@gobing-ai/ts-llm-jsonl-importer 0.5.4 → 0.5.7

package/dist/redaction.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../src/redaction.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAEzD,qFAAqF;AACrF,eAAO,MAAM,uBAAuB,EAAE,SAAS,aAAa,EA+B3D,CAAC;AAEF,qEAAqE;AACrE,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,GAAE,SAAS,aAAa,EAA4B,GAAG,OAAO,CAa9G;AAED,mFAAmF;AACnF,wBAAgB,YAAY,CAAC,OAAO,SAAS,UAAU,EACnD,MAAM,EAAE,OAAO,EACf,KAAK,GAAE,SAAS,aAAa,EAA4B,GAC1D,OAAO,CAET"}
+{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../src/redaction.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAEzD,qFAAqF;AACrF,eAAO,MAAM,uBAAuB,EAAE,SAAS,aAAa,EAwC3D,CAAC;AAUF,qEAAqE;AACrE,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,GAAE,SAAS,aAAa,EAA4B,GAAG,OAAO,CAgB9G;AAED,mFAAmF;AACnF,wBAAgB,YAAY,CAAC,OAAO,SAAS,UAAU,EACnD,MAAM,EAAE,OAAO,EACf,KAAK,GAAE,SAAS,aAAa,EAA4B,GAC1D,OAAO,CAET"}

package/dist/redaction.js

@@ -1,8 +1,16 @@
 /** Default redaction rules for common token, key, and email shapes in agent logs. */
 export const DEFAULT_REDACTION_RULES = [
     {
+        // Task 0086 R5: vendor-specific token shapes. The underscore form
+        // deliberately requires a live/test infix — a bare sk_/pk_ prefix would
+        // redact DB identifiers like pk_customer_orders_id in code snippets.
         name: 'api-key',
-        pattern: /\b(?:sk|pk|ghp|github_pat|xox[baprs])-[-_a-zA-Z0-9]{12,}\b/g,
+        pattern: /\b(?:(?:sk|pk|ghp|github_pat|xox[baprs])-[-_a-zA-Z0-9]{12,}|(?:sk|pk|rk)_(?:live|test)_[A-Za-z0-9]{10,})\b/g,
+        replacement: '[REDACTED:token]',
+    },
+    {
+        name: 'github-token',
+        pattern: /\b(?:gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,})\b/g,
         replacement: '[REDACTED:token]',
     },
     {
@@ -31,6 +39,12 @@ export const DEFAULT_REDACTION_RULES = [
         replacement: '[REDACTED:bearer]',
     },
 ];
+/**
+ * Keys whose string values are secrets regardless of shape (task 0086 R5).
+ * Anchored so usage-analytics keys (tokens_used, token_count, max_tokens) are
+ * NOT redacted — those appear in LLM usage records.
+ */
+const SECRET_KEY = /^(?:api[_-]?key|apikey|api[_-]?secret|token|access[_-]?token|refresh[_-]?token|auth[_-]?token|secret|secret[_-]?key|client[_-]?secret|private[_-]?key|session[_-]?token|password|passwd|authorization)$/i;
 /** Redact supported scalar and composite JSON values recursively. */
 export function redactValue(value, rules = DEFAULT_REDACTION_RULES) {
     if (typeof value === 'string') {
@@ -40,7 +54,10 @@ export function redactValue(value, rules = DEFAULT_REDACTION_RULES) {
         return value.map((entry) => redactValue(entry, rules));
     }
     if (value !== null && typeof value === 'object') {
-        return Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, redactValue(entry, rules)]));
+        return Object.fromEntries(Object.entries(value).map(([key, entry]) => [
+            key,
+            SECRET_KEY.test(key) && typeof entry === 'string' ? '[REDACTED:secret]' : redactValue(entry, rules),
+        ]));
     }
     return value;
 }

package/dist/schema-sql.d.ts

@@ -4,7 +4,7 @@
  * Guaranteed to match the package version; a bump-or-fail test enforces that
  * any modification to HISTORY_IMPORT_SCHEMA_SQL must be accompanied by a version bump.
  */
-export declare const HISTORY_IMPORT_SCHEMA_VERSION = "0.5.4";
+export declare const HISTORY_IMPORT_SCHEMA_VERSION = "0.5.7";
 /**
  * DDL string that creates the history import checkpoint, ledger, and typed contract tables.
  *

package/dist/schema-sql.js

@@ -4,7 +4,7 @@
  * Guaranteed to match the package version; a bump-or-fail test enforces that
  * any modification to HISTORY_IMPORT_SCHEMA_SQL must be accompanied by a version bump.
  */
-export const HISTORY_IMPORT_SCHEMA_VERSION = '0.5.4';
+export const HISTORY_IMPORT_SCHEMA_VERSION = '0.5.7';
 /**
  * DDL string that creates the history import checkpoint, ledger, and typed contract tables.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gobing-ai/ts-llm-jsonl-importer",
-    "version": "0.5.4",
+    "version": "0.5.7",
     "description": "@gobing-ai/ts-llm-jsonl-importer — Generic JSONL importer for LLM agent history files.",
     "keywords": [
         "typescript",
@@ -47,9 +47,9 @@
         "release": "echo 'Manual publish is disabled. Releases go through GitHub Actions via Trusted Publishing — push a tag: git tag @gobing-ai/ts-llm-jsonl-importer-v<version> && git push --tags' && exit 1"
     },
     "dependencies": {
-        "@gobing-ai/ts-db": "^0.5.4",
-        "@gobing-ai/ts-runtime": "^0.5.4",
-        "@gobing-ai/ts-utils": "^0.5.4",
+        "@gobing-ai/ts-db": "^0.5.7",
+        "@gobing-ai/ts-runtime": "^0.5.7",
+        "@gobing-ai/ts-utils": "^0.5.7",
         "zod": "^4.1.0"
     },
     "devDependencies": {

package/src/redaction.ts

@@ -3,8 +3,17 @@ import type { JsonObject, RedactionRule } from './types';
 /** Default redaction rules for common token, key, and email shapes in agent logs. */
 export const DEFAULT_REDACTION_RULES: readonly RedactionRule[] = [
     {
+        // Task 0086 R5: vendor-specific token shapes. The underscore form
+        // deliberately requires a live/test infix — a bare sk_/pk_ prefix would
+        // redact DB identifiers like pk_customer_orders_id in code snippets.
         name: 'api-key',
-        pattern: /\b(?:sk|pk|ghp|github_pat|xox[baprs])-[-_a-zA-Z0-9]{12,}\b/g,
+        pattern:
+            /\b(?:(?:sk|pk|ghp|github_pat|xox[baprs])-[-_a-zA-Z0-9]{12,}|(?:sk|pk|rk)_(?:live|test)_[A-Za-z0-9]{10,})\b/g,
+        replacement: '[REDACTED:token]',
+    },
+    {
+        name: 'github-token',
+        pattern: /\b(?:gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,})\b/g,
         replacement: '[REDACTED:token]',
     },
     {
@@ -34,6 +43,14 @@ export const DEFAULT_REDACTION_RULES: readonly RedactionRule[] = [
     },
 ];
 
+/**
+ * Keys whose string values are secrets regardless of shape (task 0086 R5).
+ * Anchored so usage-analytics keys (tokens_used, token_count, max_tokens) are
+ * NOT redacted — those appear in LLM usage records.
+ */
+const SECRET_KEY =
+    /^(?:api[_-]?key|apikey|api[_-]?secret|token|access[_-]?token|refresh[_-]?token|auth[_-]?token|secret|secret[_-]?key|client[_-]?secret|private[_-]?key|session[_-]?token|password|passwd|authorization)$/i;
+
 /** Redact supported scalar and composite JSON values recursively. */
 export function redactValue(value: unknown, rules: readonly RedactionRule[] = DEFAULT_REDACTION_RULES): unknown {
     if (typeof value === 'string') {
@@ -44,7 +61,10 @@ export function redactValue(value: unknown, rules: readonly RedactionRule[] = DE
     }
     if (value !== null && typeof value === 'object') {
         return Object.fromEntries(
-            Object.entries(value as JsonObject).map(([key, entry]) => [key, redactValue(entry, rules)]),
+            Object.entries(value as JsonObject).map(([key, entry]) => [
+                key,
+                SECRET_KEY.test(key) && typeof entry === 'string' ? '[REDACTED:secret]' : redactValue(entry, rules),
+            ]),
         );
     }
     return value;

package/src/schema-sql.ts

@@ -4,7 +4,7 @@
  * Guaranteed to match the package version; a bump-or-fail test enforces that
  * any modification to HISTORY_IMPORT_SCHEMA_SQL must be accompanied by a version bump.
  */
-export const HISTORY_IMPORT_SCHEMA_VERSION = '0.5.4';
+export const HISTORY_IMPORT_SCHEMA_VERSION = '0.5.7';
 
 /**
  * DDL string that creates the history import checkpoint, ledger, and typed contract tables.