@id-wispera/core 0.1.0

package/dist/delegation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation.js","sourceRoot":"","sources":["../src/delegation.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAGL,YAAY,GACb,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,+EAA+E;AAC/E,8BAA8B;AAC9B,+EAA+E;AAE/E;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAY,EACZ,UAAkB,EAClB,UAA4C,EAC5C,KAAa;IAEb,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC1D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,YAAY,CAAC,uBAAuB,UAAU,EAAE,EAAE,oBAAoB,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,GAAG,GAAkB;QACzB,GAAG,UAAU;QACb,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IAEF,MAAM,YAAY,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,eAAe,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IAEhE,MAAM,OAAO,GAAa;QACxB,GAAG,QAAQ;QACX,eAAe,EAAE,YAAY;QAC7B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IAEF,MAAM,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAEnC,MAAM,SAAS,CAAC,KAAK,EAAE;QACrB,UAAU;QACV,MAAM,EAAE,UAAU;QAClB,KAAK;QACL,OAAO,EAAE,8BAA8B,UAAU,CAAC,IAAI,SAAS,UAAU,CAAC,EAAE,GAAG;QAC/E,QAAQ,EAAE;YACR,cAAc,EAAE,UAAU,CAAC,IAAI;YAC/B,YAAY,EAAE,UAAU,CAAC,EAAE;YAC3B,eAAe,EAAE,UAAU,CAAC,KAAK;SAClC;KACF,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAY,EACZ,UAAkB,EAClB,KAAa;IAEb,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC1D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,YAAY,CAAC,uBAAuB,UAAU,EAAE,EAAE,oBAAoB,CAAC,CAAC;IACpF,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,eAAe,IAAI,QAAQ,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,YAAY,CAAC,yBAAyB,EAAE,eAAe,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,UAAU,GAAG,QAAQ,CAAC,eAAe,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACjF,MAAM,YAAY,GAAG,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAE3D,MAAM,OAAO,GAAa;QACxB,GAAG,QAAQ;QACX,eAAe,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;QACnE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IAEF,MAAM,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAEnC,MAAM,SAAS,CAAC,KAAK,EAAE;QACrB,UAAU;QACV,MAAM,EAAE,UAAU;QAClB,KAAK;QACL,OAAO,EAAE,4BAA4B,UAAU,EAAE,IAAI,SAAS,UAAU,EAAE,EAAE,GAAG;QAC/E,QAAQ,EAAE;YACR,iBAAiB,EAAE,UAAU;SAC9B;KACF,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAY,EACZ,UAAkB,EAClB,KAAa;IAEb,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC1D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,YAAY,CAAC,uBAAuB,UAAU,EAAE,EAAE,oBAAoB,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,aAAa,GAAG,QAAQ,CAAC,eAAe,CAAC;IAE/C,MAAM,OAAO,GAAa;QACxB,GAAG,QAAQ;QACX,eAAe,EAAE,SAAS;QAC1B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IAEF,MAAM,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAEnC,MAAM,SAAS,CAAC,KAAK,EAAE;QACrB,UAAU;QACV,MAAM,EAAE,UAAU;QAClB,KAAK;QACL,OAAO,EAAE,4BAA4B,aAAa,EAAE,MAAM,IAAI,CAAC,gBAAgB;QAC/E,QAAQ,EAAE;YACR,kBAAkB,EAAE,aAAa;SAClC;KACF,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,+EAA+E;AAC/E,4BAA4B;AAC5B,+EAA+E;AAE/E;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAkB;IACnD,OAAO,QAAQ,CAAC,eAAe,EAAE,MAAM,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAkB;IACjD,IAAI,CAAC,QAAQ,CAAC,eAAe,IAAI,QAAQ,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvE,OAAO,QAAQ,CAAC,UAAU,CAAC;IAC7B,CAAC;IACD,OAAO,QAAQ,CAAC,eAAe,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,IAAI,QAAQ,CAAC,UAAU,CAAC;AAClG,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAkB;IAClD,OAAO,QAAQ,CAAC,UAAU,CAAC;AAC7B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAkB;IACxD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IAEpD,IAAI,QAAQ,CAAC,eAAe,EAAE,CAAC;QAC7B,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,eAAe,EAAE,CAAC;YAC3C,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACnB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAkB,EAAE,MAAc;IACpE,IAAI,QAAQ,CAAC,UAAU,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAEhD,IAAI,QAAQ,CAAC,eAAe,EAAE,CAAC;QAC7B,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,eAAe,EAAE,CAAC;YAC3C,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,IAAI,GAAG,CAAC,EAAE,KAAK,MAAM;gBAAE,OAAO,IAAI,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAkB;IAClD,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAEpC,IAAI,QAAQ,CAAC,eAAe,EAAE,CAAC;QAC7B,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,eAAe,EAAE,CAAC;YAC3C,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAkB;IACrD,IAAI,CAAC,QAAQ,CAAC,eAAe;QAAE,OAAO,KAAK,CAAC;IAE5C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,OAAO,QAAQ,CAAC,eAAe,CAAC,IAAI,CAClC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,GAAG,CACxD,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAkB;IACtD,IAAI,CAAC,QAAQ,CAAC,eAAe;QAAE,OAAO,EAAE,CAAC;IAEzC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,OAAO,QAAQ,CAAC,eAAe,CAAC,MAAM,CACpC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,GAAG,CACxD,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAkB,EAClB,aAAqB,CAAC;IAEtB,IAAI,CAAC,QAAQ,CAAC,eAAe;QAAE,OAAO,EAAE,CAAC;IAEzC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,UAAU,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAE7E,OAAO,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;QAC7C,IAAI,CAAC,GAAG,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QACjC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1C,OAAO,SAAS,GAAG,GAAG,IAAI,SAAS,IAAI,SAAS,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,+EAA+E;AAC/E,4BAA4B;AAC5B,+EAA+E;AAE/E;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAkB;IAClD,uCAAuC;IACvC,IAAI,cAAc,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAE7C,wDAAwD;IACxD,IAAI,QAAQ,CAAC,eAAe,EAAE,CAAC;QAC7B,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,eAAe,EAAE,CAAC;YAC3C,IAAI,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBAC1C,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;oBAC/B,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;wBAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACvD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AACpC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAkB,EAAE,KAAa;IAChE,MAAM,cAAc,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACnD,OAAO,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACxC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAkB;IAKrD,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC;IACrC,IAAI,YAAY,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IAC1C,MAAM,YAAY,GAA2D,EAAE,CAAC;IAEhF,IAAI,QAAQ,CAAC,eAAe,EAAE,CAAC;QAC7B,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,eAAe,EAAE,CAAC;YAC3C,IAAI,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBAC1C,MAAM,aAAa,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBAE9E,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC7B,YAAY,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,CAAC;gBAC5C,CAAC;gBAED,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,aAAa;QACb,cAAc,EAAE,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC;QACxC,YAAY;KACb,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,wBAAwB;AACxB,+EAA+E;AAE/E;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAkB;IAIxD,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,CAAC,QAAQ,CAAC,eAAe,IAAI,QAAQ,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACrC,CAAC;IAED,iCAAiC;IACjC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IACpD,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,eAAe,EAAE,CAAC;QAC3C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,kCAAkC,GAAG,CAAC,EAAE,0BAA0B,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;IAED,yDAAyD;IACzD,IAAI,YAAY,GAAG,QAAQ,CAAC,UAAU,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzD,MAAM,GAAG,GAAG,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QACxC,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,CACT,uBAAuB,CAAC,GAAG,CAAC,oBAAoB,YAAY,WAAW,GAAG,CAAC,IAAI,GAAG,CACnF,CAAC;QACJ,CAAC;QACD,YAAY,GAAG,GAAG,EAAE,EAAE,IAAI,YAAY,CAAC;IACzC,CAAC;IAED,gCAAgC;IAChC,MAAM,OAAO,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,6BAA6B,CAAC,CAAC;IAC9D,CAAC;IAED,2CAA2C;IAC3C,IAAI,aAAa,GAAgB,IAAI,CAAC;IACtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzD,MAAM,GAAG,GAAG,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QACxC,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACxC,IAAI,aAAa,IAAI,OAAO,GAAG,aAAa,EAAE,CAAC;gBAC7C,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACnE,CAAC;YACD,aAAa,GAAG,OAAO,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC1B,MAAM;KACP,CAAC;AACJ,CAAC"}

package/dist/detection.d.ts

@@ -0,0 +1,35 @@
+/**
+ * ID Wispera Credential Detection
+ * Regex + heuristic patterns for detecting exposed credentials
+ */
+import { CredentialType, DetectionResult } from './types.js';
+/**
+ * Detect credentials in text
+ * Returns array of detected credentials with type, position, and confidence
+ */
+export declare function detectCredentials(text: string): DetectionResult[];
+/**
+ * Classify a known credential value
+ * Returns the most likely credential type
+ */
+export declare function classifyCredential(value: string): CredentialType;
+/**
+ * Check if text likely contains credentials
+ * Quick check without full detection (faster)
+ */
+export declare function mightContainCredentials(text: string): boolean;
+/**
+ * Mask detected credentials in text
+ * Returns text with credentials replaced by masked versions
+ */
+export declare function maskCredentialsInText(text: string): string;
+/**
+ * Get statistics about detections
+ */
+export declare function getDetectionStats(results: DetectionResult[]): {
+    total: number;
+    byType: Record<CredentialType, number>;
+    highConfidence: number;
+    averageConfidence: number;
+};
+//# sourceMappingURL=detection.d.ts.map

package/dist/detection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detection.d.ts","sourceRoot":"","sources":["../src/detection.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AA2W7D;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,EAAE,CAoEjE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,CA4BhE;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAgB7D;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAc1D;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,eAAe,EAAE,GAAG;IAC7D,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IACvC,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,EAAE,MAAM,CAAC;CAC3B,CAgBA"}

package/dist/detection.js

@@ -0,0 +1,474 @@
+/**
+ * ID Wispera Credential Detection
+ * Regex + heuristic patterns for detecting exposed credentials
+ */
+import { maskValue } from './utils.js';
+/**
+ * Known credential patterns
+ * Each pattern includes a confidence score (0-1) indicating how certain we are
+ */
+const DETECTION_PATTERNS = [
+    // OpenAI API Keys
+    {
+        type: 'api-key',
+        name: 'OpenAI API Key',
+        pattern: /sk-[a-zA-Z0-9]{20,}T3BlbkFJ[a-zA-Z0-9]{20,}/g,
+        confidence: 0.99,
+    },
+    {
+        type: 'api-key',
+        name: 'OpenAI Project Key',
+        pattern: /sk-proj-[a-zA-Z0-9_-]{20,}/g,
+        confidence: 0.99,
+    },
+    {
+        type: 'api-key',
+        name: 'OpenAI Service Account Key',
+        pattern: /sk-svcacct-[a-zA-Z0-9_-]{20,}/g,
+        confidence: 0.99,
+    },
+    {
+        type: 'api-key',
+        name: 'OpenAI Key (legacy)',
+        pattern: /sk-[a-zA-Z0-9]{32,}/g,
+        confidence: 0.85,
+    },
+    // Anthropic API Keys
+    {
+        type: 'api-key',
+        name: 'Anthropic API Key',
+        pattern: /sk-ant-[a-zA-Z0-9_-]{90,}/g,
+        confidence: 0.99,
+    },
+    // AWS Credentials
+    {
+        type: 'api-key',
+        name: 'AWS Access Key ID',
+        pattern: /AKIA[0-9A-Z]{16}/g,
+        confidence: 0.99,
+    },
+    {
+        type: 'secret',
+        name: 'AWS Secret Access Key',
+        pattern: /(?<![A-Za-z0-9/+=])[A-Za-z0-9/+=]{40}(?![A-Za-z0-9/+=])/g,
+        confidence: 0.5, // Low confidence without context
+        validate: (match) => /^[A-Za-z0-9/+=]{40}$/.test(match) && !/^[A-Za-z]+$/.test(match),
+    },
+    // GitHub Tokens
+    {
+        type: 'api-key',
+        name: 'GitHub Personal Access Token',
+        pattern: /ghp_[a-zA-Z0-9]{36}/g,
+        confidence: 0.99,
+    },
+    {
+        type: 'api-key',
+        name: 'GitHub OAuth Token',
+        pattern: /gho_[a-zA-Z0-9]{36}/g,
+        confidence: 0.99,
+    },
+    {
+        type: 'api-key',
+        name: 'GitHub App Token',
+        pattern: /ghu_[a-zA-Z0-9]{36}/g,
+        confidence: 0.99,
+    },
+    {
+        type: 'api-key',
+        name: 'GitHub Server Token',
+        pattern: /ghs_[a-zA-Z0-9]{36}/g,
+        confidence: 0.99,
+    },
+    {
+        type: 'api-key',
+        name: 'GitHub Refresh Token',
+        pattern: /ghr_[a-zA-Z0-9]{36}/g,
+        confidence: 0.99,
+    },
+    // Google Cloud
+    {
+        type: 'api-key',
+        name: 'Google API Key',
+        pattern: /AIza[0-9A-Za-z_-]{35}/g,
+        confidence: 0.95,
+    },
+    {
+        type: 'oauth-token',
+        name: 'Google OAuth Token',
+        pattern: /ya29\.[0-9A-Za-z_-]+/g,
+        confidence: 0.9,
+    },
+    // Azure
+    {
+        type: 'api-key',
+        name: 'Azure Storage Key',
+        pattern: /[a-zA-Z0-9+/]{86}==/g,
+        confidence: 0.6,
+        validate: (match) => match.length === 88,
+    },
+    // Stripe
+    {
+        type: 'api-key',
+        name: 'Stripe Secret Key',
+        pattern: /sk_live_[a-zA-Z0-9]{24,}/g,
+        confidence: 0.99,
+    },
+    {
+        type: 'api-key',
+        name: 'Stripe Test Key',
+        pattern: /sk_test_[a-zA-Z0-9]{24,}/g,
+        confidence: 0.99,
+    },
+    {
+        type: 'api-key',
+        name: 'Stripe Restricted Key',
+        pattern: /rk_live_[a-zA-Z0-9]{24,}/g,
+        confidence: 0.99,
+    },
+    // Twilio
+    {
+        type: 'api-key',
+        name: 'Twilio API Key',
+        pattern: /SK[a-f0-9]{32}/g,
+        confidence: 0.9,
+    },
+    // Slack
+    {
+        type: 'api-key',
+        name: 'Slack Bot Token',
+        pattern: /xoxb-[0-9]{10,}-[0-9]{10,}-[a-zA-Z0-9]{24}/g,
+        confidence: 0.99,
+    },
+    {
+        type: 'api-key',
+        name: 'Slack User Token',
+        pattern: /xoxp-[0-9]{10,}-[0-9]{10,}-[a-zA-Z0-9]{24}/g,
+        confidence: 0.99,
+    },
+    {
+        type: 'api-key',
+        name: 'Slack Webhook',
+        pattern: /https:\/\/hooks\.slack\.com\/services\/T[a-zA-Z0-9_]+\/B[a-zA-Z0-9_]+\/[a-zA-Z0-9_]+/g,
+        confidence: 0.99,
+    },
+    // Discord
+    {
+        type: 'api-key',
+        name: 'Discord Bot Token',
+        pattern: /[MN][A-Za-z\d]{23,}\.[\w-]{6}\.[\w-]{27}/g,
+        confidence: 0.9,
+    },
+    {
+        type: 'api-key',
+        name: 'Discord Webhook',
+        pattern: /https:\/\/discord(?:app)?\.com\/api\/webhooks\/[0-9]+\/[a-zA-Z0-9_-]+/g,
+        confidence: 0.99,
+    },
+    // SendGrid
+    {
+        type: 'api-key',
+        name: 'SendGrid API Key',
+        pattern: /SG\.[a-zA-Z0-9_-]{22}\.[a-zA-Z0-9_-]{43}/g,
+        confidence: 0.99,
+    },
+    // Mailgun
+    {
+        type: 'api-key',
+        name: 'Mailgun API Key',
+        pattern: /key-[a-zA-Z0-9]{32}/g,
+        confidence: 0.95,
+    },
+    // npm
+    {
+        type: 'api-key',
+        name: 'npm Access Token',
+        pattern: /npm_[a-zA-Z0-9]{36}/g,
+        confidence: 0.99,
+    },
+    // PyPI
+    {
+        type: 'api-key',
+        name: 'PyPI API Token',
+        pattern: /pypi-[a-zA-Z0-9_-]{100,}/g,
+        confidence: 0.99,
+    },
+    // JWTs
+    {
+        type: 'jwt',
+        name: 'JWT Token',
+        pattern: /eyJ[a-zA-Z0-9_-]*\.eyJ[a-zA-Z0-9_-]*\.[a-zA-Z0-9_-]*/g,
+        confidence: 0.95,
+    },
+    // Private Keys
+    {
+        type: 'private-key',
+        name: 'RSA Private Key',
+        pattern: /-----BEGIN RSA PRIVATE KEY-----[\s\S]*?-----END RSA PRIVATE KEY-----/g,
+        confidence: 0.99,
+    },
+    {
+        type: 'private-key',
+        name: 'Private Key',
+        pattern: /-----BEGIN PRIVATE KEY-----[\s\S]*?-----END PRIVATE KEY-----/g,
+        confidence: 0.99,
+    },
+    {
+        type: 'private-key',
+        name: 'EC Private Key',
+        pattern: /-----BEGIN EC PRIVATE KEY-----[\s\S]*?-----END EC PRIVATE KEY-----/g,
+        confidence: 0.99,
+    },
+    {
+        type: 'private-key',
+        name: 'OpenSSH Private Key',
+        pattern: /-----BEGIN OPENSSH PRIVATE KEY-----[\s\S]*?-----END OPENSSH PRIVATE KEY-----/g,
+        confidence: 0.99,
+    },
+    // Connection Strings
+    {
+        type: 'connection-string',
+        name: 'MongoDB Connection String',
+        pattern: /mongodb(\+srv)?:\/\/[a-zA-Z0-9_-]+:[a-zA-Z0-9_-]+@[a-zA-Z0-9._-]+/g,
+        confidence: 0.95,
+    },
+    {
+        type: 'connection-string',
+        name: 'PostgreSQL Connection String',
+        pattern: /postgres(ql)?:\/\/[a-zA-Z0-9_-]+:[a-zA-Z0-9_-]+@[a-zA-Z0-9._-]+/g,
+        confidence: 0.95,
+    },
+    {
+        type: 'connection-string',
+        name: 'MySQL Connection String',
+        pattern: /mysql:\/\/[a-zA-Z0-9_-]+:[a-zA-Z0-9_-]+@[a-zA-Z0-9._-]+/g,
+        confidence: 0.95,
+    },
+    {
+        type: 'connection-string',
+        name: 'Redis Connection String',
+        pattern: /redis:\/\/[a-zA-Z0-9_-]+:[a-zA-Z0-9_-]+@[a-zA-Z0-9._-]+/g,
+        confidence: 0.95,
+    },
+    // Generic API Key patterns (lower confidence)
+    {
+        type: 'api-key',
+        name: 'Generic API Key',
+        pattern: /(?:api[_-]?key|apikey|api[_-]?secret)['":\s=]+['"]?([a-zA-Z0-9_-]{20,})['"]?/gi,
+        confidence: 0.7,
+    },
+    {
+        type: 'secret',
+        name: 'Generic Secret',
+        pattern: /(?:secret|password|passwd|pwd)['":\s=]+['"]?([a-zA-Z0-9_!@#$%^&*-]{8,})['"]?/gi,
+        confidence: 0.6,
+    },
+    {
+        type: 'api-key',
+        name: 'Bearer Token',
+        pattern: /Bearer\s+[a-zA-Z0-9_-]{20,}/g,
+        confidence: 0.85,
+    },
+    // =====================
+    // OpenClaw-specific patterns
+    // =====================
+    // Telegram Bot Token
+    {
+        type: 'bot-token',
+        name: 'Telegram Bot Token',
+        pattern: /\d{8,10}:[A-Za-z0-9_-]{35}/g,
+        confidence: 0.95,
+    },
+    // Slack Tokens
+    {
+        type: 'bot-token',
+        name: 'Slack App Token',
+        pattern: /xapp-\d+-[A-Z0-9]+-\d+-[a-zA-Z0-9]+/g,
+        confidence: 0.99,
+    },
+    // OpenRouter API Key
+    {
+        type: 'api-key',
+        name: 'OpenRouter API Key',
+        pattern: /sk-or-v1-[a-zA-Z0-9]{48,}/g,
+        confidence: 0.99,
+    },
+    // OpenClaw Gateway Token (40-char hex)
+    {
+        type: 'api-key',
+        name: 'OpenClaw Gateway Token',
+        pattern: /(?:gateway[_-]?token|OPENCLAW_GATEWAY_TOKEN)['":\s=]+['"]?([a-f0-9]{40})['"]?/gi,
+        confidence: 0.9,
+    },
+    // WhatsApp Session Identifiers (in OpenClaw format)
+    {
+        type: 'session-keys',
+        name: 'WhatsApp JID',
+        pattern: /\d{10,15}:\d+@s\.whatsapp\.net/g,
+        confidence: 0.95,
+    },
+    // OpenClaw advSecretKey (base64)
+    {
+        type: 'secret',
+        name: 'OpenClaw Adv Secret Key',
+        pattern: /"advSecretKey"\s*:\s*"([A-Za-z0-9+/=]{20,})"/g,
+        confidence: 0.9,
+    },
+    // OpenClaw noiseKey/signedIdentityKey private keys (base64 in Buffer format)
+    {
+        type: 'private-key',
+        name: 'OpenClaw Buffer Private Key',
+        pattern: /"private"\s*:\s*\{\s*"type"\s*:\s*"Buffer"\s*,\s*"data"\s*:\s*"([A-Za-z0-9+/=]{20,})"/g,
+        confidence: 0.85,
+    },
+];
+// ============================================================================
+// Detection Functions
+// ============================================================================
+/**
+ * Detect credentials in text
+ * Returns array of detected credentials with type, position, and confidence
+ */
+export function detectCredentials(text) {
+    const results = [];
+    const seen = new Set(); // Avoid duplicates
+    for (const patternDef of DETECTION_PATTERNS) {
+        // Reset regex state
+        patternDef.pattern.lastIndex = 0;
+        let match;
+        while ((match = patternDef.pattern.exec(text)) !== null) {
+            const value = match[1] ?? match[0]; // Use capture group if present
+            const key = `${value}-${match.index}`;
+            // Skip if we've already found this exact match
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            // Run validation if present
+            if (patternDef.validate && !patternDef.validate(value)) {
+                continue;
+            }
+            // Calculate line and column
+            const beforeMatch = text.substring(0, match.index);
+            const lines = beforeMatch.split('\n');
+            const line = lines.length;
+            const column = (lines[lines.length - 1]?.length ?? 0) + 1;
+            // Get context (surrounding text)
+            const contextStart = Math.max(0, match.index - 20);
+            const contextEnd = Math.min(text.length, match.index + value.length + 20);
+            const context = text.substring(contextStart, contextEnd);
+            results.push({
+                type: patternDef.type,
+                value: value,
+                startIndex: match.index,
+                endIndex: match.index + match[0].length,
+                confidence: patternDef.confidence,
+                line,
+                column,
+                pattern: patternDef.name,
+                context: context.replace(/\n/g, '\\n'),
+            });
+        }
+    }
+    // Sort by position
+    results.sort((a, b) => a.startIndex - b.startIndex);
+    // Remove overlapping matches (keep higher confidence) - O(n) since results are sorted by startIndex
+    const filtered = [];
+    for (const result of results) {
+        if (filtered.length > 0) {
+            const last = filtered[filtered.length - 1];
+            // Check overlap with the last added result
+            if (last && result.startIndex < last.endIndex) {
+                // Overlapping: keep the one with higher confidence
+                if (result.confidence > last.confidence) {
+                    filtered[filtered.length - 1] = result;
+                }
+                continue;
+            }
+        }
+        filtered.push(result);
+    }
+    return filtered;
+}
+/**
+ * Classify a known credential value
+ * Returns the most likely credential type
+ */
+export function classifyCredential(value) {
+    // Check each pattern
+    for (const patternDef of DETECTION_PATTERNS) {
+        patternDef.pattern.lastIndex = 0;
+        if (patternDef.pattern.test(value)) {
+            if (patternDef.validate && !patternDef.validate(value)) {
+                continue;
+            }
+            if (patternDef.confidence >= 0.8) {
+                return patternDef.type;
+            }
+        }
+    }
+    // Fallback heuristics
+    if (value.startsWith('-----BEGIN') && value.includes('PRIVATE KEY')) {
+        return 'private-key';
+    }
+    if (value.startsWith('eyJ') && value.split('.').length === 3) {
+        return 'jwt';
+    }
+    if (value.includes('://') && value.includes('@')) {
+        return 'connection-string';
+    }
+    return 'custom';
+}
+/**
+ * Check if text likely contains credentials
+ * Quick check without full detection (faster)
+ */
+export function mightContainCredentials(text) {
+    const quickPatterns = [
+        /sk-[a-zA-Z0-9]/,
+        /AKIA[0-9A-Z]/,
+        /ghp_[a-zA-Z0-9]/,
+        /gho_[a-zA-Z0-9]/,
+        /eyJ[a-zA-Z0-9]/,
+        /-----BEGIN.*PRIVATE KEY/,
+        /api[_-]?key/i,
+        /secret[_-]?key/i,
+        /password\s*[=:]/i,
+        /mongodb\+srv:\/\//,
+        /Bearer\s+[a-zA-Z0-9]/,
+    ];
+    return quickPatterns.some((p) => p.test(text));
+}
+/**
+ * Mask detected credentials in text
+ * Returns text with credentials replaced by masked versions
+ */
+export function maskCredentialsInText(text) {
+    const detections = detectCredentials(text);
+    let masked = text;
+    let offset = 0;
+    for (const detection of detections) {
+        const start = detection.startIndex + offset;
+        const end = detection.endIndex + offset;
+        const maskedValue = maskValue(detection.value);
+        masked = masked.substring(0, start) + maskedValue + masked.substring(end);
+        offset += maskedValue.length - (detection.endIndex - detection.startIndex);
+    }
+    return masked;
+}
+/**
+ * Get statistics about detections
+ */
+export function getDetectionStats(results) {
+    const byType = {};
+    for (const result of results) {
+        byType[result.type] = (byType[result.type] ?? 0) + 1;
+    }
+    return {
+        total: results.length,
+        byType: byType,
+        highConfidence: results.filter((r) => r.confidence >= 0.9).length,
+        averageConfidence: results.length > 0
+            ? results.reduce((sum, r) => sum + r.confidence, 0) / results.length
+            : 0,
+    };
+}
+//# sourceMappingURL=detection.js.map

package/dist/detection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detection.js","sourceRoot":"","sources":["../src/detection.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAcvC;;;GAGG;AACH,MAAM,kBAAkB,GAAuB;IAC7C,kBAAkB;IAClB;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,8CAA8C;QACvD,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,6BAA6B;QACtC,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,4BAA4B;QAClC,OAAO,EAAE,gCAAgC;QACzC,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,sBAAsB;QAC/B,UAAU,EAAE,IAAI;KACjB;IAED,qBAAqB;IACrB;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,4BAA4B;QACrC,UAAU,EAAE,IAAI;KACjB;IAED,kBAAkB;IAClB;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,mBAAmB;QAC5B,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,uBAAuB;QAC7B,OAAO,EAAE,0DAA0D;QACnE,UAAU,EAAE,GAAG,EAAE,iCAAiC;QAClD,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;KACtF;IAED,gBAAgB;IAChB;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,8BAA8B;QACpC,OAAO,EAAE,sBAAsB;QAC/B,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,sBAAsB;QAC/B,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,sBAAsB;QAC/B,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,sBAAsB;QAC/B,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,sBAAsB;QAC/B,UAAU,EAAE,IAAI;KACjB;IAED,eAAe;IACf;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,wBAAwB;QACjC,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,aAAa;QACnB,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,uBAAuB;QAChC,UAAU,EAAE,GAAG;KAChB;IAED,QAAQ;IACR;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,sBAAsB;QAC/B,UAAU,EAAE,GAAG;QACf,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,EAAE;KACzC;IAED,SAAS;IACT;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,2BAA2B;QACpC,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,2BAA2B;QACpC,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,uBAAuB;QAC7B,OAAO,EAAE,2BAA2B;QACpC,UAAU,EAAE,IAAI;KACjB;IAED,SAAS;IACT;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,iBAAiB;QAC1B,UAAU,EAAE,GAAG;KAChB;IAED,QAAQ;IACR;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,6CAA6C;QACtD,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,6CAA6C;QACtD,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,uFAAuF;QAChG,UAAU,EAAE,IAAI;KACjB;IAED,UAAU;IACV;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,2CAA2C;QACpD,UAAU,EAAE,GAAG;KAChB;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,wEAAwE;QACjF,UAAU,EAAE,IAAI;KACjB;IAED,WAAW;IACX;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,2CAA2C;QACpD,UAAU,EAAE,IAAI;KACjB;IAED,UAAU;IACV;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,sBAAsB;QAC/B,UAAU,EAAE,IAAI;KACjB;IAED,MAAM;IACN;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,sBAAsB;QAC/B,UAAU,EAAE,IAAI;KACjB;IAED,OAAO;IACP;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,2BAA2B;QACpC,UAAU,EAAE,IAAI;KACjB;IAED,OAAO;IACP;QACE,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,uDAAuD;QAChE,UAAU,EAAE,IAAI;KACjB;IAED,eAAe;IACf;QACE,IAAI,EAAE,aAAa;QACnB,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,uEAAuE;QAChF,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,aAAa;QACnB,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,+DAA+D;QACxE,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,aAAa;QACnB,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,qEAAqE;QAC9E,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,aAAa;QACnB,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,+EAA+E;QACxF,UAAU,EAAE,IAAI;KACjB;IAED,qBAAqB;IACrB;QACE,IAAI,EAAE,mBAAmB;QACzB,IAAI,EAAE,2BAA2B;QACjC,OAAO,EAAE,oEAAoE;QAC7E,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,IAAI,EAAE,8BAA8B;QACpC,OAAO,EAAE,kEAAkE;QAC3E,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,IAAI,EAAE,yBAAyB;QAC/B,OAAO,EAAE,0DAA0D;QACnE,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,IAAI,EAAE,yBAAyB;QAC/B,OAAO,EAAE,0DAA0D;QACnE,UAAU,EAAE,IAAI;KACjB;IAED,8CAA8C;IAC9C;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,gFAAgF;QACzF,UAAU,EAAE,GAAG;KAChB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,gFAAgF;QACzF,UAAU,EAAE,GAAG;KAChB;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,8BAA8B;QACvC,UAAU,EAAE,IAAI;KACjB;IAED,wBAAwB;IACxB,6BAA6B;IAC7B,wBAAwB;IAExB,qBAAqB;IACrB;QACE,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,6BAA6B;QACtC,UAAU,EAAE,IAAI;KACjB;IAED,eAAe;IACf;QACE,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,sCAAsC;QAC/C,UAAU,EAAE,IAAI;KACjB;IAED,qBAAqB;IACrB;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,4BAA4B;QACrC,UAAU,EAAE,IAAI;KACjB;IAED,uCAAuC;IACvC;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,wBAAwB;QAC9B,OAAO,EAAE,iFAAiF;QAC1F,UAAU,EAAE,GAAG;KAChB;IAED,oDAAoD;IACpD;QACE,IAAI,EAAE,cAAc;QACpB,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,iCAAiC;QAC1C,UAAU,EAAE,IAAI;KACjB;IAED,iCAAiC;IACjC;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,yBAAyB;QAC/B,OAAO,EAAE,+CAA+C;QACxD,UAAU,EAAE,GAAG;KAChB;IAED,6EAA6E;IAC7E;QACE,IAAI,EAAE,aAAa;QACnB,IAAI,EAAE,6BAA6B;QACnC,OAAO,EAAE,wFAAwF;QACjG,UAAU,EAAE,IAAI;KACjB;CACF,CAAC;AAEF,+EAA+E;AAC/E,sBAAsB;AACtB,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC,CAAC,mBAAmB;IAEnD,KAAK,MAAM,UAAU,IAAI,kBAAkB,EAAE,CAAC;QAC5C,oBAAoB;QACpB,UAAU,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QAEjC,IAAI,KAA6B,CAAC;QAClC,OAAO,CAAC,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACxD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,+BAA+B;YACnE,MAAM,GAAG,GAAG,GAAG,KAAK,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAEtC,+CAA+C;YAC/C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAEd,4BAA4B;YAC5B,IAAI,UAAU,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvD,SAAS;YACX,CAAC;YAED,4BAA4B;YAC5B,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACnD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC;YAC1B,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YAE1D,iCAAiC;YACjC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;YACnD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;YAC1E,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;YAEzD,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,KAAK,EAAE,KAAK;gBACZ,UAAU,EAAE,KAAK,CAAC,KAAK;gBACvB,QAAQ,EAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM;gBACvC,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,IAAI;gBACJ,MAAM;gBACN,OAAO,EAAE,UAAU,CAAC,IAAI;gBACxB,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;aACvC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,mBAAmB;IACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC;IAEpD,oGAAoG;IACpG,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC3C,2CAA2C;YAC3C,IAAI,IAAI,IAAI,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC9C,mDAAmD;gBACnD,IAAI,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;oBACxC,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC;gBACzC,CAAC;gBACD,SAAS;YACX,CAAC;QACH,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,qBAAqB;IACrB,KAAK,MAAM,UAAU,IAAI,kBAAkB,EAAE,CAAC;QAC5C,UAAU,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QACjC,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACnC,IAAI,UAAU,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvD,SAAS;YACX,CAAC;YACD,IAAI,UAAU,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;gBACjC,OAAO,UAAU,CAAC,IAAI,CAAC;YACzB,CAAC;QACH,CAAC;IACH,CAAC;IAED,sBAAsB;IACtB,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACpE,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,MAAM,aAAa,GAAG;QACpB,gBAAgB;QAChB,cAAc;QACd,iBAAiB;QACjB,iBAAiB;QACjB,gBAAgB;QAChB,yBAAyB;QACzB,cAAc;QACd,iBAAiB;QACjB,kBAAkB;QAClB,mBAAmB;QACnB,sBAAsB;KACvB,CAAC;IAEF,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACjD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,SAAS,CAAC,UAAU,GAAG,MAAM,CAAC;QAC5C,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,GAAG,MAAM,CAAC;QACxC,MAAM,WAAW,GAAG,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,WAAW,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC1E,MAAM,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IAC7E,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAA0B;IAM1D,MAAM,MAAM,GAA2B,EAAE,CAAC;IAE1C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACvD,CAAC;IAED,OAAO;QACL,KAAK,EAAE,OAAO,CAAC,MAAM;QACrB,MAAM,EAAE,MAAwC;QAChD,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,MAAM;QACjE,iBAAiB,EACf,OAAO,CAAC,MAAM,GAAG,CAAC;YAChB,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM;YACpE,CAAC,CAAC,CAAC;KACR,CAAC;AACJ,CAAC"}

package/dist/exec/execManager.d.ts

@@ -0,0 +1,60 @@
+/**
+ * ExecManager — Core Subprocess Credential Injection
+ *
+ * Handles the core exec logic independently of the CLI, so it can be
+ * reused by the MCP server or programmatic API in the future.
+ *
+ * Flow:
+ * 1. Resolve each passport (by ID or name)
+ * 2. Evaluate policy for each passport
+ * 3. Determine env var names (explicit, platform-map, or fallback)
+ * 4. Check for env var collisions
+ * 5. Inject into child process environment
+ * 6. Spawn the child process
+ * 7. Propagate signals (SIGTERM, SIGINT, SIGHUP)
+ * 8. Wait for exit
+ * 9. Log audit entries with process metadata
+ * 10. Return exit code
+ */
+import type { Vault } from '../vault.js';
+export interface ExecPassportSpec {
+    /** Passport ID or name to retrieve */
+    passportRef: string;
+    /** Override the env var name (--as flag) */
+    envVarOverride?: string;
+}
+export interface ExecOptions {
+    /** Command and arguments to execute */
+    command: string[];
+    /** Passports to inject */
+    passports: ExecPassportSpec[];
+    /** Vault instance (already unlocked) */
+    vault: Vault;
+    /** Actor name for audit logging */
+    actor: string;
+    /** Whether to inherit the parent process environment */
+    inheritEnv?: boolean;
+    /** Additional environment variables to set */
+    extraEnv?: Record<string, string>;
+    /** Working directory for the child process */
+    cwd?: string;
+    /** Whether to run a dry run (print env vars, don't execute) */
+    dryRun?: boolean;
+}
+export interface ExecResult {
+    exitCode: number;
+    signal?: string;
+    injectedVars: {
+        envVar: string;
+        passportId: string;
+        passportName: string;
+        source: string;
+    }[];
+    duration: number;
+    auditEntryIds: string[];
+}
+/**
+ * Execute a command with vault credentials injected as environment variables.
+ */
+export declare function execWithCredentials(options: ExecOptions): Promise<ExecResult>;
+//# sourceMappingURL=execManager.d.ts.map

package/dist/exec/execManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execManager.d.ts","sourceRoot":"","sources":["../../src/exec/execManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAMzC,MAAM,WAAW,gBAAgB;IAC/B,sCAAsC;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,4CAA4C;IAC5C,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,uCAAuC;IACvC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,0BAA0B;IAC1B,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,wCAAwC;IACxC,KAAK,EAAE,KAAK,CAAC;IACb,mCAAmC;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,wDAAwD;IACxD,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,8CAA8C;IAC9C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,8CAA8C;IAC9C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,+DAA+D;IAC/D,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC7F,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CA0PnF"}