@orcareplay/core 0.2.3 → 0.2.5-main.g05c6ca2

package/dist/fetch.d.ts

@@ -0,0 +1,38 @@
+/**
+ * fetch with the DESTINATION PINNED — a redirect is a hard failure, never a hand-off.
+ *
+ * THE ORIGIN CHECK VALIDATES THE URL WE PASS, NOT THE URL THE REQUEST REACHES (orcacode-review).
+ * `resolveGateway` decides whether the key may go to this host, and then `fetch` was free to follow
+ * a `Location` anywhere. undici strips `authorization` across origins but NOT `x-api-key`, and
+ * gatewayHeaders sets both to the same key — so one header from whoever answers for the gateway
+ * carried the replay-scoped credential to a host it was never issued for, defeating the promise the
+ * README makes in writing: "Never a key to a host it was not set up for."
+ *
+ * Push had a second failure on top: a 301/302/303 is re-issued as a GET with no body, so the
+ * target's 200 satisfied `res.ok` and the CLI printed `push.done` for a run that went nowhere. A
+ * 307/308 instead failed with an opaque "fetch failed", because undici cannot replay a detached
+ * body — so a legitimately redirecting gateway could not be talked to either.
+ *
+ * `manual` rather than `error`: Node resolves it with the real status and Location, so the refusal
+ * can NAME the destination. `error` rejects with a bare TypeError whose only distinguishing mark is
+ * an undici-internal cause string ("unexpected redirect"), which a genuine connection failure
+ * ("bad port") is indistinguishable from without matching on that string.
+ *
+ * Following a same-origin redirect would be safe and is deliberately not implemented: no gateway
+ * this CLI talks to issues one, and an unused branch that forwards credentials is the wrong thing
+ * to carry.
+ *
+ * IT LIVES IN core, NOT IN THE PACKAGE THAT FIRST NEEDED IT (orcacode-review, twice).
+ *
+ * The first version was local to the CLI's sync.ts, so push and pull were pinned and `probeModels`
+ * — the third request carrying the same header pair — was not. The second lived beside
+ * gatewayHeaders in the CLI's config.ts, which fixed that and left the RECORDING PROXY out: it is
+ * handed the very same credential as `upstreamHeaders` and attaches it to both of its live call
+ * sites, on the path every `orca record` / `replay --loose` / `compare` / fork takes.
+ *
+ * Both times the pin sat in the package that noticed the problem rather than in the one every
+ * carrier of the credential depends on. core is that package, so this is the last place it can
+ * move to.
+ */
+export declare function fetchPinned(target: string, init: RequestInit): Promise<Response>;
+//# sourceMappingURL=fetch.d.ts.map

package/dist/fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../src/fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAWtF"}

package/dist/fetch.js

@@ -0,0 +1,47 @@
+/**
+ * fetch with the DESTINATION PINNED — a redirect is a hard failure, never a hand-off.
+ *
+ * THE ORIGIN CHECK VALIDATES THE URL WE PASS, NOT THE URL THE REQUEST REACHES (orcacode-review).
+ * `resolveGateway` decides whether the key may go to this host, and then `fetch` was free to follow
+ * a `Location` anywhere. undici strips `authorization` across origins but NOT `x-api-key`, and
+ * gatewayHeaders sets both to the same key — so one header from whoever answers for the gateway
+ * carried the replay-scoped credential to a host it was never issued for, defeating the promise the
+ * README makes in writing: "Never a key to a host it was not set up for."
+ *
+ * Push had a second failure on top: a 301/302/303 is re-issued as a GET with no body, so the
+ * target's 200 satisfied `res.ok` and the CLI printed `push.done` for a run that went nowhere. A
+ * 307/308 instead failed with an opaque "fetch failed", because undici cannot replay a detached
+ * body — so a legitimately redirecting gateway could not be talked to either.
+ *
+ * `manual` rather than `error`: Node resolves it with the real status and Location, so the refusal
+ * can NAME the destination. `error` rejects with a bare TypeError whose only distinguishing mark is
+ * an undici-internal cause string ("unexpected redirect"), which a genuine connection failure
+ * ("bad port") is indistinguishable from without matching on that string.
+ *
+ * Following a same-origin redirect would be safe and is deliberately not implemented: no gateway
+ * this CLI talks to issues one, and an unused branch that forwards credentials is the wrong thing
+ * to carry.
+ *
+ * IT LIVES IN core, NOT IN THE PACKAGE THAT FIRST NEEDED IT (orcacode-review, twice).
+ *
+ * The first version was local to the CLI's sync.ts, so push and pull were pinned and `probeModels`
+ * — the third request carrying the same header pair — was not. The second lived beside
+ * gatewayHeaders in the CLI's config.ts, which fixed that and left the RECORDING PROXY out: it is
+ * handed the very same credential as `upstreamHeaders` and attaches it to both of its live call
+ * sites, on the path every `orca record` / `replay --loose` / `compare` / fork takes.
+ *
+ * Both times the pin sat in the package that noticed the problem rather than in the one every
+ * carrier of the credential depends on. core is that package, so this is the last place it can
+ * move to.
+ */
+export async function fetchPinned(target, init) {
+    const res = await fetch(target, { ...init, redirect: 'manual' });
+    if (res.status >= 300 && res.status < 400) {
+        const to = res.headers.get('location') ?? '(no Location header)';
+        throw new Error(`${target} answered ${res.status} redirecting to ${to}. orca does not follow it: your key is ` +
+            `attached to the host you named, and following would hand it to whatever answers there. ` +
+            `Point --gateway (or ORCA_GATEWAY_URL) at the final address instead.`);
+    }
+    return res;
+}
+//# sourceMappingURL=fetch.js.map

package/dist/fetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch.js","sourceRoot":"","sources":["../src/fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAc,EAAE,IAAiB;IACjE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACjE,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC1C,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,sBAAsB,CAAC;QACjE,MAAM,IAAI,KAAK,CACb,GAAG,MAAM,aAAa,GAAG,CAAC,MAAM,mBAAmB,EAAE,yCAAyC;YAC5F,yFAAyF;YACzF,qEAAqE,CACxE,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 export * from './blobs.js';
+export * from './fetch.js';
 export * from './graph.js';
 export * from './paths.js';
 export * from './reader.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC"}

package/dist/index.js

@@ -1,4 +1,5 @@
 export * from './blobs.js';
+export * from './fetch.js';
 export * from './graph.js';
 export * from './paths.js';
 export * from './reader.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC"}

package/dist/redaction.d.ts

@@ -1,6 +1,6 @@
 import type { RedactionRecord } from '@orcareplay/schema';
 /** Bump when a rule is added or changed, so old traces stay interpretable. */
-export declare const REDACTION_POLICY_VERSION = 3;
+export declare const REDACTION_POLICY_VERSION = 4;
 /** Environment capture is allowlist-only (spec §5). Everything else is denied. */
 export declare const DEFAULT_ENV_ALLOWLIST: string[];
 /**

package/dist/redaction.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../src/redaction.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE1D,8EAA8E;AAK9E,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAE1C,kFAAkF;AAClF,eAAO,MAAM,qBAAqB,UAUjC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,UAQhC,CAAC;AAEF,wFAAwF;AACxF,eAAO,MAAM,qBAAqB,UAAiB,CAAC;AAEpD,2EAA2E;AAC3E,eAAO,MAAM,YAAY,UAAsD,CAAC;AAOhF;;;GAGG;AACH;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,iBAAiB,CAAC;AAiGjD,MAAM,WAAW,gBAAgB;IAC/B,uFAAuF;IACvF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,2FAA2F;IAC3F,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,eAAe,CAAC,CAAC;IAChC,KAAK,EAAE,CAAC,CAAC;IACT,IAAI,EAAE,eAAe,EAAE,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,qBAAa,QAAQ;;gBAKP,IAAI,GAAE,gBAAqB;IAKvC,YAAY,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC;IAOlE,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAcvF,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAY1E,uFAAuF;IACvF,OAAO,IAAI,eAAe,EAAE;IAI5B,UAAU,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;CAsErC"}
+{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../src/redaction.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE1D,8EAA8E;AAQ9E,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAE1C,kFAAkF;AAClF,eAAO,MAAM,qBAAqB,UAUjC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,UAQhC,CAAC;AAEF,wFAAwF;AACxF,eAAO,MAAM,qBAAqB,UAAiB,CAAC;AAEpD,2EAA2E;AAC3E,eAAO,MAAM,YAAY,UAAsD,CAAC;AAOhF;;;GAGG;AACH;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,iBAAiB,CAAC;AAqdjD,MAAM,WAAW,gBAAgB;IAC/B,uFAAuF;IACvF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,2FAA2F;IAC3F,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,eAAe,CAAC,CAAC;IAChC,KAAK,EAAE,CAAC,CAAC;IACT,IAAI,EAAE,eAAe,EAAE,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,qBAAa,QAAQ;;gBAKP,IAAI,GAAE,gBAAqB;IAKvC,YAAY,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC;IAOlE,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAcvF,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAY1E,uFAAuF;IACvF,OAAO,IAAI,eAAe,EAAE;IAI5B,UAAU,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;CAsFrC"}

package/dist/redaction.js

@@ -1,10 +1,14 @@
 import { createHash, randomBytes } from 'node:crypto';
+import { inflateSync } from 'node:zlib';
 /** Bump when a rule is added or changed, so old traces stay interpretable. */
 // Bumped when a rule's *name* or pattern changes, because both reach the trace: the placeholder is
 // `<secret:<kind>:<hash>>`, and a reader comparing two traces needs to know the policy differed
 // rather than the content. v2 renamed `openai_key` to `sk_api_key`; v3 stopped the entropy sweep
-// eating protocol identifiers (`id`, `tool_use_id`, `tool_call_id`).
-export const REDACTION_POLICY_VERSION = 3;
+// eating protocol identifiers (`id`, `tool_use_id`, `tool_call_id`); v4 stopped it eating whole
+// PNGs, which is a change in what reaches the trace for exactly the same reason — the same body
+// recorded under v3 and v4 differs, and a reader has to be able to tell that from the content
+// differing.
+export const REDACTION_POLICY_VERSION = 4;
 /** Environment capture is allowlist-only (spec §5). Everything else is denied. */
 export const DEFAULT_ENV_ALLOWLIST = [
     'TERM',
@@ -68,6 +72,358 @@ const RULES = [
     { kind: 'slack_token', pattern: /xox[baprs]-[A-Za-z0-9-]{10,}/g },
     { kind: 'google_api_key', pattern: /AIza[0-9A-Za-z_-]{35}/g },
 ];
+/**
+ * A base64 run that decodes to a whole PNG, wherever it sits in the value.
+ *
+ * The exemption is granted on the payload, not on the syntax around it or the label in front of
+ * it, because every argument for it is an argument about *pixels* — and every draft that granted
+ * it on something a caller writes was a hole:
+ *
+ *   - the media type, so `data:image/png;base64,<credential>` bought one
+ *   - the signature, so `iVBORw0KGgo<credential>` bought one
+ *   - the framing, so `signature + IHDR + IDAT{<credential>} + IEND` with self-consistent lengths
+ *     bought one
+ *   - a *valid* container, so a 1×1 image with the credential in a `tEXt` chunk bought one, and a
+ *     real screenshot with the credential appended inside `IDAT` past the end of the zlib stream
+ *     bought one, and flipping IHDR's interlace byte skipped the size check altogether
+ *
+ * So the rule is now the narrowest one that still serves the case this exists for: **every chunk
+ * has to be a chunk whose bytes the exemption can account for.** Structure (`IHDR`, `IEND`), the
+ * pixel stream (`IDAT`), and a short list of fixed-size ancillary chunks each held to its spec
+ * length, with every chunk's CRC checked so its four CRC bytes are not four more of the caller's.
+ * Anything else — `tEXt`, `iTXt`, `zTXt`, `iCCP`, `cHRM`, `PLTE`, an unknown type — is a place a
+ * caller can put bytes of their choosing, so its presence costs the whole run its exemption and the
+ * sweep runs as it always did. Indexed PNGs therefore have no exemption at all, since they cannot
+ * be valid without a palette.
+ *
+ * The pixel stream is checked, not assumed: the concatenated `IDAT` has to inflate, to consume
+ * every byte of itself doing so (`inflateSync` stops at the end of the zlib stream and ignores
+ * whatever follows, which is where a credential went), and to yield exactly the byte count `IHDR`
+ * describes — including the seven-pass sum when the image is interlaced.
+ *
+ * Measured, on a 1 MB PNG: the chunk walk costs 0.2 ms and the inflate 1.2 ms, against the 55 ms
+ * the base64 decode already costs.
+ *
+ * **PNG only.** JPEG was here and is gone. Its ancillary segments (`COM`, `APPn`) carry arbitrary
+ * bytes, its `DQT`/`DHT` payloads are arbitrary within a shape, and its entropy-coded scan cannot
+ * be told from a credential without a full Huffman decode — so a JPEG exemption can only ever mean
+ * "a marker chain that closes", which is framing, which is what this file kept getting wrong. GIF,
+ * BMP, WebP and AVIF went earlier for the same reason. A format with no validator does not get an
+ * exemption; it gets the sweep, as it did before any of this. The cost is real and is the right way
+ * round: an agent that sends JPEG screenshots still gets them shredded.
+ *
+ * What this still does not claim: a secret written into the pixels themselves is not detectable
+ * here, and no content rule could be — a stored-mode deflate block whose "pixels" are a credential
+ * inflates to the declared size like any other. The line is that the payload has to be a picture;
+ * a picture cannot be proved innocent.
+ */
+/**
+ * Whether `code` is a base64 alphabet character.
+ *
+ * A run used to be found with `/(?:[A-Za-z0-9+/]|\\[/\\])+={0,2}/g`, and a backtracking `+` over a
+ * multi-megabyte run overflows V8's regexp stack: measured, `redactString` threw
+ * `RangeError: Maximum call stack size exceeded` from `RegExpStringIterator.next` at 8 MB of
+ * contiguous base64 — a ~6 MB screenshot, which is the thing this exemption exists to protect. The
+ * entropy sweep's own `TOKEN` never had the problem because `+` and `/` are not in its class, so
+ * real base64 reaches it as thousands of short matches; this prefilter was the first pattern to run
+ * a quantifier across a whole payload, and the same input that the pre-change code walked without
+ * complaint at 16 MB threw here. So runs are found by hand, in one left-to-right pass.
+ */
+function isBase64Char(code) {
+    return ((code >= 0x41 && code <= 0x5a) || // A-Z
+        (code >= 0x61 && code <= 0x7a) || // a-z
+        (code >= 0x30 && code <= 0x39) || // 0-9
+        code === 0x2b || // +
+        code === 0x2f // /
+    );
+}
+/** Shortest run worth decoding: below this it cannot hold a header and any pixels. */
+const MIN_RASTER_CHARS = 40;
+/**
+ * The largest pixel stream worth inflating, as a matter of policy rather than of format.
+ *
+ * An 8K screenshot at four channels is about 127 MiB of raw pixels, so 256 MiB is roughly double the
+ * largest thing anyone is plausibly recording. An IHDR that declares more than this is refused
+ * before any memory is committed — otherwise the header itself, which is the caller's to write,
+ * would set how much the redactor allocates.
+ */
+const MAX_RASTER_RAW_BYTES = 1 << 28;
+const PNG_SIGNATURE = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
+/**
+ * Ancillary chunks whose length the spec fixes, mapped to that length.
+ *
+ * A caller cannot choose how many bytes these hold, and every one of them is shorter than
+ * `MIN_ENTROPY_LENGTH`, so none can carry a run the sweep would have redacted. That is the whole
+ * admission criterion — not that the chunk is harmless, but that exempting it cannot hide anything
+ * the sweep was protecting. Every variable-length chunk is therefore absent, and so is `cHRM`:
+ * fixed at 32 bytes, but 32 bytes is long enough to matter.
+ *
+ * The lengths here are what the caller gets, because the CRCs are checked: four more bytes per
+ * chunk that would otherwise be theirs to fill. The largest of these is `pHYs` at nine, so the
+ * longest run of chosen bytes any admitted chunk can contribute is twelve base64 characters,
+ * against the sweep's threshold of twenty.
+ */
+const PNG_FIXED_ANCILLARY = {
+    gAMA: 4,
+    sRGB: 1,
+    pHYs: 9,
+    tIME: 7,
+    sBIT: 4,
+    bKGD: 6,
+};
+/**
+ * Bytes per pixel for each PNG colour type; an unlisted type is not one this exemption accepts.
+ *
+ * Indexed (3) is absent, which means indexed PNGs are swept like any other unvalidated payload. It
+ * was here, on the argument that an indexed image's palette *is* its pixels — but that argument
+ * does not survive: `PLTE` is up to 768 uncompressed caller-chosen bytes sitting verbatim in the
+ * trace, its entries need not be referenced by any pixel, and nothing about it is checked beyond a
+ * length that the bit depth alone bounds. `IDAT` is not analogous, because it has to inflate to
+ * exactly the size the header declares. Admitting 768 free bytes while rejecting `cHRM` at 32 as
+ * "long enough to matter" was the file contradicting its own admission criterion.
+ */
+const PNG_CHANNELS = { 0: 1, 2: 3, 4: 2, 6: 4 };
+/** The bit depths each colour type allows. A pairing outside this is not an image a decoder reads. */
+const PNG_DEPTHS = {
+    0: [1, 2, 4, 8, 16],
+    2: [8, 16],
+    4: [8, 16],
+    6: [8, 16],
+};
+/** Adam7: `[xOffset, yOffset, xStep, yStep]` for each of the seven passes. */
+const ADAM7 = [
+    [0, 0, 8, 8],
+    [4, 0, 8, 8],
+    [0, 4, 4, 8],
+    [2, 0, 4, 4],
+    [0, 2, 2, 4],
+    [1, 0, 2, 2],
+    [0, 1, 1, 2],
+];
+/**
+ * The exact length of the inflated pixel stream for these image parameters.
+ *
+ * Each scanline is a filter byte plus its packed samples, and an interlaced image is seven smaller
+ * images by the same rule — a pass with no rows or no columns contributes nothing at all, which is
+ * what the guard is for rather than tidiness. Skipping this for interlaced images was a hole: it
+ * let one IHDR byte buy the exemption for an IDAT holding no pixels.
+ */
+function pngRawLength(width, height, channels, depth, interlaced) {
+    const rows = (w, h) => w <= 0 || h <= 0 ? 0 : h * (1 + Math.ceil((w * channels * depth) / 8));
+    if (!interlaced)
+        return rows(width, height);
+    let total = 0;
+    for (const [x0, y0, dx, dy] of ADAM7) {
+        total += rows(Math.ceil((width - x0) / dx), Math.ceil((height - y0) / dy));
+    }
+    return total;
+}
+/** The CRC-32 lookup table, built once: `0xedb88320` is the reversed polynomial PNG uses. */
+const CRC_TABLE = (() => {
+    const table = new Uint32Array(256);
+    for (let n = 0; n < 256; n += 1) {
+        let c = n;
+        for (let k = 0; k < 8; k += 1)
+            c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
+        table[n] = c >>> 0;
+    }
+    return table;
+})();
+/**
+ * CRC-32 of `data`.
+ *
+ * Not `zlib.crc32`, which arrived after the oldest runtime this repo supports: `packages/cli`
+ * declares `>=20.0.0` and `doctor` enforces major 20, while `zlib.crc32` is newer than that. A
+ * named import of it would be `undefined` on such a runtime, and the first screenshot would take
+ * the recording down with it — `intercept.ts` looks `zstdDecompressSync` up dynamically for
+ * exactly this reason, and `tls-intercept.test.ts` records what the named import did instead.
+ *
+ * Computing it here rather than looking it up dynamically leaves one implementation, always
+ * exercised, instead of a fallback branch that only some runtimes ever run. It costs 0.75 ms on a
+ * 381 KB PNG against `zlib.crc32`'s 0.10 ms, which is nothing beside the 55 ms that PNG's base64
+ * decode already costs. Every "a real PNG stays exempt" case in the tests builds its CRCs with
+ * `zlib.crc32`, so those tests pass only while this agrees with Node's.
+ */
+function crc32Of(data) {
+    let c = 0xffffffff;
+    for (let i = 0; i < data.length; i += 1)
+        c = (c >>> 8) ^ CRC_TABLE[(c ^ data[i]) & 0xff];
+    return (c ^ 0xffffffff) >>> 0;
+}
+/**
+ * Whether the chunk beginning at `at` carries the CRC its own bytes imply.
+ *
+ * A caller who can set a length can set a CRC too, so this proves nothing about intent. What it
+ * does is stop the four CRC bytes of every admitted chunk being four bytes of the caller's
+ * choosing — which is the difference between "`pHYs` contributes nine chosen bytes" and "thirteen",
+ * and the whole fixed-length argument is a counting argument.
+ *
+ * The CRC covers the type and the data, not the length field.
+ */
+function hasValidCrc(b, at, len) {
+    return crc32Of(b.subarray(at + 4, at + 8 + len)) === b.readUInt32BE(at + 8 + len);
+}
+/**
+ * Whether these bytes are a PNG this exemption can account for, byte for byte.
+ *
+ * IHDR is read before the walk rather than during it. The spec puts it first, at a fixed size, and
+ * every later decision depends on its fields — so reading it up front is the difference between
+ * checking those fields and checking them after something has already used them.
+ *
+ * The walk then rejects on the first chunk it cannot account for, so an unknown type never reaches
+ * the part that grants anything.
+ */
+function isWholePng(b) {
+    if (!b.subarray(0, 8).equals(PNG_SIGNATURE))
+        return false;
+    // Signature, then IHDR's length and type: 13 bytes of data at a known offset.
+    if (b.length < 33)
+        return false;
+    if (b.readUInt32BE(8) !== 13 || b.subarray(12, 16).toString('latin1') !== 'IHDR')
+        return false;
+    if (!hasValidCrc(b, 8, 13))
+        return false;
+    const width = b.readUInt32BE(16);
+    const height = b.readUInt32BE(20);
+    const depth = b[24];
+    const colour = b[25];
+    const interlace = b[28];
+    const channels = PNG_CHANNELS[colour];
+    if (width === 0 || height === 0 || channels === undefined)
+        return false;
+    if (!PNG_DEPTHS[colour].includes(depth))
+        return false;
+    // Compression and filter: the spec defines one value each, and two interlace methods.
+    if (b[26] !== 0 || b[27] !== 0 || interlace > 1)
+        return false;
+    let at = 33; // 8 signature + 4 length + 4 type + 13 data + 4 CRC
+    let sawEnd = false;
+    const idat = [];
+    while (!sawEnd) {
+        if (at + 12 > b.length)
+            return false;
+        const len = b.readUInt32BE(at);
+        const type = b.subarray(at + 4, at + 8).toString('latin1');
+        const next = at + 12 + len; // length + type + data + CRC
+        if (next > b.length)
+            return false;
+        if (!hasValidCrc(b, at, len))
+            return false;
+        if (type === 'IDAT') {
+            idat.push(Buffer.from(b.subarray(at + 8, at + 8 + len)));
+        }
+        else if (type === 'IEND') {
+            if (len !== 0 || next !== b.length || idat.length === 0)
+                return false;
+            sawEnd = true;
+        }
+        else if (type === 'IHDR') {
+            return false; // exactly one, already read
+        }
+        else {
+            const fixed = PNG_FIXED_ANCILLARY[type];
+            // A chunk whose size the caller picks is a chunk the caller can fill.
+            if (fixed === undefined || len > fixed)
+                return false;
+        }
+        at = next;
+    }
+    // The size is known before the inflate, not after it, so the inflate is bounded by it. Deciding
+    // afterwards meant a 400 KB IDAT declaring 1×1 could expand to whatever it liked: measured, one
+    // 531 KB base64 payload took RSS up by 821 MB, and `--max-old-space-size` does not bound it
+    // because zlib writes outside the JS heap. This is the one place in the write path that runs
+    // over bytes an agent's tools, an MCP server, or (for `orca scrub`) somebody else's trace file
+    // chose.
+    const expected = pngRawLength(width, height, channels, depth, interlace === 1);
+    if (expected > MAX_RASTER_RAW_BYTES)
+        return false;
+    const stream = Buffer.concat(idat);
+    let raw;
+    try {
+        // `info: true` for `bytesWritten`, which is the input the stream actually consumed. Without it
+        // anything past the end of the zlib stream is never looked at, and `IDAT{<pixels><credential>}`
+        // inflates to the declared size with the credential still in the trace. `@types/node` models
+        // only the plain-Buffer overload, so the shape is spelled out here; only `bytesWritten` and
+        // `buffer` are read from it.
+        const result = inflateSync(stream, { info: true, maxOutputLength: expected });
+        if (result.engine.bytesWritten !== stream.length)
+            return false;
+        raw = result.buffer;
+    }
+    catch {
+        // Not a zlib stream, or a stream that wanted more room than the header asked for — which is
+        // what a decompression bomb is. Either way: not an image, so the sweep runs as it always did.
+        return false;
+    }
+    return raw.length === expected;
+}
+/** Whether these bytes are one complete image this exemption can account for. */
+function isWholeRasterImage(b) {
+    if (b.length < 16)
+        return false;
+    return isWholePng(b);
+}
+/**
+ * The spans of `value` that are whole raster images.
+ *
+ * The signature is checked before anything is decoded, so a long run that is not an image costs
+ * six characters rather than a decode — which matters because this runs over every string a trace
+ * writes.
+ */
+function rasterSpans(value) {
+    const spans = [];
+    let at = 0;
+    while (at < value.length) {
+        const start = at;
+        // One maximal run of the base64 alphabet, `\/` and `\\` counting as the character they stand
+        // for. Advancing to the run's end rather than past its first character is what keeps this
+        // linear: a signature *inside* a run does not start one, so there is nothing to come back for.
+        while (at < value.length) {
+            const code = value.charCodeAt(at);
+            if (isBase64Char(code)) {
+                at += 1;
+                continue;
+            }
+            if (code === 0x5c) {
+                const next = value.charCodeAt(at + 1);
+                if (next === 0x2f || next === 0x5c) {
+                    at += 2;
+                    continue;
+                }
+            }
+            break;
+        }
+        if (at === start) {
+            at += 1;
+            continue;
+        }
+        // Padding only where padding belongs. `Buffer.from(x, 'base64')` stops at the first `=` and
+        // ignores the rest, so a run of `<image>==<credential>` decoded to a valid image and the span
+        // covered the credential with it. Ending the run at the padding splits the two, and an interior
+        // `=` ends a run for the same reason.
+        let end = at;
+        for (let pad = 0; pad < 2 && value.charCodeAt(end) === 0x3d; pad += 1)
+            end += 1;
+        at = end;
+        // `iVBORw` is what a PNG signature looks like once base64-encoded.
+        if (end - start < MIN_RASTER_CHARS || !value.startsWith('iVBORw', start))
+            continue;
+        // `\/` and `\\` stand for payload characters; they are stripped before decoding and the span
+        // still covers them, or the sweep would resume inside the image.
+        const payload = value.slice(start, end).replace(/\\(.)/g, '$1');
+        let bytes;
+        try {
+            bytes = Buffer.from(payload, 'base64');
+        }
+        catch {
+            continue;
+        }
+        if (!isWholeRasterImage(bytes))
+            continue;
+        spans.push([start, end]);
+    }
+    return spans;
+}
 const TOKEN = /[A-Za-z0-9_-]{20,}/g;
 const PLACEHOLDER = /<secret:[a-z_]+:[0-9a-f]{8}>/g;
 const MIN_ENTROPY_LENGTH = 20;
@@ -129,7 +485,19 @@ const PROTOCOL_ID_VALUE = /(\\*")(?:id|tool_use_id|tool_call_id)\1\s*:\s*\1[A-Za
  * keeping it costs no secrecy that was not already spent.
  */
 const PROTOCOL_SIGNATURE_VALUE = /(\\*")signature\1\s*:\s*\1[A-Za-z0-9+/=_-]*\1/g;
-/** Regions the entropy sweep must not touch: what it already replaced, and what is not a secret. */
+/**
+ * Regions the entropy sweep must not touch: what it already replaced, and what is not a secret.
+ *
+ * Returned sorted by start, which is what {@link Redactor.redactString}'s sweep relies on to test
+ * containment in one pass rather than one scan of the whole list per token.
+ *
+ * The rasters are appended one at a time, not spread. `push(...spans)` passes one argument per
+ * element and V8 stops at about 125k of them — and a string can hold one span per image, so ~130k
+ * of the smallest PNG this file accepts (a 1×1 greyscale, 92 base64 characters: about 12 MB of
+ * payload, which any tool result or MCP frame can carry) raised
+ * `RangeError: Maximum call stack size exceeded` from here, out through `redactString`, with
+ * nothing on the write path to catch it.
+ */
 function spansOf(value) {
     const spans = [];
     for (const m of value.matchAll(PLACEHOLDER))
@@ -139,7 +507,9 @@ function spansOf(value) {
     for (const m of value.matchAll(PROTOCOL_SIGNATURE_VALUE)) {
         spans.push([m.index, m.index + m[0].length]);
     }
-    return spans;
+    for (const span of rasterSpans(value))
+        spans.push(span);
+    return spans.sort((a, b) => a[0] - b[0]);
 }
 /**
  * Write-path redactor (spec §5).
@@ -220,10 +590,27 @@ export class Redactor {
         const spans = spansOf(value);
         let out = '';
         let cut = 0;
+        // `spans.some(...)` per token walked the whole list every time, which is quadratic once a value
+        // holds many images — measured, 40k small PNGs cost 2.7 s against 0.14 s before the exemption
+        // existed. Spans arrive sorted by start and `matchAll` yields tokens the same way, so one
+        // cursor carrying the furthest end seen so far answers the same question in a single pass:
+        // `reach` is max(b) over every span with a <= start, and a token is inside one of them exactly
+        // when it ends at or before that.
+        let cursor = 0;
+        let reach = -1;
         for (const m of value.matchAll(TOKEN)) {
             const token = m[0];
             const start = m.index;
-            if (spans.some(([a, b]) => start >= a && start < b))
+            while (cursor < spans.length && spans[cursor][0] <= start) {
+                if (spans[cursor][1] > reach)
+                    reach = spans[cursor][1];
+                cursor += 1;
+            }
+            // Wholly inside, not merely starting inside. A TOKEN is `[A-Za-z0-9_-]+`, which runs on
+            // past an image payload through a `_` or `-` that base64 has no use for — so a token that
+            // began in the image and ended in a credential was skipped entire, and the credential with
+            // it. Overlap would be wrong the other way: it would exempt text outside the image.
+            if (start + token.length <= reach)
                 continue;
             if (token.length < MIN_ENTROPY_LENGTH || !looksRandom(token))
                 continue;

package/dist/redaction.js.map

@@ -1 +1 @@
-{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../src/redaction.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAGtD,8EAA8E;AAC9E,mGAAmG;AACnG,gGAAgG;AAChG,iGAAiG;AACjG,qEAAqE;AACrE,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAE1C,kFAAkF;AAClF,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,MAAM;IACN,MAAM;IACN,QAAQ;IACR,MAAM;IACN,MAAM;IACN,OAAO;IACP,IAAI;IACJ,MAAM;IACN,KAAK;CACN,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,eAAe;IACf,WAAW;IACX,2EAA2E;IAC3E,SAAS;IACT,gBAAgB;IAChB,QAAQ;IACR,qBAAqB;CACtB,CAAC;AAEF,wFAAwF;AACxF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,YAAY,CAAC,CAAC;AAEpD,2EAA2E;AAC3E,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAG,oBAAoB,EAAE,GAAG,qBAAqB,CAAC,CAAC;AAOhF;;;GAGG;AACH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAc,CAAC;AAEjD,MAAM,KAAK,GAAW;IACpB;QACE,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,mFAAmF;KAC7F;IACD,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,gEAAgE,EAAE;IAC1F,yFAAyF;IACzF,kGAAkG;IAClG,kGAAkG;IAClG,2FAA2F;IAC3F,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,wBAAwB,EAAE;IACzD,6FAA6F;IAC7F,6FAA6F;IAC7F,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,6BAA6B,EAAE;IAChE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,mBAAmB,EAAE;IAC3D,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,+BAA+B,EAAE;IACjE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,wBAAwB,EAAE;CAC9D,CAAC;AAEF,MAAM,KAAK,GAAG,qBAAqB,CAAC;AACpC,MAAM,WAAW,GAAG,+BAA+B,CAAC;AACpD,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAElC,wFAAwF;AACxF,SAAS,OAAO,CAAC,KAAa;IAC5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,EAAE,IAAI,KAAK;QAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9D,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;QAC3B,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,iBAAiB,GAAG,mEAAmE,CAAC;AAE9F;;;;;;;;;GASG;AACH,MAAM,wBAAwB,GAAG,gDAAgD,CAAC;AAElF,oGAAoG;AACpG,SAAS,OAAO,CAAC,KAAa;IAC5B,MAAM,KAAK,GAAuB,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1F,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAChG,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAAC;QACzD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAcD;;;;;;;GAOG;AACH,MAAM,OAAO,QAAQ;IACV,KAAK,CAAS;IACd,aAAa,CAAc;IAC3B,QAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;IAEvD,YAAY,OAAyB,EAAE;QACrC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC1D,IAAI,CAAC,aAAa,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,qBAAqB,CAAC,CAAC;IAC3E,CAAC;IAED,YAAY,CAAC,CAAS,EAAE,OAAgB;QACtC,MAAM,IAAI,GAAG,IAAI,GAAG,EAA2B,CAAC;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;IAC7C,CAAC;IAED,aAAa,CAAC,OAA+B;QAC3C,MAAM,IAAI,GAAG,IAAI,GAAG,EAA2B,CAAC;QAChD,MAAM,KAAK,GAA2B,EAAE,CAAC;QACzC,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,UAAU,KAAK,EAAE,CAAC;YAClC,KAAK,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACxC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC;gBACrE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;IAC7C,CAAC;IAED,SAAS,CAAC,GAAuC;QAC/C,MAAM,IAAI,GAAG,IAAI,GAAG,EAA2B,CAAC;QAChD,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;YACrB,IAAI,GAAG,KAAK,SAAS;gBAAE,SAAS;YAChC,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClB,OAAO,GAAG,CAAC;IACb,CAAC;IAED,uFAAuF;IACvF,OAAO;QACL,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,UAAU;QACR,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE;YAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;QACnF,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,KAAa,EAAE,OAA2B,EAAE,IAAkC;QAClF,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QACrF,CAAC;QACD,0FAA0F;QAC1F,4FAA4F;QAC5F,8FAA8F;QAC9F,+FAA+F;QAC/F,4FAA4F;QAC5F,0FAA0F;QAC1F,8FAA8F;QAC9F,MAAM;QACN,IAAI,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YAAE,OAAO,KAAK,CAAC;QACrD,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACjD,CAAC;IAED,YAAY,CACV,KAAa,EACb,OAA2B,EAC3B,IAAkC;QAElC,qFAAqF;QACrF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,GAAG,CAAC,CAAC;QACZ,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACnB,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;YACtB,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;gBAAE,SAAS;YAC9D,IAAI,KAAK,CAAC,MAAM,GAAG,kBAAkB,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;gBAAE,SAAS;YACvE,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,qBAAqB;gBAAE,SAAS;YACtD,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YACjF,GAAG,GAAG,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC;QAC7B,CAAC;QACD,OAAO,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,IAAI,CACF,IAAY,EACZ,MAAc,EACd,OAA2B,EAC3B,IAAkC;QAElC,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/F,MAAM,WAAW,GAAG,WAAW,IAAI,IAAI,KAAK,GAAG,CAAC;QAChD,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;QAC3D,wFAAwF;QACxF,+FAA+F;QAC/F,mEAAmE;QACnE,MAAM,GAAG,GAAG,GAAG,IAAI,KAAK,UAAU,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,IAAI;YAAE,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;;YACrB,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QACtE,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,CAAC,IAAkC;QACvC,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,IAAI;gBAAE,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC;;gBAC7B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../src/redaction.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAGxC,8EAA8E;AAC9E,mGAAmG;AACnG,gGAAgG;AAChG,iGAAiG;AACjG,gGAAgG;AAChG,gGAAgG;AAChG,8FAA8F;AAC9F,aAAa;AACb,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAE1C,kFAAkF;AAClF,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,MAAM;IACN,MAAM;IACN,QAAQ;IACR,MAAM;IACN,MAAM;IACN,OAAO;IACP,IAAI;IACJ,MAAM;IACN,KAAK;CACN,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,eAAe;IACf,WAAW;IACX,2EAA2E;IAC3E,SAAS;IACT,gBAAgB;IAChB,QAAQ;IACR,qBAAqB;CACtB,CAAC;AAEF,wFAAwF;AACxF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,YAAY,CAAC,CAAC;AAEpD,2EAA2E;AAC3E,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAG,oBAAoB,EAAE,GAAG,qBAAqB,CAAC,CAAC;AAOhF;;;GAGG;AACH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAc,CAAC;AAEjD,MAAM,KAAK,GAAW;IACpB;QACE,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,mFAAmF;KAC7F;IACD,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,gEAAgE,EAAE;IAC1F,yFAAyF;IACzF,kGAAkG;IAClG,kGAAkG;IAClG,2FAA2F;IAC3F,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,wBAAwB,EAAE;IACzD,6FAA6F;IAC7F,6FAA6F;IAC7F,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,6BAA6B,EAAE;IAChE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,mBAAmB,EAAE;IAC3D,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,+BAA+B,EAAE;IACjE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,wBAAwB,EAAE;CAC9D,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH;;;;;;;;;;;GAWG;AACH,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,CACL,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,MAAM;QACxC,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,MAAM;QACxC,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,MAAM;QACxC,IAAI,KAAK,IAAI,IAAI,IAAI;QACrB,IAAI,KAAK,IAAI,CAAC,IAAI;KACnB,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAE5B;;;;;;;GAOG;AACH,MAAM,oBAAoB,GAAG,CAAC,IAAI,EAAE,CAAC;AAErC,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAEpF;;;;;;;;;;;;;GAaG;AACH,MAAM,mBAAmB,GAA2B;IAClD,IAAI,EAAE,CAAC;IACP,IAAI,EAAE,CAAC;IACP,IAAI,EAAE,CAAC;IACP,IAAI,EAAE,CAAC;IACP,IAAI,EAAE,CAAC;IACP,IAAI,EAAE,CAAC;CACR,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,YAAY,GAA2B,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;AAExE,sGAAsG;AACtG,MAAM,UAAU,GAA6B;IAC3C,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;IACnB,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;IACV,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;IACV,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;CACX,CAAC;AAEF,8EAA8E;AAC9E,MAAM,KAAK,GAAG;IACZ,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACZ,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACZ,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACZ,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACZ,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACZ,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACZ,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;CACJ,CAAC;AAEX;;;;;;;GAOG;AACH,SAAS,YAAY,CACnB,KAAa,EACb,MAAc,EACd,QAAgB,EAChB,KAAa,EACb,UAAmB;IAEnB,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CACpC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACzE,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC5C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;QACrC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,6FAA6F;AAC7F,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE;IACtB,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC;YAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC5E,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC,EAAE,CAAC;AAEL;;;;;;;;;;;;;;GAcG;AACH,SAAS,OAAO,CAAC,IAAY;IAC3B,IAAI,CAAC,GAAG,UAAU,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC,GAAG,IAAI,CAAE,CAAC;IAC3F,OAAO,CAAC,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,WAAW,CAAC,CAAS,EAAE,EAAU,EAAE,GAAW;IACrD,OAAO,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC;AACpF,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,UAAU,CAAC,CAAS;IAC3B,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC;QAAE,OAAO,KAAK,CAAC;IAE1D,8EAA8E;IAC9E,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAC/F,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,KAAK,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,CAAC,CAAC,EAAE,CAAE,CAAC;IACrB,MAAM,MAAM,GAAG,CAAC,CAAC,EAAE,CAAE,CAAC;IACtB,MAAM,SAAS,GAAG,CAAC,CAAC,EAAE,CAAE,CAAC;IACzB,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,KAAK,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACxE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvD,sFAAsF;IACtF,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,SAAS,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAE9D,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,oDAAoD;IACjE,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,OAAO,CAAC,MAAM,EAAE,CAAC;QACf,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QACrC,MAAM,GAAG,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,6BAA6B;QACzD,IAAI,IAAI,GAAG,CAAC,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAElC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAE3C,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAC3D,CAAC;aAAM,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YAC3B,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YACtE,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;aAAM,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC,CAAC,4BAA4B;QAC5C,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;YACxC,sEAAsE;YACtE,IAAI,KAAK,KAAK,SAAS,IAAI,GAAG,GAAG,KAAK;gBAAE,OAAO,KAAK,CAAC;QACvD,CAAC;QACD,EAAE,GAAG,IAAI,CAAC;IACZ,CAAC;IAED,gGAAgG;IAChG,gGAAgG;IAChG,4FAA4F;IAC5F,6FAA6F;IAC7F,+FAA+F;IAC/F,SAAS;IACT,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,KAAK,CAAC,CAAC,CAAC;IAC/E,IAAI,QAAQ,GAAG,oBAAoB;QAAE,OAAO,KAAK,CAAC;IAElD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,+FAA+F;QAC/F,gGAAgG;QAChG,6FAA6F;QAC7F,4FAA4F;QAC5F,6BAA6B;QAC7B,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,CAG3E,CAAC;QACF,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,KAAK,MAAM,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC/D,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,4FAA4F;QAC5F,8FAA8F;QAC9F,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC;AACjC,CAAC;AAED,iFAAiF;AACjF,SAAS,kBAAkB,CAAC,CAAS;IACnC,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IAChC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;AACvB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,KAAa;IAChC,MAAM,KAAK,GAAuB,EAAE,CAAC;IACrC,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,EAAE,CAAC;QACjB,6FAA6F;QAC7F,0FAA0F;QAC1F,+FAA+F;QAC/F,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAClC,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvB,EAAE,IAAI,CAAC,CAAC;gBACR,SAAS;YACX,CAAC;YACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;gBACtC,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBACnC,EAAE,IAAI,CAAC,CAAC;oBACR,SAAS;gBACX,CAAC;YACH,CAAC;YACD,MAAM;QACR,CAAC;QACD,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;YACjB,EAAE,IAAI,CAAC,CAAC;YACR,SAAS;QACX,CAAC;QACD,4FAA4F;QAC5F,8FAA8F;QAC9F,gGAAgG;QAChG,sCAAsC;QACtC,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,GAAG,IAAI,CAAC;YAAE,GAAG,IAAI,CAAC,CAAC;QAChF,EAAE,GAAG,GAAG,CAAC;QAET,mEAAmE;QACnE,IAAI,GAAG,GAAG,KAAK,GAAG,gBAAgB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC;YAAE,SAAS;QACnF,6FAA6F;QAC7F,iEAAiE;QACjE,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAChE,IAAI,KAAa,CAAC;QAClB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC;YAAE,SAAS;QACzC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,KAAK,GAAG,qBAAqB,CAAC;AACpC,MAAM,WAAW,GAAG,+BAA+B,CAAC;AACpD,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAElC,wFAAwF;AACxF,SAAS,OAAO,CAAC,KAAa;IAC5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,EAAE,IAAI,KAAK;QAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9D,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;QAC3B,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,iBAAiB,GAAG,mEAAmE,CAAC;AAE9F;;;;;;;;;GASG;AACH,MAAM,wBAAwB,GAAG,gDAAgD,CAAC;AAElF;;;;;;;;;;;;GAYG;AACH,SAAS,OAAO,CAAC,KAAa;IAC5B,MAAM,KAAK,GAAuB,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1F,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAChG,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAAC;QACzD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,KAAK,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3C,CAAC;AAcD;;;;;;;GAOG;AACH,MAAM,OAAO,QAAQ;IACV,KAAK,CAAS;IACd,aAAa,CAAc;IAC3B,QAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;IAEvD,YAAY,OAAyB,EAAE;QACrC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC1D,IAAI,CAAC,aAAa,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,qBAAqB,CAAC,CAAC;IAC3E,CAAC;IAED,YAAY,CAAC,CAAS,EAAE,OAAgB;QACtC,MAAM,IAAI,GAAG,IAAI,GAAG,EAA2B,CAAC;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;IAC7C,CAAC;IAED,aAAa,CAAC,OAA+B;QAC3C,MAAM,IAAI,GAAG,IAAI,GAAG,EAA2B,CAAC;QAChD,MAAM,KAAK,GAA2B,EAAE,CAAC;QACzC,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,UAAU,KAAK,EAAE,CAAC;YAClC,KAAK,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACxC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC;gBACrE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;IAC7C,CAAC;IAED,SAAS,CAAC,GAAuC;QAC/C,MAAM,IAAI,GAAG,IAAI,GAAG,EAA2B,CAAC;QAChD,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;YACrB,IAAI,GAAG,KAAK,SAAS;gBAAE,SAAS;YAChC,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClB,OAAO,GAAG,CAAC;IACb,CAAC;IAED,uFAAuF;IACvF,OAAO;QACL,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,UAAU;QACR,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE;YAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;QACnF,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,KAAa,EAAE,OAA2B,EAAE,IAAkC;QAClF,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QACrF,CAAC;QACD,0FAA0F;QAC1F,4FAA4F;QAC5F,8FAA8F;QAC9F,+FAA+F;QAC/F,4FAA4F;QAC5F,0FAA0F;QAC1F,8FAA8F;QAC9F,MAAM;QACN,IAAI,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YAAE,OAAO,KAAK,CAAC;QACrD,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACjD,CAAC;IAED,YAAY,CACV,KAAa,EACb,OAA2B,EAC3B,IAAkC;QAElC,qFAAqF;QACrF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,GAAG,CAAC,CAAC;QACZ,gGAAgG;QAChG,8FAA8F;QAC9F,0FAA0F;QAC1F,2FAA2F;QAC3F,+FAA+F;QAC/F,kCAAkC;QAClC,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC;QACf,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACnB,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;YACtB,OAAO,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAE,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC;gBAC3D,IAAI,KAAK,CAAC,MAAM,CAAE,CAAC,CAAC,CAAC,GAAG,KAAK;oBAAE,KAAK,GAAG,KAAK,CAAC,MAAM,CAAE,CAAC,CAAC,CAAC,CAAC;gBACzD,MAAM,IAAI,CAAC,CAAC;YACd,CAAC;YACD,wFAAwF;YACxF,0FAA0F;YAC1F,2FAA2F;YAC3F,oFAAoF;YACpF,IAAI,KAAK,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK;gBAAE,SAAS;YAC5C,IAAI,KAAK,CAAC,MAAM,GAAG,kBAAkB,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;gBAAE,SAAS;YACvE,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,qBAAqB;gBAAE,SAAS;YACtD,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YACjF,GAAG,GAAG,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC;QAC7B,CAAC;QACD,OAAO,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,IAAI,CACF,IAAY,EACZ,MAAc,EACd,OAA2B,EAC3B,IAAkC;QAElC,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/F,MAAM,WAAW,GAAG,WAAW,IAAI,IAAI,KAAK,GAAG,CAAC;QAChD,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;QAC3D,wFAAwF;QACxF,+FAA+F;QAC/F,mEAAmE;QACnE,MAAM,GAAG,GAAG,GAAG,IAAI,KAAK,UAAU,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,IAAI;YAAE,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;;YACrB,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QACtE,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,CAAC,IAAkC;QACvC,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,IAAI;gBAAE,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC;;gBAC7B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orcareplay/core",
-  "version": "0.2.3",
+  "version": "0.2.5-main.g05c6ca2",
   "type": "module",
   "license": "Apache-2.0",
   "repository": {
@@ -17,7 +17,7 @@
     "dist"
   ],
   "dependencies": {
-    "@orcareplay/plugin-api": "0.2.3",
-    "@orcareplay/schema": "0.2.3"
+    "@orcareplay/plugin-api": "0.2.5-main.g05c6ca2",
+    "@orcareplay/schema": "0.2.5-main.g05c6ca2"
   }
 }