pw-sanitizer 0.1.0

package/dist/redact/json-walker.js

@@ -0,0 +1,164 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.walkAndRedact = walkAndRedact;
+const matcher_js_1 = require("./matcher.js");
+/**
+ * Recursively traverses a JSON-like structure and redacts any string values
+ * that match the provided patterns.
+ *
+ * Traversal rules:
+ * - **Arrays**: each element is walked with an indexed path (e.g. `items[0].token`).
+ * - **Objects**: each property is visited; the key is tested against patterns.
+ * - **Strings**: tested via {@link redactValue}. If not redacted, the value is also
+ *   tested as embedded JSON (a string that is itself a JSON object/array) and, if
+ *   parseable, the inner structure is walked recursively and re-serialised.
+ * - **Base64 JSON bodies**: if an object has a `Content-Type: application/json`
+ *   sibling and a body-like field containing base64 data, the decoded JSON is
+ *   walked and the field is re-encoded after redaction.
+ * - **Numbers / booleans**: copied through as-is (never redacted).
+ * - **`null` / `undefined`**: returned unchanged.
+ *
+ * The input is **never mutated** — a new tree is produced for each call.
+ *
+ * @param obj      - The JSON value to walk. Typically a parsed `trace.json` array
+ *   or the `window.__pw_report_data__` object extracted from an HTML report.
+ * @param patterns - Ordered list of {@link RedactPattern}s to apply.
+ * @param config   - The redact config, forwarded to {@link redactValue} for placeholder resolution.
+ * @returns A {@link WalkResult} containing the transformed tree, total redaction count,
+ *   and the list of individual {@link RedactionMatch}es.
+ */
+function walkAndRedact(obj, patterns, config) {
+    const matches = [];
+    let count = 0;
+    function walk(node, keyPath) {
+        if (node === null || node === undefined) {
+            return node;
+        }
+        if (Array.isArray(node)) {
+            // Mutate array in place to save memory
+            for (let i = 0; i < node.length; i++) {
+                node[i] = walk(node[i], `${keyPath}[${i}]`);
+            }
+            return node;
+        }
+        if (typeof node === 'object') {
+            const objNode = node;
+            let hasJsonContentType = false;
+            const bodyKeys = [];
+            for (const [key, value] of Object.entries(objNode)) {
+                const currentPath = keyPath ? `${keyPath}.${key}` : key;
+                const keyLower = key.toLowerCase();
+                // Check for content-type indicating JSON
+                if ((keyLower === 'content-type' || keyLower === 'contenttype') &&
+                    typeof value === 'string' &&
+                    value.toLowerCase().includes('application/json')) {
+                    hasJsonContentType = true;
+                }
+                else if (['body', 'content', 'data', 'payload'].includes(keyLower) &&
+                    typeof value === 'string' &&
+                    isLikelyBase64(value)) {
+                    bodyKeys.push(key);
+                }
+                if (typeof value === 'string') {
+                    // Try to redact the string value
+                    const redactionResult = (0, matcher_js_1.redactValue)(key, value, patterns, config);
+                    if (redactionResult.redacted) {
+                        objNode[key] = redactionResult.value;
+                        count++;
+                        matches.push({
+                            keyPath: currentPath,
+                            patternId: redactionResult.matchedPatternId,
+                        });
+                    }
+                    else {
+                        // Check if the string is embedded JSON
+                        const parsed = tryParseJson(value);
+                        if (parsed !== undefined) {
+                            const innerResult = walk(parsed, currentPath);
+                            objNode[key] = JSON.stringify(innerResult);
+                        }
+                        // else string remains unchanged
+                    }
+                }
+                else if (typeof value === 'object' && value !== null) {
+                    // Recurse into nested objects/arrays
+                    objNode[key] = walk(value, currentPath);
+                }
+                // Booleans and numbers remain unchanged
+            }
+            // Handle base64-encoded JSON bodies
+            if (hasJsonContentType && bodyKeys.length > 0) {
+                for (const bodyKey of bodyKeys) {
+                    const bodyValue = objNode[bodyKey];
+                    if (typeof bodyValue === 'string') {
+                        const decoded = tryDecodeBase64Json(bodyValue);
+                        if (decoded !== undefined) {
+                            const innerPath = keyPath ? `${keyPath}.${bodyKey}` : bodyKey;
+                            const redacted = walk(decoded, innerPath);
+                            objNode[bodyKey] = Buffer.from(JSON.stringify(redacted)).toString('base64');
+                        }
+                    }
+                }
+            }
+            return objNode;
+        }
+        return node;
+    }
+    const result = walk(obj, '');
+    return { result, count, matches };
+}
+/**
+ * Attempts to parse a string as JSON.
+ *
+ * Uses a fast heuristic to skip non-JSON strings: the trimmed value must start
+ * with `{` and end with `}`, or start with `[` and end with `]`.
+ *
+ * @param value - The string to attempt to parse.
+ * @returns The parsed value, or `undefined` if parsing fails or the value
+ *   does not look like JSON.
+ */
+function tryParseJson(value) {
+    // Quick heuristic: only try if it starts with { or [
+    const trimmed = value.trim();
+    if ((trimmed.startsWith('{') && trimmed.endsWith('}')) ||
+        (trimmed.startsWith('[') && trimmed.endsWith(']'))) {
+        try {
+            return JSON.parse(value);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    return undefined;
+}
+/**
+ * Heuristic check for whether a string looks like base64-encoded data.
+ *
+ * Considers a string base64 if it is at least 4 characters long and consists
+ * entirely of the base64 alphabet (`A-Za-z0-9+/`) with optional `=` padding.
+ *
+ * @param value - The string to test.
+ * @returns `true` if the value matches the base64 character set.
+ */
+function isLikelyBase64(value) {
+    if (value.length < 4)
+        return false;
+    // Base64 uses A-Z, a-z, 0-9, +, /, = (padding)
+    return /^[A-Za-z0-9+/]+=*$/.test(value);
+}
+/**
+ * Attempts to decode a base64 string and parse the result as JSON.
+ *
+ * @param value - A base64-encoded string (UTF-8 JSON content expected).
+ * @returns The parsed JSON value, or `undefined` if decoding or parsing fails.
+ */
+function tryDecodeBase64Json(value) {
+    try {
+        const decoded = Buffer.from(value, 'base64').toString('utf-8');
+        return JSON.parse(decoded);
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=json-walker.js.map

package/dist/redact/json-walker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-walker.js","sourceRoot":"","sources":["../../src/redact/json-walker.ts"],"names":[],"mappings":";;AAiCA,sCAgGC;AA3HD,6CAA2C;AAE3C;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,SAAgB,aAAa,CAC3B,GAAY,EACZ,QAAyB,EACzB,MAAoB;IAEpB,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,SAAS,IAAI,CAAC,IAAa,EAAE,OAAe;QAC1C,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,uCAAuC;YACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACrC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAG,IAA+B,CAAC;YAChD,IAAI,kBAAkB,GAAG,KAAK,CAAC;YAC/B,MAAM,QAAQ,GAAa,EAAE,CAAC;YAE9B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBACnD,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;gBACxD,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;gBAEnC,yCAAyC;gBACzC,IACE,CAAC,QAAQ,KAAK,cAAc,IAAI,QAAQ,KAAK,aAAa,CAAC;oBAC3D,OAAO,KAAK,KAAK,QAAQ;oBACzB,KAAK,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAChD,CAAC;oBACD,kBAAkB,GAAG,IAAI,CAAC;gBAC5B,CAAC;qBAAM,IACL,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBACzD,OAAO,KAAK,KAAK,QAAQ;oBACzB,cAAc,CAAC,KAAK,CAAC,EACrB,CAAC;oBACD,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACrB,CAAC;gBAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;oBAC9B,iCAAiC;oBACjC,MAAM,eAAe,GAAG,IAAA,wBAAW,EAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;oBAClE,IAAI,eAAe,CAAC,QAAQ,EAAE,CAAC;wBAC7B,OAAO,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC,KAAK,CAAC;wBACrC,KAAK,EAAE,CAAC;wBACR,OAAO,CAAC,IAAI,CAAC;4BACX,OAAO,EAAE,WAAW;4BACpB,SAAS,EAAE,eAAe,CAAC,gBAAiB;yBAC7C,CAAC,CAAC;oBACL,CAAC;yBAAM,CAAC;wBACN,uCAAuC;wBACvC,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;wBACnC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;4BACzB,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;4BAC9C,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;wBAC7C,CAAC;wBACD,gCAAgC;oBAClC,CAAC;gBACH,CAAC;qBAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;oBACvD,qCAAqC;oBACrC,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;gBAC1C,CAAC;gBACD,wCAAwC;YAC1C,CAAC;YAED,oCAAoC;YACpC,IAAI,kBAAkB,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;oBAC/B,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;oBACnC,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;wBAClC,MAAM,OAAO,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;wBAC/C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;4BAC1B,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;4BAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;4BAC1C,OAAO,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,IAAI,CAC5B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CACzB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;wBACvB,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC7B,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AACpC,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,YAAY,CAAC,KAAa;IACjC,qDAAqD;IACrD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IACE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAClD,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAClD,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAID;;;;;;;;GAQG;AACH,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,+CAA+C;IAC/C,OAAO,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/redact/matcher.d.ts

@@ -0,0 +1,25 @@
+import type { RedactConfig, RedactPattern, RedactionResult } from '../config/types.js';
+/**
+ * Evaluates a key/value pair against the full list of patterns and returns
+ * a {@link RedactionResult} describing whether — and how — it was redacted.
+ *
+ * Matching rules:
+ * - Pattern with only `key`: key must match.
+ * - Pattern with only `valuePattern`: value must match.
+ * - Pattern with both: **both** must match (AND logic).
+ * - Patterns are tested in order; the **first** match wins.
+ *
+ * @remarks
+ * This function intentionally **never logs the matched value** to prevent
+ * secrets from appearing in log output. Only the key name and pattern ID
+ * are logged at verbose level.
+ *
+ * @param key      - The field name (e.g. header name, JSON property key).
+ * @param value    - The current string value of the field.
+ * @param patterns - Ordered list of {@link RedactPattern}s to test against.
+ * @param config   - The redact config, used to resolve placeholder / partial-redaction settings.
+ * @returns A {@link RedactionResult} with `redacted: false` if no pattern matched,
+ *   or `redacted: true` with the replacement value and matched pattern ID.
+ */
+export declare function redactValue(key: string, value: string, patterns: RedactPattern[], config: RedactConfig): RedactionResult;
+//# sourceMappingURL=matcher.d.ts.map

package/dist/redact/matcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"matcher.d.ts","sourceRoot":"","sources":["../../src/redact/matcher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAgEvF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,WAAW,CACzB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,aAAa,EAAE,EACzB,MAAM,EAAE,YAAY,GACnB,eAAe,CAoDjB"}

package/dist/redact/matcher.js

@@ -0,0 +1,130 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.redactValue = redactValue;
+const logger_js_1 = require("../logger.js");
+/**
+ * Tests whether an event key matches a pattern's `key` field.
+ *
+ * - `string` → exact case-insensitive comparison
+ * - `RegExp` → tested against the raw key string
+ *
+ * @param key - The key to test (e.g. a header name or JSON property name).
+ * @param patternKey - The matcher from {@link RedactPattern.key}.
+ * @returns `true` if the key satisfies the matcher.
+ */
+function matchesKey(key, patternKey) {
+    if (typeof patternKey === 'string') {
+        return key.toLowerCase() === patternKey.toLowerCase();
+    }
+    return patternKey.test(key);
+}
+/**
+ * Tests whether a string value satisfies a pattern's `valuePattern` regexp.
+ *
+ * @param value - The string value to test.
+ * @param valuePattern - The regexp from {@link RedactPattern.valuePattern}.
+ * @returns `true` if the regexp matches.
+ */
+function matchesValue(value, valuePattern) {
+    return valuePattern.test(value);
+}
+/**
+ * Applies partial redaction to a string value.
+ *
+ * Keeps the first `prefix` characters and last `suffix` characters visible,
+ * replacing everything in between with `'***'`.
+ * If the value is too short for partial redaction (`length <= prefix + suffix`),
+ * the entire value is replaced with `'***'`.
+ *
+ * @param value  - The original string value to partially redact.
+ * @param prefix - Number of leading characters to keep visible.
+ * @param suffix - Number of trailing characters to keep visible.
+ * @returns The partially redacted string.
+ *
+ * @example
+ * ```ts
+ * applyPartialRedaction('Bearer eyJhbGci', 4, 4); // 'Bear***lci'
+ * applyPartialRedaction('short', 4, 4);           // '***'  (too short)
+ * ```
+ */
+function applyPartialRedaction(value, prefix, suffix) {
+    if (value.length <= prefix + suffix) {
+        // Value too short for partial redaction — redact entirely
+        return '***';
+    }
+    const start = value.substring(0, prefix);
+    const end = value.substring(value.length - suffix);
+    return `${start}***${end}`;
+}
+/**
+ * Evaluates a key/value pair against the full list of patterns and returns
+ * a {@link RedactionResult} describing whether — and how — it was redacted.
+ *
+ * Matching rules:
+ * - Pattern with only `key`: key must match.
+ * - Pattern with only `valuePattern`: value must match.
+ * - Pattern with both: **both** must match (AND logic).
+ * - Patterns are tested in order; the **first** match wins.
+ *
+ * @remarks
+ * This function intentionally **never logs the matched value** to prevent
+ * secrets from appearing in log output. Only the key name and pattern ID
+ * are logged at verbose level.
+ *
+ * @param key      - The field name (e.g. header name, JSON property key).
+ * @param value    - The current string value of the field.
+ * @param patterns - Ordered list of {@link RedactPattern}s to test against.
+ * @param config   - The redact config, used to resolve placeholder / partial-redaction settings.
+ * @returns A {@link RedactionResult} with `redacted: false` if no pattern matched,
+ *   or `redacted: true` with the replacement value and matched pattern ID.
+ */
+function redactValue(key, value, patterns, config) {
+    for (const pattern of patterns) {
+        let keyMatches = true;
+        let valueMatches = true;
+        // Check key match (if pattern specifies a key)
+        if (pattern.key !== undefined) {
+            keyMatches = matchesKey(key, pattern.key);
+        }
+        // Check value match (if pattern specifies a valuePattern)
+        if (pattern.valuePattern !== undefined) {
+            valueMatches = matchesValue(value, pattern.valuePattern);
+        }
+        // If pattern has only key: key must match
+        // If pattern has only valuePattern: value must match
+        // If pattern has both: both must match (AND logic)
+        if (pattern.key !== undefined && pattern.valuePattern !== undefined) {
+            // AND logic: both must match
+            if (!keyMatches || !valueMatches)
+                continue;
+        }
+        else if (pattern.key !== undefined) {
+            if (!keyMatches)
+                continue;
+        }
+        else if (pattern.valuePattern !== undefined) {
+            if (!valueMatches)
+                continue;
+        }
+        else {
+            // No matchers (should have been caught by validation)
+            continue;
+        }
+        // Match found — apply redaction
+        logger_js_1.logger.verbose(`Redacting key "${key}" matched by pattern "${pattern.id}"`);
+        let redactedValue;
+        if (config.partialRedaction) {
+            redactedValue = applyPartialRedaction(value, config.partialRedaction.prefix, config.partialRedaction.suffix);
+        }
+        else {
+            redactedValue = config.placeholder ?? '[REDACTED]';
+        }
+        return {
+            redacted: true,
+            value: redactedValue,
+            matchedPatternId: pattern.id,
+        };
+    }
+    return { redacted: false, value };
+}
+//# sourceMappingURL=matcher.js.map

package/dist/redact/matcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"matcher.js","sourceRoot":"","sources":["../../src/redact/matcher.ts"],"names":[],"mappings":";;AAsFA,kCAyDC;AA9ID,4CAAsC;AAEtC;;;;;;;;;GASG;AACH,SAAS,UAAU,CAAC,GAAW,EAAE,UAA2B;IAC1D,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,GAAG,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,WAAW,EAAE,CAAC;IACxD,CAAC;IACD,OAAO,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,KAAa,EAAE,YAAoB;IACvD,OAAO,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAClC,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAS,qBAAqB,CAC5B,KAAa,EACb,MAAc,EACd,MAAc;IAEd,IAAI,KAAK,CAAC,MAAM,IAAI,MAAM,GAAG,MAAM,EAAE,CAAC;QACpC,0DAA0D;QAC1D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;IACnD,OAAO,GAAG,KAAK,MAAM,GAAG,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,SAAgB,WAAW,CACzB,GAAW,EACX,KAAa,EACb,QAAyB,EACzB,MAAoB;IAEpB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,UAAU,GAAG,IAAI,CAAC;QACtB,IAAI,YAAY,GAAG,IAAI,CAAC;QAExB,+CAA+C;QAC/C,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC9B,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5C,CAAC;QAED,0DAA0D;QAC1D,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACvC,YAAY,GAAG,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QAC3D,CAAC;QAED,0CAA0C;QAC1C,qDAAqD;QACrD,mDAAmD;QACnD,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACpE,6BAA6B;YAC7B,IAAI,CAAC,UAAU,IAAI,CAAC,YAAY;gBAAE,SAAS;QAC7C,CAAC;aAAM,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YACrC,IAAI,CAAC,UAAU;gBAAE,SAAS;QAC5B,CAAC;aAAM,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAC9C,IAAI,CAAC,YAAY;gBAAE,SAAS;QAC9B,CAAC;aAAM,CAAC;YACN,sDAAsD;YACtD,SAAS;QACX,CAAC;QAED,gCAAgC;QAChC,kBAAM,CAAC,OAAO,CAAC,kBAAkB,GAAG,yBAAyB,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;QAE5E,IAAI,aAAqB,CAAC;QAC1B,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC5B,aAAa,GAAG,qBAAqB,CACnC,KAAK,EACL,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAC9B,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAC/B,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,aAAa,GAAG,MAAM,CAAC,WAAW,IAAI,YAAY,CAAC;QACrD,CAAC;QAED,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,aAAa;YACpB,gBAAgB,EAAE,OAAO,CAAC,EAAE;SAC7B,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AACpC,CAAC"}

package/dist/redact/pattern-loader.d.ts

@@ -0,0 +1,25 @@
+import type { RedactPattern } from '../config/types.js';
+/**
+ * Thrown when a pattern file path listed in `redact.patternFiles` cannot be
+ * resolved or loaded.
+ */
+export declare class PatternFileNotFoundError extends Error {
+    constructor(filePath: string);
+}
+/**
+ * Loads an array of {@link RedactPattern}s from an external file.
+ *
+ * Supported formats:
+ * - **`.json`** — parsed with `JSON.parse`; RegExp values are not supported
+ *   (use string patterns instead, which are matched case-insensitively).
+ * - **`.ts` / `.js`** — loaded via dynamic `import()`; the file must export a
+ *   default array of {@link RedactPattern} objects (supports `RegExp` fields).
+ *   If a `.ts` file fails to import (e.g. no `tsx` / `ts-node` available),
+ *   a compiled `.js` sibling at the same path is tried automatically.
+ *
+ * @param filePath - Absolute or relative path to the pattern file.
+ * @returns Array of {@link RedactPattern}s defined in the file.
+ * @throws {@link PatternFileNotFoundError} if the file does not exist or cannot be loaded.
+ */
+export declare function loadPatternFile(filePath: string): Promise<RedactPattern[]>;
+//# sourceMappingURL=pattern-loader.d.ts.map

package/dist/redact/pattern-loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pattern-loader.d.ts","sourceRoot":"","sources":["../../src/redact/pattern-loader.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGxD;;;GAGG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,QAAQ,EAAE,MAAM;CAI7B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAkDhF"}

package/dist/redact/pattern-loader.js

@@ -0,0 +1,111 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PatternFileNotFoundError = void 0;
+exports.loadPatternFile = loadPatternFile;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const logger_js_1 = require("../logger.js");
+/**
+ * Thrown when a pattern file path listed in `redact.patternFiles` cannot be
+ * resolved or loaded.
+ */
+class PatternFileNotFoundError extends Error {
+    constructor(filePath) {
+        super(`redact.patternFiles: file not found: ${filePath}`);
+        this.name = 'PatternFileNotFoundError';
+    }
+}
+exports.PatternFileNotFoundError = PatternFileNotFoundError;
+/**
+ * Loads an array of {@link RedactPattern}s from an external file.
+ *
+ * Supported formats:
+ * - **`.json`** — parsed with `JSON.parse`; RegExp values are not supported
+ *   (use string patterns instead, which are matched case-insensitively).
+ * - **`.ts` / `.js`** — loaded via dynamic `import()`; the file must export a
+ *   default array of {@link RedactPattern} objects (supports `RegExp` fields).
+ *   If a `.ts` file fails to import (e.g. no `tsx` / `ts-node` available),
+ *   a compiled `.js` sibling at the same path is tried automatically.
+ *
+ * @param filePath - Absolute or relative path to the pattern file.
+ * @returns Array of {@link RedactPattern}s defined in the file.
+ * @throws {@link PatternFileNotFoundError} if the file does not exist or cannot be loaded.
+ */
+async function loadPatternFile(filePath) {
+    const absolutePath = path.resolve(filePath);
+    if (!fs.existsSync(absolutePath)) {
+        throw new PatternFileNotFoundError(filePath);
+    }
+    const ext = path.extname(absolutePath).toLowerCase();
+    if (ext === '.json') {
+        const content = fs.readFileSync(absolutePath, 'utf-8');
+        const parsed = JSON.parse(content);
+        if (!Array.isArray(parsed)) {
+            logger_js_1.logger.fatal(`Pattern file ${filePath} must export an array of RedactPattern objects.`);
+        }
+        return parsed;
+    }
+    // .ts or .js — dynamic import
+    try {
+        const module = await import(absolutePath);
+        const patterns = module.default ?? module;
+        if (!Array.isArray(patterns)) {
+            logger_js_1.logger.fatal(`Pattern file ${filePath} must export a default array of RedactPattern objects.`);
+        }
+        return patterns;
+    }
+    catch (err) {
+        // If .ts file failed, try .js sibling
+        if (ext === '.ts') {
+            const jsSibling = absolutePath.replace(/\.ts$/, '.js');
+            if (fs.existsSync(jsSibling)) {
+                try {
+                    const module = await import(jsSibling);
+                    const patterns = module.default ?? module;
+                    if (!Array.isArray(patterns)) {
+                        logger_js_1.logger.fatal(`Pattern file ${jsSibling} must export a default array of RedactPattern objects.`);
+                    }
+                    return patterns;
+                }
+                catch {
+                    throw new PatternFileNotFoundError(`Failed to load pattern file from both ${filePath} and ${jsSibling}`);
+                }
+            }
+        }
+        throw new PatternFileNotFoundError(`Failed to load pattern file ${filePath}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+//# sourceMappingURL=pattern-loader.js.map

package/dist/redact/pattern-loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pattern-loader.js","sourceRoot":"","sources":["../../src/redact/pattern-loader.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,0CAkDC;AAjFD,4CAA8B;AAC9B,gDAAkC;AAElC,4CAAsC;AAEtC;;;GAGG;AACH,MAAa,wBAAyB,SAAQ,KAAK;IACjD,YAAY,QAAgB;QAC1B,KAAK,CAAC,wCAAwC,QAAQ,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AALD,4DAKC;AAED;;;;;;;;;;;;;;GAcG;AACI,KAAK,UAAU,eAAe,CAAC,QAAgB;IACpD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE5C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;IAErD,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAoB,CAAC;QACtD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,kBAAM,CAAC,KAAK,CAAC,gBAAgB,QAAQ,iDAAiD,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,8BAA8B;IAC9B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC;QAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,kBAAM,CAAC,KAAK,CAAC,gBAAgB,QAAQ,wDAAwD,CAAC,CAAC;QACjG,CAAC;QACD,OAAO,QAA2B,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,sCAAsC;QACtC,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;YAClB,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACvD,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC7B,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;oBACvC,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC;oBAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;wBAC7B,kBAAM,CAAC,KAAK,CAAC,gBAAgB,SAAS,wDAAwD,CAAC,CAAC;oBAClG,CAAC;oBACD,OAAO,QAA2B,CAAC;gBACrC,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,IAAI,wBAAwB,CAChC,yCAAyC,QAAQ,QAAQ,SAAS,EAAE,CACrE,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,IAAI,wBAAwB,CAChC,+BAA+B,QAAQ,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC/F,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/redact/pattern-registry.d.ts

@@ -0,0 +1,17 @@
+import type { RedactConfig, RedactPattern } from '../config/types.js';
+/**
+ * Builds the complete, deduplicated list of {@link RedactPattern}s for a run.
+ *
+ * Merge order:
+ * 1. All patterns loaded from `config.patternFiles` (in declaration order)
+ * 2. Inline patterns from `config.patterns`
+ *
+ * No built-in patterns are ever injected — only what the user explicitly declared.
+ * If the same `id` appears more than once, a warning is emitted and the **last**
+ * definition wins (last-write-wins semantics).
+ *
+ * @param config - The `redact` section of the sanitizer config.
+ * @returns Deduplicated array of validated {@link RedactPattern}s, ready for use.
+ */
+export declare function buildPatternRegistry(config: RedactConfig): Promise<RedactPattern[]>;
+//# sourceMappingURL=pattern-registry.d.ts.map

package/dist/redact/pattern-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pattern-registry.d.ts","sourceRoot":"","sources":["../../src/redact/pattern-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAKtE;;;;;;;;;;;;;GAaG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,aAAa,EAAE,CAAC,CA6C1B"}

package/dist/redact/pattern-registry.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildPatternRegistry = buildPatternRegistry;
+const pattern_loader_js_1 = require("./pattern-loader.js");
+const validator_js_1 = require("../config/validator.js");
+const logger_js_1 = require("../logger.js");
+/**
+ * Builds the complete, deduplicated list of {@link RedactPattern}s for a run.
+ *
+ * Merge order:
+ * 1. All patterns loaded from `config.patternFiles` (in declaration order)
+ * 2. Inline patterns from `config.patterns`
+ *
+ * No built-in patterns are ever injected — only what the user explicitly declared.
+ * If the same `id` appears more than once, a warning is emitted and the **last**
+ * definition wins (last-write-wins semantics).
+ *
+ * @param config - The `redact` section of the sanitizer config.
+ * @returns Deduplicated array of validated {@link RedactPattern}s, ready for use.
+ */
+async function buildPatternRegistry(config) {
+    const allPatterns = [];
+    // Load from pattern files first
+    if (config.patternFiles) {
+        const files = Array.isArray(config.patternFiles)
+            ? config.patternFiles
+            : [config.patternFiles];
+        for (const filePath of files) {
+            const patterns = await (0, pattern_loader_js_1.loadPatternFile)(filePath);
+            allPatterns.push(...patterns);
+        }
+    }
+    // Then inline patterns
+    if (config.patterns) {
+        allPatterns.push(...config.patterns);
+    }
+    // Validate each pattern
+    for (const pattern of allPatterns) {
+        (0, validator_js_1.validatePattern)(pattern);
+    }
+    // Check for duplicate IDs and warn
+    const seenIds = new Map();
+    for (let i = 0; i < allPatterns.length; i++) {
+        const pattern = allPatterns[i];
+        const previousIndex = seenIds.get(pattern.id);
+        if (previousIndex !== undefined) {
+            logger_js_1.logger.warn(`Duplicate pattern id "${pattern.id}" — last definition wins (index ${i} replaces ${previousIndex}).`);
+        }
+        seenIds.set(pattern.id, i);
+    }
+    // Deduplicate: last-write-wins
+    const deduped = new Map();
+    for (const pattern of allPatterns) {
+        deduped.set(pattern.id, pattern);
+    }
+    return Array.from(deduped.values());
+}
+//# sourceMappingURL=pattern-registry.js.map

package/dist/redact/pattern-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pattern-registry.js","sourceRoot":"","sources":["../../src/redact/pattern-registry.ts"],"names":[],"mappings":";;AAmBA,oDA+CC;AAjED,2DAAsD;AACtD,yDAAyD;AACzD,4CAAsC;AAEtC;;;;;;;;;;;;;GAaG;AACI,KAAK,UAAU,oBAAoB,CACxC,MAAoB;IAEpB,MAAM,WAAW,GAAoB,EAAE,CAAC;IAExC,gCAAgC;IAChC,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC;YAC9C,CAAC,CAAC,MAAM,CAAC,YAAY;YACrB,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAE1B,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;YAC7B,MAAM,QAAQ,GAAG,MAAM,IAAA,mCAAe,EAAC,QAAQ,CAAC,CAAC;YACjD,WAAW,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,WAAW,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAED,wBAAwB;IACxB,KAAK,MAAM,OAAO,IAAI,WAAW,EAAE,CAAC;QAClC,IAAA,8BAAe,EAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IAED,mCAAmC;IACnC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAE,CAAC;QAChC,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC9C,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,kBAAM,CAAC,IAAI,CACT,yBAAyB,OAAO,CAAC,EAAE,mCAAmC,CAAC,aAAa,aAAa,IAAI,CACtG,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC7B,CAAC;IAED,+BAA+B;IAC/B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAyB,CAAC;IACjD,KAAK,MAAM,OAAO,IAAI,WAAW,EAAE,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AACtC,CAAC"}

package/dist/remove/detector.d.ts

@@ -0,0 +1,22 @@
+import type { TraceEvent, RemoveRule, RemovalSet } from '../config/types.js';
+/**
+ * Identifies all trace events that should be removed based on user-declared rules.
+ *
+ * Matching semantics:
+ * - **Within a rule**: all provided matchers must match (AND logic).
+ * - **Across rules**: any matching rule makes an event a removal candidate (OR logic).
+ * - **No automatic detection**: zero built-in heuristics; only explicitly declared rules apply.
+ *
+ * `minConsecutiveOccurrences` safety guard:
+ * If a rule declares this threshold, each consecutive run of matching events is
+ * evaluated against it. Runs that are *shorter* than the threshold are **skipped**
+ * (not removed) and a warning is emitted. This prevents accidentally deleting
+ * one-off occurrences of a step that also appears in noisy repeating sequences.
+ *
+ * @param events - The flat ordered list of trace events to scan.
+ * @param rules  - The user-declared removal rules to apply.
+ * @returns A {@link RemovalSet} containing the indices and match details of every
+ *   event selected for removal.
+ */
+export declare function findStepsToRemove(events: TraceEvent[], rules: RemoveRule[]): RemovalSet;
+//# sourceMappingURL=detector.d.ts.map

package/dist/remove/detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detector.d.ts","sourceRoot":"","sources":["../../src/remove/detector.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAa,MAAM,oBAAoB,CAAC;AAoGxF;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,UAAU,EAAE,EACpB,KAAK,EAAE,UAAU,EAAE,GAClB,UAAU,CA8CZ"}