field-redactor 1.5.0 → 1.6.0

package/dist/rules/customObjectManager.d.ts

@@ -0,0 +1,28 @@
+import { CustomObject, MatchedSchemaReport } from '../types';
+/**
+ * Utility for determining if a given object matches a CustomObject schema.
+ * A value matches when it contains every key defined in the schema; additional keys on the value are allowed.
+ * When multiple schemas match, the schema with the most keys is selected.
+ */
+export declare class CustomObjectManager {
+    private readonly customObjects;
+    private readonly schemaNames;
+    /**
+     * Creates a CustomObjectManager with the specified CustomObjects.
+     * @param customObjects The CustomObjects to check against.
+     * @param schemaNames Optional labels parallel to `customObjects` for dry-run reports.
+     */
+    constructor(customObjects?: CustomObject[], schemaNames?: readonly (string | undefined)[]);
+    getSchemaIndex(schema: CustomObject): number;
+    getSchemaName(schemaIndex: number): string | undefined;
+    getSchemaMetadata(schema: CustomObject): Pick<MatchedSchemaReport, 'schemaIndex' | 'schemaName'>;
+    /**
+     * Determines if the input value matches any of the custom objects provided in the constructor.
+     * When multiple schemas match, returns the schema with the most keys.
+     * @param value The value to compare against the custom objects.
+     * @returns The most specific matching custom object, otherwise undefined.
+     */
+    getMatchingCustomObject(value: unknown): CustomObject | undefined;
+    private isCustomObject;
+}
+//# sourceMappingURL=customObjectManager.d.ts.map

package/dist/rules/customObjectManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"customObjectManager.d.ts","sourceRoot":"","sources":["../../src/rules/customObjectManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAc,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAGzE;;;;GAIG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAiB;IAC/C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAkC;IAE9D;;;;OAIG;gBACS,aAAa,CAAC,EAAE,YAAY,EAAE,EAAE,WAAW,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE;IAMlF,cAAc,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM;IAI5C,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAItD,iBAAiB,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAAC,mBAAmB,EAAE,aAAa,GAAG,YAAY,CAAC;IAMvG;;;;;OAKG;IACI,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,GAAG,SAAS;IAiBxE,OAAO,CAAC,cAAc;CAOvB"}

package/dist/rules/customObjectManager.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CustomObjectManager = void 0;
+const customObjectSchemas_1 = require("../config/customObjectSchemas");
+/**
+ * Utility for determining if a given object matches a CustomObject schema.
+ * A value matches when it contains every key defined in the schema; additional keys on the value are allowed.
+ * When multiple schemas match, the schema with the most keys is selected.
+ */
+class CustomObjectManager {
+    /**
+     * Creates a CustomObjectManager with the specified CustomObjects.
+     * @param customObjects The CustomObjects to check against.
+     * @param schemaNames Optional labels parallel to `customObjects` for dry-run reports.
+     */
+    constructor(customObjects, schemaNames) {
+        (0, customObjectSchemas_1.assertNoIdenticalCustomObjectSchemas)(customObjects);
+        this.customObjects = customObjects !== null && customObjects !== void 0 ? customObjects : [];
+        this.schemaNames = schemaNames !== null && schemaNames !== void 0 ? schemaNames : [];
+    }
+    getSchemaIndex(schema) {
+        return this.customObjects.indexOf(schema);
+    }
+    getSchemaName(schemaIndex) {
+        return this.schemaNames[schemaIndex];
+    }
+    getSchemaMetadata(schema) {
+        const schemaIndex = this.getSchemaIndex(schema);
+        const schemaName = this.getSchemaName(schemaIndex);
+        return schemaName ? { schemaIndex, schemaName } : { schemaIndex };
+    }
+    /**
+     * Determines if the input value matches any of the custom objects provided in the constructor.
+     * When multiple schemas match, returns the schema with the most keys.
+     * @param value The value to compare against the custom objects.
+     * @returns The most specific matching custom object, otherwise undefined.
+     */
+    getMatchingCustomObject(value) {
+        let bestMatch;
+        let bestMatchKeyCount = -1;
+        for (const customObject of this.customObjects) {
+            if (this.isCustomObject(value, customObject)) {
+                const keyCount = Object.keys(customObject).length;
+                if (keyCount > bestMatchKeyCount) {
+                    bestMatch = customObject;
+                    bestMatchKeyCount = keyCount;
+                }
+            }
+        }
+        return bestMatch;
+    }
+    isCustomObject(value, customObject) {
+        if (typeof value !== 'object' || !value || Array.isArray(value)) {
+            return false;
+        }
+        return Object.keys(customObject).every((key) => Object.prototype.hasOwnProperty.call(value, key));
+    }
+}
+exports.CustomObjectManager = CustomObjectManager;
+//# sourceMappingURL=customObjectManager.js.map

package/dist/rules/customObjectManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"customObjectManager.js","sourceRoot":"","sources":["../../src/rules/customObjectManager.ts"],"names":[],"mappings":";;;AACA,uEAAqF;AAErF;;;;GAIG;AACH,MAAa,mBAAmB;IAI9B;;;;OAIG;IACH,YAAY,aAA8B,EAAE,WAA6C;QACvF,IAAA,0DAAoC,EAAC,aAAa,CAAC,CAAC;QACpD,IAAI,CAAC,aAAa,GAAG,aAAa,aAAb,aAAa,cAAb,aAAa,GAAI,EAAE,CAAC;QACzC,IAAI,CAAC,WAAW,GAAG,WAAW,aAAX,WAAW,cAAX,WAAW,GAAI,EAAE,CAAC;IACvC,CAAC;IAEM,cAAc,CAAC,MAAoB;QACxC,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;IAEM,aAAa,CAAC,WAAmB;QACtC,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IACvC,CAAC;IAEM,iBAAiB,CAAC,MAAoB;QAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAChD,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QACnD,OAAO,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IACpE,CAAC;IAED;;;;;OAKG;IACI,uBAAuB,CAAC,KAAc;QAC3C,IAAI,SAAmC,CAAC;QACxC,IAAI,iBAAiB,GAAG,CAAC,CAAC,CAAC;QAE3B,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YAC9C,IAAI,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,CAAC;gBAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC;gBAClD,IAAI,QAAQ,GAAG,iBAAiB,EAAE,CAAC;oBACjC,SAAS,GAAG,YAAY,CAAC;oBACzB,iBAAiB,GAAG,QAAQ,CAAC;gBAC/B,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,cAAc,CAAC,KAAc,EAAE,YAA0B;QAC/D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IACpG,CAAC;CACF;AA3DD,kDA2DC"}

package/dist/rules/fieldDisposition.d.ts

@@ -0,0 +1,3 @@
+export type { FieldDisposition } from './ruleResolver';
+export { resolvePathDisposition as resolveFieldDisposition } from './ruleResolver';
+//# sourceMappingURL=fieldDisposition.d.ts.map

package/dist/rules/fieldDisposition.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fieldDisposition.d.ts","sourceRoot":"","sources":["../../src/rules/fieldDisposition.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,sBAAsB,IAAI,uBAAuB,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/rules/fieldDisposition.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveFieldDisposition = void 0;
+var ruleResolver_1 = require("./ruleResolver");
+Object.defineProperty(exports, "resolveFieldDisposition", { enumerable: true, get: function () { return ruleResolver_1.resolvePathDisposition; } });
+//# sourceMappingURL=fieldDisposition.js.map

package/dist/rules/fieldDisposition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fieldDisposition.js","sourceRoot":"","sources":["../../src/rules/fieldDisposition.ts"],"names":[],"mappings":";;;AACA,+CAAmF;AAA1E,uHAAA,sBAAsB,OAA2B"}

package/dist/rules/pathRuleMatcher.d.ts

@@ -0,0 +1,19 @@
+import { PathPatternSegment } from '../util/pathParsing';
+import { PathRule, PathRuleMode } from '../types';
+type CompiledPathRule = {
+    segments: PathPatternSegment[];
+    mode: PathRuleMode;
+    path: string;
+};
+/**
+ * Matches configured path rules against traversal paths. Longest matching rule wins.
+ */
+export declare class PathRuleMatcher {
+    private readonly rules;
+    constructor(pathRules?: PathRule[]);
+    getMatchingRule(path: Array<string | number>): CompiledPathRule | undefined;
+    hasRules(): boolean;
+}
+export declare const EMPTY_PATH_RULE_MATCHER: PathRuleMatcher;
+export {};
+//# sourceMappingURL=pathRuleMatcher.d.ts.map

package/dist/rules/pathRuleMatcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pathRuleMatcher.d.ts","sourceRoot":"","sources":["../../src/rules/pathRuleMatcher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAElD,KAAK,gBAAgB,GAAG;IACtB,QAAQ,EAAE,kBAAkB,EAAE,CAAC;IAC/B,IAAI,EAAE,YAAY,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAUF;;GAEG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqB;gBAE/B,SAAS,CAAC,EAAE,QAAQ,EAAE;IAoBlC,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,GAAG,gBAAgB,GAAG,SAAS;IAI3E,QAAQ,IAAI,OAAO;CAGpB;AAED,eAAO,MAAM,uBAAuB,iBAAwB,CAAC"}

package/dist/rules/pathRuleMatcher.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EMPTY_PATH_RULE_MATCHER = exports.PathRuleMatcher = void 0;
+const pathParsing_1 = require("../util/pathParsing");
+const segmentsMatch = (rule, path) => {
+    if (rule.length !== path.length) {
+        return false;
+    }
+    return rule.every((segment, index) => segment === '*' || segment === path[index]);
+};
+/**
+ * Matches configured path rules against traversal paths. Longest matching rule wins.
+ */
+class PathRuleMatcher {
+    constructor(pathRules) {
+        this.rules = (pathRules !== null && pathRules !== void 0 ? pathRules : [])
+            .map((rule) => ({
+            segments: (0, pathParsing_1.parsePathRulePattern)(rule.path),
+            mode: rule.mode,
+            path: rule.path
+        }))
+            .filter((rule) => rule.segments.length > 0)
+            .sort((left, right) => {
+            if (right.segments.length !== left.segments.length) {
+                return right.segments.length - left.segments.length;
+            }
+            const wildcardCount = (segments) => segments.filter((segment) => segment === '*').length;
+            return wildcardCount(left.segments) - wildcardCount(right.segments);
+        });
+    }
+    getMatchingRule(path) {
+        return this.rules.find((rule) => segmentsMatch(rule.segments, path));
+    }
+    hasRules() {
+        return this.rules.length > 0;
+    }
+}
+exports.PathRuleMatcher = PathRuleMatcher;
+exports.EMPTY_PATH_RULE_MATCHER = new PathRuleMatcher();
+//# sourceMappingURL=pathRuleMatcher.js.map

package/dist/rules/pathRuleMatcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pathRuleMatcher.js","sourceRoot":"","sources":["../../src/rules/pathRuleMatcher.ts"],"names":[],"mappings":";;;AAAA,qDAA+E;AAS/E,MAAM,aAAa,GAAG,CAAC,IAA0B,EAAE,IAA4B,EAAW,EAAE;IAC1F,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AACpF,CAAC,CAAC;AAEF;;GAEG;AACH,MAAa,eAAe;IAG1B,YAAY,SAAsB;QAChC,IAAI,CAAC,KAAK,GAAG,CAAC,SAAS,aAAT,SAAS,cAAT,SAAS,GAAI,EAAE,CAAC;aAC3B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACd,QAAQ,EAAE,IAAA,kCAAoB,EAAC,IAAI,CAAC,IAAI,CAAC;YACzC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC,CAAC;aACF,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;aAC1C,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YACpB,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACnD,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YACtD,CAAC;YAED,MAAM,aAAa,GAAG,CAAC,QAA8B,EAAU,EAAE,CAC/D,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC;YAEvD,OAAO,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;IACP,CAAC;IAED,eAAe,CAAC,IAA4B;QAC1C,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAC/B,CAAC;CACF;AA9BD,0CA8BC;AAEY,QAAA,uBAAuB,GAAG,IAAI,eAAe,EAAE,CAAC"}

package/dist/rules/ruleResolver.d.ts

@@ -0,0 +1,65 @@
+import { CustomObjectManager } from './customObjectManager';
+import { PathRuleMatcher } from './pathRuleMatcher';
+import { SecretManager } from './secretManager';
+import { ValuePatternMatcher } from './valuePatternMatcher';
+import { CustomObject, DryRunPathRule, JsonValue, PathRule, SecretSpecifierValue } from '../types';
+export type KeyRule = 'remove' | 'opaque' | 'deep' | 'shallow';
+export type KeyRuleLabel = KeyRule | 'default';
+export type FieldDisposition = {
+    action: 'default';
+} | {
+    action: 'skip';
+} | {
+    action: 'remove';
+} | {
+    action: 'opaque';
+} | {
+    action: 'deep';
+} | {
+    action: 'shallow';
+} | {
+    action: 'pass-key-recurse';
+};
+type AttributionContext = {
+    before: JsonValue | undefined;
+    path: string;
+    segments: Array<string | number>;
+    objectKeys: string[];
+};
+/** Shared path-rule + pass-key disposition used during traversal. */
+export declare const resolvePathDisposition: (secretManager: SecretManager, pathRuleMatcher: PathRuleMatcher, key: string, pathSegments: Array<string | number>, forceDeepRedaction: boolean) => FieldDisposition;
+/**
+ * Single source of truth for field-level rule precedence shared by traversal and dry-run attribution.
+ * Precedence: schema → path rule → enclosing opaque/deep key → leaf key rule → value pattern → default.
+ */
+export declare class RuleResolver {
+    private readonly secretManager;
+    private readonly pathRuleMatcher;
+    private readonly valuePatternMatcher;
+    private readonly customObjectManager;
+    constructor(secretManager: SecretManager, pathRuleMatcher: PathRuleMatcher, valuePatternMatcher: ValuePatternMatcher, customObjectManager: CustomObjectManager);
+    resolvePathDisposition(pathSegments: Array<string | number>, key: string, forceDeepRedaction: boolean): FieldDisposition;
+    getMatchingPathRule(segments: Array<string | number>): PathRule | undefined;
+    shouldRemoveByKey(key: SecretSpecifierValue): boolean;
+    shouldOpaqueByKey(key: SecretSpecifierValue): boolean;
+    shouldTraverseContainerByKey(key: SecretSpecifierValue, forceDeepRedaction: boolean): boolean;
+    containerForceDeepRedaction(key: SecretSpecifierValue, forceDeepRedaction: boolean): boolean;
+    nestedObjectForceDeepRedaction(key: SecretSpecifierValue, forceDeepRedaction: boolean): boolean;
+    attributeKeyRule(path: string, action: DryRunPathRule['action'], key: SecretSpecifierValue): DryRunPathRule;
+    findEnclosingOpaqueOrDeepKey(objectKeys: string[]): {
+        key: string;
+        rule: 'opaque' | 'deep';
+    } | undefined;
+    resolveSchemaAttribution(context: AttributionContext): DryRunPathRule | undefined;
+    resolvePathRuleAttribution(context: AttributionContext): DryRunPathRule | undefined;
+    resolveEnclosingKeyAttribution(context: AttributionContext): DryRunPathRule | undefined;
+    resolveLeafKeyAttribution(context: AttributionContext): DryRunPathRule | undefined;
+    resolveValuePatternAttribution(context: AttributionContext): DryRunPathRule | undefined;
+    attributeRedactPath(before: JsonValue | undefined, path: string): DryRunPathRule;
+    attributeDeletePath(before: JsonValue | undefined, path: string): DryRunPathRule;
+    /** Returns the matching schema when a shaped object should be handled at this node. */
+    getMatchingSchema(value: JsonValue): CustomObject | undefined;
+}
+export declare const buildPathRules: (before: JsonValue | undefined, redactedPaths: readonly string[], deletedPaths: readonly string[], resolver: RuleResolver) => DryRunPathRule[];
+export {};
+//# sourceMappingURL=ruleResolver.d.ts.map

package/dist/rules/ruleResolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ruleResolver.d.ts","sourceRoot":"","sources":["../../src/rules/ruleResolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAI5D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EACL,YAAY,EACZ,cAAc,EAGd,SAAS,EACT,QAAQ,EAER,oBAAoB,EACrB,MAAM,UAAU,CAAC;AAElB,MAAM,MAAM,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAC;AAE/D,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,SAAS,CAAC;AAE/C,MAAM,MAAM,gBAAgB,GACxB;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAClB;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GACpB;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GACpB;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAClB;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,kBAAkB,CAAA;CAAE,CAAC;AAEnC,KAAK,kBAAkB,GAAG;IACxB,MAAM,EAAE,SAAS,GAAG,SAAS,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;IACjC,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB,CAAC;AAeF,qEAAqE;AACrE,eAAO,MAAM,sBAAsB,kBAClB,aAAa,mBACX,eAAe,OAC3B,MAAM,gBACG,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,sBAChB,OAAO,KAC1B,gBA4BF,CAAC;AAEF;;;GAGG;AACH,qBAAa,YAAY;IAErB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IACpC,OAAO,CAAC,QAAQ,CAAC,mBAAmB;gBAHnB,aAAa,EAAE,aAAa,EAC5B,eAAe,EAAE,eAAe,EAChC,mBAAmB,EAAE,mBAAmB,EACxC,mBAAmB,EAAE,mBAAmB;IAG3D,sBAAsB,CACpB,YAAY,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,EACpC,GAAG,EAAE,MAAM,EACX,kBAAkB,EAAE,OAAO,GAC1B,gBAAgB;IAInB,mBAAmB,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,GAAG,QAAQ,GAAG,SAAS;IAK3E,iBAAiB,CAAC,GAAG,EAAE,oBAAoB,GAAG,OAAO;IAIrD,iBAAiB,CAAC,GAAG,EAAE,oBAAoB,GAAG,OAAO;IAIrD,4BAA4B,CAAC,GAAG,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,OAAO,GAAG,OAAO;IAQ7F,2BAA2B,CAAC,GAAG,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,OAAO,GAAG,OAAO;IAI5F,8BAA8B,CAAC,GAAG,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,OAAO,GAAG,OAAO;IAI/F,gBAAgB,CACd,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC,EAChC,GAAG,EAAE,oBAAoB,GACxB,cAAc;IASjB,4BAA4B,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,CAAA;KAAE,GAAG,SAAS;IAYxG,wBAAwB,CAAC,OAAO,EAAE,kBAAkB,GAAG,cAAc,GAAG,SAAS;IA4BjF,0BAA0B,CAAC,OAAO,EAAE,kBAAkB,GAAG,cAAc,GAAG,SAAS;IAanF,8BAA8B,CAAC,OAAO,EAAE,kBAAkB,GAAG,cAAc,GAAG,SAAS;IAWvF,yBAAyB,CAAC,OAAO,EAAE,kBAAkB,GAAG,cAAc,GAAG,SAAS;IASlF,8BAA8B,CAAC,OAAO,EAAE,kBAAkB,GAAG,cAAc,GAAG,SAAS;IAgBvF,mBAAmB,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,cAAc;IA2BhF,mBAAmB,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,cAAc;IAehF,uFAAuF;IACvF,iBAAiB,CAAC,KAAK,EAAE,SAAS,GAAG,YAAY,GAAG,SAAS;CAG9D;AAED,eAAO,MAAM,cAAc,WACjB,SAAS,GAAG,SAAS,iBACd,SAAS,MAAM,EAAE,gBAClB,SAAS,MAAM,EAAE,YACrB,YAAY,KACrB,cAAc,EAGhB,CAAC"}

package/dist/rules/ruleResolver.js

@@ -0,0 +1,194 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildPathRules = exports.RuleResolver = exports.resolvePathDisposition = void 0;
+const objectRedactorHelpers_1 = require("../engine/objectRedactorHelpers");
+const jsonWalk_1 = require("../util/jsonWalk");
+const pathParsing_1 = require("../util/pathParsing");
+const types_1 = require("../types");
+const objectKeysFromPath = (segments) => segments.filter((segment) => typeof segment === 'string');
+const toPathRule = (path, action, rule, extras = {}) => (Object.assign({ path, action, rule }, extras));
+const patternForKey = (secretManager, key, rule) => secretManager.getKeyRulePattern(key, rule);
+/** Shared path-rule + pass-key disposition used during traversal. */
+const resolvePathDisposition = (secretManager, pathRuleMatcher, key, pathSegments, forceDeepRedaction) => {
+    const pathRule = pathRuleMatcher.getMatchingRule([...pathSegments, key]);
+    if ((pathRule === null || pathRule === void 0 ? void 0 : pathRule.mode) === 'pass') {
+        return { action: 'skip' };
+    }
+    if ((pathRule === null || pathRule === void 0 ? void 0 : pathRule.mode) === 'remove') {
+        return { action: 'remove' };
+    }
+    if ((pathRule === null || pathRule === void 0 ? void 0 : pathRule.mode) === 'opaque') {
+        return { action: 'opaque' };
+    }
+    if ((pathRule === null || pathRule === void 0 ? void 0 : pathRule.mode) === 'deep') {
+        return { action: 'deep' };
+    }
+    if ((pathRule === null || pathRule === void 0 ? void 0 : pathRule.mode) === 'shallow') {
+        return { action: 'shallow' };
+    }
+    if (forceDeepRedaction && secretManager.isPassKey(key)) {
+        return { action: 'pass-key-recurse' };
+    }
+    return { action: 'default' };
+};
+exports.resolvePathDisposition = resolvePathDisposition;
+/**
+ * Single source of truth for field-level rule precedence shared by traversal and dry-run attribution.
+ * Precedence: schema → path rule → enclosing opaque/deep key → leaf key rule → value pattern → default.
+ */
+class RuleResolver {
+    constructor(secretManager, pathRuleMatcher, valuePatternMatcher, customObjectManager) {
+        this.secretManager = secretManager;
+        this.pathRuleMatcher = pathRuleMatcher;
+        this.valuePatternMatcher = valuePatternMatcher;
+        this.customObjectManager = customObjectManager;
+    }
+    resolvePathDisposition(pathSegments, key, forceDeepRedaction) {
+        return (0, exports.resolvePathDisposition)(this.secretManager, this.pathRuleMatcher, key, pathSegments, forceDeepRedaction);
+    }
+    getMatchingPathRule(segments) {
+        const match = this.pathRuleMatcher.getMatchingRule(segments);
+        return (match === null || match === void 0 ? void 0 : match.mode) === 'pass' ? undefined : match;
+    }
+    shouldRemoveByKey(key) {
+        return this.secretManager.isDeleteSecretKey(key);
+    }
+    shouldOpaqueByKey(key) {
+        return this.secretManager.isFullSecretKey(key);
+    }
+    shouldTraverseContainerByKey(key, forceDeepRedaction) {
+        return (this.secretManager.isSecretKey(key) ||
+            this.secretManager.isDeepSecretKey(key) ||
+            forceDeepRedaction);
+    }
+    containerForceDeepRedaction(key, forceDeepRedaction) {
+        return forceDeepRedaction || this.secretManager.isDeepSecretKey(key);
+    }
+    nestedObjectForceDeepRedaction(key, forceDeepRedaction) {
+        return forceDeepRedaction || this.secretManager.isDeepSecretKey(key);
+    }
+    attributeKeyRule(path, action, key) {
+        var _a;
+        const rule = (_a = this.secretManager.classifyKeyRule(key)) !== null && _a !== void 0 ? _a : 'default';
+        if (rule === 'default') {
+            return toPathRule(path, action, rule);
+        }
+        return toPathRule(path, action, rule, { pattern: patternForKey(this.secretManager, key, rule) });
+    }
+    findEnclosingOpaqueOrDeepKey(objectKeys) {
+        for (let index = objectKeys.length - 2; index >= 0; index--) {
+            const key = objectKeys[index];
+            const rule = this.secretManager.classifyKeyRule(key);
+            if (rule === 'opaque' || rule === 'deep') {
+                return { key, rule };
+            }
+        }
+        return undefined;
+    }
+    resolveSchemaAttribution(context) {
+        const { parent, leaf } = (0, jsonWalk_1.getParentContext)(context.before, context.segments);
+        if (!(0, types_1.isJsonObject)(parent) || typeof leaf !== 'string') {
+            return undefined;
+        }
+        const schema = this.customObjectManager.getMatchingCustomObject(parent);
+        if (!schema || !(leaf in schema)) {
+            return undefined;
+        }
+        let pattern;
+        if (typeof schema[leaf] === 'string') {
+            const siblingSpecifier = (0, objectRedactorHelpers_1.getStringSpecifiedCustomObjectSecretKeyValueIfExists)(parent, schema, leaf);
+            if (siblingSpecifier !== undefined) {
+                const siblingRule = this.secretManager.classifyKeyRule(siblingSpecifier);
+                if (siblingRule && siblingRule !== 'default') {
+                    pattern = patternForKey(this.secretManager, siblingSpecifier, siblingRule);
+                }
+            }
+        }
+        return toPathRule(context.path, 'redact', 'schema', Object.assign(Object.assign({}, this.customObjectManager.getSchemaMetadata(schema)), (pattern ? { pattern } : {})));
+    }
+    resolvePathRuleAttribution(context) {
+        const match = this.getMatchingPathRule(context.segments);
+        if (!match) {
+            return undefined;
+        }
+        if (match.mode === 'remove') {
+            return toPathRule(context.path, 'delete', 'remove', { pattern: match.path });
+        }
+        return toPathRule(context.path, 'redact', match.mode, { pattern: match.path });
+    }
+    resolveEnclosingKeyAttribution(context) {
+        const enclosing = this.findEnclosingOpaqueOrDeepKey(context.objectKeys);
+        if (!enclosing) {
+            return undefined;
+        }
+        return toPathRule(context.path, 'redact', enclosing.rule, {
+            pattern: patternForKey(this.secretManager, enclosing.key, enclosing.rule)
+        });
+    }
+    resolveLeafKeyAttribution(context) {
+        const leafKey = context.objectKeys.at(-1);
+        if (!leafKey || !this.secretManager.classifyKeyRule(leafKey)) {
+            return undefined;
+        }
+        return this.attributeKeyRule(context.path, 'redact', leafKey);
+    }
+    resolveValuePatternAttribution(context) {
+        const value = (0, jsonWalk_1.getJsonValueAtPath)(context.before, context.segments);
+        if (value === undefined || (typeof value !== 'string' && typeof value !== 'number')) {
+            return undefined;
+        }
+        const match = this.valuePatternMatcher.findMatching((0, objectRedactorHelpers_1.toRedactablePrimitive)(value));
+        if (!match) {
+            return undefined;
+        }
+        return toPathRule(context.path, 'redact', 'value', {
+            pattern: this.valuePatternMatcher.formatPattern(match)
+        });
+    }
+    attributeRedactPath(before, path) {
+        const segments = (0, pathParsing_1.parseJsonPath)(path);
+        const context = {
+            before,
+            path,
+            segments,
+            objectKeys: objectKeysFromPath(segments)
+        };
+        const resolvers = [
+            () => this.resolveSchemaAttribution(context),
+            () => this.resolvePathRuleAttribution(context),
+            () => this.resolveEnclosingKeyAttribution(context),
+            () => this.resolveLeafKeyAttribution(context),
+            () => this.resolveValuePatternAttribution(context)
+        ];
+        for (const resolve of resolvers) {
+            const rule = resolve();
+            if (rule) {
+                return rule;
+            }
+        }
+        return toPathRule(path, 'redact', 'default');
+    }
+    attributeDeletePath(before, path) {
+        const segments = (0, pathParsing_1.parseJsonPath)(path);
+        const pathRule = this.getMatchingPathRule(segments);
+        if ((pathRule === null || pathRule === void 0 ? void 0 : pathRule.mode) === 'remove') {
+            return toPathRule(path, 'delete', 'remove', { pattern: pathRule.path });
+        }
+        const deleteKey = objectKeysFromPath(segments).at(-1);
+        if (deleteKey) {
+            return this.attributeKeyRule(path, 'delete', deleteKey);
+        }
+        return toPathRule(path, 'delete', 'default');
+    }
+    /** Returns the matching schema when a shaped object should be handled at this node. */
+    getMatchingSchema(value) {
+        return (0, types_1.isJsonObject)(value) ? this.customObjectManager.getMatchingCustomObject(value) : undefined;
+    }
+}
+exports.RuleResolver = RuleResolver;
+const buildPathRules = (before, redactedPaths, deletedPaths, resolver) => [
+    ...deletedPaths.map((path) => resolver.attributeDeletePath(before, path)),
+    ...redactedPaths.map((path) => resolver.attributeRedactPath(before, path))
+];
+exports.buildPathRules = buildPathRules;
+//# sourceMappingURL=ruleResolver.js.map

package/dist/rules/ruleResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ruleResolver.js","sourceRoot":"","sources":["../../src/rules/ruleResolver.ts"],"names":[],"mappings":";;;AACA,2EAA8H;AAC9H,+CAAwE;AACxE,qDAAoD;AAIpD,oCASkB;AAsBlB,MAAM,kBAAkB,GAAG,CAAC,QAAgC,EAAY,EAAE,CACxE,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAqB,EAAE,CAAC,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC;AAE/E,MAAM,UAAU,GAAG,CACjB,IAAY,EACZ,MAAgC,EAChC,IAAwB,EACxB,SAAkF,EAAE,EACpE,EAAE,CAAC,iBAAG,IAAI,EAAE,MAAM,EAAE,IAAI,IAAK,MAAM,EAAG,CAAC;AAEzD,MAAM,aAAa,GAAG,CAAC,aAA4B,EAAE,GAAyB,EAAE,IAAa,EAAsB,EAAE,CACnH,aAAa,CAAC,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAE7C,qEAAqE;AAC9D,MAAM,sBAAsB,GAAG,CACpC,aAA4B,EAC5B,eAAgC,EAChC,GAAW,EACX,YAAoC,EACpC,kBAA2B,EACT,EAAE;IACpB,MAAM,QAAQ,GAAG,eAAe,CAAC,eAAe,CAAC,CAAC,GAAG,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC;IAEzE,IAAI,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,IAAI,MAAK,MAAM,EAAE,CAAC;QAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED,IAAI,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,IAAI,MAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC9B,CAAC;IAED,IAAI,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,IAAI,MAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC9B,CAAC;IAED,IAAI,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,IAAI,MAAK,MAAM,EAAE,CAAC;QAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED,IAAI,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,IAAI,MAAK,SAAS,EAAE,CAAC;QACjC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC/B,CAAC;IAED,IAAI,kBAAkB,IAAI,aAAa,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;QACvD,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACxC,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC/B,CAAC,CAAC;AAlCW,QAAA,sBAAsB,0BAkCjC;AAEF;;;GAGG;AACH,MAAa,YAAY;IACvB,YACmB,aAA4B,EAC5B,eAAgC,EAChC,mBAAwC,EACxC,mBAAwC;QAHxC,kBAAa,GAAb,aAAa,CAAe;QAC5B,oBAAe,GAAf,eAAe,CAAiB;QAChC,wBAAmB,GAAnB,mBAAmB,CAAqB;QACxC,wBAAmB,GAAnB,mBAAmB,CAAqB;IACxD,CAAC;IAEJ,sBAAsB,CACpB,YAAoC,EACpC,GAAW,EACX,kBAA2B;QAE3B,OAAO,IAAA,8BAAsB,EAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,YAAY,EAAE,kBAAkB,CAAC,CAAC;IACjH,CAAC;IAED,mBAAmB,CAAC,QAAgC;QAClD,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC7D,OAAO,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,IAAI,MAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;IACpD,CAAC;IAED,iBAAiB,CAAC,GAAyB;QACzC,OAAO,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACnD,CAAC;IAED,iBAAiB,CAAC,GAAyB;QACzC,OAAO,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IACjD,CAAC;IAED,4BAA4B,CAAC,GAAyB,EAAE,kBAA2B;QACjF,OAAO,CACL,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC;YACnC,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,GAAG,CAAC;YACvC,kBAAkB,CACnB,CAAC;IACJ,CAAC;IAED,2BAA2B,CAAC,GAAyB,EAAE,kBAA2B;QAChF,OAAO,kBAAkB,IAAI,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IACvE,CAAC;IAED,8BAA8B,CAAC,GAAyB,EAAE,kBAA2B;QACnF,OAAO,kBAAkB,IAAI,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IACvE,CAAC;IAED,gBAAgB,CACd,IAAY,EACZ,MAAgC,EAChC,GAAyB;;QAEzB,MAAM,IAAI,GAAG,MAAA,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,GAAG,CAAC,mCAAI,SAAS,CAAC;QAClE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC;QAED,OAAO,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IACnG,CAAC;IAED,4BAA4B,CAAC,UAAoB;QAC/C,KAAK,IAAI,KAAK,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;YAC5D,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;YAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;YACrD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACzC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;YACvB,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,wBAAwB,CAAC,OAA2B;QAClD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAA,2BAAgB,EAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC5E,IAAI,CAAC,IAAA,oBAAY,EAAC,MAAM,CAAC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,mBAAmB,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,EAAE,CAAC;YACjC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,OAA2B,CAAC;QAChC,IAAI,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;YACrC,MAAM,gBAAgB,GAAG,IAAA,4EAAoD,EAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YACpG,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;gBACnC,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC;gBACzE,IAAI,WAAW,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;oBAC7C,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,aAAa,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;gBAC7E,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,kCAC7C,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,MAAM,CAAC,GAClD,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAC/B,CAAC;IACL,CAAC;IAED,0BAA0B,CAAC,OAA2B;QACpD,MAAM,KAAK,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5B,OAAO,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/E,CAAC;QAED,OAAO,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAqC,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAClH,CAAC;IAED,8BAA8B,CAAC,OAA2B;QACxD,MAAM,SAAS,GAAG,IAAI,CAAC,4BAA4B,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACxE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,IAAI,EAAE;YACxD,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC;SAC1E,CAAC,CAAC;IACL,CAAC;IAED,yBAAyB,CAAC,OAA2B;QACnD,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7D,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAChE,CAAC;IAED,8BAA8B,CAAC,OAA2B;QACxD,MAAM,KAAK,GAAG,IAAA,6BAAkB,EAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QACnE,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,EAAE,CAAC;YACpF,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,IAAA,6CAAqB,EAAC,KAAsB,CAAC,CAAC,CAAC;QACnG,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE;YACjD,OAAO,EAAE,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,KAAK,CAAC;SACvD,CAAC,CAAC;IACL,CAAC;IAED,mBAAmB,CAAC,MAA6B,EAAE,IAAY;QAC7D,MAAM,QAAQ,GAAG,IAAA,2BAAa,EAAC,IAAI,CAAC,CAAC;QACrC,MAAM,OAAO,GAAuB;YAClC,MAAM;YACN,IAAI;YACJ,QAAQ;YACR,UAAU,EAAE,kBAAkB,CAAC,QAAQ,CAAC;SACzC,CAAC;QAEF,MAAM,SAAS,GAAG;YAChB,GAAG,EAAE,CAAC,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC;YAC5C,GAAG,EAAE,CAAC,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC;YAC9C,GAAG,EAAE,CAAC,IAAI,CAAC,8BAA8B,CAAC,OAAO,CAAC;YAClD,GAAG,EAAE,CAAC,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC;YAC7C,GAAG,EAAE,CAAC,IAAI,CAAC,8BAA8B,CAAC,OAAO,CAAC;SAC1C,CAAC;QAEX,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;YACvB,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC/C,CAAC;IAED,mBAAmB,CAAC,MAA6B,EAAE,IAAY;QAC7D,MAAM,QAAQ,GAAG,IAAA,2BAAa,EAAC,IAAI,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,IAAI,MAAK,QAAQ,EAAE,CAAC;YAChC,OAAO,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,SAAS,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC1D,CAAC;QAED,OAAO,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC/C,CAAC;IAED,uFAAuF;IACvF,iBAAiB,CAAC,KAAgB;QAChC,OAAO,IAAA,oBAAY,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnG,CAAC;CACF;AAjMD,oCAiMC;AAEM,MAAM,cAAc,GAAG,CAC5B,MAA6B,EAC7B,aAAgC,EAChC,YAA+B,EAC/B,QAAsB,EACJ,EAAE,CAAC;IACrB,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACzE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;CAC3E,CAAC;AARW,QAAA,cAAc,kBAQzB"}

package/dist/rules/secretManager.d.ts

@@ -0,0 +1,32 @@
+import { SecretManagerConfig, SecretSpecifierValue } from '../types';
+type KeyRule = 'remove' | 'opaque' | 'deep' | 'shallow';
+/**
+ * Utility class for managing secrets and determining if a given value is a secret of any type. If no secrets of
+ * any type are provided in the configuration then all values are considered secrets (but not deep or full secrets).
+ */
+export declare class SecretManager {
+    private secretKeys?;
+    private deepSecretKeys?;
+    private fullSecretKeys?;
+    private deleteSecretKeys?;
+    private passKeys?;
+    constructor(config: SecretManagerConfig);
+    /**
+     * Determines if the given key is a secret. If no secrets of any type are provided then this function
+     * always returns true.
+     */
+    isSecretKey(key: SecretSpecifierValue): boolean;
+    isDeepSecretKey(key: SecretSpecifierValue): boolean;
+    isFullSecretKey(key: SecretSpecifierValue): boolean;
+    isDeleteSecretKey(key: SecretSpecifierValue): boolean;
+    /** Determines if a key is allowlisted and should not be redacted under deep parents. */
+    isPassKey(key: SecretSpecifierValue): boolean;
+    getKeyRulePattern(key: SecretSpecifierValue, rule: KeyRule): string | undefined;
+    classifyKeyRule(key: SecretSpecifierValue): KeyRule | 'default' | null;
+    private matchesRule;
+    private regexListFor;
+    private static findMatchingRegex;
+    private static matchesAnyRegex;
+}
+export {};
+//# sourceMappingURL=secretManager.d.ts.map

package/dist/rules/secretManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretManager.d.ts","sourceRoot":"","sources":["../../src/rules/secretManager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAErE,KAAK,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAC;AAIxD;;;GAGG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,UAAU,CAAC,CAAW;IAC9B,OAAO,CAAC,cAAc,CAAC,CAAW;IAClC,OAAO,CAAC,cAAc,CAAC,CAAW;IAClC,OAAO,CAAC,gBAAgB,CAAC,CAAW;IACpC,OAAO,CAAC,QAAQ,CAAC,CAAW;gBAEhB,MAAM,EAAE,mBAAmB;IAavC;;;OAGG;IACI,WAAW,CAAC,GAAG,EAAE,oBAAoB,GAAG,OAAO;IAQ/C,eAAe,CAAC,GAAG,EAAE,oBAAoB,GAAG,OAAO;IAInD,eAAe,CAAC,GAAG,EAAE,oBAAoB,GAAG,OAAO;IAInD,iBAAiB,CAAC,GAAG,EAAE,oBAAoB,GAAG,OAAO;IAI5D,wFAAwF;IACjF,SAAS,CAAC,GAAG,EAAE,oBAAoB,GAAG,OAAO;IAI7C,iBAAiB,CAAC,GAAG,EAAE,oBAAoB,EAAE,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS;IAK/E,eAAe,CAAC,GAAG,EAAE,oBAAoB,GAAG,OAAO,GAAG,SAAS,GAAG,IAAI;IAc7E,OAAO,CAAC,WAAW;IAKnB,OAAO,CAAC,YAAY;IAapB,OAAO,CAAC,MAAM,CAAC,iBAAiB;IAIhC,OAAO,CAAC,MAAM,CAAC,eAAe;CAG/B"}

package/dist/rules/secretManager.js

@@ -0,0 +1,85 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecretManager = void 0;
+const regexUtils_1 = require("../util/regexUtils");
+const KEY_RULE_PRECEDENCE = ['remove', 'opaque', 'deep', 'shallow'];
+/**
+ * Utility class for managing secrets and determining if a given value is a secret of any type. If no secrets of
+ * any type are provided in the configuration then all values are considered secrets (but not deep or full secrets).
+ */
+class SecretManager {
+    constructor(config) {
+        this.deepSecretKeys = config.deepSecretKeys;
+        this.fullSecretKeys = config.fullSecretKeys;
+        this.deleteSecretKeys = config.deleteSecretKeys;
+        this.passKeys = config.passKeys;
+        if (!config.secretKeys && (config.deepSecretKeys || config.fullSecretKeys || config.deleteSecretKeys)) {
+            this.secretKeys = [];
+        }
+        else {
+            this.secretKeys = config.secretKeys;
+        }
+    }
+    /**
+     * Determines if the given key is a secret. If no secrets of any type are provided then this function
+     * always returns true.
+     */
+    isSecretKey(key) {
+        if (!this.secretKeys) {
+            return true;
+        }
+        return this.matchesRule(key, 'shallow');
+    }
+    isDeepSecretKey(key) {
+        return this.matchesRule(key, 'deep');
+    }
+    isFullSecretKey(key) {
+        return this.matchesRule(key, 'opaque');
+    }
+    isDeleteSecretKey(key) {
+        return this.matchesRule(key, 'remove');
+    }
+    /** Determines if a key is allowlisted and should not be redacted under deep parents. */
+    isPassKey(key) {
+        return !!this.passKeys && SecretManager.matchesAnyRegex(key, this.passKeys);
+    }
+    getKeyRulePattern(key, rule) {
+        const match = SecretManager.findMatchingRegex(key, this.regexListFor(rule));
+        return match ? (0, regexUtils_1.formatRegExp)(match) : undefined;
+    }
+    classifyKeyRule(key) {
+        for (const rule of KEY_RULE_PRECEDENCE) {
+            if (this.matchesRule(key, rule)) {
+                return rule;
+            }
+        }
+        if (this.isSecretKey(key)) {
+            return this.secretKeys ? 'shallow' : 'default';
+        }
+        return null;
+    }
+    matchesRule(key, rule) {
+        const regexes = this.regexListFor(rule);
+        return !!regexes && SecretManager.matchesAnyRegex(key, regexes);
+    }
+    regexListFor(rule) {
+        switch (rule) {
+            case 'remove':
+                return this.deleteSecretKeys;
+            case 'opaque':
+                return this.fullSecretKeys;
+            case 'deep':
+                return this.deepSecretKeys;
+            case 'shallow':
+                return this.secretKeys;
+        }
+    }
+    static findMatchingRegex(key, regexes) {
+        return regexes === null || regexes === void 0 ? void 0 : regexes.find((regex) => regex.test(String(key)));
+    }
+    static matchesAnyRegex(value, regexes) {
+        return regexes.some((regex) => regex.test(String(value)));
+    }
+}
+exports.SecretManager = SecretManager;
+//# sourceMappingURL=secretManager.js.map

package/dist/rules/secretManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretManager.js","sourceRoot":"","sources":["../../src/rules/secretManager.ts"],"names":[],"mappings":";;;AAAA,mDAAkD;AAKlD,MAAM,mBAAmB,GAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;AAE/E;;;GAGG;AACH,MAAa,aAAa;IAOxB,YAAY,MAA2B;QACrC,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QAC5C,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QAC5C,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,CAAC;QAChD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAEhC,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACtG,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QACtC,CAAC;IACH,CAAC;IAED;;;OAGG;IACI,WAAW,CAAC,GAAyB;QAC1C,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC1C,CAAC;IAEM,eAAe,CAAC,GAAyB;QAC9C,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IAEM,eAAe,CAAC,GAAyB;QAC9C,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACzC,CAAC;IAEM,iBAAiB,CAAC,GAAyB;QAChD,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED,wFAAwF;IACjF,SAAS,CAAC,GAAyB;QACxC,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,aAAa,CAAC,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9E,CAAC;IAEM,iBAAiB,CAAC,GAAyB,EAAE,IAAa;QAC/D,MAAM,KAAK,GAAG,aAAa,CAAC,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5E,OAAO,KAAK,CAAC,CAAC,CAAC,IAAA,yBAAY,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjD,CAAC;IAEM,eAAe,CAAC,GAAyB;QAC9C,KAAK,MAAM,IAAI,IAAI,mBAAmB,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;gBAChC,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QACjD,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,WAAW,CAAC,GAAyB,EAAE,IAAa;QAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACxC,OAAO,CAAC,CAAC,OAAO,IAAI,aAAa,CAAC,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAClE,CAAC;IAEO,YAAY,CAAC,IAAa;QAChC,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,QAAQ;gBACX,OAAO,IAAI,CAAC,gBAAgB,CAAC;YAC/B,KAAK,QAAQ;gBACX,OAAO,IAAI,CAAC,cAAc,CAAC;YAC7B,KAAK,MAAM;gBACT,OAAO,IAAI,CAAC,cAAc,CAAC;YAC7B,KAAK,SAAS;gBACZ,OAAO,IAAI,CAAC,UAAU,CAAC;QAC3B,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,iBAAiB,CAAC,GAAyB,EAAE,OAAkB;QAC5E,OAAO,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC;IAEO,MAAM,CAAC,eAAe,CAAC,KAA2B,EAAE,OAAiB;QAC3E,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC;CACF;AA7FD,sCA6FC"}

package/dist/rules/valuePatternMatcher.d.ts

@@ -0,0 +1,15 @@
+import { RedactablePrimitive } from '../types';
+/**
+ * Opt-in regex matching against scalar **values** (not key names).
+ * Applied only when key-based rules do not already redact the field.
+ */
+export declare class ValuePatternMatcher {
+    private readonly patterns;
+    constructor(patterns?: RegExp[]);
+    hasPatterns(): boolean;
+    findMatching(value: RedactablePrimitive | undefined): RegExp | undefined;
+    formatPattern(regex: RegExp): string;
+}
+/** Shared empty matcher for tests and configs without value patterns. */
+export declare const EMPTY_VALUE_PATTERN_MATCHER: ValuePatternMatcher;
+//# sourceMappingURL=valuePatternMatcher.d.ts.map

package/dist/rules/valuePatternMatcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"valuePatternMatcher.d.ts","sourceRoot":"","sources":["../../src/rules/valuePatternMatcher.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAE/C;;;GAGG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAW;gBAExB,QAAQ,CAAC,EAAE,MAAM,EAAE;IAIxB,WAAW,IAAI,OAAO;IAItB,YAAY,CAAC,KAAK,EAAE,mBAAmB,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS;IASxE,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;CAG5C;AAED,yEAAyE;AACzE,eAAO,MAAM,2BAA2B,qBAA4B,CAAC"}