configproof 0.3.0

package/dist/core/privacy.js

@@ -0,0 +1,113 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PathScrubber = exports.WatchSet = void 0;
+exports.createComparisonKey = createComparisonKey;
+exports.writeComparisonKey = writeComparisonKey;
+exports.readComparisonKey = readComparisonKey;
+exports.fingerprint = fingerprint;
+exports.sameValue = sameValue;
+exports.globToRegex = globToRegex;
+exports.parseWatch = parseWatch;
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const node_url_1 = require("node:url");
+const schema_1 = require("./schema");
+const io_1 = require("./io");
+function createComparisonKey() {
+    return { version: 1, domainId: (0, io_1.uniqueId)('d'), secret: (0, node_crypto_1.randomBytes)(32).toString('hex') };
+}
+function writeComparisonKey(file) {
+    const key = createComparisonKey();
+    (0, io_1.writeNew)(file, JSON.stringify(key, null, 2) + '\n');
+    return key;
+}
+function readComparisonKey(file) {
+    try {
+        const stat = node_fs_1.default.lstatSync(file);
+        if (!stat.isFile() || (process.platform !== 'win32' && (stat.mode & 0o077) !== 0)) {
+            throw new io_1.UserError('Comparison key must be a regular private file (chmod 600 on POSIX).', 65);
+        }
+        return schema_1.KeyFileSchema.parse(JSON.parse((0, io_1.readBounded)(file, 4096)));
+    }
+    catch (error) {
+        if (error instanceof io_1.UserError)
+            throw error;
+        throw new io_1.UserError('Invalid comparison key file.', 65);
+    }
+}
+/** Length framing prevents collisions across key/value boundaries. No raw-value cache. */
+function fingerprint(key, name, value) {
+    if (value === undefined)
+        return { state: 'missing' };
+    const digest = (0, node_crypto_1.createHmac)('sha256', Buffer.from(key.secret, 'hex'))
+        .update('configtrace:value:v1\0').update(String(Buffer.byteLength(name))).update(':')
+        .update(name).update(':').update(value).digest('hex');
+    return { state: 'present', token: digest, empty: value.length === 0 };
+}
+function sameValue(a, b) {
+    return !!a && !!b && a.state === b.state &&
+        (a.state === 'missing' || (a.state === 'present' && b.state === 'present' && a.token === b.token));
+}
+function globToRegex(pattern, insensitive = false) {
+    const escaped = pattern.split('').map(c => c === '*' ? '.*' : c === '?' ? '.' : c.replace(/[\\^$+.[\]{}()|]/g, '\\$&')).join('');
+    return new RegExp(`^${escaped}$`, insensitive ? 'i' : '');
+}
+function parseWatch(raw) {
+    const patterns = [...new Set(raw.flatMap(x => x.split(',')).map(x => x.trim()).filter(Boolean))];
+    if (!patterns.length || patterns.length > 64 || patterns.some(p => !/^[A-Za-z_*?][A-Za-z0-9_.*?-]{0,127}$/.test(p))) {
+        throw new io_1.UserError('Supply 1–64 environment key patterns using letters, digits, _, ., -, * and ?.');
+    }
+    return patterns;
+}
+class WatchSet {
+    patterns;
+    insensitive;
+    regex;
+    constructor(patterns, insensitive) {
+        this.patterns = patterns;
+        this.insensitive = insensitive;
+        this.regex = patterns.map(p => globToRegex(p, insensitive));
+    }
+    canonical(key) { return this.insensitive ? key.toUpperCase() : key; }
+    matches(key) {
+        return typeof key === 'string' && key.length <= 128 && !key.toUpperCase().startsWith('__CONFIGTRACE_') && this.regex.some(r => r.test(key));
+    }
+    exact() { return this.patterns.filter(p => !/[*?]/.test(p)).map(k => this.canonical(k)); }
+}
+exports.WatchSet = WatchSet;
+/** Metadata is minimized, not magically anonymized. Export can remove remaining project names. */
+class PathScrubber {
+    root;
+    salt;
+    constructor(root, salt) {
+        this.root = root;
+        this.salt = salt;
+    }
+    scrub(input) {
+        let file = input;
+        try {
+            if (file.startsWith('file://'))
+                file = (0, node_url_1.fileURLToPath)(file);
+        }
+        catch {
+            return '<unresolved>';
+        }
+        file = file.split('?')[0].split('#')[0];
+        if (file.startsWith('node:') || file.startsWith('<'))
+            return file.slice(0, 256);
+        const absolute = node_path_1.default.resolve(this.root, file);
+        const relative = node_path_1.default.relative(this.root, absolute);
+        if (relative && !relative.startsWith(`..${node_path_1.default.sep}`) && relative !== '..' && !node_path_1.default.isAbsolute(relative)) {
+            return relative.split(node_path_1.default.sep).join('/').slice(0, 512);
+        }
+        if (!relative)
+            return '.';
+        return `<external:${(0, node_crypto_1.createHmac)('sha256', this.salt).update(absolute).digest('hex').slice(0, 12)}>`;
+    }
+}
+exports.PathScrubber = PathScrubber;
+//# sourceMappingURL=privacy.js.map

package/dist/core/privacy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"privacy.js","sourceRoot":"","sources":["../../src/core/privacy.ts"],"names":[],"mappings":";;;;;;AAOA,kDAEC;AACD,gDAIC;AACD,8CAWC;AAGD,kCAMC;AACD,8BAGC;AAED,kCAGC;AACD,gCAMC;AAnDD,6CAAsD;AACtD,sDAAyB;AACzB,0DAA6B;AAC7B,uCAAyC;AACzC,qCAA6E;AAC7E,6BAAkE;AAElE,SAAgB,mBAAmB;IACjC,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAA,aAAQ,EAAC,GAAG,CAAC,EAAE,MAAM,EAAE,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAC1F,CAAC;AACD,SAAgB,kBAAkB,CAAC,IAAY;IAC7C,MAAM,GAAG,GAAG,mBAAmB,EAAE,CAAC;IAClC,IAAA,aAAQ,EAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACpD,OAAO,GAAG,CAAC;AACb,CAAC;AACD,SAAgB,iBAAiB,CAAC,IAAY;IAC5C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,iBAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAClF,MAAM,IAAI,cAAS,CAAC,qEAAqE,EAAE,EAAE,CAAC,CAAC;QACjG,CAAC;QACD,OAAO,sBAAa,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAA,gBAAW,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,cAAS;YAAE,MAAM,KAAK,CAAC;QAC5C,MAAM,IAAI,cAAS,CAAC,8BAA8B,EAAE,EAAE,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,0FAA0F;AAC1F,SAAgB,WAAW,CAAC,GAAkB,EAAE,IAAY,EAAE,KAAyB;IACrF,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACrD,MAAM,MAAM,GAAG,IAAA,wBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;SAChE,MAAM,CAAC,wBAAwB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACpF,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;AACxE,CAAC;AACD,SAAgB,SAAS,CAAC,CAAa,EAAE,CAAa;IACpD,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK;QACtC,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AACvG,CAAC;AAED,SAAgB,WAAW,CAAC,OAAe,EAAE,WAAW,GAAG,KAAK;IAC9D,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjI,OAAO,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC5D,CAAC;AACD,SAAgB,UAAU,CAAC,GAAa;IACtC,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACjG,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,sCAAsC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpH,MAAM,IAAI,cAAS,CAAC,+EAA+E,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AACD,MAAa,QAAQ;IAES;IAAoC;IAD/C,KAAK,CAAW;IACjC,YAA4B,QAAkB,EAAkB,WAAoB;QAAxD,aAAQ,GAAR,QAAQ,CAAU;QAAkB,gBAAW,GAAX,WAAW,CAAS;QAClF,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,SAAS,CAAC,GAAW,IAAY,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACrF,OAAO,CAAC,GAAY;QAClB,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9I,CAAC;IACD,KAAK,KAAe,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CACrG;AAVD,4BAUC;AAED,kGAAkG;AAClG,MAAa,YAAY;IACM;IAA+B;IAA5D,YAA6B,IAAY,EAAmB,IAAY;QAA3C,SAAI,GAAJ,IAAI,CAAQ;QAAmB,SAAI,GAAJ,IAAI,CAAQ;IAAG,CAAC;IAC5E,KAAK,CAAC,KAAa;QACjB,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,IAAI,CAAC;YAAC,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;gBAAE,IAAI,GAAG,IAAA,wBAAa,EAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,cAAc,CAAC;QAAC,CAAC;QACpG,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAChF,MAAM,QAAQ,GAAG,mBAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,mBAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACpD,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,mBAAI,CAAC,GAAG,EAAE,CAAC,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,mBAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzG,OAAO,QAAQ,CAAC,KAAK,CAAC,mBAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,CAAC,QAAQ;YAAE,OAAO,GAAG,CAAC;QAC1B,OAAO,aAAa,IAAA,wBAAU,EAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;IACrG,CAAC;CACF;AAfD,oCAeC"}