field-redactor 1.2.0 → 1.6.0

package/dist/rules/ruleResolver.d.ts

@@ -0,0 +1,65 @@
+import { CustomObjectManager } from './customObjectManager';
+import { PathRuleMatcher } from './pathRuleMatcher';
+import { SecretManager } from './secretManager';
+import { ValuePatternMatcher } from './valuePatternMatcher';
+import { CustomObject, DryRunPathRule, JsonValue, PathRule, SecretSpecifierValue } from '../types';
+export type KeyRule = 'remove' | 'opaque' | 'deep' | 'shallow';
+export type KeyRuleLabel = KeyRule | 'default';
+export type FieldDisposition = {
+    action: 'default';
+} | {
+    action: 'skip';
+} | {
+    action: 'remove';
+} | {
+    action: 'opaque';
+} | {
+    action: 'deep';
+} | {
+    action: 'shallow';
+} | {
+    action: 'pass-key-recurse';
+};
+type AttributionContext = {
+    before: JsonValue | undefined;
+    path: string;
+    segments: Array<string | number>;
+    objectKeys: string[];
+};
+/** Shared path-rule + pass-key disposition used during traversal. */
+export declare const resolvePathDisposition: (secretManager: SecretManager, pathRuleMatcher: PathRuleMatcher, key: string, pathSegments: Array<string | number>, forceDeepRedaction: boolean) => FieldDisposition;
+/**
+ * Single source of truth for field-level rule precedence shared by traversal and dry-run attribution.
+ * Precedence: schema → path rule → enclosing opaque/deep key → leaf key rule → value pattern → default.
+ */
+export declare class RuleResolver {
+    private readonly secretManager;
+    private readonly pathRuleMatcher;
+    private readonly valuePatternMatcher;
+    private readonly customObjectManager;
+    constructor(secretManager: SecretManager, pathRuleMatcher: PathRuleMatcher, valuePatternMatcher: ValuePatternMatcher, customObjectManager: CustomObjectManager);
+    resolvePathDisposition(pathSegments: Array<string | number>, key: string, forceDeepRedaction: boolean): FieldDisposition;
+    getMatchingPathRule(segments: Array<string | number>): PathRule | undefined;
+    shouldRemoveByKey(key: SecretSpecifierValue): boolean;
+    shouldOpaqueByKey(key: SecretSpecifierValue): boolean;
+    shouldTraverseContainerByKey(key: SecretSpecifierValue, forceDeepRedaction: boolean): boolean;
+    containerForceDeepRedaction(key: SecretSpecifierValue, forceDeepRedaction: boolean): boolean;
+    nestedObjectForceDeepRedaction(key: SecretSpecifierValue, forceDeepRedaction: boolean): boolean;
+    attributeKeyRule(path: string, action: DryRunPathRule['action'], key: SecretSpecifierValue): DryRunPathRule;
+    findEnclosingOpaqueOrDeepKey(objectKeys: string[]): {
+        key: string;
+        rule: 'opaque' | 'deep';
+    } | undefined;
+    resolveSchemaAttribution(context: AttributionContext): DryRunPathRule | undefined;
+    resolvePathRuleAttribution(context: AttributionContext): DryRunPathRule | undefined;
+    resolveEnclosingKeyAttribution(context: AttributionContext): DryRunPathRule | undefined;
+    resolveLeafKeyAttribution(context: AttributionContext): DryRunPathRule | undefined;
+    resolveValuePatternAttribution(context: AttributionContext): DryRunPathRule | undefined;
+    attributeRedactPath(before: JsonValue | undefined, path: string): DryRunPathRule;
+    attributeDeletePath(before: JsonValue | undefined, path: string): DryRunPathRule;
+    /** Returns the matching schema when a shaped object should be handled at this node. */
+    getMatchingSchema(value: JsonValue): CustomObject | undefined;
+}
+export declare const buildPathRules: (before: JsonValue | undefined, redactedPaths: readonly string[], deletedPaths: readonly string[], resolver: RuleResolver) => DryRunPathRule[];
+export {};
+//# sourceMappingURL=ruleResolver.d.ts.map

package/dist/rules/ruleResolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ruleResolver.d.ts","sourceRoot":"","sources":["../../src/rules/ruleResolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAI5D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EACL,YAAY,EACZ,cAAc,EAGd,SAAS,EACT,QAAQ,EAER,oBAAoB,EACrB,MAAM,UAAU,CAAC;AAElB,MAAM,MAAM,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAC;AAE/D,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,SAAS,CAAC;AAE/C,MAAM,MAAM,gBAAgB,GACxB;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAClB;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GACpB;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GACpB;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAClB;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,kBAAkB,CAAA;CAAE,CAAC;AAEnC,KAAK,kBAAkB,GAAG;IACxB,MAAM,EAAE,SAAS,GAAG,SAAS,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;IACjC,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB,CAAC;AAeF,qEAAqE;AACrE,eAAO,MAAM,sBAAsB,kBAClB,aAAa,mBACX,eAAe,OAC3B,MAAM,gBACG,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,sBAChB,OAAO,KAC1B,gBA4BF,CAAC;AAEF;;;GAGG;AACH,qBAAa,YAAY;IAErB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IACpC,OAAO,CAAC,QAAQ,CAAC,mBAAmB;gBAHnB,aAAa,EAAE,aAAa,EAC5B,eAAe,EAAE,eAAe,EAChC,mBAAmB,EAAE,mBAAmB,EACxC,mBAAmB,EAAE,mBAAmB;IAG3D,sBAAsB,CACpB,YAAY,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,EACpC,GAAG,EAAE,MAAM,EACX,kBAAkB,EAAE,OAAO,GAC1B,gBAAgB;IAInB,mBAAmB,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,GAAG,QAAQ,GAAG,SAAS;IAK3E,iBAAiB,CAAC,GAAG,EAAE,oBAAoB,GAAG,OAAO;IAIrD,iBAAiB,CAAC,GAAG,EAAE,oBAAoB,GAAG,OAAO;IAIrD,4BAA4B,CAAC,GAAG,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,OAAO,GAAG,OAAO;IAQ7F,2BAA2B,CAAC,GAAG,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,OAAO,GAAG,OAAO;IAI5F,8BAA8B,CAAC,GAAG,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,OAAO,GAAG,OAAO;IAI/F,gBAAgB,CACd,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC,EAChC,GAAG,EAAE,oBAAoB,GACxB,cAAc;IASjB,4BAA4B,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,CAAA;KAAE,GAAG,SAAS;IAYxG,wBAAwB,CAAC,OAAO,EAAE,kBAAkB,GAAG,cAAc,GAAG,SAAS;IA4BjF,0BAA0B,CAAC,OAAO,EAAE,kBAAkB,GAAG,cAAc,GAAG,SAAS;IAanF,8BAA8B,CAAC,OAAO,EAAE,kBAAkB,GAAG,cAAc,GAAG,SAAS;IAWvF,yBAAyB,CAAC,OAAO,EAAE,kBAAkB,GAAG,cAAc,GAAG,SAAS;IASlF,8BAA8B,CAAC,OAAO,EAAE,kBAAkB,GAAG,cAAc,GAAG,SAAS;IAgBvF,mBAAmB,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,cAAc;IA2BhF,mBAAmB,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,cAAc;IAehF,uFAAuF;IACvF,iBAAiB,CAAC,KAAK,EAAE,SAAS,GAAG,YAAY,GAAG,SAAS;CAG9D;AAED,eAAO,MAAM,cAAc,WACjB,SAAS,GAAG,SAAS,iBACd,SAAS,MAAM,EAAE,gBAClB,SAAS,MAAM,EAAE,YACrB,YAAY,KACrB,cAAc,EAGhB,CAAC"}

package/dist/rules/ruleResolver.js

@@ -0,0 +1,194 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildPathRules = exports.RuleResolver = exports.resolvePathDisposition = void 0;
+const objectRedactorHelpers_1 = require("../engine/objectRedactorHelpers");
+const jsonWalk_1 = require("../util/jsonWalk");
+const pathParsing_1 = require("../util/pathParsing");
+const types_1 = require("../types");
+const objectKeysFromPath = (segments) => segments.filter((segment) => typeof segment === 'string');
+const toPathRule = (path, action, rule, extras = {}) => (Object.assign({ path, action, rule }, extras));
+const patternForKey = (secretManager, key, rule) => secretManager.getKeyRulePattern(key, rule);
+/** Shared path-rule + pass-key disposition used during traversal. */
+const resolvePathDisposition = (secretManager, pathRuleMatcher, key, pathSegments, forceDeepRedaction) => {
+    const pathRule = pathRuleMatcher.getMatchingRule([...pathSegments, key]);
+    if ((pathRule === null || pathRule === void 0 ? void 0 : pathRule.mode) === 'pass') {
+        return { action: 'skip' };
+    }
+    if ((pathRule === null || pathRule === void 0 ? void 0 : pathRule.mode) === 'remove') {
+        return { action: 'remove' };
+    }
+    if ((pathRule === null || pathRule === void 0 ? void 0 : pathRule.mode) === 'opaque') {
+        return { action: 'opaque' };
+    }
+    if ((pathRule === null || pathRule === void 0 ? void 0 : pathRule.mode) === 'deep') {
+        return { action: 'deep' };
+    }
+    if ((pathRule === null || pathRule === void 0 ? void 0 : pathRule.mode) === 'shallow') {
+        return { action: 'shallow' };
+    }
+    if (forceDeepRedaction && secretManager.isPassKey(key)) {
+        return { action: 'pass-key-recurse' };
+    }
+    return { action: 'default' };
+};
+exports.resolvePathDisposition = resolvePathDisposition;
+/**
+ * Single source of truth for field-level rule precedence shared by traversal and dry-run attribution.
+ * Precedence: schema → path rule → enclosing opaque/deep key → leaf key rule → value pattern → default.
+ */
+class RuleResolver {
+    constructor(secretManager, pathRuleMatcher, valuePatternMatcher, customObjectManager) {
+        this.secretManager = secretManager;
+        this.pathRuleMatcher = pathRuleMatcher;
+        this.valuePatternMatcher = valuePatternMatcher;
+        this.customObjectManager = customObjectManager;
+    }
+    resolvePathDisposition(pathSegments, key, forceDeepRedaction) {
+        return (0, exports.resolvePathDisposition)(this.secretManager, this.pathRuleMatcher, key, pathSegments, forceDeepRedaction);
+    }
+    getMatchingPathRule(segments) {
+        const match = this.pathRuleMatcher.getMatchingRule(segments);
+        return (match === null || match === void 0 ? void 0 : match.mode) === 'pass' ? undefined : match;
+    }
+    shouldRemoveByKey(key) {
+        return this.secretManager.isDeleteSecretKey(key);
+    }
+    shouldOpaqueByKey(key) {
+        return this.secretManager.isFullSecretKey(key);
+    }
+    shouldTraverseContainerByKey(key, forceDeepRedaction) {
+        return (this.secretManager.isSecretKey(key) ||
+            this.secretManager.isDeepSecretKey(key) ||
+            forceDeepRedaction);
+    }
+    containerForceDeepRedaction(key, forceDeepRedaction) {
+        return forceDeepRedaction || this.secretManager.isDeepSecretKey(key);
+    }
+    nestedObjectForceDeepRedaction(key, forceDeepRedaction) {
+        return forceDeepRedaction || this.secretManager.isDeepSecretKey(key);
+    }
+    attributeKeyRule(path, action, key) {
+        var _a;
+        const rule = (_a = this.secretManager.classifyKeyRule(key)) !== null && _a !== void 0 ? _a : 'default';
+        if (rule === 'default') {
+            return toPathRule(path, action, rule);
+        }
+        return toPathRule(path, action, rule, { pattern: patternForKey(this.secretManager, key, rule) });
+    }
+    findEnclosingOpaqueOrDeepKey(objectKeys) {
+        for (let index = objectKeys.length - 2; index >= 0; index--) {
+            const key = objectKeys[index];
+            const rule = this.secretManager.classifyKeyRule(key);
+            if (rule === 'opaque' || rule === 'deep') {
+                return { key, rule };
+            }
+        }
+        return undefined;
+    }
+    resolveSchemaAttribution(context) {
+        const { parent, leaf } = (0, jsonWalk_1.getParentContext)(context.before, context.segments);
+        if (!(0, types_1.isJsonObject)(parent) || typeof leaf !== 'string') {
+            return undefined;
+        }
+        const schema = this.customObjectManager.getMatchingCustomObject(parent);
+        if (!schema || !(leaf in schema)) {
+            return undefined;
+        }
+        let pattern;
+        if (typeof schema[leaf] === 'string') {
+            const siblingSpecifier = (0, objectRedactorHelpers_1.getStringSpecifiedCustomObjectSecretKeyValueIfExists)(parent, schema, leaf);
+            if (siblingSpecifier !== undefined) {
+                const siblingRule = this.secretManager.classifyKeyRule(siblingSpecifier);
+                if (siblingRule && siblingRule !== 'default') {
+                    pattern = patternForKey(this.secretManager, siblingSpecifier, siblingRule);
+                }
+            }
+        }
+        return toPathRule(context.path, 'redact', 'schema', Object.assign(Object.assign({}, this.customObjectManager.getSchemaMetadata(schema)), (pattern ? { pattern } : {})));
+    }
+    resolvePathRuleAttribution(context) {
+        const match = this.getMatchingPathRule(context.segments);
+        if (!match) {
+            return undefined;
+        }
+        if (match.mode === 'remove') {
+            return toPathRule(context.path, 'delete', 'remove', { pattern: match.path });
+        }
+        return toPathRule(context.path, 'redact', match.mode, { pattern: match.path });
+    }
+    resolveEnclosingKeyAttribution(context) {
+        const enclosing = this.findEnclosingOpaqueOrDeepKey(context.objectKeys);
+        if (!enclosing) {
+            return undefined;
+        }
+        return toPathRule(context.path, 'redact', enclosing.rule, {
+            pattern: patternForKey(this.secretManager, enclosing.key, enclosing.rule)
+        });
+    }
+    resolveLeafKeyAttribution(context) {
+        const leafKey = context.objectKeys.at(-1);
+        if (!leafKey || !this.secretManager.classifyKeyRule(leafKey)) {
+            return undefined;
+        }
+        return this.attributeKeyRule(context.path, 'redact', leafKey);
+    }
+    resolveValuePatternAttribution(context) {
+        const value = (0, jsonWalk_1.getJsonValueAtPath)(context.before, context.segments);
+        if (value === undefined || (typeof value !== 'string' && typeof value !== 'number')) {
+            return undefined;
+        }
+        const match = this.valuePatternMatcher.findMatching((0, objectRedactorHelpers_1.toRedactablePrimitive)(value));
+        if (!match) {
+            return undefined;
+        }
+        return toPathRule(context.path, 'redact', 'value', {
+            pattern: this.valuePatternMatcher.formatPattern(match)
+        });
+    }
+    attributeRedactPath(before, path) {
+        const segments = (0, pathParsing_1.parseJsonPath)(path);
+        const context = {
+            before,
+            path,
+            segments,
+            objectKeys: objectKeysFromPath(segments)
+        };
+        const resolvers = [
+            () => this.resolveSchemaAttribution(context),
+            () => this.resolvePathRuleAttribution(context),
+            () => this.resolveEnclosingKeyAttribution(context),
+            () => this.resolveLeafKeyAttribution(context),
+            () => this.resolveValuePatternAttribution(context)
+        ];
+        for (const resolve of resolvers) {
+            const rule = resolve();
+            if (rule) {
+                return rule;
+            }
+        }
+        return toPathRule(path, 'redact', 'default');
+    }
+    attributeDeletePath(before, path) {
+        const segments = (0, pathParsing_1.parseJsonPath)(path);
+        const pathRule = this.getMatchingPathRule(segments);
+        if ((pathRule === null || pathRule === void 0 ? void 0 : pathRule.mode) === 'remove') {
+            return toPathRule(path, 'delete', 'remove', { pattern: pathRule.path });
+        }
+        const deleteKey = objectKeysFromPath(segments).at(-1);
+        if (deleteKey) {
+            return this.attributeKeyRule(path, 'delete', deleteKey);
+        }
+        return toPathRule(path, 'delete', 'default');
+    }
+    /** Returns the matching schema when a shaped object should be handled at this node. */
+    getMatchingSchema(value) {
+        return (0, types_1.isJsonObject)(value) ? this.customObjectManager.getMatchingCustomObject(value) : undefined;
+    }
+}
+exports.RuleResolver = RuleResolver;
+const buildPathRules = (before, redactedPaths, deletedPaths, resolver) => [
+    ...deletedPaths.map((path) => resolver.attributeDeletePath(before, path)),
+    ...redactedPaths.map((path) => resolver.attributeRedactPath(before, path))
+];
+exports.buildPathRules = buildPathRules;
+//# sourceMappingURL=ruleResolver.js.map

package/dist/rules/ruleResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ruleResolver.js","sourceRoot":"","sources":["../../src/rules/ruleResolver.ts"],"names":[],"mappings":";;;AACA,2EAA8H;AAC9H,+CAAwE;AACxE,qDAAoD;AAIpD,oCASkB;AAsBlB,MAAM,kBAAkB,GAAG,CAAC,QAAgC,EAAY,EAAE,CACxE,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAqB,EAAE,CAAC,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC;AAE/E,MAAM,UAAU,GAAG,CACjB,IAAY,EACZ,MAAgC,EAChC,IAAwB,EACxB,SAAkF,EAAE,EACpE,EAAE,CAAC,iBAAG,IAAI,EAAE,MAAM,EAAE,IAAI,IAAK,MAAM,EAAG,CAAC;AAEzD,MAAM,aAAa,GAAG,CAAC,aAA4B,EAAE,GAAyB,EAAE,IAAa,EAAsB,EAAE,CACnH,aAAa,CAAC,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAE7C,qEAAqE;AAC9D,MAAM,sBAAsB,GAAG,CACpC,aAA4B,EAC5B,eAAgC,EAChC,GAAW,EACX,YAAoC,EACpC,kBAA2B,EACT,EAAE;IACpB,MAAM,QAAQ,GAAG,eAAe,CAAC,eAAe,CAAC,CAAC,GAAG,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC;IAEzE,IAAI,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,IAAI,MAAK,MAAM,EAAE,CAAC;QAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED,IAAI,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,IAAI,MAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC9B,CAAC;IAED,IAAI,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,IAAI,MAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC9B,CAAC;IAED,IAAI,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,IAAI,MAAK,MAAM,EAAE,CAAC;QAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED,IAAI,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,IAAI,MAAK,SAAS,EAAE,CAAC;QACjC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC/B,CAAC;IAED,IAAI,kBAAkB,IAAI,aAAa,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;QACvD,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACxC,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC/B,CAAC,CAAC;AAlCW,QAAA,sBAAsB,0BAkCjC;AAEF;;;GAGG;AACH,MAAa,YAAY;IACvB,YACmB,aAA4B,EAC5B,eAAgC,EAChC,mBAAwC,EACxC,mBAAwC;QAHxC,kBAAa,GAAb,aAAa,CAAe;QAC5B,oBAAe,GAAf,eAAe,CAAiB;QAChC,wBAAmB,GAAnB,mBAAmB,CAAqB;QACxC,wBAAmB,GAAnB,mBAAmB,CAAqB;IACxD,CAAC;IAEJ,sBAAsB,CACpB,YAAoC,EACpC,GAAW,EACX,kBAA2B;QAE3B,OAAO,IAAA,8BAAsB,EAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,YAAY,EAAE,kBAAkB,CAAC,CAAC;IACjH,CAAC;IAED,mBAAmB,CAAC,QAAgC;QAClD,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC7D,OAAO,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,IAAI,MAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;IACpD,CAAC;IAED,iBAAiB,CAAC,GAAyB;QACzC,OAAO,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACnD,CAAC;IAED,iBAAiB,CAAC,GAAyB;QACzC,OAAO,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IACjD,CAAC;IAED,4BAA4B,CAAC,GAAyB,EAAE,kBAA2B;QACjF,OAAO,CACL,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC;YACnC,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,GAAG,CAAC;YACvC,kBAAkB,CACnB,CAAC;IACJ,CAAC;IAED,2BAA2B,CAAC,GAAyB,EAAE,kBAA2B;QAChF,OAAO,kBAAkB,IAAI,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IACvE,CAAC;IAED,8BAA8B,CAAC,GAAyB,EAAE,kBAA2B;QACnF,OAAO,kBAAkB,IAAI,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IACvE,CAAC;IAED,gBAAgB,CACd,IAAY,EACZ,MAAgC,EAChC,GAAyB;;QAEzB,MAAM,IAAI,GAAG,MAAA,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,GAAG,CAAC,mCAAI,SAAS,CAAC;QAClE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC;QAED,OAAO,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IACnG,CAAC;IAED,4BAA4B,CAAC,UAAoB;QAC/C,KAAK,IAAI,KAAK,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;YAC5D,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;YAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;YACrD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACzC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;YACvB,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,wBAAwB,CAAC,OAA2B;QAClD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAA,2BAAgB,EAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC5E,IAAI,CAAC,IAAA,oBAAY,EAAC,MAAM,CAAC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,mBAAmB,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,EAAE,CAAC;YACjC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,OAA2B,CAAC;QAChC,IAAI,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;YACrC,MAAM,gBAAgB,GAAG,IAAA,4EAAoD,EAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YACpG,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;gBACnC,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC;gBACzE,IAAI,WAAW,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;oBAC7C,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,aAAa,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;gBAC7E,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,kCAC7C,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,MAAM,CAAC,GAClD,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAC/B,CAAC;IACL,CAAC;IAED,0BAA0B,CAAC,OAA2B;QACpD,MAAM,KAAK,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5B,OAAO,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/E,CAAC;QAED,OAAO,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAqC,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAClH,CAAC;IAED,8BAA8B,CAAC,OAA2B;QACxD,MAAM,SAAS,GAAG,IAAI,CAAC,4BAA4B,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACxE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,IAAI,EAAE;YACxD,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC;SAC1E,CAAC,CAAC;IACL,CAAC;IAED,yBAAyB,CAAC,OAA2B;QACnD,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7D,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAChE,CAAC;IAED,8BAA8B,CAAC,OAA2B;QACxD,MAAM,KAAK,GAAG,IAAA,6BAAkB,EAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QACnE,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,EAAE,CAAC;YACpF,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,IAAA,6CAAqB,EAAC,KAAsB,CAAC,CAAC,CAAC;QACnG,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE;YACjD,OAAO,EAAE,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,KAAK,CAAC;SACvD,CAAC,CAAC;IACL,CAAC;IAED,mBAAmB,CAAC,MAA6B,EAAE,IAAY;QAC7D,MAAM,QAAQ,GAAG,IAAA,2BAAa,EAAC,IAAI,CAAC,CAAC;QACrC,MAAM,OAAO,GAAuB;YAClC,MAAM;YACN,IAAI;YACJ,QAAQ;YACR,UAAU,EAAE,kBAAkB,CAAC,QAAQ,CAAC;SACzC,CAAC;QAEF,MAAM,SAAS,GAAG;YAChB,GAAG,EAAE,CAAC,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC;YAC5C,GAAG,EAAE,CAAC,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC;YAC9C,GAAG,EAAE,CAAC,IAAI,CAAC,8BAA8B,CAAC,OAAO,CAAC;YAClD,GAAG,EAAE,CAAC,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC;YAC7C,GAAG,EAAE,CAAC,IAAI,CAAC,8BAA8B,CAAC,OAAO,CAAC;SAC1C,CAAC;QAEX,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;YACvB,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC/C,CAAC;IAED,mBAAmB,CAAC,MAA6B,EAAE,IAAY;QAC7D,MAAM,QAAQ,GAAG,IAAA,2BAAa,EAAC,IAAI,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,IAAI,MAAK,QAAQ,EAAE,CAAC;YAChC,OAAO,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,SAAS,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC1D,CAAC;QAED,OAAO,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC/C,CAAC;IAED,uFAAuF;IACvF,iBAAiB,CAAC,KAAgB;QAChC,OAAO,IAAA,oBAAY,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnG,CAAC;CACF;AAjMD,oCAiMC;AAEM,MAAM,cAAc,GAAG,CAC5B,MAA6B,EAC7B,aAAgC,EAChC,YAA+B,EAC/B,QAAsB,EACJ,EAAE,CAAC;IACrB,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACzE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;CAC3E,CAAC;AARW,QAAA,cAAc,kBAQzB"}

package/dist/rules/secretManager.d.ts

@@ -0,0 +1,32 @@
+import { SecretManagerConfig, SecretSpecifierValue } from '../types';
+type KeyRule = 'remove' | 'opaque' | 'deep' | 'shallow';
+/**
+ * Utility class for managing secrets and determining if a given value is a secret of any type. If no secrets of
+ * any type are provided in the configuration then all values are considered secrets (but not deep or full secrets).
+ */
+export declare class SecretManager {
+    private secretKeys?;
+    private deepSecretKeys?;
+    private fullSecretKeys?;
+    private deleteSecretKeys?;
+    private passKeys?;
+    constructor(config: SecretManagerConfig);
+    /**
+     * Determines if the given key is a secret. If no secrets of any type are provided then this function
+     * always returns true.
+     */
+    isSecretKey(key: SecretSpecifierValue): boolean;
+    isDeepSecretKey(key: SecretSpecifierValue): boolean;
+    isFullSecretKey(key: SecretSpecifierValue): boolean;
+    isDeleteSecretKey(key: SecretSpecifierValue): boolean;
+    /** Determines if a key is allowlisted and should not be redacted under deep parents. */
+    isPassKey(key: SecretSpecifierValue): boolean;
+    getKeyRulePattern(key: SecretSpecifierValue, rule: KeyRule): string | undefined;
+    classifyKeyRule(key: SecretSpecifierValue): KeyRule | 'default' | null;
+    private matchesRule;
+    private regexListFor;
+    private static findMatchingRegex;
+    private static matchesAnyRegex;
+}
+export {};
+//# sourceMappingURL=secretManager.d.ts.map

package/dist/rules/secretManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretManager.d.ts","sourceRoot":"","sources":["../../src/rules/secretManager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAErE,KAAK,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAC;AAIxD;;;GAGG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,UAAU,CAAC,CAAW;IAC9B,OAAO,CAAC,cAAc,CAAC,CAAW;IAClC,OAAO,CAAC,cAAc,CAAC,CAAW;IAClC,OAAO,CAAC,gBAAgB,CAAC,CAAW;IACpC,OAAO,CAAC,QAAQ,CAAC,CAAW;gBAEhB,MAAM,EAAE,mBAAmB;IAavC;;;OAGG;IACI,WAAW,CAAC,GAAG,EAAE,oBAAoB,GAAG,OAAO;IAQ/C,eAAe,CAAC,GAAG,EAAE,oBAAoB,GAAG,OAAO;IAInD,eAAe,CAAC,GAAG,EAAE,oBAAoB,GAAG,OAAO;IAInD,iBAAiB,CAAC,GAAG,EAAE,oBAAoB,GAAG,OAAO;IAI5D,wFAAwF;IACjF,SAAS,CAAC,GAAG,EAAE,oBAAoB,GAAG,OAAO;IAI7C,iBAAiB,CAAC,GAAG,EAAE,oBAAoB,EAAE,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS;IAK/E,eAAe,CAAC,GAAG,EAAE,oBAAoB,GAAG,OAAO,GAAG,SAAS,GAAG,IAAI;IAc7E,OAAO,CAAC,WAAW;IAKnB,OAAO,CAAC,YAAY;IAapB,OAAO,CAAC,MAAM,CAAC,iBAAiB;IAIhC,OAAO,CAAC,MAAM,CAAC,eAAe;CAG/B"}

package/dist/rules/secretManager.js

@@ -0,0 +1,85 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecretManager = void 0;
+const regexUtils_1 = require("../util/regexUtils");
+const KEY_RULE_PRECEDENCE = ['remove', 'opaque', 'deep', 'shallow'];
+/**
+ * Utility class for managing secrets and determining if a given value is a secret of any type. If no secrets of
+ * any type are provided in the configuration then all values are considered secrets (but not deep or full secrets).
+ */
+class SecretManager {
+    constructor(config) {
+        this.deepSecretKeys = config.deepSecretKeys;
+        this.fullSecretKeys = config.fullSecretKeys;
+        this.deleteSecretKeys = config.deleteSecretKeys;
+        this.passKeys = config.passKeys;
+        if (!config.secretKeys && (config.deepSecretKeys || config.fullSecretKeys || config.deleteSecretKeys)) {
+            this.secretKeys = [];
+        }
+        else {
+            this.secretKeys = config.secretKeys;
+        }
+    }
+    /**
+     * Determines if the given key is a secret. If no secrets of any type are provided then this function
+     * always returns true.
+     */
+    isSecretKey(key) {
+        if (!this.secretKeys) {
+            return true;
+        }
+        return this.matchesRule(key, 'shallow');
+    }
+    isDeepSecretKey(key) {
+        return this.matchesRule(key, 'deep');
+    }
+    isFullSecretKey(key) {
+        return this.matchesRule(key, 'opaque');
+    }
+    isDeleteSecretKey(key) {
+        return this.matchesRule(key, 'remove');
+    }
+    /** Determines if a key is allowlisted and should not be redacted under deep parents. */
+    isPassKey(key) {
+        return !!this.passKeys && SecretManager.matchesAnyRegex(key, this.passKeys);
+    }
+    getKeyRulePattern(key, rule) {
+        const match = SecretManager.findMatchingRegex(key, this.regexListFor(rule));
+        return match ? (0, regexUtils_1.formatRegExp)(match) : undefined;
+    }
+    classifyKeyRule(key) {
+        for (const rule of KEY_RULE_PRECEDENCE) {
+            if (this.matchesRule(key, rule)) {
+                return rule;
+            }
+        }
+        if (this.isSecretKey(key)) {
+            return this.secretKeys ? 'shallow' : 'default';
+        }
+        return null;
+    }
+    matchesRule(key, rule) {
+        const regexes = this.regexListFor(rule);
+        return !!regexes && SecretManager.matchesAnyRegex(key, regexes);
+    }
+    regexListFor(rule) {
+        switch (rule) {
+            case 'remove':
+                return this.deleteSecretKeys;
+            case 'opaque':
+                return this.fullSecretKeys;
+            case 'deep':
+                return this.deepSecretKeys;
+            case 'shallow':
+                return this.secretKeys;
+        }
+    }
+    static findMatchingRegex(key, regexes) {
+        return regexes === null || regexes === void 0 ? void 0 : regexes.find((regex) => regex.test(String(key)));
+    }
+    static matchesAnyRegex(value, regexes) {
+        return regexes.some((regex) => regex.test(String(value)));
+    }
+}
+exports.SecretManager = SecretManager;
+//# sourceMappingURL=secretManager.js.map

package/dist/rules/secretManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretManager.js","sourceRoot":"","sources":["../../src/rules/secretManager.ts"],"names":[],"mappings":";;;AAAA,mDAAkD;AAKlD,MAAM,mBAAmB,GAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;AAE/E;;;GAGG;AACH,MAAa,aAAa;IAOxB,YAAY,MAA2B;QACrC,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QAC5C,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QAC5C,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,CAAC;QAChD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAEhC,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACtG,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QACtC,CAAC;IACH,CAAC;IAED;;;OAGG;IACI,WAAW,CAAC,GAAyB;QAC1C,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC1C,CAAC;IAEM,eAAe,CAAC,GAAyB;QAC9C,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IAEM,eAAe,CAAC,GAAyB;QAC9C,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACzC,CAAC;IAEM,iBAAiB,CAAC,GAAyB;QAChD,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED,wFAAwF;IACjF,SAAS,CAAC,GAAyB;QACxC,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,aAAa,CAAC,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9E,CAAC;IAEM,iBAAiB,CAAC,GAAyB,EAAE,IAAa;QAC/D,MAAM,KAAK,GAAG,aAAa,CAAC,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5E,OAAO,KAAK,CAAC,CAAC,CAAC,IAAA,yBAAY,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjD,CAAC;IAEM,eAAe,CAAC,GAAyB;QAC9C,KAAK,MAAM,IAAI,IAAI,mBAAmB,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;gBAChC,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QACjD,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,WAAW,CAAC,GAAyB,EAAE,IAAa;QAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACxC,OAAO,CAAC,CAAC,OAAO,IAAI,aAAa,CAAC,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAClE,CAAC;IAEO,YAAY,CAAC,IAAa;QAChC,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,QAAQ;gBACX,OAAO,IAAI,CAAC,gBAAgB,CAAC;YAC/B,KAAK,QAAQ;gBACX,OAAO,IAAI,CAAC,cAAc,CAAC;YAC7B,KAAK,MAAM;gBACT,OAAO,IAAI,CAAC,cAAc,CAAC;YAC7B,KAAK,SAAS;gBACZ,OAAO,IAAI,CAAC,UAAU,CAAC;QAC3B,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,iBAAiB,CAAC,GAAyB,EAAE,OAAkB;QAC5E,OAAO,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC;IAEO,MAAM,CAAC,eAAe,CAAC,KAA2B,EAAE,OAAiB;QAC3E,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC;CACF;AA7FD,sCA6FC"}

package/dist/rules/valuePatternMatcher.d.ts

@@ -0,0 +1,15 @@
+import { RedactablePrimitive } from '../types';
+/**
+ * Opt-in regex matching against scalar **values** (not key names).
+ * Applied only when key-based rules do not already redact the field.
+ */
+export declare class ValuePatternMatcher {
+    private readonly patterns;
+    constructor(patterns?: RegExp[]);
+    hasPatterns(): boolean;
+    findMatching(value: RedactablePrimitive | undefined): RegExp | undefined;
+    formatPattern(regex: RegExp): string;
+}
+/** Shared empty matcher for tests and configs without value patterns. */
+export declare const EMPTY_VALUE_PATTERN_MATCHER: ValuePatternMatcher;
+//# sourceMappingURL=valuePatternMatcher.d.ts.map

package/dist/rules/valuePatternMatcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"valuePatternMatcher.d.ts","sourceRoot":"","sources":["../../src/rules/valuePatternMatcher.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAE/C;;;GAGG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAW;gBAExB,QAAQ,CAAC,EAAE,MAAM,EAAE;IAIxB,WAAW,IAAI,OAAO;IAItB,YAAY,CAAC,KAAK,EAAE,mBAAmB,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS;IASxE,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;CAG5C;AAED,yEAAyE;AACzE,eAAO,MAAM,2BAA2B,qBAA4B,CAAC"}

package/dist/rules/valuePatternMatcher.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EMPTY_VALUE_PATTERN_MATCHER = exports.ValuePatternMatcher = void 0;
+const regexUtils_1 = require("../util/regexUtils");
+/**
+ * Opt-in regex matching against scalar **values** (not key names).
+ * Applied only when key-based rules do not already redact the field.
+ */
+class ValuePatternMatcher {
+    constructor(patterns) {
+        this.patterns = patterns !== null && patterns !== void 0 ? patterns : [];
+    }
+    hasPatterns() {
+        return this.patterns.length > 0;
+    }
+    findMatching(value) {
+        if (value === undefined || value === null || typeof value === 'boolean') {
+            return undefined;
+        }
+        const text = String(value);
+        return this.patterns.find((pattern) => pattern.test(text));
+    }
+    formatPattern(regex) {
+        return (0, regexUtils_1.formatRegExp)(regex);
+    }
+}
+exports.ValuePatternMatcher = ValuePatternMatcher;
+/** Shared empty matcher for tests and configs without value patterns. */
+exports.EMPTY_VALUE_PATTERN_MATCHER = new ValuePatternMatcher();
+//# sourceMappingURL=valuePatternMatcher.js.map

package/dist/rules/valuePatternMatcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"valuePatternMatcher.js","sourceRoot":"","sources":["../../src/rules/valuePatternMatcher.ts"],"names":[],"mappings":";;;AAAA,mDAAkD;AAGlD;;;GAGG;AACH,MAAa,mBAAmB;IAG9B,YAAY,QAAmB;QAC7B,IAAI,CAAC,QAAQ,GAAG,QAAQ,aAAR,QAAQ,cAAR,QAAQ,GAAI,EAAE,CAAC;IACjC,CAAC;IAEM,WAAW;QAChB,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IAClC,CAAC;IAEM,YAAY,CAAC,KAAsC;QACxD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;YACxE,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,CAAC;IAEM,aAAa,CAAC,KAAa;QAChC,OAAO,IAAA,yBAAY,EAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;CACF;AAvBD,kDAuBC;AAED,yEAAyE;AAC5D,QAAA,2BAA2B,GAAG,IAAI,mBAAmB,EAAE,CAAC"}

package/dist/secretManager.d.ts

@@ -1,6 +1,7 @@
-import { SecretManagerConfig } from './types';
+import { SecretManagerConfig, SecretSpecifierValue } from './types';
+type KeyRule = 'remove' | 'opaque' | 'deep' | 'shallow';
 /**
- * Utility class for managing secrets and determining if a  given value is a secret of any type. If no secrets of
+ * Utility class for managing secrets and determining if a given value is a secret of any type. If no secrets of
  * any type are provided in the configuration then all values are considered secrets (but not deep or full secrets).
  */
 export declare class SecretManager {
@@ -8,32 +9,24 @@ export declare class SecretManager {
     private deepSecretKeys?;
     private fullSecretKeys?;
     private deleteSecretKeys?;
+    private passKeys?;
     constructor(config: SecretManagerConfig);
     /**
      * Determines if the given key is a secret. If no secrets of any type are provided then this function
      * always returns true.
-     * @param key The key to check.
-     * @returns True if the key is a secret key or no secret keys exist, otherwise false.
      */
-    isSecretKey(key: string): boolean;
-    /**
-     * Determines if a key is a deep secret based on the deepSecretKeys configuration provided in the constructor.
-     * @param key The key to check.
-     * @returns True if the key is a deep secret key, otherwise false.
-     */
-    isDeepSecretKey(key: string): boolean;
-    /**
-     * Determines if a key is a full secret based on the fullSecretKeys configuration provided in the constructor.
-     * @param key The key to check.
-     * @returns True if the key is a full secret key, otherwise false.
-     */
-    isFullSecretKey(key: string): boolean;
-    /**
-     * Determines if a key is a delete secret based on the deleteSecretKeys configuration provided in the constructor.
-     * @param key The key to check.
-     * @returns True if the key is a delete secret key, otherwise false.
-     */
-    isDeleteSecretKey(key: string): boolean;
-    private static valueMatchesAnyRegexValue;
+    isSecretKey(key: SecretSpecifierValue): boolean;
+    isDeepSecretKey(key: SecretSpecifierValue): boolean;
+    isFullSecretKey(key: SecretSpecifierValue): boolean;
+    isDeleteSecretKey(key: SecretSpecifierValue): boolean;
+    /** Determines if a key is allowlisted and should not be redacted under deep parents. */
+    isPassKey(key: SecretSpecifierValue): boolean;
+    getKeyRulePattern(key: SecretSpecifierValue, rule: KeyRule): string | undefined;
+    classifyKeyRule(key: SecretSpecifierValue): KeyRule | 'default' | null;
+    private matchesRule;
+    private regexListFor;
+    private static findMatchingRegex;
+    private static matchesAnyRegex;
 }
+export {};
 //# sourceMappingURL=secretManager.d.ts.map

package/dist/secretManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secretManager.d.ts","sourceRoot":"","sources":["../src/secretManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAE9C;;;GAGG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,UAAU,CAAC,CAAW;IAC9B,OAAO,CAAC,cAAc,CAAC,CAAW;IAClC,OAAO,CAAC,cAAc,CAAC,CAAW;IAClC,OAAO,CAAC,gBAAgB,CAAC,CAAW;gBAExB,MAAM,EAAE,mBAAmB;IAYvC;;;;;OAKG;IACI,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAQxC;;;;OAIG;IACI,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAQ5C;;;;OAIG;IACI,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAQ5C;;;;OAIG;IACI,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAQ9C,OAAO,CAAC,MAAM,CAAC,yBAAyB;CAGzC"}
+{"version":3,"file":"secretManager.d.ts","sourceRoot":"","sources":["../src/secretManager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AAEpE,KAAK,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAC;AAIxD;;;GAGG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,UAAU,CAAC,CAAW;IAC9B,OAAO,CAAC,cAAc,CAAC,CAAW;IAClC,OAAO,CAAC,cAAc,CAAC,CAAW;IAClC,OAAO,CAAC,gBAAgB,CAAC,CAAW;IACpC,OAAO,CAAC,QAAQ,CAAC,CAAW;gBAEhB,MAAM,EAAE,mBAAmB;IAavC;;;OAGG;IACI,WAAW,CAAC,GAAG,EAAE,oBAAoB,GAAG,OAAO;IAQ/C,eAAe,CAAC,GAAG,EAAE,oBAAoB,GAAG,OAAO;IAInD,eAAe,CAAC,GAAG,EAAE,oBAAoB,GAAG,OAAO;IAInD,iBAAiB,CAAC,GAAG,EAAE,oBAAoB,GAAG,OAAO;IAI5D,wFAAwF;IACjF,SAAS,CAAC,GAAG,EAAE,oBAAoB,GAAG,OAAO;IAI7C,iBAAiB,CAAC,GAAG,EAAE,oBAAoB,EAAE,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS;IAK/E,eAAe,CAAC,GAAG,EAAE,oBAAoB,GAAG,OAAO,GAAG,SAAS,GAAG,IAAI;IAc7E,OAAO,CAAC,WAAW;IAKnB,OAAO,CAAC,YAAY;IAapB,OAAO,CAAC,MAAM,CAAC,iBAAiB;IAIhC,OAAO,CAAC,MAAM,CAAC,eAAe;CAG/B"}

package/dist/secretManager.js

@@ -1,8 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SecretManager = void 0;
+const regexUtils_1 = require("./regexUtils");
+const KEY_RULE_PRECEDENCE = ['remove', 'opaque', 'deep', 'shallow'];
 /**
- * Utility class for managing secrets and determining if a  given value is a secret of any type. If no secrets of
+ * Utility class for managing secrets and determining if a given value is a secret of any type. If no secrets of
  * any type are provided in the configuration then all values are considered secrets (but not deep or full secrets).
  */
 class SecretManager {
@@ -10,6 +12,7 @@ class SecretManager {
         this.deepSecretKeys = config.deepSecretKeys;
         this.fullSecretKeys = config.fullSecretKeys;
         this.deleteSecretKeys = config.deleteSecretKeys;
+        this.passKeys = config.passKeys;
         if (!config.secretKeys && (config.deepSecretKeys || config.fullSecretKeys || config.deleteSecretKeys)) {
             this.secretKeys = [];
         }
@@ -20,50 +23,62 @@ class SecretManager {
     /**
      * Determines if the given key is a secret. If no secrets of any type are provided then this function
      * always returns true.
-     * @param key The key to check.
-     * @returns True if the key is a secret key or no secret keys exist, otherwise false.
      */
     isSecretKey(key) {
         if (!this.secretKeys) {
             return true;
         }
-        return SecretManager.valueMatchesAnyRegexValue(key, this.secretKeys);
+        return this.matchesRule(key, 'shallow');
     }
-    /**
-     * Determines if a key is a deep secret based on the deepSecretKeys configuration provided in the constructor.
-     * @param key The key to check.
-     * @returns True if the key is a deep secret key, otherwise false.
-     */
     isDeepSecretKey(key) {
-        if (!this.deepSecretKeys) {
-            return false;
-        }
-        return SecretManager.valueMatchesAnyRegexValue(key, this.deepSecretKeys);
+        return this.matchesRule(key, 'deep');
     }
-    /**
-     * Determines if a key is a full secret based on the fullSecretKeys configuration provided in the constructor.
-     * @param key The key to check.
-     * @returns True if the key is a full secret key, otherwise false.
-     */
     isFullSecretKey(key) {
-        if (!this.fullSecretKeys) {
-            return false;
-        }
-        return SecretManager.valueMatchesAnyRegexValue(key, this.fullSecretKeys);
+        return this.matchesRule(key, 'opaque');
     }
-    /**
-     * Determines if a key is a delete secret based on the deleteSecretKeys configuration provided in the constructor.
-     * @param key The key to check.
-     * @returns True if the key is a delete secret key, otherwise false.
-     */
     isDeleteSecretKey(key) {
-        if (!this.deleteSecretKeys) {
-            return false;
+        return this.matchesRule(key, 'remove');
+    }
+    /** Determines if a key is allowlisted and should not be redacted under deep parents. */
+    isPassKey(key) {
+        return !!this.passKeys && SecretManager.matchesAnyRegex(key, this.passKeys);
+    }
+    getKeyRulePattern(key, rule) {
+        const match = SecretManager.findMatchingRegex(key, this.regexListFor(rule));
+        return match ? (0, regexUtils_1.formatRegExp)(match) : undefined;
+    }
+    classifyKeyRule(key) {
+        for (const rule of KEY_RULE_PRECEDENCE) {
+            if (this.matchesRule(key, rule)) {
+                return rule;
+            }
+        }
+        if (this.isSecretKey(key)) {
+            return this.secretKeys ? 'shallow' : 'default';
         }
-        return SecretManager.valueMatchesAnyRegexValue(key, this.deleteSecretKeys);
+        return null;
+    }
+    matchesRule(key, rule) {
+        const regexes = this.regexListFor(rule);
+        return !!regexes && SecretManager.matchesAnyRegex(key, regexes);
+    }
+    regexListFor(rule) {
+        switch (rule) {
+            case 'remove':
+                return this.deleteSecretKeys;
+            case 'opaque':
+                return this.fullSecretKeys;
+            case 'deep':
+                return this.deepSecretKeys;
+            case 'shallow':
+                return this.secretKeys;
+        }
+    }
+    static findMatchingRegex(key, regexes) {
+        return regexes === null || regexes === void 0 ? void 0 : regexes.find((regex) => regex.test(String(key)));
     }
-    static valueMatchesAnyRegexValue(value, regexes) {
-        return regexes.some((regex) => regex.test(value));
+    static matchesAnyRegex(value, regexes) {
+        return regexes.some((regex) => regex.test(String(value)));
     }
 }
 exports.SecretManager = SecretManager;