compromising-position 1.0.0

package/dist/checks/plugins/intelx-plugin.js

@@ -0,0 +1,113 @@
+import { sanitizeForTerminal } from "../../core/sanitize.js";
+const INTELX_BASE = "https://2.intelx.io";
+const USER_AGENT = "compromising-position/1.0.0";
+export const intelXPlugin = {
+    id: "intelx",
+    name: "Intelligence X",
+    inputKind: "email",
+    requiresNetwork: true,
+    requiredConfigKeys: ["INTELX_API_KEY"],
+    isFree: false,
+    privacySummary: "Full email -> 2.intelx.io (requires paid API key)",
+    async check(input, config) {
+        const email = input;
+        const apiKey = config.pluginApiKeys["INTELX_API_KEY"];
+        if (!apiKey) {
+            return {
+                pluginId: "intelx",
+                pluginName: "Intelligence X",
+                found: false,
+                details: "Intelligence X API key not configured",
+                severity: "info",
+                error: "Missing INTELX_API_KEY",
+            };
+        }
+        try {
+            // Step 1: Initiate search
+            const searchResponse = await fetch(`${INTELX_BASE}/intelligent/search`, {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/json",
+                    "x-key": apiKey,
+                    "User-Agent": USER_AGENT,
+                },
+                body: JSON.stringify({
+                    term: email,
+                    maxresults: 10,
+                    media: 0,
+                    sort: 2,
+                    terminate: [],
+                }),
+            });
+            if (!searchResponse.ok) {
+                const statusText = sanitizeForTerminal(searchResponse.statusText);
+                return {
+                    pluginId: "intelx",
+                    pluginName: "Intelligence X",
+                    found: false,
+                    details: `Search API error: ${searchResponse.status} ${statusText}`,
+                    severity: "info",
+                    error: `IntelX API returned ${searchResponse.status}: ${statusText}`,
+                };
+            }
+            const searchData = (await searchResponse.json());
+            // Step 2: Fetch results
+            const resultResponse = await fetch(`${INTELX_BASE}/intelligent/search/result?id=${encodeURIComponent(searchData.id)}&limit=10`, {
+                headers: {
+                    "x-key": apiKey,
+                    "User-Agent": USER_AGENT,
+                },
+            });
+            if (!resultResponse.ok) {
+                const statusText = sanitizeForTerminal(resultResponse.statusText);
+                return {
+                    pluginId: "intelx",
+                    pluginName: "Intelligence X",
+                    found: false,
+                    details: `Result API error: ${resultResponse.status} ${statusText}`,
+                    severity: "info",
+                    error: `IntelX API returned ${resultResponse.status}: ${statusText}`,
+                };
+            }
+            const resultData = (await resultResponse.json());
+            const records = resultData.records ?? [];
+            const found = records.length > 0;
+            // Categorize sources
+            const buckets = new Set(records.map((r) => r.bucket).filter(Boolean));
+            let severity = "low";
+            if (records.length > 5) {
+                severity = "critical";
+            }
+            else if (records.length > 0) {
+                severity = "high";
+            }
+            return {
+                pluginId: "intelx",
+                pluginName: "Intelligence X",
+                found,
+                details: found
+                    ? `Found ${records.length} result(s) across ${buckets.size} source(s) (Tor, I2P, pastes, leaks)`
+                    : "Not found in Intelligence X",
+                severity,
+                error: null,
+                metadata: {
+                    resultCount: records.length,
+                    buckets: Array.from(buckets),
+                    searchId: searchData.id,
+                },
+            };
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            return {
+                pluginId: "intelx",
+                pluginName: "Intelligence X",
+                found: false,
+                details: `Network error: ${sanitizeForTerminal(message)}`,
+                severity: "info",
+                error: sanitizeForTerminal(message),
+            };
+        }
+    },
+};
+//# sourceMappingURL=intelx-plugin.js.map

package/dist/checks/plugins/intelx-plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"intelx-plugin.js","sourceRoot":"","sources":["../../../src/checks/plugins/intelx-plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAI7D,MAAM,WAAW,GAAG,qBAAqB,CAAC;AAC1C,MAAM,UAAU,GAAG,6BAA6B,CAAC;AAqBjD,MAAM,CAAC,MAAM,YAAY,GAAgB;IACvC,EAAE,EAAE,QAAQ;IACZ,IAAI,EAAE,gBAAgB;IACtB,SAAS,EAAE,OAAO;IAClB,eAAe,EAAE,IAAI;IACrB,kBAAkB,EAAE,CAAC,gBAAgB,CAAC;IACtC,MAAM,EAAE,KAAK;IACb,cAAc,EAAE,mDAAmD;IAEnE,KAAK,CAAC,KAAK,CACT,KAAc,EACd,MAAiB;QAEjB,MAAM,KAAK,GAAG,KAAe,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC;QAEtD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;gBACL,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,gBAAgB;gBAC5B,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,uCAAuC;gBAChD,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,wBAAwB;aAChC,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,0BAA0B;YAC1B,MAAM,cAAc,GAAG,MAAM,KAAK,CAChC,GAAG,WAAW,qBAAqB,EACnC;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,OAAO,EAAE,MAAM;oBACf,YAAY,EAAE,UAAU;iBACzB;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,IAAI,EAAE,KAAK;oBACX,UAAU,EAAE,EAAE;oBACd,KAAK,EAAE,CAAC;oBACR,IAAI,EAAE,CAAC;oBACP,SAAS,EAAE,EAAE;iBACd,CAAC;aACH,CACF,CAAC;YAEF,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC;gBACvB,MAAM,UAAU,GAAG,mBAAmB,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;gBAClE,OAAO;oBACL,QAAQ,EAAE,QAAQ;oBAClB,UAAU,EAAE,gBAAgB;oBAC5B,KAAK,EAAE,KAAK;oBACZ,OAAO,EAAE,qBAAqB,cAAc,CAAC,MAAM,IAAI,UAAU,EAAE;oBACnE,QAAQ,EAAE,MAAM;oBAChB,KAAK,EAAE,uBAAuB,cAAc,CAAC,MAAM,KAAK,UAAU,EAAE;iBACrE,CAAC;YACJ,CAAC;YAED,MAAM,UAAU,GAAG,CAAC,MAAM,cAAc,CAAC,IAAI,EAAE,CAAyB,CAAC;YAEzE,wBAAwB;YACxB,MAAM,cAAc,GAAG,MAAM,KAAK,CAChC,GAAG,WAAW,iCAAiC,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC,WAAW,EAC3F;gBACE,OAAO,EAAE;oBACP,OAAO,EAAE,MAAM;oBACf,YAAY,EAAE,UAAU;iBACzB;aACF,CACF,CAAC;YAEF,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC;gBACvB,MAAM,UAAU,GAAG,mBAAmB,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;gBAClE,OAAO;oBACL,QAAQ,EAAE,QAAQ;oBAClB,UAAU,EAAE,gBAAgB;oBAC5B,KAAK,EAAE,KAAK;oBACZ,OAAO,EAAE,qBAAqB,cAAc,CAAC,MAAM,IAAI,UAAU,EAAE;oBACnE,QAAQ,EAAE,MAAM;oBAChB,KAAK,EAAE,uBAAuB,cAAc,CAAC,MAAM,KAAK,UAAU,EAAE;iBACrE,CAAC;YACJ,CAAC;YAED,MAAM,UAAU,GAAG,CAAC,MAAM,cAAc,CAAC,IAAI,EAAE,CAAyB,CAAC;YACzE,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,IAAI,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;YAEjC,qBAAqB;YACrB,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YAEtE,IAAI,QAAQ,GAAkC,KAAK,CAAC;YACpD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,QAAQ,GAAG,UAAU,CAAC;YACxB,CAAC;iBAAM,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,QAAQ,GAAG,MAAM,CAAC;YACpB,CAAC;YAED,OAAO;gBACL,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,gBAAgB;gBAC5B,KAAK;gBACL,OAAO,EAAE,KAAK;oBACZ,CAAC,CAAC,SAAS,OAAO,CAAC,MAAM,qBAAqB,OAAO,CAAC,IAAI,sCAAsC;oBAChG,CAAC,CAAC,6BAA6B;gBACjC,QAAQ;gBACR,KAAK,EAAE,IAAI;gBACX,QAAQ,EAAE;oBACR,WAAW,EAAE,OAAO,CAAC,MAAM;oBAC3B,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;oBAC5B,QAAQ,EAAE,UAAU,CAAC,EAAE;iBACxB;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO;gBACL,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,gBAAgB;gBAC5B,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,kBAAkB,mBAAmB,CAAC,OAAO,CAAC,EAAE;gBACzD,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC;aACpC,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAC"}

package/dist/checks/plugins/leakcheck-plugin.d.ts

@@ -0,0 +1,3 @@
+import type { CheckPlugin } from "../plugin.js";
+export declare const leakCheckPlugin: CheckPlugin;
+//# sourceMappingURL=leakcheck-plugin.d.ts.map

package/dist/checks/plugins/leakcheck-plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"leakcheck-plugin.d.ts","sourceRoot":"","sources":["../../../src/checks/plugins/leakcheck-plugin.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAiBhD,eAAO,MAAM,eAAe,EAAE,WAwF7B,CAAC"}

package/dist/checks/plugins/leakcheck-plugin.js

@@ -0,0 +1,82 @@
+import { sanitizeForTerminal } from "../../core/sanitize.js";
+const LEAKCHECK_BASE = "https://leakcheck.io/api/v2/query";
+const USER_AGENT = "compromising-position/1.0.0";
+export const leakCheckPlugin = {
+    id: "leakcheck",
+    name: "LeakCheck",
+    inputKind: "email",
+    requiresNetwork: true,
+    requiredConfigKeys: ["LEAKCHECK_API_KEY"],
+    isFree: false,
+    privacySummary: "Full email -> leakcheck.io (requires paid API key)",
+    async check(input, config) {
+        const email = input;
+        const apiKey = config.pluginApiKeys["LEAKCHECK_API_KEY"];
+        if (!apiKey) {
+            return {
+                pluginId: "leakcheck",
+                pluginName: "LeakCheck",
+                found: false,
+                details: "LeakCheck API key not configured",
+                severity: "info",
+                error: "Missing LEAKCHECK_API_KEY",
+            };
+        }
+        try {
+            const response = await fetch(`${LEAKCHECK_BASE}/${encodeURIComponent(email)}`, {
+                headers: {
+                    Accept: "application/json",
+                    "X-API-Key": apiKey,
+                    "User-Agent": USER_AGENT,
+                },
+            });
+            if (!response.ok) {
+                const statusText = sanitizeForTerminal(response.statusText);
+                return {
+                    pluginId: "leakcheck",
+                    pluginName: "LeakCheck",
+                    found: false,
+                    details: `API error: ${response.status} ${statusText}`,
+                    severity: "info",
+                    error: `LeakCheck API returned ${response.status}: ${statusText}`,
+                };
+            }
+            const data = (await response.json());
+            const found = data.found > 0;
+            let severity = "low";
+            if (data.found > 10) {
+                severity = "critical";
+            }
+            else if (data.found > 0) {
+                severity = "high";
+            }
+            return {
+                pluginId: "leakcheck",
+                pluginName: "LeakCheck",
+                found,
+                details: found
+                    ? `Found in ${data.found} leak(s) from ${data.sources.length} source(s)`
+                    : "Not found in LeakCheck database",
+                severity,
+                error: null,
+                metadata: {
+                    found: data.found,
+                    sourceCount: data.sources.length,
+                    sources: data.sources.map((s) => s.name),
+                },
+            };
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            return {
+                pluginId: "leakcheck",
+                pluginName: "LeakCheck",
+                found: false,
+                details: `Network error: ${sanitizeForTerminal(message)}`,
+                severity: "info",
+                error: sanitizeForTerminal(message),
+            };
+        }
+    },
+};
+//# sourceMappingURL=leakcheck-plugin.js.map

package/dist/checks/plugins/leakcheck-plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"leakcheck-plugin.js","sourceRoot":"","sources":["../../../src/checks/plugins/leakcheck-plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAI7D,MAAM,cAAc,GAAG,mCAAmC,CAAC;AAC3D,MAAM,UAAU,GAAG,6BAA6B,CAAC;AAajD,MAAM,CAAC,MAAM,eAAe,GAAgB;IAC1C,EAAE,EAAE,WAAW;IACf,IAAI,EAAE,WAAW;IACjB,SAAS,EAAE,OAAO;IAClB,eAAe,EAAE,IAAI;IACrB,kBAAkB,EAAE,CAAC,mBAAmB,CAAC;IACzC,MAAM,EAAE,KAAK;IACb,cAAc,EAAE,oDAAoD;IAEpE,KAAK,CAAC,KAAK,CACT,KAAc,EACd,MAAiB;QAEjB,MAAM,KAAK,GAAG,KAAe,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC,mBAAmB,CAAC,CAAC;QAEzD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;gBACL,QAAQ,EAAE,WAAW;gBACrB,UAAU,EAAE,WAAW;gBACvB,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,kCAAkC;gBAC3C,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,2BAA2B;aACnC,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,GAAG,cAAc,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAChD;gBACE,OAAO,EAAE;oBACP,MAAM,EAAE,kBAAkB;oBAC1B,WAAW,EAAE,MAAM;oBACnB,YAAY,EAAE,UAAU;iBACzB;aACF,CACF,CAAC;YAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;gBAC5D,OAAO;oBACL,QAAQ,EAAE,WAAW;oBACrB,UAAU,EAAE,WAAW;oBACvB,KAAK,EAAE,KAAK;oBACZ,OAAO,EAAE,cAAc,QAAQ,CAAC,MAAM,IAAI,UAAU,EAAE;oBACtD,QAAQ,EAAE,MAAM;oBAChB,KAAK,EAAE,0BAA0B,QAAQ,CAAC,MAAM,KAAK,UAAU,EAAE;iBAClE,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAsB,CAAC;YAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;YAE7B,IAAI,QAAQ,GAAkC,KAAK,CAAC;YACpD,IAAI,IAAI,CAAC,KAAK,GAAG,EAAE,EAAE,CAAC;gBACpB,QAAQ,GAAG,UAAU,CAAC;YACxB,CAAC;iBAAM,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;gBAC1B,QAAQ,GAAG,MAAM,CAAC;YACpB,CAAC;YAED,OAAO;gBACL,QAAQ,EAAE,WAAW;gBACrB,UAAU,EAAE,WAAW;gBACvB,KAAK;gBACL,OAAO,EAAE,KAAK;oBACZ,CAAC,CAAC,YAAY,IAAI,CAAC,KAAK,iBAAiB,IAAI,CAAC,OAAO,CAAC,MAAM,YAAY;oBACxE,CAAC,CAAC,iCAAiC;gBACrC,QAAQ;gBACR,KAAK,EAAE,IAAI;gBACX,QAAQ,EAAE;oBACR,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;oBAChC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;iBACzC;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO;gBACL,QAAQ,EAAE,WAAW;gBACrB,UAAU,EAAE,WAAW;gBACvB,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,kBAAkB,mBAAmB,CAAC,OAAO,CAAC,EAAE;gBACzD,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC;aACpC,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAC"}

package/dist/checks/plugins/local-analysis-plugin.d.ts

@@ -0,0 +1,3 @@
+import type { CheckPlugin } from "../plugin.js";
+export declare const localAnalysisPlugin: CheckPlugin;
+//# sourceMappingURL=local-analysis-plugin.d.ts.map

package/dist/checks/plugins/local-analysis-plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-analysis-plugin.d.ts","sourceRoot":"","sources":["../../../src/checks/plugins/local-analysis-plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAKhD,eAAO,MAAM,mBAAmB,EAAE,WAwCjC,CAAC"}

package/dist/checks/plugins/local-analysis-plugin.js

@@ -0,0 +1,36 @@
+import { performLocalCheck } from "../local-check.js";
+export const localAnalysisPlugin = {
+    id: "local-analysis",
+    name: "Local Analysis",
+    inputKind: "secret",
+    requiresNetwork: false,
+    requiredConfigKeys: [],
+    isFree: true,
+    privacySummary: "No data sent (local only)",
+    async check(input, _config) {
+        const secret = input;
+        const result = performLocalCheck(secret);
+        const details = [
+            `Provider: ${result.identification.provider} (${result.identification.confidence})`,
+            `Entropy: ${result.entropy.shannonEntropy} bits/char`,
+        ];
+        if (result.warnings.length > 0) {
+            details.push(`Warnings: ${result.warnings.join("; ")}`);
+        }
+        return {
+            pluginId: "local-analysis",
+            pluginName: "Local Analysis",
+            found: false,
+            details: details.join(", "),
+            severity: result.looksLikeSecret ? "info" : "low",
+            error: null,
+            metadata: {
+                provider: result.identification.provider,
+                confidence: result.identification.confidence,
+                entropy: result.entropy.shannonEntropy,
+                looksLikeSecret: result.looksLikeSecret,
+            },
+        };
+    },
+};
+//# sourceMappingURL=local-analysis-plugin.js.map

package/dist/checks/plugins/local-analysis-plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-analysis-plugin.js","sourceRoot":"","sources":["../../../src/checks/plugins/local-analysis-plugin.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,MAAM,CAAC,MAAM,mBAAmB,GAAgB;IAC9C,EAAE,EAAE,gBAAgB;IACpB,IAAI,EAAE,gBAAgB;IACtB,SAAS,EAAE,QAAQ;IACnB,eAAe,EAAE,KAAK;IACtB,kBAAkB,EAAE,EAAE;IACtB,MAAM,EAAE,IAAI;IACZ,cAAc,EAAE,2BAA2B;IAE3C,KAAK,CAAC,KAAK,CACT,KAA4B,EAC5B,OAAkB;QAElB,MAAM,MAAM,GAAG,KAAqB,CAAC;QACrC,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAEzC,MAAM,OAAO,GAAG;YACd,aAAa,MAAM,CAAC,cAAc,CAAC,QAAQ,KAAK,MAAM,CAAC,cAAc,CAAC,UAAU,GAAG;YACnF,YAAY,MAAM,CAAC,OAAO,CAAC,cAAc,YAAY;SACtD,CAAC;QAEF,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,OAAO,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1D,CAAC;QAED,OAAO;YACL,QAAQ,EAAE,gBAAgB;YAC1B,UAAU,EAAE,gBAAgB;YAC5B,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAC3B,QAAQ,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;YACjD,KAAK,EAAE,IAAI;YACX,QAAQ,EAAE;gBACR,QAAQ,EAAE,MAAM,CAAC,cAAc,CAAC,QAAQ;gBACxC,UAAU,EAAE,MAAM,CAAC,cAAc,CAAC,UAAU;gBAC5C,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,cAAc;gBACtC,eAAe,EAAE,MAAM,CAAC,eAAe;aACxC;SACF,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/checks/registry.d.ts

@@ -0,0 +1,24 @@
+import type { CheckPlugin } from "./plugin.js";
+import type { AppConfig, PluginInputKind } from "../types/index.js";
+/**
+ * Registry for check plugins. Manages plugin registration and
+ * filtering by input kind, network requirements, and config availability.
+ */
+export declare class CheckRegistry {
+    #private;
+    register(plugin: CheckPlugin): void;
+    /** Get all registered plugins. */
+    getAll(): readonly CheckPlugin[];
+    /** Get plugins filtered by input kind. */
+    getByKind(kind: PluginInputKind): CheckPlugin[];
+    /**
+     * Get plugins that are runnable given the current config.
+     * Filters out:
+     * - Network plugins when offline
+     * - Plugins missing required API keys
+     * - Explicitly disabled plugins
+     * - Plugins not in the enabled list (if an enabled list is provided)
+     */
+    getRunnable(kind: PluginInputKind, config: AppConfig): CheckPlugin[];
+}
+//# sourceMappingURL=registry.d.ts.map

package/dist/checks/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/checks/registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpE;;;GAGG;AACH,qBAAa,aAAa;;IAGxB,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI;IAOnC,kCAAkC;IAClC,MAAM,IAAI,SAAS,WAAW,EAAE;IAIhC,0CAA0C;IAC1C,SAAS,CAAC,IAAI,EAAE,eAAe,GAAG,WAAW,EAAE;IAM/C;;;;;;;OAOG;IACH,WAAW,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,GAAG,WAAW,EAAE;CA2BrE"}

package/dist/checks/registry.js

@@ -0,0 +1,53 @@
+/**
+ * Registry for check plugins. Manages plugin registration and
+ * filtering by input kind, network requirements, and config availability.
+ */
+export class CheckRegistry {
+    #plugins = [];
+    register(plugin) {
+        if (this.#plugins.some((p) => p.id === plugin.id)) {
+            throw new Error(`Plugin already registered: ${plugin.id}`);
+        }
+        this.#plugins.push(plugin);
+    }
+    /** Get all registered plugins. */
+    getAll() {
+        return this.#plugins;
+    }
+    /** Get plugins filtered by input kind. */
+    getByKind(kind) {
+        return this.#plugins.filter((p) => p.inputKind === kind || p.inputKind === "both");
+    }
+    /**
+     * Get plugins that are runnable given the current config.
+     * Filters out:
+     * - Network plugins when offline
+     * - Plugins missing required API keys
+     * - Explicitly disabled plugins
+     * - Plugins not in the enabled list (if an enabled list is provided)
+     */
+    getRunnable(kind, config) {
+        return this.getByKind(kind).filter((p) => {
+            // Respect disable list
+            if (config.disabledPlugins.length > 0 && config.disabledPlugins.includes(p.id)) {
+                return false;
+            }
+            // If an explicit enable list is provided, only include those
+            if (config.enabledPlugins.length > 0 && !config.enabledPlugins.includes(p.id)) {
+                return false;
+            }
+            // Skip network plugins in offline mode
+            if (config.offline && p.requiresNetwork) {
+                return false;
+            }
+            // Skip plugins missing required config keys
+            for (const key of p.requiredConfigKeys) {
+                if (!config.pluginApiKeys[key]) {
+                    return false;
+                }
+            }
+            return true;
+        });
+    }
+}
+//# sourceMappingURL=registry.js.map

package/dist/checks/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/checks/registry.ts"],"names":[],"mappings":"AAGA;;;GAGG;AACH,MAAM,OAAO,aAAa;IACf,QAAQ,GAAkB,EAAE,CAAC;IAEtC,QAAQ,CAAC,MAAmB;QAC1B,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IAED,kCAAkC;IAClC,MAAM;QACJ,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,0CAA0C;IAC1C,SAAS,CAAC,IAAqB;QAC7B,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CACzB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,CAAC,SAAS,KAAK,MAAM,CACtD,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,WAAW,CAAC,IAAqB,EAAE,MAAiB;QAClD,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YACvC,uBAAuB;YACvB,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC/E,OAAO,KAAK,CAAC;YACf,CAAC;YAED,6DAA6D;YAC7D,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC9E,OAAO,KAAK,CAAC;YACf,CAAC;YAED,uCAAuC;YACvC,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC,eAAe,EAAE,CAAC;gBACxC,OAAO,KAAK,CAAC;YACf,CAAC;YAED,4CAA4C;YAC5C,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,kBAAkB,EAAE,CAAC;gBACvC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC/B,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/config/config.d.ts

@@ -0,0 +1,10 @@
+import type { AppConfig } from "../types/index.js";
+/**
+ * Load configuration from env vars and CLI options.
+ *
+ * Only loads .env if --env-file is explicitly provided or the .env file
+ * is in the current working directory (with a warning). This prevents
+ * a malicious .env in a cloned repo from silently overriding config.
+ */
+export declare function loadConfig(cliOptions?: Partial<AppConfig>): AppConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/config/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config/config.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAanD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,UAAU,GAAE,OAAO,CAAC,SAAS,CAAM,GAAG,SAAS,CAsCzE"}

package/dist/config/config.js

@@ -0,0 +1,56 @@
+import { existsSync } from "node:fs";
+import { resolve } from "node:path";
+import { config as dotenvConfig } from "dotenv";
+/** Known plugin API key env var names. */
+const PLUGIN_API_KEY_VARS = [
+    "HIBP_API_KEY",
+    "EMAILREP_API_KEY",
+    "GITGUARDIAN_API_TOKEN",
+    "DEHASHED_EMAIL",
+    "DEHASHED_API_KEY",
+    "LEAKCHECK_API_KEY",
+    "INTELX_API_KEY",
+];
+/**
+ * Load configuration from env vars and CLI options.
+ *
+ * Only loads .env if --env-file is explicitly provided or the .env file
+ * is in the current working directory (with a warning). This prevents
+ * a malicious .env in a cloned repo from silently overriding config.
+ */
+export function loadConfig(cliOptions = {}) {
+    if (cliOptions.envFile) {
+        // Explicit --env-file: load it
+        dotenvConfig({ path: resolve(cliOptions.envFile) });
+    }
+    else {
+        // Only auto-load .env from cwd if it exists, with a warning
+        const defaultEnv = resolve(".env");
+        if (existsSync(defaultEnv)) {
+            process.stderr.write(`Note: Loading .env from ${defaultEnv}\n`);
+            dotenvConfig({ path: defaultEnv });
+        }
+    }
+    // Collect plugin API keys from environment
+    const pluginApiKeys = {
+        ...cliOptions.pluginApiKeys,
+    };
+    for (const varName of PLUGIN_API_KEY_VARS) {
+        const val = process.env[varName];
+        if (val && !pluginApiKeys[varName]) {
+            pluginApiKeys[varName] = val;
+        }
+    }
+    return {
+        hibpApiKey: cliOptions.hibpApiKey ?? process.env["HIBP_API_KEY"] ?? null,
+        auditLogPath: cliOptions.auditLogPath ?? process.env["CP_AUDIT_LOG"] ?? null,
+        offline: cliOptions.offline ?? false,
+        json: cliOptions.json ?? false,
+        verbose: cliOptions.verbose ?? false,
+        verify: cliOptions.verify ?? false,
+        enabledPlugins: cliOptions.enabledPlugins ?? [],
+        disabledPlugins: cliOptions.disabledPlugins ?? [],
+        pluginApiKeys,
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/config/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/config/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,MAAM,IAAI,YAAY,EAAE,MAAM,QAAQ,CAAC;AAGhD,0CAA0C;AAC1C,MAAM,mBAAmB,GAAG;IAC1B,cAAc;IACd,kBAAkB;IAClB,uBAAuB;IACvB,gBAAgB;IAChB,kBAAkB;IAClB,mBAAmB;IACnB,gBAAgB;CACR,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,aAAiC,EAAE;IAC5D,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;QACvB,+BAA+B;QAC/B,YAAY,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC;SAAM,CAAC;QACN,4DAA4D;QAC5D,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,2BAA2B,UAAU,IAAI,CAC1C,CAAC;YACF,YAAY,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED,2CAA2C;IAC3C,MAAM,aAAa,GAA2B;QAC5C,GAAG,UAAU,CAAC,aAAa;KAC5B,CAAC;IACF,KAAK,MAAM,OAAO,IAAI,mBAAmB,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;YACnC,aAAa,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,OAAO;QACL,UAAU,EAAE,UAAU,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,IAAI;QACxE,YAAY,EACV,UAAU,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,IAAI;QAChE,OAAO,EAAE,UAAU,CAAC,OAAO,IAAI,KAAK;QACpC,IAAI,EAAE,UAAU,CAAC,IAAI,IAAI,KAAK;QAC9B,OAAO,EAAE,UAAU,CAAC,OAAO,IAAI,KAAK;QACpC,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,KAAK;QAClC,cAAc,EAAE,UAAU,CAAC,cAAc,IAAI,EAAE;QAC/C,eAAe,EAAE,UAAU,CAAC,eAAe,IAAI,EAAE;QACjD,aAAa;KACd,CAAC;AACJ,CAAC"}

package/dist/core/entropy.d.ts

@@ -0,0 +1,23 @@
+import type { SecureBuffer } from "./secure-buffer.js";
+import type { Encoding, EntropyResult } from "../types/index.js";
+/**
+ * Calculate Shannon entropy (bits per character) from a Buffer.
+ * Operates on raw bytes to avoid creating an immutable string.
+ */
+export declare function shannonEntropyFromBuffer(buf: Buffer): number;
+/** Calculate Shannon entropy (bits per character) from a string. */
+export declare function shannonEntropy(data: string): number;
+/**
+ * Detect the likely encoding of a buffer by examining byte values.
+ */
+export declare function detectEncodingFromBuffer(buf: Buffer): Encoding;
+/** Detect the likely encoding of a string. */
+export declare function detectEncoding(data: string): Encoding;
+/**
+ * Analyze entropy of a secret held in a SecureBuffer.
+ * Uses Buffer-based operations to avoid creating long-lived strings.
+ */
+export declare function analyzeEntropyFromBuffer(secret: SecureBuffer): EntropyResult;
+/** Analyze entropy of a string. */
+export declare function analyzeEntropy(data: string): EntropyResult;
+//# sourceMappingURL=entropy.d.ts.map

package/dist/core/entropy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entropy.d.ts","sourceRoot":"","sources":["../../src/core/entropy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEjE;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAiB5D;AAED,oEAAoE;AACpE,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAgBnD;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ,CAqC9D;AAED,8CAA8C;AAC9C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,CAQrD;AAsBD;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,YAAY,GAAG,aAAa,CAgC5E;AAED,mCAAmC;AACnC,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAuB1D"}

package/dist/core/entropy.js

@@ -0,0 +1,180 @@
+/**
+ * Calculate Shannon entropy (bits per character) from a Buffer.
+ * Operates on raw bytes to avoid creating an immutable string.
+ */
+export function shannonEntropyFromBuffer(buf) {
+    if (buf.length === 0)
+        return 0;
+    const freq = new Map();
+    for (let i = 0; i < buf.length; i++) {
+        const byte = buf[i];
+        freq.set(byte, (freq.get(byte) ?? 0) + 1);
+    }
+    let entropy = 0;
+    const len = buf.length;
+    for (const count of freq.values()) {
+        const p = count / len;
+        entropy -= p * Math.log2(p);
+    }
+    return entropy;
+}
+/** Calculate Shannon entropy (bits per character) from a string. */
+export function shannonEntropy(data) {
+    if (data.length === 0)
+        return 0;
+    const freq = new Map();
+    for (const ch of data) {
+        freq.set(ch, (freq.get(ch) ?? 0) + 1);
+    }
+    let entropy = 0;
+    const len = data.length;
+    for (const count of freq.values()) {
+        const p = count / len;
+        entropy -= p * Math.log2(p);
+    }
+    return entropy;
+}
+/**
+ * Detect the likely encoding of a buffer by examining byte values.
+ */
+export function detectEncodingFromBuffer(buf) {
+    let hasPlus = false;
+    let hasSlash = false;
+    let hasEquals = false;
+    let hasUnderscore = false;
+    let hasHyphen = false;
+    let allHex = true;
+    let allAlnum = true;
+    let allBase64 = true;
+    for (let i = 0; i < buf.length; i++) {
+        const b = buf[i];
+        const isDigit = b >= 0x30 && b <= 0x39;
+        const isUpper = b >= 0x41 && b <= 0x5a;
+        const isLower = b >= 0x61 && b <= 0x7a;
+        const isHexLower = b >= 0x61 && b <= 0x66;
+        const isHexUpper = b >= 0x41 && b <= 0x46;
+        const isB64Special = b === 0x2b || b === 0x2f || b === 0x3d; // + / =
+        if (b === 0x2b)
+            hasPlus = true;
+        else if (b === 0x2f)
+            hasSlash = true;
+        else if (b === 0x3d)
+            hasEquals = true;
+        else if (b === 0x5f)
+            hasUnderscore = true;
+        else if (b === 0x2d)
+            hasHyphen = true;
+        if (!(isDigit || isHexLower || isHexUpper))
+            allHex = false;
+        if (!(isDigit || isUpper || isLower))
+            allAlnum = false;
+        if (!(isDigit || isUpper || isLower || isB64Special))
+            allBase64 = false;
+    }
+    if (allHex && !hasPlus && !hasSlash && !hasEquals && !hasUnderscore && !hasHyphen)
+        return "hex";
+    if (allBase64 && (hasPlus || hasSlash || hasEquals))
+        return "base64";
+    if (allAlnum && !hasUnderscore && !hasHyphen)
+        return "base62";
+    if (allAlnum || (!hasPlus && !hasSlash && !hasEquals)) {
+        if (hasUnderscore || hasHyphen)
+            return "alphanumeric";
+    }
+    return "mixed";
+}
+/** Detect the likely encoding of a string. */
+export function detectEncoding(data) {
+    if (/^[0-9a-fA-F]+$/.test(data))
+        return "hex";
+    // base64 must contain +, /, or trailing = to distinguish from base62
+    if (/^[A-Za-z0-9+/]+=+$/.test(data) || (/^[A-Za-z0-9+/=]+$/.test(data) && /[+/=]/.test(data)))
+        return "base64";
+    if (/^[A-Za-z0-9]+$/.test(data))
+        return "base62";
+    if (/^[A-Za-z0-9_-]+$/.test(data))
+        return "alphanumeric";
+    return "mixed";
+}
+/** Maximum possible Shannon entropy for a given alphabet size. */
+function maxEntropy(alphabetSize) {
+    return alphabetSize > 0 ? Math.log2(alphabetSize) : 0;
+}
+function alphabetSizeForEncoding(encoding) {
+    switch (encoding) {
+        case "hex":
+            return 16;
+        case "base62":
+            return 62;
+        case "base64":
+            return 64;
+        case "alphanumeric":
+            return 64; // includes _ and -
+        case "mixed":
+            return 95; // printable ASCII
+    }
+}
+/**
+ * Analyze entropy of a secret held in a SecureBuffer.
+ * Uses Buffer-based operations to avoid creating long-lived strings.
+ */
+export function analyzeEntropyFromBuffer(secret) {
+    const buf = secret.unsafeGetBuffer();
+    // Trim whitespace bytes from the buffer for analysis
+    let start = 0;
+    let end = buf.length;
+    while (start < end && (buf[start] === 0x20 || buf[start] === 0x09 || buf[start] === 0x0a || buf[start] === 0x0d))
+        start++;
+    while (end > start && (buf[end - 1] === 0x20 || buf[end - 1] === 0x09 || buf[end - 1] === 0x0a || buf[end - 1] === 0x0d))
+        end--;
+    const trimmed = buf.subarray(start, end);
+    const len = trimmed.length;
+    const entropy = shannonEntropyFromBuffer(trimmed);
+    const encoding = detectEncodingFromBuffer(trimmed);
+    const maxEnt = maxEntropy(alphabetSizeForEncoding(encoding));
+    const normalized = maxEnt > 0 ? entropy / maxEnt : 0;
+    let warning = null;
+    if (len < 8) {
+        warning = "Very short — likely not a real API key";
+    }
+    else if (entropy < 2.5) {
+        warning = "Very low entropy — may be a placeholder or test value";
+    }
+    else if (entropy < 3.5 && len < 20) {
+        warning = "Low entropy — consider whether this is a real secret";
+    }
+    return {
+        shannonEntropy: Math.round(entropy * 1000) / 1000,
+        maxPossibleEntropy: Math.round(maxEnt * 1000) / 1000,
+        normalizedEntropy: Math.round(normalized * 1000) / 1000,
+        encoding,
+        length: len,
+        warning,
+    };
+}
+/** Analyze entropy of a string. */
+export function analyzeEntropy(data) {
+    const entropy = shannonEntropy(data);
+    const encoding = detectEncoding(data);
+    const maxEnt = maxEntropy(alphabetSizeForEncoding(encoding));
+    const normalized = maxEnt > 0 ? entropy / maxEnt : 0;
+    let warning = null;
+    if (data.length < 8) {
+        warning = "Very short — likely not a real API key";
+    }
+    else if (entropy < 2.5) {
+        warning = "Very low entropy — may be a placeholder or test value";
+    }
+    else if (entropy < 3.5 && data.length < 20) {
+        warning = "Low entropy — consider whether this is a real secret";
+    }
+    return {
+        shannonEntropy: Math.round(entropy * 1000) / 1000,
+        maxPossibleEntropy: Math.round(maxEnt * 1000) / 1000,
+        normalizedEntropy: Math.round(normalized * 1000) / 1000,
+        encoding,
+        length: data.length,
+        warning,
+    };
+}
+//# sourceMappingURL=entropy.js.map