agent-nuvira 3.3.12 → 3.3.13

package/dist/security/secret-scan.js

@@ -0,0 +1,525 @@
+/**
+ * secret-scan — find secret-shaped strings in a working tree, ON DEMAND.
+ *
+ * WHY THIS EXISTS. Nuvira writes code and commits it. "Did I just stage a key?"
+ * is a real, recurring failure mode in that loop, and it is the one the toolchain
+ * cannot answer today: `redact()` (enterprise/secrets.ts) keeps secrets out of
+ * logs and history, but nothing ever LOOKS for them in the user's files.
+ *
+ * RELATIONSHIP TO `redact()`: deliberately complementary, not a second opinion.
+ * `redact()` is a SCRUBBER — it masks and never reports. This module is a
+ * DETECTOR — it reports what and where, and masks the value in its own output
+ * (reusing the SAME `maskSecret`/`redact` primitives and the SAME
+ * `KNOWN_KEY_PREFIXES` table), so what we detect can never drift from what we
+ * redact. One pattern source of truth, two readers.
+ *
+ * DESIGN CONSTRAINTS
+ * - Dependency-free and LOCAL. No `gitleaks`/`ggshield` binary, no network, no
+ *   vendor. That is the whole point of the local-first path: a scanner that
+ *   reads every file is a privacy decision, so the default must keep the data
+ *   on the machine.
+ * - PURE + DETERMINISTIC at the text level (`scanText`), so it is unit-testable
+ *   without a filesystem; `scanDirectory` is the thin I/O wrapper.
+ * - NEVER a security guarantee. It is a lint: it catches KNOWN shapes and common
+ *   assignments, and a clean result means "nothing matched", not "no secrets".
+ *   The summary says so, because a scanner that overclaims is worse than none.
+ */
+import { execFileSync } from 'node:child_process';
+import { readFileSync, readdirSync, statSync } from 'node:fs';
+import { join, relative, sep } from 'node:path';
+import { KNOWN_KEY_PREFIXES, maskSecret, redact } from '../enterprise/secrets.js';
+// ─── Pattern table ──────────────────────────────────────────────────────────
+/**
+ * High-confidence, low-false-positive shapes. Ordered most-specific first so a
+ * value is attributed to the narrowest pattern that matches it.
+ *
+ * Deliberately NOT included: a bare high-entropy heuristic. It is the classic
+ * source of "your scan found 4000 secrets" noise (git SHAs, hashes, minified
+ * bundles), and a lint nobody trusts gets switched off — which is worse than a
+ * narrower one people keep on.
+ */
+export const SECRET_PATTERNS = [
+    { id: 'private-key', label: 'Private key block', severity: 'critical', re: /-----BEGIN [A-Z ]{0,40}PRIVATE KEY-----/g },
+    { id: 'aws-access-key-id', label: 'AWS access key id', severity: 'critical', re: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g },
+    { id: 'aws-secret', label: 'AWS secret access key', severity: 'critical', re: /\baws[_-]?secret[_-]?access[_-]?key\b\s*[:=]\s*["']?([A-Za-z0-9/+=]{40})/gi },
+    { id: 'github-pat', label: 'GitHub token', severity: 'critical', re: /\bgh[pousr]_[A-Za-z0-9]{36,}\b/g },
+    { id: 'github-pat-fine', label: 'GitHub fine-grained token', severity: 'critical', re: /\bgithub_pat_[A-Za-z0-9_]{30,}\b/g },
+    { id: 'anthropic-key', label: 'Anthropic API key', severity: 'critical', re: /\bsk-ant-[A-Za-z0-9_-]{20,}\b/g },
+    { id: 'openai-key', label: 'OpenAI-compatible API key', severity: 'critical', re: /\bsk-(?!ant-)[A-Za-z0-9]{20,}\b/g },
+    { id: 'groq-key', label: 'Groq API key', severity: 'critical', re: /\bgsk_[A-Za-z0-9]{20,}\b/g },
+    { id: 'google-api-key', label: 'Google API key', severity: 'critical', re: /\bAIza[0-9A-Za-z_-]{35}\b/g },
+    { id: 'google-oauth-secret', label: 'Google OAuth client secret', severity: 'critical', re: /\bGOCSPX-[A-Za-z0-9_-]{20,}\b/g },
+    { id: 'nvidia-nim-key', label: 'NVIDIA NIM key', severity: 'critical', re: /\bnvapi-[A-Za-z0-9_-]{20,}\b/g },
+    { id: 'slack-token', label: 'Slack token', severity: 'critical', re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g },
+    { id: 'stripe-key', label: 'Stripe secret/restricted key', severity: 'critical', re: /\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{20,}\b/g },
+    { id: 'hf-token', label: 'HuggingFace token', severity: 'high', re: /\bhf_[A-Za-z0-9]{30,}\b/g },
+    { id: 'xai-key', label: 'xAI API key', severity: 'high', re: /\bxai-[A-Za-z0-9]{20,}\b/g },
+    { id: 'jwt', label: 'JWT / bearer token', severity: 'high', re: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g },
+    {
+        id: 'url-credentials',
+        label: 'Credentials embedded in a URL',
+        severity: 'high',
+        re: /\b[a-z][a-z0-9+.-]{1,12}:\/\/[^\s/:@]{2,}:[^\s/:@]{4,}@[^\s/]+/gi,
+    },
+];
+/**
+ * Build a bare-prefix pattern from the SAME list `redact()` uses, so every
+ * prefix we know how to mask is also one we can find. Kept separate from
+ * SECRET_PATTERNS because it is generated, not hand-written.
+ */
+function buildPrefixPatterns() {
+    // Skip prefixes already covered by an explicit, narrower pattern above
+    // (rewriting them here would double-report the same value).
+    const covered = new Set(['sk-', 'gsk_', 'AIza', 'xai-', 'hf_', 'AKIA', 'eyJ', 'ghp_', 'nvapi-']);
+    return KNOWN_KEY_PREFIXES.filter((p) => !covered.has(p)).map((prefix) => ({
+        id: `prefix:${prefix}`,
+        label: `Known key prefix "${prefix}"`,
+        severity: 'medium',
+        re: new RegExp(`\\b${prefix.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}[A-Za-z0-9._\\-+/]{16,}`, 'g'),
+    }));
+}
+const ALL_PATTERNS = [...SECRET_PATTERNS, ...buildPrefixPatterns()];
+/**
+ * Assignment-shaped matches (`apiKey = "…"`, `"token": "…"`). The value must be
+ * long AND not obviously a placeholder, or every `.env.example` in the world
+ * becomes a finding.
+ */
+const ASSIGN_PATTERN = {
+    id: 'assigned-secret',
+    label: 'Secret-looking value assigned to a sensitive name',
+    severity: 'medium',
+    re: /\b(?:api[_-]?key|apikey|secret|client[_-]?secret|access[_-]?token|auth[_-]?token|refresh[_-]?token|password|passwd|private[_-]?key|access[_-]?key)\b["']?\s*[:=]\s*["']([A-Za-z0-9._\-+/]{16,})["']/gi,
+};
+/** Values that are plainly not real secrets — checked before reporting. */
+const PLACEHOLDER_RE = /^(?:your|my|the|example|sample|test|dummy|fake|placeholder|changeme|change_me|none|null|undefined|todo|xxx+|\*+|<.*>)$/i;
+const TEMPLATE_RE = /[$%{<]/; // `${VAR}`, `{{var}}`, `<your-key>` — interpolation, not a literal
+const LOW_ENTROPY_RE = /^(.)\1+$/; // aaaa..., 1111...
+/** Is this matched VALUE obviously a placeholder rather than a real secret? */
+export function looksLikePlaceholder(value) {
+    const v = value.trim();
+    if (!v)
+        return true;
+    if (v.length < 8)
+        return true;
+    if (PLACEHOLDER_RE.test(v))
+        return true;
+    if (TEMPLATE_RE.test(v))
+        return true;
+    if (LOW_ENTROPY_RE.test(v))
+        return true;
+    if (!/[A-Za-z]/.test(v) || !/[0-9]/.test(v)) {
+        // Pure letters or pure digits is usually a word/number, not a credential.
+        // (Real keys are mixed, and the prefix patterns above still catch the
+        // vendors whose keys are letters-only.)
+        if (v.length < 24)
+            return true;
+    }
+    return false;
+}
+// ─── Text scanning (pure) ───────────────────────────────────────────────────
+/**
+ * Find secret-shaped substrings in `text`. Pure and synchronous — the whole
+ * detector lives here, so it can be tested without touching a filesystem.
+ *
+ * @param text   Content to scan (a file body, a diff, a log line).
+ * @param path   Label attached to each finding (workspace-relative).
+ */
+export function scanText(text, path = '<text>') {
+    if (!text)
+        return [];
+    const lines = text.split(/\r?\n/);
+    const findings = [];
+    // One report per (pattern, line) — a minified line must not yield 50 rows.
+    const seen = new Set();
+    for (let i = 0; i < lines.length; i += 1) {
+        const line = lines[i];
+        if (!line || line.length === 0)
+            continue;
+        for (const pattern of [...ALL_PATTERNS, ASSIGN_PATTERN]) {
+            pattern.re.lastIndex = 0;
+            let m;
+            while ((m = pattern.re.exec(line)) !== null) {
+                // When the pattern captures the value explicitly, judge THAT (the
+                // assignment case); otherwise judge the whole match.
+                const value = m[1] ?? m[0];
+                if (looksLikePlaceholder(value)) {
+                    if (m[0].length === 0)
+                        pattern.re.lastIndex += 1; // never loop forever
+                    continue;
+                }
+                const key = `${pattern.id}:${i}`;
+                if (seen.has(key))
+                    continue;
+                seen.add(key);
+                findings.push({
+                    path,
+                    line: i + 1,
+                    column: m.index + 1,
+                    id: pattern.id,
+                    label: pattern.label,
+                    severity: pattern.severity,
+                    masked: maskSecret(value),
+                });
+                break; // one finding per pattern per line is enough to act on
+            }
+        }
+    }
+    return findings;
+}
+// ─── Filesystem walk ────────────────────────────────────────────────────────
+/** Directories that never contain the user's own source. */
+const SKIP_DIRS = new Set([
+    '.git', 'node_modules', 'dist', 'build', 'out', 'coverage', 'vendor',
+    '.next', '.nuxt', '.svelte-kit', '__pycache__', '.venv', 'venv', '.tox',
+    '.cache', '.turbo', 'target', '.idea', '.vscode', 'Pods', '.gradle',
+]);
+/** Extensions that are binary or generated — reading them wastes time and noise. */
+const SKIP_EXTENSIONS = new Set([
+    'png', 'jpg', 'jpeg', 'gif', 'webp', 'ico', 'bmp', 'svg', 'pdf', 'zip', 'gz',
+    'tar', 'tgz', 'bz2', '7z', 'rar', 'jar', 'war', 'class', 'exe', 'dll', 'so',
+    'dylib', 'bin', 'o', 'a', 'wasm', 'mp3', 'mp4', 'mov', 'avi', 'wav', 'woff',
+    'woff2', 'ttf', 'eot', 'otf', 'map', 'lock', 'pyc', 'pyo', 'snap',
+]);
+/** Per-file read cap. A secret never hides beyond this; a minified bundle does. */
+export const MAX_FILE_BYTES = 1_000_000;
+/** Default cap on files visited per scan, so a huge monorepo cannot hang a turn. */
+export const DEFAULT_MAX_FILES = 5_000;
+/** Should this workspace-relative path be skipped? (exported for tests) */
+export function shouldSkipPath(relPath) {
+    const parts = relPath.split(/[\\/]/);
+    if (parts.some((p) => SKIP_DIRS.has(p)))
+        return true;
+    const base = parts[parts.length - 1] ?? '';
+    const dot = base.lastIndexOf('.');
+    if (dot > 0) {
+        const ext = base.slice(dot + 1).toLowerCase();
+        if (SKIP_EXTENSIONS.has(ext))
+            return true;
+    }
+    return false;
+}
+/**
+ * Scan a directory tree for secret-shaped content.
+ *
+ * The walk is bounded twice (file count + per-file size) and skips binary dirs
+ * and generated artifacts. Findings carry a WORKSPACE-RELATIVE path so a report
+ * can be pasted into a ticket without leaking the operator's home directory.
+ * Read failures are counted as skipped, never thrown — a scan must not die on
+ * one unreadable file.
+ */
+export function scanDirectory(root, options = {}) {
+    const maxFiles = options.maxFiles ?? DEFAULT_MAX_FILES;
+    const maxFileBytes = options.maxFileBytes ?? MAX_FILE_BYTES;
+    const start = options.subdir ? join(root, options.subdir) : root;
+    const findings = [];
+    let filesScanned = 0;
+    let filesSkipped = 0;
+    let truncated = false;
+    const walk = (dir) => {
+        if (truncated)
+            return;
+        let entries;
+        try {
+            entries = readdirSync(dir);
+        }
+        catch {
+            filesSkipped += 1;
+            return;
+        }
+        for (const entry of entries) {
+            if (truncated)
+                return;
+            const abs = join(dir, entry);
+            let rel;
+            try {
+                rel = relative(root, abs);
+            }
+            catch {
+                filesSkipped += 1;
+                continue;
+            }
+            if (shouldSkipPath(rel)) {
+                filesSkipped += 1;
+                continue;
+            }
+            let st;
+            try {
+                st = statSync(abs);
+            }
+            catch {
+                filesSkipped += 1;
+                continue;
+            }
+            if (st.isDirectory()) {
+                walk(abs);
+                continue;
+            }
+            if (!st.isFile()) {
+                filesSkipped += 1;
+                continue;
+            }
+            if (filesScanned >= maxFiles) {
+                truncated = true;
+                return;
+            }
+            if (st.size > maxFileBytes) {
+                filesSkipped += 1;
+                continue;
+            }
+            let body;
+            try {
+                body = readFileSync(abs, 'utf-8');
+            }
+            catch {
+                filesSkipped += 1;
+                continue;
+            }
+            filesScanned += 1;
+            for (const hit of scanText(body, rel.split(sep).join('/'))) {
+                const lineText = body.split(/\r?\n/)[hit.line - 1] ?? '';
+                findings.push({ ...hit, preview: redact(lineText).slice(0, 200) });
+            }
+        }
+    };
+    walk(start);
+    const bySeverity = { critical: 0, high: 0, medium: 0 };
+    for (const f of findings)
+        bySeverity[f.severity] += 1;
+    return {
+        root,
+        filesScanned,
+        filesSkipped,
+        truncated,
+        findings: findings.sort((a, b) => a.path.localeCompare(b.path) || a.line - b.line),
+        bySeverity,
+        summary: buildSummary(findings, bySeverity, filesScanned, truncated),
+    };
+}
+// ─── Git history scan ───────────────────────────────────────────────────────
+//
+// The working-tree scan answers "is a key staged right now?". The other half of
+// the same worry is "was a key ever COMMITTED?" — a key deleted in a later
+// commit is still in the object store, still cloneable, still valid until it is
+// rotated. This walks the reachable blobs (every version of every file) rather
+// than the diff, so a secret that was added and later removed is still found at
+// the commit that introduced it. Bounded the same way as the tree walk, and
+// entirely local (`git` only — no network, no vendor binary).
+/** Default cap on commits walked. */
+export const DEFAULT_MAX_HISTORY_COMMITS = 500;
+/** Default cap on distinct blobs read, so a huge history cannot hang a turn. */
+export const DEFAULT_MAX_HISTORY_BLOBS = 2_000;
+/** Per-blob read cap (mirrors MAX_FILE_BYTES). */
+export const MAX_HISTORY_BLOB_BYTES = MAX_FILE_BYTES;
+/** Run a git command in `root`; null on any failure (git absent, not a repo…). */
+function runGit(root, args, input, maxBuffer = 256 * 1024 * 1024) {
+    try {
+        return execFileSync('git', args, {
+            cwd: root,
+            input,
+            maxBuffer,
+            stdio: ['pipe', 'pipe', 'ignore'],
+        });
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Scan reachable git history for secret-shaped content.
+ *
+ * Walks `git rev-list --objects --all` to enumerate every blob version, keeps
+ * only blobs whose path survives {@link shouldSkipPath}, reads the small ones
+ * through a single batched `git cat-file`, and runs the SAME {@link scanText}
+ * detector as the tree scan — one pattern source of truth across both surfaces.
+ * A finding's path is labelled `<path>@<commit>` when the introducing commit can
+ * be resolved (best-effort; the blob sha stand-in is used otherwise).
+ */
+export function scanGitHistory(root, options = {}) {
+    const maxCommits = options.maxCommits ?? DEFAULT_MAX_HISTORY_COMMITS;
+    const maxBlobs = options.maxBlobs ?? DEFAULT_MAX_HISTORY_BLOBS;
+    const maxBlobBytes = options.maxBlobBytes ?? MAX_HISTORY_BLOB_BYTES;
+    const empty = (isGitRepo, summary) => ({
+        root,
+        isGitRepo,
+        commitsScanned: 0,
+        blobsScanned: 0,
+        blobsSkipped: 0,
+        truncated: false,
+        findings: [],
+        bySeverity: { critical: 0, high: 0, medium: 0 },
+        summary,
+    });
+    const inside = runGit(root, ['rev-parse', '--is-inside-work-tree']);
+    if (!inside || inside.toString('utf-8').trim() !== 'true') {
+        return empty(false, 'Not a git work tree — nothing in history to scan.');
+    }
+    const totalRaw = runGit(root, ['rev-list', '--count', '--all']);
+    const totalCommits = totalRaw ? Number.parseInt(totalRaw.toString('utf-8').trim(), 10) || 0 : 0;
+    const commitsScanned = Math.min(totalCommits, maxCommits);
+    const pathArgs = options.subdir ? ['--', options.subdir] : [];
+    const listed = runGit(root, ['rev-list', '--objects', '--max-count', String(maxCommits), '--all', ...pathArgs]);
+    if (!listed) {
+        return empty(true, 'Could not read git history (the repository may be corrupt or shallow).');
+    }
+    // sha → first path seen. Bare lines are commits/trees (no path) — ignored.
+    const blobPath = new Map();
+    for (const rawLine of listed.toString('utf-8').split('\n')) {
+        const line = rawLine.trim();
+        if (!line)
+            continue;
+        const sp = line.indexOf(' ');
+        if (sp < 0)
+            continue;
+        const sha = line.slice(0, sp);
+        const path = line.slice(sp + 1).trim();
+        if (!path || !sha)
+            continue;
+        if (shouldSkipPath(path))
+            continue;
+        if (!blobPath.has(sha))
+            blobPath.set(sha, path);
+    }
+    const allShas = [...blobPath.keys()];
+    let truncated = totalCommits > maxCommits || allShas.length > maxBlobs;
+    const shas = allShas.slice(0, maxBlobs);
+    let blobsSkipped = allShas.length - shas.length;
+    // Sizes first (no content), so a huge minified bundle is never read.
+    const smallShas = [];
+    const sizeOut = runGit(root, ['cat-file', '--batch-check'], shas.join('\n') + '\n');
+    if (sizeOut) {
+        for (const line of sizeOut.toString('utf-8').split('\n')) {
+            const parts = line.trim().split(/\s+/);
+            if (parts.length < 3)
+                continue;
+            const [sha, type, sizeStr] = parts;
+            const size = Number.parseInt(sizeStr, 10);
+            if (type !== 'blob' || !Number.isFinite(size))
+                continue;
+            if (size > maxBlobBytes) {
+                blobsSkipped += 1;
+                continue;
+            }
+            smallShas.push(sha);
+        }
+    }
+    else {
+        blobsSkipped += shas.length;
+    }
+    // Read the small blobs in bounded chunks through one batched cat-file.
+    const findings = [];
+    let blobsScanned = 0;
+    const CHUNK = 500;
+    for (let i = 0; i < smallShas.length; i += CHUNK) {
+        const chunk = smallShas.slice(i, i + CHUNK);
+        const out = runGit(root, ['cat-file', '--batch'], chunk.join('\n') + '\n');
+        if (!out) {
+            blobsSkipped += chunk.length;
+            continue;
+        }
+        let pos = 0;
+        while (pos < out.length) {
+            const nl = out.indexOf(10, pos);
+            if (nl < 0)
+                break;
+            const header = out.toString('utf-8', pos, nl);
+            pos = nl + 1;
+            const [sha, type, sizeStr] = header.split(' ');
+            const size = Number.parseInt(sizeStr, 10);
+            if (!sha || type !== 'blob' || !Number.isFinite(size))
+                break;
+            const content = out.toString('utf-8', pos, pos + size);
+            pos += size + 1; // skip the content and its trailing newline
+            blobsScanned += 1;
+            const path = blobPath.get(sha) ?? sha;
+            for (const hit of scanText(content, path)) {
+                const lineText = content.split(/\r?\n/)[hit.line - 1] ?? '';
+                findings.push({ ...hit, preview: redact(lineText).slice(0, 200) });
+            }
+        }
+    }
+    // Best-effort: name the commit that introduced each finding-bearing blob, so
+    // the report says WHICH commit to rewrite. Done only for blobs with findings.
+    const findingBlobs = new Set(findings.map((f) => f.path));
+    const commitByPath = new Map();
+    for (const [sha, path] of blobPath) {
+        if (!findingBlobs.has(path) || commitByPath.has(path))
+            continue;
+        const log = runGit(root, ['log', '--all', '-1', '--format=%h', `--find-object=${sha}`]);
+        const commit = log?.toString('utf-8').trim().split('\n')[0] || undefined;
+        if (commit)
+            commitByPath.set(path, commit);
+    }
+    for (const f of findings) {
+        const commit = commitByPath.get(f.path);
+        if (commit)
+            f.commit = commit;
+    }
+    const bySeverity = { critical: 0, high: 0, medium: 0 };
+    for (const f of findings)
+        bySeverity[f.severity] += 1;
+    findings.sort((a, b) => a.path.localeCompare(b.path) || a.line - b.line);
+    return {
+        root,
+        isGitRepo: true,
+        commitsScanned,
+        blobsScanned,
+        blobsSkipped,
+        truncated,
+        findings,
+        bySeverity,
+        summary: buildHistorySummary(findings, bySeverity, commitsScanned, blobsScanned, truncated),
+    };
+}
+/** One honest sentence for a history scan — never overclaims a clean result. */
+function buildHistorySummary(findings, bySeverity, commitsScanned, blobsScanned, truncated) {
+    const suffix = truncated ? ' (cap reached — coverage is partial)' : '';
+    const base = `Walked ${commitsScanned} commit(s), ${blobsScanned} blob(s)${suffix}`;
+    if (findings.length === 0) {
+        return `${base}: nothing matched a known secret shape in history. ` +
+            'This is a lint, not a guarantee. A key only in a rewritten-away object is still reachable until `git gc`.';
+    }
+    return (`${base}: ${findings.length} historical finding(s) — ` +
+        `${bySeverity.critical} critical, ${bySeverity.high} high, ${bySeverity.medium} medium. ` +
+        'A committed secret must be ROTATED, not just deleted: it stays in the object store. Values are masked.');
+}
+/** Render a git-history result as a compact report a model or human can act on. */
+export function formatSecretHistoryScan(result) {
+    const lines = [result.summary];
+    if (result.findings.length > 0) {
+        lines.push('', 'path  commit  severity  kind  value(masked)');
+        for (const f of result.findings.slice(0, 200)) {
+            lines.push(`${f.path}  ${f.commit ?? '?'}  ${f.severity}  ${f.label}  ${f.masked}`);
+        }
+        if (result.findings.length > 200) {
+            lines.push(`… and ${result.findings.length - 200} more`);
+        }
+    }
+    return lines.join('\n');
+}
+/** One honest sentence. A clean scan is reported as "nothing matched". */
+function buildSummary(findings, bySeverity, filesScanned, truncated) {
+    const suffix = truncated ? ' (file cap reached — coverage is partial)' : '';
+    if (findings.length === 0) {
+        return `Scanned ${filesScanned} file(s)${suffix}: nothing matched a known secret shape. ` +
+            'This is a lint, not a guarantee — it finds known shapes and common assignments only.';
+    }
+    return (`Scanned ${filesScanned} file(s)${suffix}: ${findings.length} finding(s) — ` +
+        `${bySeverity.critical} critical, ${bySeverity.high} high, ${bySeverity.medium} medium. ` +
+        'Values are masked; rotate any that are real before they are committed.');
+}
+// ─── Rendering ──────────────────────────────────────────────────────────────
+/** Render a result as a compact report a model or a human can act on. */
+export function formatSecretScan(result) {
+    const lines = [result.summary];
+    if (result.findings.length > 0) {
+        lines.push('', 'path:line  severity  kind  value(masked)');
+        for (const f of result.findings.slice(0, 200)) {
+            lines.push(`${f.path}:${f.line}  ${f.severity}  ${f.label}  ${f.masked}`);
+        }
+        if (result.findings.length > 200) {
+            lines.push(`… and ${result.findings.length - 200} more`);
+        }
+    }
+    return lines.join('\n');
+}
+//# sourceMappingURL=secret-scan.js.map

package/dist/security/secret-scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-scan.js","sourceRoot":"","sources":["../../src/security/secret-scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AA4ClF,+EAA+E;AAE/E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAoB;IAC9C,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,0CAA0C,EAAE;IACvH,EAAE,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,gCAAgC,EAAE;IACnH,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,uBAAuB,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,4EAA4E,EAAE;IAC5J,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,iCAAiC,EAAE;IACxG,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,2BAA2B,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,mCAAmC,EAAE;IAC5H,EAAE,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,gCAAgC,EAAE;IAC/G,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,2BAA2B,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,kCAAkC,EAAE;IACtH,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,2BAA2B,EAAE;IAChG,EAAE,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,4BAA4B,EAAE;IACzG,EAAE,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,4BAA4B,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,gCAAgC,EAAE;IAC9H,EAAE,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,+BAA+B,EAAE;IAC5G,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,mCAAmC,EAAE;IAC1G,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,8BAA8B,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,+CAA+C,EAAE;IACtI,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,0BAA0B,EAAE;IAChG,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,2BAA2B,EAAE;IAC1F,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,iEAAiE,EAAE;IACnI;QACE,EAAE,EAAE,iBAAiB;QACrB,KAAK,EAAE,+BAA+B;QACtC,QAAQ,EAAE,MAAM;QAChB,EAAE,EAAE,kEAAkE;KACvE;CACF,CAAC;AAEF;;;;GAIG;AACH,SAAS,mBAAmB;IAC1B,uEAAuE;IACvE,4DAA4D;IAC5D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IACjG,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACxE,EAAE,EAAE,UAAU,MAAM,EAAE;QACtB,KAAK,EAAE,qBAAqB,MAAM,GAAG;QACrC,QAAQ,EAAE,QAA0B;QACpC,EAAE,EAAE,IAAI,MAAM,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,yBAAyB,EAAE,GAAG,CAAC;KAClG,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,YAAY,GAAoB,CAAC,GAAG,eAAe,EAAE,GAAG,mBAAmB,EAAE,CAAC,CAAC;AAErF;;;;GAIG;AACH,MAAM,cAAc,GAAkB;IACpC,EAAE,EAAE,iBAAiB;IACrB,KAAK,EAAE,mDAAmD;IAC1D,QAAQ,EAAE,QAAQ;IAClB,EAAE,EAAE,uMAAuM;CAC5M,CAAC;AAEF,2EAA2E;AAC3E,MAAM,cAAc,GAAG,yHAAyH,CAAC;AACjJ,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,mEAAmE;AACjG,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,mBAAmB;AAEtD,+EAA+E;AAC/E,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACvB,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,0EAA0E;QAC1E,sEAAsE;QACtE,wCAAwC;QACxC,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;IACjC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+EAA+E;AAE/E;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,IAAI,GAAG,QAAQ;IACpD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAqC,EAAE,CAAC;IACtD,2EAA2E;IAC3E,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAEzC,KAAK,MAAM,OAAO,IAAI,CAAC,GAAG,YAAY,EAAE,cAAc,CAAC,EAAE,CAAC;YACxD,OAAO,CAAC,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC;YACzB,IAAI,CAAyB,CAAC;YAC9B,OAAO,CAAC,CAAC,GAAG,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC5C,kEAAkE;gBAClE,qDAAqD;gBACrD,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC3B,IAAI,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;oBAChC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC;wBAAE,OAAO,CAAC,EAAE,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,qBAAqB;oBACvE,SAAS;gBACX,CAAC;gBACD,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;gBACjC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACd,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI;oBACJ,IAAI,EAAE,CAAC,GAAG,CAAC;oBACX,MAAM,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC;oBACnB,EAAE,EAAE,OAAO,CAAC,EAAE;oBACd,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC;iBAC1B,CAAC,CAAC;gBACH,MAAM,CAAC,uDAAuD;YAChE,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,+EAA+E;AAE/E,4DAA4D;AAC5D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ;IACpE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM;IACvE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS;CACpE,CAAC,CAAC;AAEH,oFAAoF;AACpF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI;IAC5E,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI;IAC3E,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM;IAC3E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM;CAClE,CAAC,CAAC;AAEH,mFAAmF;AACnF,MAAM,CAAC,MAAM,cAAc,GAAG,SAAS,CAAC;AACxC,oFAAoF;AACpF,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAEvC,2EAA2E;AAC3E,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QACZ,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9C,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IAC5C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAWD;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,UAAgC,EAAE;IAC5E,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,iBAAiB,CAAC;IACvD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,cAAc,CAAC;IAC5D,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEjE,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,SAAS,GAAG,KAAK,CAAC;IAEtB,MAAM,IAAI,GAAG,CAAC,GAAW,EAAQ,EAAE;QACjC,IAAI,SAAS;YAAE,OAAO;QACtB,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,YAAY,IAAI,CAAC,CAAC;YAClB,OAAO;QACT,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,SAAS;gBAAE,OAAO;YACtB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC7B,IAAI,GAAW,CAAC;YAChB,IAAI,CAAC;gBACH,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY,IAAI,CAAC,CAAC;gBAClB,SAAS;YACX,CAAC;YACD,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,YAAY,IAAI,CAAC,CAAC;gBAClB,SAAS;YACX,CAAC;YACD,IAAI,EAAE,CAAC;YACP,IAAI,CAAC;gBACH,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YACrB,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY,IAAI,CAAC,CAAC;gBAClB,SAAS;YACX,CAAC;YACD,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;gBACrB,IAAI,CAAC,GAAG,CAAC,CAAC;gBACV,SAAS;YACX,CAAC;YACD,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;gBACjB,YAAY,IAAI,CAAC,CAAC;gBAClB,SAAS;YACX,CAAC;YACD,IAAI,YAAY,IAAI,QAAQ,EAAE,CAAC;gBAC7B,SAAS,GAAG,IAAI,CAAC;gBACjB,OAAO;YACT,CAAC;YACD,IAAI,EAAE,CAAC,IAAI,GAAG,YAAY,EAAE,CAAC;gBAC3B,YAAY,IAAI,CAAC,CAAC;gBAClB,SAAS;YACX,CAAC;YACD,IAAI,IAAY,CAAC;YACjB,IAAI,CAAC;gBACH,IAAI,GAAG,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY,IAAI,CAAC,CAAC;gBAClB,SAAS;YACX,CAAC;YACD,YAAY,IAAI,CAAC,CAAC;YAClB,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;gBACzD,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,CAAC,KAAK,CAAC,CAAC;IAEZ,MAAM,UAAU,GAAmC,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IACvF,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAEtD,OAAO;QACL,IAAI;QACJ,YAAY;QACZ,YAAY;QACZ,SAAS;QACT,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;QAClF,UAAU;QACV,OAAO,EAAE,YAAY,CAAC,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,CAAC;KACrE,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,EAAE;AACF,gFAAgF;AAChF,2EAA2E;AAC3E,gFAAgF;AAChF,+EAA+E;AAC/E,gFAAgF;AAChF,4EAA4E;AAC5E,8DAA8D;AAE9D,qCAAqC;AACrC,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAC/C,gFAAgF;AAChF,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAC;AAC/C,kDAAkD;AAClD,MAAM,CAAC,MAAM,sBAAsB,GAAG,cAAc,CAAC;AAiCrD,kFAAkF;AAClF,SAAS,MAAM,CAAC,IAAY,EAAE,IAAc,EAAE,KAAc,EAAE,SAAS,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI;IACzF,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE;YAC/B,GAAG,EAAE,IAAI;YACT,KAAK;YACL,SAAS;YACT,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,UAA8B,EAAE;IAC3E,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,2BAA2B,CAAC;IACrE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,yBAAyB,CAAC;IAC/D,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,sBAAsB,CAAC;IAEpE,MAAM,KAAK,GAAG,CAAC,SAAkB,EAAE,OAAe,EAA2B,EAAE,CAAC,CAAC;QAC/E,IAAI;QACJ,SAAS;QACT,cAAc,EAAE,CAAC;QACjB,YAAY,EAAE,CAAC;QACf,YAAY,EAAE,CAAC;QACf,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,EAAE;QACZ,UAAU,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE;QAC/C,OAAO;KACR,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;QAC1D,OAAO,KAAK,CAAC,KAAK,EAAE,mDAAmD,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IAChE,MAAM,YAAY,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChG,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IAE1D,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC;IAChH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,KAAK,CAAC,IAAI,EAAE,wEAAwE,CAAC,CAAC;IAC/F,CAAC;IAED,2EAA2E;IAC3E,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,GAAG,CAAC;YAAE,SAAS;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG;YAAE,SAAS;QAC5B,IAAI,cAAc,CAAC,IAAI,CAAC;YAAE,SAAS;QACnC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACrC,IAAI,SAAS,GAAG,YAAY,GAAG,UAAU,IAAI,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC;IACvE,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACxC,IAAI,YAAY,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAEhD,qEAAqE;IACrE,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,eAAe,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;IACpF,IAAI,OAAO,EAAE,CAAC;QACZ,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACzD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACvC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,SAAS;YAC/B,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC;YACnC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAC1C,IAAI,IAAI,KAAK,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,SAAS;YACxD,IAAI,IAAI,GAAG,YAAY,EAAE,CAAC;gBACxB,YAAY,IAAI,CAAC,CAAC;gBAClB,SAAS;YACX,CAAC;YACD,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;SAAM,CAAC;QACN,YAAY,IAAI,IAAI,CAAC,MAAM,CAAC;IAC9B,CAAC;IAED,uEAAuE;IACvE,MAAM,QAAQ,GAAqB,EAAE,CAAC;IACtC,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,MAAM,KAAK,GAAG,GAAG,CAAC;IAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,SAAS,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QAC3E,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,YAAY,IAAI,KAAK,CAAC,MAAM,CAAC;YAC7B,SAAS;QACX,CAAC;QACD,IAAI,GAAG,GAAG,CAAC,CAAC;QACZ,OAAO,GAAG,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;YACxB,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YAChC,IAAI,EAAE,GAAG,CAAC;gBAAE,MAAM;YAClB,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YAC9C,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC;YACb,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAC1C,IAAI,CAAC,GAAG,IAAI,IAAI,KAAK,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,MAAM;YAC7D,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC;YACvD,GAAG,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,4CAA4C;YAC7D,YAAY,IAAI,CAAC,CAAC;YAClB,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;YACtC,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;gBAC1C,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC5D,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,8EAA8E;IAC9E,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC/C,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC;QACnC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAChE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,iBAAiB,GAAG,EAAE,CAAC,CAAC,CAAC;QACxF,MAAM,MAAM,GAAG,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;QACzE,IAAI,MAAM;YAAE,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,MAAM;YAAE,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC;IAChC,CAAC;IAED,MAAM,UAAU,GAAmC,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IACvF,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAEtD,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;IAEzE,OAAO;QACL,IAAI;QACJ,SAAS,EAAE,IAAI;QACf,cAAc;QACd,YAAY;QACZ,YAAY;QACZ,SAAS;QACT,QAAQ;QACR,UAAU;QACV,OAAO,EAAE,mBAAmB,CAAC,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,YAAY,EAAE,SAAS,CAAC;KAC5F,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,SAAS,mBAAmB,CAC1B,QAA0B,EAC1B,UAA0C,EAC1C,cAAsB,EACtB,YAAoB,EACpB,SAAkB;IAElB,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,MAAM,IAAI,GAAG,UAAU,cAAc,eAAe,YAAY,WAAW,MAAM,EAAE,CAAC;IACpF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,GAAG,IAAI,qDAAqD;YACjE,2GAA2G,CAAC;IAChH,CAAC;IACD,OAAO,CACL,GAAG,IAAI,KAAK,QAAQ,CAAC,MAAM,2BAA2B;QACtD,GAAG,UAAU,CAAC,QAAQ,cAAc,UAAU,CAAC,IAAI,UAAU,UAAU,CAAC,MAAM,WAAW;QACzF,wGAAwG,CACzG,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,uBAAuB,CAAC,MAA+B;IACrE,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,6CAA6C,CAAC,CAAC;QAC9D,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;YAC9C,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,0EAA0E;AAC1E,SAAS,YAAY,CACnB,QAAyB,EACzB,UAA0C,EAC1C,YAAoB,EACpB,SAAkB;IAElB,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,2CAA2C,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,WAAW,YAAY,WAAW,MAAM,0CAA0C;YACvF,sFAAsF,CAAC;IAC3F,CAAC;IACD,OAAO,CACL,WAAW,YAAY,WAAW,MAAM,KAAK,QAAQ,CAAC,MAAM,gBAAgB;QAC5E,GAAG,UAAU,CAAC,QAAQ,cAAc,UAAU,CAAC,IAAI,UAAU,UAAU,CAAC,MAAM,WAAW;QACzF,wEAAwE,CACzE,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,yEAAyE;AACzE,MAAM,UAAU,gBAAgB,CAAC,MAAwB;IACvD,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,0CAA0C,CAAC,CAAC;QAC3D,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;YAC9C,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/tools/plan-store.d.ts

@@ -81,6 +81,12 @@ export interface PlanStoreLike {
         description: string;
     }>): Plan;
     update(id: string, status: PlanStepStatus, note?: string): Plan | null;
+    /**
+     * Map a model-supplied step reference onto a real step id, or null when it
+     * names nothing in the plan. `plan_todo` calls this BEFORE `update` so an
+     * unknown reference is reported instead of silently doing nothing (A1).
+     */
+    resolveStepId?(id: string): string | null;
     /** Structured GUI snapshot (plan_todo emits it via plan:changed). */
     toGUI?(): PlanSnapshot | null;
     /** Human-readable checklist text (the model's tool result). */
@@ -125,11 +131,27 @@ export declare class PlanStore implements PlanStoreLike {
         id: string;
         description: string;
     }>): Plan;
+    /**
+     * Resolve a step reference the model sent to a real step id.
+     *
+     * Models are inconsistent about how they name a step: the schema examples
+     * are `step-1`/`reproduce`, but a live run's model addressed steps by bare
+     * ordinal (`2`, `3`) while it had created them as `step-2` (observed on the
+     * `cal` Android run, 2026-10-05 — the one-update that matched advanced the
+     * plan, every later update was a silent no-op and the checklist froze at
+     * `1/7`). Accept, in order: the exact id, the id with an optional
+     * `step`/`step-`/`#` prefix stripped (either side), and a 1-based ordinal
+     * when the reference is a plain integer inside range. Case-insensitive.
+     */
+    resolveStepId(id: string): string | null;
     /**
      * Mark one step's status (and optionally record a plain-English note about
-     * it). Unknown id → no-op (returns the unchanged plan).
+     * it). The reference is resolved through {@link resolveStepId} first, so a
+     * model that addressed `3` when the step is `step-3` still advances the
+     * plan. Unknown reference → no-op (returns the unchanged plan); callers that
+     * need to tell the two apart resolve first.
      */
-    update(id: string, status: PlanStepStatus, note?: string): Plan | null;
+    update(reference: string, status: PlanStepStatus, note?: string): Plan | null;
     /** A single, shared progress computation for every renderer. */
     progress(): PlanProgress;
     /** The step being worked right now (the first `running` one), or null. */

package/dist/tools/plan-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plan-store.d.ts","sourceRoot":"","sources":["../../src/tools/plan-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAQH,0EAA0E;AAC1E,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;AAExE,kCAAkC;AAClC,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,cAAc,CAAC;IACvB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,6CAA6C;AAC7C,MAAM,WAAW,IAAI;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,mEAAmE;IACnE,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,gFAAgF;AAChF,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,yEAAyE;AACzE,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,QAAQ,EAAE,OAAO,CAAC;IAClB,mEAAmE;IACnE,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,0EAA0E;AAC1E,MAAM,WAAW,aAAa;IAC5B,QAAQ,IAAI,IAAI,GAAG,IAAI,CAAC;IACxB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;IAC9E,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IACvE,qEAAqE;IACrE,KAAK,CAAC,IAAI,YAAY,GAAG,IAAI,CAAC;IAC9B,+DAA+D;IAC/D,MAAM,CAAC,IAAI,MAAM,CAAC;IAClB,uEAAuE;IACvE,OAAO,CAAC,IAAI,MAAM,CAAC;IACnB,sDAAsD;IACtD,OAAO,CAAC,IAAI,MAAM,CAAC;IACnB,2DAA2D;IAC3D,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;CACnC;AA2CD,0DAA0D;AAC1D,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,GAAG,IAAI,CAcvD;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC;CACxC;AAED,qBAAa,SAAU,YAAW,aAAa;IAC7C,OAAO,CAAC,IAAI,CAAqB;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAA8B;gBAE5C,OAAO,GAAE,gBAAqB;IAI1C,yDAAyD;IACzD,QAAQ,IAAI,IAAI,GAAG,IAAI;IAIvB,0DAA0D;IAC1D,KAAK,IAAI,YAAY,GAAG,IAAI;IAK5B;;;;OAIG;IACH,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI;IAMhC;;;OAGG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI;IAgB7E;;;OAGG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAuBtE,gEAAgE;IAChE,QAAQ,IAAI,YAAY;IAgBxB,0EAA0E;IAC1E,WAAW,IAAI,QAAQ,GAAG,IAAI;IAI9B;;;;;;;OAOG;IACH,OAAO,IAAI,MAAM;IAmBjB;;;;OAIG;IACH,OAAO,IAAI,MAAM;IAiBjB,6DAA6D;IAC7D,MAAM,IAAI,MAAM;CAgBjB;AASD,wBAAgB,gBAAgB,IAAI,aAAa,CAEhD;AAeD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGpD;AAED,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAOtD;AAED,kFAAkF;AAClF,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,CAOnE;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAQpE"}
+{"version":3,"file":"plan-store.d.ts","sourceRoot":"","sources":["../../src/tools/plan-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAQH,0EAA0E;AAC1E,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;AAExE,kCAAkC;AAClC,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,cAAc,CAAC;IACvB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,6CAA6C;AAC7C,MAAM,WAAW,IAAI;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,mEAAmE;IACnE,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,gFAAgF;AAChF,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,yEAAyE;AACzE,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,QAAQ,EAAE,OAAO,CAAC;IAClB,mEAAmE;IACnE,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,0EAA0E;AAC1E,MAAM,WAAW,aAAa;IAC5B,QAAQ,IAAI,IAAI,GAAG,IAAI,CAAC;IACxB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;IAC9E,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IACvE;;;;OAIG;IACH,aAAa,CAAC,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC1C,qEAAqE;IACrE,KAAK,CAAC,IAAI,YAAY,GAAG,IAAI,CAAC;IAC9B,+DAA+D;IAC/D,MAAM,CAAC,IAAI,MAAM,CAAC;IAClB,uEAAuE;IACvE,OAAO,CAAC,IAAI,MAAM,CAAC;IACnB,sDAAsD;IACtD,OAAO,CAAC,IAAI,MAAM,CAAC;IACnB,2DAA2D;IAC3D,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;CACnC;AA2CD,0DAA0D;AAC1D,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,GAAG,IAAI,CAcvD;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC;CACxC;AAED,qBAAa,SAAU,YAAW,aAAa;IAC7C,OAAO,CAAC,IAAI,CAAqB;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAA8B;gBAE5C,OAAO,GAAE,gBAAqB;IAI1C,yDAAyD;IACzD,QAAQ,IAAI,IAAI,GAAG,IAAI;IAIvB,0DAA0D;IAC1D,KAAK,IAAI,YAAY,GAAG,IAAI;IAK5B;;;;OAIG;IACH,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI;IAMhC;;;OAGG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI;IAgB7E;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAqBxC;;;;;;OAMG;IACH,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAwB7E,gEAAgE;IAChE,QAAQ,IAAI,YAAY;IAgBxB,0EAA0E;IAC1E,WAAW,IAAI,QAAQ,GAAG,IAAI;IAI9B;;;;;;;OAOG;IACH,OAAO,IAAI,MAAM;IAmBjB;;;;OAIG;IACH,OAAO,IAAI,MAAM;IAiBjB,6DAA6D;IAC7D,MAAM,IAAI,MAAM;CAgBjB;AASD,wBAAgB,gBAAgB,IAAI,aAAa,CAEhD;AAeD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGpD;AAED,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAOtD;AAED,kFAAkF;AAClF,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,CAOnE;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAQpE"}