instar 1.3.746 → 1.3.748

package/dist/core/conversationBindGate.d.ts

@@ -0,0 +1,62 @@
+/**
+ * conversationBindGate — the ONE shared implementation of the
+ * durable-conversation-identity §7 bind-time authority (B7/R3-M5/R4-M3).
+ *
+ * A durable-state open on a conversation id is scoped to the session's OWN
+ * authenticated bootstrap context, enforced through the per-session bind token
+ * (delivered ONLY via the spawn env — never over a route). The server verifies
+ * the MAC and reads the bootstrap set FROM the token; it NEVER trusts a
+ * caller-supplied session name.
+ *
+ * This is factored out of the `POST /commitments` route so that
+ * `POST /action-claim/observe` (slack-followthrough-generalization §4.3) runs
+ * the SAME verification — a second copy would be exactly the drift the §7 golden
+ * test forbids. Both routes call `verifyConversationBind` and act on its typed
+ * verdict.
+ *
+ * The helper never writes an HTTP response — the caller owns status codes. On a
+ * refusal (or the R7-minor-2 tokenless-straggler backstop) it raises the SAME
+ * deduped attention item the route used to raise inline (fail-closed for a
+ * minted id; fail-open for a legacy token-less positive id).
+ */
+import type { ConversationBindAuth } from './conversationBindToken.js';
+/** The minimal attention surface the gate needs (TelegramAdapter.createAttentionItem).
+ *  `priority` mirrors AttentionItem's union so TelegramAdapter is assignable here
+ *  under strict function types. */
+export interface BindGateAttentionSink {
+    createAttentionItem: (item: {
+        id: string;
+        title: string;
+        summary: string;
+        category: string;
+        priority: 'URGENT' | 'HIGH' | 'NORMAL' | 'LOW';
+        sourceContext: string;
+    }) => unknown;
+}
+export type ConversationBindVerdict = {
+    ok: true;
+    boundBy?: string;
+} | {
+    ok: false;
+    detail: string;
+};
+/**
+ * Verify the caller's authority to open durable state on `numericTopicId`.
+ *
+ * - `bindAuth` absent OR `numericTopicId` undefined → `{ ok: true }` (no gate;
+ *   the in-process / no-topic path is unchanged).
+ * - NEGATIVE (minted) id → HARD-GATED, fail-closed: requires a valid token whose
+ *   bootstrap set includes the id; else `{ ok:false }` + the deduped refusal item.
+ * - POSITIVE id WITH a token → validated against the token's bootstrap set
+ *   (R6-minor-4); a bad token refuses.
+ * - POSITIVE id WITHOUT a token → legacy fail-OPEN `{ ok:true }`; past the
+ *   deploy-stamp grace window the R7-minor-2 straggler backstop raises ONE
+ *   deduped LOW item (the bind still succeeds).
+ */
+export declare function verifyConversationBind(params: {
+    bindAuth: ConversationBindAuth | null | undefined;
+    numericTopicId: number | undefined;
+    rawToken: string | undefined;
+    attention?: BindGateAttentionSink | null;
+}): ConversationBindVerdict;
+//# sourceMappingURL=conversationBindGate.d.ts.map

package/dist/core/conversationBindGate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"conversationBindGate.d.ts","sourceRoot":"","sources":["../../src/core/conversationBindGate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAGvE;;mCAEmC;AACnC,MAAM,WAAW,qBAAqB;IACpC,mBAAmB,EAAE,CAAC,IAAI,EAAE;QAC1B,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;QAC/C,aAAa,EAAE,MAAM,CAAC;KACvB,KAAK,OAAO,CAAC;CACf;AAED,MAAM,MAAM,uBAAuB,GAC/B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElC;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE;IAC7C,QAAQ,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,CAAC;IAClD,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,SAAS,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;CAC1C,GAAG,uBAAuB,CAqE1B"}

package/dist/core/conversationBindGate.js

@@ -0,0 +1,83 @@
+import { TOKENLESS_BIND_GRACE_DAYS } from './conversationBindToken.js';
+/**
+ * Verify the caller's authority to open durable state on `numericTopicId`.
+ *
+ * - `bindAuth` absent OR `numericTopicId` undefined → `{ ok: true }` (no gate;
+ *   the in-process / no-topic path is unchanged).
+ * - NEGATIVE (minted) id → HARD-GATED, fail-closed: requires a valid token whose
+ *   bootstrap set includes the id; else `{ ok:false }` + the deduped refusal item.
+ * - POSITIVE id WITH a token → validated against the token's bootstrap set
+ *   (R6-minor-4); a bad token refuses.
+ * - POSITIVE id WITHOUT a token → legacy fail-OPEN `{ ok:true }`; past the
+ *   deploy-stamp grace window the R7-minor-2 straggler backstop raises ONE
+ *   deduped LOW item (the bind still succeeds).
+ */
+export function verifyConversationBind(params) {
+    const { bindAuth, numericTopicId, rawToken, attention } = params;
+    if (!bindAuth || numericTopicId === undefined) {
+        return { ok: true };
+    }
+    const refuse = (detail) => {
+        try {
+            void attention?.createAttentionItem({
+                id: `conversation-bind-refused:${numericTopicId}`,
+                title: 'A durable bind on a conversation id was refused',
+                summary: `A durable-state open targeting topicId ${numericTopicId} was refused: ${detail} (durable-conversation-identity §7 — never silently delivered into a foreign conversation).`,
+                category: 'conversation-identity',
+                priority: 'NORMAL',
+                sourceContext: 'conversation-identity',
+            });
+        }
+        catch {
+            /* attention is observability */
+        }
+        return { ok: false, detail };
+    };
+    if (numericTopicId < 0) {
+        // Minted-id bind: hard-gated, fail-closed.
+        if (!rawToken) {
+            return refuse('minted-id bind requires the session bind token (missing X-Instar-Bind-Token)');
+        }
+        const payload = bindAuth.verify(rawToken);
+        if (!payload) {
+            return refuse('bind token missing/invalid (MAC verification failed)');
+        }
+        if (!payload.bootstrapConversationIds.includes(numericTopicId)) {
+            return refuse(`conversation ${numericTopicId} is not in the session's authenticated bootstrap context`);
+        }
+        return { ok: true, boundBy: `session:${payload.sessionName}` };
+    }
+    if (rawToken) {
+        // R6-minor-4: a TOKEN-BEARING session's positive-id bind validates against
+        // the token's bootstrap set.
+        const payload = bindAuth.verify(rawToken);
+        if (!payload) {
+            return refuse('bind token invalid (MAC verification failed)');
+        }
+        if (!payload.bootstrapConversationIds.includes(numericTopicId)) {
+            return refuse(`topic ${numericTopicId} is not in the session's authenticated bootstrap context`);
+        }
+        return { ok: true, boundBy: `session:${payload.sessionName}` };
+    }
+    // Token-less LEGACY positive-id bind: keeps today's ungated fail-OPEN behavior.
+    // Past the deploy-stamp grace window, the straggler backstop raises ONE deduped
+    // item so a long-lived ungated session is a visible operator decision (R7-minor-2).
+    const ageDays = bindAuth.deployStampAgeDays();
+    if (ageDays !== null && ageDays >= TOKENLESS_BIND_GRACE_DAYS) {
+        try {
+            void attention?.createAttentionItem({
+                id: 'conversation-bind-tokenless-straggler',
+                title: 'A token-less session is still opening durable state',
+                summary: `A durable-state open (topicId ${numericTopicId}) arrived without a bind token ${ageDays} days after the bind-token increment deployed (grace ${TOKENLESS_BIND_GRACE_DAYS}d). The bind SUCCEEDED (legacy behavior); respawn long-lived sessions to close the window (durable-conversation-identity §7 R7-minor-2).`,
+                category: 'conversation-identity',
+                priority: 'LOW',
+                sourceContext: 'conversation-identity',
+            });
+        }
+        catch {
+            /* attention is observability */
+        }
+    }
+    return { ok: true };
+}
+//# sourceMappingURL=conversationBindGate.js.map

package/dist/core/conversationBindGate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"conversationBindGate.js","sourceRoot":"","sources":["../../src/core/conversationBindGate.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAoBvE;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAKtC;IACC,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IACjE,IAAI,CAAC,QAAQ,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,MAAc,EAA2B,EAAE;QACzD,IAAI,CAAC;YACH,KAAK,SAAS,EAAE,mBAAmB,CAAC;gBAClC,EAAE,EAAE,6BAA6B,cAAc,EAAE;gBACjD,KAAK,EAAE,iDAAiD;gBACxD,OAAO,EAAE,0CAA0C,cAAc,iBAAiB,MAAM,6FAA6F;gBACrL,QAAQ,EAAE,uBAAuB;gBACjC,QAAQ,EAAE,QAAQ;gBAClB,aAAa,EAAE,uBAAuB;aACvC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC/B,CAAC,CAAC;IAEF,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;QACvB,2CAA2C;QAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,MAAM,CAAC,8EAA8E,CAAC,CAAC;QAChG,CAAC;QACD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,MAAM,CAAC,sDAAsD,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YAC/D,OAAO,MAAM,CAAC,gBAAgB,cAAc,0DAA0D,CAAC,CAAC;QAC1G,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;IACjE,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,2EAA2E;QAC3E,6BAA6B;QAC7B,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,MAAM,CAAC,8CAA8C,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YAC/D,OAAO,MAAM,CAAC,SAAS,cAAc,0DAA0D,CAAC,CAAC;QACnG,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;IACjE,CAAC;IAED,gFAAgF;IAChF,gFAAgF;IAChF,oFAAoF;IACpF,MAAM,OAAO,GAAG,QAAQ,CAAC,kBAAkB,EAAE,CAAC;IAC9C,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,IAAI,yBAAyB,EAAE,CAAC;QAC7D,IAAI,CAAC;YACH,KAAK,SAAS,EAAE,mBAAmB,CAAC;gBAClC,EAAE,EAAE,uCAAuC;gBAC3C,KAAK,EAAE,qDAAqD;gBAC5D,OAAO,EAAE,iCAAiC,cAAc,kCAAkC,OAAO,wDAAwD,yBAAyB,0IAA0I;gBAC5T,QAAQ,EAAE,uBAAuB;gBACjC,QAAQ,EAAE,KAAK;gBACf,aAAa,EAAE,uBAAuB;aACvC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/dist/core/devGatedFeatures.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"devGatedFeatures.d.ts","sourceRoot":"","sources":["../../src/core/devGatedFeatures.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,oEAAoE;AACpE,MAAM,WAAW,eAAe;IAC9B,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,UAAU,EAAE,MAAM,CAAC;IACnB,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,eAAO,MAAM,kBAAkB,EAAE,eAAe,EAgd/C,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,MAAM,gBAAgB,GACxB,aAAa,GACb,cAAc,GACd,gBAAgB,GAChB,sBAAsB,GACtB,iBAAiB,CAAC;AAEtB,MAAM,WAAW,iBAAiB;IAChC,uEAAuE;IACvE,UAAU,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,oBAAoB,EAAE,iBAAiB,EA2JnD,CAAC;AAEF;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAO5E"}
+{"version":3,"file":"devGatedFeatures.d.ts","sourceRoot":"","sources":["../../src/core/devGatedFeatures.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,oEAAoE;AACpE,MAAM,WAAW,eAAe;IAC9B,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,UAAU,EAAE,MAAM,CAAC;IACnB,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,eAAO,MAAM,kBAAkB,EAAE,eAAe,EA4d/C,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,MAAM,gBAAgB,GACxB,aAAa,GACb,cAAc,GACd,gBAAgB,GAChB,sBAAsB,GACtB,iBAAiB,CAAC;AAEtB,MAAM,WAAW,iBAAiB;IAChC,uEAAuE;IACvE,UAAU,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,oBAAoB,EAAE,iBAAiB,EA2JnD,CAAC;AAEF;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAO5E"}

package/dist/core/devGatedFeatures.js

@@ -42,6 +42,12 @@ export const DEV_GATED_FEATURES = [
         description: "Tier1/Tier2 standby honest-stuck classification — surface the REAL reason a live-but-failing session is silent (rate-limited / policy-wedge / context-wedge / context-too-long) instead of 'actively working'.",
         justification: "Signal-only — only changes the standby MESSAGE TEXT; never gates, blocks, initiates recovery, spends, or egresses. Reuses the existing tail-gated classifyStuckSignature and defers to the same one-voice recovery-ownership checks Tier 3 already honors. Flag-OFF = Tier1/2 byte-identical to today.",
     },
+    {
+        name: 'durableOutputScrub',
+        configPath: 'monitoring.durableOutputScrub.enabled',
+        description: 'Durable-Output Hygiene Standard §2 (Layer B — "What Persists Must Be Clean") — the DurableOutputScrubber: a deterministic credential-SPAN scrub over LLM output at durable-output persistence chokepoints (session summaries wired first), config-gated + dark-first.',
+        justification: 'Ships dryRun:true (the dry-run canary): on a dev agent the scrubber COMPUTES the redaction and records would-redact metrics (feature key durable-output-scrub — COUNTS/kind/offset only, NEVER the matched bytes, so the soak telemetry can never itself be the leak), but returns the ORIGINAL text so NO durable content is mutated while dryRun holds (verified at DurableOutputScrubber.scrub/scrubRecord dryRun branches — applied:false, input returned unchanged). A real redaction (which destroys the matched span by design) needs a deliberate dryRun:false — the OPERATOR\'s endpoint decision on the dev-soak packet (Frontloaded Decision #4), never a fleet default. Pure deterministic regex floor (no LLM, no spawn-cap slot, no egress, no third-party spend); every failure path fails SAFE-toward-redaction (a scrub throw / oversize withholds the field under a typed marker, never persists raw bytes). Same dogfooding posture as topicProfiles / credentialRepointing.',
+    },
     {
         name: 'growthAnalyst',
         configPath: 'monitoring.growthAnalyst.enabled',
@@ -150,6 +156,12 @@ export const DEV_GATED_FEATURES = [
         description: 'Durable conversation identity — the §5 deliverToConversation funnel\'s minted-id (id<0) DELIVERY arm (durable-conversation-identity §9). The registry/journal/eager-mint FOUNDATION is always-on and NOT gated here; only delivery rides this gate.',
         justification: 'Delivery is externally visible, so the block ships dryRun:true even live-on-dev: the id<0 arm returns typed §5.1 non-deliveries + would-deliver audit lines (never success-shaped) until a deliberate dryRun:false flip for the live proof. Zero consumers ride the funnel in increment 1, so enabling is inert until the §6.1 proof-consumer increment; no spend, no destructive action, no egress while dry.',
     },
+    {
+        name: 'actionClaimSlack',
+        configPath: 'messaging.actionClaim.slack.enabled',
+        description: 'Slack follow-through generalization — the /action-claim/observe registration lane for NEGATIVE (minted Slack) conversation ids (spec: slack-followthrough-generalization §8.1). Registration only; follow-through DELIVERY rides the separate conversationIdentity.followThrough gate.',
+        justification: 'SIGNAL-ONLY: registration fires AFTER the Slack reply already went out (the Stop hook runs at turn end) — it can never block/delay/rewrite a message. Ships messaging.actionClaim.slack.dryRun:true even live-on-dev: the observe route runs the full classify + §7 bind-verify + would-register decision and appends a logs/action-claim-observe.jsonl audit line, but performs NO record() until a deliberate dryRun:false for the live proof. A minted-id write is §7 fail-closed (a foreign/unauthenticated caller is refused); the shared per-topic cap + 6h expiry bound the durable surface. The master messaging.actionClaim.enabled must be on for the Stop hook to POST at all. No spend, no destructive action, no egress while dry. Same dogfooding posture as conversationFollowThrough.',
+    },
     {
         name: 'prHandLease',
         configPath: 'monitoring.prHandLease.enabled',

package/dist/core/devGatedFeatures.js.map

@@ -1 +1 @@
-{"version":3,"file":"devGatedFeatures.js","sourceRoot":"","sources":["../../src/core/devGatedFeatures.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAoBH,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD;QACE,IAAI,EAAE,yBAAyB;QAC/B,UAAU,EAAE,6CAA6C;QACzD,WAAW,EAAE,+MAA+M;QAC5N,aAAa,EAAE,ikBAAikB;KACjlB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,UAAU,EAAE,iCAAiC;QAC7C,WAAW,EAAE,sPAAsP;QACnQ,aAAa,EAAE,uhBAAuhB;KACviB;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,UAAU,EAAE,wCAAwC;QACpD,WAAW,EAAE,gNAAgN;QAC7N,aAAa,EAAE,wSAAwS;KACxT;IACD;QACE,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE,kCAAkC;QAC9C,WAAW,EAAE,mDAAmD;QAChE,aAAa,EAAE,uGAAuG;KACvH;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,UAAU,EAAE,uCAAuC;QACnD,WAAW,EAAE,kCAAkC;QAC/C,aAAa,EAAE,yGAAyG;KACzH;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,UAAU,EAAE,iDAAiD;QAC7D,WAAW,EAAE,qVAAqV;QAClW,aAAa,EAAE,0sBAA0sB;KAC1tB;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,UAAU,EAAE,+BAA+B;QAC3C,WAAW,EAAE,8UAA8U;QAC3V,aAAa,EAAE,24BAA24B;KAC35B;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,UAAU,EAAE,mCAAmC;QAC/C,WAAW,EAAE,gDAAgD;QAC7D,aAAa,EAAE,sGAAsG;KACtH;IACD;QACE,IAAI,EAAE,YAAY;QAClB,UAAU,EAAE,iCAAiC;QAC7C,WAAW,EAAE,2CAA2C;QACxD,aAAa,EAAE,wGAAwG;KACxH;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,UAAU,EAAE,6CAA6C;QACzD,WAAW,EAAE,gCAAgC;QAC7C,aAAa,EAAE,sGAAsG;KACtH;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,UAAU,EAAE,sCAAsC;QAClD,WAAW,EAAE,mDAAmD;QAChE,aAAa,EAAE,8FAA8F;KAC9G;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,UAAU,EAAE,sCAAsC;QAClD,WAAW,EAAE,gDAAgD;QAC7D,aAAa,EAAE,yGAAyG;KACzH;IACD;QACE,IAAI,EAAE,cAAc;QACpB,UAAU,EAAE,sBAAsB;QAClC,WAAW,EAAE,iEAAiE;QAC9E,aAAa,EAAE,sDAAsD;KACtE;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,UAAU,EAAE,uCAAuC;QACnD,WAAW,EAAE,oEAAoE;QACjF,aAAa,EAAE,yDAAyD;KACzE;IACD;QACE,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE,kCAAkC;QAC9C,WAAW,EAAE,8EAA8E;QAC3F,aAAa,EAAE,qNAAqN;KACrO;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,UAAU,EAAE,uDAAuD;QACnE,WAAW,EAAE,wPAAwP;QACrQ,aAAa,EAAE,srBAAsrB;KACtsB;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,UAAU,EAAE,sDAAsD;QAClE,WAAW,EAAE,sMAAsM;QACnN,aAAa,EAAE,2hBAA2hB;KAC3iB;IACD;QACE,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE,uBAAuB;QACnC,WAAW,EAAE,+EAA+E;QAC5F,aAAa,EAAE,yNAAyN;KACzO;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,UAAU,EAAE,+CAA+C;QAC3D,WAAW,EAAE,uLAAuL;QACpM,aAAa,EAAE,otBAAotB;KACpuB;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,UAAU,EAAE,4BAA4B;QACxC,WAAW,EAAE,mEAAmE;QAChF,aAAa,EAAE,mOAAmO;KACnP;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,UAAU,EAAE,4CAA4C;QACxD,WAAW,EAAE,qPAAqP;QAClQ,aAAa,EAAE,gZAAgZ;KACha;IACD;QACE,IAAI,EAAE,aAAa;QACnB,UAAU,EAAE,gCAAgC;QAC5C,WAAW,EAAE,wJAAwJ;QACrK,aAAa,EAAE,wnBAAwnB;KACxoB;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,UAAU,EAAE,+CAA+C;QAC3D,WAAW,EAAE,+MAA+M;QAC5N,aAAa,EAAE,69BAA69B;KAC7+B;IACD,gFAAgF;IAChF,+EAA+E;IAC/E,8EAA8E;IAC9E,gFAAgF;IAChF,0EAA0E;IAC1E,kFAAkF;IAClF,mFAAmF;IACnF,oFAAoF;IACpF,oFAAoF;IACpF,qFAAqF;IACrF,6EAA6E;IAC7E,+EAA+E;IAC/E,iFAAiF;IACjF,+EAA+E;IAC/E,2EAA2E;IAC3E,gFAAgF;IAChF,iFAAiF;IACjF,+EAA+E;IAC/E;QACE,IAAI,EAAE,aAAa;QACnB,UAAU,EAAE,uCAAuC;QACnD,WAAW,EAAE,+IAA+I;QAC5J,aAAa,EAAE,8YAA8Y;KAC9Z;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,UAAU,EAAE,qCAAqC;QACjD,WAAW,EAAE,6OAA6O;QAC1P,aAAa,EAAE,gdAAgd;KAChe;IACD;QACE,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE,yCAAyC;QACrD,WAAW,EAAE,8JAA8J;QAC3K,aAAa,EAAE,0aAA0a;KAC1b;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,UAAU,EAAE,4CAA4C;QACxD,WAAW,EAAE,4RAA4R;QACzS,aAAa,EAAE,+uBAA+uB;KAC/vB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,UAAU,EAAE,0CAA0C;QACtD,WAAW,EAAE,2MAA2M;QACxN,aAAa,EAAE,gcAAgc;KAChd;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,UAAU,EAAE,sCAAsC;QAClD,WAAW,EAAE,wMAAwM;QACrN,aAAa,EAAE,muBAAmuB;KACnvB;IACD;QACE,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE,yCAAyC;QACrD,WAAW,EAAE,0OAA0O;QACvP,aAAa,EAAE,mcAAmc;KACnd;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,UAAU,EAAE,4CAA4C;QACxD,WAAW,EAAE,kPAAkP;QAC/P,aAAa,EAAE,+oBAA+oB;KAC/pB;IACD;QACE,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE,yCAAyC;QACrD,WAAW,EAAE,wGAAwG;QACrH,aAAa,EAAE,qRAAqR;KACrS;IACD;QACE,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE,yCAAyC;QACrD,WAAW,EAAE,2UAA2U;QACxV,aAAa,EAAE,qTAAqT;KACrU;IACD;QACE,IAAI,EAAE,cAAc;QACpB,UAAU,EAAE,iCAAiC;QAC7C,WAAW,EAAE,gNAAgN;QAC7N,aAAa,EAAE,gpBAAgpB;KAChqB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,UAAU,EAAE,mCAAmC;QAC/C,WAAW,EAAE,2ZAA2Z;QACxa,aAAa,EAAE,+lBAA+lB;KAC/mB;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,UAAU,EAAE,uCAAuC;QACnD,WAAW,EAAE,0RAA0R;QACvS,aAAa,EAAE,ynBAAynB;KACzoB;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,UAAU,EAAE,uCAAuC;QACnD,WAAW,EAAE,+TAA+T;QAC5U,aAAa,EAAE,o3BAAo3B;KACp4B;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,UAAU,EAAE,2CAA2C;QACvD,WAAW,EACT,+bAA+b;QACjc,aAAa,EACX,6rBAA6rB;KAChsB;IACD;QACE,IAAI,EAAE,wCAAwC;QAC9C,UAAU,EAAE,4DAA4D;QACxE,WAAW,EACT,2KAA2K;QAC7K,aAAa,EACX,2OAA2O;KAC9O;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,UAAU,EAAE,8CAA8C;QAC1D,WAAW,EACT,6IAA6I;QAC/I,aAAa,EACX,uKAAuK;KAC1K;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,UAAU,EAAE,qCAAqC;QACjD,WAAW,EACT,0IAA0I;QAC5I,aAAa,EACX,ieAAie;KACpe;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,UAAU,EAAE,yCAAyC;QACrD,WAAW,EACT,6HAA6H;QAC/H,aAAa,EACX,8UAA8U;KACjV;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,UAAU,EAAE,oDAAoD;QAChE,WAAW,EACT,mYAAmY;QACrY,aAAa,EACX,myBAAmyB;KACtyB;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,UAAU,EAAE,0CAA0C;QACtD,WAAW,EACT,iWAAiW;QACnW,aAAa,EACX,s7BAAs7B;KACz7B;IACD;QACE,IAAI,EAAE,aAAa;QACnB,UAAU,EAAE,gCAAgC;QAC5C,WAAW,EACT,kKAAkK;QACpK,aAAa,EACX,wiBAAwiB;KAC3iB;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,UAAU,EAAE,0CAA0C;QACtD,WAAW,EACT,2OAA2O;QAC7O,aAAa,EACX,gqBAAgqB;KACnqB;IACD,gFAAgF;IAChF,iFAAiF;IACjF,yEAAyE;IACzE,gFAAgF;IAChF;QACE,IAAI,EAAE,sBAAsB;QAC5B,UAAU,EAAE,yCAAyC;QACrD,WAAW,EAAE,qFAAqF;QAClG,aAAa,EAAE,mOAAmO;KACnP;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,UAAU,EAAE,iDAAiD;QAC7D,WAAW,EAAE,mKAAmK;QAChL,aAAa,EAAE,4fAA4f;KAC5gB;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,UAAU,EAAE,wCAAwC;QACpD,WAAW,EAAE,2LAA2L;QACxM,aAAa,EAAE,8wBAA8wB;KAC9xB;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,UAAU,EAAE,oCAAoC;QAChD,WAAW,EAAE,mFAAmF;QAChG,aAAa,EAAE,uWAAuW;KACvX;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,UAAU,EAAE,qCAAqC;QACjD,WAAW,EAAE,yEAAyE;QACtF,aAAa,EAAE,6cAA6c;KAC7d;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,UAAU,EAAE,qCAAqC;QACjD,WAAW,EAAE,+EAA+E;QAC5F,aAAa,EAAE,4MAA4M;KAC5N;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,UAAU,EAAE,2CAA2C;QACvD,WAAW,EAAE,2JAA2J;QACxK,aAAa,EAAE,0VAA0V;KAC1W;IACD,kFAAkF;IAClF,kFAAkF;IAClF,0EAA0E;IAC1E,oFAAoF;IACpF,qFAAqF;IACrF,sFAAsF;IACtF,8EAA8E;IAC9E,6EAA6E;IAC7E,sFAAsF;IACtF,qFAAqF;IACrF,qFAAqF;IACrF,oFAAoF;IACpF,kEAAkE;IAClE,gFAAgF;IAChF,mFAAmF;IACnF,oDAAoD;IACpD;QACE,IAAI,EAAE,sBAAsB;QAC5B,UAAU,EAAE,4CAA4C;QACxD,WAAW,EAAE,yFAAyF;QACtG,aAAa,EAAE,6WAA6W;KAC7X;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,UAAU,EAAE,8CAA8C;QAC1D,WAAW,EAAE,+GAA+G;QAC5H,aAAa,EAAE,waAAwa;KACxb;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,UAAU,EAAE,0CAA0C;QACtD,WAAW,EAAE,uHAAuH;QACpI,aAAa,EAAE,6UAA6U;KAC7V;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,UAAU,EAAE,0CAA0C;QACtD,WAAW,EAAE,4HAA4H;QACzI,aAAa,EAAE,qVAAqV;KACrW;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,UAAU,EAAE,iDAAiD;QAC7D,WAAW,EAAE,qIAAqI;QAClJ,aAAa,EAAE,2bAA2b;KAC3c;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,UAAU,EAAE,6CAA6C;QACzD,WAAW,EAAE,kHAAkH;QAC/H,aAAa,EAAE,0aAA0a;KAC1b;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,UAAU,EAAE,8CAA8C;QAC1D,WAAW,EAAE,kHAAkH;QAC/H,aAAa,EAAE,kjBAAkjB;KAClkB;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,UAAU,EAAE,gDAAgD;QAC5D,WAAW,EAAE,+QAA+Q;QAC5R,aAAa,EAAE,2hBAA2hB;KAC3iB;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,UAAU,EAAE,oDAAoD;QAChE,WAAW,EAAE,8VAA8V;QAC3W,aAAa,EAAE,wkBAAwkB;KACxlB;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,UAAU,EAAE,8CAA8C;QAC1D,WAAW,EAAE,2dAA2d;QACxe,aAAa,EAAE,2oBAA2oB;KAC3pB;IACD,gFAAgF;IAChF,sFAAsF;IACtF,qFAAqF;IACrF,uFAAuF;IACvF,8DAA8D;IAC9D;QACE,IAAI,EAAE,4BAA4B;QAClC,UAAU,EAAE,gDAAgD;QAC5D,WAAW,EAAE,wMAAwM;QACrN,aAAa,EAAE,skBAAskB;KACtlB;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,UAAU,EAAE,kDAAkD;QAC9D,WAAW,EAAE,2NAA2N;QACxO,aAAa,EAAE,mgBAAmgB;KACnhB;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,UAAU,EAAE,sCAAsC;QAClD,WAAW,EAAE,iPAAiP;QAC9P,aAAa,EAAE,4nBAA4nB;KAC5oB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,UAAU,EAAE,yCAAyC;QACrD,WAAW,EAAE,wfAAwf;QACrgB,aAAa,EAAE,8nBAA8nB;KAC9oB;CACF,CAAC;AA0CF,MAAM,CAAC,MAAM,oBAAoB,GAAwB;IACvD,+EAA+E;IAC/E;QACE,UAAU,EAAE,kCAAkC;QAC9C,QAAQ,EAAE,aAAa;QACvB,MAAM,EAAE,+CAA+C;KACxD;IACD;QACE,UAAU,EAAE,wCAAwC;QACpD,QAAQ,EAAE,aAAa;QACvB,MAAM,EAAE,iDAAiD;KAC1D;IACD;QACE,UAAU,EAAE,qCAAqC;QACjD,QAAQ,EAAE,aAAa;QACvB,MAAM,EAAE,+CAA+C;KACxD;IACD,gFAAgF;IAChF,+EAA+E;IAC/E,oFAAoF;IACpF,6DAA6D;IAC7D,wEAAwE;IACxE;QACE,UAAU,EAAE,8BAA8B;QAC1C,QAAQ,EAAE,cAAc;QACxB,MAAM,EAAE,mDAAmD;KAC5D;IACD;QACE,UAAU,EAAE,gCAAgC;QAC5C,QAAQ,EAAE,cAAc;QACxB,MAAM,EAAE,iIAAiI;KAC1I;IACD;QACE,UAAU,EAAE,qCAAqC;QACjD,QAAQ,EAAE,cAAc;QACxB,MAAM,EAAE,gGAAgG;KACzG;IACD,uFAAuF;IACvF;QACE,UAAU,EAAE,qDAAqD;QACjE,QAAQ,EAAE,iBAAiB;QAC3B,MAAM,EAAE,kCAAkC;KAC3C;IACD;QACE,UAAU,EAAE,2CAA2C;QACvD,QAAQ,EAAE,iBAAiB;QAC3B,MAAM,EAAE,kCAAkC;KAC3C;IACD;QACE,UAAU,EAAE,+BAA+B;QAC3C,QAAQ,EAAE,iBAAiB;QAC3B,MAAM,EAAE,qDAAqD;KAC9D;IACD;QACE,UAAU,EAAE,6BAA6B;QACzC,QAAQ,EAAE,iBAAiB;QAC3B,MAAM,EAAE,oZAAoZ;KAC7Z;IACD,qDAAqD;IACrD;QACE,UAAU,EAAE,kCAAkC;QAC9C,QAAQ,EAAE,sBAAsB;QAChC,MAAM,EAAE,8CAA8C;KACvD;IACD;QACE,UAAU,EAAE,+CAA+C;QAC3D,QAAQ,EAAE,sBAAsB;QAChC,MAAM,EAAE,kGAAkG;KAC3G;IACD;QACE,UAAU,EAAE,mDAAmD;QAC/D,QAAQ,EAAE,sBAAsB;QAChC,MAAM,EAAE,+FAA+F;KACxG;IACD;QACE,UAAU,EAAE,wDAAwD;QACpE,QAAQ,EAAE,sBAAsB;QAChC,MAAM,EAAE,kPAAkP;KAC3P;IACD,8EAA8E;IAC9E,kFAAkF;IAClF,iFAAiF;IACjF,gFAAgF;IAChF,mFAAmF;IACnF,6EAA6E;IAC7E,oFAAoF;IACpF,sFAAsF;IACtF,8EAA8E;IAC9E,+EAA+E;IAC/E,6EAA6E;IAC7E,iFAAiF;IACjF;QACE,UAAU,EAAE,qCAAqC;QACjD,QAAQ,EAAE,gBAAgB;QAC1B,MAAM,EAAE,4RAA4R;KACrS;IACD;QACE,UAAU,EAAE,wDAAwD;QACpE,QAAQ,EAAE,gBAAgB;QAC1B,MAAM,EAAE,4dAA4d;KACre;IACD;QACE,UAAU,EAAE,4DAA4D;QACxE,QAAQ,EAAE,gBAAgB;QAC1B,MAAM,EAAE,scAAsc;KAC/c;IACD;QACE,UAAU,EAAE,oDAAoD;QAChE,QAAQ,EAAE,gBAAgB;QAC1B,MAAM,EAAE,inBAAinB;KAC1nB;IACD;QACE,UAAU,EAAE,6DAA6D;QACzE,QAAQ,EAAE,gBAAgB;QAC1B,MAAM,EACJ,irBAAirB;KACprB;IACD;QACE,UAAU,EAAE,+BAA+B;QAC3C,QAAQ,EAAE,gBAAgB;QAC1B,MAAM,EAAE,uMAAuM;KAChN;IACD;QACE,UAAU,EAAE,kDAAkD;QAC9D,QAAQ,EAAE,gBAAgB;QAC1B,MAAM,EAAE,ymBAAymB;KAClnB;IACD;QACE,UAAU,EAAE,2CAA2C;QACvD,QAAQ,EAAE,gBAAgB;QAC1B,MAAM,EAAE,gXAAgX;KACzX;IACD;QACE,UAAU,EAAE,6CAA6C;QACzD,QAAQ,EAAE,gBAAgB;QAC1B,MAAM,EAAE,uVAAuV;KAChW;IACD,sDAAsD;IACtD;QACE,UAAU,EAAE,uCAAuC;QACnD,QAAQ,EAAE,cAAc;QACxB,MAAM,EAAE,wXAAwX;KACjY;IACD,gFAAgF;IAChF,uFAAuF;IACvF;QACE,UAAU,EAAE,gBAAgB;QAC5B,QAAQ,EAAE,sBAAsB;QAChC,MAAM,EAAE,8NAA8N;KACvO;IACD;QACE,UAAU,EAAE,gBAAgB;QAC5B,QAAQ,EAAE,sBAAsB;QAChC,MAAM,EAAE,gQAAgQ;KACzQ;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,MAAe,EAAE,UAAkB;IACjE,IAAI,GAAG,GAAY,MAAM,CAAC;IAC1B,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,IAAI,GAAG,IAAI,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC7D,GAAG,GAAI,GAA+B,CAAC,GAAG,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"devGatedFeatures.js","sourceRoot":"","sources":["../../src/core/devGatedFeatures.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAoBH,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD;QACE,IAAI,EAAE,yBAAyB;QAC/B,UAAU,EAAE,6CAA6C;QACzD,WAAW,EAAE,+MAA+M;QAC5N,aAAa,EAAE,ikBAAikB;KACjlB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,UAAU,EAAE,iCAAiC;QAC7C,WAAW,EAAE,sPAAsP;QACnQ,aAAa,EAAE,uhBAAuhB;KACviB;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,UAAU,EAAE,wCAAwC;QACpD,WAAW,EAAE,gNAAgN;QAC7N,aAAa,EAAE,wSAAwS;KACxT;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,UAAU,EAAE,uCAAuC;QACnD,WAAW,EAAE,uQAAuQ;QACpR,aAAa,EAAE,i8BAAi8B;KACj9B;IACD;QACE,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE,kCAAkC;QAC9C,WAAW,EAAE,mDAAmD;QAChE,aAAa,EAAE,uGAAuG;KACvH;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,UAAU,EAAE,uCAAuC;QACnD,WAAW,EAAE,kCAAkC;QAC/C,aAAa,EAAE,yGAAyG;KACzH;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,UAAU,EAAE,iDAAiD;QAC7D,WAAW,EAAE,qVAAqV;QAClW,aAAa,EAAE,0sBAA0sB;KAC1tB;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,UAAU,EAAE,+BAA+B;QAC3C,WAAW,EAAE,8UAA8U;QAC3V,aAAa,EAAE,24BAA24B;KAC35B;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,UAAU,EAAE,mCAAmC;QAC/C,WAAW,EAAE,gDAAgD;QAC7D,aAAa,EAAE,sGAAsG;KACtH;IACD;QACE,IAAI,EAAE,YAAY;QAClB,UAAU,EAAE,iCAAiC;QAC7C,WAAW,EAAE,2CAA2C;QACxD,aAAa,EAAE,wGAAwG;KACxH;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,UAAU,EAAE,6CAA6C;QACzD,WAAW,EAAE,gCAAgC;QAC7C,aAAa,EAAE,sGAAsG;KACtH;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,UAAU,EAAE,sCAAsC;QAClD,WAAW,EAAE,mDAAmD;QAChE,aAAa,EAAE,8FAA8F;KAC9G;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,UAAU,EAAE,sCAAsC;QAClD,WAAW,EAAE,gDAAgD;QAC7D,aAAa,EAAE,yGAAyG;KACzH;IACD;QACE,IAAI,EAAE,cAAc;QACpB,UAAU,EAAE,sBAAsB;QAClC,WAAW,EAAE,iEAAiE;QAC9E,aAAa,EAAE,sDAAsD;KACtE;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,UAAU,EAAE,uCAAuC;QACnD,WAAW,EAAE,oEAAoE;QACjF,aAAa,EAAE,yDAAyD;KACzE;IACD;QACE,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE,kCAAkC;QAC9C,WAAW,EAAE,8EAA8E;QAC3F,aAAa,EAAE,qNAAqN;KACrO;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,UAAU,EAAE,uDAAuD;QACnE,WAAW,EAAE,wPAAwP;QACrQ,aAAa,EAAE,srBAAsrB;KACtsB;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,UAAU,EAAE,sDAAsD;QAClE,WAAW,EAAE,sMAAsM;QACnN,aAAa,EAAE,2hBAA2hB;KAC3iB;IACD;QACE,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE,uBAAuB;QACnC,WAAW,EAAE,+EAA+E;QAC5F,aAAa,EAAE,yNAAyN;KACzO;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,UAAU,EAAE,+CAA+C;QAC3D,WAAW,EAAE,uLAAuL;QACpM,aAAa,EAAE,otBAAotB;KACpuB;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,UAAU,EAAE,4BAA4B;QACxC,WAAW,EAAE,mEAAmE;QAChF,aAAa,EAAE,mOAAmO;KACnP;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,UAAU,EAAE,4CAA4C;QACxD,WAAW,EAAE,qPAAqP;QAClQ,aAAa,EAAE,gZAAgZ;KACha;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,UAAU,EAAE,qCAAqC;QACjD,WAAW,EAAE,wRAAwR;QACrS,aAAa,EAAE,uwBAAuwB;KACvxB;IACD;QACE,IAAI,EAAE,aAAa;QACnB,UAAU,EAAE,gCAAgC;QAC5C,WAAW,EAAE,wJAAwJ;QACrK,aAAa,EAAE,wnBAAwnB;KACxoB;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,UAAU,EAAE,+CAA+C;QAC3D,WAAW,EAAE,+MAA+M;QAC5N,aAAa,EAAE,69BAA69B;KAC7+B;IACD,gFAAgF;IAChF,+EAA+E;IAC/E,8EAA8E;IAC9E,gFAAgF;IAChF,0EAA0E;IAC1E,kFAAkF;IAClF,mFAAmF;IACnF,oFAAoF;IACpF,oFAAoF;IACpF,qFAAqF;IACrF,6EAA6E;IAC7E,+EAA+E;IAC/E,iFAAiF;IACjF,+EAA+E;IAC/E,2EAA2E;IAC3E,gFAAgF;IAChF,iFAAiF;IACjF,+EAA+E;IAC/E;QACE,IAAI,EAAE,aAAa;QACnB,UAAU,EAAE,uCAAuC;QACnD,WAAW,EAAE,+IAA+I;QAC5J,aAAa,EAAE,8YAA8Y;KAC9Z;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,UAAU,EAAE,qCAAqC;QACjD,WAAW,EAAE,6OAA6O;QAC1P,aAAa,EAAE,gdAAgd;KAChe;IACD;QACE,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE,yCAAyC;QACrD,WAAW,EAAE,8JAA8J;QAC3K,aAAa,EAAE,0aAA0a;KAC1b;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,UAAU,EAAE,4CAA4C;QACxD,WAAW,EAAE,4RAA4R;QACzS,aAAa,EAAE,+uBAA+uB;KAC/vB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,UAAU,EAAE,0CAA0C;QACtD,WAAW,EAAE,2MAA2M;QACxN,aAAa,EAAE,gcAAgc;KAChd;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,UAAU,EAAE,sCAAsC;QAClD,WAAW,EAAE,wMAAwM;QACrN,aAAa,EAAE,muBAAmuB;KACnvB;IACD;QACE,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE,yCAAyC;QACrD,WAAW,EAAE,0OAA0O;QACvP,aAAa,EAAE,mcAAmc;KACnd;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,UAAU,EAAE,4CAA4C;QACxD,WAAW,EAAE,kPAAkP;QAC/P,aAAa,EAAE,+oBAA+oB;KAC/pB;IACD;QACE,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE,yCAAyC;QACrD,WAAW,EAAE,wGAAwG;QACrH,aAAa,EAAE,qRAAqR;KACrS;IACD;QACE,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE,yCAAyC;QACrD,WAAW,EAAE,2UAA2U;QACxV,aAAa,EAAE,qTAAqT;KACrU;IACD;QACE,IAAI,EAAE,cAAc;QACpB,UAAU,EAAE,iCAAiC;QAC7C,WAAW,EAAE,gNAAgN;QAC7N,aAAa,EAAE,gpBAAgpB;KAChqB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,UAAU,EAAE,mCAAmC;QAC/C,WAAW,EAAE,2ZAA2Z;QACxa,aAAa,EAAE,+lBAA+lB;KAC/mB;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,UAAU,EAAE,uCAAuC;QACnD,WAAW,EAAE,0RAA0R;QACvS,aAAa,EAAE,ynBAAynB;KACzoB;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,UAAU,EAAE,uCAAuC;QACnD,WAAW,EAAE,+TAA+T;QAC5U,aAAa,EAAE,o3BAAo3B;KACp4B;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,UAAU,EAAE,2CAA2C;QACvD,WAAW,EACT,+bAA+b;QACjc,aAAa,EACX,6rBAA6rB;KAChsB;IACD;QACE,IAAI,EAAE,wCAAwC;QAC9C,UAAU,EAAE,4DAA4D;QACxE,WAAW,EACT,2KAA2K;QAC7K,aAAa,EACX,2OAA2O;KAC9O;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,UAAU,EAAE,8CAA8C;QAC1D,WAAW,EACT,6IAA6I;QAC/I,aAAa,EACX,uKAAuK;KAC1K;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,UAAU,EAAE,qCAAqC;QACjD,WAAW,EACT,0IAA0I;QAC5I,aAAa,EACX,ieAAie;KACpe;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,UAAU,EAAE,yCAAyC;QACrD,WAAW,EACT,6HAA6H;QAC/H,aAAa,EACX,8UAA8U;KACjV;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,UAAU,EAAE,oDAAoD;QAChE,WAAW,EACT,mYAAmY;QACrY,aAAa,EACX,myBAAmyB;KACtyB;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,UAAU,EAAE,0CAA0C;QACtD,WAAW,EACT,iWAAiW;QACnW,aAAa,EACX,s7BAAs7B;KACz7B;IACD;QACE,IAAI,EAAE,aAAa;QACnB,UAAU,EAAE,gCAAgC;QAC5C,WAAW,EACT,kKAAkK;QACpK,aAAa,EACX,wiBAAwiB;KAC3iB;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,UAAU,EAAE,0CAA0C;QACtD,WAAW,EACT,2OAA2O;QAC7O,aAAa,EACX,gqBAAgqB;KACnqB;IACD,gFAAgF;IAChF,iFAAiF;IACjF,yEAAyE;IACzE,gFAAgF;IAChF;QACE,IAAI,EAAE,sBAAsB;QAC5B,UAAU,EAAE,yCAAyC;QACrD,WAAW,EAAE,qFAAqF;QAClG,aAAa,EAAE,mOAAmO;KACnP;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,UAAU,EAAE,iDAAiD;QAC7D,WAAW,EAAE,mKAAmK;QAChL,aAAa,EAAE,4fAA4f;KAC5gB;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,UAAU,EAAE,wCAAwC;QACpD,WAAW,EAAE,2LAA2L;QACxM,aAAa,EAAE,8wBAA8wB;KAC9xB;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,UAAU,EAAE,oCAAoC;QAChD,WAAW,EAAE,mFAAmF;QAChG,aAAa,EAAE,uWAAuW;KACvX;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,UAAU,EAAE,qCAAqC;QACjD,WAAW,EAAE,yEAAyE;QACtF,aAAa,EAAE,6cAA6c;KAC7d;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,UAAU,EAAE,qCAAqC;QACjD,WAAW,EAAE,+EAA+E;QAC5F,aAAa,EAAE,4MAA4M;KAC5N;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,UAAU,EAAE,2CAA2C;QACvD,WAAW,EAAE,2JAA2J;QACxK,aAAa,EAAE,0VAA0V;KAC1W;IACD,kFAAkF;IAClF,kFAAkF;IAClF,0EAA0E;IAC1E,oFAAoF;IACpF,qFAAqF;IACrF,sFAAsF;IACtF,8EAA8E;IAC9E,6EAA6E;IAC7E,sFAAsF;IACtF,qFAAqF;IACrF,qFAAqF;IACrF,oFAAoF;IACpF,kEAAkE;IAClE,gFAAgF;IAChF,mFAAmF;IACnF,oDAAoD;IACpD;QACE,IAAI,EAAE,sBAAsB;QAC5B,UAAU,EAAE,4CAA4C;QACxD,WAAW,EAAE,yFAAyF;QACtG,aAAa,EAAE,6WAA6W;KAC7X;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,UAAU,EAAE,8CAA8C;QAC1D,WAAW,EAAE,+GAA+G;QAC5H,aAAa,EAAE,waAAwa;KACxb;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,UAAU,EAAE,0CAA0C;QACtD,WAAW,EAAE,uHAAuH;QACpI,aAAa,EAAE,6UAA6U;KAC7V;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,UAAU,EAAE,0CAA0C;QACtD,WAAW,EAAE,4HAA4H;QACzI,aAAa,EAAE,qVAAqV;KACrW;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,UAAU,EAAE,iDAAiD;QAC7D,WAAW,EAAE,qIAAqI;QAClJ,aAAa,EAAE,2bAA2b;KAC3c;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,UAAU,EAAE,6CAA6C;QACzD,WAAW,EAAE,kHAAkH;QAC/H,aAAa,EAAE,0aAA0a;KAC1b;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,UAAU,EAAE,8CAA8C;QAC1D,WAAW,EAAE,kHAAkH;QAC/H,aAAa,EAAE,kjBAAkjB;KAClkB;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,UAAU,EAAE,gDAAgD;QAC5D,WAAW,EAAE,+QAA+Q;QAC5R,aAAa,EAAE,2hBAA2hB;KAC3iB;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,UAAU,EAAE,oDAAoD;QAChE,WAAW,EAAE,8VAA8V;QAC3W,aAAa,EAAE,wkBAAwkB;KACxlB;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,UAAU,EAAE,8CAA8C;QAC1D,WAAW,EAAE,2dAA2d;QACxe,aAAa,EAAE,2oBAA2oB;KAC3pB;IACD,gFAAgF;IAChF,sFAAsF;IACtF,qFAAqF;IACrF,uFAAuF;IACvF,8DAA8D;IAC9D;QACE,IAAI,EAAE,4BAA4B;QAClC,UAAU,EAAE,gDAAgD;QAC5D,WAAW,EAAE,wMAAwM;QACrN,aAAa,EAAE,skBAAskB;KACtlB;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,UAAU,EAAE,kDAAkD;QAC9D,WAAW,EAAE,2NAA2N;QACxO,aAAa,EAAE,mgBAAmgB;KACnhB;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,UAAU,EAAE,sCAAsC;QAClD,WAAW,EAAE,iPAAiP;QAC9P,aAAa,EAAE,4nBAA4nB;KAC5oB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,UAAU,EAAE,yCAAyC;QACrD,WAAW,EAAE,wfAAwf;QACrgB,aAAa,EAAE,8nBAA8nB;KAC9oB;CACF,CAAC;AA0CF,MAAM,CAAC,MAAM,oBAAoB,GAAwB;IACvD,+EAA+E;IAC/E;QACE,UAAU,EAAE,kCAAkC;QAC9C,QAAQ,EAAE,aAAa;QACvB,MAAM,EAAE,+CAA+C;KACxD;IACD;QACE,UAAU,EAAE,wCAAwC;QACpD,QAAQ,EAAE,aAAa;QACvB,MAAM,EAAE,iDAAiD;KAC1D;IACD;QACE,UAAU,EAAE,qCAAqC;QACjD,QAAQ,EAAE,aAAa;QACvB,MAAM,EAAE,+CAA+C;KACxD;IACD,gFAAgF;IAChF,+EAA+E;IAC/E,oFAAoF;IACpF,6DAA6D;IAC7D,wEAAwE;IACxE;QACE,UAAU,EAAE,8BAA8B;QAC1C,QAAQ,EAAE,cAAc;QACxB,MAAM,EAAE,mDAAmD;KAC5D;IACD;QACE,UAAU,EAAE,gCAAgC;QAC5C,QAAQ,EAAE,cAAc;QACxB,MAAM,EAAE,iIAAiI;KAC1I;IACD;QACE,UAAU,EAAE,qCAAqC;QACjD,QAAQ,EAAE,cAAc;QACxB,MAAM,EAAE,gGAAgG;KACzG;IACD,uFAAuF;IACvF;QACE,UAAU,EAAE,qDAAqD;QACjE,QAAQ,EAAE,iBAAiB;QAC3B,MAAM,EAAE,kCAAkC;KAC3C;IACD;QACE,UAAU,EAAE,2CAA2C;QACvD,QAAQ,EAAE,iBAAiB;QAC3B,MAAM,EAAE,kCAAkC;KAC3C;IACD;QACE,UAAU,EAAE,+BAA+B;QAC3C,QAAQ,EAAE,iBAAiB;QAC3B,MAAM,EAAE,qDAAqD;KAC9D;IACD;QACE,UAAU,EAAE,6BAA6B;QACzC,QAAQ,EAAE,iBAAiB;QAC3B,MAAM,EAAE,oZAAoZ;KAC7Z;IACD,qDAAqD;IACrD;QACE,UAAU,EAAE,kCAAkC;QAC9C,QAAQ,EAAE,sBAAsB;QAChC,MAAM,EAAE,8CAA8C;KACvD;IACD;QACE,UAAU,EAAE,+CAA+C;QAC3D,QAAQ,EAAE,sBAAsB;QAChC,MAAM,EAAE,kGAAkG;KAC3G;IACD;QACE,UAAU,EAAE,mDAAmD;QAC/D,QAAQ,EAAE,sBAAsB;QAChC,MAAM,EAAE,+FAA+F;KACxG;IACD;QACE,UAAU,EAAE,wDAAwD;QACpE,QAAQ,EAAE,sBAAsB;QAChC,MAAM,EAAE,kPAAkP;KAC3P;IACD,8EAA8E;IAC9E,kFAAkF;IAClF,iFAAiF;IACjF,gFAAgF;IAChF,mFAAmF;IACnF,6EAA6E;IAC7E,oFAAoF;IACpF,sFAAsF;IACtF,8EAA8E;IAC9E,+EAA+E;IAC/E,6EAA6E;IAC7E,iFAAiF;IACjF;QACE,UAAU,EAAE,qCAAqC;QACjD,QAAQ,EAAE,gBAAgB;QAC1B,MAAM,EAAE,4RAA4R;KACrS;IACD;QACE,UAAU,EAAE,wDAAwD;QACpE,QAAQ,EAAE,gBAAgB;QAC1B,MAAM,EAAE,4dAA4d;KACre;IACD;QACE,UAAU,EAAE,4DAA4D;QACxE,QAAQ,EAAE,gBAAgB;QAC1B,MAAM,EAAE,scAAsc;KAC/c;IACD;QACE,UAAU,EAAE,oDAAoD;QAChE,QAAQ,EAAE,gBAAgB;QAC1B,MAAM,EAAE,inBAAinB;KAC1nB;IACD;QACE,UAAU,EAAE,6DAA6D;QACzE,QAAQ,EAAE,gBAAgB;QAC1B,MAAM,EACJ,irBAAirB;KACprB;IACD;QACE,UAAU,EAAE,+BAA+B;QAC3C,QAAQ,EAAE,gBAAgB;QAC1B,MAAM,EAAE,uMAAuM;KAChN;IACD;QACE,UAAU,EAAE,kDAAkD;QAC9D,QAAQ,EAAE,gBAAgB;QAC1B,MAAM,EAAE,ymBAAymB;KAClnB;IACD;QACE,UAAU,EAAE,2CAA2C;QACvD,QAAQ,EAAE,gBAAgB;QAC1B,MAAM,EAAE,gXAAgX;KACzX;IACD;QACE,UAAU,EAAE,6CAA6C;QACzD,QAAQ,EAAE,gBAAgB;QAC1B,MAAM,EAAE,uVAAuV;KAChW;IACD,sDAAsD;IACtD;QACE,UAAU,EAAE,uCAAuC;QACnD,QAAQ,EAAE,cAAc;QACxB,MAAM,EAAE,wXAAwX;KACjY;IACD,gFAAgF;IAChF,uFAAuF;IACvF;QACE,UAAU,EAAE,gBAAgB;QAC5B,QAAQ,EAAE,sBAAsB;QAChC,MAAM,EAAE,8NAA8N;KACvO;IACD;QACE,UAAU,EAAE,gBAAgB;QAC5B,QAAQ,EAAE,sBAAsB;QAChC,MAAM,EAAE,gQAAgQ;KACzQ;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,MAAe,EAAE,UAAkB;IACjE,IAAI,GAAG,GAAY,MAAM,CAAC;IAC1B,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,IAAI,GAAG,IAAI,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC7D,GAAG,GAAI,GAA+B,CAAC,GAAG,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/core/durableSecretScrub.d.ts

@@ -0,0 +1,129 @@
+/**
+ * durableSecretScrub — the ONE shared credential-pattern module + the
+ * metadata-returning `scrubForStore` variant (Durable-Output Hygiene Standard,
+ * "What Persists Must Be Clean" — docs/specs/durable-output-hygiene-standard.md
+ * §2 "Layer B mechanics", rollout step 0).
+ *
+ * WHY this module exists (spec §2, round-1 MATERIAL finding): "the existing
+ * scrubber" was ≥3 diverged inline copies — `scrubSecrets` (src/monitoring/
+ * scrubSecrets.ts), `autonomousHeartbeatScrub` (src/monitoring/), and
+ * `SecretRedactor.BUILTIN_PATTERNS` (src/core/) — already drifted on the
+ * Anthropic key prefix (`sk-ant-api…` vs `sk-ant-…`). Building a FOURTH copy for
+ * the durable-output safety floor would bake Class-1 drift into the floor
+ * itself. This is the single authoritative pattern set; Layer B consumes it, and
+ * the existing copies migrate/ratchet to it as a tracked rollout follow-up
+ * (docs/specs/durable-output-hygiene-standard.md §2 rollout step 0).
+ *
+ * WHAT it guarantees (spec §2 "Layer B is the SECURITY FLOOR"): a deterministic,
+ * best-effort SPAN redaction over model output BEFORE it persists into durable
+ * storage. LLM compliance (Layer A, the prompt clause) is probabilistic; this
+ * floor is not. HONEST COVERAGE (spec §1 registry text): KNOWN TOKEN SHAPES
+ * ONLY — the floor catches what matches its patterns; encoded / split /
+ * paraphrased secrets are only reachable by the prompt rule, and against novel
+ * adversarial obfuscation this is BEST-EFFORT, never a reliable standalone
+ * security control.
+ *
+ * FAILURE SEMANTICS (spec §2 "fail-safe-toward-redaction, never fail-open"): on
+ * a scrub exception OR an input over the size bound, the whole field is replaced
+ * with a typed marker (`[REDACTED:scrub-error]` / `[REDACTED:oversize]`) + a
+ * preserved-length note — raw bytes NEVER land because the scrub broke. There is
+ * NO runtime timeout pretense (a synchronous regex pass cannot be preempted
+ * in-process): instead the pinned test asserts a worst-case timing budget on
+ * pathological inputs and forbids non-linear patterns (no nested quantifiers), so
+ * the budget is proven in CI, not hoped at runtime.
+ *
+ * TELEMETRY SAFETY (spec §2 "dry-run leak-path guard"): the returned redaction
+ * metadata carries pattern-kind + offset/length ONLY — NEVER matched bytes,
+ * never surrounding context. A would-redact record that quoted its match would
+ * BE the Class-4 defect, reintroduced by the fix's own soak mode.
+ *
+ * PURE + no I/O: this module is a deterministic, unit-testable function. Config
+ * gating, metrics, provenance markers, and the poisoning alarm live one layer up
+ * in DurableOutputScrubber (src/monitoring/).
+ */
+/** A durable-secret pattern kind — the typed label on every redaction span. */
+export type DurableSecretKind = 'anthropic-key' | 'openai-key' | 'github-token' | 'slack-token' | 'aws-access-key' | 'stripe-key' | 'google-api-key' | 'telegram-bot-token' | 'jwt' | 'pem-private-key' | 'bearer-token' | 'url-embedded-credential' | 'labeled-secret';
+/** A structural failure marker kind (fail-safe path — never a real match). */
+export type DurableScrubFailureKind = 'scrub-error' | 'oversize';
+/** One redacted span. offset/length are in ORIGINAL-text coordinates. NEVER
+ *  carries the matched bytes (telemetry-safety, spec §2). */
+export interface RedactionSpan {
+    kind: DurableSecretKind | DurableScrubFailureKind;
+    /** Byte/char offset in the ORIGINAL input where the redacted span began. */
+    offset: number;
+    /** Length (in chars) of the ORIGINAL span that was replaced. */
+    length: number;
+}
+export interface ScrubForStoreResult {
+    /** The scrubbed text — matched spans replaced with `[REDACTED:<kind>]`. */
+    text: string;
+    /** Structured redaction metadata (spec §2 — kind/offset/length only). */
+    redactions: RedactionSpan[];
+    /** True when the whole field was replaced because the input exceeded the size bound. */
+    truncated?: boolean;
+    /** True when the whole field was replaced because the scrub itself threw. */
+    error?: boolean;
+}
+/** One credential pattern. `group` names the capture group whose span is
+ *  redacted (default 0 = the whole match) so a labelled pair can keep its label
+ *  and redact only the value. Every regex carries `gd` (global + hasIndices) so
+ *  group offsets are read from `match.indices`. */
+interface ScrubPattern {
+    kind: DurableSecretKind;
+    regex: RegExp;
+    group?: number;
+}
+/**
+ * The authoritative pattern set — the UNION of the three pre-existing copies
+ * (spec Frontloaded Decision #1). ORDER MATTERS for overlap resolution: the
+ * more-specific prefix patterns (anthropic before generic openai `sk-`, stripe
+ * `sk_` before generic) sit earlier so the greedy first-wins overlap resolver
+ * labels a span with its most-specific kind.
+ *
+ * LINEARITY CONTRACT (spec §2): every pattern uses SINGLE quantifiers over
+ * character classes with no nesting — no `(x+)+` / `(x*)*` shapes — so a
+ * pathological input cannot trigger catastrophic backtracking. The pinned test
+ * (tests/unit/durableSecretScrub.test.ts) asserts both the per-kind coverage and
+ * a worst-case timing budget on adversarial inputs, and forbids nested
+ * quantifiers structurally.
+ */
+export declare const DURABLE_SECRET_PATTERNS: readonly ScrubPattern[];
+/** Default input size bound (spec §2: 1 MB). Over this, the whole field is
+ *  replaced with `[REDACTED:oversize]` (fail-safe — never persist raw bytes the
+ *  scrub could not fully walk). */
+export declare const DEFAULT_MAX_SCRUB_BYTES = 1000000;
+export interface ScrubForStoreOptions {
+    /** Input size bound in chars. Over this → whole-field `[REDACTED:oversize]`. */
+    maxBytes?: number;
+}
+/**
+ * scrubForStore — the metadata-returning safety-floor scrub (spec §2).
+ *
+ * Replaces every matched credential span with a typed `[REDACTED:<kind>]` marker
+ * and returns the structured redaction metadata (kind/offset/length ONLY, never
+ * the matched bytes). Fail-safe on both edges:
+ *   - input over `maxBytes` → whole field `[REDACTED:oversize]` (truncated:true);
+ *   - any internal throw     → whole field `[REDACTED:scrub-error]` (error:true).
+ *
+ * A benign string with no matches returns `{ text: <unchanged>, redactions: [] }`.
+ */
+export declare function scrubForStore(input: string, options?: ScrubForStoreOptions): ScrubForStoreResult;
+/**
+ * scrubStructured — apply the floor to every string field of a shallow record,
+ * returning the scrubbed record + the union of redactions (each tagged with its
+ * field). Used by structured stores (spec §2: "Scrub runs BEFORE serialization
+ * where the store writes structured fields"). Non-string fields pass through
+ * untouched; string-array fields are scrubbed element-wise.
+ */
+export interface StructuredRedactionSpan extends RedactionSpan {
+    field: string;
+}
+export interface ScrubStructuredResult<T> {
+    record: T;
+    redactions: StructuredRedactionSpan[];
+    truncated: boolean;
+    error: boolean;
+}
+export declare function scrubStructured<T extends Record<string, unknown>>(record: T, fields: readonly (keyof T)[], options?: ScrubForStoreOptions): ScrubStructuredResult<T>;
+export {};
+//# sourceMappingURL=durableSecretScrub.d.ts.map

package/dist/core/durableSecretScrub.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"durableSecretScrub.d.ts","sourceRoot":"","sources":["../../src/core/durableSecretScrub.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,+EAA+E;AAC/E,MAAM,MAAM,iBAAiB,GACzB,eAAe,GACf,YAAY,GACZ,cAAc,GACd,aAAa,GACb,gBAAgB,GAChB,YAAY,GACZ,gBAAgB,GAChB,oBAAoB,GACpB,KAAK,GACL,iBAAiB,GACjB,cAAc,GACd,yBAAyB,GACzB,gBAAgB,CAAC;AAErB,8EAA8E;AAC9E,MAAM,MAAM,uBAAuB,GAAG,aAAa,GAAG,UAAU,CAAC;AAEjE;6DAC6D;AAC7D,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,iBAAiB,GAAG,uBAAuB,CAAC;IAClD,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,UAAU,EAAE,aAAa,EAAE,CAAC;IAC5B,wFAAwF;IACxF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;mDAGmD;AACnD,UAAU,YAAY;IACpB,IAAI,EAAE,iBAAiB,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,uBAAuB,EAAE,SAAS,YAAY,EA2CjD,CAAC;AAEX;;mCAEmC;AACnC,eAAO,MAAM,uBAAuB,UAAY,CAAC;AAEjD,MAAM,WAAW,oBAAoB;IACnC,gFAAgF;IAChF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAaD;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,oBAAyB,GACjC,mBAAmB,CAmErB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,uBAAwB,SAAQ,aAAa;IAC5D,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,qBAAqB,CAAC,CAAC;IACtC,MAAM,EAAE,CAAC,CAAC;IACV,UAAU,EAAE,uBAAuB,EAAE,CAAC;IACtC,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,wBAAgB,eAAe,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/D,MAAM,EAAE,CAAC,EACT,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,EAC5B,OAAO,GAAE,oBAAyB,GACjC,qBAAqB,CAAC,CAAC,CAAC,CA4B1B"}

package/dist/core/durableSecretScrub.js

@@ -0,0 +1,220 @@
+/**
+ * durableSecretScrub — the ONE shared credential-pattern module + the
+ * metadata-returning `scrubForStore` variant (Durable-Output Hygiene Standard,
+ * "What Persists Must Be Clean" — docs/specs/durable-output-hygiene-standard.md
+ * §2 "Layer B mechanics", rollout step 0).
+ *
+ * WHY this module exists (spec §2, round-1 MATERIAL finding): "the existing
+ * scrubber" was ≥3 diverged inline copies — `scrubSecrets` (src/monitoring/
+ * scrubSecrets.ts), `autonomousHeartbeatScrub` (src/monitoring/), and
+ * `SecretRedactor.BUILTIN_PATTERNS` (src/core/) — already drifted on the
+ * Anthropic key prefix (`sk-ant-api…` vs `sk-ant-…`). Building a FOURTH copy for
+ * the durable-output safety floor would bake Class-1 drift into the floor
+ * itself. This is the single authoritative pattern set; Layer B consumes it, and
+ * the existing copies migrate/ratchet to it as a tracked rollout follow-up
+ * (docs/specs/durable-output-hygiene-standard.md §2 rollout step 0).
+ *
+ * WHAT it guarantees (spec §2 "Layer B is the SECURITY FLOOR"): a deterministic,
+ * best-effort SPAN redaction over model output BEFORE it persists into durable
+ * storage. LLM compliance (Layer A, the prompt clause) is probabilistic; this
+ * floor is not. HONEST COVERAGE (spec §1 registry text): KNOWN TOKEN SHAPES
+ * ONLY — the floor catches what matches its patterns; encoded / split /
+ * paraphrased secrets are only reachable by the prompt rule, and against novel
+ * adversarial obfuscation this is BEST-EFFORT, never a reliable standalone
+ * security control.
+ *
+ * FAILURE SEMANTICS (spec §2 "fail-safe-toward-redaction, never fail-open"): on
+ * a scrub exception OR an input over the size bound, the whole field is replaced
+ * with a typed marker (`[REDACTED:scrub-error]` / `[REDACTED:oversize]`) + a
+ * preserved-length note — raw bytes NEVER land because the scrub broke. There is
+ * NO runtime timeout pretense (a synchronous regex pass cannot be preempted
+ * in-process): instead the pinned test asserts a worst-case timing budget on
+ * pathological inputs and forbids non-linear patterns (no nested quantifiers), so
+ * the budget is proven in CI, not hoped at runtime.
+ *
+ * TELEMETRY SAFETY (spec §2 "dry-run leak-path guard"): the returned redaction
+ * metadata carries pattern-kind + offset/length ONLY — NEVER matched bytes,
+ * never surrounding context. A would-redact record that quoted its match would
+ * BE the Class-4 defect, reintroduced by the fix's own soak mode.
+ *
+ * PURE + no I/O: this module is a deterministic, unit-testable function. Config
+ * gating, metrics, provenance markers, and the poisoning alarm live one layer up
+ * in DurableOutputScrubber (src/monitoring/).
+ */
+/**
+ * The authoritative pattern set — the UNION of the three pre-existing copies
+ * (spec Frontloaded Decision #1). ORDER MATTERS for overlap resolution: the
+ * more-specific prefix patterns (anthropic before generic openai `sk-`, stripe
+ * `sk_` before generic) sit earlier so the greedy first-wins overlap resolver
+ * labels a span with its most-specific kind.
+ *
+ * LINEARITY CONTRACT (spec §2): every pattern uses SINGLE quantifiers over
+ * character classes with no nesting — no `(x+)+` / `(x*)*` shapes — so a
+ * pathological input cannot trigger catastrophic backtracking. The pinned test
+ * (tests/unit/durableSecretScrub.test.ts) asserts both the per-kind coverage and
+ * a worst-case timing budget on adversarial inputs, and forbids nested
+ * quantifiers structurally.
+ */
+export const DURABLE_SECRET_PATTERNS = [
+    // Anthropic API keys — catches BOTH the drifted `sk-ant-api…` and `sk-ant-…`
+    // shapes the three copies disagreed on (spec §2, the Anthropic-prefix drift).
+    { kind: 'anthropic-key', regex: /sk-ant-[A-Za-z0-9_-]{20,}/gd },
+    // Stripe live/test keys (before the generic openai `sk-` — distinct `_` sep).
+    { kind: 'stripe-key', regex: /sk_(?:live|test)_[A-Za-z0-9]{12,}/gd },
+    // Generic provider keys: sk-/pk-/rk- prefixed (OpenAI + generic).
+    { kind: 'openai-key', regex: /\b(?:sk|pk|rk)-[A-Za-z0-9]{16,}/gd },
+    // GitHub PAT / OAuth / app tokens (ghp_/gho_/ghu_/ghs_/ghr_).
+    { kind: 'github-token', regex: /\bgh[pousr]_[A-Za-z0-9]{20,}/gd },
+    // Google API keys (AIza + 35 url-safe chars).
+    { kind: 'google-api-key', regex: /\bAIza[A-Za-z0-9_-]{35}/gd },
+    // Slack tokens: xoxb-/xoxp-/xoxa-/xoxr-/xoxs- + segments.
+    { kind: 'slack-token', regex: /\bxox[baprs]-[A-Za-z0-9-]{10,}/gd },
+    // AWS access key IDs (AKIA/ASIA + 16 uppercase alphanumerics).
+    { kind: 'aws-access-key', regex: /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/gd },
+    // Telegram bot tokens: <digits>:<35-char base64url-ish secret>.
+    { kind: 'telegram-bot-token', regex: /\b\d{6,12}:[A-Za-z0-9_-]{30,}\b/gd },
+    // PEM private-key blocks. Lazy body over a RESTRICTED char class terminated by
+    // a literal `-----END…` — single quantifier, no nesting, linear.
+    {
+        kind: 'pem-private-key',
+        regex: /-----BEGIN[A-Z ]*PRIVATE KEY-----[A-Za-z0-9+/=\s]{0,8192}?-----END[A-Z ]*PRIVATE KEY-----/gd,
+    },
+    // JWTs: three base64url segments. Known FP suspect on dotted identifiers
+    // (spec rollout step 2) — surfaced per-pattern-kind in the dry-run soak.
+    { kind: 'jwt', regex: /\b[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{16,}\b/gd },
+    // Bearer tokens.
+    { kind: 'bearer-token', regex: /Bearer\s+[A-Za-z0-9_\-.]{20,}/gd },
+    // URLs with embedded credentials (scheme://user:pass@host) — redact the
+    // credential group (group 1), keep the scheme/host structure readable.
+    {
+        kind: 'url-embedded-credential',
+        regex: /([a-z][a-z0-9+.-]*:\/\/)[^/\s:@]+:[^/\s@]+@/gd,
+        group: undefined, // whole match replaced; the scheme is short + re-derivable
+    },
+    // Labelled secret pairs (token=…, api_key: …, password "…") — redact only the
+    // VALUE group so the label survives ("a <label> was redacted").
+    {
+        kind: 'labeled-secret',
+        regex: /(?:token|secret|password|passwd|pwd|api[_-]?key)(?:["'=:\s]+)([A-Za-z0-9._-]{12,})/gid,
+        group: 1,
+    },
+];
+/** Default input size bound (spec §2: 1 MB). Over this, the whole field is
+ *  replaced with `[REDACTED:oversize]` (fail-safe — never persist raw bytes the
+ *  scrub could not fully walk). */
+export const DEFAULT_MAX_SCRUB_BYTES = 1_000_000;
+/** Build the typed marker for a redacted span. */
+function markerFor(kind) {
+    return `[REDACTED:${kind}]`;
+}
+/**
+ * scrubForStore — the metadata-returning safety-floor scrub (spec §2).
+ *
+ * Replaces every matched credential span with a typed `[REDACTED:<kind>]` marker
+ * and returns the structured redaction metadata (kind/offset/length ONLY, never
+ * the matched bytes). Fail-safe on both edges:
+ *   - input over `maxBytes` → whole field `[REDACTED:oversize]` (truncated:true);
+ *   - any internal throw     → whole field `[REDACTED:scrub-error]` (error:true).
+ *
+ * A benign string with no matches returns `{ text: <unchanged>, redactions: [] }`.
+ */
+export function scrubForStore(input, options = {}) {
+    const text = typeof input === 'string' ? input : String(input ?? '');
+    const maxBytes = options.maxBytes ?? DEFAULT_MAX_SCRUB_BYTES;
+    // Fail-safe edge 1: oversize. A field too large to be walked with a proven
+    // timing budget is replaced wholesale rather than partially scanned.
+    if (text.length > maxBytes) {
+        return {
+            text: `${markerFor('oversize')} (${text.length} chars withheld)`,
+            redactions: [{ kind: 'oversize', offset: 0, length: text.length }],
+            truncated: true,
+        };
+    }
+    try {
+        // 1. Collect every match span across all patterns over the ORIGINAL text.
+        const raw = [];
+        for (const { kind, regex, group } of DURABLE_SECRET_PATTERNS) {
+            regex.lastIndex = 0;
+            let m;
+            while ((m = regex.exec(text)) !== null) {
+                const gi = group ?? 0;
+                const indices = m.indices;
+                const span = indices?.[gi] ?? (gi === 0 ? [m.index, m.index + m[0].length] : undefined);
+                if (span && span[1] > span[0]) {
+                    raw.push({ start: span[0], end: span[1], kind });
+                }
+                // Guard against a zero-width match wedging the loop.
+                if (m[0].length === 0)
+                    regex.lastIndex++;
+            }
+        }
+        if (raw.length === 0) {
+            return { text, redactions: [] };
+        }
+        // 2. Overlap resolution: sort by start asc, then longest-first; greedily
+        //    accept non-overlapping spans (first/longest wins → most-specific kind).
+        raw.sort((a, b) => (a.start - b.start) || (b.end - a.end));
+        const accepted = [];
+        let cursor = -1;
+        for (const s of raw) {
+            if (s.start >= cursor) {
+                accepted.push(s);
+                cursor = s.end;
+            }
+        }
+        // 3. Build the scrubbed output + the metadata (original-text coordinates).
+        let out = '';
+        let last = 0;
+        const redactions = [];
+        for (const s of accepted) {
+            out += text.slice(last, s.start) + markerFor(s.kind);
+            redactions.push({ kind: s.kind, offset: s.start, length: s.end - s.start });
+            last = s.end;
+        }
+        out += text.slice(last);
+        return { text: out, redactions };
+    }
+    catch { // @silent-fallback-ok — fail-safe-toward-redaction: a scrub throw must NEVER persist raw bytes (spec §2). The whole field is withheld under a typed marker and the caller records the error via the returned error:true flag.
+        return {
+            text: `${markerFor('scrub-error')} (${text.length} chars withheld)`,
+            redactions: [{ kind: 'scrub-error', offset: 0, length: text.length }],
+            error: true,
+        };
+    }
+}
+export function scrubStructured(record, fields, options = {}) {
+    const out = { ...record };
+    const redactions = [];
+    let truncated = false;
+    let error = false;
+    for (const field of fields) {
+        const value = record[field];
+        const fieldName = String(field);
+        if (typeof value === 'string') {
+            const r = scrubForStore(value, options);
+            out[fieldName] = r.text;
+            if (r.truncated)
+                truncated = true;
+            if (r.error)
+                error = true;
+            for (const span of r.redactions)
+                redactions.push({ ...span, field: fieldName });
+        }
+        else if (Array.isArray(value)) {
+            out[fieldName] = value.map((el) => {
+                if (typeof el !== 'string')
+                    return el;
+                const r = scrubForStore(el, options);
+                if (r.truncated)
+                    truncated = true;
+                if (r.error)
+                    error = true;
+                for (const span of r.redactions)
+                    redactions.push({ ...span, field: fieldName });
+                return r.text;
+            });
+        }
+    }
+    return { record: out, redactions, truncated, error };
+}
+//# sourceMappingURL=durableSecretScrub.js.map

package/dist/core/durableSecretScrub.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"durableSecretScrub.js","sourceRoot":"","sources":["../../src/core/durableSecretScrub.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAoDH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAA4B;IAC9D,6EAA6E;IAC7E,8EAA8E;IAC9E,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,6BAA6B,EAAE;IAC/D,8EAA8E;IAC9E,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,qCAAqC,EAAE;IACpE,kEAAkE;IAClE,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,mCAAmC,EAAE;IAClE,8DAA8D;IAC9D,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,gCAAgC,EAAE;IACjE,8CAA8C;IAC9C,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,2BAA2B,EAAE;IAC9D,0DAA0D;IAC1D,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,kCAAkC,EAAE;IAClE,+DAA+D;IAC/D,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,iCAAiC,EAAE;IACpE,gEAAgE;IAChE,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,mCAAmC,EAAE;IAC1E,+EAA+E;IAC/E,iEAAiE;IACjE;QACE,IAAI,EAAE,iBAAiB;QACvB,KAAK,EAAE,6FAA6F;KACrG;IACD,yEAAyE;IACzE,yEAAyE;IACzE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,iEAAiE,EAAE;IACzF,iBAAiB;IACjB,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,iCAAiC,EAAE;IAClE,wEAAwE;IACxE,uEAAuE;IACvE;QACE,IAAI,EAAE,yBAAyB;QAC/B,KAAK,EAAE,+CAA+C;QACtD,KAAK,EAAE,SAAS,EAAE,2DAA2D;KAC9E;IACD,8EAA8E;IAC9E,gEAAgE;IAChE;QACE,IAAI,EAAE,gBAAgB;QACtB,KAAK,EAAE,uFAAuF;QAC9F,KAAK,EAAE,CAAC;KACT;CACO,CAAC;AAEX;;mCAEmC;AACnC,MAAM,CAAC,MAAM,uBAAuB,GAAG,SAAS,CAAC;AAOjD,kDAAkD;AAClD,SAAS,SAAS,CAAC,IAA2B;IAC5C,OAAO,aAAa,IAAI,GAAG,CAAC;AAC9B,CAAC;AAQD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAC3B,KAAa,EACb,UAAgC,EAAE;IAElC,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,uBAAuB,CAAC;IAE7D,2EAA2E;IAC3E,qEAAqE;IACrE,IAAI,IAAI,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QAC3B,OAAO;YACL,IAAI,EAAE,GAAG,SAAS,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,MAAM,kBAAkB;YAChE,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YAClE,SAAS,EAAE,IAAI;SAChB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,0EAA0E;QAC1E,MAAM,GAAG,GAAc,EAAE,CAAC;QAC1B,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,uBAAuB,EAAE,CAAC;YAC7D,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;YACpB,IAAI,CAAyB,CAAC;YAC9B,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACvC,MAAM,EAAE,GAAG,KAAK,IAAI,CAAC,CAAC;gBACtB,MAAM,OAAO,GAAI,CAAyE,CAAC,OAAO,CAAC;gBACnG,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAqB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBAC5G,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC9B,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;gBACnD,CAAC;gBACD,qDAAqD;gBACrD,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC;oBAAE,KAAK,CAAC,SAAS,EAAE,CAAC;YAC3C,CAAC;QACH,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QAClC,CAAC;QAED,yEAAyE;QACzE,6EAA6E;QAC7E,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC;QAChB,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACpB,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,EAAE,CAAC;gBACtB,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACjB,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC;YACjB,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,MAAM,UAAU,GAAoB,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACrD,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YAC5E,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC;QACf,CAAC;QACD,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAExB,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC,CAAC,8NAA8N;QACtO,OAAO;YACL,IAAI,EAAE,GAAG,SAAS,CAAC,aAAa,CAAC,KAAK,IAAI,CAAC,MAAM,kBAAkB;YACnE,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YACrE,KAAK,EAAE,IAAI;SACZ,CAAC;IACJ,CAAC;AACH,CAAC;AAoBD,MAAM,UAAU,eAAe,CAC7B,MAAS,EACT,MAA4B,EAC5B,UAAgC,EAAE;IAElC,MAAM,GAAG,GAA4B,EAAE,GAAG,MAAM,EAAE,CAAC;IACnD,MAAM,UAAU,GAA8B,EAAE,CAAC;IACjD,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,KAAK,GAAG,KAAK,CAAC;IAElB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACxC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACxB,IAAI,CAAC,CAAC,SAAS;gBAAE,SAAS,GAAG,IAAI,CAAC;YAClC,IAAI,CAAC,CAAC,KAAK;gBAAE,KAAK,GAAG,IAAI,CAAC;YAC1B,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,UAAU;gBAAE,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAClF,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,GAAG,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;gBAChC,IAAI,OAAO,EAAE,KAAK,QAAQ;oBAAE,OAAO,EAAE,CAAC;gBACtC,MAAM,CAAC,GAAG,aAAa,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;gBACrC,IAAI,CAAC,CAAC,SAAS;oBAAE,SAAS,GAAG,IAAI,CAAC;gBAClC,IAAI,CAAC,CAAC,KAAK;oBAAE,KAAK,GAAG,IAAI,CAAC;gBAC1B,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,UAAU;oBAAE,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;gBAChF,OAAO,CAAC,CAAC,IAAI,CAAC;YAChB,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,GAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC5D,CAAC"}

package/dist/core/types.d.ts

@@ -4501,6 +4501,24 @@ export interface MonitoringConfig {
     standbyHonestyTiers?: {
         enabled?: boolean;
     };
+    /**
+     * Durable-Output Hygiene Standard §2 (Layer B — "What Persists Must Be Clean").
+     * The config-gated DurableOutputScrubber that redacts credential SPANS from LLM
+     * output at durable-output persistence chokepoints BEFORE the write. `enabled` is
+     * OMITTED from ConfigDefaults → resolved via the developmentAgent dark-feature
+     * gate (LIVE on a dev agent, DARK on the fleet). `dryRun` (default true, the
+     * canary) COMPUTES + records would-redact metrics but stores the ORIGINAL text —
+     * a real (dryRun:false) redaction flip is the OPERATOR'S endpoint decision
+     * (Frontloaded Decision #4). `perStore` is the per-store opt-out map. When
+     * absent/disabled, durable writes are byte-identical to today.
+     */
+    durableOutputScrub?: {
+        enabled?: boolean;
+        dryRun?: boolean;
+        perStore?: Record<string, {
+            enabled?: boolean;
+        }>;
+    };
     /**
      * CollaborationRedriveEngine — proactively re-engage a counterpart that
      * has gone silent on an open threadline-reply commitment. Ships OFF.