@cogenta/core 0.1.0

package/dist/errors/codes.js

@@ -0,0 +1,201 @@
+/**
+ * Every error Cogenta throws carries one of these codes. They are a public API:
+ * callers branch on them, logs are aggregated by them, and translations key off
+ * them. Adding a code is a minor version; changing the meaning of one is major.
+ */
+export const ERROR_CODES = [
+    // Configuration
+    'CONFIG_INVALID',
+    'CONFIG_NOT_FOUND',
+    'CONFIG_LOAD_FAILED',
+    'CONFIG_SECRET_IN_FILE',
+    // Drivers
+    'DRIVER_UNKNOWN',
+    'DRIVER_DUPLICATE',
+    'DRIVER_UNAVAILABLE',
+    'DRIVER_INIT_FAILED',
+    // Data
+    'DB_UNREACHABLE',
+    'DB_DIALECT_UNSUPPORTED',
+    'MIGRATION_FAILED',
+    'MIGRATION_IRREVERSIBLE',
+    'MIGRATION_LOCKED',
+    'MIGRATION_CHECKSUM_MISMATCH',
+    'MIGRATION_DESTRUCTIVE',
+    // Content schema
+    'SCHEMA_INVALID',
+    // Content
+    'CONTENT_NOT_FOUND',
+    'CONTENT_INVALID',
+    'CONTENT_CONFLICT',
+    'CONTENT_SLUG_INVALID',
+    'CONTENT_SLUG_TAKEN',
+    'CONTENT_ROUTE_INVALID',
+    'CONTENT_REDIRECT_LOOP',
+    'CONTENT_SCHEDULE_INVALID',
+    'CONTENT_READ_ONLY',
+    // Blocks
+    'BLOCK_UNKNOWN',
+    'BLOCK_INVALID',
+    'BLOCK_DEFINITION_INVALID',
+    'BLOCK_MIGRATION_FAILED',
+    // Rendering — skins. A skin is refused, never repaired: contract D freezes the
+    // token set precisely so that a generated skin either passes or is rejected.
+    'SKIN_TOKEN_MISSING',
+    'SKIN_TOKEN_UNKNOWN',
+    'SKIN_TOKEN_INVALID',
+    'SKIN_CONTRAST_INSUFFICIENT',
+    'SKIN_SCALE_NOT_MONOTONIC',
+    'SKIN_MOTION_NOT_REDUCED',
+    // Themes
+    'THEME_NOT_FOUND',
+    'THEME_INVALID',
+    'THEME_BLOCK_MISSING',
+    'THEME_IMPORT_FORBIDDEN',
+    'THEME_SIGNATURE_INVALID',
+    // Rendering — the content API a theme reads through (ADR-0016)
+    'CONTENT_API_FAILED',
+    // Rendering — in-process fallback `cogenta serve` uses until a real Astro
+    // build exists (no image pipeline is wired into that fallback yet)
+    'THEME_IMAGE_UNSUPPORTED',
+    // Rendering — build targets. A target that cannot honour a declared runtime
+    // need refuses the build; it never degrades silently (ADR-0004).
+    'BUILD_TARGET_UNKNOWN',
+    'BUILD_RUNTIME_UNSATISFIED',
+    // Access
+    'FORBIDDEN',
+    'UNAUTHENTICATED',
+    'PREVIEW_TOKEN_INVALID',
+    'PREVIEW_TOKEN_EXPIRED',
+    'QUERY_INVALID',
+    // Auth
+    'AUTH_PASSWORD_INVALID',
+    'AUTH_INVALID_CREDENTIALS',
+    'AUTH_TOTP_INVALID',
+    'AUTH_TOTP_REQUIRED',
+    'AUTH_WEBAUTHN_FAILED',
+    'AUTH_SESSION_INVALID',
+    'AUTH_SESSION_EXPIRED',
+    'AUTH_RATE_LIMITED',
+    'AUTH_MFA_REQUIRED',
+    'AUTH_USER_EXISTS',
+    'AUTH_USER_NOT_FOUND',
+    'AUTH_ROLE_UNKNOWN',
+    'AUDIT_CHAIN_BROKEN',
+    // Media
+    'MEDIA_NOT_FOUND',
+    'MEDIA_INVALID',
+    'MEDIA_TYPE_REJECTED',
+    // Infrastructure
+    'CACHE_FAILED',
+    'QUEUE_FAILED',
+    'STORAGE_FAILED',
+    // Agents — LLM provider adapters (L4)
+    'PROVIDER_UNKNOWN',
+    'PROVIDER_REQUEST_FAILED',
+    'PROVIDER_RESPONSE_INVALID',
+    'PROVIDER_RATE_LIMITED',
+    'PROVIDER_TIMEOUT',
+    // Agents — tool registry (L4)
+    'TOOL_DEFINITION_INVALID',
+    'TOOL_DUPLICATE',
+    'TOOL_UNKNOWN',
+    'TOOL_INPUT_INVALID',
+    'TOOL_OUTPUT_INVALID',
+    'TOOL_CALL_REJECTED',
+    // Agents — core tools (L4)
+    'HTTP_FETCH_DOMAIN_DENIED',
+    // Agents — autonomy and approval (L4)
+    'APPROVAL_REQUEST_UNKNOWN',
+    // Agents — reversibility (L4)
+    'RECEIPT_UNKNOWN',
+    'RECEIPT_ALREADY_REVERTED',
+    'RECEIPT_NOT_REVERTIBLE',
+    // Agents — sub-agents (L4)
+    'AGENT_SUBAGENT_UNKNOWN',
+    'AGENT_SUBAGENT_TOOLS_NOT_SUBSET',
+    // Agents — skills (L4)
+    'SKILL_UNKNOWN',
+    'SKILL_DEFINITION_INVALID',
+    // Agents — memory (L4)
+    'AGENT_APPROVAL_NOT_DECIDED',
+    // MCP client (L4)
+    'MCP_CLIENT_REMOTE_ERROR',
+    'MCP_CLIENT_TOOL_FAILED',
+    // Agents — privacy (L4)
+    'PRIVACY_NO_DATA_LEAVES_VIOLATION',
+    // Agents — agent format and registry (L5)
+    'AGENT_DEFINITION_INVALID',
+    'AGENT_UNKNOWN',
+    // Agents — evaluation (L5)
+    'EVAL_THRESHOLD_NOT_MET',
+    // Agents-builtin — security agent (L5)
+    'SECURITY_OSV_QUERY_FAILED',
+    'SECURITY_EPSS_QUERY_FAILED',
+    'SECURITY_DEPENDENCY_NOT_FOUND',
+    // Agents-builtin — performance agent (L5)
+    'PERFORMANCE_CRUX_QUERY_FAILED',
+    // create-cogenta — blueprints (L9)
+    'BLUEPRINT_REGISTRY_CORRUPT',
+    // create-cogenta — AI skin generation (L9)
+    'SKIN_GENERATION_RESPONSE_NOT_JSON',
+    // Import — WordPress WXR (L9)
+    'IMPORT_WXR_PARSE_FAILED',
+    'IMPORT_WXR_UNSAFE_DOCUMENT',
+    // create-cogenta — playground reset (L9)
+    'PLAYGROUND_BLUEPRINT_UNKNOWN',
+    // Channels — adapter registry (L6)
+    'CHANNEL_UNKNOWN',
+    'CHANNEL_DUPLICATE',
+    // Channels — identity linking (L6 task 2)
+    'CHANNEL_LINK_CODE_INVALID',
+    // Channels — inbound command routing (L6 task 3)
+    'CHANNEL_COMMAND_DUPLICATE',
+    // Channels — Telegram adapter (L6 task 4)
+    'CHANNEL_TELEGRAM_API_ERROR',
+    // Channels — message formats (L6 task 6)
+    'CHANNEL_MESSAGE_INVALID',
+    // Channels — notification preferences (L6 task 7)
+    'CHANNEL_PREFERENCES_INVALID',
+    // Channels — email adapter (L6 task 8)
+    'CHANNEL_EMAIL_TRANSPORT_ERROR',
+    'CHANNEL_EMAIL_INBOUND_UNSUPPORTED',
+    // Channels — Slack adapter (L6 task 9)
+    'CHANNEL_SLACK_API_ERROR',
+    // Channels — Discord adapter (L6 task 10)
+    'CHANNEL_DISCORD_API_ERROR',
+    // Channels — generic signed webhook (L6 task 11)
+    'CHANNEL_WEBHOOK_SIGNATURE_INVALID',
+    'CHANNEL_WEBHOOK_EXPIRED',
+    'CHANNEL_WEBHOOK_REPLAY_DETECTED',
+    'CHANNEL_WEBHOOK_DELIVERY_FAILED',
+    'CHANNEL_WEBHOOK_INBOUND_UNSUPPORTED',
+    // Plugins — manifest schema and validation (L7 task 1)
+    'PLUGIN_MANIFEST_INVALID',
+    // Plugins — resolution and loading (L7 task 2)
+    'PLUGIN_SOURCE_NOT_FOUND',
+    'PLUGIN_MANIFEST_FILE_NOT_FOUND',
+    'PLUGIN_MANIFEST_LOAD_FAILED',
+    'PLUGIN_MANIFEST_EXPORT_INVALID',
+    // Plugins — isolated worker execution (L7 task 3)
+    'PLUGIN_WORKER_TIMEOUT',
+    'PLUGIN_WORKER_CRASHED',
+    'PLUGIN_WORKER_RUNTIME_ERROR',
+    // Plugins — capability-gated SDK (L7 task 4)
+    'PLUGIN_CAPABILITY_REFUSED',
+    // Plugins — resource limits, kill and disable (L7 task 6)
+    'PLUGIN_DISABLED',
+    // Plugins — signature and verification (L7 task 9)
+    'PLUGIN_SIGNATURE_MISSING',
+    'PLUGIN_SIGNATURE_INVALID',
+    // Fleet — site-side telemetry emission (L8 task 2)
+    'FLEET_TELEMETRY_FORBIDDEN_FIELD',
+    // Fleet — rollout campaigns (L8 task 7)
+    'FLEET_CAMPAIGN_NOT_FOUND',
+    'FLEET_CAMPAIGN_STATE_CORRUPT',
+    // Fleet — per-site rollback (L8 task 8)
+    'FLEET_ROLLBACK_NO_PRIOR_VERSION',
+    // Catch-all, deliberately last and deliberately rare.
+    'INTERNAL',
+];
+//# sourceMappingURL=codes.js.map

package/dist/errors/codes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codes.js","sourceRoot":"","sources":["../../src/errors/codes.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,gBAAgB;IAChB,gBAAgB;IAChB,kBAAkB;IAClB,oBAAoB;IACpB,uBAAuB;IAEvB,UAAU;IACV,gBAAgB;IAChB,kBAAkB;IAClB,oBAAoB;IACpB,oBAAoB;IAEpB,OAAO;IACP,gBAAgB;IAChB,wBAAwB;IACxB,kBAAkB;IAClB,wBAAwB;IACxB,kBAAkB;IAClB,6BAA6B;IAC7B,uBAAuB;IAEvB,iBAAiB;IACjB,gBAAgB;IAEhB,UAAU;IACV,mBAAmB;IACnB,iBAAiB;IACjB,kBAAkB;IAClB,sBAAsB;IACtB,oBAAoB;IACpB,uBAAuB;IACvB,uBAAuB;IACvB,0BAA0B;IAC1B,mBAAmB;IAEnB,SAAS;IACT,eAAe;IACf,eAAe;IACf,0BAA0B;IAC1B,wBAAwB;IAExB,+EAA+E;IAC/E,6EAA6E;IAC7E,oBAAoB;IACpB,oBAAoB;IACpB,oBAAoB;IACpB,4BAA4B;IAC5B,0BAA0B;IAC1B,yBAAyB;IAEzB,SAAS;IACT,iBAAiB;IACjB,eAAe;IACf,qBAAqB;IACrB,wBAAwB;IACxB,yBAAyB;IAEzB,+DAA+D;IAC/D,oBAAoB;IAEpB,0EAA0E;IAC1E,mEAAmE;IACnE,yBAAyB;IAEzB,4EAA4E;IAC5E,iEAAiE;IACjE,sBAAsB;IACtB,2BAA2B;IAE3B,SAAS;IACT,WAAW;IACX,iBAAiB;IACjB,uBAAuB;IACvB,uBAAuB;IACvB,eAAe;IAEf,OAAO;IACP,uBAAuB;IACvB,0BAA0B;IAC1B,mBAAmB;IACnB,oBAAoB;IACpB,sBAAsB;IACtB,sBAAsB;IACtB,sBAAsB;IACtB,mBAAmB;IACnB,mBAAmB;IACnB,kBAAkB;IAClB,qBAAqB;IACrB,mBAAmB;IACnB,oBAAoB;IAEpB,QAAQ;IACR,iBAAiB;IACjB,eAAe;IACf,qBAAqB;IAErB,iBAAiB;IACjB,cAAc;IACd,cAAc;IACd,gBAAgB;IAEhB,sCAAsC;IACtC,kBAAkB;IAClB,yBAAyB;IACzB,2BAA2B;IAC3B,uBAAuB;IACvB,kBAAkB;IAElB,8BAA8B;IAC9B,yBAAyB;IACzB,gBAAgB;IAChB,cAAc;IACd,oBAAoB;IACpB,qBAAqB;IACrB,oBAAoB;IAEpB,2BAA2B;IAC3B,0BAA0B;IAE1B,sCAAsC;IACtC,0BAA0B;IAE1B,8BAA8B;IAC9B,iBAAiB;IACjB,0BAA0B;IAC1B,wBAAwB;IAExB,2BAA2B;IAC3B,wBAAwB;IACxB,iCAAiC;IAEjC,uBAAuB;IACvB,eAAe;IACf,0BAA0B;IAE1B,uBAAuB;IACvB,4BAA4B;IAE5B,kBAAkB;IAClB,yBAAyB;IACzB,wBAAwB;IAExB,wBAAwB;IACxB,kCAAkC;IAElC,0CAA0C;IAC1C,0BAA0B;IAC1B,eAAe;IAEf,2BAA2B;IAC3B,wBAAwB;IAExB,uCAAuC;IACvC,2BAA2B;IAC3B,4BAA4B;IAC5B,+BAA+B;IAE/B,0CAA0C;IAC1C,+BAA+B;IAE/B,mCAAmC;IACnC,4BAA4B;IAE5B,2CAA2C;IAC3C,mCAAmC;IAEnC,8BAA8B;IAC9B,yBAAyB;IACzB,4BAA4B;IAE5B,yCAAyC;IACzC,8BAA8B;IAE9B,mCAAmC;IACnC,iBAAiB;IACjB,mBAAmB;IAEnB,0CAA0C;IAC1C,2BAA2B;IAE3B,iDAAiD;IACjD,2BAA2B;IAE3B,0CAA0C;IAC1C,4BAA4B;IAE5B,yCAAyC;IACzC,yBAAyB;IAEzB,kDAAkD;IAClD,6BAA6B;IAE7B,uCAAuC;IACvC,+BAA+B;IAC/B,mCAAmC;IAEnC,uCAAuC;IACvC,yBAAyB;IAEzB,0CAA0C;IAC1C,2BAA2B;IAE3B,iDAAiD;IACjD,mCAAmC;IACnC,yBAAyB;IACzB,iCAAiC;IACjC,iCAAiC;IACjC,qCAAqC;IAErC,uDAAuD;IACvD,yBAAyB;IAEzB,+CAA+C;IAC/C,yBAAyB;IACzB,gCAAgC;IAChC,6BAA6B;IAC7B,gCAAgC;IAEhC,kDAAkD;IAClD,uBAAuB;IACvB,uBAAuB;IACvB,6BAA6B;IAE7B,6CAA6C;IAC7C,2BAA2B;IAE3B,0DAA0D;IAC1D,iBAAiB;IAEjB,mDAAmD;IACnD,0BAA0B;IAC1B,0BAA0B;IAE1B,mDAAmD;IACnD,iCAAiC;IAEjC,wCAAwC;IACxC,0BAA0B;IAC1B,8BAA8B;IAE9B,wCAAwC;IACxC,iCAAiC;IAEjC,sDAAsD;IACtD,UAAU;CACF,CAAA"}

package/dist/errors/cogenta-error.d.ts

@@ -0,0 +1,38 @@
+import type { ErrorCode } from './codes.js';
+export interface CogentaErrorOptions {
+    /** Stable, machine-readable code. Never derived from the message. */
+    readonly code: ErrorCode;
+    /** What failed and why, in one sentence, aimed at a human. */
+    readonly message: string;
+    /** What the user should do about it. Required for anything a user can hit. */
+    readonly hint?: string;
+    /** The underlying error, kept for debugging. */
+    readonly cause?: unknown;
+    /**
+     * Structured context for logs. Opt-in per call site, which is what keeps
+     * secrets out of it: nothing is ever copied here automatically (rule R7).
+     */
+    readonly details?: Readonly<Record<string, unknown>>;
+}
+export interface SerialisedCogentaError {
+    readonly name: 'CogentaError';
+    readonly code: ErrorCode;
+    readonly message: string;
+    readonly hint: string | undefined;
+    readonly details: Readonly<Record<string, unknown>> | undefined;
+}
+/**
+ * The only error class library code throws. A bare `throw new Error("…")` is
+ * forbidden in Cogenta: it gives the caller nothing to branch on and the user
+ * nothing to act on.
+ */
+export declare class CogentaError extends Error {
+    readonly code: ErrorCode;
+    readonly hint: string | undefined;
+    readonly details: Readonly<Record<string, unknown>> | undefined;
+    constructor(options: CogentaErrorOptions);
+    /** Structured form for logging. The stack is deliberately left out. */
+    toJSON(): SerialisedCogentaError;
+}
+export declare function isCogentaError(value: unknown): value is CogentaError;
+//# sourceMappingURL=cogenta-error.d.ts.map

package/dist/errors/cogenta-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cogenta-error.d.ts","sourceRoot":"","sources":["../../src/errors/cogenta-error.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAE3C,MAAM,WAAW,mBAAmB;IAClC,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,8EAA8E;IAC9E,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,gDAAgD;IAChD,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;IACxB;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CACrD;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;IAC7B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;IACjC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAAA;CAChE;AAED;;;;GAIG;AACH,qBAAa,YAAa,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;IACjC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAAA;IAE/D,YAAY,OAAO,EAAE,mBAAmB,EAMvC;IAED,uEAAuE;IACvE,MAAM,IAAI,sBAAsB,CAQ/B;CACF;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,YAAY,CAEpE"}

package/dist/errors/cogenta-error.js

@@ -0,0 +1,31 @@
+/**
+ * The only error class library code throws. A bare `throw new Error("…")` is
+ * forbidden in Cogenta: it gives the caller nothing to branch on and the user
+ * nothing to act on.
+ */
+export class CogentaError extends Error {
+    code;
+    hint;
+    details;
+    constructor(options) {
+        super(options.message, options.cause === undefined ? undefined : { cause: options.cause });
+        this.name = 'CogentaError';
+        this.code = options.code;
+        this.hint = options.hint;
+        this.details = options.details;
+    }
+    /** Structured form for logging. The stack is deliberately left out. */
+    toJSON() {
+        return {
+            name: 'CogentaError',
+            code: this.code,
+            message: this.message,
+            hint: this.hint,
+            details: this.details,
+        };
+    }
+}
+export function isCogentaError(value) {
+    return value instanceof CogentaError;
+}
+//# sourceMappingURL=cogenta-error.js.map

package/dist/errors/cogenta-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cogenta-error.js","sourceRoot":"","sources":["../../src/errors/cogenta-error.ts"],"names":[],"mappings":"AA0BA;;;;GAIG;AACH,MAAM,OAAO,YAAa,SAAQ,KAAK;IAC5B,IAAI,CAAW;IACf,IAAI,CAAoB;IACxB,OAAO,CAA+C;IAE/D,YAAY,OAA4B;QACtC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA;QAC1F,IAAI,CAAC,IAAI,GAAG,cAAc,CAAA;QAC1B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;QACxB,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;QACxB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAA;IAChC,CAAC;IAED,uEAAuE;IACvE,MAAM;QACJ,OAAO;YACL,IAAI,EAAE,cAAc;YACpB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAA;IACH,CAAC;CACF;AAED,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,KAAK,YAAY,YAAY,CAAA;AACtC,CAAC"}

package/dist/errors/index.d.ts

@@ -0,0 +1,5 @@
+export type { ErrorCode } from './codes.js';
+export { ERROR_CODES } from './codes.js';
+export type { CogentaErrorOptions, SerialisedCogentaError } from './cogenta-error.js';
+export { CogentaError, isCogentaError } from './cogenta-error.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/errors/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/errors/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AACxC,YAAY,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAA;AACrF,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA"}

package/dist/errors/index.js

@@ -0,0 +1,3 @@
+export { ERROR_CODES } from './codes.js';
+export { CogentaError, isCogentaError } from './cogenta-error.js';
+//# sourceMappingURL=index.js.map

package/dist/errors/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/errors/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAExC,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA"}

package/dist/id.d.ts

@@ -0,0 +1,5 @@
+export declare function newId(now?: () => number): string;
+export declare function isUuidV7(value: string): boolean;
+/** The millisecond an id was minted, readable without a database round-trip. */
+export declare function timestampOf(id: string): number;
+//# sourceMappingURL=id.d.ts.map

package/dist/id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"id.d.ts","sourceRoot":"","sources":["../src/id.ts"],"names":[],"mappings":"AAkCA,wBAAgB,KAAK,CAAC,GAAG,GAAE,MAAM,MAAiB,GAAG,MAAM,CAoC1D;AAiBD,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE/C;AAED,gFAAgF;AAChF,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAE9C"}

package/dist/id.js

@@ -0,0 +1,82 @@
+import { randomFillSync } from 'node:crypto';
+/**
+ * UUIDv7 generation, per ADR-0015: every content id is minted by the
+ * application, never by the database.
+ *
+ * Node exposes `randomUUID`, which is v4 only — there is no v7 in the standard
+ * library as of Node 24 — so the layout below is written out by hand against
+ * RFC 9562 §5.7 rather than pulling in a dependency for sixteen bytes (rule R9).
+ *
+ *   0..5   unix timestamp in milliseconds, big-endian, 48 bits
+ *   6..7   version (7) in the high nibble, then a 12-bit sequence counter
+ *   8      variant (0b10) in the two high bits, then 6 random bits
+ *   9..15  random, 56 bits
+ *
+ * v4 is not an option here: random ids fragment a B-tree index on insert, and
+ * the write cost grows with the table. v7 sorts by creation time, so new rows
+ * land at the end of the index.
+ */
+const MAX_SEQUENCE = 0xfff;
+/**
+ * Ids minted inside the same millisecond stay ordered because the 12-bit
+ * `rand_a` field is used as a counter (RFC 9562 §6.2, "monotonic random"
+ * method 1). Without it, two rows created in the same tick sort at random —
+ * which breaks pagination by id, the very reason for choosing v7.
+ */
+let lastTimestamp = -1;
+let sequence = 0;
+/** Random bytes for the low 62 bits. Refilled per call, never reused. */
+const randomBytes = new Uint8Array(8);
+export function newId(now = Date.now) {
+    const timestamp = now();
+    if (timestamp === lastTimestamp) {
+        sequence += 1;
+        if (sequence > MAX_SEQUENCE) {
+            // More than 4096 ids in one millisecond: borrow from the next one rather
+            // than emit a duplicate. Time-ordering is preserved, the clock is not.
+            lastTimestamp += 1;
+            sequence = 0;
+        }
+    }
+    else {
+        // A clock that steps backwards must not produce ids that sort before rows
+        // already written, so the last timestamp only ever moves forward.
+        lastTimestamp = timestamp > lastTimestamp ? timestamp : lastTimestamp + 1;
+        sequence = 0;
+    }
+    randomFillSync(randomBytes);
+    const bytes = new Uint8Array(16);
+    const millis = lastTimestamp;
+    bytes[0] = Math.floor(millis / 2 ** 40) & 0xff;
+    bytes[1] = Math.floor(millis / 2 ** 32) & 0xff;
+    bytes[2] = Math.floor(millis / 2 ** 24) & 0xff;
+    bytes[3] = Math.floor(millis / 2 ** 16) & 0xff;
+    bytes[4] = Math.floor(millis / 2 ** 8) & 0xff;
+    bytes[5] = millis & 0xff;
+    bytes[6] = 0x70 | ((sequence >>> 8) & 0x0f);
+    bytes[7] = sequence & 0xff;
+    bytes[8] = 0x80 | ((randomBytes[0] ?? 0) & 0x3f);
+    for (let index = 9; index < 16; index += 1) {
+        bytes[index] = randomBytes[index - 8] ?? 0;
+    }
+    return formatUuid(bytes);
+}
+const HEX = Array.from({ length: 256 }, (_, byte) => byte.toString(16).padStart(2, '0'));
+function formatUuid(bytes) {
+    let text = '';
+    for (let index = 0; index < 16; index += 1) {
+        if (index === 4 || index === 6 || index === 8 || index === 10)
+            text += '-';
+        text += HEX[bytes[index] ?? 0];
+    }
+    return text;
+}
+const UUID_V7_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+export function isUuidV7(value) {
+    return UUID_V7_PATTERN.test(value);
+}
+/** The millisecond an id was minted, readable without a database round-trip. */
+export function timestampOf(id) {
+    return Number.parseInt(id.slice(0, 8) + id.slice(9, 13), 16);
+}
+//# sourceMappingURL=id.js.map

package/dist/id.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"id.js","sourceRoot":"","sources":["../src/id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAE5C;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,YAAY,GAAG,KAAK,CAAA;AAE1B;;;;;GAKG;AACH,IAAI,aAAa,GAAG,CAAC,CAAC,CAAA;AACtB,IAAI,QAAQ,GAAG,CAAC,CAAA;AAEhB,yEAAyE;AACzE,MAAM,WAAW,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAA;AAErC,MAAM,UAAU,KAAK,CAAC,GAAG,GAAiB,IAAI,CAAC,GAAG;IAChD,MAAM,SAAS,GAAG,GAAG,EAAE,CAAA;IAEvB,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;QAChC,QAAQ,IAAI,CAAC,CAAA;QACb,IAAI,QAAQ,GAAG,YAAY,EAAE,CAAC;YAC5B,yEAAyE;YACzE,uEAAuE;YACvE,aAAa,IAAI,CAAC,CAAA;YAClB,QAAQ,GAAG,CAAC,CAAA;QACd,CAAC;IACH,CAAC;SAAM,CAAC;QACN,0EAA0E;QAC1E,kEAAkE;QAClE,aAAa,GAAG,SAAS,GAAG,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,GAAG,CAAC,CAAA;QACzE,QAAQ,GAAG,CAAC,CAAA;IACd,CAAC;IAED,cAAc,CAAC,WAAW,CAAC,CAAA;IAE3B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAA;IAChC,MAAM,MAAM,GAAG,aAAa,CAAA;IAC5B,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAA;IAC9C,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAA;IAC9C,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAA;IAC9C,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAA;IAC9C,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAA;IAC7C,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;IACxB,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;IAC3C,KAAK,CAAC,CAAC,CAAC,GAAG,QAAQ,GAAG,IAAI,CAAA;IAC1B,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;IAChD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,EAAE,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC3C,KAAK,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,CAAA;IAC5C,CAAC;IAED,OAAO,UAAU,CAAC,KAAK,CAAC,CAAA;AAC1B,CAAC;AAED,MAAM,GAAG,GAAsB,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CACrE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CACnC,CAAA;AAED,SAAS,UAAU,CAAC,KAAiB;IACnC,IAAI,IAAI,GAAG,EAAE,CAAA;IACb,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,EAAE,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC3C,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE;YAAE,IAAI,IAAI,GAAG,CAAA;QAC1E,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;IAChC,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,eAAe,GAAG,uEAAuE,CAAA;AAE/F,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,OAAO,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AACpC,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,WAAW,CAAC,EAAU;IACpC,OAAO,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAA;AAC9D,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,12 @@
+export * from './cache/index.js';
+export * from './config/index.js';
+export * from './db/index.js';
+export * from './drivers/index.js';
+export * from './errors/index.js';
+export * from './id.js';
+export * from './logger/index.js';
+export * from './media/index.js';
+export * from './migrations/index.js';
+export * from './queue/index.js';
+export * from './storage/index.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAA;AAChC,cAAc,mBAAmB,CAAA;AACjC,cAAc,eAAe,CAAA;AAC7B,cAAc,oBAAoB,CAAA;AAClC,cAAc,mBAAmB,CAAA;AACjC,cAAc,SAAS,CAAA;AACvB,cAAc,mBAAmB,CAAA;AACjC,cAAc,kBAAkB,CAAA;AAChC,cAAc,uBAAuB,CAAA;AACrC,cAAc,kBAAkB,CAAA;AAChC,cAAc,oBAAoB,CAAA"}

package/dist/index.js

@@ -0,0 +1,12 @@
+export * from './cache/index.js';
+export * from './config/index.js';
+export * from './db/index.js';
+export * from './drivers/index.js';
+export * from './errors/index.js';
+export * from './id.js';
+export * from './logger/index.js';
+export * from './media/index.js';
+export * from './migrations/index.js';
+export * from './queue/index.js';
+export * from './storage/index.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAA;AAChC,cAAc,mBAAmB,CAAA;AACjC,cAAc,eAAe,CAAA;AAC7B,cAAc,oBAAoB,CAAA;AAClC,cAAc,mBAAmB,CAAA;AACjC,cAAc,SAAS,CAAA;AACvB,cAAc,mBAAmB,CAAA;AACjC,cAAc,kBAAkB,CAAA;AAChC,cAAc,uBAAuB,CAAA;AACrC,cAAc,kBAAkB,CAAA;AAChC,cAAc,oBAAoB,CAAA"}

package/dist/logger/index.d.ts

@@ -0,0 +1,5 @@
+export { createLogger } from './logger.js';
+export { REDACTED, redact } from './redact.js';
+export type { EmittedLogLevel, LogDestination, LogFields, Logger, LoggerOptions, LogLevel, LogRecord, } from './types.js';
+export { LOG_LEVELS } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/logger/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/logger/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAC9C,YAAY,EACV,eAAe,EACf,cAAc,EACd,SAAS,EACT,MAAM,EACN,aAAa,EACb,QAAQ,EACR,SAAS,GACV,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA"}

package/dist/logger/index.js

@@ -0,0 +1,4 @@
+export { createLogger } from './logger.js';
+export { REDACTED, redact } from './redact.js';
+export { LOG_LEVELS } from './types.js';
+//# sourceMappingURL=index.js.map

package/dist/logger/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/logger/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAU9C,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA"}

package/dist/logger/logger.d.ts

@@ -0,0 +1,10 @@
+import type { Logger, LoggerOptions } from './types.js';
+/**
+ * Structured NDJSON logger. One JSON object per line, never free text: logs are
+ * read by machines first and humans second.
+ *
+ * Every record passes through redaction, so a secret that slipped into a field
+ * does not reach the output (rule R7).
+ */
+export declare function createLogger(options?: LoggerOptions): Logger;
+//# sourceMappingURL=logger.d.ts.map

package/dist/logger/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/logger/logger.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAIV,MAAM,EACN,aAAa,EAEd,MAAM,YAAY,CAAA;AA4DnB;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,OAAO,GAAE,aAAkB,GAAG,MAAM,CAkDhE"}

package/dist/logger/logger.js

@@ -0,0 +1,108 @@
+import process from 'node:process';
+import { isCogentaError } from '../errors/index.js';
+import { redact } from './redact.js';
+const SEVERITY = {
+    debug: 10,
+    info: 20,
+    warn: 30,
+    error: 40,
+    silent: Number.POSITIVE_INFINITY,
+};
+/** Reserved by the record structure: a field may never overwrite one of these. */
+const RESERVED = new Set(['time', 'level', 'msg']);
+const writeToStdout = (line) => {
+    process.stdout.write(line);
+};
+/**
+ * `Error` has non-enumerable properties, so `JSON.stringify` renders it as `{}`.
+ * Losing the one field that explains a failure is the classic structured-logging
+ * bug; unpack it explicitly instead.
+ */
+function serialiseError(value) {
+    if (isCogentaError(value))
+        return { ...value.toJSON() };
+    const serialised = { name: value.name, message: value.message };
+    if (value.cause !== undefined) {
+        serialised['cause'] = value.cause instanceof Error ? serialiseError(value.cause) : value.cause;
+    }
+    return serialised;
+}
+function expandErrors(fields) {
+    const output = {};
+    for (const [key, value] of Object.entries(fields)) {
+        output[key] = value instanceof Error ? serialiseError(value) : value;
+    }
+    return output;
+}
+/**
+ * Last line of defence. A logger that throws takes the caller down with it, and
+ * an unserialisable field is never worth an outage — drop the field, keep the
+ * record, say so.
+ */
+function stringify(record) {
+    try {
+        return JSON.stringify(record, (_key, value) => typeof value === 'bigint' ? value.toString() : value);
+    }
+    catch {
+        return JSON.stringify({
+            time: record['time'],
+            level: record['level'],
+            msg: record['msg'],
+            logError: 'fields could not be serialised and were dropped',
+        });
+    }
+}
+/**
+ * Structured NDJSON logger. One JSON object per line, never free text: logs are
+ * read by machines first and humans second.
+ *
+ * Every record passes through redaction, so a secret that slipped into a field
+ * does not reach the output (rule R7).
+ */
+export function createLogger(options = {}) {
+    const level = options.level ?? 'info';
+    const destination = options.destination ?? writeToStdout;
+    const clock = options.clock ?? (() => new Date());
+    const bindings = redact(options.bindings ?? {});
+    const threshold = SEVERITY[level];
+    function emit(recordLevel, message, fields) {
+        if (SEVERITY[recordLevel] < threshold)
+            return;
+        const safe = fields === undefined ? {} : redact(expandErrors(fields));
+        const record = { ...bindings };
+        for (const [key, value] of Object.entries(safe)) {
+            if (!RESERVED.has(key))
+                record[key] = value;
+        }
+        record['time'] = clock().toISOString();
+        record['level'] = recordLevel;
+        record['msg'] = message;
+        destination(`${stringify(record)}\n`);
+    }
+    return {
+        level,
+        debug: (message, fields) => {
+            emit('debug', message, fields);
+        },
+        info: (message, fields) => {
+            emit('info', message, fields);
+        },
+        warn: (message, fields) => {
+            emit('warn', message, fields);
+        },
+        error: (message, fields) => {
+            emit('error', message, fields);
+        },
+        child: (childBindings) => createLogger({
+            ...options,
+            level,
+            destination,
+            clock,
+            bindings: { ...bindings, ...redact(childBindings) },
+        }),
+        isLevelEnabled: (candidate) => candidate !== 'silent' &&
+            SEVERITY[candidate] >= threshold &&
+            threshold !== Number.POSITIVE_INFINITY,
+    };
+}
+//# sourceMappingURL=logger.js.map

package/dist/logger/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/logger/logger.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,cAAc,CAAA;AAClC,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAUpC,MAAM,QAAQ,GAA6B;IACzC,KAAK,EAAE,EAAE;IACT,IAAI,EAAE,EAAE;IACR,IAAI,EAAE,EAAE;IACR,KAAK,EAAE,EAAE;IACT,MAAM,EAAE,MAAM,CAAC,iBAAiB;CACjC,CAAA;AAED,kFAAkF;AAClF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAA;AAElD,MAAM,aAAa,GAAmB,CAAC,IAAI,EAAE,EAAE;IAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;AAC5B,CAAC,CAAA;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,KAAY;IAClC,IAAI,cAAc,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,EAAE,CAAA;IAEvD,MAAM,UAAU,GAAc,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAA;IAC1E,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9B,UAAU,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAA;IAChG,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,MAAiB;IACrC,MAAM,MAAM,GAAc,EAAE,CAAA;IAC5B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IACtE,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,MAAiB;IAClC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAC5C,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,CACrD,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,SAAS,CAAC;YACpB,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;YACpB,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC;YACtB,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC;YAClB,QAAQ,EAAE,iDAAiD;SAC5D,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,OAAO,GAAkB,EAAE;IACtD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,MAAM,CAAA;IACrC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,aAAa,CAAA;IACxD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,GAAS,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAA;IACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAA;IAC/C,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAEjC,SAAS,IAAI,CAAC,WAA4B,EAAE,OAAe,EAAE,MAAkB;QAC7E,IAAI,QAAQ,CAAC,WAAW,CAAC,GAAG,SAAS;YAAE,OAAM;QAE7C,MAAM,IAAI,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAA;QACrE,MAAM,MAAM,GAAc,EAAE,GAAG,QAAQ,EAAE,CAAA;QACzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;QAC7C,CAAC;QAED,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,EAAE,CAAC,WAAW,EAAE,CAAA;QACtC,MAAM,CAAC,OAAO,CAAC,GAAG,WAAW,CAAA;QAC7B,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAA;QAEvB,WAAW,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACvC,CAAC;IAED,OAAO;QACL,KAAK;QACL,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACzB,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;QAChC,CAAC;QACD,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACxB,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;QAC/B,CAAC;QACD,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACxB,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;QAC/B,CAAC;QACD,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACzB,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;QAChC,CAAC;QACD,KAAK,EAAE,CAAC,aAAa,EAAE,EAAE,CACvB,YAAY,CAAC;YACX,GAAG,OAAO;YACV,KAAK;YACL,WAAW;YACX,KAAK;YACL,QAAQ,EAAE,EAAE,GAAG,QAAQ,EAAE,GAAG,MAAM,CAAC,aAAa,CAAC,EAAE;SACpD,CAAC;QACJ,cAAc,EAAE,CAAC,SAAS,EAAE,EAAE,CAC5B,SAAS,KAAK,QAAQ;YACtB,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS;YAChC,SAAS,KAAK,MAAM,CAAC,iBAAiB;KACzC,CAAA;AACH,CAAC"}

package/dist/logger/redact.d.ts

@@ -0,0 +1,12 @@
+/** What replaces a redacted value. Constant so tests and readers can match on it. */
+export declare const REDACTED = "[redacted]";
+/**
+ * Returns a copy of `fields` with credentials removed — by field name, by value
+ * shape, and inside connection strings.
+ *
+ * This is belt and braces on top of rule R7: secrets are not supposed to reach a
+ * log call in the first place. Defence in depth is warranted because a leaked
+ * key in a log file is discovered late, by someone else, and costs a rotation.
+ */
+export declare function redact<T extends Record<string, unknown>>(fields: T): Record<string, unknown>;
+//# sourceMappingURL=redact.d.ts.map

package/dist/logger/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../src/logger/redact.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,eAAO,MAAM,QAAQ,eAAe,CAAA;AAuFpC;;;;;;;GAOG;AACH,wBAAgB,MAAM,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE5F"}