@mhosaic/feedback 0.13.0 → 0.15.0

package/dist/{chunk-DKE6ELJ4.mjs → chunk-FGA63IEZ.mjs}

@@ -1,7 +1,9 @@
 // src/capture/scrub.ts
 var SENSITIVE_TOKEN_PATTERNS = [
-  // Mhosaic feedback keys.
-  /\b(?:sk|pk)_proj_[A-Za-z0-9_-]{16,}\b/g,
+  // Mhosaic feedback keys. Match ANY tail length — a backend error echo can
+  // truncate the suffix (e.g. `sk_proj_***abc`) and the redaction must still
+  // catch the prefix.
+  /\b(?:sk|pk)_proj_[A-Za-z0-9_*-]+/g,
   // JWT shape (header.payload.signature).
   /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g,
   // "Bearer <token>" and "Authorization: …" headers.
@@ -14,7 +16,17 @@ var SENSITIVE_TOKEN_PATTERNS = [
   // AWS access key id.
   /\bAKIA[0-9A-Z]{12,}\b/g,
   // Slack tokens.
-  /\bxox[abprso]-[A-Za-z0-9-]{12,}\b/g
+  /\bxox[abprso]-[A-Za-z0-9-]{12,}\b/g,
+  // Google API keys (Maps, GCP, Firebase, etc.).
+  /\bAIza[0-9A-Za-z_-]{35}\b/g,
+  // OpenAI API keys (legacy, project-scoped, service-account).
+  /\bsk-(?:proj-|svcacct-)?[A-Za-z0-9_-]{20,}\b/g,
+  // Anthropic API keys.
+  /\bsk-ant-(?:api03-)?[A-Za-z0-9_-]{40,}\b/g,
+  // Twilio account / API SIDs (paired secret would also be redacted by the
+  // Stripe-shape regex if it's prefixed sk_).
+  /\bAC[a-f0-9]{32}\b/g,
+  /\bSK[a-f0-9]{32}\b/g
 ];
 function scrubCredentials(text) {
   let out = text;
@@ -27,4 +39,4 @@ function scrubCredentials(text) {
 export {
   scrubCredentials
 };
-//# sourceMappingURL=chunk-DKE6ELJ4.mjs.map
+//# sourceMappingURL=chunk-FGA63IEZ.mjs.map

package/dist/chunk-FGA63IEZ.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/capture/scrub.ts"],"sourcesContent":["/**\n * Shared credential-shaped-string scrubber.\n *\n * Used by every capture module (console, error, performance, network) so a\n * single regression in any one path can't leak credentials a sibling path\n * already cleans. Patterns mirror the ones in the URL sanitizer's\n * value-shape detector — keep them in sync.\n */\n\nexport const SENSITIVE_TOKEN_PATTERNS: RegExp[] = [\n  // Mhosaic feedback keys. Match ANY tail length — a backend error echo can\n  // truncate the suffix (e.g. `sk_proj_***abc`) and the redaction must still\n  // catch the prefix.\n  /\\b(?:sk|pk)_proj_[A-Za-z0-9_*-]+/g,\n  // JWT shape (header.payload.signature).\n  /\\beyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\b/g,\n  // \"Bearer <token>\" and \"Authorization: …\" headers.\n  /\\bBearer\\s+[A-Za-z0-9._~+/=-]{16,}\\b/g,\n  /\\bAuthorization\\s*[:=]\\s*[\"']?[A-Za-z0-9._~+/=-]{16,}[\"']?/gi,\n  // GitHub PATs.\n  /\\bgh[pousr]_[A-Za-z0-9]{30,}\\b/g,\n  // Stripe live/test secret keys + webhook secrets.\n  /\\b(?:sk|pk|rk|whsec)_(?:live|test)_[A-Za-z0-9]{16,}\\b/g,\n  // AWS access key id.\n  /\\bAKIA[0-9A-Z]{12,}\\b/g,\n  // Slack tokens.\n  /\\bxox[abprso]-[A-Za-z0-9-]{12,}\\b/g,\n  // Google API keys (Maps, GCP, Firebase, etc.).\n  /\\bAIza[0-9A-Za-z_-]{35}\\b/g,\n  // OpenAI API keys (legacy, project-scoped, service-account).\n  /\\bsk-(?:proj-|svcacct-)?[A-Za-z0-9_-]{20,}\\b/g,\n  // Anthropic API keys.\n  /\\bsk-ant-(?:api03-)?[A-Za-z0-9_-]{40,}\\b/g,\n  // Twilio account / API SIDs (paired secret would also be redacted by the\n  // Stripe-shape regex if it's prefixed sk_).\n  /\\bAC[a-f0-9]{32}\\b/g,\n  /\\bSK[a-f0-9]{32}\\b/g,\n]\n\nexport function scrubCredentials(text: string): string {\n  let out = text\n  for (const re of SENSITIVE_TOKEN_PATTERNS) {\n    out = out.replace(re, '[redacted-token]')\n  }\n  return out\n}\n"],"mappings":";AASO,IAAM,2BAAqC;AAAA;AAAA;AAAA;AAAA,EAIhD;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA;AAAA,EAGA;AAAA,EACA;AACF;AAEO,SAAS,iBAAiB,MAAsB;AACrD,MAAI,MAAM;AACV,aAAW,MAAM,0BAA0B;AACzC,UAAM,IAAI,QAAQ,IAAI,kBAAkB;AAAA,EAC1C;AACA,SAAO;AACT;","names":[]}