beercan 0.5.2 → 0.5.3

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,OAAO,EAAE,MAAM,QAAQ,CAAC;AAC3C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AAEpC,qEAAqE;AACrE,wDAAwD;AACxD,6BAA6B;AAC7B,cAAc;AACd,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,CAAC;AACpF,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;AAE9C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAClD,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;AAElD,OAAO,EAAE,CAAC,CAAC,WAAW;AAEtB,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACvC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,CAAC;IAChE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,mBAAmB,CAAC;IACrD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC;IACjD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,2BAA2B,CAAC;IAChE,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IAC3C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACpC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IAC/C,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACpE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACxC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;IACjD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3C,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC7C,gCAAgC;IAChC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACpC,kCAAkC;IAClC,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9C,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7C,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7C,qBAAqB;IACrB,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAChD,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC;IACvD,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3C,sBAAsB;IACtB,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC7C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAIH,IAAI,OAAO,GAAkB,IAAI,CAAC;AAElC,MAAM,UAAU,SAAS;IACvB,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC;YAC3B,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB;YAC9C,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;YACrC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB;YAC/C,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB;YAC3C,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB;YACrD,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB;gBACpD,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;gBAC9C,CAAC,CAAC,SAAS;YACb,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB;gBAClD,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;gBAChD,CAAC,CAAC,SAAS;YACb,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB;gBAC/C,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;gBAC9C,CAAC,CAAC,SAAS;YACb,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;gBAClD,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;gBAC5C,CAAC,CAAC,SAAS;YACb,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB;YACvC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;YACrC,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B;gBACtD,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;gBAClD,CAAC,CAAC,SAAS;YACb,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,6BAA6B;gBAC3D,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC;gBACrD,CAAC,CAAC,SAAS;YACb,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe;YACnC,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B;gBACtD,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,KAAK,OAAO;gBACpD,CAAC,CAAC,SAAS;YACb,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B;YACxD,mBAAmB,EAAE,OAAO,CAAC,GAAG,CAAC,8BAA8B;gBAC7D,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC;gBACtD,CAAC,CAAC,SAAS;YACb,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB;gBAChD,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;gBAC/C,CAAC,CAAC,SAAS;YACb,sBAAsB,EAAE,OAAO,CAAC,GAAG,CAAC,iCAAiC;gBACnE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC;gBACzD,CAAC,CAAC,SAAS;YACb,qBAAqB,EAAE,OAAO,CAAC,GAAG,CAAC,gCAAgC;gBACjE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC;gBACxD,CAAC,CAAC,SAAS;YACb,sBAAsB,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB;gBAC3D,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;gBACjD,CAAC,CAAC,SAAS;YACb,wBAAwB,EAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B;gBAC9D,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;gBAClD,CAAC,CAAC,SAAS;YACb,oBAAoB,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB;YACzD,oBAAoB,EAAE,OAAO,CAAC,GAAG,CAAC,8BAA8B;gBAC9D,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC;gBACtD,CAAC,CAAC,SAAS;YACb,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B;gBACvD,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,KAAK,MAAM;gBACnD,CAAC,CAAC,SAAS;YACb,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB;SACtD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,WAAW;IACzB,OAAO,GAAG,IAAI,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,WAAmB;IAC/C,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;AACjE,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,OAAO,EAAE,MAAM,QAAQ,CAAC;AAC3C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AAEpC,qEAAqE;AACrE,wDAAwD;AACxD,6BAA6B;AAC7B,cAAc;AACd,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,CAAC;AACpF,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;AAE9C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAClD,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;AAElD,OAAO,EAAE,CAAC,CAAC,WAAW;AAEtB,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACvC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,CAAC;IAChE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,mBAAmB,CAAC;IACrD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC;IACjD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,2BAA2B,CAAC;IAChE,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IAC3C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACpC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IAC/C,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACpE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACxC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;IACjD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3C,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC7C,gCAAgC;IAChC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACpC,kCAAkC;IAClC,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9C,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7C,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7C,qBAAqB;IACrB,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAChD,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC;IACvD,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3C,sBAAsB;IACtB,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC7C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,aAAa;IACb,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC7C,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IACvE,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAG,8CAA8C;IAC5F,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAY,gCAAgC;IAC/E,gBAAgB;IAChB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAIH,IAAI,OAAO,GAAkB,IAAI,CAAC;AAElC,MAAM,UAAU,SAAS;IACvB,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC;YAC3B,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB;YAC9C,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;YACrC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB;YAC/C,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB;YAC3C,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB;YACrD,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB;gBACpD,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;gBAC9C,CAAC,CAAC,SAAS;YACb,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB;gBAClD,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;gBAChD,CAAC,CAAC,SAAS;YACb,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB;gBAC/C,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;gBAC9C,CAAC,CAAC,SAAS;YACb,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;gBAClD,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;gBAC5C,CAAC,CAAC,SAAS;YACb,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB;YACvC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;YACrC,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B;gBACtD,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;gBAClD,CAAC,CAAC,SAAS;YACb,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,6BAA6B;gBAC3D,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC;gBACrD,CAAC,CAAC,SAAS;YACb,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe;YACnC,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B;gBACtD,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,KAAK,OAAO;gBACpD,CAAC,CAAC,SAAS;YACb,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B;YACxD,mBAAmB,EAAE,OAAO,CAAC,GAAG,CAAC,8BAA8B;gBAC7D,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC;gBACtD,CAAC,CAAC,SAAS;YACb,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB;gBAChD,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;gBAC/C,CAAC,CAAC,SAAS;YACb,sBAAsB,EAAE,OAAO,CAAC,GAAG,CAAC,iCAAiC;gBACnE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC;gBACzD,CAAC,CAAC,SAAS;YACb,qBAAqB,EAAE,OAAO,CAAC,GAAG,CAAC,gCAAgC;gBACjE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC;gBACxD,CAAC,CAAC,SAAS;YACb,sBAAsB,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB;gBAC3D,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;gBACjD,CAAC,CAAC,SAAS;YACb,wBAAwB,EAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B;gBAC9D,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;gBAClD,CAAC,CAAC,SAAS;YACb,oBAAoB,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB;YACzD,oBAAoB,EAAE,OAAO,CAAC,GAAG,CAAC,8BAA8B;gBAC9D,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC;gBACtD,CAAC,CAAC,SAAS;YACb,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B;gBACvD,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,KAAK,MAAM;gBACnD,CAAC,CAAC,SAAS;YACb,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB;YACrD,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B;gBACvD,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,KAAK,MAAM;gBACnD,CAAC,CAAC,SAAS;YACb,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB;YACnD,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B;YACzD,oBAAoB,EAAE,OAAO,CAAC,GAAG,CAAC,6BAA6B;YAC/D,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;gBAC3C,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,MAAM;gBAC7C,CAAC,CAAC,SAAS;YACb,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB;YAC1C,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;SACzC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,WAAW;IACzB,OAAO,GAAG,IAAI,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,WAAmB;IAC/C,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;AACjE,CAAC"}

package/dist/core/logger.d.ts

@@ -10,7 +10,10 @@ export declare class Logger {
     private level;
     private fileStream;
     private quiet;
+    private sanitizeEnabled;
     constructor(level?: LogLevel, logFilePath?: string);
+    /** Enable or disable log sanitization (redacts sensitive fields). */
+    setSanitize(enabled: boolean): void;
     /** Suppress console output (file-only). Used in chat mode. */
     setQuiet(quiet: boolean): void;
     private write;
@@ -19,6 +22,10 @@ export declare class Logger {
     warn(component: string, message: string, data?: Record<string, unknown>): void;
     error(component: string, message: string, data?: Record<string, unknown>): void;
     close(): void;
+    /** Deep-walk a data object and redact sensitive fields. */
+    static sanitize(data: Record<string, unknown>): Record<string, unknown>;
+    /** Scrub known secret patterns from a string. */
+    static sanitizeString(str: string): string;
 }
 export declare function setGlobalLogger(logger: Logger): void;
 export declare function getLogger(): Logger;

package/dist/core/logger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/core/logger.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAI3D,MAAM,WAAW,QAAQ;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,QAAQ,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,qBAAa,MAAM;IACjB,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,UAAU,CAA+B;IACjD,OAAO,CAAC,KAAK,CAAS;gBAEV,KAAK,GAAE,QAAiB,EAAE,WAAW,CAAC,EAAE,MAAM;IAU1D,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI;IAI9B,OAAO,CAAC,KAAK;IA0Bb,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAI/E,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAI9E,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAI9E,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAI/E,KAAK,IAAI,IAAI;CAId;AAKD,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAEpD;AAED,wBAAgB,SAAS,IAAI,MAAM,CAKlC"}
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/core/logger.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAI3D,MAAM,WAAW,QAAQ;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,QAAQ,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAoBD,qBAAa,MAAM;IACjB,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,UAAU,CAA+B;IACjD,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,eAAe,CAAS;gBAEpB,KAAK,GAAE,QAAiB,EAAE,WAAW,CAAC,EAAE,MAAM;IAU1D,qEAAqE;IACrE,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI;IAInC,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI;IAI9B,OAAO,CAAC,KAAK;IA6Bb,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAI/E,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAI9E,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAI9E,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAI/E,KAAK,IAAI,IAAI;IAKb,2DAA2D;IAC3D,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAsBvE,iDAAiD;IACjD,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;CAO3C;AAKD,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAEpD;AAED,wBAAgB,SAAS,IAAI,MAAM,CAKlC"}

package/dist/core/logger.js

@@ -1,10 +1,27 @@
 import fs from "fs";
 import path from "path";
 const LEVELS = { debug: 0, info: 1, warn: 2, error: 3 };
+// ── Sensitive Field Patterns ─────────────────────────────────
+// Fields whose values should be redacted when log sanitization is active.
+const SENSITIVE_FIELDS = new Set([
+    "goal", "result", "content", "messages", "systemPrompt", "system_prompt",
+    "toolCalls", "tool_calls", "extraContext", "extra_context",
+    "eventData", "event_data", "goalTemplate", "goal_template",
+    "filterData", "filter_data", "passphrase", "password",
+]);
+// Regex patterns for API keys/tokens that should always be redacted.
+const SECRET_PATTERNS = [
+    /sk-ant-[a-zA-Z0-9_-]+/g, // Anthropic API keys
+    /sk-[a-zA-Z0-9]{20,}/g, // OpenAI-style keys
+    /xoxb-[a-zA-Z0-9-]+/g, // Slack bot tokens
+    /xoxp-[a-zA-Z0-9-]+/g, // Slack user tokens
+    /Bearer\s+[a-zA-Z0-9._~+/-]+=*/g, // Bearer tokens
+];
 export class Logger {
     level;
     fileStream = null;
     quiet = false;
+    sanitizeEnabled = false;
     constructor(level = "info", logFilePath) {
         this.level = LEVELS[level];
         if (logFilePath) {
@@ -14,6 +31,10 @@ export class Logger {
             this.fileStream = fs.createWriteStream(logFilePath, { flags: "a" });
         }
     }
+    /** Enable or disable log sanitization (redacts sensitive fields). */
+    setSanitize(enabled) {
+        this.sanitizeEnabled = enabled;
+    }
     /** Suppress console output (file-only). Used in chat mode. */
     setQuiet(quiet) {
         this.quiet = quiet;
@@ -21,12 +42,14 @@ export class Logger {
     write(level, component, message, data) {
         if (LEVELS[level] < this.level)
             return;
+        const sanitizedData = this.sanitizeEnabled && data ? Logger.sanitize(data) : data;
+        const sanitizedMessage = this.sanitizeEnabled ? Logger.sanitizeString(message) : message;
         const entry = {
             timestamp: new Date().toISOString(),
             level,
             component,
-            message,
-            ...(data && Object.keys(data).length > 0 ? { data } : {}),
+            message: sanitizedMessage,
+            ...(sanitizedData && Object.keys(sanitizedData).length > 0 ? { data: sanitizedData } : {}),
         };
         const line = JSON.stringify(entry);
         // Always write to file if available
@@ -57,6 +80,38 @@ export class Logger {
         this.fileStream?.end();
         this.fileStream = null;
     }
+    /** Deep-walk a data object and redact sensitive fields. */
+    static sanitize(data) {
+        const result = {};
+        for (const [key, value] of Object.entries(data)) {
+            if (SENSITIVE_FIELDS.has(key)) {
+                result[key] = "[REDACTED]";
+            }
+            else if (typeof value === "string") {
+                result[key] = Logger.sanitizeString(value);
+            }
+            else if (Array.isArray(value)) {
+                result[key] = value.map((item) => typeof item === "object" && item !== null
+                    ? Logger.sanitize(item)
+                    : typeof item === "string" ? Logger.sanitizeString(item) : item);
+            }
+            else if (typeof value === "object" && value !== null) {
+                result[key] = Logger.sanitize(value);
+            }
+            else {
+                result[key] = value;
+            }
+        }
+        return result;
+    }
+    /** Scrub known secret patterns from a string. */
+    static sanitizeString(str) {
+        let result = str;
+        for (const pattern of SECRET_PATTERNS) {
+            result = result.replace(pattern, "[REDACTED:key]");
+        }
+        return result;
+    }
 }
 /** Global logger instance — set once in BeerCanEngine */
 let _logger = null;

package/dist/core/logger.js.map

@@ -1 +1 @@
-{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/core/logger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AAOxB,MAAM,MAAM,GAA6B,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAUlF,MAAM,OAAO,MAAM;IACT,KAAK,CAAS;IACd,UAAU,GAA0B,IAAI,CAAC;IACzC,KAAK,GAAG,KAAK,CAAC;IAEtB,YAAY,QAAkB,MAAM,EAAE,WAAoB;QACxD,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAE3B,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YACtC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAChE,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC,iBAAiB,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED,8DAA8D;IAC9D,QAAQ,CAAC,KAAc;QACrB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,KAAe,EAAE,SAAiB,EAAE,OAAe,EAAE,IAA8B;QAC/F,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK;YAAE,OAAO;QAEvC,MAAM,KAAK,GAAa;YACtB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,KAAK;YACL,SAAS;YACT,OAAO;YACP,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D,CAAC;QAEF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAEnC,oCAAoC;QACpC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;QAEpC,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO;QAEvB,oDAAoD;QACpD,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YAC1C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;QACpC,CAAC;aAAM,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACvC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAiB,EAAE,OAAe,EAAE,IAA8B;QACtE,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,CAAC,SAAiB,EAAE,OAAe,EAAE,IAA8B;QACrE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,CAAC,SAAiB,EAAE,OAAe,EAAE,IAA8B;QACrE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,SAAiB,EAAE,OAAe,EAAE,IAA8B;QACtE,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAChD,CAAC;IAED,KAAK;QACH,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;IACzB,CAAC;CACF;AAED,yDAAyD;AACzD,IAAI,OAAO,GAAkB,IAAI,CAAC;AAElC,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,OAAO,GAAG,MAAM,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/core/logger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AAOxB,MAAM,MAAM,GAA6B,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAUlF,gEAAgE;AAChE,0EAA0E;AAC1E,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,cAAc,EAAE,eAAe;IACxE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,eAAe;IAC1D,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,eAAe;IAC1D,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU;CACtD,CAAC,CAAC;AAEH,qEAAqE;AACrE,MAAM,eAAe,GAAG;IACtB,wBAAwB,EAAO,qBAAqB;IACpD,sBAAsB,EAAU,oBAAoB;IACpD,qBAAqB,EAAW,mBAAmB;IACnD,qBAAqB,EAAW,oBAAoB;IACpD,gCAAgC,EAAE,gBAAgB;CACnD,CAAC;AAEF,MAAM,OAAO,MAAM;IACT,KAAK,CAAS;IACd,UAAU,GAA0B,IAAI,CAAC;IACzC,KAAK,GAAG,KAAK,CAAC;IACd,eAAe,GAAG,KAAK,CAAC;IAEhC,YAAY,QAAkB,MAAM,EAAE,WAAoB;QACxD,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAE3B,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YACtC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAChE,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC,iBAAiB,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,WAAW,CAAC,OAAgB;QAC1B,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC;IACjC,CAAC;IAED,8DAA8D;IAC9D,QAAQ,CAAC,KAAc;QACrB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,KAAe,EAAE,SAAiB,EAAE,OAAe,EAAE,IAA8B;QAC/F,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK;YAAE,OAAO;QAEvC,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAClF,MAAM,gBAAgB,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QAEzF,MAAM,KAAK,GAAa;YACtB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,KAAK;YACL,SAAS;YACT,OAAO,EAAE,gBAAgB;YACzB,GAAG,CAAC,aAAa,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3F,CAAC;QAEF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAEnC,oCAAoC;QACpC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;QAEpC,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO;QAEvB,oDAAoD;QACpD,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YAC1C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;QACpC,CAAC;aAAM,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACvC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAiB,EAAE,OAAe,EAAE,IAA8B;QACtE,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,CAAC,SAAiB,EAAE,OAAe,EAAE,IAA8B;QACrE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,CAAC,SAAiB,EAAE,OAAe,EAAE,IAA8B;QACrE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,SAAiB,EAAE,OAAe,EAAE,IAA8B;QACtE,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAChD,CAAC;IAED,KAAK;QACH,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;IACzB,CAAC;IAED,2DAA2D;IAC3D,MAAM,CAAC,QAAQ,CAAC,IAA6B;QAC3C,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC9B,MAAM,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC;YAC7B,CAAC;iBAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACrC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAC7C,CAAC;iBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChC,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAC/B,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;oBACvC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAA+B,CAAC;oBAClD,CAAC,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAClE,CAAC;YACJ,CAAC;iBAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACvD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAgC,CAAC,CAAC;YAClE,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACtB,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,iDAAiD;IACjD,MAAM,CAAC,cAAc,CAAC,GAAW;QAC/B,IAAI,MAAM,GAAG,GAAG,CAAC;QACjB,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;YACtC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAED,yDAAyD;AACzD,IAAI,OAAO,GAAkB,IAAI,CAAC;AAElC,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,OAAO,GAAG,MAAM,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/crypto/index.d.ts

@@ -0,0 +1,66 @@
+export type EncryptionScope = {
+    type: "global";
+} | {
+    type: "project";
+    projectId: string;
+} | {
+    type: "bloop";
+    projectId: string;
+    bloopId: string;
+} | {
+    type: "memory";
+    projectId: string;
+};
+export declare class CryptoManager {
+    private keyManager;
+    private constructor();
+    /** Create a CryptoManager from a passphrase. */
+    static fromPassphrase(passphrase: string, configDir: string): CryptoManager;
+    /** Create a CryptoManager from a keyfile. */
+    static fromKeyfile(keyfilePath: string): CryptoManager;
+    /** Create a disabled CryptoManager (no-op passthrough). */
+    static disabled(): CryptoManager;
+    /** Returns true if encryption is active. */
+    isEnabled(): boolean;
+    /**
+     * Encrypt a plaintext string with scope-based key derivation.
+     * Returns an "enc:v1:<base64>" formatted string.
+     * If encryption is disabled, returns the plaintext unchanged.
+     */
+    encrypt(plaintext: string, scope: EncryptionScope): string;
+    /**
+     * Decrypt an "enc:v1:<base64>" string back to plaintext.
+     * Throws if the data is tampered or the wrong key is used.
+     * If encryption is disabled, returns the input unchanged.
+     */
+    decrypt(ciphertext: string, scope: EncryptionScope): string;
+    /**
+     * Decrypt if encrypted, return as-is if plaintext.
+     * Use during migration period when data may be mixed.
+     */
+    maybeDecrypt(value: string | null | undefined, scope: EncryptionScope): string | null | undefined;
+    /**
+     * Encrypt a JSON-serializable value.
+     * Serializes to JSON string, then encrypts.
+     */
+    encryptJSON(obj: unknown, scope: EncryptionScope): string;
+    /**
+     * Decrypt a value and parse as JSON.
+     */
+    decryptJSON(ciphertext: string, scope: EncryptionScope): unknown;
+    /**
+     * Conditionally decrypt a JSON field. If the value is already plaintext JSON, parse directly.
+     */
+    maybeDecryptJSON(value: string | null | undefined, scope: EncryptionScope): unknown;
+    /**
+     * Securely destroy all key material. Call on shutdown.
+     * After calling, encrypt/decrypt will act as disabled (passthrough).
+     */
+    destroy(): void;
+    private resolveKey;
+}
+/** Check if a value is in encrypted format. */
+export declare function isEncrypted(value: string): boolean;
+export { KeyManager } from "./key-manager.js";
+export { generateRandomKey, zeroBuffer } from "./primitives.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/crypto/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/crypto/index.ts"],"names":[],"mappings":"AAYA,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACrD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAa1C,qBAAa,aAAa;IACxB,OAAO,CAAC,UAAU,CAAoB;IAEtC,OAAO;IAMP,gDAAgD;IAChD,MAAM,CAAC,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,aAAa;IAK3E,6CAA6C;IAC7C,MAAM,CAAC,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,aAAa;IAKtD,2DAA2D;IAC3D,MAAM,CAAC,QAAQ,IAAI,aAAa;IAMhC,4CAA4C;IAC5C,SAAS,IAAI,OAAO;IAMpB;;;;OAIG;IACH,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,MAAM;IAS1D;;;;OAIG;IACH,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,MAAM;IAc3D;;;OAGG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,KAAK,EAAE,eAAe,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS;IAOjG;;;OAGG;IACH,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,GAAG,MAAM;IAIzD;;OAEG;IACH,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO;IAKhE;;OAEG;IACH,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO;IAUnF;;;OAGG;IACH,OAAO,IAAI,IAAI;IAQf,OAAO,CAAC,UAAU;CAkBnB;AAID,+CAA+C;AAC/C,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAElD;AAGD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/crypto/index.js

@@ -0,0 +1,142 @@
+import { aesGcmEncrypt, aesGcmDecrypt, packAesGcm, unpackAesGcm, } from "./primitives.js";
+import { KeyManager } from "./key-manager.js";
+// ── Encrypted Value Format ───────────────────────────────────
+// Encrypted values are stored as: "enc:v1:<base64(iv + ciphertext + tag)>"
+// The prefix allows detection of encrypted vs plaintext data.
+const ENC_PREFIX = "enc:v1:";
+// ── CryptoManager ────────────────────────────────────────────
+// High-level facade for all encryption operations in BeerCan.
+// Thread-safe (single-threaded Node.js), handles key derivation
+// and provides encrypt/decrypt with scope-based key selection.
+export class CryptoManager {
+    keyManager;
+    constructor(keyManager) {
+        this.keyManager = keyManager;
+    }
+    // ── Factory Methods ──────────────────────────────────────
+    /** Create a CryptoManager from a passphrase. */
+    static fromPassphrase(passphrase, configDir) {
+        const km = KeyManager.fromPassphrase(passphrase, configDir);
+        return new CryptoManager(km);
+    }
+    /** Create a CryptoManager from a keyfile. */
+    static fromKeyfile(keyfilePath) {
+        const km = KeyManager.fromKeyfile(keyfilePath);
+        return new CryptoManager(km);
+    }
+    /** Create a disabled CryptoManager (no-op passthrough). */
+    static disabled() {
+        return new CryptoManager(null);
+    }
+    // ── Status ───────────────────────────────────────────────
+    /** Returns true if encryption is active. */
+    isEnabled() {
+        return this.keyManager !== null && !this.keyManager.isDestroyed();
+    }
+    // ── Encrypt / Decrypt ────────────────────────────────────
+    /**
+     * Encrypt a plaintext string with scope-based key derivation.
+     * Returns an "enc:v1:<base64>" formatted string.
+     * If encryption is disabled, returns the plaintext unchanged.
+     */
+    encrypt(plaintext, scope) {
+        if (!this.isEnabled())
+            return plaintext;
+        const key = this.resolveKey(scope);
+        const result = aesGcmEncrypt(key, Buffer.from(plaintext, "utf-8"));
+        const packed = packAesGcm(result);
+        return ENC_PREFIX + packed.toString("base64");
+    }
+    /**
+     * Decrypt an "enc:v1:<base64>" string back to plaintext.
+     * Throws if the data is tampered or the wrong key is used.
+     * If encryption is disabled, returns the input unchanged.
+     */
+    decrypt(ciphertext, scope) {
+        if (!this.isEnabled())
+            return ciphertext;
+        if (!ciphertext.startsWith(ENC_PREFIX)) {
+            throw new Error("Cannot decrypt: value is not in encrypted format");
+        }
+        const packed = Buffer.from(ciphertext.slice(ENC_PREFIX.length), "base64");
+        const { iv, ciphertext: ct, tag } = unpackAesGcm(packed);
+        const key = this.resolveKey(scope);
+        const plaintext = aesGcmDecrypt(key, iv, ct, tag);
+        return plaintext.toString("utf-8");
+    }
+    /**
+     * Decrypt if encrypted, return as-is if plaintext.
+     * Use during migration period when data may be mixed.
+     */
+    maybeDecrypt(value, scope) {
+        if (value == null)
+            return value;
+        if (!this.isEnabled())
+            return value;
+        if (!isEncrypted(value))
+            return value;
+        return this.decrypt(value, scope);
+    }
+    /**
+     * Encrypt a JSON-serializable value.
+     * Serializes to JSON string, then encrypts.
+     */
+    encryptJSON(obj, scope) {
+        return this.encrypt(JSON.stringify(obj), scope);
+    }
+    /**
+     * Decrypt a value and parse as JSON.
+     */
+    decryptJSON(ciphertext, scope) {
+        const plaintext = this.decrypt(ciphertext, scope);
+        return JSON.parse(plaintext);
+    }
+    /**
+     * Conditionally decrypt a JSON field. If the value is already plaintext JSON, parse directly.
+     */
+    maybeDecryptJSON(value, scope) {
+        if (value == null)
+            return value;
+        if (!this.isEnabled() || !isEncrypted(value)) {
+            return JSON.parse(value);
+        }
+        return this.decryptJSON(value, scope);
+    }
+    // ── Lifecycle ────────────────────────────────────────────
+    /**
+     * Securely destroy all key material. Call on shutdown.
+     * After calling, encrypt/decrypt will act as disabled (passthrough).
+     */
+    destroy() {
+        if (this.keyManager) {
+            this.keyManager.destroy();
+        }
+    }
+    // ── Internal ─────────────────────────────────────────────
+    resolveKey(scope) {
+        if (!this.keyManager) {
+            throw new Error("CryptoManager is disabled — cannot resolve key");
+        }
+        switch (scope.type) {
+            case "global":
+                return this.keyManager.deriveGlobalKey();
+            case "project":
+                return this.keyManager.deriveProjectKey(scope.projectId);
+            case "bloop":
+                return this.keyManager.deriveBloopKey(scope.projectId, scope.bloopId);
+            case "memory":
+                return this.keyManager.deriveMemoryKey(scope.projectId);
+            default:
+                throw new Error(`Unknown encryption scope type: ${scope.type}`);
+        }
+    }
+}
+// ── Utility ──────────────────────────────────────────────────
+/** Check if a value is in encrypted format. */
+export function isEncrypted(value) {
+    return value.startsWith(ENC_PREFIX);
+}
+// Re-export key types for consumers
+export { KeyManager } from "./key-manager.js";
+export { generateRandomKey, zeroBuffer } from "./primitives.js";
+//# sourceMappingURL=index.js.map

package/dist/crypto/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/crypto/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,aAAa,EACb,UAAU,EACV,YAAY,GAEb,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAW9C,gEAAgE;AAChE,2EAA2E;AAC3E,8DAA8D;AAE9D,MAAM,UAAU,GAAG,SAAS,CAAC;AAE7B,gEAAgE;AAChE,8DAA8D;AAC9D,gEAAgE;AAChE,+DAA+D;AAE/D,MAAM,OAAO,aAAa;IAChB,UAAU,CAAoB;IAEtC,YAAoB,UAA6B;QAC/C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED,4DAA4D;IAE5D,gDAAgD;IAChD,MAAM,CAAC,cAAc,CAAC,UAAkB,EAAE,SAAiB;QACzD,MAAM,EAAE,GAAG,UAAU,CAAC,cAAc,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAC5D,OAAO,IAAI,aAAa,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC;IAED,6CAA6C;IAC7C,MAAM,CAAC,WAAW,CAAC,WAAmB;QACpC,MAAM,EAAE,GAAG,UAAU,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QAC/C,OAAO,IAAI,aAAa,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC;IAED,2DAA2D;IAC3D,MAAM,CAAC,QAAQ;QACb,OAAO,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED,4DAA4D;IAE5D,4CAA4C;IAC5C,SAAS;QACP,OAAO,IAAI,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC;IACpE,CAAC;IAED,4DAA4D;IAE5D;;;;OAIG;IACH,OAAO,CAAC,SAAiB,EAAE,KAAsB;QAC/C,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;YAAE,OAAO,SAAS,CAAC;QAExC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC;IAED;;;;OAIG;IACH,OAAO,CAAC,UAAkB,EAAE,KAAsB;QAChD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;YAAE,OAAO,UAAU,CAAC;QAEzC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC1E,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QACzD,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QAClD,OAAO,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAED;;;OAGG;IACH,YAAY,CAAC,KAAgC,EAAE,KAAsB;QACnE,IAAI,KAAK,IAAI,IAAI;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;YAAE,OAAO,KAAK,CAAC;QACpC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACtC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACpC,CAAC;IAED;;;OAGG;IACH,WAAW,CAAC,GAAY,EAAE,KAAsB;QAC9C,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,UAAkB,EAAE,KAAsB;QACpD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,KAAgC,EAAE,KAAsB;QACvE,IAAI,KAAK,IAAI,IAAI;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACxC,CAAC;IAED,4DAA4D;IAE5D;;;OAGG;IACH,OAAO;QACL,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,4DAA4D;IAEpD,UAAU,CAAC,KAAsB;QACvC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QAED,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;YACnB,KAAK,QAAQ;gBACX,OAAO,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,CAAC;YAC3C,KAAK,SAAS;gBACZ,OAAO,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC3D,KAAK,OAAO;gBACV,OAAO,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YACxE,KAAK,QAAQ;gBACX,OAAO,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC1D;gBACE,MAAM,IAAI,KAAK,CAAC,kCAAmC,KAAa,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;CACF;AAED,gEAAgE;AAEhE,+CAA+C;AAC/C,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,OAAO,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AACtC,CAAC;AAED,oCAAoC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/crypto/key-manager.d.ts

@@ -0,0 +1,62 @@
+export interface CryptoConfig {
+    version: number;
+    mode: "passphrase" | "keyfile";
+    scrypt?: {
+        salt: string;
+        N: number;
+        r: number;
+        p: number;
+        keyLength: number;
+    };
+    verifier: string;
+}
+export declare class KeyManager {
+    private masterKey;
+    private hkdfSalt;
+    private subKeyCache;
+    private destroyed;
+    private constructor();
+    /**
+     * Initialize from a passphrase. If crypto.json exists at configDir, uses stored salt.
+     * Otherwise creates a new config with fresh salt.
+     */
+    static fromPassphrase(passphrase: string, configDir: string): KeyManager;
+    /**
+     * Initialize from a keyfile. If the file doesn't exist, throws.
+     */
+    static fromKeyfile(keyfilePath: string): KeyManager;
+    /**
+     * Generate a new keyfile at the given path.
+     */
+    static generateKeyfile(keyfilePath: string, configDir: string): void;
+    /**
+     * Derive a sub-key for a given context string.
+     * Uses LRU cache to avoid repeated HKDF calls.
+     */
+    deriveKey(context: string): Buffer;
+    /** Derive a project-scoped key. */
+    deriveProjectKey(projectId: string): Buffer;
+    /** Derive a bloop-scoped key. */
+    deriveBloopKey(projectId: string, bloopId: string): Buffer;
+    /** Derive a memory-scoped key. */
+    deriveMemoryKey(projectId: string): Buffer;
+    /** Derive the global key (for cross-project data like job queue). */
+    deriveGlobalKey(): Buffer;
+    /**
+     * Securely destroy all key material. Call on shutdown.
+     * After calling, all encrypt/decrypt operations will throw.
+     */
+    destroy(): void;
+    isDestroyed(): boolean;
+    private ensureNotDestroyed;
+    /**
+     * Create a verifier string by encrypting a known plaintext with the key.
+     * Used to check if a passphrase is correct without storing the key.
+     */
+    private static createVerifier;
+    /**
+     * Verify that a key can decrypt the stored verifier.
+     */
+    private static verifyKey;
+}
+//# sourceMappingURL=key-manager.d.ts.map

package/dist/crypto/key-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-manager.d.ts","sourceRoot":"","sources":["../../src/crypto/key-manager.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,YAAY,GAAG,SAAS,CAAC;IAC/B,MAAM,CAAC,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,CAAC,EAAE,MAAM,CAAC;QACV,CAAC,EAAE,MAAM,CAAC;QACV,CAAC,EAAE,MAAM,CAAC;QACV,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,QAAQ,EAAE,MAAM,CAAC;CAClB;AAOD,qBAAa,UAAU;IACrB,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,WAAW,CAA0D;IAC7E,OAAO,CAAC,SAAS,CAAS;IAE1B,OAAO;IAQP;;;OAGG;IACH,MAAM,CAAC,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,UAAU;IAkDxE;;OAEG;IACH,MAAM,CAAC,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,UAAU;IAenD;;OAEG;IACH,MAAM,CAAC,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;IAyBpE;;;OAGG;IACH,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;IAgClC,mCAAmC;IACnC,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAI3C,iCAAiC;IACjC,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM;IAI1D,kCAAkC;IAClC,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAI1C,qEAAqE;IACrE,eAAe,IAAI,MAAM;IAMzB;;;OAGG;IACH,OAAO,IAAI,IAAI;IAaf,WAAW,IAAI,OAAO;IAMtB,OAAO,CAAC,kBAAkB;IAM1B;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,cAAc;IAK7B;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,SAAS;CAUzB"}

package/dist/crypto/key-manager.js

@@ -0,0 +1,198 @@
+import fs from "node:fs";
+import path from "node:path";
+import { aesGcmEncrypt, aesGcmDecrypt, packAesGcm, unpackAesGcm, hkdfDerive, scryptDerive, generateRandomKey, zeroBuffer, } from "./primitives.js";
+const VERIFIER_PLAINTEXT = "beercan-key-verification-v1";
+const CONFIG_FILENAME = "crypto.json";
+const KEYFILE_FILENAME = "master.key";
+const MAX_LRU_SIZE = 200;
+export class KeyManager {
+    masterKey;
+    hkdfSalt;
+    subKeyCache = new Map();
+    destroyed = false;
+    constructor(masterKey, hkdfSalt) {
+        this.masterKey = masterKey;
+        // Use a fixed HKDF salt derived from the master key for deterministic sub-key derivation
+        this.hkdfSalt = hkdfSalt;
+    }
+    // ── Factory Methods ──────────────────────────────────────
+    /**
+     * Initialize from a passphrase. If crypto.json exists at configDir, uses stored salt.
+     * Otherwise creates a new config with fresh salt.
+     */
+    static fromPassphrase(passphrase, configDir) {
+        const configPath = path.join(configDir, CONFIG_FILENAME);
+        let config = null;
+        if (fs.existsSync(configPath)) {
+            config = JSON.parse(fs.readFileSync(configPath, "utf-8"));
+            if (config.mode !== "passphrase") {
+                throw new Error(`crypto.json specifies mode "${config.mode}", but passphrase was provided`);
+            }
+        }
+        let key;
+        if (config?.scrypt) {
+            // Re-derive with stored params
+            const salt = Buffer.from(config.scrypt.salt, "base64");
+            const result = scryptDerive(passphrase, salt);
+            key = result.key;
+            // Verify the passphrase is correct
+            if (!KeyManager.verifyKey(key, config.verifier)) {
+                zeroBuffer(key);
+                throw new Error("Invalid passphrase — key verification failed");
+            }
+        }
+        else {
+            // First-time setup: derive key and save config
+            const result = scryptDerive(passphrase);
+            key = result.key;
+            const verifier = KeyManager.createVerifier(key);
+            const newConfig = {
+                version: 1,
+                mode: "passphrase",
+                scrypt: {
+                    salt: result.params.salt.toString("base64"),
+                    N: result.params.N,
+                    r: result.params.r,
+                    p: result.params.p,
+                    keyLength: result.params.keyLength,
+                },
+                verifier,
+            };
+            fs.mkdirSync(configDir, { recursive: true });
+            fs.writeFileSync(configPath, JSON.stringify(newConfig, null, 2), { mode: 0o600 });
+        }
+        const hkdfSalt = hkdfDerive(key, Buffer.alloc(0), "beercan-hkdf-salt", 32);
+        return new KeyManager(key, hkdfSalt);
+    }
+    /**
+     * Initialize from a keyfile. If the file doesn't exist, throws.
+     */
+    static fromKeyfile(keyfilePath) {
+        if (!fs.existsSync(keyfilePath)) {
+            throw new Error(`Keyfile not found: ${keyfilePath}`);
+        }
+        const raw = fs.readFileSync(keyfilePath);
+        if (raw.length !== 32) {
+            throw new Error(`Keyfile must be exactly 32 bytes (256 bits), got ${raw.length}`);
+        }
+        const key = Buffer.from(raw);
+        const hkdfSalt = hkdfDerive(key, Buffer.alloc(0), "beercan-hkdf-salt", 32);
+        return new KeyManager(key, hkdfSalt);
+    }
+    /**
+     * Generate a new keyfile at the given path.
+     */
+    static generateKeyfile(keyfilePath, configDir) {
+        const key = generateRandomKey();
+        const dir = path.dirname(keyfilePath);
+        fs.mkdirSync(dir, { recursive: true });
+        fs.writeFileSync(keyfilePath, key, { mode: 0o600 });
+        // Also write crypto.json in keyfile mode
+        const verifier = KeyManager.createVerifier(key);
+        const config = {
+            version: 1,
+            mode: "keyfile",
+            verifier,
+        };
+        fs.mkdirSync(configDir, { recursive: true });
+        fs.writeFileSync(path.join(configDir, CONFIG_FILENAME), JSON.stringify(config, null, 2), { mode: 0o600 });
+        zeroBuffer(key);
+    }
+    // ── Key Derivation ───────────────────────────────────────
+    /**
+     * Derive a sub-key for a given context string.
+     * Uses LRU cache to avoid repeated HKDF calls.
+     */
+    deriveKey(context) {
+        this.ensureNotDestroyed();
+        const cached = this.subKeyCache.get(context);
+        if (cached) {
+            cached.accessedAt = Date.now();
+            return cached.key;
+        }
+        const derived = hkdfDerive(this.masterKey, this.hkdfSalt, context);
+        // Evict oldest entry if cache is full
+        if (this.subKeyCache.size >= MAX_LRU_SIZE) {
+            let oldestKey = "";
+            let oldestTime = Infinity;
+            for (const [k, v] of this.subKeyCache) {
+                if (v.accessedAt < oldestTime) {
+                    oldestTime = v.accessedAt;
+                    oldestKey = k;
+                }
+            }
+            if (oldestKey) {
+                const evicted = this.subKeyCache.get(oldestKey);
+                if (evicted)
+                    zeroBuffer(evicted.key);
+                this.subKeyCache.delete(oldestKey);
+            }
+        }
+        this.subKeyCache.set(context, { key: derived, accessedAt: Date.now() });
+        return derived;
+    }
+    /** Derive a project-scoped key. */
+    deriveProjectKey(projectId) {
+        return this.deriveKey(`beercan-project-${projectId}`);
+    }
+    /** Derive a bloop-scoped key. */
+    deriveBloopKey(projectId, bloopId) {
+        return this.deriveKey(`beercan-bloop-${projectId}-${bloopId}`);
+    }
+    /** Derive a memory-scoped key. */
+    deriveMemoryKey(projectId) {
+        return this.deriveKey(`beercan-memory-${projectId}`);
+    }
+    /** Derive the global key (for cross-project data like job queue). */
+    deriveGlobalKey() {
+        return this.deriveKey("beercan-global");
+    }
+    // ── Lifecycle ────────────────────────────────────────────
+    /**
+     * Securely destroy all key material. Call on shutdown.
+     * After calling, all encrypt/decrypt operations will throw.
+     */
+    destroy() {
+        if (this.destroyed)
+            return;
+        zeroBuffer(this.masterKey);
+        zeroBuffer(this.hkdfSalt);
+        for (const [, entry] of this.subKeyCache) {
+            zeroBuffer(entry.key);
+        }
+        this.subKeyCache.clear();
+        this.destroyed = true;
+    }
+    isDestroyed() {
+        return this.destroyed;
+    }
+    // ── Internal ─────────────────────────────────────────────
+    ensureNotDestroyed() {
+        if (this.destroyed) {
+            throw new Error("KeyManager has been destroyed — cannot derive keys");
+        }
+    }
+    /**
+     * Create a verifier string by encrypting a known plaintext with the key.
+     * Used to check if a passphrase is correct without storing the key.
+     */
+    static createVerifier(key) {
+        const result = aesGcmEncrypt(key, Buffer.from(VERIFIER_PLAINTEXT, "utf-8"));
+        return packAesGcm(result).toString("base64");
+    }
+    /**
+     * Verify that a key can decrypt the stored verifier.
+     */
+    static verifyKey(key, verifierBase64) {
+        try {
+            const packed = Buffer.from(verifierBase64, "base64");
+            const { iv, ciphertext, tag } = unpackAesGcm(packed);
+            const plaintext = aesGcmDecrypt(key, iv, ciphertext, tag);
+            return plaintext.toString("utf-8") === VERIFIER_PLAINTEXT;
+        }
+        catch {
+            return false;
+        }
+    }
+}
+//# sourceMappingURL=key-manager.js.map