@agentlensai/server 0.10.0 → 0.13.0

package/dist/lib/redaction/pii-detection-layer.js

@@ -1,183 +0,0 @@
-/**
- * Layer 2: PII Detection (Story 2.1)
- */
-/**
- * Luhn algorithm for credit card validation.
- */
-function luhnCheck(digits) {
-    const nums = digits.replace(/\D/g, '');
-    if (nums.length < 13 || nums.length > 19)
-        return false;
-    let sum = 0;
-    let alternate = false;
-    for (let i = nums.length - 1; i >= 0; i--) {
-        let n = parseInt(nums[i], 10);
-        if (alternate) {
-            n *= 2;
-            if (n > 9)
-                n -= 9;
-        }
-        sum += n;
-        alternate = !alternate;
-    }
-    return sum % 10 === 0;
-}
-export const PII_PATTERNS = [
-    {
-        name: 'email',
-        category: 'email',
-        regex: /[a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}/g,
-        replacement: '[EMAIL]',
-        confidence: 0.95,
-    },
-    {
-        name: 'ssn_dashed',
-        category: 'ssn',
-        regex: /\b\d{3}-\d{2}-\d{4}\b/g,
-        replacement: '[SSN]',
-        confidence: 0.95,
-    },
-    {
-        name: 'ssn_plain',
-        category: 'ssn',
-        regex: /\b(?<!\d)(?!000|666|9\d\d)\d{3}(?!00)\d{2}(?!0000)\d{4}(?!\d)\b/g,
-        replacement: '[SSN]',
-        confidence: 0.70,
-        validate: (match) => {
-            const digits = match.replace(/\D/g, '');
-            // Must be exactly 9 digits, not all same, not sequential
-            return digits.length === 9 && !/^(\d)\1{8}$/.test(digits);
-        },
-    },
-    {
-        name: 'credit_card_16',
-        category: 'credit_card',
-        regex: /\b\d{4}[-\s]?\d{4}[-\s]?\d{4}[-\s]?\d{4}\b/g,
-        replacement: '[CREDIT_CARD]',
-        confidence: 0.90,
-        validate: (match) => luhnCheck(match),
-    },
-    {
-        name: 'credit_card_amex',
-        category: 'credit_card',
-        regex: /\b3[47]\d{2}[-\s]?\d{6}[-\s]?\d{5}\b/g,
-        replacement: '[CREDIT_CARD]',
-        confidence: 0.90,
-        validate: (match) => luhnCheck(match),
-    },
-    {
-        name: 'phone_us',
-        category: 'phone',
-        regex: /(?:\+?1[-.\s])?\(?\d{3}\)?[-.\s]\d{3}[-.\s]\d{4}\b/g,
-        replacement: '[PHONE]',
-        confidence: 0.85,
-    },
-    {
-        name: 'phone_international',
-        category: 'phone',
-        regex: /\+\d{1,3}[-.\s]?\d{1,4}[-.\s]?\d{2,4}[-.\s]?\d{2,4}[-.\s]?\d{0,4}\b/g,
-        replacement: '[PHONE]',
-        confidence: 0.80,
-    },
-    {
-        name: 'ip_address_v4',
-        category: 'ip_address',
-        regex: /\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b/g,
-        replacement: '[IP_ADDRESS]',
-        confidence: 0.80,
-    },
-    {
-        name: 'ip_address_v6',
-        category: 'ip_address',
-        regex: /\b(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}\b/g,
-        replacement: '[IP_ADDRESS]',
-        confidence: 0.80,
-    },
-    {
-        name: 'ip_address_v6_compressed',
-        category: 'ip_address',
-        regex: /\b(?:[0-9a-fA-F]{1,4}:){1,6}(?::[0-9a-fA-F]{1,4}){1,6}\b/g,
-        replacement: '[IP_ADDRESS]',
-        confidence: 0.75,
-    },
-    {
-        name: 'ip_address_v4_mapped_v6',
-        category: 'ip_address',
-        regex: /::ffff:\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b/g,
-        replacement: '[IP_ADDRESS]',
-        confidence: 0.80,
-    },
-];
-export class PIIDetectionLayer {
-    presidio;
-    name = 'pii_detection';
-    order = 200;
-    constructor(presidio) {
-        this.presidio = presidio;
-    }
-    async process(input, _context) {
-        const findings = [];
-        const allMatches = [];
-        // Regex-based detection
-        for (const pattern of PII_PATTERNS) {
-            const regex = new RegExp(pattern.regex.source, pattern.regex.flags);
-            let match;
-            while ((match = regex.exec(input)) !== null) {
-                if (pattern.validate && !pattern.validate(match[0]))
-                    continue;
-                allMatches.push({
-                    start: match.index,
-                    end: match.index + match[0].length,
-                    replacement: pattern.replacement,
-                    category: pattern.category,
-                    confidence: pattern.confidence,
-                });
-            }
-        }
-        // Optional Presidio NER
-        if (this.presidio) {
-            const entities = await this.presidio.analyze(input);
-            for (const entity of entities) {
-                const alreadyCovered = allMatches.some(m => m.start <= entity.start && m.end >= entity.end);
-                if (!alreadyCovered) {
-                    allMatches.push({
-                        start: entity.start,
-                        end: entity.end,
-                        replacement: `[${entity.entityType}]`,
-                        category: entity.entityType.toLowerCase(),
-                        confidence: entity.score,
-                    });
-                }
-            }
-        }
-        // Sort descending by start for safe replacement
-        allMatches.sort((a, b) => b.start - a.start);
-        // Deduplicate overlapping
-        const deduped = [];
-        for (const m of allMatches) {
-            if (!deduped.some(d => m.start < d.end && m.end > d.start)) {
-                deduped.push(m);
-            }
-        }
-        let output = input;
-        // Record findings in ascending order
-        const ascending = [...deduped].sort((a, b) => a.start - b.start);
-        for (const m of ascending) {
-            findings.push({
-                layer: 'pii_detection',
-                category: m.category,
-                originalLength: m.end - m.start,
-                replacement: m.replacement,
-                startOffset: m.start,
-                endOffset: m.end,
-                confidence: m.confidence,
-            });
-        }
-        // Apply replacements descending
-        for (const m of deduped) {
-            output = output.slice(0, m.start) + m.replacement + output.slice(m.end);
-        }
-        return { output, findings, blocked: false };
-    }
-}
-//# sourceMappingURL=pii-detection-layer.js.map

package/dist/lib/redaction/pii-detection-layer.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"pii-detection-layer.js","sourceRoot":"","sources":["../../../src/lib/redaction/pii-detection-layer.ts"],"names":[],"mappings":"AAAA;;GAEG;AAkBH;;GAEG;AACH,SAAS,SAAS,CAAC,MAAc;IAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvC,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IACvD,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9B,IAAI,SAAS,EAAE,CAAC;YACd,CAAC,IAAI,CAAC,CAAC;YACP,IAAI,CAAC,GAAG,CAAC;gBAAE,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;QACD,GAAG,IAAI,CAAC,CAAC;QACT,SAAS,GAAG,CAAC,SAAS,CAAC;IACzB,CAAC;IACD,OAAO,GAAG,GAAG,EAAE,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAiB;IACxC;QACE,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,mDAAmD;QAC1D,WAAW,EAAE,SAAS;QACtB,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,KAAK;QACf,KAAK,EAAE,wBAAwB;QAC/B,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,KAAK;QACf,KAAK,EAAE,kEAAkE;QACzE,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE;YAClB,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACxC,yDAAyD;YACzD,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5D,CAAC;KACF;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,aAAa;QACvB,KAAK,EAAE,6CAA6C;QACpD,WAAW,EAAE,eAAe;QAC5B,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC;KACtC;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,aAAa;QACvB,KAAK,EAAE,uCAAuC;QAC9C,WAAW,EAAE,eAAe;QAC5B,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC;KACtC;IACD;QACE,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,qDAAqD;QAC5D,WAAW,EAAE,SAAS;QACtB,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,sEAAsE;QAC7E,WAAW,EAAE,SAAS;QACtB,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,YAAY;QACtB,KAAK,EAAE,yCAAyC;QAChD,WAAW,EAAE,cAAc;QAC3B,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,YAAY;QACtB,KAAK,EAAE,+CAA+C;QACtD,WAAW,EAAE,cAAc;QAC3B,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,QAAQ,EAAE,YAAY;QACtB,KAAK,EAAE,2DAA2D;QAClE,WAAW,EAAE,cAAc;QAC3B,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,QAAQ,EAAE,YAAY;QACtB,KAAK,EAAE,8CAA8C;QACrD,WAAW,EAAE,cAAc;QAC3B,UAAU,EAAE,IAAI;KACjB;CACF,CAAC;AAYF,MAAM,OAAO,iBAAiB;IAIC;IAHpB,IAAI,GAAG,eAAwB,CAAC;IAChC,KAAK,GAAG,GAAG,CAAC;IAErB,YAA6B,QAA2B;QAA3B,aAAQ,GAAR,QAAQ,CAAmB;IAAG,CAAC;IAE5D,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,QAA0B;QACrD,MAAM,QAAQ,GAAuB,EAAE,CAAC;QACxC,MAAM,UAAU,GAMX,EAAE,CAAC;QAER,wBAAwB;QACxB,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACpE,IAAI,KAA6B,CAAC;YAClC,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC5C,IAAI,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;oBAAE,SAAS;gBAC9D,UAAU,CAAC,IAAI,CAAC;oBACd,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,GAAG,EAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM;oBAClC,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;iBAC/B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,wBAAwB;QACxB,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACpD,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;gBAC9B,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CACpC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,CACpD,CAAC;gBACF,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,UAAU,CAAC,IAAI,CAAC;wBACd,KAAK,EAAE,MAAM,CAAC,KAAK;wBACnB,GAAG,EAAE,MAAM,CAAC,GAAG;wBACf,WAAW,EAAE,IAAI,MAAM,CAAC,UAAU,GAAG;wBACrC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE;wBACzC,UAAU,EAAE,MAAM,CAAC,KAAK;qBACzB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,gDAAgD;QAChD,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QAE7C,0BAA0B;QAC1B,MAAM,OAAO,GAAsB,EAAE,CAAC;QACtC,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,qCAAqC;QACrC,MAAM,SAAS,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACjE,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,eAAe;gBACtB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,cAAc,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK;gBAC/B,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,WAAW,EAAE,CAAC,CAAC,KAAK;gBACpB,SAAS,EAAE,CAAC,CAAC,GAAG;gBAChB,UAAU,EAAE,CAAC,CAAC,UAAU;aACzB,CAAC,CAAC;QACL,CAAC;QAED,gCAAgC;QAChC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC1E,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC9C,CAAC;CACF"}

package/dist/lib/redaction/pipeline.d.ts

@@ -1,26 +0,0 @@
-/**
- * Redaction Pipeline Orchestrator (Story 2.3)
- */
-import type { RedactionLayer, RedactionContext, RedactionResult, RawLessonContent } from '@agentlensai/core';
-import { type PresidioProvider } from './pii-detection-layer.js';
-import { type ReviewQueueStore } from './human-review-layer.js';
-export interface RedactionPipelineConfig {
-    humanReviewEnabled?: boolean;
-    reviewQueueStore?: ReviewQueueStore;
-    presidioProvider?: PresidioProvider;
-    publicDomainAllowlist?: string[];
-}
-export declare class RedactionPipeline {
-    private layers;
-    constructor(config?: RedactionPipelineConfig, customLayers?: RedactionLayer[]);
-    getLayers(): readonly RedactionLayer[];
-    /**
-     * Register a custom redaction layer at runtime.
-     * The layer is inserted at the correct position based on its `order` field.
-     * Multiple custom layers are supported.
-     * Plugin errors trigger fail-closed behavior (same as built-in layers).
-     */
-    registerCustomLayer(layer: RedactionLayer): void;
-    process(raw: RawLessonContent, ctx: RedactionContext): Promise<RedactionResult>;
-}
-//# sourceMappingURL=pipeline.d.ts.map

package/dist/lib/redaction/pipeline.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"pipeline.d.ts","sourceRoot":"","sources":["../../../src/lib/redaction/pipeline.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACV,cAAc,EAEd,gBAAgB,EAChB,eAAe,EAEf,gBAAgB,EACjB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAIpF,OAAO,EAAoB,KAAK,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAElF,MAAM,WAAW,uBAAuB;IACtC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;CAClC;AAED,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,MAAM,CAAmB;gBAG/B,MAAM,GAAE,uBAA4B,EACpC,YAAY,CAAC,EAAE,cAAc,EAAE;IAqBjC,SAAS,IAAI,SAAS,cAAc,EAAE;IAItC;;;;;OAKG;IACH,mBAAmB,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI;IAK1C,OAAO,CAAC,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;CAuDtF"}

package/dist/lib/redaction/pipeline.js

@@ -1,91 +0,0 @@
-/**
- * Redaction Pipeline Orchestrator (Story 2.3)
- */
-import { createRedactedLessonContent, REDACTION_PIPELINE_KEY } from '@agentlensai/core';
-import { SecretDetectionLayer } from './secret-detection-layer.js';
-import { PIIDetectionLayer } from './pii-detection-layer.js';
-import { UrlPathScrubbingLayer } from './url-path-scrubbing-layer.js';
-import { TenantDeidentificationLayer } from './tenant-deidentification-layer.js';
-import { SemanticDenyListLayer } from './semantic-denylist-layer.js';
-import { HumanReviewLayer } from './human-review-layer.js';
-export class RedactionPipeline {
-    layers;
-    constructor(config = {}, customLayers) {
-        const defaultLayers = [
-            new SecretDetectionLayer(),
-            new PIIDetectionLayer(config.presidioProvider),
-            new UrlPathScrubbingLayer(config.publicDomainAllowlist),
-            new TenantDeidentificationLayer(),
-            new SemanticDenyListLayer(),
-            new HumanReviewLayer(config.humanReviewEnabled ?? false, config.reviewQueueStore),
-        ];
-        if (customLayers) {
-            defaultLayers.push(...customLayers);
-        }
-        this.layers = defaultLayers.sort((a, b) => a.order - b.order);
-    }
-    getLayers() {
-        return this.layers;
-    }
-    /**
-     * Register a custom redaction layer at runtime.
-     * The layer is inserted at the correct position based on its `order` field.
-     * Multiple custom layers are supported.
-     * Plugin errors trigger fail-closed behavior (same as built-in layers).
-     */
-    registerCustomLayer(layer) {
-        this.layers.push(layer);
-        this.layers.sort((a, b) => a.order - b.order);
-    }
-    async process(raw, ctx) {
-        // Combine title and content for processing
-        let text = `${raw.title}\n---\n${raw.content}`;
-        const allFindings = [];
-        for (const layer of this.layers) {
-            let result;
-            try {
-                result = await layer.process(text, ctx);
-            }
-            catch (error) {
-                // FAIL-CLOSED: any layer error blocks the lesson
-                return {
-                    status: 'error',
-                    error: error instanceof Error ? error.message : String(error),
-                    layer: layer.name,
-                };
-            }
-            if (result.blocked) {
-                // Check for pending_review special case
-                if (result.blockReason?.startsWith('pending_review:')) {
-                    const reviewId = result.blockReason.split(':')[1];
-                    return { status: 'pending_review', reviewId };
-                }
-                return {
-                    status: 'blocked',
-                    reason: result.blockReason ?? 'Blocked by redaction layer',
-                    layer: layer.name,
-                };
-            }
-            text = result.output;
-            allFindings.push(...result.findings);
-        }
-        // Split back into title and content
-        const separatorIndex = text.indexOf('\n---\n');
-        let title;
-        let content;
-        if (separatorIndex !== -1) {
-            title = text.slice(0, separatorIndex);
-            content = text.slice(separatorIndex + 5);
-        }
-        else {
-            title = text;
-            content = '';
-        }
-        return {
-            status: 'redacted',
-            content: createRedactedLessonContent(title, content, {}, REDACTION_PIPELINE_KEY), // context always stripped
-            findings: allFindings,
-        };
-    }
-}
-//# sourceMappingURL=pipeline.js.map

package/dist/lib/redaction/pipeline.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"pipeline.js","sourceRoot":"","sources":["../../../src/lib/redaction/pipeline.ts"],"names":[],"mappings":"AAAA;;GAEG;AAUH,OAAO,EAAE,2BAA2B,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AACxF,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAyB,MAAM,0BAA0B,CAAC;AACpF,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAyB,MAAM,yBAAyB,CAAC;AASlF,MAAM,OAAO,iBAAiB;IACpB,MAAM,CAAmB;IAEjC,YACE,SAAkC,EAAE,EACpC,YAA+B;QAE/B,MAAM,aAAa,GAAqB;YACtC,IAAI,oBAAoB,EAAE;YAC1B,IAAI,iBAAiB,CAAC,MAAM,CAAC,gBAAgB,CAAC;YAC9C,IAAI,qBAAqB,CAAC,MAAM,CAAC,qBAAqB,CAAC;YACvD,IAAI,2BAA2B,EAAE;YACjC,IAAI,qBAAqB,EAAE;YAC3B,IAAI,gBAAgB,CAClB,MAAM,CAAC,kBAAkB,IAAI,KAAK,EAClC,MAAM,CAAC,gBAAgB,CACxB;SACF,CAAC;QAEF,IAAI,YAAY,EAAE,CAAC;YACjB,aAAa,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;QACtC,CAAC;QAED,IAAI,CAAC,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IAChE,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;;;;OAKG;IACH,mBAAmB,CAAC,KAAqB;QACvC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAqB,EAAE,GAAqB;QACxD,2CAA2C;QAC3C,IAAI,IAAI,GAAG,GAAG,GAAG,CAAC,KAAK,UAAU,GAAG,CAAC,OAAO,EAAE,CAAC;QAC/C,MAAM,WAAW,GAAuB,EAAE,CAAC;QAE3C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,IAAI,MAAM,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC1C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,iDAAiD;gBACjD,OAAO;oBACL,MAAM,EAAE,OAAO;oBACf,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;oBAC7D,KAAK,EAAE,KAAK,CAAC,IAA0B;iBACxC,CAAC;YACJ,CAAC;YAED,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,wCAAwC;gBACxC,IAAI,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;oBACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;oBAClD,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CAAC;gBAChD,CAAC;gBAED,OAAO;oBACL,MAAM,EAAE,SAAS;oBACjB,MAAM,EAAE,MAAM,CAAC,WAAW,IAAI,4BAA4B;oBAC1D,KAAK,EAAE,KAAK,CAAC,IAA0B;iBACxC,CAAC;YACJ,CAAC;YAED,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC;YACrB,WAAW,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;QAED,oCAAoC;QACpC,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,KAAa,CAAC;QAClB,IAAI,OAAe,CAAC;QAEpB,IAAI,cAAc,KAAK,CAAC,CAAC,EAAE,CAAC;YAC1B,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;YACtC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,KAAK,GAAG,IAAI,CAAC;YACb,OAAO,GAAG,EAAE,CAAC;QACf,CAAC;QAED,OAAO;YACL,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,2BAA2B,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,sBAAsB,CAAC,EAAE,0BAA0B;YAC5G,QAAQ,EAAE,WAAW;SACtB,CAAC;IACJ,CAAC;CACF"}

package/dist/lib/redaction/secret-detection-layer.d.ts

@@ -1,10 +0,0 @@
-/**
- * Layer 1: Secret Detection (Story 2.1)
- */
-import type { RedactionLayer, RedactionLayerResult, RedactionContext } from '@agentlensai/core';
-export declare class SecretDetectionLayer implements RedactionLayer {
-    readonly name: "secret_detection";
-    readonly order = 100;
-    process(input: string, _context: RedactionContext): RedactionLayerResult;
-}
-//# sourceMappingURL=secret-detection-layer.d.ts.map

package/dist/lib/redaction/secret-detection-layer.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"secret-detection-layer.d.ts","sourceRoot":"","sources":["../../../src/lib/redaction/secret-detection-layer.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,oBAAoB,EACpB,gBAAgB,EAEjB,MAAM,mBAAmB,CAAC;AAG3B,qBAAa,oBAAqB,YAAW,cAAc;IACzD,QAAQ,CAAC,IAAI,EAAG,kBAAkB,CAAU;IAC5C,QAAQ,CAAC,KAAK,OAAO;IAErB,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB,GAAG,oBAAoB;CAyFzE"}

package/dist/lib/redaction/secret-detection-layer.js

@@ -1,79 +0,0 @@
-/**
- * Layer 1: Secret Detection (Story 2.1)
- */
-import { ACTIVE_SECRET_PATTERNS, detectHighEntropyStrings } from './secret-patterns.js';
-export class SecretDetectionLayer {
-    name = 'secret_detection';
-    order = 100;
-    process(input, _context) {
-        const findings = [];
-        let output = input;
-        let secretIndex = 0;
-        // Collect all matches with their positions (work on original input for offsets)
-        const allMatches = [];
-        // Regex-based detection
-        for (const pattern of ACTIVE_SECRET_PATTERNS) {
-            const globalRegex = new RegExp(pattern.regex.source, pattern.regex.flags + (pattern.regex.flags.includes('g') ? '' : 'g'));
-            let match;
-            while ((match = globalRegex.exec(input)) !== null) {
-                allMatches.push({
-                    start: match.index,
-                    end: match.index + match[0].length,
-                    category: pattern.category,
-                    confidence: pattern.confidence,
-                    patternName: pattern.name,
-                });
-            }
-        }
-        // High-entropy detection
-        const entropyMatches = detectHighEntropyStrings(input);
-        for (const em of entropyMatches) {
-            // Skip if already covered by a regex match
-            const alreadyCovered = allMatches.some(m => m.start <= em.start && m.end >= em.end);
-            if (!alreadyCovered) {
-                allMatches.push({
-                    start: em.start,
-                    end: em.end,
-                    category: 'high_entropy_string',
-                    confidence: Math.min(0.6 + (em.entropy - 4.5) * 0.1, 0.9),
-                    patternName: 'entropy_detection',
-                });
-            }
-        }
-        // Sort by start position descending to replace from end (preserves offsets)
-        allMatches.sort((a, b) => b.start - a.start);
-        // Deduplicate overlapping matches (keep highest confidence)
-        const deduped = [];
-        for (const m of allMatches) {
-            const overlaps = deduped.some(d => m.start < d.end && m.end > d.start);
-            if (!overlaps) {
-                deduped.push(m);
-            }
-        }
-        // Sort ascending for findings reporting, but replace descending
-        const sortedForFindings = [...deduped].sort((a, b) => a.start - b.start);
-        const replacements = new Map();
-        for (const m of sortedForFindings) {
-            secretIndex++;
-            const replacement = `[SECRET_REDACTED_${secretIndex}]`;
-            replacements.set(m, replacement);
-            findings.push({
-                layer: 'secret_detection',
-                category: m.category,
-                originalLength: m.end - m.start,
-                replacement,
-                startOffset: m.start,
-                endOffset: m.end,
-                confidence: m.confidence,
-            });
-        }
-        // Apply replacements from end to start
-        const descending = [...deduped].sort((a, b) => b.start - a.start);
-        for (const m of descending) {
-            const replacement = replacements.get(m);
-            output = output.slice(0, m.start) + replacement + output.slice(m.end);
-        }
-        return { output, findings, blocked: false };
-    }
-}
-//# sourceMappingURL=secret-detection-layer.js.map

package/dist/lib/redaction/secret-detection-layer.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"secret-detection-layer.js","sourceRoot":"","sources":["../../../src/lib/redaction/secret-detection-layer.ts"],"names":[],"mappings":"AAAA;;GAEG;AAQH,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAExF,MAAM,OAAO,oBAAoB;IACtB,IAAI,GAAG,kBAA2B,CAAC;IACnC,KAAK,GAAG,GAAG,CAAC;IAErB,OAAO,CAAC,KAAa,EAAE,QAA0B;QAC/C,MAAM,QAAQ,GAAuB,EAAE,CAAC;QACxC,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,IAAI,WAAW,GAAG,CAAC,CAAC;QAEpB,gFAAgF;QAChF,MAAM,UAAU,GAMX,EAAE,CAAC;QAER,wBAAwB;QACxB,KAAK,MAAM,OAAO,IAAI,sBAAsB,EAAE,CAAC;YAC7C,MAAM,WAAW,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3H,IAAI,KAA6B,CAAC;YAClC,OAAO,CAAC,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAClD,UAAU,CAAC,IAAI,CAAC;oBACd,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,GAAG,EAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM;oBAClC,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,WAAW,EAAE,OAAO,CAAC,IAAI;iBAC1B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,yBAAyB;QACzB,MAAM,cAAc,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC;QACvD,KAAK,MAAM,EAAE,IAAI,cAAc,EAAE,CAAC;YAChC,2CAA2C;YAC3C,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CACpC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,CAC5C,CAAC;YACF,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,UAAU,CAAC,IAAI,CAAC;oBACd,KAAK,EAAE,EAAE,CAAC,KAAK;oBACf,GAAG,EAAE,EAAE,CAAC,GAAG;oBACX,QAAQ,EAAE,qBAAqB;oBAC/B,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,GAAG,EAAE,GAAG,CAAC;oBACzD,WAAW,EAAE,mBAAmB;iBACjC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,4EAA4E;QAC5E,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QAE7C,4DAA4D;QAC5D,MAAM,OAAO,GAAsB,EAAE,CAAC;QACtC,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAC3B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,CACxC,CAAC;YACF,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,gEAAgE;QAChE,MAAM,iBAAiB,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACzE,MAAM,YAAY,GAAG,IAAI,GAAG,EAAgC,CAAC;QAE7D,KAAK,MAAM,CAAC,IAAI,iBAAiB,EAAE,CAAC;YAClC,WAAW,EAAE,CAAC;YACd,MAAM,WAAW,GAAG,oBAAoB,WAAW,GAAG,CAAC;YACvD,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;YACjC,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,kBAAkB;gBACzB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,cAAc,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK;gBAC/B,WAAW;gBACX,WAAW,EAAE,CAAC,CAAC,KAAK;gBACpB,SAAS,EAAE,CAAC,CAAC,GAAG;gBAChB,UAAU,EAAE,CAAC,CAAC,UAAU;aACzB,CAAC,CAAC;QACL,CAAC;QAED,uCAAuC;QACvC,MAAM,UAAU,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QAClE,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,MAAM,WAAW,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC;YACzC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACxE,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC9C,CAAC;CACF"}

package/dist/lib/redaction/secret-patterns.d.ts

@@ -1,29 +0,0 @@
-/**
- * Secret Detection Patterns & Entropy Calculator (Story 2.1, Layer 1)
- */
-export interface SecretPattern {
-    name: string;
-    category: string;
-    regex: RegExp;
-    confidence: number;
-}
-export declare const SECRET_PATTERNS: SecretPattern[];
-export declare const ACTIVE_SECRET_PATTERNS: SecretPattern[];
-/**
- * Shannon entropy of a string (bits per character).
- */
-export declare function shannonEntropy(s: string): number;
-/**
- * Detect high-entropy strings that may be unknown secrets.
- * Scans with a sliding window approach.
- */
-export declare function detectHighEntropyStrings(text: string, options?: {
-    minLength?: number;
-    maxLength?: number;
-    entropyThreshold?: number;
-}): Array<{
-    start: number;
-    end: number;
-    entropy: number;
-}>;
-//# sourceMappingURL=secret-patterns.d.ts.map

package/dist/lib/redaction/secret-patterns.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"secret-patterns.d.ts","sourceRoot":"","sources":["../../../src/lib/redaction/secret-patterns.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,eAAe,EAAE,aAAa,EA0G1C,CAAC;AAGF,eAAO,MAAM,sBAAsB,iBAAmD,CAAC;AAEvF;;GAEG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAYhD;AAMD;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAO,GAClF,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CA6BxD"}

package/dist/lib/redaction/secret-patterns.js

@@ -1,133 +0,0 @@
-/**
- * Secret Detection Patterns & Entropy Calculator (Story 2.1, Layer 1)
- */
-export const SECRET_PATTERNS = [
-    // ─── OpenAI ─────────────────────────────────────────
-    { name: 'openai_api_key', category: 'api_key', regex: /sk-[a-zA-Z0-9]{20,}/, confidence: 0.95 },
-    { name: 'openai_org', category: 'api_key', regex: /org-[a-zA-Z0-9]{20,}/, confidence: 0.85 },
-    // ─── Anthropic ──────────────────────────────────────
-    { name: 'anthropic_api_key', category: 'api_key', regex: /sk-ant-[a-zA-Z0-9\-]{20,}/, confidence: 0.95 },
-    // ─── GitHub ─────────────────────────────────────────
-    { name: 'github_pat', category: 'api_key', regex: /ghp_[a-zA-Z0-9]{36}/, confidence: 0.95 },
-    { name: 'github_oauth', category: 'api_key', regex: /gho_[a-zA-Z0-9]{36}/, confidence: 0.95 },
-    { name: 'github_app_token', category: 'api_key', regex: /(?:ghu|ghs|ghr)_[a-zA-Z0-9]{36}/, confidence: 0.95 },
-    // ─── AWS ────────────────────────────────────────────
-    { name: 'aws_access_key', category: 'api_key', regex: /AKIA[0-9A-Z]{16}/, confidence: 0.95 },
-    { name: 'aws_secret_key', category: 'api_key', regex: /(?:aws_secret_access_key|AWS_SECRET_ACCESS_KEY)\s*[=:]\s*[A-Za-z0-9/+=]{40}/, confidence: 0.95 },
-    // ─── Stripe ─────────────────────────────────────────
-    { name: 'stripe_live_key', category: 'api_key', regex: /sk_live_[a-zA-Z0-9]{20,}/, confidence: 0.95 },
-    { name: 'stripe_test_key', category: 'api_key', regex: /sk_test_[a-zA-Z0-9]{20,}/, confidence: 0.90 },
-    { name: 'stripe_publishable', category: 'api_key', regex: /pk_(?:live|test)_[a-zA-Z0-9]{20,}/, confidence: 0.90 },
-    { name: 'stripe_restricted', category: 'api_key', regex: /rk_(?:live|test)_[a-zA-Z0-9]{20,}/, confidence: 0.90 },
-    // ─── Slack ──────────────────────────────────────────
-    { name: 'slack_token', category: 'api_key', regex: /xox[bpras]-[a-zA-Z0-9\-]+/, confidence: 0.95 },
-    { name: 'slack_webhook', category: 'api_key', regex: /https:\/\/hooks\.slack\.com\/services\/T[a-zA-Z0-9_]+\/B[a-zA-Z0-9_]+\/[a-zA-Z0-9_]+/, confidence: 0.95 },
-    // ─── Google ─────────────────────────────────────────
-    { name: 'google_api_key', category: 'api_key', regex: /AIza[0-9A-Za-z\-_]{35}/, confidence: 0.90 },
-    { name: 'google_oauth_client', category: 'api_key', regex: /[0-9]+-[a-z0-9_]{32}\.apps\.googleusercontent\.com/, confidence: 0.90 },
-    // ─── Azure ──────────────────────────────────────────
-    { name: 'azure_subscription', category: 'api_key', regex: /[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}/, confidence: 0.3 },
-    // ─── Twilio ─────────────────────────────────────────
-    { name: 'twilio_api_key', category: 'api_key', regex: /SK[a-f0-9]{32}/, confidence: 0.85 },
-    { name: 'twilio_account_sid', category: 'api_key', regex: /AC[a-f0-9]{32}/, confidence: 0.85 },
-    // ─── SendGrid ───────────────────────────────────────
-    { name: 'sendgrid_api_key', category: 'api_key', regex: /SG\.[a-zA-Z0-9_\-]{22}\.[a-zA-Z0-9_\-]{43}/, confidence: 0.95 },
-    // ─── Mailgun ────────────────────────────────────────
-    { name: 'mailgun_api_key', category: 'api_key', regex: /key-[a-zA-Z0-9]{32}/, confidence: 0.85 },
-    // ─── Heroku ─────────────────────────────────────────
-    { name: 'heroku_api_key', category: 'api_key', regex: /[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}/, confidence: 0.3 },
-    // ─── npm ────────────────────────────────────────────
-    { name: 'npm_token', category: 'api_key', regex: /npm_[a-zA-Z0-9]{36}/, confidence: 0.95 },
-    // ─── PyPI ───────────────────────────────────────────
-    { name: 'pypi_token', category: 'api_key', regex: /pypi-[a-zA-Z0-9\-_]{50,}/, confidence: 0.95 },
-    // ─── Discord ────────────────────────────────────────
-    { name: 'discord_token', category: 'api_key', regex: /[MN][A-Za-z\d]{23,}\.[\w-]{6}\.[\w-]{27,}/, confidence: 0.90 },
-    { name: 'discord_webhook', category: 'api_key', regex: /https:\/\/discord(?:app)?\.com\/api\/webhooks\/\d+\/[\w-]+/, confidence: 0.95 },
-    // ─── Telegram ───────────────────────────────────────
-    { name: 'telegram_bot_token', category: 'api_key', regex: /\d{8,10}:[A-Za-z0-9_-]{35}/, confidence: 0.85 },
-    // ─── Bearer / Basic Auth ────────────────────────────
-    { name: 'bearer_token', category: 'auth_token', regex: /Bearer\s+[a-zA-Z0-9._~+\/=-]{20,}/, confidence: 0.90 },
-    { name: 'basic_auth', category: 'auth_token', regex: /Basic\s+[a-zA-Z0-9+\/=]{10,}/, confidence: 0.90 },
-    // ─── URL with credentials ──────────────────────────
-    { name: 'url_password', category: 'auth_token', regex: /\/\/[^:\/\s]+:[^@\/\s]+@[^\/\s]+/, confidence: 0.95 },
-    // ─── Private Keys ──────────────────────────────────
-    { name: 'private_key', category: 'private_key', regex: /-----BEGIN\s+(?:RSA\s+|EC\s+|DSA\s+|OPENSSH\s+)?PRIVATE KEY-----/, confidence: 0.99 },
-    // ─── Connection Strings ─────────────────────────────
-    { name: 'connection_string', category: 'connection_string', regex: /(?:mongodb(?:\+srv)?|postgres(?:ql)?|mysql|redis|amqp|mssql):\/\/[^\s]+/, confidence: 0.90 },
-    // ─── JWT ────────────────────────────────────────────
-    { name: 'jwt', category: 'auth_token', regex: /eyJ[a-zA-Z0-9_-]{10,}\.eyJ[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]{10,}/, confidence: 0.85 },
-    // ─── HashiCorp Vault ────────────────────────────────
-    { name: 'vault_token', category: 'api_key', regex: /hvs\.[a-zA-Z0-9_-]{24,}/, confidence: 0.90 },
-    // ─── Datadog ────────────────────────────────────────
-    { name: 'datadog_api_key', category: 'api_key', regex: /dd[a-f0-9]{40}/, confidence: 0.80 },
-    // ─── Supabase ───────────────────────────────────────
-    { name: 'supabase_key', category: 'api_key', regex: /sbp_[a-f0-9]{40}/, confidence: 0.90 },
-    // ─── Vercel ─────────────────────────────────────────
-    { name: 'vercel_token', category: 'api_key', regex: /vercel_[a-zA-Z0-9]{24,}/, confidence: 0.90 },
-    // ─── Linear ─────────────────────────────────────────
-    { name: 'linear_api_key', category: 'api_key', regex: /lin_api_[a-zA-Z0-9]{40,}/, confidence: 0.90 },
-    // ─── Shopify ────────────────────────────────────────
-    { name: 'shopify_token', category: 'api_key', regex: /shpat_[a-fA-F0-9]{32}/, confidence: 0.90 },
-    { name: 'shopify_secret', category: 'api_key', regex: /shpss_[a-fA-F0-9]{32}/, confidence: 0.90 },
-    // ─── Cloudflare ─────────────────────────────────────
-    { name: 'cloudflare_api_token', category: 'api_key', regex: /[a-zA-Z0-9_]{40}/, confidence: 0.2 }, // low confidence - too generic alone
-    // ─── Generic password assignment ────────────────────
-    { name: 'password_assignment', category: 'password', regex: /(?:password|passwd|pwd|secret|token|api_key|apikey)['"]?\s*[=:]\s*['"]?[^\s'"<>]{8,}['"]?/i, confidence: 0.80 },
-    // XML-style password: <password>value</password>
-    { name: 'xml_password', category: 'password', regex: /<(?:password|secret|token|api[_-]?key)>([^<]{8,})<\//i, confidence: 0.80 },
-    // SQL PASSWORD keyword: PASSWORD 'value'
-    { name: 'sql_password', category: 'password', regex: /PASSWORD\s+['"]([^'"]{8,})['"]/i, confidence: 0.80 },
-];
-// Only use patterns with confidence >= threshold (skip very generic ones)
-export const ACTIVE_SECRET_PATTERNS = SECRET_PATTERNS.filter(p => p.confidence >= 0.5);
-/**
- * Shannon entropy of a string (bits per character).
- */
-export function shannonEntropy(s) {
-    if (s.length === 0)
-        return 0;
-    const freq = new Map();
-    for (const c of s) {
-        freq.set(c, (freq.get(c) ?? 0) + 1);
-    }
-    let entropy = 0;
-    for (const count of freq.values()) {
-        const p = count / s.length;
-        entropy -= p * Math.log2(p);
-    }
-    return entropy;
-}
-// Hex and base64 character sets for entropy detection
-const HEX_RE = /^[a-fA-F0-9]+$/;
-const BASE64_RE = /^[a-zA-Z0-9+\/=_-]+$/;
-/**
- * Detect high-entropy strings that may be unknown secrets.
- * Scans with a sliding window approach.
- */
-export function detectHighEntropyStrings(text, options = {}) {
-    const minLen = options.minLength ?? 20;
-    const maxLen = options.maxLength ?? 128;
-    const threshold = options.entropyThreshold ?? 4.5;
-    const results = [];
-    // Find candidate tokens (non-whitespace sequences)
-    const tokenRegex = /[^\s,;:(){}\[\]<>"'`]+/g;
-    let match;
-    while ((match = tokenRegex.exec(text)) !== null) {
-        const token = match[0];
-        if (token.length < minLen || token.length > maxLen)
-            continue;
-        // Only consider hex-like or base64-like strings
-        if (!HEX_RE.test(token) && !BASE64_RE.test(token))
-            continue;
-        const entropy = shannonEntropy(token);
-        if (entropy >= threshold) {
-            results.push({
-                start: match.index,
-                end: match.index + token.length,
-                entropy,
-            });
-        }
-    }
-    return results;
-}
-//# sourceMappingURL=secret-patterns.js.map

package/dist/lib/redaction/secret-patterns.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"secret-patterns.js","sourceRoot":"","sources":["../../../src/lib/redaction/secret-patterns.ts"],"names":[],"mappings":"AAAA;;GAEG;AASH,MAAM,CAAC,MAAM,eAAe,GAAoB;IAC9C,uDAAuD;IACvD,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAE,IAAI,EAAE;IAC/F,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,sBAAsB,EAAE,UAAU,EAAE,IAAI,EAAE;IAE5F,uDAAuD;IACvD,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,2BAA2B,EAAE,UAAU,EAAE,IAAI,EAAE;IAExG,uDAAuD;IACvD,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAE,IAAI,EAAE;IAC3F,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAE,IAAI,EAAE;IAC7F,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,iCAAiC,EAAE,UAAU,EAAE,IAAI,EAAE;IAE7G,uDAAuD;IACvD,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,IAAI,EAAE;IAC5F,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,6EAA6E,EAAE,UAAU,EAAE,IAAI,EAAE;IAEvJ,uDAAuD;IACvD,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,0BAA0B,EAAE,UAAU,EAAE,IAAI,EAAE;IACrG,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,0BAA0B,EAAE,UAAU,EAAE,IAAI,EAAE;IACrG,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,mCAAmC,EAAE,UAAU,EAAE,IAAI,EAAE;IACjH,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,mCAAmC,EAAE,UAAU,EAAE,IAAI,EAAE;IAEhH,uDAAuD;IACvD,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,2BAA2B,EAAE,UAAU,EAAE,IAAI,EAAE;IAClG,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,sFAAsF,EAAE,UAAU,EAAE,IAAI,EAAE;IAE/J,uDAAuD;IACvD,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,wBAAwB,EAAE,UAAU,EAAE,IAAI,EAAE;IAClG,EAAE,IAAI,EAAE,qBAAqB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,oDAAoD,EAAE,UAAU,EAAE,IAAI,EAAE;IAEnI,uDAAuD;IACvD,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,8DAA8D,EAAE,UAAU,EAAE,GAAG,EAAE;IAE3I,uDAAuD;IACvD,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,IAAI,EAAE;IAC1F,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,IAAI,EAAE;IAE9F,uDAAuD;IACvD,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,4CAA4C,EAAE,UAAU,EAAE,IAAI,EAAE;IAExH,uDAAuD;IACvD,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAE,IAAI,EAAE;IAEhG,uDAAuD;IACvD,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,8DAA8D,EAAE,UAAU,EAAE,GAAG,EAAE;IAEvI,uDAAuD;IACvD,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAE,IAAI,EAAE;IAE1F,uDAAuD;IACvD,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,0BAA0B,EAAE,UAAU,EAAE,IAAI,EAAE;IAEhG,uDAAuD;IACvD,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,2CAA2C,EAAE,UAAU,EAAE,IAAI,EAAE;IACpH,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,4DAA4D,EAAE,UAAU,EAAE,IAAI,EAAE;IAEvI,uDAAuD;IACvD,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,4BAA4B,EAAE,UAAU,EAAE,IAAI,EAAE;IAE1G,uDAAuD;IACvD,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,mCAAmC,EAAE,UAAU,EAAE,IAAI,EAAE;IAC9G,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,8BAA8B,EAAE,UAAU,EAAE,IAAI,EAAE;IAEvG,sDAAsD;IACtD,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,kCAAkC,EAAE,UAAU,EAAE,IAAI,EAAE;IAE7G,sDAAsD;IACtD,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,aAAa,EAAE,KAAK,EAAE,kEAAkE,EAAE,UAAU,EAAE,IAAI,EAAE;IAE7I,uDAAuD;IACvD,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,mBAAmB,EAAE,KAAK,EAAE,yEAAyE,EAAE,UAAU,EAAE,IAAI,EAAE;IAEhK,uDAAuD;IACvD,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,kEAAkE,EAAE,UAAU,EAAE,IAAI,EAAE;IAEpI,uDAAuD;IACvD,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,yBAAyB,EAAE,UAAU,EAAE,IAAI,EAAE;IAEhG,uDAAuD;IACvD,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,IAAI,EAAE;IAE3F,uDAAuD;IACvD,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,IAAI,EAAE;IAE1F,uDAAuD;IACvD,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,yBAAyB,EAAE,UAAU,EAAE,IAAI,EAAE;IAEjG,uDAAuD;IACvD,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,0BAA0B,EAAE,UAAU,EAAE,IAAI,EAAE;IAEpG,uDAAuD;IACvD,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,uBAAuB,EAAE,UAAU,EAAE,IAAI,EAAE;IAChG,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,uBAAuB,EAAE,UAAU,EAAE,IAAI,EAAE;IAEjG,uDAAuD;IACvD,EAAE,IAAI,EAAE,sBAAsB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE,qCAAqC;IAExI,uDAAuD;IACvD,EAAE,IAAI,EAAE,qBAAqB,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,4FAA4F,EAAE,UAAU,EAAE,IAAI,EAAE;IAE5K,iDAAiD;IACjD,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,uDAAuD,EAAE,UAAU,EAAE,IAAI,EAAE;IAEhI,yCAAyC;IACzC,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,iCAAiC,EAAE,UAAU,EAAE,IAAI,EAAE;CAC3G,CAAC;AAEF,0EAA0E;AAC1E,MAAM,CAAC,MAAM,sBAAsB,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC;AAEvF;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,CAAS;IACtC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAClB,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC;QAC3B,OAAO,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,sDAAsD;AACtD,MAAM,MAAM,GAAG,gBAAgB,CAAC;AAChC,MAAM,SAAS,GAAG,sBAAsB,CAAC;AAEzC;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,IAAY,EACZ,UAAiF,EAAE;IAEnF,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;IACvC,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,IAAI,GAAG,CAAC;IACxC,MAAM,SAAS,GAAG,OAAO,CAAC,gBAAgB,IAAI,GAAG,CAAC;IAElD,MAAM,OAAO,GAA2D,EAAE,CAAC;IAE3E,mDAAmD;IACnD,MAAM,UAAU,GAAG,yBAAyB,CAAC;IAC7C,IAAI,KAA6B,CAAC;IAElC,OAAO,CAAC,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM;YAAE,SAAS;QAE7D,gDAAgD;QAChD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,SAAS;QAE5D,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,OAAO,IAAI,SAAS,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC;gBACX,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,GAAG,EAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,MAAM;gBAC/B,OAAO;aACR,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/lib/redaction/semantic-denylist-layer.d.ts

@@ -1,10 +0,0 @@
-/**
- * Layer 5: Semantic Deny List (Story 2.2)
- */
-import type { RedactionLayer, RedactionLayerResult, RedactionContext } from '@agentlensai/core';
-export declare class SemanticDenyListLayer implements RedactionLayer {
-    readonly name: "semantic_denylist";
-    readonly order = 500;
-    process(input: string, context: RedactionContext): RedactionLayerResult;
-}
-//# sourceMappingURL=semantic-denylist-layer.d.ts.map

package/dist/lib/redaction/semantic-denylist-layer.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"semantic-denylist-layer.d.ts","sourceRoot":"","sources":["../../../src/lib/redaction/semantic-denylist-layer.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,oBAAoB,EACpB,gBAAgB,EAEjB,MAAM,mBAAmB,CAAC;AAE3B,qBAAa,qBAAsB,YAAW,cAAc;IAC1D,QAAQ,CAAC,IAAI,EAAG,mBAAmB,CAAU;IAC7C,QAAQ,CAAC,KAAK,OAAO;IAErB,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,GAAG,oBAAoB;CA2DxE"}