sliccy 5.62.0 → 5.63.0

package/dist/node-server/_shared/secret-masking.d.ts

@@ -4,6 +4,7 @@
  * Used on both agent side (env population, output scrubbing) and
  * server side (fetch proxy response scrubbing).
  */
+export declare function hmacSha256Hex(key: string, message: Uint8Array): Promise<string>;
 /**
  * Produce a deterministic, format-preserving masked value.
  *

package/dist/node-server/_shared/secret-masking.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secret-masking.d.ts","sourceRoot":"","sources":["../src/secret-masking.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AA6DH;;;;;GAKG;AACH,wBAAsB,IAAI,CACxB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,CAYjB;AAED,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAE5C;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAgB7E;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAcxE;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE7E;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAE5E"}
+{"version":3,"file":"secret-masking.d.ts","sourceRoot":"","sources":["../src/secret-masking.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAmEH,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAUrF;AAID;;;;;GAKG;AACH,wBAAsB,IAAI,CACxB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,CAYjB;AAED,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAE5C;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAgB7E;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAcxE;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE7E;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAE5E"}

package/dist/node-server/_shared/secret-masking.js

@@ -49,6 +49,11 @@ function toHex(bytes) {
         .map((b) => b.toString(16).padStart(2, '0'))
         .join('');
 }
+export async function hmacSha256Hex(key, message) {
+    const cryptoKey = await crypto.subtle.importKey('raw', new TextEncoder().encode(key), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    const sig = await crypto.subtle.sign('HMAC', cryptoKey, message);
+    return toHex(new Uint8Array(sig));
+}
 // ---------- Public API ----------
 /**
  * Produce a deterministic, format-preserving masked value.

package/dist/node-server/_shared/secret-masking.js.map

@@ -1 +1 @@
-{"version":3,"file":"secret-masking.js","sourceRoot":"","sources":["../src/secret-masking.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,6CAA6C;AAE7C,MAAM,cAAc,GAAa;IAC/B,MAAM,EAAE,aAAa;IACrB,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,wBAAwB;IAChC,MAAM,EAAE,0BAA0B;IAClC,MAAM,EAAE,iBAAiB;IACzB,aAAa,EAAE,0BAA0B;IACzC,KAAK,EAAE,6BAA6B;IACpC,KAAK,EAAE,yBAAyB;IAChC,OAAO,EAAE,kBAAkB;IAC3B,OAAO,EAAE,mBAAmB;IAC5B,OAAO,EAAE,kBAAkB;IAC3B,OAAO,EAAE,sBAAsB;IAC/B,MAAM,EAAE,oBAAoB;IAC5B,MAAM,EAAE,UAAU;IAClB,MAAM,EAAE,gBAAgB;IACxB,MAAM,EAAE,gBAAgB;IACxB,SAAS,EAAE,YAAY;IACvB,SAAS,EAAE,8BAA8B;CAC1C,CAAC;AAEF,0DAA0D;AAC1D,MAAM,eAAe,GAAG,CAAC,GAAG,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhF;;GAEG;AACH,SAAS,YAAY,CAAC,KAAa;IACjC,KAAK,MAAM,CAAC,IAAI,eAAe,EAAE,CAAC;QAChC,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,oCAAoC;AAEpC,KAAK,UAAU,UAAU,CAAC,GAAW,EAAE,OAAe;IACpD,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC7C,KAAK,EACL,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EACf,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7E,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,KAAK,CAAC,KAAiB;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;SACrB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAED,mCAAmC;AAEnC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CACxB,SAAiB,EACjB,UAAkB,EAClB,SAAiB;IAEjB,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAEjD,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,SAAS,GAAG,UAAU,EAAE,SAAS,CAAC,CAAC;IACjE,IAAI,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IAEtB,sDAAsD;IACtD,OAAO,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM;QAAE,GAAG,IAAI,GAAG,CAAC;IACjD,MAAM,eAAe,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAEvD,OAAO,MAAM,GAAG,eAAe,CAAC;AAClC,CAAC;AAOD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC;AAE5C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAAC,OAAqB;IACjD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,IAAI,0BAA0B,CAAC,CAAC;IACzF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAE3C,gEAAgE;IAChE,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAErF,OAAO,CAAC,IAAY,EAAU,EAAE;QAC9B,IAAI,MAAM,GAAG,IAAI,CAAC;QAClB,KAAK,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,MAAM,EAAE,CAAC;YAChD,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC/B,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,QAAgB;IAC7D,MAAM,CAAC,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAChC,MAAM,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAEjC,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAE3B,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,KAAK,CAAC,CAAC;IACjB,CAAC;IAED,4BAA4B;IAC5B,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB;IAC5C,0EAA0E;IAC1E,OAAO,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACxD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,QAAkB,EAAE,QAAgB;IAClE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,QAAkB;IACjE,OAAO,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAC7C,CAAC"}
+{"version":3,"file":"secret-masking.js","sourceRoot":"","sources":["../src/secret-masking.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,6CAA6C;AAE7C,MAAM,cAAc,GAAa;IAC/B,MAAM,EAAE,aAAa;IACrB,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,wBAAwB;IAChC,MAAM,EAAE,0BAA0B;IAClC,MAAM,EAAE,iBAAiB;IACzB,aAAa,EAAE,0BAA0B;IACzC,KAAK,EAAE,6BAA6B;IACpC,KAAK,EAAE,yBAAyB;IAChC,OAAO,EAAE,kBAAkB;IAC3B,OAAO,EAAE,mBAAmB;IAC5B,OAAO,EAAE,kBAAkB;IAC3B,OAAO,EAAE,sBAAsB;IAC/B,MAAM,EAAE,oBAAoB;IAC5B,MAAM,EAAE,UAAU;IAClB,MAAM,EAAE,gBAAgB;IACxB,MAAM,EAAE,gBAAgB;IACxB,SAAS,EAAE,YAAY;IACvB,SAAS,EAAE,8BAA8B;CAC1C,CAAC;AAEF,0DAA0D;AAC1D,MAAM,eAAe,GAAG,CAAC,GAAG,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhF;;GAEG;AACH,SAAS,YAAY,CAAC,KAAa;IACjC,KAAK,MAAM,CAAC,IAAI,eAAe,EAAE,CAAC;QAChC,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,oCAAoC;AAEpC,KAAK,UAAU,UAAU,CAAC,GAAW,EAAE,OAAe;IACpD,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC7C,KAAK,EACL,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EACf,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7E,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,KAAK,CAAC,KAAiB;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;SACrB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAW,EAAE,OAAmB;IAClE,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC7C,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAC7B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,OAAqB,CAAC,CAAC;IAC/E,OAAO,KAAK,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,mCAAmC;AAEnC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CACxB,SAAiB,EACjB,UAAkB,EAClB,SAAiB;IAEjB,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAEjD,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,SAAS,GAAG,UAAU,EAAE,SAAS,CAAC,CAAC;IACjE,IAAI,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IAEtB,sDAAsD;IACtD,OAAO,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM;QAAE,GAAG,IAAI,GAAG,CAAC;IACjD,MAAM,eAAe,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAEvD,OAAO,MAAM,GAAG,eAAe,CAAC;AAClC,CAAC;AAOD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC;AAE5C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAAC,OAAqB;IACjD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,IAAI,0BAA0B,CAAC,CAAC;IACzF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAE3C,gEAAgE;IAChE,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAErF,OAAO,CAAC,IAAY,EAAU,EAAE;QAC9B,IAAI,MAAM,GAAG,IAAI,CAAC;QAClB,KAAK,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,MAAM,EAAE,CAAC;YAChD,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC/B,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,QAAgB;IAC7D,MAAM,CAAC,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAChC,MAAM,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAEjC,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAE3B,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,KAAK,CAAC,CAAC;IACjB,CAAC;IAED,4BAA4B;IAC5B,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB;IAC5C,0EAA0E;IAC1E,OAAO,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACxD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,QAAkB,EAAE,QAAgB;IAClE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,QAAkB;IACjE,OAAO,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAC7C,CAAC"}

package/dist/node-server/_shared/secrets-pipeline.d.ts

@@ -1,4 +1,12 @@
 import type { SessionSecretStore } from './session-secret-store.js';
+/**
+ * Sentinel request header a client sets to ask the fetch proxy to sign the
+ * request body: `x-slicc-hmac-sign: <secretName>:<targetHeader>`. The proxy
+ * computes `HMAC-SHA256(body, secretName's real value)`, attaches the hex
+ * result under `targetHeader`, and strips this header before forwarding —
+ * see `SecretsPipeline.signHmac`.
+ */
+export declare const HMAC_SIGN_HEADER = "x-slicc-hmac-sign";
 export interface FetchProxySecretSource {
     get(name: string): Promise<string | undefined>;
     listAll(): Promise<{
@@ -24,6 +32,12 @@ export interface UnmaskResult {
 export interface UnmaskHeadersResult {
     forbidden?: ForbiddenInfo;
 }
+export interface HmacSignResult {
+    /** Header the computed signature should be attached under. Absent when `spec` was malformed or named an unknown secret — callers should leave the request unsigned in that case. */
+    headerName?: string;
+    signatureHex?: string;
+    forbidden?: ForbiddenInfo;
+}
 export interface BasicResult {
     value: string;
     forbidden?: ForbiddenInfo;
@@ -74,6 +88,7 @@ export declare class SecretsPipeline {
     private readonly sessionStore?;
     private maskedToSecret;
     private consumableShortSecrets;
+    private byName;
     private scrubber;
     constructor(opts: SecretsPipelineOpts);
     reload(): Promise<void>;
@@ -103,6 +118,19 @@ export declare class SecretsPipeline {
      * Match SecretProxyManager's existing semantics so call sites compile unchanged.
      */
     unmaskHeaders(headers: Record<string, string>, hostname: string): UnmaskHeadersResult;
+    /**
+     * Resolve an `x-slicc-hmac-sign: <secretName>:<targetHeader>` directive
+     * against the (already-unmasked) request body. The real secret value is
+     * looked up by name, domain-checked exactly like `unmaskHeaders`, and used
+     * to compute `HMAC-SHA256(body, realValue)` — the caller attaches the hex
+     * result under `targetHeader` and forwards. The real value never leaves
+     * this method.
+     *
+     * Returns `{}` (no-op) for a malformed spec or an unknown secret name —
+     * the fetch proxy is expected to treat that as "nothing to sign", not a
+     * hard error, since the header may have been set for a different purpose.
+     */
+    signHmac(spec: string, body: Uint8Array, hostname: string): Promise<HmacSignResult>;
     unmaskBodyBytes(body: Uint8Array, hostname: string): {
         bytes: Uint8Array;
     };

package/dist/node-server/_shared/secrets-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secrets-pipeline.d.ts","sourceRoot":"","sources":["../src/secrets-pipeline.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAiCpE,MAAM,WAAW,sBAAsB;IACrC,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC/C,OAAO,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC,CAAC;CAC1E;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,sBAAsB,CAAC;IAC/B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,kBAAkB,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAAa,eAAe;IAC1B,SAAgB,SAAS,EAAE,MAAM,CAAC;IAClC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyB;IAChD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAqB;IACnD,OAAO,CAAC,cAAc,CAAmC;IAQzD,OAAO,CAAC,sBAAsB,CAAmC;IACjE,OAAO,CAAC,QAAQ,CAAsC;gBAE1C,IAAI,EAAE,mBAAmB;IAM/B,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IA+CvB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAI3D,UAAU,IAAI,OAAO;IAOrB,gBAAgB,IAAI,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAenF;;;OAGG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,YAAY;IAYpD;;;OAGG;IACH,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE;IAU5D,wBAAwB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,WAAW;IA6B5E,8BAA8B,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB;IAkCjE;;;OAGG;IACH,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,mBAAmB;IAerF,eAAe,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,UAAU,CAAA;KAAE;IAY1E,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAInC,kBAAkB,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU;IAWjD,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;CAOvD"}
+{"version":3,"file":"secrets-pipeline.d.ts","sourceRoot":"","sources":["../src/secrets-pipeline.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAiCpE;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,sBAAsB,CAAC;AAEpD,MAAM,WAAW,sBAAsB;IACrC,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC/C,OAAO,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC,CAAC;CAC1E;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,oLAAoL;IACpL,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,sBAAsB,CAAC;IAC/B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,kBAAkB,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAAa,eAAe;IAC1B,SAAgB,SAAS,EAAE,MAAM,CAAC;IAClC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyB;IAChD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAqB;IACnD,OAAO,CAAC,cAAc,CAAmC;IAQzD,OAAO,CAAC,sBAAsB,CAAmC;IAKjE,OAAO,CAAC,MAAM,CAAmC;IACjD,OAAO,CAAC,QAAQ,CAAsC;gBAE1C,IAAI,EAAE,mBAAmB;IAM/B,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IA+DvB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAI3D,UAAU,IAAI,OAAO;IAOrB,gBAAgB,IAAI,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAenF;;;OAGG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,YAAY;IAYpD;;;OAGG;IACH,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE;IAU5D,wBAAwB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,WAAW;IA6B5E,8BAA8B,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB;IAkCjE;;;OAGG;IACH,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,mBAAmB;IAerF;;;;;;;;;;;OAWG;IACG,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAsBzF,eAAe,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,UAAU,CAAA;KAAE;IAY1E,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAInC,kBAAkB,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU;IAWjD,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;CAOvD"}

package/dist/node-server/_shared/secrets-pipeline.js

@@ -1,4 +1,4 @@
-import { buildScrubber, mask as cryptoMask, MIN_MASKABLE_SECRET_LENGTH, matchesDomains, } from './secret-masking.js';
+import { buildScrubber, mask as cryptoMask, hmacSha256Hex, MIN_MASKABLE_SECRET_LENGTH, matchesDomains, } from './secret-masking.js';
 function indexOfBytes(haystack, needle, from = 0) {
     outer: for (let i = from; i <= haystack.length - needle.length; i++) {
         for (let j = 0; j < needle.length; j++) {
@@ -29,6 +29,14 @@ function replaceAllBytes(haystack, needle, replacement) {
     }
     return new Uint8Array(out);
 }
+/**
+ * Sentinel request header a client sets to ask the fetch proxy to sign the
+ * request body: `x-slicc-hmac-sign: <secretName>:<targetHeader>`. The proxy
+ * computes `HMAC-SHA256(body, secretName's real value)`, attaches the hex
+ * result under `targetHeader`, and strips this header before forwarding —
+ * see `SecretsPipeline.signHmac`.
+ */
+export const HMAC_SIGN_HEADER = 'x-slicc-hmac-sign';
 /**
  * Stateful unmask/scrub pipeline shared between node-server's /api/fetch-proxy
  * and the chrome-extension SW's fetch-proxy.fetch Port handler.
@@ -66,6 +74,11 @@ export class SecretsPipeline {
     // the actual secret, while the scrubber's masking-pattern set stays
     // collision-free for short inputs. Keyed by name (one entry per secret).
     consumableShortSecrets = new Map();
+    // Indexes every secret (maskable or short) by name, for lookups that start
+    // from a secret name rather than a masked value found in text — currently
+    // only `signHmac`, which needs the real value of a *named* secret to
+    // compute a body signature the agent could never derive from a masked token.
+    byName = new Map();
     scrubber = (t) => t;
     constructor(opts) {
         this.sessionId = opts.sessionId;
@@ -110,6 +123,21 @@ export class SecretsPipeline {
         }
         this.maskedToSecret = next;
         this.consumableShortSecrets = nextShort;
+        // Invariant: a secret name is unique across {next, nextShort} — reload()
+        // partitions each source secret into exactly one of the two maps, so a
+        // collision here can only mean a future storage change broke that
+        // partitioning. Warn rather than silently letting the second write win,
+        // since `signHmac` trusts this index to resolve to the right real value.
+        const nextByName = new Map();
+        for (const ms of next.values())
+            nextByName.set(ms.name, ms);
+        for (const ms of nextShort.values()) {
+            if (nextByName.has(ms.name)) {
+                console.warn(`[slicc:secrets] secret "${ms.name}" registered as both maskable and short-consumable`);
+            }
+            nextByName.set(ms.name, ms);
+        }
+        this.byName = nextByName;
         const pairs = Array.from(next.values()).map((ms) => ({
             realValue: ms.realValue,
             maskedValue: ms.maskedValue,
@@ -258,6 +286,40 @@ export class SecretsPipeline {
         }
         return {};
     }
+    /**
+     * Resolve an `x-slicc-hmac-sign: <secretName>:<targetHeader>` directive
+     * against the (already-unmasked) request body. The real secret value is
+     * looked up by name, domain-checked exactly like `unmaskHeaders`, and used
+     * to compute `HMAC-SHA256(body, realValue)` — the caller attaches the hex
+     * result under `targetHeader` and forwards. The real value never leaves
+     * this method.
+     *
+     * Returns `{}` (no-op) for a malformed spec or an unknown secret name —
+     * the fetch proxy is expected to treat that as "nothing to sign", not a
+     * hard error, since the header may have been set for a different purpose.
+     */
+    async signHmac(spec, body, hostname) {
+        const sep = spec.indexOf(':');
+        if (sep < 0)
+            return {};
+        const secretName = spec.slice(0, sep).trim();
+        const headerName = spec.slice(sep + 1).trim();
+        if (!secretName || !headerName)
+            return {};
+        const ms = this.byName.get(secretName);
+        if (!ms) {
+            // Log-only, never a hard error: a typo'd name would otherwise fail
+            // silently (request goes out unsigned, upstream just 401s with no clue
+            // why). Mirrors the too-short-secret warning above — never logs a value.
+            console.warn(`[slicc:secrets] signHmac: no secret named "${secretName}"`);
+            return {};
+        }
+        if (!matchesDomains(hostname, ms.domains)) {
+            return { forbidden: { secretName: ms.name, hostname } };
+        }
+        const signatureHex = await hmacSha256Hex(ms.realValue, body);
+        return { headerName, signatureHex };
+    }
     unmaskBodyBytes(body, hostname) {
         let out = body;
         const enc = new TextEncoder();

package/dist/node-server/_shared/secrets-pipeline.js.map

@@ -1 +1 @@
-{"version":3,"file":"secrets-pipeline.js","sourceRoot":"","sources":["../src/secrets-pipeline.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,IAAI,IAAI,UAAU,EAClB,0BAA0B,EAC1B,cAAc,GAEf,MAAM,qBAAqB,CAAC;AAG7B,SAAS,YAAY,CAAC,QAAoB,EAAE,MAAkB,EAAE,IAAI,GAAG,CAAC;IACtE,KAAK,EAAE,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,IAAI,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC;gBAAE,SAAS,KAAK,CAAC;QACpD,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC;AAED,SAAS,eAAe,CACtB,QAAoB,EACpB,MAAkB,EAClB,WAAuB;IAEvB,IAAI,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IACxD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAC9C,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE;gBAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAChE,MAAM;QACR,CAAC;QACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QACtE,CAAC,GAAG,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAmDD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,OAAO,eAAe;IACV,SAAS,CAAS;IACjB,MAAM,CAAyB;IAC/B,YAAY,CAAsB;IAC3C,cAAc,GAAG,IAAI,GAAG,EAAwB,CAAC;IACzD,0EAA0E;IAC1E,sEAAsE;IACtE,uEAAuE;IACvE,qEAAqE;IACrE,0EAA0E;IAC1E,oEAAoE;IACpE,yEAAyE;IACjE,sBAAsB,GAAG,IAAI,GAAG,EAAwB,CAAC;IACzD,QAAQ,GAA6B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAEtD,YAAY,IAAyB;QACnC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,MAAM;QACV,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACxC,sEAAsE;QACtE,mEAAmE;QACnE,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAChG,MAAM,MAAM,GAAG,CAAC,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAwB,CAAC;QAC7C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAwB,CAAC;QAClD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,+DAA+D;YAC/D,kEAAkE;YAClE,6DAA6D;YAC7D,6DAA6D;YAC7D,kEAAkE;YAClE,gEAAgE;YAChE,gEAAgE;YAChE,qBAAqB;YACrB,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,0BAA0B,EAAE,CAAC;gBAChD,OAAO,CAAC,IAAI,CACV,2BAA2B,CAAC,CAAC,IAAI,oCAAoC,0BAA0B,QAAQ,CACxG,CAAC;gBACF,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE;oBACpB,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,SAAS,EAAE,CAAC,CAAC,KAAK;oBAClB,WAAW,EAAE,CAAC,CAAC,KAAK;oBACpB,OAAO,EAAE,CAAC,CAAC,OAAO;iBACnB,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YACtE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE;gBACpB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,SAAS,EAAE,CAAC,CAAC,KAAK;gBAClB,WAAW;gBACX,OAAO,EAAE,CAAC,CAAC,OAAO;aACnB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC3B,IAAI,CAAC,sBAAsB,GAAG,SAAS,CAAC;QACxC,MAAM,KAAK,GAAiB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACjE,SAAS,EAAE,EAAE,CAAC,SAAS;YACvB,WAAW,EAAE,EAAE,CAAC,WAAW;SAC5B,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,KAAa;QACvC,OAAO,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC;IAED,UAAU;QACR,oEAAoE;QACpE,iEAAiE;QACjE,gEAAgE;QAChE,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,CAAC;IACtC,CAAC;IAED,gBAAgB;QACd,MAAM,OAAO,GAAoE,EAAE,CAAC;QACpF,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,EAAE,CAAC;YAC9C,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,uEAAuE;QACvE,uEAAuE;QACvE,sEAAsE;QACtE,mDAAmD;QACnD,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,EAAE,CAAC;YACtD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,IAAY,EAAE,QAAgB;QACnC,IAAI,MAAM,GAAG,IAAI,CAAC;QAClB,KAAK,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACpD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAAE,SAAS;YAC5C,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;YAChE,CAAC;YACD,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC;IAED;;;OAGG;IACH,UAAU,CAAC,IAAY,EAAE,QAAgB;QACvC,IAAI,MAAM,GAAG,IAAI,CAAC;QAClB,KAAK,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACpD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAAE,SAAS;YAC5C,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC;gBAAE,SAAS;YACpD,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC;IAED,wBAAwB,CAAC,WAAmB,EAAE,QAAgB;QAC5D,MAAM,OAAO,GAAG,gBAAgB,CAAC;QACjC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAC1C,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAChC,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAC7C,IAAI,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACnC,IAAI,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACpC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACpD,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC7D,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC1C,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;gBAC9E,CAAC;gBACD,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;oBAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;gBAClF,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;oBAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;gBAClF,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAC5C,OAAO,EAAE,KAAK,EAAE,SAAS,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;IACvD,CAAC;IAED,8BAA8B,CAAC,MAAc;QAC3C,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QACzB,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QAEjE,IAAI,IAAI,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,IAAI,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACpD,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC7D,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;oBACtC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;gBAC7E,CAAC;gBACD,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC/B,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;oBAClD,OAAO,GAAG,IAAI,CAAC;gBACjB,CAAC;gBACD,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC/B,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;oBAClD,OAAO,GAAG,IAAI,CAAC;gBACjB,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7F,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAC;QACrB,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAC;QACrB,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,sBAAsB,EAAE,SAAS,EAAE,CAAC;IACvE,CAAC;IAED;;;OAGG;IACH,aAAa,CAAC,OAA+B,EAAE,QAAgB;QAC7D,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACjD,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,eAAe,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnE,MAAM,KAAK,GAAG,IAAI,CAAC,wBAAwB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBAC3D,IAAI,KAAK,CAAC,SAAS;oBAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;gBAC3D,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;gBAC3B,SAAS;YACX,CAAC;YACD,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACvD,IAAI,SAAS;gBAAE,OAAO,EAAE,SAAS,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;QACtB,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,eAAe,CAAC,IAAgB,EAAE,QAAgB;QAChD,IAAI,GAAG,GAAG,IAAI,CAAC;QACf,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACpD,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC;gBAAE,SAAS;YACpD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACvC,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;YAC7C,GAAG,GAAG,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IACxB,CAAC;IAED,aAAa,CAAC,IAAY;QACxB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,kBAAkB,CAAC,KAAiB;QAClC,IAAI,GAAG,GAAG,KAAK,CAAC;QAChB,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACpD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;YACxC,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC5C,GAAG,GAAG,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,YAAY,CAAC,OAAgB;QAC3B,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACvB,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QACH,OAAO,GAAG,CAAC;IACb,CAAC;CACF"}
+{"version":3,"file":"secrets-pipeline.js","sourceRoot":"","sources":["../src/secrets-pipeline.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,IAAI,IAAI,UAAU,EAClB,aAAa,EACb,0BAA0B,EAC1B,cAAc,GAEf,MAAM,qBAAqB,CAAC;AAG7B,SAAS,YAAY,CAAC,QAAoB,EAAE,MAAkB,EAAE,IAAI,GAAG,CAAC;IACtE,KAAK,EAAE,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,IAAI,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC;gBAAE,SAAS,KAAK,CAAC;QACpD,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC;AAED,SAAS,eAAe,CACtB,QAAoB,EACpB,MAAkB,EAClB,WAAuB;IAEvB,IAAI,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IACxD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAC9C,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE;gBAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAChE,MAAM;QACR,CAAC;QACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QACtE,CAAC,GAAG,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AA0DpD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,OAAO,eAAe;IACV,SAAS,CAAS;IACjB,MAAM,CAAyB;IAC/B,YAAY,CAAsB;IAC3C,cAAc,GAAG,IAAI,GAAG,EAAwB,CAAC;IACzD,0EAA0E;IAC1E,sEAAsE;IACtE,uEAAuE;IACvE,qEAAqE;IACrE,0EAA0E;IAC1E,oEAAoE;IACpE,yEAAyE;IACjE,sBAAsB,GAAG,IAAI,GAAG,EAAwB,CAAC;IACjE,2EAA2E;IAC3E,0EAA0E;IAC1E,qEAAqE;IACrE,6EAA6E;IACrE,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAC;IACzC,QAAQ,GAA6B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAEtD,YAAY,IAAyB;QACnC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,MAAM;QACV,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACxC,sEAAsE;QACtE,mEAAmE;QACnE,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAChG,MAAM,MAAM,GAAG,CAAC,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAwB,CAAC;QAC7C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAwB,CAAC;QAClD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,+DAA+D;YAC/D,kEAAkE;YAClE,6DAA6D;YAC7D,6DAA6D;YAC7D,kEAAkE;YAClE,gEAAgE;YAChE,gEAAgE;YAChE,qBAAqB;YACrB,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,0BAA0B,EAAE,CAAC;gBAChD,OAAO,CAAC,IAAI,CACV,2BAA2B,CAAC,CAAC,IAAI,oCAAoC,0BAA0B,QAAQ,CACxG,CAAC;gBACF,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE;oBACpB,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,SAAS,EAAE,CAAC,CAAC,KAAK;oBAClB,WAAW,EAAE,CAAC,CAAC,KAAK;oBACpB,OAAO,EAAE,CAAC,CAAC,OAAO;iBACnB,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YACtE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE;gBACpB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,SAAS,EAAE,CAAC,CAAC,KAAK;gBAClB,WAAW;gBACX,OAAO,EAAE,CAAC,CAAC,OAAO;aACnB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC3B,IAAI,CAAC,sBAAsB,GAAG,SAAS,CAAC;QACxC,yEAAyE;QACzE,uEAAuE;QACvE,kEAAkE;QAClE,wEAAwE;QACxE,yEAAyE;QACzE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAwB,CAAC;QACnD,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE;YAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC5D,KAAK,MAAM,EAAE,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;YACpC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5B,OAAO,CAAC,IAAI,CACV,2BAA2B,EAAE,CAAC,IAAI,oDAAoD,CACvF,CAAC;YACJ,CAAC;YACD,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC9B,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC;QACzB,MAAM,KAAK,GAAiB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACjE,SAAS,EAAE,EAAE,CAAC,SAAS;YACvB,WAAW,EAAE,EAAE,CAAC,WAAW;SAC5B,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,KAAa;QACvC,OAAO,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC;IAED,UAAU;QACR,oEAAoE;QACpE,iEAAiE;QACjE,gEAAgE;QAChE,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,CAAC;IACtC,CAAC;IAED,gBAAgB;QACd,MAAM,OAAO,GAAoE,EAAE,CAAC;QACpF,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,EAAE,CAAC;YAC9C,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,uEAAuE;QACvE,uEAAuE;QACvE,sEAAsE;QACtE,mDAAmD;QACnD,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,EAAE,CAAC;YACtD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,IAAY,EAAE,QAAgB;QACnC,IAAI,MAAM,GAAG,IAAI,CAAC;QAClB,KAAK,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACpD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAAE,SAAS;YAC5C,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;YAChE,CAAC;YACD,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC;IAED;;;OAGG;IACH,UAAU,CAAC,IAAY,EAAE,QAAgB;QACvC,IAAI,MAAM,GAAG,IAAI,CAAC;QAClB,KAAK,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACpD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAAE,SAAS;YAC5C,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC;gBAAE,SAAS;YACpD,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC;IAED,wBAAwB,CAAC,WAAmB,EAAE,QAAgB;QAC5D,MAAM,OAAO,GAAG,gBAAgB,CAAC;QACjC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAC1C,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAChC,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAC7C,IAAI,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACnC,IAAI,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACpC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACpD,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC7D,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC1C,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;gBAC9E,CAAC;gBACD,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;oBAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;gBAClF,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;oBAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;gBAClF,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAC5C,OAAO,EAAE,KAAK,EAAE,SAAS,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;IACvD,CAAC;IAED,8BAA8B,CAAC,MAAc;QAC3C,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QACzB,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QAEjE,IAAI,IAAI,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,IAAI,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACpD,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC7D,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;oBACtC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;gBAC7E,CAAC;gBACD,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC/B,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;oBAClD,OAAO,GAAG,IAAI,CAAC;gBACjB,CAAC;gBACD,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC/B,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;oBAClD,OAAO,GAAG,IAAI,CAAC;gBACjB,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7F,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAC;QACrB,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAC;QACrB,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,sBAAsB,EAAE,SAAS,EAAE,CAAC;IACvE,CAAC;IAED;;;OAGG;IACH,aAAa,CAAC,OAA+B,EAAE,QAAgB;QAC7D,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACjD,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,eAAe,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnE,MAAM,KAAK,GAAG,IAAI,CAAC,wBAAwB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBAC3D,IAAI,KAAK,CAAC,SAAS;oBAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;gBAC3D,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;gBAC3B,SAAS;YACX,CAAC;YACD,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACvD,IAAI,SAAS;gBAAE,OAAO,EAAE,SAAS,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;QACtB,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,IAAgB,EAAE,QAAgB;QAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,GAAG,GAAG,CAAC;YAAE,OAAO,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU;YAAE,OAAO,EAAE,CAAC;QAE1C,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACvC,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,mEAAmE;YACnE,uEAAuE;YACvE,yEAAyE;YACzE,OAAO,CAAC,IAAI,CAAC,8CAA8C,UAAU,GAAG,CAAC,CAAC;YAC1E,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1C,OAAO,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;QAC1D,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC7D,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;IACtC,CAAC;IAED,eAAe,CAAC,IAAgB,EAAE,QAAgB;QAChD,IAAI,GAAG,GAAG,IAAI,CAAC;QACf,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACpD,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC;gBAAE,SAAS;YACpD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACvC,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;YAC7C,GAAG,GAAG,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IACxB,CAAC;IAED,aAAa,CAAC,IAAY;QACxB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,kBAAkB,CAAC,KAAiB;QAClC,IAAI,GAAG,GAAG,KAAK,CAAC;QAChB,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACpD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;YACxC,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC5C,GAAG,GAAG,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,YAAY,CAAC,OAAgB;QAC3B,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACvB,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QACH,OAAO,GAAG,CAAC;IACb,CAAC;CACF"}

package/dist/node-server/fetch-proxy-headers.js

@@ -30,6 +30,10 @@ export const FETCH_PROXY_SKIP_HEADERS = new Set([
     // Kept in sync with `BRIDGE_TOKEN_HEADER` in `bridge-security.ts`
     // (lowercased because Node lowercases incoming request header keys).
     'x-bridge-token',
+    // Proxy-side HMAC body-signing directive (`HMAC_SIGN_HEADER` in
+    // @slicc/shared-ts secrets-pipeline.ts) — consumed by the route handler
+    // to compute and attach a real signature header; never forwarded as-is.
+    'x-slicc-hmac-sign',
 ]);
 /**
  * Response-side header names the proxy must NOT copy from the upstream

package/dist/node-server/routes/fetch-proxy.js

@@ -1,5 +1,6 @@
 import { Readable, Transform } from 'node:stream';
 import { StringDecoder } from 'node:string_decoder';
+import { HMAC_SIGN_HEADER } from '../_shared/index.js';
 import { FETCH_PROXY_SKIP_HEADERS, FETCH_PROXY_SKIP_RESPONSE_HEADERS, FETCH_PROXY_SKIP_RESPONSE_PREFIXES, } from '../fetch-proxy-headers.js';
 /** Pick the first value of a possibly-multi-valued request header. */
 function firstHeaderValue(value) {
@@ -112,6 +113,24 @@ function injectRequestSecrets(secretProxy, headers, targetUrl, targetHostname) {
     }
     return { cleanedUrl: credsResult.url };
 }
+/**
+ * Apply the `x-slicc-hmac-sign` directive, if present: sign `body` with the
+ * named secret's real value and attach the hex result under the header the
+ * client requested. Mutates `headers` and always removes the sentinel
+ * (already stripped from `headers` by `buildForwardHeaders`'s skip-list;
+ * this only needs to read it off the raw request).
+ */
+async function applyHmacSigning(secretProxy, headers, hmacSpec, body, targetHostname) {
+    if (!hmacSpec)
+        return undefined;
+    const signResult = await secretProxy.signHmac(hmacSpec, body ?? Buffer.alloc(0), targetHostname);
+    if (signResult.forbidden)
+        return { forbidden: signResult.forbidden };
+    if (signResult.headerName && signResult.signatureHex) {
+        headers[signResult.headerName] = signResult.signatureHex;
+    }
+    return undefined;
+}
 /**
  * Unmask masked secrets in a text request body. Non-text bodies (git
  * packfiles, octet-stream, images, …) are left untouched — `toString('utf-8')`
@@ -280,13 +299,27 @@ export function registerFetchProxyRoute(app, deps) {
                 });
                 return;
             }
-            if (Object.keys(headers).length > 0)
-                fetchInit.headers = headers;
+            let body;
             if (rawBody.length > 0 && !['GET', 'HEAD'].includes(req.method)) {
-                const body = unmaskRequestBody(secretProxy, headers, rawBody, targetHostname);
+                body = unmaskRequestBody(secretProxy, headers, rawBody, targetHostname);
                 // Buffer extends Uint8Array which is a valid fetch body at runtime.
                 fetchInit.body = body;
             }
+            // Proxy-side HMAC body signing: the client can't compute this itself
+            // (it only ever sees a masked secret token), so it asks the proxy to
+            // sign the body with the real value and attach the result as a header.
+            const hmacSpec = firstHeaderValue(req.headers[HMAC_SIGN_HEADER]);
+            const signing = await applyHmacSigning(secretProxy, headers, hmacSpec, body, targetHostname);
+            if (signing) {
+                logger.warn(`[fetch-proxy] ${req.method} ${targetUrl} → 403 (secret "${signing.forbidden.secretName}" not allowed for "${signing.forbidden.hostname}")`);
+                res.setHeader('X-Proxy-Error', '1');
+                res.status(403).json({
+                    error: `Secret "${signing.forbidden.secretName}" is not allowed for domain "${signing.forbidden.hostname}"`,
+                });
+                return;
+            }
+            if (Object.keys(headers).length > 0)
+                fetchInit.headers = headers;
             // Propagate client disconnect to the upstream request so long-lived
             // streams (LLM SSE completions) are torn down promptly. Listen on
             // `res.on('close')`, not `req.on('close')` — Node fires req close as soon

package/dist/node-server/secrets/proxy-manager.d.ts

@@ -51,6 +51,14 @@ export declare class SecretProxyManager {
             hostname: string;
         };
     };
+    signHmac(spec: string, body: Uint8Array, targetHostname: string): Promise<{
+        headerName?: string;
+        signatureHex?: string;
+        forbidden?: {
+            secretName: string;
+            hostname: string;
+        };
+    }>;
     extractAndUnmaskUrlCredentials(rawUrl: string): import("../_shared/index.js").ExtractedUrlCreds;
     scrubResponse(text: string): string;
     scrubHeaders(headers: Headers): Record<string, string>;

package/dist/node-server/secrets/proxy-manager.js

@@ -90,6 +90,9 @@ export class SecretProxyManager {
     unmaskHeaders(headers, targetHostname) {
         return this.pipeline.unmaskHeaders(headers, targetHostname);
     }
+    signHmac(spec, body, targetHostname) {
+        return this.pipeline.signHmac(spec, body, targetHostname);
+    }
     extractAndUnmaskUrlCredentials(rawUrl) {
         return this.pipeline.extractAndUnmaskUrlCredentials(rawUrl);
     }

package/dist/ui/assets/{account-store-lXHUJTBI.js → account-store-C8V8X8M6.js}

@@ -1,5 +1,5 @@
 const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/oauth-service-CmM0tZSO.js","assets/preload-helper-Czpn1I53.js","assets/proxied-fetch-DETjVL-j.js","assets/rolldown-runtime-aKtaBQYM.js","assets/base64-DpPqYZJF.js","assets/src-CS5gSDhT.js","assets/runtime-env-DH4NDw4t.js","assets/fetch-body-D2PwksUW.js","assets/panel-rpc-DmJSNs0I.js","assets/wc-permissions-registry-Blyunq37.js"])))=>i.map(i=>d[i]);
-import{n as e,t}from"./rolldown-runtime-aKtaBQYM.js";import{t as n}from"./preload-helper-Czpn1I53.js";import{i as r,n as i,r as a}from"./compat-DyT25qXb.js";import"./context-compaction-dcYYajWb.js";import{t as o}from"./logger-DDBAeTLF.js";import"./src-CS5gSDhT.js";import{o as s,t as c}from"./proxied-fetch-DETjVL-j.js";import{t as l}from"./secret-topology-D2k1IxFk.js";import{t as u}from"./secrets-bridge-client-CONYX8PU.js";import"./tool-ui-DfXu6quJ.js";import{n as d,o as f,t as p}from"./providers-ByFXFWPn.js";import{n as m,t as h}from"./panel-rpc-DmJSNs0I.js";import{r as g,t as _}from"./bedrock-camp-BEi8MYUS.js";var v=Symbol.for(`yaml.alias`),y=Symbol.for(`yaml.document`),b=Symbol.for(`yaml.map`),x=Symbol.for(`yaml.pair`),S=Symbol.for(`yaml.scalar`),C=Symbol.for(`yaml.seq`),w=Symbol.for(`yaml.node.type`),T=e=>!!e&&typeof e==`object`&&e[w]===v,E=e=>!!e&&typeof e==`object`&&e[w]===y,ee=e=>!!e&&typeof e==`object`&&e[w]===b,D=e=>!!e&&typeof e==`object`&&e[w]===x,O=e=>!!e&&typeof e==`object`&&e[w]===S,k=e=>!!e&&typeof e==`object`&&e[w]===C;function A(e){if(e&&typeof e==`object`)switch(e[w]){case b:case C:return!0}return!1}function j(e){if(e&&typeof e==`object`)switch(e[w]){case v:case b:case S:case C:return!0}return!1}var te=e=>(O(e)||A(e))&&!!e.anchor,M=Symbol(`break visit`),ne=Symbol(`skip children`),N=Symbol(`remove node`);function re(e,t){let n=ae(t);E(e)?P(null,e.contents,n,Object.freeze([e]))===N&&(e.contents=null):P(null,e,n,Object.freeze([]))}re.BREAK=M,re.SKIP=ne,re.REMOVE=N;function P(e,t,n,r){let i=oe(e,t,n,r);if(j(i)||D(i))return se(e,r,i),P(e,i,n,r);if(typeof i!=`symbol`){if(A(t)){r=Object.freeze(r.concat(t));for(let e=0;e<t.items.length;++e){let i=P(e,t.items[e],n,r);if(typeof i==`number`)e=i-1;else if(i===M)return M;else i===N&&(t.items.splice(e,1),--e)}}else if(D(t)){r=Object.freeze(r.concat(t));let e=P(`key`,t.key,n,r);if(e===M)return M;e===N&&(t.key=null);let i=P(`value`,t.value,n,r);if(i===M)return M;i===N&&(t.value=null)}}return i}async function ie(e,t){let n=ae(t);E(e)?await F(null,e.contents,n,Object.freeze([e]))===N&&(e.contents=null):await F(null,e,n,Object.freeze([]))}ie.BREAK=M,ie.SKIP=ne,ie.REMOVE=N;async function F(e,t,n,r){let i=await oe(e,t,n,r);if(j(i)||D(i))return se(e,r,i),F(e,i,n,r);if(typeof i!=`symbol`){if(A(t)){r=Object.freeze(r.concat(t));for(let e=0;e<t.items.length;++e){let i=await F(e,t.items[e],n,r);if(typeof i==`number`)e=i-1;else if(i===M)return M;else i===N&&(t.items.splice(e,1),--e)}}else if(D(t)){r=Object.freeze(r.concat(t));let e=await F(`key`,t.key,n,r);if(e===M)return M;e===N&&(t.key=null);let i=await F(`value`,t.value,n,r);if(i===M)return M;i===N&&(t.value=null)}}return i}function ae(e){return typeof e==`object`&&(e.Collection||e.Node||e.Value)?Object.assign({Alias:e.Node,Map:e.Node,Scalar:e.Node,Seq:e.Node},e.Value&&{Map:e.Value,Scalar:e.Value,Seq:e.Value},e.Collection&&{Map:e.Collection,Seq:e.Collection},e):e}function oe(e,t,n,r){if(typeof n==`function`)return n(e,t,r);if(ee(t))return n.Map?.(e,t,r);if(k(t))return n.Seq?.(e,t,r);if(D(t))return n.Pair?.(e,t,r);if(O(t))return n.Scalar?.(e,t,r);if(T(t))return n.Alias?.(e,t,r)}function se(e,t,n){let r=t[t.length-1];if(A(r))r.items[e]=n;else if(D(r))e===`key`?r.key=n:r.value=n;else if(E(r))r.contents=n;else{let e=T(r)?`alias`:`scalar`;throw Error(`Cannot replace node with ${e} parent`)}}var ce={"!":`%21`,",":`%2C`,"[":`%5B`,"]":`%5D`,"{":`%7B`,"}":`%7D`},le=e=>e.replace(/[!,[\]{}]/g,e=>ce[e]),ue=class e{constructor(t,n){this.docStart=null,this.docEnd=!1,this.yaml=Object.assign({},e.defaultYaml,t),this.tags=Object.assign({},e.defaultTags,n)}clone(){let t=new e(this.yaml,this.tags);return t.docStart=this.docStart,t}atDocument(){let t=new e(this.yaml,this.tags);switch(this.yaml.version){case`1.1`:this.atNextDocument=!0;break;case`1.2`:this.atNextDocument=!1,this.yaml={explicit:e.defaultYaml.explicit,version:`1.2`},this.tags=Object.assign({},e.defaultTags);break}return t}add(t,n){this.atNextDocument&&=(this.yaml={explicit:e.defaultYaml.explicit,version:`1.1`},this.tags=Object.assign({},e.defaultTags),!1);let r=t.trim().split(/[ \t]+/),i=r.shift();switch(i){case`%TAG`:{if(r.length!==2&&(n(0,`%TAG directive should contain exactly two parts`),r.length<2))return!1;let[e,t]=r;return this.tags[e]=t,!0}case`%YAML`:{if(this.yaml.explicit=!0,r.length!==1)return n(0,`%YAML directive should contain exactly one part`),!1;let[e]=r;if(e===`1.1`||e===`1.2`)return this.yaml.version=e,!0;{let t=/^\d+\.\d+$/.test(e);return n(6,`Unsupported YAML version ${e}`,t),!1}}default:return n(0,`Unknown directive ${i}`,!0),!1}}tagName(e,t){if(e===`!`)return`!`;if(e[0]!==`!`)return t(`Not a valid tag: ${e}`),null;if(e[1]===`<`){let n=e.slice(2,-1);return n===`!`||n===`!!`?(t(`Verbatim tags aren't resolved, so ${e} is invalid.`),null):(e[e.length-1]!==`>`&&t(`Verbatim tags must end with a >`),n)}let[,n,r]=e.match(/^(.*!)([^!]*)$/s);r||t(`The ${e} tag has no suffix`);let i=this.tags[n];if(i)try{return i+decodeURIComponent(r)}catch(e){return t(String(e)),null}return n===`!`?e:(t(`Could not resolve tag: ${e}`),null)}tagString(e){for(let[t,n]of Object.entries(this.tags))if(e.startsWith(n))return t+le(e.substring(n.length));return e[0]===`!`?e:`!<${e}>`}toString(e){let t=this.yaml.explicit?[`%YAML ${this.yaml.version||`1.2`}`]:[],n=Object.entries(this.tags),r;if(e&&n.length>0&&j(e.contents)){let t={};re(e.contents,(e,n)=>{j(n)&&n.tag&&(t[n.tag]=!0)}),r=Object.keys(t)}else r=[];for(let[i,a]of n)i===`!!`&&a===`tag:yaml.org,2002:`||(!e||r.some(e=>e.startsWith(a)))&&t.push(`%TAG ${i} ${a}`);return t.join(`
+import{n as e,t}from"./rolldown-runtime-aKtaBQYM.js";import{t as n}from"./preload-helper-Czpn1I53.js";import{i as r,n as i,r as a}from"./compat-DyT25qXb.js";import"./context-compaction-dcYYajWb.js";import{t as o}from"./logger-DDBAeTLF.js";import"./src-CS5gSDhT.js";import{o as s,t as c}from"./proxied-fetch-DETjVL-j.js";import{t as l}from"./secret-topology-D2k1IxFk.js";import{t as u}from"./secrets-bridge-client-CONYX8PU.js";import"./tool-ui-DfXu6quJ.js";import{n as d,o as f,t as p}from"./providers-O8pbKDYe.js";import{n as m,t as h}from"./panel-rpc-DmJSNs0I.js";import{r as g,t as _}from"./bedrock-camp-BEi8MYUS.js";var v=Symbol.for(`yaml.alias`),y=Symbol.for(`yaml.document`),b=Symbol.for(`yaml.map`),x=Symbol.for(`yaml.pair`),S=Symbol.for(`yaml.scalar`),C=Symbol.for(`yaml.seq`),w=Symbol.for(`yaml.node.type`),T=e=>!!e&&typeof e==`object`&&e[w]===v,E=e=>!!e&&typeof e==`object`&&e[w]===y,ee=e=>!!e&&typeof e==`object`&&e[w]===b,D=e=>!!e&&typeof e==`object`&&e[w]===x,O=e=>!!e&&typeof e==`object`&&e[w]===S,k=e=>!!e&&typeof e==`object`&&e[w]===C;function A(e){if(e&&typeof e==`object`)switch(e[w]){case b:case C:return!0}return!1}function j(e){if(e&&typeof e==`object`)switch(e[w]){case v:case b:case S:case C:return!0}return!1}var te=e=>(O(e)||A(e))&&!!e.anchor,M=Symbol(`break visit`),ne=Symbol(`skip children`),N=Symbol(`remove node`);function re(e,t){let n=ae(t);E(e)?P(null,e.contents,n,Object.freeze([e]))===N&&(e.contents=null):P(null,e,n,Object.freeze([]))}re.BREAK=M,re.SKIP=ne,re.REMOVE=N;function P(e,t,n,r){let i=oe(e,t,n,r);if(j(i)||D(i))return se(e,r,i),P(e,i,n,r);if(typeof i!=`symbol`){if(A(t)){r=Object.freeze(r.concat(t));for(let e=0;e<t.items.length;++e){let i=P(e,t.items[e],n,r);if(typeof i==`number`)e=i-1;else if(i===M)return M;else i===N&&(t.items.splice(e,1),--e)}}else if(D(t)){r=Object.freeze(r.concat(t));let e=P(`key`,t.key,n,r);if(e===M)return M;e===N&&(t.key=null);let i=P(`value`,t.value,n,r);if(i===M)return M;i===N&&(t.value=null)}}return i}async function ie(e,t){let n=ae(t);E(e)?await F(null,e.contents,n,Object.freeze([e]))===N&&(e.contents=null):await F(null,e,n,Object.freeze([]))}ie.BREAK=M,ie.SKIP=ne,ie.REMOVE=N;async function F(e,t,n,r){let i=await oe(e,t,n,r);if(j(i)||D(i))return se(e,r,i),F(e,i,n,r);if(typeof i!=`symbol`){if(A(t)){r=Object.freeze(r.concat(t));for(let e=0;e<t.items.length;++e){let i=await F(e,t.items[e],n,r);if(typeof i==`number`)e=i-1;else if(i===M)return M;else i===N&&(t.items.splice(e,1),--e)}}else if(D(t)){r=Object.freeze(r.concat(t));let e=await F(`key`,t.key,n,r);if(e===M)return M;e===N&&(t.key=null);let i=await F(`value`,t.value,n,r);if(i===M)return M;i===N&&(t.value=null)}}return i}function ae(e){return typeof e==`object`&&(e.Collection||e.Node||e.Value)?Object.assign({Alias:e.Node,Map:e.Node,Scalar:e.Node,Seq:e.Node},e.Value&&{Map:e.Value,Scalar:e.Value,Seq:e.Value},e.Collection&&{Map:e.Collection,Seq:e.Collection},e):e}function oe(e,t,n,r){if(typeof n==`function`)return n(e,t,r);if(ee(t))return n.Map?.(e,t,r);if(k(t))return n.Seq?.(e,t,r);if(D(t))return n.Pair?.(e,t,r);if(O(t))return n.Scalar?.(e,t,r);if(T(t))return n.Alias?.(e,t,r)}function se(e,t,n){let r=t[t.length-1];if(A(r))r.items[e]=n;else if(D(r))e===`key`?r.key=n:r.value=n;else if(E(r))r.contents=n;else{let e=T(r)?`alias`:`scalar`;throw Error(`Cannot replace node with ${e} parent`)}}var ce={"!":`%21`,",":`%2C`,"[":`%5B`,"]":`%5D`,"{":`%7B`,"}":`%7D`},le=e=>e.replace(/[!,[\]{}]/g,e=>ce[e]),ue=class e{constructor(t,n){this.docStart=null,this.docEnd=!1,this.yaml=Object.assign({},e.defaultYaml,t),this.tags=Object.assign({},e.defaultTags,n)}clone(){let t=new e(this.yaml,this.tags);return t.docStart=this.docStart,t}atDocument(){let t=new e(this.yaml,this.tags);switch(this.yaml.version){case`1.1`:this.atNextDocument=!0;break;case`1.2`:this.atNextDocument=!1,this.yaml={explicit:e.defaultYaml.explicit,version:`1.2`},this.tags=Object.assign({},e.defaultTags);break}return t}add(t,n){this.atNextDocument&&=(this.yaml={explicit:e.defaultYaml.explicit,version:`1.1`},this.tags=Object.assign({},e.defaultTags),!1);let r=t.trim().split(/[ \t]+/),i=r.shift();switch(i){case`%TAG`:{if(r.length!==2&&(n(0,`%TAG directive should contain exactly two parts`),r.length<2))return!1;let[e,t]=r;return this.tags[e]=t,!0}case`%YAML`:{if(this.yaml.explicit=!0,r.length!==1)return n(0,`%YAML directive should contain exactly one part`),!1;let[e]=r;if(e===`1.1`||e===`1.2`)return this.yaml.version=e,!0;{let t=/^\d+\.\d+$/.test(e);return n(6,`Unsupported YAML version ${e}`,t),!1}}default:return n(0,`Unknown directive ${i}`,!0),!1}}tagName(e,t){if(e===`!`)return`!`;if(e[0]!==`!`)return t(`Not a valid tag: ${e}`),null;if(e[1]===`<`){let n=e.slice(2,-1);return n===`!`||n===`!!`?(t(`Verbatim tags aren't resolved, so ${e} is invalid.`),null):(e[e.length-1]!==`>`&&t(`Verbatim tags must end with a >`),n)}let[,n,r]=e.match(/^(.*!)([^!]*)$/s);r||t(`The ${e} tag has no suffix`);let i=this.tags[n];if(i)try{return i+decodeURIComponent(r)}catch(e){return t(String(e)),null}return n===`!`?e:(t(`Could not resolve tag: ${e}`),null)}tagString(e){for(let[t,n]of Object.entries(this.tags))if(e.startsWith(n))return t+le(e.substring(n.length));return e[0]===`!`?e:`!<${e}>`}toString(e){let t=this.yaml.explicit?[`%YAML ${this.yaml.version||`1.2`}`]:[],n=Object.entries(this.tags),r;if(e&&n.length>0&&j(e.contents)){let t={};re(e.contents,(e,n)=>{j(n)&&n.tag&&(t[n.tag]=!0)}),r=Object.keys(t)}else r=[];for(let[i,a]of n)i===`!!`&&a===`tag:yaml.org,2002:`||(!e||r.some(e=>e.startsWith(a)))&&t.push(`%TAG ${i} ${a}`);return t.join(`
 `)}};ue.defaultYaml={explicit:!1,version:`1.2`},ue.defaultTags={"!!":`tag:yaml.org,2002:`};function de(e){if(/[\x00-\x19\s,[\]{}]/.test(e)){let t=`Anchor must not contain whitespace or control characters: ${JSON.stringify(e)}`;throw Error(t)}return!0}function fe(e,t,n,r){if(r&&typeof r==`object`)if(Array.isArray(r))for(let t=0,n=r.length;t<n;++t){let n=r[t],i=fe(e,r,String(t),n);i===void 0?delete r[t]:i!==n&&(r[t]=i)}else if(r instanceof Map)for(let t of Array.from(r.keys())){let n=r.get(t),i=fe(e,r,t,n);i===void 0?r.delete(t):i!==n&&r.set(t,i)}else if(r instanceof Set)for(let t of Array.from(r)){let n=fe(e,r,t,t);n===void 0?r.delete(t):n!==t&&(r.delete(t),r.add(n))}else for(let[t,n]of Object.entries(r)){let i=fe(e,r,t,n);i===void 0?delete r[t]:i!==n&&(r[t]=i)}return e.call(t,n,r)}function I(e,t,n){if(Array.isArray(e))return e.map((e,t)=>I(e,String(t),n));if(e&&typeof e.toJSON==`function`){if(!n||!te(e))return e.toJSON(t,n);let r={aliasCount:0,count:1,res:void 0};n.anchors.set(e,r),n.onCreate=e=>{r.res=e,delete n.onCreate};let i=e.toJSON(t,n);return n.onCreate&&n.onCreate(i),i}return typeof e==`bigint`&&!n?.keep?Number(e):e}var pe=class{constructor(e){Object.defineProperty(this,w,{value:e})}clone(){let e=Object.create(Object.getPrototypeOf(this),Object.getOwnPropertyDescriptors(this));return this.range&&(e.range=this.range.slice()),e}toJS(e,{mapAsMap:t,maxAliasCount:n,onAnchor:r,reviver:i}={}){if(!E(e))throw TypeError(`A document argument is required`);let a={anchors:new Map,doc:e,keep:!0,mapAsMap:t===!0,mapKeyWarned:!1,maxAliasCount:typeof n==`number`?n:100},o=I(this,``,a);if(typeof r==`function`)for(let{count:e,res:t}of a.anchors.values())r(t,e);return typeof i==`function`?fe(i,{"":o},``,o):o}},me=class extends pe{constructor(e){super(v),this.source=e,Object.defineProperty(this,"tag",{set(){throw Error(`Alias nodes cannot have tags`)}})}resolve(e,t){if(t?.maxAliasCount===0)throw ReferenceError(`Alias resolution is disabled`);let n;t?.aliasResolveCache?n=t.aliasResolveCache:(n=[],re(e,{Node:(e,t)=>{(T(t)||te(t))&&n.push(t)}}),t&&(t.aliasResolveCache=n));let r;for(let e of n){if(e===this)break;e.anchor===this.source&&(r=e)}return r}toJSON(e,t){if(!t)return{source:this.source};let{anchors:n,doc:r,maxAliasCount:i}=t,a=this.resolve(r,t);if(!a){let e=`Unresolved alias (the anchor must be set before the alias): ${this.source}`;throw ReferenceError(e)}let o=n.get(a);if(o||=(I(a,null,t),n.get(a)),o?.res===void 0)throw ReferenceError(`This should not happen: Alias anchor was not resolved?`);if(i>=0&&(o.count+=1,o.aliasCount===0&&(o.aliasCount=he(r,a,n)),o.count*o.aliasCount>i))throw ReferenceError(`Excessive alias count indicates a resource exhaustion attack`);return o.res}toString(e,t,n){let r=`*${this.source}`;if(e){if(de(this.source),e.options.verifyAliasOrder&&!e.anchors.has(this.source)){let e=`Unresolved alias (the anchor must be set before the alias): ${this.source}`;throw Error(e)}if(e.implicitKey)return`${r} `}return r}};function he(e,t,n){if(T(t)){let r=t.resolve(e),i=n&&r&&n.get(r);return i?i.count*i.aliasCount:0}else if(A(t)){let r=0;for(let i of t.items){let t=he(e,i,n);t>r&&(r=t)}return r}else if(D(t)){let r=he(e,t.key,n),i=he(e,t.value,n);return Math.max(r,i)}return 1}var ge=e=>!e||typeof e!=`function`&&typeof e!=`object`,L=class extends pe{constructor(e){super(S),this.value=e}toJSON(e,t){return t?.keep?this.value:I(this.value,e,t)}toString(){return String(this.value)}};L.BLOCK_FOLDED=`BLOCK_FOLDED`,L.BLOCK_LITERAL=`BLOCK_LITERAL`,L.PLAIN=`PLAIN`,L.QUOTE_DOUBLE=`QUOTE_DOUBLE`,L.QUOTE_SINGLE=`QUOTE_SINGLE`;var _e=`tag:yaml.org,2002:`;function ve(e,t,n){if(t){let e=n.filter(e=>e.tag===t),r=e.find(e=>!e.format)??e[0];if(!r)throw Error(`Tag ${t} not found`);return r}return n.find(t=>t.identify?.(e)&&!t.format)}function ye(e,t,n){if(E(e)&&(e=e.contents),j(e))return e;if(D(e)){let t=n.schema[b].createNode?.(n.schema,null,n);return t.items.push(e),t}(e instanceof String||e instanceof Number||e instanceof Boolean||typeof BigInt<`u`&&e instanceof BigInt)&&(e=e.valueOf());let{aliasDuplicateObjects:r,onAnchor:i,onTagObj:a,schema:o,sourceObjects:s}=n,c;if(r&&e&&typeof e==`object`){if(c=s.get(e),c)return c.anchor??=i(e),new me(c.anchor);c={anchor:null,node:null},s.set(e,c)}t?.startsWith(`!!`)&&(t=_e+t.slice(2));let l=ve(e,t,o.tags);if(!l){if(e&&typeof e.toJSON==`function`&&(e=e.toJSON()),!e||typeof e!=`object`){let t=new L(e);return c&&(c.node=t),t}l=e instanceof Map?o[b]:Symbol.iterator in Object(e)?o[C]:o[b]}a&&(a(l),delete n.onTagObj);let u=l?.createNode?l.createNode(n.schema,e,n):typeof l?.nodeClass?.from==`function`?l.nodeClass.from(n.schema,e,n):new L(e);return t?u.tag=t:l.default||(u.tag=l.tag),c&&(c.node=u),u}function be(e,t,n){let r=n;for(let e=t.length-1;e>=0;--e){let n=t[e];if(typeof n==`number`&&Number.isInteger(n)&&n>=0){let e=[];e[n]=r,r=e}else r=new Map([[n,r]])}return ye(r,void 0,{aliasDuplicateObjects:!1,keepUndefined:!1,onAnchor:()=>{throw Error(`This should not happen, please report a bug.`)},schema:e,sourceObjects:new Map})}var xe=e=>e==null||typeof e==`object`&&!!e[Symbol.iterator]().next().done,Se=class extends pe{constructor(e,t){super(e),Object.defineProperty(this,"schema",{value:t,configurable:!0,enumerable:!1,writable:!0})}clone(e){let t=Object.create(Object.getPrototypeOf(this),Object.getOwnPropertyDescriptors(this));return e&&(t.schema=e),t.items=t.items.map(t=>j(t)||D(t)?t.clone(e):t),this.range&&(t.range=this.range.slice()),t}addIn(e,t){if(xe(e))this.add(t);else{let[n,...r]=e,i=this.get(n,!0);if(A(i))i.addIn(r,t);else if(i===void 0&&this.schema)this.set(n,be(this.schema,r,t));else throw Error(`Expected YAML collection at ${n}. Remaining path: ${r}`)}}deleteIn(e){let[t,...n]=e;if(n.length===0)return this.delete(t);let r=this.get(t,!0);if(A(r))return r.deleteIn(n);throw Error(`Expected YAML collection at ${t}. Remaining path: ${n}`)}getIn(e,t){let[n,...r]=e,i=this.get(n,!0);return r.length===0?!t&&O(i)?i.value:i:A(i)?i.getIn(r,t):void 0}hasAllNullValues(e){return this.items.every(t=>{if(!D(t))return!1;let n=t.value;return n==null||e&&O(n)&&n.value==null&&!n.commentBefore&&!n.comment&&!n.tag})}hasIn(e){let[t,...n]=e;if(n.length===0)return this.has(t);let r=this.get(t,!0);return A(r)?r.hasIn(n):!1}setIn(e,t){let[n,...r]=e;if(r.length===0)this.set(n,t);else{let e=this.get(n,!0);if(A(e))e.setIn(r,t);else if(e===void 0&&this.schema)this.set(n,be(this.schema,r,t));else throw Error(`Expected YAML collection at ${n}. Remaining path: ${r}`)}}},Ce=e=>e.replace(/^(?!$)(?: $)?/gm,`#`);function we(e,t){return/^\n+$/.test(e)?e.substring(1):t?e.replace(/^(?! *$)/gm,t):e}var R=(e,t,n)=>e.endsWith(`
 `)?we(n,t):n.includes(`
 `)?`