@melra/receipt-schema 0.3.0-alpha.11 → 0.3.0-alpha.13

package/README.md

@@ -9,7 +9,7 @@ npm install @melra/receipt-schema
 ```
 
 ```ts
-import { createCertificate, redactStructuredValue, sha256 } from "@melra/receipt-schema";
+import { createCertificate, redactSecrets, redactStructuredValue, sha256 } from "@melra/receipt-schema";
 ```
 
 A receipt records one action: the operation, the policy decision, the evidence
@@ -20,8 +20,14 @@ rather than trusted.
 `canonicalJson` sorts keys and normalises formatting before hashing, so the same
 logical value always produces the same digest across processes and platforms.
 
-`redactStructuredValue` strips credential-shaped values — tokens, keys, auth
-headers, connection strings — from anything before it is persisted. Raw output
+`redactStructuredValue` strips credential-shaped values from anything before
+it is persisted: fields named like secrets (`authorization`, `headers`,
+`cookie`, `token`, `password`, `env`, `content`, `stdout`, …) are replaced
+whole, URL query strings and fragments are dropped, and every other string goes
+through `redactSecrets`. `SECRET_PATTERNS` — PEM private keys, AWS key IDs,
+JWTs, Slack and GitHub tokens, common API keys, bearer tokens, and
+password/secret assignments — is the one list memory and terminal output use
+too, so a new secret format is added here once. Raw output
 goes to the live caller only; the durable copy is the redacted one. A new field
 that can carry a secret must pass through this, or through the memory package's
 equivalent, before it reaches storage.

package/dist/index.d.ts

@@ -1,3 +1,30 @@
+/**
+ * Secret shapes redacted wherever MELRA persists free text: receipts and task
+ * records here, memory values, and terminal output. One list, exported, because
+ * three private copies had drifted apart and none of them knew a PEM private
+ * key or an AWS access key id; GovBench found memory storing both verbatim.
+ *
+ * Only high-confidence shapes belong here. A pattern that fires on ordinary
+ * text corrupts the record it was meant to protect, so a secret without a
+ * recognisable shape is left to the field-name rule in redactStructuredValue.
+ */
+export declare const SECRET_PATTERNS: ReadonlyArray<readonly [RegExp, string]>;
+/** Every SECRET_PATTERNS match in `text` replaced, and which kinds were found. */
+export declare function redactSecrets(text: string): {
+    value: string;
+    redactions: string[];
+};
+/**
+ * A command's arguments with the credentials taken out and everything else
+ * kept, so a receipt still says what ran (#122). A credential-named flag loses
+ * its value, attached or as the next argument; so do `-pPASSWORD`, the password
+ * half of `-u user:pass`, credential-named `NAME=value` assignments, auth
+ * headers, and URL userinfo. Every argument then goes through SECRET_PATTERNS.
+ */
+export declare function redactArgv(argv: readonly string[], command?: string): {
+    value: string[];
+    redactions: string[];
+};
 export type CertificateResult = "VERIFIED_SUCCESS" | "PARTIAL" | "FAILED" | "CANCELLED" | "WAITING_APPROVAL" | "WAITING_USER" | "POLICY_BLOCKED" | "BUDGET_EXHAUSTED"
 /** The effect may or may not have happened. Neither claim is available yet. */
  | "RECOVERY_REQUIRED";
@@ -74,6 +101,13 @@ export interface ActionReceipt {
         outcome: "allow" | "deny" | "confirm";
         policyVersion: string;
         approvalId?: string;
+        /** Who approved, through which channel, having been shown what. */
+        approval?: {
+            channel: string;
+            renderDigest: string;
+            approver: string;
+            decidedAt: string;
+        };
     };
     target: string;
     inputDigest: string;
@@ -95,6 +129,16 @@ export interface ExecutionCertificate {
     receiptIds: string[];
     evidence: EvidenceItem[];
     createdAt: string;
+    /** The deployment mode the task ran under, as on its receipts. */
+    mode?: string;
+    /**
+     * How the task's effect was authorised: `not_required` (a read),
+     * `bypassed` (a mutation allowed with no challenge, which only
+     * developer-mode unsafe-local permits), `in_band`, or `out_of_band`. One
+     * certificate covers one task, so this is that task's channel. Absent when
+     * nothing was authorised. Covered by `digest`, like every other field.
+     */
+    approvalChannel?: string;
     digest: string;
 }
 export declare function redactStructuredValue(value: unknown): {

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAcA,MAAM,MAAM,iBAAiB,GACzB,kBAAkB,GAClB,SAAS,GACT,QAAQ,GACR,WAAW,GACX,kBAAkB,GAClB,cAAc,GACd,gBAAgB,GAChB,kBAAkB;AACpB,+EAA+E;GAC7E,mBAAmB,CAAC;AAExB;;;;;;;;GAQG;AACH,MAAM,MAAM,gBAAgB;AAC1B,mEAAmE;AACjE,WAAW;AACb,oDAAoD;GAClD,OAAO;AACT,qEAAqE;GACnE,aAAa;AACf,8FAA8F;GAC5F,UAAU,CAAC;AAoBf,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,CAE/D;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,aAAa,CAAC;IAC1C;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,cAAc,EAAE;QACd,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;QACtC,aAAa,EAAE,MAAM,CAAC;QACtB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,iBAAiB,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG;IACrD,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB,CAyDA;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAYpD;AAED,wBAAgB,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAE7C;AAED,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,IAAI,CAAC,oBAAoB,EAAE,eAAe,GAAG,eAAe,GAAG,QAAQ,CAAC,GAC9E,oBAAoB,CAQtB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAOA;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAqBpE,CAAC;AAEF,kFAAkF;AAClF,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,CASnF;AAgDD;;;;;;GAMG;AACH,wBAAgB,UAAU,CACxB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,CAAC,EAAE,MAAM,GACf;IAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,CAe3C;AAED,MAAM,MAAM,iBAAiB,GACzB,kBAAkB,GAClB,SAAS,GACT,QAAQ,GACR,WAAW,GACX,kBAAkB,GAClB,cAAc,GACd,gBAAgB,GAChB,kBAAkB;AACpB,+EAA+E;GAC7E,mBAAmB,CAAC;AAExB;;;;;;;;GAQG;AACH,MAAM,MAAM,gBAAgB;AAC1B,mEAAmE;AACjE,WAAW;AACb,oDAAoD;GAClD,OAAO;AACT,qEAAqE;GACnE,aAAa;AACf,8FAA8F;GAC5F,UAAU,CAAC;AAoBf,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,CAE/D;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,aAAa,CAAC;IAC1C;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,cAAc,EAAE;QACd,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;QACtC,aAAa,EAAE,MAAM,CAAC;QACtB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,mEAAmE;QACnE,QAAQ,CAAC,EAAE;YACT,OAAO,EAAE,MAAM,CAAC;YAChB,YAAY,EAAE,MAAM,CAAC;YACrB,QAAQ,EAAE,MAAM,CAAC;YACjB,SAAS,EAAE,MAAM,CAAC;SACnB,CAAC;KACH,CAAC;IACF,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,iBAAiB,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG;IACrD,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB,CAyEA;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAYpD;AAED,wBAAgB,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAE7C;AAED,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,IAAI,CAAC,oBAAoB,EAAE,eAAe,GAAG,eAAe,GAAG,QAAQ,CAAC,GAC9E,oBAAoB,CAQtB"}

package/dist/index.js

@@ -1,13 +1,124 @@
 // Copyright 2026 XAGI Labs Private Limited
 // SPDX-License-Identifier: Apache-2.0
 import { createHash, randomUUID } from "node:crypto";
-const SENSITIVE_KEY = /^(?:args?|authorization|constraints|content|cookie|env|goal|headers?|pass(?:word|wd)?|secret|std(?:out|err)|text|token|api[_-]?key|values?)$/i;
-const SECRET_PATTERNS = [
+const SENSITIVE_KEY = /^(?:arg|authorization|constraints|content|cookie|env|goal|headers?|input|pass(?:word|wd)?|secret|std(?:out|err)|text|token|api[_-]?key|values?)$/i;
+/**
+ * Secret shapes redacted wherever MELRA persists free text: receipts and task
+ * records here, memory values, and terminal output. One list, exported, because
+ * three private copies had drifted apart and none of them knew a PEM private
+ * key or an AWS access key id; GovBench found memory storing both verbatim.
+ *
+ * Only high-confidence shapes belong here. A pattern that fires on ordinary
+ * text corrupts the record it was meant to protect, so a secret without a
+ * recognisable shape is left to the field-name rule in redactStructuredValue.
+ */
+export const SECRET_PATTERNS = [
+    // A whole PEM private key block, and a truncated one (output cut mid-key).
+    [
+        /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY-----[\s\S]*?-----END (?:[A-Z0-9]+ )*PRIVATE KEY-----/g,
+        "[REDACTED_PRIVATE_KEY]",
+    ],
+    [/-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY-----[\s\S]*/g, "[REDACTED_PRIVATE_KEY]"],
+    [/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g, "[REDACTED_AWS_KEY_ID]"],
+    [/\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g, "[REDACTED_JWT]"],
+    [/\bxox[abposr]-[A-Za-z0-9-]{10,}\b/g, "[REDACTED_SLACK_TOKEN]"],
     [/\bgh[opurs]_[A-Za-z0-9]{20,}\b/g, "[REDACTED_GITHUB_TOKEN]"],
     [/\b(?:sk|pk|api)[-_][a-z0-9_-]{16,}\b/gi, "[REDACTED_API_KEY]"],
     [/\bBearer\s+[A-Za-z0-9._~+/-]+=*\b/gi, "Bearer [REDACTED_TOKEN]"],
-    [/\b(password|passwd|secret)\s*[:=]\s*\S+/gi, "$1=[REDACTED]"],
+    // `password=x`, and the spellings that hide the word inside a longer name or
+    // behind a quote: `DB_PASSWORD=x`, `AWS_SECRET_ACCESS_KEY: x`, `"password": "x"`.
+    [
+        /(?<![A-Za-z0-9])((?:[A-Za-z0-9]+_)*(?:password|passwd|passphrase|secret)(?:_[A-Za-z0-9]+)*)(["']?)\s*[:=]\s*["']?[^\s"',;}]+/gi,
+        "$1$2=[REDACTED]",
+    ],
+    // Userinfo in a URL or connection string anywhere in text: `postgres://app:pw@db`.
+    [/\b([a-z][a-z0-9+.-]*:\/\/)[^\s/@:]*:[^\s/@]+@/gi, "$1[REDACTED_URL_CREDENTIALS]@"],
 ];
+/** Every SECRET_PATTERNS match in `text` replaced, and which kinds were found. */
+export function redactSecrets(text) {
+    let value = text;
+    const redactions = [];
+    for (const [pattern, replacement] of SECRET_PATTERNS) {
+        const before = value;
+        value = value.replace(pattern, replacement);
+        if (value !== before && !redactions.includes(replacement))
+            redactions.push(replacement);
+    }
+    return { value, redactions };
+}
+// A flag whose value is a credential, `--token x` or `--token=x`, matched on
+// the flag's name because the value itself may have no recognisable shape.
+// The credential word may lead a longer name too: `--secret-key`,
+// `--s3-secret-access-key`, `--passphrase`.
+const SECRET_FLAG = /^(--?(?:[a-z0-9]+[-_])*(?:token|password|passwd|passphrase|pass|secret|api[-_]?key|apikey|auth|authorization|credentials?|cookie|private[-_]?key)(?:[-_][a-z0-9]+)*)(?:=([\s\S]*))?$/i;
+// `-u user:pass` / `--user user:pass` (curl, wget), and curl's proxy forms:
+// only the part after the colon is a secret, and `sort -u`, `git add -u` take
+// no value at all.
+const USER_FLAG = /^(?:-u|--user|-U|--proxy-user)$/;
+// The same, attached: `-ualice:pw`.
+const ATTACHED_USER = /^(-u[^:\s]+):[\s\S]+$/;
+// `-pPASSWORD` (mysql and friends). Never the next argument: `mkdir -p dir`,
+// `ssh -p 22`. Only after a mysql-family program, because `find -print` and
+// `gcc -pthread` have the same shape. A remainder under three characters is
+// read as bundled short flags (`-pv`, `-pr`), not a password.
+const ATTACHED_PASSWORD = /^-p(.{3,})$/s;
+const MYSQL_FAMILY = /^(?:mysql[a-z]*|mariadb[a-z-]*)(?:\.exe)?$/i;
+// `NAME=value` with a credential-like name, as `env FOO_TOKEN=x cmd` passes it.
+const SECRET_ASSIGNMENT = /^([A-Za-z_][A-Za-z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD|PASS|AUTH|CREDENTIALS?))=[\s\S]*$/i;
+// A header given as one argument, as `curl -H 'Authorization: Bearer x'` does.
+const SECRET_HEADER = /^((?:--header=|-H)?(?:(?:proxy-)?authorization|cookie|[a-z0-9-]*(?:token|api-?key|secret)))\s*:[\s\S]*$/i;
+// Credentials inside a URL or connection string: `postgres://user:pass@host`,
+// and `redis://:pass@host`, whose username is usually empty.
+const URL_CREDENTIALS = /(\/\/)[^\s/@:]*:[^\s/@]+@/g;
+const REDACTED_ARG = "[REDACTED_SENSITIVE_ARG]";
+function redactOneArg(arg, previous, mysql) {
+    if (previous !== undefined) {
+        const flag = SECRET_FLAG.exec(previous);
+        if (flag !== null && flag[2] === undefined)
+            return REDACTED_ARG;
+        if (USER_FLAG.test(previous) && arg.includes(":")) {
+            return `${arg.slice(0, arg.indexOf(":"))}:${REDACTED_ARG}`;
+        }
+    }
+    const flag = SECRET_FLAG.exec(arg);
+    if (flag?.[2] !== undefined)
+        return `${flag[1]}=${REDACTED_ARG}`;
+    if (mysql && ATTACHED_PASSWORD.test(arg))
+        return `-p${REDACTED_ARG}`;
+    if (ATTACHED_USER.test(arg))
+        return arg.replace(ATTACHED_USER, `$1:${REDACTED_ARG}`);
+    if (SECRET_ASSIGNMENT.test(arg))
+        return arg.replace(SECRET_ASSIGNMENT, `$1=${REDACTED_ARG}`);
+    if (SECRET_HEADER.test(arg))
+        return arg.replace(SECRET_HEADER, `$1: ${REDACTED_ARG}`);
+    return arg.replace(URL_CREDENTIALS, `$1${REDACTED_ARG}@`);
+}
+/**
+ * A command's arguments with the credentials taken out and everything else
+ * kept, so a receipt still says what ran (#122). A credential-named flag loses
+ * its value, attached or as the next argument; so do `-pPASSWORD`, the password
+ * half of `-u user:pass`, credential-named `NAME=value` assignments, auth
+ * headers, and URL userinfo. Every argument then goes through SECRET_PATTERNS.
+ */
+export function redactArgv(argv, command) {
+    const redactions = new Set();
+    // Unknown program: read `-pXXXX` as a password, the cautious side.
+    const program = (name) => MYSQL_FAMILY.test(name.split(/[\\/]/).pop() ?? "");
+    let mysql = command === undefined || program(command);
+    const value = argv.map((arg, index) => {
+        // `env`, `sudo` and friends put the program among the arguments.
+        if (program(arg))
+            mysql = true;
+        const out = redactOneArg(arg, index === 0 ? undefined : argv[index - 1], mysql);
+        if (out !== arg)
+            redactions.add(REDACTED_ARG);
+        const redacted = redactSecrets(out);
+        for (const kind of redacted.redactions)
+            redactions.add(kind);
+        return redacted.value;
+    });
+    return { value, redactions: [...redactions] };
+}
 /**
  * Only the types that outrank `execution` are listed. An unrecognised type —
  * an older receipt, a predicate added without a decision here — reads as the
@@ -43,10 +154,23 @@ export function redactStructuredValue(value) {
         }
         return "[REDACTED_SENSITIVE_FIELD]";
     };
-    const visit = (current, key) => {
+    const visit = (current, key, parent) => {
         if (key !== undefined && SENSITIVE_KEY.test(key)) {
             return redactWholeValue(current);
         }
+        if (key === "args") {
+            // Arguments are what a receipt most needs to show, so only their
+            // credentials go; anything that is not a list of strings goes whole.
+            if (!Array.isArray(current) || !current.every((item) => typeof item === "string")) {
+                return redactWholeValue(current);
+            }
+            // The program sits beside its arguments, as `command`.
+            const command = typeof parent?.command === "string" ? parent.command : undefined;
+            const redacted = redactArgv(current, command);
+            for (const kind of redacted.redactions)
+                redactions.add(kind);
+            return redacted.value;
+        }
         if (key === "url" && typeof current === "string") {
             try {
                 const url = new URL(current);
@@ -55,21 +179,26 @@ export function redactStructuredValue(value) {
                     url.search = "";
                     url.hash = "";
                 }
-                return url.toString();
+                if (url.username !== "" || url.password !== "") {
+                    redactions.add("[REDACTED_URL_CREDENTIALS]");
+                    url.username = "";
+                    url.password = "";
+                }
+                // Then the shapes any string gets: a token in the path is still a token.
+                const redacted = redactSecrets(url.toString());
+                for (const kind of redacted.redactions)
+                    redactions.add(kind);
+                return redacted.value;
             }
             catch {
                 // Non-URL strings continue through normal pattern redaction.
             }
         }
         if (typeof current === "string") {
-            let redacted = current;
-            for (const [pattern, replacement] of SECRET_PATTERNS) {
-                const before = redacted;
-                redacted = redacted.replace(pattern, replacement);
-                if (redacted !== before)
-                    redactions.add(replacement);
-            }
-            return redacted;
+            const redacted = redactSecrets(current);
+            for (const kind of redacted.redactions)
+                redactions.add(kind);
+            return redacted.value;
         }
         if (Array.isArray(current)) {
             return current.map((item) => visit(item));
@@ -77,7 +206,7 @@ export function redactStructuredValue(value) {
         if (current !== null && typeof current === "object") {
             return Object.fromEntries(Object.entries(current).map(([entryKey, entryValue]) => [
                 entryKey,
-                visit(entryValue, entryKey),
+                visit(entryValue, entryKey, current),
             ]));
         }
         return current;

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,sCAAsC;AAEtC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAErD,MAAM,aAAa,GACjB,+IAA+I,CAAC;AAClJ,MAAM,eAAe,GAA4B;IAC/C,CAAC,iCAAiC,EAAE,yBAAyB,CAAC;IAC9D,CAAC,wCAAwC,EAAE,oBAAoB,CAAC;IAChE,CAAC,qCAAqC,EAAE,yBAAyB,CAAC;IAClE,CAAC,2CAA2C,EAAE,eAAe,CAAC;CAC/D,CAAC;AAiCF;;;;GAIG;AACH,MAAM,uBAAuB,GAAqC;IAChE,WAAW,EAAE,OAAO;IACpB,WAAW,EAAE,OAAO;IACpB,SAAS,EAAE,OAAO;IAClB,6EAA6E;IAC7E,yBAAyB;IACzB,WAAW,EAAE,OAAO;IACpB,4EAA4E;IAC5E,8EAA8E;IAC9E,cAAc;IACd,qBAAqB,EAAE,aAAa;CACrC,CAAC;AAEF,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,uBAAuB,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC;AACtD,CAAC;AAkFD,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAIlD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,gBAAgB,GAAG,CAAC,OAAgB,EAAW,EAAE;QACrD,UAAU,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;QAC7C,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,4BAA4B,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YACpD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;gBACrC,QAAQ;gBACR,4BAA4B;aAC7B,CAAC,CACH,CAAC;QACJ,CAAC;QACD,OAAO,4BAA4B,CAAC;IACtC,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,OAAgB,EAAE,GAAY,EAAW,EAAE;QACxD,IAAI,GAAG,KAAK,SAAS,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACjD,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,GAAG,KAAK,KAAK,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YACjD,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;oBACzC,UAAU,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;oBACvC,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;oBAChB,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;gBAChB,CAAC;gBACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,6DAA6D;YAC/D,CAAC;QACH,CAAC;QACD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,IAAI,QAAQ,GAAG,OAAO,CAAC;YACvB,KAAK,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,eAAe,EAAE,CAAC;gBACrD,MAAM,MAAM,GAAG,QAAQ,CAAC;gBACxB,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;gBAClD,IAAI,QAAQ,KAAK,MAAM;oBAAE,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACvD,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YACpD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC;gBACtD,QAAQ;gBACR,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC;aAC5B,CAAC,CACH,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC;IACzC,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACnD,CAAC;IACD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;SAC3B,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;SACpE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,KAAc;IACnC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,UAAU,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,KAA+E;IAE/E,MAAM,aAAa,GAAG,UAAU,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG;QACX,aAAa,EAAE,OAAgB;QAC/B,aAAa;QACb,GAAG,KAAK;KACT,CAAC;IACF,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;AAC3C,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,sCAAsC;AAEtC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAErD,MAAM,aAAa,GACjB,mJAAmJ,CAAC;AACtJ;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,eAAe,GAA6C;IACvE,2EAA2E;IAC3E;QACE,6FAA6F;QAC7F,wBAAwB;KACzB;IACD,CAAC,oDAAoD,EAAE,wBAAwB,CAAC;IAChF,CAAC,gCAAgC,EAAE,uBAAuB,CAAC;IAC3D,CAAC,oEAAoE,EAAE,gBAAgB,CAAC;IACxF,CAAC,oCAAoC,EAAE,wBAAwB,CAAC;IAChE,CAAC,iCAAiC,EAAE,yBAAyB,CAAC;IAC9D,CAAC,wCAAwC,EAAE,oBAAoB,CAAC;IAChE,CAAC,qCAAqC,EAAE,yBAAyB,CAAC;IAClE,6EAA6E;IAC7E,kFAAkF;IAClF;QACE,gIAAgI;QAChI,iBAAiB;KAClB;IACD,mFAAmF;IACnF,CAAC,iDAAiD,EAAE,+BAA+B,CAAC;CACrF,CAAC;AAEF,kFAAkF;AAClF,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,KAAK,GAAG,IAAI,CAAC;IACjB,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,eAAe,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,KAAK,CAAC;QACrB,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC5C,IAAI,KAAK,KAAK,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AAC/B,CAAC;AAED,6EAA6E;AAC7E,2EAA2E;AAC3E,kEAAkE;AAClE,4CAA4C;AAC5C,MAAM,WAAW,GACf,uLAAuL,CAAC;AAC1L,4EAA4E;AAC5E,8EAA8E;AAC9E,mBAAmB;AACnB,MAAM,SAAS,GAAG,iCAAiC,CAAC;AACpD,oCAAoC;AACpC,MAAM,aAAa,GAAG,uBAAuB,CAAC;AAC9C,6EAA6E;AAC7E,4EAA4E;AAC5E,4EAA4E;AAC5E,8DAA8D;AAC9D,MAAM,iBAAiB,GAAG,cAAc,CAAC;AACzC,MAAM,YAAY,GAAG,6CAA6C,CAAC;AACnE,gFAAgF;AAChF,MAAM,iBAAiB,GACrB,gGAAgG,CAAC;AACnG,+EAA+E;AAC/E,MAAM,aAAa,GACjB,0GAA0G,CAAC;AAC7G,8EAA8E;AAC9E,6DAA6D;AAC7D,MAAM,eAAe,GAAG,4BAA4B,CAAC;AACrD,MAAM,YAAY,GAAG,0BAA0B,CAAC;AAEhD,SAAS,YAAY,CAAC,GAAW,EAAE,QAA4B,EAAE,KAAc;IAC7E,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,OAAO,YAAY,CAAC;QAChE,IAAI,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAClD,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7D,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,YAAY,EAAE,CAAC;IACjE,IAAI,KAAK,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,YAAY,EAAE,CAAC;IACrE,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,YAAY,EAAE,CAAC,CAAC;IACrF,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,YAAY,EAAE,CAAC,CAAC;IAC7F,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,YAAY,EAAE,CAAC,CAAC;IACtF,OAAO,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,KAAK,YAAY,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CACxB,IAAuB,EACvB,OAAgB;IAEhB,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,mEAAmE;IACnE,MAAM,OAAO,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9F,IAAI,KAAK,GAAG,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QACpC,iEAAiE;QACjE,IAAI,OAAO,CAAC,GAAG,CAAC;YAAE,KAAK,GAAG,IAAI,CAAC;QAC/B,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAChF,IAAI,GAAG,KAAK,GAAG;YAAE,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACpC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,UAAU;YAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7D,OAAO,QAAQ,CAAC,KAAK,CAAC;IACxB,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC;AAChD,CAAC;AAiCD;;;;GAIG;AACH,MAAM,uBAAuB,GAAqC;IAChE,WAAW,EAAE,OAAO;IACpB,WAAW,EAAE,OAAO;IACpB,SAAS,EAAE,OAAO;IAClB,6EAA6E;IAC7E,yBAAyB;IACzB,WAAW,EAAE,OAAO;IACpB,4EAA4E;IAC5E,8EAA8E;IAC9E,cAAc;IACd,qBAAqB,EAAE,aAAa;CACrC,CAAC;AAEF,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,uBAAuB,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC;AACtD,CAAC;AAmGD,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAIlD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,gBAAgB,GAAG,CAAC,OAAgB,EAAW,EAAE;QACrD,UAAU,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;QAC7C,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,4BAA4B,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YACpD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;gBACrC,QAAQ;gBACR,4BAA4B;aAC7B,CAAC,CACH,CAAC;QACJ,CAAC;QACD,OAAO,4BAA4B,CAAC;IACtC,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,OAAgB,EAAE,GAAY,EAAE,MAAgC,EAAW,EAAE;QAC1F,IAAI,GAAG,KAAK,SAAS,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACjD,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;YACnB,iEAAiE;YACjE,qEAAqE;YACrE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;gBAClF,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACnC,CAAC;YACD,uDAAuD;YACvD,MAAM,OAAO,GAAG,OAAO,MAAM,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YACjF,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9C,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,UAAU;gBAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC7D,OAAO,QAAQ,CAAC,KAAK,CAAC;QACxB,CAAC;QACD,IAAI,GAAG,KAAK,KAAK,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YACjD,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;oBACzC,UAAU,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;oBACvC,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;oBAChB,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;gBAChB,CAAC;gBACD,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;oBAC/C,UAAU,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;oBAC7C,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC;oBAClB,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC;gBACpB,CAAC;gBACD,yEAAyE;gBACzE,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC/C,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,UAAU;oBAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC7D,OAAO,QAAQ,CAAC,KAAK,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,6DAA6D;YAC/D,CAAC;QACH,CAAC;QACD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;YACxC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,UAAU;gBAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC7D,OAAO,QAAQ,CAAC,KAAK,CAAC;QACxB,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YACpD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC;gBACtD,QAAQ;gBACR,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAkC,CAAC;aAChE,CAAC,CACH,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC;IACzC,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACnD,CAAC;IACD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;SAC3B,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;SACpE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,KAAc;IACnC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,UAAU,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,KAA+E;IAE/E,MAAM,aAAa,GAAG,UAAU,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG;QACX,aAAa,EAAE,OAAgB;QAC/B,aAAa;QACb,GAAG,KAAK;KACT,CAAC;IACF,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;AAC3C,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@melra/receipt-schema",
-  "version": "0.3.0-alpha.11",
+  "version": "0.3.0-alpha.13",
   "description": "Canonical receipts, redaction, and execution certificates for MELRA.",
   "license": "Apache-2.0",
   "repository": {
@@ -24,6 +24,6 @@
     "build": "tsc -p tsconfig.json",
     "clean": "rm -rf dist",
     "test": "vitest run --passWithNoTests",
-    "typecheck": "tsc -p tsconfig.json --noEmit"
+    "typecheck": "tsc -p tsconfig.test.json"
   }
 }

package/dist/index.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=index.test.d.ts.map

package/dist/index.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.test.d.ts","sourceRoot":"","sources":["../src/index.test.ts"],"names":[],"mappings":""}

package/dist/index.test.js

@@ -1,49 +0,0 @@
-// Copyright 2026 XAGI Labs Private Limited
-// SPDX-License-Identifier: Apache-2.0
-import { describe, expect, it } from "vitest";
-import { canonicalJson, createCertificate, evidenceStrength, redactStructuredValue, sha256, } from "./index.js";
-describe("receipt and certificate primitives", () => {
-    it("canonicalizes object keys before hashing", () => {
-        expect(canonicalJson({ b: 2, a: { d: 4, c: 3 } })).toBe('{"a":{"c":3,"d":4},"b":2}');
-        expect(sha256({ b: 2, a: 1 })).toBe(sha256({ a: 1, b: 2 }));
-    });
-    it("binds the certificate digest to every public field", () => {
-        const certificate = createCertificate({
-            taskId: "cff6c496-88b9-442b-b6ef-6f63f57364a3",
-            goal: "Verify a deterministic outcome",
-            result: "VERIFIED_SUCCESS",
-            policyVersion: "1",
-            receiptIds: ["3f5676d5-1c17-4670-8fa1-ddd55170d5a0"],
-            evidence: [
-                { type: "result_equals", passed: true, summary: "matched" },
-            ],
-            createdAt: "2026-07-28T00:00:00.000Z",
-        });
-        const { digest, ...unsigned } = certificate;
-        expect(digest).toBe(sha256(unsigned));
-        expect(digest).toMatch(/^[a-f0-9]{64}$/);
-    });
-    it("redacts secret-shaped strings and sensitive fields recursively", () => {
-        const redacted = redactStructuredValue({
-            page: "password=hunter2",
-            nested: { authorization: "Bearer should-never-persist" },
-            values: ["ghp_123456789012345678901234"],
-        });
-        expect(redacted.value.page).not.toContain("hunter2");
-        expect(redacted.value.nested.authorization).toBe("[REDACTED_SENSITIVE_FIELD]");
-        expect(redacted.value.values[0]).not.toContain("ghp_");
-        expect(redacted.redactions.length).toBeGreaterThanOrEqual(2);
-    });
-    it("ranks re-read state above the adapter's own report", () => {
-        // The distinction the field exists for: a file the kernel went back and
-        // looked at outranks the adapter saying the call returned.
-        expect(evidenceStrength("file_hash")).toBe("state");
-        expect(evidenceStrength("operation_completed")).toBe("execution");
-    });
-    it("reads an unknown evidence type as the weakest claim", () => {
-        // A predicate added without a decision in the table, or a type from a
-        // future version, must not inherit a strength it never earned.
-        expect(evidenceStrength("predicate_from_a_later_version")).toBe("execution");
-    });
-});
-//# sourceMappingURL=index.test.js.map

package/dist/index.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.test.js","sourceRoot":"","sources":["../src/index.test.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,sCAAsC;AAEtC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,MAAM,GACP,MAAM,YAAY,CAAC;AAEpB,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;IAClD,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CACrD,2BAA2B,CAC5B,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,WAAW,GAAG,iBAAiB,CAAC;YACpC,MAAM,EAAE,sCAAsC;YAC9C,IAAI,EAAE,gCAAgC;YACtC,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,GAAG;YAClB,UAAU,EAAE,CAAC,sCAAsC,CAAC;YACpD,QAAQ,EAAE;gBACR,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE;aAC5D;YACD,SAAS,EAAE,0BAA0B;SACtC,CAAC,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,EAAE,GAAG,WAAW,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,QAAQ,GAAG,qBAAqB,CAAC;YACrC,IAAI,EAAE,kBAAkB;YACxB,MAAM,EAAE,EAAE,aAAa,EAAE,6BAA6B,EAAE;YACxD,MAAM,EAAE,CAAC,8BAA8B,CAAC;SACzC,CAOA,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACrD,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAC9C,4BAA4B,CAC7B,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACvD,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,wEAAwE;QACxE,2DAA2D;QAC3D,MAAM,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,sEAAsE;QACtE,+DAA+D;QAC/D,MAAM,CAAC,gBAAgB,CAAC,gCAAgC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}