instar 1.3.1247 → 1.3.1249

package/dist/core/durableSecretScrub.d.ts

@@ -75,10 +75,12 @@ interface ScrubPattern {
 }
 /**
  * The authoritative pattern set — the UNION of the three pre-existing copies
- * (spec Frontloaded Decision #1). ORDER MATTERS for overlap resolution: the
- * more-specific prefix patterns (anthropic before generic openai `sk-`, stripe
- * `sk_` before generic) sit earlier so the greedy first-wins overlap resolver
- * labels a span with its most-specific kind.
+ * (spec Frontloaded Decision #1). Overlap precedence is decided by the resolver,
+ * NOT by array order: overlapping spans are sorted by start position, then
+ * longest match wins; array order only breaks an exact start+end tie (stable
+ * sort). The more-specific prefix patterns still sit before the generic ones so
+ * those exact ties label a span with its most-specific kind — do not "restore"
+ * order-based precedence on the strength of an older reading of this comment.
  *
  * LINEARITY CONTRACT (spec §2): every pattern uses SINGLE quantifiers over
  * character classes with no nesting — no `(x+)+` / `(x*)*` shapes — so a

package/dist/core/durableSecretScrub.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"durableSecretScrub.d.ts","sourceRoot":"","sources":["../../src/core/durableSecretScrub.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,+EAA+E;AAC/E,MAAM,MAAM,iBAAiB,GACzB,eAAe,GACf,YAAY,GACZ,cAAc,GACd,aAAa,GACb,gBAAgB,GAChB,YAAY,GACZ,gBAAgB,GAChB,oBAAoB,GACpB,KAAK,GACL,iBAAiB,GACjB,cAAc,GACd,yBAAyB,GACzB,gBAAgB,CAAC;AAErB,8EAA8E;AAC9E,MAAM,MAAM,uBAAuB,GAAG,aAAa,GAAG,UAAU,CAAC;AAEjE;6DAC6D;AAC7D,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,iBAAiB,GAAG,uBAAuB,CAAC;IAClD,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,UAAU,EAAE,aAAa,EAAE,CAAC;IAC5B,wFAAwF;IACxF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;mDAGmD;AACnD,UAAU,YAAY;IACpB,IAAI,EAAE,iBAAiB,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,uBAAuB,EAAE,SAAS,YAAY,EA2CjD,CAAC;AAEX;;mCAEmC;AACnC,eAAO,MAAM,uBAAuB,UAAY,CAAC;AAEjD,MAAM,WAAW,oBAAoB;IACnC,gFAAgF;IAChF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAaD;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,oBAAyB,GACjC,mBAAmB,CAmErB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,uBAAwB,SAAQ,aAAa;IAC5D,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,qBAAqB,CAAC,CAAC;IACtC,MAAM,EAAE,CAAC,CAAC;IACV,UAAU,EAAE,uBAAuB,EAAE,CAAC;IACtC,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,wBAAgB,eAAe,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/D,MAAM,EAAE,CAAC,EACT,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,EAC5B,OAAO,GAAE,oBAAyB,GACjC,qBAAqB,CAAC,CAAC,CAAC,CA4B1B"}
+{"version":3,"file":"durableSecretScrub.d.ts","sourceRoot":"","sources":["../../src/core/durableSecretScrub.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,+EAA+E;AAC/E,MAAM,MAAM,iBAAiB,GACzB,eAAe,GACf,YAAY,GACZ,cAAc,GACd,aAAa,GACb,gBAAgB,GAChB,YAAY,GACZ,gBAAgB,GAChB,oBAAoB,GACpB,KAAK,GACL,iBAAiB,GACjB,cAAc,GACd,yBAAyB,GACzB,gBAAgB,CAAC;AAErB,8EAA8E;AAC9E,MAAM,MAAM,uBAAuB,GAAG,aAAa,GAAG,UAAU,CAAC;AAEjE;6DAC6D;AAC7D,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,iBAAiB,GAAG,uBAAuB,CAAC;IAClD,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,UAAU,EAAE,aAAa,EAAE,CAAC;IAC5B,wFAAwF;IACxF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;mDAGmD;AACnD,UAAU,YAAY;IACpB,IAAI,EAAE,iBAAiB,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,uBAAuB,EAAE,SAAS,YAAY,EA+DjD,CAAC;AAEX;;mCAEmC;AACnC,eAAO,MAAM,uBAAuB,UAAY,CAAC;AAEjD,MAAM,WAAW,oBAAoB;IACnC,gFAAgF;IAChF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAaD;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,oBAAyB,GACjC,mBAAmB,CAmErB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,uBAAwB,SAAQ,aAAa;IAC5D,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,qBAAqB,CAAC,CAAC;IACtC,MAAM,EAAE,CAAC,CAAC;IACV,UAAU,EAAE,uBAAuB,EAAE,CAAC;IACtC,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,wBAAgB,eAAe,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/D,MAAM,EAAE,CAAC,EACT,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,EAC5B,OAAO,GAAE,oBAAyB,GACjC,qBAAqB,CAAC,CAAC,CAAC,CA4B1B"}

package/dist/core/durableSecretScrub.js

@@ -43,10 +43,12 @@
  */
 /**
  * The authoritative pattern set — the UNION of the three pre-existing copies
- * (spec Frontloaded Decision #1). ORDER MATTERS for overlap resolution: the
- * more-specific prefix patterns (anthropic before generic openai `sk-`, stripe
- * `sk_` before generic) sit earlier so the greedy first-wins overlap resolver
- * labels a span with its most-specific kind.
+ * (spec Frontloaded Decision #1). Overlap precedence is decided by the resolver,
+ * NOT by array order: overlapping spans are sorted by start position, then
+ * longest match wins; array order only breaks an exact start+end tie (stable
+ * sort). The more-specific prefix patterns still sit before the generic ones so
+ * those exact ties label a span with its most-specific kind — do not "restore"
+ * order-based precedence on the strength of an older reading of this comment.
  *
  * LINEARITY CONTRACT (spec §2): every pattern uses SINGLE quantifiers over
  * character classes with no nesting — no `(x+)+` / `(x*)*` shapes — so a
@@ -63,8 +65,20 @@ export const DURABLE_SECRET_PATTERNS = [
     { kind: 'stripe-key', regex: /sk_(?:live|test)_[A-Za-z0-9]{12,}/gd },
     // Generic provider keys: sk-/pk-/rk- prefixed (OpenAI + generic).
     { kind: 'openai-key', regex: /\b(?:sk|pk|rk)-[A-Za-z0-9]{16,}/gd },
+    // Modern sk-family provider keys: OpenAI project / service-account / admin /
+    // None forms, and OpenRouter (sk-or-v1-). The generic pattern above cannot
+    // see these: it needs 16 unbroken alphanumerics straight after `sk-`, and each
+    // of these puts a short word and a hyphen there. Anchored by a lookbehind, not
+    // \b: \b misses an underscore-joined key (MY_KEY_sk-proj-…), while NO anchor
+    // refuses kebab slugs whose word ends in "sk" (task-proj-<long-slug>). Spec:
+    // docs/specs/outbound-credential-wall-modern-key-formats.md.
+    { kind: 'openai-key', regex: /(?<![A-Za-z0-9])sk-(?:proj|svcacct|admin|None|or-v1)-[A-Za-z0-9_-]{32,}/gd },
     // GitHub PAT / OAuth / app tokens (ghp_/gho_/ghu_/ghs_/ghr_).
     { kind: 'github-token', regex: /\bgh[pousr]_[A-Za-z0-9]{20,}/gd },
+    // GitHub fine-grained personal access tokens (issued ~82 chars; the 40 floor
+    // sits far below real length and far above any identifier). Same anchor
+    // reasoning as the sk-family entry above.
+    { kind: 'github-token', regex: /(?<![A-Za-z0-9])github_pat_[A-Za-z0-9_]{40,}/gd },
     // Google API keys (AIza + 35 url-safe chars).
     { kind: 'google-api-key', regex: /\bAIza[A-Za-z0-9_-]{35}/gd },
     // Slack tokens: xoxb-/xoxp-/xoxa-/xoxr-/xoxs- + segments.
@@ -81,14 +95,22 @@ export const DURABLE_SECRET_PATTERNS = [
     },
     // JWTs: three base64url segments. Known FP suspect on dotted identifiers
     // (spec rollout step 2) — surfaced per-pattern-kind in the dry-run soak.
-    { kind: 'jwt', regex: /\b[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{16,}\b/gd },
+    // First segment capped at 1024: an uncapped `{16,}` rescans the rest of an
+    // unbroken run from EVERY word boundary inside it, which is quadratic (814 ms
+    // at 64 KB, minutes at the 1 MB scrub ceiling). The cap makes each attempt
+    // bounded and loses no detection — a JWT header segment is far shorter.
+    { kind: 'jwt', regex: /\b[A-Za-z0-9_-]{16,1024}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{16,}\b/gd },
     // Bearer tokens.
     { kind: 'bearer-token', regex: /Bearer\s+[A-Za-z0-9_\-.]{20,}/gd },
     // URLs with embedded credentials (scheme://user:pass@host) — redact the
     // credential group (group 1), keep the scheme/host structure readable.
     {
         kind: 'url-embedded-credential',
-        regex: /([a-z][a-z0-9+.-]*:\/\/)[^/\s:@]+:[^/\s@]+@/gd,
+        // Scheme capped at 64: an uncapped `*` let every position in a long run
+        // start a scan to the run's end — quadratic, on the non-overridable wall
+        // (2.4 s at 64 KB). The regex still starts within 64 chars of the `://`,
+        // so every credentialed URL is still detected.
+        regex: /([a-z][a-z0-9+.-]{0,63}:\/\/)[^/\s:@]+:[^/\s@]+@/gd,
         group: undefined, // whole match replaced; the scheme is short + re-derivable
     },
     // Labelled secret pairs (token=…, api_key: …, password "…") — redact only the

package/dist/core/durableSecretScrub.js.map

@@ -1 +1 @@
-{"version":3,"file":"durableSecretScrub.js","sourceRoot":"","sources":["../../src/core/durableSecretScrub.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAoDH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAA4B;IAC9D,6EAA6E;IAC7E,8EAA8E;IAC9E,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,6BAA6B,EAAE;IAC/D,8EAA8E;IAC9E,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,qCAAqC,EAAE;IACpE,kEAAkE;IAClE,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,mCAAmC,EAAE;IAClE,8DAA8D;IAC9D,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,gCAAgC,EAAE;IACjE,8CAA8C;IAC9C,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,2BAA2B,EAAE;IAC9D,0DAA0D;IAC1D,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,kCAAkC,EAAE;IAClE,+DAA+D;IAC/D,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,iCAAiC,EAAE;IACpE,gEAAgE;IAChE,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,mCAAmC,EAAE;IAC1E,+EAA+E;IAC/E,iEAAiE;IACjE;QACE,IAAI,EAAE,iBAAiB;QACvB,KAAK,EAAE,6FAA6F;KACrG;IACD,yEAAyE;IACzE,yEAAyE;IACzE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,iEAAiE,EAAE;IACzF,iBAAiB;IACjB,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,iCAAiC,EAAE;IAClE,wEAAwE;IACxE,uEAAuE;IACvE;QACE,IAAI,EAAE,yBAAyB;QAC/B,KAAK,EAAE,+CAA+C;QACtD,KAAK,EAAE,SAAS,EAAE,2DAA2D;KAC9E;IACD,8EAA8E;IAC9E,gEAAgE;IAChE;QACE,IAAI,EAAE,gBAAgB;QACtB,KAAK,EAAE,uFAAuF;QAC9F,KAAK,EAAE,CAAC;KACT;CACO,CAAC;AAEX;;mCAEmC;AACnC,MAAM,CAAC,MAAM,uBAAuB,GAAG,SAAS,CAAC;AAOjD,kDAAkD;AAClD,SAAS,SAAS,CAAC,IAA2B;IAC5C,OAAO,aAAa,IAAI,GAAG,CAAC;AAC9B,CAAC;AAQD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAC3B,KAAa,EACb,UAAgC,EAAE;IAElC,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,uBAAuB,CAAC;IAE7D,2EAA2E;IAC3E,qEAAqE;IACrE,IAAI,IAAI,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QAC3B,OAAO;YACL,IAAI,EAAE,GAAG,SAAS,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,MAAM,kBAAkB;YAChE,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YAClE,SAAS,EAAE,IAAI;SAChB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,0EAA0E;QAC1E,MAAM,GAAG,GAAc,EAAE,CAAC;QAC1B,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,uBAAuB,EAAE,CAAC;YAC7D,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;YACpB,IAAI,CAAyB,CAAC;YAC9B,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACvC,MAAM,EAAE,GAAG,KAAK,IAAI,CAAC,CAAC;gBACtB,MAAM,OAAO,GAAI,CAAyE,CAAC,OAAO,CAAC;gBACnG,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAqB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBAC5G,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC9B,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;gBACnD,CAAC;gBACD,qDAAqD;gBACrD,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC;oBAAE,KAAK,CAAC,SAAS,EAAE,CAAC;YAC3C,CAAC;QACH,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QAClC,CAAC;QAED,yEAAyE;QACzE,6EAA6E;QAC7E,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC;QAChB,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACpB,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,EAAE,CAAC;gBACtB,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACjB,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC;YACjB,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,MAAM,UAAU,GAAoB,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACrD,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YAC5E,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC;QACf,CAAC;QACD,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAExB,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC,CAAC,8NAA8N;QACtO,OAAO;YACL,IAAI,EAAE,GAAG,SAAS,CAAC,aAAa,CAAC,KAAK,IAAI,CAAC,MAAM,kBAAkB;YACnE,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YACrE,KAAK,EAAE,IAAI;SACZ,CAAC;IACJ,CAAC;AACH,CAAC;AAoBD,MAAM,UAAU,eAAe,CAC7B,MAAS,EACT,MAA4B,EAC5B,UAAgC,EAAE;IAElC,MAAM,GAAG,GAA4B,EAAE,GAAG,MAAM,EAAE,CAAC;IACnD,MAAM,UAAU,GAA8B,EAAE,CAAC;IACjD,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,KAAK,GAAG,KAAK,CAAC;IAElB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACxC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACxB,IAAI,CAAC,CAAC,SAAS;gBAAE,SAAS,GAAG,IAAI,CAAC;YAClC,IAAI,CAAC,CAAC,KAAK;gBAAE,KAAK,GAAG,IAAI,CAAC;YAC1B,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,UAAU;gBAAE,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAClF,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,GAAG,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;gBAChC,IAAI,OAAO,EAAE,KAAK,QAAQ;oBAAE,OAAO,EAAE,CAAC;gBACtC,MAAM,CAAC,GAAG,aAAa,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;gBACrC,IAAI,CAAC,CAAC,SAAS;oBAAE,SAAS,GAAG,IAAI,CAAC;gBAClC,IAAI,CAAC,CAAC,KAAK;oBAAE,KAAK,GAAG,IAAI,CAAC;gBAC1B,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,UAAU;oBAAE,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;gBAChF,OAAO,CAAC,CAAC,IAAI,CAAC;YAChB,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,GAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC5D,CAAC"}
+{"version":3,"file":"durableSecretScrub.js","sourceRoot":"","sources":["../../src/core/durableSecretScrub.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAoDH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAA4B;IAC9D,6EAA6E;IAC7E,8EAA8E;IAC9E,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,6BAA6B,EAAE;IAC/D,8EAA8E;IAC9E,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,qCAAqC,EAAE;IACpE,kEAAkE;IAClE,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,mCAAmC,EAAE;IAClE,6EAA6E;IAC7E,2EAA2E;IAC3E,+EAA+E;IAC/E,+EAA+E;IAC/E,6EAA6E;IAC7E,6EAA6E;IAC7E,6DAA6D;IAC7D,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,2EAA2E,EAAE;IAC1G,8DAA8D;IAC9D,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,gCAAgC,EAAE;IACjE,6EAA6E;IAC7E,wEAAwE;IACxE,0CAA0C;IAC1C,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,gDAAgD,EAAE;IACjF,8CAA8C;IAC9C,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,2BAA2B,EAAE;IAC9D,0DAA0D;IAC1D,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,kCAAkC,EAAE;IAClE,+DAA+D;IAC/D,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,iCAAiC,EAAE;IACpE,gEAAgE;IAChE,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,mCAAmC,EAAE;IAC1E,+EAA+E;IAC/E,iEAAiE;IACjE;QACE,IAAI,EAAE,iBAAiB;QACvB,KAAK,EAAE,6FAA6F;KACrG;IACD,yEAAyE;IACzE,yEAAyE;IACzE,2EAA2E;IAC3E,8EAA8E;IAC9E,2EAA2E;IAC3E,wEAAwE;IACxE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,qEAAqE,EAAE;IAC7F,iBAAiB;IACjB,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,iCAAiC,EAAE;IAClE,wEAAwE;IACxE,uEAAuE;IACvE;QACE,IAAI,EAAE,yBAAyB;QAC/B,wEAAwE;QACxE,yEAAyE;QACzE,yEAAyE;QACzE,+CAA+C;QAC/C,KAAK,EAAE,oDAAoD;QAC3D,KAAK,EAAE,SAAS,EAAE,2DAA2D;KAC9E;IACD,8EAA8E;IAC9E,gEAAgE;IAChE;QACE,IAAI,EAAE,gBAAgB;QACtB,KAAK,EAAE,uFAAuF;QAC9F,KAAK,EAAE,CAAC;KACT;CACO,CAAC;AAEX;;mCAEmC;AACnC,MAAM,CAAC,MAAM,uBAAuB,GAAG,SAAS,CAAC;AAOjD,kDAAkD;AAClD,SAAS,SAAS,CAAC,IAA2B;IAC5C,OAAO,aAAa,IAAI,GAAG,CAAC;AAC9B,CAAC;AAQD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAC3B,KAAa,EACb,UAAgC,EAAE;IAElC,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,uBAAuB,CAAC;IAE7D,2EAA2E;IAC3E,qEAAqE;IACrE,IAAI,IAAI,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QAC3B,OAAO;YACL,IAAI,EAAE,GAAG,SAAS,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,MAAM,kBAAkB;YAChE,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YAClE,SAAS,EAAE,IAAI;SAChB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,0EAA0E;QAC1E,MAAM,GAAG,GAAc,EAAE,CAAC;QAC1B,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,uBAAuB,EAAE,CAAC;YAC7D,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;YACpB,IAAI,CAAyB,CAAC;YAC9B,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACvC,MAAM,EAAE,GAAG,KAAK,IAAI,CAAC,CAAC;gBACtB,MAAM,OAAO,GAAI,CAAyE,CAAC,OAAO,CAAC;gBACnG,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAqB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBAC5G,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC9B,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;gBACnD,CAAC;gBACD,qDAAqD;gBACrD,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC;oBAAE,KAAK,CAAC,SAAS,EAAE,CAAC;YAC3C,CAAC;QACH,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QAClC,CAAC;QAED,yEAAyE;QACzE,6EAA6E;QAC7E,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC;QAChB,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACpB,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,EAAE,CAAC;gBACtB,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACjB,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC;YACjB,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,MAAM,UAAU,GAAoB,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACrD,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YAC5E,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC;QACf,CAAC;QACD,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAExB,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC,CAAC,8NAA8N;QACtO,OAAO;YACL,IAAI,EAAE,GAAG,SAAS,CAAC,aAAa,CAAC,KAAK,IAAI,CAAC,MAAM,kBAAkB;YACnE,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YACrE,KAAK,EAAE,IAAI;SACZ,CAAC;IACJ,CAAC;AACH,CAAC;AAoBD,MAAM,UAAU,eAAe,CAC7B,MAAS,EACT,MAA4B,EAC5B,UAAgC,EAAE;IAElC,MAAM,GAAG,GAA4B,EAAE,GAAG,MAAM,EAAE,CAAC;IACnD,MAAM,UAAU,GAA8B,EAAE,CAAC;IACjD,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,KAAK,GAAG,KAAK,CAAC;IAElB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACxC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACxB,IAAI,CAAC,CAAC,SAAS;gBAAE,SAAS,GAAG,IAAI,CAAC;YAClC,IAAI,CAAC,CAAC,KAAK;gBAAE,KAAK,GAAG,IAAI,CAAC;YAC1B,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,UAAU;gBAAE,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAClF,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,GAAG,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;gBAChC,IAAI,OAAO,EAAE,KAAK,QAAQ;oBAAE,OAAO,EAAE,CAAC;gBACtC,MAAM,CAAC,GAAG,aAAa,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;gBACrC,IAAI,CAAC,CAAC,SAAS;oBAAE,SAAS,GAAG,IAAI,CAAC;gBAClC,IAAI,CAAC,CAAC,KAAK;oBAAE,KAAK,GAAG,IAAI,CAAC;gBAC1B,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,UAAU;oBAAE,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;gBAChF,OAAO,CAAC,CAAC,IAAI,CAAC;YAChB,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,GAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC5D,CAAC"}

package/dist/core/redactUrl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redactUrl.d.ts","sourceRoot":"","sources":["../../src/core/redactUrl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAiBH;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG,MAAM,CA6BrD;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMrD"}
+{"version":3,"file":"redactUrl.d.ts","sourceRoot":"","sources":["../../src/core/redactUrl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAkBH;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG,MAAM,CA6BrD;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMrD"}

package/dist/core/redactUrl.js

@@ -35,6 +35,7 @@ const TOKEN_PATTERNS = [
     /xox[baprs]-[A-Za-z0-9-]{10,}/g, // Slack tokens
     /\d{8,10}:[A-Za-z0-9_-]{30,}/g, // Telegram bot tokens (id:secret) — no \b: the API path form is /bot<id>:<secret>/
     /sk-[A-Za-z0-9]{20,}/g, // OpenAI-style keys
+    /sk-(?:proj|svcacct|admin|None|or-v1)-[A-Za-z0-9_-]{32,}/g, // modern sk-family (OpenAI project/svcacct/admin/None, OpenRouter)
 ];
 /**
  * Redact the userinfo (user:password@) segment of a single URL string.

package/dist/core/redactUrl.js.map

@@ -1 +1 @@
-{"version":3,"file":"redactUrl.js","sourceRoot":"","sources":["../../src/core/redactUrl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,MAAM,QAAQ,GAAG,KAAK,CAAC;AAEvB;;;;GAIG;AACH,MAAM,cAAc,GAAa;IAC/B,8BAA8B,EAAS,yDAAyD;IAChG,+BAA+B,EAAS,0BAA0B;IAClE,+BAA+B,EAAS,eAAe;IACvD,8BAA8B,EAAU,mFAAmF;IAC3H,sBAAsB,EAAkB,oBAAoB;CAC7D,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,KAAmB;IAC3C,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;IAEjE,6EAA6E;IAC7E,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;YACnE,0EAA0E;YAC1E,0DAA0D;YAC1D,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;gBACrB,MAAM,WAAW,GAAG,SAAS,GAAG,CAAC,CAAC;gBAClC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;gBAC5C,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;oBACjB,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,GAAG,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACjE,CAAC;YACH,CAAC;QACH,CAAC;QACD,0EAA0E;QAC1E,mDAAmD;QACnD,OAAO,uBAAuB,CAAC,GAAG,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,+DAA+D;QAC/D,OAAO,uBAAuB,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,sEAAsE;IACtE,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACrD,8EAA8E;IAC9E,OAAO,uBAAuB,CAAC,gBAAgB,CAAC,CAAC;AACnD,CAAC;AAED,qFAAqF;AACrF,SAAS,qBAAqB,CAAC,IAAY;IACzC,gFAAgF;IAChF,OAAO,IAAI,CAAC,OAAO,CACjB,4CAA4C,EAC5C,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,QAAQ,GAAG,CACxC,CAAC;AACJ,CAAC;AAED,qEAAqE;AACrE,SAAS,uBAAuB,CAAC,IAAY;IAC3C,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,EAAE,IAAI,cAAc,EAAE,CAAC;QAChC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"redactUrl.js","sourceRoot":"","sources":["../../src/core/redactUrl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,MAAM,QAAQ,GAAG,KAAK,CAAC;AAEvB;;;;GAIG;AACH,MAAM,cAAc,GAAa;IAC/B,8BAA8B,EAAS,yDAAyD;IAChG,+BAA+B,EAAS,0BAA0B;IAClE,+BAA+B,EAAS,eAAe;IACvD,8BAA8B,EAAU,mFAAmF;IAC3H,sBAAsB,EAAkB,oBAAoB;IAC5D,0DAA0D,EAAG,mEAAmE;CACjI,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,KAAmB;IAC3C,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;IAEjE,6EAA6E;IAC7E,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;YACnE,0EAA0E;YAC1E,0DAA0D;YAC1D,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;gBACrB,MAAM,WAAW,GAAG,SAAS,GAAG,CAAC,CAAC;gBAClC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;gBAC5C,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;oBACjB,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,GAAG,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACjE,CAAC;YACH,CAAC;QACH,CAAC;QACD,0EAA0E;QAC1E,mDAAmD;QACnD,OAAO,uBAAuB,CAAC,GAAG,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,+DAA+D;QAC/D,OAAO,uBAAuB,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,sEAAsE;IACtE,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACrD,8EAA8E;IAC9E,OAAO,uBAAuB,CAAC,gBAAgB,CAAC,CAAC;AACnD,CAAC;AAED,qFAAqF;AACrF,SAAS,qBAAqB,CAAC,IAAY;IACzC,gFAAgF;IAChF,OAAO,IAAI,CAAC,OAAO,CACjB,4CAA4C,EAC5C,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,QAAQ,GAAG,CACxC,CAAC;AACJ,CAAC;AAED,qEAAqE;AACrE,SAAS,uBAAuB,CAAC,IAAY;IAC3C,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,EAAE,IAAI,cAAc,EAAE,CAAC;QAChC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/core/types.d.ts

@@ -3703,6 +3703,24 @@ export interface InstarConfig {
      * migration. See src/core/LlmCircuitBreaker.ts.
      */
     intelligence?: {
+        /**
+         * Jev signal-layer shadow (docs/specs/jev-signal-layer-shadow.md). DARK by
+         * default. Measure-only: compares Jev (TypeSafe AI) against the B1–B7
+         * deterministic detectors on real tone-gate candidates and decides nothing.
+         * Inert unless enabled AND soakEndsAt is a future ISO instant AND the vault
+         * holds `typesafe_api_key`. Read live per candidate (no restart).
+         */
+        jevSignalShadow?: {
+            enabled?: boolean;
+            /** 0..1 share of candidates shadowed (default 1). */
+            sampleRate?: number;
+            /** Pinned model id — never an alias (default "jev-1.13.0"). */
+            model?: string;
+            /** Hard abort per call (default 1500). */
+            timeoutMs?: number;
+            /** The mechanical soak bound: inert at or after this instant, and when null. */
+            soakEndsAt?: string | null;
+        };
         circuitBreaker?: {
             /** Master switch for the rate-limit circuit breaker (default: true). */
             enabled?: boolean;