@redaktyn/cli 0.0.0-stage → 1.5.6

package/redaktyn-shared.cjs

@@ -0,0 +1,9 @@
+"use strict";var oe=Object.defineProperty;var wt=Object.getOwnPropertyDescriptor;var Rt=Object.getOwnPropertyNames;var Tt=Object.prototype.hasOwnProperty;var Ct=(e,t)=>{for(var n in t)oe(e,n,{get:t[n],enumerable:!0})},Pt=(e,t,n,a)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of Rt(t))!Tt.call(e,o)&&o!==n&&oe(e,o,{get:()=>t[o],enumerable:!(a=wt(t,o))||a.enumerable});return e};var _t=e=>Pt(oe({},"__esModule",{value:!0}),e);var ln={};Ct(ln,{AIToolCategory:()=>ae,AI_REGISTRY:()=>Y,ANNUAL_MONTHS_FREE:()=>Ft,ASSIGNED_SECRET_SLUG:()=>Xr,AlertChannel:()=>_e,AlertTrigger:()=>Ue,CATEGORISED_SLUGS:()=>sn,COVERAGE_SLUGS:()=>kt,DETECTION_CATEGORIES:()=>we,DETECTION_FAMILY_BLURBS:()=>en,DETECTION_FAMILY_NAMES:()=>St,DETECTION_PROOF_NAMES:()=>tn,DETECTION_UNIVERSAL_IGNORES:()=>rn,DIGEST_VERSION_HMAC_V1:()=>ur,ENTERPRISE_FEATURES:()=>pe,EventAction:()=>Te,EventType:()=>He,FREE_FEATURES:()=>le,FREE_SEATS:()=>ce,INVISIBLE_CHARS_CLASS:()=>tt,KDF_ITERATIONS:()=>gr,KDF_VERSION_V2:()=>mr,MATRIX_TIERS:()=>zt,MAX_ACTIVITY_SESSIONS_PER_BATCH:()=>ro,MAX_SCAN_WINDOWS:()=>ne,MAX_TOTAL_SCAN_CHARS:()=>W,MIN_SECRET_LENGTH:()=>pr,NORMALIZATION_VERSION_V1:()=>hr,NORMALIZATION_VERSION_V2:()=>fr,OrgPlan:()=>Pe,PASSPHRASE_VERIFY_LABEL:()=>nt,PASTE_CEILING_ALARM_CHARS:()=>xt,PASTE_CEILING_WARN_CHARS:()=>yt,PLAN_DESCRIPTORS:()=>jt,PLAN_FEATURE_MATRIX:()=>Yt,PLAN_FEATURE_TIERS:()=>Kt,PLAN_LIMITS:()=>Le,PLAN_PRICING:()=>Nt,PRIVACY_EMAIL:()=>Jt,PROJECT_KDF_LABEL:()=>rt,PRO_BANDS:()=>m,PRO_ENTRY_BAND:()=>A,PRO_FEATURES:()=>de,PRO_TOP_BAND:()=>Ot,RiskLevel:()=>se,SAFE_BLOCK_EVENT_FIELDS:()=>Ut,SALES_EMAIL:()=>$t,SCAN_PREFILTER_LABEL:()=>lt,SCAN_PREFILTER_PATTERN:()=>ut,SCAN_PREFILTER_SPACE:()=>Ie,SCAN_PREFILTER_WINDOWS_PER_SIGNATURE:()=>bt,SECRET_PROVIDER_NAMES:()=>De,SECRET_PROVIDER_SLUGS:()=>It,SECURITY_EMAIL:()=>qt,TRIAL_DAYS:()=>Wt,UNRECOGNISED_PROVIDER_SLUG:()=>V,UserRole:()=>Ce,annualBilledNote:()=>Oe,appendPasskeyEnvelope:()=>Br,behaviorExplanation:()=>vt,canonicalSecretPlaintextForHmac:()=>X,categoryOfSlug:()=>nn,computePassphraseVerifyHmac:()=>Mr,customPolicyDomains:()=>cn,decodeScanPrefilter:()=>ke,deriveBehaviorRisk:()=>Ht,deriveHmacKeyFromPassphrase:()=>Ar,deriveProjectKey:()=>kr,deriveScanPrefilterSeed:()=>ft,encodeScanPrefilter:()=>Et,extractAddedLinesFromUnifiedDiff:()=>Vr,familyDisplayName:()=>an,familyOfSlug:()=>Mt,findBand:()=>Gt,findPasskeyEnvelope:()=>Wr,foldUuidHexCase:()=>N,generateHmacKey:()=>Dr,generatePrfSalt:()=>Lr,getInjectionHostnames:()=>Be,getLimitsForPlan:()=>Lt,getPrfSaltBytes:()=>Gr,hexToKey:()=>Rr,hmacDigestHex:()=>Q,isAIToolDomain:()=>Zt,isInjectionScopedHostname:()=>he,isKnownProviderSlug:()=>Zr,isProtectableSlug:()=>on,isV1PassphraseEnvelope:()=>st,isV2Envelope:()=>at,keyToHex:()=>wr,matchDomain:()=>Ge,matchPatternsForHostname:()=>tr,maxScannablePasteChars:()=>qr,maxScannablePasteCharsFor:()=>re,normalizeAndHmacHex:()=>xr,normalizeAndHmacHexCollapsed:()=>br,normalizeAndHmacHexLower:()=>yr,normalizeDomainInput:()=>fe,normalizeSecretPlaintextCollapsed:()=>G,normalizeSecretPlaintextForMatch:()=>be,normalizeSecretPlaintextLower:()=>Z,perMonthOnAnnual:()=>Vt,policyNamedDomains:()=>Dt,projectedScanCost:()=>Me,providerDisplayName:()=>Qr,removePasskeyEnvelope:()=>Fr,scanBudgetFor:()=>Jr,scanPrefilterFingerprint:()=>te,scanPrefilterForRawSecret:()=>jr,scanPrefilterParams:()=>ht,scanPrefilterRoller:()=>Yr,scanPrefilterUnits:()=>mt,scanSweeps:()=>Se,scanWindowLengths:()=>$r,smallestBandFor:()=>Bt,unwrapHmacKeyWithPrf:()=>Nr,upgradeEnvelopeToV2:()=>Ur,usd:()=>C,validateNewPassphrase:()=>_r,validatePassphraseStrength:()=>ot,wrapHmacKeyWithPrf:()=>Or});module.exports=_t(ln);var ae=(c=>(c.CODE_GEN="CODE_GEN",c.IMAGE_GEN="IMAGE_GEN",c.WRITING="WRITING",c.DATA_ANALYSIS="DATA_ANALYSIS",c.CHATBOT="CHATBOT",c.SEARCH="SEARCH",c.OTHER="OTHER",c))(ae||{}),se=(o=>(o.LOW="LOW",o.MEDIUM="MEDIUM",o.HIGH="HIGH",o.CRITICAL="CRITICAL",o))(se||{}),Te=(n=>(n.BLOCKED="BLOCKED",n.LOGGED="LOGGED",n))(Te||{}),Ce=(o=>(o.OWNER="OWNER",o.ADMIN="ADMIN",o.USER="USER",o.VIEWER="VIEWER",o))(Ce||{}),Pe=(a=>(a.FREE="FREE",a.PRO="PRO",a.ENTERPRISE="ENTERPRISE",a))(Pe||{}),_e=(n=>(n.EMAIL="EMAIL",n.WEBHOOK="WEBHOOK",n))(_e||{}),Ue=(a=>(a.CRITICAL_BLOCK="CRITICAL_BLOCK",a.DAILY_SUMMARY="DAILY_SUMMARY",a.WEEKLY_REPORT="WEEKLY_REPORT",a))(Ue||{}),He=(o=>(o.PASTE="PASTE",o.FILE_UPLOAD="FILE_UPLOAD",o.PASTE_REDACTED="PASTE_REDACTED",o.DETECTED="DETECTED",o))(He||{}),Ut=["event","type","secretLabel","secretLabels","attemptCount","risk","toolDomain","sourceUrl","timestamp","eventType","scanMethod","scanMs","hmacBatches","secretIds","matchReason","matchReasonSource","bypassVariant","incidentId","detectedAt","policyAction"];function Ht(e){return e<=1?"low":e===2?"medium":"high"}function vt(e){return e<=1?"User likely made an accidental paste.":e===2?"User may not be aware this is sensitive.":"Repeated attempts detected \u2014 potential risk."}var _={maxUsers:5,maxInviteCodes:5,alerts:["EMAIL"],customDetection:!1,advancedReports:!1,exportReports:!1,siem:!1,sso:!1},ie={maxUsers:200,maxInviteCodes:200,alerts:["EMAIL","WEBHOOK"],customDetection:!0,advancedReports:!0,exportReports:!1,siem:!1,sso:!1},ve={maxUsers:9999,maxInviteCodes:9999,alerts:["EMAIL","WEBHOOK"],customDetection:!0,advancedReports:!0,exportReports:!0,siem:!0,sso:!0},Le={FREE:_,PRO:ie,ENTERPRISE:ve};function Lt(e){return Le[e]??_}var ce=_.maxUsers,m=[{id:"team15",name:"Team",maxUsers:15,monthlyUsd:39,annualUsd:390},{id:"growth30",name:"Growth",maxUsers:30,monthlyUsd:79,annualUsd:790},{id:"business75",name:"Business",maxUsers:75,monthlyUsd:149,annualUsd:1490},{id:"scale200",name:"Scale",maxUsers:200,monthlyUsd:349,annualUsd:3490}],un=m[m.length-1].maxUsers,A=m[0],Ot=m[m.length-1],Nt={PRO:{monthlyUsd:A.monthlyUsd,annualUsd:A.annualUsd}};function Gt(e){return m.find(t=>t.id===e)}function Bt(e){return m.find(t=>t.maxUsers>=e)}var Ft=2,Wt=14;function C(e){return`$${Number.isInteger(e)?e.toLocaleString("en-US"):e.toFixed(2)}`}function Vt(e){return C(e/12)}function Oe(e,t){return`${C(t)} billed yearly \xB7 save ${C(e*12-t)}`}var le=["The full detection engine \u2014 paste, send, typed input, drag and file upload","Chrome, Edge and Safari","Bypass detection \u2014 whitespace injection and case folding","Unregistered-secret suggestions \u2014 spots keys nobody registered, admin opt-in, never a block","Zero-knowledge by construction: only HMAC digests leave the device",`Up to ${ce} monitored users`,`${_.maxInviteCodes} invite codes`,"Email alerts","30-day compliance history","Community support"],de=[`Pick your team's size \u2014 ${m.map(e=>`${e.name} to ${e.maxUsers} people, ${C(e.monthlyUsd)}/mo`).join("; ")}`,"Everyone inside your size is covered; no per-seat metering or proration between invites","As many unused invite links as your size has seats","Webhook alerts alongside email","Domain policies \u2014 add any site, beyond the built-in AI tools, to the places Redaktyn blocks","365-day compliance history","Priority support"],pe=["Custom seat limits, agreed rather than published","CSV export of the full event log","SIEM webhook delivery","SSO \u2014 SAML and OIDC","Dedicated support"],Kt=[{key:"FREE",name:"Free",features:le},{key:"PRO",name:"Pro",features:de},{key:"ENTERPRISE",name:"Enterprise",features:pe}],zt=[{key:"FREE",name:"Free",price:"$0"},{key:"PRO",name:"Pro",price:`From ${C(A.monthlyUsd)}/mo`},{key:"ENTERPRISE",name:"Enterprise",price:"Contact us"}],Yt=[{section:"Limits",rows:[{label:"People covered",note:`Pro is bought in ${m.length} sizes, up to ${m.map(e=>e.maxUsers).join(", ")} people \u2014 the figure here is the largest; a workspace's own limit is the size it bought.`,gate:"maxUsers",values:{FREE:String(ce),PRO:"200",ENTERPRISE:"Custom"}},{label:"Invite codes",note:"Unused links held at once. A link is spent when a browser connects and takes a seat, so on Pro this is the size you bought.",gate:"maxInviteCodes",values:{FREE:String(_.maxInviteCodes),PRO:String(ie.maxInviteCodes),ENTERPRISE:"Unlimited"}},{label:"Compliance history",note:"How far back a compliance report may be run. Event data itself is not deleted on any plan.",gate:"advancedReports",values:{FREE:"30 days",PRO:"365 days",ENTERPRISE:"365 days"}}]},{section:"Detection and blocking",rows:[{label:"Paste, send, typed input, drag and file upload",note:"All six enforcement paths, on every plan. Detection has never been plan-gated and is the last thing that should be.",ungated:"No plan check exists on any enforcement path in the extension.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Chrome, Edge and Safari",ungated:"The extension reports its browser; no route reads a plan before accepting the heartbeat.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Bypass detection \u2014 whitespace injection, case folding",ungated:"Runs inside the same scan as the direct match; there is no flag to turn it off.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Detection engine \u2014 50 categories nobody registered",note:"Credentials, infrastructure files and personal data, each proven by a checksum, a decoded structure or the provider's format. On by default; suggests, never blocks.",ungated:"The org switch is an admin setting with no plan check, and the extension's resolver reads only that switch.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Personal-data detection \u2014 cards, Aadhaar, PAN, SSN, IBAN",note:"Checksum-verified and labelled, offered for removal only. Its own switch, on by default.",ungated:"The personal-data switch is an admin setting with no plan check; the resolver passes it straight to the engine.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Unprotected-secret counts by category",note:"A daily count per category on the dashboard \u2014 never a value, a fingerprint or a name.",ungated:"The coverage route checks the org's reporting switch and the enrolment, never the plan.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Custom domain policies",note:"Add a site that is not one of the built-in AI tools to the places Redaktyn blocks. Older warn and log policies keep working.",gate:"customDetection",values:{FREE:!1,PRO:!0,ENTERPRISE:!0}}]},{section:"Alerting and reporting",rows:[{label:"Email alerts",ungated:"EMAIL is in every plan's channel list, so the row is true by construction.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Webhook alerts",gate:"alerts",channel:"WEBHOOK",values:{FREE:!1,PRO:!0,ENTERPRISE:!0}},{label:"Executive PDF report",note:"Emailed every Monday, and downloadable at any time from Reports.",gate:"advancedReports",values:{FREE:!1,PRO:!0,ENTERPRISE:!0}},{label:"CSV export of the event log",gate:"exportReports",values:{FREE:!1,PRO:!1,ENTERPRISE:!0}},{label:"SIEM webhook delivery",gate:"siem",values:{FREE:!1,PRO:!1,ENTERPRISE:!0}}]},{section:"Access and support",rows:[{label:"SSO \u2014 SAML and OIDC",gate:"sso",values:{FREE:!1,PRO:!1,ENTERPRISE:!0}},{label:"Support",note:"A commitment from people, not a switch in the code \u2014 which is why no flag backs this row.",ungated:"Support tiering is contractual; no route reads a plan to answer a support request.",values:{FREE:"Community",PRO:"Priority",ENTERPRISE:"Dedicated"}}]}],jt=[{id:"FREE",name:"Free",tagline:"The whole detection engine, for a team that is still proving it works",priceMonthly:0,priceLabel:"$0",priceNote:"Forever free \xB7 no card",limits:_,features:le,featuresHeading:"What's included",highlighted:!1,cta:"Get started"},{id:"PRO",name:"Pro",tagline:"For a team that has to answer questions about its own exposure",priceMonthly:A.monthlyUsd,priceLabel:C(A.monthlyUsd),priceNote:`per month \xB7 up to ${A.maxUsers} people`,annualNote:Oe(A.monthlyUsd,A.annualUsd),limits:ie,features:de,featuresHeading:"Everything in Free, plus",highlighted:!0,cta:"Start free, then upgrade"},{id:"ENTERPRISE",name:"Enterprise",tagline:"For satisfying somebody else's auditor or IT department",priceMonthly:null,priceLabel:"Custom",priceNote:"Contact sales",limits:ve,features:pe,featuresHeading:"Everything in Pro, plus",highlighted:!1,cta:"Contact sales"}],Ne="ak8340651733@gmail.com",$t=Ne,qt=Ne,Jt="support@redaktyn.com";function r(e,t,n,a="MEDIUM",o={}){return{domain:e,name:t,category:n,riskLevel:a,isEnterprise:o.isEnterprise??!1,...o.personalVersionDomain?{personalVersionDomain:o.personalVersionDomain}:{}}}var Y=[r("chat.openai.com","ChatGPT","CODE_GEN","HIGH"),r("chatgpt.com","ChatGPT","CODE_GEN","HIGH"),r("platform.openai.com","OpenAI Platform","CODE_GEN","HIGH"),r("claude.ai","Claude","CODE_GEN","HIGH"),r("gemini.google.com","Gemini","CODE_GEN","MEDIUM"),r("aistudio.google.com","Google AI Studio","CODE_GEN","MEDIUM"),r("copilot.github.com","GitHub Copilot","CODE_GEN","MEDIUM"),r("github.com/copilot","GitHub Copilot Chat","CODE_GEN","MEDIUM"),r("cursor.sh","Cursor","CODE_GEN","MEDIUM"),r("cursor.com","Cursor","CODE_GEN","MEDIUM"),r("replit.com","Replit","CODE_GEN","HIGH"),r("codeium.com","Codeium","CODE_GEN","MEDIUM"),r("tabnine.com","Tabnine","CODE_GEN","MEDIUM"),r("codewhisperer.aws","Amazon CodeWhisperer","CODE_GEN","LOW",{isEnterprise:!0}),r("aws.amazon.com/codewhisperer","Amazon CodeWhisperer","CODE_GEN","LOW",{isEnterprise:!0}),r("phind.com","Phind","CODE_GEN","MEDIUM"),r("continue.dev","Continue","CODE_GEN","MEDIUM"),r("askcodi.com","AskCodi","CODE_GEN","MEDIUM"),r("sourcegraph.com","Sourcegraph Cody","CODE_GEN","MEDIUM"),r("windsurf.ai","Windsurf","CODE_GEN","MEDIUM"),r("v0.dev","Vercel v0","CODE_GEN","MEDIUM"),r("bolt.new","Bolt","CODE_GEN","HIGH"),r("lovable.dev","Lovable","CODE_GEN","HIGH"),r("aider.chat","Aider","CODE_GEN","MEDIUM"),r("cody.dev","Cody","CODE_GEN","MEDIUM"),r("blackbox.ai","Blackbox AI","CODE_GEN","HIGH"),r("deepcode.ai","DeepCode","CODE_GEN","MEDIUM"),r("codiga.io","Codiga","CODE_GEN","MEDIUM"),r("mutable.ai","Mutable AI","CODE_GEN","MEDIUM"),r("pieces.app","Pieces","CODE_GEN","MEDIUM"),r("codium.ai","CodiumAI","CODE_GEN","MEDIUM"),r("coderabbit.ai","CodeRabbit","CODE_GEN","MEDIUM"),r("devin.ai","Devin","CODE_GEN","HIGH"),r("idx.dev","Project IDX","CODE_GEN","MEDIUM"),r("stackblitz.com","StackBlitz","CODE_GEN","MEDIUM"),r("codepen.io","CodePen AI","CODE_GEN","MEDIUM"),r("codesandbox.io","CodeSandbox AI","CODE_GEN","MEDIUM"),r("gitpod.io","Gitpod","CODE_GEN","MEDIUM"),r("poe.com","Poe","CHATBOT","MEDIUM"),r("character.ai","Character.AI","CHATBOT","MEDIUM"),r("beta.character.ai","Character.AI Beta","CHATBOT","MEDIUM"),r("huggingface.co/chat","HuggingChat","CHATBOT","MEDIUM"),r("pi.ai","Pi","CHATBOT","LOW"),r("chat.mistral.ai","Mistral Chat","CHATBOT","MEDIUM"),r("chat.deepseek.com","DeepSeek Chat","CHATBOT","HIGH"),r("deepseek.com","DeepSeek","CHATBOT","HIGH"),r("groq.com","Groq","CHATBOT","MEDIUM"),r("console.groq.com","Groq Console","CHATBOT","MEDIUM"),r("cohere.com","Cohere","CHATBOT","MEDIUM"),r("coral.cohere.com","Cohere Coral","CHATBOT","MEDIUM"),r("inflection.ai","Inflection","CHATBOT","MEDIUM"),r("chat.lmsys.org","LMSYS Chatbot Arena","CHATBOT","HIGH"),r("open-assistant.io","Open Assistant","CHATBOT","MEDIUM"),r("bard.google.com","Google Bard","CHATBOT","MEDIUM"),r("copilot.microsoft.com","Microsoft Copilot","CHATBOT","LOW",{isEnterprise:!0}),r("bing.com/chat","Bing Chat","CHATBOT","MEDIUM"),r("meta.ai","Meta AI","CHATBOT","MEDIUM"),r("labs.perplexity.ai","Perplexity Labs","CHATBOT","MEDIUM"),r("together.ai","Together AI","CHATBOT","MEDIUM"),r("api.together.xyz","Together API","CHATBOT","MEDIUM"),r("fireworks.ai","Fireworks AI","CHATBOT","MEDIUM"),r("anyscale.com","Anyscale","CHATBOT","MEDIUM"),r("replicate.com","Replicate","CHATBOT","MEDIUM"),r("lepton.ai","Lepton AI","CHATBOT","MEDIUM"),r("forefront.ai","Forefront","CHATBOT","MEDIUM"),r("chat.vercel.ai","Vercel AI Chat","CHATBOT","MEDIUM"),r("llama.meta.com","Llama","CHATBOT","MEDIUM"),r("grok.com","Grok","CHATBOT","HIGH"),r("grok.x.ai","Grok","CHATBOT","MEDIUM"),r("x.ai","xAI","CHATBOT","MEDIUM"),r("duckduckgo.com/aichat","DuckDuckGo AI Chat","CHATBOT","LOW"),r("chatglm.cn","ChatGLM","CHATBOT","HIGH"),r("yiyan.baidu.com","Ernie Bot","CHATBOT","HIGH"),r("qianwen.aliyun.com","Qwen","CHATBOT","HIGH"),r("abacus.ai","Abacus AI","CHATBOT","MEDIUM"),r("midjourney.com","Midjourney","IMAGE_GEN","MEDIUM"),r("discord.com/channels/midjourney","Midjourney Discord","IMAGE_GEN","MEDIUM"),r("openai.com/dall-e","DALL-E","IMAGE_GEN","MEDIUM"),r("labs.openai.com","DALL-E Labs","IMAGE_GEN","MEDIUM"),r("stability.ai","Stable Diffusion","IMAGE_GEN","MEDIUM"),r("dreamstudio.ai","DreamStudio","IMAGE_GEN","MEDIUM"),r("leonardo.ai","Leonardo.ai","IMAGE_GEN","MEDIUM"),r("app.leonardo.ai","Leonardo.ai App","IMAGE_GEN","MEDIUM"),r("ideogram.ai","Ideogram","IMAGE_GEN","MEDIUM"),r("firefly.adobe.com","Adobe Firefly","IMAGE_GEN","LOW",{isEnterprise:!0}),r("clipdrop.co","ClipDrop","IMAGE_GEN","MEDIUM"),r("playground.ai","Playground AI","IMAGE_GEN","MEDIUM"),r("nightcafe.studio","NightCafe","IMAGE_GEN","MEDIUM"),r("creator.nightcafe.studio","NightCafe Creator","IMAGE_GEN","MEDIUM"),r("runwayml.com","Runway","IMAGE_GEN","MEDIUM"),r("app.runwayml.com","Runway App","IMAGE_GEN","MEDIUM"),r("canva.com/ai-image-generator","Canva AI","IMAGE_GEN","LOW"),r("imagine.meta.com","Meta Imagine","IMAGE_GEN","MEDIUM"),r("pika.art","Pika","IMAGE_GEN","MEDIUM"),r("kaiber.ai","Kaiber","IMAGE_GEN","MEDIUM"),r("bing.com/images/create","Bing Image Creator","IMAGE_GEN","MEDIUM"),r("designer.microsoft.com","Microsoft Designer","IMAGE_GEN","MEDIUM"),r("craiyon.com","Craiyon","IMAGE_GEN","LOW"),r("starryai.com","StarryAI","IMAGE_GEN","LOW"),r("hotpot.ai","Hotpot AI","IMAGE_GEN","LOW"),r("lexica.art","Lexica","IMAGE_GEN","LOW"),r("jasper.ai","Jasper","WRITING","MEDIUM"),r("app.jasper.ai","Jasper App","WRITING","MEDIUM"),r("copy.ai","Copy.ai","WRITING","MEDIUM"),r("app.copy.ai","Copy.ai App","WRITING","MEDIUM"),r("writesonic.com","Writesonic","WRITING","MEDIUM"),r("app.writesonic.com","Writesonic App","WRITING","MEDIUM"),r("grammarly.com","Grammarly AI","WRITING","MEDIUM"),r("app.grammarly.com","Grammarly App","WRITING","MEDIUM"),r("notion.so","Notion AI","WRITING","MEDIUM"),r("quillbot.com","QuillBot","WRITING","MEDIUM"),r("wordtune.com","Wordtune","WRITING","MEDIUM"),r("rytr.me","Rytr","WRITING","MEDIUM"),r("anyword.com","Anyword","WRITING","MEDIUM"),r("hyperwriteai.com","HyperWrite","WRITING","MEDIUM"),r("writer.com","Writer","WRITING","MEDIUM",{isEnterprise:!0}),r("textcortex.com","TextCortex","WRITING","MEDIUM"),r("app.textcortex.com","TextCortex App","WRITING","MEDIUM"),r("peppertype.ai","Peppertype","WRITING","MEDIUM"),r("simplified.com","Simplified AI","WRITING","MEDIUM"),r("contentbot.ai","ContentBot","WRITING","MEDIUM"),r("ink.co","INK Editor","WRITING","MEDIUM"),r("sudowrite.com","Sudowrite","WRITING","MEDIUM"),r("novelai.net","NovelAI","WRITING","LOW"),r("shortlyai.com","ShortlyAI","WRITING","MEDIUM"),r("lex.page","Lex","WRITING","MEDIUM"),r("julius.ai","Julius","DATA_ANALYSIS","HIGH"),r("hex.tech","Hex","DATA_ANALYSIS","HIGH"),r("app.hex.tech","Hex App","DATA_ANALYSIS","HIGH"),r("obviously.ai","Obviously AI","DATA_ANALYSIS","HIGH"),r("akkio.com","Akkio","DATA_ANALYSIS","HIGH"),r("monkeylearn.com","MonkeyLearn","DATA_ANALYSIS","HIGH"),r("rows.com","Rows","DATA_ANALYSIS","MEDIUM"),r("breadcrumbs.io","Breadcrumbs","DATA_ANALYSIS","MEDIUM"),r("polymer.co","Polymer","DATA_ANALYSIS","HIGH"),r("databricks.com","Databricks AI","DATA_ANALYSIS","LOW",{isEnterprise:!0}),r("datarobot.com","DataRobot","DATA_ANALYSIS","LOW",{isEnterprise:!0}),r("h2o.ai","H2O.ai","DATA_ANALYSIS","MEDIUM"),r("rapidminer.com","RapidMiner","DATA_ANALYSIS","MEDIUM"),r("knime.com","KNIME","DATA_ANALYSIS","MEDIUM"),r("alteryx.com","Alteryx","DATA_ANALYSIS","LOW",{isEnterprise:!0}),r("tableau.com","Tableau AI","DATA_ANALYSIS","LOW",{isEnterprise:!0}),r("mode.com","Mode Analytics","DATA_ANALYSIS","MEDIUM"),r("deepnote.com","Deepnote","DATA_ANALYSIS","HIGH"),r("observable.com","Observable","DATA_ANALYSIS","MEDIUM"),r("noteable.io","Noteable","DATA_ANALYSIS","HIGH"),r("perplexity.ai","Perplexity Search","SEARCH","MEDIUM"),r("you.com","You.com Search","SEARCH","MEDIUM"),r("andi.ai","Andi","SEARCH","LOW"),r("kagi.com","Kagi","SEARCH","LOW"),r("metaphor.systems","Metaphor","SEARCH","MEDIUM"),r("exa.ai","Exa","SEARCH","MEDIUM"),r("tavily.com","Tavily","SEARCH","MEDIUM"),r("consensus.app","Consensus","SEARCH","LOW"),r("elicit.com","Elicit","SEARCH","MEDIUM"),r("elicit.org","Elicit","SEARCH","MEDIUM"),r("searchgpt.com","SearchGPT","SEARCH","MEDIUM"),r("brave.com/search/ai","Brave AI Search","SEARCH","LOW"),r("neeva.com","Neeva","SEARCH","LOW"),r("socratic.org","Socratic","SEARCH","LOW"),r("devv.ai","Devv AI","SEARCH","MEDIUM"),r("iask.ai","iAsk AI","SEARCH","LOW"),r("chatpdf.com","ChatPDF","SEARCH","MEDIUM"),r("smodin.io","Smodin","WRITING","MEDIUM"),r("ai-writer.com","AI Writer","WRITING","MEDIUM"),r("scalenut.com","Scalenut","WRITING","MEDIUM"),r("closerscopy.com","ClosersCopy","WRITING","MEDIUM"),r("longshot.ai","LongShot AI","WRITING","MEDIUM"),r("fig.io","Fig AI","CODE_GEN","MEDIUM"),r("warp.dev","Warp Terminal AI","CODE_GEN","MEDIUM"),r("raycast.com","Raycast AI","CODE_GEN","MEDIUM"),r("app.codeanywhere.com","Codeanywhere AI","CODE_GEN","MEDIUM"),r("zed.dev","Zed AI","CODE_GEN","MEDIUM"),r("gencraft.com","Gencraft","IMAGE_GEN","LOW"),r("deepai.org","DeepAI","IMAGE_GEN","LOW"),r("artbreeder.com","Artbreeder","IMAGE_GEN","LOW"),r("fotor.com/ai","Fotor AI","IMAGE_GEN","LOW"),r("remove.bg","Remove.bg","IMAGE_GEN","LOW"),r("photoroom.com","PhotoRoom AI","IMAGE_GEN","LOW"),r("app.recraft.ai","Recraft AI","IMAGE_GEN","MEDIUM"),r("pecan.ai","Pecan AI","DATA_ANALYSIS","HIGH"),r("apteo.co","Apteo","DATA_ANALYSIS","HIGH"),r("mindsdb.com","MindsDB","DATA_ANALYSIS","MEDIUM"),r("zapier.com/ai","Zapier AI","OTHER","MEDIUM"),r("make.com","Make (Integromat) AI","OTHER","MEDIUM"),r("otter.ai","Otter.ai","OTHER","HIGH"),r("fireflies.ai","Fireflies.ai","OTHER","HIGH"),r("descript.com","Descript","OTHER","MEDIUM"),r("synthesia.io","Synthesia","OTHER","MEDIUM"),r("elevenlabs.io","ElevenLabs","OTHER","MEDIUM"),r("murf.ai","Murf AI","OTHER","MEDIUM"),r("resemble.ai","Resemble AI","OTHER","MEDIUM"),r("loom.com","Loom AI","OTHER","MEDIUM"),r("beautiful.ai","Beautiful.ai","OTHER","LOW"),r("gamma.app","Gamma","OTHER","MEDIUM"),r("tome.app","Tome","OTHER","MEDIUM"),r("magician.design","Magician","OTHER","MEDIUM"),r("uizard.io","Uizard","OTHER","MEDIUM"),r("huggingface.co/spaces","HuggingFace Spaces","OTHER","MEDIUM"),r("roboflow.com","Roboflow","OTHER","MEDIUM"),r("scale.com","Scale AI","OTHER","MEDIUM"),r("labelbox.com","Labelbox","OTHER","MEDIUM")],gn=new Set(Y.map(e=>e.domain.toLowerCase())),O=new Map;for(let e of Y){let t=e.domain.toLowerCase();O.has(t)||O.set(t,e)}function Xt(e){try{return e.includes("://")||(e="https://"+e),new URL(e).hostname.toLowerCase()}catch{return null}}function Ge(e){let t=Xt(e);if(!t)return null;let n=O.get(t);if(n)return n;try{let o=new URL(e.includes("://")?e:"https://"+e),s=(o.hostname+o.pathname).toLowerCase().replace(/\/+$/,""),i=O.get(s);if(i)return i}catch{}let a=t.split(".");for(let o=1;o<a.length-1;o++){let s=a.slice(o).join("."),i=O.get(s);if(i)return i}return null}function Zt(e){return Ge(e)!==null}var Qt=new Set(["replit.com","sourcegraph.com","idx.dev","stackblitz.com","codepen.io","codesandbox.io","gitpod.io","fig.io","warp.dev","raycast.com","app.codeanywhere.com","zed.dev","anyscale.com","grammarly.com","notion.so","hex.tech","app.hex.tech","rows.com","breadcrumbs.io","databricks.com","datarobot.com","h2o.ai","rapidminer.com","knime.com","alteryx.com","tableau.com","mode.com","deepnote.com","observable.com","noteable.io","mindsdb.com","kagi.com","make.com","loom.com","roboflow.com","scale.com","labelbox.com"]),er=["redaktyn.com"];function Be(){let e=new Set;for(let t of Y){let n=t.domain.toLowerCase();n.includes("/")||Qt.has(n)||e.add(n)}for(let t of er)e.add(t.toLowerCase());return Array.from(e).sort()}var ue=null;function he(e){ue||(ue=new Set(Be()));let t=e.toLowerCase();for(let n of ue)if(t===n||t.endsWith(`.${n}`))return!0;return!1}function tr(e){let t=e.toLowerCase();return[`*://${t}/*`,`*://*.${t}/*`]}function fe(e){let t=e.trim().toLowerCase();return!t||(t=t.replace(/^[a-z][a-z0-9+.-]*:\/\//,""),t=t.split(/[/?#]/)[0],t=t.split("@").pop(),t=t.split(":")[0],!/^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)+$/.test(t))?null:t}function rr(e){return e instanceof Uint8Array||ArrayBuffer.isView(e)&&e.constructor.name==="Uint8Array"}function M(e){if(!Number.isSafeInteger(e)||e<0)throw new Error("positive integer expected, got "+e)}function D(e,...t){if(!rr(e))throw new Error("Uint8Array expected");if(t.length>0&&!t.includes(e.length))throw new Error("Uint8Array expected of length "+t+", got length="+e.length)}function P(e){if(typeof e!="function"||typeof e.create!="function")throw new Error("Hash should be wrapped by utils.createHasher");M(e.outputLen),M(e.blockLen)}function H(e,t=!0){if(e.destroyed)throw new Error("Hash instance has been destroyed");if(t&&e.finished)throw new Error("Hash#digest() has already been called")}function We(e,t){D(e);let n=t.outputLen;if(e.length<n)throw new Error("digestInto() expects output buffer of length at least "+n)}function g(...e){for(let t=0;t<e.length;t++)e[t].fill(0)}function v(e){return new DataView(e.buffer,e.byteOffset,e.byteLength)}function E(e,t){return e<<32-t|e>>>t}var Ve=typeof Uint8Array.from([]).toHex=="function"&&typeof Uint8Array.fromHex=="function",nr=Array.from({length:256},(e,t)=>t.toString(16).padStart(2,"0"));function j(e){if(D(e),Ve)return e.toHex();let t="";for(let n=0;n<e.length;n++)t+=nr[e[n]];return t}var I={_0:48,_9:57,A:65,F:70,a:97,f:102};function Fe(e){if(e>=I._0&&e<=I._9)return e-I._0;if(e>=I.A&&e<=I.F)return e-(I.A-10);if(e>=I.a&&e<=I.f)return e-(I.a-10)}function Ke(e){if(typeof e!="string")throw new Error("hex string expected, got "+typeof e);if(Ve)return Uint8Array.fromHex(e);let t=e.length,n=t/2;if(t%2)throw new Error("hex string expected, got unpadded hex of length "+t);let a=new Uint8Array(n);for(let o=0,s=0;o<n;o++,s+=2){let i=Fe(e.charCodeAt(s)),c=Fe(e.charCodeAt(s+1));if(i===void 0||c===void 0){let d=e[s]+e[s+1];throw new Error('hex string expected, got non-hex character "'+d+'" at index '+s)}a[o]=i*16+c}return a}var or=async()=>{};async function ze(e,t,n){let a=Date.now();for(let o=0;o<e;o++){n(o);let s=Date.now()-a;s>=0&&s<t||(await or(),a+=s)}}function b(e){if(typeof e!="string")throw new Error("string expected");return new Uint8Array(new TextEncoder().encode(e))}function w(e){return typeof e=="string"&&(e=b(e)),D(e),e}function me(e){return typeof e=="string"&&(e=b(e)),D(e),e}function Ye(e,t){if(t!==void 0&&{}.toString.call(t)!=="[object Object]")throw new Error("options should be object or undefined");return Object.assign(e,t)}var U=class{};function je(e){let t=a=>e().update(w(a)).digest(),n=e();return t.outputLen=n.outputLen,t.blockLen=n.blockLen,t.create=()=>e(),t}var $=class extends U{constructor(t,n){super(),this.finished=!1,this.destroyed=!1,P(t);let a=w(n);if(this.iHash=t.create(),typeof this.iHash.update!="function")throw new Error("Expected instance of class which extends utils.Hash");this.blockLen=this.iHash.blockLen,this.outputLen=this.iHash.outputLen;let o=this.blockLen,s=new Uint8Array(o);s.set(a.length>o?t.create().update(a).digest():a);for(let i=0;i<s.length;i++)s[i]^=54;this.iHash.update(s),this.oHash=t.create();for(let i=0;i<s.length;i++)s[i]^=106;this.oHash.update(s),g(s)}update(t){return H(this),this.iHash.update(t),this}digestInto(t){H(this),D(t,this.outputLen),this.finished=!0,this.iHash.digestInto(t),this.oHash.update(t),this.oHash.digestInto(t),this.destroy()}digest(){let t=new Uint8Array(this.oHash.outputLen);return this.digestInto(t),t}_cloneInto(t){t||(t=Object.create(Object.getPrototypeOf(this),{}));let{oHash:n,iHash:a,finished:o,destroyed:s,blockLen:i,outputLen:c}=this;return t=t,t.finished=o,t.destroyed=s,t.blockLen=i,t.outputLen=c,t.oHash=n._cloneInto(t.oHash),t.iHash=a._cloneInto(t.iHash),t}clone(){return this._cloneInto()}destroy(){this.destroyed=!0,this.oHash.destroy(),this.iHash.destroy()}},y=(e,t,n)=>new $(e,t).update(n).digest();y.create=(e,t)=>new $(e,t);function ar(e,t,n,a){if(typeof e.setBigUint64=="function")return e.setBigUint64(t,n,a);let o=BigInt(32),s=BigInt(4294967295),i=Number(n>>o&s),c=Number(n&s),d=a?4:0,u=a?0:4;e.setUint32(t+d,i,a),e.setUint32(t+u,c,a)}function $e(e,t,n){return e&t^~e&n}function qe(e,t,n){return e&t^e&n^t&n}var q=class extends U{constructor(t,n,a,o){super(),this.finished=!1,this.length=0,this.pos=0,this.destroyed=!1,this.blockLen=t,this.outputLen=n,this.padOffset=a,this.isLE=o,this.buffer=new Uint8Array(t),this.view=v(this.buffer)}update(t){H(this),t=w(t),D(t);let{view:n,buffer:a,blockLen:o}=this,s=t.length;for(let i=0;i<s;){let c=Math.min(o-this.pos,s-i);if(c===o){let d=v(t);for(;o<=s-i;i+=o)this.process(d,i);continue}a.set(t.subarray(i,i+c),this.pos),this.pos+=c,i+=c,this.pos===o&&(this.process(n,0),this.pos=0)}return this.length+=t.length,this.roundClean(),this}digestInto(t){H(this),We(t,this),this.finished=!0;let{buffer:n,view:a,blockLen:o,isLE:s}=this,{pos:i}=this;n[i++]=128,g(this.buffer.subarray(i)),this.padOffset>o-i&&(this.process(a,0),i=0);for(let p=i;p<o;p++)n[p]=0;ar(a,o-8,BigInt(this.length*8),s),this.process(a,0);let c=v(t),d=this.outputLen;if(d%4)throw new Error("_sha2: outputLen should be aligned to 32bit");let u=d/4,h=this.get();if(u>h.length)throw new Error("_sha2: outputLen bigger than state");for(let p=0;p<u;p++)c.setUint32(4*p,h[p],s)}digest(){let{buffer:t,outputLen:n}=this;this.digestInto(t);let a=t.slice(0,n);return this.destroy(),a}_cloneInto(t){t||(t=new this.constructor),t.set(...this.get());let{blockLen:n,buffer:a,length:o,finished:s,destroyed:i,pos:c}=this;return t.destroyed=i,t.finished=s,t.length=o,t.pos=c,o%n&&t.buffer.set(a),t}clone(){return this._cloneInto()}},k=Uint32Array.from([1779033703,3144134277,1013904242,2773480762,1359893119,2600822924,528734635,1541459225]);var sr=Uint32Array.from([1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298]),R=new Uint32Array(64),J=class extends q{constructor(t=32){super(64,t,8,!1),this.A=k[0]|0,this.B=k[1]|0,this.C=k[2]|0,this.D=k[3]|0,this.E=k[4]|0,this.F=k[5]|0,this.G=k[6]|0,this.H=k[7]|0}get(){let{A:t,B:n,C:a,D:o,E:s,F:i,G:c,H:d}=this;return[t,n,a,o,s,i,c,d]}set(t,n,a,o,s,i,c,d){this.A=t|0,this.B=n|0,this.C=a|0,this.D=o|0,this.E=s|0,this.F=i|0,this.G=c|0,this.H=d|0}process(t,n){for(let p=0;p<16;p++,n+=4)R[p]=t.getUint32(n,!1);for(let p=16;p<64;p++){let x=R[p-15],f=R[p-2],L=E(x,7)^E(x,18)^x>>>3,S=E(f,17)^E(f,19)^f>>>10;R[p]=S+R[p-7]+L+R[p-16]|0}let{A:a,B:o,C:s,D:i,E:c,F:d,G:u,H:h}=this;for(let p=0;p<64;p++){let x=E(c,6)^E(c,11)^E(c,25),f=h+x+$e(c,d,u)+sr[p]+R[p]|0,S=(E(a,2)^E(a,13)^E(a,22))+qe(a,o,s)|0;h=u,u=d,d=c,c=i+f|0,i=s,s=o,o=a,a=f+S|0}a=a+this.A|0,o=o+this.B|0,s=s+this.C|0,i=i+this.D|0,c=c+this.E|0,d=d+this.F|0,u=u+this.G|0,h=h+this.H|0,this.set(a,o,s,i,c,d,u,h)}roundClean(){g(R)}destroy(){this.set(0,0,0,0,0,0,0,0),g(this.buffer)}};var Je=je(()=>new J);var T=Je;function ir(e,t,n,a){P(e);let o=Ye({dkLen:32,asyncTick:10},a),{c:s,dkLen:i,asyncTick:c}=o;if(M(s),M(i),M(c),s<1)throw new Error("iterations (c) should be >= 1");let d=me(t),u=me(n),h=new Uint8Array(i),p=y.create(e,d),x=p._cloneInto().update(u);return{c:s,dkLen:i,asyncTick:c,DK:h,PRF:p,PRFSalt:x}}function cr(e,t,n,a,o){return e.destroy(),t.destroy(),a&&a.destroy(),g(o),n}async function Xe(e,t,n,a){let{c:o,dkLen:s,asyncTick:i,DK:c,PRF:d,PRFSalt:u}=ir(e,t,n,a),h,p=new Uint8Array(4),x=v(p),f=new Uint8Array(d.outputLen);for(let L=1,S=0;S<s;L++,S+=d.outputLen){let K=c.subarray(S,S+d.outputLen);x.setInt32(0,L,!1),(h=u._cloneInto(h)).update(p).digestInto(f),K.set(f.subarray(0,K.length)),await ze(o-1,i,()=>{d._cloneInto(h).update(f).digestInto(f);for(let z=0;z<K.length;z++)K[z]^=f[z]})}return cr(d,u,c,h,f)}function lr(e,t,n){return P(e),n===void 0&&(n=new Uint8Array(e.outputLen)),y(e,w(n),w(t))}var ge=Uint8Array.from([0]),Ze=Uint8Array.of();function dr(e,t,n,a=32){P(e),M(a);let o=e.outputLen;if(a>255*o)throw new Error("Length should be <= 255*HashLen");let s=Math.ceil(a/o);n===void 0&&(n=Ze);let i=new Uint8Array(s*o),c=y.create(e,t),d=c._cloneInto(),u=new Uint8Array(c.outputLen);for(let h=0;h<s;h++)ge[0]=h+1,d.update(h===0?Ze:u).update(n).update(ge).digestInto(u),i.set(u,o*h),c._cloneInto(d);return c.destroy(),d.destroy(),g(u,ge),i.slice(0,a)}var Qe=(e,t,n,a,o)=>dr(e,lr(e,t,n),a,o);var pr=8,ur="hmac-sha256-v1",hr="normalization-v1",fr="normalization-v2",mr="pbkdf2-sha256-600k-v2",et=6e5,gr=et,Ee=32,tt="[\\u00ad\\u200b-\\u200f\\u2060-\\u2064\\ufeff]",Er=new RegExp(tt,"g");function be(e){let t=e.normalize("NFC");return t=t.replace(/\r\n/g,`
+`).replace(/[\r\u2028\u2029]/g,`
+`),t=t.replace(Er,""),t=t.trim(),t}function N(e){if(e.length===36&&e[8]==="-"&&e[13]==="-"&&e[18]==="-"&&e[23]==="-"){let t=e.replace(/-/g,"");if(/^[0-9a-fA-F]{32}$/.test(t))return e.toLowerCase()}return e}function X(e){return N(be(e))}function G(e){return be(e).replace(/\s/g,"")}function br(e,t){return Q(N(G(e)),t)}function Z(e){return G(e).toLowerCase()}function yr(e,t){return Q(Z(e),t)}function Q(e,t){return j(y(T,t,b(e)))}function xr(e,t){return Q(X(e),t)}async function Ar(e,t){let n=b(e),a=T(b(t));return Xe(T,n,a,{c:et,dkLen:Ee})}var rt="redaktyn-project-key-v1",Ir=b(rt);function kr(e,t){if(e.length!==Ee)throw new Error("deriveProjectKey: org key must be 32 bytes");if(!t)throw new Error("deriveProjectKey: projectId is required");return Qe(T,e,b(t),Ir,Ee)}var nt="vaultx-passphrase-verify-v1",Sr=b(nt);function Mr(e){return j(y(T,e,Sr))}function Dr(){return crypto.getRandomValues(new Uint8Array(32))}function wr(e){return j(e)}function Rr(e){return Ke(e)}function ot(e){return e.length<12?{ok:!1,error:"Passphrase must be at least 12 characters."}:/[A-Z]/.test(e)?/[a-z]/.test(e)?/[0-9]/.test(e)?/[^A-Za-z0-9]/.test(e)?{ok:!0}:{ok:!1,error:"Passphrase must include at least one special character (e.g. !@#$%)."}:{ok:!1,error:"Passphrase must include at least one number."}:{ok:!1,error:"Passphrase must include at least one lowercase letter."}:{ok:!1,error:"Passphrase must include at least one uppercase letter."}}var Tr=["password","passphrase","letmein","welcome","monkey","dragon","qwerty","qwertyuiop","asdfgh","zxcvbn","iloveyou","sunshine","princess","football","baseball","superman","batman","master","shadow","michael","jennifer","trustno","starwars","whatever","freedom","computer","internet","samsung","google","facebook","admin","administrator","root","changeme","secret","default","login","abc","test","temp","demo","company","corporate"];function Cr(e){return e.toLowerCase().replace(/[@4]/g,"a").replace(/[3]/g,"e").replace(/[1!|]/g,"i").replace(/[0]/g,"o").replace(/[5$]/g,"s").replace(/[7]/g,"t")}function Pr(e){let t=e.toLowerCase();if(/^(.)\1+$/.test(t))return!0;let n=["abcdefghijklmnopqrstuvwxyz","0123456789","qwertyuiopasdfghjklzxcvbnm"],a=t.replace(/[^a-z0-9]/g,"");if(a.length>=6){for(let o of n)if(o.includes(a)||[...o].reverse().join("").includes(a))return!0}return!1}function _r(e){let t=ot(e);if(!t.ok)return t;let a=Cr(e).replace(/[^a-z]/g,"");for(let o of Tr)if(a===o||a.startsWith(o)||a.endsWith(o))return{ok:!1,error:"That passphrase is built on a word attackers try first. Because the server stores a verifier for this key, a guessable passphrase can be cracked offline \u2014 pick something unrelated to a common word."};return Pr(e)?{ok:!1,error:"That passphrase is a repeated character or a keyboard sequence. Pick something without a predictable pattern."}:new Set(e).size<8?{ok:!1,error:"That passphrase reuses too few distinct characters. Use at least eight different ones."}:{ok:!0}}function at(e){return!e||typeof e!="object"?!1:e.version===2}function st(e){if(!e||typeof e!="object")return!1;let t=e;return typeof t.encryptedKey=="string"&&t.encryptedKey.length>0&&typeof t.iv=="string"&&t.iv.length>0&&typeof t.salt=="string"&&t.salt.length>0}function Ur(e){return at(e)?e:st(e)?{version:2,passphrase:e}:null}function B(e){let t=new ArrayBuffer(e.byteLength);return new Uint8Array(t).set(e),t}function ye(e){let t="";for(let n of e)t+=String.fromCharCode(n);return btoa(t)}function xe(e){let t=atob(e),n=new Uint8Array(t.length);for(let a=0;a<t.length;a++)n[a]=t.charCodeAt(a);return n}function it(e){let t=new Uint8Array(e);return crypto.getRandomValues(t),t}var ee=32,Hr=256,vr=12;function Lr(){return it(ee)}async function ct(e){if(e.byteLength===0)throw new Error("PRF output is empty");let t=await crypto.subtle.digest("SHA-256",B(e));return crypto.subtle.importKey("raw",t,{name:"AES-GCM",length:Hr},!1,["encrypt","decrypt"])}async function Or(e,t,n,a,o){if(e.byteLength!==32)throw new Error("HMAC key must be 32 bytes");if(t.byteLength!==ee)throw new Error("PRF output must be 32 bytes");if(n.byteLength!==ee)throw new Error("PRF salt must be 32 bytes");if(!a)throw new Error("credentialId is required");let s=await ct(t),i=it(vr),c=await crypto.subtle.encrypt({name:"AES-GCM",iv:B(i)},s,B(e)),d={credentialId:a,prfSalt:ye(n),iv:ye(i),ciphertext:ye(new Uint8Array(c)),createdAt:Date.now()};return o&&o.trim().length>0&&(d.label=o.trim().slice(0,64)),d}async function Nr(e,t){if(t.byteLength!==ee)throw new Error("PRF output must be 32 bytes");let n=await ct(t),a=xe(e.iv),o=xe(e.ciphertext),s=await crypto.subtle.decrypt({name:"AES-GCM",iv:B(a)},n,B(o)),i=new Uint8Array(s);if(i.byteLength!==32)throw i.fill(0),new Error("Invalid HMAC key material");return i}function Gr(e){return xe(e.prfSalt)}function Br(e,t){let a=(e?.passkey??[]).filter(o=>o.credentialId!==t.credentialId);return{version:2,passphrase:e?.passphrase,passkey:[...a,t]}}function Fr(e,t){let n=e?.passkey??[];return{version:2,passphrase:e?.passphrase,passkey:n.filter(a=>a.credentialId!==t)}}function Wr(e,t){return e?.passkey?.find(n=>n.credentialId===t)}function Vr(e){let t=e.split(/\r?\n/),n=[];for(let a of t)a.startsWith("+++")||a.startsWith("---")||a.startsWith("+")&&!a.startsWith("+++")&&n.push(a.slice(1));return n.join(`
+`)}var lt="redaktyn-scan-prefilter-v1",dt="v1.",pt=65535,F=Math.imul,Ie=pt+1,ut=/^v1\.[0-9a-f]{12}$/;function ht(e){if(e.length<4)throw new Error("scanPrefilterParams: seed too short");return{base:e[0]<<24|e[1]<<16|e[2]<<8|e[3]|1}}function ft(e){return y(T,e,b(lt))}function Kr(e){return(e>=65&&e<=90?e+32:e)+1}function mt(e){let t=new Int32Array(e.length);for(let n=0;n<e.length;n++)t[n]=Kr(e.charCodeAt(n));return t}function zr(e,t){let n=1,a=e|0,o=t;for(;o>0;)o&1&&(n=F(n,a)),a=F(a,a),o>>>=1;return n}function gt(e,t,n,a){let o=0;for(let s=n;s<n+a;s++)o=F(o,e)+t[s]|0;return o}function te(e,t){return gt(e.base,mt(t),0,t.length)>>>16}function Yr(e,t,n){let a=e.base,o=zr(a,n-1),s=-2,i=0;return c=>(c===s+1?i=F(i-F(t[s],o)|0,a)+t[s+n]|0:i=gt(a,t,c,n),s=c,i>>>16)}function Ae(e){return(e&pt).toString(16).padStart(4,"0")}function Et(e,t){return dt+Ae(te(e,t.exact))+Ae(te(e,t.collapsed))+Ae(te(e,t.lower))}function jr(e,t){return Et(ht(ft(t)),{exact:X(e),collapsed:N(G(e)),lower:Z(e)})}function ke(e){if(typeof e!="string"||!ut.test(e))return null;let t=e.slice(dt.length);return{exact:parseInt(t.slice(0,4),16),collapsed:parseInt(t.slice(4,8),16),lower:parseInt(t.slice(8,12),16)}}var ne=15e5,W=5*1024*1024,bt=256,yt=5e4,xt=1e4;function At(e){return ke(e.scanPrefilter)!==null}function Se(e,t=!1){let n=[new Map,new Map,new Map],a=(o,s,i)=>{if(typeof s!="number"||!(s>0))return;let c=n[o].get(s);n[o].set(s,c?{windowLen:s,prefiltered:c.prefiltered&&i,entries:c.entries+1}:{windowLen:s,prefiltered:i,entries:1})};for(let o of e){let s=t||At(o);a(0,o.length,s),a(1,o.lengthStripped,s),a(2,o.lengthLower,s)}return n.flatMap(o=>[...o.values()])}function Me(e,t){let n=0;for(let a of t){let o=Math.max(0,e-a.windowLen+1);n+=a.prefiltered?Math.ceil(o/bt)+Math.ceil(o*a.entries/Ie):o}return n}function re(e){if(e.length===0)return 1/0;if(Me(W,e)<=ne)return W;let t=0,n=W;for(;t<n;){let a=Math.ceil((t+n)/2);Me(a,e)<=ne?t=a:n=a-1}return t}function $r(e){let t=new Set,n=new Set,a=new Set;for(let o of e)o.length>0&&t.add(o.length),typeof o.lengthStripped=="number"&&o.lengthStripped>0&&n.add(o.lengthStripped),typeof o.lengthLower=="number"&&o.lengthLower>0&&a.add(o.lengthLower);return[...t,...n,...a]}function qr(e){let t=e.length;if(t===0)return 1/0;let n=e.reduce((a,o)=>a+o,0);return Math.max(0,Math.floor((ne+n-t)/t))}function Jr(e){let t=Se(e),n=re(t),o={windowLen:t.length?Math.round(t.reduce((i,c)=>i+c.windowLen,0)/t.length):40,prefiltered:!0,entries:1},s=re([...t,o,o,o]);return{windowLengths:t.length,maxPasteChars:n,severity:n<xt?"alarm":n<yt?"warn":"ok",maxPasteCharsAfterOneMore:s,legacySecrets:e.filter(i=>!At(i)).length,maxPasteCharsIfReenrolled:re(Se(e,!0)),atCharacterCap:n===W}}var ro=200;var De={"stripe-live-secret":"Stripe live secret key","stripe-restricted-live":"Stripe restricted live key","stripe-test":"Stripe test key","stripe-publishable":"Stripe publishable key","github-pat":"GitHub personal access token","github-oauth":"GitHub OAuth token","github-app":"GitHub app token","github-fine-grained":"GitHub fine-grained token","npm-token":"npm access token","aws-access-key-id":"AWS access key ID","google-api-key":"Google API key","anthropic-api-key":"Anthropic API key","openai-api-key":"OpenAI API key","gitlab-pat":"GitLab personal access token","slack-token":"Slack token","slack-app-token":"Slack app token","shopify-token":"Shopify access token","digitalocean-token":"DigitalOcean token","huggingface-token":"Hugging Face token","stripe-webhook-secret":"Stripe webhook signing secret","openrouter-api-key":"OpenRouter API key","groq-api-key":"Groq API key","xai-api-key":"xAI API key","perplexity-api-key":"Perplexity API key","replicate-token":"Replicate API token","google-oauth-client-secret":"Google OAuth client secret","azure-ad-client-secret":"Azure AD client secret","gitlab-token":"GitLab token","slack-webhook":"Slack webhook URL","discord-webhook":"Discord webhook URL","discord-bot-token":"Discord bot token","telegram-bot-token":"Telegram bot token","sendgrid-api-key":"SendGrid API key","twilio-api-key":"Twilio API key","mailgun-api-key":"Mailgun API key","mailchimp-api-key":"Mailchimp API key","pypi-token":"PyPI upload token","docker-hub-token":"Docker Hub access token","vault-token":"HashiCorp Vault token","terraform-cloud-token":"Terraform Cloud token","doppler-token":"Doppler token","linear-api-key":"Linear API key","notion-token":"Notion integration token","airtable-token":"Airtable personal access token","atlassian-api-token":"Atlassian API token","square-token":"Square access token","sentry-token":"Sentry auth token","new-relic-key":"New Relic API key","grafana-token":"Grafana token","postman-api-key":"Postman API key","supabase-token":"Supabase secret key","supabase-publishable":"Supabase publishable key","netlify-token":"Netlify access token","age-secret-key":"age secret key","private-key":"Private key","connection-string-password":"Password in a connection string","neon-db-password":"Neon database password","assigned-secret":"Value assigned to a credential name","aws-secret-access-key":"AWS secret access key","aws-session-token":"AWS session token","gcp-service-account-key":"Google Cloud service-account key","azure-storage-key":"Azure storage account key","cloudflare-api-token":"Cloudflare API token","cloud-provider-token":"Cloud platform token","hyperscaler-access-key":"Cloud access key (Alibaba, Tencent, IBM, Oracle)","bitbucket-token":"Bitbucket token","ci-token":"CI/CD token","package-registry-token":"Package registry token","pulumi-token":"Pulumi access token","managed-db-token":"Managed database token","jdbc-ado-password":"Password in a JDBC or ADO.NET connection string","warehouse-credential":"Data warehouse credential","payment-provider-secret":"Payment gateway secret","commerce-token":"Commerce platform token","llm-provider-key":"AI provider API key","email-provider-key":"Email provider key","sms-provider-secret":"SMS or voice provider secret","productivity-saas-token":"Productivity SaaS token","observability-key":"Monitoring or logging key","signing-secret":"Signing or encryption secret","oauth-client-secret":"OAuth client secret","long-lived-jwt":"Long-lived JWT","http-basic-auth":"HTTP basic-auth credentials","session-cookie":"Session cookie","config-password":"Password in configuration","crypto-wallet-secret":"Crypto wallet key or seed phrase","vpn-private-key":"VPN private key","env-file":"Secrets in an .env file","kubeconfig-credential":"Kubernetes config credential","k8s-secret-manifest":"Kubernetes Secret value","terraform-secret":"Secret in Terraform state or variables","credential-file":"Credentials file (.npmrc, .netrc, docker, git)","presigned-url":"Pre-signed URL that is still valid","payment-card-number":"Payment card number","aadhaar-number":"Aadhaar number","india-tax-id":"PAN or personal GSTIN","national-id-number":"SSN or National Insurance number","bank-account-details":"Bank account details","customer-data-dump":"Customer data export"},It=Object.keys(De),V="unrecognised",Xr="assigned-secret",kt=[...It,V];function Zr(e){return kt.includes(e)}function Qr(e){return e===V?"Unrecognised credential":De[e]??e}var St={credential:"Credentials",infra:"Infrastructure",pii:"Personal data"},en={credential:"Keys, tokens and passwords that grant access to something. An admin can protect one on the spot, and the next paste of it is blocked.",infra:"Files that carry credentials in bulk \u2014 an .env dump, a kubeconfig, a Terraform state file. One paste can hand over a whole environment.",pii:"Card, identity and bank numbers that belong to people, not to the org. Never protected, only removed from the message."},tn={checksum:"Checksum verified",structure:"Structure decoded",prefix:"Provider format",context:"Named and random"},l=(e,t,n,a,o)=>({id:e,family:t,name:n,slugs:a,...o}),we=[l(1,"credential","AWS access keys",["aws-access-key-id","aws-secret-access-key"],{proof:"prefix",catches:"AKIA\u2026 access key IDs, and the 40-character secret access key beside them in a credentials file, an env var or a chat message.",ignores:"AWS's documented example keys (AKIAIOSFODNN7EXAMPLE), ARNs and account IDs."}),l(2,"credential","AWS session tokens",["aws-session-token"],{proof:"prefix",catches:"Temporary STS session tokens (IQoJb3JpZ2lu\u2026, FwoGZXIvYXdz\u2026) copied out of a console or a CLI profile.",ignores:"Tokens cut short with an ellipsis, and placeholders."}),l(3,"credential","Google Cloud credentials",["gcp-service-account-key","google-api-key"],{proof:"structure",catches:"Service-account JSON files whose private key is a real key, and AIza\u2026 API keys.",ignores:"Service-account JSON with a truncated or random-filler private key, and AIza followed by filler."}),l(4,"credential","Azure storage keys",["azure-storage-key"],{proof:"context",catches:"AccountKey= and SharedAccessKey= inside Azure Storage, Service Bus and Event Hubs connection strings.",ignores:"The public Azurite emulator key (devstoreaccount1) and <your-account-key> placeholders."}),l(5,"credential","Azure AD client secrets",["azure-ad-client-secret"],{proof:"prefix",catches:"Entra ID app client secrets \u2014 the 40-character values with Q~ at position four.",ignores:"Tenant and client IDs, which are GUIDs and not secret."}),l(6,"credential","Cloudflare tokens",["cloudflare-api-token"],{proof:"context",catches:"Cloudflare API tokens assigned to a Cloudflare variable, and v1.0- origin CA keys.",ignores:"Zone and account IDs."}),l(7,"credential","Developer cloud tokens",["digitalocean-token","netlify-token","cloud-provider-token"],{proof:"prefix",catches:"DigitalOcean (dop_v1_), Netlify (nfp_), Heroku (HRKU-), Fly.io (fo1_), Render (rnd_) and Vercel tokens.",ignores:"App names and region settings, and tokens made of filler characters."}),l(8,"credential","Other cloud access keys",["hyperscaler-access-key"],{proof:"prefix",catches:"Alibaba Cloud (LTAI\u2026), Tencent Cloud (AKID\u2026) and IBM Cloud API keys.",ignores:"Region names and other configuration that sits next to them."}),l(9,"credential","GitHub tokens",["github-pat","github-oauth","github-app","github-fine-grained"],{proof:"checksum",catches:"Classic and fine-grained personal access tokens, OAuth tokens and app tokens (ghp_, gho_, ghs_, github_pat_) \u2014 each carries a CRC32 checksum, and it has to verify.",ignores:"Strings shaped like a GitHub token whose checksum fails, ${{ secrets.GITHUB_TOKEN }} references, and repository URLs."}),l(10,"credential","GitLab tokens",["gitlab-pat","gitlab-token"],{proof:"prefix",catches:"GitLab personal access tokens (glpat-) and runner tokens (glrt-).",ignores:"GitLab URLs and filler tokens."}),l(11,"credential","Bitbucket and Atlassian tokens",["atlassian-api-token","bitbucket-token"],{proof:"prefix",catches:"Atlassian API tokens (ATATT\u2026), Bitbucket app passwords and access tokens (ATBB\u2026).",ignores:"Jira and Confluence site URLs."}),l(12,"credential","CI/CD tokens",["ci-token"],{proof:"prefix",catches:"CircleCI (CCIPAT_), Buildkite (bkua_) and Jenkins API tokens.",ignores:"Build numbers, job URLs and pipeline names."}),l(13,"credential","Package registry tokens",["npm-token","pypi-token","docker-hub-token","package-registry-token"],{proof:"checksum",catches:"npm tokens (npm_, checksum-verified), PyPI upload tokens, Docker Hub PATs (dckr_pat_), RubyGems and NuGet keys.",ignores:"npm-shaped tokens whose checksum fails, and registry URLs."}),l(14,"credential","Infrastructure-as-code and secret-manager tokens",["vault-token","terraform-cloud-token","doppler-token","pulumi-token"],{proof:"prefix",catches:"HashiCorp Vault tokens (hvs.), Terraform Cloud tokens (.atlasv1.), Doppler (dp.st.) and Pulumi (pul-) tokens.",ignores:"Vault addresses and workspace names."}),l(15,"credential","Database connection strings",["connection-string-password"],{proof:"context",catches:"The password inside a postgres://, mysql://, mongodb+srv://, redis:// or amqp:// URL pointing at a real host.",ignores:"localhost and example.com hosts, user:password, ${DB_PASSWORD} references and <password> placeholders."}),l(16,"credential","Managed database tokens",["neon-db-password","supabase-token","supabase-publishable","managed-db-token"],{proof:"prefix",catches:"Neon passwords (npg_), Supabase service and secret keys (sbp_, sb_secret_), PlanetScale and Upstash tokens.",ignores:"Supabase publishable keys, which are meant to be public, and project IDs."}),l(17,"credential","JDBC and ADO.NET passwords",["jdbc-ado-password"],{proof:"context",catches:"password= and Password= inside JDBC URLs and SQL Server / ADO.NET connection strings.",ignores:"Password=password, ${SA_PASSWORD} and <your_password>."}),l(18,"credential","Data warehouse credentials",["warehouse-credential"],{proof:"prefix",catches:"Databricks tokens (dapi\u2026), and Snowflake and ClickHouse passwords.",ignores:"Account locators and warehouse names."}),l(19,"credential","Stripe keys",["stripe-live-secret","stripe-restricted-live","stripe-webhook-secret","stripe-test","stripe-publishable"],{proof:"prefix",catches:"Live secret keys (sk_live_), restricted live keys (rk_live_) and webhook signing secrets (whsec_).",ignores:"Test-mode keys, publishable keys (pk_), which are public, and keys cut short with an ellipsis."}),l(20,"credential","Payment gateway secrets",["square-token","payment-provider-secret"],{proof:"prefix",catches:"Square access tokens, Braintree production tokens, Plaid production secrets, Razorpay key secrets and PayPal client secrets.",ignores:"Razorpay key IDs on their own, test-mode and sandbox keys."}),l(21,"credential","Commerce platform tokens",["shopify-token","commerce-token"],{proof:"prefix",catches:"Shopify admin tokens (shpat_), WooCommerce consumer keys (ck_) and BigCommerce access tokens.",ignores:"Store domains and all-zero filler tokens."}),l(22,"credential","OpenAI keys",["openai-api-key"],{proof:"prefix",catches:"Project keys (sk-proj-\u2026 with the T3BlbkFJ marker) and legacy sk- keys.",ignores:"Model names, sk-abcdef\u2026 keyboard strings and keys masked as sk-\u2026a1B2."}),l(23,"credential","Anthropic keys",["anthropic-api-key"],{proof:"prefix",catches:"Anthropic API keys (sk-ant-api03-\u2026AA).",ignores:"Model names and sk-ant-\u2026 placeholders."}),l(24,"credential","Other AI provider keys",["groq-api-key","xai-api-key","perplexity-api-key","replicate-token","huggingface-token","openrouter-api-key","llm-provider-key"],{proof:"prefix",catches:"Groq, xAI, Perplexity, Replicate, Hugging Face, OpenRouter, DeepSeek, LangSmith and Mistral keys.",ignores:"Cache paths like HF_HOME and filler tokens."}),l(25,"credential","Slack tokens and webhooks",["slack-token","slack-app-token","slack-webhook"],{proof:"prefix",catches:"Bot, user and app tokens (xoxb-, xoxp-, xapp-) and incoming webhook URLs.",ignores:"xoxb-your-bot-token and channel names."}),l(26,"credential","Discord and Telegram bots",["discord-webhook","discord-bot-token","telegram-bot-token"],{proof:"structure",catches:"Discord webhook URLs and bot tokens, and Telegram bot tokens (a bot ID, a colon, then AA\u2026).",ignores:"Guild and channel IDs."}),l(27,"credential","Email provider keys",["sendgrid-api-key","mailgun-api-key","mailchimp-api-key","email-provider-key"],{proof:"prefix",catches:"SendGrid (SG.), Mailgun (key-), Mailchimp (\u2026-us1), Resend (re_), Brevo (xkeysib-) and Postmark keys.",ignores:"SMTP hosts and sender addresses."}),l(28,"credential","SMS and voice provider secrets",["twilio-api-key","sms-provider-secret"],{proof:"context",catches:"Twilio API keys (SK\u2026) and auth tokens, and MSG91 auth keys.",ignores:"Account SIDs and phone numbers on their own."}),l(29,"credential","Productivity SaaS tokens",["linear-api-key","notion-token","airtable-token","postman-api-key","productivity-saas-token"],{proof:"prefix",catches:"Linear, Notion, Airtable, Postman, HubSpot, Figma, Asana and Zendesk tokens.",ignores:"Database and page IDs, which are not secret."}),l(30,"credential","Monitoring and logging keys",["sentry-token","new-relic-key","grafana-token","observability-key"],{proof:"prefix",catches:"Sentry auth tokens, New Relic (NRAK-), Grafana service accounts (glsa_), Dynatrace, PostHog personal keys and Datadog API keys.",ignores:"Sentry DSNs and PostHog project keys, which are designed to ship in browser code."}),l(31,"credential","Private keys (PEM, OpenSSH, PGP)",["private-key"],{proof:"structure",catches:"RSA, EC, PKCS#8, OpenSSH and PGP private key blocks whose body decodes to a real key.",ignores:"Public keys and certificates, key blocks with ... for a body, and blocks filled with random text."}),l(32,"credential","Signing and encryption secrets",["signing-secret"],{proof:"context",catches:"JWT_SECRET, SECRET_KEY_BASE, NEXTAUTH_SECRET, Django SECRET_KEY and similar, when the value is random.",ignores:"changeme, algorithm names like HS256 and expiry settings."}),l(33,"credential","OAuth client secrets",["google-oauth-client-secret","oauth-client-secret"],{proof:"prefix",catches:"Google client secrets (GOCSPX-) and refresh tokens, and Okta, Auth0 and generic client_secret values.",ignores:"Client IDs, which are public."}),l(34,"credential","Long-lived JWTs",["long-lived-jwt"],{proof:"structure",catches:"Signed JWTs that are still valid for a long time \u2014 service-role keys, service-account tokens, tokens that never expire.",ignores:"Expired tokens, short-lived session tokens, Supabase anon keys and the jwt.io sample token."}),l(35,"credential","Basic auth and session cookies",["http-basic-auth","session-cookie"],{proof:"structure",catches:"Authorization: Basic headers that decode to user:password, curl -u credentials, and login session cookies.",ignores:"Analytics and preference cookies, and user:pass examples."}),l(36,"credential","Passwords in configuration",["config-password","assigned-secret"],{proof:"context",catches:"Values assigned to DB_PASSWORD, API_TOKEN, password: and their kin in env files, YAML and code, when they are random enough to be real.",ignores:"********, length settings, keyboard walks like qwertyuiop123, and placeholders."}),l(37,"credential","Crypto wallet keys and seed phrases",["crypto-wallet-secret"],{proof:"checksum",catches:"BIP39 recovery phrases whose checksum word verifies, WIF and xprv keys (Base58Check) and raw Ethereum private keys.",ignores:"The abandon \u2026 about test phrase, Hardhat's published dev keys, and wallet addresses."}),l(38,"credential","age and WireGuard keys",["age-secret-key","vpn-private-key"],{proof:"structure",catches:"age secret keys (AGE-SECRET-KEY-1\u2026) and the PrivateKey of a WireGuard [Interface].",ignores:"WireGuard peer public keys."}),l(39,"infra",".env files",["env-file"],{proof:"context",catches:"A pasted .env file with real secrets in it, flagged as one file rather than line by line.",ignores:".env files with only settings, ${VAR} references or your_key_here placeholders."}),l(40,"infra","Kubernetes configs",["kubeconfig-credential"],{proof:"structure",catches:"kubeconfig files carrying a client key or a bearer token for a cluster.",ignores:"kubeconfigs that authenticate through an exec plugin, and REDACTED tokens."}),l(41,"infra","Kubernetes Secret manifests",["k8s-secret-manifest"],{proof:"structure",catches:"kind: Secret manifests \u2014 the base64 under data: is decoded and checked, and stringData: is read as is.",ignores:"Secrets that decode to password or admin, and certificates."}),l(42,"infra","Terraform state and variables",["terraform-secret"],{proof:"structure",catches:"Passwords in terraform.tfstate attributes and hard-coded in .tf resources.",ignores:"null attributes and var.db_password references."}),l(43,"infra","Credential files",["credential-file"],{proof:"structure",catches:".netrc logins, Docker config.json auths, .pgpass lines and tokens embedded in git remote URLs.",ignores:"example.com entries, user:password auths and plain clone URLs."}),l(44,"infra","Pre-signed URLs",["presigned-url"],{proof:"structure",catches:"S3 pre-signed and Azure SAS URLs that have not expired yet \u2014 anyone holding one can read the file.",ignores:"Expired links, unsigned URLs and documentation pages."}),l(45,"pii","Payment card numbers",["payment-card-number"],{proof:"checksum",catches:"Visa, Mastercard, Amex, RuPay and other card numbers that pass the Luhn check and sit next to a card label, an expiry or a card network name.",ignores:"Published test cards (4242\u2026, 4111\u2026), order IDs and numbers that fail Luhn."}),l(46,"pii","Aadhaar numbers",["aadhaar-number"],{proof:"checksum",catches:"Aadhaar numbers that pass the Verhoeff check, labelled or in the 4-4-4 grouping.",ignores:"UIDAI's sample numbers, transaction references and numbers that fail Verhoeff."}),l(47,"pii","PAN and GSTIN",["india-tax-id"],{proof:"checksum",catches:"Individual PANs and GSTINs whose check character verifies.",ignores:"Company PANs, unlabelled lookalikes and GSTINs with a wrong check character."}),l(48,"pii","SSN and National Insurance numbers",["national-id-number"],{proof:"structure",catches:"US Social Security numbers and UK National Insurance numbers that follow the issuing rules and are labelled or listed.",ignores:"Numbers never issued (000, 666, 9xx areas), the famous Woolworth card number, and part numbers."}),l(49,"pii","Bank account details",["bank-account-details"],{proof:"checksum",catches:"IBANs that pass mod-97, and account numbers next to a valid ABA routing number or an IFSC code.",ignores:"Published example IBANs, IBANs with a wrong check digit and IFSC codes alone."}),l(50,"pii","Customer data exports",["customer-data-dump"],{proof:"context",catches:"Pasted tables of real people \u2014 rows with names, personal email addresses and phone numbers.",ignores:"example.com addresses, 555 phone numbers, short lists and staff email lists."})],rn=["Placeholders \u2014 <your-key>, ${VAR}, {{ secret }}, xxxx, changeme, your_key_here","Values cut short or masked \u2014 sk_live_\u2026, ****, REDACTED","Anything marked fake, mock, dummy, stub, fixture or sample \u2014 in a comment beside it or in its variable name","Vendors' published example and test keys","Variable names, file paths, URLs, hashes, UUIDs and regex source","Public keys, publishable keys and IDs that are not secret"],Re=new Map;for(let e of we)for(let t of e.slugs)Re.set(t,e);function nn(e){return Re.get(e)}function Mt(e){return e===V?"credential":Re.get(e)?.family??"credential"}function on(e){return Mt(e)!=="pii"}function an(e){return St[e]}var sn=we.flatMap(e=>e.slugs);function Dt(e){let t=new Set;for(let n of e)if(n?.isActive)for(let a of n.rules??[])for(let o of a?.specificDomains??[]){let s=fe(o);s&&t.add(s)}return Array.from(t).sort()}function cn(e){return Dt(e).filter(t=>!he(t))}0&&(module.exports={AIToolCategory,AI_REGISTRY,ANNUAL_MONTHS_FREE,ASSIGNED_SECRET_SLUG,AlertChannel,AlertTrigger,CATEGORISED_SLUGS,COVERAGE_SLUGS,DETECTION_CATEGORIES,DETECTION_FAMILY_BLURBS,DETECTION_FAMILY_NAMES,DETECTION_PROOF_NAMES,DETECTION_UNIVERSAL_IGNORES,DIGEST_VERSION_HMAC_V1,ENTERPRISE_FEATURES,EventAction,EventType,FREE_FEATURES,FREE_SEATS,INVISIBLE_CHARS_CLASS,KDF_ITERATIONS,KDF_VERSION_V2,MATRIX_TIERS,MAX_ACTIVITY_SESSIONS_PER_BATCH,MAX_SCAN_WINDOWS,MAX_TOTAL_SCAN_CHARS,MIN_SECRET_LENGTH,NORMALIZATION_VERSION_V1,NORMALIZATION_VERSION_V2,OrgPlan,PASSPHRASE_VERIFY_LABEL,PASTE_CEILING_ALARM_CHARS,PASTE_CEILING_WARN_CHARS,PLAN_DESCRIPTORS,PLAN_FEATURE_MATRIX,PLAN_FEATURE_TIERS,PLAN_LIMITS,PLAN_PRICING,PRIVACY_EMAIL,PROJECT_KDF_LABEL,PRO_BANDS,PRO_ENTRY_BAND,PRO_FEATURES,PRO_TOP_BAND,RiskLevel,SAFE_BLOCK_EVENT_FIELDS,SALES_EMAIL,SCAN_PREFILTER_LABEL,SCAN_PREFILTER_PATTERN,SCAN_PREFILTER_SPACE,SCAN_PREFILTER_WINDOWS_PER_SIGNATURE,SECRET_PROVIDER_NAMES,SECRET_PROVIDER_SLUGS,SECURITY_EMAIL,TRIAL_DAYS,UNRECOGNISED_PROVIDER_SLUG,UserRole,annualBilledNote,appendPasskeyEnvelope,behaviorExplanation,canonicalSecretPlaintextForHmac,categoryOfSlug,computePassphraseVerifyHmac,customPolicyDomains,decodeScanPrefilter,deriveBehaviorRisk,deriveHmacKeyFromPassphrase,deriveProjectKey,deriveScanPrefilterSeed,encodeScanPrefilter,extractAddedLinesFromUnifiedDiff,familyDisplayName,familyOfSlug,findBand,findPasskeyEnvelope,foldUuidHexCase,generateHmacKey,generatePrfSalt,getInjectionHostnames,getLimitsForPlan,getPrfSaltBytes,hexToKey,hmacDigestHex,isAIToolDomain,isInjectionScopedHostname,isKnownProviderSlug,isProtectableSlug,isV1PassphraseEnvelope,isV2Envelope,keyToHex,matchDomain,matchPatternsForHostname,maxScannablePasteChars,maxScannablePasteCharsFor,normalizeAndHmacHex,normalizeAndHmacHexCollapsed,normalizeAndHmacHexLower,normalizeDomainInput,normalizeSecretPlaintextCollapsed,normalizeSecretPlaintextForMatch,normalizeSecretPlaintextLower,perMonthOnAnnual,policyNamedDomains,projectedScanCost,providerDisplayName,removePasskeyEnvelope,scanBudgetFor,scanPrefilterFingerprint,scanPrefilterForRawSecret,scanPrefilterParams,scanPrefilterRoller,scanPrefilterUnits,scanSweeps,scanWindowLengths,smallestBandFor,unwrapHmacKeyWithPrf,upgradeEnvelopeToV2,usd,validateNewPassphrase,validatePassphraseStrength,wrapHmacKeyWithPrf});
+/*! Bundled license information:
+
+@noble/hashes/esm/utils.js:
+  (*! noble-hashes - MIT License (c) 2022 Paul Miller (paulmillr.com) *)
+*/

package/redaktyn-ui.mjs

@@ -0,0 +1,5 @@
+const m=process.env,i=process.stderr,T=!!m.REDAKTYN_FORCE_UI,w=T||!!i.isTTY&&m.TERM!=="dumb"&&!m.CI,g=w&&!m.NO_COLOR,h=w&&!!i.isTTY&&!m.CI&&!m.REDAKTYN_NO_ANIMATION&&!T,E=!m.REDAKTYN_ASCII&&m.TERM!=="linux"&&m.TERM!=="dumb",S=/truecolor|24bit/i.test(m.COLORTERM??""),N=/256color/i.test(m.TERM??""),b=(t,r,n)=>a=>g?`\x1B[${S?`38;2;${t}`:N?`38;5;${r}`:n}m${a}\x1B[0m`:String(a),e={clay:b("217;119;87",173,33),green:b("95;168;112",71,32),amber:b("212;164;76",178,33),red:b("208;93;93",167,31),blue:b("112;160;214",74,36),dim:t=>g?`\x1B[2m${t}\x1B[0m`:String(t),bold:t=>g?`\x1B[1m${t}\x1B[0m`:String(t),gray:t=>g?`\x1B[90m${t}\x1B[0m`:String(t)},O={clay:e.clay,green:e.green,amber:e.amber,red:e.red,blue:e.blue,dim:e.dim},s=E?{ok:"\u2714",fail:"\u2716",warn:"\u25B2",dot:"\xB7",arrow:"\u2192",down:"\u25BC",bar:"\u2502",mark:"\u25CE",full:"\u2588",empty:"\u2591",tl:"\u256D",tr:"\u256E",bl:"\u2570",br:"\u256F",h:"\u2500",v:"\u2502",lock:"\u{1F512}"}:{ok:"+",fail:"x",warn:"!",dot:"-",arrow:"->",down:"v",bar:"|",mark:"(o)",full:"#",empty:".",tl:"+",tr:"+",bl:"+",br:"+",h:"-",v:"|",lock:""},R=/\x1b\[[0-9;]*m/g,f=t=>String(t).replace(R,"").length,k=(t,r)=>t+" ".repeat(Math.max(0,r-f(t))),A=()=>Math.max(60,Math.min(i.columns||80,100)),p=(t="")=>i.write(t+`
+`);let v=!1;function _(t,r){if(!w||v)return;v=!0;const n=r?e.dim(`  v${r}`):"";p(""),p(`  ${e.clay(s.mark)}  ${e.bold(e.clay("R E D A K T Y N"))}${n}`),p(`     ${e.dim("zero-knowledge secret protection")}${t?e.dim(`  ${s.dot}  ${t}`):""}`),p("")}function B(t,r,{tone:n="clay",width:a}={}){const c=O[n]??e.clay,l=Math.max(f(t)+4,...r.map(f)),o=Math.min(a??l+2,A()-4),$=u=>f(u)<=o-2?k(u,o-2):String(u).replace(R,"").slice(0,o-3)+"\u2026",d=`${s.tl}${s.h} ${t} ${s.h.repeat(Math.max(1,o-f(t)-3))}${s.tr}`,x=r.map(u=>`${c(s.v)} ${$(u)} ${c(s.v)}`);p("  "+c(d)),x.forEach(u=>p("  "+u)),p("  "+c(`${s.bl}${s.h.repeat(o)}${s.br}`))}function H(t,{indent:r=2,labelWidth:n}={}){const a=n??Math.max(...t.map(([c])=>f(c)));return t.map(([c,l])=>`${" ".repeat(r)}${e.gray(k(c,a))}  ${l}`)}const I=E?["\u280B","\u2819","\u2839","\u2838","\u283C","\u2834","\u2826","\u2827","\u2807","\u280F"]:["-","\\","|","/"];let y=!1;const M=()=>{y&&(i.write("\x1B[?25h"),y=!1)};process.on("exit",M),process.on("SIGINT",()=>{M(),i.write(`
+`),process.exit(130)});const C=t=>{const r=Date.now()-t;return r<1e3?`${r} ms`:`${(r/1e3).toFixed(1)} s`};function K(t){const r=Date.now();if(!w)return i.write(`${t}\u2026
+`),{update(){},succeed(){},fail(){},warn(){}};let n=t,a=null,c=0;if(h){i.write("\x1B[?25l"),y=!0;const o=()=>i.write(`\r\x1B[2K  ${e.clay(I[c++%I.length])} ${n}`);o(),a=setInterval(o,80)}const l=(o,$,d=!0)=>{a&&clearInterval(a),h&&(i.write("\r\x1B[2K"),M()),p(`  ${o} ${$??n}${d?e.dim(`  ${C(r)}`):""}`)};return{update(o){n=o,h||p(`  ${e.clay(s.dot)} ${o}`)},succeed(o){l(e.green(s.ok),o)},fail(o){l(e.red(s.fail),o,!1)},warn(o){l(e.amber(s.warn),o,!1)}}}async function z(t,r,n){const a=K(t);try{const c=await r(a);return a.succeed(typeof n=="function"?n(c):n),c}catch(c){throw a.fail(`${t}: ${c instanceof Error?c.message:c}`),c}}function G(t,r,n=24){const a=r===0?n:Math.round(t/r*n);return e.clay(s.full.repeat(a))+e.gray(s.empty.repeat(n-a))+e.dim(`  ${t}/${r}`)}const D=t=>new Promise(r=>setTimeout(r,t)),F="0123456789abcdef";async function P(t,r,{show:n=16,hold:a=450}={}){const c=r.slice(0,n),l=$=>$.replace(/(.{4})/g,"$1 ").trim();if(!h){p(`${t}${e.amber(l(c))} ${e.dim("\u2026")}`);return}const o=14;for(let $=0;$<=o;$++){const d=Math.floor($/o*n);let x=c.slice(0,d);for(let u=d;u<n;u++)x+=F[Math.floor(Math.random()*16)];i.write(`\r\x1B[2K${t}${$<o?e.gray(l(x)):e.amber(l(x))} ${e.dim("\u2026")}`),await D(a/o)}i.write(`
+`)}function U(t){return t<1024?`${t} B`:t<1048576?`${(t/1024).toFixed(1)} KB`:`${(t/1048576).toFixed(1)} MB`}export{h as animated,_ as banner,G as bar,B as box,s as g,U as humanBytes,e as k,P as reveal,w as rich,H as rows,p as say,K as step,z as task,g as useColor,f as visibleLength};

package/redaktyn-verify.mjs

@@ -0,0 +1,60 @@
+#!/usr/bin/env node
+import{createHash as T,createHmac as L,pbkdf2 as F,verify as J,createPublicKey as M}from"node:crypto";import{promisify as V}from"node:util";import{readFileSync as E,writeFileSync as W,existsSync as A}from"node:fs";import{join as G}from"node:path";import{homedir as U}from"node:os";import{createInterface as z}from"node:readline";const X=V(F),P=6e5,Q=/[\u00ad\u200b-\u200f\u2060-\u2064\ufeff]/g;function I(e){return e.normalize("NFC").replace(/\r\n/g,`
+`).replace(/[\r\u2028\u2029]/g,`
+`).replace(Q,"").trim()}function q(e){return e.length===36&&e[8]==="-"&&e[13]==="-"&&e[18]==="-"&&e[23]==="-"&&/^[0-9a-fA-F]{32}$/.test(e.replace(/-/g,""))?e.toLowerCase():e}async function Z(e,s){const t=T("sha256").update(s,"utf8").digest();return X(e,t,P,32,"sha256")}function N(e,s){return L("sha256",s).update(e,"utf8").digest("hex")}function ee(e,s){const t=q(I(e).replace(/\s/g,""));return{hmacHex:N(q(I(e)),s),hmacHexStripped:N(t,s),hmacHexLower:N(t.toLowerCase(),s)}}const te=Buffer.from("302a300506032b6570032100","hex");function se(e,s,t){const o=Buffer.from(t,"base64");if(o.length!==32)return!1;const a=M({key:Buffer.concat([te,o]),format:"der",type:"spki"});return J(null,e,a,Buffer.from(s,"base64"))}function x(e){return e===null||typeof e!="object"?JSON.stringify(e):Array.isArray(e)?`[${e.map(x).join(",")}]`:`{${Object.keys(e).sort().map(s=>`${JSON.stringify(s)}:${x(e[s])}`).join(",")}}`}const ne="0".repeat(64);function H(e){let s=ne;return e.forEach((t,o)=>{t.seq!==o+1&&l(`Release log entry ${o+1} is out of order (seq ${t.seq}).`),t.prevHead!==s&&l(`Release log entry ${t.seq} does not follow ${t.seq-1}.`);const{head:a,...d}=t;T("sha256").update(x(d),"utf8").digest("hex")!==a&&l(`Release log entry ${t.seq} was modified after it was written.`),s=a}),s}const b=process.env.NO_COLOR!=null||process.argv.includes("--no-color"),n={b:b?"":"\x1B[1m",d:b?"":"\x1B[2m",r:b?"":"\x1B[0m",g:b?"":"\x1B[32m",y:b?"":"\x1B[33m",red:b?"":"\x1B[31m"},u=e=>console.log(`  ${n.g}\u2713${n.r} ${e}`),p=e=>console.log(`  ${n.red}\u2717${n.r} ${e}`),v=e=>console.log(`  ${n.y}!${n.r} ${e}`),i=e=>console.log(`    ${n.d}${e}${n.r}`);function l(e){console.error(`
+${n.red}${e}${n.r}`),process.exit(1)}function R(e,s=null){const t=process.argv.indexOf(e);return t>=0&&process.argv[t+1]!=null?process.argv[t+1]:s}function D(e){const s=R(e);return s==null&&l(`Missing required argument ${e}. Run with --help.`),s}function S(){return(R("--server")??process.env.REDAKTYN_SERVER??"").replace(/\/+$/,"")||l("Set --server https://your-redaktyn-host (or REDAKTYN_SERVER).")}async function O(e,s={}){const t=await fetch(e,{headers:s});return t.ok||l(`GET ${e} \u2192 HTTP ${t.status}`),t.json()}async function _(e){const s=await fetch(e);return s.ok||l(`GET ${e} \u2192 HTTP ${s.status}`),Buffer.from(await s.arrayBuffer())}function B(e){return new Promise(s=>{if(process.stdout.write(`  ${e} `),!process.stdin.isTTY){const a=z({input:process.stdin});a.once("line",d=>{a.close(),s(d)});return}let t="";process.stdin.setRawMode(!0),process.stdin.resume(),process.stdin.setEncoding("utf8");const o=a=>{a===""&&process.exit(130),a==="\r"||a===`
+`?(process.stdin.removeListener("data",o),process.stdin.setRawMode(!1),process.stdin.pause(),process.stdout.write(`
+`),s(t)):a==="\x7F"||a==="\b"?t&&(t=t.slice(0,-1),process.stdout.write("\b \b")):(t+=a,process.stdout.write("\u2022"))};process.stdin.on("data",o)})}const w=process.env.REDAKTYN_VERIFY_PIN??G(U(),".redaktyn-verify-pin.json");async function re(){const e=D("--org-id"),s=process.env.REDAKTYN_PASSPHRASE??await B("Organization passphrase:");s||l("A passphrase is required \u2014 it is what the key is derived from.");const t=process.env.REDAKTYN_SECRET??await B("Secret value:");t||l("A secret value is required."),console.log(`
+${n.b}Deriving key${n.r}  PBKDF2-SHA256, ${P.toLocaleString("en-US")} iterations`);const o=await Z(s,e),a=ee(t,o);console.log(`
+${n.b}Computed locally${n.r}`);for(const[r,c]of Object.entries(a))console.log(`  ${r.padEnd(16)} ${c}`);const d=R("--token")??process.env.REDAKTYN_TOKEN;if(!d){console.log(`
+${n.d}No API token given, so nothing was compared against the server.
+Pass --token <admin JWT> to fetch GET /api/secrets and check whether the
+stored digests equal the values above.${n.r}`);return}const f=await O(`${S()}/api/secrets`,{Authorization:`Bearer ${d}`});console.log(`
+${n.b}Compared against ${f.length} registered fingerprint(s)${n.r}`);const h=f.find(r=>["hmacHex","hmacHexStripped","hmacHexLower"].some(c=>r[c]!=null&&r[c]===a[c]));if(!h){p("No stored digest equals what was just computed."),i("Either this secret has no registered fingerprint, or the passphrase differs"),i("from the one used to register it. A different passphrase yields an unrelated digest."),process.exitCode=1;return}u(`Matched "${h.label}".`);for(const r of["hmacHex","hmacHexStripped","hmacHexLower"])h[r]==null?v(`${r} is not stored for this secret \u2014 that variant is unprotected.`):h[r]===a[r]?u(`${r} identical.`):(p(`${r} differs from the local computation.`),process.exitCode=1);i("The server holds a one-way digest of this secret, not the secret."),i("It does not follow that the server never received the plaintext by some"),i("other route \u2014 run `egress` against a capture to check what the client sends.")}async function oe(){const e=S(),s=await O(`${e}/api/verify/release`);if(s.released===!1){v("This deployment publishes no signed release manifest."),i(s.detail??""),i("Nothing can be verified about the served bundle. Build from source and"),i("compare, or ask the operator which commit is deployed."),process.exitCode=1;return}const t=Buffer.from(s.manifest,"utf8"),o=JSON.parse(s.manifest);if(console.log(`
+${n.b}Manifest${n.r}  commit ${o.gitCommit}  \xB7  ${o.artifactCount} artifacts`),!s.signed)v("The manifest is NOT signed \u2014 it lists hashes but attests to nothing.");else{const r=R("--pubkey")??process.env.REDAKTYN_PUBKEY,c=s.signature.publicKeyBase64;if(r==null)v("Signature checked against the key this same server supplied."),i("That only rules out accidental corruption. A server able to alter the"),i("manifest can alter the key beside it. Pass --pubkey <base64> with a key"),i("you obtained elsewhere to make this meaningful.");else if(r!==c){p("The server's signing key is not the key you pinned."),i(`pinned  ${r}`),i(`served  ${c}`),process.exitCode=1;return}else u("Signing key matches the one you pinned.");if(!se(t,s.signature.signature,c)){p("Ed25519 signature does not verify \u2014 the manifest has been altered."),process.exitCode=1;return}u("Signature verifies over the manifest bytes.")}const a=new Map(o.artifacts.map(r=>[r.path,r.sha256])),d=await _(`${e}/`),f=[["dashboard/index.html",d]];for(const r of d.toString("utf8").matchAll(/(?:src|href)="(\/assets\/[^"]+)"/g))f.push([`dashboard${r[1]}`,await _(`${e}${r[1]}`)]);console.log(`
+${n.b}Served bytes vs manifest${n.r}`);let h=0;for(const[r,c]of f){const $=T("sha256").update(c).digest("hex"),g=a.get(r);g==null?v(`${r} \u2014 not in the manifest`):g===$?u(`${r}`):(p(`${r} \u2014 served bytes differ from the signed hash`),h++)}if(h>0){process.exitCode=1;return}i("The bundle served to you matches the manifest. To close the loop, check"),i("that the manifest matches the published source: clone the repo at"),i(`${o.gitCommit.slice(0,12)} and run scripts/release/verify-reproducible.mjs.`)}async function K(e){const s=await(await fetch(`${e}/api/verify/log`)).text();s.trimStart().startsWith("{")&&s.includes('"released":false')&&l("This deployment publishes no release log.");const t=s.split(`
+`).map(o=>o.trim()).filter(Boolean).map(o=>JSON.parse(o));return t.length===0&&l("The release log is empty."),t}async function ie(){const e=S(),s=await K(e),t=H(s);u(`Chain of ${s.length} release(s) is internally consistent.`);const o=A(w)?JSON.parse(E(w,"utf8")):{};o[e]={head:t,seq:s.length,pinnedAt:new Date().toISOString()},W(w,JSON.stringify(o,null,2)+`
+`),console.log(`
+  head  ${t}`),console.log(`  saved ${w}`),i("Run `redaktyn-verify check` later. If releases up to this point are ever"),i("rewritten or dropped, the chain will no longer reproduce this head.")}async function ae(){const e=S();A(w)||l(`Nothing pinned yet \u2014 run \`redaktyn-verify pin --server ${e}\` first.`);const t=JSON.parse(E(w,"utf8"))[e];t==null&&l(`No pin recorded for ${e}.`);const o=await K(e);if(H(o),u(`Chain of ${o.length} release(s) is internally consistent.`),o.length<t.seq){p(`The log has shrunk: ${t.seq} entries were pinned, ${o.length} are served now.`),process.exitCode=1;return}const a=o[t.seq-1];if(a.head!==t.head){p(`Release ${t.seq} has changed since you pinned it.`),i(`pinned  ${t.head}`),i(`served  ${a.head}`),i("History was rewritten. Treat every signature from this server as suspect."),process.exitCode=1;return}u(`Release ${t.seq} still hashes to the head you pinned on ${t.pinnedAt.slice(0,10)}.`),o.length>t.seq&&u(`${o.length-t.seq} release(s) appended since, with your pin intact beneath them.`),i("This detects a rewrite of the log served to you. It cannot detect a server"),i("that serves a different, self-consistent log to somebody else.")}async function ce(){const e=D("--har");A(e)||l(`No such file: ${e}`);const s=JSON.parse(E(e,"utf8")),{endpoints:t}=await O(`${S()}/api/verify/fields`),o=h=>t.find(r=>{const c="^"+r.path.replace(/:[^/]+/g,"[^/]+")+"$";return new RegExp(c).test(h)}),a=s?.log?.entries??[];a.length===0&&l("That HAR contains no entries.");let d=0;const f=[];for(const h of a){const r=h.request;if(r?.postData?.text==null)continue;let c;try{c=new URL(r.url).pathname}catch{continue}const $=o(c);if($==null||$.method!==r.method)continue;let g;try{g=JSON.parse(r.postData.text)}catch{continue}d++;const Y=Object.keys(g).filter(m=>!$.fields.includes(m));for(const m of Y)f.push(`${r.method} ${c} \u2192 "${m}"`);const k=$.itemFields;if(k&&Array.isArray(g[k.field])){for(const m of g[k.field])if(!(m==null||typeof m!="object"))for(const C of Object.keys(m))k.fields.includes(C)||f.push(`${r.method} ${c} \u2192 ${k.field}[].${C}`)}}if(console.log(`
+${n.b}Inspected ${d} Redaktyn API request(s) in ${e}${n.r}`),d===0){v("None of the captured requests hit a Redaktyn ingest endpoint."),i("Record the capture while registering a fingerprint or triggering a block.");return}if(f.length>0){p(`${f.length} field(s) outside the published allowlist:`);for(const h of[...new Set(f)])console.log(`      ${h}`);process.exitCode=1;return}u("Every field sent is one the API publicly declares it accepts."),i("This covers the requests in your capture, to endpoints on the allowlist."),i("It says nothing about requests you did not record, or about what the"),i("server does with the fields it does accept.")}function le(){console.log(`
+${n.b}redaktyn-verify${n.r} \u2014 check Redaktyn's claims for yourself
+
+${n.b}COMMANDS${n.r}
+
+  ${n.b}recompute${n.r}  --org-id <uuid> [--token <jwt>]
+      Derives the HMAC key from your passphrase and recomputes all three
+      digests. With a token, compares them against GET /api/secrets.
+      Passphrase and secret are read from a hidden prompt, or from
+      REDAKTYN_PASSPHRASE / REDAKTYN_SECRET.
+
+  ${n.b}build${n.r}      [--pubkey <base64>]
+      Fetches the signed release manifest, verifies the Ed25519 signature,
+      then hashes the bundle this server actually serves and compares.
+      Supply --pubkey with a key obtained independently \u2014 verifying against
+      the key the same server just handed you proves very little.
+
+  ${n.b}pin${n.r}
+      Records the release log head as it stands today, in
+      ~/.redaktyn-verify-pin.json (override with REDAKTYN_VERIFY_PIN).
+
+  ${n.b}check${n.r}
+      Re-fetches the log and confirms it still reproduces your pinned head.
+
+  ${n.b}egress${n.r}     --har <file.har>
+      Asserts that every field sent to a Redaktyn ingest endpoint in the capture
+      is one the API publicly declares. Record with DevTools \u2192 Network \u2192
+      "Export HAR" while registering a fingerprint.
+
+${n.b}COMMON${n.r}
+
+  --server <url>   Redaktyn base URL (or REDAKTYN_SERVER)
+  --no-color       Disable ANSI colour
+  --help
+
+${n.b}WHAT THIS CANNOT SHOW${n.r}
+
+  ${n.d}Nothing here establishes what the server does with data after receiving it.
+  A one-way digest proves the stored value cannot be reversed; it does not
+  prove the plaintext was never written elsewhere. That needs source access,
+  an independent audit, or a deployment you host.${n.r}
+`)}const y=process.argv[2],j={recompute:re,build:oe,pin:ie,check:ae,egress:ce};(y==null||y==="--help"||y==="-h"||j[y]==null)&&(le(),process.exit(y==null||y.startsWith("-")?0:1)),j[y]().catch(e=>{l(e instanceof Error?e.message:String(e))});