@sema-agent/server 7.56.0 → 7.57.0

package/dist/trace/redact.js

@@ -1,40 +1,675 @@
-const SECRET_PATTERNS = [
+import { recordFailOpen } from "../observability/fail-open.js";
+const REDACTION_TOKEN_RE_SRC = String.raw `«redacted(?::[a-z-]{1,16}){0,2}»`;
+const FULL_SECRET_PATTERNS = [
     [/-----BEGIN[^-]+PRIVATE KEY(?: BLOCK)?-----[\s\S]{0,8192}?-----END[^-]+PRIVATE KEY(?: BLOCK)?-----/g, "«redacted:private-key»"],
+    [/---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----[\s\S]{0,8192}?---- END SSH2 ENCRYPTED PRIVATE KEY ----/g, "«redacted:private-key»"],
     [/\bsk-[A-Za-z0-9_-]{16,}\b/g, "«redacted:key»"],
     [/\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}\b/g, "«redacted:gh-token»"],
+    [/\bgithub_pat_[A-Za-z0-9]{22}_[A-Za-z0-9]{59}\b/g, "«redacted:gh-token»"],
     [/\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, "«redacted:slack-token»"],
     [/\bAKIA[0-9A-Z]{16}\b/g, "«redacted:aws-key»"],
+    [/\bASIA[0-9A-Z]{16}\b/g, "«redacted:aws-key»"],
+    [/\b(?:gl(?:pat|dt|rt|rtr|cbt|ptt|oas|ft|imt|agent|wt|soat|ffct)-[A-Za-z0-9_-]{20,}|(?:sk|rk)_(?:live|test|org)_[A-Za-z0-9]{24,}|pypi-[A-Za-z0-9_-]{85,})\b/g, "«redacted:key»"],
+    [/\bxapp-\d-[A-Za-z0-9-]{20,}\b/g, "«redacted:slack-token»"],
     [/\b[Bb]earer\s+[A-Za-z0-9._~+/-]{20,}=*/g, "Bearer «redacted»"],
     [/\bBasic\s+[A-Za-z0-9+/]{16,}={0,2}/g, "Basic «redacted»"],
-    [/\b([A-Za-z][A-Za-z0-9+.-]*:\/\/[^/@\s:]+):[^/@\s]+@/g, "$1:«redacted»@"],
+    [/:(?<=\b[A-Za-z][A-Za-z0-9+.-]*:)\/\//g, "$1:«redacted»@"],
     [/\b[Tt]oken\s+[A-Za-z0-9._~+/-]{20,}/g, "token «redacted»"],
     [/("(?:private_key|client_secret|password|api[_-]?key|secret|token)"\s*:\s*)"[^"\\]*(?:\\.[^"\\]*)*"/gi, '$1"«redacted»"'],
 ];
+const PEM_FRAGMENT_TOKEN = "«redacted:private-key:partial»";
+const PEM_HEADER_IDENT_MAX = 31;
+const PEM_BODY_RUN_MIN = 8;
+const CH_TAB = 9, CH_LF = 10, CH_CR = 13, CH_SPACE = 32, CH_PLUS = 43, CH_MINUS = 45, CH_SLASH = 47;
+const CH_0 = 48, CH_9 = 57, CH_COLON = 58, CH_EQ = 61, CH_A = 65, CH_Z = 90, CH_BACKSLASH = 92, CH_UNDERSCORE = 95;
+const CH_a = 97, CH_n = 110, CH_r = 114, CH_t = 116, CH_z = 122;
+const CH_QUOTE = 34;
+const CH_LAQUO = 171;
+const isSepCode = (c) => c === CH_SPACE || c === CH_TAB || c === CH_CR || c === CH_LF;
+const isBase64Code = (c) => (c >= CH_A && c <= CH_Z) || (c >= CH_a && c <= CH_z) || (c >= CH_0 && c <= CH_9) || c === CH_PLUS || c === CH_SLASH || c === CH_EQ;
+const isIdentStartCode = (c) => (c >= CH_A && c <= CH_Z) || (c >= CH_a && c <= CH_z);
+const isIdentCode = (c) => isIdentStartCode(c) || (c >= CH_0 && c <= CH_9) || c === CH_UNDERSCORE || c === CH_MINUS;
+function pemEscapeLetterAt(s, i, limit) {
+    let j = i;
+    while (j < limit && s.charCodeAt(j) === CH_BACKSLASH)
+        j += 1;
+    if (j === i || j >= limit)
+        return -1;
+    const n = s.charCodeAt(j);
+    return n === CH_r || n === CH_n || n === CH_t ? j : -1;
+}
+function skipPemSeps(s, i, limit) {
+    for (;;) {
+        if (i >= limit)
+            return i;
+        const c = s.charCodeAt(i);
+        if (isSepCode(c)) {
+            i += 1;
+            continue;
+        }
+        if (c === CH_BACKSLASH) {
+            const j = pemEscapeLetterAt(s, i, limit);
+            if (j >= 0) {
+                i = j + 1;
+                continue;
+            }
+        }
+        return i;
+    }
+}
+function pemLineBreakLen(s, i, limit) {
+    if (i >= limit)
+        return 0;
+    const c = s.charCodeAt(i);
+    if (c === CH_CR || c === CH_LF)
+        return 1;
+    if (c === CH_BACKSLASH) {
+        const j = pemEscapeLetterAt(s, i, limit);
+        if (j >= 0 && s.charCodeAt(j) !== CH_t)
+            return j + 1 - i;
+    }
+    return 0;
+}
+function pemInlineSepLen(s, i, limit) {
+    if (i >= limit)
+        return 0;
+    const c = s.charCodeAt(i);
+    if (c === CH_SPACE || c === CH_TAB)
+        return 1;
+    if (c === CH_BACKSLASH) {
+        const j = pemEscapeLetterAt(s, i, limit);
+        if (j >= 0 && s.charCodeAt(j) === CH_t)
+            return j + 1 - i;
+    }
+    return 0;
+}
+function probePemHeaderToken(s, p, limit) {
+    if (p >= limit || !isIdentStartCode(s.charCodeAt(p)))
+        return -1;
+    p += 1;
+    let identLen = 1;
+    while (identLen < PEM_HEADER_IDENT_MAX && p < limit && isIdentCode(s.charCodeAt(p))) {
+        p += 1;
+        identLen += 1;
+    }
+    for (;;) {
+        if (p >= limit)
+            return -1;
+        const c = s.charCodeAt(p);
+        if (c === CH_SPACE || c === CH_TAB) {
+            p += 1;
+            continue;
+        }
+        return c === CH_COLON ? p + 1 : -1;
+    }
+}
+const PEM_HDR = { search: 0, contentEnd: 0, next: 0, hitLimit: false, jsonEnd: false };
+function setPemHdr(search, contentEnd, next, hitLimit, jsonEnd = false) {
+    PEM_HDR.search = search;
+    PEM_HDR.contentEnd = contentEnd;
+    PEM_HDR.next = next;
+    PEM_HDR.hitLimit = hitLimit;
+    PEM_HDR.jsonEnd = jsonEnd;
+    return true;
+}
+function parsePemHeaderLine(s, i, limit, allowBare, json) {
+    const start = skipPemSeps(s, i, limit);
+    if (start >= limit)
+        return false;
+    const afterToken = probePemHeaderToken(s, start, limit);
+    if (afterToken < 0 && !allowBare)
+        return false;
+    let p = afterToken < 0 ? start : afterToken;
+    if (afterToken >= 0 && probePemHeaderToken(s, p, limit) >= 0)
+        return setPemHdr(start, p, p, false);
+    for (;;) {
+        if (p >= limit)
+            return setPemHdr(start, p, p, true);
+        const c = s.charCodeAt(p);
+        if (c !== CH_CR && c !== CH_LF && c !== CH_SPACE && c !== CH_TAB && c !== CH_BACKSLASH && c !== CH_QUOTE) {
+            p += 1;
+            continue;
+        }
+        if (c === CH_QUOTE) {
+            if (json)
+                return setPemHdr(start, p, p, false, true);
+            p += 1;
+            continue;
+        }
+        if (c === CH_CR || c === CH_LF)
+            return setPemHdr(start, p, p + 1, false);
+        if (c === CH_BACKSLASH) {
+            let j = p;
+            while (j < limit && s.charCodeAt(j) === CH_BACKSLASH)
+                j += 1;
+            const n = j < limit ? s.charCodeAt(j) : -1;
+            if (n !== CH_r && n !== CH_n && n !== CH_t) {
+                p = json && (j - p) % 2 === 0 && n === CH_QUOTE ? j : Math.min(limit, j + 1);
+                continue;
+            }
+        }
+        let q = p;
+        for (;;) {
+            const b = pemLineBreakLen(s, q, limit);
+            if (b === 1)
+                return setPemHdr(start, p, q + 1, false);
+            if (b >= 2) {
+                q += b;
+                continue;
+            }
+            const u = pemInlineSepLen(s, q, limit);
+            if (u === 0)
+                break;
+            q += u;
+        }
+        if (q >= limit)
+            return setPemHdr(start, p, q, true);
+        if (probePemHeaderToken(s, q, limit) >= 0)
+            return setPemHdr(start, p, q, false);
+        p = q;
+    }
+}
+function parsePemBody(s, i, limit) {
+    let end = -1;
+    let p = i;
+    for (;;) {
+        const q = skipPemSeps(s, p, limit);
+        let r = q;
+        while (r < limit && isBase64Code(s.charCodeAt(r)))
+            r += 1;
+        if (r - q < PEM_BODY_RUN_MIN)
+            break;
+        end = r;
+        p = r;
+    }
+    return end;
+}
+function rightmostPemRunEnd(s, from, to) {
+    let best = -1;
+    let runStart = -1;
+    for (let p = from; p <= to; p++) {
+        if (p < to && s.charCodeAt(p) === CH_LAQUO) {
+            const tokenEnd = redactionTokenEndAt(s, p, to);
+            if (tokenEnd > 0) {
+                if (runStart >= 0 && p - runStart >= PEM_BODY_RUN_MIN)
+                    best = p;
+                runStart = -1;
+                p = tokenEnd - 1;
+                continue;
+            }
+        }
+        if (p < to && isBase64Code(s.charCodeAt(p))) {
+            if (runStart < 0)
+                runStart = p;
+        }
+        else if (runStart >= 0) {
+            if (p - runStart >= PEM_BODY_RUN_MIN)
+                best = p;
+            runStart = -1;
+        }
+    }
+    return best;
+}
+const PEM_KEY_WORD = "PRIVATE KEY";
+const PEM_BLOCK_WORD = " BLOCK";
+function isPemFenceLabel(s, from, to) {
+    let end = to;
+    if (end - from > PEM_BLOCK_WORD.length && s.startsWith(PEM_BLOCK_WORD, end - PEM_BLOCK_WORD.length))
+        end -= PEM_BLOCK_WORD.length;
+    if (end - from <= PEM_KEY_WORD.length)
+        return false;
+    if (!s.startsWith(PEM_KEY_WORD, end - PEM_KEY_WORD.length))
+        return false;
+    for (let i = from; i < to; i++)
+        if (s.charCodeAt(i) === 45)
+            return false;
+    return true;
+}
+const PEM_FENCE_OPEN = "-----BEGIN";
+const PEM_FENCE_CLOSE = "-----";
+function findPemFence(text, from) {
+    for (;;) {
+        const fence = text.indexOf(PEM_FENCE_OPEN, from);
+        if (fence < 0)
+            return undefined;
+        const labelFrom = fence + PEM_FENCE_OPEN.length;
+        const close = text.indexOf(PEM_FENCE_CLOSE, labelFrom);
+        if (close < 0)
+            return undefined;
+        from = labelFrom;
+        if (!isPemFenceLabel(text, labelFrom, close))
+            continue;
+        return { fence, after: close + PEM_FENCE_CLOSE.length };
+    }
+}
+function redactPemFragments(text, json) {
+    let count = 0;
+    let out;
+    let copied = 0;
+    let cur = findPemFence(text, 0);
+    let inherited = false;
+    while (cur !== undefined) {
+        const next = findPemFence(text, cur.after);
+        const limit = next === undefined ? text.length : next.fence;
+        let pos = cur.after;
+        let allowBare = inherited;
+        let hitLimit = false;
+        let rightmost = -1;
+        while (parsePemHeaderLine(text, pos, limit, allowBare, json)) {
+            const e = rightmostPemRunEnd(text, PEM_HDR.search, PEM_HDR.contentEnd);
+            if (e > rightmost)
+                rightmost = e;
+            pos = PEM_HDR.next;
+            allowBare = false;
+            if (PEM_HDR.hitLimit) {
+                hitLimit = true;
+                break;
+            }
+            if (PEM_HDR.jsonEnd)
+                break;
+        }
+        inherited = hitLimit;
+        let bodyEnd = parsePemBody(text, pos, limit);
+        if (bodyEnd < 0)
+            bodyEnd = rightmost;
+        if (bodyEnd >= 0) {
+            out ??= [];
+            out.push(text.slice(copied, cur.fence), PEM_FRAGMENT_TOKEN);
+            copied = bodyEnd;
+            count += 1;
+        }
+        cur = next;
+    }
+    if (out === undefined)
+        return { out: text, count: 0 };
+    out.push(text.slice(copied));
+    return { out: out.join(""), count };
+}
+const HEADLESS_PPK_TOKEN = "«redacted:private-key:partial»";
+function redactHeadlessPpkBodies(text) {
+    const KEY = "Private-Lines: ";
+    const n = text.length;
+    const isB64 = (c) => (c >= 48 && c <= 57) || (c >= 65 && c <= 90) || (c >= 97 && c <= 122) || c === 43 || c === 47 || c === 61;
+    const skipHs = (i) => { while (i < n && (text.charCodeAt(i) === 32 || text.charCodeAt(i) === 9))
+        i += 1; return i; };
+    const skipNewlines = (i) => {
+        let q = skipHs(i);
+        let seen = false;
+        for (;;) {
+            let any = false;
+            if (text.charCodeAt(q) === 13) {
+                q += 1;
+                any = true;
+            }
+            else {
+                const e = escapedNewlineLen(q);
+                if (e > 0 && text.charCodeAt(q + e - 1) === 114) {
+                    q += e;
+                    any = true;
+                }
+            }
+            if (text.charCodeAt(q) === 10) {
+                q += 1;
+                any = true;
+            }
+            else {
+                const e = escapedNewlineLen(q);
+                if (e > 0 && text.charCodeAt(q + e - 1) === 110) {
+                    q += e;
+                    any = true;
+                }
+            }
+            if (!any)
+                break;
+            seen = true;
+            q = skipHs(q);
+        }
+        return seen ? q : -1;
+    };
+    const escapedNewlineLen = (i) => {
+        let k = i;
+        while (k < n && text.charCodeAt(k) === 92)
+            k += 1;
+        if (k === i)
+            return 0;
+        const c = text.charCodeAt(k);
+        return c === 110 || c === 114 ? k - i + 1 : 0;
+    };
+    const atLineEnd = (i) => {
+        const b = skipHs(i);
+        if (b >= n)
+            return true;
+        const c = text.charCodeAt(b);
+        return c === 10 || c === 13 || c === 34 || escapedNewlineLen(b) > 0;
+    };
+    let out = "";
+    let last = 0;
+    let count = 0;
+    let search = 0;
+    for (;;) {
+        const at = text.indexOf(KEY, search);
+        if (at === -1)
+            break;
+        let p = at + KEY.length;
+        const d0 = p;
+        while (p < n && text.charCodeAt(p) >= 48 && text.charCodeAt(p) <= 57)
+            p += 1;
+        if (p === d0) {
+            search = at + KEY.length;
+            continue;
+        }
+        let end = p;
+        let lines = 0;
+        for (;;) {
+            const q0 = skipNewlines(end);
+            if (q0 === -1)
+                break;
+            let q = q0;
+            const mk = text.charCodeAt(q);
+            if (mk === 43 || mk === 45)
+                q = skipHs(q + 1);
+            let r = q;
+            while (r < n && isB64(text.charCodeAt(r)))
+                r += 1;
+            if (r - q < 4) {
+                r = q0;
+                while (r < n && isB64(text.charCodeAt(r)))
+                    r += 1;
+                if (r - q0 < 4)
+                    break;
+            }
+            if (!atLineEnd(r))
+                break;
+            lines += 1;
+            end = r;
+        }
+        if (lines === 0) {
+            search = p;
+            continue;
+        }
+        out += text.slice(last, at) + HEADLESS_PPK_TOKEN;
+        last = end;
+        search = end;
+        count += 1;
+    }
+    return count === 0 ? { out: text, count: 0 } : { out: out + text.slice(last), count };
+}
+const FRAGMENT_SECRET_PATTERNS = [
+    [/\bsk-(?=[A-Za-z0-9_-]{6,})(?=[A-Za-z0-9_-]{0,64}[0-9A-Z][A-Za-z0-9_-]{0,64}[0-9A-Z])[A-Za-z0-9_-]{6,}/g, "«redacted:key:partial»"],
+    [/\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{8,}/g, "«redacted:gh-token:partial»"],
+    [/\bgithub_pat_[A-Za-z0-9_]{8,}/g, "«redacted:gh-token:partial»"],
+    [/\bxox[baprs]-[A-Za-z0-9-]{4,}/g, "«redacted:slack-token:partial»"],
+    [/\bAKIA[0-9A-Z]{6,}/g, "«redacted:aws-key:partial»"],
+    [/\bASIA[0-9A-Z]{8,}/g, "«redacted:aws-key:partial»"],
+    [/\b(?:gl(?:pat|dt|rt|rtr|cbt|ptt|oas|ft|imt|agent|wt|soat|ffct)-|(?:sk|rk)_(?:live|test|org)_|pypi-)(?=[A-Za-z0-9_-]{8,})(?=[A-Za-z0-9_-]{0,90}[0-9A-Z][A-Za-z0-9_-]{0,90}[0-9A-Z])[A-Za-z0-9_-]{8,}/g, "«redacted:key:partial»"],
+    [/\bxapp-\d-[A-Za-z0-9-]{4,}/g, "«redacted:slack-token:partial»"],
+];
+const REDACTION_TOKENS = new Set([...FULL_SECRET_PATTERNS.map(([, r]) => r), PEM_FRAGMENT_TOKEN, ...FRAGMENT_SECRET_PATTERNS.map(([, r]) => r)]
+    .flatMap((r) => r.match(/«[^»]*»/g) ?? []));
+const REDACTION_TOKEN_MAX = Math.max(...[...REDACTION_TOKENS].map((t) => t.length));
+{
+    const closed = new RegExp(`^${REDACTION_TOKEN_RE_SRC}$`);
+    for (const t of REDACTION_TOKENS)
+        if (!closed.test(t))
+            throw new Error(`redact: token ${t} is outside the closed form ${REDACTION_TOKEN_RE_SRC}`);
+}
+function redactionTokenEndAt(s, p, limit) {
+    const max = Math.min(limit, p + REDACTION_TOKEN_MAX);
+    for (let e = p + 2; e <= max; e++) {
+        if (s.charCodeAt(e - 1) === 187)
+            return REDACTION_TOKENS.has(s.slice(p, e)) ? e : 0;
+    }
+    return 0;
+}
+const labelOfToken = (token) => token.replace(/[«»]/g, "").replace(/^redacted:/, "");
+const regexRule = ([re, repl], arm) => {
+    const groupCount = (new RegExp(`${re.source}|`).exec("")?.length ?? 1) - 1;
+    const refs = [...repl.matchAll(/\$(.)/g)].map(([, d]) => d ?? "");
+    for (const d of refs) {
+        if (!/^[1-9]$/.test(d) || Number(d) > groupCount)
+            throw new Error(`redact: replacement ${JSON.stringify(repl)} uses unsupported ref $${d}`);
+    }
+    const expand = refs.length === 0 ? undefined : (args) => repl.replace(/\$([1-9])/g, (_, d) => args[Number(d)] ?? "");
+    return {
+        label: labelOfToken(repl),
+        arm,
+        run: (text, wantCount, json) => {
+            const rx = re;
+            if (!wantCount)
+                return { out: text.replace(rx, repl), count: 0 };
+            let n = 0;
+            const out = text.replace(rx, (...args) => {
+                n += 1;
+                return expand === undefined ? repl : expand(args);
+            });
+            return { out, count: n };
+        },
+    };
+};
+const URL_USERINFO_PATTERN = (() => {
+    const row = FULL_SECRET_PATTERNS.find(([, repl]) => repl.endsWith("»@"));
+    if (row === undefined)
+        throw new Error("redact: URL-userinfo rule missing from FULL_SECRET_PATTERNS");
+    return row;
+})();
+const isRegexSpace = (c) => c === 32 || (c >= 9 && c <= 13) || c === 0xa0 || c === 0x1680 || (c >= 0x2000 && c <= 0x200a) || c === 0x2028 || c === 0x2029 || c === 0x202f || c === 0x205f || c === 0x3000 || c === 0xfeff;
+const isLineTerminator = (c) => c === 10 || c === 13 || c === 0x2028 || c === 0x2029;
+function scanUserinfoRun(text, i, kind, json) {
+    const n = text.length;
+    while (i < n) {
+        const c = text.charCodeAt(i);
+        if (json && c === 92) {
+            if (i + 1 < n && !isLineTerminator(text.charCodeAt(i + 1))) {
+                i += 2;
+                continue;
+            }
+            return i;
+        }
+        if (c === 64 || isRegexSpace(c) || (json && c === 34))
+            return i;
+        switch (kind) {
+            case "plain-user":
+                if (c === 47 || c === 58)
+                    return i;
+                break;
+            case "plain-pass":
+                if (c === 47)
+                    return i;
+                break;
+            case "token-pass":
+                if (c === 58 && text.charCodeAt(i + 1) === 47 && text.charCodeAt(i + 2) === 47)
+                    return i;
+                break;
+        }
+        i += 1;
+    }
+    return i;
+}
+const REDACTION_TOKEN_Y = new RegExp(REDACTION_TOKEN_RE_SRC, "y");
+function matchUserinfoAt(text, p, json) {
+    REDACTION_TOKEN_Y.lastIndex = p;
+    const tokEnd = REDACTION_TOKEN_Y.test(text) ? REDACTION_TOKEN_Y.lastIndex : -1;
+    const afterTok = tokEnd >= 0 ? text.charCodeAt(tokEnd) : -1;
+    if (afterTok === 64)
+        return null;
+    let userEnd;
+    let kind;
+    if (afterTok === 58) {
+        userEnd = tokEnd;
+        kind = "token-pass";
+    }
+    else {
+        userEnd = scanUserinfoRun(text, p, "plain-user", json);
+        if (userEnd === p || text.charCodeAt(userEnd) !== 58)
+            return null;
+        kind = "plain-pass";
+    }
+    const passEnd = scanUserinfoRun(text, userEnd + 1, kind, json);
+    if (passEnd === userEnd + 1 || text.charCodeAt(passEnd) !== 64)
+        return null;
+    return [userEnd, passEnd + 1];
+}
+function redactUrlUserinfo(text, json) {
+    const [head, repl] = URL_USERINFO_PATTERN;
+    head.lastIndex = 0;
+    let out = "";
+    let last = 0;
+    let count = 0;
+    for (let m = head.exec(text); m !== null; m = head.exec(text)) {
+        const colon = m.index;
+        const hit = matchUserinfoAt(text, colon + 3, json);
+        if (hit === null) {
+            head.lastIndex = colon + 1;
+            continue;
+        }
+        const user = text.slice(colon, hit[0]);
+        out += text.slice(last, colon) + repl.replace(/\$1/g, () => user);
+        last = hit[1];
+        head.lastIndex = hit[1];
+        count += 1;
+    }
+    return count === 0 ? { out: text, count: 0 } : { out: out + text.slice(last), count };
+}
+const PPK_CONTAINER_TOKEN = "«redacted:private-key»";
+let ppkScanBytes = 0;
+export function ppkScanBytesForTest() { return ppkScanBytes; }
+export function resetPpkScanBytesForTest() { ppkScanBytes = 0; }
+function redactPpkContainers(text, record) {
+    const HEAD = "PuTTY-User-Key-File-";
+    const MAC = "Private-MAC: ";
+    const HASH = "Private-Hash: ";
+    const LINES = "Private-Lines: ";
+    const cache = new Map();
+    const find = (needle, from) => {
+        const c = cache.get(needle);
+        if (c !== undefined && c >= from)
+            return c;
+        const p = text.indexOf(needle, from);
+        ppkScanBytes += (p === -1 ? text.length : p) - from;
+        const v = p === -1 ? Number.POSITIVE_INFINITY : p;
+        cache.set(needle, v);
+        return v;
+    };
+    const isVersionedHead = (at) => {
+        let p = at + HEAD.length;
+        const start = p;
+        while (p < text.length) {
+            const c = text.charCodeAt(p);
+            if (c >= 48 && c <= 57)
+                p += 1;
+            else
+                break;
+        }
+        return p > start && text.startsWith(": ", p);
+    };
+    const nextVersionedHead = (from) => {
+        let p = find(HEAD, from);
+        while (p !== Number.POSITIVE_INFINITY && !isVersionedHead(p))
+            p = find(HEAD, p + HEAD.length);
+        return p;
+    };
+    const hexRunEnd = (from) => {
+        let e = from;
+        while (e < text.length) {
+            const c = text.charCodeAt(e);
+            if ((c >= 48 && c <= 57) || (c >= 97 && c <= 102) || (c >= 65 && c <= 70))
+                e += 1;
+            else
+                break;
+        }
+        return e;
+    };
+    let out = "";
+    let last = 0;
+    let count = 0;
+    let at = nextVersionedHead(0);
+    while (at !== Number.POSITIVE_INFINITY) {
+        let pos = at + HEAD.length + 1;
+        let end = text.length;
+        let ateToEnd = true;
+        for (;;) {
+            const mac = find(MAC, pos);
+            const hash = find(HASH, pos);
+            const term = Math.min(mac, hash);
+            if (term === Number.POSITIVE_INFINITY)
+                break;
+            const hexStart = term + (term === mac ? MAC.length : HASH.length);
+            const hexEnd = hexRunEnd(hexStart);
+            if (hexEnd - hexStart < 32) {
+                pos = hexStart;
+                continue;
+            }
+            if (find(LINES, at) > term) {
+                pos = hexStart;
+                continue;
+            }
+            const limit = nextVersionedHead(hexEnd);
+            const straggler = Math.min(find(LINES, hexEnd), find(MAC, hexEnd), find(HASH, hexEnd));
+            let gapBlank = true;
+            if (limit !== Number.POSITIVE_INFINITY) {
+                for (let i = hexEnd; i < limit; i++) {
+                    const c = text.charCodeAt(i);
+                    if (c !== 32 && c !== 10 && c !== 13 && c !== 9) {
+                        gapBlank = false;
+                        break;
+                    }
+                }
+            }
+            ateToEnd = straggler < limit || !gapBlank;
+            end = ateToEnd ? text.length : hexEnd;
+            break;
+        }
+        if (ateToEnd && record)
+            recordFailOpen("server.redact.ppk-eat-to-end", `from=${at} len=${text.length}`);
+        out += text.slice(last, at) + PPK_CONTAINER_TOKEN;
+        last = end;
+        count += 1;
+        at = end >= text.length ? Number.POSITIVE_INFINITY : nextVersionedHead(end);
+    }
+    return count === 0 ? { out: text, count: 0 } : { out: out + text.slice(last), count };
+}
+const urlUserinfoRule = { label: labelOfToken(URL_USERINFO_PATTERN[1]), arm: "full", run: (text, _wantCount, json) => redactUrlUserinfo(text, json) };
+const SECRET_RULES = [
+    ...FULL_SECRET_PATTERNS.map((p) => (p === URL_USERINFO_PATTERN ? urlUserinfoRule : regexRule(p, "full"))),
+    { label: labelOfToken(PPK_CONTAINER_TOKEN), arm: "full", run: (text, _wantCount, _json, observe) => redactPpkContainers(text, observe) },
+    { label: labelOfToken(PEM_FRAGMENT_TOKEN), arm: "fragment", run: (text, _wantCount, json) => redactPemFragments(text, json) },
+    { label: labelOfToken(HEADLESS_PPK_TOKEN), arm: "fragment", run: (text) => redactHeadlessPpkBodies(text) },
+    ...FRAGMENT_SECRET_PATTERNS.map((p) => regexRule(p, "fragment")),
+    { ...urlUserinfoRule, run: (text, _wantCount, json) => ({ out: redactUrlUserinfo(text, json).out, count: 0 }) },
+];
 let onRedaction;
 export function setRedactionObserver(fn) {
     onRedaction = fn;
 }
-const PATTERN_LABELS = SECRET_PATTERNS.map(([, repl]) => repl.replace(/[«»]/g, "").replace(/^redacted:/, ""));
-export function redactSecrets(text, opts) {
-    const observe = opts?.observe ?? true;
+function applyRules(text, wantCount, json, observe) {
     let out = text;
-    for (let i = 0; i < SECRET_PATTERNS.length; i++) {
-        const [re, repl] = SECRET_PATTERNS[i];
-        if (!onRedaction || !observe) {
-            out = out.replace(re, repl);
-            continue;
+    const hits = [];
+    for (const rule of SECRET_RULES) {
+        const r = rule.run(out, wantCount, json, observe);
+        out = r.out;
+        if (wantCount && r.count > 0)
+            hits.push({ label: rule.label, count: r.count, arm: rule.arm });
+    }
+    return { out, hits };
+}
+function reportHits(hits) {
+    if (onRedaction === undefined)
+        return;
+    for (const h of hits) {
+        try {
+            onRedaction(h.label, h.count, { arm: h.arm });
         }
-        const n = out.match(re)?.length ?? 0;
-        out = out.replace(re, repl);
-        if (n > 0) {
-            try {
-                onRedaction(PATTERN_LABELS[i], n);
-            }
-            catch {
-            }
+        catch {
         }
     }
-    return out;
+}
+export function redactSecrets(text, opts) {
+    const wantCount = onRedaction !== undefined && (opts?.observe ?? true);
+    const json = opts?.json === true;
+    let r;
+    r = applyRules(text, wantCount, json, opts?.observe ?? true);
+    reportHits(r.hits);
+    return r.out;
 }
 const REDACT_MAX_DEPTH = 64;
 export function redactDeep(value) {
@@ -91,7 +726,7 @@ export function redactedPreview(value, cap = 2000) {
     }
     if (s.length === 0)
         return null;
-    s = redactSecrets(s);
+    s = redactSecrets(s, { json: true });
     return s.length > cap ? `${s.slice(0, cap)}…[truncated]` : s;
 }
 //# sourceMappingURL=redact.js.map