@agentlensai/server 0.8.0 → 0.9.0

package/dist/lib/redaction/pii-detection-layer.js

@@ -0,0 +1,183 @@
+/**
+ * Layer 2: PII Detection (Story 2.1)
+ */
+/**
+ * Luhn algorithm for credit card validation.
+ */
+function luhnCheck(digits) {
+    const nums = digits.replace(/\D/g, '');
+    if (nums.length < 13 || nums.length > 19)
+        return false;
+    let sum = 0;
+    let alternate = false;
+    for (let i = nums.length - 1; i >= 0; i--) {
+        let n = parseInt(nums[i], 10);
+        if (alternate) {
+            n *= 2;
+            if (n > 9)
+                n -= 9;
+        }
+        sum += n;
+        alternate = !alternate;
+    }
+    return sum % 10 === 0;
+}
+export const PII_PATTERNS = [
+    {
+        name: 'email',
+        category: 'email',
+        regex: /[a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}/g,
+        replacement: '[EMAIL]',
+        confidence: 0.95,
+    },
+    {
+        name: 'ssn_dashed',
+        category: 'ssn',
+        regex: /\b\d{3}-\d{2}-\d{4}\b/g,
+        replacement: '[SSN]',
+        confidence: 0.95,
+    },
+    {
+        name: 'ssn_plain',
+        category: 'ssn',
+        regex: /\b(?<!\d)(?!000|666|9\d\d)\d{3}(?!00)\d{2}(?!0000)\d{4}(?!\d)\b/g,
+        replacement: '[SSN]',
+        confidence: 0.70,
+        validate: (match) => {
+            const digits = match.replace(/\D/g, '');
+            // Must be exactly 9 digits, not all same, not sequential
+            return digits.length === 9 && !/^(\d)\1{8}$/.test(digits);
+        },
+    },
+    {
+        name: 'credit_card_16',
+        category: 'credit_card',
+        regex: /\b\d{4}[-\s]?\d{4}[-\s]?\d{4}[-\s]?\d{4}\b/g,
+        replacement: '[CREDIT_CARD]',
+        confidence: 0.90,
+        validate: (match) => luhnCheck(match),
+    },
+    {
+        name: 'credit_card_amex',
+        category: 'credit_card',
+        regex: /\b3[47]\d{2}[-\s]?\d{6}[-\s]?\d{5}\b/g,
+        replacement: '[CREDIT_CARD]',
+        confidence: 0.90,
+        validate: (match) => luhnCheck(match),
+    },
+    {
+        name: 'phone_us',
+        category: 'phone',
+        regex: /(?:\+?1[-.\s])?\(?\d{3}\)?[-.\s]\d{3}[-.\s]\d{4}\b/g,
+        replacement: '[PHONE]',
+        confidence: 0.85,
+    },
+    {
+        name: 'phone_international',
+        category: 'phone',
+        regex: /\+\d{1,3}[-.\s]?\d{1,4}[-.\s]?\d{2,4}[-.\s]?\d{2,4}[-.\s]?\d{0,4}\b/g,
+        replacement: '[PHONE]',
+        confidence: 0.80,
+    },
+    {
+        name: 'ip_address_v4',
+        category: 'ip_address',
+        regex: /\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b/g,
+        replacement: '[IP_ADDRESS]',
+        confidence: 0.80,
+    },
+    {
+        name: 'ip_address_v6',
+        category: 'ip_address',
+        regex: /\b(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}\b/g,
+        replacement: '[IP_ADDRESS]',
+        confidence: 0.80,
+    },
+    {
+        name: 'ip_address_v6_compressed',
+        category: 'ip_address',
+        regex: /\b(?:[0-9a-fA-F]{1,4}:){1,6}(?::[0-9a-fA-F]{1,4}){1,6}\b/g,
+        replacement: '[IP_ADDRESS]',
+        confidence: 0.75,
+    },
+    {
+        name: 'ip_address_v4_mapped_v6',
+        category: 'ip_address',
+        regex: /::ffff:\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b/g,
+        replacement: '[IP_ADDRESS]',
+        confidence: 0.80,
+    },
+];
+export class PIIDetectionLayer {
+    presidio;
+    name = 'pii_detection';
+    order = 200;
+    constructor(presidio) {
+        this.presidio = presidio;
+    }
+    async process(input, _context) {
+        const findings = [];
+        const allMatches = [];
+        // Regex-based detection
+        for (const pattern of PII_PATTERNS) {
+            const regex = new RegExp(pattern.regex.source, pattern.regex.flags);
+            let match;
+            while ((match = regex.exec(input)) !== null) {
+                if (pattern.validate && !pattern.validate(match[0]))
+                    continue;
+                allMatches.push({
+                    start: match.index,
+                    end: match.index + match[0].length,
+                    replacement: pattern.replacement,
+                    category: pattern.category,
+                    confidence: pattern.confidence,
+                });
+            }
+        }
+        // Optional Presidio NER
+        if (this.presidio) {
+            const entities = await this.presidio.analyze(input);
+            for (const entity of entities) {
+                const alreadyCovered = allMatches.some(m => m.start <= entity.start && m.end >= entity.end);
+                if (!alreadyCovered) {
+                    allMatches.push({
+                        start: entity.start,
+                        end: entity.end,
+                        replacement: `[${entity.entityType}]`,
+                        category: entity.entityType.toLowerCase(),
+                        confidence: entity.score,
+                    });
+                }
+            }
+        }
+        // Sort descending by start for safe replacement
+        allMatches.sort((a, b) => b.start - a.start);
+        // Deduplicate overlapping
+        const deduped = [];
+        for (const m of allMatches) {
+            if (!deduped.some(d => m.start < d.end && m.end > d.start)) {
+                deduped.push(m);
+            }
+        }
+        let output = input;
+        // Record findings in ascending order
+        const ascending = [...deduped].sort((a, b) => a.start - b.start);
+        for (const m of ascending) {
+            findings.push({
+                layer: 'pii_detection',
+                category: m.category,
+                originalLength: m.end - m.start,
+                replacement: m.replacement,
+                startOffset: m.start,
+                endOffset: m.end,
+                confidence: m.confidence,
+            });
+        }
+        // Apply replacements descending
+        for (const m of deduped) {
+            output = output.slice(0, m.start) + m.replacement + output.slice(m.end);
+        }
+        return { output, findings, blocked: false };
+    }
+}
+//# sourceMappingURL=pii-detection-layer.js.map

package/dist/lib/redaction/pii-detection-layer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pii-detection-layer.js","sourceRoot":"","sources":["../../../src/lib/redaction/pii-detection-layer.ts"],"names":[],"mappings":"AAAA;;GAEG;AAkBH;;GAEG;AACH,SAAS,SAAS,CAAC,MAAc;IAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvC,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IACvD,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9B,IAAI,SAAS,EAAE,CAAC;YACd,CAAC,IAAI,CAAC,CAAC;YACP,IAAI,CAAC,GAAG,CAAC;gBAAE,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;QACD,GAAG,IAAI,CAAC,CAAC;QACT,SAAS,GAAG,CAAC,SAAS,CAAC;IACzB,CAAC;IACD,OAAO,GAAG,GAAG,EAAE,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAiB;IACxC;QACE,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,mDAAmD;QAC1D,WAAW,EAAE,SAAS;QACtB,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,KAAK;QACf,KAAK,EAAE,wBAAwB;QAC/B,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,KAAK;QACf,KAAK,EAAE,kEAAkE;QACzE,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE;YAClB,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACxC,yDAAyD;YACzD,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5D,CAAC;KACF;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,aAAa;QACvB,KAAK,EAAE,6CAA6C;QACpD,WAAW,EAAE,eAAe;QAC5B,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC;KACtC;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,aAAa;QACvB,KAAK,EAAE,uCAAuC;QAC9C,WAAW,EAAE,eAAe;QAC5B,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC;KACtC;IACD;QACE,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,qDAAqD;QAC5D,WAAW,EAAE,SAAS;QACtB,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,sEAAsE;QAC7E,WAAW,EAAE,SAAS;QACtB,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,YAAY;QACtB,KAAK,EAAE,yCAAyC;QAChD,WAAW,EAAE,cAAc;QAC3B,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,YAAY;QACtB,KAAK,EAAE,+CAA+C;QACtD,WAAW,EAAE,cAAc;QAC3B,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,QAAQ,EAAE,YAAY;QACtB,KAAK,EAAE,2DAA2D;QAClE,WAAW,EAAE,cAAc;QAC3B,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,QAAQ,EAAE,YAAY;QACtB,KAAK,EAAE,8CAA8C;QACrD,WAAW,EAAE,cAAc;QAC3B,UAAU,EAAE,IAAI;KACjB;CACF,CAAC;AAYF,MAAM,OAAO,iBAAiB;IAIC;IAHpB,IAAI,GAAG,eAAwB,CAAC;IAChC,KAAK,GAAG,GAAG,CAAC;IAErB,YAA6B,QAA2B;QAA3B,aAAQ,GAAR,QAAQ,CAAmB;IAAG,CAAC;IAE5D,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,QAA0B;QACrD,MAAM,QAAQ,GAAuB,EAAE,CAAC;QACxC,MAAM,UAAU,GAMX,EAAE,CAAC;QAER,wBAAwB;QACxB,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACpE,IAAI,KAA6B,CAAC;YAClC,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC5C,IAAI,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;oBAAE,SAAS;gBAC9D,UAAU,CAAC,IAAI,CAAC;oBACd,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,GAAG,EAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM;oBAClC,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;iBAC/B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,wBAAwB;QACxB,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACpD,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;gBAC9B,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CACpC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,CACpD,CAAC;gBACF,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,UAAU,CAAC,IAAI,CAAC;wBACd,KAAK,EAAE,MAAM,CAAC,KAAK;wBACnB,GAAG,EAAE,MAAM,CAAC,GAAG;wBACf,WAAW,EAAE,IAAI,MAAM,CAAC,UAAU,GAAG;wBACrC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE;wBACzC,UAAU,EAAE,MAAM,CAAC,KAAK;qBACzB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,gDAAgD;QAChD,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QAE7C,0BAA0B;QAC1B,MAAM,OAAO,GAAsB,EAAE,CAAC;QACtC,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,qCAAqC;QACrC,MAAM,SAAS,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACjE,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,eAAe;gBACtB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,cAAc,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK;gBAC/B,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,WAAW,EAAE,CAAC,CAAC,KAAK;gBACpB,SAAS,EAAE,CAAC,CAAC,GAAG;gBAChB,UAAU,EAAE,CAAC,CAAC,UAAU;aACzB,CAAC,CAAC;QACL,CAAC;QAED,gCAAgC;QAChC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC1E,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC9C,CAAC;CACF"}

package/dist/lib/redaction/pipeline.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Redaction Pipeline Orchestrator (Story 2.3)
+ */
+import type { RedactionLayer, RedactionContext, RedactionResult, RawLessonContent } from '@agentlensai/core';
+import { type PresidioProvider } from './pii-detection-layer.js';
+import { type ReviewQueueStore } from './human-review-layer.js';
+export interface RedactionPipelineConfig {
+    humanReviewEnabled?: boolean;
+    reviewQueueStore?: ReviewQueueStore;
+    presidioProvider?: PresidioProvider;
+    publicDomainAllowlist?: string[];
+}
+export declare class RedactionPipeline {
+    private layers;
+    constructor(config?: RedactionPipelineConfig, customLayers?: RedactionLayer[]);
+    getLayers(): readonly RedactionLayer[];
+    /**
+     * Register a custom redaction layer at runtime.
+     * The layer is inserted at the correct position based on its `order` field.
+     * Multiple custom layers are supported.
+     * Plugin errors trigger fail-closed behavior (same as built-in layers).
+     */
+    registerCustomLayer(layer: RedactionLayer): void;
+    process(raw: RawLessonContent, ctx: RedactionContext): Promise<RedactionResult>;
+}
+//# sourceMappingURL=pipeline.d.ts.map

package/dist/lib/redaction/pipeline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipeline.d.ts","sourceRoot":"","sources":["../../../src/lib/redaction/pipeline.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACV,cAAc,EAEd,gBAAgB,EAChB,eAAe,EAEf,gBAAgB,EACjB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAIpF,OAAO,EAAoB,KAAK,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAElF,MAAM,WAAW,uBAAuB;IACtC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;CAClC;AAED,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,MAAM,CAAmB;gBAG/B,MAAM,GAAE,uBAA4B,EACpC,YAAY,CAAC,EAAE,cAAc,EAAE;IAqBjC,SAAS,IAAI,SAAS,cAAc,EAAE;IAItC;;;;;OAKG;IACH,mBAAmB,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI;IAK1C,OAAO,CAAC,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;CAuDtF"}

package/dist/lib/redaction/pipeline.js

@@ -0,0 +1,91 @@
+/**
+ * Redaction Pipeline Orchestrator (Story 2.3)
+ */
+import { createRedactedLessonContent, REDACTION_PIPELINE_KEY } from '@agentlensai/core';
+import { SecretDetectionLayer } from './secret-detection-layer.js';
+import { PIIDetectionLayer } from './pii-detection-layer.js';
+import { UrlPathScrubbingLayer } from './url-path-scrubbing-layer.js';
+import { TenantDeidentificationLayer } from './tenant-deidentification-layer.js';
+import { SemanticDenyListLayer } from './semantic-denylist-layer.js';
+import { HumanReviewLayer } from './human-review-layer.js';
+export class RedactionPipeline {
+    layers;
+    constructor(config = {}, customLayers) {
+        const defaultLayers = [
+            new SecretDetectionLayer(),
+            new PIIDetectionLayer(config.presidioProvider),
+            new UrlPathScrubbingLayer(config.publicDomainAllowlist),
+            new TenantDeidentificationLayer(),
+            new SemanticDenyListLayer(),
+            new HumanReviewLayer(config.humanReviewEnabled ?? false, config.reviewQueueStore),
+        ];
+        if (customLayers) {
+            defaultLayers.push(...customLayers);
+        }
+        this.layers = defaultLayers.sort((a, b) => a.order - b.order);
+    }
+    getLayers() {
+        return this.layers;
+    }
+    /**
+     * Register a custom redaction layer at runtime.
+     * The layer is inserted at the correct position based on its `order` field.
+     * Multiple custom layers are supported.
+     * Plugin errors trigger fail-closed behavior (same as built-in layers).
+     */
+    registerCustomLayer(layer) {
+        this.layers.push(layer);
+        this.layers.sort((a, b) => a.order - b.order);
+    }
+    async process(raw, ctx) {
+        // Combine title and content for processing
+        let text = `${raw.title}\n---\n${raw.content}`;
+        const allFindings = [];
+        for (const layer of this.layers) {
+            let result;
+            try {
+                result = await layer.process(text, ctx);
+            }
+            catch (error) {
+                // FAIL-CLOSED: any layer error blocks the lesson
+                return {
+                    status: 'error',
+                    error: error instanceof Error ? error.message : String(error),
+                    layer: layer.name,
+                };
+            }
+            if (result.blocked) {
+                // Check for pending_review special case
+                if (result.blockReason?.startsWith('pending_review:')) {
+                    const reviewId = result.blockReason.split(':')[1];
+                    return { status: 'pending_review', reviewId };
+                }
+                return {
+                    status: 'blocked',
+                    reason: result.blockReason ?? 'Blocked by redaction layer',
+                    layer: layer.name,
+                };
+            }
+            text = result.output;
+            allFindings.push(...result.findings);
+        }
+        // Split back into title and content
+        const separatorIndex = text.indexOf('\n---\n');
+        let title;
+        let content;
+        if (separatorIndex !== -1) {
+            title = text.slice(0, separatorIndex);
+            content = text.slice(separatorIndex + 5);
+        }
+        else {
+            title = text;
+            content = '';
+        }
+        return {
+            status: 'redacted',
+            content: createRedactedLessonContent(title, content, {}, REDACTION_PIPELINE_KEY), // context always stripped
+            findings: allFindings,
+        };
+    }
+}
+//# sourceMappingURL=pipeline.js.map

package/dist/lib/redaction/pipeline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipeline.js","sourceRoot":"","sources":["../../../src/lib/redaction/pipeline.ts"],"names":[],"mappings":"AAAA;;GAEG;AAUH,OAAO,EAAE,2BAA2B,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AACxF,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAyB,MAAM,0BAA0B,CAAC;AACpF,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAyB,MAAM,yBAAyB,CAAC;AASlF,MAAM,OAAO,iBAAiB;IACpB,MAAM,CAAmB;IAEjC,YACE,SAAkC,EAAE,EACpC,YAA+B;QAE/B,MAAM,aAAa,GAAqB;YACtC,IAAI,oBAAoB,EAAE;YAC1B,IAAI,iBAAiB,CAAC,MAAM,CAAC,gBAAgB,CAAC;YAC9C,IAAI,qBAAqB,CAAC,MAAM,CAAC,qBAAqB,CAAC;YACvD,IAAI,2BAA2B,EAAE;YACjC,IAAI,qBAAqB,EAAE;YAC3B,IAAI,gBAAgB,CAClB,MAAM,CAAC,kBAAkB,IAAI,KAAK,EAClC,MAAM,CAAC,gBAAgB,CACxB;SACF,CAAC;QAEF,IAAI,YAAY,EAAE,CAAC;YACjB,aAAa,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;QACtC,CAAC;QAED,IAAI,CAAC,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IAChE,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;;;;OAKG;IACH,mBAAmB,CAAC,KAAqB;QACvC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAqB,EAAE,GAAqB;QACxD,2CAA2C;QAC3C,IAAI,IAAI,GAAG,GAAG,GAAG,CAAC,KAAK,UAAU,GAAG,CAAC,OAAO,EAAE,CAAC;QAC/C,MAAM,WAAW,GAAuB,EAAE,CAAC;QAE3C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,IAAI,MAAM,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC1C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,iDAAiD;gBACjD,OAAO;oBACL,MAAM,EAAE,OAAO;oBACf,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;oBAC7D,KAAK,EAAE,KAAK,CAAC,IAA0B;iBACxC,CAAC;YACJ,CAAC;YAED,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,wCAAwC;gBACxC,IAAI,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;oBACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;oBAClD,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CAAC;gBAChD,CAAC;gBAED,OAAO;oBACL,MAAM,EAAE,SAAS;oBACjB,MAAM,EAAE,MAAM,CAAC,WAAW,IAAI,4BAA4B;oBAC1D,KAAK,EAAE,KAAK,CAAC,IAA0B;iBACxC,CAAC;YACJ,CAAC;YAED,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC;YACrB,WAAW,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;QAED,oCAAoC;QACpC,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,KAAa,CAAC;QAClB,IAAI,OAAe,CAAC;QAEpB,IAAI,cAAc,KAAK,CAAC,CAAC,EAAE,CAAC;YAC1B,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;YACtC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,KAAK,GAAG,IAAI,CAAC;YACb,OAAO,GAAG,EAAE,CAAC;QACf,CAAC;QAED,OAAO;YACL,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,2BAA2B,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,sBAAsB,CAAC,EAAE,0BAA0B;YAC5G,QAAQ,EAAE,WAAW;SACtB,CAAC;IACJ,CAAC;CACF"}

package/dist/lib/redaction/secret-detection-layer.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Layer 1: Secret Detection (Story 2.1)
+ */
+import type { RedactionLayer, RedactionLayerResult, RedactionContext } from '@agentlensai/core';
+export declare class SecretDetectionLayer implements RedactionLayer {
+    readonly name: "secret_detection";
+    readonly order = 100;
+    process(input: string, _context: RedactionContext): RedactionLayerResult;
+}
+//# sourceMappingURL=secret-detection-layer.d.ts.map

package/dist/lib/redaction/secret-detection-layer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-detection-layer.d.ts","sourceRoot":"","sources":["../../../src/lib/redaction/secret-detection-layer.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,oBAAoB,EACpB,gBAAgB,EAEjB,MAAM,mBAAmB,CAAC;AAG3B,qBAAa,oBAAqB,YAAW,cAAc;IACzD,QAAQ,CAAC,IAAI,EAAG,kBAAkB,CAAU;IAC5C,QAAQ,CAAC,KAAK,OAAO;IAErB,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB,GAAG,oBAAoB;CAyFzE"}

package/dist/lib/redaction/secret-detection-layer.js

@@ -0,0 +1,79 @@
+/**
+ * Layer 1: Secret Detection (Story 2.1)
+ */
+import { ACTIVE_SECRET_PATTERNS, detectHighEntropyStrings } from './secret-patterns.js';
+export class SecretDetectionLayer {
+    name = 'secret_detection';
+    order = 100;
+    process(input, _context) {
+        const findings = [];
+        let output = input;
+        let secretIndex = 0;
+        // Collect all matches with their positions (work on original input for offsets)
+        const allMatches = [];
+        // Regex-based detection
+        for (const pattern of ACTIVE_SECRET_PATTERNS) {
+            const globalRegex = new RegExp(pattern.regex.source, pattern.regex.flags + (pattern.regex.flags.includes('g') ? '' : 'g'));
+            let match;
+            while ((match = globalRegex.exec(input)) !== null) {
+                allMatches.push({
+                    start: match.index,
+                    end: match.index + match[0].length,
+                    category: pattern.category,
+                    confidence: pattern.confidence,
+                    patternName: pattern.name,
+                });
+            }
+        }
+        // High-entropy detection
+        const entropyMatches = detectHighEntropyStrings(input);
+        for (const em of entropyMatches) {
+            // Skip if already covered by a regex match
+            const alreadyCovered = allMatches.some(m => m.start <= em.start && m.end >= em.end);
+            if (!alreadyCovered) {
+                allMatches.push({
+                    start: em.start,
+                    end: em.end,
+                    category: 'high_entropy_string',
+                    confidence: Math.min(0.6 + (em.entropy - 4.5) * 0.1, 0.9),
+                    patternName: 'entropy_detection',
+                });
+            }
+        }
+        // Sort by start position descending to replace from end (preserves offsets)
+        allMatches.sort((a, b) => b.start - a.start);
+        // Deduplicate overlapping matches (keep highest confidence)
+        const deduped = [];
+        for (const m of allMatches) {
+            const overlaps = deduped.some(d => m.start < d.end && m.end > d.start);
+            if (!overlaps) {
+                deduped.push(m);
+            }
+        }
+        // Sort ascending for findings reporting, but replace descending
+        const sortedForFindings = [...deduped].sort((a, b) => a.start - b.start);
+        const replacements = new Map();
+        for (const m of sortedForFindings) {
+            secretIndex++;
+            const replacement = `[SECRET_REDACTED_${secretIndex}]`;
+            replacements.set(m, replacement);
+            findings.push({
+                layer: 'secret_detection',
+                category: m.category,
+                originalLength: m.end - m.start,
+                replacement,
+                startOffset: m.start,
+                endOffset: m.end,
+                confidence: m.confidence,
+            });
+        }
+        // Apply replacements from end to start
+        const descending = [...deduped].sort((a, b) => b.start - a.start);
+        for (const m of descending) {
+            const replacement = replacements.get(m);
+            output = output.slice(0, m.start) + replacement + output.slice(m.end);
+        }
+        return { output, findings, blocked: false };
+    }
+}
+//# sourceMappingURL=secret-detection-layer.js.map

package/dist/lib/redaction/secret-detection-layer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-detection-layer.js","sourceRoot":"","sources":["../../../src/lib/redaction/secret-detection-layer.ts"],"names":[],"mappings":"AAAA;;GAEG;AAQH,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAExF,MAAM,OAAO,oBAAoB;IACtB,IAAI,GAAG,kBAA2B,CAAC;IACnC,KAAK,GAAG,GAAG,CAAC;IAErB,OAAO,CAAC,KAAa,EAAE,QAA0B;QAC/C,MAAM,QAAQ,GAAuB,EAAE,CAAC;QACxC,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,IAAI,WAAW,GAAG,CAAC,CAAC;QAEpB,gFAAgF;QAChF,MAAM,UAAU,GAMX,EAAE,CAAC;QAER,wBAAwB;QACxB,KAAK,MAAM,OAAO,IAAI,sBAAsB,EAAE,CAAC;YAC7C,MAAM,WAAW,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3H,IAAI,KAA6B,CAAC;YAClC,OAAO,CAAC,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAClD,UAAU,CAAC,IAAI,CAAC;oBACd,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,GAAG,EAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM;oBAClC,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,WAAW,EAAE,OAAO,CAAC,IAAI;iBAC1B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,yBAAyB;QACzB,MAAM,cAAc,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC;QACvD,KAAK,MAAM,EAAE,IAAI,cAAc,EAAE,CAAC;YAChC,2CAA2C;YAC3C,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CACpC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,CAC5C,CAAC;YACF,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,UAAU,CAAC,IAAI,CAAC;oBACd,KAAK,EAAE,EAAE,CAAC,KAAK;oBACf,GAAG,EAAE,EAAE,CAAC,GAAG;oBACX,QAAQ,EAAE,qBAAqB;oBAC/B,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,GAAG,EAAE,GAAG,CAAC;oBACzD,WAAW,EAAE,mBAAmB;iBACjC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,4EAA4E;QAC5E,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QAE7C,4DAA4D;QAC5D,MAAM,OAAO,GAAsB,EAAE,CAAC;QACtC,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAC3B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,CACxC,CAAC;YACF,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,gEAAgE;QAChE,MAAM,iBAAiB,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACzE,MAAM,YAAY,GAAG,IAAI,GAAG,EAAgC,CAAC;QAE7D,KAAK,MAAM,CAAC,IAAI,iBAAiB,EAAE,CAAC;YAClC,WAAW,EAAE,CAAC;YACd,MAAM,WAAW,GAAG,oBAAoB,WAAW,GAAG,CAAC;YACvD,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;YACjC,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,kBAAkB;gBACzB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,cAAc,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK;gBAC/B,WAAW;gBACX,WAAW,EAAE,CAAC,CAAC,KAAK;gBACpB,SAAS,EAAE,CAAC,CAAC,GAAG;gBAChB,UAAU,EAAE,CAAC,CAAC,UAAU;aACzB,CAAC,CAAC;QACL,CAAC;QAED,uCAAuC;QACvC,MAAM,UAAU,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QAClE,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,MAAM,WAAW,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC;YACzC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACxE,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC9C,CAAC;CACF"}

package/dist/lib/redaction/secret-patterns.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Secret Detection Patterns & Entropy Calculator (Story 2.1, Layer 1)
+ */
+export interface SecretPattern {
+    name: string;
+    category: string;
+    regex: RegExp;
+    confidence: number;
+}
+export declare const SECRET_PATTERNS: SecretPattern[];
+export declare const ACTIVE_SECRET_PATTERNS: SecretPattern[];
+/**
+ * Shannon entropy of a string (bits per character).
+ */
+export declare function shannonEntropy(s: string): number;
+/**
+ * Detect high-entropy strings that may be unknown secrets.
+ * Scans with a sliding window approach.
+ */
+export declare function detectHighEntropyStrings(text: string, options?: {
+    minLength?: number;
+    maxLength?: number;
+    entropyThreshold?: number;
+}): Array<{
+    start: number;
+    end: number;
+    entropy: number;
+}>;
+//# sourceMappingURL=secret-patterns.d.ts.map

package/dist/lib/redaction/secret-patterns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-patterns.d.ts","sourceRoot":"","sources":["../../../src/lib/redaction/secret-patterns.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,eAAe,EAAE,aAAa,EA0G1C,CAAC;AAGF,eAAO,MAAM,sBAAsB,iBAAmD,CAAC;AAEvF;;GAEG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAYhD;AAMD;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAO,GAClF,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CA6BxD"}

package/dist/lib/redaction/secret-patterns.js

@@ -0,0 +1,133 @@
+/**
+ * Secret Detection Patterns & Entropy Calculator (Story 2.1, Layer 1)
+ */
+export const SECRET_PATTERNS = [
+    // ─── OpenAI ─────────────────────────────────────────
+    { name: 'openai_api_key', category: 'api_key', regex: /sk-[a-zA-Z0-9]{20,}/, confidence: 0.95 },
+    { name: 'openai_org', category: 'api_key', regex: /org-[a-zA-Z0-9]{20,}/, confidence: 0.85 },
+    // ─── Anthropic ──────────────────────────────────────
+    { name: 'anthropic_api_key', category: 'api_key', regex: /sk-ant-[a-zA-Z0-9\-]{20,}/, confidence: 0.95 },
+    // ─── GitHub ─────────────────────────────────────────
+    { name: 'github_pat', category: 'api_key', regex: /ghp_[a-zA-Z0-9]{36}/, confidence: 0.95 },
+    { name: 'github_oauth', category: 'api_key', regex: /gho_[a-zA-Z0-9]{36}/, confidence: 0.95 },
+    { name: 'github_app_token', category: 'api_key', regex: /(?:ghu|ghs|ghr)_[a-zA-Z0-9]{36}/, confidence: 0.95 },
+    // ─── AWS ────────────────────────────────────────────
+    { name: 'aws_access_key', category: 'api_key', regex: /AKIA[0-9A-Z]{16}/, confidence: 0.95 },
+    { name: 'aws_secret_key', category: 'api_key', regex: /(?:aws_secret_access_key|AWS_SECRET_ACCESS_KEY)\s*[=:]\s*[A-Za-z0-9/+=]{40}/, confidence: 0.95 },
+    // ─── Stripe ─────────────────────────────────────────
+    { name: 'stripe_live_key', category: 'api_key', regex: /sk_live_[a-zA-Z0-9]{20,}/, confidence: 0.95 },
+    { name: 'stripe_test_key', category: 'api_key', regex: /sk_test_[a-zA-Z0-9]{20,}/, confidence: 0.90 },
+    { name: 'stripe_publishable', category: 'api_key', regex: /pk_(?:live|test)_[a-zA-Z0-9]{20,}/, confidence: 0.90 },
+    { name: 'stripe_restricted', category: 'api_key', regex: /rk_(?:live|test)_[a-zA-Z0-9]{20,}/, confidence: 0.90 },
+    // ─── Slack ──────────────────────────────────────────
+    { name: 'slack_token', category: 'api_key', regex: /xox[bpras]-[a-zA-Z0-9\-]+/, confidence: 0.95 },
+    { name: 'slack_webhook', category: 'api_key', regex: /https:\/\/hooks\.slack\.com\/services\/T[a-zA-Z0-9_]+\/B[a-zA-Z0-9_]+\/[a-zA-Z0-9_]+/, confidence: 0.95 },
+    // ─── Google ─────────────────────────────────────────
+    { name: 'google_api_key', category: 'api_key', regex: /AIza[0-9A-Za-z\-_]{35}/, confidence: 0.90 },
+    { name: 'google_oauth_client', category: 'api_key', regex: /[0-9]+-[a-z0-9_]{32}\.apps\.googleusercontent\.com/, confidence: 0.90 },
+    // ─── Azure ──────────────────────────────────────────
+    { name: 'azure_subscription', category: 'api_key', regex: /[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}/, confidence: 0.3 },
+    // ─── Twilio ─────────────────────────────────────────
+    { name: 'twilio_api_key', category: 'api_key', regex: /SK[a-f0-9]{32}/, confidence: 0.85 },
+    { name: 'twilio_account_sid', category: 'api_key', regex: /AC[a-f0-9]{32}/, confidence: 0.85 },
+    // ─── SendGrid ───────────────────────────────────────
+    { name: 'sendgrid_api_key', category: 'api_key', regex: /SG\.[a-zA-Z0-9_\-]{22}\.[a-zA-Z0-9_\-]{43}/, confidence: 0.95 },
+    // ─── Mailgun ────────────────────────────────────────
+    { name: 'mailgun_api_key', category: 'api_key', regex: /key-[a-zA-Z0-9]{32}/, confidence: 0.85 },
+    // ─── Heroku ─────────────────────────────────────────
+    { name: 'heroku_api_key', category: 'api_key', regex: /[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}/, confidence: 0.3 },
+    // ─── npm ────────────────────────────────────────────
+    { name: 'npm_token', category: 'api_key', regex: /npm_[a-zA-Z0-9]{36}/, confidence: 0.95 },
+    // ─── PyPI ───────────────────────────────────────────
+    { name: 'pypi_token', category: 'api_key', regex: /pypi-[a-zA-Z0-9\-_]{50,}/, confidence: 0.95 },
+    // ─── Discord ────────────────────────────────────────
+    { name: 'discord_token', category: 'api_key', regex: /[MN][A-Za-z\d]{23,}\.[\w-]{6}\.[\w-]{27,}/, confidence: 0.90 },
+    { name: 'discord_webhook', category: 'api_key', regex: /https:\/\/discord(?:app)?\.com\/api\/webhooks\/\d+\/[\w-]+/, confidence: 0.95 },
+    // ─── Telegram ───────────────────────────────────────
+    { name: 'telegram_bot_token', category: 'api_key', regex: /\d{8,10}:[A-Za-z0-9_-]{35}/, confidence: 0.85 },
+    // ─── Bearer / Basic Auth ────────────────────────────
+    { name: 'bearer_token', category: 'auth_token', regex: /Bearer\s+[a-zA-Z0-9._~+\/=-]{20,}/, confidence: 0.90 },
+    { name: 'basic_auth', category: 'auth_token', regex: /Basic\s+[a-zA-Z0-9+\/=]{10,}/, confidence: 0.90 },
+    // ─── URL with credentials ──────────────────────────
+    { name: 'url_password', category: 'auth_token', regex: /\/\/[^:\/\s]+:[^@\/\s]+@[^\/\s]+/, confidence: 0.95 },
+    // ─── Private Keys ──────────────────────────────────
+    { name: 'private_key', category: 'private_key', regex: /-----BEGIN\s+(?:RSA\s+|EC\s+|DSA\s+|OPENSSH\s+)?PRIVATE KEY-----/, confidence: 0.99 },
+    // ─── Connection Strings ─────────────────────────────
+    { name: 'connection_string', category: 'connection_string', regex: /(?:mongodb(?:\+srv)?|postgres(?:ql)?|mysql|redis|amqp|mssql):\/\/[^\s]+/, confidence: 0.90 },
+    // ─── JWT ────────────────────────────────────────────
+    { name: 'jwt', category: 'auth_token', regex: /eyJ[a-zA-Z0-9_-]{10,}\.eyJ[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]{10,}/, confidence: 0.85 },
+    // ─── HashiCorp Vault ────────────────────────────────
+    { name: 'vault_token', category: 'api_key', regex: /hvs\.[a-zA-Z0-9_-]{24,}/, confidence: 0.90 },
+    // ─── Datadog ────────────────────────────────────────
+    { name: 'datadog_api_key', category: 'api_key', regex: /dd[a-f0-9]{40}/, confidence: 0.80 },
+    // ─── Supabase ───────────────────────────────────────
+    { name: 'supabase_key', category: 'api_key', regex: /sbp_[a-f0-9]{40}/, confidence: 0.90 },
+    // ─── Vercel ─────────────────────────────────────────
+    { name: 'vercel_token', category: 'api_key', regex: /vercel_[a-zA-Z0-9]{24,}/, confidence: 0.90 },
+    // ─── Linear ─────────────────────────────────────────
+    { name: 'linear_api_key', category: 'api_key', regex: /lin_api_[a-zA-Z0-9]{40,}/, confidence: 0.90 },
+    // ─── Shopify ────────────────────────────────────────
+    { name: 'shopify_token', category: 'api_key', regex: /shpat_[a-fA-F0-9]{32}/, confidence: 0.90 },
+    { name: 'shopify_secret', category: 'api_key', regex: /shpss_[a-fA-F0-9]{32}/, confidence: 0.90 },
+    // ─── Cloudflare ─────────────────────────────────────
+    { name: 'cloudflare_api_token', category: 'api_key', regex: /[a-zA-Z0-9_]{40}/, confidence: 0.2 }, // low confidence - too generic alone
+    // ─── Generic password assignment ────────────────────
+    { name: 'password_assignment', category: 'password', regex: /(?:password|passwd|pwd|secret|token|api_key|apikey)['"]?\s*[=:]\s*['"]?[^\s'"<>]{8,}['"]?/i, confidence: 0.80 },
+    // XML-style password: <password>value</password>
+    { name: 'xml_password', category: 'password', regex: /<(?:password|secret|token|api[_-]?key)>([^<]{8,})<\//i, confidence: 0.80 },
+    // SQL PASSWORD keyword: PASSWORD 'value'
+    { name: 'sql_password', category: 'password', regex: /PASSWORD\s+['"]([^'"]{8,})['"]/i, confidence: 0.80 },
+];
+// Only use patterns with confidence >= threshold (skip very generic ones)
+export const ACTIVE_SECRET_PATTERNS = SECRET_PATTERNS.filter(p => p.confidence >= 0.5);
+/**
+ * Shannon entropy of a string (bits per character).
+ */
+export function shannonEntropy(s) {
+    if (s.length === 0)
+        return 0;
+    const freq = new Map();
+    for (const c of s) {
+        freq.set(c, (freq.get(c) ?? 0) + 1);
+    }
+    let entropy = 0;
+    for (const count of freq.values()) {
+        const p = count / s.length;
+        entropy -= p * Math.log2(p);
+    }
+    return entropy;
+}
+// Hex and base64 character sets for entropy detection
+const HEX_RE = /^[a-fA-F0-9]+$/;
+const BASE64_RE = /^[a-zA-Z0-9+\/=_-]+$/;
+/**
+ * Detect high-entropy strings that may be unknown secrets.
+ * Scans with a sliding window approach.
+ */
+export function detectHighEntropyStrings(text, options = {}) {
+    const minLen = options.minLength ?? 20;
+    const maxLen = options.maxLength ?? 128;
+    const threshold = options.entropyThreshold ?? 4.5;
+    const results = [];
+    // Find candidate tokens (non-whitespace sequences)
+    const tokenRegex = /[^\s,;:(){}\[\]<>"'`]+/g;
+    let match;
+    while ((match = tokenRegex.exec(text)) !== null) {
+        const token = match[0];
+        if (token.length < minLen || token.length > maxLen)
+            continue;
+        // Only consider hex-like or base64-like strings
+        if (!HEX_RE.test(token) && !BASE64_RE.test(token))
+            continue;
+        const entropy = shannonEntropy(token);
+        if (entropy >= threshold) {
+            results.push({
+                start: match.index,
+                end: match.index + token.length,
+                entropy,
+            });
+        }
+    }
+    return results;
+}
+//# sourceMappingURL=secret-patterns.js.map

package/dist/lib/redaction/secret-patterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-patterns.js","sourceRoot":"","sources":["../../../src/lib/redaction/secret-patterns.ts"],"names":[],"mappings":"AAAA;;GAEG;AASH,MAAM,CAAC,MAAM,eAAe,GAAoB;IAC9C,uDAAuD;IACvD,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAE,IAAI,EAAE;IAC/F,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,sBAAsB,EAAE,UAAU,EAAE,IAAI,EAAE;IAE5F,uDAAuD;IACvD,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,2BAA2B,EAAE,UAAU,EAAE,IAAI,EAAE;IAExG,uDAAuD;IACvD,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAE,IAAI,EAAE;IAC3F,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAE,IAAI,EAAE;IAC7F,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,iCAAiC,EAAE,UAAU,EAAE,IAAI,EAAE;IAE7G,uDAAuD;IACvD,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,IAAI,EAAE;IAC5F,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,6EAA6E,EAAE,UAAU,EAAE,IAAI,EAAE;IAEvJ,uDAAuD;IACvD,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,0BAA0B,EAAE,UAAU,EAAE,IAAI,EAAE;IACrG,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,0BAA0B,EAAE,UAAU,EAAE,IAAI,EAAE;IACrG,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,mCAAmC,EAAE,UAAU,EAAE,IAAI,EAAE;IACjH,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,mCAAmC,EAAE,UAAU,EAAE,IAAI,EAAE;IAEhH,uDAAuD;IACvD,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,2BAA2B,EAAE,UAAU,EAAE,IAAI,EAAE;IAClG,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,sFAAsF,EAAE,UAAU,EAAE,IAAI,EAAE;IAE/J,uDAAuD;IACvD,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,wBAAwB,EAAE,UAAU,EAAE,IAAI,EAAE;IAClG,EAAE,IAAI,EAAE,qBAAqB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,oDAAoD,EAAE,UAAU,EAAE,IAAI,EAAE;IAEnI,uDAAuD;IACvD,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,8DAA8D,EAAE,UAAU,EAAE,GAAG,EAAE;IAE3I,uDAAuD;IACvD,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,IAAI,EAAE;IAC1F,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,IAAI,EAAE;IAE9F,uDAAuD;IACvD,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,4CAA4C,EAAE,UAAU,EAAE,IAAI,EAAE;IAExH,uDAAuD;IACvD,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAE,IAAI,EAAE;IAEhG,uDAAuD;IACvD,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,8DAA8D,EAAE,UAAU,EAAE,GAAG,EAAE;IAEvI,uDAAuD;IACvD,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAE,IAAI,EAAE;IAE1F,uDAAuD;IACvD,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,0BAA0B,EAAE,UAAU,EAAE,IAAI,EAAE;IAEhG,uDAAuD;IACvD,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,2CAA2C,EAAE,UAAU,EAAE,IAAI,EAAE;IACpH,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,4DAA4D,EAAE,UAAU,EAAE,IAAI,EAAE;IAEvI,uDAAuD;IACvD,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,4BAA4B,EAAE,UAAU,EAAE,IAAI,EAAE;IAE1G,uDAAuD;IACvD,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,mCAAmC,EAAE,UAAU,EAAE,IAAI,EAAE;IAC9G,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,8BAA8B,EAAE,UAAU,EAAE,IAAI,EAAE;IAEvG,sDAAsD;IACtD,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,kCAAkC,EAAE,UAAU,EAAE,IAAI,EAAE;IAE7G,sDAAsD;IACtD,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,aAAa,EAAE,KAAK,EAAE,kEAAkE,EAAE,UAAU,EAAE,IAAI,EAAE;IAE7I,uDAAuD;IACvD,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,mBAAmB,EAAE,KAAK,EAAE,yEAAyE,EAAE,UAAU,EAAE,IAAI,EAAE;IAEhK,uDAAuD;IACvD,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,kEAAkE,EAAE,UAAU,EAAE,IAAI,EAAE;IAEpI,uDAAuD;IACvD,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,yBAAyB,EAAE,UAAU,EAAE,IAAI,EAAE;IAEhG,uDAAuD;IACvD,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,IAAI,EAAE;IAE3F,uDAAuD;IACvD,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,IAAI,EAAE;IAE1F,uDAAuD;IACvD,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,yBAAyB,EAAE,UAAU,EAAE,IAAI,EAAE;IAEjG,uDAAuD;IACvD,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,0BAA0B,EAAE,UAAU,EAAE,IAAI,EAAE;IAEpG,uDAAuD;IACvD,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,uBAAuB,EAAE,UAAU,EAAE,IAAI,EAAE;IAChG,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,uBAAuB,EAAE,UAAU,EAAE,IAAI,EAAE;IAEjG,uDAAuD;IACvD,EAAE,IAAI,EAAE,sBAAsB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE,qCAAqC;IAExI,uDAAuD;IACvD,EAAE,IAAI,EAAE,qBAAqB,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,4FAA4F,EAAE,UAAU,EAAE,IAAI,EAAE;IAE5K,iDAAiD;IACjD,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,uDAAuD,EAAE,UAAU,EAAE,IAAI,EAAE;IAEhI,yCAAyC;IACzC,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,iCAAiC,EAAE,UAAU,EAAE,IAAI,EAAE;CAC3G,CAAC;AAEF,0EAA0E;AAC1E,MAAM,CAAC,MAAM,sBAAsB,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC;AAEvF;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,CAAS;IACtC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAClB,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC;QAC3B,OAAO,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,sDAAsD;AACtD,MAAM,MAAM,GAAG,gBAAgB,CAAC;AAChC,MAAM,SAAS,GAAG,sBAAsB,CAAC;AAEzC;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,IAAY,EACZ,UAAiF,EAAE;IAEnF,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;IACvC,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,IAAI,GAAG,CAAC;IACxC,MAAM,SAAS,GAAG,OAAO,CAAC,gBAAgB,IAAI,GAAG,CAAC;IAElD,MAAM,OAAO,GAA2D,EAAE,CAAC;IAE3E,mDAAmD;IACnD,MAAM,UAAU,GAAG,yBAAyB,CAAC;IAC7C,IAAI,KAA6B,CAAC;IAElC,OAAO,CAAC,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM;YAAE,SAAS;QAE7D,gDAAgD;QAChD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,SAAS;QAE5D,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,OAAO,IAAI,SAAS,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC;gBACX,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,GAAG,EAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,MAAM;gBAC/B,OAAO;aACR,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/lib/redaction/semantic-denylist-layer.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Layer 5: Semantic Deny List (Story 2.2)
+ */
+import type { RedactionLayer, RedactionLayerResult, RedactionContext } from '@agentlensai/core';
+export declare class SemanticDenyListLayer implements RedactionLayer {
+    readonly name: "semantic_denylist";
+    readonly order = 500;
+    process(input: string, context: RedactionContext): RedactionLayerResult;
+}
+//# sourceMappingURL=semantic-denylist-layer.d.ts.map

package/dist/lib/redaction/semantic-denylist-layer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"semantic-denylist-layer.d.ts","sourceRoot":"","sources":["../../../src/lib/redaction/semantic-denylist-layer.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,oBAAoB,EACpB,gBAAgB,EAEjB,MAAM,mBAAmB,CAAC;AAE3B,qBAAa,qBAAsB,YAAW,cAAc;IAC1D,QAAQ,CAAC,IAAI,EAAG,mBAAmB,CAAU;IAC7C,QAAQ,CAAC,KAAK,OAAO;IAErB,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,GAAG,oBAAoB;CA2DxE"}