@redact-secret/core 0.1.0-beta.1 → 0.1.0-beta.2

package/README.md

@@ -119,16 +119,99 @@ names the finding type instead (`<JWT_1>`).
 
 ## Incremental and stream availability
 
-The current Node and WebAssembly artifacts do not build incremental sessions.
-After initialization, `createIncrementalSanitizer`, `createNodeStreamSanitizer`,
-and `createWebStreamSanitizer` fail with `INCREMENTAL_UNAVAILABLE` when using
-these artifacts. Whole-input operations remain supported.
+The Node artifact builds a real incremental session, wrapping the same core
+`IncrementalSanitizer` the Python binding does, and the browser (WebAssembly)
+artifact builds the same kind of session over the compiled WebAssembly
+module. `createIncrementalSanitizer` retains unresolved text until its
+detection window closes, then emits sanitized text and findings;
+concatenating every `append`/`finalize` result's text reconstructs the whole
+sanitized output. Findings carry absolute UTF-16 offsets into the logical
+whole-session input, so `input.slice(finding.start, finding.end)` selects the
+matched span, on every runtime. Do not scan chunks independently — a
+credential may cross a chunk boundary.
 
-The session types and stream subpaths are exported contracts, not evidence of
-runtime support. Adapter constructors accept a supplied session, but the
-package cannot create one with either current artifact. Use bounded whole-input
-scanning, or use Python, Rust, or CLI streaming. Do not scan chunks independently:
-a credential may cross a chunk boundary.
+```ts
+import { createIncrementalSanitizer, initialize } from "@redact-secret/core";
+
+await initialize();
+
+const limits = {
+  maxInputCodeUnits: 32_768,
+  maxBufferedCodeUnits: 16_512,
+  maxTokenCodeUnits: 8_192,
+  maxMultilineCodeUnits: 16_384,
+};
+const session = createIncrementalSanitizer({ limits });
+
+const first = session.append("api_key=SYNTHETIC_REVOKED_");
+const second = session.append("INCREMENTAL_VALUE\nordinary text");
+const final = session.finalize();
+
+const safeText = first.text + second.text + final.text;
+```
+
+The four limit fields keep their existing `CodeUnits` names for compatibility,
+but both artifacts enforce their values as UTF-8 byte ceilings in the Rust
+core. Findings and their `start`/`end` ranges still use UTF-16 code units.
+
+A session starts `accepting` and moves to the terminal `finalized` (one
+successful `finalize()`), `aborted` (`abort()`), or `failed` (a limit,
+detector, policy, or placeholder failure) state; every operation outside
+`accepting` throws `INVALID_STATE`, and every terminal transition discards
+whatever plaintext the session still retained.
+
+`@redact-secret/core/node-stream` wraps a session in a byte-to-byte Node
+`Transform`, finalizing it when the stream ends normally and aborting it on
+every other exit:
+
+```ts
+import { pipeline } from "node:stream/promises";
+
+import { initialize } from "@redact-secret/core";
+import { createNodeStreamSanitizer } from "@redact-secret/core/node-stream";
+
+await initialize();
+
+await pipeline(
+  process.stdin,
+  createNodeStreamSanitizer({
+    limits: {
+      maxInputCodeUnits: 32_768,
+      maxBufferedCodeUnits: 16_512,
+      maxTokenCodeUnits: 8_192,
+      maxMultilineCodeUnits: 16_384,
+    },
+  }),
+  process.stdout,
+);
+```
+
+`@redact-secret/core/web-stream` wraps a session in a byte-to-string Web
+`TransformStream`, finalizing it when the writable side closes normally and
+aborting it on every other exit:
+
+```ts
+import { initialize } from "@redact-secret/core";
+import { createWebStreamSanitizer } from "@redact-secret/core/web-stream";
+
+await initialize();
+
+declare const source: ReadableStream<Uint8Array>;
+declare const destination: WritableStream<string>;
+
+await source
+  .pipeThrough(
+    createWebStreamSanitizer({
+      limits: {
+        maxInputCodeUnits: 32_768,
+        maxBufferedCodeUnits: 16_512,
+        maxTokenCodeUnits: 8_192,
+        maxMultilineCodeUnits: 16_384,
+      },
+    }),
+  )
+  .pipeTo(destination);
+```
 
 See the [streaming guide](https://github.com/redact-secret/redact-secret/blob/main/docs/guides/streaming.md).
 
@@ -159,9 +242,8 @@ try {
 string may contain a lone UTF-16 surrogate, which has no UTF-8
 representation, so `scan`, `redact`, `scanAndRedact`, and an incremental
 sanitizer's `append` all reject one with this fixed code before it reaches
-either binding, identically on Node.js and in the browser — and
-`INCREMENTAL_UNAVAILABLE` from both current runtime adapters. Core failures
-are mapped to the same fixed error vocabulary.
+either binding, identically on Node.js and in the browser. Core failures are
+mapped to the same fixed error vocabulary.
 
 ## Public API
 

package/dist/adapters/shared.js

@@ -17,7 +17,10 @@
  */
 import { SecretScanError } from "../errors.js";
 export function createStreamSanitizerRuntime(session) {
-    const decoder = new TextDecoder("utf-8", { fatal: true });
+    const decoder = new TextDecoder("utf-8", {
+        fatal: true,
+        ignoreBOM: true,
+    });
     const findings = [];
     /** Idempotent, and safe after the session has already left `accepting`. */
     function abort() {
@@ -33,13 +36,23 @@ export function createStreamSanitizerRuntime(session) {
             throw new SecretScanError("INVALID_UTF8");
         }
     }
+    function accumulateFindings(next) {
+        try {
+            for (const finding of next)
+                findings.push(finding);
+        }
+        catch {
+            abort();
+            throw new SecretScanError("INVALID_STATE");
+        }
+    }
     function append(chunk) {
         if (!(chunk instanceof Uint8Array)) {
             abort();
             throw new SecretScanError("INVALID_CHUNK");
         }
         const result = session.append(decode(chunk, true));
-        findings.push(...result.findings);
+        accumulateFindings(result.findings);
         return result;
     }
     /**
@@ -61,7 +74,8 @@ export function createStreamSanitizerRuntime(session) {
             abort();
             throw error;
         }
-        findings.push(...decodedResult.findings, ...finalResult.findings);
+        accumulateFindings(decodedResult.findings);
+        accumulateFindings(finalResult.findings);
         return Object.freeze({
             text: decodedResult.text + finalResult.text,
             findings: Object.freeze([

package/dist/errors.d.ts

@@ -6,11 +6,8 @@
  * message (`decision-define-runtime-bindings`). Sixteen codes come from the
  * Rust core; `NOT_INITIALIZED` and `INITIALIZATION_FAILED` are produced by the
  * binding layer, `INVALID_CHUNK` and `INVALID_UTF8` by the stream adapters,
- * `UNPAIRED_SURROGATE` by this package's own runtime-neutral input check, and
- * `INCREMENTAL_UNAVAILABLE` by any binding that does not implement
- * incremental sanitization — the browser binding always (`bindings/wasm` has
- * no such export by design) and the Node binding until `bindings/node` gains
- * one; and this package normalizes all of them into the same class so
+ * `UNPAIRED_SURROGATE` by this package's own runtime-neutral input check. The
+ * package normalizes all of them into the same class so
  * `instanceof SecretScanError` holds on every runtime and every subpath.
  *
  * `UNPAIRED_SURROGATE` resolves `B/F-10`
@@ -24,7 +21,7 @@
  * Node and browser runtimes by construction rather than by parallel
  * implementation.
  */
-export type SecretScanErrorCode = "INVALID_INPUT" | "INVALID_OPTIONS" | "INVALID_DETECTOR" | "DETECTOR_FAILURE" | "INVALID_CANDIDATE" | "POLICY_FAILURE" | "INVALID_POLICY_ACTION" | "INVALID_FINDINGS" | "PLACEHOLDER_FAILURE" | "INVALID_PLACEHOLDER" | "INVALID_LIMITS" | "INPUT_LIMIT_EXCEEDED" | "BUFFER_LIMIT_EXCEEDED" | "TOKEN_LIMIT_EXCEEDED" | "MULTILINE_LIMIT_EXCEEDED" | "INVALID_STATE" | "NOT_INITIALIZED" | "INITIALIZATION_FAILED" | "INVALID_CHUNK" | "INVALID_UTF8" | "UNPAIRED_SURROGATE" | "INCREMENTAL_UNAVAILABLE";
+export type SecretScanErrorCode = "INVALID_INPUT" | "INVALID_OPTIONS" | "INVALID_DETECTOR" | "DETECTOR_FAILURE" | "INVALID_CANDIDATE" | "POLICY_FAILURE" | "INVALID_POLICY_ACTION" | "INVALID_FINDINGS" | "PLACEHOLDER_FAILURE" | "INVALID_PLACEHOLDER" | "INVALID_LIMITS" | "INPUT_LIMIT_EXCEEDED" | "BUFFER_LIMIT_EXCEEDED" | "TOKEN_LIMIT_EXCEEDED" | "MULTILINE_LIMIT_EXCEEDED" | "INVALID_STATE" | "NOT_INITIALIZED" | "INITIALIZATION_FAILED" | "INVALID_CHUNK" | "INVALID_UTF8" | "UNPAIRED_SURROGATE";
 /** A sanitized failure. It carries nothing but its fixed code and message. */
 export declare class SecretScanError extends Error {
     readonly code: SecretScanErrorCode;

package/dist/errors.js

@@ -6,11 +6,8 @@
  * message (`decision-define-runtime-bindings`). Sixteen codes come from the
  * Rust core; `NOT_INITIALIZED` and `INITIALIZATION_FAILED` are produced by the
  * binding layer, `INVALID_CHUNK` and `INVALID_UTF8` by the stream adapters,
- * `UNPAIRED_SURROGATE` by this package's own runtime-neutral input check, and
- * `INCREMENTAL_UNAVAILABLE` by any binding that does not implement
- * incremental sanitization — the browser binding always (`bindings/wasm` has
- * no such export by design) and the Node binding until `bindings/node` gains
- * one; and this package normalizes all of them into the same class so
+ * `UNPAIRED_SURROGATE` by this package's own runtime-neutral input check. The
+ * package normalizes all of them into the same class so
  * `instanceof SecretScanError` holds on every runtime and every subpath.
  *
  * `UNPAIRED_SURROGATE` resolves `B/F-10`
@@ -47,7 +44,6 @@ const ERROR_MESSAGES = {
     INVALID_CHUNK: "Stream sanitizer input must contain bytes.",
     INVALID_UTF8: "Stream sanitizer input is not valid UTF-8.",
     UNPAIRED_SURROGATE: "Secret scan input contains an unpaired UTF-16 surrogate.",
-    INCREMENTAL_UNAVAILABLE: "Incremental sanitization is not available on this runtime.",
 };
 const ERROR_CODES = new Set(Object.keys(ERROR_MESSAGES));
 /** A sanitized failure. It carries nothing but its fixed code and message. */

package/dist/runtime/browser.d.ts

@@ -12,11 +12,13 @@
  * binding's own idempotent `initialize()` that builds the detector registry.
  * Wrapping both is exactly this adapter's job.
  *
- * `bindings/wasm` does not export a `createIncrementalSanitizer` (see its
- * `README.md`): incremental sanitization is deliberately unavailable on this
- * runtime, so this adapter's `createIncrementalSanitizer` always rejects with
- * the fixed `INCREMENTAL_UNAVAILABLE` code. `./web-stream` rejects the same
- * way, through this same binding, and `initialize()` itself still resolves.
+ * `bindings/wasm` exports a real `createIncrementalSanitizer`
+ * (`decision-define-runtime-bindings`): it builds a bounded
+ * `IncrementalSanitizer` session, wrapping the same core session
+ * `bindings/node` and `bindings/python` wrap, with an explicit
+ * `accepting`/`finalized`/`aborted`/`failed` lifecycle and absolute UTF-16
+ * ranges converted chunk by chunk. `./web-stream` reaches it through this
+ * same binding.
  */
 import { type NativeBinding } from "../native.js";
 import type { PlaceholderContext, PolicyContext } from "../types.js";
@@ -58,6 +60,23 @@ export interface WasmFindingMetadata extends WasmDetectedFindingMetadata {
 }
 type WasmPolicyCallback = (finding: WasmDetectedFindingMetadata, context: PolicyContext) => string;
 type WasmFormatterCallback = (finding: WasmFindingMetadata, context: PlaceholderContext) => string;
+/** The position information an incremental policy callback receives. */
+export interface WasmIncrementalPolicyContext {
+    readonly findingIndex: number;
+}
+type WasmIncrementalPolicyCallback = (finding: WasmDetectedFindingMetadata, context: WasmIncrementalPolicyContext) => string;
+/** The result of one incremental `append`/`finalize` call. */
+export interface WasmIncrementalResult {
+    readonly text: string;
+    readonly findings: readonly WasmFinding[];
+}
+/** The `IncrementalSanitizer` class `createIncrementalSanitizer` returns. */
+export interface WasmIncrementalSanitizer {
+    readonly state: string;
+    append(chunk: string): WasmIncrementalResult;
+    finalize(): WasmIncrementalResult;
+    abort(): void;
+}
 export interface WasmModule {
     default(): Promise<unknown>;
     version(): string;
@@ -68,15 +87,16 @@ export interface WasmModule {
         readonly text: string;
         readonly findings: readonly WasmFinding[];
     };
+    createIncrementalSanitizer(maxInputCodeUnits: number, maxBufferedCodeUnits: number, maxTokenCodeUnits: number, maxMultilineCodeUnits: number, policy?: WasmIncrementalPolicyCallback, formatter?: WasmFormatterCallback): WasmIncrementalSanitizer;
 }
 /**
  * Builds the internal binding contract from an already-loaded WebAssembly
  * module.
  *
  * Exported so a test double can exercise this exact normalization — the
- * nested-metadata flattening above and the fixed `INCREMENTAL_UNAVAILABLE`
- * rejection below — against a fake module shaped like the real artifact,
- * without loading the artifact itself.
+ * nested-metadata flattening above and the incremental session wiring below
+ * — against a fake module shaped like the real artifact, without loading the
+ * artifact itself.
  */
 export declare function createBindingFromWasmModule(wasm: WasmModule): NativeBinding;
 export declare const loadNativeBinding: () => Promise<NativeBinding>;

package/dist/runtime/browser.js

@@ -12,11 +12,13 @@
  * binding's own idempotent `initialize()` that builds the detector registry.
  * Wrapping both is exactly this adapter's job.
  *
- * `bindings/wasm` does not export a `createIncrementalSanitizer` (see its
- * `README.md`): incremental sanitization is deliberately unavailable on this
- * runtime, so this adapter's `createIncrementalSanitizer` always rejects with
- * the fixed `INCREMENTAL_UNAVAILABLE` code. `./web-stream` rejects the same
- * way, through this same binding, and `initialize()` itself still resolves.
+ * `bindings/wasm` exports a real `createIncrementalSanitizer`
+ * (`decision-define-runtime-bindings`): it builds a bounded
+ * `IncrementalSanitizer` session, wrapping the same core session
+ * `bindings/node` and `bindings/python` wrap, with an explicit
+ * `accepting`/`finalized`/`aborted`/`failed` lifecycle and absolute UTF-16
+ * ranges converted chunk by chunk. `./web-stream` reaches it through this
+ * same binding.
  */
 import { SecretScanError } from "../errors.js";
 import { NATIVE_HANDLE, } from "../native.js";
@@ -84,6 +86,17 @@ function toWasmFormatterCallback(formatter) {
         return undefined;
     return (finding, context) => formatter(toNativeFormatterMetadata(finding), context);
 }
+function toWasmIncrementalPolicyCallback(policy) {
+    if (policy === undefined)
+        return undefined;
+    return (finding, context) => policy(toNativeDetectedFinding(finding), context);
+}
+function toNativeIncrementalResult(result) {
+    return {
+        text: result.text,
+        findings: result.findings.map(toNativeFinding),
+    };
+}
 /**
  * Loads the WebAssembly artifact published in lockstep with this package.
  *
@@ -100,6 +113,7 @@ async function loadWasmModule() {
         "scan",
         "redact",
         "scanAndRedact",
+        "createIncrementalSanitizer",
     ]) {
         if (typeof module[name] !== "function") {
             throw new SecretScanError("INITIALIZATION_FAILED");
@@ -112,9 +126,9 @@ async function loadWasmModule() {
  * module.
  *
  * Exported so a test double can exercise this exact normalization — the
- * nested-metadata flattening above and the fixed `INCREMENTAL_UNAVAILABLE`
- * rejection below — against a fake module shaped like the real artifact,
- * without loading the artifact itself.
+ * nested-metadata flattening above and the incremental session wiring below
+ * — against a fake module shaped like the real artifact, without loading the
+ * artifact itself.
  */
 export function createBindingFromWasmModule(wasm) {
     return {
@@ -131,8 +145,18 @@ export function createBindingFromWasmModule(wasm) {
                 findings: result.findings.map(toNativeFinding),
             };
         },
-        createIncrementalSanitizer: () => {
-            throw new SecretScanError("INCREMENTAL_UNAVAILABLE");
+        createIncrementalSanitizer: (options) => {
+            const session = wasm.createIncrementalSanitizer(options.limits.maxInputCodeUnits, options.limits.maxBufferedCodeUnits, options.limits.maxTokenCodeUnits, options.limits.maxMultilineCodeUnits, toWasmIncrementalPolicyCallback(options.policy), toWasmFormatterCallback(options.formatter));
+            return {
+                get state() {
+                    return session.state;
+                },
+                append: (chunk) => toNativeIncrementalResult(session.append(chunk)),
+                finalize: () => toNativeIncrementalResult(session.finalize()),
+                abort: () => {
+                    session.abort();
+                },
+            };
         },
     };
 }

package/dist/runtime/node.d.ts

@@ -16,11 +16,10 @@ import type { NativeBinding, NativeFinding, NativeFormatterCallback, NativeIncre
  * which this adapter renames to the contract's `text`; everything else is
  * already the documented UTF-16 shape.
  *
- * `createIncrementalSanitizer` is optional: `bindings/node` does not implement
- * it yet (unlike `bindings/python`, which wraps the same core
- * `IncrementalSanitizer`), so this adapter treats its absence the same way
- * `runtime/browser.ts` treats `bindings/wasm`'s documented non-support —
- * `INCREMENTAL_UNAVAILABLE` at call time, not a load-time failure.
+ * Incremental sanitization is part of the artifact contract. A package and
+ * platform addon are released in lockstep, so an addon without that export is
+ * an invalid installation and fails initialization with the other missing
+ * required exports.
  */
 interface NodeAddon {
     version(): string;
@@ -31,7 +30,7 @@ interface NodeAddon {
         readonly findings: readonly NativeFinding[];
         readonly redacted: string;
     };
-    createIncrementalSanitizer?(options: NativeIncrementalOptions): NativeIncrementalSanitizer;
+    createIncrementalSanitizer(options: NativeIncrementalOptions): NativeIncrementalSanitizer;
 }
 /**
  * The addon package this host should have installed, or `undefined` on a
@@ -48,9 +47,8 @@ export declare function resolveAddonSpecifier(): string | undefined;
 /**
  * Builds the internal binding contract from an already-loaded addon.
  *
- * Exported so a test double can exercise this exact normalization —
- * including the `createIncrementalSanitizer` fallback — without loading the
- * real addon, the way `runtime/browser.ts`'s
+ * Exported so a test double can exercise this exact normalization without
+ * loading the real addon, the way `runtime/browser.ts`'s
  * `createBindingFromWasmModule` does for the WebAssembly artifact.
  */
 export declare function createBindingFromAddon(addon: NodeAddon): NativeBinding;

package/dist/runtime/node.js

@@ -84,6 +84,7 @@ function loadAddon() {
         "scan",
         "redact",
         "scanAndRedact",
+        "createIncrementalSanitizer",
     ]) {
         if (typeof addon[name] !== "function") {
             throw new SecretScanError("INITIALIZATION_FAILED");
@@ -94,9 +95,8 @@ function loadAddon() {
 /**
  * Builds the internal binding contract from an already-loaded addon.
  *
- * Exported so a test double can exercise this exact normalization —
- * including the `createIncrementalSanitizer` fallback — without loading the
- * real addon, the way `runtime/browser.ts`'s
+ * Exported so a test double can exercise this exact normalization without
+ * loading the real addon, the way `runtime/browser.ts`'s
  * `createBindingFromWasmModule` does for the WebAssembly artifact.
  */
 export function createBindingFromAddon(addon) {
@@ -111,12 +111,7 @@ export function createBindingFromAddon(addon) {
             const result = addon.scanAndRedact(input, policy, formatter);
             return { text: result.redacted, findings: result.findings };
         },
-        createIncrementalSanitizer: (options) => {
-            if (typeof addon.createIncrementalSanitizer !== "function") {
-                throw new SecretScanError("INCREMENTAL_UNAVAILABLE");
-            }
-            return addon.createIncrementalSanitizer(options);
-        },
+        createIncrementalSanitizer: (options) => addon.createIncrementalSanitizer(options),
     };
 }
 export const loadNativeBinding = async () => createBindingFromAddon(loadAddon());

package/dist/runtime.js

@@ -217,6 +217,13 @@ export function createRedactSecretRuntime(loadNativeBinding) {
         catch (thrown) {
             throw toSecretScanError(thrown, "INVALID_LIMITS");
         }
+        // Host validation cannot reach the core; abort releases its buffer and index.
+        let inputFailed = false;
+        function requireAccepting() {
+            if (inputFailed || session.state !== "accepting") {
+                throw new SecretScanError("INVALID_STATE");
+            }
+        }
         function run(operation, fallback) {
             let result;
             try {
@@ -232,11 +239,31 @@ export function createRedactSecretRuntime(loadNativeBinding) {
         }
         return Object.freeze({
             get state() {
-                return session.state;
+                return inputFailed ? "failed" : session.state;
+            },
+            append: (chunk) => {
+                requireAccepting();
+                let text;
+                try {
+                    text = requireString(chunk);
+                }
+                catch (thrown) {
+                    inputFailed = true;
+                    try {
+                        session.abort();
+                    }
+                    finally {
+                        throw toSecretScanError(thrown, "INVALID_INPUT");
+                    }
+                }
+                return run(() => session.append(text), "DETECTOR_FAILURE");
+            },
+            finalize: () => {
+                requireAccepting();
+                return run(() => session.finalize(), "DETECTOR_FAILURE");
             },
-            append: (chunk) => run(() => session.append(requireString(chunk)), "DETECTOR_FAILURE"),
-            finalize: () => run(() => session.finalize(), "DETECTOR_FAILURE"),
             abort: () => {
+                requireAccepting();
                 try {
                     session.abort();
                 }

package/dist/types.d.ts

@@ -92,9 +92,13 @@ export interface IncrementalSecretPolicy {
  * requires. There are no environment-derived or silent defaults.
  */
 export interface IncrementalLimits {
+    /** UTF-8 byte ceiling; the legacy field name is retained for compatibility. */
     readonly maxInputCodeUnits: number;
+    /** UTF-8 byte ceiling; the legacy field name is retained for compatibility. */
     readonly maxBufferedCodeUnits: number;
+    /** UTF-8 byte ceiling; the legacy field name is retained for compatibility. */
     readonly maxTokenCodeUnits: number;
+    /** UTF-8 byte ceiling; the legacy field name is retained for compatibility. */
     readonly maxMultilineCodeUnits: number;
 }
 export interface IncrementalSanitizerOptions extends RedactOptions {

package/dist/version.d.ts

@@ -5,4 +5,4 @@
  * SemVer version per release (`decision-release-bindings-in-lockstep`), so
  * `initialize()` refuses a binding artifact that reports a different one.
  */
-export declare const VERSION = "0.1.0-beta.1";
+export declare const VERSION = "0.1.0-beta.2";

package/dist/version.js

@@ -5,4 +5,4 @@
  * SemVer version per release (`decision-release-bindings-in-lockstep`), so
  * `initialize()` refuses a binding artifact that reports a different one.
  */
-export const VERSION = "0.1.0-beta.1";
+export const VERSION = "0.1.0-beta.2";

package/package.json

@@ -51,16 +51,16 @@
   "engines": {
     "node": "20.x || 22.x || 24.x"
   },
-  "version": "0.1.0-beta.1",
+  "version": "0.1.0-beta.2",
   "dependencies": {
-    "@redact-secret/wasm": "0.1.0-beta.1"
+    "@redact-secret/wasm": "0.1.0-beta.2"
   },
   "optionalDependencies": {
-    "@redact-secret/node-darwin-arm64": "0.1.0-beta.1",
-    "@redact-secret/node-darwin-x64": "0.1.0-beta.1",
-    "@redact-secret/node-linux-arm64-gnu": "0.1.0-beta.1",
-    "@redact-secret/node-linux-x64-gnu": "0.1.0-beta.1",
-    "@redact-secret/node-win32-arm64-msvc": "0.1.0-beta.1",
-    "@redact-secret/node-win32-x64-msvc": "0.1.0-beta.1"
+    "@redact-secret/node-darwin-arm64": "0.1.0-beta.2",
+    "@redact-secret/node-darwin-x64": "0.1.0-beta.2",
+    "@redact-secret/node-linux-arm64-gnu": "0.1.0-beta.2",
+    "@redact-secret/node-linux-x64-gnu": "0.1.0-beta.2",
+    "@redact-secret/node-win32-arm64-msvc": "0.1.0-beta.2",
+    "@redact-secret/node-win32-x64-msvc": "0.1.0-beta.2"
   }
 }