@mnemonik/shared 5.135.4 → 5.137.0

package/dist/secretPatterns.d.ts

@@ -25,12 +25,5 @@
  */
 export declare const SECRET_REDACTION_PLACEHOLDER = "[REDACTED]";
 export declare const SECRET_PATTERNS: ReadonlyArray<RegExp>;
-/**
- * Replace recognized secret shapes in `text` with the redaction
- * placeholder. Returns the input unchanged when no patterns match.
- *
- * Idempotent: scrubbing already-scrubbed text returns the same text
- * (the placeholder itself doesn't match any pattern).
- */
 export declare function scrubSecrets(text: string): string;
 //# sourceMappingURL=secretPatterns.d.ts.map

package/dist/secretPatterns.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secretPatterns.d.ts","sourceRoot":"","sources":["../src/secretPatterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,eAAO,MAAM,4BAA4B,eAAe,CAAC;AAEzD,eAAO,MAAM,eAAe,EAAE,aAAa,CAAC,MAAM,CAYjD,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAOjD"}
+{"version":3,"file":"secretPatterns.d.ts","sourceRoot":"","sources":["../src/secretPatterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,eAAO,MAAM,4BAA4B,eAAe,CAAC;AAGzD,eAAO,MAAM,eAAe,EAAE,aAAa,CAAC,MAAM,CAYjD,CAAC;AAkBF,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CASjD"}

package/dist/secretPatterns.js

@@ -24,6 +24,7 @@
  * while catching the common credential leak vectors.
  */
 export const SECRET_REDACTION_PLACEHOLDER = '[REDACTED]';
+// Shared by the scanner daemon and server-side scrub paths.
 export const SECRET_PATTERNS = [
     /(?:api[_-]?key|secret|token|password|credential|auth)\s*[:=]\s*\S+/gi,
     // Stripe-shape: (sk|pk)_(live|test)_<24+ alphanumerics>. Catches modern
@@ -44,12 +45,20 @@ export const SECRET_PATTERNS = [
  * Idempotent: scrubbing already-scrubbed text returns the same text
  * (the placeholder itself doesn't match any pattern).
  */
+/**
+ * A key=value match whose value side is a code REFERENCE to an env read
+ * (`process.env.X`, `process.env['X']`, `import.meta.env.X`) contains no
+ * literal secret — redacting it destroys information (it blinded the
+ * doc-truth env_vars authority to every secret-named variable) without
+ * protecting anything.
+ */
+const ENV_READ_VALUE_RE = /[:=]\s*(?:await\s+)?(?:process\.env[.[]|import\.meta\.env[.[])/;
 export function scrubSecrets(text) {
     if (!text)
         return text;
     let result = text;
     for (const pattern of SECRET_PATTERNS) {
-        result = result.replace(pattern, SECRET_REDACTION_PLACEHOLDER);
+        result = result.replace(pattern, (match) => ENV_READ_VALUE_RE.test(match) ? match : SECRET_REDACTION_PLACEHOLDER);
     }
     return result;
 }

package/dist/secretPatterns.js.map

@@ -1 +1 @@
-{"version":3,"file":"secretPatterns.js","sourceRoot":"","sources":["../src/secretPatterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,YAAY,CAAC;AAEzD,MAAM,CAAC,MAAM,eAAe,GAA0B;IACpD,sEAAsE;IACtE,wEAAwE;IACxE,oEAAoE;IACpE,qEAAqE;IACrE,kEAAkE;IAClE,2CAA2C;IAC3C,2CAA2C;IAC3C,gCAAgC;IAChC,sBAAsB;IACtB,0BAA0B;IAC1B,yDAAyD;CAC1D,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACtC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,4BAA4B,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"secretPatterns.js","sourceRoot":"","sources":["../src/secretPatterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,YAAY,CAAC;AAEzD,4DAA4D;AAC5D,MAAM,CAAC,MAAM,eAAe,GAA0B;IACpD,sEAAsE;IACtE,wEAAwE;IACxE,oEAAoE;IACpE,qEAAqE;IACrE,kEAAkE;IAClE,2CAA2C;IAC3C,2CAA2C;IAC3C,gCAAgC;IAChC,sBAAsB;IACtB,0BAA0B;IAC1B,yDAAyD;CAC1D,CAAC;AAEF;;;;;;GAMG;AACH;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,gEAAgE,CAAC;AAE3F,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACtC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACzC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,4BAA4B,CACrE,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mnemonik/shared",
-  "version": "5.135.4",
+  "version": "5.137.0",
   "description": "Shared constants and utilities for Mnemonik packages",
   "type": "module",
   "main": "dist/index.js",

package/src/secretPatterns.ts

@@ -26,6 +26,7 @@
 
 export const SECRET_REDACTION_PLACEHOLDER = '[REDACTED]';
 
+// Shared by the scanner daemon and server-side scrub paths.
 export const SECRET_PATTERNS: ReadonlyArray<RegExp> = [
   /(?:api[_-]?key|secret|token|password|credential|auth)\s*[:=]\s*\S+/gi,
   // Stripe-shape: (sk|pk)_(live|test)_<24+ alphanumerics>. Catches modern
@@ -47,11 +48,22 @@ export const SECRET_PATTERNS: ReadonlyArray<RegExp> = [
  * Idempotent: scrubbing already-scrubbed text returns the same text
  * (the placeholder itself doesn't match any pattern).
  */
+/**
+ * A key=value match whose value side is a code REFERENCE to an env read
+ * (`process.env.X`, `process.env['X']`, `import.meta.env.X`) contains no
+ * literal secret — redacting it destroys information (it blinded the
+ * doc-truth env_vars authority to every secret-named variable) without
+ * protecting anything.
+ */
+const ENV_READ_VALUE_RE = /[:=]\s*(?:await\s+)?(?:process\.env[.[]|import\.meta\.env[.[])/;
+
 export function scrubSecrets(text: string): string {
   if (!text) return text;
   let result = text;
   for (const pattern of SECRET_PATTERNS) {
-    result = result.replace(pattern, SECRET_REDACTION_PLACEHOLDER);
+    result = result.replace(pattern, (match) =>
+      ENV_READ_VALUE_RE.test(match) ? match : SECRET_REDACTION_PLACEHOLDER
+    );
   }
   return result;
 }