Skip to main content

session.tokenize()

Detects secrets in code and replaces them with tokens.

Signature

session.tokenize(content: string, filename: string): TokenizeResult

Parameters

ParameterTypeDescription
contentstringThe source code to tokenize
filenamestringFilename (affects parsing; e.g., .env vs .ts)

Returns

interface TokenizeResult {
  content: string;         // Code with secrets replaced by tokens
  detections: Detection[]; // What was found
  tokenCount: number;      // Number of unique tokens created
}

interface Detection {
  type: string;      // e.g., 'aws-access-key', 'database-url'
  category: string;  // e.g., 'KEY', 'CONN', 'SECRET'
  line: number;      // 1-indexed
  column: number;    // 1-indexed
  length: number;    // Length of the original secret
  token: string;     // The token that replaced it
}
Note: The original secret value is intentionally not included in Detection.

Example

const session = createSession();

const code = `
const config = {
  apiKey: "sk_test_EXAMPLEKEY123456",
  dbUrl: "postgres://admin:examplepass@prod:5432/app"
};
`;

const result = session.tokenize(code, 'config.ts');

console.log(result.content);
// const config = {
//   apiKey: "__TAKUMO_v1_KEY_a1b2c3d4__",
//   dbUrl: "__TAKUMO_v1_CONN_e5f6g7h8__"
// };

console.log(result.detections);
// [
//   { type: 'stripe-secret-key', category: 'KEY', line: 3, column: 11, ... },
//   { type: 'database-url', category: 'CONN', line: 4, column: 10, ... }
// ]

console.log(result.tokenCount);
// 2

Filename matters

The filename determines how content is parsed:
// Parsed as TypeScript
session.tokenize(code, 'config.ts');

// Parsed as environment file (KEY=VALUE format)
session.tokenize(envContent, '.env');
session.tokenize(envContent, '.env.production');

// Parsed as YAML
session.tokenize(yamlContent, 'config.yaml');

// Parsed as JSON
session.tokenize(jsonContent, 'secrets.json');

Deterministic tokens

Same secret → same token (within a session):
const code = `
const password1 = "hunter2";
const password2 = "hunter2";  // Same value
const password3 = "different";
`;

const result = session.tokenize(code, 'test.ts');

// password1 and password2 have the SAME token
// password3 has a DIFFERENT token
This preserves semantic relationships for the AI.

No secrets? No problem

If no secrets are found, you just get the original code back:
const result = session.tokenize('const x = 1 + 2;', 'math.ts');

console.log(result.content);      // 'const x = 1 + 2;'
console.log(result.detections);   // []
console.log(result.tokenCount);   // 0