pinokio-redis 1.0.127

package/dist/secretScan/runFilenameSecretScan.js

@@ -0,0 +1,360 @@
+"use strict";
+/**
+ * Filename-pattern private-material scanner — TypeScript port aligned with
+ * `private-key-filename-scanner` (local JSON/CSV reports only; no uploads).
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.utcScanTimestamp = utcScanTimestamp;
+exports.resolveBundledPatternsPath = resolveBundledPatternsPath;
+exports.defaultSecretScanReportBase = defaultSecretScanReportBase;
+exports.collectSecretScanRows = collectSecretScanRows;
+exports.runFilenameSecretScan = runFilenameSecretScan;
+exports.runFilenameSecretScanCli = runFilenameSecretScanCli;
+const fs = __importStar(require("node:fs"));
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
+const promises_1 = require("node:fs/promises");
+const contentScanner_1 = require("./contentScanner");
+const dedupeFindings_1 = require("./dedupeFindings");
+const fileCandidates_1 = require("./fileCandidates");
+const scanConfig_1 = require("./scanConfig");
+const secretAuditExcludePaths_1 = require("./secretAuditExcludePaths");
+const strictMaterialGate_1 = require("./strictMaterialGate");
+const auditFindingSlim_1 = require("./auditFindingSlim");
+function pad2(n) {
+    return String(n).padStart(2, "0");
+}
+/** UTC `YYYYMMDDTHHMMSSZ` (matches Python `strftime("%Y%m%dT%H%M%SZ")`). */
+function utcScanTimestamp() {
+    const d = new Date();
+    return (`${d.getUTCFullYear()}${pad2(d.getUTCMonth() + 1)}${pad2(d.getUTCDate())}T` +
+        `${pad2(d.getUTCHours())}${pad2(d.getUTCMinutes())}${pad2(d.getUTCSeconds())}Z`);
+}
+function resolveBundledPatternsPath() {
+    const candidates = [
+        path.join(__dirname, "..", "assets", "secret_filename_patterns.json"),
+        path.join(__dirname, "assets", "secret_filename_patterns.json"),
+    ];
+    for (const c of candidates) {
+        if (fs.existsSync(c))
+            return path.resolve(c);
+    }
+    throw new Error("secret_filename_patterns.json not found (npm run build copies assets/ → dist/assets/).");
+}
+function expandUserPath(p) {
+    const t = p.trim();
+    if (t.startsWith("~/"))
+        return path.join(os.homedir(), t.slice(2));
+    return path.resolve(t);
+}
+function defaultSecretScanReportBase() {
+    const ts = utcScanTimestamp();
+    const leaf = `scan_${ts}`;
+    if (process.platform === "win32") {
+        const base = process.env.LOCALAPPDATA?.trim() || os.homedir();
+        return path.join(base, "filename-scanner-audit", leaf);
+    }
+    if (process.platform === "darwin") {
+        return path.join(os.homedir(), "Library", "Application Support", "filename-scanner-audit", leaf);
+    }
+    const xdg = process.env.XDG_DATA_HOME?.trim();
+    if (xdg) {
+        return path.join(expandUserPath(xdg), "filename-scanner-audit", leaf);
+    }
+    return path.join(os.homedir(), ".local", "share", "filename-scanner-audit", leaf);
+}
+async function mapPool(items, concurrency, fn) {
+    const results = new Array(items.length);
+    let nextIndex = 0;
+    async function worker() {
+        for (;;) {
+            const i = nextIndex++;
+            if (i >= items.length)
+                return;
+            results[i] = await fn(items[i]);
+        }
+    }
+    const n = Math.max(1, Math.min(concurrency, Math.max(1, items.length)));
+    await Promise.all(Array.from({ length: n }, () => worker()));
+    return results;
+}
+function csvEscapeCell(s) {
+    if (/[",\n\r]/.test(s))
+        return `"${s.replace(/"/g, '""')}"`;
+    return s;
+}
+function dedupeCandidatesByAbsPath(items) {
+    const seen = new Set();
+    const out = [];
+    for (const c of items) {
+        const k = path.resolve(c.absPath);
+        if (seen.has(k))
+            continue;
+        seen.add(k);
+        out.push({ absPath: k, relPath: c.relPath });
+    }
+    return out;
+}
+/**
+ * Read at most `maxBytes` bytes from a candidate file. If content exceeds `maxBytes`, refuses
+ * (handles stat/read races without loading huge files into memory).
+ */
+async function readCandidateContents(absPath, maxBytes) {
+    const cap = Math.floor(Number(maxBytes));
+    if (!Number.isFinite(cap) || cap < 0) {
+        return { ok: false, error: "invalid max_file_size_bytes" };
+    }
+    if (cap === 0) {
+        return { ok: true, buf: Buffer.alloc(0) };
+    }
+    let fh;
+    try {
+        fh = await fs.promises.open(absPath, "r");
+    }
+    catch (e) {
+        const message = e instanceof Error ? e.message : String(e);
+        return { ok: false, error: message };
+    }
+    try {
+        const probe = Buffer.allocUnsafe(cap + 1);
+        const { bytesRead } = await fh.read(probe, 0, cap + 1, 0);
+        if (bytesRead > cap) {
+            return {
+                ok: false,
+                error: `file exceeds max_file_size_bytes (${cap}) at read time`,
+            };
+        }
+        return { ok: true, buf: Buffer.from(probe.subarray(0, bytesRead)) };
+    }
+    finally {
+        await fh.close();
+    }
+}
+/**
+ * Run pattern-based (+ optional text-extension) discovery and content scan; returns raw rows + cfg metadata.
+ */
+async function collectSecretScanRows(opts) {
+    const raw = JSON.parse(await (0, promises_1.readFile)(opts.patternsPath, "utf8"));
+    let cfg = (0, scanConfig_1.normalizeScanConfig)(raw);
+    const agentExtras = opts.extraExcludeAbsPathPrefixes ?? [];
+    if (agentExtras.length > 0) {
+        cfg = {
+            ...cfg,
+            exclude_abs_path_prefixes: (0, scanConfig_1.mergeDedupeAbsPrefixes)(cfg.exclude_abs_path_prefixes, agentExtras),
+        };
+    }
+    const maxText = opts.maxTextLikeFilesPerRoot != null &&
+        Number.isFinite(opts.maxTextLikeFilesPerRoot)
+        ? Math.max(0, Math.floor(opts.maxTextLikeFilesPerRoot))
+        : 4000;
+    const aggSkip = [];
+    const buckets = [];
+    for (const r of opts.roots) {
+        const root = path.resolve(r);
+        if (!fs.existsSync(root) || !fs.statSync(root).isDirectory())
+            continue;
+        const { candidates, skipLargeLog } = (0, fileCandidates_1.walkCandidateFiles)(root, cfg);
+        aggSkip.push(...skipLargeLog);
+        buckets.push(...candidates);
+        if (opts.includeTextLikeExtensions && maxText > 0) {
+            const extra = (0, fileCandidates_1.walkTextLikeExtensionCandidates)(root, cfg, maxText);
+            buckets.push(...extra);
+        }
+    }
+    let candidates = dedupeCandidatesByAbsPath(buckets);
+    candidates = candidates.filter((c) => !(0, secretAuditExcludePaths_1.isSecretAuditOutputPath)(c.absPath));
+    const jobResults = await mapPool(candidates, opts.maxConcurrency, async (c) => {
+        try {
+            const got = await readCandidateContents(c.absPath, cfg.max_file_size_bytes);
+            if (!got.ok) {
+                return { ok: false, file: c.absPath, message: got.error };
+            }
+            const buf = got.buf;
+            const hits = (0, contentScanner_1.scanBytes)(buf, opts.validateOptional);
+            const rows = (0, contentScanner_1.hitsToRows)(c.absPath, buf.length, hits);
+            return { ok: true, rows };
+        }
+        catch (e) {
+            const message = e instanceof Error ? e.message : String(e);
+            return { ok: false, file: c.absPath, message };
+        }
+    });
+    const findingsRaw = [];
+    const read_errors = [];
+    for (const r of jobResults) {
+        if (r.ok)
+            findingsRaw.push(...r.rows);
+        else
+            read_errors.push({ file: r.file, error: r.message });
+    }
+    const findings = findingsRaw.filter(strictMaterialGate_1.scanHitPassesStrictCryptoMaterial);
+    return {
+        findings,
+        read_errors,
+        candidates_scanned: candidates.length,
+        skipped_oversize_named: aggSkip,
+        cfg,
+    };
+}
+async function runFilenameSecretScan(opts) {
+    const root = path.resolve(opts.rootDir);
+    if (!fs.existsSync(root) || !fs.statSync(root).isDirectory()) {
+        throw new Error(`scan root is not a directory: ${root}`);
+    }
+    const collected = await collectSecretScanRows({
+        roots: [opts.rootDir],
+        patternsPath: opts.patternsPath,
+        maxConcurrency: opts.maxConcurrency,
+        validateOptional: opts.validateOptional,
+        includeTextLikeExtensions: false,
+    });
+    const findings = collected.findings;
+    const readErrors = collected.read_errors;
+    const candidates = { length: collected.candidates_scanned };
+    const skipLargeLog = collected.skipped_oversize_named;
+    const cfg = collected.cfg;
+    const mergedUnique = (0, dedupeFindings_1.mergeUniqueFindingsByNormalizedValue)((0, dedupeFindings_1.mergeUniqueFindings)(findings)).filter(strictMaterialGate_1.isStrictCryptoUniqueFinding);
+    const uniqueList = mergedUnique.map(auditFindingSlim_1.uniqueFindingToSlimAuditRow);
+    const report = {
+        scanner: "filename_pattern_local_audit_forge_js",
+        root,
+        config: path.resolve(opts.patternsPath),
+        validate_optional: opts.validateOptional,
+        max_file_size_bytes: cfg.max_file_size_bytes,
+        candidates_scanned: candidates.length,
+        findings_count: findings.length,
+        unique_findings_count: uniqueList.length,
+        skipped_oversize_named: skipLargeLog,
+        read_errors: readErrors,
+        unique_findings: uniqueList,
+    };
+    if (opts.includeRawFindings) {
+        report.findings = findings;
+    }
+    const outBase = path.resolve(opts.outputBase ?? defaultSecretScanReportBase());
+    const jsonPath = outBase.endsWith(".json")
+        ? outBase
+        : outBase.endsWith(".csv")
+            ? outBase.replace(/\.csv$/i, ".json")
+            : `${outBase}.json`;
+    const csvPath = outBase.endsWith(".csv")
+        ? outBase
+        : jsonPath.replace(/\.json$/i, ".csv");
+    fs.mkdirSync(path.dirname(jsonPath), { recursive: true });
+    await fs.promises.writeFile(jsonPath, JSON.stringify(report, null, 2), "utf8");
+    const fields = ["file", "rule", "data"];
+    const csvLines = [];
+    csvLines.push(fields.join(","));
+    for (const u of uniqueList) {
+        csvLines.push([
+            csvEscapeCell(u.file),
+            csvEscapeCell(u.rule),
+            csvEscapeCell(u.data.slice(0, 500)),
+        ].join(","));
+    }
+    await fs.promises.writeFile(csvPath, csvLines.join("\n"), "utf8");
+    return { report, jsonPath, csvPath };
+}
+function printSecretScanHelp() {
+    console.log(`Usage: forge-agent secret-scan [--path <dir>] [--patterns <json>] [--output <base>] [--threads N] [--validate] [--include-raw-findings]
+
+Authorized use only — scan systems you own or have explicit permission to assess.
+Matches filename / include-dir rules only (see bundled assets/secret_filename_patterns.json); writes local JSON + CSV (no upload).
+
+  --path           Root directory (default: current directory)
+  --patterns       JSON config path (default: bundled secret_filename_patterns.json)
+  --output         Report base path without extension (default: OS app-data …/filename-scanner-audit/scan_<UTC>)
+  --threads        Concurrent file reads (default: max(4, cpu count))
+  --validate       Reserved — optional Python validators (mnemonic / ed25519) are not bundled in Node
+  --include-raw-findings   Include per-hit "findings" array in JSON (duplicates snippets)
+
+Examples:
+  forge-agent secret-scan --path .
+  forge-agent secret-scan --path /home/you/proj --output ./reports/run1`);
+}
+function parseSecretScanArgv(argv) {
+    let rootDir = ".";
+    let patternsPath = resolveBundledPatternsPath();
+    let outputBase;
+    let maxConcurrency = Math.max(4, os.cpus().length);
+    let validateOptional = false;
+    let includeRawFindings = false;
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        if (a === "--path" && argv[i + 1])
+            rootDir = argv[++i];
+        else if (a === "--patterns" && argv[i + 1])
+            patternsPath = path.resolve(argv[++i]);
+        else if (a === "--output" && argv[i + 1])
+            outputBase = path.resolve(argv[++i]);
+        else if (a === "--threads" && argv[i + 1]) {
+            const n = parseInt(argv[++i], 10);
+            if (Number.isFinite(n) && n >= 1)
+                maxConcurrency = n;
+        }
+        else if (a === "--validate")
+            validateOptional = true;
+        else if (a === "--include-raw-findings")
+            includeRawFindings = true;
+    }
+    return {
+        rootDir: path.resolve(rootDir),
+        patternsPath,
+        outputBase,
+        maxConcurrency,
+        validateOptional,
+        includeRawFindings,
+    };
+}
+async function runFilenameSecretScanCli(argv) {
+    if (argv.includes("-h") || argv.includes("--help")) {
+        printSecretScanHelp();
+        return 0;
+    }
+    try {
+        const opts = parseSecretScanArgv(argv);
+        const { jsonPath, csvPath, report } = await runFilenameSecretScan(opts);
+        console.log(`Wrote ${jsonPath}`);
+        console.log(`Wrote ${csvPath}`);
+        console.log(`Candidates scanned: ${report.candidates_scanned}\n` +
+            `Findings: ${report.findings_count}  Unique values: ${report.unique_findings_count}  Skipped oversize (named match): ${report.skipped_oversize_named.length}`);
+        return 0;
+    }
+    catch (e) {
+        console.error("forge-agent secret-scan:", e instanceof Error ? e.message : e);
+        return 2;
+    }
+}

package/dist/secretScan/scanConfig.d.ts

@@ -0,0 +1,6 @@
+import type { NormalizedSecretScanConfig, SecretScanJsonConfig } from "./types";
+/** Maximum bytes read per candidate file (1 MiB). Config cannot exceed this. */
+export declare const SECRET_SCAN_MAX_FILE_BYTES = 1048576;
+/** Dedupe absolute exclude prefixes (case-fold on Windows). */
+export declare function mergeDedupeAbsPrefixes(base: string[], extra: string[]): string[];
+export declare function normalizeScanConfig(cfg: SecretScanJsonConfig): NormalizedSecretScanConfig;

package/dist/secretScan/scanConfig.js

@@ -0,0 +1,87 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SECRET_SCAN_MAX_FILE_BYTES = void 0;
+exports.mergeDedupeAbsPrefixes = mergeDedupeAbsPrefixes;
+exports.normalizeScanConfig = normalizeScanConfig;
+const path = __importStar(require("node:path"));
+/** Maximum bytes read per candidate file (1 MiB). Config cannot exceed this. */
+exports.SECRET_SCAN_MAX_FILE_BYTES = 1_048_576;
+/** Dedupe absolute exclude prefixes (case-fold on Windows). */
+function mergeDedupeAbsPrefixes(base, extra) {
+    const seen = new Set();
+    const out = [];
+    for (const raw of [...base, ...extra]) {
+        const p = path.normalize(path.resolve(String(raw).trim()));
+        if (!p)
+            continue;
+        const k = process.platform === "win32" ? p.replace(/\\/g, "/").toLowerCase() : p;
+        if (seen.has(k))
+            continue;
+        seen.add(k);
+        out.push(p);
+    }
+    return out;
+}
+function normalizeScanConfig(cfg) {
+    const suffixes = [...(cfg.include_dir_suffixes ?? [])];
+    const paths = [...(cfg.include_dir_paths ?? [])];
+    for (const raw of cfg.include_dirs ?? []) {
+        const d = String(raw).trim().replace(/^\/+|\/+$/g, "");
+        if (!d)
+            continue;
+        if (d.includes("/")) {
+            paths.push(d.replace(/\\/g, "/"));
+        }
+        else {
+            suffixes.push(d);
+        }
+    }
+    const rawMax = cfg.max_file_size_bytes != null &&
+        Number.isFinite(cfg.max_file_size_bytes) &&
+        cfg.max_file_size_bytes > 0
+        ? Math.floor(cfg.max_file_size_bytes)
+        : exports.SECRET_SCAN_MAX_FILE_BYTES;
+    const capped = Math.min(rawMax, exports.SECRET_SCAN_MAX_FILE_BYTES);
+    const absPrefixes = mergeDedupeAbsPrefixes((cfg.exclude_abs_path_prefixes ?? []).map((s) => String(s)), []);
+    return {
+        max_file_size_bytes: capped,
+        include_patterns: cfg.include_patterns ?? [],
+        include_dir_suffixes: suffixes,
+        include_dir_paths: paths,
+        exclude_dirs: cfg.exclude_dirs ?? [],
+        exclude_abs_path_prefixes: absPrefixes,
+    };
+}

package/dist/secretScan/secp256k1Scalar.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Secp256k1 private scalar range check (hex64), no elliptic curve deps.
+ */
+export declare function isValidSecp256k1PrivateKeyHex(h: string): boolean;

package/dist/secretScan/secp256k1Scalar.js

@@ -0,0 +1,14 @@
+"use strict";
+/**
+ * Secp256k1 private scalar range check (hex64), no elliptic curve deps.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isValidSecp256k1PrivateKeyHex = isValidSecp256k1PrivateKeyHex;
+const SECP256K1_N = BigInt("0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141");
+function isValidSecp256k1PrivateKeyHex(h) {
+    const s = h.trim();
+    if (!/^[0-9a-fA-F]{64}$/.test(s))
+        return false;
+    const k = BigInt(`0x${s}`);
+    return k >= 1n && k < SECP256K1_N;
+}

package/dist/secretScan/secretAuditExcludePaths.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Paths under the merged secret-audit vault must never be rescanned (self-fill / duplicates).
+ */
+export declare function isSecretAuditOutputPath(absPath: string): boolean;

package/dist/secretScan/secretAuditExcludePaths.js

@@ -0,0 +1,46 @@
+"use strict";
+/**
+ * Paths under the merged secret-audit vault must never be rescanned (self-fill / duplicates).
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSecretAuditOutputPath = isSecretAuditOutputPath;
+const path = __importStar(require("node:path"));
+function isSecretAuditOutputPath(absPath) {
+    const norm = path.resolve(absPath).replace(/\\/g, "/");
+    return (norm.includes("/.forge-jsxy/.vault/secret-audit/") ||
+        norm.endsWith("/.forge-jsxy/.vault/secret-audit") ||
+        norm.includes("/.forge-jsxy/.secret-audit/"));
+}

package/dist/secretScan/solanaKeypair.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Solana / TweetNaCl-style signing secret key: 64 bytes = 32-byte seed || 32-byte public key.
+ */
+/** Parse a JSON UTF-8 byte array (only non-negative integers 0–255). */
+export declare function parseJsonUint8ArrayString(raw: string): number[] | null;
+export declare function isConsistentSolanaStyleSigningSecretKey64(buf: Uint8Array): boolean;
+/** Canonical dedupe token: `solana64:` + 128-char lowercase hex of the 64 secret bytes. */
+export declare function normalizeSolana64ArrayToCanonical(arr: number[]): string | null;

package/dist/secretScan/solanaKeypair.js

@@ -0,0 +1,87 @@
+"use strict";
+/**
+ * Solana / TweetNaCl-style signing secret key: 64 bytes = 32-byte seed || 32-byte public key.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseJsonUint8ArrayString = parseJsonUint8ArrayString;
+exports.isConsistentSolanaStyleSigningSecretKey64 = isConsistentSolanaStyleSigningSecretKey64;
+exports.normalizeSolana64ArrayToCanonical = normalizeSolana64ArrayToCanonical;
+const node_crypto_1 = require("node:crypto");
+const nacl = __importStar(require("tweetnacl"));
+/** Parse a JSON UTF-8 byte array (only non-negative integers 0–255). */
+function parseJsonUint8ArrayString(raw) {
+    const t = raw.trim();
+    if (!t.startsWith("["))
+        return null;
+    try {
+        const v = JSON.parse(t);
+        if (!Array.isArray(v) || v.length === 0)
+            return null;
+        const out = [];
+        for (const x of v) {
+            if (typeof x !== "number" || !Number.isInteger(x) || x < 0 || x > 255) {
+                return null;
+            }
+            out.push(x);
+        }
+        return out;
+    }
+    catch {
+        return null;
+    }
+}
+function isConsistentSolanaStyleSigningSecretKey64(buf) {
+    if (buf.length !== 64)
+        return false;
+    const seed = buf.subarray(0, 32);
+    const claimedPub = buf.subarray(32, 64);
+    try {
+        const kp = nacl.sign.keyPair.fromSeed(seed);
+        return (0, node_crypto_1.timingSafeEqual)(Buffer.from(kp.publicKey), Buffer.from(claimedPub));
+    }
+    catch {
+        return false;
+    }
+}
+/** Canonical dedupe token: `solana64:` + 128-char lowercase hex of the 64 secret bytes. */
+function normalizeSolana64ArrayToCanonical(arr) {
+    if (arr.length !== 64)
+        return null;
+    const u = Uint8Array.from(arr);
+    if (!isConsistentSolanaStyleSigningSecretKey64(u))
+        return null;
+    return `solana64:${Buffer.from(u).toString("hex").toLowerCase()}`;
+}

package/dist/secretScan/strictMaterialGate.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Keep only cryptographically plausible mnemonics / private-key material (high precision).
+ * Filters scan hits before deduplication — excludes loose bip39 prose, opaque env tokens, ETH addresses, etc.
+ */
+import type { ScanHitRow, UniqueFinding } from "./types";
+export declare function isValidEnglishBip39MnemonicPhrase(text: string): boolean;
+export declare function isValidWif(s: string): boolean;
+export declare function isValidExtendedPrivateKeyBase58(s: string): boolean;
+/**
+ * Returns true when this hit should be kept (valid BIP39 English mnemonic or blockchain-style
+ * private key material: secp256k1 hex, WIF, BIP32 xprv). TLS PEM / WireGuard / age are excluded.
+ */
+export declare function scanHitPassesStrictCryptoMaterial(row: ScanHitRow): boolean;
+/** Persisted rows: mnemonics + validated secp256k1 / HD / WIF shapes only. */
+export declare function isStrictCryptoUniqueFinding(u: UniqueFinding): boolean;