@optimuslabs/harness-map-staging 1.5.45 → 1.5.46

package/dist/log_config_files/collection/plugin_collector.js

@@ -20,11 +20,24 @@ const SKILL_MAX_FILE_BYTES = 1024 * 1024;
 const SKILL_MAX_TOTAL_BYTES = 8 * 1024 * 1024;
 const SKILL_MAX_FILES = 500;
 const SKILL_MAX_DEPTH = 8;
+// Credential-shaped names, lower case: the backend skill bundle's rule (_is_secret_name) and its
+// credential files (CredentialFiles.FILE_NAMES), which it never stores the content of (OPT-1016).
+const SECRET_NAMES = new Set([
+    '.env', '.npmrc', '.netrc', '.pgpass', '.git-credentials', '.htpasswd',
+    'credentials', 'credentials.json', '.credentials.json', 'auth.json', 'auth.v2.file',
+    'oauth_creds.json', 'mcp-auth.json', 'mcp_oauth_tokens.json',
+    'id_rsa', 'id_dsa', 'id_ecdsa', 'id_ed25519',
+    'secrets.json', 'secrets.yaml', 'secrets.yml', 'secrets.toml', 'secrets.env',
+]);
+const SECRET_SUFFIXES = ['.pem', '.key', '.p12', '.pfx', '.jks', '.keystore'];
 /** Hidden files are collected, but credential-shaped ones are recorded without their contents. */
 function isSecretName(name) {
     const lower = name.toLowerCase();
-    return lower === '.env' || lower.startsWith('.env.') || lower === '.npmrc' || lower === '.netrc'
-        || lower === '.pgpass' || lower.endsWith('.pem') || lower.endsWith('.key');
+    if (SECRET_NAMES.has(lower) || lower.startsWith('.env.') || SECRET_SUFFIXES.some((s) => lower.endsWith(s)))
+        return true;
+    // Cloud credential files: OAuth client secrets and service-account keys.
+    return lower.endsWith('.json')
+        && (lower.startsWith('client_secret') || lower.startsWith('service-account') || lower.includes('serviceaccount'));
 }
 function skillMetaRecord(filePath, size, sha256, ver) {
     return {
@@ -34,72 +47,74 @@ function skillMetaRecord(filePath, size, sha256, ver) {
         raw_content: { source: 'file', size, ...(sha256 ? { sha256 } : {}), ...(ver ? { version: ver } : {}) },
     };
 }
-function collectSkillDirFiles(dir, results, constants, skillFilename, budget, depth) {
-    if (depth > SKILL_MAX_DEPTH)
-        return;
-    let entries;
+function readSkillDir(dir) {
     try {
-        entries = readdirSync(dir, { withFileTypes: true });
+        return readdirSync(dir, { withFileTypes: true });
     }
     catch (err) {
         console.warn(`Error reading skill dir ${dir}:`, err instanceof Error ? err.message : String(err));
-        return;
+        return null;
+    }
+}
+function sha256Of(full) {
+    try {
+        return createHash('sha256').update(readFileSync(full)).digest('hex');
+    }
+    catch {
+        return null;
     }
-    for (const ent of entries) {
+}
+/** One extra skill file as a record, or null when it is skipped or unreadable. */
+function skillFileRecord(full, name, constants) {
+    const ext = extname(name).toLowerCase();
+    if (SKILL_SKIP_EXTS.has(ext))
+        return null;
+    let size;
+    try {
+        size = statSync(full).size;
+    }
+    catch {
+        return null;
+    }
+    const ver = versionFromPluginCachePath(full, constants);
+    // A credential file's bytes are never read, so it is checked before the size cap and the hash.
+    if (isSecretName(name) || size > SKILL_MAX_FILE_BYTES)
+        return skillMetaRecord(full, size, '', ver);
+    if (!SKILL_TEXT_EXTS.has(ext)) {
+        const sha256 = sha256Of(full);
+        return sha256 === null ? null : skillMetaRecord(full, size, sha256, ver);
+    }
+    const content = readMarkdownFile(full);
+    if (content === null)
+        return null;
+    return { file_type: 'claude_skill', file_path: full, raw_content: { content, source: 'file', ...(ver ? { version: ver } : {}) } };
+}
+function collectSkillDirFiles(dir, results, constants, skillFilename, budget, depth) {
+    if (depth > SKILL_MAX_DEPTH)
+        return;
+    for (const ent of readSkillDir(dir) ?? []) {
         if (budget.files >= SKILL_MAX_FILES || budget.bytes >= SKILL_MAX_TOTAL_BYTES)
             return;
         const full = join(dir, ent.name);
-        if (ent.isDirectory()) {
-            if (!SKILL_SKIP_DIRS.has(ent.name))
-                collectSkillDirFiles(full, results, constants, skillFilename, budget, depth + 1);
+        if (ent.isDirectory() && !SKILL_SKIP_DIRS.has(ent.name)) {
+            collectSkillDirFiles(full, results, constants, skillFilename, budget, depth + 1);
             continue;
         }
-        if (ent.name === skillFilename)
-            continue;
         // Extra skill files: skip nested symlinks so the walk stays inside this skill dir.
-        if (!ent.isFile())
-            continue;
-        const ext = extname(ent.name).toLowerCase();
-        if (SKILL_SKIP_EXTS.has(ext))
-            continue;
-        let size;
-        try {
-            size = statSync(full).size;
-        }
-        catch {
-            continue;
-        }
-        const ver = versionFromPluginCachePath(full, constants);
-        if (size > SKILL_MAX_FILE_BYTES) {
-            results.push(skillMetaRecord(full, size, '', ver));
-            budget.files += 1;
+        if (ent.name === skillFilename || !ent.isFile())
             continue;
-        }
-        if (!SKILL_TEXT_EXTS.has(ext) && ent.name !== skillFilename) {
-            let sha256 = '';
-            try {
-                sha256 = createHash('sha256').update(readFileSync(full)).digest('hex');
-            }
-            catch {
-                continue;
-            }
-            results.push(skillMetaRecord(full, size, sha256, ver));
-            budget.files += 1;
-            continue;
-        }
-        if (isSecretName(ent.name)) {
-            results.push(skillMetaRecord(full, size, '', ver));
-            budget.files += 1;
-            continue;
-        }
-        const content = readMarkdownFile(full);
-        if (content === null)
-            continue;
-        results.push({ file_type: 'claude_skill', file_path: full, raw_content: { content, source: 'file', ...(ver ? { version: ver } : {}) } });
-        budget.files += 1;
-        budget.bytes += Buffer.byteLength(content);
+        addSkillRecord(skillFileRecord(full, ent.name, constants), results, budget);
     }
 }
+function addSkillRecord(record, results, budget) {
+    if (!record)
+        return;
+    results.push(record);
+    budget.files += 1;
+    const content = record.raw_content.content;
+    if (typeof content === 'string')
+        budget.bytes += Buffer.byteLength(content);
+}
 function collectSkillFiles(skillsDir, results, constants) {
     const skillFilename = getPluginSkillFilename(constants);
     try {
@@ -228,4 +243,4 @@ function collectConfigFilesFromInstalledPlugins(constants) {
     }
     return results;
 }
-export { collectConfigFilesFromInstalledPlugins, collectPluginCacheMcpFiles };
+export { collectConfigFilesFromInstalledPlugins, collectPluginCacheMcpFiles, isSecretName };

package/dist/log_config_files/runtime/client_event_reporter.js

@@ -20,6 +20,7 @@ import { createSignature } from '../sender/signing.js';
 import { readStoredAuthKey } from '../auth/auth_key_store.js';
 import { resolveHardwareUuid } from './hardware_uuid.js';
 import { buildLogMetadataObject } from './log_metadata.js';
+import { SCRUBBER_VERSION, scrubFields } from '../../pii_scrub.js';
 const CLIENT_EVENT_PATH = '/endpoint_security/api/client-event/';
 const SEND_TIMEOUT_MS = 4000;
 const BUFFER_BASENAME = 'client_events.jsonl';
@@ -198,6 +199,16 @@ function claimBufferedEvents() {
         return [];
     }
 }
+/**
+ * An event as it is sent: its free-text fields (a failure's log, a command line, an error and its
+ * stack) scrubbed like tool-call content, and the scrubber's version in its metadata. Buffered
+ * events are scrubbed here too, on their way out.
+ */
+function forWire(event) {
+    const scrubbed = scrubFields(event, ['command', 'message', 'detail', 'log_text']);
+    const metadata = (event.metadata ?? {});
+    return { ...scrubbed, metadata: { ...metadata, scrubber_version: SCRUBBER_VERSION } };
+}
 async function postEvents(events) {
     if (events.length === 0)
         return true;
@@ -210,7 +221,7 @@ async function postEvents(events) {
     }
     const base = loadEndpointBase().replace(/\/+$/, '');
     const url = `${base}${CLIENT_EVENT_PATH}`;
-    const signingPayload = { hardware_uuid: hardwareUuid, events };
+    const signingPayload = { hardware_uuid: hardwareUuid, events: events.map(forWire) };
     let signature = '';
     try {
         const authKey = readStoredAuthKey();

package/dist/log_config_files/runtime/compliance_session_log.js

@@ -3,6 +3,7 @@ import path from 'node:path';
 import { homedir } from 'node:os';
 import { OPTIMUSLABS_LOGS_REL, LOG_GROUP_COMPLIANCE } from '../../bootstrap_constants.js';
 import { buildLogMetadataBlock } from './log_metadata.js';
+import { SCRUBBER_VERSION, scrubText } from '../../pii_scrub.js';
 const COMPLIANCE_SUBDIR = LOG_GROUP_COMPLIANCE;
 const TIER_NOOP = 'noop';
 const TIER_SUCCESS = 'success';
@@ -318,19 +319,27 @@ function appendLineToSessionLogFile(logPath, message) {
 /**
  * Upload full session log to the server (success and failures tiers only, first finalize only).
  */
-export async function uploadComplianceSessionLogFromFinalize(result) {
+/** The session log to upload, or null when this finalize does not upload one (and why is logged). */
+function sessionLogToUpload(result) {
     if (result.tier !== TIER_SUCCESS && result.tier !== TIER_FAILURES)
-        return;
+        return null;
     if (!result.moved)
-        return;
+        return null;
     const logText = readComplianceSessionLog(result.logPath);
     if (!logText.trim())
-        return;
+        return null;
     const logBytes = Buffer.byteLength(logText, 'utf8');
     if (logBytes > MAX_SESSION_LOG_UPLOAD_BYTES) {
         appendLineToSessionLogFile(result.logPath, `compliance_session_upload: skipped (${logBytes} bytes exceeds ${MAX_SESSION_LOG_UPLOAD_BYTES})`);
-        return;
+        return null;
     }
+    return { logText, logBytes };
+}
+export async function uploadComplianceSessionLogFromFinalize(result) {
+    const toUpload = sessionLogToUpload(result);
+    if (!toUpload)
+        return;
+    const { logText, logBytes } = toUpload;
     const { readStoredAuthKey } = await import('../auth/auth_key_store.js');
     const { tryResolveHardwareUuid } = await import('./hardware_uuid.js');
     const { loadEndpointBase } = await import('../sender/endpoint_config.js');
@@ -349,10 +358,11 @@ export async function uploadComplianceSessionLogFromFinalize(result) {
         hardware_uuid: hardwareUuid,
         outcome,
         session_filename: sessionFilename,
-        log_text: logText,
+        // Signed as scrubbed; the version sits outside the signed fields.
+        log_text: scrubText(logText),
     };
     const signature = createSignature(signingPayload, authKey.key);
-    const body = JSON.stringify({ ...signingPayload, signature });
+    const body = JSON.stringify({ ...signingPayload, scrubber_version: SCRUBBER_VERSION, signature });
     const url = buildApiUrl(loadEndpointBase(), '/endpoint_security/api/remediation-activity-log/');
     try {
         const { statusCode } = await executeBody(url, 'POST', body, 30_000);

package/dist/log_config_files/runtime/prompt-collection-policy.js

@@ -30,23 +30,59 @@ function collectPromptsFromConfig(cfg) {
 export function readCollectPrompts() {
     return collectPromptsFromConfig(readOrgConfig());
 }
-export function persistCollectPrompts(value) {
-    if (typeof value !== "boolean")
-        return;
+/** The org's fingerprint key: hex, at least 128 bits. Keys the prompt hash and secret fingerprints. */
+const FINGERPRINT_KEY = /^(?:[0-9a-f]{2}){16,}$/i;
+/**
+ * The org key the backend sends in the startup and inventory responses (`fingerprint_key`),
+ * or undefined until it has arrived: the prompt hash stays plain SHA-256 and secrets get no
+ * fingerprint until then.
+ */
+export function readFingerprintKey() {
+    const key = readOrgConfig().fingerprint_key;
+    return typeof key === "string" && FINGERPRINT_KEY.test(key) ? key : undefined;
+}
+function writeOrgConfig(update) {
     const filePath = orgConfigPath();
     try {
         fs.mkdirSync(path.dirname(filePath), { recursive: true });
-        const next = { ...readOrgConfig(), collect_prompts: value };
-        delete next.hash_tool_call_prompts;
-        fs.writeFileSync(filePath, `${JSON.stringify(next)}\n`, { encoding: "utf8", mode: 0o600 });
+        fs.writeFileSync(filePath, `${JSON.stringify(update(readOrgConfig()))}\n`, { encoding: "utf8", mode: 0o600 });
     }
     catch {
         // Best-effort: next heartbeat can retry.
     }
 }
+export function persistCollectPrompts(value) {
+    if (typeof value !== "boolean")
+        return;
+    writeOrgConfig((current) => {
+        const next = { ...current, collect_prompts: value };
+        delete next.hash_tool_call_prompts;
+        return next;
+    });
+}
+function persistFingerprintKey(value) {
+    if (typeof value !== "string" || !FINGERPRINT_KEY.test(value) || value === readFingerprintKey())
+        return;
+    writeOrgConfig((current) => ({ ...current, fingerprint_key: value }));
+}
+/**
+ * Whether the organization scrubs what endpoints send (OPT-942), read by `@optimuslabs/pii-scrub`
+ * from this file: only an explicit `false` switches scrubbing off.
+ */
+function persistScrubPii(value) {
+    if (typeof value !== "boolean" || readOrgConfig().scrub_pii === value)
+        return;
+    writeOrgConfig((current) => ({ ...current, scrub_pii: value }));
+}
+/**
+ * Store the org options a startup or inventory response carries: prompt collection, the org key
+ * and whether to scrub.
+ */
 export function persistCollectPromptsFromResponse(body) {
     if (!body || typeof body !== "object")
         return;
+    persistFingerprintKey(body.fingerprint_key);
+    persistScrubPii(body.scrub_pii);
     if (typeof body.collect_prompts === "boolean") {
         persistCollectPrompts(body.collect_prompts);
         return;

package/dist/log_config_files/runtime/remediation_sync.js

@@ -16,6 +16,8 @@ import { clearRemediationApplyQuarantine, readRemediationApplyTrackingFile, writ
 import { CURSOR_SCALAR_ITEMTABLE_FIELDS, buildVscdbPostApplyRawContent, persistVscdbComposerContractFromPatternsResponse, } from '../readers/vscdb_reader.js';
 import { sendConfigFile } from '../sender/batch_sender.js';
 import { parseWorktreeRootFromPath } from './worktree_scanner.js';
+import { SCRUBBER_VERSION, containsPlaceholder, scrubValue } from '../../pii_scrub.js';
+import { readFingerprintKey } from './prompt-collection-policy.js';
 import { reportAbsentWorktrees } from './worktree_absent.js';
 import { buildApiUrl, getFileCollectionPatterns } from '../../endpoint_client/registry_api.js';
 import { resolveRemediationConfigPath } from './remediation_config_path.js';
@@ -69,8 +71,21 @@ function readInstructions() {
     const { remediations } = readRemediationInstructionsFile();
     return { remediations: remediations };
 }
+/**
+ * Instructions whose fix would write a scrubbed placeholder are never stored, so never applied.
+ * The server holds only the scrubbed copy of a config; writing a placeholder back would replace
+ * the user's real key or token with `[OL_REDACTED:...]`.
+ */
+function withoutScrubbedFixes(remediations) {
+    return remediations.filter((inst) => {
+        if (!containsPlaceholder(remediationFixSpec(inst)?.checks ?? []))
+            return true;
+        hookRunLog(`remediation_instructions_skipped: uuid=${inst.uuid} reason=fix carries a scrubbed placeholder`);
+        return false;
+    });
+}
 function writeInstructions(file) {
-    writeRemediationInstructionsFile(file);
+    writeRemediationInstructionsFile({ ...file, remediations: withoutScrubbedFixes(file.remediations) });
 }
 /**
  * Merge persisted rows with API overlay; GET manifest for enforced UUIDs still missing rows.
@@ -1577,12 +1592,12 @@ export function reportAutofixApplied(remediationUuid, result, details) {
         payload.failure_reason = details.failure_reason.slice(0, 2000);
     if (details?.consecutive_failures != null)
         payload.consecutive_failures = details.consecutive_failures;
-    const bodyPayload = { ...payload, signature: '' };
+    const bodyPayload = { ...payload, scrubber_version: SCRUBBER_VERSION, signature: '' };
     if (details?.config_snapshot_after && typeof details.config_snapshot_after === 'object') {
-        bodyPayload.config_snapshot_after = details.config_snapshot_after;
+        bodyPayload.config_snapshot_after = scrubValue(details.config_snapshot_after, { fingerprintKey: readFingerprintKey() });
     }
     if (details?.config_snapshot_before && typeof details.config_snapshot_before === 'object') {
-        bodyPayload.config_snapshot_before = details.config_snapshot_before;
+        bodyPayload.config_snapshot_before = scrubValue(details.config_snapshot_before, { fingerprintKey: readFingerprintKey() });
     }
     const signature = createSignature(payload, authKey.key);
     const body = JSON.stringify({ ...bodyPayload, signature });

package/dist/log_config_files/runtime/workspace_repo.js

@@ -3,9 +3,10 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { hookRunLog } from './hook_logger.js';
+import { scrubText } from '../../pii_scrub.js';
 const GIT_TIMEOUT_MS = 3000;
 const MAX_WALK_UP = 25;
-function gitRemoteInDir(dir) {
+function readGitRemote(dir) {
     try {
         return execFileSync('git', ['remote', '-v'], {
             cwd: dir,
@@ -18,6 +19,13 @@ function gitRemoteInDir(dir) {
         return '';
     }
 }
+/**
+ * `git remote -v` in `dir`. A remote can embed a token (`https://user:token@host/owner/repo`), so
+ * it is scrubbed here, where every remote this package reports comes from; host and path stay.
+ */
+function gitRemoteInDir(dir) {
+    return scrubText(readGitRemote(dir));
+}
 function gitToplevelFromDir(dir) {
     try {
         return execFileSync('git', ['rev-parse', '--show-toplevel'], {
@@ -51,7 +59,7 @@ export function resolveWorkspaceRepoFromEnv() {
     ]) {
         const value = (candidate || '').trim();
         if (value)
-            return value;
+            return scrubText(value);
     }
     return '';
 }

package/dist/log_config_files/sender/batch_sender.js

@@ -4,7 +4,8 @@ import { loadEndpointBase } from './endpoint_config.js';
 import { hookRunLog } from '../runtime/hook_logger.js';
 import { canonicalCursorUserStateVscdbPath } from '../runtime/remediation_config_path.js';
 import { resolveWorkspaceRepoFromEnv } from '../runtime/workspace_repo.js';
-import { persistCollectPromptsFromResponse } from '../runtime/prompt-collection-policy.js';
+import { persistCollectPromptsFromResponse, readFingerprintKey } from '../runtime/prompt-collection-policy.js';
+import { SCRUBBER_VERSION, scrubText, scrubValue } from '../../pii_scrub.js';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -84,7 +85,8 @@ function buildChunkBody(chunk, hardwareUuid, authKey, hookRequestId, metadata) {
         const item = {
             file_type: c.file_type,
             file_path: canonicalCursorUserStateVscdbPath(c.file_path),
-            raw_content: c.raw_content,
+            raw_content: scrubValue(c.raw_content, { fingerprintKey: readFingerprintKey() }),
+            scrubber_version: SCRUBBER_VERSION,
         };
         if (c.symlink_info !== undefined)
             item.symlink_info = c.symlink_info;
@@ -227,11 +229,11 @@ async function sendConfigFile(configFile, hardwareUuid, authKey, repoIdentifier)
     const endpoint = loadEndpointBase();
     const apiUrl = `${resolveApiBase(endpoint)}/endpoint_security/log-config-file/`;
     const uploadPath = canonicalCursorUserStateVscdbPath(configFile.file_path);
-    const payload = { hardware_uuid: hardwareUuid, file_type: configFile.file_type, file_path: uploadPath, raw_content: configFile.raw_content };
+    const payload = { hardware_uuid: hardwareUuid, file_type: configFile.file_type, file_path: uploadPath, raw_content: scrubValue(configFile.raw_content, { fingerprintKey: readFingerprintKey() }) };
     if (configFile.symlink_info !== undefined)
         payload.symlink_info = configFile.symlink_info;
     const signature = createSignature(payload, authKey.key);
-    const body = { ...payload, signature, key_id: authKey.key_id || '', metadata: { org_identifier: process.env.GITHUB_ORG || process.env.GH_ORG || '', organization_uuid: readOrganizationUuid(), repo_identifier: repoIdentifier ?? resolveWorkspaceRepoFromEnv() } };
+    const body = { ...payload, signature, key_id: authKey.key_id || '', metadata: { org_identifier: process.env.GITHUB_ORG || process.env.GH_ORG || '', organization_uuid: readOrganizationUuid(), repo_identifier: repoIdentifier ?? resolveWorkspaceRepoFromEnv(), scrubber_version: SCRUBBER_VERSION } };
     try {
         const response = await postStartupPayload(apiUrl, body);
         if (response.status !== 'accepted') {
@@ -273,8 +275,10 @@ async function sendHookRequestUpdateManifest(hardwareUuid, authKey, hookRequestI
     const payload = { hardware_uuid: hardwareUuid, hook_request_id: hookRequestId, manifest: manifestNormalized };
     const signature = createSignature(payload, authKey.key);
     const body = { ...payload, signature, key_id: authKey.key_id || '' };
+    // The hook's log holds its whole environment: scrubbed, outside the signed manifest.
     if (hookLog)
-        body.hook_log = hookLog;
+        body.hook_log = scrubText(hookLog);
+    body.scrubber_version = SCRUBBER_VERSION;
     try {
         const data = (await patchPayload(apiUrl, body));
         if (data.status === 'accepted') {

package/dist/log_uuid/startup_sender.js

@@ -4,6 +4,7 @@ import { flushBufferedClientEvents, getStoryId, reportFunctionalFailureAwait, re
 import { resolveHardwareUuid } from './hardware_uuid.js';
 import { writeAuthKey, readStoredAuthKey, loadEndpointBase, buildStartupEndpointUrl } from './auth_key_store.js';
 import { resolveUserProfile } from './user_profile.js';
+import { SCRUBBER_VERSION } from '../pii_scrub.js';
 import { resolveWorkspaceRepo } from '../log_config_files/runtime/workspace_repo.js';
 import { collectInstalledHookHashes } from './installed_hook_hashes.js';
 import { persistCollectPromptsFromResponse } from '../log_config_files/runtime/prompt-collection-policy.js';
@@ -62,6 +63,7 @@ const getMetadata = () => ({
     user_profile: { ...resolveUserProfile() },
     // Every installed agent's hooks from disk, not just the launching agent's (OPTIMUS_HOOK_MANIFEST).
     hook_manifest: { ...parseHookManifest(), ...collectInstalledHookHashes() },
+    scrubber_version: SCRUBBER_VERSION,
 });
 function buildRequestBody(hardwareUuid, timestamp) {
     const metadata = getMetadata();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@optimuslabs/harness-map-staging",
-  "version": "1.5.45",
+  "version": "1.5.46",
   "description": "CLI helpers for logging hardware UUIDs and posting startup payloads to Optimus Security.",
   "type": "module",
   "bin": {
@@ -19,7 +19,7 @@
     "dev": "ts-node src/cli.ts",
     "lint": "eslint \"src/**/*.ts\"",
     "prepare": "npm run build",
-    "pretest": "npm run build",
+    "pretest": "npm run build --prefix ../pii-scrub && npm run build",
     "test": "vitest run",
     "test:watch": "vitest"
   },
@@ -56,6 +56,7 @@
     "vitest": "^4.1.12"
   },
   "dependencies": {
+    "@optimuslabs/pii-scrub-staging": "^0.1.0",
     "@optimuslabs/tofu-staging": "^0.1.18",
     "axios": "^1.20.0",
     "canonicalize": "^2.1.0",