@oops-catcher/core 0.1.0

package/dist/rules/secrets_v1.js

@@ -0,0 +1,283 @@
+import { lineForIndex } from '../engine/line.js';
+import { redactExcerpt } from '../output/redact.js';
+import { stableFingerprint } from '../engine/fingerprint.js';
+const PRIVATE_KEY_BLOCK = /-----BEGIN (RSA|EC|OPENSSH|PGP|DSA) PRIVATE KEY-----/g;
+const GITHUB_TOKEN = /(ghp_[A-Za-z0-9]{36}|github_pat_[A-Za-z0-9_]{22,})/g;
+const AWS_ACCESS_KEY = /\b(AKIA[0-9A-Z]{16})\b/g;
+const AWS_SECRET_KEY = /(?:aws[_\-.]?secret[_\-.]?(?:access[_\-.]?)?key|AWS_SECRET_ACCESS_KEY)\s*[=:]\s*["']?([A-Za-z0-9/+=]{40})["']?/gi;
+const STRIPE_LIVE_KEY = /\b(sk_live_[0-9a-zA-Z]{24,})\b/g;
+const SLACK_TOKEN = /\b(xox[aboprs]-[0-9A-Za-z\-]{10,})\b/g;
+const HIGH_ENTROPY_STRING = /["']([A-Za-z0-9+/=_\-]{20,})["']/g;
+const SECRETS_FILE_BASENAMES = new Set([
+    '.env',
+    'credentials.json',
+    'id_rsa',
+    'id_ed25519',
+    'id_ecdsa',
+    'id_dsa',
+]);
+function isSecretsFilePath(filePath) {
+    const base = filePath.split('/').pop() ?? filePath;
+    if (SECRETS_FILE_BASENAMES.has(base))
+        return true;
+    if (base.startsWith('.env.'))
+        return true;
+    if (base.endsWith('.pem'))
+        return true;
+    if (base.startsWith('secrets.'))
+        return true;
+    return false;
+}
+function shannonEntropy(s) {
+    const freq = {};
+    for (const c of s)
+        freq[c] = (freq[c] ?? 0) + 1;
+    const len = s.length;
+    return Object.values(freq).reduce((h, count) => {
+        const p = count / len;
+        return h - p * Math.log2(p);
+    }, 0);
+}
+function looksLikeUrl(s) {
+    return s.startsWith('http') || s.startsWith('ftp');
+}
+export const secretsV1Rules = [
+    {
+        id: 'SEC001',
+        title: 'Private key block detected',
+        defaultSeverity: 'critical',
+        appliesTo: () => true,
+        run: (ctx) => {
+            const findings = [];
+            for (const match of ctx.content.matchAll(PRIVATE_KEY_BLOCK)) {
+                const index = match.index ?? 0;
+                const line = lineForIndex(ctx.content, index);
+                const matched = match[0];
+                const redactedExcerpt = redactExcerpt(matched, ctx.config.output.redact);
+                findings.push({
+                    ruleId: 'SEC001',
+                    severity: 'critical',
+                    path: ctx.path,
+                    line,
+                    message: 'Private key block detected',
+                    why: 'Private keys should not be committed to source control.',
+                    fix: 'Remove the key from the repo and rotate it immediately.',
+                    redactedExcerpt,
+                    fingerprint: stableFingerprint(`SEC001:${ctx.path}:${line}:${matched.slice(0, 16)}`),
+                });
+            }
+            return findings;
+        },
+    },
+    {
+        id: 'SEC002',
+        title: 'AWS credentials detected',
+        defaultSeverity: 'critical',
+        appliesTo: () => true,
+        run: (ctx) => {
+            const findings = [];
+            for (const match of ctx.content.matchAll(AWS_ACCESS_KEY)) {
+                const index = match.index ?? 0;
+                const line = lineForIndex(ctx.content, index);
+                const matched = match[1];
+                if (!matched)
+                    continue;
+                findings.push({
+                    ruleId: 'SEC002',
+                    severity: 'critical',
+                    path: ctx.path,
+                    line,
+                    message: 'AWS access key ID detected',
+                    why: 'AWS access keys grant account access and must not be committed.',
+                    fix: 'Remove the key and rotate it in the AWS console immediately.',
+                    redactedExcerpt: redactExcerpt(matched, ctx.config.output.redact),
+                    fingerprint: stableFingerprint(`SEC002:${ctx.path}:${line}:${matched.slice(0, 8)}`),
+                });
+            }
+            for (const match of ctx.content.matchAll(AWS_SECRET_KEY)) {
+                const index = match.index ?? 0;
+                const line = lineForIndex(ctx.content, index);
+                const matched = match[1];
+                if (!matched)
+                    continue;
+                findings.push({
+                    ruleId: 'SEC002',
+                    severity: 'critical',
+                    path: ctx.path,
+                    line,
+                    message: 'AWS secret access key detected',
+                    why: 'AWS secret keys grant full account access and must not be committed.',
+                    fix: 'Remove the key and rotate it in the AWS console immediately.',
+                    redactedExcerpt: redactExcerpt(matched, ctx.config.output.redact),
+                    fingerprint: stableFingerprint(`SEC002:${ctx.path}:${line}:${matched.slice(0, 8)}`),
+                });
+            }
+            return findings;
+        },
+    },
+    {
+        id: 'SEC003',
+        title: 'GitHub token detected',
+        defaultSeverity: 'critical',
+        appliesTo: () => true,
+        run: (ctx) => {
+            const findings = [];
+            for (const match of ctx.content.matchAll(GITHUB_TOKEN)) {
+                const index = match.index ?? 0;
+                const line = lineForIndex(ctx.content, index);
+                const matched = match[0];
+                const redactedExcerpt = redactExcerpt(matched, ctx.config.output.redact);
+                findings.push({
+                    ruleId: 'SEC003',
+                    severity: 'critical',
+                    path: ctx.path,
+                    line,
+                    message: 'GitHub token detected',
+                    why: 'Tokens provide API access and should be stored in a secret manager.',
+                    fix: 'Remove the token and rotate it in GitHub immediately.',
+                    redactedExcerpt,
+                    fingerprint: stableFingerprint(`SEC003:${ctx.path}:${line}:${matched.slice(0, 16)}`),
+                });
+            }
+            return findings;
+        },
+    },
+    {
+        id: 'SEC004',
+        title: 'Stripe live secret key detected',
+        defaultSeverity: 'critical',
+        appliesTo: () => true,
+        run: (ctx) => {
+            const findings = [];
+            for (const match of ctx.content.matchAll(STRIPE_LIVE_KEY)) {
+                const index = match.index ?? 0;
+                const line = lineForIndex(ctx.content, index);
+                const matched = match[1];
+                if (!matched)
+                    continue;
+                findings.push({
+                    ruleId: 'SEC004',
+                    severity: 'critical',
+                    path: ctx.path,
+                    line,
+                    message: 'Stripe live secret key detected',
+                    why: 'Live Stripe keys can charge real cards and must not be committed.',
+                    fix: 'Remove the key and rotate it in the Stripe dashboard immediately.',
+                    redactedExcerpt: redactExcerpt(matched, ctx.config.output.redact),
+                    fingerprint: stableFingerprint(`SEC004:${ctx.path}:${line}:${matched.slice(0, 12)}`),
+                });
+            }
+            return findings;
+        },
+    },
+    {
+        id: 'SEC005',
+        title: 'Slack token detected',
+        defaultSeverity: 'critical',
+        appliesTo: () => true,
+        run: (ctx) => {
+            const findings = [];
+            for (const match of ctx.content.matchAll(SLACK_TOKEN)) {
+                const index = match.index ?? 0;
+                const line = lineForIndex(ctx.content, index);
+                const matched = match[1];
+                if (!matched)
+                    continue;
+                findings.push({
+                    ruleId: 'SEC005',
+                    severity: 'critical',
+                    path: ctx.path,
+                    line,
+                    message: 'Slack token detected',
+                    why: 'Slack tokens grant API access and must not be committed.',
+                    fix: 'Remove the token and rotate it in the Slack app dashboard.',
+                    redactedExcerpt: redactExcerpt(matched, ctx.config.output.redact),
+                    fingerprint: stableFingerprint(`SEC005:${ctx.path}:${line}:${matched.slice(0, 12)}`),
+                });
+            }
+            return findings;
+        },
+    },
+    {
+        id: 'SEC006',
+        title: 'GCP service account key detected',
+        defaultSeverity: 'critical',
+        appliesTo: (path) => path.endsWith('.json'),
+        run: (ctx) => {
+            try {
+                const parsed = JSON.parse(ctx.content);
+                if (parsed['type'] === 'service_account' &&
+                    typeof parsed['private_key'] === 'string' &&
+                    parsed['private_key'].length > 0) {
+                    return [
+                        {
+                            ruleId: 'SEC006',
+                            severity: 'critical',
+                            path: ctx.path,
+                            message: 'GCP service account key file detected',
+                            why: 'Service account keys grant cloud access and must not be committed.',
+                            fix: 'Remove the file, revoke the key in GCP IAM, and use Workload Identity instead.',
+                            fingerprint: stableFingerprint(`SEC006:${ctx.path}`),
+                        },
+                    ];
+                }
+            }
+            catch {
+                // Not valid JSON
+            }
+            return [];
+        },
+    },
+    {
+        id: 'SEC007',
+        title: 'Secrets file tracked',
+        defaultSeverity: 'warning',
+        appliesTo: (path) => isSecretsFilePath(path),
+        run: (ctx) => [
+            {
+                ruleId: 'SEC007',
+                severity: 'warning',
+                path: ctx.path,
+                message: `Secrets file tracked in repository: ${ctx.path.split('/').pop()}`,
+                why: 'Files like .env and private key files should never be committed.',
+                fix: 'Remove the file from the repository and add it to .gitignore.',
+                fingerprint: stableFingerprint(`SEC007:${ctx.path}`),
+            },
+        ],
+    },
+    {
+        id: 'SEC050',
+        title: 'High-entropy token heuristic',
+        defaultSeverity: 'warning',
+        appliesTo: () => true,
+        run: (ctx) => {
+            const findings = [];
+            for (const match of ctx.content.matchAll(HIGH_ENTROPY_STRING)) {
+                const candidate = match[1];
+                if (!candidate)
+                    continue;
+                if (looksLikeUrl(candidate))
+                    continue;
+                if (shannonEntropy(candidate) >= 4.5) {
+                    const index = match.index ?? 0;
+                    const line = lineForIndex(ctx.content, index);
+                    findings.push({
+                        ruleId: 'SEC050',
+                        severity: 'warning',
+                        path: ctx.path,
+                        line,
+                        message: 'High-entropy string detected (possible secret)',
+                        why: 'Randomly-generated tokens often indicate embedded secrets.',
+                        fix: 'Move to a secret manager or environment variable.',
+                        redactedExcerpt: redactExcerpt(candidate, ctx.config.output.redact),
+                        fingerprint: stableFingerprint(`SEC050:${ctx.path}:${line}:${candidate.slice(0, 8)}`),
+                    });
+                }
+            }
+            return findings;
+        },
+    },
+];
+// Export patterns for reuse in AI artifacts rule
+export { PRIVATE_KEY_BLOCK, GITHUB_TOKEN, AWS_ACCESS_KEY, STRIPE_LIVE_KEY, SLACK_TOKEN };
+//# sourceMappingURL=secrets_v1.js.map

package/dist/rules/secrets_v1.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets_v1.js","sourceRoot":"","sources":["../../src/rules/secrets_v1.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,MAAM,iBAAiB,GAAG,uDAAuD,CAAC;AAClF,MAAM,YAAY,GAAG,qDAAqD,CAAC;AAC3E,MAAM,cAAc,GAAG,yBAAyB,CAAC;AACjD,MAAM,cAAc,GAAG,kHAAkH,CAAC;AAC1I,MAAM,eAAe,GAAG,iCAAiC,CAAC;AAC1D,MAAM,WAAW,GAAG,uCAAuC,CAAC;AAC5D,MAAM,mBAAmB,GAAG,mCAAmC,CAAC;AAEhE,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,MAAM;IACN,kBAAkB;IAClB,QAAQ;IACR,YAAY;IACZ,UAAU;IACV,QAAQ;CACT,CAAC,CAAC;AAEH,SAAS,iBAAiB,CAAC,QAAgB;IACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,QAAQ,CAAC;IACnD,IAAI,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,CAAS;IAC/B,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC;IACrB,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE;QAC7C,MAAM,CAAC,GAAG,KAAK,GAAG,GAAG,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC,EAAE,CAAC,CAAC,CAAC;AACR,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAW;IACpC;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,4BAA4B;QACnC,eAAe,EAAE,UAAU;QAC3B,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI;QACrB,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE;YACX,MAAM,QAAQ,GAAc,EAAE,CAAC;YAC/B,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBAC5D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;gBAC/B,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBAC9C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACzB,MAAM,eAAe,GAAG,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACzE,QAAQ,CAAC,IAAI,CAAC;oBACZ,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,UAAU;oBACpB,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,IAAI;oBACJ,OAAO,EAAE,4BAA4B;oBACrC,GAAG,EAAE,yDAAyD;oBAC9D,GAAG,EAAE,yDAAyD;oBAC9D,eAAe;oBACf,WAAW,EAAE,iBAAiB,CAAC,UAAU,GAAG,CAAC,IAAI,IAAI,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;iBACrF,CAAC,CAAC;YACL,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,0BAA0B;QACjC,eAAe,EAAE,UAAU;QAC3B,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI;QACrB,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE;YACX,MAAM,QAAQ,GAAc,EAAE,CAAC;YAC/B,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;gBACzD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;gBAC/B,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBAC9C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACzB,IAAI,CAAC,OAAO;oBAAE,SAAS;gBACvB,QAAQ,CAAC,IAAI,CAAC;oBACZ,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,UAAU;oBACpB,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,IAAI;oBACJ,OAAO,EAAE,4BAA4B;oBACrC,GAAG,EAAE,iEAAiE;oBACtE,GAAG,EAAE,8DAA8D;oBACnE,eAAe,EAAE,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;oBACjE,WAAW,EAAE,iBAAiB,CAAC,UAAU,GAAG,CAAC,IAAI,IAAI,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;iBACpF,CAAC,CAAC;YACL,CAAC;YACD,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;gBACzD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;gBAC/B,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBAC9C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACzB,IAAI,CAAC,OAAO;oBAAE,SAAS;gBACvB,QAAQ,CAAC,IAAI,CAAC;oBACZ,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,UAAU;oBACpB,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,IAAI;oBACJ,OAAO,EAAE,gCAAgC;oBACzC,GAAG,EAAE,sEAAsE;oBAC3E,GAAG,EAAE,8DAA8D;oBACnE,eAAe,EAAE,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;oBACjE,WAAW,EAAE,iBAAiB,CAAC,UAAU,GAAG,CAAC,IAAI,IAAI,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;iBACpF,CAAC,CAAC;YACL,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,uBAAuB;QAC9B,eAAe,EAAE,UAAU;QAC3B,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI;QACrB,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE;YACX,MAAM,QAAQ,GAAc,EAAE,CAAC;YAC/B,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBACvD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;gBAC/B,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBAC9C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACzB,MAAM,eAAe,GAAG,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACzE,QAAQ,CAAC,IAAI,CAAC;oBACZ,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,UAAU;oBACpB,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,IAAI;oBACJ,OAAO,EAAE,uBAAuB;oBAChC,GAAG,EAAE,qEAAqE;oBAC1E,GAAG,EAAE,uDAAuD;oBAC5D,eAAe;oBACf,WAAW,EAAE,iBAAiB,CAAC,UAAU,GAAG,CAAC,IAAI,IAAI,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;iBACrF,CAAC,CAAC;YACL,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,iCAAiC;QACxC,eAAe,EAAE,UAAU;QAC3B,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI;QACrB,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE;YACX,MAAM,QAAQ,GAAc,EAAE,CAAC;YAC/B,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC1D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;gBAC/B,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBAC9C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACzB,IAAI,CAAC,OAAO;oBAAE,SAAS;gBACvB,QAAQ,CAAC,IAAI,CAAC;oBACZ,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,UAAU;oBACpB,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,IAAI;oBACJ,OAAO,EAAE,iCAAiC;oBAC1C,GAAG,EAAE,mEAAmE;oBACxE,GAAG,EAAE,mEAAmE;oBACxE,eAAe,EAAE,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;oBACjE,WAAW,EAAE,iBAAiB,CAAC,UAAU,GAAG,CAAC,IAAI,IAAI,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;iBACrF,CAAC,CAAC;YACL,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,sBAAsB;QAC7B,eAAe,EAAE,UAAU;QAC3B,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI;QACrB,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE;YACX,MAAM,QAAQ,GAAc,EAAE,CAAC;YAC/B,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBACtD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;gBAC/B,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBAC9C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACzB,IAAI,CAAC,OAAO;oBAAE,SAAS;gBACvB,QAAQ,CAAC,IAAI,CAAC;oBACZ,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,UAAU;oBACpB,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,IAAI;oBACJ,OAAO,EAAE,sBAAsB;oBAC/B,GAAG,EAAE,0DAA0D;oBAC/D,GAAG,EAAE,4DAA4D;oBACjE,eAAe,EAAE,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;oBACjE,WAAW,EAAE,iBAAiB,CAAC,UAAU,GAAG,CAAC,IAAI,IAAI,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;iBACrF,CAAC,CAAC;YACL,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,kCAAkC;QACzC,eAAe,EAAE,UAAU;QAC3B,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAC3C,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE;YACX,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAA4B,CAAC;gBAClE,IACE,MAAM,CAAC,MAAM,CAAC,KAAK,iBAAiB;oBACpC,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,QAAQ;oBACzC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC,EAChC,CAAC;oBACD,OAAO;wBACL;4BACE,MAAM,EAAE,QAAQ;4BAChB,QAAQ,EAAE,UAAU;4BACpB,IAAI,EAAE,GAAG,CAAC,IAAI;4BACd,OAAO,EAAE,uCAAuC;4BAChD,GAAG,EAAE,oEAAoE;4BACzE,GAAG,EAAE,gFAAgF;4BACrF,WAAW,EAAE,iBAAiB,CAAC,UAAU,GAAG,CAAC,IAAI,EAAE,CAAC;yBACrD;qBACF,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;KACF;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,sBAAsB;QAC7B,eAAe,EAAE,SAAS;QAC1B,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC;QAC5C,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC;YACZ;gBACE,MAAM,EAAE,QAAQ;gBAChB,QAAQ,EAAE,SAAS;gBACnB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,OAAO,EAAE,uCAAuC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;gBAC3E,GAAG,EAAE,kEAAkE;gBACvE,GAAG,EAAE,+DAA+D;gBACpE,WAAW,EAAE,iBAAiB,CAAC,UAAU,GAAG,CAAC,IAAI,EAAE,CAAC;aACrD;SACF;KACF;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,8BAA8B;QACrC,eAAe,EAAE,SAAS;QAC1B,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI;QACrB,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE;YACX,MAAM,QAAQ,GAAc,EAAE,CAAC;YAC/B,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBAC9D,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC3B,IAAI,CAAC,SAAS;oBAAE,SAAS;gBACzB,IAAI,YAAY,CAAC,SAAS,CAAC;oBAAE,SAAS;gBACtC,IAAI,cAAc,CAAC,SAAS,CAAC,IAAI,GAAG,EAAE,CAAC;oBACrC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;oBAC/B,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;oBAC9C,QAAQ,CAAC,IAAI,CAAC;wBACZ,MAAM,EAAE,QAAQ;wBAChB,QAAQ,EAAE,SAAS;wBACnB,IAAI,EAAE,GAAG,CAAC,IAAI;wBACd,IAAI;wBACJ,OAAO,EAAE,gDAAgD;wBACzD,GAAG,EAAE,4DAA4D;wBACjE,GAAG,EAAE,mDAAmD;wBACxD,eAAe,EAAE,aAAa,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;wBACnE,WAAW,EAAE,iBAAiB,CAAC,UAAU,GAAG,CAAC,IAAI,IAAI,IAAI,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;qBACtF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF;CACF,CAAC;AAEF,iDAAiD;AACjD,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,WAAW,EAAE,CAAC"}

package/dist/rules/types.d.ts

@@ -0,0 +1,19 @@
+import { Finding, OopsConfig } from '../types.js';
+export type RuleContext = {
+    cwd: string;
+    path: string;
+    content: string;
+    config: OopsConfig;
+};
+export type Rule = {
+    id: string;
+    title: string;
+    defaultSeverity: 'critical' | 'warning' | 'info';
+    appliesTo: (path: string) => boolean;
+    run: (ctx: RuleContext) => Finding[];
+};
+export type Ruleset = {
+    id: string;
+    rules: Rule[];
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/rules/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/rules/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAElD,MAAM,MAAM,WAAW,GAAG;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,UAAU,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,IAAI,GAAG;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,UAAU,GAAG,SAAS,GAAG,MAAM,CAAC;IACjD,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACrC,GAAG,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,OAAO,EAAE,CAAC;CACtC,CAAC;AAEF,MAAM,MAAM,OAAO,GAAG;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,IAAI,EAAE,CAAC;CACf,CAAC"}

package/dist/rules/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/rules/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/rules/types.ts"],"names":[],"mappings":""}

package/dist/types.d.ts

@@ -0,0 +1,41 @@
+export type Severity = 'critical' | 'warning' | 'info';
+export type Finding = {
+    ruleId: string;
+    severity: Severity;
+    path: string;
+    line?: number;
+    message: string;
+    why: string;
+    fix: string;
+    redactedExcerpt?: string;
+    fingerprint: string;
+};
+export type RedactConfig = {
+    showPrefix: number;
+    showSuffix: number;
+};
+export type OutputFormat = 'text' | 'json';
+export type OopsConfig = {
+    version: 1;
+    include: string[];
+    exclude: string[];
+    rulesets: string[];
+    rules: {
+        disable: string[];
+        severity_overrides: Record<string, Severity>;
+    };
+    output: {
+        format: OutputFormat;
+        failOn: Severity;
+        redact: RedactConfig;
+    };
+    baseline: {
+        mode: 'off' | 'use' | 'update';
+        file: string;
+    };
+    allowlist: {
+        paths: string[];
+        rules: Record<string, string[]>;
+    };
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,SAAS,GAAG,MAAM,CAAC;AAEvD,MAAM,MAAM,OAAO,GAAG;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,QAAQ,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,CAAC;AAE3C,MAAM,MAAM,UAAU,GAAG;IACvB,OAAO,EAAE,CAAC,CAAC;IACX,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,EAAE;QACL,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;KAC9C,CAAC;IACF,MAAM,EAAE;QACN,MAAM,EAAE,YAAY,CAAC;QACrB,MAAM,EAAE,QAAQ,CAAC;QACjB,MAAM,EAAE,YAAY,CAAC;KACtB,CAAC;IACF,QAAQ,EAAE;QACR,IAAI,EAAE,KAAK,GAAG,KAAK,GAAG,QAAQ,CAAC;QAC/B,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IACF,SAAS,EAAE;QACT,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;KACjC,CAAC;CACH,CAAC"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "@oops-catcher/core",
+  "version": "0.1.0",
+  "description": "Core scan engine for oops-catcher — rules, redaction, and formatters",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist/"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/auntiemoi-commits/oops-catcher.git"
+  },
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "fast-glob": "^3.3.2",
+    "js-yaml": "^4.1.0",
+    "zod": "^3.23.8"
+  }
+}