@envseal/detector 0.1.0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined in Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity exercising
+      permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or Object
+      form, made available under the License, as indicated by a copyright
+      notice that is included in or attached to the work (an example is
+      provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original Work and any Derivative Works thereof, that is
+      intentionally submitted to, or received by, Licensor for inclusion
+      in the Work by the copyright owner or by an individual or Legal
+      Entity authorized to submit on behalf of the copyright owner. For
+      the purposes of this definition, "submitted" means any form of
+      electronic, verbal, or written communication sent to the Licensor
+      or its representatives, including but not limited to communication
+      on electronic mailing lists, source code control systems, and issue
+      tracking systems that are managed by, or on behalf of, the Licensor
+      for the purpose of discussing and improving the Work, but excluding
+      communication that is conspicuously marked or otherwise designated
+      in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any Legal Entity on behalf of
+      which a Contribution has been received by Licensor and subsequently
+      incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file, then any
+          Derivative Works that You distribute must include a readable
+          copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE from the Work, provided that
+          such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions of this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contribution.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in appropriate
+      comment syntax for the file type. We also recommend that you
+      include a file or class name and date of last modification in
+      the header comment to make it easier to identify the original
+      author and when the file was changed.
+
+         Copyright 2026 The envseal authors
+
+         Licensed under the Apache License, Version 2.0 (the "License");
+         you may not use this file except in compliance with the License.
+         You may obtain a copy of the License at
+
+             http://www.apache.org/licenses/LICENSE-2.0
+
+         Unless required by applicable law or agreed to in writing, software
+         distributed under the License is distributed on an "AS IS" BASIS,
+         WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+         See the License for the specific language governing permissions and
+         limitations under the License.

package/dist/entropy.d.ts

@@ -0,0 +1,3 @@
+export declare function shannonEntropy(s: string): number;
+export declare function charsetClasses(s: string): number;
+//# sourceMappingURL=entropy.d.ts.map

package/dist/entropy.js

@@ -0,0 +1,33 @@
+export function shannonEntropy(s) {
+    if (s.length === 0) {
+        return 0;
+    }
+    const freq = new Map();
+    for (const ch of s) {
+        freq.set(ch, (freq.get(ch) ?? 0) + 1);
+    }
+    let entropy = 0;
+    const len = s.length;
+    for (const count of freq.values()) {
+        const p = count / len;
+        entropy -= p * Math.log2(p);
+    }
+    return entropy;
+}
+const LOWERCASE_RE = /[a-z]/;
+const UPPERCASE_RE = /[A-Z]/;
+const DIGIT_RE = /[0-9]/;
+const SYMBOL_RE = /[^a-zA-Z0-9]/;
+export function charsetClasses(s) {
+    let classes = 0;
+    if (LOWERCASE_RE.test(s))
+        classes += 1;
+    if (UPPERCASE_RE.test(s))
+        classes += 1;
+    if (DIGIT_RE.test(s))
+        classes += 1;
+    if (SYMBOL_RE.test(s))
+        classes += 1;
+    return classes;
+}
+//# sourceMappingURL=entropy.js.map

package/dist/exclusions.d.ts

@@ -0,0 +1,7 @@
+export interface ExclusionContext {
+    before: string;
+    after: string;
+}
+export declare function exclusionReason(candidate: string, context: ExclusionContext): string | null;
+export declare function isExcluded(candidate: string, context: ExclusionContext): boolean;
+//# sourceMappingURL=exclusions.d.ts.map

package/dist/exclusions.js

@@ -0,0 +1,196 @@
+import { WORDLIST_LOWER } from './wordlist.js';
+const WORDLIST_SET = new Set(WORDLIST_LOWER.trim().split('\n'));
+export function exclusionReason(candidate, context) {
+    if (isNonSecretAssignment(candidate))
+        return 'env-assignment-short-value';
+    if (isGitSha(candidate))
+        return 'git-sha';
+    if (isUUID(candidate))
+        return 'uuid';
+    if (isDigest(candidate, context))
+        return 'digest';
+    if (isDataUri(candidate, context))
+        return 'data-uri';
+    if (isFilesystemPath(candidate))
+        return 'filesystem-path';
+    if (isPlainUrl(candidate))
+        return 'plain-url';
+    if (isHexColour(candidate))
+        return 'hex-colour';
+    if (isIsoTimestamp(candidate))
+        return 'iso-timestamp';
+    if (isSemver(candidate))
+        return 'semver';
+    if (isRepeatedChar(candidate))
+        return 'repeated-char';
+    if (isDictionaryText(candidate))
+        return 'dictionary-text';
+    if (isCodeAdjacent(candidate, context))
+        return 'code-adjacent';
+    if (isNumeric(candidate))
+        return 'numeric';
+    if (isPredictableSequence(candidate))
+        return 'predictable-sequence';
+    if (hasCodeKeyword(candidate))
+        return 'code-keyword';
+    if (isNonLatinProse(candidate))
+        return 'non-latin-prose';
+    return null;
+}
+export function isExcluded(candidate, context) {
+    return exclusionReason(candidate, context) !== null;
+}
+/**
+ * `SCREAMING_SNAKE=value` where the value is too short to be a credential.
+ *
+ * Text around this product is dense with env-var assignments (`NODE_ENV=production`,
+ * `REACT_APP_FEATURE_FLAG_ENABLED=true`), and the whole `KEY=value` token is often
+ * long and mixed-case enough to clear the entropy bar on the strength of the key
+ * name alone. What matters is the value: anything shorter than the generic-candidate
+ * threshold cannot be a credential we would have detected on its own merits, so the
+ * assignment as a whole is not evidence of one.
+ *
+ * This deliberately does NOT suppress `OPENAI_API_KEY=sk-...`: real keys exceed the
+ * threshold, and prefixed ones are caught earlier by a high-confidence pattern that
+ * never consults the exclusion list.
+ */
+const MIN_GENERIC_LENGTH = 24;
+function isNonSecretAssignment(candidate) {
+    const match = /^[A-Z][A-Z0-9_]{2,}=(.*)$/.exec(candidate);
+    if (match === null)
+        return false;
+    const value = match[1];
+    if (value === undefined)
+        return false;
+    return value.length < MIN_GENERIC_LENGTH;
+}
+function isGitSha(candidate) {
+    const len = candidate.length;
+    const isLowerHex = /^[0-9a-f]+$/.test(candidate);
+    return isLowerHex && (len === 40 || len === 64 || (len >= 7 && len <= 12));
+}
+function isUUID(candidate) {
+    const uuidPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+    return uuidPattern.test(candidate);
+}
+function isDigest(candidate, context) {
+    if (candidate.startsWith('sha256:') || candidate.startsWith('sha256-') ||
+        candidate.startsWith('sha512-') || candidate.startsWith('sha1-') ||
+        candidate.startsWith('md5-')) {
+        return true;
+    }
+    if (context.before.endsWith('integrity=') || context.before.endsWith('integrity="')) {
+        return /^[A-Za-z0-9+/=]+$/.test(candidate);
+    }
+    return false;
+}
+function isDataUri(candidate, context) {
+    if (candidate.startsWith('data:'))
+        return true;
+    return /data:[^/]*\/[^;]*;base64,$/.test(context.before);
+}
+function isFilesystemPath(candidate) {
+    const hasPathSep = candidate.includes('/') || candidate.includes(String.fromCharCode(92));
+    if (!hasPathSep)
+        return false;
+    const hasCredential = /[a-z][a-z0-9+.-]*:\/\/[^@]*:.*@/.test(candidate);
+    return !hasCredential;
+}
+function isPlainUrl(candidate) {
+    try {
+        const url = new URL(candidate);
+        return (url.protocol === 'http:' || url.protocol === 'https:') &&
+            url.username === '' && url.password === '';
+    }
+    catch {
+        return false;
+    }
+}
+function isHexColour(candidate) {
+    return /^#[0-9a-fA-F]{3}(?:[0-9a-fA-F]{3})?$/.test(candidate) ||
+        /^#[0-9a-fA-F]{6}(?:[0-9a-fA-F]{2})?$/.test(candidate);
+}
+function isIsoTimestamp(candidate) {
+    const isoPattern = /^\d{4}-\d{2}-\d{2}(?:T\d{2}:\d{2}:\d{2}(?:\.\d{3})?(?:Z|[+-]\d{2}:\d{2})?)?$/;
+    return isoPattern.test(candidate);
+}
+function isSemver(candidate) {
+    const semverPattern = /^(?:\^|~|>=|<=|>|<)?(?:\d+)(?:\.\d+)?(?:\.\d+)?(?:-[a-zA-Z0-9.-]+)?(?:\+[a-zA-Z0-9.-]+)?$/;
+    return semverPattern.test(candidate);
+}
+function isRepeatedChar(candidate) {
+    return /^(.)\1+$/.test(candidate);
+}
+function isDictionaryText(candidate) {
+    const segments = splitOnBoundaries(candidate);
+    const longSegments = segments.map((s) => s.toLowerCase()).filter((s) => s.length >= 3);
+    if (longSegments.length < 2)
+        return false;
+    const inWordlist = longSegments.filter((s) => WORDLIST_SET.has(s)).length;
+    return inWordlist / longSegments.length >= 0.3;
+}
+function splitOnBoundaries(candidate) {
+    let result = candidate.split(/[^a-zA-Z]/);
+    result = result.flatMap((segment) => {
+        if (segment.length === 0)
+            return [];
+        const withBoundaries = segment.replace(/([a-z])([A-Z])/g, '$1|$2');
+        return withBoundaries.split('|');
+    });
+    return result.filter((s) => s.length > 0);
+}
+function isCodeAdjacent(candidate, context) {
+    const codeChars = /[{}();,:]/;
+    if (context.before.length > 0) {
+        const lastChar = context.before.at(-1);
+        if (lastChar !== undefined && codeChars.test(lastChar) && !/\s/.test(lastChar))
+            return true;
+    }
+    if (context.after.length > 0) {
+        const firstChar = context.after.at(0);
+        if (firstChar !== undefined && codeChars.test(firstChar) && !/\s/.test(firstChar))
+            return true;
+    }
+    return false;
+}
+function isNumeric(candidate) {
+    return /^\d+$/.test(candidate);
+}
+function isNonLatinProse(candidate) {
+    let nonAsciiCount = 0;
+    let hasAsciiDigit = false;
+    for (let i = 0; i < candidate.length; i++) {
+        const charCode = candidate.charCodeAt(i);
+        if (charCode > 127)
+            nonAsciiCount++;
+        if (charCode >= 48 && charCode <= 57)
+            hasAsciiDigit = true;
+    }
+    const nonAsciiRatio = nonAsciiCount / candidate.length;
+    return nonAsciiRatio >= 0.5 && !hasAsciiDigit;
+}
+function isPredictableSequence(candidate) {
+    if (/^a+b+c+d+e+f+g+h+i+j+k+l+m+n+o+p+q+r+s+t+u+v+w+x+y+z+/.test(candidate)) {
+        return true;
+    }
+    if (/^A+B+C+D+E+F+G+H+I+J+K+L+M+N+O+P+Q+R+S+T+U+V+W+X+Y+Z+/.test(candidate)) {
+        return true;
+    }
+    if (/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ/.test(candidate)) {
+        return true;
+    }
+    return false;
+}
+function hasCodeKeyword(candidate) {
+    const keywords = [
+        'interface', 'type', 'class', 'function', 'const', 'let', 'var',
+        'extends', 'implements', 'readonly', 'record', 'string', 'number',
+        'boolean', 'async', 'await', 'return', 'import', 'export',
+        'docker', 'compose', 'kubernetes', 'kubectl', 'production',
+        'development', 'staging', 'environment', 'authentication', 'provider',
+        'configuration', 'serialized', 'transaction', 'payload', 'metadata',
+    ];
+    const lower = candidate.toLowerCase();
+    return keywords.some(kw => lower.includes(kw));
+}
+//# sourceMappingURL=exclusions.js.map

package/dist/index.d.ts

@@ -0,0 +1,17 @@
+export interface Detection {
+    start: number;
+    end: number;
+    patternId: string;
+    providerId?: string;
+    confidence: 'high' | 'medium';
+    label: string;
+}
+export declare function detect(text: string): Detection[];
+export declare function redactDetections(text: string, detections: Detection[]): string;
+export declare function hasSecret(text: string): boolean;
+export { shannonEntropy, charsetClasses } from './entropy.js';
+export { allPatterns } from './patterns.js';
+export { isExcluded, exclusionReason } from './exclusions.js';
+export type { SecretPattern } from './patterns.js';
+export type { ExclusionContext } from './exclusions.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -0,0 +1,119 @@
+import { allPatterns } from './patterns.js';
+import { shannonEntropy, charsetClasses } from './entropy.js';
+import { isExcluded } from './exclusions.js';
+/** Minimum token length before the generic entropy heuristic will consider it. */
+const MIN_GENERIC_LENGTH = 24;
+const MIN_ENTROPY = 3.5;
+const MIN_CHARSET_CLASSES = 2;
+/**
+ * Characters that terminate a candidate token. Deliberately does not include
+ * `-`, `_`, `.`, `+`, `/` or `=` — those appear inside real credentials
+ * (base64, JWTs, connection strings) and splitting on them would shred a key
+ * into fragments that individually fall under the length threshold.
+ */
+const TOKEN_SPLIT_RE = /[\s"'`<>()[\]{},;|\\]+/;
+function scanPatterns(text) {
+    const out = [];
+    for (const pattern of allPatterns()) {
+        // allPatterns() hands back fresh RegExp objects, so lastIndex starts at 0.
+        let match;
+        while ((match = pattern.regex.exec(text)) !== null) {
+            const detection = {
+                start: match.index,
+                end: match.index + match[0].length,
+                patternId: pattern.id,
+                confidence: pattern.confidence,
+                label: pattern.label,
+            };
+            if (pattern.providerId !== undefined)
+                detection.providerId = pattern.providerId;
+            out.push(detection);
+            // Zero-length matches would spin forever.
+            if (match[0].length === 0)
+                pattern.regex.lastIndex += 1;
+        }
+    }
+    return out;
+}
+function scanGeneric(text, covered) {
+    const out = [];
+    let cursor = 0;
+    for (const raw of text.split(TOKEN_SPLIT_RE)) {
+        const start = text.indexOf(raw, cursor);
+        if (start < 0 || raw.length === 0) {
+            cursor += raw.length;
+            continue;
+        }
+        const end = start + raw.length;
+        cursor = end;
+        if (raw.length < MIN_GENERIC_LENGTH)
+            continue;
+        // Skip anything a high-confidence pattern already claimed; re-reporting it
+        // as a generic hit would only downgrade a precise label.
+        if (covered.some((d) => start < d.end && end > d.start))
+            continue;
+        if (shannonEntropy(raw) < MIN_ENTROPY)
+            continue;
+        if (charsetClasses(raw) < MIN_CHARSET_CLASSES)
+            continue;
+        if (isExcluded(raw, { before: text.slice(0, start), after: text.slice(end) }))
+            continue;
+        out.push({
+            start,
+            end,
+            patternId: 'generic:high-entropy',
+            confidence: 'medium',
+            label: 'high-entropy string',
+        });
+    }
+    return out;
+}
+/**
+ * Merge overlapping detections, preferring high confidence, then the longer
+ * span. Returns a sorted, non-overlapping list.
+ */
+function merge(detections) {
+    const rank = (d) => (d.confidence === 'high' ? 1 : 0);
+    const sorted = [...detections].sort((a, b) => {
+        if (a.start !== b.start)
+            return a.start - b.start;
+        if (rank(a) !== rank(b))
+            return rank(b) - rank(a);
+        return b.end - b.start - (a.end - a.start);
+    });
+    const out = [];
+    for (const d of sorted) {
+        const last = out[out.length - 1];
+        if (last === undefined || d.start >= last.end) {
+            out.push(d);
+            continue;
+        }
+        // Overlap: keep whichever wins on confidence, then on span length.
+        const better = rank(d) > rank(last) || (rank(d) === rank(last) && d.end - d.start > last.end - last.start);
+        if (better)
+            out[out.length - 1] = d;
+    }
+    return out;
+}
+export function detect(text) {
+    const high = scanPatterns(text);
+    const generic = scanGeneric(text, high);
+    return merge([...high, ...generic]);
+}
+export function redactDetections(text, detections) {
+    // Walk backwards so earlier offsets stay valid as we splice.
+    const ordered = [...detections].sort((a, b) => b.start - a.start);
+    let out = text;
+    for (const d of ordered) {
+        const token = d.confidence === 'high' ? `«redacted:${d.label}»` : '«redacted-secret»';
+        out = out.slice(0, d.start) + token + out.slice(d.end);
+    }
+    return out;
+}
+export function hasSecret(text) {
+    return detect(text).length > 0;
+}
+export { shannonEntropy, charsetClasses } from './entropy.js';
+export { allPatterns } from './patterns.js';
+export { isExcluded, exclusionReason } from './exclusions.js';
+//# sourceMappingURL=index.js.map

package/dist/patterns.d.ts

@@ -0,0 +1,9 @@
+export interface SecretPattern {
+    id: string;
+    regex: RegExp;
+    providerId?: string;
+    confidence: 'high' | 'medium';
+    label: string;
+}
+export declare function allPatterns(): SecretPattern[];
+//# sourceMappingURL=patterns.d.ts.map

package/dist/patterns.js

@@ -0,0 +1,72 @@
+import { allPrefixPatterns } from '@envseal/registry';
+function escapeRegExp(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+const SW = '[A-Za-z0-9_\\-]';
+const HAND_PATTERNS = [
+    { id: 'openai-project-key', label: 'OpenAI project API key', providerId: 'openai', source: `sk-proj-${SW}{20,}` },
+    { id: 'anthropic-api03', label: 'Anthropic API key', providerId: 'anthropic', source: `sk-ant-api03-${SW}{20,}` },
+    { id: 'github-pat', label: 'GitHub personal access token', providerId: 'github', source: `ghp_${SW}{30,}` },
+    { id: 'github-oauth', label: 'GitHub OAuth access token', providerId: 'github', source: `gho_${SW}{30,}` },
+    { id: 'github-user', label: 'GitHub user-to-server token', providerId: 'github', source: `ghu_${SW}{30,}` },
+    { id: 'github-app', label: 'GitHub server-to-server token', providerId: 'github', source: `ghs_${SW}{30,}` },
+    { id: 'github-fine-grained', label: 'GitHub fine-grained token', providerId: 'github', source: `github_pat_[A-Za-z0-9_]{40,}` },
+    { id: 'gitlab-pat', label: 'GitLab personal access token', providerId: 'gitlab', source: `glpat-${SW}{16,}` },
+    { id: 'aws-access-key', label: 'AWS access key ID', providerId: 'aws', source: `AKIA[0-9A-Z]{16}` },
+    { id: 'aws-qualified', label: 'AWS access key', providerId: 'aws', source: `(?:AWS_ACCESS_KEY_ID|AWS_SECRET_ACCESS_KEY)=${SW}{16,}` },
+    { id: 'sendgrid', label: 'SendGrid API key', providerId: 'sendgrid', source: `SG\\.[A-Za-z0-9_\\-]{20,}\\.[A-Za-z0-9_\\-]{20,}` },
+    { id: 'stripe-secret', label: 'Stripe secret key', providerId: 'stripe', source: `sk_live_${SW}{24,}` },
+    { id: 'stripe-publishable', label: 'Stripe publishable key', providerId: 'stripe', source: `pk_live_${SW}{24,}` },
+    { id: 'stripe-restricted', label: 'Stripe restricted key', providerId: 'stripe', source: `rk_live_${SW}{24,}` },
+    { id: 'google-api-key', label: 'Google API key', providerId: 'gcp', source: `AIza[0-9A-Za-z_\\-]{35}` },
+    { id: 'slack-bot', label: 'Slack bot token', providerId: 'slack', source: `xoxb-${SW}{20,}` },
+    { id: 'slack-user', label: 'Slack user token', providerId: 'slack', source: `xoxp-${SW}{20,}` },
+    { id: 'slack-app', label: 'Slack app-level token', providerId: 'slack', source: `xoxa-${SW}{16,}` },
+    { id: 'slack-app-env', label: 'Slack app env token', providerId: 'slack', source: `xapp-${SW}{24,}` },
+    { id: 'digitalocean', label: 'DigitalOcean API token', providerId: 'digitalocean', source: `dop_v1_[A-Za-z0-9_]{32,}` },
+    { id: 'shopify', label: 'Shopify access token', providerId: 'shopify', source: `shpat_[A-Za-z0-9_]{24,}` },
+    { id: 'npm', label: 'npm access token', providerId: 'npm', source: `npm_${SW}{16,}` },
+    { id: 'huggingface', label: 'Hugging Face token', providerId: 'huggingface', source: `hf_[A-Za-z0-9_]{16,}` },
+    { id: 'groq', label: 'Groq API key', providerId: 'groq', source: `gsk_[A-Za-z0-9_]{24,}` },
+    { id: 'openrouter-v1', label: 'OpenRouter v1 key', providerId: 'openrouter', source: `sk-or-v1-${SW}{32,}` },
+    { id: 'resend', label: 'Resend API key', providerId: 'resend', source: `re_[A-Za-z0-9]{8}_[A-Za-z0-9]{16,}` },
+    { id: 'private-key', label: 'Private key', source: `-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----` },
+    { id: 'jwt', label: 'JWT token', source: `eyJ[A-Za-z0-9_\\-]+\\.[A-Za-z0-9_\\-]+\\.[A-Za-z0-9_\\-]+` },
+    { id: 'conn-string', label: 'database connection string', source: `(?:postgres|postgresql|mysql|mongodb(?:\\+srv)?|redis|amqp)://[^:\\s/]+:[^@\\s]+@` },
+];
+export function allPatterns() {
+    const patterns = [];
+    for (const entry of allPrefixPatterns()) {
+        if (entry.prefix === undefined) {
+            continue;
+        }
+        // Two guards, both load-bearing for registry-derived patterns, which are
+        // synthesised from a bare prefix and so are far weaker than the hand-written
+        // ones:
+        //
+        // 1. A leading boundary. Without it a short prefix matches mid-identifier —
+        //    Twilio's `AC` matched inside `REACT_APP_FEATURE_FLAG_ENABLED`, turning
+        //    an ordinary env-var name into a "high confidence" credential hit.
+        // 2. An alphanumeric-only body. Real key material is random alphanumerics;
+        //    SCREAMING_SNAKE identifiers are not. Excluding `_` and `-` from the body
+        //    stops the pattern from running through word separators.
+        patterns.push({
+            id: `registry:${entry.providerId}:${entry.envVar}`,
+            regex: new RegExp(`(?<![A-Za-z0-9_-])${escapeRegExp(entry.prefix)}[A-Za-z0-9]{16,}`, 'g'),
+            providerId: entry.providerId,
+            confidence: 'high',
+            label: `${entry.providerId} ${entry.envVar}`,
+        });
+    }
+    for (const hp of HAND_PATTERNS) {
+        patterns.push({
+            id: hp.id,
+            regex: new RegExp(hp.source, 'g'),
+            providerId: hp.providerId,
+            confidence: 'high',
+            label: hp.label,
+        });
+    }
+    return patterns;
+}
+//# sourceMappingURL=patterns.js.map