npm - @nodatachat/mcp - Versions diffs - 1.5.0 → 1.5.1 - Mend

@nodatachat/mcp 1.5.0 → 1.5.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (4) hide show

package/dist/gate.js CHANGED Viewed

@@ -1,4 +1,4 @@
-/*! @nodatachat/mcp 1.5.0 | Copyright 2026 Capsule Ltd. | FSL-1.1-ALv2 | see LICENSE.md */
+/*! @nodatachat/mcp 1.5.1 | Copyright 2026 Capsule Ltd. | FSL-1.1-ALv2 | see LICENSE.md */
 import{appendFileSync as to,copyFileSync as pd,existsSync as ur,mkdirSync as no,readdirSync as ro,readFileSync as io,statSync as Wt,writeFileSync as hd}from"node:fs";import{homedir as se}from"node:os";import{basename as Gt,extname as fr,isAbsolute as oe,join as tt,relative as so,resolve as C}from"node:path";import{TextDecoder as Nn}from"node:util";var P={text:[],header:[],secrets:[],table:null,amounts:null,severity:null};function ut(e){e.table&&(P.table=e.table),e.severity&&(P.severity=e.severity),e.amounts&&(P.amounts=e.amounts);for(let t of e.text??[])P.text.some(r=>r.kind===t.kind)||P.text.push(t);e.header&&!P.header.includes(e.header)&&P.header.push(e.header);for(let t of e.secrets??[])P.secrets.some(r=>r.id===t.id)||P.secrets.push(t)}function ft(){return P.amounts?.()===!0}function Ee(){return P.text}function Xt(){return P.header}function ue(){return P.table}function Jt(){return P.secrets}var Ae=[{id:"aws-access-key",name:"AWS Access Key",pattern:/(?:^|[^A-Z0-9])AKIA[A-Z2-7]{16}(?:[^A-Z2-7]|$)/,severity:"critical"},{id:"aws-secret-key",name:"AWS Secret Key",pattern:/(?:aws_secret_access_key|aws_secret_key|secret_access_key)\s*[=:]\s*['"]?[A-Za-z0-9/+=]{40}['"]?/,severity:"critical"},{id:"gcp-api-key",name:"GCP API Key",pattern:/AIza[0-9A-Za-z_-]{35}/,severity:"critical"},{id:"gcp-service-account",name:"GCP Service Account",pattern:/"type"\s*:\s*"service_account"/,severity:"critical"},{id:"github-token",name:"GitHub Token",pattern:/gh[pousr]_[0-9a-zA-Z]{36,}/,severity:"critical"},{id:"github-fine-grained",name:"GitHub Fine-Grained Token",pattern:/github_pat_[0-9a-zA-Z_]{22,}/,severity:"critical"},{id:"gitlab-token",name:"GitLab Token",pattern:/glpat-[0-9a-zA-Z_-]{20,}/,severity:"critical"},{id:"stripe-secret",name:"Stripe Secret Key",pattern:/sk_live_[0-9a-zA-Z]{24,}/,severity:"critical"},{id:"stripe-restricted",name:"Stripe Restricted Key",pattern:/rk_live_[0-9a-zA-Z]{24,}/,severity:"critical"},{id:"slack-token",name:"Slack Token",pattern:/xox[baprs]-[0-9a-zA-Z-]{10,}/,severity:"high"},{id:"slack-webhook",name:"Slack Webhook",pattern:/hooks\.slack\.com\/services\/T[0-9A-Z]{8,}\/B[0-9A-Z]{8,}\/[0-9a-zA-Z]{24}/,severity:"high"},{id:"twilio-api-key",name:"Twilio API Key",pattern:/SK[0-9a-fA-F]{32}/,severity:"high"},{id:"sendgrid-api-key",name:"SendGrid API Key",pattern:/SG\.[0-9a-zA-Z_-]{22}\.[0-9a-zA-Z_-]{43}/,severity:"critical"},{id:"postgres-uri",name:"PostgreSQL Connection String",pattern:/postgres(?:ql)?:\/\/[^\s'"]{10,}/,severity:"critical"},{id:"mongodb-uri",name:"MongoDB Connection String",pattern:/mongodb(?:\+srv)?:\/\/[^\s'"]{10,}/,severity:"critical"},{id:"redis-uri",name:"Redis Connection String",pattern:/redis(?:s)?:\/\/[^\s'"]{10,}/,severity:"high"},{id:"openai-key",name:"OpenAI API Key",pattern:/sk-[0-9a-zA-Z]{20,}T3BlbkFJ[0-9a-zA-Z]{20,}/,severity:"critical"},{id:"openai-project-key",name:"OpenAI API Key",pattern:/sk-(?:proj|svcacct|admin)-[0-9A-Za-z_-]{40,}/,severity:"critical"},{id:"anthropic-key",name:"Anthropic API Key",pattern:/sk-ant-[0-9a-zA-Z_-]{40,}/,severity:"critical"},{id:"firebase-key",name:"Firebase API Key",pattern:/AIza[0-9A-Za-z_-]{35}/,severity:"high"},{id:"supabase-key",name:"Supabase Service Key",pattern:/eyJ[0-9a-zA-Z_-]{100,}/,severity:"critical"},{id:"supabase-access-token",name:"Supabase Access Token",pattern:/\bsbp_[0-9a-f]{40}\b/,severity:"critical"},{id:"supabase-secret-key",name:"Supabase Secret Key",pattern:/\bsb_secret_[0-9A-Za-z_-]{20,}/,severity:"critical"},{id:"private-key",name:"Private Key",pattern:/-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/,severity:"critical"},{id:"jwt-secret",name:"JWT/Generic Secret",pattern:/(?:jwt_secret|JWT_SECRET|secret_key|SECRET_KEY|api_secret|API_SECRET)\s*[=:]\s*['"][^'"]{8,}['"]/,severity:"high"},{id:"password-in-code",name:"Password in Code",pattern:/(?:password|passwd|pwd)\s*[=:]\s*['"][^'"]{8,}['"]/,severity:"high"},{id:"bearer-token",name:"Bearer Token in Code",pattern:/['"]Bearer\s+[0-9a-zA-Z._-]{20,}['"]/,severity:"high"}];function fe(){let e=Jt().filter(t=>!Ae.some(r=>r.id===t.id));return[...Ae,...e]}var jr=[{pattern:/^(full_?name|first_?name|last_?name|spouse_?name|beneficiary_?name)$/i,type:"name",label:"Person name"},{pattern:/^(email|e_?mail|email_?address)$/i,type:"email",label:"Email address"},{pattern:/^(phone|mobile|telephone|phone_?number|cell_?phone)$/i,type:"phone",label:"Phone number"},{pattern:/^(id_?number|identity|ssn|social_?security|national_?id|teudat_?zehut)$/i,type:"id",label:"ID number"},{pattern:/^(address|street_?address|home_?address)$/i,type:"address",label:"Address"},{pattern:/^(date_?of_?birth|dob|birth_?date|birthday)$/i,type:"dob",label:"Date of birth"},{pattern:/^(bank_?account|iban|account_?number|bank_?details|routing_?number)$/i,type:"financial",label:"Bank account"},{pattern:/^(credit_?card|card_?number|cvv|cc_?number)$/i,type:"financial",label:"Credit card"},{pattern:/^(salary|income|commission|premium|compensation)$/i,type:"financial",label:"Salary / income"},{pattern:/^(medical_?info|health_?conditions|diagnosis|medication|prescription)$/i,type:"medical",label:"Medical"},{pattern:/^(passport|passport_?number|passport_?id)$/i,type:"id",label:"Passport"},{pattern:/^(driver_?license|drivers_?license|dl_?number)$/i,type:"id",label:"Driver license"},{pattern:/^(tax_?id|tin|vat_?number|ein)$/i,type:"financial",label:"Tax ID"},{pattern:/^(insurance_?number|policy_?number|member_?id)$/i,type:"id",label:"Insurance/Policy"},{pattern:/^(biometric|fingerprint|face_?id|retina)$/i,type:"biometric",label:"Biometric"},{pattern:/^(latitude|longitude|lat|lng|geo_?location|coordinates)$/i,type:"location",label:"Geolocation"}],Mr=[{pattern:/^(?:שם|שם_מלא|שם פרטי|שם_פרטי|שם משפחה|שם_משפחה|שם הלקוח|שם בן זוג|שם המבוטח|שם המוטב|שם הילד|שם הקטין)$/i,type:"name",label:"\u05E9\u05DD \u05D0\u05D3\u05DD"},{pattern:/^(?:ת"ז|ת\.ז|ת ז|תז|תעודת זהות|תעודת_זהות|מספר זהות|מס' זהות|teudat_zehut|tz|israeli_id|il_id)$/i,type:"id",label:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA"},{pattern:/^(?:דרכון|מספר דרכון|רישיון נהיגה|רישיון_נהיגה|רשיון נהיגה)$/i,type:"id",label:"\u05D3\u05E8\u05DB\u05D5\u05DF/\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF"},{pattern:/^(?:מייל|דוא"ל|דוא_ל|דואר אלקטרוני|אימייל|כתובת מייל)$/i,type:"email",label:"\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9"},{pattern:/^(?:טלפון|טל'|נייד|פלאפון|סלולרי|מספר טלפון|טלפון נייד)$/i,type:"phone",label:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF"},{pattern:/^(?:כתובת|כתובת מגורים|רחוב|מס בית|עיר|ישוב|יישוב|מיקוד|כתובת מלאה|מען)$/i,type:"address",label:"\u05DB\u05EA\u05D5\u05D1\u05EA"},{pattern:/^(?:תאריך לידה|ת לידה|תאריך הולדת|יום הולדת|גיל)$/i,type:"dob",label:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"},{pattern:/^(?:חשבון בנק|מספר חשבון|מס חשבון|סניף|iban|iban_il)$/i,type:"financial",label:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7"},{pattern:/^(?:כרטיס אשראי|מספר אשראי|cvv|אשראי)$/i,type:"financial",label:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"},{pattern:/^(?:שכר|משכורת|הכנסה|פרמיה|שכר ברוטו|שכר נטו|תגמול|בונוס|פיצוי)$/i,type:"financial",label:"\u05E9\u05DB\u05E8/\u05D4\u05DB\u05E0\u05E1\u05D4"},{pattern:/^(?:אבחון|אבחנה|מחלה|תרופה|מרשם|בדיקה רפואית|מצב רפואי|חיסון|רגישות|אלרגיה|סוג דם)$/i,type:"medical",label:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(?:מספר פוליסה|מס פוליסה|פוליסה|מספר חבר|מספר ביטוח)$/i,type:"id",label:"\u05E4\u05D5\u05DC\u05D9\u05E1\u05D4/\u05D7\u05D1\u05E8\u05D5\u05EA"},{pattern:/^(?:שם הילד|תעודת זהות של ילד|ילדים|קטין|מספר ילדים|תעודת לידה)$/i,type:"minor_data",label:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05DF"},{pattern:/^(?:דת|לאום|מין|נטייה מינית|השקפה פוליטית|מצב משפחתי|עדה|מוצא)$/i,type:"sensitive_personal",label:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9"},{pattern:/^(?:מספר רכב|מס רכב|לוחית רישוי|מספר רישוי)$/i,type:"tracking",label:"\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"}],Hr=/^(id|uuid|created_?at|updated_?at|deleted_?at|status|type|category|description|title|slug|url|path|key|value|enabled|active|public|version|metadata|config|settings|data|content|note|comment|label|color|icon)$/i,Ur=/^שם[ _](?:ה)?(?:קובץ|מוצר|פריט|חברה|ארגון|עסק|פרויקט|גיליון|טבלה|שדה|קטגוריה|סניף|בנק|עיר|רחוב|ישוב|יישוב|מסמך|תוכנית|חבילה|קורס|מחלקה|אתר|דומיין|מותג|ספק|שירות|תפקיד)$|^(file|product|item|company|org|organization|project|sheet|table|field|category|branch|bank|city|street|document|plan|course|department|site|domain|brand|vendor|service|role)[ _-]?name$/i;function pe(e){if(!e)return null;let t=e.trim();if(Hr.test(t)||/^name$/i.test(t)||/^\[[A-Z_]+(?:-\d+)?\]$/.test(t))return null;let r=t.replace(/[\s-]+/g,"_");for(let n of[...Mr,...jr])if(n.pattern.test(t)||n.pattern.test(r))return{type:n.type,label:n.label};if(Ur.test(t))return null;if(/^שם[ _][\u0590-\u05FF"'׳ ]{2,20}$/.test(t))return{type:"name",label:"\u05E9\u05DD \u05D0\u05D3\u05DD"};if(/^(customer|client|employee|inspector|supervisor|contact|person|patient|user|owner|manager|agent|member|driver|tenant|student|parent|beneficiary|insured)_?(full_?)?name$/i.test(r))return{type:"name",label:"Person name"};for(let n of Xt()){let i=n(t);if(i)return{type:i.type,label:i.label}}return null}function qt(e){let t=String(e??"").replace(/\D/g,"");if(t.length===0||t.length>9)return!1;let r=t.padStart(9,"0"),n=0;for(let i=0;i<9;i++){let s=parseInt(r[i]??"0",10)*(i%2+1);s>9&&(s-=9),n+=s}return n%10===0&&parseInt(r,10)>0}function Br(e){let t=String(e??"").replace(/\D/g,"");if(t.length<12||t.length>19)return!1;let r=0,n=!1;for(let i=t.length-1;i>=0;i-=1){let s=parseInt(t[i]??"0",10);n&&(s*=2,s>9&&(s-=9)),r+=s,n=!n}return r%10===0}function zr(e){let t=String(e??"").replace(/\s/g,"").toUpperCase();if(!/^[A-Z]{2}\d{2}[A-Z0-9]{10,30}$/.test(t))return!1;let r=t.slice(4)+t.slice(0,4),n=0;for(let i of r){let s=i>="A"&&i<="Z"?String(i.charCodeAt(0)-55):i;for(let o of s)n=(n*10+Number(o))%97}return n===1}var pt="(?<!\\d)(?<!\\d[.,])",ht="(?!\\d)(?![.,]\\d)",Yt=[{subkind:"israeli_id",severity:"high",pattern:new RegExp(`${pt}\\d{9}${ht}`,"g"),validate:qt,hint:"Israeli national ID (check digit verified) in plaintext. Encrypt the column or mask it at rest."},{subkind:"credit_card",severity:"critical",pattern:new RegExp(`${pt}[2-6][ -]?(?:\\d[ -]?){11,17}\\d${ht}`,"g"),validate:Br,hint:"Payment card number (Luhn verified) in plaintext. This is PCI scope."},{subkind:"iban",severity:"high",pattern:/\b[A-Z]{2}\d{2}(?: ?[A-Z0-9]{4}){2,7}(?: ?[A-Z0-9]{1,4})?\b/g,validate:zr,hint:"Bank account in IBAN form (mod-97 verified) in plaintext."},{subkind:"israeli_phone",severity:"medium",pattern:new RegExp(`${pt}(?:\\+972[- ]?|0)(?:[57]\\d|[2-489])[- ]?\\d{3}[- ]?\\d{4}${ht}`,"g"),validate:e=>{let t=e.replace(/\D/g,"").replace(/^972/,"0");return/^0[57]\d{8}$/.test(t)?!0:/^0[2-489]\d{7}$/.test(t)&&(/[- ]/.test(e)||e.startsWith("+972"))},hint:"Israeli phone number in plaintext."}];function Ie(e,t){let r=[],n="",i=!1;for(let s=0;s<e.length;s++){let o=e[s];i?o==='"'&&e[s+1]==='"'?(n+='"',s++):o==='"'?i=!1:n+=o:o==='"'?i=!0:o===t?(r.push(n),n=""):n+=o}return r.push(n),r}import{inflateRawSync as Ii}from"node:zlib";import{inflateSync as Wr}from"node:zlib";var $e=new Set([".pdf"]),Qt=8*1024*1024;function rn(e){let t=e.toString("latin1"),r=new Map,n=/(\d+)\s+(\d+)\s+obj\b/g,i;for(;(i=n.exec(t))!==null;){let s=Number(i[1]),o=n.lastIndex,a=t.indexOf("endobj",o);if(a<0)continue;let l=t.indexOf("stream",o),c,u=null;if(l>=0&&l<a){c=t.slice(o,l);let d=l+6;t[d]==="\r"&&(d+=1),t[d]===`
 `&&(d+=1);let f=t.indexOf("endstream",d);f>d&&(u=e.subarray(d,f))}else c=t.slice(o,a);r.set(s,{num:s,dict:c,stream:u})}for(let s of[...r.values()]){if(!s.stream||!/\/Type\s*\/ObjStm\b/.test(s.dict))continue;let o=Te(s),a=Number(/\/N\s+(\d+)/.exec(s.dict)?.[1]??0),l=Number(/\/First\s+(\d+)/.exec(s.dict)?.[1]??-1);if(o===null||!a||l<0)continue;let c=o.slice(0,l).trim().split(/\s+/).map(Number);for(let u=0;u<a;u+=1){let d=c[2*u],f=c[2*u+1];if(d===void 0||f===void 0||Number.isNaN(d)||Number.isNaN(f))break;let h=u+1<a?c[2*(u+1)+1]:void 0,m=o.slice(l+f,h!==void 0?l+h:void 0);r.has(d)||r.set(d,{num:d,dict:m,stream:null})}}return r}function mt(e){let t=[...e.replace(/\s+/g,"")];if(t.length<40)return!1;let r=0,n=0;for(let i of t){let s=i.codePointAt(0)??0;s<32||s>=127&&s<=191||s===65533||s>=57344&&s<=63743?r+=1:/[\p{L}\p{N}]/u.test(i)&&(n+=1)}return r/t.length>.2||n/t.length<.25}function Gr(e){let t=e.toString("latin1").replace(/\s/g,"");t.startsWith("<~")&&(t=t.slice(2));let r=t.indexOf("~>");r>=0&&(t=t.slice(0,r));let n=[],i=0,s=0;for(let o of t){if(o==="z"&&s===0){n.push(0,0,0,0);continue}let a=o.charCodeAt(0)-33;if(a<0||a>84)return null;i=i*85+a,s+=1,s===5&&(n.push(i>>>24&255,i>>>16&255,i>>>8&255,i&255),i=0,s=0)}if(s>0){for(let a=s;a<5;a+=1)i=i*85+84;let o=[i>>>24&255,i>>>16&255,i>>>8&255,i&255];for(let a=0;a<s-1;a+=1)n.push(o[a]??0)}return Buffer.from(n)}function Vr(e){let t=e.toString("latin1").replace(/\s/g,"").split(">")[0]??"",r=t.length%2?t+"0":t;return/^[0-9A-Fa-f]*$/.test(r)?Buffer.from(r,"hex"):null}function Kr(e){let t=/\/Filter\s*(\[[^\]]*\]|\/\w+)/.exec(e);return!t||!t[1]?[]:[...t[1].matchAll(/\/(\w+)/g)].map(r=>r[1]??"")}function Te(e){if(!e.stream)return null;let t=e.stream;for(let r of Kr(e.dict)){let n=null;if(r==="FlateDecode")try{n=Wr(t)}catch{return null}else if(r==="ASCII85Decode")n=Gr(t);else if(r==="ASCIIHexDecode")n=Vr(t);else return null;if(n===null)return null;t=n}return t.toString("latin1")}function Zr(e){let t=new Map,r=1,n=/begincodespacerange([\s\S]*?)endcodespacerange/.exec(e);if(n&&n[1]){let l=/<([0-9A-Fa-f]+)>/.exec(n[1]);l&&l[1]&&l[1].length>=4&&(r=2)}let i=l=>{let c="";for(let u=0;u+3<l.length+1;u+=4){let d=parseInt(l.slice(u,u+4),16);Number.isFinite(d)&&d>0&&(c+=String.fromCharCode(d))}return c},s=/beginbfchar([\s\S]*?)endbfchar/g,o;for(;(o=s.exec(e))!==null;){let l=/<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]*)>/g,c;for(;(c=l.exec(o[1]??""))!==null;)t.set(parseInt(c[1]??"0",16),i(c[2]??""))}let a=/beginbfrange([\s\S]*?)endbfrange/g;for(;(o=a.exec(e))!==null;){let l=o[1]??"",c=/<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]*)>/g,u;for(;(u=c.exec(l))!==null;){let d=parseInt(u[1]??"0",16),f=parseInt(u[2]??"0",16),h=parseInt((u[3]??"0").slice(0,4)||"0",16);if(!(f-d>65535))for(let m=d;m<=f;m+=1)t.set(m,String.fromCharCode(h+(m-d)))}}return{map:t,bytes:r}}function Xr(e){let t=new Map,r=[],n=[];for(let s of e.values()){for(let o of s.dict.matchAll(/\/Font\s*<<([\s\S]*?)>>/g))o[1]&&n.push(o[1]);for(let o of s.dict.matchAll(/\/Font\s+(\d+)\s+\d+\s+R/g)){let a=e.get(Number(o[1]));a&&n.push(a.dict)}}let i=new Set;for(let s of n){let o=/\/([^\s/<>[\]()]+)\s+(\d+)\s+\d+\s+R/g,a;for(;(a=o.exec(s))!==null;){let l=`${a[1]}#${a[2]}`;i.has(l)||(i.add(l),r.push([a[1]??"",Number(a[2])]))}}for(let[s,o]of r){let a=e.get(o);if(!a)continue;let l=null,c=/\/ToUnicode\s+(\d+)\s+\d+\s+R/.exec(a.dict);if(c){let d=e.get(Number(c[1])),f=d?Te(d):null;f&&(l=Zr(f))}if(l||(l=Yr(a.dict,e)),!l)continue;let u=t.get(s)??[];u.push(l),t.set(s,u)}return t}var Jr=["alef","bet","gimel","dalet","he","vav","zayin","het","tet","yod","finalkaf","kaf","lamed","finalmem","mem","finalnun","nun","samekh","ayin","finalpe","pe","finaltsadi","tsadi","qof","resh","shin","tav"];function qr(e){let t=/^uni([0-9A-Fa-f]{4})$/.exec(e)??/^u([0-9A-Fa-f]{4,6})$/.exec(e);if(t)return String.fromCodePoint(parseInt(t[1],16));let r=/^afii(\d{5})$/.exec(e);if(r){let s=Number(r[1]);if(s>=57664&&s<=57690)return String.fromCharCode(1488+(s-57664))}let n=Jr.indexOf(e.replace(/hebrew$/,""));return n>=0?String.fromCharCode(1488+n):e==="space"?" ":/^[A-Za-z]$/.test(e)?e:{zero:"0",one:"1",two:"2",three:"3",four:"4",five:"5",six:"6",seven:"7",eight:"8",nine:"9",period:".",comma:",",hyphen:"-",colon:":",slash:"/",at:"@"}[e]??null}function Yr(e,t){let r=e,n=/\/Encoding\s+(\d+)\s+\d+\s+R/.exec(e);n&&(r=t.get(Number(n[1]))?.dict??"");let i=/\/Differences\s*\[([^\]]*)\]/.exec(r);if(!i?.[1])return null;let s=new Map,o=0;for(let a of i[1].match(/\d+|\/[^\s/[\]]+/g)??[]){if(/^\d+$/.test(a)){o=Number(a);continue}let l=qr(a.slice(1));l!==null&&s.set(o,l),o+=1}return s.size?{map:s,bytes:1}:null}function sn(e){let t=[];for(let r=0;r<e.length;r+=1){let n=e[r];if(n!=="\\"){t.push(n.charCodeAt(0)&255);continue}let i=e[r+1];if(i===void 0)break;if(i>="0"&&i<="7"){let o="",a=r+1;for(;a<e.length&&o.length<3&&e[a]>="0"&&e[a]<="7";)o+=e[a],a+=1;t.push(parseInt(o,8)&255),r=a-1;continue}let s={n:10,r:13,t:9,b:8,f:12};t.push(s[i]??i.charCodeAt(0)&255),r+=1}return t}function on(e){if(e.length<2||e[0]!==254||e[1]!==255)return null;let t="";for(let r=2;r+1<e.length;r+=2)t+=String.fromCharCode((e[r]??0)<<8|(e[r+1]??0));return t}function en(e,t){let r=on(e);if(r!==null)return r;if(!t)return e.map(i=>String.fromCharCode(i)).join("");let n="";if(t.bytes===2)for(let i=0;i+1<e.length;i+=2){let s=(e[i]??0)<<8|(e[i+1]??0);n+=t.map.get(s)??""}else for(let i of e)n+=t.map.get(i)??String.fromCharCode(i);return n}function Qr(e){let t=0;for(let r of e){let n=r.codePointAt(0)??0;/[\p{L}\p{N}]/u.test(r)?t+=1:(n<32||n>=127&&n<=191||n===65533)&&(t-=2)}return t}function tn(e,t){if(!t||t.length<=1)return en(e,t?.[0]);let r="",n=-1/0;for(let i of t){let s=en(e,i),o=Qr(s);o>n&&(r=s,n=o)}return r}function ei(e,t){let r="",n="",i,s=!1,o="",a=0,l=null,c=()=>{n.trim()&&(r+=n+`
 `),n="",a=0},u=()=>{n&&!n.endsWith(" ")&&a>1&&(n+=" ")},d=/\/([^\s/<>[\]()]+)\s+-?[\d.]+\s+Tf|(-?[\d.]+)\s+(-?[\d.]+)\s+T[dD]\b|(?:-?[\d.]+\s+){5}(-?[\d.]+)\s+Tm\b|T\*|\((?:\\.|[^\\)])*\)|<[0-9A-Fa-f\s]*>|\[|\]|-?\d+(?:\.\d+)?|TJ|Tj|'|"/g,f;for(;(f=d.exec(e))!==null;){let h=f[0];if(f[1]!==void 0&&h.endsWith("Tf")){i=t.get(f[1]);continue}if(f[2]!==void 0){Math.abs(Number(f[3]))>.01?c():Number(f[2])!==0&&u();continue}if(f[4]!==void 0){let m=Number(f[4]);l!==null&&Math.abs(m-l)>.01?c():l!==null&&u(),l=m;continue}if(h==="T*"){c();continue}if(h==="["){s=!0;continue}if(h==="]"){s=!1;continue}if(h==="TJ"||h==="Tj"||h==="'"||h==='"'){(h==="'"||h==='"')&&c(),o&&(n+=o,a=o.trim().length,o="");continue}if(h.startsWith("("))o+=tn(sn(h.slice(1,-1)),i);else if(h.startsWith("<")){let m=h.slice(1,-1).replace(/\s+/g,""),g=[];for(let b=0;b+1<m.length;b+=2)g.push(parseInt(m.slice(b,b+2),16));o+=tn(g,i)}else s&&Number(h)<-200&&o&&!o.endsWith(" ")&&(o+=" ")}return o&&(n+=o),c(),r}function ti(e,t){let r=e.toString("latin1"),n=/\/Info\s+(\d+)\s+\d+\s+R/.exec(r),i=n?t.get(Number(n[1]))?.dict:void 0;if(!i)return"";let s=[],o=/\/(Author|Title|Subject|Keywords|Creator|Producer)\s*(\((?:\\.|[^\\)])*\)|<[0-9A-Fa-f\s]*>)/g,a;for(;(a=o.exec(i))!==null;){let l=a[2]??"";if(l.startsWith("(")){let c=sn(l.slice(1,-1));s.push(on(c)??c.map(u=>String.fromCharCode(u)).join(""))}else{let c=l.slice(1,-1).replace(/\s+/g,""),u="";if(c.toUpperCase().startsWith("FEFF"))for(let d=4;d+3<c.length+1;d+=4)u+=String.fromCharCode(parseInt(c.slice(d,d+4),16));else for(let d=0;d+1<c.length;d+=2)u+=String.fromCharCode(parseInt(c.slice(d,d+2),16));s.push(u)}}return s.join(`

package/dist/index.js CHANGED Viewed

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-/*! @nodatachat/mcp 1.5.0 | Copyright 2026 Capsule Ltd. | FSL-1.1-ALv2 | see LICENSE.md */
+/*! @nodatachat/mcp 1.5.1 | Copyright 2026 Capsule Ltd. | FSL-1.1-ALv2 | see LICENSE.md */
 import{createRequire as __ndReq}from"node:module";const require=__ndReq(import.meta.url);
 var $v=Object.create;var ll=Object.defineProperty;var Tv=Object.getOwnPropertyDescriptor;var Rv=Object.getOwnPropertyNames;var Nv=Object.getPrototypeOf,Pv=Object.prototype.hasOwnProperty;var oe=(e=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(e,{get:(t,n)=>(typeof require<"u"?require:t)[n]}):e)(function(e){if(typeof require<"u")return require.apply(this,arguments);throw Error('Dynamic require of "'+e+'" is not supported')});var V=(e,t)=>()=>(e&&(t=e(e=0)),t);var ce=(e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports),Dv=(e,t)=>{for(var n in t)ll(e,n,{get:t[n],enumerable:!0})},Ov=(e,t,n,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of Rv(t))!Pv.call(e,o)&&o!==n&&ll(e,o,{get:()=>t[o],enumerable:!(r=Tv(t,o))||r.enumerable});return e};var Ve=(e,t,n)=>(n=e!=null?$v(Nv(e)):{},Ov(t||!e||!e.__esModule?ll(n,"default",{value:e,enumerable:!0}):n,e));function dl(e){e.table&&(Me.table=e.table),e.severity&&(Me.severity=e.severity),e.amounts&&(Me.amounts=e.amounts);for(let t of e.text??[])Me.text.some(n=>n.kind===t.kind)||Me.text.push(t);e.header&&!Me.header.includes(e.header)&&Me.header.push(e.header);for(let t of e.secrets??[])Me.secrets.some(n=>n.id===t.id)||Me.secrets.push(t)}function Fs(e){return Me.severity?.(e)}function ul(){return Me.amounts?.()===!0}function Nr(){return Me.text}function If(){return Me.header}function Pr(){return Me.table}function Cf(){return Me.secrets}var Me,an=V(()=>{"use strict";Me={text:[],header:[],secrets:[],table:null,amounts:null,severity:null}});function Dt(){let e=Cf().filter(t=>!Bs.some(n=>n.id===t.id));return[...Bs,...e]}function Cv(e,t){let n=i=>i.replace(/^[^0-9]*/,"").split(".").map(s=>parseInt(s,10)||0),r=n(e),o=n(t);for(let i=0;i<3;i++){if((r[i]||0)<(o[i]||0))return!0;if((r[i]||0)>(o[i]||0))return!1}return!1}function Ff(e){let t=[],n;try{n=JSON.parse(e)}catch{return t}let r={...n.dependencies??{},...n.devDependencies??{}};for(let[o,i]of Object.entries(r)){let s=(i||"").replace(/^[\^~>=<\s]+/,""),a=Iv.find(c=>c.name===o&&Cv(s,c.below));a&&t.push({name:o,version:s,vuln:a})}return t}function zt(e){if(!e)return null;let t=e.trim();if(Fv.test(t)||/^name$/i.test(t)||/^\[[A-Z_]+(?:-\d+)?\]$/.test(t))return null;let n=t.replace(/[\s-]+/g,"_");for(let r of[...Lv,...jv])if(r.pattern.test(t)||r.pattern.test(n))return{type:r.type,label:r.label};if(Bv.test(t))return null;if(/^שם[ _][\u0590-\u05FF"'׳ ]{2,20}$/.test(t))return{type:"name",label:"\u05E9\u05DD \u05D0\u05D3\u05DD"};if(/^(customer|client|employee|inspector|supervisor|contact|person|patient|user|owner|manager|agent|member|driver|tenant|student|parent|beneficiary|insured)_?(full_?)?name$/i.test(n))return{type:"name",label:"Person name"};for(let r of If()){let o=r(t);if(o)return{type:o.type,label:o.label}}return null}function Hs(e){let t=String(e??"").replace(/\D/g,"");if(t.length===0||t.length>9)return!1;let n=t.padStart(9,"0"),r=0;for(let o=0;o<9;o++){let i=parseInt(n[o]??"0",10)*(o%2+1);i>9&&(i-=9),r+=i}return r%10===0&&parseInt(n,10)>0}function Mv(e){let t=String(e??"").replace(/\D/g,"");if(t.length<12||t.length>19)return!1;let n=0,r=!1;for(let o=t.length-1;o>=0;o-=1){let i=parseInt(t[o]??"0",10);r&&(i*=2,i>9&&(i-=9)),n+=i,r=!r}return n%10===0}function Hv(e){let t=String(e??"").replace(/\s/g,"").toUpperCase();if(!/^[A-Z]{2}\d{2}[A-Z0-9]{10,30}$/.test(t))return!1;let n=t.slice(4)+t.slice(0,4),r=0;for(let o of n){let i=o>="A"&&o<="Z"?String(o.charCodeAt(0)-55):o;for(let s of i)r=(r*10+Number(s))%97}return r===1}function Bf(e){if(e.length!==14&&e.length!==17)return!1;let t=+e.slice(0,4),n=+e.slice(4,6),r=+e.slice(6,8),o=+e.slice(8,10),i=+e.slice(10,12),s=+e.slice(12,14);return t>=1970&&t<=2099&&n>=1&&n<=12&&r>=1&&r<=31&&o<24&&i<60&&s<60}function Mf(e){let t=Number(e);return!Number.isSafeInteger(t)||t<1024?!1:Number.isInteger(Math.log2(t))||t%1048576===0}function ni(e){return Uv.has(e.replace(/\D/g,""))}function Us(e){let t=e.replace(/\D/g,"");return Bf(t)||Mf(t)}function ii(e,t){let n=[];for(let r of gl){r.pattern.lastIndex=0;let o=new Set,i,s=0;for(;(i=r.pattern.exec(e))!==null&&(s+=1,!(s>2e5));){let a=i[0];if(!(r.subkind!=="iban"&&r.subkind!=="israeli_phone"&&Us(a))&&(r.validate(a)&&o.add(a.replace(/[\s-]/g,"")),o.size>=1e5))break}if(o.size>0){if(t)for(let c of o)ni(c)||t(r.subkind,c);let a=[...o].filter(c=>!ni(c)).length;n.push({subkind:r.subkind,severity:a===0?"low":r.severity,hint:a===0?`${r.hint} All ${o.size} are published test numbers.`:r.hint,count:o.size,real:a})}}for(let r of Nr()){let o=new Set;for(let i of r.find(e))o.add(e.slice(i.start,i.end).trim());o.size>0&&n.push({subkind:r.kind,severity:r.severity,hint:r.hint,count:o.size})}return n}function Wn(e,t){let n=[],r="",o=!1;for(let i=0;i<e.length;i++){let s=e[i];o?s==='"'&&e[i+1]==='"'?(r+='"',i++):s==='"'?o=!1:r+=s:s==='"'?o=!0:s===t?(n.push(r),r=""):r+=s}return n.push(r),n}var Bs,jf,Lf,hl,Iv,jv,Lv,Fv,Bv,Ms,ri,oi,pl,fl,gl,Uv,Gn=V(()=>{"use strict";an();Bs=[{id:"aws-access-key",name:"AWS Access Key",pattern:/(?:^|[^A-Z0-9])AKIA[A-Z2-7]{16}(?:[^A-Z2-7]|$)/,severity:"critical"},{id:"aws-secret-key",name:"AWS Secret Key",pattern:/(?:aws_secret_access_key|aws_secret_key|secret_access_key)\s*[=:]\s*['"]?[A-Za-z0-9/+=]{40}['"]?/,severity:"critical"},{id:"gcp-api-key",name:"GCP API Key",pattern:/AIza[0-9A-Za-z_-]{35}/,severity:"critical"},{id:"gcp-service-account",name:"GCP Service Account",pattern:/"type"\s*:\s*"service_account"/,severity:"critical"},{id:"github-token",name:"GitHub Token",pattern:/gh[pousr]_[0-9a-zA-Z]{36,}/,severity:"critical"},{id:"github-fine-grained",name:"GitHub Fine-Grained Token",pattern:/github_pat_[0-9a-zA-Z_]{22,}/,severity:"critical"},{id:"gitlab-token",name:"GitLab Token",pattern:/glpat-[0-9a-zA-Z_-]{20,}/,severity:"critical"},{id:"stripe-secret",name:"Stripe Secret Key",pattern:/sk_live_[0-9a-zA-Z]{24,}/,severity:"critical"},{id:"stripe-restricted",name:"Stripe Restricted Key",pattern:/rk_live_[0-9a-zA-Z]{24,}/,severity:"critical"},{id:"slack-token",name:"Slack Token",pattern:/xox[baprs]-[0-9a-zA-Z-]{10,}/,severity:"high"},{id:"slack-webhook",name:"Slack Webhook",pattern:/hooks\.slack\.com\/services\/T[0-9A-Z]{8,}\/B[0-9A-Z]{8,}\/[0-9a-zA-Z]{24}/,severity:"high"},{id:"twilio-api-key",name:"Twilio API Key",pattern:/SK[0-9a-fA-F]{32}/,severity:"high"},{id:"sendgrid-api-key",name:"SendGrid API Key",pattern:/SG\.[0-9a-zA-Z_-]{22}\.[0-9a-zA-Z_-]{43}/,severity:"critical"},{id:"postgres-uri",name:"PostgreSQL Connection String",pattern:/postgres(?:ql)?:\/\/[^\s'"]{10,}/,severity:"critical"},{id:"mongodb-uri",name:"MongoDB Connection String",pattern:/mongodb(?:\+srv)?:\/\/[^\s'"]{10,}/,severity:"critical"},{id:"redis-uri",name:"Redis Connection String",pattern:/redis(?:s)?:\/\/[^\s'"]{10,}/,severity:"high"},{id:"openai-key",name:"OpenAI API Key",pattern:/sk-[0-9a-zA-Z]{20,}T3BlbkFJ[0-9a-zA-Z]{20,}/,severity:"critical"},{id:"openai-project-key",name:"OpenAI API Key",pattern:/sk-(?:proj|svcacct|admin)-[0-9A-Za-z_-]{40,}/,severity:"critical"},{id:"anthropic-key",name:"Anthropic API Key",pattern:/sk-ant-[0-9a-zA-Z_-]{40,}/,severity:"critical"},{id:"firebase-key",name:"Firebase API Key",pattern:/AIza[0-9A-Za-z_-]{35}/,severity:"high"},{id:"supabase-key",name:"Supabase Service Key",pattern:/eyJ[0-9a-zA-Z_-]{100,}/,severity:"critical"},{id:"supabase-access-token",name:"Supabase Access Token",pattern:/\bsbp_[0-9a-f]{40}\b/,severity:"critical"},{id:"supabase-secret-key",name:"Supabase Secret Key",pattern:/\bsb_secret_[0-9A-Za-z_-]{20,}/,severity:"critical"},{id:"private-key",name:"Private Key",pattern:/-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/,severity:"critical"},{id:"jwt-secret",name:"JWT/Generic Secret",pattern:/(?:jwt_secret|JWT_SECRET|secret_key|SECRET_KEY|api_secret|API_SECRET)\s*[=:]\s*['"][^'"]{8,}['"]/,severity:"high"},{id:"password-in-code",name:"Password in Code",pattern:/(?:password|passwd|pwd)\s*[=:]\s*['"][^'"]{8,}['"]/,severity:"high"},{id:"bearer-token",name:"Bearer Token in Code",pattern:/['"]Bearer\s+[0-9a-zA-Z._-]{20,}['"]/,severity:"high"}];jf=/node_modules\/|\.next\/|\.test\.|\.spec\.|__tests__\/|\.nodata-proof\.json$|\.git\//,Lf=/(^|\/)\.env(\.[\w-]+)*\.(example|sample|template|dist)$|\.(example|sample|template)$|(^|\/)[^/]*\.(example|sample)\.[a-z0-9]+$/i,hl=/(^|\/)(__tests__|__mocks__|tests?|spec|fixtures?|mocks?|samples?|examples?|demo|testdata)(\/|$)|\.(test|spec)\.[a-z0-9]+$|\.min\.(m?js|css)$|(^|\/)[^/]*\.worker\.min\.m?js$/i,Iv=[{name:"lodash",below:"4.17.21",severity:"critical",cve:"CVE-2021-23337",desc:"Command injection via template"},{name:"minimist",below:"1.2.6",severity:"critical",cve:"CVE-2021-44906",desc:"Prototype pollution"},{name:"json5",below:"2.2.2",severity:"high",cve:"CVE-2022-46175",desc:"Prototype pollution"},{name:"express",below:"4.19.2",severity:"high",cve:"CVE-2024-29041",desc:"Open redirect"},{name:"path-to-regexp",below:"6.3.0",severity:"high",cve:"CVE-2024-45296",desc:"ReDoS"},{name:"sanitize-html",below:"2.12.1",severity:"high",cve:"CVE-2024-21501",desc:"XSS bypass"},{name:"dompurify",below:"3.0.9",severity:"high",cve:"CVE-2024-45801",desc:"mXSS"},{name:"jsonwebtoken",below:"9.0.0",severity:"critical",cve:"CVE-2022-23529",desc:"Key confusion attack"},{name:"jose",below:"4.15.5",severity:"high",cve:"CVE-2024-28176",desc:"DoS via JWE"},{name:"axios",below:"1.6.0",severity:"high",cve:"CVE-2023-45857",desc:"CSRF cookie leak"},{name:"node-fetch",below:"2.6.7",severity:"high",cve:"CVE-2022-0235",desc:"Header leak on redirect"},{name:"serialize-javascript",below:"6.0.2",severity:"critical",cve:"CVE-2024-11831",desc:"XSS via serialization"},{name:"xml2js",below:"0.6.0",severity:"high",cve:"CVE-2023-0842",desc:"Prototype pollution"},{name:"next",below:"14.1.1",severity:"high",cve:"CVE-2024-34350",desc:"SSRF via headers"},{name:"sharp",below:"0.32.6",severity:"high",cve:"CVE-2023-4863",desc:"libwebp heap overflow"},{name:"multer",below:"1.4.5",severity:"high",cve:"CVE-2022-24434",desc:"Prototype pollution"},{name:"tough-cookie",below:"4.1.3",severity:"medium",cve:"CVE-2023-26136",desc:"Prototype pollution"},{name:"semver",below:"7.5.4",severity:"medium",cve:"CVE-2022-25883",desc:"ReDoS"},{name:"ip",below:"2.0.1",severity:"critical",cve:"CVE-2024-29415",desc:"SSRF bypass via octal IP"},{name:"tar",below:"6.2.1",severity:"high",cve:"CVE-2024-28863",desc:"DoS via path traversal"}];jv=[{pattern:/^(full_?name|first_?name|last_?name|spouse_?name|beneficiary_?name)$/i,type:"name",label:"Person name"},{pattern:/^(email|e_?mail|email_?address)$/i,type:"email",label:"Email address"},{pattern:/^(phone|mobile|telephone|phone_?number|cell_?phone)$/i,type:"phone",label:"Phone number"},{pattern:/^(id_?number|identity|ssn|social_?security|national_?id|teudat_?zehut)$/i,type:"id",label:"ID number"},{pattern:/^(address|street_?address|home_?address)$/i,type:"address",label:"Address"},{pattern:/^(date_?of_?birth|dob|birth_?date|birthday)$/i,type:"dob",label:"Date of birth"},{pattern:/^(bank_?account|iban|account_?number|bank_?details|routing_?number)$/i,type:"financial",label:"Bank account"},{pattern:/^(credit_?card|card_?number|cvv|cc_?number)$/i,type:"financial",label:"Credit card"},{pattern:/^(salary|income|commission|premium|compensation)$/i,type:"financial",label:"Salary / income"},{pattern:/^(medical_?info|health_?conditions|diagnosis|medication|prescription)$/i,type:"medical",label:"Medical"},{pattern:/^(passport|passport_?number|passport_?id)$/i,type:"id",label:"Passport"},{pattern:/^(driver_?license|drivers_?license|dl_?number)$/i,type:"id",label:"Driver license"},{pattern:/^(tax_?id|tin|vat_?number|ein)$/i,type:"financial",label:"Tax ID"},{pattern:/^(insurance_?number|policy_?number|member_?id)$/i,type:"id",label:"Insurance/Policy"},{pattern:/^(biometric|fingerprint|face_?id|retina)$/i,type:"biometric",label:"Biometric"},{pattern:/^(latitude|longitude|lat|lng|geo_?location|coordinates)$/i,type:"location",label:"Geolocation"}],Lv=[{pattern:/^(?:שם|שם_מלא|שם פרטי|שם_פרטי|שם משפחה|שם_משפחה|שם הלקוח|שם בן זוג|שם המבוטח|שם המוטב|שם הילד|שם הקטין)$/i,type:"name",label:"\u05E9\u05DD \u05D0\u05D3\u05DD"},{pattern:/^(?:ת"ז|ת\.ז|ת ז|תז|תעודת זהות|תעודת_זהות|מספר זהות|מס' זהות|teudat_zehut|tz|israeli_id|il_id)$/i,type:"id",label:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA"},{pattern:/^(?:דרכון|מספר דרכון|רישיון נהיגה|רישיון_נהיגה|רשיון נהיגה)$/i,type:"id",label:"\u05D3\u05E8\u05DB\u05D5\u05DF/\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF"},{pattern:/^(?:מייל|דוא"ל|דוא_ל|דואר אלקטרוני|אימייל|כתובת מייל)$/i,type:"email",label:"\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9"},{pattern:/^(?:טלפון|טל'|נייד|פלאפון|סלולרי|מספר טלפון|טלפון נייד)$/i,type:"phone",label:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF"},{pattern:/^(?:כתובת|כתובת מגורים|רחוב|מס בית|עיר|ישוב|יישוב|מיקוד|כתובת מלאה|מען)$/i,type:"address",label:"\u05DB\u05EA\u05D5\u05D1\u05EA"},{pattern:/^(?:תאריך לידה|ת לידה|תאריך הולדת|יום הולדת|גיל)$/i,type:"dob",label:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"},{pattern:/^(?:חשבון בנק|מספר חשבון|מס חשבון|סניף|iban|iban_il)$/i,type:"financial",label:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7"},{pattern:/^(?:כרטיס אשראי|מספר אשראי|cvv|אשראי)$/i,type:"financial",label:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"},{pattern:/^(?:שכר|משכורת|הכנסה|פרמיה|שכר ברוטו|שכר נטו|תגמול|בונוס|פיצוי)$/i,type:"financial",label:"\u05E9\u05DB\u05E8/\u05D4\u05DB\u05E0\u05E1\u05D4"},{pattern:/^(?:אבחון|אבחנה|מחלה|תרופה|מרשם|בדיקה רפואית|מצב רפואי|חיסון|רגישות|אלרגיה|סוג דם)$/i,type:"medical",label:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(?:מספר פוליסה|מס פוליסה|פוליסה|מספר חבר|מספר ביטוח)$/i,type:"id",label:"\u05E4\u05D5\u05DC\u05D9\u05E1\u05D4/\u05D7\u05D1\u05E8\u05D5\u05EA"},{pattern:/^(?:שם הילד|תעודת זהות של ילד|ילדים|קטין|מספר ילדים|תעודת לידה)$/i,type:"minor_data",label:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05DF"},{pattern:/^(?:דת|לאום|מין|נטייה מינית|השקפה פוליטית|מצב משפחתי|עדה|מוצא)$/i,type:"sensitive_personal",label:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9"},{pattern:/^(?:מספר רכב|מס רכב|לוחית רישוי|מספר רישוי)$/i,type:"tracking",label:"\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"}],Fv=/^(id|uuid|created_?at|updated_?at|deleted_?at|status|type|category|description|title|slug|url|path|key|value|enabled|active|public|version|metadata|config|settings|data|content|note|comment|label|color|icon)$/i,Bv=/^שם[ _](?:ה)?(?:קובץ|מוצר|פריט|חברה|ארגון|עסק|פרויקט|גיליון|טבלה|שדה|קטגוריה|סניף|בנק|עיר|רחוב|ישוב|יישוב|מסמך|תוכנית|חבילה|קורס|מחלקה|אתר|דומיין|מותג|ספק|שירות|תפקיד)$|^(file|product|item|company|org|organization|project|sheet|table|field|category|branch|bank|city|street|document|plan|course|department|site|domain|brand|vendor|service|role)[ _-]?name$/i;Ms={id:"critical",financial:"critical",medical:"critical",biometric:"critical",minor_data:"critical",sensitive_personal:"critical",email:"high",phone:"high",name:"high",address:"high",dob:"high",tracking:"medium",location:"high",auth:"critical",employment:"medium",education:"medium",behavior:"high"};ri=/(?:\+972[\s-]?|0)(?:5[0-9]|[2-4]|[89])(?:[\s-]?\d){7}/g,oi=/\bIL\d{2}\s?(?:\d{4}\s?){4}\d{3}\b/g;pl="(?<!\\d)(?<!\\d[.,])",fl="(?!\\d)(?![.,]\\d)",gl=[{subkind:"israeli_id",severity:"high",pattern:new RegExp(`${pl}\\d{9}${fl}`,"g"),validate:Hs,hint:"Israeli national ID (check digit verified) in plaintext. Encrypt the column or mask it at rest."},{subkind:"credit_card",severity:"critical",pattern:new RegExp(`${pl}[2-6][ -]?(?:\\d[ -]?){11,17}\\d${fl}`,"g"),validate:Mv,hint:"Payment card number (Luhn verified) in plaintext. This is PCI scope."},{subkind:"iban",severity:"high",pattern:/\b[A-Z]{2}\d{2}(?: ?[A-Z0-9]{4}){2,7}(?: ?[A-Z0-9]{1,4})?\b/g,validate:Hv,hint:"Bank account in IBAN form (mod-97 verified) in plaintext."},{subkind:"israeli_phone",severity:"medium",pattern:new RegExp(`${pl}(?:\\+972[- ]?|0)(?:[57]\\d|[2-489])[- ]?\\d{3}[- ]?\\d{4}${fl}`,"g"),validate:e=>{let t=e.replace(/\D/g,"").replace(/^972/,"0");return/^0[57]\d{8}$/.test(t)?!0:/^0[2-489]\d{7}$/.test(t)&&(/[- ]/.test(e)||e.startsWith("+972"))},hint:"Israeli phone number in plaintext."}];Uv=new Set(["000000018","123456782","111111118","222222226","333333334","999999998","4111111111111111","4242424242424242","4000056655665556","5555555555554444","5105105105105100","2223003122003222","378282246310005","371449635398431","6011111111111117","3056930009020004","4012888888881881","4000000000000002"])});import{inflateSync as Kv}from"node:zlib";function Gf(e){let t=e.toString("latin1"),n=new Map,r=/(\d+)\s+(\d+)\s+obj\b/g,o;for(;(o=r.exec(t))!==null;){let i=Number(o[1]),s=r.lastIndex,a=t.indexOf("endobj",s);if(a<0)continue;let c=t.indexOf("stream",s),l,d=null;if(c>=0&&c<a){l=t.slice(s,c);let u=c+6;t[u]==="\r"&&(u+=1),t[u]===`
 `&&(u+=1);let p=t.indexOf("endstream",u);p>u&&(d=e.subarray(u,p))}else l=t.slice(s,a);n.set(i,{num:i,dict:l,stream:d})}for(let i of[...n.values()]){if(!i.stream||!/\/Type\s*\/ObjStm\b/.test(i.dict))continue;let s=Ks(i),a=Number(/\/N\s+(\d+)/.exec(i.dict)?.[1]??0),c=Number(/\/First\s+(\d+)/.exec(i.dict)?.[1]??-1);if(s===null||!a||c<0)continue;let l=s.slice(0,c).trim().split(/\s+/).map(Number);for(let d=0;d<a;d+=1){let u=l[2*d],p=l[2*d+1];if(u===void 0||p===void 0||Number.isNaN(u)||Number.isNaN(p))break;let f=d+1<a?l[2*(d+1)+1]:void 0,h=s.slice(c+p,f!==void 0?c+f:void 0);n.has(u)||n.set(u,{num:u,dict:h,stream:null})}}return n}function ml(e){let t=[...e.replace(/\s+/g,"")];if(t.length<40)return!1;let n=0,r=0;for(let o of t){let i=o.codePointAt(0)??0;i<32||i>=127&&i<=191||i===65533||i>=57344&&i<=63743?n+=1:/[\p{L}\p{N}]/u.test(o)&&(r+=1)}return n/t.length>.2||r/t.length<.25}function Wv(e){let t=e.toString("latin1").replace(/\s/g,"");t.startsWith("<~")&&(t=t.slice(2));let n=t.indexOf("~>");n>=0&&(t=t.slice(0,n));let r=[],o=0,i=0;for(let s of t){if(s==="z"&&i===0){r.push(0,0,0,0);continue}let a=s.charCodeAt(0)-33;if(a<0||a>84)return null;o=o*85+a,i+=1,i===5&&(r.push(o>>>24&255,o>>>16&255,o>>>8&255,o&255),o=0,i=0)}if(i>0){for(let a=i;a<5;a+=1)o=o*85+84;let s=[o>>>24&255,o>>>16&255,o>>>8&255,o&255];for(let a=0;a<i-1;a+=1)r.push(s[a]??0)}return Buffer.from(r)}function Gv(e){let t=e.toString("latin1").replace(/\s/g,"").split(">")[0]??"",n=t.length%2?t+"0":t;return/^[0-9A-Fa-f]*$/.test(n)?Buffer.from(n,"hex"):null}function Vv(e){let t=/\/Filter\s*(\[[^\]]*\]|\/\w+)/.exec(e);return!t||!t[1]?[]:[...t[1].matchAll(/\/(\w+)/g)].map(n=>n[1]??"")}function Ks(e){if(!e.stream)return null;let t=e.stream;for(let n of Vv(e.dict)){let r=null;if(n==="FlateDecode")try{r=Kv(t)}catch{return null}else if(n==="ASCII85Decode")r=Wv(t);else if(n==="ASCIIHexDecode")r=Gv(t);else return null;if(r===null)return null;t=r}return t.toString("latin1")}function qv(e){let t=new Map,n=1,r=/begincodespacerange([\s\S]*?)endcodespacerange/.exec(e);if(r&&r[1]){let c=/<([0-9A-Fa-f]+)>/.exec(r[1]);c&&c[1]&&c[1].length>=4&&(n=2)}let o=c=>{let l="";for(let d=0;d+3<c.length+1;d+=4){let u=parseInt(c.slice(d,d+4),16);Number.isFinite(u)&&u>0&&(l+=String.fromCharCode(u))}return l},i=/beginbfchar([\s\S]*?)endbfchar/g,s;for(;(s=i.exec(e))!==null;){let c=/<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]*)>/g,l;for(;(l=c.exec(s[1]??""))!==null;)t.set(parseInt(l[1]??"0",16),o(l[2]??""))}let a=/beginbfrange([\s\S]*?)endbfrange/g;for(;(s=a.exec(e))!==null;){let c=s[1]??"",l=/<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]*)>/g,d;for(;(d=l.exec(c))!==null;){let u=parseInt(d[1]??"0",16),p=parseInt(d[2]??"0",16),f=parseInt((d[3]??"0").slice(0,4)||"0",16);if(!(p-u>65535))for(let h=u;h<=p;h+=1)t.set(h,String.fromCharCode(f+(h-u)))}}return{map:t,bytes:n}}function zv(e){let t=new Map,n=[],r=[];for(let i of e.values()){for(let s of i.dict.matchAll(/\/Font\s*<<([\s\S]*?)>>/g))s[1]&&r.push(s[1]);for(let s of i.dict.matchAll(/\/Font\s+(\d+)\s+\d+\s+R/g)){let a=e.get(Number(s[1]));a&&r.push(a.dict)}}let o=new Set;for(let i of r){let s=/\/([^\s/<>[\]()]+)\s+(\d+)\s+\d+\s+R/g,a;for(;(a=s.exec(i))!==null;){let c=`${a[1]}#${a[2]}`;o.has(c)||(o.add(c),n.push([a[1]??"",Number(a[2])]))}}for(let[i,s]of n){let a=e.get(s);if(!a)continue;let c=null,l=/\/ToUnicode\s+(\d+)\s+\d+\s+R/.exec(a.dict);if(l){let u=e.get(Number(l[1])),p=u?Ks(u):null;p&&(c=qv(p))}if(c||(c=Xv(a.dict,e)),!c)continue;let d=t.get(i)??[];d.push(c),t.set(i,d)}return t}function Yv(e){let t=/^uni([0-9A-Fa-f]{4})$/.exec(e)??/^u([0-9A-Fa-f]{4,6})$/.exec(e);if(t)return String.fromCodePoint(parseInt(t[1],16));let n=/^afii(\d{5})$/.exec(e);if(n){let i=Number(n[1]);if(i>=57664&&i<=57690)return String.fromCharCode(1488+(i-57664))}let r=Jv.indexOf(e.replace(/hebrew$/,""));return r>=0?String.fromCharCode(1488+r):e==="space"?" ":/^[A-Za-z]$/.test(e)?e:{zero:"0",one:"1",two:"2",three:"3",four:"4",five:"5",six:"6",seven:"7",eight:"8",nine:"9",period:".",comma:",",hyphen:"-",colon:":",slash:"/",at:"@"}[e]??null}function Xv(e,t){let n=e,r=/\/Encoding\s+(\d+)\s+\d+\s+R/.exec(e);r&&(n=t.get(Number(r[1]))?.dict??"");let o=/\/Differences\s*\[([^\]]*)\]/.exec(n);if(!o?.[1])return null;let i=new Map,s=0;for(let a of o[1].match(/\d+|\/[^\s/[\]]+/g)??[]){if(/^\d+$/.test(a)){s=Number(a);continue}let c=Yv(a.slice(1));c!==null&&i.set(s,c),s+=1}return i.size?{map:i,bytes:1}:null}function Vf(e){let t=[];for(let n=0;n<e.length;n+=1){let r=e[n];if(r!=="\\"){t.push(r.charCodeAt(0)&255);continue}let o=e[n+1];if(o===void 0)break;if(o>="0"&&o<="7"){let s="",a=n+1;for(;a<e.length&&s.length<3&&e[a]>="0"&&e[a]<="7";)s+=e[a],a+=1;t.push(parseInt(s,8)&255),n=a-1;continue}let i={n:10,r:13,t:9,b:8,f:12};t.push(i[o]??o.charCodeAt(0)&255),n+=1}return t}function qf(e){if(e.length<2||e[0]!==254||e[1]!==255)return null;let t="";for(let n=2;n+1<e.length;n+=2)t+=String.fromCharCode((e[n]??0)<<8|(e[n+1]??0));return t}function Uf(e,t){let n=qf(e);if(n!==null)return n;if(!t)return e.map(o=>String.fromCharCode(o)).join("");let r="";if(t.bytes===2)for(let o=0;o+1<e.length;o+=2){let i=(e[o]??0)<<8|(e[o+1]??0);r+=t.map.get(i)??""}else for(let o of e)r+=t.map.get(o)??String.fromCharCode(o);return r}function Zv(e){let t=0;for(let n of e){let r=n.codePointAt(0)??0;/[\p{L}\p{N}]/u.test(n)?t+=1:(r<32||r>=127&&r<=191||r===65533)&&(t-=2)}return t}function Kf(e,t){if(!t||t.length<=1)return Uf(e,t?.[0]);let n="",r=-1/0;for(let o of t){let i=Uf(e,o),s=Zv(i);s>r&&(n=i,r=s)}return n}function Qv(e,t){let n="",r="",o,i=!1,s="",a=0,c=null,l=()=>{r.trim()&&(n+=r+`
@@ -256,7 +256,7 @@ ${f.length?f.map(h=>`  ${Zo(h,!0)}`).join(`
 `+e.slice(-Rs):e}function BP(e,t,n,r){return new Promise(o=>{let i=Date.now(),s=ik(e,{cwd:t,env:n,shell:!0,stdio:["ignore","pipe","pipe"]}),a="",c=!1,l=u=>{if(a+=u.toString("utf8"),a.length>Rs*32){let p=a.slice(-Rs*16);a=p.slice(p.indexOf(`
 `)+1)}};s.stdout.on("data",l),s.stderr.on("data",l);let d=setTimeout(()=>{c=!0,s.kill("SIGTERM")},r);s.on("error",u=>{clearTimeout(d),o({code:null,output:a+`
 ${u.message}`,timedOut:c,ms:Date.now()-i})}),s.on("close",u=>{clearTimeout(d),o({code:u,output:a,timedOut:c,ms:Date.now()-i})})})}var yk=()=>ak(sk(),".nodata","org-approvals.json"),rk=(e,t,n)=>`${e}\0${t??""}\0${n}`;function _k(){try{let e=JSON.parse(Ps(yk(),"utf8"));return e&&typeof e=="object"&&!Array.isArray(e)?e:{}}catch{return{}}}function MP(e){Vc(ak(sk(),".nodata"),{recursive:!0}),qc(yk(),JSON.stringify(e,null,2),{mode:384})}function HP(e,t,n){let r={};for(let[o,i]of Object.entries(_k())){let[s,a,c]=o.split("\0");s!==e||!c||(t!==void 0?a===t&&(r[`${n??""}:${c}`]=i):a.includes("")||(r[`${a}:${c}`]=i))}return r}function UP(e,t,n,r){let o=_k(),i=!1;for(let s of n){let a=rk(e,s.project||t,s.key);a in o&&(delete o[a],i=!0)}for(let s of r??[]){let a=rk(e,s.project??t,s.key);s.approval?o[a]!==s.approval.lock_id&&(o[a]=s.approval.lock_id,i=!0):a in o&&/organisation approval (refused|could not be spent)/.test(s.reason)&&(delete o[a],i=!0)}i&&MP(o)}function Gc(e){let t=new Map,n=!1;for(let r of e.withheld??[])if(r.challenge){n||=r.challenge.failed;for(let o of r.challenge.questions)t.has(o.id)||t.set(o.id,o)}return t.size?{questions:[...t.values()],failed:n}:null}function bk(e){return(e.withheld??[]).filter(t=>t.approval).map(t=>`${t.project?`${t.project}/`:""}${t.key}: ${t.approval.signatures_collected}/${t.approval.signatures_required} signed${t.approval.status==="collected"?" (approved \u2014 waiting for cooling-off or for the other keys)":""} \xB7 approval ${t.approval.lock_id}`)}async function wk(e,t,n={}){let r=n.partner_of?`${n.partner_of}${t??""}`:t,o=n.plan||n.ask?{}:{...HP(e.base_url,n.partner_of?r:void 0,t),...n.approvals??{}},i;try{i=await Ds(e)}catch(p){return{error:p instanceof Error?p.message:String(p)}}let s=await fetch(`${e.base_url}/api/secrets/pull`,{method:"POST",headers:{authorization:`Bearer ${i}`,"content-type":"application/json"},body:JSON.stringify({...t?{projectLabel:t}:{},...n,...Object.keys(o).length?{approvals:o}:{}})}),a=await s.json().catch(()=>({})),c=typeof a.next=="string"?` \xB7 stage ${String(a.stage??"")}: next, ${a.next}`:"";if(!s.ok)return{error:`HTTP ${s.status}${a.error?` \u2014 ${a.error}`:""}${c}`,...s.status===428&&typeof a.approval=="string"?{approval:a.approval}:{}};if(n.ask){let p=a.approval??{};return typeof p.approval_id!="string"||typeof p.approve_url!="string"?{error:"this NoData server cannot ask a person to approve a command yet"}:{secrets:{},project:a.project??t,approval:{approval_id:p.approval_id,code:String(p.code??""),approve_url:p.approve_url,expires_in:Number(p.expires_in??300),keys:Array.isArray(p.keys)?p.keys:[]}}}let l=a.project??t??"",d=n.plan?{secrets:{},missing:[]}:await IP(e.base_url,Array.isArray(a.halves)?a.halves:[],!!n.partner_of),u=[...Array.isArray(a.withheld)?a.withheld:[],...d.missing.map(p=>({key:p,reason:n.partner_of?"the client has not shared its half with this computer yet \u2014 it runs secrets-share for the project after naming this computer on the key's rule":`this computer holds no half of it \u2014 set it here (npx -y @nodatachat/mcp secrets-set --project ${l||"<project>"} ${p}), or ask whoever set it to share it (secrets-share)`}))];if(!n.plan){let p=(Array.isArray(a.halves)?a.halves:[]).map(f=>({key:f.key,project:n.partner_of?r??"":f.project}));try{UP(e.base_url,r,p,n.partner_of?u.map(f=>({...f,project:r??void 0})):u)}catch{}}return{secrets:d.secrets,project:a.project??t,...u.length?{withheld:u}:{},...Array.isArray(a.plan)?{plan:a.plan}:{},...n.approval_id&&a.approval_id===n.approval_id?{approved_by:typeof a.approved_by=="string"?a.approved_by:"a person"}:{}}}function KP(){return!!process.stdin.isTTY&&!!process.stdout.isTTY}async function kk(e,t=wk,n=i=>process.stderr.write(i+`
-`),r=KP,o={}){let i=e.indexOf("--"),s=i>=0?e.slice(0,i):e,a=i>=0?e.slice(i+1):[],c=s.indexOf("--project"),l=s.indexOf("--from"),d=l>=0?s[l+1]??"":Sa(process.cwd())?.org_id??null;if(a.length===0)return n("Usage: nodata-mcp secrets-run [--project <label>] [--from <client org id>] -- <command\u2026>   e.g.  secrets-run --project web -- npm run dev"),2;let u=d!==null?hk():ei();if(!u)return n(ef),2;let p=dd((c>=0?s[c+1]:null)??u.project??null);if("error"in p)return n(`\u2717 ${p.error}`),2;let f=p.project;if(d!==null&&(!d||!f))return n("\u2717 A client's keys need both: --from <client organisation id> --project <its project>."),2;let h=($,T,D={})=>t($,T,d?{...D,partner_of:d}:D),y=r(),_=y?"person":"agent",m=await h(u,f,{for:_});if("error"in m)return n(`\u2717 Pull failed: ${m.error}`),1;let w={},g=(m.withheld??[]).filter($=>$.person_approval);if(y&&g.length){let $={command:a.join(" "),cwd:process.cwd()},T=await h(u,f,{for:_,run:$,ask:!0});if("error"in T||!T.approval)return n(`\u2717 Could not ask for your approval at NoData (${"error"in T?T.error:"no approval"}). Nothing was run.`),1;let D=o.openUrl?o.openUrl(T.approval.approve_url):!1;n(`\u{1F510} Your own rules for ${g.map(P=>`${P.project?`${P.project}/`:""}${P.key}`).join(", ")} need one step \u2014 a terminal alone does not prove it is you:`),n(`  approve this run in the browser: ${T.approval.approve_url}${D?"  (opened)":""}`),T.approval.code&&n(`  Check that it shows this command and the code ${T.approval.code}. Waiting\u2026`);let C=o.sleep??(P=>new Promise(Q=>setTimeout(Q,P))),j=Date.now()+Math.min(T.approval.expires_in*1e3,o.waitMs??Number.POSITIVE_INFINITY);for(w={run:$,approval_id:T.approval.approval_id};;){let P=await h(u,f,{for:_,...w});if(!("error"in P)){m=P;break}if(P.approval==="pending"&&Date.now()<j){await C(o.pollMs??2e3);continue}return n(P.approval==="pending"?"\u270B Not run \u2014 not approved in time. Run the same command again to ask anew.":P.approval==="denied"?"\u270B Not run \u2014 the run was denied in the browser.":P.approval?`\u270B Not run \u2014 the approval is ${P.approval} (another command, already used, or expired). Run it again to ask anew.`:`\u2717 Pull failed: ${P.error}`),4}}let v=Gc(m);if(v){if(!y)return n("\u270B Not run \u2014 a key asks for your security answers, and they can only be typed in a terminal you type in yourself."),5;n("\u{1F510} A key needs your security answers (typed here, never shown or stored):");let $={};for(let C of v.questions)$[C.id]=await Qe(`  ${C.label}: `);if(m=await h(u,f,{for:_,...w,answers:$}),"error"in m)return n(`\u2717 Pull failed: ${m.error}`),1;let T=Gc(m),D=(m.withheld??[]).find(C=>/too many wrong answers/.test(C.reason));if(T||D)return n(D?`\u2717 ${D.reason}. Nothing was run.`:"\u2717 The answers were not right. Nothing was run."),5}let k=bk(m);if(k.length){n("\u270B Not run \u2014 waiting for a second person's approval (your guardian or the admins sign it on the approvals queue; your own approval does not release it):");for(let $ of k)n(`    \xB7 ${$}`);return n("  Run the same command again once they have signed. Each approval releases the key once."),3}if(y)for(let $ of(m.withheld??[]).filter(T=>T.person_approval))n(`    \xB7 ${$.project?`${$.project}/`:""}${$.key}: ${$.reason} \u2014 not given to this command`);else{let $=(m.withheld??[]).filter(T=>!T.approval&&!T.challenge);n("\u2139 Not an interactive terminal \u2014 pulled as an agent: each key's agent rules apply (run it yourself in a terminal for your own access).");for(let T of $)n(`    \xB7 ${T.project?`${T.project}/`:""}${T.key}: ${T.reason} \u2014 not given to this command`)}return n(`\u2713 ${Object.keys(m.secrets).length} secret(s)${m.project?` from ${m.project}`:""} in memory only \u2014 no .env written.`),await new Promise($=>{let T=ik(a[0],a.slice(1),{stdio:"inherit",env:{...process.env,...m.secrets},shell:process.platform==="win32"});T.on("error",D=>{n(`\u2717 ${D.message}`),$(127)}),T.on("close",D=>$(D??1))})}var WP=(e,t,n,r)=>$P("sha256").update(`${e}\0${t}\0${n}\0${r??""}`).digest("hex");function vk(e,t){let n=t.pull??wk,r=new Map,o=t.waitMs??9e4,i=t.pollMs??2e3,s=t.sleep??(a=>new Promise(c=>setTimeout(c,a)));e.registerTool("nodata_run",{description:"Run a command on this machine (tests, a migration, a deploy script) WITH the project's secrets from the NoData vault as environment variables \u2014 without you seeing them. The secrets are pulled into memory only (no .env is written); you get back the exit code and the output with every secret value blanked. EVERY command needs the user's approval, as written. When a key's policy says a person approves each use, or the client cannot ask the user itself, NoData asks the person: a page opens in their browser (or give them the link this returns), they sign in, check the command and the code, and approve it there \u2014 you cannot approve it, and there is no code for you to send back. Then call nodata_run again with the same command, folder and project; it resumes the same request. Never embed a secret value in the command, never try to print or encode one, and never confirm on the user's behalf. Uses this computer's NoData connection (`npx -y @nodatachat/mcp connect`, approved once in the browser) \u2014 no separate token; a project-limited CLI token saved with `secrets-login` is used first if present. Never ask the user for a key in the chat.",inputSchema:{command:Qo.string().min(1).describe("The exact command line to run, e.g. `npm test`."),cwd:Qo.string().optional().describe("Folder to run in. Default: the current folder."),project:Qo.string().optional().describe("Secrets project label. Default: the token's project (a connected computer has none: name it)."),timeout_seconds:Qo.number().int().min(5).max(1800).optional().describe("Default 300."),approval:Qo.string().optional().describe("Optional: the approval id NoData returned for this exact command. It releases nothing by itself \u2014 only a person's approval of this command at NoData does."),partner_of:Qo.string().optional().describe("Optional: a CLIENT organisation's id \u2014 run with that client's keys, as its partner. The client's own key board decides each key (only a rule naming this computer releases one; its admins approve, never you). Needs a Connect connection from the client to this computer.")}},async({command:a,cwd:c,project:l,timeout_seconds:d,approval:u,partner_of:p})=>{p=p??Sa(nk(c??process.cwd()))?.org_id;let f=p?hk():ei(),h=(E,R,B={})=>n(E,R,p?{...B,partner_of:p}:B);if(!f)return{content:[{type:"text",text:`This computer is not connected to NoData. One step \u2014 ask the user to run, in their own terminal (not here):
+`),r=KP,o={}){let i=e.indexOf("--"),s=i>=0?e.slice(0,i):e,a=i>=0?e.slice(i+1):[],c=s.indexOf("--project"),l=s.indexOf("--from"),d=l>=0?s[l+1]??"":Sa(process.cwd())?.org_id??null;if(a.length===0)return n("Usage: nodata-mcp secrets-run [--project <label>] [--from <client org id>] -- <command\u2026>   e.g.  secrets-run --project web -- npm run dev"),2;let u=d!==null?hk():ei();if(!u)return n(ef),2;let p=dd((c>=0?s[c+1]:null)??u.project??null);if("error"in p)return n(`\u2717 ${p.error}`),2;let f=p.project;if(d!==null&&(!d||!f))return n("\u2717 A client's keys need both: --from <client organisation id> --project <its project>."),2;let h=($,T,D={})=>t($,T,d?{...D,partner_of:d}:D),y=r(),_=y?"person":"agent",m=await h(u,f,{for:_});if("error"in m)return n(`\u2717 Pull failed: ${m.error}`),1;let w={},g=(m.withheld??[]).filter($=>$.person_approval);if(y&&g.length){let $={command:a.join(" "),cwd:process.cwd()},T=await h(u,f,{for:_,run:$,ask:!0});if("error"in T||!T.approval)return n(`\u2717 Could not ask for your approval at NoData (${"error"in T?T.error:"no approval"}). Nothing was run.`),1;let D=o.openUrl?o.openUrl(T.approval.approve_url):!1;n(`\u{1F510} Your own rules for ${g.map(P=>`${P.project?`${P.project}/`:""}${P.key}`).join(", ")} need one step \u2014 a terminal alone does not prove it is you:`),n(`  approve this run in the browser: ${T.approval.approve_url}${D?"  (opened)":""}`),T.approval.code&&n(`  Check that it shows this command and the code ${T.approval.code}. Waiting\u2026`);let C=o.sleep??(P=>new Promise(Q=>setTimeout(Q,P))),j=Date.now()+Math.min(T.approval.expires_in*1e3,o.waitMs??Number.POSITIVE_INFINITY);for(w={run:$,approval_id:T.approval.approval_id};;){let P=await h(u,f,{for:_,...w});if(!("error"in P)){m=P;break}if(P.approval==="pending"&&Date.now()<j){await C(o.pollMs??2e3);continue}return n(P.approval==="pending"?"\u270B Not run \u2014 not approved in time. Run the same command again to ask anew.":P.approval==="denied"?"\u270B Not run \u2014 the run was denied in the browser.":P.approval?`\u270B Not run \u2014 the approval is ${P.approval} (another command, already used, or expired). Run it again to ask anew.`:`\u2717 Pull failed: ${P.error}`),4}}let v=Gc(m);if(v){if(!y)return n("\u270B Not run \u2014 a key asks for your security answers, and they can only be typed in a terminal you type in yourself."),5;n("\u{1F510} A key needs your security answers (typed here, never shown or stored):");let $={};for(let C of v.questions)$[C.id]=await Qe(`  ${C.label}: `);if(m=await h(u,f,{for:_,...w,answers:$}),"error"in m)return n(`\u2717 Pull failed: ${m.error}`),1;let T=Gc(m),D=(m.withheld??[]).find(C=>/too many wrong answers/.test(C.reason));if(T||D)return n(D?`\u2717 ${D.reason}. Nothing was run.`:"\u2717 The answers were not right. Nothing was run."),5}let k=bk(m);if(k.length){n("\u270B Not run \u2014 waiting for a second person's approval (your guardian or the admins sign it on the approvals queue; your own approval does not release it):");for(let $ of k)n(`    \xB7 ${$}`);return n("  Run the same command again once they have signed. Each approval releases the key once."),3}if(y)for(let $ of(m.withheld??[]).filter(T=>d||T.person_approval))n(`    \xB7 ${$.project?`${$.project}/`:""}${$.key}: ${$.reason} \u2014 not given to this command`);else{let $=(m.withheld??[]).filter(T=>!T.approval&&!T.challenge);n("\u2139 Not an interactive terminal \u2014 pulled as an agent: each key's agent rules apply (run it yourself in a terminal for your own access).");for(let T of $)n(`    \xB7 ${T.project?`${T.project}/`:""}${T.key}: ${T.reason} \u2014 not given to this command`)}return n(`\u2713 ${Object.keys(m.secrets).length} secret(s)${m.project?` from ${m.project}`:""} in memory only \u2014 no .env written.`),await new Promise($=>{let T=ik(a[0],a.slice(1),{stdio:"inherit",env:{...process.env,...m.secrets},shell:process.platform==="win32"});T.on("error",D=>{n(`\u2717 ${D.message}`),$(127)}),T.on("close",D=>$(D??1))})}var WP=(e,t,n,r)=>$P("sha256").update(`${e}\0${t}\0${n}\0${r??""}`).digest("hex");function vk(e,t){let n=t.pull??wk,r=new Map,o=t.waitMs??9e4,i=t.pollMs??2e3,s=t.sleep??(a=>new Promise(c=>setTimeout(c,a)));e.registerTool("nodata_run",{description:"Run a command on this machine (tests, a migration, a deploy script) WITH the project's secrets from the NoData vault as environment variables \u2014 without you seeing them. The secrets are pulled into memory only (no .env is written); you get back the exit code and the output with every secret value blanked. EVERY command needs the user's approval, as written. When a key's policy says a person approves each use, or the client cannot ask the user itself, NoData asks the person: a page opens in their browser (or give them the link this returns), they sign in, check the command and the code, and approve it there \u2014 you cannot approve it, and there is no code for you to send back. Then call nodata_run again with the same command, folder and project; it resumes the same request. Never embed a secret value in the command, never try to print or encode one, and never confirm on the user's behalf. Uses this computer's NoData connection (`npx -y @nodatachat/mcp connect`, approved once in the browser) \u2014 no separate token; a project-limited CLI token saved with `secrets-login` is used first if present. Never ask the user for a key in the chat.",inputSchema:{command:Qo.string().min(1).describe("The exact command line to run, e.g. `npm test`."),cwd:Qo.string().optional().describe("Folder to run in. Default: the current folder."),project:Qo.string().optional().describe("Secrets project label. Default: the token's project (a connected computer has none: name it)."),timeout_seconds:Qo.number().int().min(5).max(1800).optional().describe("Default 300."),approval:Qo.string().optional().describe("Optional: the approval id NoData returned for this exact command. It releases nothing by itself \u2014 only a person's approval of this command at NoData does."),partner_of:Qo.string().optional().describe("Optional: a CLIENT organisation's id \u2014 run with that client's keys, as its partner. The client's own key board decides each key (only a rule naming this computer releases one; its admins approve, never you). Needs a Connect connection from the client to this computer.")}},async({command:a,cwd:c,project:l,timeout_seconds:d,approval:u,partner_of:p})=>{p=p??Sa(nk(c??process.cwd()))?.org_id;let f=p?hk():ei(),h=(E,R,B={})=>n(E,R,p?{...B,partner_of:p}:B);if(!f)return{content:[{type:"text",text:`This computer is not connected to NoData. One step \u2014 ask the user to run, in their own terminal (not here):
   npx -y @nodatachat/mcp@latest connect
 and approve this computer in the browser. Nothing to create, copy or paste \u2014 never ask the user for a key in the chat.`}],isError:!0};let y=nk(c??process.cwd());if(!Ns(y)||!RP(y).isDirectory())return{content:[{type:"text",text:`No such folder: ${y}`}],isError:!0};let _=dd(l??f.project??null,y);if("error"in _)return{content:[{type:"text",text:_.error}],isError:!0};let m=_.project,w=await h(f,m,{for:"agent",plan:!0}),g=!("error"in w)&&w.plan?w.plan:[],v=g.filter(E=>E.effect!=="allow"||(E.does??[]).length).map(E=>`    \xB7 ${E.key}${E.does?.length?` [${E.does.join(", ")}]`:""}: ${E.why}${E.effect==="deny"?" \u2014 NOT given to this command":E.effect==="approve"?E.challenge?" \u2014 given only after you answer its security questions":E.approval_tier?" \u2014 given only after your guardian/admins sign it (your approval alone does not release it)":" \u2014 given only after you approve this command at NoData (the agent cannot)":""}`),k=[`  command: ${a}`,`  folder:  ${y}`,`  secrets: ${m?`project "${m}"`:"the token's secrets"} (values stay hidden from the agent)`,...v.length?["  by each key's policy:",...v]:[]].join(`
 `),$=!!e.server.getClientCapabilities()?.elicitation,T=g.filter(E=>E.effect==="approve"&&!E.approval_tier&&!E.challenge);if(p&&!$)return{content:[{type:"text",text:[`NOT RUN \u2014 a client's keys need the user to confirm the command, and this client has no dialog for it. ${t.who()}`,"Ask the user to run it in their own terminal:",`  npx -y @nodatachat/mcp secrets-run --from ${p}${m?` --project ${m}`:""} -- ${a}`].join(`
@@ -302,7 +302,7 @@ Finish it once in the console (Recovery setup), then wrap again. NoData never se
 `),v.length>0&&g.length===0)})}to();import{createHash as vf}from"node:crypto";import{appendFileSync as JD,existsSync as YD,mkdirSync as XD,readFileSync as ZD}from"node:fs";import{homedir as ev}from"node:os";import{join as tv}from"node:path";var Sf=[{id:"overview",topics:["what","nodata","does","do","product","about","can","\u05DE\u05D4","\u05E2\u05D5\u05E9\u05D4","\u05D9\u05D5\u05D3\u05E2","\u05DE\u05D5\u05E6\u05E8","\u05E0\u05D5 \u05D3\u05D0\u05D8\u05D4","\u05D9\u05DB\u05D5\u05DC\u05D5\u05EA"],answer:"NoData keeps sensitive information safe where you work: on your computer and in your AI agents' work. It finds what is exposed in your files (ID numbers, cards, bank numbers, phones, emails, names, API keys: in text, Excel, Word, PowerPoint and PDF), locks files so only the approved computer that sealed them can open them, makes clean copies to work on, runs commands with secrets they never write to disk, shares files through links you can cancel, gives AI agents access to exactly the columns you allow, and keeps a proof of every step. Scanning and clean copies run entirely on this computer; locking encrypts here and registers at NoData only a key half sealed to this computer."},{id:"privacy",topics:["safe","secure","privacy","private","who can see","trust","upload","\u05D1\u05D8\u05D5\u05D7","\u05E4\u05E8\u05D8\u05D9\u05D5\u05EA","\u05DE\u05D9 \u05D9\u05DB\u05D5\u05DC \u05DC\u05E8\u05D0\u05D5\u05EA","\u05DE\u05D9 \u05E8\u05D5\u05D0\u05D4","\u05D4\u05DE\u05D9\u05D3\u05E2 \u05E9\u05DC\u05D9","\u05E2\u05D5\u05DC\u05D4 \u05DC\u05E2\u05E0\u05DF","\u05D0\u05DE\u05D5\u05DF"],answer:"Where your information stays: scanning and clean copies (nodata_scan_folder, nodata_redact) run on this computer and upload nothing, and the scan reports counts and places, not the values. Locking (nodata_protect) encrypts on this computer; the file never leaves it, and NoData receives only the file key sealed to this computer's key, which only this computer opens. A locked file opens on the computer that sealed it and on the same person's other connected computers (its key is sealed to each of them, each with its own key), after NoData checks that computer, a person approves the opening, and a proof is recorded. A file sent with nodata_send is stored by NoData only as ciphertext, with the key in the part of the link NoData never receives. An archive made with nodata_wrap opens only with your organisation's 12 words."},{id:"capsule",topics:["capsule","ndc","\u05E7\u05E4\u05E1\u05D5\u05DC\u05D4","\u05E7\u05E4\u05E1\u05D5\u05DC\u05D5\u05EA"],answer:"A capsule is a file sealed so it opens only under its own policy: on the approved computer that sealed it (nodata_protect, a .ndc file; it also opens on your other connected computers; every opening is recorded and can be revoked), as a governed link with expiry and cancel (nodata_send), or to your organisation's 12-word key (nodata_wrap)."},{id:"scan",topics:["scan","find","folder","exposed","sensitive","pii","report","\u05E1\u05E8\u05D9\u05E7\u05D4","\u05DC\u05E1\u05E8\u05D5\u05E7","\u05DC\u05DE\u05E6\u05D5\u05D0","\u05EA\u05D9\u05E7\u05D9\u05D9\u05D4","\u05E8\u05D2\u05D9\u05E9","\u05D7\u05E9\u05D5\u05E3","\u05D3\u05D5\u05D7"],answer:"nodata_scan_folder scans a folder on this computer and reports what is exposed: checksum-validated Israeli IDs, credit cards (Luhn), IBANs, phones, emails, names and addresses, and hard-coded keys and passwords. It reads Excel, Word, PowerPoint and PDF, including Hebrew. The result shows counts by type, folder and file, a full HTML report, and a line saying how many documents were read. Nothing is uploaded."},{id:"pdf",topics:["pdf","scanned","ocr","hebrew","read","document","\u05E1\u05E8\u05D5\u05E7","\u05E1\u05E8\u05D9\u05E7\u05D4","\u05E2\u05D1\u05E8\u05D9\u05EA","\u05DE\u05E1\u05DE\u05DA","\u05DC\u05E7\u05E8\u05D5\u05D0","\u05E7\u05E8\u05D9\u05D0\u05D4"],answer:"PDFs are read by NoData's own reader, including Hebrew and documents stamped by marking tools. With two free tools installed on this computer it reads more: Poppler (pdftotext) reads every PDF a second time, and Tesseract reads scanned pages (OCR). They run only here. See what is installed: npx -y @nodatachat/mcp@latest pdf-tools"},{id:"gate",topics:["claude","read","gate","block","ask before","\u05E7\u05DC\u05D5\u05D3","\u05E1\u05D5\u05DB\u05DF","\u05D7\u05E1\u05D9\u05DE\u05D4","\u05DC\u05D7\u05E1\u05D5\u05DD","\u05E9\u05E2\u05E8","\u05E7\u05E8\u05D0","\u05E7\u05D5\u05E8\u05D0","\u05D9\u05E7\u05E8\u05D0"],answer:"The read gate asks you before Claude Code reads a file where the scan found sensitive data, or refuses it if you choose. It also covers env files and never lets an agent read the device key. Turn it on in a terminal: npx -y @nodatachat/mcp@latest install-gate (add --block to refuse instead of asking)."},{id:"protect",topics:["lock","protect","encrypt","seal","unlock","release","\u05E0\u05E2\u05D9\u05DC\u05D4","\u05DC\u05E0\u05E2\u05D5\u05DC","\u05E0\u05D5\u05E2\u05DC","\u05E0\u05E2\u05D5\u05DC","\u05D4\u05E6\u05E4\u05E0\u05D4","\u05DC\u05D4\u05E6\u05E4\u05D9\u05DF","\u05DE\u05E6\u05E4\u05D9\u05DF","\u05DC\u05E4\u05EA\u05D5\u05D7"],answer:"nodata_protect locks files: each is sealed as <file>.ndc (AES-256-GCM) to this computer's key, which never leaves it. Locking needs this computer to be connected and approved by a person in the organisation: every seal belongs to that computer, is registered at NoData with a signed proof (NoData holds only a key half sealed to this computer), and can be revoked. Given a folder, it locks the files the scan found exposure in. nodata_open opens a sealed file back next to it, only on the computer that sealed it, and checks its hash; the opening is recorded. A kept original is still readable, so for .env secrets use nodata_run. nodata_policy lists every sealed file of the organisation, which computer it belongs to and its openings; nodata_seal_revoke opens the console where a person revokes one for good (a leaked file, a lost computer). Both show what they will do and ask before acting."},{id:"redact",topics:["clean","copy","redact","anonymise","anonymize","share","work","\u05E2\u05D5\u05EA\u05E7","\u05E0\u05E7\u05D9","\u05D4\u05EA\u05DE\u05DE\u05D4","\u05DC\u05D4\u05E1\u05EA\u05D9\u05E8","\u05DC\u05E2\u05D1\u05D5\u05D3"],answer:"nodata_redact makes a clean copy to work on: IDs, cards, IBANs, phones, emails and keys become typed tokens ([ID], [CARD], [SECRET] \u2026); in Excel and CSV a personal-data column becomes one stable token per person, so the copy still groups and counts. The copy is re-scanned before it is handed back, and a receipt is written."},{id:"plan",topics:["policy","recommend","plan","decide","what to do","\u05DE\u05D3\u05D9\u05E0\u05D9\u05D5\u05EA","\u05D4\u05DE\u05DC\u05E6\u05D4","\u05EA\u05D5\u05DB\u05E0\u05D9\u05EA","\u05DE\u05D4 \u05DC\u05E2\u05E9\u05D5\u05EA"],answer:"nodata_plan recommends a policy per file after a scan \u2014 a tier (Restricted / Confidential / Internal) and an action: clean copy, lock, both, or keep \u2014 and applies it only after you approve. Leaked keys also get where-and-how-to-replace steps per provider."},{id:"scan-feedback",topics:["false positive","wrong","mistake","missed","not sensitive","feedback","report","\u05D8\u05E2\u05D5\u05EA","\u05E9\u05D2\u05D5\u05D9","\u05E4\u05E1\u05E4\u05E1","\u05DC\u05D0 \u05E8\u05D2\u05D9\u05E9","\u05DE\u05E9\u05D5\u05D1","\u05D3\u05D9\u05D5\u05D5\u05D7"],answer:'When a scan gets it wrong, say so: nodata_scan_feedback reports what it flagged that is not sensitive and what kinds it missed. Only kind labels and counts leave your machine ("ID\xD72 not sensitive \xB7 phone\xD71 missed") \u2014 never a value, a file name or free text \u2014 and you see the exact line sent. It changes no file; to leave a file alone use nodata_plan with keep.'},{id:"secrets",topics:["secret","secrets","env",".env","key","keys","password","token","vault","run","\u05E1\u05D5\u05D3","\u05E1\u05D5\u05D3\u05D5\u05EA","\u05DE\u05E4\u05EA\u05D7","\u05DE\u05E4\u05EA\u05D7\u05D5\u05EA","\u05E1\u05D9\u05E1\u05DE\u05D4","\u05DB\u05E1\u05E4\u05EA"],answer:"Secrets reach a command without a .env on disk. In a terminal: npx -y @nodatachat/mcp@latest secrets-login --project <name> once, then npx -y @nodatachat/mcp@latest secrets-run -- <command>; the secrets exist only in that command's memory. An agent does the same with nodata_run: every command needs your approval, and the output it sees has every secret value blanked."},{id:"leaked-keys",topics:["leaked","leak","rotate","rotation","git","history","commit","exposed key","\u05D3\u05DC\u05E3","\u05D3\u05DC\u05D9\u05E4\u05D4","\u05DC\u05D4\u05D7\u05DC\u05D9\u05E3","\u05D2\u05D9\u05D8","\u05D4\u05D9\u05E1\u05D8\u05D5\u05E8\u05D9\u05D4"],answer:"The scan finds API keys and passwords written in files (OpenAI, Anthropic, Supabase, AWS, Stripe, database URLs and more) and, with git_history, in past commits too \u2014 including ones deleted since. nodata_plan then lists, per provider, where to replace each key, which is the step that stops its use."},{id:"send",topics:["send","share","link","burn","revoke","expire","recipient","\u05DC\u05E9\u05DC\u05D5\u05D7","\u05DC\u05E9\u05EA\u05E3","\u05E7\u05D9\u05E9\u05D5\u05E8","\u05DC\u05D1\u05D8\u05DC","\u05DC\u05E9\u05E8\u05D5\u05E3","\u05E0\u05DE\u05E2\u05DF"],answer:"nodata_send shares a file as a governed link (or, with to:<NoData address>, over the NoData road \u2014 see fabric): encrypted on this computer, stored by NoData only as ciphertext, with the key in the part of the link NoData never receives. It expires after a time and a number of opens; nodata_link_status shows opens so far; nodata_burn cancels it for good, with a signed receipt. With code:true (or your own code of 8+ letters) the link opens only together with a code you send on a different channel; the recipient types it and their browser checks it, and NoData never receives it \u2014 a forwarded link alone opens nothing."},{id:"fabric",topics:["fabric","road","network","address","partner","organisation","organization","other company","inbox","mcp to mcp","\u05E4\u05D1\u05E8\u05D9\u05E7","\u05E8\u05E9\u05EA","\u05DB\u05EA\u05D5\u05D1\u05EA","\u05E9\u05D5\u05EA\u05E3","\u05D0\u05E8\u05D2\u05D5\u05DF \u05D0\u05D7\u05E8","\u05D7\u05D1\u05E8\u05D4 \u05D0\u05D7\u05E8\u05EA","\u05EA\u05D9\u05D1\u05D4","\u05D3\u05D5\u05D0\u05E8 \u05E0\u05DB\u05E0\u05E1","\u05D1\u05D9\u05DF \u05D0\u05E8\u05D2\u05D5\u05E0\u05D9\u05DD"],answer:"The NoData road (Fabric) connects this computer to other organisations with no link to leak. nodata_inbox (action 'address') makes this computer's address: a key pair made here, the private half never leaves it (~/.nodata/fabric-key.json), NoData knows only its fingerprint. A partner sends with nodata_send to:<address> \u2014 or to your email once your computers are on the road, and it reaches each of them \u2014 (or from the console); it is sealed on their computer to yours, NoData stores ciphertext only, and a proof is written on both organisations' chains before anything moves. nodata_inbox 'list' shows what arrived, 'open' unseals it here into a folder without showing its content to the agent."},{id:"fabric-plate",topics:["who can send","who can reach","approve","block","spam","unknown sender","plate","policy","disclose","\u05DE\u05D9 \u05D9\u05DB\u05D5\u05DC \u05DC\u05E9\u05DC\u05D5\u05D7","\u05DC\u05D0\u05E9\u05E8","\u05DC\u05D7\u05E1\u05D5\u05DD","\u05E9\u05D5\u05DC\u05D7 \u05DC\u05D0 \u05DE\u05D5\u05DB\u05E8","\u05DC\u05D5\u05D7\u05D9\u05EA","\u05DE\u05D3\u05D9\u05E0\u05D9\u05D5\u05EA","\u05DC\u05D7\u05E9\u05D5\u05E3","\u05DE\u05D4 \u05E8\u05D5\u05D0\u05D9\u05DD \u05E2\u05DC\u05D9\u05D9"],answer:"Your address carries a plate \u2014 its policy, changeable any time with nodata_inbox action 'policy': open, verified (a first message from an unknown organisation waits, still sealed, until you approve or block it) or closed (only your allow list); allow and block lists; whether a sender must declare a purpose; and what senders learn about you (organisation name, only 'verified', or just the address). nodata_inbox 'approve' admits a waiting sender and delivers what it sent; 'block' refuses it and shreds what it sent, unread. Every decision is on both sides' proof chains, and each asks you first."},{id:"file-folder-rules",topics:["rules","rule","folder rules","file rules","folder policy","per folder","per file","agent may","block folder","\u05D7\u05D5\u05E7\u05D9\u05DD","\u05DB\u05DC\u05DC\u05D9\u05DD","\u05DE\u05D3\u05D9\u05E0\u05D9\u05D5\u05EA \u05DC\u05EA\u05D9\u05E7\u05D9\u05D9\u05D4"],answer:"nodata_rules is the board of rules for each file and folder on this computer: what an AI agent may do there \u2014 allowed, ask you, clean copy only (it works on a nodata_redact copy), or not allowed \u2014 with several rules per path and conditions on the action (read, search, run, write), the hour, the weekday and the file type. The most specific path decides; among its rules, the first whose conditions hold. The read gate enforces them on every read, search, command and write, whatever the agent. Tightening is a preview then confirm; allowing a path, or removing a restriction, needs your own approval. The rules are signed on this computer: changed by hand, every path they name is closed until you save them again. Your organisation can also set folder rules for every computer (in the browser: the capsule page \u2192 the organisation's folder rules); they arrive with its policy, and on your computer the stricter of its rule and yours wins. For keys, each key has its own rules in the vault (Courier \u2192 secrets \u2192 key policy board), applied by nodata_run."},{id:"access-not-copies",topics:["access instead","not send","without sending","ownership","copy","query","share data","expose","folder","partner ask","\u05D2\u05D9\u05E9\u05D4","\u05D1\u05DC\u05D9 \u05DC\u05E9\u05DC\u05D5\u05D7","\u05D1\u05E2\u05DC\u05D5\u05EA","\u05D4\u05E2\u05EA\u05E7","\u05DC\u05E9\u05EA\u05E3 \u05DE\u05D9\u05D3\u05E2","\u05DC\u05D7\u05E9\u05D5\u05E3","\u05D7\u05E9\u05D9\u05E4\u05D4","\u05EA\u05D9\u05E7\u05D9\u05D9\u05D4","\u05DC\u05EA\u05EA \u05D2\u05D9\u05E9\u05D4"],answer:"Most sharing should be access, not a copy. For files on this computer: nodata_expose lets a partner's computer ask for files in a folder you choose \u2014 it gets the verified clean copy of each file it asks for (identifiers replaced, checked before it leaves), only while the rule lives, and you stop it at once; they ask with nodata_inbox action 'ask'. For your tables: the other side's agent gets a scoped grant (nodata_grant) and reads only the fields it is allowed (nodata_retrieve / nodata_read), cut at once with nodata_revoke. A file moves whole only when a copy must: nodata_send, as a governed link or over the NoData road."},{id:"archive",topics:["archive","wrap","backup","recovery","12 words","lost","\u05D0\u05E8\u05DB\u05D9\u05D5\u05DF","\u05D2\u05D9\u05D1\u05D5\u05D9","\u05E9\u05D7\u05D6\u05D5\u05E8","12 \u05DE\u05D9\u05DC\u05D9\u05DD","\u05D0\u05D1\u05D3"],answer:"nodata_wrap archives files encrypted on this computer to your organisation's 12-word key; only ciphertext is uploaded, and only your 12 words (or recovery file) open it \u2014 even if this computer is lost."},{id:"key-backup",topics:["device key","back up","backup","usb","lost computer","\u05DE\u05E4\u05EA\u05D7 \u05D4\u05DE\u05DB\u05E9\u05D9\u05E8","\u05DE\u05E4\u05EA\u05D7","\u05D2\u05D9\u05D1\u05D5\u05D9","\u05DC\u05D2\u05D1\u05D5\u05EA","\u05DE\u05D2\u05D1\u05D9\u05DD","\u05DE\u05D2\u05D1\u05D4","\u05D3\u05D9\u05E1\u05E7 \u05D0\u05D5\u05DF \u05E7\u05D9"],answer:"Locked files open on the computer that sealed them, with its device key. Back it up once, in a terminal: npx -y @nodatachat/mcp@latest key-backup E: (E: is your USB drive): it copies the key, checks the copy is identical, and records the backup."},{id:"agents-data",topics:["agent","agents","database","table","grant","access","columns","revoke","ai","\u05E1\u05D5\u05DB\u05E0\u05D9\u05DD","\u05D8\u05D1\u05DC\u05D4","\u05DE\u05E1\u05D3","\u05D4\u05E8\u05E9\u05D0\u05D4","\u05D2\u05D9\u05E9\u05D4","\u05E2\u05DE\u05D5\u05D3\u05D5\u05EA"],answer:"AI agents get exactly what you allow over your own tables: nodata_register_table declares the sensitive columns, nodata_grant gives one agent a scoped grant (after your approval), nodata_policy shows every agent and what it can reach, and nodata_revoke cuts it at once. An agent asks with nodata_decide, pulls allowed fields with nodata_retrieve, and denied columns never decrypt."},{id:"proofs",topics:["proof","proofs","receipt","audit","verify","evidence","\u05D4\u05D5\u05DB\u05D7\u05D4","\u05D4\u05D5\u05DB\u05D7\u05D5\u05EA","\u05E7\u05D1\u05DC\u05D4","\u05D1\u05D9\u05E7\u05D5\u05E8\u05EA","\u05DC\u05D0\u05DE\u05EA"],answer:"nodata_proofs lists your organisation's signed proofs \u2014 every grant, agent read and denial \u2014 content-free. Anyone can verify one without an account at /api/access/verify. Locking, clean copies and cancelled links write their own receipts too."},{id:"start",topics:["start","install","connect","signup","setup","begin","\u05DC\u05D4\u05EA\u05D7\u05D9\u05DC","\u05DE\u05EA\u05D7\u05D9\u05DC\u05D9\u05DD","\u05D4\u05EA\u05E7\u05E0\u05D4","\u05D4\u05E8\u05E9\u05DE\u05D4","\u05D7\u05D9\u05D1\u05D5\u05E8"],answer:"Accept the terms once (nodata_terms) and scanning, locking and clean copies work on this computer. For the organisation tools (agents, sending, proofs) call nodata_connect: a page opens in your browser, you sign in (or create a free account) and click Approve \u2014 nothing to copy. Then type /mcp."}],nv=vf("sha256").update(JSON.stringify(Sf)).digest("hex").slice(0,12);function QD(e,t){return e.topics.reduce((n,r)=>n+(t.includes(r.toLowerCase())?1:0),0)}function eO(e){let t=` ${e.toLowerCase()} `,r=Sf.map(o=>({a:o,s:QD(o,t)})).filter(o=>o.s>0).sort((o,i)=>i.s-o.s).filter(o=>o.a.id!=="overview").slice(0,3).map(o=>o.a);return r.length?r:[Sf[0]]}var kf=()=>tv(ev(),".nodata","answers.log");function tO(e){let t="genesis";try{let r=YD(kf())?ZD(kf(),"utf8").trimEnd().split(`
 `):[],o=r[r.length-1];o&&(t=vf("sha256").update(o).digest("hex").slice(0,16))}catch{}let n=JSON.stringify({at:new Date().toISOString(),entries:e,bank:nv,prev:t});try{XD(tv(ev(),".nodata"),{recursive:!0}),JD(kf(),n+`
 `,{mode:384})}catch{}return vf("sha256").update(n).digest("hex").slice(0,16)}function rv(e){let t=eO(e),n=tO(t.map(r=>r.id));return["ANSWER FROM THE NODATA ANSWER BANK \u2014 relay this in the user's language, and nothing beyond it:","",...t.map(r=>`\u2022 ${r.answer}`),"",`Source: NoData answer bank ${nv} \xB7 entries: ${t.map(r=>r.id).join(", ")} \xB7 recorded ${n} in ~/.nodata/answers.log`].join(`
-`)}Jd();import{existsSync as cv,mkdirSync as nO,readFileSync as rO,writeFileSync as oO}from"node:fs";import{homedir as Af}from"node:os";import{join as $f}from"node:path";var iO=60*6e4;function sO(e){try{return process.kill(e,0),!0}catch(t){return t.code==="EPERM"}}var xf=()=>$f(Af(),".nodata","connection.json"),aO=()=>$f(Af(),".nodata","pending-link.json"),Ef=6e4,ov=15*Ef,iv=[3e4,2*Ef,5*Ef];function sv(e,t){switch(e.connection){case"connected":return{state:"connected"};case"unstable":case"offline":return{state:"reconnecting"};case"restart":return{state:"restart",step:"/mcp"};case"not-connected":return t?{state:"waiting"}:{state:"local"};case"reconnect":return t?{state:"waiting"}:{state:"needs-you",step:e.refused==="org-has-no-key"?"console \u2192 API keys":e.refused==="flag-key"||e.refused==="env-key"?"remove the old key":"nodata_connect"}}}function ol(e,t=new Date){try{nO($f(Af(),".nodata"),{recursive:!0});let n=t.toISOString(),r={};for(let[o,i]of Object.entries(cO()?.versions??{}))t.getTime()-Date.parse(i.at)<iO&&sO(Number(o))&&(r[o]=i);e.version&&(r[String(process.pid)]={version:e.version,at:n}),oO(xf(),JSON.stringify({...e,...Object.keys(r).length?{versions:r}:{},at:n}),{mode:384})}catch{}}function cO(){try{return cv(xf())?JSON.parse(rO(xf(),"utf8")):null}catch{return null}}var av=()=>cv(aO());function lO(e,t){return e==="reconnecting"?iv[Math.min(t,iv.length-1)]??ov:e==="waiting"?3e4:ov}function lv(e,t,n,r){let o=0,i=n?{version:n}:{},s=sv(t,av());ol({...s,...i});let a=null,c=()=>{a=setTimeout(l,lO(s.state,o)),a.unref?.()},l=async()=>{try{let d=sv(await e(),av());o=d.state==="reconnecting"?o+1:0,(d.state!==s.state||d.step!==s.step)&&r?.(d),s=d,ol({...d,...i})}catch{o+=1}c()};return c(),()=>{a&&clearTimeout(a)}}Et();import{homedir as gO}from"node:os";import{join as pv,resolve as il}from"node:path";import{existsSync as Rf,readFileSync as Of,writeFileSync as mO,mkdirSync as yO}from"node:fs";import{spawn as sl,spawnSync as wv}from"node:child_process";import{generateKeyPairSync as _O,createPrivateKey as bO,sign as wO,randomBytes as kO}from"node:crypto";var sn="1.5.0";function al(e=process.cwd()){try{let t=xt(e),n=t?ld(t):null;if(!n||!Rf(n))return null;let r=JSON.parse(Of(n,"utf8"));if(!r)return null;let o=r.device&&typeof r.device.private_key_pkcs8_b64=="string",i=typeof r.api_key=="string"&&r.api_key;return o||i?r:null}catch{return null}}function Nf(e,t=process.cwd()){let n=cd(e);if(!n)throw new Error("nothing to save: no organisation in the credential");Rg(n,e),t&&Ng(t,n)}var vO=`nodata-mcp v${sn} \u2014 NoData MCP server
+`)}Jd();import{existsSync as cv,mkdirSync as nO,readFileSync as rO,writeFileSync as oO}from"node:fs";import{homedir as Af}from"node:os";import{join as $f}from"node:path";var iO=60*6e4;function sO(e){try{return process.kill(e,0),!0}catch(t){return t.code==="EPERM"}}var xf=()=>$f(Af(),".nodata","connection.json"),aO=()=>$f(Af(),".nodata","pending-link.json"),Ef=6e4,ov=15*Ef,iv=[3e4,2*Ef,5*Ef];function sv(e,t){switch(e.connection){case"connected":return{state:"connected"};case"unstable":case"offline":return{state:"reconnecting"};case"restart":return{state:"restart",step:"/mcp"};case"not-connected":return t?{state:"waiting"}:{state:"local"};case"reconnect":return t?{state:"waiting"}:{state:"needs-you",step:e.refused==="org-has-no-key"?"console \u2192 API keys":e.refused==="flag-key"||e.refused==="env-key"?"remove the old key":"nodata_connect"}}}function ol(e,t=new Date){try{nO($f(Af(),".nodata"),{recursive:!0});let n=t.toISOString(),r={};for(let[o,i]of Object.entries(cO()?.versions??{}))t.getTime()-Date.parse(i.at)<iO&&sO(Number(o))&&(r[o]=i);e.version&&(r[String(process.pid)]={version:e.version,at:n}),oO(xf(),JSON.stringify({...e,...Object.keys(r).length?{versions:r}:{},at:n}),{mode:384})}catch{}}function cO(){try{return cv(xf())?JSON.parse(rO(xf(),"utf8")):null}catch{return null}}var av=()=>cv(aO());function lO(e,t){return e==="reconnecting"?iv[Math.min(t,iv.length-1)]??ov:e==="waiting"?3e4:ov}function lv(e,t,n,r){let o=0,i=n?{version:n}:{},s=sv(t,av());ol({...s,...i});let a=null,c=()=>{a=setTimeout(l,lO(s.state,o)),a.unref?.()},l=async()=>{try{let d=sv(await e(),av());o=d.state==="reconnecting"?o+1:0,(d.state!==s.state||d.step!==s.step)&&r?.(d),s=d,ol({...d,...i})}catch{o+=1}c()};return c(),()=>{a&&clearTimeout(a)}}Et();import{homedir as gO}from"node:os";import{join as pv,resolve as il}from"node:path";import{existsSync as Rf,readFileSync as Of,writeFileSync as mO,mkdirSync as yO}from"node:fs";import{spawn as sl,spawnSync as wv}from"node:child_process";import{generateKeyPairSync as _O,createPrivateKey as bO,sign as wO,randomBytes as kO}from"node:crypto";var sn="1.5.1";function al(e=process.cwd()){try{let t=xt(e),n=t?ld(t):null;if(!n||!Rf(n))return null;let r=JSON.parse(Of(n,"utf8"));if(!r)return null;let o=r.device&&typeof r.device.private_key_pkcs8_b64=="string",i=typeof r.api_key=="string"&&r.api_key;return o||i?r:null}catch{return null}}function Nf(e,t=process.cwd()){let n=cd(e);if(!n)throw new Error("nothing to save: no organisation in the credential");Rg(n,e),t&&Ng(t,n)}var vO=`nodata-mcp v${sn} \u2014 NoData MCP server
   ADMIN mode:  nodata-mcp --api-key sk_live_...
   AGENT mode:  nodata-mcp --grant-token ndca-...

package/dist/status.js CHANGED Viewed

@@ -1,2 +1,2 @@
-/*! @nodatachat/mcp 1.5.0 | Copyright 2026 Capsule Ltd. | FSL-1.1-ALv2 | see LICENSE.md */
+/*! @nodatachat/mcp 1.5.1 | Copyright 2026 Capsule Ltd. | FSL-1.1-ALv2 | see LICENSE.md */
 import{execSync as vn}from"node:child_process";import{existsSync as xn,readFileSync as Z}from"node:fs";import{existsSync as T,mkdirSync as Dn,readdirSync as X,readFileSync as nn,rmSync as An,writeFileSync as Rn,chmodSync as Bn}from"node:fs";import{homedir as L}from"node:os";import{basename as Mn,isAbsolute as en,join as u,relative as tn,resolve as rn}from"node:path";var g=()=>u(L(),".nodata"),on=()=>u(g(),"credentials.json"),b=()=>u(g(),"orgs"),sn=()=>u(g(),"bindings.json"),ln=/^[A-Za-z0-9_.-]{1,80}$/,v=n=>ln.test(n)&&n!=="."&&n!=="..";function F(n){try{return T(n)?JSON.parse(nn(n,"utf8")):null}catch{return null}}function cn(n){return n?n.device?.org_id?n.device.org_id:n.api_key?`key-${(n.key_prefix??n.api_key.slice(0,12)).replace(/[^A-Za-z0-9_-]/g,"")}`:null:null}function E(){return cn(F(on()))}function m(){let n=[],t=E();t&&n.push(t);try{for(let e of X(b()))v(e)&&!n.includes(e)&&T(u(b(),e,"credentials.json"))&&n.push(e)}catch{}return n}function an(n){return n===E()?g():v(n)?u(b(),n):null}var un=n=>process.platform==="win32"||process.platform==="darwin"?n.toLowerCase():n,h=n=>un(rn(n.replace(/^~(?=[\\/]|$)/,L())));function dn(n,t){let e=tn(h(n),h(t));return e===""||!e.startsWith("..")&&!en(e)}function D(){let n=F(sn());return(Array.isArray(n?.bindings)?n.bindings:[]).filter(e=>!!e&&typeof e.folder=="string"&&typeof e.org_id=="string"&&v(e.org_id)).map(e=>e.project===void 0||hn(e.project)===e.project?e:{...e,project:void 0}).map(e=>e.client===void 0||typeof e.client?.org_id=="string"&&fn.test(e.client.org_id)?e:{...e,client:void 0})}var fn=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function gn(n,t=D()){let e=null;for(let s of t)dn(s.folder,n)&&(!e||h(s.folder).length>h(e.folder).length)&&(e=s);return e}function x(n,t=m(),e=D()){if(t.length===0)return{kind:"none"};let s=gn(n,e.filter(c=>t.includes(c.org_id)));return s?{kind:"bound",org_id:s.org_id,folder:s.folder}:t.length===1?{kind:"only",org_id:t[0]}:{kind:"unbound",orgs:t}}function pn(n){let t=x(n);return t.kind==="bound"||t.kind==="only"?t.org_id:null}function hn(n){if(typeof n!="string")return null;let t=n.trim();return t&&t.length<=120&&!/[\u0000-\u001f\\/]/.test(t)?t:null}function A(n,t=process.cwd()){if(m().length===0)return g();let e=n??pn(t);return e?an(e):null}import{homedir as Sn}from"node:os";import{join as d}from"node:path";var R=["\u{1F7E3}","\u{1F535}","\u{1F7E0}","\u{1F7E4}","\u{1F7E1}"];function mn(n){let t=0;for(let e of n)t=t*31+e.codePointAt(0)>>>0;return R[t%R.length]}function B(n,t){let e=(n||"agent").toLowerCase().replace(/[^a-z0-9._-]+/g,"-").slice(0,40);return t?`${e}@${t}`:e}function J(n){return`${mn(n)} ${n}`}var P="2026-09-24-v3";import{existsSync as $n,mkdirSync as Kn,readFileSync as _n,writeFileSync as Un}from"node:fs";import{homedir as yn}from"node:os";import{join as jn}from"node:path";var M=()=>jn(yn(),".nodata","prefs.json");function kn(){try{let n=$n(M())?JSON.parse(_n(M(),"utf8")).lang:null;return n==="he"||n==="en"?n:null}catch{return null}}function wn(){let t=process.env.LC_ALL||process.env.LC_MESSAGES||process.env.LANG||"";try{t||=Intl.DateTimeFormat().resolvedOptions().locale}catch{}return/^(he|iw)(?:[-_.@]|$)/i.test(t)?"he":"en"}function bn(){return kn()??wn()}function r(n,t,e=bn()){return e==="he"?n:t}var On="\x1B[32m",a="\x1B[33m",w="\x1B[31m",N="\x1B[2m",i="\x1B[0m";function f(n){try{return xn(n)?JSON.parse(Z(n,"utf8")):null}catch{return null}}var C="";try{C=Z(0,"utf8")}catch{}var p=Sn(),Nn=f(d(p,".claude","settings.json")),I=(Nn?.hooks?.PreToolUse??[]).flatMap(n=>n.hooks??[]).find(n=>n.command.includes("gate.mjs"))?.command,S=I?I.includes("--block")?"block":"ask":null,Cn=f(d(p,".nodata","consent.json")),Tn=Cn?.terms_version===P,q=f(d(p,".nodata","credentials.json")),Ln=B("claude-code",q?.device?.label),o=[],_;Tn?S?(_=On,o.push(r(`\u05E9\u05E2\u05E8 ${S==="block"?"\u05D7\u05D5\u05E1\u05DD":"\u05E9\u05D5\u05D0\u05DC"}`,`gate ${S}`),r("\u05EA\u05E0\u05D0\u05D9\u05DD \u2713","terms \u2713"))):(_=a,o.push(r("\u05E9\u05E2\u05E8 \u05DB\u05D1\u05D5\u05D9","gate off"))):(_=w,o.push(r("\u05EA\u05E0\u05D0\u05D9 \u05E9\u05D9\u05DE\u05D5\u05E9 \u05DC\u05D0 \u05D0\u05D5\u05E9\u05E8\u05D5 \u2014 nodata_terms","terms not accepted \u2014 nodata_terms")));var l=f(d(p,".nodata","connection.json")),z=l?.at?Date.now()-Date.parse(l.at)<60*6e4:!1,H=`${a}${r("\u05DC\u05D0 \u05DE\u05D7\u05D5\u05D1\u05E8","not connected")}${i}`;z&&l?.state==="waiting"?o.push(`${a}${r("\u05DE\u05DE\u05EA\u05D9\u05DF \u05DC\u05D0\u05D9\u05E9\u05D5\u05E8","waiting for approval")}${i}`):q?!l||!z?o.push(`${a}${r("\u05D7\u05D9\u05D1\u05D5\u05E8 \u05DC\u05D0 \u05E0\u05D1\u05D3\u05E7","connection not checked")}${i}`):l.state==="connected"?o.push(r("\u05DE\u05D7\u05D5\u05D1\u05E8 \u2713","connected \u2713")):l.state==="reconnecting"?o.push(`${a}${r("\u05DE\u05EA\u05D7\u05D1\u05E8 \u05DE\u05D7\u05D3\u05E9\u2026","reconnecting\u2026")}${i}`):l.state==="restart"?o.push(`${a}${r("\u05D0\u05D5\u05E9\u05E8 \u2014 \u05D4\u05E7\u05DC\u05D3 /mcp","approved \u2014 type /mcp")}${i}`):l.state==="needs-you"?o.push(`${w}${r("\u05DC\u05D0 \u05DE\u05D7\u05D5\u05D1\u05E8","not connected")} \u2192 ${l.step??"nodata_connect"}${i}`):o.push(H):o.push(H);var G=m(),y=process.cwd();try{let n=JSON.parse(C);y=n.workspace?.current_dir||n.cwd||y}catch{}if(G.length>1){let n=x(y,G);n.kind==="bound"||n.kind==="only"?o.push(`${r("\u05D0\u05E8\u05D2\u05D5\u05DF","org")} ${n.org_id.slice(0,8)}`):o.push(`${w}${r("\u05D4\u05EA\u05D9\u05E7\u05D9\u05D9\u05D4 \u05DC\u05D0 \u05E9\u05D5\u05D9\u05DB\u05D4 \u05DC\u05D0\u05E8\u05D2\u05D5\u05DF","folder bound to no org")}${i}`)}var K=A(null,y),$=K?f(d(K,"capsule.json")):null;if($){let n=$.last_heartbeat_ok_at?Date.parse($.last_heartbeat_ok_at):NaN,t=Number.isFinite(n)?Math.round((Date.now()-n)/6e4):1/0,e=s=>s<120?r(`${s} \u05D3'`,`${s}m`):r(`${Math.round(s/60)} \u05E9'`,`${Math.round(s/60)}h`);$.revoked?o.push(`${w}${r('\u05D4\u05E6\u05D5\u05DE\u05EA \u05D4\u05D5\u05E9\u05D4\u05D4 \u05E2"\u05D9 \u05D4\u05D0\u05E8\u05D2\u05D5\u05DF',"node paused by org")}${i}`):t<=15?o.push(`${r("\u05E6\u05D5\u05DE\u05EA","node")} \u2713 ${t<1?r("\u05E2\u05DB\u05E9\u05D9\u05D5","now"):e(t)}`):o.push(`${a}${r("\u05E6\u05D5\u05DE\u05EA \u05DC\u05D0 \u05D0\u05D5\u05DE\u05EA","node not verified")}${Number.isFinite(t)?` ${e(t)}`:""}${i}`)}o.push(J(Ln));var U=n=>n.split(".").map(Number),Y=(n,t)=>{let[e,s]=[U(n),U(t)];for(let c=0;c<3;c++)if(e[c]!==s[c])return e[c]>s[c];return!1},Q=[...new Set(Object.values(l?.versions??{}).map(n=>n.version).concat(l?.version??[]))].filter(n=>/^\d+\.\d+\.\d+$/.test(n)),j=Q.reduce((n,t)=>!n||Y(t,n)?t:n,null),O=Q.filter(n=>j&&Y(j,n)),Fn=j?` ${N}v${j}${i}${O.length?` ${a}${r(`(v${O.join(", v")} \u05D1\u05D7\u05DC\u05D5\u05DF \u05D0\u05D7\u05E8: /mcp)`,`(v${O.join(", v")} in another window: /mcp)`)}${i}`:""}`:"",V=`${_}\u25CF NoData${i}${Fn} ${N}\xB7${i} ${o.join(` ${N}\xB7${i} `)}`,W=f(d(p,".nodata","statusline-prev.json"))?.command,k="";if(W)try{k=vn(W,{input:C,timeout:2e3,encoding:"utf8"}).trim()}catch{k=""}process.stdout.write(k?`${k} \u2502 ${V}`:V);

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@nodatachat/mcp",
-  "version": "1.5.0",
+  "version": "1.5.1",
   "description": "NoData MCP server: connect any MCP client (Claude Code, Codex, Cursor, VS Code) to the NoData Information Access Processor. Governed access for AI agents, with a verifiable proof for every decision.",
   "bin": {
     "nodata-mcp": "dist/index.js"