@logtape/redaction 1.2.0 → 1.2.1

package/deno.json

@@ -1,6 +1,6 @@
 {
   "name": "@logtape/redaction",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "license": "MIT",
   "exports": "./src/mod.ts",
   "exclude": [

package/dist/field.cjs

@@ -22,11 +22,17 @@ const DEFAULT_REDACT_FIELDS = [
 	/address/i
 ];
 /**
-* Redacts properties in a {@link LogRecord} based on the provided field
-* patterns and action.
+* Redacts properties and message values in a {@link LogRecord} based on the
+* provided field patterns and action.
 *
 * Note that it is a decorator which wraps the sink and redacts properties
-* before passing them to the sink.
+* and message values before passing them to the sink.
+*
+* For string templates (e.g., `"Hello, {name}!"`), placeholder names are
+* matched against the field patterns to determine which values to redact.
+*
+* For tagged template literals (e.g., `` `Hello, ${name}!` ``), redaction
+* is performed by comparing message values with redacted property values.
 *
 * @example
 * ```ts
@@ -44,9 +50,20 @@ const DEFAULT_REDACT_FIELDS = [
 function redactByField(sink, options = DEFAULT_REDACT_FIELDS) {
 	const opts = Array.isArray(options) ? { fieldPatterns: options } : options;
 	const wrapped = (record) => {
+		const redactedProperties = redactProperties(record.properties, opts);
+		let redactedMessage = record.message;
+		if (typeof record.rawMessage === "string") {
+			const placeholders = extractPlaceholderNames(record.rawMessage);
+			const redactedIndices = getRedactedPlaceholderIndices(placeholders, opts.fieldPatterns);
+			if (redactedIndices.size > 0) redactedMessage = redactMessageArray(record.message, redactedIndices, opts.action);
+		} else {
+			const redactedValues = getRedactedValues(record.properties, redactedProperties);
+			if (redactedValues.size > 0) redactedMessage = redactMessageByValues(record.message, redactedValues);
+		}
 		sink({
 			...record,
-			properties: redactProperties(record.properties, opts)
+			message: redactedMessage,
+			properties: redactedProperties
 		});
 	};
 	if (Symbol.dispose in sink) wrapped[Symbol.dispose] = sink[Symbol.dispose];
@@ -99,6 +116,129 @@ function shouldFieldRedacted(field, fieldPatterns) {
 	} else if (fieldPattern.test(field)) return true;
 	return false;
 }
+/**
+* Extracts placeholder names from a message template string in order.
+* @param template The message template string.
+* @returns An array of placeholder names in the order they appear.
+*/
+function extractPlaceholderNames(template) {
+	const placeholders = [];
+	for (let i = 0; i < template.length; i++) if (template[i] === "{") {
+		if (i + 1 < template.length && template[i + 1] === "{") {
+			i++;
+			continue;
+		}
+		const closeIndex = template.indexOf("}", i + 1);
+		if (closeIndex === -1) continue;
+		const key = template.slice(i + 1, closeIndex).trim();
+		placeholders.push(key);
+		i = closeIndex;
+	}
+	return placeholders;
+}
+/**
+* Parses a property path into its segments.
+* @param path The property path (e.g., "user.password" or "users[0].email").
+* @returns An array of path segments.
+*/
+function parsePathSegments(path) {
+	const segments = [];
+	let current = "";
+	for (const char of path) if (char === "." || char === "[") {
+		if (current) segments.push(current);
+		current = "";
+	} else if (char === "]" || char === "?") {} else current += char;
+	if (current) segments.push(current);
+	return segments;
+}
+/**
+* Determines which placeholder indices should be redacted based on field
+* patterns.
+* @param placeholders Array of placeholder names from the template.
+* @param fieldPatterns Field patterns to match against.
+* @returns Set of indices that should be redacted.
+*/
+function getRedactedPlaceholderIndices(placeholders, fieldPatterns) {
+	const indices = /* @__PURE__ */ new Set();
+	for (let i = 0; i < placeholders.length; i++) {
+		const placeholder = placeholders[i];
+		if (placeholder === "*") continue;
+		if (shouldFieldRedacted(placeholder, fieldPatterns)) {
+			indices.add(i);
+			continue;
+		}
+		const segments = parsePathSegments(placeholder);
+		for (const segment of segments) if (shouldFieldRedacted(segment, fieldPatterns)) {
+			indices.add(i);
+			break;
+		}
+	}
+	return indices;
+}
+/**
+* Redacts values in the message array based on the redacted placeholder
+* indices.
+* @param message The original message array.
+* @param redactedIndices Set of placeholder indices to redact.
+* @param action The redaction action.
+* @returns New message array with redacted values.
+*/
+function redactMessageArray(message, redactedIndices, action) {
+	if (redactedIndices.size === 0) return message;
+	const result = [];
+	let placeholderIndex = 0;
+	for (let i = 0; i < message.length; i++) if (i % 2 === 0) result.push(message[i]);
+	else {
+		if (redactedIndices.has(placeholderIndex)) if (action == null || action === "delete") result.push("");
+		else result.push(action(message[i]));
+		else result.push(message[i]);
+		placeholderIndex++;
+	}
+	return result;
+}
+/**
+* Collects redacted value mappings from original to redacted properties.
+* @param original The original properties.
+* @param redacted The redacted properties.
+* @param map The map to populate with original -> redacted value pairs.
+*/
+function collectRedactedValues(original, redacted, map) {
+	for (const key in original) {
+		const origVal = original[key];
+		const redVal = redacted[key];
+		if (origVal !== redVal) map.set(origVal, redVal);
+		if (typeof origVal === "object" && origVal !== null && typeof redVal === "object" && redVal !== null && !Array.isArray(origVal)) collectRedactedValues(origVal, redVal, map);
+	}
+}
+/**
+* Gets a map of original values to their redacted replacements.
+* @param original The original properties.
+* @param redacted The redacted properties.
+* @returns A map of original -> redacted values.
+*/
+function getRedactedValues(original, redacted) {
+	const map = /* @__PURE__ */ new Map();
+	collectRedactedValues(original, redacted, map);
+	return map;
+}
+/**
+* Redacts message array values by comparing with redacted property values.
+* Used for tagged template literals where placeholder names are not available.
+* @param message The original message array.
+* @param redactedValues Map of original -> redacted values.
+* @returns New message array with redacted values.
+*/
+function redactMessageByValues(message, redactedValues) {
+	if (redactedValues.size === 0) return message;
+	const result = [];
+	for (let i = 0; i < message.length; i++) if (i % 2 === 0) result.push(message[i]);
+	else {
+		const val = message[i];
+		if (redactedValues.has(val)) result.push(redactedValues.get(val));
+		else result.push(val);
+	}
+	return result;
+}
 
 //#endregion
 exports.DEFAULT_REDACT_FIELDS = DEFAULT_REDACT_FIELDS;

package/dist/field.d.cts

@@ -47,11 +47,17 @@ interface FieldRedactionOptions {
   readonly action?: "delete" | ((value: unknown) => unknown);
 }
 /**
- * Redacts properties in a {@link LogRecord} based on the provided field
- * patterns and action.
+ * Redacts properties and message values in a {@link LogRecord} based on the
+ * provided field patterns and action.
  *
  * Note that it is a decorator which wraps the sink and redacts properties
- * before passing them to the sink.
+ * and message values before passing them to the sink.
+ *
+ * For string templates (e.g., `"Hello, {name}!"`), placeholder names are
+ * matched against the field patterns to determine which values to redact.
+ *
+ * For tagged template literals (e.g., `` `Hello, ${name}!` ``), redaction
+ * is performed by comparing message values with redacted property values.
  *
  * @example
  * ```ts

package/dist/field.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"field.d.cts","names":[],"sources":["../src/field.ts"],"sourcesContent":[],"mappings":";;;;;;AAOA;AAOA;AAQA;AAqBiB,KApCL,YAAA,GAoCK,MAAqB,GApCF,MA2CV;AAmC1B;;;;;AACmC,KAxEvB,aAAA,GAAgB,YAwEO,EAAA;;;;;;;AAEL,cAlEjB,qBAkEiB,EAlEM,aAkEN;;AAAsB;;;;UA7CnC,qBAAA;;;;;;;0BAOS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAmCV,aAAA,OACR,OAAO,OAAO,aAAa,OAAO,2BAC/B,wBAAwB,gBAChC,OAAO,OAAO,aAAa,OAAO"}
+{"version":3,"file":"field.d.cts","names":[],"sources":["../src/field.ts"],"sourcesContent":[],"mappings":";;;;;;AAOA;AAOA;AAQA;AAqBiB,KApCL,YAAA,GAoCK,MAAqB,GApCF,MA2CV;AAyC1B;;;;;AACmC,KA9EvB,aAAA,GAAgB,YA8EO,EAAA;;;;;;;AAEL,cAxEjB,qBAwEiB,EAxEM,aAwEN;;AAAsB;;;;UAnDnC,qBAAA;;;;;;;0BAOS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAyCV,aAAA,OACR,OAAO,OAAO,aAAa,OAAO,2BAC/B,wBAAwB,gBAChC,OAAO,OAAO,aAAa,OAAO"}

package/dist/field.d.ts

@@ -47,11 +47,17 @@ interface FieldRedactionOptions {
   readonly action?: "delete" | ((value: unknown) => unknown);
 }
 /**
- * Redacts properties in a {@link LogRecord} based on the provided field
- * patterns and action.
+ * Redacts properties and message values in a {@link LogRecord} based on the
+ * provided field patterns and action.
  *
  * Note that it is a decorator which wraps the sink and redacts properties
- * before passing them to the sink.
+ * and message values before passing them to the sink.
+ *
+ * For string templates (e.g., `"Hello, {name}!"`), placeholder names are
+ * matched against the field patterns to determine which values to redact.
+ *
+ * For tagged template literals (e.g., `` `Hello, ${name}!` ``), redaction
+ * is performed by comparing message values with redacted property values.
  *
  * @example
  * ```ts

package/dist/field.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"field.d.ts","names":[],"sources":["../src/field.ts"],"sourcesContent":[],"mappings":";;;;;;AAOA;AAOA;AAQA;AAqBiB,KApCL,YAAA,GAoCK,MAAqB,GApCF,MA2CV;AAmC1B;;;;;AACmC,KAxEvB,aAAA,GAAgB,YAwEO,EAAA;;;;;;;AAEL,cAlEjB,qBAkEiB,EAlEM,aAkEN;;AAAsB;;;;UA7CnC,qBAAA;;;;;;;0BAOS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAmCV,aAAA,OACR,OAAO,OAAO,aAAa,OAAO,2BAC/B,wBAAwB,gBAChC,OAAO,OAAO,aAAa,OAAO"}
+{"version":3,"file":"field.d.ts","names":[],"sources":["../src/field.ts"],"sourcesContent":[],"mappings":";;;;;;AAOA;AAOA;AAQA;AAqBiB,KApCL,YAAA,GAoCK,MAAqB,GApCF,MA2CV;AAyC1B;;;;;AACmC,KA9EvB,aAAA,GAAgB,YA8EO,EAAA;;;;;;;AAEL,cAxEjB,qBAwEiB,EAxEM,aAwEN;;AAAsB;;;;UAnDnC,qBAAA;;;;;;;0BAOS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAyCV,aAAA,OACR,OAAO,OAAO,aAAa,OAAO,2BAC/B,wBAAwB,gBAChC,OAAO,OAAO,aAAa,OAAO"}

package/dist/field.js

@@ -21,11 +21,17 @@ const DEFAULT_REDACT_FIELDS = [
 	/address/i
 ];
 /**
-* Redacts properties in a {@link LogRecord} based on the provided field
-* patterns and action.
+* Redacts properties and message values in a {@link LogRecord} based on the
+* provided field patterns and action.
 *
 * Note that it is a decorator which wraps the sink and redacts properties
-* before passing them to the sink.
+* and message values before passing them to the sink.
+*
+* For string templates (e.g., `"Hello, {name}!"`), placeholder names are
+* matched against the field patterns to determine which values to redact.
+*
+* For tagged template literals (e.g., `` `Hello, ${name}!` ``), redaction
+* is performed by comparing message values with redacted property values.
 *
 * @example
 * ```ts
@@ -43,9 +49,20 @@ const DEFAULT_REDACT_FIELDS = [
 function redactByField(sink, options = DEFAULT_REDACT_FIELDS) {
 	const opts = Array.isArray(options) ? { fieldPatterns: options } : options;
 	const wrapped = (record) => {
+		const redactedProperties = redactProperties(record.properties, opts);
+		let redactedMessage = record.message;
+		if (typeof record.rawMessage === "string") {
+			const placeholders = extractPlaceholderNames(record.rawMessage);
+			const redactedIndices = getRedactedPlaceholderIndices(placeholders, opts.fieldPatterns);
+			if (redactedIndices.size > 0) redactedMessage = redactMessageArray(record.message, redactedIndices, opts.action);
+		} else {
+			const redactedValues = getRedactedValues(record.properties, redactedProperties);
+			if (redactedValues.size > 0) redactedMessage = redactMessageByValues(record.message, redactedValues);
+		}
 		sink({
 			...record,
-			properties: redactProperties(record.properties, opts)
+			message: redactedMessage,
+			properties: redactedProperties
 		});
 	};
 	if (Symbol.dispose in sink) wrapped[Symbol.dispose] = sink[Symbol.dispose];
@@ -98,6 +115,129 @@ function shouldFieldRedacted(field, fieldPatterns) {
 	} else if (fieldPattern.test(field)) return true;
 	return false;
 }
+/**
+* Extracts placeholder names from a message template string in order.
+* @param template The message template string.
+* @returns An array of placeholder names in the order they appear.
+*/
+function extractPlaceholderNames(template) {
+	const placeholders = [];
+	for (let i = 0; i < template.length; i++) if (template[i] === "{") {
+		if (i + 1 < template.length && template[i + 1] === "{") {
+			i++;
+			continue;
+		}
+		const closeIndex = template.indexOf("}", i + 1);
+		if (closeIndex === -1) continue;
+		const key = template.slice(i + 1, closeIndex).trim();
+		placeholders.push(key);
+		i = closeIndex;
+	}
+	return placeholders;
+}
+/**
+* Parses a property path into its segments.
+* @param path The property path (e.g., "user.password" or "users[0].email").
+* @returns An array of path segments.
+*/
+function parsePathSegments(path) {
+	const segments = [];
+	let current = "";
+	for (const char of path) if (char === "." || char === "[") {
+		if (current) segments.push(current);
+		current = "";
+	} else if (char === "]" || char === "?") {} else current += char;
+	if (current) segments.push(current);
+	return segments;
+}
+/**
+* Determines which placeholder indices should be redacted based on field
+* patterns.
+* @param placeholders Array of placeholder names from the template.
+* @param fieldPatterns Field patterns to match against.
+* @returns Set of indices that should be redacted.
+*/
+function getRedactedPlaceholderIndices(placeholders, fieldPatterns) {
+	const indices = /* @__PURE__ */ new Set();
+	for (let i = 0; i < placeholders.length; i++) {
+		const placeholder = placeholders[i];
+		if (placeholder === "*") continue;
+		if (shouldFieldRedacted(placeholder, fieldPatterns)) {
+			indices.add(i);
+			continue;
+		}
+		const segments = parsePathSegments(placeholder);
+		for (const segment of segments) if (shouldFieldRedacted(segment, fieldPatterns)) {
+			indices.add(i);
+			break;
+		}
+	}
+	return indices;
+}
+/**
+* Redacts values in the message array based on the redacted placeholder
+* indices.
+* @param message The original message array.
+* @param redactedIndices Set of placeholder indices to redact.
+* @param action The redaction action.
+* @returns New message array with redacted values.
+*/
+function redactMessageArray(message, redactedIndices, action) {
+	if (redactedIndices.size === 0) return message;
+	const result = [];
+	let placeholderIndex = 0;
+	for (let i = 0; i < message.length; i++) if (i % 2 === 0) result.push(message[i]);
+	else {
+		if (redactedIndices.has(placeholderIndex)) if (action == null || action === "delete") result.push("");
+		else result.push(action(message[i]));
+		else result.push(message[i]);
+		placeholderIndex++;
+	}
+	return result;
+}
+/**
+* Collects redacted value mappings from original to redacted properties.
+* @param original The original properties.
+* @param redacted The redacted properties.
+* @param map The map to populate with original -> redacted value pairs.
+*/
+function collectRedactedValues(original, redacted, map) {
+	for (const key in original) {
+		const origVal = original[key];
+		const redVal = redacted[key];
+		if (origVal !== redVal) map.set(origVal, redVal);
+		if (typeof origVal === "object" && origVal !== null && typeof redVal === "object" && redVal !== null && !Array.isArray(origVal)) collectRedactedValues(origVal, redVal, map);
+	}
+}
+/**
+* Gets a map of original values to their redacted replacements.
+* @param original The original properties.
+* @param redacted The redacted properties.
+* @returns A map of original -> redacted values.
+*/
+function getRedactedValues(original, redacted) {
+	const map = /* @__PURE__ */ new Map();
+	collectRedactedValues(original, redacted, map);
+	return map;
+}
+/**
+* Redacts message array values by comparing with redacted property values.
+* Used for tagged template literals where placeholder names are not available.
+* @param message The original message array.
+* @param redactedValues Map of original -> redacted values.
+* @returns New message array with redacted values.
+*/
+function redactMessageByValues(message, redactedValues) {
+	if (redactedValues.size === 0) return message;
+	const result = [];
+	for (let i = 0; i < message.length; i++) if (i % 2 === 0) result.push(message[i]);
+	else {
+		const val = message[i];
+		if (redactedValues.has(val)) result.push(redactedValues.get(val));
+		else result.push(val);
+	}
+	return result;
+}
 
 //#endregion
 export { DEFAULT_REDACT_FIELDS, redactByField };

package/dist/field.js.map

@@ -1 +1 @@
-{"version":3,"file":"field.js","names":["DEFAULT_REDACT_FIELDS: FieldPatterns","sink: Sink | Sink & Disposable | Sink & AsyncDisposable","options: FieldRedactionOptions | FieldPatterns","record: LogRecord","properties: Record<string, unknown>","options: FieldRedactionOptions","field: string","fieldPatterns: FieldPatterns"],"sources":["../src/field.ts"],"sourcesContent":["import type { LogRecord, Sink } from \"@logtape/logtape\";\n\n/**\n * The type for a field pattern used in redaction.  A string or a regular\n * expression that matches field names.\n * @since 0.10.0\n */\nexport type FieldPattern = string | RegExp;\n\n/**\n * An array of field patterns used for redaction.  Each pattern can be\n * a string or a regular expression that matches field names.\n * @since 0.10.0\n */\nexport type FieldPatterns = FieldPattern[];\n\n/**\n * Default field patterns for redaction.  These patterns will match\n * common sensitive fields such as passwords, tokens, and personal\n * information.\n * @since 0.10.0\n */\nexport const DEFAULT_REDACT_FIELDS: FieldPatterns = [\n  /pass(?:code|phrase|word)/i,\n  /secret/i,\n  /token/i,\n  /key/i,\n  /credential/i,\n  /auth/i,\n  /signature/i,\n  /sensitive/i,\n  /private/i,\n  /ssn/i,\n  /email/i,\n  /phone/i,\n  /address/i,\n];\n\n/**\n * Options for redacting fields in a {@link LogRecord}.  Used by\n * the {@link redactByField} function.\n * @since 0.10.0\n */\nexport interface FieldRedactionOptions {\n  /**\n   * The field patterns to match against.  This can be an array of\n   * strings or regular expressions.  If a field matches any of the\n   * patterns, it will be redacted.\n   * @defaultValue {@link DEFAULT_REDACT_FIELDS}\n   */\n  readonly fieldPatterns: FieldPatterns;\n\n  /**\n   * The action to perform on the matched fields.  If not provided,\n   * the default action is to delete the field from the properties.\n   * If a function is provided, it will be called with the\n   * value of the field, and the return value will be used to replace\n   * the field in the properties.\n   * If the action is `\"delete\"`, the field will be removed from the\n   * properties.\n   * @default `\"delete\"`\n   */\n  readonly action?: \"delete\" | ((value: unknown) => unknown);\n}\n\n/**\n * Redacts properties in a {@link LogRecord} based on the provided field\n * patterns and action.\n *\n * Note that it is a decorator which wraps the sink and redacts properties\n * before passing them to the sink.\n *\n * @example\n * ```ts\n * import { getConsoleSink } from \"@logtape/logtape\";\n * import { redactByField } from \"@logtape/redaction\";\n *\n * const sink = redactByField(getConsoleSink());\n * ```\n *\n * @param sink The sink to wrap.\n * @param options The redaction options.\n * @returns The wrapped sink.\n * @since 0.10.0\n */\nexport function redactByField(\n  sink: Sink | Sink & Disposable | Sink & AsyncDisposable,\n  options: FieldRedactionOptions | FieldPatterns = DEFAULT_REDACT_FIELDS,\n): Sink | Sink & Disposable | Sink & AsyncDisposable {\n  const opts = Array.isArray(options) ? { fieldPatterns: options } : options;\n  const wrapped = (record: LogRecord) => {\n    sink({ ...record, properties: redactProperties(record.properties, opts) });\n  };\n  if (Symbol.dispose in sink) wrapped[Symbol.dispose] = sink[Symbol.dispose];\n  if (Symbol.asyncDispose in sink) {\n    wrapped[Symbol.asyncDispose] = sink[Symbol.asyncDispose];\n  }\n  return wrapped;\n}\n\n/**\n * Redacts properties from an object based on specified field patterns.\n *\n * This function creates a shallow copy of the input object and applies\n * redaction rules to its properties. For properties that match the redaction\n * patterns, the function either removes them or transforms their values based\n * on the provided action.\n *\n * The redaction process is recursive and will be applied to nested objects\n * as well, allowing for deep redaction of sensitive data in complex object\n * structures.\n * @param properties The properties to redact.\n * @param options The redaction options.\n * @returns The redacted properties.\n * @since 0.10.0\n */\nexport function redactProperties(\n  properties: Record<string, unknown>,\n  options: FieldRedactionOptions,\n): Record<string, unknown> {\n  const copy = { ...properties };\n  for (const field in copy) {\n    if (shouldFieldRedacted(field, options.fieldPatterns)) {\n      if (options.action == null || options.action === \"delete\") {\n        delete copy[field];\n      } else {\n        copy[field] = options.action(copy[field]);\n      }\n      continue;\n    }\n    const value = copy[field];\n    // Check if value is an array:\n    if (Array.isArray(value)) {\n      copy[field] = value.map((item) => {\n        if (\n          typeof item === \"object\" && item !== null &&\n          (Object.getPrototypeOf(item) === Object.prototype ||\n            Object.getPrototypeOf(item) === null)\n        ) {\n          // @ts-ignore: item is always Record<string, unknown>\n          return redactProperties(item, options);\n        }\n        return item;\n      });\n      // Check if value is a vanilla object:\n    } else if (\n      typeof value === \"object\" && value !== null &&\n      (Object.getPrototypeOf(value) === Object.prototype ||\n        Object.getPrototypeOf(value) === null)\n    ) {\n      // @ts-ignore: value is always Record<string, unknown>\n      copy[field] = redactProperties(value, options);\n    }\n  }\n  return copy;\n}\n\n/**\n * Checks if a field should be redacted based on the provided field patterns.\n * @param field The field name to check.\n * @param fieldPatterns The field patterns to match against.\n * @returns `true` if the field should be redacted, `false` otherwise.\n * @since 0.10.0\n */\nexport function shouldFieldRedacted(\n  field: string,\n  fieldPatterns: FieldPatterns,\n): boolean {\n  for (const fieldPattern of fieldPatterns) {\n    if (typeof fieldPattern === \"string\") {\n      if (fieldPattern === field) return true;\n    } else {\n      if (fieldPattern.test(field)) return true;\n    }\n  }\n  return false;\n}\n"],"mappings":";;;;;;;AAsBA,MAAaA,wBAAuC;CAClD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACD;;;;;;;;;;;;;;;;;;;;;AAiDD,SAAgB,cACdC,MACAC,UAAiD,uBACE;CACnD,MAAM,OAAO,MAAM,QAAQ,QAAQ,GAAG,EAAE,eAAe,QAAS,IAAG;CACnE,MAAM,UAAU,CAACC,WAAsB;AACrC,OAAK;GAAE,GAAG;GAAQ,YAAY,iBAAiB,OAAO,YAAY,KAAK;EAAE,EAAC;CAC3E;AACD,KAAI,OAAO,WAAW,KAAM,SAAQ,OAAO,WAAW,KAAK,OAAO;AAClE,KAAI,OAAO,gBAAgB,KACzB,SAAQ,OAAO,gBAAgB,KAAK,OAAO;AAE7C,QAAO;AACR;;;;;;;;;;;;;;;;;AAkBD,SAAgB,iBACdC,YACAC,SACyB;CACzB,MAAM,OAAO,EAAE,GAAG,WAAY;AAC9B,MAAK,MAAM,SAAS,MAAM;AACxB,MAAI,oBAAoB,OAAO,QAAQ,cAAc,EAAE;AACrD,OAAI,QAAQ,UAAU,QAAQ,QAAQ,WAAW,SAC/C,QAAO,KAAK;OAEZ,MAAK,SAAS,QAAQ,OAAO,KAAK,OAAO;AAE3C;EACD;EACD,MAAM,QAAQ,KAAK;AAEnB,MAAI,MAAM,QAAQ,MAAM,CACtB,MAAK,SAAS,MAAM,IAAI,CAAC,SAAS;AAChC,cACS,SAAS,YAAY,SAAS,SACpC,OAAO,eAAe,KAAK,KAAK,OAAO,aACtC,OAAO,eAAe,KAAK,KAAK,MAGlC,QAAO,iBAAiB,MAAM,QAAQ;AAExC,UAAO;EACR,EAAC;kBAGK,UAAU,YAAY,UAAU,SACtC,OAAO,eAAe,MAAM,KAAK,OAAO,aACvC,OAAO,eAAe,MAAM,KAAK,MAGnC,MAAK,SAAS,iBAAiB,OAAO,QAAQ;CAEjD;AACD,QAAO;AACR;;;;;;;;AASD,SAAgB,oBACdC,OACAC,eACS;AACT,MAAK,MAAM,gBAAgB,cACzB,YAAW,iBAAiB,UAC1B;MAAI,iBAAiB,MAAO,QAAO;CAAK,WAEpC,aAAa,KAAK,MAAM,CAAE,QAAO;AAGzC,QAAO;AACR"}
+{"version":3,"file":"field.js","names":["DEFAULT_REDACT_FIELDS: FieldPatterns","sink: Sink | Sink & Disposable | Sink & AsyncDisposable","options: FieldRedactionOptions | FieldPatterns","record: LogRecord","properties: Record<string, unknown>","options: FieldRedactionOptions","field: string","fieldPatterns: FieldPatterns","template: string","placeholders: string[]","path: string","segments: string[]","message: readonly unknown[]","redactedIndices: Set<number>","action: \"delete\" | ((value: unknown) => unknown) | undefined","result: unknown[]","original: Record<string, unknown>","redacted: Record<string, unknown>","map: Map<unknown, unknown>","redactedValues: Map<unknown, unknown>"],"sources":["../src/field.ts"],"sourcesContent":["import type { LogRecord, Sink } from \"@logtape/logtape\";\n\n/**\n * The type for a field pattern used in redaction.  A string or a regular\n * expression that matches field names.\n * @since 0.10.0\n */\nexport type FieldPattern = string | RegExp;\n\n/**\n * An array of field patterns used for redaction.  Each pattern can be\n * a string or a regular expression that matches field names.\n * @since 0.10.0\n */\nexport type FieldPatterns = FieldPattern[];\n\n/**\n * Default field patterns for redaction.  These patterns will match\n * common sensitive fields such as passwords, tokens, and personal\n * information.\n * @since 0.10.0\n */\nexport const DEFAULT_REDACT_FIELDS: FieldPatterns = [\n  /pass(?:code|phrase|word)/i,\n  /secret/i,\n  /token/i,\n  /key/i,\n  /credential/i,\n  /auth/i,\n  /signature/i,\n  /sensitive/i,\n  /private/i,\n  /ssn/i,\n  /email/i,\n  /phone/i,\n  /address/i,\n];\n\n/**\n * Options for redacting fields in a {@link LogRecord}.  Used by\n * the {@link redactByField} function.\n * @since 0.10.0\n */\nexport interface FieldRedactionOptions {\n  /**\n   * The field patterns to match against.  This can be an array of\n   * strings or regular expressions.  If a field matches any of the\n   * patterns, it will be redacted.\n   * @defaultValue {@link DEFAULT_REDACT_FIELDS}\n   */\n  readonly fieldPatterns: FieldPatterns;\n\n  /**\n   * The action to perform on the matched fields.  If not provided,\n   * the default action is to delete the field from the properties.\n   * If a function is provided, it will be called with the\n   * value of the field, and the return value will be used to replace\n   * the field in the properties.\n   * If the action is `\"delete\"`, the field will be removed from the\n   * properties.\n   * @default `\"delete\"`\n   */\n  readonly action?: \"delete\" | ((value: unknown) => unknown);\n}\n\n/**\n * Redacts properties and message values in a {@link LogRecord} based on the\n * provided field patterns and action.\n *\n * Note that it is a decorator which wraps the sink and redacts properties\n * and message values before passing them to the sink.\n *\n * For string templates (e.g., `\"Hello, {name}!\"`), placeholder names are\n * matched against the field patterns to determine which values to redact.\n *\n * For tagged template literals (e.g., `` `Hello, ${name}!` ``), redaction\n * is performed by comparing message values with redacted property values.\n *\n * @example\n * ```ts\n * import { getConsoleSink } from \"@logtape/logtape\";\n * import { redactByField } from \"@logtape/redaction\";\n *\n * const sink = redactByField(getConsoleSink());\n * ```\n *\n * @param sink The sink to wrap.\n * @param options The redaction options.\n * @returns The wrapped sink.\n * @since 0.10.0\n */\nexport function redactByField(\n  sink: Sink | Sink & Disposable | Sink & AsyncDisposable,\n  options: FieldRedactionOptions | FieldPatterns = DEFAULT_REDACT_FIELDS,\n): Sink | Sink & Disposable | Sink & AsyncDisposable {\n  const opts = Array.isArray(options) ? { fieldPatterns: options } : options;\n  const wrapped = (record: LogRecord) => {\n    const redactedProperties = redactProperties(record.properties, opts);\n    let redactedMessage = record.message;\n\n    if (typeof record.rawMessage === \"string\") {\n      // String template: redact by placeholder names\n      const placeholders = extractPlaceholderNames(record.rawMessage);\n      const redactedIndices = getRedactedPlaceholderIndices(\n        placeholders,\n        opts.fieldPatterns,\n      );\n      if (redactedIndices.size > 0) {\n        redactedMessage = redactMessageArray(\n          record.message,\n          redactedIndices,\n          opts.action,\n        );\n      }\n    } else {\n      // Tagged template: redact by comparing values\n      const redactedValues = getRedactedValues(\n        record.properties,\n        redactedProperties,\n      );\n      if (redactedValues.size > 0) {\n        redactedMessage = redactMessageByValues(record.message, redactedValues);\n      }\n    }\n\n    sink({\n      ...record,\n      message: redactedMessage,\n      properties: redactedProperties,\n    });\n  };\n  if (Symbol.dispose in sink) wrapped[Symbol.dispose] = sink[Symbol.dispose];\n  if (Symbol.asyncDispose in sink) {\n    wrapped[Symbol.asyncDispose] = sink[Symbol.asyncDispose];\n  }\n  return wrapped;\n}\n\n/**\n * Redacts properties from an object based on specified field patterns.\n *\n * This function creates a shallow copy of the input object and applies\n * redaction rules to its properties. For properties that match the redaction\n * patterns, the function either removes them or transforms their values based\n * on the provided action.\n *\n * The redaction process is recursive and will be applied to nested objects\n * as well, allowing for deep redaction of sensitive data in complex object\n * structures.\n * @param properties The properties to redact.\n * @param options The redaction options.\n * @returns The redacted properties.\n * @since 0.10.0\n */\nexport function redactProperties(\n  properties: Record<string, unknown>,\n  options: FieldRedactionOptions,\n): Record<string, unknown> {\n  const copy = { ...properties };\n  for (const field in copy) {\n    if (shouldFieldRedacted(field, options.fieldPatterns)) {\n      if (options.action == null || options.action === \"delete\") {\n        delete copy[field];\n      } else {\n        copy[field] = options.action(copy[field]);\n      }\n      continue;\n    }\n    const value = copy[field];\n    // Check if value is an array:\n    if (Array.isArray(value)) {\n      copy[field] = value.map((item) => {\n        if (\n          typeof item === \"object\" && item !== null &&\n          (Object.getPrototypeOf(item) === Object.prototype ||\n            Object.getPrototypeOf(item) === null)\n        ) {\n          // @ts-ignore: item is always Record<string, unknown>\n          return redactProperties(item, options);\n        }\n        return item;\n      });\n      // Check if value is a vanilla object:\n    } else if (\n      typeof value === \"object\" && value !== null &&\n      (Object.getPrototypeOf(value) === Object.prototype ||\n        Object.getPrototypeOf(value) === null)\n    ) {\n      // @ts-ignore: value is always Record<string, unknown>\n      copy[field] = redactProperties(value, options);\n    }\n  }\n  return copy;\n}\n\n/**\n * Checks if a field should be redacted based on the provided field patterns.\n * @param field The field name to check.\n * @param fieldPatterns The field patterns to match against.\n * @returns `true` if the field should be redacted, `false` otherwise.\n * @since 0.10.0\n */\nexport function shouldFieldRedacted(\n  field: string,\n  fieldPatterns: FieldPatterns,\n): boolean {\n  for (const fieldPattern of fieldPatterns) {\n    if (typeof fieldPattern === \"string\") {\n      if (fieldPattern === field) return true;\n    } else {\n      if (fieldPattern.test(field)) return true;\n    }\n  }\n  return false;\n}\n\n/**\n * Extracts placeholder names from a message template string in order.\n * @param template The message template string.\n * @returns An array of placeholder names in the order they appear.\n */\nfunction extractPlaceholderNames(template: string): string[] {\n  const placeholders: string[] = [];\n  for (let i = 0; i < template.length; i++) {\n    if (template[i] === \"{\") {\n      // Check for escaped brace\n      if (i + 1 < template.length && template[i + 1] === \"{\") {\n        i++;\n        continue;\n      }\n      const closeIndex = template.indexOf(\"}\", i + 1);\n      if (closeIndex === -1) continue;\n      const key = template.slice(i + 1, closeIndex).trim();\n      placeholders.push(key);\n      i = closeIndex;\n    }\n  }\n  return placeholders;\n}\n\n/**\n * Parses a property path into its segments.\n * @param path The property path (e.g., \"user.password\" or \"users[0].email\").\n * @returns An array of path segments.\n */\nfunction parsePathSegments(path: string): string[] {\n  const segments: string[] = [];\n  let current = \"\";\n  for (const char of path) {\n    if (char === \".\" || char === \"[\") {\n      if (current) segments.push(current);\n      current = \"\";\n    } else if (char === \"]\" || char === \"?\") {\n      // Skip these characters\n    } else {\n      current += char;\n    }\n  }\n  if (current) segments.push(current);\n  return segments;\n}\n\n/**\n * Determines which placeholder indices should be redacted based on field\n * patterns.\n * @param placeholders Array of placeholder names from the template.\n * @param fieldPatterns Field patterns to match against.\n * @returns Set of indices that should be redacted.\n */\nfunction getRedactedPlaceholderIndices(\n  placeholders: string[],\n  fieldPatterns: FieldPatterns,\n): Set<number> {\n  const indices = new Set<number>();\n  for (let i = 0; i < placeholders.length; i++) {\n    const placeholder = placeholders[i];\n    // Skip wildcard {*}\n    if (placeholder === \"*\") continue;\n\n    // Check the full placeholder name\n    if (shouldFieldRedacted(placeholder, fieldPatterns)) {\n      indices.add(i);\n      continue;\n    }\n    // For nested paths, check each segment\n    const segments = parsePathSegments(placeholder);\n    for (const segment of segments) {\n      if (shouldFieldRedacted(segment, fieldPatterns)) {\n        indices.add(i);\n        break;\n      }\n    }\n  }\n  return indices;\n}\n\n/**\n * Redacts values in the message array based on the redacted placeholder\n * indices.\n * @param message The original message array.\n * @param redactedIndices Set of placeholder indices to redact.\n * @param action The redaction action.\n * @returns New message array with redacted values.\n */\nfunction redactMessageArray(\n  message: readonly unknown[],\n  redactedIndices: Set<number>,\n  action: \"delete\" | ((value: unknown) => unknown) | undefined,\n): readonly unknown[] {\n  if (redactedIndices.size === 0) return message;\n\n  const result: unknown[] = [];\n  let placeholderIndex = 0;\n\n  for (let i = 0; i < message.length; i++) {\n    if (i % 2 === 0) {\n      // Even index: text segment\n      result.push(message[i]);\n    } else {\n      // Odd index: value/placeholder\n      if (redactedIndices.has(placeholderIndex)) {\n        if (action == null || action === \"delete\") {\n          result.push(\"\");\n        } else {\n          result.push(action(message[i]));\n        }\n      } else {\n        result.push(message[i]);\n      }\n      placeholderIndex++;\n    }\n  }\n  return result;\n}\n\n/**\n * Collects redacted value mappings from original to redacted properties.\n * @param original The original properties.\n * @param redacted The redacted properties.\n * @param map The map to populate with original -> redacted value pairs.\n */\nfunction collectRedactedValues(\n  original: Record<string, unknown>,\n  redacted: Record<string, unknown>,\n  map: Map<unknown, unknown>,\n): void {\n  for (const key in original) {\n    const origVal = original[key];\n    const redVal = redacted[key];\n\n    if (origVal !== redVal) {\n      map.set(origVal, redVal);\n    }\n\n    // Recurse into nested objects\n    if (\n      typeof origVal === \"object\" && origVal !== null &&\n      typeof redVal === \"object\" && redVal !== null &&\n      !Array.isArray(origVal)\n    ) {\n      collectRedactedValues(\n        origVal as Record<string, unknown>,\n        redVal as Record<string, unknown>,\n        map,\n      );\n    }\n  }\n}\n\n/**\n * Gets a map of original values to their redacted replacements.\n * @param original The original properties.\n * @param redacted The redacted properties.\n * @returns A map of original -> redacted values.\n */\nfunction getRedactedValues(\n  original: Record<string, unknown>,\n  redacted: Record<string, unknown>,\n): Map<unknown, unknown> {\n  const map = new Map<unknown, unknown>();\n  collectRedactedValues(original, redacted, map);\n  return map;\n}\n\n/**\n * Redacts message array values by comparing with redacted property values.\n * Used for tagged template literals where placeholder names are not available.\n * @param message The original message array.\n * @param redactedValues Map of original -> redacted values.\n * @returns New message array with redacted values.\n */\nfunction redactMessageByValues(\n  message: readonly unknown[],\n  redactedValues: Map<unknown, unknown>,\n): readonly unknown[] {\n  if (redactedValues.size === 0) return message;\n\n  const result: unknown[] = [];\n  for (let i = 0; i < message.length; i++) {\n    if (i % 2 === 0) {\n      result.push(message[i]);\n    } else {\n      const val = message[i];\n      if (redactedValues.has(val)) {\n        result.push(redactedValues.get(val));\n      } else {\n        result.push(val);\n      }\n    }\n  }\n  return result;\n}\n"],"mappings":";;;;;;;AAsBA,MAAaA,wBAAuC;CAClD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACD;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuDD,SAAgB,cACdC,MACAC,UAAiD,uBACE;CACnD,MAAM,OAAO,MAAM,QAAQ,QAAQ,GAAG,EAAE,eAAe,QAAS,IAAG;CACnE,MAAM,UAAU,CAACC,WAAsB;EACrC,MAAM,qBAAqB,iBAAiB,OAAO,YAAY,KAAK;EACpE,IAAI,kBAAkB,OAAO;AAE7B,aAAW,OAAO,eAAe,UAAU;GAEzC,MAAM,eAAe,wBAAwB,OAAO,WAAW;GAC/D,MAAM,kBAAkB,8BACtB,cACA,KAAK,cACN;AACD,OAAI,gBAAgB,OAAO,EACzB,mBAAkB,mBAChB,OAAO,SACP,iBACA,KAAK,OACN;EAEJ,OAAM;GAEL,MAAM,iBAAiB,kBACrB,OAAO,YACP,mBACD;AACD,OAAI,eAAe,OAAO,EACxB,mBAAkB,sBAAsB,OAAO,SAAS,eAAe;EAE1E;AAED,OAAK;GACH,GAAG;GACH,SAAS;GACT,YAAY;EACb,EAAC;CACH;AACD,KAAI,OAAO,WAAW,KAAM,SAAQ,OAAO,WAAW,KAAK,OAAO;AAClE,KAAI,OAAO,gBAAgB,KACzB,SAAQ,OAAO,gBAAgB,KAAK,OAAO;AAE7C,QAAO;AACR;;;;;;;;;;;;;;;;;AAkBD,SAAgB,iBACdC,YACAC,SACyB;CACzB,MAAM,OAAO,EAAE,GAAG,WAAY;AAC9B,MAAK,MAAM,SAAS,MAAM;AACxB,MAAI,oBAAoB,OAAO,QAAQ,cAAc,EAAE;AACrD,OAAI,QAAQ,UAAU,QAAQ,QAAQ,WAAW,SAC/C,QAAO,KAAK;OAEZ,MAAK,SAAS,QAAQ,OAAO,KAAK,OAAO;AAE3C;EACD;EACD,MAAM,QAAQ,KAAK;AAEnB,MAAI,MAAM,QAAQ,MAAM,CACtB,MAAK,SAAS,MAAM,IAAI,CAAC,SAAS;AAChC,cACS,SAAS,YAAY,SAAS,SACpC,OAAO,eAAe,KAAK,KAAK,OAAO,aACtC,OAAO,eAAe,KAAK,KAAK,MAGlC,QAAO,iBAAiB,MAAM,QAAQ;AAExC,UAAO;EACR,EAAC;kBAGK,UAAU,YAAY,UAAU,SACtC,OAAO,eAAe,MAAM,KAAK,OAAO,aACvC,OAAO,eAAe,MAAM,KAAK,MAGnC,MAAK,SAAS,iBAAiB,OAAO,QAAQ;CAEjD;AACD,QAAO;AACR;;;;;;;;AASD,SAAgB,oBACdC,OACAC,eACS;AACT,MAAK,MAAM,gBAAgB,cACzB,YAAW,iBAAiB,UAC1B;MAAI,iBAAiB,MAAO,QAAO;CAAK,WAEpC,aAAa,KAAK,MAAM,CAAE,QAAO;AAGzC,QAAO;AACR;;;;;;AAOD,SAAS,wBAAwBC,UAA4B;CAC3D,MAAMC,eAAyB,CAAE;AACjC,MAAK,IAAI,IAAI,GAAG,IAAI,SAAS,QAAQ,IACnC,KAAI,SAAS,OAAO,KAAK;AAEvB,MAAI,IAAI,IAAI,SAAS,UAAU,SAAS,IAAI,OAAO,KAAK;AACtD;AACA;EACD;EACD,MAAM,aAAa,SAAS,QAAQ,KAAK,IAAI,EAAE;AAC/C,MAAI,eAAe,GAAI;EACvB,MAAM,MAAM,SAAS,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM;AACpD,eAAa,KAAK,IAAI;AACtB,MAAI;CACL;AAEH,QAAO;AACR;;;;;;AAOD,SAAS,kBAAkBC,MAAwB;CACjD,MAAMC,WAAqB,CAAE;CAC7B,IAAI,UAAU;AACd,MAAK,MAAM,QAAQ,KACjB,KAAI,SAAS,OAAO,SAAS,KAAK;AAChC,MAAI,QAAS,UAAS,KAAK,QAAQ;AACnC,YAAU;CACX,WAAU,SAAS,OAAO,SAAS,KAAK,CAExC,MACC,YAAW;AAGf,KAAI,QAAS,UAAS,KAAK,QAAQ;AACnC,QAAO;AACR;;;;;;;;AASD,SAAS,8BACPF,cACAF,eACa;CACb,MAAM,0BAAU,IAAI;AACpB,MAAK,IAAI,IAAI,GAAG,IAAI,aAAa,QAAQ,KAAK;EAC5C,MAAM,cAAc,aAAa;AAEjC,MAAI,gBAAgB,IAAK;AAGzB,MAAI,oBAAoB,aAAa,cAAc,EAAE;AACnD,WAAQ,IAAI,EAAE;AACd;EACD;EAED,MAAM,WAAW,kBAAkB,YAAY;AAC/C,OAAK,MAAM,WAAW,SACpB,KAAI,oBAAoB,SAAS,cAAc,EAAE;AAC/C,WAAQ,IAAI,EAAE;AACd;EACD;CAEJ;AACD,QAAO;AACR;;;;;;;;;AAUD,SAAS,mBACPK,SACAC,iBACAC,QACoB;AACpB,KAAI,gBAAgB,SAAS,EAAG,QAAO;CAEvC,MAAMC,SAAoB,CAAE;CAC5B,IAAI,mBAAmB;AAEvB,MAAK,IAAI,IAAI,GAAG,IAAI,QAAQ,QAAQ,IAClC,KAAI,IAAI,MAAM,EAEZ,QAAO,KAAK,QAAQ,GAAG;MAClB;AAEL,MAAI,gBAAgB,IAAI,iBAAiB,CACvC,KAAI,UAAU,QAAQ,WAAW,SAC/B,QAAO,KAAK,GAAG;MAEf,QAAO,KAAK,OAAO,QAAQ,GAAG,CAAC;MAGjC,QAAO,KAAK,QAAQ,GAAG;AAEzB;CACD;AAEH,QAAO;AACR;;;;;;;AAQD,SAAS,sBACPC,UACAC,UACAC,KACM;AACN,MAAK,MAAM,OAAO,UAAU;EAC1B,MAAM,UAAU,SAAS;EACzB,MAAM,SAAS,SAAS;AAExB,MAAI,YAAY,OACd,KAAI,IAAI,SAAS,OAAO;AAI1B,aACS,YAAY,YAAY,YAAY,eACpC,WAAW,YAAY,WAAW,SACxC,MAAM,QAAQ,QAAQ,CAEvB,uBACE,SACA,QACA,IACD;CAEJ;AACF;;;;;;;AAQD,SAAS,kBACPF,UACAC,UACuB;CACvB,MAAM,sBAAM,IAAI;AAChB,uBAAsB,UAAU,UAAU,IAAI;AAC9C,QAAO;AACR;;;;;;;;AASD,SAAS,sBACPL,SACAO,gBACoB;AACpB,KAAI,eAAe,SAAS,EAAG,QAAO;CAEtC,MAAMJ,SAAoB,CAAE;AAC5B,MAAK,IAAI,IAAI,GAAG,IAAI,QAAQ,QAAQ,IAClC,KAAI,IAAI,MAAM,EACZ,QAAO,KAAK,QAAQ,GAAG;MAClB;EACL,MAAM,MAAM,QAAQ;AACpB,MAAI,eAAe,IAAI,IAAI,CACzB,QAAO,KAAK,eAAe,IAAI,IAAI,CAAC;MAEpC,QAAO,KAAK,IAAI;CAEnB;AAEH,QAAO;AACR"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@logtape/redaction",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "description": "Redact sensitive data from log messages",
   "keywords": [
     "logging",
@@ -46,7 +46,7 @@
   },
   "sideEffects": false,
   "peerDependencies": {
-    "@logtape/logtape": "^1.2.0"
+    "@logtape/logtape": "^1.2.1"
   },
   "devDependencies": {
     "@alinea/suite": "^0.6.3",

package/src/field.test.ts

@@ -341,4 +341,204 @@ test("redactByField()", async () => {
     const configs = records[0].properties.configs as any;
     assertEquals(configs[0], { username: "user" });
   }
+
+  { // redacts values in message array (string template)
+    const records: LogRecord[] = [];
+    const wrappedSink = redactByField((r) => records.push(r), {
+      fieldPatterns: ["password"],
+      action: () => "[REDACTED]",
+    });
+
+    wrappedSink({
+      level: "info",
+      category: ["test"],
+      message: ["Password is ", "supersecret", ""],
+      rawMessage: "Password is {password}",
+      timestamp: Date.now(),
+      properties: { password: "supersecret" },
+    });
+
+    assertEquals(records[0].message, ["Password is ", "[REDACTED]", ""]);
+    assertEquals(records[0].properties.password, "[REDACTED]");
+  }
+
+  { // redacts multiple sensitive fields in message
+    const records: LogRecord[] = [];
+    const wrappedSink = redactByField((r) => records.push(r), {
+      fieldPatterns: ["password", "email"],
+      action: () => "[REDACTED]",
+    });
+
+    wrappedSink({
+      level: "info",
+      category: ["test"],
+      message: ["Login: ", "user@example.com", " with ", "secret123", ""],
+      rawMessage: "Login: {email} with {password}",
+      timestamp: Date.now(),
+      properties: { email: "user@example.com", password: "secret123" },
+    });
+
+    assertEquals(records[0].message[1], "[REDACTED]");
+    assertEquals(records[0].message[3], "[REDACTED]");
+  }
+
+  { // redacts nested property path in message
+    const records: LogRecord[] = [];
+    const wrappedSink = redactByField((r) => records.push(r), {
+      fieldPatterns: ["password"],
+      action: () => "[REDACTED]",
+    });
+
+    wrappedSink({
+      level: "info",
+      category: ["test"],
+      message: ["User password: ", "secret", ""],
+      rawMessage: "User password: {user.password}",
+      timestamp: Date.now(),
+      properties: { user: { password: "secret" } },
+    });
+
+    assertEquals(records[0].message[1], "[REDACTED]");
+  }
+
+  { // delete action uses empty string in message
+    const records: LogRecord[] = [];
+    const wrappedSink = redactByField((r) => records.push(r), {
+      fieldPatterns: ["password"],
+    });
+
+    wrappedSink({
+      level: "info",
+      category: ["test"],
+      message: ["Password: ", "secret", ""],
+      rawMessage: "Password: {password}",
+      timestamp: Date.now(),
+      properties: { password: "secret" },
+    });
+
+    assertEquals(records[0].message[1], "");
+    assertFalse("password" in records[0].properties);
+  }
+
+  { // non-sensitive field in message is not redacted
+    const records: LogRecord[] = [];
+    const wrappedSink = redactByField((r) => records.push(r), {
+      fieldPatterns: ["password"],
+      action: () => "[REDACTED]",
+    });
+
+    wrappedSink({
+      level: "info",
+      category: ["test"],
+      message: ["Username: ", "johndoe", ""],
+      rawMessage: "Username: {username}",
+      timestamp: Date.now(),
+      properties: { username: "johndoe" },
+    });
+
+    assertEquals(records[0].message[1], "johndoe");
+  }
+
+  { // wildcard {*} in message is not redacted
+    const records: LogRecord[] = [];
+    const wrappedSink = redactByField((r) => records.push(r), {
+      fieldPatterns: ["password"],
+      action: () => "[REDACTED]",
+    });
+
+    const props = { username: "john", password: "secret" };
+    wrappedSink({
+      level: "info",
+      category: ["test"],
+      message: ["Props: ", props, ""],
+      rawMessage: "Props: {*}",
+      timestamp: Date.now(),
+      properties: props,
+    });
+
+    // The {*} itself should not be redacted
+    assertEquals(records[0].message[1], props);
+  }
+
+  { // escaped braces are not treated as placeholders
+    const records: LogRecord[] = [];
+    const wrappedSink = redactByField((r) => records.push(r), {
+      fieldPatterns: ["password"],
+      action: () => "[REDACTED]",
+    });
+
+    wrappedSink({
+      level: "info",
+      category: ["test"],
+      message: ["Value: ", "secret", ""],
+      rawMessage: "Value: {{password}} {password}",
+      timestamp: Date.now(),
+      properties: { password: "secret" },
+    });
+
+    // Only the second {password} is a placeholder
+    assertEquals(records[0].message[1], "[REDACTED]");
+  }
+
+  { // tagged template literal - redacts by comparing values
+    const records: LogRecord[] = [];
+    const wrappedSink = redactByField((r) => records.push(r), {
+      fieldPatterns: ["password"],
+      action: () => "[REDACTED]",
+    });
+
+    const rawMessage = ["Password: ", ""] as unknown as TemplateStringsArray;
+    Object.defineProperty(rawMessage, "raw", { value: rawMessage });
+
+    wrappedSink({
+      level: "info",
+      category: ["test"],
+      message: ["Password: ", "secret", ""],
+      rawMessage,
+      timestamp: Date.now(),
+      properties: { password: "secret" },
+    });
+
+    // Message should be redacted by value comparison
+    assertEquals(records[0].message[1], "[REDACTED]");
+    assertEquals(records[0].properties.password, "[REDACTED]");
+  }
+
+  { // array access path in message
+    const records: LogRecord[] = [];
+    const wrappedSink = redactByField((r) => records.push(r), {
+      fieldPatterns: ["password"],
+      action: () => "[REDACTED]",
+    });
+
+    wrappedSink({
+      level: "info",
+      category: ["test"],
+      message: ["First user password: ", "secret1", ""],
+      rawMessage: "First user password: {users[0].password}",
+      timestamp: Date.now(),
+      properties: { users: [{ password: "secret1" }] },
+    });
+
+    assertEquals(records[0].message[1], "[REDACTED]");
+  }
+
+  { // regex pattern matches in message placeholder
+    const records: LogRecord[] = [];
+    const wrappedSink = redactByField((r) => records.push(r), {
+      fieldPatterns: [/pass/i],
+      action: () => "[REDACTED]",
+    });
+
+    wrappedSink({
+      level: "info",
+      category: ["test"],
+      message: ["Passphrase: ", "mysecret", ""],
+      rawMessage: "Passphrase: {passphrase}",
+      timestamp: Date.now(),
+      properties: { passphrase: "mysecret" },
+    });
+
+    assertEquals(records[0].message[1], "[REDACTED]");
+  }
 });

package/src/field.ts

@@ -64,11 +64,17 @@ export interface FieldRedactionOptions {
 }
 
 /**
- * Redacts properties in a {@link LogRecord} based on the provided field
- * patterns and action.
+ * Redacts properties and message values in a {@link LogRecord} based on the
+ * provided field patterns and action.
  *
  * Note that it is a decorator which wraps the sink and redacts properties
- * before passing them to the sink.
+ * and message values before passing them to the sink.
+ *
+ * For string templates (e.g., `"Hello, {name}!"`), placeholder names are
+ * matched against the field patterns to determine which values to redact.
+ *
+ * For tagged template literals (e.g., `` `Hello, ${name}!` ``), redaction
+ * is performed by comparing message values with redacted property values.
  *
  * @example
  * ```ts
@@ -89,7 +95,39 @@ export function redactByField(
 ): Sink | Sink & Disposable | Sink & AsyncDisposable {
   const opts = Array.isArray(options) ? { fieldPatterns: options } : options;
   const wrapped = (record: LogRecord) => {
-    sink({ ...record, properties: redactProperties(record.properties, opts) });
+    const redactedProperties = redactProperties(record.properties, opts);
+    let redactedMessage = record.message;
+
+    if (typeof record.rawMessage === "string") {
+      // String template: redact by placeholder names
+      const placeholders = extractPlaceholderNames(record.rawMessage);
+      const redactedIndices = getRedactedPlaceholderIndices(
+        placeholders,
+        opts.fieldPatterns,
+      );
+      if (redactedIndices.size > 0) {
+        redactedMessage = redactMessageArray(
+          record.message,
+          redactedIndices,
+          opts.action,
+        );
+      }
+    } else {
+      // Tagged template: redact by comparing values
+      const redactedValues = getRedactedValues(
+        record.properties,
+        redactedProperties,
+      );
+      if (redactedValues.size > 0) {
+        redactedMessage = redactMessageByValues(record.message, redactedValues);
+      }
+    }
+
+    sink({
+      ...record,
+      message: redactedMessage,
+      properties: redactedProperties,
+    });
   };
   if (Symbol.dispose in sink) wrapped[Symbol.dispose] = sink[Symbol.dispose];
   if (Symbol.asyncDispose in sink) {
@@ -175,3 +213,200 @@ export function shouldFieldRedacted(
   }
   return false;
 }
+
+/**
+ * Extracts placeholder names from a message template string in order.
+ * @param template The message template string.
+ * @returns An array of placeholder names in the order they appear.
+ */
+function extractPlaceholderNames(template: string): string[] {
+  const placeholders: string[] = [];
+  for (let i = 0; i < template.length; i++) {
+    if (template[i] === "{") {
+      // Check for escaped brace
+      if (i + 1 < template.length && template[i + 1] === "{") {
+        i++;
+        continue;
+      }
+      const closeIndex = template.indexOf("}", i + 1);
+      if (closeIndex === -1) continue;
+      const key = template.slice(i + 1, closeIndex).trim();
+      placeholders.push(key);
+      i = closeIndex;
+    }
+  }
+  return placeholders;
+}
+
+/**
+ * Parses a property path into its segments.
+ * @param path The property path (e.g., "user.password" or "users[0].email").
+ * @returns An array of path segments.
+ */
+function parsePathSegments(path: string): string[] {
+  const segments: string[] = [];
+  let current = "";
+  for (const char of path) {
+    if (char === "." || char === "[") {
+      if (current) segments.push(current);
+      current = "";
+    } else if (char === "]" || char === "?") {
+      // Skip these characters
+    } else {
+      current += char;
+    }
+  }
+  if (current) segments.push(current);
+  return segments;
+}
+
+/**
+ * Determines which placeholder indices should be redacted based on field
+ * patterns.
+ * @param placeholders Array of placeholder names from the template.
+ * @param fieldPatterns Field patterns to match against.
+ * @returns Set of indices that should be redacted.
+ */
+function getRedactedPlaceholderIndices(
+  placeholders: string[],
+  fieldPatterns: FieldPatterns,
+): Set<number> {
+  const indices = new Set<number>();
+  for (let i = 0; i < placeholders.length; i++) {
+    const placeholder = placeholders[i];
+    // Skip wildcard {*}
+    if (placeholder === "*") continue;
+
+    // Check the full placeholder name
+    if (shouldFieldRedacted(placeholder, fieldPatterns)) {
+      indices.add(i);
+      continue;
+    }
+    // For nested paths, check each segment
+    const segments = parsePathSegments(placeholder);
+    for (const segment of segments) {
+      if (shouldFieldRedacted(segment, fieldPatterns)) {
+        indices.add(i);
+        break;
+      }
+    }
+  }
+  return indices;
+}
+
+/**
+ * Redacts values in the message array based on the redacted placeholder
+ * indices.
+ * @param message The original message array.
+ * @param redactedIndices Set of placeholder indices to redact.
+ * @param action The redaction action.
+ * @returns New message array with redacted values.
+ */
+function redactMessageArray(
+  message: readonly unknown[],
+  redactedIndices: Set<number>,
+  action: "delete" | ((value: unknown) => unknown) | undefined,
+): readonly unknown[] {
+  if (redactedIndices.size === 0) return message;
+
+  const result: unknown[] = [];
+  let placeholderIndex = 0;
+
+  for (let i = 0; i < message.length; i++) {
+    if (i % 2 === 0) {
+      // Even index: text segment
+      result.push(message[i]);
+    } else {
+      // Odd index: value/placeholder
+      if (redactedIndices.has(placeholderIndex)) {
+        if (action == null || action === "delete") {
+          result.push("");
+        } else {
+          result.push(action(message[i]));
+        }
+      } else {
+        result.push(message[i]);
+      }
+      placeholderIndex++;
+    }
+  }
+  return result;
+}
+
+/**
+ * Collects redacted value mappings from original to redacted properties.
+ * @param original The original properties.
+ * @param redacted The redacted properties.
+ * @param map The map to populate with original -> redacted value pairs.
+ */
+function collectRedactedValues(
+  original: Record<string, unknown>,
+  redacted: Record<string, unknown>,
+  map: Map<unknown, unknown>,
+): void {
+  for (const key in original) {
+    const origVal = original[key];
+    const redVal = redacted[key];
+
+    if (origVal !== redVal) {
+      map.set(origVal, redVal);
+    }
+
+    // Recurse into nested objects
+    if (
+      typeof origVal === "object" && origVal !== null &&
+      typeof redVal === "object" && redVal !== null &&
+      !Array.isArray(origVal)
+    ) {
+      collectRedactedValues(
+        origVal as Record<string, unknown>,
+        redVal as Record<string, unknown>,
+        map,
+      );
+    }
+  }
+}
+
+/**
+ * Gets a map of original values to their redacted replacements.
+ * @param original The original properties.
+ * @param redacted The redacted properties.
+ * @returns A map of original -> redacted values.
+ */
+function getRedactedValues(
+  original: Record<string, unknown>,
+  redacted: Record<string, unknown>,
+): Map<unknown, unknown> {
+  const map = new Map<unknown, unknown>();
+  collectRedactedValues(original, redacted, map);
+  return map;
+}
+
+/**
+ * Redacts message array values by comparing with redacted property values.
+ * Used for tagged template literals where placeholder names are not available.
+ * @param message The original message array.
+ * @param redactedValues Map of original -> redacted values.
+ * @returns New message array with redacted values.
+ */
+function redactMessageByValues(
+  message: readonly unknown[],
+  redactedValues: Map<unknown, unknown>,
+): readonly unknown[] {
+  if (redactedValues.size === 0) return message;
+
+  const result: unknown[] = [];
+  for (let i = 0; i < message.length; i++) {
+    if (i % 2 === 0) {
+      result.push(message[i]);
+    } else {
+      const val = message[i];
+      if (redactedValues.has(val)) {
+        result.push(redactedValues.get(val));
+      } else {
+        result.push(val);
+      }
+    }
+  }
+  return result;
+}