@miadi/tide-contract 0.3.2 → 0.3.3

package/README.md

@@ -63,3 +63,21 @@ Exported from the package and mirrored in the schema's `x-tide` metadata:
 
 The TypeScript types are written by hand and checked against the schema by a test that fails
 when the two drift apart. Generating them from the schema is planned.
+
+## Credential redaction
+
+`schema/secret-redaction.json` is an ordered list of credential rules for pane captures.
+`sanitizeSecrets(text)` applies it: a token keeps its first 6 characters followed by `***`
+(`mwt_Qn***`, `sk-ant***`), a `NAME_TOKEN=value` or `Bearer value` keeps its label, and a
+private key block is replaced whole. Running it twice changes nothing.
+
+```ts
+import { sanitizeSecrets } from "@miadi/tide-contract"
+
+sanitizeSecrets("export MIADI_API_TOKEN=abc123def456ghi789")
+// "export MIADI_API_TOKEN=abc123***"
+```
+
+The rules are plain regular expressions in the subset JavaScript and Python share, so a
+runtime in another language can read the JSON (`@miadi/tide-contract/schema/secret-redaction.json`).
+A test holds the exported `TIDE_SECRET_RULES` equal to it.

package/dist/index.d.ts

@@ -391,4 +391,5 @@ export interface TidePendingApproval {
     requires_controller: boolean;
     created_at: string;
 }
+export * from "./secret-redaction.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,kBAAkB,mDAAmD,CAAA;AAClF,eAAO,MAAM,gBAAgB,SAAS,CAAA;AACtC,eAAO,MAAM,mBAAmB,eAAe,CAAA;AAC/C,eAAO,MAAM,uBAAuB,uBAAuB,CAAA;AAC3D,eAAO,MAAM,4BAA4B,yBAAyB,CAAA;AAIlE;;;;GAIG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,OAAO,CAAA;AAE1C;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAAA;AAEjF;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAA;AAE9D;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,kBAAkB,CAAA;IACzB,UAAU,EAAE,MAAM,CAAA;IAClB,oDAAoD;IACpD,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,sGAAsG;IACtG,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;IACnC,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;IACf,0FAA0F;IAC1F,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,2DAA2D;IAC3D,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,kCAAkC;IAClC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,qJAAqJ;IACrJ,SAAS,EAAE,MAAM,CAAA;IACjB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,yGAAyG;IACzG,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,yFAAyF;IACzF,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,oHAAoH;IACpH,KAAK,CAAC,EAAE,aAAa,GAAG,IAAI,CAAA;IAC5B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,iBAAiB,EAAE,MAAM,CAAA;IACzB,SAAS,EAAE,OAAO,CAAA;IAClB,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACtC,SAAS,EAAE,eAAe,EAAE,CAAA;IAC5B,eAAe,CAAC,EAAE,WAAW,EAAE,CAAA;IAC/B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,OAAO,CAAA;IACX,SAAS,EAAE;QACT,QAAQ,EAAE,QAAQ,GAAG,KAAK,CAAA;QAC1B,SAAS,EAAE,QAAQ,GAAG,KAAK,CAAA;QAC3B,QAAQ,EAAE,KAAK,CAAA;QACf,UAAU,EAAE,MAAM,CAAA;QAClB,eAAe,EAAE,OAAO,CAAA;KACzB,CAAA;IACD,MAAM,EAAE;QACN,MAAM,EAAE,OAAO,CAAA;QACf,EAAE,EAAE,OAAO,CAAA;QACX,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KACrB,CAAA;IACD,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB,2HAA2H;IAC3H,OAAO,EAAE,MAAM,CAAA;IACf,yKAAyK;IACzK,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,GAAG,EAAE,MAAM,CAAA;IACX,WAAW,EAAE,OAAO,CAAA;IACpB,gBAAgB,EAAE,MAAM,CAAA;IACxB,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,iBAAiB,EAAE,MAAM,CAAA;IACzB,cAAc,EAAE,MAAM,CAAA;IACtB,cAAc,EAAE,MAAM,CAAA;IACtB,mBAAmB,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,MAAM,mBAAmB,GAAG,kBAAkB,EAAE,CAAA;AAEtD,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,MAAM,gBAAgB,GAAG,eAAe,GAAG,IAAI,CAAA;AAErD;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAA;IACd,wKAAwK;IACxK,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACjC,gCAAgC;IAChC,OAAO,EAAE,MAAM,CAAA;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,OAAO,CAAA;IACpB,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAA;IACZ,sBAAsB;IACtB,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,4BAA4B;IAC5B,IAAI,EAAE,MAAM,CAAA;IACZ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,kBAAkB,GAAG,mBAAmB,CAAA;AAErE,MAAM,WAAW,eAAe;IAC9B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAID;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAA;IACd,4CAA4C;IAC5C,OAAO,EAAE,MAAM,CAAA;IACf,wEAAwE;IACxE,SAAS,EAAE,OAAO,CAAA;IAClB,+EAA+E;IAC/E,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,2FAA2F;IAC3F,cAAc,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IAC/B,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,OAAO,CAAA;IACpB,uIAAuI;IACvI,MAAM,EAAE,MAAM,CAAA;IACd,sFAAsF;IACtF,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,4CAA4C;IAC5C,OAAO,EAAE,MAAM,CAAA;IACf,gEAAgE;IAChE,SAAS,EAAE,OAAO,CAAA;IAClB,iGAAiG;IACjG,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,oFAAoF;IACpF,cAAc,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IAC/B,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,4FAA4F;AAC5F,MAAM,MAAM,kBAAkB,GAAG,sBAAsB,GAAG,uBAAuB,CAAA;AAIjF;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,8FAA8F;IAC9F,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,YAAY,CAAC,EAAE,eAAe,GAAG,MAAM,CAAA;IACvC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED,0EAA0E;AAC1E,MAAM,WAAW,sBAAsB;IACrC,qDAAqD;IACrD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,kDAAkD;IAClD,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,OAAO,CAAA;IACpB,qCAAqC;IACrC,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,sBAAsB,EAAE,CAAA;IACpC,KAAK,EAAE,iBAAiB,EAAE,CAAA;IAC1B,8EAA8E;IAC9E,IAAI,CAAC,EAAE,gBAAgB,EAAE,CAAA;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,yBAAyB;IACxC,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,MAAM,CAAC,EAAE;QACP,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,YAAY,CAAC,EAAE,MAAM,CAAA;QACrB,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,YAAY,CAAC,EAAE,MAAM,CAAA;QACrB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KACvB,CAAA;IACD,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,YAAY,CAAC,EAAE,MAAM,CAAA;QACrB,YAAY,CAAC,EAAE,eAAe,GAAG,MAAM,CAAA;QACvC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KACvB,CAAA;IACD,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAID,MAAM,MAAM,yBAAyB,GAAG,UAAU,GAAG,YAAY,GAAG,MAAM,CAAA;AAE1E,MAAM,MAAM,eAAe,GACvB,UAAU,GACV,aAAa,GACb,UAAU,GACV,gBAAgB,GAChB,QAAQ,CAAA;AAEZ,MAAM,MAAM,4BAA4B,GAAG,UAAU,GAAG,YAAY,GAAG,SAAS,CAAA;AAEhF,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,eAAe,CAAA;IAC1B,8EAA8E;IAC9E,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,6IAA6I;IAC7I,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,YAAY,CAAC,EAAE,eAAe,CAAA;IAC9B,kBAAkB,EAAE,4BAA4B,CAAA;IAChD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,aAAa,EAAE,OAAO,CAAA;IACtB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,OAAO,EAAE,yBAAyB,CAAA;CACnC;AAED,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,WAAW,EAAE,CAAA;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,6FAA6F;IAC7F,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB,aAAa,EAAE,OAAO,CAAA;IACtB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;CAC/B;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAA;IAClB,cAAc,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAA;IAClB,cAAc,EAAE,MAAM,CAAA;IACtB,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,wBAAwB,EAAE,MAAM,GAAG,IAAI,CAAA;IACvC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,6FAA6F;IAC7F,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,YAAY,CAAC,EAAE,eAAe,CAAA;IAC9B,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,mBAAmB,EAAE,OAAO,CAAA;IAC5B,UAAU,EAAE,MAAM,CAAA;CACnB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,kBAAkB,mDAAmD,CAAA;AAClF,eAAO,MAAM,gBAAgB,SAAS,CAAA;AACtC,eAAO,MAAM,mBAAmB,eAAe,CAAA;AAC/C,eAAO,MAAM,uBAAuB,uBAAuB,CAAA;AAC3D,eAAO,MAAM,4BAA4B,yBAAyB,CAAA;AAIlE;;;;GAIG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,OAAO,CAAA;AAE1C;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAAA;AAEjF;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAA;AAE9D;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,kBAAkB,CAAA;IACzB,UAAU,EAAE,MAAM,CAAA;IAClB,oDAAoD;IACpD,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,sGAAsG;IACtG,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;IACnC,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;IACf,0FAA0F;IAC1F,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,2DAA2D;IAC3D,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,kCAAkC;IAClC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,qJAAqJ;IACrJ,SAAS,EAAE,MAAM,CAAA;IACjB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,yGAAyG;IACzG,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,yFAAyF;IACzF,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,oHAAoH;IACpH,KAAK,CAAC,EAAE,aAAa,GAAG,IAAI,CAAA;IAC5B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,iBAAiB,EAAE,MAAM,CAAA;IACzB,SAAS,EAAE,OAAO,CAAA;IAClB,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACtC,SAAS,EAAE,eAAe,EAAE,CAAA;IAC5B,eAAe,CAAC,EAAE,WAAW,EAAE,CAAA;IAC/B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,OAAO,CAAA;IACX,SAAS,EAAE;QACT,QAAQ,EAAE,QAAQ,GAAG,KAAK,CAAA;QAC1B,SAAS,EAAE,QAAQ,GAAG,KAAK,CAAA;QAC3B,QAAQ,EAAE,KAAK,CAAA;QACf,UAAU,EAAE,MAAM,CAAA;QAClB,eAAe,EAAE,OAAO,CAAA;KACzB,CAAA;IACD,MAAM,EAAE;QACN,MAAM,EAAE,OAAO,CAAA;QACf,EAAE,EAAE,OAAO,CAAA;QACX,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KACrB,CAAA;IACD,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB,2HAA2H;IAC3H,OAAO,EAAE,MAAM,CAAA;IACf,yKAAyK;IACzK,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,GAAG,EAAE,MAAM,CAAA;IACX,WAAW,EAAE,OAAO,CAAA;IACpB,gBAAgB,EAAE,MAAM,CAAA;IACxB,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,iBAAiB,EAAE,MAAM,CAAA;IACzB,cAAc,EAAE,MAAM,CAAA;IACtB,cAAc,EAAE,MAAM,CAAA;IACtB,mBAAmB,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,MAAM,mBAAmB,GAAG,kBAAkB,EAAE,CAAA;AAEtD,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,MAAM,gBAAgB,GAAG,eAAe,GAAG,IAAI,CAAA;AAErD;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAA;IACd,wKAAwK;IACxK,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACjC,gCAAgC;IAChC,OAAO,EAAE,MAAM,CAAA;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,OAAO,CAAA;IACpB,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAA;IACZ,sBAAsB;IACtB,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,4BAA4B;IAC5B,IAAI,EAAE,MAAM,CAAA;IACZ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,kBAAkB,GAAG,mBAAmB,CAAA;AAErE,MAAM,WAAW,eAAe;IAC9B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAID;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAA;IACd,4CAA4C;IAC5C,OAAO,EAAE,MAAM,CAAA;IACf,wEAAwE;IACxE,SAAS,EAAE,OAAO,CAAA;IAClB,+EAA+E;IAC/E,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,2FAA2F;IAC3F,cAAc,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IAC/B,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,OAAO,CAAA;IACpB,uIAAuI;IACvI,MAAM,EAAE,MAAM,CAAA;IACd,sFAAsF;IACtF,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,4CAA4C;IAC5C,OAAO,EAAE,MAAM,CAAA;IACf,gEAAgE;IAChE,SAAS,EAAE,OAAO,CAAA;IAClB,iGAAiG;IACjG,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,oFAAoF;IACpF,cAAc,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IAC/B,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,4FAA4F;AAC5F,MAAM,MAAM,kBAAkB,GAAG,sBAAsB,GAAG,uBAAuB,CAAA;AAIjF;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,8FAA8F;IAC9F,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,YAAY,CAAC,EAAE,eAAe,GAAG,MAAM,CAAA;IACvC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED,0EAA0E;AAC1E,MAAM,WAAW,sBAAsB;IACrC,qDAAqD;IACrD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,kDAAkD;IAClD,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,OAAO,CAAA;IACpB,qCAAqC;IACrC,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,sBAAsB,EAAE,CAAA;IACpC,KAAK,EAAE,iBAAiB,EAAE,CAAA;IAC1B,8EAA8E;IAC9E,IAAI,CAAC,EAAE,gBAAgB,EAAE,CAAA;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,yBAAyB;IACxC,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,MAAM,CAAC,EAAE;QACP,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,YAAY,CAAC,EAAE,MAAM,CAAA;QACrB,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,YAAY,CAAC,EAAE,MAAM,CAAA;QACrB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KACvB,CAAA;IACD,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,YAAY,CAAC,EAAE,MAAM,CAAA;QACrB,YAAY,CAAC,EAAE,eAAe,GAAG,MAAM,CAAA;QACvC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KACvB,CAAA;IACD,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAID,MAAM,MAAM,yBAAyB,GAAG,UAAU,GAAG,YAAY,GAAG,MAAM,CAAA;AAE1E,MAAM,MAAM,eAAe,GACvB,UAAU,GACV,aAAa,GACb,UAAU,GACV,gBAAgB,GAChB,QAAQ,CAAA;AAEZ,MAAM,MAAM,4BAA4B,GAAG,UAAU,GAAG,YAAY,GAAG,SAAS,CAAA;AAEhF,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,eAAe,CAAA;IAC1B,8EAA8E;IAC9E,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,6IAA6I;IAC7I,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,YAAY,CAAC,EAAE,eAAe,CAAA;IAC9B,kBAAkB,EAAE,4BAA4B,CAAA;IAChD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,aAAa,EAAE,OAAO,CAAA;IACtB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,OAAO,EAAE,yBAAyB,CAAA;CACnC;AAED,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,WAAW,EAAE,CAAA;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,6FAA6F;IAC7F,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB,aAAa,EAAE,OAAO,CAAA;IACtB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;CAC/B;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAA;IAClB,cAAc,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAA;IAClB,cAAc,EAAE,MAAM,CAAA;IACtB,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,wBAAwB,EAAE,MAAM,GAAG,IAAI,CAAA;IACvC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,6FAA6F;IAC7F,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,YAAY,CAAC,EAAE,eAAe,CAAA;IAC9B,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,mBAAmB,EAAE,OAAO,CAAA;IAC5B,UAAU,EAAE,MAAM,CAAA;CACnB;AAID,cAAc,uBAAuB,CAAA"}

package/dist/index.js

@@ -5,4 +5,6 @@ export const TIDE_CLI_COMMAND = "tide";
 export const TIDE_STATE_ROOT_ENV = "MIADI_HOME";
 export const TIDE_DEFAULT_STATE_ROOT = "~/.miadi/navigator";
 export const TIDE_DAEMON_CONTRACT_VERSION = "miadi.tide.daemon.v2";
+// ── Credential redaction (jgwill/Miadi#745) ─────────────────────────────────
+export * from "./secret-redaction.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mDAAmD;AACnD,iFAAiF;AAEjF,MAAM,CAAC,MAAM,kBAAkB,GAAG,gDAAgD,CAAA;AAClF,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAA;AACtC,MAAM,CAAC,MAAM,mBAAmB,GAAG,YAAY,CAAA;AAC/C,MAAM,CAAC,MAAM,uBAAuB,GAAG,oBAAoB,CAAA;AAC3D,MAAM,CAAC,MAAM,4BAA4B,GAAG,sBAAsB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mDAAmD;AACnD,iFAAiF;AAEjF,MAAM,CAAC,MAAM,kBAAkB,GAAG,gDAAgD,CAAA;AAClF,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAA;AACtC,MAAM,CAAC,MAAM,mBAAmB,GAAG,YAAY,CAAA;AAC/C,MAAM,CAAC,MAAM,uBAAuB,GAAG,oBAAoB,CAAA;AAC3D,MAAM,CAAC,MAAM,4BAA4B,GAAG,sBAAsB,CAAA;AAsblE,+EAA+E;AAE/E,cAAc,uBAAuB,CAAA"}

package/dist/secret-redaction.d.ts

@@ -0,0 +1,22 @@
+export type TideSecretRuleKind = "token" | "labelled" | "block";
+export interface TideSecretRule {
+    name: string;
+    /** token: the whole match is redacted. labelled: group 1 is kept, group 2 is redacted. block: the whole match becomes `replacement`. */
+    kind: TideSecretRuleKind;
+    /** A regex in the subset JavaScript and Python share. */
+    pattern: string;
+    /** "" or "i". */
+    flags: string;
+    replacement?: string;
+}
+export declare const TIDE_SECRET_MASK = "***";
+/** Applied top to bottom. */
+export declare const TIDE_SECRET_RULES: readonly TideSecretRule[];
+/** A secret as its first 6 characters (4 when shorter than 7) followed by `***`. */
+export declare function redactSecretValue(value: string): string;
+/**
+ * Text with every credential the rules know redacted. Running it again changes
+ * nothing, so a capture ironsilk already redacted passes through unchanged.
+ */
+export declare function sanitizeSecrets(text: string): string;
+//# sourceMappingURL=secret-redaction.d.ts.map

package/dist/secret-redaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-redaction.d.ts","sourceRoot":"","sources":["../src/secret-redaction.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,UAAU,GAAG,OAAO,CAAA;AAE/D,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAA;IACZ,wIAAwI;IACxI,IAAI,EAAE,kBAAkB,CAAA;IACxB,yDAAyD;IACzD,OAAO,EAAE,MAAM,CAAA;IACf,iBAAiB;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,eAAO,MAAM,gBAAgB,QAAQ,CAAA;AAErC,6BAA6B;AAC7B,eAAO,MAAM,iBAAiB,EAAE,SAAS,cAAc,EAwBtD,CAAA;AAED,oFAAoF;AACpF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGvD;AAID;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAapD"}

package/dist/secret-redaction.js

@@ -0,0 +1,60 @@
+// Credential redaction for pane captures (jgwill/Miadi#745).
+//
+// schema/secret-redaction.json is the rule list; TIDE_SECRET_RULES mirrors it
+// and test/secret-redaction.test.ts holds the two equal. Change the JSON first.
+// ironsilk carries its own copy (tide_runtime/secret_redaction.json), held equal
+// to the same JSON by its tests.
+export const TIDE_SECRET_MASK = "***";
+/** Applied top to bottom. */
+export const TIDE_SECRET_RULES = [
+    { name: "private-key-block", kind: "block", pattern: "-----BEGIN [^-]*PRIVATE KEY-----[\\s\\S]*?-----END [^-]*PRIVATE KEY-----", flags: "", replacement: "-----BEGIN PRIVATE KEY-----***-----END PRIVATE KEY-----" },
+    { name: "putty-key", kind: "block", pattern: "PuTTY-User-Key-File-[0-9][\\s\\S]*?(?:Private-MAC:[^\\n]*|$)", flags: "", replacement: "PuTTY-User-Key-File-***" },
+    { name: "aws-access-key", kind: "token", pattern: "(?<![A-Za-z0-9])AKIA[0-9A-Z]{16}", flags: "" },
+    { name: "aws-session-key", kind: "token", pattern: "(?<![A-Za-z0-9])ASIA[0-9A-Z]{16}", flags: "" },
+    { name: "github-token", kind: "token", pattern: "(?<![A-Za-z0-9])gh[pousr]_[A-Za-z0-9_]{20,}", flags: "" },
+    { name: "github-pat", kind: "token", pattern: "(?<![A-Za-z0-9])github_pat_[A-Za-z0-9_]{20,}", flags: "" },
+    { name: "gitlab-pat", kind: "token", pattern: "(?<![A-Za-z0-9])glpat-[A-Za-z0-9_-]{18,}", flags: "" },
+    { name: "anthropic-key", kind: "token", pattern: "(?<![A-Za-z0-9])sk-ant-[A-Za-z0-9_-]{20,}", flags: "" },
+    { name: "openai-project-key", kind: "token", pattern: "(?<![A-Za-z0-9])sk-proj-[A-Za-z0-9_-]{20,}", flags: "" },
+    { name: "openai-key", kind: "token", pattern: "(?<![A-Za-z0-9])sk-[A-Za-z0-9_-]{20,}", flags: "" },
+    { name: "slack-token", kind: "token", pattern: "(?<![A-Za-z0-9])xox[baprs]-[A-Za-z0-9-]{10,}", flags: "" },
+    { name: "google-api-key", kind: "token", pattern: "(?<![A-Za-z0-9])AIza[0-9A-Za-z_-]{35}", flags: "" },
+    { name: "google-oauth-token", kind: "token", pattern: "(?<![A-Za-z0-9])ya29\\.[0-9A-Za-z_-]{20,}", flags: "" },
+    { name: "huggingface-token", kind: "token", pattern: "(?<![A-Za-z0-9])hf_[A-Za-z0-9]{20,}", flags: "" },
+    { name: "npm-token", kind: "token", pattern: "(?<![A-Za-z0-9])npm_[A-Za-z0-9]{30,}", flags: "" },
+    { name: "stripe-live-key", kind: "token", pattern: "(?<![A-Za-z0-9])(?:sk|pk|rk)_live_[A-Za-z0-9]{20,}", flags: "" },
+    { name: "digitalocean-token", kind: "token", pattern: "(?<![A-Za-z0-9])dop_v1_[A-Za-z0-9]{32,}", flags: "" },
+    { name: "shopify-token", kind: "token", pattern: "(?<![A-Za-z0-9])shpat_[A-Za-z0-9]{32,}", flags: "" },
+    { name: "medicine-wheel-token", kind: "token", pattern: "(?<![A-Za-z0-9])mwt_[A-Za-z0-9_-]{32,}", flags: "" },
+    { name: "miadi-reader-token", kind: "token", pattern: "(?<![A-Za-z0-9])mr_[A-Za-z0-9]{32,}", flags: "" },
+    { name: "jwt", kind: "token", pattern: "(?<![A-Za-z0-9])eyJ[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}", flags: "" },
+    { name: "bearer", kind: "labelled", pattern: "(\\bBearer\\s+)([A-Za-z0-9._~+/=-]{12,})", flags: "i" },
+    { name: "secret-assignment", kind: "labelled", pattern: "(\\b[A-Za-z0-9_.-]*(?:api[_-]?key|secret|token|passwd|password|client[_-]?secret|access[_-]?key|private[_-]?key|auth[_-]?token)[A-Za-z0-9_.-]*\\b[\"'\\s]*[:=]\\s*[\"']?)([A-Za-z0-9][A-Za-z0-9/_+.=~:-]{7,})", flags: "i" },
+];
+/** A secret as its first 6 characters (4 when shorter than 7) followed by `***`. */
+export function redactSecretValue(value) {
+    const keep = value.length >= 7 ? 6 : value.length >= 4 ? 4 : value.length;
+    return value.slice(0, keep) + TIDE_SECRET_MASK;
+}
+const compiled = TIDE_SECRET_RULES.map(rule => ({ rule, regex: new RegExp(rule.pattern, rule.flags + "g") }));
+/**
+ * Text with every credential the rules know redacted. Running it again changes
+ * nothing, so a capture ironsilk already redacted passes through unchanged.
+ */
+export function sanitizeSecrets(text) {
+    let out = text;
+    for (const { rule, regex } of compiled) {
+        if (rule.kind === "block") {
+            const replacement = rule.replacement ?? TIDE_SECRET_MASK;
+            out = out.replace(regex, () => replacement);
+        }
+        else if (rule.kind === "labelled") {
+            out = out.replace(regex, (_match, label, value) => label + redactSecretValue(value));
+        }
+        else {
+            out = out.replace(regex, match => redactSecretValue(match));
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=secret-redaction.js.map

package/dist/secret-redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-redaction.js","sourceRoot":"","sources":["../src/secret-redaction.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAC7D,EAAE;AACF,8EAA8E;AAC9E,gFAAgF;AAChF,iFAAiF;AACjF,iCAAiC;AAejC,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,CAAA;AAErC,6BAA6B;AAC7B,MAAM,CAAC,MAAM,iBAAiB,GAA8B;IAC1D,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,0EAA0E,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,yDAAyD,EAAE;IACpN,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,8DAA8D,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,yBAAyB,EAAE;IAChK,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,kCAAkC,EAAE,KAAK,EAAE,EAAE,EAAE;IACjG,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,kCAAkC,EAAE,KAAK,EAAE,EAAE,EAAE;IAClG,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,6CAA6C,EAAE,KAAK,EAAE,EAAE,EAAE;IAC1G,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,8CAA8C,EAAE,KAAK,EAAE,EAAE,EAAE;IACzG,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,0CAA0C,EAAE,KAAK,EAAE,EAAE,EAAE;IACrG,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,2CAA2C,EAAE,KAAK,EAAE,EAAE,EAAE;IACzG,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,4CAA4C,EAAE,KAAK,EAAE,EAAE,EAAE;IAC/G,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,uCAAuC,EAAE,KAAK,EAAE,EAAE,EAAE;IAClG,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,8CAA8C,EAAE,KAAK,EAAE,EAAE,EAAE;IAC1G,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,uCAAuC,EAAE,KAAK,EAAE,EAAE,EAAE;IACtG,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,2CAA2C,EAAE,KAAK,EAAE,EAAE,EAAE;IAC9G,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,qCAAqC,EAAE,KAAK,EAAE,EAAE,EAAE;IACvG,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,sCAAsC,EAAE,KAAK,EAAE,EAAE,EAAE;IAChG,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,oDAAoD,EAAE,KAAK,EAAE,EAAE,EAAE;IACpH,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,yCAAyC,EAAE,KAAK,EAAE,EAAE,EAAE;IAC5G,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,wCAAwC,EAAE,KAAK,EAAE,EAAE,EAAE;IACtG,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,wCAAwC,EAAE,KAAK,EAAE,EAAE,EAAE;IAC7G,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,qCAAqC,EAAE,KAAK,EAAE,EAAE,EAAE;IACxG,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,8EAA8E,EAAE,KAAK,EAAE,EAAE,EAAE;IAClI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,0CAA0C,EAAE,KAAK,EAAE,GAAG,EAAE;IACrG,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,+MAA+M,EAAE,KAAK,EAAE,GAAG,EAAE;CACtR,CAAA;AAED,oFAAoF;AACpF,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAA;IACzE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,gBAAgB,CAAA;AAChD,CAAC;AAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;AAE7G;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,IAAI,GAAG,GAAG,IAAI,CAAA;IACd,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,QAAQ,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC1B,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,gBAAgB,CAAA;YACxD,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,CAAA;QAC7C,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACpC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,KAAa,EAAE,KAAa,EAAE,EAAE,CAAC,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAA;QACtG,CAAC;aAAM,CAAC;YACN,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAA;QAC7D,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miadi/tide-contract",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "description": "Schema-first Tide API contract shared by Miadi and the IronSilk tide runtime.",
   "license": "MIT",
   "publishConfig": {
@@ -15,6 +15,7 @@
       "import": "./dist/index.js"
     },
     "./schema/tide-api.schema.json": "./schema/tide-api.schema.json",
+    "./schema/secret-redaction.json": "./schema/secret-redaction.json",
     "./package.json": "./package.json"
   },
   "files": [

package/schema/secret-redaction.json

@@ -0,0 +1,30 @@
+{
+  "$comment": "Ordered credential-redaction rules for pane captures (jgwill/Miadi#745). Applied top to bottom. Patterns use the regex subset JavaScript and Python share. 'token': the whole match is redacted. 'labelled': group 1 is kept and group 2 is redacted. 'block': the whole match becomes 'replacement'. A redacted value keeps its first 6 characters (4 when shorter than 7) followed by '***'. Mirrors jgwill/miadi-orchestration-kit claude/miadi-session-observability/hooks/secret_capture_sanitizer.sh, with a left boundary on prefixed tokens. src/secret-redaction.ts and ironsilk's tide_runtime/secret_redaction.json are held equal to this file by tests.",
+  "version": 1,
+  "mask": "***",
+  "rules": [
+    { "name": "private-key-block", "kind": "block", "pattern": "-----BEGIN [^-]*PRIVATE KEY-----[\\s\\S]*?-----END [^-]*PRIVATE KEY-----", "flags": "", "replacement": "-----BEGIN PRIVATE KEY-----***-----END PRIVATE KEY-----" },
+    { "name": "putty-key", "kind": "block", "pattern": "PuTTY-User-Key-File-[0-9][\\s\\S]*?(?:Private-MAC:[^\\n]*|$)", "flags": "", "replacement": "PuTTY-User-Key-File-***" },
+    { "name": "aws-access-key", "kind": "token", "pattern": "(?<![A-Za-z0-9])AKIA[0-9A-Z]{16}", "flags": "" },
+    { "name": "aws-session-key", "kind": "token", "pattern": "(?<![A-Za-z0-9])ASIA[0-9A-Z]{16}", "flags": "" },
+    { "name": "github-token", "kind": "token", "pattern": "(?<![A-Za-z0-9])gh[pousr]_[A-Za-z0-9_]{20,}", "flags": "" },
+    { "name": "github-pat", "kind": "token", "pattern": "(?<![A-Za-z0-9])github_pat_[A-Za-z0-9_]{20,}", "flags": "" },
+    { "name": "gitlab-pat", "kind": "token", "pattern": "(?<![A-Za-z0-9])glpat-[A-Za-z0-9_-]{18,}", "flags": "" },
+    { "name": "anthropic-key", "kind": "token", "pattern": "(?<![A-Za-z0-9])sk-ant-[A-Za-z0-9_-]{20,}", "flags": "" },
+    { "name": "openai-project-key", "kind": "token", "pattern": "(?<![A-Za-z0-9])sk-proj-[A-Za-z0-9_-]{20,}", "flags": "" },
+    { "name": "openai-key", "kind": "token", "pattern": "(?<![A-Za-z0-9])sk-[A-Za-z0-9_-]{20,}", "flags": "" },
+    { "name": "slack-token", "kind": "token", "pattern": "(?<![A-Za-z0-9])xox[baprs]-[A-Za-z0-9-]{10,}", "flags": "" },
+    { "name": "google-api-key", "kind": "token", "pattern": "(?<![A-Za-z0-9])AIza[0-9A-Za-z_-]{35}", "flags": "" },
+    { "name": "google-oauth-token", "kind": "token", "pattern": "(?<![A-Za-z0-9])ya29\\.[0-9A-Za-z_-]{20,}", "flags": "" },
+    { "name": "huggingface-token", "kind": "token", "pattern": "(?<![A-Za-z0-9])hf_[A-Za-z0-9]{20,}", "flags": "" },
+    { "name": "npm-token", "kind": "token", "pattern": "(?<![A-Za-z0-9])npm_[A-Za-z0-9]{30,}", "flags": "" },
+    { "name": "stripe-live-key", "kind": "token", "pattern": "(?<![A-Za-z0-9])(?:sk|pk|rk)_live_[A-Za-z0-9]{20,}", "flags": "" },
+    { "name": "digitalocean-token", "kind": "token", "pattern": "(?<![A-Za-z0-9])dop_v1_[A-Za-z0-9]{32,}", "flags": "" },
+    { "name": "shopify-token", "kind": "token", "pattern": "(?<![A-Za-z0-9])shpat_[A-Za-z0-9]{32,}", "flags": "" },
+    { "name": "medicine-wheel-token", "kind": "token", "pattern": "(?<![A-Za-z0-9])mwt_[A-Za-z0-9_-]{32,}", "flags": "" },
+    { "name": "miadi-reader-token", "kind": "token", "pattern": "(?<![A-Za-z0-9])mr_[A-Za-z0-9]{32,}", "flags": "" },
+    { "name": "jwt", "kind": "token", "pattern": "(?<![A-Za-z0-9])eyJ[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}", "flags": "" },
+    { "name": "bearer", "kind": "labelled", "pattern": "(\\bBearer\\s+)([A-Za-z0-9._~+/=-]{12,})", "flags": "i" },
+    { "name": "secret-assignment", "kind": "labelled", "pattern": "(\\b[A-Za-z0-9_.-]*(?:api[_-]?key|secret|token|passwd|password|client[_-]?secret|access[_-]?key|private[_-]?key|auth[_-]?token)[A-Za-z0-9_.-]*\\b[\"'\\s]*[:=]\\s*[\"']?)([A-Za-z0-9][A-Za-z0-9/_+.=~:-]{7,})", "flags": "i" }
+  ]
+}