@oneuptime/common 14.0.1 → 14.0.2

package/build/dist/Utils/AiRemediation/KubectlOutputRedactor.js

@@ -0,0 +1,1209 @@
+/*
+ * Redacts credential-looking material from kubectl output before it reaches
+ * a language model or is stored next to an AI run.
+ *
+ * Pure and dependency-free on purpose, like KubectlPolicy: the same code can
+ * run on the server (KubectlJobRunner, the one output path investigations
+ * and remediation share) and, if ever needed, inside the Runner before the
+ * bytes leave the cluster.
+ *
+ * What it understands — all deterministic and line-oriented, so output the
+ * Runner truncated is handled exactly like complete output:
+ *  1. The `data:` / `stringData:` / `binaryData:` blocks of Kubernetes
+ *     objects, in YAML or pretty-printed JSON, single objects or Lists. For
+ *     a Secret — or whenever the object's kind cannot be determined — every
+ *     value in the block is masked (keys stay, so the model still knows
+ *     which keys exist). For any other kind (a ConfigMap) only the values
+ *     whose key looks credential-like are masked, so configuration stays
+ *     readable. `kubectl describe configmap` prints the same data as
+ *     "KEY:", a "----" rule and the value on the lines below; a
+ *     credential-like key loses that whole value.
+ *  2. Container env entries (`- name: X` / `value: Y`, YAML or JSON) whose
+ *     name looks credential-like: the value is masked; a valueFrom
+ *     reference is kept because it holds no material.
+ *  3. Any `key: value` or `key=value` whose key looks credential-like,
+ *     wherever it appears: describe output, kubeconfig-like text, container
+ *     logs, command-line flags, one-line JSON (`{"password":"…"}`, as
+ *     jsonpath and structured logs print it). A masked block scalar
+ *     (`tls.key: |`) drops its whole block.
+ *  4. A credential flag whose value is the NEXT argv element rather than
+ *     `=`-joined: `- --db-password` / `- value` in YAML, the same pair in a
+ *     JSON array or describe's Args block, and `--requirepass value` inside
+ *     one line. A tool's short password flag (`mysql -pX`, `redis-cli -a X`)
+ *     only where the command names that tool.
+ *  5. The `kubectl.kubernetes.io/last-applied-configuration` annotation —
+ *     the entire applied object, Secret data included, as one JSON string —
+ *     is replaced wholesale.
+ *  6. Inline material regardless of structure: `scheme://user:password@`,
+ *     `Bearer …` / `Basic …` tokens, JWTs, PEM private keys, one-line JSON
+ *     `"data":{…}` objects and `"name":"…","value":"…"` env pairs, and
+ *     base64 runs that are padded or long.
+ *
+ * Over-masking is accepted; under-masking is not. When the structure is
+ * ambiguous (no kind in sight, unexpected nesting inside a data block) the
+ * value is masked.
+ */
+export const KUBECTL_REDACTED_MARKER = "[redacted]";
+// Every marker this module writes starts with it: "[redacted-jwt]" too.
+const REDACTED_PREFIX = "[redacted";
+const DATA_BLOCK_KEYS = new Set([
+    "data",
+    "stringData",
+    "binaryData",
+]);
+const LAST_APPLIED_CONFIGURATION_ANNOTATION = "kubectl.kubernetes.io/last-applied-configuration";
+/*
+ * A key or env name that names credential material. Deliberately broad:
+ * `auth` also catches "authorization-mode", which is harmless to hide,
+ * while a narrow list would miss "DB_PASSWORD". A bare `key` is NOT
+ * credential-like (taints, tolerations and secretKeyRef all have one), but
+ * `tls.key`, `KEY_ID`, `api_key` and `private-key-file` are.
+ *
+ * `pass`, `pw` and `creds` count as a whole segment only — DB_PASS,
+ * RABBITMQ_DEFAULT_PASS, LDAP_BIND_PW, DB_CREDS, `--pass` — so "bypass",
+ * "compass", "passed", "MAX_PASSES" and "ssl-passthrough" stay readable,
+ * and "pass-through" is spelled out as not a credential. A few names glue
+ * a prefix on instead: Redis's `requirepass`, "dbpass", "smtppass".
+ */
+const CREDENTIAL_NAME_REGEX = /passw(?:or)?d|passwd|pwd|passphrase|passcode|(?:^|[-_./])pass(?:$|[-_.](?!through))|(?:require|db|user|admin|root|smtp|mail|redis|ldap|bind|sasl|ftp)pass(?![a-z])|(?:^|[-_./])(?:pw|creds?)(?:$|[-_.])|secret|token|credential|auth|cert|bearer|cookie|dockerconfig|dockercfg|webhook|(?:api|access|private|priv|encryption|signing|client|ssh|master|license|service|account|session|app|consumer|shared)[-_.]?key|(?:^|[-_./])key[-_.]|[-_./]key$|(?:^|[-_./])(?:dsn|salt|otp)(?:[-_.]|$)|\.(?:crt|cer|pem|p12|pfx|jks)$/i;
+/*
+ * Keys that match the pattern above but only ever REFER to a credential —
+ * the name of a Secret a volume mounts, whether a token is automounted —
+ * and that an on-call engineer needs when a pod cannot start. Compared
+ * lowercase, with leading dashes stripped so flag names match too.
+ */
+const REFERENCE_ONLY_KEYS = new Set([
+    "secretname",
+    "secretnamespace",
+    "secretproviderclass",
+    "secretkeyref",
+    "secretref",
+    "configmapkeyref",
+    "tokenexpirationseconds",
+    "expirationseconds",
+    "serviceaccounttoken",
+    "automountserviceaccounttoken",
+    "imagepullsecrets",
+    "image pull secrets",
+    "mountable secrets",
+    "tokens",
+    "audience",
+    "authorization-mode",
+    "anonymous-auth",
+    "tls-min-version",
+    "tls-cipher-suites",
+    "cert-manager.io/cluster-issuer",
+    "cert-manager.io/issuer",
+]);
+/*
+ * Values that carry no material and read better untouched: an absent
+ * value, and describe's own "<set to the key 'x' in secret 'y'>" reference
+ * for an env entry that comes from a Secret.
+ */
+const EXEMPT_VALUES = new Set([
+    "",
+    '""',
+    "''",
+    "null",
+    "~",
+    "{}",
+    "[]",
+    "{",
+    "[",
+    "<none>",
+    "<nil>",
+    "<unset>",
+    "<invalid>",
+    "<empty>",
+]);
+const EXEMPT_VALUE_PREFIX = "<set to the key ";
+// YAML block scalar indicators: |, |-, |+, >, >-, >2 ...
+const BLOCK_SCALAR_REGEX = /^[|>][+-]?[0-9]*$/;
+/*
+ * `key: value`, `key:` and `"key": value,` at the start of a line's content.
+ * Unquoted keys may contain spaces (describe prints "Image ID:") but never
+ * a colon, so "2026-09-22T10:00:00Z" and "http://…" are not keys. The colon
+ * must be followed by whitespace or end the line for the same reason.
+ */
+const KEY_VALUE_LINE_REGEX = /^(?:"([^"]*)"|'([^']*)'|([^\s"'#:{}[\],][^:"']*?))[ \t]*:(?:[ \t]+|$)/;
+/*
+ * An unquoted key with whitespace or `=` in it may be free text rather than
+ * a name: "connecting DB_PASSWORD=hunter2 host: db" parses as the key
+ * "connecting DB_PASSWORD=hunter2 host". Such a key is scanned for inline
+ * material too.
+ */
+const FREE_TEXT_KEY_REGEX = /[\s=]/;
+const LIST_ITEM_PREFIX_REGEX = /^-(?:[ \t]+|$)/;
+const LEADING_WHITESPACE_REGEX = /^[ \t]*/;
+/*
+ * scheme://user:password@host — the password only; an empty user still
+ * counts. The match starts at "://" and the scheme is checked by a
+ * lookbehind, so the scan stays linear: a pattern that STARTS with the
+ * scheme retries `[a-z][a-z0-9+.-]*` from every word boundary of a long
+ * dotted run ("eyJ.eyJ.eyJ…", "a.b.c.…") and backtracks through the whole
+ * run each time — 200 KB of pod log took over 30 seconds on one thread.
+ */
+const URL_CREDENTIAL_REGEX = /:\/\/(?<=\b[a-z][a-z0-9+.-]*:\/\/)([^\s/:@"']*):([^\s/@"']+)@/gi;
+const BEARER_TOKEN_REGEX = /\b(Bearer)[ \t]+([A-Za-z0-9._~+/-]{8,}=*)/g;
+// Prose ("Basic configuration", "Bearer authentication") is lowercase letters only.
+const LOWERCASE_WORD_REGEX = /^[a-z]+$/;
+const BASIC_TOKEN_REGEX = /\b(Basic)[ \t]+([A-Za-z0-9+/]{8,}={0,2})(?![A-Za-z0-9+/=])/g;
+const JWT_REGEX = /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{5,}/g;
+/*
+ * PEM private key blocks. A block whose END line was truncated away is
+ * masked to the end of the output rather than left standing.
+ */
+const PRIVATE_KEY_BLOCK_REGEX = /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY-----[\s\S]*?(?:-----END (?:[A-Z0-9]+ )*PRIVATE KEY-----|$)/g;
+/*
+ * Compact JSON, as in a one-line `"data":{...}` — the quote may be escaped
+ * when the JSON itself sits inside a JSON string.
+ */
+const INLINE_JSON_DATA_OBJECT_REGEX = /("|\\")(?:data|stringData|binaryData)(?:"|\\")\s*:\s*\{/g;
+/*
+ * A JSON string body: anything but an unescaped quote. Two spellings, for
+ * plain JSON and for JSON escaped inside another JSON string.
+ */
+const JSON_STRING_BODY = '(?:[^"\\\\]|\\\\.)*';
+const ESCAPED_JSON_STRING_BODY = '(?:[^"\\\\]|\\\\[^"])*';
+const JSON_QUOTE = '"';
+const ESCAPED_JSON_QUOTE = '\\\\"';
+function buildJsonEnvPairRegexes(isEscaped) {
+    const body = isEscaped ? ESCAPED_JSON_STRING_BODY : JSON_STRING_BODY;
+    const q = isEscaped ? ESCAPED_JSON_QUOTE : JSON_QUOTE;
+    return {
+        nameFirst: new RegExp(`(${q}name${q}\\s*:\\s*${q}(${body})${q}\\s*,\\s*${q}value${q}\\s*:\\s*${q})(${body})(${q})`, "g"),
+        valueFirst: new RegExp(`(${q}value${q}\\s*:\\s*${q})(${body})(${q}\\s*,\\s*${q}name${q}\\s*:\\s*${q}(${body})${q})`, "g"),
+    };
+}
+const JSON_ENV_PAIR_REGEXES = [buildJsonEnvPairRegexes(false), buildJsonEnvPairRegexes(true)];
+function buildJsonCredentialPairRule(isEscaped) {
+    const body = isEscaped ? ESCAPED_JSON_STRING_BODY : JSON_STRING_BODY;
+    const q = isEscaped ? ESCAPED_JSON_QUOTE : JSON_QUOTE;
+    return {
+        quote: isEscaped ? '\\"' : '"',
+        regex: new RegExp(`(${q}([^"\\\\\\n]{1,256})${q}\\s*:\\s*)(?:(${q})(${body})(${q}|$)|(-?[0-9][0-9.eE+-]*))`, "g"),
+    };
+}
+const JSON_CREDENTIAL_PAIR_RULES = [
+    buildJsonCredentialPairRule(false),
+    buildJsonCredentialPairRule(true),
+];
+/*
+ * `key=value` / `key: value` / `key:value` anywhere in a line — logs, args,
+ * Go-formatted maps (`map[password:cGFz…]`). The key is judged by
+ * isCredentialKey, so this never touches "timeout=1s" or "op=Exists". A
+ * JSON-escaped line break (`…\npassword: x\nuser: bob` inside a log
+ * message) separates pairs like a real one.
+ */
+const INLINE_PAIR_REGEX = /(^|[\s[,{("']|\\[nrt])([A-Za-z0-9_./-]+)([ \t]*[:=][ \t]*)("(?:[^"\\]|\\.)*"|'[^']*'|(?:[^\s,;&\]})"'\\]|\\(?![nrt]))+)/g;
+/*
+ * An image reference — `registry.example.com/auth:1.2.3`,
+ * `ghcr.io/org/secret-service:2.0` — has the shape of an inline pair whose
+ * key is a path and whose separator is a bare colon with no whitespace
+ * after it. A real pair with a path-shaped key (an annotation in describe
+ * output, `vault.hashicorp.com/agent-inject-token: abc123`) always has the
+ * space. The tag is what an on-call engineer needs most, so it stays.
+ */
+function isImageReferencePair(key, separator) {
+    return key.includes("/") && separator === ":";
+}
+/*
+ * A command-line flag standing alone as one argv element: "--db-password",
+ * "-password". A credential flag's value is then the NEXT element, which
+ * the pair rules above never see.
+ */
+const FLAG_TOKEN_REGEX = /^-{1,2}[A-Za-z][A-Za-z0-9_.-]*$/;
+/*
+ * A flag's value inside one line: a quoted string, or a bare word that is
+ * neither the next flag ("-…") nor a marker this module already wrote.
+ */
+const INLINE_FLAG_VALUE_PATTERN = /("(?:[^"\\]|\\.)*"|'[^']*'|[^\s"'[\-,;&|`\])}][^\s"',;&|`\])}]*)/;
+const INLINE_FLAG_VALUE_SOURCE = INLINE_FLAG_VALUE_PATTERN.source;
+// Where a flag can start inside a line.
+const INLINE_FLAG_BOUNDARY_PATTERN = /(^|[\s"'[(,;&|`])/;
+const INLINE_FLAG_BOUNDARY_SOURCE = INLINE_FLAG_BOUNDARY_PATTERN.source;
+/*
+ * `--requirepass value` / `-password value` in one line: a command in a
+ * log, describe's probe line, an `sh -c` script. The flag is judged by
+ * isCredentialKey, so "--port 8080" and "--tail 100" stay.
+ */
+const INLINE_SPLIT_FLAG_REGEX = new RegExp(`${INLINE_FLAG_BOUNDARY_SOURCE}(--?[A-Za-z][A-Za-z0-9_.-]*)([ \\t]+)${INLINE_FLAG_VALUE_SOURCE}`, "g");
+/*
+ * `"--db-password","value"` — a flag and its value as neighbouring JSON
+ * array strings (jsonpath `{.spec.containers[*].args}`), plain, escaped
+ * inside another JSON string, or single-quoted as a Python list prints it.
+ */
+function buildQuotedFlagPairRegex(quote, body) {
+    return new RegExp(`(${quote}(--?[A-Za-z][A-Za-z0-9_.-]*)${quote}\\s*,\\s*${quote})(${body})(${quote})`, "g");
+}
+const QUOTED_FLAG_PAIR_REGEXES = [
+    buildQuotedFlagPairRegex(JSON_QUOTE, JSON_STRING_BODY),
+    buildQuotedFlagPairRegex(ESCAPED_JSON_QUOTE, ESCAPED_JSON_STRING_BODY),
+    buildQuotedFlagPairRegex("'", "[^']*"),
+];
+/*
+ * Tools whose single-letter flag carries a password: `mysql -pS3cret`,
+ * `mongosh -p S3cret`, `sshpass -p S3cret`, `redis-cli -a S3cret`. The
+ * same letters mean something else everywhere else — `-p` is a port for
+ * ssh, psql and redis-cli and "make parents" for mkdir — so a short flag
+ * is judged only where the command names one of these tools: earlier on
+ * the same line, or earlier in the same one-element-per-line argv list.
+ */
+const SHORT_PASSWORD_FLAG_BY_TOOL = new Map([
+    ["mysql", "p"],
+    ["mysqladmin", "p"],
+    ["mysqldump", "p"],
+    ["mysqlcheck", "p"],
+    ["mysqlimport", "p"],
+    ["mysqlshow", "p"],
+    ["mysqlpump", "p"],
+    ["mysqlsh", "p"],
+    ["mariadb", "p"],
+    ["mariadb-admin", "p"],
+    ["mariadb-dump", "p"],
+    ["mariadb-check", "p"],
+    ["mariadb-import", "p"],
+    ["mongo", "p"],
+    ["mongosh", "p"],
+    ["mongodump", "p"],
+    ["mongorestore", "p"],
+    ["mongoexport", "p"],
+    ["mongoimport", "p"],
+    ["mongostat", "p"],
+    ["mongotop", "p"],
+    ["sshpass", "p"],
+    ["redis-cli", "a"],
+    ["keydb-cli", "a"],
+    ["valkey-cli", "a"],
+]);
+// One of those tools named inside a line, a path in front of it allowed.
+const TOOL_NAME_REGEX = new RegExp(`(^|[\\s/"'[(,;&|=\`])(${Array.from(SHORT_PASSWORD_FLAG_BY_TOOL.keys()).join("|")})(?=$|[\\s"'\\]),;&|\`\\\\])`, "g");
+// Where the command a tool starts ends inside a line.
+const COMMAND_END_REGEX = /[\];|&)`]/;
+// The password glued to a short flag ("-pS3cret"): a bare word.
+const SHORT_PASSWORD_ATTACHED_VALUE_PATTERN = /([^\s"'[\-,;&|`\])}][^\s"',;&|`\])}]*)/;
+// What separates a short flag from its password: blanks, or a list's ",".
+const SHORT_PASSWORD_SEPARATOR_PATTERN = /([ \t]+|"\s*,\s*"|\\"\s*,\s*\\"|'\s*,\s*')/;
+function buildShortPasswordFlagRegexes(letter) {
+    return {
+        attached: new RegExp(`${INLINE_FLAG_BOUNDARY_SOURCE}(-${letter})${SHORT_PASSWORD_ATTACHED_VALUE_PATTERN.source}`, "g"),
+        separated: new RegExp(`${INLINE_FLAG_BOUNDARY_SOURCE}(-${letter})${SHORT_PASSWORD_SEPARATOR_PATTERN.source}${INLINE_FLAG_VALUE_SOURCE}`, "g"),
+    };
+}
+const SHORT_PASSWORD_FLAG_REGEXES = new Map(Array.from(new Set(SHORT_PASSWORD_FLAG_BY_TOOL.values())).map((letter) => {
+    return [letter, buildShortPasswordFlagRegexes(letter)];
+}));
+/*
+ * `kubectl describe configmap` prints each data entry as "KEY:", this rule
+ * on the next line, and the value verbatim below it; the entries end with
+ * a "BinaryData" heading underlined the same way.
+ */
+const DESCRIBE_DATA_ENTRY_RULE = "----";
+const DESCRIBE_BINARY_DATA_HEADING = "BinaryData";
+const DESCRIBE_SECTION_RULE = "====";
+/*
+ * Base64 runs. A padded run of any length is base64 by construction
+ * ("cGFzc3dvcmQ=" is "password"); an unpadded run must be long and mixed to
+ * count, so identifiers, hashes and hex ids stay legible. The padding must
+ * end the token: "--feature-gates=Foo=true" is a flag, not a secret.
+ */
+const BASE64_PADDED_REGEX = /(?<![A-Za-z0-9+/])([A-Za-z0-9+/]{4,})(={1,2})(?![A-Za-z0-9+/=])/g;
+const BASE64_LONG_REGEX = /(?<![A-Za-z0-9+/])([A-Za-z0-9+/]{32,})(?![A-Za-z0-9+/=])/g;
+function parseLine(raw) {
+    var _a, _b, _c;
+    const whitespaceMatch = LEADING_WHITESPACE_REGEX.exec(raw);
+    const indent = whitespaceMatch ? whitespaceMatch[0].length : 0;
+    let content = raw.slice(indent);
+    if (content.trim() === "") {
+        return { raw, isBlank: true, indent, isListItem: false, contentIndent: 0 };
+    }
+    let isListItem = false;
+    let contentIndent = indent;
+    const listMatch = LIST_ITEM_PREFIX_REGEX.exec(content);
+    if (listMatch) {
+        isListItem = true;
+        contentIndent = indent + listMatch[0].length;
+        content = content.slice(listMatch[0].length);
+    }
+    const keyMatch = KEY_VALUE_LINE_REGEX.exec(content);
+    if (!keyMatch) {
+        return { raw, isBlank: false, indent, isListItem, contentIndent };
+    }
+    const key = ((_c = (_b = (_a = keyMatch[1]) !== null && _a !== void 0 ? _a : keyMatch[2]) !== null && _b !== void 0 ? _b : keyMatch[3]) !== null && _c !== void 0 ? _c : "").trim();
+    const valueStart = contentIndent + keyMatch[0].length;
+    return {
+        raw,
+        isBlank: false,
+        indent,
+        isListItem,
+        contentIndent,
+        key,
+        keyIsFreeText: keyMatch[3] !== undefined && FREE_TEXT_KEY_REGEX.test(keyMatch[3]),
+        value: raw.slice(valueStart).trim(),
+        valueStart,
+    };
+}
+// Strip a JSON trailing comma and surrounding quotes from a scalar.
+function unquote(value) {
+    let body = value.trim();
+    if (body.endsWith(",")) {
+        body = body.slice(0, -1).trimEnd();
+    }
+    if (body.length >= 2 &&
+        ((body.startsWith('"') && body.endsWith('"')) ||
+            (body.startsWith("'") && body.endsWith("'")))) {
+        body = body.slice(1, -1);
+    }
+    return body;
+}
+function isDocumentSeparator(line) {
+    return line.raw.trim() === "---";
+}
+function isBlockScalar(value) {
+    return BLOCK_SCALAR_REGEX.test(value);
+}
+// "data:" or "\"data\": {" — a mapping whose entries follow on later lines.
+function isContainerStart(value) {
+    return value === "" || value === "{";
+}
+// A value with no material in it, including a marker an earlier pass wrote.
+function isExemptValue(value) {
+    let body = value.trim();
+    if (body.endsWith(",")) {
+        body = body.slice(0, -1).trimEnd();
+    }
+    return (EXEMPT_VALUES.has(body) ||
+        body.startsWith(EXEMPT_VALUE_PREFIX) ||
+        unquote(body).startsWith(REDACTED_PREFIX));
+}
+function looksLikeCredentialName(name) {
+    return CREDENTIAL_NAME_REGEX.test(name.trim());
+}
+// A key that names credential material, minus the reference-only keys.
+function isCredentialKey(key) {
+    const normalized = key.trim().replace(/^-+/, "").toLowerCase();
+    if (REFERENCE_ONLY_KEYS.has(normalized)) {
+        return false;
+    }
+    return looksLikeCredentialName(normalized);
+}
+/*
+ * An argv element that can be a flag's value: not the next flag, not
+ * empty, not a marker this module already wrote.
+ */
+function isArgvValue(element) {
+    return !element.startsWith("-") && !isExemptValue(element);
+}
+// The short password flag of the tool an argv element names, if any.
+function shortPasswordFlagOfTool(element) {
+    return SHORT_PASSWORD_FLAG_BY_TOOL.get(element.slice(element.lastIndexOf("/") + 1));
+}
+/*
+ * A scalar replaced by the marker, keeping its quotes, a JSON trailing
+ * comma and `keptPrefix` (the "-p" of "-pS3cret").
+ */
+function maskScalar(value, keptPrefix = "") {
+    const trailingComma = value.trimEnd().endsWith(",") ? "," : "";
+    const body = trailingComma
+        ? value.trimEnd().slice(0, -1).trimEnd()
+        : value.trim();
+    if (body.startsWith('"')) {
+        return `"${keptPrefix}${KUBECTL_REDACTED_MARKER}"${trailingComma}`;
+    }
+    if (body.startsWith("'")) {
+        return `'${keptPrefix}${KUBECTL_REDACTED_MARKER}'${trailingComma}`;
+    }
+    return `${keptPrefix}${KUBECTL_REDACTED_MARKER}${trailingComma}`;
+}
+/*
+ * A bare value found inside a line, replaced by the marker. When the value
+ * ends the body of an escaped JSON string (`…=S3cret\"`), the backslash
+ * belongs to the closing quote and stays.
+ */
+function maskInlineValue(value) {
+    if (value.startsWith('"') || value.startsWith("'")) {
+        return maskScalar(value);
+    }
+    return `${KUBECTL_REDACTED_MARKER}${value.endsWith("\\") ? "\\" : ""}`;
+}
+/*
+ * The part of a `key: value` line before its value. A key that may be free
+ * text gets the inline rules; an ordinary key is returned as it is.
+ */
+function redactKeyPrefix(line) {
+    var _a;
+    const prefix = line.raw.slice(0, (_a = line.valueStart) !== null && _a !== void 0 ? _a : 0);
+    if (!line.keyIsFreeText) {
+        return { text: prefix, count: 0 };
+    }
+    const inline = applyInlineRules(prefix.slice(line.contentIndent));
+    return {
+        text: prefix.slice(0, line.contentIndent) + inline.text,
+        count: inline.count,
+    };
+}
+function maskValueInPlace(line) {
+    if (line.valueStart === undefined || line.value === undefined) {
+        return {
+            text: " ".repeat(line.indent) + KUBECTL_REDACTED_MARKER,
+            count: 1,
+        };
+    }
+    const prefix = redactKeyPrefix(line);
+    return {
+        text: prefix.text + maskScalar(line.value),
+        count: prefix.count + 1,
+    };
+}
+// The first line at or above `indent` — the end of a nested block.
+function skipDeeperLines(parsed, from, indent) {
+    let index = from;
+    while (index < parsed.length) {
+        const line = parsed[index];
+        if (!line.isBlank && line.indent <= indent) {
+            break;
+        }
+        index++;
+    }
+    return index;
+}
+const UPPERCASE_REGEX = /[A-Z]/;
+const LOWERCASE_REGEX = /[a-z]/;
+const DIGIT_REGEX = /[0-9]/;
+function hasUpperAndLower(text) {
+    return UPPERCASE_REGEX.test(text) && LOWERCASE_REGEX.test(text);
+}
+function hasDigit(text) {
+    return DIGIT_REGEX.test(text);
+}
+// `Bearer …` / `Basic …`: the token after the scheme, unless it is prose.
+function maskAuthorizationTokens(text, regex) {
+    let count = 0;
+    const result = text.replace(regex, (match, scheme, token) => {
+        if (LOWERCASE_WORD_REGEX.test(token)) {
+            return match;
+        }
+        count++;
+        return `${scheme} ${KUBECTL_REDACTED_MARKER}`;
+    });
+    return { text: result, count };
+}
+/*
+ * One-line JSON env pairs, `"name":"X","value":"Y"` in either order: the
+ * value is masked when the name looks credential-like and the value holds
+ * something (an empty value, or one already masked, stays as it is).
+ */
+function maskJsonEnvPairs(text, regexes) {
+    let count = 0;
+    let result = text.replace(regexes.nameFirst, (match, prefix, name, value, closingQuote) => {
+        if (!looksLikeCredentialName(name) || isExemptValue(value)) {
+            return match;
+        }
+        count++;
+        return `${prefix}${KUBECTL_REDACTED_MARKER}${closingQuote}`;
+    });
+    result = result.replace(regexes.valueFirst, (match, prefix, value, suffix, name) => {
+        if (!looksLikeCredentialName(name) || isExemptValue(value)) {
+            return match;
+        }
+        count++;
+        return `${prefix}${KUBECTL_REDACTED_MARKER}${suffix}`;
+    });
+    return { text: result, count };
+}
+/*
+ * One-line JSON `"key":"value"` pairs whose key looks credential-like, and
+ * the last-applied-configuration annotation as jsonpath prints it. The
+ * quotes stay, so the JSON still parses; a bare number becomes a string.
+ */
+function maskJsonCredentialPairs(text, rule) {
+    let count = 0;
+    const result = text.replace(rule.regex, (match, prefix, key, openingQuote, body, closingQuote, bare) => {
+        if (key !== LAST_APPLIED_CONFIGURATION_ANNOTATION &&
+            !isCredentialKey(key)) {
+            return match;
+        }
+        if (openingQuote !== undefined) {
+            if (isExemptValue(body !== null && body !== void 0 ? body : "")) {
+                return match;
+            }
+            count++;
+            return `${prefix}${openingQuote}${KUBECTL_REDACTED_MARKER}${closingQuote !== null && closingQuote !== void 0 ? closingQuote : ""}`;
+        }
+        if (bare === undefined) {
+            return match;
+        }
+        count++;
+        return `${prefix}${rule.quote}${KUBECTL_REDACTED_MARKER}${rule.quote}`;
+    });
+    return { text: result, count };
+}
+// `"--db-password","value"` in a one-line array: the value is masked.
+function maskQuotedFlagPairs(text, regex) {
+    let count = 0;
+    const result = text.replace(regex, (match, prefix, flag, value, closingQuote) => {
+        if (!isCredentialKey(flag) || !isArgvValue(value)) {
+            return match;
+        }
+        count++;
+        return `${prefix}${KUBECTL_REDACTED_MARKER}${closingQuote}`;
+    });
+    return { text: result, count };
+}
+// `--requirepass value` inside one line: the value is masked.
+function maskInlineSplitFlags(text) {
+    let count = 0;
+    const result = text.replace(INLINE_SPLIT_FLAG_REGEX, (match, boundary, flag, separator, value) => {
+        if (!isCredentialKey(flag) || !isArgvValue(unquote(value))) {
+            return match;
+        }
+        count++;
+        return `${boundary}${flag}${separator}${maskInlineValue(value)}`;
+    });
+    return { text: result, count };
+}
+// A tool's short password flag within the stretch of a line that is its command.
+function maskShortPasswordFlag(text, letter) {
+    const regexes = SHORT_PASSWORD_FLAG_REGEXES.get(letter);
+    if (!regexes) {
+        return { text, count: 0 };
+    }
+    let count = 0;
+    let result = text.replace(regexes.separated, (match, boundary, flag, separator, value) => {
+        if (!isArgvValue(unquote(value))) {
+            return match;
+        }
+        count++;
+        return `${boundary}${flag}${separator}${maskInlineValue(value)}`;
+    });
+    result = result.replace(regexes.attached, (_match, boundary, flag, value) => {
+        count++;
+        return `${boundary}${flag}${maskInlineValue(value)}`;
+    });
+    return { text: result, count };
+}
+/*
+ * `mysql -pS3cret`, `mongosh -p S3cret`, `redis-cli -a S3cret`: a tool's
+ * short password flag, judged only in the stretch of the line from the
+ * tool's name to the next tool or the end of its command (`]`, `)`, `;`,
+ * `|`, `&`, a backtick).
+ */
+function maskToolPasswordFlags(text) {
+    var _a, _b, _c;
+    const tools = [];
+    TOOL_NAME_REGEX.lastIndex = 0;
+    let match = TOOL_NAME_REGEX.exec(text);
+    while (match) {
+        const start = match.index + ((_a = match[1]) !== null && _a !== void 0 ? _a : "").length;
+        const name = (_b = match[2]) !== null && _b !== void 0 ? _b : "";
+        tools.push({
+            start,
+            end: start + name.length,
+            letter: (_c = SHORT_PASSWORD_FLAG_BY_TOOL.get(name)) !== null && _c !== void 0 ? _c : "",
+        });
+        match = TOOL_NAME_REGEX.exec(text);
+    }
+    TOOL_NAME_REGEX.lastIndex = 0;
+    if (tools.length === 0) {
+        return { text, count: 0 };
+    }
+    let result = "";
+    let count = 0;
+    let cursor = 0;
+    tools.forEach((tool, toolIndex) => {
+        /*
+         * Only the stretch up to the next tool is searched for the command's
+         * end, so a line naming a tool many times is still scanned once.
+         */
+        const nextTool = tools[toolIndex + 1];
+        const stretch = text.slice(tool.end, nextTool ? nextTool.start : text.length);
+        const commandEnd = stretch.search(COMMAND_END_REGEX);
+        const command = commandEnd === -1 ? stretch : stretch.slice(0, commandEnd);
+        result += text.slice(cursor, tool.end);
+        const masked = maskShortPasswordFlag(command, tool.letter);
+        result += masked.text;
+        count += masked.count;
+        cursor = tool.end + command.length;
+    });
+    result += text.slice(cursor);
+    return { text: result, count };
+}
+/*
+ * Mask the body of every one-line `"data":{…}` object. Braces are matched
+ * by depth; an object the line truncated away is masked to the end.
+ */
+function maskInlineJsonDataObjects(text) {
+    var _a;
+    let result = text;
+    let count = 0;
+    let searchFrom = 0;
+    while (searchFrom < result.length) {
+        INLINE_JSON_DATA_OBJECT_REGEX.lastIndex = searchFrom;
+        const match = INLINE_JSON_DATA_OBJECT_REGEX.exec(result);
+        if (!match) {
+            break;
+        }
+        const quote = (_a = match[1]) !== null && _a !== void 0 ? _a : '"';
+        const bodyStart = match.index + match[0].length;
+        let depth = 1;
+        let position = bodyStart;
+        while (position < result.length && depth > 0) {
+            const character = result[position];
+            if (character === "{") {
+                depth++;
+            }
+            else if (character === "}") {
+                depth--;
+            }
+            position++;
+        }
+        // `position` is just past the closing brace, or the end of the text.
+        const bodyEnd = depth === 0 ? position - 1 : result.length;
+        if (result.slice(bodyStart, bodyEnd).trim() === "") {
+            searchFrom = position;
+            continue;
+        }
+        const replacement = `${quote}${KUBECTL_REDACTED_MARKER}${quote}:${quote}${KUBECTL_REDACTED_MARKER}${quote}`;
+        result = result.slice(0, bodyStart) + replacement + result.slice(bodyEnd);
+        count++;
+        searchFrom = bodyStart + replacement.length;
+    }
+    INLINE_JSON_DATA_OBJECT_REGEX.lastIndex = 0;
+    return { text: result, count };
+}
+// The rules that apply to any line regardless of its YAML/JSON structure.
+function applyInlineRules(text) {
+    let count = 0;
+    let result = text;
+    const apply = (masked) => {
+        result = masked.text;
+        count += masked.count;
+    };
+    result = result.replace(URL_CREDENTIAL_REGEX, (_match, user) => {
+        count++;
+        return `://${user}:${KUBECTL_REDACTED_MARKER}@`;
+    });
+    for (const tokenRegex of [BEARER_TOKEN_REGEX, BASIC_TOKEN_REGEX]) {
+        apply(maskAuthorizationTokens(result, tokenRegex));
+    }
+    result = result.replace(JWT_REGEX, () => {
+        count++;
+        return "[redacted-jwt]";
+    });
+    apply(maskInlineJsonDataObjects(result));
+    for (const pair of JSON_ENV_PAIR_REGEXES) {
+        apply(maskJsonEnvPairs(result, pair));
+    }
+    for (const rule of JSON_CREDENTIAL_PAIR_RULES) {
+        apply(maskJsonCredentialPairs(result, rule));
+    }
+    for (const regex of QUOTED_FLAG_PAIR_REGEXES) {
+        apply(maskQuotedFlagPairs(result, regex));
+    }
+    result = result.replace(INLINE_PAIR_REGEX, (match, boundary, key, separator, value) => {
+        if (isImageReferencePair(key, separator) ||
+            !isCredentialKey(key) ||
+            isExemptValue(value)) {
+            return match;
+        }
+        count++;
+        return `${boundary}${key}${separator}${KUBECTL_REDACTED_MARKER}${value.endsWith("\\") ? "\\" : ""}`;
+    });
+    apply(maskInlineSplitFlags(result));
+    apply(maskToolPasswordFlags(result));
+    result = result.replace(BASE64_PADDED_REGEX, (match, run) => {
+        if (!hasUpperAndLower(run) && !hasDigit(run)) {
+            return match;
+        }
+        count++;
+        return "[redacted-base64]";
+    });
+    result = result.replace(BASE64_LONG_REGEX, (match, run) => {
+        if (!hasUpperAndLower(run) || !hasDigit(run)) {
+            return match;
+        }
+        count++;
+        return "[redacted-base64]";
+    });
+    return { text: result, count };
+}
+/*
+ * The inline rules over one line. A line that already parsed as
+ * `key: value` has its value examined, and its key only when the key may
+ * be free text: its key was judged by isCredentialKey (and possibly
+ * exempted), and re-reading "Image pull secrets:" as the pair "secrets:
+ * <none>" must not undo that.
+ */
+function applyInlineRulesToLine(line) {
+    if (line.valueStart === undefined || line.value === undefined) {
+        return applyInlineRules(line.raw);
+    }
+    const prefix = redactKeyPrefix(line);
+    const inline = applyInlineRules(line.raw.slice(line.valueStart));
+    return {
+        text: prefix.text + inline.text,
+        count: prefix.count + inline.count,
+    };
+}
+export default class KubectlOutputRedactor {
+    static redact(output) {
+        var _a;
+        if (!output) {
+            return { text: "", redactionCount: 0 };
+        }
+        const parsed = output
+            .replace(/\r\n?/g, "\n")
+            .split("\n")
+            .map(parseLine);
+        const masks = {
+            envValueLines: KubectlOutputRedactor.findCredentialEnvValueLines(parsed),
+            argvValueLines: KubectlOutputRedactor.findArgvValueLines(parsed),
+        };
+        const out = [];
+        let count = 0;
+        let index = 0;
+        while (index < parsed.length) {
+            const line = parsed[index];
+            let step;
+            if (KubectlOutputRedactor.isDescribeDataEntry(parsed, index) &&
+                isCredentialKey((_a = line.key) !== null && _a !== void 0 ? _a : "")) {
+                step = KubectlOutputRedactor.redactDescribeDataEntry(parsed, index);
+            }
+            else if (!line.isBlank &&
+                line.key !== undefined &&
+                DATA_BLOCK_KEYS.has(line.key) &&
+                isContainerStart(line.value)) {
+                step = KubectlOutputRedactor.redactDataBlock(parsed, index, masks);
+            }
+            else {
+                step = KubectlOutputRedactor.redactStandaloneLine(parsed, index, masks);
+            }
+            out.push(...step.lines);
+            count += step.count;
+            index = step.next;
+        }
+        let text = out.join("\n");
+        text = text.replace(PRIVATE_KEY_BLOCK_REGEX, () => {
+            count++;
+            return "[redacted-private-key]";
+        });
+        return { text, redactionCount: count };
+    }
+    /*
+     * Which `value:` lines belong to an env entry whose `name:` looks
+     * credential-like. Found up front because the value may precede the name
+     * inside its entry, and the main pass only ever moves forward.
+     */
+    static findCredentialEnvValueLines(parsed) {
+        const valueLines = new Set();
+        for (let index = 0; index < parsed.length; index++) {
+            const line = parsed[index];
+            if (line.isBlank || line.key !== "name" || line.value === undefined) {
+                continue;
+            }
+            const name = unquote(line.value);
+            if (!name || !looksLikeCredentialName(name)) {
+                continue;
+            }
+            const valueLine = KubectlOutputRedactor.findSiblingValueLine(parsed, index);
+            if (valueLine !== undefined) {
+                valueLines.add(valueLine);
+            }
+        }
+        return valueLines;
+    }
+    /*
+     * Argv printed one element per line — `- --db-password` / `- value` in
+     * YAML, `"--db-password",` / `"value"` in pretty JSON, describe's Command
+     * and Args blocks — and the elements that are the value of a credential
+     * flag before them, each with its masked text. A list's elements are
+     * consecutive lines at the same indent and of the same shape; a
+     * `key: value` line ends it (describe prints an argument that contains
+     * ": " as is, so a flag's value may look like one). A tool's short
+     * password flag counts only once the list has named the tool.
+     */
+    static findArgvValueLines(parsed) {
+        const masked = new Map();
+        let list = undefined;
+        for (let index = 0; index < parsed.length; index++) {
+            const line = parsed[index];
+            if (line.isBlank) {
+                continue;
+            }
+            // "- key: value" is a mapping entry, never an argv element.
+            if (line.isListItem && line.key !== undefined) {
+                list = undefined;
+                continue;
+            }
+            if (list === undefined ||
+                list.indent !== line.indent ||
+                list.isListItem !== line.isListItem) {
+                list = {
+                    indent: line.indent,
+                    isListItem: line.isListItem,
+                    shortPasswordFlag: undefined,
+                    expectsValue: false,
+                };
+            }
+            const indentText = line.raw.slice(0, line.contentIndent);
+            const content = line.raw.slice(line.contentIndent);
+            const element = unquote(content);
+            if (list.expectsValue) {
+                list.expectsValue = false;
+                if (isArgvValue(element)) {
+                    masked.set(index, indentText + maskScalar(content));
+                    continue;
+                }
+            }
+            if (line.key !== undefined) {
+                list = undefined;
+                continue;
+            }
+            const shortFlag = list.shortPasswordFlag !== undefined
+                ? `-${list.shortPasswordFlag}`
+                : undefined;
+            if (shortFlag !== undefined && element.startsWith(shortFlag)) {
+                const attached = element.slice(shortFlag.length);
+                if (attached === "") {
+                    list.expectsValue = true;
+                }
+                else if (isArgvValue(attached)) {
+                    masked.set(index, indentText + maskScalar(content, shortFlag));
+                }
+                continue;
+            }
+            if (FLAG_TOKEN_REGEX.test(element) && isCredentialKey(element)) {
+                list.expectsValue = true;
+                continue;
+            }
+            const toolFlag = shortPasswordFlagOfTool(element);
+            if (toolFlag !== undefined) {
+                list.shortPasswordFlag = toolFlag;
+            }
+        }
+        return masked;
+    }
+    /*
+     * The `value:` sibling of a `name:` line inside the same list entry (YAML)
+     * or object (JSON). Siblings share the name line's content indent; a
+     * shallower line ends the entry, a deeper one is nested under a sibling.
+     */
+    static findSiblingValueLine(parsed, nameIndex) {
+        const nameLine = parsed[nameIndex];
+        const indent = nameLine.contentIndent;
+        for (let index = nameIndex + 1; index < parsed.length; index++) {
+            const line = parsed[index];
+            if (line.isBlank) {
+                continue;
+            }
+            if (line.indent < indent) {
+                break;
+            }
+            if (line.indent > indent || line.isListItem) {
+                continue;
+            }
+            if (line.key === "value") {
+                return index;
+            }
+        }
+        // "- name: X" is its entry's first line: nothing above it is a sibling.
+        if (nameLine.isListItem) {
+            return undefined;
+        }
+        for (let index = nameIndex - 1; index >= 0; index--) {
+            const line = parsed[index];
+            if (line.isBlank) {
+                continue;
+            }
+            if (line.isListItem && line.contentIndent === indent) {
+                // The entry's own "- …" line — a sibling, and the entry's start.
+                return line.key === "value" ? index : undefined;
+            }
+            if (line.indent < indent) {
+                break;
+            }
+            if (line.indent > indent || line.isListItem) {
+                continue;
+            }
+            if (line.key === "value") {
+                return index;
+            }
+        }
+        return undefined;
+    }
+    /*
+     * The `kind:` sibling of a data block: same indent, same object, on
+     * either side of the block. Undefined when the output does not say — a
+     * truncated object, or not a Kubernetes object at all.
+     */
+    static findSiblingKind(parsed, blockIndex) {
+        const indent = parsed[blockIndex].contentIndent;
+        for (let index = blockIndex - 1; index >= 0; index--) {
+            const line = parsed[index];
+            if (line.isBlank) {
+                continue;
+            }
+            if (isDocumentSeparator(line)) {
+                break;
+            }
+            if (line.indent > indent) {
+                continue;
+            }
+            if (line.isListItem && line.contentIndent === indent) {
+                // The entry's own "- …" line: its first key, and the entry's start.
+                if (line.key === "kind" && line.value !== undefined) {
+                    return unquote(line.value);
+                }
+                break;
+            }
+            if (line.indent < indent) {
+                break;
+            }
+            if (line.isListItem) {
+                continue;
+            }
+            if (line.key === "kind" && line.value !== undefined) {
+                return unquote(line.value);
+            }
+        }
+        for (let index = blockIndex + 1; index < parsed.length; index++) {
+            const line = parsed[index];
+            if (line.isBlank) {
+                continue;
+            }
+            if (isDocumentSeparator(line)) {
+                break;
+            }
+            if (line.indent > indent) {
+                continue;
+            }
+            if (line.indent < indent) {
+                break;
+            }
+            if (line.isListItem) {
+                continue;
+            }
+            if (line.key === "kind" && line.value !== undefined) {
+                return unquote(line.value);
+            }
+        }
+        return undefined;
+    }
+    /*
+     * A `kubectl describe configmap` data entry: "KEY:" with nothing after
+     * the colon, then the "----" rule at the same indent on the next line.
+     */
+    static isDescribeDataEntry(parsed, index) {
+        const line = parsed[index];
+        const rule = parsed[index + 1];
+        return (line !== undefined &&
+            rule !== undefined &&
+            !line.isBlank &&
+            !line.isListItem &&
+            line.key !== undefined &&
+            line.value === "" &&
+            !rule.isBlank &&
+            rule.indent === line.indent &&
+            rule.raw.trim() === DESCRIBE_DATA_ENTRY_RULE);
+    }
+    /*
+     * Where a describe data entry's value ends: at the next entry or the
+     * "BinaryData" heading after the last one — each follows a blank line at
+     * the entry's indent — or at the end of the output.
+     */
+    static isDescribeDataValueEnd(parsed, index, indent) {
+        const line = parsed[index];
+        const previous = parsed[index - 1];
+        const next = parsed[index + 1];
+        if (line.isBlank || line.indent !== indent || !(previous === null || previous === void 0 ? void 0 : previous.isBlank)) {
+            return false;
+        }
+        if (KubectlOutputRedactor.isDescribeDataEntry(parsed, index)) {
+            return true;
+        }
+        return (line.raw.trim() === DESCRIBE_BINARY_DATA_HEADING &&
+            next !== undefined &&
+            next.raw.trim() === DESCRIBE_SECTION_RULE);
+    }
+    /*
+     * A credential-like describe data entry. The key and the rule stay; the
+     * whole value — every line of it, blank lines included, since a
+     * properties file or a PEM block has them — becomes one marker, and the
+     * blank lines that close the entry stay. A value the Runner truncated
+     * is masked to the end of the output.
+     */
+    static redactDescribeDataEntry(parsed, headerIndex) {
+        const header = parsed[headerIndex];
+        const valueStart = headerIndex + 2;
+        let end = valueStart;
+        while (end < parsed.length &&
+            !KubectlOutputRedactor.isDescribeDataValueEnd(parsed, end, header.indent)) {
+            end++;
+        }
+        let lastValueLine = valueStart - 1;
+        for (let index = valueStart; index < end; index++) {
+            if (!parsed[index].isBlank) {
+                lastValueLine = index;
+            }
+        }
+        const lines = [header.raw, parsed[headerIndex + 1].raw];
+        let count = 0;
+        if (lastValueLine >= valueStart) {
+            const valueLines = parsed.slice(valueStart, lastValueLine + 1);
+            const isAlreadyMasked = valueLines.every((line) => {
+                return line.isBlank || line.raw.trim() === KUBECTL_REDACTED_MARKER;
+            });
+            if (isAlreadyMasked) {
+                lines.push(...valueLines.map((line) => {
+                    return line.raw;
+                }));
+            }
+            else {
+                lines.push(" ".repeat(header.indent) + KUBECTL_REDACTED_MARKER);
+                count++;
+            }
+        }
+        for (let index = lastValueLine + 1; index < end; index++) {
+            lines.push(parsed[index].raw);
+        }
+        return { lines, next: end, count };
+    }
+    /*
+     * A `data:` / `stringData:` / `binaryData:` block. Every value is masked
+     * for a Secret or an object of unknown kind; only credential-like keys
+     * are masked for anything else. Keys are kept either way.
+     */
+    static redactDataBlock(parsed, blockIndex, masks) {
+        const block = parsed[blockIndex];
+        const kind = KubectlOutputRedactor.findSiblingKind(parsed, blockIndex);
+        const maskEveryValue = kind === undefined || kind.toLowerCase() === "secret";
+        const lines = [block.raw];
+        let count = 0;
+        let index = blockIndex + 1;
+        let entryIndent = undefined;
+        let entryMasked = false;
+        while (index < parsed.length) {
+            const line = parsed[index];
+            if (line.isBlank) {
+                if (!entryMasked) {
+                    lines.push(line.raw);
+                }
+                index++;
+                continue;
+            }
+            if (line.indent <= block.contentIndent) {
+                break;
+            }
+            if (entryIndent === undefined) {
+                entryIndent = line.indent;
+            }
+            // Deeper than an entry: a block scalar body or nested structure.
+            if (line.indent > entryIndent) {
+                if (maskEveryValue || entryMasked) {
+                    index++;
+                    continue;
+                }
+                const nested = KubectlOutputRedactor.redactStandaloneLine(parsed, index, masks);
+                lines.push(...nested.lines);
+                count += nested.count;
+                index = nested.next;
+                continue;
+            }
+            if (line.key === undefined) {
+                // Not "key: value" — an unexpected shape inside a data block.
+                if (maskEveryValue) {
+                    lines.push(" ".repeat(line.indent) + KUBECTL_REDACTED_MARKER);
+                    count++;
+                    entryMasked = true;
+                }
+                else {
+                    const inline = applyInlineRules(line.raw);
+                    lines.push(inline.text);
+                    count += inline.count;
+                    entryMasked = false;
+                }
+                index++;
+                continue;
+            }
+            if (maskEveryValue || isCredentialKey(line.key)) {
+                if (line.value !== undefined && !isExemptValue(line.value)) {
+                    const masked = maskValueInPlace(line);
+                    lines.push(masked.text);
+                    count += masked.count;
+                }
+                else {
+                    lines.push(line.raw);
+                }
+                entryMasked = true;
+                index++;
+                continue;
+            }
+            const inline = applyInlineRulesToLine(line);
+            lines.push(inline.text);
+            count += inline.count;
+            entryMasked = false;
+            index++;
+        }
+        return { lines, next: index, count };
+    }
+    /*
+     * One line outside a data block: env value, argv value, credential-like
+     * key, inline rules.
+     */
+    static redactStandaloneLine(parsed, index, masks) {
+        var _a;
+        const line = parsed[index];
+        if (line.isBlank) {
+            return { lines: [line.raw], next: index + 1, count: 0 };
+        }
+        if (masks.envValueLines.has(index) && line.value !== undefined) {
+            if (isBlockScalar(line.value)) {
+                const masked = maskValueInPlace(line);
+                return {
+                    lines: [masked.text],
+                    next: skipDeeperLines(parsed, index + 1, line.contentIndent),
+                    count: masked.count,
+                };
+            }
+            if (!isExemptValue(line.value)) {
+                const masked = maskValueInPlace(line);
+                return { lines: [masked.text], next: index + 1, count: masked.count };
+            }
+        }
+        const argvValue = masks.argvValueLines.get(index);
+        if (argvValue !== undefined) {
+            return { lines: [argvValue], next: index + 1, count: 1 };
+        }
+        if (line.key !== undefined &&
+            line.value !== undefined &&
+            (line.key === LAST_APPLIED_CONFIGURATION_ANNOTATION ||
+                isCredentialKey(line.key))) {
+            if (isBlockScalar(line.value)) {
+                const masked = maskValueInPlace(line);
+                return {
+                    lines: [masked.text],
+                    next: skipDeeperLines(parsed, index + 1, line.contentIndent),
+                    count: masked.count,
+                };
+            }
+            if (!isExemptValue(line.value)) {
+                const masked = maskValueInPlace(line);
+                return { lines: [masked.text], next: index + 1, count: masked.count };
+            }
+            /*
+             * A credential-like key with nothing to hide on this line: its
+             * children are judged on their own, and describe's "<set to the key
+             * …>" reference must not be chewed up by the inline pair rule.
+             */
+            const prefix = redactKeyPrefix(line);
+            return {
+                lines: [prefix.text + line.raw.slice((_a = line.valueStart) !== null && _a !== void 0 ? _a : 0)],
+                next: index + 1,
+                count: prefix.count,
+            };
+        }
+        const inline = applyInlineRulesToLine(line);
+        return { lines: [inline.text], next: index + 1, count: inline.count };
+    }
+}
+//# sourceMappingURL=KubectlOutputRedactor.js.map