@assemble-dev/shared-utils 0.1.0

package/dist/redaction/index.cjs

@@ -0,0 +1,230 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/redaction/index.ts
+var redaction_exports = {};
+__export(redaction_exports, {
+  RedactTracePayloadOptionsSchema: () => RedactTracePayloadOptionsSchema,
+  RedactionModeSchema: () => RedactionModeSchema,
+  defaultRedactionMode: () => defaultRedactionMode,
+  isBearerTokenShapedString: () => isBearerTokenShapedString,
+  isJwtShapedString: () => isJwtShapedString,
+  isProviderApiKeyShapedString: () => isProviderApiKeyShapedString,
+  isSecretNamedField: () => isSecretNamedField,
+  isSecretShapedString: () => isSecretShapedString,
+  redactTracePayload: () => redactTracePayload,
+  redactedValue: () => redactedValue,
+  replaceProviderApiKeySubstrings: () => replaceProviderApiKeySubstrings,
+  replaceSecretShapedSubstrings: () => replaceSecretShapedSubstrings,
+  resolveRedactionMode: () => resolveRedactionMode,
+  summarizeJsonValue: () => summarizeJsonValue
+});
+module.exports = __toCommonJS(redaction_exports);
+
+// src/redaction/redaction-mode.ts
+var import_zod = require("zod");
+var RedactionModeSchema = import_zod.z.enum([
+  "metadata-only",
+  "redacted",
+  "full"
+]);
+var defaultRedactionMode = "redacted";
+function resolveRedactionMode(mode) {
+  return mode ?? defaultRedactionMode;
+}
+
+// src/redaction/secret-detection.ts
+var redactedValue = "[REDACTED]";
+var providerApiKeyPrefixes = [
+  "sk-",
+  "sk_live_",
+  "sk_test_",
+  "asm_",
+  "ghp_",
+  "gho_",
+  "ghs_",
+  "ghu_",
+  "github_pat_",
+  "xoxb-",
+  "xoxp-",
+  "xoxa-",
+  "xoxs-",
+  "pk_live_",
+  "rk_live_",
+  "whsec_",
+  "AKIA"
+];
+var secretBodyPattern = /^[A-Za-z0-9+/=_.-]{12,}$/;
+var bearerTokenPattern = /^bearer\s+\S+/i;
+var jwtShapedPattern = /^eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/;
+var secretFieldNameSuffixes = [
+  "api_key",
+  "apikey",
+  "secret",
+  "token",
+  "password"
+];
+function escapeRegExpLiteral(literal) {
+  return literal.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function buildProviderApiKeySubstringPattern() {
+  const escapedPrefixes = providerApiKeyPrefixes.map(escapeRegExpLiteral).join("|");
+  return new RegExp(`(?:${escapedPrefixes})[A-Za-z0-9+/=_.-]{12,}`, "g");
+}
+var providerApiKeySubstringPattern = buildProviderApiKeySubstringPattern();
+var bearerTokenSubstringPattern = /bearer\s+\S+/gi;
+var jwtShapedSubstringPattern = /eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}[A-Za-z0-9_.-]*/g;
+function replaceProviderApiKeySubstrings(value) {
+  return value.replace(providerApiKeySubstringPattern, redactedValue);
+}
+function replaceSecretShapedSubstrings(value) {
+  return replaceProviderApiKeySubstrings(value).replace(bearerTokenSubstringPattern, redactedValue).replace(jwtShapedSubstringPattern, redactedValue);
+}
+function isProviderApiKeyShapedString(value) {
+  return providerApiKeyPrefixes.some(
+    (prefix) => value.startsWith(prefix) && secretBodyPattern.test(value.slice(prefix.length))
+  );
+}
+function isBearerTokenShapedString(value) {
+  return bearerTokenPattern.test(value);
+}
+function isJwtShapedString(value) {
+  return jwtShapedPattern.test(value);
+}
+function isSecretShapedString(value) {
+  return isProviderApiKeyShapedString(value) || isBearerTokenShapedString(value) || isJwtShapedString(value);
+}
+function isSecretNamedField(fieldName) {
+  const normalizedFieldName = fieldName.toLowerCase();
+  if (normalizedFieldName === "authorization") {
+    return true;
+  }
+  return secretFieldNameSuffixes.some(
+    (suffix) => normalizedFieldName.endsWith(suffix)
+  );
+}
+
+// src/redaction/summarize-json-value.ts
+function summarizeJsonValue(value) {
+  if (value === null) {
+    return { kind: "null" };
+  }
+  if (typeof value === "string") {
+    return { kind: "string", length: value.length };
+  }
+  if (typeof value === "number") {
+    return { kind: "number" };
+  }
+  if (typeof value === "boolean") {
+    return { kind: "boolean" };
+  }
+  if (Array.isArray(value)) {
+    return { kind: "array", length: value.length };
+  }
+  return { kind: "object", keys: Object.keys(value) };
+}
+
+// src/redaction/redact-trace-payload.ts
+var import_zod2 = require("zod");
+var RedactTracePayloadOptionsSchema = import_zod2.z.object({
+  mode: RedactionModeSchema.optional(),
+  sensitiveFieldNames: import_zod2.z.array(import_zod2.z.string()).optional()
+});
+function redactTracePayload(payload, options) {
+  const mode = resolveRedactionMode(options?.mode);
+  if (mode === "metadata-only") {
+    return { payload: summarizeJsonValue(payload), redacted: true };
+  }
+  const context = {
+    mode,
+    sensitiveFieldNames: buildSensitiveFieldNameSet(
+      options?.sensitiveFieldNames
+    ),
+    redactedValueCount: 0
+  };
+  const redactedPayload = redactJsonValue(payload, context);
+  return {
+    payload: redactedPayload,
+    redacted: mode !== "full" || context.redactedValueCount > 0
+  };
+}
+function buildSensitiveFieldNameSet(fieldNames) {
+  return new Set(
+    (fieldNames ?? []).map((fieldName) => fieldName.toLowerCase())
+  );
+}
+function redactJsonValue(value, context) {
+  if (typeof value === "string") {
+    return redactStringValue(value, context);
+  }
+  if (Array.isArray(value)) {
+    return value.map((item) => redactJsonValue(item, context));
+  }
+  if (value !== null && typeof value === "object") {
+    return redactObjectValue(value, context);
+  }
+  return value;
+}
+function redactStringValue(value, context) {
+  const shouldRedactWholeString = context.mode === "full" ? isProviderApiKeyShapedString(value) : isSecretShapedString(value);
+  if (shouldRedactWholeString) {
+    context.redactedValueCount += 1;
+    return redactedValue;
+  }
+  const valueWithSecretsReplaced = context.mode === "full" ? replaceProviderApiKeySubstrings(value) : replaceSecretShapedSubstrings(value);
+  if (valueWithSecretsReplaced !== value) {
+    context.redactedValueCount += 1;
+  }
+  return valueWithSecretsReplaced;
+}
+function redactObjectValue(value, context) {
+  const redactedEntries = Object.entries(value).map(
+    ([fieldName, fieldValue]) => {
+      if (shouldRedactFieldValue(fieldName, context)) {
+        context.redactedValueCount += 1;
+        return [fieldName, redactedValue];
+      }
+      return [fieldName, redactJsonValue(fieldValue, context)];
+    }
+  );
+  return Object.fromEntries(redactedEntries);
+}
+function shouldRedactFieldValue(fieldName, context) {
+  if (context.sensitiveFieldNames.has(fieldName.toLowerCase())) {
+    return true;
+  }
+  return context.mode === "redacted" && isSecretNamedField(fieldName);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  RedactTracePayloadOptionsSchema,
+  RedactionModeSchema,
+  defaultRedactionMode,
+  isBearerTokenShapedString,
+  isJwtShapedString,
+  isProviderApiKeyShapedString,
+  isSecretNamedField,
+  isSecretShapedString,
+  redactTracePayload,
+  redactedValue,
+  replaceProviderApiKeySubstrings,
+  replaceSecretShapedSubstrings,
+  resolveRedactionMode,
+  summarizeJsonValue
+});

package/dist/redaction/index.d.cts

@@ -0,0 +1,55 @@
+import { z } from 'zod';
+import { JsonValue } from '@assemble-dev/shared-types/json';
+
+declare const RedactionModeSchema: z.ZodEnum<{
+    "metadata-only": "metadata-only";
+    redacted: "redacted";
+    full: "full";
+}>;
+type RedactionMode = z.infer<typeof RedactionModeSchema>;
+declare const defaultRedactionMode: RedactionMode;
+declare function resolveRedactionMode(mode: RedactionMode | undefined): RedactionMode;
+
+declare const redactedValue = "[REDACTED]";
+declare function replaceProviderApiKeySubstrings(value: string): string;
+declare function replaceSecretShapedSubstrings(value: string): string;
+declare function isProviderApiKeyShapedString(value: string): boolean;
+declare function isBearerTokenShapedString(value: string): boolean;
+declare function isJwtShapedString(value: string): boolean;
+declare function isSecretShapedString(value: string): boolean;
+declare function isSecretNamedField(fieldName: string): boolean;
+
+type JsonValueSummary = {
+    kind: "string";
+    length: number;
+} | {
+    kind: "number";
+} | {
+    kind: "boolean";
+} | {
+    kind: "null";
+} | {
+    kind: "array";
+    length: number;
+} | {
+    kind: "object";
+    keys: string[];
+};
+declare function summarizeJsonValue(value: JsonValue): JsonValueSummary;
+
+declare const RedactTracePayloadOptionsSchema: z.ZodObject<{
+    mode: z.ZodOptional<z.ZodEnum<{
+        "metadata-only": "metadata-only";
+        redacted: "redacted";
+        full: "full";
+    }>>;
+    sensitiveFieldNames: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+type RedactTracePayloadOptions = z.infer<typeof RedactTracePayloadOptionsSchema>;
+type RedactTracePayloadResult = {
+    payload: JsonValue;
+    redacted: boolean;
+};
+declare function redactTracePayload(payload: JsonValue, options?: RedactTracePayloadOptions): RedactTracePayloadResult;
+
+export { type JsonValueSummary, type RedactTracePayloadOptions, RedactTracePayloadOptionsSchema, type RedactTracePayloadResult, type RedactionMode, RedactionModeSchema, defaultRedactionMode, isBearerTokenShapedString, isJwtShapedString, isProviderApiKeyShapedString, isSecretNamedField, isSecretShapedString, redactTracePayload, redactedValue, replaceProviderApiKeySubstrings, replaceSecretShapedSubstrings, resolveRedactionMode, summarizeJsonValue };

package/dist/redaction/index.d.ts

@@ -0,0 +1,55 @@
+import { z } from 'zod';
+import { JsonValue } from '@assemble-dev/shared-types/json';
+
+declare const RedactionModeSchema: z.ZodEnum<{
+    "metadata-only": "metadata-only";
+    redacted: "redacted";
+    full: "full";
+}>;
+type RedactionMode = z.infer<typeof RedactionModeSchema>;
+declare const defaultRedactionMode: RedactionMode;
+declare function resolveRedactionMode(mode: RedactionMode | undefined): RedactionMode;
+
+declare const redactedValue = "[REDACTED]";
+declare function replaceProviderApiKeySubstrings(value: string): string;
+declare function replaceSecretShapedSubstrings(value: string): string;
+declare function isProviderApiKeyShapedString(value: string): boolean;
+declare function isBearerTokenShapedString(value: string): boolean;
+declare function isJwtShapedString(value: string): boolean;
+declare function isSecretShapedString(value: string): boolean;
+declare function isSecretNamedField(fieldName: string): boolean;
+
+type JsonValueSummary = {
+    kind: "string";
+    length: number;
+} | {
+    kind: "number";
+} | {
+    kind: "boolean";
+} | {
+    kind: "null";
+} | {
+    kind: "array";
+    length: number;
+} | {
+    kind: "object";
+    keys: string[];
+};
+declare function summarizeJsonValue(value: JsonValue): JsonValueSummary;
+
+declare const RedactTracePayloadOptionsSchema: z.ZodObject<{
+    mode: z.ZodOptional<z.ZodEnum<{
+        "metadata-only": "metadata-only";
+        redacted: "redacted";
+        full: "full";
+    }>>;
+    sensitiveFieldNames: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+type RedactTracePayloadOptions = z.infer<typeof RedactTracePayloadOptionsSchema>;
+type RedactTracePayloadResult = {
+    payload: JsonValue;
+    redacted: boolean;
+};
+declare function redactTracePayload(payload: JsonValue, options?: RedactTracePayloadOptions): RedactTracePayloadResult;
+
+export { type JsonValueSummary, type RedactTracePayloadOptions, RedactTracePayloadOptionsSchema, type RedactTracePayloadResult, type RedactionMode, RedactionModeSchema, defaultRedactionMode, isBearerTokenShapedString, isJwtShapedString, isProviderApiKeyShapedString, isSecretNamedField, isSecretShapedString, redactTracePayload, redactedValue, replaceProviderApiKeySubstrings, replaceSecretShapedSubstrings, resolveRedactionMode, summarizeJsonValue };

package/dist/redaction/index.js

@@ -0,0 +1,32 @@
+import {
+  RedactTracePayloadOptionsSchema,
+  RedactionModeSchema,
+  defaultRedactionMode,
+  isBearerTokenShapedString,
+  isJwtShapedString,
+  isProviderApiKeyShapedString,
+  isSecretNamedField,
+  isSecretShapedString,
+  redactTracePayload,
+  redactedValue,
+  replaceProviderApiKeySubstrings,
+  replaceSecretShapedSubstrings,
+  resolveRedactionMode,
+  summarizeJsonValue
+} from "../chunk-XDYQIW3Q.js";
+export {
+  RedactTracePayloadOptionsSchema,
+  RedactionModeSchema,
+  defaultRedactionMode,
+  isBearerTokenShapedString,
+  isJwtShapedString,
+  isProviderApiKeyShapedString,
+  isSecretNamedField,
+  isSecretShapedString,
+  redactTracePayload,
+  redactedValue,
+  replaceProviderApiKeySubstrings,
+  replaceSecretShapedSubstrings,
+  resolveRedactionMode,
+  summarizeJsonValue
+};

package/package.json

@@ -0,0 +1,78 @@
+{
+  "name": "@assemble-dev/shared-utils",
+  "version": "0.1.0",
+  "license": "Elastic-2.0",
+  "description": "Shared utilities for Assemble including errors, ids, auth, and redaction",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/smundhra-git/assemble.git",
+    "directory": "packages/shared-utils"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    },
+    "./api-keys": {
+      "types": "./dist/api-keys/index.d.ts",
+      "import": "./dist/api-keys/index.js",
+      "require": "./dist/api-keys/index.cjs"
+    },
+    "./auth": {
+      "types": "./dist/auth/index.d.ts",
+      "import": "./dist/auth/index.js",
+      "require": "./dist/auth/index.cjs"
+    },
+    "./errors": {
+      "types": "./dist/errors/index.d.ts",
+      "import": "./dist/errors/index.js",
+      "require": "./dist/errors/index.cjs"
+    },
+    "./ids": {
+      "types": "./dist/ids/index.d.ts",
+      "import": "./dist/ids/index.js",
+      "require": "./dist/ids/index.cjs"
+    },
+    "./provider-keys": {
+      "types": "./dist/provider-keys/index.d.ts",
+      "import": "./dist/provider-keys/index.js",
+      "require": "./dist/provider-keys/index.cjs"
+    },
+    "./redaction": {
+      "types": "./dist/redaction/index.d.ts",
+      "import": "./dist/redaction/index.js",
+      "require": "./dist/redaction/index.cjs"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "hono": "^4.12.27",
+    "jose": "^6.2.3",
+    "zod": "^4.1.13",
+    "@assemble-dev/shared-types": "0.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "^20.19.0",
+    "eslint": "^9.30.0",
+    "tsup": "^8.5.0",
+    "typescript": "^5.8.3",
+    "vitest": "^3.2.4",
+    "@assemble-dev/config": "0.0.0"
+  },
+  "scripts": {
+    "build": "tsup",
+    "test": "vitest run",
+    "lint": "eslint src",
+    "typecheck": "tsc --noEmit"
+  }
+}