@poetic-ai/poetic 1.42.0

package/dist/chunk-LO3X5NLS.js

@@ -0,0 +1,326 @@
+import {
+  BUILT_IN_VARIANT_STRATEGIES
+} from "./chunk-VXF4Q3FW.js";
+import {
+  getBuiltInTaskTypesDir,
+  getPackageRoot,
+  getRepoTaskTypesDir
+} from "./chunk-XZE4XARH.js";
+import {
+  deepMerge
+} from "./chunk-LPITVM7M.js";
+
+// src/core/task-types/alias-map.ts
+import * as fs from "fs/promises";
+import * as path from "path";
+import * as yaml from "js-yaml";
+var ALIAS_MAP_FILENAME = "task-type-aliases.yaml";
+function getBuiltInAliasMapPath() {
+  return path.join(getPackageRoot(), "templates", ".poetic", "config", ALIAS_MAP_FILENAME);
+}
+function getRepoAliasMapPath(cwd = process.cwd()) {
+  return path.join(cwd, ".poetic", "config", ALIAS_MAP_FILENAME);
+}
+var TaskTypeAliasMap = class _TaskTypeAliasMap {
+  entries;
+  constructor(entries) {
+    this.entries = entries;
+  }
+  static empty() {
+    return new _TaskTypeAliasMap(/* @__PURE__ */ new Map());
+  }
+  /**
+   * Load the alias map from the built-in template (if any) then the repo
+   * override (last-wins per key). A missing/empty/invalid file contributes
+   * nothing — the loader NEVER throws on absent or malformed config; an absent
+   * map simply yields no 'declared' resolution (inference still works).
+   */
+  static async load(options = {}) {
+    const cwd = options.cwd ?? process.cwd();
+    const builtInPath = options.builtInPath ?? getBuiltInAliasMapPath();
+    const repoPath = options.repoPath ?? getRepoAliasMapPath(cwd);
+    const entries = /* @__PURE__ */ new Map();
+    for (const filePath of [builtInPath, repoPath]) {
+      const parsed = await readAliasFile(filePath);
+      for (const [declared, id] of parsed) {
+        entries.set(declared, id);
+      }
+    }
+    return new _TaskTypeAliasMap(entries);
+  }
+  /** Build directly from a record (used by tests / programmatic config). */
+  static fromRecord(record) {
+    return new _TaskTypeAliasMap(normalizeEntries(record));
+  }
+  /** True when no mapping is configured (the out-of-the-box default). */
+  isEmpty() {
+    return this.entries.size === 0;
+  }
+  /** Number of configured mappings. */
+  get size() {
+    return this.entries.size;
+  }
+  /**
+   * Look up the mapped registry id for a declared term. The term is matched
+   * VERBATIM (no normalization), preserving opacity. Returns undefined when the
+   * term is not mapped.
+   */
+  resolve(declaredType) {
+    if (typeof declaredType !== "string" || declaredType.length === 0) return void 0;
+    return this.entries.get(declaredType);
+  }
+  /** Iterate configured mappings (declared term -> id). Useful for validation. */
+  list() {
+    return [...this.entries.entries()].map(([declared, id]) => ({ declared, id }));
+  }
+};
+function normalizeEntries(parsed) {
+  const entries = /* @__PURE__ */ new Map();
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return entries;
+  }
+  const record = parsed;
+  const source = record.aliases && typeof record.aliases === "object" && !Array.isArray(record.aliases) ? record.aliases : record;
+  for (const [declared, value] of Object.entries(source)) {
+    if (typeof declared !== "string" || declared.length === 0) continue;
+    if (typeof value !== "string" || value.trim().length === 0) continue;
+    entries.set(declared, value.trim());
+  }
+  return entries;
+}
+async function readAliasFile(filePath) {
+  let raw;
+  try {
+    raw = await fs.readFile(filePath, "utf8");
+  } catch {
+    return [];
+  }
+  let parsed;
+  try {
+    parsed = yaml.load(raw, { schema: yaml.JSON_SCHEMA });
+  } catch {
+    return [];
+  }
+  return [...normalizeEntries(parsed).entries()];
+}
+
+// src/core/task-types/types.ts
+import { z } from "zod";
+var TaskTypeStageTypeSchema = z.enum([
+  "standard",
+  "competition",
+  "verify",
+  "autoloop",
+  "refinement"
+]);
+var TaskTypeExecutionIntentSchema = z.enum(["edit", "analysis"]);
+var TaskTypeStrategySchema = z.enum(BUILT_IN_VARIANT_STRATEGIES);
+var TaskTypeJudgingFrameworkSchema = z.enum(["hybrid", "multi-lens", "ai-judge", "auto"]);
+var TaskTypeAllowlistModeSchema = z.enum(["strict", "warn", "off"]);
+var TaskTypePolicySchema = z.object({
+  executionIntent: TaskTypeExecutionIntentSchema.optional(),
+  routing: z.object({
+    defaultStrategy: TaskTypeStrategySchema.optional(),
+    preferCompetition: z.boolean().optional()
+  }).passthrough().optional(),
+  decomposition: z.object({
+    requiredStageTypes: z.array(TaskTypeStageTypeSchema).optional(),
+    maxParallelGroups: z.number().int().positive().optional(),
+    guidance: z.object({
+      hints: z.array(z.string()).optional(),
+      antiPatterns: z.array(z.string()).optional()
+    }).passthrough().optional()
+  }).passthrough().optional(),
+  judging: z.object({
+    framework: TaskTypeJudgingFrameworkSchema.optional(),
+    defaultScore: z.number().min(0).max(100).optional(),
+    minimumScore: z.number().min(0).max(100).optional()
+  }).passthrough().optional(),
+  allowlist: z.object({
+    requireNonEmpty: z.boolean().optional(),
+    mode: TaskTypeAllowlistModeSchema.optional()
+  }).passthrough().optional(),
+  verify: z.object({
+    defaultCommands: z.array(z.string()).optional()
+  }).passthrough().optional()
+}).passthrough();
+var TaskTypeMatchSchema = z.object({
+  priority: z.number().int().optional(),
+  canonical: z.object({
+    category: z.array(z.string()).optional(),
+    judgeTaskKind: z.array(z.string()).optional()
+  }).optional(),
+  keywords: z.array(z.string()).optional(),
+  regex: z.array(z.string()).optional(),
+  // When true, this task type is suppressed for prompts that carry strong
+  // code-only signals unless the prompt also has a direct documentation
+  // deliverable intent. Data-driven replacement for a hardcoded id check in
+  // the resolver; set on the doc task type definition(s).
+  suppressWhenCodeOnly: z.boolean().optional()
+}).passthrough().optional();
+var TaskTypeDefinitionSchema = z.object({
+  id: z.string().min(1),
+  version: z.number().int().positive().default(1),
+  extends: z.string().min(1).optional(),
+  match: TaskTypeMatchSchema,
+  policy: TaskTypePolicySchema.optional()
+}).passthrough();
+
+// src/core/task-types/registry.ts
+import * as fs2 from "fs/promises";
+import * as path2 from "path";
+import * as yaml2 from "js-yaml";
+
+// src/core/task-types/merge.ts
+function mergePolicy(parent, child) {
+  if (!child) return parent;
+  return deepMerge(parent, child);
+}
+function getPolicy(def) {
+  return def.policy ?? {};
+}
+
+// src/core/task-types/registry.ts
+var TaskTypeRegistryError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "TaskTypeRegistryError";
+  }
+};
+async function listYamlFiles(dir) {
+  try {
+    const entries = await fs2.readdir(dir, { withFileTypes: true });
+    return entries.filter((e) => e.isFile() && (e.name.endsWith(".yaml") || e.name.endsWith(".yml"))).map((e) => path2.join(dir, e.name)).sort((a, b) => a.localeCompare(b));
+  } catch {
+    return [];
+  }
+}
+async function loadDefinitionsFromDir(dir, source) {
+  const files = await listYamlFiles(dir);
+  const loaded = [];
+  for (const filePath of files) {
+    const raw = await fs2.readFile(filePath, "utf8");
+    let parsed;
+    try {
+      parsed = yaml2.load(raw, { schema: yaml2.JSON_SCHEMA });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      throw new TaskTypeRegistryError(`Failed to parse task type YAML: ${filePath}. ${message}`);
+    }
+    const result = TaskTypeDefinitionSchema.safeParse(parsed);
+    if (!result.success) {
+      const issues = result.error.issues.map((i) => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ");
+      throw new TaskTypeRegistryError(`Invalid task type YAML: ${filePath}. ${issues}`);
+    }
+    loaded.push({ definition: result.data, sourcePath: filePath, source });
+  }
+  return loaded;
+}
+function detectCycles(id, graph, visiting, visited, pathStack) {
+  if (visited.has(id)) return;
+  if (visiting.has(id)) {
+    const start = pathStack.indexOf(id);
+    const cycle = [...pathStack.slice(start), id].join(" -> ");
+    throw new TaskTypeRegistryError(`Circular task type extends detected: ${cycle}`);
+  }
+  visiting.add(id);
+  pathStack.push(id);
+  const parent = graph.get(id);
+  if (parent) {
+    detectCycles(parent, graph, visiting, visited, [...pathStack]);
+  }
+  visiting.delete(id);
+  visited.add(id);
+}
+function resolvePolicy(id, defs, resolved) {
+  const existing = resolved.get(id);
+  if (existing) return existing;
+  const versions = defs.get(id);
+  if (!versions || versions.length === 0) {
+    throw new TaskTypeRegistryError(`Task type not found: ${id}`);
+  }
+  const effective = versions.at(-1);
+  if (!effective) {
+    throw new TaskTypeRegistryError(`Task type not found: ${id}`);
+  }
+  const def = effective.definition;
+  const parentId = def.extends;
+  let basePolicy = {};
+  if (parentId) {
+    if (!defs.has(parentId)) {
+      throw new TaskTypeRegistryError(`Task type "${id}" extends unknown parent "${parentId}"`);
+    }
+    const parentResolved = resolvePolicy(parentId, defs, resolved);
+    basePolicy = parentResolved.policy;
+  }
+  const policy = mergePolicy(basePolicy, getPolicy(def));
+  const sources = versions.map((v) => ({ path: v.sourcePath, source: v.source }));
+  const finalResolved = {
+    id: def.id,
+    version: def.version,
+    extends: def.extends,
+    match: def.match,
+    policy,
+    sources
+  };
+  resolved.set(id, finalResolved);
+  return finalResolved;
+}
+var TaskTypeRegistry = class _TaskTypeRegistry {
+  defsById;
+  resolvedById;
+  constructor(defsById, resolvedById) {
+    this.defsById = defsById;
+    this.resolvedById = resolvedById;
+  }
+  static async load(options = {}) {
+    const cwd = options.cwd ?? process.cwd();
+    const builtInDir = options.builtInDir ?? getBuiltInTaskTypesDir();
+    const repoDir = options.repoDir ?? getRepoTaskTypesDir(cwd);
+    const loaded = [];
+    loaded.push(...await loadDefinitionsFromDir(builtInDir, "built-in"));
+    loaded.push(...await loadDefinitionsFromDir(repoDir, "repo"));
+    const defsById = /* @__PURE__ */ new Map();
+    for (const entry of loaded) {
+      const id = entry.definition.id;
+      const bucket = defsById.get(id) ?? [];
+      bucket.push(entry);
+      defsById.set(id, bucket);
+    }
+    const graph = /* @__PURE__ */ new Map();
+    for (const [id, versions] of defsById.entries()) {
+      const effective = versions.at(-1);
+      if (!effective) {
+        continue;
+      }
+      graph.set(id, effective.definition.extends);
+    }
+    const visiting = /* @__PURE__ */ new Set();
+    const visited = /* @__PURE__ */ new Set();
+    for (const id of defsById.keys()) {
+      detectCycles(id, graph, visiting, visited, []);
+    }
+    const resolvedById = /* @__PURE__ */ new Map();
+    for (const id of defsById.keys()) {
+      resolvePolicy(id, defsById, resolvedById);
+    }
+    return new _TaskTypeRegistry(defsById, resolvedById);
+  }
+  listIds() {
+    return [...this.resolvedById.keys()].sort((a, b) => a.localeCompare(b));
+  }
+  get(id) {
+    return this.resolvedById.get(id) ?? null;
+  }
+  getSources(id) {
+    return this.defsById.get(id) ?? [];
+  }
+};
+
+export {
+  getRepoAliasMapPath,
+  TaskTypeAliasMap,
+  TaskTypePolicySchema,
+  TaskTypeRegistry
+};
+//# sourceMappingURL=chunk-LO3X5NLS.js.map

package/dist/chunk-LPITVM7M.js

@@ -0,0 +1,339 @@
+// src/utils/provider-secret-patterns.ts
+var PROVIDER_SECRET_PATTERNS = [
+  {
+    id: "anthropic-api-key",
+    source: "sk-ant-[a-zA-Z0-9_-]{20,}",
+    caseInsensitive: true
+  },
+  {
+    id: "openai-project-api-key",
+    source: "sk-proj-[a-zA-Z0-9_-]{20,}",
+    caseInsensitive: true
+  },
+  {
+    id: "openai-service-account-key",
+    source: "sk-svcacct-[a-zA-Z0-9_-]{20,}",
+    caseInsensitive: true
+  },
+  {
+    id: "openai-admin-api-key",
+    source: "sk-admin-[a-zA-Z0-9_-]{20,}",
+    caseInsensitive: true
+  },
+  {
+    id: "openrouter-api-key",
+    source: "sk-or-v1-[a-zA-Z0-9]{20,}",
+    caseInsensitive: true
+  },
+  {
+    id: "google-api-key",
+    source: "AIzaSy[a-zA-Z0-9_-]{20,}",
+    caseInsensitive: false
+  },
+  {
+    id: "xai-api-key",
+    source: "xai-[a-zA-Z0-9]{20,}",
+    caseInsensitive: true
+  },
+  {
+    id: "slack-token",
+    source: "xox[baprs]-[a-zA-Z0-9-]{10,}",
+    caseInsensitive: true
+  }
+];
+
+// src/utils/type-guards.ts
+function isObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function hasProperty(value, key) {
+  return isObject(value) && key in value;
+}
+function isStringProperty(value, key) {
+  return hasProperty(value, key) && typeof value[key] === "string";
+}
+function isNumberProperty(value, key) {
+  return hasProperty(value, key) && typeof value[key] === "number";
+}
+function isError(value) {
+  return value instanceof Error;
+}
+function hasStderr(error) {
+  return isStringProperty(error, "stderr");
+}
+function hasStdout(error) {
+  return isStringProperty(error, "stdout");
+}
+function hasExitCode(error) {
+  return isNumberProperty(error, "exitCode");
+}
+function hasErrorCode(error) {
+  return isStringProperty(error, "code");
+}
+function getStderr(error) {
+  if (hasStderr(error)) {
+    return error.stderr;
+  }
+  return "";
+}
+function getStdout(error) {
+  if (hasStdout(error)) {
+    return error.stdout;
+  }
+  return "";
+}
+function getExitCode(error) {
+  if (hasExitCode(error)) {
+    return error.exitCode;
+  }
+  return void 0;
+}
+function getErrorCode(error) {
+  if (hasErrorCode(error)) {
+    return error.code;
+  }
+  return void 0;
+}
+function deepMerge(base, override) {
+  if (!isObject(base) || !isObject(override)) {
+    return override ?? base;
+  }
+  const result = { ...base };
+  for (const [key, value] of Object.entries(override)) {
+    const existing = result[key];
+    if (Array.isArray(value)) {
+      result[key] = value;
+      continue;
+    }
+    if (isObject(existing) && isObject(value)) {
+      result[key] = deepMerge(existing, value);
+      continue;
+    }
+    result[key] = value;
+  }
+  return result;
+}
+
+// src/utils/error-sanitizer.ts
+function compileProviderSecretPatterns() {
+  return PROVIDER_SECRET_PATTERNS.map(
+    (pattern) => new RegExp(pattern.source, pattern.caseInsensitive ? "gi" : "g")
+  );
+}
+var SENSITIVE_PATTERNS = [
+  // Database connection strings (MUST come first to capture full credentials)
+  /mongodb(\+srv)?:\/\/[^:]+:[^@]+@/gi,
+  /postgres(ql)?:\/\/[^:]+:[^@]+@/gi,
+  /mysql:\/\/[^:]+:[^@]+@/gi,
+  // Generic URL userinfo credentials (any scheme: https, redis(s), amqp(s), ftp, etc.).
+  // The `://` lookbehind keeps the scheme and host visible while redacting only the
+  // `user:pass@` portion; DB-specific patterns above still handle their own schemes.
+  /(?<=:\/\/)[^:/@\s]+:[^@/\s]+@/g,
+  // AWS credentials (MUST come before generic secret pattern)
+  /AKIA[0-9A-Z]{16}/g,
+  // AWS Access Key ID
+  /aws_access_key_id[=:]\s*['"]?[A-Z0-9]{16,}['"]?/gi,
+  /aws_secret_access_key[=:]\s*['"]?[a-zA-Z0-9+/=]{32,}['"]?/gi,
+  // Generic API keys and tokens (with broader matching)
+  /api[_-]?key[=:]\s*['"]?[a-zA-Z0-9_\-.]{8,}['"]?/gi,
+  /token[=:]\s*['"]?(?!\[REDACTED\])[^\s'"]{8,}['"]?/gi,
+  /secret[=:]\s*['"]?[a-zA-Z0-9_\-.]{10,}['"]?/gi,
+  /password[=:]\s*['"]?[^\s'"]{6,}['"]?/gi,
+  /passwd[=:]\s*['"]?[^\s'"]{6,}['"]?/gi,
+  /pwd[=:]\s*['"]?[^\s'"]{6,}['"]?/gi,
+  // Bearer tokens (Authorization headers)
+  /bearer\s+[a-zA-Z0-9_\-.]{10,}/gi,
+  /authorization[=:]\s*['"]?(?!\[REDACTED\])bearer\s+[a-zA-Z0-9_\-.]{10,}['"]?/gi,
+  // Allow an optional auth scheme (Basic|Digest|Negotiate|Bearer) before the value so
+  // scheme-prefixed forms like `Authorization: Basic <base64>` are redacted; the base64
+  // characters `+/=` are permitted in the value token for Basic credentials.
+  /authorization[=:]\s*['"]?(?!\[REDACTED\])(?:(?:basic|digest|negotiate|bearer)\s+)?[a-zA-Z0-9+/=_\-.]{10,}['"]?/gi,
+  // Common API key formats: Stripe-style `sk_live_`/`sk_test_`/`pk_live_`/`pk_test_`
+  // and bare `sk_`/`sk-`/`pk_`/`pk-` secret tokens. The `sk`/`pk` vendor prefix is
+  // required: bare `live_`/`test_` prefixes were removed because no mainstream key
+  // format uses them without a vendor prefix, while ordinary identifiers do
+  // (`test_currency_mismatch_raises` was being mangled into `[REDACTED]_mismatch_raises`,
+  // which corrupted source code passed through judge prompts). The leading
+  // non-alphanumeric lookbehind keeps `sk`/`pk` from matching mid-word.
+  /(?<![a-zA-Z0-9])(?:(?:sk|pk)[_-](?:live|test)[_-][a-zA-Z0-9]{8,}|(?:sk|pk)[_-][a-zA-Z0-9]{8,})/gi,
+  // Provider-specific hyphenated key forms (F1–F5) from shared inventory —
+  // same sources/min lengths as flywheel-security; replacement remains [REDACTED].
+  ...compileProviderSecretPatterns(),
+  // GitHub tokens (more flexible length requirements)
+  /ghp_[a-zA-Z0-9]{20,}/gi,
+  // Personal Access Token
+  /gho_[a-zA-Z0-9]{20,}/gi,
+  // OAuth Access Token
+  /ghu_[a-zA-Z0-9]{20,}/gi,
+  // User-to-Server Token
+  /ghs_[a-zA-Z0-9]{20,}/gi,
+  // Server-to-Server Token
+  /ghr_[a-zA-Z0-9]{20,}/gi,
+  // Refresh Token
+  /github_pat_[a-zA-Z0-9_]{50,}/gi,
+  // Fine-grained PAT
+  // GCP service account keys (base64-encoded JSON)
+  /"private_key":\s*"[^"]{100,}"/gi,
+  /"client_email":\s*"[^"]+@[^"]+\.gserviceaccount\.com"/gi,
+  // Azure connection strings
+  /AccountKey=[a-zA-Z0-9+/=]{32,}/gi,
+  /SharedAccessSignature=[a-zA-Z0-9%=&]+/gi,
+  // Private keys (any algorithm label: RSA, EC, DSA, OPENSSH, ENCRYPTED, etc.)
+  /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/gi,
+  // JWT tokens (base64.base64.base64 format with more flexibility)
+  /eyJ[a-zA-Z0-9_-]{4,}\.eyJ[a-zA-Z0-9_-]{4,}\.[a-zA-Z0-9_-]{4,}/g,
+  // Generic base64-encoded secrets (64+ chars)
+  /[=:]\s*['"]?[a-zA-Z0-9+/]{64,}={0,2}['"]?/g
+];
+var SENSITIVE_HEADER_VALUE_PATTERNS = [
+  {
+    pattern: /(^|[\r\n]|[^\S\r\n])([ \t]*)(set-cookie|cookie|proxy-authorization|www-authenticate|x-amz-security-token|x-api-key|x-auth-token)([ \t]*:[ \t]*)([^\r\n]*)/gi,
+    replace: (_match, prefix, indentation, headerName, separator) => `${prefix}${indentation}${headerName}${separator}${REDACTION_PLACEHOLDER}`
+  },
+  {
+    pattern: /(['"])(set-cookie|cookie|proxy-authorization|www-authenticate|x-amz-security-token|x-api-key|x-auth-token)\1([ \t]*:[ \t]*)"[^"\r\n]*"/gi,
+    replace: (_match, quote, headerName, separator) => `${quote}${headerName}${quote}${separator}"${REDACTION_PLACEHOLDER}"`
+  },
+  {
+    pattern: /(['"])(set-cookie|cookie|proxy-authorization|www-authenticate|x-amz-security-token|x-api-key|x-auth-token)\1([ \t]*:[ \t]*)'[^'\r\n]*'/gi,
+    replace: (_match, quote, headerName, separator) => `${quote}${headerName}${quote}${separator}'${REDACTION_PLACEHOLDER}'`
+  },
+  {
+    pattern: /(['"])(set-cookie|cookie|proxy-authorization|www-authenticate|x-amz-security-token|x-api-key|x-auth-token)\1([ \t]*:[ \t]*)\[[^\]\r\n]*\]/gi,
+    replace: (_match, quote, headerName, separator) => `${quote}${headerName}${quote}${separator}[${REDACTION_PLACEHOLDER}]`
+  }
+];
+var HOME_DIR_PATTERN = /(\/Users\/|\/home\/)([^/\s]+)\//g;
+var PATH_SEGMENT_CHARACTER = /[.]|[^\s!-/:-@\[-^`{-~]/u;
+var REDACTION_PLACEHOLDER = "[REDACTED]";
+var SENSITIVE_ARG_VALUE_PLACEHOLDER = "<redacted>";
+function isSensitiveArgName(rawName) {
+  const name = rawName.replace(/^-+/, "").split(/[=:]/, 1)[0] ?? "";
+  const normalized = name.toLowerCase();
+  const parts = normalized.split(/[._-]+/).filter(Boolean);
+  const compact = parts.join("");
+  return compact === "token" || compact.endsWith("token") || compact.endsWith("apikey") || compact.endsWith("authkey") || compact.endsWith("accesskey") || compact.endsWith("privatekey") || compact.endsWith("authtoken") || compact.endsWith("accesstoken") || compact.endsWith("refreshtoken") || compact.endsWith("bearertoken") || compact.endsWith("credential") || compact.endsWith("credentials") || compact.endsWith("secret") || compact.endsWith("password") || compact.endsWith("passwd") || compact.endsWith("pwd") || parts.includes("token");
+}
+function sanitizeArgvForLogging(argv) {
+  const sanitized = [];
+  let redactNext = false;
+  for (const arg of argv) {
+    if (redactNext) {
+      sanitized.push(SENSITIVE_ARG_VALUE_PLACEHOLDER);
+      redactNext = false;
+      continue;
+    }
+    const assignmentMatch = arg.match(/^(-{1,2}[^=\s:]+)([=:])(.+)$/);
+    if (assignmentMatch && isSensitiveArgName(assignmentMatch[1] ?? "")) {
+      sanitized.push(
+        `${assignmentMatch[1]}${assignmentMatch[2]}${SENSITIVE_ARG_VALUE_PLACEHOLDER}`
+      );
+      continue;
+    }
+    if (/^-{1,2}/.test(arg) && isSensitiveArgName(arg)) {
+      sanitized.push(sanitizeString(arg));
+      redactNext = true;
+      continue;
+    }
+    sanitized.push(sanitizeString(arg));
+  }
+  return sanitized;
+}
+function sanitizeCommandLineForLogging(commandLine) {
+  const assignmentPattern = /(^|\s)(-{1,2}[^\s=:]+)([=:])(?:"[^"]*"|'[^']*'|\S+)/g;
+  const valuePattern = /(^|\s)(-{1,2}[^\s=:]+)(\s+)(?:"[^"]*"|'[^']*'|\S+)/g;
+  const protectedValues = [];
+  const protectRedactedArg = (value) => {
+    const index = protectedValues.push(value) - 1;
+    return `__POETIC_REDACTED_ARG_${index}__`;
+  };
+  const redactAssignments = commandLine.replace(
+    assignmentPattern,
+    (match, prefix, flag, separator) => {
+      if (!isSensitiveArgName(flag)) {
+        return match;
+      }
+      return `${prefix}${protectRedactedArg(`${flag}${separator}${SENSITIVE_ARG_VALUE_PLACEHOLDER}`)}`;
+    }
+  );
+  const redactFlagValues = redactAssignments.replace(
+    valuePattern,
+    (match, prefix, flag, spacing) => {
+      if (!isSensitiveArgName(flag)) {
+        return match;
+      }
+      return `${prefix}${protectRedactedArg(`${flag}${spacing}${SENSITIVE_ARG_VALUE_PLACEHOLDER}`)}`;
+    }
+  );
+  return sanitizeString(redactFlagValues).replace(
+    /__POETIC_REDACTED_ARG_(\d+)__/g,
+    (match, rawIndex) => {
+      const replacement = protectedValues[Number(rawIndex)];
+      return replacement ?? match;
+    }
+  );
+}
+function sanitizeString(input) {
+  let sanitized = input;
+  for (const { pattern, replace } of SENSITIVE_HEADER_VALUE_PATTERNS) {
+    pattern.lastIndex = 0;
+    sanitized = sanitized.replace(pattern, replace);
+  }
+  for (const pattern of SENSITIVE_PATTERNS) {
+    pattern.lastIndex = 0;
+    sanitized = sanitized.replace(pattern, REDACTION_PLACEHOLDER);
+  }
+  HOME_DIR_PATTERN.lastIndex = 0;
+  sanitized = sanitized.replace(
+    HOME_DIR_PATTERN,
+    (_match, root, _username, offset, whole) => {
+      const previousCharacter = offset > 0 ? whole.charAt(offset - 1) : "";
+      if (previousCharacter !== "" && PATH_SEGMENT_CHARACTER.test(previousCharacter)) {
+        return `${root}${REDACTION_PLACEHOLDER}/`;
+      }
+      return "~/";
+    }
+  );
+  return sanitized;
+}
+function sanitizeError(error) {
+  const sanitizedMessage = sanitizeString(error.message);
+  const sanitizedError = new Error(sanitizedMessage);
+  sanitizedError.name = error.name;
+  if (error.stack !== void 0) {
+    sanitizedError.stack = sanitizeString(error.stack);
+  } else {
+    delete sanitizedError.stack;
+  }
+  if ("cause" in error && error.cause) {
+    const sanitizedWithCause = sanitizedError;
+    if (error.cause instanceof Error) {
+      sanitizedWithCause.cause = sanitizeError(error.cause);
+    } else {
+      sanitizedWithCause.cause = sanitizeString(String(error.cause));
+    }
+  }
+  return sanitizedError;
+}
+function sanitizeValue(value) {
+  if (isError(value)) {
+    return sanitizeError(value).message;
+  }
+  return sanitizeString(String(value));
+}
+
+export {
+  PROVIDER_SECRET_PATTERNS,
+  isStringProperty,
+  getStderr,
+  getStdout,
+  getExitCode,
+  getErrorCode,
+  deepMerge,
+  sanitizeArgvForLogging,
+  sanitizeCommandLineForLogging,
+  sanitizeString,
+  sanitizeError,
+  sanitizeValue
+};
+//# sourceMappingURL=chunk-LPITVM7M.js.map