field-redactor 1.2.0 → 1.5.0

package/dist/presets.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.presets = void 0;
+const types_1 = require("./types");
+const AUTH_KEY_REMOVAL = {
+    deleteSecretKeys: [/authKey/i]
+};
+const NAME_VALUE_EVENT_SCHEMA = {
+    name: types_1.CustomObjectMatchType.Ignore,
+    value: 'name'
+};
+const NAME_TYPE_VALUE_METADATA_SCHEMA = {
+    name: types_1.CustomObjectMatchType.Ignore,
+    type: types_1.CustomObjectMatchType.Ignore,
+    value: 'name'
+};
+const KEY_VALUE_ENTRY_SCHEMA = {
+    key: types_1.CustomObjectMatchType.Ignore,
+    value: 'key'
+};
+const APPLICATION_LOG_SECRET_KEYS = [/email/i, /mdn/i, /phone/i, /.+name$/i, /auth/i];
+/**
+ * Opinionated configuration presets derived from integration test fixtures.
+ * Spread into {@link FieldRedactor} or {@link FieldRedactor.createSafe} config and extend as needed.
+ */
+exports.presets = {
+    /**
+     * `{ name, type, value }` metadata entries with sibling-key redaction and auth key removal.
+     * Pair with your own `secretKeys` for field names that should trigger redaction.
+     */
+    loggingMetadata() {
+        return Object.assign(Object.assign({}, AUTH_KEY_REMOVAL), { customObjects: [NAME_TYPE_VALUE_METADATA_SCHEMA] });
+    },
+    /**
+     * Application log preset from `realExamples.spec.ts`: common PII field patterns,
+     * auth key removal, and `{ name, value }` event metadata schemas.
+     */
+    applicationLogging() {
+        return Object.assign(Object.assign({ secretKeys: APPLICATION_LOG_SECRET_KEYS }, AUTH_KEY_REMOVAL), { customObjects: [NAME_VALUE_EVENT_SCHEMA] });
+    },
+    /**
+     * `{ key, value }` shaped entries (blanket coverage small schema).
+     */
+    keyValueEntries() {
+        return {
+            customObjects: [KEY_VALUE_ENTRY_SCHEMA]
+        };
+    }
+};
+//# sourceMappingURL=presets.js.map

package/dist/presets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"presets.js","sourceRoot":"","sources":["../src/presets.ts"],"names":[],"mappings":";;;AAAA,mCAAmF;AAEnF,MAAM,gBAAgB,GAAkD;IACtE,gBAAgB,EAAE,CAAC,UAAU,CAAC;CAC/B,CAAC;AAEF,MAAM,uBAAuB,GAAiB;IAC5C,IAAI,EAAE,6BAAqB,CAAC,MAAM;IAClC,KAAK,EAAE,MAAM;CACd,CAAC;AAEF,MAAM,+BAA+B,GAAiB;IACpD,IAAI,EAAE,6BAAqB,CAAC,MAAM;IAClC,IAAI,EAAE,6BAAqB,CAAC,MAAM;IAClC,KAAK,EAAE,MAAM;CACd,CAAC;AAEF,MAAM,sBAAsB,GAAiB;IAC3C,GAAG,EAAE,6BAAqB,CAAC,MAAM;IACjC,KAAK,EAAE,KAAK;CACb,CAAC;AAEF,MAAM,2BAA2B,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;AAEtF;;;GAGG;AACU,QAAA,OAAO,GAAG;IACrB;;;OAGG;IACH,eAAe;QACb,uCACK,gBAAgB,KACnB,aAAa,EAAE,CAAC,+BAA+B,CAAC,IAChD;IACJ,CAAC;IAED;;;OAGG;IACH,kBAAkB;QAChB,qCACE,UAAU,EAAE,2BAA2B,IACpC,gBAAgB,KACnB,aAAa,EAAE,CAAC,uBAAuB,CAAC,IACxC;IACJ,CAAC;IAED;;OAEG;IACH,eAAe;QACb,OAAO;YACL,aAAa,EAAE,CAAC,sBAAsB,CAAC;SACxC,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/primitiveRedactor.d.ts

@@ -1,4 +1,4 @@
-import { PrimitiveRedactorConfig } from './types';
+import { PrimitiveRedactorConfig, RedactablePrimitive, RedactedPrimitive } from './types';
 /**
  * Redacts primitive values based on the configuration provided in the constructor. Uses the redactor
  * privded in the constructor to redact values, or a basic redactor which returns 'REDACTED' if no redactor
@@ -6,23 +6,28 @@ import { PrimitiveRedactorConfig } from './types';
  */
 export declare class PrimitiveRedactor {
     private static DEFAULT_REDACTED_TEXT;
-    private ignoreBooleans;
-    private ignoreNullOrUndefined;
-    private redactor;
+    private readonly ignoreBooleans;
+    private readonly ignoreNullOrUndefined;
+    private readonly useAsyncRedactor;
+    private readonly syncRedactor;
+    private readonly asyncRedactor?;
     /**
      * Creates a PrimitiveRedactor with the specified configuration.
      * @param config The PrimitiveRedactor configuration which specifies the redactor to use, whether to
      * ignore booleans, and whether to ignore null or undefined values.
      */
     constructor(config: PrimitiveRedactorConfig);
+    usesAsyncRedactor(): boolean;
     /**
      * Redacts the primitive value based on the configuration provided in the constructor.
      * @param value The value to redact.
      * @returns The redacted value.
      */
-    redactValue(value: any): Promise<any>;
-    private redactNullOrUndefinedValue;
-    private redactBoolean;
-    private redactAny;
+    redactValue(value: RedactablePrimitive): Promise<RedactedPrimitive>;
+    /**
+     * Synchronously redacts a primitive value without Promise allocation.
+     */
+    redactValueSync(value: RedactablePrimitive): RedactedPrimitive;
+    private redactWith;
 }
 //# sourceMappingURL=primitiveRedactor.d.ts.map

package/dist/primitiveRedactor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"primitiveRedactor.d.ts","sourceRoot":"","sources":["../src/primitiveRedactor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAY,MAAM,SAAS,CAAC;AAE5D;;;;GAIG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAc;IAClD,OAAO,CAAC,cAAc,CAAU;IAChC,OAAO,CAAC,qBAAqB,CAAU;IACvC,OAAO,CAAC,QAAQ,CAAoF;IAEpG;;;;OAIG;gBACS,MAAM,EAAE,uBAAuB;IAQ3C;;;;OAIG;IACU,WAAW,CAAC,KAAK,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;YAUpC,0BAA0B;YAQ1B,aAAa;YAIb,SAAS;CAGxB"}
+{"version":3,"file":"primitiveRedactor.d.ts","sourceRoot":"","sources":["../src/primitiveRedactor.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,iBAAiB,EAIlB,MAAM,SAAS,CAAC;AAEjB;;;;GAIG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAc;IAClD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAU;IACzC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAU;IAChD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAU;IAC3C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;IAC5C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAW;IAE1C;;;;OAIG;gBACS,MAAM,EAAE,uBAAuB;IAepC,iBAAiB,IAAI,OAAO;IAInC;;;;OAIG;IACU,WAAW,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAQhF;;OAEG;IACI,eAAe,CAAC,KAAK,EAAE,mBAAmB,GAAG,iBAAiB;IAIrE,OAAO,CAAC,UAAU;CAkBnB"}

package/dist/primitiveRedactor.js

@@ -22,12 +22,21 @@ class PrimitiveRedactor {
      * ignore booleans, and whether to ignore null or undefined values.
      */
     constructor(config) {
-        this.redactor = (val) => Promise.resolve(PrimitiveRedactor.DEFAULT_REDACTED_TEXT);
-        if (config.redactor) {
-            this.redactor = config.redactor;
-        }
+        var _a;
         this.ignoreBooleans = config.ignoreBooleans;
         this.ignoreNullOrUndefined = config.ignoreNullOrUndefined;
+        this.useAsyncRedactor = !!config.redactor && !config.syncRedactor;
+        this.syncRedactor = (_a = config.syncRedactor) !== null && _a !== void 0 ? _a : (config.redactor
+            ? () => {
+                throw new Error('Sync redaction is not available without syncRedactor configuration');
+            }
+            : () => PrimitiveRedactor.DEFAULT_REDACTED_TEXT);
+        if (config.redactor) {
+            this.asyncRedactor = config.redactor;
+        }
+    }
+    usesAsyncRedactor() {
+        return this.useAsyncRedactor;
     }
     /**
      * Redacts the primitive value based on the configuration provided in the constructor.
@@ -36,33 +45,29 @@ class PrimitiveRedactor {
      */
     redactValue(value) {
         return __awaiter(this, void 0, void 0, function* () {
-            if (typeof value === 'boolean') {
-                return this.redactBoolean(value);
-            }
-            else if (!value) {
-                return this.redactNullOrUndefinedValue(value);
-            }
-            return this.redactAny(value);
-        });
-    }
-    redactNullOrUndefinedValue(value) {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (this.ignoreNullOrUndefined) {
-                const result = yield Promise.resolve(value);
-                return result;
+            if (!this.useAsyncRedactor) {
+                return this.redactValueSync(value);
             }
-            return this.ignoreNullOrUndefined ? Promise.resolve(value) : this.redactor(value);
+            return this.redactWith(value, (input) => this.asyncRedactor(input));
         });
     }
-    redactBoolean(value) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return this.ignoreBooleans ? Promise.resolve(value) : this.redactor(value);
-        });
+    /**
+     * Synchronously redacts a primitive value without Promise allocation.
+     */
+    redactValueSync(value) {
+        return this.redactWith(value, (input) => this.syncRedactor(input));
     }
-    redactAny(value) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return this.redactor(value);
-        });
+    redactWith(value, apply) {
+        if (typeof value === 'boolean') {
+            return this.ignoreBooleans ? value : apply(value);
+        }
+        if (value === null || value === undefined) {
+            return this.ignoreNullOrUndefined ? value : apply(value);
+        }
+        if (value === '' || value === 0) {
+            return this.ignoreNullOrUndefined ? value : apply(value);
+        }
+        return apply(value);
     }
 }
 exports.PrimitiveRedactor = PrimitiveRedactor;

package/dist/primitiveRedactor.js.map

@@ -1 +1 @@
-{"version":3,"file":"primitiveRedactor.js","sourceRoot":"","sources":["../src/primitiveRedactor.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA;;;;GAIG;AACH,MAAa,iBAAiB;IAM5B;;;;OAIG;IACH,YAAY,MAA+B;QAPnC,aAAQ,GAAa,CAAC,GAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;QAQlG,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpB,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAClC,CAAC;QACD,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QAC5C,IAAI,CAAC,qBAAqB,GAAG,MAAM,CAAC,qBAAqB,CAAC;IAC5D,CAAC;IAED;;;;OAIG;IACU,WAAW,CAAC,KAAU;;YACjC,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC/B,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YACnC,CAAC;iBAAM,IAAI,CAAC,KAAK,EAAE,CAAC;gBAClB,OAAO,IAAI,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC;YAChD,CAAC;YAED,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;KAAA;IAEa,0BAA0B,CAAC,KAAuB;;YAC9D,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;gBAC/B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBAC5C,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACpF,CAAC;KAAA;IAEa,aAAa,CAAC,KAAc;;YACxC,OAAO,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC7E,CAAC;KAAA;IAEa,SAAS,CAAC,KAAU;;YAChC,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;KAAA;;AAhDH,8CAiDC;AAhDgB,uCAAqB,GAAG,UAAU,AAAb,CAAc"}
+{"version":3,"file":"primitiveRedactor.js","sourceRoot":"","sources":["../src/primitiveRedactor.ts"],"names":[],"mappings":";;;;;;;;;;;;AASA;;;;GAIG;AACH,MAAa,iBAAiB;IAQ5B;;;;OAIG;IACH,YAAY,MAA+B;;QACzC,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QAC5C,IAAI,CAAC,qBAAqB,GAAG,MAAM,CAAC,qBAAqB,CAAC;QAC1D,IAAI,CAAC,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;QAClE,IAAI,CAAC,YAAY,GAAG,MAAA,MAAM,CAAC,YAAY,mCAAI,CAAC,MAAM,CAAC,QAAQ;YACzD,CAAC,CAAC,GAAG,EAAE;gBACH,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;YACxF,CAAC;YACH,CAAC,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;QAEnD,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpB,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC;QACvC,CAAC;IACH,CAAC;IAEM,iBAAiB;QACtB,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAC/B,CAAC;IAED;;;;OAIG;IACU,WAAW,CAAC,KAA0B;;YACjD,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBAC3B,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YACrC,CAAC;YAED,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAc,CAAC,KAAK,CAAC,CAA+B,CAAC;QACrG,CAAC;KAAA;IAED;;OAEG;IACI,eAAe,CAAC,KAA0B;QAC/C,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAsB,CAAC;IAC1F,CAAC;IAEO,UAAU,CAChB,KAA0B,EAC1B,KAA+E;QAE/E,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpD,CAAC;QAED,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC1C,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3D,CAAC;QAED,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;;AArEH,8CAsEC;AArEgB,uCAAqB,GAAG,UAAU,CAAC"}

package/dist/redactionRules.d.ts

@@ -0,0 +1,23 @@
+import { CustomObject, FieldRedactorConfig } from './types';
+export declare const SECRET_REGEX_FIELDS: readonly ["secretKeys", "deepSecretKeys", "fullSecretKeys", "deleteSecretKeys"];
+export declare const VALUE_PATTERN_FIELDS: readonly ["valuePatterns"];
+export declare const REGEX_ARRAY_CONFIG_FIELDS: readonly ["secretKeys", "deepSecretKeys", "fullSecretKeys", "deleteSecretKeys", "valuePatterns"];
+export type SecretRegexField = (typeof SECRET_REGEX_FIELDS)[number];
+export type ValuePatternField = (typeof VALUE_PATTERN_FIELDS)[number];
+export type RegexArrayConfigField = (typeof REGEX_ARRAY_CONFIG_FIELDS)[number];
+export declare const RULE_LIST_FIELDS: readonly ["secretKeys", "deepSecretKeys", "fullSecretKeys", "deleteSecretKeys", "valuePatterns", "customObjects"];
+export declare const hasExplicitRedactionRules: (config?: FieldRedactorConfig) => boolean;
+/**
+ * When only value patterns are configured, shallow key matching must be disabled (`secretKeys: []`)
+ * so the legacy default does not redact every field.
+ */
+export declare const resolveSecretKeys: (config?: FieldRedactorConfig) => RegExp[] | undefined;
+export declare const appendRegExpArray: <F extends RegexArrayConfigField>(config: FieldRedactorConfig, field: F, patterns: RegExp[]) => void;
+export declare const appendRegexToConfig: (config: FieldRedactorConfig, field: SecretRegexField, patterns: RegExp[]) => void;
+export type RegisteredSchema = {
+    object: CustomObject;
+    name?: string;
+};
+export declare const finalizeRegisteredSchemas: (schemas: RegisteredSchema[]) => Pick<FieldRedactorConfig, "customObjects" | "schemaNames">;
+export declare const mergePartialConfig: (target: FieldRedactorConfig, schemas: RegisteredSchema[], partial: Partial<FieldRedactorConfig>) => void;
+//# sourceMappingURL=redactionRules.d.ts.map

package/dist/redactionRules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redactionRules.d.ts","sourceRoot":"","sources":["../src/redactionRules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAE5D,eAAO,MAAM,mBAAmB,iFAAkF,CAAC;AAEnH,eAAO,MAAM,oBAAoB,4BAA6B,CAAC;AAE/D,eAAO,MAAM,yBAAyB,kGAA6D,CAAC;AAEpG,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpE,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEtE,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/E,eAAO,MAAM,gBAAgB,mHAA2D,CAAC;AAIzF,eAAO,MAAM,yBAAyB,YAAa,mBAAmB,KAAG,OACqB,CAAC;AAE/F;;;GAGG;AACH,eAAO,MAAM,iBAAiB,YAAa,mBAAmB,KAAG,MAAM,EAAE,GAAG,SAkB3E,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAI,CAAC,SAAS,qBAAqB,UACvD,mBAAmB,SACpB,CAAC,YACE,MAAM,EAAE,KACjB,IAEF,CAAC;AAEF,eAAO,MAAM,mBAAmB,WACtB,mBAAmB,SACpB,gBAAgB,YACb,MAAM,EAAE,KACjB,IAEF,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvE,eAAO,MAAM,yBAAyB,YAC3B,gBAAgB,EAAE,KAC1B,IAAI,CAAC,mBAAmB,EAAE,eAAe,GAAG,aAAa,CAS3D,CAAC;AAqBF,eAAO,MAAM,kBAAkB,WACrB,mBAAmB,WAClB,gBAAgB,EAAE,WAClB,OAAO,CAAC,mBAAmB,CAAC,KACpC,IASF,CAAC"}

package/dist/redactionRules.js

@@ -0,0 +1,76 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mergePartialConfig = exports.finalizeRegisteredSchemas = exports.appendRegexToConfig = exports.appendRegExpArray = exports.resolveSecretKeys = exports.hasExplicitRedactionRules = exports.RULE_LIST_FIELDS = exports.REGEX_ARRAY_CONFIG_FIELDS = exports.VALUE_PATTERN_FIELDS = exports.SECRET_REGEX_FIELDS = void 0;
+exports.SECRET_REGEX_FIELDS = ['secretKeys', 'deepSecretKeys', 'fullSecretKeys', 'deleteSecretKeys'];
+exports.VALUE_PATTERN_FIELDS = ['valuePatterns'];
+exports.REGEX_ARRAY_CONFIG_FIELDS = [...exports.SECRET_REGEX_FIELDS, ...exports.VALUE_PATTERN_FIELDS];
+exports.RULE_LIST_FIELDS = [...exports.REGEX_ARRAY_CONFIG_FIELDS, 'customObjects'];
+const hasNonEmptyArray = (value) => value !== undefined && value.length > 0;
+const hasExplicitRedactionRules = (config) => exports.RULE_LIST_FIELDS.some((field) => hasNonEmptyArray(config === null || config === void 0 ? void 0 : config[field]));
+exports.hasExplicitRedactionRules = hasExplicitRedactionRules;
+/**
+ * When only value patterns are configured, shallow key matching must be disabled (`secretKeys: []`)
+ * so the legacy default does not redact every field.
+ */
+const resolveSecretKeys = (config) => {
+    const { secretKeys, deepSecretKeys, fullSecretKeys, deleteSecretKeys, customObjects, valuePatterns } = config !== null && config !== void 0 ? config : {};
+    if (secretKeys !== undefined) {
+        return secretKeys;
+    }
+    if ((valuePatterns === null || valuePatterns === void 0 ? void 0 : valuePatterns.length) &&
+        !(deepSecretKeys === null || deepSecretKeys === void 0 ? void 0 : deepSecretKeys.length) &&
+        !(fullSecretKeys === null || fullSecretKeys === void 0 ? void 0 : fullSecretKeys.length) &&
+        !(deleteSecretKeys === null || deleteSecretKeys === void 0 ? void 0 : deleteSecretKeys.length) &&
+        !(customObjects === null || customObjects === void 0 ? void 0 : customObjects.length)) {
+        return [];
+    }
+    return undefined;
+};
+exports.resolveSecretKeys = resolveSecretKeys;
+const appendRegExpArray = (config, field, patterns) => {
+    var _a;
+    config[field] = [...((_a = config[field]) !== null && _a !== void 0 ? _a : []), ...patterns];
+};
+exports.appendRegExpArray = appendRegExpArray;
+const appendRegexToConfig = (config, field, patterns) => {
+    (0, exports.appendRegExpArray)(config, field, patterns);
+};
+exports.appendRegexToConfig = appendRegexToConfig;
+const finalizeRegisteredSchemas = (schemas) => {
+    if (schemas.length === 0) {
+        return {};
+    }
+    const customObjects = schemas.map((entry) => entry.object);
+    const schemaNames = schemas.map((entry) => entry.name);
+    return schemaNames.some((name) => name !== undefined) ? { customObjects, schemaNames } : { customObjects };
+};
+exports.finalizeRegisteredSchemas = finalizeRegisteredSchemas;
+const PRESET_SCALAR_FIELDS = [
+    'redactor',
+    'syncRedactor',
+    'ignoreBooleans',
+    'ignoreNullOrUndefined',
+    'cloneInput',
+    'strict',
+    'onConfigWarning'
+];
+const applyUnsetScalars = (target, partial) => {
+    for (const field of PRESET_SCALAR_FIELDS) {
+        const value = partial[field];
+        if (value !== undefined && target[field] === undefined) {
+            Object.assign(target, { [field]: value });
+        }
+    }
+};
+const mergePartialConfig = (target, schemas, partial) => {
+    var _a, _b;
+    for (const field of exports.REGEX_ARRAY_CONFIG_FIELDS) {
+        if ((_a = partial[field]) === null || _a === void 0 ? void 0 : _a.length) {
+            (0, exports.appendRegExpArray)(target, field, partial[field]);
+        }
+    }
+    (_b = partial.customObjects) === null || _b === void 0 ? void 0 : _b.forEach((object) => schemas.push({ object }));
+    applyUnsetScalars(target, partial);
+};
+exports.mergePartialConfig = mergePartialConfig;
+//# sourceMappingURL=redactionRules.js.map

package/dist/redactionRules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redactionRules.js","sourceRoot":"","sources":["../src/redactionRules.ts"],"names":[],"mappings":";;;AAEa,QAAA,mBAAmB,GAAG,CAAC,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,kBAAkB,CAAU,CAAC;AAEtG,QAAA,oBAAoB,GAAG,CAAC,eAAe,CAAU,CAAC;AAElD,QAAA,yBAAyB,GAAG,CAAC,GAAG,2BAAmB,EAAE,GAAG,4BAAoB,CAAU,CAAC;AAQvF,QAAA,gBAAgB,GAAG,CAAC,GAAG,iCAAyB,EAAE,eAAe,CAAU,CAAC;AAEzF,MAAM,gBAAgB,GAAG,CAAI,KAAsB,EAAgB,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AAEvG,MAAM,yBAAyB,GAAG,CAAC,MAA4B,EAAW,EAAE,CACjF,wBAAgB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAG,KAAK,CAA0B,CAAC,CAAC,CAAC;AADlF,QAAA,yBAAyB,6BACyD;AAE/F;;;GAGG;AACI,MAAM,iBAAiB,GAAG,CAAC,MAA4B,EAAwB,EAAE;IACtF,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,GAAG,MAAM,aAAN,MAAM,cAAN,MAAM,GAAI,EAAE,CAAC;IAEpH,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,IACE,CAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,MAAM;QACrB,CAAC,CAAA,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,MAAM,CAAA;QACvB,CAAC,CAAA,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,MAAM,CAAA;QACvB,CAAC,CAAA,gBAAgB,aAAhB,gBAAgB,uBAAhB,gBAAgB,CAAE,MAAM,CAAA;QACzB,CAAC,CAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,MAAM,CAAA,EACtB,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAlBW,QAAA,iBAAiB,qBAkB5B;AAEK,MAAM,iBAAiB,GAAG,CAC/B,MAA2B,EAC3B,KAAQ,EACR,QAAkB,EACZ,EAAE;;IACR,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,MAAA,MAAM,CAAC,KAAK,CAAC,mCAAI,EAAE,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC;AAC1D,CAAC,CAAC;AANW,QAAA,iBAAiB,qBAM5B;AAEK,MAAM,mBAAmB,GAAG,CACjC,MAA2B,EAC3B,KAAuB,EACvB,QAAkB,EACZ,EAAE;IACR,IAAA,yBAAiB,EAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;AAC7C,CAAC,CAAC;AANW,QAAA,mBAAmB,uBAM9B;AAIK,MAAM,yBAAyB,GAAG,CACvC,OAA2B,EACiC,EAAE;IAC9D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3D,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAEvD,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC;AAC7G,CAAC,CAAC;AAXW,QAAA,yBAAyB,6BAWpC;AAEF,MAAM,oBAAoB,GAAG;IAC3B,UAAU;IACV,cAAc;IACd,gBAAgB;IAChB,uBAAuB;IACvB,YAAY;IACZ,QAAQ;IACR,iBAAiB;CAC0C,CAAC;AAE9D,MAAM,iBAAiB,GAAG,CAAC,MAA2B,EAAE,OAAqC,EAAQ,EAAE;IACrG,KAAK,MAAM,KAAK,IAAI,oBAAoB,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,SAAS,EAAE,CAAC;YACvD,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;AACH,CAAC,CAAC;AAEK,MAAM,kBAAkB,GAAG,CAChC,MAA2B,EAC3B,OAA2B,EAC3B,OAAqC,EAC/B,EAAE;;IACR,KAAK,MAAM,KAAK,IAAI,iCAAyB,EAAE,CAAC;QAC9C,IAAI,MAAA,OAAO,CAAC,KAAK,CAAC,0CAAE,MAAM,EAAE,CAAC;YAC3B,IAAA,yBAAiB,EAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,MAAA,OAAO,CAAC,aAAa,0CAAE,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACrE,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACrC,CAAC,CAAC;AAbW,QAAA,kBAAkB,sBAa7B"}

package/dist/regexUtils.d.ts

@@ -0,0 +1,3 @@
+export declare const formatRegExp: (regex: RegExp) => string;
+export declare const regexIdentity: (regex: RegExp) => string;
+//# sourceMappingURL=regexUtils.d.ts.map

package/dist/regexUtils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"regexUtils.d.ts","sourceRoot":"","sources":["../src/regexUtils.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,YAAY,UAAW,MAAM,KAAG,MAA2C,CAAC;AAEzF,eAAO,MAAM,aAAa,UAAW,MAAM,KAAG,MAA2C,CAAC"}

package/dist/regexUtils.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.regexIdentity = exports.formatRegExp = void 0;
+const formatRegExp = (regex) => `/${regex.source}/${regex.flags}`;
+exports.formatRegExp = formatRegExp;
+const regexIdentity = (regex) => `${regex.source}\0${regex.flags}`;
+exports.regexIdentity = regexIdentity;
+//# sourceMappingURL=regexUtils.js.map

package/dist/regexUtils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"regexUtils.js","sourceRoot":"","sources":["../src/regexUtils.ts"],"names":[],"mappings":";;;AAAO,MAAM,YAAY,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;AAA5E,QAAA,YAAY,gBAAgE;AAElF,MAAM,aAAa,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;AAA7E,QAAA,aAAa,iBAAgE"}

package/dist/secretManager.d.ts

@@ -1,4 +1,5 @@
-import { SecretManagerConfig } from './types';
+import { SecretManagerConfig, SecretSpecifierValue } from './types';
+type KeyRule = 'remove' | 'opaque' | 'deep' | 'shallow';
 /**
  * Utility class for managing secrets and determining if a  given value is a secret of any type. If no secrets of
  * any type are provided in the configuration then all values are considered secrets (but not deep or full secrets).
@@ -15,25 +16,30 @@ export declare class SecretManager {
      * @param key The key to check.
      * @returns True if the key is a secret key or no secret keys exist, otherwise false.
      */
-    isSecretKey(key: string): boolean;
+    isSecretKey(key: SecretSpecifierValue): boolean;
     /**
      * Determines if a key is a deep secret based on the deepSecretKeys configuration provided in the constructor.
      * @param key The key to check.
      * @returns True if the key is a deep secret key, otherwise false.
      */
-    isDeepSecretKey(key: string): boolean;
+    isDeepSecretKey(key: SecretSpecifierValue): boolean;
     /**
      * Determines if a key is a full secret based on the fullSecretKeys configuration provided in the constructor.
      * @param key The key to check.
      * @returns True if the key is a full secret key, otherwise false.
      */
-    isFullSecretKey(key: string): boolean;
+    isFullSecretKey(key: SecretSpecifierValue): boolean;
     /**
      * Determines if a key is a delete secret based on the deleteSecretKeys configuration provided in the constructor.
      * @param key The key to check.
      * @returns True if the key is a delete secret key, otherwise false.
      */
-    isDeleteSecretKey(key: string): boolean;
-    private static valueMatchesAnyRegexValue;
+    isDeleteSecretKey(key: SecretSpecifierValue): boolean;
+    getKeyRulePattern(key: SecretSpecifierValue, rule: KeyRule): string | undefined;
+    classifyKeyRule(key: SecretSpecifierValue): 'remove' | 'opaque' | 'deep' | 'shallow' | 'default' | null;
+    private regexListFor;
+    private static findMatchingRegex;
+    private static matchesAnyRegex;
 }
+export {};
 //# sourceMappingURL=secretManager.d.ts.map

package/dist/secretManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secretManager.d.ts","sourceRoot":"","sources":["../src/secretManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAE9C;;;GAGG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,UAAU,CAAC,CAAW;IAC9B,OAAO,CAAC,cAAc,CAAC,CAAW;IAClC,OAAO,CAAC,cAAc,CAAC,CAAW;IAClC,OAAO,CAAC,gBAAgB,CAAC,CAAW;gBAExB,MAAM,EAAE,mBAAmB;IAYvC;;;;;OAKG;IACI,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAQxC;;;;OAIG;IACI,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAQ5C;;;;OAIG;IACI,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAQ5C;;;;OAIG;IACI,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAQ9C,OAAO,CAAC,MAAM,CAAC,yBAAyB;CAGzC"}
+{"version":3,"file":"secretManager.d.ts","sourceRoot":"","sources":["../src/secretManager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AAEpE,KAAK,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAC;AAExD;;;GAGG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,UAAU,CAAC,CAAW;IAC9B,OAAO,CAAC,cAAc,CAAC,CAAW;IAClC,OAAO,CAAC,cAAc,CAAC,CAAW;IAClC,OAAO,CAAC,gBAAgB,CAAC,CAAW;gBAExB,MAAM,EAAE,mBAAmB;IAYvC;;;;;OAKG;IACI,WAAW,CAAC,GAAG,EAAE,oBAAoB,GAAG,OAAO;IAQtD;;;;OAIG;IACI,eAAe,CAAC,GAAG,EAAE,oBAAoB,GAAG,OAAO;IAI1D;;;;OAIG;IACI,eAAe,CAAC,GAAG,EAAE,oBAAoB,GAAG,OAAO;IAI1D;;;;OAIG;IACI,iBAAiB,CAAC,GAAG,EAAE,oBAAoB,GAAG,OAAO;IAIrD,iBAAiB,CAAC,GAAG,EAAE,oBAAoB,EAAE,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS;IAK/E,eAAe,CAAC,GAAG,EAAE,oBAAoB,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,IAAI;IAoB9G,OAAO,CAAC,YAAY;IAapB,OAAO,CAAC,MAAM,CAAC,iBAAiB;IAIhC,OAAO,CAAC,MAAM,CAAC,eAAe;CAG/B"}

package/dist/secretManager.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SecretManager = void 0;
+const regexUtils_1 = require("./regexUtils");
 /**
  * Utility class for managing secrets and determining if a  given value is a secret of any type. If no secrets of
  * any type are provided in the configuration then all values are considered secrets (but not deep or full secrets).
@@ -27,7 +28,7 @@ class SecretManager {
         if (!this.secretKeys) {
             return true;
         }
-        return SecretManager.valueMatchesAnyRegexValue(key, this.secretKeys);
+        return SecretManager.matchesAnyRegex(key, this.secretKeys);
     }
     /**
      * Determines if a key is a deep secret based on the deepSecretKeys configuration provided in the constructor.
@@ -35,10 +36,7 @@ class SecretManager {
      * @returns True if the key is a deep secret key, otherwise false.
      */
     isDeepSecretKey(key) {
-        if (!this.deepSecretKeys) {
-            return false;
-        }
-        return SecretManager.valueMatchesAnyRegexValue(key, this.deepSecretKeys);
+        return !!this.deepSecretKeys && SecretManager.matchesAnyRegex(key, this.deepSecretKeys);
     }
     /**
      * Determines if a key is a full secret based on the fullSecretKeys configuration provided in the constructor.
@@ -46,10 +44,7 @@ class SecretManager {
      * @returns True if the key is a full secret key, otherwise false.
      */
     isFullSecretKey(key) {
-        if (!this.fullSecretKeys) {
-            return false;
-        }
-        return SecretManager.valueMatchesAnyRegexValue(key, this.fullSecretKeys);
+        return !!this.fullSecretKeys && SecretManager.matchesAnyRegex(key, this.fullSecretKeys);
     }
     /**
      * Determines if a key is a delete secret based on the deleteSecretKeys configuration provided in the constructor.
@@ -57,13 +52,44 @@ class SecretManager {
      * @returns True if the key is a delete secret key, otherwise false.
      */
     isDeleteSecretKey(key) {
-        if (!this.deleteSecretKeys) {
-            return false;
+        return !!this.deleteSecretKeys && SecretManager.matchesAnyRegex(key, this.deleteSecretKeys);
+    }
+    getKeyRulePattern(key, rule) {
+        const match = SecretManager.findMatchingRegex(key, this.regexListFor(rule));
+        return match ? (0, regexUtils_1.formatRegExp)(match) : undefined;
+    }
+    classifyKeyRule(key) {
+        if (this.isDeleteSecretKey(key)) {
+            return 'remove';
+        }
+        if (this.isFullSecretKey(key)) {
+            return 'opaque';
         }
-        return SecretManager.valueMatchesAnyRegexValue(key, this.deleteSecretKeys);
+        if (this.isDeepSecretKey(key)) {
+            return 'deep';
+        }
+        if (this.isSecretKey(key)) {
+            return this.secretKeys ? 'shallow' : 'default';
+        }
+        return null;
+    }
+    regexListFor(rule) {
+        switch (rule) {
+            case 'remove':
+                return this.deleteSecretKeys;
+            case 'opaque':
+                return this.fullSecretKeys;
+            case 'deep':
+                return this.deepSecretKeys;
+            case 'shallow':
+                return this.secretKeys;
+        }
+    }
+    static findMatchingRegex(key, regexes) {
+        return regexes === null || regexes === void 0 ? void 0 : regexes.find((regex) => regex.test(String(key)));
     }
-    static valueMatchesAnyRegexValue(value, regexes) {
-        return regexes.some((regex) => regex.test(value));
+    static matchesAnyRegex(value, regexes) {
+        return regexes.some((regex) => regex.test(String(value)));
     }
 }
 exports.SecretManager = SecretManager;

package/dist/secretManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"secretManager.js","sourceRoot":"","sources":["../src/secretManager.ts"],"names":[],"mappings":";;;AAEA;;;GAGG;AACH,MAAa,aAAa;IAMxB,YAAY,MAA2B;QACrC,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QAC5C,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QAC5C,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,CAAC;QAEhD,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACtG,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QACtC,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACI,WAAW,CAAC,GAAW;QAC5B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,aAAa,CAAC,yBAAyB,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACvE,CAAC;IAED;;;;OAIG;IACI,eAAe,CAAC,GAAW;QAChC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,aAAa,CAAC,yBAAyB,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;IAC3E,CAAC;IAED;;;;OAIG;IACI,eAAe,CAAC,GAAW;QAChC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,aAAa,CAAC,yBAAyB,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;IAC3E,CAAC;IAED;;;;OAIG;IACI,iBAAiB,CAAC,GAAW;QAClC,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,aAAa,CAAC,yBAAyB,CAAC,GAAG,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC7E,CAAC;IAEO,MAAM,CAAC,yBAAyB,CAAC,KAAa,EAAE,OAAiB;QACvE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACpD,CAAC;CACF;AA1ED,sCA0EC"}
+{"version":3,"file":"secretManager.js","sourceRoot":"","sources":["../src/secretManager.ts"],"names":[],"mappings":";;;AAAA,6CAA4C;AAK5C;;;GAGG;AACH,MAAa,aAAa;IAMxB,YAAY,MAA2B;QACrC,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QAC5C,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QAC5C,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,CAAC;QAEhD,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACtG,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QACtC,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACI,WAAW,CAAC,GAAyB;QAC1C,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,aAAa,CAAC,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7D,CAAC;IAED;;;;OAIG;IACI,eAAe,CAAC,GAAyB;QAC9C,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,IAAI,aAAa,CAAC,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;IAC1F,CAAC;IAED;;;;OAIG;IACI,eAAe,CAAC,GAAyB;QAC9C,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,IAAI,aAAa,CAAC,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;IAC1F,CAAC;IAED;;;;OAIG;IACI,iBAAiB,CAAC,GAAyB;QAChD,OAAO,CAAC,CAAC,IAAI,CAAC,gBAAgB,IAAI,aAAa,CAAC,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC9F,CAAC;IAEM,iBAAiB,CAAC,GAAyB,EAAE,IAAa;QAC/D,MAAM,KAAK,GAAG,aAAa,CAAC,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5E,OAAO,KAAK,CAAC,CAAC,CAAC,IAAA,yBAAY,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjD,CAAC;IAEM,eAAe,CAAC,GAAyB;QAC9C,IAAI,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QACjD,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,YAAY,CAAC,IAAa;QAChC,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,QAAQ;gBACX,OAAO,IAAI,CAAC,gBAAgB,CAAC;YAC/B,KAAK,QAAQ;gBACX,OAAO,IAAI,CAAC,cAAc,CAAC;YAC7B,KAAK,MAAM;gBACT,OAAO,IAAI,CAAC,cAAc,CAAC;YAC7B,KAAK,SAAS;gBACZ,OAAO,IAAI,CAAC,UAAU,CAAC;QAC3B,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,iBAAiB,CAAC,GAAyB,EAAE,OAAkB;QAC5E,OAAO,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC;IAEO,MAAM,CAAC,eAAe,CAAC,KAA2B,EAAE,OAAiB;QAC3E,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC;CACF;AAxGD,sCAwGC"}

package/dist/types.d.ts

@@ -1,4 +1,40 @@
-export type Redactor = (value: any) => Promise<string>;
+/** JSON-compatible primitive. */
+export type JsonPrimitive = string | number | boolean | null;
+/** Function values encountered during traversal are left unchanged. */
+export type JsonFunction = (...args: never[]) => unknown;
+/** Scalar values that may appear in JSON-like structures during redaction. */
+export type JsonLeafValue = JsonPrimitive | Date | JsonFunction;
+/** JSON-compatible object. */
+export type JsonObject = {
+    [key: string]: JsonValue | undefined;
+};
+/** JSON-compatible array. */
+export type JsonArray = Array<JsonValue | undefined>;
+/** JSON-compatible value. */
+export type JsonValue = JsonLeafValue | JsonObject | JsonArray;
+/**
+ * Values accepted by {@link FieldRedactor.redact} and {@link FieldRedactor.redactInPlace}.
+ * Root-level primitives, `Date`, and functions are returned unchanged without traversal.
+ */
+export type RedactableInput = JsonValue | undefined;
+/** Primitive values that may be passed to a custom {@link Redactor} function. */
+export type RedactorInput = JsonPrimitive | undefined;
+/** Primitive values processed by {@link PrimitiveRedactor}. */
+export type RedactablePrimitive = RedactorInput;
+/** Result of redacting a primitive value. */
+export type RedactedPrimitive = string | boolean | null | undefined | 0;
+/**
+ * Sibling field value used to resolve secret specifiers in custom object schemas
+ * (for example, the string `"email"` in a `{ name, value }` metadata entry).
+ */
+export type SecretSpecifierValue = string | number | boolean;
+export type Redactor = (value: RedactorInput) => Promise<string>;
+/** Synchronous redactor for use with {@link FieldRedactor.redactSync} without Promise overhead. */
+export type SyncRedactor = (value: RedactorInput) => string;
+/**
+ * Per-field redaction mode inside a {@link CustomObject} schema.
+ * Values align with the top-level doc labels: Shallow, Deep, Opaque (Full), Remove (Delete).
+ */
 export declare enum CustomObjectMatchType {
     Delete = 0,
     Full = 1,
@@ -8,21 +44,86 @@ export declare enum CustomObjectMatchType {
     Ignore = 5
 }
 export type CustomObject = {
+    /**
+     * Object schema for **Schema** (`customObjects`) mode.
+     * Keys define required fields for matching; input objects may contain additional keys.
+     */
     [key: string]: CustomObjectMatchType | string;
 };
 export type PrimitiveRedactorConfig = {
     redactor?: Redactor;
+    syncRedactor?: SyncRedactor;
     ignoreBooleans: boolean;
     ignoreNullOrUndefined: boolean;
 };
 export type SecretManagerConfig = {
+    /** Shallow — redact matching keys' scalar values only (`secretKeys`). */
     secretKeys?: RegExp[];
+    /** Deep — redact matching keys and all descendant primitives (`deepSecretKeys`). */
     deepSecretKeys?: RegExp[];
+    /** Opaque — stringify entire value at matching keys, then redact (`fullSecretKeys`). */
     fullSecretKeys?: RegExp[];
+    /** Remove — delete matching keys from output (`deleteSecretKeys`). */
     deleteSecretKeys?: RegExp[];
 };
-export type FieldRedactorConfig = Partial<PrimitiveRedactorConfig> & SecretManagerConfig & {
+export type ValuePatternConfig = {
+    /**
+     * Opt-in value-pattern redaction: redact scalar fields whose **string form** matches a pattern,
+     * regardless of key name. Lowest precedence — runs only when key-based rules leave the value unchanged.
+     */
+    valuePatterns?: RegExp[];
+};
+export type FieldRedactorConfig = Partial<PrimitiveRedactorConfig> & SecretManagerConfig & ValuePatternConfig & {
     redactor?: Redactor;
+    syncRedactor?: SyncRedactor;
+    /** Schema rules for shaped objects (`customObjects`). */
     customObjects?: CustomObject[];
+    /**
+     * When true (default), `redact()` and `redactSync()` leave the input untouched using copy-on-write
+     * structural sharing. When false, those methods mutate the input in place (equivalent to `redactInPlace`).
+     */
+    cloneInput?: boolean;
+    /**
+     * When true, configuration warnings throw {@link FieldRedactorConfigurationError} at construction time.
+     * When false (default), warnings are exposed via {@link FieldRedactor.configWarnings} and `onConfigWarning`.
+     */
+    strict?: boolean;
+    /** Called for each non-fatal configuration warning when `strict` is false. */
+    onConfigWarning?: (message: string) => void;
+    /**
+     * Optional labels parallel to `customObjects` (same index). Used in {@link FieldRedactor.dryRun} reports.
+     * Set via {@link FieldRedactorConfigBuilder.schema}.
+     */
+    schemaNames?: (string | undefined)[];
+};
+export type MatchedSchemaReport = {
+    path: string;
+    schemaIndex: number;
+    schemaName?: string;
+};
+export type RedactionRuleLabel = 'schema' | 'opaque' | 'deep' | 'remove' | 'shallow' | 'value' | 'default';
+export type DryRunPathRule = {
+    path: string;
+    action: 'redact' | 'delete';
+    rule: RedactionRuleLabel;
+    pattern?: string;
+    schemaIndex?: number;
+    schemaName?: string;
+};
+export type DryRunReport = {
+    redactedPaths: string[];
+    deletedPaths: string[];
+    matchedSchemas: MatchedSchemaReport[];
+    /** Per-path rule attribution for redacted and deleted paths. */
+    pathRules: DryRunPathRule[];
+};
+export type DryRunResult<T> = {
+    result: T;
+    report: DryRunReport;
 };
+/** JSON object or array traversed during in-place redaction. */
+export type TraversableJson = JsonObject | JsonArray;
+/** Mutable key/value map used while traversing JSON object or array keys in place. */
+export type JsonRecord = Record<string, JsonValue | undefined>;
+export declare const isJsonObject: (value: JsonValue | undefined) => value is JsonObject;
 //# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,QAAQ,GAAG,CAAC,KAAK,EAAE,GAAG,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAEvD,oBAAY,qBAAqB;IAC/B,MAAM,IAAA;IACN,IAAI,IAAA;IACJ,IAAI,IAAA;IACJ,OAAO,IAAA;IACP,IAAI,IAAA;IACJ,MAAM,IAAA;CACP;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,CAAC,GAAG,EAAE,MAAM,GAAG,qBAAqB,GAAG,MAAM,CAAC;CAC/C,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,cAAc,EAAE,OAAO,CAAC;IACxB,qBAAqB,EAAE,OAAO,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG,OAAO,CAAC,uBAAuB,CAAC,GAChE,mBAAmB,GAAG;IACpB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,aAAa,CAAC,EAAE,YAAY,EAAE,CAAC;CAChC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,iCAAiC;AACjC,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;AAE7D,uEAAuE;AACvE,MAAM,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,OAAO,CAAC;AAEzD,8EAA8E;AAC9E,MAAM,MAAM,aAAa,GAAG,aAAa,GAAG,IAAI,GAAG,YAAY,CAAC;AAEhE,8BAA8B;AAC9B,MAAM,MAAM,UAAU,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAAA;CAAE,CAAC;AAElE,6BAA6B;AAC7B,MAAM,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;AAErD,6BAA6B;AAC7B,MAAM,MAAM,SAAS,GAAG,aAAa,GAAG,UAAU,GAAG,SAAS,CAAC;AAE/D;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,SAAS,CAAC;AAEpD,iFAAiF;AACjF,MAAM,MAAM,aAAa,GAAG,aAAa,GAAG,SAAS,CAAC;AAEtD,+DAA+D;AAC/D,MAAM,MAAM,mBAAmB,GAAG,aAAa,CAAC;AAEhD,6CAA6C;AAC7C,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,GAAG,CAAC,CAAC;AAExE;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAE7D,MAAM,MAAM,QAAQ,GAAG,CAAC,KAAK,EAAE,aAAa,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAEjE,mGAAmG;AACnG,MAAM,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,aAAa,KAAK,MAAM,CAAC;AAE5D;;;GAGG;AACH,oBAAY,qBAAqB;IAC/B,MAAM,IAAA;IACN,IAAI,IAAA;IACJ,IAAI,IAAA;IACJ,OAAO,IAAA;IACP,IAAI,IAAA;IACJ,MAAM,IAAA;CACP;AAED,MAAM,MAAM,YAAY,GAAG;IACzB;;;OAGG;IACH,CAAC,GAAG,EAAE,MAAM,GAAG,qBAAqB,GAAG,MAAM,CAAC;CAC/C,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,cAAc,EAAE,OAAO,CAAC;IACxB,qBAAqB,EAAE,OAAO,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,yEAAyE;IACzE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,oFAAoF;IACpF,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,wFAAwF;IACxF,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,sEAAsE;IACtE,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG,OAAO,CAAC,uBAAuB,CAAC,GAChE,mBAAmB,GACnB,kBAAkB,GAAG;IACnB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,yDAAyD;IACzD,aAAa,CAAC,EAAE,YAAY,EAAE,CAAC;IAC/B;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,8EAA8E;IAC9E,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5C;;;OAGG;IACH,WAAW,CAAC,EAAE,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC;CACtC,CAAC;AAEJ,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;AAE3G,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC5B,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,cAAc,EAAE,mBAAmB,EAAE,CAAC;IACtC,gEAAgE;IAChE,SAAS,EAAE,cAAc,EAAE,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,YAAY,CAAC,CAAC,IAAI;IAC5B,MAAM,EAAE,CAAC,CAAC;IACV,MAAM,EAAE,YAAY,CAAC;CACtB,CAAC;AAEF,gEAAgE;AAChE,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,SAAS,CAAC;AAErD,sFAAsF;AACtF,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAAC,CAAC;AAE/D,eAAO,MAAM,YAAY,UAAW,SAAS,GAAG,SAAS,KAAG,KAAK,IAAI,UACsB,CAAC"}