@socprime/logtotal-sanitizer 0.0.1-beta.0

package/cli.js

@@ -0,0 +1,3431 @@
+#!/usr/bin/env node
+import { realpathSync, createReadStream, createWriteStream } from 'fs';
+import { readFile, stat, writeFile } from 'fs/promises';
+import { join, dirname, basename } from 'path';
+import 'stream';
+import { fileURLToPath, pathToFileURL } from 'url';
+import { parseArgs } from 'util';
+import { once } from 'events';
+import { finished } from 'stream/promises';
+
+// src/core/constants.ts
+var DEFAULT_PREVIEW_BYTES = 256 * 1024;
+var DEFAULT_MAX_LINE_CHARS = 1024 * 1024;
+var DEFAULT_LINE_OVERLAP_CHARS = 1024;
+var DEFAULT_KEY_BYTES = 32;
+var MASK_TOKEN_PREFIX = "R";
+var ALWAYS_REDACT_RULE_ID = "custom";
+var ALWAYS_REDACT_TOKEN = "CUSTOM";
+
+// src/core/errors.ts
+var ERROR_BRAND = /* @__PURE__ */ Symbol.for("@socprime/logtotal-sanitizer/error");
+var SanitizerError = class extends Error {
+  /** Machine-readable cause, stable across releases. */
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "SanitizerError";
+    this.code = code;
+    Object.defineProperty(this, ERROR_BRAND, { value: true, enumerable: false });
+  }
+};
+var InvalidRuleError = class extends SanitizerError {
+  constructor(message) {
+    super("INVALID_RULE", message);
+    this.name = "InvalidRuleError";
+  }
+};
+var UnknownRuleError = class extends SanitizerError {
+  constructor(message) {
+    super("UNKNOWN_RULE", message);
+    this.name = "UnknownRuleError";
+  }
+};
+var InvalidKeyError = class extends SanitizerError {
+  constructor(message) {
+    super("INVALID_KEY", message);
+    this.name = "InvalidKeyError";
+  }
+};
+var InvalidOptionError = class extends SanitizerError {
+  constructor(message) {
+    super("INVALID_OPTION", message);
+    this.name = "InvalidOptionError";
+  }
+};
+var SanitizationAbortedError = class extends SanitizerError {
+  constructor(message = "Sanitization was aborted.") {
+    super("ABORTED", message);
+    this.name = "SanitizationAbortedError";
+  }
+};
+
+// src/core/hmac.ts
+var BLOCK_BYTES = 64;
+var DIGEST_BYTES = 32;
+var K = new Uint32Array([
+  1116352408,
+  1899447441,
+  3049323471,
+  3921009573,
+  961987163,
+  1508970993,
+  2453635748,
+  2870763221,
+  3624381080,
+  310598401,
+  607225278,
+  1426881987,
+  1925078388,
+  2162078206,
+  2614888103,
+  3248222580,
+  3835390401,
+  4022224774,
+  264347078,
+  604807628,
+  770255983,
+  1249150122,
+  1555081692,
+  1996064986,
+  2554220882,
+  2821834349,
+  2952996808,
+  3210313671,
+  3336571891,
+  3584528711,
+  113926993,
+  338241895,
+  666307205,
+  773529912,
+  1294757372,
+  1396182291,
+  1695183700,
+  1986661051,
+  2177026350,
+  2456956037,
+  2730485921,
+  2820302411,
+  3259730800,
+  3345764771,
+  3516065817,
+  3600352804,
+  4094571909,
+  275423344,
+  430227734,
+  506948616,
+  659060556,
+  883997877,
+  958139571,
+  1322822218,
+  1537002063,
+  1747873779,
+  1955562222,
+  2024104815,
+  2227730452,
+  2361852424,
+  2428436474,
+  2756734187,
+  3204031479,
+  3329325298
+]);
+var INITIAL_STATE = new Uint32Array([
+  1779033703,
+  3144134277,
+  1013904242,
+  2773480762,
+  1359893119,
+  2600822924,
+  528734635,
+  1541459225
+]);
+function rotr(value, bits) {
+  return (value >>> bits | value << 32 - bits) >>> 0;
+}
+function concatBytes(a, b) {
+  const out = new Uint8Array(a.length + b.length);
+  out.set(a, 0);
+  out.set(b, a.length);
+  return out;
+}
+function padMessage(message) {
+  const bitLength = message.length * 8;
+  const paddedLength = Math.ceil((message.length + 9) / BLOCK_BYTES) * BLOCK_BYTES;
+  const padded = new Uint8Array(paddedLength);
+  padded.set(message);
+  padded[message.length] = 128;
+  const view = new DataView(padded.buffer);
+  view.setUint32(paddedLength - 8, Math.floor(bitLength / 2 ** 32), false);
+  view.setUint32(paddedLength - 4, bitLength >>> 0, false);
+  return padded;
+}
+function sha256(message) {
+  const padded = padMessage(message);
+  const view = new DataView(padded.buffer);
+  const state = Uint32Array.from(INITIAL_STATE);
+  const w = new Uint32Array(64);
+  for (let offset = 0; offset < padded.length; offset += BLOCK_BYTES) {
+    for (let i = 0; i < 16; i += 1) {
+      w[i] = view.getUint32(offset + i * 4, false);
+    }
+    for (let i = 16; i < 64; i += 1) {
+      const s0 = rotr(w[i - 15], 7) ^ rotr(w[i - 15], 18) ^ w[i - 15] >>> 3;
+      const s1 = rotr(w[i - 2], 17) ^ rotr(w[i - 2], 19) ^ w[i - 2] >>> 10;
+      w[i] = w[i - 16] + s0 + w[i - 7] + s1 >>> 0;
+    }
+    let a = state[0];
+    let b = state[1];
+    let c = state[2];
+    let d = state[3];
+    let e = state[4];
+    let f = state[5];
+    let g = state[6];
+    let h = state[7];
+    for (let i = 0; i < 64; i += 1) {
+      const s1 = rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25);
+      const ch = e & f ^ ~e & g;
+      const temp1 = h + s1 + ch + K[i] + w[i] >>> 0;
+      const s0 = rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22);
+      const maj = a & b ^ a & c ^ b & c;
+      const temp2 = s0 + maj >>> 0;
+      h = g;
+      g = f;
+      f = e;
+      e = d + temp1 >>> 0;
+      d = c;
+      c = b;
+      b = a;
+      a = temp1 + temp2 >>> 0;
+    }
+    state[0] = state[0] + a >>> 0;
+    state[1] = state[1] + b >>> 0;
+    state[2] = state[2] + c >>> 0;
+    state[3] = state[3] + d >>> 0;
+    state[4] = state[4] + e >>> 0;
+    state[5] = state[5] + f >>> 0;
+    state[6] = state[6] + g >>> 0;
+    state[7] = state[7] + h >>> 0;
+  }
+  const digest = new Uint8Array(DIGEST_BYTES);
+  const digestView = new DataView(digest.buffer);
+  for (let i = 0; i < 8; i += 1) {
+    digestView.setUint32(i * 4, state[i], false);
+  }
+  return digest;
+}
+function normalizeKey(key) {
+  const hashed = key.length > BLOCK_BYTES ? sha256(key) : key;
+  if (hashed.length === BLOCK_BYTES) {
+    return hashed;
+  }
+  const padded = new Uint8Array(BLOCK_BYTES);
+  padded.set(hashed);
+  return padded;
+}
+function createHmacSha256(key) {
+  const block = normalizeKey(key);
+  const ipad = new Uint8Array(BLOCK_BYTES);
+  const opad = new Uint8Array(BLOCK_BYTES);
+  for (let i = 0; i < BLOCK_BYTES; i += 1) {
+    ipad[i] = block[i] ^ 54;
+    opad[i] = block[i] ^ 92;
+  }
+  return (message) => sha256(concatBytes(opad, sha256(concatBytes(ipad, message))));
+}
+function hexToBytes(hex) {
+  const bytes = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < bytes.length; i += 1) {
+    bytes[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  }
+  return bytes;
+}
+function bytesToHex(bytes) {
+  return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+
+// src/core/key.ts
+var HEX_PATTERN = /^(?:[0-9a-fA-F]{2})+$/;
+function generateKey(byteLength = DEFAULT_KEY_BYTES) {
+  if (!Number.isInteger(byteLength) || byteLength < 16) {
+    throw new InvalidKeyError(`Key length must be an integer of at least 16 bytes, got ${byteLength}.`);
+  }
+  const source = globalThis.crypto;
+  if (typeof source?.getRandomValues !== "function") {
+    throw new InvalidKeyError(
+      "No secure random source available. Pass an explicit `key` or provide a Web Crypto implementation on globalThis.crypto."
+    );
+  }
+  const bytes = new Uint8Array(byteLength);
+  source.getRandomValues(bytes);
+  return bytesToHex(bytes);
+}
+function assertKey(key, encoding) {
+  if (key.length === 0) {
+    throw new InvalidKeyError("Key must not be empty.");
+  }
+  if (encoding === "hex" && !HEX_PATTERN.test(key)) {
+    throw new InvalidKeyError(
+      'A hex key must contain an even number of hexadecimal characters. Pass `keyEncoding: "utf8"` for a passphrase.'
+    );
+  }
+}
+
+// src/rules/alwaysRedact.ts
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function normalizeValues(values) {
+  const unique = new Set(values.map((value) => value.trim()).filter((value) => value.length > 0));
+  return [...unique].sort((left, right) => right.length - left.length || left.localeCompare(right));
+}
+function normalizePatterns(patterns) {
+  return patterns.map((pattern) => {
+    const source = typeof pattern === "string" ? pattern : pattern.source;
+    try {
+      new RegExp(source, "u");
+    } catch (cause) {
+      throw new InvalidOptionError(
+        `alwaysRedact.patterns contains an invalid regular expression: ${String(cause)}`
+      );
+    }
+    return `(?:${source})`;
+  });
+}
+function createAlwaysRedactRule(options) {
+  if (!options) {
+    return null;
+  }
+  const patterns = [
+    ...normalizeValues(options.values ?? []).map((value) => `(?:${escapeRegExp(value)})`),
+    ...normalizePatterns(options.patterns ?? [])
+  ];
+  if (patterns.length === 0) {
+    return null;
+  }
+  return {
+    id: options.ruleId ?? ALWAYS_REDACT_RULE_ID,
+    label: "Always redacted",
+    description: "Values and patterns the caller marked as always sensitive.",
+    mode: options.mode ?? "pseudo",
+    token: options.token ?? ALWAYS_REDACT_TOKEN,
+    patterns
+  };
+}
+
+// src/rules/definitions/geoLocation.ts
+function parseLatLonPair(match) {
+  const stripped = match.replace(/[()\s]/g, "");
+  if (!/^-?\d+\.\d+[,;]-?\d+\.\d+$/.test(stripped)) {
+    return null;
+  }
+  const [latStr, lonStr] = stripped.split(/[,;]/);
+  const lat = Number(latStr);
+  const lon = Number(lonStr);
+  if (!Number.isFinite(lat) || !Number.isFinite(lon)) {
+    return null;
+  }
+  return { lat, lon };
+}
+function isPlausibleLatLon(lat, lon) {
+  if (lat === 0 && lon === 0) {
+    return false;
+  }
+  return lat >= -90 && lat <= 90 && lon >= -180 && lon <= 180;
+}
+function validateGeo(match) {
+  const pair = parseLatLonPair(match);
+  if (pair) {
+    return isPlausibleLatLon(pair.lat, pair.lon);
+  }
+  return true;
+}
+var LAT_KEY = "(?:latitude|lat)";
+var LON_KEY = "(?:longitude|long|lon|lng)";
+var ZIP_KEY = "(?:zipCode|postalCode|postcode|zip)";
+var ADDR_KEY = "(?:addressLine1|address|street)";
+var OLC = "[23456789CFGHJMPQRVWXcfghjmpqrvwx]";
+var GEOHASH = "[0-9b-hjkmnp-zB-HJKMNP-Z]";
+var geoLocationRule = {
+  id: "geoLocation",
+  label: "Geo location",
+  description: "Coordinates, geohashes, plus codes, postcodes and context-anchored addresses become a stable <GEO:\u2026> token \u2014 the same value maps to the same token everywhere within a session.",
+  mode: "pseudo",
+  token: "GEO",
+  patterns: [
+    "(?:\\(\\s*-?\\d{1,3}\\.\\d{3,}\\s*[,;]\\s*-?\\d{1,3}\\.\\d{3,}\\s*\\))",
+    "(?:(?<![\\d.])-?\\d{1,3}\\.\\d{3,}\\s*[,;]\\s*-?\\d{1,3}\\.\\d{3,}(?!\\d))",
+    `(?:(?<=\\b${LAT_KEY}\\s*[=:]\\s*)-?\\d{1,3}\\.\\d+)`,
+    `(?:(?<=\\b${LON_KEY}\\s*[=:]\\s*)-?\\d{1,3}\\.\\d+)`,
+    `(?:(?<=\\bgeohash\\s*[=:]\\s*)${GEOHASH}{5,12}\\b)`,
+    `(?:(?<![\\w+])${OLC}{4,8}\\+${OLC}{2,3}(?![\\w+]))`,
+    `(?:\\b\\d{1,3}\xB0\\d{1,2}'\\d{1,2}(?:\\.\\d+)?"[NSEW]\\b)`,
+    "(?:\\b[A-Za-z]{1,2}\\d{1,2}[A-Za-z]?\\s\\d[A-Za-z]{2}\\b)",
+    `(?:(?<=\\b${ZIP_KEY}\\s*[=:]\\s*)\\d{5}(?:-\\d{4})?\\b)`
+  ],
+  aggressivePatterns: [
+    "(?:\\(\\s*-?\\d{1,3}\\.\\d{2,}\\s*[,;]\\s*-?\\d{1,3}\\.\\d{2,}\\s*\\))",
+    "(?:(?<![\\d.])-?\\d{1,3}\\.\\d{2,}\\s*[,;]\\s*-?\\d{1,3}\\.\\d{2,}(?!\\d))",
+    `(?:(?<=\\b${ADDR_KEY}\\s*[=:]\\s*)[^\\n"'<>]{5,80})`
+  ],
+  validate: validateGeo,
+  jsonKeys: [
+    "latitude",
+    "longitude",
+    "lat",
+    "lon",
+    "lng",
+    "long",
+    "coordinates",
+    "coords",
+    "geo",
+    "streetAddress",
+    "addressLine1",
+    "addressLine2",
+    "postalCode",
+    "postcode",
+    "zip",
+    "zipCode",
+    "geohash"
+  ]
+};
+
+// src/rules/definitions/govIdentifiers.ts
+function luhnCheck(digits) {
+  if (!/^\d+$/.test(digits) || /^0+$/.test(digits)) {
+    return false;
+  }
+  let sum = 0;
+  let doubleIt = false;
+  for (let i = digits.length - 1; i >= 0; i -= 1) {
+    let digit = Number(digits[i]);
+    if (doubleIt) {
+      digit *= 2;
+      if (digit > 9) {
+        digit -= 9;
+      }
+    }
+    sum += digit;
+    doubleIt = !doubleIt;
+  }
+  return sum % 10 === 0;
+}
+function isValidSsn(area, group, serial) {
+  if (area === "000" || area === "666" || area.startsWith("9")) {
+    return false;
+  }
+  return group !== "00" && serial !== "0000";
+}
+function isValidItin(area, group, serial) {
+  if (!area.startsWith("9") || serial === "0000") {
+    return false;
+  }
+  const groupNum = Number(group);
+  return groupNum >= 70 && groupNum <= 88 || groupNum >= 90 && groupNum <= 92 || groupNum >= 94 && groupNum <= 99;
+}
+function isValidNhs(digits) {
+  if (!/^\d{10}$/.test(digits) || /^0+$/.test(digits)) {
+    return false;
+  }
+  let sum = 0;
+  for (let i = 0; i < 9; i += 1) {
+    sum += Number(digits[i]) * (10 - i);
+  }
+  const remainder = sum % 11;
+  let check = 11 - remainder;
+  if (check === 11) {
+    check = 0;
+  }
+  if (check === 10) {
+    return false;
+  }
+  return check === Number(digits[9]);
+}
+function validateGovId(match) {
+  const dashed = /^(\d{3})-(\d{2})-(\d{4})$/.exec(match);
+  if (dashed?.[1] && dashed[2] && dashed[3]) {
+    return isValidSsn(dashed[1], dashed[2], dashed[3]) || isValidItin(dashed[1], dashed[2], dashed[3]);
+  }
+  if (/^\d{3}-\d{3}-\d{3}$/.test(match)) {
+    return luhnCheck(match.replace(/-/g, ""));
+  }
+  if (/^\d{3} \d{3} \d{4}$/.test(match)) {
+    return isValidNhs(match.replace(/ /g, ""));
+  }
+  const nhsPrefixed = /(?:NHS|nhs)(?:[_-]?number)?\s*[=:]\s*(\d{10})$/.exec(match);
+  const nhsDigits = nhsPrefixed?.[1];
+  if (nhsDigits) {
+    return isValidNhs(nhsDigits);
+  }
+  return true;
+}
+var SSN_CTX = "(?:[Ss][Ss][Nn]|[Ee][Ii][Nn]|[Ss][Ii][Nn]|tax[_-]?id|social[_ -]?security(?:[_ -]?number)?)";
+var ID_CTX = "(?:passport(?:_no|_number)?|driver[_-]?license|national[_-]?id|tax[_-]?id)";
+var govIdentifiersRule = {
+  id: "govIds",
+  label: "Government identifiers",
+  description: "Passport numbers, tax numbers, SSNs and similar IDs are redacted outright.",
+  mode: "mask",
+  token: "GOV_ID",
+  patterns: [
+    "(?:(?<![A-Z0-9<])P<[A-Z0-9<]{42}(?![A-Z0-9<]))",
+    "(?:\\b\\d{3}-\\d{2}-\\d{4}\\b)",
+    "(?:\\b\\d{3}-\\d{3}-\\d{3}\\b)",
+    "(?:\\b\\d{3} \\d{3} \\d{4}\\b)",
+    "(?:\\b(?:NHS|nhs)(?:[_-]?number)?\\s*[=:]\\s*\\d{10}\\b)",
+    "(?:\\b(?!BG|GB|NK|KN|TN|NT|ZZ)[A-CEGHJ-PR-TW-Z][A-CEGHJ-NPR-TW-Z]\\d{6}\\s?[A-D]\\b)",
+    "(?:(?<![A-Za-z0-9\u0410-\u042F\u0406\u0407\u0404\u0490\u0430-\u044F\u0456\u0457\u0454\u0491])[\u0410-\u042F\u0406\u0407\u0404\u0490]{2}\\d{6}\\b)",
+    `(?:(?<=\\b${SSN_CTX}\\s*[=:]?\\s*)\\d{9}\\b)`,
+    "(?:(?<=(?:\u0406\u041F\u041D|\u0420\u041D\u041E\u041A\u041F\u041F|tax[_-]?id)\\s*[=:]?\\s*)\\d{10}\\b)",
+    `(?:(?<=\\b${ID_CTX}\\s*[=:]\\s*)[A-Za-z0-9<]{5,32})`
+  ],
+  aggressivePatterns: [
+    "(?:\\b[A-Z]{1,2}\\d{6,9}\\b)",
+    "(?:\\b\\d{9,11}\\b)"
+  ],
+  validate: validateGovId,
+  jsonKeys: [
+    "ssn",
+    "passportNumber",
+    "taxId",
+    "nationalId",
+    "socialSecurityNumber",
+    "passport",
+    "nino",
+    "nhsNumber",
+    "driverLicense",
+    "licenseNumber",
+    "personalId",
+    "dob",
+    "dateOfBirth"
+  ]
+};
+
+// src/rules/definitions/healthInfo.ts
+function isValidDea(match) {
+  if (!/^[ABFGMPRX][A-Z9]\d{7}$/.test(match)) {
+    return false;
+  }
+  const digits = match.slice(2);
+  const sum = Number(digits[0]) + Number(digits[2]) + Number(digits[4]) + 2 * (Number(digits[1]) + Number(digits[3]) + Number(digits[5]));
+  return sum % 10 === Number(digits[6]);
+}
+function validateHealth(match) {
+  if (/^[ABFGMPRX][A-Z9]\d{7}$/.test(match)) {
+    return isValidDea(match);
+  }
+  return true;
+}
+var MRN_KEY = "(?:[Mm][Rr][Nn]|medical[_-]?record(?:[_-]?number)?)";
+var healthInfoRule = {
+  id: "healthInfo",
+  label: "Protected health information",
+  description: "PHI in SOC logs is almost always structured: JSON field names (diagnosis, medication, MRN, \u2026) carry most of the coverage. Freeform patterns only match context-anchored medical codes (ICD, SNOMED, LOINC, NDC, DEA, MRN).",
+  mode: "mask",
+  token: "PHI",
+  patterns: [
+    "(?:\\b(?:[Ii][Cc][Dd]-10|[Ii][Cc][Dd]10):?\\s*[A-Z]\\d{2}(?:\\.\\d{1,4})?\\b)",
+    "(?:\\b(?:[Ii][Cc][Dd]-9|[Ii][Cc][Dd]9):?\\s*(?:[VE]\\d{2,3}|\\d{3})(?:\\.\\d{1,2})?\\b)",
+    "(?:\\b(?:SNOMED(?:\\s*CT)?|[Ss]nomed(?:\\s*CT)?)[:\\s]+\\d{6,18}\\b)",
+    "(?:\\b(?:LOINC|[Ll]oinc)[:\\s]+\\d{1,5}-\\d\\b)",
+    "(?:\\b(?:NDC|[Nn]dc)[:\\s]+\\d{4,5}-\\d{3,4}-\\d{1,2}\\b)",
+    "(?:\\b[ABFGMPRX][A-Z9]\\d{7}\\b)",
+    "(?:\\b(?:[Nn][Pp][Ii])\\s*[=:]\\s*\\d{10}\\b)",
+    `(?:(?<=\\b${MRN_KEY}\\s*[=:]\\s*)[A-Za-z0-9-]{4,}\\b)`
+  ],
+  aggressivePatterns: [
+    "(?:(?<![A-Za-z0-9])[A-TV-Z]\\d{2}(?:\\.\\w{1,4})?(?![A-Za-z0-9:]))"
+  ],
+  validate: validateHealth,
+  jsonKeys: [
+    "diagnosis",
+    "prescription",
+    "medication",
+    "icd10",
+    "icd9",
+    "snomed",
+    "condition",
+    "allergy",
+    "allergies",
+    "bloodType",
+    "patientId",
+    "mrn",
+    "medicalRecordNumber",
+    "insuranceNumber",
+    "labResult",
+    "observation",
+    "vitalSigns"
+  ]
+};
+
+// src/rules/definitions/homePaths.ts
+var USER_SEG = `[^/\\\\\\s"'<>]+`;
+function validateHomeUser(match) {
+  return match !== "." && match !== "..";
+}
+var homePathsRule = {
+  id: "paths",
+  label: "Home-directory usernames",
+  description: "Only the username segment of a home-directory path is redacted (e.g. /home/jdoe/app \u2192 /home/<R:\u2026>/app); the rest of the path stays visible.",
+  mode: "mask",
+  token: "PATH",
+  patterns: [
+    `(?:(?<=/export/home/)${USER_SEG})`,
+    `(?:(?<=/usr/home/)${USER_SEG})`,
+    `(?:(?<=/var/home/)${USER_SEG})`,
+    `(?:(?<=/home/)${USER_SEG})`,
+    `(?:(?<=/Users/)${USER_SEG})`,
+    `(?:(?<=[A-Za-z]:\\\\Users\\\\)${USER_SEG})`,
+    `(?:(?<=[A-Za-z]:/Users/)${USER_SEG})`,
+    `(?:(?<=\\\\\\\\\\?\\\\[A-Za-z]:\\\\Users\\\\)${USER_SEG})`,
+    `(?:(?<=[A-Za-z]:\\\\Documents and Settings\\\\)${USER_SEG})`,
+    `(?:(?<=[A-Za-z]:\\\\\\\\Users\\\\\\\\)${USER_SEG})`,
+    `(?:(?<=/mnt/[A-Za-z]/Users/)${USER_SEG})`,
+    `(?:(?<=//wsl\\$/(?:[A-Za-z0-9_-]+)/home/)${USER_SEG})`
+  ],
+  validate: validateHomeUser
+};
+
+// src/rules/definitions/hostnames.ts
+var GTLD = [
+  "abbott",
+  "abogado",
+  "ac",
+  "academy",
+  "accountant",
+  "accountants",
+  "active",
+  "actor",
+  "ad",
+  "ads",
+  "adult",
+  "ae",
+  "aero",
+  "af",
+  "afl",
+  "ag",
+  "agency",
+  "ai",
+  "airforce",
+  "al",
+  "allfinanz",
+  "alsace",
+  "am",
+  "amsterdam",
+  "an",
+  "android",
+  "ao",
+  "apartments",
+  "aq",
+  "aquarelle",
+  "ar",
+  "archi",
+  "army",
+  "arpa",
+  "as",
+  "asia",
+  "associates",
+  "at",
+  "attorney",
+  "au",
+  "auction",
+  "audio",
+  "autos",
+  "aw",
+  "ax",
+  "axa",
+  "az",
+  "ba",
+  "band",
+  "bank",
+  "bar",
+  "barclaycard",
+  "barclays",
+  "bargains",
+  "bauhaus",
+  "bayern",
+  "bb",
+  "bbc",
+  "bd",
+  "be",
+  "beer",
+  "berlin",
+  "best",
+  "bf",
+  "bg",
+  "bh",
+  "bi",
+  "bid",
+  "bike",
+  "bingo",
+  "bio",
+  "biz",
+  "bj",
+  "bl",
+  "black",
+  "blackfriday",
+  "bloomberg",
+  "blue",
+  "bm",
+  "bmw",
+  "bn",
+  "bnpparibas",
+  "bo",
+  "boats",
+  "bond",
+  "boo",
+  "boutique",
+  "bq",
+  "br",
+  "brussels",
+  "bs",
+  "bt",
+  "budapest",
+  "build",
+  "builders",
+  "business",
+  "buzz",
+  "bv",
+  "bw",
+  "by",
+  "bz",
+  "bzh",
+  "ca",
+  "cab",
+  "cafe",
+  "cal",
+  "camera",
+  "camp",
+  "cancerresearch",
+  "canon",
+  "capetown",
+  "capital",
+  "caravan",
+  "cards",
+  "care",
+  "career",
+  "careers",
+  "cartier",
+  "casa",
+  "cash",
+  "casino",
+  "cat",
+  "catering",
+  "cbn",
+  "cc",
+  "cd",
+  "center",
+  "ceo",
+  "cern",
+  "cf",
+  "cfd",
+  "cg",
+  "ch",
+  "channel",
+  "chat",
+  "cheap",
+  "chloe",
+  "christmas",
+  "chrome",
+  "church",
+  "ci",
+  "citic",
+  "city",
+  "ck",
+  "cl",
+  "claims",
+  "cleaning",
+  "click",
+  "clinic",
+  "clothing",
+  "club",
+  "cm",
+  "cn",
+  "co",
+  "coach",
+  "codes",
+  "coffee",
+  "college",
+  "cologne",
+  "com",
+  "community",
+  "company",
+  "computer",
+  "condos",
+  "construction",
+  "consulting",
+  "contractors",
+  "cooking",
+  "cool",
+  "coop",
+  "country",
+  "courses",
+  "cr",
+  "credit",
+  "creditcard",
+  "cricket",
+  "crs",
+  "cruises",
+  "cu",
+  "cuisinella",
+  "cv",
+  "cw",
+  "cx",
+  "cy",
+  "cymru",
+  "cyou",
+  "cz",
+  "dabur",
+  "dad",
+  "dance",
+  "date",
+  "dating",
+  "datsun",
+  "day",
+  "dclk",
+  "de",
+  "deals",
+  "degree",
+  "delivery",
+  "democrat",
+  "dental",
+  "dentist",
+  "desi",
+  "design",
+  "dev",
+  "diamonds",
+  "diet",
+  "digital",
+  "direct",
+  "directory",
+  "discount",
+  "dj",
+  "dk",
+  "dm",
+  "dnp",
+  "do",
+  "docs",
+  "doha",
+  "domains",
+  "doosan",
+  "download",
+  "durban",
+  "dvag",
+  "dz",
+  "eat",
+  "ec",
+  "edu",
+  "education",
+  "ee",
+  "eg",
+  "eh",
+  "email",
+  "emerck",
+  "energy",
+  "engineer",
+  "engineering",
+  "enterprises",
+  "epson",
+  "equipment",
+  "er",
+  "erni",
+  "es",
+  "esq",
+  "estate",
+  "et",
+  "eu",
+  "eurovision",
+  "eus",
+  "events",
+  "everbank",
+  "exchange",
+  "expert",
+  "exposed",
+  "express",
+  "fail",
+  "faith",
+  "fan",
+  "fans",
+  "farm",
+  "fashion",
+  "feedback",
+  "fi",
+  "film",
+  "finance",
+  "financial",
+  "firmdale",
+  "fish",
+  "fishing",
+  "fit",
+  "fitness",
+  "fj",
+  "fk",
+  "flights",
+  "florist",
+  "flowers",
+  "flsmidth",
+  "fly",
+  "fm",
+  "fo",
+  "foo",
+  "football",
+  "forex",
+  "forsale",
+  "foundation",
+  "fr",
+  "frl",
+  "frogans",
+  "fund",
+  "furniture",
+  "futbol",
+  "ga",
+  "gal",
+  "gallery",
+  "garden",
+  "gb",
+  "gbiz",
+  "gd",
+  "gdn",
+  "ge",
+  "gent",
+  "gf",
+  "gg",
+  "ggee",
+  "gh",
+  "gi",
+  "gift",
+  "gifts",
+  "gives",
+  "gl",
+  "glass",
+  "gle",
+  "global",
+  "globo",
+  "gm",
+  "gmail",
+  "gmo",
+  "gmx",
+  "gn",
+  "gold",
+  "goldpoint",
+  "golf",
+  "goo",
+  "goog",
+  "google",
+  "gop",
+  "gov",
+  "gp",
+  "gq",
+  "gr",
+  "graphics",
+  "gratis",
+  "green",
+  "gripe",
+  "gs",
+  "gt",
+  "gu",
+  "guge",
+  "guide",
+  "guitars",
+  "guru",
+  "gw",
+  "gy",
+  "hamburg",
+  "hangout",
+  "haus",
+  "healthcare",
+  "help",
+  "here",
+  "hermes",
+  "hiphop",
+  "hiv",
+  "hk",
+  "hm",
+  "hn",
+  "holdings",
+  "holiday",
+  "homes",
+  "horse",
+  "host",
+  "hosting",
+  "house",
+  "how",
+  "hr",
+  "ht",
+  "hu",
+  "ibm",
+  "id",
+  "ie",
+  "ifm",
+  "il",
+  "im",
+  "immo",
+  "immobilien",
+  "in",
+  "industries",
+  "infiniti",
+  "info",
+  "ing",
+  "ink",
+  "institute",
+  "insure",
+  "int",
+  "international",
+  "investments",
+  "io",
+  "iq",
+  "ir",
+  "irish",
+  "is",
+  "it",
+  "iwc",
+  "java",
+  "jcb",
+  "je",
+  "jetzt",
+  "jm",
+  "jo",
+  "jobs",
+  "joburg",
+  "jp",
+  "juegos",
+  "kaufen",
+  "kddi",
+  "ke",
+  "kg",
+  "kh",
+  "ki",
+  "kim",
+  "kitchen",
+  "kiwi",
+  "km",
+  "kn",
+  "koeln",
+  "komatsu",
+  "kp",
+  "kr",
+  "krd",
+  "kred",
+  "kw",
+  "ky",
+  "kyoto",
+  "kz",
+  "la",
+  "lacaixa",
+  "land",
+  "lat",
+  "latrobe",
+  "lawyer",
+  "lb",
+  "lc",
+  "lds",
+  "lease",
+  "leclerc",
+  "legal",
+  "lgbt",
+  "li",
+  "lidl",
+  "life",
+  "lighting",
+  "limited",
+  "limo",
+  "link",
+  "lk",
+  "loan",
+  "loans",
+  "london",
+  "lotte",
+  "lotto",
+  "love",
+  "lr",
+  "ls",
+  "lt",
+  "ltda",
+  "lu",
+  "luxe",
+  "luxury",
+  "lv",
+  "ly",
+  "ma",
+  "madrid",
+  "maif",
+  "maison",
+  "management",
+  "mango",
+  "market",
+  "marketing",
+  "markets",
+  "marriott",
+  "mc",
+  "md",
+  "me",
+  "media",
+  "meet",
+  "melbourne",
+  "meme",
+  "memorial",
+  "menu",
+  "mf",
+  "mg",
+  "mh",
+  "miami",
+  "mil",
+  "mini",
+  "mk",
+  "ml",
+  "mm",
+  "mma",
+  "mn",
+  "mo",
+  "mobi",
+  "moda",
+  "moe",
+  "monash",
+  "money",
+  "mormon",
+  "mortgage",
+  "moscow",
+  "motorcycles",
+  "mov",
+  "movie",
+  "mp",
+  "mq",
+  "mr",
+  "ms",
+  "mt",
+  "mtn",
+  "mtpc",
+  "mu",
+  "museum",
+  "mv",
+  "mw",
+  "mx",
+  "my",
+  "mz",
+  "na",
+  "nagoya",
+  "name",
+  "navy",
+  "nc",
+  "ne",
+  "net",
+  "network",
+  "neustar",
+  "new",
+  "news",
+  "nexus",
+  "nf",
+  "ng",
+  "ngo",
+  "nhk",
+  "ni",
+  "nico",
+  "ninja",
+  "nissan",
+  "nl",
+  "no",
+  "np",
+  "nr",
+  "nra",
+  "nrw",
+  "ntt",
+  "nu",
+  "nyc",
+  "nz",
+  "okinawa",
+  "om",
+  "one",
+  "ong",
+  "onl",
+  "online",
+  "ooo",
+  "org",
+  "organic",
+  "osaka",
+  "otsuka",
+  "ovh",
+  "pa",
+  "page",
+  "panerai",
+  "paris",
+  "partners",
+  "parts",
+  "party",
+  "pe",
+  "pf",
+  "pg",
+  "ph",
+  "pharmacy",
+  "photo",
+  "photography",
+  "photos",
+  "physio",
+  "piaget",
+  "pics",
+  "pictet",
+  "pictures",
+  "pink",
+  "pizza",
+  "pk",
+  "pl",
+  "place",
+  "plumbing",
+  "plus",
+  "pm",
+  "pn",
+  "pohl",
+  "poker",
+  "porn",
+  "post",
+  "pr",
+  "praxi",
+  "press",
+  "pro",
+  "prod",
+  "productions",
+  "prof",
+  "properties",
+  "property",
+  "ps",
+  "pt",
+  "pub",
+  "pw",
+  "py",
+  "qa",
+  "qpon",
+  "quebec",
+  "racing",
+  "re",
+  "realtor",
+  "recipes",
+  "red",
+  "redstone",
+  "rehab",
+  "reise",
+  "reisen",
+  "reit",
+  "ren",
+  "rentals",
+  "repair",
+  "report",
+  "republican",
+  "rest",
+  "restaurant",
+  "review",
+  "reviews",
+  "rich",
+  "rio",
+  "rip",
+  "ro",
+  "rocks",
+  "rodeo",
+  "rs",
+  "rsvp",
+  "ru",
+  "ruhr",
+  "rw",
+  "ryukyu",
+  "sa",
+  "saarland",
+  "sale",
+  "samsung",
+  "sap",
+  "sarl",
+  "saxo",
+  "sb",
+  "sc",
+  "sca",
+  "scb",
+  "schmidt",
+  "scholarships",
+  "school",
+  "schule",
+  "schwarz",
+  "science",
+  "scot",
+  "sd",
+  "se",
+  "services",
+  "sew",
+  "sexy",
+  "sg",
+  "sh",
+  "shiksha",
+  "shoes",
+  "shriram",
+  "si",
+  "singles",
+  "site",
+  "sj",
+  "sk",
+  "sky",
+  "sl",
+  "sm",
+  "sn",
+  "so",
+  "social",
+  "software",
+  "sohu",
+  "solar",
+  "solutions",
+  "soy",
+  "space",
+  "spiegel",
+  "spreadbetting",
+  "sr",
+  "ss",
+  "st",
+  "study",
+  "style",
+  "su",
+  "sucks",
+  "supplies",
+  "supply",
+  "support",
+  "surf",
+  "surgery",
+  "suzuki",
+  "sv",
+  "sx",
+  "sy",
+  "sydney",
+  "systems",
+  "sz",
+  "taipei",
+  "tatar",
+  "tattoo",
+  "tax",
+  "tc",
+  "td",
+  "tech",
+  "technology",
+  "tel",
+  "temasek",
+  "tennis",
+  "tf",
+  "tg",
+  "th",
+  "tickets",
+  "tienda",
+  "tips",
+  "tires",
+  "tirol",
+  "tj",
+  "tk",
+  "tl",
+  "tm",
+  "tn",
+  "to",
+  "today",
+  "tokyo",
+  "tools",
+  "top",
+  "toshiba",
+  "tours",
+  "town",
+  "toys",
+  "tp",
+  "tr",
+  "trade",
+  "trading",
+  "training",
+  "travel",
+  "trust",
+  "tt",
+  "tui",
+  "tv",
+  "tw",
+  "tz",
+  "ua",
+  "ug",
+  "uk",
+  "um",
+  "university",
+  "uno",
+  "uol",
+  "us",
+  "uy",
+  "uz",
+  "va",
+  "vacations",
+  "vc",
+  "ve",
+  "vegas",
+  "ventures",
+  "versicherung",
+  "vet",
+  "vg",
+  "vi",
+  "viajes",
+  "video",
+  "villas",
+  "vision",
+  "vlaanderen",
+  "vn",
+  "vodka",
+  "vote",
+  "voting",
+  "voto",
+  "voyage",
+  "vu",
+  "wales",
+  "wang",
+  "watch",
+  "webcam",
+  "website",
+  "wed",
+  "wedding",
+  "wf",
+  "whoswho",
+  "wien",
+  "wiki",
+  "williamhill",
+  "win",
+  "wme",
+  "work",
+  "works",
+  "world",
+  "ws",
+  "wtc",
+  "wtf",
+  "xin",
+  "\u6D4B\u8BD5",
+  "\u092A\u0930\u0940\u0915\u094D\u0937\u093E",
+  "\u4F5B\u5C71",
+  "\u6148\u5584",
+  "\u96C6\u56E2",
+  "\u5728\u7EBF",
+  "\uD55C\uAD6D",
+  "\u09AD\u09BE\u09B0\u09A4",
+  "\u516B\u5366",
+  "\u0645\u0648\u0642\u0639",
+  "\u09AC\u09BE\u0982\u09B2\u09BE",
+  "\u516C\u76CA",
+  "\u516C\u53F8",
+  "\u79FB\u52A8",
+  "\u6211\u7231\u4F60",
+  "\u043C\u043E\u0441\u043A\u0432\u0430",
+  "\u0438\u0441\u043F\u044B\u0442\u0430\u043D\u0438\u0435",
+  "\u049B\u0430\u0437",
+  "\u043E\u043D\u043B\u0430\u0439\u043D",
+  "\u0441\u0430\u0439\u0442",
+  "\u0441\u0440\u0431",
+  "\u0431\u0435\u043B",
+  "\u65F6\u5C1A",
+  "\uD14C\uC2A4\uD2B8",
+  "\u6DE1\u9A6C\u9521",
+  "\u043E\u0440\u0433",
+  "\uC0BC\uC131",
+  "\u0B9A\u0BBF\u0B99\u0BCD\u0B95\u0BAA\u0BCD\u0BAA\u0BC2\u0BB0\u0BCD",
+  "\u5546\u6807",
+  "\u5546\u5E97",
+  "\u5546\u57CE",
+  "\u0434\u0435\u0442\u0438",
+  "\u043C\u043A\u0434",
+  "\u05D8\u05E2\u05E1\u05D8",
+  "\u4E2D\u6587\u7F51",
+  "\u4E2D\u4FE1",
+  "\u4E2D\u56FD",
+  "\u4E2D\u570B",
+  "\u8C37\u6B4C",
+  "\u0C2D\u0C3E\u0C30\u0C24\u0C4D",
+  "\u0DBD\u0D82\u0D9A\u0DCF",
+  "\u6E2C\u8A66",
+  "\u0AAD\u0ABE\u0AB0\u0AA4",
+  "\u092D\u093E\u0930\u0924",
+  "\u0622\u0632\u0645\u0627\u06CC\u0634\u06CC",
+  "\u0BAA\u0BB0\u0BBF\u0B9F\u0BCD\u0B9A\u0BC8",
+  "\u7F51\u5E97",
+  "\u0938\u0902\u0917\u0920\u0928",
+  "\u7F51\u7EDC",
+  "\u0443\u043A\u0440",
+  "\u9999\u6E2F",
+  "\u03B4\u03BF\u03BA\u03B9\u03BC\u03AE",
+  "\u98DE\u5229\u6D66",
+  "\u0625\u062E\u062A\u0628\u0627\u0631",
+  "\u53F0\u6E7E",
+  "\u53F0\u7063",
+  "\u624B\u673A",
+  "\u043C\u043E\u043D",
+  "\u0627\u0644\u062C\u0632\u0627\u0626\u0631",
+  "\u0639\u0645\u0627\u0646",
+  "\u0627\u06CC\u0631\u0627\u0646",
+  "\u0627\u0645\u0627\u0631\u0627\u062A",
+  "\u0628\u0627\u0632\u0627\u0631",
+  "\u067E\u0627\u06A9\u0633\u062A\u0627\u0646",
+  "\u0627\u0644\u0627\u0631\u062F\u0646",
+  "\u0628\u06BE\u0627\u0631\u062A",
+  "\u0627\u0644\u0645\u063A\u0631\u0628",
+  "\u0627\u0644\u0633\u0639\u0648\u062F\u064A\u0629",
+  "\u0633\u0648\u062F\u0627\u0646",
+  "\u0639\u0631\u0627\u0642",
+  "\u0645\u0644\u064A\u0633\u064A\u0627",
+  "\u653F\u5E9C",
+  "\u0634\u0628\u0643\u0629",
+  "\u10D2\u10D4",
+  "\u673A\u6784",
+  "\u7EC4\u7EC7\u673A\u6784",
+  "\u5065\u5EB7",
+  "\u0E44\u0E17\u0E22",
+  "\u0633\u0648\u0631\u064A\u0629",
+  "\u0440\u0443\u0441",
+  "\u0440\u0444",
+  "\u062A\u0648\u0646\u0633",
+  "\u307F\u3093\u306A",
+  "\u30B0\u30FC\u30B0\u30EB",
+  "\u4E16\u754C",
+  "\u0A2D\u0A3E\u0A30\u0A24",
+  "\u7F51\u5740",
+  "\u6E38\u620F",
+  "verm\xF6gensberater",
+  "verm\xF6gensberatung",
+  "\u4F01\u4E1A",
+  "\u4FE1\u606F",
+  "\u0645\u0635\u0631",
+  "\u0642\u0637\u0631",
+  "\u5E7F\u4E1C",
+  "\u0B87\u0BB2\u0B99\u0BCD\u0B95\u0BC8",
+  "\u0B87\u0BA8\u0BCD\u0BA4\u0BBF\u0BAF\u0BBE",
+  "\u0570\u0561\u0575",
+  "\u65B0\u52A0\u5761",
+  "\u0641\u0644\u0633\u0637\u064A\u0646",
+  "\u30C6\u30B9\u30C8",
+  "\u653F\u52A1",
+  "xxx",
+  "xyz",
+  "yachts",
+  "yandex",
+  "ye",
+  "yodobashi",
+  "yoga",
+  "yokohama",
+  "youtube",
+  "yt",
+  "za",
+  "zm",
+  "zone",
+  "zuerich",
+  "zw"
+];
+var INTERNAL_SUFFIXES = [
+  "local",
+  "internal",
+  "intranet",
+  "corp",
+  "lan",
+  "home",
+  "localdomain",
+  "arpa"
+];
+var INTERNAL_COMPOUND_SUFFIXES = [
+  "svc\\.cluster\\.local",
+  "ec2\\.internal",
+  "compute\\.internal"
+];
+var FILE_EXT_COLLISION_TLDS = [
+  "ac",
+  "am",
+  "cc",
+  "gs",
+  "hiv",
+  "in",
+  "is",
+  "it",
+  "java",
+  "la",
+  "md",
+  "ml",
+  "pl",
+  "py",
+  "rs",
+  "sh",
+  "so",
+  "tf"
+];
+var COLLISION_TLD_SET = new Set(FILE_EXT_COLLISION_TLDS);
+var GTLD_UNRESTRICTED = GTLD.filter((tld) => !COLLISION_TLD_SET.has(tld));
+var TLD_EXACT = [...INTERNAL_COMPOUND_SUFFIXES, ...GTLD_UNRESTRICTED, ...INTERNAL_SUFFIXES].join(
+  "|"
+);
+var TLD_COLLISION = FILE_EXT_COLLISION_TLDS.join("|");
+var LABEL = "[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?";
+var HOST_EXACT = `(?:(?<![\\w.$-])(?<![^:/\\\\][/\\\\])(?:${LABEL}\\.)+(?:${TLD_EXACT})(?!\\.?\\w))`;
+var HOST_COLLISION = `(?:(?<=(?:https?|sftp|ftps?|wss?)://(?:[^/@\\s]+@)?)(?:${LABEL}\\.)+(?:${TLD_COLLISION})(?!\\.?\\w))`;
+var UNC_COMPUTER = "(?:(?<=\\\\\\\\)[A-Za-z][A-Za-z0-9-]{0,14}(?=\\\\[A-Za-z0-9$]))";
+var SPN_HOST = "(?:(?<=\\b[A-Za-z][A-Za-z0-9]*/)[A-Za-z0-9][A-Za-z0-9.-]*(?=@[A-Z0-9.-]+\\b))";
+var HOST_CTX_KEY = "(?:host|hostname|computer)";
+var HOST_CTX = `(?:(?<=\\b${HOST_CTX_KEY}\\s*[=:]\\s*)[A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?)`;
+var NETBIOS_AGGRESSIVE = "(?:\\b(?:WIN|DESKTOP)-[A-Z0-9]{7,10}\\b)";
+var hostnamesRule = {
+  id: "hosts",
+  label: "Hostnames & domains",
+  description: "FQDNs, UNC computer names and Kerberos SPN hosts become the same token everywhere within a session.",
+  mode: "pseudo",
+  token: "HOST",
+  patterns: [HOST_EXACT, HOST_COLLISION, UNC_COMPUTER, SPN_HOST, HOST_CTX],
+  aggressivePatterns: [NETBIOS_AGGRESSIVE],
+  jsonKeys: [
+    "hostname",
+    "host",
+    "fqdn",
+    "domain",
+    "computerName",
+    "serverName",
+    "nodeName",
+    "dnsName",
+    "machineName",
+    "targetHost"
+  ]
+};
+
+// src/rules/definitions/ipAddresses.ts
+var IPV4_OCTET = "(?:25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)";
+var IPV4 = `(?:(?<![\\d.])\\b${IPV4_OCTET}(?:\\.${IPV4_OCTET}){3}\\b(?!\\.\\d))`;
+var IPV6_SEG = "[0-9a-fA-F]{1,4}";
+var IPV6_FULL = `(?:${IPV6_SEG}:){7}${IPV6_SEG}`;
+var IPV6_COMPRESSED = `(?:(?:${IPV6_SEG}:){1,7}:|(?:${IPV6_SEG}:){1,6}:${IPV6_SEG}|(?:${IPV6_SEG}:){1,5}(?::${IPV6_SEG}){1,2}|(?:${IPV6_SEG}:){1,4}(?::${IPV6_SEG}){1,3}|(?:${IPV6_SEG}:){1,3}(?::${IPV6_SEG}){1,4}|(?:${IPV6_SEG}:){1,2}(?::${IPV6_SEG}){1,5}|${IPV6_SEG}:(?::${IPV6_SEG}){1,6}|:(?:(?::${IPV6_SEG}){1,7}|:))`;
+var IPV4_MAPPED = `(?:::ffff:${IPV4})`;
+var IPV6 = `(?:(?<![A-Za-z0-9])(?:${IPV4_MAPPED}|${IPV6_FULL}|${IPV6_COMPRESSED})(?![A-Za-z0-9:])(?!\\.\\d)(?:%[A-Za-z0-9_.-]+)?)`;
+var PTR_V4 = "(?:\\b(?:\\d{1,3}\\.){4}in-addr\\.arpa\\b)";
+var PTR_V6 = "(?:\\b(?:[0-9a-fA-F]\\.){4,32}ip6\\.arpa\\b)";
+var MAC_COLON = "(?:(?<!&)\\b[0-9A-Fa-f]{2}(?::[0-9A-Fa-f]{2}){5}\\b)";
+var MAC_DASH = "(?:\\b[0-9A-Fa-f]{2}(?:-[0-9A-Fa-f]{2}){5}\\b)";
+var MAC_CISCO = "(?:\\b[0-9A-Fa-f]{4}(?:\\.[0-9A-Fa-f]{4}){2}\\b)";
+function ipv4ToOctets(ip) {
+  return ip.split(".").map(Number);
+}
+function isNetmaskShape(octets) {
+  const bin = octets.map((octet) => octet.toString(2).padStart(8, "0")).join("");
+  return /^1*0*$/.test(bin);
+}
+function isReservedIpv4(ip) {
+  const octets = ipv4ToOctets(ip);
+  if (octets.length !== 4 || octets.some((octet) => Number.isNaN(octet))) {
+    return false;
+  }
+  if (octets[0] === 127) {
+    return true;
+  }
+  if (octets[0] === 0) {
+    return true;
+  }
+  if (octets[0] === 169 && octets[1] === 254) {
+    return true;
+  }
+  if (octets[0] >= 224 && octets[0] <= 239) {
+    return true;
+  }
+  return isNetmaskShape(octets);
+}
+function validateIp(match) {
+  if (/^\d{1,3}(?:\.\d{1,3}){3}$/.test(match)) {
+    return !isReservedIpv4(match);
+  }
+  const withoutZone = match.split("%")[0] ?? match;
+  if (withoutZone === "::" || withoutZone === "::1") {
+    return false;
+  }
+  const mapped = /^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/.exec(withoutZone);
+  if (mapped?.[1]) {
+    return !isReservedIpv4(mapped[1]);
+  }
+  return true;
+}
+var ipAddressesRule = {
+  id: "ips",
+  label: "Network addresses",
+  description: "IPv4/IPv6 addresses, MAC addresses and reverse-DNS (PTR) names become the same token everywhere within a session.",
+  mode: "pseudo",
+  token: "IP",
+  patterns: [PTR_V4, PTR_V6, IPV6, IPV4, MAC_COLON, MAC_DASH, MAC_CISCO],
+  validate: validateIp,
+  jsonKeys: [
+    "ip",
+    "ipAddress",
+    "ip_address",
+    "clientIp",
+    "remoteAddr",
+    "srcIp",
+    "dstIp",
+    "sourceIp",
+    "destinationIp",
+    "xForwardedFor",
+    "mac",
+    "macAddress"
+  ]
+};
+
+// src/rules/shared/hmacSha256.ts
+var BLOCK_BYTES2 = 64;
+var DIGEST_BYTES2 = 32;
+var K2 = new Uint32Array([
+  1116352408,
+  1899447441,
+  3049323471,
+  3921009573,
+  961987163,
+  1508970993,
+  2453635748,
+  2870763221,
+  3624381080,
+  310598401,
+  607225278,
+  1426881987,
+  1925078388,
+  2162078206,
+  2614888103,
+  3248222580,
+  3835390401,
+  4022224774,
+  264347078,
+  604807628,
+  770255983,
+  1249150122,
+  1555081692,
+  1996064986,
+  2554220882,
+  2821834349,
+  2952996808,
+  3210313671,
+  3336571891,
+  3584528711,
+  113926993,
+  338241895,
+  666307205,
+  773529912,
+  1294757372,
+  1396182291,
+  1695183700,
+  1986661051,
+  2177026350,
+  2456956037,
+  2730485921,
+  2820302411,
+  3259730800,
+  3345764771,
+  3516065817,
+  3600352804,
+  4094571909,
+  275423344,
+  430227734,
+  506948616,
+  659060556,
+  883997877,
+  958139571,
+  1322822218,
+  1537002063,
+  1747873779,
+  1955562222,
+  2024104815,
+  2227730452,
+  2361852424,
+  2428436474,
+  2756734187,
+  3204031479,
+  3329325298
+]);
+var INITIAL_STATE2 = new Uint32Array([
+  1779033703,
+  3144134277,
+  1013904242,
+  2773480762,
+  1359893119,
+  2600822924,
+  528734635,
+  1541459225
+]);
+function rotr2(value, bits) {
+  return (value >>> bits | value << 32 - bits) >>> 0;
+}
+function padMessage2(message) {
+  const bitLength = message.length * 8;
+  const paddedLength = Math.ceil((message.length + 9) / BLOCK_BYTES2) * BLOCK_BYTES2;
+  const padded = new Uint8Array(paddedLength);
+  padded.set(message);
+  padded[message.length] = 128;
+  const view = new DataView(padded.buffer);
+  view.setUint32(paddedLength - 8, Math.floor(bitLength / 2 ** 32), false);
+  view.setUint32(paddedLength - 4, bitLength >>> 0, false);
+  return padded;
+}
+function sha2562(message) {
+  const padded = padMessage2(message);
+  const view = new DataView(padded.buffer);
+  const state = Uint32Array.from(INITIAL_STATE2);
+  const w = new Uint32Array(64);
+  for (let offset = 0; offset < padded.length; offset += BLOCK_BYTES2) {
+    for (let i = 0; i < 16; i += 1) {
+      w[i] = view.getUint32(offset + i * 4, false);
+    }
+    for (let i = 16; i < 64; i += 1) {
+      const s0 = rotr2(w[i - 15], 7) ^ rotr2(w[i - 15], 18) ^ w[i - 15] >>> 3;
+      const s1 = rotr2(w[i - 2], 17) ^ rotr2(w[i - 2], 19) ^ w[i - 2] >>> 10;
+      w[i] = w[i - 16] + s0 + w[i - 7] + s1 >>> 0;
+    }
+    let [a, b, c, d, e, f, g, h] = state;
+    for (let i = 0; i < 64; i += 1) {
+      const s1 = rotr2(e, 6) ^ rotr2(e, 11) ^ rotr2(e, 25);
+      const ch = e & f ^ ~e & g;
+      const temp1 = h + s1 + ch + K2[i] + w[i] >>> 0;
+      const s0 = rotr2(a, 2) ^ rotr2(a, 13) ^ rotr2(a, 22);
+      const maj = a & b ^ a & c ^ b & c;
+      const temp2 = s0 + maj >>> 0;
+      h = g;
+      g = f;
+      f = e;
+      e = d + temp1 >>> 0;
+      d = c;
+      c = b;
+      b = a;
+      a = temp1 + temp2 >>> 0;
+    }
+    state[0] = state[0] + a >>> 0;
+    state[1] = state[1] + b >>> 0;
+    state[2] = state[2] + c >>> 0;
+    state[3] = state[3] + d >>> 0;
+    state[4] = state[4] + e >>> 0;
+    state[5] = state[5] + f >>> 0;
+    state[6] = state[6] + g >>> 0;
+    state[7] = state[7] + h >>> 0;
+  }
+  const digest = new Uint8Array(DIGEST_BYTES2);
+  const digestView = new DataView(digest.buffer);
+  for (let i = 0; i < 8; i += 1) {
+    digestView.setUint32(i * 4, state[i], false);
+  }
+  return digest;
+}
+
+// src/rules/definitions/paymentInfo.ts
+var BASE58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
+function luhnCheck2(digits) {
+  if (!/^\d{13,19}$/.test(digits) || /^0+$/.test(digits)) {
+    return false;
+  }
+  let sum = 0;
+  let doubleIt = false;
+  for (let i = digits.length - 1; i >= 0; i -= 1) {
+    let digit = Number(digits[i]);
+    if (doubleIt) {
+      digit *= 2;
+      if (digit > 9) {
+        digit -= 9;
+      }
+    }
+    sum += digit;
+    doubleIt = !doubleIt;
+  }
+  return sum % 10 === 0;
+}
+function ibanMod97(iban) {
+  const compact = iban.replace(/\s/g, "").toUpperCase();
+  if (!/^[A-Z]{2}\d{2}[A-Z0-9]{10,30}$/.test(compact)) {
+    return false;
+  }
+  const rearranged = compact.slice(4) + compact.slice(0, 4);
+  const numeric = rearranged.replace(/[A-Z]/g, (char) => String(char.charCodeAt(0) - 55));
+  let remainder = 0;
+  for (let i = 0; i < numeric.length; i += 1) {
+    remainder = (remainder * 10 + Number(numeric[i])) % 97;
+  }
+  return remainder === 1;
+}
+var IBAN_COUNTRY_CODES = /* @__PURE__ */ new Set([
+  "AD",
+  "AE",
+  "AL",
+  "AO",
+  "AT",
+  "AZ",
+  "BA",
+  "BE",
+  "BF",
+  "BG",
+  "BH",
+  "BI",
+  "BJ",
+  "BR",
+  "BY",
+  "CF",
+  "CG",
+  "CH",
+  "CI",
+  "CM",
+  "CR",
+  "CV",
+  "CY",
+  "CZ",
+  "DE",
+  "DJ",
+  "DK",
+  "DO",
+  "DZ",
+  "EE",
+  "EG",
+  "ES",
+  "FI",
+  "FO",
+  "FR",
+  "GA",
+  "GB",
+  "GE",
+  "GI",
+  "GL",
+  "GQ",
+  "GR",
+  "GT",
+  "GW",
+  "HN",
+  "HR",
+  "HU",
+  "IE",
+  "IL",
+  "IQ",
+  "IR",
+  "IS",
+  "IT",
+  "JO",
+  "KM",
+  "KW",
+  "KZ",
+  "LB",
+  "LC",
+  "LI",
+  "LT",
+  "LU",
+  "LV",
+  "LY",
+  "MA",
+  "MC",
+  "MD",
+  "ME",
+  "MG",
+  "MK",
+  "ML",
+  "MR",
+  "MT",
+  "MU",
+  "MZ",
+  "NE",
+  "NI",
+  "NL",
+  "NO",
+  "PK",
+  "PL",
+  "PS",
+  "PT",
+  "QA",
+  "RO",
+  "RS",
+  "RU",
+  "SA",
+  "SC",
+  "SD",
+  "SE",
+  "SI",
+  "SK",
+  "SM",
+  "SN",
+  "ST",
+  "SV",
+  "TD",
+  "TG",
+  "TL",
+  "TN",
+  "TR",
+  "UA",
+  "VA",
+  "VG",
+  "XK"
+]);
+function isIbanCountry(compact) {
+  return IBAN_COUNTRY_CODES.has(compact.slice(0, 2).toUpperCase());
+}
+function isHexHashLength(value) {
+  return /^(?:[A-Fa-f0-9]{32}|[A-Fa-f0-9]{40}|[A-Fa-f0-9]{64})$/.test(value);
+}
+function isCardSeparatorLayout(match) {
+  if (!/[ -]/.test(match)) {
+    return true;
+  }
+  const groups = match.split(/[ -]/).map((group) => group.length);
+  if (groups.some((length) => length === 0)) {
+    return false;
+  }
+  if (groups.length === 3 && groups[0] === 4 && groups[1] === 6 && (groups[2] === 4 || groups[2] === 5)) {
+    return true;
+  }
+  const last = groups[groups.length - 1];
+  return groups.length >= 2 && groups.slice(0, -1).every((length) => length === 4) && last >= 1 && last <= 7;
+}
+function bitcoinBase58Check(address) {
+  const decoded = decodeBase58(address);
+  if (!decoded || decoded.length < 5) {
+    return false;
+  }
+  const payload = decoded.subarray(0, decoded.length - 4);
+  const checksum = decoded.subarray(decoded.length - 4);
+  const digest = sha2562(sha2562(payload));
+  return digest[0] === checksum[0] && digest[1] === checksum[1] && digest[2] === checksum[2] && digest[3] === checksum[3];
+}
+function decodeBase58(input) {
+  const bytes = [0];
+  for (let i = 0; i < input.length; i += 1) {
+    let carry = BASE58_ALPHABET.indexOf(input[i]);
+    if (carry === -1) {
+      return null;
+    }
+    for (let j = 0; j < bytes.length; j += 1) {
+      carry += bytes[j] * 58;
+      bytes[j] = carry % 256;
+      carry = Math.floor(carry / 256);
+    }
+    while (carry > 0) {
+      bytes.push(carry % 256);
+      carry = Math.floor(carry / 256);
+    }
+  }
+  let leadingOnes = 0;
+  while (leadingOnes < input.length && input[leadingOnes] === "1") {
+    leadingOnes += 1;
+  }
+  let end = bytes.length;
+  while (end > 0 && bytes[end - 1] === 0) {
+    end -= 1;
+  }
+  const out = new Uint8Array(leadingOnes + end);
+  for (let i = 0; i < end; i += 1) {
+    out[leadingOnes + end - 1 - i] = bytes[i];
+  }
+  return out;
+}
+function isKnownCardIin(digits) {
+  const { length } = digits;
+  const d2 = Number(digits.slice(0, 2));
+  const d4 = Number(digits.slice(0, 4));
+  switch (digits[0]) {
+    case "4":
+      return length === 13 || length === 16 || length === 19;
+    case "5":
+      return length === 16 && d2 >= 51 && d2 <= 55;
+    case "2":
+      return length === 16 && d4 >= 2221 && d4 <= 2720;
+    case "3":
+      if (length === 15) {
+        return d2 === 34 || d2 === 37;
+      }
+      if (length === 14) {
+        return d2 === 36 || d2 === 38 || d2 === 39 || d4 >= 3e3 && d4 <= 3059 || d4 === 3095;
+      }
+      return length >= 16 && length <= 19 && d4 >= 3528 && d4 <= 3589;
+    case "6":
+      return length >= 16 && length <= 19 && (digits.startsWith("6011") || digits.startsWith("62") || digits.startsWith("64") || digits.startsWith("65"));
+    default:
+      return false;
+  }
+}
+function validatePayment(match) {
+  const compactIban = match.replace(/\s/g, "");
+  if (/^[A-Za-z]{2}\d{2}[A-Za-z0-9]+$/.test(compactIban)) {
+    return !isHexHashLength(compactIban) && isIbanCountry(compactIban) && ibanMod97(match);
+  }
+  const compactPan = match.replace(/[ -]/g, "");
+  if (/^[\d -]+$/.test(match) && /^\d{13,19}$/.test(compactPan)) {
+    const grouped = /[ -]/.test(match);
+    if (!grouped && compactPan.length > 16) {
+      return false;
+    }
+    return isCardSeparatorLayout(match) && isKnownCardIin(compactPan) && luhnCheck2(compactPan);
+  }
+  if (/^[13][A-HJ-NP-Za-km-z1-9]{25,34}$/.test(match)) {
+    return bitcoinBase58Check(match);
+  }
+  return true;
+}
+var CVV_KEY = "(?:[Cc][Vv][Vv]2?|[Cc][Vv][Cc]2?|[Cc][Ii][Dd])";
+var EXP_KEY = "(?:[Ee]xp(?:iry|iration)?|[Ee]xp[_-]?[Dd]ate)";
+var ROUTING_KEY = "(?:[Rr]outing(?:[_-]?[Nn]umber)?|[Aa][Bb][Aa])";
+var ACCOUNT_KEY = "(?:[Aa]ccount[_-]?[Nn]umber|[Aa]cct)";
+var paymentInfoRule = {
+  id: "paymentInfo",
+  label: "Payment info",
+  description: "IBANs, card numbers (PAN, Luhn-checked), CVV/CVC, expiry dates and crypto addresses are redacted outright.",
+  mode: "mask",
+  token: "PAYMENT",
+  patterns: [
+    "(?:(?<![.\\d])\\b\\d(?:[ -]?\\d){12,18}\\b)",
+    "(?:\\b[A-Z]{2}\\d{2}[A-Z0-9]{10,30}\\b)",
+    "(?:\\b[A-Z]{2}\\d{2}(?: [A-Z0-9]{4}){2,7}(?: [A-Z0-9]{1,4})?\\b)",
+    `(?:(?<=\\b${CVV_KEY}\\s*[=:]\\s*)\\d{3,4}\\b)`,
+    `(?:(?<=\\b${EXP_KEY}\\s*[=:]\\s*)(?:0[1-9]|1[0-2])[/-](?:\\d{2}|\\d{4})\\b)`,
+    "(?:\\bbc1[a-z0-9]{25,39}\\b)",
+    "(?:(?<![A-Za-z0-9])[13][A-HJ-NP-Za-km-z1-9]{25,34}(?![A-Za-z0-9]))",
+    "(?:\\b0x[A-Fa-f0-9]{40}\\b)"
+  ],
+  aggressivePatterns: [
+    "(?:(?<![\\\\/])\\b[A-Z]{6}[A-Z0-9]{2}(?:[A-Z0-9]{3})?\\b(?![\\\\/]))",
+    `(?:(?<=\\b${ROUTING_KEY}\\s*[=:]\\s*)\\d{9}\\b)`,
+    `(?:(?<=\\b${ACCOUNT_KEY}\\s*[=:]\\s*)\\d{8,12}\\b)`
+  ],
+  validate: validatePayment,
+  jsonKeys: [
+    "iban",
+    "cardNumber",
+    "pan",
+    "cvv",
+    "cvc",
+    "card_number",
+    "creditCard",
+    "cvv2",
+    "accountNumber",
+    "routingNumber",
+    "bic",
+    "swift",
+    "expiryDate"
+  ]
+};
+
+// src/rules/definitions/phoneNumbers.ts
+function validatePhone(match) {
+  const digits = match.replace(/\D/g, "");
+  const national = digits.startsWith("00") ? digits.slice(2) : digits;
+  return national.length >= 7 && national.length <= 15;
+}
+var PHONE_KEY = "(?:telephone|phone|mobile|msisdn|cell|fax|tel)";
+var phoneNumbersRule = {
+  id: "phoneNumbers",
+  label: "Phone numbers",
+  description: "Phone numbers become a stable <PHONE:\u2026> token \u2014 the same number maps to the same token everywhere within a session.",
+  mode: "pseudo",
+  token: "PHONE",
+  patterns: [
+    "(?:(?<![A-Za-z0-9])\\+[1-9](?:[\\s().-]*\\d){6,14}(?!\\d))",
+    "(?:\\(\\d{3}\\)\\s?\\d{3}-\\d{4}(?!\\d))",
+    "(?:\\b\\d{3}-\\d{3}-\\d{4}\\b)",
+    "(?:\\b1-\\d{3}-\\d{3}-\\d{4}\\b)",
+    "(?:\\b0\\d{2}-\\d{3}-\\d{2}-\\d{2}\\b)",
+    "(?:\\b0\\d{2}\\s\\d{3}\\s\\d{2}\\s\\d{2}\\b)",
+    "(?:(?<![.\\d])\\b00[1-9](?:[\\s().-]*\\d){7,13}(?!\\d))",
+    "(?:(?<=\\b(?:tel|sms):)\\+?[1-9](?:[\\s().-]*\\d){6,14}(?!\\d))",
+    `(?:(?<=\\b${PHONE_KEY}\\s*[=:]\\s*)\\+?[0-9](?:[\\s().-]*\\d){6,14}(?!\\d))`
+  ],
+  validate: validatePhone,
+  jsonKeys: [
+    "phone",
+    "phoneNumber",
+    "phone_number",
+    "mobile",
+    "mobileNumber",
+    "cell",
+    "telephone",
+    "tel",
+    "fax",
+    "msisdn",
+    "contactNumber"
+  ]
+};
+
+// src/rules/definitions/secrets.ts
+var ENTROPY_THRESHOLD = 3.5;
+function shannonEntropy(value) {
+  const { length } = value;
+  if (length === 0) {
+    return 0;
+  }
+  const freq = {};
+  for (let i = 0; i < length; i += 1) {
+    const char = value[i];
+    freq[char] = (freq[char] ?? 0) + 1;
+  }
+  return Object.values(freq).reduce((entropy, count) => {
+    const p = count / length;
+    return entropy - p * Math.log2(p);
+  }, 0);
+}
+function isHexBlob(match) {
+  return match.length >= 32 && /^[A-Fa-f0-9]+$/.test(match);
+}
+function isBase64Blob(match) {
+  return match.length >= 40 && /^[A-Za-z0-9+/]+=*$/.test(match);
+}
+function validateSecret(match) {
+  if (isHexBlob(match)) {
+    return shannonEntropy(match) > ENTROPY_THRESHOLD;
+  }
+  if (isBase64Blob(match)) {
+    return shannonEntropy(match) > ENTROPY_THRESHOLD && /[A-Za-z]/.test(match) && /[0-9+/]/.test(match);
+  }
+  return true;
+}
+var CONTEXT_KEYS = "(?:api[_-]?key|apikey|access[_-]?token|refresh[_-]?token|id[_-]?token|client[_-]?secret|secret[_-]?key|private[_-]?key|password|passwd|pwd|pass|auth[_-]?token|signing[_-]?key)";
+var CONTEXT_VALUE = `[^\\s,;}"']{4,}`;
+var CLI_FLAGS = "(?:password|secret|token|api-key|apikey|access-token|client-secret)";
+var secretsRule = {
+  id: "secrets",
+  label: "Tokens & credentials",
+  description: "Bearer tokens, JWTs and API keys are redacted outright \u2014 they are not meant to be traced.",
+  mode: "mask",
+  token: "SECRET",
+  patterns: [
+    "(?:(?<=(?:Bearer|bearer|BEARER)\\s+)[A-Za-z0-9._\\-+/=]{8,})",
+    "(?:(?<=(?:Basic|basic|BASIC)\\s+)[A-Za-z0-9+/]{8,}={0,2})",
+    "(?:(?<![A-Za-z0-9_-])eyJ[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}(?:\\.[A-Za-z0-9_-]{8,})?)",
+    "(?:-----BEGIN (?:(?:RSA |EC |DSA |OPENSSH |ENCRYPTED )?PRIVATE KEY|CERTIFICATE)-----[A-Za-z0-9+/=\\s\\\\]+?-----END (?:(?:RSA |EC |DSA |OPENSSH |ENCRYPTED )?PRIVATE KEY|CERTIFICATE)-----)",
+    "(?:\\b(?:AKIA|ASIA|ABIA|ACCA)[A-Z0-9]{16}\\b)",
+    "(?:(?<=(?:aws_secret_access_key|AWS_SECRET_ACCESS_KEY)\\s*[=:]\\s*)[A-Za-z0-9/+=]{30,})",
+    "(?:github_pat_[A-Za-z0-9_]{22,})",
+    "(?:gh[pousr]_[A-Za-z0-9]{36,})",
+    "(?:xox[abprs]-[A-Za-z0-9-]{10,})",
+    "(?:hooks\\.slack\\.com/services/[A-Za-z0-9/_-]{16,})",
+    "(?:AIza[A-Za-z0-9_-]{35})",
+    "(?:(?:sk_live_|sk_test_|rk_live_|rk_test_)[A-Za-z0-9]{16,})",
+    "(?:sk-proj-[A-Za-z0-9_-]{16,})",
+    "(?:sk-[A-Za-z0-9]{20,})",
+    "(?:(?<=(?:[Tt]wilio.{0,60}|\\b(?:[Aa]ccount[Ss]id|[Aa]uth[Tt]oken|[Ss]id)\\s*[=:]\\s*))(?:AC|SK)[0-9A-Fa-f]{32})",
+    "(?:SG\\.[A-Za-z0-9_-]{10,}\\.[A-Za-z0-9_-]{10,})",
+    "(?:npm_[A-Za-z0-9]{36,})",
+    `(?:(?<=[?&][Ss]ig=)[^&\\s"']{16,})`,
+    "(?:(?<=[a-zA-Z][a-zA-Z0-9+.-]*://)[^/@\\s:]+:[^/@\\s]+@)",
+    `(?:(?<=--${CLI_FLAGS}(?:\\s+|=)"?)[^\\s"']{4,})`,
+    `(?:(?<=\\b${CONTEXT_KEYS}"?\\s*[=:]\\s*"?)${CONTEXT_VALUE})`
+  ],
+  aggressivePatterns: [
+    "(?:(?<![A-Za-z0-9+/])[A-Za-z0-9+/]{40,}={0,2}(?![A-Za-z0-9+/=]))",
+    "(?:\\b[A-Fa-f0-9]{32,}\\b)"
+  ],
+  validate: validateSecret,
+  jsonKeys: [
+    "password",
+    "token",
+    "authorization",
+    "apiKey",
+    "secret",
+    "accessToken",
+    "refreshToken",
+    "passwd",
+    "pwd",
+    "pass",
+    "clientSecret",
+    "privateKey",
+    "secretKey",
+    "apiSecret",
+    "credentials",
+    "auth",
+    "xApiKey",
+    "idToken",
+    "awsSecretAccessKey",
+    "signature"
+  ]
+};
+
+// src/rules/definitions/sessionCookies.ts
+var COOKIE_VALUE = "[^;\\s]{8,}";
+var sessionCookiesRule = {
+  id: "sessionCookies",
+  label: "Session cookies",
+  description: "Session identifiers (sessionid, sid, JSESSIONID, PHPSESSID) are redacted outright.",
+  mode: "mask",
+  token: "SESSION",
+  patterns: [
+    `(?:(?<![\\w-])(?:[Ss]essionid|[Ss]ession_id|sessionId|SESSIONID)=${COOKIE_VALUE})`,
+    `(?:(?<![\\w-])sid=${COOKIE_VALUE})`,
+    `(?:PHPSESSID=${COOKIE_VALUE})`,
+    `(?:JSESSIONID=${COOKIE_VALUE})`,
+    `(?:ASP\\.NET_SessionId=${COOKIE_VALUE})`,
+    `(?:ASPSESSIONID[A-Za-z0-9]*=${COOKIE_VALUE})`,
+    `(?:connect\\.sid=${COOKIE_VALUE})`,
+    `(?:laravel_session=${COOKIE_VALUE})`,
+    `(?:_session_id=${COOKIE_VALUE})`,
+    `(?:(?:csrftoken|csrf_token|XSRF-TOKEN|xsrf-token)=${COOKIE_VALUE})`,
+    `(?:remember_token=${COOKIE_VALUE})`,
+    `(?:(?:SSESS|SESS)[A-Fa-f0-9]{32}=${COOKIE_VALUE})`,
+    `(?:(?<=[Ss]et-[Cc]ookie:\\s*)[^;=\\s]+=${COOKIE_VALUE})`
+  ],
+  aggressivePatterns: [
+    `(?:(?<![\\w-])[\\w-]*session[\\w-]*=${COOKIE_VALUE})`,
+    `(?:(?<![\\w-])[\\w-]*token=${COOKIE_VALUE})`
+  ],
+  jsonKeys: ["sessionId", "sid", "cookie", "cookies", "setCookie", "jsessionid", "csrfToken"]
+};
+
+// src/rules/definitions/users.ts
+var EMAIL_LOCAL = "[A-Za-z0-9._%+-]+";
+var EMAIL_DOMAIN = "[A-Za-z0-9.-]+\\.[A-Za-z]{2,}";
+var EMAIL = `(?:\\b${EMAIL_LOCAL}@${EMAIL_DOMAIN})`;
+var EMAIL_IP_LITERAL = `(?:\\b${EMAIL_LOCAL}@\\[[0-9a-fA-F.:]+\\])`;
+var WIN_DOMAIN_EXCLUDE = "(?:BUILTIN|NT SERVICE|NT AUTHORITY|Users|Settings|Files)\\\\";
+var USER_SEG_SIMPLE = "[A-Za-z0-9_](?:[A-Za-z0-9_.$-]*[A-Za-z0-9$])";
+var FILE_EXT = "exe|dll|sys|bat|cmd|ps1|vbs|msi|tmp|hiv|log|dat|txt|ini|xml|json|lnk|cpl|ocx|drv";
+var NOT_FILENAME = `(?![A-Za-z0-9_$.-]*\\.(?:${FILE_EXT})(?![A-Za-z0-9]))`;
+var NOT_GUID = "(?![0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-)";
+var ACCOUNT_END = "(?![A-Za-z0-9_$\\\\/-])";
+var PATH_ROOT = "(?:\\b(?:HKLM|HKCU|HKU|HKCR|HKEY_[A-Z_]+)|\\b[A-Za-z]:)\\\\";
+var NOT_UNDER_PATH_ROOT = `(?<!${PATH_ROOT}(?:(?! [-/])[^<>'"\\n])*)`;
+var DOMAIN_USER = `(?:(?<!${WIN_DOMAIN_EXCLUDE})(?<=(?:^|[^\\\\.-])\\b[A-Za-z0-9](?:[A-Za-z0-9.-]{0,13}[A-Za-z0-9])?\\\\)${NOT_FILENAME}${NOT_GUID}${USER_SEG_SIMPLE}${ACCOUNT_END}${NOT_UNDER_PATH_ROOT})`;
+var SID = "(?:\\bS-1-(?:\\d+-){1,14}\\d+\\b)";
+var VALUE_WITH_LETTER = "[\\w.@+-]*[A-Za-z][\\w.@+-]*";
+var LDAP_DN_SINGLE = `(?:(?<=\\b(?:uid|sAMAccountName)=)${VALUE_WITH_LETTER})`;
+var CN_VALUE = "(?:[A-Za-z0-9.'-]+(?: [A-Za-z0-9.'-]+){0,3})";
+var LDAP_DN_CN = `(?:(?<=\\bcn=)${CN_VALUE})`;
+var ARN_USER = "(?:(?<=:user/)[\\w.@+=,-]+)";
+var ARN_ASSUMED_ROLE_SESSION = "(?:(?<=:assumed-role/[\\w+=,.@-]+/)[\\w.@+=,-]+)";
+var K8S_SERVICE_ACCOUNT = "(?:(?<=\\bsystem:serviceaccount:[A-Za-z0-9-]+:)[A-Za-z0-9-]+)";
+var SSHD_FOR_USER = "(?:(?<=(?:\\bfor (?:invalid )?user|\\b[Ii]nvalid user)\\s+)[A-Za-z0-9._-]+)";
+var SSHD_RUSER = "(?:(?<=\\bruser=)[A-Za-z0-9._-]+)";
+var SSHD_LOGNAME = "(?:(?<=\\blogname=)[A-Za-z0-9._-]+)";
+var SUDO_USER = "(?:(?<=\\bsudo:\\s+)[A-Za-z0-9._-]+(?=\\s+:))";
+var GENERIC_KEY = "(?:user|username|login|account|owner|actor|principal|requester|createdBy|modifiedBy|assignee|operator)";
+var GENERIC_CTX = `(?:(?<=\\b${GENERIC_KEY}\\s*[=:]\\s*)${VALUE_WITH_LETTER})`;
+var SLACK_USER_ID_AGGRESSIVE = "(?:\\bU[A-Z0-9]{8,10}\\b)";
+var SYSTEM_ACCOUNTS = /* @__PURE__ */ new Set([
+  "root",
+  "system",
+  "daemon",
+  "nobody",
+  "www-data",
+  "nginx",
+  "sshd",
+  "syslog"
+]);
+function isWellKnownWindowsAccount(match) {
+  const upper = match.toUpperCase();
+  if (upper === "SYSTEM" || upper === "LOCAL" || upper === "NETWORK" || upper === "ANONYMOUS") {
+    return true;
+  }
+  return match.endsWith("$");
+}
+function isWellKnownSid(match) {
+  if (match === "S-1-1-0") {
+    return true;
+  }
+  if (/^S-1-5-(?:18|19|20)$/.test(match)) {
+    return true;
+  }
+  return /^S-1-5-32-\d+$/.test(match);
+}
+function validateUser(match) {
+  if (isWellKnownWindowsAccount(match)) {
+    return false;
+  }
+  if (isWellKnownSid(match)) {
+    return false;
+  }
+  return !SYSTEM_ACCOUNTS.has(match.toLowerCase());
+}
+var usersRule = {
+  id: "users",
+  label: "Usernames & emails",
+  description: "Email addresses and account identifiers (DOMAIN\\user, SIDs, ARNs, LDAP DNs, sshd/PAM context) become the same token everywhere within a session.",
+  mode: "pseudo",
+  token: "USER",
+  patterns: [
+    EMAIL_IP_LITERAL,
+    EMAIL,
+    DOMAIN_USER,
+    SID,
+    LDAP_DN_SINGLE,
+    LDAP_DN_CN,
+    ARN_USER,
+    ARN_ASSUMED_ROLE_SESSION,
+    K8S_SERVICE_ACCOUNT,
+    SSHD_FOR_USER,
+    SSHD_RUSER,
+    SSHD_LOGNAME,
+    SUDO_USER,
+    GENERIC_CTX
+  ],
+  aggressivePatterns: [SLACK_USER_ID_AGGRESSIVE],
+  validate: validateUser,
+  jsonKeys: [
+    "email",
+    "username",
+    "user",
+    "emailAddress",
+    "mail",
+    "userEmail",
+    "user_name",
+    "login",
+    "account",
+    "samAccountName",
+    "userPrincipalName",
+    "upn",
+    "actor",
+    "principal",
+    "owner",
+    "createdBy",
+    "modifiedBy",
+    "firstName",
+    "lastName",
+    "fullName",
+    "displayName",
+    "givenName",
+    "surname",
+    "userId",
+    "uid"
+  ]
+};
+
+// src/rules/registry.ts
+var builtinRules = [
+  secretsRule,
+  sessionCookiesRule,
+  paymentInfoRule,
+  govIdentifiersRule,
+  healthInfoRule,
+  phoneNumbersRule,
+  ipAddressesRule,
+  hostnamesRule,
+  usersRule,
+  geoLocationRule,
+  homePathsRule
+];
+var builtinRuleIds = builtinRules.map(
+  (rule) => rule.id
+);
+var builtinsById = new Map(builtinRules.map((rule) => [rule.id, rule]));
+function getBuiltinRule(id) {
+  return builtinsById.get(id);
+}
+
+// src/core/allowlist.ts
+function patternSource(pattern) {
+  return typeof pattern === "string" ? pattern : pattern.source;
+}
+function compileAnchored(patterns) {
+  const sources = patterns.map(patternSource).filter((source) => source.length > 0);
+  if (sources.length === 0) {
+    return null;
+  }
+  const combined = sources.map((source) => `(?:${source})`).join("|");
+  try {
+    return new RegExp(`^(?:${combined})$`, "u");
+  } catch (cause) {
+    throw new InvalidOptionError(
+      `neverRedact.patterns contains an invalid regular expression: ${String(cause)}`
+    );
+  }
+}
+function createAllowList(options) {
+  const values = new Set((options?.values ?? []).filter((value) => value.length > 0));
+  const pattern = compileAnchored(options?.patterns ?? []);
+  const byRule = /* @__PURE__ */ new Map();
+  for (const entry of options?.byRule ?? []) {
+    const existing = byRule.get(entry.ruleId) ?? /* @__PURE__ */ new Set();
+    for (const value of entry.values) {
+      if (value.length > 0) {
+        existing.add(value);
+      }
+    }
+    byRule.set(entry.ruleId, existing);
+  }
+  return {
+    empty: values.size === 0 && pattern === null && byRule.size === 0,
+    values,
+    pattern,
+    byRule
+  };
+}
+function isAllowed(allow, ruleId, value) {
+  if (allow.empty) {
+    return false;
+  }
+  if (allow.values.has(value)) {
+    return true;
+  }
+  if (allow.byRule.get(ruleId)?.has(value) === true) {
+    return true;
+  }
+  return allow.pattern !== null && allow.pattern.test(value);
+}
+
+// src/core/pseudonymize.ts
+var TOKEN_HEX_LENGTH = 16;
+var TOKEN_BYTES = TOKEN_HEX_LENGTH / 2;
+var textEncoder = new TextEncoder();
+function createPseudonymizer(key, encoding) {
+  const keyBytes = encoding === "utf8" ? textEncoder.encode(key) : hexToBytes(key);
+  const sign = createHmacSha256(keyBytes);
+  const cache = /* @__PURE__ */ new Map();
+  return (ruleId, value) => {
+    const cacheKey = `${ruleId}\0${value}`;
+    const cached = cache.get(cacheKey);
+    if (cached !== void 0) {
+      return cached;
+    }
+    const digest = sign(textEncoder.encode(cacheKey));
+    const token = bytesToHex(digest.subarray(0, TOKEN_BYTES));
+    cache.set(cacheKey, token);
+    return token;
+  };
+}
+function replacementPrefix(rule) {
+  if (rule.mode === "mask") {
+    return MASK_TOKEN_PREFIX;
+  }
+  return rule.token ?? rule.id.toUpperCase();
+}
+
+// src/core/compile.ts
+function compileRules(rules, aggressive) {
+  const parts = rules.map((rule) => ({
+    id: rule.id,
+    patterns: aggressive ? [...rule.patterns, ...rule.aggressivePatterns ?? []] : rule.patterns
+  })).filter(({ patterns }) => patterns.length > 0).map(({ id, patterns }) => `(?<${id}>${patterns.join("|")})`);
+  if (parts.length === 0) {
+    return null;
+  }
+  try {
+    return new RegExp(parts.join("|"), "gu");
+  } catch (cause) {
+    throw new InvalidRuleError(`Failed to compile the combined rule pattern: ${String(cause)}`);
+  }
+}
+function createRuleContext(input) {
+  const { rules } = input;
+  return {
+    compiled: compileRules(rules, input.aggressive),
+    rules,
+    ruleIds: rules.map((rule) => rule.id),
+    rulesById: new Map(rules.map((rule) => [rule.id, rule])),
+    prefixById: new Map(rules.map((rule) => [rule.id, replacementPrefix(rule)])),
+    pseudonymize: input.pseudonymize,
+    allow: input.allow,
+    contextChars: input.contextChars,
+    json: input.json
+  };
+}
+function buildReplacement(ctx, ruleId, value) {
+  return `<${ctx.prefixById.get(ruleId) ?? ruleId.toUpperCase()}:${ctx.pseudonymize(ruleId, value)}>`;
+}
+
+// src/core/lineSplitter.ts
+function extractLines(buffer) {
+  const lines = [];
+  let start = 0;
+  for (let i = 0; i < buffer.length; i += 1) {
+    if (buffer[i] === "\n") {
+      lines.push(buffer.slice(start, i + 1));
+      start = i + 1;
+    }
+  }
+  return { lines, rest: buffer.slice(start) };
+}
+function createLineSplitter(options = {}) {
+  const maxLineChars = options.maxLineChars ?? DEFAULT_MAX_LINE_CHARS;
+  const overlapChars = options.overlapChars ?? DEFAULT_LINE_OVERLAP_CHARS;
+  if (maxLineChars < 1) {
+    throw new InvalidOptionError("lines.maxLineChars must be at least 1.");
+  }
+  if (overlapChars < 0 || overlapChars >= maxLineChars) {
+    throw new InvalidOptionError(
+      `lines.overlapChars must be between 0 and lines.maxLineChars - 1 (${maxLineChars - 1}), got ${overlapChars}.`
+    );
+  }
+  let carry = "";
+  function push(chunk) {
+    carry += chunk;
+    const { lines, rest } = extractLines(carry);
+    carry = rest;
+    while (carry.length > maxLineChars) {
+      const cut = carry.length - overlapChars;
+      lines.push(carry.slice(0, cut));
+      carry = carry.slice(cut);
+    }
+    return lines;
+  }
+  function flush() {
+    if (carry.length === 0) {
+      return [];
+    }
+    const rest = carry;
+    carry = "";
+    return [rest];
+  }
+  return { push, flush };
+}
+
+// src/core/redactLine.ts
+function sliceContext(text, index, length, chars) {
+  return {
+    contextBefore: text.slice(Math.max(0, index - chars), index),
+    contextAfter: text.slice(index + length, index + length + chars)
+  };
+}
+function matchedRuleId(ruleIds, groups) {
+  for (const id of ruleIds) {
+    if (groups[id] !== void 0) {
+      return id;
+    }
+  }
+  return void 0;
+}
+function redactLine(line, ctx, options = {}) {
+  const { compiled, ruleIds, rulesById, allow, contextChars } = ctx;
+  const withSegments = options.withSegments ?? false;
+  const withMatches = options.withMatches ?? false;
+  if (!compiled) {
+    return {
+      output: line,
+      counts: {},
+      matches: [],
+      segments: withSegments ? { before: [{ text: line, changed: false }], after: [{ text: line, changed: false }] } : void 0
+    };
+  }
+  compiled.lastIndex = 0;
+  const counts = {};
+  const matches = [];
+  const before = [];
+  const after = [];
+  let output = "";
+  let cursor = 0;
+  let match = compiled.exec(line);
+  while (match !== null) {
+    const ruleId = match.groups ? matchedRuleId(ruleIds, match.groups) : void 0;
+    const rule = ruleId === void 0 ? void 0 : rulesById.get(ruleId);
+    const original = match[0];
+    if (rule === void 0 || ruleId === void 0) {
+      compiled.lastIndex = match.index + Math.max(original.length, 1);
+      match = compiled.exec(line);
+      continue;
+    }
+    const rejected = rule.validate !== void 0 && !rule.validate(original) || isAllowed(allow, ruleId, original);
+    if (rejected) {
+      compiled.lastIndex = match.index + Math.max(original.length, 1);
+      match = compiled.exec(line);
+      continue;
+    }
+    const replacement = buildReplacement(ctx, ruleId, original);
+    if (withSegments) {
+      if (match.index > cursor) {
+        const gap = line.slice(cursor, match.index);
+        before.push({ text: gap, changed: false });
+        after.push({ text: gap, changed: false });
+      }
+      before.push({ text: original, changed: true });
+      after.push({ text: replacement, changed: true });
+    }
+    output += line.slice(cursor, match.index) + replacement;
+    cursor = match.index + original.length;
+    counts[ruleId] = (counts[ruleId] ?? 0) + 1;
+    if (withMatches) {
+      matches.push({
+        ruleId,
+        original,
+        replacement,
+        ...contextChars > 0 ? sliceContext(line, match.index, original.length, contextChars) : {}
+      });
+    }
+    if (original.length === 0) {
+      compiled.lastIndex += 1;
+    }
+    match = compiled.exec(line);
+  }
+  output += line.slice(cursor);
+  if (withSegments && cursor < line.length) {
+    const tail = line.slice(cursor);
+    before.push({ text: tail, changed: false });
+    after.push({ text: tail, changed: false });
+  }
+  return {
+    output,
+    counts,
+    matches,
+    segments: withSegments ? { before, after } : void 0
+  };
+}
+
+// src/core/redactJsonLine.ts
+var REPLACEMENT_TOKEN_RE = /<[A-Z][A-Z0-9]*:[0-9a-f]+>/g;
+function looksLikeJson(line) {
+  const trimmed = line.trim();
+  return trimmed.length > 0 && (trimmed.startsWith("{") || trimmed.startsWith("["));
+}
+function normalizeKey2(key) {
+  return key.toLowerCase().replace(/[-_]/g, "");
+}
+function buildJsonKeyIndex(rules) {
+  const index = /* @__PURE__ */ new Map();
+  for (const rule of rules) {
+    for (const key of rule.jsonKeys ?? []) {
+      const normalized = normalizeKey2(key);
+      if (!index.has(normalized)) {
+        index.set(normalized, rule);
+      }
+    }
+  }
+  return index;
+}
+var jsonKeyIndexCache = /* @__PURE__ */ new WeakMap();
+function jsonKeyIndex(rules) {
+  const cached = jsonKeyIndexCache.get(rules);
+  if (cached) {
+    return cached;
+  }
+  const index = buildJsonKeyIndex(rules);
+  jsonKeyIndexCache.set(rules, index);
+  return index;
+}
+function mergeCounts(target, source) {
+  for (const [id, count] of Object.entries(source)) {
+    target[id] = (target[id] ?? 0) + count;
+  }
+}
+function highlightReplacements(text) {
+  const segments = [];
+  let cursor = 0;
+  REPLACEMENT_TOKEN_RE.lastIndex = 0;
+  let match = REPLACEMENT_TOKEN_RE.exec(text);
+  while (match !== null) {
+    if (match.index > cursor) {
+      segments.push({ text: text.slice(cursor, match.index), changed: false });
+    }
+    segments.push({ text: match[0], changed: true });
+    cursor = match.index + match[0].length;
+    match = REPLACEMENT_TOKEN_RE.exec(text);
+  }
+  if (cursor < text.length) {
+    segments.push({ text: text.slice(cursor), changed: false });
+  }
+  return segments.length > 0 ? segments : [{ text, changed: false }];
+}
+function redactJsonLine(line, ctx, options = {}) {
+  const terminatorMatch = /(\r\n|\r|\n)$/.exec(line);
+  const terminator = terminatorMatch ? terminatorMatch[0] : "";
+  const content = terminator ? line.slice(0, -terminator.length) : line;
+  let parsed;
+  try {
+    parsed = JSON.parse(content);
+  } catch {
+    return null;
+  }
+  if (typeof parsed !== "object" || parsed === null) {
+    return null;
+  }
+  const withSegments = options.withSegments ?? false;
+  const withMatches = options.withMatches ?? false;
+  const keyIndex = jsonKeyIndex(ctx.rules);
+  const counts = {};
+  const matches = [];
+  const contextFor = (value) => {
+    if (ctx.contextChars <= 0) {
+      return {};
+    }
+    const index = content.indexOf(value);
+    if (index < 0) {
+      return { contextBefore: "", contextAfter: "" };
+    }
+    return sliceContext(content, index, value.length, ctx.contextChars);
+  };
+  const redactValue = (value, key) => {
+    if (typeof value === "string") {
+      const fieldRule = key === void 0 ? void 0 : keyIndex.get(normalizeKey2(key));
+      if (fieldRule) {
+        if (isAllowed(ctx.allow, fieldRule.id, value)) {
+          return value;
+        }
+        const replacement = buildReplacement(ctx, fieldRule.id, value);
+        counts[fieldRule.id] = (counts[fieldRule.id] ?? 0) + 1;
+        if (withMatches) {
+          matches.push({
+            ruleId: fieldRule.id,
+            original: value,
+            replacement,
+            ...contextFor(value)
+          });
+        }
+        return replacement;
+      }
+      const result = redactLine(value, ctx, { withMatches });
+      mergeCounts(counts, result.counts);
+      if (withMatches) {
+        for (const match of result.matches) {
+          matches.push({ ...match, ...contextFor(match.original) });
+        }
+      }
+      return result.output;
+    }
+    if (Array.isArray(value)) {
+      return value.map((item) => redactValue(item));
+    }
+    if (value !== null && typeof value === "object") {
+      const out = {};
+      for (const [entryKey, entryValue] of Object.entries(value)) {
+        out[entryKey] = redactValue(entryValue, entryKey);
+      }
+      return out;
+    }
+    return value;
+  };
+  const output = JSON.stringify(redactValue(parsed)) + terminator;
+  if (!withSegments) {
+    return { output, counts, matches };
+  }
+  const preview = redactLine(line, ctx, { withSegments: true });
+  return {
+    output,
+    counts,
+    matches,
+    segments: {
+      before: preview.segments?.before ?? [{ text: line, changed: false }],
+      after: highlightReplacements(output)
+    }
+  };
+}
+
+// src/core/report.ts
+function createReportCollector(options = {}) {
+  const previewBytes = options.previewBytes ?? DEFAULT_PREVIEW_BYTES;
+  const collectReplacements = options.replacements ?? true;
+  if (previewBytes < 0) {
+    throw new InvalidOptionError("report.previewBytes must not be negative.");
+  }
+  const counts = {};
+  const replacements = /* @__PURE__ */ new Map();
+  const before = [];
+  const after = [];
+  let lineCount = 0;
+  let previewBytesUsed = 0;
+  let previewClosed = previewBytes === 0;
+  function needsSegments() {
+    return !previewClosed;
+  }
+  function needsMatches() {
+    return collectReplacements;
+  }
+  function record(result) {
+    lineCount += 1;
+    for (const [id, count] of Object.entries(result.counts)) {
+      counts[id] = (counts[id] ?? 0) + count;
+    }
+    if (collectReplacements) {
+      for (const match of result.matches) {
+        const key = `${match.ruleId}\0${match.original}`;
+        const existing = replacements.get(key);
+        if (existing) {
+          existing.count += 1;
+        } else {
+          replacements.set(key, {
+            ruleId: match.ruleId,
+            original: match.original,
+            replacement: match.replacement,
+            count: 1,
+            ...match.contextBefore !== void 0 ? { contextBefore: match.contextBefore, contextAfter: match.contextAfter } : {}
+          });
+        }
+      }
+    }
+    if (previewClosed) {
+      return;
+    }
+    if (result.segments) {
+      before.push(...result.segments.before);
+      after.push(...result.segments.after);
+    }
+    previewBytesUsed += result.output.length;
+    if (previewBytesUsed >= previewBytes) {
+      previewClosed = true;
+    }
+  }
+  function build(snapshot) {
+    const includeReplacements = snapshot?.includeReplacements ?? true;
+    let totalMatches = 0;
+    for (const count of Object.values(counts)) {
+      totalMatches += count;
+    }
+    return {
+      counts: { ...counts },
+      totalMatches,
+      lineCount,
+      replacements: includeReplacements ? [...replacements.values()] : [],
+      preview: { before: [...before], after: [...after] }
+    };
+  }
+  return { needsSegments, needsMatches, record, build };
+}
+
+// src/rules/validateRule.ts
+var RULE_ID_PATTERN = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+var TOKEN_PATTERN = /^[A-Z][A-Z0-9]*$/;
+var NAMED_GROUP_PATTERN = /\(\?<[^=!]/;
+function requireText(value, rule, field) {
+  if (typeof value !== "string" || value.trim().length === 0) {
+    throw new InvalidRuleError(`Rule "${rule}": \`${field}\` must be a non-empty string.`);
+  }
+  return value;
+}
+function assertPatterns(patterns, ruleId, field) {
+  if (patterns === void 0) {
+    return [];
+  }
+  if (!Array.isArray(patterns)) {
+    throw new InvalidRuleError(`Rule "${ruleId}": \`${field}\` must be an array of strings.`);
+  }
+  return patterns.map((pattern, index) => {
+    if (typeof pattern !== "string" || pattern.length === 0) {
+      throw new InvalidRuleError(
+        `Rule "${ruleId}": \`${field}[${index}]\` must be a non-empty regular expression source.`
+      );
+    }
+    if (NAMED_GROUP_PATTERN.test(pattern)) {
+      throw new InvalidRuleError(
+        `Rule "${ruleId}": \`${field}[${index}]\` must not declare a named capture group \u2014 the rule identifier is used as the group name.`
+      );
+    }
+    try {
+      new RegExp(pattern, "u");
+    } catch (cause) {
+      throw new InvalidRuleError(
+        `Rule "${ruleId}": \`${field}[${index}]\` is not a valid Unicode regular expression: ${String(cause)}`
+      );
+    }
+    return pattern;
+  });
+}
+function validateRule(rule) {
+  if (typeof rule !== "object" || rule === null) {
+    throw new InvalidRuleError("A rule must be an object.");
+  }
+  const id = requireText(rule.id, String(rule.id), "id");
+  if (!RULE_ID_PATTERN.test(id)) {
+    throw new InvalidRuleError(
+      `Rule "${id}": \`id\` must be a valid ASCII identifier matching ${RULE_ID_PATTERN.source}, because it is used as a named capture group.`
+    );
+  }
+  requireText(rule.label, id, "label");
+  requireText(rule.description, id, "description");
+  if (rule.mode !== "pseudo" && rule.mode !== "mask") {
+    throw new InvalidRuleError(`Rule "${id}": \`mode\` must be either "pseudo" or "mask".`);
+  }
+  if (rule.token !== void 0 && !TOKEN_PATTERN.test(rule.token)) {
+    throw new InvalidRuleError(
+      `Rule "${id}": \`token\` must match ${TOKEN_PATTERN.source}, so replacement tokens stay recognizable.`
+    );
+  }
+  const patterns = assertPatterns(rule.patterns, id, "patterns");
+  const aggressivePatterns = assertPatterns(rule.aggressivePatterns, id, "aggressivePatterns");
+  if (patterns.length === 0 && aggressivePatterns.length === 0) {
+    throw new InvalidRuleError(`Rule "${id}": at least one pattern is required.`);
+  }
+  if (rule.jsonKeys !== void 0) {
+    if (!Array.isArray(rule.jsonKeys)) {
+      throw new InvalidRuleError(`Rule "${id}": \`jsonKeys\` must be an array of strings.`);
+    }
+    for (const [index, key] of rule.jsonKeys.entries()) {
+      requireText(key, id, `jsonKeys[${index}]`);
+    }
+  }
+  if (rule.validate !== void 0 && typeof rule.validate !== "function") {
+    throw new InvalidRuleError(`Rule "${id}": \`validate\` must be a function.`);
+  }
+  return rule;
+}
+
+// src/core/resolveRules.ts
+function toRule(selector) {
+  if (typeof selector === "string") {
+    const builtin = getBuiltinRule(selector);
+    if (!builtin) {
+      throw new UnknownRuleError(
+        `Unknown rule "${selector}". Pass a rule object for custom rules, or one of the built-in identifiers.`
+      );
+    }
+    return builtin;
+  }
+  return validateRule(selector);
+}
+function resolveRules(selectors, extraRules = []) {
+  const resolved = [];
+  const positions = /* @__PURE__ */ new Map();
+  for (const selector of [...selectors, ...extraRules]) {
+    const rule = toRule(selector);
+    const existing = positions.get(rule.id);
+    if (existing === void 0) {
+      positions.set(rule.id, resolved.length);
+      resolved.push(rule);
+    } else {
+      resolved[existing] = rule;
+    }
+  }
+  return resolved;
+}
+
+// src/core/sanitizer.ts
+async function* toAsyncIterable(source) {
+  yield* source;
+}
+function processLine(line, ctx, collector) {
+  const options = {
+    withSegments: collector.needsSegments(),
+    withMatches: collector.needsMatches()
+  };
+  const parsed = ctx.json && looksLikeJson(line) ? redactJsonLine(line, ctx, options) : null;
+  const result = parsed ?? redactLine(line, ctx, options);
+  collector.record(result);
+  return result.output;
+}
+function createSanitizer(options = {}) {
+  const keyEncoding = options.keyEncoding ?? "hex";
+  const key = options.key ?? generateKey();
+  assertKey(key, keyEncoding);
+  const contextChars = options.report?.contextChars ?? 0;
+  if (contextChars < 0) {
+    throw new InvalidOptionError("report.contextChars must not be negative.");
+  }
+  const selected = resolveWithAlwaysRedact(options);
+  const ctx = createRuleContext({
+    rules: selected,
+    aggressive: options.aggressive ?? false,
+    pseudonymize: createPseudonymizer(key, keyEncoding),
+    allow: createAllowList(options.neverRedact),
+    contextChars,
+    json: options.json !== false
+  });
+  const collectorOptions = {
+    previewBytes: options.report?.previewBytes,
+    replacements: options.report?.replacements
+  };
+  const rules = selected.map((rule) => ({
+    id: rule.id,
+    label: rule.label,
+    description: rule.description,
+    mode: rule.mode
+  }));
+  function sanitizeText(text) {
+    const collector = createReportCollector(collectorOptions);
+    const splitter = createLineSplitter(options.lines);
+    let output = "";
+    for (const line of splitter.push(text)) {
+      output += processLine(line, ctx, collector);
+    }
+    for (const line of splitter.flush()) {
+      output += processLine(line, ctx, collector);
+    }
+    return { output, report: collector.build() };
+  }
+  async function sanitizeStream(source, sink, streamOptions = {}) {
+    const collector = createReportCollector(collectorOptions);
+    const splitter = createLineSplitter(options.lines);
+    const { signal, onProgress } = streamOptions;
+    let charsRead = 0;
+    const writeLine = async (line) => {
+      if (signal?.aborted === true) {
+        throw new SanitizationAbortedError();
+      }
+      await sink.write(processLine(line, ctx, collector));
+    };
+    for await (const chunk of toAsyncIterable(source)) {
+      charsRead += chunk.length;
+      for (const line of splitter.push(chunk)) {
+        await writeLine(line);
+      }
+      onProgress?.({ charsRead, report: collector.build({ includeReplacements: false }) });
+    }
+    for (const line of splitter.flush()) {
+      await writeLine(line);
+    }
+    await sink.close?.();
+    return collector.build();
+  }
+  return { key, rules, sanitizeText, sanitizeStream };
+}
+function resolveWithAlwaysRedact(options) {
+  const selected = resolveRules(options.rules ?? builtinRuleIds, options.extraRules);
+  const alwaysRule = createAlwaysRedactRule(options.alwaysRedact);
+  if (!alwaysRule) {
+    return selected;
+  }
+  if (selected.some((rule) => rule.id === alwaysRule.id)) {
+    throw new InvalidOptionError(
+      `alwaysRedact.ruleId "${alwaysRule.id}" collides with an active rule. Choose an identifier that is not in use.`
+    );
+  }
+  return [alwaysRule, ...selected];
+}
+
+// src/io/sinks.ts
+function toNullSink() {
+  return { write: () => void 0 };
+}
+var DEFAULT_CHUNK_BYTES = 4 * 1024 * 1024;
+function fromNodeStream(stream) {
+  return {
+    async *[Symbol.asyncIterator]() {
+      const decoder = new TextDecoder("utf-8");
+      for await (const chunk of stream) {
+        const text = typeof chunk === "string" ? chunk : decoder.decode(chunk, { stream: true });
+        if (text.length > 0) {
+          yield text;
+        }
+      }
+      const tail = decoder.decode();
+      if (tail.length > 0) {
+        yield tail;
+      }
+    }
+  };
+}
+function fromFile(path, chunkBytes = DEFAULT_CHUNK_BYTES) {
+  return fromNodeStream(createReadStream(path, { highWaterMark: chunkBytes }));
+}
+function toNodeStream(stream) {
+  return {
+    async write(chunk) {
+      if (!stream.write(chunk)) {
+        await once(stream, "drain");
+      }
+    }
+  };
+}
+function toFile(path) {
+  const stream = createWriteStream(path, { encoding: "utf-8" });
+  const target = toNodeStream(stream);
+  return {
+    write: target.write.bind(target),
+    async close() {
+      stream.end();
+      await finished(stream);
+    }
+  };
+}
+
+// src/cli.ts
+var EXIT_OK = 0;
+var EXIT_ERROR = 1;
+var EXIT_USAGE = 2;
+var HELP = `Usage: logtotal-sanitize [options] <input>
+
+Redact secrets, identifiers and PII from a log file. Input "-" reads stdin.
+
+Options:
+  -o, --out <path>           Output file (default: <input>.sanitized)
+      --stdout               Write sanitized text to stdout
+      --report <path>        Write a JSON report to <path>
+      --report-format <fmt>  json | text (default: json)
+      --rules <ids>          Comma-separated built-in rule ids (default: all)
+      --exclude-rules <ids>  Comma-separated built-in rule ids to skip
+      --rules-file <path>    Load extra rules from a JS/JSON module
+      --exclude <value>      Never redact this exact value (repeatable)
+      --exclude-file <path>  Newline-separated never-redact values
+      --redact <value>       Always redact this exact value (repeatable)
+      --redact-file <path>   Newline-separated always-redact values
+      --aggressive           Enable broader, noisier patterns
+      --key <value>          HMAC key (reuse to correlate tokens across files)
+      --key-file <path>      Read HMAC key from a file
+      --key-encoding <enc>   hex | utf8
+      --print-key            Print the key to stderr
+      --dry-run              Report only; do not write sanitized output
+      --fail-on-match        Exit 1 if anything was redacted
+      --progress             Show a live progress bar on stderr
+      --no-progress          Do not show a progress bar
+  -q, --quiet                Suppress the text summary
+  -h, --help                 Show this help
+  -v, --version              Show version
+`;
+function parseCli(argv) {
+  const { values, positionals } = parseArgs({
+    args: argv,
+    allowPositionals: true,
+    options: {
+      out: { type: "string", short: "o" },
+      stdout: { type: "boolean", default: false },
+      report: { type: "string" },
+      "report-format": { type: "string", default: "json" },
+      rules: { type: "string" },
+      "exclude-rules": { type: "string" },
+      "rules-file": { type: "string" },
+      exclude: { type: "string", multiple: true },
+      "exclude-file": { type: "string" },
+      redact: { type: "string", multiple: true },
+      "redact-file": { type: "string" },
+      aggressive: { type: "boolean", default: false },
+      key: { type: "string" },
+      "key-file": { type: "string" },
+      "key-encoding": { type: "string" },
+      "print-key": { type: "boolean", default: false },
+      "dry-run": { type: "boolean", default: false },
+      "fail-on-match": { type: "boolean", default: false },
+      progress: { type: "boolean", default: false },
+      "no-progress": { type: "boolean", default: false },
+      quiet: { type: "boolean", short: "q", default: false },
+      help: { type: "boolean", short: "h", default: false },
+      version: { type: "boolean", short: "v", default: false }
+    }
+  });
+  const keyEncoding = values["key-encoding"] === "hex" || values["key-encoding"] === "utf8" ? values["key-encoding"] : void 0;
+  return {
+    out: values.out,
+    stdout: Boolean(values.stdout),
+    report: values.report,
+    reportFormat: values["report-format"] === "text" ? "text" : "json",
+    rules: values.rules,
+    excludeRules: values["exclude-rules"],
+    rulesFile: values["rules-file"],
+    exclude: values.exclude ?? [],
+    excludeFile: values["exclude-file"],
+    redact: values.redact ?? [],
+    redactFile: values["redact-file"],
+    aggressive: Boolean(values.aggressive),
+    key: values.key,
+    keyFile: values["key-file"],
+    keyEncoding,
+    printKey: Boolean(values["print-key"]),
+    dryRun: Boolean(values["dry-run"]),
+    failOnMatch: Boolean(values["fail-on-match"]),
+    progress: Boolean(values.progress),
+    noProgress: Boolean(values["no-progress"]),
+    quiet: Boolean(values.quiet),
+    help: Boolean(values.help),
+    version: Boolean(values.version),
+    input: positionals[0]
+  };
+}
+async function readLines(path) {
+  const text = await readFile(path, "utf8");
+  return text.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+}
+async function loadRulesFile(path) {
+  if (path.endsWith(".json")) {
+    const parsed = JSON.parse(await readFile(path, "utf8"));
+    return Array.isArray(parsed) ? parsed : [parsed];
+  }
+  const mod = await import(pathToFileURL(path).href);
+  const value = mod.default;
+  if (Array.isArray(value)) {
+    return value;
+  }
+  return [value];
+}
+function formatReportText(report) {
+  const lines = [`lines: ${report.lineCount}`, `matches: ${report.totalMatches}`];
+  for (const [id, count] of Object.entries(report.counts)) {
+    lines.push(`  ${id}: ${count}`);
+  }
+  return `${lines.join("\n")}
+`;
+}
+var PROGRESS_BAR_WIDTH = 20;
+function streamIsTty(stream) {
+  return Boolean(stream.isTTY);
+}
+function progressLabel(input, useStdin) {
+  if (useStdin) {
+    return "stdin";
+  }
+  const name = basename(input);
+  return name.length > 32 ? `${name.slice(0, 29)}...` : name;
+}
+function formatBytes(bytes) {
+  if (bytes < 1024) {
+    return `${Math.round(bytes)} B`;
+  }
+  const units = ["KB", "MB", "GB", "TB"];
+  let value = bytes / 1024;
+  let unit = 0;
+  while (value >= 1024 && unit < units.length - 1) {
+    value /= 1024;
+    unit += 1;
+  }
+  const digits = value >= 10 ? 1 : 2;
+  return `${value.toFixed(digits)} ${units[unit]}`;
+}
+function formatBar(ratio) {
+  const clamped = Math.min(1, Math.max(0, ratio));
+  const filled = Math.round(clamped * PROGRESS_BAR_WIDTH);
+  const head = filled > 0 && filled < PROGRESS_BAR_WIDTH ? ">" : filled === PROGRESS_BAR_WIDTH ? "=" : "";
+  const body = "=".repeat(Math.max(0, filled - head.length));
+  const empty = " ".repeat(PROGRESS_BAR_WIDTH - body.length - head.length);
+  return `[${body}${head}${empty}]`;
+}
+function formatProgressLine(state) {
+  const stats = `${formatBytes(state.bytesRead)}${state.totalBytes !== void 0 ? ` / ${formatBytes(state.totalBytes)}` : ""}  ${state.lineCount} lines  ${state.totalMatches} matches`;
+  if (state.totalBytes === void 0) {
+    return `${state.label}  ${stats}`;
+  }
+  const ratio = state.totalBytes === 0 ? 1 : Math.min(1, state.bytesRead / state.totalBytes);
+  const pct = String(Math.min(100, Math.floor(ratio * 100))).padStart(3, " ");
+  return `${state.label}  ${formatBar(ratio)} ${pct}%  ${stats}`;
+}
+function withByteTracking(source, tracked) {
+  return {
+    async *[Symbol.asyncIterator]() {
+      for await (const chunk of source) {
+        tracked.bytes += Buffer.byteLength(chunk, "utf8");
+        yield chunk;
+      }
+    }
+  };
+}
+function createProgressPrinter(stderr, options) {
+  const minIntervalMs = options.tty ? 80 : 500;
+  let lastAt = 0;
+  let lastLen = 0;
+  let lastText = "";
+  const lineFor = (bytesRead, report) => formatProgressLine({
+    label: options.label,
+    bytesRead,
+    totalBytes: options.totalBytes,
+    lineCount: report.lineCount,
+    totalMatches: report.totalMatches
+  });
+  const paint = (text, newline) => {
+    lastText = text;
+    if (options.tty) {
+      const padded = text.length < lastLen ? `${text}${" ".repeat(lastLen - text.length)}` : text;
+      stderr.write(`\r${padded}`);
+      lastLen = text.length;
+      if (newline) {
+        stderr.write("\n");
+      }
+    } else {
+      stderr.write(`${text}
+`);
+    }
+  };
+  return {
+    update(bytesRead, report) {
+      const now = Date.now();
+      if (now - lastAt < minIntervalMs) {
+        return;
+      }
+      lastAt = now;
+      paint(lineFor(bytesRead, report), false);
+    },
+    finish(bytesRead, report) {
+      const text = lineFor(bytesRead, report);
+      if (!options.tty && text === lastText) {
+        return;
+      }
+      paint(text, true);
+    }
+  };
+}
+async function runCli(argv, io = {
+  stdin: process.stdin,
+  stdout: process.stdout,
+  stderr: process.stderr
+}) {
+  let flags;
+  try {
+    flags = parseCli(argv);
+  } catch (error) {
+    io.stderr.write(`${error instanceof Error ? error.message : String(error)}
+`);
+    return EXIT_USAGE;
+  }
+  if (flags.help) {
+    io.stdout.write(HELP);
+    return EXIT_OK;
+  }
+  if (flags.version) {
+    const pkgUrl = new URL("../package.json", import.meta.url);
+    const pkg = JSON.parse(await readFile(pkgUrl, "utf8"));
+    io.stdout.write(`${pkg.version}
+`);
+    return EXIT_OK;
+  }
+  if (!flags.input) {
+    io.stderr.write('Missing input path. Use "-" for stdin.\n');
+    io.stderr.write(HELP);
+    return EXIT_USAGE;
+  }
+  const extraRules = flags.rulesFile ? await loadRulesFile(flags.rulesFile) : [];
+  let ruleIds = [...builtinRuleIds];
+  if (flags.rules) {
+    ruleIds = flags.rules.split(",").map((id) => id.trim());
+  }
+  if (flags.excludeRules) {
+    const skip = new Set(flags.excludeRules.split(",").map((id) => id.trim()));
+    ruleIds = ruleIds.filter((id) => !skip.has(id));
+  }
+  const neverValues = [...flags.exclude];
+  if (flags.excludeFile) {
+    neverValues.push(...await readLines(flags.excludeFile));
+  }
+  const alwaysValues = [...flags.redact];
+  if (flags.redactFile) {
+    alwaysValues.push(...await readLines(flags.redactFile));
+  }
+  const suppliedKey = Boolean(flags.key || flags.keyFile);
+  let key = flags.key;
+  if (flags.keyFile) {
+    key = (await readFile(flags.keyFile, "utf8")).trim();
+  }
+  if (!key) {
+    key = generateKey();
+  }
+  if (flags.printKey) {
+    io.stderr.write(`${key}
+`);
+  }
+  const options = {
+    rules: ruleIds,
+    extraRules: extraRules.length > 0 ? extraRules : void 0,
+    aggressive: flags.aggressive,
+    key,
+    keyEncoding: flags.keyEncoding ?? (suppliedKey ? "utf8" : "hex"),
+    alwaysRedact: alwaysValues.length > 0 ? { values: alwaysValues } : void 0,
+    neverRedact: neverValues.length > 0 ? { values: neverValues } : void 0
+  };
+  const sanitizer = createSanitizer(options);
+  const useStdin = flags.input === "-";
+  const source = useStdin ? fromNodeStream(io.stdin) : fromFile(flags.input);
+  const tty = streamIsTty(io.stderr);
+  const showProgress = flags.noProgress ? false : flags.progress || tty && !flags.quiet;
+  const totalBytes = showProgress && !useStdin ? (await stat(flags.input)).size : void 0;
+  const tracked = { bytes: 0 };
+  const trackedSource = showProgress ? withByteTracking(source, tracked) : source;
+  const progress = showProgress ? createProgressPrinter(io.stderr, {
+    tty,
+    label: progressLabel(flags.input, useStdin),
+    totalBytes
+  }) : void 0;
+  const writeStdout = flags.stdout || useStdin && !flags.out;
+  let outputPath = flags.out;
+  if (!writeStdout && !flags.dryRun && !outputPath && !useStdin) {
+    outputPath = join(dirname(flags.input), `${basename(flags.input)}.sanitized`);
+  }
+  const sink = flags.dryRun ? toNullSink() : writeStdout ? toNodeStream(io.stdout) : toFile(outputPath);
+  const report = await sanitizer.sanitizeStream(trackedSource, sink, {
+    onProgress: progress ? (snapshot) => {
+      progress.update(tracked.bytes, snapshot.report);
+    } : void 0
+  });
+  progress?.finish(tracked.bytes, report);
+  if (flags.report) {
+    const body = flags.reportFormat === "text" ? formatReportText(report) : `${JSON.stringify(report, null, 2)}
+`;
+    await writeFile(flags.report, body, "utf8");
+  }
+  if (!flags.quiet && !writeStdout) {
+    io.stderr.write(formatReportText(report));
+  }
+  if (flags.failOnMatch && report.totalMatches > 0) {
+    return EXIT_ERROR;
+  }
+  return EXIT_OK;
+}
+async function main() {
+  try {
+    process.exitCode = await runCli(process.argv.slice(2));
+  } catch (error) {
+    process.stderr.write(`${error instanceof Error ? error.message : String(error)}
+`);
+    process.exitCode = EXIT_ERROR;
+  }
+}
+function isCliEntryPoint(entryPath = process.argv[1]) {
+  if (!entryPath) {
+    return false;
+  }
+  try {
+    return realpathSync(fileURLToPath(import.meta.url)) === realpathSync(entryPath);
+  } catch {
+    return false;
+  }
+}
+if (isCliEntryPoint()) {
+  void main();
+}
+
+export { EXIT_ERROR, EXIT_OK, EXIT_USAGE, isCliEntryPoint, runCli };
+//# sourceMappingURL=cli.js.map
+//# sourceMappingURL=cli.js.map