@pinta-ai/pinta-copilot 0.3.1 → 0.5.0

package/dist/core/env-bridge.js

@@ -1,43 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.bridgeUserConfigToOtelEnv = bridgeUserConfigToOtelEnv;
-/**
- * Bridge Claude Code's userConfig env vars (CLAUDE_PLUGIN_OPTION_*) to the
- * OTel SDK standard env vars (OTEL_EXPORTER_OTLP_*).
- *
- * Claude Code maps each plugin.json `userConfig.<key>` to a corresponding
- * `CLAUDE_PLUGIN_OPTION_<KEY>` env var on hook spawn. We keep the user-
- * facing names friendly (`endpoint`, `api_key`) and translate them into the
- * canonical OTel env names so transport.ts (and any future OTel SDK adoption)
- * can read them via the OTel-spec names.
- *
- * The user-facing `endpoint` is treated as a *full* OTLP/HTTP traces URL
- * (e.g., `http://127.0.0.1:5147/v1/traces`), so we map it to
- * `OTEL_EXPORTER_OTLP_TRACES_ENDPOINT` (signal-specific full URL per OTel
- * spec) rather than `OTEL_EXPORTER_OTLP_ENDPOINT` (which is a base URL the
- * SDK appends `/v1/traces` to). This way both the OTel SDK (when used) and
- * pinta-cc's hand-written transport agree on the URL without any path
- * manipulation downstream.
- *
- * Pinta Manager auto-injects `CLAUDE_PLUGIN_OPTION_*` via Claude Code's
- * settings.json. OSS users fill them in via the `/plugin install` UI.
- *
- * Existing OTEL_EXPORTER_OTLP_TRACES_ENDPOINT / HEADERS take precedence
- * (explicit override).
- */
-function bridgeUserConfigToOtelEnv() {
-    if (process.env.CLAUDE_PLUGIN_OPTION_ENDPOINT &&
-        !process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT) {
-        process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT =
-            process.env.CLAUDE_PLUGIN_OPTION_ENDPOINT;
-    }
-    if (process.env.CLAUDE_PLUGIN_OPTION_API_KEY && !process.env.OTEL_EXPORTER_OTLP_HEADERS) {
-        process.env.OTEL_EXPORTER_OTLP_HEADERS =
-            `x-pinta-relay-token=${process.env.CLAUDE_PLUGIN_OPTION_API_KEY}`;
-    }
-    // Expose for guard.ts (~/guard/evaluate auth header)
-    if (!process.env.PINTA_RELAY_TOKEN && process.env.CLAUDE_PLUGIN_OPTION_API_KEY) {
-        process.env.PINTA_RELAY_TOKEN = process.env.CLAUDE_PLUGIN_OPTION_API_KEY;
-    }
-}
-//# sourceMappingURL=env-bridge.js.map

package/dist/core/env-bridge.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"env-bridge.js","sourceRoot":"","sources":["../../src/core/env-bridge.ts"],"names":[],"mappings":";;AAwBA,8DAgBC;AAxCD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,SAAgB,yBAAyB;IACvC,IACE,OAAO,CAAC,GAAG,CAAC,6BAA6B;QACzC,CAAC,OAAO,CAAC,GAAG,CAAC,kCAAkC,EAC/C,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,kCAAkC;YAC5C,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC;IAC9C,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,CAAC;QACxF,OAAO,CAAC,GAAG,CAAC,0BAA0B;YACpC,uBAAuB,OAAO,CAAC,GAAG,CAAC,4BAA4B,EAAE,CAAC;IACtE,CAAC;IACD,qDAAqD;IACrD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC,4BAA4B,EAAE,CAAC;QAC/E,OAAO,CAAC,GAAG,CAAC,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;IAC3E,CAAC;AACH,CAAC"}

package/dist/core/guard.d.ts

@@ -1,14 +0,0 @@
-export interface GuardInput {
-    spanId: string;
-    toolName?: string;
-    toolInput?: unknown;
-    rawTextFields?: Record<string, string>;
-}
-export interface GuardResult {
-    decision: 'ALLOW' | 'DENY' | 'REVIEW';
-    reason: string | null;
-    userMessage: string | null;
-    durationMs: number;
-    failOpenReason?: 'timeout' | 'refused' | 'error';
-}
-export declare function evaluateGuard(input: GuardInput, endpoint: string | undefined): Promise<GuardResult | null>;

package/dist/core/guard.js

@@ -1,53 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.evaluateGuard = evaluateGuard;
-// Guard must be fast or fail-open. 50ms default keeps the hook snappy;
-// override for slower relays (or test harnesses) via PINTA_GUARD_TIMEOUT_MS.
-const TIMEOUT_MS = Number(process.env.PINTA_GUARD_TIMEOUT_MS) || 50;
-// Self-identify to the manager's guard route so it can attribute calls to this
-// adaptor (the route parses `pinta-*/<version>` out of the User-Agent). Keep the
-// version in sync with package.json.
-const GUARD_UA = 'pinta-copilot/0.3.1';
-function sleep(ms) {
-    return new Promise((_, reject) => setTimeout(() => {
-        const err = new Error('Guard request timed out');
-        err.name = 'TimeoutError';
-        reject(err);
-    }, ms));
-}
-async function evaluateGuard(input, endpoint) {
-    if (!endpoint)
-        return null;
-    if (process.env.PINTA_GUARD_DISABLED === '1')
-        return null;
-    const start = Date.now();
-    try {
-        const res = await Promise.race([
-            fetch(endpoint, {
-                method: 'POST',
-                headers: {
-                    'content-type': 'application/json',
-                    'user-agent': GUARD_UA,
-                    'x-pinta-relay-token': process.env.PINTA_RELAY_TOKEN ?? '',
-                },
-                body: JSON.stringify({ input }),
-            }),
-            sleep(TIMEOUT_MS),
-        ]);
-        if (res.status !== 200) {
-            return { decision: 'ALLOW', reason: null, userMessage: null, durationMs: Date.now() - start, failOpenReason: 'error' };
-        }
-        const body = (await res.json());
-        return {
-            decision: body.decision,
-            reason: body.reason,
-            userMessage: body.userMessage ?? null,
-            durationMs: body.durationMs ?? (Date.now() - start),
-        };
-    }
-    catch (err) {
-        const reason = err.name === 'TimeoutError' ? 'timeout' : 'error';
-        return { decision: 'ALLOW', reason: null, userMessage: null, durationMs: Date.now() - start, failOpenReason: reason };
-    }
-}
-//# sourceMappingURL=guard.js.map

package/dist/core/guard.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"guard.js","sourceRoot":"","sources":["../../src/core/guard.ts"],"names":[],"mappings":";;AAqCA,sCAuCC;AA1DD,uEAAuE;AACvE,6EAA6E;AAC7E,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,EAAE,CAAC;AAEpE,+EAA+E;AAC/E,iFAAiF;AACjF,qCAAqC;AACrC,MAAM,QAAQ,GAAG,qBAAqB,CAAC;AAEvC,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAC/B,UAAU,CAAC,GAAG,EAAE;QACd,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACjD,GAAG,CAAC,IAAI,GAAG,cAAc,CAAC;QAC1B,MAAM,CAAC,GAAG,CAAC,CAAC;IACd,CAAC,EAAE,EAAE,CAAC,CACP,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,aAAa,CACjC,KAAiB,EACjB,QAA4B;IAE5B,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAC7B,KAAK,CAAC,QAAQ,EAAE;gBACd,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,YAAY,EAAE,QAAQ;oBACtB,qBAAqB,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE;iBAC3D;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;aAChC,CAAC;YACF,KAAK,CAAC,UAAU,CAAC;SAClB,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;QACzH,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAK7B,CAAC;QACF,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;YACrC,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;SACpD,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAmC,GAAa,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;QAC3G,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;IACxH,CAAC;AACH,CAAC"}

package/dist/core/otlp.d.ts

@@ -1,55 +0,0 @@
-import type { GuardResult } from "./guard.js";
-import { type RawEvent } from "./types.js";
-import type { Surface } from "./surface.js";
-export interface OtlpAttribute {
-    key: string;
-    value: {
-        stringValue: string;
-    } | {
-        intValue: number;
-    } | {
-        doubleValue: number;
-    } | {
-        boolValue: boolean;
-    };
-}
-export interface OtlpSpan {
-    traceId: string;
-    spanId: string;
-    name: string;
-    kind: number;
-    startTimeUnixNano: string;
-    endTimeUnixNano: string;
-    attributes: OtlpAttribute[];
-}
-export interface ResourceSpans {
-    resource: {
-        attributes: OtlpAttribute[];
-    };
-    scopeSpans: Array<{
-        scope: {
-            name: string;
-            version: string;
-        };
-        spans: OtlpSpan[];
-    }>;
-}
-export interface OtlpPayload {
-    resourceSpans: ResourceSpans[];
-}
-/**
- * Convert a 26-char Crockford ULID into 32 lowercase hex chars (16 bytes)
- * suitable for an OTLP traceId.
- */
-export declare function ulidToTraceId(ulid: string): string;
-/** Generate a fresh 16-hex-char (8-byte) span ID. */
-export declare function newSpanId(): string;
-export declare function buildOtlpPayload(args: {
-    event: RawEvent;
-    traceId: string;
-    surface: Surface;
-    now?: number;
-    guard?: GuardResult | null;
-}): OtlpPayload;
-/** Concatenate per-hook payloads' resourceSpans into one OTLP payload. */
-export declare function mergeBatch(payloads: OtlpPayload[]): OtlpPayload;

package/dist/core/otlp.js

@@ -1,184 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ulidToTraceId = ulidToTraceId;
-exports.newSpanId = newSpanId;
-exports.buildOtlpPayload = buildOtlpPayload;
-exports.mergeBatch = mergeBatch;
-const crypto_1 = __importDefault(require("crypto"));
-const os_1 = __importDefault(require("os"));
-const redact_js_1 = require("./redact.js");
-const types_js_1 = require("./types.js");
-const SDK_VERSION = "0.3.1"; // keep in sync with package.json
-/**
- * Copilot CLI/ext version isn't reliably discoverable from the hook process
- * env. Read an optional `COPILOT_CLI_VERSION` override, else "unknown" — a
- * missing version must never fail the hook.
- */
-function getCopilotVersion() {
-    return process.env.COPILOT_CLI_VERSION || "unknown";
-}
-const CROCKFORD = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
-/**
- * Convert a 26-char Crockford ULID into 32 lowercase hex chars (16 bytes)
- * suitable for an OTLP traceId.
- */
-function ulidToTraceId(ulid) {
-    if (ulid.length !== 26) {
-        throw new Error(`ulidToTraceId: expected 26 chars, got ${ulid.length}`);
-    }
-    let n = 0n;
-    for (const ch of ulid) {
-        const idx = CROCKFORD.indexOf(ch);
-        if (idx < 0)
-            throw new Error(`ulidToTraceId: invalid Crockford char "${ch}"`);
-        n = (n << 5n) | BigInt(idx);
-    }
-    const mask = (1n << 128n) - 1n;
-    n &= mask;
-    return n.toString(16).padStart(32, "0");
-}
-/** Generate a fresh 16-hex-char (8-byte) span ID. */
-function newSpanId() {
-    return crypto_1.default.randomBytes(8).toString("hex");
-}
-/**
- * Identifier/enum keys for which redaction (Tier 1) is skipped (truncation
- * still applies). Both snake (CLI/ext) and camel (permissionRequest) casings
- * are listed since Bronze flattening preserves the incoming key name.
- */
-const SKIP_REDACT_KEYS = new Set([
-    "copilot.hook",
-    "copilot.tool_name", "copilot.toolName",
-    "copilot.tool_use_id", "copilot.toolUseId",
-    "copilot.session_id", "copilot.sessionId",
-    "copilot.transcript_path", "copilot.transcriptPath",
-    "copilot.cwd",
-    "copilot.permission_mode",
-    "copilot.surface",
-    "copilot.agent_id", "copilot.agent_type",
-    "copilot.agent_name", "copilot.agent_display_name",
-    "copilot.stop_reason", "copilot.notification_type",
-]);
-/** Keys that may carry shell command / tool payload text → bash redaction context. */
-const BASH_CONTEXT_KEYS = new Set([
-    "copilot.tool_input", "copilot.toolInput",
-    "copilot.tool_response", "copilot.tool_result",
-]);
-function maybeRedactString(key, raw) {
-    const truncated = (0, redact_js_1.truncate)(raw);
-    if (SKIP_REDACT_KEYS.has(key))
-        return truncated;
-    const context = BASH_CONTEXT_KEYS.has(key) ? "bash" : undefined;
-    return (0, redact_js_1.redact)(truncated, { context });
-}
-/** Convert a JS value into an OTLP attribute value. Returns null to omit. */
-function toOtlpValue(key, v) {
-    if (v === null || v === undefined)
-        return null;
-    switch (typeof v) {
-        case "string":
-            return { stringValue: maybeRedactString(key, v) };
-        case "boolean":
-            return { boolValue: v };
-        case "number":
-            if (Number.isInteger(v))
-                return { intValue: v };
-            return { doubleValue: v };
-        case "object":
-            try {
-                return { stringValue: maybeRedactString(key, JSON.stringify(v)) };
-            }
-            catch {
-                return { stringValue: maybeRedactString(key, String(v)) };
-            }
-        default:
-            return { stringValue: maybeRedactString(key, String(v)) };
-    }
-}
-function snakeCase(name) {
-    return name
-        .replace(/([a-z0-9])([A-Z])/g, "$1_$2")
-        .replace(/([A-Z])([A-Z][a-z])/g, "$1_$2")
-        .toLowerCase();
-}
-// Discriminator keys covered by `copilot.hook` — don't re-emit them raw.
-const DISCRIMINATOR_KEYS = new Set(["hook_event_name", "hookEventName", "hookName"]);
-function flattenEvent(event, surface) {
-    const out = [];
-    // Discriminator first so aware-backend's detectIngestType hits it cheaply.
-    out.push({ key: "ingest.type", value: { stringValue: "copilot" } });
-    // Canonical hook name regardless of incoming discriminator key (snake/camel/hookName).
-    out.push({ key: "copilot.hook", value: { stringValue: (0, types_js_1.eventName)(event) ?? "unknown" } });
-    // Runtime surface label (cli | ext | cloud).
-    out.push({ key: "copilot.surface", value: { stringValue: surface } });
-    for (const [k, v] of Object.entries(event)) {
-        if (DISCRIMINATOR_KEYS.has(k))
-            continue; // covered by copilot.hook
-        const key = `copilot.${k}`;
-        const value = toOtlpValue(key, v);
-        if (value === null)
-            continue;
-        out.push({ key, value });
-    }
-    return out;
-}
-function resourceAttrs() {
-    return [
-        { key: "service.name", value: { stringValue: "copilot" } },
-        { key: "service.version", value: { stringValue: getCopilotVersion() } },
-        { key: "telemetry.sdk.name", value: { stringValue: "pinta-copilot" } },
-        { key: "telemetry.sdk.language", value: { stringValue: "nodejs" } },
-        { key: "telemetry.sdk.version", value: { stringValue: SDK_VERSION } },
-        { key: "process.pid", value: { intValue: process.pid } },
-        { key: "process.owner", value: { stringValue: os_1.default.userInfo().username } },
-        { key: "host.name", value: { stringValue: os_1.default.hostname() } },
-        { key: "host.arch", value: { stringValue: os_1.default.arch() } },
-    ];
-}
-function buildOtlpPayload(args) {
-    const ts = args.now ?? Date.now();
-    const tsNano = (BigInt(ts) * 1000000n).toString();
-    const attrs = flattenEvent(args.event, args.surface);
-    if (args.guard) {
-        attrs.push({ key: "pinta.guard.decision", value: { stringValue: args.guard.decision.toLowerCase() } }, { key: "pinta.guard.duration_ms", value: { intValue: args.guard.durationMs } });
-        if (args.guard.reason) {
-            attrs.push({ key: "pinta.guard.matched_rule", value: { stringValue: args.guard.reason } });
-        }
-        if (args.guard.failOpenReason) {
-            attrs.push({ key: "pinta.guard.fail_open_reason", value: { stringValue: args.guard.failOpenReason } });
-        }
-    }
-    const span = {
-        traceId: ulidToTraceId(args.traceId),
-        spanId: newSpanId(),
-        name: `copilot.${snakeCase((0, types_js_1.eventName)(args.event) ?? "unknown")}`,
-        kind: 1, // SPAN_KIND_INTERNAL
-        startTimeUnixNano: tsNano,
-        endTimeUnixNano: tsNano,
-        attributes: attrs,
-    };
-    return {
-        resourceSpans: [
-            {
-                resource: { attributes: resourceAttrs() },
-                scopeSpans: [
-                    {
-                        scope: { name: "pinta-copilot", version: SDK_VERSION },
-                        spans: [span],
-                    },
-                ],
-            },
-        ],
-    };
-}
-/** Concatenate per-hook payloads' resourceSpans into one OTLP payload. */
-function mergeBatch(payloads) {
-    const out = [];
-    for (const p of payloads)
-        out.push(...p.resourceSpans);
-    return { resourceSpans: out };
-}
-//# sourceMappingURL=otlp.js.map

package/dist/core/otlp.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"otlp.js","sourceRoot":"","sources":["../../src/core/otlp.ts"],"names":[],"mappings":";;;;;AAuDA,sCAaC;AAGD,8BAEC;AAkGD,4CA4CC;AAGD,gCAIC;AA9ND,oDAA4B;AAC5B,4CAAoB;AACpB,2CAA+C;AAE/C,yCAAsD;AAGtD,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,iCAAiC;AAE9D;;;;GAIG;AACH,SAAS,iBAAiB;IACxB,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,SAAS,CAAC;AACtD,CAAC;AAiCD,MAAM,SAAS,GAAG,kCAAkC,CAAC;AAErD;;;GAGG;AACH,SAAgB,aAAa,CAAC,IAAY;IACxC,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,yCAAyC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,GAAG,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,EAAE,GAAG,CAAC,CAAC;QAC9E,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/B,CAAC,IAAI,IAAI,CAAC;IACV,OAAO,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED,qDAAqD;AACrD,SAAgB,SAAS;IACvB,OAAO,gBAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED;;;;GAIG;AACH,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC;IACpD,cAAc;IACd,mBAAmB,EAAE,kBAAkB;IACvC,qBAAqB,EAAE,mBAAmB;IAC1C,oBAAoB,EAAE,mBAAmB;IACzC,yBAAyB,EAAE,wBAAwB;IACnD,aAAa;IACb,yBAAyB;IACzB,iBAAiB;IACjB,kBAAkB,EAAE,oBAAoB;IACxC,oBAAoB,EAAE,4BAA4B;IAClD,qBAAqB,EAAE,2BAA2B;CACnD,CAAC,CAAC;AAEH,sFAAsF;AACtF,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC;IACrD,oBAAoB,EAAE,mBAAmB;IACzC,uBAAuB,EAAE,qBAAqB;CAC/C,CAAC,CAAC;AAEH,SAAS,iBAAiB,CAAC,GAAW,EAAE,GAAW;IACjD,MAAM,SAAS,GAAG,IAAA,oBAAQ,EAAC,GAAG,CAAC,CAAC;IAChC,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,MAAgB,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,OAAO,IAAA,kBAAM,EAAC,SAAS,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,6EAA6E;AAC7E,SAAS,WAAW,CAAC,GAAW,EAAE,CAAU;IAC1C,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC/C,QAAQ,OAAO,CAAC,EAAE,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,EAAE,WAAW,EAAE,iBAAiB,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;QACpD,KAAK,SAAS;YACZ,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QAC1B,KAAK,QAAQ;YACX,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;gBAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;YAChD,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;QAC5B,KAAK,QAAQ;YACX,IAAI,CAAC;gBACH,OAAO,EAAE,WAAW,EAAE,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,WAAW,EAAE,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,CAAC;QACH;YACE,OAAO,EAAE,WAAW,EAAE,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,IAAI;SACR,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC;SACtC,OAAO,CAAC,sBAAsB,EAAE,OAAO,CAAC;SACxC,WAAW,EAAE,CAAC;AACnB,CAAC;AAED,yEAAyE;AACzE,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,iBAAiB,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC,CAAC;AAErF,SAAS,YAAY,CAAC,KAAe,EAAE,OAAgB;IACrD,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,2EAA2E;IAC3E,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IACpE,uFAAuF;IACvF,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,IAAA,oBAAS,EAAC,KAAK,CAAC,IAAI,SAAS,EAAE,EAAE,CAAC,CAAC;IACzF,6CAA6C;IAC7C,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IACtE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS,CAAC,0BAA0B;QACnE,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAClC,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QAC7B,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa;IACpB,OAAO;QACL,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE;QAC1D,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,iBAAiB,EAAE,EAAE,EAAE;QACvE,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,eAAe,EAAE,EAAE;QACtE,EAAE,GAAG,EAAE,wBAAwB,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE;QACnE,EAAE,GAAG,EAAE,uBAAuB,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE;QACrE,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;QACxD,EAAE,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,YAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE;QACxE,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,YAAE,CAAC,QAAQ,EAAE,EAAE,EAAE;QAC3D,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,YAAE,CAAC,IAAI,EAAE,EAAE,EAAE;KACxD,CAAC;AACJ,CAAC;AAED,SAAgB,gBAAgB,CAAC,IAMhC;IACC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,QAAU,CAAC,CAAC,QAAQ,EAAE,CAAC;IACpD,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,KAAK,CAAC,IAAI,CACR,EAAE,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,EAAE,EAC1F,EAAE,GAAG,EAAE,yBAAyB,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,CAC/E,CAAC;QACF,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACtB,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,0BAA0B,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,8BAA8B,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QACzG,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAa;QACrB,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;QACpC,MAAM,EAAE,SAAS,EAAE;QACnB,IAAI,EAAE,WAAW,SAAS,CAAC,IAAA,oBAAS,EAAC,IAAI,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,EAAE;QAChE,IAAI,EAAE,CAAC,EAAE,qBAAqB;QAC9B,iBAAiB,EAAE,MAAM;QACzB,eAAe,EAAE,MAAM;QACvB,UAAU,EAAE,KAAK;KAClB,CAAC;IACF,OAAO;QACL,aAAa,EAAE;YACb;gBACE,QAAQ,EAAE,EAAE,UAAU,EAAE,aAAa,EAAE,EAAE;gBACzC,UAAU,EAAE;oBACV;wBACE,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,WAAW,EAAE;wBACtD,KAAK,EAAE,CAAC,IAAI,CAAC;qBACd;iBACF;aACF;SACF;KACF,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,SAAgB,UAAU,CAAC,QAAuB;IAChD,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC;IACvD,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;AAChC,CAAC"}

package/dist/core/redact.d.ts

@@ -1,57 +0,0 @@
-export interface RedactOptions {
-    /**
-     * Optional context hint that enables context-gated patterns. Currently
-     * only "bash" enables `cli_password_short` (-p<pass>) since matching it
-     * outside Bash command text is too noisy.
-     */
-    context?: "bash";
-}
-/** Tier 3 cap: per-string byte limit before truncation. */
-export declare const MAX_BYTES = 102400;
-/**
- * Truncate input by UTF-8 byte length. Appends `…[TRUNCATED:<origByteLen>]`
- * to indicate elision. Returns input unchanged when within cap.
- *
- * Uses Buffer for accurate byte counting; slices on byte boundary then
- * decodes — may produce a U+FFFD if the boundary lands mid-codepoint, which
- * is acceptable for telemetry.
- */
-export declare function truncate(input: string): string;
-export interface Pattern {
-    /** Token type printed inside `[REDACTED:<type>]`. */
-    type: string;
-    /** Regex with global flag (`g`). Multiline (`m`) for line-anchored ones. */
-    regex: RegExp;
-    /**
-     * Capture group index whose substring is replaced. 0 (default) = whole match.
-     * Use a positive group when the pattern brackets context that should be
-     * preserved (e.g. `postgres://user:<pwd>@` keeps the URL shape intact).
-     */
-    captureGroup?: number;
-    /**
-     * If set, this pattern only applies when `RedactOptions.context` equals
-     * the listed value. Used for false-positive-prone shapes.
-     */
-    requireContext?: "bash";
-}
-export declare const PATTERNS: ReadonlyArray<Pattern>;
-interface Match {
-    start: number;
-    end: number;
-    replaceStart: number;
-    replaceEnd: number;
-    type: string;
-}
-export declare function collectMatches(input: string, opts: RedactOptions): Match[];
-export declare function resolveOverlaps(matches: Match[]): Match[];
-export declare function applyMatches(input: string, matches: Match[]): string;
-/**
- * Mask high-confidence secret patterns in `input`. Returns a new string with
- * matched substrings replaced by `[REDACTED:<type>]`.
- *
- * - `opts.context = "bash"` enables context-gated patterns.
- * - Truncation is NOT applied here — see `truncate()`. The caller decides
- *   the order (spec §3 Tier 3: truncate first, then redact).
- */
-export declare function redact(input: string, opts?: RedactOptions): string;
-export {};

package/dist/core/redact.js

@@ -1,149 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.PATTERNS = exports.MAX_BYTES = void 0;
-exports.truncate = truncate;
-exports.collectMatches = collectMatches;
-exports.resolveOverlaps = resolveOverlaps;
-exports.applyMatches = applyMatches;
-exports.redact = redact;
-/** Tier 3 cap: per-string byte limit before truncation. */
-exports.MAX_BYTES = 102400;
-/**
- * Truncate input by UTF-8 byte length. Appends `…[TRUNCATED:<origByteLen>]`
- * to indicate elision. Returns input unchanged when within cap.
- *
- * Uses Buffer for accurate byte counting; slices on byte boundary then
- * decodes — may produce a U+FFFD if the boundary lands mid-codepoint, which
- * is acceptable for telemetry.
- */
-function truncate(input) {
-    const buf = Buffer.from(input, "utf-8");
-    if (buf.length <= exports.MAX_BYTES)
-        return input;
-    const head = buf.subarray(0, exports.MAX_BYTES).toString("utf-8");
-    return `${head}…[TRUNCATED:${buf.length}]`;
-}
-exports.PATTERNS = [
-    { type: "aws_access_key", regex: /AKIA[0-9A-Z]{16}/g },
-    {
-        type: "aws_secret_key",
-        // Context word `aws_secret`/`AWS_SECRET` (with optional separator) followed
-        // by an assignment-ish character then a 40-char base64-ish blob.
-        regex: /(?:aws[_-]?secret(?:[_-]?(?:access)?[_-]?key)?)\s*[:=]\s*["']?([A-Za-z0-9/+=]{40})(?![A-Za-z0-9/+=])/gi,
-        captureGroup: 1,
-    },
-    {
-        type: "gcp_service_account",
-        // Whole JSON blob starting with the service-account discriminator.
-        regex: /\{[\s\S]{0,200}?"type"\s*:\s*"service_account"[\s\S]*?\}/g,
-    },
-    { type: "github_token", regex: /gh[pousr]_[A-Za-z0-9]{36,}/g },
-    { type: "gitlab_token", regex: /glpat-[A-Za-z0-9_-]{20}/g },
-    { type: "slack_token", regex: /xox[abrsp]-[0-9A-Za-z-]{10,}/g },
-    { type: "openai_key", regex: /sk-(?:proj-)?[A-Za-z0-9_-]{40,}/g },
-    { type: "anthropic_key", regex: /sk-ant-[A-Za-z0-9_-]{50,}/g },
-    { type: "stripe_key", regex: /(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{20,}/g },
-    {
-        type: "jwt",
-        regex: /eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g,
-    },
-    {
-        type: "private_key_block",
-        regex: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
-    },
-    { type: "bearer_token", regex: /bearer\s+([A-Za-z0-9._~+/=-]{12,})/gi, captureGroup: 1 },
-    { type: "basic_auth", regex: /basic\s+([A-Za-z0-9+/=]{12,})/gi, captureGroup: 1 },
-    {
-        type: "db_url_password",
-        regex: /\b(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|redis):\/\/[^:\s/]+:([^@\s]+)@/gi,
-        captureGroup: 1,
-    },
-    {
-        type: "cli_password_flag",
-        regex: /(?:--password|--pass|--pwd)[=\s]([^\s'"]+)/g,
-        captureGroup: 1,
-    },
-    {
-        type: "cli_password_short",
-        // mysql -p<pass>; only on bash context.
-        regex: /\s-p([^\s'"]+)/g,
-        captureGroup: 1,
-        requireContext: "bash",
-    },
-    {
-        type: "env_var_secret",
-        // Known false positive: trailing `[A-Z0-9_]*` is greedy, so names like
-        // `OPENAI_API_KEY_DESCRIPTION=Used` still match. Acceptable for Bronze.
-        regex: /^(?:export\s+)?([A-Z][A-Z0-9_]*(?:KEY|SECRET|TOKEN|PASSWORD|PASSWD|PWD|API_KEY)[A-Z0-9_]*)\s*=\s*["']?([^\s"'\n]+)/gm,
-        captureGroup: 2,
-    },
-];
-function collectMatches(input, opts) {
-    const out = [];
-    for (const pattern of exports.PATTERNS) {
-        if (pattern.requireContext && pattern.requireContext !== opts.context)
-            continue;
-        const re = new RegExp(pattern.regex.source, pattern.regex.flags);
-        let m;
-        while ((m = re.exec(input)) !== null) {
-            const cg = pattern.captureGroup ?? 0;
-            const captured = m[cg];
-            if (captured === undefined) {
-                if (m.index === re.lastIndex)
-                    re.lastIndex++;
-                continue;
-            }
-            const start = m.index;
-            const end = m.index + m[0].length;
-            const replaceStart = start + m[0].indexOf(captured);
-            const replaceEnd = replaceStart + captured.length;
-            out.push({ start, end, replaceStart, replaceEnd, type: pattern.type });
-            if (m.index === re.lastIndex)
-                re.lastIndex++; // guard against zero-length
-        }
-    }
-    return out;
-}
-function resolveOverlaps(matches) {
-    const sorted = [...matches].sort((a, b) => {
-        if (a.start !== b.start)
-            return a.start - b.start;
-        return (b.end - b.start) - (a.end - a.start); // longer whole-match wins on tie
-    });
-    const kept = [];
-    let lastEnd = -1;
-    for (const m of sorted) {
-        if (m.start < lastEnd)
-            continue; // overlapping later match dropped
-        kept.push(m);
-        lastEnd = m.end;
-    }
-    return kept;
-}
-function applyMatches(input, matches) {
-    // Apply right-to-left so earlier indices remain valid.
-    const sorted = [...matches].sort((a, b) => b.replaceStart - a.replaceStart);
-    let out = input;
-    for (const m of sorted) {
-        out = out.slice(0, m.replaceStart) + `[REDACTED:${m.type}]` + out.slice(m.replaceEnd);
-    }
-    return out;
-}
-/**
- * Mask high-confidence secret patterns in `input`. Returns a new string with
- * matched substrings replaced by `[REDACTED:<type>]`.
- *
- * - `opts.context = "bash"` enables context-gated patterns.
- * - Truncation is NOT applied here — see `truncate()`. The caller decides
- *   the order (spec §3 Tier 3: truncate first, then redact).
- */
-function redact(input, opts = {}) {
-    if (input.length === 0)
-        return input;
-    const all = collectMatches(input, opts);
-    if (all.length === 0)
-        return input;
-    const kept = resolveOverlaps(all);
-    return applyMatches(input, kept);
-}
-//# sourceMappingURL=redact.js.map

package/dist/core/redact.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../src/core/redact.ts"],"names":[],"mappings":";;;AAoBA,4BAKC;AAoFD,wCAsBC;AAED,0CAaC;AAED,oCAQC;AAUD,wBAMC;AAnKD,2DAA2D;AAC9C,QAAA,SAAS,GAAG,MAAM,CAAC;AAEhC;;;;;;;GAOG;AACH,SAAgB,QAAQ,CAAC,KAAa;IACpC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACxC,IAAI,GAAG,CAAC,MAAM,IAAI,iBAAS;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,iBAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC1D,OAAO,GAAG,IAAI,eAAe,GAAG,CAAC,MAAM,GAAG,CAAC;AAC7C,CAAC;AAoBY,QAAA,QAAQ,GAA2B;IAC9C,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,mBAAmB,EAAE;IACtD;QACE,IAAI,EAAE,gBAAgB;QACtB,4EAA4E;QAC5E,iEAAiE;QACjE,KAAK,EAAE,wGAAwG;QAC/G,YAAY,EAAE,CAAC;KAChB;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,mEAAmE;QACnE,KAAK,EAAE,2DAA2D;KACnE;IACD,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,6BAA6B,EAAE;IAC9D,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,0BAA0B,EAAE;IAC3D,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,+BAA+B,EAAE;IAC/D,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,kCAAkC,EAAE;IACjE,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,4BAA4B,EAAE;IAC9D,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,8CAA8C,EAAE;IAC7E;QACE,IAAI,EAAE,KAAK;QACX,KAAK,EAAE,mEAAmE;KAC3E;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,KAAK,EAAE,6EAA6E;KACrF;IACD,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,sCAAsC,EAAE,YAAY,EAAE,CAAC,EAAE;IACxF,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,iCAAiC,EAAE,YAAY,EAAE,CAAC,EAAE;IACjF;QACE,IAAI,EAAE,iBAAiB;QACvB,KAAK,EAAE,2FAA2F;QAClG,YAAY,EAAE,CAAC;KAChB;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,KAAK,EAAE,6CAA6C;QACpD,YAAY,EAAE,CAAC;KAChB;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,wCAAwC;QACxC,KAAK,EAAE,iBAAiB;QACxB,YAAY,EAAE,CAAC;QACf,cAAc,EAAE,MAAM;KACvB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,uEAAuE;QACvE,wEAAwE;QACxE,KAAK,EAAE,sHAAsH;QAC7H,YAAY,EAAE,CAAC;KAChB;CACF,CAAC;AAUF,SAAgB,cAAc,CAAC,KAAa,EAAE,IAAmB;IAC/D,MAAM,GAAG,GAAY,EAAE,CAAC;IACxB,KAAK,MAAM,OAAO,IAAI,gBAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,cAAc,KAAK,IAAI,CAAC,OAAO;YAAE,SAAS;QAChF,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjE,IAAI,CAAyB,CAAC;QAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACrC,MAAM,EAAE,GAAG,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC;YACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;YACvB,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,IAAI,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC,SAAS;oBAAE,EAAE,CAAC,SAAS,EAAE,CAAC;gBAC7C,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;YACtB,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAClC,MAAM,YAAY,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACpD,MAAM,UAAU,GAAG,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC;YAClD,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YACvE,IAAI,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC,SAAS;gBAAE,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC,4BAA4B;QAC5E,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAgB,eAAe,CAAC,OAAgB;IAC9C,MAAM,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACxC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK;YAAE,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;QAClD,OAAO,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,iCAAiC;IACjF,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,GAAY,EAAE,CAAC;IACzB,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC;IACjB,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,KAAK,GAAG,OAAO;YAAE,SAAS,CAAC,kCAAkC;QACnE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACb,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,YAAY,CAAC,KAAa,EAAE,OAAgB;IAC1D,uDAAuD;IACvD,MAAM,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC;IAC5E,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,aAAa,CAAC,CAAC,IAAI,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,MAAM,CAAC,KAAa,EAAE,OAAsB,EAAE;IAC5D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,GAAG,GAAG,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACxC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AACnC,CAAC"}

package/dist/core/retry-queue.d.ts

@@ -1,26 +0,0 @@
-import type { OtlpPayload } from "./otlp.js";
-export interface QueueEntry {
-    savedAt: string;
-    payload: OtlpPayload;
-}
-export declare class RetryQueue {
-    private filePath;
-    private lockPath;
-    constructor(pluginData: string);
-    /** Append a single payload. Best-effort: any IO error is swallowed (logged to stderr). */
-    enqueue(payload: OtlpPayload): void;
-    /**
-     * Read all entries oldest-first. Returns [] if the file does not exist or is unreadable.
-     * Does NOT delete the file — callers handle persistence via `rewrite`.
-     */
-    readAll(): QueueEntry[];
-    /** Replace the queue with the given entries (or delete the file when empty). */
-    rewrite(entries: QueueEntry[]): void;
-    /**
-     * Try to acquire the lock for ~LOCK_TIMEOUT_MS. Returns true on success.
-     * Caller MUST call `release()` if true is returned.
-     */
-    tryAcquireLock(): boolean;
-    release(): void;
-    private trim;
-}