@shivaedev/errors 0.1.3 → 0.2.0

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 0.2.0 - 2026-10-31
+
+### Added
+
+- `@shivaedev/errors/taxonomy.ts` exports class guards (`isConflict`, `isNotFound` and one `is<Class>` guard for every other taxonomy error). They narrow actual class instances and reject objects with matching tags.
+
+### Fixed
+
+- Logs, error reports, RPC failure data and exported spans share errors' database-key and URL policy. Database users and connection strings are masked under their diagnostic keys; URL user information, query values and fragments are masked in structured values and text.
+
+### Breaking
+
+- Import `schemaSensitiveKeys` from `@shivaedev/errors/schemaSensitiveKeys.ts` instead of server, and `redactRecord` from `@shivaedev/errors/redact.ts` instead of server's `redactingDiagnostics.ts`.
+- Import schema sensitivity AST helpers from `@shivaedev/errors/schemaSensitiveAst.ts` instead of `@shivaedev/server/schemaSensitiveAst.ts`.
+- Replace server's `redactOtlpUrl` with `redactUrl` from `@shivaedev/errors/sensitive.ts`. Replace server's `redactOtlpText(value, key, sensitive)` with `redactText(value, sensitive, undefined, key)` from `@shivaedev/errors/sensitive.ts`.
+- Errors' redaction helpers now apply the same URL and database-key masking previously applied only to exported traces. Consumers should expect `<redacted>` for URL user information, query values and fragments, and for `db.user`, `db.user.name` and `db.connection_string` values.
+
 ## 0.1.3 - 2026-10-31
 
 ### Fixed

package/README.md

@@ -39,6 +39,8 @@ export const Rename = Rpc.make("Rename", {
 
 A handler fails with `new Conflict({ field: "name", message: "Name is taken" })`, and native RPC JSON decodes the rejection back to the error instance with its field. `rejectedField(error)` reads either that instance or its tagged JSON. Any value with a string `_tag`, `field` and `message` qualifies, including an application's own tagged error; an untagged object, a missing field or a non-string field yields `Option.none()`.
 
+Each class has an `is<Class>` guard in `taxonomy.ts`, such as `isConflict(value)`. Guards narrow actual instances, including errors decoded by the class schema; an object with the same `_tag` and fields does not qualify. Use them with `Effect.catchIf(isConflict, handler)` when matching a taxonomy failure by class.
+
 ### Mapping unexpected failures at the handler edge
 
 Use `rpcBoundary` only at the RPC handler edge, never inside services. Services keep their typed failures and defects so callers can handle them. At that edge, `rpcBoundary(schema, options)` keeps declared rejections and maps other failures and defects into one declared fallback. It leaves successful values and interruption intact:
@@ -70,13 +72,15 @@ export const Handlers = Api.toLayer({
 
 ### Masking secrets in failures
 
-`sensitive.ts` decides which names are secret. `isSensitiveKey(key)` matches credential-shaped names whatever their casing or separator, such as `sessionId`, `bearerToken`, `access_key_id` or `cardNumber`. A `SensitiveKey` is any `(key: string) => boolean`, so an application can widen the policy with its own names. `redactText(text, sensitive, maxLength?)` masks credential-shaped text and `key=value` assignments inside a string, and cuts it at 2,048 characters by default; passing `Infinity` keeps complete public text. Masked values become `REDACTED`, the string `<redacted>`.
+`sensitive.ts` decides which names are secret. `isSensitiveKey(key)` matches credential-shaped names whatever their casing or separator, such as `sessionId`, `bearerToken`, `access_key_id` or `cardNumber`, and database diagnostic keys `db.user`, `db.user.name` and `db.connection_string`. A `SensitiveKey` is any `(key: string) => boolean`, so an application can widen the policy with its own names. `redactText(text, sensitive, maxLength?, key?)` masks credential-shaped text and `key=value` assignments inside a string, URL user information, query values and fragments, and cuts it at 2,048 characters by default; passing `Infinity` keeps complete public text. The optional `key` supplies context for standalone URL components such as `url.query`. `redactUrl(value, key?)` from `sensitive.ts` applies just the URL rules, including nested JSON strings. Masked values become `REDACTED`, the string `<redacted>`.
 
-`redact.ts` applies that policy to structured values. `redact(value, sensitive?)` masks values under sensitive keys and credential text inside strings, summarises large collections and binary data, and stops cyclic payloads at a depth limit; use it for diagnostics. `redactWire(value, sensitive?)` applies the same masking without summaries or truncation; use it for failure data sent to a client.
+`redact.ts` applies that policy to structured values. `redact(value, sensitive?)` masks values under sensitive keys and credential text inside strings, summarises large collections and binary data, and stops cyclic payloads at a depth limit; use it for diagnostics. `redactRecord(values, sensitive?)` masks every top-level record entry without limiting the number of keys, while applying diagnostic limits within each value. `redactWire(value, sensitive?)` applies the same masking without summaries or truncation; use it for failure data sent to a client.
 
 `redactCause.ts` applies it to Effect causes. `redactCause(cause, sensitive?)` rebuilds a cause with masked defects and keeps its typed failures, interruptions and annotations as they are, so the failure channel keeps its type. `redactDiagnosticCause(cause, sensitive?)` masks failures, defects and annotations for diagnostics, `redactDefect(defect, sensitive?)` masks one defect, and `redactingErrorReporter(reporter, sensitive?)` wraps an Effect error reporter so it only ever receives diagnostic-masked causes.
 
-The policy matches names, not values: it does not scan prose for personal data, so keep secrets out of free text and span names.
+`schemaSensitiveKeys(group, extraKeys?)` from `schemaSensitiveKeys.ts` derives the key predicate from native RPC payload, success, error, defect and middleware error schemas. It includes nested sensitive annotations, Redacted schemas, encoded field names and additional application keys. Its `forRpc(tag)` method selects the schema-derived policy for one RPC; additional application keys apply to every RPC. Its `maskFailure(tag, reason)` method identifies whole error or defect roots that need masking. The host applies this predicate to logs, error reports, RPC failure data and exported traces.
+
+The policy matches names and credential or URL shapes, not arbitrary values: it does not scan prose for personal data, so keep secrets out of free text and span names.
 
 ### Install and limits
 

package/dist/redact.d.ts

@@ -1,4 +1,5 @@
 import { type SensitiveKey } from "#sensitive.ts";
 export declare function redact(value: unknown, sensitive?: SensitiveKey): unknown;
 export declare function redactWire(value: unknown, sensitive?: SensitiveKey): unknown;
+export declare function redactRecord(values: Readonly<Record<string, unknown>>, sensitive?: SensitiveKey): Record<string, unknown>;
 //# sourceMappingURL=redact.d.ts.map

package/dist/redact.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../src/redact.ts"],"names":[],"mappings":"AACA,OAAO,EAA0D,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAyD1G,wBAAgB,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,GAAE,YAA6B,GAAG,OAAO,CAExF;AACD,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,GAAE,YAA6B,GAAG,OAAO,CAE5F"}
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../src/redact.ts"],"names":[],"mappings":"AACA,OAAO,EAA0D,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAyD1G,wBAAgB,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,GAAE,YAA6B,GAAG,OAAO,CAExF;AACD,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,GAAE,YAA6B,GAAG,OAAO,CAE5F;AACD,wBAAgB,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,SAAS,GAAE,YAA6B,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzI"}

package/dist/redact.js

@@ -24,24 +24,24 @@ function entriesOf(value, sensitive, bounded) {
     const extra = entries.filter(([key]) => !["name", "message", "stack", "cause"].includes(key));
     return value.cause === undefined ? [...shape, ...extra] : [...shape, ...extra, ["cause", value.cause]];
 }
-function collection(value, sensitive, depth, bounded) {
+function collection(value, sensitive, depth, bounded, parentKey) {
     if (Array.isArray(value)) {
-        const items = value.slice(0, bounded ? MAX_ENTRIES : value.length).map((item) => walk(item, sensitive, depth + 1, bounded));
+        const items = value.slice(0, bounded ? MAX_ENTRIES : value.length).map((item) => walk(item, sensitive, depth + 1, bounded, parentKey));
         return bounded && value.length > MAX_ENTRIES ? [...items, `<${value.length - MAX_ENTRIES} more items>`] : items;
     }
     const entries = entriesOf(value, sensitive, bounded);
     const kept = entries.slice(0, bounded ? MAX_ENTRIES : entries.length).map(([key, nested]) => {
         const stackHeader = key === "stack" && typeof nested === "string" && (sensitive("name") || sensitive("message"));
-        return [key, sensitive(key) || stackHeader ? REDACTED : walk(nested, sensitive, depth + 1, bounded)];
+        return [key, sensitive(key) || stackHeader ? REDACTED : walk(nested, sensitive, depth + 1, bounded, key)];
     });
     return Object.fromEntries(bounded && entries.length > MAX_ENTRIES ? [...kept, ["<truncated>", `${entries.length - MAX_ENTRIES} more keys`]] : kept);
 }
-function walk(value, sensitive, depth, bounded) {
+function walk(value, sensitive, depth, bounded, key = "") {
     if (Redacted.isRedacted(value)) {
         return REDACTED;
     }
     if (Predicate.isString(value)) {
-        return bounded ? redactText(value, sensitive) : redactText(value, sensitive, Number.POSITIVE_INFINITY);
+        return redactText(value, sensitive, bounded ? undefined : Number.POSITIVE_INFINITY, key);
     }
     if (!Predicate.isObjectOrArray(value)) {
         return value;
@@ -53,7 +53,7 @@ function walk(value, sensitive, depth, bounded) {
     if (bounded && depth >= MAX_DEPTH) {
         return "<truncated>";
     }
-    return collection(value, sensitive, depth, bounded);
+    return collection(value, sensitive, depth, bounded, key);
 }
 export function redact(value, sensitive = isSensitiveKey) {
     return walk(value, sensitive, 0, true);
@@ -61,4 +61,7 @@ export function redact(value, sensitive = isSensitiveKey) {
 export function redactWire(value, sensitive = isSensitiveKey) {
     return walk(value, sensitive, 0, false);
 }
+export function redactRecord(values, sensitive = isSensitiveKey) {
+    return Object.fromEntries(Object.entries(values).map(([key, value]) => [key, sensitive(key) ? REDACTED : walk(value, sensitive, 0, true, key)]));
+}
 //# sourceMappingURL=redact.js.map

package/dist/redact.js.map

@@ -1 +1 @@
-{"version":3,"file":"redact.js","sourceRoot":"","sources":["../src/redact.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,gBAAgB,EAAE,UAAU,EAAqB,MAAM,eAAe,CAAC;AAE1G,MAAM,SAAS,GAAG,CAAC,CAAC;AACpB,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,SAAS,MAAM,CAAC,KAAa;IAC5B,IAAI,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,IAAI,KAAK,CAAC,WAAW,CAAC,IAAI,IAAI,KAAK,CAAC,UAAU,SAAS,CAAC;IAChE,CAAC;IACD,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;QAClC,OAAO,gBAAgB,KAAK,CAAC,UAAU,SAAS,CAAC;IAClD,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AACD,SAAS,SAAS,CAAC,KAAa,EAAE,SAAuB,EAAE,OAAgB;IAC1E,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,OAAO,CAAC;IAChB,CAAC;IACD,MAAM,KAAK,GAAwB;QAClC,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC;QACpB,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC;QAC1B,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;KACrE,CAAC;IACF,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9F,OAAO,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,EAAE,GAAG,KAAK,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AACxG,CAAC;AACD,SAAS,UAAU,CAAC,KAAa,EAAE,SAAuB,EAAE,KAAa,EAAE,OAAgB;IAC1F,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QAC5H,OAAO,OAAO,IAAI,KAAK,CAAC,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,EAAE,IAAI,KAAK,CAAC,MAAM,GAAG,WAAW,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACjH,CAAC;IACD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAqB,EAAE;QAC9G,MAAM,WAAW,GAAG,GAAG,KAAK,OAAO,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;QACjH,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IACtG,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,aAAa,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,WAAW,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACrJ,CAAC;AACD,SAAS,IAAI,CAAC,KAAc,EAAE,SAAuB,EAAE,KAAa,EAAE,OAAgB;IACrF,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,QAAQ,CAAC;IACjB,CAAC;IACD,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;IAClC,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,IAAI,SAAS,EAAE,CAAC;QACnC,OAAO,aAAa,CAAC;IACtB,CAAC;IACD,OAAO,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;AACrD,CAAC;AACD,MAAM,UAAU,MAAM,CAAC,KAAc,EAAE,SAAS,GAAiB,cAAc;IAC9E,OAAO,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;AACxC,CAAC;AACD,MAAM,UAAU,UAAU,CAAC,KAAc,EAAE,SAAS,GAAiB,cAAc;IAClF,OAAO,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;AACzC,CAAC"}
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../src/redact.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,gBAAgB,EAAE,UAAU,EAAqB,MAAM,eAAe,CAAC;AAE1G,MAAM,SAAS,GAAG,CAAC,CAAC;AACpB,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,SAAS,MAAM,CAAC,KAAa;IAC5B,IAAI,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,IAAI,KAAK,CAAC,WAAW,CAAC,IAAI,IAAI,KAAK,CAAC,UAAU,SAAS,CAAC;IAChE,CAAC;IACD,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;QAClC,OAAO,gBAAgB,KAAK,CAAC,UAAU,SAAS,CAAC;IAClD,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AACD,SAAS,SAAS,CAAC,KAAa,EAAE,SAAuB,EAAE,OAAgB;IAC1E,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,OAAO,CAAC;IAChB,CAAC;IACD,MAAM,KAAK,GAAwB;QAClC,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC;QACpB,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC;QAC1B,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;KACrE,CAAC;IACF,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9F,OAAO,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,EAAE,GAAG,KAAK,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AACxG,CAAC;AACD,SAAS,UAAU,CAAC,KAAa,EAAE,SAAuB,EAAE,KAAa,EAAE,OAAgB,EAAE,SAAiB;IAC7G,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,GAAG,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;QACvI,OAAO,OAAO,IAAI,KAAK,CAAC,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,EAAE,IAAI,KAAK,CAAC,MAAM,GAAG,WAAW,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACjH,CAAC;IACD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAqB,EAAE;QAC9G,MAAM,WAAW,GAAG,GAAG,KAAK,OAAO,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;QACjH,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;IAC3G,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,aAAa,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,WAAW,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACrJ,CAAC;AACD,SAAS,IAAI,CAAC,KAAc,EAAE,SAAuB,EAAE,KAAa,EAAE,OAAgB,EAAE,GAAG,GAAG,EAAE;IAC/F,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,QAAQ,CAAC;IACjB,CAAC;IACD,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;IAClC,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,IAAI,SAAS,EAAE,CAAC;QACnC,OAAO,aAAa,CAAC;IACtB,CAAC;IACD,OAAO,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;AAC1D,CAAC;AACD,MAAM,UAAU,MAAM,CAAC,KAAc,EAAE,SAAS,GAAiB,cAAc;IAC9E,OAAO,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;AACxC,CAAC;AACD,MAAM,UAAU,UAAU,CAAC,KAAc,EAAE,SAAS,GAAiB,cAAc;IAClF,OAAO,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;AACzC,CAAC;AACD,MAAM,UAAU,YAAY,CAAC,MAAyC,EAAE,SAAS,GAAiB,cAAc;IAC/G,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAClJ,CAAC"}

package/dist/schemaSensitiveAst.d.ts

@@ -0,0 +1,7 @@
+import { type SchemaAST } from "effect";
+export declare function marked(ast: SchemaAST.AST, seen?: Set<SchemaAST.AST>): boolean;
+export declare function collectEncodedKeys(ast: SchemaAST.AST, keys: Set<string>): void;
+export declare function maskedValue(ast: SchemaAST.AST, keys: ReadonlySet<string>, seen?: Set<SchemaAST.AST>): boolean;
+export declare function collect(ast: SchemaAST.AST, nodes: Set<SchemaAST.AST>, encodings?: boolean): void;
+export declare function collectFieldKeys(properties: SchemaAST.Objects["propertySignatures"], keys: Set<string>, sensitive: (ast: SchemaAST.AST) => boolean): void;
+//# sourceMappingURL=schemaSensitiveAst.d.ts.map

package/dist/schemaSensitiveAst.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemaSensitiveAst.d.ts","sourceRoot":"","sources":["../src/schemaSensitiveAst.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,QAAQ,CAAC;AAsBnD,wBAAgB,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,IAAI,qBAA2B,GAAG,OAAO,CAenF;AAOD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,QAcvE;AAOD,wBAAgB,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,IAAI,qBAA2B,GAAG,OAAO,CAmBnH;AACD,wBAAgB,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,SAAS,UAAO,QAQtF;AAMD,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,SAAS,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,KAAK,OAAO,QAMlJ"}

package/dist/schemaSensitiveAst.js

@@ -0,0 +1,102 @@
+import { Predicate } from "effect";
+import { isSensitiveKey } from "#sensitive.ts";
+function children(ast) {
+    switch (ast._tag) {
+        case "Objects":
+            return [...ast.propertySignatures.map((property) => property.type), ...ast.indexSignatures.flatMap((index) => [index.parameter, index.type])];
+        case "Arrays":
+            return [...ast.elements, ...ast.rest];
+        case "Union":
+            return ast.types;
+        case "Declaration":
+            return ast.typeParameters;
+        case "Suspend":
+            return [ast.thunk()];
+        default:
+            return [];
+    }
+}
+function sensitiveCheck(check) {
+    return check.annotations?.sensitive === true || (check._tag === "FilterGroup" && check.checks.some(sensitiveCheck));
+}
+export function marked(ast, seen = new Set()) {
+    if (seen.has(ast)) {
+        return false;
+    }
+    seen.add(ast);
+    if (ast.annotations?.sensitive === true
+        || ast.context?.annotations?.sensitive === true
+        || ast.checks?.some(sensitiveCheck)
+        || (Predicate.hasProperty(ast.annotations?.representation, "id") && ast.annotations.representation.id === "effect/schema/Redacted")) {
+        return true;
+    }
+    const nested = ast._tag === "Objects" ? ast.indexSignatures.map((index) => index.type) : children(ast);
+    return (ast.encoding?.some((link) => marked(link.to, seen)) ?? false) || nested.some((type) => marked(type, seen));
+}
+function containsSensitive(ast, keys) {
+    return (marked(ast)
+        || propertiesOf(ast).some((property) => typeof property.name === "string" && (keys.has(property.name) || isSensitiveKey(property.name))));
+}
+export function collectEncodedKeys(ast, keys) {
+    let source = ast;
+    let sensitive = false;
+    for (const link of ast.encoding ?? []) {
+        sensitive ||= containsSensitive(source, keys);
+        if (sensitive) {
+            for (const property of propertiesOf(link.to)) {
+                if (typeof property.name === "string") {
+                    keys.add(property.name);
+                }
+            }
+        }
+        source = link.to;
+    }
+}
+function fixedOutput(ast) {
+    if (ast._tag === "Union") {
+        return ast.types.every(fixedOutput);
+    }
+    return ast._tag === "Objects" && ast.indexSignatures.length === 0;
+}
+export function maskedValue(ast, keys, seen = new Set()) {
+    if (seen.has(ast)) {
+        return false;
+    }
+    seen.add(ast);
+    if (marked(ast)) {
+        return true;
+    }
+    let source = ast;
+    let sensitive = false;
+    for (const link of ast.encoding ?? []) {
+        sensitive ||= containsSensitive(source, keys);
+        if (sensitive && !fixedOutput(link.to)) {
+            return true;
+        }
+        source = link.to;
+    }
+    const nested = ast._tag === "Objects" ? ast.indexSignatures.map((index) => index.type) : children(ast);
+    return nested.some((type) => maskedValue(type, keys, seen));
+}
+export function collect(ast, nodes, encodings = true) {
+    if (nodes.has(ast)) {
+        return;
+    }
+    nodes.add(ast);
+    for (const child of [...children(ast), ...(encodings ? (ast.encoding?.map((link) => link.to) ?? []) : [])]) {
+        collect(child, nodes, encodings);
+    }
+}
+function propertiesOf(ast) {
+    const nodes = new Set();
+    collect(ast, nodes, false);
+    return [...nodes].flatMap((node) => (node._tag === "Objects" ? node.propertySignatures : []));
+}
+export function collectFieldKeys(properties, keys, sensitive) {
+    for (const property of properties) {
+        if (typeof property.name === "string" && sensitive(property.type)) {
+            keys.add(property.name);
+        }
+    }
+}
+//# sourceMappingURL=schemaSensitiveAst.js.map

package/dist/schemaSensitiveAst.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemaSensitiveAst.js","sourceRoot":"","sources":["../src/schemaSensitiveAst.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAkB,MAAM,QAAQ,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,SAAS,QAAQ,CAAC,GAAkB;IACnC,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,SAAS;YACb,OAAO,CAAC,GAAG,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/I,KAAK,QAAQ;YACZ,OAAO,CAAC,GAAG,GAAG,CAAC,QAAQ,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,KAAK,OAAO;YACX,OAAO,GAAG,CAAC,KAAK,CAAC;QAClB,KAAK,aAAa;YACjB,OAAO,GAAG,CAAC,cAAc,CAAC;QAC3B,KAAK,SAAS;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QACtB;YACC,OAAO,EAAE,CAAC;IACZ,CAAC;AACF,CAAC;AACD,SAAS,cAAc,CAAC,KAA6B;IACpD,OAAO,KAAK,CAAC,WAAW,EAAE,SAAS,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,aAAa,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;AACrH,CAAC;AACD,MAAM,UAAU,MAAM,CAAC,GAAkB,EAAE,IAAI,GAAG,IAAI,GAAG,EAAiB;IACzE,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACd,IACC,GAAG,CAAC,WAAW,EAAE,SAAS,KAAK,IAAI;WAChC,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,SAAS,KAAK,IAAI;WAC5C,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,CAAC;WAChC,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,WAAW,EAAE,cAAc,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,cAAc,CAAC,EAAE,KAAK,wBAAwB,CAAC,EAClI,CAAC;QACF,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACvG,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AACpH,CAAC;AACD,SAAS,iBAAiB,CAAC,GAAkB,EAAE,IAAyB;IACvE,OAAO,CACN,MAAM,CAAC,GAAG,CAAC;WACR,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CACxI,CAAC;AACH,CAAC;AACD,MAAM,UAAU,kBAAkB,CAAC,GAAkB,EAAE,IAAiB;IACvE,IAAI,MAAM,GAAG,GAAG,CAAC;IACjB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QACvC,SAAS,KAAK,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9C,IAAI,SAAS,EAAE,CAAC;YACf,KAAK,MAAM,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC9C,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACvC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACzB,CAAC;YACF,CAAC;QACF,CAAC;QACD,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;IAClB,CAAC;AACF,CAAC;AACD,SAAS,WAAW,CAAC,GAAkB;IACtC,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC1B,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,CAAC;AACnE,CAAC;AACD,MAAM,UAAU,WAAW,CAAC,GAAkB,EAAE,IAAyB,EAAE,IAAI,GAAG,IAAI,GAAG,EAAiB;IACzG,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACd,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,MAAM,GAAG,GAAG,CAAC;IACjB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QACvC,SAAS,KAAK,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9C,IAAI,SAAS,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC;QACb,CAAC;QACD,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACvG,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAC7D,CAAC;AACD,MAAM,UAAU,OAAO,CAAC,GAAkB,EAAE,KAAyB,EAAE,SAAS,GAAG,IAAI;IACtF,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO;IACR,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAC5G,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IAClC,CAAC;AACF,CAAC;AACD,SAAS,YAAY,CAAC,GAAkB;IACvC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAiB,CAAC;IACvC,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC3B,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC/F,CAAC;AACD,MAAM,UAAU,gBAAgB,CAAC,UAAmD,EAAE,IAAiB,EAAE,SAA0C;IAClJ,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACnE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;IACF,CAAC;AACF,CAAC"}

package/dist/schemaSensitiveKeys.d.ts

@@ -0,0 +1,6 @@
+import { Rpc, type RpcGroup } from "effect/rpc";
+export declare function schemaSensitiveKeys<R extends Rpc.Any>(group: RpcGroup.RpcGroup<R>, extra?: readonly string[]): ((key: string) => boolean) & {
+    forRpc: (tag: string | undefined) => (key: string) => boolean;
+    maskFailure: (tag: string | undefined, reason: "Fail" | "Die") => boolean;
+};
+//# sourceMappingURL=schemaSensitiveKeys.d.ts.map

package/dist/schemaSensitiveKeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemaSensitiveKeys.d.ts","sourceRoot":"","sources":["../src/schemaSensitiveKeys.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,CAAC;AAgChD,wBAAgB,mBAAmB,CAAC,CAAC,SAAS,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,GAAE,SAAS,MAAM,EAAO,UAOxF,MAAM;kBAIf,MAAM,GAAG,SAAS,WAJT,MAAM;uBAKV,MAAM,GAAG,SAAS,UAAU,MAAM,GAAG,KAAK;EAG9D"}

package/dist/schemaSensitiveKeys.js

@@ -0,0 +1,47 @@
+import { Rpc } from "effect/rpc";
+import { collect, collectEncodedKeys, collectFieldKeys, marked, maskedValue } from "#schemaSensitiveAst.ts";
+import { isSensitiveKey } from "#sensitive.ts";
+function rpcSensitiveKeys(rpc, extra) {
+    const keys = new Set(extra);
+    const nodes = new Set();
+    const schemas = [
+        rpc.payloadSchema,
+        rpc.successSchema,
+        rpc.errorSchema,
+        rpc.defectSchema,
+        ...[...rpc.middlewares].map((m) => m.error),
+    ];
+    for (const schema of schemas) {
+        collect(schema.ast, nodes);
+    }
+    const properties = [...nodes].flatMap((ast) => (ast._tag === "Objects" ? ast.propertySignatures : []));
+    collectFieldKeys(properties, keys, marked);
+    let previousSize;
+    do {
+        previousSize = keys.size;
+        collectFieldKeys(properties, keys, (ast) => maskedValue(ast, keys));
+        for (const ast of nodes) {
+            collectEncodedKeys(ast, keys);
+        }
+    } while (keys.size !== previousSize);
+    return Object.assign((key) => keys.has(key) || isSensitiveKey(key), {
+        die: maskedValue(rpc.defectSchema.ast, keys),
+        fail: [rpc.errorSchema, ...[...rpc.middlewares].map((m) => m.error)].some((schema) => maskedValue(schema.ast, keys)),
+    });
+}
+export function schemaSensitiveKeys(group, extra = []) {
+    const policies = new Map();
+    for (const rpc of group.requests.values()) {
+        if (Rpc.isRpc(rpc)) {
+            policies.set(rpc._tag, rpcSensitiveKeys(rpc, extra));
+        }
+    }
+    function sensitive(key) {
+        return extra.includes(key) || isSensitiveKey(key) || [...policies.values()].some((policy) => policy(key));
+    }
+    return Object.assign(sensitive, {
+        forRpc: (tag) => (tag === undefined ? sensitive : (policies.get(tag) ?? sensitive)),
+        maskFailure: (tag, reason) => [...policies].some(([method, policy]) => (tag === undefined || tag === method) && (reason === "Fail" ? policy.fail : policy.die)),
+    });
+}
+//# sourceMappingURL=schemaSensitiveKeys.js.map

package/dist/schemaSensitiveKeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemaSensitiveKeys.js","sourceRoot":"","sources":["../src/schemaSensitiveKeys.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAiB,MAAM,YAAY,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC5G,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,SAAS,gBAAgB,CAAC,GAAqB,EAAE,KAAwB;IACxE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAiB,CAAC;IACvC,MAAM,OAAO,GAAiB;QAC7B,GAAG,CAAC,aAAa;QACjB,GAAG,CAAC,aAAa;QACjB,GAAG,CAAC,WAAW;QACf,GAAG,CAAC,YAAY;QAChB,GAAG,CAAC,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;KAC3C,CAAC;IACF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC9B,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC5B,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACvG,gBAAgB,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAC3C,IAAI,YAAoB,CAAC;IACzB,GAAG,CAAC;QACH,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC;QACzB,gBAAgB,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACpE,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;YACzB,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC/B,CAAC;IACF,CAAC,QAAQ,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE;IACrC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE;QAC3E,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC;QAC5C,IAAI,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;KACpH,CAAC,CAAC;AACJ,CAAC;AACD,MAAM,UAAU,mBAAmB,CAAoB,KAA2B,EAAE,KAAK,GAAsB,EAAE;IAChH,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA+C,CAAC;IACxE,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QAC3C,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QACtD,CAAC;IACF,CAAC;IACD,SAAS,SAAS,CAAC,GAAW;QAC7B,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3G,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE;QAC/B,MAAM,EAAE,CAAC,GAAuB,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,CAAC;QACvG,WAAW,EAAE,CAAC,GAAuB,EAAE,MAAsB,EAAE,EAAE,CAChE,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;KAClI,CAAC,CAAC;AACJ,CAAC"}

package/dist/sensitive.d.ts

@@ -1,6 +1,7 @@
 export declare const REDACTED = "<redacted>";
 export type SensitiveKey = (key: string) => boolean;
 export declare function isSensitiveKey(key: string): boolean;
-export declare function redactText(text: string, sensitive: SensitiveKey, maxLength?: number): string;
+export declare function redactText(text: string, sensitive: SensitiveKey, maxLength?: number, key?: string): string;
 export declare function redactErrorStack(error: Error, sensitive: SensitiveKey): string | undefined;
+export declare function redactUrl(value: string, key?: string): string;
 //# sourceMappingURL=sensitive.d.ts.map

package/dist/sensitive.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sensitive.d.ts","sourceRoot":"","sources":["../src/sensitive.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,QAAQ,eAAe,CAAC;AAwBrC,MAAM,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;AAQpD,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAOnD;AA8BD,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,SAAa,GAAG,MAAM,CAGhG;AACD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,GAAG,MAAM,GAAG,SAAS,CAK1F"}
+{"version":3,"file":"sensitive.d.ts","sourceRoot":"","sources":["../src/sensitive.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,QAAQ,eAAe,CAAC;AAwBrC,MAAM,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;AAQpD,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAOnD;AAyBD,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,SAAa,EAAE,GAAG,SAAK,GAAG,MAAM,CAG1G;AACD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,GAAG,MAAM,GAAG,SAAS,CAK1F;AA8BD,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,SAAK,GAAG,MAAM,CAkBzD"}

package/dist/sensitive.js

@@ -1,3 +1,4 @@
+import { Option, Schema } from "effect";
 export const REDACTED = "<redacted>";
 const MAX_STRING = 2048;
 const SENSITIVE_PARTS = [
@@ -21,7 +22,7 @@ const SENSITIVE_PARTS = [
     "xsrf",
 ];
 const SENSITIVE_WORDS = ["otp", "pin", "cvv", "cvc", "ssn", "iban"];
-const SENSITIVE_NAMES = ["session", "pan", "sig"];
+const SENSITIVE_NAMES = ["session", "pan", "sig", "db.user", "db.user.name", "db.connectionstring"];
 function wordsOf(key) {
     return key
         .replaceAll(/(?<lower>[a-z0-9])(?<upper>[A-Z])/gu, "$<lower> $<upper>")
@@ -38,7 +39,6 @@ export function isSensitiveKey(key) {
 const AUTH_SCHEME = /\b(?<scheme>Bearer|Basic)\s+[A-Za-z0-9%._~+/-]+=*/giu;
 const JWT = /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*/gu;
 const PRIVATE_KEY = /-----BEGIN (?<kind>(?:[A-Z0-9]+ )*PRIVATE KEY)-----[\s\S]*?-----END \k<kind>-----/gu;
-const URL_PASSWORD = /(?<authority>\/\/[^:/\s@]+:)[^@/\s]+@/gu;
 function redactAssignments(text, sensitive) {
     const matcher = /(?<key>[A-Za-z][\w.-]*)(?<separator>["']?\s*[=:]\s*["']?)(?<value>[^\s"'&,;]+)/gu;
     let result = "";
@@ -58,15 +58,11 @@ function redactAssignments(text, sensitive) {
     return result + text.slice(cursor);
 }
 function scrub(text, sensitive) {
-    const credentials = text
-        .replaceAll(PRIVATE_KEY, REDACTED)
-        .replaceAll(AUTH_SCHEME, `$<scheme> ${REDACTED}`)
-        .replaceAll(JWT, REDACTED)
-        .replaceAll(URL_PASSWORD, `$<authority>${REDACTED}@`);
+    const credentials = text.replaceAll(PRIVATE_KEY, REDACTED).replaceAll(AUTH_SCHEME, `$<scheme> ${REDACTED}`).replaceAll(JWT, REDACTED);
     return redactAssignments(credentials, sensitive);
 }
-export function redactText(text, sensitive, maxLength = MAX_STRING) {
-    const scrubbed = scrub(text, sensitive);
+export function redactText(text, sensitive, maxLength = MAX_STRING, key = "") {
+    const scrubbed = scrub(redactUrl(text, key), sensitive);
     return scrubbed.length > maxLength ? `${scrubbed.slice(0, maxLength)}…<${scrubbed.length - maxLength} more chars>` : scrubbed;
 }
 export function redactErrorStack(error, sensitive) {
@@ -75,4 +71,41 @@ export function redactErrorStack(error, sensitive) {
     }
     return ["message", "name", "stack"].some((key) => sensitive(key)) ? REDACTED : redactText(error.stack, sensitive);
 }
+function query(value) {
+    return value
+        .split("&")
+        .map((part) => (part === "" ? part : `${part.split("=", 1)[0]}=${REDACTED}`))
+        .join("&");
+}
+function url(value) {
+    const fragment = value.indexOf("#");
+    const target = fragment === -1 ? value : value.slice(0, fragment);
+    const separator = target.indexOf("?");
+    return ((separator === -1 ? target : `${target.slice(0, separator + 1)}${query(target.slice(separator + 1))}`).replaceAll(/(?<authority>(?:\b[a-z][a-z0-9+.-]*:)?\/\/)[^/?#]*@/giu, `$<authority>${REDACTED}@`) + (fragment === -1 ? "" : `#${REDACTED}`));
+}
+const structuredUrl = Schema.decodeUnknownOption(Schema.fromJsonString(Schema.Unknown, {
+    reviver: (key, item) => (typeof item === "string" ? redactUrl(item, key) : item),
+}));
+function structured(value) {
+    return Option.getOrUndefined(Option.map(structuredUrl(value), (parsed) => JSON.stringify(parsed)));
+}
+export function redactUrl(value, key = "") {
+    if (/(?:^|[._-])(?:fragment|userinfo|username|password)$/iu.test(key)) {
+        return REDACTED;
+    }
+    if (/(?:^|[._-])query$/iu.test(key)) {
+        return url(`?${value}`).slice(1);
+    }
+    if (/(?:^|[._-])(?:url|uri|target)(?:$|[._-])/iu.test(key) || /(?:^|[._-])(?:referer|referrer|location|origin)$/iu.test(key)) {
+        return url(value);
+    }
+    if (/^\s*[[{]/u.test(value)) {
+        const redacted = structured(value);
+        if (redacted !== undefined) {
+            return redacted;
+        }
+    }
+    // Quotes and whitespace can belong to secret values, so free text has no safe closing delimiter.
+    return value.replaceAll(/(?:[a-z][a-z0-9+.-]*:\/\/|[/?#]).*/gisu, url);
+}
 //# sourceMappingURL=sensitive.js.map

package/dist/sensitive.js.map

@@ -1 +1 @@
-{"version":3,"file":"sensitive.js","sourceRoot":"","sources":["../src/sensitive.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,QAAQ,GAAG,YAAY,CAAC;AACrC,MAAM,UAAU,GAAG,IAAI,CAAC;AACxB,MAAM,eAAe,GAAG;IACvB,UAAU;IACV,YAAY;IACZ,QAAQ;IACR,OAAO;IACP,eAAe;IACf,QAAQ;IACR,QAAQ;IACR,WAAW;IACX,YAAY;IACZ,YAAY;IACZ,KAAK;IACL,QAAQ;IACR,WAAW;IACX,WAAW;IACX,YAAY;IACZ,eAAe;IACf,MAAM;IACN,MAAM;CACN,CAAC;AACF,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AACpE,MAAM,eAAe,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;AAElD,SAAS,OAAO,CAAC,GAAW;IAC3B,OAAO,GAAG;SACR,UAAU,CAAC,qCAAqC,EAAE,mBAAmB,CAAC;SACtE,UAAU,CAAC,wCAAwC,EAAE,oBAAoB,CAAC;SAC1E,WAAW,EAAE;SACb,KAAK,CAAC,UAAU,CAAC,CAAC;AACrB,CAAC;AACD,MAAM,UAAU,cAAc,CAAC,GAAW;IACzC,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC9D,OAAO,CACN,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC;WACjC,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;WACzD,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAC9D,CAAC;AACH,CAAC;AACD,MAAM,WAAW,GAAG,sDAAsD,CAAC;AAC3E,MAAM,GAAG,GAAG,uDAAuD,CAAC;AACpE,MAAM,WAAW,GAAG,qFAAqF,CAAC;AAC1G,MAAM,YAAY,GAAG,yCAAyC,CAAC;AAC/D,SAAS,iBAAiB,CAAC,IAAY,EAAE,SAAuB;IAC/D,MAAM,OAAO,GAAG,kFAAkF,CAAC;IACnG,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,IAAI,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,IAAI,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACjF,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,SAAS,GAAG,QAAQ,EAAE,CAAC;YAC5E,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;QAC5B,CAAC;aAAM,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,6FAA6F;YAC7F,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;QACjE,CAAC;IACF,CAAC;IACD,OAAO,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AACD,SAAS,KAAK,CAAC,IAAY,EAAE,SAAuB;IACnD,MAAM,WAAW,GAAG,IAAI;SACtB,UAAU,CAAC,WAAW,EAAE,QAAQ,CAAC;SACjC,UAAU,CAAC,WAAW,EAAE,aAAa,QAAQ,EAAE,CAAC;SAChD,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC;SACzB,UAAU,CAAC,YAAY,EAAE,eAAe,QAAQ,GAAG,CAAC,CAAC;IACvD,OAAO,iBAAiB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;AAClD,CAAC;AACD,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,SAAuB,EAAE,SAAS,GAAG,UAAU;IACvF,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACxC,OAAO,QAAQ,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,KAAK,QAAQ,CAAC,MAAM,GAAG,SAAS,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC/H,CAAC;AACD,MAAM,UAAU,gBAAgB,CAAC,KAAY,EAAE,SAAuB;IACrE,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;AACnH,CAAC"}
+{"version":3,"file":"sensitive.js","sourceRoot":"","sources":["../src/sensitive.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAExC,MAAM,CAAC,MAAM,QAAQ,GAAG,YAAY,CAAC;AACrC,MAAM,UAAU,GAAG,IAAI,CAAC;AACxB,MAAM,eAAe,GAAG;IACvB,UAAU;IACV,YAAY;IACZ,QAAQ;IACR,OAAO;IACP,eAAe;IACf,QAAQ;IACR,QAAQ;IACR,WAAW;IACX,YAAY;IACZ,YAAY;IACZ,KAAK;IACL,QAAQ;IACR,WAAW;IACX,WAAW;IACX,YAAY;IACZ,eAAe;IACf,MAAM;IACN,MAAM;CACN,CAAC;AACF,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AACpE,MAAM,eAAe,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,qBAAqB,CAAC,CAAC;AAEpG,SAAS,OAAO,CAAC,GAAW;IAC3B,OAAO,GAAG;SACR,UAAU,CAAC,qCAAqC,EAAE,mBAAmB,CAAC;SACtE,UAAU,CAAC,wCAAwC,EAAE,oBAAoB,CAAC;SAC1E,WAAW,EAAE;SACb,KAAK,CAAC,UAAU,CAAC,CAAC;AACrB,CAAC;AACD,MAAM,UAAU,cAAc,CAAC,GAAW;IACzC,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC9D,OAAO,CACN,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC;WACjC,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;WACzD,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAC9D,CAAC;AACH,CAAC;AACD,MAAM,WAAW,GAAG,sDAAsD,CAAC;AAC3E,MAAM,GAAG,GAAG,uDAAuD,CAAC;AACpE,MAAM,WAAW,GAAG,qFAAqF,CAAC;AAC1G,SAAS,iBAAiB,CAAC,IAAY,EAAE,SAAuB;IAC/D,MAAM,OAAO,GAAG,kFAAkF,CAAC;IACnG,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,IAAI,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,IAAI,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACjF,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,SAAS,GAAG,QAAQ,EAAE,CAAC;YAC5E,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;QAC5B,CAAC;aAAM,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,6FAA6F;YAC7F,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;QACjE,CAAC;IACF,CAAC;IACD,OAAO,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AACD,SAAS,KAAK,CAAC,IAAY,EAAE,SAAuB;IACnD,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,aAAa,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACtI,OAAO,iBAAiB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;AAClD,CAAC;AACD,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,SAAuB,EAAE,SAAS,GAAG,UAAU,EAAE,GAAG,GAAG,EAAE;IACjG,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,SAAS,CAAC,CAAC;IACxD,OAAO,QAAQ,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,KAAK,QAAQ,CAAC,MAAM,GAAG,SAAS,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC/H,CAAC;AACD,MAAM,UAAU,gBAAgB,CAAC,KAAY,EAAE,SAAuB;IACrE,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;AACnH,CAAC;AAED,SAAS,KAAK,CAAC,KAAa;IAC3B,OAAO,KAAK;SACV,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC;SAC5E,IAAI,CAAC,GAAG,CAAC,CAAC;AACb,CAAC;AAED,SAAS,GAAG,CAAC,KAAa;IACzB,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAClE,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,OAAO,CACN,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,UAAU,CAChH,wDAAwD,EACxD,eAAe,QAAQ,GAAG,CAC1B,GAAG,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,CAAC,CAC3C,CAAC;AACH,CAAC;AAED,MAAM,aAAa,GAAG,MAAM,CAAC,mBAAmB,CAC/C,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE;IACrC,OAAO,EAAE,CAAC,GAAW,EAAE,IAAa,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;CACjG,CAAC,CACF,CAAC;AACF,SAAS,UAAU,CAAC,KAAa;IAChC,OAAO,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACpG,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,GAAG,GAAG,EAAE;IAChD,IAAI,uDAAuD,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACvE,OAAO,QAAQ,CAAC;IACjB,CAAC;IACD,IAAI,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,OAAO,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,4CAA4C,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,oDAAoD,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9H,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IACD,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,QAAQ,CAAC;QACjB,CAAC;IACF,CAAC;IACD,iGAAiG;IACjG,OAAO,KAAK,CAAC,UAAU,CAAC,wCAAwC,EAAE,GAAG,CAAC,CAAC;AACxE,CAAC"}

package/dist/taxonomy.d.ts

@@ -51,5 +51,15 @@ declare const ServiceUnavailable_base: Schema.Class<ServiceUnavailable, Schema.T
 }>, import("effect/Cause").YieldableError>;
 export declare class ServiceUnavailable extends ServiceUnavailable_base {
 }
+export declare function isNotFound(value: unknown): value is NotFound;
+export declare function isUnauthorized(value: unknown): value is Unauthorized;
+export declare function isForbidden(value: unknown): value is Forbidden;
+export declare function isBadRequest(value: unknown): value is BadRequest;
+export declare function isConflict(value: unknown): value is Conflict;
+export declare function isPreconditionFailed(value: unknown): value is PreconditionFailed;
+export declare function isTooManyRequests(value: unknown): value is TooManyRequests;
+export declare function isAuthUnavailable(value: unknown): value is AuthUnavailable;
+export declare function isInternalServerError(value: unknown): value is InternalServerError;
+export declare function isServiceUnavailable(value: unknown): value is ServiceUnavailable;
 export {};
 //# sourceMappingURL=taxonomy.d.ts.map

package/dist/taxonomy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"taxonomy.d.ts","sourceRoot":"","sources":["../src/taxonomy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;;;;AAIhC,qBAAa,QAAS,SAAQ,aAAqD;CAAG;;;;AACtF,qBAAa,YAAa,SAAQ,iBAA6D;CAAG;;;;AAClG,qBAAa,SAAU,SAAQ,cAAuD;CAAG;;;;;AACzF,qBAAa,UAAW,SAAQ,eAAwD;CAAG;;;;;AAC3F,qBAAa,QAAS,SAAQ,aAAoD;CAAG;;;;AACrF,qBAAa,kBAAmB,SAAQ,uBAAyE;CAAG;;;;AACpH,qBAAa,eAAgB,SAAQ,oBAAmE;CAAG;;;;AAC3G,qBAAa,eAAgB,SAAQ,oBAAmE;CAAG;;;;AAC3G,qBAAa,mBAAoB,SAAQ,wBAA2E;CAAG;;;;AACvH,qBAAa,kBAAmB,SAAQ,uBAAyE;CAAG"}
+{"version":3,"file":"taxonomy.d.ts","sourceRoot":"","sources":["../src/taxonomy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;;;;AAIhC,qBAAa,QAAS,SAAQ,aAAqD;CAAG;;;;AACtF,qBAAa,YAAa,SAAQ,iBAA6D;CAAG;;;;AAClG,qBAAa,SAAU,SAAQ,cAAuD;CAAG;;;;;AACzF,qBAAa,UAAW,SAAQ,eAAwD;CAAG;;;;;AAC3F,qBAAa,QAAS,SAAQ,aAAoD;CAAG;;;;AACrF,qBAAa,kBAAmB,SAAQ,uBAAyE;CAAG;;;;AACpH,qBAAa,eAAgB,SAAQ,oBAAmE;CAAG;;;;AAC3G,qBAAa,eAAgB,SAAQ,oBAAmE;CAAG;;;;AAC3G,qBAAa,mBAAoB,SAAQ,wBAA2E;CAAG;;;;AACvH,qBAAa,kBAAmB,SAAQ,uBAAyE;CAAG;AAEpH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,QAAQ,CAE5D;AACD,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,YAAY,CAEpE;AACD,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,SAAS,CAE9D;AACD,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,UAAU,CAEhE;AACD,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,QAAQ,CAE5D;AACD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,kBAAkB,CAEhF;AACD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,eAAe,CAE1E;AACD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,eAAe,CAE1E;AACD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,mBAAmB,CAElF;AACD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,kBAAkB,CAEhF"}

package/dist/taxonomy.js

@@ -21,4 +21,34 @@ export class InternalServerError extends Schema.TaggedError()("InternalServerErr
 }
 export class ServiceUnavailable extends Schema.TaggedError()("ServiceUnavailable", described) {
 }
+export function isNotFound(value) {
+    return value instanceof NotFound;
+}
+export function isUnauthorized(value) {
+    return value instanceof Unauthorized;
+}
+export function isForbidden(value) {
+    return value instanceof Forbidden;
+}
+export function isBadRequest(value) {
+    return value instanceof BadRequest;
+}
+export function isConflict(value) {
+    return value instanceof Conflict;
+}
+export function isPreconditionFailed(value) {
+    return value instanceof PreconditionFailed;
+}
+export function isTooManyRequests(value) {
+    return value instanceof TooManyRequests;
+}
+export function isAuthUnavailable(value) {
+    return value instanceof AuthUnavailable;
+}
+export function isInternalServerError(value) {
+    return value instanceof InternalServerError;
+}
+export function isServiceUnavailable(value) {
+    return value instanceof ServiceUnavailable;
+}
 //# sourceMappingURL=taxonomy.js.map

package/dist/taxonomy.js.map

@@ -1 +1 @@
-{"version":3,"file":"taxonomy.js","sourceRoot":"","sources":["../src/taxonomy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,MAAM,SAAS,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;AAC7C,MAAM,QAAQ,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;AACtF,MAAM,OAAO,QAAS,SAAQ,MAAM,CAAC,WAAW,EAAY,CAAC,UAAU,EAAE,SAAS,CAAC;CAAG;AACtF,MAAM,OAAO,YAAa,SAAQ,MAAM,CAAC,WAAW,EAAgB,CAAC,cAAc,EAAE,SAAS,CAAC;CAAG;AAClG,MAAM,OAAO,SAAU,SAAQ,MAAM,CAAC,WAAW,EAAa,CAAC,WAAW,EAAE,SAAS,CAAC;CAAG;AACzF,MAAM,OAAO,UAAW,SAAQ,MAAM,CAAC,WAAW,EAAc,CAAC,YAAY,EAAE,QAAQ,CAAC;CAAG;AAC3F,MAAM,OAAO,QAAS,SAAQ,MAAM,CAAC,WAAW,EAAY,CAAC,UAAU,EAAE,QAAQ,CAAC;CAAG;AACrF,MAAM,OAAO,kBAAmB,SAAQ,MAAM,CAAC,WAAW,EAAsB,CAAC,oBAAoB,EAAE,SAAS,CAAC;CAAG;AACpH,MAAM,OAAO,eAAgB,SAAQ,MAAM,CAAC,WAAW,EAAmB,CAAC,iBAAiB,EAAE,SAAS,CAAC;CAAG;AAC3G,MAAM,OAAO,eAAgB,SAAQ,MAAM,CAAC,WAAW,EAAmB,CAAC,iBAAiB,EAAE,SAAS,CAAC;CAAG;AAC3G,MAAM,OAAO,mBAAoB,SAAQ,MAAM,CAAC,WAAW,EAAuB,CAAC,qBAAqB,EAAE,SAAS,CAAC;CAAG;AACvH,MAAM,OAAO,kBAAmB,SAAQ,MAAM,CAAC,WAAW,EAAsB,CAAC,oBAAoB,EAAE,SAAS,CAAC;CAAG"}
+{"version":3,"file":"taxonomy.js","sourceRoot":"","sources":["../src/taxonomy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,MAAM,SAAS,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;AAC7C,MAAM,QAAQ,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;AACtF,MAAM,OAAO,QAAS,SAAQ,MAAM,CAAC,WAAW,EAAY,CAAC,UAAU,EAAE,SAAS,CAAC;CAAG;AACtF,MAAM,OAAO,YAAa,SAAQ,MAAM,CAAC,WAAW,EAAgB,CAAC,cAAc,EAAE,SAAS,CAAC;CAAG;AAClG,MAAM,OAAO,SAAU,SAAQ,MAAM,CAAC,WAAW,EAAa,CAAC,WAAW,EAAE,SAAS,CAAC;CAAG;AACzF,MAAM,OAAO,UAAW,SAAQ,MAAM,CAAC,WAAW,EAAc,CAAC,YAAY,EAAE,QAAQ,CAAC;CAAG;AAC3F,MAAM,OAAO,QAAS,SAAQ,MAAM,CAAC,WAAW,EAAY,CAAC,UAAU,EAAE,QAAQ,CAAC;CAAG;AACrF,MAAM,OAAO,kBAAmB,SAAQ,MAAM,CAAC,WAAW,EAAsB,CAAC,oBAAoB,EAAE,SAAS,CAAC;CAAG;AACpH,MAAM,OAAO,eAAgB,SAAQ,MAAM,CAAC,WAAW,EAAmB,CAAC,iBAAiB,EAAE,SAAS,CAAC;CAAG;AAC3G,MAAM,OAAO,eAAgB,SAAQ,MAAM,CAAC,WAAW,EAAmB,CAAC,iBAAiB,EAAE,SAAS,CAAC;CAAG;AAC3G,MAAM,OAAO,mBAAoB,SAAQ,MAAM,CAAC,WAAW,EAAuB,CAAC,qBAAqB,EAAE,SAAS,CAAC;CAAG;AACvH,MAAM,OAAO,kBAAmB,SAAQ,MAAM,CAAC,WAAW,EAAsB,CAAC,oBAAoB,EAAE,SAAS,CAAC;CAAG;AAEpH,MAAM,UAAU,UAAU,CAAC,KAAc;IACxC,OAAO,KAAK,YAAY,QAAQ,CAAC;AAClC,CAAC;AACD,MAAM,UAAU,cAAc,CAAC,KAAc;IAC5C,OAAO,KAAK,YAAY,YAAY,CAAC;AACtC,CAAC;AACD,MAAM,UAAU,WAAW,CAAC,KAAc;IACzC,OAAO,KAAK,YAAY,SAAS,CAAC;AACnC,CAAC;AACD,MAAM,UAAU,YAAY,CAAC,KAAc;IAC1C,OAAO,KAAK,YAAY,UAAU,CAAC;AACpC,CAAC;AACD,MAAM,UAAU,UAAU,CAAC,KAAc;IACxC,OAAO,KAAK,YAAY,QAAQ,CAAC;AAClC,CAAC;AACD,MAAM,UAAU,oBAAoB,CAAC,KAAc;IAClD,OAAO,KAAK,YAAY,kBAAkB,CAAC;AAC5C,CAAC;AACD,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC/C,OAAO,KAAK,YAAY,eAAe,CAAC;AACzC,CAAC;AACD,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC/C,OAAO,KAAK,YAAY,eAAe,CAAC;AACzC,CAAC;AACD,MAAM,UAAU,qBAAqB,CAAC,KAAc;IACnD,OAAO,KAAK,YAAY,mBAAmB,CAAC;AAC7C,CAAC;AACD,MAAM,UAAU,oBAAoB,CAAC,KAAc;IAClD,OAAO,KAAK,YAAY,kBAAkB,CAAC;AAC5C,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shivaedev/errors",
-  "version": "0.1.3",
+  "version": "0.2.0",
   "description": "Typed expected failures and secret-safe failure reporting for Effect applications",
   "keywords": [
     "effect"
@@ -45,7 +45,7 @@
     "README.md"
   ],
   "devDependencies": {
-    "@shivaedev/quality": "0.48.1",
+    "@shivaedev/quality": "0.49.0",
     "@shivaedev/test": "0.12.0",
     "@types/node": "24.19.2",
     "effect": "4.0.6",

package/src/redact.ts

@@ -25,24 +25,24 @@ function entriesOf(value: object, sensitive: SensitiveKey, bounded: boolean): [s
 	const extra = entries.filter(([key]) => !["name", "message", "stack", "cause"].includes(key));
 	return value.cause === undefined ? [...shape, ...extra] : [...shape, ...extra, ["cause", value.cause]];
 }
-function collection(value: object, sensitive: SensitiveKey, depth: number, bounded: boolean): unknown {
+function collection(value: object, sensitive: SensitiveKey, depth: number, bounded: boolean, parentKey: string): unknown {
 	if (Array.isArray(value)) {
-		const items = value.slice(0, bounded ? MAX_ENTRIES : value.length).map((item) => walk(item, sensitive, depth + 1, bounded));
+		const items = value.slice(0, bounded ? MAX_ENTRIES : value.length).map((item) => walk(item, sensitive, depth + 1, bounded, parentKey));
 		return bounded && value.length > MAX_ENTRIES ? [...items, `<${value.length - MAX_ENTRIES} more items>`] : items;
 	}
 	const entries = entriesOf(value, sensitive, bounded);
 	const kept = entries.slice(0, bounded ? MAX_ENTRIES : entries.length).map(([key, nested]): [string, unknown] => {
 		const stackHeader = key === "stack" && typeof nested === "string" && (sensitive("name") || sensitive("message"));
-		return [key, sensitive(key) || stackHeader ? REDACTED : walk(nested, sensitive, depth + 1, bounded)];
+		return [key, sensitive(key) || stackHeader ? REDACTED : walk(nested, sensitive, depth + 1, bounded, key)];
 	});
 	return Object.fromEntries(bounded && entries.length > MAX_ENTRIES ? [...kept, ["<truncated>", `${entries.length - MAX_ENTRIES} more keys`]] : kept);
 }
-function walk(value: unknown, sensitive: SensitiveKey, depth: number, bounded: boolean): unknown {
+function walk(value: unknown, sensitive: SensitiveKey, depth: number, bounded: boolean, key = ""): unknown {
 	if (Redacted.isRedacted(value)) {
 		return REDACTED;
 	}
 	if (Predicate.isString(value)) {
-		return bounded ? redactText(value, sensitive) : redactText(value, sensitive, Number.POSITIVE_INFINITY);
+		return redactText(value, sensitive, bounded ? undefined : Number.POSITIVE_INFINITY, key);
 	}
 	if (!Predicate.isObjectOrArray(value)) {
 		return value;
@@ -54,7 +54,7 @@ function walk(value: unknown, sensitive: SensitiveKey, depth: number, bounded: b
 	if (bounded && depth >= MAX_DEPTH) {
 		return "<truncated>";
 	}
-	return collection(value, sensitive, depth, bounded);
+	return collection(value, sensitive, depth, bounded, key);
 }
 export function redact(value: unknown, sensitive: SensitiveKey = isSensitiveKey): unknown {
 	return walk(value, sensitive, 0, true);
@@ -62,3 +62,6 @@ export function redact(value: unknown, sensitive: SensitiveKey = isSensitiveKey)
 export function redactWire(value: unknown, sensitive: SensitiveKey = isSensitiveKey): unknown {
 	return walk(value, sensitive, 0, false);
 }
+export function redactRecord(values: Readonly<Record<string, unknown>>, sensitive: SensitiveKey = isSensitiveKey): Record<string, unknown> {
+	return Object.fromEntries(Object.entries(values).map(([key, value]) => [key, sensitive(key) ? REDACTED : walk(value, sensitive, 0, true, key)]));
+}

package/src/schemaSensitiveAst.ts

@@ -0,0 +1,106 @@
+import { Predicate, type SchemaAST } from "effect";
+import { isSensitiveKey } from "#sensitive.ts";
+
+function children(ast: SchemaAST.AST): readonly SchemaAST.AST[] {
+	switch (ast._tag) {
+		case "Objects":
+			return [...ast.propertySignatures.map((property) => property.type), ...ast.indexSignatures.flatMap((index) => [index.parameter, index.type])];
+		case "Arrays":
+			return [...ast.elements, ...ast.rest];
+		case "Union":
+			return ast.types;
+		case "Declaration":
+			return ast.typeParameters;
+		case "Suspend":
+			return [ast.thunk()];
+		default:
+			return [];
+	}
+}
+function sensitiveCheck(check: SchemaAST.Check<never>): boolean {
+	return check.annotations?.sensitive === true || (check._tag === "FilterGroup" && check.checks.some(sensitiveCheck));
+}
+export function marked(ast: SchemaAST.AST, seen = new Set<SchemaAST.AST>()): boolean {
+	if (seen.has(ast)) {
+		return false;
+	}
+	seen.add(ast);
+	if (
+		ast.annotations?.sensitive === true
+		|| ast.context?.annotations?.sensitive === true
+		|| ast.checks?.some(sensitiveCheck)
+		|| (Predicate.hasProperty(ast.annotations?.representation, "id") && ast.annotations.representation.id === "effect/schema/Redacted")
+	) {
+		return true;
+	}
+	const nested = ast._tag === "Objects" ? ast.indexSignatures.map((index) => index.type) : children(ast);
+	return (ast.encoding?.some((link) => marked(link.to, seen)) ?? false) || nested.some((type) => marked(type, seen));
+}
+function containsSensitive(ast: SchemaAST.AST, keys: ReadonlySet<string>): boolean {
+	return (
+		marked(ast)
+		|| propertiesOf(ast).some((property) => typeof property.name === "string" && (keys.has(property.name) || isSensitiveKey(property.name)))
+	);
+}
+export function collectEncodedKeys(ast: SchemaAST.AST, keys: Set<string>) {
+	let source = ast;
+	let sensitive = false;
+	for (const link of ast.encoding ?? []) {
+		sensitive ||= containsSensitive(source, keys);
+		if (sensitive) {
+			for (const property of propertiesOf(link.to)) {
+				if (typeof property.name === "string") {
+					keys.add(property.name);
+				}
+			}
+		}
+		source = link.to;
+	}
+}
+function fixedOutput(ast: SchemaAST.AST): boolean {
+	if (ast._tag === "Union") {
+		return ast.types.every(fixedOutput);
+	}
+	return ast._tag === "Objects" && ast.indexSignatures.length === 0;
+}
+export function maskedValue(ast: SchemaAST.AST, keys: ReadonlySet<string>, seen = new Set<SchemaAST.AST>()): boolean {
+	if (seen.has(ast)) {
+		return false;
+	}
+	seen.add(ast);
+	if (marked(ast)) {
+		return true;
+	}
+	let source = ast;
+	let sensitive = false;
+	for (const link of ast.encoding ?? []) {
+		sensitive ||= containsSensitive(source, keys);
+		if (sensitive && !fixedOutput(link.to)) {
+			return true;
+		}
+		source = link.to;
+	}
+	const nested = ast._tag === "Objects" ? ast.indexSignatures.map((index) => index.type) : children(ast);
+	return nested.some((type) => maskedValue(type, keys, seen));
+}
+export function collect(ast: SchemaAST.AST, nodes: Set<SchemaAST.AST>, encodings = true) {
+	if (nodes.has(ast)) {
+		return;
+	}
+	nodes.add(ast);
+	for (const child of [...children(ast), ...(encodings ? (ast.encoding?.map((link) => link.to) ?? []) : [])]) {
+		collect(child, nodes, encodings);
+	}
+}
+function propertiesOf(ast: SchemaAST.AST) {
+	const nodes = new Set<SchemaAST.AST>();
+	collect(ast, nodes, false);
+	return [...nodes].flatMap((node) => (node._tag === "Objects" ? node.propertySignatures : []));
+}
+export function collectFieldKeys(properties: SchemaAST.Objects["propertySignatures"], keys: Set<string>, sensitive: (ast: SchemaAST.AST) => boolean) {
+	for (const property of properties) {
+		if (typeof property.name === "string" && sensitive(property.type)) {
+			keys.add(property.name);
+		}
+	}
+}

package/src/schemaSensitiveKeys.ts

@@ -0,0 +1,49 @@
+import type { Schema, SchemaAST } from "effect";
+import { Rpc, type RpcGroup } from "effect/rpc";
+import { collect, collectEncodedKeys, collectFieldKeys, marked, maskedValue } from "#schemaSensitiveAst.ts";
+import { isSensitiveKey } from "#sensitive.ts";
+
+function rpcSensitiveKeys(rpc: Rpc.AnyWithProps, extra: readonly string[]) {
+	const keys = new Set(extra);
+	const nodes = new Set<SchemaAST.AST>();
+	const schemas: Schema.Top[] = [
+		rpc.payloadSchema,
+		rpc.successSchema,
+		rpc.errorSchema,
+		rpc.defectSchema,
+		...[...rpc.middlewares].map((m) => m.error),
+	];
+	for (const schema of schemas) {
+		collect(schema.ast, nodes);
+	}
+	const properties = [...nodes].flatMap((ast) => (ast._tag === "Objects" ? ast.propertySignatures : []));
+	collectFieldKeys(properties, keys, marked);
+	let previousSize: number;
+	do {
+		previousSize = keys.size;
+		collectFieldKeys(properties, keys, (ast) => maskedValue(ast, keys));
+		for (const ast of nodes) {
+			collectEncodedKeys(ast, keys);
+		}
+	} while (keys.size !== previousSize);
+	return Object.assign((key: string) => keys.has(key) || isSensitiveKey(key), {
+		die: maskedValue(rpc.defectSchema.ast, keys),
+		fail: [rpc.errorSchema, ...[...rpc.middlewares].map((m) => m.error)].some((schema) => maskedValue(schema.ast, keys)),
+	});
+}
+export function schemaSensitiveKeys<R extends Rpc.Any>(group: RpcGroup.RpcGroup<R>, extra: readonly string[] = []) {
+	const policies = new Map<string, ReturnType<typeof rpcSensitiveKeys>>();
+	for (const rpc of group.requests.values()) {
+		if (Rpc.isRpc(rpc)) {
+			policies.set(rpc._tag, rpcSensitiveKeys(rpc, extra));
+		}
+	}
+	function sensitive(key: string) {
+		return extra.includes(key) || isSensitiveKey(key) || [...policies.values()].some((policy) => policy(key));
+	}
+	return Object.assign(sensitive, {
+		forRpc: (tag: string | undefined) => (tag === undefined ? sensitive : (policies.get(tag) ?? sensitive)),
+		maskFailure: (tag: string | undefined, reason: "Fail" | "Die") =>
+			[...policies].some(([method, policy]) => (tag === undefined || tag === method) && (reason === "Fail" ? policy.fail : policy.die)),
+	});
+}

package/src/sensitive.ts

@@ -1,3 +1,5 @@
+import { Option, Schema } from "effect";
+
 export const REDACTED = "<redacted>";
 const MAX_STRING = 2048;
 const SENSITIVE_PARTS = [
@@ -21,7 +23,7 @@ const SENSITIVE_PARTS = [
 	"xsrf",
 ];
 const SENSITIVE_WORDS = ["otp", "pin", "cvv", "cvc", "ssn", "iban"];
-const SENSITIVE_NAMES = ["session", "pan", "sig"];
+const SENSITIVE_NAMES = ["session", "pan", "sig", "db.user", "db.user.name", "db.connectionstring"];
 export type SensitiveKey = (key: string) => boolean;
 function wordsOf(key: string): string[] {
 	return key
@@ -41,7 +43,6 @@ export function isSensitiveKey(key: string): boolean {
 const AUTH_SCHEME = /\b(?<scheme>Bearer|Basic)\s+[A-Za-z0-9%._~+/-]+=*/giu;
 const JWT = /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*/gu;
 const PRIVATE_KEY = /-----BEGIN (?<kind>(?:[A-Z0-9]+ )*PRIVATE KEY)-----[\s\S]*?-----END \k<kind>-----/gu;
-const URL_PASSWORD = /(?<authority>\/\/[^:/\s@]+:)[^@/\s]+@/gu;
 function redactAssignments(text: string, sensitive: SensitiveKey): string {
 	const matcher = /(?<key>[A-Za-z][\w.-]*)(?<separator>["']?\s*[=:]\s*["']?)(?<value>[^\s"'&,;]+)/gu;
 	let result = "";
@@ -60,15 +61,11 @@ function redactAssignments(text: string, sensitive: SensitiveKey): string {
 	return result + text.slice(cursor);
 }
 function scrub(text: string, sensitive: SensitiveKey): string {
-	const credentials = text
-		.replaceAll(PRIVATE_KEY, REDACTED)
-		.replaceAll(AUTH_SCHEME, `$<scheme> ${REDACTED}`)
-		.replaceAll(JWT, REDACTED)
-		.replaceAll(URL_PASSWORD, `$<authority>${REDACTED}@`);
+	const credentials = text.replaceAll(PRIVATE_KEY, REDACTED).replaceAll(AUTH_SCHEME, `$<scheme> ${REDACTED}`).replaceAll(JWT, REDACTED);
 	return redactAssignments(credentials, sensitive);
 }
-export function redactText(text: string, sensitive: SensitiveKey, maxLength = MAX_STRING): string {
-	const scrubbed = scrub(text, sensitive);
+export function redactText(text: string, sensitive: SensitiveKey, maxLength = MAX_STRING, key = ""): string {
+	const scrubbed = scrub(redactUrl(text, key), sensitive);
 	return scrubbed.length > maxLength ? `${scrubbed.slice(0, maxLength)}…<${scrubbed.length - maxLength} more chars>` : scrubbed;
 }
 export function redactErrorStack(error: Error, sensitive: SensitiveKey): string | undefined {
@@ -77,3 +74,51 @@ export function redactErrorStack(error: Error, sensitive: SensitiveKey): string
 	}
 	return ["message", "name", "stack"].some((key) => sensitive(key)) ? REDACTED : redactText(error.stack, sensitive);
 }
+
+function query(value: string): string {
+	return value
+		.split("&")
+		.map((part) => (part === "" ? part : `${part.split("=", 1)[0]}=${REDACTED}`))
+		.join("&");
+}
+
+function url(value: string): string {
+	const fragment = value.indexOf("#");
+	const target = fragment === -1 ? value : value.slice(0, fragment);
+	const separator = target.indexOf("?");
+	return (
+		(separator === -1 ? target : `${target.slice(0, separator + 1)}${query(target.slice(separator + 1))}`).replaceAll(
+			/(?<authority>(?:\b[a-z][a-z0-9+.-]*:)?\/\/)[^/?#]*@/giu,
+			`$<authority>${REDACTED}@`,
+		) + (fragment === -1 ? "" : `#${REDACTED}`)
+	);
+}
+
+const structuredUrl = Schema.decodeUnknownOption(
+	Schema.fromJsonString(Schema.Unknown, {
+		reviver: (key: string, item: unknown) => (typeof item === "string" ? redactUrl(item, key) : item),
+	}),
+);
+function structured(value: string): string | undefined {
+	return Option.getOrUndefined(Option.map(structuredUrl(value), (parsed) => JSON.stringify(parsed)));
+}
+
+export function redactUrl(value: string, key = ""): string {
+	if (/(?:^|[._-])(?:fragment|userinfo|username|password)$/iu.test(key)) {
+		return REDACTED;
+	}
+	if (/(?:^|[._-])query$/iu.test(key)) {
+		return url(`?${value}`).slice(1);
+	}
+	if (/(?:^|[._-])(?:url|uri|target)(?:$|[._-])/iu.test(key) || /(?:^|[._-])(?:referer|referrer|location|origin)$/iu.test(key)) {
+		return url(value);
+	}
+	if (/^\s*[[{]/u.test(value)) {
+		const redacted = structured(value);
+		if (redacted !== undefined) {
+			return redacted;
+		}
+	}
+	// Quotes and whitespace can belong to secret values, so free text has no safe closing delimiter.
+	return value.replaceAll(/(?:[a-z][a-z0-9+.-]*:\/\/|[/?#]).*/gisu, url);
+}

package/src/taxonomy.ts

@@ -12,3 +12,34 @@ export class TooManyRequests extends Schema.TaggedError<TooManyRequests>()("TooM
 export class AuthUnavailable extends Schema.TaggedError<AuthUnavailable>()("AuthUnavailable", described) {}
 export class InternalServerError extends Schema.TaggedError<InternalServerError>()("InternalServerError", described) {}
 export class ServiceUnavailable extends Schema.TaggedError<ServiceUnavailable>()("ServiceUnavailable", described) {}
+
+export function isNotFound(value: unknown): value is NotFound {
+	return value instanceof NotFound;
+}
+export function isUnauthorized(value: unknown): value is Unauthorized {
+	return value instanceof Unauthorized;
+}
+export function isForbidden(value: unknown): value is Forbidden {
+	return value instanceof Forbidden;
+}
+export function isBadRequest(value: unknown): value is BadRequest {
+	return value instanceof BadRequest;
+}
+export function isConflict(value: unknown): value is Conflict {
+	return value instanceof Conflict;
+}
+export function isPreconditionFailed(value: unknown): value is PreconditionFailed {
+	return value instanceof PreconditionFailed;
+}
+export function isTooManyRequests(value: unknown): value is TooManyRequests {
+	return value instanceof TooManyRequests;
+}
+export function isAuthUnavailable(value: unknown): value is AuthUnavailable {
+	return value instanceof AuthUnavailable;
+}
+export function isInternalServerError(value: unknown): value is InternalServerError {
+	return value instanceof InternalServerError;
+}
+export function isServiceUnavailable(value: unknown): value is ServiceUnavailable {
+	return value instanceof ServiceUnavailable;
+}