bla-agents 0.0.0-stage → 1.5.3

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EACL,2BAA2B,GAE5B,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,qBAAqB,EACrB,kBAAkB,EAClB,2BAA2B,EAC3B,sBAAsB,EACtB,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAE1B,SAAS,SAAS;IAChB,OAAO,CAAC,GAAG,CAAC,GAAG,YAAY,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2C9B,CAAC,CAAC;AACH,CAAC;AAyBD,MAAM,UAAU,YAAY,CAAC,IAAuB;IAClD,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,IAAI,MAA0B,CAAC;IAC/B,IAAI,UAA8B,CAAC;IACnC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,SAAS,GAAwB,UAAU,CAAC;IAChD,IAAI,IAAwB,CAAC;IAC7B,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,IAAI,GAAyB,GAAG,CAAC;IACrC,MAAM,OAAO,GAA6B,EAAE,CAAC;IAC7C,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,SAA6B,CAAC;IAClC,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACrB,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YACrC,IAAI,GAAG,IAAI,CAAC;QACd,CAAC;aAAM,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;YAC/C,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;aAAM,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,IAAI,GAAG,IAAI,CAAC;QACd,CAAC;aAAM,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YAC7B,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;aAAM,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YAC3C,GAAG,GAAG,IAAI,CAAC;QACb,CAAC;aAAM,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;YAC/B,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;aAAM,IAAI,GAAG,KAAK,gBAAgB,EAAE,CAAC;YACpC,WAAW,GAAG,IAAI,CAAC;QACrB,CAAC;aAAM,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;YAChC,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;aAAM,IAAI,GAAG,KAAK,iBAAiB,EAAE,CAAC;YACrC,SAAS,GAAG,KAAK,CAAC;QACpB,CAAC;aAAM,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;YAChC,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;aAAM,IAAI,GAAG,KAAK,kBAAkB,EAAE,CAAC;YACtC,aAAa,GAAG,IAAI,CAAC;QACvB,CAAC;aAAM,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YAC3B,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;aAAM,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;YAC9B,OAAO,GAAG,QAAQ,CAAC;QACrB,CAAC;aAAM,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACvE,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAE,CAAC;QACtB,CAAC;aAAM,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACvE,UAAU,GAAG,IAAI,CAAC,EAAE,CAAC,CAAE,CAAC;QAC1B,CAAC;aAAM,IAAI,GAAG,KAAK,cAAc,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACzD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAE,CAAC,CAAC;YAC7B,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAAE,SAAS,GAAG,CAAC,CAAC;QACxC,CAAC;aAAM,IAAI,GAAG,KAAK,aAAa,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACxD,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,CAAyB,CAAC;YAC9C,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjE,SAAS,GAAG,GAAG,CAAC;YAClB,CAAC;QACH,CAAC;aAAM,IAAI,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACnD,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAE,CAAC;QACpB,CAAC;aAAM,IAAI,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACnD,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,CAA0B,CAAC;YAC/C,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtC,IAAI,GAAG,GAAG,CAAC;YACb,CAAC;QACH,CAAC;aAAM,IAAI,GAAG,KAAK,UAAU,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACrD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAA4B,CAAC,CAAC;QACrD,CAAC;aAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC,OAAO;gBAAE,OAAO,GAAG,GAAG,CAAC;;gBACvB,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO;QACP,WAAW;QACX,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,OAAO;QACP,SAAS;QACT,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,QAAQ;QACR,aAAa;QACb,IAAI;QACJ,OAAO;QACP,WAAW;QACX,MAAM;QACN,GAAG;QACH,IAAI;QACJ,KAAK;QACL,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,SAAS;QACT,IAAI;QACJ,OAAO;KACR,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAA0B,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAElC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAClC,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;QAC7B,mBAAmB,EAAE,CAAC;QACtB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACnC,SAAS,EAAE,CAAC;QACZ,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,CAAC;QACH,QAAQ,MAAM,CAAC,OAAO,EAAE,CAAC;YACvB,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,MAAM,GAAG,GAAG,QAAQ,CAAC;oBACnB,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnE,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,GAAG,EAAE,MAAM,CAAC,GAAG;iBAChB,CAAC,CAAC;gBACH,IAAI,MAAM,CAAC,IAAI;oBAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;;oBACtD,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;gBACzC,OAAO,CAAC,CAAC;YACX,CAAC;YAED,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;gBACxB,IAAI,MAAM,CAAC,IAAI;oBAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;;oBACtD,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC1C,OAAO,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7B,CAAC;YAED,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,UAAU,GAAG;oBACjB,cAAc,EAAE,YAAY,CAAC,OAAO;oBACpC,OAAO,EAAE,YAAY,CAAC,WAAW;oBACjC,YAAY,EAAE,YAAY,CAAC,YAAY;oBACvC,mBAAmB,EAAE,6BAA6B;oBAClD,mBAAmB,EAAE,wCAAwC;iBAC9D,CAAC;gBACF,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;oBAChB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBACnD,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,GAAG,CAAC,GAAG,YAAY,EAAE,YAAY,YAAY,CAAC,OAAO,4IAA4I,CAAC,CAAC;gBAC7M,CAAC;gBACD,OAAO,CAAC,CAAC;YACX,CAAC;YAED,KAAK,WAAW,CAAC,CAAC,CAAC;gBACjB,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;gBAC3B,IAAI,MAAM,CAAC,IAAI;oBAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;;oBACtD,OAAO,CAAC,GAAG,CAAC,kCAAkC,GAAG,CAAC,cAAc,CAAC,MAAM,aAAa,CAAC,CAAC;gBAC3F,OAAO,CAAC,CAAC;YACX,CAAC;YAED,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;gBACnD,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC/C,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;oBAChB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC5C,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,GAAG,CACT,GAAG,CAAC,OAAO;wBACT,CAAC,CAAC,WAAW,GAAG,CAAC,UAAU,qBAAqB,GAAG,CAAC,MAAM,CAAC,KAAK,kBAAkB,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK;wBAC3G,CAAC,CAAC,4BAA4B,GAAG,CAAC,UAAU,iCAAiC,CAChF,CAAC;gBACJ,CAAC;gBACD,OAAO,CAAC,CAAC;YACX,CAAC;YAED,KAAK,iBAAiB,CAAC,CAAC,CAAC;gBACvB,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;gBACrC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,CAAC,KAAK,CAAC,kEAAkE,CAAC,CAAC;oBAClF,OAAO,CAAC,CAAC;gBACX,CAAC;gBACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;gBAC9C,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC7C,OAAO,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9C,CAAC;YAED,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;gBAC/D,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;gBAChF,MAAM,iBAAiB,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC;oBACpD,CAAC,CAAC,MAAM,CAAC,SAAS;oBAClB,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,IAAI,UAAU,CAAC,CAAC;gBAC5C,MAAM,QAAQ,GAAG,kBAAkB,CACjC,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EACzD,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,UAAU,CAClB,CAAC;gBACF,MAAM,MAAM,GAAG,aAAa,CAAC;oBAC3B,SAAS;oBACT,SAAS,EAAE,iBAAiB;oBAC5B,IAAI,EAAE,QAAQ,CAAC,IAAI;oBACnB,YAAY,EAAE,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,KAAK,IAAI;oBACpE,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,MAAM,CAAC,aAAa,KAAK,IAAI;oBAC3E,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC3E,CAAC,CAAC;gBACH,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;oBAChB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC/C,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAC;gBACjD,CAAC;gBACD,OAAO,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,eAAe,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5G,CAAC;YAED,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;gBAC/D,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC5D,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC;oBACzE,OAAO,CAAC,CAAC;gBACX,CAAC;gBACD,MAAM,iBAAiB,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC;oBACpD,CAAC,CAAC,MAAM,CAAC,SAAS;oBAClB,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,IAAI,UAAU,CAAC,CAAC;gBAC5C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;gBACnF,MAAM,MAAM,GAAG,YAAY,CAAC;oBAC1B,SAAS,EAAE,MAAM;oBACjB,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,SAAS;wBACvD,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAE,EAAE;wBAC1D,CAAC,CAAC,EAAE,CAAC;oBACP,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,SAAS,EAAE,iBAAiB;oBAC5B,IAAI,EAAE,QAAQ,CAAC,IAAI;oBACnB,YAAY,EAAE,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,KAAK,IAAI;oBACpE,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,MAAM,CAAC,aAAa,KAAK,IAAI;iBAC5E,CAAC,CAAC;gBACH,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;oBACjB,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CACtF,CAAC;gBACJ,CAAC;qBAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;oBACvB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC/C,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,MAAM,CAAC,CAAC,CAAC;gBACnD,CAAC;gBACD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC;gBACpE,IAAI,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,YAAY,CAAC,YAAY,GAAG,SAAS,EAAE,CAAC;oBAC5E,OAAO,CAAC,CAAC;gBACX,CAAC;gBACD,OAAO,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACvC,CAAC;YAED,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;gBAC/D,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC5D,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;oBACxE,OAAO,CAAC,CAAC;gBACX,CAAC;gBACD,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;gBACnC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;oBACjB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBACjE,CAAC;qBAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;oBACvB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC/C,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;gBACzC,CAAC;gBACD,OAAO,CAAC,CAAC;YACX,CAAC;YAED,KAAK,SAAS,CAAC,CAAC,CAAC;gBACf,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;gBAC/D,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC5D,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,CAAC,KAAK,CAAC,0DAA0D,CAAC,CAAC;oBAC1E,OAAO,CAAC,CAAC;gBACX,CAAC;gBACD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;gBACnF,MAAM,GAAG,GAAG,aAAa,CAAC;oBACxB,SAAS,EAAE,MAAM;oBACjB,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,SAAS;wBACvD,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAE,EAAE;wBAC1D,CAAC,CAAC,EAAE,CAAC;oBACP,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC;wBACrC,CAAC,CAAC,MAAM,CAAC,SAAS;wBAClB,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC;oBACjD,IAAI,EAAE,QAAQ,CAAC,IAAI;oBACnB,eAAe,EAAE,MAAM,CAAC,SAAS;oBACjC,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,MAAM,CAAC,aAAa,KAAK,IAAI;iBAC5E,CAAC,CAAC;gBACH,IAAI,MAAM,CAAC,IAAI;oBAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;;oBACtD,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC9C,OAAO,CAAC,CAAC;YACX,CAAC;YAED,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;gBACrC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,CAAC,KAAK,CAAC,oEAAoE,CAAC,CAAC;oBACpF,OAAO,CAAC,CAAC;gBACX,CAAC;gBACD,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC3D,IAAI,MAAM,CAAC,IAAI;oBAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;;oBACzD,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;gBACnD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,YAAY,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;oBAC7E,OAAO,CAAC,CAAC;gBACX,CAAC;gBACD,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACtC,CAAC;YAED,KAAK,WAAW,CAAC,CAAC,CAAC;gBACjB,MAAM,KAAK,GAAG,MAAM,oBAAoB,EAAE,CAAC;gBAC3C,IAAI,MAAM,CAAC,IAAI;oBAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;;oBACxD,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC/C,OAAO,CAAC,CAAC;YACX,CAAC;YAED,KAAK,cAAc,CAAC,CAAC,CAAC;gBACpB,MAAM,OAAO,GAAG,2BAA2B,CAAC,MAAM,CAAC,IAAI,EAAE;oBACvD,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC5D,CAAC,CAAC;gBACH,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;oBAClB,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;oBACvC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;oBAChD,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;wBAChB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;oBAC5E,CAAC;yBAAM,CAAC;wBACN,OAAO,CAAC,GAAG,CAAC,WAAW,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,sBAAsB,OAAO,KAAK,OAAO,CAAC,mBAAmB,2BAA2B,CAAC,CAAC;oBACjJ,CAAC;gBACH,CAAC;qBAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;oBACvB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBAChD,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBAC/B,CAAC;gBACD,OAAO,CAAC,CAAC;YACX,CAAC;YAED;gBACE,OAAO,CAAC,KAAK,CAAC,oBAAoB,MAAM,CAAC,OAAO,4CAA4C,CAAC,CAAC;gBAC9F,OAAO,CAAC,CAAC;QACb,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5E,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,4BAA4B;AAC5B,MAAM,iBAAiB,GACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;IAC7B,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACjC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;AAE5C,IAAI,iBAAiB,EAAE,CAAC;IACtB,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QACrB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACjE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;QAC1B,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/core/config.d.ts

@@ -0,0 +1,54 @@
+import type { ProtectionIntensity } from "./types.js";
+export interface BlaProjectConfig {
+    readonly $schema?: string;
+    readonly input?: string;
+    readonly output?: string;
+    readonly intensity?: ProtectionIntensity;
+    /** Per-project PRNG seed. Prefer a random value persisted in `.blarc` — never a shared fixed fingerprint. */
+    readonly seed?: string;
+    /** When true, write `.bla-manifest.json` next to protected artifacts. Default false (opt-in via `--manifest`). */
+    readonly emitManifest?: boolean;
+    /** Opt-in risky LLM directive layers (COPPA/medical bait, dual-use imitation, AI chat markers). Default false. */
+    readonly llmDirectives?: boolean;
+    readonly honeySourceMaps?: boolean;
+    readonly minDefenseScore?: number;
+}
+/**
+ * Starter defaults written by `initBlaConfig`.
+ * `seed` is filled at init/resolve time with a per-project random value — never a global constant.
+ * `emitManifest` defaults to false so customer artifacts are not accompanied by attestation JSON unless requested.
+ */
+export declare const DEFAULT_BLA_CONFIG: BlaProjectConfig;
+/** Legacy fixed seeds that fingerprint every project the same way — never reuse as a default. */
+export declare const LEGACY_FIXED_SEEDS: ReadonlySet<string>;
+export declare function generateProjectSeed(): string;
+/**
+ * Loads `bla.config.json`, `.blarc.json`, `.blarc`, or the `"bla"` field from `package.json`
+ * in `cwd` (or an explicit config file path).
+ */
+export declare function loadBlaConfig(cwd?: string, explicitConfigPath?: string): {
+    config: BlaProjectConfig;
+    sourcePath: string | null;
+};
+/**
+ * Resolves the PRNG seed for a project:
+ * 1. Explicit CLI/`--seed` / caller override
+ * 2. Non-legacy seed already stored in project config
+ * 3. Otherwise mint a random per-project seed and persist it to `.blarc` (or update the existing config file)
+ *
+ * This kills the shared `bla-shield-seed-v1` / `bla-project-seed-v1` fingerprint across unrelated projects.
+ */
+export declare function resolveProjectSeed(cwd?: string, explicitSeed?: string | number, explicitConfigPath?: string): {
+    seed: string;
+    sourcePath: string | null;
+    persisted: boolean;
+};
+/**
+ * Writes a starter `bla.config.json` in `targetDir` with a fresh per-project random seed.
+ */
+export declare function initBlaConfig(targetDir?: string, overwrite?: boolean): {
+    configPath: string;
+    created: boolean;
+    config: BlaProjectConfig;
+};
+//# sourceMappingURL=config.d.ts.map

package/dist/core/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/core/config.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,mBAAmB,CAAC;IACzC,6GAA6G;IAC7G,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,kHAAkH;IAClH,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,kHAAkH;IAClH,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,EAAE,gBAQ/B,CAAC;AAEH,iGAAiG;AACjG,eAAO,MAAM,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAIjD,CAAC;AAIH,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAMD;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,GAAG,GAAE,MAAsB,EAC3B,kBAAkB,CAAC,EAAE,MAAM,GAC1B;IAAE,MAAM,EAAE,gBAAgB,CAAC;IAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAmDzD;AAWD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,GAAE,MAAsB,EAC3B,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,EAC9B,kBAAkB,CAAC,EAAE,MAAM,GAC1B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CA2BjE;AAED;;GAEG;AACH,wBAAgB,aAAa,CAC3B,SAAS,GAAE,MAAsB,EACjC,SAAS,UAAQ,GAChB;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,CA+BpE"}

package/dist/core/config.js

@@ -0,0 +1,160 @@
+import { randomBytes } from "node:crypto";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+/**
+ * Starter defaults written by `initBlaConfig`.
+ * `seed` is filled at init/resolve time with a per-project random value — never a global constant.
+ * `emitManifest` defaults to false so customer artifacts are not accompanied by attestation JSON unless requested.
+ */
+export const DEFAULT_BLA_CONFIG = Object.freeze({
+    $schema: "https://bla.tools/schemas/bla.config.v1.json",
+    input: "./dist",
+    intensity: "bankrupt",
+    emitManifest: false,
+    llmDirectives: false,
+    honeySourceMaps: true,
+    minDefenseScore: 90,
+});
+/** Legacy fixed seeds that fingerprint every project the same way — never reuse as a default. */
+export const LEGACY_FIXED_SEEDS = new Set([
+    "bla-project-seed-v1",
+    "bla-shield-seed-v1",
+    "bla-js-shield-v1",
+]);
+const CONFIG_FILENAMES = ["bla.config.json", ".blarc.json", ".blarc"];
+export function generateProjectSeed() {
+    return `bla-${randomBytes(16).toString("hex")}`;
+}
+function isUsableSeed(seed) {
+    return typeof seed === "string" && seed.length > 0 && !LEGACY_FIXED_SEEDS.has(seed);
+}
+/**
+ * Loads `bla.config.json`, `.blarc.json`, `.blarc`, or the `"bla"` field from `package.json`
+ * in `cwd` (or an explicit config file path).
+ */
+export function loadBlaConfig(cwd = process.cwd(), explicitConfigPath) {
+    const root = resolve(cwd);
+    if (explicitConfigPath) {
+        const absExplicit = resolve(root, explicitConfigPath);
+        if (!existsSync(absExplicit)) {
+            throw new Error(`BLA config file not found: ${absExplicit}`);
+        }
+        const parsed = JSON.parse(readFileSync(absExplicit, "utf8"));
+        return {
+            config: { ...DEFAULT_BLA_CONFIG, ...parsed },
+            sourcePath: absExplicit,
+        };
+    }
+    for (const name of CONFIG_FILENAMES) {
+        const candidate = join(root, name);
+        if (existsSync(candidate)) {
+            try {
+                const parsed = JSON.parse(readFileSync(candidate, "utf8"));
+                return {
+                    config: { ...DEFAULT_BLA_CONFIG, ...parsed },
+                    sourcePath: candidate,
+                };
+            }
+            catch {
+                // ignore malformed optional config
+            }
+        }
+    }
+    const pkgPath = join(root, "package.json");
+    if (existsSync(pkgPath)) {
+        try {
+            const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+            if (pkg.bla && typeof pkg.bla === "object") {
+                return {
+                    config: { ...DEFAULT_BLA_CONFIG, ...pkg.bla },
+                    sourcePath: pkgPath,
+                };
+            }
+        }
+        catch {
+            // ignore
+        }
+    }
+    return {
+        config: { ...DEFAULT_BLA_CONFIG },
+        sourcePath: null,
+    };
+}
+function persistSeed(targetPath, seed, existing) {
+    const next = {
+        ...DEFAULT_BLA_CONFIG,
+        ...existing,
+        seed,
+    };
+    writeFileSync(targetPath, JSON.stringify(next, null, 2) + "\n", "utf8");
+}
+/**
+ * Resolves the PRNG seed for a project:
+ * 1. Explicit CLI/`--seed` / caller override
+ * 2. Non-legacy seed already stored in project config
+ * 3. Otherwise mint a random per-project seed and persist it to `.blarc` (or update the existing config file)
+ *
+ * This kills the shared `bla-shield-seed-v1` / `bla-project-seed-v1` fingerprint across unrelated projects.
+ */
+export function resolveProjectSeed(cwd = process.cwd(), explicitSeed, explicitConfigPath) {
+    if (explicitSeed !== undefined && explicitSeed !== null && String(explicitSeed).length > 0) {
+        const seed = String(explicitSeed);
+        if (!LEGACY_FIXED_SEEDS.has(seed)) {
+            return { seed, sourcePath: null, persisted: false };
+        }
+        // Explicit legacy string: honor it (power users / tests) but do not persist as a "fresh" project seed.
+        return { seed, sourcePath: null, persisted: false };
+    }
+    const loaded = loadBlaConfig(cwd, explicitConfigPath);
+    if (isUsableSeed(loaded.config.seed)) {
+        return { seed: loaded.config.seed, sourcePath: loaded.sourcePath, persisted: false };
+    }
+    const seed = generateProjectSeed();
+    const root = resolve(cwd);
+    let targetPath;
+    if (loaded.sourcePath && !loaded.sourcePath.endsWith("package.json")) {
+        targetPath = loaded.sourcePath;
+        const existing = JSON.parse(readFileSync(targetPath, "utf8"));
+        persistSeed(targetPath, seed, existing);
+    }
+    else {
+        targetPath = join(root, ".blarc");
+        persistSeed(targetPath, seed, loaded.config);
+    }
+    return { seed, sourcePath: targetPath, persisted: true };
+}
+/**
+ * Writes a starter `bla.config.json` in `targetDir` with a fresh per-project random seed.
+ */
+export function initBlaConfig(targetDir = process.cwd(), overwrite = false) {
+    const configPath = join(resolve(targetDir), "bla.config.json");
+    if (existsSync(configPath) && !overwrite) {
+        const existing = JSON.parse(readFileSync(configPath, "utf8"));
+        const merged = { ...DEFAULT_BLA_CONFIG, ...existing };
+        if (!isUsableSeed(merged.seed)) {
+            const seed = generateProjectSeed();
+            persistSeed(configPath, seed, existing);
+            return {
+                configPath,
+                created: false,
+                config: { ...merged, seed },
+            };
+        }
+        return {
+            configPath,
+            created: false,
+            config: merged,
+        };
+    }
+    const config = {
+        ...DEFAULT_BLA_CONFIG,
+        seed: generateProjectSeed(),
+    };
+    writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n", "utf8");
+    return {
+        configPath,
+        created: true,
+        config,
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/core/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/core/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAkB1C;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAqB,MAAM,CAAC,MAAM,CAAC;IAChE,OAAO,EAAE,8CAA8C;IACvD,KAAK,EAAE,QAAQ;IACf,SAAS,EAAE,UAAU;IACrB,YAAY,EAAE,KAAK;IACnB,aAAa,EAAE,KAAK;IACpB,eAAe,EAAE,IAAI;IACrB,eAAe,EAAE,EAAE;CACpB,CAAC,CAAC;AAEH,iGAAiG;AACjG,MAAM,CAAC,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC;IAC7D,qBAAqB;IACrB,oBAAoB;IACpB,kBAAkB;CACnB,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,CAAC,iBAAiB,EAAE,aAAa,EAAE,QAAQ,CAAU,CAAC;AAE/E,MAAM,UAAU,mBAAmB;IACjC,OAAO,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,YAAY,CAAC,IAAa;IACjC,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACtF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAc,OAAO,CAAC,GAAG,EAAE,EAC3B,kBAA2B;IAE3B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAE1B,IAAI,kBAAkB,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;QACtD,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,8BAA8B,WAAW,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAqB,CAAC;QACjF,OAAO;YACL,MAAM,EAAE,EAAE,GAAG,kBAAkB,EAAE,GAAG,MAAM,EAAE;YAC5C,UAAU,EAAE,WAAW;SACxB,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAqB,CAAC;gBAC/E,OAAO;oBACL,MAAM,EAAE,EAAE,GAAG,kBAAkB,EAAE,GAAG,MAAM,EAAE;oBAC5C,UAAU,EAAE,SAAS;iBACtB,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,mCAAmC;YACrC,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC3C,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAEnD,CAAC;YACF,IAAI,GAAG,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC3C,OAAO;oBACL,MAAM,EAAE,EAAE,GAAG,kBAAkB,EAAE,GAAG,GAAG,CAAC,GAAG,EAAE;oBAC7C,UAAU,EAAE,OAAO;iBACpB,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM,EAAE,EAAE,GAAG,kBAAkB,EAAE;QACjC,UAAU,EAAE,IAAI;KACjB,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,UAAkB,EAAE,IAAY,EAAE,QAA0B;IAC/E,MAAM,IAAI,GAAqB;QAC7B,GAAG,kBAAkB;QACrB,GAAG,QAAQ;QACX,IAAI;KACL,CAAC;IACF,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAc,OAAO,CAAC,GAAG,EAAE,EAC3B,YAA8B,EAC9B,kBAA2B;IAE3B,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,IAAI,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3F,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;QAClC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QACtD,CAAC;QACD,uGAAuG;QACvG,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACtD,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACtD,IAAI,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACvF,CAAC;IAED,MAAM,IAAI,GAAG,mBAAmB,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,UAAkB,CAAC;IACvB,IAAI,MAAM,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACrE,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAqB,CAAC;QAClF,WAAW,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC1C,CAAC;SAAM,CAAC;QACN,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAClC,WAAW,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC3D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAC3B,YAAoB,OAAO,CAAC,GAAG,EAAE,EACjC,SAAS,GAAG,KAAK;IAEjB,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAC,CAAC;IAC/D,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAqB,CAAC;QAClF,MAAM,MAAM,GAAG,EAAE,GAAG,kBAAkB,EAAE,GAAG,QAAQ,EAAE,CAAC;QACtD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,mBAAmB,EAAE,CAAC;YACnC,WAAW,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;YACxC,OAAO;gBACL,UAAU;gBACV,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE;aAC5B,CAAC;QACJ,CAAC;QACD,OAAO;YACL,UAAU;YACV,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,MAAM;SACf,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAqB;QAC/B,GAAG,kBAAkB;QACrB,IAAI,EAAE,mBAAmB,EAAE;KAC5B,CAAC;IACF,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1E,OAAO;QACL,UAAU;QACV,OAAO,EAAE,IAAI;QACb,MAAM;KACP,CAAC;AACJ,CAAC"}

package/dist/core/coverage-contract.d.ts

@@ -0,0 +1,97 @@
+export type ClientArtifactCoverageStatus = "assessed-static-and-heuristic-cost-amplification" | "not-protected";
+export type ServerAuthorizationCoverageStatus = "not-assessed/external-control-required" | "verified-local-reference-fixture";
+export interface ThreatPremiseBoundary {
+    readonly id: "authenticated-low-privilege-session" | "controlled-client-same-origin-fetch" | "authorized-user-response-observation";
+    readonly coveredByClientArtifactShield: false;
+    readonly authoritativeControlLocation: "server-side-application";
+    readonly explanation: string;
+}
+export interface DefenseCoverageContract {
+    readonly clientArtifact: {
+        readonly status: ClientArtifactCoverageStatus;
+        readonly scope: "static-reverse-engineering-and-automated-inspection-friction";
+        readonly guaranteesConfidentialityOfShippedData: false;
+        readonly enforcesAccessControl: false;
+    };
+    readonly serverAuthorization: {
+        readonly status: ServerAuthorizationCoverageStatus;
+        readonly responsibility: "external-application-backend";
+        readonly summary: string;
+    };
+    readonly threatPremises: readonly ThreatPremiseBoundary[];
+}
+export declare function buildDefenseCoverageContract(options?: {
+    readonly clientProtected?: boolean;
+    readonly localServerFixtureVerified?: boolean;
+}): DefenseCoverageContract;
+export type SyntheticRole = "viewer" | "admin";
+export interface SyntheticSessionRecord {
+    readonly sessionId: string;
+    readonly userId: string;
+    readonly tenantId: string;
+    readonly role: SyntheticRole;
+    readonly csrfToken: string;
+    readonly expiresAtMs: number;
+    revoked: boolean;
+}
+export interface InternalTenantDocumentRecord {
+    readonly docId: string;
+    readonly tenantId: string;
+    title: string;
+    quotaLimit: number;
+    /** Sensitive backend-only field that must NEVER be serialized to client responses. */
+    readonly internalSigningKeyMaterial: string;
+    readonly internalBillingWebhookSecret: string;
+}
+export interface MinimizedClientDocumentDto {
+    readonly docId: string;
+    readonly tenantId: string;
+    readonly title: string;
+    readonly quotaLimit: number;
+}
+export interface SyntheticHttpRequest {
+    readonly method: "GET" | "POST";
+    readonly path: string;
+    readonly origin: string;
+    readonly sessionId?: string;
+    readonly csrfToken?: string;
+    readonly requestNonce?: string;
+    readonly body?: Record<string, unknown>;
+}
+export interface SyntheticHttpResponse<T = unknown> {
+    readonly status: number;
+    readonly ok: boolean;
+    readonly errorCode?: "UNAUTHENTICATED" | "SESSION_EXPIRED_OR_REVOKED" | "CROSS_ORIGIN_REJECTED" | "CSRF_OR_REPLAY_REJECTED" | "FORBIDDEN_TENANT_OR_ROLE" | "NOT_FOUND";
+    readonly data?: T;
+}
+/**
+ * Small self-contained local reference service demonstrating authoritative server-side
+ * session verification, tenant/object isolation, CSRF + replay protection, and
+ * response data minimization (Issue #20).
+ */
+export declare class ReferenceTenantAuthorizationService {
+    private readonly allowedOrigin;
+    private readonly sessions;
+    private readonly documents;
+    private readonly consumedNonces;
+    private nowFn;
+    constructor(options?: {
+        allowedOrigin?: string;
+        nowFn?: () => number;
+    });
+    issueSession(params: {
+        readonly userId: string;
+        readonly tenantId: string;
+        readonly role: SyntheticRole;
+        readonly ttlMs?: number;
+    }): SyntheticSessionRecord;
+    revokeSession(sessionId: string): boolean;
+    seedDocument(doc: InternalTenantDocumentRecord): void;
+    snapshotDocumentState(docId: string): {
+        title: string;
+        quotaLimit: number;
+    } | undefined;
+    private minimizeDocument;
+    handleRequest(req: SyntheticHttpRequest): SyntheticHttpResponse;
+}
+//# sourceMappingURL=coverage-contract.d.ts.map

package/dist/core/coverage-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"coverage-contract.d.ts","sourceRoot":"","sources":["../../src/core/coverage-contract.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,4BAA4B,GACpC,kDAAkD,GAClD,eAAe,CAAC;AAEpB,MAAM,MAAM,iCAAiC,GACzC,wCAAwC,GACxC,kCAAkC,CAAC;AAEvC,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,EACP,qCAAqC,GACrC,qCAAqC,GACrC,sCAAsC,CAAC;IAC3C,QAAQ,CAAC,6BAA6B,EAAE,KAAK,CAAC;IAC9C,QAAQ,CAAC,4BAA4B,EAAE,yBAAyB,CAAC;IACjE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,cAAc,EAAE;QACvB,QAAQ,CAAC,MAAM,EAAE,4BAA4B,CAAC;QAC9C,QAAQ,CAAC,KAAK,EAAE,8DAA8D,CAAC;QAC/E,QAAQ,CAAC,sCAAsC,EAAE,KAAK,CAAC;QACvD,QAAQ,CAAC,qBAAqB,EAAE,KAAK,CAAC;KACvC,CAAC;IACF,QAAQ,CAAC,mBAAmB,EAAE;QAC5B,QAAQ,CAAC,MAAM,EAAE,iCAAiC,CAAC;QACnD,QAAQ,CAAC,cAAc,EAAE,8BAA8B,CAAC;QACxD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF,QAAQ,CAAC,cAAc,EAAE,SAAS,qBAAqB,EAAE,CAAC;CAC3D;AAED,wBAAgB,4BAA4B,CAAC,OAAO,CAAC,EAAE;IACrD,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,0BAA0B,CAAC,EAAE,OAAO,CAAC;CAC/C,GAAG,uBAAuB,CA8C1B;AAMD,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE/C,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,sFAAsF;IACtF,QAAQ,CAAC,0BAA0B,EAAE,MAAM,CAAC;IAC5C,QAAQ,CAAC,4BAA4B,EAAE,MAAM,CAAC;CAC/C;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,qBAAqB,CAAC,CAAC,GAAG,OAAO;IAChD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,SAAS,CAAC,EACf,iBAAiB,GACjB,4BAA4B,GAC5B,uBAAuB,GACvB,yBAAyB,GACzB,0BAA0B,GAC1B,WAAW,CAAC;IAChB,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;CACnB;AAED;;;;GAIG;AACH,qBAAa,mCAAmC;IAC9C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6C;IACtE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmD;IAC7E,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqB;IACpD,OAAO,CAAC,KAAK,CAAe;gBAEhB,OAAO,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;KAAE;IAK/D,YAAY,CAAC,MAAM,EAAE;QAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;QAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;KACzB,GAAG,sBAAsB;IAgBnB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAOzC,YAAY,CAAC,GAAG,EAAE,4BAA4B,GAAG,IAAI;IAIrD,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS;IAM9F,OAAO,CAAC,gBAAgB;IAUjB,aAAa,CAAC,GAAG,EAAE,oBAAoB,GAAG,qBAAqB;CA0EvE"}

package/dist/core/coverage-contract.js

@@ -0,0 +1,164 @@
+import { createHash, randomBytes } from "node:crypto";
+export function buildDefenseCoverageContract(options) {
+    const clientProtected = options?.clientProtected ?? true;
+    const serverVerified = options?.localServerFixtureVerified ?? false;
+    return {
+        clientArtifact: {
+            status: clientProtected
+                ? "assessed-static-and-heuristic-cost-amplification"
+                : "not-protected",
+            scope: "static-reverse-engineering-and-automated-inspection-friction",
+            guaranteesConfidentialityOfShippedData: false,
+            enforcesAccessControl: false,
+        },
+        serverAuthorization: {
+            status: serverVerified
+                ? "verified-local-reference-fixture"
+                : "not-assessed/external-control-required",
+            responsibility: "external-application-backend",
+            summary: serverVerified
+                ? "Verified against local synthetic multi-tenant reference fixture only; production backends must enforce per-request identity, object/tenant authorization, session revocation, and response data minimization independently."
+                : "Server-side authentication, object/tenant authorization, session invalidation, and CSRF/replay controls are outside BLA client-artifact scope and must be enforced by the backend service.",
+        },
+        threatPremises: [
+            {
+                id: "authenticated-low-privilege-session",
+                coveredByClientArtifactShield: false,
+                authoritativeControlLocation: "server-side-application",
+                explanation: "An active browser scenario (e.g., Playwright same-origin fetch) can reuse an existing low-privilege session cookie/token. Hiding UI buttons or obfuscating client bundles does not prevent direct API requests; the server must authorize every request against the session's tenant and role.",
+            },
+            {
+                id: "controlled-client-same-origin-fetch",
+                coveredByClientArtifactShield: false,
+                authoritativeControlLocation: "server-side-application",
+                explanation: "BLA runtime globals and AST shields execute inside the untrusted client context and carry no server identity or resource authorization authority.",
+            },
+            {
+                id: "authorized-user-response-observation",
+                coveredByClientArtifactShield: false,
+                authoritativeControlLocation: "server-side-application",
+                explanation: "BLA cannot prevent a user from recording network responses or data that their session is legitimately permitted to receive. Sensitive fields that the client does not strictly need must be omitted by the server before serialization (data minimization).",
+            },
+        ],
+    };
+}
+/**
+ * Small self-contained local reference service demonstrating authoritative server-side
+ * session verification, tenant/object isolation, CSRF + replay protection, and
+ * response data minimization (Issue #20).
+ */
+export class ReferenceTenantAuthorizationService {
+    allowedOrigin;
+    sessions = new Map();
+    documents = new Map();
+    consumedNonces = new Set();
+    nowFn;
+    constructor(options) {
+        this.allowedOrigin = options?.allowedOrigin ?? "https://app.local.fixture";
+        this.nowFn = options?.nowFn ?? (() => Date.now());
+    }
+    issueSession(params) {
+        const sessionId = `sess_${randomBytes(12).toString("hex")}`;
+        const csrfToken = `csrf_${randomBytes(12).toString("hex")}`;
+        const record = {
+            sessionId,
+            userId: params.userId,
+            tenantId: params.tenantId,
+            role: params.role,
+            csrfToken,
+            expiresAtMs: this.nowFn() + (params.ttlMs ?? 60_000),
+            revoked: false,
+        };
+        this.sessions.set(sessionId, record);
+        return record;
+    }
+    revokeSession(sessionId) {
+        const sess = this.sessions.get(sessionId);
+        if (!sess)
+            return false;
+        sess.revoked = true;
+        return true;
+    }
+    seedDocument(doc) {
+        this.documents.set(doc.docId, { ...doc });
+    }
+    snapshotDocumentState(docId) {
+        const doc = this.documents.get(docId);
+        if (!doc)
+            return undefined;
+        return { title: doc.title, quotaLimit: doc.quotaLimit };
+    }
+    minimizeDocument(doc) {
+        // Data minimization: never include internalSigningKeyMaterial or internalBillingWebhookSecret
+        return {
+            docId: doc.docId,
+            tenantId: doc.tenantId,
+            title: doc.title,
+            quotaLimit: doc.quotaLimit,
+        };
+    }
+    handleRequest(req) {
+        // 1. Validate session existence and active status on every request
+        if (!req.sessionId) {
+            return { status: 401, ok: false, errorCode: "UNAUTHENTICATED" };
+        }
+        const session = this.sessions.get(req.sessionId);
+        if (!session || session.revoked || this.nowFn() >= session.expiresAtMs) {
+            return { status: 401, ok: false, errorCode: "SESSION_EXPIRED_OR_REVOKED" };
+        }
+        // 2. Parse route `/api/tenants/:tenantId/documents/:docId`
+        const match = /^\/api\/tenants\/([^/]+)\/documents\/([^/]+)$/.exec(req.path);
+        if (!match) {
+            return { status: 404, ok: false, errorCode: "NOT_FOUND" };
+        }
+        const [, requestedTenantId, requestedDocId] = match;
+        // 3. Enforce tenant boundary before inspecting or mutating any object
+        if (requestedTenantId !== session.tenantId) {
+            return { status: 403, ok: false, errorCode: "FORBIDDEN_TENANT_OR_ROLE" };
+        }
+        const doc = this.documents.get(requestedDocId);
+        if (!doc || doc.tenantId !== session.tenantId) {
+            return { status: 403, ok: false, errorCode: "FORBIDDEN_TENANT_OR_ROLE" };
+        }
+        if (req.method === "GET") {
+            return {
+                status: 200,
+                ok: true,
+                data: this.minimizeDocument(doc),
+            };
+        }
+        // 4. State-changing request (POST): enforce origin, CSRF token, replay nonce, and role
+        if (req.origin !== this.allowedOrigin) {
+            return { status: 403, ok: false, errorCode: "CROSS_ORIGIN_REJECTED" };
+        }
+        if (!req.csrfToken ||
+            req.csrfToken !== session.csrfToken ||
+            !req.requestNonce ||
+            req.requestNonce.trim().length < 8) {
+            return { status: 403, ok: false, errorCode: "CSRF_OR_REPLAY_REJECTED" };
+        }
+        const nonceKey = createHash("sha256")
+            .update(`${session.sessionId}:${req.requestNonce}`)
+            .digest("hex");
+        if (this.consumedNonces.has(nonceKey)) {
+            return { status: 403, ok: false, errorCode: "CSRF_OR_REPLAY_REJECTED" };
+        }
+        // Role check MUST happen before committing any state or consuming business state
+        if (session.role !== "admin") {
+            return { status: 403, ok: false, errorCode: "FORBIDDEN_TENANT_OR_ROLE" };
+        }
+        this.consumedNonces.add(nonceKey);
+        if (typeof req.body?.title === "string" && req.body.title.trim().length > 0) {
+            doc.title = req.body.title.trim();
+        }
+        if (typeof req.body?.quotaLimit === "number" && Number.isSafeInteger(req.body.quotaLimit)) {
+            doc.quotaLimit = req.body.quotaLimit;
+        }
+        return {
+            status: 200,
+            ok: true,
+            data: this.minimizeDocument(doc),
+        };
+    }
+}
+//# sourceMappingURL=coverage-contract.js.map

package/dist/core/coverage-contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"coverage-contract.js","sourceRoot":"","sources":["../../src/core/coverage-contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAmCtD,MAAM,UAAU,4BAA4B,CAAC,OAG5C;IACC,MAAM,eAAe,GAAG,OAAO,EAAE,eAAe,IAAI,IAAI,CAAC;IACzD,MAAM,cAAc,GAAG,OAAO,EAAE,0BAA0B,IAAI,KAAK,CAAC;IAEpE,OAAO;QACL,cAAc,EAAE;YACd,MAAM,EAAE,eAAe;gBACrB,CAAC,CAAC,kDAAkD;gBACpD,CAAC,CAAC,eAAe;YACnB,KAAK,EAAE,8DAA8D;YACrE,sCAAsC,EAAE,KAAK;YAC7C,qBAAqB,EAAE,KAAK;SAC7B;QACD,mBAAmB,EAAE;YACnB,MAAM,EAAE,cAAc;gBACpB,CAAC,CAAC,kCAAkC;gBACpC,CAAC,CAAC,wCAAwC;YAC5C,cAAc,EAAE,8BAA8B;YAC9C,OAAO,EAAE,cAAc;gBACrB,CAAC,CAAC,6NAA6N;gBAC/N,CAAC,CAAC,4LAA4L;SACjM;QACD,cAAc,EAAE;YACd;gBACE,EAAE,EAAE,qCAAqC;gBACzC,6BAA6B,EAAE,KAAK;gBACpC,4BAA4B,EAAE,yBAAyB;gBACvD,WAAW,EACT,gSAAgS;aACnS;YACD;gBACE,EAAE,EAAE,qCAAqC;gBACzC,6BAA6B,EAAE,KAAK;gBACpC,4BAA4B,EAAE,yBAAyB;gBACvD,WAAW,EACT,mJAAmJ;aACtJ;YACD;gBACE,EAAE,EAAE,sCAAsC;gBAC1C,6BAA6B,EAAE,KAAK;gBACpC,4BAA4B,EAAE,yBAAyB;gBACvD,WAAW,EACT,6PAA6P;aAChQ;SACF;KACF,CAAC;AACJ,CAAC;AA0DD;;;;GAIG;AACH,MAAM,OAAO,mCAAmC;IAC7B,aAAa,CAAS;IACtB,QAAQ,GAAG,IAAI,GAAG,EAAkC,CAAC;IACrD,SAAS,GAAG,IAAI,GAAG,EAAwC,CAAC;IAC5D,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IAC5C,KAAK,CAAe;IAE5B,YAAY,OAA0D;QACpE,IAAI,CAAC,aAAa,GAAG,OAAO,EAAE,aAAa,IAAI,2BAA2B,CAAC;QAC3E,IAAI,CAAC,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC;IAEM,YAAY,CAAC,MAKnB;QACC,MAAM,SAAS,GAAG,QAAQ,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,SAAS,GAAG,QAAQ,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,MAAM,GAA2B;YACrC,SAAS;YACT,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,SAAS;YACT,WAAW,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC;YACpD,OAAO,EAAE,KAAK;SACf,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACrC,OAAO,MAAM,CAAC;IAChB,CAAC;IAEM,aAAa,CAAC,SAAiB;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACxB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,YAAY,CAAC,GAAiC;QACnD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;IAC5C,CAAC;IAEM,qBAAqB,CAAC,KAAa;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;IAC1D,CAAC;IAEO,gBAAgB,CAAC,GAAiC;QACxD,8FAA8F;QAC9F,OAAO;YACL,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,UAAU,EAAE,GAAG,CAAC,UAAU;SAC3B,CAAC;IACJ,CAAC;IAEM,aAAa,CAAC,GAAyB;QAC5C,mEAAmE;QACnE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;YACnB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;QAClE,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,EAAE,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACvE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,4BAA4B,EAAE,CAAC;QAC7E,CAAC;QAED,2DAA2D;QAC3D,MAAM,KAAK,GAAG,+CAA+C,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7E,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;QAC5D,CAAC;QACD,MAAM,CAAC,EAAE,iBAAiB,EAAE,cAAc,CAAC,GAAG,KAAK,CAAC;QAEpD,sEAAsE;QACtE,IAAI,iBAAiB,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC3C,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,0BAA0B,EAAE,CAAC;QAC3E,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,cAAe,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC9C,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,0BAA0B,EAAE,CAAC;QAC3E,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACzB,OAAO;gBACL,MAAM,EAAE,GAAG;gBACX,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC;aACjC,CAAC;QACJ,CAAC;QAED,uFAAuF;QACvF,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;YACtC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,uBAAuB,EAAE,CAAC;QACxE,CAAC;QACD,IACE,CAAC,GAAG,CAAC,SAAS;YACd,GAAG,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;YACnC,CAAC,GAAG,CAAC,YAAY;YACjB,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAClC,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,yBAAyB,EAAE,CAAC;QAC1E,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;aAClC,MAAM,CAAC,GAAG,OAAO,CAAC,SAAS,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;aAClD,MAAM,CAAC,KAAK,CAAC,CAAC;QACjB,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,yBAAyB,EAAE,CAAC;QAC1E,CAAC;QAED,iFAAiF;QACjF,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC7B,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,0BAA0B,EAAE,CAAC;QAC3E,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAElC,IAAI,OAAO,GAAG,CAAC,IAAI,EAAE,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5E,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACpC,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,IAAI,EAAE,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1F,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC;QACvC,CAAC;QAED,OAAO;YACL,MAAM,EAAE,GAAG;YACX,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC;SACjC,CAAC;IACJ,CAAC;CACF"}

package/dist/core/debug-posture.d.ts

@@ -0,0 +1,40 @@
+export type DebugPostureStatus = "exposed" | "not-observed" | "unknown";
+export interface DebugPostureCheck {
+    readonly id: "node-cli-inspector-exposure" | "chromium-remote-debugging-exposure" | "macos-entitlements-debug-posture" | "android-manifest-debuggable-posture";
+    readonly platform: "cross-platform" | "macos" | "android";
+    readonly status: DebugPostureStatus;
+    readonly observedConfig: string;
+    readonly restrictedChannel: string;
+    readonly remediation: string;
+}
+export interface ProductionDebugPostureReport {
+    readonly targetPath: string;
+    readonly overallPosture: "exposed" | "not-observed" | "unknown";
+    readonly checks: readonly DebugPostureCheck[];
+    readonly runtimeBoundaryContract: {
+        readonly shadowObjectsClassification: "decorative-deception-signal";
+        readonly absenceOfRuntimeMarkersImpliesNoDebugger: false;
+        readonly blocksFridaOrGdbWithLocalPrivileges: false;
+        readonly blocksRuntimeStateRecovery: false;
+        readonly secretStorageGuidance: string;
+    };
+}
+export interface InspectDebugPostureOptions {
+    readonly targetDir: string;
+    readonly packageJsonPath?: string;
+    readonly envFilePath?: string;
+    readonly macosEntitlementsPath?: string;
+    readonly androidManifestPath?: string;
+}
+/**
+ * Read-only production debug exposure inspector (Issue #19).
+ *
+ * Inspects authorized local build/deployment configuration files to identify
+ * unnecessary debug/inspector entry points (`--inspect`, `--remote-debugging-port`,
+ * `com.apple.security.get-task-allow`, `android:debuggable="true"`).
+ *
+ * Never probes network ports, never attaches to processes, and never claims that
+ * client-side JS markers can block Frida/GDB/CDP when the observer holds OS privileges.
+ */
+export declare function inspectProductionDebugPosture(options: InspectDebugPostureOptions): ProductionDebugPostureReport;
+//# sourceMappingURL=debug-posture.d.ts.map

package/dist/core/debug-posture.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"debug-posture.d.ts","sourceRoot":"","sources":["../../src/core/debug-posture.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,cAAc,GAAG,SAAS,CAAC;AAExE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EACP,6BAA6B,GAC7B,oCAAoC,GACpC,kCAAkC,GAClC,qCAAqC,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,GAAG,OAAO,GAAG,SAAS,CAAC;IAC1D,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,SAAS,GAAG,cAAc,GAAG,SAAS,CAAC;IAChE,QAAQ,CAAC,MAAM,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC9C,QAAQ,CAAC,uBAAuB,EAAE;QAChC,QAAQ,CAAC,2BAA2B,EAAE,6BAA6B,CAAC;QACpE,QAAQ,CAAC,wCAAwC,EAAE,KAAK,CAAC;QACzD,QAAQ,CAAC,mCAAmC,EAAE,KAAK,CAAC;QACpD,QAAQ,CAAC,0BAA0B,EAAE,KAAK,CAAC;QAC3C,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;KACxC,CAAC;CACH;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;CACvC;AAED;;;;;;;;;GASG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,0BAA0B,GAClC,4BAA4B,CAmN9B"}