@socprime/logtotal-sanitizer 0.0.1-beta.0

package/index.d.ts

@@ -0,0 +1,157 @@
+import { S as SanitizerOptions, r as Sanitizer, T as TextSource, c as TextSink, p as SanitizeStreamOptions, b as SanitizeReport, q as SanitizeTextResult, B as BlobLike, R as ReadableStreamLike } from './index-CutSH_48.js';
+export { A as AbortSignalLike, d as AlwaysRedactOptions, e as BuiltinRuleId, K as KeyEncoding, L as LineOptions, N as NeverRedactOptions, f as NeverRedactRuleEntry, g as RedactionMode, h as ReportOptions, i as RuleCounts, j as RuleId, k as RuleInfo, l as RuleSelector, a as SanitizeProgress, m as SanitizeReplacement, n as SanitizeRule, o as SanitizeSegment, s as builtinRuleIds, t as builtinRules, u as defineRule, v as getBuiltinRule } from './index-CutSH_48.js';
+
+/**
+ * Machine-readable cause of a {@link SanitizerError}.
+ */
+type SanitizerErrorCode = 'INVALID_RULE' | 'UNKNOWN_RULE' | 'INVALID_KEY' | 'INVALID_OPTION' | 'ABORTED';
+/**
+ * Base class for every error this package throws.
+ */
+declare class SanitizerError extends Error {
+    /** Machine-readable cause, stable across releases. */
+    readonly code: SanitizerErrorCode;
+    constructor(code: SanitizerErrorCode, message: string);
+}
+/** A rule object is malformed. */
+declare class InvalidRuleError extends SanitizerError {
+    constructor(message: string);
+}
+/** A rule identifier does not match any built-in rule. */
+declare class UnknownRuleError extends SanitizerError {
+    constructor(message: string);
+}
+/** A key is malformed, or no secure random source is available to generate one. */
+declare class InvalidKeyError extends SanitizerError {
+    constructor(message: string);
+}
+/** An option value is outside its allowed range. */
+declare class InvalidOptionError extends SanitizerError {
+    constructor(message: string);
+}
+/** A streaming run was stopped through its `AbortSignal`. */
+declare class SanitizationAbortedError extends SanitizerError {
+    constructor(message?: string);
+}
+/**
+ * Whether a caught value is an error thrown by this package.
+ *
+ * Prefer this over `instanceof` when the value may have crossed a bundle, worker or realm
+ * boundary, where class identity is not preserved.
+ */
+declare function isSanitizerError(value: unknown): value is SanitizerError;
+
+/**
+ * Generates a random hex-encoded key for token derivation.
+ *
+ * Persist the returned value if tokens have to stay comparable across runs or files; discard it if
+ * they should not. There is no way to recover the original values from the tokens, with or without
+ * the key — the key only determines which token a given value maps to.
+ *
+ * @param byteLength Key length in bytes, at least 16.
+ * @throws {InvalidKeyError} When `byteLength` is too small or no secure random source is available.
+ *
+ * @example
+ * ```ts
+ * const key = generateKey();
+ * const sanitizer = createSanitizer({ key });
+ * ```
+ */
+declare function generateKey(byteLength?: number): string;
+
+/**
+ * Creates a reusable sanitizer.
+ *
+ * Rules are resolved, validated and compiled into a single pattern once, here — so sanitizing many
+ * inputs with one sanitizer is much cheaper than calling the one-shot helpers repeatedly.
+ *
+ * @throws {UnknownRuleError} When `rules` names a rule that is not built in.
+ * @throws {InvalidRuleError} When a custom rule is malformed.
+ * @throws {InvalidKeyError} When `key` is malformed, or none could be generated.
+ * @throws {InvalidOptionError} When an option value is out of range.
+ *
+ * @example
+ * ```ts
+ * const sanitizer = createSanitizer({
+ *   rules: ['secrets', 'ips', 'users'],
+ *   alwaysRedact: { values: ['acme-internal'] },
+ *   neverRedact: { values: ['127.0.0.1'] },
+ * });
+ *
+ * const { output, report } = sanitizer.sanitizeText('login from 10.0.0.7 failed');
+ * ```
+ */
+declare function createSanitizer(options?: SanitizerOptions): Sanitizer;
+/**
+ * Sanitizes a string with a one-off configuration.
+ *
+ * Convenient for scripts and tests. Each call builds a new sanitizer, so unless `options.key` is
+ * supplied the tokens are not comparable between calls. For repeated use, create a sanitizer with
+ * {@link createSanitizer} instead.
+ */
+declare function sanitizeText(text: string, options?: SanitizerOptions): SanitizeTextResult;
+/**
+ * Streams text through a one-off sanitizer.
+ *
+ * See {@link sanitizeText} for the trade-off of creating a sanitizer per call.
+ */
+declare function sanitizeStream(source: TextSource, sink: TextSink, options?: SanitizerOptions & SanitizeStreamOptions): Promise<SanitizeReport>;
+
+/**
+ * Wraps a string as a source, split into fixed-size chunks.
+ *
+ * Useful for exercising the streaming path in tests and for feeding text that is already in memory
+ * without copying it in one piece.
+ */
+declare function fromString(text: string, chunkChars?: number): TextSource;
+/**
+ * Reads a `Blob` or `File` as UTF-8 text, one chunk at a time.
+ *
+ * Multi-byte characters split across a chunk boundary are decoded correctly. Accepts any object
+ * with `size`, `slice` and `arrayBuffer`, so browser `File`, browser `Blob` and Node's `Blob` all
+ * work.
+ *
+ * @example
+ * ```ts
+ * const report = await sanitizer.sanitizeStream(fromBlob(file), toStringSink());
+ * ```
+ */
+declare function fromBlob(blob: BlobLike, chunkBytes?: number): TextSource;
+/**
+ * Reads a `ReadableStream` of text or bytes.
+ *
+ * Byte chunks are decoded as UTF-8 across chunk boundaries. Accepts web streams from `fetch`,
+ * `Blob.stream()` and `node:stream/web`.
+ */
+declare function fromWebStream(stream: ReadableStreamLike<string | Uint8Array>): TextSource;
+
+/** A sink that accumulates everything in memory. */
+interface StringSink extends TextSink {
+    /** Everything written so far, joined. */
+    readonly text: string;
+}
+/**
+ * Collects sanitized output into a string.
+ *
+ * Only appropriate when the output is known to fit in memory — the point of the streaming API is
+ * usually to avoid that.
+ *
+ * @example
+ * ```ts
+ * const sink = toStringSink();
+ * const report = await sanitizer.sanitizeStream(fromString(input), sink);
+ * console.log(sink.text, report.totalMatches);
+ * ```
+ */
+declare function toStringSink(): StringSink;
+/**
+ * Sends sanitized output to a callback, one line at a time.
+ *
+ * The callback may return a promise; it is awaited before the next line is written, so
+ * backpressure propagates to the source.
+ */
+declare function toCallbackSink(onChunk: (chunk: string) => void | Promise<void>, onClose?: () => void | Promise<void>): TextSink;
+/** A sink that discards everything, for report-only runs. */
+declare function toNullSink(): TextSink;
+
+export { BlobLike, InvalidKeyError, InvalidOptionError, InvalidRuleError, ReadableStreamLike, SanitizationAbortedError, SanitizeReport, SanitizeStreamOptions, SanitizeTextResult, Sanitizer, SanitizerError, type SanitizerErrorCode, SanitizerOptions, type StringSink, TextSink, TextSource, UnknownRuleError, createSanitizer, fromBlob, fromString, fromWebStream, generateKey, isSanitizerError, sanitizeStream, sanitizeText, toCallbackSink, toNullSink, toStringSink };

package/index.js

@@ -0,0 +1,4 @@
+export { createSanitizer, fromBlob, fromString, fromWebStream, generateKey, sanitizeStream, sanitizeText, toCallbackSink, toNullSink, toStringSink } from './chunk-U6SJR7S7.js';
+export { InvalidKeyError, InvalidOptionError, InvalidRuleError, SanitizationAbortedError, SanitizerError, UnknownRuleError, builtinRuleIds, builtinRules, defineRule, getBuiltinRule, isSanitizerError } from './chunk-TAMK67JP.js';
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"index.js"}

package/node.cjs

@@ -0,0 +1,147 @@
+'use strict';
+
+var chunkWISLDJT3_cjs = require('./chunk-WISLDJT3.cjs');
+var chunkVW3VVW6L_cjs = require('./chunk-VW3VVW6L.cjs');
+var fs = require('fs');
+var events = require('events');
+var promises = require('stream/promises');
+
+var DEFAULT_CHUNK_BYTES = 4 * 1024 * 1024;
+function fromNodeStream(stream) {
+  return {
+    async *[Symbol.asyncIterator]() {
+      const decoder = new TextDecoder("utf-8");
+      for await (const chunk of stream) {
+        const text = typeof chunk === "string" ? chunk : decoder.decode(chunk, { stream: true });
+        if (text.length > 0) {
+          yield text;
+        }
+      }
+      const tail = decoder.decode();
+      if (tail.length > 0) {
+        yield tail;
+      }
+    }
+  };
+}
+function fromFile(path, chunkBytes = DEFAULT_CHUNK_BYTES) {
+  return fromNodeStream(fs.createReadStream(path, { highWaterMark: chunkBytes }));
+}
+function toNodeStream(stream) {
+  return {
+    async write(chunk) {
+      if (!stream.write(chunk)) {
+        await events.once(stream, "drain");
+      }
+    }
+  };
+}
+function toFile(path) {
+  const stream = fs.createWriteStream(path, { encoding: "utf-8" });
+  const target = toNodeStream(stream);
+  return {
+    write: target.write.bind(target),
+    async close() {
+      stream.end();
+      await promises.finished(stream);
+    }
+  };
+}
+async function sanitizeFile(options) {
+  const { input, output, chunkBytes, onProgress, signal, ...sanitizerOptions } = options;
+  const sanitizer = chunkWISLDJT3_cjs.createSanitizer(sanitizerOptions);
+  const sink = output === void 0 ? chunkWISLDJT3_cjs.toNullSink() : toFile(output);
+  return sanitizer.sanitizeStream(fromFile(input, chunkBytes), sink, { onProgress, signal });
+}
+
+Object.defineProperty(exports, "createSanitizer", {
+  enumerable: true,
+  get: function () { return chunkWISLDJT3_cjs.createSanitizer; }
+});
+Object.defineProperty(exports, "fromBlob", {
+  enumerable: true,
+  get: function () { return chunkWISLDJT3_cjs.fromBlob; }
+});
+Object.defineProperty(exports, "fromString", {
+  enumerable: true,
+  get: function () { return chunkWISLDJT3_cjs.fromString; }
+});
+Object.defineProperty(exports, "fromWebStream", {
+  enumerable: true,
+  get: function () { return chunkWISLDJT3_cjs.fromWebStream; }
+});
+Object.defineProperty(exports, "generateKey", {
+  enumerable: true,
+  get: function () { return chunkWISLDJT3_cjs.generateKey; }
+});
+Object.defineProperty(exports, "sanitizeStream", {
+  enumerable: true,
+  get: function () { return chunkWISLDJT3_cjs.sanitizeStream; }
+});
+Object.defineProperty(exports, "sanitizeText", {
+  enumerable: true,
+  get: function () { return chunkWISLDJT3_cjs.sanitizeText; }
+});
+Object.defineProperty(exports, "toCallbackSink", {
+  enumerable: true,
+  get: function () { return chunkWISLDJT3_cjs.toCallbackSink; }
+});
+Object.defineProperty(exports, "toNullSink", {
+  enumerable: true,
+  get: function () { return chunkWISLDJT3_cjs.toNullSink; }
+});
+Object.defineProperty(exports, "toStringSink", {
+  enumerable: true,
+  get: function () { return chunkWISLDJT3_cjs.toStringSink; }
+});
+Object.defineProperty(exports, "InvalidKeyError", {
+  enumerable: true,
+  get: function () { return chunkVW3VVW6L_cjs.InvalidKeyError; }
+});
+Object.defineProperty(exports, "InvalidOptionError", {
+  enumerable: true,
+  get: function () { return chunkVW3VVW6L_cjs.InvalidOptionError; }
+});
+Object.defineProperty(exports, "InvalidRuleError", {
+  enumerable: true,
+  get: function () { return chunkVW3VVW6L_cjs.InvalidRuleError; }
+});
+Object.defineProperty(exports, "SanitizationAbortedError", {
+  enumerable: true,
+  get: function () { return chunkVW3VVW6L_cjs.SanitizationAbortedError; }
+});
+Object.defineProperty(exports, "SanitizerError", {
+  enumerable: true,
+  get: function () { return chunkVW3VVW6L_cjs.SanitizerError; }
+});
+Object.defineProperty(exports, "UnknownRuleError", {
+  enumerable: true,
+  get: function () { return chunkVW3VVW6L_cjs.UnknownRuleError; }
+});
+Object.defineProperty(exports, "builtinRuleIds", {
+  enumerable: true,
+  get: function () { return chunkVW3VVW6L_cjs.builtinRuleIds; }
+});
+Object.defineProperty(exports, "builtinRules", {
+  enumerable: true,
+  get: function () { return chunkVW3VVW6L_cjs.builtinRules; }
+});
+Object.defineProperty(exports, "defineRule", {
+  enumerable: true,
+  get: function () { return chunkVW3VVW6L_cjs.defineRule; }
+});
+Object.defineProperty(exports, "getBuiltinRule", {
+  enumerable: true,
+  get: function () { return chunkVW3VVW6L_cjs.getBuiltinRule; }
+});
+Object.defineProperty(exports, "isSanitizerError", {
+  enumerable: true,
+  get: function () { return chunkVW3VVW6L_cjs.isSanitizerError; }
+});
+exports.fromFile = fromFile;
+exports.fromNodeStream = fromNodeStream;
+exports.sanitizeFile = sanitizeFile;
+exports.toFile = toFile;
+exports.toNodeStream = toNodeStream;
+//# sourceMappingURL=node.cjs.map
+//# sourceMappingURL=node.cjs.map

package/node.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/node/index.ts"],"names":["createReadStream","once","createWriteStream","finished","createSanitizer","toNullSink"],"mappings":";;;;;;;;AAgBA,IAAM,mBAAA,GAAsB,IAAI,IAAA,GAAO,IAAA;AAOhC,SAAS,eAAe,MAAA,EAAmE;AAChG,EAAA,OAAO;AAAA,IACL,QAAQ,MAAA,CAAO,aAAa,CAAA,GAA2B;AACrD,MAAA,MAAM,OAAA,GAAU,IAAI,WAAA,CAAY,OAAO,CAAA;AAEvC,MAAA,WAAA,MAAiB,SAAS,MAAA,EAA8C;AACtE,QAAA,MAAM,IAAA,GAAO,OAAO,KAAA,KAAU,QAAA,GAAW,KAAA,GAAQ,OAAA,CAAQ,MAAA,CAAO,KAAA,EAAO,EAAE,MAAA,EAAQ,IAAA,EAAM,CAAA;AAEvF,QAAA,IAAI,IAAA,CAAK,SAAS,CAAA,EAAG;AACnB,UAAA,MAAM,IAAA;AAAA,QACR;AAAA,MACF;AAEA,MAAA,MAAM,IAAA,GAAO,QAAQ,MAAA,EAAO;AAE5B,MAAA,IAAI,IAAA,CAAK,SAAS,CAAA,EAAG;AACnB,QAAA,MAAM,IAAA;AAAA,MACR;AAAA,IACF;AAAA,GACF;AACF;AAQO,SAAS,QAAA,CAAS,IAAA,EAAc,UAAA,GAAa,mBAAA,EAAiC;AACnF,EAAA,OAAO,eAAeA,mBAAA,CAAiB,IAAA,EAAM,EAAE,aAAA,EAAe,UAAA,EAAY,CAAC,CAAA;AAC7E;AAOO,SAAS,aAAa,MAAA,EAA4B;AACvD,EAAA,OAAO;AAAA,IACL,MAAM,MAAM,KAAA,EAA8B;AACxC,MAAA,IAAI,CAAC,MAAA,CAAO,KAAA,CAAM,KAAK,CAAA,EAAG;AACxB,QAAA,MAAMC,WAAA,CAAK,QAAQ,OAAO,CAAA;AAAA,MAC5B;AAAA,IACF;AAAA,GACF;AACF;AAOO,SAAS,OAAO,IAAA,EAAwB;AAC7C,EAAA,MAAM,SAASC,oBAAA,CAAkB,IAAA,EAAM,EAAE,QAAA,EAAU,SAAS,CAAA;AAC5D,EAAA,MAAM,MAAA,GAAS,aAAa,MAAM,CAAA;AAElC,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,MAAA,CAAO,KAAA,CAAM,IAAA,CAAK,MAAM,CAAA;AAAA,IAC/B,MAAM,KAAA,GAAuB;AAC3B,MAAA,MAAA,CAAO,GAAA,EAAI;AACX,MAAA,MAAMC,kBAAS,MAAM,CAAA;AAAA,IACvB;AAAA,GACF;AACF;AAiCA,eAAsB,aAAa,OAAA,EAAuD;AACxF,EAAA,MAAM,EAAE,OAAO,MAAA,EAAQ,UAAA,EAAY,YAAY,MAAA,EAAQ,GAAG,kBAAiB,GAAI,OAAA;AAC/E,EAAA,MAAM,SAAA,GAAYC,kCAAgB,gBAAgB,CAAA;AAClD,EAAA,MAAM,OAAO,MAAA,KAAW,MAAA,GAAYC,4BAAA,EAAW,GAAI,OAAO,MAAM,CAAA;AAEhE,EAAA,OAAO,SAAA,CAAU,cAAA,CAAe,QAAA,CAAS,KAAA,EAAO,UAAU,GAAG,IAAA,EAAM,EAAE,UAAA,EAAY,MAAA,EAAQ,CAAA;AAC3F","file":"node.cjs","sourcesContent":["import { createReadStream, createWriteStream } from 'node:fs';\nimport { once } from 'node:events';\nimport type { Readable, Writable } from 'node:stream';\nimport { finished } from 'node:stream/promises';\n\nimport { createSanitizer } from '../core/sanitizer';\nimport { toNullSink } from '../io/sinks';\nimport type {\n  AbortSignalLike,\n  SanitizeProgress,\n  SanitizeReport,\n  SanitizerOptions,\n  TextSink,\n  TextSource,\n} from '../types';\n\nconst DEFAULT_CHUNK_BYTES = 4 * 1024 * 1024;\n\n/**\n * Reads a Node readable stream as UTF-8 text.\n *\n * Byte chunks are decoded across chunk boundaries, so multi-byte characters are never split.\n */\nexport function fromNodeStream(stream: Readable | AsyncIterable<string | Uint8Array>): TextSource {\n  return {\n    async *[Symbol.asyncIterator](): AsyncIterator<string> {\n      const decoder = new TextDecoder('utf-8');\n\n      for await (const chunk of stream as AsyncIterable<string | Uint8Array>) {\n        const text = typeof chunk === 'string' ? chunk : decoder.decode(chunk, { stream: true });\n\n        if (text.length > 0) {\n          yield text;\n        }\n      }\n\n      const tail = decoder.decode();\n\n      if (tail.length > 0) {\n        yield tail;\n      }\n    },\n  };\n}\n\n/**\n * Reads a file as UTF-8 text.\n *\n * @param path Path to the file to read.\n * @param chunkBytes Read buffer size.\n */\nexport function fromFile(path: string, chunkBytes = DEFAULT_CHUNK_BYTES): TextSource {\n  return fromNodeStream(createReadStream(path, { highWaterMark: chunkBytes }));\n}\n\n/**\n * Writes sanitized text to a Node writable stream, respecting backpressure.\n *\n * The stream is not ended when the run finishes, so it is safe to pass `process.stdout`.\n */\nexport function toNodeStream(stream: Writable): TextSink {\n  return {\n    async write(chunk: string): Promise<void> {\n      if (!stream.write(chunk)) {\n        await once(stream, 'drain');\n      }\n    },\n  };\n}\n\n/**\n * Writes sanitized text to a file, creating or truncating it.\n *\n * The file is closed and flushed when the run finishes.\n */\nexport function toFile(path: string): TextSink {\n  const stream = createWriteStream(path, { encoding: 'utf-8' });\n  const target = toNodeStream(stream);\n\n  return {\n    write: target.write.bind(target),\n    async close(): Promise<void> {\n      stream.end();\n      await finished(stream);\n    },\n  };\n}\n\n/** Options for {@link sanitizeFile}. */\nexport interface SanitizeFileOptions extends SanitizerOptions {\n  /** Path of the file to read. */\n  input: string;\n  /** Path to write the sanitized result to. Omit for a report-only run. */\n  output?: string;\n  /** Read buffer size, in bytes. */\n  chunkBytes?: number;\n  /** Called after each chunk with a live snapshot of progress. */\n  onProgress?: (progress: SanitizeProgress) => void;\n  /** Aborts the run between lines. A partially written output file is left in place. */\n  signal?: AbortSignalLike;\n}\n\n/**\n * Sanitizes a file on disk, streaming it so memory use stays flat regardless of file size.\n *\n * @returns The report for the whole file.\n * @throws {SanitizationAbortedError} When `options.signal` is aborted.\n *\n * @example\n * ```ts\n * const report = await sanitizeFile({\n *   input: 'app.log',\n *   output: 'app.sanitized.log',\n *   rules: ['secrets', 'ips'],\n * });\n *\n * console.log(`${report.totalMatches} values redacted`);\n * ```\n */\nexport async function sanitizeFile(options: SanitizeFileOptions): Promise<SanitizeReport> {\n  const { input, output, chunkBytes, onProgress, signal, ...sanitizerOptions } = options;\n  const sanitizer = createSanitizer(sanitizerOptions);\n  const sink = output === undefined ? toNullSink() : toFile(output);\n\n  return sanitizer.sanitizeStream(fromFile(input, chunkBytes), sink, { onProgress, signal });\n}\n\nexport * from '../index';\n"]}

package/node.d.cts

@@ -0,0 +1,63 @@
+import { Readable, Writable } from 'node:stream';
+import { S as SanitizerOptions, a as SanitizeProgress, A as AbortSignalLike, T as TextSource, b as SanitizeReport, c as TextSink } from './index-CutSH_48.cjs';
+export { d as AlwaysRedactOptions, B as BlobLike, e as BuiltinRuleId, K as KeyEncoding, L as LineOptions, N as NeverRedactOptions, f as NeverRedactRuleEntry, R as ReadableStreamLike, g as RedactionMode, h as ReportOptions, i as RuleCounts, j as RuleId, k as RuleInfo, l as RuleSelector, m as SanitizeReplacement, n as SanitizeRule, o as SanitizeSegment, p as SanitizeStreamOptions, q as SanitizeTextResult, r as Sanitizer, s as builtinRuleIds, t as builtinRules, u as defineRule, v as getBuiltinRule } from './index-CutSH_48.cjs';
+export { InvalidKeyError, InvalidOptionError, InvalidRuleError, SanitizationAbortedError, SanitizerError, SanitizerErrorCode, StringSink, UnknownRuleError, createSanitizer, fromBlob, fromString, fromWebStream, generateKey, isSanitizerError, sanitizeStream, sanitizeText, toCallbackSink, toNullSink, toStringSink } from './index.cjs';
+
+/**
+ * Reads a Node readable stream as UTF-8 text.
+ *
+ * Byte chunks are decoded across chunk boundaries, so multi-byte characters are never split.
+ */
+declare function fromNodeStream(stream: Readable | AsyncIterable<string | Uint8Array>): TextSource;
+/**
+ * Reads a file as UTF-8 text.
+ *
+ * @param path Path to the file to read.
+ * @param chunkBytes Read buffer size.
+ */
+declare function fromFile(path: string, chunkBytes?: number): TextSource;
+/**
+ * Writes sanitized text to a Node writable stream, respecting backpressure.
+ *
+ * The stream is not ended when the run finishes, so it is safe to pass `process.stdout`.
+ */
+declare function toNodeStream(stream: Writable): TextSink;
+/**
+ * Writes sanitized text to a file, creating or truncating it.
+ *
+ * The file is closed and flushed when the run finishes.
+ */
+declare function toFile(path: string): TextSink;
+/** Options for {@link sanitizeFile}. */
+interface SanitizeFileOptions extends SanitizerOptions {
+    /** Path of the file to read. */
+    input: string;
+    /** Path to write the sanitized result to. Omit for a report-only run. */
+    output?: string;
+    /** Read buffer size, in bytes. */
+    chunkBytes?: number;
+    /** Called after each chunk with a live snapshot of progress. */
+    onProgress?: (progress: SanitizeProgress) => void;
+    /** Aborts the run between lines. A partially written output file is left in place. */
+    signal?: AbortSignalLike;
+}
+/**
+ * Sanitizes a file on disk, streaming it so memory use stays flat regardless of file size.
+ *
+ * @returns The report for the whole file.
+ * @throws {SanitizationAbortedError} When `options.signal` is aborted.
+ *
+ * @example
+ * ```ts
+ * const report = await sanitizeFile({
+ *   input: 'app.log',
+ *   output: 'app.sanitized.log',
+ *   rules: ['secrets', 'ips'],
+ * });
+ *
+ * console.log(`${report.totalMatches} values redacted`);
+ * ```
+ */
+declare function sanitizeFile(options: SanitizeFileOptions): Promise<SanitizeReport>;
+
+export { AbortSignalLike, type SanitizeFileOptions, SanitizeProgress, SanitizeReport, SanitizerOptions, TextSink, TextSource, fromFile, fromNodeStream, sanitizeFile, toFile, toNodeStream };

package/node.d.ts

@@ -0,0 +1,63 @@
+import { Readable, Writable } from 'node:stream';
+import { S as SanitizerOptions, a as SanitizeProgress, A as AbortSignalLike, T as TextSource, b as SanitizeReport, c as TextSink } from './index-CutSH_48.js';
+export { d as AlwaysRedactOptions, B as BlobLike, e as BuiltinRuleId, K as KeyEncoding, L as LineOptions, N as NeverRedactOptions, f as NeverRedactRuleEntry, R as ReadableStreamLike, g as RedactionMode, h as ReportOptions, i as RuleCounts, j as RuleId, k as RuleInfo, l as RuleSelector, m as SanitizeReplacement, n as SanitizeRule, o as SanitizeSegment, p as SanitizeStreamOptions, q as SanitizeTextResult, r as Sanitizer, s as builtinRuleIds, t as builtinRules, u as defineRule, v as getBuiltinRule } from './index-CutSH_48.js';
+export { InvalidKeyError, InvalidOptionError, InvalidRuleError, SanitizationAbortedError, SanitizerError, SanitizerErrorCode, StringSink, UnknownRuleError, createSanitizer, fromBlob, fromString, fromWebStream, generateKey, isSanitizerError, sanitizeStream, sanitizeText, toCallbackSink, toNullSink, toStringSink } from './index.js';
+
+/**
+ * Reads a Node readable stream as UTF-8 text.
+ *
+ * Byte chunks are decoded across chunk boundaries, so multi-byte characters are never split.
+ */
+declare function fromNodeStream(stream: Readable | AsyncIterable<string | Uint8Array>): TextSource;
+/**
+ * Reads a file as UTF-8 text.
+ *
+ * @param path Path to the file to read.
+ * @param chunkBytes Read buffer size.
+ */
+declare function fromFile(path: string, chunkBytes?: number): TextSource;
+/**
+ * Writes sanitized text to a Node writable stream, respecting backpressure.
+ *
+ * The stream is not ended when the run finishes, so it is safe to pass `process.stdout`.
+ */
+declare function toNodeStream(stream: Writable): TextSink;
+/**
+ * Writes sanitized text to a file, creating or truncating it.
+ *
+ * The file is closed and flushed when the run finishes.
+ */
+declare function toFile(path: string): TextSink;
+/** Options for {@link sanitizeFile}. */
+interface SanitizeFileOptions extends SanitizerOptions {
+    /** Path of the file to read. */
+    input: string;
+    /** Path to write the sanitized result to. Omit for a report-only run. */
+    output?: string;
+    /** Read buffer size, in bytes. */
+    chunkBytes?: number;
+    /** Called after each chunk with a live snapshot of progress. */
+    onProgress?: (progress: SanitizeProgress) => void;
+    /** Aborts the run between lines. A partially written output file is left in place. */
+    signal?: AbortSignalLike;
+}
+/**
+ * Sanitizes a file on disk, streaming it so memory use stays flat regardless of file size.
+ *
+ * @returns The report for the whole file.
+ * @throws {SanitizationAbortedError} When `options.signal` is aborted.
+ *
+ * @example
+ * ```ts
+ * const report = await sanitizeFile({
+ *   input: 'app.log',
+ *   output: 'app.sanitized.log',
+ *   rules: ['secrets', 'ips'],
+ * });
+ *
+ * console.log(`${report.totalMatches} values redacted`);
+ * ```
+ */
+declare function sanitizeFile(options: SanitizeFileOptions): Promise<SanitizeReport>;
+
+export { AbortSignalLike, type SanitizeFileOptions, SanitizeProgress, SanitizeReport, SanitizerOptions, TextSink, TextSource, fromFile, fromNodeStream, sanitizeFile, toFile, toNodeStream };

package/node.js

@@ -0,0 +1,58 @@
+import { createSanitizer, toNullSink } from './chunk-U6SJR7S7.js';
+export { createSanitizer, fromBlob, fromString, fromWebStream, generateKey, sanitizeStream, sanitizeText, toCallbackSink, toNullSink, toStringSink } from './chunk-U6SJR7S7.js';
+export { InvalidKeyError, InvalidOptionError, InvalidRuleError, SanitizationAbortedError, SanitizerError, UnknownRuleError, builtinRuleIds, builtinRules, defineRule, getBuiltinRule, isSanitizerError } from './chunk-TAMK67JP.js';
+import { createReadStream, createWriteStream } from 'fs';
+import { once } from 'events';
+import { finished } from 'stream/promises';
+
+var DEFAULT_CHUNK_BYTES = 4 * 1024 * 1024;
+function fromNodeStream(stream) {
+  return {
+    async *[Symbol.asyncIterator]() {
+      const decoder = new TextDecoder("utf-8");
+      for await (const chunk of stream) {
+        const text = typeof chunk === "string" ? chunk : decoder.decode(chunk, { stream: true });
+        if (text.length > 0) {
+          yield text;
+        }
+      }
+      const tail = decoder.decode();
+      if (tail.length > 0) {
+        yield tail;
+      }
+    }
+  };
+}
+function fromFile(path, chunkBytes = DEFAULT_CHUNK_BYTES) {
+  return fromNodeStream(createReadStream(path, { highWaterMark: chunkBytes }));
+}
+function toNodeStream(stream) {
+  return {
+    async write(chunk) {
+      if (!stream.write(chunk)) {
+        await once(stream, "drain");
+      }
+    }
+  };
+}
+function toFile(path) {
+  const stream = createWriteStream(path, { encoding: "utf-8" });
+  const target = toNodeStream(stream);
+  return {
+    write: target.write.bind(target),
+    async close() {
+      stream.end();
+      await finished(stream);
+    }
+  };
+}
+async function sanitizeFile(options) {
+  const { input, output, chunkBytes, onProgress, signal, ...sanitizerOptions } = options;
+  const sanitizer = createSanitizer(sanitizerOptions);
+  const sink = output === void 0 ? toNullSink() : toFile(output);
+  return sanitizer.sanitizeStream(fromFile(input, chunkBytes), sink, { onProgress, signal });
+}
+
+export { fromFile, fromNodeStream, sanitizeFile, toFile, toNodeStream };
+//# sourceMappingURL=node.js.map
+//# sourceMappingURL=node.js.map

package/node.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/node/index.ts"],"names":[],"mappings":";;;;;;;AAgBA,IAAM,mBAAA,GAAsB,IAAI,IAAA,GAAO,IAAA;AAOhC,SAAS,eAAe,MAAA,EAAmE;AAChG,EAAA,OAAO;AAAA,IACL,QAAQ,MAAA,CAAO,aAAa,CAAA,GAA2B;AACrD,MAAA,MAAM,OAAA,GAAU,IAAI,WAAA,CAAY,OAAO,CAAA;AAEvC,MAAA,WAAA,MAAiB,SAAS,MAAA,EAA8C;AACtE,QAAA,MAAM,IAAA,GAAO,OAAO,KAAA,KAAU,QAAA,GAAW,KAAA,GAAQ,OAAA,CAAQ,MAAA,CAAO,KAAA,EAAO,EAAE,MAAA,EAAQ,IAAA,EAAM,CAAA;AAEvF,QAAA,IAAI,IAAA,CAAK,SAAS,CAAA,EAAG;AACnB,UAAA,MAAM,IAAA;AAAA,QACR;AAAA,MACF;AAEA,MAAA,MAAM,IAAA,GAAO,QAAQ,MAAA,EAAO;AAE5B,MAAA,IAAI,IAAA,CAAK,SAAS,CAAA,EAAG;AACnB,QAAA,MAAM,IAAA;AAAA,MACR;AAAA,IACF;AAAA,GACF;AACF;AAQO,SAAS,QAAA,CAAS,IAAA,EAAc,UAAA,GAAa,mBAAA,EAAiC;AACnF,EAAA,OAAO,eAAe,gBAAA,CAAiB,IAAA,EAAM,EAAE,aAAA,EAAe,UAAA,EAAY,CAAC,CAAA;AAC7E;AAOO,SAAS,aAAa,MAAA,EAA4B;AACvD,EAAA,OAAO;AAAA,IACL,MAAM,MAAM,KAAA,EAA8B;AACxC,MAAA,IAAI,CAAC,MAAA,CAAO,KAAA,CAAM,KAAK,CAAA,EAAG;AACxB,QAAA,MAAM,IAAA,CAAK,QAAQ,OAAO,CAAA;AAAA,MAC5B;AAAA,IACF;AAAA,GACF;AACF;AAOO,SAAS,OAAO,IAAA,EAAwB;AAC7C,EAAA,MAAM,SAAS,iBAAA,CAAkB,IAAA,EAAM,EAAE,QAAA,EAAU,SAAS,CAAA;AAC5D,EAAA,MAAM,MAAA,GAAS,aAAa,MAAM,CAAA;AAElC,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,MAAA,CAAO,KAAA,CAAM,IAAA,CAAK,MAAM,CAAA;AAAA,IAC/B,MAAM,KAAA,GAAuB;AAC3B,MAAA,MAAA,CAAO,GAAA,EAAI;AACX,MAAA,MAAM,SAAS,MAAM,CAAA;AAAA,IACvB;AAAA,GACF;AACF;AAiCA,eAAsB,aAAa,OAAA,EAAuD;AACxF,EAAA,MAAM,EAAE,OAAO,MAAA,EAAQ,UAAA,EAAY,YAAY,MAAA,EAAQ,GAAG,kBAAiB,GAAI,OAAA;AAC/E,EAAA,MAAM,SAAA,GAAY,gBAAgB,gBAAgB,CAAA;AAClD,EAAA,MAAM,OAAO,MAAA,KAAW,MAAA,GAAY,UAAA,EAAW,GAAI,OAAO,MAAM,CAAA;AAEhE,EAAA,OAAO,SAAA,CAAU,cAAA,CAAe,QAAA,CAAS,KAAA,EAAO,UAAU,GAAG,IAAA,EAAM,EAAE,UAAA,EAAY,MAAA,EAAQ,CAAA;AAC3F","file":"node.js","sourcesContent":["import { createReadStream, createWriteStream } from 'node:fs';\nimport { once } from 'node:events';\nimport type { Readable, Writable } from 'node:stream';\nimport { finished } from 'node:stream/promises';\n\nimport { createSanitizer } from '../core/sanitizer';\nimport { toNullSink } from '../io/sinks';\nimport type {\n  AbortSignalLike,\n  SanitizeProgress,\n  SanitizeReport,\n  SanitizerOptions,\n  TextSink,\n  TextSource,\n} from '../types';\n\nconst DEFAULT_CHUNK_BYTES = 4 * 1024 * 1024;\n\n/**\n * Reads a Node readable stream as UTF-8 text.\n *\n * Byte chunks are decoded across chunk boundaries, so multi-byte characters are never split.\n */\nexport function fromNodeStream(stream: Readable | AsyncIterable<string | Uint8Array>): TextSource {\n  return {\n    async *[Symbol.asyncIterator](): AsyncIterator<string> {\n      const decoder = new TextDecoder('utf-8');\n\n      for await (const chunk of stream as AsyncIterable<string | Uint8Array>) {\n        const text = typeof chunk === 'string' ? chunk : decoder.decode(chunk, { stream: true });\n\n        if (text.length > 0) {\n          yield text;\n        }\n      }\n\n      const tail = decoder.decode();\n\n      if (tail.length > 0) {\n        yield tail;\n      }\n    },\n  };\n}\n\n/**\n * Reads a file as UTF-8 text.\n *\n * @param path Path to the file to read.\n * @param chunkBytes Read buffer size.\n */\nexport function fromFile(path: string, chunkBytes = DEFAULT_CHUNK_BYTES): TextSource {\n  return fromNodeStream(createReadStream(path, { highWaterMark: chunkBytes }));\n}\n\n/**\n * Writes sanitized text to a Node writable stream, respecting backpressure.\n *\n * The stream is not ended when the run finishes, so it is safe to pass `process.stdout`.\n */\nexport function toNodeStream(stream: Writable): TextSink {\n  return {\n    async write(chunk: string): Promise<void> {\n      if (!stream.write(chunk)) {\n        await once(stream, 'drain');\n      }\n    },\n  };\n}\n\n/**\n * Writes sanitized text to a file, creating or truncating it.\n *\n * The file is closed and flushed when the run finishes.\n */\nexport function toFile(path: string): TextSink {\n  const stream = createWriteStream(path, { encoding: 'utf-8' });\n  const target = toNodeStream(stream);\n\n  return {\n    write: target.write.bind(target),\n    async close(): Promise<void> {\n      stream.end();\n      await finished(stream);\n    },\n  };\n}\n\n/** Options for {@link sanitizeFile}. */\nexport interface SanitizeFileOptions extends SanitizerOptions {\n  /** Path of the file to read. */\n  input: string;\n  /** Path to write the sanitized result to. Omit for a report-only run. */\n  output?: string;\n  /** Read buffer size, in bytes. */\n  chunkBytes?: number;\n  /** Called after each chunk with a live snapshot of progress. */\n  onProgress?: (progress: SanitizeProgress) => void;\n  /** Aborts the run between lines. A partially written output file is left in place. */\n  signal?: AbortSignalLike;\n}\n\n/**\n * Sanitizes a file on disk, streaming it so memory use stays flat regardless of file size.\n *\n * @returns The report for the whole file.\n * @throws {SanitizationAbortedError} When `options.signal` is aborted.\n *\n * @example\n * ```ts\n * const report = await sanitizeFile({\n *   input: 'app.log',\n *   output: 'app.sanitized.log',\n *   rules: ['secrets', 'ips'],\n * });\n *\n * console.log(`${report.totalMatches} values redacted`);\n * ```\n */\nexport async function sanitizeFile(options: SanitizeFileOptions): Promise<SanitizeReport> {\n  const { input, output, chunkBytes, onProgress, signal, ...sanitizerOptions } = options;\n  const sanitizer = createSanitizer(sanitizerOptions);\n  const sink = output === undefined ? toNullSink() : toFile(output);\n\n  return sanitizer.sanitizeStream(fromFile(input, chunkBytes), sink, { onProgress, signal });\n}\n\nexport * from '../index';\n"]}

package/package.json

@@ -0,0 +1,75 @@
+{
+  "name": "@socprime/logtotal-sanitizer",
+  "version": "0.0.1-beta.0",
+  "description": "Framework-agnostic log sanitizer that detects and pseudonymizes secrets, PII and infrastructure identifiers in log data, in the browser and in Node.js.",
+  "keywords": [
+    "sanitizer",
+    "redaction",
+    "pseudonymization",
+    "anonymization",
+    "pii",
+    "gdpr",
+    "logs",
+    "log-analysis",
+    "security",
+    "privacy",
+    "masking"
+  ],
+  "license": "Apache-2.0",
+  "author": "SOC Prime",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/socprime/logtotal-sanitizer.git"
+  },
+  "bugs": {
+    "url": "https://github.com/socprime/logtotal-sanitizer/issues"
+  },
+  "homepage": "https://github.com/socprime/logtotal-sanitizer#readme",
+  "engines": {
+    "node": ">=20"
+  },
+  "type": "module",
+  "sideEffects": false,
+  "main": "./index.cjs",
+  "module": "./index.js",
+  "types": "./index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./index.d.ts",
+        "default": "./index.js"
+      },
+      "require": {
+        "types": "./index.d.cts",
+        "default": "./index.cjs"
+      }
+    },
+    "./rules": {
+      "import": {
+        "types": "./rules.d.ts",
+        "default": "./rules.js"
+      },
+      "require": {
+        "types": "./rules.d.cts",
+        "default": "./rules.cjs"
+      }
+    },
+    "./node": {
+      "import": {
+        "types": "./node.d.ts",
+        "default": "./node.js"
+      },
+      "require": {
+        "types": "./node.d.cts",
+        "default": "./node.cjs"
+      }
+    },
+    "./package.json": "./package.json"
+  },
+  "bin": {
+    "logtotal-sanitize": "cli.js"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/rules.cjs

@@ -0,0 +1,24 @@
+'use strict';
+
+var chunkVW3VVW6L_cjs = require('./chunk-VW3VVW6L.cjs');
+
+
+
+Object.defineProperty(exports, "builtinRuleIds", {
+  enumerable: true,
+  get: function () { return chunkVW3VVW6L_cjs.builtinRuleIds; }
+});
+Object.defineProperty(exports, "builtinRules", {
+  enumerable: true,
+  get: function () { return chunkVW3VVW6L_cjs.builtinRules; }
+});
+Object.defineProperty(exports, "defineRule", {
+  enumerable: true,
+  get: function () { return chunkVW3VVW6L_cjs.defineRule; }
+});
+Object.defineProperty(exports, "getBuiltinRule", {
+  enumerable: true,
+  get: function () { return chunkVW3VVW6L_cjs.getBuiltinRule; }
+});
+//# sourceMappingURL=rules.cjs.map
+//# sourceMappingURL=rules.cjs.map

package/rules.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"rules.cjs"}

package/rules.d.cts

@@ -0,0 +1 @@
+export { e as BuiltinRuleId, g as RedactionMode, j as RuleId, k as RuleInfo, n as SanitizeRule, s as builtinRuleIds, t as builtinRules, u as defineRule, v as getBuiltinRule } from './index-CutSH_48.cjs';

package/rules.d.ts

@@ -0,0 +1 @@
+export { e as BuiltinRuleId, g as RedactionMode, j as RuleId, k as RuleInfo, n as SanitizeRule, s as builtinRuleIds, t as builtinRules, u as defineRule, v as getBuiltinRule } from './index-CutSH_48.js';

package/rules.js

@@ -0,0 +1,3 @@
+export { builtinRuleIds, builtinRules, defineRule, getBuiltinRule } from './chunk-TAMK67JP.js';
+//# sourceMappingURL=rules.js.map
+//# sourceMappingURL=rules.js.map

package/rules.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"rules.js"}