@grafana/plugin-ui 0.17.3 → 0.17.4

package/dist/esm/secret-scanner/core/scanCode.js

@@ -0,0 +1,70 @@
+import { iterateStringLiterals } from './detection/literals.js';
+import { isPlaceholder } from './detection/placeholders.js';
+import { createPositionResolver } from './detection/position.js';
+export { offsetToPosition } from './detection/position.js';
+import { detectEmbedded } from './detection/embedded.js';
+import { detectHighEntropy } from './detection/highEntropy.js';
+import { detectFromName } from './detection/nameDetector.js';
+import { memoizeLatest } from './memoizeLatest.js';
+
+function scan$1(script) {
+  var _a;
+  const findings = [];
+  const positionAt = createPositionResolver(script);
+  for (const {
+    body,
+    literalStart,
+    literalEnd,
+    contentStart,
+    contentEnd,
+    kind,
+    name,
+    embeddedOnly
+  } of iterateStringLiterals(script)) {
+    const literal = { start: literalStart, end: literalEnd };
+    const embedded = detectEmbedded(script.slice(contentStart, contentEnd));
+    if (embedded) {
+      const spansWholeLiteral = !embeddedOnly && embedded.index === 0 && embedded.length === contentEnd - contentStart;
+      const secretStart = contentStart + embedded.index;
+      const range = { start: secretStart, end: secretStart + embedded.length };
+      const { line, column } = positionAt(range.start);
+      findings.push({
+        id: `${range.start}-${embedded.type}`,
+        type: embedded.type,
+        label: embedded.label,
+        confidence: embedded.confidence,
+        secret: embedded.secret,
+        range,
+        line,
+        column,
+        literal,
+        rewrite: spansWholeLiteral ? "literal" : kind === "template" ? "template-interpolation" : "none"
+      });
+      continue;
+    }
+    if (!embeddedOnly && body.length > 0 && !isPlaceholder(body)) {
+      const detected = (_a = detectHighEntropy(body)) != null ? _a : detectFromName(body, name);
+      if (detected) {
+        const range = { start: contentStart, end: contentEnd };
+        const { line, column } = positionAt(range.start);
+        findings.push({
+          id: `${range.start}-${detected.type}`,
+          ...detected,
+          range,
+          line,
+          column,
+          literal,
+          rewrite: "literal"
+        });
+      }
+    }
+  }
+  return findings;
+}
+function createCodeScanner() {
+  return memoizeLatest(scan$1);
+}
+const scanCode = createCodeScanner();
+
+export { createCodeScanner, scanCode };
+//# sourceMappingURL=scanCode.js.map

package/dist/esm/secret-scanner/core/scanCode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanCode.js","sources":["../../../../src/secret-scanner/core/scanCode.ts"],"sourcesContent":["/**\n * Code-first scanner: flags likely hardcoded secrets in a script.\n *\n * String-literal aware (AST-based) rather than raw-text, so reported ranges line\n * up with what the user sees and a rewrite can edit the original text.\n *\n * For plain-text outside a literal, use `scanText`.\n *\n * Orchestration only; the detectors live in `./detection`.\n */\n\nimport { iterateStringLiterals } from './detection/literals';\nimport { isPlaceholder } from './detection/placeholders';\nimport { createPositionResolver } from './detection/position';\nimport { detectEmbedded } from './detection/embedded';\nimport { detectHighEntropy } from './detection/highEntropy';\nimport { detectFromName } from './detection/nameDetector';\nimport type { SecretFinding } from './detection/types';\nimport { memoizeLatest } from './memoizeLatest';\n\nfunction scan(script: string): SecretFinding[] {\n  const findings: SecretFinding[] = [];\n  const positionAt = createPositionResolver(script);\n\n  for (const {\n    body,\n    literalStart,\n    literalEnd,\n    contentStart,\n    contentEnd,\n    kind,\n    name,\n    embeddedOnly,\n  } of iterateStringLiterals(script)) {\n    const literal = { start: literalStart, end: literalEnd };\n\n    const embedded = detectEmbedded(script.slice(contentStart, contentEnd));\n    if (embedded) {\n      // A match covering the whole content means the literal *is* the secret\n      const spansWholeLiteral = !embeddedOnly && embedded.index === 0 && embedded.length === contentEnd - contentStart;\n      const secretStart = contentStart + embedded.index;\n      const range = { start: secretStart, end: secretStart + embedded.length };\n      const { line, column } = positionAt(range.start);\n\n      findings.push({\n        id: `${range.start}-${embedded.type}`,\n        type: embedded.type,\n        label: embedded.label,\n        confidence: embedded.confidence,\n        secret: embedded.secret,\n        range,\n        line,\n        column,\n        literal,\n        rewrite: spansWholeLiteral ? 'literal' : kind === 'template' ? 'template-interpolation' : 'none',\n      });\n      continue;\n    }\n\n    if (!embeddedOnly && body.length > 0 && !isPlaceholder(body)) {\n      const detected = detectHighEntropy(body) ?? detectFromName(body, name);\n      if (detected) {\n        const range = { start: contentStart, end: contentEnd };\n        const { line, column } = positionAt(range.start);\n        findings.push({\n          id: `${range.start}-${detected.type}`,\n          ...detected,\n          range,\n          line,\n          column,\n          literal,\n          rewrite: 'literal',\n        });\n      }\n    }\n  }\n\n  return findings;\n}\n\n/**\n * A code scanner with its own memo. Prefer this to the shared {@link scanCode}\n * when more than one surface scans independently — see `memoizeLatest`.\n */\nexport function createCodeScanner(): (script: string) => SecretFinding[] {\n  return memoizeLatest(scan);\n}\n\n/** Shared code scanner, for a host with a single scanning surface. */\nexport const scanCode = createCodeScanner();\n\nexport { offsetToPosition } from './detection/position';\nexport { shannonEntropy } from './detection/entropy';\nexport type { SecretFinding, SecretConfidence, SecretRange, SecretRewrite } from './detection/types';\n"],"names":["scan"],"mappings":";;;;;;;;;AAoBA,SAASA,OAAK,MAAA,EAAiC;AApB/C,EAAA,IAAA,EAAA;AAqBE,EAAA,MAAM,WAA4B,EAAC;AACnC,EAAA,MAAM,UAAA,GAAa,uBAAuB,MAAM,CAAA;AAEhD,EAAA,KAAA,MAAW;AAAA,IACT,IAAA;AAAA,IACA,YAAA;AAAA,IACA,UAAA;AAAA,IACA,YAAA;AAAA,IACA,UAAA;AAAA,IACA,IAAA;AAAA,IACA,IAAA;AAAA,IACA;AAAA,GACF,IAAK,qBAAA,CAAsB,MAAM,CAAA,EAAG;AAClC,IAAA,MAAM,OAAA,GAAU,EAAE,KAAA,EAAO,YAAA,EAAc,KAAK,UAAA,EAAW;AAEvD,IAAA,MAAM,WAAW,cAAA,CAAe,MAAA,CAAO,KAAA,CAAM,YAAA,EAAc,UAAU,CAAC,CAAA;AACtE,IAAA,IAAI,QAAA,EAAU;AAEZ,MAAA,MAAM,iBAAA,GAAoB,CAAC,YAAA,IAAgB,QAAA,CAAS,UAAU,CAAA,IAAK,QAAA,CAAS,WAAW,UAAA,GAAa,YAAA;AACpG,MAAA,MAAM,WAAA,GAAc,eAAe,QAAA,CAAS,KAAA;AAC5C,MAAA,MAAM,QAAQ,EAAE,KAAA,EAAO,aAAa,GAAA,EAAK,WAAA,GAAc,SAAS,MAAA,EAAO;AACvE,MAAA,MAAM,EAAE,IAAA,EAAM,MAAA,EAAO,GAAI,UAAA,CAAW,MAAM,KAAK,CAAA;AAE/C,MAAA,QAAA,CAAS,IAAA,CAAK;AAAA,QACZ,IAAI,CAAA,EAAG,KAAA,CAAM,KAAK,CAAA,CAAA,EAAI,SAAS,IAAI,CAAA,CAAA;AAAA,QACnC,MAAM,QAAA,CAAS,IAAA;AAAA,QACf,OAAO,QAAA,CAAS,KAAA;AAAA,QAChB,YAAY,QAAA,CAAS,UAAA;AAAA,QACrB,QAAQ,QAAA,CAAS,MAAA;AAAA,QACjB,KAAA;AAAA,QACA,IAAA;AAAA,QACA,MAAA;AAAA,QACA,OAAA;AAAA,QACA,OAAA,EAAS,iBAAA,GAAoB,SAAA,GAAY,IAAA,KAAS,aAAa,wBAAA,GAA2B;AAAA,OAC3F,CAAA;AACD,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,CAAC,gBAAgB,IAAA,CAAK,MAAA,GAAS,KAAK,CAAC,aAAA,CAAc,IAAI,CAAA,EAAG;AAC5D,MAAA,MAAM,YAAW,EAAA,GAAA,iBAAA,CAAkB,IAAI,MAAtB,IAAA,GAAA,EAAA,GAA2B,cAAA,CAAe,MAAM,IAAI,CAAA;AACrE,MAAA,IAAI,QAAA,EAAU;AACZ,QAAA,MAAM,KAAA,GAAQ,EAAE,KAAA,EAAO,YAAA,EAAc,KAAK,UAAA,EAAW;AACrD,QAAA,MAAM,EAAE,IAAA,EAAM,MAAA,EAAO,GAAI,UAAA,CAAW,MAAM,KAAK,CAAA;AAC/C,QAAA,QAAA,CAAS,IAAA,CAAK;AAAA,UACZ,IAAI,CAAA,EAAG,KAAA,CAAM,KAAK,CAAA,CAAA,EAAI,SAAS,IAAI,CAAA,CAAA;AAAA,UACnC,GAAG,QAAA;AAAA,UACH,KAAA;AAAA,UACA,IAAA;AAAA,UACA,MAAA;AAAA,UACA,OAAA;AAAA,UACA,OAAA,EAAS;AAAA,SACV,CAAA;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO,QAAA;AACT;AAMO,SAAS,iBAAA,GAAyD;AACvE,EAAA,OAAO,cAAcA,MAAI,CAAA;AAC3B;AAGO,MAAM,WAAW,iBAAA;;;;"}

package/dist/esm/secret-scanner/core/scanText.js

@@ -0,0 +1,51 @@
+import { findAllEmbedded } from './detection/embedded.js';
+import { detectHighEntropy } from './detection/highEntropy.js';
+import { isPlaceholder } from './detection/placeholders.js';
+import { createPositionResolver } from './detection/position.js';
+import { memoizeLatest } from './memoizeLatest.js';
+
+const HIGH_ENTROPY_TOKEN = /[A-Za-z0-9+/=]{24,}/g;
+function highEntropyMatches(text) {
+  const matches = [];
+  HIGH_ENTROPY_TOKEN.lastIndex = 0;
+  let m;
+  while ((m = HIGH_ENTROPY_TOKEN.exec(text)) !== null) {
+    const token = m[0];
+    if (isPlaceholder(token)) {
+      continue;
+    }
+    const detected = detectHighEntropy(token);
+    if (detected) {
+      matches.push({ ...detected, index: m.index, length: token.length });
+    }
+  }
+  return matches;
+}
+function scan(text) {
+  const ruleMatches = findAllEmbedded(text);
+  const overlapsRuleMatch = (m) => ruleMatches.some((rule) => m.index < rule.index + rule.length && rule.index < m.index + m.length);
+  const matches = [...ruleMatches, ...highEntropyMatches(text).filter((m) => !overlapsRuleMatch(m))].sort(
+    (a, b) => a.index - b.index
+  );
+  const positionAt = createPositionResolver(text);
+  return matches.map((match) => {
+    const { line, column } = positionAt(match.index);
+    return {
+      id: `${match.index}-${match.type}`,
+      type: match.type,
+      label: match.label,
+      confidence: match.confidence,
+      secret: match.secret,
+      range: { start: match.index, end: match.index + match.length },
+      line,
+      column
+    };
+  });
+}
+function createTextScanner() {
+  return memoizeLatest(scan);
+}
+const scanText = createTextScanner();
+
+export { createTextScanner, scanText };
+//# sourceMappingURL=scanText.js.map

package/dist/esm/secret-scanner/core/scanText.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanText.js","sources":["../../../../src/secret-scanner/core/scanText.ts"],"sourcesContent":["/**\n * Text-first counterpart to {@link scanCode}: runs the same value-shape\n * detectors over raw text rather than over parsed string literals, which is what\n * a natural-language surface (a prompt, a description) needs — there the\n * credential is typed inline, not quoted as a JS string.\n *\n */\nimport { type EmbeddedMatch, findAllEmbedded } from './detection/embedded';\nimport { detectHighEntropy } from './detection/highEntropy';\nimport { isPlaceholder } from './detection/placeholders';\nimport { createPositionResolver } from './detection/position';\nimport type { SecretFinding } from './detection/types';\nimport { memoizeLatest } from './memoizeLatest';\n\n// A run of high-entropy-alphabet characters, long enough to be a secret blob.\n// The alphabet mirrors `detectHighEntropy` (no `-`/`_`, so kebab/snake config\n// and identifiers aren't split into candidates), and the quotes/whitespace/\n// punctuation around a token in prose delimit it.\nconst HIGH_ENTROPY_TOKEN = /[A-Za-z0-9+/=]{24,}/g;\n\nfunction highEntropyMatches(text: string): EmbeddedMatch[] {\n  const matches: EmbeddedMatch[] = [];\n  HIGH_ENTROPY_TOKEN.lastIndex = 0;\n  let m: RegExpExecArray | null;\n  while ((m = HIGH_ENTROPY_TOKEN.exec(text)) !== null) {\n    const token = m[0];\n    if (isPlaceholder(token)) {\n      continue;\n    }\n    const detected = detectHighEntropy(token);\n    if (detected) {\n      matches.push({ ...detected, index: m.index, length: token.length });\n    }\n  }\n  return matches;\n}\n\nfunction scan(text: string): SecretFinding[] {\n  const ruleMatches = findAllEmbedded(text);\n  const overlapsRuleMatch = (m: EmbeddedMatch) =>\n    ruleMatches.some((rule) => m.index < rule.index + rule.length && rule.index < m.index + m.length);\n\n  const matches = [...ruleMatches, ...highEntropyMatches(text).filter((m) => !overlapsRuleMatch(m))].sort(\n    (a, b) => a.index - b.index\n  );\n\n  const positionAt = createPositionResolver(text);\n  return matches.map((match): SecretFinding => {\n    const { line, column } = positionAt(match.index);\n    return {\n      id: `${match.index}-${match.type}`,\n      type: match.type,\n      label: match.label,\n      confidence: match.confidence,\n      secret: match.secret,\n      range: { start: match.index, end: match.index + match.length },\n      line,\n      column,\n    };\n  });\n}\n\n/**\n * A text scanner with its own memo. Prefer this to the shared {@link scanText}\n * when more than one surface scans independently — see `memoizeLatest`.\n */\nexport function createTextScanner(): (text: string) => SecretFinding[] {\n  return memoizeLatest(scan);\n}\n\n/** Shared text scanner, for a host with a single scanning surface. */\nexport const scanText = createTextScanner();\n"],"names":[],"mappings":";;;;;;AAkBA,MAAM,kBAAA,GAAqB,sBAAA;AAE3B,SAAS,mBAAmB,IAAA,EAA+B;AACzD,EAAA,MAAM,UAA2B,EAAC;AAClC,EAAA,kBAAA,CAAmB,SAAA,GAAY,CAAA;AAC/B,EAAA,IAAI,CAAA;AACJ,EAAA,OAAA,CAAQ,CAAA,GAAI,kBAAA,CAAmB,IAAA,CAAK,IAAI,OAAO,IAAA,EAAM;AACnD,IAAA,MAAM,KAAA,GAAQ,EAAE,CAAC,CAAA;AACjB,IAAA,IAAI,aAAA,CAAc,KAAK,CAAA,EAAG;AACxB,MAAA;AAAA,IACF;AACA,IAAA,MAAM,QAAA,GAAW,kBAAkB,KAAK,CAAA;AACxC,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,OAAA,CAAQ,IAAA,CAAK,EAAE,GAAG,QAAA,EAAU,KAAA,EAAO,EAAE,KAAA,EAAO,MAAA,EAAQ,KAAA,CAAM,MAAA,EAAQ,CAAA;AAAA,IACpE;AAAA,EACF;AACA,EAAA,OAAO,OAAA;AACT;AAEA,SAAS,KAAK,IAAA,EAA+B;AAC3C,EAAA,MAAM,WAAA,GAAc,gBAAgB,IAAI,CAAA;AACxC,EAAA,MAAM,oBAAoB,CAAC,CAAA,KACzB,YAAY,IAAA,CAAK,CAAC,SAAS,CAAA,CAAE,KAAA,GAAQ,IAAA,CAAK,KAAA,GAAQ,KAAK,MAAA,IAAU,IAAA,CAAK,QAAQ,CAAA,CAAE,KAAA,GAAQ,EAAE,MAAM,CAAA;AAElG,EAAA,MAAM,UAAU,CAAC,GAAG,WAAA,EAAa,GAAG,mBAAmB,IAAI,CAAA,CAAE,MAAA,CAAO,CAAC,MAAM,CAAC,iBAAA,CAAkB,CAAC,CAAC,CAAC,CAAA,CAAE,IAAA;AAAA,IACjG,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,QAAQ,CAAA,CAAE;AAAA,GACxB;AAEA,EAAA,MAAM,UAAA,GAAa,uBAAuB,IAAI,CAAA;AAC9C,EAAA,OAAO,OAAA,CAAQ,GAAA,CAAI,CAAC,KAAA,KAAyB;AAC3C,IAAA,MAAM,EAAE,IAAA,EAAM,MAAA,EAAO,GAAI,UAAA,CAAW,MAAM,KAAK,CAAA;AAC/C,IAAA,OAAO;AAAA,MACL,IAAI,CAAA,EAAG,KAAA,CAAM,KAAK,CAAA,CAAA,EAAI,MAAM,IAAI,CAAA,CAAA;AAAA,MAChC,MAAM,KAAA,CAAM,IAAA;AAAA,MACZ,OAAO,KAAA,CAAM,KAAA;AAAA,MACb,YAAY,KAAA,CAAM,UAAA;AAAA,MAClB,QAAQ,KAAA,CAAM,MAAA;AAAA,MACd,KAAA,EAAO,EAAE,KAAA,EAAO,KAAA,CAAM,OAAO,GAAA,EAAK,KAAA,CAAM,KAAA,GAAQ,KAAA,CAAM,MAAA,EAAO;AAAA,MAC7D,IAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF,CAAC,CAAA;AACH;AAMO,SAAS,iBAAA,GAAuD;AACrE,EAAA,OAAO,cAAc,IAAI,CAAA;AAC3B;AAGO,MAAM,WAAW,iBAAA;;;;"}

package/dist/esm/secret-scanner/core/secretScanner.utils.js

@@ -0,0 +1,33 @@
+const MAX_NAME_LENGTH = 253;
+function suggestSecretName(finding, existingNames = []) {
+  const base = `${finding.type}-secret`.toLowerCase().replace(/[^a-z0-9.-]+/g, "-").replace(/^[^a-z0-9]+/, "").replace(/-+$/, "").slice(0, MAX_NAME_LENGTH);
+  const taken = new Set(existingNames);
+  if (!taken.has(base)) {
+    return base;
+  }
+  let suffix = 2;
+  while (taken.has(`${base}-${suffix}`)) {
+    suffix++;
+  }
+  return `${base}-${suffix}`;
+}
+function maskSecret(secret) {
+  if (secret.length <= 8) {
+    return "\u2022".repeat(secret.length);
+  }
+  return `${secret.slice(0, 3)}${"\u2022".repeat(4)}${secret.slice(-2)}`;
+}
+function getFindingSignature(finding) {
+  return `${finding.type}.${fnv1aHash(`${finding.type}:${finding.secret}`)}`;
+}
+function fnv1aHash(value) {
+  let hash = 2166136261;
+  for (let i = 0; i < value.length; i++) {
+    hash ^= value.charCodeAt(i);
+    hash = Math.imul(hash, 16777619);
+  }
+  return (hash >>> 0).toString(16);
+}
+
+export { getFindingSignature, maskSecret, suggestSecretName };
+//# sourceMappingURL=secretScanner.utils.js.map

package/dist/esm/secret-scanner/core/secretScanner.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretScanner.utils.js","sources":["../../../../src/secret-scanner/core/secretScanner.utils.ts"],"sourcesContent":["import type { SecretFinding } from './detection/types';\n\nconst MAX_NAME_LENGTH = 253;\n\n/**\n * Suggests a Secrets-store-compatible name for a finding. Secret names must be\n * lowercase and may only contain letters, numbers, dashes and periods (see\n * `secretSchema`), so we derive the suggestion from the detector type and\n * de-duplicate against existing names.\n */\nexport function suggestSecretName(finding: Pick<SecretFinding, 'type'>, existingNames: string[] = []): string {\n  const base = `${finding.type}-secret`\n    .toLowerCase()\n    .replace(/[^a-z0-9.-]+/g, '-')\n    .replace(/^[^a-z0-9]+/, '')\n    .replace(/-+$/, '')\n    .slice(0, MAX_NAME_LENGTH);\n\n  const taken = new Set(existingNames);\n  if (!taken.has(base)) {\n    return base;\n  }\n\n  let suffix = 2;\n  while (taken.has(`${base}-${suffix}`)) {\n    suffix++;\n  }\n  return `${base}-${suffix}`;\n}\n\nexport function maskSecret(secret: string): string {\n  if (secret.length <= 8) {\n    return '•'.repeat(secret.length);\n  }\n  return `${secret.slice(0, 3)}${'•'.repeat(4)}${secret.slice(-2)}`;\n}\n\n/**\n * Stable signature for remembering an \"ignore\" choice across edits and reloads.\n * Hashing (FNV-1a) keeps the plaintext out of local storage, and deriving it\n * from content rather than position keeps it stable when the secret moves —\n * unlike the finding `id`.\n */\nexport function getFindingSignature(finding: Pick<SecretFinding, 'type' | 'secret'>): string {\n  return `${finding.type}.${fnv1aHash(`${finding.type}:${finding.secret}`)}`;\n}\n\nfunction fnv1aHash(value: string): string {\n  let hash = 0x811c9dc5;\n  for (let i = 0; i < value.length; i++) {\n    hash ^= value.charCodeAt(i);\n    hash = Math.imul(hash, 0x01000193);\n  }\n  return (hash >>> 0).toString(16);\n}\n"],"names":[],"mappings":"AAEA,MAAM,eAAA,GAAkB,GAAA;AAQjB,SAAS,iBAAA,CAAkB,OAAA,EAAsC,aAAA,GAA0B,EAAC,EAAW;AAC5G,EAAA,MAAM,IAAA,GAAO,GAAG,OAAA,CAAQ,IAAI,UACzB,WAAA,EAAY,CACZ,QAAQ,eAAA,EAAiB,GAAG,EAC5B,OAAA,CAAQ,aAAA,EAAe,EAAE,CAAA,CACzB,OAAA,CAAQ,OAAO,EAAE,CAAA,CACjB,KAAA,CAAM,CAAA,EAAG,eAAe,CAAA;AAE3B,EAAA,MAAM,KAAA,GAAQ,IAAI,GAAA,CAAI,aAAa,CAAA;AACnC,EAAA,IAAI,CAAC,KAAA,CAAM,GAAA,CAAI,IAAI,CAAA,EAAG;AACpB,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,OAAO,MAAM,GAAA,CAAI,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,MAAM,EAAE,CAAA,EAAG;AACrC,IAAA,MAAA,EAAA;AAAA,EACF;AACA,EAAA,OAAO,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,MAAM,CAAA,CAAA;AAC1B;AAEO,SAAS,WAAW,MAAA,EAAwB;AACjD,EAAA,IAAI,MAAA,CAAO,UAAU,CAAA,EAAG;AACtB,IAAA,OAAO,QAAA,CAAI,MAAA,CAAO,MAAA,CAAO,MAAM,CAAA;AAAA,EACjC;AACA,EAAA,OAAO,CAAA,EAAG,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,EAAG,QAAA,CAAI,MAAA,CAAO,CAAC,CAAC,CAAA,EAAG,MAAA,CAAO,KAAA,CAAM,EAAE,CAAC,CAAA,CAAA;AACjE;AAQO,SAAS,oBAAoB,OAAA,EAAyD;AAC3F,EAAA,OAAO,CAAA,EAAG,OAAA,CAAQ,IAAI,CAAA,CAAA,EAAI,SAAA,CAAU,CAAA,EAAG,OAAA,CAAQ,IAAI,CAAA,CAAA,EAAI,OAAA,CAAQ,MAAM,CAAA,CAAE,CAAC,CAAA,CAAA;AAC1E;AAEA,SAAS,UAAU,KAAA,EAAuB;AACxC,EAAA,IAAI,IAAA,GAAO,UAAA;AACX,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACrC,IAAA,IAAA,IAAQ,KAAA,CAAM,WAAW,CAAC,CAAA;AAC1B,IAAA,IAAA,GAAO,IAAA,CAAK,IAAA,CAAK,IAAA,EAAM,QAAU,CAAA;AAAA,EACnC;AACA,EAAA,OAAA,CAAQ,IAAA,KAAS,CAAA,EAAG,QAAA,CAAS,EAAE,CAAA;AACjC;;;;"}

package/dist/esm/secret-scanner/monaco/installSecretScanner.js

@@ -0,0 +1,117 @@
+import { createCodeScanner } from '../core/scanCode.js';
+import '../core/detection/ruleDetectors.js';
+import { DEFAULT_DEBOUNCE_MS } from '../core/constants.js';
+
+const SECRET_MARKER_CODE = "hardcoded-secret";
+const MARKER_OWNER = "secret-scanner";
+const DEFAULT_LANGUAGES = ["typescript", "javascript"];
+const DEFAULT_QUICK_FIX_TITLE = "Move to Secrets Manager";
+function installSecretScanner(monaco, editor, options = {}) {
+  var _a, _b, _c, _d, _e;
+  const languages = (_a = options.languages) != null ? _a : DEFAULT_LANGUAGES;
+  const scan = (_b = options.scan) != null ? _b : createCodeScanner();
+  const debounceMs = (_c = options.debounceMs) != null ? _c : DEFAULT_DEBOUNCE_MS;
+  const markerMessage = (_d = options.markerMessage) != null ? _d : ((finding) => `Possible hardcoded secret (${finding.label}). Consider moving it to a managed secret.`);
+  const disposables = [];
+  const updateMarkers = () => {
+    const model = editor.getModel();
+    if (model === null) {
+      return;
+    }
+    if (options.enabled === false) {
+      monaco.editor.setModelMarkers(model, MARKER_OWNER, []);
+      return;
+    }
+    const script = model.getValue();
+    const markers = scan(script).map((finding) => {
+      const start = model.getPositionAt(finding.range.start);
+      const end = model.getPositionAt(finding.range.end);
+      return {
+        severity: monaco.MarkerSeverity.Warning,
+        message: markerMessage(finding),
+        code: SECRET_MARKER_CODE,
+        startLineNumber: start.lineNumber,
+        startColumn: start.column,
+        endLineNumber: end.lineNumber,
+        endColumn: end.column
+      };
+    });
+    monaco.editor.setModelMarkers(model, MARKER_OWNER, markers);
+  };
+  let debounceTimer;
+  const cancelScheduled = () => {
+    if (debounceTimer !== void 0) {
+      clearTimeout(debounceTimer);
+      debounceTimer = void 0;
+    }
+  };
+  const scheduleUpdate = () => {
+    cancelScheduled();
+    debounceTimer = setTimeout(() => {
+      debounceTimer = void 0;
+      updateMarkers();
+    }, debounceMs);
+  };
+  const updateNow = () => {
+    cancelScheduled();
+    updateMarkers();
+  };
+  updateMarkers();
+  disposables.push(editor.onDidChangeModelContent(() => scheduleUpdate()));
+  disposables.push(editor.onDidChangeModel(() => updateNow()));
+  disposables.push({ dispose: cancelScheduled });
+  if (options.enabled !== false && options.quickFix) {
+    const runQuickFix = options.quickFix.run;
+    const title = (_e = options.quickFix.title) != null ? _e : DEFAULT_QUICK_FIX_TITLE;
+    const commandId = editor.addCommand(0, (_accessor, finding) => runQuickFix(finding));
+    if (commandId) {
+      for (const language of languages) {
+        disposables.push(
+          monaco.languages.registerCodeActionProvider(language, {
+            provideCodeActions(model, _range, context) {
+              const secretMarkers = context.markers.filter((marker) => marker.code === SECRET_MARKER_CODE);
+              if (secretMarkers.length === 0) {
+                return { actions: [], dispose() {
+                } };
+              }
+              const findings = scan(model.getValue());
+              const actions = secretMarkers.flatMap((marker) => {
+                const markerOffset = model.getOffsetAt({
+                  lineNumber: marker.startLineNumber,
+                  column: marker.startColumn
+                });
+                const finding = findings.find((candidate) => candidate.range.start === markerOffset);
+                if (finding === void 0) {
+                  return [];
+                }
+                return [
+                  {
+                    title,
+                    kind: "quickfix",
+                    diagnostics: [marker],
+                    command: { id: commandId, title, arguments: [finding] }
+                  }
+                ];
+              });
+              return { actions, dispose() {
+              } };
+            }
+          })
+        );
+      }
+    }
+  }
+  return {
+    refresh: updateNow,
+    dispose() {
+      disposables.forEach((disposable) => disposable.dispose());
+      const model = editor.getModel();
+      if (model !== null) {
+        monaco.editor.setModelMarkers(model, MARKER_OWNER, []);
+      }
+    }
+  };
+}
+
+export { SECRET_MARKER_CODE, installSecretScanner };
+//# sourceMappingURL=installSecretScanner.js.map

package/dist/esm/secret-scanner/monaco/installSecretScanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"installSecretScanner.js","sources":["../../../../src/secret-scanner/monaco/installSecretScanner.ts"],"sourcesContent":["import { createCodeScanner, DEFAULT_DEBOUNCE_MS, type SecretFinding } from '../core/index';\nimport type { IStandaloneCodeEditor, MonacoNamespace } from './types';\n\n/** Marker `code` identifying the scanner's diagnostics for the quick fix. */\nexport const SECRET_MARKER_CODE = 'hardcoded-secret';\n\nconst MARKER_OWNER = 'secret-scanner';\nconst DEFAULT_LANGUAGES = ['typescript', 'javascript'];\nconst DEFAULT_QUICK_FIX_TITLE = 'Move to Secrets Manager';\n\nexport interface InstallSecretScannerOptions {\n  languages?: string[];\n  enabled?: boolean;\n  markerMessage?: (finding: SecretFinding) => string;\n  quickFix?: { title?: string; run: (finding: SecretFinding) => void };\n  scan?: (code: string) => SecretFinding[];\n  debounceMs?: number;\n}\n\nexport interface SecretScannerInstallation {\n  refresh(): void;\n  dispose(): void;\n}\n\n/**\n * Gutter markers for detected secrets plus an optional \"Move to Secrets Manager\"\n * quick fix.\n */\nexport function installSecretScanner(\n  monaco: MonacoNamespace,\n  editor: IStandaloneCodeEditor,\n  options: InstallSecretScannerOptions = {}\n): SecretScannerInstallation {\n  const languages = options.languages ?? DEFAULT_LANGUAGES;\n  const scan = options.scan ?? createCodeScanner();\n  const debounceMs = options.debounceMs ?? DEFAULT_DEBOUNCE_MS;\n  const markerMessage =\n    options.markerMessage ??\n    ((finding: SecretFinding) =>\n      `Possible hardcoded secret (${finding.label}). Consider moving it to a managed secret.`);\n\n  const disposables: Array<{ dispose(): void }> = [];\n\n  const updateMarkers = () => {\n    const model = editor.getModel();\n    if (model === null) {\n      return;\n    }\n\n    if (options.enabled === false) {\n      monaco.editor.setModelMarkers(model, MARKER_OWNER, []);\n      return;\n    }\n\n    const script = model.getValue();\n    const markers = scan(script).map((finding) => {\n      const start = model.getPositionAt(finding.range.start);\n      const end = model.getPositionAt(finding.range.end);\n      return {\n        severity: monaco.MarkerSeverity.Warning,\n        message: markerMessage(finding),\n        code: SECRET_MARKER_CODE,\n        startLineNumber: start.lineNumber,\n        startColumn: start.column,\n        endLineNumber: end.lineNumber,\n        endColumn: end.column,\n      };\n    });\n\n    monaco.editor.setModelMarkers(model, MARKER_OWNER, markers);\n  };\n\n  let debounceTimer: ReturnType<typeof setTimeout> | undefined;\n  const cancelScheduled = () => {\n    if (debounceTimer !== undefined) {\n      clearTimeout(debounceTimer);\n      debounceTimer = undefined;\n    }\n  };\n  const scheduleUpdate = () => {\n    cancelScheduled();\n    debounceTimer = setTimeout(() => {\n      debounceTimer = undefined;\n      updateMarkers();\n    }, debounceMs);\n  };\n  const updateNow = () => {\n    cancelScheduled();\n    updateMarkers();\n  };\n\n  updateMarkers();\n  disposables.push(editor.onDidChangeModelContent(() => scheduleUpdate()));\n  disposables.push(editor.onDidChangeModel(() => updateNow()));\n  disposables.push({ dispose: cancelScheduled });\n\n  if (options.enabled !== false && options.quickFix) {\n    const runQuickFix = options.quickFix.run;\n    const title = options.quickFix.title ?? DEFAULT_QUICK_FIX_TITLE;\n\n    const commandId = editor.addCommand(0, (_accessor: unknown, finding: SecretFinding) => runQuickFix(finding));\n\n    if (commandId) {\n      for (const language of languages) {\n        disposables.push(\n          monaco.languages.registerCodeActionProvider(language, {\n            provideCodeActions(model, _range, context) {\n              const secretMarkers = context.markers.filter((marker) => marker.code === SECRET_MARKER_CODE);\n\n              if (secretMarkers.length === 0) {\n                return { actions: [], dispose() {} };\n              }\n\n              const findings = scan(model.getValue());\n              const actions = secretMarkers.flatMap((marker) => {\n                const markerOffset = model.getOffsetAt({\n                  lineNumber: marker.startLineNumber,\n                  column: marker.startColumn,\n                });\n                const finding = findings.find((candidate) => candidate.range.start === markerOffset);\n\n                if (finding === undefined) {\n                  return [];\n                }\n\n                return [\n                  {\n                    title,\n                    kind: 'quickfix',\n                    diagnostics: [marker],\n                    command: { id: commandId, title, arguments: [finding] },\n                  },\n                ];\n              });\n\n              return { actions, dispose() {} };\n            },\n          })\n        );\n      }\n    }\n  }\n\n  return {\n    refresh: updateNow,\n    dispose() {\n      disposables.forEach((disposable) => disposable.dispose());\n      const model = editor.getModel();\n      if (model !== null) {\n        monaco.editor.setModelMarkers(model, MARKER_OWNER, []);\n      }\n    },\n  };\n}\n"],"names":[],"mappings":";;;;AAIO,MAAM,kBAAA,GAAqB;AAElC,MAAM,YAAA,GAAe,gBAAA;AACrB,MAAM,iBAAA,GAAoB,CAAC,YAAA,EAAc,YAAY,CAAA;AACrD,MAAM,uBAAA,GAA0B,yBAAA;AAoBzB,SAAS,oBAAA,CACd,MAAA,EACA,MAAA,EACA,OAAA,GAAuC,EAAC,EACb;AAhC7B,EAAA,IAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA;AAiCE,EAAA,MAAM,SAAA,GAAA,CAAY,EAAA,GAAA,OAAA,CAAQ,SAAA,KAAR,IAAA,GAAA,EAAA,GAAqB,iBAAA;AACvC,EAAA,MAAM,IAAA,GAAA,CAAO,EAAA,GAAA,OAAA,CAAQ,IAAA,KAAR,IAAA,GAAA,EAAA,GAAgB,iBAAA,EAAkB;AAC/C,EAAA,MAAM,UAAA,GAAA,CAAa,EAAA,GAAA,OAAA,CAAQ,UAAA,KAAR,IAAA,GAAA,EAAA,GAAsB,mBAAA;AACzC,EAAA,MAAM,aAAA,GAAA,CACJ,aAAQ,aAAA,KAAR,IAAA,GAAA,EAAA,IACC,CAAC,OAAA,KACA,CAAA,2BAAA,EAA8B,QAAQ,KAAK,CAAA,0CAAA,CAAA,CAAA;AAE/C,EAAA,MAAM,cAA0C,EAAC;AAEjD,EAAA,MAAM,gBAAgB,MAAM;AAC1B,IAAA,MAAM,KAAA,GAAQ,OAAO,QAAA,EAAS;AAC9B,IAAA,IAAI,UAAU,IAAA,EAAM;AAClB,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,OAAA,CAAQ,YAAY,KAAA,EAAO;AAC7B,MAAA,MAAA,CAAO,MAAA,CAAO,eAAA,CAAgB,KAAA,EAAO,YAAA,EAAc,EAAE,CAAA;AACrD,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,MAAA,GAAS,MAAM,QAAA,EAAS;AAC9B,IAAA,MAAM,UAAU,IAAA,CAAK,MAAM,CAAA,CAAE,GAAA,CAAI,CAAC,OAAA,KAAY;AAC5C,MAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,aAAA,CAAc,OAAA,CAAQ,MAAM,KAAK,CAAA;AACrD,MAAA,MAAM,GAAA,GAAM,KAAA,CAAM,aAAA,CAAc,OAAA,CAAQ,MAAM,GAAG,CAAA;AACjD,MAAA,OAAO;AAAA,QACL,QAAA,EAAU,OAAO,cAAA,CAAe,OAAA;AAAA,QAChC,OAAA,EAAS,cAAc,OAAO,CAAA;AAAA,QAC9B,IAAA,EAAM,kBAAA;AAAA,QACN,iBAAiB,KAAA,CAAM,UAAA;AAAA,QACvB,aAAa,KAAA,CAAM,MAAA;AAAA,QACnB,eAAe,GAAA,CAAI,UAAA;AAAA,QACnB,WAAW,GAAA,CAAI;AAAA,OACjB;AAAA,IACF,CAAC,CAAA;AAED,IAAA,MAAA,CAAO,MAAA,CAAO,eAAA,CAAgB,KAAA,EAAO,YAAA,EAAc,OAAO,CAAA;AAAA,EAC5D,CAAA;AAEA,EAAA,IAAI,aAAA;AACJ,EAAA,MAAM,kBAAkB,MAAM;AAC5B,IAAA,IAAI,kBAAkB,MAAA,EAAW;AAC/B,MAAA,YAAA,CAAa,aAAa,CAAA;AAC1B,MAAA,aAAA,GAAgB,MAAA;AAAA,IAClB;AAAA,EACF,CAAA;AACA,EAAA,MAAM,iBAAiB,MAAM;AAC3B,IAAA,eAAA,EAAgB;AAChB,IAAA,aAAA,GAAgB,WAAW,MAAM;AAC/B,MAAA,aAAA,GAAgB,MAAA;AAChB,MAAA,aAAA,EAAc;AAAA,IAChB,GAAG,UAAU,CAAA;AAAA,EACf,CAAA;AACA,EAAA,MAAM,YAAY,MAAM;AACtB,IAAA,eAAA,EAAgB;AAChB,IAAA,aAAA,EAAc;AAAA,EAChB,CAAA;AAEA,EAAA,aAAA,EAAc;AACd,EAAA,WAAA,CAAY,KAAK,MAAA,CAAO,uBAAA,CAAwB,MAAM,cAAA,EAAgB,CAAC,CAAA;AACvE,EAAA,WAAA,CAAY,KAAK,MAAA,CAAO,gBAAA,CAAiB,MAAM,SAAA,EAAW,CAAC,CAAA;AAC3D,EAAA,WAAA,CAAY,IAAA,CAAK,EAAE,OAAA,EAAS,eAAA,EAAiB,CAAA;AAE7C,EAAA,IAAI,OAAA,CAAQ,OAAA,KAAY,KAAA,IAAS,OAAA,CAAQ,QAAA,EAAU;AACjD,IAAA,MAAM,WAAA,GAAc,QAAQ,QAAA,CAAS,GAAA;AACrC,IAAA,MAAM,KAAA,GAAA,CAAQ,EAAA,GAAA,OAAA,CAAQ,QAAA,CAAS,KAAA,KAAjB,IAAA,GAAA,EAAA,GAA0B,uBAAA;AAExC,IAAA,MAAM,SAAA,GAAY,OAAO,UAAA,CAAW,CAAA,EAAG,CAAC,SAAA,EAAoB,OAAA,KAA2B,WAAA,CAAY,OAAO,CAAC,CAAA;AAE3G,IAAA,IAAI,SAAA,EAAW;AACb,MAAA,KAAA,MAAW,YAAY,SAAA,EAAW;AAChC,QAAA,WAAA,CAAY,IAAA;AAAA,UACV,MAAA,CAAO,SAAA,CAAU,0BAAA,CAA2B,QAAA,EAAU;AAAA,YACpD,kBAAA,CAAmB,KAAA,EAAO,MAAA,EAAQ,OAAA,EAAS;AACzC,cAAA,MAAM,aAAA,GAAgB,QAAQ,OAAA,CAAQ,MAAA,CAAO,CAAC,MAAA,KAAW,MAAA,CAAO,SAAS,kBAAkB,CAAA;AAE3F,cAAA,IAAI,aAAA,CAAc,WAAW,CAAA,EAAG;AAC9B,gBAAA,OAAO,EAAE,OAAA,EAAS,EAAC,EAAG,OAAA,GAAU;AAAA,gBAAC,CAAA,EAAE;AAAA,cACrC;AAEA,cAAA,MAAM,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,QAAA,EAAU,CAAA;AACtC,cAAA,MAAM,OAAA,GAAU,aAAA,CAAc,OAAA,CAAQ,CAAC,MAAA,KAAW;AAChD,gBAAA,MAAM,YAAA,GAAe,MAAM,WAAA,CAAY;AAAA,kBACrC,YAAY,MAAA,CAAO,eAAA;AAAA,kBACnB,QAAQ,MAAA,CAAO;AAAA,iBAChB,CAAA;AACD,gBAAA,MAAM,OAAA,GAAU,SAAS,IAAA,CAAK,CAAC,cAAc,SAAA,CAAU,KAAA,CAAM,UAAU,YAAY,CAAA;AAEnF,gBAAA,IAAI,YAAY,MAAA,EAAW;AACzB,kBAAA,OAAO,EAAC;AAAA,gBACV;AAEA,gBAAA,OAAO;AAAA,kBACL;AAAA,oBACE,KAAA;AAAA,oBACA,IAAA,EAAM,UAAA;AAAA,oBACN,WAAA,EAAa,CAAC,MAAM,CAAA;AAAA,oBACpB,OAAA,EAAS,EAAE,EAAA,EAAI,SAAA,EAAW,OAAO,SAAA,EAAW,CAAC,OAAO,CAAA;AAAE;AACxD,iBACF;AAAA,cACF,CAAC,CAAA;AAED,cAAA,OAAO,EAAE,SAAS,OAAA,GAAU;AAAA,cAAC,CAAA,EAAE;AAAA,YACjC;AAAA,WACD;AAAA,SACH;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,SAAA;AAAA,IACT,OAAA,GAAU;AACR,MAAA,WAAA,CAAY,OAAA,CAAQ,CAAC,UAAA,KAAe,UAAA,CAAW,SAAS,CAAA;AACxD,MAAA,MAAM,KAAA,GAAQ,OAAO,QAAA,EAAS;AAC9B,MAAA,IAAI,UAAU,IAAA,EAAM;AAClB,QAAA,MAAA,CAAO,MAAA,CAAO,eAAA,CAAgB,KAAA,EAAO,YAAA,EAAc,EAAE,CAAA;AAAA,MACvD;AAAA,IACF;AAAA,GACF;AACF;;;;"}

package/dist/esm/secret-scanner/panel/SecretReferenceModal.js

@@ -0,0 +1,21 @@
+import React from 'react';
+import { Text, Modal, Stack, Input, ClipboardButton } from '@grafana/ui';
+
+const DEFAULT_TITLE = "Reference your secret";
+function SecretReferenceModal({
+  reference,
+  onDismiss,
+  snippet,
+  title = DEFAULT_TITLE,
+  description
+}) {
+  if (reference === null) {
+    return null;
+  }
+  const text = snippet != null ? snippet : reference.reference;
+  const defaultDescription = /* @__PURE__ */ React.createElement(Text, { variant: "body" }, "The secret ", /* @__PURE__ */ React.createElement("code", null, reference.secretName), " was created, but this value could not be replaced automatically. Copy the reference below and use it in place of the hardcoded value.");
+  return /* @__PURE__ */ React.createElement(Modal, { title, isOpen: true, onDismiss }, /* @__PURE__ */ React.createElement(Stack, { direction: "column", gap: 2 }, description != null ? description : defaultDescription, /* @__PURE__ */ React.createElement(Input, { readOnly: true, value: text })), /* @__PURE__ */ React.createElement(Modal.ButtonRow, null, /* @__PURE__ */ React.createElement(ClipboardButton, { icon: "copy", variant: "primary", getText: () => text }, "Copy reference")));
+}
+
+export { SecretReferenceModal };
+//# sourceMappingURL=SecretReferenceModal.js.map

package/dist/esm/secret-scanner/panel/SecretReferenceModal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretReferenceModal.js","sources":["../../../../src/secret-scanner/panel/SecretReferenceModal.tsx"],"sourcesContent":["import React from 'react';\nimport { ClipboardButton, Input, Modal, Stack, Text } from '@grafana/ui';\n\nimport type { SecretReference } from '../react/index';\n\ninterface SecretReferenceModalProps {\n  reference: SecretReference | null;\n  onDismiss: () => void;\n  snippet?: string;\n  title?: string;\n  description?: NonNullable<React.ReactNode>;\n}\n\nconst DEFAULT_TITLE = 'Reference your secret';\n\n/**\n * Shown after a secret is created for a finding that couldn't be rewritten in\n * place. Purely presentational — render it off `scanner.reference.pending`.\n */\nexport function SecretReferenceModal({\n  reference,\n  onDismiss,\n  snippet,\n  title = DEFAULT_TITLE,\n  description,\n}: SecretReferenceModalProps) {\n  if (reference === null) {\n    return null;\n  }\n\n  const text = snippet ?? reference.reference;\n  const defaultDescription = (\n    <Text variant=\"body\">\n      The secret <code>{reference.secretName}</code> was created, but this value could not be replaced automatically.\n      Copy the reference below and use it in place of the hardcoded value.\n    </Text>\n  );\n\n  return (\n    <Modal title={title} isOpen onDismiss={onDismiss}>\n      <Stack direction=\"column\" gap={2}>\n        {description ?? defaultDescription}\n\n        <Input readOnly value={text} />\n      </Stack>\n\n      <Modal.ButtonRow>\n        <ClipboardButton icon=\"copy\" variant=\"primary\" getText={() => text}>\n          Copy reference\n        </ClipboardButton>\n      </Modal.ButtonRow>\n    </Modal>\n  );\n}\n"],"names":[],"mappings":";;;AAaA,MAAM,aAAA,GAAgB,uBAAA;AAMf,SAAS,oBAAA,CAAqB;AAAA,EACnC,SAAA;AAAA,EACA,SAAA;AAAA,EACA,OAAA;AAAA,EACA,KAAA,GAAQ,aAAA;AAAA,EACR;AACF,CAAA,EAA8B;AAC5B,EAAA,IAAI,cAAc,IAAA,EAAM;AACtB,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,IAAA,GAAO,4BAAW,SAAA,CAAU,SAAA;AAClC,EAAA,MAAM,kBAAA,mBACJ,KAAA,CAAA,aAAA,CAAC,IAAA,EAAA,EAAK,OAAA,EAAQ,MAAA,EAAA,EAAO,aAAA,kBACR,KAAA,CAAA,aAAA,CAAC,MAAA,EAAA,IAAA,EAAM,SAAA,CAAU,UAAW,CAAA,EAAO,wIAEhD,CAAA;AAGF,EAAA,2CACG,KAAA,EAAA,EAAM,KAAA,EAAc,MAAA,EAAM,IAAA,EAAC,6BAC1B,KAAA,CAAA,aAAA,CAAC,KAAA,EAAA,EAAM,SAAA,EAAU,QAAA,EAAS,KAAK,CAAA,EAAA,EAC5B,WAAA,IAAA,IAAA,GAAA,WAAA,GAAe,kBAAA,kBAEhB,KAAA,CAAA,aAAA,CAAC,SAAM,QAAA,EAAQ,IAAA,EAAC,KAAA,EAAO,IAAA,EAAM,CAC/B,CAAA,kBAEA,KAAA,CAAA,aAAA,CAAC,KAAA,CAAM,SAAA,EAAN,sBACC,KAAA,CAAA,aAAA,CAAC,eAAA,EAAA,EAAgB,IAAA,EAAK,MAAA,EAAO,SAAQ,SAAA,EAAU,OAAA,EAAS,MAAM,IAAA,EAAA,EAAM,gBAEpE,CACF,CACF,CAAA;AAEJ;;;;"}

package/dist/esm/secret-scanner/panel/SecretScannerPanel.js

@@ -0,0 +1,75 @@
+import React from 'react';
+import { useStyles2, Alert, Text, Stack, Badge, Button } from '@grafana/ui';
+import { css } from '@emotion/css';
+import '../core/detection/literals.js';
+import '../core/detection/ruleDetectors.js';
+import { maskSecret } from '../core/secretScanner.utils.js';
+
+const DEFAULT_DESCRIPTION = "Hardcoded secrets in test scripts are stored in plaintext. Move them to Secrets Manager and reference them at runtime instead.";
+const DEFAULT_MOVE_LABEL = "Move to secret";
+const DEFAULT_IGNORE_LABEL = "Ignore";
+const CONFIDENCE_BADGE = {
+  high: { text: "high", color: "red" },
+  medium: { text: "medium", color: "orange" },
+  low: { text: "low", color: "blue" }
+};
+function SecretFindingsPanel({
+  findings,
+  onMove,
+  onIgnore,
+  hidden = false,
+  showLine = true,
+  description = DEFAULT_DESCRIPTION,
+  moveLabel = DEFAULT_MOVE_LABEL,
+  ignoreLabel = DEFAULT_IGNORE_LABEL
+}) {
+  const styles = useStyles2(getStyles);
+  if (hidden || findings.length === 0) {
+    return null;
+  }
+  const title = findings.length === 1 ? "1 potential secret detected" : `${findings.length} potential secrets detected`;
+  return /* @__PURE__ */ React.createElement(Alert, { severity: "warning", title }, /* @__PURE__ */ React.createElement(Text, { variant: "bodySmall" }, description), /* @__PURE__ */ React.createElement("div", { className: styles.list }, findings.map((finding) => /* @__PURE__ */ React.createElement("div", { key: finding.id, className: styles.row }, /* @__PURE__ */ React.createElement(Stack, { alignItems: "center", gap: 1, wrap: "wrap" }, /* @__PURE__ */ React.createElement(Badge, { text: finding.label, color: CONFIDENCE_BADGE[finding.confidence].color }), /* @__PURE__ */ React.createElement("code", { className: styles.value }, maskSecret(finding.secret)), /* @__PURE__ */ React.createElement(Text, { variant: "bodySmall", color: "secondary" }, showLine && finding.line != null ? `line ${finding.line} \xB7 ` : "", CONFIDENCE_BADGE[finding.confidence].text, " confidence")), /* @__PURE__ */ React.createElement(Stack, { gap: 1 }, onMove && /* @__PURE__ */ React.createElement(Button, { size: "sm", variant: "primary", icon: "shield", onClick: () => onMove(finding) }, moveLabel), onIgnore && /* @__PURE__ */ React.createElement(Button, { size: "sm", variant: "secondary", fill: "outline", onClick: () => onIgnore(finding) }, ignoreLabel))))));
+}
+function SecretScannerPanel({ scanner, readOnly = false, ...rest }) {
+  return /* @__PURE__ */ React.createElement(
+    SecretFindingsPanel,
+    {
+      findings: scanner.findings,
+      onMove: readOnly ? void 0 : scanner.migration.request,
+      onIgnore: scanner.ignore,
+      ...rest
+    }
+  );
+}
+function getStyles(theme) {
+  return {
+    list: css`
+      display: flex;
+      flex-direction: column;
+      gap: ${theme.spacing(1)};
+      margin-top: ${theme.spacing(1)};
+      /* Cap the list so a script with many findings can't grow the panel
+         unbounded and push the editor out of view; scroll past ~8 rows. */
+      max-height: ${theme.spacing(40)};
+      overflow-y: auto;
+    `,
+    row: css`
+      display: flex;
+      align-items: center;
+      justify-content: space-between;
+      gap: ${theme.spacing(2)};
+      padding: ${theme.spacing(1)};
+      border: 1px solid ${theme.colors.border.weak};
+      border-radius: ${theme.shape.radius.default};
+      background: ${theme.colors.background.secondary};
+      flex-wrap: wrap;
+    `,
+    value: css`
+      font-family: ${theme.typography.fontFamilyMonospace};
+      font-size: ${theme.typography.bodySmall.fontSize};
+    `
+  };
+}
+
+export { SecretFindingsPanel, SecretScannerPanel };
+//# sourceMappingURL=SecretScannerPanel.js.map

package/dist/esm/secret-scanner/panel/SecretScannerPanel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretScannerPanel.js","sources":["../../../../src/secret-scanner/panel/SecretScannerPanel.tsx"],"sourcesContent":["import React from 'react';\nimport { Alert, Badge, Button, Stack, Text, useStyles2 } from '@grafana/ui';\nimport type { GrafanaTheme2 } from '@grafana/data';\nimport { css } from '@emotion/css';\n\nimport { maskSecret, type SecretConfidence, type SecretFinding } from '../core/index';\nimport type { SecretScanner } from '../react/index';\n\nexport interface SecretFindingSummary {\n  id: string;\n  label: string;\n  confidence: SecretConfidence;\n  secret: string;\n  line?: number;\n}\n\ninterface SecretFindingsPanelProps<T extends SecretFindingSummary> {\n  findings: T[];\n  onMove?: (finding: T) => void;\n  onIgnore?: (finding: T) => void;\n  hidden?: boolean;\n  showLine?: boolean;\n  description?: NonNullable<React.ReactNode>;\n  moveLabel?: React.ReactNode;\n  ignoreLabel?: React.ReactNode;\n}\n\ninterface SecretScannerPanelProps extends Omit<\n  SecretFindingsPanelProps<SecretFinding>,\n  'findings' | 'onMove' | 'onIgnore'\n> {\n  scanner: SecretScanner;\n  readOnly?: boolean;\n}\n\nconst DEFAULT_DESCRIPTION =\n  'Hardcoded secrets in test scripts are stored in plaintext. Move them to Secrets Manager and reference them at runtime instead.';\nconst DEFAULT_MOVE_LABEL = 'Move to secret';\nconst DEFAULT_IGNORE_LABEL = 'Ignore';\n\nconst CONFIDENCE_BADGE: Record<SecretConfidence, { text: string; color: 'red' | 'orange' | 'blue' }> = {\n  high: { text: 'high', color: 'red' },\n  medium: { text: 'medium', color: 'orange' },\n  low: { text: 'low', color: 'blue' },\n};\n\n/**\n * Presentational: takes findings and renders them. Accepts any finding shape\n * carrying the fields in `SecretFindingSummary`, so a host can pass its own.\n * For a panel driven by `useSecretScanner`, use `SecretScannerPanel`.\n */\nexport function SecretFindingsPanel<T extends SecretFindingSummary>({\n  findings,\n  onMove,\n  onIgnore,\n  hidden = false,\n  showLine = true,\n  description = DEFAULT_DESCRIPTION,\n  moveLabel = DEFAULT_MOVE_LABEL,\n  ignoreLabel = DEFAULT_IGNORE_LABEL,\n}: SecretFindingsPanelProps<T>) {\n  const styles = useStyles2(getStyles);\n\n  if (hidden || findings.length === 0) {\n    return null;\n  }\n\n  const title = findings.length === 1 ? '1 potential secret detected' : `${findings.length} potential secrets detected`;\n\n  return (\n    <Alert severity=\"warning\" title={title}>\n      <Text variant=\"bodySmall\">{description}</Text>\n\n      <div className={styles.list}>\n        {findings.map((finding) => (\n          <div key={finding.id} className={styles.row}>\n            <Stack alignItems=\"center\" gap={1} wrap=\"wrap\">\n              <Badge text={finding.label} color={CONFIDENCE_BADGE[finding.confidence].color} />\n              <code className={styles.value}>{maskSecret(finding.secret)}</code>\n              <Text variant=\"bodySmall\" color=\"secondary\">\n                {showLine && finding.line != null ? `line ${finding.line} · ` : ''}\n                {CONFIDENCE_BADGE[finding.confidence].text} confidence\n              </Text>\n            </Stack>\n\n            <Stack gap={1}>\n              {onMove && (\n                <Button size=\"sm\" variant=\"primary\" icon=\"shield\" onClick={() => onMove(finding)}>\n                  {moveLabel}\n                </Button>\n              )}\n              {onIgnore && (\n                <Button size=\"sm\" variant=\"secondary\" fill=\"outline\" onClick={() => onIgnore(finding)}>\n                  {ignoreLabel}\n                </Button>\n              )}\n            </Stack>\n          </div>\n        ))}\n      </div>\n    </Alert>\n  );\n}\n\n/**\n * \"Move to secret\" calls `scanner.migration.request(finding)`, which sets\n * `scanner.migration.finding`; render your own create-secret modal off that, and\n * call `scanner.migration.apply` once the secret exists.\n */\nexport function SecretScannerPanel({ scanner, readOnly = false, ...rest }: SecretScannerPanelProps) {\n  return (\n    <SecretFindingsPanel\n      findings={scanner.findings}\n      onMove={readOnly ? undefined : scanner.migration.request}\n      onIgnore={scanner.ignore}\n      {...rest}\n    />\n  );\n}\n\nfunction getStyles(theme: GrafanaTheme2) {\n  return {\n    list: css`\n      display: flex;\n      flex-direction: column;\n      gap: ${theme.spacing(1)};\n      margin-top: ${theme.spacing(1)};\n      /* Cap the list so a script with many findings can't grow the panel\n         unbounded and push the editor out of view; scroll past ~8 rows. */\n      max-height: ${theme.spacing(40)};\n      overflow-y: auto;\n    `,\n    row: css`\n      display: flex;\n      align-items: center;\n      justify-content: space-between;\n      gap: ${theme.spacing(2)};\n      padding: ${theme.spacing(1)};\n      border: 1px solid ${theme.colors.border.weak};\n      border-radius: ${theme.shape.radius.default};\n      background: ${theme.colors.background.secondary};\n      flex-wrap: wrap;\n    `,\n    value: css`\n      font-family: ${theme.typography.fontFamilyMonospace};\n      font-size: ${theme.typography.bodySmall.fontSize};\n    `,\n  };\n}\n"],"names":[],"mappings":";;;;;;;AAmCA,MAAM,mBAAA,GACJ,gIAAA;AACF,MAAM,kBAAA,GAAqB,gBAAA;AAC3B,MAAM,oBAAA,GAAuB,QAAA;AAE7B,MAAM,gBAAA,GAAiG;AAAA,EACrG,IAAA,EAAM,EAAE,IAAA,EAAM,MAAA,EAAQ,OAAO,KAAA,EAAM;AAAA,EACnC,MAAA,EAAQ,EAAE,IAAA,EAAM,QAAA,EAAU,OAAO,QAAA,EAAS;AAAA,EAC1C,GAAA,EAAK,EAAE,IAAA,EAAM,KAAA,EAAO,OAAO,MAAA;AAC7B,CAAA;AAOO,SAAS,mBAAA,CAAoD;AAAA,EAClE,QAAA;AAAA,EACA,MAAA;AAAA,EACA,QAAA;AAAA,EACA,MAAA,GAAS,KAAA;AAAA,EACT,QAAA,GAAW,IAAA;AAAA,EACX,WAAA,GAAc,mBAAA;AAAA,EACd,SAAA,GAAY,kBAAA;AAAA,EACZ,WAAA,GAAc;AAChB,CAAA,EAAgC;AAC9B,EAAA,MAAM,MAAA,GAAS,WAAW,SAAS,CAAA;AAEnC,EAAA,IAAI,MAAA,IAAU,QAAA,CAAS,MAAA,KAAW,CAAA,EAAG;AACnC,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,QAAQ,QAAA,CAAS,MAAA,KAAW,IAAI,6BAAA,GAAgC,CAAA,EAAG,SAAS,MAAM,CAAA,2BAAA,CAAA;AAExF,EAAA,uBACE,KAAA,CAAA,aAAA,CAAC,KAAA,EAAA,EAAM,QAAA,EAAS,SAAA,EAAU,KAAA,EAAA,kBACxB,KAAA,CAAA,aAAA,CAAC,IAAA,EAAA,EAAK,OAAA,EAAQ,WAAA,EAAA,EAAa,WAAY,CAAA,kBAEvC,KAAA,CAAA,aAAA,CAAC,KAAA,EAAA,EAAI,SAAA,EAAW,MAAA,CAAO,IAAA,EAAA,EACpB,QAAA,CAAS,GAAA,CAAI,CAAC,OAAA,qBACb,KAAA,CAAA,aAAA,CAAC,KAAA,EAAA,EAAI,GAAA,EAAK,OAAA,CAAQ,EAAA,EAAI,SAAA,EAAW,MAAA,CAAO,GAAA,EAAA,kBACtC,KAAA,CAAA,aAAA,CAAC,SAAM,UAAA,EAAW,QAAA,EAAS,GAAA,EAAK,CAAA,EAAG,IAAA,EAAK,MAAA,EAAA,kBACtC,KAAA,CAAA,aAAA,CAAC,KAAA,EAAA,EAAM,IAAA,EAAM,OAAA,CAAQ,KAAA,EAAO,KAAA,EAAO,gBAAA,CAAiB,OAAA,CAAQ,UAAU,CAAA,CAAE,KAAA,EAAO,CAAA,kBAC/E,KAAA,CAAA,aAAA,CAAC,MAAA,EAAA,EAAK,SAAA,EAAW,MAAA,CAAO,KAAA,EAAA,EAAQ,UAAA,CAAW,OAAA,CAAQ,MAAM,CAAE,CAAA,kBAC3D,KAAA,CAAA,aAAA,CAAC,IAAA,EAAA,EAAK,SAAQ,WAAA,EAAY,KAAA,EAAM,WAAA,EAAA,EAC7B,QAAA,IAAY,OAAA,CAAQ,IAAA,IAAQ,IAAA,GAAO,CAAA,KAAA,EAAQ,OAAA,CAAQ,IAAI,CAAA,MAAA,CAAA,GAAQ,EAAA,EAC/D,gBAAA,CAAiB,OAAA,CAAQ,UAAU,CAAA,CAAE,IAAA,EAAK,aAC7C,CACF,CAAA,kBAEA,KAAA,CAAA,aAAA,CAAC,KAAA,EAAA,EAAM,GAAA,EAAK,CAAA,EAAA,EACT,MAAA,oBACC,KAAA,CAAA,aAAA,CAAC,MAAA,EAAA,EAAO,IAAA,EAAK,IAAA,EAAK,OAAA,EAAQ,WAAU,IAAA,EAAK,QAAA,EAAS,OAAA,EAAS,MAAM,MAAA,CAAO,OAAO,CAAA,EAAA,EAC5E,SACH,CAAA,EAED,QAAA,oBACC,KAAA,CAAA,aAAA,CAAC,MAAA,EAAA,EAAO,IAAA,EAAK,IAAA,EAAK,OAAA,EAAQ,WAAA,EAAY,IAAA,EAAK,SAAA,EAAU,OAAA,EAAS,MAAM,QAAA,CAAS,OAAO,CAAA,EAAA,EACjF,WACH,CAEJ,CACF,CACD,CACH,CACF,CAAA;AAEJ;AAOO,SAAS,mBAAmB,EAAE,OAAA,EAAS,WAAW,KAAA,EAAO,GAAG,MAAK,EAA4B;AAClG,EAAA,uBACE,KAAA,CAAA,aAAA;AAAA,IAAC,mBAAA;AAAA,IAAA;AAAA,MACC,UAAU,OAAA,CAAQ,QAAA;AAAA,MAClB,MAAA,EAAQ,QAAA,GAAW,MAAA,GAAY,OAAA,CAAQ,SAAA,CAAU,OAAA;AAAA,MACjD,UAAU,OAAA,CAAQ,MAAA;AAAA,MACjB,GAAG;AAAA;AAAA,GACN;AAEJ;AAEA,SAAS,UAAU,KAAA,EAAsB;AACvC,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,GAAA;AAAA;AAAA;AAAA,WAAA,EAGG,KAAA,CAAM,OAAA,CAAQ,CAAC,CAAC,CAAA;AAAA,kBAAA,EACT,KAAA,CAAM,OAAA,CAAQ,CAAC,CAAC,CAAA;AAAA;AAAA;AAAA,kBAAA,EAGhB,KAAA,CAAM,OAAA,CAAQ,EAAE,CAAC,CAAA;AAAA;AAAA,IAAA,CAAA;AAAA,IAGjC,GAAA,EAAK,GAAA;AAAA;AAAA;AAAA;AAAA,WAAA,EAII,KAAA,CAAM,OAAA,CAAQ,CAAC,CAAC,CAAA;AAAA,eAAA,EACZ,KAAA,CAAM,OAAA,CAAQ,CAAC,CAAC,CAAA;AAAA,wBAAA,EACP,KAAA,CAAM,MAAA,CAAO,MAAA,CAAO,IAAI,CAAA;AAAA,qBAAA,EAC3B,KAAA,CAAM,KAAA,CAAM,MAAA,CAAO,OAAO,CAAA;AAAA,kBAAA,EAC7B,KAAA,CAAM,MAAA,CAAO,UAAA,CAAW,SAAS,CAAA;AAAA;AAAA,IAAA,CAAA;AAAA,IAGjD,KAAA,EAAO,GAAA;AAAA,mBAAA,EACU,KAAA,CAAM,WAAW,mBAAmB,CAAA;AAAA,iBAAA,EACtC,KAAA,CAAM,UAAA,CAAW,SAAA,CAAU,QAAQ,CAAA;AAAA,IAAA;AAAA,GAEpD;AACF;;;;"}

package/dist/esm/secret-scanner/react/useIgnoredSecrets.js

@@ -0,0 +1,25 @@
+import { useCallback } from 'react';
+import '../core/detection/literals.js';
+import '../core/detection/ruleDetectors.js';
+import { getFindingSignature } from '../core/secretScanner.utils.js';
+import { useLocalStorageList } from './useLocalStorageList.js';
+
+const DEFAULT_STORAGE_KEY = "secretScanner.ignored";
+function useIgnoredSecrets(storageKey = DEFAULT_STORAGE_KEY) {
+  const [ignored, setIgnored] = useLocalStorageList(storageKey);
+  const isIgnored = useCallback(
+    (finding) => ignored.includes(getFindingSignature(finding)),
+    [ignored]
+  );
+  const ignore = useCallback(
+    (finding) => {
+      const signature = getFindingSignature(finding);
+      setIgnored((current) => current.includes(signature) ? current : [...current, signature]);
+    },
+    [setIgnored]
+  );
+  return { isIgnored, ignore };
+}
+
+export { useIgnoredSecrets };
+//# sourceMappingURL=useIgnoredSecrets.js.map

package/dist/esm/secret-scanner/react/useIgnoredSecrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useIgnoredSecrets.js","sources":["../../../../src/secret-scanner/react/useIgnoredSecrets.ts"],"sourcesContent":["import { useCallback } from 'react';\n\nimport { getFindingSignature, type SecretFinding } from '../core/index';\nimport { useLocalStorageList } from './useLocalStorageList';\n\nconst DEFAULT_STORAGE_KEY = 'secretScanner.ignored';\n\ntype IgnorableFinding = Pick<SecretFinding, 'type' | 'secret'>;\n\n/**\n * Remembers which detected secrets the user chose to ignore, persisted in\n * localStorage under `storageKey` (namespace it per document). Tracked by a\n * content-derived signature, never the plaintext.\n */\nexport function useIgnoredSecrets(storageKey: string = DEFAULT_STORAGE_KEY) {\n  const [ignored, setIgnored] = useLocalStorageList(storageKey);\n\n  const isIgnored = useCallback(\n    (finding: IgnorableFinding) => ignored.includes(getFindingSignature(finding)),\n    [ignored]\n  );\n\n  const ignore = useCallback(\n    (finding: IgnorableFinding) => {\n      const signature = getFindingSignature(finding);\n      setIgnored((current) => (current.includes(signature) ? current : [...current, signature]));\n    },\n    [setIgnored]\n  );\n\n  return { isIgnored, ignore };\n}\n"],"names":[],"mappings":";;;;;;AAKA,MAAM,mBAAA,GAAsB,uBAAA;AASrB,SAAS,iBAAA,CAAkB,aAAqB,mBAAA,EAAqB;AAC1E,EAAA,MAAM,CAAC,OAAA,EAAS,UAAU,CAAA,GAAI,oBAAoB,UAAU,CAAA;AAE5D,EAAA,MAAM,SAAA,GAAY,WAAA;AAAA,IAChB,CAAC,OAAA,KAA8B,OAAA,CAAQ,QAAA,CAAS,mBAAA,CAAoB,OAAO,CAAC,CAAA;AAAA,IAC5E,CAAC,OAAO;AAAA,GACV;AAEA,EAAA,MAAM,MAAA,GAAS,WAAA;AAAA,IACb,CAAC,OAAA,KAA8B;AAC7B,MAAA,MAAM,SAAA,GAAY,oBAAoB,OAAO,CAAA;AAC7C,MAAA,UAAA,CAAW,CAAC,OAAA,KAAa,OAAA,CAAQ,QAAA,CAAS,SAAS,CAAA,GAAI,OAAA,GAAU,CAAC,GAAG,OAAA,EAAS,SAAS,CAAE,CAAA;AAAA,IAC3F,CAAA;AAAA,IACA,CAAC,UAAU;AAAA,GACb;AAEA,EAAA,OAAO,EAAE,WAAW,MAAA,EAAO;AAC7B;;;;"}

package/dist/esm/secret-scanner/react/useLocalStorageList.js

@@ -0,0 +1,38 @@
+import { useState, useRef, useEffect, useCallback } from 'react';
+
+function read(key) {
+  try {
+    const raw = localStorage.getItem(key);
+    const parsed = raw ? JSON.parse(raw) : [];
+    return Array.isArray(parsed) ? parsed : [];
+  } catch (e) {
+    return [];
+  }
+}
+function useLocalStorageList(key) {
+  const [value, setValue] = useState(() => read(key));
+  const keyRef = useRef(key);
+  useEffect(() => {
+    if (keyRef.current !== key) {
+      keyRef.current = key;
+      setValue(read(key));
+    }
+  }, [key]);
+  const set = useCallback(
+    (updater) => {
+      setValue((prev) => {
+        const next = typeof updater === "function" ? updater(prev) : updater;
+        try {
+          localStorage.setItem(key, JSON.stringify(next));
+        } catch (e) {
+        }
+        return next;
+      });
+    },
+    [key]
+  );
+  return [value, set];
+}
+
+export { useLocalStorageList };
+//# sourceMappingURL=useLocalStorageList.js.map

package/dist/esm/secret-scanner/react/useLocalStorageList.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useLocalStorageList.js","sources":["../../../../src/secret-scanner/react/useLocalStorageList.ts"],"sourcesContent":["import { useCallback, useEffect, useRef, useState } from 'react';\n\nfunction read(key: string): string[] {\n  try {\n    const raw = localStorage.getItem(key);\n    const parsed = raw ? JSON.parse(raw) : [];\n    return Array.isArray(parsed) ? parsed : [];\n  } catch {\n    return [];\n  }\n}\n\ntype Updater = string[] | ((prev: string[]) => string[]);\n\nexport function useLocalStorageList(key: string): [string[], (updater: Updater) => void] {\n  const [value, setValue] = useState<string[]>(() => read(key));\n  const keyRef = useRef(key);\n\n  useEffect(() => {\n    if (keyRef.current !== key) {\n      keyRef.current = key;\n      setValue(read(key));\n    }\n  }, [key]);\n\n  const set = useCallback(\n    (updater: Updater) => {\n      setValue((prev) => {\n        const next = typeof updater === 'function' ? updater(prev) : updater;\n        try {\n          localStorage.setItem(key, JSON.stringify(next));\n        } catch {\n          // Ignore write failures (private mode, quota, …).\n        }\n        return next;\n      });\n    },\n    [key]\n  );\n\n  return [value, set];\n}\n"],"names":[],"mappings":";;AAEA,SAAS,KAAK,GAAA,EAAuB;AACnC,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,YAAA,CAAa,OAAA,CAAQ,GAAG,CAAA;AACpC,IAAA,MAAM,SAAS,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,GAAG,IAAI,EAAC;AACxC,IAAA,OAAO,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,GAAI,SAAS,EAAC;AAAA,EAC3C,CAAA,CAAA,OAAQ,CAAA,EAAA;AACN,IAAA,OAAO,EAAC;AAAA,EACV;AACF;AAIO,SAAS,oBAAoB,GAAA,EAAqD;AACvF,EAAA,MAAM,CAAC,OAAO,QAAQ,CAAA,GAAI,SAAmB,MAAM,IAAA,CAAK,GAAG,CAAC,CAAA;AAC5D,EAAA,MAAM,MAAA,GAAS,OAAO,GAAG,CAAA;AAEzB,EAAA,SAAA,CAAU,MAAM;AACd,IAAA,IAAI,MAAA,CAAO,YAAY,GAAA,EAAK;AAC1B,MAAA,MAAA,CAAO,OAAA,GAAU,GAAA;AACjB,MAAA,QAAA,CAAS,IAAA,CAAK,GAAG,CAAC,CAAA;AAAA,IACpB;AAAA,EACF,CAAA,EAAG,CAAC,GAAG,CAAC,CAAA;AAER,EAAA,MAAM,GAAA,GAAM,WAAA;AAAA,IACV,CAAC,OAAA,KAAqB;AACpB,MAAA,QAAA,CAAS,CAAC,IAAA,KAAS;AACjB,QAAA,MAAM,OAAO,OAAO,OAAA,KAAY,UAAA,GAAa,OAAA,CAAQ,IAAI,CAAA,GAAI,OAAA;AAC7D,QAAA,IAAI;AACF,UAAA,YAAA,CAAa,OAAA,CAAQ,GAAA,EAAK,IAAA,CAAK,SAAA,CAAU,IAAI,CAAC,CAAA;AAAA,QAChD,CAAA,CAAA,OAAQ,CAAA,EAAA;AAAA,QAER;AACA,QAAA,OAAO,IAAA;AAAA,MACT,CAAC,CAAA;AAAA,IACH,CAAA;AAAA,IACA,CAAC,GAAG;AAAA,GACN;AAEA,EAAA,OAAO,CAAC,OAAO,GAAG,CAAA;AACpB;;;;"}

package/dist/esm/secret-scanner/react/useMonacoSecretScanner.js

@@ -0,0 +1,28 @@
+import { useEffect } from 'react';
+import { installSecretScanner } from '../monaco/installSecretScanner.js';
+import { useSecretScanner } from './useSecretScanner.js';
+
+function useMonacoSecretScanner(params) {
+  const { monaco, editor, canMigrate = true, languages, ...headless } = params;
+  const { enabled = true, debounceMs, scan } = headless;
+  const scanner = useSecretScanner(headless);
+  const { request } = scanner.migration;
+  const languageKey = (languages != null ? languages : []).join(",");
+  useEffect(() => {
+    if (monaco === void 0 || editor === void 0) {
+      return;
+    }
+    const installation = installSecretScanner(monaco, editor, {
+      enabled,
+      languages,
+      debounceMs,
+      scan,
+      quickFix: canMigrate ? { run: request } : void 0
+    });
+    return () => installation.dispose();
+  }, [monaco, editor, enabled, canMigrate, languageKey, debounceMs, scan, request]);
+  return scanner;
+}
+
+export { useMonacoSecretScanner };
+//# sourceMappingURL=useMonacoSecretScanner.js.map

package/dist/esm/secret-scanner/react/useMonacoSecretScanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useMonacoSecretScanner.js","sources":["../../../../src/secret-scanner/react/useMonacoSecretScanner.ts"],"sourcesContent":["import { useEffect } from 'react';\n\nimport { installSecretScanner, type IStandaloneCodeEditor, type MonacoNamespace } from '../monaco/index';\nimport { useSecretScanner, type SecretScanner, type UseSecretScannerParams } from './useSecretScanner';\n\nexport interface UseMonacoSecretScannerParams extends UseSecretScannerParams {\n  /** Monaco namespace + editor, injected from the host's editor mount. */\n  monaco?: MonacoNamespace;\n  editor?: IStandaloneCodeEditor;\n  /** Whether the \"Move to secret\" quick fix is offered. Default true. */\n  canMigrate?: boolean;\n  /** Languages to register the quick fix for. Default: ts + js. */\n  languages?: string[];\n}\n\n/**\n * Monaco adapter over {@link useSecretScanner}: adds gutter markers and a\n * \"Move to Secrets Manager\" quick fix on top of the headless scanner.\n *\n * The Monaco pieces are optional — until `monaco` and `editor` are both\n * provided, this behaves exactly like `useSecretScanner`, so a host can mount it\n * before its editor is ready.\n */\nexport function useMonacoSecretScanner(params: UseMonacoSecretScannerParams): SecretScanner {\n  const { monaco, editor, canMigrate = true, languages, ...headless } = params;\n  const { enabled = true, debounceMs, scan } = headless;\n\n  const scanner = useSecretScanner(headless);\n  const { request } = scanner.migration;\n\n  const languageKey = (languages ?? []).join(',');\n  useEffect(() => {\n    if (monaco === undefined || editor === undefined) {\n      return;\n    }\n\n    const installation = installSecretScanner(monaco, editor, {\n      enabled,\n      languages,\n      debounceMs,\n      scan,\n      quickFix: canMigrate ? { run: request } : undefined,\n    });\n\n    return () => installation.dispose();\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [monaco, editor, enabled, canMigrate, languageKey, debounceMs, scan, request]);\n\n  return scanner;\n}\n"],"names":[],"mappings":";;;;AAuBO,SAAS,uBAAuB,MAAA,EAAqD;AAC1F,EAAA,MAAM,EAAE,QAAQ,MAAA,EAAQ,UAAA,GAAa,MAAM,SAAA,EAAW,GAAG,UAAS,GAAI,MAAA;AACtE,EAAA,MAAM,EAAE,OAAA,GAAU,IAAA,EAAM,UAAA,EAAY,MAAK,GAAI,QAAA;AAE7C,EAAA,MAAM,OAAA,GAAU,iBAAiB,QAAQ,CAAA;AACzC,EAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,OAAA,CAAQ,SAAA;AAE5B,EAAA,MAAM,WAAA,GAAA,CAAe,SAAA,IAAA,IAAA,GAAA,SAAA,GAAa,EAAC,EAAG,KAAK,GAAG,CAAA;AAC9C,EAAA,SAAA,CAAU,MAAM;AACd,IAAA,IAAI,MAAA,KAAW,MAAA,IAAa,MAAA,KAAW,MAAA,EAAW;AAChD,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,YAAA,GAAe,oBAAA,CAAqB,MAAA,EAAQ,MAAA,EAAQ;AAAA,MACxD,OAAA;AAAA,MACA,SAAA;AAAA,MACA,UAAA;AAAA,MACA,IAAA;AAAA,MACA,QAAA,EAAU,UAAA,GAAa,EAAE,GAAA,EAAK,SAAQ,GAAI;AAAA,KAC3C,CAAA;AAED,IAAA,OAAO,MAAM,aAAa,OAAA,EAAQ;AAAA,EAEpC,CAAA,EAAG,CAAC,MAAA,EAAQ,MAAA,EAAQ,OAAA,EAAS,YAAY,WAAA,EAAa,UAAA,EAAY,IAAA,EAAM,OAAO,CAAC,CAAA;AAEhF,EAAA,OAAO,OAAA;AACT;;;;"}

package/dist/esm/secret-scanner/react/useSecretScanner.js

@@ -0,0 +1,57 @@
+import { useMemo, useState, useEffect, useCallback } from 'react';
+import { createCodeScanner } from '../core/scanCode.js';
+import '../core/detection/ruleDetectors.js';
+import { DEFAULT_DEBOUNCE_MS } from '../core/constants.js';
+import { k6SecretRewriter } from '../core/k6Rewriter.js';
+import { useIgnoredSecrets } from './useIgnoredSecrets.js';
+
+function useSecretScanner(params) {
+  const {
+    text,
+    scan,
+    rewriter = k6SecretRewriter,
+    onChange,
+    enabled = true,
+    ignoreStorageKey,
+    debounceMs = DEFAULT_DEBOUNCE_MS
+  } = params;
+  const defaultScan = useMemo(() => createCodeScanner(), []);
+  const scanner = scan != null ? scan : defaultScan;
+  const { isIgnored, ignore } = useIgnoredSecrets(ignoreStorageKey);
+  const [activeFinding, setActiveFinding] = useState(null);
+  const [pendingReference, setPendingReference] = useState(null);
+  const [findings, setFindings] = useState(() => enabled ? scanner(text) : []);
+  useEffect(() => {
+    if (!enabled) {
+      setFindings([]);
+      return;
+    }
+    const handle = setTimeout(() => setFindings(scanner(text)), debounceMs);
+    return () => clearTimeout(handle);
+  }, [text, debounceMs, enabled, scanner]);
+  const visible = useMemo(() => findings.filter((finding) => !isIgnored(finding)), [findings, isIgnored]);
+  const request = useCallback((finding) => setActiveFinding(finding), []);
+  const cancel = useCallback(() => setActiveFinding(null), []);
+  const dismiss = useCallback(() => setPendingReference(null), []);
+  const apply = useCallback(
+    (finding, secretName) => {
+      const result = onChange ? rewriter.apply(text, finding, secretName) : void 0;
+      if (result == null ? void 0 : result.applied) {
+        onChange(result.text);
+      } else {
+        setPendingReference({ finding, secretName, reference: rewriter.reference(secretName) });
+      }
+      setActiveFinding(null);
+    },
+    [text, onChange, rewriter]
+  );
+  const migration = useMemo(
+    () => ({ finding: activeFinding, request, cancel, apply }),
+    [activeFinding, request, cancel, apply]
+  );
+  const reference = useMemo(() => ({ pending: pendingReference, dismiss }), [pendingReference, dismiss]);
+  return { findings: visible, ignore, migration, reference };
+}
+
+export { useSecretScanner };
+//# sourceMappingURL=useSecretScanner.js.map