@secfn/core 0.0.1 → 0.0.2

package/dist/scanner/reporters.js

@@ -0,0 +1,85 @@
+const SEVERITY_ORDER = {
+    info: 0,
+    low: 1,
+    medium: 2,
+    high: 3,
+    critical: 4,
+};
+export function findingMeetsSeverity(finding, minimum) {
+    return SEVERITY_ORDER[finding.severity] >= SEVERITY_ORDER[minimum];
+}
+export function formatFindingsTable(findings) {
+    if (findings.length === 0) {
+        return "No security findings found.";
+    }
+    return findings
+        .map((finding) => [
+        finding.severity.toUpperCase().padEnd(8),
+        finding.ruleName,
+        `${finding.file}:${finding.line}:${finding.column}`,
+        finding.redactedMatch ?? "",
+    ].filter(Boolean).join("  "))
+        .join("\n");
+}
+export function formatFindingsJson(findings) {
+    return JSON.stringify({ findings }, null, 2);
+}
+export function formatFindingsSarif(findings) {
+    const rules = new Map();
+    for (const finding of findings) {
+        if (!rules.has(finding.ruleId))
+            rules.set(finding.ruleId, finding);
+    }
+    return JSON.stringify({
+        version: "2.1.0",
+        $schema: "https://json.schemastore.org/sarif-2.1.0.json",
+        runs: [
+            {
+                tool: {
+                    driver: {
+                        name: "SecFn",
+                        informationUri: "https://github.com/21nCo/super-functions/tree/dev/secfn",
+                        rules: Array.from(rules.values()).map((finding) => ({
+                            id: finding.ruleId,
+                            name: finding.ruleName,
+                            shortDescription: { text: finding.ruleName },
+                            fullDescription: { text: finding.message },
+                            defaultConfiguration: {
+                                level: sarifLevel(finding.severity),
+                            },
+                        })),
+                    },
+                },
+                results: findings.map((finding) => ({
+                    ruleId: finding.ruleId,
+                    level: sarifLevel(finding.severity),
+                    message: {
+                        text: `${finding.message}${finding.redactedMatch ? ` (${finding.redactedMatch})` : ""}`,
+                    },
+                    partialFingerprints: {
+                        primaryLocationLineHash: finding.fingerprint,
+                    },
+                    locations: [
+                        {
+                            physicalLocation: {
+                                artifactLocation: { uri: finding.file },
+                                region: {
+                                    startLine: finding.line,
+                                    startColumn: finding.column,
+                                },
+                            },
+                        },
+                    ],
+                })),
+            },
+        ],
+    }, null, 2);
+}
+function sarifLevel(severity) {
+    if (severity === "critical" || severity === "high")
+        return "error";
+    if (severity === "medium" || severity === "low")
+        return "warning";
+    return "note";
+}
+//# sourceMappingURL=reporters.js.map

package/dist/scanner/reporters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reporters.js","sourceRoot":"","sources":["../../src/scanner/reporters.ts"],"names":[],"mappings":"AAEA,MAAM,cAAc,GAAG;IACrB,IAAI,EAAE,CAAC;IACP,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;IACP,QAAQ,EAAE,CAAC;CACH,CAAC;AAEX,MAAM,UAAU,oBAAoB,CAAC,OAAwB,EAAE,OAAoC;IACjG,OAAO,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAA2B;IAC7D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,6BAA6B,CAAC;IACvC,CAAC;IACD,OAAO,QAAQ;SACZ,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CACf;QACE,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QACxC,OAAO,CAAC,QAAQ;QAChB,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE;QACnD,OAAO,CAAC,aAAa,IAAI,EAAE;KAC5B,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC7B;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,QAA2B;IAC5D,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAA2B;IAC7D,MAAM,KAAK,GAAG,IAAI,GAAG,EAA2B,CAAC;IACjD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,OAAO,EAAE,OAAO;QAChB,OAAO,EAAE,+CAA+C;QACxD,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE;oBACJ,MAAM,EAAE;wBACN,IAAI,EAAE,OAAO;wBACb,cAAc,EAAE,yDAAyD;wBACzE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;4BAClD,EAAE,EAAE,OAAO,CAAC,MAAM;4BAClB,IAAI,EAAE,OAAO,CAAC,QAAQ;4BACtB,gBAAgB,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE;4BAC5C,eAAe,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE;4BAC1C,oBAAoB,EAAE;gCACpB,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC;6BACpC;yBACF,CAAC,CAAC;qBACJ;iBACF;gBACD,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;oBAClC,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC;oBACnC,OAAO,EAAE;wBACP,IAAI,EAAE,GAAG,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;qBACxF;oBACD,mBAAmB,EAAE;wBACnB,uBAAuB,EAAE,OAAO,CAAC,WAAW;qBAC7C;oBACD,SAAS,EAAE;wBACT;4BACE,gBAAgB,EAAE;gCAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE;gCACvC,MAAM,EAAE;oCACN,SAAS,EAAE,OAAO,CAAC,IAAI;oCACvB,WAAW,EAAE,OAAO,CAAC,MAAM;iCAC5B;6BACF;yBACF;qBACF;iBACF,CAAC,CAAC;aACJ;SACF;KACF,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CAAC,QAAqC;IACvD,IAAI,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,OAAO,CAAC;IACnE,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IAClE,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/scanner/rules.d.ts

@@ -0,0 +1,24 @@
+import type { RulePack, ScanTarget, SecurityFinding, SecurityRule, SecFnSeverity } from "../types.js";
+export interface PatternSecurityRuleConfig {
+    id: string;
+    name: string;
+    description: string;
+    severity: SecFnSeverity;
+    pattern: RegExp;
+    entropy?: number;
+}
+export declare class PatternSecurityRule implements SecurityRule {
+    readonly id: string;
+    readonly name: string;
+    readonly description: string;
+    readonly severity: SecFnSeverity;
+    private readonly pattern;
+    private readonly entropy?;
+    constructor(config: PatternSecurityRuleConfig);
+    evaluate({ target, content }: {
+        target: ScanTarget;
+        content: string;
+    }): SecurityFinding[];
+}
+export declare const defaultSecretRulePack: RulePack;
+//# sourceMappingURL=rules.d.ts.map

package/dist/scanner/rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../src/scanner/rules.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,eAAe,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAStG,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,aAAa,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,qBAAa,mBAAoB,YAAW,YAAY;IACtD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAS;gBAEtB,MAAM,EAAE,yBAAyB;IAS7C,QAAQ,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE;QAAE,MAAM,EAAE,UAAU,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,eAAe,EAAE;CAiC1F;AAED,eAAO,MAAM,qBAAqB,EAAE,QAmFnC,CAAC"}

package/dist/scanner/rules.js

@@ -0,0 +1,141 @@
+import { generateId } from "../id.js";
+import { calculateEntropy, contextForLine, fingerprintFinding, lineColumn, redactSecret, } from "./utils.js";
+export class PatternSecurityRule {
+    id;
+    name;
+    description;
+    severity;
+    pattern;
+    entropy;
+    constructor(config) {
+        this.id = config.id;
+        this.name = config.name;
+        this.description = config.description;
+        this.severity = config.severity;
+        this.pattern = ensureGlobal(config.pattern);
+        this.entropy = config.entropy;
+    }
+    evaluate({ target, content }) {
+        const findings = [];
+        for (const match of content.matchAll(this.pattern)) {
+            if (match.index === undefined || !match[0])
+                continue;
+            const value = match[1] || match[0];
+            if (this.entropy !== undefined && calculateEntropy(value) < this.entropy) {
+                continue;
+            }
+            const location = lineColumn(content, match.index);
+            const file = target.displayPath ?? target.path;
+            findings.push({
+                id: generateId("finding"),
+                ruleId: this.id,
+                ruleName: this.name,
+                severity: this.severity,
+                message: this.description,
+                file,
+                line: location.line,
+                column: location.column,
+                match: value,
+                redactedMatch: redactSecret(value),
+                fingerprint: fingerprintFinding({
+                    ruleId: this.id,
+                    file,
+                    line: location.line,
+                    column: location.column,
+                    value,
+                }),
+                context: contextForLine(content, location.line),
+            });
+        }
+        return findings;
+    }
+}
+export const defaultSecretRulePack = {
+    id: "secfn.secrets",
+    name: "SecFn Secret Detection",
+    rules: [
+        new PatternSecurityRule({
+            id: "secret.aws_access_key",
+            name: "AWS Access Key",
+            description: "AWS access key detected",
+            severity: "critical",
+            pattern: /AKIA[0-9A-Z]{16}/g,
+            entropy: 3.5,
+        }),
+        new PatternSecurityRule({
+            id: "secret.aws_secret_key",
+            name: "AWS Secret Key",
+            description: "AWS secret access key assignment detected",
+            severity: "critical",
+            pattern: /aws[_-]?secret[_-]?access[_-]?key\s*[=:]\s*['"]?([A-Za-z0-9/+=]{40})['"]?/gi,
+            entropy: 3.5,
+        }),
+        new PatternSecurityRule({
+            id: "secret.github_token",
+            name: "GitHub Token",
+            description: "GitHub token detected",
+            severity: "critical",
+            pattern: /\b(gh[pousr]_[A-Za-z0-9_]{36,255})\b/g,
+            entropy: 3.5,
+        }),
+        new PatternSecurityRule({
+            id: "secret.openai_key",
+            name: "OpenAI API Key",
+            description: "OpenAI API key detected",
+            severity: "critical",
+            pattern: /\b(sk-[A-Za-z0-9_-]{20,})\b/g,
+            entropy: 3.0,
+        }),
+        new PatternSecurityRule({
+            id: "secret.stripe_key",
+            name: "Stripe API Key",
+            description: "Stripe API key detected",
+            severity: "critical",
+            pattern: /\b((?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,})\b/g,
+            entropy: 3.0,
+        }),
+        new PatternSecurityRule({
+            id: "secret.slack_token",
+            name: "Slack Token",
+            description: "Slack token detected",
+            severity: "high",
+            pattern: /\b(xox[baprs]-[A-Za-z0-9-]{10,})\b/g,
+            entropy: 3.0,
+        }),
+        new PatternSecurityRule({
+            id: "secret.private_key",
+            name: "Private Key",
+            description: "Private key block detected",
+            severity: "critical",
+            pattern: /-----BEGIN (?:RSA |OPENSSH |DSA |EC |PGP )?PRIVATE KEY-----/g,
+        }),
+        new PatternSecurityRule({
+            id: "secret.jwt",
+            name: "JWT Token",
+            description: "JWT token detected",
+            severity: "high",
+            pattern: /\b(eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+)\b/g,
+            entropy: 3.0,
+        }),
+        new PatternSecurityRule({
+            id: "secret.database_url",
+            name: "Database URL With Credentials",
+            description: "Database URL containing credentials detected",
+            severity: "high",
+            pattern: /\b((?:postgres|postgresql|mysql|mongodb|redis):\/\/[^:\s]+:[^@\s]+@[^\s'"]+)/gi,
+        }),
+        new PatternSecurityRule({
+            id: "secret.generic_api_key",
+            name: "Generic API Key",
+            description: "Generic API key assignment detected",
+            severity: "medium",
+            pattern: /(?:api[_-]?key|secret|token)\s*[=:]\s*['"]?([A-Za-z0-9_\-./+=]{24,})['"]?/gi,
+            entropy: 3.5,
+        }),
+    ],
+};
+function ensureGlobal(pattern) {
+    const flags = pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`;
+    return new RegExp(pattern.source, flags);
+}
+//# sourceMappingURL=rules.js.map

package/dist/scanner/rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../src/scanner/rules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAEtC,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,kBAAkB,EAClB,UAAU,EACV,YAAY,GACb,MAAM,YAAY,CAAC;AAWpB,MAAM,OAAO,mBAAmB;IACrB,EAAE,CAAS;IACX,IAAI,CAAS;IACb,WAAW,CAAS;IACpB,QAAQ,CAAgB;IAChB,OAAO,CAAS;IAChB,OAAO,CAAU;IAElC,YAAY,MAAiC;QAC3C,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC;QACpB,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QACtC,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAChC,CAAC;IAED,QAAQ,CAAC,EAAE,MAAM,EAAE,OAAO,EAA2C;QACnE,MAAM,QAAQ,GAAsB,EAAE,CAAC;QACvC,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACnD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;gBAAE,SAAS;YACrD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;YACnC,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,gBAAgB,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;gBACzE,SAAS;YACX,CAAC;YACD,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC;YAC/C,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,UAAU,CAAC,SAAS,CAAC;gBACzB,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,OAAO,EAAE,IAAI,CAAC,WAAW;gBACzB,IAAI;gBACJ,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,KAAK,EAAE,KAAK;gBACZ,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC;gBAClC,WAAW,EAAE,kBAAkB,CAAC;oBAC9B,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,IAAI;oBACJ,IAAI,EAAE,QAAQ,CAAC,IAAI;oBACnB,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,KAAK;iBACN,CAAC;gBACF,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC;aAChD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAa;IAC7C,EAAE,EAAE,eAAe;IACnB,IAAI,EAAE,wBAAwB;IAC9B,KAAK,EAAE;QACL,IAAI,mBAAmB,CAAC;YACtB,EAAE,EAAE,uBAAuB;YAC3B,IAAI,EAAE,gBAAgB;YACtB,WAAW,EAAE,yBAAyB;YACtC,QAAQ,EAAE,UAAU;YACpB,OAAO,EAAE,mBAAmB;YAC5B,OAAO,EAAE,GAAG;SACb,CAAC;QACF,IAAI,mBAAmB,CAAC;YACtB,EAAE,EAAE,uBAAuB;YAC3B,IAAI,EAAE,gBAAgB;YACtB,WAAW,EAAE,2CAA2C;YACxD,QAAQ,EAAE,UAAU;YACpB,OAAO,EAAE,6EAA6E;YACtF,OAAO,EAAE,GAAG;SACb,CAAC;QACF,IAAI,mBAAmB,CAAC;YACtB,EAAE,EAAE,qBAAqB;YACzB,IAAI,EAAE,cAAc;YACpB,WAAW,EAAE,uBAAuB;YACpC,QAAQ,EAAE,UAAU;YACpB,OAAO,EAAE,uCAAuC;YAChD,OAAO,EAAE,GAAG;SACb,CAAC;QACF,IAAI,mBAAmB,CAAC;YACtB,EAAE,EAAE,mBAAmB;YACvB,IAAI,EAAE,gBAAgB;YACtB,WAAW,EAAE,yBAAyB;YACtC,QAAQ,EAAE,UAAU;YACpB,OAAO,EAAE,8BAA8B;YACvC,OAAO,EAAE,GAAG;SACb,CAAC;QACF,IAAI,mBAAmB,CAAC;YACtB,EAAE,EAAE,mBAAmB;YACvB,IAAI,EAAE,gBAAgB;YACtB,WAAW,EAAE,yBAAyB;YACtC,QAAQ,EAAE,UAAU;YACpB,OAAO,EAAE,iDAAiD;YAC1D,OAAO,EAAE,GAAG;SACb,CAAC;QACF,IAAI,mBAAmB,CAAC;YACtB,EAAE,EAAE,oBAAoB;YACxB,IAAI,EAAE,aAAa;YACnB,WAAW,EAAE,sBAAsB;YACnC,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,qCAAqC;YAC9C,OAAO,EAAE,GAAG;SACb,CAAC;QACF,IAAI,mBAAmB,CAAC;YACtB,EAAE,EAAE,oBAAoB;YACxB,IAAI,EAAE,aAAa;YACnB,WAAW,EAAE,4BAA4B;YACzC,QAAQ,EAAE,UAAU;YACpB,OAAO,EAAE,8DAA8D;SACxE,CAAC;QACF,IAAI,mBAAmB,CAAC;YACtB,EAAE,EAAE,YAAY;YAChB,IAAI,EAAE,WAAW;YACjB,WAAW,EAAE,oBAAoB;YACjC,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,6DAA6D;YACtE,OAAO,EAAE,GAAG;SACb,CAAC;QACF,IAAI,mBAAmB,CAAC;YACtB,EAAE,EAAE,qBAAqB;YACzB,IAAI,EAAE,+BAA+B;YACrC,WAAW,EAAE,8CAA8C;YAC3D,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,gFAAgF;SAC1F,CAAC;QACF,IAAI,mBAAmB,CAAC;YACtB,EAAE,EAAE,wBAAwB;YAC5B,IAAI,EAAE,iBAAiB;YACvB,WAAW,EAAE,qCAAqC;YAClD,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,6EAA6E;YACtF,OAAO,EAAE,GAAG;SACb,CAAC;KACH;CACF,CAAC;AAEF,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,GAAG,CAAC;IAChF,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAC3C,CAAC"}

package/dist/scanner/scanner.d.ts

@@ -0,0 +1,25 @@
+import type { RulePack, ScanTarget, SecurityFinding } from "../types.js";
+export interface SecurityScannerOptions {
+    rulePacks?: RulePack[];
+    excludePaths?: string[];
+    maxFileSize?: number;
+}
+export interface ScanDirectoryOptions {
+    saveContent?: false;
+}
+export interface GitHistoryScanOptions {
+    commits?: number;
+    branch?: string;
+}
+export declare class SecurityScanner {
+    private readonly rulePacks;
+    private readonly excludePaths;
+    private readonly maxFileSize;
+    constructor(options?: SecurityScannerOptions);
+    scanContent(content: string, target: ScanTarget): SecurityFinding[];
+    scanFile(filePath: string): Promise<SecurityFinding[]>;
+    scanDirectory(dir: string): Promise<SecurityFinding[]>;
+    scanGitHistory(options?: GitHistoryScanOptions): Promise<SecurityFinding[]>;
+}
+export declare function createSecurityScanner(options?: SecurityScannerOptions): SecurityScanner;
+//# sourceMappingURL=scanner.d.ts.map

package/dist/scanner/scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../../src/scanner/scanner.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAKzE,MAAM,WAAW,sBAAsB;IACrC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACnC,WAAW,CAAC,EAAE,KAAK,CAAC;CACrB;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAa;IACvC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAW;IACxC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;gBAEzB,OAAO,GAAE,sBAA2B;IAahD,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,eAAe,EAAE;IAM7D,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAQtD,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAkBtD,cAAc,CAAC,OAAO,GAAE,qBAA0B,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;CAkBtF;AAED,wBAAgB,qBAAqB,CAAC,OAAO,CAAC,EAAE,sBAAsB,GAAG,eAAe,CAEvF"}

package/dist/scanner/scanner.js

@@ -0,0 +1,73 @@
+import { execFile } from "node:child_process";
+import { readFile } from "node:fs/promises";
+import { promisify } from "node:util";
+import { glob } from "glob";
+import { defaultSecretRulePack } from "./rules.js";
+const execFileAsync = promisify(execFile);
+export class SecurityScanner {
+    rulePacks;
+    excludePaths;
+    maxFileSize;
+    constructor(options = {}) {
+        this.rulePacks = options.rulePacks ?? [defaultSecretRulePack];
+        this.excludePaths = options.excludePaths ?? [
+            "node_modules/**",
+            "dist/**",
+            "build/**",
+            ".git/**",
+            ".next/**",
+            "coverage/**",
+        ];
+        this.maxFileSize = options.maxFileSize ?? 1024 * 1024;
+    }
+    scanContent(content, target) {
+        return this.rulePacks.flatMap((pack) => pack.rules.flatMap((rule) => rule.evaluate({ content, target })));
+    }
+    async scanFile(filePath) {
+        const content = await readFile(filePath, "utf8");
+        if (Buffer.byteLength(content, "utf8") > this.maxFileSize) {
+            return [];
+        }
+        return this.scanContent(content, { path: filePath });
+    }
+    async scanDirectory(dir) {
+        const files = await glob("**/*", {
+            cwd: dir,
+            absolute: true,
+            nodir: true,
+            ignore: this.excludePaths,
+        });
+        const findings = [];
+        for (const file of files) {
+            try {
+                findings.push(...await this.scanFile(file));
+            }
+            catch {
+                // Binary/unreadable files are ignored by design.
+            }
+        }
+        return findings;
+    }
+    async scanGitHistory(options = {}) {
+        const commits = String(options.commits ?? 100);
+        const branch = options.branch ?? "HEAD";
+        const { stdout } = await execFileAsync("git", ["log", branch, `-n${commits}`, "--format=%H"]);
+        const findings = [];
+        for (const hash of stdout.split("\n").filter(Boolean)) {
+            const shown = await execFileAsync("git", ["show", "--format=medium", "--no-ext-diff", hash]);
+            const commitFindings = this.scanContent(shown.stdout, {
+                path: `commit:${hash}`,
+                displayPath: `commit:${hash.slice(0, 12)}`,
+            });
+            for (const finding of commitFindings) {
+                finding.metadata = { ...(finding.metadata ?? {}), commit: hash };
+            }
+            findings.push(...commitFindings);
+        }
+        return findings;
+    }
+}
+export function createSecurityScanner(options) {
+    return new SecurityScanner(options);
+}
+//# sourceMappingURL=scanner.js.map

package/dist/scanner/scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../../src/scanner/scanner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAEnD,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAiB1C,MAAM,OAAO,eAAe;IACT,SAAS,CAAa;IACtB,YAAY,CAAW;IACvB,WAAW,CAAS;IAErC,YAAY,UAAkC,EAAE;QAC9C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAC9D,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI;YAC1C,iBAAiB;YACjB,SAAS;YACT,UAAU;YACV,SAAS;YACT,UAAU;YACV,aAAa;SACd,CAAC;QACF,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,GAAG,IAAI,CAAC;IACxD,CAAC;IAED,WAAW,CAAC,OAAe,EAAE,MAAkB;QAC7C,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CACjE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,QAAgB;QAC7B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACjD,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YAC1D,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,GAAW;QAC7B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE;YAC/B,GAAG,EAAE,GAAG;YACR,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,IAAI,CAAC,YAAY;SAC1B,CAAC,CAAC;QACH,MAAM,QAAQ,GAAsB,EAAE,CAAC;QACvC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9C,CAAC;YAAC,MAAM,CAAC;gBACP,iDAAiD;YACnD,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,UAAiC,EAAE;QACtD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,GAAG,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC;QACxC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,OAAO,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC;QAC9F,MAAM,QAAQ,GAAsB,EAAE,CAAC;QACvC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,iBAAiB,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC;YAC7F,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE;gBACpD,IAAI,EAAE,UAAU,IAAI,EAAE;gBACtB,WAAW,EAAE,UAAU,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;aAC3C,CAAC,CAAC;YACH,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;gBACrC,OAAO,CAAC,QAAQ,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YACnE,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAgC;IACpE,OAAO,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC"}

package/dist/scanner/utils.d.ts

@@ -0,0 +1,15 @@
+export declare function calculateEntropy(value: string): number;
+export declare function redactSecret(value: string): string;
+export declare function fingerprintFinding(input: {
+    ruleId: string;
+    file: string;
+    line: number;
+    column: number;
+    value: string;
+}): string;
+export declare function lineColumn(content: string, index: number): {
+    line: number;
+    column: number;
+};
+export declare function contextForLine(content: string, line: number, span?: number): string;
+//# sourceMappingURL=utils.d.ts.map

package/dist/scanner/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/scanner/utils.ts"],"names":[],"mappings":"AAEA,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAYtD;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGlD;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,MAAM,CAIT;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAO3F;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,SAAI,GAAG,MAAM,CAK9E"}

package/dist/scanner/utils.js

@@ -0,0 +1,40 @@
+import { createHash } from "node:crypto";
+export function calculateEntropy(value) {
+    if (!value)
+        return 0;
+    const counts = new Map();
+    for (const char of value) {
+        counts.set(char, (counts.get(char) ?? 0) + 1);
+    }
+    let entropy = 0;
+    for (const count of counts.values()) {
+        const probability = count / value.length;
+        entropy -= probability * Math.log2(probability);
+    }
+    return entropy;
+}
+export function redactSecret(value) {
+    if (value.length <= 8)
+        return "[redacted]";
+    return `${value.slice(0, 4)}...${value.slice(-4)}`;
+}
+export function fingerprintFinding(input) {
+    return createHash("sha256")
+        .update(`${input.ruleId}:${input.file}:${input.line}:${input.column}:${input.value}`)
+        .digest("hex");
+}
+export function lineColumn(content, index) {
+    const before = content.slice(0, index);
+    const lines = before.split("\n");
+    return {
+        line: lines.length,
+        column: lines[lines.length - 1].length + 1,
+    };
+}
+export function contextForLine(content, line, span = 2) {
+    const lines = content.split("\n");
+    const start = Math.max(0, line - span - 1);
+    const end = Math.min(lines.length, line + span);
+    return lines.slice(start, end).join("\n");
+}
+//# sourceMappingURL=utils.js.map

package/dist/scanner/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../src/scanner/utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,CAAC;IACrB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QACpC,MAAM,WAAW,GAAG,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC;QACzC,OAAO,IAAI,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,YAAY,CAAC;IAC3C,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAMlC;IACC,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;SACpF,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,OAAe,EAAE,KAAa;IACvD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,MAAM;QAClB,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,IAAY,EAAE,IAAI,GAAG,CAAC;IACpE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,GAAG,IAAI,CAAC,CAAC;IAChD,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC"}

package/dist/schema.d.ts

@@ -0,0 +1,9 @@
+import type { TableSchema } from "@superfunctions/db";
+export declare const SECFN_SCHEMA_VERSION = 1;
+export declare function getSecFnSchema(): TableSchema[];
+export interface SecFnSchemaDefinition {
+    version: number;
+    schemas: TableSchema[];
+}
+export declare function getSchema(): SecFnSchemaDefinition;
+//# sourceMappingURL=schema.d.ts.map

package/dist/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAEtC,wBAAgB,cAAc,IAAI,WAAW,EAAE,CA8N9C;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,WAAW,EAAE,CAAC;CACxB;AAED,wBAAgB,SAAS,IAAI,qBAAqB,CAKjD"}