@grafana/sigil-sdk-js-core 0.0.0 → 0.6.0

package/dist/redaction.js

@@ -0,0 +1,155 @@
+import { cloneGeneration } from './utils.js';
+// --- Tier 1: High-confidence patterns (definite secret formats) ---
+const tier1Patterns = [
+    { id: 'grafana-cloud-token', regex: /\bglc_[A-Za-z0-9_-]{20,}/g },
+    { id: 'grafana-service-account-token', regex: /\bglsa_[A-Za-z0-9_-]{20,}/g },
+    { id: 'aws-access-token', regex: /\b(?:A3T[A-Z0-9]|AKIA|ASIA|ABIA|ACCA)[A-Z2-7]{16}\b/g },
+    { id: 'github-pat', regex: /\bghp_[A-Za-z0-9_]{36,}/g },
+    { id: 'github-oauth', regex: /\bgho_[A-Za-z0-9_]{36,}/g },
+    { id: 'github-app-token', regex: /\bghs_[A-Za-z0-9_]{36,}/g },
+    { id: 'github-fine-grained-pat', regex: /\bgithub_pat_[A-Za-z0-9_]{82}/g },
+    { id: 'anthropic-api-key', regex: /\bsk-ant-api03-[a-zA-Z0-9_-]{93}AA/g },
+    { id: 'anthropic-admin-key', regex: /\bsk-ant-admin01-[a-zA-Z0-9_-]{93}AA/g },
+    { id: 'openai-api-key', regex: /\bsk-[a-zA-Z0-9]{20}T3BlbkFJ[a-zA-Z0-9]{20}/g },
+    { id: 'openai-project-key', regex: /\bsk-proj-[a-zA-Z0-9_-]{40,}/g },
+    { id: 'openai-svcacct-key', regex: /\bsk-svcacct-[a-zA-Z0-9_-]{40,}/g },
+    { id: 'gcp-api-key', regex: /\bAIza[A-Za-z0-9_-]{35}/g },
+    { id: 'private-key', regex: /-----BEGIN[A-Z ]*PRIVATE KEY-----[\s\S]*?-----END[A-Z ]*PRIVATE KEY-----/g },
+    { id: 'connection-string', regex: /(?:postgres|mysql|mongodb|redis|amqp):\/\/[^\s'"]+@[^\s'"]+/g },
+    { id: 'bearer-token', regex: /[Bb]earer\s+[A-Za-z0-9_.\-~+/]{20,}={0,3}/g },
+    { id: 'slack-token', regex: /\bxox[bporas]-[A-Za-z0-9-]{10,}/g },
+    { id: 'stripe-key', regex: /\b[sr]k_(?:live|test)_[A-Za-z0-9]{20,}/g },
+    { id: 'sendgrid-api-key', regex: /\bSG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}/g },
+    { id: 'twilio-api-key', regex: /\bSK[a-f0-9]{32}/g },
+    { id: 'npm-token', regex: /\bnpm_[A-Za-z0-9]{36}/g },
+    { id: 'pypi-token', regex: /\bpypi-[A-Za-z0-9_-]{50,}/g },
+];
+const emailPattern = {
+    id: 'email',
+    regex: /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi,
+};
+// --- Tier 2: Heuristic patterns (env file values) ---
+const tier2Patterns = [
+    {
+        id: 'env-secret-value',
+        regex: /((?:PASSWORD|SECRET|TOKEN|KEY|CREDENTIAL|API_KEY|PRIVATE_KEY|ACCESS_KEY)\s*[=:]\s*)(\S+)/gi,
+    },
+];
+class SecretRedactor {
+    includeEmailAddresses;
+    constructor(includeEmailAddresses) {
+        this.includeEmailAddresses = includeEmailAddresses;
+    }
+    /** Full redaction: tier 1 + tier 2. Use for tool call args and tool results. */
+    redact(text) {
+        let result = applyPatterns(text, tier1Patterns);
+        if (this.includeEmailAddresses) {
+            result = applyPattern(result, emailPattern);
+        }
+        return applyTier2Patterns(result, tier2Patterns);
+    }
+    /** Lightweight redaction: tier 1 only. Use for assistant text and reasoning. */
+    redactLightweight(text) {
+        let result = applyPatterns(text, tier1Patterns);
+        if (this.includeEmailAddresses) {
+            result = applyPattern(result, emailPattern);
+        }
+        return result;
+    }
+}
+export function createSecretRedactionSanitizer(options = {}) {
+    const redactor = new SecretRedactor(options.redactEmailAddresses ?? true);
+    const redactInputMessages = options.redactInputMessages ?? false;
+    return (generation) => {
+        const sanitized = cloneGeneration(generation);
+        if (sanitized.systemPrompt !== undefined) {
+            sanitized.systemPrompt = redactor.redactLightweight(sanitized.systemPrompt);
+        }
+        if (sanitized.conversationTitle !== undefined) {
+            sanitized.conversationTitle = redactor.redactLightweight(sanitized.conversationTitle);
+        }
+        if (sanitized.callError !== undefined) {
+            sanitized.callError = redactor.redactLightweight(sanitized.callError);
+        }
+        for (const message of sanitized.input ?? []) {
+            sanitizeMessage(message, redactor, message.role === 'user'
+                ? redactInputMessages
+                    ? 'full'
+                    : 'none'
+                : message.role === 'assistant'
+                    ? 'light'
+                    : message.role === 'tool'
+                        ? 'full'
+                        : 'none');
+        }
+        for (const message of sanitized.output ?? []) {
+            sanitizeMessage(message, redactor, message.role === 'assistant' ? 'light' : message.role === 'tool' ? 'full' : 'none');
+        }
+        return sanitized;
+    };
+}
+function sanitizeMessage(message, redactor, defaultTextMode) {
+    if (typeof message.content === 'string') {
+        message.content = redactString(message.content, redactor, defaultTextMode);
+    }
+    for (const part of message.parts ?? []) {
+        sanitizePart(part, redactor, defaultTextMode);
+    }
+}
+function sanitizePart(part, redactor, defaultTextMode) {
+    switch (part.type) {
+        case 'text':
+            part.text = redactString(part.text, redactor, defaultTextMode);
+            break;
+        case 'thinking':
+            if (defaultTextMode !== 'none') {
+                part.thinking = redactor.redactLightweight(part.thinking);
+            }
+            break;
+        case 'tool_call':
+            if (defaultTextMode !== 'none' && typeof part.toolCall.inputJSON === 'string') {
+                part.toolCall.inputJSON = redactor.redact(part.toolCall.inputJSON);
+            }
+            break;
+        case 'tool_result':
+            if (defaultTextMode !== 'none') {
+                if (typeof part.toolResult.content === 'string') {
+                    part.toolResult.content = redactor.redact(part.toolResult.content);
+                }
+                if (typeof part.toolResult.contentJSON === 'string') {
+                    part.toolResult.contentJSON = redactor.redact(part.toolResult.contentJSON);
+                }
+            }
+            break;
+    }
+}
+function redactString(value, redactor, mode) {
+    switch (mode) {
+        case 'full':
+            return redactor.redact(value);
+        case 'light':
+            return redactor.redactLightweight(value);
+        default:
+            return value;
+    }
+}
+function applyPatterns(text, patterns) {
+    let result = text;
+    for (const pattern of patterns) {
+        result = applyPattern(result, pattern);
+    }
+    return result;
+}
+function applyPattern(text, pattern) {
+    pattern.regex.lastIndex = 0;
+    return text.replace(pattern.regex, `[REDACTED:${pattern.id}]`);
+}
+function applyTier2Patterns(text, patterns) {
+    let result = text;
+    for (const pattern of patterns) {
+        pattern.regex.lastIndex = 0;
+        result = result.replace(pattern.regex, `$1[REDACTED:${pattern.id}]`);
+    }
+    return result;
+}
+//# sourceMappingURL=redaction.js.map

package/dist/redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../../js/src/redaction.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAgC7C,qEAAqE;AACrE,MAAM,aAAa,GAAoB;IACrC,EAAE,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,2BAA2B,EAAE;IACjE,EAAE,EAAE,EAAE,+BAA+B,EAAE,KAAK,EAAE,4BAA4B,EAAE;IAC5E,EAAE,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,sDAAsD,EAAE;IACzF,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,0BAA0B,EAAE;IACvD,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,0BAA0B,EAAE;IACzD,EAAE,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,0BAA0B,EAAE;IAC7D,EAAE,EAAE,EAAE,yBAAyB,EAAE,KAAK,EAAE,gCAAgC,EAAE;IAC1E,EAAE,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,qCAAqC,EAAE;IACzE,EAAE,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,uCAAuC,EAAE;IAC7E,EAAE,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,8CAA8C,EAAE;IAC/E,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,+BAA+B,EAAE;IACpE,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,kCAAkC,EAAE;IACvE,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,0BAA0B,EAAE;IACxD,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,2EAA2E,EAAE;IACzG,EAAE,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,8DAA8D,EAAE;IAClG,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,4CAA4C,EAAE;IAC3E,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,kCAAkC,EAAE;IAChE,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,yCAAyC,EAAE;IACtE,EAAE,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,6CAA6C,EAAE;IAChF,EAAE,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,mBAAmB,EAAE;IACpD,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,wBAAwB,EAAE;IACpD,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,4BAA4B,EAAE;CAC1D,CAAC;AAEF,MAAM,YAAY,GAAkB;IAClC,EAAE,EAAE,OAAO;IACX,KAAK,EAAE,6CAA6C;CACrD,CAAC;AAEF,uDAAuD;AACvD,MAAM,aAAa,GAAoB;IACrC;QACE,EAAE,EAAE,kBAAkB;QACtB,KAAK,EAAE,4FAA4F;KACpG;CACF,CAAC;AAEF,MAAM,cAAc;IACD,qBAAqB,CAAU;IAEhD,YAAY,qBAA8B;QACxC,IAAI,CAAC,qBAAqB,GAAG,qBAAqB,CAAC;IACrD,CAAC;IAED,gFAAgF;IAChF,MAAM,CAAC,IAAY;QACjB,IAAI,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QAChD,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC/B,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,kBAAkB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACnD,CAAC;IAED,gFAAgF;IAChF,iBAAiB,CAAC,IAAY;QAC5B,IAAI,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QAChD,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC/B,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAED,MAAM,UAAU,8BAA8B,CAAC,UAAkC,EAAE;IACjF,MAAM,QAAQ,GAAG,IAAI,cAAc,CAAC,OAAO,CAAC,oBAAoB,IAAI,IAAI,CAAC,CAAC;IAC1E,MAAM,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,IAAI,KAAK,CAAC;IAEjE,OAAO,CAAC,UAAU,EAAE,EAAE;QACpB,MAAM,SAAS,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;QAE9C,IAAI,SAAS,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACzC,SAAS,CAAC,YAAY,GAAG,QAAQ,CAAC,iBAAiB,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,SAAS,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YAC9C,SAAS,CAAC,iBAAiB,GAAG,QAAQ,CAAC,iBAAiB,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QACxF,CAAC;QACD,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACtC,SAAS,CAAC,SAAS,GAAG,QAAQ,CAAC,iBAAiB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACxE,CAAC;QAED,KAAK,MAAM,OAAO,IAAI,SAAS,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YAC5C,eAAe,CACb,OAAO,EACP,QAAQ,EACR,OAAO,CAAC,IAAI,KAAK,MAAM;gBACrB,CAAC,CAAC,mBAAmB;oBACnB,CAAC,CAAC,MAAM;oBACR,CAAC,CAAC,MAAM;gBACV,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,WAAW;oBAC5B,CAAC,CAAC,OAAO;oBACT,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM;wBACvB,CAAC,CAAC,MAAM;wBACR,CAAC,CAAC,MAAM,CACf,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,SAAS,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YAC7C,eAAe,CACb,OAAO,EACP,QAAQ,EACR,OAAO,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CACnF,CAAC;QACJ,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,OAAgB,EAAE,QAAwB,EAAE,eAA0C;IAC7G,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,CAAC,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC7E,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QACvC,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAAiB,EAAE,QAAwB,EAAE,eAA0C;IAC3G,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,MAAM;YACT,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;YAC/D,MAAM;QACR,KAAK,UAAU;YACb,IAAI,eAAe,KAAK,MAAM,EAAE,CAAC;gBAC/B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC5D,CAAC;YACD,MAAM;QACR,KAAK,WAAW;YACd,IAAI,eAAe,KAAK,MAAM,IAAI,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAC9E,IAAI,CAAC,QAAQ,CAAC,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YACrE,CAAC;YACD,MAAM;QACR,KAAK,aAAa;YAChB,IAAI,eAAe,KAAK,MAAM,EAAE,CAAC;gBAC/B,IAAI,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;oBAChD,IAAI,CAAC,UAAU,CAAC,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;gBACrE,CAAC;gBACD,IAAI,OAAO,IAAI,CAAC,UAAU,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;oBACpD,IAAI,CAAC,UAAU,CAAC,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;gBAC7E,CAAC;YACH,CAAC;YACD,MAAM;IACV,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,QAAwB,EAAE,IAA+B;IAC5F,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,MAAM;YACT,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,KAAK,OAAO;YACV,OAAO,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC3C;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,QAAyB;IAC5D,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,OAAsB;IACxD,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;IAC5B,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,aAAa,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY,EAAE,QAAyB;IACjE,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;QAC5B,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,eAAe,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}