@keynv/redactor 0.1.0-rc.23

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025-2026 keynv-labs and contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/batch.d.ts

@@ -0,0 +1,10 @@
+import type { RedactOptions, RedactResult } from './types.js';
+/**
+ * Walks `patterns` and `text`, returning every non-overlapping hit.
+ *
+ * When two patterns overlap, the earlier-starting (longer when tied)
+ * match wins. This avoids double-redaction artifacts like
+ * `<REDACTED:postgres-uri>` further nibbled by `<REDACTED:high-entropy>`.
+ */
+export declare function redact(text: string, opts?: RedactOptions): RedactResult;
+//# sourceMappingURL=batch.d.ts.map

package/dist/batch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"batch.d.ts","sourceRoot":"","sources":["../src/batch.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAkB,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAkB9E;;;;;;GAMG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,aAAkB,GAAG,YAAY,CA0F3E"}

package/dist/batch.js

@@ -0,0 +1,111 @@
+import { findEntropyMatches } from './entropy.js';
+import { BUILTIN_PATTERNS } from './patterns.js';
+const ENTROPY_PATTERN_NAME = 'high-entropy';
+const LITERAL_PATTERN_NAME = 'literal-alias-resolved-value';
+function defaultRender(name) {
+    return `<REDACTED:${name}>`;
+}
+function preview(matched) {
+    if (matched.length <= 4)
+        return '****';
+    return `${matched.slice(0, 3)}...`;
+}
+function escapeRegExp(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/**
+ * Walks `patterns` and `text`, returning every non-overlapping hit.
+ *
+ * When two patterns overlap, the earlier-starting (longer when tied)
+ * match wins. This avoids double-redaction artifacts like
+ * `<REDACTED:postgres-uri>` further nibbled by `<REDACTED:high-entropy>`.
+ */
+export function redact(text, opts = {}) {
+    if (typeof text !== 'string' || text.length === 0) {
+        return { text, matches: [] };
+    }
+    const patterns = [
+        ...(opts.patterns ?? BUILTIN_PATTERNS),
+        ...(opts.extraPatterns ?? []),
+    ];
+    // Pattern matches.
+    const raw = [];
+    for (const pattern of patterns) {
+        pattern.regex.lastIndex = 0;
+        for (const m of text.matchAll(pattern.regex)) {
+            if (m.index === undefined)
+                continue;
+            raw.push({
+                pattern: pattern.name,
+                start: m.index,
+                end: m.index + m[0].length,
+                preview: preview(m[0]),
+            });
+        }
+    }
+    // Literal matches (e.g., resolved alias values that the caller wants
+    // pre-emptively redacted).
+    if (opts.literals && opts.literals.length > 0) {
+        for (const literal of opts.literals) {
+            if (!literal)
+                continue;
+            const re = new RegExp(escapeRegExp(literal), 'g');
+            for (const m of text.matchAll(re)) {
+                if (m.index === undefined)
+                    continue;
+                raw.push({
+                    pattern: LITERAL_PATTERN_NAME,
+                    start: m.index,
+                    end: m.index + literal.length,
+                    preview: preview(literal),
+                });
+            }
+        }
+    }
+    // Entropy detector.
+    const entropyMatches = findEntropyMatches(text, opts.entropy);
+    for (const m of entropyMatches) {
+        raw.push({
+            pattern: ENTROPY_PATTERN_NAME,
+            start: m.start,
+            end: m.end,
+            preview: preview(m.token),
+        });
+    }
+    if (raw.length === 0)
+        return { text, matches: [] };
+    // Sort and de-overlap (earliest start wins; longer match wins on tie).
+    raw.sort((a, b) => a.start - b.start || b.end - b.start - (a.end - a.start));
+    const merged = [];
+    for (const m of raw) {
+        const last = merged[merged.length - 1];
+        if (!last || m.start >= last.end) {
+            merged.push({ ...m });
+        }
+        else if (m.end > last.end) {
+            // Partial overlap: extend the surviving match to cover the union span.
+            // Dropping `m` outright would leave characters (last.end, m.end) — the
+            // tail of a real secret — un-redacted. Extending only ever redacts
+            // MORE, never less, so it is strictly safer.
+            last.end = m.end;
+        }
+    }
+    // Build the redacted output in a single left-to-right pass. `merged` is
+    // sorted ascending and non-overlapping, so we can push [gap, token] pieces
+    // and join once — O(n) instead of the O(matches × filesize) rebuild that a
+    // per-match slice+concat incurs on large scans.
+    const pieces = [];
+    let cursor = 0;
+    for (const m of merged) {
+        if (m.start > cursor)
+            pieces.push(text.slice(cursor, m.start));
+        const original = text.slice(m.start, m.end);
+        const renderer = patterns.find((p) => p.name === m.pattern)?.redactWith ?? (() => defaultRender(m.pattern));
+        pieces.push(renderer(original));
+        cursor = m.end;
+    }
+    if (cursor < text.length)
+        pieces.push(text.slice(cursor));
+    return { text: pieces.join(''), matches: merged };
+}
+//# sourceMappingURL=batch.js.map

package/dist/batch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"batch.js","sourceRoot":"","sources":["../src/batch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAGjD,MAAM,oBAAoB,GAAG,cAAc,CAAC;AAC5C,MAAM,oBAAoB,GAAG,8BAA8B,CAAC;AAE5D,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,aAAa,IAAI,GAAG,CAAC;AAC9B,CAAC;AAED,SAAS,OAAO,CAAC,OAAe;IAC9B,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IACvC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC;AACrC,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,MAAM,CAAC,IAAY,EAAE,OAAsB,EAAE;IAC3D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC/B,CAAC;IAED,MAAM,QAAQ,GAAc;QAC1B,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,gBAAgB,CAAC;QACtC,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;KAC9B,CAAC;IAEF,mBAAmB;IACnB,MAAM,GAAG,GAAY,EAAE,CAAC;IACxB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;QAC5B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7C,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;gBAAE,SAAS;YACpC,GAAG,CAAC,IAAI,CAAC;gBACP,OAAO,EAAE,OAAO,CAAC,IAAI;gBACrB,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,GAAG,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;gBAC1B,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;aACvB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,2BAA2B;IAC3B,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,IAAI,CAAC,OAAO;gBAAE,SAAS;YACvB,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;YAClD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;gBAClC,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;oBAAE,SAAS;gBACpC,GAAG,CAAC,IAAI,CAAC;oBACP,OAAO,EAAE,oBAAoB;oBAC7B,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,GAAG,EAAE,CAAC,CAAC,KAAK,GAAG,OAAO,CAAC,MAAM;oBAC7B,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC;iBAC1B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,oBAAoB;IACpB,MAAM,cAAc,GAAG,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9D,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;QAC/B,GAAG,CAAC,IAAI,CAAC;YACP,OAAO,EAAE,oBAAoB;YAC7B,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAEnD,uEAAuE;IACvE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAG7E,MAAM,MAAM,GAAmB,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACjC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACxB,CAAC;aAAM,IAAI,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC5B,uEAAuE;YACvE,uEAAuE;YACvE,mEAAmE;YACnE,6CAA6C;YAC7C,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;QACnB,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,2EAA2E;IAC3E,2EAA2E;IAC3E,gDAAgD;IAChD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,KAAK,GAAG,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,QAAQ,GACZ,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7F,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QAChC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC;IACjB,CAAC;IACD,IAAI,MAAM,GAAG,IAAI,CAAC,MAAM;QAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1D,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AACpD,CAAC"}

package/dist/entropy.d.ts

@@ -0,0 +1,18 @@
+import type { EntropyOptions } from './types.js';
+/**
+ * Shannon entropy of a string in bits-per-character. Higher = more
+ * "random-looking". Real secrets typically score 4.0-6.0 bits/char.
+ */
+export declare function shannonEntropy(s: string): number;
+export interface EntropyMatch {
+    start: number;
+    end: number;
+    token: string;
+}
+/**
+ * Finds high-entropy tokens within `text`. Tokens are split on
+ * whitespace + common separators; each candidate token is checked
+ * against the length and entropy thresholds.
+ */
+export declare function findEntropyMatches(text: string, opts?: EntropyOptions): EntropyMatch[];
+//# sourceMappingURL=entropy.d.ts.map

package/dist/entropy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entropy.d.ts","sourceRoot":"","sources":["../src/entropy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAqBjD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAWhD;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,cAAmB,GAAG,YAAY,EAAE,CA4B1F"}

package/dist/entropy.js

@@ -0,0 +1,70 @@
+/** Token boundary characters. We split on whitespace, quotes, and common
+ * separators that appear around credential-shaped substrings. */
+const TOKEN_BOUNDARY_RE = /[\s,;:'"<>(){}[\]=]+/;
+const DEFAULT_EXCLUDE_PREFIXES = [
+    'sha1-',
+    'sha256:',
+    'sha256-',
+    'sha384-',
+    'sha512-',
+];
+const DEFAULTS = {
+    enabled: true,
+    minLength: 24,
+    minBitsPerChar: 4.5,
+    excludePrefixes: DEFAULT_EXCLUDE_PREFIXES,
+};
+/**
+ * Shannon entropy of a string in bits-per-character. Higher = more
+ * "random-looking". Real secrets typically score 4.0-6.0 bits/char.
+ */
+export function shannonEntropy(s) {
+    if (s.length === 0)
+        return 0;
+    const counts = new Map();
+    for (const ch of s)
+        counts.set(ch, (counts.get(ch) ?? 0) + 1);
+    const n = s.length;
+    let h = 0;
+    for (const c of counts.values()) {
+        const p = c / n;
+        h -= p * Math.log2(p);
+    }
+    return h;
+}
+/**
+ * Finds high-entropy tokens within `text`. Tokens are split on
+ * whitespace + common separators; each candidate token is checked
+ * against the length and entropy thresholds.
+ */
+export function findEntropyMatches(text, opts = {}) {
+    const cfg = { ...DEFAULTS, ...opts };
+    if (!cfg.enabled)
+        return [];
+    const matches = [];
+    let i = 0;
+    while (i < text.length) {
+        // Skip token boundaries.
+        while (i < text.length && TOKEN_BOUNDARY_RE.test(text[i] ?? ''))
+            i++;
+        if (i >= text.length)
+            break;
+        const start = i;
+        while (i < text.length && !TOKEN_BOUNDARY_RE.test(text[i] ?? ''))
+            i++;
+        const end = i;
+        const token = text.slice(start, end);
+        if (token.length >= cfg.minLength) {
+            const lower = token.toLowerCase();
+            const excluded = cfg.excludePrefixes.some((p) => lower.startsWith(p));
+            if (!excluded) {
+                const h = shannonEntropy(token);
+                if (h >= cfg.minBitsPerChar) {
+                    matches.push({ start, end, token });
+                }
+            }
+        }
+    }
+    return matches;
+}
+//# sourceMappingURL=entropy.js.map

package/dist/entropy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entropy.js","sourceRoot":"","sources":["../src/entropy.ts"],"names":[],"mappings":"AAEA;iEACiE;AACjE,MAAM,iBAAiB,GAAG,sBAAsB,CAAC;AAEjD,MAAM,wBAAwB,GAA0B;IACtD,OAAO;IACP,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;CACV,CAAC;AAEF,MAAM,QAAQ,GAA6B;IACzC,OAAO,EAAE,IAAI;IACb,SAAS,EAAE,EAAE;IACb,cAAc,EAAE,GAAG;IACnB,eAAe,EAAE,wBAAwB;CAC1C,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,CAAS;IACtC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,EAAE,IAAI,CAAC;QAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9D,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAQD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,OAAuB,EAAE;IACxE,MAAM,GAAG,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;IACrC,IAAI,CAAC,GAAG,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IAE5B,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,yBAAyB;QACzB,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAAE,CAAC,EAAE,CAAC;QACrE,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM;QAE5B,MAAM,KAAK,GAAG,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAAE,CAAC,EAAE,CAAC;QACtE,MAAM,GAAG,GAAG,CAAC,CAAC;QACd,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAErC,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;YAClC,MAAM,QAAQ,GAAG,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;YACtE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;gBAChC,IAAI,CAAC,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;oBAC5B,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;gBACtC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+export type { EntropyOptions, Match, Pattern, RedactionSummary, RedactOptions, RedactResult, } from './types.js';
+export { BUILTIN_PATTERNS, BUILTIN_LINE_PATTERNS } from './patterns.js';
+export { redact } from './batch.js';
+export { createRedactStream, type StreamingOptions } from './streaming.js';
+export { findEntropyMatches, shannonEntropy } from './entropy.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,cAAc,EACd,KAAK,EACL,OAAO,EACP,gBAAgB,EAChB,aAAa,EACb,YAAY,GACb,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -0,0 +1,5 @@
+export { BUILTIN_PATTERNS, BUILTIN_LINE_PATTERNS } from './patterns.js';
+export { redact } from './batch.js';
+export { createRedactStream } from './streaming.js';
+export { findEntropyMatches, shannonEntropy } from './entropy.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAyB,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC"}

package/dist/patterns.d.ts

@@ -0,0 +1,16 @@
+import type { Pattern } from './types.js';
+/**
+ * Built-in pattern bank. Mirrored 1:1 with docs/02-threat-model.md
+ * §pattern-bank. Adding a pattern:
+ *  1. Append the entry here.
+ *  2. Add a regression test in patterns.test.ts (positive + a negative
+ *     to verify it doesn't false-positive on innocuous fixtures).
+ *  3. Update docs/02-threat-model.md.
+ */
+export declare const BUILTIN_PATTERNS: ReadonlyArray<Pattern>;
+/**
+ * The subset of `BUILTIN_PATTERNS` that are safe to apply per-line in
+ * a streaming context (no multiline regexes).
+ */
+export declare const BUILTIN_LINE_PATTERNS: ReadonlyArray<Pattern>;
+//# sourceMappingURL=patterns.d.ts.map

package/dist/patterns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"patterns.d.ts","sourceRoot":"","sources":["../src/patterns.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE1C;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,EAAE,aAAa,CAAC,OAAO,CA8HnD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,aAAa,CAAC,OAAO,CAExD,CAAC"}

package/dist/patterns.js

@@ -0,0 +1,136 @@
+/**
+ * Built-in pattern bank. Mirrored 1:1 with docs/02-threat-model.md
+ * §pattern-bank. Adding a pattern:
+ *  1. Append the entry here.
+ *  2. Add a regression test in patterns.test.ts (positive + a negative
+ *     to verify it doesn't false-positive on innocuous fixtures).
+ *  3. Update docs/02-threat-model.md.
+ */
+export const BUILTIN_PATTERNS = [
+    // URI-shaped credentials
+    {
+        name: 'postgres-uri',
+        regex: /postgres(?:ql)?:\/\/[^\s'"<>]+/g,
+    },
+    {
+        name: 'mysql-uri',
+        regex: /mysql:\/\/[^\s'"<>]+/g,
+    },
+    {
+        name: 'mongodb-uri',
+        regex: /mongodb(?:\+srv)?:\/\/[^\s'"<>]+/g,
+    },
+    {
+        name: 'redis-uri-with-password',
+        regex: /rediss?:\/\/[^@\s'"<>]+@[^\s'"<>]+/g,
+    },
+    {
+        name: 'slack-webhook',
+        regex: /https:\/\/hooks\.slack\.com\/services\/[A-Z0-9]+\/[A-Z0-9]+\/[A-Za-z0-9]+/g,
+    },
+    // Cloud provider keys
+    {
+        name: 'aws-access-key-id',
+        regex: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g,
+    },
+    {
+        name: 'gcp-api-key',
+        regex: /\bAIza[0-9A-Za-z_-]{35}\b/g,
+    },
+    // Vendor-prefixed tokens
+    {
+        name: 'github-pat-classic',
+        regex: /\bghp_[A-Za-z0-9]{36}\b/g,
+    },
+    {
+        name: 'github-oauth-user-to-server',
+        regex: /\bghu_[A-Za-z0-9]{36}\b/g,
+    },
+    {
+        name: 'github-oauth-server-to-server',
+        regex: /\bgho_[A-Za-z0-9]{36}\b/g,
+    },
+    {
+        // Fine-grained PATs are commonly 82 chars after the prefix but we
+        // accept >=40 to cover dev-mode and future variations.
+        name: 'github-pat-fine-grained',
+        regex: /\bgithub_pat_[A-Za-z0-9_]{40,}\b/g,
+    },
+    {
+        name: 'slack-bot-token',
+        regex: /\bxoxb-[A-Za-z0-9-]{24,}\b/g,
+    },
+    {
+        name: 'slack-user-token',
+        regex: /\bxoxp-[A-Za-z0-9-]{24,}\b/g,
+    },
+    {
+        name: 'stripe-live-secret-key',
+        regex: /\bsk_live_[A-Za-z0-9]{24,}\b/g,
+    },
+    {
+        name: 'stripe-test-secret-key',
+        regex: /\bsk_test_[A-Za-z0-9]{24,}\b/g,
+    },
+    {
+        name: 'stripe-restricted-live-key',
+        regex: /\brk_live_[A-Za-z0-9]{24,}\b/g,
+    },
+    {
+        name: 'stripe-restricted-test-key',
+        regex: /\brk_test_[A-Za-z0-9]{24,}\b/g,
+    },
+    {
+        // Negative lookahead skips Anthropic-prefixed keys so the more
+        // specific anthropic-api-key pattern wins on those.
+        name: 'openai-api-key',
+        regex: /\bsk-(?!ant-)(?:proj-)?[A-Za-z0-9_-]{20,}\b/g,
+    },
+    {
+        name: 'anthropic-api-key',
+        regex: /\bsk-ant-(?:api03|admin01)-[A-Za-z0-9_-]{20,}\b/g,
+    },
+    // Hex-shaped vendor tokens. The entropy backstop structurally cannot
+    // catch hex (max Shannon entropy log2(16)=4.0 < the 4.5 threshold), so
+    // these are matched by their distinctive prefixes — high precision, near
+    // zero false positives, unlike a blanket "long hex" rule which would fire
+    // on git SHAs and content hashes.
+    {
+        name: 'twilio-account-sid',
+        regex: /\bAC[0-9a-f]{32}\b/g,
+    },
+    {
+        name: 'twilio-api-key-sid',
+        regex: /\bSK[0-9a-f]{32}\b/g,
+    },
+    {
+        name: 'mailgun-api-key',
+        regex: /\bkey-[0-9a-f]{32}\b/g,
+    },
+    {
+        name: 'sendgrid-api-key',
+        regex: /\bSG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}\b/g,
+    },
+    // Structured tokens
+    {
+        name: 'jwt',
+        regex: /\beyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g,
+    },
+    // PEM-armored private keys (multiline; not applied in streaming mode)
+    {
+        name: 'pem-private-key',
+        regex: /-----BEGIN [A-Z][A-Z ]*PRIVATE KEY-----[\s\S]+?-----END [A-Z][A-Z ]*PRIVATE KEY-----/g,
+        multiline: true,
+    },
+    {
+        name: 'pgp-private-key',
+        regex: /-----BEGIN PGP PRIVATE KEY BLOCK-----[\s\S]+?-----END PGP PRIVATE KEY BLOCK-----/g,
+        multiline: true,
+    },
+];
+/**
+ * The subset of `BUILTIN_PATTERNS` that are safe to apply per-line in
+ * a streaming context (no multiline regexes).
+ */
+export const BUILTIN_LINE_PATTERNS = BUILTIN_PATTERNS.filter((p) => !p.multiline);
+//# sourceMappingURL=patterns.js.map

package/dist/patterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"patterns.js","sourceRoot":"","sources":["../src/patterns.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAA2B;IACtD,yBAAyB;IACzB;QACE,IAAI,EAAE,cAAc;QACpB,KAAK,EAAE,iCAAiC;KACzC;IACD;QACE,IAAI,EAAE,WAAW;QACjB,KAAK,EAAE,uBAAuB;KAC/B;IACD;QACE,IAAI,EAAE,aAAa;QACnB,KAAK,EAAE,mCAAmC;KAC3C;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,KAAK,EAAE,qCAAqC;KAC7C;IACD;QACE,IAAI,EAAE,eAAe;QACrB,KAAK,EAAE,4EAA4E;KACpF;IAED,sBAAsB;IACtB;QACE,IAAI,EAAE,mBAAmB;QACzB,KAAK,EAAE,gCAAgC;KACxC;IACD;QACE,IAAI,EAAE,aAAa;QACnB,KAAK,EAAE,4BAA4B;KACpC;IAED,yBAAyB;IACzB;QACE,IAAI,EAAE,oBAAoB;QAC1B,KAAK,EAAE,0BAA0B;KAClC;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,KAAK,EAAE,0BAA0B;KAClC;IACD;QACE,IAAI,EAAE,+BAA+B;QACrC,KAAK,EAAE,0BAA0B;KAClC;IACD;QACE,kEAAkE;QAClE,uDAAuD;QACvD,IAAI,EAAE,yBAAyB;QAC/B,KAAK,EAAE,mCAAmC;KAC3C;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,KAAK,EAAE,6BAA6B;KACrC;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,KAAK,EAAE,6BAA6B;KACrC;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,KAAK,EAAE,+BAA+B;KACvC;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,KAAK,EAAE,+BAA+B;KACvC;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,KAAK,EAAE,+BAA+B;KACvC;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,KAAK,EAAE,+BAA+B;KACvC;IACD;QACE,+DAA+D;QAC/D,oDAAoD;QACpD,IAAI,EAAE,gBAAgB;QACtB,KAAK,EAAE,8CAA8C;KACtD;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,KAAK,EAAE,kDAAkD;KAC1D;IAED,qEAAqE;IACrE,uEAAuE;IACvE,yEAAyE;IACzE,0EAA0E;IAC1E,kCAAkC;IAClC;QACE,IAAI,EAAE,oBAAoB;QAC1B,KAAK,EAAE,qBAAqB;KAC7B;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,KAAK,EAAE,qBAAqB;KAC7B;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,KAAK,EAAE,uBAAuB;KAC/B;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,KAAK,EAAE,+CAA+C;KACvD;IAED,oBAAoB;IACpB;QACE,IAAI,EAAE,KAAK;QACX,KAAK,EAAE,uEAAuE;KAC/E;IAED,sEAAsE;IACtE;QACE,IAAI,EAAE,iBAAiB;QACvB,KAAK,EAAE,uFAAuF;QAC9F,SAAS,EAAE,IAAI;KAChB;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,KAAK,EAAE,mFAAmF;QAC1F,SAAS,EAAE,IAAI;KAChB;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAA2B,gBAAgB,CAAC,MAAM,CAClF,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CACpB,CAAC"}

package/dist/patterns.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=patterns.test.d.ts.map

package/dist/patterns.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"patterns.test.d.ts","sourceRoot":"","sources":["../src/patterns.test.ts"],"names":[],"mappings":""}

package/dist/patterns.test.js

@@ -0,0 +1,193 @@
+import { describe, expect, it } from 'vitest';
+import { redact } from './batch.js';
+// Vendor-prefixed fixtures are constructed at runtime from
+// concatenated pieces so the LITERAL secret-shape never appears
+// verbatim in source. Static scanners (GitHub Push Protection,
+// trufflehog, gitleaks) match against contiguous source bytes;
+// concatenation keeps our regex tests honest while preventing
+// false positives at commit time.
+const X = (n) => 'X'.repeat(n);
+const fix = {
+    awsKey: `AKIA${'EXAMPLE'.repeat(2)}EX`,
+    awsTemp: `ASIA${'EXAMPLE'.repeat(2)}DD`,
+    gcp: `${'AIza'}${X(35)}`,
+    ghClassic: `${'ghp'}_${X(36)}`,
+    ghFine: `${'github'}_pat_${X(60)}`,
+    slackBot: `${'xoxb'}-${X(10)}-${X(13)}-${X(24)}`,
+    slackHook: `https://hooks.slack.com/services/${X(10).replace(/X/g, 'T')}/${X(10).replace(/X/g, 'B')}/${X(26)}`,
+    stripe: `${'sk'}_${'live'}_${X(26)}`,
+    openai: `${'sk'}-proj-${X(24)}`,
+    anthropic: `${'sk'}-ant-api03-${X(24)}`,
+    jwt: `${'eyJ'}${X(20)}.${'eyJ'}${X(20)}.${X(20)}`,
+    twilioSid: `${'AC'}${'a1b2c3d4'.repeat(4)}`,
+    twilioKey: `${'SK'}${'a1b2c3d4'.repeat(4)}`,
+    mailgun: `${'key'}-${'a1b2c3d4'.repeat(4)}`,
+    sendgrid: `${'SG'}.${X(22)}.${X(43)}`,
+};
+describe('pattern bank — true positives', () => {
+    it.each([
+        [
+            'postgres URI',
+            'connect to postgres://app:hunter2@db.example.com:5432/billing for the migration',
+            'postgres-uri',
+        ],
+        ['mysql URI', 'mysql://root:rootpass@10.0.0.5:3306/app', 'mysql-uri'],
+        ['mongodb+srv URI', 'mongodb+srv://u:p@cluster0.mongo.net/app?retryWrites=true', 'mongodb-uri'],
+        [
+            'Redis with password',
+            'rediss://default:abc123@redis.example.com:6379/0',
+            'redis-uri-with-password',
+        ],
+        ['Slack webhook', `POST ${fix.slackHook}`, 'slack-webhook'],
+        ['AWS AKIA', `AWS_ACCESS_KEY_ID=${fix.awsKey}`, 'aws-access-key-id'],
+        ['AWS ASIA temp', `token=${fix.awsTemp}`, 'aws-access-key-id'],
+        ['GCP API key', `key: ${fix.gcp}`, 'gcp-api-key'],
+        ['GitHub PAT classic', `gh auth login --token ${fix.ghClassic}`, 'github-pat-classic'],
+        ['GitHub fine-grained PAT', `PAT=${fix.ghFine}`, 'github-pat-fine-grained'],
+        ['Slack bot token', `export SLACK_BOT=${fix.slackBot}`, 'slack-bot-token'],
+        ['Stripe live key', `STRIPE_KEY=${fix.stripe}`, 'stripe-live-secret-key'],
+        ['OpenAI API key', `OPENAI_API_KEY=${fix.openai}`, 'openai-api-key'],
+        ['Anthropic API key', `ANTHROPIC_API_KEY=${fix.anthropic}`, 'anthropic-api-key'],
+        ['Twilio Account SID', `TWILIO_SID=${fix.twilioSid}`, 'twilio-account-sid'],
+        ['Twilio API Key SID', `TWILIO_KEY=${fix.twilioKey}`, 'twilio-api-key-sid'],
+        ['Mailgun API key', `MAILGUN_KEY=${fix.mailgun}`, 'mailgun-api-key'],
+        ['SendGrid API key', `SENDGRID_KEY=${fix.sendgrid}`, 'sendgrid-api-key'],
+        ['JWT', `Authorization: Bearer ${fix.jwt}`, 'jwt'],
+    ])('redacts %s', (_label, input, expectedPattern) => {
+        const { text, matches } = redact(input);
+        expect(matches.length).toBeGreaterThan(0);
+        expect(matches.some((m) => m.pattern === expectedPattern)).toBe(true);
+        expect(text).toContain(`<REDACTED:${expectedPattern}>`);
+    });
+    it('redacts multi-line PEM private key blocks', () => {
+        const input = [
+            'this is a key:',
+            '-----BEGIN RSA PRIVATE KEY-----',
+            'MIIEpAIBAAKCAQEA1234567890abcdef',
+            'MIIEpAIBAAKCAQEAabcdef1234567890',
+            '-----END RSA PRIVATE KEY-----',
+            'continuing',
+        ].join('\n');
+        const { text, matches } = redact(input);
+        expect(matches.some((m) => m.pattern === 'pem-private-key')).toBe(true);
+        expect(text).toContain('<REDACTED:pem-private-key>');
+        expect(text).not.toContain('MIIEpAIBAAKCAQEA');
+    });
+    it('redacts multi-line PGP private key blocks', () => {
+        const input = [
+            '-----BEGIN PGP PRIVATE KEY BLOCK-----',
+            'Comment: gpg pretend key',
+            'lQOYBGFbS7gBCAD...',
+            '-----END PGP PRIVATE KEY BLOCK-----',
+        ].join('\n');
+        const { text } = redact(input);
+        expect(text).toContain('<REDACTED:pgp-private-key>');
+    });
+});
+describe('pattern bank — false positives (innocent fixtures must NOT be redacted)', () => {
+    // To reduce flakiness, run the entropy detector with default settings —
+    // the patterns themselves should not match any of these.
+    const innocent = [
+        ['UUIDv4', '550e8400-e29b-41d4-a716-446655440000'],
+        ['short git SHA', 'a3f9b8c'],
+        ['long git SHA', 'a3f9b8c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7'],
+        // A bare 32-char hex (MD5-shaped) with no vendor prefix must NOT match —
+        // proves we did not add a blanket "long hex" rule that would fire on
+        // content hashes and git SHAs.
+        ['bare md5 hash (no vendor prefix)', 'd41d8cd98f00b204e9800998ecf8427e'],
+        ['lorem ipsum', 'lorem ipsum dolor sit amet consectetur adipiscing elit'],
+        ['file path', '/usr/local/bin/keynv-server'],
+        [
+            'public RSA key marker (not private)',
+            '-----BEGIN PUBLIC KEY----- ... -----END PUBLIC KEY-----',
+        ],
+        ['email address', 'support@billing.example.com'],
+        ['public GitHub URL', 'https://github.com/anthropic/keynv'],
+        ['version string', 'keynv 1.2.3-rc.4'],
+    ];
+    // We disable the entropy detector here to isolate pattern-only behavior.
+    it.each(innocent)('does not pattern-match %s', (_label, input) => {
+        const { matches } = redact(input, { entropy: { enabled: false } });
+        expect(matches).toEqual([]);
+    });
+    it('does not entropy-flag npm package-lock.json sha512 integrity hashes', () => {
+        const hash = 'sha512-YFlf4sNAz0cAFGY0SGOC4V9T3zDIJUyCJmI6EMbqTX4UPIxw9VpBBPuRgL3Q3eD7F3m7ixFW7Lh6wj3fIlzg==';
+        const { matches } = redact(hash);
+        expect(matches).toEqual([]);
+    });
+    it('does not entropy-flag Docker image digests (sha256:hex)', () => {
+        const digest = 'sha256:a3f9b8c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a74f3b1c9d2e8a0f5b7c6d4e2f1';
+        const { matches } = redact(digest);
+        expect(matches).toEqual([]);
+    });
+    it('does not entropy-flag sha384 subresource integrity attributes', () => {
+        const sri = 'sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC';
+        const { matches } = redact(sri);
+        expect(matches).toEqual([]);
+    });
+});
+describe('redact — overlap and ordering', () => {
+    it('renders matches in order without index drift', () => {
+        const input = `a=${fix.ghClassic} b=${fix.awsKey}`;
+        const { text } = redact(input, { entropy: { enabled: false } });
+        expect(text).toBe('a=<REDACTED:github-pat-classic> b=<REDACTED:aws-access-key-id>');
+    });
+    it('does not double-redact overlapping pattern hits', () => {
+        // jwt + entropy could both match; the wider pattern (jwt) wins.
+        const jwt = fix.jwt;
+        const input = `token: ${jwt}`;
+        const { text, matches } = redact(input);
+        expect(text).toContain('<REDACTED:jwt>');
+        expect(matches.filter((m) => m.start < input.indexOf(jwt) + jwt.length).length).toBe(1);
+    });
+    it('does not leak the tail of a longer secret on partial overlap', () => {
+        // Two resolved values share overlapping text. The earlier, shorter match
+        // must NOT cause the tail of the later one to survive un-redacted: the
+        // de-overlap step extends to the union span rather than dropping the
+        // second hit. Regression for the "tail leak" (batch de-overlap loop).
+        const input = 'abc123def456ghi';
+        const { text } = redact(input, {
+            literals: ['abc123def', 'def456ghi'],
+            entropy: { enabled: false },
+        });
+        // Every character of either secret must be gone — no plaintext tail.
+        expect(text).not.toContain('abc123def');
+        expect(text).not.toContain('def456ghi');
+        expect(text).not.toContain('456ghi');
+        expect(text).not.toMatch(/[0-9]/);
+    });
+});
+describe('redact — literals (resolved-value pre-emptive redaction)', () => {
+    it('redacts an arbitrary literal exact-match', () => {
+        const { text, matches } = redact('the password is hunter2 and another hunter2', {
+            literals: ['hunter2'],
+            entropy: { enabled: false },
+        });
+        expect(text).not.toContain('hunter2');
+        expect(matches.length).toBe(2);
+    });
+    it('escapes regex metacharacters in literal', () => {
+        const { text } = redact('value: a.b+c?d', {
+            literals: ['a.b+c?d'],
+            entropy: { enabled: false },
+        });
+        expect(text).not.toContain('a.b+c?d');
+    });
+});
+describe('redact — entropy detector', () => {
+    it('catches high-entropy strings (random base64-shaped)', () => {
+        const { matches } = redact('payload: A8sJ19sbgZ7GqbkpRXp9-ZQyCPmK3VBh2');
+        expect(matches.some((m) => m.pattern === 'high-entropy')).toBe(true);
+    });
+    it('respects minLength threshold', () => {
+        const { matches } = redact('short: A8sJ19sbgZ', { entropy: { minLength: 24 } });
+        expect(matches).toEqual([]);
+    });
+    it('can be disabled', () => {
+        const { matches } = redact('payload: A8sJ19sbgZ7GqbkpRXp9-ZQyCPmK3VBh2', {
+            entropy: { enabled: false },
+        });
+        expect(matches).toEqual([]);
+    });
+});
+//# sourceMappingURL=patterns.test.js.map

package/dist/patterns.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"patterns.test.js","sourceRoot":"","sources":["../src/patterns.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEpC,2DAA2D;AAC3D,gEAAgE;AAChE,+DAA+D;AAC/D,+DAA+D;AAC/D,8DAA8D;AAC9D,kCAAkC;AAClC,MAAM,CAAC,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACvC,MAAM,GAAG,GAAG;IACV,MAAM,EAAE,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;IACtC,OAAO,EAAE,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;IACvC,GAAG,EAAE,GAAG,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE;IACxB,SAAS,EAAE,GAAG,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE;IAC9B,MAAM,EAAE,GAAG,QAAQ,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE;IAClC,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE;IAChD,SAAS,EAAE,oCAAoC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE;IAC9G,MAAM,EAAE,GAAG,IAAI,IAAI,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE;IACpC,MAAM,EAAE,GAAG,IAAI,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE;IAC/B,SAAS,EAAE,GAAG,IAAI,cAAc,CAAC,CAAC,EAAE,CAAC,EAAE;IACvC,GAAG,EAAE,GAAG,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE;IACjD,SAAS,EAAE,GAAG,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;IAC3C,SAAS,EAAE,GAAG,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;IAC3C,OAAO,EAAE,GAAG,KAAK,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;IAC3C,QAAQ,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE;CACtC,CAAC;AAEF,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,EAAE,CAAC,IAAI,CAAC;QACN;YACE,cAAc;YACd,iFAAiF;YACjF,cAAc;SACf;QACD,CAAC,WAAW,EAAE,yCAAyC,EAAE,WAAW,CAAC;QACrE,CAAC,iBAAiB,EAAE,2DAA2D,EAAE,aAAa,CAAC;QAC/F;YACE,qBAAqB;YACrB,kDAAkD;YAClD,yBAAyB;SAC1B;QACD,CAAC,eAAe,EAAE,QAAQ,GAAG,CAAC,SAAS,EAAE,EAAE,eAAe,CAAC;QAC3D,CAAC,UAAU,EAAE,qBAAqB,GAAG,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC;QACpE,CAAC,eAAe,EAAE,SAAS,GAAG,CAAC,OAAO,EAAE,EAAE,mBAAmB,CAAC;QAC9D,CAAC,aAAa,EAAE,QAAQ,GAAG,CAAC,GAAG,EAAE,EAAE,aAAa,CAAC;QACjD,CAAC,oBAAoB,EAAE,yBAAyB,GAAG,CAAC,SAAS,EAAE,EAAE,oBAAoB,CAAC;QACtF,CAAC,yBAAyB,EAAE,OAAO,GAAG,CAAC,MAAM,EAAE,EAAE,yBAAyB,CAAC;QAC3E,CAAC,iBAAiB,EAAE,oBAAoB,GAAG,CAAC,QAAQ,EAAE,EAAE,iBAAiB,CAAC;QAC1E,CAAC,iBAAiB,EAAE,cAAc,GAAG,CAAC,MAAM,EAAE,EAAE,wBAAwB,CAAC;QACzE,CAAC,gBAAgB,EAAE,kBAAkB,GAAG,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC;QACpE,CAAC,mBAAmB,EAAE,qBAAqB,GAAG,CAAC,SAAS,EAAE,EAAE,mBAAmB,CAAC;QAChF,CAAC,oBAAoB,EAAE,cAAc,GAAG,CAAC,SAAS,EAAE,EAAE,oBAAoB,CAAC;QAC3E,CAAC,oBAAoB,EAAE,cAAc,GAAG,CAAC,SAAS,EAAE,EAAE,oBAAoB,CAAC;QAC3E,CAAC,iBAAiB,EAAE,eAAe,GAAG,CAAC,OAAO,EAAE,EAAE,iBAAiB,CAAC;QACpE,CAAC,kBAAkB,EAAE,gBAAgB,GAAG,CAAC,QAAQ,EAAE,EAAE,kBAAkB,CAAC;QACxE,CAAC,KAAK,EAAE,yBAAyB,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC;KACnD,CAAC,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE;QAClD,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QACxC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtE,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,aAAa,eAAe,GAAG,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,KAAK,GAAG;YACZ,gBAAgB;YAChB,iCAAiC;YACjC,kCAAkC;YAClC,kCAAkC;YAClC,+BAA+B;YAC/B,YAAY;SACb,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QACxC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxE,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,KAAK,GAAG;YACZ,uCAAuC;YACvC,0BAA0B;YAC1B,oBAAoB;YACpB,qCAAqC;SACtC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,yEAAyE,EAAE,GAAG,EAAE;IACvF,wEAAwE;IACxE,yDAAyD;IACzD,MAAM,QAAQ,GAA4B;QACxC,CAAC,QAAQ,EAAE,sCAAsC,CAAC;QAClD,CAAC,eAAe,EAAE,SAAS,CAAC;QAC5B,CAAC,cAAc,EAAE,0CAA0C,CAAC;QAC5D,yEAAyE;QACzE,qEAAqE;QACrE,+BAA+B;QAC/B,CAAC,kCAAkC,EAAE,kCAAkC,CAAC;QACxE,CAAC,aAAa,EAAE,wDAAwD,CAAC;QACzE,CAAC,WAAW,EAAE,6BAA6B,CAAC;QAC5C;YACE,qCAAqC;YACrC,yDAAyD;SAC1D;QACD,CAAC,eAAe,EAAE,6BAA6B,CAAC;QAChD,CAAC,mBAAmB,EAAE,oCAAoC,CAAC;QAC3D,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;KACvC,CAAC;IAEF,yEAAyE;IACzE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,2BAA2B,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QAC/D,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACnE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,IAAI,GACR,+FAA+F,CAAC;QAClG,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,MAAM,GAAG,0EAA0E,CAAC;QAC1F,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,GAAG,GAAG,yEAAyE,CAAC;QACtF,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,KAAK,GAAG,KAAK,GAAG,CAAC,SAAS,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC;QACnD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAChE,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,gEAAgE;QAChE,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;QACpB,MAAM,KAAK,GAAG,UAAU,GAAG,EAAE,CAAC;QAC9B,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QACzC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,yEAAyE;QACzE,uEAAuE;QACvE,qEAAqE;QACrE,sEAAsE;QACtE,MAAM,KAAK,GAAG,iBAAiB,CAAC;QAChC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE;YAC7B,QAAQ,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC;YACpC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;SAC5B,CAAC,CAAC;QACH,qEAAqE;QACrE,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,0DAA0D,EAAE,GAAG,EAAE;IACxE,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,6CAA6C,EAAE;YAC9E,QAAQ,EAAE,CAAC,SAAS,CAAC;YACrB,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;SAC5B,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACtC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,gBAAgB,EAAE;YACxC,QAAQ,EAAE,CAAC,SAAS,CAAC;YACrB,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;SAC5B,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,4CAA4C,CAAC,CAAC;QACzE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,mBAAmB,EAAE,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAChF,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iBAAiB,EAAE,GAAG,EAAE;QACzB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,4CAA4C,EAAE;YACvE,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;SAC5B,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/streaming.d.ts

@@ -0,0 +1,22 @@
+import { Transform } from 'node:stream';
+import type { RedactOptions } from './types.js';
+export interface StreamingOptions extends RedactOptions {
+    /** Hard cap on per-line buffer. Default 64 KB. */
+    bufferLimit?: number;
+}
+/**
+ * Constructs a Transform stream that line-buffers input, runs each
+ * complete line through `redact`, and emits the redacted line.
+ *
+ * Multi-line patterns from the builtin bank (RSA / PGP private keys)
+ * are NOT applied here — by definition they span multiple lines, and
+ * detecting them across chunk boundaries requires unbounded buffering.
+ * The batch API handles those; for streaming, a private key spanning
+ * many lines will leak unless the caller adds a custom matcher with
+ * explicit windowing.
+ *
+ * Use case: piped between a privileged subprocess's stdout/stderr and
+ * the AI agent's tool-output channel.
+ */
+export declare function createRedactStream(opts?: StreamingOptions): Transform;
+//# sourceMappingURL=streaming.d.ts.map

package/dist/streaming.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"streaming.d.ts","sourceRoot":"","sources":["../src/streaming.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAA0B,MAAM,aAAa,CAAC;AAGhE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAUhD,MAAM,WAAW,gBAAiB,SAAQ,aAAa;IACrD,kDAAkD;IAClD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,GAAE,gBAAqB,GAAG,SAAS,CAwCzE"}

package/dist/streaming.js

@@ -0,0 +1,65 @@
+import { Transform } from 'node:stream';
+import { redact } from './batch.js';
+import { BUILTIN_LINE_PATTERNS } from './patterns.js';
+/**
+ * Hard cap on the in-memory line buffer. Subprocess output containing
+ * an unterminated line (e.g., interactive prompts that don't print
+ * \n) is flushed once the buffer reaches this size to avoid unbounded
+ * memory growth. Default: 64 KB.
+ */
+const DEFAULT_BUFFER_LIMIT = 64 * 1024;
+/**
+ * Constructs a Transform stream that line-buffers input, runs each
+ * complete line through `redact`, and emits the redacted line.
+ *
+ * Multi-line patterns from the builtin bank (RSA / PGP private keys)
+ * are NOT applied here — by definition they span multiple lines, and
+ * detecting them across chunk boundaries requires unbounded buffering.
+ * The batch API handles those; for streaming, a private key spanning
+ * many lines will leak unless the caller adds a custom matcher with
+ * explicit windowing.
+ *
+ * Use case: piped between a privileged subprocess's stdout/stderr and
+ * the AI agent's tool-output channel.
+ */
+export function createRedactStream(opts = {}) {
+    const lineOpts = {
+        patterns: opts.patterns ?? BUILTIN_LINE_PATTERNS,
+        ...(opts.extraPatterns ? { extraPatterns: opts.extraPatterns } : {}),
+        ...(opts.literals ? { literals: opts.literals } : {}),
+        ...(opts.entropy ? { entropy: opts.entropy } : {}),
+    };
+    const bufferLimit = opts.bufferLimit ?? DEFAULT_BUFFER_LIMIT;
+    let buf = '';
+    function flushBufferThroughRedactor() {
+        if (buf.length === 0)
+            return '';
+        const result = redact(buf, lineOpts);
+        buf = '';
+        return result.text;
+    }
+    return new Transform({
+        transform(chunk, _enc, cb) {
+            buf += chunk.toString('utf8');
+            let out = '';
+            let nl;
+            // biome-ignore lint/suspicious/noAssignInExpressions: idiomatic line iteration
+            while ((nl = buf.indexOf('\n')) !== -1) {
+                const line = buf.slice(0, nl + 1);
+                buf = buf.slice(nl + 1);
+                const result = redact(line, lineOpts);
+                out += result.text;
+            }
+            // Force-flush if the unterminated tail grows past the buffer cap
+            // (defends against unbounded line lengths from misbehaving tools).
+            if (buf.length >= bufferLimit) {
+                out += flushBufferThroughRedactor();
+            }
+            cb(null, out);
+        },
+        flush(cb) {
+            cb(null, flushBufferThroughRedactor());
+        },
+    });
+}
+//# sourceMappingURL=streaming.js.map

package/dist/streaming.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"streaming.js","sourceRoot":"","sources":["../src/streaming.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAA0B,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACpC,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAGtD;;;;;GAKG;AACH,MAAM,oBAAoB,GAAG,EAAE,GAAG,IAAI,CAAC;AAOvC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAyB,EAAE;IAC5D,MAAM,QAAQ,GAAkB;QAC9B,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,qBAAqB;QAChD,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnD,CAAC;IACF,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,oBAAoB,CAAC;IAC7D,IAAI,GAAG,GAAG,EAAE,CAAC;IAEb,SAAS,0BAA0B;QACjC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACrC,GAAG,GAAG,EAAE,CAAC;QACT,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAED,OAAO,IAAI,SAAS,CAAC;QACnB,SAAS,CAAC,KAAa,EAAE,IAAI,EAAE,EAAqB;YAClD,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC9B,IAAI,GAAG,GAAG,EAAE,CAAC;YACb,IAAI,EAAU,CAAC;YACf,+EAA+E;YAC/E,OAAO,CAAC,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBACvC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;gBAClC,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;gBACxB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;gBACtC,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC;YACrB,CAAC;YACD,iEAAiE;YACjE,mEAAmE;YACnE,IAAI,GAAG,CAAC,MAAM,IAAI,WAAW,EAAE,CAAC;gBAC9B,GAAG,IAAI,0BAA0B,EAAE,CAAC;YACtC,CAAC;YACD,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAChB,CAAC;QACD,KAAK,CAAC,EAAqB;YACzB,EAAE,CAAC,IAAI,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACzC,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/streaming.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=streaming.test.d.ts.map

package/dist/streaming.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"streaming.test.d.ts","sourceRoot":"","sources":["../src/streaming.test.ts"],"names":[],"mappings":""}

package/dist/streaming.test.js

@@ -0,0 +1,63 @@
+import { Readable } from 'node:stream';
+import { describe, expect, it } from 'vitest';
+import { createRedactStream } from './streaming.js';
+// Same construction pattern as patterns.test.ts: build secret-shaped
+// fixtures from concatenation so static scanners don't match the
+// literals.
+const X = (n) => 'X'.repeat(n);
+const ghClassic = `${'ghp'}_${X(36)}`;
+const awsKey = `AKIA${'EXAMPLE'.repeat(2)}EX`;
+async function pipe(input, stream) {
+    const reader = Readable.from([Buffer.from(input, 'utf8')]);
+    const chunks = [];
+    for await (const chunk of reader.pipe(stream)) {
+        chunks.push(typeof chunk === 'string' ? Buffer.from(chunk) : chunk);
+    }
+    return Buffer.concat(chunks).toString('utf8');
+}
+describe('createRedactStream', () => {
+    it('redacts an inline secret and preserves the rest of the line', async () => {
+        const out = await pipe('INFO connecting postgres://u:p@db/app for migration\n', createRedactStream({ entropy: { enabled: false } }));
+        expect(out).toContain('<REDACTED:postgres-uri>');
+        expect(out).toContain('INFO connecting');
+        expect(out).toContain('for migration');
+    });
+    it('flushes a trailing line that has no terminating newline', async () => {
+        const out = await pipe(`tail line ${ghClassic}`, createRedactStream({ entropy: { enabled: false } }));
+        expect(out).toContain('<REDACTED:github-pat-classic>');
+    });
+    it('passes innocuous output through unchanged', async () => {
+        const input = 'hello\nworld\n';
+        const out = await pipe(input, createRedactStream());
+        expect(out).toBe(input);
+    });
+    it('handles many small chunks without losing bytes', async () => {
+        const stream = createRedactStream({ entropy: { enabled: false } });
+        const input = `aws=${awsKey} done\n`;
+        const reader = Readable.from(input.split('').map((c) => Buffer.from(c, 'utf8')));
+        const chunks = [];
+        for await (const chunk of reader.pipe(stream)) {
+            chunks.push(typeof chunk === 'string' ? Buffer.from(chunk) : chunk);
+        }
+        const out = Buffer.concat(chunks).toString('utf8');
+        expect(out).toContain('<REDACTED:aws-access-key-id>');
+        expect(out).toContain('aws=');
+        expect(out).toContain(' done');
+    });
+    it('does not apply multiline PEM block patterns (documented limitation)', async () => {
+        const input = [
+            'log line one',
+            '-----BEGIN RSA PRIVATE KEY-----',
+            'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA',
+            '-----END RSA PRIVATE KEY-----',
+            'log line last',
+            '',
+        ].join('\n');
+        const out = await pipe(input, createRedactStream({ entropy: { enabled: false } }));
+        // Streaming mode does NOT redact across newlines — confirming the
+        // limitation. Per-line content remains, so callers must use the
+        // batch API when they need multi-line coverage.
+        expect(out).toContain('-----BEGIN RSA PRIVATE KEY-----');
+    });
+});
+//# sourceMappingURL=streaming.test.js.map

package/dist/streaming.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"streaming.test.js","sourceRoot":"","sources":["../src/streaming.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD,qEAAqE;AACrE,iEAAiE;AACjE,YAAY;AACZ,MAAM,CAAC,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACvC,MAAM,SAAS,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACtC,MAAM,MAAM,GAAG,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAE9C,KAAK,UAAU,IAAI,CAAC,KAAa,EAAE,MAA6C;IAC9E,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAgB,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,GAAG,GAAG,MAAM,IAAI,CACpB,uDAAuD,EACvD,kBAAkB,CAAC,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,CACpD,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;QACjD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,GAAG,GAAG,MAAM,IAAI,CACpB,aAAa,SAAS,EAAE,EACxB,kBAAkB,CAAC,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,CACpD,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,+BAA+B,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,KAAK,GAAG,gBAAgB,CAAC;QAC/B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;QACpD,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,MAAM,GAAG,kBAAkB,CAAC,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACnE,MAAM,KAAK,GAAG,OAAO,MAAM,SAAS,CAAC;QACrC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QACjF,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9C,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAgB,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAC;QACtD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,KAAK,GAAG;YACZ,cAAc;YACd,iCAAiC;YACjC,oCAAoC;YACpC,+BAA+B;YAC/B,eAAe;YACf,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,kBAAkB,CAAC,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;QACnF,kEAAkE;QAClE,gEAAgE;QAChE,gDAAgD;QAChD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,iCAAiC,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,68 @@
+/**
+ * A regex-based redaction pattern. Names are stable identifiers used
+ * in audit logs and the `pattern_summary` returned to MCP callers.
+ *
+ * `multiline` patterns may span newlines (e.g., RSA private-key blocks).
+ * They are NOT applied in streaming mode — only in batch — because
+ * detecting them across chunk boundaries requires unbounded buffering.
+ */
+export interface Pattern {
+    readonly name: string;
+    readonly regex: RegExp;
+    readonly multiline?: boolean;
+    /** How to render the redaction string. Default: `<REDACTED:{name}>`. */
+    readonly redactWith?: (matched: string) => string;
+}
+/**
+ * Where a pattern was hit. Offsets are into the input string.
+ *
+ * `preview` is a tightly-bounded fragment (max 3 chars + `…`) — it lets
+ * audit consumers eyeball "what kind of secret was this" without
+ * exposing the full value. Never log the underlying matched string.
+ *
+ * Trust boundary: `preview` is informational only. It is derived from
+ * the matched string but truncated to at most 3 characters, making it
+ * insufficient to reconstruct the original value. Treat it as a
+ * non-sensitive hint for log readability, not as an authenticated
+ * identifier.
+ */
+export interface Match {
+    readonly pattern: string;
+    readonly start: number;
+    readonly end: number;
+    readonly preview: string;
+}
+export interface RedactResult {
+    readonly text: string;
+    readonly matches: ReadonlyArray<Match>;
+}
+export interface RedactOptions {
+    /** Override the default pattern bank entirely. */
+    patterns?: ReadonlyArray<Pattern>;
+    /** Add patterns on top of the default bank. */
+    extraPatterns?: ReadonlyArray<Pattern>;
+    /** Exact-match strings to redact (e.g., known resolved values). */
+    literals?: ReadonlyArray<string>;
+    entropy?: EntropyOptions;
+}
+export interface EntropyOptions {
+    /** Default true. Disable to skip the entropy detector entirely. */
+    enabled?: boolean;
+    /** Minimum token length to consider. Default 24. */
+    minLength?: number;
+    /** Minimum bits-per-character. Default 4.5. */
+    minBitsPerChar?: number;
+    /**
+     * Token prefixes to exclude from entropy detection. Tokens whose
+     * lowercased value starts with any of these strings are never flagged.
+     * Default: common content-hash prefixes (sha1-, sha256:, sha384-,
+     * sha512-) which appear in package-lock.json integrity fields and
+     * Docker digests but are never actual secrets.
+     */
+    excludePrefixes?: ReadonlyArray<string>;
+}
+export interface RedactionSummary {
+    totalMatches: number;
+    byPattern: Record<string, number>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,wEAAwE;IACxE,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC;CACnD;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,aAAa;IAC5B,kDAAkD;IAClD,QAAQ,CAAC,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;IAClC,+CAA+C;IAC/C,aAAa,CAAC,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;IACvC,mEAAmE;IACnE,QAAQ,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACjC,OAAO,CAAC,EAAE,cAAc,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,mEAAmE;IACnE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,oDAAoD;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+CAA+C;IAC/C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,40 @@
+{
+  "name": "@keynv/redactor",
+  "version": "0.1.0-rc.23",
+  "description": "keynv output and file redaction (regex + entropy + per-project custom patterns).",
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/keynv-labs/keynv.git",
+    "directory": "packages/redactor"
+  },
+  "homepage": "https://github.com/keynv-labs/keynv#readme",
+  "bugs": {
+    "url": "https://github.com/keynv-labs/keynv/issues"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "clean": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\""
+  }
+}