@powerhousedao/reactor-workflow 6.2.3-dev.11

package/dist/redact-C7LWgAyD.js

@@ -0,0 +1,797 @@
+import { DEDUPE_KEY_PROPERTY, StoreScope } from "@powerhousedao/pieces-framework";
+import { mkdir, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { randomUUID } from "node:crypto";
+import { ssrfIpClassifier } from "@powerhousedao/pieces-framework/host";
+import { Cron } from "croner";
+import dgram from "node:dgram";
+import dns from "node:dns";
+import net, { isIP } from "node:net";
+import { AsyncLocalStorage } from "node:async_hooks";
+//#region src/pieces/activepieces/types.ts
+function getActions(piece) {
+	return (typeof piece.actions === "function" ? piece.actions() : piece.actions) ?? {};
+}
+function getTriggers(piece) {
+	return (typeof piece.triggers === "function" ? piece.triggers() : piece.triggers) ?? {};
+}
+//#endregion
+//#region src/pieces/activepieces/context/stubs.ts
+var UnsupportedContextMemberError = class extends Error {
+	member;
+	constructor(member) {
+		super(`Piece used unimplemented context member "${member}". Implement it in the adapter or reject the piece at conformance time.`);
+		this.name = "UnsupportedContextMemberError";
+		this.member = member;
+	}
+};
+function throwingStub(memberPath) {
+	return new Proxy(function stub() {}, {
+		get(_target, prop) {
+			if (typeof prop !== "string" || prop === "then") return void 0;
+			throw new UnsupportedContextMemberError(`${memberPath}.${prop}`);
+		},
+		apply() {
+			throw new UnsupportedContextMemberError(memberPath);
+		}
+	});
+}
+function withTouchTracking(base, touched, onTouch) {
+	return new Proxy(base, { get(target, prop, receiver) {
+		if (typeof prop === "string" && prop !== "then") {
+			const member = prop in target ? prop : `UNDOCUMENTED:${prop}`;
+			touched.add(member);
+			onTouch?.(member);
+		}
+		return Reflect.get(target, prop, receiver);
+	} });
+}
+//#endregion
+//#region src/pieces/activepieces/worker/protocol.ts
+const LOG_WRITE = "log.write";
+const OUTPUT_UPDATE = "output.update";
+const STORE_GET = "store.get";
+const STORE_PUT = "store.put";
+const STORE_DELETE = "store.delete";
+const REACTOR_MODELS = "reactor.models";
+const REACTOR_MODEL = "reactor.model";
+const REACTOR_GET = "reactor.get";
+const REACTOR_FIND = "reactor.find";
+const REACTOR_CREATE = "reactor.create";
+const REACTOR_EXECUTE = "reactor.execute";
+//#endregion
+//#region src/pieces/activepieces/worker/json-safe.ts
+function jsonSafe(value) {
+	try {
+		return JSON.parse(JSON.stringify(value));
+	} catch {
+		return String(value);
+	}
+}
+//#endregion
+//#region src/pieces/activepieces/context/store-scope.ts
+function normalizeStoreScope(scope) {
+	return scope === StoreScope.PROJECT || scope === "PROJECT" ? "PROJECT" : "FLOW";
+}
+//#endregion
+//#region src/pieces/activepieces/context/action.ts
+var InMemoryConnectionsProvider = class {
+	values;
+	constructor(values = {}) {
+		this.values = new Map(Object.entries(values));
+	}
+	set(key, value) {
+		this.values.set(key, value);
+	}
+	get(key) {
+		return Promise.resolve(this.values.get(key) ?? null);
+	}
+};
+var InMemoryKeyValueStore = class {
+	entries;
+	constructor(seed = {}) {
+		this.entries = new Map(Object.entries(seed));
+	}
+	snapshot() {
+		return Object.fromEntries(this.entries);
+	}
+	put(key, value, scope) {
+		const stored = jsonSafe(value);
+		this.entries.set(this.scoped(key, scope), stored);
+		return Promise.resolve(stored);
+	}
+	get(key, scope) {
+		return Promise.resolve(this.entries.get(this.scoped(key, scope)) ?? null);
+	}
+	delete(key, scope) {
+		this.entries.delete(this.scoped(key, scope));
+		return Promise.resolve();
+	}
+	scoped(key, scope) {
+		return scope === "PROJECT" ? `PROJECT:${key}` : key;
+	}
+};
+function buildActionContext(options) {
+	const { identity = {} } = options;
+	const store = options.store ?? new InMemoryKeyValueStore();
+	const touched = /* @__PURE__ */ new Set();
+	return {
+		context: withTouchTracking({
+			executionType: options.executionType ?? "BEGIN",
+			auth: options.auth,
+			propsValue: options.propsValue,
+			store: {
+				put: (key, value, scope) => store.put(key, value, normalizeStoreScope(scope)),
+				get: (key, scope) => store.get(key, normalizeStoreScope(scope)),
+				delete: (key, scope) => store.delete(key, normalizeStoreScope(scope))
+			},
+			connections: options.connections ?? throwingStub("connections"),
+			tags: throwingStub("tags"),
+			server: throwingStub("server"),
+			files: options.files ?? throwingStub("files"),
+			output: options.output ?? throwingStub("output"),
+			reactor: options.reactor ?? throwingStub("reactor"),
+			agent: throwingStub("agent"),
+			run: {
+				id: identity.runId ?? "run",
+				stop: throwingStub("run.stop"),
+				pause: throwingStub("run.pause"),
+				respond: throwingStub("run.respond"),
+				createWaitpoint: throwingStub("run.createWaitpoint"),
+				waitForWaitpoint: throwingStub("run.waitForWaitpoint")
+			},
+			project: {
+				id: identity.projectId ?? "project",
+				externalId: () => Promise.resolve(identity.projectId ?? "project")
+			},
+			flows: {
+				list: throwingStub("flows.list"),
+				current: {
+					id: identity.flowId ?? "flow",
+					version: { id: identity.flowVersionId ?? "flow-version" }
+				}
+			},
+			step: { name: identity.stepName ?? "step" },
+			generateResumeUrl: throwingStub("generateResumeUrl")
+		}, touched, options.onTouch),
+		touched
+	};
+}
+//#endregion
+//#region src/pieces/activepieces/context/limits.ts
+const DEFAULT_MAX_FILE_BYTES = 8 * 1024 * 1024;
+function maxFileBytes() {
+	const raw = process.env.PH_PIECE_MAX_FILE_BYTES;
+	if (raw === void 0) return DEFAULT_MAX_FILE_BYTES;
+	const parsed = Number(raw);
+	return Number.isFinite(parsed) && parsed > 0 ? Math.floor(parsed) : DEFAULT_MAX_FILE_BYTES;
+}
+var FileTooLargeError = class extends Error {
+	size;
+	limit;
+	constructor(size, limit = maxFileBytes()) {
+		super(`File of ${size} bytes exceeds the ${limit} byte limit (raise PH_PIECE_MAX_FILE_BYTES to allow more)`);
+		this.name = "FileTooLargeError";
+		this.size = size;
+		this.limit = limit;
+	}
+};
+function assertWithinLimit(size) {
+	const limit = maxFileBytes();
+	if (size > limit) throw new FileTooLargeError(size, limit);
+}
+//#endregion
+//#region src/pieces/activepieces/context/files.ts
+const APFILE_SCHEME = "apfile://";
+var DataUriFilesService = class {
+	write(file) {
+		const data = Buffer.isBuffer(file.data) ? file.data : Buffer.from(file.data);
+		if (data.byteLength > maxFileBytes()) return Promise.reject(new FileTooLargeError(data.byteLength));
+		return Promise.resolve(`data:application/octet-stream;base64,${data.toString("base64")}`);
+	}
+};
+const EXTENSION_TYPES = {
+	pdf: "application/pdf",
+	png: "image/png",
+	jpg: "image/jpeg",
+	jpeg: "image/jpeg",
+	webp: "image/webp",
+	tif: "image/tiff",
+	tiff: "image/tiff",
+	txt: "text/plain",
+	json: "application/json",
+	csv: "text/csv"
+};
+function contentTypeFor(fileName) {
+	const extension = fileName.split(".").pop()?.toLowerCase();
+	return extension ? EXTENSION_TYPES[extension] : void 0;
+}
+var StagedFilesService = class {
+	files = [];
+	constructor(stagingDir) {
+		this.stagingDir = stagingDir;
+	}
+	staged() {
+		return [...this.files];
+	}
+	async write(file) {
+		const data = Buffer.isBuffer(file.data) ? file.data : Buffer.from(file.data);
+		assertWithinLimit(data.byteLength);
+		const token = randomUUID();
+		const fileName = file.fileName && file.fileName !== "" ? file.fileName : token;
+		const target = path.join(this.stagingDir, token);
+		await mkdir(this.stagingDir, { recursive: true });
+		await writeFile(target, data);
+		this.files.push({
+			token: `${APFILE_SCHEME}${token}`,
+			path: target,
+			fileName,
+			size: data.byteLength,
+			contentType: contentTypeFor(fileName)
+		});
+		return `${APFILE_SCHEME}${token}`;
+	}
+};
+function rewriteFileRefs(value, refs) {
+	if (refs.size === 0) return value;
+	if (typeof value === "string") return refs.get(value) ?? value;
+	if (Array.isArray(value)) return value.map((entry) => rewriteFileRefs(entry, refs));
+	if (typeof value === "object" && value !== null) {
+		const out = {};
+		for (const [key, entry] of Object.entries(value)) out[key] = rewriteFileRefs(entry, refs);
+		return out;
+	}
+	return value;
+}
+//#endregion
+//#region src/pieces/activepieces/context/trigger.ts
+const MIN_SCHEDULE_INTERVAL_MS = 6e4;
+var InvalidCronExpressionError = class extends Error {
+	constructor(cronExpression) {
+		super(`Invalid cron expression "${cronExpression}"`);
+		this.name = "InvalidCronExpressionError";
+	}
+};
+var InvalidScheduleIntervalError = class extends Error {
+	constructor(intervalMs) {
+		super(`Invalid schedule interval ${String(intervalMs)}: expected a whole number of milliseconds, at least ${MIN_SCHEDULE_INTERVAL_MS}`);
+		this.name = "InvalidScheduleIntervalError";
+	}
+};
+function validateSchedule(request) {
+	if ("intervalMs" in request) {
+		const { intervalMs } = request;
+		if (!Number.isInteger(intervalMs) || intervalMs < 6e4) throw new InvalidScheduleIntervalError(intervalMs);
+		return { intervalMs };
+	}
+	const timezone = request.timezone ?? "UTC";
+	let parsed;
+	try {
+		parsed = new Cron(request.cronExpression, {
+			timezone,
+			legacyMode: false
+		});
+	} catch {
+		throw new InvalidCronExpressionError(request.cronExpression);
+	}
+	if (!parsed.nextRun()) throw new InvalidCronExpressionError(request.cronExpression);
+	return {
+		cronExpression: request.cronExpression,
+		timezone
+	};
+}
+function buildTriggerContext(options) {
+	const { identity = {} } = options;
+	const store = options.store ?? new InMemoryKeyValueStore();
+	const touched = /* @__PURE__ */ new Set();
+	const schedules = [];
+	const listeners = [];
+	const prefix = options.storePrefix ?? "";
+	const flowId = identity.flowId ?? "flow";
+	const scopedKey = (key, scope) => normalizeStoreScope(scope) === "PROJECT" ? `${prefix}${key}` : `${prefix}flow_${flowId}/${key}`;
+	const address = (key, scope) => options.hostPartitionedStore ? [key, normalizeStoreScope(scope)] : [scopedKey(key, scope), void 0];
+	return {
+		context: withTouchTracking({
+			auth: options.auth,
+			propsValue: options.propsValue,
+			isRepublish: options.isRepublish ?? false,
+			store: {
+				put: (key, value, scope) => {
+					const [at, partition] = address(key, scope);
+					return store.put(at, value, partition);
+				},
+				get: (key, scope) => store.get(...address(key, scope)),
+				delete: (key, scope) => store.delete(...address(key, scope))
+			},
+			flows: {
+				list: options.flows?.list.bind(options.flows) ?? throwingStub("flows.list"),
+				current: {
+					id: identity.flowId ?? "flow",
+					version: { id: identity.flowVersionId ?? "flow-version" }
+				}
+			},
+			step: { name: identity.stepName ?? "trigger" },
+			project: {
+				id: identity.projectId ?? "project",
+				externalId: () => Promise.resolve(identity.projectId ?? "project")
+			},
+			connections: options.connections ?? { get: throwingStub("connections.get") },
+			server: options.server ?? throwingStub("server"),
+			webhookUrl: options.webhookUrl ?? "http://localhost:0/webhook",
+			payload: options.payload,
+			setSchedule: (schedule) => {
+				schedules.push(validateSchedule(schedule));
+			},
+			app: { createListeners: (listener) => {
+				listeners.push(listener);
+			} },
+			files: options.files ?? throwingStub("files")
+		}, touched, options.onTouch),
+		touched,
+		schedules,
+		listeners
+	};
+}
+function extractDedupeKey(payload) {
+	if (typeof payload !== "object" || payload === null) return void 0;
+	const value = payload[DEDUPE_KEY_PROPERTY];
+	return typeof value === "string" ? value : void 0;
+}
+var TriggerHookNotImplementedError = class extends Error {
+	constructor(triggerName, hook) {
+		super(`Trigger "${triggerName}" does not implement ${hook}()`);
+		this.name = "TriggerHookNotImplementedError";
+	}
+};
+async function runTriggerHook(trigger, hook, handle) {
+	const fn = trigger[hook];
+	if (typeof fn !== "function") throw new TriggerHookNotImplementedError(trigger.name ?? "unknown", hook);
+	return await fn.call(trigger, handle.context);
+}
+//#endregion
+//#region src/pieces/activepieces/worker/egress.ts
+const EGRESS_DENIED_CODE = "EGRESS_DENIED";
+const DEFAULT_EGRESS_POLICY = {};
+var EgressDeniedError = class extends Error {
+	code = EGRESS_DENIED_CODE;
+	host;
+	port;
+	address;
+	constructor(reason, where) {
+		super(`Egress denied: ${reason}`);
+		this.name = "EgressDeniedError";
+		this.host = where.host;
+		this.port = where.port;
+		this.address = where.address;
+	}
+};
+const IPV4_COMPATIBLE = new net.BlockList();
+IPV4_COMPATIBLE.addSubnet("::", 96, "ipv6");
+function familyOf(address) {
+	return isIP(address) === 6 ? "ipv6" : "ipv4";
+}
+function parseAddress(value) {
+	const bare = value.split("%")[0];
+	return isIP(bare) === 0 ? void 0 : bare;
+}
+function addAllowedAddress(list, spec) {
+	const slash = spec.indexOf("/");
+	const mask = slash === -1 ? "" : spec.slice(slash + 1);
+	const address = parseAddress(slash === -1 ? spec : spec.slice(0, slash));
+	if (!address) throw new Error(`Egress policy entry "${spec}" is not an IP address`);
+	const family = familyOf(address);
+	const width = family === "ipv6" ? 128 : 32;
+	const prefix = mask === "" ? width : Number(mask);
+	if (!Number.isInteger(prefix) || prefix < 1 || prefix > width) throw new Error(`Egress policy entry "${spec}" has an invalid prefix`);
+	list.addSubnet(address, prefix, family);
+}
+const nativeLookup = originalOf(dns, "lookup");
+const RESOLVER_METHODS = [
+	"resolve",
+	"resolve4",
+	"resolve6",
+	"resolveAny",
+	"resolveCaa",
+	"resolveCname",
+	"resolveMx",
+	"resolveNaptr",
+	"resolveNs",
+	"resolvePtr",
+	"resolveSoa",
+	"resolveSrv",
+	"resolveTxt",
+	"reverse"
+];
+function isPrivateAddress(value) {
+	const address = parseAddress(value);
+	if (!address) return true;
+	if (IPV4_COMPATIBLE.check(address, familyOf(address))) return true;
+	return ssrfIpClassifier.isBlockedIp({
+		ip: address,
+		allowList: []
+	});
+}
+function compile(policy) {
+	const hosts = policy.allowHosts?.map((host) => host.trim().toLowerCase());
+	const ports = policy.allowPorts?.map((port) => {
+		if (!Number.isInteger(port) || port < 0 || port > 65535) throw new Error(`Egress policy port ${String(port)} is out of range`);
+		return port;
+	});
+	const specs = policy.allowAddresses ?? [];
+	const addresses = new net.BlockList();
+	for (const spec of specs) addAllowedAddress(addresses, spec);
+	return {
+		hosts: hosts && hosts.length > 0 ? hosts : void 0,
+		addresses: specs.length > 0 ? addresses : void 0,
+		ports: ports && ports.length > 0 ? ports : void 0,
+		allowPrivate: policy.allowPrivateAddresses === true
+	};
+}
+function hostAllowed(policy, host) {
+	if (!policy.hosts) return true;
+	const name = host.toLowerCase();
+	return policy.hosts.some((entry) => entry.startsWith("*.") ? name.length > entry.length - 1 && name.endsWith(entry.slice(1)) : entry === name);
+}
+function addressAllowed(policy, address) {
+	const ip = parseAddress(address);
+	if (!ip) return false;
+	if (policy.addresses?.check(ip, familyOf(ip))) return true;
+	return policy.allowPrivate || !isPrivateAddress(ip);
+}
+let inFlight;
+const started = new AsyncLocalStorage();
+function policiesInForce() {
+	const inherited = started.getStore();
+	const policies = [];
+	if (inFlight) policies.push(inFlight);
+	if (inherited && inherited !== inFlight) policies.push(inherited);
+	return policies;
+}
+async function runWithEgressPolicy(policy, work) {
+	const compiled = policy ? compile(policy) : void 0;
+	installEgressGuard();
+	inFlight = compiled;
+	try {
+		return await started.run(compiled, work);
+	} finally {
+		if (inFlight === compiled) inFlight = void 0;
+	}
+}
+function normalizeConnectArgs(args) {
+	if (Array.isArray(args[0])) {
+		const [options, callback] = args[0];
+		return {
+			options: { ...options },
+			callback
+		};
+	}
+	const first = args[0];
+	let options = {};
+	if (typeof first === "object" && first !== null) options = { ...first };
+	else if (typeof first === "string" && Number.isNaN(Number(first))) options.path = first;
+	else {
+		options.port = first;
+		if (typeof args[1] === "string") options.host = args[1];
+	}
+	const last = args[args.length - 1];
+	return {
+		options,
+		callback: typeof last === "function" ? last : void 0
+	};
+}
+function guardedLookup(policies, host, port) {
+	return (hostname, options, callback) => {
+		const asked = options;
+		nativeLookup(hostname, options, (error, result, family) => {
+			if (error) {
+				callback(error);
+				return;
+			}
+			try {
+				const entries = asked.all ? result : [{
+					address: result,
+					family: family ?? 0
+				}];
+				const permitted = entries.filter((entry) => policies.every((policy) => addressAllowed(policy, entry.address)));
+				if (permitted.length === 0) {
+					callback(new EgressDeniedError(`host "${host}" resolves to ${entries.map((entry) => entry.address).join(", ") || "nothing"}, which the policy does not permit`, {
+						host,
+						port,
+						address: entries[0]?.address
+					}));
+					return;
+				}
+				if (asked.all) callback(null, permitted);
+				else callback(null, permitted[0].address, permitted[0].family);
+			} catch (failure) {
+				callback(failure instanceof Error ? failure : new Error(String(failure)));
+			}
+		});
+	};
+}
+function denyReason(policies, options) {
+	if (typeof options.path === "string") return new EgressDeniedError(`connections to local socket "${options.path}" are not permitted`, { host: options.path });
+	const host = typeof options.host === "string" ? options.host : "";
+	const port = options.port === void 0 ? void 0 : Number(options.port);
+	for (const policy of policies) {
+		if (policy.ports && (port === void 0 || !policy.ports.includes(port))) return new EgressDeniedError(`port ${String(port)} on host "${host}" is not permitted`, {
+			host,
+			port
+		});
+		if (!hostAllowed(policy, host)) return new EgressDeniedError(`host "${host}" is not on the allowlist`, {
+			host,
+			port
+		});
+		if (isIP(host) && !addressAllowed(policy, host)) return new EgressDeniedError(`address ${host} is not permitted`, {
+			host,
+			port,
+			address: host
+		});
+	}
+}
+function failLater(emitter, error, callback) {
+	process.nextTick(() => {
+		if (typeof callback === "function") callback(error);
+		else emitter.emit("error", error);
+	});
+}
+function originalOf(target, name) {
+	return Object.getOwnPropertyDescriptor(target, name)?.value;
+}
+function resolverDenial(method, args) {
+	const host = typeof args[0] === "string" ? args[0] : "";
+	return new EgressDeniedError(`DNS ${method}("${host}") is not permitted; use a hostname in a request instead`, { host });
+}
+function refuseResolvers(target, promised) {
+	for (const method of RESOLVER_METHODS) {
+		const original = originalOf(target, method);
+		if (typeof original !== "function") continue;
+		function refused(...args) {
+			if (policiesInForce().length === 0) return original.apply(this, args);
+			const denied = resolverDenial(method, args);
+			if (promised) return Promise.reject(denied);
+			const callback = args[args.length - 1];
+			if (typeof callback !== "function") throw denied;
+			process.nextTick(() => callback(denied));
+		}
+		seal(target, method, refused);
+	}
+}
+function seal(target, name, value) {
+	Object.defineProperty(target, name, {
+		value,
+		writable: false,
+		configurable: false,
+		enumerable: false
+	});
+}
+let installed = false;
+function installEgressGuard() {
+	if (installed) return;
+	installed = true;
+	const connect = originalOf(net.Socket.prototype, "connect");
+	function patchedConnect(...args) {
+		const policies = policiesInForce();
+		if (policies.length === 0) return connect.apply(this, args);
+		const { options, callback } = normalizeConnectArgs(args);
+		if (typeof options.path !== "string" && !options.host) options.host = "localhost";
+		const denied = denyReason(policies, options);
+		if (denied) {
+			process.nextTick(() => this.destroy(denied));
+			return this;
+		}
+		if (typeof options.host === "string" && !isIP(options.host)) options.lookup = guardedLookup(policies, options.host, options.port === void 0 ? void 0 : Number(options.port));
+		return connect.call(this, options, callback);
+	}
+	seal(net.Socket.prototype, "connect", patchedConnect);
+	const send = originalOf(dgram.Socket.prototype, "send");
+	function patchedSend(...args) {
+		if (policiesInForce().length === 0) {
+			send.apply(this, args);
+			return;
+		}
+		const host = args.find((arg, index) => index > 0 && typeof arg === "string");
+		const last = args[args.length - 1];
+		failLater(this, new EgressDeniedError(`UDP to "${host ?? "the requested address"}" is not permitted`, { host: host ?? "" }), typeof last === "function" ? last : void 0);
+	}
+	seal(dgram.Socket.prototype, "send", patchedSend);
+	const bind = originalOf(dgram.Socket.prototype, "bind");
+	function patchedBind(...args) {
+		if (policiesInForce().length === 0) return bind.apply(this, args);
+		failLater(this, new EgressDeniedError("binding a UDP socket is not permitted", { host: "" }), void 0);
+		return this;
+	}
+	seal(dgram.Socket.prototype, "bind", patchedBind);
+	const listen = originalOf(net.Server.prototype, "listen");
+	function patchedListen(...args) {
+		if (policiesInForce().length === 0) return listen.apply(this, args);
+		failLater(this, new EgressDeniedError("listening for connections is not permitted", { host: "" }), void 0);
+		return this;
+	}
+	seal(net.Server.prototype, "listen", patchedListen);
+	refuseResolvers(dns, false);
+	refuseResolvers(dns.Resolver.prototype, false);
+	refuseResolvers(dns.promises, true);
+	refuseResolvers(dns.promises.Resolver.prototype, true);
+}
+//#endregion
+//#region src/pieces/activepieces/worker/redact.ts
+const REDACTED_PREFIX = "[redacted:";
+const SECRET_MARKER = "[redacted:secret]";
+const CIRCULAR_MARKER = "[circular]";
+const TRUNCATED_MARKER = "[truncated]";
+const ERROR_MAX_DEPTH = 8;
+const ERROR_MAX_NODES = 1e3;
+const STACK_GUARD_DEPTH = 200;
+const SENSITIVE_NAMES = new Set([
+	"auth",
+	"authorization",
+	"proxyauthorization",
+	"wwwauthenticate",
+	"authtoken",
+	"xauthtoken",
+	"apikey",
+	"xapikey",
+	"apisecret",
+	"bearer",
+	"cookie",
+	"setcookie",
+	"credential",
+	"credentials",
+	"password",
+	"passwd",
+	"passphrase",
+	"pwd",
+	"privatekey",
+	"secret",
+	"secrettext",
+	"sessionid",
+	"signature",
+	"token"
+]);
+const SENSITIVE_SUFFIXES = [
+	"apikey",
+	"credentials",
+	"password",
+	"privatekey",
+	"secret",
+	"token"
+];
+const TEXT_FIELD = new RegExp(String.raw`\b(authorization|proxy-authorization|api[-_]?key|x-api-key|access[-_]?token|refresh[-_]?token|client[-_]?secret|set-cookie|cookie|password|secret|token|(?:[a-z0-9]+[-_])*signature(?:[-_][a-z0-9]+)*)\b(["']?)(\s*[:=]\s*)(["']?)((?:(?:Bearer|Basic|Token)\s+)?[^\s",;&)}]+)\4`, "gi");
+const AUTH_SCHEME = /\b(Bearer|Basic|Token)\s+([A-Za-z0-9._~+/=-]{8,})/g;
+const QUERY_PARAM = /([?&])([A-Za-z0-9_.%[\]-]+)=([^&\s"'<>]+)/g;
+const URL_USERINFO = /([a-z][a-z0-9+.-]*:\/\/)([^/\s:@]+):([^/\s@]+)@/gi;
+function normalizeName(name) {
+	return name.toLowerCase().replace(/[^a-z0-9]/g, "");
+}
+function isSensitiveName(name) {
+	const normalized = normalizeName(name);
+	if (!normalized) return false;
+	if (SENSITIVE_NAMES.has(normalized)) return true;
+	if (normalized.includes("signature")) return true;
+	return SENSITIVE_SUFFIXES.some((suffix) => normalized.length > suffix.length && normalized.endsWith(suffix));
+}
+function marker(name) {
+	return `[redacted:${name.toLowerCase()}]`;
+}
+function shannonEntropy(text) {
+	const counts = /* @__PURE__ */ new Map();
+	for (const char of text) counts.set(char, (counts.get(char) ?? 0) + 1);
+	let entropy = 0;
+	for (const count of counts.values()) {
+		const p = count / text.length;
+		entropy -= p * Math.log2(p);
+	}
+	return entropy;
+}
+const MIN_VALUE_LENGTH = 8;
+const MIN_DISTINCT_CHARS = 5;
+const MIN_ENTROPY_BITS = 2;
+const MIN_DECLARED_LENGTH = 4;
+function isRedactableValue(value) {
+	if (typeof value !== "string") return false;
+	if (value.length < MIN_VALUE_LENGTH) return false;
+	if (new Set(value).size < MIN_DISTINCT_CHARS) return false;
+	return shannonEntropy(value) >= MIN_ENTROPY_BITS;
+}
+function isDeclaredValue(value) {
+	return typeof value === "string" && value.length >= MIN_DECLARED_LENGTH;
+}
+const STRUCTURAL_NAMES = new Set(["type", "authtype"]);
+const URL_LIKE = /^[a-z][a-z0-9+.-]*:\/\//i;
+function collectSecretValues(value, into = /* @__PURE__ */ new Set(), depth = 0) {
+	if (depth > ERROR_MAX_DEPTH) return into;
+	if (isRedactableValue(value)) {
+		if (!URL_LIKE.test(value)) into.add(value);
+		return into;
+	}
+	if (Array.isArray(value)) {
+		for (const entry of value) collectSecretValues(entry, into, depth + 1);
+		return into;
+	}
+	if (typeof value === "object" && value !== null) for (const [key, entry] of Object.entries(value)) {
+		if (STRUCTURAL_NAMES.has(normalizeName(key))) continue;
+		collectSecretValues(entry, into, depth + 1);
+	}
+	return into;
+}
+const thrownSecrets = /* @__PURE__ */ new WeakMap();
+function rememberSecrets(error, values) {
+	if (typeof error === "object" && error !== null && values.length > 0) thrownSecrets.set(error, values);
+	return error;
+}
+function secretsFor(error) {
+	if (typeof error !== "object" || error === null) return [];
+	return thrownSecrets.get(error) ?? [];
+}
+function preparePass(options) {
+	return {
+		values: [...options?.values ?? []].filter(isDeclaredValue).sort((a, b) => b.length - a.length),
+		maxDepth: options?.maxDepth ?? STACK_GUARD_DEPTH,
+		maxNodes: options?.maxNodes ?? Number.POSITIVE_INFINITY,
+		nodes: 0
+	};
+}
+function safeDecode(name) {
+	try {
+		return decodeURIComponent(name);
+	} catch {
+		return name;
+	}
+}
+function replaceValues(text, values) {
+	let result = text;
+	for (const value of values) {
+		if (result.includes(value)) result = result.split(value).join(SECRET_MARKER);
+		const encoded = encodeURIComponent(value);
+		if (encoded !== value && result.includes(encoded)) result = result.split(encoded).join(SECRET_MARKER);
+	}
+	return result;
+}
+function redactText(text, pass) {
+	let result = replaceValues(text, pass.values);
+	result = result.replace(URL_USERINFO, (_match, scheme, user) => `${scheme}${user}:${marker("password")}@`);
+	result = result.replace(QUERY_PARAM, (match, sep, name) => isSensitiveName(safeDecode(name)) ? `${sep}${name}=${marker(name)}` : match);
+	result = result.replace(AUTH_SCHEME, (_match, scheme) => `${scheme} ${marker(scheme)}`);
+	return result.replace(TEXT_FIELD, (match, name, nameQuote, sep, quote, value) => value.startsWith("[redacted:") ? match : `${name}${nameQuote}${sep}${quote}${marker(name)}${quote}`);
+}
+function walk(value, pass, depth, seen) {
+	if (typeof value === "string") return redactText(value, pass);
+	if (typeof value !== "object" || value === null) return value;
+	if (seen.has(value)) return CIRCULAR_MARKER;
+	if (depth >= pass.maxDepth) return TRUNCATED_MARKER;
+	if (pass.nodes >= pass.maxNodes) return TRUNCATED_MARKER;
+	pass.nodes += 1;
+	seen.add(value);
+	try {
+		if (Array.isArray(value)) return value.map((entry) => walk(entry, pass, depth + 1, seen));
+		const result = {};
+		for (const [key, entry] of Object.entries(value)) result[key] = isSensitiveName(key) ? marker(key) : walk(entry, pass, depth + 1, seen);
+		return result;
+	} finally {
+		seen.delete(value);
+	}
+}
+function redact(value, options) {
+	return walk(value, preparePass(options), 0, /* @__PURE__ */ new Set());
+}
+function redactError(value, options) {
+	return redact(value, {
+		maxDepth: ERROR_MAX_DEPTH,
+		maxNodes: ERROR_MAX_NODES,
+		...options
+	});
+}
+function containsRedactedMarker(value, depth = 0) {
+	if (typeof value === "string") return value.includes(REDACTED_PREFIX);
+	if (typeof value !== "object" || value === null) return false;
+	if (depth >= STACK_GUARD_DEPTH) return false;
+	return Object.values(value).some((entry) => containsRedactedMarker(entry, depth + 1));
+}
+function redactMessage(text, options) {
+	return redactText(text, preparePass(options));
+}
+//#endregion
+export { REACTOR_MODEL as A, jsonSafe as C, REACTOR_EXECUTE as D, REACTOR_CREATE as E, UnsupportedContextMemberError as F, throwingStub as I, withTouchTracking as L, STORE_DELETE as M, STORE_GET as N, REACTOR_FIND as O, STORE_PUT as P, getActions as R, buildActionContext as S, OUTPUT_UPDATE as T, FileTooLargeError as _, redactMessage as a, InMemoryConnectionsProvider as b, DEFAULT_EGRESS_POLICY as c, buildTriggerContext as d, extractDedupeKey as f, rewriteFileRefs as g, StagedFilesService as h, redactError as i, REACTOR_MODELS as j, REACTOR_GET as k, installEgressGuard as l, DataUriFilesService as m, containsRedactedMarker as n, rememberSecrets as o, runTriggerHook as p, redact as r, secretsFor as s, collectSecretValues as t, runWithEgressPolicy as u, assertWithinLimit as v, LOG_WRITE as w, InMemoryKeyValueStore as x, maxFileBytes as y, getTriggers as z };
+
+//# sourceMappingURL=redact-C7LWgAyD.js.map