instar 1.3.745 → 1.3.747

package/dist/core/devGatedFeatures.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"devGatedFeatures.d.ts","sourceRoot":"","sources":["../../src/core/devGatedFeatures.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,oEAAoE;AACpE,MAAM,WAAW,eAAe;IAC9B,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,UAAU,EAAE,MAAM,CAAC;IACnB,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,eAAO,MAAM,kBAAkB,EAAE,eAAe,EAgd/C,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,MAAM,gBAAgB,GACxB,aAAa,GACb,cAAc,GACd,gBAAgB,GAChB,sBAAsB,GACtB,iBAAiB,CAAC;AAEtB,MAAM,WAAW,iBAAiB;IAChC,uEAAuE;IACvE,UAAU,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,oBAAoB,EAAE,iBAAiB,EA2JnD,CAAC;AAEF;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAO5E"}
+{"version":3,"file":"devGatedFeatures.d.ts","sourceRoot":"","sources":["../../src/core/devGatedFeatures.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,oEAAoE;AACpE,MAAM,WAAW,eAAe;IAC9B,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,UAAU,EAAE,MAAM,CAAC;IACnB,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,eAAO,MAAM,kBAAkB,EAAE,eAAe,EAsd/C,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,MAAM,gBAAgB,GACxB,aAAa,GACb,cAAc,GACd,gBAAgB,GAChB,sBAAsB,GACtB,iBAAiB,CAAC;AAEtB,MAAM,WAAW,iBAAiB;IAChC,uEAAuE;IACvE,UAAU,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,oBAAoB,EAAE,iBAAiB,EA2JnD,CAAC;AAEF;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAO5E"}

package/dist/core/devGatedFeatures.js

@@ -42,6 +42,12 @@ export const DEV_GATED_FEATURES = [
         description: "Tier1/Tier2 standby honest-stuck classification — surface the REAL reason a live-but-failing session is silent (rate-limited / policy-wedge / context-wedge / context-too-long) instead of 'actively working'.",
         justification: "Signal-only — only changes the standby MESSAGE TEXT; never gates, blocks, initiates recovery, spends, or egresses. Reuses the existing tail-gated classifyStuckSignature and defers to the same one-voice recovery-ownership checks Tier 3 already honors. Flag-OFF = Tier1/2 byte-identical to today.",
     },
+    {
+        name: 'durableOutputScrub',
+        configPath: 'monitoring.durableOutputScrub.enabled',
+        description: 'Durable-Output Hygiene Standard §2 (Layer B — "What Persists Must Be Clean") — the DurableOutputScrubber: a deterministic credential-SPAN scrub over LLM output at durable-output persistence chokepoints (session summaries wired first), config-gated + dark-first.',
+        justification: 'Ships dryRun:true (the dry-run canary): on a dev agent the scrubber COMPUTES the redaction and records would-redact metrics (feature key durable-output-scrub — COUNTS/kind/offset only, NEVER the matched bytes, so the soak telemetry can never itself be the leak), but returns the ORIGINAL text so NO durable content is mutated while dryRun holds (verified at DurableOutputScrubber.scrub/scrubRecord dryRun branches — applied:false, input returned unchanged). A real redaction (which destroys the matched span by design) needs a deliberate dryRun:false — the OPERATOR\'s endpoint decision on the dev-soak packet (Frontloaded Decision #4), never a fleet default. Pure deterministic regex floor (no LLM, no spawn-cap slot, no egress, no third-party spend); every failure path fails SAFE-toward-redaction (a scrub throw / oversize withholds the field under a typed marker, never persists raw bytes). Same dogfooding posture as topicProfiles / credentialRepointing.',
+    },
     {
         name: 'growthAnalyst',
         configPath: 'monitoring.growthAnalyst.enabled',

package/dist/core/devGatedFeatures.js.map

@@ -1 +1 @@
-{"version":3,"file":"devGatedFeatures.js","sourceRoot":"","sources":["../../src/core/devGatedFeatures.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAoBH,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD;QACE,IAAI,EAAE,yBAAyB;QAC/B,UAAU,EAAE,6CAA6C;QACzD,WAAW,EAAE,+MAA+M;QAC5N,aAAa,EAAE,ikBAAikB;KACjlB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,UAAU,EAAE,iCAAiC;QAC7C,WAAW,EAAE,sPAAsP;QACnQ,aAAa,EAAE,uhBAAuhB;KACviB;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,UAAU,EAAE,wCAAwC;QACpD,WAAW,EAAE,gNAAgN;QAC7N,aAAa,EAAE,wSAAwS;KACxT;IACD;QACE,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE,kCAAkC;QAC9C,WAAW,EAAE,mDAAmD;QAChE,aAAa,EAAE,uGAAuG;KACvH;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,UAAU,EAAE,uCAAuC;QACnD,WAAW,EAAE,kCAAkC;QAC/C,aAAa,EAAE,yGAAyG;KACzH;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,UAAU,EAAE,iDAAiD;QAC7D,WAAW,EAAE,qVAAqV;QAClW,aAAa,EAAE,0sBAA0sB;KAC1tB;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,UAAU,EAAE,+BAA+B;QAC3C,WAAW,EAAE,8UAA8U;QAC3V,aAAa,EAAE,24BAA24B;KAC35B;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,UAAU,EAAE,mCAAmC;QAC/C,WAAW,EAAE,gDAAgD;QAC7D,aAAa,EAAE,sGAAsG;KACtH;IACD;QACE,IAAI,EAAE,YAAY;QAClB,UAAU,EAAE,iCAAiC;QAC7C,WAAW,EAAE,2CAA2C;QACxD,aAAa,EAAE,wGAAwG;KACxH;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,UAAU,EAAE,6CAA6C;QACzD,WAAW,EAAE,gCAAgC;QAC7C,aAAa,EAAE,sGAAsG;KACtH;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,UAAU,EAAE,sCAAsC;QAClD,WAAW,EAAE,mDAAmD;QAChE,aAAa,EAAE,8FAA8F;KAC9G;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,UAAU,EAAE,sCAAsC;QAClD,WAAW,EAAE,gDAAgD;QAC7D,aAAa,EAAE,yGAAyG;KACzH;IACD;QACE,IAAI,EAAE,cAAc;QACpB,UAAU,EAAE,sBAAsB;QAClC,WAAW,EAAE,iEAAiE;QAC9E,aAAa,EAAE,sDAAsD;KACtE;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,UAAU,EAAE,uCAAuC;QACnD,WAAW,EAAE,oEAAoE;QACjF,aAAa,EAAE,yDAAyD;KACzE;IACD;QACE,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE,kCAAkC;QAC9C,WAAW,EAAE,8EAA8E;QAC3F,aAAa,EAAE,qNAAqN;KACrO;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,UAAU,EAAE,uDAAuD;QACnE,WAAW,EAAE,wPAAwP;QACrQ,aAAa,EAAE,srBAAsrB;KACtsB;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,UAAU,EAAE,sDAAsD;QAClE,WAAW,EAAE,sMAAsM;QACnN,aAAa,EAAE,2hBAA2hB;KAC3iB;IACD;QACE,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE,uBAAuB;QACnC,WAAW,EAAE,+EAA+E;QAC5F,aAAa,EAAE,yNAAyN;KACzO;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,UAAU,EAAE,+CAA+C;QAC3D,WAAW,EAAE,uLAAuL;QACpM,aAAa,EAAE,otBAAotB;KACpuB;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,UAAU,EAAE,4BAA4B;QACxC,WAAW,EAAE,mEAAmE;QAChF,aAAa,EAAE,mOAAmO;KACnP;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,UAAU,EAAE,4CAA4C;QACxD,WAAW,EAAE,qPAAqP;QAClQ,aAAa,EAAE,gZAAgZ;KACha;IACD;QACE,IAAI,EAAE,aAAa;QACnB,UAAU,EAAE,gCAAgC;QAC5C,WAAW,EAAE,wJAAwJ;QACrK,aAAa,EAAE,wnBAAwnB;KACxoB;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,UAAU,EAAE,+CAA+C;QAC3D,WAAW,EAAE,+MAA+M;QAC5N,aAAa,EAAE,69BAA69B;KAC7+B;IACD,gFAAgF;IAChF,+EAA+E;IAC/E,8EAA8E;IAC9E,gFAAgF;IAChF,0EAA0E;IAC1E,kFAAkF;IAClF,mFAAmF;IACnF,oFAAoF;IACpF,oFAAoF;IACpF,qFAAqF;IACrF,6EAA6E;IAC7E,+EAA+E;IAC/E,iFAAiF;IACjF,+EAA+E;IAC/E,2EAA2E;IAC3E,gFAAgF;IAChF,iFAAiF;IACjF,+EAA+E;IAC/E;QACE,IAAI,EAAE,aAAa;QACnB,UAAU,EAAE,uCAAuC;QACnD,WAAW,EAAE,+IAA+I;QAC5J,aAAa,EAAE,8YAA8Y;KAC9Z;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,UAAU,EAAE,qCAAqC;QACjD,WAAW,EAAE,6OAA6O;QAC1P,aAAa,EAAE,gdAAgd;KAChe;IACD;QACE,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE,yCAAyC;QACrD,WAAW,EAAE,8JAA8J;QAC3K,aAAa,EAAE,0aAA0a;KAC1b;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,UAAU,EAAE,4CAA4C;QACxD,WAAW,EAAE,4RAA4R;QACzS,aAAa,EAAE,+uBAA+uB;KAC/vB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,UAAU,EAAE,0CAA0C;QACtD,WAAW,EAAE,2MAA2M;QACxN,aAAa,EAAE,gcAAgc;KAChd;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,UAAU,EAAE,sCAAsC;QAClD,WAAW,EAAE,wMAAwM;QACrN,aAAa,EAAE,muBAAmuB;KACnvB;IACD;QACE,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE,yCAAyC;QACrD,WAAW,EAAE,0OAA0O;QACvP,aAAa,EAAE,mcAAmc;KACnd;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,UAAU,EAAE,4CAA4C;QACxD,WAAW,EAAE,kPAAkP;QAC/P,aAAa,EAAE,+oBAA+oB;KAC/pB;IACD;QACE,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE,yCAAyC;QACrD,WAAW,EAAE,wGAAwG;QACrH,aAAa,EAAE,qRAAqR;KACrS;IACD;QACE,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE,yCAAyC;QACrD,WAAW,EAAE,2UAA2U;QACxV,aAAa,EAAE,qTAAqT;KACrU;IACD;QACE,IAAI,EAAE,cAAc;QACpB,UAAU,EAAE,iCAAiC;QAC7C,WAAW,EAAE,gNAAgN;QAC7N,aAAa,EAAE,gpBAAgpB;KAChqB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,UAAU,EAAE,mCAAmC;QAC/C,WAAW,EAAE,2ZAA2Z;QACxa,aAAa,EAAE,+lBAA+lB;KAC/mB;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,UAAU,EAAE,uCAAuC;QACnD,WAAW,EAAE,0RAA0R;QACvS,aAAa,EAAE,ynBAAynB;KACzoB;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,UAAU,EAAE,uCAAuC;QACnD,WAAW,EAAE,+TAA+T;QAC5U,aAAa,EAAE,o3BAAo3B;KACp4B;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,UAAU,EAAE,2CAA2C;QACvD,WAAW,EACT,+bAA+b;QACjc,aAAa,EACX,6rBAA6rB;KAChsB;IACD;QACE,IAAI,EAAE,wCAAwC;QAC9C,UAAU,EAAE,4DAA4D;QACxE,WAAW,EACT,2KAA2K;QAC7K,aAAa,EACX,2OAA2O;KAC9O;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,UAAU,EAAE,8CAA8C;QAC1D,WAAW,EACT,6IAA6I;QAC/I,aAAa,EACX,uKAAuK;KAC1K;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,UAAU,EAAE,qCAAqC;QACjD,WAAW,EACT,0IAA0I;QAC5I,aAAa,EACX,ieAAie;KACpe;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,UAAU,EAAE,yCAAyC;QACrD,WAAW,EACT,6HAA6H;QAC/H,aAAa,EACX,8UAA8U;KACjV;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,UAAU,EAAE,oDAAoD;QAChE,WAAW,EACT,mYAAmY;QACrY,aAAa,EACX,myBAAmyB;KACtyB;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,UAAU,EAAE,0CAA0C;QACtD,WAAW,EACT,iWAAiW;QACnW,aAAa,EACX,s7BAAs7B;KACz7B;IACD;QACE,IAAI,EAAE,aAAa;QACnB,UAAU,EAAE,gCAAgC;QAC5C,WAAW,EACT,kKAAkK;QACpK,aAAa,EACX,wiBAAwiB;KAC3iB;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,UAAU,EAAE,0CAA0C;QACtD,WAAW,EACT,2OAA2O;QAC7O,aAAa,EACX,gqBAAgqB;KACnqB;IACD,gFAAgF;IAChF,iFAAiF;IACjF,yEAAyE;IACzE,gFAAgF;IAChF;QACE,IAAI,EAAE,sBAAsB;QAC5B,UAAU,EAAE,yCAAyC;QACrD,WAAW,EAAE,qFAAqF;QAClG,aAAa,EAAE,mOAAmO;KACnP;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,UAAU,EAAE,iDAAiD;QAC7D,WAAW,EAAE,mKAAmK;QAChL,aAAa,EAAE,4fAA4f;KAC5gB;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,UAAU,EAAE,wCAAwC;QACpD,WAAW,EAAE,2LAA2L;QACxM,aAAa,EAAE,8wBAA8wB;KAC9xB;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,UAAU,EAAE,oCAAoC;QAChD,WAAW,EAAE,mFAAmF;QAChG,aAAa,EAAE,uWAAuW;KACvX;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,UAAU,EAAE,qCAAqC;QACjD,WAAW,EAAE,yEAAyE;QACtF,aAAa,EAAE,6cAA6c;KAC7d;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,UAAU,EAAE,qCAAqC;QACjD,WAAW,EAAE,+EAA+E;QAC5F,aAAa,EAAE,4MAA4M;KAC5N;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,UAAU,EAAE,2CAA2C;QACvD,WAAW,EAAE,2JAA2J;QACxK,aAAa,EAAE,0VAA0V;KAC1W;IACD,kFAAkF;IAClF,kFAAkF;IAClF,0EAA0E;IAC1E,oFAAoF;IACpF,qFAAqF;IACrF,sFAAsF;IACtF,8EAA8E;IAC9E,6EAA6E;IAC7E,sFAAsF;IACtF,qFAAqF;IACrF,qFAAqF;IACrF,oFAAoF;IACpF,kEAAkE;IAClE,gFAAgF;IAChF,mFAAmF;IACnF,oDAAoD;IACpD;QACE,IAAI,EAAE,sBAAsB;QAC5B,UAAU,EAAE,4CAA4C;QACxD,WAAW,EAAE,yFAAyF;QACtG,aAAa,EAAE,6WAA6W;KAC7X;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,UAAU,EAAE,8CAA8C;QAC1D,WAAW,EAAE,+GAA+G;QAC5H,aAAa,EAAE,waAAwa;KACxb;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,UAAU,EAAE,0CAA0C;QACtD,WAAW,EAAE,uHAAuH;QACpI,aAAa,EAAE,6UAA6U;KAC7V;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,UAAU,EAAE,0CAA0C;QACtD,WAAW,EAAE,4HAA4H;QACzI,aAAa,EAAE,qVAAqV;KACrW;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,UAAU,EAAE,iDAAiD;QAC7D,WAAW,EAAE,qIAAqI;QAClJ,aAAa,EAAE,2bAA2b;KAC3c;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,UAAU,EAAE,6CAA6C;QACzD,WAAW,EAAE,kHAAkH;QAC/H,aAAa,EAAE,0aAA0a;KAC1b;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,UAAU,EAAE,8CAA8C;QAC1D,WAAW,EAAE,kHAAkH;QAC/H,aAAa,EAAE,kjBAAkjB;KAClkB;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,UAAU,EAAE,gDAAgD;QAC5D,WAAW,EAAE,+QAA+Q;QAC5R,aAAa,EAAE,2hBAA2hB;KAC3iB;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,UAAU,EAAE,oDAAoD;QAChE,WAAW,EAAE,8VAA8V;QAC3W,aAAa,EAAE,wkBAAwkB;KACxlB;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,UAAU,EAAE,8CAA8C;QAC1D,WAAW,EAAE,2dAA2d;QACxe,aAAa,EAAE,2oBAA2oB;KAC3pB;IACD,gFAAgF;IAChF,sFAAsF;IACtF,qFAAqF;IACrF,uFAAuF;IACvF,8DAA8D;IAC9D;QACE,IAAI,EAAE,4BAA4B;QAClC,UAAU,EAAE,gDAAgD;QAC5D,WAAW,EAAE,wMAAwM;QACrN,aAAa,EAAE,skBAAskB;KACtlB;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,UAAU,EAAE,kDAAkD;QAC9D,WAAW,EAAE,2NAA2N;QACxO,aAAa,EAAE,mgBAAmgB;KACnhB;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,UAAU,EAAE,sCAAsC;QAClD,WAAW,EAAE,iPAAiP;QAC9P,aAAa,EAAE,4nBAA4nB;KAC5oB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,UAAU,EAAE,yCAAyC;QACrD,WAAW,EAAE,wfAAwf;QACrgB,aAAa,EAAE,8nBAA8nB;KAC9oB;CACF,CAAC;AA0CF,MAAM,CAAC,MAAM,oBAAoB,GAAwB;IACvD,+EAA+E;IAC/E;QACE,UAAU,EAAE,kCAAkC;QAC9C,QAAQ,EAAE,aAAa;QACvB,MAAM,EAAE,+CAA+C;KACxD;IACD;QACE,UAAU,EAAE,wCAAwC;QACpD,QAAQ,EAAE,aAAa;QACvB,MAAM,EAAE,iDAAiD;KAC1D;IACD;QACE,UAAU,EAAE,qCAAqC;QACjD,QAAQ,EAAE,aAAa;QACvB,MAAM,EAAE,+CAA+C;KACxD;IACD,gFAAgF;IAChF,+EAA+E;IAC/E,oFAAoF;IACpF,6DAA6D;IAC7D,wEAAwE;IACxE;QACE,UAAU,EAAE,8BAA8B;QAC1C,QAAQ,EAAE,cAAc;QACxB,MAAM,EAAE,mDAAmD;KAC5D;IACD;QACE,UAAU,EAAE,gCAAgC;QAC5C,QAAQ,EAAE,cAAc;QACxB,MAAM,EAAE,iIAAiI;KAC1I;IACD;QACE,UAAU,EAAE,qCAAqC;QACjD,QAAQ,EAAE,cAAc;QACxB,MAAM,EAAE,gGAAgG;KACzG;IACD,uFAAuF;IACvF;QACE,UAAU,EAAE,qDAAqD;QACjE,QAAQ,EAAE,iBAAiB;QAC3B,MAAM,EAAE,kCAAkC;KAC3C;IACD;QACE,UAAU,EAAE,2CAA2C;QACvD,QAAQ,EAAE,iBAAiB;QAC3B,MAAM,EAAE,kCAAkC;KAC3C;IACD;QACE,UAAU,EAAE,+BAA+B;QAC3C,QAAQ,EAAE,iBAAiB;QAC3B,MAAM,EAAE,qDAAqD;KAC9D;IACD;QACE,UAAU,EAAE,6BAA6B;QACzC,QAAQ,EAAE,iBAAiB;QAC3B,MAAM,EAAE,oZAAoZ;KAC7Z;IACD,qDAAqD;IACrD;QACE,UAAU,EAAE,kCAAkC;QAC9C,QAAQ,EAAE,sBAAsB;QAChC,MAAM,EAAE,8CAA8C;KACvD;IACD;QACE,UAAU,EAAE,+CAA+C;QAC3D,QAAQ,EAAE,sBAAsB;QAChC,MAAM,EAAE,kGAAkG;KAC3G;IACD;QACE,UAAU,EAAE,mDAAmD;QAC/D,QAAQ,EAAE,sBAAsB;QAChC,MAAM,EAAE,+FAA+F;KACxG;IACD;QACE,UAAU,EAAE,wDAAwD;QACpE,QAAQ,EAAE,sBAAsB;QAChC,MAAM,EAAE,kPAAkP;KAC3P;IACD,8EAA8E;IAC9E,kFAAkF;IAClF,iFAAiF;IACjF,gFAAgF;IAChF,mFAAmF;IACnF,6EAA6E;IAC7E,oFAAoF;IACpF,sFAAsF;IACtF,8EAA8E;IAC9E,+EAA+E;IAC/E,6EAA6E;IAC7E,iFAAiF;IACjF;QACE,UAAU,EAAE,qCAAqC;QACjD,QAAQ,EAAE,gBAAgB;QAC1B,MAAM,EAAE,4RAA4R;KACrS;IACD;QACE,UAAU,EAAE,wDAAwD;QACpE,QAAQ,EAAE,gBAAgB;QAC1B,MAAM,EAAE,4dAA4d;KACre;IACD;QACE,UAAU,EAAE,4DAA4D;QACxE,QAAQ,EAAE,gBAAgB;QAC1B,MAAM,EAAE,scAAsc;KAC/c;IACD;QACE,UAAU,EAAE,oDAAoD;QAChE,QAAQ,EAAE,gBAAgB;QAC1B,MAAM,EAAE,inBAAinB;KAC1nB;IACD;QACE,UAAU,EAAE,6DAA6D;QACzE,QAAQ,EAAE,gBAAgB;QAC1B,MAAM,EACJ,irBAAirB;KACprB;IACD;QACE,UAAU,EAAE,+BAA+B;QAC3C,QAAQ,EAAE,gBAAgB;QAC1B,MAAM,EAAE,uMAAuM;KAChN;IACD;QACE,UAAU,EAAE,kDAAkD;QAC9D,QAAQ,EAAE,gBAAgB;QAC1B,MAAM,EAAE,ymBAAymB;KAClnB;IACD;QACE,UAAU,EAAE,2CAA2C;QACvD,QAAQ,EAAE,gBAAgB;QAC1B,MAAM,EAAE,gXAAgX;KACzX;IACD;QACE,UAAU,EAAE,6CAA6C;QACzD,QAAQ,EAAE,gBAAgB;QAC1B,MAAM,EAAE,uVAAuV;KAChW;IACD,sDAAsD;IACtD;QACE,UAAU,EAAE,uCAAuC;QACnD,QAAQ,EAAE,cAAc;QACxB,MAAM,EAAE,wXAAwX;KACjY;IACD,gFAAgF;IAChF,uFAAuF;IACvF;QACE,UAAU,EAAE,gBAAgB;QAC5B,QAAQ,EAAE,sBAAsB;QAChC,MAAM,EAAE,8NAA8N;KACvO;IACD;QACE,UAAU,EAAE,gBAAgB;QAC5B,QAAQ,EAAE,sBAAsB;QAChC,MAAM,EAAE,gQAAgQ;KACzQ;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,MAAe,EAAE,UAAkB;IACjE,IAAI,GAAG,GAAY,MAAM,CAAC;IAC1B,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,IAAI,GAAG,IAAI,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC7D,GAAG,GAAI,GAA+B,CAAC,GAAG,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"devGatedFeatures.js","sourceRoot":"","sources":["../../src/core/devGatedFeatures.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAoBH,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD;QACE,IAAI,EAAE,yBAAyB;QAC/B,UAAU,EAAE,6CAA6C;QACzD,WAAW,EAAE,+MAA+M;QAC5N,aAAa,EAAE,ikBAAikB;KACjlB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,UAAU,EAAE,iCAAiC;QAC7C,WAAW,EAAE,sPAAsP;QACnQ,aAAa,EAAE,uhBAAuhB;KACviB;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,UAAU,EAAE,wCAAwC;QACpD,WAAW,EAAE,gNAAgN;QAC7N,aAAa,EAAE,wSAAwS;KACxT;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,UAAU,EAAE,uCAAuC;QACnD,WAAW,EAAE,uQAAuQ;QACpR,aAAa,EAAE,i8BAAi8B;KACj9B;IACD;QACE,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE,kCAAkC;QAC9C,WAAW,EAAE,mDAAmD;QAChE,aAAa,EAAE,uGAAuG;KACvH;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,UAAU,EAAE,uCAAuC;QACnD,WAAW,EAAE,kCAAkC;QAC/C,aAAa,EAAE,yGAAyG;KACzH;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,UAAU,EAAE,iDAAiD;QAC7D,WAAW,EAAE,qVAAqV;QAClW,aAAa,EAAE,0sBAA0sB;KAC1tB;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,UAAU,EAAE,+BAA+B;QAC3C,WAAW,EAAE,8UAA8U;QAC3V,aAAa,EAAE,24BAA24B;KAC35B;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,UAAU,EAAE,mCAAmC;QAC/C,WAAW,EAAE,gDAAgD;QAC7D,aAAa,EAAE,sGAAsG;KACtH;IACD;QACE,IAAI,EAAE,YAAY;QAClB,UAAU,EAAE,iCAAiC;QAC7C,WAAW,EAAE,2CAA2C;QACxD,aAAa,EAAE,wGAAwG;KACxH;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,UAAU,EAAE,6CAA6C;QACzD,WAAW,EAAE,gCAAgC;QAC7C,aAAa,EAAE,sGAAsG;KACtH;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,UAAU,EAAE,sCAAsC;QAClD,WAAW,EAAE,mDAAmD;QAChE,aAAa,EAAE,8FAA8F;KAC9G;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,UAAU,EAAE,sCAAsC;QAClD,WAAW,EAAE,gDAAgD;QAC7D,aAAa,EAAE,yGAAyG;KACzH;IACD;QACE,IAAI,EAAE,cAAc;QACpB,UAAU,EAAE,sBAAsB;QAClC,WAAW,EAAE,iEAAiE;QAC9E,aAAa,EAAE,sDAAsD;KACtE;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,UAAU,EAAE,uCAAuC;QACnD,WAAW,EAAE,oEAAoE;QACjF,aAAa,EAAE,yDAAyD;KACzE;IACD;QACE,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE,kCAAkC;QAC9C,WAAW,EAAE,8EAA8E;QAC3F,aAAa,EAAE,qNAAqN;KACrO;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,UAAU,EAAE,uDAAuD;QACnE,WAAW,EAAE,wPAAwP;QACrQ,aAAa,EAAE,srBAAsrB;KACtsB;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,UAAU,EAAE,sDAAsD;QAClE,WAAW,EAAE,sMAAsM;QACnN,aAAa,EAAE,2hBAA2hB;KAC3iB;IACD;QACE,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE,uBAAuB;QACnC,WAAW,EAAE,+EAA+E;QAC5F,aAAa,EAAE,yNAAyN;KACzO;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,UAAU,EAAE,+CAA+C;QAC3D,WAAW,EAAE,uLAAuL;QACpM,aAAa,EAAE,otBAAotB;KACpuB;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,UAAU,EAAE,4BAA4B;QACxC,WAAW,EAAE,mEAAmE;QAChF,aAAa,EAAE,mOAAmO;KACnP;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,UAAU,EAAE,4CAA4C;QACxD,WAAW,EAAE,qPAAqP;QAClQ,aAAa,EAAE,gZAAgZ;KACha;IACD;QACE,IAAI,EAAE,aAAa;QACnB,UAAU,EAAE,gCAAgC;QAC5C,WAAW,EAAE,wJAAwJ;QACrK,aAAa,EAAE,wnBAAwnB;KACxoB;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,UAAU,EAAE,+CAA+C;QAC3D,WAAW,EAAE,+MAA+M;QAC5N,aAAa,EAAE,69BAA69B;KAC7+B;IACD,gFAAgF;IAChF,+EAA+E;IAC/E,8EAA8E;IAC9E,gFAAgF;IAChF,0EAA0E;IAC1E,kFAAkF;IAClF,mFAAmF;IACnF,oFAAoF;IACpF,oFAAoF;IACpF,qFAAqF;IACrF,6EAA6E;IAC7E,+EAA+E;IAC/E,iFAAiF;IACjF,+EAA+E;IAC/E,2EAA2E;IAC3E,gFAAgF;IAChF,iFAAiF;IACjF,+EAA+E;IAC/E;QACE,IAAI,EAAE,aAAa;QACnB,UAAU,EAAE,uCAAuC;QACnD,WAAW,EAAE,+IAA+I;QAC5J,aAAa,EAAE,8YAA8Y;KAC9Z;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,UAAU,EAAE,qCAAqC;QACjD,WAAW,EAAE,6OAA6O;QAC1P,aAAa,EAAE,gdAAgd;KAChe;IACD;QACE,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE,yCAAyC;QACrD,WAAW,EAAE,8JAA8J;QAC3K,aAAa,EAAE,0aAA0a;KAC1b;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,UAAU,EAAE,4CAA4C;QACxD,WAAW,EAAE,4RAA4R;QACzS,aAAa,EAAE,+uBAA+uB;KAC/vB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,UAAU,EAAE,0CAA0C;QACtD,WAAW,EAAE,2MAA2M;QACxN,aAAa,EAAE,gcAAgc;KAChd;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,UAAU,EAAE,sCAAsC;QAClD,WAAW,EAAE,wMAAwM;QACrN,aAAa,EAAE,muBAAmuB;KACnvB;IACD;QACE,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE,yCAAyC;QACrD,WAAW,EAAE,0OAA0O;QACvP,aAAa,EAAE,mcAAmc;KACnd;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,UAAU,EAAE,4CAA4C;QACxD,WAAW,EAAE,kPAAkP;QAC/P,aAAa,EAAE,+oBAA+oB;KAC/pB;IACD;QACE,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE,yCAAyC;QACrD,WAAW,EAAE,wGAAwG;QACrH,aAAa,EAAE,qRAAqR;KACrS;IACD;QACE,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE,yCAAyC;QACrD,WAAW,EAAE,2UAA2U;QACxV,aAAa,EAAE,qTAAqT;KACrU;IACD;QACE,IAAI,EAAE,cAAc;QACpB,UAAU,EAAE,iCAAiC;QAC7C,WAAW,EAAE,gNAAgN;QAC7N,aAAa,EAAE,gpBAAgpB;KAChqB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,UAAU,EAAE,mCAAmC;QAC/C,WAAW,EAAE,2ZAA2Z;QACxa,aAAa,EAAE,+lBAA+lB;KAC/mB;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,UAAU,EAAE,uCAAuC;QACnD,WAAW,EAAE,0RAA0R;QACvS,aAAa,EAAE,ynBAAynB;KACzoB;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,UAAU,EAAE,uCAAuC;QACnD,WAAW,EAAE,+TAA+T;QAC5U,aAAa,EAAE,o3BAAo3B;KACp4B;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,UAAU,EAAE,2CAA2C;QACvD,WAAW,EACT,+bAA+b;QACjc,aAAa,EACX,6rBAA6rB;KAChsB;IACD;QACE,IAAI,EAAE,wCAAwC;QAC9C,UAAU,EAAE,4DAA4D;QACxE,WAAW,EACT,2KAA2K;QAC7K,aAAa,EACX,2OAA2O;KAC9O;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,UAAU,EAAE,8CAA8C;QAC1D,WAAW,EACT,6IAA6I;QAC/I,aAAa,EACX,uKAAuK;KAC1K;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,UAAU,EAAE,qCAAqC;QACjD,WAAW,EACT,0IAA0I;QAC5I,aAAa,EACX,ieAAie;KACpe;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,UAAU,EAAE,yCAAyC;QACrD,WAAW,EACT,6HAA6H;QAC/H,aAAa,EACX,8UAA8U;KACjV;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,UAAU,EAAE,oDAAoD;QAChE,WAAW,EACT,mYAAmY;QACrY,aAAa,EACX,myBAAmyB;KACtyB;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,UAAU,EAAE,0CAA0C;QACtD,WAAW,EACT,iWAAiW;QACnW,aAAa,EACX,s7BAAs7B;KACz7B;IACD;QACE,IAAI,EAAE,aAAa;QACnB,UAAU,EAAE,gCAAgC;QAC5C,WAAW,EACT,kKAAkK;QACpK,aAAa,EACX,wiBAAwiB;KAC3iB;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,UAAU,EAAE,0CAA0C;QACtD,WAAW,EACT,2OAA2O;QAC7O,aAAa,EACX,gqBAAgqB;KACnqB;IACD,gFAAgF;IAChF,iFAAiF;IACjF,yEAAyE;IACzE,gFAAgF;IAChF;QACE,IAAI,EAAE,sBAAsB;QAC5B,UAAU,EAAE,yCAAyC;QACrD,WAAW,EAAE,qFAAqF;QAClG,aAAa,EAAE,mOAAmO;KACnP;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,UAAU,EAAE,iDAAiD;QAC7D,WAAW,EAAE,mKAAmK;QAChL,aAAa,EAAE,4fAA4f;KAC5gB;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,UAAU,EAAE,wCAAwC;QACpD,WAAW,EAAE,2LAA2L;QACxM,aAAa,EAAE,8wBAA8wB;KAC9xB;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,UAAU,EAAE,oCAAoC;QAChD,WAAW,EAAE,mFAAmF;QAChG,aAAa,EAAE,uWAAuW;KACvX;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,UAAU,EAAE,qCAAqC;QACjD,WAAW,EAAE,yEAAyE;QACtF,aAAa,EAAE,6cAA6c;KAC7d;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,UAAU,EAAE,qCAAqC;QACjD,WAAW,EAAE,+EAA+E;QAC5F,aAAa,EAAE,4MAA4M;KAC5N;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,UAAU,EAAE,2CAA2C;QACvD,WAAW,EAAE,2JAA2J;QACxK,aAAa,EAAE,0VAA0V;KAC1W;IACD,kFAAkF;IAClF,kFAAkF;IAClF,0EAA0E;IAC1E,oFAAoF;IACpF,qFAAqF;IACrF,sFAAsF;IACtF,8EAA8E;IAC9E,6EAA6E;IAC7E,sFAAsF;IACtF,qFAAqF;IACrF,qFAAqF;IACrF,oFAAoF;IACpF,kEAAkE;IAClE,gFAAgF;IAChF,mFAAmF;IACnF,oDAAoD;IACpD;QACE,IAAI,EAAE,sBAAsB;QAC5B,UAAU,EAAE,4CAA4C;QACxD,WAAW,EAAE,yFAAyF;QACtG,aAAa,EAAE,6WAA6W;KAC7X;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,UAAU,EAAE,8CAA8C;QAC1D,WAAW,EAAE,+GAA+G;QAC5H,aAAa,EAAE,waAAwa;KACxb;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,UAAU,EAAE,0CAA0C;QACtD,WAAW,EAAE,uHAAuH;QACpI,aAAa,EAAE,6UAA6U;KAC7V;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,UAAU,EAAE,0CAA0C;QACtD,WAAW,EAAE,4HAA4H;QACzI,aAAa,EAAE,qVAAqV;KACrW;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,UAAU,EAAE,iDAAiD;QAC7D,WAAW,EAAE,qIAAqI;QAClJ,aAAa,EAAE,2bAA2b;KAC3c;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,UAAU,EAAE,6CAA6C;QACzD,WAAW,EAAE,kHAAkH;QAC/H,aAAa,EAAE,0aAA0a;KAC1b;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,UAAU,EAAE,8CAA8C;QAC1D,WAAW,EAAE,kHAAkH;QAC/H,aAAa,EAAE,kjBAAkjB;KAClkB;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,UAAU,EAAE,gDAAgD;QAC5D,WAAW,EAAE,+QAA+Q;QAC5R,aAAa,EAAE,2hBAA2hB;KAC3iB;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,UAAU,EAAE,oDAAoD;QAChE,WAAW,EAAE,8VAA8V;QAC3W,aAAa,EAAE,wkBAAwkB;KACxlB;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,UAAU,EAAE,8CAA8C;QAC1D,WAAW,EAAE,2dAA2d;QACxe,aAAa,EAAE,2oBAA2oB;KAC3pB;IACD,gFAAgF;IAChF,sFAAsF;IACtF,qFAAqF;IACrF,uFAAuF;IACvF,8DAA8D;IAC9D;QACE,IAAI,EAAE,4BAA4B;QAClC,UAAU,EAAE,gDAAgD;QAC5D,WAAW,EAAE,wMAAwM;QACrN,aAAa,EAAE,skBAAskB;KACtlB;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,UAAU,EAAE,kDAAkD;QAC9D,WAAW,EAAE,2NAA2N;QACxO,aAAa,EAAE,mgBAAmgB;KACnhB;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,UAAU,EAAE,sCAAsC;QAClD,WAAW,EAAE,iPAAiP;QAC9P,aAAa,EAAE,4nBAA4nB;KAC5oB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,UAAU,EAAE,yCAAyC;QACrD,WAAW,EAAE,wfAAwf;QACrgB,aAAa,EAAE,8nBAA8nB;KAC9oB;CACF,CAAC;AA0CF,MAAM,CAAC,MAAM,oBAAoB,GAAwB;IACvD,+EAA+E;IAC/E;QACE,UAAU,EAAE,kCAAkC;QAC9C,QAAQ,EAAE,aAAa;QACvB,MAAM,EAAE,+CAA+C;KACxD;IACD;QACE,UAAU,EAAE,wCAAwC;QACpD,QAAQ,EAAE,aAAa;QACvB,MAAM,EAAE,iDAAiD;KAC1D;IACD;QACE,UAAU,EAAE,qCAAqC;QACjD,QAAQ,EAAE,aAAa;QACvB,MAAM,EAAE,+CAA+C;KACxD;IACD,gFAAgF;IAChF,+EAA+E;IAC/E,oFAAoF;IACpF,6DAA6D;IAC7D,wEAAwE;IACxE;QACE,UAAU,EAAE,8BAA8B;QAC1C,QAAQ,EAAE,cAAc;QACxB,MAAM,EAAE,mDAAmD;KAC5D;IACD;QACE,UAAU,EAAE,gCAAgC;QAC5C,QAAQ,EAAE,cAAc;QACxB,MAAM,EAAE,iIAAiI;KAC1I;IACD;QACE,UAAU,EAAE,qCAAqC;QACjD,QAAQ,EAAE,cAAc;QACxB,MAAM,EAAE,gGAAgG;KACzG;IACD,uFAAuF;IACvF;QACE,UAAU,EAAE,qDAAqD;QACjE,QAAQ,EAAE,iBAAiB;QAC3B,MAAM,EAAE,kCAAkC;KAC3C;IACD;QACE,UAAU,EAAE,2CAA2C;QACvD,QAAQ,EAAE,iBAAiB;QAC3B,MAAM,EAAE,kCAAkC;KAC3C;IACD;QACE,UAAU,EAAE,+BAA+B;QAC3C,QAAQ,EAAE,iBAAiB;QAC3B,MAAM,EAAE,qDAAqD;KAC9D;IACD;QACE,UAAU,EAAE,6BAA6B;QACzC,QAAQ,EAAE,iBAAiB;QAC3B,MAAM,EAAE,oZAAoZ;KAC7Z;IACD,qDAAqD;IACrD;QACE,UAAU,EAAE,kCAAkC;QAC9C,QAAQ,EAAE,sBAAsB;QAChC,MAAM,EAAE,8CAA8C;KACvD;IACD;QACE,UAAU,EAAE,+CAA+C;QAC3D,QAAQ,EAAE,sBAAsB;QAChC,MAAM,EAAE,kGAAkG;KAC3G;IACD;QACE,UAAU,EAAE,mDAAmD;QAC/D,QAAQ,EAAE,sBAAsB;QAChC,MAAM,EAAE,+FAA+F;KACxG;IACD;QACE,UAAU,EAAE,wDAAwD;QACpE,QAAQ,EAAE,sBAAsB;QAChC,MAAM,EAAE,kPAAkP;KAC3P;IACD,8EAA8E;IAC9E,kFAAkF;IAClF,iFAAiF;IACjF,gFAAgF;IAChF,mFAAmF;IACnF,6EAA6E;IAC7E,oFAAoF;IACpF,sFAAsF;IACtF,8EAA8E;IAC9E,+EAA+E;IAC/E,6EAA6E;IAC7E,iFAAiF;IACjF;QACE,UAAU,EAAE,qCAAqC;QACjD,QAAQ,EAAE,gBAAgB;QAC1B,MAAM,EAAE,4RAA4R;KACrS;IACD;QACE,UAAU,EAAE,wDAAwD;QACpE,QAAQ,EAAE,gBAAgB;QAC1B,MAAM,EAAE,4dAA4d;KACre;IACD;QACE,UAAU,EAAE,4DAA4D;QACxE,QAAQ,EAAE,gBAAgB;QAC1B,MAAM,EAAE,scAAsc;KAC/c;IACD;QACE,UAAU,EAAE,oDAAoD;QAChE,QAAQ,EAAE,gBAAgB;QAC1B,MAAM,EAAE,inBAAinB;KAC1nB;IACD;QACE,UAAU,EAAE,6DAA6D;QACzE,QAAQ,EAAE,gBAAgB;QAC1B,MAAM,EACJ,irBAAirB;KACprB;IACD;QACE,UAAU,EAAE,+BAA+B;QAC3C,QAAQ,EAAE,gBAAgB;QAC1B,MAAM,EAAE,uMAAuM;KAChN;IACD;QACE,UAAU,EAAE,kDAAkD;QAC9D,QAAQ,EAAE,gBAAgB;QAC1B,MAAM,EAAE,ymBAAymB;KAClnB;IACD;QACE,UAAU,EAAE,2CAA2C;QACvD,QAAQ,EAAE,gBAAgB;QAC1B,MAAM,EAAE,gXAAgX;KACzX;IACD;QACE,UAAU,EAAE,6CAA6C;QACzD,QAAQ,EAAE,gBAAgB;QAC1B,MAAM,EAAE,uVAAuV;KAChW;IACD,sDAAsD;IACtD;QACE,UAAU,EAAE,uCAAuC;QACnD,QAAQ,EAAE,cAAc;QACxB,MAAM,EAAE,wXAAwX;KACjY;IACD,gFAAgF;IAChF,uFAAuF;IACvF;QACE,UAAU,EAAE,gBAAgB;QAC5B,QAAQ,EAAE,sBAAsB;QAChC,MAAM,EAAE,8NAA8N;KACvO;IACD;QACE,UAAU,EAAE,gBAAgB;QAC5B,QAAQ,EAAE,sBAAsB;QAChC,MAAM,EAAE,gQAAgQ;KACzQ;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,MAAe,EAAE,UAAkB;IACjE,IAAI,GAAG,GAAY,MAAM,CAAC;IAC1B,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,IAAI,GAAG,IAAI,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC7D,GAAG,GAAI,GAA+B,CAAC,GAAG,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/core/durableSecretScrub.d.ts

@@ -0,0 +1,129 @@
+/**
+ * durableSecretScrub — the ONE shared credential-pattern module + the
+ * metadata-returning `scrubForStore` variant (Durable-Output Hygiene Standard,
+ * "What Persists Must Be Clean" — docs/specs/durable-output-hygiene-standard.md
+ * §2 "Layer B mechanics", rollout step 0).
+ *
+ * WHY this module exists (spec §2, round-1 MATERIAL finding): "the existing
+ * scrubber" was ≥3 diverged inline copies — `scrubSecrets` (src/monitoring/
+ * scrubSecrets.ts), `autonomousHeartbeatScrub` (src/monitoring/), and
+ * `SecretRedactor.BUILTIN_PATTERNS` (src/core/) — already drifted on the
+ * Anthropic key prefix (`sk-ant-api…` vs `sk-ant-…`). Building a FOURTH copy for
+ * the durable-output safety floor would bake Class-1 drift into the floor
+ * itself. This is the single authoritative pattern set; Layer B consumes it, and
+ * the existing copies migrate/ratchet to it as a tracked rollout follow-up
+ * (docs/specs/durable-output-hygiene-standard.md §2 rollout step 0).
+ *
+ * WHAT it guarantees (spec §2 "Layer B is the SECURITY FLOOR"): a deterministic,
+ * best-effort SPAN redaction over model output BEFORE it persists into durable
+ * storage. LLM compliance (Layer A, the prompt clause) is probabilistic; this
+ * floor is not. HONEST COVERAGE (spec §1 registry text): KNOWN TOKEN SHAPES
+ * ONLY — the floor catches what matches its patterns; encoded / split /
+ * paraphrased secrets are only reachable by the prompt rule, and against novel
+ * adversarial obfuscation this is BEST-EFFORT, never a reliable standalone
+ * security control.
+ *
+ * FAILURE SEMANTICS (spec §2 "fail-safe-toward-redaction, never fail-open"): on
+ * a scrub exception OR an input over the size bound, the whole field is replaced
+ * with a typed marker (`[REDACTED:scrub-error]` / `[REDACTED:oversize]`) + a
+ * preserved-length note — raw bytes NEVER land because the scrub broke. There is
+ * NO runtime timeout pretense (a synchronous regex pass cannot be preempted
+ * in-process): instead the pinned test asserts a worst-case timing budget on
+ * pathological inputs and forbids non-linear patterns (no nested quantifiers), so
+ * the budget is proven in CI, not hoped at runtime.
+ *
+ * TELEMETRY SAFETY (spec §2 "dry-run leak-path guard"): the returned redaction
+ * metadata carries pattern-kind + offset/length ONLY — NEVER matched bytes,
+ * never surrounding context. A would-redact record that quoted its match would
+ * BE the Class-4 defect, reintroduced by the fix's own soak mode.
+ *
+ * PURE + no I/O: this module is a deterministic, unit-testable function. Config
+ * gating, metrics, provenance markers, and the poisoning alarm live one layer up
+ * in DurableOutputScrubber (src/monitoring/).
+ */
+/** A durable-secret pattern kind — the typed label on every redaction span. */
+export type DurableSecretKind = 'anthropic-key' | 'openai-key' | 'github-token' | 'slack-token' | 'aws-access-key' | 'stripe-key' | 'google-api-key' | 'telegram-bot-token' | 'jwt' | 'pem-private-key' | 'bearer-token' | 'url-embedded-credential' | 'labeled-secret';
+/** A structural failure marker kind (fail-safe path — never a real match). */
+export type DurableScrubFailureKind = 'scrub-error' | 'oversize';
+/** One redacted span. offset/length are in ORIGINAL-text coordinates. NEVER
+ *  carries the matched bytes (telemetry-safety, spec §2). */
+export interface RedactionSpan {
+    kind: DurableSecretKind | DurableScrubFailureKind;
+    /** Byte/char offset in the ORIGINAL input where the redacted span began. */
+    offset: number;
+    /** Length (in chars) of the ORIGINAL span that was replaced. */
+    length: number;
+}
+export interface ScrubForStoreResult {
+    /** The scrubbed text — matched spans replaced with `[REDACTED:<kind>]`. */
+    text: string;
+    /** Structured redaction metadata (spec §2 — kind/offset/length only). */
+    redactions: RedactionSpan[];
+    /** True when the whole field was replaced because the input exceeded the size bound. */
+    truncated?: boolean;
+    /** True when the whole field was replaced because the scrub itself threw. */
+    error?: boolean;
+}
+/** One credential pattern. `group` names the capture group whose span is
+ *  redacted (default 0 = the whole match) so a labelled pair can keep its label
+ *  and redact only the value. Every regex carries `gd` (global + hasIndices) so
+ *  group offsets are read from `match.indices`. */
+interface ScrubPattern {
+    kind: DurableSecretKind;
+    regex: RegExp;
+    group?: number;
+}
+/**
+ * The authoritative pattern set — the UNION of the three pre-existing copies
+ * (spec Frontloaded Decision #1). ORDER MATTERS for overlap resolution: the
+ * more-specific prefix patterns (anthropic before generic openai `sk-`, stripe
+ * `sk_` before generic) sit earlier so the greedy first-wins overlap resolver
+ * labels a span with its most-specific kind.
+ *
+ * LINEARITY CONTRACT (spec §2): every pattern uses SINGLE quantifiers over
+ * character classes with no nesting — no `(x+)+` / `(x*)*` shapes — so a
+ * pathological input cannot trigger catastrophic backtracking. The pinned test
+ * (tests/unit/durableSecretScrub.test.ts) asserts both the per-kind coverage and
+ * a worst-case timing budget on adversarial inputs, and forbids nested
+ * quantifiers structurally.
+ */
+export declare const DURABLE_SECRET_PATTERNS: readonly ScrubPattern[];
+/** Default input size bound (spec §2: 1 MB). Over this, the whole field is
+ *  replaced with `[REDACTED:oversize]` (fail-safe — never persist raw bytes the
+ *  scrub could not fully walk). */
+export declare const DEFAULT_MAX_SCRUB_BYTES = 1000000;
+export interface ScrubForStoreOptions {
+    /** Input size bound in chars. Over this → whole-field `[REDACTED:oversize]`. */
+    maxBytes?: number;
+}
+/**
+ * scrubForStore — the metadata-returning safety-floor scrub (spec §2).
+ *
+ * Replaces every matched credential span with a typed `[REDACTED:<kind>]` marker
+ * and returns the structured redaction metadata (kind/offset/length ONLY, never
+ * the matched bytes). Fail-safe on both edges:
+ *   - input over `maxBytes` → whole field `[REDACTED:oversize]` (truncated:true);
+ *   - any internal throw     → whole field `[REDACTED:scrub-error]` (error:true).
+ *
+ * A benign string with no matches returns `{ text: <unchanged>, redactions: [] }`.
+ */
+export declare function scrubForStore(input: string, options?: ScrubForStoreOptions): ScrubForStoreResult;
+/**
+ * scrubStructured — apply the floor to every string field of a shallow record,
+ * returning the scrubbed record + the union of redactions (each tagged with its
+ * field). Used by structured stores (spec §2: "Scrub runs BEFORE serialization
+ * where the store writes structured fields"). Non-string fields pass through
+ * untouched; string-array fields are scrubbed element-wise.
+ */
+export interface StructuredRedactionSpan extends RedactionSpan {
+    field: string;
+}
+export interface ScrubStructuredResult<T> {
+    record: T;
+    redactions: StructuredRedactionSpan[];
+    truncated: boolean;
+    error: boolean;
+}
+export declare function scrubStructured<T extends Record<string, unknown>>(record: T, fields: readonly (keyof T)[], options?: ScrubForStoreOptions): ScrubStructuredResult<T>;
+export {};
+//# sourceMappingURL=durableSecretScrub.d.ts.map

package/dist/core/durableSecretScrub.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"durableSecretScrub.d.ts","sourceRoot":"","sources":["../../src/core/durableSecretScrub.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,+EAA+E;AAC/E,MAAM,MAAM,iBAAiB,GACzB,eAAe,GACf,YAAY,GACZ,cAAc,GACd,aAAa,GACb,gBAAgB,GAChB,YAAY,GACZ,gBAAgB,GAChB,oBAAoB,GACpB,KAAK,GACL,iBAAiB,GACjB,cAAc,GACd,yBAAyB,GACzB,gBAAgB,CAAC;AAErB,8EAA8E;AAC9E,MAAM,MAAM,uBAAuB,GAAG,aAAa,GAAG,UAAU,CAAC;AAEjE;6DAC6D;AAC7D,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,iBAAiB,GAAG,uBAAuB,CAAC;IAClD,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,UAAU,EAAE,aAAa,EAAE,CAAC;IAC5B,wFAAwF;IACxF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;mDAGmD;AACnD,UAAU,YAAY;IACpB,IAAI,EAAE,iBAAiB,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,uBAAuB,EAAE,SAAS,YAAY,EA2CjD,CAAC;AAEX;;mCAEmC;AACnC,eAAO,MAAM,uBAAuB,UAAY,CAAC;AAEjD,MAAM,WAAW,oBAAoB;IACnC,gFAAgF;IAChF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAaD;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,oBAAyB,GACjC,mBAAmB,CAmErB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,uBAAwB,SAAQ,aAAa;IAC5D,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,qBAAqB,CAAC,CAAC;IACtC,MAAM,EAAE,CAAC,CAAC;IACV,UAAU,EAAE,uBAAuB,EAAE,CAAC;IACtC,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,wBAAgB,eAAe,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/D,MAAM,EAAE,CAAC,EACT,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,EAC5B,OAAO,GAAE,oBAAyB,GACjC,qBAAqB,CAAC,CAAC,CAAC,CA4B1B"}

package/dist/core/durableSecretScrub.js

@@ -0,0 +1,220 @@
+/**
+ * durableSecretScrub — the ONE shared credential-pattern module + the
+ * metadata-returning `scrubForStore` variant (Durable-Output Hygiene Standard,
+ * "What Persists Must Be Clean" — docs/specs/durable-output-hygiene-standard.md
+ * §2 "Layer B mechanics", rollout step 0).
+ *
+ * WHY this module exists (spec §2, round-1 MATERIAL finding): "the existing
+ * scrubber" was ≥3 diverged inline copies — `scrubSecrets` (src/monitoring/
+ * scrubSecrets.ts), `autonomousHeartbeatScrub` (src/monitoring/), and
+ * `SecretRedactor.BUILTIN_PATTERNS` (src/core/) — already drifted on the
+ * Anthropic key prefix (`sk-ant-api…` vs `sk-ant-…`). Building a FOURTH copy for
+ * the durable-output safety floor would bake Class-1 drift into the floor
+ * itself. This is the single authoritative pattern set; Layer B consumes it, and
+ * the existing copies migrate/ratchet to it as a tracked rollout follow-up
+ * (docs/specs/durable-output-hygiene-standard.md §2 rollout step 0).
+ *
+ * WHAT it guarantees (spec §2 "Layer B is the SECURITY FLOOR"): a deterministic,
+ * best-effort SPAN redaction over model output BEFORE it persists into durable
+ * storage. LLM compliance (Layer A, the prompt clause) is probabilistic; this
+ * floor is not. HONEST COVERAGE (spec §1 registry text): KNOWN TOKEN SHAPES
+ * ONLY — the floor catches what matches its patterns; encoded / split /
+ * paraphrased secrets are only reachable by the prompt rule, and against novel
+ * adversarial obfuscation this is BEST-EFFORT, never a reliable standalone
+ * security control.
+ *
+ * FAILURE SEMANTICS (spec §2 "fail-safe-toward-redaction, never fail-open"): on
+ * a scrub exception OR an input over the size bound, the whole field is replaced
+ * with a typed marker (`[REDACTED:scrub-error]` / `[REDACTED:oversize]`) + a
+ * preserved-length note — raw bytes NEVER land because the scrub broke. There is
+ * NO runtime timeout pretense (a synchronous regex pass cannot be preempted
+ * in-process): instead the pinned test asserts a worst-case timing budget on
+ * pathological inputs and forbids non-linear patterns (no nested quantifiers), so
+ * the budget is proven in CI, not hoped at runtime.
+ *
+ * TELEMETRY SAFETY (spec §2 "dry-run leak-path guard"): the returned redaction
+ * metadata carries pattern-kind + offset/length ONLY — NEVER matched bytes,
+ * never surrounding context. A would-redact record that quoted its match would
+ * BE the Class-4 defect, reintroduced by the fix's own soak mode.
+ *
+ * PURE + no I/O: this module is a deterministic, unit-testable function. Config
+ * gating, metrics, provenance markers, and the poisoning alarm live one layer up
+ * in DurableOutputScrubber (src/monitoring/).
+ */
+/**
+ * The authoritative pattern set — the UNION of the three pre-existing copies
+ * (spec Frontloaded Decision #1). ORDER MATTERS for overlap resolution: the
+ * more-specific prefix patterns (anthropic before generic openai `sk-`, stripe
+ * `sk_` before generic) sit earlier so the greedy first-wins overlap resolver
+ * labels a span with its most-specific kind.
+ *
+ * LINEARITY CONTRACT (spec §2): every pattern uses SINGLE quantifiers over
+ * character classes with no nesting — no `(x+)+` / `(x*)*` shapes — so a
+ * pathological input cannot trigger catastrophic backtracking. The pinned test
+ * (tests/unit/durableSecretScrub.test.ts) asserts both the per-kind coverage and
+ * a worst-case timing budget on adversarial inputs, and forbids nested
+ * quantifiers structurally.
+ */
+export const DURABLE_SECRET_PATTERNS = [
+    // Anthropic API keys — catches BOTH the drifted `sk-ant-api…` and `sk-ant-…`
+    // shapes the three copies disagreed on (spec §2, the Anthropic-prefix drift).
+    { kind: 'anthropic-key', regex: /sk-ant-[A-Za-z0-9_-]{20,}/gd },
+    // Stripe live/test keys (before the generic openai `sk-` — distinct `_` sep).
+    { kind: 'stripe-key', regex: /sk_(?:live|test)_[A-Za-z0-9]{12,}/gd },
+    // Generic provider keys: sk-/pk-/rk- prefixed (OpenAI + generic).
+    { kind: 'openai-key', regex: /\b(?:sk|pk|rk)-[A-Za-z0-9]{16,}/gd },
+    // GitHub PAT / OAuth / app tokens (ghp_/gho_/ghu_/ghs_/ghr_).
+    { kind: 'github-token', regex: /\bgh[pousr]_[A-Za-z0-9]{20,}/gd },
+    // Google API keys (AIza + 35 url-safe chars).
+    { kind: 'google-api-key', regex: /\bAIza[A-Za-z0-9_-]{35}/gd },
+    // Slack tokens: xoxb-/xoxp-/xoxa-/xoxr-/xoxs- + segments.
+    { kind: 'slack-token', regex: /\bxox[baprs]-[A-Za-z0-9-]{10,}/gd },
+    // AWS access key IDs (AKIA/ASIA + 16 uppercase alphanumerics).
+    { kind: 'aws-access-key', regex: /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/gd },
+    // Telegram bot tokens: <digits>:<35-char base64url-ish secret>.
+    { kind: 'telegram-bot-token', regex: /\b\d{6,12}:[A-Za-z0-9_-]{30,}\b/gd },
+    // PEM private-key blocks. Lazy body over a RESTRICTED char class terminated by
+    // a literal `-----END…` — single quantifier, no nesting, linear.
+    {
+        kind: 'pem-private-key',
+        regex: /-----BEGIN[A-Z ]*PRIVATE KEY-----[A-Za-z0-9+/=\s]{0,8192}?-----END[A-Z ]*PRIVATE KEY-----/gd,
+    },
+    // JWTs: three base64url segments. Known FP suspect on dotted identifiers
+    // (spec rollout step 2) — surfaced per-pattern-kind in the dry-run soak.
+    { kind: 'jwt', regex: /\b[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{16,}\b/gd },
+    // Bearer tokens.
+    { kind: 'bearer-token', regex: /Bearer\s+[A-Za-z0-9_\-.]{20,}/gd },
+    // URLs with embedded credentials (scheme://user:pass@host) — redact the
+    // credential group (group 1), keep the scheme/host structure readable.
+    {
+        kind: 'url-embedded-credential',
+        regex: /([a-z][a-z0-9+.-]*:\/\/)[^/\s:@]+:[^/\s@]+@/gd,
+        group: undefined, // whole match replaced; the scheme is short + re-derivable
+    },
+    // Labelled secret pairs (token=…, api_key: …, password "…") — redact only the
+    // VALUE group so the label survives ("a <label> was redacted").
+    {
+        kind: 'labeled-secret',
+        regex: /(?:token|secret|password|passwd|pwd|api[_-]?key)(?:["'=:\s]+)([A-Za-z0-9._-]{12,})/gid,
+        group: 1,
+    },
+];
+/** Default input size bound (spec §2: 1 MB). Over this, the whole field is
+ *  replaced with `[REDACTED:oversize]` (fail-safe — never persist raw bytes the
+ *  scrub could not fully walk). */
+export const DEFAULT_MAX_SCRUB_BYTES = 1_000_000;
+/** Build the typed marker for a redacted span. */
+function markerFor(kind) {
+    return `[REDACTED:${kind}]`;
+}
+/**
+ * scrubForStore — the metadata-returning safety-floor scrub (spec §2).
+ *
+ * Replaces every matched credential span with a typed `[REDACTED:<kind>]` marker
+ * and returns the structured redaction metadata (kind/offset/length ONLY, never
+ * the matched bytes). Fail-safe on both edges:
+ *   - input over `maxBytes` → whole field `[REDACTED:oversize]` (truncated:true);
+ *   - any internal throw     → whole field `[REDACTED:scrub-error]` (error:true).
+ *
+ * A benign string with no matches returns `{ text: <unchanged>, redactions: [] }`.
+ */
+export function scrubForStore(input, options = {}) {
+    const text = typeof input === 'string' ? input : String(input ?? '');
+    const maxBytes = options.maxBytes ?? DEFAULT_MAX_SCRUB_BYTES;
+    // Fail-safe edge 1: oversize. A field too large to be walked with a proven
+    // timing budget is replaced wholesale rather than partially scanned.
+    if (text.length > maxBytes) {
+        return {
+            text: `${markerFor('oversize')} (${text.length} chars withheld)`,
+            redactions: [{ kind: 'oversize', offset: 0, length: text.length }],
+            truncated: true,
+        };
+    }
+    try {
+        // 1. Collect every match span across all patterns over the ORIGINAL text.
+        const raw = [];
+        for (const { kind, regex, group } of DURABLE_SECRET_PATTERNS) {
+            regex.lastIndex = 0;
+            let m;
+            while ((m = regex.exec(text)) !== null) {
+                const gi = group ?? 0;
+                const indices = m.indices;
+                const span = indices?.[gi] ?? (gi === 0 ? [m.index, m.index + m[0].length] : undefined);
+                if (span && span[1] > span[0]) {
+                    raw.push({ start: span[0], end: span[1], kind });
+                }
+                // Guard against a zero-width match wedging the loop.
+                if (m[0].length === 0)
+                    regex.lastIndex++;
+            }
+        }
+        if (raw.length === 0) {
+            return { text, redactions: [] };
+        }
+        // 2. Overlap resolution: sort by start asc, then longest-first; greedily
+        //    accept non-overlapping spans (first/longest wins → most-specific kind).
+        raw.sort((a, b) => (a.start - b.start) || (b.end - a.end));
+        const accepted = [];
+        let cursor = -1;
+        for (const s of raw) {
+            if (s.start >= cursor) {
+                accepted.push(s);
+                cursor = s.end;
+            }
+        }
+        // 3. Build the scrubbed output + the metadata (original-text coordinates).
+        let out = '';
+        let last = 0;
+        const redactions = [];
+        for (const s of accepted) {
+            out += text.slice(last, s.start) + markerFor(s.kind);
+            redactions.push({ kind: s.kind, offset: s.start, length: s.end - s.start });
+            last = s.end;
+        }
+        out += text.slice(last);
+        return { text: out, redactions };
+    }
+    catch { // @silent-fallback-ok — fail-safe-toward-redaction: a scrub throw must NEVER persist raw bytes (spec §2). The whole field is withheld under a typed marker and the caller records the error via the returned error:true flag.
+        return {
+            text: `${markerFor('scrub-error')} (${text.length} chars withheld)`,
+            redactions: [{ kind: 'scrub-error', offset: 0, length: text.length }],
+            error: true,
+        };
+    }
+}
+export function scrubStructured(record, fields, options = {}) {
+    const out = { ...record };
+    const redactions = [];
+    let truncated = false;
+    let error = false;
+    for (const field of fields) {
+        const value = record[field];
+        const fieldName = String(field);
+        if (typeof value === 'string') {
+            const r = scrubForStore(value, options);
+            out[fieldName] = r.text;
+            if (r.truncated)
+                truncated = true;
+            if (r.error)
+                error = true;
+            for (const span of r.redactions)
+                redactions.push({ ...span, field: fieldName });
+        }
+        else if (Array.isArray(value)) {
+            out[fieldName] = value.map((el) => {
+                if (typeof el !== 'string')
+                    return el;
+                const r = scrubForStore(el, options);
+                if (r.truncated)
+                    truncated = true;
+                if (r.error)
+                    error = true;
+                for (const span of r.redactions)
+                    redactions.push({ ...span, field: fieldName });
+                return r.text;
+            });
+        }
+    }
+    return { record: out, redactions, truncated, error };
+}
+//# sourceMappingURL=durableSecretScrub.js.map

package/dist/core/durableSecretScrub.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"durableSecretScrub.js","sourceRoot":"","sources":["../../src/core/durableSecretScrub.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAoDH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAA4B;IAC9D,6EAA6E;IAC7E,8EAA8E;IAC9E,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,6BAA6B,EAAE;IAC/D,8EAA8E;IAC9E,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,qCAAqC,EAAE;IACpE,kEAAkE;IAClE,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,mCAAmC,EAAE;IAClE,8DAA8D;IAC9D,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,gCAAgC,EAAE;IACjE,8CAA8C;IAC9C,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,2BAA2B,EAAE;IAC9D,0DAA0D;IAC1D,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,kCAAkC,EAAE;IAClE,+DAA+D;IAC/D,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,iCAAiC,EAAE;IACpE,gEAAgE;IAChE,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,mCAAmC,EAAE;IAC1E,+EAA+E;IAC/E,iEAAiE;IACjE;QACE,IAAI,EAAE,iBAAiB;QACvB,KAAK,EAAE,6FAA6F;KACrG;IACD,yEAAyE;IACzE,yEAAyE;IACzE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,iEAAiE,EAAE;IACzF,iBAAiB;IACjB,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,iCAAiC,EAAE;IAClE,wEAAwE;IACxE,uEAAuE;IACvE;QACE,IAAI,EAAE,yBAAyB;QAC/B,KAAK,EAAE,+CAA+C;QACtD,KAAK,EAAE,SAAS,EAAE,2DAA2D;KAC9E;IACD,8EAA8E;IAC9E,gEAAgE;IAChE;QACE,IAAI,EAAE,gBAAgB;QACtB,KAAK,EAAE,uFAAuF;QAC9F,KAAK,EAAE,CAAC;KACT;CACO,CAAC;AAEX;;mCAEmC;AACnC,MAAM,CAAC,MAAM,uBAAuB,GAAG,SAAS,CAAC;AAOjD,kDAAkD;AAClD,SAAS,SAAS,CAAC,IAA2B;IAC5C,OAAO,aAAa,IAAI,GAAG,CAAC;AAC9B,CAAC;AAQD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAC3B,KAAa,EACb,UAAgC,EAAE;IAElC,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,uBAAuB,CAAC;IAE7D,2EAA2E;IAC3E,qEAAqE;IACrE,IAAI,IAAI,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QAC3B,OAAO;YACL,IAAI,EAAE,GAAG,SAAS,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,MAAM,kBAAkB;YAChE,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YAClE,SAAS,EAAE,IAAI;SAChB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,0EAA0E;QAC1E,MAAM,GAAG,GAAc,EAAE,CAAC;QAC1B,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,uBAAuB,EAAE,CAAC;YAC7D,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;YACpB,IAAI,CAAyB,CAAC;YAC9B,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACvC,MAAM,EAAE,GAAG,KAAK,IAAI,CAAC,CAAC;gBACtB,MAAM,OAAO,GAAI,CAAyE,CAAC,OAAO,CAAC;gBACnG,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAqB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBAC5G,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC9B,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;gBACnD,CAAC;gBACD,qDAAqD;gBACrD,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC;oBAAE,KAAK,CAAC,SAAS,EAAE,CAAC;YAC3C,CAAC;QACH,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QAClC,CAAC;QAED,yEAAyE;QACzE,6EAA6E;QAC7E,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC;QAChB,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACpB,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,EAAE,CAAC;gBACtB,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACjB,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC;YACjB,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,MAAM,UAAU,GAAoB,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACrD,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YAC5E,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC;QACf,CAAC;QACD,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAExB,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC,CAAC,8NAA8N;QACtO,OAAO;YACL,IAAI,EAAE,GAAG,SAAS,CAAC,aAAa,CAAC,KAAK,IAAI,CAAC,MAAM,kBAAkB;YACnE,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YACrE,KAAK,EAAE,IAAI;SACZ,CAAC;IACJ,CAAC;AACH,CAAC;AAoBD,MAAM,UAAU,eAAe,CAC7B,MAAS,EACT,MAA4B,EAC5B,UAAgC,EAAE;IAElC,MAAM,GAAG,GAA4B,EAAE,GAAG,MAAM,EAAE,CAAC;IACnD,MAAM,UAAU,GAA8B,EAAE,CAAC;IACjD,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,KAAK,GAAG,KAAK,CAAC;IAElB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACxC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACxB,IAAI,CAAC,CAAC,SAAS;gBAAE,SAAS,GAAG,IAAI,CAAC;YAClC,IAAI,CAAC,CAAC,KAAK;gBAAE,KAAK,GAAG,IAAI,CAAC;YAC1B,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,UAAU;gBAAE,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAClF,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,GAAG,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;gBAChC,IAAI,OAAO,EAAE,KAAK,QAAQ;oBAAE,OAAO,EAAE,CAAC;gBACtC,MAAM,CAAC,GAAG,aAAa,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;gBACrC,IAAI,CAAC,CAAC,SAAS;oBAAE,SAAS,GAAG,IAAI,CAAC;gBAClC,IAAI,CAAC,CAAC,KAAK;oBAAE,KAAK,GAAG,IAAI,CAAC;gBAC1B,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,UAAU;oBAAE,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;gBAChF,OAAO,CAAC,CAAC,IAAI,CAAC;YAChB,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,GAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC5D,CAAC"}

package/dist/core/types.d.ts

@@ -4501,6 +4501,24 @@ export interface MonitoringConfig {
     standbyHonestyTiers?: {
         enabled?: boolean;
     };
+    /**
+     * Durable-Output Hygiene Standard §2 (Layer B — "What Persists Must Be Clean").
+     * The config-gated DurableOutputScrubber that redacts credential SPANS from LLM
+     * output at durable-output persistence chokepoints BEFORE the write. `enabled` is
+     * OMITTED from ConfigDefaults → resolved via the developmentAgent dark-feature
+     * gate (LIVE on a dev agent, DARK on the fleet). `dryRun` (default true, the
+     * canary) COMPUTES + records would-redact metrics but stores the ORIGINAL text —
+     * a real (dryRun:false) redaction flip is the OPERATOR'S endpoint decision
+     * (Frontloaded Decision #4). `perStore` is the per-store opt-out map. When
+     * absent/disabled, durable writes are byte-identical to today.
+     */
+    durableOutputScrub?: {
+        enabled?: boolean;
+        dryRun?: boolean;
+        perStore?: Record<string, {
+            enabled?: boolean;
+        }>;
+    };
     /**
      * CollaborationRedriveEngine — proactively re-engage a counterpart that
      * has gone silent on an open threadline-reply commitment. Ships OFF.