@n8n/utils 1.19.0 → 1.20.1

package/dist/files/sanitize.cjs

@@ -0,0 +1,3 @@
+const require_sanitize = require('../sanitize.cjs');
+
+exports.sanitizeFilename = require_sanitize.sanitizeFilename;

package/dist/files/sanitize.d.cts

@@ -0,0 +1,2 @@
+import { t as sanitizeFilename } from "../sanitize.cjs";
+export { sanitizeFilename };

package/dist/files/sanitize.d.mts

@@ -0,0 +1,2 @@
+import { t as sanitizeFilename } from "../sanitize.mjs";
+export { sanitizeFilename };

package/dist/files/sanitize.mjs

@@ -0,0 +1,3 @@
+import { t as sanitizeFilename } from "../sanitize.mjs";
+
+export { sanitizeFilename };

package/dist/index.cjs

@@ -7,6 +7,7 @@ const require_reRankSearchResults = require('./reRankSearchResults.cjs');
 const require_sublimeSearch = require('./sublimeSearch.cjs');
 const require_sortByProperty = require('./sortByProperty.cjs');
 const require_truncate = require('./truncate.cjs');
+const require_sanitize = require('./sanitize.cjs');
 
 exports.DEFAULT_KEYS = require_sublimeSearch.DEFAULT_KEYS;
 exports.assert = require_assert.assert;
@@ -14,6 +15,7 @@ exports.createEventBus = require_event_bus.createEventBus;
 exports.createEventQueue = require_event_queue.createEventQueue;
 exports.reRankSearchResults = require_reRankSearchResults.reRankSearchResults;
 exports.retry = require_retry.retry;
+exports.sanitizeFilename = require_sanitize.sanitizeFilename;
 exports.smartDecimal = require_smartDecimal.smartDecimal;
 exports.sortByProperty = require_sortByProperty.sortByProperty;
 exports.sublimeSearch = require_sublimeSearch.sublimeSearch;

package/dist/index.d.cts

@@ -1,10 +1,11 @@
 import { t as assert } from "./assert2.cjs";
 import { n as EventBus, r as createEventBus, t as CallbackFn } from "./event-bus2.cjs";
 import { t as createEventQueue } from "./event-queue2.cjs";
+import { t as sanitizeFilename } from "./sanitize.cjs";
 import { t as retry } from "./retry2.cjs";
 import { t as smartDecimal } from "./smartDecimal.cjs";
 import { t as reRankSearchResults } from "./reRankSearchResults.cjs";
 import { n as sublimeSearch, t as DEFAULT_KEYS } from "./sublimeSearch.cjs";
 import { t as sortByProperty } from "./sortByProperty.cjs";
 import { n as truncateBeforeLast, t as truncate } from "./truncate.cjs";
-export { CallbackFn, DEFAULT_KEYS, EventBus, assert, createEventBus, createEventQueue, reRankSearchResults, retry, smartDecimal, sortByProperty, sublimeSearch, truncate, truncateBeforeLast };
+export { CallbackFn, DEFAULT_KEYS, EventBus, assert, createEventBus, createEventQueue, reRankSearchResults, retry, sanitizeFilename, smartDecimal, sortByProperty, sublimeSearch, truncate, truncateBeforeLast };

package/dist/index.d.mts

@@ -1,10 +1,11 @@
 import { t as assert } from "./assert2.mjs";
 import { n as EventBus, r as createEventBus, t as CallbackFn } from "./event-bus2.mjs";
 import { t as createEventQueue } from "./event-queue2.mjs";
+import { t as sanitizeFilename } from "./sanitize.mjs";
 import { t as retry } from "./retry2.mjs";
 import { t as smartDecimal } from "./smartDecimal.mjs";
 import { t as reRankSearchResults } from "./reRankSearchResults.mjs";
 import { n as sublimeSearch, t as DEFAULT_KEYS } from "./sublimeSearch.mjs";
 import { t as sortByProperty } from "./sortByProperty.mjs";
 import { n as truncateBeforeLast, t as truncate } from "./truncate.mjs";
-export { CallbackFn, DEFAULT_KEYS, EventBus, assert, createEventBus, createEventQueue, reRankSearchResults, retry, smartDecimal, sortByProperty, sublimeSearch, truncate, truncateBeforeLast };
+export { CallbackFn, DEFAULT_KEYS, EventBus, assert, createEventBus, createEventQueue, reRankSearchResults, retry, sanitizeFilename, smartDecimal, sortByProperty, sublimeSearch, truncate, truncateBeforeLast };

package/dist/index.mjs

@@ -7,5 +7,6 @@ import { t as reRankSearchResults } from "./reRankSearchResults.mjs";
 import { n as sublimeSearch, t as DEFAULT_KEYS } from "./sublimeSearch.mjs";
 import { t as sortByProperty } from "./sortByProperty.mjs";
 import { n as truncateBeforeLast, t as truncate } from "./truncate.mjs";
+import { t as sanitizeFilename } from "./sanitize.mjs";
 
-export { DEFAULT_KEYS, assert, createEventBus, createEventQueue, reRankSearchResults, retry, smartDecimal, sortByProperty, sublimeSearch, truncate, truncateBeforeLast };
+export { DEFAULT_KEYS, assert, createEventBus, createEventQueue, reRankSearchResults, retry, sanitizeFilename, smartDecimal, sortByProperty, sublimeSearch, truncate, truncateBeforeLast };

package/dist/sanitize.cjs

@@ -0,0 +1,67 @@
+
+//#region src/files/sanitize.ts
+const INVALID_CHARS_REGEX = /[<>:"/\\|?*\u0000-\u001F\u007F-\u009F]/g;
+const ZERO_WIDTH_CHARS_REGEX = /[\u200B-\u200D\u2060\uFEFF]/g;
+const UNICODE_SPACES_REGEX = /[\u00A0\u2000-\u200A]/g;
+const LEADING_TRAILING_DOTS_SPACES_REGEX = /^[\s.]+|[\s.]+$/g;
+const WINDOWS_RESERVED_NAMES = new Set([
+	"CON",
+	"PRN",
+	"AUX",
+	"NUL",
+	"COM1",
+	"COM2",
+	"COM3",
+	"COM4",
+	"COM5",
+	"COM6",
+	"COM7",
+	"COM8",
+	"COM9",
+	"LPT1",
+	"LPT2",
+	"LPT3",
+	"LPT4",
+	"LPT5",
+	"LPT6",
+	"LPT7",
+	"LPT8",
+	"LPT9"
+]);
+const DEFAULT_FALLBACK_NAME = "untitled";
+const MAX_FILENAME_LENGTH = 200;
+/**
+* Sanitizes a filename to be compatible with Mac, Linux, and Windows file systems
+*
+* Main features:
+* - Replace invalid characters (e.g. ":" in hello:world)
+* - Handle Windows reserved names
+* - Limit filename length
+* - Normalize Unicode characters
+*
+* @param filename - The filename to sanitize (without extension)
+* @param maxLength - Maximum filename length (default: 200)
+* @returns A sanitized filename (without extension)
+*
+* @example
+* sanitizeFilename('hello:world') // returns 'hello_world'
+* sanitizeFilename('CON') // returns '_CON'
+* sanitizeFilename('') // returns 'untitled'
+*/
+const sanitizeFilename = (filename, maxLength = MAX_FILENAME_LENGTH) => {
+	if (!filename) return DEFAULT_FALLBACK_NAME;
+	let baseName = filename.trim().replace(INVALID_CHARS_REGEX, "_").replace(ZERO_WIDTH_CHARS_REGEX, "").replace(UNICODE_SPACES_REGEX, " ").replace(LEADING_TRAILING_DOTS_SPACES_REGEX, "");
+	if (!baseName) baseName = DEFAULT_FALLBACK_NAME;
+	if (WINDOWS_RESERVED_NAMES.has(baseName.toUpperCase())) baseName = `_${baseName}`;
+	if (baseName.length > maxLength) baseName = baseName.slice(0, maxLength);
+	return baseName;
+};
+
+//#endregion
+Object.defineProperty(exports, 'sanitizeFilename', {
+  enumerable: true,
+  get: function () {
+    return sanitizeFilename;
+  }
+});
+//# sourceMappingURL=sanitize.cjs.map

package/dist/sanitize.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.cjs","names":[],"sources":["../src/files/sanitize.ts"],"sourcesContent":["// Constants definition\n/* eslint-disable no-control-regex */\nconst INVALID_CHARS_REGEX = /[<>:\"/\\\\|?*\\u0000-\\u001F\\u007F-\\u009F]/g;\nconst ZERO_WIDTH_CHARS_REGEX = /[\\u200B-\\u200D\\u2060\\uFEFF]/g;\nconst UNICODE_SPACES_REGEX = /[\\u00A0\\u2000-\\u200A]/g;\nconst LEADING_TRAILING_DOTS_SPACES_REGEX = /^[\\s.]+|[\\s.]+$/g;\n/* eslint-enable no-control-regex */\n\nconst WINDOWS_RESERVED_NAMES = new Set([\n\t'CON',\n\t'PRN',\n\t'AUX',\n\t'NUL',\n\t'COM1',\n\t'COM2',\n\t'COM3',\n\t'COM4',\n\t'COM5',\n\t'COM6',\n\t'COM7',\n\t'COM8',\n\t'COM9',\n\t'LPT1',\n\t'LPT2',\n\t'LPT3',\n\t'LPT4',\n\t'LPT5',\n\t'LPT6',\n\t'LPT7',\n\t'LPT8',\n\t'LPT9',\n]);\n\nconst DEFAULT_FALLBACK_NAME = 'untitled';\nconst MAX_FILENAME_LENGTH = 200;\n\n/**\n * Sanitizes a filename to be compatible with Mac, Linux, and Windows file systems\n *\n * Main features:\n * - Replace invalid characters (e.g. \":\" in hello:world)\n * - Handle Windows reserved names\n * - Limit filename length\n * - Normalize Unicode characters\n *\n * @param filename - The filename to sanitize (without extension)\n * @param maxLength - Maximum filename length (default: 200)\n * @returns A sanitized filename (without extension)\n *\n * @example\n * sanitizeFilename('hello:world') // returns 'hello_world'\n * sanitizeFilename('CON') // returns '_CON'\n * sanitizeFilename('') // returns 'untitled'\n */\nexport const sanitizeFilename = (\n\tfilename: string,\n\tmaxLength: number = MAX_FILENAME_LENGTH,\n): string => {\n\t// Input validation\n\tif (!filename) {\n\t\treturn DEFAULT_FALLBACK_NAME;\n\t}\n\n\tlet baseName = filename\n\t\t.trim()\n\t\t.replace(INVALID_CHARS_REGEX, '_')\n\t\t.replace(ZERO_WIDTH_CHARS_REGEX, '')\n\t\t.replace(UNICODE_SPACES_REGEX, ' ')\n\t\t.replace(LEADING_TRAILING_DOTS_SPACES_REGEX, '');\n\n\t// Handle empty or invalid filenames after cleaning\n\tif (!baseName) {\n\t\tbaseName = DEFAULT_FALLBACK_NAME;\n\t}\n\n\t// Handle Windows reserved names\n\tif (WINDOWS_RESERVED_NAMES.has(baseName.toUpperCase())) {\n\t\tbaseName = `_${baseName}`;\n\t}\n\n\t// Truncate if too long\n\tif (baseName.length > maxLength) {\n\t\tbaseName = baseName.slice(0, maxLength);\n\t}\n\n\treturn baseName;\n};\n"],"mappings":";;AAEA,MAAM,sBAAsB;AAC5B,MAAM,yBAAyB;AAC/B,MAAM,uBAAuB;AAC7B,MAAM,qCAAqC;AAG3C,MAAM,yBAAyB,IAAI,IAAI;CACtC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA,CAAC;AAEF,MAAM,wBAAwB;AAC9B,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;AAoB5B,MAAa,oBACZ,UACA,YAAoB,wBACR;AAEZ,KAAI,CAAC,SACJ,QAAO;CAGR,IAAI,WAAW,SACb,MAAM,CACN,QAAQ,qBAAqB,IAAI,CACjC,QAAQ,wBAAwB,GAAG,CACnC,QAAQ,sBAAsB,IAAI,CAClC,QAAQ,oCAAoC,GAAG;AAGjD,KAAI,CAAC,SACJ,YAAW;AAIZ,KAAI,uBAAuB,IAAI,SAAS,aAAa,CAAC,CACrD,YAAW,IAAI;AAIhB,KAAI,SAAS,SAAS,UACrB,YAAW,SAAS,MAAM,GAAG,UAAU;AAGxC,QAAO"}

package/dist/sanitize.d.cts

@@ -0,0 +1,5 @@
+//#region src/files/sanitize.d.ts
+declare const sanitizeFilename: (filename: string, maxLength?: number) => string;
+//#endregion
+export { sanitizeFilename as t };
+//# sourceMappingURL=sanitize.d.cts.map

package/dist/sanitize.d.mts

@@ -0,0 +1,5 @@
+//#region src/files/sanitize.d.ts
+declare const sanitizeFilename: (filename: string, maxLength?: number) => string;
+//#endregion
+export { sanitizeFilename as t };
+//# sourceMappingURL=sanitize.d.mts.map

package/dist/sanitize.mjs

@@ -0,0 +1,61 @@
+//#region src/files/sanitize.ts
+const INVALID_CHARS_REGEX = /[<>:"/\\|?*\u0000-\u001F\u007F-\u009F]/g;
+const ZERO_WIDTH_CHARS_REGEX = /[\u200B-\u200D\u2060\uFEFF]/g;
+const UNICODE_SPACES_REGEX = /[\u00A0\u2000-\u200A]/g;
+const LEADING_TRAILING_DOTS_SPACES_REGEX = /^[\s.]+|[\s.]+$/g;
+const WINDOWS_RESERVED_NAMES = new Set([
+	"CON",
+	"PRN",
+	"AUX",
+	"NUL",
+	"COM1",
+	"COM2",
+	"COM3",
+	"COM4",
+	"COM5",
+	"COM6",
+	"COM7",
+	"COM8",
+	"COM9",
+	"LPT1",
+	"LPT2",
+	"LPT3",
+	"LPT4",
+	"LPT5",
+	"LPT6",
+	"LPT7",
+	"LPT8",
+	"LPT9"
+]);
+const DEFAULT_FALLBACK_NAME = "untitled";
+const MAX_FILENAME_LENGTH = 200;
+/**
+* Sanitizes a filename to be compatible with Mac, Linux, and Windows file systems
+*
+* Main features:
+* - Replace invalid characters (e.g. ":" in hello:world)
+* - Handle Windows reserved names
+* - Limit filename length
+* - Normalize Unicode characters
+*
+* @param filename - The filename to sanitize (without extension)
+* @param maxLength - Maximum filename length (default: 200)
+* @returns A sanitized filename (without extension)
+*
+* @example
+* sanitizeFilename('hello:world') // returns 'hello_world'
+* sanitizeFilename('CON') // returns '_CON'
+* sanitizeFilename('') // returns 'untitled'
+*/
+const sanitizeFilename = (filename, maxLength = MAX_FILENAME_LENGTH) => {
+	if (!filename) return DEFAULT_FALLBACK_NAME;
+	let baseName = filename.trim().replace(INVALID_CHARS_REGEX, "_").replace(ZERO_WIDTH_CHARS_REGEX, "").replace(UNICODE_SPACES_REGEX, " ").replace(LEADING_TRAILING_DOTS_SPACES_REGEX, "");
+	if (!baseName) baseName = DEFAULT_FALLBACK_NAME;
+	if (WINDOWS_RESERVED_NAMES.has(baseName.toUpperCase())) baseName = `_${baseName}`;
+	if (baseName.length > maxLength) baseName = baseName.slice(0, maxLength);
+	return baseName;
+};
+
+//#endregion
+export { sanitizeFilename as t };
+//# sourceMappingURL=sanitize.mjs.map

package/dist/sanitize.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.mjs","names":[],"sources":["../src/files/sanitize.ts"],"sourcesContent":["// Constants definition\n/* eslint-disable no-control-regex */\nconst INVALID_CHARS_REGEX = /[<>:\"/\\\\|?*\\u0000-\\u001F\\u007F-\\u009F]/g;\nconst ZERO_WIDTH_CHARS_REGEX = /[\\u200B-\\u200D\\u2060\\uFEFF]/g;\nconst UNICODE_SPACES_REGEX = /[\\u00A0\\u2000-\\u200A]/g;\nconst LEADING_TRAILING_DOTS_SPACES_REGEX = /^[\\s.]+|[\\s.]+$/g;\n/* eslint-enable no-control-regex */\n\nconst WINDOWS_RESERVED_NAMES = new Set([\n\t'CON',\n\t'PRN',\n\t'AUX',\n\t'NUL',\n\t'COM1',\n\t'COM2',\n\t'COM3',\n\t'COM4',\n\t'COM5',\n\t'COM6',\n\t'COM7',\n\t'COM8',\n\t'COM9',\n\t'LPT1',\n\t'LPT2',\n\t'LPT3',\n\t'LPT4',\n\t'LPT5',\n\t'LPT6',\n\t'LPT7',\n\t'LPT8',\n\t'LPT9',\n]);\n\nconst DEFAULT_FALLBACK_NAME = 'untitled';\nconst MAX_FILENAME_LENGTH = 200;\n\n/**\n * Sanitizes a filename to be compatible with Mac, Linux, and Windows file systems\n *\n * Main features:\n * - Replace invalid characters (e.g. \":\" in hello:world)\n * - Handle Windows reserved names\n * - Limit filename length\n * - Normalize Unicode characters\n *\n * @param filename - The filename to sanitize (without extension)\n * @param maxLength - Maximum filename length (default: 200)\n * @returns A sanitized filename (without extension)\n *\n * @example\n * sanitizeFilename('hello:world') // returns 'hello_world'\n * sanitizeFilename('CON') // returns '_CON'\n * sanitizeFilename('') // returns 'untitled'\n */\nexport const sanitizeFilename = (\n\tfilename: string,\n\tmaxLength: number = MAX_FILENAME_LENGTH,\n): string => {\n\t// Input validation\n\tif (!filename) {\n\t\treturn DEFAULT_FALLBACK_NAME;\n\t}\n\n\tlet baseName = filename\n\t\t.trim()\n\t\t.replace(INVALID_CHARS_REGEX, '_')\n\t\t.replace(ZERO_WIDTH_CHARS_REGEX, '')\n\t\t.replace(UNICODE_SPACES_REGEX, ' ')\n\t\t.replace(LEADING_TRAILING_DOTS_SPACES_REGEX, '');\n\n\t// Handle empty or invalid filenames after cleaning\n\tif (!baseName) {\n\t\tbaseName = DEFAULT_FALLBACK_NAME;\n\t}\n\n\t// Handle Windows reserved names\n\tif (WINDOWS_RESERVED_NAMES.has(baseName.toUpperCase())) {\n\t\tbaseName = `_${baseName}`;\n\t}\n\n\t// Truncate if too long\n\tif (baseName.length > maxLength) {\n\t\tbaseName = baseName.slice(0, maxLength);\n\t}\n\n\treturn baseName;\n};\n"],"mappings":";AAEA,MAAM,sBAAsB;AAC5B,MAAM,yBAAyB;AAC/B,MAAM,uBAAuB;AAC7B,MAAM,qCAAqC;AAG3C,MAAM,yBAAyB,IAAI,IAAI;CACtC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA,CAAC;AAEF,MAAM,wBAAwB;AAC9B,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;AAoB5B,MAAa,oBACZ,UACA,YAAoB,wBACR;AAEZ,KAAI,CAAC,SACJ,QAAO;CAGR,IAAI,WAAW,SACb,MAAM,CACN,QAAQ,qBAAqB,IAAI,CACjC,QAAQ,wBAAwB,GAAG,CACnC,QAAQ,sBAAsB,IAAI,CAClC,QAAQ,oCAAoC,GAAG;AAGjD,KAAI,CAAC,SACJ,YAAW;AAIZ,KAAI,uBAAuB,IAAI,SAAS,aAAa,CAAC,CACrD,YAAW,IAAI;AAIhB,KAAI,SAAS,SAAS,UACrB,YAAW,SAAS,MAAM,GAAG,UAAU;AAGxC,QAAO"}

package/dist/scrub-secrets.cjs

@@ -0,0 +1,44 @@
+
+//#region src/scrub-secrets.ts
+/**
+* Replace common credential patterns in free-form text with `[REDACTED]`.
+*
+* Used before persisting or transmitting user-supplied text (telemetry
+* excerpts, eval report HTML, free-form feedback) where keys/tokens
+* accidentally pasted into prompts or command lines could otherwise leak
+* downstream.
+*
+* Conservative by design: matches well-known prefixed tokens, explicit
+* `key=value` pairs, and quoted JSON/JS-object fields with sensitive
+* names. We don't attempt to redact arbitrary long opaque strings — false
+* positives on file paths, IDs, or base64 payloads would make the output
+* unreadable.
+*/
+const SECRET_KEYS = "password|passwd|secret|credentials?|api[_-]?key|authorization|access[_-]?token|refresh[_-]?token|id[_-]?token|session[_-]?token|auth[_-]?token";
+const SECRET_VALUE_PATTERNS = [
+	/-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----/g,
+	/\beyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g,
+	/\b(?:Bearer|Basic|Token)\s+[A-Za-z0-9._~+/=-]{12,}/gi,
+	/\bsk-(?:ant-|proj-)?[A-Za-z0-9_-]{16,}/g,
+	/\b(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{16,}/g,
+	/\bAIza[0-9A-Za-z_-]{35}\b/g,
+	/\bxox[abprso]-[A-Za-z0-9-]{10,}/g,
+	/\bgh[psoru]_[A-Za-z0-9]{20,}/g,
+	/\bgithub_pat_[A-Za-z0-9_]{22,}/g,
+	/\bAKIA[0-9A-Z]{16}\b/g,
+	/(?<=:\/\/)[^\s:/@]+:[^\s:/@]+(?=@)/g,
+	new RegExp(`"(?:${SECRET_KEYS})"\\s*:\\s*"(?!\\[(?:redacted|REDACTED)\\]")(?:[^"\\\\\\r\\n]|\\\\.)*"`, "gi"),
+	new RegExp(`'(?:${SECRET_KEYS})'\\s*:\\s*'(?!\\[(?:redacted|REDACTED)\\]')(?:[^'\\\\\\r\\n]|\\\\.)*'`, "gi"),
+	new RegExp(`\\b(?:${SECRET_KEYS})\\s*[:=]\\s*\\S+`, "gi")
+];
+function scrubSecretsInText(input) {
+	let out = input;
+	for (const pattern of SECRET_VALUE_PATTERNS) out = out.replace(pattern, "[REDACTED]");
+	return out;
+}
+
+//#endregion
+exports.SECRET_KEYS = SECRET_KEYS;
+exports.SECRET_VALUE_PATTERNS = SECRET_VALUE_PATTERNS;
+exports.scrubSecretsInText = scrubSecretsInText;
+//# sourceMappingURL=scrub-secrets.cjs.map

package/dist/scrub-secrets.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"scrub-secrets.cjs","names":["SECRET_VALUE_PATTERNS: readonly RegExp[]"],"sources":["../src/scrub-secrets.ts"],"sourcesContent":["/**\n * Replace common credential patterns in free-form text with `[REDACTED]`.\n *\n * Used before persisting or transmitting user-supplied text (telemetry\n * excerpts, eval report HTML, free-form feedback) where keys/tokens\n * accidentally pasted into prompts or command lines could otherwise leak\n * downstream.\n *\n * Conservative by design: matches well-known prefixed tokens, explicit\n * `key=value` pairs, and quoted JSON/JS-object fields with sensitive\n * names. We don't attempt to redact arbitrary long opaque strings — false\n * positives on file paths, IDs, or base64 payloads would make the output\n * unreadable.\n */\nexport const SECRET_KEYS =\n\t'password|passwd|secret|credentials?|api[_-]?key|authorization|access[_-]?token|refresh[_-]?token|id[_-]?token|session[_-]?token|auth[_-]?token';\n\nexport const SECRET_VALUE_PATTERNS: readonly RegExp[] = [\n\t// PEM private-key blocks (RSA/EC/DSA/OpenSSH/PGP). Whole block, multiline.\n\t/-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----[\\s\\S]*?-----END (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----/g,\n\t// JWTs: `eyJ<header>.eyJ<payload>.<signature>` (both leading segments are\n\t// base64url of a `{\"` object, which makes this highly distinctive).\n\t/\\beyJ[A-Za-z0-9_-]+\\.eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+/g,\n\t// Authorization-header substrings: `Bearer <token>`, `Basic <token>`, `Token <token>`\n\t/\\b(?:Bearer|Basic|Token)\\s+[A-Za-z0-9._~+/=-]{12,}/gi,\n\t// OpenAI / Anthropic API keys\n\t/\\bsk-(?:ant-|proj-)?[A-Za-z0-9_-]{16,}/g,\n\t// Stripe secret/restricted/publishable keys (`sk_live_…`, `rk_test_…`, …)\n\t/\\b(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{16,}/g,\n\t// Google API keys\n\t/\\bAIza[0-9A-Za-z_-]{35}\\b/g,\n\t// Slack tokens (xoxb, xoxp, xoxa, xoxr, xoxs, xoxo)\n\t/\\bxox[abprso]-[A-Za-z0-9-]{10,}/g,\n\t// GitHub tokens (ghp, ghs, gho, ghr, ghu)\n\t/\\bgh[psoru]_[A-Za-z0-9]{20,}/g,\n\t// GitHub fine-grained personal access tokens\n\t/\\bgithub_pat_[A-Za-z0-9_]{22,}/g,\n\t// AWS access key id\n\t/\\bAKIA[0-9A-Z]{16}\\b/g,\n\t// Credentials embedded in a URL: `scheme://user:password@` — redact the userinfo.\n\t/(?<=:\\/\\/)[^\\s:/@]+:[^\\s:/@]+(?=@)/g,\n\t// JSON-shaped `\"key\": \"value\"` — matches the quoted field as a whole.\n\t// Run before the loose pattern so nested objects like\n\t// `{\"credentials\": {\"apiKey\": \"...\"}}` don't have the outer key consume\n\t// the inner key on its way to a non-quoted (object) value. The value\n\t// body uses the unrolled JSON-string idiom `(?:[^\"\\\\\\r\\n]|\\\\.)*`: the\n\t// negated class excludes the backslash so a backslash can only be consumed\n\t// by the `\\\\.` escape branch. Keep the two alternatives disjoint (don't\n\t// fold `\\\\` back into the negated class) — that keeps every run of\n\t// backslashes to a single, unambiguous parse, so matching stays fast on any\n\t// input. An escaped quote inside the value (`\"abc\\\"def\"`) still doesn't end\n\t// the match early, via the escape branch. The negative lookahead skips\n\t// values that are already a `[redacted]` / `[REDACTED]` placeholder so this\n\t// stays idempotent when chained behind upstream object-walking redaction\n\t// (e.g. langsmith trace payloads).\n\tnew RegExp(\n\t\t`\"(?:${SECRET_KEYS})\"\\\\s*:\\\\s*\"(?!\\\\[(?:redacted|REDACTED)\\\\]\")(?:[^\"\\\\\\\\\\\\r\\\\n]|\\\\\\\\.)*\"`,\n\t\t'gi',\n\t),\n\t// JS-object-shaped `'key': 'value'`\n\tnew RegExp(\n\t\t`'(?:${SECRET_KEYS})'\\\\s*:\\\\s*'(?!\\\\[(?:redacted|REDACTED)\\\\]')(?:[^'\\\\\\\\\\\\r\\\\n]|\\\\\\\\.)*'`,\n\t\t'gi',\n\t),\n\t// Generic `password=...` / `api_key=...` / `secret=...` style assignments\n\tnew RegExp(`\\\\b(?:${SECRET_KEYS})\\\\s*[:=]\\\\s*\\\\S+`, 'gi'),\n];\n\nexport function scrubSecretsInText(input: string): string {\n\tlet out = input;\n\tfor (const pattern of SECRET_VALUE_PATTERNS) {\n\t\tout = out.replace(pattern, '[REDACTED]');\n\t}\n\treturn out;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAcA,MAAa,cACZ;AAED,MAAaA,wBAA2C;CAEvD;CAGA;CAEA;CAEA;CAEA;CAEA;CAEA;CAEA;CAEA;CAEA;CAEA;CAeA,IAAI,OACH,OAAO,YAAY,yEACnB,KACA;CAED,IAAI,OACH,OAAO,YAAY,yEACnB,KACA;CAED,IAAI,OAAO,SAAS,YAAY,oBAAoB,KAAK;CACzD;AAED,SAAgB,mBAAmB,OAAuB;CACzD,IAAI,MAAM;AACV,MAAK,MAAM,WAAW,sBACrB,OAAM,IAAI,QAAQ,SAAS,aAAa;AAEzC,QAAO"}

package/dist/scrub-secrets.d.cts

@@ -0,0 +1,7 @@
+//#region src/scrub-secrets.d.ts
+declare const SECRET_KEYS = "password|passwd|secret|credentials?|api[_-]?key|authorization|access[_-]?token|refresh[_-]?token|id[_-]?token|session[_-]?token|auth[_-]?token";
+declare const SECRET_VALUE_PATTERNS: readonly RegExp[];
+declare function scrubSecretsInText(input: string): string;
+//#endregion
+export { SECRET_KEYS, SECRET_VALUE_PATTERNS, scrubSecretsInText };
+//# sourceMappingURL=scrub-secrets.d.cts.map

package/dist/scrub-secrets.d.mts

@@ -0,0 +1,7 @@
+//#region src/scrub-secrets.d.ts
+declare const SECRET_KEYS = "password|passwd|secret|credentials?|api[_-]?key|authorization|access[_-]?token|refresh[_-]?token|id[_-]?token|session[_-]?token|auth[_-]?token";
+declare const SECRET_VALUE_PATTERNS: readonly RegExp[];
+declare function scrubSecretsInText(input: string): string;
+//#endregion
+export { SECRET_KEYS, SECRET_VALUE_PATTERNS, scrubSecretsInText };
+//# sourceMappingURL=scrub-secrets.d.mts.map

package/dist/scrub-secrets.mjs

@@ -0,0 +1,41 @@
+//#region src/scrub-secrets.ts
+/**
+* Replace common credential patterns in free-form text with `[REDACTED]`.
+*
+* Used before persisting or transmitting user-supplied text (telemetry
+* excerpts, eval report HTML, free-form feedback) where keys/tokens
+* accidentally pasted into prompts or command lines could otherwise leak
+* downstream.
+*
+* Conservative by design: matches well-known prefixed tokens, explicit
+* `key=value` pairs, and quoted JSON/JS-object fields with sensitive
+* names. We don't attempt to redact arbitrary long opaque strings — false
+* positives on file paths, IDs, or base64 payloads would make the output
+* unreadable.
+*/
+const SECRET_KEYS = "password|passwd|secret|credentials?|api[_-]?key|authorization|access[_-]?token|refresh[_-]?token|id[_-]?token|session[_-]?token|auth[_-]?token";
+const SECRET_VALUE_PATTERNS = [
+	/-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----/g,
+	/\beyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g,
+	/\b(?:Bearer|Basic|Token)\s+[A-Za-z0-9._~+/=-]{12,}/gi,
+	/\bsk-(?:ant-|proj-)?[A-Za-z0-9_-]{16,}/g,
+	/\b(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{16,}/g,
+	/\bAIza[0-9A-Za-z_-]{35}\b/g,
+	/\bxox[abprso]-[A-Za-z0-9-]{10,}/g,
+	/\bgh[psoru]_[A-Za-z0-9]{20,}/g,
+	/\bgithub_pat_[A-Za-z0-9_]{22,}/g,
+	/\bAKIA[0-9A-Z]{16}\b/g,
+	/(?<=:\/\/)[^\s:/@]+:[^\s:/@]+(?=@)/g,
+	new RegExp(`"(?:${SECRET_KEYS})"\\s*:\\s*"(?!\\[(?:redacted|REDACTED)\\]")(?:[^"\\\\\\r\\n]|\\\\.)*"`, "gi"),
+	new RegExp(`'(?:${SECRET_KEYS})'\\s*:\\s*'(?!\\[(?:redacted|REDACTED)\\]')(?:[^'\\\\\\r\\n]|\\\\.)*'`, "gi"),
+	new RegExp(`\\b(?:${SECRET_KEYS})\\s*[:=]\\s*\\S+`, "gi")
+];
+function scrubSecretsInText(input) {
+	let out = input;
+	for (const pattern of SECRET_VALUE_PATTERNS) out = out.replace(pattern, "[REDACTED]");
+	return out;
+}
+
+//#endregion
+export { SECRET_KEYS, SECRET_VALUE_PATTERNS, scrubSecretsInText };
+//# sourceMappingURL=scrub-secrets.mjs.map

package/dist/scrub-secrets.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"scrub-secrets.mjs","names":["SECRET_VALUE_PATTERNS: readonly RegExp[]"],"sources":["../src/scrub-secrets.ts"],"sourcesContent":["/**\n * Replace common credential patterns in free-form text with `[REDACTED]`.\n *\n * Used before persisting or transmitting user-supplied text (telemetry\n * excerpts, eval report HTML, free-form feedback) where keys/tokens\n * accidentally pasted into prompts or command lines could otherwise leak\n * downstream.\n *\n * Conservative by design: matches well-known prefixed tokens, explicit\n * `key=value` pairs, and quoted JSON/JS-object fields with sensitive\n * names. We don't attempt to redact arbitrary long opaque strings — false\n * positives on file paths, IDs, or base64 payloads would make the output\n * unreadable.\n */\nexport const SECRET_KEYS =\n\t'password|passwd|secret|credentials?|api[_-]?key|authorization|access[_-]?token|refresh[_-]?token|id[_-]?token|session[_-]?token|auth[_-]?token';\n\nexport const SECRET_VALUE_PATTERNS: readonly RegExp[] = [\n\t// PEM private-key blocks (RSA/EC/DSA/OpenSSH/PGP). Whole block, multiline.\n\t/-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----[\\s\\S]*?-----END (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----/g,\n\t// JWTs: `eyJ<header>.eyJ<payload>.<signature>` (both leading segments are\n\t// base64url of a `{\"` object, which makes this highly distinctive).\n\t/\\beyJ[A-Za-z0-9_-]+\\.eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+/g,\n\t// Authorization-header substrings: `Bearer <token>`, `Basic <token>`, `Token <token>`\n\t/\\b(?:Bearer|Basic|Token)\\s+[A-Za-z0-9._~+/=-]{12,}/gi,\n\t// OpenAI / Anthropic API keys\n\t/\\bsk-(?:ant-|proj-)?[A-Za-z0-9_-]{16,}/g,\n\t// Stripe secret/restricted/publishable keys (`sk_live_…`, `rk_test_…`, …)\n\t/\\b(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{16,}/g,\n\t// Google API keys\n\t/\\bAIza[0-9A-Za-z_-]{35}\\b/g,\n\t// Slack tokens (xoxb, xoxp, xoxa, xoxr, xoxs, xoxo)\n\t/\\bxox[abprso]-[A-Za-z0-9-]{10,}/g,\n\t// GitHub tokens (ghp, ghs, gho, ghr, ghu)\n\t/\\bgh[psoru]_[A-Za-z0-9]{20,}/g,\n\t// GitHub fine-grained personal access tokens\n\t/\\bgithub_pat_[A-Za-z0-9_]{22,}/g,\n\t// AWS access key id\n\t/\\bAKIA[0-9A-Z]{16}\\b/g,\n\t// Credentials embedded in a URL: `scheme://user:password@` — redact the userinfo.\n\t/(?<=:\\/\\/)[^\\s:/@]+:[^\\s:/@]+(?=@)/g,\n\t// JSON-shaped `\"key\": \"value\"` — matches the quoted field as a whole.\n\t// Run before the loose pattern so nested objects like\n\t// `{\"credentials\": {\"apiKey\": \"...\"}}` don't have the outer key consume\n\t// the inner key on its way to a non-quoted (object) value. The value\n\t// body uses the unrolled JSON-string idiom `(?:[^\"\\\\\\r\\n]|\\\\.)*`: the\n\t// negated class excludes the backslash so a backslash can only be consumed\n\t// by the `\\\\.` escape branch. Keep the two alternatives disjoint (don't\n\t// fold `\\\\` back into the negated class) — that keeps every run of\n\t// backslashes to a single, unambiguous parse, so matching stays fast on any\n\t// input. An escaped quote inside the value (`\"abc\\\"def\"`) still doesn't end\n\t// the match early, via the escape branch. The negative lookahead skips\n\t// values that are already a `[redacted]` / `[REDACTED]` placeholder so this\n\t// stays idempotent when chained behind upstream object-walking redaction\n\t// (e.g. langsmith trace payloads).\n\tnew RegExp(\n\t\t`\"(?:${SECRET_KEYS})\"\\\\s*:\\\\s*\"(?!\\\\[(?:redacted|REDACTED)\\\\]\")(?:[^\"\\\\\\\\\\\\r\\\\n]|\\\\\\\\.)*\"`,\n\t\t'gi',\n\t),\n\t// JS-object-shaped `'key': 'value'`\n\tnew RegExp(\n\t\t`'(?:${SECRET_KEYS})'\\\\s*:\\\\s*'(?!\\\\[(?:redacted|REDACTED)\\\\]')(?:[^'\\\\\\\\\\\\r\\\\n]|\\\\\\\\.)*'`,\n\t\t'gi',\n\t),\n\t// Generic `password=...` / `api_key=...` / `secret=...` style assignments\n\tnew RegExp(`\\\\b(?:${SECRET_KEYS})\\\\s*[:=]\\\\s*\\\\S+`, 'gi'),\n];\n\nexport function scrubSecretsInText(input: string): string {\n\tlet out = input;\n\tfor (const pattern of SECRET_VALUE_PATTERNS) {\n\t\tout = out.replace(pattern, '[REDACTED]');\n\t}\n\treturn out;\n}\n"],"mappings":";;;;;;;;;;;;;;;AAcA,MAAa,cACZ;AAED,MAAaA,wBAA2C;CAEvD;CAGA;CAEA;CAEA;CAEA;CAEA;CAEA;CAEA;CAEA;CAEA;CAEA;CAeA,IAAI,OACH,OAAO,YAAY,yEACnB,KACA;CAED,IAAI,OACH,OAAO,YAAY,yEACnB,KACA;CAED,IAAI,OAAO,SAAS,YAAY,oBAAoB,KAAK;CACzD;AAED,SAAgB,mBAAmB,OAAuB;CACzD,IAAI,MAAM;AACV,MAAK,MAAM,WAAW,sBACrB,OAAM,IAAI,QAAQ,SAAS,aAAa;AAEzC,QAAO"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@n8n/utils",
   "type": "module",
-  "version": "1.19.0",
+  "version": "1.20.1",
   "files": [
     "dist",
     "LICENSE.md",
@@ -32,11 +32,11 @@
     "@testing-library/user-event": "^14.6.1",
     "tsdown": "^0.16.5",
     "typescript": "5.9.2",
-    "vite": "npm:rolldown-vite@latest",
+    "vite": "npm:rolldown-vite@7.1.16",
     "vitest": "^3.1.3",
     "@n8n/eslint-config": "0.0.1",
-    "@n8n/typescript-config": "1.3.0",
-    "@n8n/vitest-config": "1.5.0"
+    "@n8n/vitest-config": "1.5.1",
+    "@n8n/typescript-config": "1.3.1"
   },
   "license": "SEE LICENSE IN LICENSE.md",
   "homepage": "https://n8n.io",
@@ -54,6 +54,7 @@
     "preview": "vite preview",
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
+    "test:unit": "vitest run",
     "test:dev": "vitest --silent=false",
     "lint": "eslint src --quiet",
     "lint:fix": "eslint src --fix",