bilt-toolkit 1.0.0

package/dist/core/rules/entropy.js

@@ -0,0 +1,117 @@
+// ─── Shannon Entropy Utilities ───────────────────────────────────────────────
+//
+// Pure functions for calculating Shannon entropy of string values.
+// Used by secret-detection rules to flag high-entropy values that are
+// likely API keys, tokens, or passwords even when no regex rule matches.
+// ─────────────────────────────────────────────────────────────────────────────
+/** Minimum value length considered for entropy analysis. */
+const MIN_LENGTH = 8;
+/**
+ * UUID v4 pattern — values that match are skipped because UUIDs are
+ * high-entropy by design but are almost never secrets.
+ */
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+/**
+ * Common English / config words that happen to be long-ish but are
+ * obviously not secrets.  All comparisons are lower-cased.
+ */
+const COMMON_WORDS = new Set([
+    "development",
+    "production",
+    "staging",
+    "localhost",
+    "undefined",
+    "password",
+    "username",
+    "database",
+    "hostname",
+    "application",
+    "configuration",
+    "environment",
+    "true",
+    "false",
+    "null",
+    "enabled",
+    "disabled",
+    "default",
+    "example",
+    "changeme",
+    "change_me",
+    "your-api-key",
+    "your-api-key-here",
+    "your_api_key",
+    "your_api_key_here",
+    "replace_me",
+    "replaceme",
+    "placeholder",
+    "test1234",
+    "testtest",
+    "abcdefgh",
+    "xxxxxxxx",
+    "todo",
+    "fixme",
+]);
+// ─── Public API ──────────────────────────────────────────────────────────────
+/**
+ * Calculate the Shannon entropy (in bits-per-character) of a string.
+ *
+ * Shannon entropy is defined as:
+ *   H = -Σ p(x) · log₂(p(x))
+ *
+ * where p(x) is the frequency of character x in the string.
+ *
+ * Higher values indicate more randomness — typical English prose scores
+ * around 3.5–4.0 while random hex/base64 strings score 4.5–6.0+.
+ */
+export function calculateShannonEntropy(value) {
+    if (value.length === 0)
+        return 0;
+    // Build frequency map
+    const freq = new Map();
+    for (const ch of value) {
+        freq.set(ch, (freq.get(ch) ?? 0) + 1);
+    }
+    const len = value.length;
+    let entropy = 0;
+    for (const count of freq.values()) {
+        const p = count / len;
+        // p is always > 0 here, so log₂ is safe
+        entropy -= p * Math.log2(p);
+    }
+    return entropy;
+}
+/**
+ * Determine whether a value is "high entropy" — i.e. random enough to
+ * plausibly be a secret key / token.
+ *
+ * Before running the entropy check the function applies several
+ * heuristics to avoid false positives:
+ *
+ * 1. Values shorter than 8 characters are skipped (too short to be a key).
+ * 2. Pure UUID strings are skipped (high-entropy but not secret).
+ * 3. Values that match common configuration words are skipped.
+ *
+ * @param value     The raw string value to analyse.
+ * @param threshold Minimum entropy (bits-per-char) to be considered
+ *                  "high". Defaults to **4.5**.
+ */
+export function isHighEntropy(value, threshold = 4.5) {
+    // ── fast-exit filters ──────────────────────────────────────────────
+    if (value.length < MIN_LENGTH)
+        return false;
+    if (UUID_RE.test(value))
+        return false;
+    if (COMMON_WORDS.has(value.toLowerCase()))
+        return false;
+    // Skip values that are all the same character (e.g. "xxxxxxxx")
+    if (new Set(value).size === 1)
+        return false;
+    // Skip values that look like repeated short patterns (e.g. "abababab")
+    if (value.length >= 8) {
+        const half = value.slice(0, Math.floor(value.length / 2));
+        if (value === half + half)
+            return false;
+    }
+    return calculateShannonEntropy(value) >= threshold;
+}
+//# sourceMappingURL=entropy.js.map

package/dist/core/rules/entropy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entropy.js","sourceRoot":"","sources":["../../../src/core/rules/entropy.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,EAAE;AACF,mEAAmE;AACnE,sEAAsE;AACtE,yEAAyE;AACzE,gFAAgF;AAEhF,4DAA4D;AAC5D,MAAM,UAAU,GAAG,CAAC,CAAC;AAErB;;;GAGG;AACH,MAAM,OAAO,GACX,4EAA4E,CAAC;AAE/E;;;GAGG;AACH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,aAAa;IACb,YAAY;IACZ,SAAS;IACT,WAAW;IACX,WAAW;IACX,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,aAAa;IACb,eAAe;IACf,aAAa;IACb,MAAM;IACN,OAAO;IACP,MAAM;IACN,SAAS;IACT,UAAU;IACV,SAAS;IACT,SAAS;IACT,UAAU;IACV,WAAW;IACX,cAAc;IACd,mBAAmB;IACnB,cAAc;IACd,mBAAmB;IACnB,YAAY;IACZ,WAAW;IACX,aAAa;IACb,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,MAAM;IACN,OAAO;CACR,CAAC,CAAC;AAEH,gFAAgF;AAEhF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAEjC,sBAAsB;IACtB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IACzB,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,KAAK,GAAG,GAAG,CAAC;QACtB,wCAAwC;QACxC,OAAO,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa,EAAE,SAAS,GAAG,GAAG;IAC1D,sEAAsE;IACtE,IAAI,KAAK,CAAC,MAAM,GAAG,UAAU;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IAExD,gEAAgE;IAChE,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAE5C,uEAAuE;IACvE,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;QAC1D,IAAI,KAAK,KAAK,IAAI,GAAG,IAAI;YAAE,OAAO,KAAK,CAAC;IAC1C,CAAC;IAED,OAAO,uBAAuB,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC;AACrD,CAAC"}

package/dist/core/rules/providers.d.ts

@@ -0,0 +1,12 @@
+import type { ProviderInfo } from "../../types/index.js";
+export declare const PROVIDER_MAP: Map<string, ProviderInfo>;
+/**
+ * Attempt to identify which cloud provider a secret value belongs to.
+ *
+ * Resolution order:
+ * 1. If a `matchedRuleId` is supplied and maps to a known provider, use that.
+ * 2. Walk value-based heuristics (prefix / substring checks).
+ * 3. Return `undefined` if the provider cannot be determined.
+ */
+export declare function detectProvider(value: string, matchedRuleId?: string): ProviderInfo | undefined;
+//# sourceMappingURL=providers.d.ts.map

package/dist/core/rules/providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"providers.d.ts","sourceRoot":"","sources":["../../../src/core/rules/providers.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAiHzD,eAAO,MAAM,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAcjD,CAAC;AAqDH;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,MAAM,EACb,aAAa,CAAC,EAAE,MAAM,GACrB,YAAY,GAAG,SAAS,CAiB1B"}

package/dist/core/rules/providers.js

@@ -0,0 +1,184 @@
+// ─── Provider Information & Detection ────────────────────────────────────────
+//
+// Maps cloud / SaaS providers to their credential-management pages
+// so that Bilt can tell developers exactly where to rotate a leaked key.
+// ─────────────────────────────────────────────────────────────────────────────
+// ─── Provider Definitions ────────────────────────────────────────────────────
+const aws = {
+    name: "aws",
+    displayName: "Amazon Web Services",
+    icon: "☁️",
+    rotationUrl: "https://console.aws.amazon.com/iam/home#/security_credentials",
+    docsUrl: "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html",
+};
+const stripe = {
+    name: "stripe",
+    displayName: "Stripe",
+    icon: "💳",
+    rotationUrl: "https://dashboard.stripe.com/apikeys",
+    docsUrl: "https://docs.stripe.com/keys",
+};
+const openai = {
+    name: "openai",
+    displayName: "OpenAI",
+    icon: "🤖",
+    rotationUrl: "https://platform.openai.com/api-keys",
+    docsUrl: "https://platform.openai.com/docs/api-reference/authentication",
+};
+const github = {
+    name: "github",
+    displayName: "GitHub",
+    icon: "🐙",
+    rotationUrl: "https://github.com/settings/tokens",
+    docsUrl: "https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens",
+};
+const supabase = {
+    name: "supabase",
+    displayName: "Supabase",
+    icon: "⚡",
+    rotationUrl: "https://app.supabase.com/project/_/settings/api",
+    docsUrl: "https://supabase.com/docs/guides/api#api-keys",
+};
+const slack = {
+    name: "slack",
+    displayName: "Slack",
+    icon: "💬",
+    rotationUrl: "https://api.slack.com/apps",
+    docsUrl: "https://api.slack.com/authentication/token-types",
+};
+const google = {
+    name: "google",
+    displayName: "Google Cloud",
+    icon: "🔍",
+    rotationUrl: "https://console.cloud.google.com/apis/credentials",
+    docsUrl: "https://cloud.google.com/docs/authentication/api-keys",
+};
+const twilio = {
+    name: "twilio",
+    displayName: "Twilio",
+    icon: "📞",
+    rotationUrl: "https://www.twilio.com/console",
+    docsUrl: "https://www.twilio.com/docs/iam/api-keys",
+};
+const sendgrid = {
+    name: "sendgrid",
+    displayName: "SendGrid",
+    icon: "📧",
+    rotationUrl: "https://app.sendgrid.com/settings/api_keys",
+    docsUrl: "https://docs.sendgrid.com/ui/account-and-settings/api-keys",
+};
+const mailgun = {
+    name: "mailgun",
+    displayName: "Mailgun",
+    icon: "📬",
+    rotationUrl: "https://app.mailgun.com/app/account/security/api_keys",
+    docsUrl: "https://documentation.mailgun.com/en/latest/api-intro.html",
+};
+const mailchimp = {
+    name: "mailchimp",
+    displayName: "Mailchimp",
+    icon: "🐵",
+    rotationUrl: "https://us1.admin.mailchimp.com/account/api/",
+    docsUrl: "https://mailchimp.com/developer/marketing/guides/quick-start/",
+};
+const heroku = {
+    name: "heroku",
+    displayName: "Heroku",
+    icon: "🟣",
+    rotationUrl: "https://dashboard.heroku.com/account",
+    docsUrl: "https://devcenter.heroku.com/articles/authentication",
+};
+const digitalocean = {
+    name: "digitalocean",
+    displayName: "DigitalOcean",
+    icon: "🌊",
+    rotationUrl: "https://cloud.digitalocean.com/account/api/tokens",
+    docsUrl: "https://docs.digitalocean.com/reference/api/create-personal-access-token/",
+};
+// ─── Provider Map ────────────────────────────────────────────────────────────
+export const PROVIDER_MAP = new Map([
+    ["aws", aws],
+    ["stripe", stripe],
+    ["openai", openai],
+    ["github", github],
+    ["supabase", supabase],
+    ["slack", slack],
+    ["google", google],
+    ["twilio", twilio],
+    ["sendgrid", sendgrid],
+    ["mailgun", mailgun],
+    ["mailchimp", mailchimp],
+    ["heroku", heroku],
+    ["digitalocean", digitalocean],
+]);
+// ─── Value-based detection heuristics ────────────────────────────────────────
+// Maps a substring / prefix found in the matched value to a provider name.
+const VALUE_HINTS = [
+    { test: (v) => v.startsWith("AKIA"), provider: "aws" },
+    { test: (v) => /^sk_(live|test)_/.test(v), provider: "stripe" },
+    { test: (v) => /^pk_(live|test)_/.test(v), provider: "stripe" },
+    { test: (v) => /^rk_(live|test)_/.test(v), provider: "stripe" },
+    { test: (v) => v.startsWith("sk-"), provider: "openai" },
+    { test: (v) => /^gh[pousr]_/.test(v), provider: "github" },
+    { test: (v) => /^xox[bps]-/.test(v), provider: "slack" },
+    { test: (v) => v.includes("hooks.slack.com"), provider: "slack" },
+    { test: (v) => v.startsWith("AIza"), provider: "google" },
+    {
+        test: (v) => v.startsWith("SK") && /^SK[0-9a-fA-F]{32}$/.test(v),
+        provider: "twilio",
+    },
+    { test: (v) => v.startsWith("SG."), provider: "sendgrid" },
+    { test: (v) => v.startsWith("sbp_"), provider: "supabase" },
+    { test: (v) => v.startsWith("key-"), provider: "mailgun" },
+    { test: (v) => /-us\d{1,2}$/.test(v), provider: "mailchimp" },
+    { test: (v) => v.startsWith("dop_v1_"), provider: "digitalocean" },
+];
+// ─── Rule-ID to provider mapping ────────────────────────────────────────────
+// Extracted from the rule definitions so we can resolve by ID without
+// needing to re-import the rules (avoids circular deps).
+const RULE_ID_PROVIDER = {
+    "aws-access-key": "aws",
+    "aws-secret-key": "aws",
+    "stripe-secret-key": "stripe",
+    "stripe-test-secret-key": "stripe",
+    "stripe-publishable-key": "stripe",
+    "stripe-restricted-key": "stripe",
+    "openai-api-key": "openai",
+    "github-token": "github",
+    "slack-token": "slack",
+    "slack-webhook": "slack",
+    "google-api-key": "google",
+    "twilio-api-key": "twilio",
+    "sendgrid-api-key": "sendgrid",
+    "supabase-service-key": "supabase",
+    "mailgun-api-key": "mailgun",
+    "mailchimp-api-key": "mailchimp",
+    "heroku-api-key": "heroku",
+    "digitalocean-token": "digitalocean",
+};
+// ─── Public API ──────────────────────────────────────────────────────────────
+/**
+ * Attempt to identify which cloud provider a secret value belongs to.
+ *
+ * Resolution order:
+ * 1. If a `matchedRuleId` is supplied and maps to a known provider, use that.
+ * 2. Walk value-based heuristics (prefix / substring checks).
+ * 3. Return `undefined` if the provider cannot be determined.
+ */
+export function detectProvider(value, matchedRuleId) {
+    // 1. Try rule-ID lookup first (most reliable)
+    if (matchedRuleId) {
+        const providerName = RULE_ID_PROVIDER[matchedRuleId];
+        if (providerName) {
+            return PROVIDER_MAP.get(providerName);
+        }
+    }
+    // 2. Value-based heuristics
+    for (const hint of VALUE_HINTS) {
+        if (hint.test(value)) {
+            return PROVIDER_MAP.get(hint.provider);
+        }
+    }
+    return undefined;
+}
+//# sourceMappingURL=providers.js.map

package/dist/core/rules/providers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"providers.js","sourceRoot":"","sources":["../../../src/core/rules/providers.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,EAAE;AACF,mEAAmE;AACnE,yEAAyE;AACzE,gFAAgF;AAIhF,gFAAgF;AAEhF,MAAM,GAAG,GAAiB;IACxB,IAAI,EAAE,KAAK;IACX,WAAW,EAAE,qBAAqB;IAClC,IAAI,EAAE,IAAI;IACV,WAAW,EAAE,+DAA+D;IAC5E,OAAO,EACL,kFAAkF;CACrF,CAAC;AAEF,MAAM,MAAM,GAAiB;IAC3B,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,QAAQ;IACrB,IAAI,EAAE,IAAI;IACV,WAAW,EAAE,sCAAsC;IACnD,OAAO,EAAE,8BAA8B;CACxC,CAAC;AAEF,MAAM,MAAM,GAAiB;IAC3B,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,QAAQ;IACrB,IAAI,EAAE,IAAI;IACV,WAAW,EAAE,sCAAsC;IACnD,OAAO,EAAE,+DAA+D;CACzE,CAAC;AAEF,MAAM,MAAM,GAAiB;IAC3B,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,QAAQ;IACrB,IAAI,EAAE,IAAI;IACV,WAAW,EAAE,oCAAoC;IACjD,OAAO,EACL,qHAAqH;CACxH,CAAC;AAEF,MAAM,QAAQ,GAAiB;IAC7B,IAAI,EAAE,UAAU;IAChB,WAAW,EAAE,UAAU;IACvB,IAAI,EAAE,GAAG;IACT,WAAW,EAAE,iDAAiD;IAC9D,OAAO,EAAE,+CAA+C;CACzD,CAAC;AAEF,MAAM,KAAK,GAAiB;IAC1B,IAAI,EAAE,OAAO;IACb,WAAW,EAAE,OAAO;IACpB,IAAI,EAAE,IAAI;IACV,WAAW,EAAE,4BAA4B;IACzC,OAAO,EAAE,kDAAkD;CAC5D,CAAC;AAEF,MAAM,MAAM,GAAiB;IAC3B,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,cAAc;IAC3B,IAAI,EAAE,IAAI;IACV,WAAW,EAAE,mDAAmD;IAChE,OAAO,EAAE,uDAAuD;CACjE,CAAC;AAEF,MAAM,MAAM,GAAiB;IAC3B,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,QAAQ;IACrB,IAAI,EAAE,IAAI;IACV,WAAW,EAAE,gCAAgC;IAC7C,OAAO,EAAE,0CAA0C;CACpD,CAAC;AAEF,MAAM,QAAQ,GAAiB;IAC7B,IAAI,EAAE,UAAU;IAChB,WAAW,EAAE,UAAU;IACvB,IAAI,EAAE,IAAI;IACV,WAAW,EAAE,4CAA4C;IACzD,OAAO,EAAE,4DAA4D;CACtE,CAAC;AAEF,MAAM,OAAO,GAAiB;IAC5B,IAAI,EAAE,SAAS;IACf,WAAW,EAAE,SAAS;IACtB,IAAI,EAAE,IAAI;IACV,WAAW,EAAE,uDAAuD;IACpE,OAAO,EAAE,4DAA4D;CACtE,CAAC;AAEF,MAAM,SAAS,GAAiB;IAC9B,IAAI,EAAE,WAAW;IACjB,WAAW,EAAE,WAAW;IACxB,IAAI,EAAE,IAAI;IACV,WAAW,EAAE,8CAA8C;IAC3D,OAAO,EAAE,+DAA+D;CACzE,CAAC;AAEF,MAAM,MAAM,GAAiB;IAC3B,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,QAAQ;IACrB,IAAI,EAAE,IAAI;IACV,WAAW,EAAE,sCAAsC;IACnD,OAAO,EAAE,sDAAsD;CAChE,CAAC;AAEF,MAAM,YAAY,GAAiB;IACjC,IAAI,EAAE,cAAc;IACpB,WAAW,EAAE,cAAc;IAC3B,IAAI,EAAE,IAAI;IACV,WAAW,EAAE,mDAAmD;IAChE,OAAO,EACL,2EAA2E;CAC9E,CAAC;AAEF,gFAAgF;AAEhF,MAAM,CAAC,MAAM,YAAY,GAA8B,IAAI,GAAG,CAAC;IAC7D,CAAC,KAAK,EAAE,GAAG,CAAC;IACZ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAClB,CAAC,QAAQ,EAAE,MAAM,CAAC;IAClB,CAAC,QAAQ,EAAE,MAAM,CAAC;IAClB,CAAC,UAAU,EAAE,QAAQ,CAAC;IACtB,CAAC,OAAO,EAAE,KAAK,CAAC;IAChB,CAAC,QAAQ,EAAE,MAAM,CAAC;IAClB,CAAC,QAAQ,EAAE,MAAM,CAAC;IAClB,CAAC,UAAU,EAAE,QAAQ,CAAC;IACtB,CAAC,SAAS,EAAE,OAAO,CAAC;IACpB,CAAC,WAAW,EAAE,SAAS,CAAC;IACxB,CAAC,QAAQ,EAAE,MAAM,CAAC;IAClB,CAAC,cAAc,EAAE,YAAY,CAAC;CAC/B,CAAC,CAAC;AAEH,gFAAgF;AAChF,2EAA2E;AAE3E,MAAM,WAAW,GAA8D;IAC7E,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE;IACtD,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAC/D,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAC/D,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAC/D,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE;IACxD,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAC1D,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE;IACxD,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE;IACjE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE;IACzD;QACE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;QAChE,QAAQ,EAAE,QAAQ;KACnB;IACD,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE;IAC1D,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE;IAC3D,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE;IAC1D,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE;IAC7D,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE;CACnE,CAAC;AAEF,+EAA+E;AAC/E,sEAAsE;AACtE,yDAAyD;AAEzD,MAAM,gBAAgB,GAA2B;IAC/C,gBAAgB,EAAE,KAAK;IACvB,gBAAgB,EAAE,KAAK;IACvB,mBAAmB,EAAE,QAAQ;IAC7B,wBAAwB,EAAE,QAAQ;IAClC,wBAAwB,EAAE,QAAQ;IAClC,uBAAuB,EAAE,QAAQ;IACjC,gBAAgB,EAAE,QAAQ;IAC1B,cAAc,EAAE,QAAQ;IACxB,aAAa,EAAE,OAAO;IACtB,eAAe,EAAE,OAAO;IACxB,gBAAgB,EAAE,QAAQ;IAC1B,gBAAgB,EAAE,QAAQ;IAC1B,kBAAkB,EAAE,UAAU;IAC9B,sBAAsB,EAAE,UAAU;IAClC,iBAAiB,EAAE,SAAS;IAC5B,mBAAmB,EAAE,WAAW;IAChC,gBAAgB,EAAE,QAAQ;IAC1B,oBAAoB,EAAE,cAAc;CACrC,CAAC;AAEF,gFAAgF;AAEhF;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,KAAa,EACb,aAAsB;IAEtB,8CAA8C;IAC9C,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,YAAY,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAC;QACrD,IAAI,YAAY,EAAE,CAAC;YACjB,OAAO,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAED,4BAA4B;IAC5B,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrB,OAAO,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/core/rules/secret-rules.d.ts

@@ -0,0 +1,3 @@
+import type { SecretRule } from "../../types/index.js";
+export declare const SECRET_RULES: SecretRule[];
+//# sourceMappingURL=secret-rules.d.ts.map

package/dist/core/rules/secret-rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-rules.d.ts","sourceRoot":"","sources":["../../../src/core/rules/secret-rules.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEvD,eAAO,MAAM,YAAY,EAAE,UAAU,EAqNpC,CAAC"}

package/dist/core/rules/secret-rules.js

@@ -0,0 +1,205 @@
+// ─── Secret Detection Rules ──────────────────────────────────────────────────
+//
+// A curated list of regex-based rules for detecting leaked secrets,
+// API keys, tokens, and credentials in source code and .env files.
+//
+// Each rule specifies:
+//   • A globally-unique `id` (used for severity overrides & ignoring)
+//   • A descriptive `name` shown in CLI output
+//   • A `pattern` regex (with the `g` flag so scanners can find all matches)
+//   • An optional `provider` key mapping into the PROVIDER_MAP
+//   • A `severity` level
+//   • A human-readable `description`
+// ─────────────────────────────────────────────────────────────────────────────
+export const SECRET_RULES = [
+    // ── AWS ──────────────────────────────────────────────────────────────
+    {
+        id: "aws-access-key",
+        name: "AWS Access Key ID",
+        pattern: /(?<![A-Z0-9])AKIA[0-9A-Z]{16}(?![A-Z0-9])/g,
+        provider: "aws",
+        severity: "critical",
+        description: "AWS Access Key IDs always start with AKIA followed by 16 alphanumeric characters.",
+    },
+    {
+        id: "aws-secret-key",
+        name: "AWS Secret Access Key",
+        pattern: /(?<![A-Za-z0-9/+=])[A-Za-z0-9/+]{40}(?![A-Za-z0-9/+=])/g,
+        provider: "aws",
+        severity: "critical",
+        description: "AWS Secret Access Keys are 40-character base64 strings.",
+    },
+    // ── Stripe ───────────────────────────────────────────────────────────
+    {
+        id: "stripe-secret-key",
+        name: "Stripe Secret Key",
+        pattern: /sk_live_[a-zA-Z0-9]{24,}/g,
+        provider: "stripe",
+        severity: "critical",
+        description: "Stripe live secret key — grants full API access.",
+    },
+    {
+        id: "stripe-test-secret-key",
+        name: "Stripe Test Secret Key",
+        pattern: /sk_test_[a-zA-Z0-9]{24,}/g,
+        provider: "stripe",
+        severity: "warning",
+        description: "Stripe test secret key — should still not be committed.",
+    },
+    {
+        id: "stripe-publishable-key",
+        name: "Stripe Publishable Key",
+        pattern: /pk_(live|test)_[a-zA-Z0-9]{24,}/g,
+        provider: "stripe",
+        severity: "info",
+        description: "Stripe publishable key — safe for client bundles but tracked for awareness.",
+    },
+    {
+        id: "stripe-restricted-key",
+        name: "Stripe Restricted Key",
+        pattern: /rk_(live|test)_[a-zA-Z0-9]{24,}/g,
+        provider: "stripe",
+        severity: "critical",
+        description: "Stripe restricted key with custom permissions.",
+    },
+    // ── OpenAI ───────────────────────────────────────────────────────────
+    {
+        id: "openai-api-key",
+        name: "OpenAI API Key",
+        pattern: /sk-[a-zA-Z0-9]{20,}/g,
+        provider: "openai",
+        severity: "critical",
+        description: "OpenAI API key — grants access to GPT and other models.",
+    },
+    // ── GitHub ───────────────────────────────────────────────────────────
+    {
+        id: "github-token",
+        name: "GitHub Token",
+        pattern: /gh[pousr]_[A-Za-z0-9_]{36,}/g,
+        provider: "github",
+        severity: "critical",
+        description: "GitHub personal access token, OAuth token, or app token.",
+    },
+    // ── Slack ────────────────────────────────────────────────────────────
+    {
+        id: "slack-token",
+        name: "Slack Token",
+        pattern: /xox[bps]-[0-9]+-[0-9]+-[a-zA-Z0-9]+/g,
+        provider: "slack",
+        severity: "critical",
+        description: "Slack bot, user, or app token.",
+    },
+    {
+        id: "slack-webhook",
+        name: "Slack Webhook URL",
+        pattern: /https:\/\/hooks\.slack\.com\/services\/T[A-Z0-9]+\/B[A-Z0-9]+\/[a-zA-Z0-9]+/g,
+        provider: "slack",
+        severity: "critical",
+        description: "Slack incoming webhook URL — can post messages to a channel.",
+    },
+    // ── Google ───────────────────────────────────────────────────────────
+    {
+        id: "google-api-key",
+        name: "Google API Key",
+        pattern: /AIza[0-9A-Za-z\-_]{35}/g,
+        provider: "google",
+        severity: "critical",
+        description: "Google Cloud / Maps / Firebase API key.",
+    },
+    // ── Twilio ───────────────────────────────────────────────────────────
+    {
+        id: "twilio-api-key",
+        name: "Twilio API Key",
+        pattern: /SK[0-9a-fA-F]{32}/g,
+        provider: "twilio",
+        severity: "critical",
+        description: "Twilio API key SID.",
+    },
+    // ── SendGrid ─────────────────────────────────────────────────────────
+    {
+        id: "sendgrid-api-key",
+        name: "SendGrid API Key",
+        pattern: /SG\.[a-zA-Z0-9_-]{22}\.[a-zA-Z0-9_-]{43}/g,
+        provider: "sendgrid",
+        severity: "critical",
+        description: "SendGrid API key.",
+    },
+    // ── Supabase ─────────────────────────────────────────────────────────
+    {
+        id: "supabase-service-key",
+        name: "Supabase Service Role Key",
+        pattern: /sbp_[a-f0-9]{40}/g,
+        provider: "supabase",
+        severity: "critical",
+        description: "Supabase service-role key — bypasses RLS.",
+    },
+    // ── Database URLs ────────────────────────────────────────────────────
+    {
+        id: "database-url",
+        name: "Database Connection String",
+        pattern: /(postgres|postgresql|mysql|mongodb|mongodb\+srv):\/\/[^\s"'`]+:[^\s"'`]+@[^\s"'`]+/g,
+        severity: "critical",
+        description: "Database connection string with embedded credentials.",
+    },
+    // ── JWT ──────────────────────────────────────────────────────────────
+    {
+        id: "jwt-token",
+        name: "JSON Web Token",
+        pattern: /eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g,
+        severity: "warning",
+        description: "JSON Web Token — may contain sensitive claims.",
+    },
+    // ── Private Keys ─────────────────────────────────────────────────────
+    {
+        id: "private-key",
+        name: "Private Key",
+        pattern: /-----BEGIN (?:RSA |EC |DSA )?PRIVATE KEY-----/g,
+        severity: "critical",
+        description: "PEM-encoded private key header.",
+    },
+    // ── Mailgun ──────────────────────────────────────────────────────────
+    {
+        id: "mailgun-api-key",
+        name: "Mailgun API Key",
+        pattern: /key-[a-f0-9]{32}/g,
+        provider: "mailgun",
+        severity: "critical",
+        description: "Mailgun API key.",
+    },
+    // ── Mailchimp ────────────────────────────────────────────────────────
+    {
+        id: "mailchimp-api-key",
+        name: "Mailchimp API Key",
+        pattern: /[a-f0-9]{32}-us\d{1,2}/g,
+        provider: "mailchimp",
+        severity: "critical",
+        description: "Mailchimp API key — includes datacenter suffix.",
+    },
+    // ── Heroku ───────────────────────────────────────────────────────────
+    {
+        id: "heroku-api-key",
+        name: "Heroku API Key",
+        pattern: /[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}/g,
+        provider: "heroku",
+        severity: "warning",
+        description: "Heroku API key (UUID format).",
+    },
+    // ── DigitalOcean ─────────────────────────────────────────────────────
+    {
+        id: "digitalocean-token",
+        name: "DigitalOcean Token",
+        pattern: /dop_v1_[a-f0-9]{64}/g,
+        provider: "digitalocean",
+        severity: "critical",
+        description: "DigitalOcean personal access token.",
+    },
+    // ── Generic high-entropy assignment (catch-all) ──────────────────────
+    {
+        id: "generic-high-entropy",
+        name: "High-Entropy String",
+        pattern: /(?:api[_-]?key|api[_-]?secret|auth[_-]?token|access[_-]?token|secret[_-]?key|private[_-]?key|password|passwd|credential)\s*[:=]\s*['"]([A-Za-z0-9/+=_\-.]{16,})['"/]?/gi,
+        severity: "warning",
+        description: "Assignment of a high-entropy string to a variable with a secret-like name.",
+    },
+];
+//# sourceMappingURL=secret-rules.js.map

package/dist/core/rules/secret-rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-rules.js","sourceRoot":"","sources":["../../../src/core/rules/secret-rules.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,EAAE;AACF,oEAAoE;AACpE,mEAAmE;AACnE,EAAE;AACF,uBAAuB;AACvB,sEAAsE;AACtE,+CAA+C;AAC/C,6EAA6E;AAC7E,+DAA+D;AAC/D,yBAAyB;AACzB,qCAAqC;AACrC,gFAAgF;AAIhF,MAAM,CAAC,MAAM,YAAY,GAAiB;IACxC,wEAAwE;IACxE;QACE,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,4CAA4C;QACrD,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,UAAU;QACpB,WAAW,EACT,mFAAmF;KACtF;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE,uBAAuB;QAC7B,OAAO,EAAE,yDAAyD;QAClE,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,yDAAyD;KACvE;IAED,wEAAwE;IACxE;QACE,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,2BAA2B;QACpC,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,kDAAkD;KAChE;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,IAAI,EAAE,wBAAwB;QAC9B,OAAO,EAAE,2BAA2B;QACpC,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,SAAS;QACnB,WAAW,EAAE,yDAAyD;KACvE;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,IAAI,EAAE,wBAAwB;QAC9B,OAAO,EAAE,kCAAkC;QAC3C,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,MAAM;QAChB,WAAW,EACT,6EAA6E;KAChF;IACD;QACE,EAAE,EAAE,uBAAuB;QAC3B,IAAI,EAAE,uBAAuB;QAC7B,OAAO,EAAE,kCAAkC;QAC3C,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,gDAAgD;KAC9D;IAED,wEAAwE;IACxE;QACE,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,sBAAsB;QAC/B,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,yDAAyD;KACvE;IAED,wEAAwE;IACxE;QACE,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,8BAA8B;QACvC,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,0DAA0D;KACxE;IAED,wEAAwE;IACxE;QACE,EAAE,EAAE,aAAa;QACjB,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,sCAAsC;QAC/C,QAAQ,EAAE,OAAO;QACjB,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,gCAAgC;KAC9C;IACD;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,mBAAmB;QACzB,OAAO,EACL,8EAA8E;QAChF,QAAQ,EAAE,OAAO;QACjB,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,8DAA8D;KAC5E;IAED,wEAAwE;IACxE;QACE,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,yBAAyB;QAClC,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,yCAAyC;KACvD;IAED,wEAAwE;IACxE;QACE,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,oBAAoB;QAC7B,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,qBAAqB;KACnC;IAED,wEAAwE;IACxE;QACE,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,2CAA2C;QACpD,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,mBAAmB;KACjC;IAED,wEAAwE;IACxE;QACE,EAAE,EAAE,sBAAsB;QAC1B,IAAI,EAAE,2BAA2B;QACjC,OAAO,EAAE,mBAAmB;QAC5B,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,2CAA2C;KACzD;IAED,wEAAwE;IACxE;QACE,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,4BAA4B;QAClC,OAAO,EACL,qFAAqF;QACvF,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,uDAAuD;KACrE;IAED,wEAAwE;IACxE;QACE,EAAE,EAAE,WAAW;QACf,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,uDAAuD;QAChE,QAAQ,EAAE,SAAS;QACnB,WAAW,EAAE,gDAAgD;KAC9D;IAED,wEAAwE;IACxE;QACE,EAAE,EAAE,aAAa;QACjB,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,gDAAgD;QACzD,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,iCAAiC;KAC/C;IAED,wEAAwE;IACxE;QACE,EAAE,EAAE,iBAAiB;QACrB,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,mBAAmB;QAC5B,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,kBAAkB;KAChC;IAED,wEAAwE;IACxE;QACE,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,yBAAyB;QAClC,QAAQ,EAAE,WAAW;QACrB,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,iDAAiD;KAC/D;IAED,wEAAwE;IACxE;QACE,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE,gBAAgB;QACtB,OAAO,EACL,8EAA8E;QAChF,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,SAAS;QACnB,WAAW,EAAE,+BAA+B;KAC7C;IAED,wEAAwE;IACxE;QACE,EAAE,EAAE,oBAAoB;QACxB,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,sBAAsB;QAC/B,QAAQ,EAAE,cAAc;QACxB,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,qCAAqC;KACnD;IAED,wEAAwE;IACxE;QACE,EAAE,EAAE,sBAAsB;QAC1B,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EACL,yKAAyK;QAC3K,QAAQ,EAAE,SAAS;QACnB,WAAW,EACT,4EAA4E;KAC/E;CACF,CAAC"}

package/dist/core/scan/env.d.ts

@@ -0,0 +1,47 @@
+import type { ParsedEnvEntry, ParsedEnvFile, ScanFinding } from "../../types/index.js";
+/**
+ * Parse the content of a `.env` file into a structured `ParsedEnvFile`.
+ *
+ * Handles:
+ *   • Comments (lines starting with `#`)
+ *   • Empty / whitespace-only lines
+ *   • Inline comments (`VAR=value # comment`)
+ *   • Single-quoted, double-quoted, and backtick-quoted values
+ *   • Multiline values enclosed in double-quotes (using `\n` or real newlines)
+ *   • `export` prefix (e.g. `export FOO=bar`)
+ */
+export declare function parseEnvFile(content: string, filePath: string): ParsedEnvFile;
+/**
+ * Discover all `.env*` files in a directory tree, following common
+ * naming conventions: `.env`, `.env.local`, `.env.development`, etc.
+ *
+ * Excludes `node_modules`, `.git`, `dist`, and `build` directories.
+ */
+export declare function findEnvFiles(dir: string): Promise<string[]>;
+/**
+ * Cross-compare multiple parsed env files and produce findings for
+ * variables that exist in one file but are missing from another.
+ *
+ * Template files (`.env.example`, `.env.template`, `.env.sample`) are
+ * treated as the "source of truth" — variables present in a template
+ * but missing from an actual env file produce a finding.
+ */
+export declare function diffEnvFiles(filesOrFileA: ParsedEnvFile[] | ParsedEnvFile, fileB?: ParsedEnvFile): ScanFinding[];
+/**
+ * Scan source code for references to environment variables.
+ * Returns a deduplicated list of variable names found.
+ */
+export declare function scanCodeForEnvRefs(content: string, _filePath?: string): string[] & {
+    size: number;
+};
+/**
+ * Given the env var names referenced in code and the env vars actually
+ * defined, produce findings for any referenced vars that are missing.
+ */
+export declare function findMissingEnvVars(codeRefs: string[] | Set<string>, envVars: string[] | Set<string>, codeFile: string): ScanFinding[];
+/**
+ * Given the env var names referenced in code and all env entries,
+ * produce findings for env vars that are defined but never used.
+ */
+export declare function findUnusedEnvVars(firstArg: string[] | Set<string>, secondArg: ParsedEnvEntry[] | Set<string>, envFile: string): ScanFinding[];
+//# sourceMappingURL=env.d.ts.map

package/dist/core/scan/env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../../src/core/scan/env.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EACV,cAAc,EACd,aAAa,EACb,WAAW,EACZ,MAAM,sBAAsB,CAAC;AAoD9B;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,aAAa,CAsF7E;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CASjE;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAC1B,YAAY,EAAE,aAAa,EAAE,GAAG,aAAa,EAC7C,KAAK,CAAC,EAAE,aAAa,GACpB,WAAW,EAAE,CA2Cf;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,SAAS,CAAC,EAAE,MAAM,GACjB,MAAM,EAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAgB7B;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAChC,OAAO,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAC/B,QAAQ,EAAE,MAAM,GACf,WAAW,EAAE,CA8Bf;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAChC,SAAS,EAAE,cAAc,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EACzC,OAAO,EAAE,MAAM,GACd,WAAW,EAAE,CAgDf"}