{"version":3,"file":"securityScan.js","names":[],"sources":["esm/cli/securityScan.js"],"sourcesContent":["import { readdir, readFile } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nconst SECRET_PATTERNS = [\n // api tokens / keys with known prefixes\n [\"Anthropic API key\", /sk-ant-[A-Za-z0-9_-]{20,}/g],\n [\"OpenAI API key\", /sk-proj-[A-Za-z0-9_-]{20,}/g],\n [\"Stripe secret key\", /sk_live_[A-Za-z0-9]{20,}/g],\n [\"Stripe webhook secret\", /whsec_[A-Za-z0-9]{20,}/g],\n [\"GitHub token\", /gh[ps]_[A-Za-z0-9]{36,}/g],\n [\"GitHub PAT\", /github_pat_[A-Za-z0-9_]{20,}/g],\n [\"AWS access key\", /(? {\n if (safeStrings.has(match)) return true;\n return safeRegexes.some((p) => p.test(match));\n };\n}\nasync function collectJSFiles(dir) {\n const files = [];\n async function walk(currentDir) {\n let entries;\n try {\n entries = await readdir(currentDir, { withFileTypes: true });\n } catch {\n return;\n }\n for (const entry of entries) {\n const fullPath = join(currentDir, entry.name);\n if (entry.isDirectory()) {\n await walk(fullPath);\n } else if (entry.name.endsWith(\".js\")) {\n files.push(fullPath);\n }\n }\n }\n await walk(dir);\n return files;\n}\nasync function scanBundleForSecrets(distDir, userSafePatterns) {\n const isSafe = createSafeMatcher(userSafePatterns);\n const files = await collectJSFiles(distDir);\n const findings = [];\n for (const fullPath of files) {\n const relativePath = fullPath.slice(distDir.length + 1);\n let content;\n try {\n content = await readFile(fullPath, \"utf-8\");\n } catch {\n continue;\n }\n for (const [label, pattern] of SECRET_PATTERNS) {\n pattern.lastIndex = 0;\n let match;\n while ((match = pattern.exec(content)) !== null) {\n const matched = match[0];\n if (isSafe(matched)) continue;\n const beforeMatch = content.slice(0, match.index);\n const line = (beforeMatch.match(/\\n/g)?.length ?? 0) + 1;\n findings.push({\n file: relativePath,\n label,\n match: matched.length > 40 ? `${matched.slice(0, 20)}...${matched.slice(-10)}` : matched,\n line\n });\n }\n }\n }\n return { clean: findings.length === 0, findings };\n}\nasync function runSecurityScan(clientDir, level, safePatterns) {\n console.info(`\n \\u{1F512} scanning client bundles for leaked secrets...\n`);\n const { clean, findings } = await scanBundleForSecrets(clientDir, safePatterns);\n if (clean) {\n console.info(`\n \\u{1F512} security scan passed \\u2014 no secrets found\n`);\n return true;\n }\n const icon = level === \"error\" ? \"\\u{1F6A8}\" : \"\\u26A0\\uFE0F\";\n const header = level === \"error\" ? `${icon} ${findings.length} secret(s) leaked into client bundle:` : `${icon} ${findings.length} potential secret(s) found in client bundle:`;\n console.error(`\n ${header}\n`);\n for (const f of findings) {\n console.error(` ${f.label}`);\n console.error(` file: ${f.file}:${f.line}`);\n console.error(` match: ${f.match}\n`);\n }\n if (level === \"error\") {\n console.error(\n ` Set build.securityScan to 'warn' to continue building despite findings.\n`\n );\n return false;\n }\n console.warn(\n ` Set build.securityScan to 'error' to fail builds when secrets are detected.\n`\n );\n return true;\n}\nexport {\n runSecurityScan,\n scanBundleForSecrets\n};\n//# sourceMappingURL=securityScan.js.map\n"],"mappings":";;;;AAEA,MAAM,kBAAkB;CAEtB,CAAC,qBAAqB,4BAA4B;CAClD,CAAC,kBAAkB,6BAA6B;CAChD,CAAC,qBAAqB,2BAA2B;CACjD,CAAC,yBAAyB,yBAAyB;CACnD,CAAC,gBAAgB,0BAA0B;CAC3C,CAAC,cAAc,+BAA+B;CAC9C,CAAC,kBAAkB,kDAAkD;CACrE,CACE,yBACA,+DACF;CACA,CAAC,2BAA2B,uCAAuC;CACnE,CACE,6BACA,0EACF;CAEA,CAAC,4BAA4B,iDAAiD;CAC9E,CAAC,+BAA+B,oDAAoD;CACpF,CAAC,2BAA2B,gDAAgD;AAC9E;AACA,MAAM,6BAA6B,IAAI,IAAI;CACzC;CACA;CAEA;AAEF,CAAC;AACD,MAAM,wBAAwB;CAC5B;CACA;CACA;CAEA;CAEA;AAEF;AACA,SAAS,kBAAkB,cAAc;CACvC,MAAM,cAAc,IAAI,IAAI,UAAU;CACtC,MAAM,cAAc,CAAC,GAAG,qBAAqB;CAC7C,IAAI,cAAc;EAChB,KAAK,MAAM,KAAK,cAAc;GAC5B,IAAI,OAAO,MAAM,UAAU;IACzB,YAAY,IAAI,CAAC;GACnB,OAAO;IACL,YAAY,KAAK,CAAC;GACpB;EACF;CACF;CACA,QAAQ,UAAU;EAChB,IAAI,YAAY,IAAI,KAAK,GAAG,OAAO;EACnC,OAAO,YAAY,MAAM,MAAM,EAAE,KAAK,KAAK,CAAC;CAC9C;AACF;AACA,eAAe,eAAe,KAAK;CACjC,MAAM,QAAQ,CAAC;CACf,eAAe,KAAK,YAAY;EAC9B,IAAI;EACJ,IAAI;GACF,UAAU,MAAM,QAAQ,YAAY,EAAE,eAAe,KAAK,CAAC;EAC7D,QAAQ;GACN;EACF;EACA,KAAK,MAAM,SAAS,SAAS;GAC3B,MAAM,WAAW,KAAK,YAAY,MAAM,IAAI;GAC5C,IAAI,MAAM,YAAY,GAAG;IACvB,MAAM,KAAK,QAAQ;GACrB,OAAO,IAAI,MAAM,KAAK,SAAS,KAAK,GAAG;IACrC,MAAM,KAAK,QAAQ;GACrB;EACF;CACF;CACA,MAAM,KAAK,GAAG;CACd,OAAO;AACT;AACA,eAAe,qBAAqB,SAAS,kBAAkB;CAC7D,MAAM,SAAS,kBAAkB,gBAAgB;CACjD,MAAM,QAAQ,MAAM,eAAe,OAAO;CAC1C,MAAM,WAAW,CAAC;CAClB,KAAK,MAAM,YAAY,OAAO;EAC5B,MAAM,eAAe,SAAS,MAAM,QAAQ,SAAS,CAAC;EACtD,IAAI;EACJ,IAAI;GACF,UAAU,MAAM,SAAS,UAAU,OAAO;EAC5C,QAAQ;GACN;EACF;EACA,KAAK,MAAM,CAAC,OAAO,YAAY,iBAAiB;GAC9C,QAAQ,YAAY;GACpB,IAAI;GACJ,QAAQ,QAAQ,QAAQ,KAAK,OAAO,OAAO,MAAM;IAC/C,MAAM,UAAU,MAAM;IACtB,IAAI,OAAO,OAAO,GAAG;IACrB,MAAM,cAAc,QAAQ,MAAM,GAAG,MAAM,KAAK;IAChD,MAAM,QAAQ,YAAY,MAAM,KAAK,CAAC,EAAE,UAAU,KAAK;IACvD,SAAS,KAAK;KACZ,MAAM;KACN;KACA,OAAO,QAAQ,SAAS,KAAK,GAAG,QAAQ,MAAM,GAAG,EAAE,EAAE,KAAK,QAAQ,MAAM,CAAC,EAAE,MAAM;KACjF;IACF,CAAC;GACH;EACF;CACF;CACA,OAAO;EAAE,OAAO,SAAS,WAAW;EAAG;CAAS;AAClD;AACA,eAAe,gBAAgB,WAAW,OAAO,cAAc;CAC7D,QAAQ,KAAK;;CAEd;CACC,MAAM,EAAE,OAAO,aAAa,MAAM,qBAAqB,WAAW,YAAY;CAC9E,IAAI,OAAO;EACT,QAAQ,KAAK;;CAEhB;EACG,OAAO;CACT;CACA,MAAM,OAAO,UAAU,UAAU,OAAc;CAC/C,MAAM,SAAS,UAAU,UAAU,GAAG,KAAK,GAAG,SAAS,OAAO,yCAAyC,GAAG,KAAK,GAAG,SAAS,OAAO;CAClI,QAAQ,MAAM;GACb,OAAO;CACT;CACC,KAAK,MAAM,KAAK,UAAU;EACxB,QAAQ,MAAM,MAAM,EAAE,OAAO;EAC7B,QAAQ,MAAM,cAAc,EAAE,KAAK,GAAG,EAAE,MAAM;EAC9C,QAAQ,MAAM,eAAe,EAAE,MAAM;CACxC;CACC;CACA,IAAI,UAAU,SAAS;EACrB,QAAQ,MACN;CAEF;EACA,OAAO;CACT;CACA,QAAQ,KACN;CAEF;CACA,OAAO;AACT"}