format:"der",type:"pkcs8"});return Fg(null,Buffer.from(t,"utf8"),n).toString("base64")}function qg(){let e=ql().toLowerCase().replace(/[^a-z0-9-]+/g,"-").replace(/^-+|-+$/g,"").slice(0,20)||"device";return`${/^[a-z]/.test(e)?e:`d-${e}`}-${Mg(3).toString("hex")}`.slice(0,32)}async function Jg(e,t,n,r,o){let i=await Y(e,t,"/api/v1/attest/devices",{handle:n,label:r,ed25519_pubkey_hex:o});if(i.ok){let s=i.body.org_id??"";return s?{ok:!0,orgId:s}:{ok:!1,status:i.status,error:"enroll response missing org_id"}}return{ok:!1,status:i.status,error:i.body?.error??`HTTP ${i.status}`}}async function Yg(e,t){let n=await Y(e,"","/api/v1/attest/challenge",{org_id:t.org_id,handle:t.handle});if(!n.ok)throw new Error(`challenge: ${n.body?.error??`HTTP ${n.status}`}`);let{challenge:r,nonce:o}=n.body;if(!r||!o)throw new Error("challenge response malformed");let i=zg(t.private_key_pkcs8_b64,r),s=await Y(e,"","/api/v1/attest",{org_id:t.org_id,handle:t.handle,nonce:o,signature:i});if(!s.ok)throw new Error(`attest: ${s.body?.error??`HTTP ${s.status}`}`);let a=s.body;if(!a.allowed||!a.access_token)throw new Error(`attestation rejected: ${a.reason??"denied"}`);return{token:a.access_token,expiresAtMs:a.expires_at?Date.parse(a.expires_at):Date.now()+15*6e4}}function Ul(e,t){let n=null;return async()=>((!n||Date.now()>=n.expiresAtMs-Gg)&&(n=await Yg(e,t)),n.token)}function Xg(e,t){let n=Nr(zl(),".nodata","approvals");Xl(n,{recursive:!0});let r=Nr(n,`${new Date().toISOString().replace(/[:.]/g,"-").slice(0,19)}-${e}.json`);return Yl(r,JSON.stringify({kind:e,approved_at:new Date().toISOString(),...t},null,2)+`
+`,{mode:384}),r}function Zg(e,t,n,r){e.registerTool("nodata_register_table",{description:"Register one of your own tables as AI-agent-readable. This writes POLICY only: it declares which columns are sensitive (released per-column only if their ciphertext exists) and which are plaintext metadata. It does NOT encrypt or change anything in the user's database \u2014 never tell the user their data is now encrypted. Relay the response's `message` and `next_steps` verbatim. After this, grants can target the table.",inputSchema:{table_name:g.string().describe("Your SQL table name"),encrypted_columns:g.array(g.string()).describe("Columns stored as <col>_ct/_iv/_tag triplets"),plaintext_columns:g.array(g.string()).optional().describe("Plaintext metadata/filter columns"),classification_column:g.string().optional().describe("Plaintext column carrying the classification value")}},async({table_name:o,encrypted_columns:i,plaintext_columns:s,classification_column:a})=>{let c=await Y(t,n,"/api/v1/governance/tables",{table_name:o,encrypted_columns:i,plaintext_columns:s??[],classification_column:a});return J(c)}),e.registerTool("nodata_connect_source",{description:"Connect the user's own Supabase project as the data source for their registered tables, so granted agents can read metadata through NoData. Reads the project URL, anon key and JWT secret from the user's LOCAL env file (e.g. .env.local) and sends them directly to NoData \u2014 never ask the user to paste a key or secret into the chat, and never print them. Only allowed_tables are readable (deny-by-default).",inputSchema:{allowed_tables:g.array(g.string()).describe("Tables agents may read through this source"),env_file:g.string().optional().describe("Path to the env file holding the Supabase keys (default: .env.local, then .env in the working directory)"),source_url:g.string().optional().describe("Override the project URL (https://<ref>.supabase.co) if the env file lacks it")}},async({allowed_tables:o,env_file:i,source_url:s})=>{let a=Ug(i);if("error"in a)return{content:[{type:"text",text:`Error: ${a.error}`}],isError:!0};let c=s??a.url?.value,l=[c?null:"project URL (SUPABASE_URL / NEXT_PUBLIC_SUPABASE_URL)",a.anon?null:"anon key (SUPABASE_ANON_KEY / NEXT_PUBLIC_SUPABASE_ANON_KEY)",a.jwt?null:"JWT secret (SUPABASE_JWT_SECRET \xB7 Supabase \u2192 Settings \u2192 API \u2192 JWT secret)"].filter(Boolean);if(l.length>0)return{content:[{type:"text",text:`Not sent. Missing in ${a.files.join(", ")||"the environment"}: ${l.join("; ")}.
+Ask the user to add them to that file themselves (not in this chat), then call this tool again.`}],isError:!0};let d=await Y(t,n,"/api/connector/secrets",{source_url:c,allowed_tables:o,anon_key:a.anon.value,jwt_secret:a.jwt.value}),p={read_from:a.files,variables_used:[a.url?.name,a.anon.name,a.jwt.name].filter(Boolean)};return J({...d,body:{...d.body,...p}})}),e.registerTool("nodata_grant",{description:"Issue ONE AI agent a claim-scoped grant over your data \u2014 claims, not blanket access. Returns a grant_token (shown once) the agent presents to read. Denied columns never decrypt. For one agent over several tables pass `tables` in a single call \u2014 do NOT call this once per table, that creates a separate agent each time. ASKS FIRST: without confirm:true it returns the exact policy change and grants nothing \u2014 show it to the user and call again with confirm:true only after they approve. On confirm, a copy of the approval (who, what, when, the receipt and its proof_url \u2014 never the token) is kept in ~/.nodata/approvals.",inputSchema:{agent:g.string().describe("Agent label (becomes its handle)"),tables:g.array(g.object({table:g.string(),columns:g.array(g.string()).describe("Columns the agent may read in this table"),where:g.record(g.string(),g.union([g.string(),g.number(),g.boolean()])).optional()})).optional().describe("Several tables for the same agent. When set, table/columns/where are ignored."),table:g.string().optional().describe("Single target table (default agent_demo_records)"),columns:g.array(g.string()).optional().describe("Columns the agent may read (single-table form)"),where:g.record(g.string(),g.union([g.string(),g.number(),g.boolean()])).optional().describe("Equality filter (plaintext cols only)"),classifications:g.array(g.string()).optional().describe("Allowed classification values; empty = no gating"),ttl_seconds:g.number().optional().describe("Token lifetime (default 30d, max 1y)"),confirm:g.boolean().optional().describe("true = grant it. Omit to preview the policy change.")}},async({agent:o,tables:i,table:s,columns:a,where:c,classifications:l,ttl_seconds:d,confirm:p})=>{let f={agent:o,...i?{tables:i}:{table:s??"agent_demo_records",columns:a,where:c},classifications:l,ttl_seconds:d};if(!p){let _=(i??[{table:s??"agent_demo_records",columns:a??[],where:c}]).map(E=>`  \xB7 ${E.table}: ${(E.columns??[]).join(", ")||"(no columns)"}${E.where?`  where ${JSON.stringify(E.where)}`:""}`),S=d?`${Math.round(d/86400*10)/10} days`:"30 days (default)";return{content:[{type:"text",text:[`POLICY CHANGE \u2014 PREVIEW, nothing granted yet. Requested by ${r()}`,`Agent "${o}" would be able to read ONLY:`,..._,`Classifications: ${l?.length?l.join(", "):"not gated"}`,`Valid for: ${S}. Every other column stays sealed and every read is receipted.`,"","Ask the user to approve this change, then call nodata_grant again with the same arguments and confirm: true."].join(`
+`)}]}}let h=await Y(t,n,"/api/v1/governance/grant",f);if(h.ok){let y=h.body,_=Xg("grant",{approved_by:r(),request:f,result:{handle:y.handle,agent_id:y.agent_id,expires_at:y.expires_at,grant_receipt_id:y.grant_receipt_id,proof_url:y.proof_url}});h.body.approval_copy=_}return J(h)}),e.registerTool("nodata_policy",{description:"The POLICY BOARD: every AI agent in the organization and exactly what it can reach \u2014 tables, columns, classifications \u2014 plus status. Deny-by-default: an agent with no grant reaches nothing. Change it with nodata_grant (asks for approval first) and nodata_revoke (immediate). Content-free: names only, never a value.",inputSchema:{}},async()=>{let o=await ji(t,n,"/api/v1/agents",{});if(!o.ok)return J(o);let s=o.body.agents??[],a=[`POLICY BOARD \u2014 ${r()}`,`${s.length} agent(s). Deny-by-default: no grant \u21D2 no access.`,""];for(let c of s){let l=c.scope,d=l?l.grants===0?"reaches nothing":`${l.tables_allowed.join(", ")||"(tables)"} \u2192 ${l.columns_allowed.join(", ")||"(no columns)"} \xB7 classifications: ${l.unrestricted_classifications?"not gated":l.classifications_allowed.join(", ")||"none"}`:"scope unavailable";a.push(`  ${String(c.handle??c.name).padEnd(24)} ${String(c.status??"").padEnd(8)} ${d}`)}return a.push("",'Change: nodata_grant (preview \u2192 approve) \xB7 nodata_revoke handle: "<agent>" (immediate) \xB7 proofs: nodata_proofs'),{content:[{type:"text",text:a.join(`
+`)}]}}),e.registerTool("nodata_revoke",{description:"Revoke an agent's grant by handle (kills all its active credentials) or by a specific jti. Revocation is mathematics \u2014 the next read 401s and any cached data is governance-dead.",inputSchema:{handle:g.string().optional().describe("Agent handle to revoke"),jti:g.string().optional().describe("Specific credential jti to revoke"),reason:g.string().optional()}},async({handle:o,jti:i,reason:s})=>{let a=await Y(t,n,"/api/v1/governance/revoke",{handle:o,jti:i,reason:s});return J(a)}),e.registerTool("nodata_encrypt",{description:"LEGACY (v0.1). Encrypt a field value with Capsule Blind Relay. The key is EMBEDDED in the returned string: whoever holds the string can decrypt it, so this is not protection at rest. Prefer nodata_protect for files, nodata_run for secrets, nodata_send to share. Use only when the user asks for this format by name.",inputSchema:{field:g.string(),value:g.string(),context:g.string().optional()}},async({field:o,value:i,context:s})=>{let a={field:o,value:i};return s&&(a.context=s),J(await Y(t,n,"/api/v1/encrypt",a))}),e.registerTool("nodata_decrypt",{description:"LEGACY (v0.1). Decrypt a Blind Relay string (aes256gcm:v1:iv:cipher:key \u2014 the key travels inside it). Returns plaintext: show counts, not the value, unless the user asks.",inputSchema:{ciphertext:g.string(),field:g.string().optional(),requester:g.string().optional()}},async({ciphertext:o,field:i,requester:s})=>{let a={ciphertext:o};return i&&(a.field=i),s&&(a.requester=s),J(await Y(t,n,"/api/v1/decrypt",a))}),e.registerTool("nodata_deliver",{description:"Create a burn-after-read secure link for delivering sensitive content. Returns a view URL and OTP.",inputSchema:{content:g.string(),to:g.string().optional(),maxViews:g.number().optional(),ttl:g.string().optional(),burn:g.boolean().optional()}},async({content:o,to:i,maxViews:s,ttl:a,burn:c})=>{let l={content:o};return i&&(l.to=i),s!==void 0&&(l.maxViews=s),a&&(l.ttl=a),c!==void 0&&(l.burn=c),J(await Y(t,n,"/api/v1/deliver",l))}),e.registerTool("nodata_evidence",{description:"Field-level encrypt/decrypt/deliver events (field_access_log). Requires the Engine scope on the key. For the signed decision-receipt chain \u2014 grants, agent reads, denials \u2014 use nodata_proofs instead, which every org key can call. Metadata only.",inputSchema:{from:g.string().optional(),to:g.string().optional(),action:g.string().optional(),limit:g.number().optional()}},async({from:o,to:i,action:s,limit:a})=>{let c={from:o,to:i,action:s,limit:a!==void 0?String(a):void 0};return J(await ji(t,n,"/api/v1/evidence",c))}),e.registerTool("nodata_proofs",{description:"List your organization's signed proofs: every grant, agent read and denial, newest first. Content-free (labels, hashes, timestamps). Each proof can be verified by anyone, without an account, by POSTing {proof_id: <its receipt_id>} to /api/access/verify. The response's `plan` says which proof types the user's plan includes and which need an upgrade (with the plan name) \u2014 relay it as is.",inputSchema:{receipt_id:g.string().optional().describe("Fetch one proof by id"),surface:g.string().optional().describe("Filter, e.g. 'governance.grant', 'agent.read'"),decision:g.string().optional().describe("Filter: 'grant' | 'allow' | 'deny' | 'revoke'"),from:g.string().optional().describe("ISO timestamp"),to:g.string().optional().describe("ISO timestamp"),limit:g.number().optional().describe("1..1000, default 50")}},async({receipt_id:o,surface:i,decision:s,from:a,to:c,limit:l})=>J(await ji(t,n,"/api/v1/proofs",{receipt_id:o,surface:i,decision:s,from:a,to:c,limit:l!==void 0?String(l):void 0})))}function Qg(e,t,n){let r=Vg(n);r||console.error("nodata-mcp: warning \u2014 could not derive an agent handle from the grant token (expected ndca-<jwt> with a 'handle' claim). nodata_decide/nodata_retrieve will work; nodata_read/nodata_use will fail until a valid grant token is provided."),e.registerTool("nodata_decide",{description:"Ask whether this agent MAY reach a resource, WITHOUT reading it. Returns a decision (allow / degrade / deny), the reachable column subset, an access-distance cost, and a signed proof \u2014 never any data. Use it to plan: check reachability before you retrieve. Hard-scoped to this server's grant token.",inputSchema:{table:g.string().describe("Table to check (must be in your grant)"),columns:g.array(g.string()).describe("Columns you want to reach"),where:g.record(g.string(),g.union([g.string(),g.number(),g.boolean()])).optional().describe("Equality filter (readable columns only)")}},async({table:o,columns:i,where:s})=>{let a=await Y(t,n,"/api/access/decide",{resource:{table:o,columns:i,where:s},intent:"read"});return J(a)}),e.registerTool("nodata_retrieve",{description:"Retrieve prompt-ready context for a resource, filtered to exactly what this agent may see. Denied columns are never decrypted; the response includes an accounting of what was withheld (columns + estimated tokens saved) and a signed proof. Prefer this over a raw read when assembling an LLM prompt. Hard-scoped to this server's grant token.",inputSchema:{table:g.string().describe("Table to retrieve from (must be in your grant)"),columns:g.array(g.string()).describe("Columns to include in context"),where:g.record(g.string(),g.union([g.string(),g.number(),g.boolean()])).optional(),top_k:g.number().optional().describe("Max rows (default 50, max 200)")}},async({table:o,columns:i,where:s,top_k:a})=>{let c=await Y(t,n,"/api/access/retrieve",{resource:{table:o,columns:i,where:s},top_k:a});return J(c)}),e.registerTool("nodata_read",{description:"Read governed data within this agent's grant. You may only request columns your grant allows \u2014 denied columns never decrypt server-side, and every read emits a cryptographic receipt. This tool is hard-scoped to the grant token this server was started with.",inputSchema:{table:g.string().describe("Table to read (must be in your grant)"),columns:g.array(g.string()).describe("Columns to read (must be in your grant)"),where:g.record(g.string(),g.union([g.string(),g.number(),g.boolean()])).optional(),limit:g.number().optional().describe("Max rows (default 50, max 200)")}},async({table:o,columns:i,where:s,limit:a})=>{if(!r)return{content:[{type:"text",text:"Error: could not derive agent handle from grant token."}],isError:!0};let c=await Y(t,n,`/api/agents/${encodeURIComponent(r)}/read`,{table:o,columns:i,where:s,limit:a});return J(c)}),e.registerTool("nodata_use",{description:"Invoke a pre-registered capability (deploy, send, charge, query, \u2026) WITHOUT receiving the secret. The Capsule injects the sealed credential server-side and returns only the result. You may invoke only capabilities your grant allows; the secret never reaches you. Hard-scoped to the grant token this server was started with.",inputSchema:{capability:g.string().describe("Capability name to invoke (must be in your grant, e.g. 'deploy-prod')"),params:g.record(g.string(),g.unknown()).optional().describe("Allowlisted params; unknown keys are dropped server-side"),resource_key:g.string().optional().describe("Optional folder/resource the action targets (enforced against corpus scope)")}},async({capability:o,params:i,resource_key:s})=>{if(!r)return{content:[{type:"text",text:"Error: could not derive agent handle from grant token."}],isError:!0};let a=await Y(t,n,`/api/agents/${encodeURIComponent(r)}/use`,{capability:o,params:i,resource_key:s});return J(a)}),e.registerTool("nodata_code_advise",{description:"Ask the blind code advisor to diagnose/fix a bug in a code capsule WITHOUT seeing its source. You receive guidance + a targeted diff + an exposure proof (source never left the boundary); the source is never returned to you. Requires the capsule owner to have granted this agent (scope.fabric_developers). Hard-scoped to this server's grant token.",inputSchema:{capsule_id:g.string().describe("The code capsule to advise on (you must be granted on it)"),question:g.string().optional().describe("What to fix / improve, in natural language"),note:g.string().optional().describe("Extra context for the advisor"),error:g.object({message:g.string().optional(),stack:g.string().optional(),kind:g.string().optional()}).optional().describe("An error the code produced, to guide the fix"),steer:g.string().optional().describe("A steer on a refine turn (e.g. 'no, round half-up')"),prior_diff:g.string().optional().describe("The previously proposed diff, to refine")}},async({capsule_id:o,question:i,note:s,error:a,steer:c,prior_diff:l})=>{if(!r)return{content:[{type:"text",text:"Error: could not derive agent handle from grant token."}],isError:!0};let d=await Y(t,n,`/api/agents/${encodeURIComponent(r)}/code-capsule/${encodeURIComponent(o)}/advise`,{question:i,note:s,error:a,steer:c,prior_diff:l});return J(d)}),e.registerTool("nodata_code_patch",{description:"Submit a fix to a code capsule as a SIGNED, queued patch WITHOUT seeing its source. Provide a raw unified `diff`, or a whole-file `replace` ({path, content}) that is diffed server-side against the sealed source. The source is never persisted or returned; you get back a patch id, the diff hash, and a receipt. Requires a capsule grant (scope.fabric_developers). Hard-scoped to this server's grant token.",inputSchema:{capsule_id:g.string().describe("The code capsule to patch (you must be granted on it)"),summary:g.string().optional().describe("Short human-readable summary of the fix"),diff:g.string().optional().describe("A raw unified diff (advanced)"),replace:g.object({path:g.string(),content:g.string()}).optional().describe("Whole-file replacement; the diff is synthesized server-side against sealed source")}},async({capsule_id:o,summary:i,diff:s,replace:a})=>{if(!r)return{content:[{type:"text",text:"Error: could not derive agent handle from grant token."}],isError:!0};let c=await Y(t,n,`/api/agents/${encodeURIComponent(r)}/code-capsule/${encodeURIComponent(o)}/patch`,{summary:i,diff:s,replace:a});return J(c)})}var Vl=`WHAT NODATA DOES \u2014 in one line:
   Give any agent real power over your data, without the power to leak it.
   (Possession is not permission: it can hold the key and still not read what you didn't allow.)
-`,Zg=`TURN THE DATA TOOLS ON \u2014 3 steps, about a minute, once:
+`,ey=`TURN THE DATA TOOLS ON \u2014 3 steps, about a minute, once:
 
   1. GET A KEY   call  nodata_connect  (no arguments)
                  -> opens the signup in your browser: email + company (~30s), a 12-word
@@ -183,7 +184,7 @@ Ask the user to add them to that file themselves (not in this chat), then call t
   3. ACTIVATE    type  /mcp  (or restart Claude Code) so the tools load.
 
 COMING BACK LATER? Nothing to redo \u2014 it starts ready. If the tools look missing, just /mcp.
-`,Qg=`YOUR WORKSPACE \u2014 say it in plain words; anything that changes files or policy asks you first:
+`,ty=`YOUR WORKSPACE \u2014 say it in plain words; anything that changes files or policy asks you first:
 
   1. SEE       "scan <folder>"            -> nodata_scan_folder: the whole result + a full HTML report,
                                             on this machine, nothing uploads.
@@ -199,32 +200,32 @@ COMING BACK LATER? Nothing to redo \u2014 it starts ready. If the tools look mis
 
 Database tables: nodata_register_table + nodata_connect_source, then nodata_grant.
 One secret value: nodata_encrypt, hand it over once: nodata_deliver.
-`,ey=`WHAT YOU CAN DO \u2014 scoped to your grant; you reach only what it allows, the rest never decrypts:
+`,ny=`WHAT YOU CAN DO \u2014 scoped to your grant; you reach only what it allows, the rest never decrypts:
 
   1. PLAN   nodata_decide     "may I reach X?" -> allow / partial / deny + a signed proof. No data moves.
   2. PULL   nodata_retrieve   prompt-ready context, allowed fields only, with a receipt.
             (nodata_read for raw governed rows.)
   3. ACT    nodata_use        run a capability with a secret injected server-side \u2014 you never see it.
-`,Vl=`STUCK? There's always a next step:
+`,Gl=`STUCK? There's always a next step:
   - Don't see the nodata_* tools? They load when the client starts \u2014 type  /mcp  or restart.
     (Expected, not an error.)
   - No MCP at all? The same governance runs from one curl, or the guided page:
     https://www.nodatacapsule.com/developers/get-started
-`;function Gl(e){return e==="setup"?`You're connected to NoData \u2014 but there's NO key yet, so the data tools are still off.
+`;function Wl(e){return e==="setup"?`You're connected to NoData \u2014 but there's NO key yet, so the data tools are still off.
 
 `:e==="agent"?`You're connected to NoData, scoped to one grant token.
 
 `:`You're connected to NoData (admin mode). You don't memorize commands \u2014 just ask in plain words.
 
-`}function ty(e){return(e!=="agent"&&!Gt()?`FIRST \u2014 NoData's terms of use (updated for AI agents) are not accepted on this machine yet. Call nodata_terms to show them; the data tools start once the user accepts.
+`}function ry(e){return(e!=="agent"&&!Wt()?`FIRST \u2014 NoData's terms of use (updated for AI agents) are not accepted on this machine yet. Call nodata_terms to show them; the data tools start once the user accepts.
 
-`:"")+ny(e)}function ny(e){if(e==="setup")return Gl(e)+Ul+`
-`+Zg+`
-`+Vl;let t=e==="agent"?ey:Qg;return Gl(e)+Ul+`
+`:"")+oy(e)}function oy(e){if(e==="setup")return Wl(e)+Vl+`
+`+ey+`
+`+Gl;let t=e==="agent"?ny:ty;return Wl(e)+Vl+`
 `+t+`
-`+Vl}function ry(e,t){e.registerTool("nodata_get_started",{description:"Call this FIRST (no arguments). NoData in one line: what you can achieve \u2014 an agent that cannot leak, a look at what is already exposed, a secret we cannot read \u2014 with the single next step for each, and how to recover if the tools or MCP seem stuck. If the user asks what NoData can do, how to start, or why the tools are missing, call this and relay it.",inputSchema:{}},async()=>({content:[{type:"text",text:ty(t)}]}))}var oy="/capsule-api/register";function iy(e){let t=process.platform==="win32",n=process.platform==="darwin"?"open":t?"cmd":"xdg-open",r=t?["/c","start","",e]:[e];try{let o=Ng(n,r,{stdio:"ignore",detached:!0});return o.on("error",()=>{}),o.unref(),!0}catch{return!1}}function sy(e,t){e.registerTool("nodata_connect",{description:"Switch NoData's data tools on. Step 1: call with NO arguments to open the free signup in a browser (email + company, ~30s \u2014 also where your 12-word recovery phrase + email verification happen); it shows an ORG KEY once. Step 2: call this tool again with that key as `api_key` and it is saved on this machine, so every later start comes up ready with nothing to retype. Step 3: type /mcp (or restart) so the client loads the tools.",inputSchema:{api_key:g.string().optional().describe("The org key shown once at signup (ndp_\u2026 or sk_\u2026). Omit on the first call to open signup.")}},async({api_key:n})=>{let r=(n??"").trim();if(!r){let u=t+oy;return{content:[{type:"text",text:(iy(u)?`STEP 1 of 3 \u2014 opened the NoData signup in your browser:
+`+Gl}function iy(e,t){e.registerTool("nodata_get_started",{description:"Call this FIRST (no arguments). NoData in one line: what you can achieve \u2014 an agent that cannot leak, a look at what is already exposed, a secret we cannot read \u2014 with the single next step for each, and how to recover if the tools or MCP seem stuck. If the user asks what NoData can do, how to start, or why the tools are missing, call this and relay it.",inputSchema:{}},async()=>({content:[{type:"text",text:ry(t)}]}))}var sy="/capsule-api/register";function ay(e){let t=process.platform==="win32",n=process.platform==="darwin"?"open":t?"cmd":"xdg-open",r=t?["/c","start","",e]:[e];try{let o=jg(n,r,{stdio:"ignore",detached:!0});return o.on("error",()=>{}),o.unref(),!0}catch{return!1}}function cy(e,t){e.registerTool("nodata_connect",{description:"Switch NoData's data tools on. Step 1: call with NO arguments to open the free signup in a browser (email + company, ~30s \u2014 also where your 12-word recovery phrase + email verification happen); it shows an ORG KEY once. Step 2: call this tool again with that key as `api_key` and it is saved on this machine, so every later start comes up ready with nothing to retype. Step 3: type /mcp (or restart) so the client loads the tools.",inputSchema:{api_key:g.string().optional().describe("The org key shown once at signup (ndp_\u2026 or sk_\u2026). Omit on the first call to open signup.")}},async({api_key:n})=>{let r=(n??"").trim();if(!r){let d=t+sy;return{content:[{type:"text",text:(ay(d)?`STEP 1 of 3 \u2014 opened the NoData signup in your browser:
   `:`STEP 1 of 3 \u2014 open the NoData signup in your browser:
-  `)+u+`
+  `)+d+`
 
 There, about a minute:
   - email + company (a personal email is fine for the sandbox)
@@ -234,22 +235,23 @@ There, about a minute:
 STEP 2 \u2014 come back and call this tool again with the key:
   nodata_connect  api_key: "<the key you copied>"
 and I'll save it so you never paste it again. (Then STEP 3: type /mcp to activate.)`}]}}if(!/^(ndp_|sk_)/.test(r))return{content:[{type:"text",text:`That doesn't look like a NoData org key (it should start with ndp_ or sk_).
-Copy the key shown once on the signup page and try again: nodata_connect api_key: "ndp_\u2026".`}]};let{publicKeyHex:o,privateKeyPkcs8B64:i}=Vg(),s=Wg(),a=zl()||"this device",c=await zg(t,r,s,a,o);if(c.ok){try{Fl({device:{org_id:c.orgId,handle:s,label:a,private_key_pkcs8_b64:i,public_key_hex:o},base_url:t})}catch(u){return{content:[{type:"text",text:"Enrolled the device, but couldn't save it locally: "+(u instanceof Error?u.message:String(u))}]}}return{content:[{type:"text",text:`STEP 2 done \u2014 this device is enrolled as "${a}" (${s}), and only its PRIVATE key is
+Copy the key shown once on the signup page and try again: nodata_connect api_key: "ndp_\u2026".`}]};let{publicKeyHex:o,privateKeyPkcs8B64:i}=Wg(),s=qg(),a=ql()||"this device",c=await Jg(t,r,s,a,o);if(c.ok){try{Ml({device:{org_id:c.orgId,handle:s,label:a,private_key_pkcs8_b64:i,public_key_hex:o},base_url:t})}catch(d){return{content:[{type:"text",text:"Enrolled the device, but couldn't save it locally: "+(d instanceof Error?d.message:String(d))}]}}return{content:[{type:"text",text:`STEP 2 done \u2014 this device is enrolled as "${a}" (${s}), and only its PRIVATE key is
 saved at ~/.nodata/credentials.json (readable only by you). The org key you pasted was NOT
 stored: every start now proves possession by signing a fresh challenge and gets a 15-minute token.
 
-STEP 3 \u2014 type /mcp (or restart Claude Code) and the admin tools appear. Next time: nothing to do.`}]}}let l=c.status===404||c.status===0;try{Fl({api_key:r,key_prefix:r.slice(0,12),base_url:t})}catch(u){return{content:[{type:"text",text:"Couldn't save locally: "+(u instanceof Error?u.message:String(u))+`
+STEP 3 \u2014 type /mcp (or restart Claude Code) and the admin tools appear. Next time: nothing to do.`}]}}let l=c.status===404||c.status===0;try{Ml({api_key:r,key_prefix:r.slice(0,12),base_url:t})}catch(d){return{content:[{type:"text",text:"Couldn't save locally: "+(d instanceof Error?d.message:String(d))+`
 As a fallback, pass it on launch: claude mcp add nodata --env NODATA_API_KEY=<your key> -- npx @nodatachat/mcp`}]}}return{content:[{type:"text",text:(l?`STEP 2 done \u2014 saved your key on this machine (device attestation isn't available on this
 server yet, so this is the key-at-rest path). `:`STEP 2 done \u2014 saved your key on this machine (device enrollment didn't succeed: ${c.error}). `)+`Every future start loads it automatically \u2014 no re-register, no re-paste.
 
-STEP 3 \u2014 type /mcp (or restart Claude Code) and the admin tools appear. Next time: nothing to do.`}]}})}var ay=["NoData guards this machine's data files. For ANY work on a user's data file (xlsx, xls, csv, tsv, docx, pptx, pdf, json, txt \u2026), by default and without being asked:","1. Scan first \u2014 nodata_scan_folder (a file or a folder). Report counts, not values.","2. To clean, anonymise, redact, mask or share a file \u2014 use nodata_redact. Never write your own script for this: nodata_redact checks every hidden value against the copy, removes a copy that is not clean, and records a proof with a link.","3. Work, analyse and answer from the clean copy. Do not open the original directly; if the read gate asks, suggest the clean copy first.","4. After a scan, offer nodata_plan (a recommended policy the user approves) \u2014 locking what should be locked with nodata_protect.","5. On screen: totals, counts, groupings \u2014 never names, ID / policy / account numbers or other individual values unless the user explicitly asks."].join(`
-`);function cy(){let e=$r(),t=Gt(),n=yn(),r=[];return t||r.push("the terms are not accepted yet \u2014 data tools are held (offer nodata_terms)"),e||r.push("the read gate is off \u2014 offer that the user run `npx -y @nodatachat/mcp@latest install-gate` in their terminal, then restart"),ut()||r.push("no language chosen \u2014 ask: \u05E2\u05D1\u05E8\u05D9\u05EA or English (nodata_terms takes `language`)"),pt()&&r.push(`the device key has no confirmed backup \u2014 ${ft()}`),[`NoData status on this machine: read gate ${e??"OFF"} \xB7 terms ${t?"accepted":"NOT accepted"} \xB7 language ${De()}${ut()?"":" (not chosen)"} \xB7 node ${n?"registered":"not registered"}.`,"At the START of your first reply in this session, tell the user in ONE short line that NoData guards their data files on this machine (scan, clean copy with proof, lock), and its status."+(r.length?` Then offer to turn on what is off: ${r.join("; ")}.`:" Everything is on \u2014 say so."),"The first time you lock or share something, say in ONE sentence what a capsule is: a file sealed so it opens only under its own policy \u2014 on this machine only (nodata_protect \u2192 .ndc), as a governed link with expiry and revoke (nodata_send), or to the organisation's key (nodata_wrap). Secrets for commands go through the vault (nodata_run), never into a file or the chat."].join(`
-`)}async function ly(){ml();let e=process.argv[2];if(e==="gate")return el(process.argv.slice(3));if(e==="install-gate"||e==="uninstall-gate"){let h=Ci([]),_=h.device?Hl(h.baseUrl,h.device):h.apiKey||null,y=_?{baseUrl:h.baseUrl,org:h.device?.org_id??null,token:Kl(_)}:null,k=process.argv.includes("--block"),E=e==="install-gate"?ol(new URL("./gate.js",import.meta.url),k):il(),R=await Wt(y,e==="install-gate"?"read-gate-install":"read-gate-uninstall",Ei("cli",h.device?.label),k?"block":"ask");process.stdout.write(E+(R?`
-Recorded at NoData for your organisation (operational only)${typeof R=="string"?` \u2014 proof: ${R}`:""}.`:"")+`
-`);return}if(e==="key-backed-up"){process.stdout.write(ra()+`
-`);return}if(e==="lang"){process.stdout.write(Hs(process.argv[3])+`
-`);return}if(e==="secrets-login"||e==="secrets-logout"){let h=e==="secrets-login"?await El(process.argv.slice(3),Ci([]).baseUrl):xl();process.stdout.write(h+`
-`);return}let{apiKey:t,grantToken:n,baseUrl:r,credentialSource:o,device:i}=Ci(process.argv.slice(2)),s=n?"agent":t||i?"admin":"setup",a=new Rg({name:s==="agent"?"NoData (agent-scoped)":s==="setup"?"NoData (setup)":"NoData",version:xn},{instructions:[Ks(),s==="agent"?"":cy(),s==="agent"?"":ay].filter(Boolean).join(`
-
-`)}),c=()=>Ei(a.server.getClientVersion()?.name,i?.label),l=()=>`${Il(c())} \xB7 `+(i?`device "${i.label}" (${i.handle}) \xB7 org ${i.org_id}`:t?`org key ${t.slice(0,12)}\u2026`:"not connected \u2014 local only"),u=i?Hl(r,i):t||null,p=u?{baseUrl:r,org:i?.org_id??null,token:Kl(u)}:null;if(s!=="agent"&&(Xs(a,p,c,`${r}/terms`),Zs(a),p&&Ys(p)),s!=="agent"&&kl(a,{version:xn,agent:c,who:l,org:i&&p?{id:i.org_id,baseUrl:r,token:p.token}:null,ack:h=>Wt(p,"capsule-node-register",c(),h)}),wi({version:xn,agent:c}),u){Yg(a,r,u,l),Hc(a,r,async()=>{let _=await An(u);if("error"in _)throw new Error("no usable org credential \u2014 run nodata_connect");return _.token},l);let h=async(_,y,k)=>{let E=await An(u);if("error"in E)return{status:401,body:{error:"no usable org credential \u2014 run nodata_connect"}};let R=await fetch(`${r}${y}`,{method:_,headers:{authorization:`Bearer ${E.token}`,...k?{"content-type":"application/json"}:{}},...k?{body:JSON.stringify(k)}:{}});return{status:R.status,body:await R.json().catch(()=>({}))}};Bl(a,{get:_=>h("GET",_),post:(_,y)=>h("POST",_,y)},()=>Ll(i?.private_key_pkcs8_b64,i?.label),l)}n&&Xg(a,r,n),ry(a,s),s!=="agent"&&Sa(a,l,h=>Wt(p,"policy-apply",c(),h)),s!=="agent"&&Al(a,{who:l,ack:h=>Wt(p,"secrets-run",c(),h)}),s==="setup"?(sy(a,r),console.error(`nodata-mcp: no credential given \u2014 running in setup mode (data tools disabled).
-Call nodata_connect (opens signup, enrolls this device), or pass --api-key / --grant-token. See --help.`)):i?console.error(`nodata-mcp: loaded device identity "${i.label}" (${i.handle}) \u2014 attest mode; tokens are minted per session.`):o==="stored"&&console.error("nodata-mcp: loaded saved credential from ~/.nodata/credentials.json (admin mode).");let f=new Dg;await a.connect(f)}ly().catch(e=>{console.error("Fatal error:",e),process.exit(1)});
+STEP 3 \u2014 type /mcp (or restart Claude Code) and the admin tools appear. Next time: nothing to do.`}]}})}var ly=["NoData guards this machine's data files. For ANY work on a user's data file (xlsx, xls, csv, tsv, docx, pptx, pdf, json, txt \u2026), by default and without being asked:","1. Scan first \u2014 nodata_scan_folder (a file or a folder). Report counts, not values.","2. To clean, anonymise, redact, mask or share a file \u2014 use nodata_redact. Never write your own script for this: nodata_redact checks every hidden value against the copy, removes a copy that is not clean, and records a proof with a link.","3. Work, analyse and answer from the clean copy. Do not open the original directly; if the read gate asks, suggest the clean copy first.","4. After a scan, offer nodata_plan (a recommended policy the user approves) \u2014 locking what should be locked with nodata_protect.","5. On screen: totals, counts, groupings \u2014 never names, ID / policy / account numbers or other individual values unless the user explicitly asks.",`6. "0 findings" is only clean if the scan could read the file. A scan's COVERAGE lists documents it could NOT read \u2014 say so plainly, never call them clean, and offer to lock them.`].join(`
+`),dy=["When the user asks what NoData is, does or can do:","- Answer from what is loaded and working in THIS session: the nodata_* tools you have and the status line above. Describe what each does in plain words.",'- No roadmap, no plans, no internal known issues, no numbers you did not just measure with a tool. If asked for something no tool here does: "not available in this version" \u2014 nothing more.',`- Never promise beyond the tool's own description (e.g. do not say a file "can never be opened" or is "anchored on a blockchain" unless a tool result here says so).`].join(`
+`);function uy(){let e=Rr(),t=Wt(),n=bn(),r=[];return t||r.push("the terms are not accepted yet \u2014 data tools are held (offer nodata_terms)"),e||r.push("the read gate is off \u2014 offer that the user run `npx -y @nodatachat/mcp@latest install-gate` in their terminal, then restart"),ft()||r.push("no language chosen \u2014 ask: \u05E2\u05D1\u05E8\u05D9\u05EA or English (nodata_terms takes `language`)"),qe()&&r.push(`the device key has no confirmed backup \u2014 ${Je()}`),[`NoData status on this machine: read gate ${e??"OFF"} \xB7 terms ${t?"accepted":"NOT accepted"} \xB7 language ${De()}${ft()?"":" (not chosen)"} \xB7 node ${n?"registered":"not registered"}.`,"At the START of your first reply in this session, tell the user in ONE short line that NoData guards their data files on this machine (scan, clean copy with proof, lock), and its status."+(r.length?` Then offer to turn on what is off: ${r.join("; ")}.`:" Everything is on \u2014 say so."),"The first time you lock or share something, say in ONE sentence what a capsule is: a file sealed so it opens only under its own policy \u2014 on this machine only (nodata_protect \u2192 .ndc), as a governed link with expiry and revoke (nodata_send), or to the organisation's key (nodata_wrap). Secrets for commands go through the vault (nodata_run), never into a file or the chat."].join(`
+`)}async function py(){gl();let e=process.argv[2];if(e==="gate")return tl(process.argv.slice(3));if(e==="install-gate"||e==="uninstall-gate"){let h=Oi([]),y=h.device?Ul(h.baseUrl,h.device):h.apiKey||null,_=y?{baseUrl:h.baseUrl,org:h.device?.org_id??null,token:Hl(y)}:null,S=process.argv.includes("--block"),E=e==="install-gate"?il(new URL("./gate.js",import.meta.url),S):sl(),P=await zt(_,e==="install-gate"?"read-gate-install":"read-gate-uninstall",Ai("cli",h.device?.label),S?"block":"ask");process.stdout.write(E+(P?`
+Recorded at NoData for your organisation (operational only)${typeof P=="string"?` \u2014 proof: ${P}`:""}.`:"")+`
+`);return}if(e==="key-backed-up"){process.stdout.write(oa()+`
+`);return}if(e==="lang"){process.stdout.write(Us(process.argv[3])+`
+`);return}if(e==="secrets-login"||e==="secrets-logout"){let h=e==="secrets-login"?await xl(process.argv.slice(3),Oi([]).baseUrl):Al();process.stdout.write(h+`
+`);return}let{apiKey:t,grantToken:n,baseUrl:r,credentialSource:o,device:i}=Oi(process.argv.slice(2)),s=n?"agent":t||i?"admin":"setup",a=new Cg({name:s==="agent"?"NoData (agent-scoped)":s==="setup"?"NoData (setup)":"NoData",version:Tn},{instructions:[Hs(),s==="agent"?"":uy(),s==="agent"?"":ly,dy].filter(Boolean).join(`
+
+`)}),c=()=>Ai(a.server.getClientVersion()?.name,i?.label),l=()=>`${$l(c())} \xB7 `+(i?`device "${i.label}" (${i.handle}) \xB7 org ${i.org_id}`:t?`org key ${t.slice(0,12)}\u2026`:"not connected \u2014 local only"),d=i?Ul(r,i):t||null,p=d?{baseUrl:r,org:i?.org_id??null,token:Hl(d)}:null;if(s!=="agent"&&(Zs(a,p,c,`${r}/terms`),Qs(a),p&&Xs(p)),s!=="agent"&&wl(a,{version:Tn,agent:c,who:l,org:i&&p?{id:i.org_id,baseUrl:r,token:p.token}:null,ack:h=>zt(p,"capsule-node-register",c(),h)}),Ei({version:Tn,agent:c}),d){Zg(a,r,d,l),Uc(a,r,async()=>{let y=await In(d);if("error"in y)throw new Error("no usable org credential \u2014 run nodata_connect");return y.token},l);let h=async(y,_,S)=>{let E=await In(d);if("error"in E)return{status:401,body:{error:"no usable org credential \u2014 run nodata_connect"}};let P=await fetch(`${r}${_}`,{method:y,headers:{authorization:`Bearer ${E.token}`,...S?{"content-type":"application/json"}:{}},...S?{body:JSON.stringify(S)}:{}});return{status:P.status,body:await P.json().catch(()=>({}))}};Fl(a,{get:y=>h("GET",y),post:(y,_)=>h("POST",y,_)},()=>Bl(i?.private_key_pkcs8_b64,i?.label),l)}n&&Qg(a,r,n),iy(a,s),s!=="agent"&&Ea(a,l,h=>zt(p,"policy-apply",c(),h)),s!=="agent"&&Tl(a,{who:l,ack:h=>zt(p,"secrets-run",c(),h)}),s==="setup"?(cy(a,r),console.error(`nodata-mcp: no credential given \u2014 running in setup mode (data tools disabled).
+Call nodata_connect (opens signup, enrolls this device), or pass --api-key / --grant-token. See --help.`)):i?console.error(`nodata-mcp: loaded device identity "${i.label}" (${i.handle}) \u2014 attest mode; tokens are minted per session.`):o==="stored"&&console.error("nodata-mcp: loaded saved credential from ~/.nodata/credentials.json (admin mode).");let f=new Ng;await a.connect(f)}py().catch(e=>{console.error("Fatal error:",e),process.exit(1)});