@nodatachat/mcp 1.6.3 → 1.6.4

package/dist/scan-worker.js

@@ -1,4 +1,4 @@
-/*! @nodatachat/mcp 1.6.3 | Copyright 2026 Capsule Ltd. | FSL-1.1-ALv2 | see LICENSE.md */
+/*! @nodatachat/mcp 1.6.4 | Copyright 2026 Capsule Ltd. | FSL-1.1-ALv2 | see LICENSE.md */
 import{createRequire as __ndReq}from"node:module";const require=__ndReq(import.meta.url);
 import{parentPort as xt}from"node:worker_threads";import{createHash as go}from"node:crypto";import{closeSync as yo,existsSync as bo,openSync as _o,readSync as xo,readdirSync as Qn,readFileSync as wo,statSync as ft}from"node:fs";import{homedir as vo}from"node:os";import{basename as er,join as We}from"node:path";import{TextDecoder as lr}from"node:util";var J={text:[],header:[],secrets:[],table:null,amounts:null,severity:null};function vt(e){e.table&&(J.table=e.table),e.severity&&(J.severity=e.severity),e.amounts&&(J.amounts=e.amounts);for(let t of e.text??[])J.text.some(n=>n.kind===t.kind)||J.text.push(t);e.header&&!J.header.includes(e.header)&&J.header.push(e.header);for(let t of e.secrets??[])J.secrets.some(n=>n.id===t.id)||J.secrets.push(t)}function Ve(e){return J.severity?.(e)}function Xe(){return J.text}function on(){return J.header}function Re(){return J.table}function sn(){return J.secrets}var an=[{id:"aws-access-key",name:"AWS Access Key",pattern:/(?:^|[^A-Z0-9])AKIA[A-Z2-7]{16}(?:[^A-Z2-7]|$)/,severity:"critical"},{id:"aws-secret-key",name:"AWS Secret Key",pattern:/(?:aws_secret_access_key|aws_secret_key|secret_access_key)\s*[=:]\s*['"]?[A-Za-z0-9/+=]{40}['"]?/,severity:"critical"},{id:"gcp-api-key",name:"GCP API Key",pattern:/AIza[0-9A-Za-z_-]{35}/,severity:"critical"},{id:"gcp-service-account",name:"GCP Service Account",pattern:/"type"\s*:\s*"service_account"/,severity:"critical"},{id:"github-token",name:"GitHub Token",pattern:/gh[pousr]_[0-9a-zA-Z]{36,}/,severity:"critical"},{id:"github-fine-grained",name:"GitHub Fine-Grained Token",pattern:/github_pat_[0-9a-zA-Z_]{22,}/,severity:"critical"},{id:"gitlab-token",name:"GitLab Token",pattern:/glpat-[0-9a-zA-Z_-]{20,}/,severity:"critical"},{id:"stripe-secret",name:"Stripe Secret Key",pattern:/sk_live_[0-9a-zA-Z]{24,}/,severity:"critical"},{id:"stripe-restricted",name:"Stripe Restricted Key",pattern:/rk_live_[0-9a-zA-Z]{24,}/,severity:"critical"},{id:"slack-token",name:"Slack Token",pattern:/xox[baprs]-[0-9a-zA-Z-]{10,}/,severity:"high"},{id:"slack-webhook",name:"Slack Webhook",pattern:/hooks\.slack\.com\/services\/T[0-9A-Z]{8,}\/B[0-9A-Z]{8,}\/[0-9a-zA-Z]{24}/,severity:"high"},{id:"twilio-api-key",name:"Twilio API Key",pattern:/SK[0-9a-fA-F]{32}/,severity:"high"},{id:"sendgrid-api-key",name:"SendGrid API Key",pattern:/SG\.[0-9a-zA-Z_-]{22}\.[0-9a-zA-Z_-]{43}/,severity:"critical"},{id:"postgres-uri",name:"PostgreSQL Connection String",pattern:/postgres(?:ql)?:\/\/[^\s'"]{10,}/,severity:"critical"},{id:"mongodb-uri",name:"MongoDB Connection String",pattern:/mongodb(?:\+srv)?:\/\/[^\s'"]{10,}/,severity:"critical"},{id:"redis-uri",name:"Redis Connection String",pattern:/redis(?:s)?:\/\/[^\s'"]{10,}/,severity:"high"},{id:"openai-key",name:"OpenAI API Key",pattern:/sk-[0-9a-zA-Z]{20,}T3BlbkFJ[0-9a-zA-Z]{20,}/,severity:"critical"},{id:"openai-project-key",name:"OpenAI API Key",pattern:/sk-(?:proj|svcacct|admin)-[0-9A-Za-z_-]{40,}/,severity:"critical"},{id:"anthropic-key",name:"Anthropic API Key",pattern:/sk-ant-[0-9a-zA-Z_-]{40,}/,severity:"critical"},{id:"firebase-key",name:"Firebase API Key",pattern:/AIza[0-9A-Za-z_-]{35}/,severity:"high"},{id:"supabase-key",name:"Supabase Service Key",pattern:/eyJ[0-9a-zA-Z_-]{100,}/,severity:"critical"},{id:"supabase-access-token",name:"Supabase Access Token",pattern:/\bsbp_[0-9a-f]{40}\b/,severity:"critical"},{id:"supabase-secret-key",name:"Supabase Secret Key",pattern:/\bsb_secret_[0-9A-Za-z_-]{20,}/,severity:"critical"},{id:"private-key",name:"Private Key",pattern:/-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/,severity:"critical"},{id:"jwt-secret",name:"JWT/Generic Secret",pattern:/(?:jwt_secret|JWT_SECRET|secret_key|SECRET_KEY|api_secret|API_SECRET)\s*[=:]\s*['"][^'"]{8,}['"]/,severity:"high"},{id:"password-in-code",name:"Password in Code",pattern:/(?:password|passwd|pwd)\s*[=:]\s*['"][^'"]{8,}['"]/,severity:"high"},{id:"bearer-token",name:"Bearer Token in Code",pattern:/['"]Bearer\s+[0-9a-zA-Z._-]{20,}['"]/,severity:"high"}];function Et(){let e=sn().filter(t=>!an.some(n=>n.id===t.id));return[...an,...e]}var cn=/node_modules\/|\.next\/|\.test\.|\.spec\.|__tests__\/|\.nodata-proof\.json$|\.git\//,ln=/(^|\/)\.env(\.[\w-]+)*\.(example|sample|template|dist)$|\.(example|sample|template)$|(^|\/)[^/]*\.(example|sample)\.[a-z0-9]+$/i,At=/(^|\/)(__tests__|__mocks__|tests?|spec|fixtures?|mocks?|samples?|examples?|demo|testdata)(\/|$)|\.(test|spec)\.[a-z0-9]+$|\.min\.(m?js|css)$|(^|\/)[^/]*\.worker\.min\.m?js$/i,Or=[{name:"lodash",below:"4.17.21",severity:"critical",cve:"CVE-2021-23337",desc:"Command injection via template"},{name:"minimist",below:"1.2.6",severity:"critical",cve:"CVE-2021-44906",desc:"Prototype pollution"},{name:"json5",below:"2.2.2",severity:"high",cve:"CVE-2022-46175",desc:"Prototype pollution"},{name:"express",below:"4.19.2",severity:"high",cve:"CVE-2024-29041",desc:"Open redirect"},{name:"path-to-regexp",below:"6.3.0",severity:"high",cve:"CVE-2024-45296",desc:"ReDoS"},{name:"sanitize-html",below:"2.12.1",severity:"high",cve:"CVE-2024-21501",desc:"XSS bypass"},{name:"dompurify",below:"3.0.9",severity:"high",cve:"CVE-2024-45801",desc:"mXSS"},{name:"jsonwebtoken",below:"9.0.0",severity:"critical",cve:"CVE-2022-23529",desc:"Key confusion attack"},{name:"jose",below:"4.15.5",severity:"high",cve:"CVE-2024-28176",desc:"DoS via JWE"},{name:"axios",below:"1.6.0",severity:"high",cve:"CVE-2023-45857",desc:"CSRF cookie leak"},{name:"node-fetch",below:"2.6.7",severity:"high",cve:"CVE-2022-0235",desc:"Header leak on redirect"},{name:"serialize-javascript",below:"6.0.2",severity:"critical",cve:"CVE-2024-11831",desc:"XSS via serialization"},{name:"xml2js",below:"0.6.0",severity:"high",cve:"CVE-2023-0842",desc:"Prototype pollution"},{name:"next",below:"14.1.1",severity:"high",cve:"CVE-2024-34350",desc:"SSRF via headers"},{name:"sharp",below:"0.32.6",severity:"high",cve:"CVE-2023-4863",desc:"libwebp heap overflow"},{name:"multer",below:"1.4.5",severity:"high",cve:"CVE-2022-24434",desc:"Prototype pollution"},{name:"tough-cookie",below:"4.1.3",severity:"medium",cve:"CVE-2023-26136",desc:"Prototype pollution"},{name:"semver",below:"7.5.4",severity:"medium",cve:"CVE-2022-25883",desc:"ReDoS"},{name:"ip",below:"2.0.1",severity:"critical",cve:"CVE-2024-29415",desc:"SSRF bypass via octal IP"},{name:"tar",below:"6.2.1",severity:"high",cve:"CVE-2024-28863",desc:"DoS via path traversal"}];function Dr(e,t){let n=o=>o.replace(/^[^0-9]*/,"").split(".").map(s=>parseInt(s,10)||0),r=n(e),i=n(t);for(let o=0;o<3;o++){if((r[o]||0)<(i[o]||0))return!0;if((r[o]||0)>(i[o]||0))return!1}return!1}function un(e){let t=[],n;try{n=JSON.parse(e)}catch{return t}let r={...n.dependencies??{},...n.devDependencies??{}};for(let[i,o]of Object.entries(r)){let s=(o||"").replace(/^[\^~>=<\s]+/,""),a=Or.find(l=>l.name===i&&Dr(s,l.below));a&&t.push({name:i,version:s,vuln:a})}return t}var Nr=[{pattern:/^(full_?name|first_?name|last_?name|spouse_?name|beneficiary_?name)$/i,type:"name",label:"Person name"},{pattern:/^(email|e_?mail|email_?address)$/i,type:"email",label:"Email address"},{pattern:/^(phone|mobile|telephone|phone_?number|cell_?phone)$/i,type:"phone",label:"Phone number"},{pattern:/^(id_?number|identity|ssn|social_?security|national_?id|teudat_?zehut)$/i,type:"id",label:"ID number"},{pattern:/^(address|street_?address|home_?address)$/i,type:"address",label:"Address"},{pattern:/^(date_?of_?birth|dob|birth_?date|birthday)$/i,type:"dob",label:"Date of birth"},{pattern:/^(bank_?account|iban|account_?number|bank_?details|routing_?number)$/i,type:"financial",label:"Bank account"},{pattern:/^(credit_?card|card_?number|cvv|cc_?number)$/i,type:"financial",label:"Credit card"},{pattern:/^(salary|income|commission|premium|compensation)$/i,type:"financial",label:"Salary / income"},{pattern:/^(medical_?info|health_?conditions|diagnosis|medication|prescription)$/i,type:"medical",label:"Medical"},{pattern:/^(passport|passport_?number|passport_?id)$/i,type:"id",label:"Passport"},{pattern:/^(driver_?license|drivers_?license|dl_?number)$/i,type:"id",label:"Driver license"},{pattern:/^(tax_?id|tin|vat_?number|ein)$/i,type:"financial",label:"Tax ID"},{pattern:/^(insurance_?number|policy_?number|member_?id)$/i,type:"id",label:"Insurance/Policy"},{pattern:/^(biometric|fingerprint|face_?id|retina)$/i,type:"biometric",label:"Biometric"},{pattern:/^(latitude|longitude|lat|lng|geo_?location|coordinates)$/i,type:"location",label:"Geolocation"}],Fr=[{pattern:/^(?:שם|שם_מלא|שם פרטי|שם_פרטי|שם משפחה|שם_משפחה|שם הלקוח|שם בן זוג|שם המבוטח|שם המוטב|שם הילד|שם הקטין)$/i,type:"name",label:"\u05E9\u05DD \u05D0\u05D3\u05DD"},{pattern:/^(?:ת"ז|ת\.ז|ת ז|תז|תעודת זהות|תעודת_זהות|מספר זהות|מס' זהות|teudat_zehut|tz|israeli_id|il_id)$/i,type:"id",label:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA"},{pattern:/^(?:דרכון|מספר דרכון|רישיון נהיגה|רישיון_נהיגה|רשיון נהיגה)$/i,type:"id",label:"\u05D3\u05E8\u05DB\u05D5\u05DF/\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF"},{pattern:/^(?:מייל|דוא"ל|דוא_ל|דואר אלקטרוני|אימייל|כתובת מייל)$/i,type:"email",label:"\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9"},{pattern:/^(?:טלפון|טל'|נייד|פלאפון|סלולרי|מספר טלפון|טלפון נייד)$/i,type:"phone",label:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF"},{pattern:/^(?:כתובת|כתובת מגורים|רחוב|מס בית|עיר|ישוב|יישוב|מיקוד|כתובת מלאה|מען)$/i,type:"address",label:"\u05DB\u05EA\u05D5\u05D1\u05EA"},{pattern:/^(?:תאריך לידה|ת לידה|תאריך הולדת|יום הולדת|גיל)$/i,type:"dob",label:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"},{pattern:/^(?:חשבון בנק|מספר חשבון|מס חשבון|סניף|iban|iban_il)$/i,type:"financial",label:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7"},{pattern:/^(?:כרטיס אשראי|מספר אשראי|cvv|אשראי)$/i,type:"financial",label:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"},{pattern:/^(?:שכר|משכורת|הכנסה|פרמיה|שכר ברוטו|שכר נטו|תגמול|בונוס|פיצוי)$/i,type:"financial",label:"\u05E9\u05DB\u05E8/\u05D4\u05DB\u05E0\u05E1\u05D4"},{pattern:/^(?:אבחון|אבחנה|מחלה|תרופה|מרשם|בדיקה רפואית|מצב רפואי|חיסון|רגישות|אלרגיה|סוג דם)$/i,type:"medical",label:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(?:מספר פוליסה|מס פוליסה|פוליסה|מספר חבר|מספר ביטוח)$/i,type:"id",label:"\u05E4\u05D5\u05DC\u05D9\u05E1\u05D4/\u05D7\u05D1\u05E8\u05D5\u05EA"},{pattern:/^(?:שם הילד|תעודת זהות של ילד|ילדים|קטין|מספר ילדים|תעודת לידה)$/i,type:"minor_data",label:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05DF"},{pattern:/^(?:דת|לאום|מין|נטייה מינית|השקפה פוליטית|מצב משפחתי|עדה|מוצא)$/i,type:"sensitive_personal",label:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9"},{pattern:/^(?:מספר רכב|מס רכב|לוחית רישוי|מספר רישוי)$/i,type:"tracking",label:"\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"}],Mr=/^(id|uuid|created_?at|updated_?at|deleted_?at|status|type|category|description|title|slug|url|path|key|value|enabled|active|public|version|metadata|config|settings|data|content|note|comment|label|color|icon)$/i,jr=/^שם[ _](?:ה)?(?:קובץ|מוצר|פריט|חברה|ארגון|עסק|פרויקט|גיליון|טבלה|שדה|קטגוריה|סניף|בנק|עיר|רחוב|ישוב|יישוב|מסמך|תוכנית|חבילה|קורס|מחלקה|אתר|דומיין|מותג|ספק|שירות|תפקיד)$|^(file|product|item|company|org|organization|project|sheet|table|field|category|branch|bank|city|street|document|plan|course|department|site|domain|brand|vendor|service|role)[ _-]?name$/i;function be(e){if(!e)return null;let t=e.trim();if(Mr.test(t)||/^name$/i.test(t)||/^\[[A-Z_]+(?:-\d+)?\]$/.test(t))return null;let n=t.replace(/[\s-]+/g,"_");for(let r of[...Fr,...Nr])if(r.pattern.test(t)||r.pattern.test(n))return{type:r.type,label:r.label};if(jr.test(t))return null;if(/^שם[ _][\u0590-\u05FF"'׳ ]{2,20}$/.test(t))return{type:"name",label:"\u05E9\u05DD \u05D0\u05D3\u05DD"};if(/^(customer|client|employee|inspector|supervisor|contact|person|patient|user|owner|manager|agent|member|driver|tenant|student|parent|beneficiary|insured)_?(full_?)?name$/i.test(n))return{type:"name",label:"Person name"};for(let r of on()){let i=r(t);if(i)return{type:i.type,label:i.label}}return null}var Ge={id:"critical",financial:"critical",medical:"critical",biometric:"critical",minor_data:"critical",sensitive_personal:"critical",email:"high",phone:"high",name:"high",address:"high",dob:"high",tracking:"medium",location:"high",auth:"critical",employment:"medium",education:"medium",behavior:"high"};function Ze(e){let t=String(e??"").replace(/\D/g,"");if(t.length===0||t.length>9)return!1;let n=t.padStart(9,"0"),r=0;for(let i=0;i<9;i++){let o=parseInt(n[i]??"0",10)*(i%2+1);o>9&&(o-=9),r+=o}return r%10===0&&parseInt(n,10)>0}var It=/(?:\+972[\s-]?|0)(?:5[0-9]|[2-4]|[89])(?:[\s-]?\d){7}/g;var Le=/\bIL\d{2}\s?(?:\d{4}\s?){4}\d{3}\b/g;function Hr(e){let t=String(e??"").replace(/\D/g,"");if(t.length<12||t.length>19)return!1;let n=0,r=!1;for(let i=t.length-1;i>=0;i-=1){let o=parseInt(t[i]??"0",10);r&&(o*=2,o>9&&(o-=9)),n+=o,r=!r}return n%10===0}function Ur(e){let t=String(e??"").replace(/\s/g,"").toUpperCase();if(!/^[A-Z]{2}\d{2}[A-Z0-9]{10,30}$/.test(t))return!1;let n=t.slice(4)+t.slice(0,4),r=0;for(let i of n){let o=i>="A"&&i<="Z"?String(i.charCodeAt(0)-55):i;for(let s of o)r=(r*10+Number(s))%97}return r===1}var kt="(?<!\\d)(?<!\\d[.,])",St="(?!\\d)(?![.,]\\d)",Pe=[{subkind:"israeli_id",severity:"high",pattern:new RegExp(`${kt}\\d{9}${St}`,"g"),validate:Ze,hint:"Israeli national ID (check digit verified) in plaintext. Encrypt the column or mask it at rest."},{subkind:"credit_card",severity:"critical",pattern:new RegExp(`${kt}[2-6][ -]?(?:\\d[ -]?){11,17}\\d${St}`,"g"),validate:Hr,hint:"Payment card number (Luhn verified) in plaintext. This is PCI scope."},{subkind:"iban",severity:"high",pattern:/\b[A-Z]{2}\d{2}(?: ?[A-Z0-9]{4}){2,7}(?: ?[A-Z0-9]{1,4})?\b/g,validate:Ur,hint:"Bank account in IBAN form (mod-97 verified) in plaintext."},{subkind:"israeli_phone",severity:"medium",pattern:new RegExp(`${kt}(?:\\+972[- ]?|0)(?:[57]\\d|[2-489])[- ]?\\d{3}[- ]?\\d{4}${St}`,"g"),validate:e=>{let t=e.replace(/\D/g,"").replace(/^972/,"0");return/^0[57]\d{8}$/.test(t)?!0:/^0[2-489]\d{7}$/.test(t)&&(/[- ]/.test(e)||e.startsWith("+972"))},hint:"Israeli phone number in plaintext."}];function dn(e){if(e.length!==14&&e.length!==17)return!1;let t=+e.slice(0,4),n=+e.slice(4,6),r=+e.slice(6,8),i=+e.slice(8,10),o=+e.slice(10,12),s=+e.slice(12,14);return t>=1970&&t<=2099&&n>=1&&n<=12&&r>=1&&r<=31&&i<24&&o<60&&s<60}function fn(e){let t=Number(e);return!Number.isSafeInteger(t)||t<1024?!1:Number.isInteger(Math.log2(t))||t%1048576===0}var Br=new Set(["000000018","123456782","111111118","222222226","333333334","999999998","4111111111111111","4242424242424242","4000056655665556","5555555555554444","5105105105105100","2223003122003222","378282246310005","371449635398431","6011111111111117","3056930009020004","4012888888881881","4000000000000002"]);function Ce(e){return Br.has(e.replace(/\D/g,""))}function Ke(e){let t=e.replace(/\D/g,"");return dn(t)||fn(t)}function Oe(e,t){let n=[];for(let r of Pe){r.pattern.lastIndex=0;let i=new Set,o,s=0;for(;(o=r.pattern.exec(e))!==null&&(s+=1,!(s>2e5));){let a=o[0];if(!(r.subkind!=="iban"&&r.subkind!=="israeli_phone"&&Ke(a))&&(r.validate(a)&&i.add(a.replace(/[\s-]/g,"")),i.size>=1e5))break}if(i.size>0){if(t)for(let l of i)Ce(l)||t(r.subkind,l);let a=[...i].filter(l=>!Ce(l)).length;n.push({subkind:r.subkind,severity:a===0?"low":r.severity,hint:a===0?`${r.hint} All ${i.size} are published test numbers.`:r.hint,count:i.size,real:a})}}for(let r of Xe()){let i=new Set;for(let o of r.find(e))i.add(e.slice(o.start,o.end).trim());i.size>0&&n.push({subkind:r.kind,severity:r.severity,hint:r.hint,count:i.size})}return n}function De(e,t){let n=[],r="",i=!1;for(let o=0;o<e.length;o++){let s=e[o];i?s==='"'&&e[o+1]==='"'?(r+='"',o++):s==='"'?i=!1:r+=s:s==='"'?i=!0:s===t?(n.push(r),r=""):r+=s}return n.push(r),n}import{inflateRawSync as Ai}from"node:zlib";import{inflateSync as pn}from"node:zlib";var Ne=new Set([".pdf"]),hn=8*1024*1024;function qe(e){let t=e.toString("latin1"),n=new Map,r=/(\d+)\s+(\d+)\s+obj\b/g,i;for(;(i=r.exec(t))!==null;){let o=Number(i[1]),s=r.lastIndex,a=t.indexOf("endobj",s);if(a<0)continue;let l=t.indexOf("stream",s),c,h=null;if(l>=0&&l<a){c=t.slice(s,l);let u=l+6;t[u]==="\r"&&(u+=1),t[u]===`
 `&&(u+=1);let p=t.indexOf("endstream",u);p>u&&(h=e.subarray(u,p))}else c=t.slice(s,a);n.set(o,{num:o,dict:c,stream:h})}for(let o of[...n.values()]){if(!o.stream||!/\/Type\s*\/ObjStm\b/.test(o.dict))continue;let s=Fe(o),a=Number(/\/N\s+(\d+)/.exec(o.dict)?.[1]??0),l=Number(/\/First\s+(\d+)/.exec(o.dict)?.[1]??-1);if(s===null||!a||l<0)continue;let c=s.slice(0,l).trim().split(/\s+/).map(Number);for(let h=0;h<a;h+=1){let u=c[2*h],p=c[2*h+1];if(u===void 0||p===void 0||Number.isNaN(u)||Number.isNaN(p))break;let x=h+1<a?c[2*(h+1)+1]:void 0,w=s.slice(l+p,x!==void 0?l+x:void 0);n.has(u)||n.set(u,{num:u,dict:w,stream:null})}}return n}function $t(e){let t=[...e.replace(/\s+/g,"")];if(t.length<40)return!1;let n=0,r=0;for(let i of t){let o=i.codePointAt(0)??0;o<32||o>=127&&o<=191||o===65533||o>=57344&&o<=63743?n+=1:/[\p{L}\p{N}]/u.test(i)&&(r+=1)}return n/t.length>.2||r/t.length<.25}function zr(e){let t=e.toString("latin1").replace(/\s/g,"");t.startsWith("<~")&&(t=t.slice(2));let n=t.indexOf("~>");n>=0&&(t=t.slice(0,n));let r=[],i=0,o=0;for(let s of t){if(s==="z"&&o===0){r.push(0,0,0,0);continue}let a=s.charCodeAt(0)-33;if(a<0||a>84)return null;i=i*85+a,o+=1,o===5&&(r.push(i>>>24&255,i>>>16&255,i>>>8&255,i&255),i=0,o=0)}if(o>0){for(let a=o;a<5;a+=1)i=i*85+84;let s=[i>>>24&255,i>>>16&255,i>>>8&255,i&255];for(let a=0;a<o-1;a+=1)r.push(s[a]??0)}return Buffer.from(r)}function Wr(e){let t=e.toString("latin1").replace(/\s/g,"").split(">")[0]??"",n=t.length%2?t+"0":t;return/^[0-9A-Fa-f]*$/.test(n)?Buffer.from(n,"hex"):null}function Vr(e){let t=/\/Filter\s*(\[[^\]]*\]|\/\w+)/.exec(e);return!t||!t[1]?[]:[...t[1].matchAll(/\/(\w+)/g)].map(n=>n[1]??"")}function Fe(e,t){if(!e.stream)return null;let n=e.stream;for(let r of Vr(e.dict)){let i=null;if(r==="FlateDecode")try{i=t!==void 0?pn(n,{maxOutputLength:Math.max(1,t)}):pn(n)}catch{return null}else if(r==="ASCII85Decode")i=zr(n);else if(r==="ASCIIHexDecode")i=Wr(n);else return null;if(i===null)return null;n=i}return n.toString("latin1")}function Xr(e){let t=new Map,n=1,r=/begincodespacerange([\s\S]*?)endcodespacerange/.exec(e);if(r&&r[1]){let l=/<([0-9A-Fa-f]+)>/.exec(r[1]);l&&l[1]&&l[1].length>=4&&(n=2)}let i=l=>{let c="";for(let h=0;h+3<l.length+1;h+=4){let u=parseInt(l.slice(h,h+4),16);Number.isFinite(u)&&u>0&&(c+=String.fromCharCode(u))}return c},o=/beginbfchar([\s\S]*?)endbfchar/g,s;for(;(s=o.exec(e))!==null;){let l=/<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]*)>/g,c;for(;(c=l.exec(s[1]??""))!==null;)t.set(parseInt(c[1]??"0",16),i(c[2]??""))}let a=/beginbfrange([\s\S]*?)endbfrange/g;for(;(s=a.exec(e))!==null;){let l=s[1]??"",c=/<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]*)>/g,h;for(;(h=c.exec(l))!==null;){let u=parseInt(h[1]??"0",16),p=parseInt(h[2]??"0",16),x=parseInt((h[3]??"0").slice(0,4)||"0",16);if(!(p-u>65535))for(let w=u;w<=p;w+=1)t.set(w,String.fromCharCode(x+(w-u)))}}return{map:t,bytes:n}}function Gr(e){let t=new Map,n=[],r=[];for(let o of e.values()){for(let s of o.dict.matchAll(/\/Font\s*<<([\s\S]*?)>>/g))s[1]&&r.push(s[1]);for(let s of o.dict.matchAll(/\/Font\s+(\d+)\s+\d+\s+R/g)){let a=e.get(Number(s[1]));a&&r.push(a.dict)}}let i=new Set;for(let o of r){let s=/\/([^\s/<>[\]()]+)\s+(\d+)\s+\d+\s+R/g,a;for(;(a=s.exec(o))!==null;){let l=`${a[1]}#${a[2]}`;i.has(l)||(i.add(l),n.push([a[1]??"",Number(a[2])]))}}for(let[o,s]of n){let a=e.get(s);if(!a)continue;let l=null,c=/\/ToUnicode\s+(\d+)\s+\d+\s+R/.exec(a.dict);if(c){let u=e.get(Number(c[1])),p=u?Fe(u):null;p&&(l=Xr(p))}if(l||(l=qr(a.dict,e)),!l)continue;let h=t.get(o)??[];h.push(l),t.set(o,h)}return t}var Zr=["alef","bet","gimel","dalet","he","vav","zayin","het","tet","yod","finalkaf","kaf","lamed","finalmem","mem","finalnun","nun","samekh","ayin","finalpe","pe","finaltsadi","tsadi","qof","resh","shin","tav"];function Kr(e){let t=/^uni([0-9A-Fa-f]{4})$/.exec(e)??/^u([0-9A-Fa-f]{4,6})$/.exec(e);if(t)return String.fromCodePoint(parseInt(t[1],16));let n=/^afii(\d{5})$/.exec(e);if(n){let o=Number(n[1]);if(o>=57664&&o<=57690)return String.fromCharCode(1488+(o-57664))}let r=Zr.indexOf(e.replace(/hebrew$/,""));return r>=0?String.fromCharCode(1488+r):e==="space"?" ":/^[A-Za-z]$/.test(e)?e:{zero:"0",one:"1",two:"2",three:"3",four:"4",five:"5",six:"6",seven:"7",eight:"8",nine:"9",period:".",comma:",",hyphen:"-",colon:":",slash:"/",at:"@"}[e]??null}function qr(e,t){let n=e,r=/\/Encoding\s+(\d+)\s+\d+\s+R/.exec(e);r&&(n=t.get(Number(r[1]))?.dict??"");let i=/\/Differences\s*\[([^\]]*)\]/.exec(n);if(!i?.[1])return null;let o=new Map,s=0;for(let a of i[1].match(/\d+|\/[^\s/[\]]+/g)??[]){if(/^\d+$/.test(a)){s=Number(a);continue}let l=Kr(a.slice(1));l!==null&&o.set(s,l),s+=1}return o.size?{map:o,bytes:1}:null}function xn(e){let t=[];for(let n=0;n<e.length;n+=1){let r=e[n];if(r!=="\\"){t.push(r.charCodeAt(0)&255);continue}let i=e[n+1];if(i===void 0)break;if(i>="0"&&i<="7"){let s="",a=n+1;for(;a<e.length&&s.length<3&&e[a]>="0"&&e[a]<="7";)s+=e[a],a+=1;t.push(parseInt(s,8)&255),n=a-1;continue}let o={n:10,r:13,t:9,b:8,f:12};t.push(o[i]??i.charCodeAt(0)&255),n+=1}return t}function wn(e){if(e.length<2||e[0]!==254||e[1]!==255)return null;let t="";for(let n=2;n+1<e.length;n+=2)t+=String.fromCharCode((e[n]??0)<<8|(e[n+1]??0));return t}function mn(e,t){let n=wn(e);if(n!==null)return n;if(!t)return e.map(i=>String.fromCharCode(i)).join("");let r="";if(t.bytes===2)for(let i=0;i+1<e.length;i+=2){let o=(e[i]??0)<<8|(e[i+1]??0);r+=t.map.get(o)??""}else for(let i of e)r+=t.map.get(i)??String.fromCharCode(i);return r}function Jr(e){let t=0;for(let n of e){let r=n.codePointAt(0)??0;/[\p{L}\p{N}]/u.test(n)?t+=1:(r<32||r>=127&&r<=191||r===65533)&&(t-=2)}return t}function gn(e,t){if(!t||t.length<=1)return mn(e,t?.[0]);let n="",r=-1/0;for(let i of t){let o=mn(e,i),s=Jr(o);s>r&&(n=o,r=s)}return n}function Yr(e,t){let n="",r="",i,o=!1,s="",a=0,l=null,c=()=>{r.trim()&&(n+=r+`

package/dist/status.js

@@ -1,2 +1,2 @@
-/*! @nodatachat/mcp 1.6.3 | Copyright 2026 Capsule Ltd. | FSL-1.1-ALv2 | see LICENSE.md */
+/*! @nodatachat/mcp 1.6.4 | Copyright 2026 Capsule Ltd. | FSL-1.1-ALv2 | see LICENSE.md */
 import{execSync as vn}from"node:child_process";import{existsSync as xn,readFileSync as Z}from"node:fs";import{existsSync as T,mkdirSync as Dn,readdirSync as X,readFileSync as nn,rmSync as An,writeFileSync as Rn,chmodSync as Bn}from"node:fs";import{homedir as L}from"node:os";import{basename as Mn,isAbsolute as en,join as u,relative as tn,resolve as rn}from"node:path";var g=()=>u(L(),".nodata"),on=()=>u(g(),"credentials.json"),b=()=>u(g(),"orgs"),sn=()=>u(g(),"bindings.json"),ln=/^[A-Za-z0-9_.-]{1,80}$/,v=n=>ln.test(n)&&n!=="."&&n!=="..";function F(n){try{return T(n)?JSON.parse(nn(n,"utf8")):null}catch{return null}}function cn(n){return n?n.device?.org_id?n.device.org_id:n.api_key?`key-${(n.key_prefix??n.api_key.slice(0,12)).replace(/[^A-Za-z0-9_-]/g,"")}`:null:null}function E(){return cn(F(on()))}function m(){let n=[],t=E();t&&n.push(t);try{for(let e of X(b()))v(e)&&!n.includes(e)&&T(u(b(),e,"credentials.json"))&&n.push(e)}catch{}return n}function an(n){return n===E()?g():v(n)?u(b(),n):null}var un=n=>process.platform==="win32"||process.platform==="darwin"?n.toLowerCase():n,h=n=>un(rn(n.replace(/^~(?=[\\/]|$)/,L())));function dn(n,t){let e=tn(h(n),h(t));return e===""||!e.startsWith("..")&&!en(e)}function D(){let n=F(sn());return(Array.isArray(n?.bindings)?n.bindings:[]).filter(e=>!!e&&typeof e.folder=="string"&&typeof e.org_id=="string"&&v(e.org_id)).map(e=>e.project===void 0||hn(e.project)===e.project?e:{...e,project:void 0}).map(e=>e.client===void 0||typeof e.client?.org_id=="string"&&fn.test(e.client.org_id)?e:{...e,client:void 0})}var fn=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function gn(n,t=D()){let e=null;for(let s of t)dn(s.folder,n)&&(!e||h(s.folder).length>h(e.folder).length)&&(e=s);return e}function x(n,t=m(),e=D()){if(t.length===0)return{kind:"none"};let s=gn(n,e.filter(c=>t.includes(c.org_id)));return s?{kind:"bound",org_id:s.org_id,folder:s.folder}:t.length===1?{kind:"only",org_id:t[0]}:{kind:"unbound",orgs:t}}function pn(n){let t=x(n);return t.kind==="bound"||t.kind==="only"?t.org_id:null}function hn(n){if(typeof n!="string")return null;let t=n.trim();return t&&t.length<=120&&!/[\u0000-\u001f\\/]/.test(t)?t:null}function A(n,t=process.cwd()){if(m().length===0)return g();let e=n??pn(t);return e?an(e):null}import{homedir as Sn}from"node:os";import{join as d}from"node:path";var R=["\u{1F7E3}","\u{1F535}","\u{1F7E0}","\u{1F7E4}","\u{1F7E1}"];function mn(n){let t=0;for(let e of n)t=t*31+e.codePointAt(0)>>>0;return R[t%R.length]}function B(n,t){let e=(n||"agent").toLowerCase().replace(/[^a-z0-9._-]+/g,"-").slice(0,40);return t?`${e}@${t}`:e}function J(n){return`${mn(n)} ${n}`}var P="2026-09-24-v3";import{existsSync as $n,mkdirSync as Kn,readFileSync as _n,writeFileSync as Un}from"node:fs";import{homedir as yn}from"node:os";import{join as jn}from"node:path";var M=()=>jn(yn(),".nodata","prefs.json");function kn(){try{let n=$n(M())?JSON.parse(_n(M(),"utf8")).lang:null;return n==="he"||n==="en"?n:null}catch{return null}}function wn(){let t=process.env.LC_ALL||process.env.LC_MESSAGES||process.env.LANG||"";try{t||=Intl.DateTimeFormat().resolvedOptions().locale}catch{}return/^(he|iw)(?:[-_.@]|$)/i.test(t)?"he":"en"}function bn(){return kn()??wn()}function r(n,t,e=bn()){return e==="he"?n:t}var On="\x1B[32m",a="\x1B[33m",w="\x1B[31m",N="\x1B[2m",i="\x1B[0m";function f(n){try{return xn(n)?JSON.parse(Z(n,"utf8")):null}catch{return null}}var C="";try{C=Z(0,"utf8")}catch{}var p=Sn(),Nn=f(d(p,".claude","settings.json")),I=(Nn?.hooks?.PreToolUse??[]).flatMap(n=>n.hooks??[]).find(n=>n.command.includes("gate.mjs"))?.command,S=I?I.includes("--block")?"block":"ask":null,Cn=f(d(p,".nodata","consent.json")),Tn=Cn?.terms_version===P,q=f(d(p,".nodata","credentials.json")),Ln=B("claude-code",q?.device?.label),o=[],_;Tn?S?(_=On,o.push(r(`\u05E9\u05E2\u05E8 ${S==="block"?"\u05D7\u05D5\u05E1\u05DD":"\u05E9\u05D5\u05D0\u05DC"}`,`gate ${S}`),r("\u05EA\u05E0\u05D0\u05D9\u05DD \u2713","terms \u2713"))):(_=a,o.push(r("\u05E9\u05E2\u05E8 \u05DB\u05D1\u05D5\u05D9","gate off"))):(_=w,o.push(r("\u05EA\u05E0\u05D0\u05D9 \u05E9\u05D9\u05DE\u05D5\u05E9 \u05DC\u05D0 \u05D0\u05D5\u05E9\u05E8\u05D5 \u2014 nodata_terms","terms not accepted \u2014 nodata_terms")));var l=f(d(p,".nodata","connection.json")),z=l?.at?Date.now()-Date.parse(l.at)<60*6e4:!1,H=`${a}${r("\u05DC\u05D0 \u05DE\u05D7\u05D5\u05D1\u05E8","not connected")}${i}`;z&&l?.state==="waiting"?o.push(`${a}${r("\u05DE\u05DE\u05EA\u05D9\u05DF \u05DC\u05D0\u05D9\u05E9\u05D5\u05E8","waiting for approval")}${i}`):q?!l||!z?o.push(`${a}${r("\u05D7\u05D9\u05D1\u05D5\u05E8 \u05DC\u05D0 \u05E0\u05D1\u05D3\u05E7","connection not checked")}${i}`):l.state==="connected"?o.push(r("\u05DE\u05D7\u05D5\u05D1\u05E8 \u2713","connected \u2713")):l.state==="reconnecting"?o.push(`${a}${r("\u05DE\u05EA\u05D7\u05D1\u05E8 \u05DE\u05D7\u05D3\u05E9\u2026","reconnecting\u2026")}${i}`):l.state==="restart"?o.push(`${a}${r("\u05D0\u05D5\u05E9\u05E8 \u2014 \u05D4\u05E7\u05DC\u05D3 /mcp","approved \u2014 type /mcp")}${i}`):l.state==="needs-you"?o.push(`${w}${r("\u05DC\u05D0 \u05DE\u05D7\u05D5\u05D1\u05E8","not connected")} \u2192 ${l.step??"nodata_connect"}${i}`):o.push(H):o.push(H);var G=m(),y=process.cwd();try{let n=JSON.parse(C);y=n.workspace?.current_dir||n.cwd||y}catch{}if(G.length>1){let n=x(y,G);n.kind==="bound"||n.kind==="only"?o.push(`${r("\u05D0\u05E8\u05D2\u05D5\u05DF","org")} ${n.org_id.slice(0,8)}`):o.push(`${w}${r("\u05D4\u05EA\u05D9\u05E7\u05D9\u05D9\u05D4 \u05DC\u05D0 \u05E9\u05D5\u05D9\u05DB\u05D4 \u05DC\u05D0\u05E8\u05D2\u05D5\u05DF","folder bound to no org")}${i}`)}var K=A(null,y),$=K?f(d(K,"capsule.json")):null;if($){let n=$.last_heartbeat_ok_at?Date.parse($.last_heartbeat_ok_at):NaN,t=Number.isFinite(n)?Math.round((Date.now()-n)/6e4):1/0,e=s=>s<120?r(`${s} \u05D3'`,`${s}m`):r(`${Math.round(s/60)} \u05E9'`,`${Math.round(s/60)}h`);$.revoked?o.push(`${w}${r('\u05D4\u05E6\u05D5\u05DE\u05EA \u05D4\u05D5\u05E9\u05D4\u05D4 \u05E2"\u05D9 \u05D4\u05D0\u05E8\u05D2\u05D5\u05DF',"node paused by org")}${i}`):t<=15?o.push(`${r("\u05E6\u05D5\u05DE\u05EA","node")} \u2713 ${t<1?r("\u05E2\u05DB\u05E9\u05D9\u05D5","now"):e(t)}`):o.push(`${a}${r("\u05E6\u05D5\u05DE\u05EA \u05DC\u05D0 \u05D0\u05D5\u05DE\u05EA","node not verified")}${Number.isFinite(t)?` ${e(t)}`:""}${i}`)}o.push(J(Ln));var U=n=>n.split(".").map(Number),Y=(n,t)=>{let[e,s]=[U(n),U(t)];for(let c=0;c<3;c++)if(e[c]!==s[c])return e[c]>s[c];return!1},Q=[...new Set(Object.values(l?.versions??{}).map(n=>n.version).concat(l?.version??[]))].filter(n=>/^\d+\.\d+\.\d+$/.test(n)),j=Q.reduce((n,t)=>!n||Y(t,n)?t:n,null),O=Q.filter(n=>j&&Y(j,n)),Fn=j?` ${N}v${j}${i}${O.length?` ${a}${r(`(v${O.join(", v")} \u05D1\u05D7\u05DC\u05D5\u05DF \u05D0\u05D7\u05E8: /mcp)`,`(v${O.join(", v")} in another window: /mcp)`)}${i}`:""}`:"",V=`${_}\u25CF NoData${i}${Fn} ${N}\xB7${i} ${o.join(` ${N}\xB7${i} `)}`,W=f(d(p,".nodata","statusline-prev.json"))?.command,k="";if(W)try{k=vn(W,{input:C,timeout:2e3,encoding:"utf8"}).trim()}catch{k=""}process.stdout.write(k?`${k} \u2502 ${V}`:V);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nodatachat/mcp",
-  "version": "1.6.3",
+  "version": "1.6.4",
   "description": "NoData MCP server: connect any MCP client (Claude Code, Codex, Cursor, VS Code) to the NoData Information Access Processor. Governed access for AI agents, with a verifiable proof for every decision.",
   "bin": {
     "nodata-mcp": "dist/index.js"