@moda-ai/cli 1.22.1 → 1.23.0

package/dist/prompts.js

@@ -1,418 +0,0 @@
-import { execFileSync } from 'node:child_process';
-import { createHash } from 'node:crypto';
-import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, writeFileSync, } from 'node:fs';
-import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
-import { callControlAPI } from './api-client.js';
-import { createCommandContext } from './command-context.js';
-import { runPromptAb } from './prompts-ab.js';
-import { runPromptPropose } from './prompts-propose.js';
-const MODA_DIR = '.moda';
-const MANIFEST_PATH = join(MODA_DIR, 'prompts.yml');
-const LOCK_PATH = join(MODA_DIR, 'prompts.lock.json');
-const DEFAULT_PROMPT_PATHS = [
-    'prompts/**/*.prompt.md',
-    'prompts/**/*.prompt.json',
-    'prompts/**/*.prompt.yaml',
-    'prompts/**/*.prompt.yml',
-];
-export async function runPromptsCommand(input, legacyFlags, legacyProfileOptions) {
-    const context = Array.isArray(input)
-        ? createCommandContext({
-            command: 'prompts',
-            positional: input[0],
-            positionals: input,
-            flags: legacyFlags ?? {},
-        }, {
-            commandFlags: legacyFlags ?? {},
-            outputMode: legacyFlags?.agent === 'true' ? 'agent' : legacyFlags?.json === 'true' ? 'json' : 'human',
-            env: legacyProfileOptions?.env,
-        })
-        : input;
-    const positionals = context.positionals;
-    const flags = context.flags;
-    const profileOptions = legacyProfileOptions ?? { profile: context.profile, env: context.env };
-    const subcommand = positionals[0] || 'status';
-    switch (subcommand) {
-        case 'init':
-            await initPrompts({ silent: true });
-            context.output.writeData({
-                manifest: MANIFEST_PATH,
-                lockfile: LOCK_PATH,
-                promptPaths: readManifest().promptPaths,
-            });
-            break;
-        case 'status':
-            context.output.writeData(await getPromptStatus());
-            break;
-        case 'diff':
-            context.output.writeData(await getPromptStatus());
-            break;
-        case 'sync':
-            await syncPrompts(flags, profileOptions, context);
-            break;
-        case 'promote':
-            await promotePrompt(positionals, flags, profileOptions, context);
-            break;
-        case 'ab':
-            await runPromptAb(flags, profileOptions, context);
-            break;
-        case 'propose':
-            await runPromptPropose(positionals, flags, profileOptions, context);
-            break;
-        default:
-            throw new Error(`Unknown prompts command '${subcommand}'. Use init, status, diff, sync, promote, ab, or propose.`);
-    }
-}
-export async function initPrompts(options = {}) {
-    mkdirSync(MODA_DIR, { recursive: true });
-    if (!existsSync(MANIFEST_PATH)) {
-        writeFileSync(MANIFEST_PATH, [
-            'version: 1',
-            'prompt_paths:',
-            ...DEFAULT_PROMPT_PATHS.map((path) => `  - "${path}"`),
-            '',
-        ].join('\n'));
-    }
-    if (!options.silent) {
-        printJson({
-            manifest: MANIFEST_PATH,
-            lockfile: LOCK_PATH,
-            promptPaths: readManifest().promptPaths,
-        });
-    }
-}
-async function syncPrompts(flags, profileOptions, context) {
-    if (flags.watch === 'true') {
-        await watchPromptSync(flags, profileOptions);
-        return;
-    }
-    await syncPromptsOnce(flags, profileOptions, context);
-}
-/**
- * Sync the manifest's prompt files to the backend and update the lockfile.
- * Returns the synced list without printing, so callers (e.g. `moda init`)
- * control their own output. `moda prompts sync` wraps this with JSON output.
- */
-export async function runPromptSync(flags, profileOptions) {
-    await initPrompts({ silent: true });
-    const prompts = discoverPrompts();
-    const sourceCommit = getGitCommit();
-    const manifestHash = hashFile(MANIFEST_PATH);
-    const dryRun = flags['dry-run'] === 'true';
-    const response = await callControlAPI('/prompts/sync', {
-        method: 'POST',
-        body: JSON.stringify({
-            prompts: prompts.map((prompt) => ({
-                ...prompt,
-                sourceCommit,
-                manifestHash,
-            })),
-            sourceCommit,
-            manifestHash,
-            dryRun,
-        }),
-    }, profileOptions);
-    if (!dryRun) {
-        writeLock(prompts, response.synced ?? []);
-    }
-    return { synced: response.synced ?? [], dryRun };
-}
-async function syncPromptsOnce(flags, profileOptions, context) {
-    const result = await runPromptSync(flags, profileOptions);
-    const payload = {
-        synced: result.synced,
-        lockfile: result.dryRun ? undefined : LOCK_PATH,
-    };
-    if (context)
-        context.output.writeData(payload);
-    else
-        printJson(payload);
-}
-async function watchPromptSync(flags, profileOptions) {
-    console.error('Watching prompt files. Press Ctrl+C to stop.');
-    let lastSignature = '';
-    const intervalMs = Math.max(1000, Number(flags.interval ?? 2500));
-    while (true) {
-        const status = await getPromptStatus();
-        const signature = stableJson(status.prompts);
-        if (signature !== lastSignature) {
-            lastSignature = signature;
-            if (status.changed > 0 || status.new > 0 || status.deleted > 0) {
-                await syncPromptsOnce({ ...flags, watch: 'false' }, profileOptions);
-            }
-        }
-        await new Promise((resolve) => setTimeout(resolve, intervalMs));
-    }
-}
-async function promotePrompt(positionals, flags, profileOptions, context) {
-    const key = positionals[1];
-    const label = flags.label;
-    const versionId = flags.version || flags['version-id'];
-    if (!key)
-        throw new Error('Usage: moda prompts promote <prompt_key> --label=prod --version=<version_id>');
-    if (!label)
-        throw new Error('Missing required flag: --label=dev|staging|prod');
-    if (!versionId)
-        throw new Error('Missing required flag: --version=<version_id>');
-    const response = await callControlAPI(`/prompts/${encodeURIComponent(key)}/labels`, {
-        method: 'POST',
-        body: JSON.stringify({ label, versionId }),
-    }, profileOptions);
-    context.output.writeData(response);
-}
-async function getPromptStatus() {
-    await initPrompts({ silent: true });
-    const prompts = discoverPrompts();
-    const lock = readLock();
-    const rows = prompts.map((prompt) => {
-        const locked = lock?.prompts[prompt.key];
-        const state = !locked
-            ? 'new'
-            : locked.contentHash === prompt.contentHash
-                ? 'unchanged'
-                : 'changed';
-        return {
-            key: prompt.key,
-            sourcePath: prompt.sourcePath,
-            contentHash: prompt.contentHash,
-            lockedHash: locked?.contentHash ?? null,
-            versionId: locked?.versionId ?? null,
-            state,
-        };
-    });
-    const discoveredKeys = new Set(prompts.map((prompt) => prompt.key));
-    for (const [key, locked] of Object.entries(lock?.prompts ?? {})) {
-        if (!discoveredKeys.has(key)) {
-            rows.push({
-                key,
-                sourcePath: locked.sourcePath,
-                contentHash: null,
-                lockedHash: locked.contentHash,
-                versionId: locked.versionId ?? null,
-                state: 'deleted',
-            });
-        }
-    }
-    return {
-        manifest: MANIFEST_PATH,
-        lockfile: LOCK_PATH,
-        total: rows.length,
-        changed: rows.filter((row) => row.state === 'changed').length,
-        new: rows.filter((row) => row.state === 'new').length,
-        deleted: rows.filter((row) => row.state === 'deleted').length,
-        prompts: rows,
-    };
-}
-export function discoverPrompts() {
-    const manifest = readManifest();
-    // A pattern like `src/prompts/**/*.prompt.md` should *only* match files under
-    // src/prompts. Extract both the base directory (everything up to the first
-    // glob segment) and the file suffix so we can scope `walk()` accordingly.
-    const rules = manifest.promptPaths
-        .map((pattern) => {
-        const suffixMatch = pattern.match(/\.prompt\.(md|json|ya?ml)$/i);
-        if (!suffixMatch)
-            return null;
-        const suffix = `.prompt.${suffixMatch[1]}`;
-        const globIndex = pattern.search(/[*?[]/);
-        const baseRaw = globIndex === -1 ? dirname(pattern) : pattern.slice(0, globIndex);
-        const base = baseRaw.replace(/[\\/]+$/, '') || '.';
-        const baseAbs = isAbsolute(base) ? base : resolve(process.cwd(), base);
-        return { baseAbs, suffix };
-    })
-        .filter((rule) => Boolean(rule));
-    const effectiveRules = rules.length
-        ? rules
-        : [
-            { baseAbs: process.cwd(), suffix: '.prompt.md' },
-            { baseAbs: process.cwd(), suffix: '.prompt.json' },
-        ];
-    const discovered = new Set();
-    for (const { baseAbs, suffix } of effectiveRules) {
-        if (!existsSync(baseAbs))
-            continue;
-        for (const file of walk(baseAbs)) {
-            if (file.endsWith(suffix))
-                discovered.add(file);
-        }
-    }
-    return [...discovered].sort().map(parsePromptFile);
-}
-function parsePromptFile(absPath) {
-    const sourcePath = relative(process.cwd(), absPath);
-    const raw = readFileSync(absPath, 'utf8');
-    if (absPath.endsWith('.json')) {
-        const parsed = JSON.parse(raw);
-        const key = parsed.key || keyFromPath(sourcePath);
-        const content = parsed.content || JSON.stringify(parsed.messages ?? [], null, 2);
-        return normalizePrompt({ ...parsed, key, name: parsed.name || key, sourcePath, content });
-    }
-    const { frontmatter, body } = parseFrontmatter(raw);
-    const key = frontmatter.key || keyFromPath(sourcePath);
-    return normalizePrompt({
-        key,
-        name: frontmatter.name || key,
-        description: frontmatter.description,
-        category: frontmatter.category,
-        systemPrompt: frontmatter.system_prompt || frontmatter.systemPrompt,
-        modelConfig: frontmatter.model ? { model: frontmatter.model } : undefined,
-        sourcePath,
-        content: body.trim(),
-    });
-}
-function normalizePrompt(prompt) {
-    const normalized = stableJson({
-        key: prompt.key,
-        content: prompt.content,
-        systemPrompt: prompt.systemPrompt ?? null,
-        messages: prompt.messages ?? [],
-        variables: prompt.variables ?? [],
-        variablesSchema: prompt.variablesSchema ?? {},
-        modelConfig: prompt.modelConfig ?? {},
-        toolRefs: prompt.toolRefs ?? [],
-        responseSchema: prompt.responseSchema ?? null,
-    });
-    return {
-        key: prompt.key,
-        name: prompt.name || prompt.key,
-        description: prompt.description,
-        sourcePath: prompt.sourcePath,
-        content: prompt.content,
-        systemPrompt: prompt.systemPrompt,
-        messages: prompt.messages,
-        variables: prompt.variables,
-        variablesSchema: prompt.variablesSchema,
-        modelConfig: prompt.modelConfig,
-        toolRefs: prompt.toolRefs,
-        responseSchema: prompt.responseSchema,
-        contentHash: sha256(normalized),
-    };
-}
-function readManifest() {
-    if (!existsSync(MANIFEST_PATH)) {
-        return { promptPaths: DEFAULT_PROMPT_PATHS };
-    }
-    const text = readFileSync(MANIFEST_PATH, 'utf8');
-    const promptPaths = [...text.matchAll(/^\s*-\s*["']?([^"'\n]+)["']?\s*$/gm)]
-        .map((match) => match[1])
-        .filter((path) => path.includes('.prompt.'));
-    return { promptPaths: promptPaths.length ? promptPaths : DEFAULT_PROMPT_PATHS };
-}
-export function readPromptLock() {
-    return readLock();
-}
-/** Parse a prompt file for A/B runs (body text + registry key). */
-export function parsePromptFileForAb(absPath) {
-    const parsed = parsePromptFile(absPath);
-    return { key: parsed.key, content: parsed.content };
-}
-function readLock() {
-    if (!existsSync(LOCK_PATH))
-        return null;
-    return JSON.parse(readFileSync(LOCK_PATH, 'utf8'));
-}
-function writeLock(prompts, synced) {
-    const syncedByKey = new Map(synced.map((item) => [item.key, item]));
-    const lock = {
-        version: 1,
-        generatedAt: new Date().toISOString(),
-        prompts: Object.fromEntries(prompts.map((prompt) => {
-            const result = syncedByKey.get(prompt.key);
-            return [prompt.key, {
-                    key: prompt.key,
-                    sourcePath: prompt.sourcePath,
-                    contentHash: prompt.contentHash,
-                    promptId: result?.promptId,
-                    versionId: result?.versionId,
-                }];
-        })),
-    };
-    mkdirSync(dirname(LOCK_PATH), { recursive: true });
-    writeFileSync(LOCK_PATH, `${JSON.stringify(lock, null, 2)}\n`);
-}
-function walk(dir) {
-    let entries;
-    try {
-        entries = readdirSync(dir);
-    }
-    catch {
-        return [];
-    }
-    const files = [];
-    for (const entry of entries) {
-        if (entry === 'node_modules' || entry === '.git' || entry === 'dist' || entry === 'build')
-            continue;
-        const fullPath = join(dir, entry);
-        // lstatSync — never follow symlinks. A symlink in the tree could otherwise
-        // (a) loop into an ancestor and recurse forever, or (b) silently point at a
-        // sensitive file like .env that would then get uploaded as prompt content.
-        let stat;
-        try {
-            stat = lstatSync(fullPath);
-        }
-        catch {
-            continue;
-        }
-        if (stat.isSymbolicLink())
-            continue;
-        if (stat.isDirectory())
-            files.push(...walk(fullPath));
-        else if (stat.isFile())
-            files.push(fullPath);
-    }
-    return files;
-}
-function parseFrontmatter(raw) {
-    if (!raw.startsWith('---'))
-        return { frontmatter: {}, body: raw };
-    const end = raw.indexOf('\n---', 3);
-    if (end === -1)
-        return { frontmatter: {}, body: raw };
-    const frontmatterText = raw.slice(3, end).trim();
-    const frontmatter = Object.fromEntries(frontmatterText
-        .split('\n')
-        .map((line) => line.match(/^([A-Za-z0-9_-]+):\s*(.*)$/))
-        .filter((match) => Boolean(match))
-        .map((match) => [match[1], match[2].replace(/^["']|["']$/g, '')]));
-    return { frontmatter, body: raw.slice(end + 4) };
-}
-function keyFromPath(path) {
-    return path
-        .replace(/^prompts\//, '')
-        .replace(/\.prompt\.(md|json|ya?ml)$/i, '')
-        .replace(/[\\/]/g, '.');
-}
-function hashFile(path) {
-    return existsSync(path) ? sha256(readFileSync(path, 'utf8')) : '';
-}
-function getGitCommit() {
-    try {
-        return execFileSync('git', ['rev-parse', 'HEAD'], {
-            encoding: 'utf8',
-            stdio: ['ignore', 'pipe', 'ignore'],
-        }).trim();
-    }
-    catch {
-        return undefined;
-    }
-}
-function stableJson(value) {
-    return JSON.stringify(sortJson(value));
-}
-function sortJson(value) {
-    if (Array.isArray(value))
-        return value.map(sortJson);
-    if (value && typeof value === 'object') {
-        return Object.fromEntries(Object.entries(value)
-            .sort(([a], [b]) => a.localeCompare(b))
-            .map(([key, item]) => [key, sortJson(item)]));
-    }
-    return value;
-}
-function sha256(input) {
-    return createHash('sha256').update(input).digest('hex');
-}
-function printJson(value) {
-    console.log(JSON.stringify(value, null, 2));
-}
-//# sourceMappingURL=prompts.js.map

package/dist/provision.d.ts

@@ -1,28 +0,0 @@
-import { type CommandContext } from './command-context.js';
-export interface ProvisionRunOptions {
-    /**
-     * Original invocation as an argv array (e.g. ['moda', 'provision',
-     * '--save']), threaded into recoverable failures so the caller knows
-     * exactly how to resume after logging in.
-     */
-    resumeCommand?: string[];
-}
-export interface ProvisionResult {
-    exitCode: number;
-    apiKey?: string;
-}
-/**
- * The credentials document printed to stdout. Field names are a public
- * contract (`moda provision | jq -r .apiKey`); do not rename.
- */
-export interface ProvisionPayload {
-    apiKey: string;
-    tenantId: string;
-    tenantName: string;
-    tenantSlug: string;
-    ingestUrl: string;
-    baseUrl: string;
-    reused: boolean;
-}
-export declare function runProvision(context: CommandContext, options?: ProvisionRunOptions): Promise<ProvisionResult>;
-//# sourceMappingURL=provision.d.ts.map

package/dist/provision.js

@@ -1,104 +0,0 @@
-// src/provision.ts — moda provision: headless tenant + API key provisioning
-// for CI jobs and agents. Requires an existing CLI session (moda auth login
-// run previously); browserless signup is explicitly out of scope (decision
-// D3), so a missing session fails fast with CliAuthError instead of opening
-// a browser.
-import { loadAuthSession } from './auth.js';
-import { stringOption } from './command-context.js';
-import { resolveIngestUrl, resolveModaBaseUrl } from './config.js';
-import { CliAuthError } from './errors.js';
-import { selectTenantAndCreateKey } from './init/tenant.js';
-export async function runProvision(context, options = {}) {
-    const resumeCommand = options.resumeCommand ?? ['moda', 'provision'];
-    // Pre-coercion raw values (like init's tenantIdFlag/profileFlag): the
-    // dispatcher's flagsToArgs number-coerces numeric-looking values, which
-    // must never happen to tenant ids, profile names, or labels.
-    const profileFlag = stringOption(context.rawFlags.profile);
-    const authOptions = { profile: profileFlag, env: context.env };
-    // Provision never opens a browser (headless by contract), so the session
-    // check happens up front: no stored session is a recoverable exit-4
-    // failure with explicit instructions, not a login prompt.
-    const session = loadAuthSession(authOptions);
-    if (!session) {
-        const expiredSession = loadAuthSession({ ...authOptions, includeExpired: true });
-        throw new CliAuthError('moda provision requires an existing CLI session and never opens a browser. ' +
-            'Run "moda auth login" on a machine with a browser first, then re-run provision here ' +
-            '(or skip provisioning and set MODA_API_KEY directly).', {
-            reason: expiredSession ? 'token_expired' : 'no_stored_credentials',
-            login_command: ['moda', 'auth', 'login'],
-            resume_command: resumeCommand,
-        });
-    }
-    const flagTenantId = stringOption(context.rawFlags['tenant-id'] ?? context.rawFlags.tenant_id);
-    const envTenantId = stringOption(context.env.MODA_TENANT_ID);
-    const label = stringOption(context.rawFlags.label);
-    const save = context.flags.save === 'true';
-    // Reuses init's dedup + bootstrap machinery (stored-key liveness probe,
-    // Idempotency-Key persistence, label, cap/viewer errors). Multi-tenant
-    // accounts without --tenant-id/MODA_TENANT_ID throw CliInputRequiredError
-    // (exit 5) with per-tenant resume flags — even on a TTY, provision is
-    // headless by contract and never prompts.
-    let result;
-    try {
-        result = await selectTenantAndCreateKey({
-            tenantId: flagTenantId ?? envTenantId,
-            tenantIdSource: flagTenantId !== undefined ? 'flag' : envTenantId !== undefined ? 'env' : undefined,
-            // Unconditional (init derives this from flags/TTY): provision is
-            // headless by contract even on an interactive terminal.
-            nonInteractive: true,
-            // stdout must stay exactly one JSON credentials document; all provision
-            // prose goes to stderr, so suppress the tenant-selection prose entirely.
-            silent: true,
-            // Multi-tenant runs surface CliInputRequiredError (exit 5); echo this
-            // invocation's resume command so the caller knows how to continue.
-            resumeCommand,
-            label,
-            // Headless callers own their credential storage; --save opts into the
-            // init-style ~/.moda/config.json persistence.
-            persistConfig: save,
-            profile: profileFlag,
-            env: context.env,
-        });
-    }
-    catch (error) {
-        // A mid-flight 401 classified by authFetch (token_expired /
-        // token_revoked / renew_failed during the context or bootstrap call)
-        // throws a CliAuthError that carries only the login command. Re-throw
-        // with this invocation's resume command attached so the caller knows how
-        // to continue after recovering, matching the upfront session gate above.
-        if (error instanceof CliAuthError && !error.auth.resume_command) {
-            throw new CliAuthError(error.message, {
-                reason: error.auth.reason,
-                login_command: error.auth.login_command,
-                resume_command: resumeCommand,
-            });
-        }
-        throw error;
-    }
-    const payload = {
-        apiKey: result.apiKey,
-        tenantId: result.tenantId,
-        tenantName: result.tenantName,
-        tenantSlug: result.tenantSlug,
-        ingestUrl: resolveIngestUrl(authOptions),
-        baseUrl: resolveModaBaseUrl(authOptions),
-        reused: result.reused,
-    };
-    // Security note on stderr, never stdout: stdout carries a live credential
-    // and must stay exactly one parseable JSON document.
-    console.error('Output contains a live API key. Avoid piping to logs.');
-    if (save) {
-        console.error('Saved API key + tenant to ~/.moda/config.json (--save).');
-    }
-    // `moda provision` exists to be composed: `KEY=$(moda provision | jq -r
-    // .apiKey)`. Command substitution IS a pipe, so stdout is a non-TTY and
-    // the CLI would auto-select agent mode and wrap the payload in a
-    // moda.agent.v1 envelope, burying apiKey under `.data`. Like `moda auth
-    // token`, this command therefore deliberately bypasses the CliOutput
-    // envelope machinery in EVERY output mode (human/json/agent) and writes
-    // exactly one JSON document to stdout — nothing else. Human TTY runs get
-    // the same machine-parseable JSON: credentials output is the whole point.
-    process.stdout.write(`${JSON.stringify(payload, null, 2)}\n`);
-    return { exitCode: 0, apiKey: result.apiKey };
-}
-//# sourceMappingURL=provision.js.map

package/dist/redact.d.ts

@@ -1,2 +0,0 @@
-export declare function redactDeep<T>(value: T): T;
-//# sourceMappingURL=redact.d.ts.map

package/dist/redact.js

@@ -1,90 +0,0 @@
-const REDACTED = '[REDACTED]';
-// Pure stack-safety bound. Cycles are handled separately by the `seen` WeakSet,
-// so this only needs to be high enough that legitimate nested payloads (the
-// agent-envelope wrapper plus arbitrary customer tool-call JSON) are never
-// silently truncated to '[MaxDepth]'. 256 is far below any real recursion limit.
-const MAX_DEPTH = 256;
-const SECRET_KEYS = new Set([
-    'api_key',
-    'apikey',
-    'token',
-    'access_token',
-    'authorization',
-    'secret',
-    'password',
-    'cli_token',
-]);
-const SECRET_PATTERNS = [
-    { pattern: /\bmoda_sk_[A-Za-z0-9_-]+\b/g, prefixLength: 8 },
-    { pattern: /\bmoda_ct_[A-Za-z0-9_-]+\b/g, prefixLength: 8 },
-    { pattern: /\bBearer\s+([A-Za-z0-9._~+/-]+=*)\b/gi, prefixLength: 8 },
-    { pattern: /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g, prefixLength: 8 },
-    // Third-party provider credentials that can appear inline in scanned source
-    // (e.g. harness-candidate excerpts) — the detectors deliberately fire on the
-    // very lines most likely to carry hardcoded keys.
-    { pattern: /\bsk-ant-api\d{2}-[A-Za-z0-9_-]{20,}\b/g, prefixLength: 12 }, // Anthropic
-    { pattern: /\bsk-(?:proj-|svcacct-)?[A-Za-z0-9_-]{20,}\b/g, prefixLength: 8 }, // OpenAI
-    { pattern: /\bAKIA[A-Z0-9]{16}\b/g, prefixLength: 8 }, // AWS access key id
-    { pattern: /\bAIza[A-Za-z0-9_-]{35}\b/g, prefixLength: 8 }, // Google API key
-    { pattern: /\bgh[pousr]_[A-Za-z0-9]{36,}\b/g, prefixLength: 8 }, // GitHub token
-    { pattern: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, prefixLength: 8 }, // Slack token
-];
-export function redactDeep(value) {
-    return redactValue(value, 0, new WeakSet());
-}
-function redactValue(value, depth, seen) {
-    if (typeof value === 'string')
-        return redactString(value);
-    if (value === null || typeof value !== 'object')
-        return value;
-    if (depth >= MAX_DEPTH)
-        return '[MaxDepth]';
-    if (seen.has(value))
-        return '[Circular]';
-    seen.add(value);
-    if (Array.isArray(value)) {
-        try {
-            return value.map((item) => redactValue(item, depth + 1, seen));
-        }
-        finally {
-            seen.delete(value);
-        }
-    }
-    const out = {};
-    try {
-        for (const [key, item] of Object.entries(value)) {
-            out[key] = shouldRedactKey(key) ? redactSecretValue(item) : redactValue(item, depth + 1, seen);
-        }
-    }
-    finally {
-        seen.delete(value);
-    }
-    return out;
-}
-function shouldRedactKey(key) {
-    return SECRET_KEYS.has(key.replace(/[-\s]/g, '_').toLowerCase());
-}
-function redactSecretValue(value) {
-    if (typeof value !== 'string')
-        return REDACTED;
-    const redacted = redactString(value);
-    if (redacted !== value)
-        return redacted;
-    if (/^(configured|missing|not_configured|none|present|absent)$/i.test(value))
-        return value;
-    return REDACTED;
-}
-function redactString(input) {
-    let output = input;
-    for (const { pattern, prefixLength } of SECRET_PATTERNS) {
-        output = output.replace(pattern, (match) => {
-            if (/^Bearer\s+/i.test(match)) {
-                const token = match.replace(/^Bearer\s+/i, '');
-                return `Bearer ${token.slice(0, prefixLength)}...[REDACTED]`;
-            }
-            return `${match.slice(0, prefixLength)}...[REDACTED]`;
-        });
-    }
-    return output;
-}
-//# sourceMappingURL=redact.js.map