@redact-secret/core 0.1.0-beta.1

package/dist/runtime/node.js

@@ -0,0 +1,122 @@
+/**
+ * The Node.js adapter: the N-API native addon, normalized to the internal
+ * binding contract (`decision-define-runtime-bindings`).
+ *
+ * The package's `imports` map reaches this module only under the `node`
+ * condition, so a browser build never resolves it and never pulls in the
+ * `node:` module below.
+ *
+ * Node's own loading has nothing to await, so `initialize()` here is a fast
+ * idempotent no-op in the addon. It stays part of the contract regardless, so
+ * the usage model does not vary by runtime.
+ */
+import { createRequire } from "node:module";
+import { SecretScanError } from "../errors.js";
+/**
+ * One `optionalDependencies` entry per `node-publish-targets`, published in
+ * lockstep with this package (`bindings/node/npm/<platform>/package.json`).
+ * `os`/`cpu`/`libc` on each of those manifests is what makes every
+ * non-matching entry optional in the literal npm sense: an install skips
+ * the ones that do not match instead of failing on them.
+ *
+ * `node-publish-targets` is six of the eight triples `napi.targets` builds
+ * and qualifies: npm ships glibc only
+ * (`decision-ship-first-release-artifact-set`), so the two musl triples have
+ * no entry here and no libc dimension below — there is nothing for one to
+ * select between. A musl host's `process.platform`/`process.arch` still
+ * matches the `linux` glibc entry, and each manifest's `libc` field is not
+ * reliably enforced by every npm version, so a musl install can still
+ * resolve and install the glibc package (`docs/qualification.md`).
+ * `loadAddon`'s `require` of a glibc-linked `.node` file then fails to load
+ * under a musl runtime, caught the same way a missing optional dependency
+ * on any platform is, reaching the same `INITIALIZATION_FAILED` an
+ * explicitly unsupported host gets. `scripts/check-artifact-matrix.py`
+ * requires this mapping, the six `bindings/node/npm/<platform>/package.json`
+ * manifests, and this package's own `optionalDependencies` to name exactly
+ * the same six packages.
+ */
+const PLATFORM_PACKAGES = {
+    darwin: {
+        arm64: "@redact-secret/node-darwin-arm64",
+        x64: "@redact-secret/node-darwin-x64",
+    },
+    linux: {
+        arm64: "@redact-secret/node-linux-arm64-gnu",
+        x64: "@redact-secret/node-linux-x64-gnu",
+    },
+    win32: {
+        arm64: "@redact-secret/node-win32-arm64-msvc",
+        x64: "@redact-secret/node-win32-x64-msvc",
+    },
+};
+/**
+ * The addon package this host should have installed, or `undefined` on a
+ * platform/architecture this package ships no addon for at all — the
+ * runtime fallback that keeps an unsupported host's failure identical to a
+ * supported host whose optional dependency did not install: both reach
+ * `loadAddon`'s own `INITIALIZATION_FAILED`, never a raw `require` error.
+ *
+ * Exported so `scripts/qualify-node-addon.mjs` and
+ * `scripts/qualify-package-consumer.mjs` compute the same host-to-package
+ * mapping this module actually loads from, instead of restating it.
+ */
+export function resolveAddonSpecifier() {
+    return PLATFORM_PACKAGES[process.platform]?.[process.arch];
+}
+function loadAddon() {
+    const specifier = resolveAddonSpecifier();
+    if (specifier === undefined) {
+        throw new SecretScanError("INITIALIZATION_FAILED");
+    }
+    const require = createRequire(import.meta.url);
+    let addon;
+    try {
+        addon = require(specifier);
+    }
+    catch {
+        // Not installed (an optional dependency npm skipped, or one that failed
+        // to install) and a corrupt addon both fail the same fixed way.
+        throw new SecretScanError("INITIALIZATION_FAILED");
+    }
+    for (const name of [
+        "version",
+        "initialize",
+        "scan",
+        "redact",
+        "scanAndRedact",
+    ]) {
+        if (typeof addon[name] !== "function") {
+            throw new SecretScanError("INITIALIZATION_FAILED");
+        }
+    }
+    return addon;
+}
+/**
+ * Builds the internal binding contract from an already-loaded addon.
+ *
+ * Exported so a test double can exercise this exact normalization —
+ * including the `createIncrementalSanitizer` fallback — without loading the
+ * real addon, the way `runtime/browser.ts`'s
+ * `createBindingFromWasmModule` does for the WebAssembly artifact.
+ */
+export function createBindingFromAddon(addon) {
+    return {
+        version: () => addon.version(),
+        initialize: () => {
+            addon.initialize();
+        },
+        scan: (input, policy) => addon.scan(input, policy),
+        redact: (input, findings, formatter) => addon.redact(input, findings, formatter),
+        scanAndRedact: (input, policy, formatter) => {
+            const result = addon.scanAndRedact(input, policy, formatter);
+            return { text: result.redacted, findings: result.findings };
+        },
+        createIncrementalSanitizer: (options) => {
+            if (typeof addon.createIncrementalSanitizer !== "function") {
+                throw new SecretScanError("INCREMENTAL_UNAVAILABLE");
+            }
+            return addon.createIncrementalSanitizer(options);
+        },
+    };
+}
+export const loadNativeBinding = async () => createBindingFromAddon(loadAddon());

package/dist/runtime.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The runtime-neutral half of the package: the initialization contract and
+ * the operations it gates.
+ *
+ * {@link createRedactSecretRuntime} takes the loader for one runtime and returns
+ * the public operations bound to it. `index.ts` supplies the loader the
+ * package's `imports` map selected; tests supply their own. Nothing here
+ * inspects the host, imports a `node:` module, or touches a global.
+ */
+import { type NativeBindingLoader } from "./native.js";
+import type { IncrementalSanitizer, IncrementalSanitizerOptions, RedactOptions, ScanAndRedactOptions, ScanOptions, ScanResult, SecretFinding } from "./types.js";
+export interface RedactSecretRuntime {
+    initialize(): Promise<void>;
+    scan(input: string, options?: ScanOptions): readonly SecretFinding[];
+    redact(input: string, findings: readonly SecretFinding[], options?: RedactOptions): string;
+    scanAndRedact(input: string, options?: ScanAndRedactOptions): ScanResult;
+    createIncrementalSanitizer(options: IncrementalSanitizerOptions): IncrementalSanitizer;
+}
+/**
+ * Binds the public operations to one runtime's loader.
+ *
+ * `initialize` is the whole lifecycle contract: it may be awaited any number
+ * of times from any number of call sites and loads at most once, it verifies
+ * that the loaded artifact reports this package's version
+ * (`decision-release-bindings-in-lockstep`), and every synchronous operation
+ * below fails with `NOT_INITIALIZED` until exactly one call has succeeded. A
+ * failed attempt is not cached: a caller may retry.
+ */
+export declare function createRedactSecretRuntime(loadNativeBinding: NativeBindingLoader): RedactSecretRuntime;

package/dist/runtime.js

@@ -0,0 +1,256 @@
+/**
+ * The runtime-neutral half of the package: the initialization contract and
+ * the operations it gates.
+ *
+ * {@link createRedactSecretRuntime} takes the loader for one runtime and returns
+ * the public operations bound to it. `index.ts` supplies the loader the
+ * package's `imports` map selected; tests supply their own. Nothing here
+ * inspects the host, imports a `node:` module, or touches a global.
+ */
+import { SecretScanError, toSecretScanError, } from "./errors.js";
+import { defaultPlaceholderFormatter } from "./formatters.js";
+import { NATIVE_HANDLE, } from "./native.js";
+import { VERSION } from "./version.js";
+/** Freezes the five documented fields a policy callback is allowed to see. */
+function toDetectedSecretFinding(finding) {
+    return Object.freeze({
+        id: finding.id,
+        type: finding.type,
+        detector: finding.detector,
+        confidence: finding.confidence,
+        start: finding.start,
+        end: finding.end,
+    });
+}
+/** Freezes the seven documented fields, preserving any binding handle. */
+function toSecretFinding(finding) {
+    const published = {
+        id: finding.id,
+        type: finding.type,
+        detector: finding.detector,
+        confidence: finding.confidence,
+        action: finding.action,
+        start: finding.start,
+        end: finding.end,
+    };
+    const handle = finding[NATIVE_HANDLE];
+    if (handle !== undefined) {
+        Object.defineProperty(published, NATIVE_HANDLE, {
+            value: handle,
+            enumerable: false,
+            writable: false,
+            configurable: false,
+        });
+    }
+    return Object.freeze(published);
+}
+function toSecretFindings(findings) {
+    return Object.freeze(findings.map(toSecretFinding));
+}
+/**
+ * Re-presents a public finding to the binding that produced it, carrying the
+ * binding handle back across when the finding has one.
+ *
+ * The WebAssembly binding's `redact` accepts only the opaque findings its own
+ * `scan` returned; that adapter rejects a finding that arrives without one
+ * rather than reinterpreting it. The Node addon reads the plain fields.
+ */
+function toNativeFinding(finding) {
+    const handle = finding[NATIVE_HANDLE];
+    if (handle === undefined)
+        return finding;
+    return { ...finding, [NATIVE_HANDLE]: handle };
+}
+/**
+ * Matches a JavaScript string containing a lone (unpaired) UTF-16 surrogate:
+ * a high surrogate not immediately followed by a low surrogate, or a low
+ * surrogate not immediately preceded by a high surrogate. Such a code unit
+ * has no UTF-8 representation, so it cannot cross into either binding's Rust
+ * `&str` (`errors.ts`'s `UNPAIRED_SURROGATE` documentation).
+ */
+const LONE_SURROGATE = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/;
+function requireString(value) {
+    if (typeof value !== "string")
+        throw new SecretScanError("INVALID_INPUT");
+    if (LONE_SURROGATE.test(value)) {
+        throw new SecretScanError("UNPAIRED_SURROGATE");
+    }
+    return value;
+}
+function toPolicyCallback(policy) {
+    if (policy === undefined)
+        return undefined;
+    if (typeof policy !== "object" || typeof policy.evaluate !== "function") {
+        throw new SecretScanError("INVALID_OPTIONS");
+    }
+    return (finding, context) => policy.evaluate(toDetectedSecretFinding(finding), context);
+}
+/**
+ * Routes the exported default formatter back to the binding's own built-in
+ * rather than calling across the boundary for every placeholder, so the
+ * default path stays exactly the core's.
+ */
+function toFormatterCallback(formatter) {
+    if (formatter === undefined || formatter === defaultPlaceholderFormatter) {
+        return undefined;
+    }
+    if (typeof formatter !== "function") {
+        throw new SecretScanError("INVALID_OPTIONS");
+    }
+    return (finding, context) => formatter(toSecretFinding(finding), context);
+}
+function toNativeIncrementalOptions(options) {
+    if (typeof options !== "object" || options === null) {
+        throw new SecretScanError("INVALID_OPTIONS");
+    }
+    const { limits, policy, placeholderFormatter } = options;
+    if (typeof limits !== "object" || limits === null) {
+        throw new SecretScanError("INVALID_LIMITS");
+    }
+    const formatter = toFormatterCallback(placeholderFormatter);
+    if (policy !== undefined &&
+        (typeof policy !== "object" || typeof policy.evaluate !== "function")) {
+        throw new SecretScanError("INVALID_OPTIONS");
+    }
+    const policyCallback = policy === undefined
+        ? undefined
+        : (finding, context) => policy.evaluate(toDetectedSecretFinding(finding), context);
+    return {
+        limits: {
+            maxInputCodeUnits: limits.maxInputCodeUnits,
+            maxBufferedCodeUnits: limits.maxBufferedCodeUnits,
+            maxTokenCodeUnits: limits.maxTokenCodeUnits,
+            maxMultilineCodeUnits: limits.maxMultilineCodeUnits,
+        },
+        ...(policyCallback === undefined ? {} : { policy: policyCallback }),
+        ...(formatter === undefined ? {} : { formatter }),
+    };
+}
+/**
+ * Binds the public operations to one runtime's loader.
+ *
+ * `initialize` is the whole lifecycle contract: it may be awaited any number
+ * of times from any number of call sites and loads at most once, it verifies
+ * that the loaded artifact reports this package's version
+ * (`decision-release-bindings-in-lockstep`), and every synchronous operation
+ * below fails with `NOT_INITIALIZED` until exactly one call has succeeded. A
+ * failed attempt is not cached: a caller may retry.
+ */
+export function createRedactSecretRuntime(loadNativeBinding) {
+    let binding;
+    let pending;
+    async function load() {
+        let loaded;
+        try {
+            loaded = await loadNativeBinding();
+            if (loaded.version() !== VERSION) {
+                throw new SecretScanError("INITIALIZATION_FAILED");
+            }
+            loaded.initialize();
+        }
+        catch (thrown) {
+            throw toSecretScanError(thrown, "INITIALIZATION_FAILED");
+        }
+        binding = loaded;
+    }
+    function initialize() {
+        if (binding !== undefined)
+            return Promise.resolve();
+        pending ??= load().finally(() => {
+            pending = undefined;
+        });
+        return pending;
+    }
+    function active() {
+        if (binding === undefined)
+            throw new SecretScanError("NOT_INITIALIZED");
+        return binding;
+    }
+    function scan(input, options) {
+        const native = active();
+        const text = requireString(input);
+        const policy = toPolicyCallback(options?.policy);
+        try {
+            return toSecretFindings(native.scan(text, policy));
+        }
+        catch (thrown) {
+            throw toSecretScanError(thrown, "DETECTOR_FAILURE");
+        }
+    }
+    function redact(input, findings, options) {
+        const native = active();
+        const text = requireString(input);
+        if (!Array.isArray(findings)) {
+            throw new SecretScanError("INVALID_FINDINGS");
+        }
+        const formatter = toFormatterCallback(options?.placeholderFormatter);
+        try {
+            return native.redact(text, findings.map(toNativeFinding), formatter);
+        }
+        catch (thrown) {
+            throw toSecretScanError(thrown, "INVALID_FINDINGS");
+        }
+    }
+    function scanAndRedact(input, options) {
+        const native = active();
+        const text = requireString(input);
+        const policy = toPolicyCallback(options?.policy);
+        const formatter = toFormatterCallback(options?.placeholderFormatter);
+        let result;
+        try {
+            result = native.scanAndRedact(text, policy, formatter);
+        }
+        catch (thrown) {
+            throw toSecretScanError(thrown, "DETECTOR_FAILURE");
+        }
+        return Object.freeze({
+            text: result.text,
+            findings: toSecretFindings(result.findings),
+        });
+    }
+    function createIncrementalSanitizer(options) {
+        const native = active();
+        let session;
+        try {
+            session = native.createIncrementalSanitizer(toNativeIncrementalOptions(options));
+        }
+        catch (thrown) {
+            throw toSecretScanError(thrown, "INVALID_LIMITS");
+        }
+        function run(operation, fallback) {
+            let result;
+            try {
+                result = operation();
+            }
+            catch (thrown) {
+                throw toSecretScanError(thrown, fallback);
+            }
+            return Object.freeze({
+                text: result.text,
+                findings: toSecretFindings(result.findings),
+            });
+        }
+        return Object.freeze({
+            get state() {
+                return session.state;
+            },
+            append: (chunk) => run(() => session.append(requireString(chunk)), "DETECTOR_FAILURE"),
+            finalize: () => run(() => session.finalize(), "DETECTOR_FAILURE"),
+            abort: () => {
+                try {
+                    session.abort();
+                }
+                catch (thrown) {
+                    throw toSecretScanError(thrown, "INVALID_STATE");
+                }
+            },
+        });
+    }
+    return {
+        initialize,
+        scan,
+        redact,
+        scanAndRedact,
+        createIncrementalSanitizer,
+    };
+}

package/dist/session.d.ts

@@ -0,0 +1,13 @@
+/**
+ * The one runtime this package binds for the host it is running on.
+ *
+ * `index.ts` and both stream adapters import this module rather than each
+ * building their own runtime, so a single `await initialize()` covers the
+ * whole public surface no matter which subpath a caller reached first. ESM
+ * evaluates this module once, so `dist/index.js` and
+ * `dist/adapters/node-stream.js` share the same loaded binding.
+ *
+ * Nothing here is part of the published API: the package's `exports` map does
+ * not reach this module.
+ */
+export declare const runtime: import("./runtime.js").RedactSecretRuntime;

package/dist/session.js

@@ -0,0 +1,15 @@
+/**
+ * The one runtime this package binds for the host it is running on.
+ *
+ * `index.ts` and both stream adapters import this module rather than each
+ * building their own runtime, so a single `await initialize()` covers the
+ * whole public surface no matter which subpath a caller reached first. ESM
+ * evaluates this module once, so `dist/index.js` and
+ * `dist/adapters/node-stream.js` share the same loaded binding.
+ *
+ * Nothing here is part of the published API: the package's `exports` map does
+ * not reach this module.
+ */
+import { loadNativeBinding } from "#native";
+import { createRedactSecretRuntime } from "./runtime.js";
+export const runtime = createRedactSecretRuntime(loadNativeBinding);

package/dist/types.d.ts

@@ -0,0 +1,117 @@
+/**
+ * The documented public type contract of `@redact-secret/core`.
+ *
+ * Every range in this file is a `[start, end)` pair of **UTF-16 code-unit**
+ * offsets into the JavaScript string that produced it, so `input.slice(start,
+ * end)` selects exactly the matched span (`decision-define-runtime-bindings`).
+ * The Rust core reports UTF-8 byte offsets; the Node and browser bindings
+ * convert them without changing the selected span.
+ *
+ * Custom detector callbacks are deliberately absent: every built-in detector
+ * runs in Rust, and the first stable extension surface is a policy and a
+ * placeholder formatter, both of which receive safe metadata only.
+ */
+/** The string-index unit every public range in this package uses. */
+export type RangeUnit = "utf16-code-units";
+/** How specific a detector considers a match. */
+export type SecretConfidence = "high" | "medium" | "low";
+/** What a policy decided to do with a finding. */
+export type SecretAction = "redact" | "block" | "warn" | "allow";
+/**
+ * A finding before policy evaluation: the safe metadata a policy callback
+ * receives. It never carries the input or the matched value.
+ */
+export interface DetectedSecretFinding {
+    /** Deterministic finding id (`finding-1`, `finding-2`, ...). */
+    readonly id: string;
+    /** Finding type, for example `"jwt"` or `"aws_access_key_id"`. */
+    readonly type: string;
+    /** Id of the detector that produced this finding. */
+    readonly detector: string;
+    readonly confidence: SecretConfidence;
+    /** Start offset, in UTF-16 code units. */
+    readonly start: number;
+    /** End offset (exclusive), in UTF-16 code units. */
+    readonly end: number;
+}
+/** A finding after policy evaluation: the shape {@link scan} returns. */
+export interface SecretFinding extends DetectedSecretFinding {
+    readonly action: SecretAction;
+}
+/** Position information passed alongside a finding to a policy. */
+export interface PolicyContext {
+    /** Zero-based position in the finalized detection list. */
+    readonly findingIndex: number;
+    /** Total number of finalized findings for the input. */
+    readonly findingCount: number;
+}
+/**
+ * A custom policy. It sees safe metadata only, never the input or a matched
+ * value. Omit it to use the built-in policy, which runs in Rust.
+ */
+export interface SecretPolicy {
+    evaluate(finding: DetectedSecretFinding, context: PolicyContext): SecretAction;
+}
+/** Position information passed to a placeholder formatter. */
+export interface PlaceholderContext {
+    /** One-based position among findings that are actually replaced. */
+    readonly placeholderIndex: number;
+}
+/**
+ * A custom placeholder formatter. It sees safe metadata only, and its result
+ * is validated: an empty, oversized, or matched-value-reproducing placeholder
+ * is rejected.
+ */
+export type PlaceholderFormatter = (finding: SecretFinding, context: PlaceholderContext) => string;
+export interface ScanOptions {
+    readonly policy?: SecretPolicy;
+}
+export interface RedactOptions {
+    readonly placeholderFormatter?: PlaceholderFormatter;
+}
+export interface ScanAndRedactOptions extends ScanOptions, RedactOptions {
+}
+/** Sanitized text alongside every finding that produced it. */
+export interface ScanResult {
+    readonly text: string;
+    readonly findings: readonly SecretFinding[];
+}
+/** The terminally distinct lifecycle states of an incremental session. */
+export type IncrementalSanitizerState = "accepting" | "finalized" | "aborted" | "failed";
+/** Position information passed alongside a finding to an incremental policy. */
+export interface IncrementalPolicyContext {
+    /** Zero-based position among findings finalized by this session. */
+    readonly findingIndex: number;
+}
+/** A custom policy for an incremental session. */
+export interface IncrementalSecretPolicy {
+    evaluate(finding: DetectedSecretFinding, context: IncrementalPolicyContext): SecretAction;
+}
+/**
+ * Explicit, positive UTF-16 code-unit limits every incremental session
+ * requires. There are no environment-derived or silent defaults.
+ */
+export interface IncrementalLimits {
+    readonly maxInputCodeUnits: number;
+    readonly maxBufferedCodeUnits: number;
+    readonly maxTokenCodeUnits: number;
+    readonly maxMultilineCodeUnits: number;
+}
+export interface IncrementalSanitizerOptions extends RedactOptions {
+    readonly limits: IncrementalLimits;
+    readonly policy?: IncrementalSecretPolicy;
+}
+/** Safe output and final findings produced by one session operation. */
+export interface IncrementalSanitizerResult extends ScanResult {
+}
+/**
+ * A bounded incremental session. `append` and `finalize` return only text and
+ * findings whose detection window is closed; findings carry absolute UTF-16
+ * offsets into the logical whole-session input.
+ */
+export interface IncrementalSanitizer {
+    readonly state: IncrementalSanitizerState;
+    append(chunk: string): IncrementalSanitizerResult;
+    finalize(): IncrementalSanitizerResult;
+    abort(): void;
+}

package/dist/types.js

@@ -0,0 +1,14 @@
+/**
+ * The documented public type contract of `@redact-secret/core`.
+ *
+ * Every range in this file is a `[start, end)` pair of **UTF-16 code-unit**
+ * offsets into the JavaScript string that produced it, so `input.slice(start,
+ * end)` selects exactly the matched span (`decision-define-runtime-bindings`).
+ * The Rust core reports UTF-8 byte offsets; the Node and browser bindings
+ * convert them without changing the selected span.
+ *
+ * Custom detector callbacks are deliberately absent: every built-in detector
+ * runs in Rust, and the first stable extension surface is a policy and a
+ * placeholder formatter, both of which receive safe metadata only.
+ */
+export {};

package/dist/version.d.ts

@@ -0,0 +1,8 @@
+/**
+ * The shared product version.
+ *
+ * The Rust crate, the npm package, the Python package, and the CLI carry one
+ * SemVer version per release (`decision-release-bindings-in-lockstep`), so
+ * `initialize()` refuses a binding artifact that reports a different one.
+ */
+export declare const VERSION = "0.1.0-beta.1";

package/dist/version.js

@@ -0,0 +1,8 @@
+/**
+ * The shared product version.
+ *
+ * The Rust crate, the npm package, the Python package, and the CLI carry one
+ * SemVer version per release (`decision-release-bindings-in-lockstep`), so
+ * `initialize()` refuses a binding artifact that reports a different one.
+ */
+export const VERSION = "0.1.0-beta.1";

package/package.json

@@ -0,0 +1,66 @@
+{
+  "name": "@redact-secret/core",
+  "description": "Deterministic secret detection and redaction for browser and server JavaScript/TypeScript applications.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/redact-secret/redact-secret.git",
+    "directory": "packages/javascript"
+  },
+  "homepage": "https://github.com/redact-secret/redact-secret#readme",
+  "bugs": {
+    "url": "https://github.com/redact-secret/redact-secret/issues"
+  },
+  "keywords": [
+    "secret-detection",
+    "redaction",
+    "security",
+    "browser",
+    "node"
+  ],
+  "type": "module",
+  "sideEffects": false,
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./node-stream": {
+      "types": "./dist/adapters/node-stream.d.ts",
+      "import": "./dist/adapters/node-stream.js"
+    },
+    "./web-stream": {
+      "types": "./dist/adapters/web-stream.d.ts",
+      "import": "./dist/adapters/web-stream.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "imports": {
+    "#native": {
+      "node": "./dist/runtime/node.js",
+      "browser": "./dist/runtime/browser.js",
+      "default": "./dist/runtime/browser.js"
+    }
+  },
+  "types": "./dist/index.d.ts",
+  "engines": {
+    "node": "20.x || 22.x || 24.x"
+  },
+  "version": "0.1.0-beta.1",
+  "dependencies": {
+    "@redact-secret/wasm": "0.1.0-beta.1"
+  },
+  "optionalDependencies": {
+    "@redact-secret/node-darwin-arm64": "0.1.0-beta.1",
+    "@redact-secret/node-darwin-x64": "0.1.0-beta.1",
+    "@redact-secret/node-linux-arm64-gnu": "0.1.0-beta.1",
+    "@redact-secret/node-linux-x64-gnu": "0.1.0-beta.1",
+    "@redact-secret/node-win32-arm64-msvc": "0.1.0-beta.1",
+    "@redact-secret/node-win32-x64-msvc": "0.1.0-beta.1"
+  }
+}