@sfdxy/anypoint-connect 0.14.0 → 0.16.2

package/dist/safety/guards.d.ts

@@ -10,7 +10,7 @@ export declare function isProductionEnv(envName: string, isProduction?: boolean)
 /**
  * Build a deployment summary for confirmation
  */
-export declare function buildDeploySummary(appName: string, envName: string, existing: CH2Deployment | null, newVersion?: string): string;
+export declare function buildDeploySummary(appName: string, envName: string, existing: CH2Deployment | null, newVersion?: string, isProduction?: boolean): string;
 /**
  * Validate a JAR file exists and looks correct
  */
@@ -23,5 +23,5 @@ export declare function validateJarFile(jarPath: string): {
 /**
  * Ask for production deployment confirmation
  */
-export declare function confirmProductionDeploy(envName: string): Promise<boolean>;
+export declare function confirmProductionDeploy(envName: string, isProduction?: boolean): Promise<boolean>;
 //# sourceMappingURL=guards.d.ts.map

package/dist/safety/guards.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guards.d.ts","sourceRoot":"","sources":["../../src/safety/guards.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAG5D;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,OAAO,GAAG,OAAO,CAIhF;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAC9B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,aAAa,GAAG,IAAI,EAC9B,UAAU,CAAC,EAAE,MAAM,GACpB,MAAM,CA4BR;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG;IAC9C,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB,CAuBA;AAED;;GAEG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAc/E"}
+{"version":3,"file":"guards.d.ts","sourceRoot":"","sources":["../../src/safety/guards.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAG5D;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,OAAO,GAAG,OAAO,CAIhF;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAC9B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,aAAa,GAAG,IAAI,EAC9B,UAAU,CAAC,EAAE,MAAM,EACnB,YAAY,CAAC,EAAE,OAAO,GACvB,MAAM,CA4BR;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG;IAC9C,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB,CAuBA;AAED;;GAEG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAcvG"}

package/dist/safety/guards.js

@@ -17,9 +17,9 @@ export function isProductionEnv(envName, isProduction) {
 /**
  * Build a deployment summary for confirmation
  */
-export function buildDeploySummary(appName, envName, existing, newVersion) {
+export function buildDeploySummary(appName, envName, existing, newVersion, isProduction) {
     const lines = [];
-    if (isProductionEnv(envName)) {
+    if (isProductionEnv(envName, isProduction)) {
         lines.push(chalk.red.bold('\n  ⚠️  PRODUCTION DEPLOYMENT'));
         lines.push(chalk.red('  ════════════════════════════════════\n'));
     }
@@ -66,8 +66,8 @@ export function validateJarFile(jarPath) {
 /**
  * Ask for production deployment confirmation
  */
-export async function confirmProductionDeploy(envName) {
-    if (!isProductionEnv(envName))
+export async function confirmProductionDeploy(envName, isProduction) {
+    if (!isProductionEnv(envName, isProduction))
         return true;
     const rl = readline.createInterface({
         input: process.stdin,

package/dist/safety/guards.js.map

@@ -1 +1 @@
-{"version":3,"file":"guards.js","sourceRoot":"","sources":["../../src/safety/guards.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,QAAQ,MAAM,UAAU,CAAC;AAErC,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,YAAsB;IACnE,IAAI,YAAY,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACpC,OAAO,KAAK,KAAK,YAAY,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;AACtF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAC9B,OAAe,EACf,OAAe,EACf,QAA8B,EAC9B,UAAmB;IAEnB,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,CAAC;QAC5D,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACpE,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAEpE,IAAI,QAAQ,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,OAAO,IAAI,SAAS,CAAC;QAChE,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,SAAS,CAAC;QAC5C,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,EAAE,QAAQ,IAAI,CAAC,CAAC;QAChD,KAAK,CAAC,IAAI,CACN,KAAK,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,OAAO,KAAK,MAAM,KAAK,QAAQ,WAAW,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAC5G,CAAC;IACN,CAAC;SAAM,CAAC;QACJ,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,IAAI,UAAU,EAAE,CAAC;QACb,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,UAAU,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAM3C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,OAAO,EAAE,EAAE,CAAC;IACjE,CAAC;IAED,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAClB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;IACxD,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;IACxE,CAAC;IAED,6CAA6C;IAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAChD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAEvF,OAAO;QACH,KAAK,EAAE,IAAI;QACX,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACtB,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;KACtB,CAAC;AACN,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAAe;IACzD,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAE3C,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC;QAChC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,MAAM,EAAE,OAAO,CAAC,MAAM;KACzB,CAAC,CAAC;IAEH,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC3B,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,4CAA4C,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE;YACjF,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,sBAAsB,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"guards.js","sourceRoot":"","sources":["../../src/safety/guards.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,QAAQ,MAAM,UAAU,CAAC;AAErC,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,YAAsB;IACnE,IAAI,YAAY,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACpC,OAAO,KAAK,KAAK,YAAY,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;AACtF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAC9B,OAAe,EACf,OAAe,EACf,QAA8B,EAC9B,UAAmB,EACnB,YAAsB;IAEtB,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,eAAe,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,CAAC;QAC5D,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACpE,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAEpE,IAAI,QAAQ,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,OAAO,IAAI,SAAS,CAAC;QAChE,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,SAAS,CAAC;QAC5C,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,EAAE,QAAQ,IAAI,CAAC,CAAC;QAChD,KAAK,CAAC,IAAI,CACN,KAAK,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,OAAO,KAAK,MAAM,KAAK,QAAQ,WAAW,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAC5G,CAAC;IACN,CAAC;SAAM,CAAC;QACJ,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,IAAI,UAAU,EAAE,CAAC;QACb,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,UAAU,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAM3C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,OAAO,EAAE,EAAE,CAAC;IACjE,CAAC;IAED,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAClB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;IACxD,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;IACxE,CAAC;IAED,6CAA6C;IAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAChD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAEvF,OAAO;QACH,KAAK,EAAE,IAAI;QACX,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACtB,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;KACtB,CAAC;AACN,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAAe,EAAE,YAAsB;IACjF,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzD,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC;QAChC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,MAAM,EAAE,OAAO,CAAC,MAAM;KACzB,CAAC,CAAC;IAEH,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC3B,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,4CAA4C,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE;YACjF,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,sBAAsB,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/safety/paths.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Project-scoped file access
+ * Every file a tool reads secrets from or writes output to must sit inside the project root,
+ * so a tool call cannot reach arbitrary files on the machine.
+ */
+/** Environment variable that pins the project root, for MCP servers started outside the project. */
+export declare const PROJECT_ROOT_ENV = "ANYPOINT_CONNECT_PROJECT_ROOT";
+/** The git toplevel of the working directory, or the working directory itself. */
+export declare function resolveProjectRoot(cwd?: string): string;
+/**
+ * Resolve a path for reading. The real path (symlinks followed) must stay inside the root,
+ * and the file must be a regular file no larger than `maxBytes`.
+ */
+export declare function resolveReadablePath(file: string, options?: {
+    projectRoot?: string;
+    maxBytes?: number;
+}): {
+    path: string;
+    size: number;
+};
+/**
+ * Resolve a path for writing. The parent directory must exist inside the root, and an
+ * existing file is only replaced when `overwrite` is set.
+ */
+export declare function resolveWritablePath(file: string, options?: {
+    projectRoot?: string;
+    overwrite?: boolean;
+}): string;
+//# sourceMappingURL=paths.d.ts.map

package/dist/safety/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/safety/paths.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,oGAAoG;AACpG,eAAO,MAAM,gBAAgB,kCAAkC,CAAC;AAEhE,kFAAkF;AAClF,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAsB,GAAG,MAAM,CActE;AAOD;;;GAGG;AACH,wBAAgB,mBAAmB,CAC/B,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAC1D;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAWhC;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,MAAM,CAarH"}

package/dist/safety/paths.js

@@ -0,0 +1,76 @@
+/**
+ * Project-scoped file access
+ * Every file a tool reads secrets from or writes output to must sit inside the project root,
+ * so a tool call cannot reach arbitrary files on the machine.
+ */
+import { execFileSync } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+/** Environment variable that pins the project root, for MCP servers started outside the project. */
+export const PROJECT_ROOT_ENV = 'ANYPOINT_CONNECT_PROJECT_ROOT';
+/** The git toplevel of the working directory, or the working directory itself. */
+export function resolveProjectRoot(cwd = process.cwd()) {
+    const pinned = process.env[PROJECT_ROOT_ENV];
+    if (pinned)
+        return fs.realpathSync(path.resolve(pinned));
+    try {
+        const top = execFileSync('git', ['rev-parse', '--show-toplevel'], {
+            cwd,
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+        }).trim();
+        if (top)
+            return fs.realpathSync(top);
+    }
+    catch {
+        // Not a git checkout; fall back to the working directory.
+    }
+    return fs.realpathSync(path.resolve(cwd));
+}
+function isInside(root, candidate) {
+    const relative = path.relative(root, candidate);
+    return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative));
+}
+/**
+ * Resolve a path for reading. The real path (symlinks followed) must stay inside the root,
+ * and the file must be a regular file no larger than `maxBytes`.
+ */
+export function resolveReadablePath(file, options = {}) {
+    const root = fs.realpathSync(options.projectRoot ?? resolveProjectRoot());
+    const absolute = path.resolve(root, file);
+    if (!fs.existsSync(absolute))
+        throw new Error(`File not found: ${file}`);
+    const real = fs.realpathSync(absolute);
+    if (!isInside(root, real))
+        throw new Error(`File must be inside the project root (${root}): ${file}`);
+    const stat = fs.statSync(real);
+    if (!stat.isFile())
+        throw new Error(`Not a regular file: ${file}`);
+    const maxBytes = options.maxBytes ?? 1024 * 1024;
+    if (stat.size > maxBytes)
+        throw new Error(`File exceeds ${maxBytes} bytes: ${file}`);
+    return { path: real, size: stat.size };
+}
+/**
+ * Resolve a path for writing. The parent directory must exist inside the root, and an
+ * existing file is only replaced when `overwrite` is set.
+ */
+export function resolveWritablePath(file, options = {}) {
+    const root = fs.realpathSync(options.projectRoot ?? resolveProjectRoot());
+    const absolute = path.resolve(root, file);
+    const parent = path.dirname(absolute);
+    if (!fs.existsSync(parent))
+        throw new Error(`Directory not found: ${path.dirname(file)}`);
+    const realParent = fs.realpathSync(parent);
+    const target = path.join(realParent, path.basename(absolute));
+    if (!isInside(root, target))
+        throw new Error(`File must be inside the project root (${root}): ${file}`);
+    if (fs.existsSync(target)) {
+        if (fs.lstatSync(target).isSymbolicLink())
+            throw new Error(`Refusing to write through a symlink: ${file}`);
+        if (!options.overwrite)
+            throw new Error(`File exists: ${file}. Pass overwrite to replace it.`);
+    }
+    return target;
+}
+//# sourceMappingURL=paths.js.map

package/dist/safety/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/safety/paths.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,oGAAoG;AACpG,MAAM,CAAC,MAAM,gBAAgB,GAAG,+BAA+B,CAAC;AAEhE,kFAAkF;AAClF,MAAM,UAAU,kBAAkB,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE;IAC1D,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC7C,IAAI,MAAM;QAAE,OAAO,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACzD,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,iBAAiB,CAAC,EAAE;YAC9D,GAAG;YACH,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACtC,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,GAAG;YAAE,OAAO,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACL,0DAA0D;IAC9D,CAAC;IACD,OAAO,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,SAAiB;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAChD,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AACzF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAC/B,IAAY,EACZ,UAAuD,EAAE;IAEzD,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW,IAAI,kBAAkB,EAAE,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,IAAI,MAAM,IAAI,EAAE,CAAC,CAAC;IACtG,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,GAAG,IAAI,CAAC;IACjD,IAAI,IAAI,CAAC,IAAI,GAAG,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,QAAQ,WAAW,IAAI,EAAE,CAAC,CAAC;IACrF,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,UAAyD,EAAE;IACzG,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW,IAAI,kBAAkB,EAAE,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1F,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,IAAI,MAAM,IAAI,EAAE,CAAC,CAAC;IACxG,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,IAAI,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,EAAE,CAAC,CAAC;QAC3G,IAAI,CAAC,OAAO,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,iCAAiC,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC"}

package/dist/safety/runtime.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Runtime version checks
+ * Validate a requested Mule runtime against what the deployment target accepts, and suggest the
+ * nearest supported version when the current one has been retired. Pure functions.
+ */
+import type { RuntimeVersion } from '../api/RuntimesApi.js';
+export interface RuntimeSpec {
+    /** Base version ("4.9.0") or a version prefix ("4.9"). */
+    version: string;
+    java?: string;
+    releaseChannel?: string;
+}
+/** Split a deployment's runtime string ("4.8.5:4e-java8") into its base version and Java version. */
+export declare function parseRuntimeString(value: string, java?: string): RuntimeSpec;
+export declare function compareVersions(a: string, b: string): number;
+/** The newest catalog entry matching the spec, or undefined when the target does not offer it. */
+export declare function resolveRuntime(catalog: RuntimeVersion[], spec: RuntimeSpec): RuntimeVersion | undefined;
+/**
+ * Nearest supported versions for an unsupported runtime, best first: the newest patch of the same
+ * minor, then the oldest newer LTS, then the newest version overall. Java 17 is preferred when the
+ * original Java version is no longer offered.
+ */
+export declare function suggestRuntimes(catalog: RuntimeVersion[], current: RuntimeSpec, limit?: number): string[];
+//# sourceMappingURL=runtime.d.ts.map

package/dist/safety/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/safety/runtime.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE5D,MAAM,WAAW,WAAW;IACxB,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,qGAAqG;AACrG,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,WAAW,CAI5E;AAED,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAQ5D;AAMD,kGAAkG;AAClG,wBAAgB,cAAc,CAAC,OAAO,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,WAAW,GAAG,cAAc,GAAG,SAAS,CAMvG;AAOD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,cAAc,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,SAAI,GAAG,MAAM,EAAE,CAmBpG"}

package/dist/safety/runtime.js

@@ -0,0 +1,59 @@
+/**
+ * Runtime version checks
+ * Validate a requested Mule runtime against what the deployment target accepts, and suggest the
+ * nearest supported version when the current one has been retired. Pure functions.
+ */
+/** Split a deployment's runtime string ("4.8.5:4e-java8") into its base version and Java version. */
+export function parseRuntimeString(value, java) {
+    const [base, tag = ''] = value.split(':');
+    const fromTag = /java(\d+)/i.exec(tag)?.[1];
+    return { version: base, ...((java ?? fromTag) ? { java: java ?? fromTag } : {}) };
+}
+export function compareVersions(a, b) {
+    const pa = a.split('.').map((part) => parseInt(part, 10) || 0);
+    const pb = b.split('.').map((part) => parseInt(part, 10) || 0);
+    for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+        const diff = (pa[i] ?? 0) - (pb[i] ?? 0);
+        if (diff !== 0)
+            return diff;
+    }
+    return 0;
+}
+const minorOf = (version) => version.split('.').slice(0, 2).join('.');
+const supportsJava = (candidate, java) => !java || candidate.java.length === 0 || candidate.java.includes(java);
+/** The newest catalog entry matching the spec, or undefined when the target does not offer it. */
+export function resolveRuntime(catalog, spec) {
+    return catalog
+        .filter((v) => v.version === spec.version || v.version.startsWith(`${spec.version}.`))
+        .filter((v) => !spec.releaseChannel || v.releaseChannel?.toUpperCase() === spec.releaseChannel.toUpperCase())
+        .filter((v) => supportsJava(v, spec.java))
+        .sort((a, b) => compareVersions(b.version, a.version))[0];
+}
+function label(v, java) {
+    const javaPart = java && v.java.includes(java) ? java : v.java.includes('17') ? '17' : v.java[v.java.length - 1];
+    return [v.version, v.releaseChannel, javaPart ? `java${javaPart}` : undefined].filter(Boolean).join(' ');
+}
+/**
+ * Nearest supported versions for an unsupported runtime, best first: the newest patch of the same
+ * minor, then the oldest newer LTS, then the newest version overall. Java 17 is preferred when the
+ * original Java version is no longer offered.
+ */
+export function suggestRuntimes(catalog, current, limit = 3) {
+    const javaOffered = !current.java || catalog.some((v) => v.java.includes(current.java));
+    const java = javaOffered ? current.java : '17';
+    const usable = catalog.filter((v) => supportsJava(v, java));
+    const pool = usable.length > 0 ? usable : catalog;
+    const byNewest = [...pool].sort((a, b) => compareVersions(b.version, a.version));
+    const picks = [];
+    const add = (v) => {
+        if (v && !picks.some((p) => p.version === v.version && p.releaseChannel === v.releaseChannel))
+            picks.push(v);
+    };
+    add(byNewest.find((v) => minorOf(v.version) === minorOf(current.version)));
+    add([...pool]
+        .filter((v) => v.releaseChannel?.toUpperCase() === 'LTS' && compareVersions(v.version, current.version) > 0)
+        .sort((a, b) => compareVersions(a.version, b.version))[0]);
+    add(byNewest[0]);
+    return picks.slice(0, limit).map((v) => label(v, java));
+}
+//# sourceMappingURL=runtime.js.map

package/dist/safety/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../src/safety/runtime.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAWH,qGAAqG;AACrG,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,IAAa;IAC3D,MAAM,CAAC,IAAI,EAAE,GAAG,GAAG,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACtF,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,CAAS,EAAE,CAAS;IAChD,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACtD,MAAM,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,IAAI,IAAI,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;IAChC,CAAC;IACD,OAAO,CAAC,CAAC;AACb,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9E,MAAM,YAAY,GAAG,CAAC,SAAyB,EAAE,IAAa,EAAE,EAAE,CAC9D,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAE1E,kGAAkG;AAClG,MAAM,UAAU,cAAc,CAAC,OAAyB,EAAE,IAAiB;IACvE,OAAO,OAAO;SACT,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;SACrF,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,CAAC,cAAc,EAAE,WAAW,EAAE,KAAK,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,CAAC;SAC5G,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;SACzC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,KAAK,CAAC,CAAiB,EAAE,IAAa;IAC3C,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACjH,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7G,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,OAAyB,EAAE,OAAoB,EAAE,KAAK,GAAG,CAAC;IACtF,MAAM,WAAW,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAc,CAAC,CAAC,CAAC;IAClG,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IAClD,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAEjF,MAAM,KAAK,GAAqB,EAAE,CAAC;IACnC,MAAM,GAAG,GAAG,CAAC,CAA6B,EAAE,EAAE;QAC1C,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,cAAc,KAAK,CAAC,CAAC,cAAc,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjH,CAAC,CAAC;IACF,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3E,GAAG,CACC,CAAC,GAAG,IAAI,CAAC;SACJ,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE,WAAW,EAAE,KAAK,KAAK,IAAI,eAAe,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;SAC3G,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAChE,CAAC;IACF,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACjB,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AAC5D,CAAC"}

package/dist/safety/secret-sources.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Secret sources
+ * Property values resolved on the server from a project file or environment variables,
+ * so the values never travel in a tool call or appear in a transcript.
+ */
+import { z } from 'zod';
+export declare const fileSecretSourceSchema: z.ZodObject<{
+    file: z.ZodString;
+    format: z.ZodOptional<z.ZodEnum<{
+        env: "env";
+        json: "json";
+        properties: "properties";
+    }>>;
+    keys: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    rename: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    prefix: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const envSecretSourceSchema: z.ZodObject<{
+    env: z.ZodRecord<z.ZodString, z.ZodString>;
+}, z.core.$strip>;
+export declare const secretSourceSchema: z.ZodUnion<readonly [z.ZodObject<{
+    file: z.ZodString;
+    format: z.ZodOptional<z.ZodEnum<{
+        env: "env";
+        json: "json";
+        properties: "properties";
+    }>>;
+    keys: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    rename: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    prefix: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    env: z.ZodRecord<z.ZodString, z.ZodString>;
+}, z.core.$strip>]>;
+export type FileSecretSource = z.infer<typeof fileSecretSourceSchema>;
+export type EnvSecretSource = z.infer<typeof envSecretSourceSchema>;
+export type SecretSource = z.infer<typeof secretSourceSchema>;
+/** Parse a Java `.properties` file: `=`/`:`/space separators, comments, continuations, escapes. */
+export declare function parseProperties(text: string): Record<string, string>;
+/**
+ * Resolve one source into property values. Errors name keys and files, never values.
+ */
+export declare function resolveSecretSource(source: SecretSource, options?: {
+    projectRoot?: string;
+    env?: NodeJS.ProcessEnv;
+}): Record<string, string>;
+/** Resolve several sources in order; later sources win on duplicate keys. */
+export declare function resolveSecretSources(sources: SecretSource[] | undefined, options?: {
+    projectRoot?: string;
+    env?: NodeJS.ProcessEnv;
+}): Record<string, string>;
+//# sourceMappingURL=secret-sources.d.ts.map

package/dist/safety/secret-sources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-sources.d.ts","sourceRoot":"","sources":["../../src/safety/secret-sources.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,sBAAsB;;;;;;;;;;iBAYjC,CAAC;AAEH,eAAO,MAAM,qBAAqB;;iBAIhC,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;mBAA2D,CAAC;AAE3F,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,mGAAmG;AACnG,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA0BpE;AAkCD;;GAEG;AACH,wBAAgB,mBAAmB,CAC/B,MAAM,EAAE,YAAY,EACpB,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAO,GAChE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA0BxB;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAChC,OAAO,EAAE,YAAY,EAAE,GAAG,SAAS,EACnC,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAO,GAChE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAExB"}

package/dist/safety/secret-sources.js

@@ -0,0 +1,124 @@
+/**
+ * Secret sources
+ * Property values resolved on the server from a project file or environment variables,
+ * so the values never travel in a tool call or appear in a transcript.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { parse as parseDotenv } from 'dotenv';
+import { z } from 'zod';
+import { resolveReadablePath } from './paths.js';
+export const fileSecretSourceSchema = z.object({
+    file: z.string().describe('Path inside the project root to a .env, .properties or flat JSON file'),
+    format: z
+        .enum(['env', 'properties', 'json'])
+        .optional()
+        .describe('File format. Default: from the extension (.json, .properties, otherwise env)'),
+    keys: z.array(z.string()).optional().describe('Only take these keys from the file (default: all)'),
+    rename: z
+        .record(z.string(), z.string())
+        .optional()
+        .describe('Map a file key to a different property name, e.g. {"DB_PASSWORD": "db.password"}'),
+    prefix: z.string().optional().describe('Prefix added to every property name taken from the file'),
+});
+export const envSecretSourceSchema = z.object({
+    env: z
+        .record(z.string(), z.string())
+        .describe('Map of property name to the environment variable that holds its value in the server process'),
+});
+export const secretSourceSchema = z.union([fileSecretSourceSchema, envSecretSourceSchema]);
+/** Parse a Java `.properties` file: `=`/`:`/space separators, comments, continuations, escapes. */
+export function parseProperties(text) {
+    const result = {};
+    const lines = text.split(/\r?\n/);
+    for (let i = 0; i < lines.length; i++) {
+        let line = lines[i].replace(/^\s+/, '');
+        if (!line || line.startsWith('#') || line.startsWith('!'))
+            continue;
+        while (/(^|[^\\])(\\\\)*\\$/.test(line) && i + 1 < lines.length) {
+            line = line.slice(0, -1) + lines[++i].replace(/^\s+/, '');
+        }
+        let separator = -1;
+        for (let j = 0; j < line.length; j++) {
+            if (line[j] === '\\') {
+                j++;
+                continue;
+            }
+            if (line[j] === '=' || line[j] === ':' || /\s/.test(line[j])) {
+                separator = j;
+                break;
+            }
+        }
+        const rawKey = separator === -1 ? line : line.slice(0, separator);
+        let rest = separator === -1 ? '' : line.slice(separator);
+        rest = rest.replace(/^\s*[=:]?\s*/, '');
+        result[unescapeProperties(rawKey)] = unescapeProperties(rest);
+    }
+    return result;
+}
+function unescapeProperties(value) {
+    return value.replace(/\\(u[0-9a-fA-F]{4}|.)/g, (_, escape) => {
+        if (escape.startsWith('u') && escape.length === 5)
+            return String.fromCharCode(parseInt(escape.slice(1), 16));
+        return { t: '\t', n: '\n', r: '\r', f: '\f' }[escape] ?? escape;
+    });
+}
+function detectFormat(file) {
+    const ext = path.extname(file).toLowerCase();
+    if (ext === '.json')
+        return 'json';
+    if (ext === '.properties')
+        return 'properties';
+    return 'env';
+}
+function parseFile(text, format, file) {
+    if (format === 'env')
+        return parseDotenv(text);
+    if (format === 'properties')
+        return parseProperties(text);
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        throw new Error(`Secret source ${file} is not valid JSON`);
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new Error(`Secret source ${file} must be a flat JSON object`);
+    }
+    const entries = Object.entries(parsed);
+    const invalid = entries.filter(([, value]) => typeof value !== 'string').map(([key]) => key);
+    if (invalid.length)
+        throw new Error(`Secret source ${file} has non-string values for: ${invalid.join(', ')}`);
+    return Object.fromEntries(entries);
+}
+/**
+ * Resolve one source into property values. Errors name keys and files, never values.
+ */
+export function resolveSecretSource(source, options = {}) {
+    if ('env' in source) {
+        const env = options.env ?? process.env;
+        const missing = Object.entries(source.env)
+            .filter(([, variable]) => env[variable] === undefined || env[variable] === '')
+            .map(([, variable]) => variable);
+        if (missing.length)
+            throw new Error(`Environment variables not set in the server process: ${missing.join(', ')}`);
+        return Object.fromEntries(Object.entries(source.env).map(([key, variable]) => [key, env[variable]]));
+    }
+    const resolved = resolveReadablePath(source.file, { projectRoot: options.projectRoot });
+    const values = parseFile(fs.readFileSync(resolved.path, 'utf8'), source.format ?? detectFormat(source.file), source.file);
+    const selected = source.keys ?? Object.keys(values);
+    const missing = selected.filter((key) => !(key in values));
+    if (missing.length)
+        throw new Error(`Keys not found in ${source.file}: ${missing.join(', ')}`);
+    const result = {};
+    for (const key of selected) {
+        result[`${source.prefix ?? ''}${source.rename?.[key] ?? key}`] = values[key];
+    }
+    return result;
+}
+/** Resolve several sources in order; later sources win on duplicate keys. */
+export function resolveSecretSources(sources, options = {}) {
+    return Object.assign({}, ...(sources ?? []).map((source) => resolveSecretSource(source, options)));
+}
+//# sourceMappingURL=secret-sources.js.map

package/dist/safety/secret-sources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-sources.js","sourceRoot":"","sources":["../../src/safety/secret-sources.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,KAAK,IAAI,WAAW,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEjD,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uEAAuE,CAAC;IAClG,MAAM,EAAE,CAAC;SACJ,IAAI,CAAC,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;SACnC,QAAQ,EAAE;SACV,QAAQ,CAAC,8EAA8E,CAAC;IAC7F,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mDAAmD,CAAC;IAClG,MAAM,EAAE,CAAC;SACJ,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;SAC9B,QAAQ,EAAE;SACV,QAAQ,CAAC,kFAAkF,CAAC;IACjG,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yDAAyD,CAAC;CACpG,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,GAAG,EAAE,CAAC;SACD,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;SAC9B,QAAQ,CAAC,6FAA6F,CAAC;CAC/G,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,sBAAsB,EAAE,qBAAqB,CAAC,CAAC,CAAC;AAM3F,mGAAmG;AACnG,MAAM,UAAU,eAAe,CAAC,IAAY;IACxC,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,IAAI,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACpE,OAAO,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC9D,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC;QACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACnB,CAAC,EAAE,CAAC;gBACJ,SAAS;YACb,CAAC;YACD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3D,SAAS,GAAG,CAAC,CAAC;gBACd,MAAM;YACV,CAAC;QACL,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAClE,IAAI,IAAI,GAAG,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACzD,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QACxC,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACrC,OAAO,KAAK,CAAC,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAAC,EAAE,MAAc,EAAE,EAAE;QACjE,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAC7G,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC;IACpE,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAC7C,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,MAAM,CAAC;IACnC,IAAI,GAAG,KAAK,aAAa;QAAE,OAAO,YAAY,CAAC;IAC/C,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,MAAqC,EAAE,IAAY;IAChF,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,MAAM,KAAK,YAAY;QAAE,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACL,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,oBAAoB,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,6BAA6B,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;IAC7F,IAAI,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,+BAA+B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9G,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAA2B,CAAC;AACjE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAC/B,MAAoB,EACpB,UAA6D,EAAE;IAE/D,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC;QAClB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;aACrC,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;aAC7E,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,OAAO,CAAC,MAAM;YACd,MAAM,IAAI,KAAK,CAAC,wDAAwD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClG,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAW,CAAC,CAAC,CAAC,CAAC;IACnH,CAAC;IAED,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACxF,MAAM,MAAM,GAAG,SAAS,CACpB,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,EACtC,MAAM,CAAC,MAAM,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,EAC1C,MAAM,CAAC,IAAI,CACd,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC;IAC3D,IAAI,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAE/F,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,oBAAoB,CAChC,OAAmC,EACnC,UAA6D,EAAE;IAE/D,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;AACvG,CAAC"}

package/dist/safety/secrets.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Secret detection and redaction
+ * Keeps secret values out of tool responses, CLI output and error messages.
+ */
+/** The placeholder the platform returns for stored secure property values. */
+export declare const MASKED = "******";
+/**
+ * True when a property name looks like it holds a secret. The name is split on `.`, `_`, `-`
+ * and camel-case boundaries, so `db.password`, `clientSecret` and `API_KEY` all match while
+ * `tokenizer.mode` or `keystore.type` do not.
+ */
+export declare function looksSecret(key: string): boolean;
+/** Mask a value, keeping the last two characters of long values so a caller can tell values apart. */
+export declare function redactValue(value: string): string;
+/**
+ * Mask secret-looking entries of a flat record. `keys` forces masking for extra names
+ * (for example every key of a secure property map).
+ */
+export declare function redactRecord(record: Record<string, string>, options?: {
+    keys?: Iterable<string>;
+}): Record<string, string>;
+/**
+ * Recursively mask secret-looking fields in an arbitrary JSON value, such as an API error
+ * body the platform echoed back.
+ */
+export declare function redactDeep(value: unknown, depth?: number): unknown;
+/**
+ * Replace every occurrence of known secret values in free text. Values shorter than four
+ * characters are skipped because they would match ordinary text.
+ */
+export declare function redactText(text: string, knownSecrets: Iterable<string>): string;
+//# sourceMappingURL=secrets.d.ts.map

package/dist/safety/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/safety/secrets.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,8EAA8E;AAC9E,eAAO,MAAM,MAAM,WAAW,CAAC;AAuB/B;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAWhD;AAED,sGAAsG;AACtG,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGjD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,GAAE;IAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;CAAO,GAO7F,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAC9B;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,SAAI,GAAG,OAAO,CAY7D;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,CAM/E"}

package/dist/safety/secrets.js

@@ -0,0 +1,91 @@
+/**
+ * Secret detection and redaction
+ * Keeps secret values out of tool responses, CLI output and error messages.
+ */
+/** The placeholder the platform returns for stored secure property values. */
+export const MASKED = '******';
+const SECRET_SEGMENTS = new Set([
+    'password',
+    'passwd',
+    'pwd',
+    'secret',
+    'token',
+    'credential',
+    'credentials',
+    'passphrase',
+    'apikey',
+    'privatekey',
+    'clientsecret',
+]);
+const SECRET_PAIRS = [
+    ['private', 'key'],
+    ['api', 'key'],
+    ['client', 'secret'],
+    ['access', 'key'],
+];
+/**
+ * True when a property name looks like it holds a secret. The name is split on `.`, `_`, `-`
+ * and camel-case boundaries, so `db.password`, `clientSecret` and `API_KEY` all match while
+ * `tokenizer.mode` or `keystore.type` do not.
+ */
+export function looksSecret(key) {
+    const segments = key
+        .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
+        .toLowerCase()
+        .split(/[\s._\-/:]+/)
+        .filter(Boolean);
+    if (segments.some((segment) => SECRET_SEGMENTS.has(segment)))
+        return true;
+    for (let i = 0; i < segments.length - 1; i++) {
+        if (SECRET_PAIRS.some(([a, b]) => segments[i] === a && segments[i + 1] === b))
+            return true;
+    }
+    return false;
+}
+/** Mask a value, keeping the last two characters of long values so a caller can tell values apart. */
+export function redactValue(value) {
+    if (value === MASKED)
+        return MASKED;
+    return value.length > 8 ? `${MASKED}…${value.slice(-2)}` : MASKED;
+}
+/**
+ * Mask secret-looking entries of a flat record. `keys` forces masking for extra names
+ * (for example every key of a secure property map).
+ */
+export function redactRecord(record, options = {}) {
+    const forced = new Set(options.keys ?? []);
+    return Object.fromEntries(Object.entries(record).map(([key, value]) => [
+        key,
+        forced.has(key) || looksSecret(key) ? redactValue(String(value)) : value,
+    ]));
+}
+/**
+ * Recursively mask secret-looking fields in an arbitrary JSON value, such as an API error
+ * body the platform echoed back.
+ */
+export function redactDeep(value, depth = 0) {
+    if (depth > 20)
+        return value;
+    if (Array.isArray(value))
+        return value.map((item) => redactDeep(item, depth + 1));
+    if (value && typeof value === 'object') {
+        return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+            key,
+            looksSecret(key) && typeof item === 'string' ? redactValue(item) : redactDeep(item, depth + 1),
+        ]));
+    }
+    return value;
+}
+/**
+ * Replace every occurrence of known secret values in free text. Values shorter than four
+ * characters are skipped because they would match ordinary text.
+ */
+export function redactText(text, knownSecrets) {
+    const values = [...new Set(knownSecrets)].filter((v) => v && v !== MASKED && v.length >= 4);
+    values.sort((a, b) => b.length - a.length);
+    let result = text;
+    for (const value of values)
+        result = result.split(value).join(MASKED);
+    return result;
+}
+//# sourceMappingURL=secrets.js.map

package/dist/safety/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/safety/secrets.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,8EAA8E;AAC9E,MAAM,CAAC,MAAM,MAAM,GAAG,QAAQ,CAAC;AAE/B,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC5B,UAAU;IACV,QAAQ;IACR,KAAK;IACL,QAAQ;IACR,OAAO;IACP,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,QAAQ;IACR,YAAY;IACZ,cAAc;CACjB,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG;IACjB,CAAC,SAAS,EAAE,KAAK,CAAC;IAClB,CAAC,KAAK,EAAE,KAAK,CAAC;IACd,CAAC,QAAQ,EAAE,QAAQ,CAAC;IACpB,CAAC,QAAQ,EAAE,KAAK,CAAC;CACpB,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACnC,MAAM,QAAQ,GAAG,GAAG;SACf,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC;SACtC,WAAW,EAAE;SACb,KAAK,CAAC,aAAa,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACrB,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAC/F,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,WAAW,CAAC,KAAa;IACrC,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IACpC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AACtE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,MAA8B,EAAE,UAAuC,EAAE;IAClG,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC,WAAW,CACrB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QACzC,GAAG;QACH,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK;KAC3E,CAAC,CACqB,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,KAAc,EAAE,KAAK,GAAG,CAAC;IAChD,IAAI,KAAK,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IAClF,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACrC,OAAO,MAAM,CAAC,WAAW,CACrB,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;YAClE,GAAG;YACH,WAAW,CAAC,GAAG,CAAC,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC;SACjG,CAAC,CACL,CAAC;IACN,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,YAA8B;IACnE,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;IAC5F,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,KAAK,IAAI,MAAM;QAAE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtE,OAAO,MAAM,CAAC;AAClB,CAAC"}

package/dist/utils/errors.d.ts

@@ -6,7 +6,20 @@
  * Extracts a human-readable message from an unknown error value.
  * For AxiosErrors, prefers the API response body (which often contains
  * a more descriptive message than the generic HTTP status).
- * Safely handles Error instances, strings, and other types.
+ * Safely handles Error instances, strings, and other types. Secret-looking
+ * fields in an echoed response body are masked.
  */
 export declare function errorMessage(error: unknown): string;
+/**
+ * A metrics query the monitoring service rejected or could not run. Carries the platform's own
+ * message (syntax errors, unknown datasources or attributes, oversized limits) so callers never
+ * mistake a broken query for "no data".
+ */
+export declare class AmqlQueryError extends Error {
+    readonly query: string;
+    readonly status?: number | undefined;
+    readonly transactionId?: string | undefined;
+    constructor(message: string, query: string, status?: number | undefined, transactionId?: string | undefined);
+    static from(error: unknown, query: string): AmqlQueryError;
+}
 //# sourceMappingURL=errors.d.ts.map