@agent-inspect/redact 2.0.0

package/dist/index.cjs

@@ -0,0 +1,396 @@
+'use strict';
+
+var crypto = require('crypto');
+
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
+
+var crypto__default = /*#__PURE__*/_interopDefault(crypto);
+
+// packages/redact/src/index.ts
+var DEFAULT_REDACT_KEYS = [
+  "authorization",
+  "cookie",
+  "token",
+  "apiKey",
+  "password",
+  "secret",
+  "email"
+];
+var SHARE_PROFILE_EXTRA_KEYS = [
+  "userEmail",
+  "customerEmail",
+  "phone",
+  "phoneNumber",
+  "address",
+  "ip",
+  "ipAddress",
+  "sessionId",
+  "requestId",
+  "correlationId",
+  "decisionId",
+  "groupId",
+  "customerId",
+  "userId",
+  "accountId",
+  "tenantId",
+  "orgId",
+  "organizationId",
+  "traceId",
+  "spanId",
+  "parentSpanId"
+];
+var STRICT_PROFILE_EXTRA_KEYS = [
+  "prompt",
+  "completion",
+  "input",
+  "output",
+  "inputPreview",
+  "outputPreview",
+  "message",
+  "messages",
+  "transcript",
+  "context",
+  "document",
+  "documents",
+  "chunk",
+  "chunks",
+  "retrieval",
+  "query"
+];
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function toKey(key) {
+  return key.toLowerCase();
+}
+function stableHash(value) {
+  const hash = crypto__default.default.createHash("sha256").update(value, "utf8").digest("hex");
+  return hash.slice(0, 8);
+}
+function stringifyScalar(value) {
+  if (typeof value === "string") return value;
+  if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
+    return String(value);
+  }
+  return void 0;
+}
+function patternDetector(options) {
+  return {
+    id: options.id,
+    severity: options.severity ?? "warning",
+    matchKind: "value",
+    detect(input) {
+      if (typeof input.value !== "string") return [];
+      options.pattern.lastIndex = 0;
+      return options.pattern.test(input.value) ? [{ action: "replace", severity: options.severity ?? "warning", matchKind: "value" }] : [];
+    }
+  };
+}
+function digitsOnly(value) {
+  return value.replace(/\D/g, "");
+}
+function passesLuhn(value) {
+  const digits = digitsOnly(value);
+  if (digits.length < 13 || digits.length > 19) return false;
+  let sum = 0;
+  let double = false;
+  for (let i = digits.length - 1; i >= 0; i -= 1) {
+    let digit = Number(digits[i]);
+    if (double) {
+      digit *= 2;
+      if (digit > 9) digit -= 9;
+    }
+    sum += digit;
+    double = !double;
+  }
+  return sum % 10 === 0;
+}
+var credentialDetectors = [
+  patternDetector({
+    id: "value.authorizationHeader",
+    pattern: /^(?:basic|bearer|digest|apikey)\s+[a-z0-9._~+/=-]+$/i,
+    severity: "error"
+  }),
+  patternDetector({
+    id: "value.bearerToken",
+    pattern: /\bbearer\s+[a-z0-9._~+/=-]{12,}\b/i,
+    severity: "error"
+  }),
+  patternDetector({
+    id: "value.cookie",
+    pattern: /\b[a-z0-9_.-]+=[^;\s]+(?:;\s*[a-z0-9_.-]+=[^;\s]+)+/i,
+    severity: "error"
+  }),
+  patternDetector({
+    id: "value.jwt",
+    pattern: /\beyJ[a-zA-Z0-9_-]{8,}\.[a-zA-Z0-9_-]{8,}\.[a-zA-Z0-9_-]{8,}\b/,
+    severity: "error"
+  }),
+  patternDetector({
+    id: "value.providerApiKey",
+    pattern: /\b(?:sk-(?:proj-)?[a-zA-Z0-9_-]{16,}|sk-ant-[a-zA-Z0-9_-]{16,}|AIza[0-9A-Za-z_-]{20,})\b/,
+    severity: "error"
+  }),
+  patternDetector({
+    id: "value.githubToken",
+    pattern: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{20,}\b/,
+    severity: "error"
+  }),
+  patternDetector({
+    id: "value.awsAccessKey",
+    pattern: /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/,
+    severity: "error"
+  }),
+  patternDetector({
+    id: "value.privateKey",
+    pattern: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*-----END [A-Z ]*PRIVATE KEY-----/,
+    severity: "error"
+  }),
+  {
+    id: "value.creditCard",
+    severity: "error",
+    matchKind: "value",
+    detect(input) {
+      if (typeof input.value !== "string") return [];
+      const candidatePattern = /(?:\d[ -]?){13,19}/g;
+      for (const match of input.value.matchAll(candidatePattern)) {
+        const candidate = match[0] ?? "";
+        if (passesLuhn(candidate)) {
+          return [{ action: "replace", severity: "error", matchKind: "value" }];
+        }
+      }
+      return [];
+    }
+  }
+];
+var identifierDetectors = [
+  patternDetector({
+    id: "value.email",
+    pattern: /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/i
+  }),
+  patternDetector({
+    id: "value.phone",
+    pattern: /\b(?:\+\d{1,3}[\s.-]?)?(?:\(?\d{3}\)?[\s.-])\d{3}[\s.-]\d{4}\b/
+  }),
+  patternDetector({
+    id: "value.ipv4",
+    pattern: /\b(?:(?:25[0-5]|2[0-4]\d|1?\d?\d)\.){3}(?:25[0-5]|2[0-4]\d|1?\d?\d)\b/
+  }),
+  patternDetector({
+    id: "value.ipv6",
+    pattern: /\b(?:[0-9a-f]{1,4}:){2,7}[0-9a-f]{1,4}\b/i
+  })
+];
+function builtInDetectorsForProfile(profile) {
+  if (profile === "local") return credentialDetectors;
+  return [...credentialDetectors, ...identifierDetectors];
+}
+function compileRules(rules, extraKeys) {
+  const out = /* @__PURE__ */ new Map();
+  const set = (rule) => {
+    const key = toKey(rule.key);
+    out.set(key, { ...rule, key });
+  };
+  for (const key of DEFAULT_REDACT_KEYS) {
+    set({ key, strategy: "full" });
+  }
+  for (const key of extraKeys ?? []) {
+    if (typeof key === "string" && key.length > 0) {
+      set({ key, strategy: "full" });
+    }
+  }
+  for (const rule of rules ?? []) {
+    if (typeof rule === "string") {
+      set({ key: rule, strategy: "full" });
+      continue;
+    }
+    if (rule.strategy === "full") set({ key: rule.key, strategy: "full" });
+    if (rule.strategy === "hash") set({ key: rule.key, strategy: "hash" });
+    if (rule.strategy === "prefix") {
+      set({
+        key: rule.key,
+        strategy: "prefix",
+        keep: typeof rule.keep === "number" ? rule.keep : 8
+      });
+    }
+  }
+  return [...out.values()];
+}
+function actionForRule(rule) {
+  if (rule.strategy === "full") return "replace";
+  return rule.strategy;
+}
+function applyRule(rule, value, replacement) {
+  if (rule.strategy === "full") return replacement;
+  const asString = stringifyScalar(value);
+  if (rule.strategy === "prefix") {
+    if (asString === void 0) return replacement;
+    const keep = Math.max(0, Math.floor(rule.keep));
+    return asString.length <= keep ? `${asString}\u2026` : `${asString.slice(0, keep)}\u2026`;
+  }
+  if (rule.strategy === "hash") {
+    if (asString === void 0) return "[HASH:unknown]";
+    return `[HASH:${stableHash(asString)}]`;
+  }
+  return value;
+}
+function childPath(path, key) {
+  if (/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(key)) {
+    return path ? `${path}.${key}` : key;
+  }
+  return `${path || "$"}[${JSON.stringify(key)}]`;
+}
+function indexPath(path, index) {
+  return `${path || "$"}[${index}]`;
+}
+function makeFinding(path, detector, action, matchKind, severity = "warning", preview) {
+  return preview === void 0 ? { path, detector, action, severity, matchKind } : { path, detector, action, severity, matchKind, preview };
+}
+function createRedactionProfile(profile = "local") {
+  switch (profile) {
+    case "local":
+      return { profile: "local", extraKeys: [] };
+    case "share":
+      return {
+        profile: "share",
+        extraKeys: SHARE_PROFILE_EXTRA_KEYS,
+        maxMetadataValueLengthCap: 500,
+        maxPreviewLengthCap: 200
+      };
+    case "strict":
+      return {
+        profile: "strict",
+        extraKeys: [...SHARE_PROFILE_EXTRA_KEYS, ...STRICT_PROFILE_EXTRA_KEYS],
+        maxMetadataValueLengthCap: 200,
+        maxPreviewLengthCap: 80
+      };
+  }
+}
+var Redactor = class {
+  #rules;
+  #detectors;
+  #profile;
+  #replacement;
+  #maxDepth;
+  #collectFindings;
+  constructor(options) {
+    const resolved = createRedactionProfile(options?.profile ?? "local");
+    this.#profile = resolved.profile;
+    this.#rules = compileRules(options?.rules, [
+      ...resolved.extraKeys,
+      ...options?.extraKeys ?? []
+    ]);
+    this.#detectors = [
+      ...builtInDetectorsForProfile(this.#profile),
+      ...options?.detectors ?? []
+    ];
+    this.#replacement = options?.replacement ?? "[REDACTED]";
+    this.#maxDepth = options?.maxDepth ?? 32;
+    this.#collectFindings = options?.collectFindings ?? true;
+  }
+  redactValue(key, value) {
+    return this.#redactValue(value, key, key, 0, {
+      findings: [],
+      seen: /* @__PURE__ */ new WeakMap()
+    });
+  }
+  redactRecord(record) {
+    return this.redact(record).value;
+  }
+  redact(value) {
+    const state = {
+      findings: [],
+      seen: /* @__PURE__ */ new WeakMap()
+    };
+    const redacted = this.#redactValue(value, void 0, "$", 0, state);
+    return {
+      value: redacted,
+      findings: state.findings,
+      redacted: state.findings.some((finding) => finding.action !== "keep"),
+      profile: this.#profile
+    };
+  }
+  #recordFinding(state, finding) {
+    if (this.#collectFindings) state.findings.push(finding);
+  }
+  #redactValue(value, key, path, depth, state) {
+    if (depth > this.#maxDepth) {
+      this.#recordFinding(
+        state,
+        makeFinding(path, "structure.maxDepth", "truncate", "value", "warning")
+      );
+      return "[Truncated]";
+    }
+    if (key !== void 0) {
+      const rule = this.#rules.find((candidate) => candidate.key === toKey(key));
+      if (rule) {
+        this.#recordFinding(
+          state,
+          makeFinding(path, `key.${rule.key}`, actionForRule(rule), "key", "warning")
+        );
+        return applyRule(rule, value, this.#replacement);
+      }
+    }
+    for (const detector of this.#detectors) {
+      const detections = detector.detect({ path, key, value });
+      for (const detection of detections) {
+        const action = detection.action ?? "replace";
+        this.#recordFinding(
+          state,
+          makeFinding(
+            path,
+            detector.id,
+            action,
+            detection.matchKind ?? detector.matchKind ?? "custom",
+            detection.severity ?? detector.severity ?? "warning",
+            detection.preview
+          )
+        );
+        if (action !== "keep") {
+          return detection.replacement ?? this.#replacement;
+        }
+      }
+    }
+    if (Array.isArray(value)) {
+      if (state.seen.has(value)) return state.seen.get(value);
+      const out = [];
+      state.seen.set(value, out);
+      value.forEach((item, index) => {
+        out[index] = this.#redactValue(item, void 0, indexPath(path, index), depth + 1, state);
+      });
+      return out;
+    }
+    if (isRecord(value)) {
+      if (state.seen.has(value)) return state.seen.get(value);
+      const out = {};
+      state.seen.set(value, out);
+      for (const [entryKey, entryValue] of Object.entries(value)) {
+        out[entryKey] = this.#redactValue(
+          entryValue,
+          entryKey,
+          childPath(path === "$" ? "" : path, entryKey),
+          depth + 1,
+          state
+        );
+      }
+      return out;
+    }
+    return value;
+  }
+};
+function createRedactor(options) {
+  return new Redactor(options);
+}
+function redact(value, options) {
+  return createRedactor(options).redact(value);
+}
+
+exports.DEFAULT_REDACT_KEYS = DEFAULT_REDACT_KEYS;
+exports.Redactor = Redactor;
+exports.SHARE_PROFILE_EXTRA_KEYS = SHARE_PROFILE_EXTRA_KEYS;
+exports.STRICT_PROFILE_EXTRA_KEYS = STRICT_PROFILE_EXTRA_KEYS;
+exports.createRedactionProfile = createRedactionProfile;
+exports.createRedactor = createRedactor;
+exports.redact = redact;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"names":["crypto"],"mappings":";;;;;;;;;AA0EO,IAAM,mBAAA,GAAsB;AAAA,EACjC,eAAA;AAAA,EACA,QAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,UAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF;AAEO,IAAM,wBAAA,GAA2B;AAAA,EACtC,WAAA;AAAA,EACA,eAAA;AAAA,EACA,OAAA;AAAA,EACA,aAAA;AAAA,EACA,SAAA;AAAA,EACA,IAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,eAAA;AAAA,EACA,YAAA;AAAA,EACA,SAAA;AAAA,EACA,YAAA;AAAA,EACA,QAAA;AAAA,EACA,WAAA;AAAA,EACA,UAAA;AAAA,EACA,OAAA;AAAA,EACA,gBAAA;AAAA,EACA,SAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF;AAEO,IAAM,yBAAA,GAA4B;AAAA,EACvC,QAAA;AAAA,EACA,YAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,cAAA;AAAA,EACA,eAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA,YAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA,WAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,WAAA;AAAA,EACA;AACF;AAkBA,SAAS,SAAS,KAAA,EAAkD;AAClE,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E;AAEA,SAAS,MAAM,GAAA,EAAqB;AAClC,EAAA,OAAO,IAAI,WAAA,EAAY;AACzB;AAEA,SAAS,WAAW,KAAA,EAAuB;AACzC,EAAA,MAAM,IAAA,GAAOA,uBAAA,CAAO,UAAA,CAAW,QAAQ,CAAA,CAAE,OAAO,KAAA,EAAO,MAAM,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA;AAC3E,EAAA,OAAO,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,CAAC,CAAA;AACxB;AAEA,SAAS,gBAAgB,KAAA,EAAoC;AAC3D,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,KAAA;AACtC,EAAA,IAAI,OAAO,UAAU,QAAA,IAAY,OAAO,UAAU,SAAA,IAAa,OAAO,UAAU,QAAA,EAAU;AACxF,IAAA,OAAO,OAAO,KAAK,CAAA;AAAA,EACrB;AACA,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,gBAAgB,OAAA,EAAoD;AAC3E,EAAA,OAAO;AAAA,IACL,IAAI,OAAA,CAAQ,EAAA;AAAA,IACZ,QAAA,EAAU,QAAQ,QAAA,IAAY,SAAA;AAAA,IAC9B,SAAA,EAAW,OAAA;AAAA,IACX,OAAO,KAAA,EAAO;AACZ,MAAA,IAAI,OAAO,KAAA,CAAM,KAAA,KAAU,QAAA,SAAiB,EAAC;AAC7C,MAAA,OAAA,CAAQ,QAAQ,SAAA,GAAY,CAAA;AAC5B,MAAA,OAAO,QAAQ,OAAA,CAAQ,IAAA,CAAK,MAAM,KAAK,CAAA,GACnC,CAAC,EAAE,MAAA,EAAQ,SAAA,EAAW,QAAA,EAAU,QAAQ,QAAA,IAAY,SAAA,EAAW,WAAW,OAAA,EAAS,IACnF,EAAC;AAAA,IACP;AAAA,GACF;AACF;AAEA,SAAS,WAAW,KAAA,EAAuB;AACzC,EAAA,OAAO,KAAA,CAAM,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAChC;AAEA,SAAS,WAAW,KAAA,EAAwB;AAC1C,EAAA,MAAM,MAAA,GAAS,WAAW,KAAK,CAAA;AAC/B,EAAA,IAAI,OAAO,MAAA,GAAS,EAAA,IAAM,MAAA,CAAO,MAAA,GAAS,IAAI,OAAO,KAAA;AAErD,EAAA,IAAI,GAAA,GAAM,CAAA;AACV,EAAA,IAAI,MAAA,GAAS,KAAA;AACb,EAAA,KAAA,IAAS,IAAI,MAAA,CAAO,MAAA,GAAS,GAAG,CAAA,IAAK,CAAA,EAAG,KAAK,CAAA,EAAG;AAC9C,IAAA,IAAI,KAAA,GAAQ,MAAA,CAAO,MAAA,CAAO,CAAC,CAAC,CAAA;AAC5B,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,KAAA,IAAS,CAAA;AACT,MAAA,IAAI,KAAA,GAAQ,GAAG,KAAA,IAAS,CAAA;AAAA,IAC1B;AACA,IAAA,GAAA,IAAO,KAAA;AACP,IAAA,MAAA,GAAS,CAAC,MAAA;AAAA,EACZ;AACA,EAAA,OAAO,MAAM,EAAA,KAAO,CAAA;AACtB;AAEA,IAAM,mBAAA,GAAoD;AAAA,EACxD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,2BAAA;AAAA,IACJ,OAAA,EAAS,sDAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACX,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,mBAAA;AAAA,IACJ,OAAA,EAAS,oCAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACX,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,cAAA;AAAA,IACJ,OAAA,EAAS,sDAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACX,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,WAAA;AAAA,IACJ,OAAA,EAAS,gEAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACX,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,sBAAA;AAAA,IACJ,OAAA,EAAS,0FAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACX,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,mBAAA;AAAA,IACJ,OAAA,EAAS,+CAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACX,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,oBAAA;AAAA,IACJ,OAAA,EAAS,+BAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACX,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,kBAAA;AAAA,IACJ,OAAA,EAAS,2EAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACX,CAAA;AAAA,EACD;AAAA,IACE,EAAA,EAAI,kBAAA;AAAA,IACJ,QAAA,EAAU,OAAA;AAAA,IACV,SAAA,EAAW,OAAA;AAAA,IACX,OAAO,KAAA,EAAO;AACZ,MAAA,IAAI,OAAO,KAAA,CAAM,KAAA,KAAU,QAAA,SAAiB,EAAC;AAC7C,MAAA,MAAM,gBAAA,GAAmB,qBAAA;AACzB,MAAA,KAAA,MAAW,KAAA,IAAS,KAAA,CAAM,KAAA,CAAM,QAAA,CAAS,gBAAgB,CAAA,EAAG;AAC1D,QAAA,MAAM,SAAA,GAAY,KAAA,CAAM,CAAC,CAAA,IAAK,EAAA;AAC9B,QAAA,IAAI,UAAA,CAAW,SAAS,CAAA,EAAG;AACzB,UAAA,OAAO,CAAC,EAAE,MAAA,EAAQ,SAAA,EAAW,UAAU,OAAA,EAAS,SAAA,EAAW,SAAS,CAAA;AAAA,QACtE;AAAA,MACF;AACA,MAAA,OAAO,EAAC;AAAA,IACV;AAAA;AAEJ,CAAA;AAEA,IAAM,mBAAA,GAAoD;AAAA,EACxD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,aAAA;AAAA,IACJ,OAAA,EAAS;AAAA,GACV,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,aAAA;AAAA,IACJ,OAAA,EAAS;AAAA,GACV,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,YAAA;AAAA,IACJ,OAAA,EAAS;AAAA,GACV,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,YAAA;AAAA,IACJ,OAAA,EAAS;AAAA,GACV;AACH,CAAA;AAEA,SAAS,2BAA2B,OAAA,EAAyD;AAC3F,EAAA,IAAI,OAAA,KAAY,SAAS,OAAO,mBAAA;AAChC,EAAA,OAAO,CAAC,GAAG,mBAAA,EAAqB,GAAG,mBAAmB,CAAA;AACxD;AAEA,SAAS,YAAA,CACP,OACA,SAAA,EACgB;AAChB,EAAA,MAAM,GAAA,uBAAU,GAAA,EAA0B;AAE1C,EAAA,MAAM,GAAA,GAAM,CAAC,IAAA,KAAuB;AAClC,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA;AAC1B,IAAA,GAAA,CAAI,IAAI,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,KAAqB,CAAA;AAAA,EAC/C,CAAA;AAEA,EAAA,KAAA,MAAW,OAAO,mBAAA,EAAqB;AACrC,IAAA,GAAA,CAAI,EAAE,GAAA,EAAK,QAAA,EAAU,MAAA,EAAQ,CAAA;AAAA,EAC/B;AAEA,EAAA,KAAA,MAAW,GAAA,IAAO,SAAA,IAAa,EAAC,EAAG;AACjC,IAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,CAAI,SAAS,CAAA,EAAG;AAC7C,MAAA,GAAA,CAAI,EAAE,GAAA,EAAK,QAAA,EAAU,MAAA,EAAQ,CAAA;AAAA,IAC/B;AAAA,EACF;AAEA,EAAA,KAAA,MAAW,IAAA,IAAQ,KAAA,IAAS,EAAC,EAAG;AAC9B,IAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC5B,MAAA,GAAA,CAAI,EAAE,GAAA,EAAK,IAAA,EAAM,QAAA,EAAU,QAAQ,CAAA;AACnC,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,IAAA,CAAK,QAAA,KAAa,MAAA,EAAQ,GAAA,CAAI,EAAE,KAAK,IAAA,CAAK,GAAA,EAAK,QAAA,EAAU,MAAA,EAAQ,CAAA;AACrE,IAAA,IAAI,IAAA,CAAK,QAAA,KAAa,MAAA,EAAQ,GAAA,CAAI,EAAE,KAAK,IAAA,CAAK,GAAA,EAAK,QAAA,EAAU,MAAA,EAAQ,CAAA;AACrE,IAAA,IAAI,IAAA,CAAK,aAAa,QAAA,EAAU;AAC9B,MAAA,GAAA,CAAI;AAAA,QACF,KAAK,IAAA,CAAK,GAAA;AAAA,QACV,QAAA,EAAU,QAAA;AAAA,QACV,MAAM,OAAO,IAAA,CAAK,IAAA,KAAS,QAAA,GAAW,KAAK,IAAA,GAAO;AAAA,OACnD,CAAA;AAAA,IACH;AAAA,EACF;AAEA,EAAA,OAAO,CAAC,GAAG,GAAA,CAAI,MAAA,EAAQ,CAAA;AACzB;AAEA,SAAS,cAAc,IAAA,EAAqC;AAC1D,EAAA,IAAI,IAAA,CAAK,QAAA,KAAa,MAAA,EAAQ,OAAO,SAAA;AACrC,EAAA,OAAO,IAAA,CAAK,QAAA;AACd;AAEA,SAAS,SAAA,CACP,IAAA,EACA,KAAA,EACA,WAAA,EACS;AACT,EAAA,IAAI,IAAA,CAAK,QAAA,KAAa,MAAA,EAAQ,OAAO,WAAA;AAErC,EAAA,MAAM,QAAA,GAAW,gBAAgB,KAAK,CAAA;AACtC,EAAA,IAAI,IAAA,CAAK,aAAa,QAAA,EAAU;AAC9B,IAAA,IAAI,QAAA,KAAa,QAAW,OAAO,WAAA;AACnC,IAAA,MAAM,IAAA,GAAO,KAAK,GAAA,CAAI,CAAA,EAAG,KAAK,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC,CAAA;AAC9C,IAAA,OAAO,QAAA,CAAS,MAAA,IAAU,IAAA,GAAO,CAAA,EAAG,QAAQ,CAAA,MAAA,CAAA,GAAM,CAAA,EAAG,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,IAAI,CAAC,CAAA,MAAA,CAAA;AAAA,EAC9E;AAEA,EAAA,IAAI,IAAA,CAAK,aAAa,MAAA,EAAQ;AAC5B,IAAA,IAAI,QAAA,KAAa,QAAW,OAAO,gBAAA;AACnC,IAAA,OAAO,CAAA,MAAA,EAAS,UAAA,CAAW,QAAQ,CAAC,CAAA,CAAA,CAAA;AAAA,EACtC;AAEA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,SAAA,CAAU,MAAc,GAAA,EAAqB;AACpD,EAAA,IAAI,4BAAA,CAA6B,IAAA,CAAK,GAAG,CAAA,EAAG;AAC1C,IAAA,OAAO,IAAA,GAAO,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,GAAG,CAAA,CAAA,GAAK,GAAA;AAAA,EACnC;AACA,EAAA,OAAO,GAAG,IAAA,IAAQ,GAAG,IAAI,IAAA,CAAK,SAAA,CAAU,GAAG,CAAC,CAAA,CAAA,CAAA;AAC9C;AAEA,SAAS,SAAA,CAAU,MAAc,KAAA,EAAuB;AACtD,EAAA,OAAO,CAAA,EAAG,IAAA,IAAQ,GAAG,CAAA,CAAA,EAAI,KAAK,CAAA,CAAA,CAAA;AAChC;AAEA,SAAS,YACP,IAAA,EACA,QAAA,EACA,QACA,SAAA,EACA,QAAA,GAA8B,WAC9B,OAAA,EACkB;AAClB,EAAA,OAAO,OAAA,KAAY,MAAA,GACf,EAAE,IAAA,EAAM,UAAU,MAAA,EAAQ,QAAA,EAAU,SAAA,EAAU,GAC9C,EAAE,IAAA,EAAM,QAAA,EAAU,MAAA,EAAQ,QAAA,EAAU,WAAW,OAAA,EAAQ;AAC7D;AAEO,SAAS,sBAAA,CAAuB,UAA4B,OAAA,EAAmC;AACpG,EAAA,QAAQ,OAAA;AAAS,IACf,KAAK,OAAA;AACH,MAAA,OAAO,EAAE,OAAA,EAAS,OAAA,EAAS,SAAA,EAAW,EAAC,EAAE;AAAA,IAC3C,KAAK,OAAA;AACH,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,OAAA;AAAA,QACT,SAAA,EAAW,wBAAA;AAAA,QACX,yBAAA,EAA2B,GAAA;AAAA,QAC3B,mBAAA,EAAqB;AAAA,OACvB;AAAA,IACF,KAAK,QAAA;AACH,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,QAAA;AAAA,QACT,SAAA,EAAW,CAAC,GAAG,wBAAA,EAA0B,GAAG,yBAAyB,CAAA;AAAA,QACrE,yBAAA,EAA2B,GAAA;AAAA,QAC3B,mBAAA,EAAqB;AAAA,OACvB;AAAA;AAEN;AAEO,IAAM,WAAN,MAAe;AAAA,EACX,MAAA;AAAA,EACA,UAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,SAAA;AAAA,EACA,gBAAA;AAAA,EAET,YAAY,OAAA,EAA2B;AACrC,IAAA,MAAM,QAAA,GAAW,sBAAA,CAAuB,OAAA,EAAS,OAAA,IAAW,OAAO,CAAA;AACnE,IAAA,IAAA,CAAK,WAAW,QAAA,CAAS,OAAA;AACzB,IAAA,IAAA,CAAK,MAAA,GAAS,YAAA,CAAa,OAAA,EAAS,KAAA,EAAO;AAAA,MACzC,GAAG,QAAA,CAAS,SAAA;AAAA,MACZ,GAAI,OAAA,EAAS,SAAA,IAAa;AAAC,KAC5B,CAAA;AACD,IAAA,IAAA,CAAK,UAAA,GAAa;AAAA,MAChB,GAAG,0BAAA,CAA2B,IAAA,CAAK,QAAQ,CAAA;AAAA,MAC3C,GAAI,OAAA,EAAS,SAAA,IAAa;AAAC,KAC7B;AACA,IAAA,IAAA,CAAK,YAAA,GAAe,SAAS,WAAA,IAAe,YAAA;AAC5C,IAAA,IAAA,CAAK,SAAA,GAAY,SAAS,QAAA,IAAY,EAAA;AACtC,IAAA,IAAA,CAAK,gBAAA,GAAmB,SAAS,eAAA,IAAmB,IAAA;AAAA,EACtD;AAAA,EAEA,WAAA,CAAY,KAAa,KAAA,EAAyB;AAChD,IAAA,OAAO,IAAA,CAAK,YAAA,CAAa,KAAA,EAAO,GAAA,EAAK,KAAK,CAAA,EAAG;AAAA,MAC3C,UAAU,EAAC;AAAA,MACX,IAAA,sBAAU,OAAA;AAAyB,KACpC,CAAA;AAAA,EACH;AAAA,EAEA,aAAa,MAAA,EAA0D;AACrE,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,MAAM,CAAA,CAAE,KAAA;AAAA,EAC7B;AAAA,EAEA,OAAoB,KAAA,EAA8B;AAChD,IAAA,MAAM,KAAA,GAAwB;AAAA,MAC5B,UAAU,EAAC;AAAA,MACX,IAAA,sBAAU,OAAA;AAAyB,KACrC;AACA,IAAA,MAAM,WAAW,IAAA,CAAK,YAAA,CAAa,OAAO,MAAA,EAAW,GAAA,EAAK,GAAG,KAAK,CAAA;AAClE,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,QAAA;AAAA,MACP,UAAU,KAAA,CAAM,QAAA;AAAA,MAChB,QAAA,EAAU,MAAM,QAAA,CAAS,IAAA,CAAK,CAAC,OAAA,KAAY,OAAA,CAAQ,WAAW,MAAM,CAAA;AAAA,MACpE,SAAS,IAAA,CAAK;AAAA,KAChB;AAAA,EACF;AAAA,EAEA,cAAA,CAAe,OAAuB,OAAA,EAAiC;AACrE,IAAA,IAAI,IAAA,CAAK,gBAAA,EAAkB,KAAA,CAAM,QAAA,CAAS,KAAK,OAAO,CAAA;AAAA,EACxD;AAAA,EAEA,YAAA,CACE,KAAA,EACA,GAAA,EACA,IAAA,EACA,OACA,KAAA,EACS;AACT,IAAA,IAAI,KAAA,GAAQ,KAAK,SAAA,EAAW;AAC1B,MAAA,IAAA,CAAK,cAAA;AAAA,QACH,KAAA;AAAA,QACA,WAAA,CAAY,IAAA,EAAM,oBAAA,EAAsB,UAAA,EAAY,SAAS,SAAS;AAAA,OACxE;AACA,MAAA,OAAO,aAAA;AAAA,IACT;AAEA,IAAA,IAAI,QAAQ,MAAA,EAAW;AACrB,MAAA,MAAM,IAAA,GAAO,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,CAAC,cAAc,SAAA,CAAU,GAAA,KAAQ,KAAA,CAAM,GAAG,CAAC,CAAA;AACzE,MAAA,IAAI,IAAA,EAAM;AACR,QAAA,IAAA,CAAK,cAAA;AAAA,UACH,KAAA;AAAA,UACA,WAAA,CAAY,IAAA,EAAM,CAAA,IAAA,EAAO,IAAA,CAAK,GAAG,IAAI,aAAA,CAAc,IAAI,CAAA,EAAG,KAAA,EAAO,SAAS;AAAA,SAC5E;AACA,QAAA,OAAO,SAAA,CAAU,IAAA,EAAM,KAAA,EAAO,IAAA,CAAK,YAAY,CAAA;AAAA,MACjD;AAAA,IACF;AAEA,IAAA,KAAA,MAAW,QAAA,IAAY,KAAK,UAAA,EAAY;AACtC,MAAA,MAAM,aAAa,QAAA,CAAS,MAAA,CAAO,EAAE,IAAA,EAAM,GAAA,EAAK,OAAO,CAAA;AACvD,MAAA,KAAA,MAAW,aAAa,UAAA,EAAY;AAClC,QAAA,MAAM,MAAA,GAAS,UAAU,MAAA,IAAU,SAAA;AACnC,QAAA,IAAA,CAAK,cAAA;AAAA,UACH,KAAA;AAAA,UACA,WAAA;AAAA,YACE,IAAA;AAAA,YACA,QAAA,CAAS,EAAA;AAAA,YACT,MAAA;AAAA,YACA,SAAA,CAAU,SAAA,IAAa,QAAA,CAAS,SAAA,IAAa,QAAA;AAAA,YAC7C,SAAA,CAAU,QAAA,IAAY,QAAA,CAAS,QAAA,IAAY,SAAA;AAAA,YAC3C,SAAA,CAAU;AAAA;AACZ,SACF;AACA,QAAA,IAAI,WAAW,MAAA,EAAQ;AACrB,UAAA,OAAO,SAAA,CAAU,eAAe,IAAA,CAAK,YAAA;AAAA,QACvC;AAAA,MACF;AAAA,IACF;AAEA,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,MAAA,IAAI,KAAA,CAAM,KAAK,GAAA,CAAI,KAAK,GAAG,OAAO,KAAA,CAAM,IAAA,CAAK,GAAA,CAAI,KAAK,CAAA;AACtD,MAAA,MAAM,MAAiB,EAAC;AACxB,MAAA,KAAA,CAAM,IAAA,CAAK,GAAA,CAAI,KAAA,EAAO,GAAG,CAAA;AACzB,MAAA,KAAA,CAAM,OAAA,CAAQ,CAAC,IAAA,EAAM,KAAA,KAAU;AAC7B,QAAA,GAAA,CAAI,KAAK,CAAA,GAAI,IAAA,CAAK,YAAA,CAAa,IAAA,EAAM,MAAA,EAAW,SAAA,CAAU,IAAA,EAAM,KAAK,CAAA,EAAG,KAAA,GAAQ,CAAA,EAAG,KAAK,CAAA;AAAA,MAC1F,CAAC,CAAA;AACD,MAAA,OAAO,GAAA;AAAA,IACT;AAEA,IAAA,IAAI,QAAA,CAAS,KAAK,CAAA,EAAG;AACnB,MAAA,IAAI,KAAA,CAAM,KAAK,GAAA,CAAI,KAAK,GAAG,OAAO,KAAA,CAAM,IAAA,CAAK,GAAA,CAAI,KAAK,CAAA;AACtD,MAAA,MAAM,MAA+B,EAAC;AACtC,MAAA,KAAA,CAAM,IAAA,CAAK,GAAA,CAAI,KAAA,EAAO,GAAG,CAAA;AACzB,MAAA,KAAA,MAAW,CAAC,QAAA,EAAU,UAAU,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC1D,QAAA,GAAA,CAAI,QAAQ,IAAI,IAAA,CAAK,YAAA;AAAA,UACnB,UAAA;AAAA,UACA,QAAA;AAAA,UACA,SAAA,CAAU,IAAA,KAAS,GAAA,GAAM,EAAA,GAAK,MAAM,QAAQ,CAAA;AAAA,UAC5C,KAAA,GAAQ,CAAA;AAAA,UACR;AAAA,SACF;AAAA,MACF;AACA,MAAA,OAAO,GAAA;AAAA,IACT;AAEA,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEO,SAAS,eAAe,OAAA,EAAqC;AAClE,EAAA,OAAO,IAAI,SAAS,OAAO,CAAA;AAC7B;AAEO,SAAS,MAAA,CAAoB,OAAU,OAAA,EAA6C;AACzF,EAAA,OAAO,cAAA,CAAe,OAAO,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA;AAC7C","file":"index.cjs","sourcesContent":["import crypto from \"node:crypto\";\n\nexport type RedactionProfile = \"local\" | \"share\" | \"strict\";\n\nexport type RedactionAction = \"replace\" | \"hash\" | \"prefix\" | \"truncate\" | \"keep\";\n\nexport type RedactionSeverity = \"info\" | \"warning\" | \"error\";\n\nexport type RedactionMatchKind = \"key\" | \"value\" | \"custom\";\n\nexport type RedactionRule =\n  | string\n  | { key: string; strategy: \"full\" }\n  | { key: string; strategy: \"prefix\"; keep?: number }\n  | { key: string; strategy: \"hash\" };\n\nexport interface RedactionFinding {\n  path: string;\n  detector: string;\n  action: RedactionAction;\n  severity: RedactionSeverity;\n  matchKind: RedactionMatchKind;\n  preview?: string;\n}\n\nexport interface RedactionDetection {\n  action?: RedactionAction;\n  replacement?: unknown;\n  severity?: RedactionSeverity;\n  matchKind?: RedactionMatchKind;\n  preview?: string;\n}\n\nexport interface RedactionDetectorInput {\n  path: string;\n  key?: string;\n  value: unknown;\n}\n\nexport interface RedactionDetector {\n  id: string;\n  severity?: RedactionSeverity;\n  matchKind?: RedactionMatchKind;\n  detect(input: RedactionDetectorInput): RedactionDetection[];\n}\n\nexport interface RedactionResult<T = unknown> {\n  value: T;\n  findings: RedactionFinding[];\n  redacted: boolean;\n  profile: RedactionProfile;\n}\n\nexport interface ResolvedRedactionProfile {\n  profile: RedactionProfile;\n  extraKeys: readonly string[];\n  maxMetadataValueLengthCap?: number;\n  maxPreviewLengthCap?: number;\n}\n\nexport interface RedactOptions {\n  profile?: RedactionProfile;\n  detectors?: RedactionDetector[];\n  rules?: RedactionRule[];\n  replacement?: string;\n  maxDepth?: number;\n  maxStringLength?: number;\n  collectFindings?: boolean;\n}\n\nexport interface RedactorOptions extends RedactOptions {\n  extraKeys?: readonly string[];\n}\n\nexport const DEFAULT_REDACT_KEYS = [\n  \"authorization\",\n  \"cookie\",\n  \"token\",\n  \"apiKey\",\n  \"password\",\n  \"secret\",\n  \"email\",\n] as const;\n\nexport const SHARE_PROFILE_EXTRA_KEYS = [\n  \"userEmail\",\n  \"customerEmail\",\n  \"phone\",\n  \"phoneNumber\",\n  \"address\",\n  \"ip\",\n  \"ipAddress\",\n  \"sessionId\",\n  \"requestId\",\n  \"correlationId\",\n  \"decisionId\",\n  \"groupId\",\n  \"customerId\",\n  \"userId\",\n  \"accountId\",\n  \"tenantId\",\n  \"orgId\",\n  \"organizationId\",\n  \"traceId\",\n  \"spanId\",\n  \"parentSpanId\",\n] as const;\n\nexport const STRICT_PROFILE_EXTRA_KEYS = [\n  \"prompt\",\n  \"completion\",\n  \"input\",\n  \"output\",\n  \"inputPreview\",\n  \"outputPreview\",\n  \"message\",\n  \"messages\",\n  \"transcript\",\n  \"context\",\n  \"document\",\n  \"documents\",\n  \"chunk\",\n  \"chunks\",\n  \"retrieval\",\n  \"query\",\n] as const;\n\ntype CompiledRule =\n  | { key: string; strategy: \"full\" }\n  | { key: string; strategy: \"prefix\"; keep: number }\n  | { key: string; strategy: \"hash\" };\n\ninterface RedactionState {\n  findings: RedactionFinding[];\n  seen: WeakMap<object, unknown>;\n}\n\ninterface PatternDetectorOptions {\n  id: string;\n  pattern: RegExp;\n  severity?: RedactionSeverity;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction toKey(key: string): string {\n  return key.toLowerCase();\n}\n\nfunction stableHash(value: string): string {\n  const hash = crypto.createHash(\"sha256\").update(value, \"utf8\").digest(\"hex\");\n  return hash.slice(0, 8);\n}\n\nfunction stringifyScalar(value: unknown): string | undefined {\n  if (typeof value === \"string\") return value;\n  if (typeof value === \"number\" || typeof value === \"boolean\" || typeof value === \"bigint\") {\n    return String(value);\n  }\n  return undefined;\n}\n\nfunction patternDetector(options: PatternDetectorOptions): RedactionDetector {\n  return {\n    id: options.id,\n    severity: options.severity ?? \"warning\",\n    matchKind: \"value\",\n    detect(input) {\n      if (typeof input.value !== \"string\") return [];\n      options.pattern.lastIndex = 0;\n      return options.pattern.test(input.value)\n        ? [{ action: \"replace\", severity: options.severity ?? \"warning\", matchKind: \"value\" }]\n        : [];\n    },\n  };\n}\n\nfunction digitsOnly(value: string): string {\n  return value.replace(/\\D/g, \"\");\n}\n\nfunction passesLuhn(value: string): boolean {\n  const digits = digitsOnly(value);\n  if (digits.length < 13 || digits.length > 19) return false;\n\n  let sum = 0;\n  let double = false;\n  for (let i = digits.length - 1; i >= 0; i -= 1) {\n    let digit = Number(digits[i]);\n    if (double) {\n      digit *= 2;\n      if (digit > 9) digit -= 9;\n    }\n    sum += digit;\n    double = !double;\n  }\n  return sum % 10 === 0;\n}\n\nconst credentialDetectors: readonly RedactionDetector[] = [\n  patternDetector({\n    id: \"value.authorizationHeader\",\n    pattern: /^(?:basic|bearer|digest|apikey)\\s+[a-z0-9._~+/=-]+$/i,\n    severity: \"error\",\n  }),\n  patternDetector({\n    id: \"value.bearerToken\",\n    pattern: /\\bbearer\\s+[a-z0-9._~+/=-]{12,}\\b/i,\n    severity: \"error\",\n  }),\n  patternDetector({\n    id: \"value.cookie\",\n    pattern: /\\b[a-z0-9_.-]+=[^;\\s]+(?:;\\s*[a-z0-9_.-]+=[^;\\s]+)+/i,\n    severity: \"error\",\n  }),\n  patternDetector({\n    id: \"value.jwt\",\n    pattern: /\\beyJ[a-zA-Z0-9_-]{8,}\\.[a-zA-Z0-9_-]{8,}\\.[a-zA-Z0-9_-]{8,}\\b/,\n    severity: \"error\",\n  }),\n  patternDetector({\n    id: \"value.providerApiKey\",\n    pattern: /\\b(?:sk-(?:proj-)?[a-zA-Z0-9_-]{16,}|sk-ant-[a-zA-Z0-9_-]{16,}|AIza[0-9A-Za-z_-]{20,})\\b/,\n    severity: \"error\",\n  }),\n  patternDetector({\n    id: \"value.githubToken\",\n    pattern: /\\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{20,}\\b/,\n    severity: \"error\",\n  }),\n  patternDetector({\n    id: \"value.awsAccessKey\",\n    pattern: /\\b(?:AKIA|ASIA)[A-Z0-9]{16}\\b/,\n    severity: \"error\",\n  }),\n  patternDetector({\n    id: \"value.privateKey\",\n    pattern: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\\s\\S]*-----END [A-Z ]*PRIVATE KEY-----/,\n    severity: \"error\",\n  }),\n  {\n    id: \"value.creditCard\",\n    severity: \"error\",\n    matchKind: \"value\",\n    detect(input) {\n      if (typeof input.value !== \"string\") return [];\n      const candidatePattern = /(?:\\d[ -]?){13,19}/g;\n      for (const match of input.value.matchAll(candidatePattern)) {\n        const candidate = match[0] ?? \"\";\n        if (passesLuhn(candidate)) {\n          return [{ action: \"replace\", severity: \"error\", matchKind: \"value\" }];\n        }\n      }\n      return [];\n    },\n  },\n];\n\nconst identifierDetectors: readonly RedactionDetector[] = [\n  patternDetector({\n    id: \"value.email\",\n    pattern: /\\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\\.[A-Z]{2,}\\b/i,\n  }),\n  patternDetector({\n    id: \"value.phone\",\n    pattern: /\\b(?:\\+\\d{1,3}[\\s.-]?)?(?:\\(?\\d{3}\\)?[\\s.-])\\d{3}[\\s.-]\\d{4}\\b/,\n  }),\n  patternDetector({\n    id: \"value.ipv4\",\n    pattern: /\\b(?:(?:25[0-5]|2[0-4]\\d|1?\\d?\\d)\\.){3}(?:25[0-5]|2[0-4]\\d|1?\\d?\\d)\\b/,\n  }),\n  patternDetector({\n    id: \"value.ipv6\",\n    pattern: /\\b(?:[0-9a-f]{1,4}:){2,7}[0-9a-f]{1,4}\\b/i,\n  }),\n];\n\nfunction builtInDetectorsForProfile(profile: RedactionProfile): readonly RedactionDetector[] {\n  if (profile === \"local\") return credentialDetectors;\n  return [...credentialDetectors, ...identifierDetectors];\n}\n\nfunction compileRules(\n  rules?: RedactionRule[],\n  extraKeys?: readonly string[],\n): CompiledRule[] {\n  const out = new Map<string, CompiledRule>();\n\n  const set = (rule: CompiledRule) => {\n    const key = toKey(rule.key);\n    out.set(key, { ...rule, key } as CompiledRule);\n  };\n\n  for (const key of DEFAULT_REDACT_KEYS) {\n    set({ key, strategy: \"full\" });\n  }\n\n  for (const key of extraKeys ?? []) {\n    if (typeof key === \"string\" && key.length > 0) {\n      set({ key, strategy: \"full\" });\n    }\n  }\n\n  for (const rule of rules ?? []) {\n    if (typeof rule === \"string\") {\n      set({ key: rule, strategy: \"full\" });\n      continue;\n    }\n\n    if (rule.strategy === \"full\") set({ key: rule.key, strategy: \"full\" });\n    if (rule.strategy === \"hash\") set({ key: rule.key, strategy: \"hash\" });\n    if (rule.strategy === \"prefix\") {\n      set({\n        key: rule.key,\n        strategy: \"prefix\",\n        keep: typeof rule.keep === \"number\" ? rule.keep : 8,\n      });\n    }\n  }\n\n  return [...out.values()];\n}\n\nfunction actionForRule(rule: CompiledRule): RedactionAction {\n  if (rule.strategy === \"full\") return \"replace\";\n  return rule.strategy;\n}\n\nfunction applyRule(\n  rule: CompiledRule,\n  value: unknown,\n  replacement: string,\n): unknown {\n  if (rule.strategy === \"full\") return replacement;\n\n  const asString = stringifyScalar(value);\n  if (rule.strategy === \"prefix\") {\n    if (asString === undefined) return replacement;\n    const keep = Math.max(0, Math.floor(rule.keep));\n    return asString.length <= keep ? `${asString}…` : `${asString.slice(0, keep)}…`;\n  }\n\n  if (rule.strategy === \"hash\") {\n    if (asString === undefined) return \"[HASH:unknown]\";\n    return `[HASH:${stableHash(asString)}]`;\n  }\n\n  return value;\n}\n\nfunction childPath(path: string, key: string): string {\n  if (/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(key)) {\n    return path ? `${path}.${key}` : key;\n  }\n  return `${path || \"$\"}[${JSON.stringify(key)}]`;\n}\n\nfunction indexPath(path: string, index: number): string {\n  return `${path || \"$\"}[${index}]`;\n}\n\nfunction makeFinding(\n  path: string,\n  detector: string,\n  action: RedactionAction,\n  matchKind: RedactionMatchKind,\n  severity: RedactionSeverity = \"warning\",\n  preview?: string,\n): RedactionFinding {\n  return preview === undefined\n    ? { path, detector, action, severity, matchKind }\n    : { path, detector, action, severity, matchKind, preview };\n}\n\nexport function createRedactionProfile(profile: RedactionProfile = \"local\"): ResolvedRedactionProfile {\n  switch (profile) {\n    case \"local\":\n      return { profile: \"local\", extraKeys: [] };\n    case \"share\":\n      return {\n        profile: \"share\",\n        extraKeys: SHARE_PROFILE_EXTRA_KEYS,\n        maxMetadataValueLengthCap: 500,\n        maxPreviewLengthCap: 200,\n      };\n    case \"strict\":\n      return {\n        profile: \"strict\",\n        extraKeys: [...SHARE_PROFILE_EXTRA_KEYS, ...STRICT_PROFILE_EXTRA_KEYS],\n        maxMetadataValueLengthCap: 200,\n        maxPreviewLengthCap: 80,\n      };\n  }\n}\n\nexport class Redactor {\n  readonly #rules: CompiledRule[];\n  readonly #detectors: readonly RedactionDetector[];\n  readonly #profile: RedactionProfile;\n  readonly #replacement: string;\n  readonly #maxDepth: number;\n  readonly #collectFindings: boolean;\n\n  constructor(options?: RedactorOptions) {\n    const resolved = createRedactionProfile(options?.profile ?? \"local\");\n    this.#profile = resolved.profile;\n    this.#rules = compileRules(options?.rules, [\n      ...resolved.extraKeys,\n      ...(options?.extraKeys ?? []),\n    ]);\n    this.#detectors = [\n      ...builtInDetectorsForProfile(this.#profile),\n      ...(options?.detectors ?? []),\n    ];\n    this.#replacement = options?.replacement ?? \"[REDACTED]\";\n    this.#maxDepth = options?.maxDepth ?? 32;\n    this.#collectFindings = options?.collectFindings ?? true;\n  }\n\n  redactValue(key: string, value: unknown): unknown {\n    return this.#redactValue(value, key, key, 0, {\n      findings: [],\n      seen: new WeakMap<object, unknown>(),\n    });\n  }\n\n  redactRecord(record: Record<string, unknown>): Record<string, unknown> {\n    return this.redact(record).value as Record<string, unknown>;\n  }\n\n  redact<T = unknown>(value: T): RedactionResult<T> {\n    const state: RedactionState = {\n      findings: [],\n      seen: new WeakMap<object, unknown>(),\n    };\n    const redacted = this.#redactValue(value, undefined, \"$\", 0, state);\n    return {\n      value: redacted as T,\n      findings: state.findings,\n      redacted: state.findings.some((finding) => finding.action !== \"keep\"),\n      profile: this.#profile,\n    };\n  }\n\n  #recordFinding(state: RedactionState, finding: RedactionFinding): void {\n    if (this.#collectFindings) state.findings.push(finding);\n  }\n\n  #redactValue(\n    value: unknown,\n    key: string | undefined,\n    path: string,\n    depth: number,\n    state: RedactionState,\n  ): unknown {\n    if (depth > this.#maxDepth) {\n      this.#recordFinding(\n        state,\n        makeFinding(path, \"structure.maxDepth\", \"truncate\", \"value\", \"warning\"),\n      );\n      return \"[Truncated]\";\n    }\n\n    if (key !== undefined) {\n      const rule = this.#rules.find((candidate) => candidate.key === toKey(key));\n      if (rule) {\n        this.#recordFinding(\n          state,\n          makeFinding(path, `key.${rule.key}`, actionForRule(rule), \"key\", \"warning\"),\n        );\n        return applyRule(rule, value, this.#replacement);\n      }\n    }\n\n    for (const detector of this.#detectors) {\n      const detections = detector.detect({ path, key, value });\n      for (const detection of detections) {\n        const action = detection.action ?? \"replace\";\n        this.#recordFinding(\n          state,\n          makeFinding(\n            path,\n            detector.id,\n            action,\n            detection.matchKind ?? detector.matchKind ?? \"custom\",\n            detection.severity ?? detector.severity ?? \"warning\",\n            detection.preview,\n          ),\n        );\n        if (action !== \"keep\") {\n          return detection.replacement ?? this.#replacement;\n        }\n      }\n    }\n\n    if (Array.isArray(value)) {\n      if (state.seen.has(value)) return state.seen.get(value);\n      const out: unknown[] = [];\n      state.seen.set(value, out);\n      value.forEach((item, index) => {\n        out[index] = this.#redactValue(item, undefined, indexPath(path, index), depth + 1, state);\n      });\n      return out;\n    }\n\n    if (isRecord(value)) {\n      if (state.seen.has(value)) return state.seen.get(value);\n      const out: Record<string, unknown> = {};\n      state.seen.set(value, out);\n      for (const [entryKey, entryValue] of Object.entries(value)) {\n        out[entryKey] = this.#redactValue(\n          entryValue,\n          entryKey,\n          childPath(path === \"$\" ? \"\" : path, entryKey),\n          depth + 1,\n          state,\n        );\n      }\n      return out;\n    }\n\n    return value;\n  }\n}\n\nexport function createRedactor(options?: RedactorOptions): Redactor {\n  return new Redactor(options);\n}\n\nexport function redact<T = unknown>(value: T, options?: RedactOptions): RedactionResult<T> {\n  return createRedactor(options).redact(value);\n}\n"]}

package/dist/index.d.cts

@@ -0,0 +1,80 @@
+type RedactionProfile = "local" | "share" | "strict";
+type RedactionAction = "replace" | "hash" | "prefix" | "truncate" | "keep";
+type RedactionSeverity = "info" | "warning" | "error";
+type RedactionMatchKind = "key" | "value" | "custom";
+type RedactionRule = string | {
+    key: string;
+    strategy: "full";
+} | {
+    key: string;
+    strategy: "prefix";
+    keep?: number;
+} | {
+    key: string;
+    strategy: "hash";
+};
+interface RedactionFinding {
+    path: string;
+    detector: string;
+    action: RedactionAction;
+    severity: RedactionSeverity;
+    matchKind: RedactionMatchKind;
+    preview?: string;
+}
+interface RedactionDetection {
+    action?: RedactionAction;
+    replacement?: unknown;
+    severity?: RedactionSeverity;
+    matchKind?: RedactionMatchKind;
+    preview?: string;
+}
+interface RedactionDetectorInput {
+    path: string;
+    key?: string;
+    value: unknown;
+}
+interface RedactionDetector {
+    id: string;
+    severity?: RedactionSeverity;
+    matchKind?: RedactionMatchKind;
+    detect(input: RedactionDetectorInput): RedactionDetection[];
+}
+interface RedactionResult<T = unknown> {
+    value: T;
+    findings: RedactionFinding[];
+    redacted: boolean;
+    profile: RedactionProfile;
+}
+interface ResolvedRedactionProfile {
+    profile: RedactionProfile;
+    extraKeys: readonly string[];
+    maxMetadataValueLengthCap?: number;
+    maxPreviewLengthCap?: number;
+}
+interface RedactOptions {
+    profile?: RedactionProfile;
+    detectors?: RedactionDetector[];
+    rules?: RedactionRule[];
+    replacement?: string;
+    maxDepth?: number;
+    maxStringLength?: number;
+    collectFindings?: boolean;
+}
+interface RedactorOptions extends RedactOptions {
+    extraKeys?: readonly string[];
+}
+declare const DEFAULT_REDACT_KEYS: readonly ["authorization", "cookie", "token", "apiKey", "password", "secret", "email"];
+declare const SHARE_PROFILE_EXTRA_KEYS: readonly ["userEmail", "customerEmail", "phone", "phoneNumber", "address", "ip", "ipAddress", "sessionId", "requestId", "correlationId", "decisionId", "groupId", "customerId", "userId", "accountId", "tenantId", "orgId", "organizationId", "traceId", "spanId", "parentSpanId"];
+declare const STRICT_PROFILE_EXTRA_KEYS: readonly ["prompt", "completion", "input", "output", "inputPreview", "outputPreview", "message", "messages", "transcript", "context", "document", "documents", "chunk", "chunks", "retrieval", "query"];
+declare function createRedactionProfile(profile?: RedactionProfile): ResolvedRedactionProfile;
+declare class Redactor {
+    #private;
+    constructor(options?: RedactorOptions);
+    redactValue(key: string, value: unknown): unknown;
+    redactRecord(record: Record<string, unknown>): Record<string, unknown>;
+    redact<T = unknown>(value: T): RedactionResult<T>;
+}
+declare function createRedactor(options?: RedactorOptions): Redactor;
+declare function redact<T = unknown>(value: T, options?: RedactOptions): RedactionResult<T>;
+
+export { DEFAULT_REDACT_KEYS, type RedactOptions, type RedactionAction, type RedactionDetection, type RedactionDetector, type RedactionDetectorInput, type RedactionFinding, type RedactionMatchKind, type RedactionProfile, type RedactionResult, type RedactionRule, type RedactionSeverity, Redactor, type RedactorOptions, type ResolvedRedactionProfile, SHARE_PROFILE_EXTRA_KEYS, STRICT_PROFILE_EXTRA_KEYS, createRedactionProfile, createRedactor, redact };

package/dist/index.d.ts

@@ -0,0 +1,80 @@
+type RedactionProfile = "local" | "share" | "strict";
+type RedactionAction = "replace" | "hash" | "prefix" | "truncate" | "keep";
+type RedactionSeverity = "info" | "warning" | "error";
+type RedactionMatchKind = "key" | "value" | "custom";
+type RedactionRule = string | {
+    key: string;
+    strategy: "full";
+} | {
+    key: string;
+    strategy: "prefix";
+    keep?: number;
+} | {
+    key: string;
+    strategy: "hash";
+};
+interface RedactionFinding {
+    path: string;
+    detector: string;
+    action: RedactionAction;
+    severity: RedactionSeverity;
+    matchKind: RedactionMatchKind;
+    preview?: string;
+}
+interface RedactionDetection {
+    action?: RedactionAction;
+    replacement?: unknown;
+    severity?: RedactionSeverity;
+    matchKind?: RedactionMatchKind;
+    preview?: string;
+}
+interface RedactionDetectorInput {
+    path: string;
+    key?: string;
+    value: unknown;
+}
+interface RedactionDetector {
+    id: string;
+    severity?: RedactionSeverity;
+    matchKind?: RedactionMatchKind;
+    detect(input: RedactionDetectorInput): RedactionDetection[];
+}
+interface RedactionResult<T = unknown> {
+    value: T;
+    findings: RedactionFinding[];
+    redacted: boolean;
+    profile: RedactionProfile;
+}
+interface ResolvedRedactionProfile {
+    profile: RedactionProfile;
+    extraKeys: readonly string[];
+    maxMetadataValueLengthCap?: number;
+    maxPreviewLengthCap?: number;
+}
+interface RedactOptions {
+    profile?: RedactionProfile;
+    detectors?: RedactionDetector[];
+    rules?: RedactionRule[];
+    replacement?: string;
+    maxDepth?: number;
+    maxStringLength?: number;
+    collectFindings?: boolean;
+}
+interface RedactorOptions extends RedactOptions {
+    extraKeys?: readonly string[];
+}
+declare const DEFAULT_REDACT_KEYS: readonly ["authorization", "cookie", "token", "apiKey", "password", "secret", "email"];
+declare const SHARE_PROFILE_EXTRA_KEYS: readonly ["userEmail", "customerEmail", "phone", "phoneNumber", "address", "ip", "ipAddress", "sessionId", "requestId", "correlationId", "decisionId", "groupId", "customerId", "userId", "accountId", "tenantId", "orgId", "organizationId", "traceId", "spanId", "parentSpanId"];
+declare const STRICT_PROFILE_EXTRA_KEYS: readonly ["prompt", "completion", "input", "output", "inputPreview", "outputPreview", "message", "messages", "transcript", "context", "document", "documents", "chunk", "chunks", "retrieval", "query"];
+declare function createRedactionProfile(profile?: RedactionProfile): ResolvedRedactionProfile;
+declare class Redactor {
+    #private;
+    constructor(options?: RedactorOptions);
+    redactValue(key: string, value: unknown): unknown;
+    redactRecord(record: Record<string, unknown>): Record<string, unknown>;
+    redact<T = unknown>(value: T): RedactionResult<T>;
+}
+declare function createRedactor(options?: RedactorOptions): Redactor;
+declare function redact<T = unknown>(value: T, options?: RedactOptions): RedactionResult<T>;
+
+export { DEFAULT_REDACT_KEYS, type RedactOptions, type RedactionAction, type RedactionDetection, type RedactionDetector, type RedactionDetectorInput, type RedactionFinding, type RedactionMatchKind, type RedactionProfile, type RedactionResult, type RedactionRule, type RedactionSeverity, Redactor, type RedactorOptions, type ResolvedRedactionProfile, SHARE_PROFILE_EXTRA_KEYS, STRICT_PROFILE_EXTRA_KEYS, createRedactionProfile, createRedactor, redact };

package/dist/index.mjs

@@ -0,0 +1,384 @@
+import crypto from 'crypto';
+
+// packages/redact/src/index.ts
+var DEFAULT_REDACT_KEYS = [
+  "authorization",
+  "cookie",
+  "token",
+  "apiKey",
+  "password",
+  "secret",
+  "email"
+];
+var SHARE_PROFILE_EXTRA_KEYS = [
+  "userEmail",
+  "customerEmail",
+  "phone",
+  "phoneNumber",
+  "address",
+  "ip",
+  "ipAddress",
+  "sessionId",
+  "requestId",
+  "correlationId",
+  "decisionId",
+  "groupId",
+  "customerId",
+  "userId",
+  "accountId",
+  "tenantId",
+  "orgId",
+  "organizationId",
+  "traceId",
+  "spanId",
+  "parentSpanId"
+];
+var STRICT_PROFILE_EXTRA_KEYS = [
+  "prompt",
+  "completion",
+  "input",
+  "output",
+  "inputPreview",
+  "outputPreview",
+  "message",
+  "messages",
+  "transcript",
+  "context",
+  "document",
+  "documents",
+  "chunk",
+  "chunks",
+  "retrieval",
+  "query"
+];
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function toKey(key) {
+  return key.toLowerCase();
+}
+function stableHash(value) {
+  const hash = crypto.createHash("sha256").update(value, "utf8").digest("hex");
+  return hash.slice(0, 8);
+}
+function stringifyScalar(value) {
+  if (typeof value === "string") return value;
+  if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
+    return String(value);
+  }
+  return void 0;
+}
+function patternDetector(options) {
+  return {
+    id: options.id,
+    severity: options.severity ?? "warning",
+    matchKind: "value",
+    detect(input) {
+      if (typeof input.value !== "string") return [];
+      options.pattern.lastIndex = 0;
+      return options.pattern.test(input.value) ? [{ action: "replace", severity: options.severity ?? "warning", matchKind: "value" }] : [];
+    }
+  };
+}
+function digitsOnly(value) {
+  return value.replace(/\D/g, "");
+}
+function passesLuhn(value) {
+  const digits = digitsOnly(value);
+  if (digits.length < 13 || digits.length > 19) return false;
+  let sum = 0;
+  let double = false;
+  for (let i = digits.length - 1; i >= 0; i -= 1) {
+    let digit = Number(digits[i]);
+    if (double) {
+      digit *= 2;
+      if (digit > 9) digit -= 9;
+    }
+    sum += digit;
+    double = !double;
+  }
+  return sum % 10 === 0;
+}
+var credentialDetectors = [
+  patternDetector({
+    id: "value.authorizationHeader",
+    pattern: /^(?:basic|bearer|digest|apikey)\s+[a-z0-9._~+/=-]+$/i,
+    severity: "error"
+  }),
+  patternDetector({
+    id: "value.bearerToken",
+    pattern: /\bbearer\s+[a-z0-9._~+/=-]{12,}\b/i,
+    severity: "error"
+  }),
+  patternDetector({
+    id: "value.cookie",
+    pattern: /\b[a-z0-9_.-]+=[^;\s]+(?:;\s*[a-z0-9_.-]+=[^;\s]+)+/i,
+    severity: "error"
+  }),
+  patternDetector({
+    id: "value.jwt",
+    pattern: /\beyJ[a-zA-Z0-9_-]{8,}\.[a-zA-Z0-9_-]{8,}\.[a-zA-Z0-9_-]{8,}\b/,
+    severity: "error"
+  }),
+  patternDetector({
+    id: "value.providerApiKey",
+    pattern: /\b(?:sk-(?:proj-)?[a-zA-Z0-9_-]{16,}|sk-ant-[a-zA-Z0-9_-]{16,}|AIza[0-9A-Za-z_-]{20,})\b/,
+    severity: "error"
+  }),
+  patternDetector({
+    id: "value.githubToken",
+    pattern: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{20,}\b/,
+    severity: "error"
+  }),
+  patternDetector({
+    id: "value.awsAccessKey",
+    pattern: /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/,
+    severity: "error"
+  }),
+  patternDetector({
+    id: "value.privateKey",
+    pattern: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*-----END [A-Z ]*PRIVATE KEY-----/,
+    severity: "error"
+  }),
+  {
+    id: "value.creditCard",
+    severity: "error",
+    matchKind: "value",
+    detect(input) {
+      if (typeof input.value !== "string") return [];
+      const candidatePattern = /(?:\d[ -]?){13,19}/g;
+      for (const match of input.value.matchAll(candidatePattern)) {
+        const candidate = match[0] ?? "";
+        if (passesLuhn(candidate)) {
+          return [{ action: "replace", severity: "error", matchKind: "value" }];
+        }
+      }
+      return [];
+    }
+  }
+];
+var identifierDetectors = [
+  patternDetector({
+    id: "value.email",
+    pattern: /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/i
+  }),
+  patternDetector({
+    id: "value.phone",
+    pattern: /\b(?:\+\d{1,3}[\s.-]?)?(?:\(?\d{3}\)?[\s.-])\d{3}[\s.-]\d{4}\b/
+  }),
+  patternDetector({
+    id: "value.ipv4",
+    pattern: /\b(?:(?:25[0-5]|2[0-4]\d|1?\d?\d)\.){3}(?:25[0-5]|2[0-4]\d|1?\d?\d)\b/
+  }),
+  patternDetector({
+    id: "value.ipv6",
+    pattern: /\b(?:[0-9a-f]{1,4}:){2,7}[0-9a-f]{1,4}\b/i
+  })
+];
+function builtInDetectorsForProfile(profile) {
+  if (profile === "local") return credentialDetectors;
+  return [...credentialDetectors, ...identifierDetectors];
+}
+function compileRules(rules, extraKeys) {
+  const out = /* @__PURE__ */ new Map();
+  const set = (rule) => {
+    const key = toKey(rule.key);
+    out.set(key, { ...rule, key });
+  };
+  for (const key of DEFAULT_REDACT_KEYS) {
+    set({ key, strategy: "full" });
+  }
+  for (const key of extraKeys ?? []) {
+    if (typeof key === "string" && key.length > 0) {
+      set({ key, strategy: "full" });
+    }
+  }
+  for (const rule of rules ?? []) {
+    if (typeof rule === "string") {
+      set({ key: rule, strategy: "full" });
+      continue;
+    }
+    if (rule.strategy === "full") set({ key: rule.key, strategy: "full" });
+    if (rule.strategy === "hash") set({ key: rule.key, strategy: "hash" });
+    if (rule.strategy === "prefix") {
+      set({
+        key: rule.key,
+        strategy: "prefix",
+        keep: typeof rule.keep === "number" ? rule.keep : 8
+      });
+    }
+  }
+  return [...out.values()];
+}
+function actionForRule(rule) {
+  if (rule.strategy === "full") return "replace";
+  return rule.strategy;
+}
+function applyRule(rule, value, replacement) {
+  if (rule.strategy === "full") return replacement;
+  const asString = stringifyScalar(value);
+  if (rule.strategy === "prefix") {
+    if (asString === void 0) return replacement;
+    const keep = Math.max(0, Math.floor(rule.keep));
+    return asString.length <= keep ? `${asString}\u2026` : `${asString.slice(0, keep)}\u2026`;
+  }
+  if (rule.strategy === "hash") {
+    if (asString === void 0) return "[HASH:unknown]";
+    return `[HASH:${stableHash(asString)}]`;
+  }
+  return value;
+}
+function childPath(path, key) {
+  if (/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(key)) {
+    return path ? `${path}.${key}` : key;
+  }
+  return `${path || "$"}[${JSON.stringify(key)}]`;
+}
+function indexPath(path, index) {
+  return `${path || "$"}[${index}]`;
+}
+function makeFinding(path, detector, action, matchKind, severity = "warning", preview) {
+  return preview === void 0 ? { path, detector, action, severity, matchKind } : { path, detector, action, severity, matchKind, preview };
+}
+function createRedactionProfile(profile = "local") {
+  switch (profile) {
+    case "local":
+      return { profile: "local", extraKeys: [] };
+    case "share":
+      return {
+        profile: "share",
+        extraKeys: SHARE_PROFILE_EXTRA_KEYS,
+        maxMetadataValueLengthCap: 500,
+        maxPreviewLengthCap: 200
+      };
+    case "strict":
+      return {
+        profile: "strict",
+        extraKeys: [...SHARE_PROFILE_EXTRA_KEYS, ...STRICT_PROFILE_EXTRA_KEYS],
+        maxMetadataValueLengthCap: 200,
+        maxPreviewLengthCap: 80
+      };
+  }
+}
+var Redactor = class {
+  #rules;
+  #detectors;
+  #profile;
+  #replacement;
+  #maxDepth;
+  #collectFindings;
+  constructor(options) {
+    const resolved = createRedactionProfile(options?.profile ?? "local");
+    this.#profile = resolved.profile;
+    this.#rules = compileRules(options?.rules, [
+      ...resolved.extraKeys,
+      ...options?.extraKeys ?? []
+    ]);
+    this.#detectors = [
+      ...builtInDetectorsForProfile(this.#profile),
+      ...options?.detectors ?? []
+    ];
+    this.#replacement = options?.replacement ?? "[REDACTED]";
+    this.#maxDepth = options?.maxDepth ?? 32;
+    this.#collectFindings = options?.collectFindings ?? true;
+  }
+  redactValue(key, value) {
+    return this.#redactValue(value, key, key, 0, {
+      findings: [],
+      seen: /* @__PURE__ */ new WeakMap()
+    });
+  }
+  redactRecord(record) {
+    return this.redact(record).value;
+  }
+  redact(value) {
+    const state = {
+      findings: [],
+      seen: /* @__PURE__ */ new WeakMap()
+    };
+    const redacted = this.#redactValue(value, void 0, "$", 0, state);
+    return {
+      value: redacted,
+      findings: state.findings,
+      redacted: state.findings.some((finding) => finding.action !== "keep"),
+      profile: this.#profile
+    };
+  }
+  #recordFinding(state, finding) {
+    if (this.#collectFindings) state.findings.push(finding);
+  }
+  #redactValue(value, key, path, depth, state) {
+    if (depth > this.#maxDepth) {
+      this.#recordFinding(
+        state,
+        makeFinding(path, "structure.maxDepth", "truncate", "value", "warning")
+      );
+      return "[Truncated]";
+    }
+    if (key !== void 0) {
+      const rule = this.#rules.find((candidate) => candidate.key === toKey(key));
+      if (rule) {
+        this.#recordFinding(
+          state,
+          makeFinding(path, `key.${rule.key}`, actionForRule(rule), "key", "warning")
+        );
+        return applyRule(rule, value, this.#replacement);
+      }
+    }
+    for (const detector of this.#detectors) {
+      const detections = detector.detect({ path, key, value });
+      for (const detection of detections) {
+        const action = detection.action ?? "replace";
+        this.#recordFinding(
+          state,
+          makeFinding(
+            path,
+            detector.id,
+            action,
+            detection.matchKind ?? detector.matchKind ?? "custom",
+            detection.severity ?? detector.severity ?? "warning",
+            detection.preview
+          )
+        );
+        if (action !== "keep") {
+          return detection.replacement ?? this.#replacement;
+        }
+      }
+    }
+    if (Array.isArray(value)) {
+      if (state.seen.has(value)) return state.seen.get(value);
+      const out = [];
+      state.seen.set(value, out);
+      value.forEach((item, index) => {
+        out[index] = this.#redactValue(item, void 0, indexPath(path, index), depth + 1, state);
+      });
+      return out;
+    }
+    if (isRecord(value)) {
+      if (state.seen.has(value)) return state.seen.get(value);
+      const out = {};
+      state.seen.set(value, out);
+      for (const [entryKey, entryValue] of Object.entries(value)) {
+        out[entryKey] = this.#redactValue(
+          entryValue,
+          entryKey,
+          childPath(path === "$" ? "" : path, entryKey),
+          depth + 1,
+          state
+        );
+      }
+      return out;
+    }
+    return value;
+  }
+};
+function createRedactor(options) {
+  return new Redactor(options);
+}
+function redact(value, options) {
+  return createRedactor(options).redact(value);
+}
+
+export { DEFAULT_REDACT_KEYS, Redactor, SHARE_PROFILE_EXTRA_KEYS, STRICT_PROFILE_EXTRA_KEYS, createRedactionProfile, createRedactor, redact };
+//# sourceMappingURL=index.mjs.map
+//# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"names":[],"mappings":";;;AA0EO,IAAM,mBAAA,GAAsB;AAAA,EACjC,eAAA;AAAA,EACA,QAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,UAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF;AAEO,IAAM,wBAAA,GAA2B;AAAA,EACtC,WAAA;AAAA,EACA,eAAA;AAAA,EACA,OAAA;AAAA,EACA,aAAA;AAAA,EACA,SAAA;AAAA,EACA,IAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,eAAA;AAAA,EACA,YAAA;AAAA,EACA,SAAA;AAAA,EACA,YAAA;AAAA,EACA,QAAA;AAAA,EACA,WAAA;AAAA,EACA,UAAA;AAAA,EACA,OAAA;AAAA,EACA,gBAAA;AAAA,EACA,SAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF;AAEO,IAAM,yBAAA,GAA4B;AAAA,EACvC,QAAA;AAAA,EACA,YAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,cAAA;AAAA,EACA,eAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA,YAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA,WAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,WAAA;AAAA,EACA;AACF;AAkBA,SAAS,SAAS,KAAA,EAAkD;AAClE,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E;AAEA,SAAS,MAAM,GAAA,EAAqB;AAClC,EAAA,OAAO,IAAI,WAAA,EAAY;AACzB;AAEA,SAAS,WAAW,KAAA,EAAuB;AACzC,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,UAAA,CAAW,QAAQ,CAAA,CAAE,OAAO,KAAA,EAAO,MAAM,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA;AAC3E,EAAA,OAAO,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,CAAC,CAAA;AACxB;AAEA,SAAS,gBAAgB,KAAA,EAAoC;AAC3D,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,KAAA;AACtC,EAAA,IAAI,OAAO,UAAU,QAAA,IAAY,OAAO,UAAU,SAAA,IAAa,OAAO,UAAU,QAAA,EAAU;AACxF,IAAA,OAAO,OAAO,KAAK,CAAA;AAAA,EACrB;AACA,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,gBAAgB,OAAA,EAAoD;AAC3E,EAAA,OAAO;AAAA,IACL,IAAI,OAAA,CAAQ,EAAA;AAAA,IACZ,QAAA,EAAU,QAAQ,QAAA,IAAY,SAAA;AAAA,IAC9B,SAAA,EAAW,OAAA;AAAA,IACX,OAAO,KAAA,EAAO;AACZ,MAAA,IAAI,OAAO,KAAA,CAAM,KAAA,KAAU,QAAA,SAAiB,EAAC;AAC7C,MAAA,OAAA,CAAQ,QAAQ,SAAA,GAAY,CAAA;AAC5B,MAAA,OAAO,QAAQ,OAAA,CAAQ,IAAA,CAAK,MAAM,KAAK,CAAA,GACnC,CAAC,EAAE,MAAA,EAAQ,SAAA,EAAW,QAAA,EAAU,QAAQ,QAAA,IAAY,SAAA,EAAW,WAAW,OAAA,EAAS,IACnF,EAAC;AAAA,IACP;AAAA,GACF;AACF;AAEA,SAAS,WAAW,KAAA,EAAuB;AACzC,EAAA,OAAO,KAAA,CAAM,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAChC;AAEA,SAAS,WAAW,KAAA,EAAwB;AAC1C,EAAA,MAAM,MAAA,GAAS,WAAW,KAAK,CAAA;AAC/B,EAAA,IAAI,OAAO,MAAA,GAAS,EAAA,IAAM,MAAA,CAAO,MAAA,GAAS,IAAI,OAAO,KAAA;AAErD,EAAA,IAAI,GAAA,GAAM,CAAA;AACV,EAAA,IAAI,MAAA,GAAS,KAAA;AACb,EAAA,KAAA,IAAS,IAAI,MAAA,CAAO,MAAA,GAAS,GAAG,CAAA,IAAK,CAAA,EAAG,KAAK,CAAA,EAAG;AAC9C,IAAA,IAAI,KAAA,GAAQ,MAAA,CAAO,MAAA,CAAO,CAAC,CAAC,CAAA;AAC5B,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,KAAA,IAAS,CAAA;AACT,MAAA,IAAI,KAAA,GAAQ,GAAG,KAAA,IAAS,CAAA;AAAA,IAC1B;AACA,IAAA,GAAA,IAAO,KAAA;AACP,IAAA,MAAA,GAAS,CAAC,MAAA;AAAA,EACZ;AACA,EAAA,OAAO,MAAM,EAAA,KAAO,CAAA;AACtB;AAEA,IAAM,mBAAA,GAAoD;AAAA,EACxD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,2BAAA;AAAA,IACJ,OAAA,EAAS,sDAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACX,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,mBAAA;AAAA,IACJ,OAAA,EAAS,oCAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACX,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,cAAA;AAAA,IACJ,OAAA,EAAS,sDAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACX,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,WAAA;AAAA,IACJ,OAAA,EAAS,gEAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACX,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,sBAAA;AAAA,IACJ,OAAA,EAAS,0FAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACX,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,mBAAA;AAAA,IACJ,OAAA,EAAS,+CAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACX,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,oBAAA;AAAA,IACJ,OAAA,EAAS,+BAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACX,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,kBAAA;AAAA,IACJ,OAAA,EAAS,2EAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACX,CAAA;AAAA,EACD;AAAA,IACE,EAAA,EAAI,kBAAA;AAAA,IACJ,QAAA,EAAU,OAAA;AAAA,IACV,SAAA,EAAW,OAAA;AAAA,IACX,OAAO,KAAA,EAAO;AACZ,MAAA,IAAI,OAAO,KAAA,CAAM,KAAA,KAAU,QAAA,SAAiB,EAAC;AAC7C,MAAA,MAAM,gBAAA,GAAmB,qBAAA;AACzB,MAAA,KAAA,MAAW,KAAA,IAAS,KAAA,CAAM,KAAA,CAAM,QAAA,CAAS,gBAAgB,CAAA,EAAG;AAC1D,QAAA,MAAM,SAAA,GAAY,KAAA,CAAM,CAAC,CAAA,IAAK,EAAA;AAC9B,QAAA,IAAI,UAAA,CAAW,SAAS,CAAA,EAAG;AACzB,UAAA,OAAO,CAAC,EAAE,MAAA,EAAQ,SAAA,EAAW,UAAU,OAAA,EAAS,SAAA,EAAW,SAAS,CAAA;AAAA,QACtE;AAAA,MACF;AACA,MAAA,OAAO,EAAC;AAAA,IACV;AAAA;AAEJ,CAAA;AAEA,IAAM,mBAAA,GAAoD;AAAA,EACxD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,aAAA;AAAA,IACJ,OAAA,EAAS;AAAA,GACV,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,aAAA;AAAA,IACJ,OAAA,EAAS;AAAA,GACV,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,YAAA;AAAA,IACJ,OAAA,EAAS;AAAA,GACV,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,YAAA;AAAA,IACJ,OAAA,EAAS;AAAA,GACV;AACH,CAAA;AAEA,SAAS,2BAA2B,OAAA,EAAyD;AAC3F,EAAA,IAAI,OAAA,KAAY,SAAS,OAAO,mBAAA;AAChC,EAAA,OAAO,CAAC,GAAG,mBAAA,EAAqB,GAAG,mBAAmB,CAAA;AACxD;AAEA,SAAS,YAAA,CACP,OACA,SAAA,EACgB;AAChB,EAAA,MAAM,GAAA,uBAAU,GAAA,EAA0B;AAE1C,EAAA,MAAM,GAAA,GAAM,CAAC,IAAA,KAAuB;AAClC,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA;AAC1B,IAAA,GAAA,CAAI,IAAI,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,KAAqB,CAAA;AAAA,EAC/C,CAAA;AAEA,EAAA,KAAA,MAAW,OAAO,mBAAA,EAAqB;AACrC,IAAA,GAAA,CAAI,EAAE,GAAA,EAAK,QAAA,EAAU,MAAA,EAAQ,CAAA;AAAA,EAC/B;AAEA,EAAA,KAAA,MAAW,GAAA,IAAO,SAAA,IAAa,EAAC,EAAG;AACjC,IAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,CAAI,SAAS,CAAA,EAAG;AAC7C,MAAA,GAAA,CAAI,EAAE,GAAA,EAAK,QAAA,EAAU,MAAA,EAAQ,CAAA;AAAA,IAC/B;AAAA,EACF;AAEA,EAAA,KAAA,MAAW,IAAA,IAAQ,KAAA,IAAS,EAAC,EAAG;AAC9B,IAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC5B,MAAA,GAAA,CAAI,EAAE,GAAA,EAAK,IAAA,EAAM,QAAA,EAAU,QAAQ,CAAA;AACnC,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,IAAA,CAAK,QAAA,KAAa,MAAA,EAAQ,GAAA,CAAI,EAAE,KAAK,IAAA,CAAK,GAAA,EAAK,QAAA,EAAU,MAAA,EAAQ,CAAA;AACrE,IAAA,IAAI,IAAA,CAAK,QAAA,KAAa,MAAA,EAAQ,GAAA,CAAI,EAAE,KAAK,IAAA,CAAK,GAAA,EAAK,QAAA,EAAU,MAAA,EAAQ,CAAA;AACrE,IAAA,IAAI,IAAA,CAAK,aAAa,QAAA,EAAU;AAC9B,MAAA,GAAA,CAAI;AAAA,QACF,KAAK,IAAA,CAAK,GAAA;AAAA,QACV,QAAA,EAAU,QAAA;AAAA,QACV,MAAM,OAAO,IAAA,CAAK,IAAA,KAAS,QAAA,GAAW,KAAK,IAAA,GAAO;AAAA,OACnD,CAAA;AAAA,IACH;AAAA,EACF;AAEA,EAAA,OAAO,CAAC,GAAG,GAAA,CAAI,MAAA,EAAQ,CAAA;AACzB;AAEA,SAAS,cAAc,IAAA,EAAqC;AAC1D,EAAA,IAAI,IAAA,CAAK,QAAA,KAAa,MAAA,EAAQ,OAAO,SAAA;AACrC,EAAA,OAAO,IAAA,CAAK,QAAA;AACd;AAEA,SAAS,SAAA,CACP,IAAA,EACA,KAAA,EACA,WAAA,EACS;AACT,EAAA,IAAI,IAAA,CAAK,QAAA,KAAa,MAAA,EAAQ,OAAO,WAAA;AAErC,EAAA,MAAM,QAAA,GAAW,gBAAgB,KAAK,CAAA;AACtC,EAAA,IAAI,IAAA,CAAK,aAAa,QAAA,EAAU;AAC9B,IAAA,IAAI,QAAA,KAAa,QAAW,OAAO,WAAA;AACnC,IAAA,MAAM,IAAA,GAAO,KAAK,GAAA,CAAI,CAAA,EAAG,KAAK,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC,CAAA;AAC9C,IAAA,OAAO,QAAA,CAAS,MAAA,IAAU,IAAA,GAAO,CAAA,EAAG,QAAQ,CAAA,MAAA,CAAA,GAAM,CAAA,EAAG,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,IAAI,CAAC,CAAA,MAAA,CAAA;AAAA,EAC9E;AAEA,EAAA,IAAI,IAAA,CAAK,aAAa,MAAA,EAAQ;AAC5B,IAAA,IAAI,QAAA,KAAa,QAAW,OAAO,gBAAA;AACnC,IAAA,OAAO,CAAA,MAAA,EAAS,UAAA,CAAW,QAAQ,CAAC,CAAA,CAAA,CAAA;AAAA,EACtC;AAEA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,SAAA,CAAU,MAAc,GAAA,EAAqB;AACpD,EAAA,IAAI,4BAAA,CAA6B,IAAA,CAAK,GAAG,CAAA,EAAG;AAC1C,IAAA,OAAO,IAAA,GAAO,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,GAAG,CAAA,CAAA,GAAK,GAAA;AAAA,EACnC;AACA,EAAA,OAAO,GAAG,IAAA,IAAQ,GAAG,IAAI,IAAA,CAAK,SAAA,CAAU,GAAG,CAAC,CAAA,CAAA,CAAA;AAC9C;AAEA,SAAS,SAAA,CAAU,MAAc,KAAA,EAAuB;AACtD,EAAA,OAAO,CAAA,EAAG,IAAA,IAAQ,GAAG,CAAA,CAAA,EAAI,KAAK,CAAA,CAAA,CAAA;AAChC;AAEA,SAAS,YACP,IAAA,EACA,QAAA,EACA,QACA,SAAA,EACA,QAAA,GAA8B,WAC9B,OAAA,EACkB;AAClB,EAAA,OAAO,OAAA,KAAY,MAAA,GACf,EAAE,IAAA,EAAM,UAAU,MAAA,EAAQ,QAAA,EAAU,SAAA,EAAU,GAC9C,EAAE,IAAA,EAAM,QAAA,EAAU,MAAA,EAAQ,QAAA,EAAU,WAAW,OAAA,EAAQ;AAC7D;AAEO,SAAS,sBAAA,CAAuB,UAA4B,OAAA,EAAmC;AACpG,EAAA,QAAQ,OAAA;AAAS,IACf,KAAK,OAAA;AACH,MAAA,OAAO,EAAE,OAAA,EAAS,OAAA,EAAS,SAAA,EAAW,EAAC,EAAE;AAAA,IAC3C,KAAK,OAAA;AACH,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,OAAA;AAAA,QACT,SAAA,EAAW,wBAAA;AAAA,QACX,yBAAA,EAA2B,GAAA;AAAA,QAC3B,mBAAA,EAAqB;AAAA,OACvB;AAAA,IACF,KAAK,QAAA;AACH,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,QAAA;AAAA,QACT,SAAA,EAAW,CAAC,GAAG,wBAAA,EAA0B,GAAG,yBAAyB,CAAA;AAAA,QACrE,yBAAA,EAA2B,GAAA;AAAA,QAC3B,mBAAA,EAAqB;AAAA,OACvB;AAAA;AAEN;AAEO,IAAM,WAAN,MAAe;AAAA,EACX,MAAA;AAAA,EACA,UAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,SAAA;AAAA,EACA,gBAAA;AAAA,EAET,YAAY,OAAA,EAA2B;AACrC,IAAA,MAAM,QAAA,GAAW,sBAAA,CAAuB,OAAA,EAAS,OAAA,IAAW,OAAO,CAAA;AACnE,IAAA,IAAA,CAAK,WAAW,QAAA,CAAS,OAAA;AACzB,IAAA,IAAA,CAAK,MAAA,GAAS,YAAA,CAAa,OAAA,EAAS,KAAA,EAAO;AAAA,MACzC,GAAG,QAAA,CAAS,SAAA;AAAA,MACZ,GAAI,OAAA,EAAS,SAAA,IAAa;AAAC,KAC5B,CAAA;AACD,IAAA,IAAA,CAAK,UAAA,GAAa;AAAA,MAChB,GAAG,0BAAA,CAA2B,IAAA,CAAK,QAAQ,CAAA;AAAA,MAC3C,GAAI,OAAA,EAAS,SAAA,IAAa;AAAC,KAC7B;AACA,IAAA,IAAA,CAAK,YAAA,GAAe,SAAS,WAAA,IAAe,YAAA;AAC5C,IAAA,IAAA,CAAK,SAAA,GAAY,SAAS,QAAA,IAAY,EAAA;AACtC,IAAA,IAAA,CAAK,gBAAA,GAAmB,SAAS,eAAA,IAAmB,IAAA;AAAA,EACtD;AAAA,EAEA,WAAA,CAAY,KAAa,KAAA,EAAyB;AAChD,IAAA,OAAO,IAAA,CAAK,YAAA,CAAa,KAAA,EAAO,GAAA,EAAK,KAAK,CAAA,EAAG;AAAA,MAC3C,UAAU,EAAC;AAAA,MACX,IAAA,sBAAU,OAAA;AAAyB,KACpC,CAAA;AAAA,EACH;AAAA,EAEA,aAAa,MAAA,EAA0D;AACrE,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,MAAM,CAAA,CAAE,KAAA;AAAA,EAC7B;AAAA,EAEA,OAAoB,KAAA,EAA8B;AAChD,IAAA,MAAM,KAAA,GAAwB;AAAA,MAC5B,UAAU,EAAC;AAAA,MACX,IAAA,sBAAU,OAAA;AAAyB,KACrC;AACA,IAAA,MAAM,WAAW,IAAA,CAAK,YAAA,CAAa,OAAO,MAAA,EAAW,GAAA,EAAK,GAAG,KAAK,CAAA;AAClE,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,QAAA;AAAA,MACP,UAAU,KAAA,CAAM,QAAA;AAAA,MAChB,QAAA,EAAU,MAAM,QAAA,CAAS,IAAA,CAAK,CAAC,OAAA,KAAY,OAAA,CAAQ,WAAW,MAAM,CAAA;AAAA,MACpE,SAAS,IAAA,CAAK;AAAA,KAChB;AAAA,EACF;AAAA,EAEA,cAAA,CAAe,OAAuB,OAAA,EAAiC;AACrE,IAAA,IAAI,IAAA,CAAK,gBAAA,EAAkB,KAAA,CAAM,QAAA,CAAS,KAAK,OAAO,CAAA;AAAA,EACxD;AAAA,EAEA,YAAA,CACE,KAAA,EACA,GAAA,EACA,IAAA,EACA,OACA,KAAA,EACS;AACT,IAAA,IAAI,KAAA,GAAQ,KAAK,SAAA,EAAW;AAC1B,MAAA,IAAA,CAAK,cAAA;AAAA,QACH,KAAA;AAAA,QACA,WAAA,CAAY,IAAA,EAAM,oBAAA,EAAsB,UAAA,EAAY,SAAS,SAAS;AAAA,OACxE;AACA,MAAA,OAAO,aAAA;AAAA,IACT;AAEA,IAAA,IAAI,QAAQ,MAAA,EAAW;AACrB,MAAA,MAAM,IAAA,GAAO,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,CAAC,cAAc,SAAA,CAAU,GAAA,KAAQ,KAAA,CAAM,GAAG,CAAC,CAAA;AACzE,MAAA,IAAI,IAAA,EAAM;AACR,QAAA,IAAA,CAAK,cAAA;AAAA,UACH,KAAA;AAAA,UACA,WAAA,CAAY,IAAA,EAAM,CAAA,IAAA,EAAO,IAAA,CAAK,GAAG,IAAI,aAAA,CAAc,IAAI,CAAA,EAAG,KAAA,EAAO,SAAS;AAAA,SAC5E;AACA,QAAA,OAAO,SAAA,CAAU,IAAA,EAAM,KAAA,EAAO,IAAA,CAAK,YAAY,CAAA;AAAA,MACjD;AAAA,IACF;AAEA,IAAA,KAAA,MAAW,QAAA,IAAY,KAAK,UAAA,EAAY;AACtC,MAAA,MAAM,aAAa,QAAA,CAAS,MAAA,CAAO,EAAE,IAAA,EAAM,GAAA,EAAK,OAAO,CAAA;AACvD,MAAA,KAAA,MAAW,aAAa,UAAA,EAAY;AAClC,QAAA,MAAM,MAAA,GAAS,UAAU,MAAA,IAAU,SAAA;AACnC,QAAA,IAAA,CAAK,cAAA;AAAA,UACH,KAAA;AAAA,UACA,WAAA;AAAA,YACE,IAAA;AAAA,YACA,QAAA,CAAS,EAAA;AAAA,YACT,MAAA;AAAA,YACA,SAAA,CAAU,SAAA,IAAa,QAAA,CAAS,SAAA,IAAa,QAAA;AAAA,YAC7C,SAAA,CAAU,QAAA,IAAY,QAAA,CAAS,QAAA,IAAY,SAAA;AAAA,YAC3C,SAAA,CAAU;AAAA;AACZ,SACF;AACA,QAAA,IAAI,WAAW,MAAA,EAAQ;AACrB,UAAA,OAAO,SAAA,CAAU,eAAe,IAAA,CAAK,YAAA;AAAA,QACvC;AAAA,MACF;AAAA,IACF;AAEA,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,MAAA,IAAI,KAAA,CAAM,KAAK,GAAA,CAAI,KAAK,GAAG,OAAO,KAAA,CAAM,IAAA,CAAK,GAAA,CAAI,KAAK,CAAA;AACtD,MAAA,MAAM,MAAiB,EAAC;AACxB,MAAA,KAAA,CAAM,IAAA,CAAK,GAAA,CAAI,KAAA,EAAO,GAAG,CAAA;AACzB,MAAA,KAAA,CAAM,OAAA,CAAQ,CAAC,IAAA,EAAM,KAAA,KAAU;AAC7B,QAAA,GAAA,CAAI,KAAK,CAAA,GAAI,IAAA,CAAK,YAAA,CAAa,IAAA,EAAM,MAAA,EAAW,SAAA,CAAU,IAAA,EAAM,KAAK,CAAA,EAAG,KAAA,GAAQ,CAAA,EAAG,KAAK,CAAA;AAAA,MAC1F,CAAC,CAAA;AACD,MAAA,OAAO,GAAA;AAAA,IACT;AAEA,IAAA,IAAI,QAAA,CAAS,KAAK,CAAA,EAAG;AACnB,MAAA,IAAI,KAAA,CAAM,KAAK,GAAA,CAAI,KAAK,GAAG,OAAO,KAAA,CAAM,IAAA,CAAK,GAAA,CAAI,KAAK,CAAA;AACtD,MAAA,MAAM,MAA+B,EAAC;AACtC,MAAA,KAAA,CAAM,IAAA,CAAK,GAAA,CAAI,KAAA,EAAO,GAAG,CAAA;AACzB,MAAA,KAAA,MAAW,CAAC,QAAA,EAAU,UAAU,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC1D,QAAA,GAAA,CAAI,QAAQ,IAAI,IAAA,CAAK,YAAA;AAAA,UACnB,UAAA;AAAA,UACA,QAAA;AAAA,UACA,SAAA,CAAU,IAAA,KAAS,GAAA,GAAM,EAAA,GAAK,MAAM,QAAQ,CAAA;AAAA,UAC5C,KAAA,GAAQ,CAAA;AAAA,UACR;AAAA,SACF;AAAA,MACF;AACA,MAAA,OAAO,GAAA;AAAA,IACT;AAEA,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEO,SAAS,eAAe,OAAA,EAAqC;AAClE,EAAA,OAAO,IAAI,SAAS,OAAO,CAAA;AAC7B;AAEO,SAAS,MAAA,CAAoB,OAAU,OAAA,EAA6C;AACzF,EAAA,OAAO,cAAA,CAAe,OAAO,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA;AAC7C","file":"index.mjs","sourcesContent":["import crypto from \"node:crypto\";\n\nexport type RedactionProfile = \"local\" | \"share\" | \"strict\";\n\nexport type RedactionAction = \"replace\" | \"hash\" | \"prefix\" | \"truncate\" | \"keep\";\n\nexport type RedactionSeverity = \"info\" | \"warning\" | \"error\";\n\nexport type RedactionMatchKind = \"key\" | \"value\" | \"custom\";\n\nexport type RedactionRule =\n  | string\n  | { key: string; strategy: \"full\" }\n  | { key: string; strategy: \"prefix\"; keep?: number }\n  | { key: string; strategy: \"hash\" };\n\nexport interface RedactionFinding {\n  path: string;\n  detector: string;\n  action: RedactionAction;\n  severity: RedactionSeverity;\n  matchKind: RedactionMatchKind;\n  preview?: string;\n}\n\nexport interface RedactionDetection {\n  action?: RedactionAction;\n  replacement?: unknown;\n  severity?: RedactionSeverity;\n  matchKind?: RedactionMatchKind;\n  preview?: string;\n}\n\nexport interface RedactionDetectorInput {\n  path: string;\n  key?: string;\n  value: unknown;\n}\n\nexport interface RedactionDetector {\n  id: string;\n  severity?: RedactionSeverity;\n  matchKind?: RedactionMatchKind;\n  detect(input: RedactionDetectorInput): RedactionDetection[];\n}\n\nexport interface RedactionResult<T = unknown> {\n  value: T;\n  findings: RedactionFinding[];\n  redacted: boolean;\n  profile: RedactionProfile;\n}\n\nexport interface ResolvedRedactionProfile {\n  profile: RedactionProfile;\n  extraKeys: readonly string[];\n  maxMetadataValueLengthCap?: number;\n  maxPreviewLengthCap?: number;\n}\n\nexport interface RedactOptions {\n  profile?: RedactionProfile;\n  detectors?: RedactionDetector[];\n  rules?: RedactionRule[];\n  replacement?: string;\n  maxDepth?: number;\n  maxStringLength?: number;\n  collectFindings?: boolean;\n}\n\nexport interface RedactorOptions extends RedactOptions {\n  extraKeys?: readonly string[];\n}\n\nexport const DEFAULT_REDACT_KEYS = [\n  \"authorization\",\n  \"cookie\",\n  \"token\",\n  \"apiKey\",\n  \"password\",\n  \"secret\",\n  \"email\",\n] as const;\n\nexport const SHARE_PROFILE_EXTRA_KEYS = [\n  \"userEmail\",\n  \"customerEmail\",\n  \"phone\",\n  \"phoneNumber\",\n  \"address\",\n  \"ip\",\n  \"ipAddress\",\n  \"sessionId\",\n  \"requestId\",\n  \"correlationId\",\n  \"decisionId\",\n  \"groupId\",\n  \"customerId\",\n  \"userId\",\n  \"accountId\",\n  \"tenantId\",\n  \"orgId\",\n  \"organizationId\",\n  \"traceId\",\n  \"spanId\",\n  \"parentSpanId\",\n] as const;\n\nexport const STRICT_PROFILE_EXTRA_KEYS = [\n  \"prompt\",\n  \"completion\",\n  \"input\",\n  \"output\",\n  \"inputPreview\",\n  \"outputPreview\",\n  \"message\",\n  \"messages\",\n  \"transcript\",\n  \"context\",\n  \"document\",\n  \"documents\",\n  \"chunk\",\n  \"chunks\",\n  \"retrieval\",\n  \"query\",\n] as const;\n\ntype CompiledRule =\n  | { key: string; strategy: \"full\" }\n  | { key: string; strategy: \"prefix\"; keep: number }\n  | { key: string; strategy: \"hash\" };\n\ninterface RedactionState {\n  findings: RedactionFinding[];\n  seen: WeakMap<object, unknown>;\n}\n\ninterface PatternDetectorOptions {\n  id: string;\n  pattern: RegExp;\n  severity?: RedactionSeverity;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction toKey(key: string): string {\n  return key.toLowerCase();\n}\n\nfunction stableHash(value: string): string {\n  const hash = crypto.createHash(\"sha256\").update(value, \"utf8\").digest(\"hex\");\n  return hash.slice(0, 8);\n}\n\nfunction stringifyScalar(value: unknown): string | undefined {\n  if (typeof value === \"string\") return value;\n  if (typeof value === \"number\" || typeof value === \"boolean\" || typeof value === \"bigint\") {\n    return String(value);\n  }\n  return undefined;\n}\n\nfunction patternDetector(options: PatternDetectorOptions): RedactionDetector {\n  return {\n    id: options.id,\n    severity: options.severity ?? \"warning\",\n    matchKind: \"value\",\n    detect(input) {\n      if (typeof input.value !== \"string\") return [];\n      options.pattern.lastIndex = 0;\n      return options.pattern.test(input.value)\n        ? [{ action: \"replace\", severity: options.severity ?? \"warning\", matchKind: \"value\" }]\n        : [];\n    },\n  };\n}\n\nfunction digitsOnly(value: string): string {\n  return value.replace(/\\D/g, \"\");\n}\n\nfunction passesLuhn(value: string): boolean {\n  const digits = digitsOnly(value);\n  if (digits.length < 13 || digits.length > 19) return false;\n\n  let sum = 0;\n  let double = false;\n  for (let i = digits.length - 1; i >= 0; i -= 1) {\n    let digit = Number(digits[i]);\n    if (double) {\n      digit *= 2;\n      if (digit > 9) digit -= 9;\n    }\n    sum += digit;\n    double = !double;\n  }\n  return sum % 10 === 0;\n}\n\nconst credentialDetectors: readonly RedactionDetector[] = [\n  patternDetector({\n    id: \"value.authorizationHeader\",\n    pattern: /^(?:basic|bearer|digest|apikey)\\s+[a-z0-9._~+/=-]+$/i,\n    severity: \"error\",\n  }),\n  patternDetector({\n    id: \"value.bearerToken\",\n    pattern: /\\bbearer\\s+[a-z0-9._~+/=-]{12,}\\b/i,\n    severity: \"error\",\n  }),\n  patternDetector({\n    id: \"value.cookie\",\n    pattern: /\\b[a-z0-9_.-]+=[^;\\s]+(?:;\\s*[a-z0-9_.-]+=[^;\\s]+)+/i,\n    severity: \"error\",\n  }),\n  patternDetector({\n    id: \"value.jwt\",\n    pattern: /\\beyJ[a-zA-Z0-9_-]{8,}\\.[a-zA-Z0-9_-]{8,}\\.[a-zA-Z0-9_-]{8,}\\b/,\n    severity: \"error\",\n  }),\n  patternDetector({\n    id: \"value.providerApiKey\",\n    pattern: /\\b(?:sk-(?:proj-)?[a-zA-Z0-9_-]{16,}|sk-ant-[a-zA-Z0-9_-]{16,}|AIza[0-9A-Za-z_-]{20,})\\b/,\n    severity: \"error\",\n  }),\n  patternDetector({\n    id: \"value.githubToken\",\n    pattern: /\\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{20,}\\b/,\n    severity: \"error\",\n  }),\n  patternDetector({\n    id: \"value.awsAccessKey\",\n    pattern: /\\b(?:AKIA|ASIA)[A-Z0-9]{16}\\b/,\n    severity: \"error\",\n  }),\n  patternDetector({\n    id: \"value.privateKey\",\n    pattern: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\\s\\S]*-----END [A-Z ]*PRIVATE KEY-----/,\n    severity: \"error\",\n  }),\n  {\n    id: \"value.creditCard\",\n    severity: \"error\",\n    matchKind: \"value\",\n    detect(input) {\n      if (typeof input.value !== \"string\") return [];\n      const candidatePattern = /(?:\\d[ -]?){13,19}/g;\n      for (const match of input.value.matchAll(candidatePattern)) {\n        const candidate = match[0] ?? \"\";\n        if (passesLuhn(candidate)) {\n          return [{ action: \"replace\", severity: \"error\", matchKind: \"value\" }];\n        }\n      }\n      return [];\n    },\n  },\n];\n\nconst identifierDetectors: readonly RedactionDetector[] = [\n  patternDetector({\n    id: \"value.email\",\n    pattern: /\\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\\.[A-Z]{2,}\\b/i,\n  }),\n  patternDetector({\n    id: \"value.phone\",\n    pattern: /\\b(?:\\+\\d{1,3}[\\s.-]?)?(?:\\(?\\d{3}\\)?[\\s.-])\\d{3}[\\s.-]\\d{4}\\b/,\n  }),\n  patternDetector({\n    id: \"value.ipv4\",\n    pattern: /\\b(?:(?:25[0-5]|2[0-4]\\d|1?\\d?\\d)\\.){3}(?:25[0-5]|2[0-4]\\d|1?\\d?\\d)\\b/,\n  }),\n  patternDetector({\n    id: \"value.ipv6\",\n    pattern: /\\b(?:[0-9a-f]{1,4}:){2,7}[0-9a-f]{1,4}\\b/i,\n  }),\n];\n\nfunction builtInDetectorsForProfile(profile: RedactionProfile): readonly RedactionDetector[] {\n  if (profile === \"local\") return credentialDetectors;\n  return [...credentialDetectors, ...identifierDetectors];\n}\n\nfunction compileRules(\n  rules?: RedactionRule[],\n  extraKeys?: readonly string[],\n): CompiledRule[] {\n  const out = new Map<string, CompiledRule>();\n\n  const set = (rule: CompiledRule) => {\n    const key = toKey(rule.key);\n    out.set(key, { ...rule, key } as CompiledRule);\n  };\n\n  for (const key of DEFAULT_REDACT_KEYS) {\n    set({ key, strategy: \"full\" });\n  }\n\n  for (const key of extraKeys ?? []) {\n    if (typeof key === \"string\" && key.length > 0) {\n      set({ key, strategy: \"full\" });\n    }\n  }\n\n  for (const rule of rules ?? []) {\n    if (typeof rule === \"string\") {\n      set({ key: rule, strategy: \"full\" });\n      continue;\n    }\n\n    if (rule.strategy === \"full\") set({ key: rule.key, strategy: \"full\" });\n    if (rule.strategy === \"hash\") set({ key: rule.key, strategy: \"hash\" });\n    if (rule.strategy === \"prefix\") {\n      set({\n        key: rule.key,\n        strategy: \"prefix\",\n        keep: typeof rule.keep === \"number\" ? rule.keep : 8,\n      });\n    }\n  }\n\n  return [...out.values()];\n}\n\nfunction actionForRule(rule: CompiledRule): RedactionAction {\n  if (rule.strategy === \"full\") return \"replace\";\n  return rule.strategy;\n}\n\nfunction applyRule(\n  rule: CompiledRule,\n  value: unknown,\n  replacement: string,\n): unknown {\n  if (rule.strategy === \"full\") return replacement;\n\n  const asString = stringifyScalar(value);\n  if (rule.strategy === \"prefix\") {\n    if (asString === undefined) return replacement;\n    const keep = Math.max(0, Math.floor(rule.keep));\n    return asString.length <= keep ? `${asString}…` : `${asString.slice(0, keep)}…`;\n  }\n\n  if (rule.strategy === \"hash\") {\n    if (asString === undefined) return \"[HASH:unknown]\";\n    return `[HASH:${stableHash(asString)}]`;\n  }\n\n  return value;\n}\n\nfunction childPath(path: string, key: string): string {\n  if (/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(key)) {\n    return path ? `${path}.${key}` : key;\n  }\n  return `${path || \"$\"}[${JSON.stringify(key)}]`;\n}\n\nfunction indexPath(path: string, index: number): string {\n  return `${path || \"$\"}[${index}]`;\n}\n\nfunction makeFinding(\n  path: string,\n  detector: string,\n  action: RedactionAction,\n  matchKind: RedactionMatchKind,\n  severity: RedactionSeverity = \"warning\",\n  preview?: string,\n): RedactionFinding {\n  return preview === undefined\n    ? { path, detector, action, severity, matchKind }\n    : { path, detector, action, severity, matchKind, preview };\n}\n\nexport function createRedactionProfile(profile: RedactionProfile = \"local\"): ResolvedRedactionProfile {\n  switch (profile) {\n    case \"local\":\n      return { profile: \"local\", extraKeys: [] };\n    case \"share\":\n      return {\n        profile: \"share\",\n        extraKeys: SHARE_PROFILE_EXTRA_KEYS,\n        maxMetadataValueLengthCap: 500,\n        maxPreviewLengthCap: 200,\n      };\n    case \"strict\":\n      return {\n        profile: \"strict\",\n        extraKeys: [...SHARE_PROFILE_EXTRA_KEYS, ...STRICT_PROFILE_EXTRA_KEYS],\n        maxMetadataValueLengthCap: 200,\n        maxPreviewLengthCap: 80,\n      };\n  }\n}\n\nexport class Redactor {\n  readonly #rules: CompiledRule[];\n  readonly #detectors: readonly RedactionDetector[];\n  readonly #profile: RedactionProfile;\n  readonly #replacement: string;\n  readonly #maxDepth: number;\n  readonly #collectFindings: boolean;\n\n  constructor(options?: RedactorOptions) {\n    const resolved = createRedactionProfile(options?.profile ?? \"local\");\n    this.#profile = resolved.profile;\n    this.#rules = compileRules(options?.rules, [\n      ...resolved.extraKeys,\n      ...(options?.extraKeys ?? []),\n    ]);\n    this.#detectors = [\n      ...builtInDetectorsForProfile(this.#profile),\n      ...(options?.detectors ?? []),\n    ];\n    this.#replacement = options?.replacement ?? \"[REDACTED]\";\n    this.#maxDepth = options?.maxDepth ?? 32;\n    this.#collectFindings = options?.collectFindings ?? true;\n  }\n\n  redactValue(key: string, value: unknown): unknown {\n    return this.#redactValue(value, key, key, 0, {\n      findings: [],\n      seen: new WeakMap<object, unknown>(),\n    });\n  }\n\n  redactRecord(record: Record<string, unknown>): Record<string, unknown> {\n    return this.redact(record).value as Record<string, unknown>;\n  }\n\n  redact<T = unknown>(value: T): RedactionResult<T> {\n    const state: RedactionState = {\n      findings: [],\n      seen: new WeakMap<object, unknown>(),\n    };\n    const redacted = this.#redactValue(value, undefined, \"$\", 0, state);\n    return {\n      value: redacted as T,\n      findings: state.findings,\n      redacted: state.findings.some((finding) => finding.action !== \"keep\"),\n      profile: this.#profile,\n    };\n  }\n\n  #recordFinding(state: RedactionState, finding: RedactionFinding): void {\n    if (this.#collectFindings) state.findings.push(finding);\n  }\n\n  #redactValue(\n    value: unknown,\n    key: string | undefined,\n    path: string,\n    depth: number,\n    state: RedactionState,\n  ): unknown {\n    if (depth > this.#maxDepth) {\n      this.#recordFinding(\n        state,\n        makeFinding(path, \"structure.maxDepth\", \"truncate\", \"value\", \"warning\"),\n      );\n      return \"[Truncated]\";\n    }\n\n    if (key !== undefined) {\n      const rule = this.#rules.find((candidate) => candidate.key === toKey(key));\n      if (rule) {\n        this.#recordFinding(\n          state,\n          makeFinding(path, `key.${rule.key}`, actionForRule(rule), \"key\", \"warning\"),\n        );\n        return applyRule(rule, value, this.#replacement);\n      }\n    }\n\n    for (const detector of this.#detectors) {\n      const detections = detector.detect({ path, key, value });\n      for (const detection of detections) {\n        const action = detection.action ?? \"replace\";\n        this.#recordFinding(\n          state,\n          makeFinding(\n            path,\n            detector.id,\n            action,\n            detection.matchKind ?? detector.matchKind ?? \"custom\",\n            detection.severity ?? detector.severity ?? \"warning\",\n            detection.preview,\n          ),\n        );\n        if (action !== \"keep\") {\n          return detection.replacement ?? this.#replacement;\n        }\n      }\n    }\n\n    if (Array.isArray(value)) {\n      if (state.seen.has(value)) return state.seen.get(value);\n      const out: unknown[] = [];\n      state.seen.set(value, out);\n      value.forEach((item, index) => {\n        out[index] = this.#redactValue(item, undefined, indexPath(path, index), depth + 1, state);\n      });\n      return out;\n    }\n\n    if (isRecord(value)) {\n      if (state.seen.has(value)) return state.seen.get(value);\n      const out: Record<string, unknown> = {};\n      state.seen.set(value, out);\n      for (const [entryKey, entryValue] of Object.entries(value)) {\n        out[entryKey] = this.#redactValue(\n          entryValue,\n          entryKey,\n          childPath(path === \"$\" ? \"\" : path, entryKey),\n          depth + 1,\n          state,\n        );\n      }\n      return out;\n    }\n\n    return value;\n  }\n}\n\nexport function createRedactor(options?: RedactorOptions): Redactor {\n  return new Redactor(options);\n}\n\nexport function redact<T = unknown>(value: T, options?: RedactOptions): RedactionResult<T> {\n  return createRedactor(options).redact(value);\n}\n"]}

package/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "@agent-inspect/redact",
+  "version": "2.0.0",
+  "license": "MIT",
+  "type": "module",
+  "description": "Reusable deterministic redaction utilities for local AgentInspect workflows",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/rajudandigam/agent-inspect.git",
+    "directory": "packages/redact"
+  },
+  "bugs": {
+    "url": "https://github.com/rajudandigam/agent-inspect/issues"
+  },
+  "homepage": "https://github.com/rajudandigam/agent-inspect#readme",
+  "sideEffects": false,
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.mjs"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "pnpm --workspace-root exec tsup --config tsup.redact.config.ts",
+    "test": "vitest run -c ../../vitest.config.ts"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}