@vibgrate/cli 2026.702.2 → 2026.703.3

package/dist/chunk-RXP66R2E.js

@@ -0,0 +1,39 @@
+// src/core-open/utils/redact.ts
+var SECRET_PATTERNS = [
+  // Vendor token prefixes (GitHub, GitLab, Slack, OpenAI/Stripe-style, npm, AWS).
+  /\b(?:gh[opusr]_|github_pat_)[A-Za-z0-9_]{8,}\b/g,
+  /\bglpat-[A-Za-z0-9_-]{8,}\b/g,
+  /\bxox[baprs]-[A-Za-z0-9-]{8,}\b/g,
+  /\bsk-[A-Za-z0-9_-]{8,}\b/gi,
+  /\b[sr]k_(?:live|test)_[A-Za-z0-9]{8,}\b/g,
+  /\bnpm_[A-Za-z0-9]{16,}\b/g,
+  /\b(?:AKIA|ASIA)[0-9A-Z]{12,}\b/g,
+  // JWTs.
+  /\beyJ[\w-]{8,}\.[\w-]{8,}\.[\w-]+\b/g,
+  // Authorization material.
+  /\b(?:Bearer|Basic|VibgrateDSN)\s+[A-Za-z0-9+/._:=-]{8,}/g,
+  /\b(?:authorization|api[_-]?key|apikey|access[_-]?token|client[_-]?secret|password|passwd|secret)\s*[:=]\s*['"]?[^'"\s]{6,}/gi,
+  // PEM blocks.
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z ]*PRIVATE KEY-----|$)/g,
+  // Long base64/hex blobs (AWS secret keys and friends).
+  /\b[A-Za-z0-9+/]{40,}={0,2}\b/g
+];
+var REDACTED = "[REDACTED]";
+function redactSecrets(text) {
+  let out = text;
+  for (const re of SECRET_PATTERNS) out = out.replace(re, REDACTED);
+  return out;
+}
+var CREDENTIAL_QUERY_KEYS = /^(?:access[_-]?token|private[_-]?token|api[_-]?key|apikey|token|secret|password|passwd|auth|authorization|x-token|sig|signature|key)$/i;
+function redactUrlCredentials(url) {
+  const noUser = url.replace(/\/\/[^@/]+@/, "//");
+  const q = noUser.indexOf("?");
+  if (q === -1) return noUser;
+  const base = noUser.slice(0, q);
+  const kept = noUser.slice(q + 1).split("&").filter((pair) => !CREDENTIAL_QUERY_KEYS.test(pair.split("=")[0] ?? ""));
+  return kept.length ? `${base}?${kept.join("&")}` : base;
+}
+
+export { redactSecrets, redactUrlCredentials };
+//# sourceMappingURL=chunk-RXP66R2E.js.map
+//# sourceMappingURL=chunk-RXP66R2E.js.map

package/dist/chunk-RXP66R2E.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/core-open/utils/redact.ts"],"names":[],"mappings":";AAUA,IAAM,eAAA,GAA4B;AAAA;AAAA,EAEhC,iDAAA;AAAA,EACA,8BAAA;AAAA,EACA,kCAAA;AAAA,EACA,4BAAA;AAAA,EACA,0CAAA;AAAA,EACA,2BAAA;AAAA,EACA,iCAAA;AAAA;AAAA,EAEA,sCAAA;AAAA;AAAA,EAEA,0DAAA;AAAA,EACA,8HAAA;AAAA;AAAA,EAEA,mFAAA;AAAA;AAAA,EAEA;AACF,CAAA;AAEO,IAAM,QAAA,GAAW,YAAA;AAGjB,SAAS,cAAc,IAAA,EAAsB;AAClD,EAAA,IAAI,GAAA,GAAM,IAAA;AACV,EAAA,KAAA,MAAW,MAAM,eAAA,EAAiB,GAAA,GAAM,GAAA,CAAI,OAAA,CAAQ,IAAI,QAAQ,CAAA;AAChE,EAAA,OAAO,GAAA;AACT;AAYA,IAAM,qBAAA,GACJ,wIAAA;AAOK,SAAS,qBAAqB,GAAA,EAAqB;AACxD,EAAA,MAAM,MAAA,GAAS,GAAA,CAAI,OAAA,CAAQ,aAAA,EAAe,IAAI,CAAA;AAC9C,EAAA,MAAM,CAAA,GAAI,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAA;AAC5B,EAAA,IAAI,CAAA,KAAM,IAAI,OAAO,MAAA;AACrB,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,CAAC,CAAA;AAC9B,EAAA,MAAM,IAAA,GAAO,OACV,KAAA,CAAM,CAAA,GAAI,CAAC,CAAA,CACX,KAAA,CAAM,GAAG,CAAA,CACT,MAAA,CAAO,CAAC,SAAS,CAAC,qBAAA,CAAsB,KAAK,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,IAAK,EAAE,CAAC,CAAA;AACzE,EAAA,OAAO,IAAA,CAAK,SAAS,CAAA,EAAG,IAAI,IAAI,IAAA,CAAK,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,GAAK,IAAA;AACrD","file":"chunk-RXP66R2E.js","sourcesContent":["// VENDORED from @vibgrate/core-open (packages/vibgrate-core-open) by\n// scripts/vendor-core-open.mjs. Do not edit here — change the source package\n// and re-run the vendor script. Apache-2.0.\n/**\n * Shared credential redaction (GUARDRAILS §1.1): applied at INGEST, before\n * anything is stored or uploaded. One detector, reused by the VCS capture, the\n * graph builder (signatures/docs), and the push envelope — so every surface\n * scrubs the same shapes and a new token prefix is added in exactly one place.\n */\n\nconst SECRET_PATTERNS: RegExp[] = [\n  // Vendor token prefixes (GitHub, GitLab, Slack, OpenAI/Stripe-style, npm, AWS).\n  /\\b(?:gh[opusr]_|github_pat_)[A-Za-z0-9_]{8,}\\b/g,\n  /\\bglpat-[A-Za-z0-9_-]{8,}\\b/g,\n  /\\bxox[baprs]-[A-Za-z0-9-]{8,}\\b/g,\n  /\\bsk-[A-Za-z0-9_-]{8,}\\b/gi,\n  /\\b[sr]k_(?:live|test)_[A-Za-z0-9]{8,}\\b/g,\n  /\\bnpm_[A-Za-z0-9]{16,}\\b/g,\n  /\\b(?:AKIA|ASIA)[0-9A-Z]{12,}\\b/g,\n  // JWTs.\n  /\\beyJ[\\w-]{8,}\\.[\\w-]{8,}\\.[\\w-]+\\b/g,\n  // Authorization material.\n  /\\b(?:Bearer|Basic|VibgrateDSN)\\s+[A-Za-z0-9+/._:=-]{8,}/g,\n  /\\b(?:authorization|api[_-]?key|apikey|access[_-]?token|client[_-]?secret|password|passwd|secret)\\s*[:=]\\s*['\"]?[^'\"\\s]{6,}/gi,\n  // PEM blocks.\n  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\\s\\S]*?(?:-----END [A-Z ]*PRIVATE KEY-----|$)/g,\n  // Long base64/hex blobs (AWS secret keys and friends).\n  /\\b[A-Za-z0-9+/]{40,}={0,2}\\b/g,\n];\n\nexport const REDACTED = '[REDACTED]';\n\n/** Replace every credential-shaped substring with [REDACTED]. Deterministic. */\nexport function redactSecrets(text: string): string {\n  let out = text;\n  for (const re of SECRET_PATTERNS) out = out.replace(re, REDACTED);\n  return out;\n}\n\n/** True when the text contains at least one credential-shaped substring. */\nexport function containsSecret(text: string): boolean {\n  return SECRET_PATTERNS.some((re) => {\n    re.lastIndex = 0;\n    const hit = re.test(text);\n    re.lastIndex = 0;\n    return hit;\n  });\n}\n\nconst CREDENTIAL_QUERY_KEYS =\n  /^(?:access[_-]?token|private[_-]?token|api[_-]?key|apikey|token|secret|password|passwd|auth|authorization|x-token|sig|signature|key)$/i;\n\n/**\n * Strip credentials from a URL: userinfo (`//user:token@host`) AND\n * credential-bearing query parameters (`?access_token=…`, `?private_token=…`).\n * Non-URL strings pass through with just the userinfo strip applied.\n */\nexport function redactUrlCredentials(url: string): string {\n  const noUser = url.replace(/\\/\\/[^@/]+@/, '//');\n  const q = noUser.indexOf('?');\n  if (q === -1) return noUser;\n  const base = noUser.slice(0, q);\n  const kept = noUser\n    .slice(q + 1)\n    .split('&')\n    .filter((pair) => !CREDENTIAL_QUERY_KEYS.test(pair.split('=')[0] ?? ''));\n  return kept.length ? `${base}?${kept.join('&')}` : base;\n}\n"]}