@methiu/raigal 0.16.2

package/dist/json-DBN8fnd3.js

@@ -0,0 +1,35 @@
+#!/usr/bin/env node
+import { i as APP_VERSION, n as withFindingAssessments, r as ENGINE_INFO, t as summarizeFindingAssessments } from "./cli.js";
+//#region src/output/json.ts
+const buildJsonOutput = (results, scoreResult, fileCount, elapsedMs, coverage) => {
+	const allDiagnostics = results.flatMap((r) => r.diagnostics);
+	const assessedDiagnostics = withFindingAssessments(allDiagnostics);
+	const engines = {};
+	for (const result of results) engines[result.engine] = {
+		issues: result.diagnostics.length,
+		skipped: result.skipped,
+		elapsed: result.elapsed
+	};
+	return {
+		schemaVersion: "1",
+		cliVersion: APP_VERSION,
+		version: APP_VERSION,
+		score: coverage.scoreable ? scoreResult.score : null,
+		label: coverage.scoreable ? scoreResult.label : "not scored",
+		scoreable: coverage.scoreable,
+		coverage,
+		engines,
+		engineDefinitions: ENGINE_INFO,
+		diagnostics: assessedDiagnostics,
+		findingAssessment: summarizeFindingAssessments(allDiagnostics),
+		summary: {
+			errors: allDiagnostics.filter((d) => d.severity === "error").length,
+			warnings: allDiagnostics.filter((d) => d.severity === "warning").length,
+			fixable: allDiagnostics.filter((d) => d.fixable).length,
+			files: fileCount,
+			elapsed: elapsedMs < 1e3 ? `${Math.round(elapsedMs)}ms` : `${(elapsedMs / 1e3).toFixed(1)}s`
+		}
+	};
+};
+//#endregion
+export { buildJsonOutput };

package/dist/json-DKuTrkDa.js

@@ -0,0 +1,35 @@
+import { t as APP_VERSION } from "./version-CVfOxP_O.js";
+import { i as ENGINE_INFO, n as withFindingAssessments, t as summarizeFindingAssessments } from "./finding-assessment-M5fUTE-C.js";
+//#region src/output/json.ts
+const buildJsonOutput = (results, scoreResult, fileCount, elapsedMs, coverage) => {
+	const allDiagnostics = results.flatMap((r) => r.diagnostics);
+	const assessedDiagnostics = withFindingAssessments(allDiagnostics);
+	const engines = {};
+	for (const result of results) engines[result.engine] = {
+		issues: result.diagnostics.length,
+		skipped: result.skipped,
+		elapsed: result.elapsed
+	};
+	return {
+		schemaVersion: "1",
+		cliVersion: APP_VERSION,
+		version: APP_VERSION,
+		score: coverage.scoreable ? scoreResult.score : null,
+		label: coverage.scoreable ? scoreResult.label : "not scored",
+		scoreable: coverage.scoreable,
+		coverage,
+		engines,
+		engineDefinitions: ENGINE_INFO,
+		diagnostics: assessedDiagnostics,
+		findingAssessment: summarizeFindingAssessments(allDiagnostics),
+		summary: {
+			errors: allDiagnostics.filter((d) => d.severity === "error").length,
+			warnings: allDiagnostics.filter((d) => d.severity === "warning").length,
+			fixable: allDiagnostics.filter((d) => d.fixable).length,
+			files: fileCount,
+			elapsed: elapsedMs < 1e3 ? `${Math.round(elapsedMs)}ms` : `${(elapsedMs / 1e3).toFixed(1)}s`
+		}
+	};
+};
+//#endregion
+export { buildJsonOutput };

package/dist/mask-secrets-BXn-ZSEh.js

@@ -0,0 +1,71 @@
+//#region src/utils/mask-secrets.ts
+const BEGIN_KEY = "-----BEGIN (?:RSA |EC |DSA )?PRIVATE KEY-----";
+const MASK_PATTERNS = [
+	{
+		kind: "private_key",
+		pattern: new RegExp(`${BEGIN_KEY}[\\s\\S]*?-----END (?:RSA |EC |DSA )?PRIVATE KEY-----`, "g")
+	},
+	{
+		kind: "private_key",
+		pattern: new RegExp(BEGIN_KEY, "g")
+	},
+	{
+		kind: "aws",
+		pattern: /\bAKIA[0-9A-Z]{16}\b/g
+	},
+	{
+		kind: "github",
+		pattern: /\bgh[pousr]_[A-Za-z0-9_]{36,}\b/g
+	},
+	{
+		kind: "slack",
+		pattern: /\bxox[baprs]-[A-Za-z0-9-]+\b/g
+	},
+	{
+		kind: "database_url",
+		pattern: /(?:mongodb(?:\+srv)?|postgres|mysql|redis):\/\/[^:@/"'`\s]+:[^@"'`\s]+@[^"'`\s]+/gi
+	},
+	{
+		kind: "jwt",
+		pattern: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g
+	},
+	{
+		kind: "password",
+		pattern: /((?:password|passwd|pwd|secret|key|apikey|api[_-]?key|token|bearer)\s*[:=]\s*(?:\\?["'])?)([\w\-~@#$%^&*+=/]{8,})((?:\\?["'])?)/gi,
+		replaceGroup: 2
+	},
+	{
+		kind: "aws_secret",
+		pattern: /((?:aws[_-]?secret|secret[_-]?key)\s*[:=]\s*(?:\\?["'])?)([A-Za-z0-9/+=]{40})((?:\\?["'])?)/gi,
+		replaceGroup: 2
+	},
+	{
+		kind: "api_key",
+		pattern: /((?:api[_-]?key|apikey)\s*[:=]\s*(?:\\?["'])?)([A-Za-z0-9_-]{20,})((?:\\?["'])?)/gi,
+		replaceGroup: 2
+	},
+	{
+		kind: "token",
+		pattern: /((?:token|bearer)\s*[:=]\s*(?:\\?["'])?)([A-Za-z0-9_-]{20,})((?:\\?["'])?)/gi,
+		replaceGroup: 2
+	}
+];
+const isSecretClassRule = (rule) => {
+	const lower = rule.toLowerCase();
+	return lower === "security/hardcoded-secret" || lower.includes("secret") || lower.includes("credential") || lower.includes("private-key");
+};
+const FIXED_SECRET_DIAGNOSTIC_MESSAGE = "Hardcoded credential. Rotate it and load it from the environment.";
+const maskSecrets = (text) => {
+	if (!text || typeof text !== "string") return text;
+	let result = text;
+	for (const { kind, pattern, replaceGroup } of MASK_PATTERNS) {
+		const regex = new RegExp(pattern.source, pattern.flags);
+		if (replaceGroup !== void 0) result = result.replace(regex, (match, prefix, secret, suffix) => {
+			return `${prefix}[REDACTED:${kind}]${suffix}`;
+		});
+		else result = result.replace(regex, `[REDACTED:${kind}]`);
+	}
+	return result;
+};
+//#endregion
+export { isSecretClassRule as n, maskSecrets as r, FIXED_SECRET_DIAGNOSTIC_MESSAGE as t };