@wenathlan/devthink 2.0.13 → 2.0.15

package/hardening.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"hardening.d.ts","sourceRoot":"","sources":["../hardening.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9E,mTAAmT;AACnT,wBAAgB,WAAW,CAAC,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB,CAyBA;AAED,wUAAwU;AACxU,wBAAgB,aAAa,CAAC,KAAK,EAAE;IAAE,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IACjH,OAAO,EAAE,WAAW,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB,CAsBA;AAED,mOAAmO;AACnO,wBAAgB,aAAa,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG;IACpE,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;CACZ,CAOA;AAED,6RAA6R;AAC7R,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IACnG,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7D,MAAM,EAAE,MAAM,CAAC;CAChB,CAgBA;AAED,0NAA0N;AAC1N,wBAAgB,YAAY,CAAC,KAAK,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG;IACtE,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,CAcA;AAED,qMAAqM;AACrM,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,gBAAgB,CAkB7F;AAED,mSAAmS;AACnS,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,gBAAgB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAmB1D;AAED,oSAAoS;AACpS,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC5C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,YAAY,EAAE,CAAC;CACzB,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAexG"}

package/hardening.js

@@ -1,188 +0,0 @@
-/*! devthink 2.0.13 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
-
-// security.ts
-var maskmarker = "[redacted]";
-function fieldshapekind(name) {
-  const lowered = name.toLowerCase();
-  if (lowered.includes("password") || lowered.includes("passwd") || lowered.includes("pwd") || lowered.includes("passphrase"))
-    return "password";
-  if (lowered.includes("token") || lowered.includes("apikey") || lowered.includes("api_key") || lowered.includes("auth") || lowered.includes("bearer"))
-    return "token";
-  if (lowered.includes("card") || lowered.includes("cvc") || lowered.includes("cvv") || lowered.includes("expiry") || lowered.includes("pan"))
-    return "card";
-  if (lowered.includes("secret")) return "secret";
-  return void 0;
-}
-function maskingfield(name, shapes) {
-  if (fieldshapekind(name) !== void 0) return true;
-  const lowered = name.toLowerCase();
-  return shapes.some((shape) => shape !== "" && lowered.includes(shape));
-}
-function maskvalue(value) {
-  return value === "" ? "" : maskmarker;
-}
-function maskfield(input) {
-  return maskingfield(input.name, input.shapes) ? maskvalue(input.value) : input.value;
-}
-function maskrecord(record, shapes) {
-  const masked = {};
-  for (const [key, value] of Object.entries(record)) {
-    if (typeof value === "string") {
-      const sibling = record.name;
-      masked[key] = key === "value" && typeof sibling === "string" ? maskfield({ name: sibling, value, shapes }) : maskfield({ name: key, value, shapes });
-    } else if (Array.isArray(value))
-      masked[key] = value.map(
-        (item) => Boolean(item) && typeof item === "object" && !Array.isArray(item) ? maskrecord(item, shapes) : item
-      );
-    else if (Boolean(value) && typeof value === "object")
-      masked[key] = maskrecord(value, shapes);
-    else masked[key] = value;
-  }
-  return masked;
-}
-function maskexport(record, shapes) {
-  return maskrecord(record, shapes);
-}
-
-// hardening.ts
-function masklogtext(input) {
-  const maskedkeys = [];
-  let text = input.text;
-  const patterns = [
-    [/(\w+)\s*:\s*"((?:[^"\\]|\\.)*)"/g, (match) => `${match[1]}: "${maskvalue(match[2] ?? "")}"`],
-    [/(\w+)\s*=\s*([^\s&;]+)/g, (match) => `${match[1]}=${maskvalue(match[2] ?? "")}`],
-    [/(\w+)\s*:\s*([^\s,;]+)/g, (match) => `${match[1]}: ${maskvalue(match[2] ?? "")}`]
-  ];
-  for (const [pattern, rewrite] of patterns) {
-    text = text.replace(pattern, (full, key, ...rest) => {
-      if (!maskingfield(String(key), input.shapes)) return full;
-      maskedkeys.push(String(key));
-      return rewrite([full, String(key), String(rest[0] ?? "")]);
-    });
-  }
-  const unique = [...new Set(maskedkeys)];
-  return {
-    text,
-    maskedkeys: unique,
-    reason: unique.length === 0 ? "The log text carries no secret shaped key value pair; the masking pass changed nothing." : `The masking pass covered the log field${unique.length === 1 ? "" : "s"} ${unique.join(", ")} the text carried since the audit; the typed values answer the redaction marker.`
-  };
-}
-function localscangate(input) {
-  const signatures = input.hook?.localsignatures ?? [];
-  if (signatures.length === 0)
-    return {
-      verdict: "pending",
-      reason: "The scanning hook carries no local signature list; the verdict stays with the configured scanner endpoint and the file holds."
-    };
-  if (input.digest === void 0 || input.digest.trim() === "")
-    return {
-      verdict: "pending",
-      reason: `The local signature check of ${input.hook?.scanner ?? "the scanning hook"} needs the file digest; a digest nobody computed flags nothing.`
-    };
-  if (signatures.includes(input.digest))
-    return {
-      verdict: "flagged",
-      reason: `The local signature list of ${input.hook?.scanner} matched the file digest; the quarantine deletes the file and no remote endpoint ever fires.`
-    };
-  return {
-    verdict: "pending",
-    reason: `The local signature list of ${input.hook?.scanner} matched no signature; the verdict falls back to the configured scanner endpoint and the file holds.`
-  };
-}
-function hatchbannerof(input) {
-  return {
-    title: `Escape hatch: ${input.halted} in flight call${input.halted === 1 ? "" : "s"} halted`,
-    explanation: `The escape hatch key stopped every native call in one press at ${new Date(input.at).toISOString()}; the transport detached until you reattach and the halt stays recorded in the audit trail.`,
-    halted: input.halted,
-    at: input.at
-  };
-}
-function newdomainpausecard(input) {
-  if (input.knownorigins.includes(input.origin))
-    return {
-      pause: false,
-      card: { title: "", explanation: "", origin: input.origin },
-      reason: `The domain ${input.origin} sits inside the recorded origins; the review mode runs the ${input.kind} step without the new domain pause.`
-    };
-  return {
-    pause: true,
-    card: {
-      title: `New domain: ${input.origin}`,
-      explanation: `The ${input.kind} step targets a domain the profile workspace never recorded. The run pauses here so you can review the new trust boundary: the safedefaults profile applied reads only, every sensitive class stays denied, and the next explicit grant opens the domain the same way the first one did.`,
-      origin: input.origin
-    },
-    reason: `The review mode paused the ${input.kind} step on the new domain ${input.origin} with the explanatory card; the run resumes after the domain review.`
-  };
-}
-function runtracekeys(input) {
-  if (input.runid.trim() === "")
-    throw new Error("The run trace purge names its run; a nameless run trace purges nothing.");
-  const runid = input.runid.trim();
-  const keys = input.keys.filter((key) => key === runid || key.endsWith(runid));
-  const kept = input.keys.filter((key) => !keys.includes(key));
-  return {
-    keys,
-    kept,
-    reason: keys.length === 0 ? `No stored key carries the trace of the run ${runid}; the run trace purge deletes nothing.` : `The run trace purge deletes ${keys.length} stored key${keys.length === 1 ? "" : "s"} carrying the trace of the run ${runid} \u2014 ${keys.join(", ")} \u2014 while ${kept.length} key${kept.length === 1 ? "" : "s"} of other runs survive.`
-  };
-}
-function syncrotationgate(input) {
-  if ((input.current ?? "").trim() === "" || (input.next ?? "").trim() === "")
-    return {
-      allowed: false,
-      reason: "The key rotation names both the current passphrase and the next one; a rotation without either passphrase never rekeys because no key ever defaults in code."
-    };
-  if (input.current === input.next)
-    return {
-      allowed: false,
-      reason: "The key rotation needs a next passphrase that differs from the current one; rotating onto the same key rekeys nothing."
-    };
-  return {
-    allowed: true,
-    reason: "The key rotation entry point opens with both passphrases present; the derived key rekeys the sync payloads while the passphrases never persist."
-  };
-}
-function stdioclientsignaturegate(input) {
-  if (input.signature === void 0 || input.platformverifier === void 0)
-    return {
-      verified: false,
-      allowed: true,
-      reason: "The platform carries no signature verifier the bridge can call; the local stdio bridge stays unverified while the record marks it."
-    };
-  if (!input.platformverifier(input.host, input.signature))
-    return {
-      verified: false,
-      allowed: false,
-      reason: `The client signature of the ${input.host} bridge failed the platform verification; the local stdio bridge refuses the client and no frame relays.`
-    };
-  return {
-    verified: true,
-    allowed: true,
-    reason: `The platform verifier confirmed the client signature of the ${input.host} bridge; the local stdio bridge relays its frames under the verified client.`
-  };
-}
-function transparencyexportmask(input) {
-  const payload = maskexport(input.report, input.shapes);
-  const maskedfields = Object.keys(input.report).filter((key) => maskingfield(key, input.shapes));
-  if (input.regions.length > 0 && Array.isArray(payload.captures))
-    payload.captures = payload.captures.map(
-      (entry) => Boolean(entry) && typeof entry === "object" && !Array.isArray(entry) ? { ...entry, redacted: true, redactedregions: input.regions.length } : entry
-    );
-  return {
-    payload,
-    maskedfields,
-    redactedregions: input.regions.length,
-    reason: `The transparency export left with the masking pass over ${maskedfields.length} shaped field${maskedfields.length === 1 ? "" : "s"} and ${input.regions.length} redact region${input.regions.length === 1 ? "" : "s"} covering its capture derived entries; the raw values stay behind the redaction marker.`
-  };
-}
-export {
-  hatchbannerof,
-  localscangate,
-  masklogtext,
-  newdomainpausecard,
-  runtracekeys,
-  stdioclientsignaturegate,
-  syncrotationgate,
-  transparencyexportmask
-};
-//# sourceMappingURL=hardening.js.map

package/headless.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"headless.d.ts","sourceRoot":"","sources":["../headless.ts"],"names":[],"mappings":"AACA,sUAAsU;AACtU,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAM3C,OAAO,KAAK,EACV,eAAe,EACf,WAAW,EACX,cAAc,EACd,aAAa,EACb,eAAe,EACf,sBAAsB,EACtB,eAAe,EACf,iBAAiB,EACjB,YAAY,EACZ,gBAAgB,EAChB,QAAQ,EACR,YAAY,EACZ,YAAY,EAEZ,YAAY,EACZ,QAAQ,EACT,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAKjD,OAAO,EAAY,aAAa,EAAE,MAAM,aAAa,CAAC;AAEtD,4TAA4T;AAC5T,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,YAAY,GAAG,sBAAsB,CAsExG;AAED,yNAAyN;AACzN,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IACtC,QAAQ,EAAE,YAAY,GAAG,SAAS,CAAC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,sBAAsB,CAAC;IAChC,GAAG,EAAE,MAAM,CAAC;CACb,GAAG,YAAY,CAWf;AAED;;;;GAIG;AAEH,4JAA4J;AAC5J,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,GAAG,eAAe,CAiBlB;AAED,gNAAgN;AAChN,wBAAsB,gBAAgB,CAAC,KAAK,EAAE;IAC5C,OAAO,EAAE,eAAe,CAAC;IACzB,IAAI,EAAE,WAAW,CAAC;IAClB,QAAQ,CAAC,EAAE,eAAe,CAAC;CAC5B,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,eAAe,CAAC;IAAC,UAAU,EAAE,SAAS,GAAG,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAe1F;AAED,yGAAyG;AACzG,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,eAAe,GAAG,eAAe,CAE9E;AAED,6LAA6L;AAC7L,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,OAAO,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAC7G,UAAU,EAAE,YAAY,CAAC;IACzB,KAAK,EAAE,YAAY,CAAC;CACrB,CAUA;AAED,4KAA4K;AAC5K,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAE5G;AAED,mMAAmM;AACnM,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,YAAY,GAChB,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAExE;AAED,uLAAuL;AACvL,wBAAgB,cAAc,CAAC,OAAO,EAAE,aAAa,GAAG,aAAa,CAEpE;AAED,wJAAwJ;AACxJ,wBAAgB,YAAY,CAC1B,IAAI,EAAE,QAAQ,EACd,MAAM,EAAE,MAAM,EAAE,GACf;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;KAAE,CAAA;CAAE,CAqB3G;AAED,iMAAiM;AACjM,wBAAgB,WAAW,CAAC,KAAK,EAAE;IAAE,OAAO,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,EAAE,eAAe,CAAA;CAAE,GAAG;IAC3G,OAAO,EAAE,cAAc,CAAC;IACxB,IAAI,EAAE,QAAQ,CAAC;IACf,QAAQ,CAAC,EAAE,eAAe,CAAC;CAC5B,CAMA;AAED,+IAA+I;AAC/I,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,eAAe,GAAG;IAC7D,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,OAAO,CAAC;CACpB,CAQA;AAED,8JAA8J;AAC9J,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,GAAG;IAC1E,IAAI,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,CAAC;IACjC,MAAM,IAAI,aAAa,EAAE,CAAC;CAC3B,CAWA;AAED,8IAA8I;AAC9I,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,OAAO,GAAG;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAGnG;AAED,mYAAmY;AACnY,wBAAgB,cAAc,CAAC,KAAK,EAAE;IACpC,IAAI,EAAE,QAAQ,CAAC;IACf,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,eAAe,GAAG,SAAS,CAAC;IAC7D,MAAM,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC/B,GAAG,EAAE,MAAM,CAAC;CACb,GAAG;IACF,MAAM,IAAI,gBAAgB,CAAC;IAC3B,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,GAAG,sBAAsB,CAAC;IAC9D,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3C,CA2DA"}