@omniaura/solid-pulse 0.1.0

package/README.md

@@ -0,0 +1,128 @@
+# @omniaura/solid-pulse
+
+> Flash what actually updates in a SolidJS app — and give agents the same controls as humans.
+
+`solid-pulse` is dev-only instrumentation for Solid. It watches the reactive graph through Solid's official dev hooks, the DOM through a `MutationObserver`, and the network through `fetch`/`WebSocket`/`EventSource`, and turns what it sees into precisely named events:
+
+| Event | Meaning |
+| --- | --- |
+| `solid.flush` | a reactive update completed: *n* computations re-ran, by kind (`memo`/`computed`/`effect`/`render`) and by owning component |
+| `solid.computation` | one computation re-ran (only with `verboseComputations`) |
+| `solid.component.mount` / `.dispose` / `.remount` | a component function ran / its owner was disposed / the same-named child was disposed and recreated within a flush (`gapMs`) |
+| `solid.root` | a reactive root was created (multiple roots are counted, not conflated) |
+| `dom.mutation` | the DOM actually changed (targets, attribute names, added/removed counts, attribution to the flush's component) |
+| `dom.detach` | a subtree left the document, recording the `scrollTop` of every recently-scrolled descendant and whether focus was inside |
+| `dom.reattach` | the **same node instance** came back: `gapMs`, `scrollReset: before→after`, `focusLost`, `suspenseInChain`, a stable `selector` |
+| `focus.lost` | the focused element vanished from the document |
+| `net.fetch.start/end/error` | fetch lifecycle; SSE responses detected by content-type and counted frame by frame; aborts flagged |
+| `net.ws.open/message/close/error` | WebSocket lifecycle with subprotocols, direction, counts, `type` field of JSON frames, close codes |
+| `net.sse.*` | `EventSource` lifecycle (and fetch-based SSE) |
+| `query.observe` | a Solid Query observer subscribed — `role: "initiating"` (first observer, its mount causes the fetch) or `"sharing"` (query already had observers) — attributed to the Solid component |
+| `query.fetch.start/success/error` | with `trigger: observer-mount \| invalidation \| background-refetch \| initial` |
+| `query.invalidate`, `query.update`, `query.unobserve`, `query.added/removed`, `mutation.*` | the rest of the cache lifecycle |
+
+There is deliberately **no "rerender" event**: Solid never re-runs component bodies. If one ever did, you would see a `pulse.note` saying so.
+
+## Install
+
+```bash
+bun add -d @omniaura/solid-pulse
+```
+
+```ts
+// vite.config.ts — dev server only (`apply: "serve"`), production builds never include it
+import solidPulse from "@omniaura/solid-pulse/vite";
+export default defineConfig({ plugins: [solidPulse(), solid()] });
+```
+
+The plugin injects the runtime as the first module script (so Solid's dev hooks are installed before your first render), mounts the raw-DOM panel, mounts the bridge on the Vite dev server at `/__pulse`, and writes `node_modules/.vite/solid-pulse.json` so the CLI finds it.
+
+Manual setup (no Vite, or custom options):
+
+```ts
+import { initPulse } from "@omniaura/solid-pulse";
+import { mountPanel } from "@omniaura/solid-pulse/panel";
+if (import.meta.env.DEV) {
+  const pulse = initPulse({ bridge: "ws://localhost:4567/__pulse/ws" }); // or bridge: true for same-origin
+  mountPanel(pulse);
+}
+```
+
+### Solid Query adapter (optional)
+
+```ts
+import { attachQueryClient } from "@omniaura/solid-pulse/query";
+attachQueryClient(pulse, queryClient);
+```
+
+Read-only: it subscribes to the `QueryCache`/`MutationCache` and never changes query behaviour. With the Vite plugin, point `setupModule: "/src/pulse-setup.ts"` at a module that `export default (pulse) => { attachQueryClient(pulse, queryClient) }` — it is evaluated before your app's entry module, so the very first observers are attributed.
+
+### Overlay
+
+A single `position: fixed; pointer-events: none` container draws flash rectangles (amber = DOM change, green = mount, red = reattach, blue = query, purple = highlight) and a transient badge centred on the component that initiates/observes a query, showing the redacted query key. No layout shift, no focus, capped at 48 live rectangles and 4 badges; respects `prefers-reduced-motion`.
+
+## Human ⇄ agent parity
+
+Every panel control carries `data-command="<name>"` and calls `controller.run(name, args)`; the CLI and HTTP API call the same function. `solid-pulse commands` prints the contract — including where the human control lives — and the test suite asserts the two sets match.
+
+```bash
+solid-pulse status                          # bridge + connected pages
+solid-pulse commands                        # the contract
+solid-pulse events kinds=dom,query limit=50 # buffered events through the active filters
+solid-pulse tail kinds=dom.reattach,focus.lost   # live (SSE)
+solid-pulse features.set name=flash on=false
+solid-pulse features.set name=verboseComputations on=true
+solid-pulse filters.set kinds=query component=ChatFeed
+solid-pulse inspect.components name=Chat
+solid-pulse inspect.queries active=true
+solid-pulse inspect.element selector='[data-testid=composer]'   # source + component context (solid-grab aware)
+solid-pulse dom.highlight selector='.scroll-view' all=true      # show a human what the agent is looking at
+solid-pulse record.start id=qa-1 · record.stop · export recording=qa-1 --json > qa-1.json
+solid-pulse note text='step 3: switch thread'
+solid-pulse panel.open tab=query · panel.close
+solid-pulse query.invalidate key='["conversations"]'
+solid-pulse scenario.select name=chat-stream-drop               # when @omniaura/scenario-sim is attached
+```
+
+Options: `--url http://host:port[/__pulse]` (or `SOLID_PULSE_URL`; auto-discovered from `node_modules/.vite/solid-pulse.json`), `--client <id>` when several tabs are connected, `--json`.
+
+In-page: `window.__SOLID_PULSE__.run("events.list", { kinds: "dom" })` — handy from `agent-browser eval` or Playwright `page.evaluate`.
+
+### HTTP API (what the CLI uses)
+
+```
+GET  /__pulse/api/status
+GET  /__pulse/api/clients
+GET  /__pulse/api/commands?client=
+POST /__pulse/api/command   {client?, name, args}
+GET  /__pulse/api/command?name=&args=<json>&client=
+GET  /__pulse/api/events?client=&since=&kinds=&limit=
+GET  /__pulse/api/events/stream?client=&kinds=          (text/event-stream)
+```
+
+## Security and overhead
+
+- **Dev only.** The Vite plugin is `apply: "serve"`; the runtime refuses to initialise twice; nothing is imported in production builds (`bun run smoke` proves it against the example app).
+- **Loopback only.** The bridge checks both the peer address and the `Host` header; `allowRemote: true` is an explicit opt-in.
+- **Redaction.** URLs lose `token|key|secret|auth|session|ticket|password|signature|code` params, JWT and bearer tokens are scrubbed, headers are never captured, bodies only with the `captureBodies` feature (truncated).
+- **Bounded.** Ring buffer (2000 events), per-flush aggregation (individual computations only in verbose mode), per-frame flash caps, per-stream message caps (first 200 then every 50th), recordings capped and limited to the last five.
+- **Non-interfering.** The overlay and panel are raw DOM (no Solid), so they never appear in their own event stream, never take focus, and never shift layout. Query instrumentation is a cache subscription — no query behaviour changes.
+- **Hooks, not guesses.** Solid instrumentation uses `DEV.hooks.afterCreateOwner`/`afterUpdate` from Solid's development build and chains any hook already installed (e.g. `solid-devtools`); in a production Solid build it becomes a no-op and says so.
+
+## Reading a Suspense flip
+
+The bug class this was built for: a tracked `query.data` read under `<Suspense>` flips the boundary to its fallback and back within a couple of milliseconds, detaching the live surface — `scrollTop` resets to 0 and focus drops to `<body>` with no component cleanup. It reads as:
+
+```
+dom.detach    <ChatFeed> section[data-testid=chat] scrollers=1 had focus
+dom.reattach  <ChatFeed> section[data-testid=chat] gap=2.1ms SCROLL RESET 1834→0 FOCUS LOST (Suspense in chain)
+focus.lost    textarea — element removed from document
+```
+
+`solid-pulse tail kinds=dom.reattach,focus.lost` while a scroll harness runs turns days of frame-by-frame probing into a one-line alarm.
+
+## solid-grab
+
+If [`solid-grab`](https://github.com/omniaura/solid-grab) is installed, `inspect.element` returns its formatted source context (file:line:column and component chain) in addition to pulse's own attribution, and the panel's Grab tab explains Alt+click. solid-grab's `data-solid-component` attributes also improve the overlay's component→DOM mapping.
+
+MIT © omniaura

package/dist/bridge.d.ts

@@ -0,0 +1,202 @@
+import { Server, IncomingMessage, ServerResponse } from 'node:http';
+import { WebSocket } from 'ws';
+
+/** Fixed-capacity FIFO. Overwrites the oldest entry; never grows. */
+declare class RingBuffer<T> {
+    readonly capacity: number;
+    private items;
+    private head;
+    private count;
+    /** Total number of pushes since creation (dropped + retained). */
+    pushed: number;
+    constructor(capacity: number);
+    get size(): number;
+    get dropped(): number;
+    push(item: T): void;
+    /** Oldest → newest. */
+    toArray(): T[];
+    clear(): void;
+}
+
+/**
+ * Event model. Every observation the runtime makes is one PulseEvent with a
+ * precise `kind`. Kinds are deliberately specific: Solid has no "rerender", so
+ * we never report one. What actually happens is one of:
+ *
+ *   solid.flush            a reactive flush completed (n computations re-ran)
+ *   solid.computation      one memo/effect/render-effect re-ran (verbose mode)
+ *   solid.component.mount  a component function ran (fresh mount, or hydrate)
+ *   solid.component.dispose
+ *   solid.component.remount same-named component disposed + mounted in one flush
+ *   solid.root             a reactive root was created (multiple roots are fine)
+ *   dom.mutation           the DOM actually changed (childList/attr/text)
+ *   dom.detach             a subtree left the document (with scroll/focus state)
+ *   dom.reattach           the same node instance came back (Suspense flip etc.)
+ *   focus.lost             the focused element vanished from the document
+ *   net.fetch.*            fetch lifecycle (start/end/error), SSE-aware
+ *   net.ws.*               WebSocket lifecycle (open/message/close/error)
+ *   net.sse.*              EventSource lifecycle
+ *   query.*                Solid Query cache/observer events (adapter)
+ *   mutation.*             Solid Query mutation cache events (adapter)
+ *   pulse.*                runtime lifecycle / control-plane notes
+ */
+type PulseEventKind = "solid.flush" | "solid.computation" | "solid.component.mount" | "solid.component.dispose" | "solid.component.remount" | "solid.root" | "dom.mutation" | "dom.detach" | "dom.reattach" | "focus.lost" | "net.fetch.start" | "net.fetch.end" | "net.fetch.error" | "net.ws.open" | "net.ws.message" | "net.ws.close" | "net.ws.error" | "net.sse.open" | "net.sse.message" | "net.sse.error" | "net.sse.close" | "query.added" | "query.removed" | "query.observe" | "query.unobserve" | "query.fetch.start" | "query.fetch.success" | "query.fetch.error" | "query.invalidate" | "query.update" | "mutation.start" | "mutation.success" | "mutation.error" | "pulse.note";
+interface ComponentRef {
+    id: number;
+    name: string;
+    /** Component ancestry, innermost first (names only). */
+    chain?: string[];
+    /** Source location if solid-grab's data-solid-source attribute was found. */
+    source?: string | null;
+}
+interface PulseEventBase {
+    /** Monotonic per-runtime sequence. */
+    seq: number;
+    /** performance.now() at capture. */
+    t: number;
+    /** Date.now() at capture (for cross-process correlation). */
+    wall: number;
+    kind: PulseEventKind;
+    /** Flush group the event belongs to, when attributable. */
+    flush?: number;
+    /** Component attribution, when known. */
+    component?: ComponentRef | null;
+    /** Free-form structured payload; shape depends on `kind`. */
+    data: Record<string, unknown>;
+}
+type PulseEvent = PulseEventBase;
+
+interface CommandSpec {
+    /** Dotted command name, e.g. `features.set`. Also the CLI verb. */
+    name: string;
+    summary: string;
+    /** Argument name → short description. */
+    args?: Record<string, string>;
+    /** Where the equivalent human control lives in the panel (parity doc). */
+    ui?: string;
+}
+type CommandResult = {
+    ok: true;
+    value: unknown;
+} | {
+    ok: false;
+    error: string;
+};
+
+/**
+ * Bridge protocol (JSON over WebSocket) between a page runtime and the bridge
+ * server, and the HTTP shape the server exposes to CLIs and agents.
+ *
+ * Page → server
+ *   hello      first frame; identifies the tab
+ *   events     batched PulseEvents (≤ 50 ms coalescing)
+ *   result     reply to a `command`
+ * Server → page
+ *   command    run a controller command; page answers with `result`
+ *   welcome    ack of hello with the server-assigned client id
+ */
+
+interface ClientSummary {
+    clientId: string;
+    url: string;
+    title: string;
+    userAgent: string;
+    connectedWall: number;
+    lastSeenWall: number;
+    events: number;
+    commands: number;
+}
+
+/**
+ * Bridge server (Node/Bun). Accepts page runtimes over WebSocket at
+ * `<path>/ws`, mirrors their events into a per-client ring buffer, and exposes
+ * a small HTTP API for CLIs and agents at `<path>/api/*`:
+ *
+ *   GET  /api/status                    server + connected clients
+ *   GET  /api/clients
+ *   GET  /api/commands?client=          the page's command contract
+ *   POST /api/command {client?,name,args}   run a command in the page
+ *   GET  /api/command?name=&args=<json>&client=   (curl-friendly)
+ *   GET  /api/events?client=&since=&kinds=&limit=
+ *   GET  /api/events/stream?client=&kinds=        SSE, one `pulse` event per PulseEvent
+ *
+ * Access: loopback only unless `allowRemote` is set — remote address and Host
+ * header are both checked, so a LAN dev server does not leak instrumentation.
+ */
+
+interface BridgeServerOptions {
+    /** URL prefix (default `/__pulse`). */
+    path?: string;
+    /** Accept non-loopback peers and hosts (default false). */
+    allowRemote?: boolean;
+    /** Per-client mirror buffer (default 5000 events). */
+    bufferSize?: number;
+    /** Command timeout in ms (default 10000). */
+    commandTimeoutMs?: number;
+    log?: (message: string) => void;
+}
+interface ClientState {
+    ws: WebSocket;
+    summary: ClientSummary;
+    commands: CommandSpec[];
+    buffer: RingBuffer<PulseEvent>;
+    pending: Map<string, {
+        resolve: (r: CommandResult) => void;
+        timer: ReturnType<typeof setTimeout>;
+    }>;
+}
+type EventListener = (clientId: string, events: PulseEvent[]) => void;
+declare class BridgeServer {
+    readonly path: string;
+    private clients;
+    private wss;
+    private listeners;
+    private nextCommand;
+    private startedWall;
+    private opts;
+    constructor(options?: BridgeServerOptions);
+    /** Attach the WebSocket upgrade handler to an existing http server (e.g. Vite's). */
+    attach(server: Server): void;
+    isAllowed(req: IncomingMessage): boolean;
+    /** Connect middleware: handles `<path>/api/*`; returns false when the URL is not ours. */
+    handleHttp(req: IncomingMessage, res: ServerResponse): boolean;
+    private route;
+    private noClientMessage;
+    private onConnection;
+    /** Pick a client: explicit id, else the most recently seen. */
+    pick(clientId?: string): ClientState | null;
+    listClients(): ClientSummary[];
+    status(): {
+        tool: string;
+        protocol: number;
+        path: string;
+        uptimeMs: number;
+        allowRemote: boolean;
+        clients: ClientSummary[];
+    };
+    events(clientId: string, opts?: {
+        since?: number;
+        kinds?: string[];
+        limit?: number;
+    }): PulseEvent[];
+    command(clientId: string, name: string, args?: Record<string, unknown>): Promise<CommandResult>;
+    onEvents(listener: EventListener): () => boolean;
+    close(): void;
+}
+interface StandaloneOptions extends BridgeServerOptions {
+    port?: number;
+    host?: string;
+}
+/** Run the bridge as its own process (for non-Vite setups): `solid-pulse bridge --port 4567`. */
+declare function startBridgeServer(options?: StandaloneOptions): {
+    bridge: BridgeServer;
+    server: Server<typeof IncomingMessage, typeof ServerResponse>;
+    ready: Promise<{
+        url: string;
+        port: number;
+    }>;
+    url: string;
+    close: () => Promise<void>;
+};
+
+export { BridgeServer, type BridgeServerOptions, type StandaloneOptions, startBridgeServer };

package/dist/bridge.js

@@ -0,0 +1,10 @@
+import {
+  BridgeServer,
+  startBridgeServer
+} from "./chunk-TVSI7G5S.js";
+import "./chunk-4QA2G6S3.js";
+export {
+  BridgeServer,
+  startBridgeServer
+};
+//# sourceMappingURL=bridge.js.map

package/dist/bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/chunk-4QA2G6S3.js

@@ -0,0 +1,15 @@
+// src/core/protocol.ts
+var PROTOCOL_VERSION = 1;
+var DEFAULT_PATH = "/__pulse";
+function isPageFrame(value) {
+  if (!value || typeof value !== "object") return false;
+  const t = value.type;
+  return t === "hello" || t === "events" || t === "result";
+}
+
+export {
+  PROTOCOL_VERSION,
+  DEFAULT_PATH,
+  isPageFrame
+};
+//# sourceMappingURL=chunk-4QA2G6S3.js.map

package/dist/chunk-4QA2G6S3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/core/protocol.ts"],"sourcesContent":["/**\n * Bridge protocol (JSON over WebSocket) between a page runtime and the bridge\n * server, and the HTTP shape the server exposes to CLIs and agents.\n *\n * Page → server\n *   hello      first frame; identifies the tab\n *   events     batched PulseEvents (≤ 50 ms coalescing)\n *   result     reply to a `command`\n * Server → page\n *   command    run a controller command; page answers with `result`\n *   welcome    ack of hello with the server-assigned client id\n */\n\nimport type { PulseEvent } from \"./events.js\";\nimport type { CommandResult, CommandSpec } from \"./controller.js\";\n\nexport const PROTOCOL_VERSION = 1;\nexport const DEFAULT_PATH = \"/__pulse\";\n\nexport interface HelloFrame {\n  type: \"hello\";\n  protocol: number;\n  clientId: string;\n  url: string;\n  title: string;\n  userAgent: string;\n  commands: CommandSpec[];\n  startedWall: number;\n}\n\nexport interface EventsFrame {\n  type: \"events\";\n  events: PulseEvent[];\n}\n\nexport interface ResultFrame {\n  type: \"result\";\n  id: string;\n  result: CommandResult;\n}\n\nexport interface CommandFrame {\n  type: \"command\";\n  id: string;\n  name: string;\n  args: Record<string, unknown>;\n}\n\nexport interface WelcomeFrame {\n  type: \"welcome\";\n  clientId: string;\n  protocol: number;\n}\n\nexport type PageFrame = HelloFrame | EventsFrame | ResultFrame;\nexport type ServerFrame = CommandFrame | WelcomeFrame;\n\nexport interface ClientSummary {\n  clientId: string;\n  url: string;\n  title: string;\n  userAgent: string;\n  connectedWall: number;\n  lastSeenWall: number;\n  events: number;\n  commands: number;\n}\n\nexport function isPageFrame(value: unknown): value is PageFrame {\n  if (!value || typeof value !== \"object\") return false;\n  const t = (value as { type?: unknown }).type;\n  return t === \"hello\" || t === \"events\" || t === \"result\";\n}\n\nexport function isServerFrame(value: unknown): value is ServerFrame {\n  if (!value || typeof value !== \"object\") return false;\n  const t = (value as { type?: unknown }).type;\n  return t === \"command\" || t === \"welcome\";\n}\n"],"mappings":";AAgBO,IAAM,mBAAmB;AACzB,IAAM,eAAe;AAmDrB,SAAS,YAAY,OAAoC;AAC9D,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,IAAK,MAA6B;AACxC,SAAO,MAAM,WAAW,MAAM,YAAY,MAAM;AAClD;","names":[]}

package/dist/chunk-5FYH2KEZ.js

@@ -0,0 +1,66 @@
+// src/core/redact.ts
+var SENSITIVE_PARAM = /(token|key|secret|auth|session|ticket|password|passwd|signature|sig|code)/i;
+var SENSITIVE_HEADER = /^(authorization|cookie|set-cookie|x-api-key|x-auth-token|proxy-authorization)$/i;
+var BEARER = /\b(bearer|basic)\s+[a-z0-9._~+/=-]{8,}/gi;
+var JWT = /\beyJ[a-zA-Z0-9_-]{5,}\.[a-zA-Z0-9_-]{5,}\.[a-zA-Z0-9_-]{5,}\b/g;
+var REDACTED = "[redacted]";
+function redactUrl(input) {
+  let url;
+  try {
+    url = new URL(input, "http://localhost/");
+  } catch {
+    return redactText(input);
+  }
+  if (url.username || url.password) {
+    url.username = "";
+    url.password = "";
+  }
+  let changed = false;
+  for (const key of [...url.searchParams.keys()]) {
+    if (SENSITIVE_PARAM.test(key)) {
+      url.searchParams.set(key, REDACTED);
+      changed = true;
+    }
+  }
+  if (url.hash && SENSITIVE_PARAM.test(url.hash)) {
+    url.hash = "";
+    changed = true;
+  }
+  if (!/^[a-z][a-z0-9+.-]*:/i.test(input)) {
+    const rel = url.pathname + url.search + url.hash;
+    return changed ? rel : redactText(input);
+  }
+  return redactText(url.toString());
+}
+function redactText(text) {
+  return text.replace(JWT, REDACTED).replace(BEARER, (_, scheme) => `${scheme} ${REDACTED}`);
+}
+function redactHeaders(headers) {
+  const out = {};
+  for (const [k, v] of headers) {
+    out[k.toLowerCase()] = SENSITIVE_HEADER.test(k) ? REDACTED : redactText(v);
+  }
+  return out;
+}
+function redactValue(value, depth = 0) {
+  if (depth > 6 || value === null || value === void 0) return value;
+  if (typeof value === "string") return redactText(value);
+  if (Array.isArray(value)) return value.map((v) => redactValue(v, depth + 1));
+  if (typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      out[k] = SENSITIVE_PARAM.test(k) && typeof v === "string" ? REDACTED : redactValue(v, depth + 1);
+    }
+    return out;
+  }
+  return value;
+}
+
+export {
+  REDACTED,
+  redactUrl,
+  redactText,
+  redactHeaders,
+  redactValue
+};
+//# sourceMappingURL=chunk-5FYH2KEZ.js.map

package/dist/chunk-5FYH2KEZ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/core/redact.ts"],"sourcesContent":["/**\n * Redaction. Devtools traffic leaves the page (bridge, CLI, exports), so\n * anything that looks like a credential is scrubbed before it becomes an event.\n * Bodies are never captured unless `captureBodies` is turned on explicitly.\n */\n\nconst SENSITIVE_PARAM = /(token|key|secret|auth|session|ticket|password|passwd|signature|sig|code)/i;\nconst SENSITIVE_HEADER = /^(authorization|cookie|set-cookie|x-api-key|x-auth-token|proxy-authorization)$/i;\nconst BEARER = /\\b(bearer|basic)\\s+[a-z0-9._~+/=-]{8,}/gi;\nconst JWT = /\\beyJ[a-zA-Z0-9_-]{5,}\\.[a-zA-Z0-9_-]{5,}\\.[a-zA-Z0-9_-]{5,}\\b/g;\n\nexport const REDACTED = \"[redacted]\";\n\nexport function redactUrl(input: string): string {\n  let url: URL;\n  try {\n    url = new URL(input, \"http://localhost/\");\n  } catch {\n    return redactText(input);\n  }\n  if (url.username || url.password) {\n    url.username = \"\";\n    url.password = \"\";\n  }\n  let changed = false;\n  for (const key of [...url.searchParams.keys()]) {\n    if (SENSITIVE_PARAM.test(key)) {\n      url.searchParams.set(key, REDACTED);\n      changed = true;\n    }\n  }\n  if (url.hash && SENSITIVE_PARAM.test(url.hash)) {\n    url.hash = \"\";\n    changed = true;\n  }\n  // Preserve relative inputs as given (the base above is only for parsing).\n  if (!/^[a-z][a-z0-9+.-]*:/i.test(input)) {\n    const rel = url.pathname + url.search + url.hash;\n    return changed ? rel : redactText(input);\n  }\n  return redactText(url.toString());\n}\n\nexport function redactText(text: string): string {\n  return text.replace(JWT, REDACTED).replace(BEARER, (_, scheme: string) => `${scheme} ${REDACTED}`);\n}\n\nexport function redactHeaders(headers: Iterable<[string, string]>): Record<string, string> {\n  const out: Record<string, string> = {};\n  for (const [k, v] of headers) {\n    out[k.toLowerCase()] = SENSITIVE_HEADER.test(k) ? REDACTED : redactText(v);\n  }\n  return out;\n}\n\n/** Best-effort key redaction inside small structured payloads. */\nexport function redactValue<T>(value: T, depth = 0): T {\n  if (depth > 6 || value === null || value === undefined) return value;\n  if (typeof value === \"string\") return redactText(value) as T;\n  if (Array.isArray(value)) return value.map((v) => redactValue(v, depth + 1)) as T;\n  if (typeof value === \"object\") {\n    const out: Record<string, unknown> = {};\n    for (const [k, v] of Object.entries(value as Record<string, unknown>)) {\n      out[k] = SENSITIVE_PARAM.test(k) && typeof v === \"string\" ? REDACTED : redactValue(v, depth + 1);\n    }\n    return out as T;\n  }\n  return value;\n}\n"],"mappings":";AAMA,IAAM,kBAAkB;AACxB,IAAM,mBAAmB;AACzB,IAAM,SAAS;AACf,IAAM,MAAM;AAEL,IAAM,WAAW;AAEjB,SAAS,UAAU,OAAuB;AAC/C,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,OAAO,mBAAmB;AAAA,EAC1C,QAAQ;AACN,WAAO,WAAW,KAAK;AAAA,EACzB;AACA,MAAI,IAAI,YAAY,IAAI,UAAU;AAChC,QAAI,WAAW;AACf,QAAI,WAAW;AAAA,EACjB;AACA,MAAI,UAAU;AACd,aAAW,OAAO,CAAC,GAAG,IAAI,aAAa,KAAK,CAAC,GAAG;AAC9C,QAAI,gBAAgB,KAAK,GAAG,GAAG;AAC7B,UAAI,aAAa,IAAI,KAAK,QAAQ;AAClC,gBAAU;AAAA,IACZ;AAAA,EACF;AACA,MAAI,IAAI,QAAQ,gBAAgB,KAAK,IAAI,IAAI,GAAG;AAC9C,QAAI,OAAO;AACX,cAAU;AAAA,EACZ;AAEA,MAAI,CAAC,uBAAuB,KAAK,KAAK,GAAG;AACvC,UAAM,MAAM,IAAI,WAAW,IAAI,SAAS,IAAI;AAC5C,WAAO,UAAU,MAAM,WAAW,KAAK;AAAA,EACzC;AACA,SAAO,WAAW,IAAI,SAAS,CAAC;AAClC;AAEO,SAAS,WAAW,MAAsB;AAC/C,SAAO,KAAK,QAAQ,KAAK,QAAQ,EAAE,QAAQ,QAAQ,CAAC,GAAG,WAAmB,GAAG,MAAM,IAAI,QAAQ,EAAE;AACnG;AAEO,SAAS,cAAc,SAA6D;AACzF,QAAM,MAA8B,CAAC;AACrC,aAAW,CAAC,GAAG,CAAC,KAAK,SAAS;AAC5B,QAAI,EAAE,YAAY,CAAC,IAAI,iBAAiB,KAAK,CAAC,IAAI,WAAW,WAAW,CAAC;AAAA,EAC3E;AACA,SAAO;AACT;AAGO,SAAS,YAAe,OAAU,QAAQ,GAAM;AACrD,MAAI,QAAQ,KAAK,UAAU,QAAQ,UAAU,OAAW,QAAO;AAC/D,MAAI,OAAO,UAAU,SAAU,QAAO,WAAW,KAAK;AACtD,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,CAAC,MAAM,YAAY,GAAG,QAAQ,CAAC,CAAC;AAC3E,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,MAA+B,CAAC;AACtC,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAgC,GAAG;AACrE,UAAI,CAAC,IAAI,gBAAgB,KAAK,CAAC,KAAK,OAAO,MAAM,WAAW,WAAW,YAAY,GAAG,QAAQ,CAAC;AAAA,IACjG;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;","names":[]}