stageflow 0.25.0 → 0.27.0

package/dist/logging/namedSecrets.js

@@ -0,0 +1,58 @@
+import { readFileSync } from "node:fs";
+import path from "node:path";
+let registry = [];
+export const REDACTION_SECRETS_FILENAME = "redaction-secrets.json";
+export function registerNamedSecrets(secrets) {
+    const next = [...registry];
+    for (const secret of secrets) {
+        const idx = next.findIndex((s) => s.name === secret.name);
+        if (idx >= 0)
+            next[idx] = secret;
+        else
+            next.push(secret);
+    }
+    registry = next;
+}
+export function clearNamedSecretsForTests() {
+    registry = [];
+}
+export function getNamedSecrets() {
+    return registry;
+}
+export function loadNamedSecretsFromAttemptDir(attemptDir) {
+    const filePath = path.join(attemptDir, REDACTION_SECRETS_FILENAME);
+    let raw;
+    try {
+        raw = readFileSync(filePath, "utf8");
+    }
+    catch (err) {
+        const code = err.code;
+        if (code === "ENOENT")
+            return;
+        throw err;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return;
+    }
+    if (!Array.isArray(parsed))
+        return;
+    const secrets = [];
+    for (const item of parsed) {
+        if (item !== null &&
+            typeof item === "object" &&
+            typeof item.name === "string" &&
+            typeof item.value === "string") {
+            secrets.push({
+                name: item.name,
+                value: item.value,
+            });
+        }
+    }
+    if (secrets.length > 0) {
+        registerNamedSecrets(secrets);
+    }
+}

package/dist/logging/redact.d.ts

@@ -0,0 +1,13 @@
+export type NamedSecret = {
+    name: string;
+    value: string;
+};
+export type RedactOptions = {
+    patterns?: RegExp[];
+    knownSecrets?: readonly string[];
+    namedSecrets?: readonly NamedSecret[];
+};
+export declare function shouldRegisterValue(value: string): boolean;
+export declare function redactString(text: string, options?: RedactOptions): string;
+export declare function redact<T extends Record<string, unknown>>(record: T, options?: RedactOptions): T;
+export declare function stripUrlUserinfo(url: string): string;

package/dist/logging/redact.js

@@ -0,0 +1,88 @@
+import { COMMON_WORDS } from "./commonWords.js";
+const SECRET_PATTERNS = [
+    /\bsk-[A-Za-z0-9_-]{16,}\b/g,
+    /\bghp_[A-Za-z0-9]{20,}\b/g,
+    /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,
+    /\bBearer\s+[A-Za-z0-9\-._~+/]+=*/gi,
+    /\b[A-Za-z_]*KEY[A-Za-z_]*\s*[:=]\s*['"]?[A-Za-z0-9+/_-]{16,}['"]?/gi,
+];
+const REDACTED = "[redacted]";
+export function shouldRegisterValue(value) {
+    if (value.length < 8)
+        return false;
+    const lower = value.toLowerCase();
+    if (COMMON_WORDS.has(lower))
+        return false;
+    return true;
+}
+function markerFor(name) {
+    return name !== undefined && name.length > 0
+        ? `[redacted:${name}]`
+        : REDACTED;
+}
+function replaceAll(haystack, needle, replacement) {
+    if (needle.length === 0 || !haystack.includes(needle))
+        return haystack;
+    return haystack.split(needle).join(replacement);
+}
+function scrubString(value, patterns, knownSecrets, namedSecrets) {
+    let out = value;
+    for (const pattern of patterns) {
+        out = out.replace(pattern, REDACTED);
+    }
+    for (const named of namedSecrets) {
+        if (!shouldRegisterValue(named.value))
+            continue;
+        const marker = markerFor(named.name);
+        out = replaceAll(out, named.value, marker);
+        out = replaceAll(out, Buffer.from(named.value, "utf8").toString("base64"), marker);
+        out = replaceAll(out, encodeURIComponent(named.value), marker);
+    }
+    for (const secret of knownSecrets) {
+        if (secret.length === 0)
+            continue;
+        if (!out.includes(secret))
+            continue;
+        out = replaceAll(out, secret, REDACTED);
+    }
+    return out;
+}
+function scrubValue(value, patterns, knownSecrets, namedSecrets) {
+    if (typeof value === "string") {
+        return scrubString(value, patterns, knownSecrets, namedSecrets);
+    }
+    if (Array.isArray(value)) {
+        return value.map((item) => scrubValue(item, patterns, knownSecrets, namedSecrets));
+    }
+    if (value !== null && typeof value === "object") {
+        const out = {};
+        for (const [key, child] of Object.entries(value)) {
+            out[key] = scrubValue(child, patterns, knownSecrets, namedSecrets);
+        }
+        return out;
+    }
+    return value;
+}
+export function redactString(text, options = {}) {
+    return scrubString(text, options.patterns ?? SECRET_PATTERNS, options.knownSecrets ?? [], options.namedSecrets ?? []);
+}
+export function redact(record, options = {}) {
+    const patterns = options.patterns ?? SECRET_PATTERNS;
+    const knownSecrets = options.knownSecrets ?? [];
+    const namedSecrets = options.namedSecrets ?? [];
+    return scrubValue(record, patterns, knownSecrets, namedSecrets);
+}
+export function stripUrlUserinfo(url) {
+    try {
+        const parsed = new URL(url);
+        if (parsed.username || parsed.password) {
+            parsed.username = "";
+            parsed.password = "";
+            return parsed.toString();
+        }
+        return url;
+    }
+    catch {
+        return url.replace(/\/\/([^/@]+)@/g, "//");
+    }
+}