@sfdxy/anypoint-connect 0.16.2 → 0.17.0

package/dist/safety/guards.d.ts

@@ -20,6 +20,16 @@ export declare function validateJarFile(jarPath: string): {
     artifactId?: string;
     version?: string;
 };
+/**
+ * Confirm a production write from the CLI. Outside production, with --force, or when a user-level
+ * pre-approval covers the organization, the environment and `tool` (the matching MCP tool name), no
+ * prompt is shown; otherwise the typed phrase is required.
+ */
+export declare function confirmProductionWrite(env: {
+    name: string;
+    id: string;
+    isProduction?: boolean;
+}, orgId: string, tool: string, force?: boolean): Promise<boolean>;
 /**
  * Ask for production deployment confirmation
  */

package/dist/safety/guards.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guards.d.ts","sourceRoot":"","sources":["../../src/safety/guards.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAG5D;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,OAAO,GAAG,OAAO,CAIhF;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAC9B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,aAAa,GAAG,IAAI,EAC9B,UAAU,CAAC,EAAE,MAAM,EACnB,YAAY,CAAC,EAAE,OAAO,GACvB,MAAM,CA4BR;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG;IAC9C,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB,CAuBA;AAED;;GAEG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAcvG"}
+{"version":3,"file":"guards.d.ts","sourceRoot":"","sources":["../../src/safety/guards.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAI5D;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,OAAO,GAAG,OAAO,CAIhF;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAC9B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,aAAa,GAAG,IAAI,EAC9B,UAAU,CAAC,EAAE,MAAM,EACnB,YAAY,CAAC,EAAE,OAAO,GACvB,MAAM,CA4BR;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG;IAC9C,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB,CAuBA;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CACxC,GAAG,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,EACzD,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,KAAK,UAAQ,GACd,OAAO,CAAC,OAAO,CAAC,CAYlB;AAED;;GAEG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAcvG"}

package/dist/safety/guards.js

@@ -5,6 +5,7 @@
 import * as fs from 'fs';
 import * as readline from 'readline';
 import chalk from 'chalk';
+import { checkPreapproval } from './preapproval.js';
 /**
  * Check if an environment is a production environment
  */
@@ -63,6 +64,21 @@ export function validateJarFile(jarPath) {
         version: match?.[2],
     };
 }
+/**
+ * Confirm a production write from the CLI. Outside production, with --force, or when a user-level
+ * pre-approval covers the organization, the environment and `tool` (the matching MCP tool name), no
+ * prompt is shown; otherwise the typed phrase is required.
+ */
+export async function confirmProductionWrite(env, orgId, tool, force = false) {
+    if (!isProductionEnv(env.name, env.isProduction) || force)
+        return true;
+    const decision = checkPreapproval({ orgId, env }, tool);
+    if (decision.productionPreapproved) {
+        console.log(chalk.yellow(`  Production pre-approved for ${tool} in ${env.name} (${decision.preapprovalSource}${decision.preapprovalExpires ? `, until ${decision.preapprovalExpires}` : ''})`));
+        return true;
+    }
+    return confirmProductionDeploy(env.name, env.isProduction);
+}
 /**
  * Ask for production deployment confirmation
  */

package/dist/safety/guards.js.map

@@ -1 +1 @@
-{"version":3,"file":"guards.js","sourceRoot":"","sources":["../../src/safety/guards.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,QAAQ,MAAM,UAAU,CAAC;AAErC,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,YAAsB;IACnE,IAAI,YAAY,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACpC,OAAO,KAAK,KAAK,YAAY,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;AACtF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAC9B,OAAe,EACf,OAAe,EACf,QAA8B,EAC9B,UAAmB,EACnB,YAAsB;IAEtB,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,eAAe,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,CAAC;QAC5D,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACpE,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAEpE,IAAI,QAAQ,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,OAAO,IAAI,SAAS,CAAC;QAChE,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,SAAS,CAAC;QAC5C,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,EAAE,QAAQ,IAAI,CAAC,CAAC;QAChD,KAAK,CAAC,IAAI,CACN,KAAK,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,OAAO,KAAK,MAAM,KAAK,QAAQ,WAAW,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAC5G,CAAC;IACN,CAAC;SAAM,CAAC;QACJ,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,IAAI,UAAU,EAAE,CAAC;QACb,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,UAAU,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAM3C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,OAAO,EAAE,EAAE,CAAC;IACjE,CAAC;IAED,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAClB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;IACxD,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;IACxE,CAAC;IAED,6CAA6C;IAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAChD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAEvF,OAAO;QACH,KAAK,EAAE,IAAI;QACX,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACtB,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;KACtB,CAAC;AACN,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAAe,EAAE,YAAsB;IACjF,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzD,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC;QAChC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,MAAM,EAAE,OAAO,CAAC,MAAM;KACzB,CAAC,CAAC;IAEH,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC3B,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,4CAA4C,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE;YACjF,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,sBAAsB,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"guards.js","sourceRoot":"","sources":["../../src/safety/guards.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,QAAQ,MAAM,UAAU,CAAC;AAErC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpD;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,YAAsB;IACnE,IAAI,YAAY,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACpC,OAAO,KAAK,KAAK,YAAY,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;AACtF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAC9B,OAAe,EACf,OAAe,EACf,QAA8B,EAC9B,UAAmB,EACnB,YAAsB;IAEtB,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,eAAe,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,CAAC;QAC5D,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACpE,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAEpE,IAAI,QAAQ,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,OAAO,IAAI,SAAS,CAAC;QAChE,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,SAAS,CAAC;QAC5C,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,EAAE,QAAQ,IAAI,CAAC,CAAC;QAChD,KAAK,CAAC,IAAI,CACN,KAAK,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,OAAO,KAAK,MAAM,KAAK,QAAQ,WAAW,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAC5G,CAAC;IACN,CAAC;SAAM,CAAC;QACJ,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,IAAI,UAAU,EAAE,CAAC;QACb,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,UAAU,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAM3C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,OAAO,EAAE,EAAE,CAAC;IACjE,CAAC;IAED,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAClB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;IACxD,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;IACxE,CAAC;IAED,6CAA6C;IAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAChD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAEvF,OAAO;QACH,KAAK,EAAE,IAAI;QACX,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACtB,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;KACtB,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CACxC,GAAyD,EACzD,KAAa,EACb,IAAY,EACZ,KAAK,GAAG,KAAK;IAEb,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,IAAI,KAAK;QAAE,OAAO,IAAI,CAAC;IACvE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;IACxD,IAAI,QAAQ,CAAC,qBAAqB,EAAE,CAAC;QACjC,OAAO,CAAC,GAAG,CACP,KAAK,CAAC,MAAM,CACR,iCAAiC,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,iBAAiB,GAAG,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC,WAAW,QAAQ,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CACvK,CACJ,CAAC;QACF,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,uBAAuB,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;AAC/D,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAAe,EAAE,YAAsB;IACjF,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzD,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC;QAChC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,MAAM,EAAE,OAAO,CAAC,MAAM;KACzB,CAAC,CAAC;IAEH,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC3B,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,4CAA4C,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE;YACjF,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,sBAAsB,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/safety/preapproval.d.ts

@@ -0,0 +1,102 @@
+/**
+ * Production policy: pre-approvals and unmarked-artifact allowances
+ *
+ * Both live only in the user-level store, ~/.anypoint-connect/production-approvals.json, outside any
+ * repository, so a branch cannot plant or widen one. Every entry is bound to a resolved organization
+ * ID and environment ID; names are kept for display only and never matched. A `productionPreapproval`
+ * found in a project's .anypoint-connect.json is ignored and reported.
+ *
+ *   {
+ *     "productionPreapprovals": [
+ *       { "orgId": "...", "environmentId": "...", "environmentName": "Production",
+ *         "tools": ["update_app"] | "all-mutating", "expires": "2026-12-31T00:00:00Z", "projectPath": "/abs/repo" }
+ *     ],
+ *     "unmarkedArtifactAllowances": [
+ *       { "orgId": "...", "environmentId": "...", "environmentName": "Production", "expires": "...", "projectPath": "..." }
+ *     ]
+ *   }
+ *
+ * A pre-approval stands in for confirmProduction (MCP) and the typed phrase (CLI). An allowance lets
+ * jars without a build marker go to that environment. Neither waives confirm: true, bound IDs,
+ * digests, or the refusal of a jar marked not production deployable.
+ */
+/** Tools whose production confirmation can be pre-approved. The CLI uses the same names. */
+export declare const PREAPPROVABLE_TOOLS: readonly ["deploy_jar", "deploy_app", "update_app", "update_app_artifact", "rollback_app", "update_app_settings", "restart_app", "scale_app", "stop_app", "start_app", "smoke_test_api", "delete_app", "create_alert", "update_alert", "set_alert_enabled", "delete_alert"];
+export type PreapprovableTool = (typeof PREAPPROVABLE_TOOLS)[number];
+export declare const ALL_MUTATING = "all-mutating";
+/** Tools that "all-mutating" does not cover; they are pre-approved only when named. */
+export declare const NAMED_ONLY_TOOLS: readonly PreapprovableTool[];
+export declare const APPROVALS_FILE_NAME = "production-approvals.json";
+export interface ScopedEntry {
+    orgId: string;
+    environmentId: string;
+    /** Display only; never matched. */
+    environmentName?: string;
+    /** ISO 8601 date-time; the entry is ignored from then on. */
+    expires?: string;
+    /** Absolute project root; when set, the entry applies only to tools run in that project. */
+    projectPath?: string;
+}
+export interface ProductionPreapproval extends ScopedEntry {
+    tools: PreapprovableTool[] | typeof ALL_MUTATING;
+}
+export type UnmarkedArtifactAllowance = ScopedEntry;
+export interface ApprovalStore {
+    productionPreapprovals?: ProductionPreapproval[];
+    unmarkedArtifactAllowances?: UnmarkedArtifactAllowance[];
+}
+/** The user-level store path. */
+export declare function approvalsFile(): string;
+/** Validate one pre-approval entry. Throws with every problem found. */
+export declare function validatePreapproval(input: unknown): ProductionPreapproval;
+/** Validate one unmarked-artifact allowance. Throws with every problem found. */
+export declare function validateUnmarkedAllowance(input: unknown): UnmarkedArtifactAllowance;
+export type EntryView<T> = T & {
+    expired: boolean;
+};
+export interface ApprovalState {
+    source: string;
+    productionPreapprovals: EntryView<ProductionPreapproval>[];
+    unmarkedArtifactAllowances: EntryView<UnmarkedArtifactAllowance>[];
+    /** Entries or files that failed validation; they are ignored. */
+    invalid: string[];
+}
+/** Read and validate the user-level store. */
+export declare function readApprovalState(options?: {
+    now?: number;
+}): ApprovalState;
+/** Store a pre-approval (replacing one with the same scope), or remove it when `entry` is null. */
+export declare function savePreapproval(scope: ScopedEntry, entry: ProductionPreapproval | null): string;
+/** Store an unmarked-artifact allowance (replacing one with the same scope), or remove it. */
+export declare function saveUnmarkedAllowance(scope: ScopedEntry, entry: UnmarkedArtifactAllowance | null): string;
+export interface PolicyTarget {
+    orgId: string;
+    env: {
+        id: string;
+    };
+}
+interface MatchOptions {
+    now?: number;
+    state?: ApprovalState;
+    /** The current project root; resolved only when an entry is project-scoped. */
+    projectRoot?: string;
+}
+export interface PreapprovalDecision {
+    productionPreapproved: boolean;
+    /** Where the matching entry lives, when one matched. */
+    preapprovalSource?: string;
+    preapprovalExpires?: string;
+}
+/** Whether a production write by `tool` to the target org and environment is pre-approved. */
+export declare function checkPreapproval(target: PolicyTarget, tool: string, options?: MatchOptions): PreapprovalDecision;
+export interface UnmarkedDecision {
+    unmarkedAllowed: boolean;
+    source?: string;
+    expires?: string;
+}
+/** Whether jars without a build marker may go to the target org and environment. */
+export declare function checkUnmarkedAllowance(target: PolicyTarget, options?: MatchOptions): UnmarkedDecision;
+/** A warning when the project's .anypoint-connect.json carries an approval, which is never honored. */
+export declare function ignoredProjectApprovalWarning(startDir?: string): string | undefined;
+export {};
+//# sourceMappingURL=preapproval.d.ts.map

package/dist/safety/preapproval.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preapproval.d.ts","sourceRoot":"","sources":["../../src/safety/preapproval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAOH,4FAA4F;AAC5F,eAAO,MAAM,mBAAmB,6QAiBtB,CAAC;AACX,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAErE,eAAO,MAAM,YAAY,iBAAiB,CAAC;AAE3C,uFAAuF;AACvF,eAAO,MAAM,gBAAgB,EAAE,SAAS,iBAAiB,EAAmC,CAAC;AAE7F,eAAO,MAAM,mBAAmB,8BAA8B,CAAC;AAE/D,MAAM,WAAW,WAAW;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,mCAAmC;IACnC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6DAA6D;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4FAA4F;IAC5F,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,qBAAsB,SAAQ,WAAW;IACtD,KAAK,EAAE,iBAAiB,EAAE,GAAG,OAAO,YAAY,CAAC;CACpD;AAED,MAAM,MAAM,yBAAyB,GAAG,WAAW,CAAC;AAEpD,MAAM,WAAW,aAAa;IAC1B,sBAAsB,CAAC,EAAE,qBAAqB,EAAE,CAAC;IACjD,0BAA0B,CAAC,EAAE,yBAAyB,EAAE,CAAC;CAC5D;AAED,iCAAiC;AACjC,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAwCD,wEAAwE;AACxE,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,qBAAqB,CAmBzE;AAED,iFAAiF;AACjF,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,yBAAyB,CAOnF;AAED,MAAM,MAAM,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC;AAEpD,MAAM,WAAW,aAAa;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB,EAAE,SAAS,CAAC,qBAAqB,CAAC,EAAE,CAAC;IAC3D,0BAA0B,EAAE,SAAS,CAAC,yBAAyB,CAAC,EAAE,CAAC;IACnE,iEAAiE;IACjE,OAAO,EAAE,MAAM,EAAE,CAAC;CACrB;AAYD,8CAA8C;AAC9C,wBAAgB,iBAAiB,CAAC,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,aAAa,CAuB/E;AAqBD,mGAAmG;AACnG,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,qBAAqB,GAAG,IAAI,GAAG,MAAM,CAM/F;AAED,8FAA8F;AAC9F,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,yBAAyB,GAAG,IAAI,GAAG,MAAM,CAMzG;AAYD,MAAM,WAAW,YAAY;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;CACvB;AAED,UAAU,YAAY;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB;AAgBD,MAAM,WAAW,mBAAmB;IAChC,qBAAqB,EAAE,OAAO,CAAC;IAC/B,wDAAwD;IACxD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,8FAA8F;AAC9F,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,YAAiB,GAAG,mBAAmB,CAUpH;AAED,MAAM,WAAW,gBAAgB;IAC7B,eAAe,EAAE,OAAO,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,oFAAoF;AACpF,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,GAAE,YAAiB,GAAG,gBAAgB,CASzG;AAED,uGAAuG;AACvG,wBAAgB,6BAA6B,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQnF"}

package/dist/safety/preapproval.js

@@ -0,0 +1,251 @@
+/**
+ * Production policy: pre-approvals and unmarked-artifact allowances
+ *
+ * Both live only in the user-level store, ~/.anypoint-connect/production-approvals.json, outside any
+ * repository, so a branch cannot plant or widen one. Every entry is bound to a resolved organization
+ * ID and environment ID; names are kept for display only and never matched. A `productionPreapproval`
+ * found in a project's .anypoint-connect.json is ignored and reported.
+ *
+ *   {
+ *     "productionPreapprovals": [
+ *       { "orgId": "...", "environmentId": "...", "environmentName": "Production",
+ *         "tools": ["update_app"] | "all-mutating", "expires": "2026-12-31T00:00:00Z", "projectPath": "/abs/repo" }
+ *     ],
+ *     "unmarkedArtifactAllowances": [
+ *       { "orgId": "...", "environmentId": "...", "environmentName": "Production", "expires": "...", "projectPath": "..." }
+ *     ]
+ *   }
+ *
+ * A pre-approval stands in for confirmProduction (MCP) and the typed phrase (CLI). An allowance lets
+ * jars without a build marker go to that environment. Neither waives confirm: true, bound IDs,
+ * digests, or the refusal of a jar marked not production deployable.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { discoverProjectConfig, findProjectConfigFile, getConfigDir } from '../config/profiles.js';
+import { resolveProjectRoot } from './paths.js';
+/** Tools whose production confirmation can be pre-approved. The CLI uses the same names. */
+export const PREAPPROVABLE_TOOLS = [
+    'deploy_jar',
+    'deploy_app',
+    'update_app',
+    'update_app_artifact',
+    'rollback_app',
+    'update_app_settings',
+    'restart_app',
+    'scale_app',
+    'stop_app',
+    'start_app',
+    'smoke_test_api',
+    'delete_app',
+    'create_alert',
+    'update_alert',
+    'set_alert_enabled',
+    'delete_alert',
+];
+export const ALL_MUTATING = 'all-mutating';
+/** Tools that "all-mutating" does not cover; they are pre-approved only when named. */
+export const NAMED_ONLY_TOOLS = ['delete_app', 'delete_alert'];
+export const APPROVALS_FILE_NAME = 'production-approvals.json';
+/** The user-level store path. */
+export function approvalsFile() {
+    return path.join(getConfigDir(), APPROVALS_FILE_NAME);
+}
+function validateScope(input, errors) {
+    const { orgId, environmentId, environmentName, expires, projectPath } = input;
+    for (const [name, value] of [
+        ['orgId', orgId],
+        ['environmentId', environmentId],
+    ]) {
+        if (typeof value !== 'string' || !value.trim())
+            errors.push(`${name} must be a non-empty ID`);
+        else if (/[*?]/.test(value))
+            errors.push(`${name}: wildcards are not allowed`);
+    }
+    if (environmentName !== undefined && typeof environmentName !== 'string')
+        errors.push('environmentName must be a string');
+    if (expires !== undefined && (typeof expires !== 'string' || Number.isNaN(Date.parse(expires)))) {
+        errors.push('expires must be an ISO 8601 date-time');
+    }
+    if (projectPath !== undefined && (typeof projectPath !== 'string' || !path.isAbsolute(projectPath))) {
+        errors.push('projectPath must be an absolute path');
+    }
+    return {
+        orgId: orgId,
+        environmentId: environmentId,
+        ...(environmentName !== undefined ? { environmentName: environmentName } : {}),
+        ...(expires !== undefined ? { expires: expires } : {}),
+        ...(projectPath !== undefined ? { projectPath: projectPath } : {}),
+    };
+}
+function asObject(input, what) {
+    if (!input || typeof input !== 'object' || Array.isArray(input))
+        throw new Error(`${what} must be an object`);
+    return input;
+}
+function rejectUnknown(input, allowed, errors) {
+    const unknown = Object.keys(input).filter((key) => !allowed.includes(key));
+    if (unknown.length)
+        errors.push(`unknown fields: ${unknown.join(', ')}`);
+}
+const SCOPE_FIELDS = ['orgId', 'environmentId', 'environmentName', 'expires', 'projectPath'];
+/** Validate one pre-approval entry. Throws with every problem found. */
+export function validatePreapproval(input) {
+    const object = asObject(input, 'A production pre-approval');
+    const errors = [];
+    rejectUnknown(object, [...SCOPE_FIELDS, 'tools'], errors);
+    const scope = validateScope(object, errors);
+    const { tools } = object;
+    if (tools !== ALL_MUTATING) {
+        if (!Array.isArray(tools) || tools.length === 0) {
+            errors.push(`tools must be "${ALL_MUTATING}" or a non-empty list of tool names`);
+        }
+        else {
+            for (const tool of tools) {
+                if (!PREAPPROVABLE_TOOLS.includes(tool)) {
+                    errors.push(`"${String(tool)}" is not a pre-approvable tool (${PREAPPROVABLE_TOOLS.join(', ')})`);
+                }
+            }
+        }
+    }
+    if (errors.length)
+        throw new Error(`Invalid production pre-approval:\n- ${errors.join('\n- ')}`);
+    return { ...scope, tools: tools === ALL_MUTATING ? ALL_MUTATING : [...new Set(tools)] };
+}
+/** Validate one unmarked-artifact allowance. Throws with every problem found. */
+export function validateUnmarkedAllowance(input) {
+    const object = asObject(input, 'An unmarked-artifact allowance');
+    const errors = [];
+    rejectUnknown(object, SCOPE_FIELDS, errors);
+    const scope = validateScope(object, errors);
+    if (errors.length)
+        throw new Error(`Invalid unmarked-artifact allowance:\n- ${errors.join('\n- ')}`);
+    return scope;
+}
+function readRawStore(file) {
+    if (!fs.existsSync(file))
+        return { store: {}, invalid: [] };
+    try {
+        const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
+        return { store: asObject(parsed, file), invalid: [] };
+    }
+    catch (error) {
+        return { store: {}, invalid: [`${file} is unreadable: ${error.message}`] };
+    }
+}
+/** Read and validate the user-level store. */
+export function readApprovalState(options = {}) {
+    const source = approvalsFile();
+    const { store, invalid } = readRawStore(source);
+    const now = options.now ?? Date.now();
+    const expired = (expires) => expires !== undefined && Date.parse(expires) <= now;
+    const state = { source, productionPreapprovals: [], unmarkedArtifactAllowances: [], invalid };
+    for (const item of Array.isArray(store.productionPreapprovals) ? store.productionPreapprovals : []) {
+        try {
+            const entry = validatePreapproval(item);
+            state.productionPreapprovals.push({ ...entry, expired: expired(entry.expires) });
+        }
+        catch (error) {
+            state.invalid.push(error.message);
+        }
+    }
+    for (const item of Array.isArray(store.unmarkedArtifactAllowances) ? store.unmarkedArtifactAllowances : []) {
+        try {
+            const entry = validateUnmarkedAllowance(item);
+            state.unmarkedArtifactAllowances.push({ ...entry, expired: expired(entry.expires) });
+        }
+        catch (error) {
+            state.invalid.push(error.message);
+        }
+    }
+    return state;
+}
+function sameScope(a, b) {
+    return a.orgId === b.orgId && a.environmentId === b.environmentId && a.projectPath === b.projectPath;
+}
+/** Replace (or, with `entry` null, remove) the entry with the same org, environment and project. */
+function upsert(list, scope, entry) {
+    const rest = (list ?? []).filter((item) => !sameScope(item, scope));
+    return entry ? [...rest, entry] : rest;
+}
+function writeStore(update) {
+    const file = approvalsFile();
+    const { store, invalid } = readRawStore(file);
+    if (invalid.length)
+        throw new Error(`${invalid[0]}; fix or remove it first`);
+    fs.writeFileSync(file, JSON.stringify(update(store), null, 2) + '\n', { mode: 0o600 });
+    fs.chmodSync(file, 0o600);
+    return file;
+}
+/** Store a pre-approval (replacing one with the same scope), or remove it when `entry` is null. */
+export function savePreapproval(scope, entry) {
+    const valid = entry ? validatePreapproval(entry) : null;
+    return writeStore((store) => ({
+        ...store,
+        productionPreapprovals: upsert(store.productionPreapprovals, scope, valid),
+    }));
+}
+/** Store an unmarked-artifact allowance (replacing one with the same scope), or remove it. */
+export function saveUnmarkedAllowance(scope, entry) {
+    const valid = entry ? validateUnmarkedAllowance(entry) : null;
+    return writeStore((store) => ({
+        ...store,
+        unmarkedArtifactAllowances: upsert(store.unmarkedArtifactAllowances, scope, valid),
+    }));
+}
+function coversTool(entry, tool) {
+    if (entry.tools === ALL_MUTATING) {
+        return (PREAPPROVABLE_TOOLS.includes(tool) &&
+            !NAMED_ONLY_TOOLS.includes(tool));
+    }
+    return entry.tools.includes(tool);
+}
+function matcher(target, options) {
+    let root = options.projectRoot;
+    const projectMatches = (projectPath) => {
+        if (!projectPath)
+            return true;
+        root ??= resolveProjectRoot();
+        return path.resolve(projectPath) === path.resolve(root);
+    };
+    return (entry) => !entry.expired &&
+        entry.orgId === target.orgId &&
+        entry.environmentId === target.env.id &&
+        projectMatches(entry.projectPath);
+}
+/** Whether a production write by `tool` to the target org and environment is pre-approved. */
+export function checkPreapproval(target, tool, options = {}) {
+    const state = options.state ?? readApprovalState(options);
+    const inScope = matcher(target, options);
+    const match = state.productionPreapprovals.find((e) => inScope(e) && coversTool(e, tool));
+    if (!match)
+        return { productionPreapproved: false };
+    return {
+        productionPreapproved: true,
+        preapprovalSource: `${state.source} productionPreapprovals`,
+        ...(match.expires ? { preapprovalExpires: match.expires } : {}),
+    };
+}
+/** Whether jars without a build marker may go to the target org and environment. */
+export function checkUnmarkedAllowance(target, options = {}) {
+    const state = options.state ?? readApprovalState(options);
+    const match = state.unmarkedArtifactAllowances.find(matcher(target, options));
+    if (!match)
+        return { unmarkedAllowed: false };
+    return {
+        unmarkedAllowed: true,
+        source: `${state.source} unmarkedArtifactAllowances`,
+        ...(match.expires ? { expires: match.expires } : {}),
+    };
+}
+/** A warning when the project's .anypoint-connect.json carries an approval, which is never honored. */
+export function ignoredProjectApprovalWarning(startDir) {
+    const config = discoverProjectConfig(startDir);
+    if (!config)
+        return undefined;
+    const keys = ['productionPreapproval', 'productionPreapprovals', 'unmarkedArtifactAllowances'].filter((key) => config[key] !== undefined);
+    if (!keys.length)
+        return undefined;
+    return `${findProjectConfigFile(startDir)} contains ${keys.join(', ')}, which is ignored: production approvals are read only from ${approvalsFile()}`;
+}
+//# sourceMappingURL=preapproval.js.map

package/dist/safety/preapproval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preapproval.js","sourceRoot":"","sources":["../../src/safety/preapproval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACnG,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEhD,4FAA4F;AAC5F,MAAM,CAAC,MAAM,mBAAmB,GAAG;IAC/B,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,qBAAqB;IACrB,cAAc;IACd,qBAAqB;IACrB,aAAa;IACb,WAAW;IACX,UAAU;IACV,WAAW;IACX,gBAAgB;IAChB,YAAY;IACZ,cAAc;IACd,cAAc;IACd,mBAAmB;IACnB,cAAc;CACR,CAAC;AAGX,MAAM,CAAC,MAAM,YAAY,GAAG,cAAc,CAAC;AAE3C,uFAAuF;AACvF,MAAM,CAAC,MAAM,gBAAgB,GAAiC,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;AAE7F,MAAM,CAAC,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AAwB/D,iCAAiC;AACjC,MAAM,UAAU,aAAa;IACzB,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,mBAAmB,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,aAAa,CAAC,KAA8B,EAAE,MAAgB;IACnE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;IAC9E,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI;QACxB,CAAC,OAAO,EAAE,KAAK,CAAC;QAChB,CAAC,eAAe,EAAE,aAAa,CAAC;KAC1B,EAAE,CAAC;QACT,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,yBAAyB,CAAC,CAAC;aACzF,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,6BAA6B,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,eAAe,KAAK,SAAS,IAAI,OAAO,eAAe,KAAK,QAAQ;QACpE,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;IACpD,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9F,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QAClG,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO;QACH,KAAK,EAAE,KAAe;QACtB,aAAa,EAAE,aAAuB;QACtC,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,eAAyB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,WAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/E,CAAC;AACN,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc,EAAE,IAAY;IAC1C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,oBAAoB,CAAC,CAAC;IAC9G,OAAO,KAAgC,CAAC;AAC5C,CAAC;AAED,SAAS,aAAa,CAAC,KAA8B,EAAE,OAAiB,EAAE,MAAgB;IACtF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3E,IAAI,OAAO,CAAC,MAAM;QAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,YAAY,GAAG,CAAC,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;AAE7F,wEAAwE;AACxE,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAC9C,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,EAAE,2BAA2B,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,aAAa,CAAC,MAAM,EAAE,CAAC,GAAG,YAAY,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IACzB,IAAI,KAAK,KAAK,YAAY,EAAE,CAAC;QACzB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9C,MAAM,CAAC,IAAI,CAAC,kBAAkB,YAAY,qCAAqC,CAAC,CAAC;QACrF,CAAC;aAAM,CAAC;YACJ,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACvB,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,IAAyB,CAAC,EAAE,CAAC;oBAC3D,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,mCAAmC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACtG,CAAC;YACL,CAAC;QACL,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACjG,OAAO,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,KAAK,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAA4B,CAAC,CAAC,EAAE,CAAC;AACnH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACpD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,EAAE,gCAAgC,CAAC,CAAC;IACjE,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,aAAa,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACrG,OAAO,KAAK,CAAC;AACjB,CAAC;AAYD,SAAS,YAAY,CAAC,IAAY;IAC9B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC5D,IAAI,CAAC;QACD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAClE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAkB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC3E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,mBAAoB,KAAe,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;IAC1F,CAAC;AACL,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,iBAAiB,CAAC,UAA4B,EAAE;IAC5D,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,CAAC,OAAgB,EAAE,EAAE,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC;IAC1F,MAAM,KAAK,GAAkB,EAAE,MAAM,EAAE,sBAAsB,EAAE,EAAE,EAAE,0BAA0B,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;IAC7G,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACjG,IAAI,CAAC;YACD,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;YACxC,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACrF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,KAAK,CAAC,OAAO,CAAC,IAAI,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC;QACjD,CAAC;IACL,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACzG,IAAI,CAAC;YACD,MAAM,KAAK,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;YAC9C,KAAK,CAAC,0BAA0B,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,KAAK,CAAC,OAAO,CAAC,IAAI,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC;QACjD,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,SAAS,SAAS,CAAC,CAAc,EAAE,CAAc;IAC7C,OAAO,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,aAAa,KAAK,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,WAAW,CAAC;AACzG,CAAC;AAED,oGAAoG;AACpG,SAAS,MAAM,CAAwB,IAAqB,EAAE,KAAkB,EAAE,KAAe;IAC7F,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IACpE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3C,CAAC;AAED,SAAS,UAAU,CAAC,MAA+C;IAC/D,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC;IAC7E,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvF,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,eAAe,CAAC,KAAkB,EAAE,KAAmC;IACnF,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxD,OAAO,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC1B,GAAG,KAAK;QACR,sBAAsB,EAAE,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE,KAAK,EAAE,KAAK,CAAC;KAC7E,CAAC,CAAC,CAAC;AACR,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,qBAAqB,CAAC,KAAkB,EAAE,KAAuC;IAC7F,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,OAAO,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC1B,GAAG,KAAK;QACR,0BAA0B,EAAE,MAAM,CAAC,KAAK,CAAC,0BAA0B,EAAE,KAAK,EAAE,KAAK,CAAC;KACrF,CAAC,CAAC,CAAC;AACR,CAAC;AAED,SAAS,UAAU,CAAC,KAA4B,EAAE,IAAY;IAC1D,IAAI,KAAK,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;QAC/B,OAAO,CACH,mBAAmB,CAAC,QAAQ,CAAC,IAAyB,CAAC;YACvD,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAyB,CAAC,CACxD,CAAC;IACN,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAyB,CAAC,CAAC;AAC3D,CAAC;AAcD,SAAS,OAAO,CAAC,MAAoB,EAAE,OAAqB;IACxD,IAAI,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC;IAC/B,MAAM,cAAc,GAAG,CAAC,WAAoB,EAAE,EAAE;QAC5C,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QAC9B,IAAI,KAAK,kBAAkB,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,CAAC,CAAC;IACF,OAAO,CAAC,KAA6B,EAAE,EAAE,CACrC,CAAC,KAAK,CAAC,OAAO;QACd,KAAK,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK;QAC5B,KAAK,CAAC,aAAa,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE;QACrC,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;AAC1C,CAAC;AASD,8FAA8F;AAC9F,MAAM,UAAU,gBAAgB,CAAC,MAAoB,EAAE,IAAY,EAAE,UAAwB,EAAE;IAC3F,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC1F,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC;IACpD,OAAO;QACH,qBAAqB,EAAE,IAAI;QAC3B,iBAAiB,EAAE,GAAG,KAAK,CAAC,MAAM,yBAAyB;QAC3D,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAC;AACN,CAAC;AAQD,oFAAoF;AACpF,MAAM,UAAU,sBAAsB,CAAC,MAAoB,EAAE,UAAwB,EAAE;IACnF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,KAAK,CAAC,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9E,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;IAC9C,OAAO;QACH,eAAe,EAAE,IAAI;QACrB,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,6BAA6B;QACpD,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,CAAC;AACN,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,6BAA6B,CAAC,QAAiB;IAC3D,MAAM,MAAM,GAAG,qBAAqB,CAAC,QAAQ,CAAmC,CAAC;IACjF,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,IAAI,GAAG,CAAC,uBAAuB,EAAE,wBAAwB,EAAE,4BAA4B,CAAC,CAAC,MAAM,CACjG,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS,CACrC,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IACnC,OAAO,GAAG,qBAAqB,CAAC,QAAQ,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,+DAA+D,aAAa,EAAE,EAAE,CAAC;AAC1J,CAAC"}

package/dist/safety/secrets.d.ts

@@ -29,4 +29,11 @@ export declare function redactDeep(value: unknown, depth?: number): unknown;
  * characters are skipped because they would match ordinary text.
  */
 export declare function redactText(text: string, knownSecrets: Iterable<string>): string;
+/**
+ * Sanitize free text a platform echoed back (an error message), when its secrets are not known in
+ * advance: email addresses keep only their domain, and credential-looking values are masked (JWTs,
+ * bearer tokens, Salesforce session IDs, `secret=value` pairs, and long opaque strings). UUIDs, which
+ * identify resources, are kept.
+ */
+export declare function sanitizePlatformText(text: string): string;
 //# sourceMappingURL=secrets.d.ts.map

package/dist/safety/secrets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/safety/secrets.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,8EAA8E;AAC9E,eAAO,MAAM,MAAM,WAAW,CAAC;AAuB/B;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAWhD;AAED,sGAAsG;AACtG,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGjD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,GAAE;IAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;CAAO,GAO7F,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAC9B;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,SAAI,GAAG,OAAO,CAY7D;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,CAM/E"}
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/safety/secrets.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,8EAA8E;AAC9E,eAAO,MAAM,MAAM,WAAW,CAAC;AAuB/B;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAWhD;AAED,sGAAsG;AACtG,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGjD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,GAAE;IAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;CAAO,GAO7F,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAC9B;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,SAAI,GAAG,OAAO,CAY7D;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,CAM/E;AAID;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAWzD"}

package/dist/safety/secrets.js

@@ -88,4 +88,20 @@ export function redactText(text, knownSecrets) {
         result = result.split(value).join(MASKED);
     return result;
 }
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/**
+ * Sanitize free text a platform echoed back (an error message), when its secrets are not known in
+ * advance: email addresses keep only their domain, and credential-looking values are masked (JWTs,
+ * bearer tokens, Salesforce session IDs, `secret=value` pairs, and long opaque strings). UUIDs, which
+ * identify resources, are kept.
+ */
+export function sanitizePlatformText(text) {
+    return text
+        .replace(/[A-Za-z0-9._%+-]+@([A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)+)/g, '***@$1')
+        .replace(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*/g, MASKED)
+        .replace(/\b(bearer)\s+[A-Za-z0-9._~+/=-]+/gi, `$1 ${MASKED}`)
+        .replace(/\b00D[A-Za-z0-9]{12,15}![A-Za-z0-9._]+/g, MASKED)
+        .replace(/\b((?:password|passwd|secret|token|api[_-]?key|access[_-]?key|client[_-]?secret|credential)s?["']?\s*[:=]\s*["']?)[^\s"',;&]+/gi, `$1${MASKED}`)
+        .replace(/[A-Za-z0-9+/_=-]{32,}/g, (match) => (UUID.test(match) ? match : MASKED));
+}
 //# sourceMappingURL=secrets.js.map

package/dist/safety/secrets.js.map

@@ -1 +1 @@
-{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/safety/secrets.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,8EAA8E;AAC9E,MAAM,CAAC,MAAM,MAAM,GAAG,QAAQ,CAAC;AAE/B,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC5B,UAAU;IACV,QAAQ;IACR,KAAK;IACL,QAAQ;IACR,OAAO;IACP,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,QAAQ;IACR,YAAY;IACZ,cAAc;CACjB,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG;IACjB,CAAC,SAAS,EAAE,KAAK,CAAC;IAClB,CAAC,KAAK,EAAE,KAAK,CAAC;IACd,CAAC,QAAQ,EAAE,QAAQ,CAAC;IACpB,CAAC,QAAQ,EAAE,KAAK,CAAC;CACpB,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACnC,MAAM,QAAQ,GAAG,GAAG;SACf,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC;SACtC,WAAW,EAAE;SACb,KAAK,CAAC,aAAa,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACrB,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAC/F,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,WAAW,CAAC,KAAa;IACrC,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IACpC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AACtE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,MAA8B,EAAE,UAAuC,EAAE;IAClG,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC,WAAW,CACrB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QACzC,GAAG;QACH,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK;KAC3E,CAAC,CACqB,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,KAAc,EAAE,KAAK,GAAG,CAAC;IAChD,IAAI,KAAK,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IAClF,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACrC,OAAO,MAAM,CAAC,WAAW,CACrB,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;YAClE,GAAG;YACH,WAAW,CAAC,GAAG,CAAC,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC;SACjG,CAAC,CACL,CAAC;IACN,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,YAA8B;IACnE,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;IAC5F,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,KAAK,IAAI,MAAM;QAAE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtE,OAAO,MAAM,CAAC;AAClB,CAAC"}
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/safety/secrets.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,8EAA8E;AAC9E,MAAM,CAAC,MAAM,MAAM,GAAG,QAAQ,CAAC;AAE/B,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC5B,UAAU;IACV,QAAQ;IACR,KAAK;IACL,QAAQ;IACR,OAAO;IACP,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,QAAQ;IACR,YAAY;IACZ,cAAc;CACjB,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG;IACjB,CAAC,SAAS,EAAE,KAAK,CAAC;IAClB,CAAC,KAAK,EAAE,KAAK,CAAC;IACd,CAAC,QAAQ,EAAE,QAAQ,CAAC;IACpB,CAAC,QAAQ,EAAE,KAAK,CAAC;CACpB,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACnC,MAAM,QAAQ,GAAG,GAAG;SACf,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC;SACtC,WAAW,EAAE;SACb,KAAK,CAAC,aAAa,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACrB,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAC/F,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,WAAW,CAAC,KAAa;IACrC,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IACpC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AACtE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,MAA8B,EAAE,UAAuC,EAAE;IAClG,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC,WAAW,CACrB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QACzC,GAAG;QACH,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK;KAC3E,CAAC,CACqB,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,KAAc,EAAE,KAAK,GAAG,CAAC;IAChD,IAAI,KAAK,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IAClF,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACrC,OAAO,MAAM,CAAC,WAAW,CACrB,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;YAClE,GAAG;YACH,WAAW,CAAC,GAAG,CAAC,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC;SACjG,CAAC,CACL,CAAC;IACN,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,YAA8B;IACnE,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;IAC5F,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,KAAK,IAAI,MAAM;QAAE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtE,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,MAAM,IAAI,GAAG,iEAAiE,CAAC;AAE/E;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC7C,OAAO,IAAI;SACN,OAAO,CAAC,wDAAwD,EAAE,QAAQ,CAAC;SAC3E,OAAO,CAAC,sDAAsD,EAAE,MAAM,CAAC;SACvE,OAAO,CAAC,oCAAoC,EAAE,MAAM,MAAM,EAAE,CAAC;SAC7D,OAAO,CAAC,yCAAyC,EAAE,MAAM,CAAC;SAC1D,OAAO,CACJ,iIAAiI,EACjI,KAAK,MAAM,EAAE,CAChB;SACA,OAAO,CAAC,wBAAwB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAC3F,CAAC"}