@pithy-sh/core 0.10.0 → 0.12.0

package/dist/privacy/classify.js

@@ -0,0 +1,1024 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import { SQLiteBoolean, SQLiteDate, isSqliteJson } from "../data/codecs.js";
+import { ownPrivacyClasses, privacyClasses, rankPrivacyClasses, strongestPrivacyClass } from "./classes.js";
+//#region src/privacy/classify.ts
+/**
+* **The one recursion limit**, shared by `redact`, `classifyPrivacy` and `Redacted<T>` (`./types` reads this constant's
+* type). Depth is counted in levels of nesting: every object, array, tuple, record, map and set a position sits inside.
+* It applies to all nesting, not only recursion: a position deeper than this is masked whole as {@link TRUNCATED_MASK}
+* and typed `unknown`, whatever nests it: a `z.lazy`, a getter that returns one schema, one that builds a new schema
+* each read, or a schema written out level by level. The list assumes every class there, unless the chain repeats a
+* position (the same set of schemas) already read on its path. A search for a mark beneath an opaque node or a marked
+* container ends a path at the same depth, counting each lazy too, and reads every other path; so does the one
+* `Redacted<T>` makes. So does a read of the shapes a choice can have, and of the schemas that reach one position, each
+* counting the lazies nested above a schema: a lazy that builds a new choice each read never meets a schema twice. A
+* union of many lazies, none inside another, counts one.
+*/
+const MAX_RECURSION_DEPTH = 256;
+/**
+* **The one budget**: how many schemas one call of `redact`, `classifyPrivacy`, `hasPrivacy` or `walkPrivacy` reads.
+* Every position and every search in that call draws on it. Each schema a read meets counts one — a step of the read of
+* a position, of the shapes a choice can have, or of a search beneath a marked container or an opaque node — and so
+* does each schema a lazy or an object's shape yields: a lazy's target, and each field of a shape, where a getter runs
+* and may build a new schema. A schema met again in the same read costs nothing. So a call reads at most this many
+* schemas, and runs at most this many of the schema's own getters beyond the fields of the one object it was reading
+* when the budget ran out. So its time and memory grow linearly with the size of the schema and the value, and are
+* bounded beyond that by the budget and by what one of those getters builds. Past it the call fails closed: what it has not read, it assumes. `redact` masks each position it has
+* not resolved whole, with the strongest class it found there or {@link TRUNCATED_MASK} where it found none; the list
+* names every class at each position it has not read, each `truncated`. Far past any schema written out by hand, and
+* past any recursion defined once: only a schema that builds new ones as it is read, or one wider than any written out,
+* reaches it. Each call starts with the whole budget and keeps nothing for the next, so every answer is a function of
+* the schema and the value alone, whichever call came first.
+*/
+const MAX_READ_SCHEMAS = 1e4;
+/**
+* How many paths {@link walkPrivacy} writes out before a position it met already is listed by reference. A schema
+* reused in two fields at every level of thirty has thirty-one schemas and a billion paths, so a list of every path
+* cannot be built; past this many, each new position is still read and written out once, and each one met again is
+* listed at its own path with every class beneath it and `sameAs` the path it was written out under. So the paths it
+* writes out are bounded too, however many reach one schema. Far past any table written out: a book of 22 groups of 22
+* contacts of 22 addresses is written out whole.
+*/
+const MAX_LISTED_PATHS = 5e4;
+/**
+* What `redact` puts where it stops: a value nested past {@link MAX_RECURSION_DEPTH}, an opaque value over a recursion
+* that reaches it, and a position the call ran out of {@link MAX_READ_SCHEMAS} before it read, where no class was
+* found. A safety cutoff rather than a privacy class, so it is never a placeholder for one.
+*/
+const TRUNCATED_MASK = "[truncated]";
+/**
+* The classes {@link classifyPrivacy} lists for a position it did not read: every class registered, strongest first,
+* because nothing there was read and any of them may be marked below it. So the list never says less than the schema
+* marks, and `hasPrivacy` answers yes for each. A read that runs out of {@link MAX_READ_SCHEMAS} assumes them where it
+* stopped, a cut at {@link MAX_RECURSION_DEPTH} on a chain of schemas not yet seen assumes them where it cut, and a
+* schema the walk cannot read at all is listed with them.
+*/
+function unreadClasses() {
+	return rankPrivacyClasses(privacyClasses().map((each) => each.name));
+}
+/** A call with the whole budget, and nothing read. */
+function newCall() {
+	return {
+		left: MAX_READ_SCHEMAS,
+		kinds: /* @__PURE__ */ new Map(),
+		stops: /* @__PURE__ */ new Map(),
+		searched: /* @__PURE__ */ new Map(),
+		positions: /* @__PURE__ */ new Map(),
+		walked: /* @__PURE__ */ new Map()
+	};
+}
+/** Spend one of the call's budget on a read: `false`, and nothing spent, once there is none left. */
+function take(call) {
+	if (call.left <= 0) return false;
+	call.left -= 1;
+	return true;
+}
+/**
+* An object's shape, read for the call: reading it runs the shape's getters, each of which may build a schema, so the
+* call pays one for each field it holds as well as the one it took to open it. The budget may go below nothing here,
+* by at most the width of that one object, and the next read stops.
+*/
+function readShape(schema, call) {
+	const shape = shapeOf(schema);
+	call.left -= Reflect.ownKeys(shape).length;
+	return shape;
+}
+function defOf(schema) {
+	return schema._zod.def;
+}
+function isSchema(value) {
+	return typeof value === "object" && value !== null && "_zod" in value;
+}
+/** The wrappers that are the same position as what they wrap. A brand is a type, and no node at all. */
+const WRAPPERS = /* @__PURE__ */ new Set([
+	"optional",
+	"nullable",
+	"default",
+	"prefault",
+	"catch",
+	"readonly",
+	"nonoptional"
+]);
+/** The kinds a value is walked into. */
+const STRUCTURAL = /* @__PURE__ */ new Set([
+	"object",
+	"array",
+	"tuple",
+	"record",
+	"map",
+	"set"
+]);
+/** The tag Zod puts on the function it wraps a constant `.catch()` value in. */
+const CONSTANT_CATCH = "~constantCatch";
+/**
+* Whether a node hands back a value its own code made rather than the one it read: a `.catch()` with a fallback
+* function, or an `.overwrite()`. A constant fallback is a value, and is walked as the wrapper it is.
+*/
+function makesValue(def) {
+	if (def.type === "catch") {
+		const fallback = def.catchValue;
+		if (typeof fallback !== "function" || fallback[CONSTANT_CATCH] !== true) return true;
+	}
+	return (def.checks ?? []).some((check) => check._zod?.def?.check === "overwrite");
+}
+/** The value a constant `.catch()` hands back, or `undefined` for any other node. */
+function constantFallback(def) {
+	if (def.type !== "catch" || makesValue(def)) return void 0;
+	try {
+		return { value: def.catchValue() };
+	} catch {
+		return;
+	}
+}
+/** The shapes a value is walked into. */
+const STRUCTURE = [
+	"object",
+	"array",
+	"map",
+	"set"
+];
+/** Whether a value of one of `kinds` could be walked into. */
+function holdsStructure(kinds) {
+	return STRUCTURE.some((kind) => kinds.has(kind));
+}
+/**
+* A node's shapes, as a choice reads them: every shape for one that {@link makesValue} over a structure, as its own
+* code may hand back anything. A scalar's is still its own: what it makes is the scalar a mark masks or keeps.
+*/
+function widened(def, kinds) {
+	return holdsStructure(kinds) && makesValue(def) ? EVERY_KIND : kinds;
+}
+/** Every {@link ValueKind}, in the order a mask lists them. */
+const VALUE_KINDS = [
+	"string",
+	"number",
+	"bigint",
+	"boolean",
+	"symbol",
+	"function",
+	"date",
+	"object",
+	"array",
+	"map",
+	"set"
+];
+const EVERY_KIND = new Set(VALUE_KINDS);
+const NO_KIND = /* @__PURE__ */ new Set();
+/** The shape of a value, or `undefined` for `null` and `undefined`, which are kept wherever they are. */
+function kindOfValue(value) {
+	const type = typeof value;
+	if (type === "undefined" || value === null) return void 0;
+	if (type !== "object") return type;
+	if (Array.isArray(value)) return "array";
+	if (value instanceof Map) return "map";
+	if (value instanceof Set) return "set";
+	return value instanceof Date ? "date" : "object";
+}
+/** The prototype a value of each kind has where it is what its schema parses: a plain object's, a `Date`'s … */
+const TYPICAL = {
+	object: Object.prototype,
+	array: Array.prototype,
+	map: Map.prototype,
+	set: Set.prototype,
+	date: Date.prototype
+};
+/**
+* Whether a value of `kind` is one its schema parses: a plain object, an `Array.prototype` array, a `Map`, a `Set` or
+* a `Date` of its own prototype, never a subclass or a class instance. A scalar and a function always are.
+*/
+function isTypical(value, kind) {
+	const typical = TYPICAL[kind];
+	if (typical === void 0) return true;
+	const prototype = Object.getPrototypeOf(value);
+	return prototype === typical || kind === "object" && prototype === null;
+}
+/** The one shape each kind of schema produces. A record is an object, and a tuple an array. */
+const SCHEMA_KINDS = {
+	string: "string",
+	template_literal: "string",
+	number: "number",
+	nan: "number",
+	bigint: "bigint",
+	boolean: "boolean",
+	symbol: "symbol",
+	function: "function",
+	date: "date",
+	object: "object",
+	record: "object",
+	array: "array",
+	tuple: "array",
+	map: "map",
+	set: "set"
+};
+/**
+* The kinds a scalar, a literal, an enum or a node that holds no value names, or `undefined` for an opaque node, which
+* takes a value of any kind and prototype: a transform, a pipe, `z.custom`, `any`, `unknown`, or one that makes its
+* own value.
+*/
+function scalarKinds(node) {
+	const def = defOf(node);
+	if (makesValue(def)) return void 0;
+	const one = SCHEMA_KINDS[def.type];
+	if (one !== void 0) return /* @__PURE__ */ new Set([one]);
+	if (NO_VALUE.has(def.type)) return NO_KIND;
+	if (def.type !== "literal" && def.type !== "enum") return void 0;
+	const values = node._zod.values;
+	return values ? new Set([...values].flatMap((value) => [kindOfValue(value)].filter(isKind))) : void 0;
+}
+/** The kinds of schema that hold no value a mask could apply to. */
+const NO_VALUE = /* @__PURE__ */ new Set([
+	"null",
+	"undefined",
+	"void",
+	"never"
+]);
+/**
+* The shapes a schema's output can have: read through its wrappers, the options of a union, the sides of an
+* intersection, a lazy and the kit's codecs, every option to the end. Every shape for anything opaque, whose output
+* nothing here reads, for a read that meets a path more than {@link MAX_RECURSION_DEPTH} lazies long, and for one that
+* runs out of the call's {@link MAX_READ_SCHEMAS}: a lazy that builds a new choice each read never meets a schema
+* twice, and every shape is the answer that masks the most. Depth first, and the first path that runs out ends the
+* read. A schema read to its end is remembered for the call with how deep it went, so a choice reused in many places
+* is read once. A schema whose cycles all come round to itself or below is remembered for every read; one inside a
+* cycle that comes round above it is remembered while that schema is still on the path, so a choice reused inside a
+* cycle is read once too.
+*/
+function kindsOf(schema, call, lazies = 0) {
+	const read = {
+		call,
+		stopped: false,
+		past: false,
+		deepest: 0,
+		low: Number.POSITIVE_INFINITY,
+		stamps: 0,
+		path: /* @__PURE__ */ new Map(),
+		stack: [],
+		within: /* @__PURE__ */ new Map()
+	};
+	const found = readKinds(schema, lazies, read);
+	return read.stopped ? EVERY_KIND : found;
+}
+/** A schema's answer met again, `depth` lazies down: it would go as deep below as it did before. */
+function replay(known, depth, read) {
+	if (depth + known.reach > 256) {
+		read.stopped = true;
+		read.past = true;
+	}
+	read.deepest = Math.max(read.deepest, depth + known.reach);
+	return read.stopped ? EVERY_KIND : known.kinds;
+}
+/** One step of {@link kindsOf}, `depth` lazies down. */
+function readKinds(schema, depth, read) {
+	if (read.stopped) return EVERY_KIND;
+	const stop = read.call.stops.get(schema);
+	if (depth > 256 || stop !== void 0 && depth >= stop) {
+		read.stopped = true;
+		read.past = true;
+		return EVERY_KIND;
+	}
+	read.deepest = Math.max(read.deepest, depth);
+	const known = read.call.kinds.get(schema);
+	if (known) return replay(known, depth, read);
+	if (!take(read.call)) {
+		read.stopped = true;
+		return EVERY_KIND;
+	}
+	const def = defOf(schema);
+	const one = SCHEMA_KINDS[def.type];
+	if (one !== void 0) return widened(def, /* @__PURE__ */ new Set([one]));
+	if (NO_VALUE.has(def.type)) return NO_KIND;
+	if (def.type === "literal" || def.type === "enum") {
+		const values = schema._zod.values;
+		return values ? new Set([...values].flatMap((value) => [kindOfValue(value)].filter(isKind))) : EVERY_KIND;
+	}
+	const onPath = read.path.get(schema);
+	if (onPath) {
+		read.low = Math.min(read.low, onPath.index);
+		return EVERY_KIND;
+	}
+	const cycled = read.within.get(schema);
+	const anchor = cycled && read.path.get(cycled.anchor);
+	if (cycled && anchor?.stamp === cycled.stamp) {
+		read.low = Math.min(read.low, anchor.index);
+		return replay(cycled.found, depth, read);
+	}
+	const { deepest, low } = read;
+	const index = read.stack.length;
+	read.stamps += 1;
+	read.deepest = depth;
+	read.low = Number.POSITIVE_INFINITY;
+	read.path.set(schema, {
+		index,
+		stamp: read.stamps
+	});
+	read.stack.push(schema);
+	let found;
+	try {
+		found = widened(def, readStep(schema, def, depth, read));
+	} finally {
+		read.path.delete(schema);
+		read.stack.pop();
+	}
+	const reach = read.deepest - depth;
+	const below = read.low;
+	read.deepest = Math.max(deepest, read.deepest);
+	read.low = Math.min(low, below);
+	if (read.stopped && read.past && below >= index) {
+		const known = read.call.stops.get(schema);
+		read.call.stops.set(schema, known === void 0 ? depth : Math.min(known, depth));
+	}
+	if (!read.stopped) {
+		const answer = {
+			kinds: found,
+			reach
+		};
+		if (below >= index) read.call.kinds.set(schema, answer);
+		else {
+			const to = read.stack[below];
+			read.within.set(schema, {
+				found: answer,
+				anchor: to,
+				stamp: read.path.get(to).stamp
+			});
+		}
+	}
+	return found;
+}
+/** {@link readKinds} for a node that holds other schemas. */
+function readStep(schema, def, depth, read) {
+	if (WRAPPERS.has(def.type) && def.innerType) return readKinds(def.innerType, depth, read);
+	if (def.type === "union" && def.options) {
+		const joined = /* @__PURE__ */ new Set();
+		for (const option of def.options) {
+			for (const kind of readKinds(option, depth, read)) joined.add(kind);
+			if (joined.size === EVERY_KIND.size || read.stopped) break;
+		}
+		return joined;
+	}
+	if (def.type === "intersection" && def.left && def.right) {
+		const left = readKinds(def.left, depth, read);
+		if (left.size === 0) return NO_KIND;
+		const right = readKinds(def.right, depth, read);
+		return new Set([...left].filter((kind) => right.has(kind)));
+	}
+	if (def.type === "lazy") {
+		if (!take(read.call)) {
+			read.stopped = true;
+			return EVERY_KIND;
+		}
+		const inner = lazyInner(schema);
+		return inner ? readKinds(inner, depth + 1, read) : EVERY_KIND;
+	}
+	const codec = kitCodecOutput(schema);
+	return codec ? readKinds(codec, depth, read) : EVERY_KIND;
+}
+function isKind(kind) {
+	return kind !== void 0;
+}
+/**
+* The class a field was marked with, read through its wrappers — `pii(z.string()).optional()` is `pii` — or
+* `null` when nothing along the chain carries one. A field marked twice, `pii(secret(x))`, is its strongest class.
+* It never throws: a schema whose metadata cannot be read, cloned by `.describe()` or `.meta()` more times than Zod
+* can read it back through, may carry any class, so it answers the strongest of {@link unreadClasses}.
+*/
+function privacyOf(schema) {
+	try {
+		for (let node = schema; node;) {
+			const found = strongestPrivacyClass(ownPrivacyClasses(node));
+			if (found !== void 0) return found;
+			const def = defOf(node);
+			node = WRAPPERS.has(def.type) ? def.innerType : void 0;
+		}
+	} catch {
+		return strongestPrivacyClass(unreadClasses()) ?? null;
+	}
+	return null;
+}
+/** The schema one of the kit's three codecs decodes to, or `undefined` for any other node. */
+function kitCodecOutput(schema) {
+	const def = defOf(schema);
+	if (def.type !== "pipe") return void 0;
+	return def === defOf(SQLiteDate) || def === defOf(SQLiteBoolean) || isSqliteJson(schema) ? def.out : void 0;
+}
+/** What a lazy stands for: Zod's own cached target, the schema `parse` ran. Never its getter called again. */
+function lazyInner(schema) {
+	const inner = schema._zod.innerType;
+	return isSchema(inner) ? inner : void 0;
+}
+/** An object's fields, read through the shape Zod freezes on first read, so every walk sees the schemas `parse` does. */
+function shapeOf(schema) {
+	return defOf(schema).shape ?? {};
+}
+/** Every schema a node holds, whatever its kind: what a search for a mark reads through. */
+function children(schema) {
+	const def = defOf(schema);
+	if (def.type === "lazy") {
+		const inner = lazyInner(schema);
+		return inner ? [inner] : [];
+	}
+	const found = def.type === "object" ? Object.values(shapeOf(schema)).filter(isSchema) : [];
+	for (const [key, descriptor] of Object.entries(Object.getOwnPropertyDescriptors(def))) {
+		if (key === "checks" || key === "getter" || !("value" in descriptor)) continue;
+		const slot = descriptor.value;
+		if (isSchema(slot)) found.push(slot);
+		else if (Array.isArray(slot)) {
+			for (const each of slot) if (isSchema(each)) found.push(each);
+		}
+	}
+	return found;
+}
+/**
+* Every class marked anywhere beneath a schema, on every side of every node. Level by level, each level in the order
+* the schema declares it, and each schema once. A path more than {@link MAX_RECURSION_DEPTH} levels long, counting
+* each lazy and each structural node, ends there and marks the search `truncated` and `unread`; every other path is
+* still read, so a class beside a recursion is found whatever the field order. Each schema is met once, so a recursion
+* defined once comes round to a schema already read and never reaches the limit: only a chain of schemas not met
+* before does, a factory or nesting deeper than the limit, and past it any class may be marked, so every one is
+* assumed there. Each schema it meets costs one of the call's
+* {@link MAX_READ_SCHEMAS}, so shallowest first, a class above the point the budget runs out on is found. There the
+* search ends `truncated` and `unread`: what lies past it was never read, so every class is assumed there, and the
+* search never says less than the schema marks. Remembered for the call, so a schema searched again costs nothing.
+*/
+function search(schema, call) {
+	const known = call.searched.get(schema);
+	if (known) return known;
+	const classes = /* @__PURE__ */ new Set();
+	let truncated = false;
+	let unread = false;
+	let spent = false;
+	const seen = /* @__PURE__ */ new Set();
+	let level = [schema];
+	for (let depth = 0; level.length > 0 && !spent; depth += 1) {
+		const next = [];
+		const stack = [...level].reverse();
+		for (let node = stack.pop(); node; node = stack.pop()) {
+			if (seen.has(node)) continue;
+			if (!take(call)) {
+				truncated = true;
+				unread = true;
+				spent = true;
+				break;
+			}
+			seen.add(node);
+			for (const own of ownPrivacyClasses(node)) classes.add(own);
+			const def = defOf(node);
+			if (def.type !== "lazy" && !STRUCTURAL.has(def.type)) {
+				const inside = children(node);
+				for (let index = inside.length - 1; index >= 0; index -= 1) stack.push(inside[index]);
+				continue;
+			}
+			if (depth + 1 > 256) {
+				truncated = true;
+				unread = true;
+				continue;
+			}
+			if (!take(call)) {
+				truncated = true;
+				unread = true;
+				spent = true;
+				break;
+			}
+			if (def.type === "object") readShape(node, call);
+			for (const child of children(node)) next.push(child);
+		}
+		level = next;
+	}
+	const found = {
+		classes,
+		truncated,
+		unread
+	};
+	call.searched.set(schema, found);
+	return found;
+}
+/** An id per schema, so a list of schemas has a key. */
+const ids = /* @__PURE__ */ new WeakMap();
+let lastId = 0;
+function idOf(schema) {
+	let id = ids.get(schema);
+	if (id === void 0) {
+		lastId += 1;
+		id = lastId;
+		ids.set(schema, id);
+	}
+	return id;
+}
+/** The schema each leaf of one kind holds at a slot, read by `pick`. */
+function slots(leaves, kinds, pick) {
+	return leaves.filter((leaf) => kinds.includes(defOf(leaf).type)).flatMap((leaf) => [pick(defOf(leaf))].filter(isSchema));
+}
+/** A catchall a value's extra key is parsed by: none for a stripped object, `never` for a strict one. */
+function openCatchall(def) {
+	return def.catchall && defOf(def.catchall).type !== "never" ? def.catchall : void 0;
+}
+/** The position `schemas` reach, read once in the call for that list of schemas. */
+function positionOf(schemas, call) {
+	const distinct = [...new Set(schemas)];
+	if (distinct.length === 0) return void 0;
+	const key = distinct.map(idOf).join(",");
+	const known = call.positions.get(key);
+	if (known) return known;
+	const { position, leaves, signature } = readPosition(distinct, call);
+	let found = position;
+	if (leaves.length > 0) {
+		const leafKey = `${leaves.map(idOf).join(",")}${position.other ? "+" : ""}#${signature}`;
+		found = call.walked.get(leafKey) ?? position;
+		call.walked.set(leafKey, found);
+	}
+	call.positions.set(key, found);
+	return found;
+}
+/** The kind of value a structural node holds. */
+function leafKind(leaf) {
+	return SCHEMA_KINDS[defOf(leaf).type];
+}
+/**
+* Every class in `reaches` and beneath `leaves`, and every class assumed where a read there ran out: what a mask made
+* of them carries. `undefined` where none is marked and no read there was cut off or ran out.
+*/
+function carried(reaches, leaves, call) {
+	const searches = leaves.map((leaf) => search(leaf, call));
+	const found = /* @__PURE__ */ new Set([...reaches.flatMap((reach) => reach.classes), ...searches.flatMap((each) => [...each.classes])]);
+	const truncated = reaches.some((reach) => reach.truncated) || searches.some((each) => each.truncated);
+	const unread = reaches.some((reach) => reach.unread) || searches.some((each) => each.unread);
+	if (found.size === 0 && !truncated && !unread) return void 0;
+	const assumed = unread ? unreadClasses().filter((name) => !found.has(name)) : [];
+	return {
+		className: strongestPrivacyClass([...found]) ?? "",
+		own: false,
+		classes: [...found, ...assumed],
+		assumed,
+		truncated
+	};
+}
+/** The mask made of `reaches` and the structural nodes masked with them, or `undefined` when none applies. */
+function maskOf(reaches, leaves, call) {
+	if (reaches.length === 0) return void 0;
+	const mask = carried(reaches, leaves, call);
+	if (mask === void 0) return void 0;
+	const own = !mask.truncated && reaches.every((reach) => !reach.opaque) && mask.classes.length === 1;
+	return {
+		...mask,
+		own
+	};
+}
+/**
+* The mask for a value of a kind or a prototype the schemas here do not expect: every class in `reaches` and beneath
+* `leaves`, as beneath an opaque node, or `undefined` where none is marked and no read there was cut off or ran out.
+*/
+function misfitMaskOf(reaches, leaves, call) {
+	return carried(reaches, leaves, call);
+}
+/** A mask, written out: two positions with the same leaves and the same masks are one. */
+function maskKey(mask) {
+	const read = mask.truncated ? "truncated" : "read";
+	return `${mask.own ? "own" : "strongest"}:${read}:${mask.classes.join("|")}:${mask.assumed.join("|")}`;
+}
+/** A set of shapes, written out the same way whatever order it was built in. */
+function gateKey(gate) {
+	return VALUE_KINDS.map((kind) => gate.has(kind) ? "1" : "0").join("");
+}
+/** Flatten a position and decide how it is masked. Its children are read when first asked for. */
+function readPosition(schemas, call) {
+	const reaches = [];
+	const leaves = /* @__PURE__ */ new Set();
+	const met = /* @__PURE__ */ new Set();
+	const lazyGates = /* @__PURE__ */ new Set();
+	let other = false;
+	const named = /* @__PURE__ */ new Set();
+	const taken = /* @__PURE__ */ new Set();
+	/** An opaque node: masked whole with every class beneath it, and kept where there is none. */
+	const opaque = (node, gate) => {
+		const own = scalarKinds(node);
+		for (const kind of gate) if (!own || own.has(kind)) (own ? named : taken).add(kind);
+		const inside = search(node, call);
+		if (inside.classes.size > 0 || inside.truncated) reaches.push({
+			gate,
+			classes: [...inside.classes],
+			opaque: true,
+			truncated: inside.truncated,
+			unread: inside.unread
+		});
+		other = true;
+	};
+	/**
+	* A schema the call ran out of its budget before it read, or a lazy nested past the limit: cut off, and only this
+	* path. Nothing beneath it was read, so any class may be marked there, and every one is assumed. A lazy is met once
+	* per position, so only a chain of lazies not met before, each built anew, reaches the limit.
+	*/
+	const cut = (gate) => {
+		reaches.push({
+			gate,
+			classes: [],
+			opaque: true,
+			truncated: true,
+			unread: true
+		});
+		for (const kind of gate) taken.add(kind);
+		other = true;
+	};
+	let level = schemas.map((schema) => [
+		schema,
+		EVERY_KIND,
+		false
+	]);
+	for (let lazies = 0; level.length > 0; lazies += 1) {
+		const next = [];
+		const stack = [...level].reverse();
+		for (let entry = stack.pop(); entry; entry = stack.pop()) {
+			const [node, reached, option] = entry;
+			const seen = `${idOf(node)}:${gateKey(reached)}:${option ? "option" : ""}`;
+			if (met.has(seen)) continue;
+			met.add(seen);
+			if (!take(call)) {
+				cut(reached);
+				continue;
+			}
+			const kinds = option ? kindsOf(node, call, lazies) : EVERY_KIND;
+			const gate = option ? new Set([...reached].filter((kind) => kinds.has(kind))) : reached;
+			if (gate.size === 0) continue;
+			if (ownPrivacyClasses(node).length > 0) {
+				const inside = search(node, call);
+				reaches.push({
+					gate,
+					classes: [.../* @__PURE__ */ new Set([...ownPrivacyClasses(node), ...inside.classes])],
+					opaque: false,
+					truncated: inside.truncated,
+					unread: inside.unread
+				});
+				continue;
+			}
+			const def = defOf(node);
+			const codec = kitCodecOutput(node);
+			if (makesValue(def) && holdsStructure(kindsOf(node, call, lazies))) {
+				opaque(node, gate);
+				continue;
+			}
+			if (def.type === "lazy") {
+				const key = `${idOf(node)}:${gateKey(gate)}`;
+				if (lazyGates.has(key)) continue;
+				lazyGates.add(key);
+				if (lazies >= 256) {
+					cut(gate);
+					continue;
+				}
+				if (!take(call)) {
+					cut(gate);
+					continue;
+				}
+				const inner = lazyInner(node);
+				if (inner) next.push([
+					inner,
+					gate,
+					false
+				]);
+			} else if (WRAPPERS.has(def.type) && def.innerType) {
+				const fallback = constantFallback(def);
+				const kind = fallback && kindOfValue(fallback.value);
+				if (fallback && kind && gate.has(kind)) (isTypical(fallback.value, kind) ? named : taken).add(kind);
+				stack.push([
+					def.innerType,
+					gate,
+					false
+				]);
+			} else if (def.type === "union" && def.options) for (const each of [...def.options].reverse()) stack.push([
+				each,
+				gate,
+				true
+			]);
+			else if (def.type === "intersection") for (const side of [def.right, def.left].filter(isSchema)) stack.push([
+				side,
+				gate,
+				false
+			]);
+			else if (codec) stack.push([
+				codec,
+				gate,
+				false
+			]);
+			else if (STRUCTURAL.has(def.type)) {
+				if (!gate.has(leafKind(node))) continue;
+				if (def.type === "object") {
+					if (!take(call)) {
+						cut(gate);
+						continue;
+					}
+					readShape(node, call);
+				}
+				leaves.add(node);
+			} else opaque(node, gate);
+		}
+		level = next;
+	}
+	const allLeaves = [...leaves];
+	const byKind = /* @__PURE__ */ new Map();
+	for (const kind of VALUE_KINDS) {
+		const mask = maskOf(reaches.filter((reach) => reach.gate.has(kind)), allLeaves.filter((leaf) => leafKind(leaf) === kind), call);
+		if (mask) byKind.set(kind, mask);
+	}
+	const leafList = allLeaves.filter((leaf) => !byKind.has(leafKind(leaf)));
+	const mask = maskOf(reaches, allLeaves.filter((leaf) => byKind.has(leafKind(leaf))), call);
+	const nameMask = maskOf(reaches.filter((reach) => [...reach.gate].some((kind) => kind !== "symbol")), allLeaves.filter((leaf) => byKind.has(leafKind(leaf))), call);
+	const whole = byKind.size === VALUE_KINDS.length;
+	for (const leaf of allLeaves) named.add(leafKind(leaf));
+	const signature = `${[...byKind].map(([kind, each]) => `${kind}=${maskKey(each)}`).join(";")}/${gateKey(named)}/${gateKey(taken)}`;
+	const memo = /* @__PURE__ */ new Map();
+	const once = (slot, read) => {
+		if (!memo.has(slot)) memo.set(slot, positionOf(read(), call));
+		return memo.get(slot);
+	};
+	const fields = /* @__PURE__ */ new Map();
+	const objects = leafList.filter((leaf) => defOf(leaf).type === "object");
+	const tuples = leafList.filter((leaf) => defOf(leaf).type === "tuple").map(defOf);
+	const records = slots(leafList, ["record"], (def) => def.valueType);
+	const arrays = slots(leafList, ["array"], (def) => def.element);
+	const catchalls = objects.flatMap((leaf) => [openCatchall(defOf(leaf))].filter(isSchema));
+	const open = objects.flatMap((leaf, index) => {
+		const schema = openCatchall(defOf(leaf));
+		return schema ? [{
+			index,
+			schema
+		}] : [];
+	});
+	let naming;
+	const namingOf = () => {
+		if (!naming) {
+			naming = /* @__PURE__ */ new Map();
+			objects.forEach((leaf, index) => {
+				for (const key of Reflect.ownKeys(shapeOf(leaf))) {
+					const list = naming?.get(key);
+					if (list) list.push(index);
+					else naming?.set(key, [index]);
+				}
+			});
+		}
+		return naming;
+	};
+	/** The schemas a key is read by, in the objects' order: an object's own where it names the key, else its catchall. */
+	const namedBy = (name, indexes) => {
+		const out = [];
+		let next = 0;
+		for (const index of indexes) {
+			for (; next < open.length && (open[next]?.index ?? index) < index; next += 1) out.push(open[next]?.schema);
+			if (open[next]?.index === index) next += 1;
+			out.push(shapeOf(objects[index])[name]);
+		}
+		for (; next < open.length; next += 1) out.push(open[next]?.schema);
+		return out;
+	};
+	let unnamed;
+	const misfits = /* @__PURE__ */ new Map();
+	return {
+		position: {
+			mask,
+			nameMask,
+			whole,
+			maskFor: (value) => {
+				const kind = kindOfValue(value);
+				return kind === void 0 ? void 0 : byKind.get(kind);
+			},
+			misfit: (value) => {
+				const kind = kindOfValue(value);
+				if (kind === void 0) return void 0;
+				const expected = named.has(kind);
+				if (expected ? isTypical(value, kind) : taken.has(kind)) return void 0;
+				let misfit = misfits.get(kind);
+				if (!misfit) {
+					misfit = { mask: expected ? misfitMaskOf([], leafList.filter((leaf) => leafKind(leaf) === kind), call) : misfitMaskOf(reaches, allLeaves, call) };
+					misfits.set(kind, misfit);
+				}
+				return misfit;
+			},
+			kinds: new Set(leafList.map((leaf) => defOf(leaf).type)),
+			other,
+			get keys() {
+				return [...namingOf().keys()];
+			},
+			field: (name) => {
+				if (!fields.has(name)) {
+					const indexes = namingOf().get(name);
+					if (indexes) fields.set(name, positionOf([...namedBy(name, indexes), ...records], call));
+					else {
+						unnamed ??= { at: positionOf([...open.map((each) => each.schema), ...records], call) };
+						fields.set(name, unnamed.at);
+					}
+				}
+				return fields.get(name);
+			},
+			get catchall() {
+				return once("catchall", () => [...catchalls, ...records]);
+			},
+			get key() {
+				return once("key", () => slots(leafList, ["record"], (def) => def.keyType));
+			},
+			items: tuples.reduce((most, def) => Math.max(most, def.items?.length ?? 0), 0),
+			item: (index) => once(`item:${index}`, () => [...arrays, ...tuples.flatMap((def) => [def.items?.[index] ?? def.rest].filter(isSchema))]),
+			get rest() {
+				return once("rest", () => [...arrays, ...tuples.flatMap((def) => [def.rest].filter(isSchema))]);
+			},
+			get mapKey() {
+				return once("mapKey", () => slots(leafList, ["map"], (def) => def.keyType));
+			},
+			get mapValue() {
+				return once("mapValue", () => slots(leafList, ["map"], (def) => def.valueType));
+			},
+			get element() {
+				return once("element", () => slots(leafList, ["set"], (def) => def.valueType));
+			}
+		},
+		leaves: leafList,
+		signature
+	};
+}
+/** The position at the root of a schema, read in `call`: a new one, with the whole budget, unless one is given. */
+function rootPosition(schema, call = newCall()) {
+	return positionOf([schema], call);
+}
+/** `parent.key`, or `key` at the root; an index or a bracket joins without a dot. */
+function join(path, segment) {
+	return path === "" || segment.startsWith("[") ? `${path}${segment}` : `${path}.${segment}`;
+}
+/** Whether a frame's position is one it sits below: a recursion defined once, come round. */
+function onLine(frame) {
+	for (let above = frame.parent; above; above = above.parent) if (above.at === frame.at) return true;
+	return false;
+}
+/**
+* Whether a frame is cut off at the limit with every class assumed: nested deeper than {@link MAX_RECURSION_DEPTH}, at
+* a position not met on its path. A position is a set of schemas, and it is the position that is compared: a recursion
+* defined once comes round to a position (the same set of schemas) already read, whose classes are listed where it was
+* read, so it needs no cut. A chain that keeps producing positions not yet seen, a factory, nesting deeper than the
+* limit, or once-defined cycles of different lengths side by side in a union, was never read past it: any class may be
+* marked there, though each schema on the chain may be one already read.
+*/
+function cutOff(frame) {
+	return frame.depth > 256 && !onLine(frame);
+}
+/**
+* A frame for the position `read` returns. A schema nested deeper than the stack can follow, or one whose getter
+* throws, cannot be read: its frame is `unread`, listed with every class, and nothing throws.
+*/
+function frameAt(read, place) {
+	try {
+		return {
+			...place,
+			at: read()
+		};
+	} catch {
+		return {
+			...place,
+			at: void 0,
+			unread: true
+		};
+	}
+}
+/** The frames below a position that is read, in the order the schema names them. */
+function framesBelow(frame, at) {
+	const next = frame.depth + 1;
+	const below = [];
+	const add = (child, path, depth, key) => {
+		const found = frameAt(child, key === void 0 ? {
+			path,
+			depth,
+			parent: frame
+		} : {
+			path,
+			depth,
+			key,
+			parent: frame
+		});
+		if (found.at !== void 0 || found.unread) below.push(found);
+	};
+	for (const key of at.keys) if (typeof key === "string") add(() => at.field(key), join(frame.path, key), next, key);
+	add(() => at.catchall, join(frame.path, "*"), next);
+	add(() => at.key, join(frame.path, "<key>"), frame.depth);
+	for (let index = 0; index < at.items; index += 1) add(() => at.item(index), `${frame.path}[${index}]`, next);
+	add(() => at.rest, `${frame.path}[]`, next);
+	add(() => at.mapKey, join(frame.path, "<key>"), next);
+	add(() => at.mapValue, join(frame.path, "*"), next);
+	add(() => at.element, `${frame.path}[]`, next);
+	return below;
+}
+/** Every class a frame lists at its own path, once each, with whether it is only assumed. */
+function ownClasses(frame) {
+	const found = /* @__PURE__ */ new Map();
+	const mask = frame.at?.mask;
+	if (mask) for (const name of mask.classes) found.set(name, mask.assumed.includes(name));
+	if (frame.unread || cutOff(frame)) {
+		for (const name of unreadClasses()) if (!found.has(name)) found.set(name, true);
+	}
+	return [...found];
+}
+/**
+* Every class listed beneath each position the walk read, by the first frame that read it, and whether each is only
+* assumed. A class found anywhere beneath is found. A position beneath itself, a recursion defined once, is read until
+* nothing changes, last read first, so a chain of reused schemas settles in one pass.
+*/
+function classesBeneath(walked) {
+	const beneath = /* @__PURE__ */ new Map();
+	for (const at of walked.keys()) beneath.set(at, /* @__PURE__ */ new Map());
+	const firsts = [...walked].reverse();
+	for (let changed = true; changed;) {
+		changed = false;
+		for (const [at, first] of firsts) {
+			const into = beneath.get(at);
+			const merge = (name, assumed) => {
+				const known = into.get(name);
+				if (known === void 0 || known && !assumed) {
+					into.set(name, assumed);
+					changed = true;
+				}
+			};
+			for (const child of first.below ?? []) {
+				if (child.depth > 256 && !cutOff(child)) continue;
+				for (const [name, assumed] of ownClasses(child)) merge(name, assumed);
+				if (child.depth > 256) continue;
+				const below = child.at && beneath.get(child.at);
+				if (below) for (const [name, assumed] of below) merge(name, assumed);
+			}
+		}
+	}
+	return beneath;
+}
+/**
+* Walk a schema tree the way {@link classifyPrivacy} does, from `path`, and report to `visitor`. Exported so a second
+* reader of the tree — the CLI's scan — cannot walk it differently. A position met again below itself is a recursion
+* defined once, and is not walked again: its fields are listed once. A position nested more than
+* {@link MAX_RECURSION_DEPTH} levels deep is cut off by `redact` as {@link TRUNCATED_MASK}; where it is a position not
+* met on its path, nothing past it was read, so it is listed with every class, each truncated.
+*
+* Positions are read level by level, shallowest first, and reported in the schema's own order, all in one call with one
+* {@link MAX_READ_SCHEMAS}. Each distinct position is read once, wherever it sits; every level above the one the budget
+* runs out on is read whole, and each position it did not read is listed with {@link unreadClasses}, each truncated.
+* Once {@link MAX_LISTED_PATHS} paths are written out, a position met again is a reference: its path is listed with
+* every class beneath it and the path it was first written out under, and nothing below it is written out again. So the
+* walk is bounded by the budget, however many paths reach one schema. A schema that cannot be read at all, nested
+* deeper than the stack or behind a getter that throws, is listed with every class, each truncated. It never throws.
+*/
+function walkPrivacy(schema, visitor, path = "") {
+	const call = newCall();
+	const root = frameAt(() => rootPosition(schema, call), {
+		path,
+		depth: 0
+	});
+	const queue = [root];
+	const walked = /* @__PURE__ */ new Map();
+	let references = false;
+	for (let index = 0; index < queue.length; index += 1) {
+		const frame = queue[index];
+		const { at } = frame;
+		if (at === void 0 || frame.depth > 256 || at.whole) continue;
+		if (at.kinds.size === 0 || onLine(frame)) continue;
+		const first = walked.get(at);
+		if (first === void 0) walked.set(at, frame);
+		else if (queue.length >= 5e4) {
+			frame.sameAs = first;
+			references = true;
+			continue;
+		}
+		frame.below = framesBelow(frame, at);
+		for (const child of frame.below) queue.push(child);
+	}
+	const beneath = references ? classesBeneath(walked) : /* @__PURE__ */ new Map();
+	const stack = [root];
+	for (let frame = stack.pop(); frame; frame = stack.pop()) {
+		const { at } = frame;
+		if (frame.depth <= 256 && at !== void 0 && at.mask === void 0 && frame.key !== void 0) visitor.unmarkedKey?.(frame.path, frame.key);
+		if (frame.depth <= 256 || cutOff(frame)) for (const [className, assumed] of ownClasses(frame)) visitor.marked(frame.path, className, assumed ? { truncated: true } : void 0);
+		if (frame.depth > 256) continue;
+		const reference = frame.sameAs;
+		if (reference?.at) for (const [className, assumed] of beneath.get(reference.at) ?? []) visitor.marked(frame.path, className, assumed ? {
+			truncated: true,
+			sameAs: reference.path
+		} : { sameAs: reference.path });
+		if (frame.below) for (let index = frame.below.length - 1; index >= 0; index -= 1) stack.push(frame.below[index]);
+	}
+}
+/**
+* Every position `redact` masks in a schema, and its class — the Art. 30 record for one object, derived rather than
+* maintained. Empty for a schema with no markers. A path reached twice is listed once per class. It never throws.
+*/
+function classifyPrivacy(schema) {
+	const fields = [];
+	const byKey = /* @__PURE__ */ new Map();
+	walkPrivacy(schema, { marked: (path, className, note) => {
+		const key = `${path}\u0000${className}`;
+		if (byKey.has(key)) return;
+		const field = {
+			path,
+			class: className
+		};
+		if (note?.truncated) field.truncated = true;
+		if (note?.sameAs !== void 0) field.sameAs = note.sameAs;
+		byKey.set(key, field);
+		fields.push(field);
+	} });
+	return fields;
+}
+/** Whether a schema holds a field of `className` at any depth: exactly what {@link classifyPrivacy} lists. */
+function hasPrivacy(schema, className) {
+	return classifyPrivacy(schema).some((field) => field.class === className);
+}
+//#endregion
+export { MAX_LISTED_PATHS, MAX_READ_SCHEMAS, MAX_RECURSION_DEPTH, TRUNCATED_MASK, classifyPrivacy, hasPrivacy, kindOfValue, newCall, positionOf, privacyOf, rootPosition, unreadClasses, walkPrivacy };