Initial Commit

openspec/archive/2026-04-19-enterprise-security-codes/proposal.md

@@ -0,0 +1,36 @@
+# OpenSpec Change: enterprise-security-codes
+
+- **Change ID**: enterprise-security-codes
+- **Package**: `@suaveplan/security-codes`
+- **Category**: universal
+- **Target path**: `universal/auth/security-codes`
+- **Status**: PROPOSED
+- **Date**: 2026-04-19
+- **Reference spec**: `/mnt/s/web/suaveplan/enterprise/security-codes.md`
+
+## Summary
+Greenfield rebuild of `@suaveplan/security-codes` — detects and sanitises sensitive security-code leakage in strings (API keys, JWTs, credit cards, GitHub tokens, Stripe keys, SSH keys, PEM blocks, AWS access keys, etc.) with a pluggable detector and a redactor producing structured, reversible or one-way masks.
+
+## Current-state audit (genesis)
+Package does not exist yet — fresh build.
+
+## Dependencies
+- Workspace: none (leaf)
+- External (via catalog): `zod` → `catalog:forms`; `tslib` → `catalog:build`; `@opentelemetry/api` → `catalog:observability`
+- Dev (via catalog): `vitest`, `@vitest/coverage-istanbul`, `fast-check`, `mitata` → `catalog:testing`
+
+## Preserved public surface
+- `SecurityCodeDetector` — `detect(input, options?): SecurityCodeMatch[]`
+- `SecurityCodeSanitizer` — `sanitize(input, options?): { output, matches }`
+- Type exports: `SecurityCodeMatch`, `SecurityCodeType`, `DetectorOptions`, `SanitizerOptions`, `MaskingStrategy`
+- Built-in detectors: AWS access key, JWT, credit card (Luhn-validated), GitHub classic/fine-grained PAT, Stripe secret/publishable, Google API key, OpenAI `sk-…`, PEM block, SSH key, generic high-entropy string heuristic
+
+## New genesis additions
+- Codes: `SECURITY_CODES.DETECTION_FAILED`, `SECURITY_CODES.INVALID_PATTERN`, `SECURITY_CODES.SANITIZATION_FAILED`.
+- Zod schemas for `DetectorOptions`, `SanitizerOptions`, `SecurityCodeMatch`.
+- OTel counter `security_codes.detect.total{type}`, histogram `security_codes.detect.duration_ms`.
+- Property tests: sanitise twice is idempotent; detect→sanitise→detect yields zero remaining matches for masked outputs.
+
+## Impact
+- Adds one new package: `universal/auth/security-codes`
+- Adds one new spec capability: `security-codes`