@heroku/js-blanket 0.0.0 → 0.0.1

package/dist/cjs/core/scrubber.js

@@ -0,0 +1,260 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Scrubber = void 0;
+/**
+ * Core Scrubber - Deep object traversal with PII scrubbing
+ *
+ * A high-performance, immutable scrubbing engine that removes sensitive data from structured objects.
+ * Supports three scrubbing modes:
+ * - **Field-based**: Scrubs values based on field names (e.g., 'password', 'apiToken')
+ * - **Path-based**: Scrubs values at specific paths (e.g., 'user.email', 'request.headers.authorization')
+ * - **Pattern-based**: Scrubs content matching regex patterns (e.g., SSN, credit cards)
+ *
+ * ### Design Principles
+ * - **Immutable**: All operations create new objects, never mutate inputs
+ * - **Type-safe**: Preserves TypeScript types through generic constraints
+ * - **Circular-safe**: Handles circular references without crashing
+ * - **Performance**: <1ms p95 for logging, <10ms p95 for exception handling (544k+ ops/sec)
+ *
+ * ### Pattern Adoption
+ * Patterns adopted from `@heroku/oauth-provider-adapters-for-mcp/src/logging/redaction.ts`:
+ * - Deep recursive traversal with circular reference detection
+ * - Immutable cloning strategy with fallback for complex objects
+ * - Nested path resolution (e.g., 'user.profile.email')
+ * - General array path handling (e.g., 'users[0].password')
+ * - Type-safe generics preserving input types
+ *
+ * Enhanced with:
+ * - Field-based matching supporting both strings and regular expressions
+ * - Pattern-based content scrubbing for SSN, credit cards, etc.
+ * - Dual scrubbing: both field/path matching AND content pattern replacement
+ *
+ * @example Basic Usage
+ * ```typescript
+ * const scrubber = new Scrubber({
+ *   fields: ['password', 'apiToken'],
+ *   replacement: '[REDACTED]'
+ * });
+ *
+ * const result = scrubber.scrub({
+ *   user: { name: 'John', password: 'secret123' }
+ * });
+ * // Result: { user: { name: 'John', password: '[REDACTED]' } }
+ * ```
+ *
+ * @example Advanced Usage with All Modes
+ * ```typescript
+ * const scrubber = new Scrubber({
+ *   fields: ['password', /api[-_]?key/i],  // Regex matches api_key, api-key, apikey
+ *   paths: ['user.email', 'request.headers.authorization'],
+ *   patterns: [/\b\d{3}-\d{2}-\d{4}\b/g],  // SSN pattern
+ *   replacement: '[SCRUBBED]'
+ * });
+ *
+ * const result = scrubber.scrub({
+ *   user: { name: 'John', email: 'john@example.com', password: 'secret' },
+ *   request: { headers: { authorization: 'Bearer token123' } },
+ *   message: 'User SSN is 123-45-6789'
+ * });
+ * ```
+ */
+class Scrubber {
+    config;
+    circularRefs = new WeakSet();
+    pathSet;
+    /**
+     * Creates a new Scrubber instance with the specified configuration
+     *
+     * @param config - Scrubbing configuration
+     * @param config.fields - Field names to scrub (strings or regex patterns)
+     * @param config.paths - Dot-notation paths to scrub (e.g., 'user.email', 'items[0].password')
+     * @param config.patterns - Regex patterns for content scrubbing (must include global flag for multiple matches)
+     * @param config.replacement - Replacement string for scrubbed values (default: '[SCRUBBED]')
+     * @param config.recursive - Whether to recursively scrub nested objects (default: true)
+     *
+     * @example
+     * ```typescript
+     * const scrubber = new Scrubber({
+     *   fields: ['password', /api[-_]?key/i],
+     *   paths: ['user.email'],
+     *   patterns: [/\b\d{3}-\d{2}-\d{4}\b/g],
+     *   replacement: '[REDACTED]'
+     * });
+     * ```
+     */
+    constructor(config) {
+        this.config = {
+            fields: config.fields || [],
+            paths: config.paths || [],
+            patterns: config.patterns || [],
+            replacement: config.replacement || '[SCRUBBED]',
+            recursive: config.recursive !== undefined ? config.recursive : true,
+        };
+        // Pre-compute path set for O(1) lookups
+        this.pathSet = new Set(this.config.paths);
+    }
+    /**
+     * Scrubs sensitive data from an object
+     *
+     * This is the main entry point for the scrubbing engine. It performs three types of scrubbing:
+     * 1. **Field-based**: Replaces values of fields matching configured field names/patterns
+     * 2. **Path-based**: Replaces values at specific dot-notation paths
+     * 3. **Pattern-based**: Replaces content within string values matching regex patterns
+     *
+     * The operation is immutable - the input object is not modified. A deep clone is created
+     * and scrubbed values are replaced in the clone.
+     *
+     * ### Performance Characteristics
+     * - Small objects (typical logs): ~0.003ms p95
+     * - Medium objects (typical errors): ~0.034ms p95
+     * - Large objects (10KB+): ~1.2ms p95
+     * - Throughput: 54,000+ events/sec
+     *
+     * @template T - The type of the input object (preserved in output)
+     * @param obj - The object to scrub
+     * @returns A result object containing the scrubbed data, whether scrubbing occurred, and which paths were scrubbed
+     *
+     * @example Basic scrubbing
+     * ```typescript
+     * const scrubber = new Scrubber({ fields: ['password'] });
+     * const result = scrubber.scrub({ user: 'john', password: 'secret' });
+     * // result.data === { user: 'john', password: '[SCRUBBED]' }
+     * // result.scrubbed === true
+     * // result.scrubbedPaths === ['password']
+     * ```
+     *
+     * @example Type preservation
+     * ```typescript
+     * interface User { name: string; email: string; password: string; }
+     * const scrubber = new Scrubber({ fields: ['password', 'email'] });
+     * const user: User = { name: 'John', email: 'john@example.com', password: 'secret' };
+     * const result = scrubber.scrub(user);
+     * // result.data is still typed as User
+     * ```
+     */
+    scrub(obj) {
+        const scrubbedPaths = [];
+        const cloned = this.deepClone(obj);
+        // Reset circular refs tracker for each scrub operation
+        this.circularRefs = new WeakSet();
+        const scrubbed = this.scrubObject(cloned, '', scrubbedPaths);
+        return {
+            data: scrubbed,
+            scrubbed: scrubbedPaths.length > 0,
+            scrubbedPaths,
+        };
+    }
+    scrubObject(obj, path, paths) {
+        // Handle circular references
+        if (obj && typeof obj === 'object') {
+            if (this.circularRefs.has(obj)) {
+                return '[Circular Reference]';
+            }
+            this.circularRefs.add(obj);
+        }
+        // Handle primitives
+        if (obj === null || typeof obj !== 'object') {
+            return this.scrubValue(obj, path, paths);
+        }
+        // Handle arrays
+        if (Array.isArray(obj)) {
+            return obj.map((item, index) => {
+                const indexStr = index.toString();
+                const arrayPath = path ? `${path}[${index}]` : indexStr;
+                // Check if this specific array index path should be scrubbed
+                if (this.pathSet.has(indexStr) || this.pathSet.has(arrayPath)) {
+                    paths.push(arrayPath);
+                    return this.config.replacement;
+                }
+                // Recursively scrub array items
+                return this.scrubObject(item, arrayPath, paths);
+            });
+        }
+        // Handle objects - create new object (immutable approach)
+        const result = {};
+        for (const [key, value] of Object.entries(obj)) {
+            const keyPath = path ? `${path}.${key}` : key;
+            // Check if this specific path should be scrubbed
+            if (this.pathSet.has(key) || this.pathSet.has(keyPath)) {
+                result[key] = this.config.replacement;
+                paths.push(keyPath);
+                continue;
+            }
+            // Check if key matches sensitive field pattern
+            if (this.isSensitiveField(key)) {
+                result[key] = this.config.replacement;
+                paths.push(keyPath);
+                continue;
+            }
+            // Recursively scrub value
+            result[key] = this.config.recursive
+                ? this.scrubObject(value, keyPath, paths)
+                : this.scrubValue(value, keyPath, paths);
+        }
+        return result;
+    }
+    scrubValue(value, path, paths) {
+        if (typeof value !== 'string') {
+            return value;
+        }
+        let scrubbed = value;
+        let didScrub = false;
+        // Check against patterns (SSN, credit cards, etc.)
+        for (const pattern of this.config.patterns) {
+            if (pattern.test(scrubbed)) {
+                scrubbed = scrubbed.replace(pattern, this.config.replacement);
+                didScrub = true;
+            }
+        }
+        if (didScrub) {
+            paths.push(path);
+        }
+        return scrubbed;
+    }
+    /**
+     * Check if a field name matches any configured sensitive field patterns
+     */
+    isSensitiveField(key) {
+        return this.config.fields.some((field) => {
+            if (field instanceof RegExp) {
+                return field.test(key);
+            }
+            return key.toLowerCase().includes(field.toLowerCase());
+        });
+    }
+    deepClone(obj) {
+        try {
+            // Fast path for JSON-serializable objects
+            return JSON.parse(JSON.stringify(obj));
+        }
+        catch {
+            // Fallback for objects with circular references
+            const seen = new WeakMap();
+            function clone(value) {
+                if (value === null || typeof value !== 'object') {
+                    return value;
+                }
+                if (seen.has(value)) {
+                    return seen.get(value);
+                }
+                if (Array.isArray(value)) {
+                    const arr = [];
+                    seen.set(value, arr);
+                    value.forEach((item, i) => {
+                        arr[i] = clone(item);
+                    });
+                    return arr;
+                }
+                const obj = {};
+                seen.set(value, obj);
+                Object.keys(value).forEach((key) => {
+                    obj[key] = clone(value[key]);
+                });
+                return obj;
+            }
+            return clone(obj);
+        }
+    }
+}
+exports.Scrubber = Scrubber;
+//# sourceMappingURL=scrubber.js.map

package/dist/cjs/core/scrubber.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scrubber.js","sourceRoot":"","sources":["../../../src/core/scrubber.ts"],"names":[],"mappings":";;;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,MAAa,QAAQ;IACX,MAAM,CAAwB;IAC9B,YAAY,GAAG,IAAI,OAAO,EAAE,CAAC;IAC7B,OAAO,CAAc;IAE7B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,YAAY,MAAmB;QAC7B,IAAI,CAAC,MAAM,GAAG;YACZ,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE;YACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE;YAC/B,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,YAAY;YAC/C,SAAS,EAAE,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;SACpE,CAAC;QAEF,wCAAwC;QACxC,IAAI,CAAC,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAsCG;IACH,KAAK,CAAI,GAAM;QACb,MAAM,aAAa,GAAa,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAEnC,uDAAuD;QACvD,IAAI,CAAC,YAAY,GAAG,IAAI,OAAO,EAAE,CAAC;QAElC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,EAAE,aAAa,CAAC,CAAC;QAE7D,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,aAAa,CAAC,MAAM,GAAG,CAAC;YAClC,aAAa;SACd,CAAC;IACJ,CAAC;IAEO,WAAW,CAAC,GAAQ,EAAE,IAAY,EAAE,KAAe;QACzD,6BAA6B;QAC7B,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YACnC,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/B,OAAO,sBAAsB,CAAC;YAChC,CAAC;YACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAED,oBAAoB;QACpB,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC3C,CAAC;QAED,gBAAgB;QAChB,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;gBAC7B,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAClC,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAExD,6DAA6D;gBAC7D,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC9D,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBACtB,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;gBACjC,CAAC;gBAED,gCAAgC;gBAChC,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;YAClD,CAAC,CAAC,CAAC;QACL,CAAC;QAED,0DAA0D;QAC1D,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAE9C,iDAAiD;YACjD,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvD,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;gBACtC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACpB,SAAS;YACX,CAAC;YAED,+CAA+C;YAC/C,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/B,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;gBACtC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACpB,SAAS;YACX,CAAC;YAED,0BAA0B;YAC1B,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS;gBACjC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC;gBACzC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAC7C,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,UAAU,CAAC,KAAU,EAAE,IAAY,EAAE,KAAe;QAC1D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,QAAQ,GAAG,KAAK,CAAC;QAErB,mDAAmD;QACnD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC3C,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC3B,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBAC9D,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACK,gBAAgB,CAAC,GAAW;QAClC,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YACvC,IAAI,KAAK,YAAY,MAAM,EAAE,CAAC;gBAC5B,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACzB,CAAC;YACD,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,SAAS,CAAI,GAAM;QACzB,IAAI,CAAC;YACH,0CAA0C;YAC1C,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,gDAAgD;YAChD,MAAM,IAAI,GAAG,IAAI,OAAO,EAAE,CAAC;YAE3B,SAAS,KAAK,CAAC,KAAU;gBACvB,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;oBAChD,OAAO,KAAK,CAAC;gBACf,CAAC;gBAED,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;oBACpB,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACzB,CAAC;gBAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;oBACzB,MAAM,GAAG,GAAU,EAAE,CAAC;oBACtB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;oBACrB,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;wBACxB,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;oBACvB,CAAC,CAAC,CAAC;oBACH,OAAO,GAAG,CAAC;gBACb,CAAC;gBAED,MAAM,GAAG,GAAQ,EAAE,CAAC;gBACpB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBACrB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;oBACjC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC/B,CAAC,CAAC,CAAC;gBACH,OAAO,GAAG,CAAC;YACb,CAAC;YAED,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;CACF;AAhOD,4BAgOC"}

package/dist/cjs/core/scrubber.test.js

@@ -0,0 +1,392 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const mocha_1 = require("mocha");
+const chai_1 = require("chai");
+const scrubber_js_1 = require("./scrubber.js");
+(0, mocha_1.describe)('Scrubber', () => {
+    (0, mocha_1.describe)('Field-based scrubbing', () => {
+        (0, mocha_1.it)('scrubs sensitive fields at any depth', () => {
+            const scrubber = new scrubber_js_1.Scrubber({
+                fields: ['access_token'],
+            });
+            const input = {
+                user: {
+                    profile: {
+                        settings: {
+                            auth: { access_token: 'secret123' },
+                        },
+                    },
+                },
+            };
+            const { data } = scrubber.scrub(input);
+            (0, chai_1.expect)(data.user.profile.settings.auth.access_token).to.equal('[SCRUBBED]');
+        });
+        (0, mocha_1.it)('handles case-insensitive field matching', () => {
+            const scrubber = new scrubber_js_1.Scrubber({
+                fields: ['password'],
+            });
+            const input = {
+                Password: 'secret1',
+                PASSWORD: 'secret2',
+                password: 'secret3',
+            };
+            const { data } = scrubber.scrub(input);
+            (0, chai_1.expect)(data.Password).to.equal('[SCRUBBED]');
+            (0, chai_1.expect)(data.PASSWORD).to.equal('[SCRUBBED]');
+            (0, chai_1.expect)(data.password).to.equal('[SCRUBBED]');
+        });
+        (0, mocha_1.it)('supports regex field patterns', () => {
+            const scrubber = new scrubber_js_1.Scrubber({
+                fields: [/api[-_]?key/i], // Matches api_key, api-key, apikey (case insensitive)
+            });
+            const input = {
+                user_api_key: 'secret',
+                API_KEY_V2: 'secret',
+                myApiKeyHere: 'secret',
+            };
+            const { data } = scrubber.scrub(input);
+            (0, chai_1.expect)(data.user_api_key).to.equal('[SCRUBBED]');
+            (0, chai_1.expect)(data.API_KEY_V2).to.equal('[SCRUBBED]');
+            (0, chai_1.expect)(data.myApiKeyHere).to.equal('[SCRUBBED]');
+        });
+    });
+    (0, mocha_1.describe)('Path-based scrubbing', () => {
+        (0, mocha_1.it)('scrubs specific paths only', () => {
+            const scrubber = new scrubber_js_1.Scrubber({
+                paths: ['user.profile.email'],
+            });
+            const input = {
+                user: {
+                    profile: { email: 'bob@example.com', name: 'Bob' },
+                    settings: { email: 'notifications@example.com' },
+                },
+            };
+            const { data } = scrubber.scrub(input);
+            (0, chai_1.expect)(data.user.profile.email).to.equal('[SCRUBBED]');
+            (0, chai_1.expect)(data.user.settings.email).to.equal('notifications@example.com');
+        });
+        (0, mocha_1.it)('scrubs array items by index', () => {
+            const scrubber = new scrubber_js_1.Scrubber({
+                paths: ['users[0].password'],
+            });
+            const input = {
+                users: [
+                    { name: 'bob', password: 'secret1' },
+                    { name: 'alice', password: 'secret2' },
+                ],
+            };
+            const { data } = scrubber.scrub(input);
+            (0, chai_1.expect)(data.users?.[0]?.password).to.equal('[SCRUBBED]');
+            (0, chai_1.expect)(data.users?.[1]?.password).to.equal('secret2');
+        });
+    });
+    (0, mocha_1.describe)('Pattern-based scrubbing', () => {
+        (0, mocha_1.it)('scrubs SSN patterns in strings', () => {
+            const scrubber = new scrubber_js_1.Scrubber({
+                patterns: [/\b\d{3}-\d{2}-\d{4}\b/g],
+            });
+            const input = { message: 'User SSN is 123-45-6789' };
+            const { data } = scrubber.scrub(input);
+            (0, chai_1.expect)(data.message).to.contain('[SCRUBBED]');
+            (0, chai_1.expect)(data.message).not.to.contain('123-45-6789');
+        });
+        (0, mocha_1.it)('scrubs email patterns in strings', () => {
+            const scrubber = new scrubber_js_1.Scrubber({
+                patterns: [/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/g],
+            });
+            const input = { log: 'Auth failed for user@example.com' };
+            const { data } = scrubber.scrub(input);
+            (0, chai_1.expect)(data.log).to.contain('[SCRUBBED]');
+            (0, chai_1.expect)(data.log).not.to.contain('user@example.com');
+        });
+        (0, mocha_1.it)('scrubs multiple patterns in same string', () => {
+            const scrubber = new scrubber_js_1.Scrubber({
+                patterns: [
+                    /\b\d{3}-\d{2}-\d{4}\b/g, // SSN
+                    /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/g, // Email
+                ],
+            });
+            const input = {
+                log: 'User bob@example.com has SSN 123-45-6789',
+            };
+            const { data } = scrubber.scrub(input);
+            (0, chai_1.expect)(data.log).not.to.contain('bob@example.com');
+            (0, chai_1.expect)(data.log).not.to.contain('123-45-6789');
+        });
+    });
+    (0, mocha_1.describe)('Array handling', () => {
+        (0, mocha_1.it)('scrubs fields across all array items', () => {
+            const scrubber = new scrubber_js_1.Scrubber({
+                fields: ['password'],
+            });
+            const users = [
+                { name: 'bob', password: 'secret' },
+                { name: 'alice', password: 'hidden' },
+            ];
+            const { data } = scrubber.scrub(users);
+            (0, chai_1.expect)(data[0]?.password).to.equal('[SCRUBBED]');
+            (0, chai_1.expect)(data[1]?.password).to.equal('[SCRUBBED]');
+            (0, chai_1.expect)(data[0]?.name).to.equal('bob');
+            (0, chai_1.expect)(data[1]?.name).to.equal('alice');
+        });
+        (0, mocha_1.it)('handles nested arrays', () => {
+            const scrubber = new scrubber_js_1.Scrubber({
+                fields: ['api_key'],
+            });
+            const input = {
+                teams: [
+                    {
+                        members: [
+                            { name: 'bob', api_key: 'secret1' },
+                            { name: 'alice', api_key: 'secret2' },
+                        ],
+                    },
+                ],
+            };
+            const { data } = scrubber.scrub(input);
+            (0, chai_1.expect)(data.teams?.[0]?.members?.[0]?.api_key).to.equal('[SCRUBBED]');
+            (0, chai_1.expect)(data.teams?.[0]?.members?.[1]?.api_key).to.equal('[SCRUBBED]');
+        });
+    });
+    (0, mocha_1.describe)('Circular reference handling', () => {
+        (0, mocha_1.it)('handles circular references without crashing', () => {
+            const scrubber = new scrubber_js_1.Scrubber({ fields: [] });
+            const input = { name: 'test' };
+            input.self = input;
+            const { data } = scrubber.scrub(input);
+            (0, chai_1.expect)(data.self).to.equal('[Circular Reference]');
+        });
+        (0, mocha_1.it)('scrubs fields before detecting circular references', () => {
+            const scrubber = new scrubber_js_1.Scrubber({ fields: ['password'] });
+            const input = { name: 'test', password: 'secret' };
+            input.self = input;
+            const { data } = scrubber.scrub(input);
+            (0, chai_1.expect)(data.password).to.equal('[SCRUBBED]');
+            (0, chai_1.expect)(data.self).to.equal('[Circular Reference]');
+        });
+        (0, mocha_1.it)('handles nested circular references', () => {
+            const scrubber = new scrubber_js_1.Scrubber({ fields: [] });
+            const input = { name: 'test', nested: { level: 1 } };
+            input.self = input;
+            input.nested.parent = input;
+            const { data } = scrubber.scrub(input);
+            (0, chai_1.expect)(data.self).to.equal('[Circular Reference]');
+            (0, chai_1.expect)(data.nested.parent).to.equal('[Circular Reference]');
+        });
+    });
+    (0, mocha_1.describe)('Combined modes', () => {
+        (0, mocha_1.it)('applies field + path + pattern scrubbing together', () => {
+            const scrubber = new scrubber_js_1.Scrubber({
+                fields: ['api_key'],
+                paths: ['user.email'],
+                patterns: [/\b\d{3}-\d{2}-\d{4}\b/g],
+            });
+            const input = {
+                user: {
+                    email: 'bob@example.com', // Path-based
+                    api_key: 'secret-key-123', // Field-based
+                },
+                log: 'SSN: 123-45-6789', // Pattern-based
+                nested: {
+                    service: {
+                        api_key: 'another-secret', // Field-based (any depth)
+                    },
+                },
+            };
+            const { data, scrubbedPaths } = scrubber.scrub(input);
+            (0, chai_1.expect)(data.user?.email).to.equal('[SCRUBBED]');
+            (0, chai_1.expect)(data.user?.api_key).to.equal('[SCRUBBED]');
+            (0, chai_1.expect)(data.log).not.to.contain('123-45-6789');
+            (0, chai_1.expect)(data.nested?.service?.api_key).to.equal('[SCRUBBED]');
+            (0, chai_1.expect)(scrubbedPaths.length).to.be.greaterThan(0);
+        });
+    });
+    (0, mocha_1.describe)('Scrub result metadata', () => {
+        (0, mocha_1.it)('tracks scrubbed paths', () => {
+            const scrubber = new scrubber_js_1.Scrubber({
+                fields: ['password'],
+                paths: ['user.email'],
+            });
+            const input = {
+                user: { email: 'test@example.com', password: 'secret' },
+            };
+            const result = scrubber.scrub(input);
+            (0, chai_1.expect)(result.scrubbed).to.be.true;
+            (0, chai_1.expect)(result.scrubbedPaths).to.include.members([
+                'user.email',
+                'user.password',
+            ]);
+        });
+        (0, mocha_1.it)('reports scrubbed=false when nothing was scrubbed', () => {
+            const scrubber = new scrubber_js_1.Scrubber({
+                fields: ['password'],
+            });
+            const input = { name: 'Bob', age: 30 };
+            const result = scrubber.scrub(input);
+            (0, chai_1.expect)(result.scrubbed).to.be.false;
+            (0, chai_1.expect)(result.scrubbedPaths).to.have.length(0);
+        });
+    });
+    (0, mocha_1.describe)('Immutability', () => {
+        (0, mocha_1.it)('does not mutate original object', () => {
+            const scrubber = new scrubber_js_1.Scrubber({
+                fields: ['password'],
+            });
+            const input = { user: { password: 'secret', name: 'Bob' } };
+            const original = JSON.stringify(input);
+            scrubber.scrub(input);
+            (0, chai_1.expect)(JSON.stringify(input)).to.equal(original);
+            (0, chai_1.expect)(input.user.password).to.equal('secret');
+        });
+    });
+    (0, mocha_1.describe)('Custom replacement text', () => {
+        (0, mocha_1.it)('uses custom replacement string', () => {
+            const scrubber = new scrubber_js_1.Scrubber({
+                fields: ['password'],
+                replacement: '***REDACTED***',
+            });
+            const input = { password: 'secret' };
+            const { data } = scrubber.scrub(input);
+            (0, chai_1.expect)(data.password).to.equal('***REDACTED***');
+        });
+    });
+    (0, mocha_1.describe)('Edge cases', () => {
+        (0, mocha_1.it)('handles null values', () => {
+            const scrubber = new scrubber_js_1.Scrubber({ fields: ['password'] });
+            const input = { user: null };
+            const { data } = scrubber.scrub(input);
+            (0, chai_1.expect)(data.user).to.be.null;
+        });
+        (0, mocha_1.it)('handles undefined values', () => {
+            const scrubber = new scrubber_js_1.Scrubber({ fields: ['password'] });
+            const input = { user: undefined };
+            const { data } = scrubber.scrub(input);
+            (0, chai_1.expect)(data.user).to.be.undefined;
+        });
+        (0, mocha_1.it)('handles empty objects', () => {
+            const scrubber = new scrubber_js_1.Scrubber({ fields: ['password'] });
+            const input = {};
+            const { data } = scrubber.scrub(input);
+            (0, chai_1.expect)(data).to.deep.equal({});
+        });
+        (0, mocha_1.it)('handles empty arrays', () => {
+            const scrubber = new scrubber_js_1.Scrubber({ fields: ['password'] });
+            const input = [];
+            const { data } = scrubber.scrub(input);
+            (0, chai_1.expect)(data).to.deep.equal([]);
+        });
+        (0, mocha_1.it)('handles primitive values', () => {
+            const scrubber = new scrubber_js_1.Scrubber({ fields: ['password'] });
+            (0, chai_1.expect)(scrubber.scrub('test').data).to.equal('test');
+            (0, chai_1.expect)(scrubber.scrub(123).data).to.equal(123);
+            (0, chai_1.expect)(scrubber.scrub(true).data).to.equal(true);
+        });
+        (0, mocha_1.it)('scrubs entire array element by index path', () => {
+            // Tests lines 76-78: scrubbing entire array element, not just a field
+            const scrubber = new scrubber_js_1.Scrubber({
+                paths: ['users[0]', 'items[1]'], // Scrub specific array elements by full path
+            });
+            const input = {
+                users: [
+                    { name: 'bob', email: 'bob@example.com' }, // Should be scrubbed entirely
+                    { name: 'alice', email: 'alice@example.com' }, // Not scrubbed
+                ],
+                items: [
+                    { id: 1, value: 'keep' }, // Not scrubbed
+                    { id: 2, value: 'scrub' }, // Should be scrubbed entirely
+                ],
+            };
+            const { data } = scrubber.scrub(input);
+            (0, chai_1.expect)(data.users?.[0]).to.equal('[SCRUBBED]');
+            (0, chai_1.expect)(data.users?.[1]?.name).to.equal('alice'); // Not scrubbed
+            (0, chai_1.expect)(data.items?.[0]?.value).to.equal('keep'); // Not scrubbed
+            (0, chai_1.expect)(data.items?.[1]).to.equal('[SCRUBBED]'); // Entire element scrubbed
+        });
+        (0, mocha_1.it)('scrubs array index across all arrays', () => {
+            // Tests that index-only paths (e.g., '0') scrub that index in ALL arrays
+            const scrubber = new scrubber_js_1.Scrubber({
+                paths: ['1'], // Scrub index 1 of ANY array
+            });
+            const input = {
+                users: [
+                    { name: 'bob' }, // Index 0 - not scrubbed
+                    { name: 'alice' }, // Index 1 - scrubbed
+                    { name: 'charlie' }, // Index 2 - not scrubbed
+                ],
+                teams: [
+                    { id: 'team-a' }, // Index 0 - not scrubbed
+                    { id: 'team-b' }, // Index 1 - scrubbed
+                ],
+            };
+            const { data } = scrubber.scrub(input);
+            (0, chai_1.expect)(data.users?.[0]?.name).to.equal('bob');
+            (0, chai_1.expect)(data.users?.[1]).to.equal('[SCRUBBED]'); // Scrubbed by index
+            (0, chai_1.expect)(data.users?.[2]?.name).to.equal('charlie');
+            (0, chai_1.expect)(data.teams?.[0]?.id).to.equal('team-a');
+            (0, chai_1.expect)(data.teams?.[1]).to.equal('[SCRUBBED]'); // Scrubbed by index
+        });
+        (0, mocha_1.it)('handles deeply nested objects (10+ levels)', () => {
+            // Validates discovery doc requirement: "Scrubs nested objects 10+ levels deep"
+            const scrubber = new scrubber_js_1.Scrubber({
+                fields: ['secret'],
+            });
+            // Build a 15-level deep object
+            const input = { level: 1 };
+            let current = input;
+            for (let i = 2; i <= 15; i++) {
+                current.nested = { level: i };
+                current = current.nested;
+            }
+            // Add secret at the deepest level
+            current.secret = 'deep-secret';
+            current.public = 'visible';
+            const { data } = scrubber.scrub(input);
+            // Navigate to the deepest level
+            let deepest = data;
+            for (let i = 1; i < 15; i++) {
+                (0, chai_1.expect)(deepest.level).to.equal(i);
+                deepest = deepest.nested;
+            }
+            // Verify scrubbing worked at 15 levels deep
+            (0, chai_1.expect)(deepest.level).to.equal(15);
+            (0, chai_1.expect)(deepest.secret).to.equal('[SCRUBBED]');
+            (0, chai_1.expect)(deepest.public).to.equal('visible');
+        });
+        (0, mocha_1.it)('handles circular references in deep clone fallback (arrays)', () => {
+            // Tests lines 166-172: circular reference deep clone for arrays
+            const scrubber = new scrubber_js_1.Scrubber({
+                fields: ['password'],
+            });
+            // Create an object with circular references that will trigger the fallback clone
+            const parent = { name: 'parent', password: 'secret' };
+            const child1 = { name: 'child1', items: [] };
+            const child2 = { name: 'child2', password: 'hidden' };
+            // Create circular reference in an array
+            child1.items = [child2, parent]; // Array contains parent
+            parent.children = [child1]; // Parent contains array with circular ref
+            const { data } = scrubber.scrub(parent);
+            // Verify scrubbing happened
+            (0, chai_1.expect)(data.password).to.equal('[SCRUBBED]');
+            (0, chai_1.expect)(data.children?.[0]?.name).to.equal('child1');
+            // Verify circular reference was handled in the array
+            (0, chai_1.expect)(data.children?.[0]?.items?.[1]).to.equal('[Circular Reference]');
+        });
+        (0, mocha_1.it)('handles arrays with circular self-reference', () => {
+            // Additional test for circular array deep cloning
+            const scrubber = new scrubber_js_1.Scrubber({
+                fields: ['token'],
+            });
+            const obj = {
+                token: 'secret-token',
+                list: [{ name: 'item1' }],
+            };
+            // Array references the parent object
+            obj.list.push(obj);
+            const { data } = scrubber.scrub(obj);
+            (0, chai_1.expect)(data.token).to.equal('[SCRUBBED]');
+            (0, chai_1.expect)(data.list?.[0]?.name).to.equal('item1');
+            (0, chai_1.expect)(data.list?.[1]).to.equal('[Circular Reference]');
+        });
+    });
+});
+//# sourceMappingURL=scrubber.test.js.map