@superblocksteam/vite-plugin-file-sync 1.99.99-next.3 → 2.0.0-SNAPSHOT.2143e2e95d0107ab

package/dist/ai-service/security/secret-scanner-service.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Singleton secret scanner service with caching, concurrency control,
+ * and availability gating.
+ *
+ * Wraps the low-level TruffleHog process-spawning logic from
+ * `secret-scanner.ts` to prevent resource exhaustion in containers:
+ *
+ * - **Caching**: Content-hash keyed results avoid re-scanning identical
+ *   content within a TTL window.
+ * - **In-flight deduplication**: Concurrent scans of identical content
+ *   coalesce into a single TruffleHog invocation.
+ * - **Concurrency control**: A promise-based semaphore limits the number
+ *   of concurrent TruffleHog child processes.
+ * - **Availability gating**: Callers share a pending probe and cache only
+ *   successful availability. Failed checks retry on the next caller.
+ */
+import { type SecretScanOptions, type SecretScanResult } from "./secret-scanner.js";
+/** Time-to-live for cached scan results (ms). */
+export declare const CACHE_TTL_MS: number;
+/**
+ * Scans text content for secrets using TruffleHog, with caching,
+ * concurrency control, and availability gating.
+ *
+ * Drop-in replacement for the original `scanContentForSecrets` from
+ * `secret-scanner.ts` — same signature, same return type.
+ *
+ * @param content - The text content to scan for secrets
+ * @param options - Scan configuration options
+ * @returns Promise resolving to scan results with any findings
+ */
+export declare function scanContentForSecrets(content: string, options?: SecretScanOptions): Promise<SecretScanResult>;
+/**
+ * Checks availability, sharing pending probes and caching successful checks.
+ */
+export declare function isTrufflehogAvailable(): Promise<boolean>;
+/**
+ * Disposes the singleton scanner service, clearing all caches and
+ * resetting the availability flag.
+ *
+ * Primarily useful in tests or graceful shutdown.
+ */
+export declare function disposeSecretScanner(): void;
+//# sourceMappingURL=secret-scanner-service.d.ts.map

package/dist/ai-service/security/secret-scanner-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-scanner-service.d.ts","sourceRoot":"","sources":["../../../src/ai-service/security/secret-scanner-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAOH,OAAO,EAML,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EAEtB,MAAM,qBAAqB,CAAC;AAQ7B,iDAAiD;AACjD,eAAO,MAAM,YAAY,QAAgB,CAAC;AA+b1C;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,gBAAgB,CAAC,CAE3B;AAED;;GAEG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,OAAO,CAAC,CAE9D;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAK3C"}

package/dist/ai-service/security/secret-scanner-service.js

@@ -0,0 +1,422 @@
+/**
+ * Singleton secret scanner service with caching, concurrency control,
+ * and availability gating.
+ *
+ * Wraps the low-level TruffleHog process-spawning logic from
+ * `secret-scanner.ts` to prevent resource exhaustion in containers:
+ *
+ * - **Caching**: Content-hash keyed results avoid re-scanning identical
+ *   content within a TTL window.
+ * - **In-flight deduplication**: Concurrent scans of identical content
+ *   coalesce into a single TruffleHog invocation.
+ * - **Concurrency control**: A promise-based semaphore limits the number
+ *   of concurrent TruffleHog child processes.
+ * - **Availability gating**: Callers share a pending probe and cache only
+ *   successful availability. Failed checks retry on the next caller.
+ */
+import { createHash } from "node:crypto";
+import { metrics } from "@opentelemetry/api";
+import { getPrefixedLogger } from "../../util/logger.js";
+import { TrufflehogError, probeTrufflehogAvailability, runTrufflehog, redactSecrets, } from "./secret-scanner.js";
+/** Default timeout for a single TruffleHog scan (ms). */
+const DEFAULT_SCAN_TIMEOUT_MS = 10_000;
+/** Maximum number of cached scan results. */
+const MAX_CACHE_SIZE = 200;
+/** Time-to-live for cached scan results (ms). */
+export const CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes
+/** Maximum concurrent TruffleHog child processes. */
+const MAX_CONCURRENCY = 2;
+/** One caller may retry a failed scan after 30 seconds. No background retries. */
+const SCAN_COOLDOWN_MS = 30_000;
+function spawnFailureMessage(errno) {
+    return errno === "ENOENT"
+        ? "TruffleHog could not be launched (ENOENT). Manually install TruffleHog or correct PATH for this dev server: https://github.com/trufflesecurity/trufflehog"
+        : `TruffleHog could not be launched (${errno ?? "unknown errno"}). Check process resource limits, executable permissions and PATH for this dev server.`;
+}
+function availabilityFailureMessage(failure) {
+    switch (failure.category) {
+        case "spawn_error":
+            return spawnFailureMessage(failure.errno);
+        case "nonzero_exit":
+            return `TruffleHog version check exited with code ${failure.exitCode}. Run trufflehog --version manually and repair the installation.`;
+        case "signal":
+            return `TruffleHog version check terminated by ${failure.signal}. Check process limits and external termination, then run trufflehog --version manually.`;
+        case "deadline":
+            return "TruffleHog version check exceeded its deadline. Check whether trufflehog --version completes manually.";
+    }
+}
+function runtimeFailureMessage(error) {
+    const failure = error.failure;
+    if (failure.category !== "spawn_error")
+        return error.message;
+    return spawnFailureMessage(failure.errno);
+}
+/**
+ * Singleton service that wraps TruffleHog process spawning with caching,
+ * in-flight deduplication, concurrency control, and availability gating.
+ *
+ * Not intended to be instantiated directly — use the module-level
+ * {@link scanContentForSecrets} and {@link isTrufflehogAvailable} functions.
+ */
+class SecretScannerService {
+    /** Content hash -> cached findings. */
+    cache = new Map();
+    /** Content hash -> in-flight scan promise (coalesces duplicate requests). */
+    inflight = new Map();
+    /** Number of TruffleHog processes currently running. */
+    activeProcesses = 0;
+    /** Waiters blocked on a concurrency slot. */
+    waitQueue = [];
+    available;
+    pendingAvailability;
+    disposed = false;
+    runtimeFailure;
+    reportedAvailabilityFailure;
+    reportedRuntimeFailure;
+    meter = metrics.getMeter("superblocks.clark.secret_scanning");
+    attempts = this.meter.createCounter("superblocks.clark.secret_scan.attempts");
+    results = this.meter.createCounter("superblocks.clark.secret_scan.results");
+    /**
+     * Scan content for secrets, applying caching and concurrency control.
+     *
+     * @param content - Text to scan
+     * @param options - Scan configuration
+     * @returns Scan result with findings and redacted content
+     */
+    async scan(content, options = {}) {
+        const timeout = options.timeout && options.timeout > 0
+            ? options.timeout
+            : DEFAULT_SCAN_TIMEOUT_MS;
+        const { verifiedOnly = false } = options;
+        // 1. Availability gate before looking up successfully scanned content.
+        const availability = await this.getAvailability();
+        if (!availability.available) {
+            return {
+                success: false,
+                findings: [],
+                error: availabilityFailureMessage(availability.failure),
+                failure: availability.failure,
+                hasVerifiedSecrets: false,
+                hasSecrets: false,
+                redactedContent: content,
+            };
+        }
+        // 2. Cache lookup
+        const cacheKey = this.hashContent(content, verifiedOnly);
+        const cached = this.cache.get(cacheKey);
+        if (cached && cached.expiresAt > Date.now()) {
+            const findings = cached.findings;
+            this.results.add(1, {
+                "scan.consumer": options.consumer ?? "unknown",
+                "scan.outcome": "cache_hit",
+            });
+            return {
+                success: true,
+                findings,
+                hasVerifiedSecrets: findings.some((f) => f.verified),
+                hasSecrets: findings.length > 0,
+                redactedContent: redactSecrets(content, findings),
+            };
+        }
+        // 3. All consumers share the attempt, but retain their own original content.
+        const existing = this.inflight.get(cacheKey);
+        const consumers = existing?.consumers ?? new Set();
+        const consumerTypes = existing?.consumerTypes ?? new Set();
+        consumers.add(options.signal);
+        consumerTypes.add(options.consumer);
+        let scanPromise = existing?.promise;
+        if (!scanPromise) {
+            scanPromise = this.runWithConcurrencyControl(content, timeout, verifiedOnly, cacheKey, consumers, consumerTypes);
+            this.inflight.set(cacheKey, {
+                promise: scanPromise,
+                consumers,
+                consumerTypes,
+            });
+        }
+        try {
+            const findings = await scanPromise;
+            return {
+                success: true,
+                findings,
+                hasVerifiedSecrets: findings.some((f) => f.verified),
+                hasSecrets: findings.length > 0,
+                redactedContent: redactSecrets(content, findings),
+            };
+        }
+        catch (error) {
+            return {
+                success: false,
+                findings: [],
+                error: error instanceof TrufflehogError
+                    ? runtimeFailureMessage(error)
+                    : "Secret scan failed",
+                failure: error instanceof TrufflehogError ? error.failure : undefined,
+                hasVerifiedSecrets: false,
+                hasSecrets: false,
+                redactedContent: content,
+            };
+        }
+    }
+    /** Share pending checks, cache only success, and retry failures next call. */
+    async getAvailability() {
+        if (this.available === true) {
+            return { available: true };
+        }
+        if (this.pendingAvailability) {
+            return this.pendingAvailability;
+        }
+        this.pendingAvailability = probeTrufflehogAvailability()
+            .then((result) => {
+            if (result.available) {
+                this.available = true;
+                this.reportedAvailabilityFailure = undefined;
+            }
+            else {
+                const failure = result.failure;
+                const fingerprint = JSON.stringify([
+                    failure.category,
+                    failure.errno,
+                    failure.exitCode,
+                    failure.signal,
+                    failure.deadlineExpired,
+                ]);
+                if (fingerprint !== this.reportedAvailabilityFailure) {
+                    this.reportedAvailabilityFailure = fingerprint;
+                    getPrefixedLogger("[secret-scan]").error(`${availabilityFailureMessage(failure)} Requests continue without secret scanning. Evidence: ${JSON.stringify({
+                        "scan.failure_category": failure.category,
+                        "process.errno": failure.errno,
+                        "process.exit_code": failure.exitCode,
+                        "process.signal": failure.signal,
+                        "scan.deadline_expired": failure.deadlineExpired,
+                        "scan.elapsed_ms": failure.elapsedMs,
+                    })}`);
+                }
+            }
+            return result;
+        })
+            .finally(() => {
+            this.pendingAvailability = undefined;
+        });
+        return this.pendingAvailability;
+    }
+    /**
+     * Dispose of the singleton — clears the cache and resets availability.
+     */
+    dispose() {
+        this.disposed = true;
+        this.cache.clear();
+        this.inflight.clear();
+        this.available = undefined;
+    }
+    /**
+     * Compute a cache key from content and scan flags.
+     */
+    hashContent(content, verifiedOnly) {
+        const hash = createHash("sha256");
+        hash.update(content);
+        hash.update(verifiedOnly ? ":v" : ":a");
+        return hash.digest("hex");
+    }
+    /**
+     * Acquire a concurrency slot, run TruffleHog, cache the result, and
+     * release the slot.
+     */
+    async runWithConcurrencyControl(content, timeout, verifiedOnly, cacheKey, consumers, consumerTypes) {
+        await Promise.resolve();
+        try {
+            this.checkRuntimeCooldown(consumerTypes);
+            await this.acquireSlot();
+            try {
+                if (this.disposed ||
+                    [...consumers].every((signal) => signal?.aborted)) {
+                    this.results.add(1, {
+                        "scan.consumer": this.consumerAttribute(consumerTypes),
+                        "scan.outcome": "cancelled",
+                    });
+                    throw new Error("Secret scan cancelled");
+                }
+                // Recheck after waiting: work queued before a failure must not bypass it.
+                this.checkRuntimeCooldown(consumerTypes);
+                const recovery = this.runtimeFailure;
+                if (recovery) {
+                    recovery.recovering = true;
+                    this.reportedRuntimeFailure = undefined;
+                }
+                try {
+                    const consumer = this.consumerAttribute(consumerTypes);
+                    this.attempts.add(1, { "scan.consumer": consumer });
+                    const findings = await runTrufflehog(content, timeout, verifiedOnly);
+                    this.results.add(1, {
+                        "scan.consumer": this.consumerAttribute(consumerTypes),
+                        "scan.outcome": "success",
+                    });
+                    if (recovery && this.runtimeFailure === recovery) {
+                        this.runtimeFailure = undefined;
+                        this.reportRuntime(undefined, true);
+                    }
+                    this.cacheResult(cacheKey, findings);
+                    return findings;
+                }
+                catch (error) {
+                    const safeError = error instanceof TrufflehogError
+                        ? error
+                        : new Error("Secret scan failed");
+                    this.runtimeFailure = {
+                        error: safeError,
+                        retryAt: Date.now() + SCAN_COOLDOWN_MS,
+                        recovering: false,
+                    };
+                    this.results.add(1, {
+                        "scan.consumer": this.consumerAttribute(consumerTypes),
+                        "scan.outcome": safeError instanceof TrufflehogError
+                            ? safeError.failure.category
+                            : "internal_error",
+                    });
+                    this.reportRuntime(safeError);
+                    throw safeError;
+                }
+            }
+            finally {
+                this.releaseSlot();
+            }
+        }
+        finally {
+            // Unpublish as the attempt settles. A caller that arrives after a
+            // failed attempt must start its own scan, not join the rejection.
+            if (this.inflight.get(cacheKey)?.consumers === consumers) {
+                this.inflight.delete(cacheKey);
+            }
+        }
+    }
+    checkRuntimeCooldown(consumers) {
+        const failure = this.runtimeFailure;
+        const loggingOnly = consumers.size === 1 && consumers.has("logging");
+        if (failure &&
+            (Date.now() < failure.retryAt || failure.recovering || loggingOnly)) {
+            this.results.add(1, {
+                "scan.consumer": this.consumerAttribute(consumers),
+                "scan.outcome": "cooldown",
+            });
+            throw failure.error;
+        }
+    }
+    consumerAttribute(consumers) {
+        const values = [...consumers];
+        return values.length === 1 ? (values[0] ?? "unknown") : "shared";
+    }
+    reportRuntime(error, recovered = false) {
+        if (this.disposed)
+            return;
+        const logger = getPrefixedLogger("[secret-scan]");
+        if (!error) {
+            if (recovered) {
+                logger.info("TruffleHog scanning recovered. Secret scanning is enabled.");
+                this.reportedRuntimeFailure = undefined;
+            }
+            return;
+        }
+        const failure = error instanceof TrufflehogError ? error.failure : undefined;
+        const fingerprint = JSON.stringify([
+            failure?.category,
+            failure?.errno,
+            failure?.exitCode,
+            failure?.signal,
+            failure?.deadlineExpired,
+        ]);
+        if (fingerprint === this.reportedRuntimeFailure)
+            return;
+        this.reportedRuntimeFailure = fingerprint;
+        const guidance = error instanceof TrufflehogError
+            ? runtimeFailureMessage(error)
+            : "Secret scan failed internally.";
+        logger.error(`${guidance} Requests continue without secret scanning; one later caller can retry after 30 seconds. ${JSON.stringify({
+            "scan.failure_category": failure?.category ?? "internal_error",
+            "process.errno": failure?.errno,
+            "process.exit_code": failure?.exitCode,
+            "process.signal": failure?.signal,
+            "scan.deadline_expired": failure?.deadlineExpired,
+            "scan.elapsed_ms": failure?.elapsedMs,
+        })}`);
+    }
+    /**
+     * Wait until a concurrency slot is available.
+     */
+    async acquireSlot() {
+        if (this.activeProcesses < MAX_CONCURRENCY) {
+            this.activeProcesses++;
+            return;
+        }
+        return new Promise((resolve) => {
+            this.waitQueue.push(resolve);
+        });
+    }
+    /**
+     * Release a concurrency slot and wake the next waiter.
+     */
+    releaseSlot() {
+        const next = this.waitQueue.shift();
+        if (next) {
+            // Hand the slot directly to the next waiter
+            next();
+        }
+        else {
+            this.activeProcesses--;
+        }
+    }
+    /**
+     * Store findings in the cache, evicting the oldest entry if at capacity.
+     */
+    cacheResult(key, findings) {
+        if (this.cache.size >= MAX_CACHE_SIZE) {
+            // Evict the oldest entry (first key in insertion order)
+            const oldest = this.cache.keys().next().value;
+            if (oldest !== undefined) {
+                this.cache.delete(oldest);
+            }
+        }
+        this.cache.set(key, {
+            findings,
+            expiresAt: Date.now() + CACHE_TTL_MS,
+        });
+    }
+}
+let instance;
+function getInstance() {
+    if (!instance) {
+        instance = new SecretScannerService();
+    }
+    return instance;
+}
+/**
+ * Scans text content for secrets using TruffleHog, with caching,
+ * concurrency control, and availability gating.
+ *
+ * Drop-in replacement for the original `scanContentForSecrets` from
+ * `secret-scanner.ts` — same signature, same return type.
+ *
+ * @param content - The text content to scan for secrets
+ * @param options - Scan configuration options
+ * @returns Promise resolving to scan results with any findings
+ */
+export async function scanContentForSecrets(content, options = {}) {
+    return getInstance().scan(content, options);
+}
+/**
+ * Checks availability, sharing pending probes and caching successful checks.
+ */
+export async function isTrufflehogAvailable() {
+    return (await getInstance().getAvailability()).available;
+}
+/**
+ * Disposes the singleton scanner service, clearing all caches and
+ * resetting the availability flag.
+ *
+ * Primarily useful in tests or graceful shutdown.
+ */
+export function disposeSecretScanner() {
+    if (instance) {
+        instance.dispose();
+        instance = undefined;
+    }
+}
+//# sourceMappingURL=secret-scanner-service.js.map

package/dist/ai-service/security/secret-scanner-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-scanner-service.js","sourceRoot":"","sources":["../../../src/ai-service/security/secret-scanner-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EACL,eAAe,EACf,2BAA2B,EAC3B,aAAa,EACb,aAAa,GAKd,MAAM,qBAAqB,CAAC;AAE7B,yDAAyD;AACzD,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAEvC,6CAA6C;AAC7C,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,iDAAiD;AACjD,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AAEvD,qDAAqD;AACrD,MAAM,eAAe,GAAG,CAAC,CAAC;AAE1B,kFAAkF;AAClF,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEhC,SAAS,mBAAmB,CAAC,KAAc;IACzC,OAAO,KAAK,KAAK,QAAQ;QACvB,CAAC,CAAC,2JAA2J;QAC7J,CAAC,CAAC,qCAAqC,KAAK,IAAI,eAAe,wFAAwF,CAAC;AAC5J,CAAC;AAED,SAAS,0BAA0B,CACjC,OAAyE;IAEzE,QAAQ,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzB,KAAK,aAAa;YAChB,OAAO,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5C,KAAK,cAAc;YACjB,OAAO,6CAA6C,OAAO,CAAC,QAAQ,kEAAkE,CAAC;QACzI,KAAK,QAAQ;YACX,OAAO,0CAA0C,OAAO,CAAC,MAAM,0FAA0F,CAAC;QAC5J,KAAK,UAAU;YACb,OAAO,wGAAwG,CAAC;IACpH,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAsB;IACnD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,OAAO,CAAC,QAAQ,KAAK,aAAa;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IAC7D,OAAO,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC5C,CAAC;AAOD;;;;;;GAMG;AACH,MAAM,oBAAoB;IACxB,uCAAuC;IAC/B,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAE9C,6EAA6E;IACrE,QAAQ,GAAG,IAAI,GAAG,EAOvB,CAAC;IAEJ,wDAAwD;IAChD,eAAe,GAAG,CAAC,CAAC;IAE5B,6CAA6C;IACrC,SAAS,GAAsB,EAAE,CAAC;IAElC,SAAS,CAAsB;IAC/B,mBAAmB,CAA8C;IACjE,QAAQ,GAAG,KAAK,CAAC;IACjB,cAAc,CAER;IACN,2BAA2B,CAAqB;IAChD,sBAAsB,CAAqB;IAClC,KAAK,GAAG,OAAO,CAAC,QAAQ,CACvC,mCAAmC,CACpC,CAAC;IACe,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAClD,wCAAwC,CACzC,CAAC;IACe,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CACjD,uCAAuC,CACxC,CAAC;IAEF;;;;;;OAMG;IACH,KAAK,CAAC,IAAI,CACR,OAAe,EACf,UAA6B,EAAE;QAE/B,MAAM,OAAO,GACX,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,GAAG,CAAC;YACpC,CAAC,CAAC,OAAO,CAAC,OAAO;YACjB,CAAC,CAAC,uBAAuB,CAAC;QAC9B,MAAM,EAAE,YAAY,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC;QAEzC,uEAAuE;QACvE,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAClD,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC;YAC5B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,QAAQ,EAAE,EAAE;gBACZ,KAAK,EAAE,0BAA0B,CAAC,YAAY,CAAC,OAAO,CAAC;gBACvD,OAAO,EAAE,YAAY,CAAC,OAAO;gBAC7B,kBAAkB,EAAE,KAAK;gBACzB,UAAU,EAAE,KAAK;gBACjB,eAAe,EAAE,OAAO;aACzB,CAAC;QACJ,CAAC;QAED,kBAAkB;QAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;YACjC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE;gBAClB,eAAe,EAAE,OAAO,CAAC,QAAQ,IAAI,SAAS;gBAC9C,cAAc,EAAE,WAAW;aAC5B,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,QAAQ;gBACR,kBAAkB,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;gBACpD,UAAU,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAC/B,eAAe,EAAE,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC;aAClD,CAAC;QACJ,CAAC;QAED,6EAA6E;QAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,QAAQ,EAAE,SAAS,IAAI,IAAI,GAAG,EAA2B,CAAC;QAC5E,MAAM,aAAa,GACjB,QAAQ,EAAE,aAAa,IAAI,IAAI,GAAG,EAAiC,CAAC;QACtE,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9B,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,WAAW,GAAG,QAAQ,EAAE,OAAO,CAAC;QACpC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,WAAW,GAAG,IAAI,CAAC,yBAAyB,CAC1C,OAAO,EACP,OAAO,EACP,YAAY,EACZ,QAAQ,EACR,SAAS,EACT,aAAa,CACd,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE;gBAC1B,OAAO,EAAE,WAAW;gBACpB,SAAS;gBACT,aAAa;aACd,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC;YACnC,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,QAAQ;gBACR,kBAAkB,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;gBACpD,UAAU,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAC/B,eAAe,EAAE,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC;aAClD,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,QAAQ,EAAE,EAAE;gBACZ,KAAK,EACH,KAAK,YAAY,eAAe;oBAC9B,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC;oBAC9B,CAAC,CAAC,oBAAoB;gBAC1B,OAAO,EAAE,KAAK,YAAY,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;gBACrE,kBAAkB,EAAE,KAAK;gBACzB,UAAU,EAAE,KAAK;gBACjB,eAAe,EAAE,OAAO;aACzB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,eAAe;QACnB,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC5B,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC7B,CAAC;QACD,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,mBAAmB,CAAC;QAClC,CAAC;QACD,IAAI,CAAC,mBAAmB,GAAG,2BAA2B,EAAE;aACrD,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YACf,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBACrB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;gBACtB,IAAI,CAAC,2BAA2B,GAAG,SAAS,CAAC;YAC/C,CAAC;iBAAM,CAAC;gBACN,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;gBAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC;oBACjC,OAAO,CAAC,QAAQ;oBAChB,OAAO,CAAC,KAAK;oBACb,OAAO,CAAC,QAAQ;oBAChB,OAAO,CAAC,MAAM;oBACd,OAAO,CAAC,eAAe;iBACxB,CAAC,CAAC;gBACH,IAAI,WAAW,KAAK,IAAI,CAAC,2BAA2B,EAAE,CAAC;oBACrD,IAAI,CAAC,2BAA2B,GAAG,WAAW,CAAC;oBAC/C,iBAAiB,CAAC,eAAe,CAAC,CAAC,KAAK,CACtC,GAAG,0BAA0B,CAAC,OAAO,CAAC,yDAAyD,IAAI,CAAC,SAAS,CAC3G;wBACE,uBAAuB,EAAE,OAAO,CAAC,QAAQ;wBACzC,eAAe,EAAE,OAAO,CAAC,KAAK;wBAC9B,mBAAmB,EAAE,OAAO,CAAC,QAAQ;wBACrC,gBAAgB,EAAE,OAAO,CAAC,MAAM;wBAChC,uBAAuB,EAAE,OAAO,CAAC,eAAe;wBAChD,iBAAiB,EAAE,OAAO,CAAC,SAAS;qBACrC,CACF,EAAE,CACJ,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,mBAAmB,GAAG,SAAS,CAAC;QACvC,CAAC,CAAC,CAAC;QACL,OAAO,IAAI,CAAC,mBAAmB,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,OAAO;QACL,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,OAAe,EAAE,YAAqB;QACxD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACrB,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACxC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,yBAAyB,CACrC,OAAe,EACf,OAAe,EACf,YAAqB,EACrB,QAAgB,EAChB,SAAuC,EACvC,aAAiD;QAEjD,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC;YACzC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,IACE,IAAI,CAAC,QAAQ;oBACb,CAAC,GAAG,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EACjD,CAAC;oBACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE;wBAClB,eAAe,EAAE,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC;wBACtD,cAAc,EAAE,WAAW;qBAC5B,CAAC,CAAC;oBACH,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;gBAC3C,CAAC;gBACD,0EAA0E;gBAC1E,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC;gBACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC;gBACrC,IAAI,QAAQ,EAAE,CAAC;oBACb,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC;oBAC3B,IAAI,CAAC,sBAAsB,GAAG,SAAS,CAAC;gBAC1C,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;oBACvD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,CAAC;oBACpD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;oBACrE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE;wBAClB,eAAe,EAAE,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC;wBACtD,cAAc,EAAE,SAAS;qBAC1B,CAAC,CAAC;oBACH,IAAI,QAAQ,IAAI,IAAI,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;wBACjD,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;wBAChC,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;oBACtC,CAAC;oBACD,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;oBACrC,OAAO,QAAQ,CAAC;gBAClB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,SAAS,GACb,KAAK,YAAY,eAAe;wBAC9B,CAAC,CAAC,KAAK;wBACP,CAAC,CAAC,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;oBACtC,IAAI,CAAC,cAAc,GAAG;wBACpB,KAAK,EAAE,SAAS;wBAChB,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB;wBACtC,UAAU,EAAE,KAAK;qBAClB,CAAC;oBACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE;wBAClB,eAAe,EAAE,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC;wBACtD,cAAc,EACZ,SAAS,YAAY,eAAe;4BAClC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ;4BAC5B,CAAC,CAAC,gBAAgB;qBACvB,CAAC,CAAC;oBACH,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;oBAC9B,MAAM,SAAS,CAAC;gBAClB,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,kEAAkE;YAClE,kEAAkE;YAClE,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC;gBACzD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IAEO,oBAAoB,CAC1B,SAA6C;QAE7C,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC;QACpC,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,KAAK,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACrE,IACE,OAAO;YACP,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,IAAI,WAAW,CAAC,EACnE,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE;gBAClB,eAAe,EAAE,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC;gBAClD,cAAc,EAAE,UAAU;aAC3B,CAAC,CAAC;YACH,MAAM,OAAO,CAAC,KAAK,CAAC;QACtB,CAAC;IACH,CAAC;IAEO,iBAAiB,CACvB,SAA6C;QAE7C,MAAM,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC;QAC9B,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACnE,CAAC;IAEO,aAAa,CAAC,KAAa,EAAE,SAAS,GAAG,KAAK;QACpD,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC1B,MAAM,MAAM,GAAG,iBAAiB,CAAC,eAAe,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,CACT,4DAA4D,CAC7D,CAAC;gBACF,IAAI,CAAC,sBAAsB,GAAG,SAAS,CAAC;YAC1C,CAAC;YACD,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GACX,KAAK,YAAY,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/D,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC;YACjC,OAAO,EAAE,QAAQ;YACjB,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,QAAQ;YACjB,OAAO,EAAE,MAAM;YACf,OAAO,EAAE,eAAe;SACzB,CAAC,CAAC;QACH,IAAI,WAAW,KAAK,IAAI,CAAC,sBAAsB;YAAE,OAAO;QACxD,IAAI,CAAC,sBAAsB,GAAG,WAAW,CAAC;QAC1C,MAAM,QAAQ,GACZ,KAAK,YAAY,eAAe;YAC9B,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC;YAC9B,CAAC,CAAC,gCAAgC,CAAC;QACvC,MAAM,CAAC,KAAK,CACV,GAAG,QAAQ,4FAA4F,IAAI,CAAC,SAAS,CACnH;YACE,uBAAuB,EAAE,OAAO,EAAE,QAAQ,IAAI,gBAAgB;YAC9D,eAAe,EAAE,OAAO,EAAE,KAAK;YAC/B,mBAAmB,EAAE,OAAO,EAAE,QAAQ;YACtC,gBAAgB,EAAE,OAAO,EAAE,MAAM;YACjC,uBAAuB,EAAE,OAAO,EAAE,eAAe;YACjD,iBAAiB,EAAE,OAAO,EAAE,SAAS;SACtC,CACF,EAAE,CACJ,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,WAAW;QACvB,IAAI,IAAI,CAAC,eAAe,GAAG,eAAe,EAAE,CAAC;YAC3C,IAAI,CAAC,eAAe,EAAE,CAAC;YACvB,OAAO;QACT,CAAC;QACD,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YACnC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,WAAW;QACjB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACpC,IAAI,IAAI,EAAE,CAAC;YACT,4CAA4C;YAC5C,IAAI,EAAE,CAAC;QACT,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,eAAe,EAAE,CAAC;QACzB,CAAC;IACH,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,GAAW,EAAE,QAAyB;QACxD,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,cAAc,EAAE,CAAC;YACtC,wDAAwD;YACxD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAC9C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;YAClB,QAAQ;YACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY;SACrC,CAAC,CAAC;IACL,CAAC;CACF;AAED,IAAI,QAA0C,CAAC;AAE/C,SAAS,WAAW;IAClB,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,GAAG,IAAI,oBAAoB,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAe,EACf,UAA6B,EAAE;IAE/B,OAAO,WAAW,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAC9C,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,OAAO,CAAC,MAAM,WAAW,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB;IAClC,IAAI,QAAQ,EAAE,CAAC;QACb,QAAQ,CAAC,OAAO,EAAE,CAAC;QACnB,QAAQ,GAAG,SAAS,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/ai-service/security/secret-scanner.d.ts

@@ -0,0 +1,161 @@
+/**
+ * Secret scanning utilities using TruffleHog.
+ *
+ * Provides functions for scanning content for leaked credentials and secrets.
+ * Uses TruffleHog CLI under the hood for detection and verification.
+ */
+/**
+ * Result from TruffleHog secret detection.
+ */
+export interface SecretFinding {
+    /** The type of detector that found the secret (e.g., "AWS", "Stripe", "GitHub") */
+    detectorType: string;
+    /** The name of the detector */
+    detectorName: string;
+    /** Whether the secret was verified as active */
+    verified: boolean;
+    /** The raw secret value (may be redacted) */
+    raw: string;
+    /** Redacted version of the secret */
+    redacted: string;
+    /** Line number where the secret was found (if available) */
+    line?: number;
+    /** Additional metadata about the secret */
+    extraData?: Record<string, unknown>;
+    /** Source metadata */
+    sourceMetadata?: {
+        file?: string;
+        line?: number;
+    };
+}
+/**
+ * Options for secret scanning.
+ */
+export interface SecretScanOptions {
+    /** Timeout in milliseconds (default: 5000) */
+    timeout?: number;
+    /** Only return verified (confirmed active) secrets (default: false - returns all findings) */
+    verifiedOnly?: boolean;
+    /** Withdraw this consumer's queued work. Never terminates an active shared scan. */
+    signal?: AbortSignal;
+    /** Bounded caller category for scanner telemetry. */
+    consumer?: "context_persistence" | "logging" | "policy_gate" | "prompt";
+}
+/** Safe subprocess evidence. Never include process output or Error.message. */
+export interface TrufflehogFailure {
+    category: "spawn_error" | "nonzero_exit" | "signal" | "deadline" | "input_error";
+    errno?: string;
+    exitCode: number | null;
+    signal?: NodeJS.Signals;
+    deadlineExpired: boolean;
+    elapsedMs: number;
+}
+export type TrufflehogAvailability = {
+    available: true;
+} | {
+    available: false;
+    failure: TrufflehogFailure & {
+        category: Exclude<TrufflehogFailure["category"], "input_error">;
+    };
+};
+export declare class TrufflehogError extends Error {
+    readonly failure: TrufflehogFailure;
+    constructor(failure: TrufflehogFailure);
+}
+/**
+ * Result of a secret scan operation.
+ */
+export interface SecretScanResult {
+    /** Whether the scan completed successfully */
+    success: boolean;
+    /** List of detected secrets */
+    findings: SecretFinding[];
+    /** Error message if scan failed */
+    error?: string;
+    failure?: TrufflehogFailure;
+    /** Whether any verified secrets were found */
+    hasVerifiedSecrets: boolean;
+    /** Whether any secrets (verified or not) were found */
+    hasSecrets: boolean;
+    /** The original content with secrets replaced by redacted versions */
+    redactedContent: string;
+}
+/**
+ * Redacts secrets in content by replacing raw values with redacted versions.
+ *
+ * Replaces each detected secret's raw value with its redacted form.
+ * Secrets are processed longest-first to handle overlapping matches correctly.
+ *
+ * @param content - The original content containing secrets
+ * @param findings - Array of secret findings from TruffleHog
+ * @returns Content with all detected secrets redacted
+ */
+export declare function redactSecrets(content: string, findings: SecretFinding[]): string;
+/**
+ * Runs TruffleHog CLI using stdin and returns parsed findings.
+ *
+ * Uses TruffleHog's built-in detectors for common secret types (Stripe, GitHub,
+ * AWS, private keys, etc.) without custom configuration.
+ *
+ * @param content - Content to scan for secrets (piped to stdin)
+ * @param timeout - Timeout in milliseconds
+ * @param verifiedOnly - Whether to only return verified secrets
+ * @returns Promise resolving to array of SecretFinding objects
+ */
+export declare function runTrufflehog(content: string, timeout: number, verifiedOnly: boolean): Promise<SecretFinding[]>;
+/** Five-second probe plus at most 250ms to collect termination evidence. */
+export declare function probeTrufflehogAvailability(timeout?: number): Promise<TrufflehogAvailability>;
+export declare function isTrufflehogAvailable(): Promise<boolean>;
+/**
+ * A reusable secret redactor that can perform fast synchronous redaction.
+ *
+ * Use this when you need to redact secrets from multiple pieces of content
+ * using the same set of findings (e.g., redacting LLM responses based on
+ * secrets found in the input prompt).
+ *
+ * @example
+ * ```typescript
+ * // Scan input once
+ * const result = await scanContentForSecrets(userPrompt);
+ * const redactor = new SecretRedactor(result.findings);
+ *
+ * // Redact multiple outputs synchronously
+ * const safeResponse = redactor.redact(llmResponse);
+ * const safeToolOutput = redactor.redact(toolResult);
+ * ```
+ */
+export declare class SecretRedactor {
+    private sortedFindings;
+    /**
+     * Creates a new SecretRedactor with the given findings.
+     *
+     * @param findings - Secret findings to use for redaction
+     */
+    constructor(findings: SecretFinding[]);
+    /**
+     * Redacts secrets from the given content synchronously.
+     *
+     * @param content - The content to redact secrets from
+     * @returns Content with secrets replaced by redacted versions
+     */
+    redact(content: string): string;
+    /**
+     * Redacts secrets from any value (string, object, or array).
+     *
+     * Recursively processes objects and arrays, redacting any string values.
+     *
+     * @param value - The value to redact secrets from
+     * @returns Value with secrets redacted from all string content
+     */
+    redactDeep(value: unknown): unknown;
+    /**
+     * Returns true if this redactor has any findings to redact.
+     */
+    hasFindings(): boolean;
+    /**
+     * Returns the number of findings this redactor has.
+     */
+    get findingCount(): number;
+}
+export declare function formatSecretFindings(findings: SecretFinding[]): string;
+//# sourceMappingURL=secret-scanner.d.ts.map

package/dist/ai-service/security/secret-scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-scanner.d.ts","sourceRoot":"","sources":["../../../src/ai-service/security/secret-scanner.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAwCH;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,mFAAmF;IACnF,YAAY,EAAE,MAAM,CAAC;IACrB,+BAA+B;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,gDAAgD;IAChD,QAAQ,EAAE,OAAO,CAAC;IAClB,6CAA6C;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,qCAAqC;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,4DAA4D;IAC5D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,sBAAsB;IACtB,cAAc,CAAC,EAAE;QACf,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,8CAA8C;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8FAA8F;IAC9F,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,oFAAoF;IACpF,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,qDAAqD;IACrD,QAAQ,CAAC,EAAE,qBAAqB,GAAG,SAAS,GAAG,aAAa,GAAG,QAAQ,CAAC;CACzE;AAED,+EAA+E;AAC/E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EACJ,aAAa,GACb,cAAc,GACd,QAAQ,GACR,UAAU,GACV,aAAa,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC;IACxB,eAAe,EAAE,OAAO,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,sBAAsB,GAC9B;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,GACnB;IACE,SAAS,EAAE,KAAK,CAAC;IACjB,OAAO,EAAE,iBAAiB,GAAG;QAC3B,QAAQ,EAAE,OAAO,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,aAAa,CAAC,CAAC;KACjE,CAAC;CACH,CAAC;AAEN,qBAAa,eAAgB,SAAQ,KAAK;IAC5B,QAAQ,CAAC,OAAO,EAAE,iBAAiB;gBAA1B,OAAO,EAAE,iBAAiB;CAIhD;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,8CAA8C;IAC9C,OAAO,EAAE,OAAO,CAAC;IACjB,+BAA+B;IAC/B,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,mCAAmC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,8CAA8C;IAC9C,kBAAkB,EAAE,OAAO,CAAC;IAC5B,uDAAuD;IACvD,UAAU,EAAE,OAAO,CAAC;IACpB,sEAAsE;IACtE,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,aAAa,EAAE,GACxB,MAAM,CAoBR;AA2DD;;;;;;;;;;GAUG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,OAAO,GACpB,OAAO,CAAC,aAAa,EAAE,CAAC,CA8J1B;AAED,4EAA4E;AAC5E,wBAAsB,2BAA2B,CAC/C,OAAO,SAAO,GACb,OAAO,CAAC,sBAAsB,CAAC,CA6EjC;AAED,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,OAAO,CAAC,CAE9D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,cAAc,CAAkB;IAExC;;;;OAIG;gBACS,QAAQ,EAAE,aAAa,EAAE;IAOrC;;;;;OAKG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;IAc/B;;;;;;;OAOG;IACH,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;IAiBnC;;OAEG;IACH,WAAW,IAAI,OAAO;IAItB;;OAEG;IACH,IAAI,YAAY,IAAI,MAAM,CAEzB;CACF;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,MAAM,CAmBtE"}