@nodatachat/mcp 1.6.44 → 1.6.45

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/dist/gate.js +1 -1
  2. package/dist/index.js +3 -3
  3. package/dist/scan-worker.js +1 -1
  4. package/dist/status.js +1 -1
  5. package/package.json +1 -1
package/dist/gate.js CHANGED
@@ -1,4 +1,4 @@
1
- /*! @nodatachat/mcp 1.6.44 | Copyright 2026 Capsule Ltd. | FSL-1.1-ALv2 | see LICENSE.md */
1
+ /*! @nodatachat/mcp 1.6.45 | Copyright 2026 Capsule Ltd. | FSL-1.1-ALv2 | see LICENSE.md */
2
2
  import{appendFileSync as mc,copyFileSync as rh,existsSync as In,mkdirSync as vs,readdirSync as gc,readFileSync as Tn,statSync as xt,writeFileSync as yc}from"node:fs";import{homedir as Y}from"node:os";import{basename as wt,extname as Ss,isAbsolute as ne,join as xe,relative as Es,resolve as D}from"node:path";import{TextDecoder as $r}from"node:util";var H={text:[],header:[],secrets:[],table:null,amounts:null,severity:null};function $t(e){e.table&&(H.table=e.table),e.severity&&(H.severity=e.severity),e.amounts&&(H.amounts=e.amounts);for(let t of e.text??[])H.text.some(r=>r.kind===t.kind)||H.text.push(t);e.header&&!H.header.includes(e.header)&&H.header.push(e.header);for(let t of e.secrets??[])H.secrets.some(r=>r.id===t.id)||H.secrets.push(t)}function Rt(){return H.amounts?.()===!0}function De(){return H.text}function jn(){return H.header}function Se(){return H.table}function Hn(){return H.secrets}var Fe=[{id:"aws-access-key",name:"AWS Access Key",pattern:/(?:^|[^A-Z0-9])AKIA(?!X{16})[A-Z2-7]{16}(?:[^A-Z2-7]|$)/,severity:"critical"},{id:"aws-secret-key",name:"AWS Secret Key",pattern:/(?:aws_secret_access_key|aws_secret_key|secret_access_key)\s*[=:]\s*['"]?[A-Za-z0-9/+=]{40}['"]?/,severity:"critical"},{id:"gcp-api-key",name:"GCP API Key",pattern:/AIza[0-9A-Za-z_-]{35}/,severity:"critical"},{id:"gcp-service-account",name:"GCP Service Account",pattern:/"type"\s*:\s*"service_account"/,severity:"critical"},{id:"github-token",name:"GitHub Token",pattern:/gh[pousr]_[0-9a-zA-Z]{36,}/,severity:"critical"},{id:"github-fine-grained",name:"GitHub Fine-Grained Token",pattern:/github_pat_[0-9a-zA-Z_]{22,}/,severity:"critical"},{id:"gitlab-token",name:"GitLab Token",pattern:/glpat-[0-9a-zA-Z_-]{20,}/,severity:"critical"},{id:"stripe-secret",name:"Stripe Secret Key",pattern:/sk_live_[0-9a-zA-Z]{24,}/,severity:"critical"},{id:"stripe-restricted",name:"Stripe Restricted Key",pattern:/rk_live_[0-9a-zA-Z]{24,}/,severity:"critical"},{id:"slack-token",name:"Slack Token",pattern:/xox[baprs]-[0-9a-zA-Z-]{10,}/,severity:"high"},{id:"slack-webhook",name:"Slack Webhook",pattern:/hooks\.slack\.com\/services\/T[0-9A-Z]{8,}\/B[0-9A-Z]{8,}\/[0-9a-zA-Z]{24}/,severity:"high"},{id:"twilio-api-key",name:"Twilio API Key",pattern:/SK[0-9a-fA-F]{32}/,severity:"high"},{id:"sendgrid-api-key",name:"SendGrid API Key",pattern:/SG\.[0-9a-zA-Z_-]{22}\.[0-9a-zA-Z_-]{43}/,severity:"critical"},{id:"postgres-uri",name:"PostgreSQL Connection String",pattern:/postgres(?:ql)?:\/\/[^\s'"]{10,}/,severity:"critical"},{id:"mongodb-uri",name:"MongoDB Connection String",pattern:/mongodb(?:\+srv)?:\/\/[^\s'"]{10,}/,severity:"critical"},{id:"redis-uri",name:"Redis Connection String",pattern:/redis(?:s)?:\/\/[^\s'"]{10,}/,severity:"high"},{id:"openai-key",name:"OpenAI API Key",pattern:/sk-[0-9a-zA-Z]{20,}T3BlbkFJ[0-9a-zA-Z]{20,}/,severity:"critical"},{id:"openai-project-key",name:"OpenAI API Key",pattern:/sk-(?:proj|svcacct|admin)-[0-9A-Za-z_-]{40,}/,severity:"critical"},{id:"anthropic-key",name:"Anthropic API Key",pattern:/sk-ant-[0-9a-zA-Z_-]{40,}/,severity:"critical"},{id:"firebase-key",name:"Firebase API Key",pattern:/AIza[0-9A-Za-z_-]{35}/,severity:"high"},{id:"supabase-key",name:"Supabase Service Key",pattern:/eyJ[0-9a-zA-Z_-]{100,}/,severity:"critical"},{id:"supabase-access-token",name:"Supabase Access Token",pattern:/\bsbp_[0-9a-f]{40}\b/,severity:"critical"},{id:"supabase-secret-key",name:"Supabase Secret Key",pattern:/\bsb_secret_[0-9A-Za-z_-]{20,}/,severity:"critical"},{id:"private-key",name:"Private Key",pattern:/-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/,severity:"critical"},{id:"jwt-secret",name:"JWT/Generic Secret",pattern:/(?:jwt_secret|JWT_SECRET|secret_key|SECRET_KEY|api_secret|API_SECRET)\s*[=:]\s*['"][^'"]{8,}['"]/,severity:"high"},{id:"password-in-code",name:"Password in Code",pattern:/(?:password|passwd|pwd)\s*[=:]\s*['"][^'"]{8,}['"]/,severity:"high"},{id:"bearer-token",name:"Bearer Token in Code",pattern:/['"]Bearer\s+[0-9a-zA-Z._-]{20,}['"]/,severity:"high"}];function Ee(){let e=Hn().filter(t=>!Fe.some(r=>r.id===t.id));return[...Fe,...e]}var to=[{pattern:/^(full_?name|first_?name|last_?name|spouse_?name|beneficiary_?name)$/i,type:"name",label:"Person name"},{pattern:/^(email|e_?mail|email_?address)$/i,type:"email",label:"Email address"},{pattern:/^(phone|mobile|telephone|phone_?number|cell_?phone)$/i,type:"phone",label:"Phone number"},{pattern:/^(id_?number|identity|ssn|social_?security|national_?id|teudat_?zehut)$/i,type:"id",label:"ID number"},{pattern:/^(address|street_?address|home_?address)$/i,type:"address",label:"Address"},{pattern:/^(date_?of_?birth|dob|birth_?date|birthday)$/i,type:"dob",label:"Date of birth"},{pattern:/^(bank_?account|iban|account_?number|bank_?details|routing_?number)$/i,type:"financial",label:"Bank account"},{pattern:/^(credit_?card|card_?number|cvv|cc_?number)$/i,type:"financial",label:"Credit card"},{pattern:/^(salary|income|commission|premium|compensation)$/i,type:"financial",label:"Salary / income"},{pattern:/^(medical_?info|health_?conditions|diagnosis|medication|prescription)$/i,type:"medical",label:"Medical"},{pattern:/^(passport|passport_?number|passport_?id)$/i,type:"id",label:"Passport"},{pattern:/^(driver_?license|drivers_?license|dl_?number)$/i,type:"id",label:"Driver license"},{pattern:/^(tax_?id|tin|vat_?number|ein)$/i,type:"financial",label:"Tax ID"},{pattern:/^(insurance_?number|policy_?number|member_?id)$/i,type:"id",label:"Insurance/Policy"},{pattern:/^(biometric|fingerprint|face_?id|retina)$/i,type:"biometric",label:"Biometric"},{pattern:/^(latitude|longitude|lat|lng|geo_?location|coordinates)$/i,type:"location",label:"Geolocation"}],no=[{pattern:/^(?:שם|שם_מלא|שם פרטי|שם_פרטי|שם משפחה|שם_משפחה|שם הלקוח|שם בן זוג|שם המבוטח|שם המוטב|שם הילד|שם הקטין)$/i,type:"name",label:"\u05E9\u05DD \u05D0\u05D3\u05DD"},{pattern:/^(?:ת"ז|ת\.ז|ת ז|תז|תעודת זהות|תעודת_זהות|מספר זהות|מס' זהות|teudat_zehut|tz|israeli_id|il_id)$/i,type:"id",label:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA"},{pattern:/^(?:דרכון|מספר דרכון|רישיון נהיגה|רישיון_נהיגה|רשיון נהיגה)$/i,type:"id",label:"\u05D3\u05E8\u05DB\u05D5\u05DF/\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF"},{pattern:/^(?:מייל|דוא"ל|דוא_ל|דואר אלקטרוני|אימייל|כתובת מייל)$/i,type:"email",label:"\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9"},{pattern:/^(?:טלפון|טל'|נייד|פלאפון|סלולרי|מספר טלפון|טלפון נייד)$/i,type:"phone",label:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF"},{pattern:/^(?:כתובת|כתובת מגורים|רחוב|מס בית|עיר|ישוב|יישוב|מיקוד|כתובת מלאה|מען)$/i,type:"address",label:"\u05DB\u05EA\u05D5\u05D1\u05EA"},{pattern:/^(?:תאריך לידה|ת לידה|תאריך הולדת|יום הולדת|גיל)$/i,type:"dob",label:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"},{pattern:/^(?:חשבון בנק|מספר חשבון|מס חשבון|סניף|iban|iban_il)$/i,type:"financial",label:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7"},{pattern:/^(?:כרטיס אשראי|מספר אשראי|cvv|אשראי)$/i,type:"financial",label:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"},{pattern:/^(?:שכר|משכורת|הכנסה|פרמיה|שכר ברוטו|שכר נטו|תגמול|בונוס|פיצוי)$/i,type:"financial",label:"\u05E9\u05DB\u05E8/\u05D4\u05DB\u05E0\u05E1\u05D4"},{pattern:/^(?:אבחון|אבחנה|מחלה|תרופה|מרשם|בדיקה רפואית|מצב רפואי|חיסון|רגישות|אלרגיה|סוג דם)$/i,type:"medical",label:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(?:מספר פוליסה|מס פוליסה|פוליסה|מספר חבר|מספר ביטוח)$/i,type:"id",label:"\u05E4\u05D5\u05DC\u05D9\u05E1\u05D4/\u05D7\u05D1\u05E8\u05D5\u05EA"},{pattern:/^(?:שם הילד|תעודת זהות של ילד|ילדים|קטין|מספר ילדים|תעודת לידה)$/i,type:"minor_data",label:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05DF"},{pattern:/^(?:דת|לאום|מין|נטייה מינית|השקפה פוליטית|מצב משפחתי|עדה|מוצא)$/i,type:"sensitive_personal",label:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9"},{pattern:/^(?:מספר רכב|מס רכב|לוחית רישוי|מספר רישוי)$/i,type:"tracking",label:"\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"}],ro=/^(id|uuid|created_?at|updated_?at|deleted_?at|status|type|category|description|title|slug|url|path|key|value|enabled|active|public|version|metadata|config|settings|data|content|note|comment|label|color|icon)$/i,so=/^שם[ _](?:ה)?(?:קובץ|מוצר|פריט|חברה|ארגון|עסק|פרויקט|גיליון|טבלה|שדה|קטגוריה|סניף|בנק|עיר|רחוב|ישוב|יישוב|מסמך|תוכנית|חבילה|קורס|מחלקה|אתר|דומיין|מותג|ספק|שירות|תפקיד)$|^(file|product|item|company|org|organization|project|sheet|table|field|category|branch|bank|city|street|document|plan|course|department|site|domain|brand|vendor|service|role)[ _-]?name$/i;function Ae(e){if(!e)return null;let t=e.trim();if(ro.test(t)||/^name$/i.test(t)||/^\[[A-Z_]+(?:-\d+)?\]$/.test(t))return null;let r=t.replace(/[\s-]+/g,"_");for(let n of[...no,...to])if(n.pattern.test(t)||n.pattern.test(r))return{type:n.type,label:n.label};if(so.test(t))return null;if(/^שם[ _][\u0590-\u05FF"'׳ ]{2,20}$/.test(t))return{type:"name",label:"\u05E9\u05DD \u05D0\u05D3\u05DD"};if(/^(customer|client|employee|inspector|supervisor|contact|person|patient|user|owner|manager|agent|member|driver|tenant|student|parent|beneficiary|insured)_?(full_?)?name$/i.test(r))return{type:"name",label:"Person name"};for(let n of jn()){let s=n(t);if(s)return{type:s.type,label:s.label}}return null}function Un(e){let t=String(e??"").replace(/\D/g,"");if(t.length===0||t.length>9)return!1;let r=t.padStart(9,"0"),n=0;for(let s=0;s<9;s++){let o=parseInt(r[s]??"0",10)*(s%2+1);o>9&&(o-=9),n+=o}return n%10===0&&parseInt(r,10)>0}function oo(e){let t=String(e??"").replace(/\D/g,"");if(t.length<12||t.length>19)return!1;let r=0,n=!1;for(let s=t.length-1;s>=0;s-=1){let o=parseInt(t[s]??"0",10);n&&(o*=2,o>9&&(o-=9)),r+=o,n=!n}return r%10===0}function Bn(e){let t=String(e??"").replace(/\s/g,"").toUpperCase();if(!/^[A-Z]{2}\d{2}[A-Z0-9]{10,30}$/.test(t))return!1;let r=t.slice(4)+t.slice(0,4),n=0;for(let s of r){let o=s>="A"&&s<="Z"?String(s.charCodeAt(0)-55):s;for(let i of o)n=(n*10+Number(i))%97}return n===1}var It="(?<!\\d)(?<!\\d[.,])",Tt="(?!\\d)(?![.,]\\d)",Ct=[{subkind:"israeli_id",severity:"high",pattern:new RegExp(`${It}(?:\\d{8}-\\d|\\d{9})${Tt}`,"g"),validate:Un,hint:"Israeli national ID (check digit verified) in plaintext. Encrypt the column or mask it at rest."},{subkind:"credit_card",severity:"critical",pattern:new RegExp(`${It}[2-6][ -]?(?:\\d[ -]?){11,17}\\d${Tt}`,"g"),validate:oo,hint:"Payment card number (Luhn verified) in plaintext. This is PCI scope."},{subkind:"iban",severity:"high",pattern:/\b[A-Z]{2}\d{2}(?: ?[A-Z0-9]{4}){2,7}(?: ?[A-Z0-9]{1,4})?\b/g,validate:Bn,hint:"Bank account in IBAN form (mod-97 verified) in plaintext."},{subkind:"israeli_phone",severity:"medium",pattern:new RegExp(`${It}(?:\\+972[- ]?|0)(?:[57]\\d|[2-489])[- ]?\\d{3}[- ]?\\d{4}${Tt}`,"g"),validate:e=>{let t=e.replace(/\D/g,"").replace(/^972/,"0");return/^0[57]\d{8}$/.test(t)?!0:/^0[2-489]\d{7}$/.test(t)&&(/[- ]/.test(e)||e.startsWith("+972"))},hint:"Israeli phone number in plaintext."}];function Me(e,t){let r=[],n="",s=!1;for(let o=0;o<e.length;o++){let i=e[o];s?i==='"'&&e[o+1]==='"'?(n+='"',o++):i==='"'?s=!1:n+=i:i==='"'?s=!0:i===t?(r.push(n),n=""):n+=i}return r.push(n),r}import{inflateRawSync as ti}from"node:zlib";import{inflateSync as zn}from"node:zlib";var je=new Set([".pdf"]),Wn=8*1024*1024;function Kn(e){let t=e.toString("latin1"),r=new Map,n=/(\d+)\s+(\d+)\s+obj\b/g,s;for(;(s=n.exec(t))!==null;){let o=Number(s[1]),i=n.lastIndex,a=t.indexOf("endobj",i);if(a<0)continue;let c=t.indexOf("stream",i),l,f=null;if(c>=0&&c<a){l=t.slice(i,c);let d=c+6;t[d]==="\r"&&(d+=1),t[d]===`
3
3
  `&&(d+=1);let h=t.indexOf("endstream",d);h>d&&(f=e.subarray(d,h))}else l=t.slice(i,a);r.set(o,{num:o,dict:l,stream:f})}for(let o of[...r.values()]){if(!o.stream||!/\/Type\s*\/ObjStm\b/.test(o.dict))continue;let i=He(o),a=Number(/\/N\s+(\d+)/.exec(o.dict)?.[1]??0),c=Number(/\/First\s+(\d+)/.exec(o.dict)?.[1]??-1);if(i===null||!a||c<0)continue;let l=i.slice(0,c).trim().split(/\s+/).map(Number);for(let f=0;f<a;f+=1){let d=l[2*f],h=l[2*f+1];if(d===void 0||h===void 0||Number.isNaN(d)||Number.isNaN(h))break;let p=f+1<a?l[2*(f+1)+1]:void 0,g=i.slice(c+h,p!==void 0?c+p:void 0);r.has(d)||r.set(d,{num:d,dict:g,stream:null})}}return r}function Pt(e){let t=[...e.replace(/\s+/g,"")];if(t.length<40)return!1;let r=0,n=0;for(let s of t){let o=s.codePointAt(0)??0;o<32||o>=127&&o<=191||o===65533||o>=57344&&o<=63743?r+=1:/[\p{L}\p{N}]/u.test(s)&&(n+=1)}return r/t.length>.2||n/t.length<.25}function io(e){let t=e.toString("latin1").replace(/\s/g,"");t.startsWith("<~")&&(t=t.slice(2));let r=t.indexOf("~>");r>=0&&(t=t.slice(0,r));let n=[],s=0,o=0;for(let i of t){if(i==="z"&&o===0){n.push(0,0,0,0);continue}let a=i.charCodeAt(0)-33;if(a<0||a>84)return null;s=s*85+a,o+=1,o===5&&(n.push(s>>>24&255,s>>>16&255,s>>>8&255,s&255),s=0,o=0)}if(o>0){for(let a=o;a<5;a+=1)s=s*85+84;let i=[s>>>24&255,s>>>16&255,s>>>8&255,s&255];for(let a=0;a<o-1;a+=1)n.push(i[a]??0)}return Buffer.from(n)}function ao(e){let t=e.toString("latin1").replace(/\s/g,"").split(">")[0]??"",r=t.length%2?t+"0":t;return/^[0-9A-Fa-f]*$/.test(r)?Buffer.from(r,"hex"):null}function co(e){let t=/\/Filter\s*(\[[^\]]*\]|\/\w+)/.exec(e);return!t||!t[1]?[]:[...t[1].matchAll(/\/(\w+)/g)].map(r=>r[1]??"")}function He(e,t){if(!e.stream)return null;let r=e.stream;for(let n of co(e.dict)){let s=null;if(n==="FlateDecode")try{s=t!==void 0?zn(r,{maxOutputLength:Math.max(1,t)}):zn(r)}catch{return null}else if(n==="ASCII85Decode")s=io(r);else if(n==="ASCIIHexDecode")s=ao(r);else return null;if(s===null)return null;r=s}return r.toString("latin1")}function lo(e){let t=new Map,r=1,n=/begincodespacerange([\s\S]*?)endcodespacerange/.exec(e);if(n&&n[1]){let c=/<([0-9A-Fa-f]+)>/.exec(n[1]);c&&c[1]&&c[1].length>=4&&(r=2)}let s=c=>{let l="";for(let f=0;f+3<c.length+1;f+=4){let d=parseInt(c.slice(f,f+4),16);Number.isFinite(d)&&d>0&&(l+=String.fromCharCode(d))}return l},o=/beginbfchar([\s\S]*?)endbfchar/g,i;for(;(i=o.exec(e))!==null;){let c=/<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]*)>/g,l;for(;(l=c.exec(i[1]??""))!==null;)t.set(parseInt(l[1]??"0",16),s(l[2]??""))}let a=/beginbfrange([\s\S]*?)endbfrange/g;for(;(i=a.exec(e))!==null;){let c=i[1]??"",l=/<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]*)>/g,f;for(;(f=l.exec(c))!==null;){let d=parseInt(f[1]??"0",16),h=parseInt(f[2]??"0",16),p=parseInt((f[3]??"0").slice(0,4)||"0",16);if(!(h-d>65535))for(let g=d;g<=h;g+=1)t.set(g,String.fromCharCode(p+(g-d)))}}return{map:t,bytes:r}}function uo(e){let t=new Map,r=[],n=[];for(let o of e.values()){for(let i of o.dict.matchAll(/\/Font\s*<<([\s\S]*?)>>/g))i[1]&&n.push(i[1]);for(let i of o.dict.matchAll(/\/Font\s+(\d+)\s+\d+\s+R/g)){let a=e.get(Number(i[1]));a&&n.push(a.dict)}}let s=new Set;for(let o of n){let i=/\/([^\s/<>[\]()]+)\s+(\d+)\s+\d+\s+R/g,a;for(;(a=i.exec(o))!==null;){let c=`${a[1]}#${a[2]}`;s.has(c)||(s.add(c),r.push([a[1]??"",Number(a[2])]))}}for(let[o,i]of r){let a=e.get(i);if(!a)continue;let c=null,l=/\/ToUnicode\s+(\d+)\s+\d+\s+R/.exec(a.dict);if(l){let d=e.get(Number(l[1])),h=d?He(d):null;h&&(c=lo(h))}if(c||(c=ho(a.dict,e)),!c)continue;let f=t.get(o)??[];f.push(c),t.set(o,f)}return t}var fo=["alef","bet","gimel","dalet","he","vav","zayin","het","tet","yod","finalkaf","kaf","lamed","finalmem","mem","finalnun","nun","samekh","ayin","finalpe","pe","finaltsadi","tsadi","qof","resh","shin","tav"];function po(e){let t=/^uni([0-9A-Fa-f]{4})$/.exec(e)??/^u([0-9A-Fa-f]{4,6})$/.exec(e);if(t)return String.fromCodePoint(parseInt(t[1],16));let r=/^afii(\d{5})$/.exec(e);if(r){let o=Number(r[1]);if(o>=57664&&o<=57690)return String.fromCharCode(1488+(o-57664))}let n=fo.indexOf(e.replace(/hebrew$/,""));return n>=0?String.fromCharCode(1488+n):e==="space"?" ":/^[A-Za-z]$/.test(e)?e:{zero:"0",one:"1",two:"2",three:"3",four:"4",five:"5",six:"6",seven:"7",eight:"8",nine:"9",period:".",comma:",",hyphen:"-",colon:":",slash:"/",at:"@"}[e]??null}function ho(e,t){let r=e,n=/\/Encoding\s+(\d+)\s+\d+\s+R/.exec(e);n&&(r=t.get(Number(n[1]))?.dict??"");let s=/\/Differences\s*\[([^\]]*)\]/.exec(r);if(!s?.[1])return null;let o=new Map,i=0;for(let a of s[1].match(/\d+|\/[^\s/[\]]+/g)??[]){if(/^\d+$/.test(a)){i=Number(a);continue}let c=po(a.slice(1));c!==null&&o.set(i,c),i+=1}return o.size?{map:o,bytes:1}:null}function Zn(e){let t=[];for(let r=0;r<e.length;r+=1){let n=e[r];if(n!=="\\"){t.push(n.charCodeAt(0)&255);continue}let s=e[r+1];if(s===void 0)break;if(s>="0"&&s<="7"){let i="",a=r+1;for(;a<e.length&&i.length<3&&e[a]>="0"&&e[a]<="7";)i+=e[a],a+=1;t.push(parseInt(i,8)&255),r=a-1;continue}let o={n:10,r:13,t:9,b:8,f:12};t.push(o[s]??s.charCodeAt(0)&255),r+=1}return t}function Yn(e){if(e.length<2||e[0]!==254||e[1]!==255)return null;let t="";for(let r=2;r+1<e.length;r+=2)t+=String.fromCharCode((e[r]??0)<<8|(e[r+1]??0));return t}function Vn(e,t){let r=Yn(e);if(r!==null)return r;if(!t)return e.map(s=>String.fromCharCode(s)).join("");let n="";if(t.bytes===2)for(let s=0;s+1<e.length;s+=2){let o=(e[s]??0)<<8|(e[s+1]??0);n+=t.map.get(o)??""}else for(let s of e)n+=t.map.get(s)??String.fromCharCode(s);return n}function mo(e){let t=0;for(let r of e){let n=r.codePointAt(0)??0;/[\p{L}\p{N}]/u.test(r)?t+=1:(n<32||n>=127&&n<=191||n===65533)&&(t-=2)}return t}function Gn(e,t){if(!t||t.length<=1)return Vn(e,t?.[0]);let r="",n=-1/0;for(let s of t){let o=Vn(e,s),i=mo(o);i>n&&(r=o,n=i)}return r}function go(e,t){let r="",n="",s,o=!1,i="",a=0,c=null,l=()=>{n.trim()&&(r+=n+`
4
4
  `),n="",a=0},f=()=>{n&&!n.endsWith(" ")&&a>1&&(n+=" ")},d=/\/([^\s/<>[\]()]+)\s+-?[\d.]+\s+Tf|(-?[\d.]+)\s+(-?[\d.]+)\s+T[dD]\b|(?:-?[\d.]+\s+){5}(-?[\d.]+)\s+Tm\b|T\*|\((?:\\.|[^\\)])*\)|<[0-9A-Fa-f\s]*>|\[|\]|-?\d+(?:\.\d+)?|TJ|Tj|'|"/g,h;for(;(h=d.exec(e))!==null;){let p=h[0];if(h[1]!==void 0&&p.endsWith("Tf")){s=t.get(h[1]);continue}if(h[2]!==void 0){Math.abs(Number(h[3]))>.01?l():Number(h[2])!==0&&f();continue}if(h[4]!==void 0){let g=Number(h[4]);c!==null&&Math.abs(g-c)>.01?l():c!==null&&f(),c=g;continue}if(p==="T*"){l();continue}if(p==="["){o=!0;continue}if(p==="]"){o=!1;continue}if(p==="TJ"||p==="Tj"||p==="'"||p==='"'){(p==="'"||p==='"')&&l(),i&&(n+=i,a=i.trim().length,i="");continue}if(p.startsWith("("))i+=Gn(Zn(p.slice(1,-1)),s);else if(p.startsWith("<")){let g=p.slice(1,-1).replace(/\s+/g,""),u=[];for(let y=0;y+1<g.length;y+=2)u.push(parseInt(g.slice(y,y+2),16));i+=Gn(u,s)}else o&&Number(p)<-200&&i&&!i.endsWith(" ")&&(i+=" ")}return i&&(n+=i),l(),r}function yo(e,t){let r=e.toString("latin1"),n=/\/Info\s+(\d+)\s+\d+\s+R/.exec(r),s=n?t.get(Number(n[1]))?.dict:void 0;if(!s)return"";let o=[],i=/\/(Author|Title|Subject|Keywords|Creator|Producer)\s*(\((?:\\.|[^\\)])*\)|<[0-9A-Fa-f\s]*>)/g,a;for(;(a=i.exec(s))!==null;){let c=a[2]??"";if(c.startsWith("(")){let l=Zn(c.slice(1,-1));o.push(Yn(l)??l.map(f=>String.fromCharCode(f)).join(""))}else{let l=c.slice(1,-1).replace(/\s+/g,""),f="";if(l.toUpperCase().startsWith("FEFF"))for(let d=4;d+3<l.length+1;d+=4)f+=String.fromCharCode(parseInt(l.slice(d,d+4),16));else for(let d=0;d+1<l.length;d+=2)f+=String.fromCharCode(parseInt(l.slice(d,d+2),16));o.push(f)}}return o.join(`
package/dist/index.js CHANGED
@@ -1,5 +1,5 @@
1
1
  #!/usr/bin/env node
2
- /*! @nodatachat/mcp 1.6.44 | Copyright 2026 Capsule Ltd. | FSL-1.1-ALv2 | see LICENSE.md */
2
+ /*! @nodatachat/mcp 1.6.45 | Copyright 2026 Capsule Ltd. | FSL-1.1-ALv2 | see LICENSE.md */
3
3
  import{createRequire as __ndReq}from"node:module";const[__ndMaj,__ndMin]=process.versions.node.split(".").map(Number);if(!((__ndMaj===20&&__ndMin>=19)||(__ndMaj===22&&__ndMin>=12)||__ndMaj>=23)){process.stderr.write("NoData needs Node.js 20.19+, 22.12+ or 23+; this computer has "+process.version+".\nInstall the current LTS from https://nodejs.org (or: nvm install --lts), then run the same command again.\n");process.exit(1)}const require=__ndReq(import.meta.url);
4
4
  var uP=Object.create;var lp=Object.defineProperty;var pP=Object.getOwnPropertyDescriptor;var fP=Object.getOwnPropertyNames;var hP=Object.getPrototypeOf,gP=Object.prototype.hasOwnProperty;var oe=(e=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(e,{get:(t,n)=>(typeof require<"u"?require:t)[n]}):e)(function(e){if(typeof require<"u")return require.apply(this,arguments);throw Error('Dynamic require of "'+e+'" is not supported')});var H=(e,t)=>()=>(e&&(t=e(e=0)),t);var ge=(e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports),$c=(e,t)=>{for(var n in t)lp(e,n,{get:t[n],enumerable:!0})},mP=(e,t,n,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of fP(t))!gP.call(e,o)&&o!==n&&lp(e,o,{get:()=>t[o],enumerable:!(r=pP(t,o))||r.enumerable});return e};var Ce=(e,t,n)=>(n=e!=null?uP(hP(e)):{},mP(t||!e||!e.__esModule?lp(n,"default",{value:e,enumerable:!0}):n,e));function dp(e){e.table&&(ct.table=e.table),e.severity&&(ct.severity=e.severity),e.amounts&&(ct.amounts=e.amounts);for(let t of e.text??[])ct.text.some(n=>n.kind===t.kind)||ct.text.push(t);e.header&&!ct.header.includes(e.header)&&ct.header.push(e.header);for(let t of e.secrets??[])ct.secrets.some(n=>n.id===t.id)||ct.secrets.push(t)}function Ec(e){return ct.severity?.(e)}function up(){return ct.amounts?.()===!0}function Vo(){return ct.text}function S_(){return ct.header}function qo(){return ct.table}function x_(){return ct.secrets}var ct,cr=H(()=>{"use strict";ct={text:[],header:[],secrets:[],table:null,amounts:null,severity:null}});function Tt(){let e=x_().filter(t=>!Ac.some(n=>n.id===t.id));return[...Ac,...e]}function _P(e,t){let n=i=>i.replace(/^[^0-9]*/,"").split(".").map(s=>parseInt(s,10)||0),r=n(e),o=n(t);for(let i=0;i<3;i++){if((r[i]||0)<(o[i]||0))return!0;if((r[i]||0)>(o[i]||0))return!1}return!1}function A_(e){let t=[],n;try{n=JSON.parse(e)}catch{return t}let r={...n.dependencies??{},...n.devDependencies??{}};for(let[o,i]of Object.entries(r)){let s=(i||"").replace(/^[\^~>=<\s]+/,""),a=yP.find(c=>c.name===o&&_P(s,c.below));a&&t.push({name:o,version:s,vuln:a})}return t}function Hn(e){if(!e)return null;let t=e.trim();if(vP.test(t)||/^name$/i.test(t)||/^\[[A-Z_]+(?:-\d+)?\]$/.test(t))return null;let n=t.replace(/[\s-]+/g,"_");for(let r of[...wP,...bP])if(r.pattern.test(t)||r.pattern.test(n))return{type:r.type,label:r.label};if(kP.test(t))return null;if(/^שם[ _][\u0590-\u05FF"'׳ ]{2,20}$/.test(t))return{type:"name",label:"\u05E9\u05DD \u05D0\u05D3\u05DD"};if(/^(customer|client|employee|inspector|supervisor|contact|person|patient|user|owner|manager|agent|member|driver|tenant|student|parent|beneficiary|insured)_?(full_?)?name$/i.test(n))return{type:"name",label:"Person name"};for(let r of S_()){let o=r(t);if(o)return{type:o.type,label:o.label}}return null}function Pc(e){let t=String(e??"").replace(/\D/g,"");if(t.length===0||t.length>9)return!1;let n=t.padStart(9,"0"),r=0;for(let o=0;o<9;o++){let i=parseInt(n[o]??"0",10)*(o%2+1);i>9&&(i-=9),r+=i}return r%10===0&&parseInt(n,10)>0}function SP(e){let t=String(e??"").replace(/\D/g,"");if(t.length<12||t.length>19)return!1;let n=0,r=!1;for(let o=t.length-1;o>=0;o-=1){let i=parseInt(t[o]??"0",10);r&&(i*=2,i>9&&(i-=9)),n+=i,r=!r}return n%10===0}function Rc(e){let t=String(e??"").replace(/\s/g,"").toUpperCase();if(!/^[A-Z]{2}\d{2}[A-Z0-9]{10,30}$/.test(t))return!1;let n=t.slice(4)+t.slice(0,4),r=0;for(let o of n){let i=o>="A"&&o<="Z"?String(o.charCodeAt(0)-55):o;for(let s of i)r=(r*10+Number(s))%97}return r===1}function T_(e){if(e.length!==14&&e.length!==17)return!1;let t=+e.slice(0,4),n=+e.slice(4,6),r=+e.slice(6,8),o=+e.slice(8,10),i=+e.slice(10,12),s=+e.slice(12,14);return t>=1970&&t<=2099&&n>=1&&n<=12&&r>=1&&r<=31&&o<24&&i<60&&s<60}function P_(e){let t=Number(e);return!Number.isSafeInteger(t)||t<1024?!1:Number.isInteger(Math.log2(t))||t%1048576===0}function As(e){return xP.has(e.replace(/\D/g,""))}function Nc(e){let t=e.replace(/\D/g,"");return T_(t)||P_(t)}function Yr(e,t){let n=[];for(let r of Ps){r.pattern.lastIndex=0;let o=new Set,i,s=0;for(;(i=r.pattern.exec(e))!==null&&(s+=1,!(s>2e5));){let a=i[0];if(!(r.subkind!=="iban"&&r.subkind!=="israeli_phone"&&Nc(a))&&(r.validate(a)&&o.add(a.replace(/[\s-]/g,"")),o.size>=1e5))break}if(o.size>0){if(t)for(let c of o)As(c)||t(r.subkind,c);let a=[...o].filter(c=>!As(c)).length;n.push({subkind:r.subkind,severity:a===0?"low":r.severity,hint:a===0?`${r.hint} All ${o.size} are published test numbers.`:r.hint,count:o.size,real:a})}}for(let r of Vo()){let o=new Set;for(let i of r.find(e))o.add(e.slice(i.start,i.end).trim());o.size>0&&n.push({subkind:r.kind,severity:r.severity,hint:r.hint,count:o.size})}return n}function Jr(e,t){let n=[],r="",o=!1;for(let i=0;i<e.length;i++){let s=e[i];o?s==='"'&&e[i+1]==='"'?(r+='"',i++):s==='"'?o=!1:r+=s:s==='"'?o=!0:s===t?(n.push(r),r=""):r+=s}return n.push(r),n}var Ac,$_,E_,hp,yP,bP,wP,vP,kP,Tc,gp,Ts,pp,fp,Ps,xP,lr=H(()=>{"use strict";cr();Ac=[{id:"aws-access-key",name:"AWS Access Key",pattern:/(?:^|[^A-Z0-9])AKIA(?!X{16})[A-Z2-7]{16}(?:[^A-Z2-7]|$)/,severity:"critical"},{id:"aws-secret-key",name:"AWS Secret Key",pattern:/(?:aws_secret_access_key|aws_secret_key|secret_access_key)\s*[=:]\s*['"]?[A-Za-z0-9/+=]{40}['"]?/,severity:"critical"},{id:"gcp-api-key",name:"GCP API Key",pattern:/AIza[0-9A-Za-z_-]{35}/,severity:"critical"},{id:"gcp-service-account",name:"GCP Service Account",pattern:/"type"\s*:\s*"service_account"/,severity:"critical"},{id:"github-token",name:"GitHub Token",pattern:/gh[pousr]_[0-9a-zA-Z]{36,}/,severity:"critical"},{id:"github-fine-grained",name:"GitHub Fine-Grained Token",pattern:/github_pat_[0-9a-zA-Z_]{22,}/,severity:"critical"},{id:"gitlab-token",name:"GitLab Token",pattern:/glpat-[0-9a-zA-Z_-]{20,}/,severity:"critical"},{id:"stripe-secret",name:"Stripe Secret Key",pattern:/sk_live_[0-9a-zA-Z]{24,}/,severity:"critical"},{id:"stripe-restricted",name:"Stripe Restricted Key",pattern:/rk_live_[0-9a-zA-Z]{24,}/,severity:"critical"},{id:"slack-token",name:"Slack Token",pattern:/xox[baprs]-[0-9a-zA-Z-]{10,}/,severity:"high"},{id:"slack-webhook",name:"Slack Webhook",pattern:/hooks\.slack\.com\/services\/T[0-9A-Z]{8,}\/B[0-9A-Z]{8,}\/[0-9a-zA-Z]{24}/,severity:"high"},{id:"twilio-api-key",name:"Twilio API Key",pattern:/SK[0-9a-fA-F]{32}/,severity:"high"},{id:"sendgrid-api-key",name:"SendGrid API Key",pattern:/SG\.[0-9a-zA-Z_-]{22}\.[0-9a-zA-Z_-]{43}/,severity:"critical"},{id:"postgres-uri",name:"PostgreSQL Connection String",pattern:/postgres(?:ql)?:\/\/[^\s'"]{10,}/,severity:"critical"},{id:"mongodb-uri",name:"MongoDB Connection String",pattern:/mongodb(?:\+srv)?:\/\/[^\s'"]{10,}/,severity:"critical"},{id:"redis-uri",name:"Redis Connection String",pattern:/redis(?:s)?:\/\/[^\s'"]{10,}/,severity:"high"},{id:"openai-key",name:"OpenAI API Key",pattern:/sk-[0-9a-zA-Z]{20,}T3BlbkFJ[0-9a-zA-Z]{20,}/,severity:"critical"},{id:"openai-project-key",name:"OpenAI API Key",pattern:/sk-(?:proj|svcacct|admin)-[0-9A-Za-z_-]{40,}/,severity:"critical"},{id:"anthropic-key",name:"Anthropic API Key",pattern:/sk-ant-[0-9a-zA-Z_-]{40,}/,severity:"critical"},{id:"firebase-key",name:"Firebase API Key",pattern:/AIza[0-9A-Za-z_-]{35}/,severity:"high"},{id:"supabase-key",name:"Supabase Service Key",pattern:/eyJ[0-9a-zA-Z_-]{100,}/,severity:"critical"},{id:"supabase-access-token",name:"Supabase Access Token",pattern:/\bsbp_[0-9a-f]{40}\b/,severity:"critical"},{id:"supabase-secret-key",name:"Supabase Secret Key",pattern:/\bsb_secret_[0-9A-Za-z_-]{20,}/,severity:"critical"},{id:"private-key",name:"Private Key",pattern:/-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/,severity:"critical"},{id:"jwt-secret",name:"JWT/Generic Secret",pattern:/(?:jwt_secret|JWT_SECRET|secret_key|SECRET_KEY|api_secret|API_SECRET)\s*[=:]\s*['"][^'"]{8,}['"]/,severity:"high"},{id:"password-in-code",name:"Password in Code",pattern:/(?:password|passwd|pwd)\s*[=:]\s*['"][^'"]{8,}['"]/,severity:"high"},{id:"bearer-token",name:"Bearer Token in Code",pattern:/['"]Bearer\s+[0-9a-zA-Z._-]{20,}['"]/,severity:"high"}];$_=/node_modules\/|\.next\/|\.test\.|\.spec\.|__tests__\/|\.nodata-proof\.json$|\.git\//,E_=/(^|\/)\.env(\.[\w-]+)*\.(example|sample|template|dist)$|\.(example|sample|template)$|(^|\/)[^/]*\.(example|sample)\.[a-z0-9]+$/i,hp=/(^|\/)(__tests__|__mocks__|tests?|spec|fixtures?|mocks?|samples?|examples?|demo|testdata)(\/|$)|\.(test|spec)\.[a-z0-9]+$|\.min\.(m?js|css)$|(^|\/)[^/]*\.worker\.min\.m?js$/i,yP=[{name:"lodash",below:"4.17.21",severity:"critical",cve:"CVE-2021-23337",desc:"Command injection via template"},{name:"minimist",below:"1.2.6",severity:"critical",cve:"CVE-2021-44906",desc:"Prototype pollution"},{name:"json5",below:"2.2.2",severity:"high",cve:"CVE-2022-46175",desc:"Prototype pollution"},{name:"express",below:"4.19.2",severity:"high",cve:"CVE-2024-29041",desc:"Open redirect"},{name:"path-to-regexp",below:"6.3.0",severity:"high",cve:"CVE-2024-45296",desc:"ReDoS"},{name:"sanitize-html",below:"2.12.1",severity:"high",cve:"CVE-2024-21501",desc:"XSS bypass"},{name:"dompurify",below:"3.0.9",severity:"high",cve:"CVE-2024-45801",desc:"mXSS"},{name:"jsonwebtoken",below:"9.0.0",severity:"critical",cve:"CVE-2022-23529",desc:"Key confusion attack"},{name:"jose",below:"4.15.5",severity:"high",cve:"CVE-2024-28176",desc:"DoS via JWE"},{name:"axios",below:"1.6.0",severity:"high",cve:"CVE-2023-45857",desc:"CSRF cookie leak"},{name:"node-fetch",below:"2.6.7",severity:"high",cve:"CVE-2022-0235",desc:"Header leak on redirect"},{name:"serialize-javascript",below:"6.0.2",severity:"critical",cve:"CVE-2024-11831",desc:"XSS via serialization"},{name:"xml2js",below:"0.6.0",severity:"high",cve:"CVE-2023-0842",desc:"Prototype pollution"},{name:"next",below:"14.1.1",severity:"high",cve:"CVE-2024-34350",desc:"SSRF via headers"},{name:"sharp",below:"0.32.6",severity:"high",cve:"CVE-2023-4863",desc:"libwebp heap overflow"},{name:"multer",below:"1.4.5",severity:"high",cve:"CVE-2022-24434",desc:"Prototype pollution"},{name:"tough-cookie",below:"4.1.3",severity:"medium",cve:"CVE-2023-26136",desc:"Prototype pollution"},{name:"semver",below:"7.5.4",severity:"medium",cve:"CVE-2022-25883",desc:"ReDoS"},{name:"ip",below:"2.0.1",severity:"critical",cve:"CVE-2024-29415",desc:"SSRF bypass via octal IP"},{name:"tar",below:"6.2.1",severity:"high",cve:"CVE-2024-28863",desc:"DoS via path traversal"}];bP=[{pattern:/^(full_?name|first_?name|last_?name|spouse_?name|beneficiary_?name)$/i,type:"name",label:"Person name"},{pattern:/^(email|e_?mail|email_?address)$/i,type:"email",label:"Email address"},{pattern:/^(phone|mobile|telephone|phone_?number|cell_?phone)$/i,type:"phone",label:"Phone number"},{pattern:/^(id_?number|identity|ssn|social_?security|national_?id|teudat_?zehut)$/i,type:"id",label:"ID number"},{pattern:/^(address|street_?address|home_?address)$/i,type:"address",label:"Address"},{pattern:/^(date_?of_?birth|dob|birth_?date|birthday)$/i,type:"dob",label:"Date of birth"},{pattern:/^(bank_?account|iban|account_?number|bank_?details|routing_?number)$/i,type:"financial",label:"Bank account"},{pattern:/^(credit_?card|card_?number|cvv|cc_?number)$/i,type:"financial",label:"Credit card"},{pattern:/^(salary|income|commission|premium|compensation)$/i,type:"financial",label:"Salary / income"},{pattern:/^(medical_?info|health_?conditions|diagnosis|medication|prescription)$/i,type:"medical",label:"Medical"},{pattern:/^(passport|passport_?number|passport_?id)$/i,type:"id",label:"Passport"},{pattern:/^(driver_?license|drivers_?license|dl_?number)$/i,type:"id",label:"Driver license"},{pattern:/^(tax_?id|tin|vat_?number|ein)$/i,type:"financial",label:"Tax ID"},{pattern:/^(insurance_?number|policy_?number|member_?id)$/i,type:"id",label:"Insurance/Policy"},{pattern:/^(biometric|fingerprint|face_?id|retina)$/i,type:"biometric",label:"Biometric"},{pattern:/^(latitude|longitude|lat|lng|geo_?location|coordinates)$/i,type:"location",label:"Geolocation"}],wP=[{pattern:/^(?:שם|שם_מלא|שם פרטי|שם_פרטי|שם משפחה|שם_משפחה|שם הלקוח|שם בן זוג|שם המבוטח|שם המוטב|שם הילד|שם הקטין)$/i,type:"name",label:"\u05E9\u05DD \u05D0\u05D3\u05DD"},{pattern:/^(?:ת"ז|ת\.ז|ת ז|תז|תעודת זהות|תעודת_זהות|מספר זהות|מס' זהות|teudat_zehut|tz|israeli_id|il_id)$/i,type:"id",label:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA"},{pattern:/^(?:דרכון|מספר דרכון|רישיון נהיגה|רישיון_נהיגה|רשיון נהיגה)$/i,type:"id",label:"\u05D3\u05E8\u05DB\u05D5\u05DF/\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF"},{pattern:/^(?:מייל|דוא"ל|דוא_ל|דואר אלקטרוני|אימייל|כתובת מייל)$/i,type:"email",label:"\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9"},{pattern:/^(?:טלפון|טל'|נייד|פלאפון|סלולרי|מספר טלפון|טלפון נייד)$/i,type:"phone",label:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF"},{pattern:/^(?:כתובת|כתובת מגורים|רחוב|מס בית|עיר|ישוב|יישוב|מיקוד|כתובת מלאה|מען)$/i,type:"address",label:"\u05DB\u05EA\u05D5\u05D1\u05EA"},{pattern:/^(?:תאריך לידה|ת לידה|תאריך הולדת|יום הולדת|גיל)$/i,type:"dob",label:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"},{pattern:/^(?:חשבון בנק|מספר חשבון|מס חשבון|סניף|iban|iban_il)$/i,type:"financial",label:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7"},{pattern:/^(?:כרטיס אשראי|מספר אשראי|cvv|אשראי)$/i,type:"financial",label:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"},{pattern:/^(?:שכר|משכורת|הכנסה|פרמיה|שכר ברוטו|שכר נטו|תגמול|בונוס|פיצוי)$/i,type:"financial",label:"\u05E9\u05DB\u05E8/\u05D4\u05DB\u05E0\u05E1\u05D4"},{pattern:/^(?:אבחון|אבחנה|מחלה|תרופה|מרשם|בדיקה רפואית|מצב רפואי|חיסון|רגישות|אלרגיה|סוג דם)$/i,type:"medical",label:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(?:מספר פוליסה|מס פוליסה|פוליסה|מספר חבר|מספר ביטוח)$/i,type:"id",label:"\u05E4\u05D5\u05DC\u05D9\u05E1\u05D4/\u05D7\u05D1\u05E8\u05D5\u05EA"},{pattern:/^(?:שם הילד|תעודת זהות של ילד|ילדים|קטין|מספר ילדים|תעודת לידה)$/i,type:"minor_data",label:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05DF"},{pattern:/^(?:דת|לאום|מין|נטייה מינית|השקפה פוליטית|מצב משפחתי|עדה|מוצא)$/i,type:"sensitive_personal",label:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9"},{pattern:/^(?:מספר רכב|מס רכב|לוחית רישוי|מספר רישוי)$/i,type:"tracking",label:"\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"}],vP=/^(id|uuid|created_?at|updated_?at|deleted_?at|status|type|category|description|title|slug|url|path|key|value|enabled|active|public|version|metadata|config|settings|data|content|note|comment|label|color|icon)$/i,kP=/^שם[ _](?:ה)?(?:קובץ|מוצר|פריט|חברה|ארגון|עסק|פרויקט|גיליון|טבלה|שדה|קטגוריה|סניף|בנק|עיר|רחוב|ישוב|יישוב|מסמך|תוכנית|חבילה|קורס|מחלקה|אתר|דומיין|מותג|ספק|שירות|תפקיד)$|^(file|product|item|company|org|organization|project|sheet|table|field|category|branch|bank|city|street|document|plan|course|department|site|domain|brand|vendor|service|role)[ _-]?name$/i;Tc={id:"critical",financial:"critical",medical:"critical",biometric:"critical",minor_data:"critical",sensitive_personal:"critical",email:"high",phone:"high",name:"high",address:"high",dob:"high",tracking:"medium",location:"high",auth:"critical",employment:"medium",education:"medium",behavior:"high"};gp=/(?<!\d)(?<!\d[.,])(?:\+972[\s-]?|0)(?:5[0-9]|7[0-9]|[2-4]|[89])(?:[\s-]?\d){7}(?!\d)(?![.,]\d)/g,Ts=/\bIL\d{2}\s?(?:\d{4}\s?){4}\d{3}\b/g;pp="(?<!\\d)(?<!\\d[.,])",fp="(?!\\d)(?![.,]\\d)",Ps=[{subkind:"israeli_id",severity:"high",pattern:new RegExp(`${pp}(?:\\d{8}-\\d|\\d{9})${fp}`,"g"),validate:Pc,hint:"Israeli national ID (check digit verified) in plaintext. Encrypt the column or mask it at rest."},{subkind:"credit_card",severity:"critical",pattern:new RegExp(`${pp}[2-6][ -]?(?:\\d[ -]?){11,17}\\d${fp}`,"g"),validate:SP,hint:"Payment card number (Luhn verified) in plaintext. This is PCI scope."},{subkind:"iban",severity:"high",pattern:/\b[A-Z]{2}\d{2}(?: ?[A-Z0-9]{4}){2,7}(?: ?[A-Z0-9]{1,4})?\b/g,validate:Rc,hint:"Bank account in IBAN form (mod-97 verified) in plaintext."},{subkind:"israeli_phone",severity:"medium",pattern:new RegExp(`${pp}(?:\\+972[- ]?|0)(?:[57]\\d|[2-489])[- ]?\\d{3}[- ]?\\d{4}${fp}`,"g"),validate:e=>{let t=e.replace(/\D/g,"").replace(/^972/,"0");return/^0[57]\d{8}$/.test(t)?!0:/^0[2-489]\d{7}$/.test(t)&&(/[- ]/.test(e)||e.startsWith("+972"))},hint:"Israeli phone number in plaintext."}];xP=new Set(["000000018","123456782","111111118","222222226","333333334","999999998","4111111111111111","4242424242424242","4000056655665556","5555555555554444","5105105105105100","2223003122003222","378282246310005","371449635398431","6011111111111117","3056930009020004","4012888888881881","4000000000000002"])});import{inflateSync as R_}from"node:zlib";function Oc(e){let t=e.toString("latin1"),n=new Map,r=/(\d+)\s+(\d+)\s+obj\b/g,o;for(;(o=r.exec(t))!==null;){let i=Number(o[1]),s=r.lastIndex,a=t.indexOf("endobj",s);if(a<0)continue;let c=t.indexOf("stream",s),l,d=null;if(c>=0&&c<a){l=t.slice(s,c);let u=c+6;t[u]==="\r"&&(u+=1),t[u]===`
5
5
  `&&(u+=1);let p=t.indexOf("endstream",u);p>u&&(d=e.subarray(u,p))}else l=t.slice(s,a);n.set(i,{num:i,dict:l,stream:d})}for(let i of[...n.values()]){if(!i.stream||!/\/Type\s*\/ObjStm\b/.test(i.dict))continue;let s=Ns(i),a=Number(/\/N\s+(\d+)/.exec(i.dict)?.[1]??0),c=Number(/\/First\s+(\d+)/.exec(i.dict)?.[1]??-1);if(s===null||!a||c<0)continue;let l=s.slice(0,c).trim().split(/\s+/).map(Number);for(let d=0;d<a;d+=1){let u=l[2*d],p=l[2*d+1];if(u===void 0||p===void 0||Number.isNaN(u)||Number.isNaN(p))break;let f=d+1<a?l[2*(d+1)+1]:void 0,h=s.slice(c+p,f!==void 0?c+f:void 0);n.has(u)||n.set(u,{num:u,dict:h,stream:null})}}return n}function mp(e){let t=[...e.replace(/\s+/g,"")];if(t.length<40)return!1;let n=0,r=0;for(let o of t){let i=o.codePointAt(0)??0;i<32||i>=127&&i<=191||i===65533||i>=57344&&i<=63743?n+=1:/[\p{L}\p{N}]/u.test(o)&&(r+=1)}return n/t.length>.2||r/t.length<.25}function $P(e){let t=e.toString("latin1").replace(/\s/g,"");t.startsWith("<~")&&(t=t.slice(2));let n=t.indexOf("~>");n>=0&&(t=t.slice(0,n));let r=[],o=0,i=0;for(let s of t){if(s==="z"&&i===0){r.push(0,0,0,0);continue}let a=s.charCodeAt(0)-33;if(a<0||a>84)return null;o=o*85+a,i+=1,i===5&&(r.push(o>>>24&255,o>>>16&255,o>>>8&255,o&255),o=0,i=0)}if(i>0){for(let a=i;a<5;a+=1)o=o*85+84;let s=[o>>>24&255,o>>>16&255,o>>>8&255,o&255];for(let a=0;a<i-1;a+=1)r.push(s[a]??0)}return Buffer.from(r)}function EP(e){let t=e.toString("latin1").replace(/\s/g,"").split(">")[0]??"",n=t.length%2?t+"0":t;return/^[0-9A-Fa-f]*$/.test(n)?Buffer.from(n,"hex"):null}function AP(e){let t=/\/Filter\s*(\[[^\]]*\]|\/\w+)/.exec(e);return!t||!t[1]?[]:[...t[1].matchAll(/\/(\w+)/g)].map(n=>n[1]??"")}function Ns(e,t){if(!e.stream)return null;let n=e.stream;for(let r of AP(e.dict)){let o=null;if(r==="FlateDecode")try{o=t!==void 0?R_(n,{maxOutputLength:Math.max(1,t)}):R_(n)}catch{return null}else if(r==="ASCII85Decode")o=$P(n);else if(r==="ASCIIHexDecode")o=EP(n);else return null;if(o===null)return null;n=o}return n.toString("latin1")}function TP(e){let t=new Map,n=1,r=/begincodespacerange([\s\S]*?)endcodespacerange/.exec(e);if(r&&r[1]){let c=/<([0-9A-Fa-f]+)>/.exec(r[1]);c&&c[1]&&c[1].length>=4&&(n=2)}let o=c=>{let l="";for(let d=0;d+3<c.length+1;d+=4){let u=parseInt(c.slice(d,d+4),16);Number.isFinite(u)&&u>0&&(l+=String.fromCharCode(u))}return l},i=/beginbfchar([\s\S]*?)endbfchar/g,s;for(;(s=i.exec(e))!==null;){let c=/<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]*)>/g,l;for(;(l=c.exec(s[1]??""))!==null;)t.set(parseInt(l[1]??"0",16),o(l[2]??""))}let a=/beginbfrange([\s\S]*?)endbfrange/g;for(;(s=a.exec(e))!==null;){let c=s[1]??"",l=/<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]*)>/g,d;for(;(d=l.exec(c))!==null;){let u=parseInt(d[1]??"0",16),p=parseInt(d[2]??"0",16),f=parseInt((d[3]??"0").slice(0,4)||"0",16);if(!(p-u>65535))for(let h=u;h<=p;h+=1)t.set(h,String.fromCharCode(f+(h-u)))}}return{map:t,bytes:n}}function PP(e){let t=new Map,n=[],r=[];for(let i of e.values()){for(let s of i.dict.matchAll(/\/Font\s*<<([\s\S]*?)>>/g))s[1]&&r.push(s[1]);for(let s of i.dict.matchAll(/\/Font\s+(\d+)\s+\d+\s+R/g)){let a=e.get(Number(s[1]));a&&r.push(a.dict)}}let o=new Set;for(let i of r){let s=/\/([^\s/<>[\]()]+)\s+(\d+)\s+\d+\s+R/g,a;for(;(a=s.exec(i))!==null;){let c=`${a[1]}#${a[2]}`;o.has(c)||(o.add(c),n.push([a[1]??"",Number(a[2])]))}}for(let[i,s]of n){let a=e.get(s);if(!a)continue;let c=null,l=/\/ToUnicode\s+(\d+)\s+\d+\s+R/.exec(a.dict);if(l){let u=e.get(Number(l[1])),p=u?Ns(u):null;p&&(c=TP(p))}if(c||(c=OP(a.dict,e)),!c)continue;let d=t.get(i)??[];d.push(c),t.set(i,d)}return t}function NP(e){let t=/^uni([0-9A-Fa-f]{4})$/.exec(e)??/^u([0-9A-Fa-f]{4,6})$/.exec(e);if(t)return String.fromCodePoint(parseInt(t[1],16));let n=/^afii(\d{5})$/.exec(e);if(n){let i=Number(n[1]);if(i>=57664&&i<=57690)return String.fromCharCode(1488+(i-57664))}let r=RP.indexOf(e.replace(/hebrew$/,""));return r>=0?String.fromCharCode(1488+r):e==="space"?" ":/^[A-Za-z]$/.test(e)?e:{zero:"0",one:"1",two:"2",three:"3",four:"4",five:"5",six:"6",seven:"7",eight:"8",nine:"9",period:".",comma:",",hyphen:"-",colon:":",slash:"/",at:"@"}[e]??null}function OP(e,t){let n=e,r=/\/Encoding\s+(\d+)\s+\d+\s+R/.exec(e);r&&(n=t.get(Number(r[1]))?.dict??"");let o=/\/Differences\s*\[([^\]]*)\]/.exec(n);if(!o?.[1])return null;let i=new Map,s=0;for(let a of o[1].match(/\d+|\/[^\s/[\]]+/g)??[]){if(/^\d+$/.test(a)){s=Number(a);continue}let c=NP(a.slice(1));c!==null&&i.set(s,c),s+=1}return i.size?{map:i,bytes:1}:null}function L_(e){let t=[];for(let n=0;n<e.length;n+=1){let r=e[n];if(r!=="\\"){t.push(r.charCodeAt(0)&255);continue}let o=e[n+1];if(o===void 0)break;if(o>="0"&&o<="7"){let s="",a=n+1;for(;a<e.length&&s.length<3&&e[a]>="0"&&e[a]<="7";)s+=e[a],a+=1;t.push(parseInt(s,8)&255),n=a-1;continue}let i={n:10,r:13,t:9,b:8,f:12};t.push(i[o]??o.charCodeAt(0)&255),n+=1}return t}function F_(e){if(e.length<2||e[0]!==254||e[1]!==255)return null;let t="";for(let n=2;n+1<e.length;n+=2)t+=String.fromCharCode((e[n]??0)<<8|(e[n+1]??0));return t}function O_(e,t){let n=F_(e);if(n!==null)return n;if(!t)return e.map(o=>String.fromCharCode(o)).join("");let r="";if(t.bytes===2)for(let o=0;o+1<e.length;o+=2){let i=(e[o]??0)<<8|(e[o+1]??0);r+=t.map.get(i)??""}else for(let o of e)r+=t.map.get(o)??String.fromCharCode(o);return r}function CP(e){let t=0;for(let n of e){let r=n.codePointAt(0)??0;/[\p{L}\p{N}]/u.test(n)?t+=1:(r<32||r>=127&&r<=191||r===65533)&&(t-=2)}return t}function C_(e,t){if(!t||t.length<=1)return O_(e,t?.[0]);let n="",r=-1/0;for(let o of t){let i=O_(e,o),s=CP(i);s>r&&(n=i,r=s)}return n}function IP(e,t){let n="",r="",o,i=!1,s="",a=0,c=null,l=()=>{r.trim()&&(n+=r+`
@@ -401,7 +401,7 @@ A command that holds a secret can also send it out. Approve only a command you r
401
401
  `),r={}){if(!process.stdin.isTTY)return n("This runs only in a terminal you type in yourself \u2014 not through an agent (a secret must never pass through one)."),1;let o=xs();if(!o)return n(Iy),2;let i=t.indexOf("--project"),s=(i>=0?t[i+1]:null)??o.project??null,a=i>=0?t.filter((m,S)=>S!==i&&S!==i+1):t;if(!s)return n(o.via==="device"?"\u2717 Which project? --project <label>":"\u2717 Which project? --project <label> (or log in with one: secrets-login --project <label>)."),2;let c=[],l="";if(e==="secrets-set"){let m=[...new Set(a)];if(!m.length||m.some(S=>!/^[A-Za-z_][A-Za-z0-9_]{0,199}$/.test(S)))return n("Usage: nodata-mcp secrets-set [--project <label>] KEY_NAME [KEY_NAME \u2026] (each value is typed next, hidden)"),2;if(l=await Py(o,"secrets-set",s,m,n,r),l===null)return 4;for(let S of m){let b="";for(let k=0;;k++){b=await(r.readValue??ft)(`Value for ${S} (not shown; split here \u2014 NoData gets only half): `);let x=uH(b);if(!x)break;if(n(`\u2717 ${S}: ${x}.`),k>=2)return m.length>1&&n(`\u270B Nothing written \u2014 run it again for all of ${m.join(", ")}.`),1}n(` read ${b.length} characters for ${S}.`),c.push({key:S,value:b})}}else{let m=a[0]??"";if(!m||!Ss(m))return n("Usage: nodata-mcp secrets-import [--project <label>] <.env file>"),2;let S=sT(m).map(b=>b.key);if(!S.length)return n(`\u2717 No KEY=value lines in ${m}.`),1;if(l=await Py(o,"secrets-import",s,S,n,r),l===null)return 4;c=sT(m)}let d=[];for(let m of c)try{d.push({key:m.key,...(0,At.splitKey)(m.value,0)})}catch(S){n(`\u2717 ${m.key}: ${S instanceof Error?S.message:String(S)} \u2014 skipped.`)}if(e==="secrets-set"&&l&&d.length!==c.length){for(let m of d)m.server.fill(0),m.client.fill(0);return n("\u270B Nothing written \u2014 a value could not be split. Run it again."),1}let u=await Oy(o,s),p={};if(!("error"in u))for(let m of d){let S=await mT(s,m.key,m.client,u);S&&(p[m.key]=S)}let f;try{f=await bc(o)}catch(m){for(let S of d)S.server.fill(0),S.client.fill(0);return n(`\u2717 NOT saved \u2014 ${m instanceof Error?m.message:String(m)}`),1}let h=await fetch(`${o.base_url}/api/secrets/import`,{method:"POST",headers:{authorization:`Bearer ${f}`,"content-type":"application/json"},body:JSON.stringify({projectLabel:s,...l?{op:e,approval_id:l}:{},entries:d.map(m=>({key:m.key,server_share:m.server.toString("base64"),...p[m.key]??{}}))})});for(let m of d)m.server.fill(0);let g=await h.json().catch(()=>({}));if(!h.ok&&!g.summary){for(let m of d)m.client.fill(0);return n(`\u2717 NOT saved \u2014 ${g.error??`HTTP ${h.status}`}`),1}let y=new Set([...(g.rejected??[]).map(m=>m.key),...(g.errors??[]).map(m=>m.split(":")[0])]),_=Vu(),w=0;for(let m of d)y.has(m.key)||(_.shares[Gu(o.base_url,s,m.key)]={share:m.client.toString("base64"),set_at:new Date().toISOString()},w+=1),m.client.fill(0);nH(_);for(let m of g.rejected??[])n(`\u2717 ${m.key}: ${m.reason}`);return n(`\u2713 ${w} secret(s) in ${s}: NoData holds half of each; this computer's half is in ~/.nodata/secret-shares.json (closed to agents). Run with them: npx -y @nodatachat/mcp secrets-run -- <command>`),n(ET(u,Object.keys(p).length)),w?0:1}function ET(e,t){if("error"in e)return` Not shared with the team (${e.error}) \u2014 only this computer holds the other half. Share later: secrets-share`;let n=e.master?" and to the organisation's master key (the 12 words)":" (no organisation master key yet \u2014 the 12 words are not set up)";return` Shared: ${t} half/halves sealed to ${e.recipients.length} approved computer(s) of the people given this project${n}. NoData cannot open them; the grant releases NoData's half.`}async function zu(e,t=r=>process.stderr.write(r+`
402
402
  `),n={}){let r=xs();if(!r)return t(Iy),2;let o=e.indexOf("--project"),i=(o>=0?e[o+1]:null)??r.project??null;if(!i){let h=await hT(r);if(!h.length)return t("\u2713 Nothing waits to be shared: every recipient has its copy of the halves this computer holds."),0;let g=0;for(let y of h)t(`\xB7 ${y.project}: ${y.keys.join(", ")} \u2192 ${y.devices.length} recipient(s) waiting`),g=Math.max(g,await zu(["--project",y.project],t,n));return g}let s=Gu(r.base_url,i,""),a=Object.entries(Vu().shares).filter(([h])=>h.startsWith(s));if(!a.length)return t(`\u2717 This computer holds no halves of ${i} \u2014 only the computer that set a secret can share it.`),1;let c=await Oy(r,i);if("error"in c)return t(`\u2717 Could not get whom to share with: ${c.error}`),1;let l=[];for(let[h,{share:g}]of a){let y=h.slice(s.length),_=Buffer.from(g,"base64"),w=await mT(i,y,_,c);_.fill(0),w&&l.push({key:y,...w})}if(!l.length)return t(`\u2717 No one to share with in ${i}: no approved computer with a seal key among the people given it, and no master key.`),1;let d=await Py(r,"secrets-share",i,l.map(h=>h.key),t,n);if(d===null)return 4;let u;try{u=await bc(r)}catch(h){return t(`\u2717 NOT shared \u2014 ${h instanceof Error?h.message:String(h)}`),1}let p=await fetch(`${r.base_url}/api/secrets/import`,{method:"POST",headers:{authorization:`Bearer ${u}`,"content-type":"application/json"},body:JSON.stringify({projectLabel:i,...d?{op:"secrets-share",approval_id:d}:{},entries:l})}),f=await p.json().catch(()=>({}));if(!p.ok&&!f.summary)return t(`\u2717 NOT shared \u2014 ${f.error??`HTTP ${p.status}`}`),1;for(let h of f.errors??[])t(`\u2717 ${h}`);return t(ET(c,f.summary?.shared??0)),(f.summary?.shared??0)>0?0:1}function EH(e){return e.toLowerCase().replace(/[^a-z\s]+/g," ").trim().split(/\s+/).filter(Boolean).join(" ")}async function AH(e){let t=EH(e);if(t.split(" ").length!==12)throw new Error("the organisation key is 12 words");let n=wH(Buffer.from(t,"utf8"),Buffer.from("mnemonic","utf8"),2048,64,"sha512"),r=new $H,o=await r.deriveKeyPair(new Uint8Array(n).buffer),i=Buffer.from(await r.serializePrivateKey(o.privateKey)),s=Buffer.from(await r.serializePublicKey(o.publicKey));return n.fill(0),{secretKey:i,publicKey:s,kid:(0,TT.kidForPublicKey)(s)}}function TH(e){let t=xH(e);if(!vH(t))return[];if(!AT(t).isDirectory())return t.endsWith(".ndc")?[t]:[];let n=[],r=(o,i)=>{for(let s of kH(o)){let a=SH(o,s),c=AT(a);c.isDirectory()&&i<8&&!s.startsWith(".")?r(a,i+1):c.isFile()&&s.endsWith(".ndc")&&n.push(a)}};return r(t,0),n}async function PT(e,t=r=>process.stderr.write(r+`
403
403
  `),n=()=>ft("The organisation's 12 words (not shown; they stay on this machine): ")){if(!process.stdin.isTTY)return t("This runs only in a terminal you type in yourself \u2014 the 12 words must never pass through an agent."),1;let r=TH(e[0]??"");if(!r.length)return t("Usage: nodata-mcp org-open <file.ndc | folder> (opens files sealed on the organisation's computers)"),2;let o;try{o=await AH(await n())}catch(s){return t(`\u2717 ${s instanceof Error?s.message:String(s)}`),2}let i=0;try{for(let s of r){let a=(0,Yu.readManifest)(s);if(a?.org_copy&&a.org_copy.kid!==o.kid){t(`\u2717 ${s}: sealed to a different organisation key \u2014 check the words.`);continue}let c=await(0,Yu.openFileAsOrg)(s,o);c.ok?(i++,t(`\u2713 ${s} \u2192 ${c.outPath}${c.intact?"":" \u26A0 content does not match its recorded hash"}`)):t(`\u2717 ${s}: ${c.error}${c.detail?` \u2014 ${c.detail}`:""}`)}}finally{o.secretKey.fill(0)}return t(`${i} of ${r.length} file(s) opened with the organisation's key. Nothing was sent anywhere.`),i?0:1}import{z as ee}from"zod";function He(e){let t=JSON.stringify(e.body,null,2);return e.ok?{content:[{type:"text",text:t}]}:{content:[{type:"text",text:`Error (HTTP ${e.status}):
404
- ${t}`}],isError:!0}}var Ly={nodata_decide:{title:"Ask whether an agent may reach a resource",readOnlyHint:!0,openWorldHint:!1},nodata_retrieve:{title:"Retrieve context an agent may see",readOnlyHint:!0,openWorldHint:!1},nodata_read:{title:"Read governed data within a grant",readOnlyHint:!0,openWorldHint:!1},nodata_use:{title:"Invoke a registered capability",readOnlyHint:!1,destructiveHint:!0,openWorldHint:!0},nodata_code_advise:{title:"Get advice on a code capsule",readOnlyHint:!0,openWorldHint:!1},nodata_code_patch:{title:"Submit a signed patch to a code capsule",readOnlyHint:!1,destructiveHint:!0,openWorldHint:!1}};function RT(e,t,n,r){let o={registerTool:(i,s,a)=>{let c=Ly[i];if(!c)throw new Error(`agent tool ${i} has no annotations`);return e.registerTool(i,{title:c.title,...s,annotations:{...c,...s.annotations??{}}},a)}};o.registerTool("nodata_decide",{description:"Ask whether this agent MAY reach a resource, WITHOUT reading it. Returns a decision (allow / degrade / deny), the reachable column subset, an access-distance cost, and a signed proof \u2014 never any data. Use it to plan: check reachability before you retrieve. Hard-scoped to this server's grant token.",inputSchema:{table:ee.string().describe("Table to check (must be in your grant)"),columns:ee.array(ee.string()).describe("Columns you want to reach"),where:ee.record(ee.string(),ee.union([ee.string(),ee.number(),ee.boolean()])).optional().describe("Equality filter (readable columns only)")}},async({table:i,columns:s,where:a})=>{let c=await t("/api/access/decide",{resource:{table:i,columns:s,where:a},intent:"read"});return He(c)}),o.registerTool("nodata_retrieve",{description:"Retrieve prompt-ready context for a resource, filtered to exactly what this agent may see. Denied columns are never decrypted; the response includes an accounting of what was withheld (columns + estimated tokens saved) and a signed proof. Prefer this over a raw read when assembling an LLM prompt. Hard-scoped to this server's grant token.",inputSchema:{table:ee.string().describe("Table to retrieve from (must be in your grant)"),columns:ee.array(ee.string()).describe("Columns to include in context"),where:ee.record(ee.string(),ee.union([ee.string(),ee.number(),ee.boolean()])).optional(),top_k:ee.number().optional().describe("Max rows (default 50, max 200)")}},async({table:i,columns:s,where:a,top_k:c})=>{let l=await t("/api/access/retrieve",{resource:{table:i,columns:s,where:a},top_k:c});return He(r&&l.ok?{...l,body:await r("retrieve",i,l.body)}:l)}),o.registerTool("nodata_read",{description:"Read governed data within this agent's grant. You may only request columns your grant allows \u2014 denied columns never decrypt server-side, and every read emits a cryptographic receipt. This tool is hard-scoped to the grant token this server was started with.",inputSchema:{table:ee.string().describe("Table to read (must be in your grant)"),columns:ee.array(ee.string()).describe("Columns to read (must be in your grant)"),where:ee.record(ee.string(),ee.union([ee.string(),ee.number(),ee.boolean()])).optional(),limit:ee.number().optional().describe("Max rows (default 50, max 200)")}},async({table:i,columns:s,where:a,limit:c})=>{if(!n)return{content:[{type:"text",text:"Error: could not derive agent handle from grant token."}],isError:!0};let l=await t(`/api/agents/${encodeURIComponent(n)}/read`,{table:i,columns:s,where:a,limit:c});return He(r&&l.ok?{...l,body:await r("read",i,l.body)}:l)}),o.registerTool("nodata_use",{description:"Invoke an action the organisation's administrator registered (deploy, send a notification, query an internal API) WITHOUT receiving its secret. Every invocation is recorded in a signed receipt before it runs, and the administrator can audit it. The Capsule injects the sealed credential server-side and returns only the result. You may invoke only capabilities your grant allows; the secret never reaches you. If the key's rule says a person approves each use, the answer is human_approval_required with a code and approve_url: show both to the user, wait until they approve in the browser, then call again with approval_id. You cannot approve it yourself. Hard-scoped to the grant token this server was started with.",inputSchema:{capability:ee.string().describe("Capability name to invoke (must be in your grant, e.g. 'deploy-prod')"),params:ee.record(ee.string(),ee.unknown()).optional().describe("Allowlisted params; unknown keys are dropped server-side"),resource_key:ee.string().optional().describe("Optional folder/resource the action targets (enforced against corpus scope)"),approval_id:ee.string().optional().describe("Only after a 'human_approval_required' answer: the approval_id it gave, once a person has approved in the browser. Send the same capability, params and resource_key.")}},async({capability:i,params:s,resource_key:a,approval_id:c})=>{if(!n)return{content:[{type:"text",text:"Error: could not derive agent handle from grant token."}],isError:!0};let l=await t(`/api/agents/${encodeURIComponent(n)}/use`,{capability:i,params:s,resource_key:a,...c?{approval_id:c}:{}});return He(l)}),o.registerTool("nodata_code_advise",{description:"Ask the blind code advisor to diagnose/fix a bug in a code capsule WITHOUT seeing its source. You receive guidance + a targeted diff + an exposure proof (source never left the boundary); the source is never returned to you. Requires the capsule owner to have granted this agent (scope.fabric_developers). Hard-scoped to this server's grant token.",inputSchema:{capsule_id:ee.string().describe("The code capsule to advise on (you must be granted on it)"),question:ee.string().optional().describe("What to fix / improve, in natural language"),note:ee.string().optional().describe("Extra context for the advisor"),error:ee.object({message:ee.string().optional(),stack:ee.string().optional(),kind:ee.string().optional()}).optional().describe("An error the code produced, to guide the fix"),steer:ee.string().optional().describe("A steer on a refine turn (e.g. 'no, round half-up')"),prior_diff:ee.string().optional().describe("The previously proposed diff, to refine")}},async({capsule_id:i,question:s,note:a,error:c,steer:l,prior_diff:d})=>{if(!n)return{content:[{type:"text",text:"Error: could not derive agent handle from grant token."}],isError:!0};let u=await t(`/api/agents/${encodeURIComponent(n)}/code-capsule/${encodeURIComponent(i)}/advise`,{question:s,note:a,error:c,steer:l,prior_diff:d});return He(u)}),o.registerTool("nodata_code_patch",{description:"Submit a fix to a code capsule as a SIGNED, queued patch WITHOUT seeing its source. Provide a raw unified `diff`, or a whole-file `replace` ({path, content}) that is diffed server-side against the sealed source. The source is never persisted or returned; you get back a patch id, the diff hash, and a receipt. Requires a capsule grant (scope.fabric_developers). Hard-scoped to this server's grant token.",inputSchema:{capsule_id:ee.string().describe("The code capsule to patch (you must be granted on it)"),summary:ee.string().optional().describe("Short human-readable summary of the fix"),diff:ee.string().optional().describe("A raw unified diff (advanced)"),replace:ee.object({path:ee.string(),content:ee.string()}).optional().describe("Whole-file replacement; the diff is synthesized server-side against sealed source")}},async({capsule_id:i,summary:s,diff:a,replace:c})=>{if(!n)return{content:[{type:"text",text:"Error: could not derive agent handle from grant token."}],isError:!0};let l=await t(`/api/agents/${encodeURIComponent(n)}/code-capsule/${encodeURIComponent(i)}/patch`,{summary:s,diff:a,replace:c});return He(l)})}var Mn=(e,t=!1)=>({title:e,readOnlyHint:!0,openWorldHint:t}),ht=(e,t=!1)=>({title:e,readOnlyHint:!1,destructiveHint:!1,openWorldHint:t}),fn=(e,t=!1)=>({title:e,readOnlyHint:!1,destructiveHint:!0,openWorldHint:t}),PH={...Ly,nodata_get_started:Mn("Get started with NoData"),nodata_connect:ht("Connect this computer to your organisation"),nodata_terms:ht("Show or accept NoData's terms"),nodata_node:ht("Register this computer as an organisation node"),nodata_scan_folder:Mn("Scan a folder for sensitive data"),nodata_clean_folder:ht("Build a verified clean folder next to it"),nodata_scan_feedback:ht("Report a wrong scan result"),nodata_plan:fn("Recommend and apply a file policy"),nodata_protect:fn("Seal files on this computer"),nodata_open:ht("Open a sealed file"),nodata_redact:ht("Make a clean copy without personal values"),nodata_rules:fn("Set what agents may do with files"),nodata_choose:ht("Choose what crosses from a folder"),nodata_scan_terms:fn("Set the words that make a file sensitive"),nodata_wrap:fn("Archive files to the organisation capsule"),nodata_seal_revoke:fn("Revoke a sealed file for everyone"),nodata_send:ht("Send a file as a governed link",!0),nodata_link_status:Mn("Check sent links"),nodata_burn:fn("Burn a sent link"),nodata_deliver:ht("Create a burn-after-read link",!0),nodata_inbox:fn("Manage this computer's inbox and who may reach it",!0),nodata_expose:ht("Let a partner's computer ask for files",!0),nodata_partner:ht("Work with a connected organisation: commands only, never files",!0),nodata_run:fn("Run a command with vault secrets"),nodata_api_list:Mn("List the organisation's governed APIs"),nodata_api_read:Mn("Read from a governed API",!0),nodata_api_write:fn("Write to a governed API",!0),nodata_policy:Mn("Show the agent policy board"),nodata_register_table:ht("Register a table for agent access"),nodata_connect_source:ht("Connect a data source"),nodata_grant:ht("Grant an agent scoped access"),nodata_revoke:fn("Revoke an agent's access"),nodata_proofs:Mn("List the organisation's proofs"),nodata_evidence:Mn("List field access events"),nodata_encrypt:Mn("Encrypt a value (legacy)"),nodata_decrypt:Mn("Decrypt a value (legacy)")};function NT(e){let t=e.registerTool.bind(e);e.registerTool=(n,r,o)=>{let i=PH[n];if(!i)throw new Error(`tool ${n} has no annotations (tool-annotations.ts)`);let{title:s,...a}=i;return t(n,{title:s,...r,annotations:{title:s,...a,...r.annotations??{}}},o)}}import{execFileSync as sr}from"node:child_process";var RH={write(e){try{if(process.platform==="win32"){let t=["Add-Type -AssemblyName System.Windows.Forms","$v = [Console]::In.ReadToEnd()","$d = New-Object System.Windows.Forms.DataObject","$d.SetText($v)","$d.SetData('ExcludeClipboardContentFromMonitorProcessing', $true)","$d.SetData('CanIncludeInClipboardHistory', (New-Object IO.MemoryStream (,[byte[]](0,0,0,0))))","$d.SetData('CanUploadToCloudClipboard', (New-Object IO.MemoryStream (,[byte[]](0,0,0,0))))","[System.Windows.Forms.Clipboard]::SetDataObject($d, $true)"].join("; ");return sr("powershell.exe",["-NoProfile","-STA","-Command",t],{input:e,windowsHide:!0,stdio:["pipe","ignore","ignore"]}),!0}if(process.platform==="darwin")return sr("pbcopy",{input:e}),!0;for(let[t,n]of[["wl-copy",[]],["xclip",["-selection","clipboard"]],["xsel",["--clipboard","--input"]]])try{return sr(t,[...n],{input:e,stdio:["pipe","ignore","ignore"]}),!0}catch{}}catch{}return!1},read(){try{return process.platform==="win32"?sr("powershell.exe",["-NoProfile","-Command","Get-Clipboard -Raw"],{encoding:"utf8",windowsHide:!0}).replace(/\r?\n$/,""):process.platform==="darwin"?sr("pbpaste",{encoding:"utf8"}):sr("xclip",["-selection","clipboard","-o"],{encoding:"utf8"})}catch{return null}},clear(){try{process.platform==="win32"?sr("powershell.exe",["-NoProfile","-STA","-Command","Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Clipboard]::Clear()"],{windowsHide:!0,stdio:"ignore"}):process.platform==="darwin"?sr("pbcopy",{input:""}):sr("xclip",["-selection","clipboard"],{input:""})}catch{}}},OT="Usage: nodata-mcp secrets-copy [--project <label>] KEY [--seconds N] e.g. secrets-copy --project acme INSTAGRAM_ACME_PASSWORD";async function CT(e,t={}){let n=t.log??(l=>process.stderr.write(l+`
404
+ ${t}`}],isError:!0}}var Ly={nodata_decide:{title:"Ask whether an agent may reach a resource",readOnlyHint:!0,openWorldHint:!1},nodata_retrieve:{title:"Retrieve context an agent may see",readOnlyHint:!0,openWorldHint:!1},nodata_read:{title:"Read governed data within a grant",readOnlyHint:!0,openWorldHint:!1},nodata_use:{title:"Invoke a registered capability",readOnlyHint:!1,destructiveHint:!0,openWorldHint:!0},nodata_code_advise:{title:"Get advice on a code capsule",readOnlyHint:!0,openWorldHint:!1},nodata_code_patch:{title:"Submit a signed patch to a code capsule",readOnlyHint:!1,destructiveHint:!0,openWorldHint:!1}};function RT(e,t,n,r){let o={registerTool:(i,s,a)=>{let c=Ly[i];if(!c)throw new Error(`agent tool ${i} has no annotations`);return e.registerTool(i,{title:c.title,...s,annotations:{...c,...s.annotations??{}}},a)}};o.registerTool("nodata_decide",{description:"Ask whether this agent MAY reach a resource, WITHOUT reading it. Returns a decision (allow / degrade / deny), the reachable column subset, an access-distance cost, and a signed proof \u2014 never any data. Use it to plan: check reachability before you retrieve. Hard-scoped to this server's grant token.",inputSchema:{table:ee.string().describe("Table to check (must be in your grant)"),columns:ee.array(ee.string()).describe("Columns you want to reach"),where:ee.record(ee.string(),ee.union([ee.string(),ee.number(),ee.boolean()])).optional().describe("Equality filter (readable columns only)")}},async({table:i,columns:s,where:a})=>{let c=await t("/api/access/decide",{resource:{table:i,columns:s,where:a},intent:"read"});return He(c)}),o.registerTool("nodata_retrieve",{description:"Retrieve prompt-ready context for a resource, filtered to exactly what this agent may see. Denied columns are never decrypted; the response includes an accounting of what was withheld (columns + estimated tokens saved) and a signed proof. Prefer this over a raw read when assembling an LLM prompt. Hard-scoped to this server's grant token.",inputSchema:{table:ee.string().describe("Table to retrieve from (must be in your grant)"),columns:ee.array(ee.string()).describe("Columns to include in context"),where:ee.record(ee.string(),ee.union([ee.string(),ee.number(),ee.boolean()])).optional(),top_k:ee.number().optional().describe("Max rows (default 50, max 200)")}},async({table:i,columns:s,where:a,top_k:c})=>{let l=await t("/api/access/retrieve",{resource:{table:i,columns:s,where:a},top_k:c});return He(r&&l.ok?{...l,body:await r("retrieve",i,l.body)}:l)}),o.registerTool("nodata_read",{description:`Read governed data within this agent's grant. You may only request columns your grant allows \u2014 denied columns never decrypt server-side, and every read emits a cryptographic receipt. Do not guess table names: if you do not know yours, call with table "" and the answer lists the tables and columns your grant allows (your_grant). This tool is hard-scoped to the grant token this server was started with.`,inputSchema:{table:ee.string().describe("Table to read (must be in your grant)"),columns:ee.array(ee.string()).describe("Columns to read (must be in your grant)"),where:ee.record(ee.string(),ee.union([ee.string(),ee.number(),ee.boolean()])).optional(),limit:ee.number().optional().describe("Max rows (default 50, max 200)")}},async({table:i,columns:s,where:a,limit:c})=>{if(!n)return{content:[{type:"text",text:"Error: could not derive agent handle from grant token."}],isError:!0};let l=await t(`/api/agents/${encodeURIComponent(n)}/read`,{table:i,columns:s,where:a,limit:c});return He(r&&l.ok?{...l,body:await r("read",i,l.body)}:l)}),o.registerTool("nodata_use",{description:"Invoke an action the organisation's administrator registered (deploy, send a notification, query an internal API) WITHOUT receiving its secret. Every invocation is recorded in a signed receipt before it runs, and the administrator can audit it. The Capsule injects the sealed credential server-side and returns only the result. You may invoke only capabilities your grant allows; the secret never reaches you. If the key's rule says a person approves each use, the answer is human_approval_required with a code and approve_url: show both to the user, wait until they approve in the browser, then call again with approval_id. You cannot approve it yourself. Hard-scoped to the grant token this server was started with.",inputSchema:{capability:ee.string().describe("Capability name to invoke (must be in your grant, e.g. 'deploy-prod')"),params:ee.record(ee.string(),ee.unknown()).optional().describe("Allowlisted params; unknown keys are dropped server-side"),resource_key:ee.string().optional().describe("Optional folder/resource the action targets (enforced against corpus scope)"),approval_id:ee.string().optional().describe("Only after a 'human_approval_required' answer: the approval_id it gave, once a person has approved in the browser. Send the same capability, params and resource_key.")}},async({capability:i,params:s,resource_key:a,approval_id:c})=>{if(!n)return{content:[{type:"text",text:"Error: could not derive agent handle from grant token."}],isError:!0};let l=await t(`/api/agents/${encodeURIComponent(n)}/use`,{capability:i,params:s,resource_key:a,...c?{approval_id:c}:{}});return He(l)}),o.registerTool("nodata_code_advise",{description:"Ask the blind code advisor to diagnose/fix a bug in a code capsule WITHOUT seeing its source. You receive guidance + a targeted diff + an exposure proof (source never left the boundary); the source is never returned to you. Requires the capsule owner to have granted this agent (scope.fabric_developers). Hard-scoped to this server's grant token.",inputSchema:{capsule_id:ee.string().describe("The code capsule to advise on (you must be granted on it)"),question:ee.string().optional().describe("What to fix / improve, in natural language"),note:ee.string().optional().describe("Extra context for the advisor"),error:ee.object({message:ee.string().optional(),stack:ee.string().optional(),kind:ee.string().optional()}).optional().describe("An error the code produced, to guide the fix"),steer:ee.string().optional().describe("A steer on a refine turn (e.g. 'no, round half-up')"),prior_diff:ee.string().optional().describe("The previously proposed diff, to refine")}},async({capsule_id:i,question:s,note:a,error:c,steer:l,prior_diff:d})=>{if(!n)return{content:[{type:"text",text:"Error: could not derive agent handle from grant token."}],isError:!0};let u=await t(`/api/agents/${encodeURIComponent(n)}/code-capsule/${encodeURIComponent(i)}/advise`,{question:s,note:a,error:c,steer:l,prior_diff:d});return He(u)}),o.registerTool("nodata_code_patch",{description:"Submit a fix to a code capsule as a SIGNED, queued patch WITHOUT seeing its source. Provide a raw unified `diff`, or a whole-file `replace` ({path, content}) that is diffed server-side against the sealed source. The source is never persisted or returned; you get back a patch id, the diff hash, and a receipt. Requires a capsule grant (scope.fabric_developers). Hard-scoped to this server's grant token.",inputSchema:{capsule_id:ee.string().describe("The code capsule to patch (you must be granted on it)"),summary:ee.string().optional().describe("Short human-readable summary of the fix"),diff:ee.string().optional().describe("A raw unified diff (advanced)"),replace:ee.object({path:ee.string(),content:ee.string()}).optional().describe("Whole-file replacement; the diff is synthesized server-side against sealed source")}},async({capsule_id:i,summary:s,diff:a,replace:c})=>{if(!n)return{content:[{type:"text",text:"Error: could not derive agent handle from grant token."}],isError:!0};let l=await t(`/api/agents/${encodeURIComponent(n)}/code-capsule/${encodeURIComponent(i)}/patch`,{summary:s,diff:a,replace:c});return He(l)})}var Mn=(e,t=!1)=>({title:e,readOnlyHint:!0,openWorldHint:t}),ht=(e,t=!1)=>({title:e,readOnlyHint:!1,destructiveHint:!1,openWorldHint:t}),fn=(e,t=!1)=>({title:e,readOnlyHint:!1,destructiveHint:!0,openWorldHint:t}),PH={...Ly,nodata_get_started:Mn("Get started with NoData"),nodata_connect:ht("Connect this computer to your organisation"),nodata_terms:ht("Show or accept NoData's terms"),nodata_node:ht("Register this computer as an organisation node"),nodata_scan_folder:Mn("Scan a folder for sensitive data"),nodata_clean_folder:ht("Build a verified clean folder next to it"),nodata_scan_feedback:ht("Report a wrong scan result"),nodata_plan:fn("Recommend and apply a file policy"),nodata_protect:fn("Seal files on this computer"),nodata_open:ht("Open a sealed file"),nodata_redact:ht("Make a clean copy without personal values"),nodata_rules:fn("Set what agents may do with files"),nodata_choose:ht("Choose what crosses from a folder"),nodata_scan_terms:fn("Set the words that make a file sensitive"),nodata_wrap:fn("Archive files to the organisation capsule"),nodata_seal_revoke:fn("Revoke a sealed file for everyone"),nodata_send:ht("Send a file as a governed link",!0),nodata_link_status:Mn("Check sent links"),nodata_burn:fn("Burn a sent link"),nodata_deliver:ht("Create a burn-after-read link",!0),nodata_inbox:fn("Manage this computer's inbox and who may reach it",!0),nodata_expose:ht("Let a partner's computer ask for files",!0),nodata_partner:ht("Work with a connected organisation: commands only, never files",!0),nodata_run:fn("Run a command with vault secrets"),nodata_api_list:Mn("List the organisation's governed APIs"),nodata_api_read:Mn("Read from a governed API",!0),nodata_api_write:fn("Write to a governed API",!0),nodata_policy:Mn("Show the agent policy board"),nodata_register_table:ht("Register a table for agent access"),nodata_connect_source:ht("Connect a data source"),nodata_grant:ht("Grant an agent scoped access"),nodata_revoke:fn("Revoke an agent's access"),nodata_proofs:Mn("List the organisation's proofs"),nodata_evidence:Mn("List field access events"),nodata_encrypt:Mn("Encrypt a value (legacy)"),nodata_decrypt:Mn("Decrypt a value (legacy)")};function NT(e){let t=e.registerTool.bind(e);e.registerTool=(n,r,o)=>{let i=PH[n];if(!i)throw new Error(`tool ${n} has no annotations (tool-annotations.ts)`);let{title:s,...a}=i;return t(n,{title:s,...r,annotations:{title:s,...a,...r.annotations??{}}},o)}}import{execFileSync as sr}from"node:child_process";var RH={write(e){try{if(process.platform==="win32"){let t=["Add-Type -AssemblyName System.Windows.Forms","$v = [Console]::In.ReadToEnd()","$d = New-Object System.Windows.Forms.DataObject","$d.SetText($v)","$d.SetData('ExcludeClipboardContentFromMonitorProcessing', $true)","$d.SetData('CanIncludeInClipboardHistory', (New-Object IO.MemoryStream (,[byte[]](0,0,0,0))))","$d.SetData('CanUploadToCloudClipboard', (New-Object IO.MemoryStream (,[byte[]](0,0,0,0))))","[System.Windows.Forms.Clipboard]::SetDataObject($d, $true)"].join("; ");return sr("powershell.exe",["-NoProfile","-STA","-Command",t],{input:e,windowsHide:!0,stdio:["pipe","ignore","ignore"]}),!0}if(process.platform==="darwin")return sr("pbcopy",{input:e}),!0;for(let[t,n]of[["wl-copy",[]],["xclip",["-selection","clipboard"]],["xsel",["--clipboard","--input"]]])try{return sr(t,[...n],{input:e,stdio:["pipe","ignore","ignore"]}),!0}catch{}}catch{}return!1},read(){try{return process.platform==="win32"?sr("powershell.exe",["-NoProfile","-Command","Get-Clipboard -Raw"],{encoding:"utf8",windowsHide:!0}).replace(/\r?\n$/,""):process.platform==="darwin"?sr("pbpaste",{encoding:"utf8"}):sr("xclip",["-selection","clipboard","-o"],{encoding:"utf8"})}catch{return null}},clear(){try{process.platform==="win32"?sr("powershell.exe",["-NoProfile","-STA","-Command","Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Clipboard]::Clear()"],{windowsHide:!0,stdio:"ignore"}):process.platform==="darwin"?sr("pbcopy",{input:""}):sr("xclip",["-selection","clipboard"],{input:""})}catch{}}},OT="Usage: nodata-mcp secrets-copy [--project <label>] KEY [--seconds N] e.g. secrets-copy --project acme INSTAGRAM_ACME_PASSWORD";async function CT(e,t={}){let n=t.log??(l=>process.stderr.write(l+`
405
405
  `)),r=t.interactive??Dy,o=[],i="",s=20;for(let l=0;l<e.length;l++){let d=e[l];if(d==="--project"||d==="--from"){o.push(d,e[++l]??"");continue}if(d==="--seconds"){s=Number(e[++l]);continue}if(!i&&!d.startsWith("--")){i=d;continue}return n(OT),2}if(!i||!/^[A-Za-z_][A-Za-z0-9_]*$/.test(i))return n(OT),2;if(!Number.isInteger(s)||s<5||s>120)return n("\u2717 --seconds is a whole number from 5 to 120."),2;if(!r())return n("\u270B Not copied: a login is a person's, typed into a terminal they type in themselves. An agent uses the account through nodata_run / secrets-run, never its password."),2;let a=t.clipboard??RH,c=t.sleep??(l=>new Promise(d=>setTimeout(d,l)));return qu([...o,"--","copy",i],t.pull,n,r,t.wait??{},async l=>{let d=l[i];if(d===void 0)return n(`\u2717 ${i} was not given (see the reason above). Nothing was copied.`),1;if(!a.write(d))return n("\u2717 No clipboard on this computer to copy to. Nothing was copied."),1;n(`\u{1F4CB} ${i} is on your clipboard for ${s} seconds: paste it into the login now. It was not shown, and it is cleared after.`),await c(s*1e3);let u=a.read();return(u===null||u===d)&&a.clear(),n(u===null||u===d?"\u2713 Clipboard cleared.":"\u2713 You copied something else since; it was left as it is."),0})}import{existsSync as NH,readFileSync as OH,statSync as IT}from"node:fs";import{basename as Fy}from"node:path";$d();function CH(e){let t=e.trim();if(!t.startsWith("ndck1."))return null;let n=t.slice(6);if(!/^[A-Za-z0-9_-]{43}$/.test(n))return null;let r=Buffer.from(n.replace(/-/g,"+").replace(/_/g,"/"),"base64");return r.length===32&&r.some(o=>o!==0)?r.toString("base64"):null}var DT=8,jT=e=>e.trim().replace(/[\s-]/g,"");async function LT(e,t,n=r=>process.stdout.write(`${r}
406
406
  `)){let r=e.indexOf("--custodian"),o=r>=0?e[r+1]??"":"",i=e.filter((g,y)=>!g.startsWith("--")&&!(r>=0&&y===r+1));if(i.length!==1)return n("usage: nodata-mcp hold <file> [--custodian ndck1.\u2026] seal a file only you hold; your own code opens it"),2;if(!t)return n("This computer is not connected to an organisation. Run: npx -y @nodatachat/mcp@latest connect"),2;if(!t.isTTY)return n("This runs only in a terminal you type in yourself: your code must never pass through an agent."),1;let s=i[0];if(!NH(s)||!IT(s).isFile())return n(`\u2717 No such file: ${s}`),2;if(IT(s).size>jn)return n(`\u2717 Up to ${Math.floor(jn/1024/1024)} MB from here. Hold a larger file from Seal Studio.`),2;let a=null;if(o&&(a=CH(o),!a))return n("\u2717 The custodian code is not valid. It starts with ndck1. Copy it again from your custodian."),2;let c=await t.get("/api/v1/recovery/pubkey"),l=c.ok&&typeof c.body?.pubkeyB64=="string"?c.body.pubkeyB64:null;if(!l)return n("\u2717 Your organisation has no 12 words yet, so nothing can be held. Finish the recovery setup in the console once."),1;try{xd(t.orgId,l,t.pinFile)}catch(g){return n(g instanceof Oo?g.message:`\u2717 ${g instanceof Error?g.message:String(g)}`),1}let d=jT(await t.readHidden(`Your own code for ${Fy(s)} (8+ characters, not shown): `));if(d.length<DT)return n(`\u2717 At least ${DT} characters (spaces and dashes do not count). Nothing was sealed.`),2;if(jT(await t.readHidden("Type it again: "))!==d)return n("\u2717 The two codes differ. Nothing was sealed."),2;let p=await gA({fileBytes:OH(s),masterPubkey:l,code:d,custodianPubkey:a});if(!p)return n("\u2717 The file is over the limit for a held seal from here."),2;let f=await t.post(`/api/tenant/${encodeURIComponent(t.orgId)}/sovereign-seal/issue`,{...p,filename:Fy(s).slice(0,256),contentType:"application/octet-stream",downloadMode:"none"}),h=f.body??{};return!f.ok||!h.ok||!h.id?(n(`\u2717 Not sealed: ${h.message||h.error||`HTTP ${f.status}`}`),1):(n(`\u2713 Held by you: ${Fy(s)}`),n(` Open: ${t.baseUrl.replace(/\/+$/,"")}/sovereign/open/${encodeURIComponent(h.id)} (only your code opens it; the link carries none)`),n(` If you are unavailable, your organisation can ask to recover it: its 12 words${a?" (or your custodian's)":""}, a second admin, and a window in which you can refuse.`),n(' See it, and any request on it, under "What I hold" in the console.'),0)}qe();import{chmodSync as IH,existsSync as DH,mkdirSync as jH,readFileSync as LH,writeFileSync as FH}from"node:fs";import{homedir as MT}from"node:os";import{join as BT}from"node:path";import{randomBytes as MH}from"node:crypto";import{z as gt}from"zod";var My=1e5,Uy=/^[a-z0-9][a-z0-9-]{1,39}$/,BH=/^[A-Za-z0-9-]{1,64}$/,HH=3e4;var Ju=()=>BT(MT(),".nodata","api-shares.json");function By(){try{let e=JSON.parse(LH(Ju(),"utf8"));if(e?.v===1&&e.apis&&typeof e.apis=="object")return e}catch{}return{v:1,apis:{}}}function FT(e){jH(BT(MT(),".nodata"),{recursive:!0}),FH(Ju(),JSON.stringify(e,null,2),{mode:384});try{IH(Ju(),384)}catch{}}var Hy=(e,t)=>`${e.replace(/\/+$/,"")}|${t}`;function HT(e,t){let n=By().apis[Hy(e,t)];if(!n)return null;let r=Buffer.from(n.share,"base64");return r.length===At.SHARE_BYTES?r:null}async function UH(e){let t=await e.token();if(!t)return{error:"not connected to an organisation \u2014 connect first (nodata_connect)"};try{let n=await fetch(`${e.baseUrl}/api/v1/gateway/keys`,{headers:{Authorization:`Bearer ${t}`}}),r=await n.json().catch(()=>({}));return n.ok?(r.keys??[]).filter(o=>o.provider.startsWith("custom:")).map(o=>({name:o.provider.slice(7),base_url:o.base_url,policy:o.policy,key_prefix:o.key_prefix})):{error:r.error??`HTTP ${n.status}`}}catch(n){return{error:`could not reach NoData: ${n instanceof Error?n.message:String(n)}`}}}var Xu=["openai","anthropic","google","mistral","cohere","groq","deepseek","xai"],Zu=(e="<name>",t="https://api.example.com")=>Xu.includes(e)?`The person adds it once, in their own terminal (the key is typed there, hidden \u2014 never in this chat):
407
407
  npx -y @nodatachat/mcp api-add ${e}`:`The person adds an API once, in their own terminal (the key is typed there, hidden \u2014 never in this chat):
@@ -442,7 +442,7 @@ Finish it once in the console (Recovery setup), then wrap again. NoData never se
442
442
  `,{mode:384})}catch{}return l_("sha256").update(n).digest("hex").slice(0,16)}function _1(e){let t=j3(e),n=L3(t.map(r=>r.id));return["ANSWER FROM THE NODATA ANSWER BANK \u2014 relay this in the user's language, and nothing beyond it:","",...t.map(r=>`\u2022 ${r.answer}`),"",`Source: NoData answer bank ${y1} \xB7 entries: ${t.map(r=>r.id).join(", ")} \xB7 recorded ${n} in ~/.nodata/answers.log`].join(`
443
443
  `)}wa();import{existsSync as S1,mkdirSync as F3,readFileSync as M3,writeFileSync as B3}from"node:fs";import{homedir as f_}from"node:os";import{join as h_}from"node:path";var H3=60*6e4;function U3(e){try{return process.kill(e,0),!0}catch(t){return t.code==="EPERM"}}var u_=()=>h_(f_(),".nodata","connection.json"),K3=()=>h_(f_(),".nodata","pending-link.json"),p_=6e4,b1=15*p_,w1=[3e4,2*p_,5*p_];function v1(e,t){switch(e.connection){case"connected":return{state:"connected"};case"unstable":case"offline":return{state:"reconnecting"};case"restart":return{state:"restart",step:"/mcp"};case"not-connected":return t?{state:"waiting"}:{state:"local"};case"reconnect":return t?{state:"waiting"}:{state:"needs-you",step:e.refused==="org-has-no-key"?"console \u2192 API keys":e.refused==="flag-key"||e.refused==="env-key"?"remove the old key":"nodata_connect"}}}function np(e,t=new Date){try{F3(h_(f_(),".nodata"),{recursive:!0});let n=t.toISOString(),r={};for(let[o,i]of Object.entries(W3()?.versions??{}))t.getTime()-Date.parse(i.at)<H3&&U3(Number(o))&&(r[o]=i);e.version&&(r[String(process.pid)]={version:e.version,at:n}),B3(u_(),JSON.stringify({...e,...Object.keys(r).length?{versions:r}:{},at:n}),{mode:384})}catch{}}function W3(){try{return S1(u_())?JSON.parse(M3(u_(),"utf8")):null}catch{return null}}var k1=()=>S1(K3());function G3(e,t){return e==="reconnecting"?w1[Math.min(t,w1.length-1)]??b1:e==="waiting"?3e4:b1}function x1(e,t,n,r){let o=0,i=n?{version:n}:{},s=v1(t,k1());np({...s,...i});let a=null,c=()=>{a=setTimeout(l,G3(s.state,o)),a.unref?.()},l=async()=>{try{let d=v1(await e(),k1());o=d.state==="reconnecting"?o+1:0,(d.state!==s.state||d.step!==s.step)&&r?.(d),s=d,np({...d,...i})}catch{o+=1}c()};return c(),()=>{a&&clearTimeout(a)}}bt();import{homedir as oP,hostname as wU,userInfo as vU}from"node:os";import{join as z1,resolve as ip}from"node:path";import{existsSync as y_,readFileSync as v_,writeFileSync as kU,mkdirSync as SU}from"node:fs";import{spawn as sp,spawnSync as ap}from"node:child_process";import{generateKeyPairSync as xU,createPrivateKey as $U,sign as EU,randomBytes as AU}from"node:crypto";async function $1(e=process.env){if(!(e.HTTPS_PROXY||e.https_proxy||e.HTTP_PROXY||e.http_proxy)||/^(1|true)$/i.test(e.NODE_USE_ENV_PROXY??""))return!1;try{let{EnvHttpProxyAgent:t,setGlobalDispatcher:n}=await import("undici");return n(new t),!0}catch{return!1}}import{readFileSync as V3}from"node:fs";function $s(e=process.env,t=process.platform,n=A1()){return!(t==="linux"&&!n&&!e.DISPLAY&&!e.WAYLAND_DISPLAY)}function E1(e=process.env,t=process.platform,n=A1()){return e.VITEST||/^(1|true|yes)$/i.test(e.NODATA_NO_BROWSER??"")?!1:$s(e,t,n)}function A1(){try{return process.platform==="linux"&&/microsoft/i.test(V3("/proc/version","utf8"))}catch{return!1}}import{createHmac as tU}from"node:crypto";import{existsSync as nU,mkdirSync as rU,readFileSync as oU,writeFileSync as I1}from"node:fs";import{homedir as D1}from"node:os";import{join as j1}from"node:path";import{x25519 as iU}from"@noble/curves/ed25519.js";import{CipherSuite as q3,HkdfSha256 as z3}from"@hpke/core";import{DhkemX25519HkdfSha256 as Y3}from"@hpke/dhkem-x25519";import{Chacha20Poly1305 as J3}from"@hpke/chacha20poly1305";function T1(e){return["ndc.dal.column.agent.v1",e.tenantId,e.table,e.column,String(e.keyVersion),e.agentHandle,e.recipientKid].join("|")}function P1(e){return["ndc.dal.cell.v1",e.tenantId,e.table,e.column,String(e.keyVersion)].join("|")}var R1=new q3({kem:new Y3,kdf:new z3,aead:new J3}),O1=new TextEncoder,X3=new TextDecoder,zr=e=>{let t=new Uint8Array(e.length);return t.set(e),t.buffer},op=e=>Uint8Array.from(atob(e),t=>t.charCodeAt(0)),Z3=e=>btoa(String.fromCharCode(...e));async function Q3(e,t,n,r,o){if(e.recipient_x25519_b64!==Z3(t.pubkey))throw new Error("column_key_not_for_this_agent");let i=op(e.sealed_b64);if(i.length<6||i[0]!==1||i[1]!==1)throw new Error("unsupported_seal");let s=i[2]<<8|i[3],a=i[4]<<8|i[5];if(i.length!==6+s+a)throw new Error("sealed_length_mismatch");let c=O1.encode(T1({tenantId:n,table:r,column:o,keyVersion:e.key_version,agentHandle:t.handle,recipientKid:e.recipient_kid})),l=await R1.createRecipientContext({recipientKey:await R1.kem.deserializePrivateKey(zr(t.secret)),enc:zr(i.slice(6,6+s)),info:zr(c)});return new Uint8Array(await l.open(zr(i.slice(6+s))))}async function eU(e,t,n,r,o){let i=await crypto.subtle.importKey("raw",zr(e),{name:"AES-GCM"},!1,["decrypt"]),s=op(t.ct),a=op(t.tag),c=new Uint8Array(s.length+a.length);c.set(s),c.set(a,s.length);let l=await crypto.subtle.decrypt({name:"AES-GCM",iv:zr(op(t.iv)),additionalData:zr(O1.encode(P1({tenantId:n,table:r,column:o,keyVersion:t.kv}))),tagLength:128},i,zr(c));return X3.decode(l)}async function N1(e,t,n,r){let o=new Map;return async(i,s)=>{let a=(e[i]??[]).find(l=>l.key_version===s.kv);if(!a)return null;let c=`${i}:${s.kv}`;return o.has(c)||o.set(c,Q3(a,t,n,r,i)),eU(await o.get(c),s,n,r,i)}}var rp=e=>!!e&&typeof e=="object"&&!Array.isArray(e);async function C1(e,t,n,r){if(!rp(n))return n;if(e==="retrieve"){let a=n.sealed;if(!rp(a)||typeof a.tenant_id!="string"||!Array.isArray(a.rows))return n;let c=await N1(a.column_keys??{},r,a.tenant_id,t),l=[],d=0;for(let u of a.rows){let p={};for(let[f,h]of Object.entries(u.cells??{}))try{let g=await c(f,h);g!==null?p[f]=g:d+=1}catch{d+=1}l.push({ref:u.ref,values:p})}return{...n,sealed:void 0,opened:{custody:"agent_sealed",opened_here:!0,rows:l,failed:d}}}if(typeof n.tenant_id!="string"||!Array.isArray(n.rows)||!rp(n.column_keys))return n;let o=await N1(n.column_keys,r,n.tenant_id,t),i=0,s=[];for(let a of n.rows){let{_sealed:c,...l}=a,d={...l};if(rp(c))for(let[u,p]of Object.entries(c))try{let f=await o(u,p);f!==null?d[u]=f:i+=1}catch{i+=1}s.push(d)}return{...n,rows:s,column_keys:void 0,opened:{custody:"agent_sealed",opened_here:!0,failed:i}}}var sU=/^[a-z0-9][a-z0-9._-]{0,63}$/i,L1=e=>j1(D1(),".nodata","agent-keys",`${e}.json`);function F1(e){if(!sU.test(e))throw new Error("invalid agent handle");let t=L1(e);if(nU(t)){let o=JSON.parse(oU(t,"utf8"));if(o.handle===e&&/^[0-9a-f]{64}$/.test(o.secret_hex)&&/^[0-9a-f]{64}$/.test(o.pub_hex))return o}let n=Kd(),r={handle:e,secret_hex:cs(n),pub_hex:cs(Xa(n)),kid:null};return rU(j1(D1(),".nodata","agent-keys"),{recursive:!0}),I1(t,JSON.stringify(r,null,2)+`
444
444
  `,{mode:384}),r}function aU(e,t,n){let r=iU.getSharedSecret(cn(e),cn(t.server_pubkey_hex));return tU("sha256",Buffer.from(r)).update(`nd-fabric-pop-v1|${t.nonce}|${n}|${t.agent_id}`).digest("hex")}async function M1(e,t){try{let n=F1(e),r=`/api/agents/${encodeURIComponent(e)}/fabric/enroll`,o=await t(r,{ecdh_pubkey_hex:n.pub_hex});if(o.status===428){let s=o.body?.challenge;if(!s)return{error:"no challenge"};o=await t(r,{ecdh_pubkey_hex:n.pub_hex,pop:{challenge:s,proof_hex:aU(n.secret_hex,s,n.pub_hex)}})}if(!o.ok)return{error:`enroll HTTP ${o.status}`};let i=String(o.body?.kid??"");return i&&i!==n.kid&&I1(L1(e),JSON.stringify({...n,kid:i},null,2)+`
445
- `,{mode:384}),{kid:i}}catch(n){return{error:n instanceof Error?n.message:"enroll failed"}}}function B1(e){return async(t,n,r)=>{let o=F1(e);return C1(t,n,r,{handle:e,secret:cn(o.secret_hex),pubkey:cn(o.pub_hex)})}}var ar="1.6.44";function Sc(e=process.cwd()){try{let t=xt(e),n=t?Cf(t):null;if(!n||!y_(n))return null;let r=JSON.parse(v_(n,"utf8"));if(!r)return null;let o=r.device&&typeof r.device.private_key_pkcs8_b64=="string",i=typeof r.api_key=="string"&&r.api_key;return o||i?r:null}catch{return null}}function __(e,t=process.cwd()){let n=yl(e);if(!n)throw new Error("nothing to save: no organisation in the credential");Xw(n,e),t&&Zw(t,n)}var TU=`nodata-mcp v${ar} \u2014 NoData MCP server
445
+ `,{mode:384}),{kid:i}}catch(n){return{error:n instanceof Error?n.message:"enroll failed"}}}function B1(e){return async(t,n,r)=>{let o=F1(e);return C1(t,n,r,{handle:e,secret:cn(o.secret_hex),pubkey:cn(o.pub_hex)})}}var ar="1.6.45";function Sc(e=process.cwd()){try{let t=xt(e),n=t?Cf(t):null;if(!n||!y_(n))return null;let r=JSON.parse(v_(n,"utf8"));if(!r)return null;let o=r.device&&typeof r.device.private_key_pkcs8_b64=="string",i=typeof r.api_key=="string"&&r.api_key;return o||i?r:null}catch{return null}}function __(e,t=process.cwd()){let n=yl(e);if(!n)throw new Error("nothing to save: no organisation in the credential");Xw(n,e),t&&Zw(t,n)}var TU=`nodata-mcp v${ar} \u2014 NoData MCP server
446
446
 
447
447
  ADMIN mode: nodata-mcp --api-key sk_live_...
448
448
  AGENT mode: nodata-mcp --grant-token ndca-...
package/dist/scan-worker.js CHANGED
@@ -1,4 +1,4 @@
1
- /*! @nodatachat/mcp 1.6.44 | Copyright 2026 Capsule Ltd. | FSL-1.1-ALv2 | see LICENSE.md */
1
+ /*! @nodatachat/mcp 1.6.45 | Copyright 2026 Capsule Ltd. | FSL-1.1-ALv2 | see LICENSE.md */
2
2
  import{createRequire as __ndReq}from"node:module";const require=__ndReq(import.meta.url);
3
3
  import{parentPort as At}from"node:worker_threads";import{createHash as Js}from"node:crypto";import{closeSync as Ys,existsSync as qs,openSync as Qs,readSync as eo,readdirSync as mr,readFileSync as to,statSync as xt}from"node:fs";import{homedir as no}from"node:os";import{basename as gr,join as Ge}from"node:path";import{TextDecoder as Sr}from"node:util";var Q={text:[],header:[],secrets:[],table:null,amounts:null,severity:null};function Tt(e){e.table&&(Q.table=e.table),e.severity&&(Q.severity=e.severity),e.amounts&&(Q.amounts=e.amounts);for(let t of e.text??[])Q.text.some(n=>n.kind===t.kind)||Q.text.push(t);e.header&&!Q.header.includes(e.header)&&Q.header.push(e.header);for(let t of e.secrets??[])Q.secrets.some(n=>n.id===t.id)||Q.secrets.push(t)}function Ye(e){return Q.severity?.(e)}function qe(){return Q.text}function yn(){return Q.header}function Ce(){return Q.table}function bn(){return Q.secrets}var _n=[{id:"aws-access-key",name:"AWS Access Key",pattern:/(?:^|[^A-Z0-9])AKIA(?!X{16})[A-Z2-7]{16}(?:[^A-Z2-7]|$)/,severity:"critical"},{id:"aws-secret-key",name:"AWS Secret Key",pattern:/(?:aws_secret_access_key|aws_secret_key|secret_access_key)\s*[=:]\s*['"]?[A-Za-z0-9/+=]{40}['"]?/,severity:"critical"},{id:"gcp-api-key",name:"GCP API Key",pattern:/AIza[0-9A-Za-z_-]{35}/,severity:"critical"},{id:"gcp-service-account",name:"GCP Service Account",pattern:/"type"\s*:\s*"service_account"/,severity:"critical"},{id:"github-token",name:"GitHub Token",pattern:/gh[pousr]_[0-9a-zA-Z]{36,}/,severity:"critical"},{id:"github-fine-grained",name:"GitHub Fine-Grained Token",pattern:/github_pat_[0-9a-zA-Z_]{22,}/,severity:"critical"},{id:"gitlab-token",name:"GitLab Token",pattern:/glpat-[0-9a-zA-Z_-]{20,}/,severity:"critical"},{id:"stripe-secret",name:"Stripe Secret Key",pattern:/sk_live_[0-9a-zA-Z]{24,}/,severity:"critical"},{id:"stripe-restricted",name:"Stripe Restricted Key",pattern:/rk_live_[0-9a-zA-Z]{24,}/,severity:"critical"},{id:"slack-token",name:"Slack Token",pattern:/xox[baprs]-[0-9a-zA-Z-]{10,}/,severity:"high"},{id:"slack-webhook",name:"Slack Webhook",pattern:/hooks\.slack\.com\/services\/T[0-9A-Z]{8,}\/B[0-9A-Z]{8,}\/[0-9a-zA-Z]{24}/,severity:"high"},{id:"twilio-api-key",name:"Twilio API Key",pattern:/SK[0-9a-fA-F]{32}/,severity:"high"},{id:"sendgrid-api-key",name:"SendGrid API Key",pattern:/SG\.[0-9a-zA-Z_-]{22}\.[0-9a-zA-Z_-]{43}/,severity:"critical"},{id:"postgres-uri",name:"PostgreSQL Connection String",pattern:/postgres(?:ql)?:\/\/[^\s'"]{10,}/,severity:"critical"},{id:"mongodb-uri",name:"MongoDB Connection String",pattern:/mongodb(?:\+srv)?:\/\/[^\s'"]{10,}/,severity:"critical"},{id:"redis-uri",name:"Redis Connection String",pattern:/redis(?:s)?:\/\/[^\s'"]{10,}/,severity:"high"},{id:"openai-key",name:"OpenAI API Key",pattern:/sk-[0-9a-zA-Z]{20,}T3BlbkFJ[0-9a-zA-Z]{20,}/,severity:"critical"},{id:"openai-project-key",name:"OpenAI API Key",pattern:/sk-(?:proj|svcacct|admin)-[0-9A-Za-z_-]{40,}/,severity:"critical"},{id:"anthropic-key",name:"Anthropic API Key",pattern:/sk-ant-[0-9a-zA-Z_-]{40,}/,severity:"critical"},{id:"firebase-key",name:"Firebase API Key",pattern:/AIza[0-9A-Za-z_-]{35}/,severity:"high"},{id:"supabase-key",name:"Supabase Service Key",pattern:/eyJ[0-9a-zA-Z_-]{100,}/,severity:"critical"},{id:"supabase-access-token",name:"Supabase Access Token",pattern:/\bsbp_[0-9a-f]{40}\b/,severity:"critical"},{id:"supabase-secret-key",name:"Supabase Secret Key",pattern:/\bsb_secret_[0-9A-Za-z_-]{20,}/,severity:"critical"},{id:"private-key",name:"Private Key",pattern:/-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/,severity:"critical"},{id:"jwt-secret",name:"JWT/Generic Secret",pattern:/(?:jwt_secret|JWT_SECRET|secret_key|SECRET_KEY|api_secret|API_SECRET)\s*[=:]\s*['"][^'"]{8,}['"]/,severity:"high"},{id:"password-in-code",name:"Password in Code",pattern:/(?:password|passwd|pwd)\s*[=:]\s*['"][^'"]{8,}['"]/,severity:"high"},{id:"bearer-token",name:"Bearer Token in Code",pattern:/['"]Bearer\s+[0-9a-zA-Z._-]{20,}['"]/,severity:"high"}];function Lt(){let e=bn().filter(t=>!_n.some(n=>n.id===t.id));return[..._n,...e]}var xn=/node_modules\/|\.next\/|\.test\.|\.spec\.|__tests__\/|\.nodata-proof\.json$|\.git\//,wn=/(^|\/)\.env(\.[\w-]+)*\.(example|sample|template|dist)$|\.(example|sample|template)$|(^|\/)[^/]*\.(example|sample)\.[a-z0-9]+$/i,Ct=/(^|\/)(__tests__|__mocks__|tests?|spec|fixtures?|mocks?|samples?|examples?|demo|testdata)(\/|$)|\.(test|spec)\.[a-z0-9]+$|\.min\.(m?js|css)$|(^|\/)[^/]*\.worker\.min\.m?js$/i,Kr=[{name:"lodash",below:"4.17.21",severity:"critical",cve:"CVE-2021-23337",desc:"Command injection via template"},{name:"minimist",below:"1.2.6",severity:"critical",cve:"CVE-2021-44906",desc:"Prototype pollution"},{name:"json5",below:"2.2.2",severity:"high",cve:"CVE-2022-46175",desc:"Prototype pollution"},{name:"express",below:"4.19.2",severity:"high",cve:"CVE-2024-29041",desc:"Open redirect"},{name:"path-to-regexp",below:"6.3.0",severity:"high",cve:"CVE-2024-45296",desc:"ReDoS"},{name:"sanitize-html",below:"2.12.1",severity:"high",cve:"CVE-2024-21501",desc:"XSS bypass"},{name:"dompurify",below:"3.0.9",severity:"high",cve:"CVE-2024-45801",desc:"mXSS"},{name:"jsonwebtoken",below:"9.0.0",severity:"critical",cve:"CVE-2022-23529",desc:"Key confusion attack"},{name:"jose",below:"4.15.5",severity:"high",cve:"CVE-2024-28176",desc:"DoS via JWE"},{name:"axios",below:"1.6.0",severity:"high",cve:"CVE-2023-45857",desc:"CSRF cookie leak"},{name:"node-fetch",below:"2.6.7",severity:"high",cve:"CVE-2022-0235",desc:"Header leak on redirect"},{name:"serialize-javascript",below:"6.0.2",severity:"critical",cve:"CVE-2024-11831",desc:"XSS via serialization"},{name:"xml2js",below:"0.6.0",severity:"high",cve:"CVE-2023-0842",desc:"Prototype pollution"},{name:"next",below:"14.1.1",severity:"high",cve:"CVE-2024-34350",desc:"SSRF via headers"},{name:"sharp",below:"0.32.6",severity:"high",cve:"CVE-2023-4863",desc:"libwebp heap overflow"},{name:"multer",below:"1.4.5",severity:"high",cve:"CVE-2022-24434",desc:"Prototype pollution"},{name:"tough-cookie",below:"4.1.3",severity:"medium",cve:"CVE-2023-26136",desc:"Prototype pollution"},{name:"semver",below:"7.5.4",severity:"medium",cve:"CVE-2022-25883",desc:"ReDoS"},{name:"ip",below:"2.0.1",severity:"critical",cve:"CVE-2024-29415",desc:"SSRF bypass via octal IP"},{name:"tar",below:"6.2.1",severity:"high",cve:"CVE-2024-28863",desc:"DoS via path traversal"}];function Jr(e,t){let n=s=>s.replace(/^[^0-9]*/,"").split(".").map(o=>parseInt(o,10)||0),r=n(e),i=n(t);for(let s=0;s<3;s++){if((r[s]||0)<(i[s]||0))return!0;if((r[s]||0)>(i[s]||0))return!1}return!1}function vn(e){let t=[],n;try{n=JSON.parse(e)}catch{return t}let r={...n.dependencies??{},...n.devDependencies??{}};for(let[i,s]of Object.entries(r)){let o=(s||"").replace(/^[\^~>=<\s]+/,""),a=Kr.find(c=>c.name===i&&Jr(o,c.below));a&&t.push({name:i,version:o,vuln:a})}return t}var Yr=[{pattern:/^(full_?name|first_?name|last_?name|spouse_?name|beneficiary_?name)$/i,type:"name",label:"Person name"},{pattern:/^(email|e_?mail|email_?address)$/i,type:"email",label:"Email address"},{pattern:/^(phone|mobile|telephone|phone_?number|cell_?phone)$/i,type:"phone",label:"Phone number"},{pattern:/^(id_?number|identity|ssn|social_?security|national_?id|teudat_?zehut)$/i,type:"id",label:"ID number"},{pattern:/^(address|street_?address|home_?address)$/i,type:"address",label:"Address"},{pattern:/^(date_?of_?birth|dob|birth_?date|birthday)$/i,type:"dob",label:"Date of birth"},{pattern:/^(bank_?account|iban|account_?number|bank_?details|routing_?number)$/i,type:"financial",label:"Bank account"},{pattern:/^(credit_?card|card_?number|cvv|cc_?number)$/i,type:"financial",label:"Credit card"},{pattern:/^(salary|income|commission|premium|compensation)$/i,type:"financial",label:"Salary / income"},{pattern:/^(medical_?info|health_?conditions|diagnosis|medication|prescription)$/i,type:"medical",label:"Medical"},{pattern:/^(passport|passport_?number|passport_?id)$/i,type:"id",label:"Passport"},{pattern:/^(driver_?license|drivers_?license|dl_?number)$/i,type:"id",label:"Driver license"},{pattern:/^(tax_?id|tin|vat_?number|ein)$/i,type:"financial",label:"Tax ID"},{pattern:/^(insurance_?number|policy_?number|member_?id)$/i,type:"id",label:"Insurance/Policy"},{pattern:/^(biometric|fingerprint|face_?id|retina)$/i,type:"biometric",label:"Biometric"},{pattern:/^(latitude|longitude|lat|lng|geo_?location|coordinates)$/i,type:"location",label:"Geolocation"}],qr=[{pattern:/^(?:שם|שם_מלא|שם פרטי|שם_פרטי|שם משפחה|שם_משפחה|שם הלקוח|שם בן זוג|שם המבוטח|שם המוטב|שם הילד|שם הקטין)$/i,type:"name",label:"\u05E9\u05DD \u05D0\u05D3\u05DD"},{pattern:/^(?:ת"ז|ת\.ז|ת ז|תז|תעודת זהות|תעודת_זהות|מספר זהות|מס' זהות|teudat_zehut|tz|israeli_id|il_id)$/i,type:"id",label:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA"},{pattern:/^(?:דרכון|מספר דרכון|רישיון נהיגה|רישיון_נהיגה|רשיון נהיגה)$/i,type:"id",label:"\u05D3\u05E8\u05DB\u05D5\u05DF/\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF"},{pattern:/^(?:מייל|דוא"ל|דוא_ל|דואר אלקטרוני|אימייל|כתובת מייל)$/i,type:"email",label:"\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9"},{pattern:/^(?:טלפון|טל'|נייד|פלאפון|סלולרי|מספר טלפון|טלפון נייד)$/i,type:"phone",label:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF"},{pattern:/^(?:כתובת|כתובת מגורים|רחוב|מס בית|עיר|ישוב|יישוב|מיקוד|כתובת מלאה|מען)$/i,type:"address",label:"\u05DB\u05EA\u05D5\u05D1\u05EA"},{pattern:/^(?:תאריך לידה|ת לידה|תאריך הולדת|יום הולדת|גיל)$/i,type:"dob",label:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"},{pattern:/^(?:חשבון בנק|מספר חשבון|מס חשבון|סניף|iban|iban_il)$/i,type:"financial",label:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7"},{pattern:/^(?:כרטיס אשראי|מספר אשראי|cvv|אשראי)$/i,type:"financial",label:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"},{pattern:/^(?:שכר|משכורת|הכנסה|פרמיה|שכר ברוטו|שכר נטו|תגמול|בונוס|פיצוי)$/i,type:"financial",label:"\u05E9\u05DB\u05E8/\u05D4\u05DB\u05E0\u05E1\u05D4"},{pattern:/^(?:אבחון|אבחנה|מחלה|תרופה|מרשם|בדיקה רפואית|מצב רפואי|חיסון|רגישות|אלרגיה|סוג דם)$/i,type:"medical",label:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(?:מספר פוליסה|מס פוליסה|פוליסה|מספר חבר|מספר ביטוח)$/i,type:"id",label:"\u05E4\u05D5\u05DC\u05D9\u05E1\u05D4/\u05D7\u05D1\u05E8\u05D5\u05EA"},{pattern:/^(?:שם הילד|תעודת זהות של ילד|ילדים|קטין|מספר ילדים|תעודת לידה)$/i,type:"minor_data",label:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05DF"},{pattern:/^(?:דת|לאום|מין|נטייה מינית|השקפה פוליטית|מצב משפחתי|עדה|מוצא)$/i,type:"sensitive_personal",label:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9"},{pattern:/^(?:מספר רכב|מס רכב|לוחית רישוי|מספר רישוי)$/i,type:"tracking",label:"\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"}],Qr=/^(id|uuid|created_?at|updated_?at|deleted_?at|status|type|category|description|title|slug|url|path|key|value|enabled|active|public|version|metadata|config|settings|data|content|note|comment|label|color|icon)$/i,ei=/^שם[ _](?:ה)?(?:קובץ|מוצר|פריט|חברה|ארגון|עסק|פרויקט|גיליון|טבלה|שדה|קטגוריה|סניף|בנק|עיר|רחוב|ישוב|יישוב|מסמך|תוכנית|חבילה|קורס|מחלקה|אתר|דומיין|מותג|ספק|שירות|תפקיד)$|^(file|product|item|company|org|organization|project|sheet|table|field|category|branch|bank|city|street|document|plan|course|department|site|domain|brand|vendor|service|role)[ _-]?name$/i;function _e(e){if(!e)return null;let t=e.trim();if(Qr.test(t)||/^name$/i.test(t)||/^\[[A-Z_]+(?:-\d+)?\]$/.test(t))return null;let n=t.replace(/[\s-]+/g,"_");for(let r of[...qr,...Yr])if(r.pattern.test(t)||r.pattern.test(n))return{type:r.type,label:r.label};if(ei.test(t))return null;if(/^שם[ _][\u0590-\u05FF"'׳ ]{2,20}$/.test(t))return{type:"name",label:"\u05E9\u05DD \u05D0\u05D3\u05DD"};if(/^(customer|client|employee|inspector|supervisor|contact|person|patient|user|owner|manager|agent|member|driver|tenant|student|parent|beneficiary|insured)_?(full_?)?name$/i.test(n))return{type:"name",label:"Person name"};for(let r of yn()){let i=r(t);if(i)return{type:i.type,label:i.label}}return null}var Qe={id:"critical",financial:"critical",medical:"critical",biometric:"critical",minor_data:"critical",sensitive_personal:"critical",email:"high",phone:"high",name:"high",address:"high",dob:"high",tracking:"medium",location:"high",auth:"critical",employment:"medium",education:"medium",behavior:"high"};function et(e){let t=String(e??"").replace(/\D/g,"");if(t.length===0||t.length>9)return!1;let n=t.padStart(9,"0"),r=0;for(let i=0;i<9;i++){let s=parseInt(n[i]??"0",10)*(i%2+1);s>9&&(s-=9),r+=s}return r%10===0&&parseInt(n,10)>0}var Pt=/(?<!\d)(?<!\d[.,])(?:\+972[\s-]?|0)(?:5[0-9]|7[0-9]|[2-4]|[89])(?:[\s-]?\d){7}(?!\d)(?![.,]\d)/g;var Oe=/\bIL\d{2}\s?(?:\d{4}\s?){4}\d{3}\b/g;function ti(e){let t=String(e??"").replace(/\D/g,"");if(t.length<12||t.length>19)return!1;let n=0,r=!1;for(let i=t.length-1;i>=0;i-=1){let s=parseInt(t[i]??"0",10);r&&(s*=2,s>9&&(s-=9)),n+=s,r=!r}return n%10===0}function tt(e){let t=String(e??"").replace(/\s/g,"").toUpperCase();if(!/^[A-Z]{2}\d{2}[A-Z0-9]{10,30}$/.test(t))return!1;let n=t.slice(4)+t.slice(0,4),r=0;for(let i of n){let s=i>="A"&&i<="Z"?String(i.charCodeAt(0)-55):i;for(let o of s)r=(r*10+Number(o))%97}return r===1}var $t="(?<!\\d)(?<!\\d[.,])",Rt="(?!\\d)(?![.,]\\d)",De=[{subkind:"israeli_id",severity:"high",pattern:new RegExp(`${$t}(?:\\d{8}-\\d|\\d{9})${Rt}`,"g"),validate:et,hint:"Israeli national ID (check digit verified) in plaintext. Encrypt the column or mask it at rest."},{subkind:"credit_card",severity:"critical",pattern:new RegExp(`${$t}[2-6][ -]?(?:\\d[ -]?){11,17}\\d${Rt}`,"g"),validate:ti,hint:"Payment card number (Luhn verified) in plaintext. This is PCI scope."},{subkind:"iban",severity:"high",pattern:/\b[A-Z]{2}\d{2}(?: ?[A-Z0-9]{4}){2,7}(?: ?[A-Z0-9]{1,4})?\b/g,validate:tt,hint:"Bank account in IBAN form (mod-97 verified) in plaintext."},{subkind:"israeli_phone",severity:"medium",pattern:new RegExp(`${$t}(?:\\+972[- ]?|0)(?:[57]\\d|[2-489])[- ]?\\d{3}[- ]?\\d{4}${Rt}`,"g"),validate:e=>{let t=e.replace(/\D/g,"").replace(/^972/,"0");return/^0[57]\d{8}$/.test(t)?!0:/^0[2-489]\d{7}$/.test(t)&&(/[- ]/.test(e)||e.startsWith("+972"))},hint:"Israeli phone number in plaintext."}];function kn(e){if(e.length!==14&&e.length!==17)return!1;let t=+e.slice(0,4),n=+e.slice(4,6),r=+e.slice(6,8),i=+e.slice(8,10),s=+e.slice(10,12),o=+e.slice(12,14);return t>=1970&&t<=2099&&n>=1&&n<=12&&r>=1&&r<=31&&i<24&&s<60&&o<60}function Sn(e){let t=Number(e);return!Number.isSafeInteger(t)||t<1024?!1:Number.isInteger(Math.log2(t))||t%1048576===0}var ni=new Set(["000000018","123456782","111111118","222222226","333333334","999999998","4111111111111111","4242424242424242","4000056655665556","5555555555554444","5105105105105100","2223003122003222","378282246310005","371449635398431","6011111111111117","3056930009020004","4012888888881881","4000000000000002"]);function Pe(e){return ni.has(e.replace(/\D/g,""))}function nt(e){let t=e.replace(/\D/g,"");return kn(t)||Sn(t)}function Ne(e,t){let n=[];for(let r of De){r.pattern.lastIndex=0;let i=new Set,s,o=0;for(;(s=r.pattern.exec(e))!==null&&(o+=1,!(o>2e5));){let a=s[0];if(!(r.subkind!=="iban"&&r.subkind!=="israeli_phone"&&nt(a))&&(r.validate(a)&&i.add(a.replace(/[\s-]/g,"")),i.size>=1e5))break}if(i.size>0){if(t)for(let c of i)Pe(c)||t(r.subkind,c);let a=[...i].filter(c=>!Pe(c)).length;n.push({subkind:r.subkind,severity:a===0?"low":r.severity,hint:a===0?`${r.hint} All ${i.size} are published test numbers.`:r.hint,count:i.size,real:a})}}for(let r of qe()){let i=new Set;for(let s of r.find(e))i.add(e.slice(s.start,s.end).trim());i.size>0&&n.push({subkind:r.kind,severity:r.severity,hint:r.hint,count:i.size})}return n}function Fe(e,t){let n=[],r="",i=!1;for(let s=0;s<e.length;s++){let o=e[s];i?o==='"'&&e[s+1]==='"'?(r+='"',s++):o==='"'?i=!1:r+=o:o==='"'?i=!0:o===t?(n.push(r),r=""):r+=o}return n.push(r),n}import{inflateRawSync as ns}from"node:zlib";import{inflateSync as En}from"node:zlib";var Me=new Set([".pdf"]),An=8*1024*1024;function rt(e){let t=e.toString("latin1"),n=new Map,r=/(\d+)\s+(\d+)\s+obj\b/g,i;for(;(i=r.exec(t))!==null;){let s=Number(i[1]),o=r.lastIndex,a=t.indexOf("endobj",o);if(a<0)continue;let c=t.indexOf("stream",o),l,p=null;if(c>=0&&c<a){l=t.slice(o,c);let u=c+6;t[u]==="\r"&&(u+=1),t[u]===`
4
4
  `&&(u+=1);let h=t.indexOf("endstream",u);h>u&&(p=e.subarray(u,h))}else l=t.slice(o,a);n.set(s,{num:s,dict:l,stream:p})}for(let s of[...n.values()]){if(!s.stream||!/\/Type\s*\/ObjStm\b/.test(s.dict))continue;let o=je(s),a=Number(/\/N\s+(\d+)/.exec(s.dict)?.[1]??0),c=Number(/\/First\s+(\d+)/.exec(s.dict)?.[1]??-1);if(o===null||!a||c<0)continue;let l=o.slice(0,c).trim().split(/\s+/).map(Number);for(let p=0;p<a;p+=1){let u=l[2*p],h=l[2*p+1];if(u===void 0||h===void 0||Number.isNaN(u)||Number.isNaN(h))break;let y=p+1<a?l[2*(p+1)+1]:void 0,_=o.slice(c+h,y!==void 0?c+y:void 0);n.has(u)||n.set(u,{num:u,dict:_,stream:null})}}return n}function Ot(e){let t=[...e.replace(/\s+/g,"")];if(t.length<40)return!1;let n=0,r=0;for(let i of t){let s=i.codePointAt(0)??0;s<32||s>=127&&s<=191||s===65533||s>=57344&&s<=63743?n+=1:/[\p{L}\p{N}]/u.test(i)&&(r+=1)}return n/t.length>.2||r/t.length<.25}function ri(e){let t=e.toString("latin1").replace(/\s/g,"");t.startsWith("<~")&&(t=t.slice(2));let n=t.indexOf("~>");n>=0&&(t=t.slice(0,n));let r=[],i=0,s=0;for(let o of t){if(o==="z"&&s===0){r.push(0,0,0,0);continue}let a=o.charCodeAt(0)-33;if(a<0||a>84)return null;i=i*85+a,s+=1,s===5&&(r.push(i>>>24&255,i>>>16&255,i>>>8&255,i&255),i=0,s=0)}if(s>0){for(let a=s;a<5;a+=1)i=i*85+84;let o=[i>>>24&255,i>>>16&255,i>>>8&255,i&255];for(let a=0;a<s-1;a+=1)r.push(o[a]??0)}return Buffer.from(r)}function ii(e){let t=e.toString("latin1").replace(/\s/g,"").split(">")[0]??"",n=t.length%2?t+"0":t;return/^[0-9A-Fa-f]*$/.test(n)?Buffer.from(n,"hex"):null}function si(e){let t=/\/Filter\s*(\[[^\]]*\]|\/\w+)/.exec(e);return!t||!t[1]?[]:[...t[1].matchAll(/\/(\w+)/g)].map(n=>n[1]??"")}function je(e,t){if(!e.stream)return null;let n=e.stream;for(let r of si(e.dict)){let i=null;if(r==="FlateDecode")try{i=t!==void 0?En(n,{maxOutputLength:Math.max(1,t)}):En(n)}catch{return null}else if(r==="ASCII85Decode")i=ri(n);else if(r==="ASCIIHexDecode")i=ii(n);else return null;if(i===null)return null;n=i}return n.toString("latin1")}function oi(e){let t=new Map,n=1,r=/begincodespacerange([\s\S]*?)endcodespacerange/.exec(e);if(r&&r[1]){let c=/<([0-9A-Fa-f]+)>/.exec(r[1]);c&&c[1]&&c[1].length>=4&&(n=2)}let i=c=>{let l="";for(let p=0;p+3<c.length+1;p+=4){let u=parseInt(c.slice(p,p+4),16);Number.isFinite(u)&&u>0&&(l+=String.fromCharCode(u))}return l},s=/beginbfchar([\s\S]*?)endbfchar/g,o;for(;(o=s.exec(e))!==null;){let c=/<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]*)>/g,l;for(;(l=c.exec(o[1]??""))!==null;)t.set(parseInt(l[1]??"0",16),i(l[2]??""))}let a=/beginbfrange([\s\S]*?)endbfrange/g;for(;(o=a.exec(e))!==null;){let c=o[1]??"",l=/<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]*)>/g,p;for(;(p=l.exec(c))!==null;){let u=parseInt(p[1]??"0",16),h=parseInt(p[2]??"0",16),y=parseInt((p[3]??"0").slice(0,4)||"0",16);if(!(h-u>65535))for(let _=u;_<=h;_+=1)t.set(_,String.fromCharCode(y+(_-u)))}}return{map:t,bytes:n}}function ai(e){let t=new Map,n=[],r=[];for(let s of e.values()){for(let o of s.dict.matchAll(/\/Font\s*<<([\s\S]*?)>>/g))o[1]&&r.push(o[1]);for(let o of s.dict.matchAll(/\/Font\s+(\d+)\s+\d+\s+R/g)){let a=e.get(Number(o[1]));a&&r.push(a.dict)}}let i=new Set;for(let s of r){let o=/\/([^\s/<>[\]()]+)\s+(\d+)\s+\d+\s+R/g,a;for(;(a=o.exec(s))!==null;){let c=`${a[1]}#${a[2]}`;i.has(c)||(i.add(c),n.push([a[1]??"",Number(a[2])]))}}for(let[s,o]of n){let a=e.get(o);if(!a)continue;let c=null,l=/\/ToUnicode\s+(\d+)\s+\d+\s+R/.exec(a.dict);if(l){let u=e.get(Number(l[1])),h=u?je(u):null;h&&(c=oi(h))}if(c||(c=ui(a.dict,e)),!c)continue;let p=t.get(s)??[];p.push(c),t.set(s,p)}return t}var ci=["alef","bet","gimel","dalet","he","vav","zayin","het","tet","yod","finalkaf","kaf","lamed","finalmem","mem","finalnun","nun","samekh","ayin","finalpe","pe","finaltsadi","tsadi","qof","resh","shin","tav"];function li(e){let t=/^uni([0-9A-Fa-f]{4})$/.exec(e)??/^u([0-9A-Fa-f]{4,6})$/.exec(e);if(t)return String.fromCodePoint(parseInt(t[1],16));let n=/^afii(\d{5})$/.exec(e);if(n){let s=Number(n[1]);if(s>=57664&&s<=57690)return String.fromCharCode(1488+(s-57664))}let r=ci.indexOf(e.replace(/hebrew$/,""));return r>=0?String.fromCharCode(1488+r):e==="space"?" ":/^[A-Za-z]$/.test(e)?e:{zero:"0",one:"1",two:"2",three:"3",four:"4",five:"5",six:"6",seven:"7",eight:"8",nine:"9",period:".",comma:",",hyphen:"-",colon:":",slash:"/",at:"@"}[e]??null}function ui(e,t){let n=e,r=/\/Encoding\s+(\d+)\s+\d+\s+R/.exec(e);r&&(n=t.get(Number(r[1]))?.dict??"");let i=/\/Differences\s*\[([^\]]*)\]/.exec(n);if(!i?.[1])return null;let s=new Map,o=0;for(let a of i[1].match(/\d+|\/[^\s/[\]]+/g)??[]){if(/^\d+$/.test(a)){o=Number(a);continue}let c=li(a.slice(1));c!==null&&s.set(o,c),o+=1}return s.size?{map:s,bytes:1}:null}function Cn(e){let t=[];for(let n=0;n<e.length;n+=1){let r=e[n];if(r!=="\\"){t.push(r.charCodeAt(0)&255);continue}let i=e[n+1];if(i===void 0)break;if(i>="0"&&i<="7"){let o="",a=n+1;for(;a<e.length&&o.length<3&&e[a]>="0"&&e[a]<="7";)o+=e[a],a+=1;t.push(parseInt(o,8)&255),n=a-1;continue}let s={n:10,r:13,t:9,b:8,f:12};t.push(s[i]??i.charCodeAt(0)&255),n+=1}return t}function Pn(e){if(e.length<2||e[0]!==254||e[1]!==255)return null;let t="";for(let n=2;n+1<e.length;n+=2)t+=String.fromCharCode((e[n]??0)<<8|(e[n+1]??0));return t}function In(e,t){let n=Pn(e);if(n!==null)return n;if(!t)return e.map(i=>String.fromCharCode(i)).join("");let r="";if(t.bytes===2)for(let i=0;i+1<e.length;i+=2){let s=(e[i]??0)<<8|(e[i+1]??0);r+=t.map.get(s)??""}else for(let i of e)r+=t.map.get(i)??String.fromCharCode(i);return r}function di(e){let t=0;for(let n of e){let r=n.codePointAt(0)??0;/[\p{L}\p{N}]/u.test(n)?t+=1:(r<32||r>=127&&r<=191||r===65533)&&(t-=2)}return t}function Tn(e,t){if(!t||t.length<=1)return In(e,t?.[0]);let n="",r=-1/0;for(let i of t){let s=In(e,i),o=di(s);o>r&&(n=s,r=o)}return n}function fi(e,t){let n="",r="",i,s=!1,o="",a=0,c=null,l=()=>{r.trim()&&(n+=r+`
package/dist/status.js CHANGED
@@ -1,2 +1,2 @@
1
- /*! @nodatachat/mcp 1.6.44 | Copyright 2026 Capsule Ltd. | FSL-1.1-ALv2 | see LICENSE.md */
1
+ /*! @nodatachat/mcp 1.6.45 | Copyright 2026 Capsule Ltd. | FSL-1.1-ALv2 | see LICENSE.md */
2
2
  import{execSync as bn}from"node:child_process";import{existsSync as xn,readFileSync as Z}from"node:fs";import{existsSync as L,mkdirSync as Bn,readdirSync as X,readFileSync as nn,rmSync as Jn,writeFileSync as Pn,chmodSync as Mn}from"node:fs";import{homedir as F}from"node:os";import{basename as zn,isAbsolute as en,join as u,relative as tn,resolve as rn}from"node:path";var g=()=>u(F(),".nodata"),on=()=>u(g(),"credentials.json"),v=()=>u(g(),"orgs"),sn=()=>u(g(),"bindings.json"),ln=/^[A-Za-z0-9_.-]{1,80}$/,b=n=>ln.test(n)&&n!=="."&&n!=="..";function D(n){try{return L(n)?JSON.parse(nn(n,"utf8")):null}catch{return null}}function cn(n){return n?n.device?.org_id?n.device.org_id:n.api_key?`key-${(n.key_prefix??n.api_key.slice(0,12)).replace(/[^A-Za-z0-9_-]/g,"")}`:null:null}function E(){return cn(D(on()))}function m(){let n=[],t=E();t&&n.push(t);try{for(let e of X(v()))b(e)&&!n.includes(e)&&L(u(v(),e,"credentials.json"))&&n.push(e)}catch{}return n}function an(n){return n===E()?g():b(n)?u(v(),n):null}var un=n=>process.platform==="win32"||process.platform==="darwin"?n.toLowerCase():n,h=n=>un(rn(n.replace(/^~(?=[\\/]|$)/,F())));function dn(n,t){let e=tn(h(n),h(t));return e===""||!e.startsWith("..")&&!en(e)}function A(){let n=D(sn());return(Array.isArray(n?.bindings)?n.bindings:[]).filter(e=>!!e&&typeof e.folder=="string"&&typeof e.org_id=="string"&&b(e.org_id)).map(e=>e.project===void 0||hn(e.project)===e.project?e:{...e,project:void 0}).map(e=>e.client===void 0||typeof e.client?.org_id=="string"&&fn.test(e.client.org_id)?e:{...e,client:void 0})}var fn=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function gn(n,t=A()){let e=null;for(let s of t)dn(s.folder,n)&&(!e||h(s.folder).length>h(e.folder).length)&&(e=s);return e}function x(n,t=m(),e=A()){if(t.length===0)return{kind:"none"};let s=gn(n,e.filter(c=>t.includes(c.org_id)));return s?{kind:"bound",org_id:s.org_id,folder:s.folder}:t.length===1?{kind:"only",org_id:t[0]}:{kind:"unbound",orgs:t}}function pn(n){let t=x(n);return t.kind==="bound"||t.kind==="only"?t.org_id:null}function hn(n){if(typeof n!="string")return null;let t=n.trim();return t&&t.length<=120&&!/[\u0000-\u001f\\/]/.test(t)?t:null}function R(n,t=process.cwd()){if(m().length===0)return g();let e=n??pn(t);return e?an(e):null}import{homedir as Sn}from"node:os";import{join as d}from"node:path";var B=["\u{1F7E3}","\u{1F535}","\u{1F7E0}","\u{1F7E4}","\u{1F7E1}"];function mn(n){let t=0;for(let e of n)t=t*31+e.codePointAt(0)>>>0;return B[t%B.length]}function J(n,t){let e=(n||"agent").toLowerCase().replace(/[^a-z0-9._-]+/g,"-").slice(0,40);return t?`${e}@${t}`:e}function P(n){return`${mn(n)} ${n}`}var M="2026-09-24-v3";import{existsSync as $n,mkdirSync as Wn,readFileSync as _n,writeFileSync as Zn}from"node:fs";import{homedir as yn}from"node:os";import{join as jn}from"node:path";var H=()=>jn(yn(),".nodata","prefs.json");function wn(){try{let n=$n(H())?JSON.parse(_n(H(),"utf8")).lang:null;return n==="he"||n==="en"?n:null}catch{return null}}function kn(){let t=process.env.LC_ALL||process.env.LC_MESSAGES||process.env.LANG||"";try{t||=Intl.DateTimeFormat().resolvedOptions().locale}catch{}return/^(he|iw)(?:[-_.@]|$)/i.test(t)?"he":"en"}function vn(){return wn()??kn()}function r(n,t,e=vn()){return e==="he"?n:t}var On="\x1B[32m",a="\x1B[33m",k="\x1B[31m",N="\x1B[2m",i="\x1B[0m";function f(n){try{return xn(n)?JSON.parse(Z(n,"utf8")):null}catch{return null}}var T="";try{T=Z(0,"utf8")}catch{}var p=Sn(),Nn=f(d(p,".claude","settings.json")),I=(Nn?.hooks?.PreToolUse??[]).flatMap(n=>n.hooks??[]).find(n=>n.command.includes("gate.mjs"))?.command,S=I?I.includes("--block")?"block":"ask":null,Cn=f(d(p,".nodata","consent.json")),Tn=Cn?.terms_version===M,q=f(d(p,".nodata","credentials.json")),Ln=J("claude-code",q?.device?.label),o=[],_;Tn?S?(_=On,o.push(r(`\u05E9\u05E2\u05E8 ${S==="block"?"\u05D7\u05D5\u05E1\u05DD":"\u05E9\u05D5\u05D0\u05DC"}`,`gate ${S}`),r("\u05EA\u05E0\u05D0\u05D9\u05DD \u2713","terms \u2713"))):(_=a,o.push(r("\u05E9\u05E2\u05E8 \u05DB\u05D1\u05D5\u05D9","gate off"))):(_=k,o.push(r("\u05EA\u05E0\u05D0\u05D9 \u05E9\u05D9\u05DE\u05D5\u05E9 \u05DC\u05D0 \u05D0\u05D5\u05E9\u05E8\u05D5 \u2014 nodata_terms","terms not accepted \u2014 nodata_terms")));var l=f(d(p,".nodata","connection.json")),C=l?.at?Date.now()-Date.parse(l.at)<60*6e4:!1,z=`${a}${r("\u05DC\u05D0 \u05DE\u05D7\u05D5\u05D1\u05E8","not connected")}${i}`;C&&l?.state==="waiting"?o.push(`${a}${r("\u05DE\u05DE\u05EA\u05D9\u05DF \u05DC\u05D0\u05D9\u05E9\u05D5\u05E8","waiting for approval")}${i}`):q?!l||!C?o.push(`${a}${r("\u05D7\u05D9\u05D1\u05D5\u05E8 \u05DC\u05D0 \u05E0\u05D1\u05D3\u05E7","connection not checked")}${i}`):l.state==="connected"?o.push(r("\u05DE\u05D7\u05D5\u05D1\u05E8 \u2713","connected \u2713")):l.state==="reconnecting"?o.push(`${a}${r("\u05DE\u05EA\u05D7\u05D1\u05E8 \u05DE\u05D7\u05D3\u05E9\u2026","reconnecting\u2026")}${i}`):l.state==="restart"?o.push(`${a}${r("\u05D0\u05D5\u05E9\u05E8 \u2014 \u05D4\u05E7\u05DC\u05D3 /mcp","approved \u2014 type /mcp")}${i}`):l.state==="needs-you"?o.push(`${k}${r("\u05DC\u05D0 \u05DE\u05D7\u05D5\u05D1\u05E8","not connected")} \u2192 ${l.step??"nodata_connect"}${i}`):o.push(z):o.push(z);var G=m(),y=process.cwd();try{let n=JSON.parse(T);y=n.workspace?.current_dir||n.cwd||y}catch{}if(G.length>1){let n=x(y,G);n.kind==="bound"||n.kind==="only"?o.push(`${r("\u05D0\u05E8\u05D2\u05D5\u05DF","org")} ${n.org_id.slice(0,8)}`):o.push(`${k}${r("\u05D4\u05EA\u05D9\u05E7\u05D9\u05D9\u05D4 \u05DC\u05D0 \u05E9\u05D5\u05D9\u05DB\u05D4 \u05DC\u05D0\u05E8\u05D2\u05D5\u05DF","folder bound to no org")}${i}`)}var U=R(null,y),$=U?f(d(U,"capsule.json")):null;if($){let n=$.last_heartbeat_ok_at?Date.parse($.last_heartbeat_ok_at):NaN,t=Number.isFinite(n)?Math.round((Date.now()-n)/6e4):1/0,e=s=>s<120?r(`${s} \u05D3'`,`${s}m`):r(`${Math.round(s/60)} \u05E9'`,`${Math.round(s/60)}h`);$.revoked?o.push(`${k}${r('\u05D4\u05E6\u05D5\u05DE\u05EA \u05D4\u05D5\u05E9\u05D4\u05D4 \u05E2"\u05D9 \u05D4\u05D0\u05E8\u05D2\u05D5\u05DF',"node paused by org")}${i}`):t<=15?o.push(`${r("\u05E6\u05D5\u05DE\u05EA","node")} \u2713 ${t<1?r("\u05E2\u05DB\u05E9\u05D9\u05D5","now"):e(t)}`):o.push(`${a}${r("\u05E6\u05D5\u05DE\u05EA \u05DC\u05D0 \u05D0\u05D5\u05DE\u05EA","node not verified")}${Number.isFinite(t)?` ${e(t)}`:""}${i}`)}o.push(P(Ln));var K=n=>n.split(".").map(Number),Y=(n,t)=>{let[e,s]=[K(n),K(t)];for(let c=0;c<3;c++)if(e[c]!==s[c])return e[c]>s[c];return!1},Fn=60*6e4,Dn=n=>!!n&&Date.now()-Date.parse(n)<Fn,En=Object.values(l?.versions??{}).filter(n=>Dn(n.at)).map(n=>n.version),Q=[...new Set(En.concat(C&&l?.version?[l.version]:[]))].filter(n=>/^\d+\.\d+\.\d+$/.test(n)),j=Q.reduce((n,t)=>!n||Y(t,n)?t:n,null),O=Q.filter(n=>j&&Y(j,n)),An=j?` ${N}v${j}${i}${O.length?` ${a}${r(`(v${O.join(", v")} \u05D1\u05D7\u05DC\u05D5\u05DF \u05D0\u05D7\u05E8: /mcp)`,`(v${O.join(", v")} in another window: /mcp)`)}${i}`:""}`:"",V=`${_}\u25CF NoData${i}${An} ${N}\xB7${i} ${o.join(` ${N}\xB7${i} `)}`,W=f(d(p,".nodata","statusline-prev.json"))?.command,w="";if(W)try{w=bn(W,{input:T,timeout:2e3,encoding:"utf8"}).trim()}catch{w=""}process.stdout.write(w?`${w} \u2502 ${V}`:V);
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@nodatachat/mcp",
3
- "version": "1.6.44",
3
+ "version": "1.6.45",
4
4
  "mcpName": "io.github.daviderez4/nodata",
5
5
  "description": "NoData MCP server: connect any MCP client (Claude Code, Codex, Cursor, VS Code) to the NoData Information Access Processor. Governed access for AI agents, with a verifiable proof for every decision.",
6
6
  "bin": {