@malloy-publisher/server 0.0.235 → 0.0.236

package/src/package_load_metrics.ts

@@ -1,127 +0,0 @@
-/**
- * Per-load phase timing for package loads.
- *
- * `malloy_package_load_duration` already reports the *total* time to load a
- * package, but an operator watching a slow load can't tell whether it's the
- * Malloy compile or the connection schema fetches that dominate — the two are
- * tuned very differently (CPU/worker sizing vs. warehouse round-trips). These
- * histograms split the load into those phases so a single dashboard answers
- * "where did the time go?". The worker measures the phases and reports them on
- * its result; see `package_load/package_load_worker.ts` and
- * `package_load/rpc_wait_accountant.ts`.
- *
- * Labels: `status` only. Deliberately NOT labelled by package name — unlike
- * `malloy_package_load_duration`, which carries `malloy_package_name` — to keep
- * cardinality bounded on deployments with many packages. Per-package latency,
- * when needed, is better answered by exemplars/traces than a label explosion.
- *
- * Lazy init for the same reason as `query_cap_metrics.ts` / `query_timeout.ts`:
- * instruments created before `setGlobalMeterProvider` bind to a NoOp meter
- * (https://github.com/open-telemetry/opentelemetry-js/issues/3505).
- */
-
-import { type Histogram } from "@opentelemetry/api";
-import { publisherMeter } from "./telemetry";
-
-/**
- * Explicit bucket boundaries (ms) for the load-duration histograms. OTel's
- * default boundaries top out at 10 000 ms, so any load slower than 10 s falls
- * in the `+Inf` bucket and `histogram_quantile` can't resolve the tail — which
- * is exactly the tail (large/slow packages) worth seeing. These extend to
- * 5 minutes while keeping sub-10 ms resolution for the fast common case.
- * Shared with the total `malloy_package_load_duration` histogram so all
- * load-timing histograms bucket consistently.
- */
-export const LOAD_DURATION_BUCKETS_MS = [
-   1, 5, 10, 25, 50, 100, 250, 500, 1000, 2500, 5000, 10_000, 30_000, 60_000,
-   120_000, 300_000,
-];
-
-/** Bucket boundaries for the per-load schema-fetch count. */
-const SCHEMA_FETCH_COUNT_BUCKETS = [0, 1, 2, 5, 10, 25, 50, 100, 250, 500];
-
-/**
- * Terminal status of a package load, mirroring the `status` label on the
- * existing `malloy_package_load_duration` histogram so the phase metrics slice
- * the same way. In practice the phase histograms only ever carry `success`,
- * `compilation_error`, or `error` — a `pool_unavailable` failure happens before
- * the worker returns any timings, so there is nothing to record for it.
- */
-export type PackageLoadStatus =
-   | "success"
-   | "compilation_error"
-   | "pool_unavailable"
-   | "error";
-
-/** Phase timings a single package load reports (subset of the total). */
-export interface PackageLoadPhaseTimings {
-   /** Ceiling on Malloy compile CPU (compile region minus schema-fetch wait). */
-   compileDurationMs: number;
-   /** Wall-clock awaiting proxied connection schema fetches. */
-   schemaFetchDurationMs: number;
-   /** Number of proxied connection schema fetches the load drove. */
-   schemaFetchCount: number;
-}
-
-let compileDuration: Histogram | null = null;
-let schemaFetchDuration: Histogram | null = null;
-let schemaFetches: Histogram | null = null;
-
-function ensureInstruments(): void {
-   if (compileDuration && schemaFetchDuration && schemaFetches) return;
-   const meter = publisherMeter();
-   compileDuration ??= meter.createHistogram(
-      "malloy_package_load_compile_duration",
-      {
-         description:
-            "Per-load Malloy compile time (compile region minus proxied schema-fetch wait; a ceiling on compile CPU). Label: status.",
-         unit: "ms",
-         advice: { explicitBucketBoundaries: LOAD_DURATION_BUCKETS_MS },
-      },
-   );
-   schemaFetchDuration ??= meter.createHistogram(
-      "malloy_package_load_schema_fetch_duration",
-      {
-         description:
-            "Per-load wall-clock awaiting proxied connection schema fetches. Label: status.",
-         unit: "ms",
-         advice: { explicitBucketBoundaries: LOAD_DURATION_BUCKETS_MS },
-      },
-   );
-   schemaFetches ??= meter.createHistogram(
-      "malloy_package_load_schema_fetches",
-      {
-         description:
-            "Per-load count of proxied connection schema fetches. Label: status.",
-         advice: { explicitBucketBoundaries: SCHEMA_FETCH_COUNT_BUCKETS },
-      },
-   );
-}
-
-/**
- * Record one load's phase breakdown. Call once the worker has returned timings,
- * with the load's terminal `status` (so the phases can be sliced by outcome the
- * same way the total duration is). The terms are meaningless for a load that
- * never produced a worker result (e.g. a pool failure), so don't call it there.
- */
-export function recordPackageLoadPhases(
-   timings: PackageLoadPhaseTimings,
-   status: PackageLoadStatus,
-): void {
-   ensureInstruments();
-   const attrs = { status };
-   compileDuration?.record(timings.compileDurationMs, attrs);
-   schemaFetchDuration?.record(timings.schemaFetchDurationMs, attrs);
-   schemaFetches?.record(timings.schemaFetchCount, attrs);
-}
-
-/**
- * Visible for tests. Drops cached instruments so a fresh `MeterProvider`
- * (installed via `startMetricsHarness`) captures future emissions. Do NOT call
- * from production code.
- */
-export function resetPackageLoadMetricsForTesting(): void {
-   compileDuration = null;
-   schemaFetchDuration = null;
-   schemaFetches = null;
-}

package/src/path_safety.spec.ts

@@ -1,158 +0,0 @@
-import { describe, expect, it } from "bun:test";
-import * as path from "path";
-
-import { BadRequestError } from "./errors";
-import {
-   assertSafeEnvironmentPath,
-   assertSafePackageName,
-   assertSafeRelativeModelPath,
-   safeJoinUnderRoot,
-} from "./path_safety";
-
-describe("assertSafePackageName", () => {
-   it.each([
-      "pkg",
-      "test_package",
-      "test-package",
-      "TestPackage1",
-      "test.package.name",
-      "a",
-      "x".repeat(255),
-   ])("accepts %p", (name) => {
-      expect(() => assertSafePackageName(name)).not.toThrow();
-   });
-
-   it.each([
-      ["empty", ""],
-      ["dot", "."],
-      ["dot-dot", ".."],
-      ["leading dot", ".staging"],
-      ["forward slash", "foo/bar"],
-      ["backslash", "foo\\bar"],
-      ["null byte", "foo\0bar"],
-      ["traversal", "../etc/passwd"],
-      ["abs", "/etc/passwd"],
-      ["space", "my pkg"],
-      ["unicode", "pkg\u202E"],
-      ["too long", "x".repeat(256)],
-   ])("rejects %s (%p)", (_label, name) => {
-      expect(() => assertSafePackageName(name)).toThrow(BadRequestError);
-   });
-
-   it.each([
-      ["number", 42],
-      ["null", null],
-      ["undefined", undefined],
-      ["object", { name: "pkg" }],
-   ])("rejects non-string %s (%p)", (_label, value) => {
-      expect(() => assertSafePackageName(value)).toThrow(BadRequestError);
-   });
-});
-
-describe("assertSafeRelativeModelPath", () => {
-   it.each([
-      "model.malloy",
-      "models/foo.malloy",
-      "a/b/c/d.malloynb",
-      "deep/nested/file_name-1.malloy",
-   ])("accepts %p", (modelPath) => {
-      expect(() => assertSafeRelativeModelPath(modelPath)).not.toThrow();
-   });
-
-   it.each([
-      ["empty", ""],
-      ["leading slash (absolute)", "/etc/passwd"],
-      ["traversal", "../etc/passwd"],
-      ["embedded traversal", "models/../../../etc/passwd"],
-      ["embedded dot segment", "models/./foo.malloy"],
-      ["double slash", "models//foo.malloy"],
-      ["trailing slash", "models/foo/"],
-      ["backslash", "models\\foo.malloy"],
-      ["null byte", "models/foo\0.malloy"],
-      ["dotfile segment", ".staging/foo.malloy"],
-      ["dotfile leaf", "models/.hidden.malloy"],
-   ])("rejects %s (%p)", (_label, modelPath) => {
-      expect(() => assertSafeRelativeModelPath(modelPath)).toThrow(
-         BadRequestError,
-      );
-   });
-
-   it("rejects non-string inputs", () => {
-      expect(() => assertSafeRelativeModelPath(undefined)).toThrow(
-         BadRequestError,
-      );
-      expect(() => assertSafeRelativeModelPath(123)).toThrow(BadRequestError);
-   });
-});
-
-describe("assertSafeEnvironmentPath", () => {
-   it.each([
-      "/etc/publisher",
-      "/var/lib/publisher/env1",
-      "/Users/me/data",
-      "/a",
-      "C:\\Users\\me\\publisher",
-      "C:/Users/me/publisher",
-   ])("accepts %p", (p) => {
-      expect(() => assertSafeEnvironmentPath(p)).not.toThrow();
-   });
-
-   it.each([
-      ["empty", ""],
-      ["relative", "publisher/data"],
-      ["traversal in middle", "/var/lib/../../etc/passwd"],
-      ["traversal at end", "/var/lib/publisher/.."],
-      ["null byte", "/var/lib/publisher\0"],
-      ["bare dot-dot", ".."],
-      ["bare dot", "."],
-      ["too long", "/" + "a".repeat(5000)],
-   ])("rejects %s (%p)", (_label, p) => {
-      expect(() => assertSafeEnvironmentPath(p)).toThrow(BadRequestError);
-   });
-
-   it("rejects non-string inputs", () => {
-      expect(() => assertSafeEnvironmentPath(undefined)).toThrow(
-         BadRequestError,
-      );
-      expect(() => assertSafeEnvironmentPath(null)).toThrow(BadRequestError);
-      expect(() => assertSafeEnvironmentPath(42)).toThrow(BadRequestError);
-   });
-});
-
-describe("safeJoinUnderRoot", () => {
-   const root = "/tmp/test-root";
-
-   it("returns the resolved root when joined with no segments", () => {
-      expect(safeJoinUnderRoot(root)).toBe(path.resolve(root));
-   });
-
-   it("joins safe segments into a path under root", () => {
-      expect(safeJoinUnderRoot(root, "pkg", "model.malloy")).toBe(
-         path.resolve(root, "pkg", "model.malloy"),
-      );
-   });
-
-   it("throws when traversal escapes the root", () => {
-      expect(() => safeJoinUnderRoot(root, "..")).toThrow(BadRequestError);
-      expect(() => safeJoinUnderRoot(root, "..", "etc", "passwd")).toThrow(
-         BadRequestError,
-      );
-      expect(() => safeJoinUnderRoot(root, "pkg", "..", "..", "etc")).toThrow(
-         BadRequestError,
-      );
-   });
-
-   it("throws when an absolute segment overrides the root", () => {
-      expect(() => safeJoinUnderRoot(root, "/etc/passwd")).toThrow(
-         BadRequestError,
-      );
-   });
-
-   it("does NOT match a sibling directory with the same prefix", () => {
-      // path.resolve("/tmp/test-root", "../test-root-bad")  ->  "/tmp/test-root-bad"
-      // which starts with "/tmp/test-root" textually but is NOT a child.
-      expect(() => safeJoinUnderRoot(root, "..", "test-root-bad")).toThrow(
-         BadRequestError,
-      );
-   });
-});

package/src/path_safety.ts

@@ -1,146 +0,0 @@
-import * as path from "path";
-
-import { BadRequestError } from "./errors";
-
-/**
- * Path-safety helpers used by `Environment` (and any other service that
- * builds an on-disk path from request data) to defend against directory
- * traversal. The intent is two-fold:
- *
- *  1. **Source-side allowlist**: `assertSafePackageName` /
- *     `assertSafeRelativeModelPath` reject hostile inputs (`..`, leading
- *     `/`, `\`, NUL, dotfiles) at the entry of every public service
- *     method before any path-construction happens. These throw
- *     `BadRequestError` so the controller layer's error mapper returns
- *     HTTP 400.
- *
- *  2. **Sink-side containment**: `safeJoinUnderRoot` joins, resolves,
- *     and verifies the result is strictly within the supplied root.
- *     Even if a future caller forgets the source-side check, the sink
- *     refuses to hand back an escaping path. This is the standard
- *     "resolve-and-contain" pattern that CodeQL's `js/path-injection`
- *     query recognises as a sanitizer.
- */
-
-// Single path segment: ASCII letters, digits, `-`, `_`, `.`. No leading
-// `.` so internal sibling dirs (`.staging`, `.retired`) and editor /
-// VCS dirs can't be addressed by name from outside.
-const SAFE_NAME_RE = /^(?!\.\.?$)(?!\.)[A-Za-z0-9._-]{1,255}$/;
-
-const MAX_MODEL_PATH_LEN = 1024;
-
-// An environment path is server-controlled (config / disk-derived), but
-// CodeQL conservatively treats it as tainted because Express handlers on
-// the same class touch user input. The combined regex test +
-// `..` / NUL / length check at the constructor gate is the sanitizer
-// barrier the `js/path-injection` query recognises. Printable ASCII
-// only; absolute POSIX-or-Windows path; no `..`, no NUL.
-const SAFE_ENVIRONMENT_PATH_RE = /^(?:\/|[A-Za-z]:[\\/])[\x20-\x7E]*$/;
-const MAX_ENVIRONMENT_PATH_LEN = 4096;
-
-/**
- * Reject anything that isn't a plausible single-segment package name.
- * The allowlist is deliberately conservative — every existing test and
- * production package name we've seen fits within it, and tightening
- * here costs nothing.
- */
-export function assertSafePackageName(
-   packageName: unknown,
-): asserts packageName is string {
-   if (typeof packageName !== "string" || !SAFE_NAME_RE.test(packageName)) {
-      throw new BadRequestError(
-         `Invalid package name: must be 1-255 characters of letters, digits, "-", "_", or "." and must not start with "."`,
-      );
-   }
-}
-
-/**
- * Reject anything that isn't a plausible *relative* path to a model
- * file inside a package directory. Forward slashes are allowed (models
- * live in subdirectories like `models/foo.malloy`); backslashes,
- * absolute paths, NUL bytes, and `..` / `.` segments are not.
- */
-export function assertSafeRelativeModelPath(
-   modelPath: unknown,
-): asserts modelPath is string {
-   if (
-      typeof modelPath !== "string" ||
-      modelPath.length === 0 ||
-      modelPath.length > MAX_MODEL_PATH_LEN ||
-      modelPath.includes("\0") ||
-      modelPath.includes("\\") ||
-      path.isAbsolute(modelPath) ||
-      modelPath.startsWith("/")
-   ) {
-      throw new BadRequestError(`Invalid model path`);
-   }
-
-   const segments = modelPath.split("/");
-   for (const segment of segments) {
-      if (segment === "" || segment === "." || segment === "..") {
-         throw new BadRequestError(`Invalid model path`);
-      }
-      if (segment.startsWith(".")) {
-         throw new BadRequestError(`Invalid model path`);
-      }
-   }
-}
-
-/**
- * Reject anything that doesn't look like a server-controlled absolute
- * filesystem path. Applied to `environmentPath` at the constructor
- * gate so all downstream `path.join(this.environmentPath, …)` sites
- * see a value that has cleared an allowlist check — the canonical
- * sanitizer-barrier pattern CodeQL's `js/path-injection` query
- * recognises.
- */
-export function assertSafeEnvironmentPath(
-   environmentPath: unknown,
-): asserts environmentPath is string {
-   if (typeof environmentPath !== "string") {
-      throw new BadRequestError(`Invalid environment path: must be a string`);
-   }
-   if (
-      environmentPath.length === 0 ||
-      environmentPath.length > MAX_ENVIRONMENT_PATH_LEN
-   ) {
-      throw new BadRequestError(`Invalid environment path: bad length`);
-   }
-   if (environmentPath.indexOf("\0") !== -1) {
-      throw new BadRequestError(`Invalid environment path: contains NUL byte`);
-   }
-   // Sanitizer barrier in the shape `x.indexOf("..") !== -1` that the
-   // CodeQL `js/path-injection` query recognises as a traversal guard.
-   if (environmentPath.indexOf("..") !== -1) {
-      throw new BadRequestError(
-         `Invalid environment path: contains ".." traversal segment`,
-      );
-   }
-   if (!SAFE_ENVIRONMENT_PATH_RE.test(environmentPath)) {
-      throw new BadRequestError(
-         `Invalid environment path: must be an absolute path of printable ASCII characters`,
-      );
-   }
-}
-
-/**
- * Resolve `path.join(root, ...segments)` and verify the result lives
- * strictly inside `root` (or is `root` itself). Throws
- * `BadRequestError` if the resolved path escapes the root via `..`,
- * absolute segments, or symlink-style trickery in the input.
- *
- * Callers should still run `assertSafePackageName` / similar on
- * user-controlled segments first — this helper is the second line of
- * defense, not the first.
- */
-export function safeJoinUnderRoot(root: string, ...segments: string[]): string {
-   const resolvedRoot = path.resolve(root);
-   const joined = path.resolve(resolvedRoot, ...segments);
-   const rootWithSep = resolvedRoot.endsWith(path.sep)
-      ? resolvedRoot
-      : resolvedRoot + path.sep;
-   if (joined !== resolvedRoot && !joined.startsWith(rootWithSep)) {
-      throw new BadRequestError(`Resolved path is outside of root`);
-   }
-   return joined;
-}

package/src/pg_helpers.spec.ts

@@ -1,223 +0,0 @@
-import { describe, expect, it } from "bun:test";
-import { redactPgSecrets } from "./pg_helpers";
-
-describe("redactPgSecrets", () => {
-   it("redacts bare password values", () => {
-      expect(redactPgSecrets("host=h password=hunter2 dbname=d")).toBe(
-         "host=h password=*** dbname=d",
-      );
-   });
-
-   it("redacts single-quoted password values", () => {
-      expect(redactPgSecrets("host=h password='s3 cret' dbname=d")).toBe(
-         "host=h password=*** dbname=d",
-      );
-   });
-
-   it("leaves non-secret content alone", () => {
-      expect(redactPgSecrets("user=alice dbname=billing")).toBe(
-         "user=alice dbname=billing",
-      );
-   });
-
-   it("redacts the password in a URL-form connection string", () => {
-      expect(redactPgSecrets("postgres://user:pass@host/db")).toBe(
-         "postgres://user:***@host/db",
-      );
-   });
-
-   it("preserves port and query string around a URI password", () => {
-      expect(redactPgSecrets("postgresql://u:p@h:5432/d?sslmode=require")).toBe(
-         "postgresql://u:***@h:5432/d?sslmode=require",
-      );
-   });
-
-   it("redacts a percent-encoded password whole", () => {
-      expect(redactPgSecrets("postgres://u:p%40ss@h/d")).toBe(
-         "postgres://u:***@h/d",
-      );
-   });
-
-   it("redacts a literal @ in the password up to the last @", () => {
-      expect(redactPgSecrets("postgres://u:p@ss@h/d")).toBe(
-         "postgres://u:***@h/d",
-      );
-   });
-
-   it("redacts a password containing colons whole", () => {
-      expect(redactPgSecrets("postgres://u:pa:ss@h/d")).toBe(
-         "postgres://u:***@h/d",
-      );
-   });
-
-   it("redacts a raw slash in a pg password via the mop-up pass", () => {
-      expect(redactPgSecrets("postgres://u:pa/ss@h/d")).toBe(
-         "postgres://u:***@h/d",
-      );
-   });
-
-   it("redacts the password when the username is empty", () => {
-      expect(redactPgSecrets("postgres://:secret@h/d")).toBe(
-         "postgres://:***@h/d",
-      );
-   });
-
-   it("leaves IPv6 hosts intact", () => {
-      expect(redactPgSecrets("postgres://u:p@[::1]:5432/d")).toBe(
-         "postgres://u:***@[::1]:5432/d",
-      );
-   });
-
-   it("does not redact a username-only userinfo", () => {
-      expect(redactPgSecrets("postgres://user@host/db")).toBe(
-         "postgres://user@host/db",
-      );
-   });
-
-   it("leaves URIs without userinfo alone", () => {
-      expect(redactPgSecrets("postgres://host/db")).toBe("postgres://host/db");
-      expect(redactPgSecrets("postgres://host:5432/db")).toBe(
-         "postgres://host:5432/db",
-      );
-   });
-
-   it("does not mangle a passwordless URI with :...@ in its query", () => {
-      expect(redactPgSecrets("postgres://h?options=endpoint:foo@bar")).toBe(
-         "postgres://h?options=endpoint:foo@bar",
-      );
-      expect(redactPgSecrets("postgres://h/d?x=a@b")).toBe(
-         "postgres://h/d?x=a@b",
-      );
-   });
-
-   it("leaves email addresses in prose alone", () => {
-      expect(redactPgSecrets("contact admin@example.com for help")).toBe(
-         "contact admin@example.com for help",
-      );
-   });
-
-   it("does not mangle https URLs with @ in the path", () => {
-      expect(
-         redactPgSecrets("fetched https://github.com:443/@scope/pkg ok"),
-      ).toBe("fetched https://github.com:443/@scope/pkg ok");
-   });
-
-   it("redacts every URI in a message independently", () => {
-      expect(
-         redactPgSecrets(
-            "tried postgres://u1:p1@h1/d1 then postgres://u2:p2@h2/d2",
-         ),
-      ).toBe("tried postgres://u1:***@h1/d1 then postgres://u2:***@h2/d2");
-   });
-
-   it("keeps comma-joined URIs in one token separate", () => {
-      expect(
-         redactPgSecrets(
-            "candidates: postgres://u1:p1@h1/d1,postgres://u2:p2@h2/d2",
-         ),
-      ).toBe("candidates: postgres://u1:***@h1/d1,postgres://u2:***@h2/d2");
-   });
-
-   it("leaves trailing sentence punctuation alone", () => {
-      expect(redactPgSecrets("could not connect to postgres://u:p@h/d.")).toBe(
-         "could not connect to postgres://u:***@h/d.",
-      );
-   });
-
-   it("handles keyword and URI forms in one message", () => {
-      expect(
-         redactPgSecrets(
-            "attach failed: host=h password=x and fallback postgres://u:p@h2/d",
-         ),
-      ).toBe(
-         "attach failed: host=h password=*** and fallback postgres://u:***@h2/d",
-      );
-   });
-
-   it("keeps the URI intact when a password contains 'password='", () => {
-      // URI passes run before the keyword pass; keyword-first would eat
-      // the @host/db tail via \S+.
-      expect(redactPgSecrets("postgres://u:password=abc@h/d")).toBe(
-         "postgres://u:***@h/d",
-      );
-   });
-
-   it("over-redacts rather than leaks a ?password= query parameter", () => {
-      // Pre-existing keyword-pass behavior: \S+ eats through &sslmode=...
-      // Over-redaction, never a leak.
-      expect(
-         redactPgSecrets("postgres://h/d?password=abc&sslmode=require"),
-      ).toBe("postgres://h/d?password=***");
-   });
-
-   it("matches uppercase schemes", () => {
-      expect(redactPgSecrets("POSTGRES://U:Secret@H/D")).toBe(
-         "POSTGRES://U:***@H/D",
-      );
-   });
-
-   it("redacts non-pg scheme userinfo passwords too", () => {
-      expect(redactPgSecrets("amqp://guest:guest@rabbit:5672/vhost")).toBe(
-         "amqp://guest:***@rabbit:5672/vhost",
-      );
-   });
-
-   it("redacts an Azure user@servername username form", () => {
-      // Azure single-server usernames carry a literal @ (user@servername);
-      // userinfo splits at the LAST @, so the password after the first : is
-      // redacted while the @-bearing username stays intact.
-      expect(
-         redactPgSecrets(
-            "postgres://myadmin@myserver:Zx7SeCReT9q@myserver.postgres.database.azure.com:5432/db",
-         ),
-      ).toBe(
-         "postgres://myadmin@myserver:***@myserver.postgres.database.azure.com:5432/db",
-      );
-   });
-
-   it("redacts an @-in-username form whose password also contains @", () => {
-      expect(redactPgSecrets("postgres://myadmin@srv:p@ss@host/db")).toBe(
-         "postgres://myadmin@srv:***@host/db",
-      );
-   });
-
-   it("redacts an @-in-username form with a raw / in the password", () => {
-      expect(redactPgSecrets("postgresql://u@srv:sec/ret@h/d")).toBe(
-         "postgresql://u@srv:***@h/d",
-      );
-   });
-
-   it("redacts a scheme abutting a word char", () => {
-      // No leading anchor on the scheme, so a scheme glued to a preceding
-      // word char (an invalid-scheme prefix, or a stray digit) still redacts.
-      expect(redactPgSecrets("x_postgres://u:secretpw@h/d")).toBe(
-         "x_postgres://u:***@h/d",
-      );
-      expect(redactPgSecrets("3postgres://u:secretpw@h/d")).toBe(
-         "3postgres://u:***@h/d",
-      );
-   });
-
-   it("never reveals a secret when re-applied (monotonic)", () => {
-      // redactPgSecrets is not strictly idempotent in general (re-applying
-      // can redact further, e.g. an unquoted *** left by the keyword pass),
-      // but re-application must never turn a redacted secret back into
-      // cleartext.
-      const input = "postgres://u:p@ss@h/d and host=h password=hunter2";
-      const once = redactPgSecrets(input);
-      const twice = redactPgSecrets(once);
-      expect(once).not.toContain("hunter2");
-      expect(twice).not.toContain("hunter2");
-      expect(twice).not.toContain("p@ss");
-   });
-
-   it("redacts the DSN inside a real DuckDB attach error message", () => {
-      // Shape observed from DuckDB's postgres extension: the full DSN is
-      // echoed verbatim inside the IO Error text.
-      const msg =
-         'IO Error: Unable to connect to Postgres at "postgres://alice:supersecretpw@127.0.0.1:5432/mydb": connection to server at "127.0.0.1", port 5432 failed: Connection refused';
-      const redacted = redactPgSecrets(msg);
-      expect(redacted).toContain("postgres://alice:***@127.0.0.1:5432/mydb");
-      expect(redacted).not.toContain("supersecretpw");
-   });
-});