react-context-compressor 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Muhammad Umair Ali
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,169 @@
+# react-context-compressor
+
+[![npm version](https://img.shields.io/npm/v/react-context-compressor.svg)](https://www.npmjs.com/package/react-context-compressor)
+[![minzipped size](https://img.shields.io/bundlephobia/minzip/react-context-compressor)](https://bundlephobia.com/package/react-context-compressor)
+[![zero dependencies](https://img.shields.io/badge/dependencies-0-brightgreen)](https://www.npmjs.com/package/react-context-compressor?activeTab=dependencies)
+[![license](https://img.shields.io/npm/l/react-context-compressor.svg)](./LICENSE)
+
+A lightweight, **zero-dependency** JS/TS utility that mechanically strips
+non-essential UI data and deep nesting from your application state **and**
+sanitizes sensitive fields (tokens, credentials, private IDs) — producing a
+minimal, safe payload to send to an LLM. It cuts token costs and avoids
+context-window overflows.
+
+It is **100% mechanical**: no network calls, no models, no AI summarization
+(see [Non-goals](#non-goals)). A framework-agnostic core (`.`) plus a thin React
+bindings layer (`./react`).
+
+```
+Before: 17,763 chars  →  After: 402 chars   (97.7% smaller, secrets redacted)
+```
+
+_(from [`examples/demo.mjs`](./examples/demo.mjs) — run it yourself.)_
+
+## Why
+
+Sending application state to an LLM is expensive (you pay per token) and fragile
+(oversized blobs overflow the context window). State is also full of data the
+model doesn't need — UI flags, caches, deep view-models — and sometimes carries
+**secrets that must never leave the client**. `react-context-compressor` does the
+shrinking and the sanitizing in one mechanical, deterministic pass.
+
+## Install
+
+```sh
+npm install react-context-compressor
+```
+
+`react` is an optional **peer dependency** (>= 17) — only needed for the
+`./react` entry. The core has zero runtime dependencies.
+
+## Quick start
+
+### Core (any JS/TS — React not required)
+
+```ts
+import { compress } from "react-context-compressor";
+
+const payload = compress(appState, {
+  maxDepth: 3,
+  maxArrayLength: 5,
+  dropEmpty: true,
+  strip: [/^_/], // drop internal/private keys
+});
+
+// `payload` is a minimal, secret-free plain object — JSON.stringify and send it.
+```
+
+### React
+
+```tsx
+import { useCompressedContext } from "react-context-compressor/react";
+
+function useLlmContext(state: AppState) {
+  // Memoized: recomputes only when `state` or the options content changes.
+  return useCompressedContext(state, {
+    maxDepth: 3,
+    maxArrayLength: 5,
+    dropEmpty: true,
+  });
+}
+```
+
+Works with any state source — Redux, Zustand, Context, `useState`. The hook is
+pure (no DOM, no side effects), so it's safe under SSR and React Server
+Components, on React 17 / 18 / 19.
+
+## What it does
+
+| Transform    | Option                           | Behavior                                                                                |
+| ------------ | -------------------------------- | --------------------------------------------------------------------------------------- |
+| Cap depth    | `maxDepth`                       | Nodes deeper than the cap become `"[Object]"` / `"[Array]"`. Default **100**.           |
+| Cap arrays   | `maxArrayLength`                 | Longer arrays are truncated and a `"[+N more]"` marker appended. Default **unlimited**. |
+| Strip keys   | `strip`                          | Remove keys by exact string or `RegExp`, at any depth.                                  |
+| Drop empties | `dropEmpty`                      | Drop `null` / `undefined` / `""` / `[]` / `{}`. Default `false`.                        |
+| Sanitize     | `sanitize`, `defaultSanitize`, … | Redact/remove sensitive fields (see below).                                             |
+
+It also handles awkward inputs predictably: **circular references** → `"[Circular]"`,
+a **throwing getter** → `"[Getter]"` (never crashes), `Date` kept as-is, `Map` →
+plain object, `Set` → array, functions/symbols dropped, `BigInt` → string. The
+input object is **never mutated**, and output is **deterministic**.
+
+## Sanitization (data safety)
+
+By default, common sensitive field **names** are redacted to `"[REDACTED]"`
+before their value is ever read:
+
+```ts
+compress({ user: "ada", apiKey: "sk-live-123", nested: { password: "p@ss" } });
+// → { user: "ada", apiKey: "[REDACTED]", nested: { password: "[REDACTED]" } }
+```
+
+The built-in deny-list covers (case-insensitive): `password`, `secret`, `token`
+(and `accessToken`/`authToken`/…), `apiKey`/`accessKey`/`privateKey`/`signingKey`,
+`jwt`, `authorization`, `bearer`, `credentials`, `cookie`, `sessionId`,
+`otp`/`totp`/`mfa`, `mnemonic`/`seedPhrase`, recovery/backup codes, `hmac`,
+`signature`, `connectionString`/`dsn`/db URLs, `ssn`, `creditCard`/`cardNumber`,
+`cvv`, `pin`, `iban`, routing/account numbers, `passport`, `taxId`. It's tuned to
+avoid false positives like `author`, `dashboard`, `secretary`, `tokenCount`, or
+`promptTokens`.
+
+```ts
+// Extend the deny-list, or remove instead of redact:
+compress(state, {
+  sanitize: ["employeeId", /internal/i],
+  sanitizeMode: "remove",
+});
+
+// Replace the built-ins entirely:
+compress(state, { defaultSanitize: false, sanitize: [/^secret_/] });
+```
+
+### Security note & limits
+
+Sanitization is **key-name-driven** and mechanical. It is intentionally **not**:
+
+- **Value-based** — a secret stored under an innocuous key, or as a bare array /
+  `Set` element (no key), is not detected. Match it explicitly via `sanitize`.
+- A defense against deliberate **homoglyph** keys — keys are NFKC-normalized and
+  zero-width-stripped (defeating fullwidth/zero-width evasion), but not Cyrillic
+  look-alikes.
+
+Only own **enumerable string** keys are processed; Symbol-keyed and non-enumerable
+properties are dropped (never emitted). Treat the deny-list as a strong default,
+and extend it for your domain.
+
+## API
+
+### `compress(state, options?) → unknown`
+
+Mechanically compress + sanitize `state`. Pure, deterministic, never mutates input.
+
+### `useCompressedContext(state, options?) → unknown` (`./react`)
+
+Memoized React hook wrapping `compress`. Recomputes only when the `state`
+reference or the options **content** changes (an inline options literal is fine).
+
+### `CompressOptions`
+
+| Option            | Type                      | Default        | Notes                                                                       |
+| ----------------- | ------------------------- | -------------- | --------------------------------------------------------------------------- |
+| `maxDepth`        | `number`                  | `100`          | `Infinity` to disable.                                                      |
+| `maxArrayLength`  | `number`                  | `Infinity`     |                                                                             |
+| `strip`           | `Array<string \| RegExp>` | `[]`           | String = exact (case-sensitive) key; `RegExp` = pattern.                    |
+| `dropEmpty`       | `boolean`                 | `false`        |                                                                             |
+| `sanitize`        | `Array<string \| RegExp>` | `[]`           | String = case-insensitive exact; `RegExp` = pattern. Adds to the deny-list. |
+| `defaultSanitize` | `boolean`                 | `true`         | Toggle the built-in deny-list.                                              |
+| `sanitizeMode`    | `"redact" \| "remove"`    | `"redact"`     |                                                                             |
+| `redactedValue`   | `string`                  | `"[REDACTED]"` | Used when redacting.                                                        |
+
+## Non-goals
+
+This library will **never** perform semantic / AI-powered summarization, make
+network calls, or run a local model. It is a mechanical, zero-cost, client-side
+object parser — that's the whole point (it saves you money _before_ the network
+layer). See [SPLIT-PLAN §2 (out of scope)](./SPLIT-PLAN.md).
+
+## License
+
+MIT

package/dist/chunk-VBOCWPM5.mjs

@@ -0,0 +1,208 @@
+// src/core/sanitize.ts
+var REDACTED = "[REDACTED]";
+var DEFAULT_DENY_LIST = [
+  // Passwords / pass-phrases
+  /pass(?:word|wd|phrase)/i,
+  // Secrets ("secret", "clientSecret", "secretKey") but not "secretary"
+  /secret(?!ary)/i,
+  // Tokens — standalone or with an auth-ish prefix; NOT tokenCount/tokenize/promptTokens
+  /\btoken\b/i,
+  /(?:access|refresh|id|auth|bearer|api|csrf|xsrf|session|sso|oauth|reset|verification|activation)[-_]?token/i,
+  // Keys ("apiKey", "accessKey", "signingKey") but not "accessKeyword"/"keyboard"
+  /(?:api|access|private|signing|encryption)[-_]?keys?(?![a-z])/i,
+  /\bjwt\b/i,
+  /authorization/i,
+  /bearer/i,
+  /credentials?/i,
+  /cookie/i,
+  /session[-_]?(?:id|token|key)/i,
+  // 2FA / recovery
+  /\b(?:otp|totp|mfa|2fa)\b/i,
+  /(?:recovery|backup)[-_]?codes?/i,
+  /\bmnemonic\b/i,
+  /seed[-_]?phrase/i,
+  // Crypto / signing
+  /\bhmac\b/i,
+  /\bsignature\b/i,
+  /\b[cx]srf\b/i,
+  // Connection strings / DB credentials
+  /connection[-_]?string/i,
+  /\bdsn\b/i,
+  /(?:database|db)[-_]?(?:url|uri)/i,
+  // PII / financial
+  /ssn/i,
+  /social[-_]?security[-_]?(?:number|no)?/i,
+  /credit[-_]?card/i,
+  /card[-_]?number/i,
+  /cvv2?/i,
+  /\bpin\b/i,
+  /\biban\b/i,
+  /routing[-_]?number/i,
+  /account[-_]?number/i,
+  /\bpassport\b/i,
+  /tax[-_]?id/i
+];
+var ZERO_WIDTH = /[\u00AD\u200B-\u200D\u2060\uFEFF]/g;
+function normalizeKey(key) {
+  return key.normalize("NFKC").replace(ZERO_WIDTH, "");
+}
+function regexTest(re, value) {
+  if (re.global || re.sticky) re.lastIndex = 0;
+  return re.test(value);
+}
+function isSensitiveKey(key, userMatchers, useDefaults) {
+  const normalized = normalizeKey(key);
+  const lower = normalized.toLowerCase();
+  for (const matcher of userMatchers) {
+    if (typeof matcher === "string") {
+      if (normalizeKey(matcher).toLowerCase() === lower) return true;
+    } else if (regexTest(matcher, normalized)) {
+      return true;
+    }
+  }
+  if (useDefaults) {
+    for (const re of DEFAULT_DENY_LIST) {
+      if (regexTest(re, normalized)) return true;
+    }
+  }
+  return false;
+}
+
+// src/core/compress.ts
+var TRUNCATED_OBJECT = "[Object]";
+var TRUNCATED_ARRAY = "[Array]";
+var CIRCULAR = "[Circular]";
+var GETTER_ERROR = "[Getter]";
+var DEFAULT_MAX_DEPTH = 100;
+var DEFAULTS = {
+  maxDepth: DEFAULT_MAX_DEPTH,
+  maxArrayLength: Number.POSITIVE_INFINITY,
+  strip: [],
+  dropEmpty: false,
+  sanitize: [],
+  defaultSanitize: true,
+  sanitizeMode: "redact",
+  redactedValue: REDACTED
+};
+var OMIT = /* @__PURE__ */ Symbol("omit");
+function isPlainObject(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+}
+function safeAssign(target, key, value) {
+  Object.defineProperty(target, key, {
+    value,
+    writable: true,
+    enumerable: true,
+    configurable: true
+  });
+}
+function keyMatches(key, matchers) {
+  for (const matcher of matchers) {
+    if (typeof matcher === "string") {
+      if (matcher === key) return true;
+    } else if (regexTest(matcher, key)) {
+      return true;
+    }
+  }
+  return false;
+}
+function isEmptyValue(value) {
+  if (value === null || value === void 0 || value === "") return true;
+  if (Array.isArray(value)) return value.length === 0;
+  if (isPlainObject(value)) return Object.keys(value).length === 0;
+  return false;
+}
+function resolveOptions(options) {
+  return {
+    maxDepth: options.maxDepth ?? DEFAULTS.maxDepth,
+    maxArrayLength: options.maxArrayLength ?? DEFAULTS.maxArrayLength,
+    strip: options.strip ?? DEFAULTS.strip,
+    dropEmpty: options.dropEmpty ?? DEFAULTS.dropEmpty,
+    sanitize: options.sanitize ?? DEFAULTS.sanitize,
+    defaultSanitize: options.defaultSanitize ?? DEFAULTS.defaultSanitize,
+    sanitizeMode: options.sanitizeMode ?? DEFAULTS.sanitizeMode,
+    redactedValue: options.redactedValue ?? DEFAULTS.redactedValue
+  };
+}
+function walkObjectInto(out, source, depth, opts, seen) {
+  for (const key of Object.keys(source)) {
+    if (keyMatches(key, opts.strip)) continue;
+    if (isSensitiveKey(key, opts.sanitize, opts.defaultSanitize)) {
+      if (opts.sanitizeMode === "remove") continue;
+      safeAssign(out, key, opts.redactedValue);
+      continue;
+    }
+    let raw;
+    try {
+      raw = source[key];
+    } catch {
+      safeAssign(out, key, GETTER_ERROR);
+      continue;
+    }
+    const walked = walk(raw, depth + 1, opts, seen);
+    if (walked === OMIT) continue;
+    if (opts.dropEmpty && isEmptyValue(walked)) continue;
+    safeAssign(out, key, walked);
+  }
+}
+function walk(value, depth, opts, seen) {
+  if (value === null) return null;
+  const type = typeof value;
+  if (type === "function" || type === "symbol") return OMIT;
+  if (type === "bigint") return value.toString();
+  if (type !== "object") return value;
+  const ref = value;
+  if (seen.has(ref)) return CIRCULAR;
+  if (value instanceof Date) return value;
+  if (value instanceof Map) {
+    seen.add(ref);
+    const obj = {};
+    for (const [k, v] of value) safeAssign(obj, String(k), v);
+    const result = walk(obj, depth, opts, seen);
+    seen.delete(ref);
+    return result;
+  }
+  if (value instanceof Set) {
+    seen.add(ref);
+    const result = walk(Array.from(value), depth, opts, seen);
+    seen.delete(ref);
+    return result;
+  }
+  if (Array.isArray(value)) {
+    if (depth >= opts.maxDepth) return TRUNCATED_ARRAY;
+    seen.add(ref);
+    const limited = value.length > opts.maxArrayLength ? value.slice(0, opts.maxArrayLength) : value;
+    const out2 = [];
+    for (const item of limited) {
+      const walked = walk(item, depth + 1, opts, seen);
+      out2.push(walked === OMIT ? null : walked);
+    }
+    if (value.length > opts.maxArrayLength) {
+      out2.push(`[+${value.length - opts.maxArrayLength} more]`);
+    }
+    seen.delete(ref);
+    return out2;
+  }
+  if (depth >= opts.maxDepth) return TRUNCATED_OBJECT;
+  seen.add(ref);
+  const out = {};
+  walkObjectInto(out, value, depth, opts, seen);
+  seen.delete(ref);
+  return out;
+}
+function compressCore(state, options = {}) {
+  const opts = resolveOptions(options);
+  const walked = walk(state, 0, opts, /* @__PURE__ */ new WeakSet());
+  return walked === OMIT ? void 0 : walked;
+}
+
+// src/index.ts
+function compress(state, options = {}) {
+  return compressCore(state, options);
+}
+
+export { compress };
+//# sourceMappingURL=chunk-VBOCWPM5.mjs.map
+//# sourceMappingURL=chunk-VBOCWPM5.mjs.map

package/dist/chunk-VBOCWPM5.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/core/sanitize.ts","../src/core/compress.ts","../src/index.ts"],"names":["out"],"mappings":";AAgBO,IAAM,QAAA,GAAW,YAAA;AAQjB,IAAM,iBAAA,GAAuC;AAAA;AAAA,EAElD,yBAAA;AAAA;AAAA,EAEA,gBAAA;AAAA;AAAA,EAEA,YAAA;AAAA,EACA,4GAAA;AAAA;AAAA,EAEA,+DAAA;AAAA,EACA,UAAA;AAAA,EACA,gBAAA;AAAA,EACA,SAAA;AAAA,EACA,eAAA;AAAA,EACA,SAAA;AAAA,EACA,+BAAA;AAAA;AAAA,EAEA,2BAAA;AAAA,EACA,iCAAA;AAAA,EACA,eAAA;AAAA,EACA,kBAAA;AAAA;AAAA,EAEA,WAAA;AAAA,EACA,gBAAA;AAAA,EACA,cAAA;AAAA;AAAA,EAEA,wBAAA;AAAA,EACA,UAAA;AAAA,EACA,kCAAA;AAAA;AAAA,EAEA,MAAA;AAAA,EACA,yCAAA;AAAA,EACA,kBAAA;AAAA,EACA,kBAAA;AAAA,EACA,QAAA;AAAA,EACA,UAAA;AAAA,EACA,WAAA;AAAA,EACA,qBAAA;AAAA,EACA,qBAAA;AAAA,EACA,eAAA;AAAA,EACA;AACF,CAAA;AAGA,IAAM,UAAA,GAAa,oCAAA;AAOZ,SAAS,aAAa,GAAA,EAAqB;AAChD,EAAA,OAAO,IAAI,SAAA,CAAU,MAAM,CAAA,CAAE,OAAA,CAAQ,YAAY,EAAE,CAAA;AACrD;AAMO,SAAS,SAAA,CAAU,IAAY,KAAA,EAAwB;AAC5D,EAAA,IAAI,EAAA,CAAG,MAAA,IAAU,EAAA,CAAG,MAAA,KAAW,SAAA,GAAY,CAAA;AAC3C,EAAA,OAAO,EAAA,CAAG,KAAK,KAAK,CAAA;AACtB;AAOO,SAAS,cAAA,CACd,GAAA,EACA,YAAA,EACA,WAAA,EACS;AACT,EAAA,MAAM,UAAA,GAAa,aAAa,GAAG,CAAA;AACnC,EAAA,MAAM,KAAA,GAAQ,WAAW,WAAA,EAAY;AACrC,EAAA,KAAA,MAAW,WAAW,YAAA,EAAc;AAClC,IAAA,IAAI,OAAO,YAAY,QAAA,EAAU;AAC/B,MAAA,IAAI,aAAa,OAAO,CAAA,CAAE,WAAA,EAAY,KAAM,OAAO,OAAO,IAAA;AAAA,IAC5D,CAAA,MAAA,IAAW,SAAA,CAAU,OAAA,EAAS,UAAU,CAAA,EAAG;AACzC,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AACA,EAAA,IAAI,WAAA,EAAa;AACf,IAAA,KAAA,MAAW,MAAM,iBAAA,EAAmB;AAClC,MAAA,IAAI,SAAA,CAAU,EAAA,EAAI,UAAU,CAAA,EAAG,OAAO,IAAA;AAAA,IACxC;AAAA,EACF;AACA,EAAA,OAAO,KAAA;AACT;;;ACrGO,IAAM,gBAAA,GAAmB,UAAA;AAEzB,IAAM,eAAA,GAAkB,SAAA;AAExB,IAAM,QAAA,GAAW,YAAA;AAEjB,IAAM,YAAA,GAAe,UAAA;AAQrB,IAAM,iBAAA,GAAoB,GAAA;AAcjC,IAAM,QAAA,GAA4B;AAAA,EAChC,QAAA,EAAU,iBAAA;AAAA,EACV,gBAAgB,MAAA,CAAO,iBAAA;AAAA,EACvB,OAAO,EAAC;AAAA,EACR,SAAA,EAAW,KAAA;AAAA,EACX,UAAU,EAAC;AAAA,EACX,eAAA,EAAiB,IAAA;AAAA,EACjB,YAAA,EAAc,QAAA;AAAA,EACd,aAAA,EAAe;AACjB,CAAA;AAGA,IAAM,IAAA,0BAAc,MAAM,CAAA;AAE1B,SAAS,cAAc,KAAA,EAAkD;AACvE,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,MAAM,OAAO,KAAA;AACxD,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,cAAA,CAAe,KAAK,CAAA;AACzC,EAAA,OAAO,KAAA,KAAU,MAAA,CAAO,SAAA,IAAa,KAAA,KAAU,IAAA;AACjD;AAOA,SAAS,UAAA,CAAW,MAAA,EAAiC,GAAA,EAAa,KAAA,EAAsB;AACtF,EAAA,MAAA,CAAO,cAAA,CAAe,QAAQ,GAAA,EAAK;AAAA,IACjC,KAAA;AAAA,IACA,QAAA,EAAU,IAAA;AAAA,IACV,UAAA,EAAY,IAAA;AAAA,IACZ,YAAA,EAAc;AAAA,GACf,CAAA;AACH;AAGO,SAAS,UAAA,CAAW,KAAa,QAAA,EAAmD;AACzF,EAAA,KAAA,MAAW,WAAW,QAAA,EAAU;AAC9B,IAAA,IAAI,OAAO,YAAY,QAAA,EAAU;AAC/B,MAAA,IAAI,OAAA,KAAY,KAAK,OAAO,IAAA;AAAA,IAC9B,CAAA,MAAA,IAAW,SAAA,CAAU,OAAA,EAAS,GAAG,CAAA,EAAG;AAClC,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,aAAa,KAAA,EAAyB;AAC7C,EAAA,IAAI,UAAU,IAAA,IAAQ,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,IAAI,OAAO,IAAA;AAClE,EAAA,IAAI,MAAM,OAAA,CAAQ,KAAK,CAAA,EAAG,OAAO,MAAM,MAAA,KAAW,CAAA;AAClD,EAAA,IAAI,aAAA,CAAc,KAAK,CAAA,EAAG,OAAO,OAAO,IAAA,CAAK,KAAK,EAAE,MAAA,KAAW,CAAA;AAC/D,EAAA,OAAO,KAAA;AACT;AAMO,SAAS,eAAe,OAAA,EAA2C;AACxE,EAAA,OAAO;AAAA,IACL,QAAA,EAAU,OAAA,CAAQ,QAAA,IAAY,QAAA,CAAS,QAAA;AAAA,IACvC,cAAA,EAAgB,OAAA,CAAQ,cAAA,IAAkB,QAAA,CAAS,cAAA;AAAA,IACnD,KAAA,EAAO,OAAA,CAAQ,KAAA,IAAS,QAAA,CAAS,KAAA;AAAA,IACjC,SAAA,EAAW,OAAA,CAAQ,SAAA,IAAa,QAAA,CAAS,SAAA;AAAA,IACzC,QAAA,EAAU,OAAA,CAAQ,QAAA,IAAY,QAAA,CAAS,QAAA;AAAA,IACvC,eAAA,EAAiB,OAAA,CAAQ,eAAA,IAAmB,QAAA,CAAS,eAAA;AAAA,IACrD,YAAA,EAAc,OAAA,CAAQ,YAAA,IAAgB,QAAA,CAAS,YAAA;AAAA,IAC/C,aAAA,EAAe,OAAA,CAAQ,aAAA,IAAiB,QAAA,CAAS;AAAA,GACnD;AACF;AAGA,SAAS,cAAA,CACP,GAAA,EACA,MAAA,EACA,KAAA,EACA,MACA,IAAA,EACM;AACN,EAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,EAAG;AACrC,IAAA,IAAI,UAAA,CAAW,GAAA,EAAK,IAAA,CAAK,KAAK,CAAA,EAAG;AAGjC,IAAA,IAAI,eAAe,GAAA,EAAK,IAAA,CAAK,QAAA,EAAU,IAAA,CAAK,eAAe,CAAA,EAAG;AAC5D,MAAA,IAAI,IAAA,CAAK,iBAAiB,QAAA,EAAU;AACpC,MAAA,UAAA,CAAW,GAAA,EAAK,GAAA,EAAK,IAAA,CAAK,aAAa,CAAA;AACvC,MAAA;AAAA,IACF;AACA,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,OAAO,GAAG,CAAA;AAAA,IAClB,CAAA,CAAA,MAAQ;AAEN,MAAA,UAAA,CAAW,GAAA,EAAK,KAAK,YAAY,CAAA;AACjC,MAAA;AAAA,IACF;AACA,IAAA,MAAM,SAAS,IAAA,CAAK,GAAA,EAAK,KAAA,GAAQ,CAAA,EAAG,MAAM,IAAI,CAAA;AAC9C,IAAA,IAAI,WAAW,IAAA,EAAM;AACrB,IAAA,IAAI,IAAA,CAAK,SAAA,IAAa,YAAA,CAAa,MAAM,CAAA,EAAG;AAC5C,IAAA,UAAA,CAAW,GAAA,EAAK,KAAK,MAAM,CAAA;AAAA,EAC7B;AACF;AAEA,SAAS,IAAA,CACP,KAAA,EACA,KAAA,EACA,IAAA,EACA,IAAA,EACS;AACT,EAAA,IAAI,KAAA,KAAU,MAAM,OAAO,IAAA;AAC3B,EAAA,MAAM,OAAO,OAAO,KAAA;AACpB,EAAA,IAAI,IAAA,KAAS,UAAA,IAAc,IAAA,KAAS,QAAA,EAAU,OAAO,IAAA;AAErD,EAAA,IAAI,IAAA,KAAS,QAAA,EAAU,OAAQ,KAAA,CAAiB,QAAA,EAAS;AACzD,EAAA,IAAI,IAAA,KAAS,UAAU,OAAO,KAAA;AAI9B,EAAA,MAAM,GAAA,GAAM,KAAA;AACZ,EAAA,IAAI,IAAA,CAAK,GAAA,CAAI,GAAG,CAAA,EAAG,OAAO,QAAA;AAG1B,EAAA,IAAI,KAAA,YAAiB,MAAM,OAAO,KAAA;AAClC,EAAA,IAAI,iBAAiB,GAAA,EAAK;AACxB,IAAA,IAAA,CAAK,IAAI,GAAG,CAAA;AACZ,IAAA,MAAM,MAA+B,EAAC;AACtC,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,CAAA,IAAK,KAAA,aAAkB,GAAA,EAAK,MAAA,CAAO,CAAC,CAAA,EAAG,CAAC,CAAA;AACxD,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,GAAA,EAAK,KAAA,EAAO,MAAM,IAAI,CAAA;AAC1C,IAAA,IAAA,CAAK,OAAO,GAAG,CAAA;AACf,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,IAAI,iBAAiB,GAAA,EAAK;AACxB,IAAA,IAAA,CAAK,IAAI,GAAG,CAAA;AACZ,IAAA,MAAM,MAAA,GAAS,KAAK,KAAA,CAAM,IAAA,CAAK,KAAK,CAAA,EAAG,KAAA,EAAO,MAAM,IAAI,CAAA;AACxD,IAAA,IAAA,CAAK,OAAO,GAAG,CAAA;AACf,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,IAAA,IAAI,KAAA,IAAS,IAAA,CAAK,QAAA,EAAU,OAAO,eAAA;AACnC,IAAA,IAAA,CAAK,IAAI,GAAG,CAAA;AACZ,IAAA,MAAM,OAAA,GACJ,KAAA,CAAM,MAAA,GAAS,IAAA,CAAK,cAAA,GAAiB,MAAM,KAAA,CAAM,CAAA,EAAG,IAAA,CAAK,cAAc,CAAA,GAAI,KAAA;AAC7E,IAAA,MAAMA,OAAiB,EAAC;AACxB,IAAA,KAAA,MAAW,QAAQ,OAAA,EAAS;AAC1B,MAAA,MAAM,SAAS,IAAA,CAAK,IAAA,EAAM,KAAA,GAAQ,CAAA,EAAG,MAAM,IAAI,CAAA;AAE/C,MAAAA,IAAAA,CAAI,IAAA,CAAK,MAAA,KAAW,IAAA,GAAO,OAAO,MAAM,CAAA;AAAA,IAC1C;AACA,IAAA,IAAI,KAAA,CAAM,MAAA,GAAS,IAAA,CAAK,cAAA,EAAgB;AACtC,MAAAA,KAAI,IAAA,CAAK,CAAA,EAAA,EAAK,MAAM,MAAA,GAAS,IAAA,CAAK,cAAc,CAAA,MAAA,CAAQ,CAAA;AAAA,IAC1D;AACA,IAAA,IAAA,CAAK,OAAO,GAAG,CAAA;AACf,IAAA,OAAOA,IAAAA;AAAA,EACT;AAIA,EAAA,IAAI,KAAA,IAAS,IAAA,CAAK,QAAA,EAAU,OAAO,gBAAA;AACnC,EAAA,IAAA,CAAK,IAAI,GAAG,CAAA;AACZ,EAAA,MAAM,MAA+B,EAAC;AACtC,EAAA,cAAA,CAAe,GAAA,EAAK,KAAA,EAAkC,KAAA,EAAO,IAAA,EAAM,IAAI,CAAA;AACvE,EAAA,IAAA,CAAK,OAAO,GAAG,CAAA;AACf,EAAA,OAAO,GAAA;AACT;AAOO,SAAS,YAAA,CAAa,KAAA,EAAgB,OAAA,GAA2B,EAAC,EAAY;AACnF,EAAA,MAAM,IAAA,GAAO,eAAe,OAAO,CAAA;AACnC,EAAA,MAAM,SAAS,IAAA,CAAK,KAAA,EAAO,GAAG,IAAA,kBAAM,IAAI,SAAS,CAAA;AAEjD,EAAA,OAAO,MAAA,KAAW,OAAO,MAAA,GAAY,MAAA;AACvC;;;AC3JO,SAAS,QAAA,CAAY,KAAA,EAAU,OAAA,GAA2B,EAAC,EAAY;AAC5E,EAAA,OAAO,YAAA,CAAa,OAAO,OAAO,CAAA;AACpC","file":"chunk-VBOCWPM5.mjs","sourcesContent":["/**\n * Client-side data-safety layer — detect sensitive field names so the walker\n * can redact or remove them BEFORE their values are ever read. Mechanical and\n * key-name-driven: no value inspection, no network, no models.\n *\n * Limitations (key-name-driven by design):\n *  - Matches field NAMES, not values: a secret under an innocuous key, or as a\n *    bare array/Set element (no key), is NOT detected.\n *  - Only own enumerable string keys are processed; Symbol-keyed / non-enumerable\n *    properties are dropped by the walker, never scanned.\n *  - Homoglyph attacks (e.g. Cyrillic look-alikes) are not fully closed; keys are\n *    NFKC-normalized and zero-width-stripped before matching, which defeats the\n *    common fullwidth/zero-width evasions but not deliberate confusables.\n */\n\n/** Default replacement value used when a sensitive field is redacted. */\nexport const REDACTED = \"[REDACTED]\";\n\n/**\n * Built-in deny-list of sensitive field-name patterns (case-insensitive).\n * Patterns are anchored to avoid false positives on common keys — e.g. it does\n * NOT redact `author`, `dashboard`, `secretary`, `tokenCount`, `promptTokens`,\n * or `accessKeyboard`.\n */\nexport const DEFAULT_DENY_LIST: readonly RegExp[] = [\n  // Passwords / pass-phrases\n  /pass(?:word|wd|phrase)/i,\n  // Secrets (\"secret\", \"clientSecret\", \"secretKey\") but not \"secretary\"\n  /secret(?!ary)/i,\n  // Tokens — standalone or with an auth-ish prefix; NOT tokenCount/tokenize/promptTokens\n  /\\btoken\\b/i,\n  /(?:access|refresh|id|auth|bearer|api|csrf|xsrf|session|sso|oauth|reset|verification|activation)[-_]?token/i,\n  // Keys (\"apiKey\", \"accessKey\", \"signingKey\") but not \"accessKeyword\"/\"keyboard\"\n  /(?:api|access|private|signing|encryption)[-_]?keys?(?![a-z])/i,\n  /\\bjwt\\b/i,\n  /authorization/i,\n  /bearer/i,\n  /credentials?/i,\n  /cookie/i,\n  /session[-_]?(?:id|token|key)/i,\n  // 2FA / recovery\n  /\\b(?:otp|totp|mfa|2fa)\\b/i,\n  /(?:recovery|backup)[-_]?codes?/i,\n  /\\bmnemonic\\b/i,\n  /seed[-_]?phrase/i,\n  // Crypto / signing\n  /\\bhmac\\b/i,\n  /\\bsignature\\b/i,\n  /\\b[cx]srf\\b/i,\n  // Connection strings / DB credentials\n  /connection[-_]?string/i,\n  /\\bdsn\\b/i,\n  /(?:database|db)[-_]?(?:url|uri)/i,\n  // PII / financial\n  /ssn/i,\n  /social[-_]?security[-_]?(?:number|no)?/i,\n  /credit[-_]?card/i,\n  /card[-_]?number/i,\n  /cvv2?/i,\n  /\\bpin\\b/i,\n  /\\biban\\b/i,\n  /routing[-_]?number/i,\n  /account[-_]?number/i,\n  /\\bpassport\\b/i,\n  /tax[-_]?id/i,\n];\n\n/** Zero-width / default-ignorable code points used to evade name matching. */\nconst ZERO_WIDTH = /[\\u00AD\\u200B-\\u200D\\u2060\\uFEFF]/g;\n\n/**\n * Normalize a key before matching: NFKC folds fullwidth/compatibility forms to\n * their ASCII equivalents, and zero-width characters are stripped. This defeats\n * the common `\"ｐａｓｓｗｏｒｄ\"` / zero-width-injected evasions.\n */\nexport function normalizeKey(key: string): string {\n  return key.normalize(\"NFKC\").replace(ZERO_WIDTH, \"\");\n}\n\n/**\n * Stateless RegExp test. A user-supplied pattern with the `g`/`y` flag carries\n * a mutable `lastIndex`; resetting it keeps matching deterministic across keys.\n */\nexport function regexTest(re: RegExp, value: string): boolean {\n  if (re.global || re.sticky) re.lastIndex = 0;\n  return re.test(value);\n}\n\n/**\n * Is `key` a sensitive field name? Checks user matchers (string = exact,\n * case-insensitive; RegExp = pattern) and, when `useDefaults`, the built-in\n * deny-list. Keys are NFKC-normalized and zero-width-stripped first.\n */\nexport function isSensitiveKey(\n  key: string,\n  userMatchers: ReadonlyArray<string | RegExp>,\n  useDefaults: boolean,\n): boolean {\n  const normalized = normalizeKey(key);\n  const lower = normalized.toLowerCase();\n  for (const matcher of userMatchers) {\n    if (typeof matcher === \"string\") {\n      if (normalizeKey(matcher).toLowerCase() === lower) return true;\n    } else if (regexTest(matcher, normalized)) {\n      return true;\n    }\n  }\n  if (useDefaults) {\n    for (const re of DEFAULT_DENY_LIST) {\n      if (regexTest(re, normalized)) return true;\n    }\n  }\n  return false;\n}\n","/**\n * Core compression walker — mechanical, deterministic, zero-dependency.\n *\n * A single recursive pass applies: key stripping, depth capping, array-length\n * capping, and empty-value dropping, with circular-reference protection.\n * Sanitization (task 003) composes into this same walk via {@link CompressOptions.sanitize}.\n */\n\nimport type { CompressOptions } from \"../index\";\nimport { isSensitiveKey, REDACTED, regexTest } from \"./sanitize\";\n\n/** Marker substituted for a node that exceeds {@link CompressOptions.maxDepth}. */\nexport const TRUNCATED_OBJECT = \"[Object]\";\n/** Marker substituted for an array that exceeds {@link CompressOptions.maxDepth}. */\nexport const TRUNCATED_ARRAY = \"[Array]\";\n/** Marker substituted for a circular back-reference. */\nexport const CIRCULAR = \"[Circular]\";\n/** Marker substituted for a property whose getter threw when read. */\nexport const GETTER_ERROR = \"[Getter]\";\n\n/**\n * Safe default depth cap. Real application state is rarely deeper than a few\n * dozen levels; capping by default keeps payloads minimal and prevents a\n * stack-overflow DoS on pathologically deep (untrusted) input. Opt out with\n * `maxDepth: Infinity`.\n */\nexport const DEFAULT_MAX_DEPTH = 100;\n\n/** Fully-resolved options after defaults are applied. */\ninterface ResolvedOptions {\n  maxDepth: number;\n  maxArrayLength: number;\n  strip: Array<string | RegExp>;\n  dropEmpty: boolean;\n  sanitize: Array<string | RegExp>;\n  defaultSanitize: boolean;\n  sanitizeMode: \"redact\" | \"remove\";\n  redactedValue: string;\n}\n\nconst DEFAULTS: ResolvedOptions = {\n  maxDepth: DEFAULT_MAX_DEPTH,\n  maxArrayLength: Number.POSITIVE_INFINITY,\n  strip: [],\n  dropEmpty: false,\n  sanitize: [],\n  defaultSanitize: true,\n  sanitizeMode: \"redact\",\n  redactedValue: REDACTED,\n};\n\n/** A unique sentinel meaning \"this value should be omitted from the output\". */\nconst OMIT = Symbol(\"omit\");\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  if (typeof value !== \"object\" || value === null) return false;\n  const proto = Object.getPrototypeOf(value);\n  return proto === Object.prototype || proto === null;\n}\n\n/**\n * Assign an own, enumerable data property — even for dangerous keys like\n * `__proto__` (a plain `out[key] = v` would reassign the prototype instead of\n * creating a property, corrupting the output and silently dropping the value).\n */\nfunction safeAssign(target: Record<string, unknown>, key: string, value: unknown): void {\n  Object.defineProperty(target, key, {\n    value,\n    writable: true,\n    enumerable: true,\n    configurable: true,\n  });\n}\n\n/** Does `key` match any matcher (exact string or RegExp test)? */\nexport function keyMatches(key: string, matchers: ReadonlyArray<string | RegExp>): boolean {\n  for (const matcher of matchers) {\n    if (typeof matcher === \"string\") {\n      if (matcher === key) return true;\n    } else if (regexTest(matcher, key)) {\n      return true;\n    }\n  }\n  return false;\n}\n\nfunction isEmptyValue(value: unknown): boolean {\n  if (value === null || value === undefined || value === \"\") return true;\n  if (Array.isArray(value)) return value.length === 0;\n  if (isPlainObject(value)) return Object.keys(value).length === 0;\n  return false;\n}\n\n/**\n * Resolve user options against defaults. Exposed so the React layer and\n * sanitization can share one normalization path.\n */\nexport function resolveOptions(options: CompressOptions): ResolvedOptions {\n  return {\n    maxDepth: options.maxDepth ?? DEFAULTS.maxDepth,\n    maxArrayLength: options.maxArrayLength ?? DEFAULTS.maxArrayLength,\n    strip: options.strip ?? DEFAULTS.strip,\n    dropEmpty: options.dropEmpty ?? DEFAULTS.dropEmpty,\n    sanitize: options.sanitize ?? DEFAULTS.sanitize,\n    defaultSanitize: options.defaultSanitize ?? DEFAULTS.defaultSanitize,\n    sanitizeMode: options.sanitizeMode ?? DEFAULTS.sanitizeMode,\n    redactedValue: options.redactedValue ?? DEFAULTS.redactedValue,\n  };\n}\n\n/** Walk own enumerable string keys of an object-like value into `out`. */\nfunction walkObjectInto(\n  out: Record<string, unknown>,\n  source: Record<string, unknown>,\n  depth: number,\n  opts: ResolvedOptions,\n  seen: WeakSet<object>,\n): void {\n  for (const key of Object.keys(source)) {\n    if (keyMatches(key, opts.strip)) continue;\n    // Sanitize BEFORE reading the value: a sensitive value is never read\n    // (no getter fired), never walked, and never reaches the output.\n    if (isSensitiveKey(key, opts.sanitize, opts.defaultSanitize)) {\n      if (opts.sanitizeMode === \"remove\") continue;\n      safeAssign(out, key, opts.redactedValue);\n      continue;\n    }\n    let raw: unknown;\n    try {\n      raw = source[key];\n    } catch {\n      // A getter threw — degrade to a marker rather than crashing the walk.\n      safeAssign(out, key, GETTER_ERROR);\n      continue;\n    }\n    const walked = walk(raw, depth + 1, opts, seen);\n    if (walked === OMIT) continue;\n    if (opts.dropEmpty && isEmptyValue(walked)) continue;\n    safeAssign(out, key, walked);\n  }\n}\n\nfunction walk(\n  value: unknown,\n  depth: number,\n  opts: ResolvedOptions,\n  seen: WeakSet<object>,\n): unknown {\n  if (value === null) return null;\n  const type = typeof value;\n  if (type === \"function\" || type === \"symbol\") return OMIT;\n  // BigInt is not JSON-serializable; coerce to string for an LLM-ready payload.\n  if (type === \"bigint\") return (value as bigint).toString();\n  if (type !== \"object\") return value;\n\n  // Circular-reference guard sits above all object normalization so a cycle\n  // through a Map/Set is caught instead of overflowing the stack.\n  const ref = value as object;\n  if (seen.has(ref)) return CIRCULAR;\n\n  // Non-plain objects we deliberately normalize for a predictable payload.\n  if (value instanceof Date) return value;\n  if (value instanceof Map) {\n    seen.add(ref);\n    const obj: Record<string, unknown> = {};\n    for (const [k, v] of value) safeAssign(obj, String(k), v);\n    const result = walk(obj, depth, opts, seen);\n    seen.delete(ref);\n    return result;\n  }\n  if (value instanceof Set) {\n    seen.add(ref);\n    const result = walk(Array.from(value), depth, opts, seen);\n    seen.delete(ref);\n    return result;\n  }\n\n  if (Array.isArray(value)) {\n    if (depth >= opts.maxDepth) return TRUNCATED_ARRAY;\n    seen.add(ref);\n    const limited =\n      value.length > opts.maxArrayLength ? value.slice(0, opts.maxArrayLength) : value;\n    const out: unknown[] = [];\n    for (const item of limited) {\n      const walked = walk(item, depth + 1, opts, seen);\n      // In arrays, an omitted item collapses to null to preserve index intent.\n      out.push(walked === OMIT ? null : walked);\n    }\n    if (value.length > opts.maxArrayLength) {\n      out.push(`[+${value.length - opts.maxArrayLength} more]`);\n    }\n    seen.delete(ref);\n    return out;\n  }\n\n  // Plain objects and unknown object kinds (class instances) both rebuild as a\n  // plain object from their own enumerable string keys.\n  if (depth >= opts.maxDepth) return TRUNCATED_OBJECT;\n  seen.add(ref);\n  const out: Record<string, unknown> = {};\n  walkObjectInto(out, value as Record<string, unknown>, depth, opts, seen);\n  seen.delete(ref);\n  return out;\n}\n\n/**\n * Mechanically compress a state value into a minimal payload, applying the\n * structural transforms in {@link CompressOptions}. Pure and deterministic;\n * the input is never mutated.\n */\nexport function compressCore(state: unknown, options: CompressOptions = {}): unknown {\n  const opts = resolveOptions(options);\n  const walked = walk(state, 0, opts, new WeakSet());\n  // A top-level function/symbol compresses to undefined rather than a sentinel.\n  return walked === OMIT ? undefined : walked;\n}\n","/**\n * react-context-compressor — core entry (framework-agnostic, zero dependencies).\n *\n * Mechanical compression lands here (task 002); sanitization composes into the\n * same walk in task 003.\n */\n\nimport { compressCore } from \"./core/compress\";\n\n/**\n * Options controlling how a state value is mechanically compressed and\n * sanitized into a minimal, LLM-ready payload. All fields are optional;\n * `compress(state)` with no options returns a safe deep copy.\n */\nexport interface CompressOptions {\n  /**\n   * Maximum object/array depth to retain. Nodes deeper than this are replaced\n   * with a `\"[Object]\"` / `\"[Array]\"` marker. Default: `100` (a safe cap that\n   * keeps payloads minimal and prevents stack overflow on pathologically deep\n   * input). Set to `Infinity` to disable depth capping.\n   */\n  maxDepth?: number;\n  /**\n   * Maximum array length to retain. Longer arrays are truncated and a\n   * `\"[+N more]\"` marker is appended. Default: unlimited.\n   */\n  maxArrayLength?: number;\n  /** Keys (exact strings or patterns) to strip from the output. */\n  strip?: Array<string | RegExp>;\n  /** When true, drop `null` / `undefined` / `\"\"` / `[]` / `{}` values. */\n  dropEmpty?: boolean;\n  /**\n   * Extra sensitive field-name matchers to redact/remove, IN ADDITION to the\n   * built-in deny-list (unless {@link CompressOptions.defaultSanitize} is\n   * `false`). A `string` matches a key case-insensitively and exactly; a\n   * `RegExp` matches by pattern. Matching is by field NAME, not value.\n   */\n  sanitize?: Array<string | RegExp>;\n  /**\n   * Apply the built-in sensitive-field deny-list (password, token, secret,\n   * apiKey, authorization, cookie, ssn, creditCard, …). Default: `true`.\n   * Set `false` to rely solely on {@link CompressOptions.sanitize}.\n   */\n  defaultSanitize?: boolean;\n  /**\n   * How to treat a sensitive field: `\"redact\"` replaces its value with\n   * {@link CompressOptions.redactedValue}; `\"remove\"` drops the key entirely.\n   * Either way the value is never read or emitted. Default: `\"redact\"`.\n   */\n  sanitizeMode?: \"redact\" | \"remove\";\n  /** Replacement used when `sanitizeMode` is `\"redact\"`. Default: `\"[REDACTED]\"`. */\n  redactedValue?: string;\n}\n\n/**\n * Mechanically compress and sanitize a state value into a minimal, safe payload.\n *\n * Pure and deterministic: the same input and options always produce the same\n * output, and the input is never mutated. Performs no I/O — purely structural.\n */\nexport function compress<T>(state: T, options: CompressOptions = {}): unknown {\n  return compressCore(state, options);\n}\n"]}

package/dist/index.cjs

@@ -0,0 +1,210 @@
+'use strict';
+
+// src/core/sanitize.ts
+var REDACTED = "[REDACTED]";
+var DEFAULT_DENY_LIST = [
+  // Passwords / pass-phrases
+  /pass(?:word|wd|phrase)/i,
+  // Secrets ("secret", "clientSecret", "secretKey") but not "secretary"
+  /secret(?!ary)/i,
+  // Tokens — standalone or with an auth-ish prefix; NOT tokenCount/tokenize/promptTokens
+  /\btoken\b/i,
+  /(?:access|refresh|id|auth|bearer|api|csrf|xsrf|session|sso|oauth|reset|verification|activation)[-_]?token/i,
+  // Keys ("apiKey", "accessKey", "signingKey") but not "accessKeyword"/"keyboard"
+  /(?:api|access|private|signing|encryption)[-_]?keys?(?![a-z])/i,
+  /\bjwt\b/i,
+  /authorization/i,
+  /bearer/i,
+  /credentials?/i,
+  /cookie/i,
+  /session[-_]?(?:id|token|key)/i,
+  // 2FA / recovery
+  /\b(?:otp|totp|mfa|2fa)\b/i,
+  /(?:recovery|backup)[-_]?codes?/i,
+  /\bmnemonic\b/i,
+  /seed[-_]?phrase/i,
+  // Crypto / signing
+  /\bhmac\b/i,
+  /\bsignature\b/i,
+  /\b[cx]srf\b/i,
+  // Connection strings / DB credentials
+  /connection[-_]?string/i,
+  /\bdsn\b/i,
+  /(?:database|db)[-_]?(?:url|uri)/i,
+  // PII / financial
+  /ssn/i,
+  /social[-_]?security[-_]?(?:number|no)?/i,
+  /credit[-_]?card/i,
+  /card[-_]?number/i,
+  /cvv2?/i,
+  /\bpin\b/i,
+  /\biban\b/i,
+  /routing[-_]?number/i,
+  /account[-_]?number/i,
+  /\bpassport\b/i,
+  /tax[-_]?id/i
+];
+var ZERO_WIDTH = /[\u00AD\u200B-\u200D\u2060\uFEFF]/g;
+function normalizeKey(key) {
+  return key.normalize("NFKC").replace(ZERO_WIDTH, "");
+}
+function regexTest(re, value) {
+  if (re.global || re.sticky) re.lastIndex = 0;
+  return re.test(value);
+}
+function isSensitiveKey(key, userMatchers, useDefaults) {
+  const normalized = normalizeKey(key);
+  const lower = normalized.toLowerCase();
+  for (const matcher of userMatchers) {
+    if (typeof matcher === "string") {
+      if (normalizeKey(matcher).toLowerCase() === lower) return true;
+    } else if (regexTest(matcher, normalized)) {
+      return true;
+    }
+  }
+  if (useDefaults) {
+    for (const re of DEFAULT_DENY_LIST) {
+      if (regexTest(re, normalized)) return true;
+    }
+  }
+  return false;
+}
+
+// src/core/compress.ts
+var TRUNCATED_OBJECT = "[Object]";
+var TRUNCATED_ARRAY = "[Array]";
+var CIRCULAR = "[Circular]";
+var GETTER_ERROR = "[Getter]";
+var DEFAULT_MAX_DEPTH = 100;
+var DEFAULTS = {
+  maxDepth: DEFAULT_MAX_DEPTH,
+  maxArrayLength: Number.POSITIVE_INFINITY,
+  strip: [],
+  dropEmpty: false,
+  sanitize: [],
+  defaultSanitize: true,
+  sanitizeMode: "redact",
+  redactedValue: REDACTED
+};
+var OMIT = /* @__PURE__ */ Symbol("omit");
+function isPlainObject(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+}
+function safeAssign(target, key, value) {
+  Object.defineProperty(target, key, {
+    value,
+    writable: true,
+    enumerable: true,
+    configurable: true
+  });
+}
+function keyMatches(key, matchers) {
+  for (const matcher of matchers) {
+    if (typeof matcher === "string") {
+      if (matcher === key) return true;
+    } else if (regexTest(matcher, key)) {
+      return true;
+    }
+  }
+  return false;
+}
+function isEmptyValue(value) {
+  if (value === null || value === void 0 || value === "") return true;
+  if (Array.isArray(value)) return value.length === 0;
+  if (isPlainObject(value)) return Object.keys(value).length === 0;
+  return false;
+}
+function resolveOptions(options) {
+  return {
+    maxDepth: options.maxDepth ?? DEFAULTS.maxDepth,
+    maxArrayLength: options.maxArrayLength ?? DEFAULTS.maxArrayLength,
+    strip: options.strip ?? DEFAULTS.strip,
+    dropEmpty: options.dropEmpty ?? DEFAULTS.dropEmpty,
+    sanitize: options.sanitize ?? DEFAULTS.sanitize,
+    defaultSanitize: options.defaultSanitize ?? DEFAULTS.defaultSanitize,
+    sanitizeMode: options.sanitizeMode ?? DEFAULTS.sanitizeMode,
+    redactedValue: options.redactedValue ?? DEFAULTS.redactedValue
+  };
+}
+function walkObjectInto(out, source, depth, opts, seen) {
+  for (const key of Object.keys(source)) {
+    if (keyMatches(key, opts.strip)) continue;
+    if (isSensitiveKey(key, opts.sanitize, opts.defaultSanitize)) {
+      if (opts.sanitizeMode === "remove") continue;
+      safeAssign(out, key, opts.redactedValue);
+      continue;
+    }
+    let raw;
+    try {
+      raw = source[key];
+    } catch {
+      safeAssign(out, key, GETTER_ERROR);
+      continue;
+    }
+    const walked = walk(raw, depth + 1, opts, seen);
+    if (walked === OMIT) continue;
+    if (opts.dropEmpty && isEmptyValue(walked)) continue;
+    safeAssign(out, key, walked);
+  }
+}
+function walk(value, depth, opts, seen) {
+  if (value === null) return null;
+  const type = typeof value;
+  if (type === "function" || type === "symbol") return OMIT;
+  if (type === "bigint") return value.toString();
+  if (type !== "object") return value;
+  const ref = value;
+  if (seen.has(ref)) return CIRCULAR;
+  if (value instanceof Date) return value;
+  if (value instanceof Map) {
+    seen.add(ref);
+    const obj = {};
+    for (const [k, v] of value) safeAssign(obj, String(k), v);
+    const result = walk(obj, depth, opts, seen);
+    seen.delete(ref);
+    return result;
+  }
+  if (value instanceof Set) {
+    seen.add(ref);
+    const result = walk(Array.from(value), depth, opts, seen);
+    seen.delete(ref);
+    return result;
+  }
+  if (Array.isArray(value)) {
+    if (depth >= opts.maxDepth) return TRUNCATED_ARRAY;
+    seen.add(ref);
+    const limited = value.length > opts.maxArrayLength ? value.slice(0, opts.maxArrayLength) : value;
+    const out2 = [];
+    for (const item of limited) {
+      const walked = walk(item, depth + 1, opts, seen);
+      out2.push(walked === OMIT ? null : walked);
+    }
+    if (value.length > opts.maxArrayLength) {
+      out2.push(`[+${value.length - opts.maxArrayLength} more]`);
+    }
+    seen.delete(ref);
+    return out2;
+  }
+  if (depth >= opts.maxDepth) return TRUNCATED_OBJECT;
+  seen.add(ref);
+  const out = {};
+  walkObjectInto(out, value, depth, opts, seen);
+  seen.delete(ref);
+  return out;
+}
+function compressCore(state, options = {}) {
+  const opts = resolveOptions(options);
+  const walked = walk(state, 0, opts, /* @__PURE__ */ new WeakSet());
+  return walked === OMIT ? void 0 : walked;
+}
+
+// src/index.ts
+function compress(state, options = {}) {
+  return compressCore(state, options);
+}
+
+exports.compress = compress;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/core/sanitize.ts","../src/core/compress.ts","../src/index.ts"],"names":["out"],"mappings":";;;AAgBO,IAAM,QAAA,GAAW,YAAA;AAQjB,IAAM,iBAAA,GAAuC;AAAA;AAAA,EAElD,yBAAA;AAAA;AAAA,EAEA,gBAAA;AAAA;AAAA,EAEA,YAAA;AAAA,EACA,4GAAA;AAAA;AAAA,EAEA,+DAAA;AAAA,EACA,UAAA;AAAA,EACA,gBAAA;AAAA,EACA,SAAA;AAAA,EACA,eAAA;AAAA,EACA,SAAA;AAAA,EACA,+BAAA;AAAA;AAAA,EAEA,2BAAA;AAAA,EACA,iCAAA;AAAA,EACA,eAAA;AAAA,EACA,kBAAA;AAAA;AAAA,EAEA,WAAA;AAAA,EACA,gBAAA;AAAA,EACA,cAAA;AAAA;AAAA,EAEA,wBAAA;AAAA,EACA,UAAA;AAAA,EACA,kCAAA;AAAA;AAAA,EAEA,MAAA;AAAA,EACA,yCAAA;AAAA,EACA,kBAAA;AAAA,EACA,kBAAA;AAAA,EACA,QAAA;AAAA,EACA,UAAA;AAAA,EACA,WAAA;AAAA,EACA,qBAAA;AAAA,EACA,qBAAA;AAAA,EACA,eAAA;AAAA,EACA;AACF,CAAA;AAGA,IAAM,UAAA,GAAa,oCAAA;AAOZ,SAAS,aAAa,GAAA,EAAqB;AAChD,EAAA,OAAO,IAAI,SAAA,CAAU,MAAM,CAAA,CAAE,OAAA,CAAQ,YAAY,EAAE,CAAA;AACrD;AAMO,SAAS,SAAA,CAAU,IAAY,KAAA,EAAwB;AAC5D,EAAA,IAAI,EAAA,CAAG,MAAA,IAAU,EAAA,CAAG,MAAA,KAAW,SAAA,GAAY,CAAA;AAC3C,EAAA,OAAO,EAAA,CAAG,KAAK,KAAK,CAAA;AACtB;AAOO,SAAS,cAAA,CACd,GAAA,EACA,YAAA,EACA,WAAA,EACS;AACT,EAAA,MAAM,UAAA,GAAa,aAAa,GAAG,CAAA;AACnC,EAAA,MAAM,KAAA,GAAQ,WAAW,WAAA,EAAY;AACrC,EAAA,KAAA,MAAW,WAAW,YAAA,EAAc;AAClC,IAAA,IAAI,OAAO,YAAY,QAAA,EAAU;AAC/B,MAAA,IAAI,aAAa,OAAO,CAAA,CAAE,WAAA,EAAY,KAAM,OAAO,OAAO,IAAA;AAAA,IAC5D,CAAA,MAAA,IAAW,SAAA,CAAU,OAAA,EAAS,UAAU,CAAA,EAAG;AACzC,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AACA,EAAA,IAAI,WAAA,EAAa;AACf,IAAA,KAAA,MAAW,MAAM,iBAAA,EAAmB;AAClC,MAAA,IAAI,SAAA,CAAU,EAAA,EAAI,UAAU,CAAA,EAAG,OAAO,IAAA;AAAA,IACxC;AAAA,EACF;AACA,EAAA,OAAO,KAAA;AACT;;;ACrGO,IAAM,gBAAA,GAAmB,UAAA;AAEzB,IAAM,eAAA,GAAkB,SAAA;AAExB,IAAM,QAAA,GAAW,YAAA;AAEjB,IAAM,YAAA,GAAe,UAAA;AAQrB,IAAM,iBAAA,GAAoB,GAAA;AAcjC,IAAM,QAAA,GAA4B;AAAA,EAChC,QAAA,EAAU,iBAAA;AAAA,EACV,gBAAgB,MAAA,CAAO,iBAAA;AAAA,EACvB,OAAO,EAAC;AAAA,EACR,SAAA,EAAW,KAAA;AAAA,EACX,UAAU,EAAC;AAAA,EACX,eAAA,EAAiB,IAAA;AAAA,EACjB,YAAA,EAAc,QAAA;AAAA,EACd,aAAA,EAAe;AACjB,CAAA;AAGA,IAAM,IAAA,0BAAc,MAAM,CAAA;AAE1B,SAAS,cAAc,KAAA,EAAkD;AACvE,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,MAAM,OAAO,KAAA;AACxD,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,cAAA,CAAe,KAAK,CAAA;AACzC,EAAA,OAAO,KAAA,KAAU,MAAA,CAAO,SAAA,IAAa,KAAA,KAAU,IAAA;AACjD;AAOA,SAAS,UAAA,CAAW,MAAA,EAAiC,GAAA,EAAa,KAAA,EAAsB;AACtF,EAAA,MAAA,CAAO,cAAA,CAAe,QAAQ,GAAA,EAAK;AAAA,IACjC,KAAA;AAAA,IACA,QAAA,EAAU,IAAA;AAAA,IACV,UAAA,EAAY,IAAA;AAAA,IACZ,YAAA,EAAc;AAAA,GACf,CAAA;AACH;AAGO,SAAS,UAAA,CAAW,KAAa,QAAA,EAAmD;AACzF,EAAA,KAAA,MAAW,WAAW,QAAA,EAAU;AAC9B,IAAA,IAAI,OAAO,YAAY,QAAA,EAAU;AAC/B,MAAA,IAAI,OAAA,KAAY,KAAK,OAAO,IAAA;AAAA,IAC9B,CAAA,MAAA,IAAW,SAAA,CAAU,OAAA,EAAS,GAAG,CAAA,EAAG;AAClC,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,aAAa,KAAA,EAAyB;AAC7C,EAAA,IAAI,UAAU,IAAA,IAAQ,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,IAAI,OAAO,IAAA;AAClE,EAAA,IAAI,MAAM,OAAA,CAAQ,KAAK,CAAA,EAAG,OAAO,MAAM,MAAA,KAAW,CAAA;AAClD,EAAA,IAAI,aAAA,CAAc,KAAK,CAAA,EAAG,OAAO,OAAO,IAAA,CAAK,KAAK,EAAE,MAAA,KAAW,CAAA;AAC/D,EAAA,OAAO,KAAA;AACT;AAMO,SAAS,eAAe,OAAA,EAA2C;AACxE,EAAA,OAAO;AAAA,IACL,QAAA,EAAU,OAAA,CAAQ,QAAA,IAAY,QAAA,CAAS,QAAA;AAAA,IACvC,cAAA,EAAgB,OAAA,CAAQ,cAAA,IAAkB,QAAA,CAAS,cAAA;AAAA,IACnD,KAAA,EAAO,OAAA,CAAQ,KAAA,IAAS,QAAA,CAAS,KAAA;AAAA,IACjC,SAAA,EAAW,OAAA,CAAQ,SAAA,IAAa,QAAA,CAAS,SAAA;AAAA,IACzC,QAAA,EAAU,OAAA,CAAQ,QAAA,IAAY,QAAA,CAAS,QAAA;AAAA,IACvC,eAAA,EAAiB,OAAA,CAAQ,eAAA,IAAmB,QAAA,CAAS,eAAA;AAAA,IACrD,YAAA,EAAc,OAAA,CAAQ,YAAA,IAAgB,QAAA,CAAS,YAAA;AAAA,IAC/C,aAAA,EAAe,OAAA,CAAQ,aAAA,IAAiB,QAAA,CAAS;AAAA,GACnD;AACF;AAGA,SAAS,cAAA,CACP,GAAA,EACA,MAAA,EACA,KAAA,EACA,MACA,IAAA,EACM;AACN,EAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,EAAG;AACrC,IAAA,IAAI,UAAA,CAAW,GAAA,EAAK,IAAA,CAAK,KAAK,CAAA,EAAG;AAGjC,IAAA,IAAI,eAAe,GAAA,EAAK,IAAA,CAAK,QAAA,EAAU,IAAA,CAAK,eAAe,CAAA,EAAG;AAC5D,MAAA,IAAI,IAAA,CAAK,iBAAiB,QAAA,EAAU;AACpC,MAAA,UAAA,CAAW,GAAA,EAAK,GAAA,EAAK,IAAA,CAAK,aAAa,CAAA;AACvC,MAAA;AAAA,IACF;AACA,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,OAAO,GAAG,CAAA;AAAA,IAClB,CAAA,CAAA,MAAQ;AAEN,MAAA,UAAA,CAAW,GAAA,EAAK,KAAK,YAAY,CAAA;AACjC,MAAA;AAAA,IACF;AACA,IAAA,MAAM,SAAS,IAAA,CAAK,GAAA,EAAK,KAAA,GAAQ,CAAA,EAAG,MAAM,IAAI,CAAA;AAC9C,IAAA,IAAI,WAAW,IAAA,EAAM;AACrB,IAAA,IAAI,IAAA,CAAK,SAAA,IAAa,YAAA,CAAa,MAAM,CAAA,EAAG;AAC5C,IAAA,UAAA,CAAW,GAAA,EAAK,KAAK,MAAM,CAAA;AAAA,EAC7B;AACF;AAEA,SAAS,IAAA,CACP,KAAA,EACA,KAAA,EACA,IAAA,EACA,IAAA,EACS;AACT,EAAA,IAAI,KAAA,KAAU,MAAM,OAAO,IAAA;AAC3B,EAAA,MAAM,OAAO,OAAO,KAAA;AACpB,EAAA,IAAI,IAAA,KAAS,UAAA,IAAc,IAAA,KAAS,QAAA,EAAU,OAAO,IAAA;AAErD,EAAA,IAAI,IAAA,KAAS,QAAA,EAAU,OAAQ,KAAA,CAAiB,QAAA,EAAS;AACzD,EAAA,IAAI,IAAA,KAAS,UAAU,OAAO,KAAA;AAI9B,EAAA,MAAM,GAAA,GAAM,KAAA;AACZ,EAAA,IAAI,IAAA,CAAK,GAAA,CAAI,GAAG,CAAA,EAAG,OAAO,QAAA;AAG1B,EAAA,IAAI,KAAA,YAAiB,MAAM,OAAO,KAAA;AAClC,EAAA,IAAI,iBAAiB,GAAA,EAAK;AACxB,IAAA,IAAA,CAAK,IAAI,GAAG,CAAA;AACZ,IAAA,MAAM,MAA+B,EAAC;AACtC,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,CAAA,IAAK,KAAA,aAAkB,GAAA,EAAK,MAAA,CAAO,CAAC,CAAA,EAAG,CAAC,CAAA;AACxD,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,GAAA,EAAK,KAAA,EAAO,MAAM,IAAI,CAAA;AAC1C,IAAA,IAAA,CAAK,OAAO,GAAG,CAAA;AACf,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,IAAI,iBAAiB,GAAA,EAAK;AACxB,IAAA,IAAA,CAAK,IAAI,GAAG,CAAA;AACZ,IAAA,MAAM,MAAA,GAAS,KAAK,KAAA,CAAM,IAAA,CAAK,KAAK,CAAA,EAAG,KAAA,EAAO,MAAM,IAAI,CAAA;AACxD,IAAA,IAAA,CAAK,OAAO,GAAG,CAAA;AACf,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,IAAA,IAAI,KAAA,IAAS,IAAA,CAAK,QAAA,EAAU,OAAO,eAAA;AACnC,IAAA,IAAA,CAAK,IAAI,GAAG,CAAA;AACZ,IAAA,MAAM,OAAA,GACJ,KAAA,CAAM,MAAA,GAAS,IAAA,CAAK,cAAA,GAAiB,MAAM,KAAA,CAAM,CAAA,EAAG,IAAA,CAAK,cAAc,CAAA,GAAI,KAAA;AAC7E,IAAA,MAAMA,OAAiB,EAAC;AACxB,IAAA,KAAA,MAAW,QAAQ,OAAA,EAAS;AAC1B,MAAA,MAAM,SAAS,IAAA,CAAK,IAAA,EAAM,KAAA,GAAQ,CAAA,EAAG,MAAM,IAAI,CAAA;AAE/C,MAAAA,IAAAA,CAAI,IAAA,CAAK,MAAA,KAAW,IAAA,GAAO,OAAO,MAAM,CAAA;AAAA,IAC1C;AACA,IAAA,IAAI,KAAA,CAAM,MAAA,GAAS,IAAA,CAAK,cAAA,EAAgB;AACtC,MAAAA,KAAI,IAAA,CAAK,CAAA,EAAA,EAAK,MAAM,MAAA,GAAS,IAAA,CAAK,cAAc,CAAA,MAAA,CAAQ,CAAA;AAAA,IAC1D;AACA,IAAA,IAAA,CAAK,OAAO,GAAG,CAAA;AACf,IAAA,OAAOA,IAAAA;AAAA,EACT;AAIA,EAAA,IAAI,KAAA,IAAS,IAAA,CAAK,QAAA,EAAU,OAAO,gBAAA;AACnC,EAAA,IAAA,CAAK,IAAI,GAAG,CAAA;AACZ,EAAA,MAAM,MAA+B,EAAC;AACtC,EAAA,cAAA,CAAe,GAAA,EAAK,KAAA,EAAkC,KAAA,EAAO,IAAA,EAAM,IAAI,CAAA;AACvE,EAAA,IAAA,CAAK,OAAO,GAAG,CAAA;AACf,EAAA,OAAO,GAAA;AACT;AAOO,SAAS,YAAA,CAAa,KAAA,EAAgB,OAAA,GAA2B,EAAC,EAAY;AACnF,EAAA,MAAM,IAAA,GAAO,eAAe,OAAO,CAAA;AACnC,EAAA,MAAM,SAAS,IAAA,CAAK,KAAA,EAAO,GAAG,IAAA,kBAAM,IAAI,SAAS,CAAA;AAEjD,EAAA,OAAO,MAAA,KAAW,OAAO,MAAA,GAAY,MAAA;AACvC;;;AC3JO,SAAS,QAAA,CAAY,KAAA,EAAU,OAAA,GAA2B,EAAC,EAAY;AAC5E,EAAA,OAAO,YAAA,CAAa,OAAO,OAAO,CAAA;AACpC","file":"index.cjs","sourcesContent":["/**\n * Client-side data-safety layer — detect sensitive field names so the walker\n * can redact or remove them BEFORE their values are ever read. Mechanical and\n * key-name-driven: no value inspection, no network, no models.\n *\n * Limitations (key-name-driven by design):\n *  - Matches field NAMES, not values: a secret under an innocuous key, or as a\n *    bare array/Set element (no key), is NOT detected.\n *  - Only own enumerable string keys are processed; Symbol-keyed / non-enumerable\n *    properties are dropped by the walker, never scanned.\n *  - Homoglyph attacks (e.g. Cyrillic look-alikes) are not fully closed; keys are\n *    NFKC-normalized and zero-width-stripped before matching, which defeats the\n *    common fullwidth/zero-width evasions but not deliberate confusables.\n */\n\n/** Default replacement value used when a sensitive field is redacted. */\nexport const REDACTED = \"[REDACTED]\";\n\n/**\n * Built-in deny-list of sensitive field-name patterns (case-insensitive).\n * Patterns are anchored to avoid false positives on common keys — e.g. it does\n * NOT redact `author`, `dashboard`, `secretary`, `tokenCount`, `promptTokens`,\n * or `accessKeyboard`.\n */\nexport const DEFAULT_DENY_LIST: readonly RegExp[] = [\n  // Passwords / pass-phrases\n  /pass(?:word|wd|phrase)/i,\n  // Secrets (\"secret\", \"clientSecret\", \"secretKey\") but not \"secretary\"\n  /secret(?!ary)/i,\n  // Tokens — standalone or with an auth-ish prefix; NOT tokenCount/tokenize/promptTokens\n  /\\btoken\\b/i,\n  /(?:access|refresh|id|auth|bearer|api|csrf|xsrf|session|sso|oauth|reset|verification|activation)[-_]?token/i,\n  // Keys (\"apiKey\", \"accessKey\", \"signingKey\") but not \"accessKeyword\"/\"keyboard\"\n  /(?:api|access|private|signing|encryption)[-_]?keys?(?![a-z])/i,\n  /\\bjwt\\b/i,\n  /authorization/i,\n  /bearer/i,\n  /credentials?/i,\n  /cookie/i,\n  /session[-_]?(?:id|token|key)/i,\n  // 2FA / recovery\n  /\\b(?:otp|totp|mfa|2fa)\\b/i,\n  /(?:recovery|backup)[-_]?codes?/i,\n  /\\bmnemonic\\b/i,\n  /seed[-_]?phrase/i,\n  // Crypto / signing\n  /\\bhmac\\b/i,\n  /\\bsignature\\b/i,\n  /\\b[cx]srf\\b/i,\n  // Connection strings / DB credentials\n  /connection[-_]?string/i,\n  /\\bdsn\\b/i,\n  /(?:database|db)[-_]?(?:url|uri)/i,\n  // PII / financial\n  /ssn/i,\n  /social[-_]?security[-_]?(?:number|no)?/i,\n  /credit[-_]?card/i,\n  /card[-_]?number/i,\n  /cvv2?/i,\n  /\\bpin\\b/i,\n  /\\biban\\b/i,\n  /routing[-_]?number/i,\n  /account[-_]?number/i,\n  /\\bpassport\\b/i,\n  /tax[-_]?id/i,\n];\n\n/** Zero-width / default-ignorable code points used to evade name matching. */\nconst ZERO_WIDTH = /[\\u00AD\\u200B-\\u200D\\u2060\\uFEFF]/g;\n\n/**\n * Normalize a key before matching: NFKC folds fullwidth/compatibility forms to\n * their ASCII equivalents, and zero-width characters are stripped. This defeats\n * the common `\"ｐａｓｓｗｏｒｄ\"` / zero-width-injected evasions.\n */\nexport function normalizeKey(key: string): string {\n  return key.normalize(\"NFKC\").replace(ZERO_WIDTH, \"\");\n}\n\n/**\n * Stateless RegExp test. A user-supplied pattern with the `g`/`y` flag carries\n * a mutable `lastIndex`; resetting it keeps matching deterministic across keys.\n */\nexport function regexTest(re: RegExp, value: string): boolean {\n  if (re.global || re.sticky) re.lastIndex = 0;\n  return re.test(value);\n}\n\n/**\n * Is `key` a sensitive field name? Checks user matchers (string = exact,\n * case-insensitive; RegExp = pattern) and, when `useDefaults`, the built-in\n * deny-list. Keys are NFKC-normalized and zero-width-stripped first.\n */\nexport function isSensitiveKey(\n  key: string,\n  userMatchers: ReadonlyArray<string | RegExp>,\n  useDefaults: boolean,\n): boolean {\n  const normalized = normalizeKey(key);\n  const lower = normalized.toLowerCase();\n  for (const matcher of userMatchers) {\n    if (typeof matcher === \"string\") {\n      if (normalizeKey(matcher).toLowerCase() === lower) return true;\n    } else if (regexTest(matcher, normalized)) {\n      return true;\n    }\n  }\n  if (useDefaults) {\n    for (const re of DEFAULT_DENY_LIST) {\n      if (regexTest(re, normalized)) return true;\n    }\n  }\n  return false;\n}\n","/**\n * Core compression walker — mechanical, deterministic, zero-dependency.\n *\n * A single recursive pass applies: key stripping, depth capping, array-length\n * capping, and empty-value dropping, with circular-reference protection.\n * Sanitization (task 003) composes into this same walk via {@link CompressOptions.sanitize}.\n */\n\nimport type { CompressOptions } from \"../index\";\nimport { isSensitiveKey, REDACTED, regexTest } from \"./sanitize\";\n\n/** Marker substituted for a node that exceeds {@link CompressOptions.maxDepth}. */\nexport const TRUNCATED_OBJECT = \"[Object]\";\n/** Marker substituted for an array that exceeds {@link CompressOptions.maxDepth}. */\nexport const TRUNCATED_ARRAY = \"[Array]\";\n/** Marker substituted for a circular back-reference. */\nexport const CIRCULAR = \"[Circular]\";\n/** Marker substituted for a property whose getter threw when read. */\nexport const GETTER_ERROR = \"[Getter]\";\n\n/**\n * Safe default depth cap. Real application state is rarely deeper than a few\n * dozen levels; capping by default keeps payloads minimal and prevents a\n * stack-overflow DoS on pathologically deep (untrusted) input. Opt out with\n * `maxDepth: Infinity`.\n */\nexport const DEFAULT_MAX_DEPTH = 100;\n\n/** Fully-resolved options after defaults are applied. */\ninterface ResolvedOptions {\n  maxDepth: number;\n  maxArrayLength: number;\n  strip: Array<string | RegExp>;\n  dropEmpty: boolean;\n  sanitize: Array<string | RegExp>;\n  defaultSanitize: boolean;\n  sanitizeMode: \"redact\" | \"remove\";\n  redactedValue: string;\n}\n\nconst DEFAULTS: ResolvedOptions = {\n  maxDepth: DEFAULT_MAX_DEPTH,\n  maxArrayLength: Number.POSITIVE_INFINITY,\n  strip: [],\n  dropEmpty: false,\n  sanitize: [],\n  defaultSanitize: true,\n  sanitizeMode: \"redact\",\n  redactedValue: REDACTED,\n};\n\n/** A unique sentinel meaning \"this value should be omitted from the output\". */\nconst OMIT = Symbol(\"omit\");\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  if (typeof value !== \"object\" || value === null) return false;\n  const proto = Object.getPrototypeOf(value);\n  return proto === Object.prototype || proto === null;\n}\n\n/**\n * Assign an own, enumerable data property — even for dangerous keys like\n * `__proto__` (a plain `out[key] = v` would reassign the prototype instead of\n * creating a property, corrupting the output and silently dropping the value).\n */\nfunction safeAssign(target: Record<string, unknown>, key: string, value: unknown): void {\n  Object.defineProperty(target, key, {\n    value,\n    writable: true,\n    enumerable: true,\n    configurable: true,\n  });\n}\n\n/** Does `key` match any matcher (exact string or RegExp test)? */\nexport function keyMatches(key: string, matchers: ReadonlyArray<string | RegExp>): boolean {\n  for (const matcher of matchers) {\n    if (typeof matcher === \"string\") {\n      if (matcher === key) return true;\n    } else if (regexTest(matcher, key)) {\n      return true;\n    }\n  }\n  return false;\n}\n\nfunction isEmptyValue(value: unknown): boolean {\n  if (value === null || value === undefined || value === \"\") return true;\n  if (Array.isArray(value)) return value.length === 0;\n  if (isPlainObject(value)) return Object.keys(value).length === 0;\n  return false;\n}\n\n/**\n * Resolve user options against defaults. Exposed so the React layer and\n * sanitization can share one normalization path.\n */\nexport function resolveOptions(options: CompressOptions): ResolvedOptions {\n  return {\n    maxDepth: options.maxDepth ?? DEFAULTS.maxDepth,\n    maxArrayLength: options.maxArrayLength ?? DEFAULTS.maxArrayLength,\n    strip: options.strip ?? DEFAULTS.strip,\n    dropEmpty: options.dropEmpty ?? DEFAULTS.dropEmpty,\n    sanitize: options.sanitize ?? DEFAULTS.sanitize,\n    defaultSanitize: options.defaultSanitize ?? DEFAULTS.defaultSanitize,\n    sanitizeMode: options.sanitizeMode ?? DEFAULTS.sanitizeMode,\n    redactedValue: options.redactedValue ?? DEFAULTS.redactedValue,\n  };\n}\n\n/** Walk own enumerable string keys of an object-like value into `out`. */\nfunction walkObjectInto(\n  out: Record<string, unknown>,\n  source: Record<string, unknown>,\n  depth: number,\n  opts: ResolvedOptions,\n  seen: WeakSet<object>,\n): void {\n  for (const key of Object.keys(source)) {\n    if (keyMatches(key, opts.strip)) continue;\n    // Sanitize BEFORE reading the value: a sensitive value is never read\n    // (no getter fired), never walked, and never reaches the output.\n    if (isSensitiveKey(key, opts.sanitize, opts.defaultSanitize)) {\n      if (opts.sanitizeMode === \"remove\") continue;\n      safeAssign(out, key, opts.redactedValue);\n      continue;\n    }\n    let raw: unknown;\n    try {\n      raw = source[key];\n    } catch {\n      // A getter threw — degrade to a marker rather than crashing the walk.\n      safeAssign(out, key, GETTER_ERROR);\n      continue;\n    }\n    const walked = walk(raw, depth + 1, opts, seen);\n    if (walked === OMIT) continue;\n    if (opts.dropEmpty && isEmptyValue(walked)) continue;\n    safeAssign(out, key, walked);\n  }\n}\n\nfunction walk(\n  value: unknown,\n  depth: number,\n  opts: ResolvedOptions,\n  seen: WeakSet<object>,\n): unknown {\n  if (value === null) return null;\n  const type = typeof value;\n  if (type === \"function\" || type === \"symbol\") return OMIT;\n  // BigInt is not JSON-serializable; coerce to string for an LLM-ready payload.\n  if (type === \"bigint\") return (value as bigint).toString();\n  if (type !== \"object\") return value;\n\n  // Circular-reference guard sits above all object normalization so a cycle\n  // through a Map/Set is caught instead of overflowing the stack.\n  const ref = value as object;\n  if (seen.has(ref)) return CIRCULAR;\n\n  // Non-plain objects we deliberately normalize for a predictable payload.\n  if (value instanceof Date) return value;\n  if (value instanceof Map) {\n    seen.add(ref);\n    const obj: Record<string, unknown> = {};\n    for (const [k, v] of value) safeAssign(obj, String(k), v);\n    const result = walk(obj, depth, opts, seen);\n    seen.delete(ref);\n    return result;\n  }\n  if (value instanceof Set) {\n    seen.add(ref);\n    const result = walk(Array.from(value), depth, opts, seen);\n    seen.delete(ref);\n    return result;\n  }\n\n  if (Array.isArray(value)) {\n    if (depth >= opts.maxDepth) return TRUNCATED_ARRAY;\n    seen.add(ref);\n    const limited =\n      value.length > opts.maxArrayLength ? value.slice(0, opts.maxArrayLength) : value;\n    const out: unknown[] = [];\n    for (const item of limited) {\n      const walked = walk(item, depth + 1, opts, seen);\n      // In arrays, an omitted item collapses to null to preserve index intent.\n      out.push(walked === OMIT ? null : walked);\n    }\n    if (value.length > opts.maxArrayLength) {\n      out.push(`[+${value.length - opts.maxArrayLength} more]`);\n    }\n    seen.delete(ref);\n    return out;\n  }\n\n  // Plain objects and unknown object kinds (class instances) both rebuild as a\n  // plain object from their own enumerable string keys.\n  if (depth >= opts.maxDepth) return TRUNCATED_OBJECT;\n  seen.add(ref);\n  const out: Record<string, unknown> = {};\n  walkObjectInto(out, value as Record<string, unknown>, depth, opts, seen);\n  seen.delete(ref);\n  return out;\n}\n\n/**\n * Mechanically compress a state value into a minimal payload, applying the\n * structural transforms in {@link CompressOptions}. Pure and deterministic;\n * the input is never mutated.\n */\nexport function compressCore(state: unknown, options: CompressOptions = {}): unknown {\n  const opts = resolveOptions(options);\n  const walked = walk(state, 0, opts, new WeakSet());\n  // A top-level function/symbol compresses to undefined rather than a sentinel.\n  return walked === OMIT ? undefined : walked;\n}\n","/**\n * react-context-compressor — core entry (framework-agnostic, zero dependencies).\n *\n * Mechanical compression lands here (task 002); sanitization composes into the\n * same walk in task 003.\n */\n\nimport { compressCore } from \"./core/compress\";\n\n/**\n * Options controlling how a state value is mechanically compressed and\n * sanitized into a minimal, LLM-ready payload. All fields are optional;\n * `compress(state)` with no options returns a safe deep copy.\n */\nexport interface CompressOptions {\n  /**\n   * Maximum object/array depth to retain. Nodes deeper than this are replaced\n   * with a `\"[Object]\"` / `\"[Array]\"` marker. Default: `100` (a safe cap that\n   * keeps payloads minimal and prevents stack overflow on pathologically deep\n   * input). Set to `Infinity` to disable depth capping.\n   */\n  maxDepth?: number;\n  /**\n   * Maximum array length to retain. Longer arrays are truncated and a\n   * `\"[+N more]\"` marker is appended. Default: unlimited.\n   */\n  maxArrayLength?: number;\n  /** Keys (exact strings or patterns) to strip from the output. */\n  strip?: Array<string | RegExp>;\n  /** When true, drop `null` / `undefined` / `\"\"` / `[]` / `{}` values. */\n  dropEmpty?: boolean;\n  /**\n   * Extra sensitive field-name matchers to redact/remove, IN ADDITION to the\n   * built-in deny-list (unless {@link CompressOptions.defaultSanitize} is\n   * `false`). A `string` matches a key case-insensitively and exactly; a\n   * `RegExp` matches by pattern. Matching is by field NAME, not value.\n   */\n  sanitize?: Array<string | RegExp>;\n  /**\n   * Apply the built-in sensitive-field deny-list (password, token, secret,\n   * apiKey, authorization, cookie, ssn, creditCard, …). Default: `true`.\n   * Set `false` to rely solely on {@link CompressOptions.sanitize}.\n   */\n  defaultSanitize?: boolean;\n  /**\n   * How to treat a sensitive field: `\"redact\"` replaces its value with\n   * {@link CompressOptions.redactedValue}; `\"remove\"` drops the key entirely.\n   * Either way the value is never read or emitted. Default: `\"redact\"`.\n   */\n  sanitizeMode?: \"redact\" | \"remove\";\n  /** Replacement used when `sanitizeMode` is `\"redact\"`. Default: `\"[REDACTED]\"`. */\n  redactedValue?: string;\n}\n\n/**\n * Mechanically compress and sanitize a state value into a minimal, safe payload.\n *\n * Pure and deterministic: the same input and options always produce the same\n * output, and the input is never mutated. Performs no I/O — purely structural.\n */\nexport function compress<T>(state: T, options: CompressOptions = {}): unknown {\n  return compressCore(state, options);\n}\n"]}

package/dist/index.d.cts

@@ -0,0 +1,59 @@
+/**
+ * react-context-compressor — core entry (framework-agnostic, zero dependencies).
+ *
+ * Mechanical compression lands here (task 002); sanitization composes into the
+ * same walk in task 003.
+ */
+/**
+ * Options controlling how a state value is mechanically compressed and
+ * sanitized into a minimal, LLM-ready payload. All fields are optional;
+ * `compress(state)` with no options returns a safe deep copy.
+ */
+interface CompressOptions {
+    /**
+     * Maximum object/array depth to retain. Nodes deeper than this are replaced
+     * with a `"[Object]"` / `"[Array]"` marker. Default: `100` (a safe cap that
+     * keeps payloads minimal and prevents stack overflow on pathologically deep
+     * input). Set to `Infinity` to disable depth capping.
+     */
+    maxDepth?: number;
+    /**
+     * Maximum array length to retain. Longer arrays are truncated and a
+     * `"[+N more]"` marker is appended. Default: unlimited.
+     */
+    maxArrayLength?: number;
+    /** Keys (exact strings or patterns) to strip from the output. */
+    strip?: Array<string | RegExp>;
+    /** When true, drop `null` / `undefined` / `""` / `[]` / `{}` values. */
+    dropEmpty?: boolean;
+    /**
+     * Extra sensitive field-name matchers to redact/remove, IN ADDITION to the
+     * built-in deny-list (unless {@link CompressOptions.defaultSanitize} is
+     * `false`). A `string` matches a key case-insensitively and exactly; a
+     * `RegExp` matches by pattern. Matching is by field NAME, not value.
+     */
+    sanitize?: Array<string | RegExp>;
+    /**
+     * Apply the built-in sensitive-field deny-list (password, token, secret,
+     * apiKey, authorization, cookie, ssn, creditCard, …). Default: `true`.
+     * Set `false` to rely solely on {@link CompressOptions.sanitize}.
+     */
+    defaultSanitize?: boolean;
+    /**
+     * How to treat a sensitive field: `"redact"` replaces its value with
+     * {@link CompressOptions.redactedValue}; `"remove"` drops the key entirely.
+     * Either way the value is never read or emitted. Default: `"redact"`.
+     */
+    sanitizeMode?: "redact" | "remove";
+    /** Replacement used when `sanitizeMode` is `"redact"`. Default: `"[REDACTED]"`. */
+    redactedValue?: string;
+}
+/**
+ * Mechanically compress and sanitize a state value into a minimal, safe payload.
+ *
+ * Pure and deterministic: the same input and options always produce the same
+ * output, and the input is never mutated. Performs no I/O — purely structural.
+ */
+declare function compress<T>(state: T, options?: CompressOptions): unknown;
+
+export { type CompressOptions, compress };

package/dist/index.d.ts

@@ -0,0 +1,59 @@
+/**
+ * react-context-compressor — core entry (framework-agnostic, zero dependencies).
+ *
+ * Mechanical compression lands here (task 002); sanitization composes into the
+ * same walk in task 003.
+ */
+/**
+ * Options controlling how a state value is mechanically compressed and
+ * sanitized into a minimal, LLM-ready payload. All fields are optional;
+ * `compress(state)` with no options returns a safe deep copy.
+ */
+interface CompressOptions {
+    /**
+     * Maximum object/array depth to retain. Nodes deeper than this are replaced
+     * with a `"[Object]"` / `"[Array]"` marker. Default: `100` (a safe cap that
+     * keeps payloads minimal and prevents stack overflow on pathologically deep
+     * input). Set to `Infinity` to disable depth capping.
+     */
+    maxDepth?: number;
+    /**
+     * Maximum array length to retain. Longer arrays are truncated and a
+     * `"[+N more]"` marker is appended. Default: unlimited.
+     */
+    maxArrayLength?: number;
+    /** Keys (exact strings or patterns) to strip from the output. */
+    strip?: Array<string | RegExp>;
+    /** When true, drop `null` / `undefined` / `""` / `[]` / `{}` values. */
+    dropEmpty?: boolean;
+    /**
+     * Extra sensitive field-name matchers to redact/remove, IN ADDITION to the
+     * built-in deny-list (unless {@link CompressOptions.defaultSanitize} is
+     * `false`). A `string` matches a key case-insensitively and exactly; a
+     * `RegExp` matches by pattern. Matching is by field NAME, not value.
+     */
+    sanitize?: Array<string | RegExp>;
+    /**
+     * Apply the built-in sensitive-field deny-list (password, token, secret,
+     * apiKey, authorization, cookie, ssn, creditCard, …). Default: `true`.
+     * Set `false` to rely solely on {@link CompressOptions.sanitize}.
+     */
+    defaultSanitize?: boolean;
+    /**
+     * How to treat a sensitive field: `"redact"` replaces its value with
+     * {@link CompressOptions.redactedValue}; `"remove"` drops the key entirely.
+     * Either way the value is never read or emitted. Default: `"redact"`.
+     */
+    sanitizeMode?: "redact" | "remove";
+    /** Replacement used when `sanitizeMode` is `"redact"`. Default: `"[REDACTED]"`. */
+    redactedValue?: string;
+}
+/**
+ * Mechanically compress and sanitize a state value into a minimal, safe payload.
+ *
+ * Pure and deterministic: the same input and options always produce the same
+ * output, and the input is never mutated. Performs no I/O — purely structural.
+ */
+declare function compress<T>(state: T, options?: CompressOptions): unknown;
+
+export { type CompressOptions, compress };

package/dist/index.mjs

@@ -0,0 +1,3 @@
+export { compress } from './chunk-VBOCWPM5.mjs';
+//# sourceMappingURL=index.mjs.map
+//# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"index.mjs"}

package/dist/react/index.cjs

@@ -0,0 +1,239 @@
+'use strict';
+
+var react = require('react');
+
+// src/react/index.ts
+
+// src/core/sanitize.ts
+var REDACTED = "[REDACTED]";
+var DEFAULT_DENY_LIST = [
+  // Passwords / pass-phrases
+  /pass(?:word|wd|phrase)/i,
+  // Secrets ("secret", "clientSecret", "secretKey") but not "secretary"
+  /secret(?!ary)/i,
+  // Tokens — standalone or with an auth-ish prefix; NOT tokenCount/tokenize/promptTokens
+  /\btoken\b/i,
+  /(?:access|refresh|id|auth|bearer|api|csrf|xsrf|session|sso|oauth|reset|verification|activation)[-_]?token/i,
+  // Keys ("apiKey", "accessKey", "signingKey") but not "accessKeyword"/"keyboard"
+  /(?:api|access|private|signing|encryption)[-_]?keys?(?![a-z])/i,
+  /\bjwt\b/i,
+  /authorization/i,
+  /bearer/i,
+  /credentials?/i,
+  /cookie/i,
+  /session[-_]?(?:id|token|key)/i,
+  // 2FA / recovery
+  /\b(?:otp|totp|mfa|2fa)\b/i,
+  /(?:recovery|backup)[-_]?codes?/i,
+  /\bmnemonic\b/i,
+  /seed[-_]?phrase/i,
+  // Crypto / signing
+  /\bhmac\b/i,
+  /\bsignature\b/i,
+  /\b[cx]srf\b/i,
+  // Connection strings / DB credentials
+  /connection[-_]?string/i,
+  /\bdsn\b/i,
+  /(?:database|db)[-_]?(?:url|uri)/i,
+  // PII / financial
+  /ssn/i,
+  /social[-_]?security[-_]?(?:number|no)?/i,
+  /credit[-_]?card/i,
+  /card[-_]?number/i,
+  /cvv2?/i,
+  /\bpin\b/i,
+  /\biban\b/i,
+  /routing[-_]?number/i,
+  /account[-_]?number/i,
+  /\bpassport\b/i,
+  /tax[-_]?id/i
+];
+var ZERO_WIDTH = /[\u00AD\u200B-\u200D\u2060\uFEFF]/g;
+function normalizeKey(key) {
+  return key.normalize("NFKC").replace(ZERO_WIDTH, "");
+}
+function regexTest(re, value) {
+  if (re.global || re.sticky) re.lastIndex = 0;
+  return re.test(value);
+}
+function isSensitiveKey(key, userMatchers, useDefaults) {
+  const normalized = normalizeKey(key);
+  const lower = normalized.toLowerCase();
+  for (const matcher of userMatchers) {
+    if (typeof matcher === "string") {
+      if (normalizeKey(matcher).toLowerCase() === lower) return true;
+    } else if (regexTest(matcher, normalized)) {
+      return true;
+    }
+  }
+  if (useDefaults) {
+    for (const re of DEFAULT_DENY_LIST) {
+      if (regexTest(re, normalized)) return true;
+    }
+  }
+  return false;
+}
+
+// src/core/compress.ts
+var TRUNCATED_OBJECT = "[Object]";
+var TRUNCATED_ARRAY = "[Array]";
+var CIRCULAR = "[Circular]";
+var GETTER_ERROR = "[Getter]";
+var DEFAULT_MAX_DEPTH = 100;
+var DEFAULTS = {
+  maxDepth: DEFAULT_MAX_DEPTH,
+  maxArrayLength: Number.POSITIVE_INFINITY,
+  strip: [],
+  dropEmpty: false,
+  sanitize: [],
+  defaultSanitize: true,
+  sanitizeMode: "redact",
+  redactedValue: REDACTED
+};
+var OMIT = /* @__PURE__ */ Symbol("omit");
+function isPlainObject(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+}
+function safeAssign(target, key, value) {
+  Object.defineProperty(target, key, {
+    value,
+    writable: true,
+    enumerable: true,
+    configurable: true
+  });
+}
+function keyMatches(key, matchers) {
+  for (const matcher of matchers) {
+    if (typeof matcher === "string") {
+      if (matcher === key) return true;
+    } else if (regexTest(matcher, key)) {
+      return true;
+    }
+  }
+  return false;
+}
+function isEmptyValue(value) {
+  if (value === null || value === void 0 || value === "") return true;
+  if (Array.isArray(value)) return value.length === 0;
+  if (isPlainObject(value)) return Object.keys(value).length === 0;
+  return false;
+}
+function resolveOptions(options) {
+  return {
+    maxDepth: options.maxDepth ?? DEFAULTS.maxDepth,
+    maxArrayLength: options.maxArrayLength ?? DEFAULTS.maxArrayLength,
+    strip: options.strip ?? DEFAULTS.strip,
+    dropEmpty: options.dropEmpty ?? DEFAULTS.dropEmpty,
+    sanitize: options.sanitize ?? DEFAULTS.sanitize,
+    defaultSanitize: options.defaultSanitize ?? DEFAULTS.defaultSanitize,
+    sanitizeMode: options.sanitizeMode ?? DEFAULTS.sanitizeMode,
+    redactedValue: options.redactedValue ?? DEFAULTS.redactedValue
+  };
+}
+function walkObjectInto(out, source, depth, opts, seen) {
+  for (const key of Object.keys(source)) {
+    if (keyMatches(key, opts.strip)) continue;
+    if (isSensitiveKey(key, opts.sanitize, opts.defaultSanitize)) {
+      if (opts.sanitizeMode === "remove") continue;
+      safeAssign(out, key, opts.redactedValue);
+      continue;
+    }
+    let raw;
+    try {
+      raw = source[key];
+    } catch {
+      safeAssign(out, key, GETTER_ERROR);
+      continue;
+    }
+    const walked = walk(raw, depth + 1, opts, seen);
+    if (walked === OMIT) continue;
+    if (opts.dropEmpty && isEmptyValue(walked)) continue;
+    safeAssign(out, key, walked);
+  }
+}
+function walk(value, depth, opts, seen) {
+  if (value === null) return null;
+  const type = typeof value;
+  if (type === "function" || type === "symbol") return OMIT;
+  if (type === "bigint") return value.toString();
+  if (type !== "object") return value;
+  const ref = value;
+  if (seen.has(ref)) return CIRCULAR;
+  if (value instanceof Date) return value;
+  if (value instanceof Map) {
+    seen.add(ref);
+    const obj = {};
+    for (const [k, v] of value) safeAssign(obj, String(k), v);
+    const result = walk(obj, depth, opts, seen);
+    seen.delete(ref);
+    return result;
+  }
+  if (value instanceof Set) {
+    seen.add(ref);
+    const result = walk(Array.from(value), depth, opts, seen);
+    seen.delete(ref);
+    return result;
+  }
+  if (Array.isArray(value)) {
+    if (depth >= opts.maxDepth) return TRUNCATED_ARRAY;
+    seen.add(ref);
+    const limited = value.length > opts.maxArrayLength ? value.slice(0, opts.maxArrayLength) : value;
+    const out2 = [];
+    for (const item of limited) {
+      const walked = walk(item, depth + 1, opts, seen);
+      out2.push(walked === OMIT ? null : walked);
+    }
+    if (value.length > opts.maxArrayLength) {
+      out2.push(`[+${value.length - opts.maxArrayLength} more]`);
+    }
+    seen.delete(ref);
+    return out2;
+  }
+  if (depth >= opts.maxDepth) return TRUNCATED_OBJECT;
+  seen.add(ref);
+  const out = {};
+  walkObjectInto(out, value, depth, opts, seen);
+  seen.delete(ref);
+  return out;
+}
+function compressCore(state, options = {}) {
+  const opts = resolveOptions(options);
+  const walked = walk(state, 0, opts, /* @__PURE__ */ new WeakSet());
+  return walked === OMIT ? void 0 : walked;
+}
+
+// src/index.ts
+function compress(state, options = {}) {
+  return compressCore(state, options);
+}
+
+// src/react/signature.ts
+var FIELD = "
";
+var ITEM = "\0";
+function matcherKey(m) {
+  return typeof m === "string" ? `s:${JSON.stringify(m)}` : `r:${JSON.stringify(m.source)}:${m.flags}`;
+}
+function optionsSignature(o) {
+  return [
+    `d=${o.maxDepth ?? ""}`,
+    `a=${o.maxArrayLength ?? ""}`,
+    `e=${o.dropEmpty ?? ""}`,
+    `ds=${o.defaultSanitize ?? ""}`,
+    `sm=${o.sanitizeMode ?? ""}`,
+    `rv=${JSON.stringify(o.redactedValue ?? "")}`,
+    `st=${(o.strip ?? []).map(matcherKey).join(ITEM)}`,
+    `sn=${(o.sanitize ?? []).map(matcherKey).join(ITEM)}`
+  ].join(FIELD);
+}
+
+// src/react/index.ts
+function useCompressedContext(state, options = {}) {
+  const signature = optionsSignature(options);
+  return react.useMemo(() => compress(state, options), [state, signature]);
+}
+
+exports.useCompressedContext = useCompressedContext;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map

package/dist/react/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/sanitize.ts","../../src/core/compress.ts","../../src/index.ts","../../src/react/signature.ts","../../src/react/index.ts"],"names":["out","useMemo"],"mappings":";;;;;;;AAgBO,IAAM,QAAA,GAAW,YAAA;AAQjB,IAAM,iBAAA,GAAuC;AAAA;AAAA,EAElD,yBAAA;AAAA;AAAA,EAEA,gBAAA;AAAA;AAAA,EAEA,YAAA;AAAA,EACA,4GAAA;AAAA;AAAA,EAEA,+DAAA;AAAA,EACA,UAAA;AAAA,EACA,gBAAA;AAAA,EACA,SAAA;AAAA,EACA,eAAA;AAAA,EACA,SAAA;AAAA,EACA,+BAAA;AAAA;AAAA,EAEA,2BAAA;AAAA,EACA,iCAAA;AAAA,EACA,eAAA;AAAA,EACA,kBAAA;AAAA;AAAA,EAEA,WAAA;AAAA,EACA,gBAAA;AAAA,EACA,cAAA;AAAA;AAAA,EAEA,wBAAA;AAAA,EACA,UAAA;AAAA,EACA,kCAAA;AAAA;AAAA,EAEA,MAAA;AAAA,EACA,yCAAA;AAAA,EACA,kBAAA;AAAA,EACA,kBAAA;AAAA,EACA,QAAA;AAAA,EACA,UAAA;AAAA,EACA,WAAA;AAAA,EACA,qBAAA;AAAA,EACA,qBAAA;AAAA,EACA,eAAA;AAAA,EACA;AACF,CAAA;AAGA,IAAM,UAAA,GAAa,oCAAA;AAOZ,SAAS,aAAa,GAAA,EAAqB;AAChD,EAAA,OAAO,IAAI,SAAA,CAAU,MAAM,CAAA,CAAE,OAAA,CAAQ,YAAY,EAAE,CAAA;AACrD;AAMO,SAAS,SAAA,CAAU,IAAY,KAAA,EAAwB;AAC5D,EAAA,IAAI,EAAA,CAAG,MAAA,IAAU,EAAA,CAAG,MAAA,KAAW,SAAA,GAAY,CAAA;AAC3C,EAAA,OAAO,EAAA,CAAG,KAAK,KAAK,CAAA;AACtB;AAOO,SAAS,cAAA,CACd,GAAA,EACA,YAAA,EACA,WAAA,EACS;AACT,EAAA,MAAM,UAAA,GAAa,aAAa,GAAG,CAAA;AACnC,EAAA,MAAM,KAAA,GAAQ,WAAW,WAAA,EAAY;AACrC,EAAA,KAAA,MAAW,WAAW,YAAA,EAAc;AAClC,IAAA,IAAI,OAAO,YAAY,QAAA,EAAU;AAC/B,MAAA,IAAI,aAAa,OAAO,CAAA,CAAE,WAAA,EAAY,KAAM,OAAO,OAAO,IAAA;AAAA,IAC5D,CAAA,MAAA,IAAW,SAAA,CAAU,OAAA,EAAS,UAAU,CAAA,EAAG;AACzC,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AACA,EAAA,IAAI,WAAA,EAAa;AACf,IAAA,KAAA,MAAW,MAAM,iBAAA,EAAmB;AAClC,MAAA,IAAI,SAAA,CAAU,EAAA,EAAI,UAAU,CAAA,EAAG,OAAO,IAAA;AAAA,IACxC;AAAA,EACF;AACA,EAAA,OAAO,KAAA;AACT;;;ACrGO,IAAM,gBAAA,GAAmB,UAAA;AAEzB,IAAM,eAAA,GAAkB,SAAA;AAExB,IAAM,QAAA,GAAW,YAAA;AAEjB,IAAM,YAAA,GAAe,UAAA;AAQrB,IAAM,iBAAA,GAAoB,GAAA;AAcjC,IAAM,QAAA,GAA4B;AAAA,EAChC,QAAA,EAAU,iBAAA;AAAA,EACV,gBAAgB,MAAA,CAAO,iBAAA;AAAA,EACvB,OAAO,EAAC;AAAA,EACR,SAAA,EAAW,KAAA;AAAA,EACX,UAAU,EAAC;AAAA,EACX,eAAA,EAAiB,IAAA;AAAA,EACjB,YAAA,EAAc,QAAA;AAAA,EACd,aAAA,EAAe;AACjB,CAAA;AAGA,IAAM,IAAA,0BAAc,MAAM,CAAA;AAE1B,SAAS,cAAc,KAAA,EAAkD;AACvE,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,MAAM,OAAO,KAAA;AACxD,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,cAAA,CAAe,KAAK,CAAA;AACzC,EAAA,OAAO,KAAA,KAAU,MAAA,CAAO,SAAA,IAAa,KAAA,KAAU,IAAA;AACjD;AAOA,SAAS,UAAA,CAAW,MAAA,EAAiC,GAAA,EAAa,KAAA,EAAsB;AACtF,EAAA,MAAA,CAAO,cAAA,CAAe,QAAQ,GAAA,EAAK;AAAA,IACjC,KAAA;AAAA,IACA,QAAA,EAAU,IAAA;AAAA,IACV,UAAA,EAAY,IAAA;AAAA,IACZ,YAAA,EAAc;AAAA,GACf,CAAA;AACH;AAGO,SAAS,UAAA,CAAW,KAAa,QAAA,EAAmD;AACzF,EAAA,KAAA,MAAW,WAAW,QAAA,EAAU;AAC9B,IAAA,IAAI,OAAO,YAAY,QAAA,EAAU;AAC/B,MAAA,IAAI,OAAA,KAAY,KAAK,OAAO,IAAA;AAAA,IAC9B,CAAA,MAAA,IAAW,SAAA,CAAU,OAAA,EAAS,GAAG,CAAA,EAAG;AAClC,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,aAAa,KAAA,EAAyB;AAC7C,EAAA,IAAI,UAAU,IAAA,IAAQ,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,IAAI,OAAO,IAAA;AAClE,EAAA,IAAI,MAAM,OAAA,CAAQ,KAAK,CAAA,EAAG,OAAO,MAAM,MAAA,KAAW,CAAA;AAClD,EAAA,IAAI,aAAA,CAAc,KAAK,CAAA,EAAG,OAAO,OAAO,IAAA,CAAK,KAAK,EAAE,MAAA,KAAW,CAAA;AAC/D,EAAA,OAAO,KAAA;AACT;AAMO,SAAS,eAAe,OAAA,EAA2C;AACxE,EAAA,OAAO;AAAA,IACL,QAAA,EAAU,OAAA,CAAQ,QAAA,IAAY,QAAA,CAAS,QAAA;AAAA,IACvC,cAAA,EAAgB,OAAA,CAAQ,cAAA,IAAkB,QAAA,CAAS,cAAA;AAAA,IACnD,KAAA,EAAO,OAAA,CAAQ,KAAA,IAAS,QAAA,CAAS,KAAA;AAAA,IACjC,SAAA,EAAW,OAAA,CAAQ,SAAA,IAAa,QAAA,CAAS,SAAA;AAAA,IACzC,QAAA,EAAU,OAAA,CAAQ,QAAA,IAAY,QAAA,CAAS,QAAA;AAAA,IACvC,eAAA,EAAiB,OAAA,CAAQ,eAAA,IAAmB,QAAA,CAAS,eAAA;AAAA,IACrD,YAAA,EAAc,OAAA,CAAQ,YAAA,IAAgB,QAAA,CAAS,YAAA;AAAA,IAC/C,aAAA,EAAe,OAAA,CAAQ,aAAA,IAAiB,QAAA,CAAS;AAAA,GACnD;AACF;AAGA,SAAS,cAAA,CACP,GAAA,EACA,MAAA,EACA,KAAA,EACA,MACA,IAAA,EACM;AACN,EAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,EAAG;AACrC,IAAA,IAAI,UAAA,CAAW,GAAA,EAAK,IAAA,CAAK,KAAK,CAAA,EAAG;AAGjC,IAAA,IAAI,eAAe,GAAA,EAAK,IAAA,CAAK,QAAA,EAAU,IAAA,CAAK,eAAe,CAAA,EAAG;AAC5D,MAAA,IAAI,IAAA,CAAK,iBAAiB,QAAA,EAAU;AACpC,MAAA,UAAA,CAAW,GAAA,EAAK,GAAA,EAAK,IAAA,CAAK,aAAa,CAAA;AACvC,MAAA;AAAA,IACF;AACA,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,OAAO,GAAG,CAAA;AAAA,IAClB,CAAA,CAAA,MAAQ;AAEN,MAAA,UAAA,CAAW,GAAA,EAAK,KAAK,YAAY,CAAA;AACjC,MAAA;AAAA,IACF;AACA,IAAA,MAAM,SAAS,IAAA,CAAK,GAAA,EAAK,KAAA,GAAQ,CAAA,EAAG,MAAM,IAAI,CAAA;AAC9C,IAAA,IAAI,WAAW,IAAA,EAAM;AACrB,IAAA,IAAI,IAAA,CAAK,SAAA,IAAa,YAAA,CAAa,MAAM,CAAA,EAAG;AAC5C,IAAA,UAAA,CAAW,GAAA,EAAK,KAAK,MAAM,CAAA;AAAA,EAC7B;AACF;AAEA,SAAS,IAAA,CACP,KAAA,EACA,KAAA,EACA,IAAA,EACA,IAAA,EACS;AACT,EAAA,IAAI,KAAA,KAAU,MAAM,OAAO,IAAA;AAC3B,EAAA,MAAM,OAAO,OAAO,KAAA;AACpB,EAAA,IAAI,IAAA,KAAS,UAAA,IAAc,IAAA,KAAS,QAAA,EAAU,OAAO,IAAA;AAErD,EAAA,IAAI,IAAA,KAAS,QAAA,EAAU,OAAQ,KAAA,CAAiB,QAAA,EAAS;AACzD,EAAA,IAAI,IAAA,KAAS,UAAU,OAAO,KAAA;AAI9B,EAAA,MAAM,GAAA,GAAM,KAAA;AACZ,EAAA,IAAI,IAAA,CAAK,GAAA,CAAI,GAAG,CAAA,EAAG,OAAO,QAAA;AAG1B,EAAA,IAAI,KAAA,YAAiB,MAAM,OAAO,KAAA;AAClC,EAAA,IAAI,iBAAiB,GAAA,EAAK;AACxB,IAAA,IAAA,CAAK,IAAI,GAAG,CAAA;AACZ,IAAA,MAAM,MAA+B,EAAC;AACtC,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,CAAA,IAAK,KAAA,aAAkB,GAAA,EAAK,MAAA,CAAO,CAAC,CAAA,EAAG,CAAC,CAAA;AACxD,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,GAAA,EAAK,KAAA,EAAO,MAAM,IAAI,CAAA;AAC1C,IAAA,IAAA,CAAK,OAAO,GAAG,CAAA;AACf,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,IAAI,iBAAiB,GAAA,EAAK;AACxB,IAAA,IAAA,CAAK,IAAI,GAAG,CAAA;AACZ,IAAA,MAAM,MAAA,GAAS,KAAK,KAAA,CAAM,IAAA,CAAK,KAAK,CAAA,EAAG,KAAA,EAAO,MAAM,IAAI,CAAA;AACxD,IAAA,IAAA,CAAK,OAAO,GAAG,CAAA;AACf,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,IAAA,IAAI,KAAA,IAAS,IAAA,CAAK,QAAA,EAAU,OAAO,eAAA;AACnC,IAAA,IAAA,CAAK,IAAI,GAAG,CAAA;AACZ,IAAA,MAAM,OAAA,GACJ,KAAA,CAAM,MAAA,GAAS,IAAA,CAAK,cAAA,GAAiB,MAAM,KAAA,CAAM,CAAA,EAAG,IAAA,CAAK,cAAc,CAAA,GAAI,KAAA;AAC7E,IAAA,MAAMA,OAAiB,EAAC;AACxB,IAAA,KAAA,MAAW,QAAQ,OAAA,EAAS;AAC1B,MAAA,MAAM,SAAS,IAAA,CAAK,IAAA,EAAM,KAAA,GAAQ,CAAA,EAAG,MAAM,IAAI,CAAA;AAE/C,MAAAA,IAAAA,CAAI,IAAA,CAAK,MAAA,KAAW,IAAA,GAAO,OAAO,MAAM,CAAA;AAAA,IAC1C;AACA,IAAA,IAAI,KAAA,CAAM,MAAA,GAAS,IAAA,CAAK,cAAA,EAAgB;AACtC,MAAAA,KAAI,IAAA,CAAK,CAAA,EAAA,EAAK,MAAM,MAAA,GAAS,IAAA,CAAK,cAAc,CAAA,MAAA,CAAQ,CAAA;AAAA,IAC1D;AACA,IAAA,IAAA,CAAK,OAAO,GAAG,CAAA;AACf,IAAA,OAAOA,IAAAA;AAAA,EACT;AAIA,EAAA,IAAI,KAAA,IAAS,IAAA,CAAK,QAAA,EAAU,OAAO,gBAAA;AACnC,EAAA,IAAA,CAAK,IAAI,GAAG,CAAA;AACZ,EAAA,MAAM,MAA+B,EAAC;AACtC,EAAA,cAAA,CAAe,GAAA,EAAK,KAAA,EAAkC,KAAA,EAAO,IAAA,EAAM,IAAI,CAAA;AACvE,EAAA,IAAA,CAAK,OAAO,GAAG,CAAA;AACf,EAAA,OAAO,GAAA;AACT;AAOO,SAAS,YAAA,CAAa,KAAA,EAAgB,OAAA,GAA2B,EAAC,EAAY;AACnF,EAAA,MAAM,IAAA,GAAO,eAAe,OAAO,CAAA;AACnC,EAAA,MAAM,SAAS,IAAA,CAAK,KAAA,EAAO,GAAG,IAAA,kBAAM,IAAI,SAAS,CAAA;AAEjD,EAAA,OAAO,MAAA,KAAW,OAAO,MAAA,GAAY,MAAA;AACvC;;;AC3JO,SAAS,QAAA,CAAY,KAAA,EAAU,OAAA,GAA2B,EAAC,EAAY;AAC5E,EAAA,OAAO,YAAA,CAAa,OAAO,OAAO,CAAA;AACpC;;;ACrDA,IAAM,KAAA,GAAQ,GAAA;AACd,IAAM,IAAA,GAAO,IAAA;AAGb,SAAS,WAAW,CAAA,EAA4B;AAC9C,EAAA,OAAO,OAAO,CAAA,KAAM,QAAA,GAChB,CAAA,EAAA,EAAK,IAAA,CAAK,UAAU,CAAC,CAAC,CAAA,CAAA,GACtB,CAAA,EAAA,EAAK,KAAK,SAAA,CAAU,CAAA,CAAE,MAAM,CAAC,CAAA,CAAA,EAAI,EAAE,KAAK,CAAA,CAAA;AAC9C;AAOO,SAAS,iBAAiB,CAAA,EAA4B;AAC3D,EAAA,OAAO;AAAA,IACL,CAAA,EAAA,EAAK,CAAA,CAAE,QAAA,IAAY,EAAE,CAAA,CAAA;AAAA,IACrB,CAAA,EAAA,EAAK,CAAA,CAAE,cAAA,IAAkB,EAAE,CAAA,CAAA;AAAA,IAC3B,CAAA,EAAA,EAAK,CAAA,CAAE,SAAA,IAAa,EAAE,CAAA,CAAA;AAAA,IACtB,CAAA,GAAA,EAAM,CAAA,CAAE,eAAA,IAAmB,EAAE,CAAA,CAAA;AAAA,IAC7B,CAAA,GAAA,EAAM,CAAA,CAAE,YAAA,IAAgB,EAAE,CAAA,CAAA;AAAA,IAC1B,MAAM,IAAA,CAAK,SAAA,CAAU,CAAA,CAAE,aAAA,IAAiB,EAAE,CAAC,CAAA,CAAA;AAAA,IAC3C,CAAA,GAAA,EAAA,CAAO,CAAA,CAAE,KAAA,IAAS,EAAC,EAAG,IAAI,UAAU,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AAAA,IAChD,CAAA,GAAA,EAAA,CAAO,CAAA,CAAE,QAAA,IAAY,EAAC,EAAG,IAAI,UAAU,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,GACrD,CAAE,KAAK,KAAK,CAAA;AACd;;;AChBO,SAAS,oBAAA,CAAwB,KAAA,EAAU,OAAA,GAA2B,EAAC,EAAY;AACxF,EAAA,MAAM,SAAA,GAAY,iBAAiB,OAAO,CAAA;AAE1C,EAAA,OAAOC,aAAA,CAAQ,MAAM,QAAA,CAAS,KAAA,EAAO,OAAO,CAAA,EAAG,CAAC,KAAA,EAAO,SAAS,CAAC,CAAA;AACnE","file":"index.cjs","sourcesContent":["/**\n * Client-side data-safety layer — detect sensitive field names so the walker\n * can redact or remove them BEFORE their values are ever read. Mechanical and\n * key-name-driven: no value inspection, no network, no models.\n *\n * Limitations (key-name-driven by design):\n *  - Matches field NAMES, not values: a secret under an innocuous key, or as a\n *    bare array/Set element (no key), is NOT detected.\n *  - Only own enumerable string keys are processed; Symbol-keyed / non-enumerable\n *    properties are dropped by the walker, never scanned.\n *  - Homoglyph attacks (e.g. Cyrillic look-alikes) are not fully closed; keys are\n *    NFKC-normalized and zero-width-stripped before matching, which defeats the\n *    common fullwidth/zero-width evasions but not deliberate confusables.\n */\n\n/** Default replacement value used when a sensitive field is redacted. */\nexport const REDACTED = \"[REDACTED]\";\n\n/**\n * Built-in deny-list of sensitive field-name patterns (case-insensitive).\n * Patterns are anchored to avoid false positives on common keys — e.g. it does\n * NOT redact `author`, `dashboard`, `secretary`, `tokenCount`, `promptTokens`,\n * or `accessKeyboard`.\n */\nexport const DEFAULT_DENY_LIST: readonly RegExp[] = [\n  // Passwords / pass-phrases\n  /pass(?:word|wd|phrase)/i,\n  // Secrets (\"secret\", \"clientSecret\", \"secretKey\") but not \"secretary\"\n  /secret(?!ary)/i,\n  // Tokens — standalone or with an auth-ish prefix; NOT tokenCount/tokenize/promptTokens\n  /\\btoken\\b/i,\n  /(?:access|refresh|id|auth|bearer|api|csrf|xsrf|session|sso|oauth|reset|verification|activation)[-_]?token/i,\n  // Keys (\"apiKey\", \"accessKey\", \"signingKey\") but not \"accessKeyword\"/\"keyboard\"\n  /(?:api|access|private|signing|encryption)[-_]?keys?(?![a-z])/i,\n  /\\bjwt\\b/i,\n  /authorization/i,\n  /bearer/i,\n  /credentials?/i,\n  /cookie/i,\n  /session[-_]?(?:id|token|key)/i,\n  // 2FA / recovery\n  /\\b(?:otp|totp|mfa|2fa)\\b/i,\n  /(?:recovery|backup)[-_]?codes?/i,\n  /\\bmnemonic\\b/i,\n  /seed[-_]?phrase/i,\n  // Crypto / signing\n  /\\bhmac\\b/i,\n  /\\bsignature\\b/i,\n  /\\b[cx]srf\\b/i,\n  // Connection strings / DB credentials\n  /connection[-_]?string/i,\n  /\\bdsn\\b/i,\n  /(?:database|db)[-_]?(?:url|uri)/i,\n  // PII / financial\n  /ssn/i,\n  /social[-_]?security[-_]?(?:number|no)?/i,\n  /credit[-_]?card/i,\n  /card[-_]?number/i,\n  /cvv2?/i,\n  /\\bpin\\b/i,\n  /\\biban\\b/i,\n  /routing[-_]?number/i,\n  /account[-_]?number/i,\n  /\\bpassport\\b/i,\n  /tax[-_]?id/i,\n];\n\n/** Zero-width / default-ignorable code points used to evade name matching. */\nconst ZERO_WIDTH = /[\\u00AD\\u200B-\\u200D\\u2060\\uFEFF]/g;\n\n/**\n * Normalize a key before matching: NFKC folds fullwidth/compatibility forms to\n * their ASCII equivalents, and zero-width characters are stripped. This defeats\n * the common `\"ｐａｓｓｗｏｒｄ\"` / zero-width-injected evasions.\n */\nexport function normalizeKey(key: string): string {\n  return key.normalize(\"NFKC\").replace(ZERO_WIDTH, \"\");\n}\n\n/**\n * Stateless RegExp test. A user-supplied pattern with the `g`/`y` flag carries\n * a mutable `lastIndex`; resetting it keeps matching deterministic across keys.\n */\nexport function regexTest(re: RegExp, value: string): boolean {\n  if (re.global || re.sticky) re.lastIndex = 0;\n  return re.test(value);\n}\n\n/**\n * Is `key` a sensitive field name? Checks user matchers (string = exact,\n * case-insensitive; RegExp = pattern) and, when `useDefaults`, the built-in\n * deny-list. Keys are NFKC-normalized and zero-width-stripped first.\n */\nexport function isSensitiveKey(\n  key: string,\n  userMatchers: ReadonlyArray<string | RegExp>,\n  useDefaults: boolean,\n): boolean {\n  const normalized = normalizeKey(key);\n  const lower = normalized.toLowerCase();\n  for (const matcher of userMatchers) {\n    if (typeof matcher === \"string\") {\n      if (normalizeKey(matcher).toLowerCase() === lower) return true;\n    } else if (regexTest(matcher, normalized)) {\n      return true;\n    }\n  }\n  if (useDefaults) {\n    for (const re of DEFAULT_DENY_LIST) {\n      if (regexTest(re, normalized)) return true;\n    }\n  }\n  return false;\n}\n","/**\n * Core compression walker — mechanical, deterministic, zero-dependency.\n *\n * A single recursive pass applies: key stripping, depth capping, array-length\n * capping, and empty-value dropping, with circular-reference protection.\n * Sanitization (task 003) composes into this same walk via {@link CompressOptions.sanitize}.\n */\n\nimport type { CompressOptions } from \"../index\";\nimport { isSensitiveKey, REDACTED, regexTest } from \"./sanitize\";\n\n/** Marker substituted for a node that exceeds {@link CompressOptions.maxDepth}. */\nexport const TRUNCATED_OBJECT = \"[Object]\";\n/** Marker substituted for an array that exceeds {@link CompressOptions.maxDepth}. */\nexport const TRUNCATED_ARRAY = \"[Array]\";\n/** Marker substituted for a circular back-reference. */\nexport const CIRCULAR = \"[Circular]\";\n/** Marker substituted for a property whose getter threw when read. */\nexport const GETTER_ERROR = \"[Getter]\";\n\n/**\n * Safe default depth cap. Real application state is rarely deeper than a few\n * dozen levels; capping by default keeps payloads minimal and prevents a\n * stack-overflow DoS on pathologically deep (untrusted) input. Opt out with\n * `maxDepth: Infinity`.\n */\nexport const DEFAULT_MAX_DEPTH = 100;\n\n/** Fully-resolved options after defaults are applied. */\ninterface ResolvedOptions {\n  maxDepth: number;\n  maxArrayLength: number;\n  strip: Array<string | RegExp>;\n  dropEmpty: boolean;\n  sanitize: Array<string | RegExp>;\n  defaultSanitize: boolean;\n  sanitizeMode: \"redact\" | \"remove\";\n  redactedValue: string;\n}\n\nconst DEFAULTS: ResolvedOptions = {\n  maxDepth: DEFAULT_MAX_DEPTH,\n  maxArrayLength: Number.POSITIVE_INFINITY,\n  strip: [],\n  dropEmpty: false,\n  sanitize: [],\n  defaultSanitize: true,\n  sanitizeMode: \"redact\",\n  redactedValue: REDACTED,\n};\n\n/** A unique sentinel meaning \"this value should be omitted from the output\". */\nconst OMIT = Symbol(\"omit\");\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  if (typeof value !== \"object\" || value === null) return false;\n  const proto = Object.getPrototypeOf(value);\n  return proto === Object.prototype || proto === null;\n}\n\n/**\n * Assign an own, enumerable data property — even for dangerous keys like\n * `__proto__` (a plain `out[key] = v` would reassign the prototype instead of\n * creating a property, corrupting the output and silently dropping the value).\n */\nfunction safeAssign(target: Record<string, unknown>, key: string, value: unknown): void {\n  Object.defineProperty(target, key, {\n    value,\n    writable: true,\n    enumerable: true,\n    configurable: true,\n  });\n}\n\n/** Does `key` match any matcher (exact string or RegExp test)? */\nexport function keyMatches(key: string, matchers: ReadonlyArray<string | RegExp>): boolean {\n  for (const matcher of matchers) {\n    if (typeof matcher === \"string\") {\n      if (matcher === key) return true;\n    } else if (regexTest(matcher, key)) {\n      return true;\n    }\n  }\n  return false;\n}\n\nfunction isEmptyValue(value: unknown): boolean {\n  if (value === null || value === undefined || value === \"\") return true;\n  if (Array.isArray(value)) return value.length === 0;\n  if (isPlainObject(value)) return Object.keys(value).length === 0;\n  return false;\n}\n\n/**\n * Resolve user options against defaults. Exposed so the React layer and\n * sanitization can share one normalization path.\n */\nexport function resolveOptions(options: CompressOptions): ResolvedOptions {\n  return {\n    maxDepth: options.maxDepth ?? DEFAULTS.maxDepth,\n    maxArrayLength: options.maxArrayLength ?? DEFAULTS.maxArrayLength,\n    strip: options.strip ?? DEFAULTS.strip,\n    dropEmpty: options.dropEmpty ?? DEFAULTS.dropEmpty,\n    sanitize: options.sanitize ?? DEFAULTS.sanitize,\n    defaultSanitize: options.defaultSanitize ?? DEFAULTS.defaultSanitize,\n    sanitizeMode: options.sanitizeMode ?? DEFAULTS.sanitizeMode,\n    redactedValue: options.redactedValue ?? DEFAULTS.redactedValue,\n  };\n}\n\n/** Walk own enumerable string keys of an object-like value into `out`. */\nfunction walkObjectInto(\n  out: Record<string, unknown>,\n  source: Record<string, unknown>,\n  depth: number,\n  opts: ResolvedOptions,\n  seen: WeakSet<object>,\n): void {\n  for (const key of Object.keys(source)) {\n    if (keyMatches(key, opts.strip)) continue;\n    // Sanitize BEFORE reading the value: a sensitive value is never read\n    // (no getter fired), never walked, and never reaches the output.\n    if (isSensitiveKey(key, opts.sanitize, opts.defaultSanitize)) {\n      if (opts.sanitizeMode === \"remove\") continue;\n      safeAssign(out, key, opts.redactedValue);\n      continue;\n    }\n    let raw: unknown;\n    try {\n      raw = source[key];\n    } catch {\n      // A getter threw — degrade to a marker rather than crashing the walk.\n      safeAssign(out, key, GETTER_ERROR);\n      continue;\n    }\n    const walked = walk(raw, depth + 1, opts, seen);\n    if (walked === OMIT) continue;\n    if (opts.dropEmpty && isEmptyValue(walked)) continue;\n    safeAssign(out, key, walked);\n  }\n}\n\nfunction walk(\n  value: unknown,\n  depth: number,\n  opts: ResolvedOptions,\n  seen: WeakSet<object>,\n): unknown {\n  if (value === null) return null;\n  const type = typeof value;\n  if (type === \"function\" || type === \"symbol\") return OMIT;\n  // BigInt is not JSON-serializable; coerce to string for an LLM-ready payload.\n  if (type === \"bigint\") return (value as bigint).toString();\n  if (type !== \"object\") return value;\n\n  // Circular-reference guard sits above all object normalization so a cycle\n  // through a Map/Set is caught instead of overflowing the stack.\n  const ref = value as object;\n  if (seen.has(ref)) return CIRCULAR;\n\n  // Non-plain objects we deliberately normalize for a predictable payload.\n  if (value instanceof Date) return value;\n  if (value instanceof Map) {\n    seen.add(ref);\n    const obj: Record<string, unknown> = {};\n    for (const [k, v] of value) safeAssign(obj, String(k), v);\n    const result = walk(obj, depth, opts, seen);\n    seen.delete(ref);\n    return result;\n  }\n  if (value instanceof Set) {\n    seen.add(ref);\n    const result = walk(Array.from(value), depth, opts, seen);\n    seen.delete(ref);\n    return result;\n  }\n\n  if (Array.isArray(value)) {\n    if (depth >= opts.maxDepth) return TRUNCATED_ARRAY;\n    seen.add(ref);\n    const limited =\n      value.length > opts.maxArrayLength ? value.slice(0, opts.maxArrayLength) : value;\n    const out: unknown[] = [];\n    for (const item of limited) {\n      const walked = walk(item, depth + 1, opts, seen);\n      // In arrays, an omitted item collapses to null to preserve index intent.\n      out.push(walked === OMIT ? null : walked);\n    }\n    if (value.length > opts.maxArrayLength) {\n      out.push(`[+${value.length - opts.maxArrayLength} more]`);\n    }\n    seen.delete(ref);\n    return out;\n  }\n\n  // Plain objects and unknown object kinds (class instances) both rebuild as a\n  // plain object from their own enumerable string keys.\n  if (depth >= opts.maxDepth) return TRUNCATED_OBJECT;\n  seen.add(ref);\n  const out: Record<string, unknown> = {};\n  walkObjectInto(out, value as Record<string, unknown>, depth, opts, seen);\n  seen.delete(ref);\n  return out;\n}\n\n/**\n * Mechanically compress a state value into a minimal payload, applying the\n * structural transforms in {@link CompressOptions}. Pure and deterministic;\n * the input is never mutated.\n */\nexport function compressCore(state: unknown, options: CompressOptions = {}): unknown {\n  const opts = resolveOptions(options);\n  const walked = walk(state, 0, opts, new WeakSet());\n  // A top-level function/symbol compresses to undefined rather than a sentinel.\n  return walked === OMIT ? undefined : walked;\n}\n","/**\n * react-context-compressor — core entry (framework-agnostic, zero dependencies).\n *\n * Mechanical compression lands here (task 002); sanitization composes into the\n * same walk in task 003.\n */\n\nimport { compressCore } from \"./core/compress\";\n\n/**\n * Options controlling how a state value is mechanically compressed and\n * sanitized into a minimal, LLM-ready payload. All fields are optional;\n * `compress(state)` with no options returns a safe deep copy.\n */\nexport interface CompressOptions {\n  /**\n   * Maximum object/array depth to retain. Nodes deeper than this are replaced\n   * with a `\"[Object]\"` / `\"[Array]\"` marker. Default: `100` (a safe cap that\n   * keeps payloads minimal and prevents stack overflow on pathologically deep\n   * input). Set to `Infinity` to disable depth capping.\n   */\n  maxDepth?: number;\n  /**\n   * Maximum array length to retain. Longer arrays are truncated and a\n   * `\"[+N more]\"` marker is appended. Default: unlimited.\n   */\n  maxArrayLength?: number;\n  /** Keys (exact strings or patterns) to strip from the output. */\n  strip?: Array<string | RegExp>;\n  /** When true, drop `null` / `undefined` / `\"\"` / `[]` / `{}` values. */\n  dropEmpty?: boolean;\n  /**\n   * Extra sensitive field-name matchers to redact/remove, IN ADDITION to the\n   * built-in deny-list (unless {@link CompressOptions.defaultSanitize} is\n   * `false`). A `string` matches a key case-insensitively and exactly; a\n   * `RegExp` matches by pattern. Matching is by field NAME, not value.\n   */\n  sanitize?: Array<string | RegExp>;\n  /**\n   * Apply the built-in sensitive-field deny-list (password, token, secret,\n   * apiKey, authorization, cookie, ssn, creditCard, …). Default: `true`.\n   * Set `false` to rely solely on {@link CompressOptions.sanitize}.\n   */\n  defaultSanitize?: boolean;\n  /**\n   * How to treat a sensitive field: `\"redact\"` replaces its value with\n   * {@link CompressOptions.redactedValue}; `\"remove\"` drops the key entirely.\n   * Either way the value is never read or emitted. Default: `\"redact\"`.\n   */\n  sanitizeMode?: \"redact\" | \"remove\";\n  /** Replacement used when `sanitizeMode` is `\"redact\"`. Default: `\"[REDACTED]\"`. */\n  redactedValue?: string;\n}\n\n/**\n * Mechanically compress and sanitize a state value into a minimal, safe payload.\n *\n * Pure and deterministic: the same input and options always produce the same\n * output, and the input is never mutated. Performs no I/O — purely structural.\n */\nexport function compress<T>(state: T, options: CompressOptions = {}): unknown {\n  return compressCore(state, options);\n}\n","/**\n * Internal helper for the React hook: turn a {@link CompressOptions} object into\n * a stable string signature so an inline options literal (new reference every\n * render) doesn't thrash `useMemo`. Not part of the public `./react` API.\n */\nimport type { CompressOptions } from \"../index\";\n\n// Control-char delimiters that cannot appear unescaped in a JSON-encoded token,\n// so neither matcher contents nor free-text option values can forge a boundary.\nconst FIELD = \"\\u0001\";\nconst ITEM = \"\\u0000\";\n\n/** Unambiguous, collision-free key for one matcher (string or RegExp). */\nfunction matcherKey(m: string | RegExp): string {\n  return typeof m === \"string\"\n    ? `s:${JSON.stringify(m)}`\n    : `r:${JSON.stringify(m.source)}:${m.flags}`;\n}\n\n/**\n * Build a stable signature from an options object. Two options objects with\n * equal content produce the same signature; any content difference (including\n * RegExp flags, matcher order, or `Infinity` vs unset) produces a different one.\n */\nexport function optionsSignature(o: CompressOptions): string {\n  return [\n    `d=${o.maxDepth ?? \"\"}`,\n    `a=${o.maxArrayLength ?? \"\"}`,\n    `e=${o.dropEmpty ?? \"\"}`,\n    `ds=${o.defaultSanitize ?? \"\"}`,\n    `sm=${o.sanitizeMode ?? \"\"}`,\n    `rv=${JSON.stringify(o.redactedValue ?? \"\")}`,\n    `st=${(o.strip ?? []).map(matcherKey).join(ITEM)}`,\n    `sn=${(o.sanitize ?? []).map(matcherKey).join(ITEM)}`,\n  ].join(FIELD);\n}\n","/**\n * react-context-compressor — React bindings entry.\n *\n * Imports only from the core entry and the `react` peer dependency, so the\n * core (`.`) entry stays React-free and the React layer tree-shakes away for\n * consumers who import only `.`.\n */\nimport { useMemo } from \"react\";\nimport { type CompressOptions, compress } from \"../index\";\nimport { optionsSignature } from \"./signature\";\n\n/**\n * React hook returning a memoized, compressed + sanitized view of `state`.\n *\n * Recomputes only when the `state` reference changes or the options content\n * changes (compared by a stable signature, so an inline options literal is\n * fine). Pure: no DOM access, no side effects — safe under SSR and React\n * Server Components. Works on React 17 / 18 / 19.\n */\nexport function useCompressedContext<T>(state: T, options: CompressOptions = {}): unknown {\n  const signature = optionsSignature(options);\n  // biome-ignore lint/correctness/useExhaustiveDependencies: `options` is keyed by its stable `signature`\n  return useMemo(() => compress(state, options), [state, signature]);\n}\n\nexport type { CompressOptions };\n"]}

package/dist/react/index.d.cts

@@ -0,0 +1,13 @@
+import { CompressOptions } from '../index.cjs';
+
+/**
+ * React hook returning a memoized, compressed + sanitized view of `state`.
+ *
+ * Recomputes only when the `state` reference changes or the options content
+ * changes (compared by a stable signature, so an inline options literal is
+ * fine). Pure: no DOM access, no side effects — safe under SSR and React
+ * Server Components. Works on React 17 / 18 / 19.
+ */
+declare function useCompressedContext<T>(state: T, options?: CompressOptions): unknown;
+
+export { CompressOptions, useCompressedContext };

package/dist/react/index.d.ts

@@ -0,0 +1,13 @@
+import { CompressOptions } from '../index.js';
+
+/**
+ * React hook returning a memoized, compressed + sanitized view of `state`.
+ *
+ * Recomputes only when the `state` reference changes or the options content
+ * changes (compared by a stable signature, so an inline options literal is
+ * fine). Pure: no DOM access, no side effects — safe under SSR and React
+ * Server Components. Works on React 17 / 18 / 19.
+ */
+declare function useCompressedContext<T>(state: T, options?: CompressOptions): unknown;
+
+export { CompressOptions, useCompressedContext };

package/dist/react/index.mjs

@@ -0,0 +1,31 @@
+import { compress } from '../chunk-VBOCWPM5.mjs';
+import { useMemo } from 'react';
+
+// src/react/signature.ts
+var FIELD = "
";
+var ITEM = "\0";
+function matcherKey(m) {
+  return typeof m === "string" ? `s:${JSON.stringify(m)}` : `r:${JSON.stringify(m.source)}:${m.flags}`;
+}
+function optionsSignature(o) {
+  return [
+    `d=${o.maxDepth ?? ""}`,
+    `a=${o.maxArrayLength ?? ""}`,
+    `e=${o.dropEmpty ?? ""}`,
+    `ds=${o.defaultSanitize ?? ""}`,
+    `sm=${o.sanitizeMode ?? ""}`,
+    `rv=${JSON.stringify(o.redactedValue ?? "")}`,
+    `st=${(o.strip ?? []).map(matcherKey).join(ITEM)}`,
+    `sn=${(o.sanitize ?? []).map(matcherKey).join(ITEM)}`
+  ].join(FIELD);
+}
+
+// src/react/index.ts
+function useCompressedContext(state, options = {}) {
+  const signature = optionsSignature(options);
+  return useMemo(() => compress(state, options), [state, signature]);
+}
+
+export { useCompressedContext };
+//# sourceMappingURL=index.mjs.map
+//# sourceMappingURL=index.mjs.map

package/dist/react/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/react/signature.ts","../../src/react/index.ts"],"names":[],"mappings":";;;;AASA,IAAM,KAAA,GAAQ,GAAA;AACd,IAAM,IAAA,GAAO,IAAA;AAGb,SAAS,WAAW,CAAA,EAA4B;AAC9C,EAAA,OAAO,OAAO,CAAA,KAAM,QAAA,GAChB,CAAA,EAAA,EAAK,IAAA,CAAK,UAAU,CAAC,CAAC,CAAA,CAAA,GACtB,CAAA,EAAA,EAAK,KAAK,SAAA,CAAU,CAAA,CAAE,MAAM,CAAC,CAAA,CAAA,EAAI,EAAE,KAAK,CAAA,CAAA;AAC9C;AAOO,SAAS,iBAAiB,CAAA,EAA4B;AAC3D,EAAA,OAAO;AAAA,IACL,CAAA,EAAA,EAAK,CAAA,CAAE,QAAA,IAAY,EAAE,CAAA,CAAA;AAAA,IACrB,CAAA,EAAA,EAAK,CAAA,CAAE,cAAA,IAAkB,EAAE,CAAA,CAAA;AAAA,IAC3B,CAAA,EAAA,EAAK,CAAA,CAAE,SAAA,IAAa,EAAE,CAAA,CAAA;AAAA,IACtB,CAAA,GAAA,EAAM,CAAA,CAAE,eAAA,IAAmB,EAAE,CAAA,CAAA;AAAA,IAC7B,CAAA,GAAA,EAAM,CAAA,CAAE,YAAA,IAAgB,EAAE,CAAA,CAAA;AAAA,IAC1B,MAAM,IAAA,CAAK,SAAA,CAAU,CAAA,CAAE,aAAA,IAAiB,EAAE,CAAC,CAAA,CAAA;AAAA,IAC3C,CAAA,GAAA,EAAA,CAAO,CAAA,CAAE,KAAA,IAAS,EAAC,EAAG,IAAI,UAAU,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AAAA,IAChD,CAAA,GAAA,EAAA,CAAO,CAAA,CAAE,QAAA,IAAY,EAAC,EAAG,IAAI,UAAU,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,GACrD,CAAE,KAAK,KAAK,CAAA;AACd;;;AChBO,SAAS,oBAAA,CAAwB,KAAA,EAAU,OAAA,GAA2B,EAAC,EAAY;AACxF,EAAA,MAAM,SAAA,GAAY,iBAAiB,OAAO,CAAA;AAE1C,EAAA,OAAO,OAAA,CAAQ,MAAM,QAAA,CAAS,KAAA,EAAO,OAAO,CAAA,EAAG,CAAC,KAAA,EAAO,SAAS,CAAC,CAAA;AACnE","file":"index.mjs","sourcesContent":["/**\n * Internal helper for the React hook: turn a {@link CompressOptions} object into\n * a stable string signature so an inline options literal (new reference every\n * render) doesn't thrash `useMemo`. Not part of the public `./react` API.\n */\nimport type { CompressOptions } from \"../index\";\n\n// Control-char delimiters that cannot appear unescaped in a JSON-encoded token,\n// so neither matcher contents nor free-text option values can forge a boundary.\nconst FIELD = \"\\u0001\";\nconst ITEM = \"\\u0000\";\n\n/** Unambiguous, collision-free key for one matcher (string or RegExp). */\nfunction matcherKey(m: string | RegExp): string {\n  return typeof m === \"string\"\n    ? `s:${JSON.stringify(m)}`\n    : `r:${JSON.stringify(m.source)}:${m.flags}`;\n}\n\n/**\n * Build a stable signature from an options object. Two options objects with\n * equal content produce the same signature; any content difference (including\n * RegExp flags, matcher order, or `Infinity` vs unset) produces a different one.\n */\nexport function optionsSignature(o: CompressOptions): string {\n  return [\n    `d=${o.maxDepth ?? \"\"}`,\n    `a=${o.maxArrayLength ?? \"\"}`,\n    `e=${o.dropEmpty ?? \"\"}`,\n    `ds=${o.defaultSanitize ?? \"\"}`,\n    `sm=${o.sanitizeMode ?? \"\"}`,\n    `rv=${JSON.stringify(o.redactedValue ?? \"\")}`,\n    `st=${(o.strip ?? []).map(matcherKey).join(ITEM)}`,\n    `sn=${(o.sanitize ?? []).map(matcherKey).join(ITEM)}`,\n  ].join(FIELD);\n}\n","/**\n * react-context-compressor — React bindings entry.\n *\n * Imports only from the core entry and the `react` peer dependency, so the\n * core (`.`) entry stays React-free and the React layer tree-shakes away for\n * consumers who import only `.`.\n */\nimport { useMemo } from \"react\";\nimport { type CompressOptions, compress } from \"../index\";\nimport { optionsSignature } from \"./signature\";\n\n/**\n * React hook returning a memoized, compressed + sanitized view of `state`.\n *\n * Recomputes only when the `state` reference changes or the options content\n * changes (compared by a stable signature, so an inline options literal is\n * fine). Pure: no DOM access, no side effects — safe under SSR and React\n * Server Components. Works on React 17 / 18 / 19.\n */\nexport function useCompressedContext<T>(state: T, options: CompressOptions = {}): unknown {\n  const signature = optionsSignature(options);\n  // biome-ignore lint/correctness/useExhaustiveDependencies: `options` is keyed by its stable `signature`\n  return useMemo(() => compress(state, options), [state, signature]);\n}\n\nexport type { CompressOptions };\n"]}

package/package.json

@@ -0,0 +1,103 @@
+{
+  "name": "react-context-compressor",
+  "version": "0.1.0",
+  "description": "Mechanical, zero-dependency client-side compressor + sanitizer that turns React/JS app state into a minimal, safe payload for LLMs.",
+  "type": "module",
+  "license": "MIT",
+  "author": "Muhammad Umair Ali <claude@oxym.tech> (https://github.com/Muhammad-UmairAli)",
+  "contributors": [
+    "Muhammad Umair Ali <claude@oxym.tech> (https://github.com/Muhammad-UmairAli)"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Muhammad-UmairAli/react-context-compressor.git"
+  },
+  "homepage": "https://github.com/Muhammad-UmairAli/react-context-compressor#readme",
+  "bugs": {
+    "url": "https://github.com/Muhammad-UmairAli/react-context-compressor/issues"
+  },
+  "keywords": [
+    "react",
+    "llm",
+    "ai",
+    "context",
+    "compression",
+    "sanitize",
+    "tokens",
+    "state",
+    "prompt"
+  ],
+  "sideEffects": false,
+  "files": [
+    "dist"
+  ],
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.mjs"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    },
+    "./react": {
+      "import": {
+        "types": "./dist/react/index.d.ts",
+        "default": "./dist/react/index.mjs"
+      },
+      "require": {
+        "types": "./dist/react/index.d.cts",
+        "default": "./dist/react/index.cjs"
+      }
+    },
+    "./package.json": "./package.json"
+  },
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "typecheck": "tsc --noEmit",
+    "lint": "biome check .",
+    "format": "biome format --write .",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:cov": "vitest run --coverage",
+    "size": "size-limit",
+    "changeset": "changeset",
+    "prepublishOnly": "npm run build"
+  },
+  "peerDependencies": {
+    "react": ">=17"
+  },
+  "peerDependenciesMeta": {
+    "react": {
+      "optional": true
+    }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "devDependencies": {
+    "@biomejs/biome": "^2.5.0",
+    "@changesets/cli": "^2.31.0",
+    "@size-limit/preset-small-lib": "^12.1.0",
+    "@testing-library/react": "^16.3.2",
+    "@types/react": "^19.2.17",
+    "@types/react-dom": "^19.2.3",
+    "@vitest/coverage-v8": "^4.1.9",
+    "jsdom": "^29.1.1",
+    "react": "^19.2.7",
+    "react-dom": "^19.2.7",
+    "size-limit": "^12.1.0",
+    "tsup": "^8.5.1",
+    "typescript": "^6.0.3",
+    "vitest": "^4.1.9"
+  }
+}