From 8e3f979bc6dd85af50a1dd9cc9cdd419472e39e1 Mon Sep 17 00:00:00 2001
From: GravityHaxx <58637292+GravityHaxx@users.noreply.github.com>
Date: Fri, 24 Jul 2026 11:47:01 +0400
Subject: [PATCH] Wire the docs playground to the real 1.2.0 bundle
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The live playground was importing flare-redact@0.7.0 from esm.sh — a
pre-1.0 API (fpe mode, no transformSecret requirement) loaded from a
third-party CDN. Now it imports a local esbuild bundle of the same
dist that ships to npm, so the page runs fully offline and always
matches the released API.

- docs/playground/flare-redact.min.js: bundled ESM (69 kB), rebuilt
  via the new npm run build:playground script.
- Modes updated to mask/label/hash/pseudonym with a demo
  transformSecret; fpe removed.
- Opt-in toggle now also enables phone; sample text exercises the
  anthropic_key and national phone detectors.
- Status line shows the bundled version and that nothing leaves the
  page.
---
 docs/index.html                     | 18 ++++++++++--------
 docs/playground/flare-redact.min.js |  1 +
 package.json                        |  3 ++-
 3 files changed, 13 insertions(+), 9 deletions(-)
 create mode 100644 docs/playground/flare-redact.min.js

diff --git a/docs/index.html b/docs/index.html
index 42c251e..d777c76 100644
--- a/docs/index.html
+++ b/docs/index.html
@@ -133,9 +133,9 @@ <h2>Paste anything — watch the secrets disappear</h2>
             <option value="mask">mask</option>
             <option value="label">label</option>
             <option value="hash">hash</option>
-            <option value="fpe">fpe (format-preserving)</option>
+            <option value="pseudonym">pseudonym (shape-preserving)</option>
           </select>
-          <label><input type="checkbox" id="pii" checked> national IDs / crypto (opt-in)</label>
+          <label><input type="checkbox" id="pii" checked> opt-in detectors (national IDs, crypto, phone, network)</label>
           <span id="status" style="margin-left:auto;color:var(--faint)"></span>
         </div>
         <div class="grid">
@@ -174,8 +174,9 @@ <h2>One redaction layer for everywhere</h2>
   <script type="module">
     const SAMPLE = `User alice@corp.com paid with 4242 4242 4242 4242
 Authorization: Bearer ghp_R2v8KxNq7t3Zp1QwErTyUiOpAsDfGhJkLzXc
+anthropic key sk-ant-api03-w9K2mQ7vR4jX8nP1bT6cY3hF5dL0sA9gZe2uI7oM4qW6rV8tB1nC5xD3fH7jK9lZ
 db=postgres://admin:s3cr3tPass@10.2.0.4/prod
-密码: hunter2   iban=GB82WEST12345698765432
+密码: hunter2   iban=GB82WEST12345698765432   tel +90 532 123 45 67
 wallet 0x742d35Cc6634C0532925a3b844Bc454e4438f44e`;
 
     const $ = (id) => document.getElementById(id);
@@ -185,12 +186,13 @@ <h2>One redaction layer for everywhere</h2>
 
     let redact, scan;
     try {
-      const mod = await import('https://esm.sh/flare-redact@0.7.0');
+      // Bundled from the same release that ships to npm — nothing leaves this page.
+      const mod = await import('./playground/flare-redact.min.js');
       redact = mod.redact; scan = mod.scan;
-      status.textContent = 'ready';
+      status.textContent = 'v1.2.0 · runs entirely in your browser';
     } catch (e) {
       status.textContent = 'failed to load library';
-      $('out').textContent = 'Could not load flare-redact from the CDN.';
+      $('out').textContent = 'Could not load the playground bundle.';
     }
 
     const esc = (s) => s.replace(/[&<>]/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;' }[c]));
@@ -198,8 +200,8 @@ <h2>One redaction layer for everywhere</h2>
     function run() {
       if (!redact) return;
       const text = $('in').value;
-      const opts = { mode: $('mode').value };
-      if ($('pii').checked) opts.enable = ['pii', 'crypto', 'network'];
+      const opts = { mode: $('mode').value, transformSecret: 'playground-demo-secret' };
+      if ($('pii').checked) opts.enable = ['pii', 'crypto', 'network', 'phone'];
       let out = '';
       try { out = redact(text, opts); } catch (e) { out = String(e); }
       // highlight the masks (***, [REDACTED...], placeholders)
diff --git a/docs/playground/flare-redact.min.js b/docs/playground/flare-redact.min.js
new file mode 100644
index 0000000..cafe659
--- /dev/null
+++ b/docs/playground/flare-redact.min.js
@@ -0,0 +1 @@
+var pe=Array.from(new Set(["password","passwd","pwd","secret","token","apikey","api_key","api-key","access_key","access-key","accesskey","secret_key","client_secret","private_key","privatekey","credential","credentials","auth_token","passphrase","\u5BC6\u7801","\u5BC6\u78BC","\u79D8\u5BC6","\u4EE4\u724C","\u5BC6\u94A5","\u79C1\u94A5","\u53E3\u4EE4","\u092A\u093E\u0938\u0935\u0930\u094D\u0921","\u0917\u0941\u092A\u094D\u0924","\u0915\u0941\u0902\u091C\u0940","\u091F\u094B\u0915\u0928","contrase\xF1a","contrasena","clave","secreto","credencial","\u0643\u0644\u0645\u0629\u0627\u0644\u0645\u0631\u0648\u0631","\u0643\u0644\u0645\u0629\u0627\u0644\u0633\u0631","\u0633\u0631","\u0631\u0645\u0632","\u0645\u0641\u062A\u0627\u062D","\u0633\u0631\u064A","motdepasse","mot_de_passe","motdepass","cl\xE9","clef","cl\xE9secr\xE8te","secret","senha","segredo","chavesecreta","chave","\u043F\u0430\u0440\u043E\u043B\u044C","\u0441\u0435\u043A\u0440\u0435\u0442","\u0442\u043E\u043A\u0435\u043D","\u043A\u043B\u044E\u0447","\u0441\u0435\u043A\u0440\u0435\u0442\u043D\u044B\u0439\u043A\u043B\u044E\u0447","\u30D1\u30B9\u30EF\u30FC\u30C9","\u79D8\u5BC6","\u30C8\u30FC\u30AF\u30F3","\u6697\u8A3C\u756A\u53F7","\u5408\u8A00\u8449","passwort","kennwort","geheimnis","geheim","schl\xFCssel","schluessel","zugangsschl\xFCssel","\uBE44\uBC00\uBC88\uD638","\uC554\uD638","\uBE44\uBC00","\uD1A0\uD070","\uBE44\uBC00\uD0A4","\u015Fifre","sifre","parola","gizli","anahtar","gizlianahtar","segreto","chiave","parolachiave","parola_chiave","credenziale","\u0631\u0645\u0632","\u0631\u0645\u0632\u0639\u0628\u0648\u0631","\u06AF\u0630\u0631\u0648\u0627\u0698\u0647","\u06A9\u0644\u0645\u0647\u0639\u0628\u0648\u0631","\u06A9\u0644\u06CC\u062F","\u0645\u062D\u0631\u0645\u0627\u0646\u0647","has\u0142o","haslo","tajne","klucz","poufne","\u043F\u0430\u0440\u043E\u043B\u044C","\u0441\u0435\u043A\u0440\u0435\u0442","\u043A\u043B\u044E\u0447","\u0442\u0430\u0454\u043C\u043D\u0438\u0439","wachtwoord","geheim","sleutel","matkhau","mat_khau","bimat","khoa","katasandi","kata_sandi","sandi","rahasia","kunci","\u0E23\u0E2B\u0E31\u0E2A\u0E1C\u0E48\u0E32\u0E19","\u0E04\u0E27\u0E32\u0E21\u0E25\u0E31\u0E1A","\u03BA\u03C9\u03B4\u03B9\u03BA\u03CC\u03C2","\u03BC\u03C5\u03C3\u03C4\u03B9\u03BA\u03CC","\u03BA\u03BB\u03B5\u03B9\u03B4\u03AF","\u05E1\u05D9\u05E1\u05DE\u05D4","\u05E1\u05D5\u05D3","\u05DE\u05E4\u05EA\u05D7","\u015Fifr\u0259","parol","gizli","a\xE7ar","m\u0259xfi","parol\u0103","parola","cheie"].map(e=>e.toLowerCase()))),ut=e=>e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");function ft(){return[...pe].sort((e,t)=>t.length-e.length).map(ut).join("|")}function he(){return new RegExp(`(?:${ft()})["'\\s]*[:=]\\s*["']?([^\\s"',;]{4,})["']?`,"giu")}var ge=new Set(pe);var _=e=>e.replace(/\D/g,"");function me(e){let t=_(e);if(t.length<2)return!1;let r=0,a=!1;for(let s=t.length-1;s>=0;s--){let n=t.charCodeAt(s)-48;a&&(n*=2,n>9&&(n-=9)),r+=n,a=!a}return r%10===0}function be(e){let t=e.replace(/[\s-]/g,"").toUpperCase();if(!/^[A-Z]{2}\d{2}[A-Z0-9]{10,30}$/.test(t))return!1;let r=t.slice(4)+t.slice(0,4),a=0;for(let s of r){let n=s>="A"&&s<="Z"?(s.charCodeAt(0)-55).toString():s;for(let c=0;c<n.length;c++)a=(a*10+(n.charCodeAt(c)-48))%97}return a===1}function ye(e){let t=_(e);if(t.length!==11||t[0]==="0")return!1;let r=t.split("").map(Number),a=r[0]+r[2]+r[4]+r[6]+r[8],s=r[1]+r[3]+r[5]+r[7];return((a*7-s)%10+10)%10!==r[9]?!1:r.slice(0,10).reduce((c,u)=>c+u,0)%10===r[10]}function we(e){let t=_(e);if(t.length!==11||/^(\d)\1{10}$/.test(t))return!1;let r=a=>{let s=0;for(let c=0;c<a;c++)s+=Number(t[c])*(a+1-c);let n=s*10%11;return n===10?0:n};return r(9)===Number(t[9])&&r(10)===Number(t[10])}var pt="TRWAGMYFPDXBNJZSQVHLCKE";function ke(e){let t=e.toUpperCase().replace(/[\s-]/g,"").match(/^([XYZ]?)(\d{7,8})([A-Z])$/);if(!t)return!1;let r=t[1]?String("XYZ".indexOf(t[1])):"",a=parseInt(r+t[2],10);return pt[a%23]===t[3]}function Ae(e){let t=_(e);if(t.length!==9||t==="000000000")return!1;let r=0;for(let a=0;a<8;a++)r+=Number(t[a])*(9-a);return r+=Number(t[8])*-1,r%11===0}function xe(e){let t=_(e);if(t.length!==11)return!1;let r=[1,3,7,9,1,3,7,9,1,3],a=0;for(let s=0;s<10;s++)a+=Number(t[s])*r[s];return(10-a%10)%10===Number(t[10])}function _e(e){let t=_(e);if(t.length!==11)return!1;let r=10;for(let s=0;s<10;s++){let n=(Number(t[s])+r)%10;n===0&&(n=10),r=n*2%11}return(11-r)%10===Number(t[10])}function Ee(e){let t=_(e);if(t.length!==9)return!1;let r=0;for(let a=0;a<9;a+=3)r+=3*Number(t[a])+7*Number(t[a+1])+Number(t[a+2]);return r!==0&&r%10===0}function Se(e){let t=_(e);if(t.length!==10||/^(\d)\1{9}$/.test(t))return!1;let r=0;for(let s=0;s<9;s++)r+=Number(t[s])*(10-s);let a=11-r%11;return a===11&&(a=0),a===10?!1:a===Number(t[9])}var ht={A:1,B:2,C:3,D:4,E:5,F:6,G:7,H:8,J:1,K:2,L:3,M:4,N:5,P:7,R:9,S:2,T:3,U:4,V:5,W:6,X:7,Y:8,Z:9},gt=[8,7,6,5,4,3,2,10,0,9,8,7,6,5,4,3,2];function ve(e){let t=e.toUpperCase();if(!/^[A-HJ-NPR-Z0-9]{17}$/.test(t))return!1;let r=0;for(let s=0;s<17;s++){let n=t[s],c=n>="0"&&n<="9"?Number(n):ht[n];if(c===void 0)return!1;r+=c*gt[s]}let a=r%11;return t[8]===(a===10?"X":String(a))}function Re(e){let t=e.match(/^(\d{3})-?(\d{2})-?(\d{4})$/);if(!t)return!1;let r=Number(t[1]),a=Number(t[2]),s=Number(t[3]);return r===0||r===666||r>=900?!1:a!==0&&s!==0}function Ce(e){let r=e.replace(/[\s.-]/g,"").toUpperCase().match(/^([12]\d{4})(\d{2}|2[AB])(\d{6})(\d{2})$/);if(!r)return!1;let a=r[2]==="2A"?"19":r[2]==="2B"?"18":r[2];return 97-Number(r[1]+a+r[3])%97===Number(r[4])}var mt=[[0,1,2,3,4,5,6,7,8,9],[1,2,3,4,0,6,7,8,9,5],[2,3,4,0,1,7,8,9,5,6],[3,4,0,1,2,8,9,5,6,7],[4,0,1,2,3,9,5,6,7,8],[5,9,8,7,6,0,4,3,2,1],[6,5,9,8,7,1,0,4,3,2],[7,6,5,9,8,2,1,0,4,3],[8,7,6,5,9,3,2,1,0,4],[9,8,7,6,5,4,3,2,1,0]],bt=[[0,1,2,3,4,5,6,7,8,9],[1,5,7,6,2,8,3,0,9,4],[5,8,0,3,7,9,6,1,4,2],[8,9,1,6,0,4,3,5,2,7],[9,4,5,3,1,2,6,8,7,0],[4,2,8,6,5,7,3,9,0,1],[2,7,9,3,8,0,6,4,1,5],[7,0,4,6,9,1,3,2,5,8]];function De(e){let t=_(e);if(t.length!==12||t[0]==="0"||t[0]==="1")return!1;let r=0;for(let a=0;a<12;a++)r=mt[r][bt[a%8][Number(t[11-a])]];return r===0}var yt=[1,4,3,7,5,8,6,9,10];function Ie(e){let t=_(e);if(t.length!==9||/^(\d)\1{8}$/.test(t))return!1;let r=0;for(let a=0;a<9;a++)r+=Number(t[a])*yt[a];return r%11===0}var wt=[7,9,10,5,8,4,2,1,6,3,7,9,10,5,8,4,2],kt="10X98765432";function Ne(e){let t=e.toUpperCase();if(!/^[1-9]\d{5}(?:19|20)\d{2}(?:0[1-9]|1[0-2])(?:0[1-9]|[12]\d|3[01])\d{3}[\dX]$/.test(t))return!1;let r=0;for(let a=0;a<17;a++)r+=Number(t[a])*wt[a];return kt[r%11]===t[17]}function Te(e){let t=_(e);if(t.length!==12)return!1;let r=0;for(let n=1;n<=11;n++){let c=Number(t[11-n]);r+=c*(n<=6?n+1:n-5)}let a=r%11;return(a<=1?0:11-a)===Number(t[11])}var At={0:1,1:0,2:5,3:7,4:9,5:13,6:15,7:17,8:19,9:21,A:1,B:0,C:5,D:7,E:9,F:13,G:15,H:17,I:19,J:21,K:2,L:4,M:18,N:20,O:11,P:3,Q:6,R:8,S:12,T:14,U:16,V:10,W:22,X:25,Y:24,Z:23};function ze(e){let t=e.toUpperCase();if(!/^[A-Z]{6}\d{2}[A-Z]\d{2}[A-Z]\d{3}[A-Z]$/.test(t))return!1;let r=0;for(let a=0;a<15;a++){let s=t[a];if(a%2===0)r+=At[s];else{let n=s>="0"&&s<="9"?s.charCodeAt(0)-48:s.charCodeAt(0)-65;r+=n}}return String.fromCharCode(65+r%26)===t[15]}var k=()=>"[REDACTED ID]",Pe=[{id:"iban",label:"IBAN",why:"An international bank account number.",pattern:/\b[A-Z]{2}\d{2}[A-Z0-9]{11,30}\b/g,validate:be,mask:()=>"[REDACTED IBAN]",default:!0,tags:["pii","finance"]},{id:"tr_tckn",label:"Turkish national ID (TCKN)",why:"Turkey T.C. Kimlik No \u2014 a national identifier.",pattern:/\b[1-9]\d{10}\b/g,validate:ye,mask:k,default:!1,tags:["pii","id","tr"]},{id:"br_cpf",label:"Brazilian CPF",why:"Brazil taxpayer registry number \u2014 high-value PII.",pattern:/\b\d{3}\.?\d{3}\.?\d{3}-?\d{2}\b/g,validate:we,mask:k,default:!1,tags:["pii","id","br"]},{id:"es_dni",label:"Spanish DNI / NIE",why:"Spain national identity / foreigner number.",pattern:/\b[XYZ]?\d{7,8}[A-Za-z]\b/g,validate:ke,mask:k,default:!1,tags:["pii","id","es"]},{id:"nl_bsn",label:"Dutch BSN",why:"Netherlands citizen service number.",pattern:/\b\d{9}\b/g,validate:Ae,mask:k,default:!1,tags:["pii","id","nl"]},{id:"pl_pesel",label:"Polish PESEL",why:"Poland national identification number.",pattern:/\b\d{11}\b/g,validate:xe,mask:k,default:!1,tags:["pii","id","pl"]},{id:"de_tax_id",label:"German tax ID (Steuer-IdNr)",why:"Germany tax identification number.",pattern:/\b\d{11}\b/g,validate:_e,mask:k,default:!1,tags:["pii","id","de"]},{id:"it_codice_fiscale",label:"Italian Codice Fiscale",why:"Italy fiscal code \u2014 a national identifier.",pattern:/\b[A-Z]{6}\d{2}[A-Z]\d{2}[A-Z]\d{3}[A-Z]\b/gi,validate:ze,mask:k,default:!1,tags:["pii","id","it"]},{id:"ca_sin",label:"Canadian SIN",why:"Canada social insurance number.",pattern:/\b\d{3}[-\s]?\d{3}[-\s]?\d{3}\b/g,validate:me,mask:k,default:!1,tags:["pii","id","ca"]},{id:"fr_nir",label:"French NIR (num\xE9ro de s\xE9curit\xE9 sociale)",why:"France INSEE social security number.",pattern:/\b[12][\s.]?\d{2}[\s.]?\d{2}[\s.]?(?:\d{2}|2[AB])[\s.]?\d{3}[\s.]?\d{3}[\s.]?\d{2}\b/gi,validate:Ce,mask:k,default:!1,tags:["pii","id","fr"]},{id:"in_aadhaar",label:"Indian Aadhaar number",why:"India biometric-linked national identifier.",pattern:/\b[2-9]\d{3}[\s-]?\d{4}[\s-]?\d{4}\b/g,validate:De,mask:k,default:!1,tags:["pii","id","in"]},{id:"au_tfn",label:"Australian TFN",why:"Australia tax file number.",pattern:/\b\d{3}[\s-]?\d{3}[\s-]?\d{3}\b/g,validate:Ie,mask:k,default:!1,tags:["pii","id","au"]},{id:"cn_resident_id",label:"Chinese resident ID",why:"China resident identity card number.",pattern:/\b[1-9]\d{5}(?:19|20)\d{2}(?:0[1-9]|1[0-2])(?:0[1-9]|[12]\d|3[01])\d{3}[\dXx]\b/g,validate:Ne,mask:k,default:!1,tags:["pii","id","cn"]},{id:"jp_my_number",label:"Japanese My Number",why:"Japan individual number for tax and social security.",pattern:/\b\d{4}[\s-]?\d{4}[\s-]?\d{4}\b/g,validate:Te,mask:k,default:!1,tags:["pii","id","jp"]},{id:"us_ssn",label:"US Social Security number",why:"A US national identifier \u2014 high-value PII.",pattern:/\b\d{3}-\d{2}-\d{4}\b/g,validate:Re,mask:k,default:!1,tags:["pii","id","us"]}];var xt=new Set(["abandon","ability","able","about","above","absent","absorb","abstract","absurd","abuse","access","accident","account","accuse","achieve","acid","acoustic","acquire","across","act","action","actor","actress","actual","adapt","add","addict","address","adjust","admit","adult","advance","advice","aerobic","affair","afford","afraid","again","age","agent","agree","ahead","aim","air","airport","aisle","alarm","album","alcohol","alert","alien","all","alley","allow","almost","alone","alpha","already","also","alter","always","amateur","amazing","among","amount","amused","analyst","anchor","ancient","anger","angle","angry","animal","ankle","announce","annual","another","answer","antenna","antique","anxiety","any","apart","apology","appear","apple","approve","april","arch","arctic","area","arena","argue","arm","armed","armor","army","around","arrange","arrest","arrive","arrow","art","artefact","artist","artwork","ask","aspect","assault","asset","assist","assume","asthma","athlete","atom","attack","attend","attitude","attract","auction","audit","august","aunt","author","auto","autumn","average","avocado","avoid","awake","aware","away","awesome","awful","awkward","axis","baby","bachelor","bacon","badge","bag","balance","balcony","ball","bamboo","banana","banner","bar","barely","bargain","barrel","base","basic","basket","battle","beach","bean","beauty","because","become","beef","before","begin","behave","behind","believe","below","belt","bench","benefit","best","betray","better","between","beyond","bicycle","bid","bike","bind","biology","bird","birth","bitter","black","blade","blame","blanket","blast","bleak","bless","blind","blood","blossom","blouse","blue","blur","blush","board","boat","body","boil","bomb","bone","bonus","book","boost","border","boring","borrow","boss","bottom","bounce","box","boy","bracket","brain","brand","brass","brave","bread","breeze","brick","bridge","brief","bright","bring","brisk","broccoli","broken","bronze","broom","brother","brown","brush","bubble","buddy","budget","buffalo","build","bulb","bulk","bullet","bundle","bunker","burden","burger","burst","bus","business","busy","butter","buyer","buzz","cabbage","cabin","cable","cactus","cage","cake","call","calm","camera","camp","can","canal","cancel","candy","cannon","canoe","canvas","canyon","capable","capital","captain","car","carbon","card","cargo","carpet","carry","cart","case","cash","casino","castle","casual","cat","catalog","catch","category","cattle","caught","cause","caution","cave","ceiling","celery","cement","census","century","cereal","certain","chair","chalk","champion","change","chaos","chapter","charge","chase","chat","cheap","check","cheese","chef","cherry","chest","chicken","chief","child","chimney","choice","choose","chronic","chuckle","chunk","churn","cigar","cinnamon","circle","citizen","city","civil","claim","clap","clarify","claw","clay","clean","clerk","clever","click","client","cliff","climb","clinic","clip","clock","clog","close","cloth","cloud","clown","club","clump","cluster","clutch","coach","coast","coconut","code","coffee","coil","coin","collect","color","column","combine","come","comfort","comic","common","company","concert","conduct","confirm","congress","connect","consider","control","convince","cook","cool","copper","copy","coral","core","corn","correct","cost","cotton","couch","country","couple","course","cousin","cover","coyote","crack","cradle","craft","cram","crane","crash","crater","crawl","crazy","cream","credit","creek","crew","cricket","crime","crisp","critic","crop","cross","crouch","crowd","crucial","cruel","cruise","crumble","crunch","crush","cry","crystal","cube","culture","cup","cupboard","curious","current","curtain","curve","cushion","custom","cute","cycle","dad","damage","damp","dance","danger","daring","dash","daughter","dawn","day","deal","debate","debris","decade","december","decide","decline","decorate","decrease","deer","defense","define","defy","degree","delay","deliver","demand","demise","denial","dentist","deny","depart","depend","deposit","depth","deputy","derive","describe","desert","design","desk","despair","destroy","detail","detect","develop","device","devote","diagram","dial","diamond","diary","dice","diesel","diet","differ","digital","dignity","dilemma","dinner","dinosaur","direct","dirt","disagree","discover","disease","dish","dismiss","disorder","display","distance","divert","divide","divorce","dizzy","doctor","document","dog","doll","dolphin","domain","donate","donkey","donor","door","dose","double","dove","draft","dragon","drama","drastic","draw","dream","dress","drift","drill","drink","drip","drive","drop","drum","dry","duck","dumb","dune","during","dust","dutch","duty","dwarf","dynamic","eager","eagle","early","earn","earth","easily","east","easy","echo","ecology","economy","edge","edit","educate","effort","egg","eight","either","elbow","elder","electric","elegant","element","elephant","elevator","elite","else","embark","embody","embrace","emerge","emotion","employ","empower","empty","enable","enact","end","endless","endorse","enemy","energy","enforce","engage","engine","enhance","enjoy","enlist","enough","enrich","enroll","ensure","enter","entire","entry","envelope","episode","equal","equip","era","erase","erode","erosion","error","erupt","escape","essay","essence","estate","eternal","ethics","evidence","evil","evoke","evolve","exact","example","excess","exchange","excite","exclude","excuse","execute","exercise","exhaust","exhibit","exile","exist","exit","exotic","expand","expect","expire","explain","expose","express","extend","extra","eye","eyebrow","fabric","face","faculty","fade","faint","faith","fall","false","fame","family","famous","fan","fancy","fantasy","farm","fashion","fat","fatal","father","fatigue","fault","favorite","feature","february","federal","fee","feed","feel","female","fence","festival","fetch","fever","few","fiber","fiction","field","figure","file","film","filter","final","find","fine","finger","finish","fire","firm","first","fiscal","fish","fit","fitness","fix","flag","flame","flash","flat","flavor","flee","flight","flip","float","flock","floor","flower","fluid","flush","fly","foam","focus","fog","foil","fold","follow","food","foot","force","forest","forget","fork","fortune","forum","forward","fossil","foster","found","fox","fragile","frame","frequent","fresh","friend","fringe","frog","front","frost","frown","frozen","fruit","fuel","fun","funny","furnace","fury","future","gadget","gain","galaxy","gallery","game","gap","garage","garbage","garden","garlic","garment","gas","gasp","gate","gather","gauge","gaze","general","genius","genre","gentle","genuine","gesture","ghost","giant","gift","giggle","ginger","giraffe","girl","give","glad","glance","glare","glass","glide","glimpse","globe","gloom","glory","glove","glow","glue","goat","goddess","gold","good","goose","gorilla","gospel","gossip","govern","gown","grab","grace","grain","grant","grape","grass","gravity","great","green","grid","grief","grit","grocery","group","grow","grunt","guard","guess","guide","guilt","guitar","gun","gym","habit","hair","half","hammer","hamster","hand","happy","harbor","hard","harsh","harvest","hat","have","hawk","hazard","head","health","heart","heavy","hedgehog","height","hello","helmet","help","hen","hero","hidden","high","hill","hint","hip","hire","history","hobby","hockey","hold","hole","holiday","hollow","home","honey","hood","hope","horn","horror","horse","hospital","host","hotel","hour","hover","hub","huge","human","humble","humor","hundred","hungry","hunt","hurdle","hurry","hurt","husband","hybrid","ice","icon","idea","identify","idle","ignore","ill","illegal","illness","image","imitate","immense","immune","impact","impose","improve","impulse","inch","include","income","increase","index","indicate","indoor","industry","infant","inflict","inform","inhale","inherit","initial","inject","injury","inmate","inner","innocent","input","inquiry","insane","insect","inside","inspire","install","intact","interest","into","invest","invite","involve","iron","island","isolate","issue","item","ivory","jacket","jaguar","jar","jazz","jealous","jeans","jelly","jewel","job","join","joke","journey","joy","judge","juice","jump","jungle","junior","junk","just","kangaroo","keen","keep","ketchup","key","kick","kid","kidney","kind","kingdom","kiss","kit","kitchen","kite","kitten","kiwi","knee","knife","knock","know","lab","label","labor","ladder","lady","lake","lamp","language","laptop","large","later","latin","laugh","laundry","lava","law","lawn","lawsuit","layer","lazy","leader","leaf","learn","leave","lecture","left","leg","legal","legend","leisure","lemon","lend","length","lens","leopard","lesson","letter","level","liar","liberty","library","license","life","lift","light","like","limb","limit","link","lion","liquid","list","little","live","lizard","load","loan","lobster","local","lock","logic","lonely","long","loop","lottery","loud","lounge","love","loyal","lucky","luggage","lumber","lunar","lunch","luxury","lyrics","machine","mad","magic","magnet","maid","mail","main","major","make","mammal","man","manage","mandate","mango","mansion","manual","maple","marble","march","margin","marine","market","marriage","mask","mass","master","match","material","math","matrix","matter","maximum","maze","meadow","mean","measure","meat","mechanic","medal","media","melody","melt","member","memory","mention","menu","mercy","merge","merit","merry","mesh","message","metal","method","middle","midnight","milk","million","mimic","mind","minimum","minor","minute","miracle","mirror","misery","miss","mistake","mix","mixed","mixture","mobile","model","modify","mom","moment","monitor","monkey","monster","month","moon","moral","more","morning","mosquito","mother","motion","motor","mountain","mouse","move","movie","much","muffin","mule","multiply","muscle","museum","mushroom","music","must","mutual","myself","mystery","myth","naive","name","napkin","narrow","nasty","nation","nature","near","neck","need","negative","neglect","neither","nephew","nerve","nest","net","network","neutral","never","news","next","nice","night","noble","noise","nominee","noodle","normal","north","nose","notable","note","nothing","notice","novel","now","nuclear","number","nurse","nut","oak","obey","object","oblige","obscure","observe","obtain","obvious","occur","ocean","october","odor","off","offer","office","often","oil","okay","old","olive","olympic","omit","once","one","onion","online","only","open","opera","opinion","oppose","option","orange","orbit","orchard","order","ordinary","organ","orient","original","orphan","ostrich","other","outdoor","outer","output","outside","oval","oven","over","own","owner","oxygen","oyster","ozone","pact","paddle","page","pair","palace","palm","panda","panel","panic","panther","paper","parade","parent","park","parrot","party","pass","patch","path","patient","patrol","pattern","pause","pave","payment","peace","peanut","pear","peasant","pelican","pen","penalty","pencil","people","pepper","perfect","permit","person","pet","phone","photo","phrase","physical","piano","picnic","picture","piece","pig","pigeon","pill","pilot","pink","pioneer","pipe","pistol","pitch","pizza","place","planet","plastic","plate","play","please","pledge","pluck","plug","plunge","poem","poet","point","polar","pole","police","pond","pony","pool","popular","portion","position","possible","post","potato","pottery","poverty","powder","power","practice","praise","predict","prefer","prepare","present","pretty","prevent","price","pride","primary","print","priority","prison","private","prize","problem","process","produce","profit","program","project","promote","proof","property","prosper","protect","proud","provide","public","pudding","pull","pulp","pulse","pumpkin","punch","pupil","puppy","purchase","purity","purpose","purse","push","put","puzzle","pyramid","quality","quantum","quarter","question","quick","quit","quiz","quote","rabbit","raccoon","race","rack","radar","radio","rail","rain","raise","rally","ramp","ranch","random","range","rapid","rare","rate","rather","raven","raw","razor","ready","real","reason","rebel","rebuild","recall","receive","recipe","record","recycle","reduce","reflect","reform","refuse","region","regret","regular","reject","relax","release","relief","rely","remain","remember","remind","remove","render","renew","rent","reopen","repair","repeat","replace","report","require","rescue","resemble","resist","resource","response","result","retire","retreat","return","reunion","reveal","review","reward","rhythm","rib","ribbon","rice","rich","ride","ridge","rifle","right","rigid","ring","riot","ripple","risk","ritual","rival","river","road","roast","robot","robust","rocket","romance","roof","rookie","room","rose","rotate","rough","round","route","royal","rubber","rude","rug","rule","run","runway","rural","sad","saddle","sadness","safe","sail","salad","salmon","salon","salt","salute","same","sample","sand","satisfy","satoshi","sauce","sausage","save","say","scale","scan","scare","scatter","scene","scheme","school","science","scissors","scorpion","scout","scrap","screen","script","scrub","sea","search","season","seat","second","secret","section","security","seed","seek","segment","select","sell","seminar","senior","sense","sentence","series","service","session","settle","setup","seven","shadow","shaft","shallow","share","shed","shell","sheriff","shield","shift","shine","ship","shiver","shock","shoe","shoot","shop","short","shoulder","shove","shrimp","shrug","shuffle","shy","sibling","sick","side","siege","sight","sign","silent","silk","silly","silver","similar","simple","since","sing","siren","sister","situate","six","size","skate","sketch","ski","skill","skin","skirt","skull","slab","slam","sleep","slender","slice","slide","slight","slim","slogan","slot","slow","slush","small","smart","smile","smoke","smooth","snack","snake","snap","sniff","snow","soap","soccer","social","sock","soda","soft","solar","soldier","solid","solution","solve","someone","song","soon","sorry","sort","soul","sound","soup","source","south","space","spare","spatial","spawn","speak","special","speed","spell","spend","sphere","spice","spider","spike","spin","spirit","split","spoil","sponsor","spoon","sport","spot","spray","spread","spring","spy","square","squeeze","squirrel","stable","stadium","staff","stage","stairs","stamp","stand","start","state","stay","steak","steel","stem","step","stereo","stick","still","sting","stock","stomach","stone","stool","story","stove","strategy","street","strike","strong","struggle","student","stuff","stumble","style","subject","submit","subway","success","such","sudden","suffer","sugar","suggest","suit","summer","sun","sunny","sunset","super","supply","supreme","sure","surface","surge","surprise","surround","survey","suspect","sustain","swallow","swamp","swap","swarm","swear","sweet","swift","swim","swing","switch","sword","symbol","symptom","syrup","system","table","tackle","tag","tail","talent","talk","tank","tape","target","task","taste","tattoo","taxi","teach","team","tell","ten","tenant","tennis","tent","term","test","text","thank","that","theme","then","theory","there","they","thing","this","thought","three","thrive","throw","thumb","thunder","ticket","tide","tiger","tilt","timber","time","tiny","tip","tired","tissue","title","toast","tobacco","today","toddler","toe","together","toilet","token","tomato","tomorrow","tone","tongue","tonight","tool","tooth","top","topic","topple","torch","tornado","tortoise","toss","total","tourist","toward","tower","town","toy","track","trade","traffic","tragic","train","transfer","trap","trash","travel","tray","treat","tree","trend","trial","tribe","trick","trigger","trim","trip","trophy","trouble","truck","true","truly","trumpet","trust","truth","try","tube","tuition","tumble","tuna","tunnel","turkey","turn","turtle","twelve","twenty","twice","twin","twist","two","type","typical","ugly","umbrella","unable","unaware","uncle","uncover","under","undo","unfair","unfold","unhappy","uniform","unique","unit","universe","unknown","unlock","until","unusual","unveil","update","upgrade","uphold","upon","upper","upset","urban","urge","usage","use","used","useful","useless","usual","utility","vacant","vacuum","vague","valid","valley","valve","van","vanish","vapor","various","vast","vault","vehicle","velvet","vendor","venture","venue","verb","verify","version","very","vessel","veteran","viable","vibrant","vicious","victory","video","view","village","vintage","violin","virtual","virus","visa","visit","visual","vital","vivid","vocal","voice","void","volcano","volume","vote","voyage","wage","wagon","wait","walk","wall","walnut","want","warfare","warm","warrior","wash","wasp","waste","water","wave","way","wealth","weapon","wear","weasel","weather","web","wedding","weekend","weird","welcome","west","wet","whale","what","wheat","wheel","when","where","whip","whisper","wide","width","wife","wild","will","win","window","wine","wing","wink","winner","winter","wire","wisdom","wise","wish","witness","wolf","woman","wonder","wood","wool","word","work","world","worry","worth","wrap","wreck","wrestle","wrist","write","wrong","yard","year","yellow","you","young","youth","zebra","zero","zone","zoo"]),_t=new Set([12,15,18,21,24]);function Oe(e){let t=e.trim().toLowerCase().split(/\s+/);return _t.has(t.length)?t.every(r=>xt.has(r)):!1}var b=e=>t=>t.length<=e?"***":t.slice(0,e)+"***",Ve=[{id:"digitalocean_token",label:"DigitalOcean token",why:"Controls DigitalOcean infrastructure and billing.",pattern:/\bdop_v1_[a-f0-9]{64}\b/g,mask:b(7),default:!0,tags:["secret"]},{id:"sentry_dsn",label:"Sentry DSN",why:"A Sentry DSN can be used to send events to your project.",pattern:/\bhttps:\/\/[0-9a-zA-Z]{16,}@[\w.-]*sentry\.io\/\d+\b/g,mask:()=>"[REDACTED SENTRY DSN]",default:!0,tags:["secret"]},{id:"new_relic_key",label:"New Relic key",why:"Grants access to your New Relic account data.",pattern:/\b(?:NRAK-[A-Z0-9]{27}|NRJS-[a-f0-9]{19})\b/g,mask:b(5),default:!0,tags:["secret"]},{id:"discord_bot_token",label:"Discord bot token",why:"Full control of a Discord bot account.",pattern:/\b[MNO][A-Za-z\d_-]{23}\.[A-Za-z\d_-]{6}\.[A-Za-z\d_-]{27,}\b/g,mask:()=>"[REDACTED DISCORD TOKEN]",default:!0,tags:["secret"]},{id:"telegram_bot_token",label:"Telegram bot token",why:"Full control of a Telegram bot.",pattern:/\b\d{8,10}:[A-Za-z0-9_-]{34,46}\b/g,mask:()=>"[REDACTED TELEGRAM TOKEN]",default:!0,tags:["secret"]},{id:"shopify_token",label:"Shopify token",why:"Access to a Shopify store and its data.",pattern:/\bshp(?:at|ca|pa|ss)_[a-fA-F0-9]{32}\b/g,mask:b(6),default:!0,tags:["secret"]},{id:"square_token",label:"Square token",why:"Can move money through a Square account.",pattern:/\b(?:sq0[a-z]{3}-[A-Za-z0-9_-]{22,43}|EAAA[A-Za-z0-9_-]{60})\b/g,mask:b(6),default:!0,tags:["secret"]},{id:"azure_storage_key",label:"Azure storage key",why:"A storage account key grants full access to the account.",pattern:/\bAccountKey=[A-Za-z0-9+/]{86}==/g,mask:()=>"AccountKey=***",default:!0,tags:["secret"]},{id:"discord_webhook",label:"Discord webhook URL",why:"Anyone with the URL can post messages to the channel.",pattern:/\bhttps:\/\/(?:\w+\.)?discord(?:app)?\.com\/api\/webhooks\/\d{17,20}\/[A-Za-z0-9_-]{60,}/g,mask:()=>"[REDACTED DISCORD WEBHOOK]",default:!0,tags:["secret"]},{id:"huggingface_token",label:"Hugging Face token",why:"Grants access to private models, datasets, and inference.",pattern:/\bhf_[A-Za-z0-9]{30,45}\b/g,mask:b(3),default:!0,tags:["secret"]},{id:"vault_token",label:"HashiCorp Vault token",why:"A Vault token unlocks every secret it is entitled to read.",pattern:/\bhv[sbr]\.[A-Za-z0-9_-]{20,200}(?![A-Za-z0-9_-])/g,mask:b(4),default:!0,tags:["secret"]},{id:"groq_key",label:"Groq API key",why:"Bills inference against your Groq account.",pattern:/\bgsk_[A-Za-z0-9]{40,60}\b/g,mask:b(4),default:!0,tags:["secret"]},{id:"xai_key",label:"xAI API key",why:"Bills inference against your xAI account.",pattern:/\bxai-[A-Za-z0-9]{40,120}\b/g,mask:b(4),default:!0,tags:["secret"]},{id:"perplexity_key",label:"Perplexity API key",why:"Bills inference against your Perplexity account.",pattern:/\bpplx-[A-Za-z0-9]{40,60}\b/g,mask:b(5),default:!0,tags:["secret"]},{id:"openrouter_key",label:"OpenRouter API key",why:"Bills requests to every model behind your OpenRouter account.",pattern:/\bsk-or-v1-[a-f0-9]{64}\b/g,mask:b(9),default:!0,tags:["secret"]},{id:"replicate_token",label:"Replicate token",why:"Runs and bills model predictions on your account.",pattern:/\br8_[A-Za-z0-9]{30,45}\b/g,mask:b(3),default:!0,tags:["secret"]},{id:"databricks_token",label:"Databricks token",why:"Access to workspaces, jobs, and data in Databricks.",pattern:/\bdapi[a-f0-9]{32}(?:-\d)?\b/g,mask:b(4),default:!0,tags:["secret"]},{id:"airtable_pat",label:"Airtable personal access token",why:"Reads and writes the bases the token is scoped to.",pattern:/\bpat[A-Za-z0-9]{14}\.[a-f0-9]{64}\b/g,mask:b(6),default:!0,tags:["secret"]},{id:"postman_key",label:"Postman API key",why:"Access to workspaces, collections, and stored environments.",pattern:/\bPMAK-[a-f0-9]{24}-[a-f0-9]{34}\b/g,mask:b(5),default:!0,tags:["secret"]},{id:"linear_key",label:"Linear API key",why:"Reads and writes issues and projects in your workspace.",pattern:/\blin_api_[A-Za-z0-9]{40,48}\b/g,mask:b(8),default:!0,tags:["secret"]},{id:"figma_token",label:"Figma token",why:"Access to design files and team resources.",pattern:/\bfigd_[A-Za-z0-9_-]{40,50}(?![A-Za-z0-9_-])/g,mask:b(5),default:!0,tags:["secret"]},{id:"notion_token",label:"Notion token",why:"Reads and writes every page the integration can reach.",pattern:/\b(?:ntn_[A-Za-z0-9]{40,50}|secret_[A-Za-z0-9]{43})\b/g,mask:b(4),default:!0,tags:["secret"]},{id:"doppler_token",label:"Doppler token",why:"Reads the secrets of the configs it is scoped to.",pattern:/\bdp\.(?:ct|pt|st)\.(?:[a-z0-9_-]{2,35}\.)?[A-Za-z0-9]{40,44}\b/g,mask:b(6),default:!0,tags:["secret"]},{id:"supabase_key",label:"Supabase key",why:"Access to your Supabase project and its database.",pattern:/\bsbp_[a-f0-9]{40}\b/g,mask:b(4),default:!0,tags:["secret"]},{id:"netlify_token",label:"Netlify token",why:"Deploys and manages sites on your Netlify account.",pattern:/\bnfp_[A-Za-z0-9]{36,60}\b/g,mask:b(4),default:!0,tags:["secret"]},{id:"stripe_webhook_secret",label:"Stripe webhook secret",why:"Lets an attacker forge signed Stripe webhook events.",pattern:/\bwhsec_[A-Za-z0-9]{32,64}\b/g,mask:b(6),default:!0,tags:["secret"]},{id:"gcp_service_account",label:"GCP service account key",why:"A service-account key file authenticates as the service account.",pattern:/"private_key_id"\s*:\s*"([a-f0-9]{40})"/g,capture:1,mask:()=>"***",default:!0,tags:["secret"],prefilter:["private_key_id"]},{id:"gcp_refresh_token",label:"GCP OAuth refresh token",why:"Mints fresh Google Cloud access tokens indefinitely.",pattern:/\b1\/\/[A-Za-z0-9_-]{20,160}(?![A-Za-z0-9_-])/g,mask:b(4),default:!0,tags:["secret"],prefilter:["1//"]},{id:"mailgun_key",label:"Mailgun API key",why:"Can send mail as your domain and read stored messages.",pattern:/\bkey-[a-f0-9]{32}\b/g,mask:b(4),default:!0,tags:["secret"]},{id:"eth_address",label:"Ethereum address",why:"A wallet address \u2014 can identify a person and their holdings.",pattern:/\b0x[a-fA-F0-9]{40}\b/g,mask:b(6),default:!1,tags:["crypto"]},{id:"btc_address",label:"Bitcoin address",why:"A wallet address \u2014 can identify a person and their holdings.",pattern:/\b(?:bc1[a-z0-9]{25,62}|[13][a-km-zA-HJ-NP-Z1-9]{25,34})\b/g,mask:b(4),default:!1,tags:["crypto"]},{id:"seed_phrase",label:"Crypto seed phrase",why:"A BIP39 mnemonic recovers an entire wallet \u2014 the highest-value secret there is.",pattern:/\b(?:[a-z]{3,8}\s+){11,23}[a-z]{3,8}\b/g,validate:Oe,mask:()=>"[REDACTED SEED PHRASE]",default:!1,tags:["crypto"]},{id:"aba_routing",label:"US bank routing number",why:"An ABA routing number identifies a US bank account.",pattern:/\b\d{9}\b/g,validate:Ee,mask:()=>"[REDACTED ROUTING]",default:!1,tags:["finance","us"]},{id:"swift_bic",label:"SWIFT / BIC code",why:"Identifies a bank for international transfers.",pattern:/\b[A-Z]{4}[A-Z]{2}[A-Z0-9]{2}(?:[A-Z0-9]{3})?\b/g,mask:b(4),default:!1,tags:["finance"]},{id:"uk_nhs",label:"UK NHS number",why:"A UK National Health Service number \u2014 health PII.",pattern:/\b\d{3}[ -]?\d{3}[ -]?\d{4}\b/g,validate:Se,mask:()=>"[REDACTED ID]",default:!1,tags:["pii","id","gb"]},{id:"vin",label:"Vehicle VIN",why:"A vehicle identification number can identify an owner.",pattern:/\b[A-HJ-NPR-Z0-9]{17}\b/g,validate:ve,mask:()=>"[REDACTED VIN]",default:!1,tags:["vehicle"]},{id:"coordinates",label:"Geographic coordinates",why:"Precise lat/long can reveal a person\u2019s location.",pattern:/\b-?\d{1,3}\.\d{4,},\s?-?\d{1,3}\.\d{4,}\b/g,mask:()=>"[REDACTED COORDS]",default:!1,tags:["network"]},{id:"internal_url",label:"Internal URL",why:"Localhost and private-range URLs expose internal infrastructure.",pattern:/\bhttps?:\/\/(?:localhost|127\.0\.0\.1|(?:10|192\.168|172\.(?:1[6-9]|2\d|3[01]))\.[\d.]+)(?::\d+)?[^\s]*/g,mask:()=>"[REDACTED INTERNAL URL]",default:!1,tags:["network"]}];function A(e){return t=>t.length<=e?"***":t.slice(0,e)+"***"}function Ze(e){return t=>{let r=t.replace(/\D/g,""),a=r.slice(-e),s=Math.max(0,Math.ceil((r.length-e)/4));return("**** ".repeat(s)+a).trim()}}function Me(e){let t=e.replace(/\D/g,"");if(t.length<13||t.length>19)return!1;let r=0,a=!1;for(let s=t.length-1;s>=0;s--){let n=t.charCodeAt(s)-48;a&&(n*=2,n>9&&(n-=9)),r+=n,a=!a}return r%10===0}function $e(e){let t=new Map;for(let a of e)t.set(a,(t.get(a)??0)+1);let r=0;for(let a of t.values()){let s=a/e.length;r-=s*Math.log2(s)}return r}function Et(e){let t=2166136261;for(let r=0;r<e.length;r++)t^=e.charCodeAt(r),t=Math.imul(t,16777619);return(t>>>0).toString(16).padStart(8,"0")}function St(e){let t=e.replace(/\D/g,"");return!(t.length<8||t.length>15||!e.startsWith("+")&&(t.length<9||/(?:19|20)\d{2}$/.test(t)&&/[.\s-](?:19|20)\d{2}$/.test(e)))}var Y=/^(?:pass(?:word|wd)?|secret|token|api[_-]?key|access[_-]?key|client[_-]?secret|private[_-]?key|auth(?:orization)?|cookie|session[_-]?id|refresh[_-]?token|credit[_-]?card|card[_-]?number|cvv|ssn)$/i,J={id:"sensitive_key",label:"Sensitive field",why:"A value stored under a field name that is sensitive by convention.",pattern:/(?!)/,mask:()=>"***",default:!0},L=[{id:"private_key",label:"Private key",why:"A PEM private key is a full cryptographic identity \u2014 whoever holds it is you.",pattern:/-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP |ENCRYPTED )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |DSA |OPENSSH |PGP |ENCRYPTED )?PRIVATE KEY-----/g,mask:()=>"[REDACTED PRIVATE KEY]",default:!0},{id:"aws_access_key",label:"AWS access key ID",why:"Pairs with a secret key to control cloud resources and billing.",pattern:/\b(?:AKIA|ASIA|AGPA|AIDA|AROA|ANPA|ANVA)(?:[ \t-]?[A-Z0-9]){16}\b/g,validate:e=>/^(?:AKIA|ASIA|AGPA|AIDA|AROA|ANPA|ANVA)[A-Z0-9]{16}$/.test(e.replace(/[ \t-]/g,"")),mask:A(4),default:!0},{id:"aws_secret_key",label:"AWS secret access key",why:"The signing half of an AWS credential pair \u2014 full API access.",pattern:/(?:aws)?_?secret_?(?:access_?)?key["'\s]*[:=]\s*["']?([A-Za-z0-9/+]{40})(?![A-Za-z0-9/+=])/gi,capture:1,mask:()=>"***",default:!0,priority:1,prefilter:["secret"]},{id:"github_token",label:"GitHub token",why:"Grants access to repositories and account actions.",pattern:/\b(?:gh[posur]_[A-Za-z0-9]{36}|github_pat_[A-Za-z0-9_]{82})\b/g,mask:A(4),default:!0},{id:"gitlab_token",label:"GitLab token",why:"A GitLab personal access token grants API and repo access.",pattern:/\bglpat-[A-Za-z0-9_-]{20}\b/g,mask:A(6),default:!0},{id:"slack_token",label:"Slack token",why:"Lets the holder read and post as your workspace app.",pattern:/\bxox[baprs]-[A-Za-z0-9-]{10,64}\b/g,mask:A(5),default:!0},{id:"stripe_key",label:"Stripe secret key",why:"A live secret or restricted key can move real money.",pattern:/\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,64}\b/g,mask:e=>e.slice(0,e.indexOf("_",e.indexOf("_")+1)+1)+"***",default:!0},{id:"anthropic_key",label:"Anthropic API key",why:"Bills against your Anthropic account and reaches your models and data.",pattern:/\bsk-ant-[A-Za-z0-9_-]{24,160}\b/g,mask:A(7),default:!0},{id:"openai_key",label:"OpenAI API key",why:"Bills against your account and reaches your models and data.",pattern:/\bsk-(?!ant-|or-)(?:proj-)?[A-Za-z0-9_-]{20,64}\b/g,mask:A(3),default:!0},{id:"google_api_key",label:"Google API key",why:"Grants access to enabled Google Cloud APIs on your project.",pattern:/\bAIza[0-9A-Za-z_-]{35}\b/g,mask:A(4),default:!0},{id:"sendgrid_key",label:"SendGrid API key",why:"Can send mail as your domain and read templates.",pattern:/\bSG\.[A-Za-z0-9_-]{16,32}\.[A-Za-z0-9_-]{16,64}\b/g,mask:A(3),default:!0},{id:"twilio_key",label:"Twilio SID / key",why:"Can send messages and place calls billed to your account.",pattern:/\b(?:AC|SK)[a-f0-9]{32}\b/g,mask:A(4),default:!0},{id:"npm_token",label:"npm token",why:"Can publish packages to your npm account.",pattern:/\bnpm_[A-Za-z0-9]{36}\b/g,mask:A(4),default:!0},{id:"jwt",label:"JSON Web Token",why:"Often a live session or bearer credential \u2014 decode it and you may be signed in.",pattern:/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{4,}\b/g,mask:()=>"[REDACTED JWT]",default:!0},{id:"bearer_token",label:"Bearer token",why:"A bearer token in an Authorization header is a live credential.",pattern:/\bBearer\s+[A-Za-z0-9._~+/-]{8,}={0,2}/g,mask:()=>"Bearer ***",default:!0},{id:"basic_auth",label:"Basic auth header",why:"Base64 in a Basic header decodes straight back to user:password.",pattern:/\bBasic\s+[A-Za-z0-9+/]{8,}={0,2}/g,mask:()=>"Basic ***",default:!0},{id:"url_credentials",label:"Credentials in URL",why:"A username:password baked into a connection string leaks the password.",pattern:/\b[a-zA-Z][a-zA-Z0-9+.-]*:\/\/[^:@\s/]+:[^@\s/]+@/g,mask:e=>e.replace(/:([^:@\s/]+)@$/,":***@"),default:!0},{id:"generic_assignment",label:"Assigned secret",why:"A value assigned to a sensitive-looking field name (password=\u2026, \u5BC6\u7801: \u2026) in any language.",pattern:he(),mask:e=>e.replace(/([:=]\s*["']?)([^\s"',;]{4,})(["']?)\s*$/u,"$1***$3"),default:!0,tags:["secret"]},{id:"email",label:"Email address",why:"Personal data that usually does not belong in logs.",pattern:/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,24}\b/g,mask:e=>(e[0]??"")+"***@***",default:!0,tags:["pii"],prefilter:["@"]},{id:"obfuscated_email",label:"Obfuscated email address",why:"An email written with explicit \u201Cat\u201D and \u201Cdot\u201D separators to evade ordinary filters.",pattern:/\b[A-Za-z0-9._%+-]{1,64}\s*(?:\[at\]|\(at\))\s*[A-Za-z0-9-]{1,63}(?:\s*(?:\[dot\]|\(dot\))\s*[A-Za-z0-9-]{1,63}){1,4}\b/gi,mask:e=>(e[0]??"")+"*** [at] *** [dot] ***",default:!0,tags:["pii","email","obfuscated"],risk:"high",confidence:.84,priority:45,prefilter:["[at]","(at)"]},{id:"credit_card",label:"Payment card number",why:"A card number in logs is a PCI-DSS violation.",pattern:/\b\d(?:[ -]?\d){12,18}\b/g,validate:Me,mask:Ze(4),default:!0,tags:["pii","finance"]},{id:"phone",label:"Phone number",why:"A phone number is personal data.",pattern:/(?:\+[1-9]\d{0,2}[\s.-]?(?:\(\d{1,4}\)[\s.-]?)?\d{1,4}(?:[\s.-]?\d{2,4}){1,4}|\(\d{2,4}\)[\s.-]?\d{2,4}(?:[\s.-]\d{2,4}){1,3}|\b0\d{1,4}(?:[\s.-]\d{2,4}){2,4})(?!\d)/g,validate:St,mask:e=>(e.startsWith("+")?e.slice(0,3):e.slice(0,2))+"***",default:!1,tags:["pii"],confidence:.8,context:{positive:/\b(?:phone|tel|mobile|cell|call|fax|whatsapp|viber|telefon|номер|téléphone|handy)\b/i,negative:/\b(?:date|version|invoice|order|ref)\b/i}},{id:"ipv4",label:"IPv4 address",why:"Can be personal data or reveal internal infrastructure.",pattern:/\b(?:(?:25[0-5]|2[0-4]\d|1?\d?\d)\.){3}(?:25[0-5]|2[0-4]\d|1?\d?\d)\b/g,mask:()=>"***.***.***.***",default:!1,tags:["network"]},{id:"ipv6",label:"IPv6 address",why:"Can be personal data or reveal internal infrastructure.",pattern:/\b(?:[A-Fa-f0-9]{1,4}:){2,7}[A-Fa-f0-9]{1,4}\b/g,mask:()=>"[REDACTED IPv6]",default:!1,tags:["network"]},{id:"mac_address",label:"MAC address",why:"A hardware address that can identify a device.",pattern:/\b(?:[A-Fa-f0-9]{2}:){5}[A-Fa-f0-9]{2}\b/g,mask:()=>"**:**:**:**:**:**",default:!1,tags:["network"]},{id:"high_entropy",label:"High-entropy string",why:"A long random-looking token \u2014 likely a key even if its format is unknown.",pattern:/\b[A-Za-z0-9+/=_-]{20,80}\b/g,validate:e=>$e(e)>=3.5,mask:A(4),default:!1,tags:["secret"],refine:!0},{id:"person_name",label:"Person name",why:"A person name appearing after an explicit identity label.",pattern:/(?:full[ _-]?name|customer[ _-]?name|contact[ _-]?name|name|ad[ıi]|isim|nombre|nom|nome|姓名|الاسم)\s*(?:[:=]|\bis\b)\s*["']?([\p{L}][\p{L}'’.-]{1,39}(?:\s+[\p{L}][\p{L}'’.-]{1,39}){1,3})/giu,capture:1,mask:()=>"[REDACTED PERSON]",default:!1,tags:["pii","contextual"],risk:"high",confidence:.86,priority:60},{id:"street_address",label:"Street address",why:"A street address appearing after an explicit address label.",pattern:/(?:street[ _-]?address|postal[ _-]?address|shipping[ _-]?address|address|ünvan|adres|dirección|adresse|indirizzo|地址|العنوان)\s*[:=]\s*["']?(\d{1,6}\s+[\p{L}0-9.'’ -]{2,60}\s+(?:street|st|road|rd|avenue|ave|boulevard|blvd|lane|ln|drive|dr|way|küçəsi|küçe|sokak|cadde))/giu,capture:1,mask:()=>"[REDACTED ADDRESS]",default:!1,tags:["pii","contextual"],risk:"high",confidence:.9,priority:65},{id:"date_of_birth",label:"Date of birth",why:"A birth date is a strong quasi-identifier when linked to a person.",pattern:/(?:date[ _-]?of[ _-]?birth|birth[ _-]?date|dob|doğum[ _-]?tarixi|fecha[ _-]?de[ _-]?nacimiento|date[ _-]?de[ _-]?naissance|出生日期)\s*[:=]\s*["']?((?:19|20)\d{2}[-/.](?:0?[1-9]|1[0-2])[-/.](?:[12]\d|3[01]|0?[1-9])|(?:[12]\d|3[01]|0?[1-9])[-/.](?:0?[1-9]|1[0-2])[-/.](?:19|20)\d{2})/giu,capture:1,mask:()=>"[REDACTED DOB]",default:!1,tags:["pii","contextual"],risk:"high",confidence:.96,priority:70},...Pe,...Ve];var vt=new Uint32Array([1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298]),Q=new TextEncoder;function E(e,t){return e>>>t|e<<32-t}function X(e){let t=typeof e=="string"?Q.encode(e):e,r=t.length*8,a=Math.ceil((t.length+9)/64)*64,s=new Uint8Array(a);s.set(t),s[t.length]=128;let n=new DataView(s.buffer),c=Math.floor(r/4294967296),u=r>>>0;n.setUint32(a-8,c,!1),n.setUint32(a-4,u,!1);let o=new Uint32Array([1779033703,3144134277,1013904242,2773480762,1359893119,2600822924,528734635,1541459225]),i=new Uint32Array(64);for(let d=0;d<a;d+=64){for(let w=0;w<16;w++)i[w]=n.getUint32(d+w*4,!1);for(let w=16;w<64;w++){let T=i[w-15],z=i[w-2],j=E(T,7)^E(T,18)^T>>>3,W=E(z,17)^E(z,19)^z>>>10;i[w]=i[w-16]+j+i[w-7]+W>>>0}let f=o[0],h=o[1],m=o[2],g=o[3],y=o[4],S=o[5],x=o[6],v=o[7];for(let w=0;w<64;w++){let T=E(y,6)^E(y,11)^E(y,25),z=y&S^~y&x,j=v+T+z+vt[w]+i[w]>>>0,W=E(f,2)^E(f,13)^E(f,22),lt=f&h^f&m^h&m,dt=W+lt>>>0;v=x,x=S,S=y,y=g+j>>>0,g=m,m=h,h=f,f=j+dt>>>0}o[0]=o[0]+f>>>0,o[1]=o[1]+h>>>0,o[2]=o[2]+m>>>0,o[3]=o[3]+g>>>0,o[4]=o[4]+y>>>0,o[5]=o[5]+S>>>0,o[6]=o[6]+x>>>0,o[7]=o[7]+v>>>0}let l=new Uint8Array(32),p=new DataView(l.buffer);for(let d=0;d<o.length;d++)p.setUint32(d*4,o[d],!1);return l}function je(e,t){let r=typeof e=="string"?Q.encode(e):e,a=typeof t=="string"?Q.encode(t):t;r.length>64&&(r=X(r));let s=new Uint8Array(64);s.set(r);let n=new Uint8Array(64),c=new Uint8Array(64);for(let l=0;l<64;l++)n[l]=s[l]^54,c[l]=s[l]^92;let u=new Uint8Array(n.length+a.length);u.set(n),u.set(a,n.length);let o=X(u),i=new Uint8Array(c.length+o.length);return i.set(c),i.set(o,c.length),X(i)}function Rt(e){let t="";for(let r of e)t+=r.toString(16).padStart(2,"0");return t}function P(e,t,r=16){if(!e)throw new Error("A non-empty transformSecret is required for deterministic protected transforms.");return Rt(je(e,t).subarray(0,r))}function O(e,t,r){if(!e)throw new Error("A non-empty transformSecret is required for deterministic protected transforms.");let a=new Uint8Array(r),s=0,n=0;for(;s<r;){let c=je(e,`${t}\0${n++}`),u=Math.min(c.length,r-s);a.set(c.subarray(0,u),s),s+=u}return a}var Ct="abcdefghijklmnopqrstuvwxyz",Dt="ABCDEFGHIJKLMNOPQRSTUVWXYZ",Be="0123456789",Le=["Alex","Avery","Casey","Emery","Jordan","Morgan","Riley","Robin"],Ue=["Arden","Blake","Hayes","Lane","Parker","Reed","Shaw","Vale"],Fe=["Cedar","Harbor","Juniper","Maple","Orchard","River","Willow","Summit"];function It(e){if(e>="0"&&e<="9")return Be;if(e>="a"&&e<="z")return Ct;if(e>="A"&&e<="Z")return Dt}function V(e,t){let r=O(t,`pseudonym:${e}`,e.length),a="";for(let s=0;s<e.length;s++){let n=It(e[s]);a+=n?n[r[s]%n.length]:e[s]}return a}function Nt(e,t){return V(e,t)}function Ke(e,t){let r=O(t,`digits:${e}`,e.length),a="";for(let s=0;s<e.length;s++)a+=/\d/.test(e[s])?Be[r[s]%10]:e[s];return a}function Tt(e){let t=e.replace(/\D/g,""),r=0,a=!0;for(let s=t.length-1;s>=0;s--){let n=Number(t[s]);a&&(n*=2,n>9&&(n-=9)),r+=n,a=!a}return String((10-r%10)%10)}function zt(e,t){let r=Ke(e,t),a=r.search(/\d(?=\D*$)/);if(a<0)return r;let s=r.slice(0,a);return s+Tt(s)+r.slice(a+1)}function Pt(e,t){return`user_${P(t,`email:${e}`,6)}@example.invalid`}function Ot(e,t){let r=O(t,`person:${e}`,2);return`${Le[r[0]%Le.length]} ${Ue[r[1]%Ue.length]}`}function Vt(e,t){let r=O(t,`address:${e}`,3);return`${100+(r[0]<<8|r[1])%9800} ${Fe[r[2]%Fe.length]} Street`}function ee(e,t,r){switch(t.id){case"email":return Pt(e,r);case"credit_card":return zt(e,r);case"phone":return Ke(e,r);case"person_name":return Ot(e,r);case"street_address":return Vt(e,r);default:return V(e,r)}}var Zt=e=>e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");function Mt(e){return e?(Array.isArray(e)?e.map(r=>typeof r=="string"?{term:r}:r):Object.entries(e).map(([r,a])=>({term:r,replace:a}))).filter(r=>r.term&&r.term.length>0):[]}function Ge(e,t=!1){let r=Mt(e);if(!r.length)return null;let a=[...r].sort((o,i)=>i.term.length-o.term.length).map(o=>Zt(o.term)).join("|"),s=t?"gu":"giu",n=new RegExp(`(?<![\\p{L}\\p{N}_])(?:${a})(?![\\p{L}\\p{N}_])`,s),c=o=>t?o:o.toLowerCase(),u=new Map(r.map(o=>[c(o.term),o.replace??"***"]));return{id:"custom_term",label:"Custom term",why:"A term you configured as sensitive.",pattern:n,mask:o=>u.get(c(o))??"***",default:!0,tags:["custom"]}}var U={version:1,features:["log2Len","entropy","fracLower","fracUpper","fracDigit","fracSymbol","fracHex","vowelFrac","classTransitionRate","hasMixedClasses","maxRunFrac","structuredHexId","ctxSecret","ctxBenign"],weights:[2.712748,3.920866,-5.874776,5.484371,1.346649,-9.662469,-.058102,8.500786,2.714721,-.676255,-3.0573,-6.969532,5.6429,-5.446436],bias:-29.559382};var qe=["log2Len","entropy","fracLower","fracUpper","fracDigit","fracSymbol","fracHex","vowelFrac","classTransitionRate","hasMixedClasses","maxRunFrac","structuredHexId","ctxSecret","ctxBenign"],te=qe.length,$t=/\b(secret|api[_-]?key|apikey|token|password|passwd|pwd|auth|authorization|bearer|access[_-]?key|private[_-]?key|client[_-]?secret|credential|signing[_-]?key)\b/i,jt=/\b(uuid|guid|sha1|sha256|sha512|md5|hash|digest|etag|checksum|commit|revision|request[_-]?id|trace[_-]?id|correlation[_-]?id|span[_-]?id|object[_-]?id|content[_-]?id|version|colou?r|slug|filename)\b/i,Lt=/^(?:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|[0-9a-f]{24}|[0-9a-f]{32}|[0-9a-f]{40}|[0-9a-f]{64})$/i;function He(e){let t=new Map,r=0;for(let s of e)t.set(s,(t.get(s)??0)+1),r++;if(r===0)return 0;let a=0;for(let s of t.values()){let n=s/r;a-=n*Math.log2(n)}return a}function We(e,t=""){let r=e.length||1,a=0,s=0,n=0,c=0,u=0,o=0,i=0,l=0,p=1,d=1,f=-1;for(let m=0;m<e.length;m++){let g=e.charCodeAt(m);g>=97&&g<=122?(a++,i++):g>=65&&g<=90?(s++,i++):g>=48&&g<=57?n++:c++,(g>=48&&g<=57||g>=97&&g<=102||g>=65&&g<=70)&&u++,(g===97||g===101||g===105||g===111||g===117||g===65||g===69||g===73||g===79||g===85)&&o++;let y=g>=48&&g<=57?1:g>=97&&g<=122||g>=65&&g<=90?0:2;f===-1||(y!==f?(l++,p=1):p++,p>d&&(d=p)),f=y}let h=new Array(te).fill(0);return h[0]=Math.log2(r),h[1]=He(e),h[2]=a/r,h[3]=s/r,h[4]=n/r,h[5]=c/r,h[6]=u/r,h[7]=i?o/i:0,h[8]=r>1?l/(r-1):0,h[9]=a>0&&s>0&&n>0?1:0,h[10]=d/r,h[11]=Lt.test(e)?1:0,h[12]=$t.test(t)?1:0,h[13]=jt.test(t)?1:0,h}var Ut=e=>e>=0?1/(1+Math.exp(-e)):Math.exp(e)/(1+Math.exp(e));function re(e,t="",r=U){let a=We(e,t),s=r.bias;for(let n=0;n<te;n++)s+=(r.weights[n]??0)*a[n];return Ut(s)}var F=class extends Error{constructor(t,r){super(r),this.name="FlareRedactError",this.code=t}},C=class extends F{constructor(t){super("ERR_REDACTION_LIMIT",t),this.name="RedactionLimitError"}};function ae(e,t){return t.id===e||(t.tags?.includes(e)??!1)}function B(e){let t=e.custom?.length?[...L,...e.custom]:L,r;if(e.only?.length)r=t.filter(s=>e.only.some(n=>ae(n,s)));else{let{enable:s,disable:n}=e;r=t.filter(c=>{let u=c.default||(s?.some(i=>ae(i,c))??!1),o=n?.some(i=>ae(i,c))??!1;return u&&!o})}let a=Ge(e.terms,e.termsCaseSensitive);return a?[a,...r]:r}function K(e){let t=e.redactKeys;if(t===!1)return()=>!1;if(t instanceof RegExp)return r=>(t.lastIndex=0,t.test(r));if(Array.isArray(t)){let r=new Set(t.map(a=>a.toLowerCase()));return a=>r.has(a.toLowerCase())}return r=>Y.test(r)||ge.has(r.toLowerCase())}function G(e){let t=e.allow;if(!t)return()=>!1;if(t instanceof RegExp)return a=>(t.lastIndex=0,t.test(a));let r=new Set(t);return a=>r.has(a)}function Je(e){let t=e.transformSecret??e.hashSalt??"",r=e.mask,a=e.mode??"mask";return typeof r=="string"?()=>r:typeof r=="function"?(s,n)=>r({value:s,detector:n}):a==="label"?(s,n)=>`[REDACTED:${n.id}]`:a==="hash"?(s,n)=>`${n.id}_${P(t,s)}`:a==="pseudonym"||a==="fpe"?s=>V(s,t):a==="surrogate"?(s,n)=>ee(s,n,t):(s,n)=>n.mask?n.mask(s):"***"}function Ft(e){return e.flags.includes("g")?e:new RegExp(e.source,e.flags+"g")}function Bt(e){if(!/[\u200B\u200C\u200D\u2060\uFEFF]/.test(e))return{text:e};let t="",r=[];for(let a=0;a<e.length;a++){let s=e.charCodeAt(a);s===8203||s===8204||s===8205||s===8288||s===65279||(t+=e[a],r.push(a))}return{text:t,sourceIndex:r}}function D(e,t,r,a={}){let s=a.limits?.maxInputLength??16777216,n=a.limits?.maxFindings??5e4;if(e.length>s)throw new C(`Input length ${e.length} exceeds the configured limit of ${s}.`);let c=Bt(e),u=c.text,o=[];for(let i of t){if(i.prefilter&&!i.prefilter.some(d=>u.toLowerCase().includes(d.toLowerCase())))continue;let l=Ft(i.pattern);l.lastIndex=0;let p;for(;(p=l.exec(u))!==null;){p.index===l.lastIndex&&l.lastIndex++;let f=(i.capture===void 0?p[0]:p[i.capture])??"";if(!f||i.validate&&!i.validate(f))continue;let h=i.capture===void 0?0:p[0].indexOf(f);if(h<0)continue;let m=p.index+h,g=m+f.length,y=c.sourceIndex?.[m]??m,S=c.sourceIndex?(c.sourceIndex[g-1]??g-1)+1:g,x=e.slice(y,S);if(r(x)||x!==f&&r(f))continue;let v=Ht(i,e,y,S,a);if(!(v<(a.minConfidence??0))&&(o.push({detector:i.id,label:i.label,why:i.why,value:x,start:y,end:S,risk:Gt(i),confidence:v,det:i}),o.length>n))throw new C(`Finding count exceeds the configured limit of ${n}.`)}}if(a.semanticProvider){let i=a.semanticProvider.detect(e);if(!Array.isArray(i))throw new TypeError("Semantic provider is asynchronous; use scanAsync() or redactAsync().");for(let l of i){if(!Number.isInteger(l.start)||!Number.isInteger(l.end)||l.start<0||l.end<=l.start||l.end>e.length)throw new TypeError(`Semantic provider returned an invalid span for ${l.detector}.`);let p=e.slice(l.start,l.end);if(r(p)||(l.confidence??.8)<(a.minConfidence??0))continue;let d={id:l.detector,label:l.label,why:l.why,pattern:/(?!)/,default:!1,risk:l.risk??"high",confidence:l.confidence??.8};if(o.push({...l,value:p,risk:d.risk,confidence:d.confidence,det:d}),o.length>n)throw new C(`Finding count exceeds the configured limit of ${n}.`)}}return o.length<2?o:Kt(o)}function Kt(e){let t=[...e].sort((n,c)=>n.end-c.end||n.start-c.start),r=[];for(let n=0;n<t.length;n++){let c=0,u=n-1,o=-1;for(;c<=u;){let i=c+u>>>1;t[i].end<=t[n].start?(o=i,c=i+1):u=i-1}r[n]=o}let a=new Array(t.length+1).fill(0);for(let n=1;n<=t.length;n++){let c=Ye(t[n-1])+a[r[n-1]+1];a[n]=Math.max(a[n-1],c)}let s=[];for(let n=t.length;n>0;){let c=t[n-1];Ye(c)+a[r[n-1]+1]>a[n-1]?(s.push(c),n=r[n-1]+1):n--}return s.reverse().sort((n,c)=>n.start-c.start||n.end-c.end)}function Ye(e){return(e.risk==="critical"?1e9:e.risk==="high"?1e6:e.risk==="medium"?1e3:1)+(e.det.priority??0)*10+e.confidence+(e.end-e.start)/1e6}function Gt(e){return e.risk?e.risk:e.tags?.includes("secret")||/(?:token|key|auth|credential|password|seed_phrase)/.test(e.id)?"critical":e.tags?.includes("pii")||/(?:email|phone|card|ssn|iban|person|address|dob)/.test(e.id)?"high":e.tags?.includes("network")?"medium":"high"}var qt=.4;function Ht(e,t,r,a,s={}){let n=e.confidence??(e.id==="high_entropy"?.6:e.validate?.99:.92);if(e.context){let c=e.context.window??80,u=t.slice(Math.max(0,r-c),Math.min(t.length,a+c));e.context.positive&&(e.context.positive.lastIndex=0,e.context.positive.test(u)&&(n+=.06)),e.context.negative&&(e.context.negative.lastIndex=0,e.context.negative.test(u)&&(n-=.25))}if(s.refineConfidence&&e.refine){let c=t.slice(Math.max(0,r-64),Math.min(t.length,a+64)),u=re(t.slice(r,a),c);n+=(u-.5)*qt}return Math.max(0,Math.min(1,n))}function R(e,t,r,a,s={}){let n=D(e,t,r,s);if(!n.length)return e;let c="",u=0;for(let o of n)c+=e.slice(u,o.start),c+=a(o.value,o.det),u=o.end;return c+e.slice(u)}function Wt(e){return e instanceof Date||e instanceof RegExp||e instanceof Promise||e instanceof WeakMap||e instanceof WeakSet||e instanceof ArrayBuffer||ArrayBuffer.isView(e)}function Z(e,t,r){let a=new WeakMap,s=n=>{if(typeof n=="string")return t(n);if(!n||typeof n!="object")return n;let c=a.get(n);if(c!==void 0)return c;if(n instanceof Error){let o=Object.create(Object.getPrototypeOf(n));return a.set(n,o),Object.defineProperties(o,{name:{value:n.name,writable:!0,configurable:!0},message:{value:t(n.message),writable:!0,configurable:!0},...typeof n.stack=="string"?{stack:{value:t(n.stack),writable:!0,configurable:!0}}:{}}),ne(n,o,s,r),o}if(n instanceof URL){let o=new URL(t(n.toString()));return a.set(n,o),o}if(n instanceof URLSearchParams){let o=new URLSearchParams(t(n.toString()));return a.set(n,o),o}if(Wt(n))return n;if(n instanceof Map){let o=new Map;a.set(n,o);for(let[i,l]of n)o.set(s(i),s(l));return o}if(n instanceof Set){let o=new Set;a.set(n,o);for(let i of n)o.add(s(i));return o}if(Array.isArray(n)){let o=new Array(n.length);a.set(n,o);for(let i=0;i<n.length;i++)Object.prototype.hasOwnProperty.call(n,i)&&(o[i]=s(n[i]));return ne(n,o,s,r,new Set(["length",...Object.keys(n).filter(i=>/^\d+$/.test(i))])),o}let u=Object.create(Object.getPrototypeOf(n));return a.set(n,u),ne(n,u,s,r),u};return s(e)}function ne(e,t,r,a,s=new Set){for(let n of Reflect.ownKeys(e)){if(s.has(n))continue;let c=Object.getOwnPropertyDescriptor(e,n);if(!c?.enumerable||!("value"in c))continue;let u=c.value,o=typeof n=="string"&&typeof u=="string"&&a?a(n,u):r(u);Object.defineProperty(t,n,{...c,value:o})}}var Yt=e=>e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");function Jt(){let e=globalThis.crypto;if(!e?.getRandomValues)throw new Error("Web Crypto is required to create opaque vault placeholders.");let t=e.getRandomValues(new Uint8Array(12)),r="";for(let a of t)r+=a.toString(16).padStart(2,"0");return r}function q(e){if(!e.length)return s=>s;let t=[...e].sort((s,n)=>n[0].length-s[0].length),r=new Map(t),a=new RegExp(t.map(([s])=>Yt(s)).join("|"),"g");return s=>s.replace(a,n=>r.get(n)??n)}function se(e){let t=q(e),r=e.map(([n])=>n),a="",s=()=>{let n=0;for(let c of r){let u=Math.min(a.length,c.length-1);for(let o=u;o>n;o--)if(a.endsWith(c.slice(0,o))){n=o;break}}return n};return{push(n){a+=n;let c=s(),u=a.length-c,o=a.slice(0,u);return a=a.slice(u),t(o)},flush(){let n=t(a);return a="",n}}}function Xe(e,t){return Z(e,t)}function Xt(e,t,r,a,s){return Z(e,t,(n,c)=>r(n)&&!a(c)?s(c,"sensitive_key"):t(c))}function I(e={}){let t=B(e),r=G(e),a=K(e),s=e.placeholder??(e.placeholderStyle==="readable"?((l,p)=>`[${l.toUpperCase()}_${p}]`):(l=>`[FR_${l.toUpperCase()}_${Jt()}]`)),n=new Map,c=new Map,u=new Map,o=(l,p)=>{let d=n.get(l);if(d)return d;let f=(u.get(p)??0)+1;u.set(p,f);let h=s(p,f),m=c.get(h);if(m!==void 0&&m!==l)throw new Error(`Placeholder generator produced a duplicate token for ${p}.`);return n.set(l,h),c.set(h,l),h},i=l=>{let p=D(l,t,r,e);if(!p.length)return l;let d="",f=0;for(let h of p)d+=l.slice(f,h.start),d+=o(h.value,h.det.id),f=h.end;return d+l.slice(f)};return{redact:l=>Xt(l,i,a,r,o),restore:l=>Xe(l,q([...c])),entries:()=>[...c],get size(){return c.size}}}function Qt(e,t){let r=t instanceof Map?[...t]:typeof t.entries=="function"?t.entries():Object.entries(t);return r.length?Xe(e,q(r)):e}var de=new TextEncoder,er=new TextDecoder,Qe=de.encode("flare-redact-vault:v1"),M="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/",ce=1e5,le=2e6;function ue(){let e=globalThis.crypto;if(!e?.subtle||!e.getRandomValues)throw new Error("Web Crypto is required for encrypted vault persistence.");return e}function ie(e){let t="";for(let r=0;r<e.length;r+=3){let a=e[r],s=e[r+1],n=e[r+2];t+=M[a>>>2],t+=M[(a&3)<<4|(s??0)>>>4],t+=s===void 0?"=":M[(s&15)<<2|(n??0)>>>6],t+=n===void 0?"=":M[n&63]}return t}function oe(e){if(!/^[A-Za-z0-9+/]*={0,2}$/.test(e)||e.length%4!==0)throw new Error("Encrypted vault contains invalid base64 data.");let t=e.replace(/=+$/,""),r=[],a=0,s=0;for(let n of t){let c=M.indexOf(n);if(c<0)throw new Error("Encrypted vault contains invalid base64 data.");a=a<<6|c,s+=6,s>=8&&(s-=8,r.push(a>>>s&255))}return new Uint8Array(r)}async function et(e,t,r,a){let s=ue(),n=await s.subtle.importKey("raw",de.encode(e),"PBKDF2",!1,["deriveKey"]);return s.subtle.deriveKey({name:"PBKDF2",hash:"SHA-256",salt:t,iterations:r},n,{name:"AES-GCM",length:256},!1,a)}function tt(e){if(e.length<12)throw new Error("Vault password must contain at least 12 characters.")}function tr(e){return Array.isArray(e)?e:e.entries()}async function rr(e,t,r={}){tt(t);let a=r.iterations??31e4;if(!Number.isInteger(a)||a<ce||a>le)throw new Error(`PBKDF2 iterations must be an integer from ${ce} to ${le}.`);let s=ue(),n=s.getRandomValues(new Uint8Array(16)),c=s.getRandomValues(new Uint8Array(12)),u=await et(t,n,a,["encrypt"]),o=de.encode(JSON.stringify({entries:tr(e)})),i=await s.subtle.encrypt({name:"AES-GCM",iv:c,additionalData:Qe,tagLength:128},u,o);return{format:"flare-redact-vault",version:1,kdf:{name:"PBKDF2",hash:"SHA-256",iterations:a,salt:ie(n)},cipher:{name:"AES-GCM",iv:ie(c)},ciphertext:ie(new Uint8Array(i))}}function rt(e){if(!e||typeof e!="object")return!1;let t=e;if(t.format!=="flare-redact-vault"||t.version!==1||!t.kdf||typeof t.kdf!="object"||!t.cipher||typeof t.cipher!="object")return!1;let r=t.kdf,a=t.cipher;return r.name==="PBKDF2"&&r.hash==="SHA-256"&&typeof r.iterations=="number"&&typeof r.salt=="string"&&a.name==="AES-GCM"&&typeof a.iv=="string"&&typeof t.ciphertext=="string"}async function ar(e,t){if(tt(t),!rt(e))throw new Error("Not a supported encrypted flare-redact vault.");if(e.kdf.name!=="PBKDF2"||e.kdf.hash!=="SHA-256"||e.cipher.name!=="AES-GCM")throw new Error("Encrypted vault uses unsupported cryptographic parameters.");if(!Number.isInteger(e.kdf.iterations)||e.kdf.iterations<ce||e.kdf.iterations>le)throw new Error("Encrypted vault uses an unsafe PBKDF2 work factor.");try{let r=oe(e.kdf.salt),a=oe(e.cipher.iv);if(r.length!==16||a.length!==12)throw new Error("invalid parameters");let s=await et(t,r,e.kdf.iterations,["decrypt"]),n=await ue().subtle.decrypt({name:"AES-GCM",iv:a,additionalData:Qe,tagLength:128},s,oe(e.ciphertext)),c=JSON.parse(er.decode(n));if(!Array.isArray(c.entries))throw new Error("invalid payload");let u=[],o=new Set;for(let i of c.entries){if(!Array.isArray(i)||i.length!==2||typeof i[0]!="string"||typeof i[1]!="string")throw new Error("invalid payload");if(o.has(i[0]))throw new Error("invalid payload");o.add(i[0]),u.push([i[0],i[1]])}return u}catch{throw new Error("Could not decrypt vault: wrong password or corrupted file.")}}function nr(e={}){let t=I(e);return{redact:r=>t.redact(r),restore:r=>t.restore(r),redactMessages:r=>t.redact(r),stream(){return se(t.entries())},get vault(){return t},get size(){return t.size},reset(){t=I(e)}}}function $(e){return{opts:e,dets:B(e),allow:G(e),replace:Je(e),matchKey:K(e)}}function at(e,t){let{opts:r,dets:a,allow:s,replace:n,matchKey:c}=t;return Z(e,u=>R(u,a,s,n,r),(u,o)=>c(u)&&!s(o)?n(o,J):R(o,a,s,n,r))}function sr(e,t={}){return at(e,$(t))}async function N(e,t){if(!t.semanticProvider)return t;let r=await t.semanticProvider.detect(e);return{...t,semanticProvider:{detect:()=>r}}}async function nt(e,t){let{opts:r,dets:a,allow:s,replace:n,matchKey:c}=t,u=new WeakMap,o=async i=>{if(typeof i=="string"){let d=await N(i,r);return R(i,a,s,n,d)}if(!i||typeof i!="object")return i;let l=u.get(i);if(l!==void 0)return l;if(i instanceof Error){let d=Object.create(Object.getPrototypeOf(i));u.set(i,d),Object.defineProperties(d,{name:{value:i.name,writable:!0,configurable:!0},message:{value:R(i.message,a,s,n,await N(i.message,r)),writable:!0,configurable:!0},...typeof i.stack=="string"?{stack:{value:R(i.stack,a,s,n,await N(i.stack,r)),writable:!0,configurable:!0}}:{}});for(let f of Reflect.ownKeys(i)){let h=Object.getOwnPropertyDescriptor(i,f);!h?.enumerable||!("value"in h)||Object.defineProperty(d,f,{...h,value:await o(h.value)})}return d}if(i instanceof URL){let d=await N(i.toString(),r),f=new URL(R(i.toString(),a,s,n,d));return u.set(i,f),f}if(i instanceof URLSearchParams){let d=await N(i.toString(),r),f=new URLSearchParams(R(i.toString(),a,s,n,d));return u.set(i,f),f}if(i instanceof Map){let d=new Map;u.set(i,d);for(let[f,h]of i)d.set(await o(f),await o(h));return d}if(i instanceof Set){let d=new Set;u.set(i,d);for(let f of i)d.add(await o(f));return d}if(i instanceof Date||i instanceof RegExp||i instanceof ArrayBuffer||ArrayBuffer.isView(i))return i;let p=Array.isArray(i)?new Array(i.length):Object.create(Object.getPrototypeOf(i));u.set(i,p);for(let d of Reflect.ownKeys(i)){if(Array.isArray(i)&&d==="length")continue;let f=Object.getOwnPropertyDescriptor(i,d);if(!f?.enumerable||!("value"in f))continue;let h=f.value,m=typeof d=="string"&&typeof h=="string"&&c(d)&&!s(h)?n(h,J):await o(h);Object.defineProperty(p,d,{...f,value:m})}return p};return o(e)}async function Gr(e,t={}){return nt(e,$(t))}function H(e,t){let{opts:r,dets:a,allow:s,matchKey:n}=t,c=[],u=new WeakSet,o=(l,p,d)=>{let{det:f,...h}=l,m=r.includeValues?h:it(h);c.push(d?{...m,...p,path:d}:{...m,...p})},i=(l,p)=>{if(typeof l=="string"){let d=D(l,a,s,r),f=0,h=1,m=0;for(let g of d){let y=g.start??0;for(;f<y;)l.charCodeAt(f)===10&&(h++,m=f+1),f++;o(g,{line:h,column:y-m+1},p||void 0)}}else if(l&&typeof l=="object"){if(u.has(l))return;if(u.add(l),l instanceof Error&&i(l.message,p?`${p}.message`:"message"),l instanceof URL||l instanceof URLSearchParams){i(l.toString(),p);return}if(l instanceof Map){let d=0;for(let[f,h]of l)i(f,`${p}.<map-key:${d}>`),i(h,`${p}.<map-value:${d}>`),d++;return}if(l instanceof Set){let d=0;for(let f of l)i(f,`${p}[${d++}]`);return}if(l instanceof Date||l instanceof RegExp||l instanceof ArrayBuffer||ArrayBuffer.isView(l))return}if(Array.isArray(l))l.forEach((d,f)=>i(d,`${p}[${f}]`));else if(l&&typeof l=="object")for(let d of Reflect.ownKeys(l)){let f=Object.getOwnPropertyDescriptor(l,d);if(!f?.enumerable||!("value"in f))continue;let h=f.value,m=typeof d=="symbol"?`[${String(d)}]`:d,g=p?`${p}.${m}`:m;typeof d=="string"&&typeof h=="string"&&n(d)&&!s(h)?c.push({detector:"sensitive_key",label:"Sensitive field",why:`Value stored under a sensitive field name ("${d}").`,...r.includeValues?{value:h}:{},path:g,risk:"critical",confidence:.98}):i(h,g)}};return i(e,""),c}function st(e,t={}){return H(e,$(t))}function it(e){let{value:t,...r}=e;return r}async function fe(e,t){let{opts:r,dets:a,allow:s,matchKey:n}=t,c=[],u=new WeakSet,o=async(i,l)=>{if(typeof i=="string"){let p=await N(i,r),d=D(i,a,s,p),f=0,h=1,m=0;for(let g of d){let y=g.start??0;for(;f<y;)i.charCodeAt(f)===10&&(h++,m=f+1),f++;let{det:S,...x}=g,v={...r.includeValues?x:it(x),line:h,column:y-m+1};c.push(l?{...v,path:l}:v)}}else if(i&&typeof i=="object"){if(u.has(i))return;if(u.add(i),i instanceof Error&&await o(i.message,l?`${l}.message`:"message"),i instanceof URL||i instanceof URLSearchParams){await o(i.toString(),l);return}if(i instanceof Map){let p=0;for(let[d,f]of i)await o(d,`${l}.<map-key:${p}>`),await o(f,`${l}.<map-value:${p}>`),p++;return}if(i instanceof Set){let p=0;for(let d of i)await o(d,`${l}[${p++}]`);return}if(i instanceof Date||i instanceof RegExp||i instanceof ArrayBuffer||ArrayBuffer.isView(i))return}if(Array.isArray(i))for(let p=0;p<i.length;p++)await o(i[p],`${l}[${p}]`);else if(i&&typeof i=="object")for(let p of Reflect.ownKeys(i)){let d=Object.getOwnPropertyDescriptor(i,p);if(!d?.enumerable||!("value"in d))continue;let f=d.value,h=typeof p=="symbol"?`[${String(p)}]`:p,m=l?`${l}.${h}`:h;typeof p=="string"&&typeof f=="string"&&n(p)&&!s(f)?c.push({detector:"sensitive_key",label:"Sensitive field",why:`Value stored under a sensitive field name ("${p}").`,...r.includeValues?{value:f}:{},path:m,risk:"critical",confidence:.98}):await o(f,m)}};return await o(e,""),c}async function ir(e,t={}){return fe(e,$(t))}async function qr(e,t={}){return(await ir(e,t)).length===0}function Hr(e,t={}){return st(e,t).length===0}function Wr(e,t={}){return ot(st(e,t))}function ot(e){let t={},r={};for(let a of e)t[a.detector]=(t[a.detector]??0)+1,r[a.risk]=(r[a.risk]??0)+1;return{total:e.length,byDetector:t,byRisk:r}}function ct(e={}){let t=$(e);return{options:e,redact:r=>at(r,t),redactAsync:r=>nt(r,t),scan:r=>H(r,t),scanAsync:r=>fe(r,t),isClean:r=>H(r,t).length===0,isCleanAsync:async r=>(await fe(r,t)).length===0,summary:r=>ot(H(r,t)),vault:()=>I(e),wrapConsole:r=>or(e,r)}}var Yr=ct,Jr=ct;function or(e={},t=console){let r=t,a=["log","info","warn","error","debug"],s=new Map;for(let n of a){let c=r[n].bind(t);s.set(n,c),r[n]=(...u)=>c(...u.map(o=>sr(o,e)))}return()=>{for(let[n,c]of s)r[n]=c}}export{U as CONFIDENCE_MODEL,L as DETECTORS,qe as FEATURES,te as FEATURE_COUNT,F as FlareRedactError,C as RedactionLimitError,Y as SENSITIVE_KEY_RE,q as buildRestore,se as buildStreamRestore,ct as compilePolicy,Yr as createRedactor,nr as createSession,I as createVault,Jr as definePolicy,$e as entropy,We as extractFeatures,Et as fnv1a,Nt as fpe,P as hmacFingerprint,Hr as isClean,qr as isCleanAsync,rt as isSealedVault,Ze as keepLast,A as keepPrefix,Me as luhn,ar as openVault,V as pseudonymize,sr as redact,Gr as redactAsync,Qt as restore,st as scan,ir as scanAsync,rr as sealVault,re as secretProbability,He as shannonEntropy,Wr as summary,ee as surrogate,or as wrapConsole};
diff --git a/package.json b/package.json
index e75202d..0113961 100644
--- a/package.json
+++ b/package.json
@@ -73,7 +73,8 @@
     "benchmark": "npm run build && node bench/performance.mjs",
     "benchmark:adversarial": "npm run build && node bench/adversarial-runtime.mjs",
     "prepublishOnly": "npm run build",
-    "benchmark:graph": "npm run build && node bench/graph-vault.mjs"
+    "benchmark:graph": "npm run build && node bench/graph-vault.mjs",
+    "build:playground": "npm run build && npx --yes esbuild dist/index.js --bundle --format=esm --minify --outfile=docs/playground/flare-redact.min.js"
   },
   "keywords": [
     "redact",