@socprime/logtotal-sanitizer 0.2.0-beta.3 → 0.2.1-beta.0

package/cli.js

@@ -385,7 +385,40 @@ var geoLocationRule = {
     "postcode",
     "zip",
     "zipCode",
-    "geohash"
+    "geohash",
+    "address",
+    "homeAddress",
+    "billingAddress",
+    "shippingAddress",
+    "mailingAddress",
+    "postalAddress",
+    "residentialAddress",
+    "street",
+    "streetName",
+    "houseNumber",
+    "addressLine",
+    "addressLine3",
+    "postCode",
+    "plz",
+    "gps",
+    "gpsCoordinates",
+    "geoPoint",
+    "geoLocation",
+    "latLng",
+    "latLon"
+  ],
+  jsonKeyContains: [
+    "streetaddress",
+    "homeaddress",
+    "billingaddress",
+    "shippingaddress",
+    "mailingaddress",
+    "postaladdress",
+    "addressline",
+    "latitude",
+    "longitude",
+    "postalcode",
+    "zipcode"
   ]
 };
 
@@ -493,7 +526,60 @@ var govIdentifiersRule = {
     "licenseNumber",
     "personalId",
     "dob",
-    "dateOfBirth"
+    "dateOfBirth",
+    "passportNo",
+    "passportId",
+    "idNumber",
+    "idCardNumber",
+    "identityCardNumber",
+    "nationalIdNumber",
+    "nationalInsuranceNumber",
+    "sin",
+    "socialInsuranceNumber",
+    "tin",
+    "taxNumber",
+    "taxIdentificationNumber",
+    "ein",
+    "itin",
+    "ssnLast4",
+    "driversLicense",
+    "driverLicenseNumber",
+    "drivingLicence",
+    "dlNumber",
+    "personalCode",
+    "personalNumber",
+    "birthNumber",
+    "rodneCislo",
+    "pesel",
+    "oib",
+    "cnp",
+    "dni",
+    "nie",
+    "nif",
+    "nir",
+    "codiceFiscale",
+    "steuerId",
+    "bsn",
+    "cpf",
+    "curp",
+    "aadhaar",
+    "rnokpp",
+    "ipn",
+    "inn",
+    "snils",
+    "birthDate",
+    "placeOfBirth",
+    "mothersMaidenName",
+    "residencePermit",
+    "voterId"
+  ],
+  jsonKeyContains: [
+    "passport",
+    "taxid",
+    "nationalid",
+    "socialsecurity",
+    "driverlicen",
+    "drivinglicen"
   ]
 };
 
@@ -548,8 +634,42 @@ var healthInfoRule = {
     "insuranceNumber",
     "labResult",
     "observation",
-    "vitalSigns"
-  ]
+    "vitalSigns",
+    "diagnoses",
+    "diagnosisCode",
+    "icd",
+    "icdCode",
+    "medications",
+    "medicationName",
+    "drug",
+    "dosage",
+    "prescriptions",
+    "treatment",
+    "procedureCode",
+    "cptCode",
+    "symptom",
+    "symptoms",
+    "disease",
+    "illness",
+    "disability",
+    "medicalCondition",
+    "healthCondition",
+    "medicalHistory",
+    "medicalRecord",
+    "healthRecord",
+    "clinicalNotes",
+    "labResults",
+    "bloodGroup",
+    "vaccination",
+    "immunization",
+    "healthInsuranceNumber",
+    "insuranceId",
+    "npi",
+    "deaNumber",
+    "patientName",
+    "patientDob"
+  ],
+  jsonKeyContains: ["diagnos", "medication", "prescription", "allerg", "patient"]
 };
 
 // src/rules/definitions/homePaths.ts
@@ -1518,7 +1638,10 @@ var INTERNAL_SUFFIXES = [
   "lan",
   "home",
   "localdomain",
-  "arpa"
+  "arpa",
+  "test",
+  "invalid",
+  "localhost"
 ];
 var INTERNAL_COMPOUND_SUFFIXES = [
   "svc\\.cluster\\.local",
@@ -1625,9 +1748,34 @@ var hostnamesRule = {
     "nodeName",
     "dnsName",
     "machineName",
-    "targetHost"
+    "targetHost",
+    "remoteHost",
+    "sourceHost",
+    "destinationHost",
+    "srcHost",
+    "dstHost",
+    "shost",
+    "dhost",
+    "clientHost",
+    "hostFqdn",
+    "workstation",
+    "workstationName",
+    "deviceName",
+    "deviceHostname",
+    "sni",
+    "serverNameIndication",
+    "tlsServerName",
+    "virtualHost",
+    "vhost",
+    "httpHost",
+    "xForwardedHost",
+    "qname",
+    "queryName",
+    "dnsDomain",
+    "smtpHost",
+    "mailServer"
   ],
-  jsonKeyContains: ["computer", "domainname"]
+  jsonKeyContains: ["computer", "domainname", "hostname", "fqdn", "workstation"]
 };
 
 // src/rules/definitions/ipAddresses.ts
@@ -1703,7 +1851,63 @@ var ipAddressesRule = {
     "destinationIp",
     "xForwardedFor",
     "mac",
-    "macAddress"
+    "macAddress",
+    "ipv4",
+    "ipv6",
+    "ipAddr",
+    "clientAddress",
+    "clientAddr",
+    "serverAddress",
+    "remoteIp",
+    "remoteAddress",
+    "peerIp",
+    "peerAddress",
+    "srcAddr",
+    "dstAddr",
+    "sourceAddress",
+    "destinationAddress",
+    "src",
+    "dst",
+    "srcIpAddr",
+    "dstIpAddr",
+    "localIp",
+    "publicIp",
+    "privateIp",
+    "externalIp",
+    "internalIp",
+    "hostIp",
+    "serverIp",
+    "nasIpAddress",
+    "callerIpAddress",
+    "sourceIPAddress",
+    "trueClientIp",
+    "xRealIp",
+    "cfConnectingIp",
+    "forwardedFor",
+    "natIp",
+    "gatewayIp",
+    "macAddr",
+    "hwAddr",
+    "clientMac",
+    "srcMac",
+    "dstMac",
+    "smac",
+    "dmac",
+    "bssid"
+  ],
+  jsonKeyContains: [
+    "ipaddr",
+    "macaddr",
+    "networkaddress",
+    "remoteaddr",
+    "clientaddr",
+    "peeraddr",
+    "clientip",
+    "sourceip",
+    "remoteip",
+    "srcip",
+    "dstip",
+    "destinationip"
   ]
 };
 
@@ -2133,8 +2337,41 @@ var paymentInfoRule = {
     "routingNumber",
     "bic",
     "swift",
-    "expiryDate"
-  ]
+    "expiryDate",
+    "ccNumber",
+    "cardNo",
+    "cardNum",
+    "creditCardNumber",
+    "debitCardNumber",
+    "primaryAccountNumber",
+    "cvc2",
+    "cvn",
+    "csc",
+    "securityCode",
+    "cardSecurityCode",
+    "cardCvv",
+    "cardExpiry",
+    "expDate",
+    "expirationDate",
+    "bankAccount",
+    "bankAccountNumber",
+    "acctNumber",
+    "sortCode",
+    "bsb",
+    "swiftCode",
+    "bicCode",
+    "ibanNumber",
+    "walletAddress",
+    "btcAddress",
+    "ethAddress",
+    "cardHolder",
+    "cardholderName",
+    "nameOnCard",
+    "track1",
+    "track2",
+    "trackData"
+  ],
+  jsonKeyContains: ["iban", "cardnumber", "cvv", "creditcard", "accountnumber"]
 };
 
 // src/rules/definitions/phoneNumbers.ts
@@ -2173,8 +2410,30 @@ var phoneNumbersRule = {
     "tel",
     "fax",
     "msisdn",
-    "contactNumber"
-  ]
+    "contactNumber",
+    "phoneNo",
+    "phoneNum",
+    "mobilePhone",
+    "mobileNo",
+    "cellPhone",
+    "homePhone",
+    "workPhone",
+    "businessPhone",
+    "telephoneNumber",
+    "otherTelephone",
+    "telNo",
+    "faxNumber",
+    "contactPhone",
+    "primaryPhone",
+    "callerId",
+    "callerNumber",
+    "callingNumber",
+    "calledNumber",
+    "ani",
+    "dnis",
+    "whatsapp"
+  ],
+  jsonKeyContains: ["phone", "msisdn", "mobilenumber", "faxnumber"]
 };
 
 // src/rules/definitions/secrets.ts
@@ -2268,7 +2527,66 @@ var secretsRule = {
     "xApiKey",
     "idToken",
     "awsSecretAccessKey",
-    "signature"
+    "signature",
+    "accessKey",
+    "accessKeyId",
+    "secretAccessKey",
+    "awsSessionToken",
+    "xAmzSecurityToken",
+    "bearerToken",
+    "authToken",
+    "authKey",
+    "apiToken",
+    "appSecret",
+    "consumerSecret",
+    "oauthToken",
+    "oauthTokenSecret",
+    "masterKey",
+    "encryptionKey",
+    "sharedKey",
+    "sharedSecret",
+    "webhookSecret",
+    "signingSecret",
+    "signingKey",
+    "connectionString",
+    "connStr",
+    "passphrase",
+    "passwordHash",
+    "pwdHash",
+    "otp",
+    "totp",
+    "mfaCode",
+    "oneTimePassword",
+    "verificationCode",
+    "recoveryCode",
+    "sshKey",
+    "subscriptionKey",
+    "ocpApimSubscriptionKey",
+    "xAuthToken",
+    "xAccessToken",
+    "proxyAuthorization",
+    "sasToken",
+    "vaultToken",
+    "xVaultToken",
+    "jwt",
+    "samlResponse",
+    "samlAssertion",
+    "pinBlock"
+  ],
+  jsonKeyContains: [
+    "password",
+    "passwd",
+    "secret",
+    "apikey",
+    "accesstoken",
+    "refreshtoken",
+    "idtoken",
+    "authtoken",
+    "bearertoken",
+    "privatekey",
+    "credential",
+    "passphrase",
+    "connectionstring"
   ]
 };
 
@@ -2299,7 +2617,41 @@ var sessionCookiesRule = {
     `(?:(?<![\\w-])[\\w-]*session[\\w-]*=${COOKIE_VALUE})`,
     `(?:(?<![\\w-])[\\w-]*token=${COOKIE_VALUE})`
   ],
-  jsonKeys: ["sessionId", "sid", "cookie", "cookies", "setCookie", "jsessionid", "csrfToken"]
+  jsonKeys: [
+    "sessionId",
+    "sid",
+    "cookie",
+    "cookies",
+    "setCookie",
+    "jsessionid",
+    "csrfToken",
+    "sessionCookie",
+    "sessionToken",
+    "sessionKey",
+    "session",
+    "phpsessid",
+    "aspNetSessionId",
+    "connectSid",
+    "laravelSession",
+    "xsrfToken",
+    "xCsrfToken",
+    "xXsrfToken",
+    "csrf",
+    "rememberToken",
+    "authCookie",
+    "cookieHeader",
+    "requestCookies",
+    "responseCookies"
+  ],
+  jsonKeyContains: [
+    "sessionid",
+    "sessiontoken",
+    "sessioncookie",
+    "sessionkey",
+    "cookie",
+    "csrf",
+    "xsrf"
+  ]
 };
 
 // src/rules/definitions/users.ts
@@ -2419,9 +2771,71 @@ var usersRule = {
     "givenName",
     "surname",
     "userId",
-    "uid"
+    "uid",
+    "usr",
+    "usrName",
+    "usrEmail",
+    "usrId",
+    "loginName",
+    "loginId",
+    "logonName",
+    "userSid",
+    "requestedBy",
+    "submittedBy",
+    "approvedBy",
+    "updatedBy",
+    "deletedBy",
+    "author",
+    "committer",
+    "reporter",
+    "assignee",
+    "customerName",
+    "customerEmail",
+    "contactEmail",
+    "contactName",
+    "recipient",
+    "recipients",
+    "sender",
+    "replyTo",
+    "mailFrom",
+    "rcptTo",
+    "envelopeFrom",
+    "envelopeTo",
+    "emails",
+    "primaryEmail",
+    "workEmail",
+    "personalEmail",
+    "middleName",
+    "nickname",
+    "maidenName",
+    "familyName",
+    "legalName",
+    "realName",
+    "gecos",
+    "distinguishedName",
+    "userDn",
+    "userDisplayName",
+    "employeeId",
+    "employeeNumber",
+    "staffId",
+    "studentId",
+    "impersonatedUser",
+    "effectiveUser",
+    "sudoUser",
+    "ruser",
+    "suser",
+    "duser"
   ],
-  jsonKeyContains: ["owner", "username"]
+  jsonKeyContains: [
+    "owner",
+    "username",
+    "email",
+    "principalname",
+    "loginname",
+    "firstname",
+    "lastname",
+    "fullname"
+  ]
 };
 
 // src/rules/registry.ts
@@ -2757,6 +3171,181 @@ function createLineSplitter(options = {}) {
   return { push, flush };
 }
 
+// src/core/jsonKeyMatcher.ts
+var RESOLVE_CACHE_LIMIT = 1e4;
+function normalizeKey2(key) {
+  return key.toLowerCase().replace(/[-_.\s]/g, "");
+}
+function shouldPreserveJsonValue(value) {
+  return value.length === 0 || value === "-";
+}
+function buildTables(rules) {
+  const exact = /* @__PURE__ */ new Map();
+  const contains = [];
+  for (const rule of rules) {
+    for (const key of rule.jsonKeys ?? []) {
+      const normalized = normalizeKey2(key);
+      if (!exact.has(normalized)) {
+        exact.set(normalized, rule);
+      }
+    }
+    for (const fragment of rule.jsonKeyContains ?? []) {
+      contains.push({ fragment: normalizeKey2(fragment), rule });
+    }
+  }
+  return { exact, contains };
+}
+function lastSegment(key) {
+  const dot = key.lastIndexOf(".");
+  return dot === -1 ? key : key.slice(dot + 1);
+}
+function resolveUncached(tables, key, parent) {
+  const dot = key.lastIndexOf(".");
+  const leaf = normalizeKey2(dot === -1 ? key : key.slice(dot + 1));
+  const parentRaw = dot === -1 ? parent : key.slice(0, dot);
+  if (leaf.length === 0) {
+    return null;
+  }
+  if (parentRaw !== void 0) {
+    const scoped = tables.exact.get(normalizeKey2(lastSegment(parentRaw)) + leaf);
+    if (scoped) {
+      return scoped;
+    }
+  }
+  const exact = tables.exact.get(leaf);
+  if (exact) {
+    return exact;
+  }
+  for (const entry of tables.contains) {
+    if (leaf.includes(entry.fragment)) {
+      return entry.rule;
+    }
+  }
+  return null;
+}
+function buildMatcher(rules) {
+  const tables = buildTables(rules);
+  const cache = /* @__PURE__ */ new Map();
+  return {
+    resolve(key, parent) {
+      const cacheKey = parent === void 0 ? key : `${parent}\0${key}`;
+      let rule = cache.get(cacheKey);
+      if (rule === void 0) {
+        rule = resolveUncached(tables, key, parent);
+        if (cache.size >= RESOLVE_CACHE_LIMIT) {
+          cache.clear();
+        }
+        cache.set(cacheKey, rule);
+      }
+      return rule ?? void 0;
+    }
+  };
+}
+var matcherCache = /* @__PURE__ */ new WeakMap();
+function jsonKeyMatcher(rules) {
+  const cached = matcherCache.get(rules);
+  if (cached) {
+    return cached;
+  }
+  const matcher = buildMatcher(rules);
+  matcherCache.set(rules, matcher);
+  return matcher;
+}
+
+// src/core/redactKeyValuePairs.ts
+var NUMBER = "(-?\\d+(?:\\.\\d+)?(?:[eE][+-]?\\d+)?)(?![\\w.:+-])";
+var DOUBLE_QUOTED = new RegExp(
+  `(?<![\\\\\\w])"((?:[^"\\\\\\r\\n]|\\\\.){1,128})"\\s*:\\s*(?:"((?:[^"\\\\]|\\\\.)*)"|${NUMBER})`,
+  "g"
+);
+var ESCAPED = new RegExp(
+  `\\\\"((?:[^"\\\\\\r\\n]|\\\\\\\\){1,128})\\\\"\\s*:\\s*(?:\\\\"((?:\\\\\\\\\\\\"|\\\\\\\\|\\\\[^"\\\\]|[^"\\\\])*)\\\\"|${NUMBER})`,
+  "g"
+);
+var SINGLE_QUOTED = new RegExp(
+  `(?<![\\\\\\w])'((?:[^'\\\\\\r\\n]|\\\\.){1,128})'\\s*:\\s*(?:'((?:[^'\\\\]|\\\\.)*)'|"((?:[^"\\\\]|\\\\.)*)"|${NUMBER})`,
+  "g"
+);
+function decodeJsonString(raw) {
+  if (!raw.includes("\\")) {
+    return raw;
+  }
+  try {
+    return JSON.parse(`"${raw}"`);
+  } catch {
+    return raw;
+  }
+}
+function decodeEscapedJsonString(raw) {
+  return decodeJsonString(decodeJsonString(raw));
+}
+function decodePythonString(raw) {
+  return raw.includes("\\") ? raw.replace(/\\(['"\\])/g, "$1") : raw;
+}
+function collect(line, regex, rules, decode, numberQuote, out) {
+  const matcher = jsonKeyMatcher(rules);
+  regex.lastIndex = 0;
+  for (let found = regex.exec(line); found !== null; found = regex.exec(line)) {
+    const rawKey = found[1];
+    let rawValue;
+    let quote = "";
+    for (let group = 2; group < found.length; group += 1) {
+      if (found[group] !== void 0) {
+        rawValue = found[group];
+        quote = group === found.length - 1 ? numberQuote : "";
+        break;
+      }
+    }
+    if (rawValue === void 0) {
+      continue;
+    }
+    const value = quote === "" ? decode(rawValue) : rawValue;
+    if (shouldPreserveJsonValue(value)) {
+      continue;
+    }
+    const rule = matcher.resolve(decode(rawKey));
+    if (!rule) {
+      continue;
+    }
+    const end = found.index + found[0].length - (quote === "" ? 1 : 0);
+    const valueEnd = quote === "" && regex === ESCAPED ? end - 1 : end;
+    out.push({
+      keyStart: found.index,
+      match: { start: valueEnd - rawValue.length, end: valueEnd, value, rule, quote }
+    });
+  }
+}
+function findKeyValueMatches(line, rules) {
+  const doubleQuoted = line.includes('":') || line.includes('" :');
+  const singleQuoted = line.includes("':") || line.includes("' :");
+  if (!doubleQuoted && !singleQuoted) {
+    return [];
+  }
+  const candidates = [];
+  if (doubleQuoted) {
+    collect(line, DOUBLE_QUOTED, rules, decodeJsonString, '"', candidates);
+    if (line.includes('\\"')) {
+      collect(line, ESCAPED, rules, decodeEscapedJsonString, '\\"', candidates);
+    }
+  }
+  if (singleQuoted) {
+    collect(line, SINGLE_QUOTED, rules, decodePythonString, "'", candidates);
+  }
+  if (candidates.length === 0) {
+    return [];
+  }
+  candidates.sort((left, right) => left.keyStart - right.keyStart);
+  const matches = [];
+  let floor = 0;
+  for (const { keyStart, match } of candidates) {
+    if (keyStart >= floor) {
+      matches.push(match);
+      floor = match.end;
+    }
+  }
+  return matches;
+}
+
 // src/core/redactLine.ts
 function sliceContext(text, index, length, chars) {
   return {
@@ -2836,11 +3425,21 @@ function pickNext(cursors) {
   }
   return best;
 }
+function blankOut(line, spans) {
+  let out = "";
+  let cursor = 0;
+  for (const span of spans) {
+    out += line.slice(cursor, span.start) + " ".repeat(span.end - span.start);
+    cursor = span.end;
+  }
+  return out + line.slice(cursor);
+}
 function redactLine(line, ctx, options = {}) {
   const { compiled, rulesById, allow, contextChars } = ctx;
   const withSegments = options.withSegments ?? false;
   const withMatches = options.withMatches ?? false;
-  if (compiled.length === 0) {
+  const keyed = ctx.json ? findKeyValueMatches(line, ctx.rules) : [];
+  if (compiled.length === 0 && keyed.length === 0) {
     return {
       output: line,
       counts: {},
@@ -2848,18 +3447,65 @@ function redactLine(line, ctx, options = {}) {
       segments: withSegments ? { before: [{ text: line, changed: false }], after: [{ text: line, changed: false }] } : void 0
     };
   }
-  const cursors = openCursors(line, compiled);
+  const scan = keyed.length === 0 ? line : blankOut(line, keyed);
+  const cursors = openCursors(scan, compiled);
   const counts = {};
   const matches = [];
   const before = [];
   const after = [];
   let output = "";
   let cursor = 0;
+  let keyedIndex = 0;
   for (; ; ) {
     const next = pickNext(cursors);
+    const pending = keyed[keyedIndex];
+    if (pending !== void 0 && (next === null || pending.start <= next.start)) {
+      keyedIndex += 1;
+      if (!isAllowed(allow, pending.rule.id, pending.value)) {
+        const token = buildReplacement(ctx, pending.rule.id, pending.value);
+        const raw = line.slice(pending.start, pending.end);
+        if (withSegments) {
+          if (pending.start > cursor) {
+            const gap = line.slice(cursor, pending.start);
+            before.push({ text: gap, changed: false });
+            after.push({ text: gap, changed: false });
+          }
+          before.push({ text: raw, changed: true });
+          if (pending.quote) {
+            after.push({ text: pending.quote, changed: false });
+          }
+          after.push({ text: token, changed: true });
+          if (pending.quote) {
+            after.push({ text: pending.quote, changed: false });
+          }
+        }
+        output += line.slice(cursor, pending.start) + pending.quote + token + pending.quote;
+        cursor = pending.end;
+        counts[pending.rule.id] = (counts[pending.rule.id] ?? 0) + 1;
+        if (withMatches) {
+          matches.push({
+            ruleId: pending.rule.id,
+            original: pending.value,
+            replacement: token,
+            index: pending.start,
+            ...contextChars > 0 ? sliceContext(line, pending.start, raw.length, contextChars) : {}
+          });
+        }
+      }
+      for (const candidate of cursors) {
+        if (candidate.active && candidate.start < pending.end) {
+          advance(candidate, scan, pending.end);
+        }
+      }
+      continue;
+    }
     if (next === null) {
       break;
     }
+    if (pending !== void 0 && next.start + next.original.length > pending.start) {
+      advance(next, scan, next.start + 1);
+      continue;
+    }
     const { start, original, ruleId } = next;
     const spanEnd = start + Math.max(original.length, 1);
     const rule = rulesById.get(ruleId);
@@ -2890,7 +3536,7 @@ function redactLine(line, ctx, options = {}) {
     }
     for (const candidate of cursors) {
       if (candidate.active && candidate.start < spanEnd) {
-        advance(candidate, line, spanEnd);
+        advance(candidate, scan, spanEnd);
       }
     }
   }
@@ -2914,51 +3560,6 @@ function looksLikeJson(line) {
   const trimmed = line.trim();
   return trimmed.length > 0 && (trimmed.startsWith("{") || trimmed.startsWith("["));
 }
-function normalizeKey2(key) {
-  return key.toLowerCase().replace(/[-_]/g, "");
-}
-function shouldPreserveJsonValue(value) {
-  return value.length === 0 || value === "-";
-}
-function buildJsonKeyMatcher(rules) {
-  const exact = /* @__PURE__ */ new Map();
-  const contains = [];
-  for (const rule of rules) {
-    for (const key of rule.jsonKeys ?? []) {
-      const normalized = normalizeKey2(key);
-      if (!exact.has(normalized)) {
-        exact.set(normalized, rule);
-      }
-    }
-    for (const fragment of rule.jsonKeyContains ?? []) {
-      contains.push({ fragment: normalizeKey2(fragment), rule });
-    }
-  }
-  return { exact, contains };
-}
-function resolveJsonKeyRule(matcher, key) {
-  const normalized = normalizeKey2(key);
-  const exact = matcher.exact.get(normalized);
-  if (exact) {
-    return exact;
-  }
-  for (const entry of matcher.contains) {
-    if (normalized.includes(entry.fragment)) {
-      return entry.rule;
-    }
-  }
-  return void 0;
-}
-var jsonKeyMatcherCache = /* @__PURE__ */ new WeakMap();
-function jsonKeyMatcher(rules) {
-  const cached = jsonKeyMatcherCache.get(rules);
-  if (cached) {
-    return cached;
-  }
-  const matcher = buildJsonKeyMatcher(rules);
-  jsonKeyMatcherCache.set(rules, matcher);
-  return matcher;
-}
 function mergeCounts(target, source) {
   for (const [id, count] of Object.entries(source)) {
     target[id] = (target[id] ?? 0) + count;
@@ -2985,6 +3586,15 @@ function highlightReplacements(text) {
 function jsonStringContent(value) {
   return JSON.stringify(value).slice(1, -1);
 }
+function locateJsonNumber(text, value, from = 0) {
+  const re = new RegExp(`:\\s*(${escapeRegExp(value)})(?![\\d.eE])`, "g");
+  re.lastIndex = from;
+  const match = re.exec(text);
+  if (match === null) {
+    return null;
+  }
+  return { index: match.index + match[0].length - value.length, length: value.length };
+}
 function locateQuotedJsonValue(text, value, from = 0) {
   const encoded = jsonStringContent(value);
   const quotedAt = text.indexOf(`"${encoded}"`, from);
@@ -2994,6 +3604,9 @@ function locateQuotedJsonValue(text, value, from = 0) {
   return { index: quotedAt + 1, length: encoded.length };
 }
 function findOriginal(text, original, from) {
+  if (original.number === true) {
+    return locateJsonNumber(text, original.value, from);
+  }
   const encoded = jsonStringContent(original.value);
   if (original.wholeValue) {
     const quoted = `"${encoded}"`;
@@ -3076,32 +3689,39 @@ function redactJsonLine(line, ctx, options = {}) {
     }
     return { contextBefore: "", contextAfter: "" };
   };
-  const redactValue = (value, key) => {
+  const redactField = (rule, value, number) => {
+    if (isAllowed(ctx.allow, rule.id, value)) {
+      return null;
+    }
+    const replacement = buildReplacement(ctx, rule.id, value);
+    counts[rule.id] = (counts[rule.id] ?? 0) + 1;
+    if (withSegments) {
+      originals.push({ value, wholeValue: true, number });
+    }
+    if (withMatches) {
+      const located = number ? locateJsonNumber(content, value) : locateQuotedJsonValue(content, value);
+      matches.push({
+        ruleId: rule.id,
+        original: value,
+        replacement,
+        index: located?.index ?? 0,
+        ...located && ctx.contextChars > 0 ? sliceContext(content, located.index, located.length, ctx.contextChars) : ctx.contextChars > 0 ? { contextBefore: "", contextAfter: "" } : {}
+      });
+    }
+    return replacement;
+  };
+  const redactValue = (value, key, parent) => {
+    if (typeof value === "number") {
+      const fieldRule = key === void 0 || !Number.isFinite(value) ? void 0 : keyMatcher.resolve(key, parent);
+      return fieldRule ? redactField(fieldRule, String(value), true) ?? value : value;
+    }
     if (typeof value === "string") {
       if (key !== void 0 && shouldPreserveJsonValue(value)) {
         return value;
       }
-      const fieldRule = key === void 0 ? void 0 : resolveJsonKeyRule(keyMatcher, key);
+      const fieldRule = key === void 0 ? void 0 : keyMatcher.resolve(key, parent);
       if (fieldRule) {
-        if (isAllowed(ctx.allow, fieldRule.id, value)) {
-          return value;
-        }
-        const replacement = buildReplacement(ctx, fieldRule.id, value);
-        counts[fieldRule.id] = (counts[fieldRule.id] ?? 0) + 1;
-        if (withSegments) {
-          originals.push({ value, wholeValue: true });
-        }
-        if (withMatches) {
-          const located = locateQuotedJsonValue(content, value);
-          matches.push({
-            ruleId: fieldRule.id,
-            original: value,
-            replacement,
-            index: located?.index ?? 0,
-            ...located && ctx.contextChars > 0 ? sliceContext(content, located.index, located.length, ctx.contextChars) : ctx.contextChars > 0 ? { contextBefore: "", contextAfter: "" } : {}
-          });
-        }
-        return replacement;
+        return redactField(fieldRule, value, false) ?? value;
       }
       const result = redactLine(value, ctx, { withMatches: collectOriginals });
       mergeCounts(counts, result.counts);
@@ -3118,12 +3738,12 @@ function redactJsonLine(line, ctx, options = {}) {
       return result.output;
     }
     if (Array.isArray(value)) {
-      return value.map((item) => redactValue(item));
+      return value.map((item) => redactValue(item, key, parent));
     }
     if (value !== null && typeof value === "object") {
       const out = {};
       for (const [entryKey, entryValue] of Object.entries(value)) {
-        out[entryKey] = redactValue(entryValue, entryKey);
+        out[entryKey] = redactValue(entryValue, entryKey, key);
       }
       return out;
     }