redac---n 0.0.0-stage → 0.0.2

package/dist/names.d.ts

@@ -0,0 +1,106 @@
+/** Every spelling of "password" (PASSWORD_LANGUAGES), and those of languages other than English. */
+export declare const PASSWORD_SPELLINGS: string[];
+export declare const FOREIGN_PASSWORD_SPELLINGS: string[];
+/** The words of a name in upper case: `clientSecret` → CLIENT, SECRET; `x-api-key` → X, API, KEY. */
+export declare function words(name: string): string[];
+/**
+ * Whether a name names a session or its ID, whoever's session it is: `INSTAGRAM_SESSION_ID`, `LINKEDIN_SESSION`,
+ * `tiktokSessionId`; not a terminal's or a desktop's (LOCAL_SESSION_OWNERS). Read so only in a secret file, which says
+ * its values are secrets: elsewhere a session's ID under another's name is as often a checkout's or an agent's
+ * (`CHECKOUT_SESSION_ID`, `CLAUDE_SESSION_ID`), and only the names isSessionIdName knows are credentials.
+ */
+export declare function namesSession(name: string): boolean;
+/**
+ * Whether a name's value may be a login, `user:password` or `user/password` (spans.ts loginPassword): by a word of
+ * LOGIN_WORDS, or Bundler's name for a host.
+ */
+export declare function namesLogin(name: string): boolean;
+/** File names' extensions, so a file name that holds a credential word (`has_key_spec.rb`) isn't one; never a qualifier (`.prod`, `.old`, `.value`, `.test`). */
+export declare const FILE_EXTENSION: RegExp;
+export declare const VENDOR_CLIENTS: Set<string>;
+/** Whether a name's value is a password: its last word names one (`DB_PASSWORD`, `adminpasswd`, `DB_WACHTWOORD`, `REDISPASS`, `mot_de_passe`). */
+export declare function isPasswordName(name: string): boolean;
+/**
+ * Whether a name's value may be an ordinary word and still be its secret: a password's, a PIN's, a pre-shared key's
+ * or a seed phrase's (`DB_PASSWORD=sunshine`, `pin: 4821`, `mnemonic: …`).
+ */
+export declare function takesAnyWord(name: string): boolean;
+/** Whether a name says its value is a password or a PIN, by any of its words (`DB_PASSWORD_HINT`, `PGPASSWORD`, `admin-pin`, `door_code`). */
+export declare function namesPasswordOrPin(name: string): boolean;
+/** A vendor's name alone, which holds that vendor's key: `deepgram`, `NGROK` (VENDORS). */
+export declare function isVendorName(name: string): boolean;
+/** A vendor's SDK or client by its name: `algoliasearch`, `Mailgun`, `TWILIO`, `twilio.Client` (a vendor's name, then a client word or nothing; not `imgurian`). */
+export declare function isVendorClient(name: string): boolean;
+/**
+ * A credential's word somewhere in a name, as a regex source for the readers' cheap prefilters (named.ts `NAME`,
+ * setter calls): every word CREDENTIAL_WORDS and CREDENTIAL_SUFFIX know, in lower case, so a word added there reaches
+ * them all; `sess` and `private` for `session_id` and `vapidPrivate`; and "password" as other languages spell it in a
+ * name, accents and all (`db_jelszó`, `DB_HASŁO`, `contraseña`), which CREDENTIAL_WORDS holds folded. A prefilter only:
+ * whether `pin` in `pinValue` or `spinner` is a credential's word is isCredentialName's (the readers' `i` flag leaves
+ * no way to tell a camel-case hump from a lower-case letter here).
+ */
+export declare const CREDENTIAL_WORD: string;
+/**
+ * A PIN's name: `PIN` among its words (`pin`, `door_pin`, `PIN_CODE`, `pinCode`, `pin_input`, `user_pin_value`; not a
+ * GPIO's or a certificate's pin, a setting about PINs, `PIN_TIMEOUT_MS`, `Pin-Priority`, nor a key or a secret a PIN
+ * qualifies, `PIN_ENCRYPTION_KEY`, whose own word decides), `PINCODE`, `PASSCODE` (not `PASSCODE_API_KEY`), or a code
+ * named for what it opens (`alarm_code`). namesPasswordOrPin, the name readers and the prose readers all ask this one.
+ */
+export declare function isPinName(name: string): boolean;
+export type NameClass = "credential" | "hash" | "identifier" | "neutral" | "public";
+/** What a name says, read once: its words, the meaningful ones, its last meaningful word (singular, undigited) and its class. */
+export interface Name {
+    words: string[];
+    /** The words without the qualifiers and encodings after the meaningful one: `DB_PASSWORD_PROD_B64` → DB, PASSWORD. */
+    core: string[];
+    /** The last core word, singular and without a version: `API_KEYS2` → KEY. */
+    last: string;
+    class: NameClass;
+}
+/**
+ * What a name says about its value:
+ * - credential: `api_key`, `X-Auth-Token`, `password`
+ * - hash: `sha256`, `commit`, `etag`, `integrity`, `nonce`, `cursor` (random but not secret)
+ * - identifier: `user_id`, `bucket`, `url`, `sort_key`
+ * - public: `public_key`, `NEXT_PUBLIC_*`, `publishable_key`
+ * - neutral: anything else (`data`, `value`, `X-Lumen`)
+ */
+export declare function readName(name: string): Name;
+/**
+ * A name a setting has, by its last word: `HOSTNAME`, `TZ`, `APP_URL`, `TENANT_ID`, `SMTP_LOGIN`, `SSH_AUTH_SOCK`,
+ * `TOKEN_ENDPOINT`, `PASSWORD_POLICY`. (Glued to a setting's word or an owner's, `HOSTNAME`, `DBHOST`; not `PAID`,
+ * `MY_TOKEN_VALID`, whose last word merely ends like one.) Where the context says every value is a secret (a secret
+ * file, the caller's environment), this is what says one isn't.
+ */
+export declare function isSettingName(name: string): boolean;
+/** Whether a name's value is a credential. */
+export declare function isCredentialName(name: string): boolean;
+export declare function nameClass(name: string): NameClass;
+export declare const isGenericName: (name: string) => boolean;
+/** Words that make a bare `key`/`token` after them a credential's (`api key`, `client secret`), with QUALIFIER_WORDS (`old key`) and vendors' names (`stripe key`); as an alternation, for the sentences that name a credential (named.ts). */
+export declare const CREDENTIAL_QUALIFIERS = "api|secret|access|private|auth|client|signing|encryption|master|app|license|licence|admin|root|bearer|session|refresh|service|deploy|personal|bot|webhook|account|user|integration|partner|consumer|shared|write|read|ingest|dev|prod|live|test|github|gitlab|aws|gcp|azure";
+/** Words that end a name's phrase in prose: determiners, pronouns, verbs and prepositions (`Here is the token`). */
+export declare const PHRASE_STOP: RegExp;
+/**
+ * The words just before a name, up to `max` (`next page` in `next page token:`), for readPhrase: none that are a pair's
+ * value (`msg=hello token=…`, `id=web-portal secret=…` in a log line) or follow a quote, nor a word that continues a
+ * token (`portal` in `web-portal`).
+ */
+export declare function phraseBefore(text: string, max: number): string[];
+/**
+ * A bare generic name (`key`, `token`, `secret`, `id`, `hash`) read with the prose words before it: `public key`,
+ * `next page token`, `old key`, `the search-only key`. The phrase starts after the last determiner, verb or
+ * preposition ("Here is the token" names a token); one that reads as another name (two words, then one) gives its
+ * class, and a credential word after a word that qualifies no credential (`cache warm key`) is a neutral one.
+ */
+export declare function readPhrase(before: string[], name: string): {
+    name: string;
+    class: NameClass;
+};
+/**
+ * Whether the name is a credential's, or a neutral name has a credential word that the word before doesn't rule out
+ * (`auth_header`, `api_key_header`; not `cache.key.prefix`, nor a file's name, `has_key.rb`).
+ */
+export declare function mentionsCredential(name: string): boolean;
+/** Whether any word of a name is a credential word that the word before doesn't rule out (`BASIC_AUTH`; not `CACHE_KEY`), whatever the name's class. */
+export declare function hasCredentialWord(name: string): boolean;