@doubling/types 0.2.1 → 0.3.0

package/README.md

@@ -1,6 +1,8 @@
 # @doubling/types
 
-Shared TypeScript interfaces and pure helpers consumed by `web/` and `sync/`. Single source of truth for Firestore document shapes (file/folder entities, org membership, teams, user profiles), file-extension to MIME mappings, and storage-path helpers.
+Shared TypeScript interfaces and pure helpers consumed by `web/` and `sync/` (verified via each package's `package.json` dependency and `import … from '@doubling/types'` sites). Single source of truth for Firestore document shapes (file/folder entities, org membership, teams, user profiles), file-extension to MIME mappings, and storage-path helpers.
+
+`functions/` does **not** depend on this package: it deliberately keeps a local mirror of `OrgMember` (see `functions/src/index.ts`, "kept local because functions/…") pending a later migration. Root [`../DESIGN.md` §5](../DESIGN.md) describes the shapes as consumed by web, sync, and functions — that is a *structural* statement (functions stores the same documents), not a package dependency.
 
 Lives at the repo root as an npm workspace (`@doubling/types`). The compiled output is shipped at `dist/`, regenerated on `npm install` via the `prepare` script and rebuilt explicitly via `npm run build`.
 
@@ -31,4 +33,16 @@ Edit `EXT_TO_MIME` in `src/mime.ts`. That's it. Both `web/` and `sync/` pick up
 npm run -w types build
 ```
 
-Emits `dist/index.js` plus `dist/*.d.ts`. The `dist/` directory is gitignored; CI runs the build automatically via the `prepare` script on `npm install`.
+Emits `dist/index.js` plus `dist/*.d.ts`. The `dist/` directory is gitignored; CI runs the build automatically via the `prepare` script on `npm install` (`prepack` re-runs `tsc` before packaging). Only `dist/` and `README.md` are shipped in the published tarball (see the `files` field in `package.json`).
+
+## Publish
+
+Published to the public npm registry as `@doubling/types`. The [`.github/workflows/publish-types.yml`](../.github/workflows/publish-types.yml) workflow (**Publish Types to npm**) fires on every published GitHub Release, gated on the `@doubling/types@` tag prefix so a sibling `sync` release does not trigger it. It runs `npm ci`, `npm run build -w types`, skips cleanly if `types/package.json`'s version is already on npm, then `npm publish --access public` via npm Trusted Publishing (OIDC — no `NPM_TOKEN`). `workflow_dispatch` is exposed for bootstrap and transient-failure recovery. Version bumps are cut by Changesets (see `CHANGELOG.md`).
+
+The package is published because `@doubling/compound-sync` is itself a published npm package that depends on `@doubling/types` at runtime, so the dependency must resolve from the registry outside the monorepo.
+
+## Docs
+
+- [`DESIGN.md`](DESIGN.md) — detailed design (exported symbols, path scheme, trade-offs).
+- Root [`../DESIGN.md` §5](../DESIGN.md) — canonical data model.
+- [`../docs/features/sync/index.md`](../docs/features/sync/index.md) — shared-schema bullet in the sync feature docs.

package/dist/firestore.d.ts

@@ -19,6 +19,7 @@ export interface FileEntity extends EntityBase {
     storagePath?: string;
     content?: string | null;
     frontmatter?: unknown;
+    contentLoadFailed?: true;
 }
 export interface FolderEntity extends EntityBase {
     type: 'folder';
@@ -37,6 +38,7 @@ export interface OrgMember {
     email?: string;
     role?: string;
     orgName?: string;
+    teamIds?: string[];
 }
 export interface Team {
     id: string;

package/dist/firestore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"firestore.d.ts","sourceRoot":"","sources":["../src/firestore.ts"],"names":[],"mappings":"AAoBA,MAAM,MAAM,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;AAKvC,UAAU,UAAU;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CAC7B;AASD,MAAM,WAAW,UAAW,SAAQ,UAAU;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAGD,MAAM,WAAW,YAAa,SAAQ,UAAU;IAC9C,IAAI,EAAE,QAAQ,CAAC;CAChB;AAID,MAAM,MAAM,MAAM,GAAG,UAAU,GAAG,YAAY,CAAC;AAM/C,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAKD,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAGD,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAGD,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAKD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB"}
+{"version":3,"file":"firestore.d.ts","sourceRoot":"","sources":["../src/firestore.ts"],"names":[],"mappings":"AAoBA,MAAM,MAAM,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;AAKvC,UAAU,UAAU;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CAC7B;AASD,MAAM,WAAW,UAAW,SAAQ,UAAU;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;IAQtB,iBAAiB,CAAC,EAAE,IAAI,CAAC;CAC1B;AAGD,MAAM,WAAW,YAAa,SAAQ,UAAU;IAC9C,IAAI,EAAE,QAAQ,CAAC;CAChB;AAID,MAAM,MAAM,MAAM,GAAG,UAAU,GAAG,YAAY,CAAC;AAM/C,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAKD,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IAQjB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAGD,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAGD,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAKD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB"}

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 export * from './firestore.js';
 export * from './mime.js';
 export * from './paths.js';
+export * from './scrub.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAMA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAMA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC"}

package/dist/index.js

@@ -7,4 +7,5 @@
 export * from './firestore.js';
 export * from './mime.js';
 export * from './paths.js';
+export * from './scrub.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,EAAE;AACF,6DAA6D;AAC7D,qEAAqE;AACrE,6DAA6D;AAC7D,qCAAqC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,EAAE;AACF,6DAA6D;AAC7D,qEAAqE;AACrE,6DAA6D;AAC7D,qCAAqC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC"}

package/dist/scrub.d.ts

@@ -0,0 +1,41 @@
+/**
+ * The only shape allowed for context we attach deliberately.
+ *
+ * Everything here is non-identifying metadata that the operation log
+ * already models (see sync/operation-log.ts). Notably absent, and
+ * absent on purpose: `path`, `name`, `content`, `email`.
+ */
+export interface SafeContext {
+    orgId?: string;
+    userId?: string;
+    teamId?: string;
+    opType?: string;
+    scope?: string;
+    entityType?: 'file' | 'folder';
+    /** Extension only — 'md', 'pdf'. Never the filename. */
+    ext?: string;
+    mimeType?: string;
+    sizeBytes?: number;
+    /** Shape of the path, not its content. */
+    pathDepth?: number;
+    nameLength?: number;
+    errorCode?: string;
+    agentVersion?: string;
+}
+/**
+ * Redact a single string.
+ *
+ * Order matters: query strings first (Firebase Storage signed URLs
+ * carry `?token=`), then the most specific path forms, then bare
+ * filenames, then the length cap.
+ */
+export declare function redactString(input: string): string;
+/**
+ * Scrub an error event in place-safe fashion (returns a new object).
+ *
+ * Returns `null` if scrubbing itself throws. Failing closed is the only
+ * acceptable behaviour here: dropping one event costs a diagnostic,
+ * leaking one costs customer data.
+ */
+export declare function scrubEvent<T extends object>(event: T): T | null;
+//# sourceMappingURL=scrub.d.ts.map

package/dist/scrub.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scrub.d.ts","sourceRoot":"","sources":["../src/scrub.ts"],"names":[],"mappings":"AA2BA;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC/B,wDAAwD;IACxD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AA8DD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CA6BlD;AAmCD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,CAAC,SAAS,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,IAAI,CA0E/D"}

package/dist/scrub.js

@@ -0,0 +1,206 @@
+// PII scrubbing for error telemetry.
+//
+// Compound is a file-sync product. File paths, file names and file
+// CONTENTS are customer data, and the daemon runs on customer machines.
+// Nothing resembling any of it may leave with an error report.
+//
+// Two layers, deliberately:
+//
+//   1. SafeContext — a typed allowlist for anything we attach on
+//      purpose. With `exactOptionalPropertyTypes` on, passing `{ path }`
+//      is a COMPILE error. PII discipline enforced by the compiler
+//      rather than by review.
+//
+//   2. scrubEvent — a redaction pass over everything the SDK populates
+//      on its own: messages, exception values, stack frames, breadcrumbs,
+//      request data. Layer 1 cannot help there, because none of it is
+//      ours to choose.
+//
+// Lives in @doubling/types so web, sync and desktop share one
+// implementation. `functions/` keeps a small local copy: `firebase
+// deploy` runs a standalone `npm ci --workspaces=false`, which cannot
+// resolve a workspace dependency.
+//
+// Deliberately dependency-free and framework-agnostic — it takes and
+// returns a plain object, so it is trivially testable without a Sentry
+// SDK present.
+// Folder names that begin a sync-relative path. Kept as literals rather
+// than imported from paths.ts so this module stays dependency-free and
+// so a rename there cannot silently narrow the redaction.
+const SYNC_ROOTS = ['Private', 'Shared with Me', 'Shared by Me'];
+const EMAIL_RE = /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g;
+// Absolute filesystem paths. These leak the OS username as well as the
+// file, which is why they are redacted even though the daemon's own
+// install directory is not itself secret.
+const ABS_PATH_RE = /(?:\/Users\/|\/home\/|\/var\/folders\/|[A-Za-z]:\\Users\\)[^\s"')\]]+/g;
+// Extensions we recognise. Used both to anchor path matching and to
+// catch bare filenames.
+const EXT_ALT = 'md|markdown|txt|json|ya?ml|csv|pdf|png|jpe?g|gif|heic|docx?|xlsx?|base';
+const SYNC_ROOT_ALT = `(?:${SYNC_ROOTS.map(escapeRegExp).join('|')}|[^\\s"']+ Teamspace)`;
+// A sync-relative path ENDING IN A KNOWN EXTENSION, allowing spaces
+// inside segments.
+//
+// Spaces matter here: "Private/notes/Q3 Budget.md" is an entirely
+// ordinary filename, and a pattern that stops at the first space
+// reports it as two tokens with a misleading depth and extension. Both
+// halves still get redacted — nothing leaks either way — but the shape
+// metadata is the whole point of keeping a token at all, so it should
+// be right.
+//
+// Non-greedy and anchored on the extension so it cannot run on into the
+// prose that follows the path in a log line.
+const SYNC_PATH_EXT_RE = new RegExp(`${SYNC_ROOT_ALT}/[^"')\\]]+?\\.(?:${EXT_ALT})\\b`, 'gi');
+// Extension-less sync paths (folders). No space allowance: without an
+// extension to anchor on, permitting spaces would swallow the rest of
+// the sentence.
+const SYNC_PATH_RE = new RegExp(`${SYNC_ROOT_ALT}/[^\\s"')\\]]+`, 'g');
+// Any remaining bare filename with a plausible extension.
+const FILENAME_RE = new RegExp(`[^\\s"'/\\\\)\\]]+\\.(?:${EXT_ALT})\\b`, 'gi');
+// Content interpolated into a message is the failure mode this cannot
+// enumerate its way out of, so there is a blunt length cap as backstop.
+const MAX_STRING = 200;
+function escapeRegExp(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+function depthOf(p) {
+    return p.split('/').filter(Boolean).length;
+}
+/** Replace a matched path with its shape: depth, extension, name length. */
+function summarisePath(match) {
+    const name = match.split('/').pop() ?? '';
+    const dot = name.lastIndexOf('.');
+    const ext = dot > 0 ? name.slice(dot + 1).toLowerCase() : 'none';
+    return `<path:d${depthOf(match)}:ext=${ext}:len=${name.length}>`;
+}
+/**
+ * Redact a single string.
+ *
+ * Order matters: query strings first (Firebase Storage signed URLs
+ * carry `?token=`), then the most specific path forms, then bare
+ * filenames, then the length cap.
+ */
+export function redactString(input) {
+    if (typeof input !== 'string' || input.length === 0)
+        return input;
+    let out = input;
+    // Strip query strings and fragments wholesale. A Storage download URL
+    // carries an access token; a redacted path with a live token attached
+    // would be worse than the path alone.
+    out = out.replace(/([?#])[^\s"')\]]*/g, '$1<redacted>');
+    out = out.replace(EMAIL_RE, '<email>');
+    out = out.replace(ABS_PATH_RE, (m) => `<abs-path:d${depthOf(m)}>`);
+    // Extension-anchored first: it is the more specific pattern, and
+    // running the looser one first would truncate at the first space.
+    out = out.replace(SYNC_PATH_EXT_RE, summarisePath);
+    out = out.replace(SYNC_PATH_RE, summarisePath);
+    out = out.replace(FILENAME_RE, (m) => {
+        const dot = m.lastIndexOf('.');
+        return `<file:ext=${m.slice(dot + 1).toLowerCase()}:len=${m.length}>`;
+    });
+    if (out.length > MAX_STRING) {
+        out = `${out.slice(0, MAX_STRING)}…[truncated]`;
+    }
+    return out;
+}
+/** Recursively redact every string in a value, depth-capped. */
+function redactDeep(value, depth = 0) {
+    if (depth > 4)
+        return '<depth-capped>';
+    if (typeof value === 'string')
+        return redactString(value);
+    if (Array.isArray(value))
+        return value.map((v) => redactDeep(v, depth + 1));
+    if (value !== null && typeof value === 'object') {
+        const out = {};
+        for (const [k, v] of Object.entries(value)) {
+            out[k] = redactDeep(v, depth + 1);
+        }
+        return out;
+    }
+    return value;
+}
+/**
+ * Scrub an error event in place-safe fashion (returns a new object).
+ *
+ * Returns `null` if scrubbing itself throws. Failing closed is the only
+ * acceptable behaviour here: dropping one event costs a diagnostic,
+ * leaking one costs customer data.
+ */
+export function scrubEvent(event) {
+    try {
+        // `T extends object` rather than `T extends ScrubbableEvent`: the
+        // point of this module is to stay usable without the Sentry SDK,
+        // and an SDK's own ErrorEvent type does not structurally satisfy a
+        // hand-written interface (its optional fields are narrower than the
+        // `unknown` used here). Callers get their exact type back; the
+        // internal view is the structural subset we actually walk.
+        const out = { ...event };
+        if (typeof out.message === 'string')
+            out.message = redactString(out.message);
+        if (typeof out.transaction === 'string')
+            out.transaction = redactString(out.transaction);
+        if (typeof out.culprit === 'string')
+            out.culprit = redactString(out.culprit);
+        if (out.logentry)
+            out.logentry = redactDeep(out.logentry);
+        if (out.exception?.values) {
+            out.exception = {
+                ...out.exception,
+                values: out.exception.values.map((v) => {
+                    const val = { ...v };
+                    if (typeof val['value'] === 'string')
+                        val['value'] = redactString(val['value']);
+                    if (typeof val['type'] === 'string')
+                        val['type'] = redactString(val['type']);
+                    const st = val['stacktrace'];
+                    if (st?.frames) {
+                        val['stacktrace'] = {
+                            ...st,
+                            frames: st.frames.map((f) => {
+                                const frame = { ...f };
+                                for (const k of ['filename', 'abs_path', 'module']) {
+                                    if (typeof frame[k] === 'string')
+                                        frame[k] = redactString(frame[k]);
+                                }
+                                // Local variables can hold an entire file body: the
+                                // daemon throws from inside pushFileToCloud, whose
+                                // scope holds `data: string | Buffer`. Never send them.
+                                delete frame['vars'];
+                                return frame;
+                            }),
+                        };
+                    }
+                    return val;
+                }),
+            };
+        }
+        if (out.breadcrumbs)
+            out.breadcrumbs = redactDeep(out.breadcrumbs);
+        if (out.request) {
+            // Keep only a redacted URL. Bodies, headers and cookies carry
+            // auth tokens and file content and are never worth the risk.
+            const url = out.request['url'];
+            out.request = typeof url === 'string' ? { url: redactString(url) } : {};
+        }
+        // Identify the user by opaque uid only. Email is PII and the
+        // username is often the person's real name.
+        if (out.user) {
+            const id = out.user['id'];
+            out.user = id === undefined ? {} : { id };
+        }
+        // Dropped wholesale rather than redacted: `extra` is the field
+        // callers reach for when they have something interesting and
+        // unstructured, which is exactly when it holds a path or a body.
+        // Deliberate context goes through SafeContext instead.
+        delete out.extra;
+        if (out.contexts)
+            out.contexts = redactDeep(out.contexts);
+        if (out.tags)
+            out.tags = redactDeep(out.tags);
+        return out;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=scrub.js.map

package/dist/scrub.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scrub.js","sourceRoot":"","sources":["../src/scrub.ts"],"names":[],"mappings":"AAAA,qCAAqC;AACrC,EAAE;AACF,mEAAmE;AACnE,wEAAwE;AACxE,+DAA+D;AAC/D,EAAE;AACF,4BAA4B;AAC5B,EAAE;AACF,iEAAiE;AACjE,yEAAyE;AACzE,mEAAmE;AACnE,8BAA8B;AAC9B,EAAE;AACF,uEAAuE;AACvE,0EAA0E;AAC1E,sEAAsE;AACtE,uBAAuB;AACvB,EAAE;AACF,8DAA8D;AAC9D,mEAAmE;AACnE,sEAAsE;AACtE,kCAAkC;AAClC,EAAE;AACF,qEAAqE;AACrE,uEAAuE;AACvE,eAAe;AA2Bf,wEAAwE;AACxE,uEAAuE;AACvE,0DAA0D;AAC1D,MAAM,UAAU,GAAG,CAAC,SAAS,EAAE,gBAAgB,EAAE,cAAc,CAAC,CAAC;AAEjE,MAAM,QAAQ,GAAG,iDAAiD,CAAC;AAEnE,uEAAuE;AACvE,oEAAoE;AACpE,0CAA0C;AAC1C,MAAM,WAAW,GAAG,wEAAwE,CAAC;AAE7F,oEAAoE;AACpE,wBAAwB;AACxB,MAAM,OAAO,GAAG,wEAAwE,CAAC;AAEzF,MAAM,aAAa,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,uBAAuB,CAAC;AAE1F,oEAAoE;AACpE,mBAAmB;AACnB,EAAE;AACF,kEAAkE;AAClE,iEAAiE;AACjE,uEAAuE;AACvE,uEAAuE;AACvE,sEAAsE;AACtE,YAAY;AACZ,EAAE;AACF,wEAAwE;AACxE,6CAA6C;AAC7C,MAAM,gBAAgB,GAAG,IAAI,MAAM,CAAC,GAAG,aAAa,qBAAqB,OAAO,MAAM,EAAE,IAAI,CAAC,CAAC;AAE9F,sEAAsE;AACtE,sEAAsE;AACtE,gBAAgB;AAChB,MAAM,YAAY,GAAG,IAAI,MAAM,CAAC,GAAG,aAAa,gBAAgB,EAAE,GAAG,CAAC,CAAC;AAEvE,0DAA0D;AAC1D,MAAM,WAAW,GAAG,IAAI,MAAM,CAAC,2BAA2B,OAAO,MAAM,EAAE,IAAI,CAAC,CAAC;AAE/E,sEAAsE;AACtE,wEAAwE;AACxE,MAAM,UAAU,GAAG,GAAG,CAAC;AAEvB,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,OAAO,CAAC,CAAS;IACxB,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;AAC7C,CAAC;AAED,4EAA4E;AAC5E,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IACjE,OAAO,UAAU,OAAO,CAAC,KAAK,CAAC,QAAQ,GAAG,QAAQ,IAAI,CAAC,MAAM,GAAG,CAAC;AACnE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAElE,IAAI,GAAG,GAAG,KAAK,CAAC;IAEhB,sEAAsE;IACtE,sEAAsE;IACtE,sCAAsC;IACtC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,oBAAoB,EAAE,cAAc,CAAC,CAAC;IAExD,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAEvC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAEnE,iEAAiE;IACjE,kEAAkE;IAClE,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;IACnD,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;IAE/C,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE;QACnC,MAAM,GAAG,GAAG,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,aAAa,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,IAAI,GAAG,CAAC,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,GAAG,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,cAAc,CAAC;IAClD,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gEAAgE;AAChE,SAAS,UAAU,CAAC,KAAc,EAAE,KAAK,GAAG,CAAC;IAC3C,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,gBAAgB,CAAC;IACvC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IAC1D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5E,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAoBD;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAmB,KAAQ;IACnD,IAAI,CAAC;QACH,kEAAkE;QAClE,iEAAiE;QACjE,mEAAmE;QACnE,oEAAoE;QACpE,+DAA+D;QAC/D,2DAA2D;QAC3D,MAAM,GAAG,GAAG,EAAE,GAAG,KAAK,EAAqB,CAAC;QAE5C,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;YAAE,GAAG,CAAC,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7E,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ;YAAE,GAAG,CAAC,WAAW,GAAG,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACzF,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;YAAE,GAAG,CAAC,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAE7E,IAAI,GAAG,CAAC,QAAQ;YAAE,GAAG,CAAC,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAgC,CAAC;QAEzF,IAAI,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;YAC1B,GAAG,CAAC,SAAS,GAAG;gBACd,GAAG,GAAG,CAAC,SAAS;gBAChB,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;oBACrC,MAAM,GAAG,GAAG,EAAE,GAAI,CAA6B,EAAE,CAAC;oBAClD,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ;wBAAE,GAAG,CAAC,OAAO,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;oBAChF,IAAI,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ;wBAAE,GAAG,CAAC,MAAM,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;oBAC7E,MAAM,EAAE,GAAG,GAAG,CAAC,YAAY,CAAuC,CAAC;oBACnE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC;wBACf,GAAG,CAAC,YAAY,CAAC,GAAG;4BAClB,GAAG,EAAE;4BACL,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gCAC1B,MAAM,KAAK,GAAG,EAAE,GAAI,CAA6B,EAAE,CAAC;gCACpD,KAAK,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC;oCACnD,IAAI,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ;wCAAE,KAAK,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAW,CAAC,CAAC;gCAChF,CAAC;gCACD,oDAAoD;gCACpD,mDAAmD;gCACnD,wDAAwD;gCACxD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC;gCACrB,OAAO,KAAK,CAAC;4BACf,CAAC,CAAC;yBACH,CAAC;oBACJ,CAAC;oBACD,OAAO,GAAG,CAAC;gBACb,CAAC,CAAC;aACH,CAAC;QACJ,CAAC;QAED,IAAI,GAAG,CAAC,WAAW;YAAE,GAAG,CAAC,WAAW,GAAG,UAAU,CAAC,GAAG,CAAC,WAAW,CAAc,CAAC;QAEhF,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YAChB,8DAA8D;YAC9D,6DAA6D;YAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC/B,GAAG,CAAC,OAAO,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,CAAC;QAED,6DAA6D;QAC7D,4CAA4C;QAC5C,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACb,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1B,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;QAC5C,CAAC;QAED,+DAA+D;QAC/D,6DAA6D;QAC7D,iEAAiE;QACjE,uDAAuD;QACvD,OAAO,GAAG,CAAC,KAAK,CAAC;QAEjB,IAAI,GAAG,CAAC,QAAQ;YAAE,GAAG,CAAC,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAA4B,CAAC;QACrF,IAAI,GAAG,CAAC,IAAI;YAAE,GAAG,CAAC,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAA4B,CAAC;QAEzE,OAAO,GAAQ,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@doubling/types",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "Shared Firestore document interfaces and MIME / path helpers consumed by web/ and sync/. Single source of truth so the two consumers can never drift on a document shape (DOU-182, TS Phase 2 of the monorepo TypeScript migration).",
   "type": "module",
   "main": "./dist/index.js",
@@ -17,6 +17,7 @@
   ],
   "scripts": {
     "build": "tsc",
+    "test": "node --test \"src/**/*.test.ts\"",
     "typecheck": "tsc --noEmit",
     "prepare": "tsc",
     "prepack": "tsc"