@lapismd/agent-redaction 0.0.0-stage → 0.1.0

package/LICENSE.md

@@ -0,0 +1,4 @@
+Apache-2.0
+
+This project is licensed under the Apache License 2.0.
+See <https://www.apache.org/licenses/LICENSE-2.0>.

package/README.md

@@ -1,3 +1,10 @@
-# Temporary Holding Version
+# Agent redaction
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Portable complete-block sanitization for observable agent transcripts. The core
+has no runtime effects. Explicit Node and Deno adapters add reviewed Secretlint
+detectors and granted secret discovery. This package does not sanitize external
+agent software, native VCS archives or data written before capture.
+
+See the canonical [specification](spec/src/sanitization.md) and
+[verification record](spec/src/verification.md). Publication is not part of local
+development acceptance.

package/dist/deno.d.ts

@@ -0,0 +1,3 @@
+export { createNodeDetector as createDenoDetector, createNodeRedaction as createDenoRedaction, refreshNodeSecrets as refreshDenoSecrets, } from "./node.js";
+export type { SecretGrants } from "./node.js";
+export { SynchronousRedaction } from "./sync.js";

package/dist/deno.js

@@ -0,0 +1,4 @@
+// Deno's node compatibility is an explicit, separately tested enforcement adapter.
+// Permissions remain enforced by Deno; nothing is discovered on module import.
+export { createNodeDetector as createDenoDetector, createNodeRedaction as createDenoRedaction, refreshNodeSecrets as refreshDenoSecrets, } from "./node.js";
+export { SynchronousRedaction } from "./sync.js";

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export { RedactionScope } from "./sanitizer.js";
+export { CompleteBlock } from "./stream.js";
+export { LIMITS, omit } from "./types.js";
+export type { Json, LogicalPath, TrustedRoot, Detector, Span, Result, Sanitized, SanitizationSummary, Omission, OmissionReason, Policy, } from "./types.js";

package/dist/index.js

@@ -0,0 +1,3 @@
+export { RedactionScope } from "./sanitizer.js";
+export { CompleteBlock } from "./stream.js";
+export { LIMITS, omit } from "./types.js";

package/dist/node-worker.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/node-worker.js

@@ -0,0 +1,13 @@
+import { parentPort } from "node:worker_threads";
+import { secretlintDetector } from "./secretlint.js";
+parentPort.on("message", async ({ id, text }) => {
+    try {
+        parentPort.postMessage({
+            id,
+            spans: await secretlintDetector.scan(text),
+        });
+    }
+    catch {
+        parentPort.postMessage({ id, failure: true });
+    }
+});

package/dist/node.d.ts

@@ -0,0 +1,18 @@
+import { RedactionScope } from "./sanitizer.js";
+import { type Detector, type Policy } from "./types.js";
+export { SynchronousRedaction } from "./sync.js";
+export interface NodeDetector extends Detector {
+    dispose(): void;
+}
+/** Explicit construction starts an isolated scanner. No worker starts on import. */
+export declare function createNodeDetector(timeoutMs?: number): NodeDetector;
+export interface SecretGrants {
+    readonly environment?: readonly string[];
+    readonly dotenvFiles?: readonly string[];
+}
+/** Only explicit names and canonical paths are read. No directory discovery. */
+export declare function refreshNodeSecrets(scope: Pick<RedactionScope, "registerSecrets" | "dispose">, grants: SecretGrants, environment?: Readonly<Record<string, string | undefined>>): Promise<boolean>;
+export declare function createNodeRedaction(policy?: Omit<Policy, "detector">): {
+    scope: RedactionScope;
+    dispose(): void;
+};

package/dist/node.js

@@ -0,0 +1,131 @@
+import { Worker } from "node:worker_threads";
+import { open, realpath } from "node:fs/promises";
+import { parse } from "dotenv";
+import { RedactionScope } from "./sanitizer.js";
+import { LIMITS } from "./types.js";
+export { SynchronousRedaction } from "./sync.js";
+/** Explicit construction starts an isolated scanner. No worker starts on import. */
+export function createNodeDetector(timeoutMs = 10_000) {
+    if (!Number.isInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 60_000)
+        throw new Error("policy_invalid");
+    let worker, next = 0, closed = false;
+    const pending = new Map();
+    const fail = () => {
+        for (const entry of pending.values()) {
+            clearTimeout(entry.timer);
+            entry.reject(new Error("detector_failure"));
+        }
+        pending.clear();
+        const previous = worker;
+        worker = undefined;
+        void previous?.terminate();
+    };
+    const start = () => {
+        if (worker)
+            return worker;
+        // Empty worker env prevents DEBUG and profiler settings from exposing source.
+        const active = new Worker(new URL("./node-worker.js", import.meta.url), {
+            env: {},
+            stdout: true,
+            stderr: true,
+            resourceLimits: { maxOldGenerationSizeMb: 128 },
+        });
+        active.stdout?.resume();
+        active.stderr?.resume();
+        active.on("message", (message) => {
+            const entry = pending.get(message.id);
+            if (!entry)
+                return;
+            clearTimeout(entry.timer);
+            pending.delete(message.id);
+            if (message.failure || !Array.isArray(message.spans))
+                entry.reject(new Error("detector_failure"));
+            else
+                entry.resolve(message.spans);
+        });
+        active.on("error", () => {
+            if (worker === active)
+                fail();
+        });
+        active.on("exit", () => {
+            if (worker === active)
+                fail();
+        });
+        worker = active;
+        return active;
+    };
+    return Object.freeze({
+        id: "secretlint-13.0.5-explicit-27-v1",
+        scan(text) {
+            if (closed || pending.size >= 64)
+                return Promise.reject(new Error("detector_failure"));
+            return new Promise((resolve, reject) => {
+                const id = ++next;
+                const timer = setTimeout(fail, timeoutMs);
+                pending.set(id, { resolve, reject, timer });
+                try {
+                    start().postMessage({ id, text });
+                }
+                catch {
+                    fail();
+                }
+            });
+        },
+        dispose() {
+            closed = true;
+            fail();
+        },
+    });
+}
+/** Only explicit names and canonical paths are read. No directory discovery. */
+export async function refreshNodeSecrets(scope, grants, environment = process.env) {
+    const values = [];
+    try {
+        if ((grants.environment?.length ?? 0) + (grants.dotenvFiles?.length ?? 0) >
+            LIMITS.secrets)
+            throw 0;
+        for (const name of grants.environment ?? []) {
+            if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name))
+                throw 0;
+            const value = environment[name];
+            if (value)
+                values.push(value);
+        }
+        for (const path of grants.dotenvFiles ?? []) {
+            const canonical = await realpath(path);
+            if (canonical !== path)
+                throw 0;
+            const handle = await open(canonical, "r");
+            try {
+                const stat = await handle.stat();
+                if (!stat.isFile() || stat.size > LIMITS.secretBytes)
+                    throw 0;
+                const data = new Uint8Array(LIMITS.secretBytes + 1);
+                const { bytesRead } = await handle.read(data, 0, data.length, 0);
+                if (bytesRead > LIMITS.secretBytes)
+                    throw 0;
+                const text = new TextDecoder("utf-8", { fatal: true }).decode(data.subarray(0, bytesRead));
+                values.push(...Object.values(parse(text)).filter(Boolean));
+            }
+            finally {
+                await handle.close();
+            }
+        }
+        return scope.registerSecrets(values);
+    }
+    catch {
+        scope.dispose();
+        return false;
+    }
+}
+export function createNodeRedaction(policy = {}) {
+    const detector = createNodeDetector();
+    const scope = new RedactionScope({ ...policy, detector });
+    return {
+        scope,
+        dispose() {
+            scope.dispose();
+            detector.dispose();
+        },
+    };
+}

package/dist/paths.d.ts

@@ -0,0 +1,7 @@
+import { type LogicalPath, type TrustedRoot } from "./types.js";
+export declare class PathRegistry {
+    #private;
+    constructor(roots: readonly TrustedRoot[], destination: "public" | "private-portable");
+    classify(value: string): LogicalPath;
+    text(value: string): string;
+}

package/dist/paths.js

@@ -0,0 +1,122 @@
+import { EXTERNAL } from "./types.js";
+const safeId = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
+function decodePath(value) {
+    if (/^file:\/\//i.test(value)) {
+        const url = new URL(value);
+        if (url.username || url.password || url.search || url.hash)
+            throw 0;
+        const decoded = decodeURIComponent(url.pathname);
+        return url.hostname && url.hostname !== "localhost"
+            ? `//${url.hostname}${decoded}`
+            : decoded.replace(/^\/([A-Za-z]:\/)/, "$1");
+    }
+    return value;
+}
+function windows(value) {
+    return /^[A-Za-z]:[\\/]|^\\\\|^\/\/[^/]/.test(value);
+}
+function normal(value) {
+    const decoded = decodePath(value);
+    return windows(decoded) ? decoded.replace(/\\/g, "/") : decoded;
+}
+function absolute(value) {
+    return /^(?:\/|[A-Za-z]:\/)/.test(value);
+}
+function traversal(value) {
+    return (value.split("/").some((part) => part === ".." || part === ".") ||
+        /%2e|%2f|%5c/i.test(value));
+}
+function escape(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+export class PathRegistry {
+    #roots = [];
+    #public;
+    constructor(roots, destination) {
+        this.#public = destination === "public";
+        if (roots.length > 128)
+            throw 0;
+        for (const root of roots) {
+            if (root.kind === "workspace" && (!root.id || !safeId.test(root.id)))
+                throw 0;
+            if (root.repositoryId && !safeId.test(root.repositoryId))
+                throw 0;
+            for (const path of [root.path, ...(root.aliases ?? [])]) {
+                const clean = normal(path).replace(/\/+$/, "");
+                if (!absolute(clean) ||
+                    traversal(clean) ||
+                    !clean ||
+                    /[\r\n\x00]/.test(clean))
+                    throw 0;
+                const item = {
+                    path: clean,
+                    kind: root.kind,
+                    id: root.id,
+                    repositoryId: root.repositoryId,
+                    sensitive: root.caseSensitive ?? !windows(path),
+                };
+                if (this.#roots.some((existing) => existing.path.toLowerCase() === clean.toLowerCase() &&
+                    (existing.kind !== item.kind || existing.id !== item.id)))
+                    throw 0;
+                this.#roots.push(item);
+            }
+        }
+        this.#roots.sort((a, b) => b.path.length - a.path.length);
+    }
+    classify(value) {
+        const external = (display = EXTERNAL) => Object.freeze({ kind: "external", display, resolvable: false });
+        let path;
+        try {
+            path = normal(value);
+        }
+        catch {
+            return external();
+        }
+        if (!absolute(path) ||
+            traversal(path) ||
+            /\[REDACTED\]|[\x00-\x1f]/.test(path))
+            return external();
+        for (const root of this.#roots) {
+            const candidate = root.sensitive ? path : path.toLowerCase();
+            const prefix = root.sensitive ? root.path : root.path.toLowerCase();
+            if (candidate !== prefix && !candidate.startsWith(prefix + "/"))
+                continue;
+            const relativePath = path.slice(root.path.length).replace(/^\//, "");
+            if (root.kind === "workspace")
+                return Object.freeze({
+                    kind: "workspace",
+                    workspaceId: root.id,
+                    ...(root.repositoryId ? { repositoryId: root.repositoryId } : {}),
+                    relativePath,
+                    display: `$WORKSPACE[${root.id}]${relativePath ? "/" + relativePath : ""}`,
+                    resolvable: true,
+                });
+            return external(this.#public
+                ? EXTERNAL
+                : `${root.kind === "home" ? "$HOME" : "$TMP"}${relativePath ? "/" + relativePath : ""}`);
+        }
+        return external();
+    }
+    text(value) {
+        if (this.#public)
+            value = value.replace(/\$(?:HOME|TMP)(?:[\\/][^\s<>"'`,;)]*)?/g, EXTERNAL);
+        // Skip web URLs as complete tokens; they are not local path capabilities.
+        const trusted = this.#roots
+            .map((root) => escape(root.path).replace(/\//g, "[\\\\/]"))
+            .join("|");
+        const candidate = `(?:https?|wss?):\\/\\/[^\\s<>\"'\x60]+|file:\\/\\/[^\\s<>\"'\x60]+|(?:${trusted || "(?!)"})(?:[\\\\/][^\\s<>\"'\x60,;)]*)?|[A-Za-z]:[\\\\/][^\\s<>\"'\x60,;)]*|\\\\\\\\[^\\s<>\"'\x60,;)]*|\\/(?:[^\\s/<>\"'\x60,;)]*\\/)+[^\\s<>\"'\x60,;)]*`;
+        const regex = new RegExp(candidate, "gi");
+        return value.replace(regex, (match, offset) => {
+            if (/^(?:https?|wss?):\/\//i.test(match))
+                return match;
+            // Do not match inside identifiers, URLs or already-portable placeholders.
+            const before = value.slice(0, offset);
+            if (offset > 0 && /[\w\/$\]]$/.test(before))
+                return match;
+            const after = value[offset + match.length];
+            if (after && /[\w.-]/.test(after))
+                return EXTERNAL;
+            return this.classify(match).display;
+        });
+    }
+}

package/dist/sanitizer.d.ts

@@ -0,0 +1,11 @@
+import { type Json, type LogicalPath, type Policy, type Result } from "./types.js";
+export declare class RedactionScope {
+    #private;
+    constructor(policy?: Policy);
+    get policyId(): string;
+    registerSecrets(values: readonly string[]): boolean;
+    dispose(): void;
+    text(raw: string): Promise<Result<string>>;
+    path(raw: string): Promise<Result<LogicalPath>>;
+    value(raw: unknown): Promise<Result<Json>>;
+}

package/dist/sanitizer.js

@@ -0,0 +1,186 @@
+import { PathRegistry } from "./paths.js";
+import { formatSpans, maskSpans, SecretRegistry, sensitiveKey, stripTerminalControls, } from "./secrets.js";
+import { LIMITS, REDACTED, omit, utf8Size, validUnicode, } from "./types.js";
+class Failure {
+    reason;
+    constructor(reason) {
+        this.reason = reason;
+    }
+}
+export class RedactionScope {
+    #registry = new SecretRegistry();
+    #paths;
+    #detector;
+    #destination;
+    #valid = true;
+    constructor(policy = {}) {
+        this.#destination = policy.destination ?? "public";
+        this.#detector = policy.detector;
+        if (this.#detector && !/^[a-zA-Z0-9._:/-]{1,160}$/.test(this.#detector.id))
+            this.#valid = false;
+        this.#registry.add(policy.secrets ?? []);
+        try {
+            this.#paths = new PathRegistry(policy.roots ?? [], this.#destination);
+        }
+        catch {
+            this.#valid = false;
+        }
+    }
+    get policyId() {
+        return `agent-redaction/1/${this.#destination}/${this.#detector?.id ?? "portable"}`;
+    }
+    registerSecrets(values) {
+        return this.#registry.add(values);
+    }
+    dispose() {
+        this.#registry.dispose();
+        this.#paths = undefined;
+        this.#valid = false;
+    }
+    async #scan(raw, metadata) {
+        if (!this.#valid || !this.#registry.valid || !this.#paths)
+            throw new Failure("policy_invalid");
+        if (typeof raw !== "string" || !validUnicode(raw))
+            throw new Failure("invalid_input");
+        if (utf8Size(raw) > LIMITS.text)
+            throw new Failure("limit_exceeded");
+        const text = stripTerminalControls(raw);
+        const spans = [...this.#registry.spans(text), ...formatSpans(text)];
+        if (this.#detector) {
+            try {
+                spans.push(...(await this.#detector.scan(text)));
+            }
+            catch {
+                throw new Failure("detector_failure");
+            }
+        }
+        let redacted;
+        try {
+            redacted = maskSpans(text, spans);
+        }
+        catch {
+            throw new Failure("detector_failure");
+        }
+        const portable = this.#paths.text(redacted);
+        if (utf8Size(portable) > LIMITS.text)
+            throw new Failure("limit_exceeded");
+        metadata.redacted ||= text !== redacted;
+        metadata.pathsNormalized ||= portable !== redacted;
+        return portable;
+    }
+    #result(value, metadata) {
+        const summary = Object.freeze({
+            version: 1,
+            policy: this.policyId,
+            coverage: this.#detector ? "credential-detectors" : "portable",
+            ...metadata,
+        });
+        return Object.freeze({ status: "sanitized", value, summary });
+    }
+    async text(raw) {
+        const metadata = { redacted: false, pathsNormalized: false };
+        try {
+            return this.#result(await this.#scan(raw, metadata), metadata);
+        }
+        catch (error) {
+            return omit(error instanceof Failure ? error.reason : "invalid_input");
+        }
+    }
+    async path(raw) {
+        const result = await this.text(raw);
+        if (result.status === "omitted")
+            return result;
+        // A secret-bearing path may be displayed, but cannot be resolved.
+        const path = result.summary.redacted
+            ? Object.freeze({
+                kind: "external",
+                display: "[EXTERNAL_PATH]",
+                resolvable: false,
+            })
+            : this.#paths.classify(raw);
+        return Object.freeze({ ...result, value: path });
+    }
+    async value(raw) {
+        const metadata = { redacted: false, pathsNormalized: false };
+        let size = 0, nodes = 0;
+        const seen = new Set();
+        const charge = (value) => {
+            size += utf8Size(JSON.stringify(value));
+            if (size > LIMITS.record)
+                throw new Failure("limit_exceeded");
+        };
+        const visit = async (value, depth) => {
+            if (++nodes > 100_000 || depth > LIMITS.depth)
+                throw new Failure("limit_exceeded");
+            if (typeof value === "string") {
+                charge(value);
+                return this.#scan(value, metadata);
+            }
+            if (value === null ||
+                typeof value === "boolean" ||
+                (typeof value === "number" && Number.isFinite(value))) {
+                size += 32;
+                if (size > LIMITS.record)
+                    throw new Failure("limit_exceeded");
+                return value;
+            }
+            if (typeof value !== "object" || seen.has(value))
+                throw new Failure("invalid_input");
+            const array = Array.isArray(value);
+            const prototype = Object.getPrototypeOf(value);
+            if ((!array && prototype !== Object.prototype && prototype !== null) ||
+                (array && prototype !== Array.prototype) ||
+                Object.getOwnPropertySymbols(value).length)
+                throw new Failure("invalid_input");
+            seen.add(value);
+            const descriptors = Object.getOwnPropertyDescriptors(value);
+            const keys = Object.keys(descriptors).filter((key) => !(array && key === "length"));
+            if (keys.length > 100_000)
+                throw new Failure("limit_exceeded");
+            const target = Object.create(null);
+            const entries = [];
+            for (const key of keys) {
+                const descriptor = descriptors[key];
+                if (!descriptor.enumerable ||
+                    !Object.hasOwn(descriptor, "value") ||
+                    key === "toJSON" ||
+                    key === "__proto__" ||
+                    key === "constructor" ||
+                    key === "prototype")
+                    throw new Failure("invalid_input");
+                charge(key);
+                if (array && key !== String(entries.length))
+                    throw new Failure("invalid_input");
+                const cleanKey = await this.#scan(key, metadata);
+                if (cleanKey !== key)
+                    throw new Failure("invalid_input");
+                let next;
+                if (sensitiveKey(key)) {
+                    next = REDACTED;
+                    metadata.redacted = true;
+                }
+                else
+                    next = await visit(descriptor.value, depth + 1);
+                if (array)
+                    entries.push(next);
+                else
+                    target[key] = next;
+            }
+            if (array && entries.length !== value.length)
+                throw new Failure("invalid_input");
+            seen.delete(value);
+            return Object.freeze(array ? entries : target);
+        };
+        try {
+            if (!this.#valid || !this.#registry.valid)
+                throw new Failure("policy_invalid");
+            const value = await visit(raw, 0);
+            if (utf8Size(JSON.stringify(value)) > LIMITS.record)
+                throw new Failure("limit_exceeded");
+            return this.#result(value, metadata);
+        }
+        catch (error) {
+            return omit(error instanceof Failure ? error.reason : "invalid_input");
+        }
+    }
+}

package/dist/secretlint.d.ts

@@ -0,0 +1,3 @@
+import type { Detector } from "./types.js";
+export declare const RULE_INVENTORY: readonly string[];
+export declare const secretlintDetector: Detector;

package/dist/secretlint.js

@@ -0,0 +1,128 @@
+import { lintSource } from "@secretlint/core";
+import { secretLintProfiler } from "@secretlint/profiler";
+import { creator as rule0 } from "@secretlint/secretlint-rule-aws";
+import { creator as rule1 } from "@secretlint/secretlint-rule-gcp";
+import { creator as rule2 } from "@secretlint/secretlint-rule-privatekey";
+import { creator as rule3 } from "@secretlint/secretlint-rule-npm";
+import { creator as rule4 } from "@secretlint/secretlint-rule-basicauth";
+import { creator as rule5 } from "@secretlint/secretlint-rule-slack";
+import { creator as rule6 } from "@secretlint/secretlint-rule-sendgrid";
+import { creator as rule7 } from "@secretlint/secretlint-rule-shopify";
+import { creator as rule8 } from "@secretlint/secretlint-rule-stripe";
+import { creator as rule9 } from "@secretlint/secretlint-rule-github";
+import { creator as rule10 } from "@secretlint/secretlint-rule-gitlab";
+import { creator as rule11 } from "@secretlint/secretlint-rule-grafana";
+import { creator as rule12 } from "@secretlint/secretlint-rule-openai";
+import { creator as rule13 } from "@secretlint/secretlint-rule-anthropic";
+import { creator as rule14 } from "@secretlint/secretlint-rule-groq";
+import { creator as rule15 } from "@secretlint/secretlint-rule-huggingface";
+import { creator as rule16 } from "@secretlint/secretlint-rule-linear";
+import { creator as rule17 } from "@secretlint/secretlint-rule-notion";
+import { creator as rule18 } from "@secretlint/secretlint-rule-1password";
+import { creator as rule19 } from "@secretlint/secretlint-rule-database-connection-string";
+import { creator as rule20 } from "@secretlint/secretlint-rule-hashicorp-vault";
+import { creator as rule21 } from "@secretlint/secretlint-rule-vercel";
+import { creator as rule22 } from "@secretlint/secretlint-rule-databricks";
+import { creator as rule23 } from "@secretlint/secretlint-rule-docker";
+import { creator as rule24 } from "@secretlint/secretlint-rule-figma";
+import { creator as rule25 } from "@secretlint/secretlint-rule-cloudflare";
+import { creator as rule26 } from "@secretlint/secretlint-rule-tailscale";
+export const RULE_INVENTORY = Object.freeze([
+    "aws",
+    "gcp",
+    "privatekey",
+    "npm",
+    "basicauth",
+    "slack",
+    "sendgrid",
+    "shopify",
+    "stripe",
+    "github",
+    "gitlab",
+    "grafana",
+    "openai",
+    "anthropic",
+    "groq",
+    "huggingface",
+    "linear",
+    "notion",
+    "1password",
+    "database-connection-string",
+    "hashicorp-vault",
+    "vercel",
+    "databricks",
+    "docker",
+    "figma",
+    "cloudflare",
+    "tailscale",
+]);
+// No config loader, preset, filter-comments, allows, or producer options.
+const rules = [
+    rule0,
+    rule1,
+    rule2,
+    rule3,
+    rule4,
+    rule5,
+    rule6,
+    rule7,
+    rule8,
+    rule9,
+    rule10,
+    rule11,
+    rule12,
+    rule13,
+    rule14,
+    rule15,
+    rule16,
+    rule17,
+    rule18,
+    rule19,
+    rule20,
+    rule21,
+    rule22,
+    rule23,
+    rule24,
+    rule25,
+    rule26,
+];
+secretLintProfiler.setEnabled(false);
+export const secretlintDetector = Object.freeze({
+    id: "secretlint-13.0.5-explicit-27-v1",
+    async scan(text) {
+        try {
+            const result = await lintSource({
+                source: {
+                    content: text,
+                    filePath: "transcript.txt",
+                    ext: ".txt",
+                    contentType: "text",
+                },
+                options: {
+                    noPhysicFilePath: true,
+                    maskSecrets: true,
+                    config: { rules: rules.map((rule) => ({ id: rule.meta.id, rule })) },
+                },
+            });
+            // Some rules report an assignment prefix with a credential-length range.
+            // Mask the complete affected lines so a misaligned range cannot retain a suffix.
+            return result.messages.map((message) => {
+                const [start, end] = message.range;
+                if (!Number.isInteger(start) ||
+                    !Number.isInteger(end) ||
+                    start < 0 ||
+                    end <= start ||
+                    end > text.length)
+                    throw 0;
+                const lineEnd = text.indexOf("\n", end);
+                return Object.freeze({
+                    start: text.lastIndexOf("\n", Math.max(0, start - 1)) + 1,
+                    end: lineEnd === -1 ? text.length : lineEnd,
+                });
+            });
+        }
+        catch {
+            throw new Error("detector_failure");
+        }
+    },
+});