@socprime/logtotal-sanitizer 0.0.1-beta.3 → 0.1.0-beta.0

package/CHANGELOG.md

@@ -7,6 +7,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+
+- Most positive lookbehind fragments now consume their prefix and capture only the value to redact.
+  JavaScriptCore (Safari) evaluates lookbehind-led alternatives about 15× slower than V8; this
+  rewrite is equivalent on value spans and is faster in both engines. Two fragments keep their
+  lookbehind because consumption would not be equivalent there.
+- Patterns are compiled one regex per fragment, behind a cheap per-rule prefilter, instead of a
+  single combined pattern. Match selection is unchanged: the leftmost value wins, and ties go to
+  the earlier rule and then the earlier fragment.
+- Sanitizing 1 MB of Windows PowerShell logs is about 4.9× faster under JavaScriptCore and about
+  1.6× faster under V8. Output is byte-identical: verified against the previous implementation on
+  318k real log lines and 1.8M generated adversarial lines across every rule, both modes, JSON
+  mode, allowlists and segment reporting.
+
 ## [0.0.1-beta.3] - 2026-08-26
 
 ### Fixed

package/README.md

@@ -116,7 +116,7 @@ const ticket = defineRule({
 const sanitizer = createSanitizer({ rules: ['secrets', ticket] });
 ```
 
-`id` must be a JavaScript identifier (it becomes a named capture group). Use non-capturing groups in `patterns`. Put expensive checks in `validate`, not in the regex.
+`id` must be a JavaScript identifier. At most one capturing group per fragment; it marks the value to replace (the rest of the match is kept). Put expensive checks in `validate`, not in the regex.
 
 ## Streaming and I/O
 

package/{chunk-U4HRIFW3.js → chunk-5R34WEOD.js}

@@ -86,13 +86,13 @@ var geoLocationRule = {
   patterns: [
     "(?:\\(\\s*-?\\d{1,3}\\.\\d{3,}\\s*[,;]\\s*-?\\d{1,3}\\.\\d{3,}\\s*\\))",
     "(?:(?<![\\d.])-?\\d{1,3}\\.\\d{3,}\\s*[,;]\\s*-?\\d{1,3}\\.\\d{3,}(?!\\d))",
-    `(?:(?<=\\b${LAT_KEY}\\s*[=:]\\s*)-?\\d{1,3}\\.\\d+)`,
-    `(?:(?<=\\b${LON_KEY}\\s*[=:]\\s*)-?\\d{1,3}\\.\\d+)`,
-    `(?:(?<=\\bgeohash\\s*[=:]\\s*)${GEOHASH}{5,12}\\b)`,
+    `(?:\\b${LAT_KEY}\\s*[=:]\\s*)(-?\\d{1,3}\\.\\d+)`,
+    `(?:\\b${LON_KEY}\\s*[=:]\\s*)(-?\\d{1,3}\\.\\d+)`,
+    `(?:\\bgeohash\\s*[=:]\\s*)(${GEOHASH}{5,12}\\b)`,
     `(?:(?<![\\w+])${OLC}{4,8}\\+${OLC}{2,3}(?![\\w+]))`,
     `(?:\\b\\d{1,3}\xB0\\d{1,2}'\\d{1,2}(?:\\.\\d+)?"[NSEW]\\b)`,
     "(?:\\b[A-Za-z]{1,2}\\d{1,2}[A-Za-z]?\\s\\d[A-Za-z]{2}\\b)",
-    `(?:(?<=\\b${ZIP_KEY}\\s*[=:]\\s*)\\d{5}(?:-\\d{4})?\\b)`
+    `(?:\\b${ZIP_KEY}\\s*[=:]\\s*)(\\d{5}(?:-\\d{4})?\\b)`
   ],
   aggressivePatterns: [
     "(?:\\(\\s*-?\\d{1,3}\\.\\d{2,}\\s*[,;]\\s*-?\\d{1,3}\\.\\d{2,}\\s*\\))",
@@ -206,14 +206,11 @@ var govIdentifiersRule = {
     "(?:\\b(?:NHS|nhs)(?:[_-]?number)?\\s*[=:]\\s*\\d{10}\\b)",
     "(?:\\b(?!BG|GB|NK|KN|TN|NT|ZZ)[A-CEGHJ-PR-TW-Z][A-CEGHJ-NPR-TW-Z]\\d{6}\\s?[A-D]\\b)",
     "(?:(?<![A-Za-z0-9\u0410-\u042F\u0406\u0407\u0404\u0490\u0430-\u044F\u0456\u0457\u0454\u0491])[\u0410-\u042F\u0406\u0407\u0404\u0490]{2}\\d{6}\\b)",
-    `(?:(?<=\\b${SSN_CTX}\\s*[=:]?\\s*)\\d{9}\\b)`,
-    "(?:(?<=(?:\u0406\u041F\u041D|\u0420\u041D\u041E\u041A\u041F\u041F|tax[_-]?id)\\s*[=:]?\\s*)\\d{10}\\b)",
-    `(?:(?<=\\b${ID_CTX}\\s*[=:]\\s*)[A-Za-z0-9<]{5,32})`
-  ],
-  aggressivePatterns: [
-    "(?:\\b[A-Z]{1,2}\\d{6,9}\\b)",
-    "(?:\\b\\d{9,11}\\b)"
+    `(?:\\b${SSN_CTX}\\s*[=:]?\\s*)(\\d{9})\\b`,
+    "(?:(?:\u0406\u041F\u041D|\u0420\u041D\u041E\u041A\u041F\u041F|tax[_-]?id)\\s*[=:]?\\s*)(\\d{10})\\b",
+    `(?:\\b${ID_CTX}\\s*[=:]\\s*)([A-Za-z0-9<]{5,32})`
   ],
+  aggressivePatterns: ["(?:\\b[A-Z]{1,2}\\d{6,9}\\b)", "(?:\\b\\d{9,11}\\b)"],
   validate: validateGovId,
   jsonKeys: [
     "ssn",
@@ -262,11 +259,9 @@ var healthInfoRule = {
     "(?:\\b(?:NDC|[Nn]dc)[:\\s]+\\d{4,5}-\\d{3,4}-\\d{1,2}\\b)",
     "(?:\\b[ABFGMPRX][A-Z9]\\d{7}\\b)",
     "(?:\\b(?:[Nn][Pp][Ii])\\s*[=:]\\s*\\d{10}\\b)",
-    `(?:(?<=\\b${MRN_KEY}\\s*[=:]\\s*)[A-Za-z0-9-]{4,}\\b)`
-  ],
-  aggressivePatterns: [
-    "(?:(?<![A-Za-z0-9])[A-TV-Z]\\d{2}(?:\\.\\w{1,4})?(?![A-Za-z0-9:]))"
+    `(?:\\b${MRN_KEY}\\s*[=:]\\s*)([A-Za-z0-9-]{4,})\\b`
   ],
+  aggressivePatterns: ["(?:(?<![A-Za-z0-9])[A-TV-Z]\\d{2}(?:\\.\\w{1,4})?(?![A-Za-z0-9:]))"],
   validate: validateHealth,
   jsonKeys: [
     "diagnosis",
@@ -301,18 +296,18 @@ var homePathsRule = {
   mode: "mask",
   token: "PATH",
   patterns: [
-    `(?:(?<=/export/home/)${USER_SEG})`,
-    `(?:(?<=/usr/home/)${USER_SEG})`,
-    `(?:(?<=/var/home/)${USER_SEG})`,
-    `(?:(?<=/home/)${USER_SEG})`,
-    `(?:(?<=/Users/)${USER_SEG})`,
-    `(?:(?<=[A-Za-z]:\\\\Users\\\\)${USER_SEG})`,
-    `(?:(?<=[A-Za-z]:/Users/)${USER_SEG})`,
-    `(?:(?<=\\\\\\\\\\?\\\\[A-Za-z]:\\\\Users\\\\)${USER_SEG})`,
-    `(?:(?<=[A-Za-z]:\\\\Documents and Settings\\\\)${USER_SEG})`,
-    `(?:(?<=[A-Za-z]:\\\\\\\\Users\\\\\\\\)${USER_SEG})`,
-    `(?:(?<=/mnt/[A-Za-z]/Users/)${USER_SEG})`,
-    `(?:(?<=//wsl\\$/(?:[A-Za-z0-9_-]+)/home/)${USER_SEG})`
+    `(?:/export/home/(${USER_SEG}))`,
+    `(?:/usr/home/(${USER_SEG}))`,
+    `(?:/var/home/(${USER_SEG}))`,
+    `(?:/home/(${USER_SEG}))`,
+    `(?:/Users/(${USER_SEG}))`,
+    `(?:[A-Za-z]:\\\\Users\\\\(${USER_SEG}))`,
+    `(?:[A-Za-z]:/Users/(${USER_SEG}))`,
+    `(?:\\\\\\\\\\?\\\\[A-Za-z]:\\\\Users\\\\(${USER_SEG}))`,
+    `(?:[A-Za-z]:\\\\Documents and Settings\\\\(${USER_SEG}))`,
+    `(?:[A-Za-z]:\\\\\\\\Users\\\\\\\\(${USER_SEG}))`,
+    `(?:/mnt/[A-Za-z]/Users/(${USER_SEG}))`,
+    `(?://wsl\\$/(?:[A-Za-z0-9_-]+)/home/(${USER_SEG}))`
   ],
   validate: validateHomeUser
 };
@@ -1281,18 +1276,18 @@ var TLD_EXACT = [...INTERNAL_COMPOUND_SUFFIXES, ...GTLD_UNRESTRICTED, ...INTERNA
 var TLD_COLLISION = FILE_EXT_COLLISION_TLDS.join("|");
 var LABEL = "[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?";
 var HOST_EXACT = `(?:(?<![\\w.$-])(?<![^:/\\\\][/\\\\])(?:${LABEL}\\.)+(?:${TLD_EXACT})(?!\\.?\\w))`;
-var HOST_COLLISION = `(?:(?<=(?:https?|sftp|ftps?|wss?)://(?:[^/@\\s]+@)?)(?:${LABEL}\\.)+(?:${TLD_COLLISION})(?!\\.?\\w))`;
-var UNC_COMPUTER = "(?:(?<=\\\\\\\\)[A-Za-z][A-Za-z0-9-]{0,14}(?=\\\\[A-Za-z0-9$]))";
-var SPN_HOST = "(?:(?<=\\b[A-Za-z][A-Za-z0-9]*/)[A-Za-z0-9][A-Za-z0-9.-]*(?=@[A-Z0-9.-]+\\b))";
+var HOST_COLLISION = `(?:(?:https?|sftp|ftps?|wss?)://(?:[^/@\\s]+@)?)((?:${LABEL}\\.)+(?:${TLD_COLLISION}))(?!\\.?\\w)`;
+var UNC_COMPUTER = "(?:\\\\\\\\)([A-Za-z][A-Za-z0-9-]{0,14})(?=\\\\[A-Za-z0-9$])";
+var SPN_HOST = "(?:\\b[A-Za-z][A-Za-z0-9]*/)([A-Za-z0-9][A-Za-z0-9.-]*)(?=@[A-Z0-9.-]+\\b)";
 var HOST_CTX_KEY = "(?:host|hostname|computer)";
-var HOST_CTX = `(?:(?<=\\b${HOST_CTX_KEY}\\s*[=:]\\s*)[A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?)`;
+var HOST_CTX = `(?:\\b${HOST_CTX_KEY}\\s*[=:]\\s*)([A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?)`;
 var NETBIOS_AGGRESSIVE = "(?:\\b(?:WIN|DESKTOP)-[A-Z0-9]{7,10}\\b)";
 var SYSLOG_MONTH = "(?:Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)";
 var SYSLOG_BSD_TS = `${SYSLOG_MONTH}\\s+\\d{1,2}\\s+\\d{2}:\\d{2}:\\d{2}`;
 var SYSLOG_ISO_TS = "\\d{4}-\\d{2}-\\d{2}[T ]\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-]\\d{2}:?\\d{2})?";
 var SYSLOG_HOST_NAME = `${LABEL}(?:\\.${LABEL})*`;
 var SYSLOG_HOST_LOOKAHEAD = "(?=\\s+[A-Za-z][A-Za-z0-9_.@-]*(?:\\[\\d+\\])?:)";
-var SYSLOG_HOST = `(?:(?<=(?:${SYSLOG_BSD_TS}|${SYSLOG_ISO_TS})\\s+)${SYSLOG_HOST_NAME}${SYSLOG_HOST_LOOKAHEAD})`;
+var SYSLOG_HOST = `(?:(?:${SYSLOG_BSD_TS}|${SYSLOG_ISO_TS})\\s+)(${SYSLOG_HOST_NAME})${SYSLOG_HOST_LOOKAHEAD}`;
 var INVENTORY_PREFIX = "(?:[Ss][Rr][Vv]|[Ww][Ee][Bb]|[Dd][Bb]|[Aa][Pp][Pp]|[Hh][Oo][Ss][Tt]|[Nn][Oo][Dd][Ee]|[Pp][Oo][Dd])";
 var INVENTORY_HOST = `(?:\\b${INVENTORY_PREFIX}-[A-Za-z0-9]+(?:-[A-Za-z0-9]+)*-\\d+\\b)`;
 var hostnamesRule = {
@@ -1795,16 +1790,16 @@ var paymentInfoRule = {
     "(?:(?<![.\\d])\\b\\d(?:[ -]?\\d){12,18}\\b)",
     "(?:\\b[A-Z]{2}\\d{2}[A-Z0-9]{10,30}\\b)",
     "(?:\\b[A-Z]{2}\\d{2}(?: [A-Z0-9]{4}){2,7}(?: [A-Z0-9]{1,4})?\\b)",
-    `(?:(?<=\\b${CVV_KEY}\\s*[=:]\\s*)\\d{3,4}\\b)`,
-    `(?:(?<=\\b${EXP_KEY}\\s*[=:]\\s*)(?:0[1-9]|1[0-2])[/-](?:\\d{2}|\\d{4})\\b)`,
+    `(?:\\b${CVV_KEY}\\s*[=:]\\s*)(\\d{3,4}\\b)`,
+    `(?:\\b${EXP_KEY}\\s*[=:]\\s*)((?:0[1-9]|1[0-2])[/-](?:\\d{2}|\\d{4})\\b)`,
     "(?:\\bbc1[a-z0-9]{25,39}\\b)",
     "(?:(?<![A-Za-z0-9])[13][A-HJ-NP-Za-km-z1-9]{25,34}(?![A-Za-z0-9]))",
     "(?:\\b0x[A-Fa-f0-9]{40}\\b)"
   ],
   aggressivePatterns: [
     "(?:(?<![\\\\/])\\b[A-Z]{6}[A-Z0-9]{2}(?:[A-Z0-9]{3})?\\b(?![\\\\/]))",
-    `(?:(?<=\\b${ROUTING_KEY}\\s*[=:]\\s*)\\d{9}\\b)`,
-    `(?:(?<=\\b${ACCOUNT_KEY}\\s*[=:]\\s*)\\d{8,12}\\b)`
+    `(?:\\b${ROUTING_KEY}\\s*[=:]\\s*)(\\d{9}\\b)`,
+    `(?:\\b${ACCOUNT_KEY}\\s*[=:]\\s*)(\\d{8,12}\\b)`
   ],
   validate: validatePayment,
   jsonKeys: [
@@ -1844,9 +1839,9 @@ var phoneNumbersRule = {
     "(?:\\b1-\\d{3}-\\d{3}-\\d{4}\\b)",
     "(?:\\b0\\d{2}-\\d{3}-\\d{2}-\\d{2}\\b)",
     "(?:\\b0\\d{2}\\s\\d{3}\\s\\d{2}\\s\\d{2}\\b)",
-    "(?:(?<![.\\d])\\b00[1-9](?:[\\s().-]*\\d){7,13}(?!\\d))",
-    "(?:(?<=\\b(?:tel|sms):)\\+?[1-9](?:[\\s().-]*\\d){6,14}(?!\\d))",
-    `(?:(?<=\\b${PHONE_KEY}\\s*[=:]\\s*)\\+?[0-9](?:[\\s().-]*\\d){6,14}(?!\\d))`
+    "(?:(?<![.\\d-])\\b00[1-9](?:[\\s().-]*\\d){7,13}(?!\\w)(?!-[\\dA-Fa-f]))",
+    "(?:\\b(?:tel|sms):)(\\+?[1-9](?:[\\s().-]*\\d){6,14})(?!\\d)",
+    `(?:\\b${PHONE_KEY}\\s*[=:]\\s*)(\\+?[0-9](?:[\\s().-]*\\d){6,14})(?!\\d)`
   ],
   validate: validatePhone,
   jsonKeys: [
@@ -1906,12 +1901,12 @@ var secretsRule = {
   mode: "mask",
   token: "SECRET",
   patterns: [
-    "(?:(?<=(?:Bearer|bearer|BEARER)\\s+)[A-Za-z0-9._\\-+/=]{8,})",
-    "(?:(?<=(?:Basic|basic|BASIC)\\s+)[A-Za-z0-9+/]{8,}={0,2})",
+    "(?:(?:Bearer|bearer|BEARER)\\s+)([A-Za-z0-9._\\-+/=]{8,})",
+    "(?:(?:Basic|basic|BASIC)\\s+)([A-Za-z0-9+/]{8,}={0,2})",
     "(?:(?<![A-Za-z0-9_-])eyJ[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}(?:\\.[A-Za-z0-9_-]{8,})?)",
     "(?:-----BEGIN (?:(?:RSA |EC |DSA |OPENSSH |ENCRYPTED )?PRIVATE KEY|CERTIFICATE)-----[A-Za-z0-9+/=\\s\\\\]+?-----END (?:(?:RSA |EC |DSA |OPENSSH |ENCRYPTED )?PRIVATE KEY|CERTIFICATE)-----)",
     "(?:\\b(?:AKIA|ASIA|ABIA|ACCA)[A-Z0-9]{16}\\b)",
-    "(?:(?<=(?:aws_secret_access_key|AWS_SECRET_ACCESS_KEY)\\s*[=:]\\s*)[A-Za-z0-9/+=]{30,})",
+    "(?:(?:aws_secret_access_key|AWS_SECRET_ACCESS_KEY)\\s*[=:]\\s*)([A-Za-z0-9/+=]{30,})",
     "(?:github_pat_[A-Za-z0-9_]{22,})",
     "(?:gh[pousr]_[A-Za-z0-9]{36,})",
     "(?:xox[abprs]-[A-Za-z0-9-]{10,})",
@@ -1920,13 +1915,15 @@ var secretsRule = {
     "(?:(?:sk_live_|sk_test_|rk_live_|rk_test_)[A-Za-z0-9]{16,})",
     "(?:sk-proj-[A-Za-z0-9_-]{16,})",
     "(?:sk-[A-Za-z0-9]{20,})",
+    // Kept as a lookbehind: `.{0,60}` asserts a nearby keyword rather than an adjacent prefix, so
+    // one `Twilio` has to stay reusable by every identifier that follows it.
     "(?:(?<=(?:[Tt]wilio.{0,60}|\\b(?:[Aa]ccount[Ss]id|[Aa]uth[Tt]oken|[Ss]id)\\s*[=:]\\s*))(?:AC|SK)[0-9A-Fa-f]{32})",
     "(?:SG\\.[A-Za-z0-9_-]{10,}\\.[A-Za-z0-9_-]{10,})",
     "(?:npm_[A-Za-z0-9]{36,})",
-    `(?:(?<=[?&][Ss]ig=)[^&\\s"']{16,})`,
-    "(?:(?<=[a-zA-Z][a-zA-Z0-9+.-]*://)[^/@\\s:]+:[^/@\\s]+@)",
-    `(?:(?<=--${CLI_FLAGS}(?:\\s+|=)"?)[^\\s"']{4,})`,
-    `(?:(?<=\\b${CONTEXT_KEYS}"?\\s*[=:]\\s*"?)${CONTEXT_VALUE})`
+    `(?:[?&][Ss]ig=)([^&\\s"']{16,})`,
+    "(?:[a-zA-Z][a-zA-Z0-9+.-]*://)([^/@\\s:]+:[^/@\\s]+@)",
+    `(?:--${CLI_FLAGS}(?:\\s+|=)"?)([^\\s"']{4,})`,
+    `(?:\\b${CONTEXT_KEYS}"?\\s*[=:]\\s*"?)(${CONTEXT_VALUE})`
   ],
   aggressivePatterns: [
     "(?:(?<![A-Za-z0-9+/])[A-Za-z0-9+/]{40,}={0,2}(?![A-Za-z0-9+/=]))",
@@ -1978,7 +1975,7 @@ var sessionCookiesRule = {
     `(?:(?:csrftoken|csrf_token|XSRF-TOKEN|xsrf-token)=${COOKIE_VALUE})`,
     `(?:remember_token=${COOKIE_VALUE})`,
     `(?:(?:SSESS|SESS)[A-Fa-f0-9]{32}=${COOKIE_VALUE})`,
-    `(?:(?<=[Ss]et-[Cc]ookie:\\s*)[^;=\\s]+=${COOKIE_VALUE})`
+    `(?:[Ss]et-[Cc]ookie:\\s*)([^;=\\s]+=${COOKIE_VALUE})`
   ],
   aggressivePatterns: [
     `(?:(?<![\\w-])[\\w-]*session[\\w-]*=${COOKIE_VALUE})`,
@@ -2000,21 +1997,21 @@ var NOT_GUID = "(?![0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-)";
 var ACCOUNT_END = "(?![A-Za-z0-9_$\\\\/-])";
 var PATH_ROOT = "(?:\\b(?:HKLM|HKCU|HKU|HKCR|HKEY_[A-Z_]+)|\\b[A-Za-z]:)\\\\";
 var NOT_UNDER_PATH_ROOT = `(?<!${PATH_ROOT}(?:(?! [-/])[^<>'"\\n])*)`;
-var DOMAIN_USER = `(?:(?<!${WIN_DOMAIN_EXCLUDE})(?<=(?:^|[^\\\\.-])\\b[A-Za-z0-9](?:[A-Za-z0-9.-]{0,13}[A-Za-z0-9])?\\\\)${NOT_FILENAME}${NOT_GUID}${USER_SEG_SIMPLE}${ACCOUNT_END}${NOT_UNDER_PATH_ROOT})`;
+var DOMAIN_USER = `(?:(?:(?:^|[^\\\\.-])\\b[A-Za-z0-9](?:[A-Za-z0-9.-]{0,13}[A-Za-z0-9])?\\\\)(?<!${WIN_DOMAIN_EXCLUDE})${NOT_FILENAME}${NOT_GUID}(${USER_SEG_SIMPLE})${ACCOUNT_END}${NOT_UNDER_PATH_ROOT})`;
 var SID = "(?:\\bS-1-(?:\\d+-){1,14}\\d+\\b)";
 var VALUE_WITH_LETTER = "[\\w.@+-]*[A-Za-z][\\w.@+-]*";
-var LDAP_DN_SINGLE = `(?:(?<=\\b(?:uid|sAMAccountName)=)${VALUE_WITH_LETTER})`;
+var LDAP_DN_SINGLE = `(?:\\b(?:uid|sAMAccountName)=)(${VALUE_WITH_LETTER})`;
 var CN_VALUE = "(?:[A-Za-z0-9.'-]+(?: [A-Za-z0-9.'-]+){0,3})";
-var LDAP_DN_CN = `(?:(?<=\\bcn=)${CN_VALUE})`;
-var ARN_USER = "(?:(?<=:user/)[\\w.@+=,-]+)";
-var ARN_ASSUMED_ROLE_SESSION = "(?:(?<=:assumed-role/[\\w+=,.@-]+/)[\\w.@+=,-]+)";
-var K8S_SERVICE_ACCOUNT = "(?:(?<=\\bsystem:serviceaccount:[A-Za-z0-9-]+:)[A-Za-z0-9-]+)";
-var SSHD_FOR_USER = "(?:(?<=(?:\\bfor (?:invalid )?user|\\b[Ii]nvalid user)\\s+)[A-Za-z0-9._-]+)";
-var SSHD_RUSER = "(?:(?<=\\bruser=)[A-Za-z0-9._-]+)";
-var SSHD_LOGNAME = "(?:(?<=\\blogname=)[A-Za-z0-9._-]+)";
-var SUDO_USER = "(?:(?<=\\bsudo:\\s+)[A-Za-z0-9._-]+(?=\\s+:))";
+var LDAP_DN_CN = `(?:\\bcn=)(${CN_VALUE})`;
+var ARN_USER = "(?::user/)([\\w.@+=,-]+)";
+var ARN_ASSUMED_ROLE_SESSION = "(?::assumed-role/[\\w+=,.@-]+/)([\\w.@+=,-]+)";
+var K8S_SERVICE_ACCOUNT = "(?:\\bsystem:serviceaccount:[A-Za-z0-9-]+:)([A-Za-z0-9-]+)";
+var SSHD_FOR_USER = "(?:(?:\\bfor (?:invalid )?user|\\b[Ii]nvalid user)\\s+)([A-Za-z0-9._-]+)";
+var SSHD_RUSER = "(?:\\bruser=)([A-Za-z0-9._-]+)";
+var SSHD_LOGNAME = "(?:\\blogname=)([A-Za-z0-9._-]+)";
+var SUDO_USER = "(?:\\bsudo:\\s+)([A-Za-z0-9._-]+)(?=\\s+:)";
 var GENERIC_KEY = "(?:user|username|login|account|owner|actor|principal|requester|createdBy|modifiedBy|assignee|operator)";
-var GENERIC_CTX = `(?:(?<=\\b${GENERIC_KEY}\\s*[=:]\\s*)${VALUE_WITH_LETTER})`;
+var GENERIC_CTX = `(?:\\b${GENERIC_KEY}\\s*[=:]\\s*)(${VALUE_WITH_LETTER})`;
 var SLACK_USER_ID_AGGRESSIVE = "(?:\\bU[A-Z0-9]{8,10}\\b)";
 var SYSTEM_ACCOUNTS = /* @__PURE__ */ new Set([
   "root",
@@ -2126,6 +2123,121 @@ function getBuiltinRule(id) {
   return builtinsById.get(id);
 }
 
+// src/core/regexSource.ts
+function matchParen(source, openIndex) {
+  let depth = 0;
+  let inClass = false;
+  for (let index = openIndex; index < source.length; index += 1) {
+    const char = source[index];
+    if (char === "\\") {
+      index += 1;
+      continue;
+    }
+    if (inClass) {
+      if (char === "]") {
+        inClass = false;
+      }
+      continue;
+    }
+    if (char === "[") {
+      inClass = true;
+      continue;
+    }
+    if (char === "(") {
+      depth += 1;
+    } else if (char === ")") {
+      depth -= 1;
+      if (depth === 0) {
+        return index;
+      }
+    }
+  }
+  return -1;
+}
+function countCapturingGroups(source) {
+  let count = 0;
+  let inClass = false;
+  for (let index = 0; index < source.length; index += 1) {
+    const char = source[index];
+    if (char === "\\") {
+      index += 1;
+      continue;
+    }
+    if (inClass) {
+      if (char === "]") {
+        inClass = false;
+      }
+      continue;
+    }
+    if (char === "[") {
+      inClass = true;
+      continue;
+    }
+    if (char !== "(") {
+      continue;
+    }
+    const next = source.slice(index, index + 4);
+    if (next.startsWith("(?:") || next.startsWith("(?=") || next.startsWith("(?!") || next.startsWith("(?<=") || next.startsWith("(?<!")) {
+      continue;
+    }
+    count += 1;
+  }
+  return count;
+}
+function deriveGateSource(source) {
+  let output = "";
+  let inClass = false;
+  for (let index = 0; index < source.length; index += 1) {
+    const char = source[index];
+    if (char === "\\") {
+      output += source.slice(index, index + 2);
+      index += 1;
+      continue;
+    }
+    if (inClass) {
+      output += char;
+      if (char === "]") {
+        inClass = false;
+      }
+      continue;
+    }
+    if (char === "[") {
+      inClass = true;
+      output += char;
+      continue;
+    }
+    if (char === "(" && source.startsWith("(?<=", index)) {
+      const close = matchParen(source, index);
+      if (close === -1) {
+        output += char;
+        continue;
+      }
+      output += `(?:${source.slice(index + 4, close)})`;
+      index = close;
+      continue;
+    }
+    if (char === "(" && (source.startsWith("(?<!", index) || source.startsWith("(?=", index) || source.startsWith("(?!", index))) {
+      const close = matchParen(source, index);
+      if (close === -1) {
+        output += char;
+        continue;
+      }
+      index = close;
+      continue;
+    }
+    output += char;
+  }
+  return output;
+}
+function lineHasAnyChar(line, chars) {
+  for (let index = 0; index < line.length; index += 1) {
+    if (chars.includes(line[index])) {
+      return true;
+    }
+  }
+  return false;
+}
+
 // src/rules/validateRule.ts
 var RULE_ID_PATTERN = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
 var TOKEN_PATTERN = /^[A-Z][A-Z0-9]*$/;
@@ -2151,7 +2263,7 @@ function assertPatterns(patterns, ruleId, field) {
     }
     if (NAMED_GROUP_PATTERN.test(pattern)) {
       throw new InvalidRuleError(
-        `Rule "${ruleId}": \`${field}[${index}]\` must not declare a named capture group \u2014 the rule identifier is used as the group name.`
+        `Rule "${ruleId}": \`${field}[${index}]\` must not declare a named capture group.`
       );
     }
     try {
@@ -2161,6 +2273,11 @@ function assertPatterns(patterns, ruleId, field) {
         `Rule "${ruleId}": \`${field}[${index}]\` is not a valid Unicode regular expression: ${String(cause)}`
       );
     }
+    if (countCapturingGroups(pattern) > 1) {
+      throw new InvalidRuleError(
+        `Rule "${ruleId}": \`${field}[${index}]\` must contain at most one capturing group, which marks the value to replace.`
+      );
+    }
     return pattern;
   });
 }
@@ -2171,7 +2288,7 @@ function validateRule(rule) {
   const id = requireText(rule.id, String(rule.id), "id");
   if (!RULE_ID_PATTERN.test(id)) {
     throw new InvalidRuleError(
-      `Rule "${id}": \`id\` must be a valid ASCII identifier matching ${RULE_ID_PATTERN.source}, because it is used as a named capture group.`
+      `Rule "${id}": \`id\` must be a valid ASCII identifier matching ${RULE_ID_PATTERN.source}.`
     );
   }
   requireText(rule.label, id, "label");
@@ -2208,6 +2325,6 @@ function defineRule(rule) {
   return validateRule(rule);
 }
 
-export { InvalidKeyError, InvalidOptionError, InvalidRuleError, SanitizationAbortedError, SanitizerError, UnknownRuleError, builtinRuleIds, builtinRules, defineRule, getBuiltinRule, isSanitizerError, validateRule };
-//# sourceMappingURL=chunk-U4HRIFW3.js.map
-//# sourceMappingURL=chunk-U4HRIFW3.js.map
+export { InvalidKeyError, InvalidOptionError, InvalidRuleError, SanitizationAbortedError, SanitizerError, UnknownRuleError, builtinRuleIds, builtinRules, countCapturingGroups, defineRule, deriveGateSource, getBuiltinRule, isSanitizerError, lineHasAnyChar, validateRule };
+//# sourceMappingURL=chunk-5R34WEOD.js.map
+//# sourceMappingURL=chunk-5R34WEOD.js.map