@stackline/redeyed 1.0.1

package/CHANGELOG.md

@@ -0,0 +1,50 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+The format is based on Keep a Changelog and this project follows Semantic
+Versioning.
+
+## [Unreleased]
+
+## [1.0.1] - 2026-08-26
+
+### Added
+
+- Public token-transform playground and machine-readable documentation.
+- Verbatim Esprima BSD-2-Clause redistribution terms for embedded browser
+  bundles.
+- Pinned CI, CodeQL, and immutable npm publication workflows.
+- Documentation build, crawler metadata, package checks, and production audit
+  gates.
+
+## [1.0.0] - 2026-08-26
+
+### Added
+
+- Immutable, null-prototype configuration compilation.
+- Safe support for shadowed and prototype-like token keys.
+- Array-returning custom tokenizer support and `parserOptions`.
+- Native ESM, first-party TypeScript declarations, and browser bundles.
+- Differential, frozen-config, hostile-key, parser, hashbang, package, and
+  cardinal adoption regressions.
+- Current security, migration, compatibility, and provenance documentation.
+
+### Changed
+
+- Package name to `@stackline/redeyed` for independent maintenance.
+- Hashbang masking to bounded string construction with no-newline support.
+- Development tooling to a current, audit-clean release pipeline.
+- Published files to an explicit runtime and documentation allowlist.
+
+### Preserved
+
+- Callable CommonJS and UMD APIs.
+- Esprima 4 default behavior.
+- Existing config precedence, callbacks, token skipping, JSX/AST/nojoin, result
+  shape, comments, splits, and source retention.
+- Original MIT copyright and permission notice.
+
+[Unreleased]: https://github.com/alexandroit/stackline-redeyed/compare/stackline-v1.0.1...HEAD
+[1.0.1]: https://github.com/alexandroit/stackline-redeyed/compare/stackline-v1.0.0...stackline-v1.0.1
+[1.0.0]: https://github.com/alexandroit/stackline-redeyed/tree/stackline-v1.0.0

package/LICENSE

@@ -0,0 +1,23 @@
+Copyright 2012 Thorsten Lorenz. 
+All rights reserved.
+
+Permission is hereby granted, free of charge, to any person
+obtaining a copy of this software and associated documentation
+files (the "Software"), to deal in the Software without
+restriction, including without limitation the rights to use,
+copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the
+Software is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
+OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
+HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+OTHER DEALINGS IN THE SOFTWARE.

package/NOTICE

@@ -0,0 +1,9 @@
+@stackline/redeyed is an independent maintained continuation of redeyed.
+
+It is not affiliated with or endorsed by the original author. Original
+copyright and MIT license terms are preserved in LICENSE.
+
+Original project: https://github.com/thlorenz/redeyed
+
+Browser bundles include Esprima 4.0.1. Its BSD-2-Clause redistribution terms
+are preserved in THIRD_PARTY_LICENSES.md.

package/README.md

@@ -0,0 +1,187 @@
+# @stackline/redeyed
+
+> Source-preserving JavaScript token transforms with immutable configuration
+> and pluggable parsers.
+
+[![npm version](https://img.shields.io/npm/v/@stackline/redeyed.svg?style=flat-square)](https://www.npmjs.com/package/@stackline/redeyed)
+[![npm downloads](https://img.shields.io/npm/dm/@stackline/redeyed.svg?style=flat-square)](https://www.npmjs.com/package/@stackline/redeyed)
+[![CI](https://img.shields.io/github/actions/workflow/status/alexandroit/stackline-redeyed/ci.yml?branch=main&style=flat-square&label=CI)](https://github.com/alexandroit/stackline-redeyed/actions/workflows/ci.yml)
+[![license](https://img.shields.io/npm/l/@stackline/redeyed.svg?style=flat-square)](LICENSE)
+
+**[Docs and transformer](https://alexandro.net/docs/vanilla/redeyed/)** |
+**[npm](https://www.npmjs.com/package/@stackline/redeyed)** |
+**[GitHub](https://github.com/alexandroit/stackline-redeyed)** |
+**[Migration](MIGRATION.md)** |
+**[Security](SECURITY.md)** |
+**[Changelog](CHANGELOG.md)**
+
+**Current package version:** `1.0.1`
+
+This package is an independent, maintained continuation of
+[`redeyed`](https://github.com/thlorenz/redeyed). It preserves the established
+2.1.1 callable API and Esprima defaults while removing config mutation, safely
+handling property-like token names, and supporting current array-returning
+tokenizers as an opt-in extension.
+
+## Install
+
+```bash
+npm install @stackline/redeyed
+```
+
+Preserve existing `require('redeyed')` calls with an npm alias:
+
+```bash
+npm install redeyed@npm:@stackline/redeyed
+```
+
+## Quick Start
+
+```js
+const redeyed = require('@stackline/redeyed')
+
+const result = redeyed(
+  'const answer = 42',
+  {
+    Keyword: { _default: '<strong>:</strong>' },
+    Numeric: { _default: '<mark>:</mark>' }
+  }
+)
+
+console.log(result.code)
+// <strong>const</strong> answer = <mark>42</mark>
+```
+
+A string transform uses `before:after`. Object and function forms are also
+supported:
+
+```js
+const config = {
+  Identifier: {
+    answer: { _before: '[', _after: ']' },
+    _default: (source, info) => {
+      return info.tokenIndex === 0 ? source.toUpperCase() : source
+    }
+  }
+}
+```
+
+The caller's config is never changed. Frozen objects, null-prototype maps, and
+token names such as `hasOwnProperty`, `__proto__`, `constructor`, and
+`prototype` are processed as data.
+
+## API
+
+### `redeyed(code, config[, options])`
+
+Returns:
+
+```js
+{
+  ast,
+  tokens,
+  comments,
+  splits,
+  code
+}
+```
+
+Options:
+
+| Option | Default | Purpose |
+| --- | --- | --- |
+| `buildAst` | `false` | Parse and return an AST instead of tokenizer-only operation |
+| `jsx` | `false` | Enable the historical JSX parsing path |
+| `nojoin` | `false` | Return splits without joining transformed code |
+| `parser` | Esprima 4 | Supply an Esprima-compatible or array-returning parser |
+| `parserOptions` | `{}` | Pass parser-specific settings |
+
+Function transforms receive `(tokenSource, info)`. `info` contains the merged
+token index, tokens and comments, AST when requested, and source. A transform
+can return a string or:
+
+```js
+{
+  replacement: 'new source',
+  skipPastToken: info.tokens[targetIndex]
+}
+```
+
+## Modern Syntax
+
+Esprima remains the default to avoid silently changing token labels and ASTs.
+For modern syntax, opt in to a parser already used by your application:
+
+```bash
+npm install espree
+```
+
+```js
+const espree = require('espree')
+const redeyed = require('@stackline/redeyed')
+
+const result = redeyed(
+  'class Box { #value = 1_000n }',
+  {
+    PrivateIdentifier: { _default: '<:>' },
+    Numeric: { _default: '[:]' }
+  },
+  {
+    parser: espree,
+    parserOptions: {
+      ecmaVersion: 'latest',
+      sourceType: 'module'
+    }
+  }
+)
+```
+
+Parser-specific token types remain parser-specific. Array tokenizers can expose
+comments only when their return data includes comments; `buildAst: true` uses
+the parser's AST tokens and comments.
+
+## Modules And Browser
+
+- Callable CommonJS entry
+- Native ESM default and named exports
+- First-party TypeScript declarations, including TypeScript 3.9 consumers
+- Self-contained browser CJS, ESM, and global bundles
+- Original UMD behavior retained in `redeyed.js`
+- Node.js 12 and newer at runtime
+
+The package also exports starter configs:
+
+```js
+const config = require('@stackline/redeyed/config')
+const es5Config = require('@stackline/redeyed/config-es5')
+```
+
+## Package Integrity
+
+The old 2.1.1 npm artifact includes an example that references jQuery 1.8.1.
+That example is not runtime code, but it triggers dependency scanners. The
+Stackline artifact ships only runtime entries, configs, types, documentation,
+licenses, and generated browser bundles. No redeyed runtime CVE is claimed.
+
+The maintained suite includes all 187 upstream assertions, more than 1,000
+differential executions, immutable and hostile-key configs, modern parser
+adapters, hashbang edges, browser/modules/types, package audits, and a direct
+`cardinal` adoption check.
+
+## Security
+
+Report vulnerabilities privately as described in [SECURITY.md](SECURITY.md).
+Please do not publish an unpatched report in a public issue.
+
+## Provenance
+
+The source history, decisions, and preserved boundary are recorded in
+[UPSTREAM_AUDIT.md](UPSTREAM_AUDIT.md),
+[COMPATIBILITY_CONTRACT.md](COMPATIBILITY_CONTRACT.md), and [NOTICE](NOTICE).
+Stackline is not affiliated with or endorsed by the upstream author.
+
+## License
+
+MIT. The original copyright and permission notice remain in
+[LICENSE](LICENSE). Browser bundles also retain Esprima's BSD-2-Clause legal
+terms in [THIRD_PARTY_LICENSES.md](THIRD_PARTY_LICENSES.md).

package/SECURITY.md

@@ -0,0 +1,26 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported |
+| --- | --- |
+| 1.x | Yes |
+| Upstream 2.x | Maintained by its upstream owner |
+
+## Reporting A Vulnerability
+
+Use GitHub private vulnerability reporting for this repository. If that channel
+is unavailable, contact the security address on the Stackline organization
+profile.
+
+Include the affected version, runtime and parser, a minimal reproduction,
+impact, and known workarounds. Do not open a public issue before a coordinated
+fix is available. A complete report will be acknowledged within five business
+days.
+
+## Historical Artifact Note
+
+Upstream issue #22 concerns an old jQuery URL in an example shipped with
+`redeyed@2.1.1`. The example is not executed by the library. Stackline excludes
+that example from npm artifacts, but does not misrepresent the scanner finding
+as a CVE in redeyed's runtime.

package/THIRD_PARTY_LICENSES.md

@@ -0,0 +1,25 @@
+# Third-Party Licenses
+
+## Esprima 4.0.1 (BSD-2-Clause)
+
+Copyright JS Foundation and other contributors, https://js.foundation/
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+  * Redistributions of source code must retain the above copyright
+    notice, this list of conditions and the following disclaimer.
+  * Redistributions in binary form must reproduce the above copyright
+    notice, this list of conditions and the following disclaimer in the
+    documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED. IN NO EVENT SHALL <COPYRIGHT HOLDER> BE LIABLE FOR ANY
+DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

package/config-es5.d.ts

@@ -0,0 +1,5 @@
+import redeyed = require("./index")
+
+declare const config: redeyed.Config
+
+export = config

package/config-es5.js

@@ -0,0 +1,140 @@
+/*
+ * This config only contains ES5 tokens while the default config.js contains
+ * ES6 tokens as well.
+ *
+ * Copy this file and use it as a starting point for your redeyed config.
+ * Just fill in the tokens you want to surround/replace.
+ * Keep in mind that more specific configurations override less specific ones.
+ */
+
+module.exports = {
+
+    'Boolean': {
+      'true'   :  undefined
+    , 'false'  :  undefined
+    , _default :  undefined
+    }
+
+  , 'Identifier': {
+      _default: undefined
+    }
+
+  , 'Null': {
+      _default: undefined
+    }
+
+  , 'Numeric': {
+      _default: undefined
+    }
+
+  , 'String': {
+      _default: undefined
+    }
+
+  , 'Keyword': {
+      'break'       :  undefined
+
+    , 'case'        :  undefined
+    , 'catch'       :  undefined
+    , 'continue'    :  undefined
+
+    , 'debugger'    :  undefined
+    , 'default'     :  undefined
+    , 'delete'      :  undefined
+    , 'do'          :  undefined
+
+    , 'else'        :  undefined
+
+    , 'finally'     :  undefined
+    , 'for'         :  undefined
+    , 'function'    :  undefined
+
+    , 'if'          :  undefined
+    , 'in'          :  undefined
+    , 'instanceof'  :  undefined
+
+    , 'new'         :  undefined
+    , 'return'      :  undefined
+    , 'switch'      :  undefined
+
+    , 'this'        :  undefined
+    , 'throw'       :  undefined
+    , 'try'         :  undefined
+    , 'typeof'      :  undefined
+
+    , 'var'         :  undefined
+    , 'void'        :  undefined
+
+    , 'while'       :  undefined
+    , 'with'        :  undefined
+    , _default      :  undefined
+  }
+  , 'Punctuator': {
+      ';': undefined
+    , '.': undefined
+    , ',': undefined
+
+    , '{': undefined
+    , '}': undefined
+    , '(': undefined
+    , ')': undefined
+    , '[': undefined
+    , ']': undefined
+
+    , '<': undefined
+    , '>': undefined
+    , '+': undefined
+    , '-': undefined
+    , '*': undefined
+    , '%': undefined
+    , '&': undefined
+    , '|': undefined
+    , '^': undefined
+    , '!': undefined
+    , '~': undefined
+    , '?': undefined
+    , ':': undefined
+    , '=': undefined
+
+    , '<=': undefined
+    , '>=': undefined
+    , '==': undefined
+    , '!=': undefined
+    , '++': undefined
+    , '--': undefined
+    , '<<': undefined
+    , '>>': undefined
+    , '&&': undefined
+    , '||': undefined
+    , '+=': undefined
+    , '-=': undefined
+    , '*=': undefined
+    , '%=': undefined
+    , '&=': undefined
+    , '|=': undefined
+    , '^=': undefined
+    , '/=': undefined
+
+    , '===': undefined
+    , '!==': undefined
+    , '>>>': undefined
+    , '<<=': undefined
+    , '>>=': undefined
+
+    , '>>>=': undefined
+
+    , _default: undefined
+  }
+
+  // line comment
+  , Line: {
+     _default: undefined
+    }
+
+  /* block comment */
+  , Block: {
+     _default: undefined
+    }
+
+  , _default: undefined
+}

package/config.d.ts

@@ -0,0 +1,5 @@
+import redeyed = require("./index")
+
+declare const config: redeyed.Config
+
+export = config

package/config.js

@@ -0,0 +1,195 @@
+/*
+ * Copy this file and use it as a starting point for your redeyed config.
+ * Just fill in the tokens you want to surround/replace.
+ * Keep in mind that more specific configurations override less specific ones.
+ */
+
+module.exports = {
+
+    'Boolean': {
+      'true'   :  undefined
+    , 'false'  :  undefined
+    , _default :  undefined
+    }
+
+  , 'Identifier': {
+      _default: undefined
+    }
+
+  , 'Null': {
+      _default: undefined
+    }
+
+  , 'Numeric': {
+      _default: undefined
+    }
+
+  , 'String': {
+      _default: undefined
+    }
+
+  , 'Keyword': {
+      'break'       :  undefined
+
+    , 'case'        :  undefined
+    , 'catch'       :  undefined
+    , 'class'       :  undefined
+    , 'const'       :  undefined
+    , 'continue'    :  undefined
+
+    , 'debugger'    :  undefined
+    , 'default'     :  undefined
+    , 'delete'      :  undefined
+    , 'do'          :  undefined
+
+    , 'else'        :  undefined
+    , 'enum'        :  undefined
+    , 'export'      :  undefined
+    , 'extends'     :  undefined
+
+    , 'finally'     :  undefined
+    , 'for'         :  undefined
+    , 'function'    :  undefined
+
+    , 'if'          :  undefined
+    , 'implements'  :  undefined
+    , 'import'      :  undefined
+    , 'in'          :  undefined
+    , 'instanceof'  :  undefined
+    , 'interface'   :  undefined
+    , 'let'         :  undefined
+    , 'new'         :  undefined
+
+    , 'package'     :  undefined
+    , 'private'     :  undefined
+    , 'protected'   :  undefined
+    , 'public'      :  undefined
+
+    , 'return'      :  undefined
+    , 'static'      :  undefined
+    , 'super'       :  undefined
+    , 'switch'      :  undefined
+
+    , 'this'        :  undefined
+    , 'throw'       :  undefined
+    , 'try'         :  undefined
+    , 'typeof'      :  undefined
+
+    , 'var'         :  undefined
+    , 'void'        :  undefined
+
+    , 'while'       :  undefined
+    , 'with'        :  undefined
+    , 'yield'       :  undefined
+    , _default      :  undefined
+  }
+  , 'Punctuator': {
+      ';': undefined
+    , '.': undefined
+    , ',': undefined
+
+    , '{': undefined
+    , '}': undefined
+    , '(': undefined
+    , ')': undefined
+    , '[': undefined
+    , ']': undefined
+
+    , '<': undefined
+    , '>': undefined
+    , '+': undefined
+    , '-': undefined
+    , '*': undefined
+    , '%': undefined
+    , '&': undefined
+    , '|': undefined
+    , '^': undefined
+    , '!': undefined
+    , '~': undefined
+    , '?': undefined
+    , ':': undefined
+    , '=': undefined
+
+    , '<=': undefined
+    , '>=': undefined
+    , '==': undefined
+    , '!=': undefined
+    , '++': undefined
+    , '--': undefined
+    , '<<': undefined
+    , '>>': undefined
+    , '&&': undefined
+    , '||': undefined
+    , '+=': undefined
+    , '-=': undefined
+    , '*=': undefined
+    , '%=': undefined
+    , '&=': undefined
+    , '|=': undefined
+    , '^=': undefined
+    , '/=': undefined
+    , '=>': undefined
+    , '**': undefined
+
+    , '===': undefined
+    , '!==': undefined
+    , '>>>': undefined
+    , '<<=': undefined
+    , '>>=': undefined
+    , '...': undefined
+    , '**=': undefined
+
+    , '>>>=': undefined
+
+    , _default: undefined
+  }
+
+  // line comment
+  , Line: {
+      _default: undefined
+    }
+
+  /* block comment */
+  , Block: {
+      _default: undefined
+    }
+
+  // JSX
+  , JSXAttribute: {
+      _default: undefined
+    }
+  , JSXClosingElement: {
+      _default: undefined
+    }
+  , JSXElement: {
+      _default: undefined
+    }
+  , JSXEmptyExpression: {
+      _default: undefined
+    }
+  , JSXExpressionContainer: {
+      _default: undefined
+    }
+  , JSXIdentifier: {
+      // many more identifies are possible, div, table, etc.
+        className: undefined
+      , _default: undefined
+    }
+  , JSXMemberExpression: {
+      _default: undefined
+    }
+  , JSXNamespacedName: {
+      _default: undefined
+    }
+  , JSXOpeningElement: {
+      _default: undefined
+    }
+  , JSXSpreadAttribute: {
+      _default: undefined
+    }
+  , JSXText: {
+      _default: undefined
+    }
+
+  , _default: undefined
+}