@link-foundation/sensitive-data-sanitizer 0.20.0 → 0.21.0

package/src/context.js

@@ -2,7 +2,9 @@ import { labels } from './rules.js';
 import { escapePattern, REDACTED } from './detection.js';
 import { credentialPlaceholder, referencePrefix } from './credentials.js';
 import { servicePath } from './public.js';
+import { cookieValues } from './credential-spans.js';
 import { plausiblePerson } from './names.js';
+import { htmlTag } from './html-tags.js';
 
 // Bounded vocabularies are explicit so the short PASS/PW forms do not match
 // unrelated words such as passport. Verb forms cover the supported locales.
@@ -54,12 +56,19 @@ const label = labels.credential
 // are fixed so that ordinary words ending in "pass" stay prose.
 const glued =
   '(?:db|user|root|admin|smtp|mail|ftp|sftp|ssh|redis|ldap|bind|proxy|tls|ssl|keystore|truststore|store|master|sys|app|login|account|acct|wifi|wpa)(?:password|passwd|pass|pwd|pw|secret|token)';
-const key = `(?:[\\p{L}\\p{N}]+[_.-])*(?:auth|authorization|PGPASSWORD|${glued}|${label}|pass|pw)(?:[_.-][\\p{L}\\p{N}]+)*`;
+// Plural credential names (`--access-tokens`, `API_KEYS`) hold credentials;
+// other plurals (`--max-tokens`, `tokens: 1234`) are accounting.
+const plural =
+  '(?:access|refresh|auth|session|api|bearer|client)[_.-]?(?:tokens|keys|secrets)';
+const key = `(?:[\\p{L}\\p{N}]+[_.-])*(?:auth|authorization|PGPASSWORD|${glued}|${plural}|${label}|pass|pw)(?:[_.-][\\p{L}\\p{N}]+)*`;
+// Ruby/Perl/PHP hash rockets (`'password' => 'x'`, `:token => "x"`) take a
+// quoted literal; an arrow function (`token => token.trim()`) does not.
+const rocket = `=>(?=[ \\t]*\\\\*["'])`;
 // A qualifier such as "for staging" stays on one logical line: it never
 // crosses an escaped line break, an escape sequence or an enclosing quote.
 // Verbs are whole words, so "request" does not end in the verb "est".
 const credentialPrefix = new RegExp(
-  `(?<![\\p{L}\\p{N}_])(?:\\\\*["'])?(${key})(?![\\p{L}\\p{N}_])(?:\\\\*["'])?(?:[ \\t]+(?:от|для|к|for|de|du|del)[ \\t]+[^:=\\r\\n"\\\\]{1,64})?[ \\t]*([:=：]|(?<![\\p{L}\\p{N}_])(?:${verbs})(?![\\p{L}\\p{N}_]))[ \\t]*`,
+  `(?<![\\p{L}\\p{N}_])(?:\\\\*["'])?(${key})(?![\\p{L}\\p{N}_])(?:\\\\*["'])?(?:[ \\t]+(?:от|для|к|for|de|du|del)[ \\t]+[^:=\\r\\n"\\\\]{1,64})?[ \\t]*(${rocket}|[:=：]|(?<![\\p{L}\\p{N}_])(?:${verbs})(?![\\p{L}\\p{N}_]))[ \\t]*`,
   'giu'
 );
 // camelCase and PascalCase keys (`clientSecret`, `secretKey`, `dbPassword`,
@@ -68,7 +77,7 @@ const credentialPrefix = new RegExp(
 const camelKey =
   '[\\p{L}][\\p{Ll}\\p{N}]*(?:\\p{Lu}[\\p{Ll}\\p{N}]*)*?(?:Secret|Password|Passwd|Passphrase|Pass|Pwd|Token|Credentials?|(?:Api|Private|Access|Secret|Signing|Encryption|Master|Client|App|Subscription|Account|Storage)Key)(?:Key|Value)?|(?:[Ss]ecret|[Pp]assword|[Pp]asswd|[Tt]oken|[Pp]rivate|[Aa]ccess|[Ss]igning|[Ee]ncryption)(?:Key|Value|Secret|Token)';
 const camelPrefix = new RegExp(
-  `(?<![\\p{L}\\p{N}_$])(?:\\\\*["'])?(${camelKey})(?![\\p{L}\\p{N}_])(?:\\\\*["'])?[ \\t]*([:=])[ \\t]*`,
+  `(?<![\\p{L}\\p{N}_$])(?:\\\\*["'])?(${camelKey})(?![\\p{L}\\p{N}_])(?:\\\\*["'])?[ \\t]*(${rocket}|[:=])[ \\t]*`,
   'gu'
 );
 // Bare generic labels are common English nouns. After a verb they need a
@@ -120,8 +129,20 @@ function emitValue(text, start, end, emit, details, keyName = '') {
   emit({ start, end, ...details });
 }
 
+// `HIVE_MIND_ROUTER_AUTH_GUARD=0`, `GIT_AUTH_TRANSPORT=1`, `AUTH_MODE=2`:
+// a number or a boolean under a configuration name is a setting. Credential
+// names (`AUTH_TOKEN=123456`, `AUTH_PASSWORD=1`) do not end in one of these.
+const configurationSuffix =
+  /[_.-](?:guard|transport|mode|method|type|kind|flow|strategy|scheme|protocol|port|level|state|status|enabled?|disabled?|required|strict|debug|verbose|timeout|ttl|interval|retries|retry|attempts|count|limit|max|min|size|length|version|flag)$/i;
+const configurationValue =
+  /^(?:[+-]?\d{1,9}(?:\.\d+)?|true|false|yes|no|on|off|enabled|disabled|none)$/i;
+export function configurationSetting(keyName, value) {
+  return configurationSuffix.test(keyName) && configurationValue.test(value);
+}
+
 function credentialMetadata(keyName, value) {
   return (
+    configurationSetting(keyName, value) ||
     (/(?:^|[_.-])auth[_.-](?:mode|method|type)$/i.test(keyName) &&
       /^(?:chatgpt|oauth2?|apikey|api_key|bearer|basic|none)$/i.test(value)) ||
     (keyName === 'id-token' && /^(?:write|read|none)$/.test(value)) ||
@@ -167,15 +188,27 @@ export function valueRange(text, start, mode = 'token', maxLength = Infinity) {
 }
 // Header credentials occupy a scheme and one token even inside shell/JSON
 // strings. A closing quote or escape belongs to the surrounding log record.
-export function authorizationRange(text, start) {
+// The scheme (`token`, `Bearer`, `Digest`) stays readable; only the
+// credential is returned. Auth-param lists (`Digest username="a", nonce=…`,
+// AWS SigV4) return each secret parameter value.
+export function authorizationRanges(text, start) {
   const opening = /^(\\*)(["'])/.exec(text.slice(start));
   start += opening?.[0].length ?? 0;
   const reference = referencePrefix(text.slice(start, start + 512));
   if (reference) {
-    return { start, end: start + reference[0].length };
+    return [{ start, end: start + reference[0].length }];
   }
   const scheme = /^[a-z][a-z0-9_-]*[ \t]+/i.exec(text.slice(start));
   const tokenStart = start + (scheme?.[0].length ?? 0);
+  const params = scheme ? authParams(text, tokenStart) : undefined;
+  if (params) {
+    return params;
+  }
+  const end = authorizationEnd(text, tokenStart);
+  const token = text.slice(tokenStart, end);
+  return usableAuthorization(token) ? [{ start: tokenStart, end }] : [];
+}
+function authorizationEnd(text, tokenStart) {
   const brackets = [];
   let end = tokenStart;
   for (; end < text.length; end++) {
@@ -195,8 +228,69 @@ export function authorizationRange(text, start) {
       break;
     }
   }
-  const token = text.slice(tokenStart, end);
-  return usableAuthorization(token) ? { start, end } : undefined;
+  return end;
+}
+
+// RFC 7616/7235 parameters that name the request, not a secret.
+const publicAuthParam =
+  /^(?:username|realm|uri|qop|algorithm|nc|charset|userhash|domain|stale|SignedHeaders|oauth_signature_method|oauth_version|oauth_timestamp|oauth_callback|keyId|headers|created|expires)$/i;
+const authParam = /^([A-Za-z][\w-]*)[ \t]*=[ \t]*/;
+function authParams(text, start) {
+  const ranges = [];
+  let cursor = start,
+    count = 0,
+    quoted = false;
+  for (;;) {
+    const name = authParam.exec(text.slice(cursor, cursor + 128));
+    if (!name) {
+      break;
+    }
+    const valueStart = cursor + name[0].length;
+    const value = authParamValue(text, valueStart);
+    if (!value) {
+      break;
+    }
+    count++;
+    quoted ||= value.quoted;
+    if (!publicAuthParam.test(name[1]) && value.end > value.start) {
+      ranges.push({ start: value.start, end: value.end });
+    }
+    const separator = /^[ \t]*,[ \t]*/.exec(
+      text.slice(value.after, value.after + 64)
+    );
+    if (!separator) {
+      break;
+    }
+    cursor = value.after + separator[0].length;
+  }
+  // `Basic dXNlcg==` is one token68 credential, not a parameter list.
+  return count > 1 || (count === 1 && quoted) ? ranges : undefined;
+}
+function authParamValue(text, start) {
+  const quote = /^(\\*)"/.exec(text.slice(start, start + 64));
+  if (quote) {
+    // Parameter values are short; a quote further away is not their end.
+    const window = text.slice(start, start + 4096);
+    const offset = window.indexOf(quote[0], quote[0].length);
+    const close = start + offset;
+    if (offset < 0 || /[\r\n]/.test(window.slice(0, offset))) {
+      return undefined;
+    }
+    const after = close + quote[0].length;
+    // A quoted value ends the header or continues the list.
+    if (
+      !/^(?:[ \t]*(?:,|$|[\r\n])|\\*["'\r\n])/.test(
+        text.slice(after, after + 64)
+      )
+    ) {
+      return undefined;
+    }
+    return { start: start + quote[0].length, end: close, after, quoted: true };
+  }
+  const token = /^[^\s,"'\\]{1,4096}/.exec(text.slice(start, start + 4096));
+  return token
+    ? { start, end: start + token[0].length, after: start + token[0].length }
+    : undefined;
 }
 function usableAuthorization(token) {
   return Boolean(token) && !credentialPlaceholder(token);
@@ -275,6 +369,25 @@ function operationalLocationPath(value) {
     servicePath(value) || /^(?:\.?\.?\/)?[\w.-]+(?:\/[\w.-]+)+\/?$/.test(value)
   );
 }
+// Types with a fixed value shape decide on the value alone; `undefined` leaves
+// the decision to the general checks.
+function shapedValueAllowed(value, type) {
+  if (type === 'PHONE') {
+    return (
+      /^\+?[\d () .-]{7,40}$/.test(value) &&
+      /\d{3}/.test(value.replace(/\D/g, ''))
+    );
+  }
+  if (type === 'EMAIL') {
+    return /^[^\s@]+@[^\s@]+\.[\p{L}]{2,63}$/u.test(value);
+  }
+  // A URL holds no whitespace, so prose under a `url` key is left to the
+  // detectors of what the prose contains.
+  if (type === 'URL' && /\s/u.test(value)) {
+    return false;
+  }
+  return undefined;
+}
 // Shared by native labels and the vendor catalogs. Code expressions and
 // line escapes are not personal field values, even when a key is familiar.
 export function personalValueAllowed(text, range, type, labelStart) {
@@ -288,14 +401,9 @@ export function personalValueAllowed(text, range, type, labelStart) {
   ) {
     return false;
   }
-  if (type === 'PHONE') {
-    return (
-      /^\+?[\d () .-]{7,40}$/.test(value) &&
-      /\d{3}/.test(value.replace(/\D/g, ''))
-    );
-  }
-  if (type === 'EMAIL') {
-    return /^[^\s@]+@[^\s@]+\.[\p{L}]{2,63}$/u.test(value);
+  const shaped = shapedValueAllowed(value, type);
+  if (shaped !== undefined) {
+    return shaped;
   }
   if (/^(?:\\[nrt]|[\r\n])/.test(value)) {
     return false;
@@ -391,12 +499,38 @@ function credentialMode(text, match) {
   ) {
     return 'query';
   }
-  if (match[2] === '=' || /["']\s*[:：]/.test(match[0])) {
+  if (/^=>?$/.test(match[2]) || /["']\s*[:：]/.test(match[0])) {
     return 'token';
   }
   return /[:：]/.test(match[2]) ? 'line' : 'prose';
 }
 
+// `token: <script>alert(1)</script>`: markup is the value. A bare
+// `<placeholder>` that ends the value stays a placeholder.
+const angleEnd = {
+  line: /[\r\n"]|\\+[nrt"']/,
+  token: /[\s,;}\]"']|\\+[nrt"']/,
+};
+// Formatting tags around a value (`token=<em>…</em>`) are dropped from the
+// detection view instead.
+const formattingTag = new RegExp(`^${htmlTag}`, 'i');
+function angleValue(text, start, mode) {
+  const tail = text.slice(start, start + 4096);
+  if (text[start] !== '<' || !angleEnd[mode] || formattingTag.test(tail)) {
+    return undefined;
+  }
+  const placeholder = /^<[^<>\r\n]{1,64}>/.exec(tail)?.[0];
+  if (
+    placeholder &&
+    credentialPlaceholder(placeholder) &&
+    angleEnd[mode].test(tail[placeholder.length] ?? '\n')
+  ) {
+    return { start, end: start + placeholder.length };
+  }
+  const stop = tail.search(angleEnd[mode]);
+  return { start, end: start + (stop < 0 ? tail.length : stop) };
+}
+
 function credentialRange(text, match, camel) {
   const start = match.index + match[0].length;
   if (
@@ -405,13 +539,25 @@ function credentialRange(text, match, camel) {
   ) {
     return undefined;
   }
+  if (/^(?:proxy-)?authorization$/i.test(match[1])) {
+    return authorizationRanges(text, start);
+  }
   const mode = credentialMode(text, match);
-  const range = /^(?:proxy-)?authorization$/i.test(match[1])
-    ? authorizationRange(text, start)
-    : valueRange(text, start, mode);
-  return range && mode === 'prose' ? generatedWord(text, range) : range;
+  const range = angleValue(text, start, mode) ?? valueRange(text, start, mode);
+  const value = range && mode === 'prose' ? generatedWord(text, range) : range;
+  if (value && /^(?:set-)?cookie$/i.test(match[1])) {
+    return cookieValues(text, value.start, value.end);
+  }
+  return [value].filter(Boolean);
 }
 
+// `<password>…</password>`, `<clientSecret attr="1">…</clientSecret>`:
+// attributes in the opening tag stay readable.
+const element = (name) =>
+  `<(${name})(?:[ \\t\\r\\n]+[^<>]{0,512})?>([^<]+)</\\1[ \\t]*>`;
+const xmlElement = new RegExp(element(key), 'giu');
+const camelElement = new RegExp(element(camelKey), 'gu');
+
 function detectCredentials(text, emit) {
   const details = { category: 'credential', type: 'SECRET', rule: 'context' };
   const matches = [
@@ -419,13 +565,18 @@ function detectCredentials(text, emit) {
     ...[...text.matchAll(camelPrefix)].map((match) => [match, true]),
   ];
   for (const [match, camel] of matches) {
-    const range = credentialRange(text, match, camel);
-    if (range) {
-      emitValue(text, range.start, range.end, emit, details, match[1]);
+    // `https://x-access-token:…@host` is URL user info (`url-userinfo`).
+    if (/:\/\/$/.test(text.slice(Math.max(0, match.index - 3), match.index))) {
+      continue;
+    }
+    for (const value of credentialRange(text, match, camel) ?? []) {
+      emitValue(text, value.start, value.end, emit, details, match[1]);
     }
   }
-  const xml = new RegExp(`<(${key})[ \\t]*>([^<]+)</\\1[ \\t]*>`, 'giu');
-  for (const match of text.matchAll(xml)) {
+  for (const match of [
+    ...text.matchAll(xmlElement),
+    ...text.matchAll(camelElement),
+  ]) {
     const start = match.index + match[0].indexOf('>') + 1;
     emitValue(text, start, start + match[2].length, emit, details, match[1]);
   }

package/src/credential-spans.js

@@ -0,0 +1,180 @@
+import { maskedValue } from './credentials.js';
+
+// Credential findings cover the secret, not the readable context around it:
+// PEM markers, URL hosts and user names, cookie names and the rest of a
+// sentence stay visible, so a masked log still shows what was masked.
+
+// Context rules that read "to the end of the value" without knowing the
+// value's format. A structured vendor token that starts the same value
+// bounds them.
+const openEnded = new Set([
+  'context',
+  'cookie',
+  'named-value',
+  'cli-password',
+  'quoted-entropy',
+  'entropy',
+  'gitleaks/generic-api-key',
+  'betterleaks/generic-api-key',
+]);
+const notBounding = new Set([...openEnded, 'known-secret', 'authorization']);
+const lineBreak = '(?:\\r?\\n|\\\\+[nr])';
+const pemMarker = new RegExp(
+  `-----(BEGIN|END) [A-Z0-9 _-]{0,100}-----(?:[ \\t]*${lineBreak})?`,
+  'g'
+);
+
+// Body spans of every BEGIN/END block inside [start, end). Text between two
+// blocks never belongs to a key; an unterminated block runs to `end`.
+export function pemBodies(text, start, end) {
+  const segment = text.slice(start, end);
+  if (!/^(?:\\*["'])?-----BEGIN /.test(segment)) {
+    return undefined;
+  }
+  const bodies = [];
+  let open;
+  for (const marker of segment.matchAll(pemMarker)) {
+    if (marker[1] === 'BEGIN') {
+      open = marker.index + marker[0].length;
+    } else if (open !== undefined) {
+      bodies.push(trimmed(text, start + open, start + marker.index));
+      open = undefined;
+    }
+  }
+  if (open !== undefined) {
+    bodies.push(trimmed(text, start + open, end));
+  }
+  return bodies.filter((body) => body.end > body.start);
+}
+function trimmed(text, start, end) {
+  const body = text.slice(start, end);
+  const lead = /^(?:\s|\\+[nrt])+/.exec(body)?.[0].length ?? 0;
+  const tail = /(?:\s|\\+[nrt])+$/.exec(body.slice(lead))?.[0].length ?? 0;
+  return { start: start + lead, end: end - tail };
+}
+
+// `scheme://user:password@host`: only the password is the credential.
+const userinfo = /^[a-z][a-z0-9+.-]*:\/\/([^\s/@:]+):([^\s/@]+)@/i;
+// A URL secret keeps its scheme, host and fixed path words
+// (`https://hooks.slack.com/services/`), so a reader still sees which
+// endpoint it was.
+const serviceUser =
+  /^(?:x-access-token|x-oauth-basic|x-token-auth|oauth2?|git|gitlab-ci-token|token|pat|apikey|api)$/i;
+const endpoint = /^(?:https?:\/\/)?[a-z0-9-]+(?:\.[a-z0-9-]+)+\//i;
+const pathWord = /^(?:[a-z]{2,20}(?:\d{1,2})?\/)+/i;
+
+function urlSecret(text, finding) {
+  const value = text.slice(finding.start, finding.end);
+  // `url-userinfo` already covers only `user:password`.
+  const own = finding.rule === 'url-userinfo';
+  const credentials = own
+    ? /^([^:]+):(.+)$/s.exec(value)
+    : userinfo.exec(value);
+  if (credentials) {
+    const end = finding.start + credentials[0].length - (own ? 0 : 1);
+    const start = end - credentials[2].length;
+    const user = start - 1 - credentials[1].length;
+    return [
+      { start, end },
+      // Outside credentialsOnly the user name is still personal data.
+      ...(serviceUser.test(credentials[1]) || maskedValue(credentials[1])
+        ? []
+        : [
+            {
+              start: user,
+              end: user + credentials[1].length,
+              type: 'USERNAME',
+              category: 'personal',
+            },
+          ]),
+    ];
+  }
+  const host = endpoint.exec(value);
+  if (!host || finding.rule === 'url-userinfo') {
+    return undefined;
+  }
+  const words = pathWord.exec(value.slice(host[0].length))?.[0] ?? '';
+  const start = finding.start + host[0].length + words.length;
+  return finding.end - start >= 8 ? [{ start, end: finding.end }] : undefined;
+}
+
+function narrowed(text, finding) {
+  if (finding.category !== 'credential') {
+    return [finding];
+  }
+  const parts =
+    pemBodies(text, finding.start, finding.end) ?? urlSecret(text, finding);
+  return parts ? parts.map((part) => ({ ...finding, ...part })) : [finding];
+}
+
+// `token: ghp_… . Next sentence` — a context value that a vendor rule ends
+// earlier stops at that end when only punctuation or a space follows.
+function bounded(text, finding, findings) {
+  if (!openEnded.has(finding.rule) || finding.category !== 'credential') {
+    return finding;
+  }
+  let end = finding.end;
+  for (const other of findings) {
+    if (
+      other.category === 'credential' &&
+      !notBounding.has(other.rule) &&
+      other.start === finding.start &&
+      other.end < end &&
+      other.end > other.start &&
+      /^[.,;:!?]*(?:\s|$)/.test(text.slice(other.end, finding.end))
+    ) {
+      end = other.end;
+    }
+  }
+  return end === finding.end ? finding : { ...finding, end };
+}
+
+// PEM armor (`-----BEGIN RSA PRIVATE KEY-----`) stays readable, and its
+// upper-case words are not a person or an organization.
+function pemMarkers(text, findings) {
+  const markers = [];
+  for (const finding of findings) {
+    const segment = text.slice(finding.start, finding.end);
+    if (finding.category === 'credential' && /-----BEGIN /.test(segment)) {
+      for (const marker of segment.matchAll(pemMarker)) {
+        const start = finding.start + marker.index;
+        markers.push({ start, end: start + marker[0].length });
+      }
+    }
+  }
+  return markers;
+}
+
+export function refineCredentialSpans(text, findings) {
+  const markers = pemMarkers(text, findings);
+  const narrow = findings
+    .filter(
+      (finding) =>
+        finding.category === 'credential' ||
+        !markers.some(
+          (marker) => finding.start < marker.end && marker.start < finding.end
+        )
+    )
+    .flatMap((finding) => narrowed(text, finding));
+  return narrow.map((finding) => bounded(text, finding, narrow));
+}
+
+// `Cookie: a=1; b=2` and `Set-Cookie: id=…; Path=/; HttpOnly`: each cookie
+// value is a credential; names, separators and attributes stay readable.
+const cookieAttribute =
+  /^(?:path|domain|expires|max-age|samesite|secure|httponly|priority|partitioned|version|comment)$/i;
+export function cookieValues(text, start, end) {
+  const values = [];
+  for (const pair of text.slice(start, end).matchAll(/[^;]+/g)) {
+    const part = /^[ \t]*(?:([^=\s]+)[ \t]*=[ \t]*)?(.*?)[ \t]*$/s.exec(
+      pair[0]
+    );
+    const [, name, value] = part;
+    if (!value || cookieAttribute.test(name ?? value)) {
+      continue;
+    }
+    const valueEnd = start + pair.index + pair[0].replace(/[ \t]+$/, '').length;
+    values.push({ start: valueEnd - value.length, end: valueEnd });
+  }
+  return values;
+}

package/src/credentials-entry.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Credentials-only entry point. It has the same API as the main entry for the
+ * functions it exports, always runs with `credentialsOnly: true`, and rejects
+ * `credentialsOnly: false` and `mode: 'fake'` with `ERR_CONFIG`.
+ */
+export type * from './index.js';
+export {
+  inspect,
+  sanitize,
+  redact,
+  createSanitizer,
+  createSyncSanitizer,
+  REDACTED,
+  entropy,
+  builtInRules,
+  tokenChecksum,
+  tokenWithChecksum,
+  knownSecretsFromEnv,
+  knownSecretsFromGitHubAuth,
+  knownSecretsFromGitHubConfig,
+  reservedPlaceholderTypes,
+  isPlaceholderToken,
+} from './index.js';

package/src/credentials-entry.js

@@ -0,0 +1,62 @@
+/**
+ * Credentials-only entry point (`@link-foundation/sensitive-data-sanitizer/credentials`).
+ *
+ * It loads the credential detectors without the personal-data detectors,
+ * faker or libphonenumber, so it starts faster and suits synchronous loggers.
+ * Every function here runs with `credentialsOnly: true` (issue 137).
+ */
+import {
+  inspect as inspectText,
+  sanitize as sanitizeText,
+  redact as redactText,
+} from './sanitizer.js';
+import { failure } from './detection.js';
+import { createSanitizer as createAsyncSanitizer } from './engines.js';
+import { createSyncSanitizer as createSync } from './sync-sanitizer.js';
+
+export { REDACTED, entropy } from './detection.js';
+export { builtInRules } from './rule-catalog.js';
+export { tokenChecksum, tokenWithChecksum } from './token-checksum.js';
+export {
+  reservedPlaceholderTypes,
+  isPlaceholderToken,
+} from './placeholder-types.js';
+export {
+  knownSecretsFromEnv,
+  knownSecretsFromGitHubAuth,
+  knownSecretsFromGitHubConfig,
+} from './known.js';
+
+function credentialOptions(options = {}) {
+  const transforms = [
+    options.transformation,
+    ...Object.values(options.transformations ?? {}),
+  ];
+  // The feature registry is shared by both entries in one process, so these
+  // options are rejected explicitly.
+  if (
+    options.credentialsOnly === false ||
+    options.properNames !== undefined ||
+    options.scripts !== undefined ||
+    transforms.some((transform) => transform?.mode === 'fake')
+  ) {
+    throw failure('ERR_CONFIG');
+  }
+  return { ...options, credentialsOnly: true };
+}
+
+export function inspect(text, options) {
+  return inspectText(text, credentialOptions(options));
+}
+export function sanitize(text, options) {
+  return sanitizeText(text, credentialOptions(options));
+}
+export function redact(text, findings, options) {
+  return redactText(text, findings, credentialOptions(options));
+}
+export function createSanitizer(options) {
+  return createAsyncSanitizer(credentialOptions(options));
+}
+export function createSyncSanitizer(options) {
+  return createSync(credentialOptions(options));
+}

package/src/credentials.js

@@ -10,8 +10,15 @@ export function credentialPlaceholder(value) {
 // One template or mask token: ${NAME}, $${NAME}, $NAME, $1, <name>, [NAME],
 // ****, XXXX or an ellipsis. Values made only of these (optionally split by
 // a user:password colon) carry no credential material.
+// `hive-mask` and `mask` output (`ghp…b4N`, `ab***yz`; NFKC projection turns
+// `…` into `...`) keeps at most a few characters around the marker, so a
+// second pass leaves it unchanged.
 const templateToken =
-  /^(?:\$?\$\{[A-Za-z_][\w.-]*\}|\$[A-Za-z_]\w*|\$\d|<[^<>\r\n]{1,64}>|\[[A-Z][A-Z0-9_ ]{0,63}\]|\*{3,}|[xX]{4,}|\.{3}|…)$/;
+  /^(?:\$?\$\{[A-Za-z_][\w.-]*\}|\$[A-Za-z_]\w*|\$\d|<[^<>\r\n]{1,64}>|\[[A-Z][A-Z0-9_ ]{0,63}\]|[^\s…*.]{0,4}(?:…|\.{3}|\*{3,})[^\s…*.]{0,4}|[xX]{4,})$/u;
+// A whole value that is already a template, a mask or `[REDACTED]`.
+export function maskedValue(value) {
+  return credentialPlaceholder(value) || templateToken.test(value);
+}
 const unquote = (part) => part.replace(/^["']|["']$/g, '');
 
 function templatedValue(value) {