@oscharko-dev/keiko 0.2.0-beta.3 → 0.2.0-beta.4

package/node_modules/@oscharko-dev/keiko-contracts/dist/qualityIntelligence/ids.js

@@ -51,6 +51,9 @@ export const validateQualityIntelligenceIdString = (value, kind) => {
     if (value.trim().length === 0) {
         return { ok: false, reason: `${kind} must not be whitespace-only` };
     }
+    if (value !== value.trim()) {
+        return { ok: false, reason: `${kind} must not have leading or trailing whitespace` };
+    }
     if (value.length > QI_ID_MAX_LENGTH) {
         return { ok: false, reason: `${kind} exceeds max length ${String(QI_ID_MAX_LENGTH)}` };
     }

package/node_modules/@oscharko-dev/keiko-contracts/dist/qualityIntelligence/sourceEnvelope.d.ts

@@ -54,6 +54,20 @@ export type QualityIntelligenceSourceEnvelope = QualityIntelligenceRepositoryCon
  * Cheap structural guard: rejects envelopes that look like they may carry credentials,
  * URLs, or oversized labels in their display surface. Pure, no IO.
  *
+ * Scanned fields: `displayLabel`, `localRef`, `provenance.origin`, and (for
+ * `connector-document` envelopes) `adapterId`.
+ *
+ * Rejected when ANY scanned field contains:
+ *   - a URL with an authority (`scheme://` for any scheme)
+ *   - a well-known credential shape (AWS AKIA*, GitHub ghp_/gho_/github_pat_*,
+ *     Slack xox[baprs]-, OpenAI sk-*, Bearer token, PEM PRIVATE KEY header)
+ *   - an absolute filesystem path (POSIX `/`, Windows drive, or UNC `\\`)
+ *
+ * Additionally rejects when:
+ *   - `displayLabel` is empty or exceeds 256 characters
+ *   - `displayLabel` looks base64-ish (≥40 chars of the base64 alphabet)
+ *   - `provenance.integrityHashSha256Hex` is not a 64-char lowercase hex string
+ *
  * The runtime that builds envelopes is responsible for ALL redaction; this helper is
  * a defence-in-depth check the audit ledger can use before persisting.
  */

package/node_modules/@oscharko-dev/keiko-contracts/dist/qualityIntelligence/sourceEnvelope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sourceEnvelope.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/sourceEnvelope.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,UAAU,CAAC;AAEpE,MAAM,MAAM,6BAA6B,GACrC,oBAAoB,GACpB,yBAAyB,GACzB,gBAAgB,GAChB,eAAe,GACf,oBAAoB,CAAC;AAEzB,eAAO,MAAM,iCAAiC,EAAE,SAAS,6BAA6B,EAM5E,CAAC;AAEX,MAAM,WAAW,mCAAmC;IAClD,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,iEAAiE;IACjE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;CACzC;AAED,UAAU,uCAAuC;IAC/C,QAAQ,CAAC,EAAE,EAAE,mCAAmC,CAAC;IACjD,sEAAsE;IACtE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,mCAAmC,CAAC;CAC1D;AAED,MAAM,WAAW,4CAA6C,SAAQ,uCAAuC;IAC3G,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,gDAAiD,SAAQ,uCAAuC;IAC/G,QAAQ,CAAC,IAAI,EAAE,yBAAyB,CAAC;IACzC,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,wCAAyC,SAAQ,uCAAuC;IACvG,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,yEAAyE;IACzE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,uCAAwC,SAAQ,uCAAuC;IACtG,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,4CAA6C,SAAQ,uCAAuC;IAC3G,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,MAAM,iCAAiC,GACzC,4CAA4C,GAC5C,gDAAgD,GAChD,wCAAwC,GACxC,uCAAuC,GACvC,4CAA4C,CAAC;AAEjD;;;;;;GAMG;AACH,eAAO,MAAM,kCAAkC,GAC7C,UAAU,iCAAiC,KAC1C,OAQF,CAAC"}
+{"version":3,"file":"sourceEnvelope.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/sourceEnvelope.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,UAAU,CAAC;AAEpE,MAAM,MAAM,6BAA6B,GACrC,oBAAoB,GACpB,yBAAyB,GACzB,gBAAgB,GAChB,eAAe,GACf,oBAAoB,CAAC;AAEzB,eAAO,MAAM,iCAAiC,EAAE,SAAS,6BAA6B,EAM5E,CAAC;AAEX,MAAM,WAAW,mCAAmC;IAClD,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,iEAAiE;IACjE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;CACzC;AAED,UAAU,uCAAuC;IAC/C,QAAQ,CAAC,EAAE,EAAE,mCAAmC,CAAC;IACjD,sEAAsE;IACtE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,mCAAmC,CAAC;CAC1D;AAED,MAAM,WAAW,4CAA6C,SAAQ,uCAAuC;IAC3G,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,gDAAiD,SAAQ,uCAAuC;IAC/G,QAAQ,CAAC,IAAI,EAAE,yBAAyB,CAAC;IACzC,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,wCAAyC,SAAQ,uCAAuC;IACvG,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,yEAAyE;IACzE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,uCAAwC,SAAQ,uCAAuC;IACtG,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,4CAA6C,SAAQ,uCAAuC;IAC3G,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,MAAM,iCAAiC,GACzC,4CAA4C,GAC5C,gDAAgD,GAChD,wCAAwC,GACxC,uCAAuC,GACvC,4CAA4C,CAAC;AAyBjD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,kCAAkC,GAC7C,UAAU,iCAAiC,KAC1C,OAUF,CAAC"}

package/node_modules/@oscharko-dev/keiko-contracts/dist/qualityIntelligence/sourceEnvelope.js

@@ -21,10 +21,54 @@ export const QUALITY_INTELLIGENCE_SOURCE_KINDS = [
     "human-context",
     "connector-document",
 ];
+/**
+ * Returns `true` if a field value looks safe to surface in a browser context.
+ * Rejects when the value contains:
+ *   (a) any URL authority — `scheme://` for ANY scheme (http, ftp, s3, file, …)
+ *   (b) well-known credential token prefixes (AWS AKIA, GitHub ghp_/gho_/github_pat_,
+ *       Slack xox[baprs]-, OpenAI sk-, Bearer token, PEM PRIVATE KEY header)
+ *   (c) an absolute filesystem path (POSIX `/`, Windows drive `C:\`, UNC `\\`)
+ */
+const fieldLooksUnsafe = (value) => {
+    // (a) any scheme://
+    if (/[a-z][a-z0-9+.-]*:\/\//iu.test(value))
+        return true;
+    // (b) credential shapes
+    if (/AKIA[0-9A-Z]{12,}/u.test(value))
+        return true;
+    if (/(?:ghp_|gho_|github_pat_)[A-Za-z0-9_]{20,}/u.test(value))
+        return true;
+    if (/xox[baprs]-[A-Za-z0-9-]{10,}/u.test(value))
+        return true;
+    if (/sk-[A-Za-z0-9]{16,}/u.test(value))
+        return true;
+    if (/\bBearer\s+\S/u.test(value))
+        return true;
+    if (/-----BEGIN [A-Z ]*PRIVATE KEY-----/u.test(value))
+        return true;
+    // (c) absolute filesystem paths
+    if (/^(?:\/|[A-Za-z]:[\\/]|\\\\)/u.test(value))
+        return true;
+    return false;
+};
 /**
  * Cheap structural guard: rejects envelopes that look like they may carry credentials,
  * URLs, or oversized labels in their display surface. Pure, no IO.
  *
+ * Scanned fields: `displayLabel`, `localRef`, `provenance.origin`, and (for
+ * `connector-document` envelopes) `adapterId`.
+ *
+ * Rejected when ANY scanned field contains:
+ *   - a URL with an authority (`scheme://` for any scheme)
+ *   - a well-known credential shape (AWS AKIA*, GitHub ghp_/gho_/github_pat_*,
+ *     Slack xox[baprs]-, OpenAI sk-*, Bearer token, PEM PRIVATE KEY header)
+ *   - an absolute filesystem path (POSIX `/`, Windows drive, or UNC `\\`)
+ *
+ * Additionally rejects when:
+ *   - `displayLabel` is empty or exceeds 256 characters
+ *   - `displayLabel` looks base64-ish (≥40 chars of the base64 alphabet)
+ *   - `provenance.integrityHashSha256Hex` is not a 64-char lowercase hex string
+ *
  * The runtime that builds envelopes is responsible for ALL redaction; this helper is
  * a defence-in-depth check the audit ledger can use before persisting.
  */
@@ -32,13 +76,17 @@ export const looksLikeBrowserSafeSourceEnvelope = (envelope) => {
     const { displayLabel, provenance, localRef } = envelope;
     if (displayLabel.length === 0 || displayLabel.length > 256)
         return false;
-    if (/https?:\/\//iu.test(displayLabel))
-        return false;
-    if (/https?:\/\//iu.test(localRef))
-        return false;
     if (/^[A-Za-z0-9+/]{40,}={0,2}$/u.test(displayLabel))
-        return false; // base64-ish
+        return false; // base64-ish (displayLabel only)
     if (!/^[0-9a-f]{64}$/u.test(provenance.integrityHashSha256Hex))
         return false;
+    if (fieldLooksUnsafe(displayLabel))
+        return false;
+    if (fieldLooksUnsafe(localRef))
+        return false;
+    if (fieldLooksUnsafe(provenance.origin))
+        return false;
+    if (envelope.kind === "connector-document" && fieldLooksUnsafe(envelope.adapterId))
+        return false;
     return true;
 };

package/node_modules/@oscharko-dev/keiko-contracts/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oscharko-dev/keiko-contracts",
-  "version": "0.2.0-beta.3",
+  "version": "0.2.0-beta.4",
   "private": true,
   "type": "module",
   "license": "Apache-2.0",
@@ -55,7 +55,7 @@
   },
   "scripts": {
     "build": "tsc -b tsconfig.json",
-    "typecheck": "tsc -b tsconfig.json --noEmit",
+    "typecheck": "tsc -b tsconfig.json",
     "test": "vitest run"
   },
   "files": [