@pipedog/core 0.0.0 → 0.2.0

package/dist/utils/log_config.js

@@ -0,0 +1,76 @@
+// Copyright (c) 2024-2026, Daily
+// Copyright (c) 2026, pipedog contributors
+// SPDX-License-Identifier: BSD-2-Clause
+//
+// Ported from pipecat: src/pipecat/utils/log_config.py
+/**
+ * Process-wide controls for Pipecat's debug logging.
+ *
+ * Some debug output grows with the length of a session, such as the LLM context
+ * logged on every inference. The settings here choose how much of it to write,
+ * and each is read from an environment variable once, on first use.
+ *
+ * - `PIPECAT_LOG_LLM_CONTEXT`: how much of the context LLM services include
+ *   in their DEBUG log lines. `full` (the default) logs every message;
+ *   `off` logs the line without the context.
+ *
+ * @example
+ * // PIPECAT_LOG_LLM_CONTEXT=off bun bot.ts
+ */
+import { getEnv, InvalidEnvVarValueError } from "./env.js";
+export const _LLM_CONTEXT_LOG_ENV_VAR = "PIPECAT_LOG_LLM_CONTEXT";
+/**
+ * How much of the context LLM services include in their DEBUG log lines.
+ *
+ * LLM services log a DEBUG line each time they generate a response, and
+ * realtime services when they set up their server-side conversation. The
+ * context is built only when DEBUG is enabled.
+ *
+ * - FULL: Every message of the context.
+ * - OFF: None of it; the line is logged without the context.
+ */
+export const _LLMContextLogMode = {
+    FULL: "full",
+    OFF: "off",
+};
+let llmContextLogMode = null;
+/**
+ * Return how LLM services log the context.
+ *
+ * The mode named by `PIPECAT_LOG_LLM_CONTEXT`, or `full` when it is unset
+ * or empty. The environment variable is read once, on first use.
+ *
+ * @returns The current LLM context log mode.
+ * @throws InvalidEnvVarValueError If `PIPECAT_LOG_LLM_CONTEXT` is set to an unknown mode.
+ */
+export function _getLlmContextLogMode() {
+    if (llmContextLogMode === null) {
+        llmContextLogMode = _llmContextLogModeFromEnv();
+    }
+    return llmContextLogMode;
+}
+/**
+ * Forget the cached mode so the next `_getLlmContextLogMode()` reads the
+ * environment again. Python tests assign `_llm_context_log_mode = None`; a
+ * module variable can't be assigned from outside in JS.
+ */
+export function _resetLlmContextLogMode() {
+    llmContextLogMode = null;
+}
+export function _llmContextLogModeFromEnv() {
+    const raw = getEnv(_LLM_CONTEXT_LOG_ENV_VAR);
+    if (raw === undefined || !raw.trim()) {
+        return _LLMContextLogMode.FULL;
+    }
+    const value = raw.trim().toLowerCase();
+    const modes = Object.values(_LLMContextLogMode);
+    if (modes.includes(value)) {
+        return value;
+    }
+    throw new InvalidEnvVarValueError({
+        name: _LLM_CONTEXT_LOG_ENV_VAR,
+        value: raw,
+        expected: modes.join(" or "),
+    });
+}
+//# sourceMappingURL=log_config.js.map

package/dist/utils/logger.d.ts

@@ -0,0 +1,40 @@
+export declare const LOG_LEVELS: {
+    readonly TRACE: 5;
+    readonly DEBUG: 10;
+    readonly INFO: 20;
+    readonly SUCCESS: 25;
+    readonly WARNING: 30;
+    readonly ERROR: 40;
+    readonly CRITICAL: 50;
+};
+export type LogLevel = keyof typeof LOG_LEVELS;
+export interface LogRecord {
+    level: LogLevel;
+    message: string;
+    time: Date;
+    error?: unknown;
+}
+export type LogSink = (record: LogRecord) => void;
+declare class Logger {
+    #private;
+    /** Only records at or above `level` are emitted. */
+    setLevel(level: LogLevel): void;
+    isEnabledFor(level: LogLevel): boolean;
+    /** Replace all sinks (loguru `logger.remove()` + `logger.add(sink)`). */
+    setSink(...sinks: LogSink[]): void;
+    addSink(sink: LogSink): () => void;
+    log(level: LogLevel, message: string, error?: unknown): void;
+    trace(message: string): void;
+    debug(message: string): void;
+    info(message: string): void;
+    success(message: string): void;
+    warning(message: string): void;
+    warn(message: string): void;
+    error(message: string, error?: unknown): void;
+    /** loguru `logger.exception`: an error with its stack. */
+    exception(message: string, error?: unknown): void;
+    critical(message: string, error?: unknown): void;
+}
+export declare const logger: Logger;
+export type { Logger };
+//# sourceMappingURL=logger.d.ts.map

package/dist/utils/logger.js

@@ -0,0 +1,91 @@
+// Copyright (c) 2026, pipedog contributors
+// SPDX-License-Identifier: BSD-2-Clause
+//
+// Stand-in for loguru, which upstream logs through. Same level names, so
+// ported `logger.warning(...)` calls read the same. Replace the sink to route
+// logs elsewhere (pino, console.json, Workers logs...).
+export const LOG_LEVELS = {
+    TRACE: 5,
+    DEBUG: 10,
+    INFO: 20,
+    SUCCESS: 25,
+    WARNING: 30,
+    ERROR: 40,
+    CRITICAL: 50,
+};
+const consoleSink = (record) => {
+    const line = `${record.time.toISOString()} | ${record.level.padEnd(8)} | ${record.message}`;
+    if (LOG_LEVELS[record.level] >= LOG_LEVELS.ERROR) {
+        console.error(line, ...(record.error ? [record.error] : []));
+    }
+    else if (record.level === "WARNING") {
+        console.warn(line);
+    }
+    else {
+        console.log(line);
+    }
+};
+function initialLevel() {
+    const env = globalThis.process
+        ?.env;
+    const value = env?.PIPEDOG_LOG_LEVEL?.toUpperCase();
+    return value && value in LOG_LEVELS ? value : "DEBUG";
+}
+class Logger {
+    #level = LOG_LEVELS[initialLevel()];
+    #sinks = [consoleSink];
+    /** Only records at or above `level` are emitted. */
+    setLevel(level) {
+        this.#level = LOG_LEVELS[level];
+    }
+    isEnabledFor(level) {
+        return LOG_LEVELS[level] >= this.#level;
+    }
+    /** Replace all sinks (loguru `logger.remove()` + `logger.add(sink)`). */
+    setSink(...sinks) {
+        this.#sinks = sinks;
+    }
+    addSink(sink) {
+        this.#sinks.push(sink);
+        return () => {
+            this.#sinks = this.#sinks.filter((s) => s !== sink);
+        };
+    }
+    log(level, message, error) {
+        if (LOG_LEVELS[level] < this.#level)
+            return;
+        const record = { level, message, time: new Date(), error };
+        for (const sink of this.#sinks)
+            sink(record);
+    }
+    trace(message) {
+        this.log("TRACE", message);
+    }
+    debug(message) {
+        this.log("DEBUG", message);
+    }
+    info(message) {
+        this.log("INFO", message);
+    }
+    success(message) {
+        this.log("SUCCESS", message);
+    }
+    warning(message) {
+        this.log("WARNING", message);
+    }
+    warn(message) {
+        this.log("WARNING", message);
+    }
+    error(message, error) {
+        this.log("ERROR", message, error);
+    }
+    /** loguru `logger.exception`: an error with its stack. */
+    exception(message, error) {
+        this.log("ERROR", message, error);
+    }
+    critical(message, error) {
+        this.log("CRITICAL", message, error);
+    }
+}
+export const logger = new Logger();
+//# sourceMappingURL=logger.js.map

package/dist/utils/mixin.d.ts

@@ -0,0 +1,14 @@
+export type Ctor<T = object> = abstract new (...args: any[]) => T;
+export type Mixin<F extends (base: Ctor) => Ctor, I> = F & {
+    [Symbol.hasInstance](value: unknown): value is I;
+};
+export declare function defineMixin<I, F extends <B extends Ctor>(base: B) => Ctor>(name: string, factory: F): Mixin<F, I>;
+/**
+ * Make `instanceof parent` true for instances of `child` without `child`
+ * extending it, like Python's `ABC.register`. Use it when upstream inherits
+ * from two concrete classes, e.g. `InputTextRawFrame(SystemFrame, TextFrame)`:
+ * `class InputTextRawFrame extends SystemFrame` + `addVirtualBase(InputTextRawFrame, TextFrame)`.
+ * The child must declare the parent's fields itself.
+ */
+export declare function addVirtualBase(child: Function, parent: Function): void;
+//# sourceMappingURL=mixin.d.ts.map

package/dist/utils/mixin.js

@@ -0,0 +1,63 @@
+// Copyright (c) 2026, pipedog contributors
+// SPDX-License-Identifier: BSD-2-Clause
+//
+// Python multiple inheritance (`class C(A, B)`) maps to a class-factory mixin:
+// `class C extends B(A)`. `defineMixin` brands every class the factory
+// produces so `x instanceof B` keeps working like `isinstance(x, B)`.
+//
+//   export interface AudioRawFrame { audio: Uint8Array; ... }
+//   export const AudioRawFrame = defineMixin("AudioRawFrame", <B extends Ctor>(Base: B) => {
+//     abstract class AudioRawFrameMixin extends Base { ... }
+//     return AudioRawFrameMixin;
+//   });
+//   export class OutputAudioRawFrame extends AudioRawFrame(DataFrame) { ... }
+//   frame instanceof AudioRawFrame // true
+//
+// Constructors take one options object (Python's **kwargs), so a mixin reads
+// its own keys from `args[0]` and forwards everything to `super(...args)`.
+export function defineMixin(name, factory) {
+    const brand = Symbol.for(`pipedog.mixin.${name}`);
+    const apply = ((base) => {
+        const cls = factory(base);
+        Object.defineProperty(cls.prototype, brand, { value: true });
+        return cls;
+    });
+    Object.defineProperty(apply, "name", { value: name });
+    Object.defineProperty(apply, Symbol.hasInstance, {
+        value: (value) => typeof value === "object" &&
+            value !== null &&
+            value[brand] === true,
+    });
+    return apply;
+}
+const virtualBases = new WeakMap();
+/**
+ * Make `instanceof parent` true for instances of `child` without `child`
+ * extending it, like Python's `ABC.register`. Use it when upstream inherits
+ * from two concrete classes, e.g. `InputTextRawFrame(SystemFrame, TextFrame)`:
+ * `class InputTextRawFrame extends SystemFrame` + `addVirtualBase(InputTextRawFrame, TextFrame)`.
+ * The child must declare the parent's fields itself.
+ */
+export function addVirtualBase(child, parent) {
+    let children = virtualBases.get(parent);
+    if (!children) {
+        children = new Set();
+        virtualBases.set(parent, children);
+        Object.defineProperty(parent, Symbol.hasInstance, {
+            value(value) {
+                if (Function.prototype[Symbol.hasInstance].call(this, value))
+                    return true;
+                const registered = virtualBases.get(this);
+                if (!registered)
+                    return false;
+                for (const c of registered) {
+                    if (Function.prototype[Symbol.hasInstance].call(c, value))
+                        return true;
+                }
+                return false;
+            },
+        });
+    }
+    children.add(child);
+}
+//# sourceMappingURL=mixin.js.map

package/dist/utils/network.d.ts

@@ -0,0 +1,73 @@
+/** Base class for network utilities, providing exponential backoff time calculation. */
+/**
+ * Calculate exponential backoff wait time.
+ *
+ * @param attempt Current attempt number (1-based)
+ * @param minWait Minimum wait time in seconds
+ * @param maxWait Maximum wait time in seconds
+ * @param multiplier Base multiplier for exponential calculation
+ * @returns Wait time in seconds
+ */
+export declare function exponentialBackoffTime(attempt: number, minWait?: number, maxWait?: number, multiplier?: number): number;
+export interface QuickFailureResultOptions {
+    isQuickFailure: boolean;
+    shouldGiveUp: boolean;
+}
+/**
+ * Outcome of recording one failed connection attempt.
+ *
+ * - `isQuickFailure`: Whether this attempt lasted less than the tracker's
+ *   `minStableDuration`.
+ * - `shouldGiveUp`: Whether `maxConsecutiveFailures` quick failures have now
+ *   happened in a row and the caller should stop retrying.
+ */
+export declare class QuickFailureResult {
+    isQuickFailure: boolean;
+    shouldGiveUp: boolean;
+    constructor(options: QuickFailureResultOptions);
+}
+export interface QuickFailureTrackerOptions {
+    /**
+     * Minimum time, in seconds, a connection must survive to be considered
+     * stable rather than a quick failure.
+     */
+    minStableDuration?: number;
+    /**
+     * Number of consecutive quick failures after which `record()` reports that
+     * the caller should give up.
+     */
+    maxConsecutiveFailures?: number;
+}
+/**
+ * Detects a connection that keeps failing immediately after connecting.
+ *
+ * Exponential backoff alone doesn't help when a connection attempt succeeds
+ * just enough to fail again right away (e.g. a server that accepts a
+ * WebSocket handshake but then immediately rejects invalid credentials) —
+ * waiting longer between attempts won't fix that, only stopping will.
+ *
+ * Call `record()` with how long each failed attempt lasted. Once
+ * `maxConsecutiveFailures` attempts in a row each lasted under
+ * `minStableDuration` seconds, the result's `shouldGiveUp` is true,
+ * telling the caller to stop retrying instead of trying again.
+ */
+export declare class QuickFailureTracker {
+    minStableDuration: number;
+    maxConsecutiveFailures: number;
+    count: number;
+    constructor(options?: QuickFailureTrackerOptions);
+    /**
+     * Record a failed connection attempt that lasted `duration` seconds.
+     *
+     * Increments the consecutive-failure streak if this attempt was a quick
+     * failure, or resets it if the attempt was stable.
+     *
+     * @param duration How long the failed attempt lasted, in seconds.
+     * @returns A `QuickFailureResult` describing this attempt and whether the
+     *   caller should give up.
+     */
+    record(duration: number): QuickFailureResult;
+    /** Reset the consecutive-failure streak, e.g. on a fresh connect. */
+    reset(): void;
+}
+//# sourceMappingURL=network.d.ts.map

package/dist/utils/network.js

@@ -0,0 +1,90 @@
+// Copyright (c) 2024-2026, Daily
+// Copyright (c) 2026, pipedog contributors
+// SPDX-License-Identifier: BSD-2-Clause
+//
+// Ported from pipecat: src/pipecat/utils/network.py
+/** Base class for network utilities, providing exponential backoff time calculation. */
+/**
+ * Calculate exponential backoff wait time.
+ *
+ * @param attempt Current attempt number (1-based)
+ * @param minWait Minimum wait time in seconds
+ * @param maxWait Maximum wait time in seconds
+ * @param multiplier Base multiplier for exponential calculation
+ * @returns Wait time in seconds
+ */
+export function exponentialBackoffTime(attempt, minWait = 4, maxWait = 10, multiplier = 1) {
+    const exp = 2 ** (attempt - 1) * multiplier;
+    // Python raises OverflowError for huge exponents; JS yields Infinity/NaN.
+    if (Number.isNaN(exp)) {
+        return maxWait;
+    }
+    const result = Math.max(0, Math.min(exp, maxWait));
+    return Math.max(minWait, result);
+}
+/**
+ * Outcome of recording one failed connection attempt.
+ *
+ * - `isQuickFailure`: Whether this attempt lasted less than the tracker's
+ *   `minStableDuration`.
+ * - `shouldGiveUp`: Whether `maxConsecutiveFailures` quick failures have now
+ *   happened in a row and the caller should stop retrying.
+ */
+export class QuickFailureResult {
+    isQuickFailure;
+    shouldGiveUp;
+    constructor(options) {
+        this.isQuickFailure = options.isQuickFailure;
+        this.shouldGiveUp = options.shouldGiveUp;
+    }
+}
+/**
+ * Detects a connection that keeps failing immediately after connecting.
+ *
+ * Exponential backoff alone doesn't help when a connection attempt succeeds
+ * just enough to fail again right away (e.g. a server that accepts a
+ * WebSocket handshake but then immediately rejects invalid credentials) —
+ * waiting longer between attempts won't fix that, only stopping will.
+ *
+ * Call `record()` with how long each failed attempt lasted. Once
+ * `maxConsecutiveFailures` attempts in a row each lasted under
+ * `minStableDuration` seconds, the result's `shouldGiveUp` is true,
+ * telling the caller to stop retrying instead of trying again.
+ */
+export class QuickFailureTracker {
+    minStableDuration;
+    maxConsecutiveFailures;
+    count = 0;
+    constructor(options = {}) {
+        this.minStableDuration = options.minStableDuration ?? 5.0;
+        this.maxConsecutiveFailures = options.maxConsecutiveFailures ?? 3;
+    }
+    /**
+     * Record a failed connection attempt that lasted `duration` seconds.
+     *
+     * Increments the consecutive-failure streak if this attempt was a quick
+     * failure, or resets it if the attempt was stable.
+     *
+     * @param duration How long the failed attempt lasted, in seconds.
+     * @returns A `QuickFailureResult` describing this attempt and whether the
+     *   caller should give up.
+     */
+    record(duration) {
+        const isQuickFailure = duration < this.minStableDuration;
+        if (isQuickFailure) {
+            this.count += 1;
+        }
+        else {
+            this.count = 0;
+        }
+        return new QuickFailureResult({
+            isQuickFailure,
+            shouldGiveUp: isQuickFailure && this.count >= this.maxConsecutiveFailures,
+        });
+    }
+    /** Reset the consecutive-failure streak, e.g. on a fresh connect. */
+    reset() {
+        this.count = 0;
+    }
+}
+//# sourceMappingURL=network.js.map

package/dist/utils/security/allowed_origins.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Return allowed origins from the `PIPECAT_ALLOWED_ORIGINS` env var.
+ *
+ * Parses a comma-separated list of origin strings. Returns an empty list
+ * (allow all) when the variable is unset or empty.
+ */
+export declare function defaultAllowedOrigins(): string[];
+/**
+ * Return whether `origin` is permitted by `allowedOrigins`.
+ *
+ * @param origin The value of the `Origin` header, or an empty string if absent.
+ * @param allowedOrigins List of allowed origin strings. An empty list allows
+ *   all origins. When non-empty, a missing or disallowed origin is rejected.
+ */
+export declare function isOriginAllowed(origin: string, allowedOrigins: string[]): boolean;
+//# sourceMappingURL=allowed_origins.d.ts.map

package/dist/utils/security/allowed_origins.js

@@ -0,0 +1,34 @@
+// Copyright (c) 2024-2026, Daily
+// Copyright (c) 2026, pipedog contributors
+// SPDX-License-Identifier: BSD-2-Clause
+//
+// Ported from pipecat: src/pipecat/utils/security/allowed_origins.py
+/** Origin validation utilities. */
+import { getEnv } from "../env.js";
+/**
+ * Return allowed origins from the `PIPECAT_ALLOWED_ORIGINS` env var.
+ *
+ * Parses a comma-separated list of origin strings. Returns an empty list
+ * (allow all) when the variable is unset or empty.
+ */
+export function defaultAllowedOrigins() {
+    const val = getEnv("PIPECAT_ALLOWED_ORIGINS") ?? "";
+    return val
+        .split(",")
+        .map((o) => o.trim())
+        .filter((o) => o);
+}
+/**
+ * Return whether `origin` is permitted by `allowedOrigins`.
+ *
+ * @param origin The value of the `Origin` header, or an empty string if absent.
+ * @param allowedOrigins List of allowed origin strings. An empty list allows
+ *   all origins. When non-empty, a missing or disallowed origin is rejected.
+ */
+export function isOriginAllowed(origin, allowedOrigins) {
+    if (allowedOrigins.length === 0) {
+        return true;
+    }
+    return new Set(allowedOrigins.map((o) => o.toLowerCase())).has(origin.toLowerCase());
+}
+//# sourceMappingURL=allowed_origins.js.map

package/dist/utils/security/index.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/utils/security/index.js

@@ -0,0 +1,7 @@
+// Copyright (c) 2024-2026, Daily
+// Copyright (c) 2026, pipedog contributors
+// SPDX-License-Identifier: BSD-2-Clause
+//
+// Ported from pipecat: src/pipecat/utils/security/__init__.py
+export {};
+//# sourceMappingURL=index.js.map

package/dist/utils/security/redaction.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Masks credentials in text bound for logs and error reports.
+ *
+ * Error messages often quote whatever a failure carried: an SDK exception that
+ * prints the headers it sent, a URL signed for one download, a provider body
+ * echoing the key it rejected. `redactSecrets` masks the credential and keeps
+ * the rest, so a message still says what went wrong.
+ *
+ * It masks three things:
+ *
+ * - The value of any `name=value` or `name: value` pair, quoted or not,
+ *   whose name marks a credential (`api_key`, `Authorization`,
+ *   `X-Amz-Signature`, `apiKey`...). This covers query strings, printed
+ *   header dicts and plain prose alike.
+ * - A URL's password (`scheme://user:password@host`).
+ * - Tokens recognizable by their format alone: provider key prefixes, AWS
+ *   access key IDs and JWTs.
+ */
+export declare const REDACTED = "[REDACTED]";
+/**
+ * Mask the credentials in `text`, leaving the rest as written.
+ *
+ * @param text Text that may quote a credential, such as an error message.
+ * @returns The text with each credential replaced by `[REDACTED]`.
+ */
+export declare function redactSecrets(text: string): string;
+//# sourceMappingURL=redaction.d.ts.map

package/dist/utils/security/redaction.js

@@ -0,0 +1,123 @@
+// Copyright (c) 2024-2026, Daily
+// Copyright (c) 2026, pipedog contributors
+// SPDX-License-Identifier: BSD-2-Clause
+//
+// Ported from pipecat: src/pipecat/utils/security/redaction.py
+/**
+ * Masks credentials in text bound for logs and error reports.
+ *
+ * Error messages often quote whatever a failure carried: an SDK exception that
+ * prints the headers it sent, a URL signed for one download, a provider body
+ * echoing the key it rejected. `redactSecrets` masks the credential and keeps
+ * the rest, so a message still says what went wrong.
+ *
+ * It masks three things:
+ *
+ * - The value of any `name=value` or `name: value` pair, quoted or not,
+ *   whose name marks a credential (`api_key`, `Authorization`,
+ *   `X-Amz-Signature`, `apiKey`...). This covers query strings, printed
+ *   header dicts and plain prose alike.
+ * - A URL's password (`scheme://user:password@host`).
+ * - Tokens recognizable by their format alone: provider key prefixes, AWS
+ *   access key IDs and JWTs.
+ */
+export const REDACTED = "[REDACTED]";
+// A name marks a credential when one of its words is one of these, so
+// `x-api-key` and `X-Amz-Security-Token` do while `keyterms` and `max_tokens`
+// don't.
+const CREDENTIAL_WORDS = new Set([
+    "apikey",
+    "auth",
+    "authorization",
+    "cookie",
+    "credential",
+    "credentials",
+    "creds",
+    "jwt",
+    "key",
+    "passwd",
+    "password",
+    "pwd",
+    "secret",
+    "sig",
+    "signature",
+    "token",
+    // Google's resumable upload session ID, which authorizes the upload by itself.
+    "uploadid",
+]);
+// `name=value` or `name: value` (or `:=`, `=>`), the name optionally quoted as
+// in a printed dict, the value quoted or running to the next delimiter. A
+// quoted value cut short before its closing quote, as a truncated repr leaves
+// it, runs to the next delimiter instead. An auth scheme (`Bearer`, `Basic`...)
+// ahead of the value is kept. A value already redacted is matched whole, so
+// text redacted twice reads the same as text redacted once.
+const PAIR = new RegExp(String.raw `(?<name>(?<![\w.-])(?<nq>["']?)[A-Za-z][\w.-]*\k<nq>)` +
+    String.raw `(?<sep>\s*(?::=|=>|[:=])\s*)` +
+    String.raw `(?<scheme>(?:Bearer|Basic|Token|Api-Token|Key|Digest|AWS4-HMAC-SHA256)\s+)?` +
+    String.raw `(?:(?<vq>["'])(?<quoted>.*?)\k<vq>` +
+    String.raw `|(?<oq>["']?)(?<bare>(?:\[REDACTED\]|[^\s,;&"'}\])\[])+))`, "g");
+const URL_PASSWORD = /(?<prefix>\b[a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:)[^\s/@]+(?=@)/gi;
+// Formats after gitleaks' rules for the same credentials
+// (github.com/gitleaks/gitleaks, config/gitleaks.toml), loosened where a
+// looser match costs nothing: a log line is masked, not scanned for findings.
+const KNOWN_TOKENS = new RegExp(String.raw `\b(?:` +
+    String.raw `sk-[A-Za-z0-9_-]{20,}` + // OpenAI, Anthropic
+    String.raw `|(?:A3T[A-Z0-9]|AKIA|ASIA|ABIA|ACCA)[A-Z0-9]{16}` + // AWS access key IDs
+    String.raw `|ABSK[A-Za-z0-9+/]{109,269}={0,2}` + // Amazon Bedrock API keys, long-lived
+    String.raw `|bedrock-api-key-[A-Za-z0-9+/=_-]+` + // Amazon Bedrock API keys, short-lived
+    String.raw `|AIza[0-9A-Za-z_-]{35}` + // Google API keys
+    String.raw `|gh[pousr]_[A-Za-z0-9]{36,}|github_pat_\w{82,}` + // GitHub
+    String.raw `|xox[abeoprs]-[A-Za-z0-9-]{10,}|xapp-\d-[A-Za-z0-9-]{10,}` + // Slack
+    // Slack webhooks, whose path is the secret
+    String.raw `|(?:(?<=hooks\.slack\.com/services/)|(?<=hooks\.slack\.com/workflows/)` +
+    String.raw `|(?<=hooks\.slack\.com/triggers/))[A-Za-z0-9+/]{20,}` +
+    String.raw `|(?:hf|api_org)_[A-Za-z]{34}` + // Hugging Face
+    String.raw `|pplx-[A-Za-z0-9]{48}` + // Perplexity
+    String.raw `|SK[0-9a-fA-F]{32}` + // Twilio API keys
+    String.raw `|eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]*` + // JWTs, signed or not
+    String.raw `)` +
+    // A PEM private key, through its END line or, cut short, the end of the text.
+    String.raw `|-----BEGIN[ A-Z0-9_-]{0,100}PRIVATE KEY(?: BLOCK)?-----` +
+    String.raw `(?:[\s\S]*?-----END[ A-Z0-9_-]{0,100}PRIVATE KEY(?: BLOCK)?-----|[\s\S]*)`, "g");
+function stripQuotes(name) {
+    return name.replace(/^["']+/, "").replace(/["']+$/, "");
+}
+function isCredentialName(name) {
+    const words = stripQuotes(name)
+        .replace(/([a-z0-9])([A-Z])/g, "$1_$2")
+        .toLowerCase();
+    const parts = words.split(/[-_.]/).filter((p) => p);
+    return CREDENTIAL_WORDS.has(parts.join("")) || parts.some((p) => CREDENTIAL_WORDS.has(p));
+}
+function redactPairs(text) {
+    // String.prototype.replace collects every match before calling the
+    // replacer, so recursing with the same global regex is safe.
+    return text.replace(PAIR, (...args) => redactPair(args[args.length - 1]));
+}
+function redactPair(match) {
+    const quote = match.vq || "";
+    let value;
+    if (isCredentialName(match.name)) {
+        value = REDACTED;
+    }
+    else {
+        // The value may itself hold pairs, as `URL: https://...?token=...` does.
+        value = redactPairs(match.quoted || match.bare || "");
+    }
+    const opening = match.oq || "";
+    return `${match.name}${match.sep}${match.scheme || ""}${quote || opening}${value}${quote}`;
+}
+/**
+ * Mask the credentials in `text`, leaving the rest as written.
+ *
+ * @param text Text that may quote a credential, such as an error message.
+ * @returns The text with each credential replaced by `[REDACTED]`.
+ */
+export function redactSecrets(text) {
+    // Known formats go first: a PEM key spans lines, and masking its first line
+    // as a pair's value would leave the rest unrecognizable.
+    text = text.replace(KNOWN_TOKENS, REDACTED);
+    text = redactPairs(text);
+    return text.replace(URL_PASSWORD, `$<prefix>${REDACTED}`);
+}
+//# sourceMappingURL=redaction.js.map