@oneuptime/common 14.0.8 → 14.0.10

package/build/dist/Utils/AiRemediation/Resource/ResourceOutputRedactor.js

@@ -0,0 +1,1910 @@
+/*
+ * Redacts credential-looking material from the output of a command a
+ * resource AI agent ran, before it leaves the agent, before the server
+ * stores it next to an AI run, and before a language model reads it.
+ *
+ * Two layers, applied in this order:
+ *  1. Per-program hooks (RESOURCE_OUTPUT_REDACTION_HOOKS) for material only
+ *     one tool prints: every value of a `docker inspect` "Env" list, a Ceph
+ *     keyring's `key`. Each tool's kit extends its program's entry.
+ *  2. The generic rules (GenericOutputRedactor): any `key: value` or
+ *     `key=value` whose key looks credential-like, credential flags and
+ *     their values, env name/value pairs, `scheme://user:password@`, Bearer
+ *     and Basic tokens, JWTs, PEM private keys and long or padded base64.
+ *
+ * GenericOutputRedactor is a COPY of Utils/AiRemediation/
+ * KubectlOutputRedactor (everything from its KubectlOutputRedaction
+ * interface on), with only these renames: KubectlOutputRedactor ->
+ * GenericOutputRedactor (and `export default class` -> `export class`),
+ * KubectlOutputRedaction -> GenericOutputRedaction, KUBECTL_REDACTED_MARKER
+ * -> GENERIC_REDACTED_MARKER. It is copied, not imported, because this
+ * directory is import-closed (the resource AI agent carries a
+ * byte-identical copy of it); ResourceOutputRedactorCopyParity.test.ts
+ * fails the moment the two drift, so fix KubectlOutputRedactor and re-copy.
+ * Its Kubernetes-specific rules (data blocks, describe output,
+ * last-applied-configuration) are harmless on other tools' output.
+ *
+ * Over-masking is accepted; under-masking is not.
+ */
+import { redactDatabaseOutput } from "./DatabaseQueryRedactor";
+export const GENERIC_REDACTED_MARKER = "[redacted]";
+// Every marker this module writes starts with it: "[redacted-jwt]" too.
+const REDACTED_PREFIX = "[redacted";
+const DATA_BLOCK_KEYS = new Set([
+    "data",
+    "stringData",
+    "binaryData",
+]);
+const LAST_APPLIED_CONFIGURATION_ANNOTATION = "kubectl.kubernetes.io/last-applied-configuration";
+/*
+ * A key or env name that names credential material. Deliberately broad:
+ * `auth` also catches "authorization-mode", which is harmless to hide,
+ * while a narrow list would miss "DB_PASSWORD". A bare `key` is NOT
+ * credential-like (taints, tolerations and secretKeyRef all have one), but
+ * `tls.key`, `KEY_ID`, `api_key` and `private-key-file` are.
+ *
+ * `pass`, `pw` and `creds` count as a whole segment only — DB_PASS,
+ * RABBITMQ_DEFAULT_PASS, LDAP_BIND_PW, DB_CREDS, `--pass` — so "bypass",
+ * "compass", "passed", "MAX_PASSES" and "ssl-passthrough" stay readable,
+ * and "pass-through" is spelled out as not a credential. A few names glue
+ * a prefix on instead: Redis's `requirepass`, "dbpass", "smtppass".
+ */
+const CREDENTIAL_NAME_REGEX = /passw(?:or)?d|passwd|pwd|passphrase|passcode|(?:^|[-_./])pass(?:$|[-_.](?!through))|(?:require|db|user|admin|root|smtp|mail|redis|ldap|bind|sasl|ftp)pass(?![a-z])|(?:^|[-_./])(?:pw|creds?)(?:$|[-_.])|secret|token|credential|auth|cert|bearer|cookie|dockerconfig|dockercfg|webhook|(?:api|access|private|priv|encryption|signing|client|ssh|master|license|service|account|session|app|consumer|shared)[-_.]?key|(?:^|[-_./])key[-_.]|[-_./]key$|(?:^|[-_./])(?:dsn|salt|otp)(?:[-_.]|$)|\.(?:crt|cer|pem|p12|pfx|jks)$/i;
+/*
+ * Keys that match the pattern above but only ever REFER to a credential —
+ * the name of a Secret a volume mounts, whether a token is automounted —
+ * and that an on-call engineer needs when a pod cannot start. Compared
+ * lowercase, with leading dashes stripped so flag names match too.
+ */
+const REFERENCE_ONLY_KEYS = new Set([
+    "secretname",
+    "secretnamespace",
+    "secretproviderclass",
+    "secretkeyref",
+    "secretref",
+    "configmapkeyref",
+    "tokenexpirationseconds",
+    "expirationseconds",
+    "serviceaccounttoken",
+    "automountserviceaccounttoken",
+    "imagepullsecrets",
+    "image pull secrets",
+    "mountable secrets",
+    "tokens",
+    "audience",
+    "authorization-mode",
+    "anonymous-auth",
+    "tls-min-version",
+    "tls-cipher-suites",
+    "cert-manager.io/cluster-issuer",
+    "cert-manager.io/issuer",
+]);
+/*
+ * Values that carry no material and read better untouched: an absent
+ * value, and describe's own "<set to the key 'x' in secret 'y'>" reference
+ * for an env entry that comes from a Secret.
+ */
+const EXEMPT_VALUES = new Set([
+    "",
+    '""',
+    "''",
+    "null",
+    "~",
+    "{}",
+    "[]",
+    "{",
+    "[",
+    "<none>",
+    "<nil>",
+    "<unset>",
+    "<invalid>",
+    "<empty>",
+]);
+const EXEMPT_VALUE_PREFIX = "<set to the key ";
+// YAML block scalar indicators: |, |-, |+, >, >-, >2 ...
+const BLOCK_SCALAR_REGEX = /^[|>][+-]?[0-9]*$/;
+/*
+ * `key: value`, `key:` and `"key": value,` at the start of a line's content.
+ * Unquoted keys may contain spaces (describe prints "Image ID:") but never
+ * a colon, so "2026-09-22T10:00:00Z" and "http://…" are not keys. The colon
+ * must be followed by whitespace or end the line for the same reason.
+ */
+const KEY_VALUE_LINE_REGEX = /^(?:"([^"]*)"|'([^']*)'|([^\s"'#:{}[\],][^:"']*?))[ \t]*:(?:[ \t]+|$)/;
+/*
+ * An unquoted key with whitespace or `=` in it may be free text rather than
+ * a name: "connecting DB_PASSWORD=hunter2 host: db" parses as the key
+ * "connecting DB_PASSWORD=hunter2 host". Such a key is scanned for inline
+ * material too.
+ */
+const FREE_TEXT_KEY_REGEX = /[\s=]/;
+const LIST_ITEM_PREFIX_REGEX = /^-(?:[ \t]+|$)/;
+const LEADING_WHITESPACE_REGEX = /^[ \t]*/;
+/*
+ * scheme://user:password@host — the password only; an empty user still
+ * counts. The match starts at "://" and the scheme is checked by a
+ * lookbehind, so the scan stays linear: a pattern that STARTS with the
+ * scheme retries `[a-z][a-z0-9+.-]*` from every word boundary of a long
+ * dotted run ("eyJ.eyJ.eyJ…", "a.b.c.…") and backtracks through the whole
+ * run each time — 200 KB of pod log took over 30 seconds on one thread.
+ */
+const URL_CREDENTIAL_REGEX = /:\/\/(?<=\b[a-z][a-z0-9+.-]*:\/\/)([^\s/:@"']*):([^\s/@"']+)@/gi;
+const BEARER_TOKEN_REGEX = /\b(Bearer)[ \t]+([A-Za-z0-9._~+/-]{8,}=*)/g;
+// Prose ("Basic configuration", "Bearer authentication") is lowercase letters only.
+const LOWERCASE_WORD_REGEX = /^[a-z]+$/;
+const BASIC_TOKEN_REGEX = /\b(Basic)[ \t]+([A-Za-z0-9+/]{8,}={0,2})(?![A-Za-z0-9+/=])/g;
+const JWT_REGEX = /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{5,}/g;
+/*
+ * PEM private key blocks. A block whose END line was truncated away is
+ * masked to the end of the output rather than left standing.
+ */
+const PRIVATE_KEY_BLOCK_REGEX = /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY-----[\s\S]*?(?:-----END (?:[A-Z0-9]+ )*PRIVATE KEY-----|$)/g;
+/*
+ * Compact JSON, as in a one-line `"data":{...}` — the quote may be escaped
+ * when the JSON itself sits inside a JSON string.
+ */
+const INLINE_JSON_DATA_OBJECT_REGEX = /("|\\")(?:data|stringData|binaryData)(?:"|\\")\s*:\s*\{/g;
+/*
+ * A JSON string body: anything but an unescaped quote. Two spellings, for
+ * plain JSON and for JSON escaped inside another JSON string.
+ */
+const JSON_STRING_BODY = '(?:[^"\\\\]|\\\\.)*';
+const ESCAPED_JSON_STRING_BODY = '(?:[^"\\\\]|\\\\[^"])*';
+const JSON_QUOTE = '"';
+const ESCAPED_JSON_QUOTE = '\\\\"';
+function buildJsonEnvPairRegexes(isEscaped) {
+    const body = isEscaped ? ESCAPED_JSON_STRING_BODY : JSON_STRING_BODY;
+    const q = isEscaped ? ESCAPED_JSON_QUOTE : JSON_QUOTE;
+    return {
+        nameFirst: new RegExp(`(${q}name${q}\\s*:\\s*${q}(${body})${q}\\s*,\\s*${q}value${q}\\s*:\\s*${q})(${body})(${q})`, "g"),
+        valueFirst: new RegExp(`(${q}value${q}\\s*:\\s*${q})(${body})(${q}\\s*,\\s*${q}name${q}\\s*:\\s*${q}(${body})${q})`, "g"),
+    };
+}
+const JSON_ENV_PAIR_REGEXES = [buildJsonEnvPairRegexes(false), buildJsonEnvPairRegexes(true)];
+function buildJsonCredentialPairRule(isEscaped) {
+    const body = isEscaped ? ESCAPED_JSON_STRING_BODY : JSON_STRING_BODY;
+    const q = isEscaped ? ESCAPED_JSON_QUOTE : JSON_QUOTE;
+    return {
+        quote: isEscaped ? '\\"' : '"',
+        regex: new RegExp(`(${q}([^"\\\\\\n]{1,256})${q}\\s*:\\s*)(?:(${q})(${body})(${q}|$)|(-?[0-9][0-9.eE+-]*))`, "g"),
+    };
+}
+const JSON_CREDENTIAL_PAIR_RULES = [
+    buildJsonCredentialPairRule(false),
+    buildJsonCredentialPairRule(true),
+];
+/*
+ * `key=value` / `key: value` / `key:value` anywhere in a line — logs, args,
+ * Go-formatted maps (`map[password:cGFz…]`). The key is judged by
+ * isCredentialKey, so this never touches "timeout=1s" or "op=Exists". A
+ * JSON-escaped line break (`…\npassword: x\nuser: bob` inside a log
+ * message) separates pairs like a real one.
+ */
+const INLINE_PAIR_REGEX = /(^|[\s[,{("']|\\[nrt])([A-Za-z0-9_./-]+)([ \t]*[:=][ \t]*)("(?:[^"\\]|\\.)*"|'[^']*'|(?:[^\s,;&\]})"'\\]|\\(?![nrt]))+)/g;
+/*
+ * An image reference — `registry.example.com/auth:1.2.3`,
+ * `ghcr.io/org/secret-service:2.0` — has the shape of an inline pair whose
+ * key is a path and whose separator is a bare colon with no whitespace
+ * after it. A real pair with a path-shaped key (an annotation in describe
+ * output, `vault.hashicorp.com/agent-inject-token: abc123`) always has the
+ * space. The tag is what an on-call engineer needs most, so it stays.
+ */
+function isImageReferencePair(key, separator) {
+    return key.includes("/") && separator === ":";
+}
+/*
+ * A command-line flag standing alone as one argv element: "--db-password",
+ * "-password". A credential flag's value is then the NEXT element, which
+ * the pair rules above never see.
+ */
+const FLAG_TOKEN_REGEX = /^-{1,2}[A-Za-z][A-Za-z0-9_.-]*$/;
+/*
+ * A flag's value inside one line: a quoted string, or a bare word that is
+ * neither the next flag ("-…") nor a marker this module already wrote.
+ */
+const INLINE_FLAG_VALUE_PATTERN = /("(?:[^"\\]|\\.)*"|'[^']*'|[^\s"'[\-,;&|`\])}][^\s"',;&|`\])}]*)/;
+const INLINE_FLAG_VALUE_SOURCE = INLINE_FLAG_VALUE_PATTERN.source;
+// Where a flag can start inside a line.
+const INLINE_FLAG_BOUNDARY_PATTERN = /(^|[\s"'[(,;&|`])/;
+const INLINE_FLAG_BOUNDARY_SOURCE = INLINE_FLAG_BOUNDARY_PATTERN.source;
+/*
+ * `--requirepass value` / `-password value` in one line: a command in a
+ * log, describe's probe line, an `sh -c` script. The flag is judged by
+ * isCredentialKey, so "--port 8080" and "--tail 100" stay.
+ */
+const INLINE_SPLIT_FLAG_REGEX = new RegExp(`${INLINE_FLAG_BOUNDARY_SOURCE}(--?[A-Za-z][A-Za-z0-9_.-]*)([ \\t]+)${INLINE_FLAG_VALUE_SOURCE}`, "g");
+/*
+ * `"--db-password","value"` — a flag and its value as neighbouring JSON
+ * array strings (jsonpath `{.spec.containers[*].args}`), plain, escaped
+ * inside another JSON string, or single-quoted as a Python list prints it.
+ */
+function buildQuotedFlagPairRegex(quote, body) {
+    return new RegExp(`(${quote}(--?[A-Za-z][A-Za-z0-9_.-]*)${quote}\\s*,\\s*${quote})(${body})(${quote})`, "g");
+}
+const QUOTED_FLAG_PAIR_REGEXES = [
+    buildQuotedFlagPairRegex(JSON_QUOTE, JSON_STRING_BODY),
+    buildQuotedFlagPairRegex(ESCAPED_JSON_QUOTE, ESCAPED_JSON_STRING_BODY),
+    buildQuotedFlagPairRegex("'", "[^']*"),
+];
+/*
+ * Tools whose single-letter flag carries a password: `mysql -pS3cret`,
+ * `mongosh -p S3cret`, `sshpass -p S3cret`, `redis-cli -a S3cret`. The
+ * same letters mean something else everywhere else — `-p` is a port for
+ * ssh, psql and redis-cli and "make parents" for mkdir — so a short flag
+ * is judged only where the command names one of these tools: earlier on
+ * the same line, or earlier in the same one-element-per-line argv list.
+ */
+const SHORT_PASSWORD_FLAG_BY_TOOL = new Map([
+    ["mysql", "p"],
+    ["mysqladmin", "p"],
+    ["mysqldump", "p"],
+    ["mysqlcheck", "p"],
+    ["mysqlimport", "p"],
+    ["mysqlshow", "p"],
+    ["mysqlpump", "p"],
+    ["mysqlsh", "p"],
+    ["mariadb", "p"],
+    ["mariadb-admin", "p"],
+    ["mariadb-dump", "p"],
+    ["mariadb-check", "p"],
+    ["mariadb-import", "p"],
+    ["mongo", "p"],
+    ["mongosh", "p"],
+    ["mongodump", "p"],
+    ["mongorestore", "p"],
+    ["mongoexport", "p"],
+    ["mongoimport", "p"],
+    ["mongostat", "p"],
+    ["mongotop", "p"],
+    ["sshpass", "p"],
+    ["redis-cli", "a"],
+    ["keydb-cli", "a"],
+    ["valkey-cli", "a"],
+]);
+// One of those tools named inside a line, a path in front of it allowed.
+const TOOL_NAME_REGEX = new RegExp(`(^|[\\s/"'[(,;&|=\`])(${Array.from(SHORT_PASSWORD_FLAG_BY_TOOL.keys()).join("|")})(?=$|[\\s"'\\]),;&|\`\\\\])`, "g");
+// Where the command a tool starts ends inside a line.
+const COMMAND_END_REGEX = /[\];|&)`]/;
+// The password glued to a short flag ("-pS3cret"): a bare word.
+const SHORT_PASSWORD_ATTACHED_VALUE_PATTERN = /([^\s"'[\-,;&|`\])}][^\s"',;&|`\])}]*)/;
+// What separates a short flag from its password: blanks, or a list's ",".
+const SHORT_PASSWORD_SEPARATOR_PATTERN = /([ \t]+|"\s*,\s*"|\\"\s*,\s*\\"|'\s*,\s*')/;
+function buildShortPasswordFlagRegexes(letter) {
+    return {
+        attached: new RegExp(`${INLINE_FLAG_BOUNDARY_SOURCE}(-${letter})${SHORT_PASSWORD_ATTACHED_VALUE_PATTERN.source}`, "g"),
+        separated: new RegExp(`${INLINE_FLAG_BOUNDARY_SOURCE}(-${letter})${SHORT_PASSWORD_SEPARATOR_PATTERN.source}${INLINE_FLAG_VALUE_SOURCE}`, "g"),
+    };
+}
+const SHORT_PASSWORD_FLAG_REGEXES = new Map(Array.from(new Set(SHORT_PASSWORD_FLAG_BY_TOOL.values())).map((letter) => {
+    return [letter, buildShortPasswordFlagRegexes(letter)];
+}));
+/*
+ * `kubectl describe configmap` prints each data entry as "KEY:", this rule
+ * on the next line, and the value verbatim below it; the entries end with
+ * a "BinaryData" heading underlined the same way.
+ */
+const DESCRIBE_DATA_ENTRY_RULE = "----";
+const DESCRIBE_BINARY_DATA_HEADING = "BinaryData";
+const DESCRIBE_SECTION_RULE = "====";
+/*
+ * Base64 runs. A padded run of any length is base64 by construction
+ * ("cGFzc3dvcmQ=" is "password"); an unpadded run must be long and mixed to
+ * count, so identifiers, hashes and hex ids stay legible. The padding must
+ * end the token: "--feature-gates=Foo=true" is a flag, not a secret.
+ */
+const BASE64_PADDED_REGEX = /(?<![A-Za-z0-9+/])([A-Za-z0-9+/]{4,})(={1,2})(?![A-Za-z0-9+/=])/g;
+const BASE64_LONG_REGEX = /(?<![A-Za-z0-9+/])([A-Za-z0-9+/]{32,})(?![A-Za-z0-9+/=])/g;
+function parseLine(raw) {
+    var _a, _b, _c;
+    const whitespaceMatch = LEADING_WHITESPACE_REGEX.exec(raw);
+    const indent = whitespaceMatch ? whitespaceMatch[0].length : 0;
+    let content = raw.slice(indent);
+    if (content.trim() === "") {
+        return { raw, isBlank: true, indent, isListItem: false, contentIndent: 0 };
+    }
+    let isListItem = false;
+    let contentIndent = indent;
+    const listMatch = LIST_ITEM_PREFIX_REGEX.exec(content);
+    if (listMatch) {
+        isListItem = true;
+        contentIndent = indent + listMatch[0].length;
+        content = content.slice(listMatch[0].length);
+    }
+    const keyMatch = KEY_VALUE_LINE_REGEX.exec(content);
+    if (!keyMatch) {
+        return { raw, isBlank: false, indent, isListItem, contentIndent };
+    }
+    const key = ((_c = (_b = (_a = keyMatch[1]) !== null && _a !== void 0 ? _a : keyMatch[2]) !== null && _b !== void 0 ? _b : keyMatch[3]) !== null && _c !== void 0 ? _c : "").trim();
+    const valueStart = contentIndent + keyMatch[0].length;
+    return {
+        raw,
+        isBlank: false,
+        indent,
+        isListItem,
+        contentIndent,
+        key,
+        keyIsFreeText: keyMatch[3] !== undefined && FREE_TEXT_KEY_REGEX.test(keyMatch[3]),
+        value: raw.slice(valueStart).trim(),
+        valueStart,
+    };
+}
+// Strip a JSON trailing comma and surrounding quotes from a scalar.
+function unquote(value) {
+    let body = value.trim();
+    if (body.endsWith(",")) {
+        body = body.slice(0, -1).trimEnd();
+    }
+    if (body.length >= 2 &&
+        ((body.startsWith('"') && body.endsWith('"')) ||
+            (body.startsWith("'") && body.endsWith("'")))) {
+        body = body.slice(1, -1);
+    }
+    return body;
+}
+function isDocumentSeparator(line) {
+    return line.raw.trim() === "---";
+}
+function isBlockScalar(value) {
+    return BLOCK_SCALAR_REGEX.test(value);
+}
+// "data:" or "\"data\": {" — a mapping whose entries follow on later lines.
+function isContainerStart(value) {
+    return value === "" || value === "{";
+}
+// A value with no material in it, including a marker an earlier pass wrote.
+function isExemptValue(value) {
+    let body = value.trim();
+    if (body.endsWith(",")) {
+        body = body.slice(0, -1).trimEnd();
+    }
+    return (EXEMPT_VALUES.has(body) ||
+        body.startsWith(EXEMPT_VALUE_PREFIX) ||
+        unquote(body).startsWith(REDACTED_PREFIX));
+}
+function looksLikeCredentialName(name) {
+    return CREDENTIAL_NAME_REGEX.test(name.trim());
+}
+// A key that names credential material, minus the reference-only keys.
+function isCredentialKey(key) {
+    const normalized = key.trim().replace(/^-+/, "").toLowerCase();
+    if (REFERENCE_ONLY_KEYS.has(normalized)) {
+        return false;
+    }
+    return looksLikeCredentialName(normalized);
+}
+/*
+ * An argv element that can be a flag's value: not the next flag, not
+ * empty, not a marker this module already wrote.
+ */
+function isArgvValue(element) {
+    return !element.startsWith("-") && !isExemptValue(element);
+}
+// The short password flag of the tool an argv element names, if any.
+function shortPasswordFlagOfTool(element) {
+    return SHORT_PASSWORD_FLAG_BY_TOOL.get(element.slice(element.lastIndexOf("/") + 1));
+}
+/*
+ * A scalar replaced by the marker, keeping its quotes, a JSON trailing
+ * comma and `keptPrefix` (the "-p" of "-pS3cret").
+ */
+function maskScalar(value, keptPrefix = "") {
+    const trailingComma = value.trimEnd().endsWith(",") ? "," : "";
+    const body = trailingComma
+        ? value.trimEnd().slice(0, -1).trimEnd()
+        : value.trim();
+    if (body.startsWith('"')) {
+        return `"${keptPrefix}${GENERIC_REDACTED_MARKER}"${trailingComma}`;
+    }
+    if (body.startsWith("'")) {
+        return `'${keptPrefix}${GENERIC_REDACTED_MARKER}'${trailingComma}`;
+    }
+    return `${keptPrefix}${GENERIC_REDACTED_MARKER}${trailingComma}`;
+}
+/*
+ * A bare value found inside a line, replaced by the marker. When the value
+ * ends the body of an escaped JSON string (`…=S3cret\"`), the backslash
+ * belongs to the closing quote and stays.
+ */
+function maskInlineValue(value) {
+    if (value.startsWith('"') || value.startsWith("'")) {
+        return maskScalar(value);
+    }
+    return `${GENERIC_REDACTED_MARKER}${value.endsWith("\\") ? "\\" : ""}`;
+}
+/*
+ * The part of a `key: value` line before its value. A key that may be free
+ * text gets the inline rules; an ordinary key is returned as it is.
+ */
+function redactKeyPrefix(line) {
+    var _a;
+    const prefix = line.raw.slice(0, (_a = line.valueStart) !== null && _a !== void 0 ? _a : 0);
+    if (!line.keyIsFreeText) {
+        return { text: prefix, count: 0 };
+    }
+    const inline = applyInlineRules(prefix.slice(line.contentIndent));
+    return {
+        text: prefix.slice(0, line.contentIndent) + inline.text,
+        count: inline.count,
+    };
+}
+function maskValueInPlace(line) {
+    if (line.valueStart === undefined || line.value === undefined) {
+        return {
+            text: " ".repeat(line.indent) + GENERIC_REDACTED_MARKER,
+            count: 1,
+        };
+    }
+    const prefix = redactKeyPrefix(line);
+    return {
+        text: prefix.text + maskScalar(line.value),
+        count: prefix.count + 1,
+    };
+}
+// The first line at or above `indent` — the end of a nested block.
+function skipDeeperLines(parsed, from, indent) {
+    let index = from;
+    while (index < parsed.length) {
+        const line = parsed[index];
+        if (!line.isBlank && line.indent <= indent) {
+            break;
+        }
+        index++;
+    }
+    return index;
+}
+const UPPERCASE_REGEX = /[A-Z]/;
+const LOWERCASE_REGEX = /[a-z]/;
+const DIGIT_REGEX = /[0-9]/;
+function hasUpperAndLower(text) {
+    return UPPERCASE_REGEX.test(text) && LOWERCASE_REGEX.test(text);
+}
+function hasDigit(text) {
+    return DIGIT_REGEX.test(text);
+}
+// `Bearer …` / `Basic …`: the token after the scheme, unless it is prose.
+function maskAuthorizationTokens(text, regex) {
+    let count = 0;
+    const result = text.replace(regex, (match, scheme, token) => {
+        if (LOWERCASE_WORD_REGEX.test(token)) {
+            return match;
+        }
+        count++;
+        return `${scheme} ${GENERIC_REDACTED_MARKER}`;
+    });
+    return { text: result, count };
+}
+/*
+ * One-line JSON env pairs, `"name":"X","value":"Y"` in either order: the
+ * value is masked when the name looks credential-like and the value holds
+ * something (an empty value, or one already masked, stays as it is).
+ */
+function maskJsonEnvPairs(text, regexes) {
+    let count = 0;
+    let result = text.replace(regexes.nameFirst, (match, prefix, name, value, closingQuote) => {
+        if (!looksLikeCredentialName(name) || isExemptValue(value)) {
+            return match;
+        }
+        count++;
+        return `${prefix}${GENERIC_REDACTED_MARKER}${closingQuote}`;
+    });
+    result = result.replace(regexes.valueFirst, (match, prefix, value, suffix, name) => {
+        if (!looksLikeCredentialName(name) || isExemptValue(value)) {
+            return match;
+        }
+        count++;
+        return `${prefix}${GENERIC_REDACTED_MARKER}${suffix}`;
+    });
+    return { text: result, count };
+}
+/*
+ * One-line JSON `"key":"value"` pairs whose key looks credential-like, and
+ * the last-applied-configuration annotation as jsonpath prints it. The
+ * quotes stay, so the JSON still parses; a bare number becomes a string.
+ */
+function maskJsonCredentialPairs(text, rule) {
+    let count = 0;
+    const result = text.replace(rule.regex, (match, prefix, key, openingQuote, body, closingQuote, bare) => {
+        if (key !== LAST_APPLIED_CONFIGURATION_ANNOTATION &&
+            !isCredentialKey(key)) {
+            return match;
+        }
+        if (openingQuote !== undefined) {
+            if (isExemptValue(body !== null && body !== void 0 ? body : "")) {
+                return match;
+            }
+            count++;
+            return `${prefix}${openingQuote}${GENERIC_REDACTED_MARKER}${closingQuote !== null && closingQuote !== void 0 ? closingQuote : ""}`;
+        }
+        if (bare === undefined) {
+            return match;
+        }
+        count++;
+        return `${prefix}${rule.quote}${GENERIC_REDACTED_MARKER}${rule.quote}`;
+    });
+    return { text: result, count };
+}
+// `"--db-password","value"` in a one-line array: the value is masked.
+function maskQuotedFlagPairs(text, regex) {
+    let count = 0;
+    const result = text.replace(regex, (match, prefix, flag, value, closingQuote) => {
+        if (!isCredentialKey(flag) || !isArgvValue(value)) {
+            return match;
+        }
+        count++;
+        return `${prefix}${GENERIC_REDACTED_MARKER}${closingQuote}`;
+    });
+    return { text: result, count };
+}
+// `--requirepass value` inside one line: the value is masked.
+function maskInlineSplitFlags(text) {
+    let count = 0;
+    const result = text.replace(INLINE_SPLIT_FLAG_REGEX, (match, boundary, flag, separator, value) => {
+        if (!isCredentialKey(flag) || !isArgvValue(unquote(value))) {
+            return match;
+        }
+        count++;
+        return `${boundary}${flag}${separator}${maskInlineValue(value)}`;
+    });
+    return { text: result, count };
+}
+// A tool's short password flag within the stretch of a line that is its command.
+function maskShortPasswordFlag(text, letter) {
+    const regexes = SHORT_PASSWORD_FLAG_REGEXES.get(letter);
+    if (!regexes) {
+        return { text, count: 0 };
+    }
+    let count = 0;
+    let result = text.replace(regexes.separated, (match, boundary, flag, separator, value) => {
+        if (!isArgvValue(unquote(value))) {
+            return match;
+        }
+        count++;
+        return `${boundary}${flag}${separator}${maskInlineValue(value)}`;
+    });
+    result = result.replace(regexes.attached, (_match, boundary, flag, value) => {
+        count++;
+        return `${boundary}${flag}${maskInlineValue(value)}`;
+    });
+    return { text: result, count };
+}
+/*
+ * `mysql -pS3cret`, `mongosh -p S3cret`, `redis-cli -a S3cret`: a tool's
+ * short password flag, judged only in the stretch of the line from the
+ * tool's name to the next tool or the end of its command (`]`, `)`, `;`,
+ * `|`, `&`, a backtick).
+ */
+function maskToolPasswordFlags(text) {
+    var _a, _b, _c;
+    const tools = [];
+    TOOL_NAME_REGEX.lastIndex = 0;
+    let match = TOOL_NAME_REGEX.exec(text);
+    while (match) {
+        const start = match.index + ((_a = match[1]) !== null && _a !== void 0 ? _a : "").length;
+        const name = (_b = match[2]) !== null && _b !== void 0 ? _b : "";
+        tools.push({
+            start,
+            end: start + name.length,
+            letter: (_c = SHORT_PASSWORD_FLAG_BY_TOOL.get(name)) !== null && _c !== void 0 ? _c : "",
+        });
+        match = TOOL_NAME_REGEX.exec(text);
+    }
+    TOOL_NAME_REGEX.lastIndex = 0;
+    if (tools.length === 0) {
+        return { text, count: 0 };
+    }
+    let result = "";
+    let count = 0;
+    let cursor = 0;
+    tools.forEach((tool, toolIndex) => {
+        /*
+         * Only the stretch up to the next tool is searched for the command's
+         * end, so a line naming a tool many times is still scanned once.
+         */
+        const nextTool = tools[toolIndex + 1];
+        const stretch = text.slice(tool.end, nextTool ? nextTool.start : text.length);
+        const commandEnd = stretch.search(COMMAND_END_REGEX);
+        const command = commandEnd === -1 ? stretch : stretch.slice(0, commandEnd);
+        result += text.slice(cursor, tool.end);
+        const masked = maskShortPasswordFlag(command, tool.letter);
+        result += masked.text;
+        count += masked.count;
+        cursor = tool.end + command.length;
+    });
+    result += text.slice(cursor);
+    return { text: result, count };
+}
+/*
+ * Mask the body of every one-line `"data":{…}` object. Braces are matched
+ * by depth; an object the line truncated away is masked to the end.
+ */
+function maskInlineJsonDataObjects(text) {
+    var _a;
+    let result = text;
+    let count = 0;
+    let searchFrom = 0;
+    while (searchFrom < result.length) {
+        INLINE_JSON_DATA_OBJECT_REGEX.lastIndex = searchFrom;
+        const match = INLINE_JSON_DATA_OBJECT_REGEX.exec(result);
+        if (!match) {
+            break;
+        }
+        const quote = (_a = match[1]) !== null && _a !== void 0 ? _a : '"';
+        const bodyStart = match.index + match[0].length;
+        let depth = 1;
+        let position = bodyStart;
+        while (position < result.length && depth > 0) {
+            const character = result[position];
+            if (character === "{") {
+                depth++;
+            }
+            else if (character === "}") {
+                depth--;
+            }
+            position++;
+        }
+        // `position` is just past the closing brace, or the end of the text.
+        const bodyEnd = depth === 0 ? position - 1 : result.length;
+        if (result.slice(bodyStart, bodyEnd).trim() === "") {
+            searchFrom = position;
+            continue;
+        }
+        const replacement = `${quote}${GENERIC_REDACTED_MARKER}${quote}:${quote}${GENERIC_REDACTED_MARKER}${quote}`;
+        result = result.slice(0, bodyStart) + replacement + result.slice(bodyEnd);
+        count++;
+        searchFrom = bodyStart + replacement.length;
+    }
+    INLINE_JSON_DATA_OBJECT_REGEX.lastIndex = 0;
+    return { text: result, count };
+}
+// The rules that apply to any line regardless of its YAML/JSON structure.
+function applyInlineRules(text) {
+    let count = 0;
+    let result = text;
+    const apply = (masked) => {
+        result = masked.text;
+        count += masked.count;
+    };
+    result = result.replace(URL_CREDENTIAL_REGEX, (_match, user) => {
+        count++;
+        return `://${user}:${GENERIC_REDACTED_MARKER}@`;
+    });
+    for (const tokenRegex of [BEARER_TOKEN_REGEX, BASIC_TOKEN_REGEX]) {
+        apply(maskAuthorizationTokens(result, tokenRegex));
+    }
+    result = result.replace(JWT_REGEX, () => {
+        count++;
+        return "[redacted-jwt]";
+    });
+    apply(maskInlineJsonDataObjects(result));
+    for (const pair of JSON_ENV_PAIR_REGEXES) {
+        apply(maskJsonEnvPairs(result, pair));
+    }
+    for (const rule of JSON_CREDENTIAL_PAIR_RULES) {
+        apply(maskJsonCredentialPairs(result, rule));
+    }
+    for (const regex of QUOTED_FLAG_PAIR_REGEXES) {
+        apply(maskQuotedFlagPairs(result, regex));
+    }
+    result = result.replace(INLINE_PAIR_REGEX, (match, boundary, key, separator, value) => {
+        if (isImageReferencePair(key, separator) ||
+            !isCredentialKey(key) ||
+            isExemptValue(value)) {
+            return match;
+        }
+        count++;
+        return `${boundary}${key}${separator}${GENERIC_REDACTED_MARKER}${value.endsWith("\\") ? "\\" : ""}`;
+    });
+    apply(maskInlineSplitFlags(result));
+    apply(maskToolPasswordFlags(result));
+    result = result.replace(BASE64_PADDED_REGEX, (match, run) => {
+        if (!hasUpperAndLower(run) && !hasDigit(run)) {
+            return match;
+        }
+        count++;
+        return "[redacted-base64]";
+    });
+    result = result.replace(BASE64_LONG_REGEX, (match, run) => {
+        if (!hasUpperAndLower(run) || !hasDigit(run)) {
+            return match;
+        }
+        count++;
+        return "[redacted-base64]";
+    });
+    return { text: result, count };
+}
+/*
+ * The inline rules over one line. A line that already parsed as
+ * `key: value` has its value examined, and its key only when the key may
+ * be free text: its key was judged by isCredentialKey (and possibly
+ * exempted), and re-reading "Image pull secrets:" as the pair "secrets:
+ * <none>" must not undo that.
+ */
+function applyInlineRulesToLine(line) {
+    if (line.valueStart === undefined || line.value === undefined) {
+        return applyInlineRules(line.raw);
+    }
+    const prefix = redactKeyPrefix(line);
+    const inline = applyInlineRules(line.raw.slice(line.valueStart));
+    return {
+        text: prefix.text + inline.text,
+        count: prefix.count + inline.count,
+    };
+}
+export class GenericOutputRedactor {
+    static redact(output) {
+        var _a;
+        if (!output) {
+            return { text: "", redactionCount: 0 };
+        }
+        const parsed = output
+            .replace(/\r\n?/g, "\n")
+            .split("\n")
+            .map(parseLine);
+        const masks = {
+            envValueLines: GenericOutputRedactor.findCredentialEnvValueLines(parsed),
+            argvValueLines: GenericOutputRedactor.findArgvValueLines(parsed),
+        };
+        const out = [];
+        let count = 0;
+        let index = 0;
+        while (index < parsed.length) {
+            const line = parsed[index];
+            let step;
+            if (GenericOutputRedactor.isDescribeDataEntry(parsed, index) &&
+                isCredentialKey((_a = line.key) !== null && _a !== void 0 ? _a : "")) {
+                step = GenericOutputRedactor.redactDescribeDataEntry(parsed, index);
+            }
+            else if (!line.isBlank &&
+                line.key !== undefined &&
+                DATA_BLOCK_KEYS.has(line.key) &&
+                isContainerStart(line.value)) {
+                step = GenericOutputRedactor.redactDataBlock(parsed, index, masks);
+            }
+            else {
+                step = GenericOutputRedactor.redactStandaloneLine(parsed, index, masks);
+            }
+            out.push(...step.lines);
+            count += step.count;
+            index = step.next;
+        }
+        let text = out.join("\n");
+        text = text.replace(PRIVATE_KEY_BLOCK_REGEX, () => {
+            count++;
+            return "[redacted-private-key]";
+        });
+        return { text, redactionCount: count };
+    }
+    /*
+     * Which `value:` lines belong to an env entry whose `name:` looks
+     * credential-like. Found up front because the value may precede the name
+     * inside its entry, and the main pass only ever moves forward.
+     */
+    static findCredentialEnvValueLines(parsed) {
+        const valueLines = new Set();
+        for (let index = 0; index < parsed.length; index++) {
+            const line = parsed[index];
+            if (line.isBlank || line.key !== "name" || line.value === undefined) {
+                continue;
+            }
+            const name = unquote(line.value);
+            if (!name || !looksLikeCredentialName(name)) {
+                continue;
+            }
+            const valueLine = GenericOutputRedactor.findSiblingValueLine(parsed, index);
+            if (valueLine !== undefined) {
+                valueLines.add(valueLine);
+            }
+        }
+        return valueLines;
+    }
+    /*
+     * Argv printed one element per line — `- --db-password` / `- value` in
+     * YAML, `"--db-password",` / `"value"` in pretty JSON, describe's Command
+     * and Args blocks — and the elements that are the value of a credential
+     * flag before them, each with its masked text. A list's elements are
+     * consecutive lines at the same indent and of the same shape; a
+     * `key: value` line ends it (describe prints an argument that contains
+     * ": " as is, so a flag's value may look like one). A tool's short
+     * password flag counts only once the list has named the tool.
+     */
+    static findArgvValueLines(parsed) {
+        const masked = new Map();
+        let list = undefined;
+        for (let index = 0; index < parsed.length; index++) {
+            const line = parsed[index];
+            if (line.isBlank) {
+                continue;
+            }
+            // "- key: value" is a mapping entry, never an argv element.
+            if (line.isListItem && line.key !== undefined) {
+                list = undefined;
+                continue;
+            }
+            if (list === undefined ||
+                list.indent !== line.indent ||
+                list.isListItem !== line.isListItem) {
+                list = {
+                    indent: line.indent,
+                    isListItem: line.isListItem,
+                    shortPasswordFlag: undefined,
+                    expectsValue: false,
+                };
+            }
+            const indentText = line.raw.slice(0, line.contentIndent);
+            const content = line.raw.slice(line.contentIndent);
+            const element = unquote(content);
+            if (list.expectsValue) {
+                list.expectsValue = false;
+                if (isArgvValue(element)) {
+                    masked.set(index, indentText + maskScalar(content));
+                    continue;
+                }
+            }
+            if (line.key !== undefined) {
+                list = undefined;
+                continue;
+            }
+            const shortFlag = list.shortPasswordFlag !== undefined
+                ? `-${list.shortPasswordFlag}`
+                : undefined;
+            if (shortFlag !== undefined && element.startsWith(shortFlag)) {
+                const attached = element.slice(shortFlag.length);
+                if (attached === "") {
+                    list.expectsValue = true;
+                }
+                else if (isArgvValue(attached)) {
+                    masked.set(index, indentText + maskScalar(content, shortFlag));
+                }
+                continue;
+            }
+            if (FLAG_TOKEN_REGEX.test(element) && isCredentialKey(element)) {
+                list.expectsValue = true;
+                continue;
+            }
+            const toolFlag = shortPasswordFlagOfTool(element);
+            if (toolFlag !== undefined) {
+                list.shortPasswordFlag = toolFlag;
+            }
+        }
+        return masked;
+    }
+    /*
+     * The `value:` sibling of a `name:` line inside the same list entry (YAML)
+     * or object (JSON). Siblings share the name line's content indent; a
+     * shallower line ends the entry, a deeper one is nested under a sibling.
+     */
+    static findSiblingValueLine(parsed, nameIndex) {
+        const nameLine = parsed[nameIndex];
+        const indent = nameLine.contentIndent;
+        for (let index = nameIndex + 1; index < parsed.length; index++) {
+            const line = parsed[index];
+            if (line.isBlank) {
+                continue;
+            }
+            if (line.indent < indent) {
+                break;
+            }
+            if (line.indent > indent || line.isListItem) {
+                continue;
+            }
+            if (line.key === "value") {
+                return index;
+            }
+        }
+        // "- name: X" is its entry's first line: nothing above it is a sibling.
+        if (nameLine.isListItem) {
+            return undefined;
+        }
+        for (let index = nameIndex - 1; index >= 0; index--) {
+            const line = parsed[index];
+            if (line.isBlank) {
+                continue;
+            }
+            if (line.isListItem && line.contentIndent === indent) {
+                // The entry's own "- …" line — a sibling, and the entry's start.
+                return line.key === "value" ? index : undefined;
+            }
+            if (line.indent < indent) {
+                break;
+            }
+            if (line.indent > indent || line.isListItem) {
+                continue;
+            }
+            if (line.key === "value") {
+                return index;
+            }
+        }
+        return undefined;
+    }
+    /*
+     * The `kind:` sibling of a data block: same indent, same object, on
+     * either side of the block. Undefined when the output does not say — a
+     * truncated object, or not a Kubernetes object at all.
+     */
+    static findSiblingKind(parsed, blockIndex) {
+        const indent = parsed[blockIndex].contentIndent;
+        for (let index = blockIndex - 1; index >= 0; index--) {
+            const line = parsed[index];
+            if (line.isBlank) {
+                continue;
+            }
+            if (isDocumentSeparator(line)) {
+                break;
+            }
+            if (line.indent > indent) {
+                continue;
+            }
+            if (line.isListItem && line.contentIndent === indent) {
+                // The entry's own "- …" line: its first key, and the entry's start.
+                if (line.key === "kind" && line.value !== undefined) {
+                    return unquote(line.value);
+                }
+                break;
+            }
+            if (line.indent < indent) {
+                break;
+            }
+            if (line.isListItem) {
+                continue;
+            }
+            if (line.key === "kind" && line.value !== undefined) {
+                return unquote(line.value);
+            }
+        }
+        for (let index = blockIndex + 1; index < parsed.length; index++) {
+            const line = parsed[index];
+            if (line.isBlank) {
+                continue;
+            }
+            if (isDocumentSeparator(line)) {
+                break;
+            }
+            if (line.indent > indent) {
+                continue;
+            }
+            if (line.indent < indent) {
+                break;
+            }
+            if (line.isListItem) {
+                continue;
+            }
+            if (line.key === "kind" && line.value !== undefined) {
+                return unquote(line.value);
+            }
+        }
+        return undefined;
+    }
+    /*
+     * A `kubectl describe configmap` data entry: "KEY:" with nothing after
+     * the colon, then the "----" rule at the same indent on the next line.
+     */
+    static isDescribeDataEntry(parsed, index) {
+        const line = parsed[index];
+        const rule = parsed[index + 1];
+        return (line !== undefined &&
+            rule !== undefined &&
+            !line.isBlank &&
+            !line.isListItem &&
+            line.key !== undefined &&
+            line.value === "" &&
+            !rule.isBlank &&
+            rule.indent === line.indent &&
+            rule.raw.trim() === DESCRIBE_DATA_ENTRY_RULE);
+    }
+    /*
+     * Where a describe data entry's value ends: at the next entry or the
+     * "BinaryData" heading after the last one — each follows a blank line at
+     * the entry's indent — or at the end of the output.
+     */
+    static isDescribeDataValueEnd(parsed, index, indent) {
+        const line = parsed[index];
+        const previous = parsed[index - 1];
+        const next = parsed[index + 1];
+        if (line.isBlank || line.indent !== indent || !(previous === null || previous === void 0 ? void 0 : previous.isBlank)) {
+            return false;
+        }
+        if (GenericOutputRedactor.isDescribeDataEntry(parsed, index)) {
+            return true;
+        }
+        return (line.raw.trim() === DESCRIBE_BINARY_DATA_HEADING &&
+            next !== undefined &&
+            next.raw.trim() === DESCRIBE_SECTION_RULE);
+    }
+    /*
+     * A credential-like describe data entry. The key and the rule stay; the
+     * whole value — every line of it, blank lines included, since a
+     * properties file or a PEM block has them — becomes one marker, and the
+     * blank lines that close the entry stay. A value the Runner truncated
+     * is masked to the end of the output.
+     */
+    static redactDescribeDataEntry(parsed, headerIndex) {
+        const header = parsed[headerIndex];
+        const valueStart = headerIndex + 2;
+        let end = valueStart;
+        while (end < parsed.length &&
+            !GenericOutputRedactor.isDescribeDataValueEnd(parsed, end, header.indent)) {
+            end++;
+        }
+        let lastValueLine = valueStart - 1;
+        for (let index = valueStart; index < end; index++) {
+            if (!parsed[index].isBlank) {
+                lastValueLine = index;
+            }
+        }
+        const lines = [header.raw, parsed[headerIndex + 1].raw];
+        let count = 0;
+        if (lastValueLine >= valueStart) {
+            const valueLines = parsed.slice(valueStart, lastValueLine + 1);
+            const isAlreadyMasked = valueLines.every((line) => {
+                return line.isBlank || line.raw.trim() === GENERIC_REDACTED_MARKER;
+            });
+            if (isAlreadyMasked) {
+                lines.push(...valueLines.map((line) => {
+                    return line.raw;
+                }));
+            }
+            else {
+                lines.push(" ".repeat(header.indent) + GENERIC_REDACTED_MARKER);
+                count++;
+            }
+        }
+        for (let index = lastValueLine + 1; index < end; index++) {
+            lines.push(parsed[index].raw);
+        }
+        return { lines, next: end, count };
+    }
+    /*
+     * A `data:` / `stringData:` / `binaryData:` block. Every value is masked
+     * for a Secret or an object of unknown kind; only credential-like keys
+     * are masked for anything else. Keys are kept either way.
+     */
+    static redactDataBlock(parsed, blockIndex, masks) {
+        const block = parsed[blockIndex];
+        const kind = GenericOutputRedactor.findSiblingKind(parsed, blockIndex);
+        const maskEveryValue = kind === undefined || kind.toLowerCase() === "secret";
+        const lines = [block.raw];
+        let count = 0;
+        let index = blockIndex + 1;
+        let entryIndent = undefined;
+        let entryMasked = false;
+        while (index < parsed.length) {
+            const line = parsed[index];
+            if (line.isBlank) {
+                if (!entryMasked) {
+                    lines.push(line.raw);
+                }
+                index++;
+                continue;
+            }
+            if (line.indent <= block.contentIndent) {
+                break;
+            }
+            if (entryIndent === undefined) {
+                entryIndent = line.indent;
+            }
+            // Deeper than an entry: a block scalar body or nested structure.
+            if (line.indent > entryIndent) {
+                if (maskEveryValue || entryMasked) {
+                    index++;
+                    continue;
+                }
+                const nested = GenericOutputRedactor.redactStandaloneLine(parsed, index, masks);
+                lines.push(...nested.lines);
+                count += nested.count;
+                index = nested.next;
+                continue;
+            }
+            if (line.key === undefined) {
+                // Not "key: value" — an unexpected shape inside a data block.
+                if (maskEveryValue) {
+                    lines.push(" ".repeat(line.indent) + GENERIC_REDACTED_MARKER);
+                    count++;
+                    entryMasked = true;
+                }
+                else {
+                    const inline = applyInlineRules(line.raw);
+                    lines.push(inline.text);
+                    count += inline.count;
+                    entryMasked = false;
+                }
+                index++;
+                continue;
+            }
+            if (maskEveryValue || isCredentialKey(line.key)) {
+                if (line.value !== undefined && !isExemptValue(line.value)) {
+                    const masked = maskValueInPlace(line);
+                    lines.push(masked.text);
+                    count += masked.count;
+                }
+                else {
+                    lines.push(line.raw);
+                }
+                entryMasked = true;
+                index++;
+                continue;
+            }
+            const inline = applyInlineRulesToLine(line);
+            lines.push(inline.text);
+            count += inline.count;
+            entryMasked = false;
+            index++;
+        }
+        return { lines, next: index, count };
+    }
+    /*
+     * One line outside a data block: env value, argv value, credential-like
+     * key, inline rules.
+     */
+    static redactStandaloneLine(parsed, index, masks) {
+        var _a;
+        const line = parsed[index];
+        if (line.isBlank) {
+            return { lines: [line.raw], next: index + 1, count: 0 };
+        }
+        if (masks.envValueLines.has(index) && line.value !== undefined) {
+            if (isBlockScalar(line.value)) {
+                const masked = maskValueInPlace(line);
+                return {
+                    lines: [masked.text],
+                    next: skipDeeperLines(parsed, index + 1, line.contentIndent),
+                    count: masked.count,
+                };
+            }
+            if (!isExemptValue(line.value)) {
+                const masked = maskValueInPlace(line);
+                return { lines: [masked.text], next: index + 1, count: masked.count };
+            }
+        }
+        const argvValue = masks.argvValueLines.get(index);
+        if (argvValue !== undefined) {
+            return { lines: [argvValue], next: index + 1, count: 1 };
+        }
+        if (line.key !== undefined &&
+            line.value !== undefined &&
+            (line.key === LAST_APPLIED_CONFIGURATION_ANNOTATION ||
+                isCredentialKey(line.key))) {
+            if (isBlockScalar(line.value)) {
+                const masked = maskValueInPlace(line);
+                return {
+                    lines: [masked.text],
+                    next: skipDeeperLines(parsed, index + 1, line.contentIndent),
+                    count: masked.count,
+                };
+            }
+            if (!isExemptValue(line.value)) {
+                const masked = maskValueInPlace(line);
+                return { lines: [masked.text], next: index + 1, count: masked.count };
+            }
+            /*
+             * A credential-like key with nothing to hide on this line: its
+             * children are judged on their own, and describe's "<set to the key
+             * …>" reference must not be chewed up by the inline pair rule.
+             */
+            const prefix = redactKeyPrefix(line);
+            return {
+                lines: [prefix.text + line.raw.slice((_a = line.valueStart) !== null && _a !== void 0 ? _a : 0)],
+                next: index + 1,
+                count: prefix.count,
+            };
+        }
+        const inline = applyInlineRulesToLine(line);
+        return { lines: [inline.text], next: index + 1, count: inline.count };
+    }
+}
+// The marker every masked value is replaced with.
+export const RESOURCE_REDACTED_MARKER = GENERIC_REDACTED_MARKER;
+/*
+ * `"Env": [ ... ]` as docker inspect (and docker service inspect) prints
+ * it, pretty-printed or compact, possibly escaped inside another JSON
+ * string. Every entry's VALUE is masked — an environment is where
+ * containers keep their secrets, and a name that does not look like one
+ * (APP_CONFIG, DATABASE) holds one as often as not. Names stay, so the model
+ * still knows which variables are set.
+ */
+const DOCKER_ENV_LIST_REGEX = /(\\?)"Env\1"\s*:\s*\[/g;
+const FOUR_HEX_DIGITS_REGEX = /^[0-9A-Fa-f]{4}$/;
+// The character one escape sequence of an enclosing JSON string stands for.
+function decodeJsonEscape(text, index) {
+    const next = text.charAt(index + 1);
+    if (next === "u" &&
+        FOUR_HEX_DIGITS_REGEX.test(text.slice(index + 2, index + 6))) {
+        return {
+            char: String.fromCharCode(parseInt(text.slice(index + 2, index + 6), 16)),
+            width: 6,
+        };
+    }
+    return { char: next, width: 2 };
+}
+/*
+ * Where a JSON string literal's body ends: the index of its closing quote
+ * (`"`, or `\"` when the literal is itself escaped one level inside another
+ * JSON string), or text.length when it never closes.
+ *
+ * Escaped one level, the body is read through the enclosing string's
+ * escapes: `\\\"` is the entry's own escaped quote (`\"` once decoded) and
+ * `\\\\` its own escaped backslash, so neither is taken for the entry's end
+ * — which would leave every entry after it unmasked. A bare `"` ends the
+ * enclosing string, so the entry cannot go on past it either.
+ */
+function readJsonStringEnd(text, start, isEscaped) {
+    let index = start;
+    if (!isEscaped) {
+        while (index < text.length) {
+            const ch = text.charAt(index);
+            if (ch === '"') {
+                return index;
+            }
+            index += ch === "\\" ? 2 : 1;
+        }
+        return text.length;
+    }
+    let innerEscape = false;
+    while (index < text.length) {
+        const ch = text.charAt(index);
+        if (ch === '"') {
+            return index;
+        }
+        const decoded = ch === "\\" ? decodeJsonEscape(text, index) : { char: ch, width: 1 };
+        if (innerEscape) {
+            innerEscape = false;
+        }
+        else if (decoded.char === "\\") {
+            innerEscape = true;
+        }
+        else if (decoded.char === '"') {
+            return index;
+        }
+        index += decoded.width;
+    }
+    return text.length;
+}
+function maskDockerEnvValues(data) {
+    const text = data.text;
+    let out = "";
+    let cursor = 0;
+    let count = 0;
+    DOCKER_ENV_LIST_REGEX.lastIndex = 0;
+    let match = DOCKER_ENV_LIST_REGEX.exec(text);
+    while (match) {
+        const isEscaped = match[1] === "\\";
+        const quote = isEscaped ? '\\"' : '"';
+        let index = match.index + match[0].length;
+        out += text.slice(cursor, index);
+        // Walk the list's string entries until its closing bracket (or the end).
+        while (index < text.length) {
+            const ch = text.charAt(index);
+            if (ch === "]") {
+                break;
+            }
+            if (!text.startsWith(quote, index)) {
+                out += ch;
+                index++;
+                continue;
+            }
+            const bodyStart = index + quote.length;
+            const bodyEnd = readJsonStringEnd(text, bodyStart, isEscaped);
+            const entry = text.slice(bodyStart, bodyEnd);
+            const equals = entry.indexOf("=");
+            if (equals > 0 && equals < entry.length - 1) {
+                out += `${quote}${entry.slice(0, equals + 1)}${RESOURCE_REDACTED_MARKER}`;
+                count++;
+            }
+            else {
+                out += `${quote}${entry}`;
+            }
+            if (bodyEnd >= text.length || !text.startsWith(quote, bodyEnd)) {
+                // The text ended, or (escaped) the enclosing string closed first.
+                index = bodyEnd;
+                break;
+            }
+            out += quote;
+            index = bodyEnd + quote.length;
+        }
+        cursor = index;
+        DOCKER_ENV_LIST_REGEX.lastIndex = Math.max(index, match.index + 1);
+        match = DOCKER_ENV_LIST_REGEX.exec(text);
+    }
+    out += text.slice(cursor);
+    return { text: out, redactionCount: count };
+}
+/*
+ * `docker service inspect --pretty` prints a service's environment on the
+ * " Env:" line of its ContainerSpec section, where the JSON hook above
+ * cannot see it:
+ *   " Env:\t\tAPP_KEY=abc LOG_LEVEL=debug JAVA_OPTS=-Xmx1g -Dx=y "
+ * The CLI's template prints each entry raw, so a value holding a newline (a
+ * PEM certificate, a JSON blob from a YAML block) carries the rest of the
+ * list onto the next physical lines. Inside a ContainerSpec section the Env
+ * block therefore runs until the next line the template itself starts
+ * (" Dir:", " Init:", " User:", "Mounts:", ... and "Endpoint Mode:", which
+ * it always prints), or to the end of the text.
+ *
+ * A value may hold spaces, so the block cannot be split back into its
+ * entries reliably. Every word shaped like NAME= keeps its NAME and has the
+ * rest of it masked, and every other word (the tail of a value that held a
+ * space or a newline) is dropped: over-masking accepted, never a value left.
+ */
+const DOCKER_PRETTY_ENV_LINE_REGEX = /^([ \t]*Env:[ \t]+)(\S.*?)(\r?)$/;
+const DOCKER_PRETTY_ENV_NAME_REGEX = /^[A-Za-z_][A-Za-z0-9_.-]*=/;
+const DOCKER_PRETTY_CONTAINER_SPEC_REGEX = /^ContainerSpec:[ \t]*\r?$/;
+// The lines the pretty template may start after the Env line (and the next service's ID).
+const DOCKER_PRETTY_SECTION_REGEX = /^(?: (?:Dir|Init|User|Healthcheck):|(?:ID|Capabilities|SysCtls|Ulimits|Mounts|Configs|Secrets|Log Driver|Resources|Networks|Endpoint Mode|Ports):)/;
+function maskDockerPrettyEnvEntries(entries) {
+    const masked = [];
+    let count = 0;
+    for (const word of entries.split(/\s+/)) {
+        const name = DOCKER_PRETTY_ENV_NAME_REGEX.exec(word);
+        if (!name) {
+            continue;
+        }
+        if (word.length > name[0].length) {
+            count++;
+            masked.push(`${name[0]}${RESOURCE_REDACTED_MARKER}`);
+        }
+        else {
+            masked.push(word);
+        }
+    }
+    return { text: masked.join(" "), count };
+}
+function maskDockerPrettyEnvLines(data) {
+    const lines = data.text.split("\n");
+    const out = [];
+    let count = 0;
+    let inContainerSpec = false;
+    for (let index = 0; index < lines.length; index++) {
+        const line = lines[index] || "";
+        if (DOCKER_PRETTY_CONTAINER_SPEC_REGEX.test(line)) {
+            inContainerSpec = true;
+        }
+        const match = DOCKER_PRETTY_ENV_LINE_REGEX.exec(line);
+        if (!match) {
+            out.push(line);
+            continue;
+        }
+        const block = [match[2] || ""];
+        // The lines a multi-line value carried the list onto.
+        while (inContainerSpec &&
+            index + 1 < lines.length &&
+            !DOCKER_PRETTY_SECTION_REGEX.test(lines[index + 1] || "")) {
+            index++;
+            block.push(lines[index] || "");
+        }
+        const masked = maskDockerPrettyEnvEntries(block.join(" "));
+        count += masked.count;
+        out.push(`${match[1] || ""}${masked.text}${match[3] || ""}`);
+    }
+    return { text: out.join("\n"), redactionCount: count };
+}
+/*
+ * A Ceph keyring's secret: `key = AQD...==` (ceph auth get, keyring files),
+ * `key: AQD...` (ceph auth ls) and `"key": "AQD..."` (-f json). The generic
+ * rules deliberately leave a bare `key` alone (taints and tolerations have
+ * one), but for ceph it is always a cephx secret.
+ */
+const CEPH_KEY_LINE_REGEX = /^([ \t]*key[ \t]*[:=][ \t]*)(\S.*)$/gm;
+const CEPH_KEY_JSON_REGEX = /("key"\s*:\s*")((?:[^"\\]|\\.)*)(")/g;
+function maskCephKeys(data) {
+    let count = 0;
+    const text = data.text
+        .replace(CEPH_KEY_LINE_REGEX, (whole, prefix, value) => {
+        if (value.trim() === RESOURCE_REDACTED_MARKER) {
+            return whole;
+        }
+        count++;
+        return `${prefix}${RESOURCE_REDACTED_MARKER}`;
+    })
+        .replace(CEPH_KEY_JSON_REGEX, (whole, prefix, value, suffix) => {
+        if (!value || value === RESOURCE_REDACTED_MARKER) {
+            return whole;
+        }
+        count++;
+        return `${prefix}${RESOURCE_REDACTED_MARKER}${suffix}`;
+    });
+    return { text, redactionCount: count };
+}
+/*
+ * govc (VMware vCenter). A VM's extraConfig holds guestinfo.* keys —
+ * cloud-init user data and metadata, vendor data, OVF environments — that
+ * routinely carry passwords and SSH keys under names the generic rules
+ * cannot recognise. The govc policy refuses every command that prints
+ * extraConfig (vm.info -e and -json, object.collect of config); this is the
+ * second line. The value of every option whose key is a guestinfo.* key (or
+ * names user data, vendor data or an OVF environment, or looks
+ * credential-like) is masked in each shape govc prints one: -json
+ * OptionValue objects (key before or after value, any key case, the value a
+ * string, a number or a {"_typeName", "_value"} object), the text listing
+ * (`guestinfo.userdata:  ...`), a JSON map entry (`"guestinfo.x": "..."`)
+ * and -dump's Go syntax (`Key: "...", Value: "..."`). A vSphere session id
+ * or ticket in -json output (a login event's sessionId, a clone or console
+ * ticket) authenticates as its user, and is masked too.
+ */
+const GOVC_JSON_STRING = '"(?:[^"\\\\]|\\\\.)*"';
+const GOVC_JSON_NUMBER = "-?[0-9][0-9.eE+-]*";
+const GOVC_JSON_SCALAR = `(?:${GOVC_JSON_STRING}|${GOVC_JSON_NUMBER})`;
+const GOVC_TYPED_VALUE = `\\{\\s*(?:"_typeName"\\s*:\\s*"[^"]*"\\s*,\\s*)?"_value"\\s*:\\s*${GOVC_JSON_SCALAR}(?:\\s*,\\s*"_typeName"\\s*:\\s*"[^"]*")?\\s*\\}`;
+const GOVC_OPTION_VALUE = `(?:${GOVC_JSON_SCALAR}|${GOVC_TYPED_VALUE})`;
+const GOVC_OPTION_KEY_FIRST_REGEX = new RegExp(`("key"\\s*:\\s*")((?:[^"\\\\]|\\\\.)*)("\\s*,\\s*"value"\\s*:\\s*)(${GOVC_OPTION_VALUE})`, "gi");
+const GOVC_OPTION_VALUE_FIRST_REGEX = new RegExp(`("value"\\s*:\\s*)(${GOVC_OPTION_VALUE})(\\s*,\\s*"key"\\s*:\\s*")((?:[^"\\\\]|\\\\.)*)(")`, "gi");
+const GOVC_OPTION_DUMP_REGEX = /(\bKey:\s*")((?:[^"\\]|\\.)*)("\s*,\s*Value:\s*)("(?:[^"\\]|\\.)*"|[^,\n}]*)/g;
+const GOVC_GUESTINFO_LINE_REGEX = /^([ \t]*guestinfo\.[^\s:=]*[ \t]*[:=][ \t]*)(\S.*)$/gim;
+const GOVC_SECRET_JSON_PAIR_REGEX = /("(?:sessionId|ticket|cloneTicket|guestinfo\.[^"\\\n]*)"\s*:\s*")((?:[^"\\]|\\.)*)(")/gi;
+// An option key whose value is (or may hold) credential material.
+function isSensitiveGovcOptionKey(key) {
+    const folded = key.trim().toLowerCase();
+    return (folded.startsWith("guestinfo.") ||
+        folded.includes("userdata") ||
+        folded.includes("vendordata") ||
+        folded.includes("ovfenv") ||
+        looksLikeCredentialName(folded));
+}
+// A value this hook (or an earlier pass) has nothing left to mask in.
+function isMaskedOrEmptyGovcValue(value) {
+    const body = value.trim();
+    return (body === "" ||
+        body === '""' ||
+        body === RESOURCE_REDACTED_MARKER ||
+        body === `"${RESOURCE_REDACTED_MARKER}"`);
+}
+function maskGovcSecrets(data) {
+    let count = 0;
+    const maskedJson = `"${RESOURCE_REDACTED_MARKER}"`;
+    const text = data.text
+        .replace(GOVC_OPTION_KEY_FIRST_REGEX, (whole, keyPrefix, key, separator, value) => {
+        if (!isSensitiveGovcOptionKey(key) || isMaskedOrEmptyGovcValue(value)) {
+            return whole;
+        }
+        count++;
+        return `${keyPrefix}${key}${separator}${maskedJson}`;
+    })
+        .replace(GOVC_OPTION_VALUE_FIRST_REGEX, (whole, valuePrefix, value, separator, key, closingQuote) => {
+        if (!isSensitiveGovcOptionKey(key) || isMaskedOrEmptyGovcValue(value)) {
+            return whole;
+        }
+        count++;
+        return `${valuePrefix}${maskedJson}${separator}${key}${closingQuote}`;
+    })
+        .replace(GOVC_OPTION_DUMP_REGEX, (whole, keyPrefix, key, separator, value) => {
+        if (!isSensitiveGovcOptionKey(key) || isMaskedOrEmptyGovcValue(value)) {
+            return whole;
+        }
+        count++;
+        return `${keyPrefix}${key}${separator}${maskedJson}`;
+    })
+        .replace(GOVC_GUESTINFO_LINE_REGEX, (whole, prefix, value) => {
+        if (isMaskedOrEmptyGovcValue(value)) {
+            return whole;
+        }
+        count++;
+        return `${prefix}${RESOURCE_REDACTED_MARKER}`;
+    })
+        .replace(GOVC_SECRET_JSON_PAIR_REGEX, (whole, prefix, value, suffix) => {
+        if (isMaskedOrEmptyGovcValue(value)) {
+            return whole;
+        }
+        count++;
+        return `${prefix}${RESOURCE_REDACTED_MARKER}${suffix}`;
+    });
+    return { text, redactionCount: count };
+}
+/*
+ * The rest of a Ceph secret's footprint, after maskCephKeys:
+ *  - a bare cephx secret wherever it appears (`ceph auth print-key` prints
+ *    one alone; an audit entry or an escaped JSON string can hold one). A
+ *    cephx secret is the base64 of a 28-byte key record whose type is 1, so
+ *    it starts "AQ" and is 40 characters long with "==" padding; the
+ *    pattern is looser than that on purpose;
+ *  - the value of a `"val"` or `"value"` field, plain or escaped inside
+ *    another JSON string: the audit channel (`ceph log last ... audit`)
+ *    records every `config-key set` and `config set` a client ran, value
+ *    included, and those values are where dashboard, RGW and cephadm
+ *    credentials live.
+ */
+const CEPHX_SECRET_REGEX = /(^|[^A-Za-z0-9+/])AQ[A-Za-z0-9+/]{30,}={0,2}/g;
+const CEPH_VALUE_JSON_REGEX = /("(?:val|value)"\s*:\s*")((?:[^"\\]|\\.)*)(")/g;
+const CEPH_VALUE_ESCAPED_JSON_REGEX = /(\\"(?:val|value)\\"\s*:\s*\\")((?:[^"\\]|\\\\\\["\\]|\\\\[^"\\])*)(\\")/g;
+function maskCephSecretValues(data) {
+    let count = 0;
+    const maskValue = (whole, prefix, value, suffix) => {
+        if (!value || value === RESOURCE_REDACTED_MARKER) {
+            return whole;
+        }
+        count++;
+        return `${prefix}${RESOURCE_REDACTED_MARKER}${suffix}`;
+    };
+    const text = data.text
+        .replace(CEPH_VALUE_JSON_REGEX, maskValue)
+        .replace(CEPH_VALUE_ESCAPED_JSON_REGEX, maskValue)
+        .replace(CEPHX_SECRET_REGEX, (_whole, before) => {
+        count++;
+        return `${before}${RESOURCE_REDACTED_MARKER}`;
+    });
+    return { text, redactionCount: count };
+}
+/*
+ * pvesh (Proxmox VE). A guest's config and pending changes carry
+ * cloud-init's `cipassword`, and the cluster storage list can carry a
+ * `password`, an RBD `keyring` or a PBS `encryption-key`. Masked in every
+ * shape the agent prints the API's answer in: JSON pairs (plain, or escaped
+ * inside another JSON string), `key: value` and `key value` lines, the rows
+ * of pvesh's text tables (`│ cipassword │ ... │`), and /pending entries —
+ * {"key": "cipassword", "value": ..., "pending": ...}, members in any order
+ * — where the secret's NAME is itself a value, so the generic rules never
+ * read it as a key. In the table and pending shapes any credential-looking
+ * name (isCredentialKey) counts too; the generic rules cover it elsewhere.
+ */
+const PROXMOX_SECRET_KEYS = [
+    "cipassword",
+    "password",
+    "keyring",
+    "encryption-key",
+];
+const PROXMOX_SECRET_KEY_SOURCE = PROXMOX_SECRET_KEYS.join("|");
+const PROXMOX_SECRET_JSON_REGEX = new RegExp(`("(?:${PROXMOX_SECRET_KEY_SOURCE})"\\s*:\\s*")((?:[^"\\\\]|\\\\.)*)(")`, "gi");
+const PROXMOX_SECRET_ESCAPED_JSON_REGEX = new RegExp(`(\\\\"(?:${PROXMOX_SECRET_KEY_SOURCE})\\\\"\\s*:\\s*\\\\")((?:[^"\\\\]|\\\\[^"])*)(\\\\")`, "gi");
+const PROXMOX_SECRET_LINE_REGEX = new RegExp(`^([ \\t]*(?:-[ \\t]+)?(?:${PROXMOX_SECRET_KEY_SOURCE})(?:[ \\t]*[:=][ \\t]*|[ \\t]+))(\\S.*)$`, "gim");
+const PROXMOX_FLAT_JSON_OBJECT_REGEX = /\{[^{}]*\}/g;
+const PROXMOX_PENDING_KEY_REGEX = /"key"\s*:\s*"((?:[^"\\]|\\.)*)"/;
+const PROXMOX_PENDING_VALUE_REGEX = /("(?:value|pending)"\s*:\s*)("(?:[^"\\]|\\.)*"|-?[0-9][0-9.eE+-]*)/g;
+const PROXMOX_TABLE_ROW_REGEX = /^([ \t]*)([│|])(.*)$/gm;
+const PROXMOX_CELL_CONTENT_REGEX = /\S(?:.*\S)?/;
+function isProxmoxSecretName(name) {
+    const folded = name.trim().toLowerCase();
+    return PROXMOX_SECRET_KEYS.includes(folded) || isCredentialKey(folded);
+}
+// A value an earlier pass already masked, or one with nothing in it.
+function isMaskedOrEmptyProxmoxValue(value) {
+    const body = unquote(value.trim().replace(/,$/, "").trim());
+    return body === "" || body.startsWith(REDACTED_PREFIX);
+}
+function maskProxmoxSecrets(data) {
+    let count = 0;
+    const maskPair = (whole, prefix, value, suffix) => {
+        if (isMaskedOrEmptyProxmoxValue(value)) {
+            return whole;
+        }
+        count++;
+        return `${prefix}${RESOURCE_REDACTED_MARKER}${suffix}`;
+    };
+    const text = data.text
+        .replace(PROXMOX_SECRET_JSON_REGEX, maskPair)
+        .replace(PROXMOX_SECRET_ESCAPED_JSON_REGEX, maskPair)
+        .replace(PROXMOX_FLAT_JSON_OBJECT_REGEX, (entry) => {
+        const key = PROXMOX_PENDING_KEY_REGEX.exec(entry);
+        if (!key || !isProxmoxSecretName(key[1] || "")) {
+            return entry;
+        }
+        return entry.replace(PROXMOX_PENDING_VALUE_REGEX, (whole, prefix, value) => {
+            if (isMaskedOrEmptyProxmoxValue(value)) {
+                return whole;
+            }
+            count++;
+            return `${prefix}"${RESOURCE_REDACTED_MARKER}"`;
+        });
+    })
+        .replace(PROXMOX_SECRET_LINE_REGEX, (whole, prefix, value) => {
+        if (isMaskedOrEmptyProxmoxValue(value)) {
+            return whole;
+        }
+        count++;
+        return `${prefix}${RESOURCE_REDACTED_MARKER}`;
+    })
+        .replace(PROXMOX_TABLE_ROW_REGEX, (whole, indent, separator, rest) => {
+        const cells = rest.split(separator);
+        if (cells.length < 2 || !isProxmoxSecretName(cells[0] || "")) {
+            return whole;
+        }
+        const masked = cells.map((cell, index) => {
+            if (index === 0 || isMaskedOrEmptyProxmoxValue(cell)) {
+                return cell;
+            }
+            count++;
+            return cell.replace(PROXMOX_CELL_CONTENT_REGEX, RESOURCE_REDACTED_MARKER);
+        });
+        return `${indent}${separator}${masked.join(separator)}`;
+    });
+    return { text, redactionCount: count };
+}
+/*
+ * Credentials on the command lines a process listing prints (ps, top -c,
+ * the cgroup tree of systemctl status, journalctl):
+ * the value after a credential-named flag (`--password=x`, `--token x`,
+ * `-Dapp.db.password=x`), a credential-named assignment (`PASSWORD=x`,
+ * `DB_TOKEN=x`) and the password half of `-u user:password` (curl, wget).
+ * ps and top join a process's argv with single spaces and drop its quotes,
+ * so a value is the run of characters up to the next whitespace. Names
+ * are judged by the generic rules' own isCredentialKey, so both layers
+ * agree on what a credential is called.
+ */
+const PROCESS_USER_PASSWORD_FLAGS = [
+    "-u",
+    "--user",
+    "-U",
+    "--proxy-user",
+];
+const PROCESS_NUMERIC_REGEX = /^[0-9]+$/;
+// One process line with its credential values masked, and how many.
+function maskProcessLine(line) {
+    // Words at even indexes, the whitespace between them at odd ones.
+    const parts = line.split(/(\s+)/);
+    let count = 0;
+    let maskNextWord = false;
+    let userPasswordNext = false;
+    for (let i = 0; i < parts.length; i += 2) {
+        const word = parts[i] || "";
+        if (!word) {
+            continue;
+        }
+        if (maskNextWord) {
+            maskNextWord = false;
+            if (!word.startsWith("-") && !isExemptValue(word)) {
+                parts[i] = RESOURCE_REDACTED_MARKER;
+                count++;
+                continue;
+            }
+        }
+        if (userPasswordNext) {
+            userPasswordNext = false;
+            const colon = word.indexOf(":");
+            const password = colon > 0 ? word.slice(colon + 1) : "";
+            if (password &&
+                !word.startsWith("-") &&
+                !PROCESS_NUMERIC_REGEX.test(password) &&
+                !isExemptValue(password)) {
+                parts[i] = `${word.slice(0, colon + 1)}${RESOURCE_REDACTED_MARKER}`;
+                count++;
+                continue;
+            }
+        }
+        const equals = word.indexOf("=");
+        if (equals > 0) {
+            const value = word.slice(equals + 1);
+            if (value &&
+                !isExemptValue(value) &&
+                isCredentialKey(word.slice(0, equals))) {
+                parts[i] = `${word.slice(0, equals + 1)}${RESOURCE_REDACTED_MARKER}`;
+                count++;
+            }
+            continue;
+        }
+        if (!word.startsWith("-") || word.length < 2) {
+            continue;
+        }
+        if (PROCESS_USER_PASSWORD_FLAGS.includes(word)) {
+            userPasswordNext = true;
+            continue;
+        }
+        if (isCredentialKey(word)) {
+            maskNextWord = true;
+        }
+    }
+    return { text: parts.join(""), count };
+}
+function maskProcessCredentialArguments(data) {
+    let count = 0;
+    const lines = data.text
+        .split("\n")
+        .map((line) => {
+        const masked = maskProcessLine(line);
+        count += masked.count;
+        return masked.text;
+    });
+    return { text: lines.join("\n"), redactionCount: count };
+}
+/*
+ * journalctl prints the command lines of the processes it logged: in a
+ * message, and with -o json in each record's _CMDLINE field. A JSON record
+ * (one per line) has each of its string values masked as a process line —
+ * decoded first and re-encoded after, so the record stays valid JSON; any
+ * other line is masked as a process line itself.
+ */
+function maskJournalCredentialArguments(data) {
+    let count = 0;
+    const lines = data.text
+        .split("\n")
+        .map((line) => {
+        const trimmed = line.trim();
+        if (trimmed.startsWith("{") && trimmed.endsWith("}")) {
+            let record = null;
+            try {
+                record = JSON.parse(trimmed);
+            }
+            catch (_a) {
+                record = null;
+            }
+            if (record && typeof record === "object" && !Array.isArray(record)) {
+                const fields = record;
+                let changed = false;
+                for (const key of Object.keys(fields)) {
+                    const value = fields[key];
+                    if (typeof value !== "string") {
+                        continue;
+                    }
+                    const masked = maskProcessLine(value);
+                    if (masked.count > 0) {
+                        fields[key] = masked.text;
+                        count += masked.count;
+                        changed = true;
+                    }
+                }
+                if (!changed) {
+                    return line;
+                }
+                /*
+                 * Spliced in by position, never through String.replace: a
+                 * replacement string's "$&" (a MESSAGE may hold one) would paste
+                 * the original, unmasked record back in.
+                 */
+                const start = line.indexOf(trimmed);
+                return `${line.slice(0, start)}${JSON.stringify(fields)}${line.slice(start + trimmed.length)}`;
+            }
+        }
+        const masked = maskProcessLine(line);
+        count += masked.count;
+        return masked.text;
+    });
+    return { text: lines.join("\n"), redactionCount: count };
+}
+/*
+ * `ceph status` (and `ceph -s`) in its plain format calls its usage section
+ * "data:" — pools, objects, usage and PG states — and the generic rules,
+ * written for kubectl, read a "data:" block as a Kubernetes Secret's and
+ * mask every line of it, which leaves the model blind to the one summary it
+ * asks for first. For exactly that shape — a "  data:" header after the
+ * "  cluster:" / "    id: FSID" / "  services:" headers, holding only
+ * ceph's own usage lines and their continuation lines — the header is
+ * renamed to a placeholder the generic rules read as an ordinary key while
+ * they run, and written back afterwards. Every line under it still gets the
+ * generic per-line rules. Any other shape (and output that already holds
+ * the placeholder) is left to the generic rules whole: over-masking is
+ * accepted, under-masking is not.
+ */
+const CEPH_STATUS_DATA_PLACEHOLDER = "ceph-status-usage-section";
+const CEPH_STATUS_DATA_HEADER = "  data:";
+const CEPH_STATUS_DATA_KEYS = [
+    "volumes",
+    "pools",
+    "objects",
+    "usage",
+    "pgs",
+];
+const CEPH_STATUS_FSID_LINE_REGEX = /^ {4}id: +[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+const CEPH_STATUS_DATA_ENTRY_REGEX = /^ {4}([a-z]+):(?: |$)/;
+const CEPH_STATUS_PLACEHOLDER_LINE_REGEX = new RegExp(`^( {2})${CEPH_STATUS_DATA_PLACEHOLDER}:`);
+export function shieldCephStatusDataSection(text) {
+    if (typeof text !== "string" || text.includes(CEPH_STATUS_DATA_PLACEHOLDER)) {
+        return null;
+    }
+    const lines = text.split("\n");
+    const bare = lines.map((line) => {
+        return line.replace(/\r$/, "");
+    });
+    const clusterIndex = bare.indexOf("  cluster:");
+    if (clusterIndex < 0 ||
+        !CEPH_STATUS_FSID_LINE_REGEX.test(bare[clusterIndex + 1] || "")) {
+        return null;
+    }
+    const servicesIndex = bare.indexOf("  services:", clusterIndex);
+    const dataIndex = servicesIndex < 0
+        ? -1
+        : bare.indexOf(CEPH_STATUS_DATA_HEADER, servicesIndex);
+    if (dataIndex < 0) {
+        return null;
+    }
+    let entries = 0;
+    for (let index = dataIndex + 1; index < bare.length; index++) {
+        const line = bare[index];
+        if (line.trim() === "") {
+            break;
+        }
+        const indent = line.length - line.trimStart().length;
+        if (indent <= 2) {
+            break;
+        }
+        if (indent === 4) {
+            const entry = CEPH_STATUS_DATA_ENTRY_REGEX.exec(line);
+            if (!entry || !CEPH_STATUS_DATA_KEYS.includes(entry[1] || "")) {
+                return null;
+            }
+            entries++;
+            continue;
+        }
+        // Deeper: the continuation of the entry above ("  12 active+clean").
+        if (indent > 4 && entries > 0) {
+            continue;
+        }
+        return null;
+    }
+    if (entries === 0) {
+        return null;
+    }
+    const shielded = lines.slice();
+    shielded[dataIndex] = lines[dataIndex].replace("data:", `${CEPH_STATUS_DATA_PLACEHOLDER}:`);
+    return {
+        text: shielded.join("\n"),
+        restore: (redacted) => {
+            return redacted
+                .split("\n")
+                .map((line) => {
+                return line.replace(CEPH_STATUS_PLACEHOLDER_LINE_REGEX, "$1data:");
+            })
+                .join("\n");
+        },
+    };
+}
+/*
+ * Output a program prints that the generic rules misread, shielded while
+ * they run (see shieldCephStatusDataSection); null for everything else.
+ */
+function shieldFromGenericRules(program, text) {
+    try {
+        return program === "ceph" ? shieldCephStatusDataSection(text) : null;
+    }
+    catch (_a) {
+        return null;
+    }
+}
+/*
+ * The per-program hooks, run on the raw output before the generic rules.
+ * Keyed by argv[0]; a program with no entry gets the generic rules only.
+ * Each tool's kit extends its program's list (pvesh `cipassword`, govc
+ * credentials, db query literals, ...).
+ */
+export const RESOURCE_OUTPUT_REDACTION_HOOKS = {
+    ps: [maskProcessCredentialArguments],
+    top: [maskProcessCredentialArguments],
+    // systemctl status prints every process of a unit's cgroup, argv and all.
+    systemctl: [maskProcessCredentialArguments],
+    journalctl: [maskJournalCredentialArguments],
+    docker: [maskDockerEnvValues, maskDockerPrettyEnvLines],
+    ceph: [maskCephKeys, maskCephSecretValues],
+    pvesh: [maskProxmoxSecrets],
+    govc: [maskGovcSecrets],
+    db: [redactDatabaseOutput],
+};
+// The hooks for one program; none for a program the table does not list.
+export function getResourceOutputRedactionHooks(program) {
+    if (typeof program !== "string" ||
+        !Object.prototype.hasOwnProperty.call(RESOURCE_OUTPUT_REDACTION_HOOKS, program)) {
+        return [];
+    }
+    return RESOURCE_OUTPUT_REDACTION_HOOKS[program] || [];
+}
+/*
+ * Redact one command's output: the program's hooks, then the generic rules.
+ * Total: anything that is not text comes back as "", and a hook that throws
+ * is skipped (the generic rules still run over what it was given).
+ */
+export function redactResourceCommandOutputWithCount(data) {
+    if (!data || typeof data.text !== "string" || !data.text) {
+        return { text: "", redactionCount: 0 };
+    }
+    let text = data.text;
+    let count = 0;
+    for (const hook of getResourceOutputRedactionHooks(data.program)) {
+        try {
+            const hooked = hook({
+                resourceType: data.resourceType,
+                program: data.program,
+                text,
+            });
+            if (hooked && typeof hooked.text === "string") {
+                text = hooked.text;
+                count +=
+                    typeof hooked.redactionCount === "number" ? hooked.redactionCount : 0;
+            }
+        }
+        catch (_a) {
+            // A broken hook must never leak the output unredacted by the generic rules.
+        }
+    }
+    const shield = shieldFromGenericRules(data.program, text);
+    const generic = GenericOutputRedactor.redact(shield ? shield.text : text);
+    return {
+        text: shield ? shield.restore(generic.text) : generic.text,
+        redactionCount: count + generic.redactionCount,
+    };
+}
+export function redactResourceCommandOutput(data) {
+    return redactResourceCommandOutputWithCount(data).text;
+}
+//# sourceMappingURL=ResourceOutputRedactor.js.map