gavio 0.1.0

package/src/interceptors/pii/guard.ts

@@ -0,0 +1,201 @@
+/**
+ * PiiGuard — the pre/post interceptor that detects and redacts PII.
+ *
+ * Pipeline rule (privacy): PII is scanned on every request before it reaches
+ * the provider. Detected entities are redacted/masked/tagged or blocked. In
+ * REDACT mode the original values are restored in the response.
+ */
+
+import type { InterceptorContext } from '../../context.js'
+import { PiiBlockedError } from '../../errors.js'
+import type { GavioRequest } from '../../request.js'
+import type { GavioResponse } from '../../response.js'
+import { PiiMode, Sensitivity } from '../../types.js'
+import type { Message } from '../../types.js'
+import type { Interceptor } from '../base.js'
+import { ScanContext } from './context.js'
+import { matchLength } from './match.js'
+import type { PiiMatch } from './match.js'
+import { scannerTier } from './scanner.js'
+import type { PiiScanner } from './scanner.js'
+import { defaultScanners } from './scanners/index.js'
+
+const STATE_KEY = 'pii_replacements'
+
+// Confidence floor per sensitivity level — matches below the floor are ignored.
+const CONFIDENCE_FLOOR: Record<Sensitivity, number> = {
+  [Sensitivity.STRICT]: 0.0,
+  [Sensitivity.BALANCED]: 0.6,
+  [Sensitivity.PERMISSIVE]: 0.9,
+}
+
+export interface PiiGuardOptions {
+  scanners?: PiiScanner[]
+  sensitivity?: Sensitivity
+  mode?: PiiMode
+  restoreOnResponse?: boolean
+  logEntityTypes?: boolean
+  dryRun?: boolean
+  locale?: string
+  language?: string
+}
+
+class PiiGuard implements Interceptor {
+  readonly name = 'pii_guard'
+  readonly dryRunSafe = true
+
+  private readonly scanners: PiiScanner[]
+  private readonly sensitivity: Sensitivity
+  private readonly mode: PiiMode
+  private readonly restoreOnResponse: boolean
+  private readonly logEntityTypes: boolean
+  private readonly ownDryRun: boolean
+  private readonly locale: string
+  private readonly language: string
+
+  constructor(options: PiiGuardOptions = {}) {
+    this.scanners = options.scanners ?? defaultScanners()
+    this.sensitivity = options.sensitivity ?? Sensitivity.STRICT
+    this.mode = options.mode ?? PiiMode.REDACT
+    this.restoreOnResponse = options.restoreOnResponse ?? true
+    this.logEntityTypes = options.logEntityTypes ?? true
+    this.ownDryRun = options.dryRun ?? false
+    this.locale = options.locale ?? 'NL'
+    this.language = options.language ?? 'en'
+  }
+
+  async before(request: GavioRequest, ctx: InterceptorContext): Promise<GavioRequest> {
+    const scanCtx = new ScanContext(this.language, this.locale)
+    const floor = CONFIDENCE_FLOOR[this.sensitivity]
+
+    const newMessages: Message[] = []
+    const allTypes: string[] = []
+    const replacements: Record<string, string> =
+      (ctx.state[STATE_KEY] as Record<string, string> | undefined) ?? {}
+
+    const isDryRun = this.ownDryRun || ctx.dryRun
+
+    for (const message of request.messages) {
+      const content = message.content ?? ''
+      const matches = await this.scanText(content, scanCtx, floor)
+      for (const m of matches) allTypes.push(m.entityType)
+
+      if (matches.length > 0 && this.mode === PiiMode.BLOCK) {
+        const types = matches.map((m) => m.entityType)
+        throw new PiiBlockedError(types)
+      }
+
+      let redacted = content
+      if (matches.length > 0 && !isDryRun) {
+        redacted = this.apply(content, matches, replacements)
+      }
+
+      newMessages.push({ ...message, content: redacted })
+    }
+
+    if (allTypes.length > 0) {
+      ctx.recordPii(allTypes)
+      if (this.logEntityTypes) {
+        const unique = Array.from(new Set(allTypes)).sort()
+        // eslint-disable-next-line no-console
+        console.info(`[gavio:pii] detected entity types: ${unique.join(', ')}`)
+      }
+    }
+
+    if (this.restoreOnResponse && Object.keys(replacements).length > 0) {
+      ctx.state[STATE_KEY] = replacements
+    }
+
+    if (isDryRun) return request
+    return request.copyWithMessages(newMessages)
+  }
+
+  async after(
+    response: GavioResponse,
+    ctx: InterceptorContext,
+  ): Promise<GavioResponse> {
+    if (!this.restoreOnResponse || this.mode !== PiiMode.REDACT) return response
+    const replacements = ctx.state[STATE_KEY] as Record<string, string> | undefined
+    if (!replacements || Object.keys(replacements).length === 0) return response
+    let content = response.content
+    for (const [token, original] of Object.entries(replacements)) {
+      content = content.split(token).join(original)
+    }
+    if (content === response.content) return response
+    return response.copyWithContent(content)
+  }
+
+  private async scanText(
+    text: string,
+    scanCtx: ScanContext,
+    floor: number,
+  ): Promise<PiiMatch[]> {
+    const raw: PiiMatch[] = []
+    const ordered = [...this.scanners].sort((a, b) => scannerTier(a) - scannerTier(b))
+    for (const scanner of ordered) {
+      const found = await scanner.scan(text, scanCtx)
+      for (const match of found) {
+        if (match.confidence >= floor) raw.push(match)
+      }
+    }
+    return resolveOverlaps(raw)
+  }
+
+  private apply(
+    text: string,
+    matches: PiiMatch[],
+    replacements: Record<string, string>,
+  ): string {
+    // Replace right-to-left so earlier offsets stay valid.
+    const ordered = [...matches].sort((a, b) => b.start - a.start)
+    let out = text
+    for (const match of ordered) {
+      const token = this.tokenFor(match)
+      if (this.mode === PiiMode.REDACT) {
+        replacements[token] = match.value
+      }
+      out = out.slice(0, match.start) + token + out.slice(match.end)
+    }
+    return out
+  }
+
+  private tokenFor(match: PiiMatch): string {
+    if (this.mode === PiiMode.MASK) {
+      return '*'.repeat(Math.max(matchLength(match), 1))
+    }
+    if (this.mode === PiiMode.TAG) {
+      return `<${match.entityType}>${match.value}</${match.entityType}>`
+    }
+    // REDACT (default)
+    return match.replacement || `[${match.entityType}]`
+  }
+}
+
+/**
+ * Drop lower-priority matches that overlap a kept one.
+ *
+ * Sort by start, then by descending span length (prefer the longer match),
+ * then by confidence. Greedily keep non-overlapping matches.
+ */
+export function resolveOverlaps(matches: PiiMatch[]): PiiMatch[] {
+  const ordered = [...matches].sort((a, b) => {
+    if (a.start !== b.start) return a.start - b.start
+    const lenDiff = matchLength(b) - matchLength(a)
+    if (lenDiff !== 0) return lenDiff
+    return b.confidence - a.confidence
+  })
+  const kept: PiiMatch[] = []
+  let occupiedEnd = -1
+  for (const match of ordered) {
+    if (match.start >= occupiedEnd) {
+      kept.push(match)
+      occupiedEnd = match.end
+    }
+  }
+  return kept
+}
+
+/** Factory: build a PiiGuard interceptor. */
+export function piiGuard(options: PiiGuardOptions = {}): Interceptor {
+  return new PiiGuard(options)
+}

package/src/interceptors/pii/index.ts

@@ -0,0 +1,21 @@
+/** PII guard public surface. */
+
+export { piiGuard, resolveOverlaps } from './guard.js'
+export type { PiiGuardOptions } from './guard.js'
+export { ScanContext } from './context.js'
+export { ScannerRegistry, scannerTier } from './scanner.js'
+export type { PiiScanner } from './scanner.js'
+export { makeMatch, matchLength } from './match.js'
+export type { PiiMatch } from './match.js'
+export { PiiMode, Sensitivity } from '../../types.js'
+export {
+  bsnScanner,
+  creditCardScanner,
+  emailScanner,
+  ibanScanner,
+  ipAddressScanner,
+  phoneScanner,
+  secretScanner,
+  ssnScanner,
+  defaultScanners,
+} from './scanners/index.js'

package/src/interceptors/pii/match.ts

@@ -0,0 +1,43 @@
+/** PiiMatch — a single detected PII entity within a span of text. */
+
+/**
+ * One detected entity.
+ *
+ * `start`/`end` are half-open character offsets into the scanned text.
+ * `replacement` is the placeholder used in REDACT mode; `value` is the
+ * original text (never logged — used only for restore).
+ */
+export interface PiiMatch {
+  entityType: string
+  start: number
+  end: number
+  value: string
+  confidence: number
+  /** e.g. '[EMAIL_1]'. */
+  replacement: string
+}
+
+export function matchLength(m: PiiMatch): number {
+  return m.end - m.start
+}
+
+export function makeMatch(init: {
+  entityType: string
+  start: number
+  end: number
+  value: string
+  confidence?: number
+  replacement: string
+}): PiiMatch {
+  if (init.start < 0 || init.end < init.start) {
+    throw new Error(`Invalid PiiMatch span: start=${init.start}, end=${init.end}`)
+  }
+  return {
+    entityType: init.entityType,
+    start: init.start,
+    end: init.end,
+    value: init.value,
+    confidence: init.confidence ?? 1.0,
+    replacement: init.replacement,
+  }
+}

package/src/interceptors/pii/scanner.ts

@@ -0,0 +1,54 @@
+/** PiiScanner interface and ScannerRegistry. */
+
+import type { ScanContext } from './context.js'
+import type { PiiMatch } from './match.js'
+
+/**
+ * Detects one class of PII entity within text.
+ *
+ * Scanners are tiered: tier 1 = regex, tier 2 = NER/ML, tier 3 = LLM. Lower
+ * tiers run first so cheap deterministic matches are found before expensive
+ * ones. v0.1.0 ships only tier-1 regex scanners.
+ */
+export interface PiiScanner {
+  /** e.g. 'EMAIL', 'IBAN', 'BSN'. */
+  readonly entityType: string
+  /** default: 1 */
+  readonly tier?: 1 | 2 | 3
+  scan(text: string, ctx: ScanContext): PiiMatch[] | Promise<PiiMatch[]>
+  /** default: 1.0 */
+  readonly confidence?: number
+  supportsLanguage?(lang: string): boolean
+  supportsLocale?(locale: string): boolean
+}
+
+export function scannerTier(s: PiiScanner): number {
+  return s.tier ?? 1
+}
+
+/** Registry of scanners, discoverable by entity type at runtime. */
+export class ScannerRegistry {
+  private scanners: PiiScanner[] = []
+
+  constructor(scanners?: PiiScanner[]) {
+    for (const s of scanners ?? []) this.register(s)
+  }
+
+  register(scanner: PiiScanner): this {
+    this.scanners.push(scanner)
+    return this
+  }
+
+  /** Return scanners sorted by tier (lowest first). */
+  all(): PiiScanner[] {
+    return [...this.scanners].sort((a, b) => scannerTier(a) - scannerTier(b))
+  }
+
+  byEntityType(entityType: string): PiiScanner[] {
+    return this.scanners.filter((s) => s.entityType === entityType)
+  }
+
+  get size(): number {
+    return this.scanners.length
+  }
+}

package/src/interceptors/pii/scanners/bsn.ts

@@ -0,0 +1,44 @@
+/** Dutch BSN scanner — regex + 11-proef (eleven-test) checksum. */
+
+import type { ScanContext } from '../context.js'
+import { makeMatch } from '../match.js'
+import type { PiiMatch } from '../match.js'
+import type { PiiScanner } from '../scanner.js'
+
+// BSN is 8 or 9 digits; we validate the 9-digit form with the 11-proef.
+const BSN = /\b\d{9}\b/g
+
+/** 11-proef: sum of digit*weight (9,8,...,2,-1) must be divisible by 11. */
+export function validBsn(digits: string): boolean {
+  if (digits.length !== 9) return false
+  const weights = [9, 8, 7, 6, 5, 4, 3, 2, -1]
+  let total = 0
+  for (let i = 0; i < 9; i++) {
+    total += Number(digits[i]) * weights[i]!
+  }
+  return total % 11 === 0
+}
+
+export function bsnScanner(): PiiScanner {
+  return {
+    entityType: 'BSN',
+    tier: 1,
+    scan(text: string, ctx: ScanContext): PiiMatch[] {
+      const out: PiiMatch[] = []
+      for (const m of text.matchAll(BSN)) {
+        if (!validBsn(m[0])) continue
+        const idx = ctx.nextIndex('BSN')
+        out.push(
+          makeMatch({
+            entityType: 'BSN',
+            start: m.index,
+            end: m.index + m[0].length,
+            value: m[0],
+            replacement: `[BSN_${idx}]`,
+          }),
+        )
+      }
+      return out
+    },
+  }
+}

package/src/interceptors/pii/scanners/credit-card.ts

@@ -0,0 +1,52 @@
+/** Credit card scanner — regex candidate + Luhn checksum validation. */
+
+import type { ScanContext } from '../context.js'
+import { makeMatch } from '../match.js'
+import type { PiiMatch } from '../match.js'
+import type { PiiScanner } from '../scanner.js'
+
+// 13–19 digits, optionally separated by single spaces or hyphens.
+const CARD = /\b(?:\d[ -]?){12,18}\d\b/g
+
+export function luhnValid(number: string): boolean {
+  const digits: number[] = []
+  for (const c of number) {
+    if (c >= '0' && c <= '9') digits.push(c.charCodeAt(0) - 48)
+  }
+  if (digits.length < 13 || digits.length > 19) return false
+  let checksum = 0
+  const parity = digits.length % 2
+  for (let i = 0; i < digits.length; i++) {
+    let d = digits[i]!
+    if (i % 2 === parity) {
+      d *= 2
+      if (d > 9) d -= 9
+    }
+    checksum += d
+  }
+  return checksum % 10 === 0
+}
+
+export function creditCardScanner(): PiiScanner {
+  return {
+    entityType: 'CREDIT_CARD',
+    tier: 1,
+    scan(text: string, ctx: ScanContext): PiiMatch[] {
+      const out: PiiMatch[] = []
+      for (const m of text.matchAll(CARD)) {
+        if (!luhnValid(m[0])) continue
+        const idx = ctx.nextIndex('CREDIT_CARD')
+        out.push(
+          makeMatch({
+            entityType: 'CREDIT_CARD',
+            start: m.index,
+            end: m.index + m[0].length,
+            value: m[0],
+            replacement: `[CREDIT_CARD_${idx}]`,
+          }),
+        )
+      }
+      return out
+    },
+  }
+}

package/src/interceptors/pii/scanners/email.ts

@@ -0,0 +1,31 @@
+/** Email address scanner (RFC 5322 pragmatic subset). */
+
+import type { ScanContext } from '../context.js'
+import { makeMatch } from '../match.js'
+import type { PiiMatch } from '../match.js'
+import type { PiiScanner } from '../scanner.js'
+
+const EMAIL = /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g
+
+export function emailScanner(): PiiScanner {
+  return {
+    entityType: 'EMAIL',
+    tier: 1,
+    scan(text: string, ctx: ScanContext): PiiMatch[] {
+      const out: PiiMatch[] = []
+      for (const m of text.matchAll(EMAIL)) {
+        const idx = ctx.nextIndex('EMAIL')
+        out.push(
+          makeMatch({
+            entityType: 'EMAIL',
+            start: m.index,
+            end: m.index + m[0].length,
+            value: m[0],
+            replacement: `[EMAIL_${idx}]`,
+          }),
+        )
+      }
+      return out
+    },
+  }
+}

package/src/interceptors/pii/scanners/iban.ts

@@ -0,0 +1,60 @@
+/** IBAN scanner — regex candidate + ISO 13616 mod-97 checksum validation. */
+
+import type { ScanContext } from '../context.js'
+import { makeMatch } from '../match.js'
+import type { PiiMatch } from '../match.js'
+import type { PiiScanner } from '../scanner.js'
+
+// Candidate: 2 letters, 2 check digits, 11–30 alphanumerics (optionally spaced).
+const IBAN = /\b[A-Z]{2}\d{2}(?:[ ]?[A-Z0-9]){11,30}\b/g
+
+/** ISO 13616 mod-97: rearrange, convert letters to numbers, check %97 == 1. */
+export function validIban(candidate: string): boolean {
+  const cleaned = candidate.replace(/ /g, '').toUpperCase()
+  if (cleaned.length < 15) return false
+  const rearranged = cleaned.slice(4) + cleaned.slice(0, 4)
+  let digits = ''
+  for (const ch of rearranged) {
+    if (ch >= 'A' && ch <= 'Z') {
+      digits += (ch.charCodeAt(0) - 55).toString()
+    } else if (ch >= '0' && ch <= '9') {
+      digits += ch
+    } else {
+      return false
+    }
+  }
+  return mod97(digits) === 1
+}
+
+/** Compute n % 97 over a large numeric string without BigInt overflow concerns. */
+function mod97(numeric: string): number {
+  let remainder = 0
+  for (const ch of numeric) {
+    remainder = (remainder * 10 + (ch.charCodeAt(0) - 48)) % 97
+  }
+  return remainder
+}
+
+export function ibanScanner(): PiiScanner {
+  return {
+    entityType: 'IBAN',
+    tier: 1,
+    scan(text: string, ctx: ScanContext): PiiMatch[] {
+      const out: PiiMatch[] = []
+      for (const m of text.matchAll(IBAN)) {
+        if (!validIban(m[0])) continue
+        const idx = ctx.nextIndex('IBAN')
+        out.push(
+          makeMatch({
+            entityType: 'IBAN',
+            start: m.index,
+            end: m.index + m[0].length,
+            value: m[0],
+            replacement: `[IBAN_${idx}]`,
+          }),
+        )
+      }
+      return out
+    },
+  }
+}

package/src/interceptors/pii/scanners/index.ts

@@ -0,0 +1,35 @@
+/** Built-in tier-1 (regex) PII scanners. */
+
+import type { PiiScanner } from '../scanner.js'
+import { bsnScanner } from './bsn.js'
+import { creditCardScanner } from './credit-card.js'
+import { emailScanner } from './email.js'
+import { ibanScanner } from './iban.js'
+import { ipAddressScanner } from './ip-address.js'
+import { phoneScanner } from './phone.js'
+import { secretScanner } from './secret.js'
+import { ssnScanner } from './ssn.js'
+
+export { bsnScanner, validBsn } from './bsn.js'
+export { creditCardScanner, luhnValid } from './credit-card.js'
+export { emailScanner } from './email.js'
+export { ibanScanner, validIban } from './iban.js'
+export { ipAddressScanner } from './ip-address.js'
+export { phoneScanner } from './phone.js'
+export type { PhoneScannerOptions } from './phone.js'
+export { secretScanner } from './secret.js'
+export { ssnScanner } from './ssn.js'
+
+/** The default scanner set wired into PiiGuard when none is supplied. */
+export function defaultScanners(): PiiScanner[] {
+  return [
+    secretScanner(),
+    emailScanner(),
+    ibanScanner(),
+    bsnScanner(),
+    creditCardScanner(),
+    ssnScanner(),
+    phoneScanner(),
+    ipAddressScanner(),
+  ]
+}

package/src/interceptors/pii/scanners/ip-address.ts

@@ -0,0 +1,41 @@
+/** IP address scanner — IPv4 and IPv6, validated via node:net isIP. */
+
+import { isIP } from 'node:net'
+import type { ScanContext } from '../context.js'
+import { makeMatch } from '../match.js'
+import type { PiiMatch } from '../match.js'
+import type { PiiScanner } from '../scanner.js'
+
+const IPV4 = String.raw`(?:\d{1,3}\.){3}\d{1,3}`
+// Permissive IPv6 candidate — allows empty groups for "::" compression. False
+// positives are filtered by isIP validation below.
+const IPV6 = String.raw`(?:[A-Fa-f0-9]{0,4}:){2,7}[A-Fa-f0-9]{0,4}`
+const IP = new RegExp(String.raw`(?<![\w.])(?:${IPV6}|${IPV4})(?![\w.])`, 'g')
+
+function validIp(candidate: string): boolean {
+  return isIP(candidate) !== 0
+}
+
+export function ipAddressScanner(): PiiScanner {
+  return {
+    entityType: 'IP_ADDRESS',
+    tier: 1,
+    scan(text: string, ctx: ScanContext): PiiMatch[] {
+      const out: PiiMatch[] = []
+      for (const m of text.matchAll(IP)) {
+        if (!validIp(m[0])) continue
+        const idx = ctx.nextIndex('IP_ADDRESS')
+        out.push(
+          makeMatch({
+            entityType: 'IP_ADDRESS',
+            start: m.index,
+            end: m.index + m[0].length,
+            value: m[0],
+            replacement: `[IP_ADDRESS_${idx}]`,
+          }),
+        )
+      }
+      return out
+    },
+  }
+}

package/src/interceptors/pii/scanners/phone.ts

@@ -0,0 +1,46 @@
+/** Phone number scanner — E.164 and common national formats. */
+
+import type { ScanContext } from '../context.js'
+import { makeMatch } from '../match.js'
+import type { PiiMatch } from '../match.js'
+import type { PiiScanner } from '../scanner.js'
+
+// E.164 (+CC...) or national groupings with separators. A digit-count filter
+// (7–15) below avoids matching short numbers / years.
+const PHONE =
+  /(?<![\w.])(?:\+?\d{1,3}[ .-]?)?(?:\(\d{1,4}\)[ .-]?)?\d{2,4}(?:[ .-]?\d{2,4}){2,4}(?![\w])/g
+
+export interface PhoneScannerOptions {
+  locales?: string[]
+}
+
+export function phoneScanner(options: PhoneScannerOptions = {}): PiiScanner {
+  const locales = options.locales ?? ['NL', 'DE', 'GB', 'US']
+  return {
+    entityType: 'PHONE',
+    tier: 1,
+    confidence: 0.85,
+    scan(text: string, ctx: ScanContext): PiiMatch[] {
+      const out: PiiMatch[] = []
+      for (const m of text.matchAll(PHONE)) {
+        const digitCount = (m[0].match(/\d/g) ?? []).length
+        if (digitCount < 7 || digitCount > 15) continue
+        const idx = ctx.nextIndex('PHONE')
+        out.push(
+          makeMatch({
+            entityType: 'PHONE',
+            start: m.index,
+            end: m.index + m[0].length,
+            value: m[0],
+            confidence: 0.85,
+            replacement: `[PHONE_${idx}]`,
+          }),
+        )
+      }
+      return out
+    },
+    supportsLocale(locale: string): boolean {
+      return locales.includes(locale.toUpperCase())
+    },
+  }
+}

package/src/interceptors/pii/scanners/secret.ts

@@ -0,0 +1,51 @@
+/**
+ * Secret / credential scanner (F-SEC-04).
+ *
+ * Detects API keys, tokens, JWTs, PEM private keys, and database connection
+ * strings. These must never leave the device, so SecretScanner is tier 1 and
+ * runs by default.
+ */
+
+import type { ScanContext } from '../context.js'
+import { makeMatch } from '../match.js'
+import type { PiiMatch } from '../match.js'
+import type { PiiScanner } from '../scanner.js'
+
+// [label, pattern] — ordered most-specific first. All patterns are global.
+const PATTERNS: Array<[string, RegExp]> = [
+  ['ANTHROPIC_KEY', /\bsk-ant-[A-Za-z0-9_-]{20,}\b/g],
+  ['OPENAI_KEY', /\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\b/g],
+  ['AWS_ACCESS_KEY', /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g],
+  ['GITHUB_TOKEN', /\bgh[pousr]_[A-Za-z0-9]{36,}\b/g],
+  ['JWT', /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g],
+  ['PRIVATE_KEY', /-----BEGIN (?:RSA |EC |OPENSSH |PGP )?PRIVATE KEY-----/g],
+  [
+    'DB_CONNECTION_STRING',
+    /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis):\/\/[^\s"']+/g,
+  ],
+]
+
+export function secretScanner(): PiiScanner {
+  return {
+    entityType: 'SECRET',
+    tier: 1,
+    scan(text: string, ctx: ScanContext): PiiMatch[] {
+      const out: PiiMatch[] = []
+      for (const [, pattern] of PATTERNS) {
+        for (const m of text.matchAll(pattern)) {
+          const idx = ctx.nextIndex('SECRET')
+          out.push(
+            makeMatch({
+              entityType: 'SECRET',
+              start: m.index,
+              end: m.index + m[0].length,
+              value: m[0],
+              replacement: `[SECRET_${idx}]`,
+            }),
+          )
+        }
+      }
+      return out
+    },
+  }
+}