@cohortapp/agent-sdk 2.3.0

package/lib/security/redact.mjs

@@ -0,0 +1,592 @@
+/**
+ * lib/security/redact.mjs
+ *
+ * URL / secret REDACTION and private-IP classification.
+ *
+ * Ported from OpenClaw's net-policy package
+ * (redact-sensitive-url.ts, url-userinfo.ts, ip.ts) and adapted to maestro
+ * conventions: pure ESM, JSDoc instead of TypeScript types, zero third-party
+ * dependencies (node:url + node:net only). All functions are pure and
+ * side-effect free.
+ *
+ * Two concerns live here:
+ *   1. redactSensitiveUrl(url) — make a URL safe to log/echo by stripping
+ *      embedded credentials (user:pass@) and masking sensitive query params.
+ *   2. isPrivateOrReservedIp(host) — classify a host as a private / loopback /
+ *      link-local / reserved address. Used for SSRF-style guardrails; it must
+ *      not be foolable by IPv4-mapped-IPv6 representations (e.g. ::ffff:10.0.0.1)
+ *      that would otherwise bypass a naive IPv4-only check.
+ *
+ * Faithful to OpenClaw behaviour: malformed input never throws — callers get a
+ * best-effort redaction (or a conservative classification) instead of an
+ * exception, because this code runs on the logging / security path.
+ */
+
+import { isIP } from "node:net";
+
+/**
+ * Mask value placeholder used in place of a redacted secret.
+ * @type {string}
+ */
+export const REDACTED = "***";
+
+/**
+ * Query-parameter names whose values are treated as secrets and masked.
+ * Matching is case-insensitive and substring-based so e.g. `apiKey`,
+ * `access_token`, `client_secret`, `X-Api-Key` all match.
+ * @type {readonly string[]}
+ */
+export const SENSITIVE_PARAM_KEYS = Object.freeze([
+  "token",
+  "key",
+  "secret",
+  "password",
+  "passwd",
+  "pwd",
+  "apikey",
+  "api_key",
+  "auth",
+  "access_token",
+  "refresh_token",
+  "sig",
+  "signature",
+  "credential",
+]);
+
+/**
+ * True if a query-parameter name looks sensitive (case-insensitive substring
+ * match against {@link SENSITIVE_PARAM_KEYS}).
+ *
+ * @param {string} name - The parameter name.
+ * @returns {boolean}
+ */
+export function isSensitiveParamName(name) {
+  if (typeof name !== "string" || name.length === 0) return false;
+  const lower = name.toLowerCase();
+  for (const needle of SENSITIVE_PARAM_KEYS) {
+    if (lower.includes(needle)) return true;
+  }
+  return false;
+}
+
+/**
+ * Strip the `user:password@` userinfo component from a parsed URL in place,
+ * returning whether anything was removed. Mirrors OpenClaw's url-userinfo
+ * helper: both username and password are cleared so neither leaks.
+ *
+ * @param {URL} u - A parsed WHATWG URL (mutated).
+ * @returns {boolean} True if userinfo was present and removed.
+ */
+function stripUserinfo(u) {
+  const had = u.username !== "" || u.password !== "";
+  if (had) {
+    u.username = "";
+    u.password = "";
+  }
+  return had;
+}
+
+/**
+ * Best-effort regex fallback for inputs the WHATWG URL parser rejects.
+ * Removes a `scheme://user:pass@` style userinfo segment and masks obvious
+ * `key=value` secret pairs in the query string. Never throws.
+ *
+ * @param {string} url
+ * @returns {string}
+ */
+function redactWithRegex(url) {
+  let out = url;
+
+  // Strip userinfo: matches `://something@` where `something` has no slash.
+  // Keeps the scheme and the host that follows the `@`.
+  out = out.replace(/(\/\/)[^/@\s]+@/g, "$1");
+
+  // Mask sensitive query/fragment params of the form key=value. The leading
+  // delimiter is `?`, `&`, `#`, or start-of-string (so a bare `token=...`
+  // query fragment with no preceding `?` is still caught — slightly hardened
+  // vs. OpenClaw's redactSensitiveUrlLikeString, which only matched `[?&]`).
+  out = out.replace(
+    /(^|[?&#])([^=&#\s]+)=([^&#\s]*)/g,
+    (match, sep, rawName, _value) => {
+      let name = rawName;
+      try {
+        name = decodeURIComponent(rawName);
+      } catch {
+        // keep raw name if it is not valid percent-encoding
+      }
+      return isSensitiveParamName(name)
+        ? `${sep}${rawName}=${REDACTED}`
+        : match;
+    }
+  );
+
+  return out;
+}
+
+/**
+ * Return a copy of `url` that is safe to log: any embedded `user:pass@`
+ * credentials are removed and any sensitive query-parameter values
+ * (token / key / secret / password / apikey / etc.) are replaced with `***`.
+ *
+ * Benign URLs are returned effectively unchanged (the WHATWG parser may
+ * normalise trailing details, but no information is added or masked).
+ *
+ * Never throws — malformed URLs fall back to a regex-based redaction.
+ *
+ * @param {string} url - The URL to redact.
+ * @returns {string} The redacted URL, or the input coerced to string on total
+ *   failure.
+ */
+export function redactSensitiveUrl(url) {
+  if (typeof url !== "string") {
+    if (url === null || url === undefined) return "";
+    url = String(url);
+  }
+  if (url.length === 0) return url;
+
+  let u;
+  try {
+    u = new URL(url);
+  } catch {
+    return redactWithRegex(url);
+  }
+
+  stripUserinfo(u);
+
+  // Mask sensitive query params. Iterate over a snapshot of keys because we
+  // mutate searchParams while walking it.
+  const keys = [...u.searchParams.keys()];
+  for (const key of keys) {
+    if (isSensitiveParamName(key)) {
+      // set() collapses repeated keys to one; rebuild to preserve multiplicity.
+      const values = u.searchParams.getAll(key);
+      u.searchParams.delete(key);
+      for (let i = 0; i < values.length; i++) {
+        u.searchParams.append(key, REDACTED);
+      }
+    }
+  }
+
+  return u.toString();
+}
+
+/* ------------------------------------------------------------------------- *
+ * Free-text PII / secret masking
+ *
+ * `maskText` is the general masker the URL/param redactor above is NOT: it walks
+ * arbitrary free text (LLM prompts on non-Anthropic routes, log lines, message
+ * bodies) and replaces things that look like secrets or PII with a typed
+ * placeholder, returning both the cleaned string and a count of substitutions.
+ *
+ * Design notes (mirrors the Hermes/OpenClaw pattern corpus referenced in
+ * gaps-enterprise-ops G19):
+ *   - High-signal, low-false-positive patterns only. We mask things with a
+ *     distinctive shape (vendor key prefixes, bearer tokens, email/phone) plus
+ *     long high-entropy hex/base64 runs; we deliberately do NOT mask ordinary
+ *     words, numbers, or short identifiers.
+ *   - Ordering matters: the most specific / longest patterns run first so a
+ *     bearer token isn't half-eaten by the generic-secret pass, and an email's
+ *     local part isn't mistaken for a key.
+ *   - Bounded: every replacement is a fixed-width placeholder, so masked output
+ *     can never be longer than a small multiple of the input.
+ *   - Never throws. A masker that crashes on the logging path is worse than one
+ *     that lets a borderline token through, so all input is coerced and any
+ *     internal failure falls back to returning the (coerced) input unchanged.
+ * ------------------------------------------------------------------------- */
+
+/**
+ * Ordered masking rules. Each `re` is a global regex; matched spans are replaced
+ * by `{label}` and counted. Order is significant — see the note above.
+ *
+ * @type {ReadonlyArray<{label:string, re:RegExp}>}
+ */
+const MASK_RULES = Object.freeze([
+  // Anthropic keys: sk-ant-... (must precede the generic sk- rule).
+  { label: "ANTHROPIC_KEY", re: /\bsk-ant-[A-Za-z0-9_-]{8,}/g },
+  // OpenAI-style project / legacy keys: sk-... and sk-proj-...
+  { label: "API_KEY", re: /\bsk-(?:proj-)?[A-Za-z0-9_-]{16,}/g },
+  // AWS access key id: AKIA / ASIA + 16 uppercase-alphanumerics.
+  { label: "AWS_KEY", re: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g },
+  // GitHub tokens: ghp_/gho_/ghu_/ghs_/ghr_ + 36+ chars; fine-grained github_pat_.
+  { label: "GITHUB_TOKEN", re: /\b(?:gh[pousr]_[A-Za-z0-9]{36,}|github_pat_[A-Za-z0-9_]{22,})\b/g },
+  // Slack tokens: xoxb-/xoxp-/xoxa-/xoxr-...
+  { label: "SLACK_TOKEN", re: /\bxox[baprs]-[A-Za-z0-9-]{10,}/g },
+  // Google API keys: AIza + 35 chars.
+  { label: "GOOGLE_KEY", re: /\bAIza[0-9A-Za-z_-]{35}\b/g },
+  // Bearer / Basic auth tokens in an Authorization-style position.
+  { label: "BEARER_TOKEN", re: /\b(Bearer|Basic)\s+[A-Za-z0-9._~+/=-]{8,}/gi },
+  // JWTs: three dot-separated base64url segments, first starts with eyJ.
+  { label: "JWT", re: /\beyJ[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}\b/g },
+  // Private-key PEM blocks.
+  { label: "PRIVATE_KEY", re: /-----BEGIN (?:[A-Z ]+ )?PRIVATE KEY-----[\s\S]*?-----END (?:[A-Z ]+ )?PRIVATE KEY-----/g },
+  // Email addresses.
+  { label: "EMAIL", re: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g },
+  // E.164-ish / common phone numbers: optional +, 10–15 digits with separators.
+  { label: "PHONE", re: /(?<![\w.])\+?\d[\d\s().-]{8,16}\d(?![\w.])/g },
+  // Long hex secrets (32+ hex chars) — token/session/hash material.
+  { label: "HEX_SECRET", re: /\b[0-9a-fA-F]{32,}\b/g },
+  // Long high-entropy base64/base64url runs (40+ chars) — generic secrets.
+  { label: "B64_SECRET", re: /\b[A-Za-z0-9+/_-]{40,}={0,2}\b/g },
+]);
+
+/**
+ * Mask PII and secret-shaped tokens in free text.
+ *
+ * Replaces each recognized span (vendor API keys, bearer/JWT tokens, PEM private
+ * keys, emails, phone numbers, long hex/base64 secrets) with a typed placeholder
+ * like `[REDACTED:EMAIL]` and reports how many substitutions were made. Benign
+ * text — ordinary words, short numbers, identifiers — is returned untouched.
+ *
+ * Never throws: non-string input is coerced; on any internal failure the coerced
+ * input is returned with `count: 0`. Suitable for the logging / model-router
+ * path where a crash is unacceptable.
+ *
+ * @param {string} text - The text to mask.
+ * @param {object} [opts]
+ * @param {(label:string)=>string} [opts.placeholder] - Custom placeholder
+ *   factory; defaults to ``[REDACTED:${label}]``.
+ * @returns {{text:string, count:number}} The masked text and substitution count.
+ */
+export function maskText(text, opts = {}) {
+  if (typeof text !== "string") {
+    if (text === null || text === undefined) return { text: "", count: 0 };
+    text = String(text);
+  }
+  if (text.length === 0) return { text, count: 0 };
+
+  const placeholder =
+    opts && typeof opts.placeholder === "function"
+      ? opts.placeholder
+      : (label) => `[${REDACTED_LABEL_PREFIX}${label}]`;
+
+  let out = text;
+  let count = 0;
+  try {
+    for (const { label, re } of MASK_RULES) {
+      // Fresh lastIndex per pass (global regexes are stateful).
+      re.lastIndex = 0;
+      out = out.replace(re, (match) => {
+        count += 1;
+        return placeholder(label);
+      });
+    }
+  } catch {
+    // Fail-open: never let masking crash the caller.
+    return { text, count: 0 };
+  }
+  return { text: out, count };
+}
+
+/**
+ * Placeholder prefix for {@link maskText}. Kept distinct from {@link REDACTED}
+ * (the URL/param mask placeholder) so the two redaction concerns don't collide.
+ * @type {string}
+ */
+export const REDACTED_LABEL_PREFIX = "REDACTED:";
+
+/**
+ * Convenience: mask free text and return only the cleaned string. Drop-in for
+ * an `(input:string)=>string` masker hook (e.g. `llmTask`'s `opts.maskInput`).
+ *
+ * @param {string} text
+ * @param {object} [opts] - Forwarded to {@link maskText}.
+ * @returns {string}
+ */
+export function maskTextString(text, opts = {}) {
+  return maskText(text, opts).text;
+}
+
+/**
+ * Deep-mask an arbitrary value, applying {@link maskText} to every string found
+ * (object values, array elements, nested structures). Returns a new value of the
+ * same shape with the total substitution count; the input is never mutated.
+ *
+ * Strings are masked; numbers / booleans / null / undefined pass through; keys
+ * are NOT masked (only values) so structure stays inspectable. Cycles are
+ * handled (a revisited reference is left as-is). Never throws.
+ *
+ * @param {*} obj - The value to deep-mask.
+ * @param {object} [opts] - Forwarded to {@link maskText}.
+ * @returns {{value:*, count:number}}
+ */
+export function redactObject(obj, opts = {}) {
+  let count = 0;
+  const seen = new WeakSet();
+
+  const walk = (value) => {
+    if (typeof value === "string") {
+      const r = maskText(value, opts);
+      count += r.count;
+      return r.text;
+    }
+    if (value === null || typeof value !== "object") return value;
+
+    if (seen.has(value)) return value; // cycle guard
+    seen.add(value);
+
+    if (Array.isArray(value)) {
+      return value.map((v) => walk(v));
+    }
+    // Plain object: walk own enumerable values, preserve keys verbatim.
+    const out = {};
+    for (const key of Object.keys(value)) {
+      out[key] = walk(value[key]);
+    }
+    return out;
+  };
+
+  try {
+    const value = walk(obj);
+    return { value, count };
+  } catch {
+    return { value: obj, count };
+  }
+}
+
+/* ------------------------------------------------------------------------- *
+ * IP classification
+ * ------------------------------------------------------------------------- */
+
+/**
+ * Parse a dotted-quad IPv4 string into its four octets.
+ *
+ * @param {string} ip
+ * @returns {number[] | null} `[a,b,c,d]` or null if not a valid IPv4 literal.
+ */
+function parseIPv4(ip) {
+  if (isIP(ip) !== 4) return null;
+  const parts = ip.split(".");
+  if (parts.length !== 4) return null;
+  const octets = parts.map((p) => Number(p));
+  for (const o of octets) {
+    if (!Number.isInteger(o) || o < 0 || o > 255) return null;
+  }
+  return octets;
+}
+
+/**
+ * Classify an IPv4 address (given as octets) as private / loopback /
+ * link-local / reserved / unspecified / broadcast.
+ *
+ * Covers, per RFC 1918 / 3927 / 5735 / 6598 / 5771 etc.:
+ *   0.0.0.0/8        unspecified / "this network"
+ *   10.0.0.0/8       private
+ *   100.64.0.0/10    CGNAT shared address space
+ *   127.0.0.0/8      loopback
+ *   169.254.0.0/16   link-local
+ *   172.16.0.0/12    private
+ *   192.0.0.0/24     IETF protocol assignments
+ *   192.0.2.0/24     TEST-NET-1 (documentation)
+ *   192.168.0.0/16   private
+ *   198.18.0.0/15    benchmarking
+ *   198.51.100.0/24  TEST-NET-2
+ *   203.0.113.0/24   TEST-NET-3
+ *   224.0.0.0/4      multicast (reserved for our purposes)
+ *   240.0.0.0/4      reserved (incl. 255.255.255.255 broadcast)
+ *
+ * @param {number[]} o - Four octets.
+ * @returns {boolean}
+ */
+function isPrivateOrReservedIPv4(o) {
+  const [a, b] = o;
+
+  if (a === 0) return true; // 0.0.0.0/8
+  if (a === 10) return true; // 10.0.0.0/8
+  if (a === 127) return true; // 127.0.0.0/8 loopback
+  if (a === 169 && b === 254) return true; // 169.254.0.0/16 link-local
+  if (a === 172 && b >= 16 && b <= 31) return true; // 172.16.0.0/12
+  if (a === 192 && b === 168) return true; // 192.168.0.0/16
+  if (a === 100 && b >= 64 && b <= 127) return true; // 100.64.0.0/10 CGNAT
+  if (a === 192 && b === 0 && o[2] === 0) return true; // 192.0.0.0/24
+  if (a === 192 && b === 0 && o[2] === 2) return true; // 192.0.2.0/24 TEST-NET-1
+  if (a === 198 && (b === 18 || b === 19)) return true; // 198.18.0.0/15 bench
+  if (a === 198 && b === 51 && o[2] === 100) return true; // 198.51.100.0/24
+  if (a === 203 && b === 0 && o[2] === 113) return true; // 203.0.113.0/24
+  if (a >= 224 && a <= 239) return true; // 224.0.0.0/4 multicast
+  if (a >= 240) return true; // 240.0.0.0/4 reserved + broadcast
+
+  return false;
+}
+
+/**
+ * Expand an IPv6 literal into an array of 8 16-bit groups (numbers).
+ * Handles `::` zero-compression and trailing IPv4-dotted form
+ * (e.g. `::ffff:10.0.0.1`). Returns null on anything invalid.
+ *
+ * @param {string} ip
+ * @returns {number[] | null} Eight 16-bit groups, or null.
+ */
+function parseIPv6Groups(ip) {
+  if (isIP(ip) !== 6) return null;
+
+  // Strip a zone id (%eth0) if present — irrelevant to classification.
+  const pct = ip.indexOf("%");
+  if (pct !== -1) ip = ip.slice(0, pct);
+
+  let head = ip;
+  let tailV4Groups = [];
+
+  // Embedded IPv4 (last 32 bits written in dotted-quad form).
+  const lastColon = head.lastIndexOf(":");
+  const maybeV4 = lastColon === -1 ? "" : head.slice(lastColon + 1);
+  if (maybeV4.includes(".")) {
+    const v4 = parseIPv4(maybeV4);
+    if (!v4) return null;
+    tailV4Groups = [(v4[0] << 8) | v4[1], (v4[2] << 8) | v4[3]];
+    head = head.slice(0, lastColon + 1); // keep trailing ':' for splitting
+    // remove the now-dangling segment after the colon
+    head = head.slice(0, -1);
+  }
+
+  const doubleColon = head.indexOf("::");
+  /** @type {string[]} */
+  let leftParts = [];
+  /** @type {string[]} */
+  let rightParts = [];
+
+  if (doubleColon !== -1) {
+    const left = head.slice(0, doubleColon);
+    const right = head.slice(doubleColon + 2);
+    leftParts = left.length ? left.split(":") : [];
+    rightParts = right.length ? right.split(":") : [];
+  } else {
+    leftParts = head.length ? head.split(":") : [];
+  }
+
+  /** @type {number[]} */
+  const leftGroups = leftParts.map((h) => parseInt(h, 16));
+  /** @type {number[]} */
+  const rightGroups = rightParts.map((h) => parseInt(h, 16));
+
+  for (const g of leftGroups) if (!Number.isInteger(g) || g < 0 || g > 0xffff) return null;
+  for (const g of rightGroups) if (!Number.isInteger(g) || g < 0 || g > 0xffff) return null;
+
+  const totalKnown = leftGroups.length + rightGroups.length + tailV4Groups.length;
+  if (doubleColon === -1) {
+    if (totalKnown !== 8) return null;
+    return [...leftGroups, ...tailV4Groups];
+  }
+
+  const fill = 8 - totalKnown;
+  if (fill < 0) return null;
+  return [
+    ...leftGroups,
+    ...new Array(fill).fill(0),
+    ...rightGroups,
+    ...tailV4Groups,
+  ];
+}
+
+/**
+ * Classify an IPv6 address (given as 8 groups) as private / loopback /
+ * link-local / reserved.
+ *
+ * Covers:
+ *   ::               unspecified
+ *   ::1              loopback
+ *   ::ffff:0:0/96    IPv4-mapped  → delegated to the embedded IPv4 check
+ *   ::/96 (deprecated IPv4-compatible) → embedded IPv4 check
+ *   64:ff9b::/96     NAT64        → embedded IPv4 check
+ *   fc00::/7         unique local (ULA)
+ *   fe80::/10        link-local
+ *   fec0::/10        site-local (deprecated, reserved)
+ *   ff00::/8         multicast
+ *
+ * @param {number[]} g - Eight 16-bit groups.
+ * @returns {boolean}
+ */
+function isPrivateOrReservedIPv6(g) {
+  // Unspecified ::
+  if (g.every((x) => x === 0)) return true;
+  // Loopback ::1
+  if (g[0] === 0 && g[1] === 0 && g[2] === 0 && g[3] === 0 && g[4] === 0 && g[5] === 0 && g[6] === 0 && g[7] === 1) {
+    return true;
+  }
+
+  const firstSixZero = g[0] === 0 && g[1] === 0 && g[2] === 0 && g[3] === 0 && g[4] === 0;
+
+  // IPv4-mapped ::ffff:a.b.c.d  → classify by the embedded IPv4.
+  if (firstSixZero && g[5] === 0xffff) {
+    return isPrivateOrReservedIPv4(groupsToV4Octets(g[6], g[7]));
+  }
+  // IPv4-compatible ::a.b.c.d (deprecated) — also bypass-prone; check embedded.
+  if (g[0] === 0 && g[1] === 0 && g[2] === 0 && g[3] === 0 && g[4] === 0 && g[5] === 0 && !(g[6] === 0 && g[7] === 0) && !(g[6] === 0 && g[7] === 1)) {
+    return isPrivateOrReservedIPv4(groupsToV4Octets(g[6], g[7]));
+  }
+  // NAT64 64:ff9b::/96 — embeds an IPv4; classify by it.
+  if (g[0] === 0x64 && g[1] === 0xff9b && g[2] === 0 && g[3] === 0 && g[4] === 0 && g[5] === 0) {
+    return isPrivateOrReservedIPv4(groupsToV4Octets(g[6], g[7]));
+  }
+
+  const first = g[0];
+  if ((first & 0xfe00) === 0xfc00) return true; // fc00::/7 ULA
+  if ((first & 0xffc0) === 0xfe80) return true; // fe80::/10 link-local
+  if ((first & 0xffc0) === 0xfec0) return true; // fec0::/10 site-local
+  if ((first & 0xff00) === 0xff00) return true; // ff00::/8 multicast
+
+  return false;
+}
+
+/**
+ * Convert two 16-bit groups into four IPv4 octets.
+ *
+ * @param {number} hi
+ * @param {number} lo
+ * @returns {number[]}
+ */
+function groupsToV4Octets(hi, lo) {
+  return [(hi >> 8) & 0xff, hi & 0xff, (lo >> 8) & 0xff, lo & 0xff];
+}
+
+/**
+ * True if `host` is a private, loopback, link-local, or otherwise
+ * reserved/non-routable IP address.
+ *
+ * Accepts IPv4 and IPv6 literals, with or without surrounding brackets
+ * (`[::1]`) and with an optional IPv6 zone id (`fe80::1%eth0`). Crucially it is
+ * NOT fooled by IPv4-mapped-IPv6 forms such as `::ffff:10.0.0.1` or
+ * `::ffff:127.0.0.1`, which embed a private/loopback IPv4 inside an IPv6
+ * literal — those return true.
+ *
+ * Hostnames (anything that is not a valid IP literal) return false: this
+ * function classifies addresses, not names. Resolve names to addresses first
+ * if you need to guard against DNS-based bypasses. Never throws.
+ *
+ * @param {string} host - An IP literal (IPv4 or IPv6), optionally bracketed.
+ * @returns {boolean}
+ */
+export function isPrivateOrReservedIp(host) {
+  if (typeof host !== "string") return false;
+
+  let h = host.trim();
+  if (h.length === 0) return false;
+
+  // Strip surrounding brackets used for IPv6 in URLs: [::1] -> ::1
+  if (h.startsWith("[") && h.endsWith("]")) {
+    h = h.slice(1, -1);
+  }
+
+  const kind = isIP(h);
+  if (kind === 4) {
+    const o = parseIPv4(h);
+    return o ? isPrivateOrReservedIPv4(o) : false;
+  }
+  if (kind === 6) {
+    const g = parseIPv6Groups(h);
+    return g ? isPrivateOrReservedIPv6(g) : false;
+  }
+
+  return false; // not an IP literal
+}
+
+export default {
+  REDACTED,
+  SENSITIVE_PARAM_KEYS,
+  isSensitiveParamName,
+  redactSensitiveUrl,
+  isPrivateOrReservedIp,
+  REDACTED_LABEL_PREFIX,
+  maskText,
+  maskTextString,
+  redactObject,
+};