@hardkas/core 0.2.1-alpha → 0.2.2-alpha.1

package/dist/index.d.ts

@@ -276,6 +276,16 @@ type UnknownEventPayload = {
  */
 type Branded<K, T> = Brand<T, K extends string ? K : string>;
 
+/**
+ * Redacts sensitive information from strings and objects recursively.
+ * Masks Kaspa private keys (64 hex chars) and mnemonics.
+ */
+declare function maskSecrets(data: any): any;
+/**
+ * Legacy single-value redaction for backward compatibility.
+ */
+declare function redactSecret(value: string): string;
+
 declare const SOMPI_PER_KAS = 100000000n;
 declare const kaspaNetworkIdSchema: z.ZodEnum<["mainnet", "testnet-10", "testnet-11", "testnet-12", "simnet", "simnet-1", "devnet"]>;
 type NetworkId = Brand<z.infer<typeof kaspaNetworkIdSchema>, "NetworkId">;
@@ -352,8 +362,18 @@ declare class HardkasError extends Error {
         cause?: unknown;
     });
 }
+type InvariantDomain = "semantic" | "replay" | "provenance" | "structural" | "operational";
+type InvariantSeverity = "warning" | "error" | "fatal";
+declare class InvariantViolationError extends HardkasError {
+    readonly domain: InvariantDomain;
+    readonly severity: InvariantSeverity;
+    constructor(domain: InvariantDomain, message: string, options?: {
+        severity?: InvariantSeverity;
+        cause?: unknown;
+    });
+}
 declare function parseHardkasConfig(input: unknown): HardkasConfig;
 declare function parseKasToSompi(input: string): bigint;
 declare function formatSompi(amountSompi: bigint): string;
 
-export { type ArtifactId, type ArtifactType, ArtifactTypeSchema, type Brand, type Branded, type ContentHash, type CoreEvent, type CoreEventListener, type CorrelationId, type DaaScore, type EventDomain, type EventEnvelope, type EventId, type EventKind, type EventPayloadByKind, type EventSequence, type ExecutionMode, ExecutionModeSchema, type HardkasConfig, HardkasError, type KaspaAddress, type LineageId, type NetworkId, NetworkIdSchema, type RpcEndpointId, SOMPI_PER_KAS, type StampedEvent, type TxId, type UnknownEventPayload, type WorkflowId, artifactTypeSchema, asArtifactId, asContentHash, asCorrelationId, asDaaScore, asEventId, asEventSequence, asKaspaAddress, asLineageId, asNetworkId, asRpcEndpointId, asTxId, asWorkflowId, coreEvents, createEventEnvelope, executionModeSchema, formatSompi, hardkasConfigSchema, kaspaNetworkIdSchema, parseHardkasConfig, parseKasToSompi, validateEventEnvelope };
+export { type ArtifactId, type ArtifactType, ArtifactTypeSchema, type Brand, type Branded, type ContentHash, type CoreEvent, type CoreEventListener, type CorrelationId, type DaaScore, type EventDomain, type EventEnvelope, type EventId, type EventKind, type EventPayloadByKind, type EventSequence, type ExecutionMode, ExecutionModeSchema, type HardkasConfig, HardkasError, type InvariantDomain, type InvariantSeverity, InvariantViolationError, type KaspaAddress, type LineageId, type NetworkId, NetworkIdSchema, type RpcEndpointId, SOMPI_PER_KAS, type StampedEvent, type TxId, type UnknownEventPayload, type WorkflowId, artifactTypeSchema, asArtifactId, asContentHash, asCorrelationId, asDaaScore, asEventId, asEventSequence, asKaspaAddress, asLineageId, asNetworkId, asRpcEndpointId, asTxId, asWorkflowId, coreEvents, createEventEnvelope, executionModeSchema, formatSompi, hardkasConfigSchema, kaspaNetworkIdSchema, maskSecrets, parseHardkasConfig, parseKasToSompi, redactSecret, validateEventEnvelope };

package/dist/index.js

@@ -77,6 +77,40 @@ var asNetworkId = (id) => id;
 var asEventSequence = (seq) => seq;
 var asDaaScore = (score) => score;
 
+// src/security.ts
+function maskSecrets(data) {
+  if (data === null || data === void 0) return data;
+  if (typeof data === "string") {
+    let redacted = data.replace(/\b[0-9a-fA-F]{64}\b/g, (match) => {
+      return `${match.slice(0, 6)}...${match.slice(-4)} [REDACTED]`;
+    });
+    redacted = redacted.replace(/\b([a-z]{3,10}\s+){11,23}[a-z]{3,10}\b/g, "[MNEMONIC REDACTED]");
+    return redacted;
+  }
+  if (Array.isArray(data)) {
+    return data.map((item) => maskSecrets(item));
+  }
+  if (typeof data === "object") {
+    const redactedObj = {};
+    for (const key in data) {
+      if (Object.prototype.hasOwnProperty.call(data, key)) {
+        if (key.toLowerCase().includes("secret") || key.toLowerCase().includes("privatekey") || key.toLowerCase().includes("mnemonic") || key.toLowerCase().includes("password")) {
+          redactedObj[key] = "[REDACTED]";
+        } else {
+          redactedObj[key] = maskSecrets(data[key]);
+        }
+      }
+    }
+    return redactedObj;
+  }
+  return data;
+}
+function redactSecret(value) {
+  if (!value) return "";
+  if (value.length <= 10) return "***";
+  return `${value.slice(0, 6)}...${value.slice(-4)}`;
+}
+
 // src/index.ts
 var SOMPI_PER_KAS = 100000000n;
 var kaspaNetworkIdSchema = z.enum([
@@ -127,6 +161,16 @@ var HardkasError = class extends Error {
     this.cause = options?.cause;
   }
 };
+var InvariantViolationError = class extends HardkasError {
+  domain;
+  severity;
+  constructor(domain, message, options) {
+    super(`INVARIANT_VIOLATION_${domain.toUpperCase()}`, message, { cause: options?.cause });
+    this.name = "InvariantViolationError";
+    this.domain = domain;
+    this.severity = options?.severity || "fatal";
+  }
+};
 function parseHardkasConfig(input) {
   const result = hardkasConfigSchema.safeParse(input);
   if (!result.success) {
@@ -160,6 +204,7 @@ export {
   ArtifactTypeSchema,
   ExecutionModeSchema,
   HardkasError,
+  InvariantViolationError,
   NetworkIdSchema,
   SOMPI_PER_KAS,
   artifactTypeSchema,
@@ -181,7 +226,9 @@ export {
   formatSompi,
   hardkasConfigSchema,
   kaspaNetworkIdSchema,
+  maskSecrets,
   parseHardkasConfig,
   parseKasToSompi,
+  redactSecret,
   validateEventEnvelope
 };

package/package.json

@@ -1,11 +1,14 @@
 {
   "name": "@hardkas/core",
-  "version": "0.2.1-alpha",
+  "version": "0.2.2-alpha.1",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {
-    ".": "./dist/index.js"
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
   },
   "dependencies": {
     "pino": "^9.5.0",