@swarmdo/cli 1.8.0 → 1.10.0

package/dist/src/mcp-tools/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/mcp-tools/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,YAAY,EAAE,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC7E,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/mcp-tools/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,YAAY,EAAE,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC7E,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/src/mcp-tools/index.js

@@ -15,6 +15,7 @@ export { workflowTools } from './workflow-tools.js';
 export { coverageRouterTools } from '../swarmvector/coverage-tools.js';
 export { analyzeTools } from './analyze-tools.js';
 export { codegraphTools } from './codegraph-tools.js';
+export { redactTools } from './redact-tools.js';
 export { progressTools } from './progress-tools.js';
 export { transferTools } from './transfer-tools.js';
 export { securityTools } from './security-tools.js';

package/dist/src/mcp-tools/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/mcp-tools/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,yFAAyF;AACzF,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,iEAAiE;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/mcp-tools/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,yFAAyF;AACzF,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,iEAAiE;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/src/mcp-tools/profiles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"profiles.d.ts","sourceRoot":"","sources":["../../../src/mcp-tools/profiles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC;AAyB5D,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,GAAG,KAAK,CAI9E,CAAC;AAEF,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,MAAM,GAAG,CAAC,IAAI,gBAAgB,CAEnE;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,MAAM,EAAE,GAAG,KAAK,CAIxF"}
+{"version":3,"file":"profiles.d.ts","sourceRoot":"","sources":["../../../src/mcp-tools/profiles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC;AA0B5D,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,GAAG,KAAK,CAI9E,CAAC;AAEF,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,MAAM,GAAG,CAAC,IAAI,gBAAgB,CAEnE;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,MAAM,EAAE,GAAG,KAAK,CAIxF"}

package/dist/src/mcp-tools/profiles.js

@@ -23,6 +23,7 @@ const LEAN_GROUPS = [
     'agentdb', // agentdb pattern store/search
     'embeddings', // embeddings_generate / search / compare
     'codegraph', // codegraph_query / file / index — "where is X defined?"
+    'redact', // redact_text / redact_scan — secret guard on the data path
 ];
 /** Balanced = lean + orchestration/session/system the average user reaches for. */
 const BALANCED_EXTRA = [

package/dist/src/mcp-tools/profiles.js.map

@@ -1 +1 @@
-{"version":3,"file":"profiles.js","sourceRoot":"","sources":["../../../src/mcp-tools/profiles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,8EAA8E;AAC9E,MAAM,WAAW,GAAG;IAClB,OAAO,EAAO,2DAA2D;IACzE,OAAO,EAAO,gCAAgC;IAC9C,QAAQ,EAAM,0CAA0C;IACxD,OAAO,EAAO,mDAAmD;IACjE,SAAS,EAAK,+BAA+B;IAC7C,YAAY,EAAE,yCAAyC;IACvD,WAAW,EAAG,yDAAyD;CAC/D,CAAC;AAEX,mFAAmF;AACnF,MAAM,cAAc,GAAG;IACrB,UAAU;IACV,MAAM;IACN,SAAS;IACT,QAAQ;IACR,QAAQ;IACR,cAAc;IACd,QAAQ;IACR,aAAa;CACL,CAAC;AAEX,MAAM,CAAC,MAAM,cAAc,GAAwD;IACjF,IAAI,EAAE,WAAW;IACjB,QAAQ,EAAE,CAAC,GAAG,WAAW,EAAE,GAAG,cAAc,CAAC;IAC7C,IAAI,EAAE,KAAK;CACZ,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAAC,CAAS;IAC1C,OAAO,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,MAAM,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAwB;IAC3D,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,kBAAkB,CAAC,IAAI,CAAC;QAAE,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;IAC1D,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"profiles.js","sourceRoot":"","sources":["../../../src/mcp-tools/profiles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,8EAA8E;AAC9E,MAAM,WAAW,GAAG;IAClB,OAAO,EAAO,2DAA2D;IACzE,OAAO,EAAO,gCAAgC;IAC9C,QAAQ,EAAM,0CAA0C;IACxD,OAAO,EAAO,mDAAmD;IACjE,SAAS,EAAK,+BAA+B;IAC7C,YAAY,EAAE,yCAAyC;IACvD,WAAW,EAAG,yDAAyD;IACvE,QAAQ,EAAM,4DAA4D;CAClE,CAAC;AAEX,mFAAmF;AACnF,MAAM,cAAc,GAAG;IACrB,UAAU;IACV,MAAM;IACN,SAAS;IACT,QAAQ;IACR,QAAQ;IACR,cAAc;IACd,QAAQ;IACR,aAAa;CACL,CAAC;AAEX,MAAM,CAAC,MAAM,cAAc,GAAwD;IACjF,IAAI,EAAE,WAAW;IACjB,QAAQ,EAAE,CAAC,GAAG,WAAW,EAAE,GAAG,cAAc,CAAC;IAC7C,IAAI,EAAE,KAAK;CACZ,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAAC,CAAS;IAC1C,OAAO,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,MAAM,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAwB;IAC3D,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,kBAAkB,CAAC,IAAI,CAAC;QAAE,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;IAC1D,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/src/mcp-tools/redact-tools.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Redact MCP Tools
+ *
+ * Give agents a secret guard on the data path: before writing tool output or
+ * context into memory / a message / a file, an agent can mask secrets
+ * (redact_text) or check for their presence (redact_scan). Deterministic —
+ * shares the pure engine in ../redact/redact.ts with the CLI command.
+ */
+import type { MCPTool } from './types.js';
+export declare const redactTools: MCPTool[];
+//# sourceMappingURL=redact-tools.d.ts.map

package/dist/src/mcp-tools/redact-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact-tools.d.ts","sourceRoot":"","sources":["../../../src/mcp-tools/redact-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AA4D1C,eAAO,MAAM,WAAW,EAAE,OAAO,EAAqC,CAAC"}

package/dist/src/mcp-tools/redact-tools.js

@@ -0,0 +1,69 @@
+/**
+ * Redact MCP Tools
+ *
+ * Give agents a secret guard on the data path: before writing tool output or
+ * context into memory / a message / a file, an agent can mask secrets
+ * (redact_text) or check for their presence (redact_scan). Deterministic —
+ * shares the pure engine in ../redact/redact.ts with the CLI command.
+ */
+import { redactText, scanText } from '../redact/redact.js';
+function optsOf(params) {
+    const opts = { entropy: params.entropy !== false };
+    if (typeof params.keepPrefix === 'number')
+        opts.keepPrefix = params.keepPrefix;
+    if (typeof params.token === 'string')
+        opts.token = params.token;
+    if (typeof params.entropyThreshold === 'number')
+        opts.entropyThreshold = params.entropyThreshold;
+    if (Array.isArray(params.allowlist))
+        opts.allowlist = params.allowlist.filter((a) => typeof a === 'string');
+    return opts;
+}
+const redactTextTool = {
+    name: 'redact_text',
+    description: 'Mask secrets (API keys, tokens, private keys) in a string before you store it in memory, put it in a message, or write it to a file. Returns the redacted text plus what was found. Deterministic; run this on any untrusted or command-derived content you are about to persist or forward.',
+    category: 'redact',
+    tags: ['security', 'secrets', 'redaction', 'safety'],
+    inputSchema: {
+        type: 'object',
+        properties: {
+            text: { type: 'string', description: 'The content to redact' },
+            keepPrefix: { type: 'number', description: 'Keep this many leading chars of each secret (default 3; 0 = full mask)' },
+            token: { type: 'string', description: 'Replacement token after the kept prefix (default [REDACTED])' },
+            entropy: { type: 'boolean', description: 'Enable the high-entropy keyword=value fallback (default true)' },
+            entropyThreshold: { type: 'number', description: 'Entropy threshold in bits/char for the fallback (default 3.5)' },
+            allowlist: { type: 'array', items: { type: 'string' }, description: 'Substrings; matching secrets are left untouched' },
+        },
+        required: ['text'],
+    },
+    handler: async (params) => {
+        if (typeof params.text !== 'string')
+            return { error: true, message: 'text is required' };
+        const { output, findings } = redactText(params.text, optsOf(params));
+        return { redacted: output, count: findings.length, findings };
+    },
+};
+const redactScanTool = {
+    name: 'redact_scan',
+    description: 'Check a string for secrets WITHOUT rewriting it — returns the list of findings (rule, line, column, description). Use to decide whether content is safe to store/forward, or to gate on it. Pair with redact_text when you actually need the masked output.',
+    category: 'redact',
+    tags: ['security', 'secrets', 'scan', 'safety'],
+    inputSchema: {
+        type: 'object',
+        properties: {
+            text: { type: 'string', description: 'The content to scan' },
+            entropy: { type: 'boolean', description: 'Enable the high-entropy keyword=value fallback (default true)' },
+            entropyThreshold: { type: 'number', description: 'Entropy threshold in bits/char for the fallback (default 3.5)' },
+            allowlist: { type: 'array', items: { type: 'string' }, description: 'Substrings to ignore' },
+        },
+        required: ['text'],
+    },
+    handler: async (params) => {
+        if (typeof params.text !== 'string')
+            return { error: true, message: 'text is required' };
+        const findings = scanText(params.text, optsOf(params));
+        return { clean: findings.length === 0, count: findings.length, findings };
+    },
+};
+export const redactTools = [redactTextTool, redactScanTool];
+//# sourceMappingURL=redact-tools.js.map

package/dist/src/mcp-tools/redact-tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact-tools.js","sourceRoot":"","sources":["../../../src/mcp-tools/redact-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAsB,MAAM,qBAAqB,CAAC;AAE/E,SAAS,MAAM,CAAC,MAA+B;IAC7C,MAAM,IAAI,GAAkB,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;IAClE,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;QAAE,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IAC/E,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;QAAE,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAChE,IAAI,OAAO,MAAM,CAAC,gBAAgB,KAAK,QAAQ;QAAE,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,CAAC;IACjG,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;QAAE,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IACzH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,cAAc,GAAY;IAC9B,IAAI,EAAE,aAAa;IACnB,WAAW,EACT,8RAA8R;IAChS,QAAQ,EAAE,QAAQ;IAClB,IAAI,EAAE,CAAC,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC;IACpD,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,uBAAuB,EAAE;YAC9D,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,wEAAwE,EAAE;YACrH,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,8DAA8D,EAAE;YACtG,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,+DAA+D,EAAE;YAC1G,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,+DAA+D,EAAE;YAClH,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,iDAAiD,EAAE;SACxH;QACD,QAAQ,EAAE,CAAC,MAAM,CAAC;KACnB;IACD,OAAO,EAAE,KAAK,EAAE,MAA+B,EAAE,EAAE;QACjD,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;QACzF,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACrE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC;IAChE,CAAC;CACF,CAAC;AAEF,MAAM,cAAc,GAAY;IAC9B,IAAI,EAAE,aAAa;IACnB,WAAW,EACT,6PAA6P;IAC/P,QAAQ,EAAE,QAAQ;IAClB,IAAI,EAAE,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC;IAC/C,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,qBAAqB,EAAE;YAC5D,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,+DAA+D,EAAE;YAC1G,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,+DAA+D,EAAE;YAClH,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,sBAAsB,EAAE;SAC7F;QACD,QAAQ,EAAE,CAAC,MAAM,CAAC;KACnB;IACD,OAAO,EAAE,KAAK,EAAE,MAA+B,EAAE,EAAE;QACjD,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;QACzF,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACvD,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC5E,CAAC;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAc,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC"}

package/dist/src/pack/pack.d.ts

@@ -0,0 +1,59 @@
+/**
+ * pack.ts — bundle a repo (or a subset) into one AI-friendly context blob.
+ *
+ * swarmdo has no context-assembly primitive: `codegraph` indexes symbols for
+ * *querying* and `compact` de-noises a *stream*, but neither emits promptable
+ * source for *feeding a model*. `pack` walks the tree (respecting default skips
+ * + a minimal .gitignore + glob include/exclude), and writes a bundle in
+ * markdown / xml / json / plain with a directory tree and per-file + total
+ * token estimates. Deterministic — same inputs, byte-identical output.
+ *
+ * Pure engine: the fs walk is injected as a file list + reader by the caller
+ * (../commands/pack.ts), so this module has no fs dependency and is trivially
+ * testable. Optional secret redaction reuses ../redact/redact.ts.
+ */
+export type PackFormat = 'md' | 'xml' | 'json' | 'plain';
+export interface PackFile {
+    /** repo-relative path, POSIX separators */
+    path: string;
+    content: string;
+}
+export interface PackOptions {
+    format?: PackFormat;
+    /** include a directory tree at the top (default true) */
+    tree?: boolean;
+    /** optional per-file transform (e.g. secret redaction) applied before bundling */
+    transform?: (content: string, path: string) => string;
+}
+export interface PackFileStat {
+    path: string;
+    bytes: number;
+    tokens: number;
+}
+export interface PackResult {
+    output: string;
+    stats: {
+        files: number;
+        bytes: number;
+        tokens: number;
+        perFile: PackFileStat[];
+    };
+}
+/**
+ * Cheap, deterministic token estimate (~4 chars/token, the widely-used rule of
+ * thumb for English + code). Not a real BPE tokenizer — good enough for budget
+ * warnings, and dependency-free.
+ */
+export declare function estimateTokens(text: string): number;
+/** Build an ASCII directory tree from a sorted file list. */
+export declare function buildTree(paths: string[]): string;
+/** Bundle files into a single context blob per `format`. */
+export declare function packFiles(input: PackFile[], opts?: PackOptions): PackResult;
+/**
+ * Minimal .gitignore-style matcher. Handles the common cases — plain names,
+ * `dir/`, `*.ext` globs, leading `/` anchors, and `!` negation — not the full
+ * spec (no `**` depth semantics beyond substring, no nested ignore files).
+ * Good enough to keep obvious noise out; full semantics is a follow-up.
+ */
+export declare function makeIgnoreMatcher(patterns: string[]): (relPath: string) => boolean;
+//# sourceMappingURL=pack.d.ts.map

package/dist/src/pack/pack.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pack.d.ts","sourceRoot":"","sources":["../../../src/pack/pack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,MAAM,MAAM,UAAU,GAAG,IAAI,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC;AAEzD,MAAM,WAAW,QAAQ;IACvB,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,yDAAyD;IACzD,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,kFAAkF;IAClF,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CACvD;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE;QACL,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,YAAY,EAAE,CAAC;KACzB,CAAC;CACH;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGnD;AAED,6DAA6D;AAC7D,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CA8BjD;AAuDD,4DAA4D;AAC5D,wBAAgB,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,IAAI,GAAE,WAAgB,GAAG,UAAU,CA4B/E;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CA8BlF"}

package/dist/src/pack/pack.js

@@ -0,0 +1,178 @@
+/**
+ * pack.ts — bundle a repo (or a subset) into one AI-friendly context blob.
+ *
+ * swarmdo has no context-assembly primitive: `codegraph` indexes symbols for
+ * *querying* and `compact` de-noises a *stream*, but neither emits promptable
+ * source for *feeding a model*. `pack` walks the tree (respecting default skips
+ * + a minimal .gitignore + glob include/exclude), and writes a bundle in
+ * markdown / xml / json / plain with a directory tree and per-file + total
+ * token estimates. Deterministic — same inputs, byte-identical output.
+ *
+ * Pure engine: the fs walk is injected as a file list + reader by the caller
+ * (../commands/pack.ts), so this module has no fs dependency and is trivially
+ * testable. Optional secret redaction reuses ../redact/redact.ts.
+ */
+/**
+ * Cheap, deterministic token estimate (~4 chars/token, the widely-used rule of
+ * thumb for English + code). Not a real BPE tokenizer — good enough for budget
+ * warnings, and dependency-free.
+ */
+export function estimateTokens(text) {
+    if (!text)
+        return 0;
+    return Math.ceil(text.length / 4);
+}
+/** Build an ASCII directory tree from a sorted file list. */
+export function buildTree(paths) {
+    const root = {};
+    for (const p of [...paths].sort()) {
+        const parts = p.split('/');
+        let node = root;
+        for (let i = 0; i < parts.length; i++) {
+            const part = parts[i];
+            const isFile = i === parts.length - 1;
+            if (isFile) {
+                if (!node['\0files'])
+                    node['\0files'] = [];
+                node['\0files'].push(part);
+            }
+            else {
+                node[part] = node[part] ?? {};
+                node = node[part];
+            }
+        }
+    }
+    const lines = [];
+    const walk = (node, prefix) => {
+        const dirs = Object.keys(node).filter((k) => k !== '\0files').sort();
+        const files = (node['\0files'] ?? []).sort();
+        const entries = [...dirs.map((d) => ['dir', d]), ...files.map((f) => ['file', f])];
+        entries.forEach(([kind, name], i) => {
+            const last = i === entries.length - 1;
+            lines.push(`${prefix}${last ? '└── ' : '├── '}${name}${kind === 'dir' ? '/' : ''}`);
+            if (kind === 'dir')
+                walk(node[name], prefix + (last ? '    ' : '│   '));
+        });
+    };
+    walk(root, '');
+    return lines.join('\n');
+}
+/** Pick a fenced-code language hint from a file extension. */
+function langOf(path) {
+    const ext = path.slice(path.lastIndexOf('.') + 1).toLowerCase();
+    const map = {
+        ts: 'typescript', tsx: 'tsx', js: 'javascript', jsx: 'jsx', mjs: 'javascript', cjs: 'javascript',
+        json: 'json', md: 'markdown', py: 'python', rs: 'rust', go: 'go', sh: 'bash', yml: 'yaml', yaml: 'yaml',
+        html: 'html', css: 'css', sql: 'sql', toml: 'toml',
+    };
+    return map[ext] ?? '';
+}
+function renderMarkdown(files, opts) {
+    const parts = ['# Repository context', ''];
+    if (opts.tree !== false) {
+        parts.push('## Files', '', '```', buildTree(files.map((f) => f.path)), '```', '');
+    }
+    parts.push('## Contents', '');
+    for (const f of files) {
+        const lang = langOf(f.path);
+        parts.push(`### ${f.path}`, '', '```' + lang, f.content.replace(/\n$/, ''), '```', '');
+    }
+    return parts.join('\n');
+}
+function escapeXml(s) {
+    return s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+}
+function renderXml(files, opts) {
+    const parts = ['<repository>'];
+    if (opts.tree !== false) {
+        parts.push('  <tree>', escapeXml(buildTree(files.map((f) => f.path))), '  </tree>');
+    }
+    parts.push('  <files>');
+    for (const f of files) {
+        parts.push(`    <file path="${escapeXml(f.path)}">`, escapeXml(f.content.replace(/\n$/, '')), '    </file>');
+    }
+    parts.push('  </files>', '</repository>');
+    return parts.join('\n');
+}
+function renderJson(files) {
+    return JSON.stringify({ files: files.map((f) => ({ path: f.path, content: f.content })) }, null, 2);
+}
+function renderPlain(files) {
+    const parts = [];
+    for (const f of files) {
+        parts.push('='.repeat(8) + ' ' + f.path + ' ' + '='.repeat(8), f.content.replace(/\n$/, ''), '');
+    }
+    return parts.join('\n');
+}
+/** Bundle files into a single context blob per `format`. */
+export function packFiles(input, opts = {}) {
+    const files = input
+        .map((f) => ({ path: f.path, content: opts.transform ? opts.transform(f.content, f.path) : f.content }))
+        .sort((a, b) => a.path.localeCompare(b.path));
+    const format = opts.format ?? 'md';
+    let output;
+    switch (format) {
+        case 'xml':
+            output = renderXml(files, opts);
+            break;
+        case 'json':
+            output = renderJson(files);
+            break;
+        case 'plain':
+            output = renderPlain(files);
+            break;
+        default: output = renderMarkdown(files, opts);
+    }
+    const perFile = files.map((f) => ({
+        path: f.path,
+        bytes: Buffer.byteLength(f.content, 'utf8'),
+        tokens: estimateTokens(f.content),
+    }));
+    return {
+        output,
+        stats: {
+            files: files.length,
+            bytes: perFile.reduce((n, f) => n + f.bytes, 0),
+            tokens: estimateTokens(output),
+            perFile,
+        },
+    };
+}
+/**
+ * Minimal .gitignore-style matcher. Handles the common cases — plain names,
+ * `dir/`, `*.ext` globs, leading `/` anchors, and `!` negation — not the full
+ * spec (no `**` depth semantics beyond substring, no nested ignore files).
+ * Good enough to keep obvious noise out; full semantics is a follow-up.
+ */
+export function makeIgnoreMatcher(patterns) {
+    const rules = patterns
+        .map((p) => p.trim())
+        .filter((p) => p && !p.startsWith('#'))
+        .map((p) => {
+        const negate = p.startsWith('!');
+        let body = negate ? p.slice(1) : p;
+        const dirOnly = body.endsWith('/');
+        if (dirOnly)
+            body = body.slice(0, -1);
+        const anchored = body.startsWith('/');
+        if (anchored)
+            body = body.slice(1);
+        const re = new RegExp('^' +
+            body
+                .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+                .replace(/\*/g, '[^/]*')
+                .replace(/\?/g, '[^/]') +
+            (dirOnly ? '(/|$)' : '($|/)'));
+        return { negate, anchored, re };
+    });
+    return (relPath) => {
+        let ignored = false;
+        for (const r of rules) {
+            const candidates = r.anchored ? [relPath] : [relPath, ...relPath.split('/').map((_, i, a) => a.slice(i).join('/'))];
+            if (candidates.some((c) => r.re.test(c)))
+                ignored = !r.negate;
+        }
+        return ignored;
+    };
+}
+//# sourceMappingURL=pack.js.map

package/dist/src/pack/pack.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pack.js","sourceRoot":"","sources":["../../../src/pack/pack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAkCH;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC;IACpB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,SAAS,CAAC,KAAe;IACvC,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,IAAI,GAAG,IAAI,CAAC;QAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACtB,MAAM,MAAM,GAAG,CAAC,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;YACtC,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;oBAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC;gBAC1C,IAAI,CAAC,SAAS,CAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3C,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,IAAI,CAAC,GAAI,IAAI,CAAC,IAAI,CAA6B,IAAI,EAAE,CAAC;gBAC3D,IAAI,GAAG,IAAI,CAAC,IAAI,CAA4B,CAAC;YAC/C,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,CAAC,IAA6B,EAAE,MAAc,EAAE,EAAE;QAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;QACrE,MAAM,KAAK,GAAG,CAAE,IAAI,CAAC,SAAS,CAAc,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3D,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAU,CAAC,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAU,CAAC,CAAC,CAAC;QACrG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE;YAClC,MAAM,IAAI,GAAG,CAAC,KAAK,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,IAAI,GAAG,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpF,IAAI,IAAI,KAAK,KAAK;gBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAA4B,EAAE,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACrG,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,8DAA8D;AAC9D,SAAS,MAAM,CAAC,IAAY;IAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAChE,MAAM,GAAG,GAA2B;QAClC,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,YAAY;QAChG,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;QACvG,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM;KACnD,CAAC;IACF,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,cAAc,CAAC,KAAiB,EAAE,IAAiB;IAC1D,MAAM,KAAK,GAAa,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAC;IACrD,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,GAAG,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,SAAS,CAAC,KAAiB,EAAE,IAAiB;IACrD,MAAM,KAAK,GAAa,CAAC,cAAc,CAAC,CAAC;IACzC,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IACtF,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACxB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,mBAAmB,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;IAC/G,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IAC1C,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,UAAU,CAAC,KAAiB;IACnC,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACtG,CAAC;AAED,SAAS,WAAW,CAAC,KAAiB;IACpC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,SAAS,CAAC,KAAiB,EAAE,OAAoB,EAAE;IACjE,MAAM,KAAK,GAAG,KAAK;SAChB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;SACvG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAEhD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC;IACnC,IAAI,MAAc,CAAC;IACnB,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,KAAK;YAAE,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAAC,MAAM;QACnD,KAAK,MAAM;YAAE,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;YAAC,MAAM;QAC/C,KAAK,OAAO;YAAE,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;YAAC,MAAM;QACjD,OAAO,CAAC,CAAC,MAAM,GAAG,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,OAAO,GAAmB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAChD,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC;QAC3C,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC;KAClC,CAAC,CAAC,CAAC;IACJ,OAAO;QACL,MAAM;QACN,KAAK,EAAE;YACL,KAAK,EAAE,KAAK,CAAC,MAAM;YACnB,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YAC/C,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC;YAC9B,OAAO;SACR;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAkB;IAClD,MAAM,KAAK,GAAG,QAAQ;SACnB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;SACtC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,OAAO;YAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,QAAQ;YAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,EAAE,GAAG,IAAI,MAAM,CACnB,GAAG;YACD,IAAI;iBACD,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC;iBACpC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC;iBACvB,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;YACzB,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAChC,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;IAEL,OAAO,CAAC,OAAe,EAAW,EAAE;QAClC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,UAAU,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACpH,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAE,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;QAChE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;AACJ,CAAC"}

package/dist/src/redact/redact.d.ts

@@ -0,0 +1,68 @@
+/**
+ * redact.ts — deterministic secret detection + redaction for the agent data
+ * path. swarmdo pipes tool output, memory, and context into LLMs constantly;
+ * `compact` de-noises that stream but never redacts, and `security scan` is
+ * CVE-oriented, not a content filter. This engine is the missing guard: it
+ * catches API keys / tokens / private keys via a high-confidence rule catalog
+ * plus a Shannon-entropy fallback for keyword-prefixed assignments, and masks
+ * them before content reaches a model, a log, or memory.
+ *
+ * Pure + LLM-free by design — known-secret fixtures in, deterministic masked
+ * bytes out. The CLI wrapper (../commands/redact.ts) and an MCP tool share it.
+ */
+export interface RedactRule {
+    /** stable slug, e.g. 'aws-access-key' */
+    id: string;
+    /** human description for --scan output */
+    description: string;
+    /** global regex; the whole match (or capture group `group`) is the secret */
+    regex: RegExp;
+    /** if set, redact this capture group rather than the whole match */
+    group?: number;
+}
+export interface Finding {
+    ruleId: string;
+    description: string;
+    /** 1-based line number */
+    line: number;
+    /** 1-based column of the secret within the line */
+    column: number;
+    /** the raw secret text that matched */
+    match: string;
+    /** what it was replaced with */
+    redacted: string;
+}
+export interface RedactOptions {
+    /** keep this many leading chars of a secret, mask the rest (default 3) */
+    keepPrefix?: number;
+    /** the replacement token appended after the kept prefix (default '[REDACTED]') */
+    token?: string;
+    /** enable the entropy fallback for keyword=value assignments (default true) */
+    entropy?: boolean;
+    /** Shannon-entropy threshold (bits/char) above which a keyworded value is a secret (default 3.5) */
+    entropyThreshold?: number;
+    /** substrings/regexes; any secret whose match includes one is left untouched */
+    allowlist?: Array<string | RegExp>;
+}
+export interface RedactResult {
+    output: string;
+    findings: Finding[];
+}
+/**
+ * High-confidence catalog. Ordered — more specific rules (e.g. Anthropic
+ * `sk-ant-`) come before broader ones (`sk-` OpenAI) so the specific rule wins
+ * and we don't double-count. Patterns are conservative to keep false positives
+ * low; the entropy fallback covers the long tail of custom secrets.
+ */
+export declare const RULES: RedactRule[];
+/** Shannon entropy in bits/char. Pure; used by the assignment fallback. */
+export declare function shannonEntropy(s: string): number;
+/** Mask a secret: keep `keepPrefix` leading chars, then the token. */
+export declare function maskSecret(secret: string, opts?: RedactOptions): string;
+/** Scan without rewriting — returns findings only (for --scan / CI gating). */
+export declare function scanText(text: string, opts?: RedactOptions): Finding[];
+/** Redact secrets in `text`, returning the rewritten output + findings. */
+export declare function redactText(text: string, opts?: RedactOptions): RedactResult;
+/** One-line human summary for stderr. */
+export declare function formatFindingsSummary(findings: Finding[]): string;
+//# sourceMappingURL=redact.d.ts.map

package/dist/src/redact/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../../src/redact/redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,WAAW,UAAU;IACzB,yCAAyC;IACzC,EAAE,EAAE,MAAM,CAAC;IACX,0CAA0C;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAC;IACd,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,gCAAgC;IAChC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+EAA+E;IAC/E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,oGAAoG;IACpG,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gFAAgF;IAChF,SAAS,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,EAAE,CAAC;CACrB;AAED;;;;;GAKG;AACH,eAAO,MAAM,KAAK,EAAE,UAAU,EAiB7B,CAAC;AAMF,2EAA2E;AAC3E,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAUhD;AAED,sEAAsE;AACtE,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE,aAAkB,GAAG,MAAM,CAI3E;AAmED,+EAA+E;AAC/E,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,aAAkB,GAAG,OAAO,EAAE,CAK1E;AAED,2EAA2E;AAC3E,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,aAAkB,GAAG,YAAY,CAc/E;AAED,yCAAyC;AACzC,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAMjE"}

package/dist/src/redact/redact.js

@@ -0,0 +1,153 @@
+/**
+ * redact.ts — deterministic secret detection + redaction for the agent data
+ * path. swarmdo pipes tool output, memory, and context into LLMs constantly;
+ * `compact` de-noises that stream but never redacts, and `security scan` is
+ * CVE-oriented, not a content filter. This engine is the missing guard: it
+ * catches API keys / tokens / private keys via a high-confidence rule catalog
+ * plus a Shannon-entropy fallback for keyword-prefixed assignments, and masks
+ * them before content reaches a model, a log, or memory.
+ *
+ * Pure + LLM-free by design — known-secret fixtures in, deterministic masked
+ * bytes out. The CLI wrapper (../commands/redact.ts) and an MCP tool share it.
+ */
+/**
+ * High-confidence catalog. Ordered — more specific rules (e.g. Anthropic
+ * `sk-ant-`) come before broader ones (`sk-` OpenAI) so the specific rule wins
+ * and we don't double-count. Patterns are conservative to keep false positives
+ * low; the entropy fallback covers the long tail of custom secrets.
+ */
+export const RULES = [
+    { id: 'private-key', description: 'Private key block header', regex: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----/g },
+    { id: 'aws-access-key', description: 'AWS access key ID', regex: /\b(?:AKIA|ASIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASCA)[0-9A-Z]{16}\b/g },
+    { id: 'github-pat', description: 'GitHub personal access token', regex: /\bghp_[0-9A-Za-z]{36}\b/g },
+    { id: 'github-oauth', description: 'GitHub OAuth/app token', regex: /\b(?:gho|ghu|ghs|ghr)_[0-9A-Za-z]{36}\b/g },
+    { id: 'github-fine-pat', description: 'GitHub fine-grained PAT', regex: /\bgithub_pat_[0-9A-Za-z_]{82}\b/g },
+    { id: 'gitlab-pat', description: 'GitLab personal access token', regex: /\bglpat-[0-9A-Za-z_-]{20}\b/g },
+    { id: 'anthropic-key', description: 'Anthropic API key', regex: /\bsk-ant-[0-9A-Za-z-]{16,}\b/g },
+    { id: 'openai-key', description: 'OpenAI API key', regex: /\bsk-(?:proj-)?[0-9A-Za-z]{20,}\b/g },
+    { id: 'google-api-key', description: 'Google API key', regex: /\bAIza[0-9A-Za-z_-]{35}\b/g },
+    { id: 'slack-token', description: 'Slack token', regex: /\bxox[baprs]-[0-9A-Za-z-]{10,}\b/g },
+    { id: 'slack-webhook', description: 'Slack incoming webhook', regex: /https:\/\/hooks\.slack\.com\/services\/T[0-9A-Za-z_]+\/B[0-9A-Za-z_]+\/[0-9A-Za-z_]+/g },
+    { id: 'stripe-key', description: 'Stripe secret/restricted key', regex: /\b(?:sk|rk)_live_[0-9A-Za-z]{24,}\b/g },
+    { id: 'sendgrid-key', description: 'SendGrid API key', regex: /\bSG\.[0-9A-Za-z_-]{22}\.[0-9A-Za-z_-]{43}\b/g },
+    { id: 'twilio-key', description: 'Twilio API key SID', regex: /\bSK[0-9a-fA-F]{32}\b/g },
+    { id: 'npm-token', description: 'npm access token', regex: /\bnpm_[0-9A-Za-z]{36}\b/g },
+    { id: 'jwt', description: 'JSON Web Token', regex: /\beyJ[0-9A-Za-z_-]{10,}\.eyJ[0-9A-Za-z_-]{10,}\.[0-9A-Za-z_-]{10,}\b/g },
+];
+/** Keyword-prefixed assignment, e.g. `api_key = "..."` — the value is group 1. */
+const ASSIGNMENT_RE = /(?:pass(?:word|wd)?|pwd|secret|token|api[_-]?key|apikey|access[_-]?key|auth[_-]?token|client[_-]?secret)["']?\s*[:=]\s*["']?([^\s"'`,;]{8,})/gi;
+/** Shannon entropy in bits/char. Pure; used by the assignment fallback. */
+export function shannonEntropy(s) {
+    if (!s)
+        return 0;
+    const freq = new Map();
+    for (const ch of s)
+        freq.set(ch, (freq.get(ch) ?? 0) + 1);
+    let bits = 0;
+    for (const n of freq.values()) {
+        const p = n / s.length;
+        bits -= p * Math.log2(p);
+    }
+    return bits;
+}
+/** Mask a secret: keep `keepPrefix` leading chars, then the token. */
+export function maskSecret(secret, opts = {}) {
+    const keep = Math.max(0, Math.min(opts.keepPrefix ?? 3, secret.length));
+    const token = opts.token ?? '[REDACTED]';
+    return secret.slice(0, keep) + token;
+}
+function isAllowlisted(match, allowlist) {
+    if (!allowlist || allowlist.length === 0)
+        return false;
+    return allowlist.some((a) => (typeof a === 'string' ? match.includes(a) : a.test(match)));
+}
+/** Collect all rule + entropy hits across the text, deduped by offset. */
+function collectHits(text, opts) {
+    const hits = [];
+    const claimed = []; // [start,end) ranges already taken
+    const overlaps = (start, end) => claimed.some(([s, e]) => start < e && end > s);
+    for (const rule of RULES) {
+        rule.regex.lastIndex = 0;
+        let m;
+        while ((m = rule.regex.exec(text)) !== null) {
+            const secret = rule.group != null ? m[rule.group] : m[0];
+            if (secret == null)
+                continue;
+            const start = rule.group != null ? m.index + m[0].indexOf(secret) : m.index;
+            const end = start + secret.length;
+            if (overlaps(start, end))
+                continue;
+            if (isAllowlisted(secret, opts.allowlist))
+                continue;
+            claimed.push([start, end]);
+            hits.push({ ruleId: rule.id, description: rule.description, index: start, match: secret });
+            if (m.index === rule.regex.lastIndex)
+                rule.regex.lastIndex++; // guard zero-width
+        }
+    }
+    if (opts.entropy !== false) {
+        const threshold = opts.entropyThreshold ?? 3.5;
+        ASSIGNMENT_RE.lastIndex = 0;
+        let m;
+        while ((m = ASSIGNMENT_RE.exec(text)) !== null) {
+            const value = m[1];
+            const start = m.index + m[0].indexOf(value);
+            const end = start + value.length;
+            if (overlaps(start, end))
+                continue;
+            if (isAllowlisted(value, opts.allowlist))
+                continue;
+            if (shannonEntropy(value) < threshold)
+                continue;
+            claimed.push([start, end]);
+            hits.push({ ruleId: 'high-entropy-assignment', description: 'High-entropy secret assignment', index: start, match: value });
+        }
+    }
+    return hits.sort((a, b) => a.index - b.index);
+}
+/** Map an absolute offset to 1-based {line, column}. */
+function lineColOf(text, index) {
+    let line = 1;
+    let last = -1;
+    for (let i = 0; i < index; i++) {
+        if (text[i] === '\n') {
+            line++;
+            last = i;
+        }
+    }
+    return { line, column: index - last };
+}
+/** Scan without rewriting — returns findings only (for --scan / CI gating). */
+export function scanText(text, opts = {}) {
+    return collectHits(text, opts).map((h) => {
+        const { line, column } = lineColOf(text, h.index);
+        return { ruleId: h.ruleId, description: h.description, line, column, match: h.match, redacted: maskSecret(h.match, opts) };
+    });
+}
+/** Redact secrets in `text`, returning the rewritten output + findings. */
+export function redactText(text, opts = {}) {
+    const hits = collectHits(text, opts);
+    const findings = [];
+    let out = '';
+    let cursor = 0;
+    for (const h of hits) {
+        const { line, column } = lineColOf(text, h.index);
+        const redacted = maskSecret(h.match, opts);
+        out += text.slice(cursor, h.index) + redacted;
+        cursor = h.index + h.match.length;
+        findings.push({ ruleId: h.ruleId, description: h.description, line, column, match: h.match, redacted });
+    }
+    out += text.slice(cursor);
+    return { output: out, findings };
+}
+/** One-line human summary for stderr. */
+export function formatFindingsSummary(findings) {
+    if (findings.length === 0)
+        return 'redact: no secrets found';
+    const byRule = new Map();
+    for (const f of findings)
+        byRule.set(f.ruleId, (byRule.get(f.ruleId) ?? 0) + 1);
+    const parts = [...byRule.entries()].sort((a, b) => b[1] - a[1]).map(([r, n]) => `${r}:${n}`);
+    return `redact: ${findings.length} secret${findings.length === 1 ? '' : 's'} redacted (${parts.join(', ')})`;
+}
+//# sourceMappingURL=redact.js.map