@gaganref/confect-test 10.3.1-fork.91 → 10.3.1-fork.93

package/dist/internal/Redaction.d.ts

@@ -0,0 +1,142 @@
+import * as DatabaseSchema from "@confect/server/DatabaseSchema";
+import { type JSONValue, type Value } from "convex/values";
+import * as Result from "effect/Result";
+import type * as Schema from "effect/Schema";
+import * as SchemaAST from "effect/SchemaAST";
+import * as KernelRefusal from "./KernelRefusal.js";
+import type { FunctionPath } from "./KernelValues.js";
+/**
+ * What a marker writes in place of a secret in text and in values: a failure
+ * report, a diff, a read record.
+ */
+export declare const marker = "[redacted]";
+/**
+ * The key of a snapshot's marker object, `{ "$redacted": <ref> }`. Convex's
+ * encoded JSON allows no object key that starts with `$`, so no stored value
+ * reads as a marker.
+ */
+export declare const markerKey = "$redacted";
+/**
+ * Where a value may hold secrets: the type side of a schema's AST. A walk
+ * follows it through the encoded value, so the value bounds the walk.
+ */
+export type Shape = SchemaAST.AST;
+/**
+ * A shape placed at a path inside a value: a table's schema at a document's
+ * root, a job's target arguments at its row's `args.0`.
+ */
+export interface Placement {
+    readonly at: ReadonlyArray<string>;
+    readonly shape: Shape;
+}
+/**
+ * Whether `shape` holds a secret anywhere beneath it.
+ */
+export declare const hasSecret: (shape: Shape) => boolean;
+/**
+ * Whether the field at `fieldPath` of a document of `shape` holds a secret, or
+ * sits under one.
+ */
+export declare const sensitiveAt: (shape: Shape, fieldPath: ReadonlyArray<string>) => boolean;
+/**
+ * Which values the kernel treats as secret: the shapes of a table's documents,
+ * of a function's arguments and of its return value.
+ */
+export interface Policy {
+    readonly table: (componentPath: string, table: string) => Shape | undefined;
+    readonly args: (functionPath: FunctionPath) => Shape | undefined;
+    readonly returns: (functionPath: FunctionPath) => Shape | undefined;
+}
+/**
+ * A schema the policy builds the first time it needs it, as Confect's specs and
+ * tables keep theirs.
+ */
+export type Lazy = () => Schema.Top;
+/**
+ * The schemas a policy reads its secret nodes from, by component path, then
+ * table name or `module:export`. Row 8's codegen fills this from the Confect
+ * specs. A test that declares it by hand writes the same record.
+ */
+export interface Declared {
+    readonly tables?: Readonly<Record<string, Readonly<Record<string, Lazy>>>>;
+    readonly functions?: Readonly<Record<string, Readonly<Record<string, {
+        readonly args?: Lazy;
+        readonly returns?: Lazy;
+    }>>>>;
+}
+/**
+ * A policy from `declared`'s schemas. Each schema is built the first time its
+ * shape is asked for.
+ */
+export declare const policy: (declared: Declared) => Policy;
+export declare const none: Policy;
+/**
+ * Two declarations as one: `second`'s entries win where both name a table or
+ * function.
+ */
+export declare const merge: (first: Declared, second: Declared) => Declared;
+/**
+ * A Confect database schema's tables, as a policy's `tables` entry for one
+ * component. No table's schema is built until the kernel asks for its shape.
+ */
+export declare const tablesOf: (databaseSchema: DatabaseSchema.AnyWithProps) => Readonly<Record<string, Lazy>>;
+/**
+ * The raw secrets the kernel has seen under a secret node, in the order it
+ * first saw each, with every string a compound secret holds beneath it. This
+ * store is replay state: it lives in memory beside the world and is never
+ * written to an artifact. A snapshot's markers name entries here by position.
+ */
+export declare class Secrets {
+    private readonly values;
+    private readonly refs;
+    private readonly texts;
+    /**
+     * Keep `value` and answer its position. A value kept before answers its first
+     * position.
+     */
+    keep(value: JSONValue): number;
+    raw(ref: number): JSONValue | undefined;
+    /**
+     * Every kept secret's text long enough to search free text for, longest
+     * first, so a secret inside another is never marked half.
+     */
+    searchable(): ReadonlyArray<string>;
+    copy(): Secrets;
+}
+/**
+ * Keep every secret of `value` that `placements` put there, before it is
+ * validated, so a validation error can already mark it.
+ */
+export declare const keep: (value: unknown, placements: ReadonlyArray<Placement>, secrets: Secrets) => void;
+/**
+ * `json`, a document bound for a snapshot, with every secret its placements put
+ * there, and every string holding a kept secret, replaced by a marker that
+ * names the raw value's position in `secrets`. The walk never enters a marker,
+ * so marking a marked value changes nothing.
+ */
+export declare const mark: (json: JSONValue, placements: ReadonlyArray<Placement>, secrets: Secrets) => JSONValue;
+/**
+ * `value` as an artifact other than a snapshot writes it: every secret its
+ * placements put there, and every string holding a kept secret, replaced by the
+ * marker text.
+ */
+export declare const markValue: (value: Value, placements: ReadonlyArray<Placement>, secrets: Secrets) => Value;
+/**
+ * `json` with each marker replaced by the raw value it names in `secrets`, or
+ * `SnapshotSecretMissing` for the first marker the store cannot answer.
+ */
+export declare const unmark: (json: JSONValue, secrets: Secrets) => Result.Result<JSONValue, KernelRefusal.SnapshotSecretMissing>;
+/**
+ * `text` with every kept secret, raw or as it appears inside a JSON string,
+ * replaced by the marker.
+ */
+export declare const scrubText: (text: string, secrets: Secrets) => string;
+/**
+ * A failure report for `thrown`, whatever was thrown: every kept secret in its
+ * text, its data and its causes marked. When nothing needs marking it is
+ * `thrown` itself. Otherwise it is a copy with the same prototype and fields,
+ * so its class and tag still read the same. `thrown` is never changed, so a
+ * subscription that keeps the raw error compares it as it was.
+ */
+export declare const failure: (thrown: unknown, secrets: Secrets) => unknown;
+//# sourceMappingURL=Redaction.d.ts.map

package/dist/internal/Redaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Redaction.d.ts","sourceRoot":"","sources":["../../src/internal/Redaction.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,cAAc,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,KAAK,EACX,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,SAAS,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD;;;GAGG;AACH,eAAO,MAAM,MAAM,eAAe,CAAC;AAEnC;;;;GAIG;AACH,eAAO,MAAM,SAAS,cAAc,CAAC;AAUrC;;;GAGG;AACH,MAAM,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC;AAElC;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;CACvB;AA6CD;;GAEG;AACH,eAAO,MAAM,SAAS,UAAW,KAAK,KAAG,OAOxC,CAAC;AAmLF;;;GAGG;AACH,eAAO,MAAM,WAAW,UACf,KAAK,aACD,aAAa,CAAC,MAAM,CAAC,KAC/B,OAoCF,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,KAAK,EAAE,CAAC,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,KAAK,GAAG,SAAS,CAAC;IAC5E,QAAQ,CAAC,IAAI,EAAE,CAAC,YAAY,EAAE,YAAY,KAAK,KAAK,GAAG,SAAS,CAAC;IACjE,QAAQ,CAAC,OAAO,EAAE,CAAC,YAAY,EAAE,YAAY,KAAK,KAAK,GAAG,SAAS,CAAC;CACrE;AAED;;;GAGG;AACH,MAAM,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC;AAEpC;;;;GAIG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAC3B,MAAM,CACJ,MAAM,EACN,QAAQ,CACN,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAA;KAAE,CAAC,CAClE,CACF,CACF,CAAC;CACH;AAUD;;;GAGG;AACH,eAAO,MAAM,MAAM,aAAc,QAAQ,KAAG,MAoB3C,CAAC;AAEF,eAAO,MAAM,IAAI,EAAE,MAAmB,CAAC;AAEvC;;;GAGG;AACH,eAAO,MAAM,KAAK,UAAW,QAAQ,UAAU,QAAQ,KAAG,QAiBzD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,QAAQ,mBACH,cAAc,CAAC,YAAY,KAC1C,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAQ7B,CAAC;AAwBJ;;;;;GAKG;AACH,qBAAa,OAAO;IAClB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;IAC/C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA6B;IAClD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqB;IAE3C;;;OAGG;IACH,IAAI,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAQ7B;IAED,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAEtC;IAED;;;OAGG;IACH,UAAU,IAAI,aAAa,CAAC,MAAM,CAAC,CAIlC;IAED,IAAI,IAAI,OAAO,CAId;CACF;AAED;;;GAGG;AACH,eAAO,MAAM,IAAI,UACR,OAAO,cACF,aAAa,CAAC,SAAS,CAAC,WAC3B,OAAO,KACf,IAcF,CAAC;AAsCF;;;;;GAKG;AACH,eAAO,MAAM,IAAI,SACT,SAAS,cACH,aAAa,CAAC,SAAS,CAAC,WAC3B,OAAO,KACf,SASF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,SAAS,UACb,KAAK,cACA,aAAa,CAAC,SAAS,CAAC,WAC3B,OAAO,KACf,KAaF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,MAAM,SACX,SAAS,WACN,OAAO,KACf,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,aAAa,CAAC,qBAAqB,CAwB9D,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,SAAS,SAAU,MAAM,WAAW,OAAO,KAAG,MAIjD,CAAC;AAMX;;;;;;GAMG;AACH,eAAO,MAAM,OAAO,WAAY,OAAO,WAAW,OAAO,KAAG,OAoE3D,CAAC"}

package/dist/internal/Redaction.js

@@ -0,0 +1,448 @@
+import { SnapshotSecretMissing } from "./KernelRefusal.js";
+import { convexToJson, jsonToConvex } from "convex/values";
+import * as Result from "effect/Result";
+import * as DatabaseSchema from "@confect/server/DatabaseSchema";
+import * as SchemaAST from "effect/SchemaAST";
+//#region src/internal/Redaction.ts
+/**
+* What a marker writes in place of a secret in text and in values: a failure
+* report, a diff, a read record.
+*/
+const marker = "[redacted]";
+/**
+* The key of a snapshot's marker object, `{ "$redacted": <ref> }`. Convex's
+* encoded JSON allows no object key that starts with `$`, so no stored value
+* reads as a marker.
+*/
+const markerKey = "$redacted";
+/**
+* Free text has no schema, so a failure report's message and stack are searched
+* for every kept secret string. A string shorter than this is not searched for,
+* or text that merely shares a few letters would be marked. Values are marked
+* by their schema at any length.
+*/
+const searchableLength = 4;
+const isSecretNode = (ast) => ast._tag === "Declaration" && (SchemaAST.resolve(ast)?.["representation"])?.id === "effect/schema/Redacted";
+/**
+* Whether a secret node is reachable from `ast`. A suspension is followed once
+* per ancestry, so a recursive schema ends, and a suspension reused at another
+* path is followed again there.
+*/
+const reachesSecret = (ast, ancestry) => {
+	if (isSecretNode(ast)) return true;
+	switch (ast._tag) {
+		case "Objects": return ast.propertySignatures.some((p) => reachesSecret(p.type, ancestry)) || ast.indexSignatures.some((i) => reachesSecret(i.type, ancestry));
+		case "Arrays": return [...ast.elements, ...ast.rest].some((e) => reachesSecret(e, ancestry));
+		case "Union": return ast.types.some((t) => reachesSecret(t, ancestry));
+		case "Declaration": return ast.typeParameters.some((t) => reachesSecret(t, ancestry));
+		case "Suspend": {
+			if (ancestry.has(ast)) return false;
+			ancestry.add(ast);
+			const found = reachesSecret(ast.thunk(), ancestry);
+			ancestry.delete(ast);
+			return found;
+		}
+		default: return false;
+	}
+};
+const reaches = /* @__PURE__ */ new WeakMap();
+/**
+* Whether `shape` holds a secret anywhere beneath it.
+*/
+const hasSecret = (shape) => {
+	let found = reaches.get(shape);
+	if (found === void 0) {
+		found = reachesSecret(shape, /* @__PURE__ */ new Set());
+		reaches.set(shape, found);
+	}
+	return found;
+};
+const isObject = (json) => typeof json === "object" && json !== null && !Array.isArray(json);
+/**
+* A Convex encoded leaf, such as `{"$integer": …}` or `{"$bytes": …}`, or a
+* marker: one key that starts with `$`.
+*/
+const isWrapped = (json) => {
+	if (!isObject(json)) return false;
+	const keys = Object.keys(json);
+	return keys.length === 1 && keys[0].startsWith("$");
+};
+const isMarker = (json) => isObject(json) && Object.keys(json).length === 1 && "$redacted" in json;
+const isRecord = (json) => isObject(json) && !isWrapped(json);
+/**
+* Whether `json` can be a value of `ast`, for choosing a union's members. Nodes
+* the walk does not look into fit anything.
+*/
+const fits = (ast, json, ancestry = /* @__PURE__ */ new Set()) => {
+	switch (ast._tag) {
+		case "Objects": return isRecord(json);
+		case "Arrays": return Array.isArray(json);
+		case "String":
+		case "TemplateLiteral": return typeof json === "string";
+		case "Number": return typeof json === "number" || isObject(json) && "$float" in json;
+		case "BigInt": return isObject(json) && "$integer" in json;
+		case "Boolean": return typeof json === "boolean";
+		case "Null": return json === null;
+		case "Literal": return typeof ast.literal === "bigint" ? isObject(json) && "$integer" in json : json === ast.literal;
+		case "Union": return ast.types.some((t) => fits(t, json, ancestry));
+		case "Suspend": {
+			if (ancestry.has(ast)) return true;
+			ancestry.add(ast);
+			const fit = fits(ast.thunk(), json, ancestry);
+			ancestry.delete(ast);
+			return fit;
+		}
+		case "Declaration": return !isSecretNode(ast) || ast.typeParameters.some((t) => fits(t, json, ancestry));
+		default: return true;
+	}
+};
+/**
+* `json` with `onSecret` applied at every position where `shape` puts a secret.
+* A value whose structure the shape cannot follow, beneath a node that holds a
+* secret, is treated as secret whole: the walk fails closed. A marker is never
+* walked again, so marking is idempotent and overlapping members of a union
+* mark a shared field once.
+*/
+const walk = (shape, json, onSecret, unconsumed = /* @__PURE__ */ new Set()) => {
+	if (isMarker(json)) return json;
+	if (isSecretNode(shape)) return onSecret(json);
+	if (!hasSecret(shape)) return json;
+	switch (shape._tag) {
+		case "Objects": {
+			if (!isRecord(json)) return onSecret(json);
+			const named = new Map(shape.propertySignatures.map((p) => [String(p.name), p.type]));
+			return Object.fromEntries(Object.entries(json).map(([key, item]) => {
+				const type = named.get(key);
+				return [key, type !== void 0 ? walk(type, item, onSecret) : shape.indexSignatures.reduce((value, index) => walk(index.type, value, onSecret), item)];
+			}));
+		}
+		case "Arrays": {
+			if (!Array.isArray(json)) return onSecret(json);
+			const [rest, ...post] = shape.rest;
+			return json.map((item, i) => {
+				if (i < shape.elements.length) return walk(shape.elements[i], item, onSecret);
+				const fromEnd = json.length - i;
+				if (fromEnd <= post.length) return walk(post[post.length - fromEnd], item, onSecret);
+				return rest === void 0 ? item : walk(rest, item, onSecret);
+			});
+		}
+		case "Union": {
+			const members = shape.types.filter((t) => fits(t, json));
+			if (members.length === 0) return onSecret(json);
+			return members.reduce((value, member) => walk(member, value, onSecret, unconsumed), json);
+		}
+		case "Suspend": {
+			if (unconsumed.has(shape)) return json;
+			unconsumed.add(shape);
+			const walked = walk(shape.thunk(), json, onSecret, unconsumed);
+			unconsumed.delete(shape);
+			return walked;
+		}
+		case "Declaration": return shape.typeParameters.reduce((value, parameter) => walk(parameter, value, onSecret, unconsumed), json);
+		default: return onSecret(json);
+	}
+};
+const replaceAt = (json, path, replace) => {
+	if (path.length === 0) return replace(json);
+	const [head, ...rest] = path;
+	if (Array.isArray(json)) return json.map((item, i) => `${i}` === head ? replaceAt(item, rest, replace) : item);
+	if (isRecord(json)) return Object.fromEntries(Object.entries(json).map(([key, item]) => [key, key === head ? replaceAt(item, rest, replace) : item]));
+	return json;
+};
+const walkPlaced = (json, placements, onSecret) => placements.reduce((value, { at, shape }) => replaceAt(value, at, (inner) => walk(shape, inner, onSecret)), json);
+/**
+* Whether the field at `fieldPath` of a document of `shape` holds a secret, or
+* sits under one.
+*/
+const sensitiveAt = (shape, fieldPath) => {
+	const at = (ast, path, ancestry) => {
+		if (isSecretNode(ast)) return true;
+		if (path.length === 0) return hasSecret(ast);
+		const [head, ...rest] = path;
+		switch (ast._tag) {
+			case "Objects": {
+				const property = ast.propertySignatures.find((p) => String(p.name) === head);
+				return property !== void 0 ? at(property.type, rest, /* @__PURE__ */ new Set()) : ast.indexSignatures.some((i) => at(i.type, rest, /* @__PURE__ */ new Set()));
+			}
+			case "Union": return ast.types.some((t) => at(t, path, ancestry));
+			case "Declaration": return ast.typeParameters.some((t) => at(t, path, ancestry));
+			case "Suspend": {
+				if (ancestry.has(ast)) return false;
+				ancestry.add(ast);
+				const found = at(ast.thunk(), path, ancestry);
+				ancestry.delete(ast);
+				return found;
+			}
+			default: return hasSecret(ast);
+		}
+	};
+	return at(shape, fieldPath, /* @__PURE__ */ new Set());
+};
+const memo = (compute) => {
+	const cache = /* @__PURE__ */ new Map();
+	return (key) => {
+		if (!cache.has(key)) cache.set(key, compute(key));
+		return cache.get(key);
+	};
+};
+/**
+* A policy from `declared`'s schemas. Each schema is built the first time its
+* shape is asked for.
+*/
+const policy = (declared) => {
+	const split = (key) => key.split("\0");
+	const table = memo((key) => {
+		const [componentPath, name] = split(key);
+		return declared.tables?.[componentPath]?.[name]?.().ast;
+	});
+	const fn = (part) => memo((key) => {
+		const [componentPath, udfPath] = split(key);
+		return declared.functions?.[componentPath]?.[udfPath]?.[part]?.().ast;
+	});
+	const args = fn("args");
+	const returns = fn("returns");
+	return {
+		table: (componentPath, name) => table(`${componentPath}\u0000${name}`),
+		args: ({ componentPath, udfPath }) => args(`${componentPath}\u0000${udfPath}`),
+		returns: ({ componentPath, udfPath }) => returns(`${componentPath}\u0000${udfPath}`)
+	};
+};
+const none = policy({});
+/**
+* Two declarations as one: `second`'s entries win where both name a table or
+* function.
+*/
+const merge = (first, second) => {
+	const each = (a, b) => Object.fromEntries([.../* @__PURE__ */ new Set([...Object.keys(a ?? {}), ...Object.keys(b ?? {})])].map((componentPath) => [componentPath, {
+		...a?.[componentPath],
+		...b?.[componentPath]
+	}]));
+	return {
+		tables: each(first.tables, second.tables),
+		functions: each(first.functions, second.functions)
+	};
+};
+/**
+* A Confect database schema's tables, as a policy's `tables` entry for one
+* component. No table's schema is built until the kernel asks for its shape.
+*/
+const tablesOf = (databaseSchema) => Object.fromEntries(Object.values(DatabaseSchema.tables(databaseSchema)).map((table) => [table.tableName, () => table.Fields]));
+/**
+* The text a secret leaf can show in free text: a string itself, an int64 as
+* its decimal digits.
+*/
+const leafTexts = (json) => {
+	if (typeof json === "string") return [json];
+	if (Array.isArray(json)) return json.flatMap(leafTexts);
+	if (isObject(json)) {
+		if ("$integer" in json) try {
+			const integer = jsonToConvex(json);
+			return typeof integer === "bigint" ? [integer.toString()] : [];
+		} catch {
+			return [];
+		}
+		if (isWrapped(json)) return [];
+		return Object.values(json).flatMap(leafTexts);
+	}
+	return [];
+};
+/**
+* The raw secrets the kernel has seen under a secret node, in the order it
+* first saw each, with every string a compound secret holds beneath it. This
+* store is replay state: it lives in memory beside the world and is never
+* written to an artifact. A snapshot's markers name entries here by position.
+*/
+var Secrets = class Secrets {
+	values = [];
+	refs = /* @__PURE__ */ new Map();
+	texts = /* @__PURE__ */ new Set();
+	/**
+	* Keep `value` and answer its position. A value kept before answers its first
+	* position.
+	*/
+	keep(value) {
+		const key = JSON.stringify(value);
+		const known = this.refs.get(key);
+		if (known !== void 0) return known;
+		this.values.push(value);
+		this.refs.set(key, this.values.length - 1);
+		for (const text of leafTexts(value)) this.texts.add(text);
+		return this.values.length - 1;
+	}
+	raw(ref) {
+		return this.values[ref];
+	}
+	/**
+	* Every kept secret's text long enough to search free text for, longest
+	* first, so a secret inside another is never marked half.
+	*/
+	searchable() {
+		return [...this.texts].filter((text) => text.length >= searchableLength).sort((a, b) => b.length - a.length);
+	}
+	copy() {
+		const copy = new Secrets();
+		for (const value of this.values) copy.keep(value);
+		return copy;
+	}
+};
+/**
+* Keep every secret of `value` that `placements` put there, before it is
+* validated, so a validation error can already mark it.
+*/
+const keep = (value, placements, secrets) => {
+	if (placements.length === 0) return;
+	let json;
+	try {
+		json = convexToJson(value);
+	} catch {
+		return;
+	}
+	walkPlaced(json, placements, (secret) => {
+		secrets.keep(secret);
+		return secret;
+	});
+};
+const containsSecret = (text, searchable) => searchable.some((secret) => text.includes(secret));
+/**
+* The backstop beneath every schema walk: each string, outside a marker, that
+* holds a kept secret, replaced by `replace`.
+*/
+const backstop = (json, searchable, replace) => {
+	if (searchable.length === 0) return json;
+	const go = (value) => {
+		if (typeof value === "string") return containsSecret(value, searchable) ? replace(value) : value;
+		if (Array.isArray(value)) return value.map(go);
+		if (isObject(value)) {
+			if (isWrapped(value)) return value;
+			return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, systemFields.has(key) ? item : go(item)]));
+		}
+		return value;
+	};
+	return go(json);
+};
+const systemFields = /* @__PURE__ */ new Set(["_id", "_creationTime"]);
+/**
+* `json`, a document bound for a snapshot, with every secret its placements put
+* there, and every string holding a kept secret, replaced by a marker that
+* names the raw value's position in `secrets`. The walk never enters a marker,
+* so marking a marked value changes nothing.
+*/
+const mark = (json, placements, secrets) => {
+	const toMarker = (value) => ({ [markerKey]: secrets.keep(value) });
+	return backstop(walkPlaced(json, placements, toMarker), secrets.searchable(), toMarker);
+};
+/**
+* `value` as an artifact other than a snapshot writes it: every secret its
+* placements put there, and every string holding a kept secret, replaced by the
+* marker text.
+*/
+const markValue = (value, placements, secrets) => {
+	let json;
+	try {
+		json = convexToJson(value);
+	} catch {
+		return value;
+	}
+	const marked = backstop(walkPlaced(json, placements, () => marker), secrets.searchable(), () => marker);
+	return marked === json ? value : jsonToConvex(marked);
+};
+/**
+* `json` with each marker replaced by the raw value it names in `secrets`, or
+* `SnapshotSecretMissing` for the first marker the store cannot answer.
+*/
+const unmark = (json, secrets) => {
+	let missing = void 0;
+	const go = (value) => {
+		if (Array.isArray(value)) return value.map(go);
+		if (!isObject(value)) return value;
+		if (isMarker(value)) {
+			const ref = value[markerKey];
+			const raw = typeof ref === "number" ? secrets.raw(ref) : void 0;
+			if (raw === void 0) missing ??= ref;
+			return raw ?? null;
+		}
+		return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, go(item)]));
+	};
+	const unmarked = go(json);
+	return missing === void 0 ? Result.succeed(unmarked) : Result.fail(new SnapshotSecretMissing({
+		ref: JSON.stringify(missing),
+		message: `The snapshot marks a secret at ${JSON.stringify(missing)}, which the secrets passed to restore do not hold. Restore with the secrets of the backend that exported it.`
+	}));
+};
+/**
+* `text` with every kept secret, raw or as it appears inside a JSON string,
+* replaced by the marker.
+*/
+const scrubText = (text, secrets) => secrets.searchable().reduce((scrubbed, secret) => {
+	const escaped = JSON.stringify(secret).slice(1, -1);
+	return scrubbed.split(secret).join(marker).split(escaped).join(marker);
+}, text);
+const isPlainObject = (value) => Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null;
+/**
+* A failure report for `thrown`, whatever was thrown: every kept secret in its
+* text, its data and its causes marked. When nothing needs marking it is
+* `thrown` itself. Otherwise it is a copy with the same prototype and fields,
+* so its class and tag still read the same. `thrown` is never changed, so a
+* subscription that keeps the raw error compares it as it was.
+*/
+const failure = (thrown, secrets) => {
+	if (secrets.searchable().length === 0) return thrown;
+	const copyable = (value) => Array.isArray(value) || value instanceof Error || isPlainObject(value);
+	const field = (value, key) => {
+		const descriptor = Object.getOwnPropertyDescriptor(value, key);
+		return {
+			raw: "value" in descriptor ? descriptor.value : Reflect.get(value, key),
+			enumerable: descriptor.enumerable ?? false
+		};
+	};
+	const visited = /* @__PURE__ */ new Set();
+	const holdsSecret = (value) => {
+		if (typeof value === "string") return scrubText(value, secrets) !== value;
+		if (typeof value !== "object" || value === null) return false;
+		if (visited.has(value) || !copyable(value)) return false;
+		visited.add(value);
+		return Reflect.ownKeys(value).some((key) => holdsSecret(field(value, key).raw));
+	};
+	if (!holdsSecret(thrown)) return thrown;
+	const copies = /* @__PURE__ */ new Map();
+	const copy = (value) => {
+		if (typeof value === "string") return scrubText(value, secrets);
+		if (typeof value !== "object" || value === null) return value;
+		if (copies.has(value)) return copies.get(value);
+		if (!copyable(value)) return value;
+		if (Array.isArray(value)) {
+			const items = [];
+			copies.set(value, items);
+			for (const key of Reflect.ownKeys(value)) {
+				if (key === "length") continue;
+				const { raw, enumerable } = field(value, key);
+				if (typeof key === "string" && /^(0|[1-9][0-9]*)$/.test(key)) items[Number(key)] = copy(raw);
+				else Object.defineProperty(items, key, {
+					value: copy(raw),
+					writable: true,
+					enumerable,
+					configurable: true
+				});
+			}
+			items.length = value.length;
+			return items;
+		}
+		const target = Object.create(Object.getPrototypeOf(value));
+		copies.set(value, target);
+		for (const key of Reflect.ownKeys(value)) {
+			const { raw, enumerable } = field(value, key);
+			Object.defineProperty(target, key, {
+				value: copy(raw),
+				writable: true,
+				enumerable,
+				configurable: true
+			});
+		}
+		return target;
+	};
+	return copy(thrown);
+};
+//#endregion
+export { Secrets, failure, hasSecret, keep, mark, markValue, marker, markerKey, merge, none, policy, scrubText, sensitiveAt, tablesOf, unmark };
+
+//# sourceMappingURL=Redaction.js.map