@empire-builder-kit/runtime 1.0.0-beta.9 → 1.0.0-rc.2

package/src/secrets/sensitive-patterns.cjs

@@ -0,0 +1,84 @@
+// @generated from packages/runtime/src/secrets/sensitive-patterns.ts by tools/runtime/generate-shared-authorities.mjs
+// Do not edit this artifact directly.
+'use strict';
+Object.defineProperty(exports, '__esModule', { value: true });
+exports.CREDENTIAL_SHAPE_DEFINITIONS = exports.CREDENTIAL_SHAPE_KINDS = void 0;
+exports.detectCredentialShapes = detectCredentialShapes;
+exports.hasCredentialShape = hasCredentialShape;
+exports.redactCredentialShapes = redactCredentialShapes;
+exports.CREDENTIAL_SHAPE_KINDS = Object.freeze([
+  'authorization-header',
+  'cookie-header',
+  'credential-assignment',
+  'aws-access-key',
+  'private-key',
+  'jwt',
+  'provider-token',
+  'credential-url',
+]);
+/**
+ * One package-level authority for credential shapes that must never cross a
+ * logging, evidence, release, or supply-chain metadata boundary. This ESM
+ * entry remains source-loadable; its CommonJS peer is held to the same exact
+ * definitions and behavior by the parity spec.
+ */
+exports.CREDENTIAL_SHAPE_DEFINITIONS = Object.freeze([
+  Object.freeze({
+    kind: 'authorization-header',
+    pattern:
+      /\bauthorization["']?\s*[:=]\s*(?!["']?\[?redacted\]?)(?:["']?)(?:bearer|basic)\s+\S+/iu,
+  }),
+  Object.freeze({
+    kind: 'cookie-header',
+    pattern: /\b(?:cookie|set-cookie)["']?\s*[:=]\s*["']?[^\s;=]+=[^\s;]+/iu,
+  }),
+  Object.freeze({
+    kind: 'credential-assignment',
+    pattern:
+      /(?<![:/])\b(?:access[_-]?token|api[_-]?key|(?:aws[_-]?)?secret[_-]?access[_-]?key|client[_-]?secret|credential|id[_-]?token|pass(?:word|wd)|private[_-]?key|refresh[_-]?token|secret(?:[_-]?key)?|session[_-]?token|token)["']?\s*[:=]\s*(?!["']?(?:\[redacted\]|redacted|removed)["']?(?=\s*(?:[,}\];]|$)))(?:"(?:[^"\\\r\n]|\\.)+(?=")|'(?:[^'\\\r\n]|\\.)+(?=')|[^\s,;}\]]+)/iu,
+  }),
+  Object.freeze({
+    kind: 'aws-access-key',
+    pattern: /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/u,
+  }),
+  Object.freeze({
+    kind: 'private-key',
+    pattern: /-----BEGIN (?:[A-Z ]+ )?PRIVATE KEY-----/u,
+  }),
+  Object.freeze({
+    kind: 'jwt',
+    pattern: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/u,
+  }),
+  Object.freeze({
+    kind: 'provider-token',
+    pattern:
+      /\b(?:gh[pousr]_|github_pat_|npm_|sk-(?:proj-)?|sk_(?:live|test)_|xox[baprs]-)[A-Za-z0-9_-]{12,}\b/u,
+  }),
+  Object.freeze({
+    kind: 'credential-url',
+    pattern:
+      /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis):\/\/[^/\s:@]+:[^@\s/]+@/iu,
+  }),
+]);
+function detectCredentialShapes(value) {
+  return exports.CREDENTIAL_SHAPE_DEFINITIONS.filter(({ pattern }) =>
+    pattern.test(value),
+  ).map(({ kind }) => kind);
+}
+function hasCredentialShape(value) {
+  return exports.CREDENTIAL_SHAPE_DEFINITIONS.some(({ pattern }) =>
+    pattern.test(value),
+  );
+}
+function redactCredentialShapes(value) {
+  return exports.CREDENTIAL_SHAPE_DEFINITIONS.reduce(
+    (redacted, { kind, pattern }) =>
+      redacted.replace(
+        new RegExp(pattern.source, `${pattern.flags}g`),
+        `[REDACTED_${kind.toUpperCase().replace(/-/g, '_')}]`,
+      ),
+    value,
+  );
+}
+
+Object.freeze(module.exports);

package/src/secrets/sensitive-patterns.d.cts

@@ -0,0 +1,62 @@
+// @generated from packages/runtime/src/secrets/sensitive-patterns.ts by tools/runtime/generate-shared-authorities.mjs
+// Do not edit this artifact directly.
+export declare const CREDENTIAL_SHAPE_KINDS: readonly [
+  'authorization-header',
+  'cookie-header',
+  'credential-assignment',
+  'aws-access-key',
+  'private-key',
+  'jwt',
+  'provider-token',
+  'credential-url',
+];
+export type CredentialShapeKind = (typeof CREDENTIAL_SHAPE_KINDS)[number];
+export interface CredentialShapeDefinition {
+  kind: CredentialShapeKind;
+  pattern: RegExp;
+}
+/**
+ * One package-level authority for credential shapes that must never cross a
+ * logging, evidence, release, or supply-chain metadata boundary. This ESM
+ * entry remains source-loadable; its CommonJS peer is held to the same exact
+ * definitions and behavior by the parity spec.
+ */
+export declare const CREDENTIAL_SHAPE_DEFINITIONS: readonly (
+  | Readonly<{
+      kind: 'authorization-header';
+      pattern: RegExp;
+    }>
+  | Readonly<{
+      kind: 'cookie-header';
+      pattern: RegExp;
+    }>
+  | Readonly<{
+      kind: 'credential-assignment';
+      pattern: RegExp;
+    }>
+  | Readonly<{
+      kind: 'aws-access-key';
+      pattern: RegExp;
+    }>
+  | Readonly<{
+      kind: 'private-key';
+      pattern: RegExp;
+    }>
+  | Readonly<{
+      kind: 'jwt';
+      pattern: RegExp;
+    }>
+  | Readonly<{
+      kind: 'provider-token';
+      pattern: RegExp;
+    }>
+  | Readonly<{
+      kind: 'credential-url';
+      pattern: RegExp;
+    }>
+)[];
+export declare function detectCredentialShapes(
+  value: string,
+): CredentialShapeKind[];
+export declare function hasCredentialShape(value: string): boolean;
+export declare function redactCredentialShapes(value: string): string;

package/src/secrets/sensitive-patterns.d.ts

@@ -0,0 +1,40 @@
+export declare const CREDENTIAL_SHAPE_KINDS: readonly ["authorization-header", "cookie-header", "credential-assignment", "aws-access-key", "private-key", "jwt", "provider-token", "credential-url"];
+export type CredentialShapeKind = (typeof CREDENTIAL_SHAPE_KINDS)[number];
+export interface CredentialShapeDefinition {
+    kind: CredentialShapeKind;
+    pattern: RegExp;
+}
+/**
+ * One package-level authority for credential shapes that must never cross a
+ * logging, evidence, release, or supply-chain metadata boundary. This ESM
+ * entry remains source-loadable; its CommonJS peer is held to the same exact
+ * definitions and behavior by the parity spec.
+ */
+export declare const CREDENTIAL_SHAPE_DEFINITIONS: readonly (Readonly<{
+    kind: "authorization-header";
+    pattern: RegExp;
+}> | Readonly<{
+    kind: "cookie-header";
+    pattern: RegExp;
+}> | Readonly<{
+    kind: "credential-assignment";
+    pattern: RegExp;
+}> | Readonly<{
+    kind: "aws-access-key";
+    pattern: RegExp;
+}> | Readonly<{
+    kind: "private-key";
+    pattern: RegExp;
+}> | Readonly<{
+    kind: "jwt";
+    pattern: RegExp;
+}> | Readonly<{
+    kind: "provider-token";
+    pattern: RegExp;
+}> | Readonly<{
+    kind: "credential-url";
+    pattern: RegExp;
+}>)[];
+export declare function detectCredentialShapes(value: string): CredentialShapeKind[];
+export declare function hasCredentialShape(value: string): boolean;
+export declare function redactCredentialShapes(value: string): string;

package/src/secrets/sensitive-patterns.js

@@ -0,0 +1,60 @@
+export const CREDENTIAL_SHAPE_KINDS = Object.freeze([
+    'authorization-header',
+    'cookie-header',
+    'credential-assignment',
+    'aws-access-key',
+    'private-key',
+    'jwt',
+    'provider-token',
+    'credential-url',
+]);
+/**
+ * One package-level authority for credential shapes that must never cross a
+ * logging, evidence, release, or supply-chain metadata boundary. This ESM
+ * entry remains source-loadable; its CommonJS peer is held to the same exact
+ * definitions and behavior by the parity spec.
+ */
+export const CREDENTIAL_SHAPE_DEFINITIONS = Object.freeze([
+    Object.freeze({
+        kind: 'authorization-header',
+        pattern: /\bauthorization["']?\s*[:=]\s*(?!["']?\[?redacted\]?)(?:["']?)(?:bearer|basic)\s+\S+/iu,
+    }),
+    Object.freeze({
+        kind: 'cookie-header',
+        pattern: /\b(?:cookie|set-cookie)["']?\s*[:=]\s*["']?[^\s;=]+=[^\s;]+/iu,
+    }),
+    Object.freeze({
+        kind: 'credential-assignment',
+        pattern: /(?<![:/])\b(?:access[_-]?token|api[_-]?key|(?:aws[_-]?)?secret[_-]?access[_-]?key|client[_-]?secret|credential|id[_-]?token|pass(?:word|wd)|private[_-]?key|refresh[_-]?token|secret(?:[_-]?key)?|session[_-]?token|token)["']?\s*[:=]\s*(?!["']?(?:\[redacted\]|redacted|removed)["']?(?=\s*(?:[,}\];]|$)))(?:"(?:[^"\\\r\n]|\\.)+(?=")|'(?:[^'\\\r\n]|\\.)+(?=')|[^\s,;}\]]+)/iu,
+    }),
+    Object.freeze({
+        kind: 'aws-access-key',
+        pattern: /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/u,
+    }),
+    Object.freeze({
+        kind: 'private-key',
+        pattern: /-----BEGIN (?:[A-Z ]+ )?PRIVATE KEY-----/u,
+    }),
+    Object.freeze({
+        kind: 'jwt',
+        pattern: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/u,
+    }),
+    Object.freeze({
+        kind: 'provider-token',
+        pattern: /\b(?:gh[pousr]_|github_pat_|npm_|sk-(?:proj-)?|sk_(?:live|test)_|xox[baprs]-)[A-Za-z0-9_-]{12,}\b/u,
+    }),
+    Object.freeze({
+        kind: 'credential-url',
+        pattern: /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis):\/\/[^/\s:@]+:[^@\s/]+@/iu,
+    }),
+]);
+export function detectCredentialShapes(value) {
+    return CREDENTIAL_SHAPE_DEFINITIONS.filter(({ pattern }) => pattern.test(value)).map(({ kind }) => kind);
+}
+export function hasCredentialShape(value) {
+    return CREDENTIAL_SHAPE_DEFINITIONS.some(({ pattern }) => pattern.test(value));
+}
+export function redactCredentialShapes(value) {
+    return CREDENTIAL_SHAPE_DEFINITIONS.reduce((redacted, { kind, pattern }) => redacted.replace(new RegExp(pattern.source, `${pattern.flags}g`), `[REDACTED_${kind.toUpperCase().replace(/-/g, '_')}]`), value);
+}
+//# sourceMappingURL=sensitive-patterns.js.map

package/src/secrets/sensitive-patterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sensitive-patterns.js","sourceRoot":"","sources":["../../../../../packages/runtime/src/secrets/sensitive-patterns.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC,MAAM,CAAC;IAClD,sBAAsB;IACtB,eAAe;IACf,uBAAuB;IACvB,gBAAgB;IAChB,aAAa;IACb,KAAK;IACL,gBAAgB;IAChB,gBAAgB;CACR,CAAC,CAAC;AASZ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC,MAAM,CAAC;IACxD,MAAM,CAAC,MAAM,CAAC;QACZ,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EACL,wFAAwF;KAC3F,CAAC;IACF,MAAM,CAAC,MAAM,CAAC;QACZ,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,+DAA+D;KACzE,CAAC;IACF,MAAM,CAAC,MAAM,CAAC;QACZ,IAAI,EAAE,uBAAuB;QAC7B,OAAO,EACL,mXAAmX;KACtX,CAAC;IACF,MAAM,CAAC,MAAM,CAAC;QACZ,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,gCAAgC;KAC1C,CAAC;IACF,MAAM,CAAC,MAAM,CAAC;QACZ,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,2CAA2C;KACrD,CAAC;IACF,MAAM,CAAC,MAAM,CAAC;QACZ,IAAI,EAAE,KAAK;QACX,OAAO,EAAE,iEAAiE;KAC3E,CAAC;IACF,MAAM,CAAC,MAAM,CAAC;QACZ,IAAI,EAAE,gBAAgB;QACtB,OAAO,EACL,oGAAoG;KACvG,CAAC;IACF,MAAM,CAAC,MAAM,CAAC;QACZ,IAAI,EAAE,gBAAgB;QACtB,OAAO,EACL,+EAA+E;KAClF,CAAC;CAC4C,CAAC,CAAC;AAElD,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,OAAO,4BAA4B,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CACzD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CACpB,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,OAAO,4BAA4B,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CACvD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CACpB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,OAAO,4BAA4B,CAAC,MAAM,CACxC,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAC9B,QAAQ,CAAC,OAAO,CACd,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,GAAG,CAAC,EAC/C,aAAa,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CACtD,EACH,KAAK,CACN,CAAC;AACJ,CAAC"}