@descryy/runtime-evidence-store 0.3.0 → 0.4.0

package/dist/redaction.js

@@ -1,96 +1,53 @@
 /**
- * Redaction (plan §28): "Raw runtime evidence must not automatically
- * become unrestricted AI context." This runs at write time, unconditionally
- * — `EvidenceStore.write` has no code path that skips it — rather than at
- * read time, because a read-time pass is one forgotten call site away from
- * failing (peer's framing, kept verbatim since it's exactly right).
- *
- * Extends the original key-name-only pass with the two capabilities §28
- * names that a pure key-name walk structurally cannot reach:
- *
- * - **Body filtering.** `NETWORK_REQUEST`/`NETWORK_RESPONSE` evidence
- *   (`packages/browser`) carries `postData`/`body` as a JSON- or
- *   text-*encoded string*, not a parsed object -- the original redact()
- *   walks object structure, so a secret sitting inside that string (a
- *   `{"password": "hunter2"}` request body, say) was invisible to it
- *   regardless of how complete `SENSITIVE_KEY_PATTERN` was. Body-bearing
- *   keys now get parsed (if JSON) and recursed into with the same rules,
- *   or pattern-scanned as text otherwise.
- * - **PII-aware field filtering.** A separate, independently toggleable
- *   pattern from credentials -- these are different concerns with
- *   different owners in a real system (security vs. privacy), and
- *   collapsing them into one pattern would make either impossible to
- *   reason about or configure on its own.
- *
- * **Configurable by whom, refused how (the two questions this row asked to
- * have decided rather than defaulted):** by whoever constructs the
- * `EvidenceStore` (`RedactionPolicy`, plumbed through
- * `EvidenceStoreOptions` -- see `evidence-store.ts`), and every filter
- * fails closed, disclosed, not silent: a value the body/PII filter cannot
- * classify at all (not JSON, not text that looks safe to pattern-scan) is
- * withheld wholesale rather than passed through on the assumption that
- * "couldn't parse it" means "couldn't be sensitive." A marker replaces the
- * value in place -- the key survives, so a reader can see *that* something
- * was withheld, never just find it missing (same discipline the original
- * key-based pass already established with `[REDACTED]`).
- *
- * **Not a claim of completeness.** Pattern-based text scanning is
- * inherently partial -- a sensitive string shaped unlike every pattern
- * here passes through unredacted, honestly, not silently promised as
- * covered. What the "fail closed" guarantee actually claims: content this
- * module cannot even classify never leaks by default; content it can
- * classify gets the patterns below applied, not more.
+ * Redaction (plan §28): raw runtime evidence must not automatically become
+ * unrestricted AI context. Runs at write time, unconditionally — a
+ * read-time pass is one forgotten call site away from failing.
+ *
+ * Extends the key-name-only pass with two capabilities a pure key walk
+ * can't reach: body filtering (bodies are JSON/text-*encoded strings*, not
+ * parsed objects, so a secret inside one was invisible to key matching —
+ * body-bearing keys are now parsed if JSON and recursed into, or
+ * pattern-scanned as text), and PII filtering, kept as a separate
+ * independently toggleable pattern from credentials.
+ *
+ * Configurable via `RedactionPolicy` (`EvidenceStoreOptions`). Every filter
+ * fails closed: content it can't classify at all is withheld wholesale
+ * rather than assumed safe. A marker replaces the value in place — the key
+ * survives so a reader can see *that* something was withheld.
+ *
+ * Not a claim of completeness — pattern-based text scanning is inherently
+ * partial. Fail-closed only claims: unclassifiable content never leaks by
+ * default; classifiable content gets the patterns below, not more.
  */
 const SENSITIVE_KEY_PATTERN = /^(authorization|cookie|set-cookie|token|secret|password|passwd|api[-_]?key|access[-_]?token|refresh[-_]?token|client[-_]?secret|private[-_]?key|session(id)?|bearer)$/i;
 const PII_KEY_PATTERN = /^(email|e-?mail(?:[-_]?address)?|phone(?:[-_]?number)?|mobile|ssn|social[-_]?security(?:[-_]?number)?|dob|date[-_]?of[-_]?birth|address|street[-_]?address|first[-_]?name|last[-_]?name|full[-_]?name|credit[-_]?card(?:[-_]?number)?|card[-_]?number|cvv|national[-_]?id|passport(?:[-_]?number)?)$/i;
 /**
- * Free-text-bearing keys: request/response bodies AND §28's separate
- * "sensitive log filtering" item -- `raw` is `LogCollector`'s payload key
- * for a `BACKEND_LOG`/`EXCEPTION`/`STACK_TRACE`'s captured text
- * (`backend-observation/collector.ts`), the same "an app can print a
- * secret as plain text, not just carry one as a structured field" problem
- * body filtering exists for, just from a different producer.
+ * Free-text-bearing keys: request/response bodies plus `raw`
+ * (`LogCollector`'s captured `BACKEND_LOG`/`EXCEPTION`/`STACK_TRACE` text)
+ * — an app can print a secret as plain text, not just carry it structured.
  */
 const BODY_BEARING_KEY_PATTERN = /^(body|post[-_]?data|request[-_]?body|response[-_]?body|raw)$/i;
 /**
- * Keys whose value is a **command line** -- `command`, `args`, `argv`, `cmd`.
- *
- * **Added because a claim was written before it was true (RT-069).** The
- * execution record persisted for replay carries
- * `configuration.services[x].command`, and the note justifying it said a
- * command line is one of the classic places a credential travels. It is --
- * and nothing here caught one. Measured: `node server.mjs --api-key=SEKRET`
- * went through `redact()` untouched, `redactedKeys: []`. `command` is not
- * body-bearing, so it was never scanned; and even body scanning would have
- * missed it, since the text patterns look for emails, card numbers and long
- * tokens, and a short flag value is none of those.
- *
- * A command line needs its own scanner because its secrets are **positional
- * rather than lexical**: what marks `SEKRET` as sensitive is not the value's
- * shape but the *flag in front of it*.
+ * Keys whose value is a command line (RT-069: measured
+ * `node server.mjs --api-key=SEKRET` passed through untouched,
+ * `redactedKeys: []` — `command` isn't body-bearing so it was never
+ * scanned, and text patterns look for emails/cards/long tokens, not short
+ * flag values). Needs its own scanner because secrets here are
+ * **positional**: the flag in front marks the value, not its shape.
  */
 const COMMAND_BEARING_KEY_PATTERN = /^(command|args|argv|cmd)$/i;
 /**
- * A flag or environment assignment whose NAME says the value after it is a
- * credential: `--api-key=x`, `-token x`, `DATABASE_PASSWORD=x`,
- * `--client-secret=x`.
- *
- * Deliberately name-driven and deliberately narrow. The alternative --
- * redacting anything that looks high-entropy -- destroys ordinary arguments
- * (a commit sha, a port, a base64 fixture path) and would make a redacted
- * command unreadable, which costs the reader the thing a command line is
- * kept for.
+ * A flag/env assignment whose NAME says the value is a credential:
+ * `--api-key=x`, `DATABASE_PASSWORD=x`. Deliberately narrow — redacting
+ * anything high-entropy would destroy ordinary arguments (a sha, a port)
+ * and make the command unreadable.
  */
 const SENSITIVE_ARG_NAME = /(?:key|token|secret|password|passwd|auth|credential|bearer|cookie)/i;
 /**
- * Names that contain a sensitive word but whose value is a **location, not a
- * credential**: `--keys-dir`, `--secret-file`, `--token-path`, `--key-store`.
- *
- * Measured while writing this: `--keys-dir keys/dev.json` was redacted, which
- * is a false positive that costs a reader a real path and protects nothing --
- * the secret is the file's *contents*, which never appear on the command
- * line. Excluded so the scanner keeps the information it has no reason to
- * destroy.
+ * Names with a sensitive word but a **location** value: `--keys-dir`,
+ * `--token-path`. Measured false positive: `--keys-dir keys/dev.json` was
+ * redacted for no protection (the secret is the file's contents, not the
+ * path). Excluded.
  */
 const LOCATION_ARG_NAME = /(?:[-_](?:dir|directory|path|file|store|folder)|file|path)$/i;
 const ARG_ASSIGNMENT = /^(-{0,2}[A-Za-z0-9_.-]*?)([=:])(.+)$/;
@@ -100,39 +57,19 @@ const REDACTED_BODY_MARKER = "[REDACTED-BODY]";
 // inside what would also match the generic token pattern gets the more
 // specific marker.
 /**
- * **Every quantifier here is bounded, and that is a fix rather than a style
- * choice (RT-069).** The previous form was
- * `/[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g`, whose unbounded
- * leading `+` backtracks catastrophically on text containing no `@`: the
- * class consumes the whole input, fails to find `@`, gives back one
- * character, and retries — O(n²).
- *
- * Measured, on a string of `x` with no `@` in it:
- *
- * | input | old | new |
- * | --- | --- | --- |
- * | 16 KB | 98 ms | 2.8 ms |
- * | 64 KB | 2,073 ms | 10.7 ms |
- * | 2 MB | ~35 min (extrapolated) | 218 ms |
- *
- * **This was a denial of service on our own collection path, reachable by
- * ordinary application output.** Any backend log line of a few tens of
- * kilobytes without an `@` — a serialised object, a stack dump, a base64
- * blob — would wedge `redact()`, and `redact()` sits on the only write path
- * into the store. Found by a §19 "large payload" test that hung instead of
- * failing, which is the one symptom easy to mistake for a slow test.
- *
- * The bounds are RFC-shaped rather than invented: 64 characters for the local
- * part (RFC 5321's limit), 63 per domain label, up to eight labels, 2–24 for
- * the TLD. Verified behaviourally identical to the old pattern on every
- * address form in this file's tests — the change costs no match and removes
- * the quadratic.
+ * Every quantifier here is bounded — a fix, not style (RT-069). The old
+ * unbounded-`+` form backtracked catastrophically with no `@` in the text
+ * (O(n²)): 16KB/98ms → 2.8ms, 64KB/2073ms → 10.7ms, 2MB/~35min → 218ms. A
+ * real DoS on the only write path into the store, reachable by ordinary
+ * backend log output with no `@` (a stack dump, base64 blob).
+ *
+ * Bounds are RFC-shaped: 64 chars local part (RFC 5321), 63 per label, up
+ * to 8 labels, 2-24 for TLD. Verified behaviorally identical to the old
+ * pattern in this file's tests.
  */
 const EMAIL_PATTERN = /[a-zA-Z0-9._%+-]{1,64}@[a-zA-Z0-9-]{1,63}(?:\.[a-zA-Z0-9-]{1,63}){0,8}\.[a-zA-Z]{2,24}/g;
-// Anchored to always end on a digit -- (?:\d[ -]?){13,16} over-consumes a
-// trailing space/dash that follows the number but isn't part of it
-// (caught by a real test: "card 4111 1111 1111 1111 successfully" matched
-// through the space before "successfully").
+// Anchored to end on a digit — (?:\d[ -]?){13,16} over-consumed a trailing
+// space/dash (caught by a test: matched through "successfully" after a card number).
 const CREDIT_CARD_PATTERN = /\b\d(?:[ -]?\d){12,15}\b/g;
 const GENERIC_TOKEN_PATTERN = /\b[A-Za-z0-9_-]{24,}\b/g;
 const TEXT_SCAN_PATTERNS = [EMAIL_PATTERN, CREDIT_CARD_PATTERN, GENERIC_TOKEN_PATTERN];
@@ -147,14 +84,7 @@ export function redact(payload, policy = {}) {
         redactedKeys,
     };
 }
-/**
- * Which keys the default policy would redact, without redacting anything.
- *
- * The tool a collector author needs *before* shipping a payload shape: hand
- * it the key names, get back the ones that collide and would be wiped. The
- * `sessionId` collision (RT-063) was a name nobody thought to check against
- * a pattern list nobody thought to read, and the check costs one call.
- */
+/** Which keys the default policy would redact, without redacting anything — check a payload shape before shipping it (RT-063's `sessionId` collision cost one call to catch). */
 export function collidingKeys(keys, policy = {}) {
     const resolved = { ...DEFAULT_POLICY, ...policy };
     return keys.filter((key) => SENSITIVE_KEY_PATTERN.test(key) ||
@@ -203,26 +133,20 @@ function redactValue(value, policy, path, redactedKeys) {
         }
         return { value: result, redacted };
     }
-    // A body-bearing key's value that isn't a string (null, or a non-string
-    // primitive some future producer emits) has nothing this module can
-    // scan -- left as-is, since a bare number or boolean can't itself carry
-    // a secret the way an encoded string can.
+    // Non-string primitives can't carry a secret the way an encoded string can.
     return { value, redacted: false };
 }
 /** JSON-shaped body content is parsed and recursed into; anything else is scanned as text, or withheld wholesale if it doesn't even look like text. */
 function redactBodyString(text, policy, path, redactedKeys) {
     const parsed = tryParseJson(text);
     if (parsed !== undefined) {
-        // The body's own keys are reported under the body's path, so an operator
-        // can tell `headers.authorization` from `body.authorization` — different
-        // producers, different fixes.
+        // Reported under the body's own path so `headers.authorization` stays
+        // distinct from `body.authorization` — different producers, different fixes.
         const inner = redactValue(parsed, policy, path, redactedKeys);
         return { value: JSON.stringify(inner.value), redacted: inner.redacted };
     }
     if (!looksLikeText(text)) {
-        // Fails closed: content this module cannot even classify as text is
-        // withheld wholesale rather than passed through on the assumption
-        // that "couldn't parse it" means "couldn't be sensitive."
+        // Fails closed: unclassifiable content is withheld wholesale.
         redactedKeys.push(path);
         return { value: REDACTED_BODY_MARKER, redacted: true };
     }
@@ -231,9 +155,8 @@ function redactBodyString(text, policy, path, redactedKeys) {
 function tryParseJson(text) {
     const trimmed = text.trim();
     if (trimmed.length === 0 || (trimmed[0] !== "{" && trimmed[0] !== "[")) {
-        // A bare string/number/boolean JSON body ("true", "42") is technically
-        // valid JSON but never carries nested keys to redact -- treated as
-        // plain text instead, so the patterns below still get a chance at it.
+        // A bare "true"/"42" is valid JSON but carries no nested keys — treated
+        // as plain text so the patterns below still get a chance at it.
         return undefined;
     }
     try {
@@ -270,34 +193,19 @@ function redactPlainText(text) {
 }
 /**
  * Redact credential values out of a command line, keeping the shape.
- *
- * Two forms, because a command line has two:
- *
- * - **Attached** -- `--api-key=SEKRET`, `TOKEN:abc`, `DB_PASSWORD=hunter2`.
- *   The name and the separator survive; only the value is replaced.
- * - **Detached** -- `["--api-key", "SEKRET"]` or `--api-key SEKRET`, where the
- *   secret is the *next* token. This is the form a naive per-token scanner
- *   misses entirely: `SEKRET` on its own carries nothing that marks it as a
- *   secret, and the only thing that does is the token before it.
- *
- * A detached flag at the very end of a command consumes nothing -- there is
- * no value to redact, and inventing one would corrupt the command.
- *
- * The name and separator are kept on purpose. A command redacted to
- * `[REDACTED]` wholesale is useless to the reader it was persisted for; a
- * command redacted to `node server.mjs --api-key=[REDACTED]` still answers
- * "what was run, and with what shape of argument".
+ * Two forms: attached (`--api-key=SEKRET`, name/separator survive) and
+ * detached (`--api-key SEKRET`, secret is the *next* token — what a naive
+ * per-token scanner misses). A detached flag at the end consumes nothing.
+ * Name/separator kept so a redacted command still answers "what was run,
+ * with what shape of argument", not just `[REDACTED]` wholesale.
  */
 export function redactCommand(value) {
     if (Array.isArray(value)) {
         const out = redactTokens(value);
         return { value: out.tokens, redacted: out.redacted };
     }
-    // Split on whitespace, redact, rejoin. This does not attempt to parse
-    // shell quoting -- `tokenizeCommand` (controller) already refuses shell
-    // metacharacters, so a command reaching here is a plain argv-shaped
-    // string, and a quoting parser would be machinery for a case this repo
-    // deliberately does not accept.
+    // Split/rejoin on whitespace, no shell-quoting parser — `tokenizeCommand`
+    // already refuses shell metacharacters upstream.
     const tokens = String(value).split(/\s+/);
     const out = redactTokens(tokens);
     return { value: out.tokens.join(" "), redacted: out.redacted };
@@ -319,9 +227,8 @@ function redactTokens(tokens) {
             redacted = true;
             continue;
         }
-        // A bare sensitive-looking flag arms the next token. Only a flag --
-        // a bare word containing "key" (a path like `keys/dev.json`) must not
-        // swallow whatever follows it.
+        // Only a flag arms the next token — a bare word like `keys/dev.json`
+        // must not swallow whatever follows.
         if (token.startsWith("-") && isSensitiveArgName(token)) {
             result.push(token);
             consumeNext = true;

package/dist/redaction.js.map

@@ -1 +1 @@
-{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../src/redaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAIH,MAAM,qBAAqB,GACzB,wKAAwK,CAAC;AAE3K,MAAM,eAAe,GACnB,uSAAuS,CAAC;AAE1S;;;;;;;GAOG;AACH,MAAM,wBAAwB,GAAG,gEAAgE,CAAC;AAElG;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,2BAA2B,GAAG,4BAA4B,CAAC;AAEjE;;;;;;;;;;GAUG;AACH,MAAM,kBAAkB,GAAG,qEAAqE,CAAC;AACjG;;;;;;;;;GASG;AACH,MAAM,iBAAiB,GAAG,8DAA8D,CAAC;AACzF,MAAM,cAAc,GAAG,sCAAsC,CAAC;AAE9D,MAAM,eAAe,GAAG,YAAY,CAAC;AACrC,MAAM,oBAAoB,GAAG,iBAAiB,CAAC;AAE/C,wEAAwE;AACxE,uEAAuE;AACvE,mBAAmB;AACnB;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,aAAa,GAAG,yFAAyF,CAAC;AAChH,0EAA0E;AAC1E,mEAAmE;AACnE,0EAA0E;AAC1E,4CAA4C;AAC5C,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AACxD,MAAM,qBAAqB,GAAG,yBAAyB,CAAC;AAExD,MAAM,kBAAkB,GAAsB,CAAC,aAAa,EAAE,mBAAmB,EAAE,qBAAqB,CAAC,CAAC;AAS1G,MAAM,cAAc,GAA8B,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;AAsC9F,MAAM,UAAU,MAAM,CAAC,OAAgB,EAAE,SAA0B,EAAE;IACnE,MAAM,QAAQ,GAA8B,EAAE,GAAG,cAAc,EAAE,GAAG,MAAM,EAAE,CAAC;IAC7E,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,YAAY,CAAC,CAAC;IAC7E,OAAO;QACL,OAAO,EAAE,KAAK;QACd,eAAe,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,cAAc;QACvD,YAAY;KACb,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,IAAuB,EAAE,SAA0B,EAAE;IACjF,MAAM,QAAQ,GAA8B,EAAE,GAAG,cAAc,EAAE,GAAG,MAAM,EAAE,CAAC;IAC7E,OAAO,IAAI,CAAC,MAAM,CAChB,CAAC,GAAG,EAAE,EAAE,CACN,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC;QAC/B,CAAC,QAAQ,CAAC,YAAY,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpD,CAAC,QAAQ,CAAC,aAAa,IAAI,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CACjE,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,MAAc,EAAE,GAAW;IACvC,OAAO,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,WAAW,CAClB,KAAc,EACd,MAAiC,EACjC,IAAY,EACZ,YAAsB;IAEtB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YACvC,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,YAAY,CAAC,CAAC;YAC3E,QAAQ,GAAG,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC;YACtC,OAAO,KAAK,CAAC,KAAK,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACrC,CAAC;IAED,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YAC1E,IAAI,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBAC1F,MAAM,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC;gBAC9B,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;gBACnC,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;iBAAM,IAAI,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACpG,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;gBACjC,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;gBAC1B,IAAI,KAAK,CAAC,QAAQ;oBAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;gBACvD,QAAQ,GAAG,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC;YACxC,CAAC;iBAAM,IAAI,MAAM,CAAC,aAAa,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjG,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,YAAY,CAAC,CAAC;gBAC3E,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;gBAC1B,QAAQ,GAAG,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC;YACxC,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,YAAY,CAAC,CAAC;gBACtE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;gBAC1B,QAAQ,GAAG,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC;YACxC,CAAC;QACH,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACrC,CAAC;IAED,wEAAwE;IACxE,oEAAoE;IACpE,wEAAwE;IACxE,0CAA0C;IAC1C,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACpC,CAAC;AAED,uJAAuJ;AACvJ,SAAS,gBAAgB,CACvB,IAAY,EACZ,MAAiC,EACjC,IAAY,EACZ,YAAsB;IAEtB,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,yEAAyE;QACzE,yEAAyE;QACzE,8BAA8B;QAC9B,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;QAC9D,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;IAC1E,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,oEAAoE;QACpE,kEAAkE;QAClE,0DAA0D;QAC1D,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACzD,CAAC;IAED,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QACvE,uEAAuE;QACvE,mEAAmE;QACnE,sEAAsE;QACtE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,uGAAuG;AACvG,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,kBAAkB,GAAG,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,EAAE,CAAC;QACpE,IAAI,CAAC,kBAAkB,IAAI,IAAI,GAAG,IAAI,EAAE,CAAC;YACvC,YAAY,EAAE,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,YAAY,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;AAC3C,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;QACzC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE;YACpC,QAAQ,GAAG,IAAI,CAAC;YAChB,OAAO,eAAe,CAAC;QACzB,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,aAAa,CAAC,KAAiC;IAC7D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,YAAY,CAAC,KAA0B,CAAC,CAAC;QACrD,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;IACvD,CAAC;IACD,sEAAsE;IACtE,wEAAwE;IACxE,oEAAoE;IACpE,uEAAuE;IACvE,gCAAgC;IAChC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACjC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;AACjE,CAAC;AAED,SAAS,YAAY,CAAC,MAAyB;IAC7C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,WAAW,GAAG,KAAK,CAAC;IAExB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC7B,QAAQ,GAAG,IAAI,CAAC;YAChB,WAAW,GAAG,KAAK,CAAC;YACpB,SAAS;QACX,CAAC;QAED,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,UAAU,KAAK,IAAI,IAAI,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACnE,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,eAAe,EAAE,CAAC,CAAC;YAClE,QAAQ,GAAG,IAAI,CAAC;YAChB,SAAS;QACX,CAAC;QAED,oEAAoE;QACpE,sEAAsE;QACtE,+BAA+B;QAC/B,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;YACvD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,WAAW,GAAG,IAAI,CAAC;YACnB,SAAS;QACX,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACtC,OAAO,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxE,CAAC"}
+{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../src/redaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,MAAM,qBAAqB,GACzB,wKAAwK,CAAC;AAE3K,MAAM,eAAe,GACnB,uSAAuS,CAAC;AAE1S;;;;GAIG;AACH,MAAM,wBAAwB,GAAG,gEAAgE,CAAC;AAElG;;;;;;;GAOG;AACH,MAAM,2BAA2B,GAAG,4BAA4B,CAAC;AAEjE;;;;;GAKG;AACH,MAAM,kBAAkB,GAAG,qEAAqE,CAAC;AACjG;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,8DAA8D,CAAC;AACzF,MAAM,cAAc,GAAG,sCAAsC,CAAC;AAE9D,MAAM,eAAe,GAAG,YAAY,CAAC;AACrC,MAAM,oBAAoB,GAAG,iBAAiB,CAAC;AAE/C,wEAAwE;AACxE,uEAAuE;AACvE,mBAAmB;AACnB;;;;;;;;;;GAUG;AACH,MAAM,aAAa,GAAG,yFAAyF,CAAC;AAChH,2EAA2E;AAC3E,qFAAqF;AACrF,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AACxD,MAAM,qBAAqB,GAAG,yBAAyB,CAAC;AAExD,MAAM,kBAAkB,GAAsB,CAAC,aAAa,EAAE,mBAAmB,EAAE,qBAAqB,CAAC,CAAC;AAS1G,MAAM,cAAc,GAA8B,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;AAwB9F,MAAM,UAAU,MAAM,CAAC,OAAgB,EAAE,SAA0B,EAAE;IACnE,MAAM,QAAQ,GAA8B,EAAE,GAAG,cAAc,EAAE,GAAG,MAAM,EAAE,CAAC;IAC7E,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,YAAY,CAAC,CAAC;IAC7E,OAAO;QACL,OAAO,EAAE,KAAK;QACd,eAAe,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,cAAc;QACvD,YAAY;KACb,CAAC;AACJ,CAAC;AAED,iLAAiL;AACjL,MAAM,UAAU,aAAa,CAAC,IAAuB,EAAE,SAA0B,EAAE;IACjF,MAAM,QAAQ,GAA8B,EAAE,GAAG,cAAc,EAAE,GAAG,MAAM,EAAE,CAAC;IAC7E,OAAO,IAAI,CAAC,MAAM,CAChB,CAAC,GAAG,EAAE,EAAE,CACN,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC;QAC/B,CAAC,QAAQ,CAAC,YAAY,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpD,CAAC,QAAQ,CAAC,aAAa,IAAI,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CACjE,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,MAAc,EAAE,GAAW;IACvC,OAAO,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,WAAW,CAClB,KAAc,EACd,MAAiC,EACjC,IAAY,EACZ,YAAsB;IAEtB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YACvC,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,YAAY,CAAC,CAAC;YAC3E,QAAQ,GAAG,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC;YACtC,OAAO,KAAK,CAAC,KAAK,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACrC,CAAC;IAED,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YAC1E,IAAI,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBAC1F,MAAM,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC;gBAC9B,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;gBACnC,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;iBAAM,IAAI,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACpG,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;gBACjC,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;gBAC1B,IAAI,KAAK,CAAC,QAAQ;oBAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;gBACvD,QAAQ,GAAG,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC;YACxC,CAAC;iBAAM,IAAI,MAAM,CAAC,aAAa,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjG,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,YAAY,CAAC,CAAC;gBAC3E,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;gBAC1B,QAAQ,GAAG,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC;YACxC,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,YAAY,CAAC,CAAC;gBACtE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;gBAC1B,QAAQ,GAAG,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC;YACxC,CAAC;QACH,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACrC,CAAC;IAED,4EAA4E;IAC5E,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACpC,CAAC;AAED,uJAAuJ;AACvJ,SAAS,gBAAgB,CACvB,IAAY,EACZ,MAAiC,EACjC,IAAY,EACZ,YAAsB;IAEtB,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,sEAAsE;QACtE,6EAA6E;QAC7E,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;QAC9D,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;IAC1E,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,8DAA8D;QAC9D,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACzD,CAAC;IAED,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QACvE,wEAAwE;QACxE,gEAAgE;QAChE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,uGAAuG;AACvG,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,kBAAkB,GAAG,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,EAAE,CAAC;QACpE,IAAI,CAAC,kBAAkB,IAAI,IAAI,GAAG,IAAI,EAAE,CAAC;YACvC,YAAY,EAAE,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,YAAY,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;AAC3C,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;QACzC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE;YACpC,QAAQ,GAAG,IAAI,CAAC;YAChB,OAAO,eAAe,CAAC;QACzB,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AACrC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,KAAiC;IAC7D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,YAAY,CAAC,KAA0B,CAAC,CAAC;QACrD,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;IACvD,CAAC;IACD,0EAA0E;IAC1E,iDAAiD;IACjD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACjC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;AACjE,CAAC;AAED,SAAS,YAAY,CAAC,MAAyB;IAC7C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,WAAW,GAAG,KAAK,CAAC;IAExB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC7B,QAAQ,GAAG,IAAI,CAAC;YAChB,WAAW,GAAG,KAAK,CAAC;YACpB,SAAS;QACX,CAAC;QAED,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,UAAU,KAAK,IAAI,IAAI,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACnE,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,eAAe,EAAE,CAAC,CAAC;YAClE,QAAQ,GAAG,IAAI,CAAC;YAChB,SAAS;QACX,CAAC;QAED,qEAAqE;QACrE,qCAAqC;QACrC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;YACvD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,WAAW,GAAG,IAAI,CAAC;YACnB,SAAS;QACX,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACtC,OAAO,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxE,CAAC"}

package/dist/replay.d.ts

@@ -1,55 +1,26 @@
 /**
- * Replay (plan §24).
+ * Replay (plan §24). Replays evidence, not the application: given an
+ * `executionId`, returns the recorded execution, its environment, and its
+ * evidence in recorded order — enough to re-derive correlation and
+ * findings without booting anything. Never spawns a process, drives a
+ * browser, or reissues a request — a replay that re-executed would produce
+ * a *new* observation while claiming to reproduce an old one.
  *
- * ## What this replays, and what it does not
+ * Required a gap closed first: evidence survived a process restart, the
+ * execution that produced it did not (`Execution` lived only in
+ * `ExecutionController`'s memory). `recordExecution` is the missing half —
+ * a new table, never a new `evidence` column (an added column would need a
+ * migration this package has no mechanism for).
  *
- * **It replays evidence, not the application.** Given an `executionId`, it
- * returns the recorded execution, the environment it was recorded in, and its
- * evidence in recorded order — enough to re-derive correlation, findings and
- * an evidence package without booting anything. It does not spawn a process,
- * drive a browser, or reissue a request, and it never will from here: those
- * are `descry-runtime`'s live path, and a "replay" that quietly re-executed
- * would produce a *new* observation while claiming to reproduce an old one.
+ * Redaction applies to the execution record too: `configuration.services[x].command`
+ * is a command line, a classic credential carrier. Same `redact()`, same
+ * terms; `redactedKeys` (RT-063) reports what it caught.
  *
- * That distinction is the whole reason this file names its own limits at the
- * top. §24's row was `[ ]` with the note *"having the data is not having the
- * capability"* — the opposite error is equally available, and it is shipping
- * something called replay that reproduces less than the name promises.
- *
- * ## The gap this had to close first
- *
- * Evidence survived a process restart. **The execution that produced it did
- * not.** `Execution` lived in `ExecutionController`'s memory and nowhere on
- * disk, so after a restart the store held a pile of rows keyed by an
- * `executionId` that no longer resolved to an application, a commit, or a
- * configuration. §24 marked "execution configuration — persisted with the
- * execution" as done, and it was true of the object and false of the disk.
- *
- * `recordExecution` is that missing half. It is a **new table**, never a new
- * column on `evidence` — an added table appears under `CREATE TABLE IF NOT
- * EXISTS` on an existing store file, where an added column would need a
- * migration this package has no mechanism for.
- *
- * ## Redaction applies here too, and that is not obvious
- *
- * §20's rows are all about payloads, and every one of them is about evidence.
- * But a service command is `configuration.services[x].command`, and a command
- * line is one of the classic places a credential is passed —
- * `node server.mjs --api-key=…`, `DATABASE_URL=… node app.js`. The execution
- * record goes through the same `redact()` the evidence write path uses, for
- * the same reason and on the same terms. `redactedKeys` (RT-063) reports what
- * it caught.
- *
- * ## The environment fingerprint is deliberately narrow
- *
- * Four fields: node version, platform, arch, and the declared service
- * commands. **`process.env` is not captured, and its absence is the design.**
- * §20 records that the injected process environment is not captured or
- * filtered — *"so there is nothing to leak yet, which is not the same as
- * filtering."* Capturing it here to improve reproducibility would create
- * exactly the leak that row says does not exist, inside the one module whose
- * output is meant to be safe to hand to a model. A narrower fingerprint that
- * can be trusted beats a fuller one that cannot.
+ * The environment fingerprint is deliberately narrow — node version,
+ * platform, arch, declared service commands. `process.env` is NOT
+ * captured; capturing it for reproducibility would create the exact leak
+ * this module exists to avoid, inside the one module whose output is meant
+ * to be safe to hand to a model.
  */
 import type { Evidence } from "@descryy/runtime-contracts";
 /** What was true of the machine when an execution was recorded. Narrow on purpose — see this file's header. */
@@ -58,10 +29,7 @@ export interface EnvironmentFingerprint {
     readonly nodeVersion: string;
     readonly platform: string;
     readonly arch: string;
-    /**
-     * `serviceName -> command`, from the execution's own configuration.
-     * Redacted on the way in: a command line is a classic credential carrier.
-     */
+    /** `serviceName -> command`, redacted on the way in. */
     readonly serviceCommands: Readonly<Record<string, string>>;
 }
 /** The recorded half of an execution — what `ExecutionController` held only in memory. */
@@ -86,33 +54,20 @@ export interface Replay {
     readonly evidence: readonly Evidence[];
     /** The environment replay is happening *in*, for comparison against the recorded one. */
     readonly currentEnvironment: EnvironmentFingerprint;
-    /**
-     * Never empty for a degraded replay, and each one names what differs
-     * rather than asserting the replay is invalid — whether a node-version
-     * change matters is the reader's call, not this module's.
-     */
+    /** Never empty for a degraded replay; names what differs rather than asserting invalidity — the reader's call. */
     readonly warnings: readonly ReplayWarning[];
 }
-/**
- * The current machine's fingerprint.
- *
- * `serviceCommands` comes from the caller's configuration rather than being
- * discovered, because there is nothing on a machine to discover it from — an
- * execution's services are a property of the run, not of the host.
- */
+/** The current machine's fingerprint. `serviceCommands` comes from the caller's configuration, not discovered — services are a property of the run, not the host. */
 export declare function captureEnvironment(serviceCommands?: Readonly<Record<string, string>>, runtime?: {
     version: string;
     platform: string;
     arch: string;
 }): EnvironmentFingerprint;
 /**
- * Differences between the environment an execution was recorded in and the
- * one it is being replayed in.
- *
- * **Reported, never enforced.** A replay in a different node version is not
- * wrong; it is a fact a reader needs when a re-derived finding disagrees with
- * the original. Refusing to replay would be this module deciding a question
- * it has no information about.
+ * Differences between the recorded environment and the replay one.
+ * Reported, never enforced — a different node version isn't wrong, just a
+ * fact a reader needs if a re-derived finding disagrees. Refusing to
+ * replay would be this module deciding a question it has no info about.
  */
 export declare function environmentDifferences(recorded: EnvironmentFingerprint, current: EnvironmentFingerprint): readonly string[];
 //# sourceMappingURL=replay.d.ts.map

package/dist/replay.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"replay.d.ts","sourceRoot":"","sources":["../src/replay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AAE3D,+GAA+G;AAC/G,MAAM,WAAW,sBAAsB;IACrC,0CAA0C;IAC1C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC5D;AAED,0FAA0F;AAC1F,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,sBAAsB,CAAC;IAC7C,mHAAmH;IACnH,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,qBAAqB,GAAG,aAAa,GAAG,sBAAsB,CAAC;IAC9E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,uCAAuC;IACvC,QAAQ,CAAC,QAAQ,EAAE,SAAS,QAAQ,EAAE,CAAC;IACvC,yFAAyF;IACzF,QAAQ,CAAC,kBAAkB,EAAE,sBAAsB,CAAC;IACpD;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;CAC7C;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,eAAe,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAM,EACtD,OAAO,GAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAY,GACrE,sBAAsB,CAOxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,sBAAsB,EAChC,OAAO,EAAE,sBAAsB,GAC9B,SAAS,MAAM,EAAE,CAsBnB"}
+{"version":3,"file":"replay.d.ts","sourceRoot":"","sources":["../src/replay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AAE3D,+GAA+G;AAC/G,MAAM,WAAW,sBAAsB;IACrC,0CAA0C;IAC1C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC5D;AAED,0FAA0F;AAC1F,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,sBAAsB,CAAC;IAC7C,mHAAmH;IACnH,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,qBAAqB,GAAG,aAAa,GAAG,sBAAsB,CAAC;IAC9E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,uCAAuC;IACvC,QAAQ,CAAC,QAAQ,EAAE,SAAS,QAAQ,EAAE,CAAC;IACvC,yFAAyF;IACzF,QAAQ,CAAC,kBAAkB,EAAE,sBAAsB,CAAC;IACpD,kHAAkH;IAClH,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;CAC7C;AAED,qKAAqK;AACrK,wBAAgB,kBAAkB,CAChC,eAAe,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAM,EACtD,OAAO,GAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAY,GACrE,sBAAsB,CAOxB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,sBAAsB,EAChC,OAAO,EAAE,sBAAsB,GAC9B,SAAS,MAAM,EAAE,CAsBnB"}

package/dist/replay.js

@@ -1,63 +1,28 @@
 /**
- * Replay (plan §24).
+ * Replay (plan §24). Replays evidence, not the application: given an
+ * `executionId`, returns the recorded execution, its environment, and its
+ * evidence in recorded order — enough to re-derive correlation and
+ * findings without booting anything. Never spawns a process, drives a
+ * browser, or reissues a request — a replay that re-executed would produce
+ * a *new* observation while claiming to reproduce an old one.
  *
- * ## What this replays, and what it does not
+ * Required a gap closed first: evidence survived a process restart, the
+ * execution that produced it did not (`Execution` lived only in
+ * `ExecutionController`'s memory). `recordExecution` is the missing half —
+ * a new table, never a new `evidence` column (an added column would need a
+ * migration this package has no mechanism for).
  *
- * **It replays evidence, not the application.** Given an `executionId`, it
- * returns the recorded execution, the environment it was recorded in, and its
- * evidence in recorded order — enough to re-derive correlation, findings and
- * an evidence package without booting anything. It does not spawn a process,
- * drive a browser, or reissue a request, and it never will from here: those
- * are `descry-runtime`'s live path, and a "replay" that quietly re-executed
- * would produce a *new* observation while claiming to reproduce an old one.
+ * Redaction applies to the execution record too: `configuration.services[x].command`
+ * is a command line, a classic credential carrier. Same `redact()`, same
+ * terms; `redactedKeys` (RT-063) reports what it caught.
  *
- * That distinction is the whole reason this file names its own limits at the
- * top. §24's row was `[ ]` with the note *"having the data is not having the
- * capability"* — the opposite error is equally available, and it is shipping
- * something called replay that reproduces less than the name promises.
- *
- * ## The gap this had to close first
- *
- * Evidence survived a process restart. **The execution that produced it did
- * not.** `Execution` lived in `ExecutionController`'s memory and nowhere on
- * disk, so after a restart the store held a pile of rows keyed by an
- * `executionId` that no longer resolved to an application, a commit, or a
- * configuration. §24 marked "execution configuration — persisted with the
- * execution" as done, and it was true of the object and false of the disk.
- *
- * `recordExecution` is that missing half. It is a **new table**, never a new
- * column on `evidence` — an added table appears under `CREATE TABLE IF NOT
- * EXISTS` on an existing store file, where an added column would need a
- * migration this package has no mechanism for.
- *
- * ## Redaction applies here too, and that is not obvious
- *
- * §20's rows are all about payloads, and every one of them is about evidence.
- * But a service command is `configuration.services[x].command`, and a command
- * line is one of the classic places a credential is passed —
- * `node server.mjs --api-key=…`, `DATABASE_URL=… node app.js`. The execution
- * record goes through the same `redact()` the evidence write path uses, for
- * the same reason and on the same terms. `redactedKeys` (RT-063) reports what
- * it caught.
- *
- * ## The environment fingerprint is deliberately narrow
- *
- * Four fields: node version, platform, arch, and the declared service
- * commands. **`process.env` is not captured, and its absence is the design.**
- * §20 records that the injected process environment is not captured or
- * filtered — *"so there is nothing to leak yet, which is not the same as
- * filtering."* Capturing it here to improve reproducibility would create
- * exactly the leak that row says does not exist, inside the one module whose
- * output is meant to be safe to hand to a model. A narrower fingerprint that
- * can be trusted beats a fuller one that cannot.
- */
-/**
- * The current machine's fingerprint.
- *
- * `serviceCommands` comes from the caller's configuration rather than being
- * discovered, because there is nothing on a machine to discover it from — an
- * execution's services are a property of the run, not of the host.
+ * The environment fingerprint is deliberately narrow — node version,
+ * platform, arch, declared service commands. `process.env` is NOT
+ * captured; capturing it for reproducibility would create the exact leak
+ * this module exists to avoid, inside the one module whose output is meant
+ * to be safe to hand to a model.
  */
+/** The current machine's fingerprint. `serviceCommands` comes from the caller's configuration, not discovered — services are a property of the run, not the host. */
 export function captureEnvironment(serviceCommands = {}, runtime = process) {
     return {
         nodeVersion: runtime.version,
@@ -67,13 +32,10 @@ export function captureEnvironment(serviceCommands = {}, runtime = process) {
     };
 }
 /**
- * Differences between the environment an execution was recorded in and the
- * one it is being replayed in.
- *
- * **Reported, never enforced.** A replay in a different node version is not
- * wrong; it is a fact a reader needs when a re-derived finding disagrees with
- * the original. Refusing to replay would be this module deciding a question
- * it has no information about.
+ * Differences between the recorded environment and the replay one.
+ * Reported, never enforced — a different node version isn't wrong, just a
+ * fact a reader needs if a re-derived finding disagrees. Refusing to
+ * replay would be this module deciding a question it has no info about.
  */
 export function environmentDifferences(recorded, current) {
     const differences = [];

package/dist/replay.js.map

@@ -1 +1 @@
-{"version":3,"file":"replay.js","sourceRoot":"","sources":["../src/replay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAiDH;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,kBAAoD,EAAE,EACtD,UAA+D,OAAO;IAEtE,OAAO;QACL,WAAW,EAAE,OAAO,CAAC,OAAO;QAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,eAAe;KAChB,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAgC,EAChC,OAA+B;IAE/B,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,IAAI,QAAQ,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;QACjD,WAAW,CAAC,IAAI,CAAC,QAAQ,QAAQ,CAAC,WAAW,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC3C,WAAW,CAAC,IAAI,CAAC,YAAY,QAAQ,CAAC,QAAQ,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC;QACnC,WAAW,CAAC,IAAI,CAAC,QAAQ,QAAQ,CAAC,IAAI,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAC3G,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,MAAM,KAAK,KAAK;YAAE,SAAS;QAC/B,IAAI,MAAM,KAAK,SAAS;YAAE,WAAW,CAAC,IAAI,CAAC,YAAY,IAAI,UAAU,CAAC,CAAC;aAClE,IAAI,KAAK,KAAK,SAAS;YAAE,WAAW,CAAC,IAAI,CAAC,YAAY,IAAI,WAAW,CAAC,CAAC;;YACvE,WAAW,CAAC,IAAI,CAAC,YAAY,IAAI,sBAAsB,MAAM,MAAM,KAAK,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC"}
+{"version":3,"file":"replay.js","sourceRoot":"","sources":["../src/replay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AA0CH,qKAAqK;AACrK,MAAM,UAAU,kBAAkB,CAChC,kBAAoD,EAAE,EACtD,UAA+D,OAAO;IAEtE,OAAO;QACL,WAAW,EAAE,OAAO,CAAC,OAAO;QAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,eAAe;KAChB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAgC,EAChC,OAA+B;IAE/B,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,IAAI,QAAQ,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;QACjD,WAAW,CAAC,IAAI,CAAC,QAAQ,QAAQ,CAAC,WAAW,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC3C,WAAW,CAAC,IAAI,CAAC,YAAY,QAAQ,CAAC,QAAQ,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC;QACnC,WAAW,CAAC,IAAI,CAAC,QAAQ,QAAQ,CAAC,IAAI,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAC3G,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,MAAM,KAAK,KAAK;YAAE,SAAS;QAC/B,IAAI,MAAM,KAAK,SAAS;YAAE,WAAW,CAAC,IAAI,CAAC,YAAY,IAAI,UAAU,CAAC,CAAC;aAClE,IAAI,KAAK,KAAK,SAAS;YAAE,WAAW,CAAC,IAAI,CAAC,YAAY,IAAI,WAAW,CAAC,CAAC;;YACvE,WAAW,CAAC,IAAI,CAAC,YAAY,IAAI,sBAAsB,MAAM,MAAM,KAAK,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC"}

package/package.json

@@ -1,9 +1,14 @@
 {
   "name": "@descryy/runtime-evidence-store",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "type": "module",
   "description": "Evidence persistence keyed by executionId, with redaction enforced on write -- there is no path to read an unredacted payload.",
   "license": "UNLICENSED",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/descryhq-wq/descry-runtime.git",
+    "directory": "packages/evidence-store"
+  },
   "engines": {
     "node": ">=22.5"
   },
@@ -24,6 +29,6 @@
     "build": "tsc -b"
   },
   "dependencies": {
-    "@descryy/runtime-contracts": "0.2.0"
+    "@descryy/runtime-contracts": "0.3.0"
   }
 }