@socprime/logtotal-sanitizer 0.0.1-beta.0

package/chunk-U6SJR7S7.js

@@ -0,0 +1,933 @@
+import { InvalidKeyError, InvalidOptionError, builtinRuleIds, SanitizationAbortedError, InvalidRuleError, getBuiltinRule, UnknownRuleError, validateRule } from './chunk-TAMK67JP.js';
+
+// src/core/constants.ts
+var DEFAULT_PREVIEW_BYTES = 256 * 1024;
+var DEFAULT_MAX_LINE_CHARS = 1024 * 1024;
+var DEFAULT_LINE_OVERLAP_CHARS = 1024;
+var DEFAULT_KEY_BYTES = 32;
+var MASK_TOKEN_PREFIX = "R";
+var ALWAYS_REDACT_RULE_ID = "custom";
+var ALWAYS_REDACT_TOKEN = "CUSTOM";
+
+// src/core/hmac.ts
+var BLOCK_BYTES = 64;
+var DIGEST_BYTES = 32;
+var K = new Uint32Array([
+  1116352408,
+  1899447441,
+  3049323471,
+  3921009573,
+  961987163,
+  1508970993,
+  2453635748,
+  2870763221,
+  3624381080,
+  310598401,
+  607225278,
+  1426881987,
+  1925078388,
+  2162078206,
+  2614888103,
+  3248222580,
+  3835390401,
+  4022224774,
+  264347078,
+  604807628,
+  770255983,
+  1249150122,
+  1555081692,
+  1996064986,
+  2554220882,
+  2821834349,
+  2952996808,
+  3210313671,
+  3336571891,
+  3584528711,
+  113926993,
+  338241895,
+  666307205,
+  773529912,
+  1294757372,
+  1396182291,
+  1695183700,
+  1986661051,
+  2177026350,
+  2456956037,
+  2730485921,
+  2820302411,
+  3259730800,
+  3345764771,
+  3516065817,
+  3600352804,
+  4094571909,
+  275423344,
+  430227734,
+  506948616,
+  659060556,
+  883997877,
+  958139571,
+  1322822218,
+  1537002063,
+  1747873779,
+  1955562222,
+  2024104815,
+  2227730452,
+  2361852424,
+  2428436474,
+  2756734187,
+  3204031479,
+  3329325298
+]);
+var INITIAL_STATE = new Uint32Array([
+  1779033703,
+  3144134277,
+  1013904242,
+  2773480762,
+  1359893119,
+  2600822924,
+  528734635,
+  1541459225
+]);
+function rotr(value, bits) {
+  return (value >>> bits | value << 32 - bits) >>> 0;
+}
+function concatBytes(a, b) {
+  const out = new Uint8Array(a.length + b.length);
+  out.set(a, 0);
+  out.set(b, a.length);
+  return out;
+}
+function padMessage(message) {
+  const bitLength = message.length * 8;
+  const paddedLength = Math.ceil((message.length + 9) / BLOCK_BYTES) * BLOCK_BYTES;
+  const padded = new Uint8Array(paddedLength);
+  padded.set(message);
+  padded[message.length] = 128;
+  const view = new DataView(padded.buffer);
+  view.setUint32(paddedLength - 8, Math.floor(bitLength / 2 ** 32), false);
+  view.setUint32(paddedLength - 4, bitLength >>> 0, false);
+  return padded;
+}
+function sha256(message) {
+  const padded = padMessage(message);
+  const view = new DataView(padded.buffer);
+  const state = Uint32Array.from(INITIAL_STATE);
+  const w = new Uint32Array(64);
+  for (let offset = 0; offset < padded.length; offset += BLOCK_BYTES) {
+    for (let i = 0; i < 16; i += 1) {
+      w[i] = view.getUint32(offset + i * 4, false);
+    }
+    for (let i = 16; i < 64; i += 1) {
+      const s0 = rotr(w[i - 15], 7) ^ rotr(w[i - 15], 18) ^ w[i - 15] >>> 3;
+      const s1 = rotr(w[i - 2], 17) ^ rotr(w[i - 2], 19) ^ w[i - 2] >>> 10;
+      w[i] = w[i - 16] + s0 + w[i - 7] + s1 >>> 0;
+    }
+    let a = state[0];
+    let b = state[1];
+    let c = state[2];
+    let d = state[3];
+    let e = state[4];
+    let f = state[5];
+    let g = state[6];
+    let h = state[7];
+    for (let i = 0; i < 64; i += 1) {
+      const s1 = rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25);
+      const ch = e & f ^ ~e & g;
+      const temp1 = h + s1 + ch + K[i] + w[i] >>> 0;
+      const s0 = rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22);
+      const maj = a & b ^ a & c ^ b & c;
+      const temp2 = s0 + maj >>> 0;
+      h = g;
+      g = f;
+      f = e;
+      e = d + temp1 >>> 0;
+      d = c;
+      c = b;
+      b = a;
+      a = temp1 + temp2 >>> 0;
+    }
+    state[0] = state[0] + a >>> 0;
+    state[1] = state[1] + b >>> 0;
+    state[2] = state[2] + c >>> 0;
+    state[3] = state[3] + d >>> 0;
+    state[4] = state[4] + e >>> 0;
+    state[5] = state[5] + f >>> 0;
+    state[6] = state[6] + g >>> 0;
+    state[7] = state[7] + h >>> 0;
+  }
+  const digest = new Uint8Array(DIGEST_BYTES);
+  const digestView = new DataView(digest.buffer);
+  for (let i = 0; i < 8; i += 1) {
+    digestView.setUint32(i * 4, state[i], false);
+  }
+  return digest;
+}
+function normalizeKey(key) {
+  const hashed = key.length > BLOCK_BYTES ? sha256(key) : key;
+  if (hashed.length === BLOCK_BYTES) {
+    return hashed;
+  }
+  const padded = new Uint8Array(BLOCK_BYTES);
+  padded.set(hashed);
+  return padded;
+}
+function createHmacSha256(key) {
+  const block = normalizeKey(key);
+  const ipad = new Uint8Array(BLOCK_BYTES);
+  const opad = new Uint8Array(BLOCK_BYTES);
+  for (let i = 0; i < BLOCK_BYTES; i += 1) {
+    ipad[i] = block[i] ^ 54;
+    opad[i] = block[i] ^ 92;
+  }
+  return (message) => sha256(concatBytes(opad, sha256(concatBytes(ipad, message))));
+}
+function hexToBytes(hex) {
+  const bytes = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < bytes.length; i += 1) {
+    bytes[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  }
+  return bytes;
+}
+function bytesToHex(bytes) {
+  return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+
+// src/core/key.ts
+var HEX_PATTERN = /^(?:[0-9a-fA-F]{2})+$/;
+function generateKey(byteLength = DEFAULT_KEY_BYTES) {
+  if (!Number.isInteger(byteLength) || byteLength < 16) {
+    throw new InvalidKeyError(`Key length must be an integer of at least 16 bytes, got ${byteLength}.`);
+  }
+  const source = globalThis.crypto;
+  if (typeof source?.getRandomValues !== "function") {
+    throw new InvalidKeyError(
+      "No secure random source available. Pass an explicit `key` or provide a Web Crypto implementation on globalThis.crypto."
+    );
+  }
+  const bytes = new Uint8Array(byteLength);
+  source.getRandomValues(bytes);
+  return bytesToHex(bytes);
+}
+function assertKey(key, encoding) {
+  if (key.length === 0) {
+    throw new InvalidKeyError("Key must not be empty.");
+  }
+  if (encoding === "hex" && !HEX_PATTERN.test(key)) {
+    throw new InvalidKeyError(
+      'A hex key must contain an even number of hexadecimal characters. Pass `keyEncoding: "utf8"` for a passphrase.'
+    );
+  }
+}
+
+// src/rules/alwaysRedact.ts
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function normalizeValues(values) {
+  const unique = new Set(values.map((value) => value.trim()).filter((value) => value.length > 0));
+  return [...unique].sort((left, right) => right.length - left.length || left.localeCompare(right));
+}
+function normalizePatterns(patterns) {
+  return patterns.map((pattern) => {
+    const source = typeof pattern === "string" ? pattern : pattern.source;
+    try {
+      new RegExp(source, "u");
+    } catch (cause) {
+      throw new InvalidOptionError(
+        `alwaysRedact.patterns contains an invalid regular expression: ${String(cause)}`
+      );
+    }
+    return `(?:${source})`;
+  });
+}
+function createAlwaysRedactRule(options) {
+  if (!options) {
+    return null;
+  }
+  const patterns = [
+    ...normalizeValues(options.values ?? []).map((value) => `(?:${escapeRegExp(value)})`),
+    ...normalizePatterns(options.patterns ?? [])
+  ];
+  if (patterns.length === 0) {
+    return null;
+  }
+  return {
+    id: options.ruleId ?? ALWAYS_REDACT_RULE_ID,
+    label: "Always redacted",
+    description: "Values and patterns the caller marked as always sensitive.",
+    mode: options.mode ?? "pseudo",
+    token: options.token ?? ALWAYS_REDACT_TOKEN,
+    patterns
+  };
+}
+
+// src/core/allowlist.ts
+function patternSource(pattern) {
+  return typeof pattern === "string" ? pattern : pattern.source;
+}
+function compileAnchored(patterns) {
+  const sources = patterns.map(patternSource).filter((source) => source.length > 0);
+  if (sources.length === 0) {
+    return null;
+  }
+  const combined = sources.map((source) => `(?:${source})`).join("|");
+  try {
+    return new RegExp(`^(?:${combined})$`, "u");
+  } catch (cause) {
+    throw new InvalidOptionError(
+      `neverRedact.patterns contains an invalid regular expression: ${String(cause)}`
+    );
+  }
+}
+function createAllowList(options) {
+  const values = new Set((options?.values ?? []).filter((value) => value.length > 0));
+  const pattern = compileAnchored(options?.patterns ?? []);
+  const byRule = /* @__PURE__ */ new Map();
+  for (const entry of options?.byRule ?? []) {
+    const existing = byRule.get(entry.ruleId) ?? /* @__PURE__ */ new Set();
+    for (const value of entry.values) {
+      if (value.length > 0) {
+        existing.add(value);
+      }
+    }
+    byRule.set(entry.ruleId, existing);
+  }
+  return {
+    empty: values.size === 0 && pattern === null && byRule.size === 0,
+    values,
+    pattern,
+    byRule
+  };
+}
+function isAllowed(allow, ruleId, value) {
+  if (allow.empty) {
+    return false;
+  }
+  if (allow.values.has(value)) {
+    return true;
+  }
+  if (allow.byRule.get(ruleId)?.has(value) === true) {
+    return true;
+  }
+  return allow.pattern !== null && allow.pattern.test(value);
+}
+
+// src/core/pseudonymize.ts
+var TOKEN_HEX_LENGTH = 16;
+var TOKEN_BYTES = TOKEN_HEX_LENGTH / 2;
+var textEncoder = new TextEncoder();
+function createPseudonymizer(key, encoding) {
+  const keyBytes = encoding === "utf8" ? textEncoder.encode(key) : hexToBytes(key);
+  const sign = createHmacSha256(keyBytes);
+  const cache = /* @__PURE__ */ new Map();
+  return (ruleId, value) => {
+    const cacheKey = `${ruleId}\0${value}`;
+    const cached = cache.get(cacheKey);
+    if (cached !== void 0) {
+      return cached;
+    }
+    const digest = sign(textEncoder.encode(cacheKey));
+    const token = bytesToHex(digest.subarray(0, TOKEN_BYTES));
+    cache.set(cacheKey, token);
+    return token;
+  };
+}
+function replacementPrefix(rule) {
+  if (rule.mode === "mask") {
+    return MASK_TOKEN_PREFIX;
+  }
+  return rule.token ?? rule.id.toUpperCase();
+}
+
+// src/core/compile.ts
+function compileRules(rules, aggressive) {
+  const parts = rules.map((rule) => ({
+    id: rule.id,
+    patterns: aggressive ? [...rule.patterns, ...rule.aggressivePatterns ?? []] : rule.patterns
+  })).filter(({ patterns }) => patterns.length > 0).map(({ id, patterns }) => `(?<${id}>${patterns.join("|")})`);
+  if (parts.length === 0) {
+    return null;
+  }
+  try {
+    return new RegExp(parts.join("|"), "gu");
+  } catch (cause) {
+    throw new InvalidRuleError(`Failed to compile the combined rule pattern: ${String(cause)}`);
+  }
+}
+function createRuleContext(input) {
+  const { rules } = input;
+  return {
+    compiled: compileRules(rules, input.aggressive),
+    rules,
+    ruleIds: rules.map((rule) => rule.id),
+    rulesById: new Map(rules.map((rule) => [rule.id, rule])),
+    prefixById: new Map(rules.map((rule) => [rule.id, replacementPrefix(rule)])),
+    pseudonymize: input.pseudonymize,
+    allow: input.allow,
+    contextChars: input.contextChars,
+    json: input.json
+  };
+}
+function buildReplacement(ctx, ruleId, value) {
+  return `<${ctx.prefixById.get(ruleId) ?? ruleId.toUpperCase()}:${ctx.pseudonymize(ruleId, value)}>`;
+}
+
+// src/core/lineSplitter.ts
+function extractLines(buffer) {
+  const lines = [];
+  let start = 0;
+  for (let i = 0; i < buffer.length; i += 1) {
+    if (buffer[i] === "\n") {
+      lines.push(buffer.slice(start, i + 1));
+      start = i + 1;
+    }
+  }
+  return { lines, rest: buffer.slice(start) };
+}
+function createLineSplitter(options = {}) {
+  const maxLineChars = options.maxLineChars ?? DEFAULT_MAX_LINE_CHARS;
+  const overlapChars = options.overlapChars ?? DEFAULT_LINE_OVERLAP_CHARS;
+  if (maxLineChars < 1) {
+    throw new InvalidOptionError("lines.maxLineChars must be at least 1.");
+  }
+  if (overlapChars < 0 || overlapChars >= maxLineChars) {
+    throw new InvalidOptionError(
+      `lines.overlapChars must be between 0 and lines.maxLineChars - 1 (${maxLineChars - 1}), got ${overlapChars}.`
+    );
+  }
+  let carry = "";
+  function push(chunk) {
+    carry += chunk;
+    const { lines, rest } = extractLines(carry);
+    carry = rest;
+    while (carry.length > maxLineChars) {
+      const cut = carry.length - overlapChars;
+      lines.push(carry.slice(0, cut));
+      carry = carry.slice(cut);
+    }
+    return lines;
+  }
+  function flush() {
+    if (carry.length === 0) {
+      return [];
+    }
+    const rest = carry;
+    carry = "";
+    return [rest];
+  }
+  return { push, flush };
+}
+
+// src/core/redactLine.ts
+function sliceContext(text, index, length, chars) {
+  return {
+    contextBefore: text.slice(Math.max(0, index - chars), index),
+    contextAfter: text.slice(index + length, index + length + chars)
+  };
+}
+function matchedRuleId(ruleIds, groups) {
+  for (const id of ruleIds) {
+    if (groups[id] !== void 0) {
+      return id;
+    }
+  }
+  return void 0;
+}
+function redactLine(line, ctx, options = {}) {
+  const { compiled, ruleIds, rulesById, allow, contextChars } = ctx;
+  const withSegments = options.withSegments ?? false;
+  const withMatches = options.withMatches ?? false;
+  if (!compiled) {
+    return {
+      output: line,
+      counts: {},
+      matches: [],
+      segments: withSegments ? { before: [{ text: line, changed: false }], after: [{ text: line, changed: false }] } : void 0
+    };
+  }
+  compiled.lastIndex = 0;
+  const counts = {};
+  const matches = [];
+  const before = [];
+  const after = [];
+  let output = "";
+  let cursor = 0;
+  let match = compiled.exec(line);
+  while (match !== null) {
+    const ruleId = match.groups ? matchedRuleId(ruleIds, match.groups) : void 0;
+    const rule = ruleId === void 0 ? void 0 : rulesById.get(ruleId);
+    const original = match[0];
+    if (rule === void 0 || ruleId === void 0) {
+      compiled.lastIndex = match.index + Math.max(original.length, 1);
+      match = compiled.exec(line);
+      continue;
+    }
+    const rejected = rule.validate !== void 0 && !rule.validate(original) || isAllowed(allow, ruleId, original);
+    if (rejected) {
+      compiled.lastIndex = match.index + Math.max(original.length, 1);
+      match = compiled.exec(line);
+      continue;
+    }
+    const replacement = buildReplacement(ctx, ruleId, original);
+    if (withSegments) {
+      if (match.index > cursor) {
+        const gap = line.slice(cursor, match.index);
+        before.push({ text: gap, changed: false });
+        after.push({ text: gap, changed: false });
+      }
+      before.push({ text: original, changed: true });
+      after.push({ text: replacement, changed: true });
+    }
+    output += line.slice(cursor, match.index) + replacement;
+    cursor = match.index + original.length;
+    counts[ruleId] = (counts[ruleId] ?? 0) + 1;
+    if (withMatches) {
+      matches.push({
+        ruleId,
+        original,
+        replacement,
+        ...contextChars > 0 ? sliceContext(line, match.index, original.length, contextChars) : {}
+      });
+    }
+    if (original.length === 0) {
+      compiled.lastIndex += 1;
+    }
+    match = compiled.exec(line);
+  }
+  output += line.slice(cursor);
+  if (withSegments && cursor < line.length) {
+    const tail = line.slice(cursor);
+    before.push({ text: tail, changed: false });
+    after.push({ text: tail, changed: false });
+  }
+  return {
+    output,
+    counts,
+    matches,
+    segments: withSegments ? { before, after } : void 0
+  };
+}
+
+// src/core/redactJsonLine.ts
+var REPLACEMENT_TOKEN_RE = /<[A-Z][A-Z0-9]*:[0-9a-f]+>/g;
+function looksLikeJson(line) {
+  const trimmed = line.trim();
+  return trimmed.length > 0 && (trimmed.startsWith("{") || trimmed.startsWith("["));
+}
+function normalizeKey2(key) {
+  return key.toLowerCase().replace(/[-_]/g, "");
+}
+function buildJsonKeyIndex(rules) {
+  const index = /* @__PURE__ */ new Map();
+  for (const rule of rules) {
+    for (const key of rule.jsonKeys ?? []) {
+      const normalized = normalizeKey2(key);
+      if (!index.has(normalized)) {
+        index.set(normalized, rule);
+      }
+    }
+  }
+  return index;
+}
+var jsonKeyIndexCache = /* @__PURE__ */ new WeakMap();
+function jsonKeyIndex(rules) {
+  const cached = jsonKeyIndexCache.get(rules);
+  if (cached) {
+    return cached;
+  }
+  const index = buildJsonKeyIndex(rules);
+  jsonKeyIndexCache.set(rules, index);
+  return index;
+}
+function mergeCounts(target, source) {
+  for (const [id, count] of Object.entries(source)) {
+    target[id] = (target[id] ?? 0) + count;
+  }
+}
+function highlightReplacements(text) {
+  const segments = [];
+  let cursor = 0;
+  REPLACEMENT_TOKEN_RE.lastIndex = 0;
+  let match = REPLACEMENT_TOKEN_RE.exec(text);
+  while (match !== null) {
+    if (match.index > cursor) {
+      segments.push({ text: text.slice(cursor, match.index), changed: false });
+    }
+    segments.push({ text: match[0], changed: true });
+    cursor = match.index + match[0].length;
+    match = REPLACEMENT_TOKEN_RE.exec(text);
+  }
+  if (cursor < text.length) {
+    segments.push({ text: text.slice(cursor), changed: false });
+  }
+  return segments.length > 0 ? segments : [{ text, changed: false }];
+}
+function redactJsonLine(line, ctx, options = {}) {
+  const terminatorMatch = /(\r\n|\r|\n)$/.exec(line);
+  const terminator = terminatorMatch ? terminatorMatch[0] : "";
+  const content = terminator ? line.slice(0, -terminator.length) : line;
+  let parsed;
+  try {
+    parsed = JSON.parse(content);
+  } catch {
+    return null;
+  }
+  if (typeof parsed !== "object" || parsed === null) {
+    return null;
+  }
+  const withSegments = options.withSegments ?? false;
+  const withMatches = options.withMatches ?? false;
+  const keyIndex = jsonKeyIndex(ctx.rules);
+  const counts = {};
+  const matches = [];
+  const contextFor = (value) => {
+    if (ctx.contextChars <= 0) {
+      return {};
+    }
+    const index = content.indexOf(value);
+    if (index < 0) {
+      return { contextBefore: "", contextAfter: "" };
+    }
+    return sliceContext(content, index, value.length, ctx.contextChars);
+  };
+  const redactValue = (value, key) => {
+    if (typeof value === "string") {
+      const fieldRule = key === void 0 ? void 0 : keyIndex.get(normalizeKey2(key));
+      if (fieldRule) {
+        if (isAllowed(ctx.allow, fieldRule.id, value)) {
+          return value;
+        }
+        const replacement = buildReplacement(ctx, fieldRule.id, value);
+        counts[fieldRule.id] = (counts[fieldRule.id] ?? 0) + 1;
+        if (withMatches) {
+          matches.push({
+            ruleId: fieldRule.id,
+            original: value,
+            replacement,
+            ...contextFor(value)
+          });
+        }
+        return replacement;
+      }
+      const result = redactLine(value, ctx, { withMatches });
+      mergeCounts(counts, result.counts);
+      if (withMatches) {
+        for (const match of result.matches) {
+          matches.push({ ...match, ...contextFor(match.original) });
+        }
+      }
+      return result.output;
+    }
+    if (Array.isArray(value)) {
+      return value.map((item) => redactValue(item));
+    }
+    if (value !== null && typeof value === "object") {
+      const out = {};
+      for (const [entryKey, entryValue] of Object.entries(value)) {
+        out[entryKey] = redactValue(entryValue, entryKey);
+      }
+      return out;
+    }
+    return value;
+  };
+  const output = JSON.stringify(redactValue(parsed)) + terminator;
+  if (!withSegments) {
+    return { output, counts, matches };
+  }
+  const preview = redactLine(line, ctx, { withSegments: true });
+  return {
+    output,
+    counts,
+    matches,
+    segments: {
+      before: preview.segments?.before ?? [{ text: line, changed: false }],
+      after: highlightReplacements(output)
+    }
+  };
+}
+
+// src/core/report.ts
+function createReportCollector(options = {}) {
+  const previewBytes = options.previewBytes ?? DEFAULT_PREVIEW_BYTES;
+  const collectReplacements = options.replacements ?? true;
+  if (previewBytes < 0) {
+    throw new InvalidOptionError("report.previewBytes must not be negative.");
+  }
+  const counts = {};
+  const replacements = /* @__PURE__ */ new Map();
+  const before = [];
+  const after = [];
+  let lineCount = 0;
+  let previewBytesUsed = 0;
+  let previewClosed = previewBytes === 0;
+  function needsSegments() {
+    return !previewClosed;
+  }
+  function needsMatches() {
+    return collectReplacements;
+  }
+  function record(result) {
+    lineCount += 1;
+    for (const [id, count] of Object.entries(result.counts)) {
+      counts[id] = (counts[id] ?? 0) + count;
+    }
+    if (collectReplacements) {
+      for (const match of result.matches) {
+        const key = `${match.ruleId}\0${match.original}`;
+        const existing = replacements.get(key);
+        if (existing) {
+          existing.count += 1;
+        } else {
+          replacements.set(key, {
+            ruleId: match.ruleId,
+            original: match.original,
+            replacement: match.replacement,
+            count: 1,
+            ...match.contextBefore !== void 0 ? { contextBefore: match.contextBefore, contextAfter: match.contextAfter } : {}
+          });
+        }
+      }
+    }
+    if (previewClosed) {
+      return;
+    }
+    if (result.segments) {
+      before.push(...result.segments.before);
+      after.push(...result.segments.after);
+    }
+    previewBytesUsed += result.output.length;
+    if (previewBytesUsed >= previewBytes) {
+      previewClosed = true;
+    }
+  }
+  function build(snapshot) {
+    const includeReplacements = snapshot?.includeReplacements ?? true;
+    let totalMatches = 0;
+    for (const count of Object.values(counts)) {
+      totalMatches += count;
+    }
+    return {
+      counts: { ...counts },
+      totalMatches,
+      lineCount,
+      replacements: includeReplacements ? [...replacements.values()] : [],
+      preview: { before: [...before], after: [...after] }
+    };
+  }
+  return { needsSegments, needsMatches, record, build };
+}
+
+// src/core/resolveRules.ts
+function toRule(selector) {
+  if (typeof selector === "string") {
+    const builtin = getBuiltinRule(selector);
+    if (!builtin) {
+      throw new UnknownRuleError(
+        `Unknown rule "${selector}". Pass a rule object for custom rules, or one of the built-in identifiers.`
+      );
+    }
+    return builtin;
+  }
+  return validateRule(selector);
+}
+function resolveRules(selectors, extraRules = []) {
+  const resolved = [];
+  const positions = /* @__PURE__ */ new Map();
+  for (const selector of [...selectors, ...extraRules]) {
+    const rule = toRule(selector);
+    const existing = positions.get(rule.id);
+    if (existing === void 0) {
+      positions.set(rule.id, resolved.length);
+      resolved.push(rule);
+    } else {
+      resolved[existing] = rule;
+    }
+  }
+  return resolved;
+}
+
+// src/core/sanitizer.ts
+async function* toAsyncIterable(source) {
+  yield* source;
+}
+function processLine(line, ctx, collector) {
+  const options = {
+    withSegments: collector.needsSegments(),
+    withMatches: collector.needsMatches()
+  };
+  const parsed = ctx.json && looksLikeJson(line) ? redactJsonLine(line, ctx, options) : null;
+  const result = parsed ?? redactLine(line, ctx, options);
+  collector.record(result);
+  return result.output;
+}
+function createSanitizer(options = {}) {
+  const keyEncoding = options.keyEncoding ?? "hex";
+  const key = options.key ?? generateKey();
+  assertKey(key, keyEncoding);
+  const contextChars = options.report?.contextChars ?? 0;
+  if (contextChars < 0) {
+    throw new InvalidOptionError("report.contextChars must not be negative.");
+  }
+  const selected = resolveWithAlwaysRedact(options);
+  const ctx = createRuleContext({
+    rules: selected,
+    aggressive: options.aggressive ?? false,
+    pseudonymize: createPseudonymizer(key, keyEncoding),
+    allow: createAllowList(options.neverRedact),
+    contextChars,
+    json: options.json !== false
+  });
+  const collectorOptions = {
+    previewBytes: options.report?.previewBytes,
+    replacements: options.report?.replacements
+  };
+  const rules = selected.map((rule) => ({
+    id: rule.id,
+    label: rule.label,
+    description: rule.description,
+    mode: rule.mode
+  }));
+  function sanitizeText2(text) {
+    const collector = createReportCollector(collectorOptions);
+    const splitter = createLineSplitter(options.lines);
+    let output = "";
+    for (const line of splitter.push(text)) {
+      output += processLine(line, ctx, collector);
+    }
+    for (const line of splitter.flush()) {
+      output += processLine(line, ctx, collector);
+    }
+    return { output, report: collector.build() };
+  }
+  async function sanitizeStream2(source, sink, streamOptions = {}) {
+    const collector = createReportCollector(collectorOptions);
+    const splitter = createLineSplitter(options.lines);
+    const { signal, onProgress } = streamOptions;
+    let charsRead = 0;
+    const writeLine = async (line) => {
+      if (signal?.aborted === true) {
+        throw new SanitizationAbortedError();
+      }
+      await sink.write(processLine(line, ctx, collector));
+    };
+    for await (const chunk of toAsyncIterable(source)) {
+      charsRead += chunk.length;
+      for (const line of splitter.push(chunk)) {
+        await writeLine(line);
+      }
+      onProgress?.({ charsRead, report: collector.build({ includeReplacements: false }) });
+    }
+    for (const line of splitter.flush()) {
+      await writeLine(line);
+    }
+    await sink.close?.();
+    return collector.build();
+  }
+  return { key, rules, sanitizeText: sanitizeText2, sanitizeStream: sanitizeStream2 };
+}
+function resolveWithAlwaysRedact(options) {
+  const selected = resolveRules(options.rules ?? builtinRuleIds, options.extraRules);
+  const alwaysRule = createAlwaysRedactRule(options.alwaysRedact);
+  if (!alwaysRule) {
+    return selected;
+  }
+  if (selected.some((rule) => rule.id === alwaysRule.id)) {
+    throw new InvalidOptionError(
+      `alwaysRedact.ruleId "${alwaysRule.id}" collides with an active rule. Choose an identifier that is not in use.`
+    );
+  }
+  return [alwaysRule, ...selected];
+}
+function sanitizeText(text, options) {
+  return createSanitizer(options).sanitizeText(text);
+}
+function sanitizeStream(source, sink, options) {
+  const { onProgress, signal, ...sanitizerOptions } = options ?? {};
+  return createSanitizer(sanitizerOptions).sanitizeStream(source, sink, { onProgress, signal });
+}
+
+// src/io/sources.ts
+var DEFAULT_CHUNK_BYTES = 4 * 1024 * 1024;
+function fromString(text, chunkChars = DEFAULT_CHUNK_BYTES) {
+  return {
+    *[Symbol.iterator]() {
+      for (let offset = 0; offset < text.length; offset += chunkChars) {
+        yield text.slice(offset, offset + chunkChars);
+      }
+    }
+  };
+}
+function fromBlob(blob, chunkBytes = DEFAULT_CHUNK_BYTES) {
+  return {
+    async *[Symbol.asyncIterator]() {
+      const decoder = new TextDecoder("utf-8");
+      for (let offset = 0; offset < blob.size; offset += chunkBytes) {
+        const slice = blob.slice(offset, Math.min(offset + chunkBytes, blob.size));
+        const buffer = await slice.arrayBuffer();
+        const text = decoder.decode(new Uint8Array(buffer), { stream: true });
+        if (text.length > 0) {
+          yield text;
+        }
+      }
+      const tail = decoder.decode();
+      if (tail.length > 0) {
+        yield tail;
+      }
+    }
+  };
+}
+function fromWebStream(stream) {
+  return {
+    async *[Symbol.asyncIterator]() {
+      const reader = stream.getReader();
+      const decoder = new TextDecoder("utf-8");
+      try {
+        for (; ; ) {
+          const { done, value } = await reader.read();
+          if (done) {
+            break;
+          }
+          if (value === void 0) {
+            continue;
+          }
+          const text = typeof value === "string" ? value : decoder.decode(value, { stream: true });
+          if (text.length > 0) {
+            yield text;
+          }
+        }
+        const tail = decoder.decode();
+        if (tail.length > 0) {
+          yield tail;
+        }
+      } finally {
+        reader.releaseLock();
+      }
+    }
+  };
+}
+
+// src/io/sinks.ts
+function toStringSink() {
+  const chunks = [];
+  return {
+    write(chunk) {
+      chunks.push(chunk);
+    },
+    get text() {
+      return chunks.join("");
+    }
+  };
+}
+function toCallbackSink(onChunk, onClose) {
+  return {
+    write: onChunk,
+    ...onClose ? { close: onClose } : {}
+  };
+}
+function toNullSink() {
+  return { write: () => void 0 };
+}
+
+export { createSanitizer, fromBlob, fromString, fromWebStream, generateKey, sanitizeStream, sanitizeText, toCallbackSink, toNullSink, toStringSink };
+//# sourceMappingURL=chunk-U6SJR7S7.js.map
+//# sourceMappingURL=chunk-U6SJR7S7.js.map