@wrongstack/core 0.256.0 → 0.257.0

package/dist/{secret-vault-BkYkJWQs.d.ts → secret-vault-gxtFZYBt.d.ts}

@@ -5,6 +5,13 @@ import { S as SecretVault } from './secret-vault-BJDY28ev.js';
 declare class DefaultSecretScrubber implements SecretScrubber {
     scrub(text: string): string;
     private scrubOne;
+    /**
+     * Recursively scrub every string value in an object/array graph. Secrets can
+     * appear under any key — a URL query param, an `authorization` header, an
+     * arbitrarily-named nested field — so we don't gate recursion on key names.
+     * The per-string `scrub()` fast-path (anchor pre-scan) keeps this cheap: any
+     * value without a credential anchor returns immediately without regex work.
+     */
     scrubObject<T>(obj: T): T;
 }
 

package/dist/security/index.d.ts

@@ -1,4 +1,4 @@
-export { D as DefaultSecretScrubber, a as DefaultSecretVault, S as SecretVaultOptions, d as decryptConfigSecrets, e as encryptConfigSecrets, i as isSecretField, m as migratePlaintextSecrets, r as rewriteConfigEncrypted } from '../secret-vault-BkYkJWQs.js';
+export { D as DefaultSecretScrubber, a as DefaultSecretVault, S as SecretVaultOptions, d as decryptConfigSecrets, e as encryptConfigSecrets, i as isSecretField, m as migratePlaintextSecrets, r as rewriteConfigEncrypted } from '../secret-vault-gxtFZYBt.js';
 export { A as AutoApprovePermissionPolicy, D as DefaultPermissionPolicy, P as PermissionPolicyOptions } from '../permission-policy-B8rSu908.js';
 import '../permission-CwBBpCoF.js';
 import '../context-CGdgA0q6.js';

package/dist/security/index.js

@@ -60,6 +60,10 @@ var PATTERNS = [
     regex: /(?:^|\s)([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,512})['"]?(?:\s|$)/g
   }
 ];
+var SIMPLE_PATTERNS = PATTERNS.filter((p) => p.type !== "high_entropy_env");
+var COMBINED_REGEX = new RegExp(SIMPLE_PATTERNS.map((p) => `(${p.regex.source})`).join("|"), "g");
+var HIGH_ENTROPY_REGEX = PATTERNS.find((p) => p.type === "high_entropy_env").regex;
+var COMBINED_REPLACEMENTS = SIMPLE_PATTERNS.map((p) => `[REDACTED:${p.type}]`);
 var SCRUB_CHUNK_BYTES = 64 * 1024;
 function hasCredentialAnchors(text) {
   return text.includes("-----BEGIN") || // Private keys (most unique → cheap reject)
@@ -101,17 +105,27 @@ var DefaultSecretScrubber = class {
   }
   scrubOne(text) {
     if (!hasCredentialAnchors(text)) return text;
-    let out = text;
-    for (const p of PATTERNS) {
-      out = out.replace(p.regex, (_match, group1, group2) => {
-        if (p.type === "high_entropy_env" && group1 && group2) {
-          return `${group1}=[REDACTED:${p.type}]`;
-        }
-        return `[REDACTED:${p.type}]`;
-      });
-    }
+    let out = text.replace(
+      COMBINED_REGEX,
+      (match, ...groups) => {
+        const idx = groups.findIndex((g) => g !== void 0);
+        if (idx < 0) return match;
+        const replacement = COMBINED_REPLACEMENTS[idx];
+        return replacement !== void 0 ? replacement : match;
+      }
+    );
+    out = out.replace(HIGH_ENTROPY_REGEX, (_match, group1, _group2) => {
+      return `${group1}=[REDACTED:high_entropy_env]`;
+    });
     return out;
   }
+  /**
+   * Recursively scrub every string value in an object/array graph. Secrets can
+   * appear under any key — a URL query param, an `authorization` header, an
+   * arbitrarily-named nested field — so we don't gate recursion on key names.
+   * The per-string `scrub()` fast-path (anchor pre-scan) keeps this cheap: any
+   * value without a credential anchor returns immediately without regex work.
+   */
   scrubObject(obj) {
     const seen = /* @__PURE__ */ new WeakSet();
     const visit = (v) => {