offrouter-core 0.5.1 → 0.6.0

package/dist/secret-scan.js

@@ -0,0 +1,125 @@
+/**
+ * Outbound secret scanner for OffRouter V1.
+ *
+ * Scans prompt/message text once at the delegation choke point before any
+ * provider adapter is invoked. Reuses credential shapes from secrets.ts —
+ * does not maintain a parallel pattern catalog.
+ *
+ * Findings never carry raw matched values. Audit records get pattern names
+ * only; redacted excerpts are for in-process error/result envelopes.
+ */
+import { REDACTED, SECRET_PATTERNS } from "./secrets.js";
+export const DEFAULT_OUTBOUND_SECRET_SCAN = "warn";
+/**
+ * Thrown when policy.outboundSecretScan === "block" and findings are present.
+ * Message and `patternNames` name kinds only — never matched content.
+ */
+export class OutboundSecretBlockedError extends Error {
+    code = "outbound_secret_blocked";
+    patternNames;
+    constructor(patternNames) {
+        const unique = uniqueNames(patternNames);
+        const kinds = unique.join(", ");
+        super(`Outbound request blocked: content matched credential pattern(s): ${kinds}`);
+        this.name = "OutboundSecretBlockedError";
+        this.patternNames = unique;
+    }
+}
+const EXCERPT_CONTEXT_CHARS = 24;
+/**
+ * Scan free text for known credential shapes.
+ * Returns findings with pattern names and redacted excerpts only.
+ */
+export function scanForSecrets(text) {
+    if (typeof text !== "string" || text.length === 0) {
+        return [];
+    }
+    const findings = [];
+    // Track matched spans so a more-specific pattern (sk-ant-) wins over
+    // a later generic one (sk-) covering the same bytes.
+    const claimed = [];
+    for (const { name, pattern } of SECRET_PATTERNS) {
+        // Clone so concurrent/repeated scans cannot race shared lastIndex,
+        // and so we do not mutate the module-level regex object permanently
+        // beyond what redact() already does (it resets lastIndex each use).
+        const re = new RegExp(pattern.source, pattern.flags);
+        let match;
+        while ((match = re.exec(text)) !== null) {
+            const start = match.index;
+            const end = start + match[0].length;
+            if (end === start) {
+                // Zero-width guard — avoid infinite loop on broken patterns.
+                re.lastIndex = start + 1;
+                continue;
+            }
+            if (overlapsAny(claimed, start, end)) {
+                continue;
+            }
+            claimed.push({ start, end });
+            findings.push({
+                patternName: name,
+                redactedExcerpt: buildRedactedExcerpt(text, start, end),
+            });
+        }
+    }
+    return findings;
+}
+/**
+ * Join message contents (system/user/assistant/tool) for a single scan pass.
+ */
+export function collectOutboundText(messages) {
+    return messages
+        .map((m) => (typeof m.content === "string" ? m.content : ""))
+        .filter((c) => c.length > 0)
+        .join("\n");
+}
+/**
+ * Apply scan mode to findings collected from outbound text.
+ * - "off": empty result, no throw
+ * - "warn": return findings (caller audits / attaches warnings)
+ * - "block": throw OutboundSecretBlockedError when findings exist
+ */
+export function enforceOutboundSecretScan(text, mode) {
+    const effective = mode ?? DEFAULT_OUTBOUND_SECRET_SCAN;
+    if (effective === "off") {
+        return [];
+    }
+    const findings = scanForSecrets(text);
+    if (findings.length === 0) {
+        return [];
+    }
+    if (effective === "block") {
+        throw new OutboundSecretBlockedError(findings.map((f) => f.patternName));
+    }
+    // warn
+    return findings;
+}
+function buildRedactedExcerpt(text, matchStart, matchEnd) {
+    const beforeStart = Math.max(0, matchStart - EXCERPT_CONTEXT_CHARS);
+    const afterEnd = Math.min(text.length, matchEnd + EXCERPT_CONTEXT_CHARS);
+    const before = text.slice(beforeStart, matchStart);
+    const after = text.slice(matchEnd, afterEnd);
+    const prefix = beforeStart > 0 ? "…" : "";
+    const suffix = afterEnd < text.length ? "…" : "";
+    // Surrounding context only — match replaced by the shared placeholder.
+    return `${prefix}${before}${REDACTED}${after}${suffix}`;
+}
+function overlapsAny(claimed, start, end) {
+    for (const c of claimed) {
+        if (start < c.end && end > c.start)
+            return true;
+    }
+    return false;
+}
+function uniqueNames(names) {
+    const seen = new Set();
+    const out = [];
+    for (const n of names) {
+        if (!seen.has(n)) {
+            seen.add(n);
+            out.push(n);
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=secret-scan.js.map

package/dist/secret-scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-scan.js","sourceRoot":"","sources":["../src/secret-scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAKzD,MAAM,CAAC,MAAM,4BAA4B,GAA2B,MAAM,CAAC;AAY3E;;;GAGG;AACH,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAC1C,IAAI,GAAG,yBAAkC,CAAC;IAC1C,YAAY,CAAW;IAEhC,YAAY,YAAsB;QAChC,MAAM,MAAM,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,KAAK,CACH,oEAAoE,KAAK,EAAE,CAC5E,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;QACzC,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC;IAC7B,CAAC;CACF;AAED,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAEjC;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,qEAAqE;IACrE,qDAAqD;IACrD,MAAM,OAAO,GAA0C,EAAE,CAAC;IAE1D,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,eAAe,EAAE,CAAC;QAChD,mEAAmE;QACnE,oEAAoE;QACpE,oEAAoE;QACpE,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,KAA6B,CAAC;QAClC,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;YAC1B,MAAM,GAAG,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YACpC,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;gBAClB,6DAA6D;gBAC7D,EAAE,CAAC,SAAS,GAAG,KAAK,GAAG,CAAC,CAAC;gBACzB,SAAS;YACX,CAAC;YACD,IAAI,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;gBACrC,SAAS;YACX,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7B,QAAQ,CAAC,IAAI,CAAC;gBACZ,WAAW,EAAE,IAAI;gBACjB,eAAe,EAAE,oBAAoB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;aACxD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAA4C;IAE5C,OAAO,QAAQ;SACZ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;SAC5D,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;SAC3B,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACvC,IAAY,EACZ,IAAwC;IAExC,MAAM,SAAS,GACb,IAAI,IAAI,4BAA4B,CAAC;IACvC,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;QAC1B,MAAM,IAAI,0BAA0B,CAClC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CACnC,CAAC;IACJ,CAAC;IACD,OAAO;IACP,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,oBAAoB,CAC3B,IAAY,EACZ,UAAkB,EAClB,QAAgB;IAEhB,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,qBAAqB,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,GAAG,qBAAqB,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1C,MAAM,MAAM,GAAG,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACjD,uEAAuE;IACvE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,WAAW,CAClB,OAAsD,EACtD,KAAa,EACb,GAAW;IAEX,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,KAAK,GAAG,CAAC,CAAC,GAAG,IAAI,GAAG,GAAG,CAAC,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;IAClD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,KAAe;IAClC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACjB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACZ,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/secrets.d.ts

@@ -1,5 +1,5 @@
 import { mkdir, readFile, rename, unlink, writeFile, chmod } from "node:fs/promises";
-/** Placeholder substituted for secret material in log-safe strings. */
+import { type ExecFileOptions } from "node:child_process";
 /** Placeholder substituted for secret material in log-safe strings. */
 export declare const REDACTED: "[REDACTED]";
 /**
@@ -28,10 +28,19 @@ export interface FileSecretStoreOptions {
     /** Injectable file operations for failure-path tests. Defaults to node fs. */
     fileSystem?: Partial<FileSecretStoreFileSystem>;
 }
+/**
+ * Injectable execFile for KeychainSecretStore tests.
+ * Mirrors node:child_process execFile Promise form (promisified).
+ */
+export type KeychainExecFile = (file: string, args: readonly string[] | null | undefined, options?: ExecFileOptions) => Promise<{
+    stdout: string | Buffer;
+    stderr: string | Buffer;
+}>;
 export interface KeychainSecretStoreOptions {
     /**
      * Keychain/keyring service name. OffRouter only reads entries it wrote
      * under this service — never foreign CLI credential stores.
+     * Full security `-s` value is `${service}:${scope}` (default scope "default").
      */
     service?: string;
     /**
@@ -39,6 +48,33 @@ export interface KeychainSecretStoreOptions {
      * Full item name is `${accountPrefix}${providerId}`.
      */
     accountPrefix?: string;
+    /**
+     * Service scope segment appended after `service` (default "default").
+     * Final security service string: `${service}:${scope}`.
+     */
+    scope?: string;
+    /**
+     * Path to the non-secret provider-id index file used by listProviders().
+     * Defaults to `$OFFROUTER_HOME/keychain-index.json` (or `~/.offrouter/...`).
+     * Contains provider ids only — never secret values.
+     */
+    indexPath?: string;
+    /**
+     * Absolute path to the `security` binary. Defaults to `/usr/bin/security`.
+     */
+    securityPath?: string;
+    /**
+     * Override platform detection (tests). Defaults to `process.platform`.
+     */
+    platform?: NodeJS.Platform;
+    /**
+     * Injectable execFile used to invoke `security`. Defaults to promisified
+     * child_process.execFile. Tests MUST inject a fake — never touch the real
+     * keychain in automated tests.
+     */
+    execFile?: KeychainExecFile;
+    /** Injectable file operations for the non-secret index. */
+    fileSystem?: Partial<FileSecretStoreFileSystem>;
 }
 interface FileSecretStoreFileSystem {
     mkdir: typeof mkdir;
@@ -48,6 +84,21 @@ interface FileSecretStoreFileSystem {
     writeFile: typeof writeFile;
     chmod: typeof chmod;
 }
+/**
+ * Named credential shapes shared by log redaction and outbound secret scan.
+ * Patterns are intentionally conservative (long alphabetic payload)
+ * to avoid eating short unrelated tokens while still catching leaks.
+ *
+ * Each entry's `pattern` is a global RegExp; callers must reset lastIndex.
+ * More-specific prefixes (sk-ant-, sk-proj-) are listed before generic sk-
+ * so scanners can attribute the first match correctly.
+ */
+export interface SecretPatternDef {
+    /** Stable identifier for policy/audit (never includes matched content). */
+    name: string;
+    pattern: RegExp;
+}
+export declare const SECRET_PATTERNS: readonly SecretPatternDef[];
 /**
  * Standalone redaction for log/audit paths that do not hold a store.
  * Optionally rejects known secret values (longest-first to avoid partials).
@@ -79,18 +130,38 @@ export declare class KeychainUnavailableError extends Error {
     });
 }
 /**
- * OS keychain boundary for real runs.
+ * macOS Keychain-backed secret store.
+ *
+ * Uses `/usr/bin/security` via `child_process.execFile` (argv only — never a
+ * shell). OffRouter only reads entries it wrote under the namespaced service
+ * `${service}:${scope}` (default `offrouter:default`). Account names are
+ * `${accountPrefix}${providerId}` (default `provider:<id>`).
+ *
+ * Secret values are written via `security -i` (interactive command mode):
+ * a single `add-generic-password ... -U -X <hex>` line is sent on stdin. The
+ * process argv is only `security -i`, so the secret never appears in `ps`.
+ * (Bare `security add-generic-password -w` without a value reads `/dev/tty`,
+ * not a pipe — that path is intentionally avoided.)
+ *
+ * Listing cannot be done safely via `security dump-keychain` (it dumps the
+ * entire keychain). Instead, a non-secret index of provider ids is maintained
+ * at `indexPath` (default `$OFFROUTER_HOME/keychain-index.json`). The index
+ * never contains secret values and is written with mode 0600.
  *
- * V1 ships this as a typed stub: it never scrapes other CLIs and does not
- * perform network I/O. Get/set/delete/list reject with KeychainUnavailableError
- * until a platform backend is wired. Prefer this store at the seams of real
- * runs once keychain support lands; tests and dry runs use FileSecretStore.
+ * Non-darwin platforms throw KeychainUnavailableError with the same message
+ * shape historical callers expect (`OS keychain backend is not wired...`).
+ * Tests must inject `execFile` and must never touch the real keychain.
  */
 export declare class KeychainSecretStore implements SecretStore {
     #private;
     readonly service: string;
     readonly accountPrefix: string;
+    readonly scope: string;
+    readonly indexPath: string;
+    readonly securityPath: string;
     constructor(options?: KeychainSecretStoreOptions);
+    /** security(1) `-s` service string: `offrouter:<scope>`. */
+    get securityService(): string;
     get(providerId: string): Promise<string | undefined>;
     set(providerId: string, secret: string): Promise<void>;
     delete(providerId: string): Promise<void>;

package/dist/secrets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAWA,OAAO,EACL,KAAK,EACL,QAAQ,EACR,MAAM,EACN,MAAM,EACN,SAAS,EACT,KAAK,EACN,MAAM,kBAAkB,CAAC;AAI1B,uEAAuE;AACvE,uEAAuE;AACvE,eAAO,MAAM,QAAQ,EAAG,YAAqB,CAAC;AAE9C;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACrD,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,aAAa,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACnC;;;OAGG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IAC9B;;;OAGG;IACH,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,sBAAsB;IACrC,gFAAgF;IAChF,QAAQ,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,UAAU,CAAC,EAAE,OAAO,CAAC,yBAAyB,CAAC,CAAC;CACjD;AAED,MAAM,WAAW,0BAA0B;IACzC;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAQD,UAAU,yBAAyB;IACjC,KAAK,EAAE,OAAO,KAAK,CAAC;IACpB,QAAQ,EAAE,OAAO,QAAQ,CAAC;IAC1B,MAAM,EAAE,OAAO,MAAM,CAAC;IACtB,MAAM,EAAE,OAAO,MAAM,CAAC;IACtB,SAAS,EAAE,OAAO,SAAS,CAAC;IAC5B,KAAK,EAAE,OAAO,KAAK,CAAC;CACrB;AAsCD;;;GAGG;AACH,wBAAgB,MAAM,CACpB,KAAK,EAAE,MAAM,EACb,YAAY,GAAE,QAAQ,CAAC,MAAM,CAAM,GAClC,MAAM,CAwBR;AAED;;;GAGG;AACH,qBAAa,eAAgB,YAAW,WAAW;;IACjD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;gBAMd,OAAO,EAAE,sBAAsB;IAgBrC,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAOpD,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQtD,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUzC,aAAa,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAKxC,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAO7B,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAuFlC;AAED;;;GAGG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,IAAI,EAAG,sBAAsB,CAAU;gBAEpC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAI3D;AAED;;;;;;;GAOG;AACH,qBAAa,mBAAoB,YAAW,WAAW;;IACrD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;gBAEnB,OAAO,GAAE,0BAA+B;IAQ9C,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAKpD,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMtD,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKzC,aAAa,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAIxC,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAK7B,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAgBlC;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,WAAW,GACjB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAU7B;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,WAAW,GACjB,OAAO,CAAC,IAAI,CAAC,CAEf"}
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAWA,OAAO,EACL,KAAK,EACL,QAAQ,EACR,MAAM,EACN,MAAM,EACN,SAAS,EACT,KAAK,EACN,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAgC,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAMxF,uEAAuE;AACvE,eAAO,MAAM,QAAQ,EAAG,YAAqB,CAAC;AAE9C;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACrD,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,aAAa,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACnC;;;OAGG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IAC9B;;;OAGG;IACH,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,sBAAsB;IACrC,gFAAgF;IAChF,QAAQ,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,UAAU,CAAC,EAAE,OAAO,CAAC,yBAAyB,CAAC,CAAC;CACjD;AAED;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAC7B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS,EAC1C,OAAO,CAAC,EAAE,eAAe,KACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,CAAC,CAAC;AAEnE,MAAM,WAAW,0BAA0B;IACzC;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,2DAA2D;IAC3D,UAAU,CAAC,EAAE,OAAO,CAAC,yBAAyB,CAAC,CAAC;CACjD;AAQD,UAAU,yBAAyB;IACjC,KAAK,EAAE,OAAO,KAAK,CAAC;IACpB,QAAQ,EAAE,OAAO,QAAQ,CAAC;IAC1B,MAAM,EAAE,OAAO,MAAM,CAAC;IACtB,MAAM,EAAE,OAAO,MAAM,CAAC;IACtB,SAAS,EAAE,OAAO,SAAS,CAAC;IAC5B,KAAK,EAAE,OAAO,KAAK,CAAC;CACrB;AAaD;;;;;;;;GAQG;AACH,MAAM,WAAW,gBAAgB;IAC/B,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,eAAO,MAAM,eAAe,EAAE,SAAS,gBAAgB,EA+B7C,CAAC;AAsBX;;;GAGG;AACH,wBAAgB,MAAM,CACpB,KAAK,EAAE,MAAM,EACb,YAAY,GAAE,QAAQ,CAAC,MAAM,CAAM,GAClC,MAAM,CAwBR;AAED;;;GAGG;AACH,qBAAa,eAAgB,YAAW,WAAW;;IACjD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;gBAMd,OAAO,EAAE,sBAAsB;IAgBrC,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAOpD,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQtD,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUzC,aAAa,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAKxC,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAO7B,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAuFlC;AAED;;;GAGG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,IAAI,EAAG,sBAAsB,CAAU;gBAEpC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAI3D;AA4DD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,mBAAoB,YAAW,WAAW;;IACrD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;gBAQlB,OAAO,GAAE,0BAA+B;IAuBpD,4DAA4D;IAC5D,IAAI,eAAe,IAAI,MAAM,CAE5B;IAEK,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAwBpD,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiCtD,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA0BzC,aAAa,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAMxC,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAI7B,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAuLlC;AAkCD;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,WAAW,GACjB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAU7B;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,WAAW,GACjB,OAAO,CAAC,IAAI,CAAC,CAEf"}