@mossbear/eval-core 0.1.0-alpha.100

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Mossbear
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,9 @@
+# @mossbear/eval-core
+
+Portable pieces of Mossbear's evaluation path — command redaction, the `EvalAdapter` LLM seam, and on-demand guide normalization. Grading itself runs on the [Mossbear](https://app.mossbear.io) dashboard; this package holds the parts that must stay importable outside it.
+
+`sanitizeCommand` is used by the [`mossbear` CLI](https://www.npmjs.com/package/mossbear) to redact shell command text before an action is ever recorded; the adapter and normalization prompt are used server-side.
+
+You normally don't install this directly; it ships as a dependency of `mossbear`.
+
+Source: https://github.com/mossbear-io/mossbear (`packages/eval-core`)

package/dist/adapter.d.ts

@@ -0,0 +1,31 @@
+/**
+ * The LLM completion seam.
+ *
+ * eval-core never imports fetch or any HTTP library directly — a caller
+ * supplies the transport and this package stays dependency-free and testable.
+ * The dashboard implements it in `src/lib/eval/serverEvalAdapter.ts`; tests
+ * pass mocks.
+ */
+/** Token counts for one completion call, when an adapter can report them. */
+export type EvalUsage = {
+    inputTokens: number;
+    outputTokens: number;
+    cacheReadTokens?: number;
+    cacheWriteTokens?: number;
+};
+/** Adapter interface for LLM completion. */
+export interface EvalAdapter {
+    complete(system: string, user: string): Promise<string>;
+    /**
+     * Optional: adapters that can report token usage alongside a completion's
+     * text implement this instead of (or in addition to) `complete`. Callers
+     * that care about usage/cost attribution
+     * call this when present; an adapter without it is still a valid
+     * `EvalAdapter`.
+     */
+    completeWithUsage?(system: string, user: string): Promise<{
+        text: string;
+        usage: EvalUsage | null;
+    }>;
+}
+//# sourceMappingURL=adapter.d.ts.map

package/dist/adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,6EAA6E;AAC7E,MAAM,MAAM,SAAS,GAAG;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B,CAAA;AAED,4CAA4C;AAC5C,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACvD;;;;;;OAMG;IACH,iBAAiB,CAAC,CAChB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,SAAS,GAAG,IAAI,CAAA;KAAE,CAAC,CAAA;CACtD"}

package/dist/adapter.js

@@ -0,0 +1,10 @@
+/**
+ * The LLM completion seam.
+ *
+ * eval-core never imports fetch or any HTTP library directly — a caller
+ * supplies the transport and this package stays dependency-free and testable.
+ * The dashboard implements it in `src/lib/eval/serverEvalAdapter.ts`; tests
+ * pass mocks.
+ */
+export {};
+//# sourceMappingURL=adapter.js.map

package/dist/adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter.js","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG"}

package/dist/credential-patterns.d.ts

@@ -0,0 +1,9 @@
+/** Syntax shared by the command and prose credential scanners. */
+export declare const SENSITIVE_WORD_SOURCE = "(?:api[_-]?key|access[_-]?key|secret[_-]?key|private[_-]?key|client[_-]?secret|authorization|token|secret|passw(?:or)?d|credentials?)";
+export declare const SENSITIVE_KEY_SOURCE = "[\\w.-]*(?:api[_-]?key|access[_-]?key|secret[_-]?key|private[_-]?key|client[_-]?secret|authorization|token|secret|passw(?:or)?d|credentials?)[\\w.-]*";
+export declare const SHELL_WORD_SOURCE: string;
+/** Whole segments in prose, avoiding ordinary words such as secretary. */
+export declare const PROSE_SENSITIVE_KEY_SOURCE = "(?:[A-Za-z0-9]+[._-])*(?:api[_-]?key|access[_-]?key|secret[_-]?key|private[_-]?key|client[_-]?secret|authorization|token|secret|passw(?:or)?d|credentials?)(?:[._-][A-Za-z0-9]+)*";
+/** Cookie pairs, bounded by header quoting or the next prose/shell word. */
+export declare const COOKIE_HEADER_SOURCE: string;
+//# sourceMappingURL=credential-patterns.d.ts.map

package/dist/credential-patterns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-patterns.d.ts","sourceRoot":"","sources":["../src/credential-patterns.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,eAAO,MAAM,qBAAqB,0IACuG,CAAA;AACzI,eAAO,MAAM,oBAAoB,0JAA6C,CAAA;AAC9E,eAAO,MAAM,iBAAiB,QAAgG,CAAA;AAE9H,0EAA0E;AAC1E,eAAO,MAAM,0BAA0B,sLAAyE,CAAA;AAEhH,4EAA4E;AAC5E,eAAO,MAAM,oBAAoB,QAAuN,CAAA"}

package/dist/credential-patterns.js

@@ -0,0 +1,9 @@
+/** Syntax shared by the command and prose credential scanners. */
+export const SENSITIVE_WORD_SOURCE = '(?:api[_-]?key|access[_-]?key|secret[_-]?key|private[_-]?key|client[_-]?secret|authorization|token|secret|passw(?:or)?d|credentials?)';
+export const SENSITIVE_KEY_SOURCE = `[\\w.-]*${SENSITIVE_WORD_SOURCE}[\\w.-]*`;
+export const SHELL_WORD_SOURCE = String.raw `(?:\$'(?:\\[\s\S]|[^'\\])*'|'[^']*'|"(?:\\.|[^"\\])*"|\\[\s\S]|[^\s;&|()<>'"\\])+`;
+/** Whole segments in prose, avoiding ordinary words such as secretary. */
+export const PROSE_SENSITIVE_KEY_SOURCE = `(?:[A-Za-z0-9]+[._-])*${SENSITIVE_WORD_SOURCE}(?:[._-][A-Za-z0-9]+)*`;
+/** Cookie pairs, bounded by header quoting or the next prose/shell word. */
+export const COOKIE_HEADER_SOURCE = String.raw `\b((?:set-cookie|cookie)[ \t]*:[ \t]*)(?:[\w.!#$%&*+^\x60|~-]+[ \t]*=[ \t]*(?:"(?:\\.|[^"\\\r\n])*"|[^\s;"',]*))(?:[ \t]*;[ \t]*[\w.!#$%&*+^\x60|~-]+[ \t]*=[ \t]*(?:"(?:\\.|[^"\\\r\n])*"|[^\s;"',]*))*`;
+//# sourceMappingURL=credential-patterns.js.map

package/dist/credential-patterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-patterns.js","sourceRoot":"","sources":["../src/credential-patterns.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,MAAM,CAAC,MAAM,qBAAqB,GAChC,uIAAuI,CAAA;AACzI,MAAM,CAAC,MAAM,oBAAoB,GAAG,WAAW,qBAAqB,UAAU,CAAA;AAC9E,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,GAAG,CAAA,mFAAmF,CAAA;AAE9H,0EAA0E;AAC1E,MAAM,CAAC,MAAM,0BAA0B,GAAG,yBAAyB,qBAAqB,wBAAwB,CAAA;AAEhH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,GAAG,CAAA,0MAA0M,CAAA"}

package/dist/index.d.ts

@@ -0,0 +1,12 @@
+/**
+ * @mossbear/eval-core
+ *
+ * Pure evaluation logic with no filesystem, network, or secret-loading side effects.
+ * This package must remain importable outside the CLI package.
+ */
+export { type EvalAdapter, type EvalUsage } from './adapter.js';
+export { sanitizeCommand } from './sanitize-command.js';
+export { stripCodeBlocks, type CodeBlockStripResult } from './strip-code-blocks.js';
+export { STEERING_LABELS, STEERING_CLASSIFIER_VERSION, classifySteeringTurn, classifySteeringTurnV1, scoreSteeringBaseline, type SteeringBaselineScore, type SteeringLabel, } from './steering-classification.js';
+export { MAX_PROSE_CHARS, PROSE_REDACTION_CLASSES, redactProse, type ProseRedactionClass, type ProseRedactionReport, } from './redact-prose.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,KAAK,WAAW,EAAE,KAAK,SAAS,EAAE,MAAM,cAAc,CAAA;AAE/D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAEvD,OAAO,EAAE,eAAe,EAAE,KAAK,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAEnF,OAAO,EACL,eAAe,EACf,2BAA2B,EAC3B,oBAAoB,EACpB,sBAAsB,EACtB,qBAAqB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,aAAa,GACnB,MAAM,8BAA8B,CAAA;AAErC,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,WAAW,EACX,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,mBAAmB,CAAA"}

package/dist/index.js

@@ -0,0 +1,11 @@
+/**
+ * @mossbear/eval-core
+ *
+ * Pure evaluation logic with no filesystem, network, or secret-loading side effects.
+ * This package must remain importable outside the CLI package.
+ */
+export { sanitizeCommand } from './sanitize-command.js';
+export { stripCodeBlocks } from './strip-code-blocks.js';
+export { STEERING_LABELS, STEERING_CLASSIFIER_VERSION, classifySteeringTurn, classifySteeringTurnV1, scoreSteeringBaseline, } from './steering-classification.js';
+export { MAX_PROSE_CHARS, PROSE_REDACTION_CLASSES, redactProse, } from './redact-prose.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAEvD,OAAO,EAAE,eAAe,EAA6B,MAAM,wBAAwB,CAAA;AAEnF,OAAO,EACL,eAAe,EACf,2BAA2B,EAC3B,oBAAoB,EACpB,sBAAsB,EACtB,qBAAqB,GAGtB,MAAM,8BAA8B,CAAA;AAErC,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,WAAW,GAGZ,MAAM,mBAAmB,CAAA"}

package/dist/redact-prose.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Secret redaction and length-capping for **prose** — transcript message text,
+ * as opposed to the shell command text `sanitizeCommand` handles.
+ *
+ * Why a second redactor rather than reusing the first: `sanitizeCommand` is
+ * pattern-matched against *shell syntax* — heredocs, `KEY=value` anchored at a
+ * shell token boundary, `Authorization:` headers
+ * (`./sanitize-command.ts:31-49`). `transcript-content-classes-plan.md:20`
+ * records that it "catches none of it in prose" and names a prose redactor the
+ * load-bearing deliverable rather than a checkbox on one. This is that gate.
+ *
+ * It lives here beside `sanitizeCommand`, and not in the CLI, because the plan
+ * asks for exactly that (`transcript-content-classes-plan.md:43`): shared, so
+ * the CLI and any future server-side path cannot drift into different
+ * strengths of the same protection.
+ *
+ * **What this is not.** This is the redactor and nothing else: it does not
+ * extract transcript messages and does not strip code blocks. It is no longer
+ * true, as this header said through Slice 1, that "no caller uploads its
+ * output" — transcript narration ships, and `redactProse` runs on it
+ * (`../../cli/src/transcript/narration.ts:133`) before it is attached to an
+ * action at the `action-queue.ts` choke point and uploaded by `mossbear sync`.
+ * This function is now the last thing between prose and the wire, which is why
+ * a gap in the pattern list below is a live disclosure rather than a latent
+ * one. Two consequences of that are worth saying out loud rather than
+ * assuming:
+ *
+ *   - **Code-block stripping is structural and happens before this runs.**
+ *     Fenced and indented blocks come out by the Markdown structure of the
+ *     message (Slice 2). A regex over prose must never be what stands between
+ *     a code block and the wire, so nothing here attempts it.
+ *   - **Redaction is best-effort; the length cap is the backstop.** The same
+ *     admission `sanitizeCommand` makes (`./sanitize-command.ts:26-29`). A
+ *     pattern list cannot enumerate every
+ *     secret shape, which is exactly why the class table strips whole classes
+ *     rather than trusting a scrubber to find secrets inside them.
+ *
+ * Reports **what it redacted, by class and count**, so a disclosure surface can
+ * show the user what was removed rather than asserting safety at them.
+ */
+/**
+ * Maximum characters of a single prose message that survive redaction.
+ *
+ * Deliberately far larger than `sanitizeCommand`'s 200
+ * (`./sanitize-command.ts:20`): a command is a tool
+ * invocation, where anything long is bulk payload, whereas prose is the
+ * content — "I'm going to X because Y" is the whole reason this class syncs at
+ * all, and truncating it to a couple of sentences would leave the grader with
+ * the same intent-free evidence it has today. Long enough for a real
+ * explanation, short enough that a pasted file body cannot ride along whole.
+ */
+export declare const MAX_PROSE_CHARS = 2000;
+/**
+ * The classes this reports on. Named rather than free-form strings so a
+ * disclosure surface can label each count without re-deriving the taxonomy —
+ * and so adding a pattern forces a decision about which class it belongs to.
+ */
+export declare const PROSE_REDACTION_CLASSES: readonly ["private_key", "url_credentials", "assignment", "token", "email", "long_random_string"];
+export type ProseRedactionClass = (typeof PROSE_REDACTION_CLASSES)[number];
+export type ProseRedactionReport = {
+    /** The redacted text, length-capped. */
+    text: string;
+    /** How many spans were replaced, per class. Absent classes redacted nothing. */
+    counts: Partial<Record<ProseRedactionClass, number>>;
+    /** Total spans replaced across all classes. */
+    redactedCount: number;
+    /** The text hit `MAX_PROSE_CHARS` and lost its tail. */
+    wasTruncated: boolean;
+};
+/**
+ * Redact secrets from prose and cap its length, reporting what was removed.
+ *
+ * Runs on-device, before upload, always — the server never receives the
+ * unredacted form and therefore cannot leak it.
+ */
+export declare function redactProse(input: string | null | undefined): ProseRedactionReport;
+//# sourceMappingURL=redact-prose.d.ts.map

package/dist/redact-prose.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact-prose.d.ts","sourceRoot":"","sources":["../src/redact-prose.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAUH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,eAAe,OAAO,CAAA;AAwBnC;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,mGAO1B,CAAA;AAEV,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAA;AAE1E,MAAM,MAAM,oBAAoB,GAAG;IACjC,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAA;IACZ,gFAAgF;IAChF,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,CAAA;IACpD,+CAA+C;IAC/C,aAAa,EAAE,MAAM,CAAA;IACrB,wDAAwD;IACxD,YAAY,EAAE,OAAO,CAAA;CACtB,CAAA;AA8ID;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,oBAAoB,CAgIlF"}

package/dist/redact-prose.js

@@ -0,0 +1,339 @@
+/**
+ * Secret redaction and length-capping for **prose** — transcript message text,
+ * as opposed to the shell command text `sanitizeCommand` handles.
+ *
+ * Why a second redactor rather than reusing the first: `sanitizeCommand` is
+ * pattern-matched against *shell syntax* — heredocs, `KEY=value` anchored at a
+ * shell token boundary, `Authorization:` headers
+ * (`./sanitize-command.ts:31-49`). `transcript-content-classes-plan.md:20`
+ * records that it "catches none of it in prose" and names a prose redactor the
+ * load-bearing deliverable rather than a checkbox on one. This is that gate.
+ *
+ * It lives here beside `sanitizeCommand`, and not in the CLI, because the plan
+ * asks for exactly that (`transcript-content-classes-plan.md:43`): shared, so
+ * the CLI and any future server-side path cannot drift into different
+ * strengths of the same protection.
+ *
+ * **What this is not.** This is the redactor and nothing else: it does not
+ * extract transcript messages and does not strip code blocks. It is no longer
+ * true, as this header said through Slice 1, that "no caller uploads its
+ * output" — transcript narration ships, and `redactProse` runs on it
+ * (`../../cli/src/transcript/narration.ts:133`) before it is attached to an
+ * action at the `action-queue.ts` choke point and uploaded by `mossbear sync`.
+ * This function is now the last thing between prose and the wire, which is why
+ * a gap in the pattern list below is a live disclosure rather than a latent
+ * one. Two consequences of that are worth saying out loud rather than
+ * assuming:
+ *
+ *   - **Code-block stripping is structural and happens before this runs.**
+ *     Fenced and indented blocks come out by the Markdown structure of the
+ *     message (Slice 2). A regex over prose must never be what stands between
+ *     a code block and the wire, so nothing here attempts it.
+ *   - **Redaction is best-effort; the length cap is the backstop.** The same
+ *     admission `sanitizeCommand` makes (`./sanitize-command.ts:26-29`). A
+ *     pattern list cannot enumerate every
+ *     secret shape, which is exactly why the class table strips whole classes
+ *     rather than trusting a scrubber to find secrets inside them.
+ *
+ * Reports **what it redacted, by class and count**, so a disclosure surface can
+ * show the user what was removed rather than asserting safety at them.
+ */
+import { COOKIE_HEADER_SOURCE, PROSE_SENSITIVE_KEY_SOURCE, SENSITIVE_KEY_SOURCE, SHELL_WORD_SOURCE, } from './credential-patterns.js';
+import { PRIVATE_KEY_BLOCK_SOURCE, REDACTED } from './redaction.js';
+/**
+ * Maximum characters of a single prose message that survive redaction.
+ *
+ * Deliberately far larger than `sanitizeCommand`'s 200
+ * (`./sanitize-command.ts:20`): a command is a tool
+ * invocation, where anything long is bulk payload, whereas prose is the
+ * content — "I'm going to X because Y" is the whole reason this class syncs at
+ * all, and truncating it to a couple of sentences would leave the grader with
+ * the same intent-free evidence it has today. Long enough for a real
+ * explanation, short enough that a pasted file body cannot ride along whole.
+ */
+export const MAX_PROSE_CHARS = 2000;
+/**
+ * Characters actually scanned by the patterns below.
+ *
+ * The cap on the *output* is not a bound on the *work*: without this, every
+ * pattern scans an arbitrarily long untrusted message before a single
+ * character is discarded, and the assignment matcher backtracks badly on
+ * adversarial input (a long run of `SECRET` with no `=` after it). A pasted
+ * megabyte could then stall CLI sync to produce 2,000 characters.
+ *
+ * Generous rather than equal to `MAX_PROSE_CHARS` because redaction *shrinks*
+ * text — a secret replaced by `[redacted]` pulls later content into the
+ * surviving window — so the scan has to see more than it will keep. Anything
+ * past this is dropped before scanning and counts as truncation.
+ */
+const MAX_SCAN_CHARS = MAX_PROSE_CHARS * 8;
+const QUOTED_VALUE_SOURCE = String.raw `(?:"(?:[^"\\]|\\[\s\S])*(?:"|$)|'(?:[^'\\]|\\[\s\S])*(?:'|$))`;
+// Python concatenates adjacent quoted literals. Do not consume a following
+// YAML key as another fragment of the value.
+const MAPPING_VALUE_SOURCE = String.raw `${QUOTED_VALUE_SOURCE}(?:\s*${QUOTED_VALUE_SOURCE}(?!\s*:))*|[^,}\s]+`;
+const QUOTED_COMMAND_WORD_SOURCE = String.raw `(?:\$'(?:[^'\\]|\\[\s\S])*(?:'|$)(?:${SHELL_WORD_SOURCE})?|${SHELL_WORD_SOURCE})`;
+/**
+ * The classes this reports on. Named rather than free-form strings so a
+ * disclosure surface can label each count without re-deriving the taxonomy —
+ * and so adding a pattern forces a decision about which class it belongs to.
+ */
+export const PROSE_REDACTION_CLASSES = [
+    'private_key',
+    'url_credentials',
+    'assignment',
+    'token',
+    'email',
+    'long_random_string',
+];
+/**
+ * Ordered redactions. Order matters the same way it does in `sanitizeCommand`:
+ * the widest structural shapes run first, so a token *inside* a PEM block or a
+ * URL is already gone before the narrower patterns scan for it.
+ */
+const PROSE_REDACTIONS = [
+    // Whole private-key blocks, including an unterminated one — a truncated key
+    // is still a key. First, because everything else would otherwise match the
+    // base64 inside it.
+    ['private_key', new RegExp(PRIVATE_KEY_BLOCK_SOURCE, 'g'), REDACTED],
+    // `Authorization: Bearer <token>` / `Basic <blob>`, as pasted from a request
+    // or a curl transcript. These values are routinely short-lived and short —
+    // too short for the prefix and long-run rules below — and `Authorization` is
+    // a header name rather than a sensitive assignment key, so without this rule
+    // a pasted header uploads a live credential verbatim. `sanitizeCommand`
+    // carries the same pattern for command text (`./sanitize-command.ts:45`).
+    [
+        'token',
+        /\b(authorization\s*:\s*)(?:bearer\s+|basic\s+|token\s+)?\S+/gi,
+        `$1${REDACTED}`,
+    ],
+    ['token', new RegExp(COOKIE_HEADER_SOURCE, 'gi'), `$1${REDACTED}`],
+    [
+        'assignment',
+        new RegExp(String.raw `("${SENSITIVE_KEY_SOURCE}"\s*:\s*)(?:${MAPPING_VALUE_SOURCE})`, 'gi'),
+        `$1"${REDACTED}"`,
+    ],
+    // Quoted keys in Python/YAML mappings carry the same secrets as JSON.
+    [
+        'assignment',
+        new RegExp(String.raw `('${SENSITIVE_KEY_SOURCE}'\s*:\s*)(?:${MAPPING_VALUE_SOURCE})`, 'gi'),
+        `$1${REDACTED}`,
+    ],
+    // URL userinfo. Both shapes: `scheme://user:secret@host` and the
+    // token-as-sole-userinfo form `scheme://token@host`, which a colon-requiring
+    // pattern misses entirely and which no other rule here catches when the token
+    // is short. The host always stays — "it failed against api.example.com" is
+    // the part worth grading.
+    [
+        'url_credentials',
+        /\b([a-z][a-z0-9+.-]*:\/\/)[^/\s:@]+(?::[^@\s]*)?@/gi,
+        `$1${REDACTED}@`,
+    ],
+    // A sensitive key followed by `=` or `:` and a value. Unlike the command
+    // version this is *not* anchored at a shell-token boundary — in prose the
+    // pair is embedded in a sentence ("I set OPENAI_API_KEY=sk-… and reran"), so
+    // anchoring on shell syntax is precisely what misses it.
+    //
+    // The sensitive word must be a **whole `_`/`-` separated segment** of the
+    // key, not a substring of it. As an arbitrary substring, `SECRET` matches
+    // `secretary` and `TOKEN` matches `tokenization`, so ordinary prose like
+    // "secretary: Alice" lost its value — and prose scrubbed into nonsense is
+    // useless to a grader and alarming to a reader, which makes over-redaction a
+    // defect here rather than a safe default.
+    //
+    // The quoted-value arms consume escape sequences (`\\.`) rather than stopping
+    // at the first inner quote: a value like `"correct horse \\"battery staple"`
+    // otherwise terminates early and leaves the tail of the password in place.
+    [
+        'assignment',
+        new RegExp(String.raw `\b(${PROSE_SENSITIVE_KEY_SOURCE})(\s*[=:]\s*)(?:\$'(?:[^'\\]|\\[\s\S])*(?:'|$)(?:${SHELL_WORD_SOURCE})?|(?:"(?:[^"\\]|\\[\s\S])*(?:"|$)|'(?:[^'\\]|\\[\s\S])*(?:'|$))(?:[^\s"']+|"(?:[^"\\]|\\[\s\S])*(?:"|$)|'(?:[^'\\]|\\[\s\S])*(?:'|$))*|[^\s]+)`, 'gi'),
+        `$1$2${REDACTED}`,
+    ],
+    // Well-known bare token shapes, by their published prefixes. Prefix-anchored
+    // rather than entropy-guessed, so an ordinary long word is never mistaken for
+    // a credential.
+    //
+    // **Our own CLI token leads the list** (`API_KEY_PREFIX`, the prefix the
+    // dashboard mints CLI tokens under), for the same reason `sanitizeCommand`
+    // carries it (`./sanitize-command.ts:59-68`): the product's
+    // own secret shape is the one most likely to appear. In prose the `assignment`
+    // rule above only catches the pair form — `token: mossbear_…` — while the
+    // sentence form a user actually writes ("I set my token to mossbear_… and it
+    // worked") and a bare mention have no `key=value` to anchor on. The
+    // `long_random_string` backstop does not reach them either: a `mossbear_` key
+    // is under its 40-character floor. Without this arm, a user who mentions
+    // their token in a Claude Code message uploads a live dashboard credential in
+    // plaintext. Any future re-mint under a new prefix has to be added here in the
+    // same change, and to `sanitizeCommand` — a token neither redactor matches is
+    // one that ships verbatim.
+    //
+    // `auden_` is the pre-rename prefix. Every key issued under it is deleted by
+    // migration `0056-revoke_legacy_prefix_cli_tokens.ts`, so it matches nothing
+    // that can still authenticate; it is kept because a CLI redacting on the
+    // user's machine can be older than the dashboard it syncs to, and that window
+    // is exactly the one where dropping the rule uploads a live key.
+    //
+    // The `{8,}` floor matches `sanitizeCommand`'s, deliberately: the two
+    // redactors guard the same secret against the same upload, and a prose-side
+    // floor set higher would be a difference in strength with nothing behind it.
+    [
+        'token',
+        /\b(?:mossbear_[A-Za-z0-9_-]{8,}|auden_[A-Za-z0-9_-]{8,}|sk-[A-Za-z0-9_-]{16,}|ghp_[A-Za-z0-9]{20,}|gho_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|xox[abposr]-[A-Za-z0-9-]{10,}|AKIA[0-9A-Z]{16}|AIza[A-Za-z0-9_-]{20,})/g,
+        REDACTED,
+    ],
+    // Quoted command values in narration must be consumed as complete shell
+    // words. A bare word after a flag may be prose ("--token to authenticate").
+    [
+        'assignment',
+        new RegExp(String.raw `(--${PROSE_SENSITIVE_KEY_SOURCE}\s+)(?=\$?["'])${QUOTED_COMMAND_WORD_SOURCE}`, 'gi'),
+        `$1${REDACTED}`,
+    ],
+    // Email addresses, listed among the plan's targets
+    // (`transcript-content-classes-plan.md:43`).
+    ['email', /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g, REDACTED],
+    // Long unbroken base64/hex runs: a credential shape this list has no prefix
+    // for. Runs last, so anything a named pattern would have caught is gone.
+    //
+    // Two constraints keep it from eating ordinary text, and both are load-bearing:
+    //
+    //   - **Delimiter lookarounds, not `\b`.** `+` and `/` are in the base64
+    //     alphabet but are not word characters, so a blob beginning with one has
+    //     no word boundary to match at — `\b` would start a character late and
+    //     leave a 40-character secret one short of the floor, passing it through
+    //     whole.
+    //   - **It must contain a digit.** Length alone is not a random-string
+    //     signal: `createAuthenticatedDashboardRequestContext` is 42 characters
+    //     of ordinary identifier, and redacting it removes the exact detail a
+    //     grader needs. Digests, ids and encoded blobs carry digits; long
+    //     camel-case names do not. An all-alphabetic secret is the accepted
+    //     miss, and it is what the named patterns above and the cap exist for.
+    [
+        'long_random_string',
+        /(?<![A-Za-z0-9+/=_-])(?=[A-Za-z0-9+/_-]*\d)[A-Za-z0-9+/_-]{40,}={0,2}(?![A-Za-z0-9+/=_-])/g,
+        REDACTED,
+    ],
+];
+/**
+ * Redact secrets from prose and cap its length, reporting what was removed.
+ *
+ * Runs on-device, before upload, always — the server never receives the
+ * unredacted form and therefore cannot leak it.
+ */
+export function redactProse(input) {
+    if (typeof input !== 'string' || input === '') {
+        return { text: '', counts: {}, redactedCount: 0, wasTruncated: false };
+    }
+    // Bounded before any pattern runs — see `MAX_SCAN_CHARS`.
+    const wasScanTruncated = input.length > MAX_SCAN_CHARS;
+    let text = wasScanTruncated ? input.slice(0, MAX_SCAN_CHARS) : input;
+    // Decode only credential key spellings. JSON escapes must not disguise a
+    // sensitive key, while unrelated prose retains its original spelling.
+    const sensitiveKey = new RegExp(`^${SENSITIVE_KEY_SOURCE}$`, 'i');
+    text = text.replace(/("(?:[^"\\]|\\.)*")(\s*:)/g, (match, key, separator) => {
+        try {
+            const decoded = JSON.parse(key);
+            return typeof decoded === 'string' && sensitiveKey.test(decoded)
+                ? `${JSON.stringify(decoded)}${separator}`
+                : match;
+        }
+        catch {
+            return match;
+        }
+    });
+    const counts = {};
+    let redactedCount = 0;
+    const recordAssignment = () => {
+        counts.assignment = (counts.assignment ?? 0) + 1;
+        redactedCount += 1;
+    };
+    // A YAML block scalar's value is the indented lines after its marker.
+    // Redacting only `|` or `>` leaves the complete credential behind.
+    const lines = text.split('\n');
+    const scalarKey = new RegExp(String.raw `^([ \t]*)(-[ \t]+)?(["']?${SENSITIVE_KEY_SOURCE}["']?[ \t]*:[ \t]*)[|>](?:[+-][1-9]?|[1-9][+-]?)?[ \t]*(?:#[^\r]*)?\r?$`, 'i');
+    for (let index = 0; index < lines.length; index += 1) {
+        const match = scalarKey.exec(lines[index]);
+        if (!match)
+            continue;
+        const mappingIndent = match[1].length + (match[2]?.length ?? 0);
+        let end = index + 1;
+        while (end < lines.length) {
+            const line = lines[end];
+            if (line.trim() && /^[ \t]*/.exec(line)[0].length <= mappingIndent)
+                break;
+            end += 1;
+        }
+        // These credential names are valid plain YAML keys. Removing their quotes
+        // prevents the later JSON-key rule from treating sibling YAML as a value.
+        const keyPrefix = match[3].replace(/^["']|["'](?=[ \t]*:)/g, '');
+        lines.splice(index, end - index, `${match[1]}${match[2] ?? ''}${keyPrefix}${REDACTED}`);
+        recordAssignment();
+    }
+    text = lines.join('\n');
+    // JSON strings can contain another serialized object. Scan quoted tokens
+    // structurally before the flat pair patterns, with a bounded recursion.
+    const redactEncoded = (value, depth) => {
+        if (depth > 20) {
+            recordAssignment();
+            return REDACTED;
+        }
+        if (typeof value === 'string' && /^\s*[[{]/.test(value)) {
+            try {
+                const parsed = JSON.parse(value);
+                const redacted = redactEncoded(parsed, depth + 1);
+                return JSON.stringify(redacted) === JSON.stringify(parsed)
+                    ? value
+                    : JSON.stringify(redacted);
+            }
+            catch {
+                return sensitiveKey.test(value) ? REDACTED : value;
+            }
+        }
+        if (Array.isArray(value))
+            return value.map((item) => redactEncoded(item, depth + 1));
+        if (value === null || typeof value !== 'object')
+            return value;
+        return Object.fromEntries(Object.entries(value).map(([key, item]) => {
+            if (sensitiveKey.test(key)) {
+                recordAssignment();
+                return [key, REDACTED];
+            }
+            return [key, redactEncoded(item, depth + 1)];
+        }));
+    };
+    text = text.replace(/"(?:[^"\\]|\\[\s\S])*(?:"|$)/g, (token) => {
+        try {
+            const value = JSON.parse(token);
+            const redacted = redactEncoded(value, 0);
+            return redacted === value ? token : JSON.stringify(redacted);
+        }
+        catch {
+            return token;
+        }
+    });
+    for (const [redactionClass, pattern, replacement] of PROSE_REDACTIONS) {
+        // Counted before replacing, and against a fresh regex, so the shared
+        // literal's `lastIndex` cannot carry between calls — a stateful `g` regex
+        // silently skipping the first match of the next message is exactly the
+        // failure a redactor must not have.
+        const counter = new RegExp(pattern.source, pattern.flags);
+        const matches = text.match(counter);
+        if (!matches || matches.length === 0)
+            continue;
+        // Structural passes leave redaction markers behind. Re-matching one is
+        // not a second replacement of the credential that produced it.
+        const single = new RegExp(pattern.source, pattern.flags.replace('g', ''));
+        const changed = matches.filter((match) => match.replace(single, replacement) !== match).length;
+        if (changed === 0)
+            continue;
+        counts[redactionClass] = (counts[redactionClass] ?? 0) + changed;
+        redactedCount += changed;
+        text = text.replace(new RegExp(pattern.source, pattern.flags), replacement);
+    }
+    const wasTruncated = wasScanTruncated || text.length > MAX_PROSE_CHARS;
+    if (text.length > MAX_PROSE_CHARS) {
+        // Marked rather than silently cut, so a reader can tell a short message
+        // from a long one that lost its tail.
+        text = `${text.slice(0, MAX_PROSE_CHARS)}… [truncated]`;
+    }
+    return { text, counts, redactedCount, wasTruncated };
+}
+//# sourceMappingURL=redact-prose.js.map

package/dist/redact-prose.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact-prose.js","sourceRoot":"","sources":["../src/redact-prose.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,wBAAwB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAEnE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAA;AAEnC;;;;;;;;;;;;;GAaG;AACH,MAAM,cAAc,GAAG,eAAe,GAAG,CAAC,CAAA;AAE1C,MAAM,mBAAmB,GAAG,MAAM,CAAC,GAAG,CAAA,+DAA+D,CAAA;AACrG,2EAA2E;AAC3E,6CAA6C;AAC7C,MAAM,oBAAoB,GAAG,MAAM,CAAC,GAAG,CAAA,GAAG,mBAAmB,SAAS,mBAAmB,qBAAqB,CAAA;AAC9G,MAAM,0BAA0B,GAAG,MAAM,CAAC,GAAG,CAAA,uCAAuC,iBAAiB,MAAM,iBAAiB,GAAG,CAAA;AAE/H;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,aAAa;IACb,iBAAiB;IACjB,YAAY;IACZ,OAAO;IACP,OAAO;IACP,oBAAoB;CACZ,CAAA;AAeV;;;;GAIG;AACH,MAAM,gBAAgB,GAAqD;IACzE,4EAA4E;IAC5E,2EAA2E;IAC3E,oBAAoB;IACpB,CAAC,aAAa,EAAE,IAAI,MAAM,CAAC,wBAAwB,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC;IACpE,6EAA6E;IAC7E,2EAA2E;IAC3E,6EAA6E;IAC7E,6EAA6E;IAC7E,wEAAwE;IACxE,0EAA0E;IAC1E;QACE,OAAO;QACP,+DAA+D;QAC/D,KAAK,QAAQ,EAAE;KAChB;IACD,CAAC,OAAO,EAAE,IAAI,MAAM,CAAC,oBAAoB,EAAE,IAAI,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;IAClE;QACE,YAAY;QACZ,IAAI,MAAM,CACR,MAAM,CAAC,GAAG,CAAA,KAAK,oBAAoB,eAAe,oBAAoB,GAAG,EACzE,IAAI,CACL;QACD,MAAM,QAAQ,GAAG;KAClB;IACD,sEAAsE;IACtE;QACE,YAAY;QACZ,IAAI,MAAM,CACR,MAAM,CAAC,GAAG,CAAA,KAAK,oBAAoB,eAAe,oBAAoB,GAAG,EACzE,IAAI,CACL;QACD,KAAK,QAAQ,EAAE;KAChB;IACD,iEAAiE;IACjE,6EAA6E;IAC7E,8EAA8E;IAC9E,2EAA2E;IAC3E,0BAA0B;IAC1B;QACE,iBAAiB;QACjB,qDAAqD;QACrD,KAAK,QAAQ,GAAG;KACjB;IACD,yEAAyE;IACzE,0EAA0E;IAC1E,6EAA6E;IAC7E,yDAAyD;IACzD,EAAE;IACF,0EAA0E;IAC1E,0EAA0E;IAC1E,yEAAyE;IACzE,0EAA0E;IAC1E,6EAA6E;IAC7E,0CAA0C;IAC1C,EAAE;IACF,8EAA8E;IAC9E,6EAA6E;IAC7E,2EAA2E;IAC3E;QACE,YAAY;QACZ,IAAI,MAAM,CACR,MAAM,CAAC,GAAG,CAAA,MAAM,0BAA0B,oDAAoD,iBAAiB,iJAAiJ,EAChQ,IAAI,CACL;QACD,OAAO,QAAQ,EAAE;KAClB;IACD,6EAA6E;IAC7E,8EAA8E;IAC9E,gBAAgB;IAChB,EAAE;IACF,yEAAyE;IACzE,2EAA2E;IAC3E,4DAA4D;IAC5D,+EAA+E;IAC/E,0EAA0E;IAC1E,6EAA6E;IAC7E,oEAAoE;IACpE,8EAA8E;IAC9E,yEAAyE;IACzE,8EAA8E;IAC9E,+EAA+E;IAC/E,8EAA8E;IAC9E,2BAA2B;IAC3B,EAAE;IACF,6EAA6E;IAC7E,6EAA6E;IAC7E,yEAAyE;IACzE,8EAA8E;IAC9E,iEAAiE;IACjE,EAAE;IACF,sEAAsE;IACtE,4EAA4E;IAC5E,6EAA6E;IAC7E;QACE,OAAO;QACP,8NAA8N;QAC9N,QAAQ;KACT;IACD,wEAAwE;IACxE,4EAA4E;IAC5E;QACE,YAAY;QACZ,IAAI,MAAM,CACR,MAAM,CAAC,GAAG,CAAA,MAAM,0BAA0B,kBAAkB,0BAA0B,EAAE,EACxF,IAAI,CACL;QACD,KAAK,QAAQ,EAAE;KAChB;IACD,mDAAmD;IACnD,6CAA6C;IAC7C,CAAC,OAAO,EAAE,qDAAqD,EAAE,QAAQ,CAAC;IAC1E,4EAA4E;IAC5E,yEAAyE;IACzE,EAAE;IACF,gFAAgF;IAChF,EAAE;IACF,yEAAyE;IACzE,6EAA6E;IAC7E,2EAA2E;IAC3E,6EAA6E;IAC7E,aAAa;IACb,uEAAuE;IACvE,4EAA4E;IAC5E,0EAA0E;IAC1E,sEAAsE;IACtE,wEAAwE;IACxE,2EAA2E;IAC3E;QACE,oBAAoB;QACpB,4FAA4F;QAC5F,QAAQ;KACT;CACF,CAAA;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,KAAgC;IAC1D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAC9C,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAA;IACxE,CAAC;IAED,0DAA0D;IAC1D,MAAM,gBAAgB,GAAG,KAAK,CAAC,MAAM,GAAG,cAAc,CAAA;IACtD,IAAI,IAAI,GAAG,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IACpE,yEAAyE;IACzE,sEAAsE;IACtE,MAAM,YAAY,GAAG,IAAI,MAAM,CAAC,IAAI,oBAAoB,GAAG,EAAE,GAAG,CAAC,CAAA;IACjE,IAAI,GAAG,IAAI,CAAC,OAAO,CACjB,4BAA4B,EAC5B,CAAC,KAAK,EAAE,GAAW,EAAE,SAAiB,EAAE,EAAE;QACxC,IAAI,CAAC;YACH,MAAM,OAAO,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACxC,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC;gBAC9D,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,SAAS,EAAE;gBAC1C,CAAC,CAAC,KAAK,CAAA;QACX,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC,CACF,CAAA;IACD,MAAM,MAAM,GAAiD,EAAE,CAAA;IAC/D,IAAI,aAAa,GAAG,CAAC,CAAA;IACrB,MAAM,gBAAgB,GAAG,GAAG,EAAE;QAC5B,MAAM,CAAC,UAAU,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;QAChD,aAAa,IAAI,CAAC,CAAA;IACpB,CAAC,CAAA;IAED,sEAAsE;IACtE,mEAAmE;IACnE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC9B,MAAM,SAAS,GAAG,IAAI,MAAM,CAC1B,MAAM,CAAC,GAAG,CAAA,4BAA4B,oBAAoB,yEAAyE,EACnI,GAAG,CACJ,CAAA;IACD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAE,CAAC,CAAA;QAC3C,IAAI,CAAC,KAAK;YAAE,SAAQ;QACpB,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,CAAA;QAChE,IAAI,GAAG,GAAG,KAAK,GAAG,CAAC,CAAA;QACnB,OAAO,GAAG,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAE,CAAA;YACxB,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,aAAa;gBAAE,MAAK;YAC1E,GAAG,IAAI,CAAC,CAAA;QACV,CAAC;QACD,0EAA0E;QAC1E,0EAA0E;QAC1E,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAA;QACjE,KAAK,CAAC,MAAM,CACV,KAAK,EACL,GAAG,GAAG,KAAK,EACX,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,SAAS,GAAG,QAAQ,EAAE,CACtD,CAAA;QACD,gBAAgB,EAAE,CAAA;IACpB,CAAC;IACD,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAEvB,yEAAyE;IACzE,wEAAwE;IACxE,MAAM,aAAa,GAAG,CAAC,KAAc,EAAE,KAAa,EAAW,EAAE;QAC/D,IAAI,KAAK,GAAG,EAAE,EAAE,CAAC;YACf,gBAAgB,EAAE,CAAA;YAClB,OAAO,QAAQ,CAAA;QACjB,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACxD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;gBACzC,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;gBACjD,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;oBACxD,CAAC,CAAC,KAAK;oBACP,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;YAC9B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAA;YACpD,CAAC;QACH,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAA;QACpF,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAA;QAC7D,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE;YACxC,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3B,gBAAgB,EAAE,CAAA;gBAClB,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;YACxB,CAAC;YACD,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAA;QAC9C,CAAC,CAAC,CACH,CAAA;IACH,CAAC,CAAA;IACD,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,+BAA+B,EAAE,CAAC,KAAK,EAAE,EAAE;QAC7D,IAAI,CAAC;YACH,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACxC,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;YACxC,OAAO,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,KAAK,MAAM,CAAC,cAAc,EAAE,OAAO,EAAE,WAAW,CAAC,IAAI,gBAAgB,EAAE,CAAC;QACtE,qEAAqE;QACrE,0EAA0E;QAC1E,uEAAuE;QACvE,oCAAoC;QACpC,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;QACzD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACnC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAQ;QAC9C,uEAAuE;QACvE,+DAA+D;QAC/D,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAA;QACzE,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAC5B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,KAAK,KAAK,CACxD,CAAC,MAAM,CAAA;QACR,IAAI,OAAO,KAAK,CAAC;YAAE,SAAQ;QAC3B,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,GAAG,OAAO,CAAA;QAChE,aAAa,IAAI,OAAO,CAAA;QACxB,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC,CAAA;IAC7E,CAAC;IAED,MAAM,YAAY,GAAG,gBAAgB,IAAI,IAAI,CAAC,MAAM,GAAG,eAAe,CAAA;IACtE,IAAI,IAAI,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;QAClC,wEAAwE;QACxE,sCAAsC;QACtC,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,eAAe,CAAA;IACzD,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,CAAA;AACtD,CAAC"}

package/dist/redact-prose.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=redact-prose.test.d.ts.map

package/dist/redact-prose.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact-prose.test.d.ts","sourceRoot":"","sources":["../src/redact-prose.test.ts"],"names":[],"mappings":""}