@onesi/genesis 0.1.13 → 0.2.1

package/dist/redact.js

@@ -0,0 +1,330 @@
+/**
+ * Redaction for service error bodies and messages before the CLI or MCP prints them. The design is
+ * conservative: when a key or value might be a secret, it is replaced with `[redacted]`. Field names are
+ * matched after normalisation (camelCase split, `-`/`.`/space to `_`, lower-cased), so `x-api-key`,
+ * `privateKey`, `Set-Cookie` and `client_secret` are all the same kind of name.
+ */
+export const REDACTED = '[redacted]';
+/** Bounds of the printed body: serialized bytes, per string, per array/object, nesting and the oversize preview. */
+export const ERROR_BODY_LIMITS = { bytes: 16384, string: 2048, items: 100, depth: 8, preview: 4096 };
+/** Words that make any field secret wherever they appear in its name. */
+const SECRET_WORDS = new Set(['token', 'tokens', 'secret', 'secrets', 'password', 'passwords', 'passwd', 'pwd', 'passphrase', 'passcode',
+    'credential', 'credentials', 'authorization', 'auth', 'cookie', 'cookies', 'ciphertext', 'sealed', 'plaintext', 'session', 'sessions',
+    'dpop', 'signature', 'signatures', 'sig', 'otp', 'totp', 'private', 'apikey', 'jwt', 'jwe', 'bearer', 'privkey', 'mnemonic', 'seed',
+    // Card security codes and PINs, also inside compound names (`card_cvc`, `cvv2`, `pin_code`).
+    'cvc', 'cvv', 'cvc2', 'cvv2', 'csc', 'pin', 'pincode', 'securitycode']);
+/** Whole names that are secret on their own (CLI `scrub` list, sealed envelopes). */
+const SECRET_NAMES = new Set(['envelope', 'enc', 'ct', 'key_material', 'pin', 'cvv', 'cvc', 'code_verifier', 'pass', 'pw', 'hmac', 'sid',
+    'jsessionid', 'phpsessid', 'pan', 'card_number', 'cardnumber', 'cc_number', 'ccnumber', 'credit_card_number', 'primary_account_number',
+    'account_number', 'iban', 'ssn', 'social_security_number', 'routing_number', 'routingnumber', 'aba_routing_number', 'bank_account',
+    'bank_account_number', 'sort_code']);
+/** Names written as one lower- or upper-case word (`accesstoken`, `CLIENTSECRET`): the secret compounds, matched at the end of the name. */
+const GLUED_SECRET = /(?:token|secret|password|passwd|apikey|privatekey|secretkey|accesskey|signingkey|encryptionkey|masterkey|clientkey|codeverifier|(?:recovery|backup)codes?|sessionid|sessid|securitycode|cardcode|pincode|cvc2?|cvv2?)$/;
+/** `<word>_key(s)` is secret unless the word names a non-secret key. */
+const PUBLIC_KEY_WORDS = new Set(['idempotency', 'public', 'object', 'cache', 'sort', 'partition', 'primary', 'foreign', 'route', 'lookup',
+    'dedupe', 'dedup', 'group', 'message', 'storage', 'bucket', 'file', 'path', 'map', 'kv', 'row', 'column', 'index', 'unique', 'composite', 'hash']);
+/** `<word>_code` that is a one-time secret rather than an error code. */
+const SECRET_CODE_WORDS = new Set(['security', 'card', 'login', 'auth', 'authorization', 'verification', 'device', 'user', 'otp', 'recovery', 'backup', 'pairing',
+    'join', 'invite', 'enrollment', 'activation', 'oauth', 'mfa', 'sms', 'email', 'pasted', 'one_time', 'confirmation', 'reset']);
+/** Last words that make a name metadata about a secret, not the secret (`api_key_id`, `token_type`). Never for sessions or cookies. */
+const METADATA_WORDS = new Set(['id', 'ids', 'at', 'kind', 'type', 'types', 'count', 'status', 'state', 'scope', 'scopes', 'name', 'names',
+    'label', 'hint', 'version', 'provider', 'source', 'format', 'mode', 'required', 'expires', 'expiry', 'ttl', 'algorithm', 'alg', 'length', 'policy', 'url',
+    'check', 'checks']);
+const words = (key) => {
+    const plain = key.toLowerCase().replace(/[^a-z0-9]+/g, '_');
+    const split = key.replace(/([a-z0-9])([A-Z])/g, '$1_$2').replace(/([A-Z]+)([A-Z][a-z])/g, '$1_$2').toLowerCase().replace(/[^a-z0-9]+/g, '_');
+    return [...new Set([plain, split])].map(k => k.split('_').filter(Boolean));
+};
+function secretWords(w, value) {
+    const joined = w.join('_');
+    if (SECRET_NAMES.has(joined))
+        return true;
+    const last = w[w.length - 1] ?? '';
+    // Usage counters (`input_tokens: 12`) are numbers, not tokens.
+    if (last === 'tokens' && typeof value === 'number')
+        return false;
+    const secret = w.some((word, i) => SECRET_WORDS.has(word)
+        || (word === 'key' || word === 'keys') && i > 0 && !PUBLIC_KEY_WORDS.has(w[i - 1])
+        || (word === 'code' || word === 'codes') && i > 0 && (SECRET_CODE_WORDS.has(w[i - 1]) || SECRET_CODE_WORDS.has(`${w[i - 2]}_${w[i - 1]}`)));
+    if (!secret)
+        return false;
+    const persistent = w.some(word => word === 'session' || word === 'sessions' || word === 'cookie' || word === 'cookies');
+    return !(w.length > 1 && METADATA_WORDS.has(last) && !(persistent && (last === 'id' || last === 'ids')));
+}
+/** True when a field of this name may hold a secret. */
+export function secretField(key, value) {
+    if (words(key).some(w => w.length > 0 && secretWords(w, value)))
+        return true;
+    // A glued name has no separators or case change to split on; numeric `inputtokens` counters stay readable.
+    const glued = key.trim();
+    return /^(?:[A-Za-z][a-z0-9]*|[A-Z0-9]+)$/.test(glued) && GLUED_SECRET.test(glued.toLowerCase()) && !(/tokens$/i.test(glued) && typeof value === 'number');
+}
+/** True when a run of 12 to 19 digits passes the Luhn check and could be a card number (a `1` prefix only for 15-digit UATP cards, so ms timestamps stay readable). */
+export function cardNumber(digits) {
+    if (!/^\d{12,19}$/.test(digits) || digits[0] === '1' && digits.length !== 15)
+        return false;
+    let sum = 0;
+    for (let i = 0; i < digits.length; i++) {
+        let d = digits.charCodeAt(digits.length - 1 - i) - 48;
+        if (i % 2 === 1) {
+            d *= 2;
+            if (d > 9)
+                d -= 9;
+        }
+        sum += d;
+    }
+    return sum % 10 === 0;
+}
+/** Digit groups inside one run longer than this are identifiers (hashes, reservation ids), not a card with glued digits. */
+const CARD_WINDOW_RUN = 40;
+/**
+ * Redacts the card numbers in a run of digit groups (separated by whitespace, a dash or a dot). A card is any span
+ * of whole groups with 12 to 19 digits that passes the Luhn check, so a card beside other digits (`<PAN> 12/28`,
+ * `<PAN> 123`, `line 12 <PAN>`) is still found. A span may also end inside its last group when 2 to 4 digits are
+ * glued on (an expiry or CVC: `<PAN>1228`, `5555 5555 5555 44441228`), and every window of a 20 to 40 digit group
+ * is tried. Inside a longer group a `1` prefix is never a card, so snowflake ids and nanosecond timestamps print.
+ */
+function redactCardRun(run) {
+    const groups = run.match(/\d+/g) ?? [], seps = run.match(/\D+/g) ?? [];
+    // A dotted quad is an IPv4 address.
+    if (groups.length === 4 && seps.every(s => s === '.') && groups.every(g => g.length <= 3))
+        return run;
+    const hit = groups.map(() => false);
+    const glued = (d) => d[0] !== '1' && cardNumber(d);
+    for (let i = 0; i < groups.length; i++) {
+        let digits = '';
+        for (let j = i; j < groups.length && digits.length < 19; j++) {
+            const g = groups[j];
+            for (let rest = 2; rest <= 4 && rest < g.length; rest++) {
+                const d = digits + g.slice(0, g.length - rest);
+                if (d.length >= 12 && d.length <= 19 && glued(d))
+                    hit.fill(true, i, j + 1);
+            }
+            digits += g;
+            if (digits.length >= 12 && digits.length <= 19 && cardNumber(digits))
+                hit.fill(true, i, j + 1);
+        }
+        const g = groups[i];
+        if (hit[i] || g.length < 20 || g.length > CARD_WINDOW_RUN)
+            continue;
+        for (let a = 0; a + 12 <= g.length && !hit[i]; a++)
+            for (let len = 12; len <= 19 && a + len <= g.length; len++)
+                if (glued(g.slice(a, a + len))) {
+                    hit[i] = true;
+                    break;
+                }
+    }
+    if (!hit.includes(true))
+        return run;
+    // Consecutive redacted groups become one `[redacted]`.
+    return groups.map((g, i) => hit[i] && i > 0 && hit[i - 1] ? '' : (i ? seps[i - 1] : '') + (hit[i] ? REDACTED : g)).join('');
+}
+/** True when a string passes the IBAN mod-97 check. */
+function iban(value) {
+    if (!/^[A-Z]{2}\d{2}[A-Z0-9]{11,30}$/.test(value))
+        return false;
+    const moved = value.slice(4) + value.slice(0, 4);
+    let rest = 0;
+    for (const ch of moved) {
+        const n = ch >= 'A' && ch <= 'Z' ? String(ch.charCodeAt(0) - 55) : ch;
+        for (const d of n)
+            rest = (rest * 10 + d.charCodeAt(0) - 48) % 97;
+    }
+    return rest === 1;
+}
+/** Card-holding fields: `card` with a scalar value, and `number` under a card-like parent (`card.number`, `payment_card.number`). */
+const cardField = (key, value, parent) => {
+    const k = key.toLowerCase();
+    const scalar = typeof value === 'string' || typeof value === 'number' || typeof value === 'bigint';
+    const under = (...names) => parent !== undefined && words(parent).some(w => names.some(n => w.includes(n)));
+    return scalar && (k === 'card' || k === 'cards' || k === 'number' && under('card', 'cards', 'bank')
+        || (k === 'account' || k === 'routing') && under('bank', 'bank_account', 'ach'));
+};
+/** Email local parts are personal data: `jr@example.com` prints as `[redacted]@example.com`. */
+const EMAIL = /(?<![A-Za-z0-9._%+-])[A-Za-z0-9._%+-]+@((?:[A-Za-z0-9-]+\.)+[A-Za-z]{2,63})(?![A-Za-z0-9-])/g;
+/** OAuth 2.0 error tokens (RFC 6749, 8628, OIDC): a `code` beside one of these is an authorization code. */
+const OAUTH_ERRORS = new Set(['invalid_request', 'invalid_client', 'invalid_grant', 'unauthorized_client', 'unsupported_grant_type', 'invalid_scope',
+    'access_denied', 'unsupported_response_type', 'server_error', 'temporarily_unavailable', 'invalid_token', 'authorization_pending', 'slow_down',
+    'expired_token', 'interaction_required', 'login_required', 'consent_required', 'account_selection_required', 'invalid_request_uri', 'invalid_dpop_proof']);
+/** A value that looks random (letters and digits, no separators, 16 or more characters): an authorization code, never an error code. */
+export const randomCode = (v) => typeof v === 'string' && /^[A-Za-z0-9]{16,}$/.test(v) && /\d/.test(v) && /[A-Za-z]/.test(v);
+/** Query and form parameter names that carry secrets beyond the secret-named fields. */
+const SECRET_PARAMS = new Set(['code', 'key', 'sig', 'apikey', 'api_key', 'x_amz_credential', 'x_amz_security_token', 'x_amz_signature',
+    'x_goog_signature', 'x_goog_credential', 'access_token', 'refresh_token', 'id_token', 'client_secret', 'code_verifier', 'state_token']);
+const secretParam = (name) => {
+    let decoded = name;
+    try {
+        decoded = decodeURIComponent(name);
+    }
+    catch { /* keep raw */ }
+    return SECRET_PARAMS.has(decoded.toLowerCase().replace(/[^a-z0-9]+/g, '_')) || secretField(decoded, '');
+};
+const SECRET_TEXT = [
+    // JSON pairs inside text that is not JSON as a whole (`upstream said {"accessToken":"..."}`).
+    [/"([^"\\\r\n]{1,128})"(\s*:\s*)"((?:[^"\\]|\\.){0,4096})"/g, (m, name, colon, value) => value && value !== REDACTED && secretField(name, value) ? `"${name}"${colon}"${REDACTED}"` : m],
+    // The same pairs with HTML-escaped quotes (`{&quot;api_key&quot;:&quot;...&quot;}`).
+    [/&quot;([^&"\r\n]{1,128})&quot;(\s*:\s*)&quot;((?:(?!&quot;)[\s\S]){0,4096}?)&quot;/g, (m, name, colon, value) => value && value !== REDACTED && secretField(name, value) ? `&quot;${name}&quot;${colon}&quot;${REDACTED}&quot;` : m],
+    // The same pairs backslash-escaped any number of times (`{\"client_secret\":\"...\"}` from a `%q`-quoted upstream body).
+    [/(\\+")([^"\\\r\n]{1,128})\1(\s*:\s*)\1((?:(?!\1)[\s\S]){0,4096}?)\1/g, (m, q, name, colon, value) => value && value !== REDACTED && secretField(name, value) ? `${q}${name}${q}${colon}${q}${REDACTED}${q}` : m],
+    // Header lines (`X-Api-Key: ...` in a raw header list or a dumped request), one per line.
+    [/(^|[\r\n]|\\r\\n|\\n)([ \t]*)([A-Za-z][A-Za-z0-9_-]{0,63})([ \t]*:[ \t]*)([^\r\n]+?)(?=[ \t]*(?:,[ \t]*\\*["']|[\r\n]|\\r\\n|\\n|$))/g,
+        (m, lead, pad, name, colon, value) => value !== REDACTED && secretField(name, value) ? `${lead}${pad}${name}${colon}${REDACTED}` : m],
+    // Stripe client secrets (PaymentIntent, SetupIntent, Checkout Session, Source) and ephemeral keys.
+    [/(?<![A-Za-z0-9])(?:pi|seti|cs|src)_[A-Za-z0-9_]+?_secret_[A-Za-z0-9]+/g, REDACTED],
+    [/(?<![A-Za-z0-9])ek_(?:live|test)_[A-Za-z0-9_-]{8,}/g, REDACTED],
+    // PEM private keys (whole block, or to the end when cut).
+    [/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z ]*PRIVATE KEY-----|$)/g, REDACTED],
+    // URL userinfo: scheme://user:pass@host.
+    [/\b([a-z][a-z0-9+.-]{0,31}:\/\/)[^\s/?#@]+@/gi, `$1${REDACTED}@`],
+    // An Authorization / Proxy-Authorization header in text, any scheme.
+    [/\b((?:proxy[-_ ]?)?authorization["']?\s*[:=]\s*["']?)(?!\[redacted\])(?:[A-Za-z][A-Za-z0-9_-]*\s+)?[^\s"',;]{8,}/gi, `$1${REDACTED}`],
+    // Auth schemes followed by a credential.
+    [/\b(bearer|dpop)\s+[A-Za-z0-9._~+/=-]{8,}/gi, `$1 ${REDACTED}`],
+    // Other schemes when what follows looks like a credential (digits, base64 symbols or mixed case), not a word.
+    [/\b(Basic|Token|Digest|ApiKey|Key|Negotiate|NTLM|basic|token)\s+([A-Za-z0-9._~+/=-]{8,})/g, (m, scheme, value) => /[0-9+/=]/.test(value) || /[a-z]/.test(value) && /[A-Z]/.test(value) ? `${scheme} ${REDACTED}` : m],
+    // JWT (3 parts) and JWE (5 parts).
+    [/eyJ[A-Za-z0-9_-]{4,}(?:\.[A-Za-z0-9_-]*){2,4}/g, REDACTED],
+    // Known key and token forms, also when glued to a word by `_` or `-`.
+    [/(?<![A-Za-z0-9])(?:sk|rk|mek|whsec|ghp|gho|ghs|ghu|ghr|github_pat|glpat|xox[abposre]|shpat|shpss|dop_v1|sq0atp|sq0csp)[_-][A-Za-z0-9_-]{8,}/g, REDACTED],
+    [/(?<![A-Z0-9])(?:AKIA|ASIA|AGPA|AIDA|AROA|ANPA|ANVA|AIPA)[A-Z0-9]{16}(?![A-Z0-9])/g, REDACTED],
+    [/(?<![A-Za-z0-9])AIza[A-Za-z0-9_-]{20,}/g, REDACTED],
+    [/(?<![A-Za-z0-9])ya29\.[A-Za-z0-9_-]{16,}/g, REDACTED],
+    // IBANs: two letters, two check digits, then 11 to 30 letters and digits, optionally spaced in fours; any case.
+    // A spaced IBAN is read in groups of four; trailing groups are dropped until the check passes, so a following word stays.
+    [/(?<![A-Za-z0-9])[A-Za-z]{2}\d{2}(?:[A-Za-z0-9]{11,30}|(?: [A-Za-z0-9]{4}){2,8}(?: [A-Za-z0-9]{1,4})?)(?![A-Za-z0-9])/g, (m) => {
+            const parts = m.split(' ');
+            for (let k = parts.length; k >= 1; k--) {
+                if (iban(parts.slice(0, k).join('').toUpperCase()))
+                    return [REDACTED, ...parts.slice(k)].join(' ');
+            }
+            return m;
+        }],
+    // Card numbers: Luhn-valid spans of 12 to 19 digits in a run of digit groups, also beside other digits (see redactCardRun).
+    // Order matters: this runs after the token and scheme rules, so a digit group inside a token never breaks the token's
+    // match, and before the parameter and free-text rules, which stop at a space and would leave a spaced card's tail.
+    // Groups may be separated by any whitespace (NBSP, thin and ideographic spaces, tabs, line breaks, repeated spaces),
+    // a dash or a dot. Groups and runs are bounded so a hostile run cannot make the scan quadratic; a group over 64 digits is an identifier.
+    [/(?<![0-9A-Za-z])\d{1,64}(?:(?:\s{0,8}[-.]\s{0,8}|\s{1,8})\d{1,64}){0,63}(?![0-9A-Za-z])/g, (m) => redactCardRun(m)],
+    // US social security numbers in their dashed form.
+    [/(?<![0-9A-Za-z-])\d{3}-\d{2}-\d{4}(?![0-9A-Za-z-])/g, REDACTED],
+    // Query, fragment and form parameters (`?code=`, `&X-Amz-Signature=`, a body starting `client_secret=`).
+    [/(^|[?&#;\s])([A-Za-z0-9_.~%[\]-]{1,128})=([^&#\s"']*)/g, (m, lead, name, value) => value && secretParam(name) ? `${lead}${name}=${REDACTED}` : m],
+    // `password: x`, `"api_key":"x"` and similar in free text that is not parseable JSON.
+    [/((?<![A-Za-z0-9])(?:\\*["'])?(?:password|passwd|pwd|passphrase|secret|client[_-]?secret|api[_-]?key|access[_-]?key|private[_-]?key|(?:access|refresh|id|session|auth)[_-]?token|token|cookie|set-cookie|cvc2?|cvv2?|csc|security[_ -]?code|card[_ -]?code|pin(?:[_-]?code)?)(?:\\*["'])?\s*[:=]\s*(?:\\*["'])?)(?!\[redacted\])[^\s"'\\,;&}]+/gi, `$1${REDACTED}`],
+    // Numeric JSON values of secret fields in text (`{"number":"...","cvc":123}`).
+    [/"([^"\\\r\n]{1,128})"(\s*:\s*)(-?\d[\d.]*)(?=\s*[,}\]])/g, (m, name, colon, value) => secretField(name, Number(value)) || cardField(name, value, undefined) ? `"${name}"${colon}${REDACTED}` : m],
+    // Email addresses keep their domain only.
+    [EMAIL, `${REDACTED}@$1`],
+];
+/**
+ * Terminal escape sequences, control characters (line breaks and tabs kept) and invisible or bidi characters. They
+ * are removed before redaction, so none can split a secret (`4242\x1b[0m4242...`) and hide it from the patterns.
+ */
+const INVISIBLE = /(?:\x1b\]|\x9d)[^\x07\x1b\x9c]*(?:\x07|\x1b\\|\x9c)?|(?:\x1b\[|\x9b)[\x30-\x3f]*[\x20-\x2f]*[\x40-\x7e]?|\x1b[\x20-\x2f]*[\x30-\x7e]?|[\x00-\x08\x0b\x0c\x0e-\x1f\x7f-\x9f\u00ad\u061c\u180e\u200b-\u200f\u202a-\u202e\u2060-\u2064\u2066-\u2069\ufeff\u2028\u2029]/g;
+/** Tag characters (U+E0000 to U+E007F), invisible and astral, so matched with the `u` flag. */
+const INVISIBLE_TAGS = /[\u{e0000}-\u{e007f}]/gu;
+/** Redacts secret forms in free text: an error message, a raw body or a string field. Control and invisible characters are removed first. */
+export function redactErrorText(text) {
+    return SECRET_TEXT.reduce((t, [pattern, to]) => t.replace(pattern, to), text.replace(INVISIBLE, '').replace(INVISIBLE_TAGS, ''));
+}
+/** A validation item's field path (`loc`, `field`, `path`, ...) names a secret field. */
+const LOCATION_KEYS = ['k', 'headername', 'header_name', 'loc', 'location', 'field', 'fields', 'path', 'param', 'parameter', 'pointer', 'property', 'attribute', 'key', 'name', 'header'];
+const locationSecret = (row) => Object.entries(row).some(([rawKey, v]) => {
+    // Case-insensitive: `{Name: "Authorization", Value}` is the same pair as `{name, value}`.
+    if (!LOCATION_KEYS.includes(rawKey.toLowerCase()))
+        return false;
+    const parts = (Array.isArray(v) ? v : [v]).filter((p) => typeof p === 'string').flatMap(p => p.split(/[./[\]\s]+/));
+    return parts.some(p => p !== '' && secretField(p, ''));
+});
+const validationShaped = (row) => ['loc', 'location', 'field', 'path', 'param', 'parameter', 'pointer', 'property', 'msg'].some(k => k in row);
+/** Echoed values of a validation item or header pair. */
+const ECHO_KEYS = new Set(['v', 'headervalue', 'header_value', 'value', 'values', 'val', 'content', 'input', 'inputs', 'received', 'actual', 'given', 'provided', 'ctx', 'context', 'example']);
+/** Fields of an OAuth token/authorize answer: their `code` is an authorization code, not an error code. */
+const OAUTH_KEYS = ['redirect_uri', 'redirect_url', 'session_state', 'code_verifier', 'code_challenge', 'access_token', 'id_token',
+    'refresh_token', 'token_type', 'iss', 'client_id', 'grant_type', 'expires_in', 'response_type', 'nonce'];
+/** True when an object looks like an OAuth token or authorize answer (so `code` may be an authorization code). */
+export const oauthShaped = (row) => OAUTH_KEYS.some(k => k in row);
+/**
+ * True when the `code` of this object may be an authorization code: an OAuth-shaped object, a `code` beside an
+ * OAuth error token (`{error: "invalid_grant", code}`), or a random-looking value. `errorBody` redacts that `code`.
+ */
+export const authorizationCode = (row) => oauthShaped(row) || randomCode(row.code)
+    // A short random code beside an OAuth `state` (`{code: "a1b2c3d4", state}`); refusal codes do not mix digits into letters like this.
+    || 'state' in row && typeof row.code === 'string' && /^[A-Za-z0-9-]{6,}$/.test(row.code) && /\d/.test(row.code) && /[A-Za-z]/.test(row.code)
+    || typeof row.error === 'string' && OAUTH_ERRORS.has(row.error.toLowerCase());
+const cut = (text) => text.length > ERROR_BODY_LIMITS.string
+    ? `${text.slice(0, ERROR_BODY_LIMITS.string)}…[truncated ${text.length - ERROR_BODY_LIMITS.string} chars]` : text;
+function redactString(value, depth) {
+    const trimmed = value.trim();
+    // JSON inside a string (a raw text body, a `detail` field): redact it field by field, then serialize again.
+    if (/^[{[]/.test(trimmed) && trimmed.length <= 262144) {
+        try {
+            const parsed = JSON.parse(trimmed);
+            if (parsed !== null && typeof parsed === 'object')
+                return cut(JSON.stringify(redactValue(parsed, depth + 1)));
+        }
+        catch { /* not JSON */ }
+    }
+    return cut(redactErrorText(value));
+}
+/** A header name followed by its value in a string array: `["Authorization", "..."]` tuples and flat `rawHeaders` lists. */
+const HEADER_NAME = /^[A-Za-z][A-Za-z0-9_-]{0,63}$/;
+const pairedSecret = (list, i) => i % 2 === 1 && list.length % 2 === 0 && list.every(v => typeof v === 'string')
+    && HEADER_NAME.test(list[i - 1]) && secretField(list[i - 1], list[i]);
+function redactValue(value, depth, parent) {
+    if (typeof value === 'string')
+        return redactString(value, depth);
+    // A card number sent as a JSON number.
+    if ((typeof value === 'number' && Number.isInteger(value) || typeof value === 'bigint') && redactCardRun(String(value)) !== String(value))
+        return REDACTED;
+    if (value === null || typeof value !== 'object')
+        return typeof value === 'bigint' || typeof value === 'function' || typeof value === 'symbol' ? String(value) : value;
+    if (depth >= ERROR_BODY_LIMITS.depth)
+        return '[truncated]';
+    if (Array.isArray(value)) {
+        const items = value.slice(0, ERROR_BODY_LIMITS.items).map((v, i) => v !== '' && pairedSecret(value, i) ? REDACTED : redactValue(v, depth + 1, parent));
+        return value.length > ERROR_BODY_LIMITS.items ? [...items, `[truncated ${value.length - ERROR_BODY_LIMITS.items} items]`] : items;
+    }
+    const row = value;
+    const entries = Object.entries(row);
+    // Header pairs ({name: "Authorization", value}) and validation echoes ({loc: [..., "api_key"], input}) whose field is secret.
+    const sensitiveLocation = locationSecret(row);
+    const validation = validationShaped(row);
+    const oauth = authorizationCode(row);
+    const out = {};
+    let hidden = 0;
+    for (const [rawKey, v] of entries.slice(0, ERROR_BODY_LIMITS.items)) {
+        // A key that is itself a secret (`{"sk_live_...": 1}`) is replaced, and so is its value.
+        const keyText = redactErrorText(rawKey);
+        const key = keyText === rawKey ? rawKey : `${REDACTED}${hidden++ ? `#${hidden}` : ''}`;
+        // null, empty and boolean values cannot carry a secret, and stay readable.
+        const empty = v === null || v === undefined || v === '' || typeof v === 'boolean';
+        const secret = keyText !== rawKey || secretField(rawKey, v)
+            || ECHO_KEYS.has(rawKey.toLowerCase()) && (sensitiveLocation || validation && /^inputs?$|^ctx$|^context$/i.test(rawKey))
+            || oauth && rawKey.toLowerCase() === 'code' || cardField(rawKey, v, parent);
+        out[key] = secret && !empty ? REDACTED : redactValue(v, depth + 1, rawKey);
+    }
+    if (entries.length > ERROR_BODY_LIMITS.items)
+        out['…'] = `[truncated ${entries.length - ERROR_BODY_LIMITS.items} fields]`;
+    return out;
+}
+/**
+ * A redacted, bounded copy of an error body: secret-named fields (after key normalisation, glued names included),
+ * header pairs (`{name, value}` in any case, `[name, value]` tuples, flat `rawHeaders`, `Name: value` lines) and
+ * validation echoes of secret fields, OAuth authorization codes, card numbers (Luhn-checked) and other payment or
+ * personal data, Stripe client secrets, secret-shaped keys and values, and JSON nested in strings, escaped or not. A result still over 16 KiB serialized becomes `{truncated, bytes, preview}` of the redacted text.
+ */
+export function redactErrorBody(body) {
+    if (body === undefined || body === '')
+        return undefined;
+    const safe = redactValue(body, 0);
+    let text;
+    try {
+        text = JSON.stringify(safe) ?? '';
+    }
+    catch {
+        return undefined;
+    }
+    const bytes = new TextEncoder().encode(text).length;
+    return bytes <= ERROR_BODY_LIMITS.bytes ? safe : { truncated: true, bytes, preview: text.slice(0, ERROR_BODY_LIMITS.preview) };
+}

package/dist/runner.d.ts

@@ -63,6 +63,10 @@ export declare function runnerModule(client: GenesisClient): Readonly<{
         cancel: (jobId: string, opts?: RunnerRequestOptions) => Promise<{
             snapshot: components["schemas"]["Runner.Snapshot"];
         }>;
+        delete: (jobId: string, opts?: RunnerRequestOptions) => Promise<{
+            jobId: components["schemas"]["Runner.SafeOpaqueRef"];
+            deleted: true;
+        }>;
     }>;
 }>;
 export {};

package/dist/runner.js

@@ -111,6 +111,7 @@ export function runnerModule(client) {
             },
             result: (jobId, opts = {}) => client.request('runner_getJobResult', { jobId: checkedJobId(jobId) }, requestOptions(opts)),
             cancel: (jobId, opts = {}) => client.request('runner_cancelJob', { jobId: checkedJobId(jobId) }, requestOptions(opts)),
+            delete: (jobId, opts = {}) => client.request('runner_deleteJob', { jobId: checkedJobId(jobId) }, requestOptions(opts)),
         }),
     });
 }