@c4a/extract-thrift 0.7.1 → 0.7.4

package/index.js

@@ -11404,6 +11404,8 @@ function keyTokens(key) {
   return key.replace(/([a-z0-9])([A-Z])/gu, "$1-$2").replace(/[^A-Za-z0-9]+/gu, "-").toLowerCase().split("-").filter(Boolean);
 }
 function sensitiveKey(key, value) {
+  if (value === INDEXER_OUTPUT_REDACTION_MARKER)
+    return false;
   const tokens = keyTokens(key);
   if (tokens.length === 0)
     return false;
@@ -11445,12 +11447,12 @@ function replaceWithCount(value, pattern, replacement, count) {
 function redactKnownText(value, count) {
   let output = value;
   output = replaceWithCount(output, /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/gu, INDEXER_OUTPUT_REDACTION_MARKER, count);
-  output = replaceWithCount(output, /(\bauthorization\s*:\s*(?:bearer|basic)\s+)[^\s,;]+/giu, (_match, prefix) => `${prefix}${INDEXER_OUTPUT_REDACTION_MARKER}`, count);
+  output = replaceWithCount(output, new RegExp(`(\\bauthorization\\s*:\\s*(?:bearer|basic)\\s+)` + `(?!${escapeRegExp(INDEXER_OUTPUT_REDACTION_MARKER)})[^\\s,;]+`, "giu"), (_match, prefix) => `${prefix}${INDEXER_OUTPUT_REDACTION_MARKER}`, count);
   output = replaceWithCount(output, /([a-z][a-z0-9+.-]*:\/\/)[^\s/@:]+:[^\s/@]+@/giu, (_match, prefix) => `${prefix}${INDEXER_OUTPUT_REDACTION_MARKER}@`, count);
-  output = replaceWithCount(output, /([?&](?:access_token|refresh_token|api_key|password|secret)=)[^&#\s]+/giu, (_match, prefix) => `${prefix}${INDEXER_OUTPUT_REDACTION_MARKER}`, count);
+  output = replaceWithCount(output, new RegExp(`([?&](?:access_token|refresh_token|api_key|password|secret)=)` + `(?!${escapeRegExp(INDEXER_OUTPUT_REDACTION_MARKER)})[^&#\\s]+`, "giu"), (_match, prefix) => `${prefix}${INDEXER_OUTPUT_REDACTION_MARKER}`, count);
   const key = "(?:[A-Za-z0-9_.-]*(?:password|passwd|pwd|secret|token|credential|cookie)[A-Za-z0-9_.-]*|api[-_]?key|access[-_]?(?:key|token)|private[-_]?key|client[-_]?secret|authorization)";
   const assignment = `(?:=\\s*|:\\s+(?=\\S)|:\\s*(?=["']))`;
-  output = replaceWithCount(output, new RegExp(`((?:["']?${key}["']?)\\s*${assignment})(?:"(?:\\\\.|[^"])*"|'(?:\\\\.|[^'])*'|[^\\s,;}\\]]+)`, "giu"), (_match, prefix) => `${prefix}"${INDEXER_OUTPUT_REDACTION_MARKER}"`, count);
+  output = replaceWithCount(output, new RegExp(`((?:["']?${key}["']?)\\s*${assignment})` + `(?!["']?${escapeRegExp(INDEXER_OUTPUT_REDACTION_MARKER)})` + `(?:"(?:\\\\.|[^"])*"|'(?:\\\\.|[^'])*'|[^\\s,;}\\]]+)`, "giu"), (_match, prefix) => `${prefix}"${INDEXER_OUTPUT_REDACTION_MARKER}"`, count);
   return output;
 }
 function redactBlockedText(value, blocked, count) {
@@ -11718,6 +11720,25 @@ function createIndexerEvidenceAdapterFact(input) {
   FACT_PAYLOADS.set(fact2, payload);
   return fact2;
 }
+function indexerEvidenceAdapterFactPayloads(result) {
+  const payloads = result.files.flatMap((file) => file.facts.map((fact2) => {
+    const payload = FACT_PAYLOADS.get(fact2);
+    if (payload === undefined) {
+      throw new TypeError(`Evidence Adapter fact payload ${fact2.fact_ref} is no longer materialized in this process`);
+    }
+    if (indexerEvidenceAdapterProtocolDigest(payload) !== fact2.payload_digest) {
+      throw new TypeError(`Evidence Adapter fact payload ${fact2.fact_ref} is stale`);
+    }
+    return { fact_ref: fact2.fact_ref, payload };
+  })).sort((left, right) => compareCanonicalText(left.fact_ref, right.fact_ref));
+  return assertIndexerOutputSafe({ channel: "ipc-envelope", value: payloads });
+}
+function materializeIndexerEvidenceAdapterResult(result) {
+  return {
+    result,
+    fact_payloads: indexerEvidenceAdapterFactPayloads(result)
+  };
+}
 function indexerEvidenceAdapterOutputDigest(value) {
   return indexerEvidenceAdapterProtocolDigest(value);
 }
@@ -12331,7 +12352,7 @@ function parseThriftSources(files) {
 }
 
 // src/index.ts
-var THRIFT_EVIDENCE_ADAPTER_EXPORT = "thriftSourcesToEvidenceAdapterResult";
+var THRIFT_EVIDENCE_ADAPTER_EXPORT = "thriftSourcesToEvidenceAdapterMaterialization";
 function assertModuleAuthorized(moduleRef, invocation) {
   if (moduleRef !== null && !invocation.authorized_scope.module_refs.includes(moduleRef)) {
     throw new TypeError(`Thrift module ${moduleRef} escapes authorized scope`);
@@ -12434,8 +12455,12 @@ function thriftSourcesToEvidenceAdapterResult(files, invocation) {
     }]
   });
 }
+function thriftSourcesToEvidenceAdapterMaterialization(files, invocation) {
+  return materializeIndexerEvidenceAdapterResult(thriftSourcesToEvidenceAdapterResult(files, invocation));
+}
 export {
   thriftSourcesToEvidenceAdapterResult,
+  thriftSourcesToEvidenceAdapterMaterialization,
   parseThriftSources,
   lexThrift,
   ThriftSyntaxError,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@c4a/extract-thrift",
-  "version": "0.7.1",
+  "version": "0.7.4",
   "type": "module",
   "description": "Apache Thrift IDL catalog parser for Context",
   "license": "MIT",